@lifestreamdynamics/vault-cli 1.3.7 → 1.3.9

package/dist/commands/mfa.js

@@ -1,158 +1,208 @@
 import chalk from 'chalk';
-import ora from 'ora';
 import { getClientAsync } from '../client.js';
+import { addGlobalFlags, resolveFlags } from '../utils/flags.js';
+import { createOutput, handleError } from '../utils/output.js';
 import { promptPassword, promptMfaCode } from '../utils/prompt.js';
 export function registerMfaCommands(program) {
     const mfa = program.command('mfa')
         .description('Multi-factor authentication management (requires JWT auth — use "lsvault auth login" first)')
         .addHelpText('after', '\nNOTE: MFA management requires JWT authentication. API key auth is not sufficient.\nRun "lsvault auth login" to authenticate with email/password first.');
-    mfa.command('status')
-        .description('Show MFA status and configured methods')
-        .action(async () => {
-        const spinner = ora('Fetching MFA status...').start();
+    addGlobalFlags(mfa.command('status')
+        .description('Show MFA status and configured methods'))
+        .action(async (_opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        out.startSpinner('Fetching MFA status...');
         try {
             const client = await getClientAsync();
             const status = await client.mfa.getStatus();
-            spinner.stop();
-            console.log(chalk.bold('MFA Status'));
-            console.log(`  Enabled:              ${status.mfaEnabled ? chalk.green('Yes') : chalk.dim('No')}`);
-            console.log(`  TOTP Configured:      ${status.totpConfigured ? chalk.green('Yes') : chalk.dim('No')}`);
-            console.log(`  Passkeys Registered:  ${status.passkeyCount > 0 ? chalk.cyan(status.passkeyCount) : chalk.dim('0')}`);
-            console.log(`  Backup Codes Left:    ${status.backupCodesRemaining > 0 ? chalk.cyan(status.backupCodesRemaining) : chalk.yellow('0')}`);
-            if (status.passkeys.length > 0) {
-                console.log('');
-                console.log(chalk.bold('Registered Passkeys:'));
-                for (const passkey of status.passkeys) {
-                    const lastUsed = passkey.lastUsedAt
-                        ? new Date(passkey.lastUsedAt).toLocaleDateString()
-                        : chalk.dim('never');
-                    console.log(`  - ${chalk.cyan(passkey.name)} (last used: ${lastUsed})`);
+            out.stopSpinner();
+            if (flags.output === 'json') {
+                out.record({
+                    mfaEnabled: status.mfaEnabled,
+                    totpConfigured: status.totpConfigured,
+                    passkeyCount: status.passkeyCount,
+                    backupCodesRemaining: status.backupCodesRemaining,
+                    passkeys: status.passkeys,
+                });
+            }
+            else {
+                out.raw(chalk.bold('MFA Status') + '\n');
+                out.raw(`  Enabled:              ${status.mfaEnabled ? chalk.green('Yes') : chalk.dim('No')}\n`);
+                out.raw(`  TOTP Configured:      ${status.totpConfigured ? chalk.green('Yes') : chalk.dim('No')}\n`);
+                out.raw(`  Passkeys Registered:  ${status.passkeyCount > 0 ? chalk.cyan(status.passkeyCount) : chalk.dim('0')}\n`);
+                out.raw(`  Backup Codes Left:    ${status.backupCodesRemaining > 0 ? chalk.cyan(status.backupCodesRemaining) : chalk.yellow('0')}\n`);
+                if (status.passkeys.length > 0) {
+                    out.raw('\n');
+                    out.raw(chalk.bold('Registered Passkeys:') + '\n');
+                    for (const passkey of status.passkeys) {
+                        const lastUsed = passkey.lastUsedAt
+                            ? new Date(passkey.lastUsedAt).toLocaleDateString()
+                            : chalk.dim('never');
+                        out.raw(`  - ${chalk.cyan(passkey.name)} (last used: ${lastUsed})\n`);
+                    }
                 }
