scp-next 1.0.20 → 1.1.3

package/dist/cli/index.js

@@ -1,1323 +1,1665 @@
 #!/usr/bin/env node
+import { constants, realpathSync, readFileSync } from 'node:fs';
+import path, { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Option, Command, CommanderError } from 'commander';
+import { stat, access, mkdir, readFile, readdir } from 'node:fs/promises';
+import SftpClient from 'ssh2-sftp-client';
+import { createHash } from 'node:crypto';
+import os from 'node:os';
+import { Client } from 'ssh2';
+import { z } from 'zod';
+import { assignDefined, formatByteSize } from 'mazey';
 
-// src/cli/index.ts
-import { readFileSync, realpathSync } from "fs";
-import { dirname, resolve } from "path";
-import { fileURLToPath } from "url";
-import { Command as Command4, CommanderError } from "commander";
-
-// src/client/client.ts
-import { access as access4, mkdir as mkdir2, stat as stat3 } from "fs/promises";
-import path4 from "path";
-
-// src/client/transport.ts
-import { readFile as readFile2 } from "fs/promises";
-import SftpClient from "ssh2-sftp-client";
-
-// src/security/redact.ts
-var SENSITIVE_KEYS = [
-  "password",
-  "passphrase",
-  "privatekey",
-  "privatekeyfile",
-  "token",
-  "authorization",
-  "credential",
-  "secret"
+const SENSITIVE_KEYS = [
+    "password",
+    "passphrase",
+    "privatekey",
+    "privatekeyfile",
+    "token",
+    "authorization",
+    "credential",
+    "secret"
 ];
-var PRIVATE_KEY_PATTERN = /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g;
+const PRIVATE_KEY_PATTERN = /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g;
+const SECRET_OPTION_PATTERN = /(--(?:password|passphrase|token|secret|authorization|credential)(?:=|\s+))(?:"[^"]*"|'[^']*'|\S+)/gi;
+const SECRET_ASSIGNMENT_PATTERN = /(\b(?:password|passphrase|token|secret|authorization|credential)[A-Z0-9_-]*\s*=\s*)(?:"[^"]*"|'[^']*'|[^\s&]+)/gi;
 function isSensitiveKey(key) {
-  const normalized = key.replace(/[-_\s]/g, "").toLowerCase();
-  return SENSITIVE_KEYS.some((sensitive) => normalized.includes(sensitive));
+    const normalized = key.replace(/[-_\s]/g, "").toLowerCase();
+    return SENSITIVE_KEYS.some((sensitive) => normalized.includes(sensitive));
 }
 function redactSensitiveValues(value) {
-  if (typeof value === "string") {
-    return value.replace(PRIVATE_KEY_PATTERN, "[REDACTED]");
-  }
-  if (Array.isArray(value)) {
-    const redacted = value.map((item) => redactSensitiveValues(item));
-    return redacted;
-  }
-  if (value && typeof value === "object") {
-    const redacted = {};
-    for (const [key, nestedValue] of Object.entries(value)) {
-      redacted[key] = isSensitiveKey(key) ? "[REDACTED]" : redactSensitiveValues(nestedValue);
-    }
-    return redacted;
-  }
-  return value;
+    if (typeof value === "string") {
+        return value.replace(PRIVATE_KEY_PATTERN, "[REDACTED]");
+    }
+    if (Array.isArray(value)) {
+        const redacted = value.map((item) => redactSensitiveValues(item));
+        return redacted;
+    }
+    if (value && typeof value === "object") {
+        const redacted = {};
+        for (const [key, nestedValue] of Object.entries(value)) {
+            redacted[key] = isSensitiveKey(key) ? "[REDACTED]" : redactSensitiveValues(nestedValue);
+        }
+        return redacted;
+    }
+    return value;
 }
 function formatErrorMessage(error) {
-  if (error instanceof Error) {
-    return String(redactSensitiveValues(error.message));
-  }
-  return String(redactSensitiveValues(error));
+    if (error instanceof Error) {
+        return redactKnownSensitiveValues(error.message, {});
+    }
+    return redactKnownSensitiveValues(String(error), {});
+}
+function redactKnownSensitiveValues(text, source) {
+    const sensitiveValues = collectSensitiveValues(source);
+    const redactedKnownValues = sensitiveValues.reduce((redacted, value) => redacted.split(value).join("[REDACTED]"), String(redactSensitiveValues(text)));
+    return redactedKnownValues
+        .replace(SECRET_OPTION_PATTERN, "$1[REDACTED]")
+        .replace(SECRET_ASSIGNMENT_PATTERN, "$1[REDACTED]");
+}
+function collectSensitiveValues(value, key = "") {
+    if (isSensitiveKey(key)) {
+        if (typeof value === "string" && value) {
+            return [value];
+        }
+        if (Buffer.isBuffer(value) && value.length > 0) {
+            return [value.toString("utf8")];
+        }
+        return [];
+    }
+    if (!value || typeof value !== "object") {
+        return [];
+    }
+    return Object.entries(value).flatMap(([nestedKey, nestedValue]) => collectSensitiveValues(nestedValue, nestedKey));
 }
 
-// src/errors/index.ts
-var ScpNextError = class extends Error {
-  code;
-  context;
-  constructor(message, options = {}) {
-    super(message, { cause: options.cause });
-    this.name = new.target.name;
-    this.code = options.code ?? "SCP_NEXT_ERROR";
-    this.context = redactSensitiveValues(options.context ?? {});
-  }
-};
-var ConfigurationError = class extends ScpNextError {
-  constructor(message, options = {}) {
-    super(message, { ...options, code: "SCP_NEXT_CONFIGURATION_ERROR" });
-  }
-};
-var ValidationError = class extends ScpNextError {
-  constructor(message, options = {}) {
-    super(message, { ...options, code: "SCP_NEXT_VALIDATION_ERROR" });
-  }
-};
-var AuthenticationError = class extends ScpNextError {
-  constructor(message, options = {}) {
-    super(message, { ...options, code: "SCP_NEXT_AUTHENTICATION_ERROR" });
-  }
-};
-var ConnectionError = class extends ScpNextError {
-  constructor(message, options = {}) {
-    super(message, { ...options, code: "SCP_NEXT_CONNECTION_ERROR" });
-  }
-};
-var TransferError = class extends ScpNextError {
-  constructor(message, options = {}) {
-    super(message, { ...options, code: "SCP_NEXT_TRANSFER_ERROR" });
-  }
-};
-var FileSystemError = class extends ScpNextError {
-  constructor(message, options = {}) {
-    super(message, { ...options, code: "SCP_NEXT_FILESYSTEM_ERROR" });
-  }
-};
-var HostVerificationError = class extends ScpNextError {
-  constructor(message, options = {}) {
-    super(message, { ...options, code: "SCP_NEXT_HOST_VERIFICATION_ERROR" });
-  }
-};
+class ScpNextError extends Error {
+    code;
+    context;
+    constructor(message, options = {}) {
+        super(message, { cause: options.cause });
+        this.name = new.target.name;
+        this.code = options.code ?? "SCP_NEXT_ERROR";
+        this.context = redactSensitiveValues(options.context ?? {});
+    }
+}
+class ConfigurationError extends ScpNextError {
+    constructor(message, options = {}) {
+        super(message, { ...options, code: "SCP_NEXT_CONFIGURATION_ERROR" });
+    }
+}
+class ValidationError extends ScpNextError {
+    constructor(message, options = {}) {
+        super(message, { ...options, code: "SCP_NEXT_VALIDATION_ERROR" });
+    }
+}
+class AuthenticationError extends ScpNextError {
+    constructor(message, options = {}) {
+        super(message, { ...options, code: "SCP_NEXT_AUTHENTICATION_ERROR" });
+    }
+}
+class ConnectionError extends ScpNextError {
+    constructor(message, options = {}) {
+        super(message, { ...options, code: "SCP_NEXT_CONNECTION_ERROR" });
+    }
+}
+class TransferError extends ScpNextError {
+    constructor(message, options = {}) {
+        super(message, { ...options, code: "SCP_NEXT_TRANSFER_ERROR" });
+    }
+}
+class RemoteCommandError extends ScpNextError {
+    exitCode;
+    signal;
+    stdout;
+    stderr;
+    constructor(message, options) {
+        super(message, {
+            code: "SCP_NEXT_REMOTE_COMMAND_ERROR",
+            ...(options.cause !== undefined ? { cause: options.cause } : {}),
+            ...(options.context !== undefined ? { context: options.context } : {})
+        });
+        this.exitCode = options.exitCode;
+        this.signal = options.signal;
+        this.stdout = options.stdout ?? "";
+        this.stderr = options.stderr ?? "";
+    }
+}
+class FileSystemError extends ScpNextError {
+    constructor(message, options = {}) {
+        super(message, { ...options, code: "SCP_NEXT_FILESYSTEM_ERROR" });
+    }
+}
+class HostVerificationError extends ScpNextError {
+    constructor(message, options = {}) {
+        super(message, { ...options, code: "SCP_NEXT_HOST_VERIFICATION_ERROR" });
+    }
+}
 function toScpNextError(error) {
-  if (error instanceof ScpNextError) {
-    return error;
-  }
-  const message = error instanceof Error ? error.message : "Unexpected scp-next error.";
-  const lowerMessage = message.toLowerCase();
-  if (lowerMessage.includes("authentication") || lowerMessage.includes("permission denied")) {
-    return new AuthenticationError("SSH authentication failed.", { cause: error });
-  }
-  if (lowerMessage.includes("host verification") || lowerMessage.includes("host key") || lowerMessage.includes("fingerprint") || lowerMessage.includes("host") && lowerMessage.includes("denied")) {
-    return new HostVerificationError("SSH host verification failed.", { cause: error });
-  }
-  if (lowerMessage.includes("timed out") || lowerMessage.includes("connection") || lowerMessage.includes("econn")) {
-    return new ConnectionError("SSH connection failed.", { cause: error });
-  }
-  return new TransferError(String(redactSensitiveValues(message)), { cause: error });
+    if (error instanceof ScpNextError) {
+        return error;
+    }
+    const message = error instanceof Error ? error.message : "Unexpected scp-next error.";
+    const lowerMessage = message.toLowerCase();
+    if (lowerMessage.includes("authentication") || lowerMessage.includes("permission denied")) {
+        return new AuthenticationError("SSH authentication failed.", { cause: error });
+    }
+    if (lowerMessage.includes("host verification") ||
+        lowerMessage.includes("host key") ||
+        lowerMessage.includes("fingerprint") ||
+        (lowerMessage.includes("host") && lowerMessage.includes("denied"))) {
+        return new HostVerificationError("SSH host verification failed.", { cause: error });
+    }
+    if (lowerMessage.includes("timed out") ||
+        lowerMessage.includes("connection") ||
+        lowerMessage.includes("econn")) {
+        return new ConnectionError("SSH connection failed.", { cause: error });
+    }
+    return new TransferError(String(redactSensitiveValues(message)), { cause: error });
 }
 
-// src/security/host-verification.ts
-import { createHash } from "crypto";
-import { access as access2, readFile } from "fs/promises";
-
-// src/paths/local-path.ts
-import { constants } from "fs";
-import { access, mkdir, stat } from "fs/promises";
-import os from "os";
-import path from "path";
 function expandHome(inputPath) {
-  if (inputPath === "~") {
-    return os.homedir();
-  }
-  if (inputPath.startsWith(`~${path.sep}`) || inputPath.startsWith("~/")) {
-    return path.join(os.homedir(), inputPath.slice(2));
-  }
-  return inputPath;
+    if (inputPath === "~") {
+        return os.homedir();
+    }
+    if (inputPath.startsWith(`~${path.sep}`) || inputPath.startsWith("~/")) {
+        return path.join(os.homedir(), inputPath.slice(2));
+    }
+    return inputPath;
 }
 function resolveLocalPath(inputPath, baseDir = process.cwd()) {
-  const expanded = expandHome(inputPath);
-  return path.isAbsolute(expanded) ? path.normalize(expanded) : path.resolve(baseDir, expanded);
+    const expanded = expandHome(inputPath);
+    return path.isAbsolute(expanded) ? path.normalize(expanded) : path.resolve(baseDir, expanded);
 }
 async function assertLocalPathExists(inputPath) {
-  try {
-    await access(resolveLocalPath(inputPath), constants.F_OK);
-  } catch (error) {
-    throw new FileSystemError(`Local path does not exist: ${inputPath}`, {
-      cause: error,
-      context: { path: inputPath }
-    });
-  }
+    try {
+        await access(resolveLocalPath(inputPath), constants.F_OK);
+    }
+    catch (error) {
+        throw new FileSystemError(`Local path does not exist: ${inputPath}`, {
+            cause: error,
+            context: { path: inputPath }
+        });
+    }
 }
 async function assertDownloadDestination(inputPath, createDirectories = false) {
-  const resolved = resolveLocalPath(inputPath);
-  const parent = path.dirname(resolved);
-  if (createDirectories) {
-    await mkdir(parent, { recursive: true });
-    return;
-  }
-  try {
-    await access(parent, constants.W_OK);
-  } catch (error) {
-    throw new FileSystemError(`Local destination parent does not exist or is not writable: ${parent}`, {
-      cause: error,
-      context: { path: inputPath }
-    });
-  }
+    const resolved = resolveLocalPath(inputPath);
+    const parent = path.dirname(resolved);
+    if (createDirectories) {
+        await mkdir(parent, { recursive: true });
+        return;
+    }
+    try {
+        await access(parent, constants.W_OK);
+    }
+    catch (error) {
+        throw new FileSystemError(`Local destination parent does not exist or is not writable: ${parent}`, {
+            cause: error,
+            context: { path: inputPath }
+        });
+    }
 }
 async function getLocalPathKind(inputPath) {
-  const stats = await stat(resolveLocalPath(inputPath));
-  if (stats.isDirectory()) {
-    return "directory";
-  }
-  if (stats.isFile()) {
-    return "file";
-  }
-  throw new ValidationError(`Local path must be a file or directory: ${inputPath}`, {
-    context: { path: inputPath }
-  });
+    const stats = await stat(resolveLocalPath(inputPath));
+    if (stats.isDirectory()) {
+        return "directory";
+    }
+    if (stats.isFile()) {
+        return "file";
+    }
+    throw new ValidationError(`Local path must be a file or directory: ${inputPath}`, {
+        context: { path: inputPath }
+    });
 }
 
