@kutrion/cli 1.2.12 → 1.2.16

package/dist/index.js

@@ -10417,22 +10417,22 @@ var require_formdata = __commonJS({
         name = webidl.converters.USVString(name, prefix, "name");
         value = isBlobLike(value) ? webidl.converters.Blob(value, prefix, "value", { strict: false }) : webidl.converters.USVString(value, prefix, "value");
         filename = arguments.length === 3 ? webidl.converters.USVString(filename, prefix, "filename") : void 0;
-        const entry = makeEntry(name, value, filename);
-        this[kState].push(entry);
+        const entry2 = makeEntry(name, value, filename);
+        this[kState].push(entry2);
       }
       delete(name) {
         webidl.brandCheck(this, _FormData);
         const prefix = "FormData.delete";
         webidl.argumentLengthCheck(arguments, 1, prefix);
         name = webidl.converters.USVString(name, prefix, "name");
-        this[kState] = this[kState].filter((entry) => entry.name !== name);
+        this[kState] = this[kState].filter((entry2) => entry2.name !== name);
       }
       get(name) {
         webidl.brandCheck(this, _FormData);
         const prefix = "FormData.get";
         webidl.argumentLengthCheck(arguments, 1, prefix);
         name = webidl.converters.USVString(name, prefix, "name");
-        const idx = this[kState].findIndex((entry) => entry.name === name);
+        const idx = this[kState].findIndex((entry2) => entry2.name === name);
         if (idx === -1) {
           return null;
         }
@@ -10443,14 +10443,14 @@ var require_formdata = __commonJS({
         const prefix = "FormData.getAll";
         webidl.argumentLengthCheck(arguments, 1, prefix);
         name = webidl.converters.USVString(name, prefix, "name");
-        return this[kState].filter((entry) => entry.name === name).map((entry) => entry.value);
+        return this[kState].filter((entry2) => entry2.name === name).map((entry2) => entry2.value);
       }
       has(name) {
         webidl.brandCheck(this, _FormData);
         const prefix = "FormData.has";
         webidl.argumentLengthCheck(arguments, 1, prefix);
         name = webidl.converters.USVString(name, prefix, "name");
-        return this[kState].findIndex((entry) => entry.name === name) !== -1;
+        return this[kState].findIndex((entry2) => entry2.name === name) !== -1;
       }
       set(name, value, filename = void 0) {
         webidl.brandCheck(this, _FormData);
@@ -10464,16 +10464,16 @@ var require_formdata = __commonJS({
         name = webidl.converters.USVString(name, prefix, "name");
         value = isBlobLike(value) ? webidl.converters.Blob(value, prefix, "name", { strict: false }) : webidl.converters.USVString(value, prefix, "name");
         filename = arguments.length === 3 ? webidl.converters.USVString(filename, prefix, "name") : void 0;
-        const entry = makeEntry(name, value, filename);
-        const idx = this[kState].findIndex((entry2) => entry2.name === name);
+        const entry2 = makeEntry(name, value, filename);
+        const idx = this[kState].findIndex((entry3) => entry3.name === name);
         if (idx !== -1) {
           this[kState] = [
             ...this[kState].slice(0, idx),
-            entry,
-            ...this[kState].slice(idx + 1).filter((entry2) => entry2.name !== name)
+            entry2,
+            ...this[kState].slice(idx + 1).filter((entry3) => entry3.name !== name)
           ];
         } else {
-          this[kState].push(entry);
+          this[kState].push(entry2);
         }
       }
       [nodeUtil.inspect.custom](depth, options) {
@@ -13753,16 +13753,16 @@ var require_env_http_proxy_agent = __commonJS({
           return false;
         }
         for (let i = 0; i < this.#noProxyEntries.length; i++) {
-          const entry = this.#noProxyEntries[i];
-          if (entry.port && entry.port !== port) {
+          const entry2 = this.#noProxyEntries[i];
+          if (entry2.port && entry2.port !== port) {
             continue;
           }
-          if (!/^[.*]/.test(entry.hostname)) {
-            if (hostname3 === entry.hostname) {
+          if (!/^[.*]/.test(entry2.hostname)) {
+            if (hostname3 === entry2.hostname) {
               return false;
             }
           } else {
-            if (hostname3.endsWith(entry.hostname.replace(/^\*/, ""))) {
+            if (hostname3.endsWith(entry2.hostname.replace(/^\*/, ""))) {
               return false;
             }
           }
@@ -13774,13 +13774,13 @@ var require_env_http_proxy_agent = __commonJS({
         const noProxySplit = noProxyValue.split(/[,\s]/);
         const noProxyEntries = [];
         for (let i = 0; i < noProxySplit.length; i++) {
-          const entry = noProxySplit[i];
-          if (!entry) {
+          const entry2 = noProxySplit[i];
+          if (!entry2) {
             continue;
           }
-          const parsed = entry.match(/^(.+):(\d+)$/);
+          const parsed = entry2.match(/^(.+):(\d+)$/);
           noProxyEntries.push({
-            hostname: (parsed ? parsed[1] : entry).toLowerCase(),
+            hostname: (parsed ? parsed[1] : entry2).toLowerCase(),
             port: parsed ? Number.parseInt(parsed[2], 10) : 0
           });
         }
@@ -13828,7 +13828,7 @@ var require_headers = __commonJS({
       while (j > i && isHTTPWhiteSpaceCharCode(potentialValue.charCodeAt(i))) ++i;
       return i === 0 && j === potentialValue.length ? potentialValue : potentialValue.substring(i, j);
     }
-    function fill(headers, object) {
+    function fill2(headers, object) {
       if (Array.isArray(object)) {
         for (let i = 0; i < object.length; ++i) {
           const header = object[i];
@@ -14053,7 +14053,7 @@ var require_headers = __commonJS({
         this.#guard = "none";
         if (init !== void 0) {
           init = webidl.converters.HeadersInit(init, "Headers contructor", "init");
-          fill(this, init);
+          fill2(this, init);
         }
       }
       // https://fetch.spec.whatwg.org/#dom-headers-append
@@ -14233,7 +14233,7 @@ var require_headers = __commonJS({
       });
     };
     module2.exports = {
-      fill,
+      fill: fill2,
       // for test.
       compareHeaderName,
       Headers: Headers2,
@@ -14251,7 +14251,7 @@ var require_response = __commonJS({
   "node_modules/undici/lib/web/fetch/response.js"(exports2, module2) {
     "use strict";
     init_define_KT_HUB_FILES();
-    var { Headers: Headers2, HeadersList, fill, getHeadersGuard, setHeadersGuard, setHeadersList } = require_headers();
+    var { Headers: Headers2, HeadersList, fill: fill2, getHeadersGuard, setHeadersGuard, setHeadersList } = require_headers();
     var { extractBody, cloneBody, mixinBody, hasFinalizationRegistry, streamRegistry, bodyUnusable } = require_body();
     var util = require_util();
     var nodeUtil = require("node:util");
@@ -14552,7 +14552,7 @@ var require_response = __commonJS({
         response[kState].statusText = init.statusText;
       }
       if ("headers" in init && init.headers != null) {
-        fill(response[kHeaders], init.headers);
+        fill2(response[kHeaders], init.headers);
       }
       if (body) {
         if (nullBodyStatus.includes(response.status)) {
@@ -23900,7 +23900,7 @@ async function completeEmailCodeLogin(d) {
 }
 
 // src/index.ts
-var import_fs5 = require("fs");
+var import_fs7 = require("fs");
 
 // src/owner-only.ts
 init_define_KT_HUB_FILES();
@@ -23921,7 +23921,7 @@ function writeOwnerOnly(path, data) {
 
 // src/index.ts
 var import_os5 = require("os");
-var import_path6 = require("path");
+var import_path7 = require("path");
 var import_readline2 = require("readline");
 var import_net = require("net");
 
@@ -24054,6 +24054,152 @@ function auditResultLabel(raw) {
   return humanizeAction(raw);
 }
 
+// ../packages/shared/src/refresh-refusal-copy.ts
+init_define_KT_HUB_FILES();
+
+// ../packages/shared/src/security-copy.ts
+init_define_KT_HUB_FILES();
+var SECURITY_COPY_EN = {
+  "destinationRefusal.title": "Destination not authorized",
+  "destinationRefusal.title.fault": "This destination could not be checked",
+  "destinationRefusal.title.connection": "This destination cannot be authorized as written",
+  "destinationRefusal.summary.named": 'Kutrion did not connect to {destination} and did not send the credential "{credential}".',
+  "destinationRefusal.summary.namedSource": 'Kutrion did not connect to {destination} as the source of this transfer and did not send the credential "{credential}".',
+  "destinationRefusal.summary.namedDest": 'Kutrion did not connect to {destination} as the destination of this transfer and did not send the credential "{credential}".',
+  "destinationRefusal.summary.unnamed": "Kutrion did not connect to {destination} and did not send this credential.",
+  "destinationRefusal.summary.unnamedSource": "Kutrion did not connect to {destination} as the source of this transfer and did not send this credential.",
+  "destinationRefusal.summary.unnamedDest": "Kutrion did not connect to {destination} as the destination of this transfer and did not send this credential.",
+  "destinationRefusal.allowed.list": "It may be presented to these destinations only:",
+  "destinationRefusal.allowed.listInline": "It may be presented to these destinations only: {destinations}.",
+  "destinationRefusal.allowed.noneFault": "Kutrion could not check where this credential may be presented.",
+  "destinationRefusal.allowed.none": "No authorized destinations are recorded for this credential.",
+  "destinationRefusal.action.allowList": "Where this credential may be presented is set on the credential itself. Changing it needs write access to the vault holding the credential, and the credential's current value.",
+  "destinationRefusal.action.authorizeBelow": "Authorize this destination below.",
+  "destinationRefusal.action.host": "The host recorded on this connection cannot be expressed as an authorized destination, so no entry on the credential can match it. A destination host must be a plain ASCII hostname, an IPv4 address, or an IPv6 address in square brackets, and must not carry a scheme, a port, a user name or a path. Correct the host on the connection, then authorize the corrected destination on the credential.",
+  "destinationRefusal.action.domain": "The Windows domain recorded on this connection cannot be expressed as an authorized destination, so no entry on the credential can match it. A domain must be a plain ASCII name, either a short name such as CORP or a full name such as corp.example.com, entered on its own without a backslash, a user name or an address, or left empty if this host does not use one. Correct the domain on the connection, then authorize the corrected destination on the credential.",
+  "destinationRefusal.action.fault": "This is a fault in Kutrion, not a permission you are missing. No change to the credential or the connection will resolve it. Report it with the time, the connection and the destination shown above.",
+  "destinationRefusal.notARemedy": "Re-entering the credential's value here does not change where it may be presented.",
+  "destinationRefusal.locator.named": "Open Kutrion on the web, go to the vault, open this credential and choose Destinations to allow {destination}. Or run `kt cred dest add`.",
+  "destinationRefusal.locator.unnamed": "Open Kutrion on the web, go to the vault, open this credential and choose Destinations to allow this destination. Or run `kt cred dest add`.",
+  "tlsDowngrade.title": "Transport security cannot be weakened",
+  "tlsDowngrade.summary": "An existing connection's transport security cannot be weakened.",
+  "tlsDowngrade.action": "Keep TLS and certificate checking on, or use a credential that has no stronger connection to this host.",
+  "destinationNeed.notice": "Saved. Kutrion will refuse this connection until this credential is authorized for {target}.",
+  "destinationNeed.who": "An editor, admin or owner of the vault {vault} can authorize it. It is listed as waiting under that credential's Destinations.",
+  "destinationNeed.nonWriterPresave": "Kutrion will refuse this connection until this credential is authorized for this destination. An editor, admin or owner of the vault {vault} can authorize it. It is listed as waiting under that credential's Destinations.",
+  "destinationNeed.badge": "Needs authorization",
+  "destinationNeed.cleartext.ftp": "Plain FTP sends this password unencrypted.",
+  "destinationNeed.cleartext.other": "This connection is not encrypted.",
+  "destinationNeed.cleartext.ftpReaches": "This credential already reaches {host} over {protocols}. Plain FTP sends this password unencrypted.",
+  "destinationNeed.cleartext.otherReaches": "This credential already reaches {host} over {protocols}. This connection is not encrypted.",
+  "destinationNeed.publicLinks": "{count} share link(s) or drop zone(s) on this connection will start working for anyone who holds them.",
+  "destinationNeed.firstClaim": "This is the credential's first destination. After this, Kutrion presents it only to the destinations listed for it.",
+  "authorizeSheet.action": "Authorize this destination",
+  "authorizeSheet.alsoAuthorize": "Also authorize this credential for {target}",
+  "authorizeSheet.typedHint": "Changing where a credential may be sent needs the credential's own value, not just write access to the vault.",
+  "authorizeSheet.secretMismatch": "That is not this credential's current value.",
+  "authorizeSheet.injectOnly": "This credential is injection-only, so it cannot be authorized for a destination here.",
+  "authorizeSheet.unsupported": "This server cannot authorize with the saved value. Enter the value instead.",
+  "authorizeSheet.failed": "This destination could not be authorized.",
+  "waiting.requestedBy": "Requested by {requester} ({role}).",
+  "refreshRefusal.noun.app": "app",
+  "refreshRefusal.noun.browser": "browser",
+  "refreshRefusal.noun.device": "device",
+  "refreshRefusal.signedOut.title": "This session was signed out",
+  "refreshRefusal.refresh_hub_signed_out.why": "You signed out in Kutrion Hub.",
+  "refreshRefusal.refresh_hub_revoked.why": "This {app} was signed out because its Kutrion Hub was removed.",
+  "refreshRefusal.refresh_credentials_changed.title": "Your password changed",
+  "refreshRefusal.refresh_credentials_changed.why": "Your password changed, so Kutrion signed this {app} out.",
+  "refreshRefusal.refresh_credentials_changed.action": "Sign in again with your new password.",
+  "refreshRefusal.device_revoked.title": "This device was signed out",
+  "refreshRefusal.device_revoked.why": "This {app}'s access was withdrawn from your Kutrion account.",
+  "refreshRefusal.device_revoked.action": "Sign in again to re-register it.",
+  "refreshRefusal.account_inactive.title": "This account has ended",
+  "refreshRefusal.account_inactive.why": "Your Kutrion account is no longer active, so this {app} was signed out.",
+  "refreshRefusal.accountEnded.action": "Your administrator can restore it. Signing in again won't work until they do.",
+  "refreshRefusal.account_expired.title": "This account has expired",
+  "refreshRefusal.account_expired.why": "Your Kutrion account has expired, so this {app} was signed out.",
+  "refreshRefusal.org_mismatch.why": "You're no longer a member of the organization this {app} was signed in to.",
+  "refreshRefusal.org_mismatch.action": "Sign in again to continue with your current organization.",
+  "privateTarget.connect.connectorAvailable": "{host} is on a private network, which hosted Kutrion cannot reach directly. Install the Kutrion Connector on that network, or use self-hosted Kutrion.",
+  "privateTarget.connect.connectorPending": "{host} is on a private network, which hosted Kutrion cannot reach directly. Self-hosted Kutrion connects to hosts on private networks by default. The Kutrion Connector is not available yet.",
+  "privateTarget.save.connectorAvailable": "{host} is on a private network, which hosted Kutrion cannot reach directly. Connecting to it will be refused until the Kutrion Connector is installed on that network, or you use self-hosted Kutrion.",
+  "privateTarget.save.connectorPending": "{host} is on a private network, which hosted Kutrion cannot reach directly. Connecting to it will be refused on hosted Kutrion. Self-hosted Kutrion connects to hosts on private networks by default. The Kutrion Connector is not available yet.",
+  "privateTarget.short.connectorAvailable": "{host} is on a private network that hosted Kutrion cannot reach directly. Install the Kutrion Connector there, or use self-hosted Kutrion.",
+  "privateTarget.short.connectorPending": "{host} is on a private network that hosted Kutrion cannot reach directly. Use self-hosted Kutrion; the Kutrion Connector is not available yet.",
+  "privateTarget.orgPolicy": "This organization's policy does not allow connections to {host}. Ask an organization owner or admin."
+};
+var fill = (template, values) => values ? template.replace(/\{(\w+)\}/g, (m, name) => name in values ? String(values[name]) : m) : template;
+var englishT = (key, values) => fill(SECURITY_COPY_EN[key], values);
+function securityCopy(key, t, values) {
+  if (t) {
+    try {
+      const out = t(key, values);
+      if (out && out !== key) return out;
+    } catch {
+    }
+  }
+  return englishT(key, values);
+}
+
+// ../packages/shared/src/refresh-refusal-copy.ts
+var CODES = [
+  "refresh_hub_signed_out",
+  "refresh_hub_revoked",
+  "refresh_credentials_changed",
+  "device_revoked",
+  "account_inactive",
+  "user_inactive",
+  "account_expired",
+  "org_mismatch"
+];
+var en = SECURITY_COPY_EN;
+var KEY_CODE = { user_inactive: "account_inactive" };
+var TITLE_KEY = {
+  refresh_hub_signed_out: "signedOut",
+  refresh_hub_revoked: "signedOut",
+  org_mismatch: "signedOut"
+};
+var ACTION_KEY = { account_inactive: "accountEnded", account_expired: "accountEnded" };
+var keyFor = (code, part) => {
+  const base = KEY_CODE[code] ?? code;
+  const shared = part === "title" ? TITLE_KEY[base] : part === "action" ? ACTION_KEY[base] : void 0;
+  return `refreshRefusal.${shared ?? base}.${part}`;
+};
+var entry = (code) => {
+  const action = en[keyFor(code, "action")];
+  return { title: en[keyFor(code, "title")], why: en[keyFor(code, "why")], ...action ? { action } : {} };
+};
+var REFRESH_REFUSAL_COPY = Object.fromEntries(
+  CODES.map((code) => [code, entry(code)])
+);
+var NOUNS = ["app", "browser", "device"];
+function refreshRefusalCopy(code, noun = "app", t) {
+  if (typeof code !== "string" || !Object.prototype.hasOwnProperty.call(REFRESH_REFUSAL_COPY, code)) return null;
+  const key = (part) => keyFor(code, part);
+  const word = NOUNS.includes(noun) ? securityCopy(`refreshRefusal.noun.${noun}`, t) : noun;
+  const values = { app: word };
+  const hasAction = keyFor(code, "action") in SECURITY_COPY_EN;
+  return {
+    title: securityCopy(key("title"), t),
+    why: securityCopy(key("why"), t, values),
+    ...hasAction ? { action: securityCopy(key("action"), t, values) } : {}
+  };
+}
+
+// ../packages/shared/src/private-target-refusal.ts
+init_define_KT_HUB_FILES();
+var CONNECTOR_AVAILABLE = false;
+var privateTargetReason = (v) => v === "org_policy" ? "org_policy" : "deployment";
+function privateTargetKey(surface, reason, connectorAvailable = CONNECTOR_AVAILABLE) {
+  if (reason === "org_policy") return "privateTarget.orgPolicy";
+  const variant = connectorAvailable ? "connectorAvailable" : "connectorPending";
+  return `privateTarget.${surface}.${variant}`;
+}
+function privateTargetSentence(o, t) {
+  return securityCopy(privateTargetKey(o.surface, privateTargetReason(o.reason), o.connectorAvailable), t, { host: o.host });
+}
+
 // ../packages/shared/src/client.ts
 init_define_KT_HUB_FILES();
 
