@kutrion/cli 1.2.9 → 1.2.11

package/dist/index.js

@@ -42,8 +42,10 @@ var init_define_KT_HUB_FILES = __esm({
 #   ensure-hub.sh compare A B | verify-file FILE SHA512_B64
 #
 # Exit: 0 present, installed or skipped by policy; 10 refused; 11 cannot install here; 12 fetch failed.
+# Every run that gets past argument parsing ends with one "ensure-hub: finished exit=N" line, so a caller can wait on it.
 # Environment: KT_NO_HUB=1 skips; KT_HUB_FEED_BASE (https or file) replaces the feed;
-# KT_HUB_ALLOW_UNSIGNED=1 accepts a build with no publisher identity; KT_HUB_APPS_DIR replaces /Applications.
+# KT_HUB_ALLOW_UNSIGNED=1 accepts a build with no publisher identity; KT_HUB_APPS_DIR replaces /Applications;
+# KT_HUB_FETCH_BUDGET seconds bounds one download across its resumed attempts (default 1200).
 set -u
 
 SELF_DIR=$(cd "$(dirname "$0")" && pwd)
@@ -51,7 +53,7 @@ CONF=\${KT_HUB_CONF:-$SELF_DIR/hub.conf}
 APP_ID=com.kutrion.desktop
 PKG_NAME=kutrion
 
-log() { printf 'ensure-hub: %s\\n' "$*"; }
+log() { printf 'ensure-hub: %s %s\\n' "$(date -u +%H:%M:%S)" "$*"; }
 refuse() { log "refused, nothing installed: $*"; exit 10; }
 cannot() { log "skipped: $*"; exit 11; }
 
@@ -99,15 +101,49 @@ verify_file() {
   [ "$got" = "$2" ] || return 10
 }
 
+file_size() { wc -c < "$1" 2>/dev/null | tr -d ' ' || echo 0; }
+
+# A download that stalls or drops resumes from the bytes already on disk instead of starting over; the whole
+# download shares one budget so a dead link ends the run rather than holding the install lock.
 fetch() {
   case "$1" in
-    file://*) command cp "\${1#file://}" "$2" 2>/dev/null ;;
-    https://*)
-      if command -v curl >/dev/null 2>&1; then curl -fsSL --proto '=https' --tlsv1.2 --retry 2 --connect-timeout 15 --max-time 900 -o "$2" "$1"
-      elif command -v wget >/dev/null 2>&1; then wget -q --https-only -O "$2" "$1"
-      else return 1; fi ;;
+    file://*) command cp "\${1#file://}" "$2" 2>/dev/null; return ;;
+    https://*) ;;
     *) return 1 ;;
   esac
+  if ! command -v curl >/dev/null 2>&1; then
+    command -v wget >/dev/null 2>&1 || return 1
+    wget -q --https-only -c -O "$2" "$1"; return
+  fi
+  budget=\${KT_HUB_FETCH_BUDGET:-1200}; case "$budget" in ''|*[!0-9]*) budget=1200 ;; esac
+  t0=$(date +%s); n=0
+  while :; do
+    left=$((budget - ($(date +%s) - t0)))
+    [ "$left" -gt 0 ] || { log "fetch budget of \${budget}s used up at $(file_size "$2") bytes"; return 1; }
+    n=$((n + 1))
+    curl -fsS --proto '=https' --tlsv1.2 -C - --connect-timeout 15 --max-time "$left" --speed-time 60 --speed-limit 1024 -o "$2" "$1" && return 0
+    rc=$?
+    log "fetch attempt $n stopped (curl exit $rc) at $(file_size "$2") bytes"
+    [ "$n" -lt 20 ] || return 1
+    sleep 5
+  done
+}
+
+# fetch with a begin line, a byte count every 30 s while it runs, and an end line.
+fetch_logged() {
+  log "fetch begin $1"
+  t=$(date +%s)
+  case "$1" in
+    https://*)
+      parent=$$
+      ( while sleep 30; do kill -0 "$parent" 2>/dev/null || exit 0; log "fetching, $(file_size "$2") bytes so far"; done ) &
+      tick=$!
+      fetch "$1" "$2"; rc=$?
+      kill "$tick" 2>/dev/null; wait "$tick" 2>/dev/null ;;
+    *) fetch "$1" "$2"; rc=$? ;;
+  esac
+  log "fetch end rc=$rc bytes=$(file_size "$2") seconds=$(( $(date +%s) - t ))"
+  return $rc
 }
 
 # A feed file name is a bare name; anything with a path, scheme or whitespace could point off the feed origin.
@@ -194,7 +230,7 @@ retry() {
   while :; do
     "$@" && return 0
     [ "$DEFER" -eq 1 ] && [ "$n" -lt 36 ] || return 1
-    n=$((n + 1)); sleep 5
+    n=$((n + 1)); log "install attempt $n failed, retrying in 5s"; sleep 5
   done
 }
 
@@ -266,6 +302,8 @@ verify_linux_package() {
 }
 
 cleanup() {
+  rc=$?
+  [ "$STARTED" -eq 1 ] && log "finished exit=$rc"
   [ "$LOCK_HELD" -eq 1 ] && rm -r -f "$LOCK"
   # A run staged by the app lives in its own temp directory; nothing else is ever removed.
   case "$(basename "$SELF_DIR")" in kt-hub-run-*) rm -r -f "$SELF_DIR" ;; esac
@@ -275,7 +313,7 @@ cleanup() {
 }
 
 main() {
-  FIRST_RUN=0; DEFER=0; FORCE=0; VERIFY_ONLY=0; OS_ARG=""; WORK=""; MOUNT=""; LOCK=""; LOCK_HELD=0
+  FIRST_RUN=0; DEFER=0; FORCE=0; VERIFY_ONLY=0; OS_ARG=""; WORK=""; MOUNT=""; LOCK=""; LOCK_HELD=0; STARTED=0
   trap cleanup EXIT
   while [ $# -gt 0 ]; do
     case "$1" in
@@ -291,6 +329,7 @@ main() {
     shift
   done
 
+  STARTED=1
   [ "\${KT_NO_HUB:-}" = 1 ] && { log "skipped: KT_NO_HUB=1"; exit 0; }
   MIN=$(conf_get MIN_HUB_VERSION)
   [ -n "$MIN" ] || refuse "no MIN_HUB_VERSION in $CONF"
@@ -337,6 +376,7 @@ main() {
   WORK=$(mktemp -d "\${TMPDIR:-/tmp}/kt-hub.XXXXXX") || cannot "no temporary directory"
 
   case "$OS" in mac) chan=latest-mac.yml ;; *) chan=latest-linux.yml ;; esac
+  log "start, minimum $MIN, kind $KIND"
   fetch "$FEED/$chan" "$WORK/feed.yml" || { log "could not fetch $FEED/$chan"; exit 12; }
   fv=$(feed_version "$WORK/feed.yml")
   c=$(ver_cmp "\${fv:-0}" "$MIN"); [ "$c" = 0 ] || [ "$c" = 1 ] || refuse "the feed offers \${fv:-no version}, below the minimum $MIN"
@@ -344,7 +384,8 @@ main() {
   [ -n "$pair" ] || refuse "the feed lists no $KIND package for $(uname -m)"
   name=\${pair% *}; want=\${pair##* }
   bare_name "$name" || refuse "the feed names '$name', which is not a plain file name"
-  fetch "$FEED/$name" "$WORK/$name" || { log "could not fetch $FEED/$name"; exit 12; }
+  fetch_logged "$FEED/$name" "$WORK/$name" || { log "could not fetch $FEED/$name"; exit 12; }
+  log "verify sha512"
   verify_file "$WORK/$name" "$want" || refuse "sha512 of $name does not match the feed"
   log "sha512 of $name matches the feed"
 
@@ -369,6 +410,7 @@ main() {
       [ "$VERIFY_ONLY" -eq 1 ] && { log "verified $name, not installing (--verify-only)"; exit 0; }
       # The package manager's sandbox user must be able to read the file.
       chmod 644 "$WORK/$name"; chmod 755 "$WORK"
+      log "install $KIND"
       if [ "$KIND" = deb ]; then retry install_deb "$WORK/$name"; else retry install_rpm "$WORK/$name"; fi || { log "the package manager failed"; exit 12; }
       log "installed Kutrion $fv" ;;
   esac
@@ -382,8 +424,11 @@ main "$@"
 #
 #   ensure-hub.ps1 [-FirstRun] [-Force] [-VerifyOnly]
 # Exit: 0 present, installed or skipped by policy; 10 refused; 11 cannot install here; 12 fetch or install failed.
+# Every run that gets past the dot-source guard ends with one "ensure-hub: HH:mm:ss finished exit=N" line, written to the output and
+# to the log file (%LOCALAPPDATA%\\Kutrion\\ensure-hub.log, or KT_HUB_LOG), so a caller that started it detached can wait on it.
 # Environment: KT_NO_HUB=1 skips; KT_HUB_FEED_BASE (https or file) replaces the feed;
-# KT_HUB_ALLOW_UNSIGNED=1 accepts a build with no publisher identity.
+# KT_HUB_ALLOW_UNSIGNED=1 accepts a build with no publisher identity; KT_HUB_FETCH_BUDGET seconds bounds one
+# download across its resumed attempts (default 1200).
 param(
   [switch]$FirstRun,
   [switch]$Force,
@@ -395,9 +440,23 @@ $ErrorActionPreference = 'Stop'
 $ProgressPreference = 'SilentlyContinue'
 $AppId = 'com.kutrion.desktop'
 
-function Write-Hub([string]$m) { Write-Output "ensure-hub: $m" }
-function Stop-Refused([string]$m) { Write-Hub "refused, nothing installed: $m"; exit 10 }
-function Stop-Cannot([string]$m) { Write-Hub "skipped: $m"; exit 11 }
+$script:ExitCode = 1
+$script:LogFile = if ($env:KT_HUB_LOG) { $env:KT_HUB_LOG } elseif ($env:LOCALAPPDATA) { Join-Path $env:LOCALAPPDATA 'Kutrion\\ensure-hub.log' } else { '' }
+
+# Host and file, not the pipeline: functions that return a value must not carry log lines with it.
+function Write-Hub([string]$m) {
+  $line = 'ensure-hub: {0} {1}' -f (Get-Date -Format 'HH:mm:ss'), $m
+  Write-Host $line
+  if ($script:LogFile) {
+    try {
+      New-Item -ItemType Directory -Force -Path (Split-Path -Parent $script:LogFile) | Out-Null
+      Add-Content -LiteralPath $script:LogFile -Value $line -Encoding ASCII
+    } catch { $script:LogFile = '' }
+  }
+}
+function Exit-Hub([int]$Code) { $script:ExitCode = $Code; exit $Code }
+function Stop-Refused([string]$m) { Write-Hub "refused, nothing installed: $m"; Exit-Hub 10 }
+function Stop-Cannot([string]$m) { Write-Hub "skipped: $m"; Exit-Hub 11 }
 
 function Get-ConfValue([string]$Name) {
   if (-not (Test-Path -LiteralPath $Conf)) { return '' }
@@ -482,17 +541,94 @@ function Get-InstalledHub {
   return $null
 }
 
+function Get-FileLength([string]$Path) { if (Test-Path -LiteralPath $Path) { return (Get-Item -LiteralPath $Path).Length } else { return 0L } }
+
+# One HTTP attempt. Asks for the bytes after what is on disk; a server that answers 200 anyway sends the whole file, so the
+# file is rewritten from the start. Stops when no byte arrives for 60 s or the shared deadline passes.
+function Receive-Range([string]$Url, [string]$Dest, [datetime]$Deadline) {
+  $have = Get-FileLength $Dest
+  $req = [Net.HttpWebRequest]::Create($Url)
+  $req.Timeout = 30000
+  $req.ReadWriteTimeout = 60000
+  if ($have -gt 0) { $req.AddRange([long]$have) }
+  try { $resp = $req.GetResponse() }
+  catch [Net.WebException] {
+    # 416: the bytes on disk are not a prefix of what the server holds; start over rather than loop on it.
+    if ($_.Exception.Response -and [int]$_.Exception.Response.StatusCode -eq 416 -and $have -gt 0) { Remove-Item -LiteralPath $Dest -Force; $_.Exception.Response.Close(); return $false }
+    throw
+  }
+  try {
+    if ($resp.ResponseUri.Scheme -ne 'https') { throw "the feed redirected to a non-https address" }
+    $partial = ([int]$resp.StatusCode -eq 206)
+    $total = -1L
+    if ($partial) { if ($resp.Headers['Content-Range'] -match '/(\\d+)$') { $total = [long]$Matches[1] } }
+    elseif ($resp.ContentLength -ge 0) { $total = $resp.ContentLength }
+    $mode = if ($partial) { [IO.FileMode]::Append } else { [IO.FileMode]::Create }
+    $in = $resp.GetResponseStream()
+    $out = New-Object IO.FileStream($Dest, $mode, [IO.FileAccess]::Write)
+    try {
+      $buf = New-Object byte[] 65536
+      $clock = [Diagnostics.Stopwatch]::StartNew()
+      $lastTick = 0; $lastData = 0
+      while ($true) {
+        $task = $in.ReadAsync($buf, 0, $buf.Length)
+        while (-not $task.Wait(1000)) {
+          if ($clock.Elapsed.TotalSeconds - $lastData -gt 60) { throw 'no data for 60 s' }
+          if ((Get-Date) -gt $Deadline) { throw 'the time budget ended' }
+          if ($clock.Elapsed.TotalSeconds - $lastTick -ge 30) { $lastTick = $clock.Elapsed.TotalSeconds; Write-Hub "fetching, $(Get-FileLength $Dest) bytes so far" }
+        }
+        $n = $task.Result
+        if ($n -le 0) { break }
+        $out.Write($buf, 0, $n)
+        $lastData = $clock.Elapsed.TotalSeconds
+        if ((Get-Date) -gt $Deadline) { throw 'the time budget ended' }
+        if ($lastData - $lastTick -ge 30) { $lastTick = $lastData; $out.Flush(); Write-Hub "fetching, $(Get-FileLength $Dest) bytes so far" }
+      }
+    } finally { $out.Dispose(); $in.Dispose() }
+    $now = Get-FileLength $Dest
+    if ($total -ge 0 -and $now -ne $total) { throw "the download stopped at $now of $total bytes" }
+    return $true
+  } finally { $resp.Close() }
+}
+
+# A download that stalls or drops resumes from the bytes already on disk instead of starting over; the whole
+# download shares one budget so a dead link ends the run rather than holding the install lock.
 function Get-Fetched([string]$Url, [string]$Dest) {
   if ($Url -like 'file://*') { Copy-Item -LiteralPath ([Uri]$Url).LocalPath -Destination $Dest -Force; return }
   if ($Url -notlike 'https://*') { throw "only https and file feeds are used: $Url" }
   [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
-  Invoke-WebRequest -UseBasicParsing -Uri $Url -OutFile $Dest -TimeoutSec 900
+  $budget = 1200
+  [void][int]::TryParse($env:KT_HUB_FETCH_BUDGET, [ref]$budget)
+  if ($budget -le 0) { $budget = 1200 }
+  $deadline = (Get-Date).AddSeconds($budget)
+  $attempt = 0
+  while ($true) {
+    $attempt++
+    try { if (Receive-Range $Url $Dest $deadline) { return } }
+    catch {
+      Write-Hub "fetch attempt $attempt stopped ($($_.Exception.Message)) at $(Get-FileLength $Dest) bytes"
+      if ((Get-Date) -gt $deadline) { throw "fetch budget of \${budget}s used up" }
+      if ($attempt -ge 20) { throw 'too many failed attempts' }
+      Start-Sleep -Seconds 5
+    }
+  }
+}
+
+# Get-Fetched with a begin line and an end line; the byte counts every 30 s come from the transfer itself.
+function Get-FetchedLogged([string]$Url, [string]$Dest) {
+  Write-Hub "fetch begin $Url"
+  $t = Get-Date; $ok = $false
+  try { Get-Fetched $Url $Dest; $ok = $true } finally {
+    Write-Hub ('fetch end rc={0} bytes={1} seconds={2}' -f $(if ($ok) { 0 } else { 1 }), (Get-FileLength $Dest), [int]((Get-Date) - $t).TotalSeconds)
+  }
 }
 
 # Dot-sourcing loads the functions above and runs nothing, so the checks can be driven one by one.
 if ($MyInvocation.InvocationName -eq '.') { return }
 
-if ($env:KT_NO_HUB -eq '1') { Write-Hub 'skipped: KT_NO_HUB=1'; exit 0 }
+try {
+Write-Hub 'start'
+if ($env:KT_NO_HUB -eq '1') { Write-Hub 'skipped: KT_NO_HUB=1'; Exit-Hub 0 }
 
 $min = Get-ConfValue 'MIN_HUB_VERSION'
 if (-not $min) { Stop-Refused "no MIN_HUB_VERSION in $Conf" }
@@ -500,14 +636,15 @@ $feed = if ($env:KT_HUB_FEED_BASE) { $env:KT_HUB_FEED_BASE } else { Get-ConfValu
 if (-not $feed) { Stop-Refused 'no feed configured' }
 $publisher = Get-ConfValue 'HUB_WIN_PUBLISHER'
 $allowUnsigned = ($env:KT_HUB_ALLOW_UNSIGNED -eq '1') -or ((Get-ConfValue 'HUB_ALLOW_UNSIGNED') -eq '1')
+Write-Hub "minimum $min"
 
 if (-not $Force) {
   $cur = Get-InstalledHub
   if ($null -ne $cur) {
-    if ($cur -eq 'unknown') { Write-Hub 'present, version unreadable, left alone'; exit 0 }
+    if ($cur -eq 'unknown') { Write-Hub 'present, version unreadable, left alone'; Exit-Hub 0 }
     $c = Compare-HubVersion $cur $min
-    if ($null -eq $c) { Write-Hub "present, version '$cur' not comparable, left alone"; exit 0 }
-    if ($c -ge 0) { Write-Hub "present at $cur (minimum $min), nothing to do"; exit 0 }
+    if ($null -eq $c) { Write-Hub "present, version '$cur' not comparable, left alone"; Exit-Hub 0 }
+    if ($c -ge 0) { Write-Hub "present at $cur (minimum $min), nothing to do"; Exit-Hub 0 }
     Write-Hub "present at $cur, below $min"
   } else {
     Write-Hub 'absent'
@@ -531,13 +668,13 @@ $mutex = New-Object Threading.Mutex($false, 'Local\\KutrionEnsureHub')
 $held = $false
 if (-not $VerifyOnly) {
   try { $held = $mutex.WaitOne(0) } catch [Threading.AbandonedMutexException] { $held = $true }
-  if (-not $held) { Write-Hub 'another install is running'; exit 0 }
+  if (-not $held) { Write-Hub 'another install is running'; Exit-Hub 0 }
 }
 
