@kutrion/cli 1.2.14 → 1.2.16

package/dist/index.js

@@ -10417,22 +10417,22 @@ var require_formdata = __commonJS({
         name = webidl.converters.USVString(name, prefix, "name");
         value = isBlobLike(value) ? webidl.converters.Blob(value, prefix, "value", { strict: false }) : webidl.converters.USVString(value, prefix, "value");
         filename = arguments.length === 3 ? webidl.converters.USVString(filename, prefix, "filename") : void 0;
-        const entry = makeEntry(name, value, filename);
-        this[kState].push(entry);
+        const entry2 = makeEntry(name, value, filename);
+        this[kState].push(entry2);
       }
       delete(name) {
         webidl.brandCheck(this, _FormData);
         const prefix = "FormData.delete";
         webidl.argumentLengthCheck(arguments, 1, prefix);
         name = webidl.converters.USVString(name, prefix, "name");
-        this[kState] = this[kState].filter((entry) => entry.name !== name);
+        this[kState] = this[kState].filter((entry2) => entry2.name !== name);
       }
       get(name) {
         webidl.brandCheck(this, _FormData);
         const prefix = "FormData.get";
         webidl.argumentLengthCheck(arguments, 1, prefix);
         name = webidl.converters.USVString(name, prefix, "name");
-        const idx = this[kState].findIndex((entry) => entry.name === name);
+        const idx = this[kState].findIndex((entry2) => entry2.name === name);
         if (idx === -1) {
           return null;
         }
@@ -10443,14 +10443,14 @@ var require_formdata = __commonJS({
         const prefix = "FormData.getAll";
         webidl.argumentLengthCheck(arguments, 1, prefix);
         name = webidl.converters.USVString(name, prefix, "name");
-        return this[kState].filter((entry) => entry.name === name).map((entry) => entry.value);
+        return this[kState].filter((entry2) => entry2.name === name).map((entry2) => entry2.value);
       }
       has(name) {
         webidl.brandCheck(this, _FormData);
         const prefix = "FormData.has";
         webidl.argumentLengthCheck(arguments, 1, prefix);
         name = webidl.converters.USVString(name, prefix, "name");
-        return this[kState].findIndex((entry) => entry.name === name) !== -1;
+        return this[kState].findIndex((entry2) => entry2.name === name) !== -1;
       }
       set(name, value, filename = void 0) {
         webidl.brandCheck(this, _FormData);
@@ -10464,16 +10464,16 @@ var require_formdata = __commonJS({
         name = webidl.converters.USVString(name, prefix, "name");
         value = isBlobLike(value) ? webidl.converters.Blob(value, prefix, "name", { strict: false }) : webidl.converters.USVString(value, prefix, "name");
         filename = arguments.length === 3 ? webidl.converters.USVString(filename, prefix, "name") : void 0;
-        const entry = makeEntry(name, value, filename);
-        const idx = this[kState].findIndex((entry2) => entry2.name === name);
+        const entry2 = makeEntry(name, value, filename);
+        const idx = this[kState].findIndex((entry3) => entry3.name === name);
         if (idx !== -1) {
           this[kState] = [
             ...this[kState].slice(0, idx),
-            entry,
-            ...this[kState].slice(idx + 1).filter((entry2) => entry2.name !== name)
+            entry2,
+            ...this[kState].slice(idx + 1).filter((entry3) => entry3.name !== name)
           ];
         } else {
-          this[kState].push(entry);
+          this[kState].push(entry2);
         }
       }
       [nodeUtil.inspect.custom](depth, options) {
@@ -13753,16 +13753,16 @@ var require_env_http_proxy_agent = __commonJS({
           return false;
         }
         for (let i = 0; i < this.#noProxyEntries.length; i++) {
-          const entry = this.#noProxyEntries[i];
-          if (entry.port && entry.port !== port) {
+          const entry2 = this.#noProxyEntries[i];
+          if (entry2.port && entry2.port !== port) {
             continue;
           }
-          if (!/^[.*]/.test(entry.hostname)) {
-            if (hostname3 === entry.hostname) {
+          if (!/^[.*]/.test(entry2.hostname)) {
+            if (hostname3 === entry2.hostname) {
               return false;
             }
           } else {
-            if (hostname3.endsWith(entry.hostname.replace(/^\*/, ""))) {
+            if (hostname3.endsWith(entry2.hostname.replace(/^\*/, ""))) {
               return false;
             }
           }
@@ -13774,13 +13774,13 @@ var require_env_http_proxy_agent = __commonJS({
         const noProxySplit = noProxyValue.split(/[,\s]/);
         const noProxyEntries = [];
         for (let i = 0; i < noProxySplit.length; i++) {
-          const entry = noProxySplit[i];
-          if (!entry) {
+          const entry2 = noProxySplit[i];
+          if (!entry2) {
             continue;
           }
-          const parsed = entry.match(/^(.+):(\d+)$/);
+          const parsed = entry2.match(/^(.+):(\d+)$/);
           noProxyEntries.push({
-            hostname: (parsed ? parsed[1] : entry).toLowerCase(),
+            hostname: (parsed ? parsed[1] : entry2).toLowerCase(),
             port: parsed ? Number.parseInt(parsed[2], 10) : 0
           });
         }
@@ -13828,7 +13828,7 @@ var require_headers = __commonJS({
       while (j > i && isHTTPWhiteSpaceCharCode(potentialValue.charCodeAt(i))) ++i;
       return i === 0 && j === potentialValue.length ? potentialValue : potentialValue.substring(i, j);
     }
-    function fill(headers, object) {
+    function fill2(headers, object) {
       if (Array.isArray(object)) {
         for (let i = 0; i < object.length; ++i) {
           const header = object[i];
@@ -14053,7 +14053,7 @@ var require_headers = __commonJS({
         this.#guard = "none";
         if (init !== void 0) {
           init = webidl.converters.HeadersInit(init, "Headers contructor", "init");
-          fill(this, init);
+          fill2(this, init);
         }
       }
       // https://fetch.spec.whatwg.org/#dom-headers-append
@@ -14233,7 +14233,7 @@ var require_headers = __commonJS({
       });
     };
     module2.exports = {
-      fill,
+      fill: fill2,
       // for test.
       compareHeaderName,
       Headers: Headers2,
@@ -14251,7 +14251,7 @@ var require_response = __commonJS({
   "node_modules/undici/lib/web/fetch/response.js"(exports2, module2) {
     "use strict";
     init_define_KT_HUB_FILES();
-    var { Headers: Headers2, HeadersList, fill, getHeadersGuard, setHeadersGuard, setHeadersList } = require_headers();
+    var { Headers: Headers2, HeadersList, fill: fill2, getHeadersGuard, setHeadersGuard, setHeadersList } = require_headers();
     var { extractBody, cloneBody, mixinBody, hasFinalizationRegistry, streamRegistry, bodyUnusable } = require_body();
     var util = require_util();
     var nodeUtil = require("node:util");
@@ -14552,7 +14552,7 @@ var require_response = __commonJS({
         response[kState].statusText = init.statusText;
       }
       if ("headers" in init && init.headers != null) {
-        fill(response[kHeaders], init.headers);
+        fill2(response[kHeaders], init.headers);
       }
       if (body) {
         if (nullBodyStatus.includes(response.status)) {
@@ -23900,7 +23900,7 @@ async function completeEmailCodeLogin(d) {
 }
 
 // src/index.ts
-var import_fs5 = require("fs");
+var import_fs7 = require("fs");
 
 // src/owner-only.ts
 init_define_KT_HUB_FILES();
@@ -23921,7 +23921,7 @@ function writeOwnerOnly(path, data) {
 
 // src/index.ts
 var import_os5 = require("os");
-var import_path6 = require("path");
+var import_path7 = require("path");
 var import_readline2 = require("readline");
 var import_net = require("net");
 
@@ -24056,45 +24056,148 @@ function auditResultLabel(raw) {
 
 // ../packages/shared/src/refresh-refusal-copy.ts
 init_define_KT_HUB_FILES();
-var REFRESH_REFUSAL_COPY = {
-  refresh_hub_signed_out: { title: "This session was signed out", why: "You signed out in Kutrion Hub." },
-  refresh_hub_revoked: { title: "This session was signed out", why: "This app was signed out because its Kutrion Hub was removed." },
-  refresh_credentials_changed: {
-    title: "Your password changed",
-    why: "Your password changed, so Kutrion signed this {app} out.",
-    action: "Sign in again with your new password."
-  },
-  device_revoked: {
-    title: "This device was signed out",
-    why: "This {app}'s access was withdrawn from your Kutrion account.",
-    action: "Sign in again to re-register it."
-  },
-  account_inactive: {
-    title: "This account has ended",
-    why: "Your Kutrion account is no longer active, so this {app} was signed out.",
-    action: "Your administrator can restore it. Signing in again won't work until they do."
-  },
-  user_inactive: {
-    title: "This account has ended",
-    why: "Your Kutrion account is no longer active, so this {app} was signed out.",
-    action: "Your administrator can restore it. Signing in again won't work until they do."
-  },
-  account_expired: {
-    title: "This account has expired",
-    why: "Your Kutrion account has expired, so this {app} was signed out.",
-    action: "Your administrator can restore it. Signing in again won't work until they do."
-  },
-  org_mismatch: {
-    title: "This session was signed out",
-    why: "You're no longer a member of the organization this {app} was signed in to.",
-    action: "Sign in again to continue with your current organization."
+
+// ../packages/shared/src/security-copy.ts
+init_define_KT_HUB_FILES();
+var SECURITY_COPY_EN = {
+  "destinationRefusal.title": "Destination not authorized",
+  "destinationRefusal.title.fault": "This destination could not be checked",
+  "destinationRefusal.title.connection": "This destination cannot be authorized as written",
+  "destinationRefusal.summary.named": 'Kutrion did not connect to {destination} and did not send the credential "{credential}".',
+  "destinationRefusal.summary.namedSource": 'Kutrion did not connect to {destination} as the source of this transfer and did not send the credential "{credential}".',
+  "destinationRefusal.summary.namedDest": 'Kutrion did not connect to {destination} as the destination of this transfer and did not send the credential "{credential}".',
+  "destinationRefusal.summary.unnamed": "Kutrion did not connect to {destination} and did not send this credential.",
+  "destinationRefusal.summary.unnamedSource": "Kutrion did not connect to {destination} as the source of this transfer and did not send this credential.",
+  "destinationRefusal.summary.unnamedDest": "Kutrion did not connect to {destination} as the destination of this transfer and did not send this credential.",
+  "destinationRefusal.allowed.list": "It may be presented to these destinations only:",
+  "destinationRefusal.allowed.listInline": "It may be presented to these destinations only: {destinations}.",
+  "destinationRefusal.allowed.noneFault": "Kutrion could not check where this credential may be presented.",
+  "destinationRefusal.allowed.none": "No authorized destinations are recorded for this credential.",
+  "destinationRefusal.action.allowList": "Where this credential may be presented is set on the credential itself. Changing it needs write access to the vault holding the credential, and the credential's current value.",
+  "destinationRefusal.action.authorizeBelow": "Authorize this destination below.",
+  "destinationRefusal.action.host": "The host recorded on this connection cannot be expressed as an authorized destination, so no entry on the credential can match it. A destination host must be a plain ASCII hostname, an IPv4 address, or an IPv6 address in square brackets, and must not carry a scheme, a port, a user name or a path. Correct the host on the connection, then authorize the corrected destination on the credential.",
+  "destinationRefusal.action.domain": "The Windows domain recorded on this connection cannot be expressed as an authorized destination, so no entry on the credential can match it. A domain must be a plain ASCII name, either a short name such as CORP or a full name such as corp.example.com, entered on its own without a backslash, a user name or an address, or left empty if this host does not use one. Correct the domain on the connection, then authorize the corrected destination on the credential.",
+  "destinationRefusal.action.fault": "This is a fault in Kutrion, not a permission you are missing. No change to the credential or the connection will resolve it. Report it with the time, the connection and the destination shown above.",
+  "destinationRefusal.notARemedy": "Re-entering the credential's value here does not change where it may be presented.",
+  "destinationRefusal.locator.named": "Open Kutrion on the web, go to the vault, open this credential and choose Destinations to allow {destination}. Or run `kt cred dest add`.",
+  "destinationRefusal.locator.unnamed": "Open Kutrion on the web, go to the vault, open this credential and choose Destinations to allow this destination. Or run `kt cred dest add`.",
+  "tlsDowngrade.title": "Transport security cannot be weakened",
+  "tlsDowngrade.summary": "An existing connection's transport security cannot be weakened.",
+  "tlsDowngrade.action": "Keep TLS and certificate checking on, or use a credential that has no stronger connection to this host.",
+  "destinationNeed.notice": "Saved. Kutrion will refuse this connection until this credential is authorized for {target}.",
+  "destinationNeed.who": "An editor, admin or owner of the vault {vault} can authorize it. It is listed as waiting under that credential's Destinations.",
+  "destinationNeed.nonWriterPresave": "Kutrion will refuse this connection until this credential is authorized for this destination. An editor, admin or owner of the vault {vault} can authorize it. It is listed as waiting under that credential's Destinations.",
+  "destinationNeed.badge": "Needs authorization",
+  "destinationNeed.cleartext.ftp": "Plain FTP sends this password unencrypted.",
+  "destinationNeed.cleartext.other": "This connection is not encrypted.",
+  "destinationNeed.cleartext.ftpReaches": "This credential already reaches {host} over {protocols}. Plain FTP sends this password unencrypted.",
+  "destinationNeed.cleartext.otherReaches": "This credential already reaches {host} over {protocols}. This connection is not encrypted.",
+  "destinationNeed.publicLinks": "{count} share link(s) or drop zone(s) on this connection will start working for anyone who holds them.",
+  "destinationNeed.firstClaim": "This is the credential's first destination. After this, Kutrion presents it only to the destinations listed for it.",
+  "authorizeSheet.action": "Authorize this destination",
+  "authorizeSheet.alsoAuthorize": "Also authorize this credential for {target}",
+  "authorizeSheet.typedHint": "Changing where a credential may be sent needs the credential's own value, not just write access to the vault.",
+  "authorizeSheet.secretMismatch": "That is not this credential's current value.",
+  "authorizeSheet.injectOnly": "This credential is injection-only, so it cannot be authorized for a destination here.",
+  "authorizeSheet.unsupported": "This server cannot authorize with the saved value. Enter the value instead.",
+  "authorizeSheet.failed": "This destination could not be authorized.",
+  "waiting.requestedBy": "Requested by {requester} ({role}).",
+  "refreshRefusal.noun.app": "app",
+  "refreshRefusal.noun.browser": "browser",
+  "refreshRefusal.noun.device": "device",
+  "refreshRefusal.signedOut.title": "This session was signed out",
+  "refreshRefusal.refresh_hub_signed_out.why": "You signed out in Kutrion Hub.",
+  "refreshRefusal.refresh_hub_revoked.why": "This {app} was signed out because its Kutrion Hub was removed.",
+  "refreshRefusal.refresh_credentials_changed.title": "Your password changed",
+  "refreshRefusal.refresh_credentials_changed.why": "Your password changed, so Kutrion signed this {app} out.",
+  "refreshRefusal.refresh_credentials_changed.action": "Sign in again with your new password.",
+  "refreshRefusal.device_revoked.title": "This device was signed out",
+  "refreshRefusal.device_revoked.why": "This {app}'s access was withdrawn from your Kutrion account.",
+  "refreshRefusal.device_revoked.action": "Sign in again to re-register it.",
+  "refreshRefusal.account_inactive.title": "This account has ended",
+  "refreshRefusal.account_inactive.why": "Your Kutrion account is no longer active, so this {app} was signed out.",
+  "refreshRefusal.accountEnded.action": "Your administrator can restore it. Signing in again won't work until they do.",
+  "refreshRefusal.account_expired.title": "This account has expired",
+  "refreshRefusal.account_expired.why": "Your Kutrion account has expired, so this {app} was signed out.",
+  "refreshRefusal.org_mismatch.why": "You're no longer a member of the organization this {app} was signed in to.",
+  "refreshRefusal.org_mismatch.action": "Sign in again to continue with your current organization.",
+  "privateTarget.connect.connectorAvailable": "{host} is on a private network, which hosted Kutrion cannot reach directly. Install the Kutrion Connector on that network, or use self-hosted Kutrion.",
+  "privateTarget.connect.connectorPending": "{host} is on a private network, which hosted Kutrion cannot reach directly. Self-hosted Kutrion connects to hosts on private networks by default. The Kutrion Connector is not available yet.",
+  "privateTarget.save.connectorAvailable": "{host} is on a private network, which hosted Kutrion cannot reach directly. Connecting to it will be refused until the Kutrion Connector is installed on that network, or you use self-hosted Kutrion.",
+  "privateTarget.save.connectorPending": "{host} is on a private network, which hosted Kutrion cannot reach directly. Connecting to it will be refused on hosted Kutrion. Self-hosted Kutrion connects to hosts on private networks by default. The Kutrion Connector is not available yet.",
+  "privateTarget.short.connectorAvailable": "{host} is on a private network that hosted Kutrion cannot reach directly. Install the Kutrion Connector there, or use self-hosted Kutrion.",
+  "privateTarget.short.connectorPending": "{host} is on a private network that hosted Kutrion cannot reach directly. Use self-hosted Kutrion; the Kutrion Connector is not available yet.",
+  "privateTarget.orgPolicy": "This organization's policy does not allow connections to {host}. Ask an organization owner or admin."
+};
+var fill = (template, values) => values ? template.replace(/\{(\w+)\}/g, (m, name) => name in values ? String(values[name]) : m) : template;
+var englishT = (key, values) => fill(SECURITY_COPY_EN[key], values);
+function securityCopy(key, t, values) {
+  if (t) {
+    try {
+      const out = t(key, values);
+      if (out && out !== key) return out;
+    } catch {
+    }
   }
+  return englishT(key, values);
+}
+
+// ../packages/shared/src/refresh-refusal-copy.ts
+var CODES = [
+  "refresh_hub_signed_out",
+  "refresh_hub_revoked",
+  "refresh_credentials_changed",
+  "device_revoked",
+  "account_inactive",
+  "user_inactive",
+  "account_expired",
+  "org_mismatch"
+];
+var en = SECURITY_COPY_EN;
+var KEY_CODE = { user_inactive: "account_inactive" };
+var TITLE_KEY = {
+  refresh_hub_signed_out: "signedOut",
+  refresh_hub_revoked: "signedOut",
+  org_mismatch: "signedOut"
+};
+var ACTION_KEY = { account_inactive: "accountEnded", account_expired: "accountEnded" };
+var keyFor = (code, part) => {
+  const base = KEY_CODE[code] ?? code;
+  const shared = part === "title" ? TITLE_KEY[base] : part === "action" ? ACTION_KEY[base] : void 0;
+  return `refreshRefusal.${shared ?? base}.${part}`;
 };
-function refreshRefusalCopy(code, noun = "app") {
+var entry = (code) => {
+  const action = en[keyFor(code, "action")];
+  return { title: en[keyFor(code, "title")], why: en[keyFor(code, "why")], ...action ? { action } : {} };
+};
+var REFRESH_REFUSAL_COPY = Object.fromEntries(
+  CODES.map((code) => [code, entry(code)])
+);
+var NOUNS = ["app", "browser", "device"];
+function refreshRefusalCopy(code, noun = "app", t) {
   if (typeof code !== "string" || !Object.prototype.hasOwnProperty.call(REFRESH_REFUSAL_COPY, code)) return null;
-  const c = REFRESH_REFUSAL_COPY[code];
-  const fill = (s) => s.replace(/\{app\}/g, noun);
-  return { title: c.title, why: fill(c.why), ...c.action ? { action: fill(c.action) } : {} };
+  const key = (part) => keyFor(code, part);
+  const word = NOUNS.includes(noun) ? securityCopy(`refreshRefusal.noun.${noun}`, t) : noun;
+  const values = { app: word };
+  const hasAction = keyFor(code, "action") in SECURITY_COPY_EN;
+  return {
+    title: securityCopy(key("title"), t),
+    why: securityCopy(key("why"), t, values),
+    ...hasAction ? { action: securityCopy(key("action"), t, values) } : {}
+  };
+}
+
+// ../packages/shared/src/private-target-refusal.ts
+init_define_KT_HUB_FILES();
+var CONNECTOR_AVAILABLE = false;
+var privateTargetReason = (v) => v === "org_policy" ? "org_policy" : "deployment";
+function privateTargetKey(surface, reason, connectorAvailable = CONNECTOR_AVAILABLE) {
+  if (reason === "org_policy") return "privateTarget.orgPolicy";
+  const variant = connectorAvailable ? "connectorAvailable" : "connectorPending";
+  return `privateTarget.${surface}.${variant}`;
+}
+function privateTargetSentence(o, t) {
+  return securityCopy(privateTargetKey(o.surface, privateTargetReason(o.reason), o.connectorAvailable), t, { host: o.host });
 }
 