             }
         }
         catch (err) {
-            spinner.fail('Failed to fetch MFA status');
-            console.error(err instanceof Error ? err.message : String(err));
+            out.failSpinner('Failed to fetch MFA status');
+            handleError(out, err, 'MFA management requires JWT authentication');
         }
     });
-    mfa.command('setup-totp')
-        .description('Set up TOTP authenticator app (Google Authenticator, Authy, etc.)')
-        .action(async () => {
-        const spinner = ora('Generating TOTP secret...').start();
+    addGlobalFlags(mfa.command('setup-totp')
+        .description('Set up TOTP authenticator app (Google Authenticator, Authy, etc.)'))
+        .action(async (_opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        out.startSpinner('Generating TOTP secret...');
         try {
             const client = await getClientAsync();
             const setup = await client.mfa.setupTotp();
-            spinner.stop();
-            console.log(chalk.bold('TOTP Setup'));
-            console.log('');
-            console.log(`Secret:  ${chalk.cyan(setup.secret)}`);
-            console.log('');
-            console.log('Add this URI to your authenticator app:');
-            console.log(chalk.dim(setup.otpauthUri));
-            console.log('');
-            console.log(chalk.yellow('Note: QR codes cannot be displayed in the terminal.'));
-            console.log(chalk.yellow('      Copy the URI above to any authenticator app that supports otpauth:// URIs.'));
-            console.log('');
-            // Prompt for verification code
+            out.stopSpinner();
+            if (flags.output === 'json') {
+                out.record({ secret: setup.secret, otpauthUri: setup.otpauthUri });
+            }
+            else {
+                out.raw(chalk.bold('TOTP Setup') + '\n');
+                out.raw('\n');
+                out.raw(`Secret:  ${chalk.cyan(setup.secret)}\n`);
+                out.raw('\n');
+                out.raw('Add this URI to your authenticator app:\n');
+                out.raw(chalk.dim(setup.otpauthUri) + '\n');
+                out.raw('\n');
+                out.raw(chalk.yellow('Note: QR codes cannot be displayed in the terminal.') + '\n');
+                out.raw(chalk.yellow('      Copy the URI above to any authenticator app that supports otpauth:// URIs.') + '\n');
+                out.raw('\n');
+            }
+            // Prompt for verification code — skip in quiet mode
+            if (flags.quiet)
+                return;
             const code = await promptMfaCode();
             if (!code) {
-                console.log(chalk.yellow('Setup cancelled.'));
+                out.status(chalk.yellow('Setup cancelled.'));
                 return;
             }
-            const verifySpinner = ora('Verifying code and enabling TOTP...').start();
+            out.startSpinner('Verifying code and enabling TOTP...');
             const result = await client.mfa.verifyTotp(code);
-            verifySpinner.succeed('TOTP enabled successfully!');
-            console.log('');
-            console.log(chalk.bold.yellow('IMPORTANT: Save these backup codes securely!'));
-            console.log(chalk.dim('You can use them to access your account if you lose your authenticator device.'));
-            console.log('');
-            // Display backup codes in a grid (2 columns)
-            const codes = result.backupCodes;
-            for (let i = 0; i < codes.length; i += 2) {
-                const left = codes[i] || '';
-                const right = codes[i + 1] || '';
-                console.log(`  ${chalk.cyan(left.padEnd(20))}  ${chalk.cyan(right)}`);
+            out.stopSpinner();
+            out.success('TOTP enabled successfully!');
+            if (flags.output === 'json') {
+                out.list(result.backupCodes.map((code) => ({ code })), { emptyMessage: 'No backup codes returned.' });
