@kutrion/cli 1.2.12 → 1.2.14

package/dist/index.js

@@ -24054,6 +24054,49 @@ function auditResultLabel(raw) {
   return humanizeAction(raw);
 }
 
+// ../packages/shared/src/refresh-refusal-copy.ts
+init_define_KT_HUB_FILES();
+var REFRESH_REFUSAL_COPY = {
+  refresh_hub_signed_out: { title: "This session was signed out", why: "You signed out in Kutrion Hub." },
+  refresh_hub_revoked: { title: "This session was signed out", why: "This app was signed out because its Kutrion Hub was removed." },
+  refresh_credentials_changed: {
+    title: "Your password changed",
+    why: "Your password changed, so Kutrion signed this {app} out.",
+    action: "Sign in again with your new password."
+  },
+  device_revoked: {
+    title: "This device was signed out",
+    why: "This {app}'s access was withdrawn from your Kutrion account.",
+    action: "Sign in again to re-register it."
+  },
+  account_inactive: {
+    title: "This account has ended",
+    why: "Your Kutrion account is no longer active, so this {app} was signed out.",
+    action: "Your administrator can restore it. Signing in again won't work until they do."
+  },
+  user_inactive: {
+    title: "This account has ended",
+    why: "Your Kutrion account is no longer active, so this {app} was signed out.",
+    action: "Your administrator can restore it. Signing in again won't work until they do."
+  },
+  account_expired: {
+    title: "This account has expired",
+    why: "Your Kutrion account has expired, so this {app} was signed out.",
+    action: "Your administrator can restore it. Signing in again won't work until they do."
+  },
+  org_mismatch: {
+    title: "This session was signed out",
+    why: "You're no longer a member of the organization this {app} was signed in to.",
+    action: "Sign in again to continue with your current organization."
+  }
+};
+function refreshRefusalCopy(code, noun = "app") {
+  if (typeof code !== "string" || !Object.prototype.hasOwnProperty.call(REFRESH_REFUSAL_COPY, code)) return null;
+  const c = REFRESH_REFUSAL_COPY[code];
+  const fill = (s) => s.replace(/\{app\}/g, noun);
+  return { title: c.title, why: fill(c.why), ...c.action ? { action: fill(c.action) } : {} };
+}
+
 // ../packages/shared/src/client.ts
 init_define_KT_HUB_FILES();
 
@@ -27621,6 +27664,9 @@ var ApiError = class extends Error {
     this.headers = headers;
     this.name = "ApiError";
   }
+  // #3445: the `error` code /auth/refresh gave when it ended the session behind this 401, set only by
+  // the SDK's own refresh-then-replay path. `body` and `message` stay the original request's.
+  refreshCode;
   // #2747: the error class slug — the server's `error` code, or the code the SDK minted itself — or
   // null when the reply carried none (the message is then a status phrase, not a code).
   get slug() {
@@ -28053,15 +28099,22 @@ var KutrionClient = class {
           });
           const { body: signed, signerThrew } = await this.signedRefreshBody(rt);
           let res = await post(signed);
-          if (res.status === 401 && signed.signature && isRefreshSignatureRefusal(await readBodyWithin(res, REFRESH_BODY_MS))) {
-            res = await post(this.refreshBody(rt));
-            if (res.ok) this.refreshSigningRefused = true;
+          let refusalBody;
+          if (res.status === 401 && signed.signature) {
+            refusalBody = await readBodyWithin(res, REFRESH_BODY_MS);
+            if (isRefreshSignatureRefusal(refusalBody)) {
+              res = await post(this.refreshBody(rt));
+              refusalBody = void 0;
+              if (res.ok) this.refreshSigningRefused = true;
+            }
           }
           if (res.status === 401) {
-            if (signerThrew && !signed.signature && isRefreshSignatureRefusal(await readBodyWithin(res, REFRESH_BODY_MS))) {
+            if (refusalBody === void 0) refusalBody = await readBodyWithin(res, REFRESH_BODY_MS);
+            if (signerThrew && !signed.signature && isRefreshSignatureRefusal(refusalBody)) {
               return { outcome: "indeterminate", status: 401 };
             }
-            return { outcome: "rejected", status: 401 };
+            const code = refusalBody?.error;
+            return typeof code === "string" && code ? { outcome: "rejected", status: 401, code } : { outcome: "rejected", status: 401 };
           }
           if (!res.ok) {
             const body = res.status === 403 ? await readBodyWithin(res, REFRESH_BODY_MS) : void 0;
@@ -28147,6 +28200,7 @@ var KutrionClient = class {
       data = JSON.parse(await decryptEnvelope(this.sessionKey, data.enc));
     }
     if (!res.ok) {
+      let refreshCode;
       if (res.status === 401 && auth) {
         if (_retry) {
           this.onUnauthorized?.();
@@ -28156,6 +28210,9 @@ var KutrionClient = class {
             case "refreshed":
               return this.req(method, path, body, auth, true);
             case "rejected":
+              refreshCode = r.code;
+              this.onUnauthorized?.(r.code);
+              break;
             case "no_token":
               this.onUnauthorized?.();
               break;
@@ -28170,7 +28227,9 @@ var KutrionClient = class {
           }
         }
       }
-      throw new ApiError(res.status, apiErrorMessage(res.status, data), data, res.headers);
+      const err = new ApiError(res.status, apiErrorMessage(res.status, data), data, res.headers);
+      if (refreshCode) err.refreshCode = refreshCode;
+      throw err;
     }
     return data;
   }
@@ -28420,7 +28479,7 @@ var KutrionClient = class {
   // #2578: clears a factor's pending-approval mark. A step-up-pending session is refused with 403
   // step_up_required; `approved: false` means the factor was already approved.
   approveFactor(kind, id) {
-    return this.req("POST", `/auth/factors/${kind}/${encodeURIComponent(id)}/approve`);
+    return this.req("POST", `/auth/factors/${encodeURIComponent(kind)}/${encodeURIComponent(id)}/approve`);
   }
   mfaGenerateBackupCodes() {
     return this.req("POST", "/auth/mfa/backup-codes/generate");
@@ -28447,7 +28506,7 @@ var KutrionClient = class {
   // (the iOS AutoFill extension) so it rotates independently of the app and never trips the app's
   // reuse-detection. The extension persists its own rotations; the app must not share its token.
   provisionCompanionSession(deviceId) {
-    return this.req("POST", `/auth/devices/${deviceId}/companion`, {});
+    return this.req("POST", `/auth/devices/${encodeURIComponent(deviceId)}/companion`, {});
   }
   // #768: `drain_limits` is what each device's `drain.state` may and may not be said to prove. The
   // server ships the sentence so three clients cannot each invent their own; optional here only
@@ -28456,7 +28515,7 @@ var KutrionClient = class {
     return this.req("GET", "/auth/devices");
   }
   revokeDevice(id) {
-    return this.req("DELETE", `/auth/devices/${id}`, void 0);
+    return this.req("DELETE", `/auth/devices/${encodeURIComponent(id)}`, void 0);
   }
   // Rotate tokens explicitly (req() also does this transparently on 401).
   async refreshTokens(refreshToken) {
@@ -28493,7 +28552,7 @@ var KutrionClient = class {
   // nowhere else afterwards, so a caller that drops it must either re-issue (same key while it lives)
   // or rotate — and rotating deliberately kills whatever the old key was protecting.
   issueCacheKey(deviceId, opts2) {
-    return this.req("POST", `/auth/devices/${deviceId}/cache-key`, { rotate: opts2?.rotate === true });
+    return this.req("POST", `/auth/devices/${encodeURIComponent(deviceId)}/cache-key`, { rotate: opts2?.rotate === true });
   }
   // #712: drain this device's local reveal journal. The batch is MAC'd under the cache KEK; a broken
   // chain answers 409 with the head the server holds, never a silent success.
@@ -28508,10 +28567,10 @@ var KutrionClient = class {
     return this.req("POST", "/audit/journal-discarded", input);
   }
   cacheKeyStatus(deviceId) {
-    return this.req("GET", `/auth/devices/${deviceId}/cache-key`);
+    return this.req("GET", `/auth/devices/${encodeURIComponent(deviceId)}/cache-key`);
   }
   revokeCacheKey(deviceId) {
-    return this.req("DELETE", `/auth/devices/${deviceId}/cache-key`);
+    return this.req("DELETE", `/auth/devices/${encodeURIComponent(deviceId)}/cache-key`);
   }
   listCacheKeys() {
     return this.req("GET", "/auth/cache-keys");
@@ -28532,21 +28591,24 @@ var KutrionClient = class {
     return this.req("GET", "/auth/webauthn");
   }
   deletePasskey(id) {
-    return this.req("DELETE", `/auth/webauthn/${id}`);
+    return this.req("DELETE", `/auth/webauthn/${encodeURIComponent(id)}`);
+  }
+  renamePasskey(id, label) {
+    return this.req("PATCH", `/auth/webauthn/${encodeURIComponent(id)}`, { label });
   }
   // VT-120: linked sign-in methods (SSO/social identities) + set a first password for social-only accounts.
   listIdentities() {
     return this.req("GET", "/auth/identities");
   }
   unlinkIdentity(id) {
-    return this.req("DELETE", `/auth/identities/${id}`);
+    return this.req("DELETE", `/auth/identities/${encodeURIComponent(id)}`);
   }
   // #2678: begin linking a platform provider. The browser then navigates to `url`; the callback hands
   // back a handle that completeIdentityLink attaches from this same session. #2847: a native app passes
   // its registered client and the challenge for a verifier it keeps, then completes with that verifier.
   startIdentityLink(ref, binding, currentPassword) {
     const how = typeof binding === "string" ? { cb: binding } : { native: true, native_client: binding.nativeClient, native_challenge: binding.challenge };
-    return this.req("POST", `/auth/sso/${ref}/link`, { ...how, ...currentPassword ? { current_password: currentPassword } : {} });
+    return this.req("POST", `/auth/sso/${encodeURIComponent(ref)}/link`, { ...how, ...currentPassword ? { current_password: currentPassword } : {} });
   }
   completeIdentityLink(handle, verifier) {
     return this.req("POST", "/auth/sso/link/complete", { handle, ...verifier ? { verifier } : {} });
@@ -28587,15 +28649,15 @@ var KutrionClient = class {
   // Works for both OIDC and SAML providers — /start dispatches on the provider's protocol. `ref`
   // is the provider id (preferred, unambiguous across orgs) or a platform provider's slug.
   ssoStartUrl(ref) {
-    return `${this.baseUrl}/auth/sso/${ref}/start`;
+    return `${this.baseUrl}/auth/sso/${encodeURIComponent(ref)}/start`;
   }
   // SP metadata URL to hand a SAML IdP (entityID + ACS endpoint). Keyed by provider id.
   samlMetadataUrl(ref) {
-    return `${this.baseUrl}/auth/sso/${ref}/saml/metadata`;
+    return `${this.baseUrl}/auth/sso/${encodeURIComponent(ref)}/saml/metadata`;
   }
   // OIDC redirect URI to register at the IdP, keyed by provider id (per-org safe).
   ssoCallbackUrl(ref) {
-    return `${this.baseUrl}/auth/sso/${ref}/callback`;
+    return `${this.baseUrl}/auth/sso/${encodeURIComponent(ref)}/callback`;
   }
   // --- SSO provider admin (MT-3, org admin/owner only; secrets are write-only) ---
   listSsoProvidersAdmin() {
@@ -28686,10 +28748,10 @@ var KutrionClient = class {
     return this.req("POST", "/workspaces", input);
   }
   updateWorkspace(id, input) {
-    return this.req("PUT", `/workspaces/${id}`, input);
+    return this.req("PUT", `/workspaces/${encodeURIComponent(id)}`, input);
   }
   deleteWorkspace(id) {
-    return this.req("DELETE", `/workspaces/${id}`);
+    return this.req("DELETE", `/workspaces/${encodeURIComponent(id)}`);
   }
   // --- relay (#458 vault-synced API-client documents; #464 team grants) ---
   listRelayDocuments() {
@@ -28705,7 +28767,7 @@ var KutrionClient = class {
     return this.req("POST", `/relay/documents/${encodeURIComponent(clientId)}/grants`, { team_id, role });
   }
   relayUnshare(clientId, teamId) {
-    return this.req("DELETE", `/relay/documents/${encodeURIComponent(clientId)}/grants/${teamId}`);
+    return this.req("DELETE", `/relay/documents/${encodeURIComponent(clientId)}/grants/${encodeURIComponent(teamId)}`);
   }
   // --- vault ---
   listVaults() {
@@ -28715,13 +28777,13 @@ var KutrionClient = class {
     return this.req("POST", "/vault/create", { name, team_id });
   }
   renameVault(vaultId, name) {
-    return this.req("PATCH", `/vault/${vaultId}`, { name });
+    return this.req("PATCH", `/vault/${encodeURIComponent(vaultId)}`, { name });
   }
   deleteVault(vaultId) {
-    return this.req("DELETE", `/vault/${vaultId}`);
+    return this.req("DELETE", `/vault/${encodeURIComponent(vaultId)}`);
   }
   listCredentials(vaultId) {
-    return this.req("GET", `/vault/${vaultId}/credentials`);
+    return this.req("GET", `/vault/${encodeURIComponent(vaultId)}/credentials`);
   }
   // #1122: listVaults + every listCredentials in one round trip, with the same permissions gating.