@@ -27621,6 +27767,9 @@ var ApiError = class extends Error {
     this.headers = headers;
     this.name = "ApiError";
   }
+  // #3445: the `error` code /auth/refresh gave when it ended the session behind this 401, set only by
+  // the SDK's own refresh-then-replay path. `body` and `message` stay the original request's.
+  refreshCode;
   // #2747: the error class slug — the server's `error` code, or the code the SDK minted itself — or
   // null when the reply carried none (the message is then a status phrase, not a code).
   get slug() {
@@ -27803,9 +27952,13 @@ async function withTimeout(inner, ms, input, init) {
 var REFRESH_BODY_MS = 3e3;
 var REFRESH_STORE_ATTEMPTS = 3;
 var REFRESH_STORE_TIMEOUT_MS = 1e4;
+var SIGNATURE_REQUIRED_COOLDOWN_MS = 3e4;
 function isRefreshSignatureRefusal(body) {
   const error = body?.error;
-  return error === "bad_signature" || error === "device_key_required";
+  return error === "bad_signature" || error === "device_key_required" || error === "signature_required";
+}
+function isSignatureRequired(body) {
+  return body?.error === "signature_required";
 }
 async function readBodyWithin(res, ms) {
   let timer;
@@ -27964,6 +28117,8 @@ var KutrionClient = class {
   // `next` is presented in its place: `spent` is already rotated, and presenting it reads as reuse.
   heldRefresh = null;
   refreshing = null;
+  // performance.now() time, so a wall-clock step cannot lengthen or cut the cooldown.
+  signatureRequiredUntil = 0;
   // VT-405 (#153): per-session key for decrypting sealed response payloads. Agreed lazily over ECDH
   // and held in memory only (re-agreed on demand after a reload / worker restart).
   sessionKey = null;
@@ -28043,6 +28198,7 @@ var KutrionClient = class {
   async tryRefresh() {
     const rt = this.presentableRefreshToken();
     if (!rt) return { outcome: "no_token" };
+    if (!this.refreshing && performance.now() < this.signatureRequiredUntil) return { outcome: "indeterminate", status: 401 };
     if (!this.refreshing) {
       this.refreshing = (async () => {
         try {
@@ -28053,15 +28209,23 @@ var KutrionClient = class {
           });
           const { body: signed, signerThrew } = await this.signedRefreshBody(rt);
           let res = await post(signed);
-          if (res.status === 401 && signed.signature && isRefreshSignatureRefusal(await readBodyWithin(res, REFRESH_BODY_MS))) {
-            res = await post(this.refreshBody(rt));
-            if (res.ok) this.refreshSigningRefused = true;
+          let refusalBody;
+          if (res.status === 401 && signed.signature) {
+            refusalBody = await readBodyWithin(res, REFRESH_BODY_MS);
+            if (isRefreshSignatureRefusal(refusalBody)) {
+              res = await post(this.refreshBody(rt));
+              refusalBody = void 0;
+              if (res.ok) this.refreshSigningRefused = true;
+            }
           }
           if (res.status === 401) {
-            if (signerThrew && !signed.signature && isRefreshSignatureRefusal(await readBodyWithin(res, REFRESH_BODY_MS))) {
+            if (refusalBody === void 0) refusalBody = await readBodyWithin(res, REFRESH_BODY_MS);
+            if (signerThrew && !signed.signature && isRefreshSignatureRefusal(refusalBody) || isSignatureRequired(refusalBody)) {
+              if (!signerThrew && isSignatureRequired(refusalBody)) this.signatureRequiredUntil = performance.now() + SIGNATURE_REQUIRED_COOLDOWN_MS;
               return { outcome: "indeterminate", status: 401 };
             }
-            return { outcome: "rejected", status: 401 };
+            const code = refusalBody?.error;
+            return typeof code === "string" && code ? { outcome: "rejected", status: 401, code } : { outcome: "rejected", status: 401 };
           }
           if (!res.ok) {
             const body = res.status === 403 ? await readBodyWithin(res, REFRESH_BODY_MS) : void 0;
@@ -28147,6 +28311,7 @@ var KutrionClient = class {
       data = JSON.parse(await decryptEnvelope(this.sessionKey, data.enc));
     }
     if (!res.ok) {
+      let refreshCode;
       if (res.status === 401 && auth) {
         if (_retry) {
           this.onUnauthorized?.();
@@ -28156,6 +28321,9 @@ var KutrionClient = class {
             case "refreshed":
               return this.req(method, path, body, auth, true);
             case "rejected":
+              refreshCode = r.code;
+              this.onUnauthorized?.(r.code);
+              break;
             case "no_token":
               this.onUnauthorized?.();
               break;
@@ -28170,7 +28338,9 @@ var KutrionClient = class {
           }
         }
       }
-      throw new ApiError(res.status, apiErrorMessage(res.status, data), data, res.headers);
+      const err = new ApiError(res.status, apiErrorMessage(res.status, data), data, res.headers);
+      if (refreshCode) err.refreshCode = refreshCode;
+      throw err;
     }
     return data;
   }
@@ -28420,7 +28590,7 @@ var KutrionClient = class {
   // #2578: clears a factor's pending-approval mark. A step-up-pending session is refused with 403
   // step_up_required; `approved: false` means the factor was already approved.
   approveFactor(kind, id) {
-    return this.req("POST", `/auth/factors/${kind}/${encodeURIComponent(id)}/approve`);
+    return this.req("POST", `/auth/factors/${encodeURIComponent(kind)}/${encodeURIComponent(id)}/approve`);
   }
   mfaGenerateBackupCodes() {
     return this.req("POST", "/auth/mfa/backup-codes/generate");
@@ -28440,14 +28610,17 @@ var KutrionClient = class {
   // losing its keys; the server revokes that row if it is the caller's and ignores it otherwise.
   async registerDevice(input) {
     const reg = await this.req("POST", "/auth/devices/register", input);
-    if (reg.refresh_key_bound) this.refreshSigningRefused = false;
+    if (reg.refresh_key_bound) {
+      this.refreshSigningRefused = false;
+      this.signatureRequiredUntil = 0;
+    }
     return reg;
   }
   // #301: mint a second refresh-token family for an existing device, owned by a companion process
   // (the iOS AutoFill extension) so it rotates independently of the app and never trips the app's
   // reuse-detection. The extension persists its own rotations; the app must not share its token.
   provisionCompanionSession(deviceId) {
-    return this.req("POST", `/auth/devices/${deviceId}/companion`, {});
+    return this.req("POST", `/auth/devices/${encodeURIComponent(deviceId)}/companion`, {});
   }
   // #768: `drain_limits` is what each device's `drain.state` may and may not be said to prove. The
   // server ships the sentence so three clients cannot each invent their own; optional here only
@@ -28456,7 +28629,7 @@ var KutrionClient = class {
     return this.req("GET", "/auth/devices");
   }
   revokeDevice(id) {
-    return this.req("DELETE", `/auth/devices/${id}`, void 0);
+    return this.req("DELETE", `/auth/devices/${encodeURIComponent(id)}`, void 0);
   }
   // Rotate tokens explicitly (req() also does this transparently on 401).
   async refreshTokens(refreshToken) {
@@ -28464,8 +28637,11 @@ var KutrionClient = class {
     try {
       return await this.req("POST", "/auth/refresh", body, false);
     } catch (e) {
-      if (signerThrew && !body.signature && e instanceof ApiError && e.status === 401 && isRefreshSignatureRefusal(e.body)) {
-        throw new ApiError(0, "signer_unavailable");
+      if (e instanceof ApiError && e.status === 401) {
+        if (isSignatureRequired(e.body) && !signerThrew) throw new ApiError(0, "signature_required");
+        if (signerThrew && !body.signature && isRefreshSignatureRefusal(e.body) || isSignatureRequired(e.body)) {
+          throw new ApiError(0, "signer_unavailable");
+        }
       }
       throw e;
     }
@@ -28485,7 +28661,10 @@ var KutrionClient = class {
       refreshKey ? { device_id: deviceId, signature, refresh_key: refreshKey } : { device_id: deviceId, signature },
       false
     );
-    if (tokens.refresh_key_bound) this.refreshSigningRefused = false;
+    if (tokens.refresh_key_bound) {
+      this.refreshSigningRefused = false;
+      this.signatureRequiredUntil = 0;
+    }
     return tokens;
   }
   // --- local vault cache: keys (#709, epic #708) ---
@@ -28493,7 +28672,7 @@ var KutrionClient = class {
   // nowhere else afterwards, so a caller that drops it must either re-issue (same key while it lives)
   // or rotate — and rotating deliberately kills whatever the old key was protecting.
   issueCacheKey(deviceId, opts2) {
-    return this.req("POST", `/auth/devices/${deviceId}/cache-key`, { rotate: opts2?.rotate === true });
+    return this.req("POST", `/auth/devices/${encodeURIComponent(deviceId)}/cache-key`, { rotate: opts2?.rotate === true });
   }
   // #712: drain this device's local reveal journal. The batch is MAC'd under the cache KEK; a broken
   // chain answers 409 with the head the server holds, never a silent success.
@@ -28508,10 +28687,10 @@ var KutrionClient = class {
     return this.req("POST", "/audit/journal-discarded", input);
   }
   cacheKeyStatus(deviceId) {
-    return this.req("GET", `/auth/devices/${deviceId}/cache-key`);
+    return this.req("GET", `/auth/devices/${encodeURIComponent(deviceId)}/cache-key`);
   }
   revokeCacheKey(deviceId) {
-    return this.req("DELETE", `/auth/devices/${deviceId}/cache-key`);
+    return this.req("DELETE", `/auth/devices/${encodeURIComponent(deviceId)}/cache-key`);
   }
   listCacheKeys() {
     return this.req("GET", "/auth/cache-keys");
@@ -28532,21 +28711,24 @@ var KutrionClient = class {
     return this.req("GET", "/auth/webauthn");
   }
   deletePasskey(id) {
-    return this.req("DELETE", `/auth/webauthn/${id}`);
+    return this.req("DELETE", `/auth/webauthn/${encodeURIComponent(id)}`);
+  }
+  renamePasskey(id, label) {
+    return this.req("PATCH", `/auth/webauthn/${encodeURIComponent(id)}`, { label });
   }
   // VT-120: linked sign-in methods (SSO/social identities) + set a first password for social-only accounts.
   listIdentities() {
     return this.req("GET", "/auth/identities");
   }
   unlinkIdentity(id) {
-    return this.req("DELETE", `/auth/identities/${id}`);
+    return this.req("DELETE", `/auth/identities/${encodeURIComponent(id)}`);
   }
   // #2678: begin linking a platform provider. The browser then navigates to `url`; the callback hands
   // back a handle that completeIdentityLink attaches from this same session. #2847: a native app passes
   // its registered client and the challenge for a verifier it keeps, then completes with that verifier.
   startIdentityLink(ref, binding, currentPassword) {
     const how = typeof binding === "string" ? { cb: binding } : { native: true, native_client: binding.nativeClient, native_challenge: binding.challenge };
-    return this.req("POST", `/auth/sso/${ref}/link`, { ...how, ...currentPassword ? { current_password: currentPassword } : {} });
+    return this.req("POST", `/auth/sso/${encodeURIComponent(ref)}/link`, { ...how, ...currentPassword ? { current_password: currentPassword } : {} });
   }
   completeIdentityLink(handle, verifier) {
     return this.req("POST", "/auth/sso/link/complete", { handle, ...verifier ? { verifier } : {} });
@@ -28587,15 +28769,15 @@ var KutrionClient = class {
   // Works for both OIDC and SAML providers — /start dispatches on the provider's protocol. `ref`
   // is the provider id (preferred, unambiguous across orgs) or a platform provider's slug.
   ssoStartUrl(ref) {
-    return `${this.baseUrl}/auth/sso/${ref}/start`;
+    return `${this.baseUrl}/auth/sso/${encodeURIComponent(ref)}/start`;
   }
   // SP metadata URL to hand a SAML IdP (entityID + ACS endpoint). Keyed by provider id.
   samlMetadataUrl(ref) {
-    return `${this.baseUrl}/auth/sso/${ref}/saml/metadata`;
+    return `${this.baseUrl}/auth/sso/${encodeURIComponent(ref)}/saml/metadata`;
   }
   // OIDC redirect URI to register at the IdP, keyed by provider id (per-org safe).
   ssoCallbackUrl(ref) {
-    return `${this.baseUrl}/auth/sso/${ref}/callback`;
+    return `${this.baseUrl}/auth/sso/${encodeURIComponent(ref)}/callback`;
   }
   // --- SSO provider admin (MT-3, org admin/owner only; secrets are write-only) ---
   listSsoProvidersAdmin() {
@@ -28686,10 +28868,10 @@ var KutrionClient = class {
     return this.req("POST", "/workspaces", input);
   }
   updateWorkspace(id, input) {
-    return this.req("PUT", `/workspaces/${id}`, input);
+    return this.req("PUT", `/workspaces/${encodeURIComponent(id)}`, input);
   }
   deleteWorkspace(id) {
-    return this.req("DELETE", `/workspaces/${id}`);
+    return this.req("DELETE", `/workspaces/${encodeURIComponent(id)}`);
   }
   // --- relay (#458 vault-synced API-client documents; #464 team grants) ---
   listRelayDocuments() {
@@ -28705,7 +28887,7 @@ var KutrionClient = class {
     return this.req("POST", `/relay/documents/${encodeURIComponent(clientId)}/grants`, { team_id, role });
   }
   relayUnshare(clientId, teamId) {
-    return this.req("DELETE", `/relay/documents/${encodeURIComponent(clientId)}/grants/${teamId}`);
+    return this.req("DELETE", `/relay/documents/${encodeURIComponent(clientId)}/grants/${encodeURIComponent(teamId)}`);
   }
   // --- vault ---
   listVaults() {
@@ -28715,13 +28897,13 @@ var KutrionClient = class {
     return this.req("POST", "/vault/create", { name, team_id });
   }
   renameVault(vaultId, name) {
-    return this.req("PATCH", `/vault/${vaultId}`, { name });
+    return this.req("PATCH", `/vault/${encodeURIComponent(vaultId)}`, { name });
   }
   deleteVault(vaultId) {
-    return this.req("DELETE", `/vault/${vaultId}`);
+    return this.req("DELETE", `/vault/${encodeURIComponent(vaultId)}`);
   }
   listCredentials(vaultId) {
-    return this.req("GET", `/vault/${vaultId}/credentials`);
+    return this.req("GET", `/vault/${encodeURIComponent(vaultId)}/credentials`);
   }
   // #1122: listVaults + every listCredentials in one round trip, with the same permissions gating.
   // Metadata only — revealing a secret is still the audited per-credential call.
@@ -28747,19 +28929,19 @@ var KutrionClient = class {
     return this.req("GET", `/vault/host-matches?host=${encodeURIComponent(host2)}`);
   }
   getCredential(vaultId, cid) {
-    return this.req("GET", `/vault/${vaultId}/credentials/${cid}`);
+    return this.req("GET", `/vault/${encodeURIComponent(vaultId)}/credentials/${encodeURIComponent(cid)}`);
   }
   // #717: `mutation_id` and `base_updated_at` are what a replayed offline write adds — the first
   // makes a retry a no-op, the second lets the server tell an edit from an overwrite.
   storeCredential(vaultId, input) {
-    return this.req("POST", `/vault/${vaultId}/credentials`, input);
+    return this.req("POST", `/vault/${encodeURIComponent(vaultId)}/credentials`, input);
   }
   updateCredential(vaultId, cid, input) {
-    return this.req("PATCH", `/vault/${vaultId}/credentials/${cid}`, input);
+    return this.req("PATCH", `/vault/${encodeURIComponent(vaultId)}/credentials/${encodeURIComponent(cid)}`, input);
   }
   deleteCredential(vaultId, cid, opts2) {
     const q = opts2?.mutation_id ? `?mutation_id=${encodeURIComponent(opts2.mutation_id)}` : "";
-    return this.req("DELETE", `/vault/${vaultId}/credentials/${cid}${q}`);
+    return this.req("DELETE", `/vault/${encodeURIComponent(vaultId)}/credentials/${encodeURIComponent(cid)}` + q);
   }
   // #2622: snippets. A brokered shell runs one over its socket (snippetFrame); useSnippet is for a
   // terminal the server does not broker, and records the use the same way.
@@ -28787,23 +28969,23 @@ var KutrionClient = class {
     return this.req("GET", `/vault/conflicts${opts2?.open === false ? "?open=false" : ""}`);
   }
   acknowledgeConflict(id) {
-    return this.req("POST", `/vault/conflicts/${id}/ack`);
+    return this.req("POST", `/vault/conflicts/${encodeURIComponent(id)}/ack`);
   }
   conflictPrevious(id) {
-    return this.req("GET", `/vault/conflicts/${id}/previous`);
+    return this.req("GET", `/vault/conflicts/${encodeURIComponent(id)}/previous`);
   }
   // VT-487: group RBAC on a vault (collection) + item folders.
   listVaultGrants(vaultId) {
-    return this.req("GET", `/vault/${vaultId}/grants`);
+    return this.req("GET", `/vault/${encodeURIComponent(vaultId)}/grants`);
   }
   grantVaultToTeam(vaultId, input) {
-    return this.req("POST", `/vault/${vaultId}/grants`, input);
+    return this.req("POST", `/vault/${encodeURIComponent(vaultId)}/grants`, input);
   }
   revokeVaultGrant(vaultId, grantId) {
-    return this.req("DELETE", `/vault/${vaultId}/grants/${grantId}`);
+    return this.req("DELETE", `/vault/${encodeURIComponent(vaultId)}/grants/${encodeURIComponent(grantId)}`);
   }
   listVaultFolders(vaultId) {
-    return this.req("GET", `/vault/${vaultId}/folders`);
+    return this.req("GET", `/vault/${encodeURIComponent(vaultId)}/folders`);
   }
   // #1169: the credential's destination allow-list — where its secret may be presented. The routes
   // live in their own module mounted on /vault (server/src/index.ts:310), so the paths hang off the
@@ -28820,36 +29002,45 @@ var KutrionClient = class {
   // No write response carries the three list-only fields; re-list rather than deriving them.
   // #2634: who revealed or used one credential. Vault owners and admins only; never carries the value.
   credentialProvenance(vaultId, cid) {
-    return this.req("GET", `/vault/${vaultId}/credentials/${cid}/provenance`);
+    return this.req("GET", `/vault/${encodeURIComponent(vaultId)}/credentials/${encodeURIComponent(cid)}/provenance`);
   }
   // #3074: password history. The list carries no values; revealing one is a gated read like getCredential.
   listCredentialHistory(vaultId, cid) {
-    return this.req("GET", `/vault/${vaultId}/credentials/${cid}/history`);
+    return this.req("GET", `/vault/${encodeURIComponent(vaultId)}/credentials/${encodeURIComponent(cid)}/history`);
   }
   revealCredentialHistory(vaultId, cid, hid) {
-    return this.req("GET", `/vault/${vaultId}/credentials/${cid}/history/${hid}`);
+    return this.req("GET", `/vault/${encodeURIComponent(vaultId)}/credentials/${encodeURIComponent(cid)}/history/${encodeURIComponent(hid)}`);
   }
   restoreCredentialHistory(vaultId, cid, hid) {
-    return this.req("POST", `/vault/${vaultId}/credentials/${cid}/history/${hid}/restore`);
+    return this.req("POST", `/vault/${encodeURIComponent(vaultId)}/credentials/${encodeURIComponent(cid)}/history/${encodeURIComponent(hid)}/restore`);
   }
   listCredentialDestinations(vaultId, cid) {
-    return this.req("GET", `/vault/${vaultId}/credentials/${cid}/destinations`);
+    return this.req("GET", `/vault/${encodeURIComponent(vaultId)}/credentials/${encodeURIComponent(cid)}/destinations`);
   }
   // `port` omitted means this protocol's default, resolved and stored server-side — NOT a wildcard, and
   // not something to fill in here: a client-supplied default would come back as a chosen port.
   //
-  // `secret` is the credential's current plaintext and is required by design. Write on the vault gates
-  // who may ask; the secret is what makes a repoint cost as much as knowing the credential, which is
-  // the whole point of the control. Injection-only credentials cannot satisfy it and answer 403
-  // `inject_only`; a wrong secret answers 403 `secret_mismatch` and is rate-limited to 429 after 10.
+  // Write on the vault gates who may ask; the proof gates whether they may move the credential. It is
+  // one of two (#3466):
+  //   - `secret`, the credential's current plaintext. A wrong one answers 403 `secret_mismatch` and is
+  //     rate-limited to 429 after 10.
+  //   - `use_saved_value: true`, for a caller who could reveal the value right now. It answers every
+  //     refusal reveal would, plus 403 `step_up_required` without a fresh step-up on this session. An
+  //     older server answers it 400 `invalid_input` with an issue at path ["secret"].
+  // Injection-only credentials satisfy neither and answer 403 `inject_only`. Either proof may answer
+  // 403 `step_up_required` from the adaptive gate, or 403 `device_posture_required`.
   //
   // #1170: `domain` is RDP-only and omitting it means the credential is presented with NO domain — not
   // "any domain". It is the third member of the RDP destination tuple because it selects which
   // directory authenticates the credential, so a binding that omits it does not authorise one that
   // names it. Sent on any other protocol it answers 400 `domain_not_supported`; unexpressible values
   // answer 400 `invalid_domain`.
+  //
+  // #3466: `use_saved_value` in place of `secret` asks the server to vouch for the stored value itself; a
+  // server without that mode answers 400 `invalid_input` on `secret`. `authorizeDestination` below is the
+  // one caller that should choose between the two.
   addCredentialDestination(vaultId, cid, input) {
-    return this.req("POST", `/vault/${vaultId}/credentials/${cid}/destinations`, input);
+    return this.req("POST", `/vault/${encodeURIComponent(vaultId)}/credentials/${encodeURIComponent(cid)}/destinations`, input);
   }
   // Gated on the secret for the same reason adding is, but NOT because removal widens — #1281 reversed
   // that. Emptying a protocol while rows survive elsewhere leaves the credential claimed, so that
@@ -28861,7 +29052,7 @@ var KutrionClient = class {
   removeCredentialDestination(vaultId, cid, destinationId, secret) {
     return this.req(
       "DELETE",
-      `/vault/${vaultId}/credentials/${cid}/destinations/${destinationId}`,
+      `/vault/${encodeURIComponent(vaultId)}/credentials/${encodeURIComponent(cid)}/destinations/${encodeURIComponent(destinationId)}`,
       { secret }
     );
   }
@@ -28901,20 +29092,20 @@ var KutrionClient = class {
     return this.req("POST", "/vault/breach-alerts/scan");
   }
   updateBreachAlert(id, status) {
-    return this.req("PATCH", `/vault/breach-alerts/${id}`, { status });
+    return this.req("PATCH", `/vault/breach-alerts/${encodeURIComponent(id)}`, { status });
   }
   setBreachMonitor(enabled) {
     return this.req("PUT", "/vault/breach-alerts/settings", { enabled });
   }
   importEnv(vaultId, name, dotenv) {
-    return this.req("POST", `/vault/${vaultId}/env-import`, { name, dotenv });
+    return this.req("POST", `/vault/${encodeURIComponent(vaultId)}/env-import`, { name, dotenv });
   }
   readEnv(vaultId, cid) {
-    return this.req("GET", `/vault/${vaultId}/credentials/${cid}/env`);
+    return this.req("GET", `/vault/${encodeURIComponent(vaultId)}/credentials/${encodeURIComponent(cid)}/env`);
   }
   // #96: live TOTP code for a TOTP credential (secret stays on the broker).
   getTotpCode(vaultId, cid) {
-    return this.req("GET", `/vault/${vaultId}/credentials/${cid}/totp`);
+    return this.req("GET", `/vault/${encodeURIComponent(vaultId)}/credentials/${encodeURIComponent(cid)}/totp`);
   }
   // --- passkey provider (VT-405g): Kutrion as a roaming WebAuthn authenticator for OTHER sites
   // (distinct from listPasskeys/deletePasskey above, which are passkeys for logging into Kutrion). ---
@@ -28935,7 +29126,7 @@ var KutrionClient = class {
     return this.req("POST", "/share", { credential_id: credentialId, ...opts2 });
   }
   redeemShare(token) {
-    return this.req("GET", `/share/${token}`, void 0, false);
+    return this.req("GET", `/share/${encodeURIComponent(token)}`, void 0, false);
   }
   // #869: with a credential id, every link issued for that credential (needs read on it); without
   // one, only the links the caller issued.
@@ -28943,14 +29134,14 @@ var KutrionClient = class {
     return this.req("GET", `/share${credentialId ? `?credential_id=${encodeURIComponent(credentialId)}` : ""}`);
   }
   revokeShare(id) {
-    return this.req("DELETE", `/share/${id}`);
+    return this.req("DELETE", `/share/${encodeURIComponent(id)}`);
   }
   // --- import / export ---
   exportVault(vaultId) {
-    return this.req("GET", `/vault/${vaultId}/export`);
+    return this.req("GET", `/vault/${encodeURIComponent(vaultId)}/export`);
   }
   importVault(vaultId, items) {
-    return this.req("POST", `/vault/${vaultId}/import`, { items });
+    return this.req("POST", `/vault/${encodeURIComponent(vaultId)}/import`, { items });
   }
   importProviders() {
     return this.req("GET", "/vault/import/providers");
@@ -28988,7 +29179,7 @@ var KutrionClient = class {
    *  a move's `enabled:false` after the caller's fields precisely so one request can never both repoint a
    *  partner and turn it back on, and a client that batched them would be asking to be refused. */
   setAs2PartnerEnabled(id, enabled) {
-    return this.req("PATCH", `/as2/partners/${id}`, { enabled });
+    return this.req("PATCH", `/as2/partners/${encodeURIComponent(id)}`, { enabled });
   }
   listAs2Messages() {
     return this.req("GET", "/as2/messages");
@@ -29001,33 +29192,33 @@ var KutrionClient = class {
     return this.req("POST", "/teams", { name });
   }
   listMembers(teamId) {
-    return this.req("GET", `/teams/${teamId}/members`);
+    return this.req("GET", `/teams/${encodeURIComponent(teamId)}/members`);
   }
   addMember(teamId, email, role) {
-    return this.req("POST", `/teams/${teamId}/members`, { email, role });
+    return this.req("POST", `/teams/${encodeURIComponent(teamId)}/members`, { email, role });
   }
   removeMember(teamId, userId) {
-    return this.req("DELETE", `/teams/${teamId}/members/${userId}`);
+    return this.req("DELETE", `/teams/${encodeURIComponent(teamId)}/members/${encodeURIComponent(userId)}`);
   }
   // #2775: org owner or admin only. 409 team_has_vaults or scim_managed.
   deleteTeam(teamId) {
-    return this.req("DELETE", `/teams/${teamId}`);
+    return this.req("DELETE", `/teams/${encodeURIComponent(teamId)}`);
   }
   // --- team invitations (VT-102) ---
   inviteMember(teamId, email, role) {
-    return this.req("POST", `/teams/${teamId}/invitations`, { email, role });
+    return this.req("POST", `/teams/${encodeURIComponent(teamId)}/invitations`, { email, role });
   }
   listInvitations(teamId) {
-    return this.req("GET", `/teams/${teamId}/invitations`);
+    return this.req("GET", `/teams/${encodeURIComponent(teamId)}/invitations`);
   }
   revokeInvitation(teamId, invId) {
-    return this.req("DELETE", `/teams/${teamId}/invitations/${invId}`);
+    return this.req("DELETE", `/teams/${encodeURIComponent(teamId)}/invitations/${encodeURIComponent(invId)}`);
   }
   invitePreview(token) {
-    return this.req("GET", `/teams/invitations/${token}`, void 0, false);
+    return this.req("GET", `/teams/invitations/${encodeURIComponent(token)}`, void 0, false);
   }
   acceptInvitation(token) {
-    return this.req("POST", `/teams/invitations/${token}/accept`);
+    return this.req("POST", `/teams/invitations/${encodeURIComponent(token)}/accept`);
   }
   // --- org onboarding (MT-4 #115): admin/owner-gated unless noted ---
   getOrg() {
@@ -29088,10 +29279,10 @@ var KutrionClient = class {
     return this.req("POST", "/emergency/contacts", input);
   }
   removeEmergencyContact(id) {
-    return this.req("DELETE", `/emergency/contacts/${id}`);
+    return this.req("DELETE", `/emergency/contacts/${encodeURIComponent(id)}`);
   }
   denyEmergencyRequest(id) {
-    return this.req("POST", `/emergency/requests/${id}/deny`);
+    return this.req("POST", `/emergency/requests/${encodeURIComponent(id)}/deny`);
   }
   listEmergencyGrants() {
     return this.req("GET", "/emergency/grants");
@@ -29100,10 +29291,10 @@ var KutrionClient = class {
     return this.req("POST", "/emergency/grants/accept", { token });
   }
   requestEmergencyAccess(grantId) {
-    return this.req("POST", `/emergency/grants/${grantId}/request`);
+    return this.req("POST", `/emergency/grants/${encodeURIComponent(grantId)}/request`);
   }
   completeEmergencyAccess(requestId) {
-    return this.req("POST", `/emergency/requests/${requestId}/complete`);
+    return this.req("POST", `/emergency/requests/${encodeURIComponent(requestId)}/complete`);
   }
   // VT-443: the user-facing announcement feed (filtered server-side by the org's tier/status).
   listAnnouncements() {
@@ -29193,7 +29384,7 @@ var KutrionClient = class {
   // #1959: org-admin surface grants for one member of the caller's own org. Distinct from
   // selfGrantSurface, which only ever acts on the caller.
   listUserSurfaceGrants(userId) {
-    return this.req("GET", `/surfaces/users/${userId}`);
+    return this.req("GET", `/surfaces/users/${encodeURIComponent(userId)}`);
   }
   grantUserSurface(userId, surface, opts2) {
     return this.req("POST", "/surfaces/grants", {
@@ -29294,15 +29485,15 @@ var KutrionClient = class {
     return this.req("GET", "/org/members");
   }
   setOrgMemberRole(id, org_role) {
-    return this.req("PATCH", `/org/members/${id}`, { org_role });
+    return this.req("PATCH", `/org/members/${encodeURIComponent(id)}`, { org_role });
   }
   removeOrgMember(id) {
-    return this.req("DELETE", `/org/members/${id}`);
+    return this.req("DELETE", `/org/members/${encodeURIComponent(id)}`);
   }
   // VT-483: admin-mediated recovery — email a locked-out member a password-reset link/code. The admin
   // never sets or learns the new password.
   resetOrgMemberPassword(id) {
-    return this.req("POST", `/org/members/${id}/password-reset`);
+    return this.req("POST", `/org/members/${encodeURIComponent(id)}/password-reset`);
   }
   // #1433: admin-mediated ACCOUNT RECOVERY, for a member who cannot sign in AT ALL. Distinct from the
   // password reset above, which refuses exactly the accounts that most need it: an SSO- or
@@ -29314,7 +29505,7 @@ var KutrionClient = class {
   // step_up_required), refuses a suspended member (409 member_inactive), and refuses a non-owner admin
   // who targets an owner (403 owner_recovery_requires_owner).
   recoverOrgMember(id) {
-    return this.req("POST", `/org/members/${id}/recover`);
+    return this.req("POST", `/org/members/${encodeURIComponent(id)}/recover`);
   }
   inviteToOrg(email, org_role) {
     return this.req("POST", "/org/invitations", { email, org_role });
@@ -29323,13 +29514,13 @@ var KutrionClient = class {
     return this.req("GET", "/org/invitations");
   }
   revokeOrgInvitation(id) {
-    return this.req("DELETE", `/org/invitations/${id}`);
+    return this.req("DELETE", `/org/invitations/${encodeURIComponent(id)}`);
   }
   orgInvitePreview(token) {
-    return this.req("GET", `/org/invitations/${token}`, void 0, false);
+    return this.req("GET", `/org/invitations/${encodeURIComponent(token)}`, void 0, false);
   }
   async acceptOrgInvitation(token) {
-    const r = await this.req("POST", `/org/invitations/${token}/accept`);
+    const r = await this.req("POST", `/org/invitations/${encodeURIComponent(token)}/accept`);
     this.onToken?.(r.token);
     return r;
   }
@@ -29342,18 +29533,18 @@ var KutrionClient = class {
     return this.req("POST", "/msp/clients", { client_email, role, ...expires_days ? { expires_days } : {} });
   }
   revokeMspClient(id) {
-    return this.req("POST", `/msp/clients/${id}/revoke`);
+    return this.req("POST", `/msp/clients/${encodeURIComponent(id)}/revoke`);
   }
   // Mint a read-only "view as client" scoped session (#415c). The token is used as the active bearer;
   // the existing impersonation guard makes it read-only. Revoking the relationship kills it instantly.
   viewAsMspClient(id) {
-    return this.req("POST", `/msp/clients/${id}/view-as`);
+    return this.req("POST", `/msp/clients/${encodeURIComponent(id)}/view-as`);
   }
   // #432: enter a WRITE-capable "act as client" session at the clamped effective role. Requires a fresh
   // step-up; writes are bounded by the deny-by-default server allowlist. Returns 403 step_up_required if
   // the operator has not recently verified a passkey/MFA, 409 read_only_relationship for a VIEWER ceiling.
   actAsMspClient(id, role = "EDITOR") {
-    return this.req("POST", `/msp/clients/${id}/act-as`, { role });
+    return this.req("POST", `/msp/clients/${encodeURIComponent(id)}/act-as`, { role });
   }
   // #415d: the MSP's own access ledger across managed clients (sessions opened, last access).
   mspClientsActivity() {
@@ -29377,13 +29568,13 @@ var KutrionClient = class {
     return this.req("GET", "/msp/providers");
   }
   acceptMspProvider(id) {
-    return this.req("POST", `/msp/providers/${id}/accept`);
+    return this.req("POST", `/msp/providers/${encodeURIComponent(id)}/accept`);
   }
   declineMspProvider(id) {
-    return this.req("POST", `/msp/providers/${id}/decline`);
+    return this.req("POST", `/msp/providers/${encodeURIComponent(id)}/decline`);
   }
   revokeMspProvider(id) {
-    return this.req("POST", `/msp/providers/${id}/revoke`);
+    return this.req("POST", `/msp/providers/${encodeURIComponent(id)}/revoke`);
   }
   // #434: what my providers did in my org (read-only-session opens etc.), for client-side transparency.
   mspProviderActivity() {
@@ -29417,13 +29608,13 @@ var KutrionClient = class {
   setMemberActive(memberId, active, reason) {
     return this.req(
       "PATCH",
-      `/org/members/${memberId}/active`,
+      `/org/members/${encodeURIComponent(memberId)}/active`,
       { active, ...reason ? { reason } : {} }
     );
   }
   // Offboarding: kill every offline copy a member holds, from the admin side.
   revokeMemberCacheKeys(memberId) {
-    return this.req("DELETE", `/org/members/${memberId}/cache-keys`);
+    return this.req("DELETE", `/org/members/${encodeURIComponent(memberId)}/cache-keys`);
   }
   // #815: the other half of that revoke — which devices came back and were told to wipe, and which
   // have not been seen since. Org-admin only.
@@ -29439,7 +29630,7 @@ var KutrionClient = class {
     return this.req("POST", "/org/equivalent-domains", { domains, note: note ?? null });
   }
   removeEquivalentDomains(id) {
-    return this.req("DELETE", `/org/equivalent-domains/${id}`);
+    return this.req("DELETE", `/org/equivalent-domains/${encodeURIComponent(id)}`);
   }
   // #904: the caller's OWN remembered host bindings. Per user and per (credential, host) — never per
   // org, which would make phishing one member a lateral-movement primitive. Creation is screened
@@ -29449,10 +29640,10 @@ var KutrionClient = class {
     return this.req("GET", "/vault/site-bindings");
   }
   createSiteBinding(vaultId, cid, targetUrl, sourceUrl) {
-    return this.req("POST", `/vault/${vaultId}/credentials/${cid}/site-bindings`, { target_url: targetUrl, source_url: sourceUrl });
+    return this.req("POST", `/vault/${encodeURIComponent(vaultId)}/credentials/${encodeURIComponent(cid)}/site-bindings`, { target_url: targetUrl, source_url: sourceUrl });
   }
   revokeSiteBinding(id) {
-    return this.req("DELETE", `/vault/site-bindings/${id}`);
+    return this.req("DELETE", `/vault/site-bindings/${encodeURIComponent(id)}`);
   }
   listOrgDomains() {
     return this.req("GET", "/org/domains");
@@ -29461,10 +29652,10 @@ var KutrionClient = class {
     return this.req("POST", "/org/domains", { domain });
   }
   verifyOrgDomain(id) {
-    return this.req("POST", `/org/domains/${id}/verify`);
+    return this.req("POST", `/org/domains/${encodeURIComponent(id)}/verify`);
   }
   removeOrgDomain(id) {
-    return this.req("DELETE", `/org/domains/${id}`);
+    return this.req("DELETE", `/org/domains/${encodeURIComponent(id)}`);
   }
   // VT-485/486: enterprise API tokens for SCIM provisioning and SIEM event export. The secret is
   // returned only on create; thereafter only the prefix is shown.
@@ -29475,7 +29666,7 @@ var KutrionClient = class {
     return this.req("POST", "/api-tokens", input);
   }
   revokeApiToken(id) {
-    return this.req("DELETE", `/api-tokens/${id}`);
+    return this.req("DELETE", `/api-tokens/${encodeURIComponent(id)}`);
   }
   // #662 agent access plane: non-human identities (#664), their activity (#665) and the kill
   // switch (#675). The credential is returned only on create; thereafter only the prefix is shown.
@@ -29490,23 +29681,29 @@ var KutrionClient = class {
     return this.req("POST", "/agents", input);
   }
   renewAgent(id, ttl_minutes) {
-    return this.req("POST", `/agents/${id}/renew`, { ttl_minutes });
+    return this.req("POST", `/agents/${encodeURIComponent(id)}/renew`, { ttl_minutes });
   }
   revokeAgent(id) {
-    return this.req("DELETE", `/agents/${id}`);
+    return this.req("DELETE", `/agents/${encodeURIComponent(id)}`);
   }
   // #2700: PUT replaces the whole resource scope; an omitted or empty list means unrestricted.
   agentScopeOptions() {
     return this.req("GET", "/agents/scope-options");
   }
   setAgentResourceScope(id, scope) {
-    return this.req("PUT", `/agents/${id}/resource-scope`, scope);
+    return this.req("PUT", `/agents/${encodeURIComponent(id)}/resource-scope`, scope);
   }
   listAgentOidcTrusts() {
     return this.req("GET", "/agents/oidc/trusts");
   }
+  createAgentOidcTrust(input) {
+    return this.req("POST", "/agents/oidc/trusts", input);
+  }
+  deleteAgentOidcTrust(id) {
+    return this.req("DELETE", `/agents/oidc/trusts/${encodeURIComponent(id)}`);
+  }
   setAgentOidcTrustResourceScope(id, scope, opts2 = {}) {
-    return this.req("PUT", `/agents/oidc/trusts/${id}/resource-scope`, { ...scope, ...opts2 });
+    return this.req("PUT", `/agents/oidc/trusts/${encodeURIComponent(id)}/resource-scope`, { ...scope, ...opts2 });
   }
   revokeAgents(input) {
     return this.req(
@@ -29523,7 +29720,7 @@ var KutrionClient = class {
     return this.req("GET", qs ? `/agents/sessions?${qs}` : "/agents/sessions");
   }
   getAgentSession(id) {
-    return this.req("GET", `/agents/sessions/${id}`);
+    return this.req("GET", `/agents/sessions/${encodeURIComponent(id)}`);
   }
   listAgentActivity(opts2 = {}) {
     const q = new URLSearchParams();
@@ -29533,7 +29730,7 @@ var KutrionClient = class {
   }
   /** Relative path for the auditor export; the caller downloads it with its own auth. */
   agentSessionExportPath(id) {
-    return `/agents/sessions/${id}/export`;
+    return `/agents/sessions/${encodeURIComponent(id)}/export`;
   }
   // #669: the human half of just-in-time agent approval. These routes are deliberately unreachable
   // from an MCP client — the agent opens a request and settles nothing, a person in an authenticated
@@ -29544,13 +29741,13 @@ var KutrionClient = class {
     return this.req("GET", "/agent-approvals");
   }
   getAgentApproval(id) {
-    return this.req("GET", `/agent-approvals/${id}`);
+    return this.req("GET", `/agent-approvals/${encodeURIComponent(id)}`);
   }
   approveAgentApproval(id, note) {
-    return this.req("POST", `/agent-approvals/${id}/approve`, note ? { note } : {});
+    return this.req("POST", `/agent-approvals/${encodeURIComponent(id)}/approve`, note ? { note } : {});
   }
   denyAgentApproval(id, note) {
-    return this.req("POST", `/agent-approvals/${id}/deny`, note ? { note } : {});
+    return this.req("POST", `/agent-approvals/${encodeURIComponent(id)}/deny`, note ? { note } : {});
   }
   // #670 (epic #662): the outbound MCP gateway's control plane. Curation is ORG ADMIN; only the
   // report-what-I-run call is open to any member, and that asymmetry is deliberate — the machines
@@ -29573,14 +29770,14 @@ var KutrionClient = class {
   /** Aim a credential at an approved entry. Authorised by WRITE on the credential's own vault, not by
    *  org admin — binding is an act of delegation, so 403 here is about the vault and not the console. */
   bindMcpCredential(entryId, credential_id) {
-    return this.req("POST", `/mcp/gateway/servers/${entryId}/credential`, { credential_id });
+    return this.req("POST", `/mcp/gateway/servers/${encodeURIComponent(entryId)}/credential`, { credential_id });
   }
   unbindMcpCredential(entryId) {
-    return this.req("DELETE", `/mcp/gateway/servers/${entryId}/credential`);
+    return this.req("DELETE", `/mcp/gateway/servers/${encodeURIComponent(entryId)}/credential`);