 $work = Join-Path ([IO.Path]::GetTempPath()) ('kt-hub-' + [guid]::NewGuid().ToString('N'))
 New-Item -ItemType Directory -Force -Path $work | Out-Null
 try {
-  try { Get-Fetched "$feed/latest.yml" (Join-Path $work 'feed.yml') } catch { Write-Hub "could not fetch $feed/latest.yml"; exit 12 }
+  try { Get-FetchedLogged "$feed/latest.yml" (Join-Path $work 'feed.yml') } catch { Write-Hub "could not fetch $feed/latest.yml"; Exit-Hub 12 }
   $text = Get-Content -LiteralPath (Join-Path $work 'feed.yml') -Raw
   $fv = Get-FeedVersion $text
   $c = if ($fv) { Compare-HubVersion $fv $min } else { $null }
@@ -546,7 +683,8 @@ try {
   if (-not $entry) { Stop-Refused 'the feed lists no installer' }
   if (-not (Test-BareName $entry.Name)) { Stop-Refused "the feed names '$($entry.Name)', which is not a plain file name" }
   $exe = Join-Path $work $entry.Name
-  try { Get-Fetched "$feed/$($entry.Name)" $exe } catch { Write-Hub "could not fetch $feed/$($entry.Name)"; exit 12 }
+  try { Get-FetchedLogged "$feed/$($entry.Name)" $exe } catch { Write-Hub "could not fetch $feed/$($entry.Name)"; Exit-Hub 12 }
+  Write-Hub 'verify sha512'
   if (-not (Test-FileHash $exe $entry.Sha512)) { Stop-Refused "sha512 of $($entry.Name) does not match the feed" }
   Write-Hub "sha512 of $($entry.Name) matches the feed"
 
@@ -561,23 +699,28 @@ try {
     Stop-Refused 'no publisher identity is configured and unsigned builds are not allowed'
   }
 
-  if ($VerifyOnly) { Write-Hub "verified $($entry.Name), not installing (-VerifyOnly)"; exit 0 }
+  if ($VerifyOnly) { Write-Hub "verified $($entry.Name), not installing (-VerifyOnly)"; Exit-Hub 0 }
 