   // Metadata only — revealing a secret is still the audited per-credential call.
@@ -28747,19 +28809,19 @@ var KutrionClient = class {
     return this.req("GET", `/vault/host-matches?host=${encodeURIComponent(host2)}`);
   }
   getCredential(vaultId, cid) {
-    return this.req("GET", `/vault/${vaultId}/credentials/${cid}`);
+    return this.req("GET", `/vault/${encodeURIComponent(vaultId)}/credentials/${encodeURIComponent(cid)}`);
   }
   // #717: `mutation_id` and `base_updated_at` are what a replayed offline write adds — the first
   // makes a retry a no-op, the second lets the server tell an edit from an overwrite.
   storeCredential(vaultId, input) {
-    return this.req("POST", `/vault/${vaultId}/credentials`, input);
+    return this.req("POST", `/vault/${encodeURIComponent(vaultId)}/credentials`, input);
   }
   updateCredential(vaultId, cid, input) {
-    return this.req("PATCH", `/vault/${vaultId}/credentials/${cid}`, input);
+    return this.req("PATCH", `/vault/${encodeURIComponent(vaultId)}/credentials/${encodeURIComponent(cid)}`, input);
   }
   deleteCredential(vaultId, cid, opts2) {
     const q = opts2?.mutation_id ? `?mutation_id=${encodeURIComponent(opts2.mutation_id)}` : "";
-    return this.req("DELETE", `/vault/${vaultId}/credentials/${cid}${q}`);
+    return this.req("DELETE", `/vault/${encodeURIComponent(vaultId)}/credentials/${encodeURIComponent(cid)}` + q);
   }
   // #2622: snippets. A brokered shell runs one over its socket (snippetFrame); useSnippet is for a
   // terminal the server does not broker, and records the use the same way.
@@ -28787,23 +28849,23 @@ var KutrionClient = class {
     return this.req("GET", `/vault/conflicts${opts2?.open === false ? "?open=false" : ""}`);
   }
   acknowledgeConflict(id) {
-    return this.req("POST", `/vault/conflicts/${id}/ack`);
+    return this.req("POST", `/vault/conflicts/${encodeURIComponent(id)}/ack`);
   }
   conflictPrevious(id) {
-    return this.req("GET", `/vault/conflicts/${id}/previous`);
+    return this.req("GET", `/vault/conflicts/${encodeURIComponent(id)}/previous`);
   }
   // VT-487: group RBAC on a vault (collection) + item folders.
   listVaultGrants(vaultId) {
-    return this.req("GET", `/vault/${vaultId}/grants`);
+    return this.req("GET", `/vault/${encodeURIComponent(vaultId)}/grants`);
   }
   grantVaultToTeam(vaultId, input) {
-    return this.req("POST", `/vault/${vaultId}/grants`, input);
+    return this.req("POST", `/vault/${encodeURIComponent(vaultId)}/grants`, input);
   }
   revokeVaultGrant(vaultId, grantId) {
-    return this.req("DELETE", `/vault/${vaultId}/grants/${grantId}`);
+    return this.req("DELETE", `/vault/${encodeURIComponent(vaultId)}/grants/${encodeURIComponent(grantId)}`);
   }
   listVaultFolders(vaultId) {
-    return this.req("GET", `/vault/${vaultId}/folders`);
+    return this.req("GET", `/vault/${encodeURIComponent(vaultId)}/folders`);
   }
   // #1169: the credential's destination allow-list — where its secret may be presented. The routes
   // live in their own module mounted on /vault (server/src/index.ts:310), so the paths hang off the
@@ -28820,20 +28882,20 @@ var KutrionClient = class {
   // No write response carries the three list-only fields; re-list rather than deriving them.
   // #2634: who revealed or used one credential. Vault owners and admins only; never carries the value.
   credentialProvenance(vaultId, cid) {
-    return this.req("GET", `/vault/${vaultId}/credentials/${cid}/provenance`);
+    return this.req("GET", `/vault/${encodeURIComponent(vaultId)}/credentials/${encodeURIComponent(cid)}/provenance`);
   }
   // #3074: password history. The list carries no values; revealing one is a gated read like getCredential.
   listCredentialHistory(vaultId, cid) {
-    return this.req("GET", `/vault/${vaultId}/credentials/${cid}/history`);
+    return this.req("GET", `/vault/${encodeURIComponent(vaultId)}/credentials/${encodeURIComponent(cid)}/history`);
   }
   revealCredentialHistory(vaultId, cid, hid) {
-    return this.req("GET", `/vault/${vaultId}/credentials/${cid}/history/${hid}`);
+    return this.req("GET", `/vault/${encodeURIComponent(vaultId)}/credentials/${encodeURIComponent(cid)}/history/${encodeURIComponent(hid)}`);
   }
   restoreCredentialHistory(vaultId, cid, hid) {
-    return this.req("POST", `/vault/${vaultId}/credentials/${cid}/history/${hid}/restore`);
+    return this.req("POST", `/vault/${encodeURIComponent(vaultId)}/credentials/${encodeURIComponent(cid)}/history/${encodeURIComponent(hid)}/restore`);
   }
   listCredentialDestinations(vaultId, cid) {
-    return this.req("GET", `/vault/${vaultId}/credentials/${cid}/destinations`);
+    return this.req("GET", `/vault/${encodeURIComponent(vaultId)}/credentials/${encodeURIComponent(cid)}/destinations`);
   }
   // `port` omitted means this protocol's default, resolved and stored server-side — NOT a wildcard, and
   // not something to fill in here: a client-supplied default would come back as a chosen port.
@@ -28849,7 +28911,7 @@ var KutrionClient = class {
   // names it. Sent on any other protocol it answers 400 `domain_not_supported`; unexpressible values
   // answer 400 `invalid_domain`.
   addCredentialDestination(vaultId, cid, input) {
-    return this.req("POST", `/vault/${vaultId}/credentials/${cid}/destinations`, input);
+    return this.req("POST", `/vault/${encodeURIComponent(vaultId)}/credentials/${encodeURIComponent(cid)}/destinations`, input);
   }
   // Gated on the secret for the same reason adding is, but NOT because removal widens — #1281 reversed
   // that. Emptying a protocol while rows survive elsewhere leaves the credential claimed, so that
@@ -28861,7 +28923,7 @@ var KutrionClient = class {
   removeCredentialDestination(vaultId, cid, destinationId, secret) {
     return this.req(
       "DELETE",
-      `/vault/${vaultId}/credentials/${cid}/destinations/${destinationId}`,
+      `/vault/${encodeURIComponent(vaultId)}/credentials/${encodeURIComponent(cid)}/destinations/${encodeURIComponent(destinationId)}`,
       { secret }
     );
   }
@@ -28901,20 +28963,20 @@ var KutrionClient = class {
     return this.req("POST", "/vault/breach-alerts/scan");
   }
   updateBreachAlert(id, status) {
-    return this.req("PATCH", `/vault/breach-alerts/${id}`, { status });
+    return this.req("PATCH", `/vault/breach-alerts/${encodeURIComponent(id)}`, { status });
   }
   setBreachMonitor(enabled) {
     return this.req("PUT", "/vault/breach-alerts/settings", { enabled });
   }
   importEnv(vaultId, name, dotenv) {
-    return this.req("POST", `/vault/${vaultId}/env-import`, { name, dotenv });
+    return this.req("POST", `/vault/${encodeURIComponent(vaultId)}/env-import`, { name, dotenv });
   }
   readEnv(vaultId, cid) {
-    return this.req("GET", `/vault/${vaultId}/credentials/${cid}/env`);
+    return this.req("GET", `/vault/${encodeURIComponent(vaultId)}/credentials/${encodeURIComponent(cid)}/env`);
   }
   // #96: live TOTP code for a TOTP credential (secret stays on the broker).
   getTotpCode(vaultId, cid) {
-    return this.req("GET", `/vault/${vaultId}/credentials/${cid}/totp`);
+    return this.req("GET", `/vault/${encodeURIComponent(vaultId)}/credentials/${encodeURIComponent(cid)}/totp`);
   }
   // --- passkey provider (VT-405g): Kutrion as a roaming WebAuthn authenticator for OTHER sites
   // (distinct from listPasskeys/deletePasskey above, which are passkeys for logging into Kutrion). ---
@@ -28935,7 +28997,7 @@ var KutrionClient = class {
     return this.req("POST", "/share", { credential_id: credentialId, ...opts2 });
   }
   redeemShare(token) {
-    return this.req("GET", `/share/${token}`, void 0, false);
+    return this.req("GET", `/share/${encodeURIComponent(token)}`, void 0, false);
   }
   // #869: with a credential id, every link issued for that credential (needs read on it); without
   // one, only the links the caller issued.
@@ -28943,14 +29005,14 @@ var KutrionClient = class {
     return this.req("GET", `/share${credentialId ? `?credential_id=${encodeURIComponent(credentialId)}` : ""}`);
   }
   revokeShare(id) {
-    return this.req("DELETE", `/share/${id}`);
+    return this.req("DELETE", `/share/${encodeURIComponent(id)}`);
   }
   // --- import / export ---
   exportVault(vaultId) {
-    return this.req("GET", `/vault/${vaultId}/export`);
+    return this.req("GET", `/vault/${encodeURIComponent(vaultId)}/export`);
   }
   importVault(vaultId, items) {
-    return this.req("POST", `/vault/${vaultId}/import`, { items });
+    return this.req("POST", `/vault/${encodeURIComponent(vaultId)}/import`, { items });
   }
   importProviders() {
     return this.req("GET", "/vault/import/providers");
@@ -28988,7 +29050,7 @@ var KutrionClient = class {
    *  a move's `enabled:false` after the caller's fields precisely so one request can never both repoint a
    *  partner and turn it back on, and a client that batched them would be asking to be refused. */
   setAs2PartnerEnabled(id, enabled) {
-    return this.req("PATCH", `/as2/partners/${id}`, { enabled });
+    return this.req("PATCH", `/as2/partners/${encodeURIComponent(id)}`, { enabled });
   }
   listAs2Messages() {
     return this.req("GET", "/as2/messages");
@@ -29001,33 +29063,33 @@ var KutrionClient = class {
     return this.req("POST", "/teams", { name });
   }
   listMembers(teamId) {
-    return this.req("GET", `/teams/${teamId}/members`);
+    return this.req("GET", `/teams/${encodeURIComponent(teamId)}/members`);
   }
   addMember(teamId, email, role) {
-    return this.req("POST", `/teams/${teamId}/members`, { email, role });
+    return this.req("POST", `/teams/${encodeURIComponent(teamId)}/members`, { email, role });
   }
   removeMember(teamId, userId) {
-    return this.req("DELETE", `/teams/${teamId}/members/${userId}`);
+    return this.req("DELETE", `/teams/${encodeURIComponent(teamId)}/members/${encodeURIComponent(userId)}`);
   }
   // #2775: org owner or admin only. 409 team_has_vaults or scim_managed.
