Remove account-wide delete-all verbs; gate remaining destructive ops

qn stream delete-all and qn webhook delete-all are gone. A one-line
account-wide wipe is a disproportionate blast radius for a CLI command;
that operation belongs behind the API where callers script it
deliberately.

Newly confirmation-gated (Mild: --yes skips, TTY prompts, scripts get
exit 5 before any request is sent):
- endpoint bulk pause — prompt includes the endpoint count
- endpoint security token delete — notes that clients lose access
- endpoint rate-limit delete-override — notes the revert to plan limits

bulk resume stays ungated (it restores service). Existing prompts now
state the blast radius (archive is irreversible from the CLI, tag
delete is account-wide). The kv-local confirm_mild helper moved to
confirm::confirm_mild for reuse. Severity::Severe and prompt_typed
remain for future wide-blast-radius gates.

CLAUDE.md now records the severity policy; README documents the
confirmation model. Tests: each gated command verifies exit 5 with
zero requests reaching the mock without --yes, and exit 0 with it.

Author: johnpmitsch

CLAUDE.md

@@ -73,7 +73,13 @@ Things to verify for each new endpoint:
 - **Negative numbers**: any `i64` flag that accepts `-1` (`--end`, etc.) needs `#[arg(long, allow_hyphen_values = true)]` or clap will read it as another flag.
 - **Multi-value flags**: prefer repeatable `--method foo --method bar` (clap `Vec<String>` with `#[arg(long = "method")]`). Optionally also accept `--methods foo,bar` via a second field with `value_delimiter = ','`. The command body extends one into the other.
 - **Large `Args` structs**: clippy's `large_enum_variant` will reject an enum variant whose payload is > ~200 bytes. Box it: `Create(Box<CreateArgs>)` (we hit this on `StreamCmd::Create` and `WebhookCmd::Create`).
-- **Destructive operations**: route through `confirm::decide_without_prompt(Severity::Mild|Severe, ConfirmCfg)`. Mild = single `--yes` skips, TTY prompts otherwise. Severe = `--yes --yes` skips OR user types a literal word (`delete-all`). Non-TTY without enough `--yes` returns `CliError::NeedsConfirmation` (exit 5).
+- **Destructive operations**: the policy is non-negotiable —
+  - Anything that deletes, revokes, or loosens protection (delete/archive verbs, token revocation, removing a rate-limit override, pausing many endpoints) gets **at least `Severity::Mild`**: single `--yes` skips, TTY prompts otherwise, non-TTY without `--yes` returns `CliError::NeedsConfirmation` (exit 5). Use the `confirm::confirm_mild(&ctx, msg)` helper.
+  - Prompts must name the resource and the blast radius: "Pause 47 endpoint(s)? They will stop serving requests", not "Are you sure?". Include counts for bulk operations.
+  - **Account-wide wipe verbs (delete-all style) are not offered by the CLI at all.** Don't add one; point users at the API instead.
+  - Commands that restore service (`resume`, `activate`) are not gated.
+  - `Severity::Severe` (typed-word + `--yes --yes`) exists in `confirm.rs` for future wide-blast-radius operations; nothing uses it today.
+  - Every gated command needs both tests: no `--yes` non-TTY ⇒ exit 5 **and zero requests reach the mock** (`.expect(0)`); `--yes` ⇒ exit 0.
 - **Args that span multiple subcommands**: for things like rate-limits where both account-level and method-level CRUD exists, use a single `RateLimitCmd` enum with `MethodList/MethodCreate/...` variants — don't fight clap by trying to nest a third level.
 
 ### 3. Module layout

README.md

@@ -212,6 +212,17 @@ CLI hands the key to the SDK explicitly; it does not read the SDK's
 The hidden `--base-url <URL>` flag overrides the API host for all four
 sub-clients at once (used for integration tests and on-prem mirrors).
 
+## Confirmations
+
+Destructive commands (`delete`, `archive`, `bulk pause`, token revocation,
+removing a rate-limit override, …) prompt before acting, and the prompt states
+what will happen ("Pause 3 endpoint(s)? They will stop serving requests").
+Pass `--yes`/`-y` to skip the prompt. In scripts and CI (no TTY), a gated
+command without `--yes` exits with code 5 **before** any request is sent.
+
+The CLI deliberately has no account-wide wipe commands (no `delete-all`);
+operations with that blast radius belong behind the API, not a one-liner.
+
 ## Retries
 
 Read-only commands (`list`, `show`, `logs`, `metrics`, `usage`, …) retry
@@ -220,9 +231,9 @@ exponential backoff and full jitter. The default is 3 retries; tune it with
 the global `--retries <N>` flag (`--retries 0` disables).
 