+            }
+            else {
+                out.raw('\n');
+                out.raw(chalk.bold.yellow('IMPORTANT: Save these backup codes securely!') + '\n');
+                out.raw(chalk.dim('You can use them to access your account if you lose your authenticator device.') + '\n');
+                out.raw('\n');
+                // Display backup codes in a grid (2 columns)
+                const codes = result.backupCodes;
+                for (let i = 0; i < codes.length; i += 2) {
+                    const left = codes[i] || '';
+                    const right = codes[i + 1] || '';
+                    out.raw(`  ${chalk.cyan(left.padEnd(20))}  ${chalk.cyan(right)}\n`);
+                }
+                out.raw('\n');
             }
-            console.log('');
         }
         catch (err) {
-            spinner.fail('TOTP setup failed');
-            console.error(err instanceof Error ? err.message : String(err));
+            handleError(out, err, 'TOTP setup failed');
         }
     });
-    mfa.command('disable-totp')
-        .description('Disable TOTP authentication (requires password)')
-        .action(async () => {
+    addGlobalFlags(mfa.command('disable-totp')
+        .description('Disable TOTP authentication (requires password)'))
+        .action(async (_opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        // Skip interactive prompt in quiet mode
+        if (flags.quiet) {
+            out.error('Password prompt required — cannot run in quiet mode without --password-stdin.');
+            process.exitCode = 1;
+            return;
+        }
         const password = await promptPassword();
         if (!password) {
-            console.log(chalk.yellow('Operation cancelled.'));
+            out.status(chalk.yellow('Operation cancelled.'));
             return;
         }
-        const spinner = ora('Disabling TOTP...').start();
+        out.startSpinner('Disabling TOTP...');
         try {
             const client = await getClientAsync();
             const result = await client.mfa.disableTotp(password);
-            spinner.succeed(result.message);
+            out.stopSpinner();
+            out.success(result.message, { message: result.message });
         }
         catch (err) {
-            spinner.fail('Failed to disable TOTP');
-            console.error(err instanceof Error ? err.message : String(err));
+            handleError(out, err, 'Failed to disable TOTP');
         }
     });
-    mfa.command('backup-codes')
+    addGlobalFlags(mfa.command('backup-codes')
         .description('Show remaining backup code count or regenerate codes')
-        .option('--regenerate', 'Generate new backup codes (requires password, invalidates old codes)')
-        .action(async (opts) => {
-        if (opts.regenerate) {
+        .option('--regenerate', 'Generate new backup codes (requires password, invalidates old codes)'))
+        .action(async (_opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        if (_opts.regenerate) {
             // Regenerate backup codes
+            if (flags.quiet) {
+                out.error('Password prompt required — cannot run in quiet mode without --password-stdin.');
+                process.exitCode = 1;
+                return;
+            }
             const password = await promptPassword();
             if (!password) {
-                console.log(chalk.yellow('Operation cancelled.'));
+                out.status(chalk.yellow('Operation cancelled.'));
                 return;
             }
-            const spinner = ora('Regenerating backup codes...').start();
+            out.startSpinner('Regenerating backup codes...');
             try {
                 const client = await getClientAsync();
                 const result = await client.mfa.regenerateBackupCodes(password);
-                spinner.succeed('Backup codes regenerated!');
-                console.log('');