   deleteTeam(teamId) {
-    return this.req("DELETE", `/teams/${teamId}`);
+    return this.req("DELETE", `/teams/${encodeURIComponent(teamId)}`);
   }
   // --- team invitations (VT-102) ---
   inviteMember(teamId, email, role) {
-    return this.req("POST", `/teams/${teamId}/invitations`, { email, role });
+    return this.req("POST", `/teams/${encodeURIComponent(teamId)}/invitations`, { email, role });
   }
   listInvitations(teamId) {
-    return this.req("GET", `/teams/${teamId}/invitations`);
+    return this.req("GET", `/teams/${encodeURIComponent(teamId)}/invitations`);
   }
   revokeInvitation(teamId, invId) {
-    return this.req("DELETE", `/teams/${teamId}/invitations/${invId}`);
+    return this.req("DELETE", `/teams/${encodeURIComponent(teamId)}/invitations/${encodeURIComponent(invId)}`);
   }
   invitePreview(token) {
-    return this.req("GET", `/teams/invitations/${token}`, void 0, false);
+    return this.req("GET", `/teams/invitations/${encodeURIComponent(token)}`, void 0, false);
   }
   acceptInvitation(token) {
-    return this.req("POST", `/teams/invitations/${token}/accept`);
+    return this.req("POST", `/teams/invitations/${encodeURIComponent(token)}/accept`);
   }
   // --- org onboarding (MT-4 #115): admin/owner-gated unless noted ---
   getOrg() {
@@ -29088,10 +29150,10 @@ var KutrionClient = class {
     return this.req("POST", "/emergency/contacts", input);
   }
   removeEmergencyContact(id) {
-    return this.req("DELETE", `/emergency/contacts/${id}`);
+    return this.req("DELETE", `/emergency/contacts/${encodeURIComponent(id)}`);
   }
   denyEmergencyRequest(id) {
-    return this.req("POST", `/emergency/requests/${id}/deny`);
+    return this.req("POST", `/emergency/requests/${encodeURIComponent(id)}/deny`);
   }
   listEmergencyGrants() {
     return this.req("GET", "/emergency/grants");
@@ -29100,10 +29162,10 @@ var KutrionClient = class {
     return this.req("POST", "/emergency/grants/accept", { token });
   }
   requestEmergencyAccess(grantId) {
-    return this.req("POST", `/emergency/grants/${grantId}/request`);
+    return this.req("POST", `/emergency/grants/${encodeURIComponent(grantId)}/request`);
   }
   completeEmergencyAccess(requestId) {
-    return this.req("POST", `/emergency/requests/${requestId}/complete`);
+    return this.req("POST", `/emergency/requests/${encodeURIComponent(requestId)}/complete`);
   }
   // VT-443: the user-facing announcement feed (filtered server-side by the org's tier/status).
   listAnnouncements() {
@@ -29193,7 +29255,7 @@ var KutrionClient = class {
   // #1959: org-admin surface grants for one member of the caller's own org. Distinct from
   // selfGrantSurface, which only ever acts on the caller.
   listUserSurfaceGrants(userId) {
-    return this.req("GET", `/surfaces/users/${userId}`);
+    return this.req("GET", `/surfaces/users/${encodeURIComponent(userId)}`);
   }
   grantUserSurface(userId, surface, opts2) {
     return this.req("POST", "/surfaces/grants", {
@@ -29294,15 +29356,15 @@ var KutrionClient = class {
     return this.req("GET", "/org/members");
   }
   setOrgMemberRole(id, org_role) {
-    return this.req("PATCH", `/org/members/${id}`, { org_role });
+    return this.req("PATCH", `/org/members/${encodeURIComponent(id)}`, { org_role });
   }
   removeOrgMember(id) {
-    return this.req("DELETE", `/org/members/${id}`);
+    return this.req("DELETE", `/org/members/${encodeURIComponent(id)}`);
   }
   // VT-483: admin-mediated recovery — email a locked-out member a password-reset link/code. The admin
   // never sets or learns the new password.
   resetOrgMemberPassword(id) {
-    return this.req("POST", `/org/members/${id}/password-reset`);
+    return this.req("POST", `/org/members/${encodeURIComponent(id)}/password-reset`);
   }
   // #1433: admin-mediated ACCOUNT RECOVERY, for a member who cannot sign in AT ALL. Distinct from the
   // password reset above, which refuses exactly the accounts that most need it: an SSO- or
@@ -29314,7 +29376,7 @@ var KutrionClient = class {
   // step_up_required), refuses a suspended member (409 member_inactive), and refuses a non-owner admin
   // who targets an owner (403 owner_recovery_requires_owner).
   recoverOrgMember(id) {
-    return this.req("POST", `/org/members/${id}/recover`);
+    return this.req("POST", `/org/members/${encodeURIComponent(id)}/recover`);
   }
   inviteToOrg(email, org_role) {
     return this.req("POST", "/org/invitations", { email, org_role });
@@ -29323,13 +29385,13 @@ var KutrionClient = class {
     return this.req("GET", "/org/invitations");
   }
   revokeOrgInvitation(id) {
-    return this.req("DELETE", `/org/invitations/${id}`);
+    return this.req("DELETE", `/org/invitations/${encodeURIComponent(id)}`);
   }
   orgInvitePreview(token) {
-    return this.req("GET", `/org/invitations/${token}`, void 0, false);
+    return this.req("GET", `/org/invitations/${encodeURIComponent(token)}`, void 0, false);
   }
   async acceptOrgInvitation(token) {
-    const r = await this.req("POST", `/org/invitations/${token}/accept`);
+    const r = await this.req("POST", `/org/invitations/${encodeURIComponent(token)}/accept`);
     this.onToken?.(r.token);
     return r;
   }
@@ -29342,18 +29404,18 @@ var KutrionClient = class {
     return this.req("POST", "/msp/clients", { client_email, role, ...expires_days ? { expires_days } : {} });
   }
   revokeMspClient(id) {
-    return this.req("POST", `/msp/clients/${id}/revoke`);
+    return this.req("POST", `/msp/clients/${encodeURIComponent(id)}/revoke`);
   }
   // Mint a read-only "view as client" scoped session (#415c). The token is used as the active bearer;
   // the existing impersonation guard makes it read-only. Revoking the relationship kills it instantly.
   viewAsMspClient(id) {
-    return this.req("POST", `/msp/clients/${id}/view-as`);
+    return this.req("POST", `/msp/clients/${encodeURIComponent(id)}/view-as`);
   }
   // #432: enter a WRITE-capable "act as client" session at the clamped effective role. Requires a fresh
   // step-up; writes are bounded by the deny-by-default server allowlist. Returns 403 step_up_required if
   // the operator has not recently verified a passkey/MFA, 409 read_only_relationship for a VIEWER ceiling.
   actAsMspClient(id, role = "EDITOR") {
-    return this.req("POST", `/msp/clients/${id}/act-as`, { role });
+    return this.req("POST", `/msp/clients/${encodeURIComponent(id)}/act-as`, { role });
   }
   // #415d: the MSP's own access ledger across managed clients (sessions opened, last access).
   mspClientsActivity() {
@@ -29377,13 +29439,13 @@ var KutrionClient = class {
     return this.req("GET", "/msp/providers");
   }
   acceptMspProvider(id) {
-    return this.req("POST", `/msp/providers/${id}/accept`);
+    return this.req("POST", `/msp/providers/${encodeURIComponent(id)}/accept`);
   }
   declineMspProvider(id) {
-    return this.req("POST", `/msp/providers/${id}/decline`);
+    return this.req("POST", `/msp/providers/${encodeURIComponent(id)}/decline`);
   }
   revokeMspProvider(id) {
-    return this.req("POST", `/msp/providers/${id}/revoke`);
+    return this.req("POST", `/msp/providers/${encodeURIComponent(id)}/revoke`);
   }
   // #434: what my providers did in my org (read-only-session opens etc.), for client-side transparency.
   mspProviderActivity() {
@@ -29417,13 +29479,13 @@ var KutrionClient = class {
   setMemberActive(memberId, active, reason) {
     return this.req(
       "PATCH",
-      `/org/members/${memberId}/active`,
+      `/org/members/${encodeURIComponent(memberId)}/active`,
       { active, ...reason ? { reason } : {} }
     );
   }
   // Offboarding: kill every offline copy a member holds, from the admin side.
   revokeMemberCacheKeys(memberId) {
-    return this.req("DELETE", `/org/members/${memberId}/cache-keys`);
+    return this.req("DELETE", `/org/members/${encodeURIComponent(memberId)}/cache-keys`);
   }
   // #815: the other half of that revoke — which devices came back and were told to wipe, and which
   // have not been seen since. Org-admin only.
@@ -29439,7 +29501,7 @@ var KutrionClient = class {
     return this.req("POST", "/org/equivalent-domains", { domains, note: note ?? null });
   }
   removeEquivalentDomains(id) {
-    return this.req("DELETE", `/org/equivalent-domains/${id}`);
+    return this.req("DELETE", `/org/equivalent-domains/${encodeURIComponent(id)}`);
   }
   // #904: the caller's OWN remembered host bindings. Per user and per (credential, host) — never per
   // org, which would make phishing one member a lateral-movement primitive. Creation is screened
@@ -29449,10 +29511,10 @@ var KutrionClient = class {
     return this.req("GET", "/vault/site-bindings");
   }
   createSiteBinding(vaultId, cid, targetUrl, sourceUrl) {
-    return this.req("POST", `/vault/${vaultId}/credentials/${cid}/site-bindings`, { target_url: targetUrl, source_url: sourceUrl });
+    return this.req("POST", `/vault/${encodeURIComponent(vaultId)}/credentials/${encodeURIComponent(cid)}/site-bindings`, { target_url: targetUrl, source_url: sourceUrl });
   }
   revokeSiteBinding(id) {
-    return this.req("DELETE", `/vault/site-bindings/${id}`);
+    return this.req("DELETE", `/vault/site-bindings/${encodeURIComponent(id)}`);
   }
   listOrgDomains() {
     return this.req("GET", "/org/domains");
@@ -29461,10 +29523,10 @@ var KutrionClient = class {
     return this.req("POST", "/org/domains", { domain });
   }
   verifyOrgDomain(id) {
-    return this.req("POST", `/org/domains/${id}/verify`);
+    return this.req("POST", `/org/domains/${encodeURIComponent(id)}/verify`);
   }
   removeOrgDomain(id) {
-    return this.req("DELETE", `/org/domains/${id}`);
+    return this.req("DELETE", `/org/domains/${encodeURIComponent(id)}`);
   }
   // VT-485/486: enterprise API tokens for SCIM provisioning and SIEM event export. The secret is
   // returned only on create; thereafter only the prefix is shown.
@@ -29475,7 +29537,7 @@ var KutrionClient = class {
     return this.req("POST", "/api-tokens", input);
   }
   revokeApiToken(id) {
-    return this.req("DELETE", `/api-tokens/${id}`);
+    return this.req("DELETE", `/api-tokens/${encodeURIComponent(id)}`);
   }
   // #662 agent access plane: non-human identities (#664), their activity (#665) and the kill
   // switch (#675). The credential is returned only on create; thereafter only the prefix is shown.