 // ../packages/shared/src/client.ts
@@ -27849,9 +27952,13 @@ async function withTimeout(inner, ms, input, init) {
 var REFRESH_BODY_MS = 3e3;
 var REFRESH_STORE_ATTEMPTS = 3;
 var REFRESH_STORE_TIMEOUT_MS = 1e4;
+var SIGNATURE_REQUIRED_COOLDOWN_MS = 3e4;
 function isRefreshSignatureRefusal(body) {
   const error = body?.error;
-  return error === "bad_signature" || error === "device_key_required";
+  return error === "bad_signature" || error === "device_key_required" || error === "signature_required";
+}
+function isSignatureRequired(body) {
+  return body?.error === "signature_required";
 }
 async function readBodyWithin(res, ms) {
   let timer;
@@ -28010,6 +28117,8 @@ var KutrionClient = class {
   // `next` is presented in its place: `spent` is already rotated, and presenting it reads as reuse.
   heldRefresh = null;
   refreshing = null;
+  // performance.now() time, so a wall-clock step cannot lengthen or cut the cooldown.
+  signatureRequiredUntil = 0;
   // VT-405 (#153): per-session key for decrypting sealed response payloads. Agreed lazily over ECDH
   // and held in memory only (re-agreed on demand after a reload / worker restart).
   sessionKey = null;
@@ -28089,6 +28198,7 @@ var KutrionClient = class {
   async tryRefresh() {
     const rt = this.presentableRefreshToken();
     if (!rt) return { outcome: "no_token" };
+    if (!this.refreshing && performance.now() < this.signatureRequiredUntil) return { outcome: "indeterminate", status: 401 };
     if (!this.refreshing) {
       this.refreshing = (async () => {
         try {
@@ -28110,7 +28220,8 @@ var KutrionClient = class {
           }
           if (res.status === 401) {
             if (refusalBody === void 0) refusalBody = await readBodyWithin(res, REFRESH_BODY_MS);
-            if (signerThrew && !signed.signature && isRefreshSignatureRefusal(refusalBody)) {
+            if (signerThrew && !signed.signature && isRefreshSignatureRefusal(refusalBody) || isSignatureRequired(refusalBody)) {
+              if (!signerThrew && isSignatureRequired(refusalBody)) this.signatureRequiredUntil = performance.now() + SIGNATURE_REQUIRED_COOLDOWN_MS;
               return { outcome: "indeterminate", status: 401 };
             }
             const code = refusalBody?.error;
@@ -28499,7 +28610,10 @@ var KutrionClient = class {
   // losing its keys; the server revokes that row if it is the caller's and ignores it otherwise.
   async registerDevice(input) {
     const reg = await this.req("POST", "/auth/devices/register", input);
-    if (reg.refresh_key_bound) this.refreshSigningRefused = false;
+    if (reg.refresh_key_bound) {
+      this.refreshSigningRefused = false;
+      this.signatureRequiredUntil = 0;
+    }
     return reg;
   }
   // #301: mint a second refresh-token family for an existing device, owned by a companion process
@@ -28523,8 +28637,11 @@ var KutrionClient = class {
     try {
       return await this.req("POST", "/auth/refresh", body, false);
     } catch (e) {
-      if (signerThrew && !body.signature && e instanceof ApiError && e.status === 401 && isRefreshSignatureRefusal(e.body)) {
-        throw new ApiError(0, "signer_unavailable");
+      if (e instanceof ApiError && e.status === 401) {
+        if (isSignatureRequired(e.body) && !signerThrew) throw new ApiError(0, "signature_required");
+        if (signerThrew && !body.signature && isRefreshSignatureRefusal(e.body) || isSignatureRequired(e.body)) {
+          throw new ApiError(0, "signer_unavailable");
+        }
       }
       throw e;
     }
@@ -28544,7 +28661,10 @@ var KutrionClient = class {
       refreshKey ? { device_id: deviceId, signature, refresh_key: refreshKey } : { device_id: deviceId, signature },
       false
     );
-    if (tokens.refresh_key_bound) this.refreshSigningRefused = false;
+    if (tokens.refresh_key_bound) {
+      this.refreshSigningRefused = false;
+      this.signatureRequiredUntil = 0;
+    }
     return tokens;
   }
   // --- local vault cache: keys (#709, epic #708) ---
@@ -28900,16 +29020,25 @@ var KutrionClient = class {
   // `port` omitted means this protocol's default, resolved and stored server-side — NOT a wildcard, and
   // not something to fill in here: a client-supplied default would come back as a chosen port.
   //
-  // `secret` is the credential's current plaintext and is required by design. Write on the vault gates
-  // who may ask; the secret is what makes a repoint cost as much as knowing the credential, which is
-  // the whole point of the control. Injection-only credentials cannot satisfy it and answer 403
-  // `inject_only`; a wrong secret answers 403 `secret_mismatch` and is rate-limited to 429 after 10.
+  // Write on the vault gates who may ask; the proof gates whether they may move the credential. It is
+  // one of two (#3466):
+  //   - `secret`, the credential's current plaintext. A wrong one answers 403 `secret_mismatch` and is
+  //     rate-limited to 429 after 10.
+  //   - `use_saved_value: true`, for a caller who could reveal the value right now. It answers every
+  //     refusal reveal would, plus 403 `step_up_required` without a fresh step-up on this session. An
+  //     older server answers it 400 `invalid_input` with an issue at path ["secret"].
+  // Injection-only credentials satisfy neither and answer 403 `inject_only`. Either proof may answer
+  // 403 `step_up_required` from the adaptive gate, or 403 `device_posture_required`.
   //
   // #1170: `domain` is RDP-only and omitting it means the credential is presented with NO domain — not
   // "any domain". It is the third member of the RDP destination tuple because it selects which
   // directory authenticates the credential, so a binding that omits it does not authorise one that
   // names it. Sent on any other protocol it answers 400 `domain_not_supported`; unexpressible values
   // answer 400 `invalid_domain`.
+  //
+  // #3466: `use_saved_value` in place of `secret` asks the server to vouch for the stored value itself; a
+  // server without that mode answers 400 `invalid_input` on `secret`. `authorizeDestination` below is the
+  // one caller that should choose between the two.
   addCredentialDestination(vaultId, cid, input) {
     return this.req("POST", `/vault/${encodeURIComponent(vaultId)}/credentials/${encodeURIComponent(cid)}/destinations`, input);
   }
@@ -29567,6 +29696,12 @@ var KutrionClient = class {
   listAgentOidcTrusts() {
     return this.req("GET", "/agents/oidc/trusts");
   }
+  createAgentOidcTrust(input) {
+    return this.req("POST", "/agents/oidc/trusts", input);
+  }
+  deleteAgentOidcTrust(id) {
+    return this.req("DELETE", `/agents/oidc/trusts/${encodeURIComponent(id)}`);
+  }
   setAgentOidcTrustResourceScope(id, scope, opts2 = {}) {
     return this.req("PUT", `/agents/oidc/trusts/${encodeURIComponent(id)}/resource-scope`, { ...scope, ...opts2 });
   }
@@ -29693,8 +29828,9 @@ var KutrionClient = class {
   }
   // Pre-flight risk guardrail (#141): a high-risk command 403s with { error: "step_up_required" }
   // until the session completes WebAuthn step-up; retry after stepping up.
-  exec(connId, command) {
-    return this.req("POST", `/ssh/connections/${encodeURIComponent(connId)}/exec`, { command });
+  // #3515: `stdinB64` is streamed to the command and then closed; the server acknowledges it with `stdin`.
+  exec(connId, command, stdinB64) {
+    return this.req("POST", `/ssh/connections/${encodeURIComponent(connId)}/exec`, stdinB64 === void 0 ? { command } : { command, stdin_b64: stdinB64 });
   }
   validateCommand(command) {
     return this.req("POST", "/ssh/validate", { command });
@@ -29711,7 +29847,7 @@ var KutrionClient = class {
    *
    * `rdp.tunnel` is deliberately not mintable here — the RDP broker returns its own on the
    * session-open response (`tunnel.ws_ticket`), and this route refuses the scope so a caller without
-   * the `rdp_broker` entitlement cannot mint against that socket (server/src/modules/ssh.ts:660).
+   * the `rdp_broker` entitlement cannot mint against that socket (server/src/modules/ssh.ts:665).
    */
   mintWsTicket(scope, resourceId) {
     return this.req(
@@ -30113,9 +30249,20 @@ var KutrionClient = class {
   listFileConnections() {
     return this.req("GET", "/files/connections");
   }
+  // #3466: what a create with these fields would report as `destination_need`, before creating it.
+  // `connection_id` counts the public links on that connection, and only when it is the caller's own.
+  // `secure` is optional and defaults as create does: true only when protocol is WEBDAV.
+  fileConnectionDestinationNeed(q) {
+    const qs = new URLSearchParams({ credential_id: q.credential_id, protocol: q.protocol, port: String(q.port) });
+    if (q.host !== void 0) qs.set("host", q.host);
+    if (q.secure !== void 0) qs.set("secure", String(q.secure));
+    if (q.connection_id !== void 0) qs.set("connection_id", q.connection_id);
+    return this.req("GET", `/files/connections/destination-need?${qs}`);
+  }
   createFileConnection(input) {
     return this.req("POST", "/files/connections", input);
   }
+  // #3456: `username: null` switches the connection to inherit the credential's username.
   updateFileConnection(id, input) {
     return this.req("PATCH", `/files/connections/${encodeURIComponent(id)}`, input);
   }
@@ -30332,6 +30479,10 @@ var KutrionClient = class {
   patchTransferJob(id, input) {
     return this.req("PATCH", `/files/jobs/${encodeURIComponent(id)}`, input);
   }
+  // #3549: cancel a queued or running job. A finished one answers 409 not_active.
+  cancelTransferJob(id) {
+    return this.req("POST", `/files/jobs/${encodeURIComponent(id)}/cancel`, {});
+  }
   // #563: recurring transfer schedules (interval or daily UTC time).
   createSchedule(input) {
     return this.req("POST", "/files/schedules", input);
@@ -30958,50 +31109,65 @@ function parseDestinationRefusal(body) {
     reason: DESTINATION_REFUSAL_REASONS.includes(b.reason) ? b.reason : null
   };
 }
-var DESTINATION_REFUSAL_TITLE = "Destination not authorized";
-var subject = (r) => r.credential ? `the credential "${r.credential}"` : "this credential";
-function destinationRefusalSummary(r) {
-  const where = r.side === "source" ? " as the source of this transfer" : r.side === "dest" ? " as the destination of this transfer" : "";
-  return `Kutrion did not connect to ${r.destination}${where} and did not send ${subject(r)}.`;
-}
-function destinationRefusalAllowedLabel(r) {
-  if (r.allowedDestinations.length) return "It may be presented to these destinations only:";
-  if (r.detail) return r.detail;
-  return destinationRefusalFault(r) === "kutrion" ? "Kutrion could not check where this credential may be presented." : "No authorized destinations are recorded for this credential.";
-}
-var DESTINATION_REFUSAL_ACTION = "Where this credential may be presented is set on the credential itself. Changing it needs write access to the vault holding the credential, and the credential's current value.";
-var DESTINATION_REFUSAL_NOT_A_REMEDY = "Re-entering the credential's value here does not change where it may be presented.";
-var DESTINATION_REFUSAL_FAULT_TITLE = "This destination could not be checked";
-var DESTINATION_REFUSAL_FAULT_ACTION = "This is a fault in Kutrion, not a permission you are missing. No change to the credential or the connection will resolve it. Report it with the time, the connection and the destination shown above.";
-var DESTINATION_REFUSAL_CONNECTION_TITLE = "This destination cannot be authorized as written";
-var DESTINATION_REFUSAL_HOST_ACTION = "The host recorded on this connection cannot be expressed as an authorized destination, so no entry on the credential can match it. A destination host must be a plain ASCII hostname, an IPv4 address, or an IPv6 address in square brackets, and must not carry a scheme, a port, a user name or a path. Correct the host on the connection, then authorize the corrected destination on the credential.";
-var DESTINATION_REFUSAL_DOMAIN_ACTION = "The Windows domain recorded on this connection cannot be expressed as an authorized destination, so no entry on the credential can match it. A domain must be a plain ASCII name, either a short name such as CORP or a full name such as corp.example.com, entered on its own without a backslash, a user name or an address, or left empty if this host does not use one. Correct the domain on the connection, then authorize the corrected destination on the credential.";
-function destinationRefusalTitle(r) {
+var DESTINATION_REFUSAL_TITLE = SECURITY_COPY_EN["destinationRefusal.title"];
+var usSpelling = (s) => s.replace(/\b(A|a)uthoris/g, "$1uthoriz");
+function destinationRefusalSummary(r, t) {
+  const side = r.side === "source" ? "Source" : r.side === "dest" ? "Dest" : "";
+  const key = `destinationRefusal.summary.${r.credential ? "named" : "unnamed"}${side}`;
+  return securityCopy(key, t, { destination: r.destination, credential: r.credential ?? "" });
+}
+function destinationRefusalAllowedLabel(r, t) {
+  if (r.allowedDestinations.length) return securityCopy("destinationRefusal.allowed.list", t);
+  if (r.detail) return usSpelling(r.detail);
+  return securityCopy(destinationRefusalFault(r) === "kutrion" ? "destinationRefusal.allowed.noneFault" : "destinationRefusal.allowed.none", t);
+}
+var DESTINATION_REFUSAL_ACTION = SECURITY_COPY_EN["destinationRefusal.action.allowList"];
+var isAllowListRemedy = (r) => r.reason !== "host_not_normalizable" && r.reason !== "domain_not_normalizable" && destinationRefusalFault(r) !== "kutrion";
+var DESTINATION_REFUSAL_NOT_A_REMEDY = SECURITY_COPY_EN["destinationRefusal.notARemedy"];
+var DESTINATION_REFUSAL_FAULT_TITLE = SECURITY_COPY_EN["destinationRefusal.title.fault"];
+var DESTINATION_REFUSAL_FAULT_ACTION = SECURITY_COPY_EN["destinationRefusal.action.fault"];
+var DESTINATION_REFUSAL_CONNECTION_TITLE = SECURITY_COPY_EN["destinationRefusal.title.connection"];
+var DESTINATION_REFUSAL_HOST_ACTION = SECURITY_COPY_EN["destinationRefusal.action.host"];
+var DESTINATION_REFUSAL_DOMAIN_ACTION = SECURITY_COPY_EN["destinationRefusal.action.domain"];
+function destinationRefusalTitle(r, t) {
   if (r.reason === "host_not_normalizable" || r.reason === "domain_not_normalizable") {
-    return DESTINATION_REFUSAL_CONNECTION_TITLE;
+    return securityCopy("destinationRefusal.title.connection", t);
   }
-  return destinationRefusalFault(r) === "kutrion" ? DESTINATION_REFUSAL_FAULT_TITLE : DESTINATION_REFUSAL_TITLE;
+  return securityCopy(destinationRefusalFault(r) === "kutrion" ? "destinationRefusal.title.fault" : "destinationRefusal.title", t);
 }
-function destinationRefusalAction(r) {
-  if (r.reason === "host_not_normalizable") return DESTINATION_REFUSAL_HOST_ACTION;
-  if (r.reason === "domain_not_normalizable") return DESTINATION_REFUSAL_DOMAIN_ACTION;
-  return destinationRefusalFault(r) === "kutrion" ? DESTINATION_REFUSAL_FAULT_ACTION : DESTINATION_REFUSAL_ACTION;
+function destinationRefusalAction(r, o, t) {
+  if (o?.inlineAction && isAllowListRemedy(r)) return securityCopy("destinationRefusal.action.authorizeBelow", t);
+  if (r.reason === "host_not_normalizable") return securityCopy("destinationRefusal.action.host", t);
+  if (r.reason === "domain_not_normalizable") return securityCopy("destinationRefusal.action.domain", t);
+  return securityCopy(destinationRefusalFault(r) === "kutrion" ? "destinationRefusal.action.fault" : "destinationRefusal.action.allowList", t);
 }
-function destinationRefusalLines(r, indent = "  ") {
+function destinationRefusalLines(r, indent = "  ", t) {
   return [
-    destinationRefusalTitle(r),
+    destinationRefusalTitle(r, t),
     "",
-    destinationRefusalSummary(r),
+    destinationRefusalSummary(r, t),
     "",
-    destinationRefusalAllowedLabel(r),
+    destinationRefusalAllowedLabel(r, t),
     ...r.allowedDestinations.map((d) => `${indent}${d}`),
     "",
-    destinationRefusalAction(r),
+    destinationRefusalAction(r, void 0, t),
     // Only true of a refusal that turned on where the credential may go. On a fault of ours the secret
     // was never the subject, and the line reads as one more thing the user got wrong.
-    ...destinationRefusalFault(r) === "kutrion" ? [] : [DESTINATION_REFUSAL_NOT_A_REMEDY]
+    ...destinationRefusalFault(r) === "kutrion" ? [] : [securityCopy("destinationRefusal.notARemedy", t)]
   ];
 }
+var TLS_DOWNGRADE_REFUSAL_TITLE = SECURITY_COPY_EN["tlsDowngrade.title"];
+var TLS_DOWNGRADE_REFUSAL_SUMMARY = SECURITY_COPY_EN["tlsDowngrade.summary"];
+var TLS_DOWNGRADE_REFUSAL_ACTION = SECURITY_COPY_EN["tlsDowngrade.action"];
+var DESTINATION_NEED_BADGE = SECURITY_COPY_EN["destinationNeed.badge"];
+var DESTINATION_REFUSAL_AUTHORIZE_BELOW = SECURITY_COPY_EN["destinationRefusal.action.authorizeBelow"];
+var DESTINATION_AUTHORIZE_ACTION = SECURITY_COPY_EN["authorizeSheet.action"];
+var DESTINATION_TYPED_HINT = SECURITY_COPY_EN["authorizeSheet.typedHint"];
+var DESTINATION_SECRET_MISMATCH = SECURITY_COPY_EN["authorizeSheet.secretMismatch"];
+var DESTINATION_INJECT_ONLY = SECURITY_COPY_EN["authorizeSheet.injectOnly"];
+var DESTINATION_UNSUPPORTED = SECURITY_COPY_EN["authorizeSheet.unsupported"];
+var DESTINATION_FAILED = SECURITY_COPY_EN["authorizeSheet.failed"];
+var DESTINATION_FIRST_CLAIM_WARNING = SECURITY_COPY_EN["destinationNeed.firstClaim"];
 
 // ../packages/shared/src/credential-size-refusal.ts
 init_define_KT_HUB_FILES();
@@ -31163,6 +31329,16 @@ function platformFlagRefusalText(code) {
   return code && Object.prototype.hasOwnProperty.call(PLATFORM_FLAG_REFUSAL_COPY, code) ? PLATFORM_FLAG_REFUSAL_COPY[code] : null;
 }
 