   # Waits on this pid only: Start-Process -Wait in Windows PowerShell 5.1 waits on the whole process tree, so an
   # installer that starts the app never returns.
+  Write-Hub 'install'
   $p = [Diagnostics.Process]::Start((New-Object Diagnostics.ProcessStartInfo -Property @{ FileName = $exe; Arguments = '/S /currentuser'; UseShellExecute = $false }))
-  if (-not $p.WaitForExit(600000)) { & taskkill.exe /PID $p.Id /T /F | Out-Null; Write-Hub 'the installer did not finish in 10 minutes'; exit 12 }
-  if ($p.ExitCode -ne 0) { Write-Hub "the installer exited $($p.ExitCode)"; exit 12 }
+  if (-not $p.WaitForExit(600000)) { & taskkill.exe /PID $p.Id /T /F | Out-Null; Write-Hub 'the installer did not finish in 10 minutes'; Exit-Hub 12 }
+  if ($p.ExitCode -ne 0) { Write-Hub "the installer exited $($p.ExitCode)"; Exit-Hub 12 }
   $after = Get-InstalledHub
-  if ($null -eq $after) { Write-Hub 'the installer finished but no Hub is registered'; exit 12 }
+  if ($null -eq $after) { Write-Hub 'the installer finished but no Hub is registered'; Exit-Hub 12 }
   Write-Hub "installed Kutrion $after"
-  exit 0
+  Exit-Hub 0
 } finally {
   Remove-Item -LiteralPath $work -Recurse -Force -ErrorAction SilentlyContinue
   if ($held) { $mutex.ReleaseMutex() }
   # A run staged by the app lives in its own temp directory; nothing else is ever removed.
   if ((Split-Path -Leaf $PSScriptRoot) -like 'kt-hub-run-*') { Remove-Item -LiteralPath $PSScriptRoot -Recurse -Force -ErrorAction SilentlyContinue }
 }
+} finally {
+  Write-Hub "finished exit=$($script:ExitCode)"
+}
+exit $script:ExitCode
 `, "hub.conf": "# Read by ensure-hub.sh and ensure-hub.ps1, and shipped beside them in every app build.\nMIN_HUB_VERSION=1.2.9\nFEED_BASE=https://kutrion.com/updates\n# Authenticode subject common name the Hub installer must carry. Empty until a certificate exists (#973).\nHUB_WIN_PUBLISHER=\n# Apple Team ID the Hub bundle must be signed with. Empty until the Developer ID exists (#973).\nHUB_MAC_TEAM_ID=\n# 0 installs nothing that cannot be tied to a publisher identity above. 1 until code signing lands (#973, #3295). On Windows this equals the NSIS updater trust: sha512 over TLS from our own HTTPS feed. On macOS and Linux it is sha512 over TLS only, weaker than the macOS updater. Owner accepted this on #3283. KT_HUB_ALLOW_UNSIGNED=1 overrides per run.\nHUB_ALLOW_UNSIGNED=1\n" };
   }
 });
@@ -2840,7 +2983,7 @@ var require_websocket = __commonJS({
     var http = require("http");
     var net = require("net");
     var tls = require("tls");
-    var { randomBytes: randomBytes7, createHash: createHash3 } = require("crypto");
+    var { randomBytes: randomBytes6, createHash: createHash2 } = require("crypto");
     var { Duplex, Readable } = require("stream");
     var { URL: URL2 } = require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -3378,7 +3521,7 @@ var require_websocket = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes7(16).toString("base64");
+      const key = randomBytes6(16).toString("base64");
       const request = isSecure ? https.request : http.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -3508,7 +3651,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash3("sha1").update(key + GUID).digest("base64");
+        const digest = createHash2("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -3880,7 +4023,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = require("events");
     var http = require("http");
     var { Duplex } = require("stream");
-    var { createHash: createHash3 } = require("crypto");
+    var { createHash: createHash2 } = require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -4187,7 +4330,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash3("sha1").update(key + GUID).digest("base64");
+        const digest = createHash2("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -8777,25 +8920,25 @@ var require_data_url = __commonJS({
     function isHTTPWhiteSpace(char) {
       return char === 13 || char === 10 || char === 9 || char === 32;
     }
-    function removeHTTPWhitespace(str6, leading = true, trailing = true) {
-      return removeChars(str6, leading, trailing, isHTTPWhiteSpace);
+    function removeHTTPWhitespace(str8, leading = true, trailing = true) {
+      return removeChars(str8, leading, trailing, isHTTPWhiteSpace);
     }
     function isASCIIWhitespace(char) {
       return char === 13 || char === 10 || char === 9 || char === 12 || char === 32;
     }
-    function removeASCIIWhitespace(str6, leading = true, trailing = true) {
-      return removeChars(str6, leading, trailing, isASCIIWhitespace);
+    function removeASCIIWhitespace(str8, leading = true, trailing = true) {
+      return removeChars(str8, leading, trailing, isASCIIWhitespace);
     }
-    function removeChars(str6, leading, trailing, predicate) {
+    function removeChars(str8, leading, trailing, predicate) {
       let lead = 0;
-      let trail = str6.length - 1;
+      let trail = str8.length - 1;
       if (leading) {
-        while (lead < str6.length && predicate(str6.charCodeAt(lead))) lead++;
+        while (lead < str8.length && predicate(str8.charCodeAt(lead))) lead++;
       }
       if (trailing) {
-        while (trail > 0 && predicate(str6.charCodeAt(trail))) trail--;
+        while (trail > 0 && predicate(str8.charCodeAt(trail))) trail--;
       }
-      return lead === 0 && trail === str6.length - 1 ? str6 : str6.slice(lead, trail + 1);
+      return lead === 0 && trail === str8.length - 1 ? str8 : str8.slice(lead, trail + 1);
     }
     function isomorphicDecode(input) {
       const length = input.length;
@@ -10714,7 +10857,7 @@ var require_body = __commonJS({
         const boundary = `----formdata-undici-0${`${Math.floor(Math.random() * 1e11)}`.padStart(11, "0")}`;
         const prefix = `--${boundary}\r
 Content-Disposition: form-data`;
-        const escape = (str6) => str6.replace(/\n/g, "%0A").replace(/\r/g, "%0D").replace(/"/g, "%22");
+        const escape = (str8) => str8.replace(/\n/g, "%0A").replace(/\r/g, "%0D").replace(/"/g, "%22");
         const normalizeLinefeeds = (value) => value.replace(/\r?\n|\r/g, "\r\n");
         const blobParts = [];
         const rn = new Uint8Array([13, 10]);
@@ -17294,13 +17437,13 @@ var require_stringifyComment = __commonJS({
   "node_modules/yaml/dist/stringify/stringifyComment.js"(exports2) {
     "use strict";
     init_define_KT_HUB_FILES();
-    var stringifyComment = (str6) => str6.replace(/^(?!$)(?: $)?/gm, "#");
+    var stringifyComment = (str8) => str8.replace(/^(?!$)(?: $)?/gm, "#");
     function indentComment(comment, indent) {
       if (/^\n+$/.test(comment))
         return comment.substring(1);
       return indent ? comment.replace(/^(?! *$)/gm, indent) : comment;
     }
-    var lineComment = (str6, indent, comment) => str6.endsWith("\n") ? indentComment(comment, indent) : comment.includes("\n") ? "\n" + indentComment(comment, indent) : (str6.endsWith(" ") ? "" : " ") + comment;
+    var lineComment = (str8, indent, comment) => str8.endsWith("\n") ? indentComment(comment, indent) : comment.includes("\n") ? "\n" + indentComment(comment, indent) : (str8.endsWith(" ") ? "" : " ") + comment;
     exports2.indentComment = indentComment;
     exports2.lineComment = lineComment;
     exports2.stringifyComment = stringifyComment;
@@ -17456,16 +17599,16 @@ var require_stringifyString = __commonJS({
       lineWidth: ctx.options.lineWidth,
       minContentWidth: ctx.options.minContentWidth
     });
-    var containsDocumentMarker = (str6) => /^(%|---|\.\.\.)/m.test(str6);
-    function lineLengthOverLimit(str6, lineWidth, indentLength) {
+    var containsDocumentMarker = (str8) => /^(%|---|\.\.\.)/m.test(str8);
+    function lineLengthOverLimit(str8, lineWidth, indentLength) {
       if (!lineWidth || lineWidth < 0)
         return false;
       const limit = lineWidth - indentLength;
-      const strLen = str6.length;
+      const strLen = str8.length;
       if (strLen <= limit)
         return false;
       for (let i = 0, start = 0; i < strLen; ++i) {
-        if (str6[i] === "\n") {
+        if (str8[i] === "\n") {
           if (i - start > limit)
             return true;
           start = i + 1;
@@ -17482,11 +17625,11 @@ var require_stringifyString = __commonJS({
       const { implicitKey } = ctx;
       const minMultiLineLength = ctx.options.doubleQuotedMinMultiLineLength;
       const indent = ctx.indent || (containsDocumentMarker(value) ? "  " : "");
-      let str6 = "";
+      let str8 = "";
       let start = 0;
       for (let i = 0, ch = json[i]; ch; ch = json[++i]) {
         if (ch === " " && json[i + 1] === "\\" && json[i + 2] === "n") {
-          str6 += json.slice(start, i) + "\\ ";
+          str8 += json.slice(start, i) + "\\ ";
           i += 1;
           start = i;
           ch = "\\";
@@ -17495,38 +17638,38 @@ var require_stringifyString = __commonJS({
           switch (json[i + 1]) {
             case "u":
               {
-                str6 += json.slice(start, i);
+                str8 += json.slice(start, i);
                 const code = json.substr(i + 2, 4);
                 switch (code) {
                   case "0000":
-                    str6 += "\\0";
+                    str8 += "\\0";
                     break;
                   case "0007":
-                    str6 += "\\a";
+                    str8 += "\\a";
                     break;
                   case "000b":
-                    str6 += "\\v";
+                    str8 += "\\v";
                     break;
                   case "001b":
-                    str6 += "\\e";
+                    str8 += "\\e";
                     break;
                   case "0085":
-                    str6 += "\\N";
+                    str8 += "\\N";
                     break;
                   case "00a0":
-                    str6 += "\\_";
+                    str8 += "\\_";
                     break;
                   case "2028":
-                    str6 += "\\L";
+                    str8 += "\\L";
                     break;
                   case "2029":
-                    str6 += "\\P";
+                    str8 += "\\P";
                     break;
                   default:
                     if (code.substr(0, 2) === "00")
-                      str6 += "\\x" + code.substr(2);
+                      str8 += "\\x" + code.substr(2);
                     else
-                      str6 += json.substr(i, 6);
+                      str8 += json.substr(i, 6);
                 }
                 i += 5;
                 start = i + 1;
@@ -17536,14 +17679,14 @@ var require_stringifyString = __commonJS({
               if (implicitKey || json[i + 2] === '"' || json.length < minMultiLineLength) {
                 i += 1;
               } else {
-                str6 += json.slice(start, i) + "\n\n";
+                str8 += json.slice(start, i) + "\n\n";
                 while (json[i + 2] === "\\" && json[i + 3] === "n" && json[i + 4] !== '"') {
-                  str6 += "\n";
+                  str8 += "\n";
                   i += 2;
                 }
-                str6 += indent;
+                str8 += indent;
                 if (json[i + 2] === " ")
-                  str6 += "\\";
+                  str8 += "\\";
                 i += 1;
                 start = i + 1;
               }
@@ -17552,8 +17695,8 @@ var require_stringifyString = __commonJS({
               i += 1;
           }
       }
-      str6 = start ? str6 + json.slice(start) : json;
-      return implicitKey ? str6 : foldFlowLines.foldFlowLines(str6, indent, foldFlowLines.FOLD_QUOTED, getFoldOptions(ctx, false));
+      str8 = start ? str8 + json.slice(start) : json;
+      return implicitKey ? str8 : foldFlowLines.foldFlowLines(str8, indent, foldFlowLines.FOLD_QUOTED, getFoldOptions(ctx, false));
     }
     function singleQuotedString(value, ctx) {
       if (ctx.options.singleQuote === false || ctx.implicitKey && value.includes("\n") || /[ \t]\n|\n[ \t]/.test(value))
@@ -17681,15 +17824,15 @@ ${indent}${start}${value}${end}`;
           return quotedString(value, ctx);
         }
       }
-      const str6 = value.replace(/\n+/g, `$&
+      const str8 = value.replace(/\n+/g, `$&
 ${indent}`);
       if (actualString) {
-        const test = (tag) => tag.default && tag.tag !== "tag:yaml.org,2002:str" && tag.test?.test(str6);
+        const test = (tag) => tag.default && tag.tag !== "tag:yaml.org,2002:str" && tag.test?.test(str8);
         const { compat, tags } = ctx.doc.schema;
         if (tags.some(test) || compat?.some(test))
           return quotedString(value, ctx);
       }
-      return implicitKey ? str6 : foldFlowLines.foldFlowLines(str6, indent, foldFlowLines.FOLD_FLOW, getFoldOptions(ctx, false));
+      return implicitKey ? str8 : foldFlowLines.foldFlowLines(str8, indent, foldFlowLines.FOLD_FLOW, getFoldOptions(ctx, false));
     }
     function stringifyString(item, ctx, onComment, onChompKeep) {
       const { implicitKey, inFlow } = ctx;
@@ -17842,11 +17985,11 @@ var require_stringify = __commonJS({
       const props = stringifyProps(node, tagObj, ctx);
       if (props.length > 0)
         ctx.indentAtStart = (ctx.indentAtStart ?? 0) + props.length + 1;
-      const str6 = typeof tagObj.stringify === "function" ? tagObj.stringify(node, ctx, onComment, onChompKeep) : identity.isScalar(node) ? stringifyString.stringifyString(node, ctx, onComment, onChompKeep) : node.toString(ctx, onComment, onChompKeep);
+      const str8 = typeof tagObj.stringify === "function" ? tagObj.stringify(node, ctx, onComment, onChompKeep) : identity.isScalar(node) ? stringifyString.stringifyString(node, ctx, onComment, onChompKeep) : node.toString(ctx, onComment, onChompKeep);
       if (!props)
-        return str6;
-      return identity.isScalar(node) || str6[0] === "{" || str6[0] === "[" ? `${props} ${str6}` : `${props}
-${ctx.indent}${str6}`;
+        return str8;
+      return identity.isScalar(node) || str8[0] === "{" || str8[0] === "[" ? `${props} ${str8}` : `${props}
+${ctx.indent}${str8}`;
     }
     exports2.createStringifyContext = createStringifyContext;
     exports2.stringify = stringify;
@@ -17882,8 +18025,8 @@ var require_stringifyPair = __commonJS({
       });
       let keyCommentDone = false;
       let chompKeep = false;
-      let str6 = stringify.stringify(key, ctx, () => keyCommentDone = true, () => chompKeep = true);
-      if (!explicitKey && !ctx.inFlow && str6.length > 1024) {
+      let str8 = stringify.stringify(key, ctx, () => keyCommentDone = true, () => chompKeep = true);
+      if (!explicitKey && !ctx.inFlow && str8.length > 1024) {
         if (simpleKeys)
           throw new Error("With simple keys, single line scalar must not span more than 1024 characters");
         explicitKey = true;
@@ -17892,27 +18035,27 @@ var require_stringifyPair = __commonJS({
         if (allNullValues || value == null) {
           if (keyCommentDone && onComment)
             onComment();
-          return str6 === "" ? "?" : explicitKey ? `? ${str6}` : str6;
+          return str8 === "" ? "?" : explicitKey ? `? ${str8}` : str8;
         }
       } else if (allNullValues && !simpleKeys || value == null && explicitKey) {
-        str6 = `? ${str6}`;
+        str8 = `? ${str8}`;
         if (keyComment && !keyCommentDone) {
-          str6 += stringifyComment.lineComment(str6, ctx.indent, commentString(keyComment));
+          str8 += stringifyComment.lineComment(str8, ctx.indent, commentString(keyComment));
         } else if (chompKeep && onChompKeep)
           onChompKeep();
-        return str6;
+        return str8;
       }
       if (keyCommentDone)
         keyComment = null;
       if (explicitKey) {
         if (keyComment)
-          str6 += stringifyComment.lineComment(str6, ctx.indent, commentString(keyComment));
-        str6 = `? ${str6}
+          str8 += stringifyComment.lineComment(str8, ctx.indent, commentString(keyComment));
+        str8 = `? ${str8}
 ${indent}:`;
       } else {
-        str6 = `${str6}:`;
+        str8 = `${str8}:`;
         if (keyComment)
-          str6 += stringifyComment.lineComment(str6, ctx.indent, commentString(keyComment));
+          str8 += stringifyComment.lineComment(str8, ctx.indent, commentString(keyComment));
       }
       let vsb, vcb, valueComment;
       if (identity.isNode(value)) {
@@ -17928,7 +18071,7 @@ ${indent}:`;
       }
       ctx.implicitKey = false;
       if (!explicitKey && !keyComment && identity.isScalar(value))
-        ctx.indentAtStart = str6.length + 1;
+        ctx.indentAtStart = str8.length + 1;
       chompKeep = false;
       if (!indentSeq && indentStep.length >= 2 && !ctx.inFlow && !explicitKey && identity.isSeq(value) && !value.flow && !value.tag && !value.anchor) {
         ctx.indent = ctx.indent.substring(2);
@@ -17972,16 +18115,16 @@ ${ctx.indent}`;
       } else if (valueStr === "" || valueStr[0] === "\n") {
         ws = "";
       }
-      str6 += ws + valueStr;
+      str8 += ws + valueStr;
       if (ctx.inFlow) {
         if (valueCommentDone && onComment)
           onComment();
       } else if (valueComment && !valueCommentDone) {
-        str6 += stringifyComment.lineComment(str6, ctx.indent, commentString(valueComment));
+        str8 += stringifyComment.lineComment(str8, ctx.indent, commentString(valueComment));
       } else if (chompKeep && onChompKeep) {
         onChompKeep();
       }
-      return str6;
+      return str8;
     }
     exports2.stringifyPair = stringifyPair;
   }
@@ -18213,31 +18356,31 @@ var require_stringifyCollection = __commonJS({
           }
         }
         chompKeep = false;
-        let str7 = stringify.stringify(item, itemCtx, () => comment2 = null, () => chompKeep = true);
+        let str9 = stringify.stringify(item, itemCtx, () => comment2 = null, () => chompKeep = true);
         if (comment2)
-          str7 += stringifyComment.lineComment(str7, itemIndent, commentString(comment2));
+          str9 += stringifyComment.lineComment(str9, itemIndent, commentString(comment2));
         if (chompKeep && comment2)
           chompKeep = false;
-        lines.push(blockItemPrefix + str7);
+        lines.push(blockItemPrefix + str9);
       }
-      let str6;
+      let str8;
       if (lines.length === 0) {
-        str6 = flowChars.start + flowChars.end;
+        str8 = flowChars.start + flowChars.end;
       } else {
-        str6 = lines[0];
+        str8 = lines[0];
         for (let i = 1; i < lines.length; ++i) {
           const line = lines[i];
-          str6 += line ? `
+          str8 += line ? `
 ${indent}${line}` : "\n";
         }
       }
       if (comment) {
-        str6 += "\n" + stringifyComment.indentComment(commentString(comment), indent);
+        str8 += "\n" + stringifyComment.indentComment(commentString(comment), indent);
         if (onComment)
           onComment();
       } else if (chompKeep && onChompKeep)
         onChompKeep();
-      return str6;
+      return str8;
     }
     function stringifyFlowCollection({ items }, ctx, { flowChars, itemIndent }) {
       const { indent, indentStep, flowCollectionPadding: fcPadding, options: { commentString } } = ctx;
@@ -18280,21 +18423,21 @@ ${indent}${line}` : "\n";
         }
         if (comment)
           reqNewline = true;
-        let str6 = stringify.stringify(item, itemCtx, () => comment = null);
-        reqNewline || (reqNewline = lines.length > linesAtValue || str6.includes("\n"));
+        let str8 = stringify.stringify(item, itemCtx, () => comment = null);
+        reqNewline || (reqNewline = lines.length > linesAtValue || str8.includes("\n"));
         if (i < items.length - 1) {
-          str6 += ",";
+          str8 += ",";
         } else if (ctx.options.trailingComma) {
           if (ctx.options.lineWidth > 0) {
-            reqNewline || (reqNewline = lines.reduce((sum, line) => sum + line.length + 2, 2) + (str6.length + 2) > ctx.options.lineWidth);
+            reqNewline || (reqNewline = lines.reduce((sum, line) => sum + line.length + 2, 2) + (str8.length + 2) > ctx.options.lineWidth);
           }
           if (reqNewline) {
-            str6 += ",";
+            str8 += ",";
           }
         }
         if (comment)
-          str6 += stringifyComment.lineComment(str6, itemIndent, commentString(comment));
-        lines.push(str6);
+          str8 += stringifyComment.lineComment(str8, itemIndent, commentString(comment));
+        lines.push(str8);
         linesAtValue = lines.length;
       }
       const { start, end } = flowChars;
@@ -18306,11 +18449,11 @@ ${indent}${line}` : "\n";
           reqNewline = ctx.options.lineWidth > 0 && len > ctx.options.lineWidth;
         }
         if (reqNewline) {
-          let str6 = start;
+          let str8 = start;
           for (const line of lines)
-            str6 += line ? `
+            str8 += line ? `
 ${indentStep}${indent}${line}` : "\n";
-          return `${str6}
+          return `${str8}
 ${indent}${end}`;
         } else {
           return `${start}${fcPadding}${lines.join(" ")}${fcPadding}${end}`;
@@ -18647,7 +18790,7 @@ var require_string = __commonJS({
       identify: (value) => typeof value === "string",
       default: true,
       tag: "tag:yaml.org,2002:str",
-      resolve: (str6) => str6,
+      resolve: (str8) => str8,
       stringify(item, ctx, onComment, onChompKeep) {
         ctx = Object.assign({ actualString: true }, ctx);
         return stringifyString.stringifyString(item, ctx, onComment, onChompKeep);
@@ -18687,7 +18830,7 @@ var require_bool = __commonJS({
       default: true,
       tag: "tag:yaml.org,2002:bool",
       test: /^(?:[Tt]rue|TRUE|[Ff]alse|FALSE)$/,
-      resolve: (str6) => new Scalar.Scalar(str6[0] === "t" || str6[0] === "T"),
+      resolve: (str8) => new Scalar.Scalar(str8[0] === "t" || str8[0] === "T"),
       stringify({ source, value }, ctx) {
         if (source && boolTag.test.test(source)) {
           const sv = source[0] === "t" || source[0] === "T";
@@ -18741,7 +18884,7 @@ var require_float = __commonJS({
       default: true,
       tag: "tag:yaml.org,2002:float",
       test: /^(?:[-+]?\.(?:inf|Inf|INF)|\.nan|\.NaN|\.NAN)$/,
-      resolve: (str6) => str6.slice(-3).toLowerCase() === "nan" ? NaN : str6[0] === "-" ? Number.NEGATIVE_INFINITY : Number.POSITIVE_INFINITY,
+      resolve: (str8) => str8.slice(-3).toLowerCase() === "nan" ? NaN : str8[0] === "-" ? Number.NEGATIVE_INFINITY : Number.POSITIVE_INFINITY,
       stringify: stringifyNumber.stringifyNumber
     };
     var floatExp = {
@@ -18750,7 +18893,7 @@ var require_float = __commonJS({
       tag: "tag:yaml.org,2002:float",
       format: "EXP",
       test: /^[-+]?(?:\.[0-9]+|[0-9]+(?:\.[0-9]*)?)[eE][-+]?[0-9]+$/,
-      resolve: (str6) => parseFloat(str6),
+      resolve: (str8) => parseFloat(str8),
       stringify(node) {
         const num2 = Number(node.value);
         return isFinite(num2) ? num2.toExponential() : stringifyNumber.stringifyNumber(node);
@@ -18761,11 +18904,11 @@ var require_float = __commonJS({
       default: true,
       tag: "tag:yaml.org,2002:float",
       test: /^[-+]?(?:\.[0-9]+|[0-9]+\.[0-9]*)$/,
-      resolve(str6) {
-        const node = new Scalar.Scalar(parseFloat(str6));
-        const dot = str6.indexOf(".");
-        if (dot !== -1 && str6[str6.length - 1] === "0")
-          node.minFractionDigits = str6.length - dot - 1;
+      resolve(str8) {
+        const node = new Scalar.Scalar(parseFloat(str8));
+        const dot = str8.indexOf(".");
+        if (dot !== -1 && str8[str8.length - 1] === "0")
+          node.minFractionDigits = str8.length - dot - 1;
         return node;
       },
       stringify: stringifyNumber.stringifyNumber
@@ -18783,7 +18926,7 @@ var require_int = __commonJS({
     init_define_KT_HUB_FILES();
     var stringifyNumber = require_stringifyNumber();
     var intIdentify = (value) => typeof value === "bigint" || Number.isInteger(value);
-    var intResolve = (str6, offset, radix, { intAsBigInt }) => intAsBigInt ? BigInt(str6) : parseInt(str6.substring(offset), radix);
+    var intResolve = (str8, offset, radix, { intAsBigInt }) => intAsBigInt ? BigInt(str8) : parseInt(str8.substring(offset), radix);
     function intStringify(node, radix, prefix) {
       const { value } = node;
       if (intIdentify(value) && value >= 0)
@@ -18796,7 +18939,7 @@ var require_int = __commonJS({
       tag: "tag:yaml.org,2002:int",
       format: "OCT",
       test: /^0o[0-7]+$/,
-      resolve: (str6, _onError, opt) => intResolve(str6, 2, 8, opt),
+      resolve: (str8, _onError, opt) => intResolve(str8, 2, 8, opt),
       stringify: (node) => intStringify(node, 8, "0o")
     };
     var int = {
@@ -18804,7 +18947,7 @@ var require_int = __commonJS({
       default: true,
       tag: "tag:yaml.org,2002:int",
       test: /^[-+]?[0-9]+$/,
-      resolve: (str6, _onError, opt) => intResolve(str6, 0, 10, opt),
+      resolve: (str8, _onError, opt) => intResolve(str8, 0, 10, opt),
       stringify: stringifyNumber.stringifyNumber
     };
     var intHex = {
@@ -18813,7 +18956,7 @@ var require_int = __commonJS({
       tag: "tag:yaml.org,2002:int",
       format: "HEX",
       test: /^0x[0-9a-fA-F]+$/,
-      resolve: (str6, _onError, opt) => intResolve(str6, 2, 16, opt),
+      resolve: (str8, _onError, opt) => intResolve(str8, 2, 16, opt),
       stringify: (node) => intStringify(node, 16, "0x")
     };
     exports2.int = int;
@@ -18868,7 +19011,7 @@ var require_schema2 = __commonJS({
         identify: (value) => typeof value === "string",
         default: true,
         tag: "tag:yaml.org,2002:str",
-        resolve: (str6) => str6,
+        resolve: (str8) => str8,
         stringify: stringifyJSON
       },
       {
@@ -18885,7 +19028,7 @@ var require_schema2 = __commonJS({
         default: true,
         tag: "tag:yaml.org,2002:bool",
         test: /^true$|^false$/,
-        resolve: (str6) => str6 === "true",
+        resolve: (str8) => str8 === "true",
         stringify: stringifyJSON
       },
       {
@@ -18893,7 +19036,7 @@ var require_schema2 = __commonJS({
         default: true,
         tag: "tag:yaml.org,2002:int",
         test: /^-?(?:0|[1-9][0-9]*)$/,
-        resolve: (str6, _onError, { intAsBigInt }) => intAsBigInt ? BigInt(str6) : parseInt(str6, 10),
+        resolve: (str8, _onError, { intAsBigInt }) => intAsBigInt ? BigInt(str8) : parseInt(str8, 10),
         stringify: ({ value }) => intIdentify(value) ? value.toString() : JSON.stringify(value)
       },
       {
@@ -18901,7 +19044,7 @@ var require_schema2 = __commonJS({
         default: true,
         tag: "tag:yaml.org,2002:float",
         test: /^-?(?:0|[1-9][0-9]*)(?:\.[0-9]*)?(?:[eE][-+]?[0-9]+)?$/,