@@ -29490,23 +29552,23 @@ var KutrionClient = class {
     return this.req("POST", "/agents", input);
   }
   renewAgent(id, ttl_minutes) {
-    return this.req("POST", `/agents/${id}/renew`, { ttl_minutes });
+    return this.req("POST", `/agents/${encodeURIComponent(id)}/renew`, { ttl_minutes });
   }
   revokeAgent(id) {
-    return this.req("DELETE", `/agents/${id}`);
+    return this.req("DELETE", `/agents/${encodeURIComponent(id)}`);
   }
   // #2700: PUT replaces the whole resource scope; an omitted or empty list means unrestricted.
   agentScopeOptions() {
     return this.req("GET", "/agents/scope-options");
   }
   setAgentResourceScope(id, scope) {
-    return this.req("PUT", `/agents/${id}/resource-scope`, scope);
+    return this.req("PUT", `/agents/${encodeURIComponent(id)}/resource-scope`, scope);
   }
   listAgentOidcTrusts() {
     return this.req("GET", "/agents/oidc/trusts");
   }
   setAgentOidcTrustResourceScope(id, scope, opts2 = {}) {
-    return this.req("PUT", `/agents/oidc/trusts/${id}/resource-scope`, { ...scope, ...opts2 });
+    return this.req("PUT", `/agents/oidc/trusts/${encodeURIComponent(id)}/resource-scope`, { ...scope, ...opts2 });
   }
   revokeAgents(input) {
     return this.req(
@@ -29523,7 +29585,7 @@ var KutrionClient = class {
     return this.req("GET", qs ? `/agents/sessions?${qs}` : "/agents/sessions");
   }
   getAgentSession(id) {
-    return this.req("GET", `/agents/sessions/${id}`);
+    return this.req("GET", `/agents/sessions/${encodeURIComponent(id)}`);
   }
   listAgentActivity(opts2 = {}) {
     const q = new URLSearchParams();
@@ -29533,7 +29595,7 @@ var KutrionClient = class {
   }
   /** Relative path for the auditor export; the caller downloads it with its own auth. */
   agentSessionExportPath(id) {
-    return `/agents/sessions/${id}/export`;
+    return `/agents/sessions/${encodeURIComponent(id)}/export`;
   }
   // #669: the human half of just-in-time agent approval. These routes are deliberately unreachable
   // from an MCP client — the agent opens a request and settles nothing, a person in an authenticated
@@ -29544,13 +29606,13 @@ var KutrionClient = class {
     return this.req("GET", "/agent-approvals");
   }
   getAgentApproval(id) {
-    return this.req("GET", `/agent-approvals/${id}`);
+    return this.req("GET", `/agent-approvals/${encodeURIComponent(id)}`);
   }
   approveAgentApproval(id, note) {
-    return this.req("POST", `/agent-approvals/${id}/approve`, note ? { note } : {});
+    return this.req("POST", `/agent-approvals/${encodeURIComponent(id)}/approve`, note ? { note } : {});
   }
   denyAgentApproval(id, note) {
-    return this.req("POST", `/agent-approvals/${id}/deny`, note ? { note } : {});
+    return this.req("POST", `/agent-approvals/${encodeURIComponent(id)}/deny`, note ? { note } : {});
   }
   // #670 (epic #662): the outbound MCP gateway's control plane. Curation is ORG ADMIN; only the
   // report-what-I-run call is open to any member, and that asymmetry is deliberate — the machines
@@ -29573,14 +29635,14 @@ var KutrionClient = class {
   /** Aim a credential at an approved entry. Authorised by WRITE on the credential's own vault, not by
    *  org admin — binding is an act of delegation, so 403 here is about the vault and not the console. */
   bindMcpCredential(entryId, credential_id) {
-    return this.req("POST", `/mcp/gateway/servers/${entryId}/credential`, { credential_id });
+    return this.req("POST", `/mcp/gateway/servers/${encodeURIComponent(entryId)}/credential`, { credential_id });
   }
   unbindMcpCredential(entryId) {
-    return this.req("DELETE", `/mcp/gateway/servers/${entryId}/credential`);
+    return this.req("DELETE", `/mcp/gateway/servers/${encodeURIComponent(entryId)}/credential`);
   }
   /** Stops traffic on the next call, with nothing cached in between. */
   revokeMcpServer(entryId) {
-    return this.req("DELETE", `/mcp/gateway/servers/${entryId}`);
+    return this.req("DELETE", `/mcp/gateway/servers/${encodeURIComponent(entryId)}`);
   }
   listMcpObserved() {
     return this.req("GET", "/mcp/gateway/observed");
@@ -29613,10 +29675,10 @@ var KutrionClient = class {
   // which leaves it as it is — a connection could otherwise never be made direct again.
   // #2621: `vault_id` shares a personal host into that vault, one way; its credential must live there.
   updateConnection(connId, input) {
-    return this.req("PATCH", `/ssh/connections/${connId}`, input);
+    return this.req("PATCH", `/ssh/connections/${encodeURIComponent(connId)}`, input);
   }
   deleteConnection(connId) {
-    return this.req("DELETE", `/ssh/connections/${connId}`);
+    return this.req("DELETE", `/ssh/connections/${encodeURIComponent(connId)}`);
   }
   // #414: self-serve secure-session demo. status drives the empty-state affordance; provision is
   // idempotent (reattaches to an existing demo connection); reset removes the demo artifacts.
@@ -29632,7 +29694,7 @@ var KutrionClient = class {
   // Pre-flight risk guardrail (#141): a high-risk command 403s with { error: "step_up_required" }
   // until the session completes WebAuthn step-up; retry after stepping up.
   exec(connId, command) {
-    return this.req("POST", `/ssh/connections/${connId}/exec`, { command });
+    return this.req("POST", `/ssh/connections/${encodeURIComponent(connId)}/exec`, { command });
   }
   validateCommand(command) {
     return this.req("POST", "/ssh/validate", { command });
@@ -29715,7 +29777,7 @@ var KutrionClient = class {
   }
   /** 403 step_up_required until the session has a fresh passkey/MFA check; retry after stepping up. */
   clearSshHostKey(id) {
-    return this.req("DELETE", `/ssh/host-keys/${id}`);
+    return this.req("DELETE", `/ssh/host-keys/${encodeURIComponent(id)}`);
   }
   /**
    * #2743: pins the key a host_key_unconfirmed refusal showed this caller. For a first-use refusal the server accepts only the
@@ -29733,7 +29795,7 @@ var KutrionClient = class {
   }
   /** 404 when the session already ended, or is not in the caller's org. */
   endLiveSession(kind, id) {
-    return this.req("DELETE", `/org/live-sessions/${kind}/${encodeURIComponent(id)}`);
+    return this.req("DELETE", `/org/live-sessions/${encodeURIComponent(kind)}/${encodeURIComponent(id)}`);
   }
   // --- SSH certificate authority (VT-484): mint short-lived user certs from a per-org internal CA ---
   getSshCa() {
@@ -29828,29 +29890,29 @@ var KutrionClient = class {
   // It does NOT mean "the whole directory": the routes default to limit=1000 and report `hasMore`.
   // --- SFTP file transfer (VT-112) ---
   sftpList(connId, path = ".", page) {
-    return this.req("GET", `/ssh/connections/${connId}/sftp/list?path=${encodeURIComponent(path)}${listPageQuery(page)}`);
+    return this.req("GET", `/ssh/connections/${encodeURIComponent(connId)}/sftp/list?path=${encodeURIComponent(path)}${listPageQuery(page)}`);
   }
   sftpMkdir(connId, path) {
-    return this.req("POST", `/ssh/connections/${connId}/sftp/mkdir`, { path });
+    return this.req("POST", `/ssh/connections/${encodeURIComponent(connId)}/sftp/mkdir`, { path });
   }
   sftpRename(connId, from, to) {
-    return this.req("POST", `/ssh/connections/${connId}/sftp/rename`, { from, to });
+    return this.req("POST", `/ssh/connections/${encodeURIComponent(connId)}/sftp/rename`, { from, to });
   }
   sftpDelete(connId, path, isDir) {
-    return this.req("POST", `/ssh/connections/${connId}/sftp/delete`, { path, is_dir: isDir });
+    return this.req("POST", `/ssh/connections/${encodeURIComponent(connId)}/sftp/delete`, { path, is_dir: isDir });
   }
   // #587: SFTP checksums + duplicate detection (mirror the file-connection routes).
   sftpChecksum(connId, path, algos = ["sha256"]) {
-    return this.req("GET", `/ssh/connections/${connId}/sftp/checksum?path=${encodeURIComponent(path)}&algos=${algos.join(",")}`);
+    return this.req("GET", `/ssh/connections/${encodeURIComponent(connId)}/sftp/checksum?path=${encodeURIComponent(path)}&algos=${algos.join(",")}`);
   }
   sftpDuplicates(connId, path = ".", opts2) {
-    return this.req("POST", `/ssh/connections/${connId}/sftp/duplicates`, { path, maxFiles: opts2?.maxFiles, maxBytesPerFile: opts2?.maxBytesPerFile });
+    return this.req("POST", `/ssh/connections/${encodeURIComponent(connId)}/sftp/duplicates`, { path, maxFiles: opts2?.maxFiles, maxBytesPerFile: opts2?.maxBytesPerFile });
   }
   // Download a remote file as a Blob (carries the auth token). With { redact: true } the server
   // routes the bytes through the #142 redaction gate (text only; binary → 415) before sending (#320c).
   async sftpDownload(connId, path, opts2) {
     const tok = this.getToken();
-    const res = await this.f(`${this.baseUrl}/ssh/connections/${connId}/sftp/download?path=${encodeURIComponent(path)}${opts2?.redact ? "&redact=1" : ""}`, {
+    const res = await this.f(`${this.baseUrl}/ssh/connections/${encodeURIComponent(connId)}/sftp/download?path=${encodeURIComponent(path)}${opts2?.redact ? "&redact=1" : ""}`, {
       headers: this.rawHeaders(tok)
     });
     if (!res.ok) {
@@ -29906,12 +29968,12 @@ var KutrionClient = class {
   // Stream a remote file's bytes instead of buffering them into a Blob. `opts.start` resumes from an
   // offset via Range (#555); read `resumedAt` off the result rather than assuming the server obeyed.
   sftpDownloadStream(connId, path, opts2) {
-    return this.downloadStream(`${this.baseUrl}/ssh/connections/${connId}/sftp/download?path=${encodeURIComponent(path)}${opts2?.redact ? "&redact=1" : ""}`, opts2);
+    return this.downloadStream(`${this.baseUrl}/ssh/connections/${encodeURIComponent(connId)}/sftp/download?path=${encodeURIComponent(path)}${opts2?.redact ? "&redact=1" : ""}`, opts2);
   }
   // Upload from a byte source without materialising it. `streamed` on the result reports whether this
   // runtime actually streamed the request body or had to collect it first.
   sftpUploadStream(connId, path, body, opts2) {
-    return this.uploadStream(`${this.baseUrl}/ssh/connections/${connId}/sftp/upload?path=${encodeURIComponent(path)}`, body, opts2);
+    return this.uploadStream(`${this.baseUrl}/ssh/connections/${encodeURIComponent(connId)}/sftp/upload?path=${encodeURIComponent(path)}`, body, opts2);
   }
   // #2556: throws UploadTooLargeToInspectError when this org inspects uploads and `size` is over what the
   // inspection can hold, so the file is refused before any of it is sent. A policy that cannot be read
@@ -29926,7 +29988,7 @@ var KutrionClient = class {
     throw new UploadTooLargeToInspectError(size, insp.max_bytes, insp.enabled ? "too_large_for_scan" : "too_large_for_policy");
   }
   sftpUploadResumable(connId, path, source, opts2) {
-    return this.uploadResumable(`/ssh/connections/${connId}/sftp/upload`, path, source, opts2);
+    return this.uploadResumable(`/ssh/connections/${encodeURIComponent(connId)}/sftp/upload`, path, source, opts2);
   }
   // #2556: one request per UPLOAD_CHUNK_BYTES over the #1566 resume protocol, so a file of any size
   // crosses an edge that caps a request body, and a dropped chunk is re-sent from the offset the
@@ -30055,26 +30117,26 @@ var KutrionClient = class {
     return this.req("POST", "/files/connections", input);
   }
   updateFileConnection(id, input) {
-    return this.req("PATCH", `/files/connections/${id}`, input);
+    return this.req("PATCH", `/files/connections/${encodeURIComponent(id)}`, input);
   }
   deleteFileConnection(id) {
-    return this.req("DELETE", `/files/connections/${id}`);
+    return this.req("DELETE", `/files/connections/${encodeURIComponent(id)}`);
   }
   fileList(connId, path = "/", page) {
-    return this.req("GET", `/files/connections/${connId}/list?path=${encodeURIComponent(path)}${listPageQuery(page)}`);
+    return this.req("GET", `/files/connections/${encodeURIComponent(connId)}/list?path=${encodeURIComponent(path)}${listPageQuery(page)}`);
   }
   // #587: checksums + duplicate detection.
   fileChecksum(connId, path, algos = ["sha256"]) {
-    return this.req("GET", `/files/connections/${connId}/checksum?path=${encodeURIComponent(path)}&algos=${algos.join(",")}`);
+    return this.req("GET", `/files/connections/${encodeURIComponent(connId)}/checksum?path=${encodeURIComponent(path)}&algos=${algos.join(",")}`);
   }
   fileDuplicates(connId, path = "/", opts2) {
-    return this.req("POST", `/files/connections/${connId}/duplicates`, { path, maxFiles: opts2?.maxFiles, maxBytesPerFile: opts2?.maxBytesPerFile });
+    return this.req("POST", `/files/connections/${encodeURIComponent(connId)}/duplicates`, { path, maxFiles: opts2?.maxFiles, maxBytesPerFile: opts2?.maxBytesPerFile });
   }
   // #586: recursive CONTENT search under `path`. Bytes are read on the server and only path/line/
   // snippet come back. `glob` filters which files are opened by name; it does not match names into
   // the result. Check `truncated` before presenting the matches as the whole answer.