+// ../packages/shared/src/remote-auth-refusal.ts
+init_define_KT_HUB_FILES();
+var REMOTE_AUTH_FAILED_TEXT = "The server rejected the sign-in. Check the username and password or access key saved for this connection.";
+var BASIC_OVER_HTTP_REFUSED_TEXT = "Kutrion did not send the password. The server did not offer a protected sign-in over this unencrypted connection, so the password would have been readable to anyone on the network path.";
+var BASIC_AFTER_DIGEST_REFUSED_TEXT = "Kutrion did not send the password. This server asked for Digest sign-in earlier and now asks for Basic, which would expose the password.";
+var PLAIN_HTTP_OPT_IN_LABEL = "Allow sign-in over plain HTTP";
+var BASIC_OVER_HTTP_REFUSED_NEXT = `Switch this connection to HTTPS, or tick "${PLAIN_HTTP_OPT_IN_LABEL}" on it.`;
+var CREDENTIAL_CONTROL_CHARS_TEXT = "Kutrion did not send the sign-in. The username or password saved for this connection contains a line break or NUL character, which this protocol cannot carry.";
+var CREDENTIAL_CONTROL_CHARS_NEXT = "Edit the credential in the vault so it has no line break, then open the connection again.";
+
 // ../packages/shared/src/ssh-refusal.ts
 init_define_KT_HUB_FILES();
 var SSH_REFUSAL_CLASSIFICATION = {
@@ -31408,12 +31584,12 @@ function parseJumpRefusal(body) {
   const code = str4(b.code) ?? str4(b.error);
   if (!isJumpRefusalCode(code)) return null;
   const nested = b.detail && typeof b.detail === "object" ? b.detail : {};
-  const pick2 = (k) => b[k] !== void 0 ? b[k] : nested[k];
-  const idx = pick2("hop_index");
-  const allowed = pick2("allowed_destinations");
+  const pick3 = (k) => b[k] !== void 0 ? b[k] : nested[k];
+  const idx = pick3("hop_index");
+  const allowed = pick3("allowed_destinations");
   return {
     code,
-    hopConnectionId: str4(pick2("hop_connection_id")),
+    hopConnectionId: str4(pick3("hop_connection_id")),
     hopIndex: typeof idx === "number" && Number.isFinite(idx) ? idx : null,
     detail: typeof b.detail === "string" ? str4(b.detail) : str4(nested.detail) ?? str4(b.error_description),
     allowedDestinations: Array.isArray(allowed) ? allowed.filter((x) => typeof x === "string" && x.trim() !== "") : null
@@ -31472,12 +31648,12 @@ function parseJumpHostInUse(body) {
 var JUMP_HOST_IN_USE_TITLE = "Other connections are reached through this one";
 function jumpHostInUseSummary(r, deletingName) {
   const name = str4(deletingName);
-  const subject2 = name ? `\u201C${name}\u201D` : "this connection";
+  const subject = name ? `\u201C${name}\u201D` : "this connection";
   const n = r.usedBy.length;
   if (!n) {
-    return `${subject2} is used as a jump host by other connections, so deleting it would leave them with no route.`;
+    return `${subject} is used as a jump host by other connections, so deleting it would leave them with no route.`;
   }
-  return `${subject2} is the jump host for ${n === 1 ? "another connection" : `${n} other connections`}. Deleting it would leave ` + (n === 1 ? "it" : "them") + " with no route to the target, so it was not deleted.";
+  return `${subject} is the jump host for ${n === 1 ? "another connection" : `${n} other connections`}. Deleting it would leave ` + (n === 1 ? "it" : "them") + " with no route to the target, so it was not deleted.";
 }
 var JUMP_HOST_IN_USE_ACTION = "Point each of these at a different jump host, or clear the jump host to reach it directly, and then delete this connection.";
 
@@ -32567,6 +32743,12 @@ function subtle() {
   if (!s || typeof globalThis.crypto.getRandomValues !== "function") throw new VaultKeyError("crypto_unavailable");
   return s;
 }
+var random = (n) => globalThis.crypto.getRandomValues(new Uint8Array(n));
+function toB64(bytes) {
+  let s = "";
+  for (const b of bytes) s += String.fromCharCode(b);
+  return btoa(s);
+}
 function fromB64(b64) {
   const s = atob(b64);
   const out = new Uint8Array(s.length);
@@ -32612,6 +32794,10 @@ async function derivePassphraseKek(passphrase, kdf, onProgress) {
     out.fill(0);
   }
 }
+function generateVaultKey() {
+  subtle();
+  return random(VAULT_KEY_BYTES);
+}
 async function unwrapVaultKey(wrap, kek, purpose) {
   let bytes;
   try {
@@ -32647,6 +32833,15 @@ async function unlockVaultKey(record, passphrase, onProgress) {
 }
 var dataKeyAad = (vaultId) => enc.encode(`kutrion-vault-key-v1:data-key:${vaultId.toLowerCase()}`);
 var TAG_BYTES = TAG_BITS / 8;
+async function wrapVaultDataKey(dataKey, vaultKey, vaultId) {
+  if (dataKey.length !== VAULT_KEY_BYTES) throw new VaultKeyError("malformed_wrap", "A vault data key is 32 bytes.");
+  const iv = random(IV_BYTES);
+  const ct = new Uint8Array(await subtle().encrypt({ name: "AES-GCM", iv: bs2(iv), additionalData: bs2(dataKeyAad(vaultId)), tagLength: TAG_BITS }, vaultKey, bs2(dataKey)));
+  const out = new Uint8Array(IV_BYTES + ct.length);
+  out.set(iv, 0);
+  out.set(ct, IV_BYTES);
+  return toB64(out);
+}
 async function unwrapVaultDataKey(wrap, vaultKey, vaultId) {
   let bytes;
   try {
@@ -32670,6 +32865,14 @@ async function unwrapVaultDataKey(wrap, vaultKey, vaultId) {
   }
 }
 var itemAad = (vaultId, itemId, purpose) => enc.encode(`kutrion-vault-key-v1:item:${vaultId.toLowerCase()}:${itemId.toLowerCase()}${purpose ? `:${purpose}` : ""}`);
+async function sealItemField(dataKey, plaintext, vaultId, itemId, purpose) {
+  const iv = random(IV_BYTES);
+  const ctTag = new Uint8Array(await subtle().encrypt({ name: "AES-GCM", iv: bs2(iv), additionalData: bs2(itemAad(vaultId, itemId, purpose)), tagLength: TAG_BITS }, dataKey, bs2(enc.encode(plaintext))));
+  const blob = new Uint8Array(ctTag.length);
+  blob.set(ctTag.subarray(ctTag.length - TAG_BYTES), 0);
+  blob.set(ctTag.subarray(0, ctTag.length - TAG_BYTES), TAG_BYTES);
+  return { iv: toB64(iv), blob: toB64(blob) };
+}
 async function openItemField(dataKey, iv, blob, vaultId, itemId, purpose) {
   let ivBytes, b;
   try {
@@ -32728,6 +32931,40 @@ async function openPrivateItem(item, sealed, vaultKey) {
   ]);
   return { value: value ?? "", notes, custom_fields: fields ? JSON.parse(fields) : [], passphrase, totp };
 }
+async function privateItemDataKey(current, vaultKey, vaultId, enrolledAt) {
+  if (current) {
+    return { dataKey: await unwrapVaultDataKey(current.client_wrapped_data_key, vaultKey, vaultId), key: { key_id: current.key_id } };
+  }
+  const raw = generateVaultKey();
+  try {
+    const [client_wrapped_data_key, dataKey] = await Promise.all([
+      wrapVaultDataKey(raw, vaultKey, vaultId),
+      subtle().importKey("raw", bs2(raw), { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"])
+    ]);
+    return { dataKey, key: { client_wrapped_data_key, vault_key_created_at: enrolledAt } };
+  } finally {
+    raw.fill(0);
+  }
+}
+async function sealPrivateItem(item, plain, dataKey) {
+  const seal = (s, purpose) => sealItemField(dataKey, s, item.vault_id, item.id, purpose);
+  const opt = async (s, purpose) => s === void 0 ? void 0 : s === null || s === "" ? null : seal(s, purpose);
+  const fields = plain.custom_fields === void 0 ? void 0 : plain.custom_fields && plain.custom_fields.length ? JSON.stringify(plain.custom_fields) : null;
+  const [value, notes, custom_fields, passphrase, totp] = await Promise.all([
+    plain.value === void 0 ? void 0 : seal(plain.value),
+    opt(plain.notes),
+    opt(fields),
+    opt(plain.passphrase),
+    opt(plain.totp?.trim() ?? plain.totp, "totp")
+  ]);
+  const out = {};
+  if (value !== void 0) out.value = value;
+  if (notes !== void 0) out.notes = notes;
+  if (custom_fields !== void 0) out.custom_fields = custom_fields;
+  if (passphrase !== void 0) out.passphrase = passphrase;
+  if (totp !== void 0) out.totp = totp;
+  return out;
+}
 
 // ../packages/shared/src/private-vault-copy.ts
 init_define_KT_HUB_FILES();
@@ -32812,6 +33049,7 @@ var PRIVATE_VAULT_COPY = {
 
 // src/args.ts
 init_define_KT_HUB_FILES();
+var REPEATABLE = /* @__PURE__ */ new Set(["vault", "connection", "scope-vault", "scope-conn"]);
 function parseForwardSpec(spec) {
   const m = spec.match(/^(\d{1,5}):(.+):(\d{1,5})$/);
   if (!m) return null;
@@ -32823,10 +33061,12 @@ function parseForwardSpec(spec) {
   return { localPort, dstHost, dstPort };
 }
 var GLOBAL_FLAGS = { base: "value", json: "boolean" };
-var SWITCHES = /* @__PURE__ */ new Set(["browser", "reveal", "password-stdin", "value-stdin", "vault-passphrase-stdin", "fallback", "dry-run"]);
+var SWITCHES = /* @__PURE__ */ new Set(["browser", "reveal", "password-stdin", "value-stdin", "vault-passphrase-stdin", "fallback", "dry-run", "allow-insecure-lan", "stdin"]);
 var KNOWN_FLAGS = /* @__PURE__ */ new Set([
   "action",
   "agent-forward",
+  "allow-insecure-lan",
+  "audience",
   "base",
   "browser",
   "client",
@@ -32838,6 +33078,7 @@ var KNOWN_FLAGS = /* @__PURE__ */ new Set([
   "conflict",
   "conn",
   "conns",
+  "connection",
   "cred",
   "current",
   "daily-at",
@@ -32853,7 +33094,9 @@ var KNOWN_FLAGS = /* @__PURE__ */ new Set([
   "fingerprint",
   "format",
   "from",
+  "help",
   "host",
+  "issuer",
   "insert",
   "intent",
   "json",
@@ -32890,12 +33133,16 @@ var KNOWN_FLAGS = /* @__PURE__ */ new Set([
   "reveal",
   "role",
   "scope",
+  "scope-conn",
+  "scope-vault",
   "scopes",
   "secret",
   "service",
   "session",
   "since",
   "status",
+  "stdin",
+  "subject",
   "target",
   "throttle",
   "timeout",
@@ -32913,13 +33160,22 @@ var KNOWN_FLAGS = /* @__PURE__ */ new Set([
   "verify",
   "views",
   "wait",
+  "write-env",
   "yes"
 ]);
 function unknownFlags(flags) {
   return Object.keys(flags).filter((k) => !KNOWN_FLAGS.has(k));
 }
+function repeatedFlag(argv2, name) {
+  const out = [];
+  for (let i = 0; i < argv2.length - 1; i++) {
+    if (argv2[i] === `--${name}` && !argv2[i + 1].startsWith("--")) out.push(argv2[i + 1]);
+  }
+  return out;
+}
 function parseArgs(argv2) {
   const flags = {};
+  const multi = {};
   let at = 0;
   while (at < argv2.length && argv2[at].startsWith("--")) {
     const key = argv2[at].slice(2);
@@ -32937,13 +33193,19 @@ function parseArgs(argv2) {
   const cmd = argv2[at];
   const rest = argv2.slice(at + 1);
   const positionals = [];
+  if (cmd === "exec") return { cmd, positionals: parseExecArgs(rest, flags), flags, multi };
   for (let i = 0; i < rest.length; i++) {
     const a = rest[i];
+    if (a === "--") {
+      positionals.push(...rest.slice(i + 1));
+      break;
+    }
     if (a.startsWith("--")) {
       const key = a.slice(2);
       const next = rest[i + 1];
       if (!SWITCHES.has(key) && next !== void 0 && !next.startsWith("--")) {
         flags[key] = next;
+        if (REPEATABLE.has(key)) (multi[key] ??= []).push(next);
         i++;
       } else {
         flags[key] = true;
@@ -32952,7 +33214,134 @@ function parseArgs(argv2) {
       positionals.push(a);
     }
   }
-  return { cmd: cmd ?? "help", positionals, flags };
+  return { cmd: cmd ?? "help", positionals, flags, multi };
+}
+function parseExecArgs(rest, flags) {
+  const positionals = [];
+  let i = 0;
+  for (; i < rest.length; i++) {
+    const a = rest[i];
+    if (a === "--") {
+      i++;
+      if (positionals.length) break;
+      continue;
+    }
+    if (a.startsWith("--")) {
+      const key = a.slice(2);
+      const next = rest[i + 1];
+      if (!SWITCHES.has(key) && key !== "json" && next !== void 0 && !next.startsWith("--")) {
+        flags[key] = next;
+        i++;
+      } else {
+        flags[key] = true;
+      }
+    } else if (!positionals.length) {
+      positionals.push(a);
+    } else {
+      break;
+    }
+  }
+  positionals.push(...rest.slice(i));
+  return positionals;
+}
+
+// src/base-fallback.ts
+init_define_KT_HUB_FILES();
+var import_fs2 = require("fs");
+var norm = (u) => u.trim().replace(/\/+$/, "");
+function splitBases(parts) {
+  const out = [];
+  for (const p of parts) for (const raw of p.split(",")) {
+    const u = norm(raw);
+    if (u && !out.includes(u)) out.push(u);
+  }
+  return out;
+}
+function fallbackRefusal(f) {
+  let u;
+  try {
+    u = new URL(f.url);
+  } catch {
+    return `not a valid server URL: ${f.url}`;
+  }
+  if (u.protocol === "https:") return null;
+  if (u.protocol === "http:") {
+    return f.insecure ? null : `${f.url} is plain http; credentials would cross it unencrypted. Use https, or opt this base in with --allow-insecure-lan`;
+  }
+  return `unsupported scheme for ${f.url}`;
+}
+var CONNECTION_CODES = /* @__PURE__ */ new Set([
+  "ECONNREFUSED",
+  "ECONNRESET",
+  "ENOTFOUND",
+  "EAI_AGAIN",
+  "ETIMEDOUT",
+  "EHOSTUNREACH",
+  "ENETUNREACH",
+  "EHOSTDOWN",
+  "UND_ERR_CONNECT_TIMEOUT",
+  "UND_ERR_SOCKET"
+]);
+function isConnectionFailure(e) {
+  for (let cur = e, depth = 0; cur && depth < 4; cur = cur.cause, depth++) {
+    if (typeof cur.code === "string" && CONNECTION_CODES.has(cur.code)) return true;
+    if (cur.name === "TimeoutError") return true;
+  }
+  return false;
+}
+var isEdgeFailure = (status) => status >= 520 && status <= 529;
+var replayable = (b) => b == null || typeof b === "string" || b instanceof URLSearchParams || b instanceof ArrayBuffer || ArrayBuffer.isView(b);
+function fallbackFetch(inner, primary, fallbacks, warn = (l) => console.error(l)) {
+  const p = norm(primary);
+  const bases = [{ url: p }];
+  for (const f of fallbacks) {
+    const why2 = fallbackRefusal(f);
+    if (why2) {
+      warn(`warning: ignoring fallback base: ${why2}`);
+      continue;
+    }
+    if (norm(f.url) !== p) bases.push({ ...f, url: norm(f.url) });
+  }
+  if (bases.length === 1) return inner;
+  let sticky = 0;
+  return async (input, init) => {
+    const url = typeof input === "string" ? input : input instanceof URL ? input.href : null;
+    if (url === null || !(url === p || url.startsWith(`${p}/`) || url.startsWith(`${p}?`)) || !replayable(init?.body)) {
+      return inner(input, init);
+    }
+    const suffix = url.slice(p.length);
+    const order = [sticky, ...bases.map((_, i) => i).filter((i) => i !== sticky)];
+    let firstErr;
+    for (let n = 0; n < order.length; n++) {
+      const i = order[n];
+      const b = bases[i];
+      if (b.insecure) warn(`warning: ${b.url} is plain http (opted in with --allow-insecure-lan); this request, with its credentials, is not encrypted`);
+      const more = n < order.length - 1;
+      try {
+        const res = await inner(b.url + suffix, init);
+        if (isEdgeFailure(res.status) && more) {
+          firstErr ??= new Error(`${b.url} answered ${res.status}`);
+          continue;
+        }
+        if (!isEdgeFailure(res.status)) sticky = i;
+        return res;
+      } catch (e) {
+        if (init?.signal?.aborted || !isConnectionFailure(e)) throw e;
+        firstErr ??= e;
+        if (!more) throw firstErr;
+      }
+    }
+    throw firstErr;
+  };
+}
+function readFallbacks(configPath, base) {
+  try {
+    const f = JSON.parse((0, import_fs2.readFileSync)(configPath, "utf8"));
+    if (typeof f.base !== "string" || norm(f.base) !== norm(base) || !Array.isArray(f.fallbacks)) return [];
+    return f.fallbacks.filter((x) => x && typeof x.url === "string").map((x) => ({ url: norm(x.url), ...x.insecure === true ? { insecure: true } : {} }));
+  } catch {
+    return [];
+  }
 }
 
 // src/history.ts
@@ -33005,7 +33394,7 @@ function exitForStatus(status) {
 init_define_KT_HUB_FILES();
 var import_child_process2 = require("child_process");
 var import_crypto = require("crypto");
-var import_fs2 = require("fs");
+var import_fs3 = require("fs");
 var import_os = require("os");
 var import_path2 = require("path");
 