-                console.log(chalk.bold.yellow('IMPORTANT: Save these new backup codes securely!'));
-                console.log(chalk.dim('All previous backup codes have been invalidated.'));
-                console.log('');
-                // Display backup codes in a grid (2 columns)
-                const codes = result.backupCodes;
-                for (let i = 0; i < codes.length; i += 2) {
-                    const left = codes[i] || '';
-                    const right = codes[i + 1] || '';
-                    console.log(`  ${chalk.cyan(left.padEnd(20))}  ${chalk.cyan(right)}`);
+                out.stopSpinner();
+                out.success('Backup codes regenerated!');
+                if (flags.output === 'json') {
+                    out.list(result.backupCodes.map((code) => ({ code })), { emptyMessage: 'No backup codes returned.' });
+                }
+                else {
+                    out.raw('\n');
+                    out.raw(chalk.bold.yellow('IMPORTANT: Save these new backup codes securely!') + '\n');
+                    out.raw(chalk.dim('All previous backup codes have been invalidated.') + '\n');
+                    out.raw('\n');
+                    // Display backup codes in a grid (2 columns)
+                    const codes = result.backupCodes;
+                    for (let i = 0; i < codes.length; i += 2) {
+                        const left = codes[i] || '';
+                        const right = codes[i + 1] || '';
+                        out.raw(`  ${chalk.cyan(left.padEnd(20))}  ${chalk.cyan(right)}\n`);
+                    }
+                    out.raw('\n');
                 }
-                console.log('');
             }
             catch (err) {
-                spinner.fail('Failed to regenerate backup codes');
-                console.error(err instanceof Error ? err.message : String(err));
-                process.exitCode = 1;
+                handleError(out, err, 'Failed to regenerate backup codes');
             }
         }
         else {
             // Show backup code count
-            const spinner = ora('Fetching backup code count...').start();
+            out.startSpinner('Fetching backup code count...');
             try {
                 const client = await getClientAsync();
                 const status = await client.mfa.getStatus();
-                spinner.stop();
-                console.log(chalk.bold('Backup Codes'));
-                console.log(`  Remaining: ${status.backupCodesRemaining > 0 ? chalk.cyan(status.backupCodesRemaining) : chalk.yellow('0')}`);
-                if (status.backupCodesRemaining === 0) {
-                    console.log('');
-                    console.log(chalk.yellow('You have no backup codes remaining.'));
-                    console.log(chalk.yellow('Run `lsvault mfa backup-codes --regenerate` to generate new codes.'));
+                out.stopSpinner();
+                if (flags.output === 'json') {
+                    out.record({ backupCodesRemaining: status.backupCodesRemaining });
+                }
+                else {
+                    out.raw(chalk.bold('Backup Codes') + '\n');
+                    out.raw(`  Remaining: ${status.backupCodesRemaining > 0 ? chalk.cyan(status.backupCodesRemaining) : chalk.yellow('0')}\n`);
+                    if (status.backupCodesRemaining === 0) {
+                        out.raw('\n');
+                        out.raw(chalk.yellow('You have no backup codes remaining.') + '\n');
+                        out.raw(chalk.yellow('Run `lsvault mfa backup-codes --regenerate` to generate new codes.') + '\n');
+                    }
                 }
             }
             catch (err) {
-                spinner.fail('Failed to fetch backup code count');
-                console.error(err instanceof Error ? err.message : String(err));
-                process.exitCode = 1;
+                handleError(out, err, 'Failed to fetch backup code count');
             }
         }
     });