   fileSearch(connId, path, query, opts2) {
-    return this.req("POST", `/files/connections/${connId}/search`, {
+    return this.req("POST", `/files/connections/${encodeURIComponent(connId)}/search`, {
       path,
       query,
       glob: opts2?.glob,
@@ -30084,39 +30146,39 @@ var KutrionClient = class {
   }
   // #588: time-limited presigned direct-download URL (S3 only).
   filePresign(connId, path, expiresSec = 3600) {
-    return this.req("GET", `/files/connections/${connId}/presign?path=${encodeURIComponent(path)}&expires=${expiresSec}`);
+    return this.req("GET", `/files/connections/${encodeURIComponent(connId)}/presign?path=${encodeURIComponent(path)}&expires=${expiresSec}`);
   }
   // #574: OAuth cloud connectors (Dropbox/Drive/OneDrive/Box). Tokens stay server-side.
   cloudProviders() {
     return this.req("GET", "/cloud/providers");
   }
   cloudAuthorize(provider, name) {
-    return this.req("POST", `/cloud/${provider}/authorize`, { name });
+    return this.req("POST", `/cloud/${encodeURIComponent(provider)}/authorize`, { name });
   }
   listCloudConnections() {
     return this.req("GET", "/cloud/connections");
   }
   deleteCloudConnection(id) {
-    return this.req("DELETE", `/cloud/connections/${id}`);
+    return this.req("DELETE", `/cloud/connections/${encodeURIComponent(id)}`);
   }
   cloudList(connId, path = "/", page) {
-    return this.req("GET", `/cloud/connections/${connId}/list?path=${encodeURIComponent(path)}${listPageQuery(page)}`);
+    return this.req("GET", `/cloud/connections/${encodeURIComponent(connId)}/list?path=${encodeURIComponent(path)}${listPageQuery(page)}`);
   }
   // #608: list + pin the connection's browse root (Shared Drive / SharePoint site / Box folder).
   cloudRoots(connId) {
-    return this.req("GET", `/cloud/connections/${connId}/roots`);
+    return this.req("GET", `/cloud/connections/${encodeURIComponent(connId)}/roots`);
   }
   setCloudRoot(connId, root) {
-    return this.req("PUT", `/cloud/connections/${connId}/root`, { root });
+    return this.req("PUT", `/cloud/connections/${encodeURIComponent(connId)}/root`, { root });
   }
   cloudMkdir(connId, path) {
-    return this.req("POST", `/cloud/connections/${connId}/mkdir`, { path });
+    return this.req("POST", `/cloud/connections/${encodeURIComponent(connId)}/mkdir`, { path });
   }
   cloudRename(connId, from, to) {
-    return this.req("POST", `/cloud/connections/${connId}/rename`, { from, to });
+    return this.req("POST", `/cloud/connections/${encodeURIComponent(connId)}/rename`, { from, to });
   }
   cloudDelete(connId, path, isDir) {
-    return this.req("POST", `/cloud/connections/${connId}/delete`, { path, is_dir: isDir });
+    return this.req("POST", `/cloud/connections/${encodeURIComponent(connId)}/delete`, { path, is_dir: isDir });
   }
   // #1627: `redact` is the same opt-in the /files and /ssh download helpers take, and the cloud route
   // has honoured it since #1562 (server/src/modules/cloud.ts:461). It only ever ADDS masking — the
@@ -30124,7 +30186,7 @@ var KutrionClient = class {
   // a client whose users cannot ask for less, not one that is safer.
   async cloudDownload(connId, path, opts2) {
     const tok = this.getToken();
-    const res = await this.f(`${this.baseUrl}/cloud/connections/${connId}/download?path=${encodeURIComponent(path)}${opts2?.redact ? "&redact=1" : ""}`, { headers: this.rawHeaders(tok) });
+    const res = await this.f(`${this.baseUrl}/cloud/connections/${encodeURIComponent(connId)}/download?path=${encodeURIComponent(path)}${opts2?.redact ? "&redact=1" : ""}`, { headers: this.rawHeaders(tok) });
     if (!res.ok) {
       const errBody = await res.json().catch(() => void 0);
       throw new ApiError(res.status, apiErrorMessage(res.status, errBody), errBody);
@@ -30134,7 +30196,7 @@ var KutrionClient = class {
   // #2768: one request, so `signal` cancels it but there is no per-piece progress to report.
   async cloudUpload(connId, path, data, opts2) {
     const tok = this.getToken();
-    const res = await this.fUpload(`${this.baseUrl}/cloud/connections/${connId}/upload?path=${encodeURIComponent(path)}${opts2?.ifAbsent ? "&if_absent=1" : ""}`, {
+    const res = await this.fUpload(`${this.baseUrl}/cloud/connections/${encodeURIComponent(connId)}/upload?path=${encodeURIComponent(path)}${opts2?.ifAbsent ? "&if_absent=1" : ""}`, {
       method: "POST",
       headers: this.rawHeaders(tok, { "Content-Type": "application/octet-stream" }),
       body: data,
@@ -30155,27 +30217,27 @@ var KutrionClient = class {
   // (cloud.ts:453) — downloadStream only ever sends the open-ended form, so that refusal is
   // unreachable from here.
   cloudDownloadStream(connId, path, opts2) {
-    return this.downloadStream(`${this.baseUrl}/cloud/connections/${connId}/download?path=${encodeURIComponent(path)}${opts2?.redact ? "&redact=1" : ""}`, opts2);
+    return this.downloadStream(`${this.baseUrl}/cloud/connections/${encodeURIComponent(connId)}/download?path=${encodeURIComponent(path)}${opts2?.redact ? "&redact=1" : ""}`, opts2);
   }
   // POST /cloud/connections/:id/upload (cloud.ts:537) answers `{ ok }` plus the staging keys and NOT
   // `size` — it returns `uploadProgress()` alone, where the file and sftp routes add `path`/`size`
   // (files.ts:1428, ssh.ts:1070). Typed to what this route actually sends: claiming `size: number`
   // here would hand every caller a number that is undefined at runtime.
   cloudUploadStream(connId, path, body, opts2) {
-    return this.uploadStream(`${this.baseUrl}/cloud/connections/${connId}/upload?path=${encodeURIComponent(path)}`, body, opts2);
+    return this.uploadStream(`${this.baseUrl}/cloud/connections/${encodeURIComponent(connId)}/upload?path=${encodeURIComponent(path)}`, body, opts2);
   }
   fileMkdir(connId, path) {
-    return this.req("POST", `/files/connections/${connId}/mkdir`, { path });
+    return this.req("POST", `/files/connections/${encodeURIComponent(connId)}/mkdir`, { path });
   }
   fileRename(connId, from, to) {
-    return this.req("POST", `/files/connections/${connId}/rename`, { from, to });
+    return this.req("POST", `/files/connections/${encodeURIComponent(connId)}/rename`, { from, to });
   }
   fileDelete(connId, path, isDir) {
-    return this.req("POST", `/files/connections/${connId}/delete`, { path, is_dir: isDir });
+    return this.req("POST", `/files/connections/${encodeURIComponent(connId)}/delete`, { path, is_dir: isDir });
   }
   async fileDownload(connId, path, opts2) {
     const tok = this.getToken();
-    const res = await this.f(`${this.baseUrl}/files/connections/${connId}/download?path=${encodeURIComponent(path)}${opts2?.redact ? "&redact=1" : ""}`, {
+    const res = await this.f(`${this.baseUrl}/files/connections/${encodeURIComponent(connId)}/download?path=${encodeURIComponent(path)}${opts2?.redact ? "&redact=1" : ""}`, {
       headers: this.rawHeaders(tok)
     });
     if (!res.ok) {
@@ -30186,13 +30248,13 @@ var KutrionClient = class {
   }
   // #1542: streaming + resumable counterparts of fileDownload/fileUpload. See downloadStream above.
   fileDownloadStream(connId, path, opts2) {
-    return this.downloadStream(`${this.baseUrl}/files/connections/${connId}/download?path=${encodeURIComponent(path)}${opts2?.redact ? "&redact=1" : ""}`, opts2);
+    return this.downloadStream(`${this.baseUrl}/files/connections/${encodeURIComponent(connId)}/download?path=${encodeURIComponent(path)}${opts2?.redact ? "&redact=1" : ""}`, opts2);
   }
   fileUploadStream(connId, path, body, opts2) {
-    return this.uploadStream(`${this.baseUrl}/files/connections/${connId}/upload?path=${encodeURIComponent(path)}`, body, opts2);
+    return this.uploadStream(`${this.baseUrl}/files/connections/${encodeURIComponent(connId)}/upload?path=${encodeURIComponent(path)}`, body, opts2);
   }
   fileUploadResumable(connId, path, source, opts2) {
-    return this.uploadResumable(`/files/connections/${connId}/upload`, path, source, opts2);
+    return this.uploadResumable(`/files/connections/${encodeURIComponent(connId)}/upload`, path, source, opts2);
   }
   // #325: download a selection of files/folders as one zip, built server-side (works for every protocol).
   async fileArchive(input) {
@@ -30221,7 +30283,7 @@ var KutrionClient = class {
     return this.req("GET", "/files/shares");
   }
   revokeFileShare(id) {
-    return this.req("DELETE", `/files/shares/${id}`);
+    return this.req("DELETE", `/files/shares/${encodeURIComponent(id)}`);
   }
   // #1636: the anonymous side of a Vault Drop — the recipient is outside the org and has no account.
   //
@@ -30263,12 +30325,12 @@ var KutrionClient = class {
     return this.req("GET", "/files/jobs");
   }
   getTransferJob(id) {
-    return this.req("GET", `/files/jobs/${id}`);
+    return this.req("GET", `/files/jobs/${encodeURIComponent(id)}`);
   }
   // #583: reprioritise or cancel a job that is still QUEUED. A running or finished job answers 409
   // not_queued — the runner has already leased it and there is nothing left to reorder.
   patchTransferJob(id, input) {
-    return this.req("PATCH", `/files/jobs/${id}`, input);
+    return this.req("PATCH", `/files/jobs/${encodeURIComponent(id)}`, input);
   }
   // #563: recurring transfer schedules (interval or daily UTC time).
   createSchedule(input) {
@@ -30278,10 +30340,10 @@ var KutrionClient = class {
     return this.req("GET", "/files/schedules");
   }
   setScheduleEnabled(id, enabled) {
-    return this.req("PATCH", `/files/schedules/${id}`, { enabled });
+    return this.req("PATCH", `/files/schedules/${encodeURIComponent(id)}`, { enabled });
   }
   deleteSchedule(id) {
-    return this.req("DELETE", `/files/schedules/${id}`);
+    return this.req("DELETE", `/files/schedules/${encodeURIComponent(id)}`);
   }
   // #614: folder watchers — poll a source directory and fire a transfer job on new/changed, size-stable
   // files matching the filters. The transfer runs as a durable job.
@@ -30292,10 +30354,10 @@ var KutrionClient = class {
     return this.req("GET", "/files/folder-watchers");
   }
   setFolderWatcherEnabled(id, enabled) {
-    return this.req("PATCH", `/files/folder-watchers/${id}`, { enabled });
+    return this.req("PATCH", `/files/folder-watchers/${encodeURIComponent(id)}`, { enabled });
   }
   deleteFolderWatcher(id) {
-    return this.req("DELETE", `/files/folder-watchers/${id}`);
+    return this.req("DELETE", `/files/folder-watchers/${encodeURIComponent(id)}`);
   }
   // #627: workflow templates. A saved edit is a NEW VERSION, not a PATCH — 0150's trigger refuses an
   // UPDATE, because a run names the version it used and reproducibility depends on a stored revision
@@ -30304,19 +30366,19 @@ var KutrionClient = class {
     return this.req("GET", "/files/workflow-templates");
   }
   getWorkflowTemplate(id) {
-    return this.req("GET", `/files/workflow-templates/${id}`);
+    return this.req("GET", `/files/workflow-templates/${encodeURIComponent(id)}`);
   }
   createWorkflowTemplate(input) {
     return this.req("POST", "/files/workflow-templates", input);
   }
   addWorkflowTemplateVersion(id, input) {
-    return this.req("POST", `/files/workflow-templates/${id}/versions`, input);
+    return this.req("POST", `/files/workflow-templates/${encodeURIComponent(id)}/versions`, input);
   }
   deleteWorkflowTemplate(id) {
-    return this.req("DELETE", `/files/workflow-templates/${id}`);
+    return this.req("DELETE", `/files/workflow-templates/${encodeURIComponent(id)}`);
   }
   instantiateWorkflowTemplate(id, input) {
-    return this.req("POST", `/files/workflow-templates/${id}/instantiate`, input);
+    return this.req("POST", `/files/workflow-templates/${encodeURIComponent(id)}/instantiate`, input);
   }
   // #559: directory sync / mirror. dry_run returns the plan without writing; omit it to apply.