@@ -33103,7 +33492,7 @@ function run(bin, args, store, verb, input) {
 var SECRET_TOOL_DIRS = ["/usr/bin", "/bin", "/usr/local/bin", "/run/current-system/sw/bin"];
 var isExecutable = (p) => {
   try {
-    (0, import_fs2.accessSync)(p, import_fs2.constants.X_OK);
+    (0, import_fs3.accessSync)(p, import_fs3.constants.X_OK);
     return true;
   } catch {
     return false;
@@ -33222,7 +33611,7 @@ function why(r, ...secrets) {
 function fileStore(file = FILE) {
   let raw;
   try {
-    raw = (0, import_fs2.readFileSync)(file, "utf8");
+    raw = (0, import_fs3.readFileSync)(file, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return {};
     throw new Error(`cannot read the token file ${file}: ${e.message}`);
@@ -33239,9 +33628,9 @@ function fileStore(file = FILE) {
 var dirLocked = false;
 function ensureFileDir() {
   const dir = (0, import_path2.dirname)(FILE);
-  (0, import_fs2.mkdirSync)(dir, { recursive: true, mode: 448 });
+  (0, import_fs3.mkdirSync)(dir, { recursive: true, mode: 448 });
   if ((0, import_os.platform)() !== "win32") try {
-    (0, import_fs2.chmodSync)(dir, 448);
+    (0, import_fs3.chmodSync)(dir, 448);
   } catch {
   }
   else if (!dirLocked) {
@@ -33270,32 +33659,32 @@ function withLockFile(lock, fn, afterJudge) {
   const deadline = Date.now() + LOCK_WAIT_MS;
   for (; ; ) {
     try {
-      const fd = (0, import_fs2.openSync)(lock, "wx", 384);
+      const fd = (0, import_fs3.openSync)(lock, "wx", 384);
       try {
-        (0, import_fs2.writeSync)(fd, owner);
+        (0, import_fs3.writeSync)(fd, owner);
       } finally {
-        (0, import_fs2.closeSync)(fd);
+        (0, import_fs3.closeSync)(fd);
       }
       break;
     } catch (e) {
       const code = e.code;
       if (code !== "EEXIST" && code !== "EPERM" && code !== "EACCES") throw e;
-      if (code !== "EEXIST" && !(0, import_fs2.existsSync)(lock)) throw new Error(`cannot write ${(0, import_path2.dirname)(lock)}: ${e.message}`);
+      if (code !== "EEXIST" && !(0, import_fs3.existsSync)(lock)) throw new Error(`cannot write ${(0, import_path2.dirname)(lock)}: ${e.message}`);
       try {
-        if (Date.now() - (0, import_fs2.statSync)(lock).mtimeMs > LOCK_STALE_MS) {
-          const judged = (0, import_fs2.readFileSync)(lock, "utf8");
+        if (Date.now() - (0, import_fs3.statSync)(lock).mtimeMs > LOCK_STALE_MS) {
+          const judged = (0, import_fs3.readFileSync)(lock, "utf8");
           afterJudge?.();
           const gone = `${lock}.${process.pid}.${(0, import_crypto.randomBytes)(4).toString("hex")}`;
-          (0, import_fs2.renameSync)(lock, gone);
-          if ((0, import_fs2.readFileSync)(gone, "utf8") === judged) {
-            (0, import_fs2.rmSync)(gone, { force: true });
+          (0, import_fs3.renameSync)(lock, gone);
+          if ((0, import_fs3.readFileSync)(gone, "utf8") === judged) {
+            (0, import_fs3.rmSync)(gone, { force: true });
             continue;
           }
           try {
-            (0, import_fs2.linkSync)(gone, lock);
+            (0, import_fs3.linkSync)(gone, lock);
           } catch {
           }
-          (0, import_fs2.rmSync)(gone, { force: true });
+          (0, import_fs3.rmSync)(gone, { force: true });
         }
       } catch {
       }
@@ -33307,7 +33696,7 @@ function withLockFile(lock, fn, afterJudge) {
     return fn();
   } finally {
     try {
-      if ((0, import_fs2.readFileSync)(lock, "utf8") === owner) (0, import_fs2.rmSync)(lock, { force: true });
+      if ((0, import_fs3.readFileSync)(lock, "utf8") === owner) (0, import_fs3.rmSync)(lock, { force: true });
     } catch {
     }
   }
@@ -33316,10 +33705,10 @@ var withFileLock = (fn) => withLockFile(`${FILE}.lock`, fn);
 function sweepStaleTemps(file) {
   const dir = (0, import_path2.dirname)(file), prefix = `${(0, import_path2.basename)(file)}.`;
   try {
-    for (const n of (0, import_fs2.readdirSync)(dir)) {
+    for (const n of (0, import_fs3.readdirSync)(dir)) {
       if (!n.startsWith(prefix) || !n.endsWith(".tmp")) continue;
       try {
-        if (Date.now() - (0, import_fs2.statSync)((0, import_path2.join)(dir, n)).mtimeMs > LOCK_STALE_MS) (0, import_fs2.rmSync)((0, import_path2.join)(dir, n), { force: true });
+        if (Date.now() - (0, import_fs3.statSync)((0, import_path2.join)(dir, n)).mtimeMs > LOCK_STALE_MS) (0, import_fs3.rmSync)((0, import_path2.join)(dir, n), { force: true });
       } catch {
       }
     }
@@ -33329,16 +33718,16 @@ function sweepStaleTemps(file) {
 function writeFileStore(store) {
   const tmp = `${FILE}.${process.pid}.${(0, import_crypto.randomBytes)(6).toString("hex")}.tmp`;
   try {
-    (0, import_fs2.closeSync)((0, import_fs2.openSync)(tmp, "wx", 384));
+    (0, import_fs3.closeSync)((0, import_fs3.openSync)(tmp, "wx", 384));
     if ((0, import_os.platform)() === "win32") lockDownWin(tmp, "file");
     else try {
-      (0, import_fs2.chmodSync)(tmp, 384);
+      (0, import_fs3.chmodSync)(tmp, 384);
     } catch {
     }
-    (0, import_fs2.writeFileSync)(tmp, JSON.stringify(store));
+    (0, import_fs3.writeFileSync)(tmp, JSON.stringify(store));
     for (let i = 0; ; i++) {
       try {
-        (0, import_fs2.renameSync)(tmp, FILE);
+        (0, import_fs3.renameSync)(tmp, FILE);
         break;
       } catch (e) {
         const code = e.code;
@@ -33347,7 +33736,7 @@ function writeFileStore(store) {
       }
     }
   } catch (e) {
-    (0, import_fs2.rmSync)(tmp, { force: true });
+    (0, import_fs3.rmSync)(tmp, { force: true });
     throw e;
   }
 }
@@ -33358,7 +33747,7 @@ function updateFileStore(mutate) {
     const store = fileStore();
     if (!mutate(store)) return;
     if (Object.keys(store).length) writeFileStore(store);
-    else (0, import_fs2.rmSync)(FILE, { force: true });
+    else (0, import_fs3.rmSync)(FILE, { force: true });
   });
 }
 function dropFileEntry(base) {
@@ -34980,9 +35369,9 @@ function installLocationFromRegistry(regOutput) {
 }
 function underInstallRoot(dir, roots) {
   if (!import_node_path3.win32.isAbsolute(dir)) return false;
-  const norm = (p) => import_node_path3.win32.resolve(p).toLowerCase().replace(/[\\/]+$/, "");
-  const d = norm(dir);
-  return roots.some((r) => r && import_node_path3.win32.isAbsolute(r) && d.startsWith(norm(r) + "\\"));
+  const norm2 = (p) => import_node_path3.win32.resolve(p).toLowerCase().replace(/[\\/]+$/, "");
+  const d = norm2(dir);
+  return roots.some((r) => r && import_node_path3.win32.isAbsolute(r) && d.startsWith(norm2(r) + "\\"));
 }
 function hubLauncher(env = {}) {
   const platform3 = env.platform ?? process.platform;
@@ -35134,13 +35523,14 @@ var host = () => (0, import_os3.hostname)().trim().replace(/\.local$/, "") || "t
 var ownDeviceName = () => `Kutrion CLI on ${host()}`.slice(0, 255);
 async function registerOwnDevice(deps) {
   const tty = deps.tty ?? Boolean(process.stdin.isTTY && process.stderr.isTTY);
-  if (seedSkipReason(deps.env ?? process.env, deps.platform ?? process.platform, tty)) return { kind: "skipped", note: null };
+  const previous = deps.previousDeviceId ?? null;
+  if (!previous && seedSkipReason(deps.env ?? process.env, deps.platform ?? process.platform, tty)) return { kind: "skipped", note: null };
   if (!deps.bearer || !deps.keychainAvailable()) return { kind: "skipped", note: null };
   const { store, failedWrite } = cliHubStores(deps.base, deps.kc, deps.keychainAvailable);
   const key = resolveDeviceKey(store);
   const res = await deps.post(
     "/auth/devices/register",
-    { name: ownDeviceName(), platform: "desktop", client: "cli", public_key: key.publicSpkiB64 },
+    { name: ownDeviceName(), platform: "desktop", client: "cli", public_key: key.publicSpkiB64, ...previous ? { previous_device_id: previous } : {} },
     deps.bearer
   );
   if (!res.ok) {
@@ -35310,16 +35700,16 @@ function redactProxyUrls(text2) {
 function bypassesProxy(host2, port, no) {
   if (!no) return false;
   for (const raw of no.split(/[\s,]+/)) {
-    let entry = raw.trim().toLowerCase();
-    if (!entry) continue;
-    if (entry === "*") return true;
-    const colon = entry.match(/^(.*):(\d+)$/);
+    let entry2 = raw.trim().toLowerCase();
+    if (!entry2) continue;
+    if (entry2 === "*") return true;
+    const colon = entry2.match(/^(.*):(\d+)$/);
     if (colon) {
       if (colon[2] !== port) continue;
-      entry = colon[1];
+      entry2 = colon[1];
     }
-    entry = entry.replace(/^\*?\./, "");
-    if (host2 === entry || host2.endsWith(`.${entry}`)) return true;
+    entry2 = entry2.replace(/^\*?\./, "");
+    if (host2 === entry2 || host2.endsWith(`.${entry2}`)) return true;
   }
   return false;
 }
@@ -35473,8 +35863,8 @@ function firstBindingWarning(name, group, host2, port) {
     ...group.protocols.length > 1 ? ["", "Authorizing SSH also authorizes SFTP. They are one destination."] : []
   ];
 }
-function removalWarning(name, group, entry, remainingAfter, sameGroupRemaining) {
-  const pairNote = entry.rows.length > 1 ? ["", "Both the SSH and the SFTP authorization for this host are removed."] : [];
+function removalWarning(name, group, entry2, remainingAfter, sameGroupRemaining) {
+  const pairNote = entry2.rows.length > 1 ? ["", "Both the SSH and the SFTP authorization for this host are removed."] : [];
   if (remainingAfter === 0) {
     return [
       `This is the only destination authorized on "${name}".`,
@@ -35493,7 +35883,7 @@ function removalWarning(name, group, entry, remainingAfter, sameGroupRemaining)
     ];
   }
   return [
-    `"${name}" will no longer be accepted at ${entry.host}:${entry.port} over ${group.protocols.map((p) => PROTOCOL_LABEL[p]).join(" or ")}.`,
+    `"${name}" will no longer be accepted at ${entry2.host}:${entry2.port} over ${group.protocols.map((p) => PROTOCOL_LABEL[p]).join(" or ")}.`,
     "",
     `Its other ${group.label} destinations are unchanged.`,
     ...pairNote
@@ -35664,16 +36054,22 @@ var REFUSALS = {
     why: "A jump host must be one of your own SSH connections, and no connection of yours has that id.",
     action: "Run `kt conns` and pass an id from the first column to --jump."
   },
-  // auth-guard.ts:109 (social-session gate) and :167 (adaptive), plus rotation.ts:159, jit.ts:226,
-  // fleet.ts:190, agents.ts:146, modules/ssh.ts:730 and :1228. The remedy is mechanical and worth
-  // stating exactly, because it is not obvious that it can be satisfied anywhere but here: step-up
-  // freshness is a per-USER Redis proof with a ~5 minute TTL (server/src/lib/step-up.ts:16), not a
-  // claim baked into this CLI's token. Stepping up in the web app on the same account therefore
-  // does clear it here.
+  // #3528: modules/ssh.ts sftpFail and modules/files.ts send this for a remote path, not a record id, so
+  // the 404 line about an invisible id would point at the wrong thing.
+  path_not_found: {
+    title: "No such path",
+    why: "The connection was reached, but nothing exists at that path on the remote side.",
+    action: "Check the path. `kt sftp ls <connId>` with no path lists the connection's starting directory."
+  },
+  // lib/auth-guard.ts blockStepUpPending (social-session gate) and enforceAdaptiveAuth (adaptive), plus
+  // the rotation, jit, fleet, agents and ssh modules. Step-up freshness is a per-SESSION Redis proof with
+  // a short TTL (server/src/lib/step-up.ts), so a step-up in the web app does not clear this CLI's
+  // session; `kt step-up` proves it for this one. The refusal does not say which factors the account
+  // holds, so the action names a completable path for each case (#3539).
   step_up_required: {
     title: "Step-up verification required",
     why: "This action needs a recent passkey or app-MFA check, and this session does not have one.",
-    action: "Only `kt mfa` and `kt passkey rm` ask for an authenticator code here, and only on an account that has one. Otherwise verify a passkey or app-MFA in the Kutrion web app on the same account, then re-run this command within a few minutes. If you signed in through SSO or a social provider, `kt login --email <e> --password <p> --code <2fa>` also mints a session that is not gated."
+    action: "Run `kt step-up` and enter a code from your authenticator app, then re-run this command within a few minutes. With no authenticator app on the account (none yet, or a passkey only, which a terminal cannot verify), enrol one first with `kt mfa setup` and `kt mfa verify --code <code>`, then run `kt step-up`. If you signed in through SSO or a social provider, `kt login --email <e> --password <p> --code <2fa>` also mints a session that is not gated."
   },
   // #2225 AC5, and the one shape this table exists for: the server owns the REASON, this client adds
   // the ROUTE. The server's hint names what ended the session (server/src/index.ts for a credential
@@ -35709,7 +36105,7 @@ var REFUSALS = {
   },
   refresh_hub_revoked: {
     title: "This session was signed out",
-    why: refreshWhy("refresh_hub_revoked"),
+    why: refreshWhy("refresh_hub_revoked", "app"),
     action: "Run `kt login` to sign in again."
   },
   device_revoked: {
@@ -35818,7 +36214,7 @@ var REFUSALS = {
     why: "Promoting now would leave those hosts refusing every session, because they do not yet accept a certificate from the next CA.",
     action: "Install or verify each host listed by `kt broker-ca status`, or revoke its enrollment, then promote again."
   },
-  // authz.ts:69, connection-import.ts:142. Overage freeze after a downgrade — read stays, write stops.
+  // authz.ts:69, connection-import.ts:164. Overage freeze after a downgrade — read stays, write stops.
   vault_frozen: {
     title: "Vault is read-only",
     why: "This vault is frozen for writes because the plan's vault limit was exceeded after a downgrade.",
@@ -35844,7 +36240,7 @@ var REFUSALS = {
     why: "This organization keeps AI on its own network, so only agents declared `lan` may act for it.",
     action: 'Mint with `--egress lan` only for a model the organization hosts on its own network, or ask an owner to turn off "Keep AI on our network".'
   },
-  // files.ts:196.
+  // server/src/modules/files.ts:353.
   tls_downgrade_refused: {
     title: "Transport security cannot be weakened",
     why: "The change would turn TLS off, or allow an unverified certificate, on a connection that already has it on.",
@@ -35900,7 +36296,7 @@ var REFUSALS = {
     why: "The code was valid for a limited time and that time has passed.",
     action: "Run `kt login` again; a new code is emailed when the password is accepted."
   },
-  // vault.ts:1105/1363/1387, files.ts:129, shares.ts:43, file-broker.ts:99. #954: the wire field is
+  // vault.ts:1105/1363/1387, server/src/modules/files.ts:369/574, shares.ts:43, file-broker.ts:99. #954: the wire field is
   // `inject_only`; the name the product uses is "No-reveal", and the second half is stated positively
   // so the credential does not read as broken.
   inject_only: {
@@ -35908,12 +36304,42 @@ var REFUSALS = {
     why: "Kutrion does not display, copy, export or share this credential's value. It is still used to authenticate connections and integrations.",
     action: "Use the credential rather than reading it \u2014 `kt ssh <connId>` or `kt exec <connId> <command>` broker a session with it without the value passing through this terminal."
   },
-  // modules/ssh.ts:473, modules/rdp.ts:151.
+  // modules/ssh.ts:478, modules/rdp.ts:151.
   inject_only_requires_write: {
     title: "Write access required for a No-reveal credential",
     why: "Pointing a connection at a No-reveal credential needs write access to the vault holding it, because the person doing it decides where the credential gets presented.",
     action: "Ask an owner or editor of that vault to make the change, or to grant you write access to it."
   },
+  // lib/untrusted-cert.ts, sent by files.ts fail() and cloud.ts fail() as a 503 (#3418); admitted past the 5xx
+  // gate by SERVER_REFUSALS. Wording matches Kutrion Transfer's entry.
+  // lib/remote-auth.ts, sent by files.ts fail() and ssh.ts sftpFail() as a 422 (#3451). Wording shared with Kutrion Transfer.
+  remote_auth_failed: {
+    title: "The server rejected the sign-in",
+    why: REMOTE_AUTH_FAILED_TEXT,
+    action: "Update the credential this connection uses in the vault, then retry."
+  },
+  // lib/remote-auth.ts, sent by files.ts fail() as a 400 (#3462). Nothing was sent to the host. Wording shared with Kutrion Transfer.
+  basic_over_http_refused: {
+    title: "The password was not sent over plain HTTP",
+    why: BASIC_OVER_HTTP_REFUSED_TEXT,
+    action: "Switch this connection to HTTPS, then retry."
+  },
+  basic_after_digest_refused: {
+    title: "The server's sign-in method changed",
+    why: BASIC_AFTER_DIGEST_REFUSED_TEXT,
+    action: "Kutrion refused because someone between you and the server may be removing the safer sign-in option. Ask whoever runs the server whether they changed its sign-in settings. If the change is genuine, delete this connection and add it again, or, if you own it, edit it to the server's new address (this needs step-up). Only adding it again resets the remembered sign-in type for the same address."
+  },
+  // lib/remote-auth.ts, sent by files.ts fail() as a 400 (#3484). Nothing was sent to the host.
+  credential_control_characters: {
+    title: "The saved sign-in cannot be sent",
+    why: CREDENTIAL_CONTROL_CHARS_TEXT,
+    action: CREDENTIAL_CONTROL_CHARS_NEXT
+  },
+  tls_certificate_untrusted: {
+    title: "This host's certificate is not trusted",
+    why: "The host presented a certificate that no authority vouches for, often a self-signed one, so the connection was not made. Nothing was sent to the host.",
+    action: "Ask an admin to review the certificate or the network path to this host."
+  },
   // access-policy.ts:264, reached from a root preHandler over the file family; reason values from AccessDecision.reason. The server sends
   // a bare code here and no hint, so translating `reason` is the whole value this entry adds.
   blocked_by_access_policy: {
@@ -35921,7 +36347,7 @@ var REFUSALS = {
     why: "This organization restricts where its file connections may be reached from, and this request came from outside that.",
     action: "Connect from an allowed network or country, or ask an organization administrator to widen the policy. The `reason` below says which rule refused it."
   },
-  // files.ts:34/795/889, file-requests.ts:280. `path` and `rule` name the file and the rule.
+  // server/src/modules/files.ts:56/1054, file-requests.ts:280. `path` and `rule` name the file and the rule.
   blocked_by_dlp_policy: {
     title: "Blocked by a data-loss-prevention rule",
     why: "The content or the path matched a rule this organization applies to file transfers.",
@@ -36091,8 +36517,14 @@ function contextLines(body, indent) {
     const text2 = Array.isArray(v) ? v.filter((x) => x !== null && typeof x !== "object").map((x) => String(x)).join(", ") : String(v);
     if (text2.trim()) out.push(`${indent}${f}: ${text2}`);
   }
+  const fields = asRecord(asRecord(b.details)?.fieldErrors);
+  for (const [field2, msgs] of Object.entries(fields ?? {})) {
+    const text2 = Array.isArray(msgs) ? msgs.filter((m) => typeof m === "string").map(scrubInput).join("; ") : "";
+    if (text2) out.push(`${indent}${field2}: ${text2}`);
+  }
   return out;
 }
+var scrubInput = (m) => m.replace(/,?\s*(?:received|got)\s+(?:'[^']*'|"[^"]*"|\S+)/gi, "").replace(/\s{2,}/g, " ").replace(/[\s,]+$/, "").trim();
 var STATUS_ACTION = {
   400: "The server could not use the request as sent. Check the command's arguments against `kt --help`.",
   401: "This machine's session was not accepted. Run `kt login` to sign in again.",
@@ -36109,7 +36541,7 @@ var HUB_SIGN_IN_ACTION = {
   status: "This machine's session was not accepted. Run `kt login`, it signs in through Kutrion Hub.",
   signed_out: "Run `kt login`, it signs in through Kutrion Hub."
 };
-var SERVER_REFUSALS = /* @__PURE__ */ new Set(["payment_unconfirmed"]);
+var SERVER_REFUSALS = /* @__PURE__ */ new Set(["payment_unconfirmed", "tls_certificate_untrusted"]);
 var sentenceKey = (t) => t.toLowerCase().replace(/[^a-z0-9]+/g, "");
 var sameSentence = (a, b) => b !== void 0 && sentenceKey(a) === sentenceKey(b);
 var SIGNIN_CODE_REFUSALS = /* @__PURE__ */ new Set(["email_code_required", "signin_code_cap"]);
@@ -36140,6 +36572,10 @@ function refusalLines(e, indent = "  ", opts2 = {}) {
   const code = fromRefresh ? e.refreshCode : refusalCode(e);
   const platformFlag = platformFlagRefusalText(code);
   if (platformFlag) return [`Turned off on this deployment (${code}, HTTP ${e.status})`, "", platformFlag];
+  const privateHost = code === "blocked_internal_address" ? str6(asRecord(e.body)?.host) : null;
+  if (privateHost) {
+    return [`Refused by the server (${code}, HTTP ${e.status})`, "", privateTargetSentence({ host: privateHost, surface: "short", reason: asRecord(e.body)?.target_reason })];
+  }
   const copy = Object.hasOwn(REFUSALS, code) ? REFUSALS[code] : void 0;
   const server = fromRefresh || SIGNIN_CODE_REFUSALS.has(code) ? null : serverText(e.body);
   const context = contextLines(e.body, indent);
@@ -36214,7 +36650,9 @@ function wsRefusalLines(frame, indent = "  ", jumpCtx = {}) {
   const jump = jumpRefusalReport(frame, code, head, jumpCtx, indent);
   if (jump) return jump;
   const lines = [code && !ourFault ? `${head} (${code})` : head, ""];
-  lines.push(str6(frame.error) ?? "The server sent no explanation with this refusal.");
+  lines.push(
+    code === "blocked_internal_address" && host2 ? privateTargetSentence({ host: host2, surface: "short", reason: d.target_reason }) : str6(frame.error) ?? "The server sent no explanation with this refusal."
+  );
   if (host2) lines.push("", `${indent}endpoint: ${port === null ? host2 : `${host2}:${port}`}`);
   if (allowed.length) {
     lines.push("", destinationRefusalAllowedLabel(dest));
@@ -36227,6 +36665,17 @@ function wsRefusalLines(frame, indent = "  ", jumpCtx = {}) {
 }
 