   }
   /** Stops traffic on the next call, with nothing cached in between. */
   revokeMcpServer(entryId) {
-    return this.req("DELETE", `/mcp/gateway/servers/${entryId}`);
+    return this.req("DELETE", `/mcp/gateway/servers/${encodeURIComponent(entryId)}`);
   }
   listMcpObserved() {
     return this.req("GET", "/mcp/gateway/observed");
@@ -29613,10 +29810,10 @@ var KutrionClient = class {
   // which leaves it as it is — a connection could otherwise never be made direct again.
   // #2621: `vault_id` shares a personal host into that vault, one way; its credential must live there.
   updateConnection(connId, input) {
-    return this.req("PATCH", `/ssh/connections/${connId}`, input);
+    return this.req("PATCH", `/ssh/connections/${encodeURIComponent(connId)}`, input);
   }
   deleteConnection(connId) {
-    return this.req("DELETE", `/ssh/connections/${connId}`);
+    return this.req("DELETE", `/ssh/connections/${encodeURIComponent(connId)}`);
   }
   // #414: self-serve secure-session demo. status drives the empty-state affordance; provision is
   // idempotent (reattaches to an existing demo connection); reset removes the demo artifacts.
@@ -29631,8 +29828,9 @@ var KutrionClient = class {
   }
   // Pre-flight risk guardrail (#141): a high-risk command 403s with { error: "step_up_required" }
   // until the session completes WebAuthn step-up; retry after stepping up.
-  exec(connId, command) {
-    return this.req("POST", `/ssh/connections/${connId}/exec`, { command });
+  // #3515: `stdinB64` is streamed to the command and then closed; the server acknowledges it with `stdin`.
+  exec(connId, command, stdinB64) {
+    return this.req("POST", `/ssh/connections/${encodeURIComponent(connId)}/exec`, stdinB64 === void 0 ? { command } : { command, stdin_b64: stdinB64 });
   }
   validateCommand(command) {
     return this.req("POST", "/ssh/validate", { command });
@@ -29649,7 +29847,7 @@ var KutrionClient = class {
    *
    * `rdp.tunnel` is deliberately not mintable here — the RDP broker returns its own on the
    * session-open response (`tunnel.ws_ticket`), and this route refuses the scope so a caller without
-   * the `rdp_broker` entitlement cannot mint against that socket (server/src/modules/ssh.ts:660).
+   * the `rdp_broker` entitlement cannot mint against that socket (server/src/modules/ssh.ts:665).
    */
   mintWsTicket(scope, resourceId) {
     return this.req(
@@ -29715,7 +29913,7 @@ var KutrionClient = class {
   }
   /** 403 step_up_required until the session has a fresh passkey/MFA check; retry after stepping up. */
   clearSshHostKey(id) {
-    return this.req("DELETE", `/ssh/host-keys/${id}`);
+    return this.req("DELETE", `/ssh/host-keys/${encodeURIComponent(id)}`);
   }
   /**
    * #2743: pins the key a host_key_unconfirmed refusal showed this caller. For a first-use refusal the server accepts only the
@@ -29733,7 +29931,7 @@ var KutrionClient = class {
   }
   /** 404 when the session already ended, or is not in the caller's org. */
   endLiveSession(kind, id) {
-    return this.req("DELETE", `/org/live-sessions/${kind}/${encodeURIComponent(id)}`);
+    return this.req("DELETE", `/org/live-sessions/${encodeURIComponent(kind)}/${encodeURIComponent(id)}`);
   }
   // --- SSH certificate authority (VT-484): mint short-lived user certs from a per-org internal CA ---
   getSshCa() {
@@ -29828,29 +30026,29 @@ var KutrionClient = class {
   // It does NOT mean "the whole directory": the routes default to limit=1000 and report `hasMore`.
   // --- SFTP file transfer (VT-112) ---
   sftpList(connId, path = ".", page) {
-    return this.req("GET", `/ssh/connections/${connId}/sftp/list?path=${encodeURIComponent(path)}${listPageQuery(page)}`);
+    return this.req("GET", `/ssh/connections/${encodeURIComponent(connId)}/sftp/list?path=${encodeURIComponent(path)}${listPageQuery(page)}`);
   }
   sftpMkdir(connId, path) {
-    return this.req("POST", `/ssh/connections/${connId}/sftp/mkdir`, { path });
+    return this.req("POST", `/ssh/connections/${encodeURIComponent(connId)}/sftp/mkdir`, { path });
   }
   sftpRename(connId, from, to) {
-    return this.req("POST", `/ssh/connections/${connId}/sftp/rename`, { from, to });
+    return this.req("POST", `/ssh/connections/${encodeURIComponent(connId)}/sftp/rename`, { from, to });
   }
   sftpDelete(connId, path, isDir) {
-    return this.req("POST", `/ssh/connections/${connId}/sftp/delete`, { path, is_dir: isDir });
+    return this.req("POST", `/ssh/connections/${encodeURIComponent(connId)}/sftp/delete`, { path, is_dir: isDir });
   }
   // #587: SFTP checksums + duplicate detection (mirror the file-connection routes).
   sftpChecksum(connId, path, algos = ["sha256"]) {
-    return this.req("GET", `/ssh/connections/${connId}/sftp/checksum?path=${encodeURIComponent(path)}&algos=${algos.join(",")}`);
+    return this.req("GET", `/ssh/connections/${encodeURIComponent(connId)}/sftp/checksum?path=${encodeURIComponent(path)}&algos=${algos.join(",")}`);
   }
   sftpDuplicates(connId, path = ".", opts2) {
-    return this.req("POST", `/ssh/connections/${connId}/sftp/duplicates`, { path, maxFiles: opts2?.maxFiles, maxBytesPerFile: opts2?.maxBytesPerFile });
+    return this.req("POST", `/ssh/connections/${encodeURIComponent(connId)}/sftp/duplicates`, { path, maxFiles: opts2?.maxFiles, maxBytesPerFile: opts2?.maxBytesPerFile });
   }
   // Download a remote file as a Blob (carries the auth token). With { redact: true } the server
   // routes the bytes through the #142 redaction gate (text only; binary → 415) before sending (#320c).
   async sftpDownload(connId, path, opts2) {
     const tok = this.getToken();
-    const res = await this.f(`${this.baseUrl}/ssh/connections/${connId}/sftp/download?path=${encodeURIComponent(path)}${opts2?.redact ? "&redact=1" : ""}`, {
+    const res = await this.f(`${this.baseUrl}/ssh/connections/${encodeURIComponent(connId)}/sftp/download?path=${encodeURIComponent(path)}${opts2?.redact ? "&redact=1" : ""}`, {
       headers: this.rawHeaders(tok)
     });
     if (!res.ok) {
@@ -29906,12 +30104,12 @@ var KutrionClient = class {
   // Stream a remote file's bytes instead of buffering them into a Blob. `opts.start` resumes from an
   // offset via Range (#555); read `resumedAt` off the result rather than assuming the server obeyed.
   sftpDownloadStream(connId, path, opts2) {
-    return this.downloadStream(`${this.baseUrl}/ssh/connections/${connId}/sftp/download?path=${encodeURIComponent(path)}${opts2?.redact ? "&redact=1" : ""}`, opts2);
+    return this.downloadStream(`${this.baseUrl}/ssh/connections/${encodeURIComponent(connId)}/sftp/download?path=${encodeURIComponent(path)}${opts2?.redact ? "&redact=1" : ""}`, opts2);
   }
   // Upload from a byte source without materialising it. `streamed` on the result reports whether this
   // runtime actually streamed the request body or had to collect it first.
   sftpUploadStream(connId, path, body, opts2) {
-    return this.uploadStream(`${this.baseUrl}/ssh/connections/${connId}/sftp/upload?path=${encodeURIComponent(path)}`, body, opts2);
+    return this.uploadStream(`${this.baseUrl}/ssh/connections/${encodeURIComponent(connId)}/sftp/upload?path=${encodeURIComponent(path)}`, body, opts2);
   }
   // #2556: throws UploadTooLargeToInspectError when this org inspects uploads and `size` is over what the
   // inspection can hold, so the file is refused before any of it is sent. A policy that cannot be read
@@ -29926,7 +30124,7 @@ var KutrionClient = class {
     throw new UploadTooLargeToInspectError(size, insp.max_bytes, insp.enabled ? "too_large_for_scan" : "too_large_for_policy");
   }
   sftpUploadResumable(connId, path, source, opts2) {
-    return this.uploadResumable(`/ssh/connections/${connId}/sftp/upload`, path, source, opts2);
+    return this.uploadResumable(`/ssh/connections/${encodeURIComponent(connId)}/sftp/upload`, path, source, opts2);
   }
   // #2556: one request per UPLOAD_CHUNK_BYTES over the #1566 resume protocol, so a file of any size
   // crosses an edge that caps a request body, and a dropped chunk is re-sent from the offset the
@@ -30051,30 +30249,41 @@ var KutrionClient = class {
   listFileConnections() {
     return this.req("GET", "/files/connections");
   }
+  // #3466: what a create with these fields would report as `destination_need`, before creating it.
+  // `connection_id` counts the public links on that connection, and only when it is the caller's own.
+  // `secure` is optional and defaults as create does: true only when protocol is WEBDAV.
+  fileConnectionDestinationNeed(q) {
+    const qs = new URLSearchParams({ credential_id: q.credential_id, protocol: q.protocol, port: String(q.port) });
+    if (q.host !== void 0) qs.set("host", q.host);
+    if (q.secure !== void 0) qs.set("secure", String(q.secure));
+    if (q.connection_id !== void 0) qs.set("connection_id", q.connection_id);
+    return this.req("GET", `/files/connections/destination-need?${qs}`);
+  }
   createFileConnection(input) {
     return this.req("POST", "/files/connections", input);
   }
+  // #3456: `username: null` switches the connection to inherit the credential's username.
   updateFileConnection(id, input) {
-    return this.req("PATCH", `/files/connections/${id}`, input);
+    return this.req("PATCH", `/files/connections/${encodeURIComponent(id)}`, input);
   }
   deleteFileConnection(id) {
-    return this.req("DELETE", `/files/connections/${id}`);
+    return this.req("DELETE", `/files/connections/${encodeURIComponent(id)}`);
   }
   fileList(connId, path = "/", page) {
-    return this.req("GET", `/files/connections/${connId}/list?path=${encodeURIComponent(path)}${listPageQuery(page)}`);
+    return this.req("GET", `/files/connections/${encodeURIComponent(connId)}/list?path=${encodeURIComponent(path)}${listPageQuery(page)}`);
   }
   // #587: checksums + duplicate detection.
   fileChecksum(connId, path, algos = ["sha256"]) {
-    return this.req("GET", `/files/connections/${connId}/checksum?path=${encodeURIComponent(path)}&algos=${algos.join(",")}`);
+    return this.req("GET", `/files/connections/${encodeURIComponent(connId)}/checksum?path=${encodeURIComponent(path)}&algos=${algos.join(",")}`);
   }
   fileDuplicates(connId, path = "/", opts2) {
-    return this.req("POST", `/files/connections/${connId}/duplicates`, { path, maxFiles: opts2?.maxFiles, maxBytesPerFile: opts2?.maxBytesPerFile });
+    return this.req("POST", `/files/connections/${encodeURIComponent(connId)}/duplicates`, { path, maxFiles: opts2?.maxFiles, maxBytesPerFile: opts2?.maxBytesPerFile });
   }
   // #586: recursive CONTENT search under `path`. Bytes are read on the server and only path/line/
   // snippet come back. `glob` filters which files are opened by name; it does not match names into
   // the result. Check `truncated` before presenting the matches as the whole answer.
   fileSearch(connId, path, query, opts2) {
-    return this.req("POST", `/files/connections/${connId}/search`, {
+    return this.req("POST", `/files/connections/${encodeURIComponent(connId)}/search`, {
       path,
       query,
       glob: opts2?.glob,
@@ -30084,39 +30293,39 @@ var KutrionClient = class {
   }
   // #588: time-limited presigned direct-download URL (S3 only).
   filePresign(connId, path, expiresSec = 3600) {
-    return this.req("GET", `/files/connections/${connId}/presign?path=${encodeURIComponent(path)}&expires=${expiresSec}`);
+    return this.req("GET", `/files/connections/${encodeURIComponent(connId)}/presign?path=${encodeURIComponent(path)}&expires=${expiresSec}`);
   }
   // #574: OAuth cloud connectors (Dropbox/Drive/OneDrive/Box). Tokens stay server-side.
   cloudProviders() {
     return this.req("GET", "/cloud/providers");
   }
   cloudAuthorize(provider, name) {
-    return this.req("POST", `/cloud/${provider}/authorize`, { name });
+    return this.req("POST", `/cloud/${encodeURIComponent(provider)}/authorize`, { name });
   }
   listCloudConnections() {
     return this.req("GET", "/cloud/connections");
   }
   deleteCloudConnection(id) {
-    return this.req("DELETE", `/cloud/connections/${id}`);
+    return this.req("DELETE", `/cloud/connections/${encodeURIComponent(id)}`);
   }
   cloudList(connId, path = "/", page) {
-    return this.req("GET", `/cloud/connections/${connId}/list?path=${encodeURIComponent(path)}${listPageQuery(page)}`);
+    return this.req("GET", `/cloud/connections/${encodeURIComponent(connId)}/list?path=${encodeURIComponent(path)}${listPageQuery(page)}`);
   }
   // #608: list + pin the connection's browse root (Shared Drive / SharePoint site / Box folder).
   cloudRoots(connId) {
-    return this.req("GET", `/cloud/connections/${connId}/roots`);
+    return this.req("GET", `/cloud/connections/${encodeURIComponent(connId)}/roots`);
   }
   setCloudRoot(connId, root) {
-    return this.req("PUT", `/cloud/connections/${connId}/root`, { root });
+    return this.req("PUT", `/cloud/connections/${encodeURIComponent(connId)}/root`, { root });
   }
   cloudMkdir(connId, path) {
-    return this.req("POST", `/cloud/connections/${connId}/mkdir`, { path });
+    return this.req("POST", `/cloud/connections/${encodeURIComponent(connId)}/mkdir`, { path });
   }
   cloudRename(connId, from, to) {
-    return this.req("POST", `/cloud/connections/${connId}/rename`, { from, to });
+    return this.req("POST", `/cloud/connections/${encodeURIComponent(connId)}/rename`, { from, to });
   }
   cloudDelete(connId, path, isDir) {
-    return this.req("POST", `/cloud/connections/${connId}/delete`, { path, is_dir: isDir });
+    return this.req("POST", `/cloud/connections/${encodeURIComponent(connId)}/delete`, { path, is_dir: isDir });
   }
   // #1627: `redact` is the same opt-in the /files and /ssh download helpers take, and the cloud route
   // has honoured it since #1562 (server/src/modules/cloud.ts:461). It only ever ADDS masking — the
@@ -30124,7 +30333,7 @@ var KutrionClient = class {
   // a client whose users cannot ask for less, not one that is safer.
   async cloudDownload(connId, path, opts2) {
     const tok = this.getToken();
-    const res = await this.f(`${this.baseUrl}/cloud/connections/${connId}/download?path=${encodeURIComponent(path)}${opts2?.redact ? "&redact=1" : ""}`, { headers: this.rawHeaders(tok) });
+    const res = await this.f(`${this.baseUrl}/cloud/connections/${encodeURIComponent(connId)}/download?path=${encodeURIComponent(path)}${opts2?.redact ? "&redact=1" : ""}`, { headers: this.rawHeaders(tok) });
     if (!res.ok) {
       const errBody = await res.json().catch(() => void 0);
       throw new ApiError(res.status, apiErrorMessage(res.status, errBody), errBody);
@@ -30134,7 +30343,7 @@ var KutrionClient = class {
   // #2768: one request, so `signal` cancels it but there is no per-piece progress to report.
   async cloudUpload(connId, path, data, opts2) {
     const tok = this.getToken();
-    const res = await this.fUpload(`${this.baseUrl}/cloud/connections/${connId}/upload?path=${encodeURIComponent(path)}${opts2?.ifAbsent ? "&if_absent=1" : ""}`, {
+    const res = await this.fUpload(`${this.baseUrl}/cloud/connections/${encodeURIComponent(connId)}/upload?path=${encodeURIComponent(path)}${opts2?.ifAbsent ? "&if_absent=1" : ""}`, {
       method: "POST",
       headers: this.rawHeaders(tok, { "Content-Type": "application/octet-stream" }),
       body: data,
@@ -30155,27 +30364,27 @@ var KutrionClient = class {
   // (cloud.ts:453) — downloadStream only ever sends the open-ended form, so that refusal is
   // unreachable from here.
   cloudDownloadStream(connId, path, opts2) {
-    return this.downloadStream(`${this.baseUrl}/cloud/connections/${connId}/download?path=${encodeURIComponent(path)}${opts2?.redact ? "&redact=1" : ""}`, opts2);
+    return this.downloadStream(`${this.baseUrl}/cloud/connections/${encodeURIComponent(connId)}/download?path=${encodeURIComponent(path)}${opts2?.redact ? "&redact=1" : ""}`, opts2);
   }
   // POST /cloud/connections/:id/upload (cloud.ts:537) answers `{ ok }` plus the staging keys and NOT
   // `size` — it returns `uploadProgress()` alone, where the file and sftp routes add `path`/`size`
   // (files.ts:1428, ssh.ts:1070). Typed to what this route actually sends: claiming `size: number`
   // here would hand every caller a number that is undefined at runtime.
   cloudUploadStream(connId, path, body, opts2) {
-    return this.uploadStream(`${this.baseUrl}/cloud/connections/${connId}/upload?path=${encodeURIComponent(path)}`, body, opts2);
+    return this.uploadStream(`${this.baseUrl}/cloud/connections/${encodeURIComponent(connId)}/upload?path=${encodeURIComponent(path)}`, body, opts2);
   }
   fileMkdir(connId, path) {
-    return this.req("POST", `/files/connections/${connId}/mkdir`, { path });
+    return this.req("POST", `/files/connections/${encodeURIComponent(connId)}/mkdir`, { path });
   }
   fileRename(connId, from, to) {
-    return this.req("POST", `/files/connections/${connId}/rename`, { from, to });
+    return this.req("POST", `/files/connections/${encodeURIComponent(connId)}/rename`, { from, to });
   }
   fileDelete(connId, path, isDir) {
-    return this.req("POST", `/files/connections/${connId}/delete`, { path, is_dir: isDir });
+    return this.req("POST", `/files/connections/${encodeURIComponent(connId)}/delete`, { path, is_dir: isDir });
   }
   async fileDownload(connId, path, opts2) {
     const tok = this.getToken();
-    const res = await this.f(`${this.baseUrl}/files/connections/${connId}/download?path=${encodeURIComponent(path)}${opts2?.redact ? "&redact=1" : ""}`, {
+    const res = await this.f(`${this.baseUrl}/files/connections/${encodeURIComponent(connId)}/download?path=${encodeURIComponent(path)}${opts2?.redact ? "&redact=1" : ""}`, {
       headers: this.rawHeaders(tok)
     });
     if (!res.ok) {
@@ -30186,13 +30395,13 @@ var KutrionClient = class {
   }
   // #1542: streaming + resumable counterparts of fileDownload/fileUpload. See downloadStream above.
   fileDownloadStream(connId, path, opts2) {
-    return this.downloadStream(`${this.baseUrl}/files/connections/${connId}/download?path=${encodeURIComponent(path)}${opts2?.redact ? "&redact=1" : ""}`, opts2);
+    return this.downloadStream(`${this.baseUrl}/files/connections/${encodeURIComponent(connId)}/download?path=${encodeURIComponent(path)}${opts2?.redact ? "&redact=1" : ""}`, opts2);
   }
   fileUploadStream(connId, path, body, opts2) {
-    return this.uploadStream(`${this.baseUrl}/files/connections/${connId}/upload?path=${encodeURIComponent(path)}`, body, opts2);
+    return this.uploadStream(`${this.baseUrl}/files/connections/${encodeURIComponent(connId)}/upload?path=${encodeURIComponent(path)}`, body, opts2);
   }
   fileUploadResumable(connId, path, source, opts2) {
-    return this.uploadResumable(`/files/connections/${connId}/upload`, path, source, opts2);
+    return this.uploadResumable(`/files/connections/${encodeURIComponent(connId)}/upload`, path, source, opts2);
   }
   // #325: download a selection of files/folders as one zip, built server-side (works for every protocol).
   async fileArchive(input) {
@@ -30221,7 +30430,7 @@ var KutrionClient = class {
     return this.req("GET", "/files/shares");
   }
   revokeFileShare(id) {
-    return this.req("DELETE", `/files/shares/${id}`);
+    return this.req("DELETE", `/files/shares/${encodeURIComponent(id)}`);
   }
   // #1636: the anonymous side of a Vault Drop — the recipient is outside the org and has no account.
   //
@@ -30263,12 +30472,16 @@ var KutrionClient = class {
     return this.req("GET", "/files/jobs");
   }
   getTransferJob(id) {
-    return this.req("GET", `/files/jobs/${id}`);
+    return this.req("GET", `/files/jobs/${encodeURIComponent(id)}`);
   }
   // #583: reprioritise or cancel a job that is still QUEUED. A running or finished job answers 409
   // not_queued — the runner has already leased it and there is nothing left to reorder.
   patchTransferJob(id, input) {
-    return this.req("PATCH", `/files/jobs/${id}`, input);
+    return this.req("PATCH", `/files/jobs/${encodeURIComponent(id)}`, input);
+  }
+  // #3549: cancel a queued or running job. A finished one answers 409 not_active.
+  cancelTransferJob(id) {
+    return this.req("POST", `/files/jobs/${encodeURIComponent(id)}/cancel`, {});
   }
   // #563: recurring transfer schedules (interval or daily UTC time).
   createSchedule(input) {
@@ -30278,10 +30491,10 @@ var KutrionClient = class {
     return this.req("GET", "/files/schedules");
   }
   setScheduleEnabled(id, enabled) {
-    return this.req("PATCH", `/files/schedules/${id}`, { enabled });
+    return this.req("PATCH", `/files/schedules/${encodeURIComponent(id)}`, { enabled });
   }
   deleteSchedule(id) {
-    return this.req("DELETE", `/files/schedules/${id}`);
+    return this.req("DELETE", `/files/schedules/${encodeURIComponent(id)}`);
   }
   // #614: folder watchers — poll a source directory and fire a transfer job on new/changed, size-stable
   // files matching the filters. The transfer runs as a durable job.
@@ -30292,10 +30505,10 @@ var KutrionClient = class {
     return this.req("GET", "/files/folder-watchers");
   }
   setFolderWatcherEnabled(id, enabled) {
-    return this.req("PATCH", `/files/folder-watchers/${id}`, { enabled });
+    return this.req("PATCH", `/files/folder-watchers/${encodeURIComponent(id)}`, { enabled });
   }
   deleteFolderWatcher(id) {
-    return this.req("DELETE", `/files/folder-watchers/${id}`);
+    return this.req("DELETE", `/files/folder-watchers/${encodeURIComponent(id)}`);
   }
   // #627: workflow templates. A saved edit is a NEW VERSION, not a PATCH — 0150's trigger refuses an
   // UPDATE, because a run names the version it used and reproducibility depends on a stored revision
@@ -30304,19 +30517,19 @@ var KutrionClient = class {
     return this.req("GET", "/files/workflow-templates");
   }
   getWorkflowTemplate(id) {
-    return this.req("GET", `/files/workflow-templates/${id}`);
+    return this.req("GET", `/files/workflow-templates/${encodeURIComponent(id)}`);
   }
   createWorkflowTemplate(input) {
     return this.req("POST", "/files/workflow-templates", input);
   }
   addWorkflowTemplateVersion(id, input) {
-    return this.req("POST", `/files/workflow-templates/${id}/versions`, input);
+    return this.req("POST", `/files/workflow-templates/${encodeURIComponent(id)}/versions`, input);
   }
   deleteWorkflowTemplate(id) {
-    return this.req("DELETE", `/files/workflow-templates/${id}`);
+    return this.req("DELETE", `/files/workflow-templates/${encodeURIComponent(id)}`);
   }
   instantiateWorkflowTemplate(id, input) {
-    return this.req("POST", `/files/workflow-templates/${id}/instantiate`, input);
+    return this.req("POST", `/files/workflow-templates/${encodeURIComponent(id)}/instantiate`, input);
   }
   // #559: directory sync / mirror. dry_run returns the plan without writing; omit it to apply.
   // #585: `two_way` and `mirror` are mutually exclusive and the server refuses the pair outright
@@ -30366,13 +30579,13 @@ var KutrionClient = class {
   }
   // #557: SFTP POSIX metadata (chmod / set mtime / create symlink).
   sftpChmod(connId, path, mode) {
-    return this.req("POST", `/ssh/connections/${connId}/sftp/chmod`, { path, mode });
+    return this.req("POST", `/ssh/connections/${encodeURIComponent(connId)}/sftp/chmod`, { path, mode });
   }
   sftpChtime(connId, path, mtime) {
-    return this.req("POST", `/ssh/connections/${connId}/sftp/chtime`, { path, mtime });
+    return this.req("POST", `/ssh/connections/${encodeURIComponent(connId)}/sftp/chtime`, { path, mtime });
   }
   sftpSymlink(connId, target, link) {
-    return this.req("POST", `/ssh/connections/${connId}/sftp/symlink`, { target, link });
+    return this.req("POST", `/ssh/connections/${encodeURIComponent(connId)}/sftp/symlink`, { target, link });
   }
   // #2556: resumable, as sftpUpload.
   async fileUpload(connId, path, data, opts2) {
@@ -30391,7 +30604,7 @@ var KutrionClient = class {
     return this.req("GET", "/ssh/recordings");
   }
   getRecording(id) {
-    return this.req("GET", `/ssh/recordings/${id}`);
+    return this.req("GET", `/ssh/recordings/${encodeURIComponent(id)}`);
   }
   /** #2631: what was stored for one of the caller's recorded shell sessions, once it has ended. */
   shellSessionReceipt(sessionId) {
@@ -30406,11 +30619,11 @@ var KutrionClient = class {
     return this.req("DELETE", `/ssh/shell-sessions/${encodeURIComponent(sessionId)}`);
   }
   deleteRecording(id) {
-    return this.req("DELETE", `/ssh/recordings/${id}`);
+    return this.req("DELETE", `/ssh/recordings/${encodeURIComponent(id)}`);
   }
   // VT-143: generate (or fetch cached) an AI session summary for a recording. regenerate forces recompute.
   summarizeRecording(id, regenerate = false) {
-    return this.req("POST", `/ssh/recordings/${id}/summary${regenerate ? "?regenerate=1" : ""}`);
+    return this.req("POST", `/ssh/recordings/${encodeURIComponent(id)}/summary${regenerate ? "?regenerate=1" : ""}`);
   }
   // --- #2628: org recording review and retention, org owners and admins only ---
   getRecordingPolicy() {
@@ -30477,10 +30690,10 @@ var KutrionClient = class {
     return this.req("GET", `/exposure${s ? `?${s}` : ""}`);
   }
   resolveExposure(id, resolution) {
-    return this.req("POST", `/exposure/${id}/resolve`, { resolution });
+    return this.req("POST", `/exposure/${encodeURIComponent(id)}/resolve`, { resolution });
   }
   suppressExposure(id, patterns = []) {
-    return this.req("POST", `/exposure/${id}/suppress`, { patterns });
+    return this.req("POST", `/exposure/${encodeURIComponent(id)}/suppress`, { patterns });
   }
   // --- integrations hub: outbound alert + SIEM connectors (VT-310 / VT-485) ---
   integrationCatalog() {
@@ -30493,16 +30706,16 @@ var KutrionClient = class {
     return this.req("POST", "/integrations", input);
   }
   updateIntegration(id, input) {
-    return this.req("PATCH", `/integrations/${id}`, input);
+    return this.req("PATCH", `/integrations/${encodeURIComponent(id)}`, input);
   }
   deleteIntegration(id) {
-    return this.req("DELETE", `/integrations/${id}`);
+    return this.req("DELETE", `/integrations/${encodeURIComponent(id)}`);
   }
   testIntegration(id) {
-    return this.req("POST", `/integrations/${id}/test`);
+    return this.req("POST", `/integrations/${encodeURIComponent(id)}/test`);
   }
   listIntegrationDeliveries(id, limit = 50) {
-    return this.req("GET", `/integrations/${id}/deliveries?limit=${limit}`);
+    return this.req("GET", `/integrations/${encodeURIComponent(id)}/deliveries?limit=${limit}`);
   }
   // --- HashiCorp Vault secret sync (VT-306): ENTERPRISE-gated (secret_sync). Auth secret is write-only. ---
   listHcvConnections() {
@@ -30512,28 +30725,28 @@ var KutrionClient = class {
     return this.req("POST", "/hashicorp/connections", input);
   }
   updateHcvConnection(id, input) {
-    return this.req("PATCH", `/hashicorp/connections/${id}`, input);
+    return this.req("PATCH", `/hashicorp/connections/${encodeURIComponent(id)}`, input);
   }
   deleteHcvConnection(id) {
-    return this.req("DELETE", `/hashicorp/connections/${id}`);
+    return this.req("DELETE", `/hashicorp/connections/${encodeURIComponent(id)}`);
   }
   testHcvConnection(id) {
-    return this.req("POST", `/hashicorp/connections/${id}/test`);
+    return this.req("POST", `/hashicorp/connections/${encodeURIComponent(id)}/test`);
   }
   listHcvMappings(connId) {
-    return this.req("GET", `/hashicorp/connections/${connId}/mappings`);
+    return this.req("GET", `/hashicorp/connections/${encodeURIComponent(connId)}/mappings`);
   }
   createHcvMapping(connId, input) {
-    return this.req("POST", `/hashicorp/connections/${connId}/mappings`, input);
+    return this.req("POST", `/hashicorp/connections/${encodeURIComponent(connId)}/mappings`, input);
   }
   deleteHcvMapping(mappingId) {
-    return this.req("DELETE", `/hashicorp/mappings/${mappingId}`);
+    return this.req("DELETE", `/hashicorp/mappings/${encodeURIComponent(mappingId)}`);
   }
   syncHcvMapping(mappingId, resolve2) {
-    return this.req("POST", `/hashicorp/mappings/${mappingId}/sync${resolve2 ? `?resolve=${resolve2}` : ""}`);
+    return this.req("POST", `/hashicorp/mappings/${encodeURIComponent(mappingId)}/sync${resolve2 ? `?resolve=${resolve2}` : ""}`);
   }
   syncHcvConnection(connId, resolve2) {
-    return this.req("POST", `/hashicorp/connections/${connId}/sync${resolve2 ? `?resolve=${resolve2}` : ""}`);
+    return this.req("POST", `/hashicorp/connections/${encodeURIComponent(connId)}/sync${resolve2 ? `?resolve=${resolve2}` : ""}`);
   }
   // --- rdp broker (VT-490) ---
   listRdpConnections() {
@@ -30543,28 +30756,28 @@ var KutrionClient = class {
     return this.req("POST", "/rdp/connections", input);
   }
   updateRdpConnection(id, input) {
-    return this.req("PATCH", `/rdp/connections/${id}`, input);
+    return this.req("PATCH", `/rdp/connections/${encodeURIComponent(id)}`, input);
   }
   deleteRdpConnection(id) {
-    return this.req("DELETE", `/rdp/connections/${id}`);
+    return this.req("DELETE", `/rdp/connections/${encodeURIComponent(id)}`);
   }
   testRdpConnection(id) {
-    return this.req("POST", `/rdp/connections/${id}/test`);
+    return this.req("POST", `/rdp/connections/${encodeURIComponent(id)}/test`);
   }
   startRdpSession(id) {
-    return this.req("POST", `/rdp/connections/${id}/session`);
+    return this.req("POST", `/rdp/connections/${encodeURIComponent(id)}/session`);
   }
   listRdpSessions() {
     return this.req("GET", "/rdp/sessions");
   }
   endRdpSession(sessionId) {
-    return this.req("DELETE", `/rdp/sessions/${sessionId}`);
+    return this.req("DELETE", `/rdp/sessions/${encodeURIComponent(sessionId)}`);
   }
   // Stream a brokered session's recording (broker proxies it from the gateway). Binary, so it bypasses
   // the JSON req() helper — same shape as sftpDownload/fileDownload.
   async getRdpRecording(sessionId) {
     const tok = this.getToken();
-    const res = await this.f(`${this.baseUrl}/rdp/sessions/${sessionId}/recording`, {
+    const res = await this.f(`${this.baseUrl}/rdp/sessions/${encodeURIComponent(sessionId)}/recording`, {
       headers: this.rawHeaders(tok)
     });
     if (!res.ok) throw new ApiError(res.status, apiErrorMessage(res.status));
@@ -30607,7 +30820,7 @@ var KutrionClient = class {
   }
   // Files AI (#325): build a filename regex from natural language, summarize a listing, or propose a
   // rename plan. All run LAN-first; only file NAMES/metadata are sent (never file content), through the
-  // redaction gate. The returned regex is server-validated to compile and be free of ReDoS shapes.
+  // redaction gate. The returned regex is server-validated to compile and to lack the most obvious ReDoS shapes only (isSafeRegex is a heuristic: (a|a)+ passes); clients must run it under a time budget.
   aiFilePattern(input) {
     return this.req("POST", "/ai/files/pattern", input);
   }
@@ -30639,16 +30852,16 @@ var KutrionClient = class {
     return this.req("GET", "/jit/requests");
   }
   getJitRequest(id) {
-    return this.req("GET", `/jit/requests/${id}`);
+    return this.req("GET", `/jit/requests/${encodeURIComponent(id)}`);
   }
   approveJitRequest(id, note) {
-    return this.req("POST", `/jit/requests/${id}/approve`, { note });
+    return this.req("POST", `/jit/requests/${encodeURIComponent(id)}/approve`, { note });
   }
   denyJitRequest(id, note) {
-    return this.req("POST", `/jit/requests/${id}/deny`, { note });
+    return this.req("POST", `/jit/requests/${encodeURIComponent(id)}/deny`, { note });
   }
   revokeJitRequest(id) {
-    return this.req("POST", `/jit/requests/${id}/revoke`);
+    return this.req("POST", `/jit/requests/${encodeURIComponent(id)}/revoke`);
   }
   // --- rotation copilot (VT-145) ---
   rotationServices() {
@@ -30672,13 +30885,13 @@ var KutrionClient = class {
     return this.req("POST", "/fleet/plan", input);
   }
   executeFleetRun(id) {
-    return this.req("POST", `/fleet/runs/${id}/execute`, { confirm: true });
+    return this.req("POST", `/fleet/runs/${encodeURIComponent(id)}/execute`, { confirm: true });
   }
   fleetRuns() {
     return this.req("GET", "/fleet/runs");
   }
   fleetRun(id) {
-    return this.req("GET", `/fleet/runs/${id}`);
+    return this.req("GET", `/fleet/runs/${encodeURIComponent(id)}`);
   }
   // --- anomaly baseline (VT-204) ---
   refreshBaseline() {
@@ -30896,50 +31109,65 @@ function parseDestinationRefusal(body) {
     reason: DESTINATION_REFUSAL_REASONS.includes(b.reason) ? b.reason : null
   };
 }
-var DESTINATION_REFUSAL_TITLE = "Destination not authorized";
-var subject = (r) => r.credential ? `the credential "${r.credential}"` : "this credential";
-function destinationRefusalSummary(r) {
-  const where = r.side === "source" ? " as the source of this transfer" : r.side === "dest" ? " as the destination of this transfer" : "";
-  return `Kutrion did not connect to ${r.destination}${where} and did not send ${subject(r)}.`;
-}
-function destinationRefusalAllowedLabel(r) {
-  if (r.allowedDestinations.length) return "It may be presented to these destinations only:";
-  if (r.detail) return r.detail;
-  return destinationRefusalFault(r) === "kutrion" ? "Kutrion could not check where this credential may be presented." : "No authorized destinations are recorded for this credential.";
-}
-var DESTINATION_REFUSAL_ACTION = "Where this credential may be presented is set on the credential itself. Changing it needs write access to the vault holding the credential, and the credential's current value.";
-var DESTINATION_REFUSAL_NOT_A_REMEDY = "Re-entering the credential's value here does not change where it may be presented.";
-var DESTINATION_REFUSAL_FAULT_TITLE = "This destination could not be checked";
-var DESTINATION_REFUSAL_FAULT_ACTION = "This is a fault in Kutrion, not a permission you are missing. No change to the credential or the connection will resolve it. Report it with the time, the connection and the destination shown above.";
-var DESTINATION_REFUSAL_CONNECTION_TITLE = "This destination cannot be authorized as written";
-var DESTINATION_REFUSAL_HOST_ACTION = "The host recorded on this connection cannot be expressed as an authorized destination, so no entry on the credential can match it. A destination host must be a plain ASCII hostname, an IPv4 address, or an IPv6 address in square brackets, and must not carry a scheme, a port, a user name or a path. Correct the host on the connection, then authorize the corrected destination on the credential.";
-var DESTINATION_REFUSAL_DOMAIN_ACTION = "The Windows domain recorded on this connection cannot be expressed as an authorized destination, so no entry on the credential can match it. A domain must be a plain ASCII name, either a short name such as CORP or a full name such as corp.example.com, entered on its own without a backslash, a user name or an address, or left empty if this host does not use one. Correct the domain on the connection, then authorize the corrected destination on the credential.";
-function destinationRefusalTitle(r) {
+var DESTINATION_REFUSAL_TITLE = SECURITY_COPY_EN["destinationRefusal.title"];
+var usSpelling = (s) => s.replace(/\b(A|a)uthoris/g, "$1uthoriz");
+function destinationRefusalSummary(r, t) {
+  const side = r.side === "source" ? "Source" : r.side === "dest" ? "Dest" : "";
+  const key = `destinationRefusal.summary.${r.credential ? "named" : "unnamed"}${side}`;
+  return securityCopy(key, t, { destination: r.destination, credential: r.credential ?? "" });
+}
+function destinationRefusalAllowedLabel(r, t) {
+  if (r.allowedDestinations.length) return securityCopy("destinationRefusal.allowed.list", t);
+  if (r.detail) return usSpelling(r.detail);
+  return securityCopy(destinationRefusalFault(r) === "kutrion" ? "destinationRefusal.allowed.noneFault" : "destinationRefusal.allowed.none", t);
+}
+var DESTINATION_REFUSAL_ACTION = SECURITY_COPY_EN["destinationRefusal.action.allowList"];
+var isAllowListRemedy = (r) => r.reason !== "host_not_normalizable" && r.reason !== "domain_not_normalizable" && destinationRefusalFault(r) !== "kutrion";
+var DESTINATION_REFUSAL_NOT_A_REMEDY = SECURITY_COPY_EN["destinationRefusal.notARemedy"];
+var DESTINATION_REFUSAL_FAULT_TITLE = SECURITY_COPY_EN["destinationRefusal.title.fault"];
+var DESTINATION_REFUSAL_FAULT_ACTION = SECURITY_COPY_EN["destinationRefusal.action.fault"];
+var DESTINATION_REFUSAL_CONNECTION_TITLE = SECURITY_COPY_EN["destinationRefusal.title.connection"];
+var DESTINATION_REFUSAL_HOST_ACTION = SECURITY_COPY_EN["destinationRefusal.action.host"];
+var DESTINATION_REFUSAL_DOMAIN_ACTION = SECURITY_COPY_EN["destinationRefusal.action.domain"];
+function destinationRefusalTitle(r, t) {
   if (r.reason === "host_not_normalizable" || r.reason === "domain_not_normalizable") {
-    return DESTINATION_REFUSAL_CONNECTION_TITLE;
+    return securityCopy("destinationRefusal.title.connection", t);
   }
-  return destinationRefusalFault(r) === "kutrion" ? DESTINATION_REFUSAL_FAULT_TITLE : DESTINATION_REFUSAL_TITLE;
+  return securityCopy(destinationRefusalFault(r) === "kutrion" ? "destinationRefusal.title.fault" : "destinationRefusal.title", t);
 }
-function destinationRefusalAction(r) {
-  if (r.reason === "host_not_normalizable") return DESTINATION_REFUSAL_HOST_ACTION;
-  if (r.reason === "domain_not_normalizable") return DESTINATION_REFUSAL_DOMAIN_ACTION;
-  return destinationRefusalFault(r) === "kutrion" ? DESTINATION_REFUSAL_FAULT_ACTION : DESTINATION_REFUSAL_ACTION;
+function destinationRefusalAction(r, o, t) {
+  if (o?.inlineAction && isAllowListRemedy(r)) return securityCopy("destinationRefusal.action.authorizeBelow", t);
+  if (r.reason === "host_not_normalizable") return securityCopy("destinationRefusal.action.host", t);
+  if (r.reason === "domain_not_normalizable") return securityCopy("destinationRefusal.action.domain", t);
+  return securityCopy(destinationRefusalFault(r) === "kutrion" ? "destinationRefusal.action.fault" : "destinationRefusal.action.allowList", t);
 }
-function destinationRefusalLines(r, indent = "  ") {
+function destinationRefusalLines(r, indent = "  ", t) {
   return [
-    destinationRefusalTitle(r),
+    destinationRefusalTitle(r, t),
     "",
-    destinationRefusalSummary(r),
+    destinationRefusalSummary(r, t),
     "",
-    destinationRefusalAllowedLabel(r),
+    destinationRefusalAllowedLabel(r, t),
     ...r.allowedDestinations.map((d) => `${indent}${d}`),
     "",
-    destinationRefusalAction(r),
+    destinationRefusalAction(r, void 0, t),
     // Only true of a refusal that turned on where the credential may go. On a fault of ours the secret
     // was never the subject, and the line reads as one more thing the user got wrong.
-    ...destinationRefusalFault(r) === "kutrion" ? [] : [DESTINATION_REFUSAL_NOT_A_REMEDY]
+    ...destinationRefusalFault(r) === "kutrion" ? [] : [securityCopy("destinationRefusal.notARemedy", t)]
   ];
 }
+var TLS_DOWNGRADE_REFUSAL_TITLE = SECURITY_COPY_EN["tlsDowngrade.title"];
+var TLS_DOWNGRADE_REFUSAL_SUMMARY = SECURITY_COPY_EN["tlsDowngrade.summary"];
+var TLS_DOWNGRADE_REFUSAL_ACTION = SECURITY_COPY_EN["tlsDowngrade.action"];
+var DESTINATION_NEED_BADGE = SECURITY_COPY_EN["destinationNeed.badge"];
+var DESTINATION_REFUSAL_AUTHORIZE_BELOW = SECURITY_COPY_EN["destinationRefusal.action.authorizeBelow"];
+var DESTINATION_AUTHORIZE_ACTION = SECURITY_COPY_EN["authorizeSheet.action"];
+var DESTINATION_TYPED_HINT = SECURITY_COPY_EN["authorizeSheet.typedHint"];
+var DESTINATION_SECRET_MISMATCH = SECURITY_COPY_EN["authorizeSheet.secretMismatch"];
+var DESTINATION_INJECT_ONLY = SECURITY_COPY_EN["authorizeSheet.injectOnly"];
+var DESTINATION_UNSUPPORTED = SECURITY_COPY_EN["authorizeSheet.unsupported"];
+var DESTINATION_FAILED = SECURITY_COPY_EN["authorizeSheet.failed"];
+var DESTINATION_FIRST_CLAIM_WARNING = SECURITY_COPY_EN["destinationNeed.firstClaim"];
 