   // #585: `two_way` and `mirror` are mutually exclusive and the server refuses the pair outright
@@ -30366,13 +30428,13 @@ var KutrionClient = class {
   }
   // #557: SFTP POSIX metadata (chmod / set mtime / create symlink).
   sftpChmod(connId, path, mode) {
-    return this.req("POST", `/ssh/connections/${connId}/sftp/chmod`, { path, mode });
+    return this.req("POST", `/ssh/connections/${encodeURIComponent(connId)}/sftp/chmod`, { path, mode });
   }
   sftpChtime(connId, path, mtime) {
-    return this.req("POST", `/ssh/connections/${connId}/sftp/chtime`, { path, mtime });
+    return this.req("POST", `/ssh/connections/${encodeURIComponent(connId)}/sftp/chtime`, { path, mtime });
   }
   sftpSymlink(connId, target, link) {
-    return this.req("POST", `/ssh/connections/${connId}/sftp/symlink`, { target, link });
+    return this.req("POST", `/ssh/connections/${encodeURIComponent(connId)}/sftp/symlink`, { target, link });
   }
   // #2556: resumable, as sftpUpload.
   async fileUpload(connId, path, data, opts2) {
@@ -30391,7 +30453,7 @@ var KutrionClient = class {
     return this.req("GET", "/ssh/recordings");
   }
   getRecording(id) {
-    return this.req("GET", `/ssh/recordings/${id}`);
+    return this.req("GET", `/ssh/recordings/${encodeURIComponent(id)}`);
   }
   /** #2631: what was stored for one of the caller's recorded shell sessions, once it has ended. */
   shellSessionReceipt(sessionId) {
@@ -30406,11 +30468,11 @@ var KutrionClient = class {
     return this.req("DELETE", `/ssh/shell-sessions/${encodeURIComponent(sessionId)}`);
   }
   deleteRecording(id) {
-    return this.req("DELETE", `/ssh/recordings/${id}`);
+    return this.req("DELETE", `/ssh/recordings/${encodeURIComponent(id)}`);
   }
   // VT-143: generate (or fetch cached) an AI session summary for a recording. regenerate forces recompute.
   summarizeRecording(id, regenerate = false) {
-    return this.req("POST", `/ssh/recordings/${id}/summary${regenerate ? "?regenerate=1" : ""}`);
+    return this.req("POST", `/ssh/recordings/${encodeURIComponent(id)}/summary${regenerate ? "?regenerate=1" : ""}`);
   }
   // --- #2628: org recording review and retention, org owners and admins only ---
   getRecordingPolicy() {
@@ -30477,10 +30539,10 @@ var KutrionClient = class {
     return this.req("GET", `/exposure${s ? `?${s}` : ""}`);
   }
   resolveExposure(id, resolution) {
-    return this.req("POST", `/exposure/${id}/resolve`, { resolution });
+    return this.req("POST", `/exposure/${encodeURIComponent(id)}/resolve`, { resolution });
   }
   suppressExposure(id, patterns = []) {
-    return this.req("POST", `/exposure/${id}/suppress`, { patterns });
+    return this.req("POST", `/exposure/${encodeURIComponent(id)}/suppress`, { patterns });
   }
   // --- integrations hub: outbound alert + SIEM connectors (VT-310 / VT-485) ---
   integrationCatalog() {
@@ -30493,16 +30555,16 @@ var KutrionClient = class {
     return this.req("POST", "/integrations", input);
   }
   updateIntegration(id, input) {
-    return this.req("PATCH", `/integrations/${id}`, input);
+    return this.req("PATCH", `/integrations/${encodeURIComponent(id)}`, input);
   }
   deleteIntegration(id) {
-    return this.req("DELETE", `/integrations/${id}`);
+    return this.req("DELETE", `/integrations/${encodeURIComponent(id)}`);
   }
   testIntegration(id) {
-    return this.req("POST", `/integrations/${id}/test`);
+    return this.req("POST", `/integrations/${encodeURIComponent(id)}/test`);
   }
   listIntegrationDeliveries(id, limit = 50) {
-    return this.req("GET", `/integrations/${id}/deliveries?limit=${limit}`);
+    return this.req("GET", `/integrations/${encodeURIComponent(id)}/deliveries?limit=${limit}`);
   }
   // --- HashiCorp Vault secret sync (VT-306): ENTERPRISE-gated (secret_sync). Auth secret is write-only. ---
   listHcvConnections() {
@@ -30512,28 +30574,28 @@ var KutrionClient = class {
     return this.req("POST", "/hashicorp/connections", input);
   }
   updateHcvConnection(id, input) {
-    return this.req("PATCH", `/hashicorp/connections/${id}`, input);
+    return this.req("PATCH", `/hashicorp/connections/${encodeURIComponent(id)}`, input);
   }
   deleteHcvConnection(id) {
-    return this.req("DELETE", `/hashicorp/connections/${id}`);
+    return this.req("DELETE", `/hashicorp/connections/${encodeURIComponent(id)}`);
   }
   testHcvConnection(id) {
-    return this.req("POST", `/hashicorp/connections/${id}/test`);
+    return this.req("POST", `/hashicorp/connections/${encodeURIComponent(id)}/test`);
   }
   listHcvMappings(connId) {
-    return this.req("GET", `/hashicorp/connections/${connId}/mappings`);
+    return this.req("GET", `/hashicorp/connections/${encodeURIComponent(connId)}/mappings`);
   }
   createHcvMapping(connId, input) {
-    return this.req("POST", `/hashicorp/connections/${connId}/mappings`, input);
+    return this.req("POST", `/hashicorp/connections/${encodeURIComponent(connId)}/mappings`, input);
   }
   deleteHcvMapping(mappingId) {
-    return this.req("DELETE", `/hashicorp/mappings/${mappingId}`);
+    return this.req("DELETE", `/hashicorp/mappings/${encodeURIComponent(mappingId)}`);
   }
   syncHcvMapping(mappingId, resolve2) {
-    return this.req("POST", `/hashicorp/mappings/${mappingId}/sync${resolve2 ? `?resolve=${resolve2}` : ""}`);
+    return this.req("POST", `/hashicorp/mappings/${encodeURIComponent(mappingId)}/sync${resolve2 ? `?resolve=${resolve2}` : ""}`);
   }
   syncHcvConnection(connId, resolve2) {
-    return this.req("POST", `/hashicorp/connections/${connId}/sync${resolve2 ? `?resolve=${resolve2}` : ""}`);
+    return this.req("POST", `/hashicorp/connections/${encodeURIComponent(connId)}/sync${resolve2 ? `?resolve=${resolve2}` : ""}`);
   }
   // --- rdp broker (VT-490) ---
   listRdpConnections() {
@@ -30543,28 +30605,28 @@ var KutrionClient = class {
     return this.req("POST", "/rdp/connections", input);
   }
   updateRdpConnection(id, input) {
-    return this.req("PATCH", `/rdp/connections/${id}`, input);
+    return this.req("PATCH", `/rdp/connections/${encodeURIComponent(id)}`, input);
   }
   deleteRdpConnection(id) {
-    return this.req("DELETE", `/rdp/connections/${id}`);
+    return this.req("DELETE", `/rdp/connections/${encodeURIComponent(id)}`);
   }
   testRdpConnection(id) {
-    return this.req("POST", `/rdp/connections/${id}/test`);
+    return this.req("POST", `/rdp/connections/${encodeURIComponent(id)}/test`);
   }
   startRdpSession(id) {
-    return this.req("POST", `/rdp/connections/${id}/session`);
+    return this.req("POST", `/rdp/connections/${encodeURIComponent(id)}/session`);
   }
   listRdpSessions() {
     return this.req("GET", "/rdp/sessions");
   }
   endRdpSession(sessionId) {
-    return this.req("DELETE", `/rdp/sessions/${sessionId}`);
+    return this.req("DELETE", `/rdp/sessions/${encodeURIComponent(sessionId)}`);
   }
   // Stream a brokered session's recording (broker proxies it from the gateway). Binary, so it bypasses
   // the JSON req() helper — same shape as sftpDownload/fileDownload.
   async getRdpRecording(sessionId) {
     const tok = this.getToken();
-    const res = await this.f(`${this.baseUrl}/rdp/sessions/${sessionId}/recording`, {
+    const res = await this.f(`${this.baseUrl}/rdp/sessions/${encodeURIComponent(sessionId)}/recording`, {
       headers: this.rawHeaders(tok)
     });
     if (!res.ok) throw new ApiError(res.status, apiErrorMessage(res.status));
@@ -30607,7 +30669,7 @@ var KutrionClient = class {
   }
   // Files AI (#325): build a filename regex from natural language, summarize a listing, or propose a
   // rename plan. All run LAN-first; only file NAMES/metadata are sent (never file content), through the
-  // redaction gate. The returned regex is server-validated to compile and be free of ReDoS shapes.
+  // redaction gate. The returned regex is server-validated to compile and to lack the most obvious ReDoS shapes only (isSafeRegex is a heuristic: (a|a)+ passes); clients must run it under a time budget.
   aiFilePattern(input) {
     return this.req("POST", "/ai/files/pattern", input);
   }
@@ -30639,16 +30701,16 @@ var KutrionClient = class {
     return this.req("GET", "/jit/requests");
   }
   getJitRequest(id) {
-    return this.req("GET", `/jit/requests/${id}`);
+    return this.req("GET", `/jit/requests/${encodeURIComponent(id)}`);
   }
   approveJitRequest(id, note) {
-    return this.req("POST", `/jit/requests/${id}/approve`, { note });
+    return this.req("POST", `/jit/requests/${encodeURIComponent(id)}/approve`, { note });
   }
   denyJitRequest(id, note) {
-    return this.req("POST", `/jit/requests/${id}/deny`, { note });
+    return this.req("POST", `/jit/requests/${encodeURIComponent(id)}/deny`, { note });
   }
   revokeJitRequest(id) {
-    return this.req("POST", `/jit/requests/${id}/revoke`);
+    return this.req("POST", `/jit/requests/${encodeURIComponent(id)}/revoke`);
   }
   // --- rotation copilot (VT-145) ---
   rotationServices() {
@@ -30672,13 +30734,13 @@ var KutrionClient = class {
     return this.req("POST", "/fleet/plan", input);
   }
   executeFleetRun(id) {
-    return this.req("POST", `/fleet/runs/${id}/execute`, { confirm: true });
+    return this.req("POST", `/fleet/runs/${encodeURIComponent(id)}/execute`, { confirm: true });
   }
   fleetRuns() {
     return this.req("GET", "/fleet/runs");
   }
   fleetRun(id) {
-    return this.req("GET", `/fleet/runs/${id}`);
+    return this.req("GET", `/fleet/runs/${encodeURIComponent(id)}`);
   }
   // --- anomaly baseline (VT-204) ---
   refreshBaseline() {
@@ -31222,6 +31284,9 @@ var SSH_REFUSAL_CLASSIFICATION = {
   // Something answered on that port and it was not an SSH server; what is listening has to change
   // first, even though the user is who can change it.
   protocol_error: { family: "failed", retry: "pointless" },
+  // #3419: the login was accepted and the host refused a PTY or a shell. The account is set up that
+  // way on the host, so every attempt earns the same answer.