-// src/security/host-verification.ts
 function normalizeFingerprint(fingerprint) {
-  return fingerprint.trim().replace(/^SHA256:/i, "").replace(/^sha256:/i, "").replace(/=+$/g, "");
+    return fingerprint
+        .trim()
+        .replace(/^SHA256:/i, "")
+        .replace(/^sha256:/i, "")
+        .replace(/=+$/g, "");
 }
 function isHexFingerprint(fingerprint) {
-  return /^[0-9a-f]+$/i.test(fingerprint);
+    return /^[0-9a-f]+$/i.test(fingerprint);
 }
 function fingerprintCandidates(fingerprint) {
-  const normalized = normalizeFingerprint(fingerprint);
-  const candidates = /* @__PURE__ */ new Set([normalized]);
-  if (isHexFingerprint(normalized)) {
-    candidates.add(normalized.toLowerCase());
-  } else {
-    try {
-      candidates.add(Buffer.from(normalized, "base64").toString("hex"));
-    } catch {
+    const normalized = normalizeFingerprint(fingerprint);
+    const candidates = new Set([normalized]);
+    if (isHexFingerprint(normalized)) {
+        candidates.add(normalized.toLowerCase());
+    }
+    else {
+        try {
+            candidates.add(Buffer.from(normalized, "base64").toString("hex"));
+        }
+        catch {
+            // Keep the original normalized value when it is not valid base64.
+        }
     }
-  }
-  return [...candidates];
+    return [...candidates];
 }
 function isFingerprintMatch(actual, expected) {
-  const normalizedActual = normalizeFingerprint(actual);
-  const normalizedExpected = normalizeFingerprint(expected);
-  if (normalizedActual === normalizedExpected) {
-    return true;
-  }
-  return isHexFingerprint(normalizedActual) && isHexFingerprint(normalizedExpected) && normalizedActual.toLowerCase() === normalizedExpected.toLowerCase();
+    const normalizedActual = normalizeFingerprint(actual);
+    const normalizedExpected = normalizeFingerprint(expected);
+    if (normalizedActual === normalizedExpected) {
+        return true;
+    }
+    return (isHexFingerprint(normalizedActual) &&
+        isHexFingerprint(normalizedExpected) &&
+        normalizedActual.toLowerCase() === normalizedExpected.toLowerCase());
 }
 function hostVerificationHint(host) {
-  return [
-    "",
-    "Typical fix:",
-    `  ssh ${host}`,
-    "",
-    "If you trust the host key, accept it and retry the scp-next command.",
-    "Alternatively configure hostFingerprint or knownHostsFile explicitly."
-  ].join("\n");
+    return [
+        "",
+        "Typical fix:",
+        `  ssh ${host}`,
+        "",
+        "If you trust the host key, accept it and retry the scp-next command.",
+        "Alternatively configure hostFingerprint or knownHostsFile explicitly."
+    ].join("\n");
 }
 async function resolveAllowedFingerprints(options) {
-  const fingerprints = /* @__PURE__ */ new Set();
-  const knownHostsFile = options.knownHostsFile ?? "~/.ssh/known_hosts";
-  if (!options.host) {
-    throw new HostVerificationError("A host is required for SSH host verification.");
-  }
-  if (options.hostFingerprint) {
-    for (const fingerprint of fingerprintCandidates(options.hostFingerprint)) {
-      fingerprints.add(fingerprint);
-    }
-  }
-  try {
-    await access2(expandHome(knownHostsFile));
-    const content = await readFile(expandHome(knownHostsFile), "utf8");
-    for (const line of content.split(/\r?\n/)) {
-      const trimmed = line.trim();
-      if (!trimmed || trimmed.startsWith("#") || trimmed.startsWith("@")) {
-        continue;
-      }
-      const [hosts, algorithm, key] = trimmed.split(/\s+/);
-      const hostPatterns = hosts?.split(",") ?? [];
-      const portHost = options.port ? `[${options.host}]:${options.port}` : void 0;
-      const matchesHost = hostPatterns.includes(options.host) || Boolean(portHost && hostPatterns.includes(portHost));
-      if (!hosts || !algorithm || !key || !matchesHost) {
-        continue;
-      }
-      const keyBuffer = Buffer.from(key, "base64");
-      fingerprints.add(createHash("sha256").update(keyBuffer).digest("base64").replace(/=+$/g, ""));
-      fingerprints.add(createHash("sha256").update(keyBuffer).digest("hex"));
-    }
-  } catch (error) {
-    if (options.knownHostsFile || !options.hostFingerprint) {
-      throw new HostVerificationError(
-        "SSH host verification requires hostFingerprint or an accessible knownHostsFile.",
-        { cause: error, context: { knownHostsFile } }
-      );
-    }
-  }
-  if (fingerprints.size === 0) {
-    throw new HostVerificationError(
-      `SSH host verification failed before connecting: no matching host fingerprint was configured.${hostVerificationHint(
-        options.host
-      )}`
-    );
-  }
-  return fingerprints;
+    const fingerprints = new Set();
+    const knownHostsFile = options.knownHostsFile ?? "~/.ssh/known_hosts";
+    if (!options.host) {
+        throw new HostVerificationError("A host is required for SSH host verification.");
+    }
+    if (options.hostFingerprint) {
+        for (const fingerprint of fingerprintCandidates(options.hostFingerprint)) {
+            fingerprints.add(fingerprint);
+        }
+    }
+    try {
+        await access(expandHome(knownHostsFile));
+        const content = await readFile(expandHome(knownHostsFile), "utf8");
+        for (const line of content.split(/\r?\n/)) {
+            const trimmed = line.trim();
+            if (!trimmed || trimmed.startsWith("#") || trimmed.startsWith("@")) {
+                continue;
+            }
+            const [hosts, algorithm, key] = trimmed.split(/\s+/);
+            const hostPatterns = hosts?.split(",") ?? [];
+            const portHost = options.port ? `[${options.host}]:${options.port}` : undefined;
+            const matchesHost = hostPatterns.includes(options.host) || Boolean(portHost && hostPatterns.includes(portHost));
+            if (!hosts || !algorithm || !key || !matchesHost) {
+                continue;
+            }
+            const keyBuffer = Buffer.from(key, "base64");
+            fingerprints.add(createHash("sha256").update(keyBuffer).digest("base64").replace(/=+$/g, ""));
+            fingerprints.add(createHash("sha256").update(keyBuffer).digest("hex"));
+        }
+    }
+    catch (error) {
+        if (options.knownHostsFile || !options.hostFingerprint) {
+            throw new HostVerificationError("SSH host verification requires hostFingerprint or an accessible knownHostsFile.", { cause: error, context: { knownHostsFile } });
+        }
+    }
+    if (fingerprints.size === 0) {
+        throw new HostVerificationError(`SSH host verification failed before connecting: no matching host fingerprint was configured.${hostVerificationHint(options.host)}`);
+    }
+    return fingerprints;
 }
 function createHostVerifier(allowedFingerprints) {
-  return (hashedKey) => {
-    for (const expected of allowedFingerprints) {
-      if (isFingerprintMatch(hashedKey, expected)) {
-        return true;
-      }
-    }
-    return false;
-  };
+    return (hashedKey) => {
+        for (const expected of allowedFingerprints) {
+            if (isFingerprintMatch(hashedKey, expected)) {
+                return true;
+            }
+        }
+        return false;
+    };
 }
 