 // ../packages/shared/src/credential-size-refusal.ts
 init_define_KT_HUB_FILES();
@@ -31101,6 +31329,16 @@ function platformFlagRefusalText(code) {
   return code && Object.prototype.hasOwnProperty.call(PLATFORM_FLAG_REFUSAL_COPY, code) ? PLATFORM_FLAG_REFUSAL_COPY[code] : null;
 }
 
+// ../packages/shared/src/remote-auth-refusal.ts
+init_define_KT_HUB_FILES();
+var REMOTE_AUTH_FAILED_TEXT = "The server rejected the sign-in. Check the username and password or access key saved for this connection.";
+var BASIC_OVER_HTTP_REFUSED_TEXT = "Kutrion did not send the password. The server did not offer a protected sign-in over this unencrypted connection, so the password would have been readable to anyone on the network path.";
+var BASIC_AFTER_DIGEST_REFUSED_TEXT = "Kutrion did not send the password. This server asked for Digest sign-in earlier and now asks for Basic, which would expose the password.";
+var PLAIN_HTTP_OPT_IN_LABEL = "Allow sign-in over plain HTTP";
+var BASIC_OVER_HTTP_REFUSED_NEXT = `Switch this connection to HTTPS, or tick "${PLAIN_HTTP_OPT_IN_LABEL}" on it.`;
+var CREDENTIAL_CONTROL_CHARS_TEXT = "Kutrion did not send the sign-in. The username or password saved for this connection contains a line break or NUL character, which this protocol cannot carry.";
+var CREDENTIAL_CONTROL_CHARS_NEXT = "Edit the credential in the vault so it has no line break, then open the connection again.";
+
 // ../packages/shared/src/ssh-refusal.ts
 init_define_KT_HUB_FILES();
 var SSH_REFUSAL_CLASSIFICATION = {
@@ -31222,6 +31460,9 @@ var SSH_REFUSAL_CLASSIFICATION = {
   // Something answered on that port and it was not an SSH server; what is listening has to change
   // first, even though the user is who can change it.
   protocol_error: { family: "failed", retry: "pointless" },
+  // #3419: the login was accepted and the host refused a PTY or a shell. The account is set up that
+  // way on the host, so every attempt earns the same answer.
+  shell_refused: { family: "failed", retry: "pointless" },
   // The rest are genuine retry candidates: a transport fact can be different a second later.
   connection_refused: { family: "failed", retry: "possible" },
   host_not_found: { family: "failed", retry: "possible" },
@@ -31343,12 +31584,12 @@ function parseJumpRefusal(body) {
   const code = str4(b.code) ?? str4(b.error);
   if (!isJumpRefusalCode(code)) return null;
   const nested = b.detail && typeof b.detail === "object" ? b.detail : {};
-  const pick2 = (k) => b[k] !== void 0 ? b[k] : nested[k];
-  const idx = pick2("hop_index");
-  const allowed = pick2("allowed_destinations");
+  const pick3 = (k) => b[k] !== void 0 ? b[k] : nested[k];
+  const idx = pick3("hop_index");
+  const allowed = pick3("allowed_destinations");
   return {
     code,
-    hopConnectionId: str4(pick2("hop_connection_id")),
+    hopConnectionId: str4(pick3("hop_connection_id")),
     hopIndex: typeof idx === "number" && Number.isFinite(idx) ? idx : null,
     detail: typeof b.detail === "string" ? str4(b.detail) : str4(nested.detail) ?? str4(b.error_description),
     allowedDestinations: Array.isArray(allowed) ? allowed.filter((x) => typeof x === "string" && x.trim() !== "") : null
@@ -31407,12 +31648,12 @@ function parseJumpHostInUse(body) {
 var JUMP_HOST_IN_USE_TITLE = "Other connections are reached through this one";
 function jumpHostInUseSummary(r, deletingName) {
   const name = str4(deletingName);
-  const subject2 = name ? `\u201C${name}\u201D` : "this connection";
+  const subject = name ? `\u201C${name}\u201D` : "this connection";
   const n = r.usedBy.length;
   if (!n) {
-    return `${subject2} is used as a jump host by other connections, so deleting it would leave them with no route.`;
+    return `${subject} is used as a jump host by other connections, so deleting it would leave them with no route.`;
   }
-  return `${subject2} is the jump host for ${n === 1 ? "another connection" : `${n} other connections`}. Deleting it would leave ` + (n === 1 ? "it" : "them") + " with no route to the target, so it was not deleted.";
+  return `${subject} is the jump host for ${n === 1 ? "another connection" : `${n} other connections`}. Deleting it would leave ` + (n === 1 ? "it" : "them") + " with no route to the target, so it was not deleted.";
 }
 var JUMP_HOST_IN_USE_ACTION = "Point each of these at a different jump host, or clear the jump host to reach it directly, and then delete this connection.";
 
@@ -32502,6 +32743,12 @@ function subtle() {
   if (!s || typeof globalThis.crypto.getRandomValues !== "function") throw new VaultKeyError("crypto_unavailable");
   return s;
 }
+var random = (n) => globalThis.crypto.getRandomValues(new Uint8Array(n));
+function toB64(bytes) {
+  let s = "";
+  for (const b of bytes) s += String.fromCharCode(b);
+  return btoa(s);
+}
 function fromB64(b64) {
   const s = atob(b64);
   const out = new Uint8Array(s.length);
@@ -32547,6 +32794,10 @@ async function derivePassphraseKek(passphrase, kdf, onProgress) {
     out.fill(0);
   }
 }
+function generateVaultKey() {
+  subtle();
+  return random(VAULT_KEY_BYTES);
+}
 async function unwrapVaultKey(wrap, kek, purpose) {
   let bytes;
   try {
@@ -32582,6 +32833,15 @@ async function unlockVaultKey(record, passphrase, onProgress) {
 }
 var dataKeyAad = (vaultId) => enc.encode(`kutrion-vault-key-v1:data-key:${vaultId.toLowerCase()}`);
 var TAG_BYTES = TAG_BITS / 8;
+async function wrapVaultDataKey(dataKey, vaultKey, vaultId) {
+  if (dataKey.length !== VAULT_KEY_BYTES) throw new VaultKeyError("malformed_wrap", "A vault data key is 32 bytes.");
+  const iv = random(IV_BYTES);
+  const ct = new Uint8Array(await subtle().encrypt({ name: "AES-GCM", iv: bs2(iv), additionalData: bs2(dataKeyAad(vaultId)), tagLength: TAG_BITS }, vaultKey, bs2(dataKey)));
+  const out = new Uint8Array(IV_BYTES + ct.length);
+  out.set(iv, 0);
+  out.set(ct, IV_BYTES);
+  return toB64(out);
+}
 async function unwrapVaultDataKey(wrap, vaultKey, vaultId) {
   let bytes;
   try {
@@ -32605,6 +32865,14 @@ async function unwrapVaultDataKey(wrap, vaultKey, vaultId) {
   }
 }
 var itemAad = (vaultId, itemId, purpose) => enc.encode(`kutrion-vault-key-v1:item:${vaultId.toLowerCase()}:${itemId.toLowerCase()}${purpose ? `:${purpose}` : ""}`);
+async function sealItemField(dataKey, plaintext, vaultId, itemId, purpose) {
+  const iv = random(IV_BYTES);
+  const ctTag = new Uint8Array(await subtle().encrypt({ name: "AES-GCM", iv: bs2(iv), additionalData: bs2(itemAad(vaultId, itemId, purpose)), tagLength: TAG_BITS }, dataKey, bs2(enc.encode(plaintext))));
+  const blob = new Uint8Array(ctTag.length);
+  blob.set(ctTag.subarray(ctTag.length - TAG_BYTES), 0);
+  blob.set(ctTag.subarray(0, ctTag.length - TAG_BYTES), TAG_BYTES);
+  return { iv: toB64(iv), blob: toB64(blob) };
+}
 async function openItemField(dataKey, iv, blob, vaultId, itemId, purpose) {
   let ivBytes, b;
   try {
@@ -32663,6 +32931,40 @@ async function openPrivateItem(item, sealed, vaultKey) {
   ]);
   return { value: value ?? "", notes, custom_fields: fields ? JSON.parse(fields) : [], passphrase, totp };
 }
+async function privateItemDataKey(current, vaultKey, vaultId, enrolledAt) {
+  if (current) {
+    return { dataKey: await unwrapVaultDataKey(current.client_wrapped_data_key, vaultKey, vaultId), key: { key_id: current.key_id } };
+  }
+  const raw = generateVaultKey();
+  try {
+    const [client_wrapped_data_key, dataKey] = await Promise.all([
+      wrapVaultDataKey(raw, vaultKey, vaultId),
+      subtle().importKey("raw", bs2(raw), { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"])
+    ]);
+    return { dataKey, key: { client_wrapped_data_key, vault_key_created_at: enrolledAt } };
+  } finally {
+    raw.fill(0);
+  }
+}
+async function sealPrivateItem(item, plain, dataKey) {
+  const seal = (s, purpose) => sealItemField(dataKey, s, item.vault_id, item.id, purpose);
+  const opt = async (s, purpose) => s === void 0 ? void 0 : s === null || s === "" ? null : seal(s, purpose);
+  const fields = plain.custom_fields === void 0 ? void 0 : plain.custom_fields && plain.custom_fields.length ? JSON.stringify(plain.custom_fields) : null;
+  const [value, notes, custom_fields, passphrase, totp] = await Promise.all([
+    plain.value === void 0 ? void 0 : seal(plain.value),
+    opt(plain.notes),
+    opt(fields),
+    opt(plain.passphrase),
+    opt(plain.totp?.trim() ?? plain.totp, "totp")
+  ]);
+  const out = {};
+  if (value !== void 0) out.value = value;
+  if (notes !== void 0) out.notes = notes;
+  if (custom_fields !== void 0) out.custom_fields = custom_fields;
+  if (passphrase !== void 0) out.passphrase = passphrase;
+  if (totp !== void 0) out.totp = totp;
+  return out;
+}
 
 // ../packages/shared/src/private-vault-copy.ts
 init_define_KT_HUB_FILES();
@@ -32747,6 +33049,7 @@ var PRIVATE_VAULT_COPY = {
 
 // src/args.ts
 init_define_KT_HUB_FILES();
+var REPEATABLE = /* @__PURE__ */ new Set(["vault", "connection", "scope-vault", "scope-conn"]);
 function parseForwardSpec(spec) {
   const m = spec.match(/^(\d{1,5}):(.+):(\d{1,5})$/);
   if (!m) return null;
@@ -32758,10 +33061,12 @@ function parseForwardSpec(spec) {
   return { localPort, dstHost, dstPort };
 }
 var GLOBAL_FLAGS = { base: "value", json: "boolean" };
-var SWITCHES = /* @__PURE__ */ new Set(["browser", "reveal", "password-stdin", "value-stdin", "vault-passphrase-stdin", "fallback", "dry-run"]);
+var SWITCHES = /* @__PURE__ */ new Set(["browser", "reveal", "password-stdin", "value-stdin", "vault-passphrase-stdin", "fallback", "dry-run", "allow-insecure-lan", "stdin"]);
 var KNOWN_FLAGS = /* @__PURE__ */ new Set([
   "action",
   "agent-forward",
+  "allow-insecure-lan",
+  "audience",
   "base",
   "browser",
   "client",
@@ -32773,6 +33078,7 @@ var KNOWN_FLAGS = /* @__PURE__ */ new Set([
   "conflict",
   "conn",
   "conns",
+  "connection",
   "cred",
   "current",
   "daily-at",
@@ -32788,7 +33094,9 @@ var KNOWN_FLAGS = /* @__PURE__ */ new Set([
   "fingerprint",
   "format",
   "from",
+  "help",
   "host",
+  "issuer",
   "insert",
   "intent",
   "json",
@@ -32825,12 +33133,16 @@ var KNOWN_FLAGS = /* @__PURE__ */ new Set([
   "reveal",
   "role",
   "scope",
+  "scope-conn",
+  "scope-vault",
   "scopes",
   "secret",
   "service",
   "session",
   "since",
   "status",
+  "stdin",
+  "subject",
   "target",
   "throttle",
   "timeout",
@@ -32848,19 +33160,28 @@ var KNOWN_FLAGS = /* @__PURE__ */ new Set([
   "verify",
   "views",
   "wait",
+  "write-env",
   "yes"
 ]);
 function unknownFlags(flags) {
   return Object.keys(flags).filter((k) => !KNOWN_FLAGS.has(k));
 }
-function parseArgs(argv) {
+function repeatedFlag(argv2, name) {
+  const out = [];
+  for (let i = 0; i < argv2.length - 1; i++) {
+    if (argv2[i] === `--${name}` && !argv2[i + 1].startsWith("--")) out.push(argv2[i + 1]);
+  }
+  return out;
+}
+function parseArgs(argv2) {
   const flags = {};
+  const multi = {};
   let at = 0;
-  while (at < argv.length && argv[at].startsWith("--")) {
-    const key = argv[at].slice(2);
+  while (at < argv2.length && argv2[at].startsWith("--")) {
+    const key = argv2[at].slice(2);
     const kind = GLOBAL_FLAGS[key];
     if (!kind) break;
-    const next = argv[at + 1];
+    const next = argv2[at + 1];
     if (kind === "value" && next !== void 0 && !next.startsWith("--")) {
       flags[key] = next;
       at += 2;
@@ -32869,16 +33190,22 @@ function parseArgs(argv) {
       at += 1;
     }
   }
-  const cmd = argv[at];
-  const rest = argv.slice(at + 1);
+  const cmd = argv2[at];
+  const rest = argv2.slice(at + 1);
   const positionals = [];
+  if (cmd === "exec") return { cmd, positionals: parseExecArgs(rest, flags), flags, multi };
   for (let i = 0; i < rest.length; i++) {
     const a = rest[i];
+    if (a === "--") {
+      positionals.push(...rest.slice(i + 1));
+      break;
+    }
     if (a.startsWith("--")) {
       const key = a.slice(2);
       const next = rest[i + 1];
       if (!SWITCHES.has(key) && next !== void 0 && !next.startsWith("--")) {
         flags[key] = next;
+        if (REPEATABLE.has(key)) (multi[key] ??= []).push(next);
         i++;
       } else {
         flags[key] = true;
@@ -32887,7 +33214,134 @@ function parseArgs(argv) {
       positionals.push(a);
     }
   }
-  return { cmd: cmd ?? "help", positionals, flags };
+  return { cmd: cmd ?? "help", positionals, flags, multi };
+}
+function parseExecArgs(rest, flags) {
+  const positionals = [];
+  let i = 0;
+  for (; i < rest.length; i++) {
+    const a = rest[i];
+    if (a === "--") {
+      i++;
+      if (positionals.length) break;
+      continue;
+    }
+    if (a.startsWith("--")) {
+      const key = a.slice(2);
+      const next = rest[i + 1];
+      if (!SWITCHES.has(key) && key !== "json" && next !== void 0 && !next.startsWith("--")) {
+        flags[key] = next;
+        i++;
+      } else {
+        flags[key] = true;
+      }
+    } else if (!positionals.length) {
+      positionals.push(a);
+    } else {
+      break;
+    }
+  }
+  positionals.push(...rest.slice(i));
+  return positionals;
+}
+
+// src/base-fallback.ts
+init_define_KT_HUB_FILES();
+var import_fs2 = require("fs");
+var norm = (u) => u.trim().replace(/\/+$/, "");
+function splitBases(parts) {
+  const out = [];
+  for (const p of parts) for (const raw of p.split(",")) {
+    const u = norm(raw);
+    if (u && !out.includes(u)) out.push(u);
+  }
+  return out;
+}
+function fallbackRefusal(f) {
+  let u;
+  try {
+    u = new URL(f.url);
+  } catch {
+    return `not a valid server URL: ${f.url}`;
+  }
+  if (u.protocol === "https:") return null;
+  if (u.protocol === "http:") {
+    return f.insecure ? null : `${f.url} is plain http; credentials would cross it unencrypted. Use https, or opt this base in with --allow-insecure-lan`;
+  }
+  return `unsupported scheme for ${f.url}`;
+}
+var CONNECTION_CODES = /* @__PURE__ */ new Set([
+  "ECONNREFUSED",
+  "ECONNRESET",
+  "ENOTFOUND",
+  "EAI_AGAIN",
+  "ETIMEDOUT",
+  "EHOSTUNREACH",
+  "ENETUNREACH",
+  "EHOSTDOWN",
+  "UND_ERR_CONNECT_TIMEOUT",
+  "UND_ERR_SOCKET"
+]);
+function isConnectionFailure(e) {
+  for (let cur = e, depth = 0; cur && depth < 4; cur = cur.cause, depth++) {
+    if (typeof cur.code === "string" && CONNECTION_CODES.has(cur.code)) return true;
+    if (cur.name === "TimeoutError") return true;
+  }
+  return false;
+}
+var isEdgeFailure = (status) => status >= 520 && status <= 529;
+var replayable = (b) => b == null || typeof b === "string" || b instanceof URLSearchParams || b instanceof ArrayBuffer || ArrayBuffer.isView(b);
+function fallbackFetch(inner, primary, fallbacks, warn = (l) => console.error(l)) {
+  const p = norm(primary);
+  const bases = [{ url: p }];
+  for (const f of fallbacks) {
+    const why2 = fallbackRefusal(f);
+    if (why2) {
+      warn(`warning: ignoring fallback base: ${why2}`);
+      continue;
+    }
+    if (norm(f.url) !== p) bases.push({ ...f, url: norm(f.url) });
+  }
+  if (bases.length === 1) return inner;
+  let sticky = 0;
+  return async (input, init) => {
+    const url = typeof input === "string" ? input : input instanceof URL ? input.href : null;
+    if (url === null || !(url === p || url.startsWith(`${p}/`) || url.startsWith(`${p}?`)) || !replayable(init?.body)) {
+      return inner(input, init);
+    }
+    const suffix = url.slice(p.length);
+    const order = [sticky, ...bases.map((_, i) => i).filter((i) => i !== sticky)];
+    let firstErr;
+    for (let n = 0; n < order.length; n++) {
+      const i = order[n];
+      const b = bases[i];
+      if (b.insecure) warn(`warning: ${b.url} is plain http (opted in with --allow-insecure-lan); this request, with its credentials, is not encrypted`);
+      const more = n < order.length - 1;
+      try {
+        const res = await inner(b.url + suffix, init);
+        if (isEdgeFailure(res.status) && more) {
+          firstErr ??= new Error(`${b.url} answered ${res.status}`);
+          continue;
+        }
+        if (!isEdgeFailure(res.status)) sticky = i;
+        return res;
+      } catch (e) {
+        if (init?.signal?.aborted || !isConnectionFailure(e)) throw e;
+        firstErr ??= e;
+        if (!more) throw firstErr;
+      }
+    }
+    throw firstErr;
+  };
+}
+function readFallbacks(configPath, base) {
+  try {
+    const f = JSON.parse((0, import_fs2.readFileSync)(configPath, "utf8"));
+    if (typeof f.base !== "string" || norm(f.base) !== norm(base) || !Array.isArray(f.fallbacks)) return [];
+    return f.fallbacks.filter((x) => x && typeof x.url === "string").map((x) => ({ url: norm(x.url), ...x.insecure === true ? { insecure: true } : {} }));
+  } catch {
+    return [];
+  }
 }
 
 // src/history.ts
@@ -32940,7 +33394,7 @@ function exitForStatus(status) {
 init_define_KT_HUB_FILES();
 var import_child_process2 = require("child_process");
 var import_crypto = require("crypto");
-var import_fs2 = require("fs");
+var import_fs3 = require("fs");
 var import_os = require("os");
 var import_path2 = require("path");
 