-        resolve: (str6) => parseFloat(str6),
+        resolve: (str8) => parseFloat(str8),
         stringify: stringifyJSON
       }
     ];
@@ -18909,9 +19052,9 @@ var require_schema2 = __commonJS({
       default: true,
       tag: "",
       test: /^/,
-      resolve(str6, onError) {
-        onError(`Unresolved plain scalar ${JSON.stringify(str6)}`);
-        return str6;
+      resolve(str8, onError) {
+        onError(`Unresolved plain scalar ${JSON.stringify(str8)}`);
+        return str8;
       }
     };
     var schema = [map.map, seq.seq].concat(jsonScalars, jsonError);
@@ -18944,10 +19087,10 @@ var require_binary = __commonJS({
         if (typeof node_buffer.Buffer === "function") {
           return node_buffer.Buffer.from(src, "base64");
         } else if (typeof atob === "function") {
-          const str6 = atob(src.replace(/[\n\r]/g, ""));
-          const buffer = new Uint8Array(str6.length);
-          for (let i = 0; i < str6.length; ++i)
-            buffer[i] = str6.charCodeAt(i);
+          const str8 = atob(src.replace(/[\n\r]/g, ""));
+          const buffer = new Uint8Array(str8.length);
+          for (let i = 0; i < str8.length; ++i)
+            buffer[i] = str8.charCodeAt(i);
           return buffer;
         } else {
           onError("This environment does not support reading binary tags; either Buffer or atob is required");
@@ -18958,28 +19101,28 @@ var require_binary = __commonJS({
         if (!value)
           return "";
         const buf = value;
-        let str6;
+        let str8;
         if (typeof node_buffer.Buffer === "function") {
-          str6 = buf instanceof node_buffer.Buffer ? buf.toString("base64") : node_buffer.Buffer.from(buf.buffer).toString("base64");
+          str8 = buf instanceof node_buffer.Buffer ? buf.toString("base64") : node_buffer.Buffer.from(buf.buffer).toString("base64");
         } else if (typeof btoa === "function") {
           let s = "";
           for (let i = 0; i < buf.length; ++i)
             s += String.fromCharCode(buf[i]);
-          str6 = btoa(s);
+          str8 = btoa(s);
         } else {
           throw new Error("This environment does not support writing binary tags; either Buffer or btoa is required");
         }
         type ?? (type = Scalar.Scalar.BLOCK_LITERAL);
         if (type !== Scalar.Scalar.QUOTE_DOUBLE) {
           const lineWidth = Math.max(ctx.options.lineWidth - ctx.indent.length, ctx.options.minContentWidth);
-          const n = Math.ceil(str6.length / lineWidth);
+          const n = Math.ceil(str8.length / lineWidth);
           const lines = new Array(n);
           for (let i = 0, o = 0; i < n; ++i, o += lineWidth) {
-            lines[i] = str6.substr(o, lineWidth);
+            lines[i] = str8.substr(o, lineWidth);
           }
-          str6 = lines.join(type === Scalar.Scalar.BLOCK_LITERAL ? "\n" : " ");
+          str8 = lines.join(type === Scalar.Scalar.BLOCK_LITERAL ? "\n" : " ");
         }
-        return stringifyString.stringifyString({ comment, type, value: str6 }, ctx, onComment, onChompKeep);
+        return stringifyString.stringifyString({ comment, type, value: str8 }, ctx, onComment, onChompKeep);
       }
     };
     exports2.binary = binary;
@@ -19189,7 +19332,7 @@ var require_float2 = __commonJS({
       default: true,
       tag: "tag:yaml.org,2002:float",
       test: /^(?:[-+]?\.(?:inf|Inf|INF)|\.nan|\.NaN|\.NAN)$/,
-      resolve: (str6) => str6.slice(-3).toLowerCase() === "nan" ? NaN : str6[0] === "-" ? Number.NEGATIVE_INFINITY : Number.POSITIVE_INFINITY,
+      resolve: (str8) => str8.slice(-3).toLowerCase() === "nan" ? NaN : str8[0] === "-" ? Number.NEGATIVE_INFINITY : Number.POSITIVE_INFINITY,
       stringify: stringifyNumber.stringifyNumber
     };
     var floatExp = {
@@ -19198,7 +19341,7 @@ var require_float2 = __commonJS({
       tag: "tag:yaml.org,2002:float",
       format: "EXP",
       test: /^[-+]?(?:[0-9][0-9_]*)?(?:\.[0-9_]*)?[eE][-+]?[0-9]+$/,
-      resolve: (str6) => parseFloat(str6.replace(/_/g, "")),
+      resolve: (str8) => parseFloat(str8.replace(/_/g, "")),
       stringify(node) {
         const num2 = Number(node.value);
         return isFinite(num2) ? num2.toExponential() : stringifyNumber.stringifyNumber(node);
@@ -19209,11 +19352,11 @@ var require_float2 = __commonJS({
       default: true,
       tag: "tag:yaml.org,2002:float",
       test: /^[-+]?(?:[0-9][0-9_]*)?\.[0-9_]*$/,
-      resolve(str6) {
-        const node = new Scalar.Scalar(parseFloat(str6.replace(/_/g, "")));
-        const dot = str6.indexOf(".");
+      resolve(str8) {
+        const node = new Scalar.Scalar(parseFloat(str8.replace(/_/g, "")));
+        const dot = str8.indexOf(".");
         if (dot !== -1) {
-          const f = str6.substring(dot + 1).replace(/_/g, "");
+          const f = str8.substring(dot + 1).replace(/_/g, "");
           if (f[f.length - 1] === "0")
             node.minFractionDigits = f.length;
         }
@@ -19234,34 +19377,34 @@ var require_int2 = __commonJS({
     init_define_KT_HUB_FILES();
     var stringifyNumber = require_stringifyNumber();
     var intIdentify = (value) => typeof value === "bigint" || Number.isInteger(value);
-    function intResolve(str6, offset, radix, { intAsBigInt }) {
-      const sign3 = str6[0];
-      if (sign3 === "-" || sign3 === "+")
+    function intResolve(str8, offset, radix, { intAsBigInt }) {
+      const sign2 = str8[0];
+      if (sign2 === "-" || sign2 === "+")
         offset += 1;
-      str6 = str6.substring(offset).replace(/_/g, "");
+      str8 = str8.substring(offset).replace(/_/g, "");
       if (intAsBigInt) {
         switch (radix) {
           case 2:
-            str6 = `0b${str6}`;
+            str8 = `0b${str8}`;
             break;
           case 8:
-            str6 = `0o${str6}`;
+            str8 = `0o${str8}`;
             break;
           case 16:
-            str6 = `0x${str6}`;
+            str8 = `0x${str8}`;
             break;
         }
-        const n2 = BigInt(str6);
-        return sign3 === "-" ? BigInt(-1) * n2 : n2;
+        const n2 = BigInt(str8);
+        return sign2 === "-" ? BigInt(-1) * n2 : n2;
       }
-      const n = parseInt(str6, radix);
-      return sign3 === "-" ? -1 * n : n;
+      const n = parseInt(str8, radix);
+      return sign2 === "-" ? -1 * n : n;
     }
     function intStringify(node, radix, prefix) {
       const { value } = node;
       if (intIdentify(value)) {
-        const str6 = value.toString(radix);
-        return value < 0 ? "-" + prefix + str6.substr(1) : prefix + str6;
+        const str8 = value.toString(radix);
+        return value < 0 ? "-" + prefix + str8.substr(1) : prefix + str8;
       }
       return stringifyNumber.stringifyNumber(node);
     }
@@ -19271,7 +19414,7 @@ var require_int2 = __commonJS({
       tag: "tag:yaml.org,2002:int",
       format: "BIN",
       test: /^[-+]?0b[0-1_]+$/,
-      resolve: (str6, _onError, opt) => intResolve(str6, 2, 2, opt),
+      resolve: (str8, _onError, opt) => intResolve(str8, 2, 2, opt),
       stringify: (node) => intStringify(node, 2, "0b")
     };
     var intOct = {
@@ -19280,7 +19423,7 @@ var require_int2 = __commonJS({
       tag: "tag:yaml.org,2002:int",
       format: "OCT",
       test: /^[-+]?0[0-7_]+$/,
-      resolve: (str6, _onError, opt) => intResolve(str6, 1, 8, opt),
+      resolve: (str8, _onError, opt) => intResolve(str8, 1, 8, opt),
       stringify: (node) => intStringify(node, 8, "0")
     };
     var int = {
@@ -19288,7 +19431,7 @@ var require_int2 = __commonJS({
       default: true,
       tag: "tag:yaml.org,2002:int",
       test: /^[-+]?[0-9][0-9_]*$/,
-      resolve: (str6, _onError, opt) => intResolve(str6, 0, 10, opt),
+      resolve: (str8, _onError, opt) => intResolve(str8, 0, 10, opt),
       stringify: stringifyNumber.stringifyNumber
     };
     var intHex = {
@@ -19297,7 +19440,7 @@ var require_int2 = __commonJS({
       tag: "tag:yaml.org,2002:int",
       format: "HEX",
       test: /^[-+]?0x[0-9a-fA-F_]+$/,
-      resolve: (str6, _onError, opt) => intResolve(str6, 2, 16, opt),
+      resolve: (str8, _onError, opt) => intResolve(str8, 2, 16, opt),
       stringify: (node) => intStringify(node, 16, "0x")
     };
     exports2.int = int;
@@ -19403,12 +19546,12 @@ var require_timestamp = __commonJS({
     "use strict";
     init_define_KT_HUB_FILES();
     var stringifyNumber = require_stringifyNumber();
-    function parseSexagesimal(str6, asBigInt) {
-      const sign3 = str6[0];
-      const parts = sign3 === "-" || sign3 === "+" ? str6.substring(1) : str6;
+    function parseSexagesimal(str8, asBigInt) {
+      const sign2 = str8[0];
+      const parts = sign2 === "-" || sign2 === "+" ? str8.substring(1) : str8;
       const num2 = (n) => asBigInt ? BigInt(n) : Number(n);
       const res = parts.replace(/_/g, "").split(":").reduce((res2, p) => res2 * num2(60) + num2(p), num2(0));
-      return sign3 === "-" ? num2(-1) * res : res;
+      return sign2 === "-" ? num2(-1) * res : res;
     }
     function stringifySexagesimal(node) {
       let { value } = node;
@@ -19417,9 +19560,9 @@ var require_timestamp = __commonJS({
         num2 = (n) => BigInt(n);
       else if (isNaN(value) || !isFinite(value))
         return stringifyNumber.stringifyNumber(node);
-      let sign3 = "";
+      let sign2 = "";
       if (value < 0) {
-        sign3 = "-";
+        sign2 = "-";
         value *= num2(-1);
       }
       const _60 = num2(60);
@@ -19434,7 +19577,7 @@ var require_timestamp = __commonJS({
           parts.unshift(value);
         }
       }
-      return sign3 + parts.map((n) => String(n).padStart(2, "0")).join(":").replace(/000000\d*$/, "");
+      return sign2 + parts.map((n) => String(n).padStart(2, "0")).join(":").replace(/000000\d*$/, "");
     }
     var intTime = {
       identify: (value) => typeof value === "bigint" || Number.isInteger(value),
@@ -19442,7 +19585,7 @@ var require_timestamp = __commonJS({
       tag: "tag:yaml.org,2002:int",
       format: "TIME",
       test: /^[-+]?[0-9][0-9_]*(?::[0-5]?[0-9])+$/,
-      resolve: (str6, _onError, { intAsBigInt }) => parseSexagesimal(str6, intAsBigInt),
+      resolve: (str8, _onError, { intAsBigInt }) => parseSexagesimal(str8, intAsBigInt),
       stringify: stringifySexagesimal
     };
     var floatTime = {
@@ -19451,7 +19594,7 @@ var require_timestamp = __commonJS({
       tag: "tag:yaml.org,2002:float",
       format: "TIME",
       test: /^[-+]?[0-9][0-9_]*(?::[0-5]?[0-9])+\.[0-9_]*$/,
-      resolve: (str6) => parseSexagesimal(str6, false),
+      resolve: (str8) => parseSexagesimal(str8, false),
       stringify: stringifySexagesimal
     };
     var timestamp = {
@@ -19462,8 +19605,8 @@ var require_timestamp = __commonJS({
       // may be omitted altogether, resulting in a date format. In such a case, the time part is
       // assumed to be 00:00:00Z (start of day, UTC).
       test: RegExp("^([0-9]{4})-([0-9]{1,2})-([0-9]{1,2})(?:(?:t|T|[ \\t]+)([0-9]{1,2}):([0-9]{1,2}):([0-9]{1,2}(\\.[0-9]+)?)(?:[ \\t]*(Z|[-+][012]?[0-9](?::[0-9]{2})?))?)?$"),
-      resolve(str6) {
-        const match = str6.match(timestamp.test);
+      resolve(str8) {
+        const match = str8.match(timestamp.test);
         if (!match)
           throw new Error("!!timestamp expects a date, starting with yyyy-mm-dd");
         const [, year, month, day, hour, minute, second] = match.map(Number);
@@ -24060,10 +24203,10 @@ function hexToBytes(hex) {
 }
 var nextTick = async () => {
 };
-function utf8ToBytes(str6) {
-  if (typeof str6 !== "string")
+function utf8ToBytes(str8) {
+  if (typeof str8 !== "string")
     throw new TypeError("string expected");
-  return new Uint8Array(new TextEncoder().encode(str6));
+  return new Uint8Array(new TextEncoder().encode(str8));
 }
 function kdfInputToBytes(data, errorTitle = "") {
   if (typeof data === "string")
@@ -25676,7 +25819,7 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
     bits2int_modN: "function"
   });
   ecdsaOpts = Object.assign({}, ecdsaOpts);
-  const randomBytes7 = ecdsaOpts.randomBytes === void 0 ? randomBytes2 : ecdsaOpts.randomBytes;
+  const randomBytes6 = ecdsaOpts.randomBytes === void 0 ? randomBytes2 : ecdsaOpts.randomBytes;
   const hmac2 = ecdsaOpts.hmac === void 0 ? (key, msg2) => hmac(hash_, key, msg2) : ecdsaOpts.hmac;
   const { Fp, Fn } = Point;
   const { ORDER: CURVE_ORDER, BITS: fnBits } = Fn;
@@ -25822,7 +25965,7 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
       throw new Error("invalid private key");
     const seedArgs = [int2octets(d), int2octets(h1int)];
     if (extraEntropy != null && extraEntropy !== false) {
-      const e = extraEntropy === true ? randomBytes7(lengths.secretKey) : extraEntropy;
+      const e = extraEntropy === true ? randomBytes6(lengths.secretKey) : extraEntropy;
       seedArgs.push(abytes2(e, void 0, "extraEntropy"));
     }
     const seed = concatBytes2(...seedArgs);
@@ -25849,7 +25992,7 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
     }
     return { seed, k2sig };
   }
-  function sign3(message, secretKey, opts2 = {}) {
+  function sign2(message, secretKey, opts2 = {}) {
     const { seed, k2sig } = prepSig(message, secretKey, opts2);
     const drbg = createHmacDrbg(hash_.outputLen, Fn.BYTES, hmac2);
     const sig = drbg(seed, k2sig);
@@ -25895,7 +26038,7 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
     utils,
     lengths,
     Point,
-    sign: sign3,
+    sign: sign2,
     verify,
     recoverPublicKey,
     Signature,
@@ -28317,7 +28460,15 @@ var KutrionClient = class {
   }
   // Rotate tokens explicitly (req() also does this transparently on 401).
   async refreshTokens(refreshToken) {
-    return this.req("POST", "/auth/refresh", await this.signedRefreshBody(refreshToken), false);
+    const { body, signerThrew } = await this.signedRefreshBody(refreshToken);
+    try {
+      return await this.req("POST", "/auth/refresh", body, false);
+    } catch (e) {
+      if (signerThrew && !body.signature && e instanceof ApiError && e.status === 401 && isRefreshSignatureRefusal(e.body)) {
+        throw new ApiError(0, "signer_unavailable");
+      }
+      throw e;
+    }
   }
   refreshBody(refreshToken) {
     return this.refreshClaim ? { refresh_token: refreshToken, client: this.refreshClaim } : { refresh_token: refreshToken };
@@ -28462,8 +28613,8 @@ var KutrionClient = class {
   // --- step-up (MT-3 #117): lift a social-login session's vault gate by proving a 2nd factor.
   // Returns a fresh, unlocked token (swapped in via onToken). Passkey holders can instead complete
   // a passkey login, which also mints an unlocked token.
-  async stepUpTotp(code) {
-    const r = await this.req("POST", "/auth/step-up/totp", { code });
+  async stepUpTotp(code, approvalId) {
+    const r = await this.req("POST", "/auth/step-up/totp", approvalId ? { code, approval_id: approvalId } : { code });
     this.onToken?.(r.token);
     return r;
   }
@@ -28471,11 +28622,23 @@ var KutrionClient = class {
   webauthnStepUpOptions() {
     return this.req("POST", "/auth/webauthn/step-up/options");
   }
-  async webauthnStepUpVerify(response) {
-    const r = await this.req("POST", "/auth/webauthn/step-up/verify", { response });
+  async webauthnStepUpVerify(response, approvalId) {
+    const r = await this.req("POST", "/auth/webauthn/step-up/verify", approvalId ? { response, approval_id: approvalId } : { response });
     this.onToken?.(r.token);
     return r;
   }
+  // #3301: the new-Hub approval page (server/src/modules/hub-keys.ts). The read returns only what the
+  // approval's own session may see; an unknown, spent or foreign id is a 404 or `{status:"expired"}`.
+  hubApprovalRead(id) {
+    return this.req("GET", `/auth/hub-channel-keys/approvals/${encodeURIComponent(id)}`);
+  }
+  hubApprovalPassword(id, password) {
+    return this.req("POST", `/auth/hub-channel-keys/approvals/${encodeURIComponent(id)}/password`, { password });
+  }
+  // Idempotent for a confirmed approval of the same session, so the page calls it straight after confirm.
+  hubApprovalComplete(id) {
+    return this.req("POST", `/auth/hub-channel-keys/approvals/${encodeURIComponent(id)}/complete`);
+  }
   // #1723: the browser half of the desktop step-up handoff. The ceremony above has already run and
   // recorded the proof; this hands the request id back and gets the app's custom-scheme return URL.
   // The proof must be newer than the request, so it is only ever called after a verify.
@@ -28708,6 +28871,9 @@ var KutrionClient = class {
   credentialHealth() {
     return this.req("GET", "/vault/health");
   }
+  credentialHealthSummary() {
+    return this.req("GET", "/vault/health/summary");
+  }
   // #745: duplicate credentials, found server-side across every vault the caller can reach. No secret
   // is returned — members carry an opaque secretGroup label so a client can show which ones agree.
   credentialDuplicates() {
@@ -28801,7 +28967,7 @@ var KutrionClient = class {
   }
   /** enroll: SSH rows with a username and no password are created with no credential, for a bulk enrollment (#2635). */
   commitConnImport(vaultId, connections, opts2 = {}) {
-    return this.req("POST", "/connection-import/commit", { vault_id: vaultId, connections, ...opts2.enroll ? { enroll: true } : {} });
+    return this.req("POST", "/connection-import/commit", { vault_id: vaultId, connections, ...opts2.enroll ? { enroll: true } : {}, ...opts2.reach_via ? { reach_via: opts2.reach_via } : {} });
   }
   // Raw text download of a provider's sample/template file (carries the auth token).
   async importTemplate(provider) {
@@ -29492,6 +29658,54 @@ var KutrionClient = class {
       { scope, resource_id: resourceId }
     );
   }
+  // --- #3264: port-forward allow-list. Owners and admins only. Opening the policy and adding a target
+  // answer 403 step_up_required until a fresh check; 409 port_forward_target_exists / port_forward_target_limit. ---
+  getPortForwardPolicy() {
+    return this.req("GET", "/org/port-forward-policy");
+  }
+  setPortForwardPolicy(policy) {
+    return this.req("PUT", "/org/port-forward-policy", { policy });
+  }
+  listPortForwardTargets() {
+    return this.req("GET", "/org/port-forward-targets");
+  }
+  addPortForwardTarget(input) {
+    return this.req("POST", "/org/port-forward-targets", input);
+  }
+  removePortForwardTarget(id) {
+    return this.req("DELETE", `/org/port-forward-targets/${encodeURIComponent(id)}`);
+  }
+  // --- #3311: connectors. Org owners and admins only; every route is a 404 where the deployment has the
+  // tunnel off, a 402 `feature: "connectors"` at the plan's cap. ---
+  listConnectors() {
+    return this.req("GET", "/connectors");
+  }
+  getConnector(id) {
+    return this.req("GET", `/connectors/${encodeURIComponent(id)}`);
+  }
+  createConnector(name) {
+    return this.req("POST", "/connectors", { name });
+  }
+  /** 403 step_up_required until a fresh check; 402 when reviving a revoked connector would pass the cap. */
+  issueConnectorEnrolmentToken(id) {
+    return this.req("POST", `/connectors/${encodeURIComponent(id)}/enrolment-token`);
+  }
+  revokeConnector(id) {
+    return this.req("POST", `/connectors/${encodeURIComponent(id)}/revoke`);
+  }
+  /** 400 invalid_route lists problems by index; 409 wide_cidr_acknowledgement_required lists `wide` (resend with acknowledge_wide); 409 connector_revoked. */
+  getConnectorRoutes(id) {
+    return this.req("GET", `/connectors/${encodeURIComponent(id)}/routes`);
+  }
+  /** Replaces the whole set. */
+  setConnectorRoutes(id, routes, acknowledgeWide = false) {
+    return this.req("PUT", `/connectors/${encodeURIComponent(id)}/routes`, { routes, acknowledge_wide: acknowledgeWide });
+  }
+  /** Dry run by default. `confirm: true` writes the pins and needs a fresh step-up (403 step_up_required).
+   *  Fingerprints come only from the caller's input; nothing observed through the connector is returned. */
+  pinConnectorHostKeys(id, input) {
+    return this.req("POST", `/connectors/${encodeURIComponent(id)}/host-keys`, input);
+  }
   // --- SSH host-key pins (#951 records them, #959 makes them answerable) ---
   // Read and discard only, org admin/owner. There is deliberately no create or update: nothing in the
   // product accepts a fingerprint from a human, because a pin means "this is what the host actually
@@ -29504,8 +29718,9 @@ var KutrionClient = class {
     return this.req("DELETE", `/ssh/host-keys/${id}`);
   }
   /**
-   * #2743: pins the key a host_key_unconfirmed refusal showed this caller. The server accepts only the
-   * fingerprint it observed for this caller, so this is not a way to type one in. 403 step_up_required
+   * #2743: pins the key a host_key_unconfirmed refusal showed this caller. For a first-use refusal the server accepts only the
+   * fingerprint it observed for this caller; for a host behind a jump chain (#3336) it holds no observed
+   * key, so an organization admin passes the fingerprint read from the host itself and the server checks it. 403 step_up_required
    * or host_key_confirm_forbidden; 409 host_key_not_observed, host_key_fingerprint_mismatch or
    * host_key_mismatch.
    */
@@ -29934,7 +30149,7 @@ var KutrionClient = class {
   // #1687: the streaming counterparts of cloudDownload/cloudUpload, so a cloud node can be one side of
   // a brokered transfer without the bytes being materialised. Same helpers as the sftp/file pairs.
   //
-  // GET /cloud/connections/:id/download (server/src/modules/cloud.ts:438) takes the same `?redact=1`
+  // GET /cloud/connections/:id/download (server/src/modules/cloud.ts:446) takes the same `?redact=1`
   // and the same open-ended `Range: bytes=<start>-` as the file route, and answers 206 with
   // Content-Range when it resumes. A BOUNDED range is refused outright by refuseUnsupportedRange
   // (cloud.ts:453) — downloadStream only ever sends the open-ended form, so that refusal is
@@ -30917,6 +31132,8 @@ var SSH_REFUSAL_CLASSIFICATION = {
   unsupported_credential: { family: "refused", retry: "pointless" },
   // The connection's port is not one the broker will dial.
   bad_port: { family: "refused", retry: "pointless" },
+  // The org's port-forward allow-list does not list the target; it stays unlisted until an admin adds it.
+  forward_target_refused: { family: "refused", retry: "pointless" },
   // The client presented none; reconnecting presents none again.
   missing_join_token: { family: "refused", retry: "pointless" },
   // The same token is presented again and rejected again.
@@ -30932,6 +31149,8 @@ var SSH_REFUSAL_CLASSIFICATION = {
   connection_unavailable: { family: "refused", retry: "pointless" },
   // Same as not_found, for the credential the connection names.
   credential_not_found: { family: "refused", retry: "pointless" },
+  // #3386: a temporary credential past its expiry; the same attempt earns the same refusal.
+  credential_expired: { family: "refused", retry: "pointless" },
   // #1949: this app does not own the surface and the user holds no live grant for it. "pointless" —
   // the same token from the same app earns the identical refusal, and the remedy is elsewhere: open
   // the app that owns the surface, or have an administrator grant access from this one.
@@ -31040,10 +31259,48 @@ var HOST_KEY_CONFIRM_COPY = {
   forbidden: "Only an organization admin, or an editor of the vault that holds this connection, can trust a new host key. Ask one of them to confirm it; they should check the fingerprint above against the host itself first.",
   notThisConnection: "This key is not for the host this connection opens. It belongs to a jump host on the way, or Kutrion could not tell which host it belongs to, so it cannot be trusted from this terminal. Open that host's own connection and confirm its key there; that needs an organization admin, or an editor of the vault that holds that connection."
 };
+var str3 = (v) => typeof v === "string" && v.trim() ? v.trim() : void 0;
 var pinHost = (h) => h.trim().toLowerCase().replace(/\.$/, "");
 function isOwnHost(pending, own) {
   return !!own?.host && own.port !== void 0 && pending.port !== void 0 && pending.port !== null && pending.port === Number(own.port) && pinHost(pending.host) === pinHost(own.host);
 }
+var HOST_KEY_CHAINED_COPY = {
+  heading: "Confirm this host's identity before connecting",
+  body: "This host is reached through a jump host, and its key has not been confirmed yet, so Kutrion paused before signing in and did not send your credential. Confirming records this key for the whole organization; every later connection must match it.",
+  help: "Read the fingerprint on the host itself, not through the jump host. Run this command on the host (it shows the Ed25519 key; use the matching file if the host uses another key type):",
+  command: "ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub",
+  fingerprintLabel: "Fingerprint from the host",
+  fingerprintHint: "Enter the value that starts with SHA256:",
+  invalid: "That is not a fingerprint. A fingerprint starts with SHA256: followed by 43 characters.",
+  confirm: "Confirm and trust this host",
+  confirming: "Confirming",
+  nonAdmin: "Only an organization admin can confirm this host's key. Ask one to read the fingerprint on the host and confirm it.",
+  mismatch: "That fingerprint does not match. Read it again on the host itself and try again.",
+  expired: "The time to confirm has run out. Connect again, then confirm.",
+  failed: "Could not confirm this host key.",
+  checkingRole: "Checking your role\u2026",
+  notThisConnection: "Open this host's own connection to confirm its key.",
+  banner: "Connection paused: this host's key has not been confirmed."
+};
+var HOST_KEY_FINGERPRINT_PATTERN = /SHA256:[A-Za-z0-9+/]{43}(?![A-Za-z0-9+/=])/;
+var HOST_KEY_FINGERPRINT_EXACT = /^SHA256:[A-Za-z0-9+/]{43}$/;
+function extractHostKeyFingerprint(input) {
+  return input.match(HOST_KEY_FINGERPRINT_PATTERN)?.[0] ?? null;
+}
+function hostKeyChainedFromFrame(frame) {
+  if (frame?.code !== "host_key_unconfirmed" || !frame.detail || typeof frame.detail !== "object") return null;
+  const d = frame.detail;
+  const host2 = str3(d.host);
+  if (!host2 || str3(d.presented_fingerprint) || str3(d.connector_id)) return null;
+  const port = typeof d.port === "number" ? d.port : void 0;
+  return { target: port === void 0 ? host2 : `${host2}:${port}`, host: host2, port };
+}
+function hostKeyConfirmFailure(code) {
+  if (code === "host_key_confirm_forbidden" || code === "forbidden") return "forbidden";
+  if (code === "host_key_fingerprint_mismatch" || code === "host_key_mismatch") return "mismatch";
+  if (code === "host_key_not_observed") return "expired";
+  return "other";
+}
 