 // src/shell.ts
+function ttySize(columns, rows) {
+  const known = (n, d) => typeof n === "number" && Number.isFinite(n) && n > 0 ? n : d;
+  return [known(columns, 80), known(rows, 24)];
+}
+function detachNotice(frame) {
+  const ms = frame.orphan_ttl_ms;
+  const left = typeof ms === "number" && ms > 0 ? ms >= 6e4 ? `${Math.round(ms / 6e4)} minute${Math.round(ms / 6e4) === 1 ? "" : "s"}` : `${Math.ceil(ms / 1e3)} seconds` : null;
+  const held = left ? `The session keeps running on the server for ${left}, then ends.` : "The session keeps running on the server for a short time, then ends.";
+  if (frame.recorded !== true) return `[Kutrion] Detached. ${held}`;
+  return `[Kutrion] Detached. ${held} Its recording is saved when the session ends, and kt recordings lists it from then. To end a session at once, type exit in it instead of detaching.`;
+}
 function runShell(base, token, connId, onExit, jumpCtx = {}, afterSession, onChainedHostKey) {
   const wsUrl = shellUrl(base, connId);
   const ws = new wrapper_default(wsUrl, { headers: { Authorization: `Bearer ${token}` }, agent: wsAgentFor(wsUrl) });
@@ -36235,12 +36684,12 @@ function runShell(base, token, connId, onExit, jumpCtx = {}, afterSession, onCha
   const isTty = Boolean(stdin.isTTY && stdout.isTTY);
   const sendResize = () => {
     if (ws.readyState !== wrapper_default.OPEN) return;
-    const cols = stdout.columns ?? 80;
-    const rows = stdout.rows ?? 24;
+    const [cols, rows] = ttySize(stdout.columns, stdout.rows);
     ws.send(resizeFrame(cols, rows));
   };
   let exiting = false;
   let recordedSessionId = null;
+  let sessionInfo = null;
   const printReceipt = async () => {
     const id = recordedSessionId;
     if (!id) return;
@@ -36262,6 +36711,9 @@ function runShell(base, token, connId, onExit, jumpCtx = {}, afterSession, onCha
       ws.close();
     } catch {
     }
+    if (!ended && sessionInfo) process.stderr.write(`\r
+${detachNotice(sessionInfo)}\r
+`);
     void (ended ? printReceipt() : Promise.resolve()).catch(() => {
     }).then(() => onExit?.()).catch(() => {
     }).then(() => process.exit(code));
@@ -36302,6 +36754,7 @@ ${wsRefusalLines(frame, "  ", jumpCtx).join("\r\n")}\r
     const sessionFrame = sawSession ? null : parseSessionFrame(text2);
     if (sessionFrame) {
       sawSession = true;
+      sessionInfo = sessionFrame;
       const state = recordingStateLabel(sessionFrame);
       if (state) process.stderr.write(`\r
 [Kutrion] ${state}\r
@@ -36379,7 +36832,7 @@ var import_readline = require("readline");
 
 // src/mcp-install.ts
 init_define_KT_HUB_FILES();
-var import_fs3 = require("fs");
+var import_fs4 = require("fs");
 var import_os4 = require("os");
 var import_path4 = require("path");
 var import_child_process3 = require("child_process");
@@ -36474,35 +36927,35 @@ function bundleCandidates(moduleDir) {
 function resolveLaunch(base, client, moduleDir = __dirname) {
   const which = (0, import_child_process3.spawnSync)("command -v kt", { encoding: "utf8", shell: true });
   const onPath = which.status === 0 ? (which.stdout ?? "").trim().split("\n")[0] : "";
-  let entry;
+  let entry2;
   if ((0, import_path4.isAbsolute)(onPath)) {
-    entry = { command: onPath, args: ["mcp"] };
+    entry2 = { command: onPath, args: ["mcp"] };
   } else {
-    const bundle = bundleCandidates(moduleDir).find((p) => (0, import_fs3.existsSync)(p));
+    const bundle = bundleCandidates(moduleDir).find((p) => (0, import_fs4.existsSync)(p));
     if (!bundle) {
       throw new Error(
         "no built CLI to launch the MCP bridge with. Run `npm run build` in cli/, or install the CLI so that `kt` is on your PATH, then re-run this command."
       );
     }
-    entry = { command: process.execPath, args: [bundle, "mcp"] };
+    entry2 = { command: process.execPath, args: [bundle, "mcp"] };
   }
   const fileStore2 = (ktEnv("TOKEN_STORE") ?? "").trim().toLowerCase() === "file";
-  entry.env = {
+  entry2.env = {
     KT_API_BASE: base,
     ...client ? { KT_MCP_CLIENT: client } : {},
     ...fileStore2 ? { KT_TOKEN_STORE: "file" } : {}
   };
-  return entry;
+  return entry2;
 }
 var STORE_ENV = /* @__PURE__ */ new Set(["TOKEN_STORE", "TOKEN_STORE_TIMEOUT_MS"]);
-async function verifyLaunch(entry, timeoutMs = 15e3) {
+async function verifyLaunch(entry2, timeoutMs = 15e3) {
   const probe = JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/list", params: {} });
   const inherited = Object.fromEntries(
     Object.entries(process.env).filter(([k]) => !/^(KT|VT)_/.test(k) || STORE_ENV.has(k.slice(3)))
   );
-  const res = (0, import_child_process3.spawnSync)(entry.command, entry.args, {
+  const res = (0, import_child_process3.spawnSync)(entry2.command, entry2.args, {
     input: probe + "\n",
-    env: { ...inherited, ...entry.env ?? {} },
+    env: { ...inherited, ...entry2.env ?? {} },
     cwd: (0, import_os4.tmpdir)(),
     encoding: "utf8",
     timeout: timeoutMs
@@ -36521,10 +36974,10 @@ async function verifyLaunch(entry, timeoutMs = 15e3) {
     return { ok: false, error: "the bridge produced output that is not JSON-RPC" };
   }
 }
-function mergeConfig(existing, key, entry) {
+function mergeConfig(existing, key, entry2) {
   const cfg = existing && typeof existing === "object" && !Array.isArray(existing) ? { ...existing } : {};
   const servers = cfg[key] && typeof cfg[key] === "object" && !Array.isArray(cfg[key]) ? { ...cfg[key] } : {};
-  servers[SERVER_NAME] = entry;
+  servers[SERVER_NAME] = entry2;
   cfg[key] = servers;
   return cfg;
 }
@@ -36540,14 +36993,14 @@ function removeFromConfig(existing, key) {
 }
 function readJson(path) {
   try {
-    return JSON.parse((0, import_fs3.readFileSync)(path, "utf8"));
+    return JSON.parse((0, import_fs4.readFileSync)(path, "utf8"));
   } catch {
     return void 0;
   }
 }
 function writeJson(path, value) {
-  (0, import_fs3.mkdirSync)((0, import_path4.dirname)(path), { recursive: true });
-  (0, import_fs3.writeFileSync)(path, JSON.stringify(value, null, 2) + "\n");
+  (0, import_fs4.mkdirSync)((0, import_path4.dirname)(path), { recursive: true });
+  (0, import_fs4.writeFileSync)(path, JSON.stringify(value, null, 2) + "\n");
 }
 var agentAccount = (base, client) => client ? `agent:${base}:${client}` : `agent:${base}`;
 function getAgentToken(base, client) {
@@ -36592,7 +37045,7 @@ async function installClient(o) {
   if (!configPath) {
     throw new Error(`${target.label} is not available on this platform (${(0, import_os4.platform)()}).`);
   }
-  const entry = resolveLaunch(o.base, o.client);
+  const entry2 = resolveLaunch(o.base, o.client);
   const mint = () => api2(o.base, "/agents", o.userToken, {
     method: "POST",
     body: JSON.stringify({
@@ -36601,7 +37054,8 @@ async function installClient(o) {
       client: o.client,
       scopes: o.scopes,
       ttl_minutes: o.ttlDays * 24 * 60,
-      egress_class: o.egressClass ?? "cloud"
+      egress_class: o.egressClass ?? "cloud",
+      ...o.resourceScope ? { resource_scope: o.resourceScope } : {}
     })
   });
   let superseded = 0;
@@ -36642,16 +37096,17 @@ async function installClient(o) {
   superseded += old.revoked;
   revokeFailed.push(...old.revokeFailed);
   agentListStatus ??= old.agentListStatus;
-  writeJson(configPath, mergeConfig(readJson(configPath), target.key, entry));
+  writeJson(configPath, mergeConfig(readJson(configPath), target.key, entry2));
   const who = await api2(o.base, "/mcp/whoami", agent.token);
   return {
+    ...o.resourceScope ? { resourceScope: o.resourceScope } : {},
     configPath,
     principalId: agent.id,
     expiresAt: agent.expires_at,
     scopes: agent.scopes,
     next: target.next,
     verified: who.status === 200 && who.body?.principal_id === agent.id,
-    launch: await verifyLaunch(entry),
+    launch: await verifyLaunch(entry2),
     superseded,
     revokeFailed,
     ...agentListStatus !== void 0 ? { agentListStatus } : {}
@@ -36669,7 +37124,7 @@ async function uninstallClient(o) {
   if (o.client) {
     const target = CLIENTS[o.client];
     configPath = target.path(o.dir);
-    if (configPath && (0, import_fs3.existsSync)(configPath)) {
+    if (configPath && (0, import_fs4.existsSync)(configPath)) {
       writeJson(configPath, removeFromConfig(readJson(configPath), target.key));
     }
   }
@@ -36691,6 +37146,7 @@ async function agentStatus(base, token) {
         principal_id: who.body?.principal_id,
         expires_at: who.body?.expires_at,
         scopes: who.body?.scopes,
+        resource_scope: who.body?.resource_scope,
         rate_limit: who.body?.rate_limit
       };
     }
@@ -36706,17 +37162,66 @@ async function mcpStatus(base, dir) {
     const p = t.path(dir);
     let installed = false;
     let configuredBase = null;
-    if (p && (0, import_fs3.existsSync)(p)) {
+    if (p && (0, import_fs4.existsSync)(p)) {
       const cfg = readJson(p);
-      const entry = cfg?.[t.key]?.[SERVER_NAME];
-      installed = !!entry;
-      if (typeof entry?.env?.KT_API_BASE === "string") configuredBase = entry.env.KT_API_BASE;
+      const entry2 = cfg?.[t.key]?.[SERVER_NAME];
+      installed = !!entry2;
+      if (typeof entry2?.env?.KT_API_BASE === "string") configuredBase = entry2.env.KT_API_BASE;
     }
     return { client: id, label: t.label, path: p, installed, configuredBase, agent: await agentStatus(base, getToken(agentAccount(base, id))) };
   }));
   const legacy = await agentStatus(base, getToken(agentAccount(base)));
   return { keychain: backendName(), hasToken: !!legacy || configs.some((c) => c.agent), configs, legacy };
 }
+function pick2(kind, wanted, options, problems) {
+  const ids = [];
+  for (const w of wanted) {
+    const byId = options.find((o) => o.id === w);
+    const byName = options.filter((o) => o.name === w);
+    if (byId) ids.push(byId.id);
+    else if (byName.length === 1) ids.push(byName[0].id);
+    else if (byName.length > 1) problems.push(`${kind} name "${w}" matches ${byName.length} ${kind}s; use an id (${byName.map((o) => o.id).join(", ")})`);
+    else problems.push(`unknown ${kind}: ${w}`);
+  }
+  return [...new Set(ids)];
+}
+async function resolveResourceScope(base, userToken, vaults, connections) {
+  if (!vaults.length && !connections.length) return void 0;
+  const r = await api2(base, "/agents/scope-options", userToken);
+  if (r.status !== 200 || !r.body) throw new Error(`could not list the vaults and connections this account can reach (${r.status})`);
+  const problems = [];
+  const vault_ids = pick2("vault", vaults, r.body.vaults ?? [], problems);
+  const connection_ids = pick2("connection", connections, r.body.connections ?? [], problems);
+  if (problems.length) throw new Error(`${problems.join("; ")}. Nothing was minted.`);
+  return { ...vault_ids.length ? { vault_ids } : {}, ...connection_ids.length ? { connection_ids } : {} };
+}
+function describeScope(s) {
+  const v = s?.vault_ids?.length ?? 0;
+  const c = s?.connection_ids?.length ?? 0;
+  const parts = [
+    v ? `${v} vault(s): ${s.vault_ids.join(", ")}` : "all vaults its owner can reach",
+    c ? `${c} connection(s): ${s.connection_ids.join(", ")}` : "all connections its owner can reach"
+  ];
+  return parts.join("; ");
+}
+async function mintAgent(o) {
+  const m = await api2(o.base, "/agents", o.userToken, {
+    method: "POST",
+    body: JSON.stringify({
+      name: o.name,
+      purpose: o.purpose,
+      scopes: o.scopes,
+      ttl_minutes: o.ttlDays * 24 * 60,
+      egress_class: o.egressClass,
+      ...o.resourceScope ? { resource_scope: o.resourceScope } : {}
+    })
+  });
+  if (m.status === 402) throw new Error(`your plan does not allow another AI agent (${m.body?.feature ?? "agent_access"}). Revoke one or upgrade.`);
+  if (m.status === 403 && m.body?.error === "on_network_required") throw new Error("this organization requires AI agents to run on its own network. Re-run with --egress lan if the model is self-hosted.");
+  if (m.status !== 201) throw new Error(`could not mint an agent principal (${m.status}): ${JSON.stringify(m.body)}`);
+  if (!m.body?.token || !m.body.id) throw new ApiUnavailableError(m.status, m.body);
+  return { token: m.body.token, id: m.body.id, expires_at: m.body.expires_at, scopes: m.body.scopes };
+}
 
 // src/mcp.ts
 var MODERN = "2026-07-28";
@@ -37474,9 +37979,23 @@ function recoveryText(rec, s) {
     "A payment may still be due and your access may still be at risk \u2014 this is a display failure, not a resolved account."
   ].join("\n");
 }
+function modeString(mode, type) {
+  const lead = type === "dir" ? "d" : type === "link" ? "l" : "-";
+  return lead + [6, 3, 0].map((shift) => {
+    const bits = mode >> shift & 7;
+    return (bits & 4 ? "r" : "-") + (bits & 2 ? "w" : "-") + (bits & 1 ? "x" : "-");
+  }).join("");
+}
+function whoamiLines(user) {
+  const org = user.org_name ? `${user.org_name}${user.org_role ? ` (${user.org_role})` : ""}` : user.org_role ?? "none";
+  return `email  ${user.email}
+org    ${org}`;
+}
 
 // src/private-vault.ts
 init_define_KT_HUB_FILES();
+var import_fs5 = require("fs");
+var import_path5 = require("path");
 var PASSPHRASE_STDIN_FLAG = "vault-passphrase-stdin";
 var PrivateVaultError = class extends Error {
 };
@@ -37494,6 +38013,9 @@ There is no flag that takes the passphrase itself: a flag lands in shell history
   return io.ask("vault passphrase: ");
 }
 async function unlockForCommand(client, io) {
+  return (await unlockVault(client, io)).key;
+}
+async function unlockVault(client, io) {
   const passphrase = await readVaultPassphrase(io);
   if (!passphrase) throw new PrivateVaultError("no vault passphrase was given");
   let record;
@@ -37506,7 +38028,7 @@ async function unlockForCommand(client, io) {
     throw e;
   }
   try {
-    return await unlockVaultKey(record, passphrase);
+    return { key: await unlockVaultKey(record, passphrase), enrolledAt: record.created_at };
   } catch (e) {
     if (e instanceof VaultKeyError && e.code === "wrong_secret") throw new PrivateVaultError(PRIVATE_VAULT_COPY.wrongPassphrase);
     throw e;
@@ -37517,12 +38039,115 @@ async function openSealedItem(client, key, vaultId, credId) {
   if (!sealed) throw new PrivateVaultError("this item is No-reveal. Kutrion does not display, copy or export its value; it is still used to authenticate connections and integrations.");
   try {
     const opened = await openPrivateItem({ id: credential.id, vault_id: credential.vault_id }, sealed, key);
-    return { value: opened.value };
+    return { value: opened.value, notes: opened.notes };
   } catch (e) {
     if (e instanceof VaultKeyError) throw new PrivateVaultError("this item could not be opened with your vault key.");
     throw e;
   }
 }
+async function probeVaultCustody(client, vaultId) {
+  try {
+    return { private: true, key: (await client.getPrivateDataKey(vaultId)).key };
+  } catch (e) {
+    if (e instanceof ApiError && e.status === 409 && e.slug === "vault_not_private") return { private: false };
+    throw e;
+  }
+}
+var PrivateVaultMemory = class {
+  constructor(file) {
+    this.file = file;
+  }
+  read() {
+    try {
+      const parsed = JSON.parse((0, import_fs5.readFileSync)(this.file, "utf8"));
+      return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+    } catch {
+      return {};
+    }
+  }
+  seen(base, vaultId) {
+    const ids = this.read()[base];
+    return Array.isArray(ids) && ids.includes(vaultId);
+  }
+  remember(base, vaultId) {
+    const all = this.read();
+    const ids = Array.isArray(all[base]) ? all[base] : [];
+    if (ids.includes(vaultId)) return;
+    all[base] = [...ids, vaultId];
+    (0, import_fs5.mkdirSync)((0, import_path5.dirname)(this.file), { recursive: true, mode: 448 });
+    writeOwnerOnly(this.file, JSON.stringify(all, null, 2));
+  }
+};
+var custodyChangedMessage = (vaultId) => `the server now says vault ${vaultId} is not Private, but this CLI has seen it Private before. The server's answer changed, so nothing was read or sent. Check the vault in the web app before writing to it.`;
+var PASSPHRASE_STDIN_NOT_PRIVATE = `--${PASSPHRASE_STDIN_FLAG} was given, but this vault is not Private. Nothing was read from stdin or sent: drop --${PASSPHRASE_STDIN_FLAG} to write to a Connected vault.`;
+async function resolveVaultCustody(client, vaultId, opts2) {
+  const custody = await probeVaultCustody(client, vaultId);
+  if (custody.private) {
+    try {
+      opts2.memory.remember(opts2.base, vaultId);
+    } catch (e) {
+      console.error(`warning: could not record vault ${vaultId} as Private: ${e.message}`);
+    }
+    return custody;
+  }
+  if (opts2.memory.seen(opts2.base, vaultId)) throw new PrivateVaultError(custodyChangedMessage(vaultId));
+  if (opts2.passphraseStdin) throw new PrivateVaultError(PASSPHRASE_STDIN_NOT_PRIVATE);
+  return custody;
+}
+var dataKeyChanged = (e) => e instanceof ApiError && e.status === 409 && e.slug === "data_key_changed";
+async function createSealedItem(client, vault, vaultId, current, meta, plain) {
+  const id = crypto.randomUUID();
+  const attempt = async (k) => {
+    const { dataKey, key } = await privateItemDataKey(k, vault.key, vaultId, vault.enrolledAt);
+    const fields = await sealPrivateItem({ id, vault_id: vaultId }, plain, dataKey);
+    return client.createPrivateItem(vaultId, { ...meta, id, key, fields });
+  };
+  try {
+    try {
+      return await attempt(current);
+    } catch (e) {
+      if (!dataKeyChanged(e)) throw e;
+      return await attempt(e.body?.key ?? null);
+    }
+  } catch (e) {
+    if (e instanceof VaultKeyError) throw new PrivateVaultError(PRIVATE_VAULT_COPY.wrongPassphrase);
+    throw e;
+  }
+}
+async function updateSealedItem(client, vault, vaultId, credId, current, patch) {
+  const plain = {};
+  if (patch.value !== void 0) plain.value = patch.value;
+  if (patch.notes !== void 0) plain.notes = patch.notes.trim() ? patch.notes : null;
+  const meta = patch.name !== void 0 ? { name: patch.name } : {};
+  if (!Object.keys(plain).length) return client.updatePrivateItem(vaultId, credId, meta);
+  if (!vault) throw new PrivateVaultError("a Private item's value and notes can only be changed with the vault unlocked");
+  const sealUnder = async (keyId, wrap) => {
+    const dataKey = await unwrapVaultDataKey(wrap, vault.key, vaultId);
+    const fields = await sealPrivateItem({ id: credId, vault_id: vaultId }, plain, dataKey);
+    return client.updatePrivateItem(vaultId, credId, { ...meta, key_id: keyId, fields });
+  };
+  try {
+    if (current) {
+      try {
+        return await sealUnder(current.key_id, current.client_wrapped_data_key);
+      } catch (e) {
+        if (!dataKeyChanged(e)) throw e;
+      }
+    }
+    const { sealed } = await client.getPrivateItem(vaultId, credId);
+    if (!sealed) throw new PrivateVaultError("this item is No-reveal, so its value cannot be changed from here.");
+    return await sealUnder(sealed.key_id, sealed.client_wrapped_data_key);
+  } catch (e) {
+    if (e instanceof VaultKeyError) throw new PrivateVaultError("this item could not be sealed with your vault key.");
+    throw e;
+  }
+}
+function splitPassphraseAndValue(stdin) {
+  const nl = stdin.search(/\r?\n/);
+  if (nl < 0) throw new PrivateVaultError("stdin must carry the vault passphrase on its first line and the value after it");
+  return { passphrase: stdin.slice(0, nl), value: stdin.slice(nl).replace(/^\r?\n/, "") };
+}
+var PRIVATE_IMPORT_REFUSED = "this vault is Private, and kt import cannot seal an import yet: the export file is parsed by the server, which would see every value in it. Nothing has been sent. Add each item with `kt cred add --value-stdin`.";
 
 // src/enroll.ts
 init_define_KT_HUB_FILES();
@@ -37732,10 +38357,47 @@ function parseHostsUnconfirmed(body) {
   return { count: typeof b.unconfirmedCount === "number" ? b.unconfirmedCount : hosts.length, hosts };
 }
 