+  shell_refused: { family: "failed", retry: "pointless" },
   // The rest are genuine retry candidates: a transport fact can be different a second later.
   connection_refused: { family: "failed", retry: "possible" },
   host_not_found: { family: "failed", retry: "possible" },
@@ -32853,14 +32918,14 @@ var KNOWN_FLAGS = /* @__PURE__ */ new Set([
 function unknownFlags(flags) {
   return Object.keys(flags).filter((k) => !KNOWN_FLAGS.has(k));
 }
-function parseArgs(argv) {
+function parseArgs(argv2) {
   const flags = {};
   let at = 0;
-  while (at < argv.length && argv[at].startsWith("--")) {
-    const key = argv[at].slice(2);
+  while (at < argv2.length && argv2[at].startsWith("--")) {
+    const key = argv2[at].slice(2);
     const kind = GLOBAL_FLAGS[key];
     if (!kind) break;
-    const next = argv[at + 1];
+    const next = argv2[at + 1];
     if (kind === "value" && next !== void 0 && !next.startsWith("--")) {
       flags[key] = next;
       at += 2;
@@ -32869,8 +32934,8 @@ function parseArgs(argv) {
       at += 1;
     }
   }
-  const cmd = argv[at];
-  const rest = argv.slice(at + 1);
+  const cmd = argv2[at];
+  const rest = argv2.slice(at + 1);
   const positionals = [];
   for (let i = 0; i < rest.length; i++) {
     const a = rest[i];
@@ -34029,15 +34094,18 @@ async function borrowAndEnrol(deps) {
   if (enrolment === "device_clients_disabled" || enrolment === "satellite_update_required" || enrolment === "hub_not_bound") return { ok: false, reason: enrolment };
   return enrolment ? { ok: true, enrolment, hubPublicKey: borrowed.hubPublicKey } : { ok: false, reason: "enrol_refused" };
 }
-function createBorrowSession(store, client, resolveDeps) {
+function createBorrowSession(store, client, resolveDeps, otherSigninHeld = () => false) {
   let pending = null;
   let held = null;
   let pin = null;
   let running = false;
+  let autoTried = false;
   return {
-    begin() {
-      if (running) return { ok: false, reason: "already_enrolled" };
-      if (held) return { ok: false, reason: "already_enrolled" };
+    begin(auto = false) {
+      if (auto && autoTried) return { ok: false, reason: "auto_done" };
+      if (auto) autoTried = true;
+      if (running) return { ok: false, reason: "busy" };
+      if (held || otherSigninHeld()) return { ok: false, reason: "signin_in_progress" };
       const p = prepareBorrow(store, client);
       pending = p.ok ? p : null;
       return p.ok ? { ok: true, fingerprint: p.fingerprint } : { ok: false, reason: p.reason };
@@ -34064,6 +34132,9 @@ function createBorrowSession(store, client, resolveDeps) {
       pin = deps.pin;
       return { ok: true, deviceId: out.deviceId, firstContact: out.held !== null };
     },
+    suppressAuto() {
+      autoTried = true;
+    },
     cancel() {
       pending = null;
     },
@@ -34241,14 +34312,29 @@ function joinedAccount(user, lastAccount) {
     accountChanged: lastAccount !== null && lastAccount !== user.id
   };
 }
+var HELD_TTL_MS = 3e5;
 function createBorrowConfirm(deps) {
+  const ttl = deps.ttlMs ?? HELD_TTL_MS;
+  const now = deps.now ?? Date.now;
   let account = null;
   let heldId = null;
   let heldName = null;
+  let heldAt = 0;
+  let timer = null;
   const remember = (user) => {
     if (deps.lastAccount.get() !== user.id) deps.lastAccount.set(user.id);
   };
+  const expired = () => account !== null && now() - heldAt >= ttl;
+  const reap = () => {
+    if (!expired()) return false;
+    void reject().then(() => deps.onExpired?.());
+    return true;
+  };
   const reject = async () => {
+    if (timer) {
+      clearTimeout(timer);
+      timer = null;
+    }
     account = null;
     heldId = null;
     heldName = null;
@@ -34262,19 +34348,28 @@ function createBorrowConfirm(deps) {
       account = user;
       heldId = deviceId;
       heldName = deviceName ?? null;
+      heldAt = now();
+      if (timer) clearTimeout(timer);
+      timer = setTimeout(reap, ttl);
+      timer.unref?.();
     },
-    pending: () => account ? { ...joinedAccount(account, deps.lastAccount.get()), deviceName: heldName } : null,
+    pending: () => account && !reap() ? { ...joinedAccount(account, deps.lastAccount.get()), deviceName: heldName, deviceId: heldId } : null,
     seen(user) {
       if (!account && user) remember(user);
     },
-    async confirm() {
+    async confirm(deviceId) {
+      if (reap()) return false;
       const user = account;
       const id = heldId;
-      if (!user || !id) return false;
+      if (!user || !id || id !== deviceId) return false;
       if (!deps.borrow.commit(id)) {
         await reject();
         return false;
       }
+      if (timer) {
+        clearTimeout(timer);
+        timer = null;
+      }
       account = null;
       heldId = null;
       remember(user);
@@ -34476,6 +34571,10 @@ function cliHubStores(base, kc, keychainAvailable) {
   };
   return { store, pin, latch, lastAccount, failedWrite: () => failed2 ? { deviceId, bearer } : null };
 }
+var lastAccountId = (base, kc) => read(kc, slot.lastAccount(base));
+function recordLastAccountId(base, kc, user) {
+  if (user && typeof user.id === "string" && user.id) write(kc, slot.lastAccount(base), user.id);
+}
 function borrowedDeviceKey(base, kc) {
   return readDevice(kc, base).key;
 }
@@ -34576,6 +34675,7 @@ async function hubLogin(deps) {
   if (!deps.keychainAvailable()) return { kind: "fallback", note: null, reason: "no_keychain" };
   if (locationFault(deps.location)) return { kind: "fallback", note: null, reason: "hub_not_running" };
   const { store, pin, latch, lastAccount, failedWrite } = cliHubStores(deps.base, deps.kc, deps.keychainAvailable);
+  if (deps.pairedOnly && !pin.hubPublicKey) return { kind: "fallback", note: null, reason: "not_paired" };
   const revoke = (deviceId, bearer) => endServerSession(deps.call, deviceId, bearer);
   const session = createBorrowSession(store, "cli", () => ({
     location: deps.location,
@@ -34627,11 +34727,36 @@ async function hubLogin(deps) {
   const verdict = await presentJoined(confirm, deps.out, deps.ask);
   if (verdict === "not_kept") return { kind: "fallback", note: HUB_COPY.notKept, reason: "not_kept" };
   if (verdict === "not_you") return { kind: "fallback", note: HUB_COPY.notYou, reason: "not_you" };
-  if (!await confirm.confirm()) return { kind: "fallback", note: HUB_COPY.notKept, reason: "not_kept" };
+  if (!await confirm.confirm(done.deviceId)) return { kind: "fallback", note: HUB_COPY.notKept, reason: "not_kept" };
   const lost = await unkept();
   if (lost) return lost;
   return { kind: "signed_in", user, firstContact: true };
 }
+var canPromptYes = (stdin, stderr) => Boolean(stdin.isTTY && stderr.isTTY);
+var reborrowFromHub = (deps) => hubLogin({ ...deps, pairedOnly: true });
+var loginTriesHub = (flags, accountRoot) => flags.email === void 0 && flags["password-stdin"] !== true && accountRoot !== null;
+var HubAccountSwitchedError = class extends Error {
+  constructor(email) {
+    super(`Signed in through Kutrion Hub as ${email === null ? "an account it could not name" : printable(email)}, which is not the account this command started on. Run it again to use that account.`);
+    this.name = "HubAccountSwitchedError";
+  }
+};
+async function retryAfterHubReborrow(run2, deps) {
+  try {
+    return await run2();
+  } catch (e) {
+    if (!deps.refusedSession(e) || deps.wrote()) throw e;
+    const before = deps.lastAccount();
+    const hub = await deps.reborrow();
+    if (hub.kind !== "signed_in") {
+      if (hub.note) deps.out(hub.note);
+      throw e;
+    }
+    if (!before || !hub.user || hub.user.id !== before) throw new HubAccountSwitchedError(hub.user ? hub.user.email : null);
+    deps.out(`Signed in again with the Kutrion app as ${printable(hub.user.email)}; running the command again.`);
+  }
+  return run2();
+}
 
 // src/hub/hub-seed.ts
 init_define_KT_HUB_FILES();
@@ -35517,6 +35642,7 @@ async function confirmChainedHostKey(deps, connId, k, own) {
 }
 
 // src/refusal.ts
+var refreshWhy = (code, noun = "session") => refreshRefusalCopy(code, noun)?.why ?? code;
 var REFUSALS = {
   // #1538 authoring time. Safe to key here even though `jump_cycle` and `jump_too_deep` are also
   // WebSocket codes: this table is read only by refusalLines() on the HTTP path, and wsRefusalLines()
@@ -35539,7 +35665,7 @@ var REFUSALS = {
     action: "Run `kt conns` and pass an id from the first column to --jump."
   },
   // auth-guard.ts:109 (social-session gate) and :167 (adaptive), plus rotation.ts:159, jit.ts:226,
-  // fleet.ts:190, agents.ts:146, modules/ssh.ts:727 and :1222. The remedy is mechanical and worth
+  // fleet.ts:190, agents.ts:146, modules/ssh.ts:730 and :1228. The remedy is mechanical and worth
   // stating exactly, because it is not obvious that it can be satisfied anywhere but here: step-up
   // freshness is a per-USER Redis proof with a ~5 minute TTL (server/src/lib/step-up.ts:16), not a
   // claim baked into this CLI's token. Stepping up in the web app on the same account therefore
@@ -35568,6 +35694,49 @@ var REFUSALS = {
     why: "The token stored for this server is no longer accepted, so every command will be refused until this machine signs in again.",
     action: "Run `kt login` to sign in again."
   },
+  // #3444/#3445: POST /auth/refresh terminal verdicts (server/src/modules/devices.ts). Each ends the
+  // stored session, like device_revoked, so the only way forward is a fresh `kt login`. The Hub pair
+  // reuses the extension's sentences word for word.
+  refresh_credentials_changed: {
+    title: "Your password changed",
+    why: refreshWhy("refresh_credentials_changed"),
+    action: "Run `kt login` with your new password."
+  },
+  refresh_hub_signed_out: {
+    title: "This session was signed out",
+    why: refreshWhy("refresh_hub_signed_out"),
+    action: "Run `kt login` to sign in again."
+  },
+  refresh_hub_revoked: {
+    title: "This session was signed out",
+    why: refreshWhy("refresh_hub_revoked"),
+    action: "Run `kt login` to sign in again."
+  },
+  device_revoked: {
+    title: "This device was signed out",
+    why: refreshWhy("device_revoked", "device"),
+    action: "Run `kt login` to sign in again and register it anew."
+  },
+  account_inactive: {
+    title: "This account has ended",
+    why: refreshWhy("account_inactive"),
+    action: "Your administrator can restore the account. Signing in again will not work until they do."
+  },
+  account_expired: {
+    title: "This account has expired",
+    why: refreshWhy("account_expired"),
+    action: "Your administrator can extend the account. Signing in again will not work until they do."
+  },
+  user_inactive: {
+    title: "This account has ended",
+    why: refreshWhy("user_inactive"),
+    action: "Your administrator can restore the account. Signing in again will not work until they do."
+  },
+  org_mismatch: {
+    title: "This session was signed out",
+    why: refreshWhy("org_mismatch"),
+    action: "Run `kt login` to sign in again with your current organization."
+  },
   // auth-guard.ts:164. The distinguishing fact is that this one CANNOT be stepped up out of — it is
   // sent precisely when the account holds no second factor to step up with.
   access_blocked: {
@@ -35739,7 +35908,7 @@ var REFUSALS = {
     why: "Kutrion does not display, copy, export or share this credential's value. It is still used to authenticate connections and integrations.",
     action: "Use the credential rather than reading it \u2014 `kt ssh <connId>` or `kt exec <connId> <command>` broker a session with it without the value passing through this terminal."
   },
-  // modules/ssh.ts:470, modules/rdp.ts:151.
+  // modules/ssh.ts:473, modules/rdp.ts:151.
   inject_only_requires_write: {
     title: "Write access required for a No-reveal credential",
     why: "Pointing a connection at a No-reveal credential needs write access to the vault holding it, because the person doing it decides where the credential gets presented.",
@@ -35936,11 +36105,15 @@ var STATUS_ACTION = {
   422: "The server understood the request but refused its values. Check the values passed against `kt --help`.",
   429: "Too many requests in a short period. Wait before retrying rather than looping."
 };
+var HUB_SIGN_IN_ACTION = {
+  status: "This machine's session was not accepted. Run `kt login`, it signs in through Kutrion Hub.",
+  signed_out: "Run `kt login`, it signs in through Kutrion Hub."