-// src/client/transport.ts
-function toRemoteFileInfo(info) {
-  return {
-    type: info.type,
-    name: info.name,
-    size: info.size
-  };
-}
-var Ssh2SftpTransport = class {
-  client;
-  constructor(name = "scp-next") {
-    this.client = new SftpClient(name, {
-      error: () => void 0,
-      end: () => void 0,
-      close: () => void 0
-    });
-  }
-  async connect(options) {
-    const allowedFingerprints = await resolveAllowedFingerprints(options);
-    const hostVerifier = createHostVerifier(allowedFingerprints);
+async function createSshConnectOptions(options) {
     const connectOptions = {};
-    if (options.host !== void 0) connectOptions.host = options.host;
-    if (options.port !== void 0) connectOptions.port = options.port;
-    if (options.username !== void 0) connectOptions.username = options.username;
-    if (options.password !== void 0) connectOptions.password = options.password;
-    if (options.privateKey !== void 0) {
-      connectOptions.privateKey = options.privateKey;
-    } else if (options.privateKeyFile) {
-      connectOptions.privateKey = await readFile2(expandHome(options.privateKeyFile), "utf8");
-    }
-    if (options.passphrase !== void 0) connectOptions.passphrase = options.passphrase;
-    const agent = options.agent ?? process.env.SSH_AUTH_SOCK;
-    if (agent !== void 0) {
-      connectOptions.agent = agent;
+    if (options.host !== undefined)
+        connectOptions.host = options.host;
+    if (options.port !== undefined)
+        connectOptions.port = options.port;
+    if (options.username !== undefined)
+        connectOptions.username = options.username;
+    if (options.password !== undefined)
+        connectOptions.password = options.password;
+    if (options.privateKey !== undefined) {
+        connectOptions.privateKey = options.privateKey;
     }
-    if (options.timeout !== void 0) connectOptions.readyTimeout = options.timeout;
-    if (hostVerifier) {
-      connectOptions.hostHash = "sha256";
-      connectOptions.hostVerifier = hostVerifier;
+    else if (options.privateKeyFile) {
+        connectOptions.privateKey = await readFile(expandHome(options.privateKeyFile), "utf8");
     }
-    try {
-      await this.client.connect(connectOptions);
-    } catch (error) {
-      const converted = toScpNextError(error);
-      if (converted instanceof HostVerificationError) {
-        throw new HostVerificationError(
-          `SSH host verification failed during connection: ${formatErrorMessage(
-            error
-          )}.${hostVerificationTroubleshooting(options.host)}`,
-          { cause: error, context: connectionContext(options) }
-        );
-      }
-      if (isLikelyHostVerificationFailure(error)) {
-        throw new HostVerificationError(
-          `SSH host verification failed during connection.${hostVerificationTroubleshooting(
-            options.host
-          )}`,
-          { cause: error, context: connectionContext(options) }
-        );
-      }
-      throw new ConnectionError(`Unable to connect to SSH server: ${formatErrorMessage(error)}`, {
-        cause: error,
-        context: connectionContext(options)
-      });
-    }
-  }
-  async close() {
-    await this.client.end();
-  }
-  async exists(remotePath) {
-    return this.client.exists(remotePath);
-  }
-  async mkdir(remotePath, recursive = true) {
-    await this.client.mkdir(remotePath, recursive);
-  }
-  async list(remotePath) {
-    const files = await this.client.list(remotePath);
-    return files.map(toRemoteFileInfo);
-  }
-  async uploadFile(localPath, remotePath, onStep) {
-    try {
-      await this.client.fastPut(localPath, remotePath, this.transferOptions(onStep));
-    } catch (error) {
-      throw new TransferError(`Upload failed for ${localPath}: ${formatErrorMessage(error)}`, {
-        cause: error,
-        context: { localPath, remotePath }
-      });
-    }
-  }
-  async downloadFile(remotePath, localPath, onStep) {
-    try {
-      await this.client.fastGet(remotePath, localPath, this.transferOptions(onStep));
-    } catch (error) {
-      throw new TransferError(`Download failed for ${remotePath}: ${formatErrorMessage(error)}`, {
-        cause: error,
-        context: { remotePath, localPath }
-      });
-    }
-  }
-  transferOptions(onStep) {
-    if (!onStep) {
-      return void 0;
+    if (options.passphrase !== undefined)
+        connectOptions.passphrase = options.passphrase;
+    const agent = options.agent ?? process.env.SSH_AUTH_SOCK;
+    if (agent !== undefined)
+        connectOptions.agent = agent;
+    if (options.timeout !== undefined)
+        connectOptions.readyTimeout = options.timeout;
+    const allowedFingerprints = await resolveAllowedFingerprints(options);
+    const hostVerifier = createHostVerifier(allowedFingerprints);
+    if (hostVerifier) {
+        connectOptions.hostHash = "sha256";
+        connectOptions.hostVerifier = hostVerifier;
     }
+    return connectOptions;
+}
+
+function toRemoteFileInfo(info) {
     return {
-      step(transferredBytes, chunkBytes, totalBytes) {
-        onStep({ transferredBytes, chunkBytes, totalBytes });
-      }
+        type: info.type,
+        name: info.name,
+        size: info.size
     };
-  }
-};
+}
+class Ssh2SftpTransport {
+    client;
+    constructor(name = "scp-next") {
+        this.client = new SftpClient(name, {
+            error: () => undefined,
+            end: () => undefined,
+            close: () => undefined
+        });
+    }
+    async connect(options) {
+        const connectOptions = await createSshConnectOptions(options);
+        try {
+            await this.client.connect(connectOptions);
+        }
+        catch (error) {
+            const converted = toScpNextError(error);
+            if (converted instanceof HostVerificationError) {
+                throw new HostVerificationError(`SSH host verification failed during connection: ${formatErrorMessage(error)}.${hostVerificationTroubleshooting(options.host)}`, { cause: error, context: connectionContext(options) });
+            }
+            if (isLikelyHostVerificationFailure(error)) {
+                throw new HostVerificationError(`SSH host verification failed during connection.${hostVerificationTroubleshooting(options.host)}`, { cause: error, context: connectionContext(options) });
+            }
+            throw new ConnectionError(`Unable to connect to SSH server: ${formatErrorMessage(error)}`, {
+                cause: error,
+                context: connectionContext(options)
+            });
+        }
+    }
+    async close() {
+        await this.client.end();
+    }
+    async exists(remotePath) {
+        return this.client.exists(remotePath);
+    }
+    async mkdir(remotePath, recursive = true) {
+        await this.client.mkdir(remotePath, recursive);
+    }
+    async list(remotePath) {
+        const files = await this.client.list(remotePath);
+        return files.map(toRemoteFileInfo);
+    }
+    async uploadFile(localPath, remotePath, onStep) {
+        try {
+            await this.client.fastPut(localPath, remotePath, this.transferOptions(onStep));
+        }
+        catch (error) {
+            throw new TransferError(`Upload failed for ${localPath}: ${formatErrorMessage(error)}`, {
+                cause: error,
+                context: { localPath, remotePath }
+            });
+        }
+    }
+    async downloadFile(remotePath, localPath, onStep) {
+        try {
+            await this.client.fastGet(remotePath, localPath, this.transferOptions(onStep));
+        }
+        catch (error) {
+            throw new TransferError(`Download failed for ${remotePath}: ${formatErrorMessage(error)}`, {
+                cause: error,
+                context: { remotePath, localPath }
+            });
+        }
+    }
+    transferOptions(onStep) {
+        if (!onStep) {
+            return undefined;
+        }
+        return {
+            step(transferredBytes, chunkBytes, totalBytes) {
+                onStep({ transferredBytes, chunkBytes, totalBytes });
+            }
+        };
+    }
+}
 function connectionContext(options) {
-  return {
-    host: options.host,
-    port: options.port,
-    username: options.username
-  };
+    return {
+        host: options.host,
+        port: options.port,
+        username: options.username
+    };
 }
 function isLikelyHostVerificationFailure(error) {
-  const message = error instanceof Error ? error.message.toLowerCase() : String(error).toLowerCase();
-  return message.includes("host") && (message.includes("verif") || message.includes("fingerprint") || message.includes("host key") || message.includes("key mismatch") || message.includes("denied"));
+    const message = error instanceof Error ? error.message.toLowerCase() : String(error).toLowerCase();
+    return (message.includes("host") &&
+        (message.includes("verif") ||
+            message.includes("fingerprint") ||
+            message.includes("host key") ||
+            message.includes("key mismatch") ||
+            message.includes("denied")));
 }
 function hostVerificationTroubleshooting(host) {
-  const displayHost = host ?? "<host>";
-  return [
-    "",
-    "",
-    "Typical fix:",
-    `  ssh ${displayHost}`,
-    "",
-    "If plain ssh works but scp-next fails, check that the host entry is available in",
-    "`~/.ssh/known_hosts` for the same host and port used by scp-next. For non-default ports,",
-    "OpenSSH usually stores entries as `[host]:port`.",
-    "You can also configure hostFingerprint or knownHostsFile explicitly."
-  ].join("\n");
+    const displayHost = host ?? "<host>";
+    return [
+        "",
+        "",
+        "Typical fix:",
+        `  ssh ${displayHost}`,
+        "",
+        "If plain ssh works but scp-next fails, check that the host entry is available in",
+        "`~/.ssh/known_hosts` for the same host and port used by scp-next. For non-default ports,",
+        "OpenSSH usually stores entries as `[host]:port`.",
+        "You can also configure hostFingerprint or knownHostsFile explicitly."
+    ].join("\n");
 }
 
-// src/client/walk.ts
-import { readdir, stat as stat2 } from "fs/promises";
-import path3 from "path";
+class SshCommandExecutor {
+    client;
+    connected = false;
+    closed = true;
+    constructor(client = new Client()) {
+        this.client = client;
+        this.client.on("error", () => {
+            this.connected = false;
+        });
+        this.client.on("close", () => {
+            this.connected = false;
+            this.closed = true;
+        });
+    }
+    async connect(options) {
+        const connectOptions = await createSshConnectOptions(options);
+        this.closed = false;
+        await new Promise((resolve, reject) => {
+            const onReady = () => {
+                cleanup();
+                this.connected = true;
+                resolve();
+            };
+            const onError = (error) => {
+                cleanup();
+                this.connected = false;
+                this.closed = true;
+                try {
+                    this.client.end();
+                }
+                catch {
+                    // The failed connection may not have a writable socket.
+                }
+                const converted = toScpNextError(error);
+                if (converted instanceof HostVerificationError) {
+                    reject(converted);
+                    return;
+                }
+                reject(new ConnectionError(`Unable to connect command executor to SSH server: ${formatErrorMessage(error)}`, {
+                    cause: error,
+                    context: {
+                        host: options.host,
+                        port: options.port,
+                        username: options.username
+                    }
+                }));
+            };
+            const onClose = () => {
+                cleanup();
+                reject(new ConnectionError("SSH connection closed before it was ready."));
+            };
+            const cleanup = () => {
+                this.client.off("ready", onReady);
+                this.client.off("error", onError);
+                this.client.off("close", onClose);
+            };
+            this.client.once("ready", onReady);
+            this.client.once("error", onError);
+            this.client.once("close", onClose);
+            try {
+                this.client.connect(connectOptions);
+            }
+            catch (error) {
+                cleanup();
+                this.closed = true;
+                reject(new ConnectionError(`Unable to start SSH connection: ${formatErrorMessage(error)}`));
+            }
+        });
+    }
+    async exec(command, options = {}) {
+        if (!this.connected) {
+            throw new ConnectionError("Command executor is not connected.");
+        }
+        return new Promise((resolve, reject) => {
+            try {
+                this.client.exec(command, (error, stream) => {
+                    if (error) {
+                        reject(new RemoteCommandError("Unable to start remote command.", {
+                            exitCode: null
+                        }));
+                        return;
+                    }
+                    collectCommandResult(command, stream, options, resolve, reject);
+                });
+            }
+            catch (error) {
+                reject(new ConnectionError(`Unable to start remote command: ${formatErrorMessage(error)}`));
+            }
+        });
+    }
+    async close() {
+        if (this.closed) {
+            return;
+        }
+        this.connected = false;
+        await new Promise((resolve) => {
+            this.client.once("close", resolve);
+            this.client.end();
+        });
+    }
+}
+function collectCommandResult(command, stream, options, resolve, reject) {
+    let stdout = "";
+    let stderr = "";
+    let outputBytes = 0;
+    let settled = false;
+    const maxBuffer = options.maxBuffer ?? 10 * 1024 * 1024;
+    const cleanup = () => {
+        if (timer)
+            clearTimeout(timer);
+        stream.off("data", onStdoutData);
+        stream.stderr.off("data", onStderrData);
+        stream.off("close", onClose);
+        stream.off("error", onStreamError);
+        stream.stderr.off("error", onStreamError);
+    };
+    const fail = (error) => {
+        if (settled)
+            return;
+        settled = true;
+        cleanup();
+        try {
+            stream.close();
+        }
+        catch {
+            // The connection may already be closed.
+        }
+        reject(error);
+    };
+    const appendOutput = (target, chunk) => {
+        outputBytes += Buffer.byteLength(chunk);
+        if (outputBytes > maxBuffer) {
+            fail(new RemoteCommandError(`Remote command output exceeded maxBuffer of ${maxBuffer} bytes.`, {
+                exitCode: null,
+                stdout,
+                stderr
+            }));
+            return;
+        }
+        if (target === "stdout")
+            stdout += chunk;
+        else
+            stderr += chunk;
+    };
+    const onStreamError = () => {
+        fail(new RemoteCommandError("Remote command stream failed.", {
+            exitCode: null,
+            stdout,
+            stderr
+        }));
+    };
+    const onStdoutData = (chunk) => {
+        appendOutput("stdout", chunk);
+    };
+    const onStderrData = (chunk) => {
+        appendOutput("stderr", chunk);
+    };
+    const onClose = (exitCode, signal) => {
+        if (settled)
+            return;
+        settled = true;
+        cleanup();
+        resolve({
+            command,
+            stdout,
+            stderr,
+            exitCode: typeof exitCode === "number" ? exitCode : null,
+            ...(signal ? { signal } : {})
+        });
+    };
+    const timer = options.timeout === undefined
+        ? undefined
+        : setTimeout(() => {
+            fail(new RemoteCommandError(`Remote command timed out after ${options.timeout} ms.`, {
+                exitCode: null,
+                stdout,
+                stderr
+            }));
+        }, options.timeout);
+    stream.setEncoding("utf8");
+    stream.stderr.setEncoding("utf8");
+    stream.on("data", onStdoutData);
+    stream.stderr.on("data", onStderrData);
+    stream.once("error", onStreamError);
+    stream.stderr.once("error", onStreamError);
+    stream.once("close", onClose);
+}
 
-// src/paths/remote-path.ts
-import path2 from "path";
 function assertRemotePath(inputPath, label = "remote path") {
-  if (!inputPath || inputPath.trim().length === 0) {
-    throw new ValidationError(`Invalid ${label}: remote paths must not be empty.`, {
-      context: { path: inputPath }
-    });
-  }
+    if (!inputPath || inputPath.trim().length === 0) {
+        throw new ValidationError(`Invalid ${label}: remote paths must not be empty.`, {
+            context: { path: inputPath }
+        });
+    }
 }
 function normalizeRemotePath(inputPath) {
-  assertRemotePath(inputPath);
-  return path2.posix.normalize(inputPath.replace(/\\/g, "/"));
+    assertRemotePath(inputPath);
+    return path.posix.normalize(inputPath.replace(/\\/g, "/"));
 }
 function restoreMsysConvertedRemotePath(inputPath) {
-  const normalized = inputPath.replace(/\\/g, "/");
-  const match = /^[A-Za-z]:\/(?:Program Files\/Git|Program Files \(x86\)\/Git|Git|msys64)\/(.+)$/i.exec(
-    normalized
-  );
-  return match ? `/${match[1]}` : inputPath;
+    const normalized = inputPath.replace(/\\/g, "/");
+    const match = /^[A-Za-z]:\/(?:Program Files\/Git|Program Files \(x86\)\/Git|Git|msys64)\/(.+)$/i.exec(normalized);
+    return match ? `/${match[1]}` : inputPath;
 }
 function remoteJoin(...parts) {
-  const joined = path2.posix.join(...parts);
-  assertRemotePath(joined);
-  return joined;
+    const joined = path.posix.join(...parts);
+    assertRemotePath(joined);
+    return joined;
 }
 function remoteDirname(inputPath) {
-  assertRemotePath(inputPath);
-  return path2.posix.dirname(inputPath);
+    assertRemotePath(inputPath);
+    return path.posix.dirname(inputPath);
 }
 