+// src/exec-stdin.ts
+init_define_KT_HUB_FILES();
+var EXEC_STDIN_MAX_BYTES = 8 * 1024 * 1024;
+var StdinTooLargeError = class extends Error {
+  constructor(maxBytes) {
+    super(`stdin is larger than the ${maxBytes} byte limit for kt exec; nothing was sent. Copy larger input over SFTP instead.`);
+    this.maxBytes = maxBytes;
+  }
+};
+async function readExecStdin(input, maxBytes = EXEC_STDIN_MAX_BYTES) {
+  const chunks = [];
+  let total = 0;
+  for await (const c of input) {
+    const b = Buffer.isBuffer(c) ? c : Buffer.from(c);
+    total += b.length;
+    if (total > maxBytes) throw new StdinTooLargeError(maxBytes);
+    chunks.push(b);
+  }
+  return total ? Buffer.concat(chunks) : void 0;
+}
+async function serverTakesExecStdin(base, fetchImpl = fetch) {
+  try {
+    const res = await fetchImpl(`${base.replace(/\/+$/, "")}/health`, { redirect: "error", signal: AbortSignal.timeout(HEALTH_TIMEOUT_MS) });
+    return (res.headers.get("kutrion-features") ?? "").split(",").some((v) => v.trim().toLowerCase() === "exec-stdin");
+  } catch (e) {
+    if (e instanceof Error && (e.name === "TimeoutError" || e.name === "AbortError")) throw new ExecStdinCheckTimedOut();
+    return false;
+  }
+}
+var HEALTH_TIMEOUT_MS = 1e4;
+var ExecStdinCheckTimedOut = class extends Error {
+  constructor() {
+    super("error: the check for kt exec --stdin support timed out; nothing was run");
+  }
+};
+var STDIN_UNSUPPORTED = "error: this server does not support kt exec --stdin (it predates stdin support); nothing was run";
+
 // src/transfer.ts
 init_define_KT_HUB_FILES();
-var import_fs4 = require("fs");
-var import_path5 = require("path");
+var import_fs6 = require("fs");
+var import_path6 = require("path");
 var import_promises = require("stream/promises");
 var EXIT_OK = 0;
 var EXIT_FAIL = 1;
@@ -37762,7 +38424,7 @@ function isSideError(s) {
 var listOn = (c, k, id, p) => k === "sftp" ? c.sftpList(id, p) : c.fileList(id, p);
 var mkdirOn = (c, k, id, p) => k === "sftp" ? c.sftpMkdir(id, p) : c.fileMkdir(id, p);
 var downloadOn = (c, k, id, p, o) => k === "sftp" ? c.sftpDownloadStream(id, p, o) : c.fileDownloadStream(id, p, o);
-var uploadOn = (c, k, id, p, b) => k === "sftp" ? c.sftpUploadStream(id, p, b) : c.fileUploadStream(id, p, b);
+var uploadOn = (c, k, id, p, src) => k === "sftp" ? c.sftpUploadResumable(id, p, src) : c.fileUploadResumable(id, p, src);
 var abortOnHostKey = (e) => {
   if (hostKeyUnconfirmedFromError(e)) throw e;
 };
@@ -37808,6 +38470,8 @@ function exitFor(o) {
   return o.ok > 0 ? EXIT_PARTIAL : EXIT_FAIL;
 }
 var msg = (e) => e instanceof Error ? e.message : String(e);
+async function* emptyChunks() {
+}
 async function* counted(chunks, p, tally) {
   for await (const c of chunks) {
     tally.bytes += c.byteLength;
@@ -37821,15 +38485,15 @@ async function saveTo(s, local, append, p) {
     await (0, import_promises.pipeline)(counted(s.chunks, p, tally), process.stdout, { end: false });
     return tally.bytes;
   }
-  const dir = (0, import_path5.dirname)(local);
-  if (dir && dir !== "." && !(0, import_fs4.existsSync)(dir)) (0, import_fs4.mkdirSync)(dir, { recursive: true });
-  await (0, import_promises.pipeline)(counted(s.chunks, p, tally), (0, import_fs4.createWriteStream)(local, append ? { flags: "a" } : {}));
+  const dir = (0, import_path6.dirname)(local);
+  if (dir && dir !== "." && !(0, import_fs6.existsSync)(dir)) (0, import_fs6.mkdirSync)(dir, { recursive: true });
+  await (0, import_promises.pipeline)(counted(s.chunks, p, tally), (0, import_fs6.createWriteStream)(local, append ? { flags: "a" } : {}));
   return tally.bytes;
 }
 async function getOne(c, kind, id, remote, local, opts2) {
   let start = 0;
-  if (opts2.resume && local !== "-" && (0, import_fs4.existsSync)(local)) {
-    const st = (0, import_fs4.statSync)(local);
+  if (opts2.resume && local !== "-" && (0, import_fs6.existsSync)(local)) {
+    const st = (0, import_fs6.statSync)(local);
     if (st.isFile()) start = st.size;
   }
   let s;
@@ -37852,7 +38516,7 @@ async function getOne(c, kind, id, remote, local, opts2) {
     opts2.note?.(`${remote}: server ignored the resume range, downloading from the start`);
     start = 0;
   }
-  const p = opts2.quiet ? NO_PROGRESS : progressBar((0, import_path5.basename)(remote) || remote, s.total);
+  const p = opts2.quiet ? NO_PROGRESS : progressBar((0, import_path6.basename)(remote) || remote, s.total);
   const bytes = await saveTo(s, local, start > 0, p);
   p.finish();
   return { bytes };
@@ -37904,13 +38568,13 @@ async function getPath(c, kind, id, remote, local, opts2 = {}) {
     return out;
   }
   for await (const item of walkRemote(c, kind, id, remote)) {
-    const dest = (0, import_path5.join)(local, item.rel);
+    const dest = (0, import_path6.join)(local, item.rel);
     if (item.link) {
       opts2.note?.(`skipped symlink ${item.path}`);
       continue;
     }
     if (item.dir) {
-      (0, import_fs4.mkdirSync)(dest, { recursive: true });
+      (0, import_fs6.mkdirSync)(dest, { recursive: true });
       continue;
     }
     try {
@@ -37926,8 +38590,8 @@ async function getPath(c, kind, id, remote, local, opts2 = {}) {
   return out;
 }
 function* walkLocal(root, rel = "") {
-  for (const e of (0, import_fs4.readdirSync)(root, { withFileTypes: true })) {
-    const abs = (0, import_path5.join)(root, e.name);
+  for (const e of (0, import_fs6.readdirSync)(root, { withFileTypes: true })) {
+    const abs = (0, import_path6.join)(root, e.name);
     const r = rel ? `${rel}/${e.name}` : e.name;
     if (e.isSymbolicLink()) continue;
     if (e.isDirectory()) {
@@ -37939,18 +38603,21 @@ function* walkLocal(root, rel = "") {
   }
 }
 async function putOne(c, kind, id, local, remote, opts2) {
-  const total = (0, import_fs4.statSync)(local).size;
-  await c.preflightUpload?.(total);
-  const p = opts2.quiet ? NO_PROGRESS : progressBar((0, import_path5.basename)(local), total);
+  const total = (0, import_fs6.statSync)(local).size;
+  const p = opts2.quiet ? NO_PROGRESS : progressBar((0, import_path6.basename)(local), total);
   const tally = { bytes: 0 };
-  const r = await uploadOn(c, kind, id, remote, counted((0, import_fs4.createReadStream)(local), p, tally));
+  const source = {
+    size: total,
+    slice: (start, end) => counted(end > start ? (0, import_fs6.createReadStream)(local, { start, end: end - 1 }) : emptyChunks(), p, tally)
+  };
+  const r = await uploadOn(c, kind, id, remote, source);
   p.finish();
   if (!r.streamed) opts2.note?.(`${local}: this runtime could not stream the request body, the file was buffered`);
   return r.size ?? tally.bytes;
 }
 async function putPath(c, kind, id, local, remote, opts2 = {}) {
   const out = empty();
-  const st = (0, import_fs4.existsSync)(local) ? (0, import_fs4.statSync)(local) : null;
+  const st = (0, import_fs6.existsSync)(local) ? (0, import_fs6.statSync)(local) : null;
   if (!st) {
     out.failed++;
     out.errors.push(`${local}: no such file`);
@@ -37983,7 +38650,7 @@ async function putPath(c, kind, id, local, remote, opts2 = {}) {
       }
       continue;
     }
-    const parent = (0, import_path5.dirname)(dest);
+    const parent = (0, import_path6.dirname)(dest);
     if (!made.has(parent)) {
       try {
         await mkdirOn(c, kind, id, parent);
@@ -38002,13 +38669,32 @@ async function putPath(c, kind, id, local, remote, opts2 = {}) {
   }
   return out;
 }
+var JOB_TERMINAL = /* @__PURE__ */ new Set(["succeeded", "failed", "canceled"]);
+function transientPollError(e) {
+  const status = e?.status;
+  if (typeof status === "number") return status >= 500 || e.name === "ApiUnavailableError";
+  return unreachedApi(e);
+}
+function unreachedApi(e) {
+  if (e?.name === "ApiUnavailableError") return true;
+  if (typeof e?.status === "number") return false;
+  return e instanceof TypeError || e instanceof Error && /timed out|aborted|ECONN|ENOTFOUND|EAI_AGAIN|socket|fetch failed/i.test(e.message);
+}
 async function waitForJob(get, id, opts2) {
   const interval = opts2.intervalMs ?? 2e3;
   const deadline = Date.now() + opts2.timeoutMs;
   for (; ; ) {
-    const { job } = await get(id);
-    opts2.onTick?.(job);
-    if (job.status === "succeeded" || job.status === "failed") return job;
+    let job;
+    try {
+      ({ job } = await get(id));
+    } catch (e) {
+      if (!transientPollError(e)) throw e;
+      opts2.onRetry?.(e);
+    }
+    if (job) {
+      opts2.onTick?.(job);
+      if (JOB_TERMINAL.has(job.status)) return job;
+    }
     if (Date.now() + interval > deadline) return null;
     await new Promise((r) => setTimeout(r, interval));
   }
@@ -38022,11 +38708,12 @@ function parseDailyAt(v) {
 }
 
 // src/index.ts
-var CONFIG = (0, import_path6.join)((0, import_os5.homedir)(), ".config", "kutrion", "config.json");
+var CONFIG = (0, import_path7.join)((0, import_os5.homedir)(), ".config", "kutrion", "config.json");
+var PRIVATE_VAULTS = new PrivateVaultMemory((0, import_path7.join)((0, import_os5.homedir)(), ".config", "kutrion", "private-vaults.json"));
 function storedBase() {
   let file;
   try {
-    file = JSON.parse((0, import_fs5.readFileSync)(CONFIG, "utf8"));
+    file = JSON.parse((0, import_fs7.readFileSync)(CONFIG, "utf8"));
   } catch {
     return "";
   }
@@ -38044,9 +38731,17 @@ function storedBase() {
   }
   return base;
 }
-function saveCfg(base) {
-  (0, import_fs5.mkdirSync)((0, import_path6.dirname)(CONFIG), { recursive: true });
-  (0, import_fs5.writeFileSync)(CONFIG, JSON.stringify({ base }, null, 2));
+function saveCfg(base, fallbacks = readFallbacks(CONFIG, base)) {
+  (0, import_fs7.mkdirSync)((0, import_path7.dirname)(CONFIG), { recursive: true });
+  (0, import_fs7.writeFileSync)(CONFIG, JSON.stringify({ base, ...fallbacks.length ? { fallbacks } : {} }, null, 2));
+}
+var fallbackInstalled = false;
+function installBaseFallback(base) {
+  if (fallbackInstalled) return;
+  const list = readFallbacks(CONFIG, base);
+  if (!list.length) return;
+  fallbackInstalled = true;
+  globalThis.fetch = fallbackFetch(globalThis.fetch, base, list);
 }
 function resolveBase(flag) {
   const explicit = typeof flag === "string" ? flag.trim() : "";
@@ -38193,16 +38888,38 @@ async function readStdin() {
 function readSecret(q) {
   return process.stdin.isTTY ? prompt(q, true) : readStdin();
 }
+var EMPTY_VALUE_MESSAGE = "The credential value is empty, so nothing was sent. Pipe one in with --value-stdin, or leave the flag off and type it at the prompt.";
 async function openPrivateItem2(client, fromStdin, vaultId, credId) {
   try {
     const key = await unlockForCommand(client, { tty: !!process.stdin.isTTY, fromStdin, ask: promptSecret, readStdin });
-    console.log((await openSealedItem(client, key, vaultId, credId)).value);
+    const item = await openSealedItem(client, key, vaultId, credId);
+    console.log(item.value);
+    if (item.notes) console.error(`notes: ${item.notes}`);
     return null;
   } catch (e) {
     if (e instanceof PrivateVaultError) return e.message;
     throw e;
   }
 }
+async function unlockForSealedWrite(client, flags, needValue) {
+  const passStdin = flags[PASSPHRASE_STDIN_FLAG] === true, valueStdin = flags["value-stdin"] === true;
+  const io = { tty: !!process.stdin.isTTY, fromStdin: passStdin, ask: promptSecret, readStdin };
+  if (passStdin && needValue) {
+    if (!valueStdin) throw new PrivateVaultError(`with --${PASSPHRASE_STDIN_FLAG}, pipe the value too with --value-stdin: stdin carries the passphrase on its first line and the value after it`);
+    const piped = splitPassphraseAndValue(await readStdin());
+    if (piped.value === "") throw new PrivateVaultError(EMPTY_VALUE_MESSAGE);
+    return { vault: await unlockVault(client, { ...io, readStdin: async () => piped.passphrase }), value: piped.value };
+  }
+  const vault = await unlockVault(client, io);
+  if (!needValue) return { vault };
+  const value = valueStdin ? await readSecret("value: ") : await prompt("value: ", true);
+  if (value === "") throw new PrivateVaultError(EMPTY_VALUE_MESSAGE);
+  return { vault, value };
+}
+var WATCHER_EVERY_MIN = 60;
+var WATCHER_EVERY_MAX = 86400;
+var WATCHER_PATTERN_MAX = 256;
+var withNotesMarker = (c, notes) => notes === void 0 ? c : { ...c, has_notes: notes.length > 0, notes_length: notes.length };
 function refuseSecretFlag(flag, instead) {
   console.error(`error: --${flag} is not accepted: it puts a credential on the command line, where shell history and the process list keep it.`);
   console.error(`  ${instead}`);
@@ -38277,12 +38994,12 @@ async function credDest(client, args, flags, asJson, die) {
     const secret = await promptSecret(`current value for "${name}": `);
     let added;
     try {
-      added = await client.addCredentialDestination(vaultId, cid, {
+      added = await withStepUp(client, () => client.addCredentialDestination(vaultId, cid, {
         protocol: group.key,
         host: host2,
         ...portGiven ? { port } : {},
         secret
-      });
+      }));
     } catch (e) {
       const text2 = destRefusalText(e);
       if (text2) return die(text2);
@@ -38305,24 +39022,24 @@ async function credDest(client, args, flags, asJson, die) {
     const group = groupFor(row.protocol);
     if (!group) return die(`this destination is recorded on protocol ${row.protocol}, which this version of kt cannot withdraw`);
     const inGroup = entriesFor(group, before.destinations);
-    const entry = inGroup.find((x) => x.rows.some((r) => r.id === destId));
-    if (!entry) return die(`no destination ${destId} on "${name}"`);
+    const entry2 = inGroup.find((x) => x.rows.some((r) => r.id === destId));
+    if (!entry2) return die(`no destination ${destId} on "${name}"`);
     const sameGroupRows = inGroup.reduce((n, x) => n + x.rows.length, 0);
-    for (const line of removalWarning(name, group, entry, before.destinations.length - entry.rows.length, sameGroupRows - entry.rows.length)) {
+    for (const line of removalWarning(name, group, entry2, before.destinations.length - entry2.rows.length, sameGroupRows - entry2.rows.length)) {
       console.error(line);
     }
     console.error("");
     if (!await confirmTyped("Type yes to withdraw it: ")) return die("nothing was changed");
     const secret = await promptSecret(`current value for "${name}": `);
     const gone = [];
-    for (const r of entry.rows) {
+    for (const r of entry2.rows) {
       try {
-        await client.removeCredentialDestination(vaultId, cid, r.id, secret);
+        await withStepUp(client, () => client.removeCredentialDestination(vaultId, cid, r.id, secret));
         gone.push(r.protocol);
       } catch (e) {
         if (gone.length) {
-          const left = entry.rows.filter((x) => !gone.includes(x.protocol)).map((x) => PROTOCOL_LABEL[x.protocol]).join(" and ");
-          console.error(`Only part of this destination was withdrawn. ${gone.map((pr) => PROTOCOL_LABEL[pr]).join(" and ")} at ${entry.host}:${entry.port} is no longer authorized; ${left} still is. Run the command again.`);
+          const left = entry2.rows.filter((x) => !gone.includes(x.protocol)).map((x) => PROTOCOL_LABEL[x.protocol]).join(" and ");
+          console.error(`Only part of this destination was withdrawn. ${gone.map((pr) => PROTOCOL_LABEL[pr]).join(" and ")} at ${entry2.host}:${entry2.port} is no longer authorized; ${left} still is. Run the command again.`);
         }
         const text2 = destRefusalText(e);
         if (text2) return die(text2);
@@ -38331,7 +39048,7 @@ async function credDest(client, args, flags, asJson, die) {
     }
     const after = await list();
     if (!asJson) {
-      console.log(after.destinations.length === 0 ? `"${name}" is no longer restricted. It is accepted at any host on any protocol again.` : `withdrew ${entry.host}:${entry.port}`);
+      console.log(after.destinations.length === 0 ? `"${name}" is no longer restricted. It is accepted at any host on any protocol again.` : `withdrew ${entry2.host}:${entry2.port}`);
       console.log("");
     }
     return void await printList();
@@ -38343,7 +39060,33 @@ var ROLES = ["OWNER", "ADMIN", "EDITOR", "VIEWER"];
 var TOKEN_SCOPES = ["scim", "events"];
 var ORG_ROLES = ["owner", "admin", "member"];
 var ROTATION_SERVICES = ["linux_password", "postgres_password", "mysql_password"];
-var VERSION = true ? "1.2.14" : "dev";
+var VERSION = true ? "1.2.16" : "dev";
+var CMD_HELP = {
+  "ci-login": `kt ci-login --trust <id>
+
+Exchange this CI job's own OIDC token for a short-lived agent and print its token on stdout. Nothing
+is stored: export it as KT_AGENT_TOKEN for \`kt run\`.
+
+The token comes from KT_ID_TOKEN (GitLab id_tokens) or the GitHub Actions token service. The trust
+named by --trust (or KT_OIDC_TRUST_ID) accepts it only when all three claims match what was registered:
+  iss   the issuer: the CI instance URL, for example https://gitlab.example.com
+  aud   the audience: the aud your id_tokens block (or GitHub audience) requests
+  sub   the subject: matched against the trust's pattern, which names the project and optionally the ref
+        (GitLab: project_path:group/repo:ref_type:branch:ref:main)
+
+An org owner or admin registers a trust with \`kt trust add\`.
+Flags: --trust <id>, --json (print the whole exchange result instead of only the token).`,
+  trust: `kt trust add --issuer <url> --audience <aud> --subject <pattern> --vault <id> [--vault <id> ..]
+         [--name <n>] [--scopes vault.list,vault.use] [--egress lan|cloud] [--ttl <min>]
+kt trust ls
+kt trust rm <id>
+
+A trust is the rule \`kt ci-login\` checks a CI job's OIDC token against: issuer, audience and subject
+pattern. --vault is required and repeatable: a trust reaches only the vaults named, never the whole
+organization. Org owners and admins only; granting vault.reveal or write scopes asks for step-up.
+--egress defaults to lan (output stays on the local network); pass --egress cloud to allow cloud AI.
+A subject pattern that matches every project is refused.`
+};
 var HELP = `kt \u2014 Kutrion CLI
   kt login [--email <e>] [--password-stdin] [--code <2fa>]   prompts for the password, or reads it from stdin;
                                                with no --email or --password-stdin, first asks the Kutrion desktop app
@@ -38361,8 +39104,10 @@ var HELP = `kt \u2014 Kutrion CLI
 
   kt creds <vaultId>                           list credentials in a vault
   kt get <vaultId> <credId> [--reveal] [--vault-passphrase-stdin]   show a credential (the value only with --reveal); a Private vault asks for its passphrase
-  kt cred add <vaultId> --name <n> [--value-stdin] [--type PASSWORD] [--notes ..]   prompts for the value, or reads it from stdin
-  kt cred set <vaultId> <credId> [--name ..] [--value-stdin] [--notes ..]
+  kt cred add <vaultId> --name <n> [--value-stdin] [--vault-passphrase-stdin] [--type PASSWORD] [--notes ..]   prompts for the value, or reads it from stdin
+  kt cred set <vaultId> <credId> [--name ..] [--value-stdin] [--vault-passphrase-stdin] [--notes ..]
+                                               in a Private vault the value and notes are sealed here; with both
+                                               stdin flags, stdin is the passphrase line, then the value
   kt cred rm <vaultId> <credId>                delete a credential
   kt cred dest ls <vaultId> <credId>           where this credential may be presented
   kt cred dest add <vaultId> <credId> --host <h> [--protocol SSH] [--port N]
@@ -38372,10 +39117,30 @@ var HELP = `kt \u2014 Kutrion CLI
   kt export <vaultId> [file]                   export a vault's credentials (plaintext, written mode 0600)
 