 Commands that modify resources (`create`, `update`, `delete`, `pause`, …)
-**never** retry automatically: the API has no idempotency keys yet, so a
-retried create could provision twice. If a mutation fails with a transient
-error, check whether it took effect before re-running it.
+**never** retry automatically: a retried create could provision twice. If a
+mutation fails with a transient error, check whether it took effect before
+re-running it.
 
 ## Exit codes
 
@@ -233,7 +244,7 @@ error, check whether it took effect before re-running it.
 | 2 | API error (server returned 4xx/5xx) |
 | 3 | Network failure (timeout, connect, transport) |
 | 4 | Missing or invalid API key / config |
-| 5 | Operation needs confirmation (pass `--yes` or `--yes --yes`) |
+| 5 | Operation needs confirmation (pass `--yes`) |
 | 130 | Interrupted (SIGINT) |
 
 ## License

src/cli.rs

@@ -70,7 +70,7 @@ pub struct Cli {
     #[arg(long, global = true, default_value_t = 3, value_name = "N")]
     pub retries: u32,
 
-    /// Skip confirmation prompts. Pass twice for destructive bulk operations like `stream delete-all`.
+    /// Skip confirmation prompts on destructive operations.
     #[arg(short = 'y', long = "yes", global = true, action = ArgAction::Count)]
     pub yes: u8,
 

src/commands/endpoint/bulk.rs

@@ -13,6 +13,7 @@ use quicknode_sdk::admin::{
 };
 use serde::Serialize;
 
+use crate::confirm::{decide_without_prompt, prompt_yes_no, ConfirmCfg, Severity};
 use crate::context::Ctx;
 use crate::errors::CliError;
 use crate::output::{new_table, set_header_bold, write_table, OutputCtx, Render};
@@ -73,6 +74,25 @@ async fn set_status(a: IdsArgs, status: &str, ctx: Ctx) -> Result<(), CliError>
     if a.ids.is_empty() {
         return Err(CliError::Arg("supply at least one endpoint id".to_string()));
     }
+    // Pausing a fleet stops it serving requests — confirm with the blast
+    // radius spelled out. Resuming restores service, so it stays unguarded.
+    if status == "paused" {
+        let cfg = ConfirmCfg::new(
+            ctx.global.yes_count,
+            ctx.global.no_input,
+            ctx.out.stdout_is_tty,
+        );
+        let proceed = match decide_without_prompt(Severity::Mild, cfg)? {
+            true => true,
+            false => prompt_yes_no(&format!(
+                "Pause {} endpoint(s)? They will stop serving requests",
+                a.ids.len()
+            ))?,
+        };
+        if !proceed {
+            return Err(CliError::Cancelled);
+        }
+    }
     let req = BulkUpdateEndpointStatusRequest {
         ids: a.ids,
         status: status.to_string(),

src/commands/endpoint/mod.rs

@@ -281,7 +281,10 @@ async fn archive(a: ArchiveArgs, ctx: Ctx) -> Result<(), CliError> {
     );
     let proceed = match decide_without_prompt(Severity::Mild, cfg)? {
         true => true,
-        false => prompt_yes_no(&format!("Archive endpoint {}?", a.id))?,
+        false => prompt_yes_no(&format!(
+            "Archive endpoint {}? This cannot be undone from the CLI",
+            a.id
+        ))?,
     };
     if !proceed {
         return Err(CliError::Cancelled);

src/commands/endpoint/ratelimit.rs

@@ -100,6 +100,13 @@ pub async fn run(cmd: RateLimitCmd, ctx: Ctx) -> Result<(), CliError> {
         RateLimitCmd::Get { id } => get(&id, ctx).await,
         RateLimitCmd::Set(a) => set(a, ctx).await,
         RateLimitCmd::DeleteOverride { id, override_id } => {
+            crate::confirm::confirm_mild(
+                &ctx,
+                &format!(
+                    "Delete rate-limit override {override_id} on {id}? \
+                     The endpoint reverts to its plan defaults"
+                ),
+            )?;
             ctx.sdk
                 .admin
                 .delete_rate_limit_override(&id, &override_id)

src/commands/endpoint/security.rs

@@ -11,6 +11,7 @@ use quicknode_sdk::admin::{
 };
 use serde::Serialize;
 