@@ -33038,7 +33492,7 @@ function run(bin, args, store, verb, input) {
 var SECRET_TOOL_DIRS = ["/usr/bin", "/bin", "/usr/local/bin", "/run/current-system/sw/bin"];
 var isExecutable = (p) => {
   try {
-    (0, import_fs2.accessSync)(p, import_fs2.constants.X_OK);
+    (0, import_fs3.accessSync)(p, import_fs3.constants.X_OK);
     return true;
   } catch {
     return false;
@@ -33157,7 +33611,7 @@ function why(r, ...secrets) {
 function fileStore(file = FILE) {
   let raw;
   try {
-    raw = (0, import_fs2.readFileSync)(file, "utf8");
+    raw = (0, import_fs3.readFileSync)(file, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return {};
     throw new Error(`cannot read the token file ${file}: ${e.message}`);
@@ -33174,9 +33628,9 @@ function fileStore(file = FILE) {
 var dirLocked = false;
 function ensureFileDir() {
   const dir = (0, import_path2.dirname)(FILE);
-  (0, import_fs2.mkdirSync)(dir, { recursive: true, mode: 448 });
+  (0, import_fs3.mkdirSync)(dir, { recursive: true, mode: 448 });
   if ((0, import_os.platform)() !== "win32") try {
-    (0, import_fs2.chmodSync)(dir, 448);
+    (0, import_fs3.chmodSync)(dir, 448);
   } catch {
   }
   else if (!dirLocked) {
@@ -33205,32 +33659,32 @@ function withLockFile(lock, fn, afterJudge) {
   const deadline = Date.now() + LOCK_WAIT_MS;
   for (; ; ) {
     try {
-      const fd = (0, import_fs2.openSync)(lock, "wx", 384);
+      const fd = (0, import_fs3.openSync)(lock, "wx", 384);
       try {
-        (0, import_fs2.writeSync)(fd, owner);
+        (0, import_fs3.writeSync)(fd, owner);
       } finally {
-        (0, import_fs2.closeSync)(fd);
+        (0, import_fs3.closeSync)(fd);
       }
       break;
     } catch (e) {
       const code = e.code;
       if (code !== "EEXIST" && code !== "EPERM" && code !== "EACCES") throw e;
-      if (code !== "EEXIST" && !(0, import_fs2.existsSync)(lock)) throw new Error(`cannot write ${(0, import_path2.dirname)(lock)}: ${e.message}`);
+      if (code !== "EEXIST" && !(0, import_fs3.existsSync)(lock)) throw new Error(`cannot write ${(0, import_path2.dirname)(lock)}: ${e.message}`);
       try {
-        if (Date.now() - (0, import_fs2.statSync)(lock).mtimeMs > LOCK_STALE_MS) {
-          const judged = (0, import_fs2.readFileSync)(lock, "utf8");
+        if (Date.now() - (0, import_fs3.statSync)(lock).mtimeMs > LOCK_STALE_MS) {
+          const judged = (0, import_fs3.readFileSync)(lock, "utf8");
           afterJudge?.();
           const gone = `${lock}.${process.pid}.${(0, import_crypto.randomBytes)(4).toString("hex")}`;
-          (0, import_fs2.renameSync)(lock, gone);
-          if ((0, import_fs2.readFileSync)(gone, "utf8") === judged) {
-            (0, import_fs2.rmSync)(gone, { force: true });
+          (0, import_fs3.renameSync)(lock, gone);
+          if ((0, import_fs3.readFileSync)(gone, "utf8") === judged) {
+            (0, import_fs3.rmSync)(gone, { force: true });
             continue;
           }
           try {
-            (0, import_fs2.linkSync)(gone, lock);
+            (0, import_fs3.linkSync)(gone, lock);
           } catch {
           }
-          (0, import_fs2.rmSync)(gone, { force: true });
+          (0, import_fs3.rmSync)(gone, { force: true });
         }
       } catch {
       }
@@ -33242,7 +33696,7 @@ function withLockFile(lock, fn, afterJudge) {
     return fn();
   } finally {
     try {
-      if ((0, import_fs2.readFileSync)(lock, "utf8") === owner) (0, import_fs2.rmSync)(lock, { force: true });
+      if ((0, import_fs3.readFileSync)(lock, "utf8") === owner) (0, import_fs3.rmSync)(lock, { force: true });
     } catch {
     }
   }
@@ -33251,10 +33705,10 @@ var withFileLock = (fn) => withLockFile(`${FILE}.lock`, fn);
 function sweepStaleTemps(file) {
   const dir = (0, import_path2.dirname)(file), prefix = `${(0, import_path2.basename)(file)}.`;
   try {
-    for (const n of (0, import_fs2.readdirSync)(dir)) {
+    for (const n of (0, import_fs3.readdirSync)(dir)) {
       if (!n.startsWith(prefix) || !n.endsWith(".tmp")) continue;
       try {
-        if (Date.now() - (0, import_fs2.statSync)((0, import_path2.join)(dir, n)).mtimeMs > LOCK_STALE_MS) (0, import_fs2.rmSync)((0, import_path2.join)(dir, n), { force: true });
+        if (Date.now() - (0, import_fs3.statSync)((0, import_path2.join)(dir, n)).mtimeMs > LOCK_STALE_MS) (0, import_fs3.rmSync)((0, import_path2.join)(dir, n), { force: true });
       } catch {
       }
     }
@@ -33264,16 +33718,16 @@ function sweepStaleTemps(file) {
 function writeFileStore(store) {
   const tmp = `${FILE}.${process.pid}.${(0, import_crypto.randomBytes)(6).toString("hex")}.tmp`;
   try {
-    (0, import_fs2.closeSync)((0, import_fs2.openSync)(tmp, "wx", 384));
+    (0, import_fs3.closeSync)((0, import_fs3.openSync)(tmp, "wx", 384));
     if ((0, import_os.platform)() === "win32") lockDownWin(tmp, "file");
     else try {
-      (0, import_fs2.chmodSync)(tmp, 384);
+      (0, import_fs3.chmodSync)(tmp, 384);
     } catch {
     }
-    (0, import_fs2.writeFileSync)(tmp, JSON.stringify(store));
+    (0, import_fs3.writeFileSync)(tmp, JSON.stringify(store));
     for (let i = 0; ; i++) {
       try {
-        (0, import_fs2.renameSync)(tmp, FILE);
+        (0, import_fs3.renameSync)(tmp, FILE);
         break;
       } catch (e) {
         const code = e.code;
@@ -33282,7 +33736,7 @@ function writeFileStore(store) {
       }
     }
   } catch (e) {
-    (0, import_fs2.rmSync)(tmp, { force: true });
+    (0, import_fs3.rmSync)(tmp, { force: true });
     throw e;
   }
 }
@@ -33293,7 +33747,7 @@ function updateFileStore(mutate) {
     const store = fileStore();
     if (!mutate(store)) return;
     if (Object.keys(store).length) writeFileStore(store);
-    else (0, import_fs2.rmSync)(FILE, { force: true });
+    else (0, import_fs3.rmSync)(FILE, { force: true });
   });
 }
 function dropFileEntry(base) {
@@ -34029,15 +34483,18 @@ async function borrowAndEnrol(deps) {
   if (enrolment === "device_clients_disabled" || enrolment === "satellite_update_required" || enrolment === "hub_not_bound") return { ok: false, reason: enrolment };
   return enrolment ? { ok: true, enrolment, hubPublicKey: borrowed.hubPublicKey } : { ok: false, reason: "enrol_refused" };
 }
-function createBorrowSession(store, client, resolveDeps) {
+function createBorrowSession(store, client, resolveDeps, otherSigninHeld = () => false) {
   let pending = null;
   let held = null;
   let pin = null;
   let running = false;
+  let autoTried = false;
   return {
-    begin() {
-      if (running) return { ok: false, reason: "already_enrolled" };
-      if (held) return { ok: false, reason: "already_enrolled" };
+    begin(auto = false) {
+      if (auto && autoTried) return { ok: false, reason: "auto_done" };
+      if (auto) autoTried = true;
+      if (running) return { ok: false, reason: "busy" };
+      if (held || otherSigninHeld()) return { ok: false, reason: "signin_in_progress" };
       const p = prepareBorrow(store, client);
       pending = p.ok ? p : null;
       return p.ok ? { ok: true, fingerprint: p.fingerprint } : { ok: false, reason: p.reason };
@@ -34064,6 +34521,9 @@ function createBorrowSession(store, client, resolveDeps) {
       pin = deps.pin;
       return { ok: true, deviceId: out.deviceId, firstContact: out.held !== null };
     },
+    suppressAuto() {
+      autoTried = true;
+    },
     cancel() {
       pending = null;
     },
@@ -34241,14 +34701,29 @@ function joinedAccount(user, lastAccount) {
     accountChanged: lastAccount !== null && lastAccount !== user.id
   };
 }
+var HELD_TTL_MS = 3e5;
 function createBorrowConfirm(deps) {
+  const ttl = deps.ttlMs ?? HELD_TTL_MS;
+  const now = deps.now ?? Date.now;
   let account = null;
   let heldId = null;
   let heldName = null;
+  let heldAt = 0;
+  let timer = null;
   const remember = (user) => {
     if (deps.lastAccount.get() !== user.id) deps.lastAccount.set(user.id);
   };
+  const expired = () => account !== null && now() - heldAt >= ttl;
+  const reap = () => {
+    if (!expired()) return false;
+    void reject().then(() => deps.onExpired?.());
+    return true;
+  };
   const reject = async () => {
+    if (timer) {
+      clearTimeout(timer);
+      timer = null;
+    }
     account = null;
     heldId = null;
     heldName = null;
@@ -34262,19 +34737,28 @@ function createBorrowConfirm(deps) {
       account = user;
       heldId = deviceId;
       heldName = deviceName ?? null;
+      heldAt = now();
+      if (timer) clearTimeout(timer);
+      timer = setTimeout(reap, ttl);
+      timer.unref?.();
     },
-    pending: () => account ? { ...joinedAccount(account, deps.lastAccount.get()), deviceName: heldName } : null,
+    pending: () => account && !reap() ? { ...joinedAccount(account, deps.lastAccount.get()), deviceName: heldName, deviceId: heldId } : null,
     seen(user) {
       if (!account && user) remember(user);
     },
-    async confirm() {
+    async confirm(deviceId) {
+      if (reap()) return false;
       const user = account;
       const id = heldId;
-      if (!user || !id) return false;
+      if (!user || !id || id !== deviceId) return false;
       if (!deps.borrow.commit(id)) {
         await reject();
         return false;
       }
+      if (timer) {
+        clearTimeout(timer);
+        timer = null;
+      }
       account = null;
       heldId = null;
       remember(user);
@@ -34476,6 +34960,10 @@ function cliHubStores(base, kc, keychainAvailable) {
   };
   return { store, pin, latch, lastAccount, failedWrite: () => failed2 ? { deviceId, bearer } : null };
 }
+var lastAccountId = (base, kc) => read(kc, slot.lastAccount(base));
+function recordLastAccountId(base, kc, user) {
+  if (user && typeof user.id === "string" && user.id) write(kc, slot.lastAccount(base), user.id);
+}
 function borrowedDeviceKey(base, kc) {
   return readDevice(kc, base).key;
 }
@@ -34576,6 +35064,7 @@ async function hubLogin(deps) {
   if (!deps.keychainAvailable()) return { kind: "fallback", note: null, reason: "no_keychain" };
   if (locationFault(deps.location)) return { kind: "fallback", note: null, reason: "hub_not_running" };
   const { store, pin, latch, lastAccount, failedWrite } = cliHubStores(deps.base, deps.kc, deps.keychainAvailable);
+  if (deps.pairedOnly && !pin.hubPublicKey) return { kind: "fallback", note: null, reason: "not_paired" };
   const revoke = (deviceId, bearer) => endServerSession(deps.call, deviceId, bearer);
   const session = createBorrowSession(store, "cli", () => ({
     location: deps.location,
@@ -34627,11 +35116,36 @@ async function hubLogin(deps) {
   const verdict = await presentJoined(confirm, deps.out, deps.ask);
   if (verdict === "not_kept") return { kind: "fallback", note: HUB_COPY.notKept, reason: "not_kept" };
   if (verdict === "not_you") return { kind: "fallback", note: HUB_COPY.notYou, reason: "not_you" };
-  if (!await confirm.confirm()) return { kind: "fallback", note: HUB_COPY.notKept, reason: "not_kept" };
+  if (!await confirm.confirm(done.deviceId)) return { kind: "fallback", note: HUB_COPY.notKept, reason: "not_kept" };
   const lost = await unkept();
   if (lost) return lost;
   return { kind: "signed_in", user, firstContact: true };
 }
+var canPromptYes = (stdin, stderr) => Boolean(stdin.isTTY && stderr.isTTY);
+var reborrowFromHub = (deps) => hubLogin({ ...deps, pairedOnly: true });
+var loginTriesHub = (flags, accountRoot) => flags.email === void 0 && flags["password-stdin"] !== true && accountRoot !== null;
+var HubAccountSwitchedError = class extends Error {
+  constructor(email) {
+    super(`Signed in through Kutrion Hub as ${email === null ? "an account it could not name" : printable(email)}, which is not the account this command started on. Run it again to use that account.`);
+    this.name = "HubAccountSwitchedError";
+  }
+};
+async function retryAfterHubReborrow(run2, deps) {
+  try {
+    return await run2();
+  } catch (e) {
+    if (!deps.refusedSession(e) || deps.wrote()) throw e;
+    const before = deps.lastAccount();
+    const hub = await deps.reborrow();
+    if (hub.kind !== "signed_in") {
+      if (hub.note) deps.out(hub.note);
+      throw e;
+    }
+    if (!before || !hub.user || hub.user.id !== before) throw new HubAccountSwitchedError(hub.user ? hub.user.email : null);
+    deps.out(`Signed in again with the Kutrion app as ${printable(hub.user.email)}; running the command again.`);
+  }
+  return run2();
+}
 
 // src/hub/hub-seed.ts
 init_define_KT_HUB_FILES();
@@ -34855,9 +35369,9 @@ function installLocationFromRegistry(regOutput) {
 }
 function underInstallRoot(dir, roots) {
   if (!import_node_path3.win32.isAbsolute(dir)) return false;
-  const norm = (p) => import_node_path3.win32.resolve(p).toLowerCase().replace(/[\\/]+$/, "");
-  const d = norm(dir);
-  return roots.some((r) => r && import_node_path3.win32.isAbsolute(r) && d.startsWith(norm(r) + "\\"));
+  const norm2 = (p) => import_node_path3.win32.resolve(p).toLowerCase().replace(/[\\/]+$/, "");
+  const d = norm2(dir);
+  return roots.some((r) => r && import_node_path3.win32.isAbsolute(r) && d.startsWith(norm2(r) + "\\"));
 }
 function hubLauncher(env = {}) {
   const platform3 = env.platform ?? process.platform;
@@ -35009,13 +35523,14 @@ var host = () => (0, import_os3.hostname)().trim().replace(/\.local$/, "") || "t
 var ownDeviceName = () => `Kutrion CLI on ${host()}`.slice(0, 255);
 async function registerOwnDevice(deps) {
   const tty = deps.tty ?? Boolean(process.stdin.isTTY && process.stderr.isTTY);
-  if (seedSkipReason(deps.env ?? process.env, deps.platform ?? process.platform, tty)) return { kind: "skipped", note: null };
+  const previous = deps.previousDeviceId ?? null;
+  if (!previous && seedSkipReason(deps.env ?? process.env, deps.platform ?? process.platform, tty)) return { kind: "skipped", note: null };
   if (!deps.bearer || !deps.keychainAvailable()) return { kind: "skipped", note: null };
   const { store, failedWrite } = cliHubStores(deps.base, deps.kc, deps.keychainAvailable);
   const key = resolveDeviceKey(store);
   const res = await deps.post(
     "/auth/devices/register",
-    { name: ownDeviceName(), platform: "desktop", client: "cli", public_key: key.publicSpkiB64 },
+    { name: ownDeviceName(), platform: "desktop", client: "cli", public_key: key.publicSpkiB64, ...previous ? { previous_device_id: previous } : {} },
     deps.bearer
   );
   if (!res.ok) {
@@ -35185,16 +35700,16 @@ function redactProxyUrls(text2) {
 function bypassesProxy(host2, port, no) {
   if (!no) return false;
   for (const raw of no.split(/[\s,]+/)) {
-    let entry = raw.trim().toLowerCase();
-    if (!entry) continue;
-    if (entry === "*") return true;
-    const colon = entry.match(/^(.*):(\d+)$/);
+    let entry2 = raw.trim().toLowerCase();
+    if (!entry2) continue;
+    if (entry2 === "*") return true;
+    const colon = entry2.match(/^(.*):(\d+)$/);
     if (colon) {
       if (colon[2] !== port) continue;
-      entry = colon[1];
+      entry2 = colon[1];
     }
-    entry = entry.replace(/^\*?\./, "");
-    if (host2 === entry || host2.endsWith(`.${entry}`)) return true;
+    entry2 = entry2.replace(/^\*?\./, "");
+    if (host2 === entry2 || host2.endsWith(`.${entry2}`)) return true;
   }
   return false;
 }
@@ -35348,8 +35863,8 @@ function firstBindingWarning(name, group, host2, port) {
     ...group.protocols.length > 1 ? ["", "Authorizing SSH also authorizes SFTP. They are one destination."] : []
   ];
 }
-function removalWarning(name, group, entry, remainingAfter, sameGroupRemaining) {
-  const pairNote = entry.rows.length > 1 ? ["", "Both the SSH and the SFTP authorization for this host are removed."] : [];
+function removalWarning(name, group, entry2, remainingAfter, sameGroupRemaining) {
+  const pairNote = entry2.rows.length > 1 ? ["", "Both the SSH and the SFTP authorization for this host are removed."] : [];
   if (remainingAfter === 0) {
     return [
       `This is the only destination authorized on "${name}".`,
@@ -35368,7 +35883,7 @@ function removalWarning(name, group, entry, remainingAfter, sameGroupRemaining)
     ];
   }
   return [
-    `"${name}" will no longer be accepted at ${entry.host}:${entry.port} over ${group.protocols.map((p) => PROTOCOL_LABEL[p]).join(" or ")}.`,
+    `"${name}" will no longer be accepted at ${entry2.host}:${entry2.port} over ${group.protocols.map((p) => PROTOCOL_LABEL[p]).join(" or ")}.`,
     "",
     `Its other ${group.label} destinations are unchanged.`,
     ...pairNote
@@ -35517,6 +36032,7 @@ async function confirmChainedHostKey(deps, connId, k, own) {
 }
 
 // src/refusal.ts
+var refreshWhy = (code, noun = "session") => refreshRefusalCopy(code, noun)?.why ?? code;
 var REFUSALS = {
   // #1538 authoring time. Safe to key here even though `jump_cycle` and `jump_too_deep` are also
   // WebSocket codes: this table is read only by refusalLines() on the HTTP path, and wsRefusalLines()
@@ -35538,16 +36054,22 @@ var REFUSALS = {
     why: "A jump host must be one of your own SSH connections, and no connection of yours has that id.",
     action: "Run `kt conns` and pass an id from the first column to --jump."
   },
-  // auth-guard.ts:109 (social-session gate) and :167 (adaptive), plus rotation.ts:159, jit.ts:226,
-  // fleet.ts:190, agents.ts:146, modules/ssh.ts:727 and :1222. The remedy is mechanical and worth
-  // stating exactly, because it is not obvious that it can be satisfied anywhere but here: step-up
-  // freshness is a per-USER Redis proof with a ~5 minute TTL (server/src/lib/step-up.ts:16), not a
-  // claim baked into this CLI's token. Stepping up in the web app on the same account therefore
-  // does clear it here.
+  // #3528: modules/ssh.ts sftpFail and modules/files.ts send this for a remote path, not a record id, so
+  // the 404 line about an invisible id would point at the wrong thing.
+  path_not_found: {
+    title: "No such path",
+    why: "The connection was reached, but nothing exists at that path on the remote side.",
+    action: "Check the path. `kt sftp ls <connId>` with no path lists the connection's starting directory."
+  },
+  // lib/auth-guard.ts blockStepUpPending (social-session gate) and enforceAdaptiveAuth (adaptive), plus
+  // the rotation, jit, fleet, agents and ssh modules. Step-up freshness is a per-SESSION Redis proof with
+  // a short TTL (server/src/lib/step-up.ts), so a step-up in the web app does not clear this CLI's
+  // session; `kt step-up` proves it for this one. The refusal does not say which factors the account
+  // holds, so the action names a completable path for each case (#3539).
   step_up_required: {
     title: "Step-up verification required",
     why: "This action needs a recent passkey or app-MFA check, and this session does not have one.",
-    action: "Only `kt mfa` and `kt passkey rm` ask for an authenticator code here, and only on an account that has one. Otherwise verify a passkey or app-MFA in the Kutrion web app on the same account, then re-run this command within a few minutes. If you signed in through SSO or a social provider, `kt login --email <e> --password <p> --code <2fa>` also mints a session that is not gated."
+    action: "Run `kt step-up` and enter a code from your authenticator app, then re-run this command within a few minutes. With no authenticator app on the account (none yet, or a passkey only, which a terminal cannot verify), enrol one first with `kt mfa setup` and `kt mfa verify --code <code>`, then run `kt step-up`. If you signed in through SSO or a social provider, `kt login --email <e> --password <p> --code <2fa>` also mints a session that is not gated."
   },
   // #2225 AC5, and the one shape this table exists for: the server owns the REASON, this client adds
   // the ROUTE. The server's hint names what ended the session (server/src/index.ts for a credential
@@ -35568,6 +36090,49 @@ var REFUSALS = {
     why: "The token stored for this server is no longer accepted, so every command will be refused until this machine signs in again.",
     action: "Run `kt login` to sign in again."
   },
+  // #3444/#3445: POST /auth/refresh terminal verdicts (server/src/modules/devices.ts). Each ends the
+  // stored session, like device_revoked, so the only way forward is a fresh `kt login`. The Hub pair
+  // reuses the extension's sentences word for word.
+  refresh_credentials_changed: {
+    title: "Your password changed",
+    why: refreshWhy("refresh_credentials_changed"),
+    action: "Run `kt login` with your new password."
+  },
+  refresh_hub_signed_out: {
+    title: "This session was signed out",
+    why: refreshWhy("refresh_hub_signed_out"),
+    action: "Run `kt login` to sign in again."
+  },
+  refresh_hub_revoked: {
+    title: "This session was signed out",
+    why: refreshWhy("refresh_hub_revoked", "app"),
+    action: "Run `kt login` to sign in again."
+  },
+  device_revoked: {
+    title: "This device was signed out",
+    why: refreshWhy("device_revoked", "device"),
+    action: "Run `kt login` to sign in again and register it anew."
+  },
+  account_inactive: {
+    title: "This account has ended",
+    why: refreshWhy("account_inactive"),
+    action: "Your administrator can restore the account. Signing in again will not work until they do."
+  },
+  account_expired: {
+    title: "This account has expired",
+    why: refreshWhy("account_expired"),
+    action: "Your administrator can extend the account. Signing in again will not work until they do."
+  },
+  user_inactive: {
+    title: "This account has ended",
+    why: refreshWhy("user_inactive"),
+    action: "Your administrator can restore the account. Signing in again will not work until they do."
+  },
+  org_mismatch: {
+    title: "This session was signed out",
+    why: refreshWhy("org_mismatch"),
+    action: "Run `kt login` to sign in again with your current organization."
+  },
   // auth-guard.ts:164. The distinguishing fact is that this one CANNOT be stepped up out of — it is
   // sent precisely when the account holds no second factor to step up with.
   access_blocked: {
@@ -35649,7 +36214,7 @@ var REFUSALS = {
     why: "Promoting now would leave those hosts refusing every session, because they do not yet accept a certificate from the next CA.",
     action: "Install or verify each host listed by `kt broker-ca status`, or revoke its enrollment, then promote again."
   },
-  // authz.ts:69, connection-import.ts:142. Overage freeze after a downgrade — read stays, write stops.
+  // authz.ts:69, connection-import.ts:164. Overage freeze after a downgrade — read stays, write stops.
   vault_frozen: {
     title: "Vault is read-only",
     why: "This vault is frozen for writes because the plan's vault limit was exceeded after a downgrade.",
@@ -35675,7 +36240,7 @@ var REFUSALS = {
     why: "This organization keeps AI on its own network, so only agents declared `lan` may act for it.",
     action: 'Mint with `--egress lan` only for a model the organization hosts on its own network, or ask an owner to turn off "Keep AI on our network".'
   },
-  // files.ts:196.
+  // server/src/modules/files.ts:353.
   tls_downgrade_refused: {
     title: "Transport security cannot be weakened",
     why: "The change would turn TLS off, or allow an unverified certificate, on a connection that already has it on.",
@@ -35731,7 +36296,7 @@ var REFUSALS = {
     why: "The code was valid for a limited time and that time has passed.",
     action: "Run `kt login` again; a new code is emailed when the password is accepted."
   },
-  // vault.ts:1105/1363/1387, files.ts:129, shares.ts:43, file-broker.ts:99. #954: the wire field is
+  // vault.ts:1105/1363/1387, server/src/modules/files.ts:369/574, shares.ts:43, file-broker.ts:99. #954: the wire field is
   // `inject_only`; the name the product uses is "No-reveal", and the second half is stated positively
   // so the credential does not read as broken.
   inject_only: {
@@ -35739,12 +36304,42 @@ var REFUSALS = {
     why: "Kutrion does not display, copy, export or share this credential's value. It is still used to authenticate connections and integrations.",
     action: "Use the credential rather than reading it \u2014 `kt ssh <connId>` or `kt exec <connId> <command>` broker a session with it without the value passing through this terminal."
   },
-  // modules/ssh.ts:470, modules/rdp.ts:151.
+  // modules/ssh.ts:478, modules/rdp.ts:151.
   inject_only_requires_write: {
     title: "Write access required for a No-reveal credential",
     why: "Pointing a connection at a No-reveal credential needs write access to the vault holding it, because the person doing it decides where the credential gets presented.",
     action: "Ask an owner or editor of that vault to make the change, or to grant you write access to it."
   },
+  // lib/untrusted-cert.ts, sent by files.ts fail() and cloud.ts fail() as a 503 (#3418); admitted past the 5xx
+  // gate by SERVER_REFUSALS. Wording matches Kutrion Transfer's entry.
+  // lib/remote-auth.ts, sent by files.ts fail() and ssh.ts sftpFail() as a 422 (#3451). Wording shared with Kutrion Transfer.
+  remote_auth_failed: {
+    title: "The server rejected the sign-in",
+    why: REMOTE_AUTH_FAILED_TEXT,
+    action: "Update the credential this connection uses in the vault, then retry."
+  },
+  // lib/remote-auth.ts, sent by files.ts fail() as a 400 (#3462). Nothing was sent to the host. Wording shared with Kutrion Transfer.
+  basic_over_http_refused: {
+    title: "The password was not sent over plain HTTP",
+    why: BASIC_OVER_HTTP_REFUSED_TEXT,
+    action: "Switch this connection to HTTPS, then retry."
+  },
+  basic_after_digest_refused: {
+    title: "The server's sign-in method changed",
+    why: BASIC_AFTER_DIGEST_REFUSED_TEXT,
+    action: "Kutrion refused because someone between you and the server may be removing the safer sign-in option. Ask whoever runs the server whether they changed its sign-in settings. If the change is genuine, delete this connection and add it again, or, if you own it, edit it to the server's new address (this needs step-up). Only adding it again resets the remembered sign-in type for the same address."
+  },
+  // lib/remote-auth.ts, sent by files.ts fail() as a 400 (#3484). Nothing was sent to the host.
+  credential_control_characters: {
+    title: "The saved sign-in cannot be sent",
+    why: CREDENTIAL_CONTROL_CHARS_TEXT,
+    action: CREDENTIAL_CONTROL_CHARS_NEXT
+  },
+  tls_certificate_untrusted: {
+    title: "This host's certificate is not trusted",
+    why: "The host presented a certificate that no authority vouches for, often a self-signed one, so the connection was not made. Nothing was sent to the host.",
+    action: "Ask an admin to review the certificate or the network path to this host."
+  },
   // access-policy.ts:264, reached from a root preHandler over the file family; reason values from AccessDecision.reason. The server sends
   // a bare code here and no hint, so translating `reason` is the whole value this entry adds.
   blocked_by_access_policy: {
@@ -35752,7 +36347,7 @@ var REFUSALS = {
     why: "This organization restricts where its file connections may be reached from, and this request came from outside that.",
     action: "Connect from an allowed network or country, or ask an organization administrator to widen the policy. The `reason` below says which rule refused it."
   },
-  // files.ts:34/795/889, file-requests.ts:280. `path` and `rule` name the file and the rule.
+  // server/src/modules/files.ts:56/1054, file-requests.ts:280. `path` and `rule` name the file and the rule.
   blocked_by_dlp_policy: {
     title: "Blocked by a data-loss-prevention rule",
     why: "The content or the path matched a rule this organization applies to file transfers.",
@@ -35922,8 +36517,14 @@ function contextLines(body, indent) {
     const text2 = Array.isArray(v) ? v.filter((x) => x !== null && typeof x !== "object").map((x) => String(x)).join(", ") : String(v);
     if (text2.trim()) out.push(`${indent}${f}: ${text2}`);
   }
+  const fields = asRecord(asRecord(b.details)?.fieldErrors);
+  for (const [field2, msgs] of Object.entries(fields ?? {})) {
+    const text2 = Array.isArray(msgs) ? msgs.filter((m) => typeof m === "string").map(scrubInput).join("; ") : "";
+    if (text2) out.push(`${indent}${field2}: ${text2}`);
+  }
   return out;
 }
+var scrubInput = (m) => m.replace(/,?\s*(?:received|got)\s+(?:'[^']*'|"[^"]*"|\S+)/gi, "").replace(/\s{2,}/g, " ").replace(/[\s,]+$/, "").trim();
 var STATUS_ACTION = {
   400: "The server could not use the request as sent. Check the command's arguments against `kt --help`.",
   401: "This machine's session was not accepted. Run `kt login` to sign in again.",
@@ -35936,11 +36537,15 @@ var STATUS_ACTION = {
   422: "The server understood the request but refused its values. Check the values passed against `kt --help`.",
   429: "Too many requests in a short period. Wait before retrying rather than looping."
 };
-var SERVER_REFUSALS = /* @__PURE__ */ new Set(["payment_unconfirmed"]);
+var HUB_SIGN_IN_ACTION = {
+  status: "This machine's session was not accepted. Run `kt login`, it signs in through Kutrion Hub.",
+  signed_out: "Run `kt login`, it signs in through Kutrion Hub."
+};
+var SERVER_REFUSALS = /* @__PURE__ */ new Set(["payment_unconfirmed", "tls_certificate_untrusted"]);
 var sentenceKey = (t) => t.toLowerCase().replace(/[^a-z0-9]+/g, "");
 var sameSentence = (a, b) => b !== void 0 && sentenceKey(a) === sentenceKey(b);
 var SIGNIN_CODE_REFUSALS = /* @__PURE__ */ new Set(["email_code_required", "signin_code_cap"]);
-function refusalLines(e, indent = "  ") {
+function refusalLines(e, indent = "  ", opts2 = {}) {
   if (!(e instanceof ApiError)) return null;
   if (e.status < 400 || e.status >= 500 && !SERVER_REFUSALS.has(refusalCode(e))) return null;
   const dest = parseDestinationRefusal(e.body);
@@ -35963,11 +36568,16 @@ function refusalLines(e, indent = "  ") {
       `${indent}kt conn set <id> --jump none`
     ];
   }
-  const code = refusalCode(e);
+  const fromRefresh = e.refreshCode !== void 0 && Object.hasOwn(REFUSALS, e.refreshCode);
+  const code = fromRefresh ? e.refreshCode : refusalCode(e);
   const platformFlag = platformFlagRefusalText(code);
   if (platformFlag) return [`Turned off on this deployment (${code}, HTTP ${e.status})`, "", platformFlag];
+  const privateHost = code === "blocked_internal_address" ? str6(asRecord(e.body)?.host) : null;
+  if (privateHost) {
+    return [`Refused by the server (${code}, HTTP ${e.status})`, "", privateTargetSentence({ host: privateHost, surface: "short", reason: asRecord(e.body)?.target_reason })];
+  }
   const copy = Object.hasOwn(REFUSALS, code) ? REFUSALS[code] : void 0;
-  const server = SIGNIN_CODE_REFUSALS.has(code) ? null : serverText(e.body);
+  const server = fromRefresh || SIGNIN_CODE_REFUSALS.has(code) ? null : serverText(e.body);
   const context = contextLines(e.body, indent);
   const head = copy ? `${copy.title} (${code}, HTTP ${e.status})` : `Refused by the server (${code}, HTTP ${e.status})`;
   const lines = [head, ""];
@@ -35976,7 +36586,9 @@ function refusalLines(e, indent = "  ") {
   if (!copy && !server) lines.push("The server sent no explanation with this refusal.");
   if (context.length) lines.push("", ...context);
   lines.push("");
-  if (copy?.action) lines.push(copy.action);
+  const hubAction = !opts2.hubSignIn || e.status !== 401 ? null : code === "session_signed_out" ? HUB_SIGN_IN_ACTION.signed_out : copy ? null : HUB_SIGN_IN_ACTION.status;
+  if (hubAction) lines.push(hubAction);
+  else if (copy?.action) lines.push(copy.action);
   else if (copy) lines.push("Nothing at this terminal changes this answer.");
   else lines.push(STATUS_ACTION[e.status] ?? `Quote the code and status above when reporting this; they are the whole of what the server sent.`);
   return lines;
@@ -36038,7 +36650,9 @@ function wsRefusalLines(frame, indent = "  ", jumpCtx = {}) {
   const jump = jumpRefusalReport(frame, code, head, jumpCtx, indent);
   if (jump) return jump;
   const lines = [code && !ourFault ? `${head} (${code})` : head, ""];
-  lines.push(str6(frame.error) ?? "The server sent no explanation with this refusal.");
+  lines.push(
+    code === "blocked_internal_address" && host2 ? privateTargetSentence({ host: host2, surface: "short", reason: d.target_reason }) : str6(frame.error) ?? "The server sent no explanation with this refusal."
+  );
   if (host2) lines.push("", `${indent}endpoint: ${port === null ? host2 : `${host2}:${port}`}`);
   if (allowed.length) {
     lines.push("", destinationRefusalAllowedLabel(dest));
@@ -36051,6 +36665,17 @@ function wsRefusalLines(frame, indent = "  ", jumpCtx = {}) {
 }
 