-// src/client/walk.ts
 async function walkLocalFiles(rootPath) {
-  const resolvedRoot = resolveLocalPath(rootPath);
-  const stats = await stat2(resolvedRoot);
-  if (stats.isFile()) {
-    return [
-      {
-        absolutePath: resolvedRoot,
-        relativePath: path3.basename(resolvedRoot),
-        size: stats.size
-      }
-    ];
-  }
-  const files = [];
-  async function visit(directory) {
-    const entries = await readdir(directory, { withFileTypes: true });
-    for (const entry of entries) {
-      const absolutePath = path3.join(directory, entry.name);
-      if (entry.isDirectory()) {
-        await visit(absolutePath);
-      } else if (entry.isFile()) {
-        const entryStats = await stat2(absolutePath);
-        files.push({
-          absolutePath,
-          relativePath: path3.relative(resolvedRoot, absolutePath),
-          size: entryStats.size
-        });
-      }
+    const resolvedRoot = resolveLocalPath(rootPath);
+    const stats = await stat(resolvedRoot);
+    if (stats.isFile()) {
+        return [
+            {
+                absolutePath: resolvedRoot,
+                relativePath: path.basename(resolvedRoot),
+                size: stats.size
+            }
+        ];
+    }
+    const files = [];
+    async function visit(directory) {
+        const entries = await readdir(directory, { withFileTypes: true });
+        for (const entry of entries) {
+            const absolutePath = path.join(directory, entry.name);
+            if (entry.isDirectory()) {
+                await visit(absolutePath);
+            }
+            else if (entry.isFile()) {
+                const entryStats = await stat(absolutePath);
+                files.push({
+                    absolutePath,
+                    relativePath: path.relative(resolvedRoot, absolutePath),
+                    size: entryStats.size
+                });
+            }
+        }
     }
-  }
-  await visit(resolvedRoot);
-  return files;
+    await visit(resolvedRoot);
+    return files;
 }
 async function walkRemoteFiles(transport, rootPath) {
-  const rootEntries = await transport.list(rootPath);
-  const files = [];
-  async function visit(directory, relativeBase, entries) {
-    for (const entry of entries) {
-      const fullPath = remoteJoin(directory, entry.name);
-      const relativePath = relativeBase ? remoteJoin(relativeBase, entry.name) : entry.name;
-      if (entry.type === "d") {
-        await visit(fullPath, relativePath, await transport.list(fullPath));
-      } else if (entry.type === "-") {
-        files.push({
-          remotePath: fullPath,
-          relativePath,
-          size: entry.size
-        });
-      }
+    const rootEntries = await transport.list(rootPath);
+    const files = [];
+    async function visit(directory, relativeBase, entries) {
+        for (const entry of entries) {
+            const fullPath = remoteJoin(directory, entry.name);
+            const relativePath = relativeBase ? remoteJoin(relativeBase, entry.name) : entry.name;
+            if (entry.type === "d") {
+                await visit(fullPath, relativePath, await transport.list(fullPath));
+            }
+            else if (entry.type === "-") {
+                files.push({
+                    remotePath: fullPath,
+                    relativePath,
+                    size: entry.size
+                });
+            }
+        }
+    }
+    await visit(rootPath, "", rootEntries);
+    return files;
+}
+
+function isPostUploadCommands(value) {
+    return (Array.isArray(value) &&
+        value.every((command) => typeof command === "string" && command.trim().length > 0));
+}
+function getPostUploadCommands(source) {
+    const commands = readPostUploadCommands(source);
+    if (commands === undefined) {
+        return undefined;
+    }
+    if (!isPostUploadCommands(commands)) {
+        throw new ValidationError("postUploadCommands must be an array of non-empty command strings.");
     }
-  }
-  await visit(rootPath, "", rootEntries);
-  return files;
+    return commands;
+}
+function readPostUploadCommands(source) {
+    if (typeof source !== "object" || source === null) {
+        return undefined;
+    }
+    return source
+        .postUploadCommands;
+}
+function clearPostUploadCommands(source) {
+    source.postUploadCommands =
+        undefined;
 }
 
-// src/config/validation.ts
-import { access as access3 } from "fs/promises";
 function validatePort(port) {
-  if (port === void 0) {
-    return;
-  }
-  if (!Number.isInteger(port) || port < 1 || port > 65535) {
-    throw new ValidationError("Port must be an integer between 1 and 65535.", {
-      context: { port }
-    });
-  }
+    if (port === undefined) {
+        return;
+    }
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        throw new ValidationError("Port must be an integer between 1 and 65535.", {
+            context: { port }
+        });
+    }
 }
 function validateTimeout(timeout) {
-  if (timeout === void 0) {
-    return;
-  }
-  if (!Number.isFinite(timeout) || timeout <= 0) {
-    throw new ValidationError("Timeout must be a positive number.", {
-      context: { timeout }
-    });
-  }
+    if (timeout === undefined) {
+        return;
+    }
+    if (!Number.isFinite(timeout) || timeout <= 0) {
+        throw new ValidationError("Timeout must be a positive number.", {
+            context: { timeout }
+        });
+    }
 }
 async function validateServerOptions(options) {
-  if (!options.host) {
-    throw new ValidationError("Host is required.");
-  }
-  if (!options.username) {
-    throw new ValidationError("Username is required.");
-  }
-  validatePort(options.port);
-  validateTimeout(options.timeout);
-  if (options.privateKeyFile) {
-    try {
-      await access3(resolveLocalPath(options.privateKeyFile));
-    } catch (error) {
-      throw new ValidationError(`Private key file does not exist: ${options.privateKeyFile}`, {
-        cause: error,
-        context: { privateKeyFile: options.privateKeyFile }
-      });
-    }
-  }
-  const hasAuthentication = Boolean(options.password) || Boolean(options.privateKey) || Boolean(options.privateKeyFile) || Boolean(options.agent) || Boolean(process.env.SSH_AUTH_SOCK);
-  if (!hasAuthentication) {
-    throw new ValidationError(
-      "Authentication is required. Provide a password, private key, private key file, or SSH agent."
-    );
-  }
+    if (!options.host) {
+        throw new ValidationError("Host is required.");
+    }
+    if (!options.username) {
+        throw new ValidationError("Username is required.");
+    }
+    validatePort(options.port);
+    validateTimeout(options.timeout);
+    if (options.privateKeyFile) {
+        try {
+            await access(resolveLocalPath(options.privateKeyFile));
+        }
+        catch (error) {
+            throw new ValidationError(`Private key file does not exist: ${options.privateKeyFile}`, {
+                cause: error,
+                context: { privateKeyFile: options.privateKeyFile }
+            });
+        }
+    }
+    const hasAuthentication = Boolean(options.password) ||
+        Boolean(options.privateKey) ||
+        Boolean(options.privateKeyFile) ||
+        Boolean(options.agent) ||
+        Boolean(process.env.SSH_AUTH_SOCK);
+    if (!hasAuthentication) {
+        throw new ValidationError("Authentication is required. Provide a password, private key, private key file, or SSH agent.");
+    }
 }
 async function validateUploadOptions(options) {
-  if (!options.localPath) {
-    throw new ValidationError("Missing localPath.");
-  }
-  if (!options.remotePath) {
-    throw new ValidationError("Missing remotePath.");
-  }
-  assertRemotePath(options.remotePath, "remotePath");
-  validateTimeout(options.timeout);
-  await assertLocalPathExists(options.localPath);
-  if (!options.dryRun) {
-    await validateServerOptions(options);
-  }
+    if (!options.localPath) {
+        throw new ValidationError("Missing localPath.");
+    }
+    if (!options.remotePath) {
+        throw new ValidationError("Missing remotePath.");
+    }
+    assertRemotePath(options.remotePath, "remotePath");
+    validateTimeout(options.timeout);
+    getPostUploadCommands(options);
+    await assertLocalPathExists(options.localPath);
+    if (!options.dryRun) {
+        await validateServerOptions(options);
+    }
 }
 async function validateDownloadOptions(options) {
-  if (!options.remotePath) {
-    throw new ValidationError("Missing remotePath.");
-  }
-  if (!options.localPath) {
-    throw new ValidationError("Missing localPath.");
-  }
-  assertRemotePath(options.remotePath, "remotePath");
-  validateTimeout(options.timeout);
-  await assertDownloadDestination(options.localPath, options.createDirectories ?? true);
-  if (!options.dryRun) {
-    await validateServerOptions(options);
-  }
+    if (!options.remotePath) {
+        throw new ValidationError("Missing remotePath.");
+    }
+    if (!options.localPath) {
+        throw new ValidationError("Missing localPath.");
+    }
+    assertRemotePath(options.remotePath, "remotePath");
+    validateTimeout(options.timeout);
+    if (getPostUploadCommands(options)?.length) {
+        throw new ValidationError("Post-upload commands are not supported for downloads.");
+    }
+    await assertDownloadDestination(options.localPath, options.createDirectories ?? true);
+    if (!options.dryRun) {
+        await validateServerOptions(options);
+    }
 }
 