+use crate::confirm::confirm_mild;
 use crate::context::Ctx;
 use crate::errors::CliError;
 use crate::output::{new_table, opt_cell, set_header_bold, write_table, Render};
@@ -265,6 +266,12 @@ async fn token(cmd: TokenCmd, ctx: Ctx) -> Result<(), CliError> {
             ctx.out.note(&format!("✓ Created token on {id}"));
         }
         TokenCmd::Delete { id, token_id } => {
+            confirm_mild(
+                &ctx,
+                &format!(
+                    "Delete token {token_id} on {id}? Clients authenticating with it lose access"
+                ),
+            )?;
             ctx.sdk.admin.delete_token(&id, &token_id).await?;
             ctx.out.note(&format!("✓ Deleted token {token_id} on {id}"));
         }

src/commands/endpoint/tag.rs

@@ -79,7 +79,7 @@ async fn delete(tag_id: i32, ctx: Ctx) -> Result<(), CliError> {
     );
     let proceed = match decide_without_prompt(Severity::Mild, cfg)? {
         true => true,
-        false => prompt_yes_no(&format!("Delete tag {tag_id}?"))?,
+        false => prompt_yes_no(&format!("Delete tag {tag_id} from the account?"))?,
     };
     if !proceed {
         return Err(CliError::Cancelled);

src/commands/kv/actions.rs

@@ -9,6 +9,7 @@ use quicknode_sdk::{
 
 use super::render::{ListView, ListsView, SetsView};
 use super::{ListCmd, SetCmd};
+use crate::confirm::confirm_mild;
 use crate::context::Ctx;
 use crate::errors::CliError;
 use crate::retry::retrying;
@@ -47,7 +48,7 @@ pub(super) async fn set(cmd: SetCmd, ctx: Ctx) -> Result<(), CliError> {
             crate::output::emit(&ctx.out, &SetsView(resp))?;
         }
         SetCmd::Delete { key } => {
-            super::confirm_mild(&ctx, &format!("Delete set {key:?}?"))?;
+            confirm_mild(&ctx, &format!("Delete set {key:?}?"))?;
             ctx.sdk.kvstore.delete_set(&key).await?;
             ctx.out.note(&format!("✓ Deleted set {key:?}"));
         }
@@ -160,7 +161,7 @@ pub(super) async fn list(cmd: ListCmd, ctx: Ctx) -> Result<(), CliError> {
             ctx.out.note(&format!("✓ Updated list {:?}", a.key));
         }
         ListCmd::Delete { key } => {
-            super::confirm_mild(&ctx, &format!("Delete list {key:?}?"))?;
+            confirm_mild(&ctx, &format!("Delete list {key:?}?"))?;
             ctx.sdk.kvstore.delete_list(&key).await?;
             ctx.out.note(&format!("✓ Deleted list {key:?}"));
         }

src/commands/kv/mod.rs

@@ -7,7 +7,6 @@ use std::io::{IsTerminal, Read};
 
 use clap::{Args as ClapArgs, Subcommand};
 
-use crate::confirm::{decide_without_prompt, prompt_yes_no, ConfirmCfg, Severity};
 use crate::context::Ctx;
 use crate::errors::CliError;
 
@@ -114,22 +113,6 @@ pub async fn run(args: Args, ctx: Ctx) -> Result<(), CliError> {
     }
 }
 
-fn confirm_mild(ctx: &Ctx, prompt: &str) -> Result<(), CliError> {
-    let cfg = ConfirmCfg::new(
-        ctx.global.yes_count,
-        ctx.global.no_input,
-        ctx.out.stdout_is_tty,
-    );
-    let proceed = match decide_without_prompt(Severity::Mild, cfg)? {
-        true => true,
-        false => prompt_yes_no(prompt)?,
-    };
-    if !proceed {
-        return Err(CliError::Cancelled);
-    }
-    Ok(())
-}
-
 fn read_stdin() -> Result<String, CliError> {
     if std::io::stdin().is_terminal() {
         return Err(CliError::Arg(