 // src/shell.ts
+function ttySize(columns, rows) {
+  const known = (n, d) => typeof n === "number" && Number.isFinite(n) && n > 0 ? n : d;
+  return [known(columns, 80), known(rows, 24)];
+}
+function detachNotice(frame) {
+  const ms = frame.orphan_ttl_ms;
+  const left = typeof ms === "number" && ms > 0 ? ms >= 6e4 ? `${Math.round(ms / 6e4)} minute${Math.round(ms / 6e4) === 1 ? "" : "s"}` : `${Math.ceil(ms / 1e3)} seconds` : null;
+  const held = left ? `The session keeps running on the server for ${left}, then ends.` : "The session keeps running on the server for a short time, then ends.";
+  if (frame.recorded !== true) return `[Kutrion] Detached. ${held}`;
+  return `[Kutrion] Detached. ${held} Its recording is saved when the session ends, and kt recordings lists it from then. To end a session at once, type exit in it instead of detaching.`;
+}
 function runShell(base, token, connId, onExit, jumpCtx = {}, afterSession, onChainedHostKey) {
   const wsUrl = shellUrl(base, connId);
   const ws = new wrapper_default(wsUrl, { headers: { Authorization: `Bearer ${token}` }, agent: wsAgentFor(wsUrl) });
@@ -36059,12 +36684,12 @@ function runShell(base, token, connId, onExit, jumpCtx = {}, afterSession, onCha
   const isTty = Boolean(stdin.isTTY && stdout.isTTY);
   const sendResize = () => {
     if (ws.readyState !== wrapper_default.OPEN) return;
-    const cols = stdout.columns ?? 80;
-    const rows = stdout.rows ?? 24;
+    const [cols, rows] = ttySize(stdout.columns, stdout.rows);
     ws.send(resizeFrame(cols, rows));
   };
   let exiting = false;
   let recordedSessionId = null;
+  let sessionInfo = null;
   const printReceipt = async () => {
     const id = recordedSessionId;
     if (!id) return;
@@ -36086,6 +36711,9 @@ function runShell(base, token, connId, onExit, jumpCtx = {}, afterSession, onCha
       ws.close();
     } catch {
     }
+    if (!ended && sessionInfo) process.stderr.write(`\r
+${detachNotice(sessionInfo)}\r
+`);
     void (ended ? printReceipt() : Promise.resolve()).catch(() => {
     }).then(() => onExit?.()).catch(() => {
     }).then(() => process.exit(code));
@@ -36126,6 +36754,7 @@ ${wsRefusalLines(frame, "  ", jumpCtx).join("\r\n")}\r
     const sessionFrame = sawSession ? null : parseSessionFrame(text2);
     if (sessionFrame) {
       sawSession = true;
+      sessionInfo = sessionFrame;
       const state = recordingStateLabel(sessionFrame);
       if (state) process.stderr.write(`\r
 [Kutrion] ${state}\r
@@ -36203,7 +36832,7 @@ var import_readline = require("readline");
 
 // src/mcp-install.ts
 init_define_KT_HUB_FILES();
-var import_fs3 = require("fs");
+var import_fs4 = require("fs");
 var import_os4 = require("os");
 var import_path4 = require("path");
 var import_child_process3 = require("child_process");
@@ -36233,6 +36862,18 @@ function refuseBodyRedirects(inner = fetch) {
     }
   };
 }
+function trackWrites(inner) {
+  let wrote = false;
+  return {
+    fetch: async (input, init) => {
+      const res = await inner(input, init);
+      const method = (init?.method ?? (input instanceof Request ? input.method : "GET")).toUpperCase();
+      if (res.ok && method !== "GET") wrote = true;
+      return res;
+    },
+    wrote: () => wrote
+  };
+}
 
 // src/mcp-install.ts
 var appData = () => process.env.APPDATA ?? (0, import_path4.join)((0, import_os4.homedir)(), "AppData", "Roaming");
@@ -36286,35 +36927,35 @@ function bundleCandidates(moduleDir) {
 function resolveLaunch(base, client, moduleDir = __dirname) {
   const which = (0, import_child_process3.spawnSync)("command -v kt", { encoding: "utf8", shell: true });
   const onPath = which.status === 0 ? (which.stdout ?? "").trim().split("\n")[0] : "";
-  let entry;
+  let entry2;
   if ((0, import_path4.isAbsolute)(onPath)) {
-    entry = { command: onPath, args: ["mcp"] };
+    entry2 = { command: onPath, args: ["mcp"] };
   } else {
-    const bundle = bundleCandidates(moduleDir).find((p) => (0, import_fs3.existsSync)(p));
+    const bundle = bundleCandidates(moduleDir).find((p) => (0, import_fs4.existsSync)(p));
     if (!bundle) {
       throw new Error(
         "no built CLI to launch the MCP bridge with. Run `npm run build` in cli/, or install the CLI so that `kt` is on your PATH, then re-run this command."
       );
     }
-    entry = { command: process.execPath, args: [bundle, "mcp"] };
+    entry2 = { command: process.execPath, args: [bundle, "mcp"] };
   }
   const fileStore2 = (ktEnv("TOKEN_STORE") ?? "").trim().toLowerCase() === "file";
-  entry.env = {
+  entry2.env = {
     KT_API_BASE: base,
     ...client ? { KT_MCP_CLIENT: client } : {},
     ...fileStore2 ? { KT_TOKEN_STORE: "file" } : {}
   };
-  return entry;
+  return entry2;
 }
 var STORE_ENV = /* @__PURE__ */ new Set(["TOKEN_STORE", "TOKEN_STORE_TIMEOUT_MS"]);
-async function verifyLaunch(entry, timeoutMs = 15e3) {
+async function verifyLaunch(entry2, timeoutMs = 15e3) {
   const probe = JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/list", params: {} });
   const inherited = Object.fromEntries(
     Object.entries(process.env).filter(([k]) => !/^(KT|VT)_/.test(k) || STORE_ENV.has(k.slice(3)))
   );
-  const res = (0, import_child_process3.spawnSync)(entry.command, entry.args, {
+  const res = (0, import_child_process3.spawnSync)(entry2.command, entry2.args, {
     input: probe + "\n",
-    env: { ...inherited, ...entry.env ?? {} },
+    env: { ...inherited, ...entry2.env ?? {} },
     cwd: (0, import_os4.tmpdir)(),
     encoding: "utf8",
     timeout: timeoutMs
@@ -36333,10 +36974,10 @@ async function verifyLaunch(entry, timeoutMs = 15e3) {
     return { ok: false, error: "the bridge produced output that is not JSON-RPC" };
   }
 }
-function mergeConfig(existing, key, entry) {
+function mergeConfig(existing, key, entry2) {
   const cfg = existing && typeof existing === "object" && !Array.isArray(existing) ? { ...existing } : {};
   const servers = cfg[key] && typeof cfg[key] === "object" && !Array.isArray(cfg[key]) ? { ...cfg[key] } : {};
-  servers[SERVER_NAME] = entry;
+  servers[SERVER_NAME] = entry2;
   cfg[key] = servers;
   return cfg;
 }
@@ -36352,14 +36993,14 @@ function removeFromConfig(existing, key) {
 }
 function readJson(path) {
   try {
-    return JSON.parse((0, import_fs3.readFileSync)(path, "utf8"));
+    return JSON.parse((0, import_fs4.readFileSync)(path, "utf8"));
   } catch {
     return void 0;
   }
 }
 function writeJson(path, value) {
-  (0, import_fs3.mkdirSync)((0, import_path4.dirname)(path), { recursive: true });
-  (0, import_fs3.writeFileSync)(path, JSON.stringify(value, null, 2) + "\n");
+  (0, import_fs4.mkdirSync)((0, import_path4.dirname)(path), { recursive: true });
+  (0, import_fs4.writeFileSync)(path, JSON.stringify(value, null, 2) + "\n");
 }
 var agentAccount = (base, client) => client ? `agent:${base}:${client}` : `agent:${base}`;
 function getAgentToken(base, client) {
@@ -36404,7 +37045,7 @@ async function installClient(o) {
   if (!configPath) {
     throw new Error(`${target.label} is not available on this platform (${(0, import_os4.platform)()}).`);
   }
-  const entry = resolveLaunch(o.base, o.client);
+  const entry2 = resolveLaunch(o.base, o.client);
   const mint = () => api2(o.base, "/agents", o.userToken, {
     method: "POST",
     body: JSON.stringify({
@@ -36413,7 +37054,8 @@ async function installClient(o) {
       client: o.client,
       scopes: o.scopes,
       ttl_minutes: o.ttlDays * 24 * 60,
-      egress_class: o.egressClass ?? "cloud"
+      egress_class: o.egressClass ?? "cloud",
+      ...o.resourceScope ? { resource_scope: o.resourceScope } : {}
     })
   });
   let superseded = 0;
@@ -36454,16 +37096,17 @@ async function installClient(o) {
   superseded += old.revoked;
   revokeFailed.push(...old.revokeFailed);
   agentListStatus ??= old.agentListStatus;
-  writeJson(configPath, mergeConfig(readJson(configPath), target.key, entry));
+  writeJson(configPath, mergeConfig(readJson(configPath), target.key, entry2));
   const who = await api2(o.base, "/mcp/whoami", agent.token);
   return {
+    ...o.resourceScope ? { resourceScope: o.resourceScope } : {},
     configPath,
     principalId: agent.id,
     expiresAt: agent.expires_at,
     scopes: agent.scopes,
     next: target.next,
     verified: who.status === 200 && who.body?.principal_id === agent.id,
-    launch: await verifyLaunch(entry),
+    launch: await verifyLaunch(entry2),
     superseded,
     revokeFailed,
     ...agentListStatus !== void 0 ? { agentListStatus } : {}
@@ -36481,7 +37124,7 @@ async function uninstallClient(o) {
   if (o.client) {
     const target = CLIENTS[o.client];
     configPath = target.path(o.dir);
-    if (configPath && (0, import_fs3.existsSync)(configPath)) {
+    if (configPath && (0, import_fs4.existsSync)(configPath)) {
       writeJson(configPath, removeFromConfig(readJson(configPath), target.key));
     }
   }
@@ -36503,6 +37146,7 @@ async function agentStatus(base, token) {
         principal_id: who.body?.principal_id,
         expires_at: who.body?.expires_at,
         scopes: who.body?.scopes,
+        resource_scope: who.body?.resource_scope,
         rate_limit: who.body?.rate_limit
       };
     }
@@ -36518,17 +37162,66 @@ async function mcpStatus(base, dir) {
     const p = t.path(dir);
     let installed = false;
     let configuredBase = null;
-    if (p && (0, import_fs3.existsSync)(p)) {
+    if (p && (0, import_fs4.existsSync)(p)) {
       const cfg = readJson(p);
-      const entry = cfg?.[t.key]?.[SERVER_NAME];
-      installed = !!entry;
-      if (typeof entry?.env?.KT_API_BASE === "string") configuredBase = entry.env.KT_API_BASE;
+      const entry2 = cfg?.[t.key]?.[SERVER_NAME];
+      installed = !!entry2;
+      if (typeof entry2?.env?.KT_API_BASE === "string") configuredBase = entry2.env.KT_API_BASE;
     }
     return { client: id, label: t.label, path: p, installed, configuredBase, agent: await agentStatus(base, getToken(agentAccount(base, id))) };
   }));
   const legacy = await agentStatus(base, getToken(agentAccount(base)));
   return { keychain: backendName(), hasToken: !!legacy || configs.some((c) => c.agent), configs, legacy };
 }
+function pick2(kind, wanted, options, problems) {
+  const ids = [];
+  for (const w of wanted) {
+    const byId = options.find((o) => o.id === w);
+    const byName = options.filter((o) => o.name === w);
+    if (byId) ids.push(byId.id);
+    else if (byName.length === 1) ids.push(byName[0].id);
+    else if (byName.length > 1) problems.push(`${kind} name "${w}" matches ${byName.length} ${kind}s; use an id (${byName.map((o) => o.id).join(", ")})`);
+    else problems.push(`unknown ${kind}: ${w}`);
+  }
+  return [...new Set(ids)];
+}
+async function resolveResourceScope(base, userToken, vaults, connections) {
+  if (!vaults.length && !connections.length) return void 0;
+  const r = await api2(base, "/agents/scope-options", userToken);
+  if (r.status !== 200 || !r.body) throw new Error(`could not list the vaults and connections this account can reach (${r.status})`);
+  const problems = [];
+  const vault_ids = pick2("vault", vaults, r.body.vaults ?? [], problems);
+  const connection_ids = pick2("connection", connections, r.body.connections ?? [], problems);
+  if (problems.length) throw new Error(`${problems.join("; ")}. Nothing was minted.`);
+  return { ...vault_ids.length ? { vault_ids } : {}, ...connection_ids.length ? { connection_ids } : {} };
+}
+function describeScope(s) {
+  const v = s?.vault_ids?.length ?? 0;
+  const c = s?.connection_ids?.length ?? 0;
+  const parts = [
+    v ? `${v} vault(s): ${s.vault_ids.join(", ")}` : "all vaults its owner can reach",
+    c ? `${c} connection(s): ${s.connection_ids.join(", ")}` : "all connections its owner can reach"
+  ];
+  return parts.join("; ");
+}
+async function mintAgent(o) {
+  const m = await api2(o.base, "/agents", o.userToken, {
+    method: "POST",
+    body: JSON.stringify({
+      name: o.name,
+      purpose: o.purpose,
+      scopes: o.scopes,
+      ttl_minutes: o.ttlDays * 24 * 60,
+      egress_class: o.egressClass,
+      ...o.resourceScope ? { resource_scope: o.resourceScope } : {}
+    })
+  });
+  if (m.status === 402) throw new Error(`your plan does not allow another AI agent (${m.body?.feature ?? "agent_access"}). Revoke one or upgrade.`);
+  if (m.status === 403 && m.body?.error === "on_network_required") throw new Error("this organization requires AI agents to run on its own network. Re-run with --egress lan if the model is self-hosted.");
+  if (m.status !== 201) throw new Error(`could not mint an agent principal (${m.status}): ${JSON.stringify(m.body)}`);
+  if (!m.body?.token || !m.body.id) throw new ApiUnavailableError(m.status, m.body);
+  return { token: m.body.token, id: m.body.id, expires_at: m.body.expires_at, scopes: m.body.scopes };
+}
 
 // src/mcp.ts
 var MODERN = "2026-07-28";
@@ -37286,9 +37979,23 @@ function recoveryText(rec, s) {
     "A payment may still be due and your access may still be at risk \u2014 this is a display failure, not a resolved account."
   ].join("\n");
 }
+function modeString(mode, type) {
+  const lead = type === "dir" ? "d" : type === "link" ? "l" : "-";
+  return lead + [6, 3, 0].map((shift) => {
+    const bits = mode >> shift & 7;
+    return (bits & 4 ? "r" : "-") + (bits & 2 ? "w" : "-") + (bits & 1 ? "x" : "-");
+  }).join("");
+}
+function whoamiLines(user) {
+  const org = user.org_name ? `${user.org_name}${user.org_role ? ` (${user.org_role})` : ""}` : user.org_role ?? "none";
+  return `email  ${user.email}
+org    ${org}`;
+}
 
 // src/private-vault.ts
 init_define_KT_HUB_FILES();
+var import_fs5 = require("fs");
+var import_path5 = require("path");
 var PASSPHRASE_STDIN_FLAG = "vault-passphrase-stdin";
 var PrivateVaultError = class extends Error {
 };
@@ -37306,6 +38013,9 @@ There is no flag that takes the passphrase itself: a flag lands in shell history
   return io.ask("vault passphrase: ");
 }
 async function unlockForCommand(client, io) {
+  return (await unlockVault(client, io)).key;
+}
+async function unlockVault(client, io) {
   const passphrase = await readVaultPassphrase(io);
   if (!passphrase) throw new PrivateVaultError("no vault passphrase was given");
   let record;
@@ -37318,7 +38028,7 @@ async function unlockForCommand(client, io) {
     throw e;
   }
   try {
-    return await unlockVaultKey(record, passphrase);
+    return { key: await unlockVaultKey(record, passphrase), enrolledAt: record.created_at };
   } catch (e) {
     if (e instanceof VaultKeyError && e.code === "wrong_secret") throw new PrivateVaultError(PRIVATE_VAULT_COPY.wrongPassphrase);
     throw e;
@@ -37329,12 +38039,115 @@ async function openSealedItem(client, key, vaultId, credId) {
   if (!sealed) throw new PrivateVaultError("this item is No-reveal. Kutrion does not display, copy or export its value; it is still used to authenticate connections and integrations.");
   try {
     const opened = await openPrivateItem({ id: credential.id, vault_id: credential.vault_id }, sealed, key);
-    return { value: opened.value };
+    return { value: opened.value, notes: opened.notes };
   } catch (e) {
     if (e instanceof VaultKeyError) throw new PrivateVaultError("this item could not be opened with your vault key.");
     throw e;
   }
 }
+async function probeVaultCustody(client, vaultId) {
+  try {
+    return { private: true, key: (await client.getPrivateDataKey(vaultId)).key };
+  } catch (e) {
+    if (e instanceof ApiError && e.status === 409 && e.slug === "vault_not_private") return { private: false };
+    throw e;
+  }
+}
+var PrivateVaultMemory = class {
+  constructor(file) {
+    this.file = file;
+  }
+  read() {
+    try {
+      const parsed = JSON.parse((0, import_fs5.readFileSync)(this.file, "utf8"));
+      return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+    } catch {
+      return {};
+    }
+  }
+  seen(base, vaultId) {
+    const ids = this.read()[base];
+    return Array.isArray(ids) && ids.includes(vaultId);
+  }
+  remember(base, vaultId) {
+    const all = this.read();
+    const ids = Array.isArray(all[base]) ? all[base] : [];
+    if (ids.includes(vaultId)) return;
+    all[base] = [...ids, vaultId];
+    (0, import_fs5.mkdirSync)((0, import_path5.dirname)(this.file), { recursive: true, mode: 448 });
+    writeOwnerOnly(this.file, JSON.stringify(all, null, 2));
+  }
+};
+var custodyChangedMessage = (vaultId) => `the server now says vault ${vaultId} is not Private, but this CLI has seen it Private before. The server's answer changed, so nothing was read or sent. Check the vault in the web app before writing to it.`;
+var PASSPHRASE_STDIN_NOT_PRIVATE = `--${PASSPHRASE_STDIN_FLAG} was given, but this vault is not Private. Nothing was read from stdin or sent: drop --${PASSPHRASE_STDIN_FLAG} to write to a Connected vault.`;
+async function resolveVaultCustody(client, vaultId, opts2) {
+  const custody = await probeVaultCustody(client, vaultId);
+  if (custody.private) {
+    try {
+      opts2.memory.remember(opts2.base, vaultId);
+    } catch (e) {
+      console.error(`warning: could not record vault ${vaultId} as Private: ${e.message}`);
+    }
+    return custody;
+  }
+  if (opts2.memory.seen(opts2.base, vaultId)) throw new PrivateVaultError(custodyChangedMessage(vaultId));
+  if (opts2.passphraseStdin) throw new PrivateVaultError(PASSPHRASE_STDIN_NOT_PRIVATE);
+  return custody;
+}
+var dataKeyChanged = (e) => e instanceof ApiError && e.status === 409 && e.slug === "data_key_changed";
+async function createSealedItem(client, vault, vaultId, current, meta, plain) {
+  const id = crypto.randomUUID();
+  const attempt = async (k) => {
+    const { dataKey, key } = await privateItemDataKey(k, vault.key, vaultId, vault.enrolledAt);
+    const fields = await sealPrivateItem({ id, vault_id: vaultId }, plain, dataKey);
+    return client.createPrivateItem(vaultId, { ...meta, id, key, fields });
+  };
+  try {
+    try {
+      return await attempt(current);
+    } catch (e) {
+      if (!dataKeyChanged(e)) throw e;
+      return await attempt(e.body?.key ?? null);
+    }
+  } catch (e) {
+    if (e instanceof VaultKeyError) throw new PrivateVaultError(PRIVATE_VAULT_COPY.wrongPassphrase);
+    throw e;
+  }
+}
+async function updateSealedItem(client, vault, vaultId, credId, current, patch) {
+  const plain = {};
+  if (patch.value !== void 0) plain.value = patch.value;
+  if (patch.notes !== void 0) plain.notes = patch.notes.trim() ? patch.notes : null;
+  const meta = patch.name !== void 0 ? { name: patch.name } : {};
+  if (!Object.keys(plain).length) return client.updatePrivateItem(vaultId, credId, meta);
+  if (!vault) throw new PrivateVaultError("a Private item's value and notes can only be changed with the vault unlocked");
+  const sealUnder = async (keyId, wrap) => {
+    const dataKey = await unwrapVaultDataKey(wrap, vault.key, vaultId);
+    const fields = await sealPrivateItem({ id: credId, vault_id: vaultId }, plain, dataKey);
+    return client.updatePrivateItem(vaultId, credId, { ...meta, key_id: keyId, fields });
+  };
+  try {
+    if (current) {
+      try {
+        return await sealUnder(current.key_id, current.client_wrapped_data_key);
+      } catch (e) {
+        if (!dataKeyChanged(e)) throw e;
+      }
+    }
+    const { sealed } = await client.getPrivateItem(vaultId, credId);
+    if (!sealed) throw new PrivateVaultError("this item is No-reveal, so its value cannot be changed from here.");
+    return await sealUnder(sealed.key_id, sealed.client_wrapped_data_key);
+  } catch (e) {
+    if (e instanceof VaultKeyError) throw new PrivateVaultError("this item could not be sealed with your vault key.");
+    throw e;
+  }
+}
+function splitPassphraseAndValue(stdin) {
+  const nl = stdin.search(/\r?\n/);
+  if (nl < 0) throw new PrivateVaultError("stdin must carry the vault passphrase on its first line and the value after it");
+  return { passphrase: stdin.slice(0, nl), value: stdin.slice(nl).replace(/^\r?\n/, "") };
+}
+var PRIVATE_IMPORT_REFUSED = "this vault is Private, and kt import cannot seal an import yet: the export file is parsed by the server, which would see every value in it. Nothing has been sent. Add each item with `kt cred add --value-stdin`.";
 
 // src/enroll.ts
 init_define_KT_HUB_FILES();
@@ -37415,11 +38228,11 @@ function parsePurposes(v) {
   }
   return out.length ? out : { error: `--purposes is required: one or more of ${ENROLL_PURPOSES.join(", ")}` };
 }
-function parseConfirms(argv) {
+function parseConfirms(argv2) {
   const out = /* @__PURE__ */ new Map();
-  for (let i = 0; i < argv.length; i++) {
-    if (argv[i] !== "--confirm") continue;
-    const v = argv[i + 1];
+  for (let i = 0; i < argv2.length; i++) {
+    if (argv2[i] !== "--confirm") continue;
+    const v = argv2[i + 1];
     if (v === void 0 || v.startsWith("--")) return { error: "--confirm needs <connId|host>=<fingerprint>" };
     i++;
     for (const pair of v.split(",").map((s) => s.trim()).filter(Boolean)) {
@@ -37544,10 +38357,47 @@ function parseHostsUnconfirmed(body) {
   return { count: typeof b.unconfirmedCount === "number" ? b.unconfirmedCount : hosts.length, hosts };
 }
 
+// src/exec-stdin.ts
+init_define_KT_HUB_FILES();
+var EXEC_STDIN_MAX_BYTES = 8 * 1024 * 1024;
+var StdinTooLargeError = class extends Error {
+  constructor(maxBytes) {
+    super(`stdin is larger than the ${maxBytes} byte limit for kt exec; nothing was sent. Copy larger input over SFTP instead.`);
+    this.maxBytes = maxBytes;
+  }
+};
+async function readExecStdin(input, maxBytes = EXEC_STDIN_MAX_BYTES) {
+  const chunks = [];
+  let total = 0;
+  for await (const c of input) {
+    const b = Buffer.isBuffer(c) ? c : Buffer.from(c);
+    total += b.length;
+    if (total > maxBytes) throw new StdinTooLargeError(maxBytes);
+    chunks.push(b);
+  }
+  return total ? Buffer.concat(chunks) : void 0;
+}
+async function serverTakesExecStdin(base, fetchImpl = fetch) {
+  try {
+    const res = await fetchImpl(`${base.replace(/\/+$/, "")}/health`, { redirect: "error", signal: AbortSignal.timeout(HEALTH_TIMEOUT_MS) });
+    return (res.headers.get("kutrion-features") ?? "").split(",").some((v) => v.trim().toLowerCase() === "exec-stdin");
+  } catch (e) {
+    if (e instanceof Error && (e.name === "TimeoutError" || e.name === "AbortError")) throw new ExecStdinCheckTimedOut();
+    return false;
+  }
+}
+var HEALTH_TIMEOUT_MS = 1e4;
+var ExecStdinCheckTimedOut = class extends Error {
+  constructor() {
+    super("error: the check for kt exec --stdin support timed out; nothing was run");
+  }
+};
+var STDIN_UNSUPPORTED = "error: this server does not support kt exec --stdin (it predates stdin support); nothing was run";
+
 // src/transfer.ts
 init_define_KT_HUB_FILES();
-var import_fs4 = require("fs");
-var import_path5 = require("path");
+var import_fs6 = require("fs");
+var import_path6 = require("path");
 var import_promises = require("stream/promises");
 var EXIT_OK = 0;
 var EXIT_FAIL = 1;
@@ -37574,7 +38424,7 @@ function isSideError(s) {
 var listOn = (c, k, id, p) => k === "sftp" ? c.sftpList(id, p) : c.fileList(id, p);
 var mkdirOn = (c, k, id, p) => k === "sftp" ? c.sftpMkdir(id, p) : c.fileMkdir(id, p);
 var downloadOn = (c, k, id, p, o) => k === "sftp" ? c.sftpDownloadStream(id, p, o) : c.fileDownloadStream(id, p, o);
-var uploadOn = (c, k, id, p, b) => k === "sftp" ? c.sftpUploadStream(id, p, b) : c.fileUploadStream(id, p, b);
+var uploadOn = (c, k, id, p, src) => k === "sftp" ? c.sftpUploadResumable(id, p, src) : c.fileUploadResumable(id, p, src);
 var abortOnHostKey = (e) => {
   if (hostKeyUnconfirmedFromError(e)) throw e;
 };
@@ -37620,6 +38470,8 @@ function exitFor(o) {
   return o.ok > 0 ? EXIT_PARTIAL : EXIT_FAIL;
 }
 var msg = (e) => e instanceof Error ? e.message : String(e);
+async function* emptyChunks() {
+}
 async function* counted(chunks, p, tally) {
   for await (const c of chunks) {
     tally.bytes += c.byteLength;
@@ -37633,15 +38485,15 @@ async function saveTo(s, local, append, p) {
     await (0, import_promises.pipeline)(counted(s.chunks, p, tally), process.stdout, { end: false });
     return tally.bytes;
   }
-  const dir = (0, import_path5.dirname)(local);
-  if (dir && dir !== "." && !(0, import_fs4.existsSync)(dir)) (0, import_fs4.mkdirSync)(dir, { recursive: true });
-  await (0, import_promises.pipeline)(counted(s.chunks, p, tally), (0, import_fs4.createWriteStream)(local, append ? { flags: "a" } : {}));
+  const dir = (0, import_path6.dirname)(local);
+  if (dir && dir !== "." && !(0, import_fs6.existsSync)(dir)) (0, import_fs6.mkdirSync)(dir, { recursive: true });
+  await (0, import_promises.pipeline)(counted(s.chunks, p, tally), (0, import_fs6.createWriteStream)(local, append ? { flags: "a" } : {}));
   return tally.bytes;
 }
 async function getOne(c, kind, id, remote, local, opts2) {
   let start = 0;
-  if (opts2.resume && local !== "-" && (0, import_fs4.existsSync)(local)) {
-    const st = (0, import_fs4.statSync)(local);
+  if (opts2.resume && local !== "-" && (0, import_fs6.existsSync)(local)) {
+    const st = (0, import_fs6.statSync)(local);
     if (st.isFile()) start = st.size;
   }
   let s;
@@ -37664,7 +38516,7 @@ async function getOne(c, kind, id, remote, local, opts2) {
     opts2.note?.(`${remote}: server ignored the resume range, downloading from the start`);
     start = 0;
   }
-  const p = opts2.quiet ? NO_PROGRESS : progressBar((0, import_path5.basename)(remote) || remote, s.total);
+  const p = opts2.quiet ? NO_PROGRESS : progressBar((0, import_path6.basename)(remote) || remote, s.total);
   const bytes = await saveTo(s, local, start > 0, p);
   p.finish();
   return { bytes };
@@ -37716,13 +38568,13 @@ async function getPath(c, kind, id, remote, local, opts2 = {}) {
     return out;
   }
   for await (const item of walkRemote(c, kind, id, remote)) {
-    const dest = (0, import_path5.join)(local, item.rel);
+    const dest = (0, import_path6.join)(local, item.rel);
     if (item.link) {
       opts2.note?.(`skipped symlink ${item.path}`);
       continue;
     }
     if (item.dir) {
-      (0, import_fs4.mkdirSync)(dest, { recursive: true });
+      (0, import_fs6.mkdirSync)(dest, { recursive: true });
       continue;
     }
     try {
@@ -37738,8 +38590,8 @@ async function getPath(c, kind, id, remote, local, opts2 = {}) {
   return out;
 }
 function* walkLocal(root, rel = "") {
-  for (const e of (0, import_fs4.readdirSync)(root, { withFileTypes: true })) {
-    const abs = (0, import_path5.join)(root, e.name);
+  for (const e of (0, import_fs6.readdirSync)(root, { withFileTypes: true })) {
+    const abs = (0, import_path6.join)(root, e.name);
     const r = rel ? `${rel}/${e.name}` : e.name;
     if (e.isSymbolicLink()) continue;
     if (e.isDirectory()) {
@@ -37751,18 +38603,21 @@ function* walkLocal(root, rel = "") {
   }
 }
 async function putOne(c, kind, id, local, remote, opts2) {
-  const total = (0, import_fs4.statSync)(local).size;
-  await c.preflightUpload?.(total);
-  const p = opts2.quiet ? NO_PROGRESS : progressBar((0, import_path5.basename)(local), total);
+  const total = (0, import_fs6.statSync)(local).size;
+  const p = opts2.quiet ? NO_PROGRESS : progressBar((0, import_path6.basename)(local), total);
   const tally = { bytes: 0 };
-  const r = await uploadOn(c, kind, id, remote, counted((0, import_fs4.createReadStream)(local), p, tally));
+  const source = {
+    size: total,
+    slice: (start, end) => counted(end > start ? (0, import_fs6.createReadStream)(local, { start, end: end - 1 }) : emptyChunks(), p, tally)
+  };
+  const r = await uploadOn(c, kind, id, remote, source);
   p.finish();
   if (!r.streamed) opts2.note?.(`${local}: this runtime could not stream the request body, the file was buffered`);
   return r.size ?? tally.bytes;
 }
 async function putPath(c, kind, id, local, remote, opts2 = {}) {
   const out = empty();
-  const st = (0, import_fs4.existsSync)(local) ? (0, import_fs4.statSync)(local) : null;
+  const st = (0, import_fs6.existsSync)(local) ? (0, import_fs6.statSync)(local) : null;
   if (!st) {
     out.failed++;
     out.errors.push(`${local}: no such file`);
@@ -37795,7 +38650,7 @@ async function putPath(c, kind, id, local, remote, opts2 = {}) {
       }
       continue;
     }
-    const parent = (0, import_path5.dirname)(dest);
+    const parent = (0, import_path6.dirname)(dest);
     if (!made.has(parent)) {
       try {
         await mkdirOn(c, kind, id, parent);
@@ -37814,13 +38669,32 @@ async function putPath(c, kind, id, local, remote, opts2 = {}) {
   }
   return out;
 }
+var JOB_TERMINAL = /* @__PURE__ */ new Set(["succeeded", "failed", "canceled"]);
+function transientPollError(e) {
+  const status = e?.status;
+  if (typeof status === "number") return status >= 500 || e.name === "ApiUnavailableError";
+  return unreachedApi(e);
+}
+function unreachedApi(e) {
+  if (e?.name === "ApiUnavailableError") return true;
+  if (typeof e?.status === "number") return false;
+  return e instanceof TypeError || e instanceof Error && /timed out|aborted|ECONN|ENOTFOUND|EAI_AGAIN|socket|fetch failed/i.test(e.message);
+}
 async function waitForJob(get, id, opts2) {
   const interval = opts2.intervalMs ?? 2e3;
   const deadline = Date.now() + opts2.timeoutMs;
   for (; ; ) {
-    const { job } = await get(id);
-    opts2.onTick?.(job);
-    if (job.status === "succeeded" || job.status === "failed") return job;
+    let job;
+    try {
+      ({ job } = await get(id));
+    } catch (e) {
+      if (!transientPollError(e)) throw e;
+      opts2.onRetry?.(e);
+    }
+    if (job) {
+      opts2.onTick?.(job);
+      if (JOB_TERMINAL.has(job.status)) return job;
+    }
     if (Date.now() + interval > deadline) return null;
     await new Promise((r) => setTimeout(r, interval));
   }
@@ -37834,11 +38708,12 @@ function parseDailyAt(v) {
 }
 