-// src/client/client.ts
 function percentage(transferredBytes, totalBytes) {
-  if (!totalBytes || totalBytes <= 0) {
-    return void 0;
-  }
-  return Math.min(100, Math.round(transferredBytes / totalBytes * 100));
+    if (!totalBytes || totalBytes <= 0) {
+        return undefined;
+    }
+    return Math.min(100, Math.round((transferredBytes / totalBytes) * 100));
 }
 function mergeOptions(serverOptions, transferOptions) {
-  return { ...serverOptions, ...transferOptions ?? {} };
+    return { ...serverOptions, ...(transferOptions ?? {}) };
 }
 function shouldCreateDirectories(options) {
-  return options.createDirectories ?? true;
+    return options.createDirectories ?? true;
 }
 function hasTrailingPathSeparator(inputPath) {
-  return /[\\/]$/.test(inputPath);
+    return /[\\/]$/.test(inputPath);
 }
 function trimmedRemoteDirectory(remotePath) {
-  return remotePath.replace(/\/+$/g, "") || "/";
+    return remotePath.replace(/\/+$/g, "") || "/";
 }
 function remoteBasename(remotePath) {
-  return path4.posix.basename(trimmedRemoteDirectory(remotePath));
+    return path.posix.basename(trimmedRemoteDirectory(remotePath));
 }
 async function isExistingLocalDirectory(localPath) {
-  try {
-    return (await stat3(localPath)).isDirectory();
-  } catch {
-    return false;
-  }
+    try {
+        return (await stat(localPath)).isDirectory();
+    }
+    catch {
+        return false;
+    }
 }
 async function ensureLocalDirectory(localPath, createParents = false) {
-  try {
-    const stats = await stat3(localPath);
-    if (stats.isDirectory()) {
-      return;
-    }
-    throw new TransferError(`Local destination already exists and is not a directory: ${localPath}`, {
-      context: { localPath }
-    });
-  } catch (error) {
-    if (error instanceof TransferError) {
-      throw error;
-    }
-    await mkdir2(localPath, { recursive: createParents });
-  }
-}
-var ScpNextClientImpl = class {
-  serverOptions;
-  transport;
-  connected = false;
-  constructor(serverOptions, dependencies = {}) {
-    this.serverOptions = serverOptions;
-    this.transport = dependencies.transport ?? new Ssh2SftpTransport();
-  }
-  async connect() {
-    await validateServerOptions(this.serverOptions);
-    await this.transport.connect(this.serverOptions);
-    this.connected = true;
-  }
-  async upload(localPath, remotePath, options = {}) {
-    const uploadOptions = {
-      ...mergeOptions(this.serverOptions, options),
-      localPath,
-      remotePath
-    };
-    await validateUploadOptions(uploadOptions);
-    if (options.dryRun) {
-      return;
-    }
-    await this.ensureConnected();
-    await this.uploadWithTransport(uploadOptions);
-  }
-  async download(remotePath, localPath, options = {}) {
-    const downloadOptions = {
-      ...mergeOptions(this.serverOptions, options),
-      remotePath,
-      localPath
-    };
-    await validateDownloadOptions(downloadOptions);
-    if (options.dryRun) {
-      return;
-    }
-    await this.ensureConnected();
-    await this.downloadWithTransport(downloadOptions);
-  }
-  async close() {
-    if (this.connected) {
-      await this.transport.close();
-      this.connected = false;
-    }
-  }
-  async ensureConnected() {
-    if (!this.connected) {
-      await this.connect();
-    }
-  }
-  async uploadWithTransport(options) {
-    const localKind = await getLocalPathKind(options.localPath);
-    const remotePath = normalizeRemotePath(options.remotePath);
-    if (localKind === "directory" && !options.recursive) {
-      throw new ValidationError("Uploading a directory requires recursive mode.");
-    }
-    if (localKind === "file") {
-      const destinationFile = await this.resolveRemoteDestinationForLocalFile(options, remotePath);
-      const totalBytes2 = void 0;
-      await this.transport.uploadFile(resolveLocalPath(options.localPath), destinationFile, (step) => {
-        options.onProgress?.({
-          operation: "upload",
-          source: options.localPath,
-          destination: options.remotePath,
-          transferredBytes: step.transferredBytes,
-          totalBytes: step.totalBytes || totalBytes2,
-          percentage: percentage(step.transferredBytes, step.totalBytes),
-          currentFile: options.localPath
-        });
-      });
-      return;
-    }
-    const files = await walkLocalFiles(options.localPath);
-    const totalBytes = files.reduce((sum, file) => sum + file.size, 0);
-    let completedBytes = 0;
-    let completedFiles = 0;
-    const destinationRoot = await this.resolveRemoteDestinationForLocalDirectory(
-      options,
-      remotePath
-    );
-    for (const file of files) {
-      const destinationFile = remoteJoin(
-        destinationRoot,
-        file.relativePath.split(path4.sep).join("/")
-      );
-      await this.ensureRemoteParent(destinationFile, true);
-      await this.assertRemoteOverwrite(destinationFile, options.overwrite);
-      await this.transport.uploadFile(file.absolutePath, destinationFile, (step) => {
-        const transferredBytes = completedBytes + step.transferredBytes;
-        options.onProgress?.({
-          operation: "upload",
-          source: options.localPath,
-          destination: options.remotePath,
-          transferredBytes,
-          totalBytes,
-          percentage: percentage(transferredBytes, totalBytes),
-          currentFile: file.relativePath,
-          completedFiles,
-          totalFiles: files.length
-        });
-      });
-      completedBytes += file.size;
-      completedFiles += 1;
-    }
-  }
-  async resolveRemoteDestinationForLocalFile(options, remotePath) {
-    const remoteKind = await this.transport.exists(remotePath);
-    const isDirectoryLikeDestination = remoteKind === "d" || remotePath.endsWith("/");
-    if (!isDirectoryLikeDestination) {
-      await this.ensureRemoteParent(remotePath, shouldCreateDirectories(options));
-      await this.assertRemoteOverwrite(remotePath, options.overwrite);
-      return remotePath;
-    }
-    if (remoteKind && remoteKind !== "d") {
-      throw new TransferError(`Remote destination already exists and is not a directory: ${remotePath}`, {
-        context: { remotePath }
-      });
-    }
-    const remoteDirectory = remotePath.replace(/\/+$/g, "") || "/";
-    if (!remoteKind) {
-      if (!shouldCreateDirectories(options)) {
-        throw new TransferError(`Remote destination directory does not exist: ${remoteDirectory}`, {
-          context: { remotePath }
-        });
-      }
-      await this.transport.mkdir(remoteDirectory, true);
-    }
-    const destinationFile = remoteJoin(
-      remoteDirectory,
-      path4.basename(resolveLocalPath(options.localPath))
-    );
-    await this.assertRemoteOverwrite(destinationFile, options.overwrite);
-    return destinationFile;
-  }
-  async resolveRemoteDestinationForLocalDirectory(options, remotePath) {
-    const remoteKind = await this.transport.exists(remotePath);
-    const isDirectoryLikeDestination = remoteKind === "d" || remotePath.endsWith("/");
-    const localDirectoryName = path4.basename(resolveLocalPath(options.localPath));
-    if (remoteKind && remoteKind !== "d") {
-      throw new TransferError(`Remote destination already exists and is not a directory: ${remotePath}`, {
-        context: { remotePath }
-      });
-    }
-    if (isDirectoryLikeDestination) {
-      const remoteDirectory = trimmedRemoteDirectory(remotePath);
-      if (!remoteKind) {
-        if (!shouldCreateDirectories(options)) {
-          throw new TransferError(`Remote destination directory does not exist: ${remoteDirectory}`, {
-            context: { remotePath }
-          });
-        }
-        await this.transport.mkdir(remoteDirectory, true);
-      }
-      const destinationRoot = remoteJoin(remoteDirectory, localDirectoryName);
-      await this.ensureRemoteDirectory(destinationRoot);
-      return destinationRoot;
-    }
-    if (!remoteKind) {
-      if (!shouldCreateDirectories(options)) {
-        throw new TransferError(`Remote destination directory does not exist: ${remotePath}`, {
-          context: { remotePath }
-        });
-      }
-      await this.transport.mkdir(remotePath, true);
-    }
-    return remotePath;
-  }
-  async downloadWithTransport(options) {
-    const remotePath = normalizeRemotePath(options.remotePath);
-    const remoteKind = await this.transport.exists(remotePath);
-    if (!remoteKind) {
-      throw new TransferError(`Remote path does not exist: ${options.remotePath}`, {
-        context: { remotePath: options.remotePath }
-      });
-    }
-    if (remoteKind === "d") {
-      if (!options.recursive) {
-        throw new ValidationError("Downloading a directory requires recursive mode.");
-      }
-      await this.downloadDirectory(options);
-      return;
-    }
-    await this.downloadSingleFile(options, remotePath);
-  }
-  async downloadSingleFile(options, remotePath) {
-    const localPath = await this.resolveLocalDestinationForRemoteFile(options, remotePath);
-    await this.assertLocalOverwrite(localPath, options.overwrite);
-    if (shouldCreateDirectories(options)) {
-      await mkdir2(path4.dirname(localPath), { recursive: true });
-    }
-    await this.transport.downloadFile(remotePath, localPath, (step) => {
-      options.onProgress?.({
-        operation: "download",
-        source: options.remotePath,
-        destination: options.localPath,
-        transferredBytes: step.transferredBytes,
-        totalBytes: step.totalBytes,
-        percentage: percentage(step.transferredBytes, step.totalBytes),
-        currentFile: options.remotePath
-      });
-    });
-  }
-  async downloadDirectory(options) {
-    const remotePath = normalizeRemotePath(options.remotePath);
-    const localRoot = await this.resolveLocalDestinationForRemoteDirectory(options, remotePath);
-    const files = await walkRemoteFiles(this.transport, remotePath);
-    const totalBytes = files.reduce((sum, file) => sum + file.size, 0);
-    let completedBytes = 0;
-    let completedFiles = 0;
-    await ensureLocalDirectory(localRoot, shouldCreateDirectories(options));
-    for (const file of files) {
-      const localFile = path4.join(localRoot, ...file.relativePath.split("/"));
-      await this.assertLocalOverwrite(localFile, options.overwrite);
-      await mkdir2(path4.dirname(localFile), { recursive: true });
-      await this.transport.downloadFile(file.remotePath, localFile, (step) => {
-        const transferredBytes = completedBytes + step.transferredBytes;
-        options.onProgress?.({
-          operation: "download",
-          source: options.remotePath,
-          destination: options.localPath,
-          transferredBytes,
-          totalBytes,
-          percentage: percentage(transferredBytes, totalBytes),
-          currentFile: file.relativePath,
-          completedFiles,
-          totalFiles: files.length
-        });
-      });
-      completedBytes += file.size;
-      completedFiles += 1;
-    }
-  }
-  async resolveLocalDestinationForRemoteFile(options, remotePath) {
-    const localDestination = resolveLocalPath(options.localPath);
-    const isDirectoryLikeDestination = hasTrailingPathSeparator(options.localPath) || await isExistingLocalDirectory(localDestination);
-    if (!isDirectoryLikeDestination) {
-      return localDestination;
-    }
-    if (!await isExistingLocalDirectory(localDestination)) {
-      if (!shouldCreateDirectories(options)) {
-        throw new TransferError(`Local destination directory does not exist: ${localDestination}`, {
-          context: { localPath: options.localPath }
+    try {
+        const stats = await stat(localPath);
+        if (stats.isDirectory()) {
+            return;
+        }
+        throw new TransferError(`Local destination already exists and is not a directory: ${localPath}`, {
+            context: { localPath }
         });
-      }
-      await mkdir2(localDestination, { recursive: true });
-    }
-    return path4.join(localDestination, remoteBasename(remotePath));
-  }
-  async resolveLocalDestinationForRemoteDirectory(options, remotePath) {
-    const localDestination = resolveLocalPath(options.localPath);
-    const isDirectoryLikeDestination = hasTrailingPathSeparator(options.localPath) || await isExistingLocalDirectory(localDestination);
-    if (!isDirectoryLikeDestination) {
-      return localDestination;
-    }
-    if (!await isExistingLocalDirectory(localDestination)) {
-      if (!shouldCreateDirectories(options)) {
-        throw new TransferError(`Local destination directory does not exist: ${localDestination}`, {
-          context: { localPath: options.localPath }
+    }
+    catch (error) {
+        if (error instanceof TransferError) {
+            throw error;
+        }
+        await mkdir(localPath, { recursive: createParents });
+    }
+}
+class ScpNextClientImpl {
+    serverOptions;
+    transport;
+    commandExecutor;
+    connected = false;
+    commandExecutorConnected = false;
+    constructor(serverOptions, dependencies = {}) {
+        this.serverOptions = serverOptions;
+        this.transport = dependencies.transport ?? new Ssh2SftpTransport();
+        this.commandExecutor = dependencies.commandExecutor ?? new SshCommandExecutor();
+    }
+    async connect() {
+        await validateServerOptions(this.serverOptions);
+        await this.transport.connect(this.serverOptions);
+        this.connected = true;
+    }
+    async upload(localPath, remotePath, options = {}) {
+        const uploadOptions = {
+            ...mergeOptions(this.serverOptions, options),
+            localPath,
+            remotePath
+        };
+        await validateUploadOptions(uploadOptions);
+        if (options.dryRun) {
+            return [];
+        }
+        await this.ensureConnected();
+        await this.uploadWithTransport(uploadOptions);
+        const results = [];
+        for (const command of getPostUploadCommands(options) ?? []) {
+            results.push(await this.exec(command));
+        }
+        return results;
+    }
+    async download(remotePath, localPath, options = {}) {
+        const downloadOptions = {
+            ...mergeOptions(this.serverOptions, options),
+            remotePath,
+            localPath
+        };
+        await validateDownloadOptions(downloadOptions);
+        if (options.dryRun) {
+            return;
+        }
+        await this.ensureConnected();
+        await this.downloadWithTransport(downloadOptions);
+    }
+    async exec(command, options = {}) {
+        if (typeof command !== "string" || !command.trim()) {
+            throw new ValidationError("Remote command must not be empty.");
+        }
+        if (options.timeout !== undefined && (!Number.isFinite(options.timeout) || options.timeout <= 0)) {
+            throw new ValidationError("Command timeout must be a positive number.");
+        }
+        if (options.maxBuffer !== undefined &&
+            (!Number.isInteger(options.maxBuffer) || options.maxBuffer <= 0)) {
+            throw new ValidationError("Command maxBuffer must be a positive integer.");
+        }
+        if (options.failOnStderr !== undefined &&
+            typeof options.failOnStderr !== "boolean") {
+            throw new ValidationError("Command failOnStderr must be a boolean.");
+        }
+        await this.ensureCommandExecutorConnected();
+        let result;
+        try {
+            result = await this.commandExecutor.exec(command, options);
+        }
+        catch (error) {
+            if (error instanceof RemoteCommandError) {
+                throw new RemoteCommandError(error.message, {
+                    exitCode: error.exitCode,
+                    signal: error.signal,
+                    stdout: redactKnownSensitiveValues(error.stdout, this.serverOptions),
+                    stderr: redactKnownSensitiveValues(error.stderr, this.serverOptions)
+                });
+            }
+            throw error;
+        }
+        if (result.exitCode !== 0 || (options.failOnStderr && result.stderr.length > 0)) {
+            const reason = result.exitCode === null
+                ? "Remote command ended without an exit code."
+                : result.exitCode !== 0
+                    ? `Remote command failed with exit code ${String(result.exitCode)}.`
+                    : "Remote command wrote to stderr.";
+            throw new RemoteCommandError(reason, {
+                exitCode: result.exitCode,
+                signal: result.signal,
+                stdout: redactKnownSensitiveValues(result.stdout, this.serverOptions),
+                stderr: redactKnownSensitiveValues(result.stderr, this.serverOptions)
+            });
+        }
+        return result;
+    }
+    async close() {
+        const closures = [];
+        if (this.connected)
+            closures.push(this.transport.close());
+        if (this.commandExecutorConnected)
+            closures.push(this.commandExecutor.close());
+        const results = await Promise.allSettled(closures);
+        this.connected = false;
+        this.commandExecutorConnected = false;
+        const failure = results.find((result) => result.status === "rejected");
+        if (failure) {
+            throw failure.reason;
+        }
+    }
+    async ensureConnected() {
+        if (!this.connected) {
+            await this.connect();
+        }
+    }
+    async ensureCommandExecutorConnected() {
+        if (!this.commandExecutorConnected) {
+            await validateServerOptions(this.serverOptions);
+            await this.commandExecutor.connect(this.serverOptions);
+            this.commandExecutorConnected = true;
+        }
+    }
+    async uploadWithTransport(options) {
+        const localKind = await getLocalPathKind(options.localPath);
+        const remotePath = normalizeRemotePath(options.remotePath);
+        if (localKind === "directory" && !options.recursive) {
+            throw new ValidationError("Uploading a directory requires recursive mode.");
+        }
+        if (localKind === "file") {
+            const destinationFile = await this.resolveRemoteDestinationForLocalFile(options, remotePath);
+            const totalBytes = undefined;
+            await this.transport.uploadFile(resolveLocalPath(options.localPath), destinationFile, (step) => {
+                options.onProgress?.({
+                    operation: "upload",
+                    source: options.localPath,
+                    destination: options.remotePath,
+                    transferredBytes: step.transferredBytes,
+                    totalBytes: step.totalBytes || totalBytes,
+                    percentage: percentage(step.transferredBytes, step.totalBytes),
+                    currentFile: options.localPath
+                });
+            });
+            return;
+        }
+        const files = await walkLocalFiles(options.localPath);
+        const totalBytes = files.reduce((sum, file) => sum + file.size, 0);
+        let completedBytes = 0;
+        let completedFiles = 0;
+        const destinationRoot = await this.resolveRemoteDestinationForLocalDirectory(options, remotePath);
+        for (const file of files) {
+            const destinationFile = remoteJoin(destinationRoot, file.relativePath.split(path.sep).join("/"));
+            await this.ensureRemoteParent(destinationFile, true);
+            await this.assertRemoteOverwrite(destinationFile, options.overwrite);
+            await this.transport.uploadFile(file.absolutePath, destinationFile, (step) => {
+                const transferredBytes = completedBytes + step.transferredBytes;
+                options.onProgress?.({
+                    operation: "upload",
+                    source: options.localPath,
+                    destination: options.remotePath,
+                    transferredBytes,
+                    totalBytes,
+                    percentage: percentage(transferredBytes, totalBytes),
+                    currentFile: file.relativePath,
+                    completedFiles,
+                    totalFiles: files.length
+                });
+            });
+            completedBytes += file.size;
+            completedFiles += 1;
+        }
+    }
+    async resolveRemoteDestinationForLocalFile(options, remotePath) {
+        const remoteKind = await this.transport.exists(remotePath);
+        const isDirectoryLikeDestination = remoteKind === "d" || remotePath.endsWith("/");
+        if (!isDirectoryLikeDestination) {
+            await this.ensureRemoteParent(remotePath, shouldCreateDirectories(options));
+            await this.assertRemoteOverwrite(remotePath, options.overwrite);
+            return remotePath;
+        }
+        if (remoteKind && remoteKind !== "d") {
+            throw new TransferError(`Remote destination already exists and is not a directory: ${remotePath}`, {
+                context: { remotePath }
+            });
+        }
+        const remoteDirectory = remotePath.replace(/\/+$/g, "") || "/";
+        if (!remoteKind) {
+            if (!shouldCreateDirectories(options)) {
+                throw new TransferError(`Remote destination directory does not exist: ${remoteDirectory}`, {
+                    context: { remotePath }
+                });
+            }
+            await this.transport.mkdir(remoteDirectory, true);
+        }
+        const destinationFile = remoteJoin(remoteDirectory, path.basename(resolveLocalPath(options.localPath)));
+        await this.assertRemoteOverwrite(destinationFile, options.overwrite);
+        return destinationFile;
+    }
+    async resolveRemoteDestinationForLocalDirectory(options, remotePath) {
+        const remoteKind = await this.transport.exists(remotePath);
+        const isDirectoryLikeDestination = remoteKind === "d" || remotePath.endsWith("/");
+        const localDirectoryName = path.basename(resolveLocalPath(options.localPath));
+        if (remoteKind && remoteKind !== "d") {
+            throw new TransferError(`Remote destination already exists and is not a directory: ${remotePath}`, {
+                context: { remotePath }
+            });
+        }
+        if (isDirectoryLikeDestination) {
+            const remoteDirectory = trimmedRemoteDirectory(remotePath);
+            if (!remoteKind) {
+                if (!shouldCreateDirectories(options)) {
+                    throw new TransferError(`Remote destination directory does not exist: ${remoteDirectory}`, {
+                        context: { remotePath }
+                    });
+                }
+                await this.transport.mkdir(remoteDirectory, true);
+            }
+            const destinationRoot = remoteJoin(remoteDirectory, localDirectoryName);
+            await this.ensureRemoteDirectory(destinationRoot);
+            return destinationRoot;
+        }
+        if (!remoteKind) {
+            if (!shouldCreateDirectories(options)) {
+                throw new TransferError(`Remote destination directory does not exist: ${remotePath}`, {
+                    context: { remotePath }
+                });
+            }
+            await this.transport.mkdir(remotePath, true);
+        }
+        return remotePath;
+    }
+    async downloadWithTransport(options) {
+        const remotePath = normalizeRemotePath(options.remotePath);
+        const remoteKind = await this.transport.exists(remotePath);
+        if (!remoteKind) {
+            throw new TransferError(`Remote path does not exist: ${options.remotePath}`, {
+                context: { remotePath: options.remotePath }
+            });
+        }
+        if (remoteKind === "d") {
+            if (!options.recursive) {
+                throw new ValidationError("Downloading a directory requires recursive mode.");
+            }
+            await this.downloadDirectory(options);
+            return;
+        }
+        await this.downloadSingleFile(options, remotePath);
+    }
+    async downloadSingleFile(options, remotePath) {
+        const localPath = await this.resolveLocalDestinationForRemoteFile(options, remotePath);
+        await this.assertLocalOverwrite(localPath, options.overwrite);
+        if (shouldCreateDirectories(options)) {
+            await mkdir(path.dirname(localPath), { recursive: true });
+        }
+        await this.transport.downloadFile(remotePath, localPath, (step) => {
+            options.onProgress?.({
+                operation: "download",
+                source: options.remotePath,
+                destination: options.localPath,
+                transferredBytes: step.transferredBytes,
+                totalBytes: step.totalBytes,
+                percentage: percentage(step.transferredBytes, step.totalBytes),
+                currentFile: options.remotePath
+            });
         });
-      }
-      await mkdir2(localDestination, { recursive: true });
     }
-    return path4.join(localDestination, remoteBasename(remotePath));
-  }
-  async ensureRemoteParent(remotePath, createDirectories = false) {
-    const parent = remoteDirname(remotePath);
-    if (parent === "." || parent === "/") {
-      return;
+    async downloadDirectory(options) {
+        const remotePath = normalizeRemotePath(options.remotePath);
+        const localRoot = await this.resolveLocalDestinationForRemoteDirectory(options, remotePath);
+        const files = await walkRemoteFiles(this.transport, remotePath);
+        const totalBytes = files.reduce((sum, file) => sum + file.size, 0);
+        let completedBytes = 0;
+        let completedFiles = 0;
+        await ensureLocalDirectory(localRoot, shouldCreateDirectories(options));
+        for (const file of files) {
+            const localFile = path.join(localRoot, ...file.relativePath.split("/"));
+            await this.assertLocalOverwrite(localFile, options.overwrite);
+            await mkdir(path.dirname(localFile), { recursive: true });
+            await this.transport.downloadFile(file.remotePath, localFile, (step) => {
+                const transferredBytes = completedBytes + step.transferredBytes;
+                options.onProgress?.({
+                    operation: "download",
+                    source: options.remotePath,
+                    destination: options.localPath,
+                    transferredBytes,
+                    totalBytes,
+                    percentage: percentage(transferredBytes, totalBytes),
+                    currentFile: file.relativePath,
+                    completedFiles,
+                    totalFiles: files.length
+                });
+            });
+            completedBytes += file.size;
+            completedFiles += 1;
+        }
     }
-    if (createDirectories) {
-      await this.transport.mkdir(parent, true);
-      return;
-    }
-    const exists = await this.transport.exists(parent);
-    if (exists !== "d") {
-      throw new TransferError(`Remote destination parent does not exist: ${parent}`, {
-        context: { remotePath }
-      });
-    }
-  }
-  async ensureRemoteDirectory(remotePath) {
-    const exists = await this.transport.exists(remotePath);
-    if (exists && exists !== "d") {
-      throw new TransferError(`Remote destination already exists and is not a directory: ${remotePath}`, {
-        context: { remotePath }
-      });
-    }
-    if (!exists) {
-      await this.transport.mkdir(remotePath, true);
-    }
-  }
-  async assertRemoteOverwrite(remotePath, overwrite = false) {
-    if (overwrite) {
-      return;
-    }
-    const exists = await this.transport.exists(remotePath);
-    if (exists) {
-      throw new TransferError(
-        `Remote destination already exists: ${remotePath}. Use --overwrite to overwrite it.`,
-        {
-          context: { remotePath }
-        }
-      );
-    }
-  }
-  async assertLocalOverwrite(localPath, overwrite = false) {
-    if (overwrite) {
-      return;
+    async resolveLocalDestinationForRemoteFile(options, remotePath) {
+        const localDestination = resolveLocalPath(options.localPath);
+        const isDirectoryLikeDestination = hasTrailingPathSeparator(options.localPath) || (await isExistingLocalDirectory(localDestination));
+        if (!isDirectoryLikeDestination) {
+            return localDestination;
+        }
+        if (!(await isExistingLocalDirectory(localDestination))) {
+            if (!shouldCreateDirectories(options)) {
+                throw new TransferError(`Local destination directory does not exist: ${localDestination}`, {
+                    context: { localPath: options.localPath }
+                });
+            }
+            await mkdir(localDestination, { recursive: true });
+        }
+        return path.join(localDestination, remoteBasename(remotePath));
     }
-    try {
-      await access4(localPath);
-      throw new TransferError(`Local destination already exists: ${localPath}`, {
-        context: { localPath }
-      });
-    } catch (error) {
-      if (error instanceof TransferError) {
-        throw error;
-      }
+    async resolveLocalDestinationForRemoteDirectory(options, remotePath) {
+        const localDestination = resolveLocalPath(options.localPath);
+        const isDirectoryLikeDestination = hasTrailingPathSeparator(options.localPath) || (await isExistingLocalDirectory(localDestination));
+        if (!isDirectoryLikeDestination) {
+            return localDestination;
+        }
+        if (!(await isExistingLocalDirectory(localDestination))) {
+            if (!shouldCreateDirectories(options)) {
+                throw new TransferError(`Local destination directory does not exist: ${localDestination}`, {
+                    context: { localPath: options.localPath }
+                });
+            }
+            await mkdir(localDestination, { recursive: true });
+        }
+        return path.join(localDestination, remoteBasename(remotePath));
     }
-  }
-};
+    async ensureRemoteParent(remotePath, createDirectories = false) {
+        const parent = remoteDirname(remotePath);
+        if (parent === "." || parent === "/") {
+            return;
+        }
+        if (createDirectories) {
+            await this.transport.mkdir(parent, true);
+            return;
+        }
+        const exists = await this.transport.exists(parent);
+        if (exists !== "d") {
+            throw new TransferError(`Remote destination parent does not exist: ${parent}`, {
+                context: { remotePath }
+            });
+        }
+    }
+    async ensureRemoteDirectory(remotePath) {
+        const exists = await this.transport.exists(remotePath);
+        if (exists && exists !== "d") {
+            throw new TransferError(`Remote destination already exists and is not a directory: ${remotePath}`, {
+                context: { remotePath }
+            });
+        }
+        if (!exists) {
+            await this.transport.mkdir(remotePath, true);
+        }
+    }
+    async assertRemoteOverwrite(remotePath, overwrite = false) {
+        if (overwrite) {
+            return;
+        }
+        const exists = await this.transport.exists(remotePath);
+        if (exists) {
+            throw new TransferError(`Remote destination already exists: ${remotePath}. Use --overwrite to overwrite it.`, {
+                context: { remotePath }
+            });
+        }
+    }
+    async assertLocalOverwrite(localPath, overwrite = false) {
+        if (overwrite) {
+            return;
+        }
+        try {
+            await access(localPath);
+            throw new TransferError(`Local destination already exists: ${localPath}`, {
+                context: { localPath }
+            });
+        }
+        catch (error) {
+            if (error instanceof TransferError) {
+                throw error;
+            }
+        }
+    }
+}
 