+};
 var SERVER_REFUSALS = /* @__PURE__ */ new Set(["payment_unconfirmed"]);
 var sentenceKey = (t) => t.toLowerCase().replace(/[^a-z0-9]+/g, "");
 var sameSentence = (a, b) => b !== void 0 && sentenceKey(a) === sentenceKey(b);
 var SIGNIN_CODE_REFUSALS = /* @__PURE__ */ new Set(["email_code_required", "signin_code_cap"]);
-function refusalLines(e, indent = "  ") {
+function refusalLines(e, indent = "  ", opts2 = {}) {
   if (!(e instanceof ApiError)) return null;
   if (e.status < 400 || e.status >= 500 && !SERVER_REFUSALS.has(refusalCode(e))) return null;
   const dest = parseDestinationRefusal(e.body);
@@ -35963,11 +36136,12 @@ function refusalLines(e, indent = "  ") {
       `${indent}kt conn set <id> --jump none`
     ];
   }
-  const code = refusalCode(e);
+  const fromRefresh = e.refreshCode !== void 0 && Object.hasOwn(REFUSALS, e.refreshCode);
+  const code = fromRefresh ? e.refreshCode : refusalCode(e);
   const platformFlag = platformFlagRefusalText(code);
   if (platformFlag) return [`Turned off on this deployment (${code}, HTTP ${e.status})`, "", platformFlag];
   const copy = Object.hasOwn(REFUSALS, code) ? REFUSALS[code] : void 0;
-  const server = SIGNIN_CODE_REFUSALS.has(code) ? null : serverText(e.body);
+  const server = fromRefresh || SIGNIN_CODE_REFUSALS.has(code) ? null : serverText(e.body);
   const context = contextLines(e.body, indent);
   const head = copy ? `${copy.title} (${code}, HTTP ${e.status})` : `Refused by the server (${code}, HTTP ${e.status})`;
   const lines = [head, ""];
@@ -35976,7 +36150,9 @@ function refusalLines(e, indent = "  ") {
   if (!copy && !server) lines.push("The server sent no explanation with this refusal.");
   if (context.length) lines.push("", ...context);
   lines.push("");
-  if (copy?.action) lines.push(copy.action);
+  const hubAction = !opts2.hubSignIn || e.status !== 401 ? null : code === "session_signed_out" ? HUB_SIGN_IN_ACTION.signed_out : copy ? null : HUB_SIGN_IN_ACTION.status;
+  if (hubAction) lines.push(hubAction);
+  else if (copy?.action) lines.push(copy.action);
   else if (copy) lines.push("Nothing at this terminal changes this answer.");
   else lines.push(STATUS_ACTION[e.status] ?? `Quote the code and status above when reporting this; they are the whole of what the server sent.`);
   return lines;
@@ -36233,6 +36409,18 @@ function refuseBodyRedirects(inner = fetch) {
     }
   };
 }
+function trackWrites(inner) {
+  let wrote = false;
+  return {
+    fetch: async (input, init) => {
+      const res = await inner(input, init);
+      const method = (init?.method ?? (input instanceof Request ? input.method : "GET")).toUpperCase();
+      if (res.ok && method !== "GET") wrote = true;
+      return res;
+    },
+    wrote: () => wrote
+  };
+}
 
 // src/mcp-install.ts
 var appData = () => process.env.APPDATA ?? (0, import_path4.join)((0, import_os4.homedir)(), "AppData", "Roaming");
@@ -37415,11 +37603,11 @@ function parsePurposes(v) {
   }
   return out.length ? out : { error: `--purposes is required: one or more of ${ENROLL_PURPOSES.join(", ")}` };
 }
-function parseConfirms(argv) {
+function parseConfirms(argv2) {
   const out = /* @__PURE__ */ new Map();
-  for (let i = 0; i < argv.length; i++) {
-    if (argv[i] !== "--confirm") continue;
-    const v = argv[i + 1];
+  for (let i = 0; i < argv2.length; i++) {
+    if (argv2[i] !== "--confirm") continue;
+    const v = argv2[i + 1];
     if (v === void 0 || v.startsWith("--")) return { error: "--confirm needs <connId|host>=<fingerprint>" };
     i++;
     for (const pair of v.split(",").map((s) => s.trim()).filter(Boolean)) {
@@ -38155,10 +38343,11 @@ var ROLES = ["OWNER", "ADMIN", "EDITOR", "VIEWER"];
 var TOKEN_SCOPES = ["scim", "events"];
 var ORG_ROLES = ["owner", "admin", "member"];
 var ROTATION_SERVICES = ["linux_password", "postgres_password", "mysql_password"];
-var VERSION = true ? "1.2.12" : "dev";
+var VERSION = true ? "1.2.14" : "dev";
 var HELP = `kt \u2014 Kutrion CLI
   kt login [--email <e>] [--password-stdin] [--code <2fa>]   prompts for the password, or reads it from stdin;
-                                               at a terminal with no --email, first asks the Kutrion desktop app,
+                                               with no --email or --password-stdin, first asks the Kutrion desktop app
+                                               (without a terminal, only one this CLI has already paired with),
                                                then falls back to your email and password;
                                                at the emailed-code prompt, a blank entry or r sends a new code
   kt login --browser                           not available; exits with an error
@@ -38472,6 +38661,34 @@ function runForward(base, token, connId, spec, ctx = {}) {
     console.log(`forwarding 127.0.0.1:${localPort} -> ${dstHost}:${dstPort} via ${connId}  (Ctrl-C to stop)`);
   });
 }
+function hubCallFor(base) {
+  return async (method, path, body, bearer) => {
+    try {
+      const res = await refuseBodyRedirects()(base + path, {
+        method,
+        headers: { Authorization: `Bearer ${bearer}`, Accept: "application/json", ...body === void 0 ? {} : { "Content-Type": "application/json" } },
+        body: body === void 0 ? void 0 : JSON.stringify(body),
+        signal: AbortSignal.timeout(15e3)
+      });
+      return { ok: res.ok, status: res.status, data: res.ok ? await res.json().catch(() => null) : null };
+    } catch {
+      return { ok: false, status: null, data: null };
+    }
+  };
+}
+var OWN_SIGN_IN = /* @__PURE__ */ new Set(["login", "logout", "mcp", "ci-login", "run", "enroll", "share-redeem", "help", "--help", "-h"]);
+var SESSION_REFUSED = /* @__PURE__ */ new Set(["unauthorized", "session_signed_out"]);
+var sessionWrites = trackWrites(refuseBodyRedirects());
+function refusedSavedSession(e, argv2) {
+  if (!(e instanceof ApiError) || e.status !== 401 || !SESSION_REFUSED.has(refusalCode(e)) || OWN_SIGN_IN.has(argv2.cmd)) return false;
+  if (Object.entries(argv2.flags).some(([k, v]) => k.endsWith("-stdin") && v === true)) return false;
+  const base = resolveBase(argv2.flags.base);
+  try {
+    return Boolean(base && getToken(base));
+  } catch {
+    return false;
+  }
+}
 async function main() {
   const { cmd, positionals, flags } = parseArgs(process.argv.slice(2));
   const asJson = flags.json === true;
@@ -38527,7 +38744,7 @@ run \`kt --help\` for the flags each command takes`);
     // blank User-Agent it never set. Relaxing only, and never required — an older CLI that omits it
     // is treated exactly as it is today.
     client: "cli",
-    fetchImpl: refuseBodyRedirects(),
+    fetchImpl: sessionWrites.fetch,
     // #2984: only a hub borrow leaves a refresh token, in the OS keychain beside the access token.
     getRefreshToken: () => {
       try {
@@ -38562,19 +38779,7 @@ run \`kt --help\` for the flags each command takes`);
     }
   });
   const kc = { get: getToken, set: setToken, clear: clearToken };
-  const hubCall = async (method, path, body, bearer) => {
-    try {
-      const res = await refuseBodyRedirects()(cfg.base + path, {
-        method,
-        headers: { Authorization: `Bearer ${bearer}`, Accept: "application/json", ...body === void 0 ? {} : { "Content-Type": "application/json" } },
-        body: body === void 0 ? void 0 : JSON.stringify(body),
-        signal: AbortSignal.timeout(15e3)
-      });
-      return { ok: res.ok, status: res.status, data: res.ok ? await res.json().catch(() => null) : null };
-    } catch {
-      return { ok: false, status: null, data: null };
-    }
-  };
+  const hubCall = hubCallFor(cfg.base);
   const connectionContext = async (connId) => {
     try {
       const rows = (await client.listConnections()).connections;
@@ -38684,7 +38889,8 @@ run \`kt --help\` for the flags each command takes`);
         console.error("kt login --browser is not available: browser sign-in is switched off. Sign in with the Kutrion app (`kt login`), or use `kt login --email <email> --password-stdin`.");
         process.exit(EXIT_ERROR);
       }
-      if (process.stdin.isTTY && flags.email === void 0 && !fromStdin && flags.code === void 0 && accountRoot) {
+      const tty = canPromptYes(process.stdin, process.stderr);
+      if (accountRoot && loginTriesHub(flags, accountRoot)) {
         const hub = await hubLogin({
           base: cfg.base,
           location: hubLocation(accountRoot),
@@ -38692,7 +38898,8 @@ run \`kt --help\` for the flags each command takes`);
           keychainAvailable: osKeychainAvailable,
           call: hubCall,
           out: (l) => console.error(l),
-          ask: (q) => promptLine(q)
+          ask: (q) => promptLine(q),
+          pairedOnly: !tty
         });
         if (hub.kind === "store_failed") die(hub.note);
         if (hub.kind === "signed_in") {
@@ -38702,7 +38909,7 @@ run \`kt --help\` for the flags each command takes`);
           break;
         }
         if (hub.note) console.error(hub.note);
-        if (hubAbsent(hub.reason)) console.error("Installing the Kutrion app... Run `kt login` again once it is open, or sign in with your email and password below.");
+        if (tty && hubAbsent(hub.reason)) console.error("Installing the Kutrion app... Run `kt login` again once it is open, or sign in with your email and password below.");
       }
       if (flags.email === void 0 && !fromStdin) {
         const hint = otherAppsHint(accountRoot);
@@ -38762,6 +38969,7 @@ run \`kt --help\` for the flags each command takes`);
         })()
       }).catch(() => ({ kind: "skipped", note: null }));
       recordSignIn(accountRoot, signedIn);
+      recordLastAccountId(cfg.base, kc, signedIn);
       console.log(`logged in (token stored in ${backendName()})`);
       if (rememberBase(cfg.base)) console.log(`server saved: ${cfg.base} (later commands need no --base)`);
       if (registered.kind === "skipped" && registered.note) console.error(registered.note);
@@ -40287,12 +40495,36 @@ run \`kt --help\` for the list of commands`);
   }
 }
 installFetchProxy();
-main().catch((e) => {
+var argv = parseArgs(process.argv.slice(2));
+var hubSlots = { get: getToken, set: setToken, clear: clearToken };
+var hubSignInAvailable = (e) => e instanceof ApiError && e.status === 401 && appDataDir() !== null && osKeychainAvailable();
+retryAfterHubReborrow(main, {
+  refusedSession: (e) => refusedSavedSession(e, argv),
+  wrote: sessionWrites.wrote,
+  lastAccount: () => lastAccountId(resolveBase(argv.flags.base), hubSlots),
+  reborrow: async () => {
+    const base = resolveBase(argv.flags.base);
+    const root = appDataDir();
+    if (!root) return { kind: "fallback", note: null, reason: "hub_not_running" };
+    const hub = await reborrowFromHub({
+      base,
+      location: hubLocation(root),
+      kc: hubSlots,
+      keychainAvailable: osKeychainAvailable,
+      call: hubCallFor(base),
+      out: (l) => console.error(l),
+      ask: (q) => promptLine(q)
+    });
+    if (hub.kind === "signed_in") recordSignIn(root, hub.user);
+    return hub.kind === "fallback" && hubAbsent(hub.reason) ? { ...hub, note: null } : hub;
+  },
+  out: (l) => console.error(l)
+}).catch((e) => {
   const api3 = e instanceof ApiError ? e : null;
   const code = api3 ? exitForStatus(api3.status) : EXIT_ERROR;
   const message = redactProxyUrls(e instanceof Error ? e.message : String(e));
-  const lines = (storeFailure(e) ?? refusalLines(e) ?? [`error: ${message}`]).map(redactProxyUrls);
-  if (parseArgs(process.argv.slice(2)).flags.json === true) {
+  const lines = (e instanceof HubAccountSwitchedError ? [e.message] : storeFailure(e) ?? refusalLines(e, "  ", { hubSignIn: hubSignInAvailable(e) }) ?? [`error: ${message}`]).map(redactProxyUrls);
+  if (argv.flags.json === true) {
     console.log(JSON.stringify({
       error: api3 ? refusalCode(api3) : message,
       ...api3 ? { status: api3.status } : {},