   kt mcp install --client <id> [--egress lan]  connect an AI client (claude-code|claude-desktop|cursor|copilot)
+      [--vault <id|name>]... [--connection <id>]...   limit the agent to these vaults/connections (repeatable;
+                                               none given = everything its owner can reach; unknown names refuse before minting)
+  kt agent mint [--scope-vault <id|name>]... [--scope-conn <id>]... [--write-env <file>]
+                                               mint an agent for a server install; --write-env writes
+                                               KT_AGENT_TOKEN/KT_API_BASE to a 0600 file and never prints the token
   kt mcp status                                report each client's agent and which clients are wired
   kt mcp uninstall [--client <id>]             revoke the agent and remove the client config entry
   kt mcp                                       serve MCP over stdio (what the client config invokes)
+  kt config set base-fallback <url>[,<url>...] [--allow-insecure-lan]
+                                               other addresses for the same server, tried in order only when the
+                                               primary cannot be reached (connection failure or a 52x from the edge,
+                                               never an HTTP error from the API). Must be https unless the base is
+                                               opted in with --allow-insecure-lan, which warns on stderr per request.
+                                               Tokens carry no host or issuer claim (HS256 against the deployment's
+                                               signing key), so any address reaching the SAME deployment accepts them and
+                                               refresh follows whichever base answers; a different deployment refuses
+                                               them. Websocket sessions (shell, forward) do not fall back.
+  kt config get|unset base-fallback            show or clear that list
   kt ci-login --trust <id>                     exchange this CI job's OIDC token for an agent (no stored credential)
+  kt trust add --issuer <url> --audience <aud> --subject <pattern> --vault <id> [--vault <id> ..]
+                                               register the CI identity ci-login accepts (org owner or admin)
+    [--name <n>] [--scopes vault.list,vault.use] [--egress lan|cloud] [--ttl <min>]
+  kt trust ls                                  list the registered trusts
+  kt trust rm <id>                             revoke a trust (no new exchange; issued agents run out their lifetime)
 
   kt conns                                     list SSH connections
   kt ssh <connId>                              interactive SSH shell (Ctrl-] to detach)
@@ -38387,7 +39152,10 @@ var HELP = `kt \u2014 Kutrion CLI
                                                --insert places it at the prompt without pressing Enter
   kt demo [start]                              brokered sandbox session, then the audit trail + AI summary
   kt demo status | reset                       demo availability / remove everything it provisioned
-  kt exec <connId> <command...>                run one command via the audited broker
+  kt exec <connId> [--stdin] [--] <command...> run one command via the audited broker; --stdin sends
+                                               this process's stdin (up to 8 MiB) to the command, never
+                                               to its argv. Without it stdin is not read. kt's flags end at the
+                                               connId (or the first --); the rest goes to the remote verbatim
   kt forward <connId> <localPort>:<dstHost>:<dstPort>   (ssh -L style tunnel)
 
   kt sftp ls <connId> [path]                   list a remote directory
@@ -38414,7 +39182,8 @@ var HELP = `kt \u2014 Kutrion CLI
   A "side" below is written <sftp|file|cloud>:<connId>:<path> \u2014 one argument for one endpoint.
 
   kt transfer <from> <to> [--dir]              remote-to-remote, brokered by the server
-    [--conflict overwrite|skip|rename] [--throttle <bytes/sec>]
+    [--conflict overwrite|skip|rename] [--throttle <bytes/sec>] [--timeout <sec>]
+                                               a <to> with no trailing slash whose parent exists names the file
   kt sync <from> <to> [--newer-only]           directory sync
     [--mirror] [--yes] [--dry-run]             --mirror DELETES extra files at the destination
 
@@ -38423,6 +39192,7 @@ var HELP = `kt \u2014 Kutrion CLI
   kt job new <from> <to> [--wait]              queue a job (--wait polls to completion)
     [--dir] [--verify] [--throttle N] [--newer-only] [--mirror --yes] [--timeout <sec>]
   kt job wait <id> [--timeout <sec>]           poll an existing job
+  kt job cancel <id>                           cancel a queued or running job
 
   kt schedule [ls]                             recurring transfers
   kt schedule new <name> <from> <to>           --every <sec> or --daily-at HH:MM (UTC)
@@ -38431,6 +39201,7 @@ var HELP = `kt \u2014 Kutrion CLI
 
   kt watcher [ls]                              folder watchers (fire on new/changed files)
   kt watcher new <name> <source> <dest>        [--pattern <glob>] [--every <sec>]
+    --every is 60..86400 seconds (default 300); --pattern is a filename glob (* and ?), up to 256 characters, matched on the name only
     [--min-size N] [--max-size N] [--min-age <sec>] [--no-stability]
   kt watcher enable|disable|rm <id>            pause / resume / delete a watcher
 
@@ -38545,7 +39316,7 @@ var HELP = `kt \u2014 Kutrion CLI
     [--reporter console|junit|json] [--out <file>] [--dry-run]
     with KT_AGENT_TOKEN set, runs as that pipeline principal over /mcp
 
-  kt history [query] [--limit N]               searchable command history
+  kt history [query] [--limit N]               searchable history of brokered exec commands, such as kt exec; not shell input
     [--session <id>] [--host <connection id>] [--since <iso>] [--until <iso>]
   kt news                                      security news feed
 
@@ -38565,6 +39336,7 @@ var HELP = `kt \u2014 Kutrion CLI
   kt mfa verify --code <code>                  finish TOTP enrollment
   kt mfa disable                               turn off TOTP
   kt mfa backup-codes                          regenerate backup codes
+  kt step-up                                   prove app-MFA now (code is prompted), then re-run the refused command
   kt passkeys                                  registered passkeys / security keys
   kt passkey rm <id>                           remove a passkey
 