-// src/client/download.ts
 async function download(options) {
-  const client = new ScpNextClientImpl(options);
-  try {
-    await client.download(options.remotePath, options.localPath, options);
-  } finally {
-    await client.close();
-  }
+    const client = new ScpNextClientImpl(options);
+    try {
+        await client.download(options.remotePath, options.localPath, options);
+    }
+    finally {
+        await client.close();
+    }
 }
 
-// src/client/upload.ts
 async function upload(options) {
-  const client = new ScpNextClientImpl(options);
-  try {
-    await client.upload(options.localPath, options.remotePath, options);
-  } finally {
+    const client = new ScpNextClientImpl(options);
+    let result;
+    try {
+        result = await client.upload(options.localPath, options.remotePath, options);
+    }
+    catch (error) {
+        try {
+            await client.close();
+        }
+        catch {
+            // Preserve the upload or command failure as the primary error.
+        }
+        throw error;
+    }
     await client.close();
-  }
+    return result;
 }
 
-// src/cli/commands/download.ts
-import { Command } from "commander";
-
-// src/cli/operands.ts
 function usageFor(operation) {
-  return `scp-next ${operation} <source> <destination> [options]`;
+    return `scp-next ${operation} <source> <destination> [options]`;
 }
 function assertSourceDestination(operation, source, destination) {
-  if (!source) {
-    throw new ValidationError(`Missing source path.
-
-Usage:
-  ${usageFor(operation)}`);
-  }
-  if (!destination) {
-    throw new ValidationError(`Missing destination path.
-
-Usage:
-  ${usageFor(operation)}`);
-  }
+    if (!source) {
+        throw new ValidationError(`Missing source path.\n\nUsage:\n  ${usageFor(operation)}`);
+    }
+    if (!destination) {
+        throw new ValidationError(`Missing destination path.\n\nUsage:\n  ${usageFor(operation)}`);
+    }
 }
 