package/dist/commands/plugins.js

@@ -44,7 +44,7 @@ export function registerPluginCommands(program) {
     addGlobalFlags(plugins.command('install')
         .description('Install a plugin from the marketplace')
         .requiredOption('--plugin-id <pluginId>', 'Plugin marketplace identifier (e.g. org/plugin-name)')
-        .requiredOption('--version <version>', 'Version to install'))
+        .requiredOption('--plugin-version <version>', 'Version to install'))
         .action(async (_opts) => {
         const flags = resolveFlags(_opts);
         const out = createOutput(flags);
@@ -53,7 +53,7 @@ export function registerPluginCommands(program) {
             const client = await getClientAsync();
             const installed = await client.plugins.install({
                 pluginId: _opts.pluginId,
-                version: _opts.version,
+                version: _opts.pluginVersion,
             });
             out.stopSpinner();
             if (flags.output === 'json') {

package/dist/commands/publish-vault.js

@@ -2,6 +2,7 @@ import chalk from 'chalk';
 import { getClientAsync } from '../client.js';
 import { addGlobalFlags, resolveFlags } from '../utils/flags.js';
 import { createOutput, handleError } from '../utils/output.js';
+import { confirmAction } from '../utils/confirm.js';
 export function registerPublishVaultCommands(program) {
     const pv = program.command('publish-vault').description('Manage whole-vault publishing (public sites)');
     addGlobalFlags(pv.command('list')
@@ -37,7 +38,7 @@ export function registerPublishVaultCommands(program) {
         .option('--description <desc>', 'Site description')
         .option('--show-sidebar', 'Show sidebar navigation')
         .option('--enable-search', 'Enable search on the site')
-        .option('--theme <theme>', 'Site theme')
+        .option('--theme <theme>', 'Site theme (e.g. default, minimal, blog, docs)')
         .option('--domain <domainId>', 'Custom domain ID'))
         .action(async (vaultId, _opts) => {
         const flags = resolveFlags(_opts);
@@ -68,7 +69,7 @@ export function registerPublishVaultCommands(program) {
         .option('--description <desc>', 'Site description')
         .option('--show-sidebar', 'Show sidebar')
         .option('--enable-search', 'Enable search')
-        .option('--theme <theme>', 'Site theme')
+        .option('--theme <theme>', 'Site theme (e.g. default, minimal, blog, docs)')
         .option('--domain <domainId>', 'Custom domain ID'))
         .action(async (vaultId, _opts) => {
         const flags = resolveFlags(_opts);
@@ -100,12 +101,18 @@ export function registerPublishVaultCommands(program) {
     });
     addGlobalFlags(pv.command('unpublish')
         .description('Unpublish a vault site')
-        .argument('<vaultId>', 'Vault ID'))
+        .argument('<vaultId>', 'Vault ID')
+        .option('-y, --yes', 'Skip confirmation prompt'))
         .action(async (vaultId, _opts) => {
         const flags = resolveFlags(_opts);
         const out = createOutput(flags);
-        out.startSpinner('Unpublishing vault...');
         try {
+            const confirmed = await confirmAction(`Unpublish vault site for vault ${vaultId}?`, { yes: _opts.yes });
+            if (!confirmed) {
+                out.status('Unpublish cancelled.');
+                return;
+            }
+            out.startSpinner('Unpublishing vault...');
             const client = await getClientAsync();
             await client.publishVault.unpublish(vaultId);
             out.success('Vault unpublished', { vaultId });

package/dist/commands/publish.js

@@ -3,6 +3,7 @@ import { getClientAsync } from '../client.js';
 import { addGlobalFlags, resolveFlags } from '../utils/flags.js';
 import { createOutput, handleError } from '../utils/output.js';
 import { resolveVaultId } from '../utils/resolve-vault.js';
+import { loadConfigAsync } from '../config.js';
 export function registerPublishCommands(program) {
     const publish = program.command('publish').description('Publish documents to public profile pages');
     addGlobalFlags(publish.command('list')
@@ -63,6 +64,7 @@ export function registerPublishCommands(program) {
         out.startSpinner('Publishing document...');
         try {
             vaultId = await resolveVaultId(vaultId);
+            out.debug(`API: POST publish ${vaultId}/${docPath}`);
             const client = await getClientAsync();
             const params = {
                 slug: String(_opts.slug),
@@ -74,9 +76,11 @@ export function registerPublishCommands(program) {
             if (_opts.ogImage)
                 params.ogImage = String(_opts.ogImage);
             const pub = await client.publish.create(vaultId, docPath, params);
+            const config = await loadConfigAsync();
+            const baseUrl = config.apiUrl.replace(/\/api\/v\d+\/?$/, '');
             out.success('Document published successfully!', {
                 slug: pub.slug,
-                url: `/${pub.publishedBy}/${pub.slug}`,
+                url: `${baseUrl}/${pub.publishedBy}/${pub.slug}`,
                 isPublished: pub.isPublished,
                 seoTitle: pub.seoTitle || null,
                 seoDescription: pub.seoDescription || null,