 // ../packages/shared/src/conn-import-plan.ts
 init_define_KT_HUB_FILES();
@@ -31051,6 +31308,18 @@ function connImportNeedsCredential(row) {
   return !row.username || !row.password && !row.credential_id && !(row.enroll && row.protocol === "SFTP");
 }
 var CONN_IMPORT_NO_CREDENTIAL_HINT = "Will not import: this export carries no password. Enter a username and password to import it.";
+var CONN_IMPORT_BINDING_COPY = {
+  title: "Import result",
+  boundHeading: "Credentials now limited to these hosts",
+  bound: (credential, n) => `${credential} is now limited to these ${n} host${n === 1 ? "" : "s"}:`,
+  needsHeading: "Needs a credential binding",
+  needsIntro: (n) => `${n} host${n === 1 ? "" : "s"} will be refused until a vault editor adds ${n === 1 ? "it" : "them"} to the credential.`,
+  needsRow: (name, dest) => `${name} (${dest}) will be refused until a vault editor adds this host to the credential.`,
+  needsWhere: "A vault editor can add the host to the credential's destinations in the Kutrion web app.",
+  done: "Done",
+  next: "Continue"
+};
+var connImportDestLabel = (d) => `${d.protocol} ${d.host}:${d.port}`;
 
 // ../packages/shared/src/jump-refusal.ts
 init_define_KT_HUB_FILES();
@@ -31067,11 +31336,11 @@ function isJumpRefusalCode(code) {
   return !!code && JUMP_REFUSAL_CODES.includes(code);
 }
 var MAX_JUMP_HOPS = 4;
-var str3 = (v) => typeof v === "string" && v.trim() ? v.trim() : null;
+var str4 = (v) => typeof v === "string" && v.trim() ? v.trim() : null;
 function parseJumpRefusal(body) {
   if (!body || typeof body !== "object") return null;
   const b = body;
-  const code = str3(b.code) ?? str3(b.error);
+  const code = str4(b.code) ?? str4(b.error);
   if (!isJumpRefusalCode(code)) return null;
   const nested = b.detail && typeof b.detail === "object" ? b.detail : {};
   const pick2 = (k) => b[k] !== void 0 ? b[k] : nested[k];
@@ -31079,14 +31348,14 @@ function parseJumpRefusal(body) {
   const allowed = pick2("allowed_destinations");
   return {
     code,
-    hopConnectionId: str3(pick2("hop_connection_id")),
+    hopConnectionId: str4(pick2("hop_connection_id")),
     hopIndex: typeof idx === "number" && Number.isFinite(idx) ? idx : null,
-    detail: typeof b.detail === "string" ? str3(b.detail) : str3(nested.detail) ?? str3(b.error_description),
+    detail: typeof b.detail === "string" ? str4(b.detail) : str4(nested.detail) ?? str4(b.error_description),
     allowedDestinations: Array.isArray(allowed) ? allowed.filter((x) => typeof x === "string" && x.trim() !== "") : null
   };
 }
 function hopName(r, names) {
-  return r.hopConnectionId ? str3(names(r.hopConnectionId)) : null;
+  return r.hopConnectionId ? str4(names(r.hopConnectionId)) : null;
 }
 function jumpHopLabel(r, names) {
   const name = hopName(r, names);
@@ -31098,7 +31367,7 @@ function jumpHopPossessive(r, names) {
 }
 function jumpRefusalSummary(r, names, openedName) {
   const name = hopName(r, names);
-  const opened = str3(openedName);
+  const opened = str4(openedName);
   const target = opened ? `\u201C${opened}\u201D` : "this connection";
   const where = r.hopIndex !== null && r.hopIndex > 0 ? ` at jump host ${r.hopIndex + 1} of the chain,` : "";
   const opening = `Kutrion did not reach ${target}. It was refused${where} one hop earlier,`;
@@ -31130,14 +31399,14 @@ function jumpAllowedDestinationsLabel(r, names) {
 function parseJumpHostInUse(body) {
   if (!body || typeof body !== "object") return null;
   const b = body;
-  if (str3(b.error) !== "jump_host_in_use") return null;
+  if (str4(b.error) !== "jump_host_in_use") return null;
   const rows = Array.isArray(b.used_by) ? b.used_by : [];
-  const usedBy = rows.filter((x) => !!x && typeof x === "object").map((x) => ({ id: str3(x.id) ?? "", name: str3(x.name) ?? "" })).filter((x) => x.id && x.name);
+  const usedBy = rows.filter((x) => !!x && typeof x === "object").map((x) => ({ id: str4(x.id) ?? "", name: str4(x.name) ?? "" })).filter((x) => x.id && x.name);
   return { usedBy };
 }
 var JUMP_HOST_IN_USE_TITLE = "Other connections are reached through this one";
 function jumpHostInUseSummary(r, deletingName) {
-  const name = str3(deletingName);
+  const name = str4(deletingName);
   const subject2 = name ? `\u201C${name}\u201D` : "this connection";
   const n = r.usedBy.length;
   if (!n) {
@@ -33163,11 +33432,9 @@ function osKeychainAvailable() {
   }
 }
 
-// src/app-signin.ts
+// src/hub-seed-login.ts
 init_define_KT_HUB_FILES();
-var import_node_crypto4 = require("node:crypto");
-var import_node_child_process = require("node:child_process");
-var import_node_http = require("node:http");
+var import_os3 = require("os");
 
 // src/device-identity.ts
 init_define_KT_HUB_FILES();
@@ -33206,90 +33473,6 @@ async function bindRefreshKey(deviceId, devicePkcs8B64, certMessage, transport)
   return transport.unlock({ device_id: deviceId, signature, refresh_key: { spki, certification, hardware: false } });
 }
 
-// src/hub/borrow-confirm.ts
-init_define_KT_HUB_FILES();
-var import_node_url = require("node:url");
-var text = (v) => typeof v === "string" && v.trim() ? v.trim() : null;
-var SCRIPTS = [
-  ["latin", new RegExp("\\p{Script=Latin}", "u")],
-  ["cyrillic", new RegExp("\\p{Script=Cyrillic}", "u")],
-  ["greek", new RegExp("\\p{Script=Greek}", "u")],
-  ["armenian", new RegExp("\\p{Script=Armenian}", "u")],
-  ["cjk", /[\p{Script=Han}\p{Script=Hiragana}\p{Script=Katakana}]/u],
-  ["hangul", new RegExp("\\p{Script=Hangul}", "u")],
-  ["arabic", new RegExp("\\p{Script=Arabic}", "u")],
-  ["hebrew", new RegExp("\\p{Script=Hebrew}", "u")]
-];
-function mixesScripts(s) {
-  const seen = /* @__PURE__ */ new Set();
-  for (const ch of s) {
-    if (!new RegExp("\\p{L}", "u").test(ch)) continue;
-    seen.add(SCRIPTS.find(([, re]) => re.test(ch))?.[0] ?? "other");
-  }
-  return seen.size > 1;
-}
-function joinedAccount(user, lastAccount) {
-  const at = user.email.lastIndexOf("@");
-  const localPart = at >= 0 ? user.email.slice(0, at) : user.email;
-  const raw = at >= 0 ? user.email.slice(at + 1) : "";
-  const ascii = raw ? (0, import_node_url.domainToASCII)(raw.toLowerCase()) || raw : "";
-  return {
-    email: user.email,
-    localPart,
-    domain: ascii,
-    internationalDomain: ascii !== raw.toLowerCase(),
-    mixedScript: mixesScripts(localPart),
-    displayName: text(user.display_name),
-    orgName: text(user.org_name),
-    accountChanged: lastAccount !== null && lastAccount !== user.id
-  };
-}
-function createBorrowConfirm(deps) {
-  let account = null;
-  let heldId = null;
-  let heldName = null;
-  const remember = (user) => {
-    if (deps.lastAccount.get() !== user.id) deps.lastAccount.set(user.id);
-  };
-  const reject = async () => {
-    account = null;
-    heldId = null;
-    heldName = null;
-    const held = deps.borrow.discard();
-    if (!held) return;
-    deps.pin.clear();
-    await deps.revoke(held.deviceId, held.bearer).catch(() => void 0);
-  };
-  return {
-    hold(user, deviceId, deviceName) {
-      account = user;
-      heldId = deviceId;
-      heldName = deviceName ?? null;
-    },
-    pending: () => account ? { ...joinedAccount(account, deps.lastAccount.get()), deviceName: heldName } : null,
-    seen(user) {
-      if (!account && user) remember(user);
-    },
-    async confirm() {
-      const user = account;
-      const id = heldId;
-      if (!user || !id) return false;
-      if (!deps.borrow.commit(id)) {
-        await reject();
-        return false;
-      }
-      account = null;
-      heldId = null;
-      remember(user);
-      return true;
-    },
-    reject,
-    forgetHub() {
-      deps.pin.clear();
-    }
-  };
-}
-
 // src/hub-login.ts
 init_define_KT_HUB_FILES();
 var import_os2 = require("os");
@@ -33772,16 +33955,19 @@ async function redeemEnrolment(p) {
     headers: { "Content-Type": "application/json", Accept: "application/json" },
     // #2975: this build asks the user to confirm a first-contact account, and says so, so a server
     // that refuses builds without that step can tell the two apart.
-    body: JSON.stringify({ code: p.code, signature, audience, capabilities: ["i1"] }),
+    body: JSON.stringify({ code: p.code, signature, audience, capabilities: ["i1"], hub_pk: p.hubPk }),
     signal: AbortSignal.timeout(15e3)
   });
+  p.latch?.observe(audience, res.headers);
+  const parsed = await res.json().catch(() => null);
   if (!res.ok) {
     if (res.status !== 403) return null;
-    const refusal = await res.json().catch(() => null);
-    return refusal?.error === "device_clients_disabled" || refusal?.error === "satellite_update_required" ? refusal.error : null;
+    const refusal = parsed;
+    return refusal?.error === "device_clients_disabled" || refusal?.error === "satellite_update_required" || refusal?.error === "hub_not_bound" ? refusal.error : null;
   }
-  const body = await res.json();
+  const body = parsed ?? {};
   if (!body.device?.id || !body.access_token || !body.refresh_token) return null;
+  p.latch?.tokenIssued(audience, res, body);
   return {
     deviceId: body.device.id,
     deviceName: typeof body.device.name === "string" ? body.device.name : null,
@@ -33836,9 +34022,11 @@ async function borrowAndEnrol(deps) {
     apiBase: deps.apiBase,
     identity: deps.identity,
     code: borrowed.code,
+    hubPk: borrowed.hubPublicKey,
+    latch: deps.latch,
     fetchImpl: deps.fetchImpl
   });
-  if (enrolment === "device_clients_disabled" || enrolment === "satellite_update_required") return { ok: false, reason: enrolment };
+  if (enrolment === "device_clients_disabled" || enrolment === "satellite_update_required" || enrolment === "hub_not_bound") return { ok: false, reason: enrolment };
   return enrolment ? { ok: true, enrolment, hubPublicKey: borrowed.hubPublicKey } : { ok: false, reason: "enrol_refused" };
 }
 function createBorrowSession(store, client, resolveDeps) {
@@ -33907,6 +34095,191 @@ function createBorrowSession(store, client, resolveDeps) {
   };
 }
 
+// src/hub/hub-key.ts
+init_define_KT_HUB_FILES();
+var FEATURES_HEADER = "kutrion-features";
+var HUB_KEY_FEATURE = "hub-key-check";
+var HUB_KEY_COPY = {
+  notVouched: "Kutrion could not be confirmed for your account. Sign in to the Kutrion app directly.",
+  notBound: "Sign in to the Kutrion app again."
+};
+function advertisesHubKeyCheck(headers) {
+  let raw;
+  try {
+    raw = headers?.get(FEATURES_HEADER);
+  } catch {
+    return false;
+  }
+  return !!raw && raw.split(",").some((v) => v.trim().toLowerCase() === HUB_KEY_FEATURE);
+}
+function isApiNotFound(status, body) {
+  return status === 404 && body?.error === "not_found";
+}
+var str5 = (v) => typeof v === "string" && v.length > 0;
+function issuesTokens(body) {
+  const o = body && typeof body === "object" ? body : null;
+  const device = o?.device && typeof o.device === "object" ? o.device : null;
+  return !!o && str5(device?.id) && str5(o.access_token) && str5(o.refresh_token);
+}
+function createFeatureLatch(store, log3) {
+  const read2 = () => {
+    try {
+      return store.read();
+    } catch {
+      return null;
+    }
+  };
+  const write2 = (origin) => {
+    try {
+      store.write(origin);
+    } catch {
+      log3("[hub-key] could not persist the feature latch");
+    }
+  };
+  const observe = (origin, headers) => {
+    if (advertisesHubKeyCheck(headers) && read2() !== origin) write2(origin);
+  };
+  return {
+    // An unreadable store reads as latched: not knowing is never a reason to accept a legacy answer.
+    latched(origin) {
+      try {
+        return store.read() === origin;
+      } catch {
+        return true;
+      }
+    },
+    observe,
+    verdictSeen(origin) {
+      if (read2() !== origin) write2(origin);
+    },
+    tokenIssued(origin, res, body) {
+      if (res.status < 200 || res.status > 299 || res.redirected !== false) return;
+      let type = "";
+      try {
+        type = res.headers?.get("content-type") ?? "";
+      } catch {
+        return;
+      }
+      if (!type.toLowerCase().includes("application/json") || !issuesTokens(body)) return;
+      if (advertisesHubKeyCheck(res.headers)) {
+        observe(origin, res.headers);
+        return;
+      }
+      if (read2() !== origin) return;
+      write2(null);
+      log3(`[hub-key] unlatched ${origin}: its token-issuing response carried no ${FEATURES_HEADER}`);
+    }
+  };
+}
+async function checkHubKey(p) {
+  const origin = apiOrigin(p.apiBase);
+  if (!origin || !p.bearer) return "unavailable";
+  let res;
+  try {
+    res = await (p.fetchImpl ?? fetch)(`${p.apiBase}/auth/hub-channel-keys/check`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Accept: "application/json", Authorization: `Bearer ${p.bearer}`, ...p.headers },
+      body: JSON.stringify({ channel_key: p.hubPk }),
+      redirect: "error",
+      signal: AbortSignal.timeout(p.timeoutMs ?? 1e4)
+    });
+  } catch {
+    return "unavailable";
+  }
+  p.latch.observe(origin, res.headers);
+  const body = await res.json().catch(() => null);
+  if (isApiNotFound(res.status, body) && !p.latch.latched(origin)) return "legacy";
+  if (!res.ok) return "unavailable";
+  const v = body?.verdict;
+  if (v !== "vouched" && v !== "first_contact" && v !== "new_hub" && v !== "refused") return "unavailable";
+  p.latch.verdictSeen(origin);
+  return v;
+}
+
+// src/hub/borrow-confirm.ts
+init_define_KT_HUB_FILES();
+var import_node_url = require("node:url");
+var text = (v) => typeof v === "string" && v.trim() ? v.trim() : null;
+var SCRIPTS = [
+  ["latin", new RegExp("\\p{Script=Latin}", "u")],
+  ["cyrillic", new RegExp("\\p{Script=Cyrillic}", "u")],
+  ["greek", new RegExp("\\p{Script=Greek}", "u")],
+  ["armenian", new RegExp("\\p{Script=Armenian}", "u")],
+  ["cjk", /[\p{Script=Han}\p{Script=Hiragana}\p{Script=Katakana}]/u],
+  ["hangul", new RegExp("\\p{Script=Hangul}", "u")],
+  ["arabic", new RegExp("\\p{Script=Arabic}", "u")],
+  ["hebrew", new RegExp("\\p{Script=Hebrew}", "u")]
+];
+function mixesScripts(s) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const ch of s) {
+    if (!new RegExp("\\p{L}", "u").test(ch)) continue;
+    seen.add(SCRIPTS.find(([, re]) => re.test(ch))?.[0] ?? "other");
+  }
+  return seen.size > 1;
+}
+function joinedAccount(user, lastAccount) {
+  const at = user.email.lastIndexOf("@");
+  const localPart = at >= 0 ? user.email.slice(0, at) : user.email;
+  const raw = at >= 0 ? user.email.slice(at + 1) : "";
+  const ascii = raw ? (0, import_node_url.domainToASCII)(raw.toLowerCase()) || raw : "";
+  return {
+    email: user.email,
+    localPart,
+    domain: ascii,
+    internationalDomain: ascii !== raw.toLowerCase(),
+    mixedScript: mixesScripts(localPart),
+    displayName: text(user.display_name),
+    orgName: text(user.org_name),
+    accountChanged: lastAccount !== null && lastAccount !== user.id
+  };
+}
+function createBorrowConfirm(deps) {
+  let account = null;
+  let heldId = null;
+  let heldName = null;
+  const remember = (user) => {
+    if (deps.lastAccount.get() !== user.id) deps.lastAccount.set(user.id);
+  };
+  const reject = async () => {
+    account = null;
+    heldId = null;
+    heldName = null;
+    const held = deps.borrow.discard();
+    if (!held) return;
+    deps.pin.clear();
+    await deps.revoke(held.deviceId, held.bearer).catch(() => void 0);
+  };
+  return {
+    hold(user, deviceId, deviceName) {
+      account = user;
+      heldId = deviceId;
+      heldName = deviceName ?? null;
+    },
+    pending: () => account ? { ...joinedAccount(account, deps.lastAccount.get()), deviceName: heldName } : null,
+    seen(user) {
+      if (!account && user) remember(user);
+    },
+    async confirm() {
+      const user = account;
+      const id = heldId;
+      if (!user || !id) return false;
+      if (!deps.borrow.commit(id)) {
+        await reject();
+        return false;
+      }
+      account = null;
+      heldId = null;
+      remember(user);
+      return true;
+    },
+    reject,
+    forgetHub() {
+      deps.pin.clear();
+    }
+  };
+}
+
 // src/hub/last-account.ts
 init_define_KT_HUB_FILES();
 var import_node_fs2 = require("node:fs");
@@ -34004,6 +34377,8 @@ var slot = {
   refresh: (base) => `${base}#refresh`,
   device: (base) => `${base}#device`,
   hubPin: (base) => `${base}#hub-pin`,
+  // #3301: the API origin that has advertised the Hub key check; a fact about the server, kept across sign-out.
+  featuresLatch: (base) => `${base}#hub-key-latch`,
   lastAccount: (base) => `${base}#last-account`,
   // #3051: the device id whose refresh-key bind is settled (bound, or refused for good), so it runs once.
   refreshBound: (base) => `${base}#refresh-bound`
@@ -34079,13 +34454,20 @@ function cliHubStores(base, kc, keychainAvailable) {
       drop(kc, slot.hubPin(base));
     }
   };
+  const latch = {
+    read: () => kc.get(slot.featuresLatch(base)) ?? null,
+    write: (origin) => {
+      if (origin === null) kc.clear(slot.featuresLatch(base));
+      else kc.set(slot.featuresLatch(base), origin);
+    }
+  };
   const lastAccount = {
     get: () => read(kc, slot.lastAccount(base)),
     set: (userId) => {
       write(kc, slot.lastAccount(base), userId);
     }
   };
-  return { store, pin, lastAccount, failedWrite: () => failed2 ? { deviceId, bearer } : null };
+  return { store, pin, latch, lastAccount, failedWrite: () => failed2 ? { deviceId, bearer } : null };
 }
 function borrowedDeviceKey(base, kc) {
   return readDevice(kc, base).key;
@@ -34147,6 +34529,7 @@ var HUB_COPY = {
   storeFailed: "The sign-in from the Kutrion app could not be saved in this computer's keychain, so that device was signed out and removed. Nothing was kept.",
   failure: {
     hub_not_running: "The Kutrion app is not running.",
+    hub_timed_out: "The Kutrion app, or you, did not answer in time. Run the login again to retry.",
     hub_identity_changed: "The program answering for the Kutrion app is not the one this CLI paired with, so it was not used.",
     grant_not_from_hub: "The answer did not come from the paired Kutrion app, so it was not used.",
     protocol: "The Kutrion app answered in a way this CLI does not understand.",
@@ -34160,7 +34543,8 @@ var HUB_COPY = {
     unavailable: "The Kutrion app could not get a sign-in code from the server.",
     enrol_refused: "The server did not accept the sign-in from the Kutrion app.",
     device_clients_disabled: "Signing in through the Kutrion app is turned off on this server.",
-    satellite_update_required: "The server needs a newer CLI to sign in through the Kutrion app. Update the CLI, then start a new sign-in from the Kutrion app."
+    satellite_update_required: "The server needs a newer CLI to sign in through the Kutrion app. Update the CLI, then start a new sign-in from the Kutrion app.",
+    hub_not_bound: "Sign in to the Kutrion app again."
   }
 };
 async function presentJoined(confirm, out, ask, lead = HUB_COPY.joinedLead) {
@@ -34184,13 +34568,14 @@ var hubAbsent = (reason) => reason !== void 0 && ["hub_not_running", "hub_signed
 async function hubLogin(deps) {
   if (!deps.keychainAvailable()) return { kind: "fallback", note: null, reason: "no_keychain" };
   if (locationFault(deps.location)) return { kind: "fallback", note: null, reason: "hub_not_running" };
-  const { store, pin, lastAccount, failedWrite } = cliHubStores(deps.base, deps.kc, deps.keychainAvailable);
+  const { store, pin, latch, lastAccount, failedWrite } = cliHubStores(deps.base, deps.kc, deps.keychainAvailable);
   const revoke = (deviceId, bearer) => endServerSession(deps.call, deviceId, bearer);
   const session = createBorrowSession(store, "cli", () => ({
     location: deps.location,
     apiBase: deps.base,
     pin,
-    revokeReplaced: revoke
+    revokeReplaced: revoke,
+    latch: createFeatureLatch(latch, deps.log ?? ((line) => console.error(line)))
   }));
   const confirm = createBorrowConfirm({
     borrow: { commit: (id) => session.commit(id), discard: () => session.discard() },
@@ -34241,315 +34626,16 @@ async function hubLogin(deps) {
   return { kind: "signed_in", user, firstContact: true };
 }
 