@@ -38690,13 +39462,17 @@ function refusedSavedSession(e, argv2) {
   }
 }
 async function main() {
-  const { cmd, positionals, flags } = parseArgs(process.argv.slice(2));
+  const { cmd, positionals, flags, multi } = parseArgs(process.argv.slice(2));
   const asJson = flags.json === true;
   const die = (msg2) => {
     console.error(msg2);
     process.exit(1);
   };
   const unknown = unknownFlags(flags);
+  if (flags.help === true && cmd !== "help") {
+    console.log(CMD_HELP[cmd] ?? HELP);
+    return;
+  }
   if (unknown.length) die(`unknown flag: ${unknown.map((f) => `--${f}`).join(", ")}
 run \`kt --help\` for the flags each command takes`);
   if (cmd === "--version" || cmd === "-v" || cmd === "version") {
@@ -38707,6 +39483,7 @@ run \`kt --help\` for the flags each command takes`);
   const configured = resolveBase(flags.base);
   if (!configured && !offlineLint && cmd !== "help" && cmd !== "--help" && cmd !== "-h") die(NO_BASE);
   const cfg = { base: configured };
+  if (!offlineLint && configured) installBaseFallback(configured);
   let issued;
   let signedThisRun = false;
   const ensureRefreshKeyBound = async () => {
@@ -38732,8 +39509,11 @@ run \`kt --help\` for the flags each command takes`);
     });
     if (outcome !== "failed" && borrowedDevice(cfg.base, kcSlots)?.id === dev.id) settleRefreshBind(cfg.base, kcSlots, dev.id);
   };
+  const longCall = cmd === "transfer" || cmd === "sync";
+  const longTimeoutSec = Number(flags.timeout);
   const client = new KutrionClient({
     baseUrl: cfg.base,
+    ...longCall ? { timeoutMs: (Number.isFinite(longTimeoutSec) && longTimeoutSec > 0 ? longTimeoutSec : 6 * 3600) * 1e3 } : {},
     getToken: () => getToken(cfg.base),
     onToken: (t) => {
       issued = t || void 0;
@@ -38780,6 +39560,14 @@ run \`kt --help\` for the flags each command takes`);
   });
   const kc = { get: getToken, set: setToken, clear: clearToken };
   const hubCall = hubCallFor(cfg.base);
+  const vaultCustody = async (vaultId) => {
+    try {
+      return await resolveVaultCustody(client, vaultId, { base: cfg.base, memory: PRIVATE_VAULTS, passphraseStdin: flags[PASSPHRASE_STDIN_FLAG] === true });
+    } catch (e) {
+      if (e instanceof PrivateVaultError) return die(e.message);
+      throw e;
+    }
+  };
   const connectionContext = async (connId) => {
     try {
       const rows = (await client.listConnections()).connections;
@@ -38855,6 +39643,10 @@ run \`kt --help\` for the flags each command takes`);
       timeoutMs: (intFlag("timeout") ?? 3600) * 1e3,
       onTick: (j) => {
         if (ticker) process.stderr.write(`\r${j.status} \u2014 ${j.files} file(s), ${fmtBytes(j.bytes)}   `);
+      },
+      onRetry: (e) => {
+        if (!asJson) process.stderr.write(`${ticker ? "\n" : ""}could not reach the server (${e instanceof Error ? e.message : String(e)}); still waiting
+`);
       }
     });
     if (ticker) process.stderr.write("\n");
@@ -38864,8 +39656,8 @@ run \`kt --help\` for the flags each command takes`);
       process.exit(EXIT_UNKNOWN);
     }
     show(job);
-    if (job.status === "failed") {
-      if (!asJson) console.error(`job failed: ${job.error ?? "no reason given"}`);
+    if (job.status === "failed" || job.status === "canceled") {
+      if (!asJson) console.error(`job ${job.status}: ${job.error ?? "no reason given"}`);
       process.exit(EXIT_FAIL);
     }
     process.exit(EXIT_OK);
@@ -38951,7 +39743,6 @@ run \`kt --help\` for the flags each command takes`);
         process.exit(1);
       }
       const staleDevice = dropBorrowed(cfg.base, kc);
-      if (staleDevice) await client.revokeDevice(staleDevice).catch(() => void 0);
       const post = fetchPost(cfg.base, refuseBodyRedirects());
       const registered = await registerOwnDevice({
         base: cfg.base,
@@ -38966,8 +39757,10 @@ run \`kt --help\` for the flags each command takes`);
           } catch {
             return null;
           }
-        })()
+        })(),
+        previousDeviceId: staleDevice
       }).catch(() => ({ kind: "skipped", note: null }));
+      if (staleDevice) await client.revokeDevice(staleDevice).catch(() => void 0);
       recordSignIn(accountRoot, signedIn);
       recordLastAccountId(cfg.base, kc, signedIn);
       console.log(`logged in (token stored in ${backendName()})`);
@@ -38998,7 +39791,10 @@ run \`kt --help\` for the flags each command takes`);
       break;
     case "whoami":
       requireAuth();
-      show((await client.me()).user);
+      {
+        const { user } = await client.me();
+        show(asJson ? user : whoamiLines(user));
+      }
       break;
     case "vaults":
       requireAuth();
@@ -39007,8 +39803,13 @@ run \`kt --help\` for the flags each command takes`);
     case "vault": {
       requireAuth();
       const sub = positionals[0];
-      if (sub === "create" && positionals[1]) show((await client.createVault(positionals.slice(1).join(" "))).vault);
-      else if (sub === "rename" && positionals[1] && positionals[2]) show((await client.renameVault(positionals[1], positionals.slice(2).join(" "))).vault);
+      if (sub === "create" && positionals[1]) {
+        const name = positionals.slice(1).join(" ");
+        const twin = await client.listVaults().then((r) => r.vaults.find((v) => !v.team_id && v.name === name), () => void 0);
+        if (twin) console.error(`warning: a vault named "${name}" already exists (${twin.id}); creating another`);
+        const { vault } = await client.createVault(name);
+        show(asJson ? vault : `created vault "${vault.name}" (${vault.id})`);
+      } else if (sub === "rename" && positionals[1] && positionals[2]) show((await client.renameVault(positionals[1], positionals.slice(2).join(" "))).vault);
       else if (sub === "rm" && positionals[1]) {
         await client.deleteVault(positionals[1]);
         console.log("deleted");
@@ -39037,12 +39838,15 @@ run \`kt --help\` for the flags each command takes`);
         noReveal = credential.value === null;
       } else {
         const summary = (await client.listCredentials(positionals[0])).credentials.find((c) => c.id === positionals[1]);
-        if (!summary) return die(`no credential ${positionals[1]} in vault ${positionals[0]}`);
+        if (!summary) {
+          console.error(`no credential ${positionals[1]} in vault ${positionals[0]}`);
+          process.exit(EXIT_NOT_FOUND);
+        }
         noReveal = summary.inject_only === true;
         if (noReveal) show({ ...summary, value: null });
         else {
           show({ ...summary, value_hidden: true });
-          console.error("value hidden; pass --reveal to print it");
+          if (!asJson) console.error("value hidden; pass --reveal to print it");
         }
       }
       if (noReveal) {
@@ -39064,17 +39868,45 @@ run \`kt --help\` for the flags each command takes`);
         if (flags.value !== void 0) refuseSecretFlag("value", "pipe it to --value-stdin, or leave it off to be prompted");
         if (flags["value-stdin"] === true && typeof flags.name !== "string") die("--value-stdin needs --name, because stdin carries the value");
         const name = String(flags.name ?? await prompt("name: "));
-        const value = flags["value-stdin"] === true ? await readSecret("value: ") : await prompt("value: ", true);
         const notes = flags.notes !== void 0 ? String(flags.notes) : void 0;
-        show((await client.storeCredential(vaultId, { credential_type: type, name, value, notes })).credential);
+        const custody = await vaultCustody(vaultId);
+        if (custody.private) {
+          try {
+            const { vault, value: value2 } = await unlockForSealedWrite(client, flags, true);
+            show(withNotesMarker((await createSealedItem(client, vault, vaultId, custody.key, { credential_type: type, name }, { value: value2, notes })).credential, notes));
+          } catch (e) {
+            if (e instanceof PrivateVaultError) return die(e.message);
+            throw e;
+          }
+          break;
+        }
+        const value = flags["value-stdin"] === true ? await readSecret("value: ") : await prompt("value: ", true);
+        if (value === "") die(EMPTY_VALUE_MESSAGE);
+        show(withNotesMarker((await client.storeCredential(vaultId, { credential_type: type, name, value, notes })).credential, notes));
       } else if (sub === "set" && vaultId && positionals[2]) {
         if (flags.value !== void 0) refuseSecretFlag("value", "pipe it to --value-stdin");
         const patch = {};
         if (flags.name !== void 0) patch.name = String(flags.name);
-        if (flags["value-stdin"] === true) patch.value = await readSecret("value: ");
         if (flags.notes !== void 0) patch.notes = String(flags.notes);
-        if (!Object.keys(patch).length) return die("nothing to update \u2014 pass --name/--value-stdin/--notes");
-        show((await client.updateCredential(vaultId, positionals[2], patch)).credential);
+        if (!Object.keys(patch).length && flags["value-stdin"] !== true) return die("nothing to update \u2014 pass --name/--value-stdin/--notes");
+        const custody = await vaultCustody(vaultId);
+        if (custody.private) {
+          try {
+            const sealsFields = flags["value-stdin"] === true || patch.notes !== void 0;
+            const unlocked = sealsFields ? await unlockForSealedWrite(client, flags, flags["value-stdin"] === true) : null;
+            if (unlocked?.value !== void 0) patch.value = unlocked.value;
+            show(withNotesMarker((await updateSealedItem(client, unlocked?.vault ?? null, vaultId, positionals[2], custody.key, patch)).credential, patch.notes));
+          } catch (e) {
+            if (e instanceof PrivateVaultError) return die(e.message);
+            throw e;
+          }
+          break;
+        }
+        if (flags["value-stdin"] === true) {
+          patch.value = await readSecret("value: ");
+          if (patch.value === "") die(EMPTY_VALUE_MESSAGE);
+        }
+        show(withNotesMarker((await client.updateCredential(vaultId, positionals[2], patch)).credential, patch.notes));
       } else if (sub === "rm" && vaultId && positionals[2]) {
         await client.deleteCredential(vaultId, positionals[2]);
         console.log("deleted");
@@ -39155,8 +39987,20 @@ run \`kt --help\` for the flags each command takes`);
     }
     case "exec": {
       requireAuth();
-      if (!positionals[0] || !positionals[1]) return die("usage: kt exec <connId> <command...>");
-      const r = await client.exec(positionals[0], positionals.slice(1).join(" ")).catch(async (e) => {
+      if (!positionals[0] || !positionals[1]) return die("usage: kt exec <connId> [--stdin] [--] <command...>");
+      let stdin;
+      if (flags.stdin === true) {
+        const takes = await serverTakesExecStdin(cfg.base).catch((e) => {
+          if (e instanceof ExecStdinCheckTimedOut) return die(e.message);
+          throw e;
+        });
+        if (!takes) return die(STDIN_UNSUPPORTED);
+        stdin = await readExecStdin(process.stdin).catch((e) => {
+          if (e instanceof StdinTooLargeError) return die(`error: ${e.message}`);
+          throw e;
+        });
+      }
+      const r = await client.exec(positionals[0], positionals.slice(1).join(" "), stdin?.toString("base64")).catch(async (e) => {
         const k = hostKeyUnconfirmedFromError(e);
         const chained = k ? null : hostKeyChainedFromError(e);
         if (!k && !chained) throw e;
@@ -39195,7 +40039,7 @@ run \`kt --help\` for the flags each command takes`);
       }
       let job;
       try {
-        job = parseJobFile((0, import_fs5.readFileSync)(path, "utf8"));
+        job = parseJobFile((0, import_fs7.readFileSync)(path, "utf8"));
       } catch (e) {
         return die(e instanceof JobFileError ? `${path}: ${e.message}` : `${path}: ${e.message}`);
       }
@@ -39204,7 +40048,7 @@ run \`kt --help\` for the flags each command takes`);
       if (agentToken && !asJson && reporter === "console") {
         console.error(`running as a pipeline principal through ${cfg.base.replace(/\/+$/, "")}/mcp`);
       }
-      const result = await runJob(job, runnerClient, { readLocal: (p) => (0, import_fs5.readFileSync)(p), writeLocal: (p, d) => (0, import_fs5.writeFileSync)(p, d) }, {
+      const result = await runJob(job, runnerClient, { readLocal: (p) => (0, import_fs7.readFileSync)(p), writeLocal: (p, d) => (0, import_fs7.writeFileSync)(p, d) }, {
         dryRun,
         onStep: (s) => {
           if (asJson || reporter !== "console") return;
@@ -39230,7 +40074,7 @@ run \`kt --help\` for the flags each command takes`);
           const path = positionals[2] ?? ".";
           const r = await client.sftpList(connId, path);
           if (asJson) return console.log(JSON.stringify(r, null, 2));
-          show(r.entries, ["name", "type", "size", "mode"]);
+          show(r.entries.map((e) => ({ ...e, mode: modeString(e.mode, e.type) })), ["name", "type", "size", "mode"]);
         } else if (sub === "mkdir" && connId && positionals[2]) {
           await client.sftpMkdir(connId, positionals[2]);
           console.log("created");
@@ -39302,6 +40146,11 @@ run \`kt --help\` for the flags each command takes`);
         to,
         throttle_bps: intFlag("throttle"),
         ...conflict ? { conflict } : {}
+      }).catch((e) => {
+        if (!unreachedApi(e)) throw e;
+        if (asJson) console.log(JSON.stringify({ status: "unknown", error: e instanceof Error ? e.message : String(e) }, null, 2));
+        else console.error(`no answer from the server (${e instanceof Error ? e.message : String(e)}); the transfer may still be running or may have completed. Check the destination before running it again, or use \`kt job new\` for a transfer you can poll.`);
+        return process.exit(EXIT_UNKNOWN);
       });
       if (asJson) return console.log(JSON.stringify(r, null, 2));
       console.log(`transferred ${r.files} file(s), ${fmtBytes(r.bytes)}${r.skipped ? `, ${r.skipped} skipped` : ""}${r.renamed ? `, ${r.renamed} renamed` : ""}`);
@@ -39350,8 +40199,10 @@ run \`kt --help\` for the flags each command takes`);
         return await watchJob(job.id);
       } else if (sub === "wait" && positionals[1]) {
         return await watchJob(positionals[1]);
+      } else if (sub === "cancel" && positionals[1]) {
+        show((await client.cancelTransferJob(positionals[1])).job);
       } else {
-        die("usage: kt job [ls] | kt job get <id> | kt job new <from> <to> [--wait] | kt job wait <id>");
+        die("usage: kt job [ls] | kt job get <id> | kt job new <from> <to> [--wait] | kt job wait <id> | kt job cancel <id>");
       }
       break;
     }
@@ -39401,6 +40252,13 @@ run \`kt --help\` for the flags each command takes`);
       } else if (sub === "new" && positionals[1] && positionals[2] && positionals[3]) {
         const source = sideArg(positionals[2], "source");
         const dest = sideArg(positionals[3], "destination");
+        const every = intFlag("every");
+        if (flags.every === true || every !== void 0 && (!Number.isInteger(every) || every < WATCHER_EVERY_MIN || every > WATCHER_EVERY_MAX)) {
+          return die(`--every must be a whole number of seconds from ${WATCHER_EVERY_MIN} to ${WATCHER_EVERY_MAX} (got ${flags.every === true ? "nothing" : flags.every})`);
+        }
+        if (flags.pattern !== void 0 && (flags.pattern === true || !String(flags.pattern).trim() || String(flags.pattern).length > WATCHER_PATTERN_MAX)) {
+          return die(`--pattern needs a filename glob such as '*.csv', at most ${WATCHER_PATTERN_MAX} characters`);
+        }
         show((await client.createFolderWatcher({
           name: positionals[1],
           source,
@@ -39414,7 +40272,7 @@ run \`kt --help\` for the flags each command takes`);
           // Stability checks are what stop a watcher picking up a file that is still being written.
           // Off is opt-in, never a default.
           stability_checks: flags["no-stability"] !== true,
-          interval_seconds: intFlag("every")
+          interval_seconds: every
         })).watcher);
       } else if ((sub === "enable" || sub === "disable") && positionals[1]) {
         await client.setFolderWatcherEnabled(positionals[1], sub === "enable");
@@ -39486,11 +40344,11 @@ ${r.authorize_url}`);
         const buf = Buffer.from(await blob.arrayBuffer());
         if (local === "-") process.stdout.write(buf);
         else {
-          (0, import_fs5.writeFileSync)(local, buf);
+          (0, import_fs7.writeFileSync)(local, buf);
           console.error(`saved ${local} (${fmtBytes(buf.length)})`);
         }
       } else if (sub === "put" && id && positionals[2] && positionals[3]) {
-        const buf = (0, import_fs5.readFileSync)(positionals[2]);
+        const buf = (0, import_fs7.readFileSync)(positionals[2]);
         await client.cloudUpload(id, positionals[3], new Blob([buf]));
         console.error(`uploaded ${fmtBytes(buf.length)}`);
       } else if (sub === "mkdir" && id && positionals[2]) {
@@ -39596,17 +40454,20 @@ ${r.token}`);
         }
         const scopes = flags.scopes ? String(flags.scopes).split(",").map((s) => s.trim()).filter(Boolean) : DEFAULT_SCOPES;
         const ttlDays = flags.days !== void 0 ? Number(flags.days) : DEFAULT_TTL_DAYS;
-        const dir = (0, import_path6.resolve)(String(flags.dir ?? process.cwd()));
+        const dir = (0, import_path7.resolve)(String(flags.dir ?? process.cwd()));
         const egress = String(flags.egress ?? "cloud");
         if (egress !== "lan" && egress !== "cloud") return die("--egress must be lan or cloud");
+        if (flags.vault === true || flags.connection === true) return die("--vault and --connection each take a value (an id or a name)");
         try {
-          const r = await installClient({ base: cfg.base, userToken, client: client2, dir, scopes, ttlDays, egressClass: egress });
+          const resourceScope = await resolveResourceScope(cfg.base, userToken, multi.vault ?? [], multi.connection ?? []);
+          const r = await installClient({ base: cfg.base, userToken, client: client2, dir, scopes, ttlDays, egressClass: egress, resourceScope });
           warnLeftLive(r, client2);
           if (asJson) return console.log(JSON.stringify(r, null, 2));
           console.log(`installed ${CLIENTS[client2].label}`);
           console.log(`  config    ${r.configPath}`);
           console.log(`  agent     ${r.principalId} (expires ${r.expiresAt})`);
           console.log(`  scopes    ${r.scopes.join(", ")}`);
+          console.log(`  reach     ${describeScope(r.resourceScope)}`);
           if (r.superseded) console.log(`  revoked   ${r.superseded} earlier agent(s) for this client`);
           console.log(`  credential stored in the ${backendName()} \u2014 the config file does not contain it`);
           console.log(r.verified ? "  verified  connection to the broker works" : "  warning: could not verify the connection");
@@ -39625,7 +40486,7 @@ next: ${r.next}`);
         break;
       }
       if (sub === "status") {
-        const dir = (0, import_path6.resolve)(String(flags.dir ?? process.cwd()));
+        const dir = (0, import_path7.resolve)(String(flags.dir ?? process.cwd()));
         const s = await mcpStatus(cfg.base, dir);
         if (asJson) return console.log(JSON.stringify(s, null, 2));
         console.log(`credential store: ${s.keychain}`);
@@ -39645,6 +40506,7 @@ next: ${r.next}`);
           if (c.agent?.state !== "live") continue;
           const rl = c.agent.rate_limit;
           console.log(`${c.client}: scopes ${(c.agent.scopes ?? []).join(", ")}` + (rl?.tool_calls ? `; limit ${rl.tool_calls} tool calls / ${Math.round((rl.window_ms ?? 0) / 1e3)}s` : ""));
+          console.log(`${c.client}: reach ${describeScope(c.agent.resource_scope)}`);
         }
         if (s.legacy) console.log(`
 shared pre-split credential: ${s.legacy.principal_id ?? ""} ${state(s.legacy)}`.trimEnd());
@@ -39656,7 +40518,7 @@ shared pre-split credential: ${s.legacy.principal_id ?? ""} ${state(s.legacy)}`.
         if (client2 && !CLIENT_IDS.includes(client2)) {
           return die(`unknown --client; one of: ${CLIENT_IDS.join(", ")}`);
         }
-        const dir = (0, import_path6.resolve)(String(flags.dir ?? process.cwd()));
+        const dir = (0, import_path7.resolve)(String(flags.dir ?? process.cwd()));
         const r = await uninstallClient({ base: cfg.base, userToken, client: client2, dir });
         warnLeftLive(r, client2);
         if (asJson) return console.log(JSON.stringify(r, null, 2));
@@ -39665,7 +40527,7 @@ shared pre-split credential: ${s.legacy.principal_id ?? ""} ${state(s.legacy)}`.
         break;
       }
       if (sub && sub !== "serve") {
-        return die("usage: kt mcp [serve] | kt mcp install --client <id> | kt mcp status | kt mcp uninstall [--client <id>]");
+        return die("usage: kt mcp [serve] | kt mcp install --client <id> [--vault <id|name>]... [--connection <id>]... | kt mcp status | kt mcp uninstall [--client <id>]");
       }
       if (flags.token !== void 0) refuseSecretFlag("token", "export KT_AGENT_TOKEN instead, or run kt mcp install");
       let agentToken;
@@ -39686,6 +40548,136 @@ shared pre-split credential: ${s.legacy.principal_id ?? ""} ${state(s.legacy)}`.
       await runMcpBridge({ base: cfg.base, token: agentToken });
       break;
     }
+    // #3545: a principal for a server install, which has no keychain and no AI client config to write.
+    case "agent": {
+      if (positionals[0] !== "mint") {
+        return die("usage: kt agent mint [--name <n>] [--scopes a,b] [--days <n>] [--egress lan|cloud] [--scope-vault <id|name>]... [--scope-conn <id|name>]... [--write-env <file>]");
+      }
+      const userToken = requireAuth();
+      if (flags["scope-vault"] === true || flags["scope-conn"] === true) return die("--scope-vault and --scope-conn each take a value (an id or a name)");
+      if (flags["write-env"] === true) return die("--write-env takes a file path");
+      const scopes = flags.scopes ? String(flags.scopes).split(",").map((x) => x.trim()).filter(Boolean) : DEFAULT_SCOPES;
+      const ttlDays = flags.days !== void 0 ? Number(flags.days) : DEFAULT_TTL_DAYS;
+      const egress = String(flags.egress ?? "cloud");
+      if (egress !== "lan" && egress !== "cloud") return die("--egress must be lan or cloud");
+      const envFile = typeof flags["write-env"] === "string" ? (0, import_path7.resolve)(String(flags["write-env"])) : void 0;
+      let created = false;
+      if (envFile) {
+        if ((0, import_fs7.existsSync)(envFile) && flags.yes !== true) return die(`${envFile} already exists; pass --yes to replace it (the principal it names stays live until revoked)`);
+        created = !(0, import_fs7.existsSync)(envFile);
+        try {
+          writeOwnerOnly(envFile, "");
+        } catch (e) {
+          return die(`cannot write ${envFile}: ${e.message}`);
+        }
+      }
+      try {
+        const resourceScope = await resolveResourceScope(cfg.base, userToken, multi["scope-vault"] ?? [], multi["scope-conn"] ?? []);
+        const m = await mintAgent({
+          base: cfg.base,
+          userToken,
+          name: String(flags.name ?? `kt agent on ${(0, import_os5.hostname)()}`).slice(0, 120),
+          purpose: "Server install minted with 'kt agent mint'",
+          scopes,
+          ttlDays,
+          egressClass: egress,
+          resourceScope
+        });
+        if (envFile) writeOwnerOnly(envFile, `KT_AGENT_TOKEN=${m.token}
+KT_API_BASE=${cfg.base}
+`);
+        const view = { principal_id: m.id, expires_at: m.expires_at, scopes: m.scopes, resource_scope: resourceScope ?? null, ...envFile ? { env_file: envFile } : { token: m.token } };
+        if (asJson) return console.log(JSON.stringify(view, null, 2));
+        console.log(`minted agent ${m.id} (expires ${m.expires_at})`);
+        console.log(`  scopes    ${m.scopes.join(", ")}`);
+        console.log(`  reach     ${describeScope(resourceScope)}`);
+        if (envFile) console.log(`  wrote KT_AGENT_TOKEN and KT_API_BASE to ${envFile} (mode 0600); the token is not shown`);
+        else console.log(`  token     ${m.token}
+  shown once; export it as KT_AGENT_TOKEN`);
+      } catch (e) {
+        if (envFile && created) {
+          try {
+            (0, import_fs7.unlinkSync)(envFile);
+          } catch {
+          }
+        }
+        return die(`mint failed: ${e.message}`);
+      }
+      break;
+    }
+    // #3541: the OIDC trusts `kt ci-login` exchanges against. The routes are owner/admin only and the
+    // server refuses a pattern that matches every project; this only collects the three claims and the
+    // vault scope. --vault has no org-wide default.
+    case "trust": {
+      requireAuth();
+      const sub = positionals[0] ?? "ls";
+      if (sub === "ls") {
+        const trusts = (await client.listAgentOidcTrusts()).trusts.filter((t) => !t.disabled_at);
+        const vaultsOf = (t) => {
+          const ids = t.resource_scope?.vault_ids ?? [];
+          return ids.length ? ids.map((id) => `${t.resource_scope_names?.[id] ?? "vault"} (${id})`).join(", ") : "all vaults the owner can reach";
+        };
+        show(
+          asJson ? trusts : trusts.map((t) => ({ id: t.id, issuer: t.issuer, audience: t.audience, subject: t.subject_pattern, vaults: vaultsOf(t), created: t.created_at })),
+          ["id", "issuer", "audience", "subject", "vaults", "created"]
+        );
+      } else if (sub === "add") {
+        const need = (k) => typeof flags[k] === "string" && String(flags[k]).trim() ? String(flags[k]).trim() : die(`--${k} is required; see \`kt trust --help\``);
+        const issuer = need("issuer"), audience = need("audience"), subject = need("subject");
+        const vaultIds = repeatedFlag(process.argv.slice(2), "vault").flatMap((v) => v.split(",")).map((v) => v.trim()).filter(Boolean);
+        if (!vaultIds.length) return die("--vault <id> is required (repeat it for more): a trust reaches only the vaults named, never the whole organization");
+        const scopes = (typeof flags.scopes === "string" ? flags.scopes : "vault.list,vault.use").split(",").map((x) => x.trim()).filter(Boolean);
+        const egress = String(flags.egress ?? "lan");
+        if (egress !== "lan" && egress !== "cloud") return die("--egress must be lan or cloud");
+        const trust = await withStepUp(client, () => client.createAgentOidcTrust({
+          name: typeof flags.name === "string" && flags.name.trim() ? flags.name.trim() : `ci ${subject}`.slice(0, 120),
+          issuer,
+          audience,
+          subject_pattern: subject,
+          scopes,
+          ...flags.ttl !== void 0 ? { ttl_minutes: Number(flags.ttl) } : {},
+          egress_class: egress,
+          resource_scope: { vault_ids: vaultIds }
+        }));
+        if (asJson) return console.log(JSON.stringify(trust, null, 2));
+        console.log(`trust ${trust.id} created (egress: ${egress})`);
+        console.log(`use it in the pipeline:  kt ci-login --trust ${trust.id}`);
+      } else if (sub === "rm" && positionals[1]) {
+        await client.deleteAgentOidcTrust(positionals[1]);
+        console.log(`trust ${positionals[1]} revoked; no new exchange is accepted. Agents already issued under it run out their own lifetime.`);
+      } else {
+        die("usage: kt trust add --issuer <url> --audience <aud> --subject <pattern> --vault <id> | kt trust ls | kt trust rm <id>");
+      }
+      break;
+    }
+    // #3561: only the ordered fallback list lives here; the primary base is set by `kt login`.
+    case "config": {
+      const [sub, key, ...vals] = positionals;
+      if (key !== "base-fallback" || sub !== "set" && sub !== "get" && sub !== "unset") {
+        return die("usage: kt config set base-fallback <url>[,<url>...] [--allow-insecure-lan] | kt config get base-fallback | kt config unset base-fallback");
+      }
+      const saved = storedBase();
+      if (!saved) return die("no saved server to attach a fallback to; run `kt --base <url> login` first");
+      if (sub === "set") {
+        const urls = splitBases(vals);
+        if (!urls.length) return die("give at least one fallback base URL");
+        const entries = urls.map((url) => ({ url, ...flags["allow-insecure-lan"] === true && url.startsWith("http:") ? { insecure: true } : {} }));
+        for (const f of entries) {
+          const why2 = fallbackRefusal(f);
+          if (why2) return die(`error: ${why2}`);
+          if (norm(f.url) === norm(saved)) return die(`error: ${f.url} is the primary server`);
+        }
+        saveCfg(saved, entries);
+      } else if (sub === "unset") {
+        saveCfg(saved, []);
+      }
+      const now = readFallbacks(CONFIG, saved);
+      if (asJson) return console.log(JSON.stringify({ base: saved, fallbacks: now }, null, 2));
+      console.log(`primary  ${saved}`);
+      now.forEach((f, i) => console.log(`fallback ${i + 1}  ${f.url}${f.insecure ? "  (plain http, opted in)" : ""}`));
+      if (!now.length) console.log("no fallback bases");
+      break;
+    }
     // #674: exchange this CI job's own OIDC token for a short-lived agent principal. No Kutrion
     // secret is stored in the pipeline — the job token is minted per run by the CI provider.
     case "ci-login": {
@@ -39901,7 +40893,15 @@ ${snippetPreview(s)}
         const connection_id = String(flags.conn ?? ""), credential_id = String(flags.cred ?? "");
         if (!connection_id || !credential_id) return die("need --conn <id> --cred <id>");
         const input = { connection_id, credential_id, service, target: flags.target ? String(flags.target) : void 0 };
-        show(sub === "plan" ? await client.planRotation(input) : await client.executeRotation(input));
+        if (sub === "plan") show(await client.planRotation(input));
+        else {
+          try {
+            show(await client.executeRotation(input));
+          } catch (e) {
+            if (isStepUpRequired(e)) console.error("requires_step_up: true (as `kt rotation plan` reports); run `kt step-up`, then re-run");
+            throw e;
+          }
+        }
       } else die("usage: kt rotation services | history <credId> | plan|run --conn <id> --cred <id> --service <svc> [--target ..]");
       break;
     }
@@ -39973,8 +40973,9 @@ ${owed}`);
     case "device":
       requireAuth();
       if (positionals[0] === "rm" && positionals[1]) {
-        await client.revokeDevice(positionals[1]);
+        const r = await client.revokeDevice(positionals[1]);
         console.log("revoked");
+        if (r.agents_ended) console.log(`this ended ${r.agents_ended} agent${r.agents_ended === 1 ? "" : "s"}: ${(r.agents ?? []).map((a) => printable(String(a.name ?? ""))).join(", ")}`);
       } else die("usage: kt device rm <deviceId>");
       break;
     // --- vault share ---
@@ -40037,7 +41038,7 @@ ${r.url}`);
       } else if (sub === "import") {
         const vaultId = positionals[1], file = positionals[2];
         if (!vaultId || !file) return die(CONN_IMPORT_USAGE);
-        const parsed = await client.parseConnImport((0, import_fs5.readFileSync)(file, "utf8"), {
+        const parsed = await client.parseConnImport((0, import_fs7.readFileSync)(file, "utf8"), {
           provider: flags.provider ? String(flags.provider) : void 0,
           filename: file.split("/").pop()
         });
@@ -40167,7 +41168,7 @@ ${ENROLL_USAGE}`);
       const confirms = parseConfirms(process.argv.slice(2));
       if (!(confirms instanceof Map)) return die(confirms.error);
       if (flags.key === true || flags["known-hosts"] === true || flags.vault === true) return die(ENROLL_USAGE);
-      const knownHosts = typeof flags["known-hosts"] === "string" ? (0, import_fs5.readFileSync)(flags["known-hosts"], "utf8") : void 0;
+      const knownHosts = typeof flags["known-hosts"] === "string" ? (0, import_fs7.readFileSync)(flags["known-hosts"], "utf8") : void 0;
       const fallback = flags.fallback === true;
       const vaultId = typeof flags.vault === "string" ? flags.vault : void 0;
       const timeoutSec = intFlag("timeout") ?? 1800;
@@ -40187,7 +41188,7 @@ ${r.label}  ${r.host.observedFingerprint}`);
       if (!chosen.length) return die(ENROLL_COPY.noneConfirmed);
       let bootstrap;
       if (typeof flags.key === "string") {
-        const privateKey = (0, import_fs5.readFileSync)(flags.key, "utf8");
+        const privateKey = (0, import_fs7.readFileSync)(flags.key, "utf8");
         let passphrase;
         if (isEncryptedKey(privateKey)) {
           if (flags["password-stdin"] === true) passphrase = await readStdin();
@@ -40380,14 +41381,15 @@ ${BROKER_CA_USAGE}`);
       break;
     case "import-providers":
       requireAuth();
-      show((await client.importProviders()).providers, ["id", "name", "format", "ext"]);
+      show((await client.importProviders()).providers.map((p) => ({ ...p, name: p.label })), ["id", "name", "format", "ext"]);
       break;
     case "import": {
       requireAuth();
       const vaultId = positionals[0];
       const file = positionals[1];
       if (!vaultId || !file) die("usage: kt import <vaultId> <file> [--provider <name>]  (see: kt import-providers)");
-      const content = (0, import_fs5.readFileSync)(file, "utf8");
+      const content = (0, import_fs7.readFileSync)(file, "utf8");
+      if ((await vaultCustody(vaultId)).private) return die(PRIVATE_IMPORT_REFUSED);
       const parsed = await client.parseImport(content, { provider: flags.provider ? String(flags.provider) : void 0, filename: file.split("/").pop() });
       for (const w of parsed.warnings) console.error("warning:", w);
       const items = parsed.items.filter((it) => it.name && it.value).map((it) => ({ ...it, name: it.name.slice(0, 255) }));
@@ -40466,6 +41468,19 @@ Add this to your authenticator, then run: kt mfa verify --code <code>`);
       }
       break;
     }
+    // The adaptive gate's step-up is a per-session proof (server lib/step-up.ts), so one code here clears
+    // the refusal for every command this session runs until it lapses. The code never rides on argv.
+    case "step-up": {
+      requireAuth();
+      if (positionals.length || flags.code !== void 0) die("usage: kt step-up   (the authenticator code is asked for, or read from stdin)");
+      const status = await client.mfaStatus();
+      if (status.methods.totp !== true) die("this account has no authenticator app to step up with; enrol one with `kt mfa setup`, then `kt mfa verify --code <code>`, then run `kt step-up`");
+      const code = await prompt("authenticator code: ", true);
+      if (!code) die("no authenticator code given");
+      await client.stepUpTotp(code);
+      console.log("step-up verified; re-run the refused command within a few minutes");
+      break;
+    }
     case "passkeys":
       requireAuth();
       show((await client.listPasskeys()).passkeys, ["id", "label", "kind", "created_at", "last_used"]);