package/dist/commands/saml.js

@@ -3,7 +3,9 @@ import { getClientAsync } from '../client.js';
 import { addGlobalFlags, resolveFlags } from '../utils/flags.js';
 import { createOutput, handleError } from '../utils/output.js';
 export function registerSamlCommands(program) {
-    const saml = program.command('saml').description('SAML SSO configuration management (requires admin role)');
+    const saml = program.command('saml')
+        .description('SAML SSO configuration management (requires admin role)')
+        .addHelpText('after', '\nNOTE: SAML commands require JWT authentication with admin role.\nRun "lsvault auth login" to authenticate first.');
     // ── list-configs ─────────────────────────────────────────────────────────
     addGlobalFlags(saml.command('list-configs')
         .description('List all SSO configurations'))
@@ -154,12 +156,14 @@ export function registerSamlCommands(program) {
     addGlobalFlags(saml.command('delete-config')
         .description('Delete an SSO configuration')
         .argument('<id>', 'SSO config ID')
-        .option('--force', 'Skip confirmation prompt'))
+        .option('--force', 'Skip confirmation prompt')
+        .option('-y, --yes', 'Alias for --force'))
         .action(async (id, _opts) => {
         const flags = resolveFlags(_opts);
         const out = createOutput(flags);
-        if (!_opts.force) {
-            out.raw(chalk.yellow(`Pass --force to delete SSO config ${id}.`) + '\n');
+        if (!_opts.force && !_opts.yes) {
+            out.warn(`Pass --force to delete SSO config ${id}.`);
+            process.exitCode = 1;
             return;
         }
         out.startSpinner('Deleting SSO config...');
@@ -203,6 +207,11 @@ export function registerSamlCommands(program) {
         .action(async (slug, _opts) => {
         const flags = resolveFlags(_opts);
         const out = createOutput(flags);
+        if (!slug || !slug.trim()) {
+            out.error('Slug cannot be empty.');
+            process.exitCode = 1;
+            return;
+        }
         try {
             const client = await getClientAsync();
             const url = client.saml.getLoginUrl(slug);

package/dist/commands/search.js

@@ -16,7 +16,11 @@ EXAMPLES
   lsvault search "meeting notes"
   lsvault search "project plan" --vault abc123
   lsvault search "typescript" --tags dev,code --limit 5
-  lsvault search "machine learning" --mode semantic`))
+  lsvault search "machine learning" --mode semantic
+
+NOTE
+  Semantic search (--mode semantic) requires the embedding worker to have
+  processed documents. If results are empty, ensure the worker is running.`))
         .action(async (query, _opts) => {
         const flags = resolveFlags(_opts);
         const out = createOutput(flags);

package/dist/commands/shares.js

@@ -5,6 +5,7 @@ import { addGlobalFlags, resolveFlags } from '../utils/flags.js';
 import { createOutput, handleError } from '../utils/output.js';
 import { promptPassword, readPasswordFromStdin } from '../utils/prompt.js';
 import { resolveVaultId } from '../utils/resolve-vault.js';
+import { confirmAction } from '../utils/confirm.js';
 export function registerShareCommands(program) {
     const shares = program.command('shares').description('Create, list, and revoke document share links');
     addGlobalFlags(shares.command('list')
@@ -134,12 +135,18 @@ export function registerShareCommands(program) {
     addGlobalFlags(shares.command('revoke')
         .description('Revoke a share link')
         .argument('<vaultId>', 'Vault ID or slug')
-        .argument('<shareId>', 'Share link ID'))
+        .argument('<shareId>', 'Share link ID')
+        .option('-y, --yes', 'Skip confirmation prompt'))
         .action(async (vaultId, shareId, _opts) => {
         const flags = resolveFlags(_opts);
         const out = createOutput(flags);
-        out.startSpinner('Revoking share link...');
         try {
+            const confirmed = await confirmAction(`Revoke share link ${shareId}?`, { yes: _opts.yes });
+            if (!confirmed) {
+                out.status('Revoke cancelled.');
+                return;
+            }
+            out.startSpinner('Revoking share link...');
             vaultId = await resolveVaultId(vaultId);
             const client = await getClientAsync();
             await client.shares.revoke(vaultId, shareId);