-// src/app-signin.ts
-var SIGNIN_FLOW_DEADLINE_MS = 3e5;
-var REQUEST_URI_PREFIX = "urn:ietf:params:oauth:request_uri:";
-var ID_RE = /^[A-Za-z0-9_-]{43}$/;
-var HANDLE_RE = /^[A-Za-z0-9_-]{43}$/;
-var MAX_CALLBACK_BYTES = 2048;
-var BROWSER_SIGNIN_COPY = {
-  lead: "Opening your web browser to sign in with Kutrion.",
-  waiting: "Waiting for you to approve this CLI in the browser. This request expires in a few minutes.",
-  openIt: (url) => `If the page did not open, go to this address in a browser on this computer:
-  ${url}`,
-  signedIn: "Sign in with Kutrion approved.",
-  notYou: "Not kept: that device was signed out and removed.",
-  notKept: HUB_COPY.notKept,
-  unconfirmed: "This CLI could not check which account the sign-in belongs to, so nothing from it was kept. Try again.",
-  storeFailed: "The sign-in could not be saved in this computer's keychain, so that device was signed out and removed. Nothing was kept.",
-  failure: {
-    unavailable: "This Kutrion server does not offer sign-in through the browser.",
-    already_enrolled: "This CLI is already registered on this computer. Run kt logout first.",
-    no_keychain: "There is no OS keychain to keep this sign-in in.",
-    rate_limited: "Too many sign-in attempts. Wait a few minutes and try again.",
-    unreachable: "Kutrion could not be reached. Check the connection and try again.",
-    request_failed: "Kutrion did not accept the sign-in request. Try again.",
-    no_approval_url: "The server did not return an approval page to open.",
-    approval_url_refused: "The approval page the server named is not a secure web address, so it was not used.",
-    listener_failed: "This CLI could not listen on this computer for the approval.",
-    timeout: "The approval did not arrive in time. Start again when you are ready.",
-    access_denied: "The sign-in was denied in the browser. Nothing was kept.",
-    origin_mismatch: "The approval came from a different network than this CLI, so it was refused. Sign in with your password instead.",
-    device_limit: "Your account has reached its device limit. Remove a device you no longer use in the web portal, then try again.",
-    redeem_failed: "The approval could not be completed on this computer. Start again."
-  }
-};
-function postJson(base, fetchImpl) {
-  return async (path, body) => {
-    try {
-      const res = await fetchImpl(base + path, {
-        method: "POST",
-        headers: { "Content-Type": "application/json", Accept: "application/json" },
-        body: JSON.stringify(body),
-        signal: AbortSignal.timeout(15e3)
-      });
-      const parsed = await res.json().catch(() => null);
-      return res.ok ? { ok: true, data: parsed } : { ok: false, status: res.status, body: parsed };
-    } catch {
-      return { ok: false, status: null, body: null };
-    }
-  };
-}
-var errorOf = (body) => body && typeof body === "object" ? body.error : void 0;
-function isUnavailable(status, body) {
-  const e = errorOf(body);
-  if (status === 403) return e === "kutrion_sign_in_disabled" || e === "device_clients_disabled";
-  if (status === 400) return e === "unknown_client";
-  return status === 404;
-}
-function requestIdOf(requestUri) {
-  if (typeof requestUri !== "string" || !requestUri.startsWith(REQUEST_URI_PREFIX)) return null;
-  const id = requestUri.slice(REQUEST_URI_PREFIX.length);
-  return ID_RE.test(id) ? id : null;
-}
-function approvalUrlRefusal(url, allowLoopbackHttp) {
-  if (typeof url !== "string") return null;
-  let u;
-  try {
-    u = new URL(url);
-  } catch {
-    return null;
-  }
-  const loopback = u.hostname === "localhost" || u.hostname === "127.0.0.1";
-  if (u.protocol !== "https:" && !(allowLoopbackHttp && loopback && u.protocol === "http:")) return null;
-  if (u.username || u.password) return null;
-  return u.href;
-}
-function parseCallbackForm(body) {
-  const p = new URLSearchParams(body);
-  const requestId = p.get("request_id");
-  if (!requestId || !ID_RE.test(requestId)) return null;
-  const handle = p.get("handle");
-  const error = p.get("error");
-  if (handle !== null && error === null && HANDLE_RE.test(handle)) return { requestId, handle };
-  if (error !== null && handle === null && (error === "access_denied" || error === "origin_mismatch")) return { requestId, error };
-  return null;
-}
-var PAGE = (title, line) => `<!doctype html><meta charset="utf-8"><title>${title}</title><body style="font-family:system-ui;margin:3rem"><h1>${title}</h1><p>${line}</p></body>`;
-function listenForCallback() {
-  return new Promise((resolve2) => {
-    let expected = null;
-    let origin = null;
-    const queue = [];
-    let waiter = null;
-    const server = (0, import_node_http.createServer)((req, res) => {
-      const headers = { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store", "X-Content-Type-Options": "nosniff" };
-      if (req.method !== "POST" || req.url !== "/signin/callback") {
-        res.writeHead(404, headers).end();
-        return;
-      }
-      const sent = req.headers.origin;
-      if (origin && sent !== void 0 && sent !== "null" && sent !== origin) {
-        res.writeHead(403, headers).end();
-        return;
-      }
-      const chunks = [];
-      let size = 0;
-      req.on("data", (c) => {
-        size += c.length;
-        if (size > MAX_CALLBACK_BYTES) {
-          res.writeHead(413, headers).end();
-          req.destroy();
-          return;
-        }
-        chunks.push(c);
-      });
-      req.on("end", () => {
-        if (size > MAX_CALLBACK_BYTES) return;
-        const cb = parseCallbackForm(Buffer.concat(chunks).toString("utf8"));
-        if (!cb || cb.requestId !== expected || queue.length >= 8) {
-          res.writeHead(400, headers).end(PAGE("Not recognized", "This sign-in request is not the one this CLI is waiting for."));
-          return;
-        }
-        res.writeHead(200, headers).end(PAGE("Return to your terminal", "You can close this tab. The CLI is finishing the sign-in."));
-        const w = waiter;
-        waiter = null;
-        if (w) w(cb);
-        else queue.push(cb);
-      });
-    });
-    server.once("error", () => resolve2(null));
-    server.listen(0, "127.0.0.1", () => {
-      const port = server.address().port;
-      resolve2({
-        port,
-        expect: (requestId, approvalOrigin) => {
-          expected = requestId;
-          origin = approvalOrigin ?? null;
-        },
-        next: (until) => new Promise((done) => {
-          const queued = queue.shift();
-          if (queued) {
-            done(queued);
-            return;
-          }
-          const timer = setTimeout(() => {
-            waiter = null;
-            done("timeout");
-          }, Math.max(0, until - Date.now()));
-          waiter = (c) => {
-            clearTimeout(timer);
-            done(c);
-          };
-        }),
-        close: () => {
-          waiter = null;
-          server.close();
-          server.closeAllConnections();
-        }
-      });
-    });
-  });
-}
-function openInBrowser(url, platform3 = process.platform, env = process.env) {
-  if (platform3 !== "darwin" && platform3 !== "win32" && !env.DISPLAY && !env.WAYLAND_DISPLAY) return Promise.resolve(false);
-  const [cmd, args] = platform3 === "darwin" ? ["open", [url]] : platform3 === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url]] : ["xdg-open", [url]];
-  return new Promise((resolve2) => {
-    try {
-      const child = (0, import_node_child_process.spawn)(cmd, args, { stdio: "ignore", detached: true });
-      child.once("error", () => resolve2(false));
-      child.once("spawn", () => {
-        child.unref();
-        resolve2(true);
-      });
-    } catch {
-      resolve2(false);
-    }
-  });
-}
-async function redeem(post, handle, verifier, key) {
-  const priv = (0, import_node_crypto4.createPrivateKey)({ key: Buffer.from(key.privatePkcs8B64, "base64"), format: "der", type: "pkcs8" });
-  const signature = (0, import_node_crypto4.sign)(null, Buffer.from(handle, "utf8"), priv).toString("base64");
-  const res = await post(
-    "/auth/app-signin/redeem",
-    { handle, code_verifier: verifier, signature }
-  );
-  if (!res.ok) {
-    if (res.status === 400 && errorOf(res.body) === "invalid_grant") return "invalid_grant";
-    if (res.status === 409 && errorOf(res.body) === "device_limit") return "device_limit";
-    return "failed";
-  }
-  const { device, access_token: access, refresh_token: refresh } = res.data;
-  if (typeof device?.id !== "string" || typeof access !== "string" || typeof refresh !== "string") return "failed";
-  return { deviceId: device.id, privatePkcs8B64: key.privatePkcs8B64, accessToken: access, refreshToken: refresh };
-}
-async function runBrowserSignin(deps) {
-  const fail = (reason) => ({ ok: false, reason });
-  if (deps.store.deviceId()) return fail("already_enrolled");
-  if (!deps.store.keychainAvailable()) return fail("no_keychain");
-  const listener = await (deps.listen ?? listenForCallback)();
-  if (!listener) return fail("listener_failed");
-  try {
-    const key = resolveDeviceKey(deps.store, deps.generateKey);
-    const verifier = (0, import_node_crypto4.randomBytes)(32).toString("base64url");
-    const res = await deps.post("/auth/app-signin/request", {
-      client_id: "cli",
-      public_key: key.publicSpkiB64,
-      code_challenge: (0, import_node_crypto4.createHash)("sha256").update(verifier).digest("base64url"),
-      code_challenge_method: "S256",
-      device_name: deps.deviceName().slice(0, 100),
-      loopback_port: listener.port
-    });
-    if (!res.ok) {
-      if (isUnavailable(res.status, res.body)) return fail("unavailable");
-      return fail(res.status === 429 ? "rate_limited" : res.status === null ? "unreachable" : "request_failed");
-    }
-    const requestId = requestIdOf(res.data.request_uri);
-    if (!requestId) return fail("request_failed");
-    if (typeof res.data.approval_url !== "string" || !res.data.approval_url) return fail("no_approval_url");
-    const href = approvalUrlRefusal(res.data.approval_url, deps.allowLoopbackHttp);
-    if (!href) return fail("approval_url_refused");
-    const until = Date.now() + (deps.deadlineMs ?? SIGNIN_FLOW_DEADLINE_MS);
-    deps.out(BROWSER_SIGNIN_COPY.lead);
-    listener.expect(requestId, new URL(href).origin);
-    let waited = listener.next(until);
-    await deps.open(href);
-    deps.out(BROWSER_SIGNIN_COPY.openIt(href));
-    deps.out(BROWSER_SIGNIN_COPY.waiting);
-    for (; ; ) {
-      const cb = await waited;
-      if (cb === "timeout") return fail("timeout");
-      if ("error" in cb) return fail(cb.error);
-      const out = await redeem(deps.post, cb.handle, verifier, key);
-      if (out === "invalid_grant") {
-        if (Date.now() >= until) return fail("timeout");
-        waited = listener.next(until);
-        continue;
-      }
-      if (out === "device_limit") return fail("device_limit");
-      if (out === "failed") return fail("redeem_failed");
-      return { ok: true, held: out };
-    }
-  } finally {
-    listener.close();
-  }
-}
-async function browserLogin(deps) {
-  const { store, lastAccount, failedWrite } = cliHubStores(deps.base, deps.kc, deps.keychainAvailable);
-  const outcome = await runBrowserSignin({ ...deps, store });
-  if (!outcome.ok) return { kind: "failed", note: BROWSER_SIGNIN_COPY.failure[outcome.reason], reason: outcome.reason };
-  const held = outcome.held;
-  deps.out(BROWSER_SIGNIN_COPY.signedIn);
-  let current = held;
-  const revoke = (deviceId, bearer) => endServerSession(deps.call, deviceId, bearer);
-  const confirm = createBorrowConfirm({
-    borrow: {
-      commit: (id) => {
-        const h = current;
-        if (!h || h.deviceId !== id || store.deviceId()) return false;
-        current = null;
-        store.setRefresh(h.refreshToken);
-        store.setDevice(h.deviceId, h.privatePkcs8B64);
-        store.setAccess(h.accessToken);
-        return true;
-      },
-      discard: () => {
-        const h = current;
-        current = null;
-        return h ? { deviceId: h.deviceId, bearer: h.accessToken } : null;
-      }
-    },
-    pin: { hubPublicKey: null, pin() {
-    }, clear() {
-    } },
-    lastAccount,
-    revoke
-  });
-  const me = await deps.call("GET", "/auth/me", void 0, held.accessToken).catch(() => null);
-  const user = me?.ok && me.data?.user ? me.data.user : null;
-  if (!user) {
-    await confirm.reject();
-    return { kind: "failed", note: BROWSER_SIGNIN_COPY.unconfirmed };
-  }
-  confirm.hold(user, held.deviceId);
-  const verdict = await presentJoined(confirm, deps.out, deps.ask, "Sign in with Kutrion approved this CLI for this account:");
-  if (verdict === "not_you") return { kind: "failed", note: BROWSER_SIGNIN_COPY.notYou };
-  if (verdict === "not_kept" || !await confirm.confirm()) return { kind: "failed", note: BROWSER_SIGNIN_COPY.notKept };
-  const f = failedWrite();
-  if (f) {
-    await endServerSession(deps.call, f.deviceId, f.bearer);
-    dropBorrowed(deps.base, deps.kc);
-    try {
-      if (f.bearer && deps.kc.get(deps.base) === f.bearer) deps.kc.clear(deps.base);
-    } catch {
-    }
-    return { kind: "store_failed", note: BROWSER_SIGNIN_COPY.storeFailed };
-  }
-  return { kind: "signed_in", user };
-}
-
-// src/hub-seed-login.ts
-init_define_KT_HUB_FILES();
-var import_os3 = require("os");
-
 // src/hub/hub-seed.ts
 init_define_KT_HUB_FILES();
 var import_node_net2 = require("node:net");
-var import_node_child_process2 = require("node:child_process");
+var import_node_child_process = require("node:child_process");
 var import_node_fs3 = require("node:fs");
 var import_node_os2 = require("node:os");
 var import_node_path3 = require("node:path");
 var REPLY_DEADLINE_MS2 = 13e4;
+var CONFIRM_DEADLINE_MS = 12e4;
+var SHOW_CODES_AFTER_MS = 1500;
 var CODE_RE2 = /^[A-Za-z0-9_-]{43}$/;
 var CLOSED = Symbol("closed");
 var BAD = Symbol("bad");
@@ -34599,35 +34685,80 @@ function lineReader(sock) {
   };
 }
 var failed = (reason) => ({ ok: false, reason });
-function seedOnce(deps) {
-  const resolved = resolveEndpoint(deps.location, { platform: deps.platform });
-  if (resolved === null) return Promise.resolve(failed("hub_not_running"));
-  const origin = apiOrigin(deps.apiBase);
-  if (origin === null) return Promise.resolve(failed("protocol"));
-  const { identity } = deps;
-  const sock = (deps.connectTo ?? ((e) => (0, import_node_net2.connect)(e)))(resolved.endpoint);
+function openConn(deps, endpoint) {
+  const sock = (deps.connectTo ?? ((e) => (0, import_node_net2.connect)(e)))(endpoint);
   const rd = lineReader(sock);
   const timer = setTimeout(() => sock.destroy(), REPLY_DEADLINE_MS2);
   timer.unref?.();
-  const send = (frame) => sock.write(`${JSON.stringify(frame)}
-`);
-  return (async () => {
-    const cnonce = newNonce();
-    send({ v: CHANNEL_VERSION, t: "hello-seed", client: identity.client, pk: identity.publicSpkiB64, cnonce, origin });
-    const first = await rd.next();
-    if (first === CLOSED) return failed("hub_not_running");
-    if (first === BAD) return failed("protocol");
-    const refusedFirst = parseRefuse(first);
-    if (refusedFirst) return failed(refusedFirst.reason);
-    const offer = parseOfferSeed(first);
-    if (!offer) return failed("protocol");
-    const pinned = deps.pin.hubPublicKey;
-    if (pinned && !sameKey(pinned, offer.hub_pk)) return failed("hub_identity_changed");
-    if (resolved.expectedHubPk && !sameKey(resolved.expectedHubPk, offer.hub_pk)) return failed("hub_identity_changed");
-    if (!pinned) {
-      if (!await deps.confirmHub(keyFingerprint(identity.client, offer.hub_pk))) return failed("hub_unconfirmed");
-      deps.pin.pin(offer.hub_pk);
+  return {
+    sock,
+    rd,
+    send: (frame) => sock.write(`${JSON.stringify(frame)}
+`),
+    close: () => {
+      clearTimeout(timer);
+      sock.destroy();
     }
+  };
+}
+async function helloFor(conn, identity, origin) {
+  const cnonce = newNonce();
+  conn.send({ v: CHANNEL_VERSION, t: "hello-seed", client: identity.client, pk: identity.publicSpkiB64, cnonce, origin });
+  const first = await conn.rd.next();
+  if (first === CLOSED) return failed("hub_not_running");
+  if (first === BAD) return failed("protocol");
+  const refused = parseRefuse(first);
+  if (refused) return failed(refused.reason);
+  const offer = parseOfferSeed(first);
+  return offer ? { cnonce, offer } : failed("protocol");
+}
+async function confirmWithin(deps, codes) {
+  const ac = new AbortController();
+  const t = setTimeout(() => ac.abort(), deps.timing?.confirmMs ?? CONFIRM_DEADLINE_MS);
+  t.unref?.();
+  try {
+    const yes = await deps.confirmHub(codes, ac.signal);
+    return ac.signal.aborted ? "timed_out" : yes;
+  } finally {
+    clearTimeout(t);
+  }
+}
+async function seedOnce(deps) {
+  const resolved = resolveEndpoint(deps.location, { platform: deps.platform });
+  if (resolved === null) return failed("hub_not_running");
+  const origin = apiOrigin(deps.apiBase);
+  if (origin === null) return failed("protocol");
+  const { identity } = deps;
+  const appCode = keyFingerprint(identity.client, identity.publicSpkiB64);
+  const wrongHub = (hubPk2, expect) => expect !== null && !sameKey(expect, hubPk2) || resolved.expectedHubPk != null && !sameKey(resolved.expectedHubPk, hubPk2);
+  const pinned = deps.pin.hubPublicKey ?? null;
+  const probe = openConn(deps, resolved.endpoint);
+  let met;
+  try {
+    met = await helloFor(probe, identity, origin);
+  } finally {
+    probe.close();
+  }
+  if (!("offer" in met)) return met;
+  const hubPk = met.offer.hub_pk;
+  if (wrongHub(hubPk, pinned)) return failed("hub_identity_changed");
+  const verdict = await deps.check(hubPk);
+  if (verdict === "unavailable") return failed("hub_check_unavailable");
+  if (verdict === "refused" || verdict === "new_hub") return failed("hub_not_vouched");
+  if (pinned === null || verdict === "first_contact") {
+    const answer = await confirmWithin(deps, { app: appCode, hub: keyFingerprint(identity.client, hubPk) });
+    if (answer === "timed_out") return failed("hub_timed_out");
+    if (!answer) return failed("hub_unconfirmed");
+    if (pinned === null) deps.pin.pin(hubPk);
+  }
+  const expectHub = hubPk;
+  const conn = openConn(deps, resolved.endpoint);
+  const ui = new AbortController();
+  try {
+    const met2 = await helloFor(conn, identity, origin);
+    if (!("offer" in met2)) return met2;
+    const { cnonce, offer } = met2;
+    if (wrongHub(offer.hub_pk, expectHub)) return failed("hub_identity_changed");
     const parts = {
       client: identity.client,
       satPk: identity.publicSpkiB64,
@@ -34637,48 +34768,67 @@ function seedOnce(deps) {
       snonce: offer.snonce,
       origin
     };
-    send({ v: CHANNEL_VERSION, t: "prove", sig: signTranscript(identity.privatePkcs8B64, seedRequestTranscript(parts)) });
-    const second = await rd.next();
-    if (second === CLOSED) return failed("hub_not_running");
+    conn.send({ v: CHANNEL_VERSION, t: "prove", sig: signTranscript(identity.privatePkcs8B64, seedRequestTranscript(parts)) });
+    let stopped = false;
+    const show = deps.showCodes;
+    const showTimer = show ? setTimeout(() => {
+      void show({ app: appCode, hub: keyFingerprint(identity.client, offer.hub_pk) }, ui.signal).then((stop) => {
+        if (stop && !ui.signal.aborted) {
+          stopped = true;
+          conn.sock.destroy();
+        }
+      }, () => void 0);
+    }, deps.timing?.showCodesAfterMs ?? SHOW_CODES_AFTER_MS) : null;
+    const second = await conn.rd.next();
+    if (showTimer) clearTimeout(showTimer);
+    ui.abort();
+    if (stopped) return failed("hub_unconfirmed");
+    if (second === CLOSED) return failed("hub_timed_out");
     if (second === BAD) return failed("protocol");
     const refusedSecond = parseRefuse(second);
     if (refusedSecond) return failed(refusedSecond.reason);
     const accept = parseAcceptSeed(second);
     if (!accept) return failed("protocol");
     if (!verifyTranscript(offer.hub_pk, seedAcceptTranscript(parts), accept.sig)) return failed("hub_not_from_hub");
-    const issued = await deps.issue(offer.device_pk);
+    const issued = await deps.issue(offer.device_pk, offer.hub_pk);
     if (!issued.ok) return failed(issued.reason);
-    send({
+    conn.send({
       v: CHANNEL_VERSION,
       t: "seed",
       code: issued.code,
       sig: signTranscript(identity.privatePkcs8B64, seedTranscript({ ...parts, code: issued.code }))
     });
-    const third = await rd.next();
-    if (third === CLOSED) return failed("hub_not_running");
+    const third = await conn.rd.next();
+    if (third === CLOSED) return failed("hub_timed_out");
     if (third === BAD) return failed("protocol");
     const refusedThird = parseRefuse(third);
     if (refusedThird) return failed(refusedThird.reason);
     const seeded = parseSeeded(third);
     return seeded ? { ok: true, result: seeded.result, hubPublicKey: offer.hub_pk } : failed("protocol");
-  })().finally(() => {
-    clearTimeout(timer);
-    sock.destroy();
-  });
+  } finally {
+    ui.abort();
+    conn.close();
+  }
 }
 function hubCodeIssuer(p) {
-  return async (devicePk) => {
+  return async (devicePk, hubPk, approvalId) => {
     const bearer = p.bearer();
     const deviceId = p.deviceId();
     if (!bearer || !deviceId) return { ok: false, reason: "issue_refused" };
     const res = await p.post(
       "/auth/handoff/issue",
-      { purpose: "enrolment", device_id: deviceId, client: { id: "hub", name: p.hubName, platform: "desktop", public_key: devicePk } },
+      {
+        purpose: "enrolment",
+        device_id: deviceId,
+        client: { id: "hub", name: p.hubName, platform: "desktop", public_key: devicePk, channel_key: hubPk },
+        ...approvalId ? { approval_id: approvalId } : {}
+      },
       bearer
     );
     if (!res.ok) {
       const err = res.body?.error;
-      return { ok: false, reason: res.status === 403 && err === "step_up_required" ? "step_up_required" : "issue_refused" };
+      if (res.status === 403 && err === "step_up_required") return { ok: false, reason: "step_up_required" };
+      return { ok: false, reason: res.status === 403 && err === "hub_not_vouched" ? "hub_not_vouched" : "issue_refused" };
     }
     const code = res.data?.code;
     return typeof code === "string" && CODE_RE2.test(code) ? { ok: true, code } : { ok: false, reason: "issue_refused" };
@@ -34707,11 +34857,11 @@ function hubLauncher(env = {}) {
   const home = env.home ?? (0, import_node_os2.homedir)();
   const exists = env.exists ?? import_node_fs3.existsSync;
   const exec2 = env.exec ?? ((file, args) => new Promise((resolve2, reject) => {
-    (0, import_node_child_process2.execFile)(file, args, { timeout: 5e3, windowsHide: true, maxBuffer: 4 * 1024 * 1024 }, (e, out) => e ? reject(e) : resolve2(out));
+    (0, import_node_child_process.execFile)(file, args, { timeout: 5e3, windowsHide: true, maxBuffer: 4 * 1024 * 1024 }, (e, out) => e ? reject(e) : resolve2(out));
   }));
   const startDetached2 = env.startDetached ?? ((file, args) => {
     try {
-      const child = (0, import_node_child_process2.spawn)(file, args, { detached: true, stdio: "ignore", windowsHide: true });
+      const child = (0, import_node_child_process.spawn)(file, args, { detached: true, stdio: "ignore", windowsHide: true });
       child.on("error", () => void 0);
       child.unref();
       return true;
@@ -34785,14 +34935,16 @@ async function seedHubAfterSignIn(deps) {
     if (!reachable()) return { kind: "retry" };
   }
   const launcher = deps.launcher;
-  const confirmHub = launcher?.foreground ? async (fp) => {
+  const confirmHub = launcher?.foreground ? async (codes, signal) => {
     await Promise.resolve(launcher.foreground?.()).catch(() => void 0);
-    return deps.confirmHub(fp);
+    return deps.confirmHub(codes, signal);
   } : deps.confirmHub;
   const out = await seedOnce({ ...deps, confirmHub });
   if (out.ok) return { kind: "done", result: out.result };
   if (out.reason === "hub_other_account") return { kind: "other_account" };
   if (out.reason === "hub_not_running") return { kind: "retry" };
+  if (out.reason === "hub_timed_out") return { kind: "timed_out" };
+  if (out.reason === "hub_check_unavailable") return { kind: "retry" };
   return { kind: "stopped", reason: out.reason };
 }
 