 // src/index.ts
-var CONFIG = (0, import_path6.join)((0, import_os5.homedir)(), ".config", "kutrion", "config.json");
+var CONFIG = (0, import_path7.join)((0, import_os5.homedir)(), ".config", "kutrion", "config.json");
+var PRIVATE_VAULTS = new PrivateVaultMemory((0, import_path7.join)((0, import_os5.homedir)(), ".config", "kutrion", "private-vaults.json"));
 function storedBase() {
   let file;
   try {
-    file = JSON.parse((0, import_fs5.readFileSync)(CONFIG, "utf8"));
+    file = JSON.parse((0, import_fs7.readFileSync)(CONFIG, "utf8"));
   } catch {
     return "";
   }
@@ -37856,9 +38731,17 @@ function storedBase() {
   }
   return base;
 }
-function saveCfg(base) {
-  (0, import_fs5.mkdirSync)((0, import_path6.dirname)(CONFIG), { recursive: true });
-  (0, import_fs5.writeFileSync)(CONFIG, JSON.stringify({ base }, null, 2));
+function saveCfg(base, fallbacks = readFallbacks(CONFIG, base)) {
+  (0, import_fs7.mkdirSync)((0, import_path7.dirname)(CONFIG), { recursive: true });
+  (0, import_fs7.writeFileSync)(CONFIG, JSON.stringify({ base, ...fallbacks.length ? { fallbacks } : {} }, null, 2));
+}
+var fallbackInstalled = false;
+function installBaseFallback(base) {
+  if (fallbackInstalled) return;
+  const list = readFallbacks(CONFIG, base);
+  if (!list.length) return;
+  fallbackInstalled = true;
+  globalThis.fetch = fallbackFetch(globalThis.fetch, base, list);
 }
 function resolveBase(flag) {
   const explicit = typeof flag === "string" ? flag.trim() : "";
@@ -38005,16 +38888,38 @@ async function readStdin() {
 function readSecret(q) {
   return process.stdin.isTTY ? prompt(q, true) : readStdin();
 }
+var EMPTY_VALUE_MESSAGE = "The credential value is empty, so nothing was sent. Pipe one in with --value-stdin, or leave the flag off and type it at the prompt.";
 async function openPrivateItem2(client, fromStdin, vaultId, credId) {
   try {
     const key = await unlockForCommand(client, { tty: !!process.stdin.isTTY, fromStdin, ask: promptSecret, readStdin });
-    console.log((await openSealedItem(client, key, vaultId, credId)).value);
+    const item = await openSealedItem(client, key, vaultId, credId);
+    console.log(item.value);
+    if (item.notes) console.error(`notes: ${item.notes}`);
     return null;
   } catch (e) {
     if (e instanceof PrivateVaultError) return e.message;
     throw e;
   }
 }
+async function unlockForSealedWrite(client, flags, needValue) {
+  const passStdin = flags[PASSPHRASE_STDIN_FLAG] === true, valueStdin = flags["value-stdin"] === true;
+  const io = { tty: !!process.stdin.isTTY, fromStdin: passStdin, ask: promptSecret, readStdin };
+  if (passStdin && needValue) {
+    if (!valueStdin) throw new PrivateVaultError(`with --${PASSPHRASE_STDIN_FLAG}, pipe the value too with --value-stdin: stdin carries the passphrase on its first line and the value after it`);
+    const piped = splitPassphraseAndValue(await readStdin());
+    if (piped.value === "") throw new PrivateVaultError(EMPTY_VALUE_MESSAGE);
+    return { vault: await unlockVault(client, { ...io, readStdin: async () => piped.passphrase }), value: piped.value };
+  }
+  const vault = await unlockVault(client, io);
+  if (!needValue) return { vault };
+  const value = valueStdin ? await readSecret("value: ") : await prompt("value: ", true);
+  if (value === "") throw new PrivateVaultError(EMPTY_VALUE_MESSAGE);
+  return { vault, value };
+}
+var WATCHER_EVERY_MIN = 60;
+var WATCHER_EVERY_MAX = 86400;
+var WATCHER_PATTERN_MAX = 256;
+var withNotesMarker = (c, notes) => notes === void 0 ? c : { ...c, has_notes: notes.length > 0, notes_length: notes.length };
 function refuseSecretFlag(flag, instead) {
   console.error(`error: --${flag} is not accepted: it puts a credential on the command line, where shell history and the process list keep it.`);
   console.error(`  ${instead}`);
@@ -38089,12 +38994,12 @@ async function credDest(client, args, flags, asJson, die) {
     const secret = await promptSecret(`current value for "${name}": `);
     let added;
     try {
-      added = await client.addCredentialDestination(vaultId, cid, {
+      added = await withStepUp(client, () => client.addCredentialDestination(vaultId, cid, {
         protocol: group.key,
         host: host2,
         ...portGiven ? { port } : {},
         secret
-      });
+      }));
     } catch (e) {
       const text2 = destRefusalText(e);
       if (text2) return die(text2);
@@ -38117,24 +39022,24 @@ async function credDest(client, args, flags, asJson, die) {
     const group = groupFor(row.protocol);
     if (!group) return die(`this destination is recorded on protocol ${row.protocol}, which this version of kt cannot withdraw`);
     const inGroup = entriesFor(group, before.destinations);
-    const entry = inGroup.find((x) => x.rows.some((r) => r.id === destId));
-    if (!entry) return die(`no destination ${destId} on "${name}"`);
+    const entry2 = inGroup.find((x) => x.rows.some((r) => r.id === destId));
+    if (!entry2) return die(`no destination ${destId} on "${name}"`);
     const sameGroupRows = inGroup.reduce((n, x) => n + x.rows.length, 0);
-    for (const line of removalWarning(name, group, entry, before.destinations.length - entry.rows.length, sameGroupRows - entry.rows.length)) {
+    for (const line of removalWarning(name, group, entry2, before.destinations.length - entry2.rows.length, sameGroupRows - entry2.rows.length)) {
       console.error(line);
     }
     console.error("");
     if (!await confirmTyped("Type yes to withdraw it: ")) return die("nothing was changed");
     const secret = await promptSecret(`current value for "${name}": `);
     const gone = [];
-    for (const r of entry.rows) {
+    for (const r of entry2.rows) {
       try {
-        await client.removeCredentialDestination(vaultId, cid, r.id, secret);
+        await withStepUp(client, () => client.removeCredentialDestination(vaultId, cid, r.id, secret));
         gone.push(r.protocol);
       } catch (e) {
         if (gone.length) {
-          const left = entry.rows.filter((x) => !gone.includes(x.protocol)).map((x) => PROTOCOL_LABEL[x.protocol]).join(" and ");
-          console.error(`Only part of this destination was withdrawn. ${gone.map((pr) => PROTOCOL_LABEL[pr]).join(" and ")} at ${entry.host}:${entry.port} is no longer authorized; ${left} still is. Run the command again.`);
+          const left = entry2.rows.filter((x) => !gone.includes(x.protocol)).map((x) => PROTOCOL_LABEL[x.protocol]).join(" and ");
+          console.error(`Only part of this destination was withdrawn. ${gone.map((pr) => PROTOCOL_LABEL[pr]).join(" and ")} at ${entry2.host}:${entry2.port} is no longer authorized; ${left} still is. Run the command again.`);
         }
         const text2 = destRefusalText(e);
         if (text2) return die(text2);
@@ -38143,7 +39048,7 @@ async function credDest(client, args, flags, asJson, die) {
     }
     const after = await list();
     if (!asJson) {
-      console.log(after.destinations.length === 0 ? `"${name}" is no longer restricted. It is accepted at any host on any protocol again.` : `withdrew ${entry.host}:${entry.port}`);
+      console.log(after.destinations.length === 0 ? `"${name}" is no longer restricted. It is accepted at any host on any protocol again.` : `withdrew ${entry2.host}:${entry2.port}`);
       console.log("");
     }
     return void await printList();
@@ -38155,10 +39060,37 @@ var ROLES = ["OWNER", "ADMIN", "EDITOR", "VIEWER"];
 var TOKEN_SCOPES = ["scim", "events"];
 var ORG_ROLES = ["owner", "admin", "member"];
 var ROTATION_SERVICES = ["linux_password", "postgres_password", "mysql_password"];
-var VERSION = true ? "1.2.12" : "dev";
+var VERSION = true ? "1.2.16" : "dev";
+var CMD_HELP = {
+  "ci-login": `kt ci-login --trust <id>
+
+Exchange this CI job's own OIDC token for a short-lived agent and print its token on stdout. Nothing
+is stored: export it as KT_AGENT_TOKEN for \`kt run\`.
+
+The token comes from KT_ID_TOKEN (GitLab id_tokens) or the GitHub Actions token service. The trust
+named by --trust (or KT_OIDC_TRUST_ID) accepts it only when all three claims match what was registered:
+  iss   the issuer: the CI instance URL, for example https://gitlab.example.com
+  aud   the audience: the aud your id_tokens block (or GitHub audience) requests
+  sub   the subject: matched against the trust's pattern, which names the project and optionally the ref
+        (GitLab: project_path:group/repo:ref_type:branch:ref:main)
+
+An org owner or admin registers a trust with \`kt trust add\`.
+Flags: --trust <id>, --json (print the whole exchange result instead of only the token).`,
+  trust: `kt trust add --issuer <url> --audience <aud> --subject <pattern> --vault <id> [--vault <id> ..]
+         [--name <n>] [--scopes vault.list,vault.use] [--egress lan|cloud] [--ttl <min>]
+kt trust ls
+kt trust rm <id>
+
+A trust is the rule \`kt ci-login\` checks a CI job's OIDC token against: issuer, audience and subject
+pattern. --vault is required and repeatable: a trust reaches only the vaults named, never the whole
+organization. Org owners and admins only; granting vault.reveal or write scopes asks for step-up.
+--egress defaults to lan (output stays on the local network); pass --egress cloud to allow cloud AI.
+A subject pattern that matches every project is refused.`
+};
 var HELP = `kt \u2014 Kutrion CLI
   kt login [--email <e>] [--password-stdin] [--code <2fa>]   prompts for the password, or reads it from stdin;
-                                               at a terminal with no --email, first asks the Kutrion desktop app,
+                                               with no --email or --password-stdin, first asks the Kutrion desktop app
+                                               (without a terminal, only one this CLI has already paired with),
                                                then falls back to your email and password;
                                                at the emailed-code prompt, a blank entry or r sends a new code
   kt login --browser                           not available; exits with an error
@@ -38172,8 +39104,10 @@ var HELP = `kt \u2014 Kutrion CLI
 
   kt creds <vaultId>                           list credentials in a vault
   kt get <vaultId> <credId> [--reveal] [--vault-passphrase-stdin]   show a credential (the value only with --reveal); a Private vault asks for its passphrase
-  kt cred add <vaultId> --name <n> [--value-stdin] [--type PASSWORD] [--notes ..]   prompts for the value, or reads it from stdin
-  kt cred set <vaultId> <credId> [--name ..] [--value-stdin] [--notes ..]
+  kt cred add <vaultId> --name <n> [--value-stdin] [--vault-passphrase-stdin] [--type PASSWORD] [--notes ..]   prompts for the value, or reads it from stdin
+  kt cred set <vaultId> <credId> [--name ..] [--value-stdin] [--vault-passphrase-stdin] [--notes ..]
+                                               in a Private vault the value and notes are sealed here; with both
+                                               stdin flags, stdin is the passphrase line, then the value
   kt cred rm <vaultId> <credId>                delete a credential
   kt cred dest ls <vaultId> <credId>           where this credential may be presented
   kt cred dest add <vaultId> <credId> --host <h> [--protocol SSH] [--port N]
@@ -38183,10 +39117,30 @@ var HELP = `kt \u2014 Kutrion CLI
   kt export <vaultId> [file]                   export a vault's credentials (plaintext, written mode 0600)
 
   kt mcp install --client <id> [--egress lan]  connect an AI client (claude-code|claude-desktop|cursor|copilot)
+      [--vault <id|name>]... [--connection <id>]...   limit the agent to these vaults/connections (repeatable;
+                                               none given = everything its owner can reach; unknown names refuse before minting)
+  kt agent mint [--scope-vault <id|name>]... [--scope-conn <id>]... [--write-env <file>]
+                                               mint an agent for a server install; --write-env writes
+                                               KT_AGENT_TOKEN/KT_API_BASE to a 0600 file and never prints the token
   kt mcp status                                report each client's agent and which clients are wired
   kt mcp uninstall [--client <id>]             revoke the agent and remove the client config entry
   kt mcp                                       serve MCP over stdio (what the client config invokes)
+  kt config set base-fallback <url>[,<url>...] [--allow-insecure-lan]
+                                               other addresses for the same server, tried in order only when the
+                                               primary cannot be reached (connection failure or a 52x from the edge,
+                                               never an HTTP error from the API). Must be https unless the base is
+                                               opted in with --allow-insecure-lan, which warns on stderr per request.
+                                               Tokens carry no host or issuer claim (HS256 against the deployment's
+                                               signing key), so any address reaching the SAME deployment accepts them and
+                                               refresh follows whichever base answers; a different deployment refuses
+                                               them. Websocket sessions (shell, forward) do not fall back.
+  kt config get|unset base-fallback            show or clear that list
   kt ci-login --trust <id>                     exchange this CI job's OIDC token for an agent (no stored credential)
+  kt trust add --issuer <url> --audience <aud> --subject <pattern> --vault <id> [--vault <id> ..]
+                                               register the CI identity ci-login accepts (org owner or admin)
+    [--name <n>] [--scopes vault.list,vault.use] [--egress lan|cloud] [--ttl <min>]
+  kt trust ls                                  list the registered trusts
+  kt trust rm <id>                             revoke a trust (no new exchange; issued agents run out their lifetime)
 
   kt conns                                     list SSH connections
   kt ssh <connId>                              interactive SSH shell (Ctrl-] to detach)
@@ -38198,7 +39152,10 @@ var HELP = `kt \u2014 Kutrion CLI
                                                --insert places it at the prompt without pressing Enter
   kt demo [start]                              brokered sandbox session, then the audit trail + AI summary
   kt demo status | reset                       demo availability / remove everything it provisioned
-  kt exec <connId> <command...>                run one command via the audited broker
+  kt exec <connId> [--stdin] [--] <command...> run one command via the audited broker; --stdin sends
+                                               this process's stdin (up to 8 MiB) to the command, never
+                                               to its argv. Without it stdin is not read. kt's flags end at the
+                                               connId (or the first --); the rest goes to the remote verbatim
   kt forward <connId> <localPort>:<dstHost>:<dstPort>   (ssh -L style tunnel)
 
   kt sftp ls <connId> [path]                   list a remote directory
@@ -38225,7 +39182,8 @@ var HELP = `kt \u2014 Kutrion CLI
   A "side" below is written <sftp|file|cloud>:<connId>:<path> \u2014 one argument for one endpoint.
 
   kt transfer <from> <to> [--dir]              remote-to-remote, brokered by the server
-    [--conflict overwrite|skip|rename] [--throttle <bytes/sec>]
+    [--conflict overwrite|skip|rename] [--throttle <bytes/sec>] [--timeout <sec>]
+                                               a <to> with no trailing slash whose parent exists names the file
   kt sync <from> <to> [--newer-only]           directory sync
     [--mirror] [--yes] [--dry-run]             --mirror DELETES extra files at the destination
 
@@ -38234,6 +39192,7 @@ var HELP = `kt \u2014 Kutrion CLI
   kt job new <from> <to> [--wait]              queue a job (--wait polls to completion)
     [--dir] [--verify] [--throttle N] [--newer-only] [--mirror --yes] [--timeout <sec>]
   kt job wait <id> [--timeout <sec>]           poll an existing job
+  kt job cancel <id>                           cancel a queued or running job
 
   kt schedule [ls]                             recurring transfers
   kt schedule new <name> <from> <to>           --every <sec> or --daily-at HH:MM (UTC)
@@ -38242,6 +39201,7 @@ var HELP = `kt \u2014 Kutrion CLI
 
   kt watcher [ls]                              folder watchers (fire on new/changed files)
   kt watcher new <name> <source> <dest>        [--pattern <glob>] [--every <sec>]
+    --every is 60..86400 seconds (default 300); --pattern is a filename glob (* and ?), up to 256 characters, matched on the name only
     [--min-size N] [--max-size N] [--min-age <sec>] [--no-stability]
   kt watcher enable|disable|rm <id>            pause / resume / delete a watcher
 
@@ -38356,7 +39316,7 @@ var HELP = `kt \u2014 Kutrion CLI
     [--reporter console|junit|json] [--out <file>] [--dry-run]
     with KT_AGENT_TOKEN set, runs as that pipeline principal over /mcp
 
-  kt history [query] [--limit N]               searchable command history
+  kt history [query] [--limit N]               searchable history of brokered exec commands, such as kt exec; not shell input
     [--session <id>] [--host <connection id>] [--since <iso>] [--until <iso>]
   kt news                                      security news feed
 
@@ -38376,6 +39336,7 @@ var HELP = `kt \u2014 Kutrion CLI
   kt mfa verify --code <code>                  finish TOTP enrollment
   kt mfa disable                               turn off TOTP
   kt mfa backup-codes                          regenerate backup codes
+  kt step-up                                   prove app-MFA now (code is prompted), then re-run the refused command
   kt passkeys                                  registered passkeys / security keys
   kt passkey rm <id>                           remove a passkey
 