package/dist/commands/sync.js

@@ -4,6 +4,7 @@ import chalk from 'chalk';
 import { getClientAsync } from '../client.js';
 import { addGlobalFlags, resolveFlags } from '../utils/flags.js';
 import { createOutput, handleError } from '../utils/output.js';
+import { confirmAction } from '../utils/confirm.js';
 import { formatUptime } from '../utils/format.js';
 import { loadSyncConfigs, createSyncConfig, deleteSyncConfig, getSyncConfig, } from '../sync/config.js';
 import { deleteSyncState, loadSyncState, saveSyncState, hashFileContent, buildRemoteFileState } from '../sync/state.js';
@@ -124,12 +125,18 @@ Sync modes:
     // sync delete <syncId>
     addGlobalFlags(sync.command('delete')
         .description('Delete a sync configuration')
-        .argument('<syncId>', 'Sync configuration ID'))
+        .argument('<syncId>', 'Sync configuration ID')
+        .option('-y, --yes', 'Skip confirmation prompt'))
         .action(async (syncId, _opts) => {
         const flags = resolveFlags(_opts);
         const out = createOutput(flags);
-        out.startSpinner('Deleting sync configuration...');
         try {
+            const confirmed = await confirmAction(`Delete sync configuration ${syncId}?`, { yes: _opts.yes });
+            if (!confirmed) {
+                out.status('Delete cancelled.');
+                return;
+            }
+            out.startSpinner('Deleting sync configuration...');
             const deleted = deleteSyncConfig(syncId);
             if (!deleted) {
                 out.failSpinner('Sync configuration not found');
@@ -274,8 +281,6 @@ Sync modes:
             }
             out.stopSpinner();
             if (flags.dryRun) {
-                out.status(chalk.yellow('Dry run — no changes will be made:'));
-                out.status(formatDiff(diff));
                 if (flags.output === 'json') {
                     out.record({
                         dryRun: true,
@@ -285,6 +290,10 @@ Sync modes:
                         totalBytes: diff.totalBytes,
                     });
                 }
+                else {
+                    out.status(chalk.yellow('Dry run — no changes will be made:'));
+                    out.status(formatDiff(diff));
+                }
                 return;
             }
             if (flags.verbose) {