@@ -34804,13 +34956,17 @@ var SEED_COPY = {
   failedNotRemoved: (name) => `This CLI could not register itself as a device, and the device it created could not be removed. You are still logged in. Remove "${name}" from Active devices in the web portal.`,
   joined: "The Kutrion app on this computer is now signed in to this account.",
   otherAccount: "The Kutrion app on this computer is signed in to a different account. Sign it out there first. This CLI keeps its own sign-in.",
+  retryLater: "The Kutrion app was not signed in because the account service could not be reached to check it. It will try again at the next sign-in.",
   declined: "Not shared: the Kutrion app was not signed in.",
   stopped: (reason) => `The Kutrion app was not signed in (${printable(reason)}).`,
-  firstContact: (fp) => [
-    `The Kutrion app on this computer answered. Its code is ${fp}.`,
+  firstContact: (codes) => [
+    `The Kutrion app on this computer answered. Its code is ${codes.hub}.`,
+    `The Kutrion app will then ask you to allow this CLI, and show this CLI's code: ${codes.app}`,
     "If you did not just open the Kutrion app yourself, answer no.",
     "Sharing gives the Kutrion app its own sign-in to your account. Your password is not sent, and you can sign it out again from Active devices."
   ],
+  allowCodes: (codes) => `The Kutrion app is asking whether to allow this CLI. Check it shows these codes before you allow it: this CLI ${codes.app}, Kutrion ${codes.hub}. If they differ, choose Don't allow in the Kutrion app.`,
+  timedOut: "Sharing your sign-in with the Kutrion app timed out, so it was not signed in. You are still logged in. Run kt login again to retry.",
   ask: "\x1B[0mSign the Kutrion app in too? Type yes to share, or anything else to skip: "
 };
 function seedSkipReason(env, platform3, tty) {
@@ -34888,7 +35044,8 @@ async function seedHubFromLogin(deps) {
   if (skip) return { kind: "skipped", reason: skip };
   if (!deps.location || !deps.keychainAvailable()) return { kind: "skipped", reason: "no_channel" };
   try {
-    const { store, pin } = cliHubStores(deps.base, deps.kc, deps.keychainAvailable);
+    const { store, pin, latch: latchStore } = cliHubStores(deps.base, deps.kc, deps.keychainAvailable);
+    const latch = createFeatureLatch(latchStore, deps.log ?? ((line) => console.error(line)));
     const deviceId = store.deviceId();
     const keyB64 = store.devicePrivateKeyPkcs8();
     const bearer = () => {
@@ -34904,18 +35061,29 @@ async function seedHubFromLogin(deps) {
     if (!mode?.ok || mode.data?.vault_mode !== "audited") return { kind: "skipped", reason: "private_vault" };
     const key = resolveDeviceKey(store);
     const issuer = hubCodeIssuer({ post: deps.post, bearer, deviceId: () => store.deviceId(), hubName: `Kutrion on ${host()}`.slice(0, 255) });
+    let checkUnavailable = false;
     const status = await seedHubAfterSignIn({
       location: deps.location,
       identity: { client: "cli", ...key },
       pin,
       apiBase: deps.base,
-      confirmHub: async (fingerprint) => {
-        for (const line of SEED_COPY.firstContact(fingerprint)) deps.out(line);
+      confirmHub: async (codes) => {
+        for (const line of SEED_COPY.firstContact(codes)) deps.out(line);
         return (await deps.ask(SEED_COPY.ask).catch(() => "")).trim().toLowerCase() === "yes";
       },
-      issue: async (devicePk) => {
+      // Printed once; a terminal cannot retract a line, so the prompt never asks to stop.
+      showCodes: async (codes) => {
+        deps.out(SEED_COPY.allowCodes(codes));
+        return false;
+      },
+      check: async (hubPk) => {
+        const verdict = await checkHubKey({ apiBase: deps.base, bearer: bearer(), hubPk, latch, fetchImpl: deps.fetchImpl });
+        if (verdict === "unavailable") checkUnavailable = true;
+        return verdict;
+      },
+      issue: async (devicePk, hubPk) => {
         await deps.touch().catch(() => void 0);
-        return issuer(devicePk);
+        return issuer(devicePk, hubPk);
       },
       launcher: withForeground(deps.launcher ?? hubLauncher({ platform: platform3, localAppData: env.LOCALAPPDATA, programFiles: env.ProgramFiles }), tty),
       env,
@@ -34923,7 +35091,10 @@ async function seedHubFromLogin(deps) {
     });
     if (status.kind === "done" && status.result === "joined") deps.out(SEED_COPY.joined);
     else if (status.kind === "other_account") deps.out(SEED_COPY.otherAccount);
+    else if (status.kind === "timed_out") deps.out(SEED_COPY.timedOut);
+    else if (status.kind === "retry" && checkUnavailable) deps.out(SEED_COPY.retryLater);
     else if (status.kind === "stopped" && status.reason === "hub_unconfirmed") deps.out(SEED_COPY.declined);
+    else if (status.kind === "stopped" && status.reason === "hub_not_vouched") deps.out(HUB_KEY_COPY.notVouched);
     else if (status.kind === "stopped" && status.reason !== "disabled") deps.out(SEED_COPY.stopped(status.reason));
     return status;
   } catch {
@@ -34933,7 +35104,7 @@ async function seedHubFromLogin(deps) {
 
 // src/hub/ensure-hub.ts
 init_define_KT_HUB_FILES();
-var import_node_child_process3 = require("node:child_process");
+var import_node_child_process2 = require("node:child_process");
 var import_node_fs4 = require("node:fs");
 var import_node_os3 = require("node:os");
 var import_node_path4 = require("node:path");
@@ -34956,7 +35127,7 @@ function stageFiles(files) {
   return dir;
 }
 function startDetached(command, args) {
-  const child = (0, import_node_child_process3.spawn)(command, args, { detached: true, stdio: "ignore", windowsHide: true });
+  const child = (0, import_node_child_process2.spawn)(command, args, { detached: true, stdio: "ignore", windowsHide: true });
   child.on("error", () => void 0);
   child.unref();
 }
@@ -35215,7 +35386,7 @@ var HOST_KEY_CONFIRM_COPY2 = {
   notThisConnection: "This key is not for the host this connection opens. It belongs to a jump host on the way, or Kutrion could not tell which host it belongs to, so it cannot be trusted from here. Open that host's own connection and confirm its key there; that needs an organization admin, or an editor of the vault that holds that connection.",
   connectAgain: "Connect again:"
 };
-var HOST_KEY_FINGERPRINT = /^SHA256:[A-Za-z0-9+/]{43}$/;
+var HOST_KEY_FINGERPRINT = HOST_KEY_FINGERPRINT_EXACT;
 function parseHostKeyUnconfirmed(d) {
   if (!d || typeof d !== "object") return null;
   const o = d;
@@ -35269,6 +35440,74 @@ function hostKeyConfirmErrorLines(e, connectionId, indent = "  ") {
   }
   return null;
 }
+var CHAINED_PROMPT = "Fingerprint from the host: ";
+function parseHostKeyChained(d) {
+  return hostKeyChainedFromFrame({ code: "host_key_unconfirmed", detail: d && typeof d === "object" ? d : void 0 });
+}
+function hostKeyChainedFromError(e) {
+  if (!(e instanceof ApiError) || e.status !== 409) return null;
+  const b = e.body;
+  return b?.error === "host_key_unconfirmed" ? parseHostKeyChained(b.host_key) : null;
+}
+function hostKeyChainedLines(k, own, indent = "  ") {
+  const lines = [`${HOST_KEY_CHAINED_COPY.heading} (host_key_unconfirmed)`, "", HOST_KEY_CHAINED_COPY.body, "", `${indent}host: ${k.target}`, ""];
+  if (own && isOwnHost(k, own)) {
+    lines.push(
+      HOST_KEY_CHAINED_COPY.help,
+      `${indent}${HOST_KEY_CHAINED_COPY.command}`,
+      "",
+      "An organization admin then trusts it with:",
+      `${indent}kt ssh trust ${own.id} --fingerprint <fingerprint from the host>`,
+      "",
+      HOST_KEY_CHAINED_COPY.nonAdmin
+    );
+  } else {
+    lines.push(HOST_KEY_CHAINED_COPY.notThisConnection);
+  }
+  return lines;
+}
+async function confirmChainedHostKey(deps, connId, k, own) {
+  deps.out("");
+  deps.out(`${HOST_KEY_CHAINED_COPY.heading} (host_key_unconfirmed)`);
+  deps.out("");
+  deps.out(HOST_KEY_CHAINED_COPY.body);
+  deps.out("");
+  deps.out(`  host: ${k.target}`);
+  deps.out("");
+  if (!own || !isOwnHost(k, own)) {
+    deps.out(HOST_KEY_CHAINED_COPY.notThisConnection);
+    return false;
+  }
+  if (!await deps.isAdmin()) {
+    deps.out(HOST_KEY_CHAINED_COPY.nonAdmin);
+    return false;
+  }
+  deps.out(HOST_KEY_CHAINED_COPY.help);
+  deps.out(`  ${HOST_KEY_CHAINED_COPY.command}`);
+  let fingerprint = null;
+  for (let attempt = 0; attempt < 3 && !fingerprint; attempt++) {
+    const answer = await deps.ask(CHAINED_PROMPT);
+    if (!answer) return false;
+    fingerprint = extractHostKeyFingerprint(answer);
+    if (!fingerprint) deps.out(HOST_KEY_CHAINED_COPY.invalid);
+  }
+  if (!fingerprint) return false;
+  try {
+    const r = await deps.confirm(connId, fingerprint);
+    deps.out(`${r.created ? "trusted" : "already trusted"}: ${r.pinned.host}:${r.pinned.port}  ${r.pinned.key_type}  ${r.pinned.fingerprint}`);
+    deps.out(`connect with: kt ssh ${connId}`);
+    return true;
+  } catch (e) {
+    if (!(e instanceof ApiError)) throw e;
+    const code = e.body?.error;
+    const failure = hostKeyConfirmFailure(typeof code === "string" ? code : null);
+    if (failure === "forbidden") deps.out(HOST_KEY_CHAINED_COPY.nonAdmin);
+    else if (failure === "mismatch") deps.out(HOST_KEY_CHAINED_COPY.mismatch);
+    else if (failure === "expired") deps.out(`${HOST_KEY_CHAINED_COPY.expired} kt ssh ${connId}`);
+    else throw e;
+    return false;
+  }
+}
 