@@ -38472,14 +39433,46 @@ function runForward(base, token, connId, spec, ctx = {}) {
     console.log(`forwarding 127.0.0.1:${localPort} -> ${dstHost}:${dstPort} via ${connId}  (Ctrl-C to stop)`);
   });
 }
+function hubCallFor(base) {
+  return async (method, path, body, bearer) => {
+    try {
+      const res = await refuseBodyRedirects()(base + path, {
+        method,
+        headers: { Authorization: `Bearer ${bearer}`, Accept: "application/json", ...body === void 0 ? {} : { "Content-Type": "application/json" } },
+        body: body === void 0 ? void 0 : JSON.stringify(body),
+        signal: AbortSignal.timeout(15e3)
+      });
+      return { ok: res.ok, status: res.status, data: res.ok ? await res.json().catch(() => null) : null };
+    } catch {
+      return { ok: false, status: null, data: null };
+    }
+  };
+}
+var OWN_SIGN_IN = /* @__PURE__ */ new Set(["login", "logout", "mcp", "ci-login", "run", "enroll", "share-redeem", "help", "--help", "-h"]);
+var SESSION_REFUSED = /* @__PURE__ */ new Set(["unauthorized", "session_signed_out"]);
+var sessionWrites = trackWrites(refuseBodyRedirects());
+function refusedSavedSession(e, argv2) {
+  if (!(e instanceof ApiError) || e.status !== 401 || !SESSION_REFUSED.has(refusalCode(e)) || OWN_SIGN_IN.has(argv2.cmd)) return false;
+  if (Object.entries(argv2.flags).some(([k, v]) => k.endsWith("-stdin") && v === true)) return false;
+  const base = resolveBase(argv2.flags.base);
+  try {
+    return Boolean(base && getToken(base));
+  } catch {
+    return false;
+  }
+}
 async function main() {
-  const { cmd, positionals, flags } = parseArgs(process.argv.slice(2));
+  const { cmd, positionals, flags, multi } = parseArgs(process.argv.slice(2));
   const asJson = flags.json === true;
   const die = (msg2) => {
     console.error(msg2);
     process.exit(1);
   };
   const unknown = unknownFlags(flags);
+  if (flags.help === true && cmd !== "help") {
+    console.log(CMD_HELP[cmd] ?? HELP);
+    return;
+  }
   if (unknown.length) die(`unknown flag: ${unknown.map((f) => `--${f}`).join(", ")}
 run \`kt --help\` for the flags each command takes`);
   if (cmd === "--version" || cmd === "-v" || cmd === "version") {
@@ -38490,6 +39483,7 @@ run \`kt --help\` for the flags each command takes`);
   const configured = resolveBase(flags.base);
   if (!configured && !offlineLint && cmd !== "help" && cmd !== "--help" && cmd !== "-h") die(NO_BASE);
   const cfg = { base: configured };
+  if (!offlineLint && configured) installBaseFallback(configured);
   let issued;
   let signedThisRun = false;
   const ensureRefreshKeyBound = async () => {
@@ -38515,8 +39509,11 @@ run \`kt --help\` for the flags each command takes`);
     });
     if (outcome !== "failed" && borrowedDevice(cfg.base, kcSlots)?.id === dev.id) settleRefreshBind(cfg.base, kcSlots, dev.id);
   };
+  const longCall = cmd === "transfer" || cmd === "sync";
+  const longTimeoutSec = Number(flags.timeout);
   const client = new KutrionClient({
     baseUrl: cfg.base,
+    ...longCall ? { timeoutMs: (Number.isFinite(longTimeoutSec) && longTimeoutSec > 0 ? longTimeoutSec : 6 * 3600) * 1e3 } : {},
     getToken: () => getToken(cfg.base),
     onToken: (t) => {
       issued = t || void 0;
@@ -38527,7 +39524,7 @@ run \`kt --help\` for the flags each command takes`);
     // blank User-Agent it never set. Relaxing only, and never required — an older CLI that omits it
     // is treated exactly as it is today.
     client: "cli",
-    fetchImpl: refuseBodyRedirects(),
+    fetchImpl: sessionWrites.fetch,
     // #2984: only a hub borrow leaves a refresh token, in the OS keychain beside the access token.
     getRefreshToken: () => {
       try {
@@ -38562,17 +39559,13 @@ run \`kt --help\` for the flags each command takes`);
     }
   });
   const kc = { get: getToken, set: setToken, clear: clearToken };
-  const hubCall = async (method, path, body, bearer) => {
+  const hubCall = hubCallFor(cfg.base);
+  const vaultCustody = async (vaultId) => {
     try {
-      const res = await refuseBodyRedirects()(cfg.base + path, {
-        method,
-        headers: { Authorization: `Bearer ${bearer}`, Accept: "application/json", ...body === void 0 ? {} : { "Content-Type": "application/json" } },
-        body: body === void 0 ? void 0 : JSON.stringify(body),
-        signal: AbortSignal.timeout(15e3)
-      });
-      return { ok: res.ok, status: res.status, data: res.ok ? await res.json().catch(() => null) : null };
-    } catch {
-      return { ok: false, status: null, data: null };
+      return await resolveVaultCustody(client, vaultId, { base: cfg.base, memory: PRIVATE_VAULTS, passphraseStdin: flags[PASSPHRASE_STDIN_FLAG] === true });
+    } catch (e) {
+      if (e instanceof PrivateVaultError) return die(e.message);
+      throw e;
     }
   };
   const connectionContext = async (connId) => {
@@ -38650,6 +39643,10 @@ run \`kt --help\` for the flags each command takes`);
       timeoutMs: (intFlag("timeout") ?? 3600) * 1e3,
       onTick: (j) => {
         if (ticker) process.stderr.write(`\r${j.status} \u2014 ${j.files} file(s), ${fmtBytes(j.bytes)}   `);
+      },
+      onRetry: (e) => {
+        if (!asJson) process.stderr.write(`${ticker ? "\n" : ""}could not reach the server (${e instanceof Error ? e.message : String(e)}); still waiting
+`);
       }
     });
     if (ticker) process.stderr.write("\n");
@@ -38659,8 +39656,8 @@ run \`kt --help\` for the flags each command takes`);
       process.exit(EXIT_UNKNOWN);
     }
     show(job);
-    if (job.status === "failed") {
-      if (!asJson) console.error(`job failed: ${job.error ?? "no reason given"}`);
+    if (job.status === "failed" || job.status === "canceled") {
+      if (!asJson) console.error(`job ${job.status}: ${job.error ?? "no reason given"}`);
       process.exit(EXIT_FAIL);
     }
     process.exit(EXIT_OK);
@@ -38684,7 +39681,8 @@ run \`kt --help\` for the flags each command takes`);
         console.error("kt login --browser is not available: browser sign-in is switched off. Sign in with the Kutrion app (`kt login`), or use `kt login --email <email> --password-stdin`.");
         process.exit(EXIT_ERROR);
       }
-      if (process.stdin.isTTY && flags.email === void 0 && !fromStdin && flags.code === void 0 && accountRoot) {
+      const tty = canPromptYes(process.stdin, process.stderr);
+      if (accountRoot && loginTriesHub(flags, accountRoot)) {
         const hub = await hubLogin({
           base: cfg.base,
           location: hubLocation(accountRoot),
@@ -38692,7 +39690,8 @@ run \`kt --help\` for the flags each command takes`);
           keychainAvailable: osKeychainAvailable,
           call: hubCall,
           out: (l) => console.error(l),
-          ask: (q) => promptLine(q)
+          ask: (q) => promptLine(q),
+          pairedOnly: !tty
         });
         if (hub.kind === "store_failed") die(hub.note);
         if (hub.kind === "signed_in") {
@@ -38702,7 +39701,7 @@ run \`kt --help\` for the flags each command takes`);
           break;
         }
         if (hub.note) console.error(hub.note);
-        if (hubAbsent(hub.reason)) console.error("Installing the Kutrion app... Run `kt login` again once it is open, or sign in with your email and password below.");
+        if (tty && hubAbsent(hub.reason)) console.error("Installing the Kutrion app... Run `kt login` again once it is open, or sign in with your email and password below.");
       }
       if (flags.email === void 0 && !fromStdin) {
         const hint = otherAppsHint(accountRoot);
@@ -38744,7 +39743,6 @@ run \`kt --help\` for the flags each command takes`);
         process.exit(1);
       }
       const staleDevice = dropBorrowed(cfg.base, kc);
-      if (staleDevice) await client.revokeDevice(staleDevice).catch(() => void 0);
       const post = fetchPost(cfg.base, refuseBodyRedirects());
       const registered = await registerOwnDevice({
         base: cfg.base,
@@ -38759,9 +39757,12 @@ run \`kt --help\` for the flags each command takes`);
           } catch {
             return null;
           }
-        })()
+        })(),
+        previousDeviceId: staleDevice
       }).catch(() => ({ kind: "skipped", note: null }));
+      if (staleDevice) await client.revokeDevice(staleDevice).catch(() => void 0);
       recordSignIn(accountRoot, signedIn);
+      recordLastAccountId(cfg.base, kc, signedIn);
       console.log(`logged in (token stored in ${backendName()})`);
       if (rememberBase(cfg.base)) console.log(`server saved: ${cfg.base} (later commands need no --base)`);
       if (registered.kind === "skipped" && registered.note) console.error(registered.note);
@@ -38790,7 +39791,10 @@ run \`kt --help\` for the flags each command takes`);
       break;
     case "whoami":
       requireAuth();
-      show((await client.me()).user);
+      {
+        const { user } = await client.me();
+        show(asJson ? user : whoamiLines(user));
+      }
       break;
     case "vaults":
       requireAuth();
@@ -38799,8 +39803,13 @@ run \`kt --help\` for the flags each command takes`);
     case "vault": {
       requireAuth();
       const sub = positionals[0];
-      if (sub === "create" && positionals[1]) show((await client.createVault(positionals.slice(1).join(" "))).vault);
-      else if (sub === "rename" && positionals[1] && positionals[2]) show((await client.renameVault(positionals[1], positionals.slice(2).join(" "))).vault);
+      if (sub === "create" && positionals[1]) {
+        const name = positionals.slice(1).join(" ");
+        const twin = await client.listVaults().then((r) => r.vaults.find((v) => !v.team_id && v.name === name), () => void 0);
+        if (twin) console.error(`warning: a vault named "${name}" already exists (${twin.id}); creating another`);
+        const { vault } = await client.createVault(name);
+        show(asJson ? vault : `created vault "${vault.name}" (${vault.id})`);
+      } else if (sub === "rename" && positionals[1] && positionals[2]) show((await client.renameVault(positionals[1], positionals.slice(2).join(" "))).vault);
       else if (sub === "rm" && positionals[1]) {
         await client.deleteVault(positionals[1]);
         console.log("deleted");
@@ -38829,12 +39838,15 @@ run \`kt --help\` for the flags each command takes`);
         noReveal = credential.value === null;
       } else {
         const summary = (await client.listCredentials(positionals[0])).credentials.find((c) => c.id === positionals[1]);
-        if (!summary) return die(`no credential ${positionals[1]} in vault ${positionals[0]}`);
+        if (!summary) {
+          console.error(`no credential ${positionals[1]} in vault ${positionals[0]}`);
+          process.exit(EXIT_NOT_FOUND);
+        }
         noReveal = summary.inject_only === true;
         if (noReveal) show({ ...summary, value: null });
         else {
           show({ ...summary, value_hidden: true });
-          console.error("value hidden; pass --reveal to print it");
+          if (!asJson) console.error("value hidden; pass --reveal to print it");
         }
       }
       if (noReveal) {
@@ -38856,17 +39868,45 @@ run \`kt --help\` for the flags each command takes`);
         if (flags.value !== void 0) refuseSecretFlag("value", "pipe it to --value-stdin, or leave it off to be prompted");
         if (flags["value-stdin"] === true && typeof flags.name !== "string") die("--value-stdin needs --name, because stdin carries the value");
         const name = String(flags.name ?? await prompt("name: "));
-        const value = flags["value-stdin"] === true ? await readSecret("value: ") : await prompt("value: ", true);
         const notes = flags.notes !== void 0 ? String(flags.notes) : void 0;
-        show((await client.storeCredential(vaultId, { credential_type: type, name, value, notes })).credential);
+        const custody = await vaultCustody(vaultId);
+        if (custody.private) {
+          try {
+            const { vault, value: value2 } = await unlockForSealedWrite(client, flags, true);
+            show(withNotesMarker((await createSealedItem(client, vault, vaultId, custody.key, { credential_type: type, name }, { value: value2, notes })).credential, notes));
+          } catch (e) {
+            if (e instanceof PrivateVaultError) return die(e.message);
+            throw e;
+          }
+          break;
+        }
+        const value = flags["value-stdin"] === true ? await readSecret("value: ") : await prompt("value: ", true);
+        if (value === "") die(EMPTY_VALUE_MESSAGE);
+        show(withNotesMarker((await client.storeCredential(vaultId, { credential_type: type, name, value, notes })).credential, notes));
       } else if (sub === "set" && vaultId && positionals[2]) {
         if (flags.value !== void 0) refuseSecretFlag("value", "pipe it to --value-stdin");
         const patch = {};
         if (flags.name !== void 0) patch.name = String(flags.name);
-        if (flags["value-stdin"] === true) patch.value = await readSecret("value: ");
         if (flags.notes !== void 0) patch.notes = String(flags.notes);
-        if (!Object.keys(patch).length) return die("nothing to update \u2014 pass --name/--value-stdin/--notes");
-        show((await client.updateCredential(vaultId, positionals[2], patch)).credential);
+        if (!Object.keys(patch).length && flags["value-stdin"] !== true) return die("nothing to update \u2014 pass --name/--value-stdin/--notes");
+        const custody = await vaultCustody(vaultId);
+        if (custody.private) {
+          try {
+            const sealsFields = flags["value-stdin"] === true || patch.notes !== void 0;
+            const unlocked = sealsFields ? await unlockForSealedWrite(client, flags, flags["value-stdin"] === true) : null;
+            if (unlocked?.value !== void 0) patch.value = unlocked.value;
+            show(withNotesMarker((await updateSealedItem(client, unlocked?.vault ?? null, vaultId, positionals[2], custody.key, patch)).credential, patch.notes));
+          } catch (e) {
+            if (e instanceof PrivateVaultError) return die(e.message);
+            throw e;
+          }
+          break;
+        }
+        if (flags["value-stdin"] === true) {
+          patch.value = await readSecret("value: ");
+          if (patch.value === "") die(EMPTY_VALUE_MESSAGE);
+        }
+        show(withNotesMarker((await client.updateCredential(vaultId, positionals[2], patch)).credential, patch.notes));
       } else if (sub === "rm" && vaultId && positionals[2]) {
         await client.deleteCredential(vaultId, positionals[2]);
         console.log("deleted");
@@ -38947,8 +39987,20 @@ run \`kt --help\` for the flags each command takes`);
     }
     case "exec": {
       requireAuth();
-      if (!positionals[0] || !positionals[1]) return die("usage: kt exec <connId> <command...>");
-      const r = await client.exec(positionals[0], positionals.slice(1).join(" ")).catch(async (e) => {
+      if (!positionals[0] || !positionals[1]) return die("usage: kt exec <connId> [--stdin] [--] <command...>");
+      let stdin;
+      if (flags.stdin === true) {
+        const takes = await serverTakesExecStdin(cfg.base).catch((e) => {
+          if (e instanceof ExecStdinCheckTimedOut) return die(e.message);
+          throw e;
+        });
+        if (!takes) return die(STDIN_UNSUPPORTED);
+        stdin = await readExecStdin(process.stdin).catch((e) => {
+          if (e instanceof StdinTooLargeError) return die(`error: ${e.message}`);
+          throw e;
+        });
+      }
+      const r = await client.exec(positionals[0], positionals.slice(1).join(" "), stdin?.toString("base64")).catch(async (e) => {
         const k = hostKeyUnconfirmedFromError(e);
         const chained = k ? null : hostKeyChainedFromError(e);
         if (!k && !chained) throw e;
@@ -38987,7 +40039,7 @@ run \`kt --help\` for the flags each command takes`);
       }
       let job;
       try {
-        job = parseJobFile((0, import_fs5.readFileSync)(path, "utf8"));
+        job = parseJobFile((0, import_fs7.readFileSync)(path, "utf8"));
       } catch (e) {
         return die(e instanceof JobFileError ? `${path}: ${e.message}` : `${path}: ${e.message}`);
       }
@@ -38996,7 +40048,7 @@ run \`kt --help\` for the flags each command takes`);
       if (agentToken && !asJson && reporter === "console") {
         console.error(`running as a pipeline principal through ${cfg.base.replace(/\/+$/, "")}/mcp`);
       }
-      const result = await runJob(job, runnerClient, { readLocal: (p) => (0, import_fs5.readFileSync)(p), writeLocal: (p, d) => (0, import_fs5.writeFileSync)(p, d) }, {
+      const result = await runJob(job, runnerClient, { readLocal: (p) => (0, import_fs7.readFileSync)(p), writeLocal: (p, d) => (0, import_fs7.writeFileSync)(p, d) }, {
         dryRun,
         onStep: (s) => {
           if (asJson || reporter !== "console") return;
@@ -39022,7 +40074,7 @@ run \`kt --help\` for the flags each command takes`);
           const path = positionals[2] ?? ".";
           const r = await client.sftpList(connId, path);
           if (asJson) return console.log(JSON.stringify(r, null, 2));
-          show(r.entries, ["name", "type", "size", "mode"]);
+          show(r.entries.map((e) => ({ ...e, mode: modeString(e.mode, e.type) })), ["name", "type", "size", "mode"]);
         } else if (sub === "mkdir" && connId && positionals[2]) {
           await client.sftpMkdir(connId, positionals[2]);
           console.log("created");
@@ -39094,6 +40146,11 @@ run \`kt --help\` for the flags each command takes`);
         to,
         throttle_bps: intFlag("throttle"),
         ...conflict ? { conflict } : {}
+      }).catch((e) => {
+        if (!unreachedApi(e)) throw e;
+        if (asJson) console.log(JSON.stringify({ status: "unknown", error: e instanceof Error ? e.message : String(e) }, null, 2));
+        else console.error(`no answer from the server (${e instanceof Error ? e.message : String(e)}); the transfer may still be running or may have completed. Check the destination before running it again, or use \`kt job new\` for a transfer you can poll.`);
+        return process.exit(EXIT_UNKNOWN);
       });
       if (asJson) return console.log(JSON.stringify(r, null, 2));
       console.log(`transferred ${r.files} file(s), ${fmtBytes(r.bytes)}${r.skipped ? `, ${r.skipped} skipped` : ""}${r.renamed ? `, ${r.renamed} renamed` : ""}`);
@@ -39142,8 +40199,10 @@ run \`kt --help\` for the flags each command takes`);
         return await watchJob(job.id);
       } else if (sub === "wait" && positionals[1]) {
         return await watchJob(positionals[1]);
+      } else if (sub === "cancel" && positionals[1]) {
+        show((await client.cancelTransferJob(positionals[1])).job);
       } else {
-        die("usage: kt job [ls] | kt job get <id> | kt job new <from> <to> [--wait] | kt job wait <id>");
+        die("usage: kt job [ls] | kt job get <id> | kt job new <from> <to> [--wait] | kt job wait <id> | kt job cancel <id>");
       }
       break;
     }
@@ -39193,6 +40252,13 @@ run \`kt --help\` for the flags each command takes`);
       } else if (sub === "new" && positionals[1] && positionals[2] && positionals[3]) {
         const source = sideArg(positionals[2], "source");
         const dest = sideArg(positionals[3], "destination");
+        const every = intFlag("every");
+        if (flags.every === true || every !== void 0 && (!Number.isInteger(every) || every < WATCHER_EVERY_MIN || every > WATCHER_EVERY_MAX)) {
+          return die(`--every must be a whole number of seconds from ${WATCHER_EVERY_MIN} to ${WATCHER_EVERY_MAX} (got ${flags.every === true ? "nothing" : flags.every})`);
+        }
+        if (flags.pattern !== void 0 && (flags.pattern === true || !String(flags.pattern).trim() || String(flags.pattern).length > WATCHER_PATTERN_MAX)) {
+          return die(`--pattern needs a filename glob such as '*.csv', at most ${WATCHER_PATTERN_MAX} characters`);
+        }
         show((await client.createFolderWatcher({
           name: positionals[1],
           source,
@@ -39206,7 +40272,7 @@ run \`kt --help\` for the flags each command takes`);
           // Stability checks are what stop a watcher picking up a file that is still being written.
           // Off is opt-in, never a default.
           stability_checks: flags["no-stability"] !== true,
-          interval_seconds: intFlag("every")
+          interval_seconds: every
         })).watcher);
       } else if ((sub === "enable" || sub === "disable") && positionals[1]) {
         await client.setFolderWatcherEnabled(positionals[1], sub === "enable");
@@ -39278,11 +40344,11 @@ ${r.authorize_url}`);
         const buf = Buffer.from(await blob.arrayBuffer());
         if (local === "-") process.stdout.write(buf);
         else {
-          (0, import_fs5.writeFileSync)(local, buf);
+          (0, import_fs7.writeFileSync)(local, buf);
           console.error(`saved ${local} (${fmtBytes(buf.length)})`);
         }
       } else if (sub === "put" && id && positionals[2] && positionals[3]) {
-        const buf = (0, import_fs5.readFileSync)(positionals[2]);
+        const buf = (0, import_fs7.readFileSync)(positionals[2]);
         await client.cloudUpload(id, positionals[3], new Blob([buf]));
         console.error(`uploaded ${fmtBytes(buf.length)}`);
       } else if (sub === "mkdir" && id && positionals[2]) {
@@ -39388,17 +40454,20 @@ ${r.token}`);
         }
         const scopes = flags.scopes ? String(flags.scopes).split(",").map((s) => s.trim()).filter(Boolean) : DEFAULT_SCOPES;
         const ttlDays = flags.days !== void 0 ? Number(flags.days) : DEFAULT_TTL_DAYS;
-        const dir = (0, import_path6.resolve)(String(flags.dir ?? process.cwd()));
+        const dir = (0, import_path7.resolve)(String(flags.dir ?? process.cwd()));
         const egress = String(flags.egress ?? "cloud");
         if (egress !== "lan" && egress !== "cloud") return die("--egress must be lan or cloud");
+        if (flags.vault === true || flags.connection === true) return die("--vault and --connection each take a value (an id or a name)");
         try {
-          const r = await installClient({ base: cfg.base, userToken, client: client2, dir, scopes, ttlDays, egressClass: egress });
+          const resourceScope = await resolveResourceScope(cfg.base, userToken, multi.vault ?? [], multi.connection ?? []);
+          const r = await installClient({ base: cfg.base, userToken, client: client2, dir, scopes, ttlDays, egressClass: egress, resourceScope });
           warnLeftLive(r, client2);
           if (asJson) return console.log(JSON.stringify(r, null, 2));
           console.log(`installed ${CLIENTS[client2].label}`);
           console.log(`  config    ${r.configPath}`);
           console.log(`  agent     ${r.principalId} (expires ${r.expiresAt})`);
           console.log(`  scopes    ${r.scopes.join(", ")}`);
+          console.log(`  reach     ${describeScope(r.resourceScope)}`);
           if (r.superseded) console.log(`  revoked   ${r.superseded} earlier agent(s) for this client`);
           console.log(`  credential stored in the ${backendName()} \u2014 the config file does not contain it`);
           console.log(r.verified ? "  verified  connection to the broker works" : "  warning: could not verify the connection");
@@ -39417,7 +40486,7 @@ next: ${r.next}`);
         break;
       }
       if (sub === "status") {
-        const dir = (0, import_path6.resolve)(String(flags.dir ?? process.cwd()));
+        const dir = (0, import_path7.resolve)(String(flags.dir ?? process.cwd()));
         const s = await mcpStatus(cfg.base, dir);
         if (asJson) return console.log(JSON.stringify(s, null, 2));
         console.log(`credential store: ${s.keychain}`);
@@ -39437,6 +40506,7 @@ next: ${r.next}`);
           if (c.agent?.state !== "live") continue;
           const rl = c.agent.rate_limit;
           console.log(`${c.client}: scopes ${(c.agent.scopes ?? []).join(", ")}` + (rl?.tool_calls ? `; limit ${rl.tool_calls} tool calls / ${Math.round((rl.window_ms ?? 0) / 1e3)}s` : ""));
+          console.log(`${c.client}: reach ${describeScope(c.agent.resource_scope)}`);
         }
         if (s.legacy) console.log(`
 shared pre-split credential: ${s.legacy.principal_id ?? ""} ${state(s.legacy)}`.trimEnd());
@@ -39448,7 +40518,7 @@ shared pre-split credential: ${s.legacy.principal_id ?? ""} ${state(s.legacy)}`.
         if (client2 && !CLIENT_IDS.includes(client2)) {
           return die(`unknown --client; one of: ${CLIENT_IDS.join(", ")}`);
         }
-        const dir = (0, import_path6.resolve)(String(flags.dir ?? process.cwd()));
+        const dir = (0, import_path7.resolve)(String(flags.dir ?? process.cwd()));
         const r = await uninstallClient({ base: cfg.base, userToken, client: client2, dir });
         warnLeftLive(r, client2);
         if (asJson) return console.log(JSON.stringify(r, null, 2));
@@ -39457,7 +40527,7 @@ shared pre-split credential: ${s.legacy.principal_id ?? ""} ${state(s.legacy)}`.
         break;
       }
       if (sub && sub !== "serve") {
-        return die("usage: kt mcp [serve] | kt mcp install --client <id> | kt mcp status | kt mcp uninstall [--client <id>]");
+        return die("usage: kt mcp [serve] | kt mcp install --client <id> [--vault <id|name>]... [--connection <id>]... | kt mcp status | kt mcp uninstall [--client <id>]");
       }
       if (flags.token !== void 0) refuseSecretFlag("token", "export KT_AGENT_TOKEN instead, or run kt mcp install");
       let agentToken;
@@ -39478,6 +40548,136 @@ shared pre-split credential: ${s.legacy.principal_id ?? ""} ${state(s.legacy)}`.
       await runMcpBridge({ base: cfg.base, token: agentToken });
       break;
     }
+    // #3545: a principal for a server install, which has no keychain and no AI client config to write.
+    case "agent": {
+      if (positionals[0] !== "mint") {
+        return die("usage: kt agent mint [--name <n>] [--scopes a,b] [--days <n>] [--egress lan|cloud] [--scope-vault <id|name>]... [--scope-conn <id|name>]... [--write-env <file>]");
+      }
+      const userToken = requireAuth();
+      if (flags["scope-vault"] === true || flags["scope-conn"] === true) return die("--scope-vault and --scope-conn each take a value (an id or a name)");
+      if (flags["write-env"] === true) return die("--write-env takes a file path");
+      const scopes = flags.scopes ? String(flags.scopes).split(",").map((x) => x.trim()).filter(Boolean) : DEFAULT_SCOPES;
+      const ttlDays = flags.days !== void 0 ? Number(flags.days) : DEFAULT_TTL_DAYS;
+      const egress = String(flags.egress ?? "cloud");
+      if (egress !== "lan" && egress !== "cloud") return die("--egress must be lan or cloud");
+      const envFile = typeof flags["write-env"] === "string" ? (0, import_path7.resolve)(String(flags["write-env"])) : void 0;
+      let created = false;
+      if (envFile) {
+        if ((0, import_fs7.existsSync)(envFile) && flags.yes !== true) return die(`${envFile} already exists; pass --yes to replace it (the principal it names stays live until revoked)`);
+        created = !(0, import_fs7.existsSync)(envFile);
+        try {
+          writeOwnerOnly(envFile, "");
+        } catch (e) {
+          return die(`cannot write ${envFile}: ${e.message}`);
+        }
+      }
+      try {
+        const resourceScope = await resolveResourceScope(cfg.base, userToken, multi["scope-vault"] ?? [], multi["scope-conn"] ?? []);
+        const m = await mintAgent({
+          base: cfg.base,
+          userToken,
+          name: String(flags.name ?? `kt agent on ${(0, import_os5.hostname)()}`).slice(0, 120),
+          purpose: "Server install minted with 'kt agent mint'",
+          scopes,
+          ttlDays,
+          egressClass: egress,
+          resourceScope
+        });
+        if (envFile) writeOwnerOnly(envFile, `KT_AGENT_TOKEN=${m.token}
+KT_API_BASE=${cfg.base}
+`);
+        const view = { principal_id: m.id, expires_at: m.expires_at, scopes: m.scopes, resource_scope: resourceScope ?? null, ...envFile ? { env_file: envFile } : { token: m.token } };
+        if (asJson) return console.log(JSON.stringify(view, null, 2));
+        console.log(`minted agent ${m.id} (expires ${m.expires_at})`);
+        console.log(`  scopes    ${m.scopes.join(", ")}`);
+        console.log(`  reach     ${describeScope(resourceScope)}`);
+        if (envFile) console.log(`  wrote KT_AGENT_TOKEN and KT_API_BASE to ${envFile} (mode 0600); the token is not shown`);
+        else console.log(`  token     ${m.token}
+  shown once; export it as KT_AGENT_TOKEN`);
+      } catch (e) {
+        if (envFile && created) {
+          try {
+            (0, import_fs7.unlinkSync)(envFile);
+          } catch {
+          }
+        }
+        return die(`mint failed: ${e.message}`);
+      }
+      break;
+    }
+    // #3541: the OIDC trusts `kt ci-login` exchanges against. The routes are owner/admin only and the
+    // server refuses a pattern that matches every project; this only collects the three claims and the
+    // vault scope. --vault has no org-wide default.
+    case "trust": {
+      requireAuth();
+      const sub = positionals[0] ?? "ls";
+      if (sub === "ls") {
+        const trusts = (await client.listAgentOidcTrusts()).trusts.filter((t) => !t.disabled_at);
+        const vaultsOf = (t) => {
+          const ids = t.resource_scope?.vault_ids ?? [];
+          return ids.length ? ids.map((id) => `${t.resource_scope_names?.[id] ?? "vault"} (${id})`).join(", ") : "all vaults the owner can reach";
+        };
+        show(
+          asJson ? trusts : trusts.map((t) => ({ id: t.id, issuer: t.issuer, audience: t.audience, subject: t.subject_pattern, vaults: vaultsOf(t), created: t.created_at })),
+          ["id", "issuer", "audience", "subject", "vaults", "created"]
+        );
+      } else if (sub === "add") {
+        const need = (k) => typeof flags[k] === "string" && String(flags[k]).trim() ? String(flags[k]).trim() : die(`--${k} is required; see \`kt trust --help\``);
+        const issuer = need("issuer"), audience = need("audience"), subject = need("subject");
+        const vaultIds = repeatedFlag(process.argv.slice(2), "vault").flatMap((v) => v.split(",")).map((v) => v.trim()).filter(Boolean);
+        if (!vaultIds.length) return die("--vault <id> is required (repeat it for more): a trust reaches only the vaults named, never the whole organization");
+        const scopes = (typeof flags.scopes === "string" ? flags.scopes : "vault.list,vault.use").split(",").map((x) => x.trim()).filter(Boolean);
+        const egress = String(flags.egress ?? "lan");
+        if (egress !== "lan" && egress !== "cloud") return die("--egress must be lan or cloud");
+        const trust = await withStepUp(client, () => client.createAgentOidcTrust({
+          name: typeof flags.name === "string" && flags.name.trim() ? flags.name.trim() : `ci ${subject}`.slice(0, 120),
+          issuer,
+          audience,
+          subject_pattern: subject,
+          scopes,
+          ...flags.ttl !== void 0 ? { ttl_minutes: Number(flags.ttl) } : {},
+          egress_class: egress,
+          resource_scope: { vault_ids: vaultIds }
+        }));
+        if (asJson) return console.log(JSON.stringify(trust, null, 2));
+        console.log(`trust ${trust.id} created (egress: ${egress})`);
+        console.log(`use it in the pipeline:  kt ci-login --trust ${trust.id}`);
+      } else if (sub === "rm" && positionals[1]) {
+        await client.deleteAgentOidcTrust(positionals[1]);
+        console.log(`trust ${positionals[1]} revoked; no new exchange is accepted. Agents already issued under it run out their own lifetime.`);
+      } else {
+        die("usage: kt trust add --issuer <url> --audience <aud> --subject <pattern> --vault <id> | kt trust ls | kt trust rm <id>");
+      }
+      break;
+    }
+    // #3561: only the ordered fallback list lives here; the primary base is set by `kt login`.
+    case "config": {
+      const [sub, key, ...vals] = positionals;
+      if (key !== "base-fallback" || sub !== "set" && sub !== "get" && sub !== "unset") {
+        return die("usage: kt config set base-fallback <url>[,<url>...] [--allow-insecure-lan] | kt config get base-fallback | kt config unset base-fallback");
+      }
+      const saved = storedBase();
+      if (!saved) return die("no saved server to attach a fallback to; run `kt --base <url> login` first");
+      if (sub === "set") {
+        const urls = splitBases(vals);
+        if (!urls.length) return die("give at least one fallback base URL");
+        const entries = urls.map((url) => ({ url, ...flags["allow-insecure-lan"] === true && url.startsWith("http:") ? { insecure: true } : {} }));
+        for (const f of entries) {
+          const why2 = fallbackRefusal(f);
+          if (why2) return die(`error: ${why2}`);
+          if (norm(f.url) === norm(saved)) return die(`error: ${f.url} is the primary server`);
+        }
+        saveCfg(saved, entries);
+      } else if (sub === "unset") {
+        saveCfg(saved, []);
+      }
+      const now = readFallbacks(CONFIG, saved);
+      if (asJson) return console.log(JSON.stringify({ base: saved, fallbacks: now }, null, 2));
+      console.log(`primary  ${saved}`);
+      now.forEach((f, i) => console.log(`fallback ${i + 1}  ${f.url}${f.insecure ? "  (plain http, opted in)" : ""}`));
+      if (!now.length) console.log("no fallback bases");
+      break;
+    }
     // #674: exchange this CI job's own OIDC token for a short-lived agent principal. No Kutrion
     // secret is stored in the pipeline — the job token is minted per run by the CI provider.
     case "ci-login": {
@@ -39693,7 +40893,15 @@ ${snippetPreview(s)}
         const connection_id = String(flags.conn ?? ""), credential_id = String(flags.cred ?? "");
         if (!connection_id || !credential_id) return die("need --conn <id> --cred <id>");
         const input = { connection_id, credential_id, service, target: flags.target ? String(flags.target) : void 0 };
-        show(sub === "plan" ? await client.planRotation(input) : await client.executeRotation(input));
+        if (sub === "plan") show(await client.planRotation(input));
+        else {
+          try {
+            show(await client.executeRotation(input));
+          } catch (e) {
+            if (isStepUpRequired(e)) console.error("requires_step_up: true (as `kt rotation plan` reports); run `kt step-up`, then re-run");
+            throw e;
+          }
+        }
       } else die("usage: kt rotation services | history <credId> | plan|run --conn <id> --cred <id> --service <svc> [--target ..]");
       break;
     }
@@ -39765,8 +40973,9 @@ ${owed}`);
     case "device":
       requireAuth();
       if (positionals[0] === "rm" && positionals[1]) {
-        await client.revokeDevice(positionals[1]);
+        const r = await client.revokeDevice(positionals[1]);
         console.log("revoked");
+        if (r.agents_ended) console.log(`this ended ${r.agents_ended} agent${r.agents_ended === 1 ? "" : "s"}: ${(r.agents ?? []).map((a) => printable(String(a.name ?? ""))).join(", ")}`);
       } else die("usage: kt device rm <deviceId>");
       break;
     // --- vault share ---
@@ -39829,7 +41038,7 @@ ${r.url}`);
       } else if (sub === "import") {
         const vaultId = positionals[1], file = positionals[2];
         if (!vaultId || !file) return die(CONN_IMPORT_USAGE);
-        const parsed = await client.parseConnImport((0, import_fs5.readFileSync)(file, "utf8"), {
+        const parsed = await client.parseConnImport((0, import_fs7.readFileSync)(file, "utf8"), {
           provider: flags.provider ? String(flags.provider) : void 0,
           filename: file.split("/").pop()
         });
@@ -39959,7 +41168,7 @@ ${ENROLL_USAGE}`);
       const confirms = parseConfirms(process.argv.slice(2));
       if (!(confirms instanceof Map)) return die(confirms.error);
       if (flags.key === true || flags["known-hosts"] === true || flags.vault === true) return die(ENROLL_USAGE);
-      const knownHosts = typeof flags["known-hosts"] === "string" ? (0, import_fs5.readFileSync)(flags["known-hosts"], "utf8") : void 0;
+      const knownHosts = typeof flags["known-hosts"] === "string" ? (0, import_fs7.readFileSync)(flags["known-hosts"], "utf8") : void 0;
       const fallback = flags.fallback === true;
       const vaultId = typeof flags.vault === "string" ? flags.vault : void 0;
       const timeoutSec = intFlag("timeout") ?? 1800;
@@ -39979,7 +41188,7 @@ ${r.label}  ${r.host.observedFingerprint}`);
       if (!chosen.length) return die(ENROLL_COPY.noneConfirmed);
       let bootstrap;
       if (typeof flags.key === "string") {
-        const privateKey = (0, import_fs5.readFileSync)(flags.key, "utf8");
+        const privateKey = (0, import_fs7.readFileSync)(flags.key, "utf8");
         let passphrase;
         if (isEncryptedKey(privateKey)) {
           if (flags["password-stdin"] === true) passphrase = await readStdin();
@@ -40172,14 +41381,15 @@ ${BROKER_CA_USAGE}`);
       break;
     case "import-providers":
       requireAuth();
-      show((await client.importProviders()).providers, ["id", "name", "format", "ext"]);
+      show((await client.importProviders()).providers.map((p) => ({ ...p, name: p.label })), ["id", "name", "format", "ext"]);
       break;
     case "import": {
       requireAuth();
       const vaultId = positionals[0];
       const file = positionals[1];
       if (!vaultId || !file) die("usage: kt import <vaultId> <file> [--provider <name>]  (see: kt import-providers)");
-      const content = (0, import_fs5.readFileSync)(file, "utf8");
+      const content = (0, import_fs7.readFileSync)(file, "utf8");
+      if ((await vaultCustody(vaultId)).private) return die(PRIVATE_IMPORT_REFUSED);
       const parsed = await client.parseImport(content, { provider: flags.provider ? String(flags.provider) : void 0, filename: file.split("/").pop() });
       for (const w of parsed.warnings) console.error("warning:", w);
       const items = parsed.items.filter((it) => it.name && it.value).map((it) => ({ ...it, name: it.name.slice(0, 255) }));
@@ -40258,6 +41468,19 @@ Add this to your authenticator, then run: kt mfa verify --code <code>`);
       }
       break;
     }
+    // The adaptive gate's step-up is a per-session proof (server lib/step-up.ts), so one code here clears
+    // the refusal for every command this session runs until it lapses. The code never rides on argv.
+    case "step-up": {
+      requireAuth();
+      if (positionals.length || flags.code !== void 0) die("usage: kt step-up   (the authenticator code is asked for, or read from stdin)");
+      const status = await client.mfaStatus();
+      if (status.methods.totp !== true) die("this account has no authenticator app to step up with; enrol one with `kt mfa setup`, then `kt mfa verify --code <code>`, then run `kt step-up`");
+      const code = await prompt("authenticator code: ", true);
+      if (!code) die("no authenticator code given");
+      await client.stepUpTotp(code);
+      console.log("step-up verified; re-run the refused command within a few minutes");
+      break;
+    }
     case "passkeys":
       requireAuth();
       show((await client.listPasskeys()).passkeys, ["id", "label", "kind", "created_at", "last_used"]);
@@ -40287,12 +41510,36 @@ run \`kt --help\` for the list of commands`);
   }
 }
 installFetchProxy();
-main().catch((e) => {
+var argv = parseArgs(process.argv.slice(2));
+var hubSlots = { get: getToken, set: setToken, clear: clearToken };
+var hubSignInAvailable = (e) => e instanceof ApiError && e.status === 401 && appDataDir() !== null && osKeychainAvailable();
+retryAfterHubReborrow(main, {
+  refusedSession: (e) => refusedSavedSession(e, argv),
+  wrote: sessionWrites.wrote,
+  lastAccount: () => lastAccountId(resolveBase(argv.flags.base), hubSlots),
+  reborrow: async () => {
+    const base = resolveBase(argv.flags.base);
+    const root = appDataDir();
+    if (!root) return { kind: "fallback", note: null, reason: "hub_not_running" };
+    const hub = await reborrowFromHub({
+      base,
+      location: hubLocation(root),
+      kc: hubSlots,
+      keychainAvailable: osKeychainAvailable,
+      call: hubCallFor(base),
+      out: (l) => console.error(l),
+      ask: (q) => promptLine(q)
+    });
+    if (hub.kind === "signed_in") recordSignIn(root, hub.user);
+    return hub.kind === "fallback" && hubAbsent(hub.reason) ? { ...hub, note: null } : hub;
+  },
+  out: (l) => console.error(l)
+}).catch((e) => {
   const api3 = e instanceof ApiError ? e : null;
   const code = api3 ? exitForStatus(api3.status) : EXIT_ERROR;
   const message = redactProxyUrls(e instanceof Error ? e.message : String(e));
-  const lines = (storeFailure(e) ?? refusalLines(e) ?? [`error: ${message}`]).map(redactProxyUrls);
-  if (parseArgs(process.argv.slice(2)).flags.json === true) {
+  const lines = (e instanceof HubAccountSwitchedError ? [e.message] : storeFailure(e) ?? refusalLines(e, "  ", { hubSignIn: hubSignInAvailable(e) }) ?? [`error: ${message}`]).map(redactProxyUrls);
+  if (argv.flags.json === true) {
     console.log(JSON.stringify({
       error: api3 ? refusalCode(api3) : message,
       ...api3 ? { status: api3.status } : {},