package/dist/commands/teams.js

@@ -2,6 +2,7 @@ import chalk from 'chalk';
 import { getClientAsync } from '../client.js';
 import { addGlobalFlags, resolveFlags } from '../utils/flags.js';
 import { createOutput, handleError } from '../utils/output.js';
+import { confirmAction } from '../utils/confirm.js';
 export function registerTeamCommands(program) {
     const teams = program.command('teams').description('Manage teams, members, invitations, and shared vaults');
     // ── Team CRUD ──────────────────────────────────────────────────────
@@ -12,8 +13,10 @@ export function registerTeamCommands(program) {
         const out = createOutput(flags);
         out.startSpinner('Fetching teams...');
         try {
+            out.debug('API: GET teams');
             const client = await getClientAsync();
             const teamList = await client.teams.list();
+            out.debug(`Response: ${teamList.length} teams`);
             out.stopSpinner();
             out.list(teamList.map(t => ({ name: t.name, id: t.id, description: t.description || 'No description' })), {
                 emptyMessage: 'No teams found.',
@@ -152,7 +155,7 @@ EXAMPLES
         .description('Update a member role')
         .argument('<teamId>', 'Team ID')
         .argument('<userId>', 'User ID')
-        .requiredOption('-r, --role <role>', 'New role (admin or member)'))
+        .requiredOption('-r, --role <role>', 'New role: admin, editor, or viewer'))
         .action(async (teamId, userId, _opts) => {
         const flags = resolveFlags(_opts);
         const out = createOutput(flags);
@@ -195,10 +198,16 @@ EXAMPLES
     });
     addGlobalFlags(teams.command('leave')
         .description('Leave a team')
-        .argument('<teamId>', 'Team ID'))
+        .argument('<teamId>', 'Team ID')
+        .option('-y, --yes', 'Skip confirmation prompt'))
         .action(async (teamId, _opts) => {
         const flags = resolveFlags(_opts);
         const out = createOutput(flags);
+        const confirmed = await confirmAction(`Are you sure you want to leave team ${teamId}?`, { yes: !!_opts.yes });
+        if (!confirmed) {
+            out.status('Cancelled.');
+            return;
+        }
         out.startSpinner('Leaving team...');
         try {
             const client = await getClientAsync();
@@ -245,11 +254,11 @@ EXAMPLES
         .description('Invite a user to the team')
         .argument('<teamId>', 'Team ID')
         .argument('<email>', 'Email address')
-        .requiredOption('-r, --role <role>', 'Role (admin or member)'))
+        .requiredOption('-r, --role <role>', 'Role to assign: admin, editor, or viewer (default: editor)'))
         .action(async (teamId, email, _opts) => {
         const flags = resolveFlags(_opts);
         const out = createOutput(flags);
-        const role = String(_opts.role);
+        const role = (String(_opts.role) || 'editor');
         out.startSpinner('Sending invitation...');
         try {
             const client = await getClientAsync();
@@ -267,10 +276,16 @@ EXAMPLES
     addGlobalFlags(invitations.command('revoke')
         .description('Revoke a pending invitation')
         .argument('<teamId>', 'Team ID')
-        .argument('<invitationId>', 'Invitation ID'))
+        .argument('<invitationId>', 'Invitation ID')
+        .option('-y, --yes', 'Skip confirmation prompt'))
         .action(async (teamId, invitationId, _opts) => {
         const flags = resolveFlags(_opts);
         const out = createOutput(flags);
+        const confirmed = await confirmAction(`Revoke invitation ${invitationId}?`, { yes: !!_opts.yes });
+        if (!confirmed) {
+            out.status('Cancelled.');
+            return;
+        }
         out.startSpinner('Revoking invitation...');
         try {
             const client = await getClientAsync();

package/dist/commands/user.js

@@ -5,6 +5,7 @@ import { addGlobalFlags, resolveFlags } from '../utils/flags.js';
 import { createOutput, handleError } from '../utils/output.js';
 import { formatBytes } from '../utils/format.js';
 import { promptPassword, readPasswordFromStdin } from '../utils/prompt.js';
+import { confirmAction } from '../utils/confirm.js';
 export function registerUserCommands(program) {
     const user = program.command('user').description('View account details and storage usage');
     addGlobalFlags(user.command('storage')
@@ -176,10 +177,16 @@ export function registerUserCommands(program) {
         .description('Request account deletion')
         .option('--password-stdin', 'Read password from stdin for CI usage')
         .option('--reason <reason>', 'Reason for deletion')
-        .option('--export-data', 'Request data export before deletion'))
+        .option('--export-data', 'Request data export before deletion')
+        .option('-y, --yes', 'Skip confirmation prompt'))
         .action(async (_opts) => {
         const flags = resolveFlags(_opts);
         const out = createOutput(flags);
+        const confirmed = await confirmAction('Are you sure you want to delete your account? This cannot be undone.', { yes: _opts.yes });
+        if (!confirmed) {
+            out.status('Account deletion cancelled.');
+            return;
+        }
         let password;
         if (_opts.passwordStdin) {
             password = await readPasswordFromStdin();