-// src/cli/commands/shared.ts
-import { Option } from "commander";
-
-// src/config/environment.ts
-function parseInteger(value, name) {
-  if (!value) {
-    return void 0;
-  }
-  const parsed = Number.parseInt(value, 10);
-  if (!Number.isFinite(parsed)) {
-    throw new Error(`${name} must be a number.`);
-  }
-  return parsed;
+function parseInteger$1(value, name) {
+    if (!value) {
+        return undefined;
+    }
+    const parsed = Number.parseInt(value, 10);
+    if (!Number.isFinite(parsed)) {
+        throw new Error(`${name} must be a number.`);
+    }
+    return parsed;
 }
 function readEnvironment(env = process.env) {
-  const result = {};
-  if (env.SCP_NEXT_HOST) result.host = env.SCP_NEXT_HOST;
-  if (env.SCP_NEXT_PORT) {
-    const port = parseInteger(env.SCP_NEXT_PORT, "SCP_NEXT_PORT");
-    if (port !== void 0) result.port = port;
-  }
-  if (env.SCP_NEXT_USERNAME) result.username = env.SCP_NEXT_USERNAME;
-  if (env.SCP_NEXT_PASSWORD) result.password = env.SCP_NEXT_PASSWORD;
-  if (env.SCP_NEXT_PRIVATE_KEY) result.privateKey = env.SCP_NEXT_PRIVATE_KEY;
-  if (env.SCP_NEXT_PRIVATE_KEY_FILE) result.privateKeyFile = env.SCP_NEXT_PRIVATE_KEY_FILE;
-  if (env.SCP_NEXT_PASSPHRASE) result.passphrase = env.SCP_NEXT_PASSPHRASE;
-  if (env.SCP_NEXT_TIMEOUT) {
-    const timeout = parseInteger(env.SCP_NEXT_TIMEOUT, "SCP_NEXT_TIMEOUT");
-    if (timeout !== void 0) result.timeout = timeout;
-  }
-  if (env.SCP_NEXT_PROFILE) result.profile = env.SCP_NEXT_PROFILE;
-  return result;
+    const result = {};
+    if (env.SCP_NEXT_HOST)
+        result.host = env.SCP_NEXT_HOST;
+    if (env.SCP_NEXT_PORT) {
+        const port = parseInteger$1(env.SCP_NEXT_PORT, "SCP_NEXT_PORT");
+        if (port !== undefined)
+            result.port = port;
+    }
+    if (env.SCP_NEXT_USERNAME)
+        result.username = env.SCP_NEXT_USERNAME;
+    if (env.SCP_NEXT_PASSWORD)
+        result.password = env.SCP_NEXT_PASSWORD;
+    if (env.SCP_NEXT_PRIVATE_KEY)
+        result.privateKey = env.SCP_NEXT_PRIVATE_KEY;
+    if (env.SCP_NEXT_PRIVATE_KEY_FILE)
+        result.privateKeyFile = env.SCP_NEXT_PRIVATE_KEY_FILE;
+    if (env.SCP_NEXT_PASSPHRASE)
+        result.passphrase = env.SCP_NEXT_PASSPHRASE;
+    if (env.SCP_NEXT_TIMEOUT) {
+        const timeout = parseInteger$1(env.SCP_NEXT_TIMEOUT, "SCP_NEXT_TIMEOUT");
+        if (timeout !== undefined)
+            result.timeout = timeout;
+    }
+    if (env.SCP_NEXT_PROFILE)
+        result.profile = env.SCP_NEXT_PROFILE;
+    return result;
 }
 
-// src/config/load-config.ts
-import { access as access5, readFile as readFile3 } from "fs/promises";
-import path5 from "path";
-import { z } from "zod";
-var CONFIG_FILENAMES = ["scp-next.config.json", ".scp-nextrc", ".scp-nextrc.json"];
-var serverSchema = z.object({
-  host: z.string().optional(),
-  port: z.number().int().optional(),
-  username: z.string().optional(),
-  password: z.string().optional(),
-  privateKey: z.string().optional(),
-  privateKeyFile: z.string().optional(),
-  passphrase: z.string().optional(),
-  agent: z.string().optional(),
-  timeout: z.number().int().optional(),
-  hostFingerprint: z.string().optional(),
-  knownHostsFile: z.string().optional()
+const CONFIG_FILENAMES = ["scp-next.config.json", ".scp-nextrc", ".scp-nextrc.json"];
+const serverSchema = z.object({
+    host: z.string().optional(),
+    port: z.number().int().optional(),
+    username: z.string().optional(),
+    password: z.string().optional(),
+    privateKey: z.string().optional(),
+    privateKeyFile: z.string().optional(),
+    passphrase: z.string().optional(),
+    agent: z.string().optional(),
+    timeout: z.number().int().optional(),
+    hostFingerprint: z.string().optional(),
+    knownHostsFile: z.string().optional()
 });
-var transferSchema = z.object({
-  recursive: z.boolean().optional(),
-  overwrite: z.boolean().optional(),
-  createDirectories: z.boolean().optional(),
-  dryRun: z.boolean().optional(),
-  timeout: z.number().int().optional()
+const transferSchema = z.object({
+    recursive: z.boolean().optional(),
+    overwrite: z.boolean().optional(),
+    createDirectories: z.boolean().optional(),
+    dryRun: z.boolean().optional(),
+    timeout: z.number().int().optional(),
+    postUploadCommands: z
+        .array(z.string().refine((command) => command.trim().length > 0))
+        .optional()
 });
-var jobSchema = transferSchema.extend({
-  operation: z.enum(["upload", "download"]),
-  profile: z.string().optional(),
-  source: z.string(),
-  destination: z.string()
+const jobSchema = transferSchema.extend({
+    operation: z.enum(["upload", "download"]),
+    profile: z.string().optional(),
+    source: z.string(),
+    destination: z.string()
 });
-var configSchema = serverSchema.extend({
-  defaultProfile: z.string().optional(),
-  server: serverSchema.optional(),
-  transfer: transferSchema.optional(),
-  profiles: z.record(serverSchema).optional(),
-  jobs: z.record(jobSchema).optional()
-}).passthrough();
+const configSchema = serverSchema
+    .extend({
+    defaultProfile: z.string().optional(),
+    server: serverSchema.optional(),
+    transfer: transferSchema.optional(),
+    profiles: z.record(serverSchema).optional(),
+    jobs: z.record(jobSchema).optional()
+})
+    .passthrough();
 async function fileExists(filePath) {
-  try {
-    await access5(filePath);
-    return true;
-  } catch {
-    return false;
-  }
+    try {
+        await access(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
 }
 async function findConfigFile(cwd = process.cwd()) {
-  for (const filename of CONFIG_FILENAMES) {
-    const candidate = path5.resolve(cwd, filename);
-    if (await fileExists(candidate)) {
-      return candidate;
+    for (const filename of CONFIG_FILENAMES) {
+        const candidate = path.resolve(cwd, filename);
+        if (await fileExists(candidate)) {
+            return candidate;
+        }
     }
-  }
-  return void 0;
+    return undefined;
 }
 async function loadConfig(explicitPath, cwd = process.cwd()) {
-  const configPath = explicitPath ? resolveLocalPath(explicitPath, cwd) : await findConfigFile(cwd);
-  if (!configPath) {
-    return { config: {}, directory: cwd };
-  }
-  let raw;
-  try {
-    raw = await readFile3(configPath, "utf8");
-  } catch (error) {
-    throw new ConfigurationError(`Unable to read configuration file: ${configPath}`, {
-      cause: error,
-      context: { path: configPath }
-    });
-  }
-  try {
-    const parsed = JSON.parse(raw);
-    const result = configSchema.safeParse(parsed);
-    if (!result.success) {
-      throw new ConfigurationError(`Invalid configuration file: ${result.error.message}`, {
-        context: { path: configPath }
-      });
+    const configPath = explicitPath ? resolveLocalPath(explicitPath, cwd) : await findConfigFile(cwd);
+    if (!configPath) {
+        return { config: {}, directory: cwd };
     }
-    return {
-      config: result.data,
-      path: configPath,
-      directory: path5.dirname(configPath)
-    };
-  } catch (error) {
-    if (error instanceof ConfigurationError) {
-      throw error;
+    let raw;
+    try {
+        raw = await readFile(configPath, "utf8");
+    }
+    catch (error) {
+        throw new ConfigurationError(`Unable to read configuration file: ${configPath}`, {
+            cause: error,
+            context: { path: configPath }
+        });
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        const result = configSchema.safeParse(parsed);
+        if (!result.success) {
+            throw new ConfigurationError(`Invalid configuration file: ${result.error.message}`, {
+                context: { path: configPath }
+            });
+        }
+        return {
+            config: result.data,
+            path: configPath,
+            directory: path.dirname(configPath)
+        };
+    }
+    catch (error) {
+        if (error instanceof ConfigurationError) {
+            throw error;
+        }
+        throw new ConfigurationError(`Invalid JSON in configuration file: ${configPath}`, {
+            cause: error,
+            context: { path: configPath }
+        });
     }
-    throw new ConfigurationError(`Invalid JSON in configuration file: ${configPath}`, {
-      cause: error,
-      context: { path: configPath }
-    });
-  }
 }
 
-// src/config/resolve-config.ts
-import path6 from "path";
-
-// src/config/jobs.ts
 function selectJob(config, jobName) {
-  const job = config.jobs?.[jobName];
-  if (!job) {
-    throw new ConfigurationError(`Unknown job: ${jobName}`, {
-      context: { job: jobName }
-    });
-  }
-  return job;
+    const job = config.jobs?.[jobName];
+    if (!job) {
+        throw new ConfigurationError(`Unknown job: ${jobName}`, {
+            context: { job: jobName }
+        });
+    }
+    return job;
 }
 
-// src/config/profiles.ts
 function selectProfile(config, profileName) {
-  if (!profileName) {
-    return void 0;
-  }
-  const profile = config.profiles?.[profileName];
-  if (!profile) {
-    throw new ConfigurationError(`Unknown profile: ${profileName}`, {
-      context: { profile: profileName }
-    });
-  }
-  return profile;
+    if (!profileName) {
+        return undefined;
+    }
+    const profile = config.profiles?.[profileName];
+    if (!profile) {
+        throw new ConfigurationError(`Unknown profile: ${profileName}`, {
+            context: { profile: profileName }
+        });
+    }
+    return profile;
 }
 