 // src/refusal.ts
 var REFUSALS = {
@@ -35293,7 +35532,7 @@ var REFUSALS = {
     action: "Run `kt conns` and pass an id from the first column to --jump."
   },
   // auth-guard.ts:109 (social-session gate) and :167 (adaptive), plus rotation.ts:159, jit.ts:226,
-  // fleet.ts:190, agents.ts:146, modules/ssh.ts:727 and :1201. The remedy is mechanical and worth
+  // fleet.ts:190, agents.ts:146, modules/ssh.ts:727 and :1222. The remedy is mechanical and worth
   // stating exactly, because it is not obvious that it can be satisfied anywhere but here: step-up
   // freshness is a per-USER Redis proof with a ~5 minute TTL (server/src/lib/step-up.ts:16), not a
   // claim baked into this CLI's token. Stepping up in the web app on the same account therefore
@@ -35403,7 +35642,7 @@ var REFUSALS = {
     why: "Promoting now would leave those hosts refusing every session, because they do not yet accept a certificate from the next CA.",
     action: "Install or verify each host listed by `kt broker-ca status`, or revoke its enrollment, then promote again."
   },
-  // authz.ts:69, connection-import.ts:116. Overage freeze after a downgrade — read stays, write stops.
+  // authz.ts:69, connection-import.ts:142. Overage freeze after a downgrade — read stays, write stops.
   vault_frozen: {
     title: "Vault is read-only",
     why: "This vault is frozen for writes because the plan's vault limit was exceeded after a downgrade.",
@@ -35493,7 +35732,7 @@ var REFUSALS = {
     why: "Kutrion does not display, copy, export or share this credential's value. It is still used to authenticate connections and integrations.",
     action: "Use the credential rather than reading it \u2014 `kt ssh <connId>` or `kt exec <connId> <command>` broker a session with it without the value passing through this terminal."
   },
-  // modules/ssh.ts:462, modules/rdp.ts:151.
+  // modules/ssh.ts:470, modules/rdp.ts:151.
   inject_only_requires_write: {
     title: "Write access required for a No-reveal credential",
     why: "Pointing a connection at a No-reveal credential needs write access to the vault holding it, because the person doing it decides where the credential gets presented.",
@@ -35625,15 +35864,15 @@ var REFUSALS = {
     action: "Ask whoever created it for a new one. `kt share <credId>` mints a fresh one-time link if the credential is yours."
   }
 };
-var str4 = (v) => typeof v === "string" && v.trim() ? v.trim() : null;
+var str6 = (v) => typeof v === "string" && v.trim() ? v.trim() : null;
 var asRecord = (body) => body && typeof body === "object" ? body : null;
 function serverText(body) {
   const b = asRecord(body);
   if (!b) return null;
-  return str4(b.hint) ?? str4(b.detail) ?? str4(b.remedy) ?? str4(b.message) ?? str4(b.reason);
+  return str6(b.hint) ?? str6(b.detail) ?? str6(b.remedy) ?? str6(b.message) ?? str6(b.reason);
 }
 function refusalCode(e) {
-  return str4(asRecord(e.body)?.error) ?? str4(e.message) ?? "unknown";
+  return str6(asRecord(e.body)?.error) ?? str6(e.message) ?? "unknown";
 }
 var CONTEXT_FIELDS = [
   "feature",
@@ -35758,7 +35997,7 @@ function jumpRefusalReport(frame, code, head, ctx, indent) {
   if (!jump) return null;
   const names = ctx.names ?? noNames;
   const lines = [code ? `${head} (${code})` : head, "", jumpRefusalSummary(jump, names, ctx.openedName)];
-  const message = str4(frame.error);
+  const message = str6(frame.error);
   if (jump.detail && jump.detail !== message) lines.push("", jump.detail);
   if (jump.allowedDestinations?.length) {
     lines.push("", jumpAllowedDestinationsLabel(jump, names), ...jump.allowedDestinations.map((a) => `${indent}${a}`));
@@ -35767,14 +36006,16 @@ function jumpRefusalReport(frame, code, head, ctx, indent) {
   return lines;
 }
 function wsRefusalLines(frame, indent = "  ", jumpCtx = {}) {
-  const code = str4(frame.code);
+  const code = str6(frame.code);
   const d = frame.detail ?? {};
-  const host2 = str4(d.host);
+  const host2 = str6(d.host);
   const port = typeof d.port === "number" ? d.port : null;
   const allowed = Array.isArray(d.allowed_destinations) ? d.allowed_destinations.filter((x) => typeof x === "string" && x.trim() !== "") : [];
   if (code === "host_key_unconfirmed") {
     const k = parseHostKeyUnconfirmed(frame.detail);
     if (k) return hostKeyUnconfirmedLines(k, jumpCtx.own, indent);
+    const chained = parseHostKeyChained(frame.detail);
+    if (chained) return hostKeyChainedLines(chained, jumpCtx.own, indent);
   }
   const family = refusalFamily(code);
   const dest = parseDestinationRefusal({ error: code, reason: d.reason, allowed_destinations: allowed }) ?? { credential: null, destination: "", allowedDestinations: allowed, detail: null, side: null, reason: null };
@@ -35790,20 +36031,20 @@ function wsRefusalLines(frame, indent = "  ", jumpCtx = {}) {
   const jump = jumpRefusalReport(frame, code, head, jumpCtx, indent);
   if (jump) return jump;
   const lines = [code && !ourFault ? `${head} (${code})` : head, ""];
-  lines.push(str4(frame.error) ?? "The server sent no explanation with this refusal.");
+  lines.push(str6(frame.error) ?? "The server sent no explanation with this refusal.");
   if (host2) lines.push("", `${indent}endpoint: ${port === null ? host2 : `${host2}:${port}`}`);
   if (allowed.length) {
     lines.push("", destinationRefusalAllowedLabel(dest));
     lines.push(...allowed.map((a) => `${indent}${a}`));
   }
-  const remedy = !isDest ? str4(d.remedy) : ourFault ? destinationRefusalAction(dest) : `${destinationRefusalAction(dest)} ${DESTINATION_REFUSAL_NOT_A_REMEDY} ${DESTINATION_REFUSAL_CLI_ROUTE}`;
+  const remedy = !isDest ? str6(d.remedy) : ourFault ? destinationRefusalAction(dest) : `${destinationRefusalAction(dest)} ${DESTINATION_REFUSAL_NOT_A_REMEDY} ${DESTINATION_REFUSAL_CLI_ROUTE}`;
   if (remedy) lines.push("", remedy);
   else if (!code) lines.push("", "The server sent no code and no remedy with this refusal.");
   return lines;
 }
 
 // src/shell.ts
-function runShell(base, token, connId, onExit, jumpCtx = {}, afterSession) {
+function runShell(base, token, connId, onExit, jumpCtx = {}, afterSession, onChainedHostKey) {
   const wsUrl = shellUrl(base, connId);
   const ws = new wrapper_default(wsUrl, { headers: { Authorization: `Bearer ${token}` }, agent: wsAgentFor(wsUrl) });
   const stdin = process.stdin;
@@ -35861,6 +36102,14 @@ function runShell(base, token, connId, onExit, jumpCtx = {}, afterSession) {
       const frame = parseWsRefusal(text2);
       if (frame) {
         refused = true;
+        const chained = frame.code === "host_key_unconfirmed" ? parseHostKeyChained(frame.detail) : null;
+        if (chained && onChainedHostKey && isTty) {
+          if (stdin.isTTY) stdin.setRawMode(false);
+          stdin.removeAllListeners("data");
+          void onChainedHostKey(chained).catch(() => {
+          }).then(() => cleanup(1));
+          return;
+        }
         process.stderr.write(`\r
 ${wsRefusalLines(frame, "  ", jumpCtx).join("\r\n")}\r
 `);
@@ -36459,16 +36708,16 @@ function rejectLiteralSecrets(node, path) {
   }
 }
 function execCommand(v, where) {
-  const command = str5(v, where);
+  const command = str7(v, where);
   rejectVaultReferenceInCommand(command, where);
   return command;
 }
-function str5(v, where) {
+function str7(v, where) {
   if (typeof v !== "string" || v.trim() === "") throw new JobFileError(`${where} must be a non-empty string`);
   return v;
 }
 function connectionAlias(v, where, declared) {
-  const alias = str5(v, where);
+  const alias = str7(v, where);
   if (!(alias in declared)) throw new JobFileError(`${where}: undeclared connection "${alias}"`);
   return alias;
 }
@@ -36485,10 +36734,10 @@ function parseExpectations(raw, where) {
       case "stdout_contains":
       case "stderr_contains":
       case "stdout_not_contains":
-        out[k] = str5(v, `${where}.${k}`);
+        out[k] = str7(v, `${where}.${k}`);
         break;
       case "stdout_matches": {
-        const pattern = str5(v, `${where}.stdout_matches`);
+        const pattern = str7(v, `${where}.stdout_matches`);
         try {
           new RegExp(pattern);
         } catch {
@@ -36505,7 +36754,7 @@ function parseExpectations(raw, where) {
 }
 function parseSyncSide(raw, where, declared) {
   if (!isRecord(raw)) throw new JobFileError(`${where} must be a mapping with connection and path`);
-  return { connection: connectionAlias(raw.connection, `${where}.connection`, declared), path: str5(raw.path, `${where}.path`) };
+  return { connection: connectionAlias(raw.connection, `${where}.connection`, declared), path: str7(raw.path, `${where}.path`) };
 }
 function parseStep(raw, index, declared) {
   const where = `steps[${index}]`;
@@ -36543,16 +36792,16 @@ function parseStep(raw, index, declared) {
         ...common,
         action,
         connection: connectionAlias(body.connection, `${where}.get.connection`, declared),
-        remote: str5(body.remote, `${where}.get.remote`),
-        local: str5(body.local, `${where}.get.local`)
+        remote: str7(body.remote, `${where}.get.remote`),
+        local: str7(body.local, `${where}.get.local`)
       };
     case "put":
       return {
         ...common,
         action,
         connection: connectionAlias(body.connection, `${where}.put.connection`, declared),
-        local: str5(body.local, `${where}.put.local`),
-        remote: str5(body.remote, `${where}.put.remote`)
+        local: str7(body.local, `${where}.put.local`),
+        remote: str7(body.remote, `${where}.put.remote`)
       };
     case "sync":
       return {
@@ -36579,7 +36828,7 @@ function parseJobFile(source) {
   if (doc.connections !== void 0 && doc.connections !== null) {
     if (!isRecord(doc.connections)) throw new JobFileError("connections must be a mapping of alias to connection name or id");
     for (const [alias, target] of Object.entries(doc.connections)) {
-      connections[alias] = str5(target, `connections.${alias}`);
+      connections[alias] = str7(target, `connections.${alias}`);
     }
   }
   if (!Array.isArray(doc.steps) || doc.steps.length === 0) {
@@ -37899,13 +38148,13 @@ var ROLES = ["OWNER", "ADMIN", "EDITOR", "VIEWER"];
 var TOKEN_SCOPES = ["scim", "events"];
 var ORG_ROLES = ["owner", "admin", "member"];
 var ROTATION_SERVICES = ["linux_password", "postgres_password", "mysql_password"];
-var VERSION = true ? "1.2.9" : "dev";
+var VERSION = true ? "1.2.11" : "dev";
 var HELP = `kt \u2014 Kutrion CLI
   kt login [--email <e>] [--password-stdin] [--code <2fa>]   prompts for the password, or reads it from stdin;
                                                at a terminal with no --email, first asks the Kutrion desktop app,
-                                               then signs in through your web browser if that app is not running;
+                                               then falls back to your email and password;
                                                at the emailed-code prompt, a blank entry or r sends a new code
-  kt login --browser                           sign in with Kutrion: approve this CLI in your web browser
+  kt login --browser                           not available; exits with an error
   kt whoami
   kt logout
 
@@ -38107,7 +38356,7 @@ var HELP = `kt \u2014 Kutrion CLI
   kt integrations [catalog]                    alert/SIEM integrations (or the event catalog)
   kt integration test <id>                     send a test delivery
   kt hcv [sync <connId>]                        HashiCorp Vault connections (or sync one)
-  kt compliance [report]                        SOC2 controls (or an evidence report)
+  kt compliance [report]                        control mapping to SOC 2 and PCI-DSS (or a printable report)
   kt analytics                                 usage overview
   kt emergency                                 emergency-access contacts
 
@@ -38424,66 +38673,29 @@ run \`kt --help\` for the flags each command takes`);
       const fromStdin = flags["password-stdin"] === true;
       if (fromStdin && typeof flags.email !== "string") die("--password-stdin needs --email, because stdin carries the password");
       const accountRoot = appDataDir();
-      const viaBrowser = flags.browser === true;
-      if (viaBrowser && (flags.email !== void 0 || fromStdin || flags.code !== void 0)) {
-        die("--browser signs in through the web browser; it cannot be combined with --email, --password-stdin or --code");
-      }
-      if (viaBrowser && !process.stdin.isTTY) {
-        console.error("kt login --browser needs an interactive terminal to confirm the account. In a script, use `kt login --email <email> --password-stdin`.");
+      if (flags.browser === true) {
+        console.error("kt login --browser is not available: browser sign-in is switched off. Sign in with the Kutrion app (`kt login`), or use `kt login --email <email> --password-stdin`.");
         process.exit(EXIT_ERROR);
       }
-      const browserSignIn = async () => {
-        const hint = otherAppsHint(accountRoot);
-        if (hint) console.error(hint);
-        const r = await browserLogin({
+      if (process.stdin.isTTY && flags.email === void 0 && !fromStdin && flags.code === void 0 && accountRoot) {
+        const hub = await hubLogin({
           base: cfg.base,
+          location: hubLocation(accountRoot),
           kc,
           keychainAvailable: osKeychainAvailable,
           call: hubCall,
-          post: postJson(cfg.base, refuseBodyRedirects()),
-          open: openInBrowser,
           out: (l) => console.error(l),
-          ask: (q) => promptLine(q),
-          deviceName: () => (0, import_os5.hostname)() || "Kutrion CLI",
-          allowLoopbackHttp: isLoopback(u.hostname)
+          ask: (q) => promptLine(q)
         });
-        if (r.kind === "store_failed") die(r.note);
-        if (r.kind === "failed") {
-          console.error(r.note);
-          if (viaBrowser) process.exit(EXIT_ERROR);
-          return false;
-        }
-        recordSignIn(accountRoot, r.user);
-        console.log(`logged in with Kutrion as ${printable(r.user.email)} (token stored in ${backendName()})`);
-        if (rememberBase(cfg.base)) console.log(`server saved: ${cfg.base} (later commands need no --base)`);
-        return true;
-      };
-      if (viaBrowser) {
-        if (await browserSignIn()) break;
-      }
-      if (process.stdin.isTTY && flags.email === void 0 && !fromStdin && flags.code === void 0) {
-        if (!accountRoot) {
-          if (await browserSignIn()) break;
-        } else {
-          const hub = await hubLogin({
-            base: cfg.base,
-            location: hubLocation(accountRoot),
-            kc,
-            keychainAvailable: osKeychainAvailable,
-            call: hubCall,
-            out: (l) => console.error(l),
-            ask: (q) => promptLine(q)
-          });
-          if (hub.kind === "store_failed") die(hub.note);
-          if (hub.kind === "signed_in") {
-            recordSignIn(accountRoot, hub.user);
-            console.log(`logged in with the Kutrion app${hub.user ? ` as ${printable(hub.user.email)}` : ""} (token stored in ${backendName()})`);
-            if (rememberBase(cfg.base)) console.log(`server saved: ${cfg.base} (later commands need no --base)`);
-            break;
-          }
-          if (hub.note) console.error(hub.note);
-          if (hubAbsent(hub.reason) && await browserSignIn()) break;
+        if (hub.kind === "store_failed") die(hub.note);
+        if (hub.kind === "signed_in") {
+          recordSignIn(accountRoot, hub.user);
+          console.log(`logged in with the Kutrion app${hub.user ? ` as ${printable(hub.user.email)}` : ""} (token stored in ${backendName()})`);
+          if (rememberBase(cfg.base)) console.log(`server saved: ${cfg.base} (later commands need no --base)`);
+          break;
         }
+        if (hub.note) console.error(hub.note);
+        if (hubAbsent(hub.reason)) console.error("Installing the Kutrion app... Run `kt login` again once it is open, or sign in with your email and password below.");
       }
       if (flags.email === void 0 && !fromStdin) {
         const hint = otherAppsHint(accountRoot);
@@ -38714,7 +38926,16 @@ run \`kt --help\` for the flags each command takes`);
         break;
       }
       if (!positionals[0]) return die("usage: kt ssh <connId>");
-      runShell(cfg.base, token, positionals[0], void 0, await connectionContext(positionals[0]));
+      const sshCtx = await connectionContext(positionals[0]);
+      const sshId = positionals[0];
+      runShell(cfg.base, token, sshId, void 0, sshCtx, void 0, async (k) => {
+        await confirmChainedHostKey({
+          isAdmin: () => client.me().then((r) => r.user.org_role === "owner" || r.user.org_role === "admin", () => false),
+          ask: (q) => promptLine(q),
+          confirm: (id, fp) => withStepUp(client, () => client.confirmSshHostKey(id, fp)),
+          out: (l) => console.error(l)
+        }, sshId, k, sshCtx.own);
+      });
       return;
     }
     case "exec": {
@@ -38722,8 +38943,10 @@ run \`kt --help\` for the flags each command takes`);
       if (!positionals[0] || !positionals[1]) return die("usage: kt exec <connId> <command...>");
       const r = await client.exec(positionals[0], positionals.slice(1).join(" ")).catch(async (e) => {
         const k = hostKeyUnconfirmedFromError(e);
-        if (!k) throw e;
-        for (const line of hostKeyUnconfirmedLines(k, (await connectionContext(positionals[0])).own)) console.error(line);
+        const chained = k ? null : hostKeyChainedFromError(e);
+        if (!k && !chained) throw e;
+        const own = (await connectionContext(positionals[0])).own;
+        for (const line of k ? hostKeyUnconfirmedLines(k, own) : hostKeyChainedLines(chained, own)) console.error(line);
         return process.exit(1);
       });
       if (asJson) console.log(JSON.stringify(r, null, 2));
@@ -38811,8 +39034,10 @@ run \`kt --help\` for the flags each command takes`);
         }
       } catch (e) {
         const k = hostKeyUnconfirmedFromError(e);
-        if (!k) throw e;
-        for (const line of hostKeyUnconfirmedLines(k, (await connectionContext(connId)).own)) console.error(line);
+        const chained = k ? null : hostKeyChainedFromError(e);
+        if (!k && !chained) throw e;
+        const own = (await connectionContext(connId)).own;
+        for (const line of k ? hostKeyUnconfirmedLines(k, own) : hostKeyChainedLines(chained, own)) console.error(line);
         process.exit(1);
       }
       break;
@@ -39628,14 +39853,19 @@ Re-run with --fill to type a username and password for each, or create them with
         }
         let imported = 0, updated = 0;
         const skipped = [];
+        const needsBinding = [];
+        const boundByCred = /* @__PURE__ */ new Map();
         for (let i = 0; i < ready.length; i += 200) {
           const r = await client.commitConnImport(vaultId, ready.slice(i, i + 200));
           imported += r.imported;
           updated += r.updated;
           skipped.push(...r.skipped);
+          needsBinding.push(...r.needs_binding ?? []);
+          for (const b of r.bound_destinations ?? []) boundByCred.set(b.credential_id, b);
         }
+        const bound = [...boundByCred.values()];
         if (asJson) {
-          show({ provider: parsed.provider, imported, updated, skipped, held_back: blocked.length });
+          show({ provider: parsed.provider, imported, updated, skipped, held_back: blocked.length, needs_binding: needsBinding, bound_destinations: bound });
           break;
         }
         console.log(`imported ${imported} from ${parsed.provider}${updated ? `, updated ${updated}` : ""}`);
@@ -39644,6 +39874,15 @@ Re-run with --fill to type a username and password for each, or create them with
         for (const [reason, names] of byReason) {
           console.log(`skipped ${names.length} \u2014 ${CONN_SKIP_REASON[reason] ?? reason}: ${names.join(", ")}`);
         }
+        for (const b of bound) {
+          console.log(CONN_IMPORT_BINDING_COPY.bound(b.credential, b.destinations.length));
+          for (const d of b.destinations) console.log(`  ${connImportDestLabel(d)}`);
+        }
+        if (needsBinding.length) {
+          console.log(`${CONN_IMPORT_BINDING_COPY.needsHeading}: ${CONN_IMPORT_BINDING_COPY.needsIntro(needsBinding.length)}`);
+          for (const n of needsBinding) console.log(`  ${n.name} (${connImportDestLabel(n)})`);
+          console.log(CONN_IMPORT_BINDING_COPY.needsWhere);
+        }
       } else die("usage: kt conn add --name <n> --host <h> --username <u> --cred <credId> | kt conn set <connId> [--name --host --port --username --cred] | kt conn rm <connId> | kt conn providers | kt conn import <vaultId> <file>");
       break;
     }