-// src/config/resolve-config.ts
-var DEFAULT_TRANSFER = {
-  port: 22,
-  recursive: false,
-  overwrite: false,
-  createDirectories: true,
-  dryRun: false
+const DEFAULT_TRANSFER = {
+    port: 22,
+    recursive: false,
+    overwrite: false,
+    createDirectories: true,
+    dryRun: false
 };
-function assignDefined(target, source) {
-  if (!source) {
-    return target;
-  }
-  for (const [key, value] of Object.entries(source)) {
-    if (value !== void 0) {
-      Object.assign(target, { [key]: value });
-    }
-  }
-  return target;
-}
 function rootServer(config) {
-  const result = {};
-  assignDefined(result, config.server);
-  assignDefined(result, {
-    host: config.host,
-    port: config.port,
-    username: config.username,
-    password: config.password,
-    privateKey: config.privateKey,
-    privateKeyFile: config.privateKeyFile,
-    passphrase: config.passphrase,
-    agent: config.agent,
-    timeout: config.timeout,
-    hostFingerprint: config.hostFingerprint,
-    knownHostsFile: config.knownHostsFile
-  });
-  return result;
+    const result = {};
+    assignDefined(result, config.server);
+    assignDefined(result, {
+        host: config.host,
+        port: config.port,
+        username: config.username,
+        password: config.password,
+        privateKey: config.privateKey,
+        privateKeyFile: config.privateKeyFile,
+        passphrase: config.passphrase,
+        agent: config.agent,
+        timeout: config.timeout,
+        hostFingerprint: config.hostFingerprint,
+        knownHostsFile: config.knownHostsFile
+    });
+    return result;
 }
 function jobTransfer(job) {
-  const result = {};
-  if (!job) {
-    return result;
-  }
-  return assignDefined(result, {
-    recursive: job.recursive,
-    overwrite: job.overwrite,
-    createDirectories: job.createDirectories,
-    dryRun: job.dryRun,
-    timeout: job.timeout
-  });
+    const result = {};
+    if (!job) {
+        return result;
+    }
+    return assignDefined(result, {
+        recursive: job.recursive,
+        overwrite: job.overwrite,
+        createDirectories: job.createDirectories,
+        dryRun: job.dryRun,
+        timeout: job.timeout,
+        postUploadCommands: readPostUploadCommands(job)
+    });
 }
 function resolveConfigRelatedPaths(resolved, operation, configDirectory) {
-  const next = { ...resolved };
-  if (next.privateKeyFile && !next.privateKeyFile.startsWith("~")) {
-    next.privateKeyFile = path6.isAbsolute(next.privateKeyFile) ? next.privateKeyFile : resolveLocalPath(next.privateKeyFile, configDirectory);
-  }
-  if (next.knownHostsFile && !next.knownHostsFile.startsWith("~")) {
-    next.knownHostsFile = path6.isAbsolute(next.knownHostsFile) ? next.knownHostsFile : resolveLocalPath(next.knownHostsFile, configDirectory);
-  }
-  if (operation === "upload" && !next.source.startsWith("~")) {
-    next.source = path6.isAbsolute(next.source) ? next.source : resolveLocalPath(next.source, configDirectory);
-  }
-  if (operation === "download" && !next.destination.startsWith("~")) {
-    next.destination = path6.isAbsolute(next.destination) ? next.destination : resolveLocalPath(next.destination, configDirectory);
-  }
-  return next;
+    const next = { ...resolved };
+    if (next.privateKeyFile && !next.privateKeyFile.startsWith("~")) {
+        next.privateKeyFile = path.isAbsolute(next.privateKeyFile)
+            ? next.privateKeyFile
+            : resolveLocalPath(next.privateKeyFile, configDirectory);
+    }
+    if (next.knownHostsFile && !next.knownHostsFile.startsWith("~")) {
+        next.knownHostsFile = path.isAbsolute(next.knownHostsFile)
+            ? next.knownHostsFile
+            : resolveLocalPath(next.knownHostsFile, configDirectory);
+    }
+    if (operation === "upload" && !next.source.startsWith("~")) {
+        next.source = path.isAbsolute(next.source)
+            ? next.source
+            : resolveLocalPath(next.source, configDirectory);
+    }
+    if (operation === "download" && !next.destination.startsWith("~")) {
+        next.destination = path.isAbsolute(next.destination)
+            ? next.destination
+            : resolveLocalPath(next.destination, configDirectory);
+    }
+    return next;
 }
 function resolveTransferConfig(input) {
-  const config = input.config ?? {};
-  const env = input.env ?? {};
-  const cli = input.cli ?? {};
-  const configDirectory = input.configDirectory ?? process.cwd();
-  const cwd = input.cwd ?? process.cwd();
-  const job = input.jobName ? selectJob(config, input.jobName) : void 0;
-  const operation = input.operation ?? job?.operation;
-  if (!operation) {
-    throw new Error("Transfer operation is required.");
-  }
-  const selectedProfileName = cli.profile ?? env.profile ?? job?.profile ?? config.defaultProfile;
-  const profile = selectProfile(config, selectedProfileName);
-  const resolved = {
-    ...DEFAULT_TRANSFER,
-    operation,
-    source: job?.source ?? "",
-    destination: job?.destination ?? ""
-  };
-  assignDefined(resolved, jobTransfer(job));
-  assignDefined(resolved, config.transfer);
-  assignDefined(resolved, rootServer(config));
-  assignDefined(resolved, profile);
-  assignDefined(resolved, {
-    host: env.host,
-    port: env.port,
-    username: env.username,
-    password: env.password,
-    privateKey: env.privateKey,
-    privateKeyFile: env.privateKeyFile,
-    passphrase: env.passphrase,
-    timeout: env.timeout
-  });
-  assignDefined(resolved, {
-    source: input.source,
-    destination: input.destination
-  });
-  assignDefined(resolved, cli);
-  if (selectedProfileName) {
-    resolved.profile = selectedProfileName;
-  }
-  const pathResolved = resolveConfigRelatedPaths(resolved, operation, configDirectory);
-  if (input.source && operation === "upload") {
-    pathResolved.source = resolveLocalPath(input.source, cwd);
-  }
-  if (operation === "upload") {
-    pathResolved.destination = restoreMsysConvertedRemotePath(pathResolved.destination);
-  }
-  if (operation === "download") {
-    pathResolved.source = restoreMsysConvertedRemotePath(pathResolved.source);
-  }
-  if (input.destination && operation === "download") {
-    pathResolved.destination = resolveLocalPath(input.destination, cwd);
-  }
-  return pathResolved;
+    const config = input.config ?? {};
+    const env = input.env ?? {};
+    const cli = input.cli ?? {};
+    const configDirectory = input.configDirectory ?? process.cwd();
+    const cwd = input.cwd ?? process.cwd();
+    const job = input.jobName ? selectJob(config, input.jobName) : undefined;
+    const operation = input.operation ?? job?.operation;
+    if (!operation) {
+        throw new Error("Transfer operation is required.");
+    }
+    const selectedProfileName = cli.profile ?? env.profile ?? job?.profile ?? config.defaultProfile;
+    const profile = selectProfile(config, selectedProfileName);
+    const resolved = {
+        ...DEFAULT_TRANSFER,
+        operation,
+        source: job?.source ?? "",
+        destination: job?.destination ?? ""
+    };
+    assignDefined(resolved, jobTransfer(job));
+    assignDefined(resolved, config.transfer);
+    assignDefined(resolved, rootServer(config));
+    assignDefined(resolved, profile);
+    assignDefined(resolved, {
+        host: env.host,
+        port: env.port,
+        username: env.username,
+        password: env.password,
+        privateKey: env.privateKey,
+        privateKeyFile: env.privateKeyFile,
+        passphrase: env.passphrase,
+        timeout: env.timeout
+    });
+    if (input.source !== undefined)
+        resolved.source = input.source;
+    if (input.destination !== undefined)
+        resolved.destination = input.destination;
+    assignDefined(resolved, cli);
+    if (selectedProfileName) {
+        resolved.profile = selectedProfileName;
+    }
+    const pathResolved = resolveConfigRelatedPaths(resolved, operation, configDirectory);
+    getPostUploadCommands(pathResolved);
+    if (input.source && operation === "upload") {
+        pathResolved.source = resolveLocalPath(input.source, cwd);
+    }
+    if (operation === "upload") {
+        pathResolved.destination = restoreMsysConvertedRemotePath(pathResolved.destination);
+    }
+    if (operation === "download") {
+        pathResolved.source = restoreMsysConvertedRemotePath(pathResolved.source);
+        if (getPostUploadCommands(job)?.length ||
+            getPostUploadCommands(cli)?.length) {
+            throw new ValidationError("Post-upload commands are not supported for downloads.");
+        }
+        clearPostUploadCommands(pathResolved);
+    }
+    if (input.destination && operation === "download") {
+        pathResolved.destination = resolveLocalPath(input.destination, cwd);
+    }
+    return pathResolved;
 }
 
-// src/cli/output.ts
 function writeDryRun(output, config) {
-  const destination = config.operation === "upload" ? `${config.username ?? "user"}@${config.host ?? "host"}:${config.destination}` : config.destination;
-  output.stdout.write(`Dry run: ${config.operation}
-`);
-  output.stdout.write(`Source: ${config.source}
-`);
-  output.stdout.write(`Destination: ${destination}
-`);
-  output.stdout.write(`Recursive: ${config.recursive ? "yes" : "no"}
-`);
-  output.stdout.write(`Overwrite: ${config.overwrite ? "yes" : "no"}
-`);
+    const postUploadCommands = getPostUploadCommands(config) ?? [];
+    const destination = config.operation === "upload"
+        ? `${config.username ?? "user"}@${config.host ?? "host"}:${config.destination}`
+        : config.destination;
+    output.stdout.write(`Dry run: ${config.operation}\n`);
+    output.stdout.write(`Source: ${config.source}\n`);
+    output.stdout.write(`Destination: ${destination}\n`);
+    output.stdout.write(`Recursive: ${config.recursive ? "yes" : "no"}\n`);
+    output.stdout.write(`Overwrite: ${config.overwrite ? "yes" : "no"}\n`);
+    if (config.operation === "upload" && postUploadCommands.length > 0) {
+        output.stdout.write("\nPost-upload commands:\n");
+        postUploadCommands.forEach((command, index) => {
+            output.stdout.write(`${index + 1}. ${redactKnownSensitiveValues(command, config)}\n`);
+        });
+    }
+}
+function writeCommandResults(output, results, config) {
+    results.forEach((result, index) => {
+        output.stdout.write(`Remote command ${index + 1} completed successfully.\n`);
+        if (result.stdout) {
+            output.stdout.write(redactKnownSensitiveValues(result.stdout, config));
+            if (!result.stdout.endsWith("\n"))
+                output.stdout.write("\n");
+        }
+        if (result.stderr) {
+            output.stderr.write(redactKnownSensitiveValues(result.stderr, config));
+            if (!result.stderr.endsWith("\n"))
+                output.stderr.write("\n");
+        }
+    });
 }
 function createProgressReporter(output, quiet) {
-  if (quiet || !output.stderr.isTTY) {
-    return void 0;
-  }
-  const minimumUpdateIntervalMs = 500;
-  let lastLineLength = 0;
-  let lastPercentage;
-  let lastWriteAt = 0;
-  let completed = false;
-  return (progress) => {
-    if (completed) {
-      return;
-    }
-    const now = Date.now();
-    const totalBytes = progress.totalBytes;
-    const isComplete = progress.percentage === 100 || totalBytes !== void 0 && totalBytes > 0 && progress.transferredBytes >= totalBytes;
-    const percentageChanged = progress.percentage !== void 0 && progress.percentage !== lastPercentage;
-    if (!isComplete && !percentageChanged && lastWriteAt !== 0 && now - lastWriteAt < minimumUpdateIntervalMs) {
-      return;
-    }
-    const total = progress.totalBytes ? formatBytes(progress.totalBytes) : "?";
-    const transferred = formatBytes(progress.transferredBytes);
-    const percentage2 = progress.percentage === void 0 ? "" : ` (${progress.percentage}%)`;
-    const currentFile = progress.currentFile ? `: ${progress.currentFile}` : "";
-    const line = `${progress.operation === "upload" ? "Uploading" : "Downloading"}${currentFile} ${transferred} / ${total}${percentage2}`;
-    const padding = " ".repeat(Math.max(0, lastLineLength - line.length));
-    output.stderr.write(`\r${line}${padding}`);
-    lastLineLength = line.length;
-    lastPercentage = progress.percentage;
-    lastWriteAt = now;
-    if (isComplete) {
-      output.stderr.write("\n");
-      completed = true;
-    }
-  };
+    if (quiet || !output.stderr.isTTY) {
+        return undefined;
+    }
+    const minimumUpdateIntervalMs = 500;
+    let lastLineLength = 0;
+    let lastPercentage;
+    let lastWriteAt = 0;
+    let completed = false;
+    return (progress) => {
+        if (completed) {
+            return;
+        }
+        const now = Date.now();
+        const totalBytes = progress.totalBytes;
+        const isComplete = progress.percentage === 100 ||
+            (totalBytes !== undefined && totalBytes > 0 && progress.transferredBytes >= totalBytes);
+        const percentageChanged = progress.percentage !== undefined && progress.percentage !== lastPercentage;
+        if (!isComplete &&
+            !percentageChanged &&
+            lastWriteAt !== 0 &&
+            now - lastWriteAt < minimumUpdateIntervalMs) {
+            return;
+        }
+        const total = progress.totalBytes ? formatByteSize(progress.totalBytes) : "?";
+        const transferred = formatByteSize(progress.transferredBytes);
+        const percentage = progress.percentage === undefined ? "" : ` (${progress.percentage}%)`;
+        const currentFile = progress.currentFile ? `: ${progress.currentFile}` : "";
+        const line = `${progress.operation === "upload" ? "Uploading" : "Downloading"}${currentFile} ${transferred} / ${total}${percentage}`;
+        const padding = " ".repeat(Math.max(0, lastLineLength - line.length));
+        output.stderr.write(`\r${line}${padding}`);
+        lastLineLength = line.length;
+        lastPercentage = progress.percentage;
+        lastWriteAt = now;
+        if (isComplete) {
+            output.stderr.write("\n");
+            completed = true;
+        }
+    };
 }
 function verbosePlan(output, config) {
-  output.stderr.write(
-    `${JSON.stringify(
-      redactSensitiveValues({
+    const postUploadCommands = getPostUploadCommands(config);
+    output.stderr.write(`${JSON.stringify(redactSensitiveValues({
         operation: config.operation,
         host: config.host,
         port: config.port,
@@ -1327,241 +1669,260 @@ function verbosePlan(output, config) {
         recursive: config.recursive,
         overwrite: config.overwrite,
         createDirectories: config.createDirectories,
-        dryRun: config.dryRun
-      }),
-      null,
-      2
-    )}
-`
-  );
-}
-function formatBytes(bytes) {
-  if (bytes < 1024) {
-    return `${bytes} B`;
-  }
-  const units = ["KB", "MB", "GB", "TB"];
-  let value = bytes / 1024;
-  let unitIndex = 0;
-  while (value >= 1024 && unitIndex < units.length - 1) {
-    value /= 1024;
-    unitIndex += 1;
-  }
-  return `${value.toFixed(1)} ${units[unitIndex]}`;
+        dryRun: config.dryRun,
+        postUploadCommands: postUploadCommands?.map((_command, index) => `command-${index + 1}`)
+    }), null, 2)}\n`);
 }
 
-// src/cli/commands/shared.ts
-function addTransferOptions(command) {
-  command.option("--host <host>", "SSH server host");
-  command.addOption(new Option("--port <port>", "SSH server port").argParser(parseInteger2));
-  command.option("--username <username>", "SSH username");
-  command.option("--password <password>", "SSH password (prefer environment variables or key files)");
-  command.option("--private-key <privateKey>", "Private-key content");
-  command.option("--private-key-file <privateKeyFile>", "Private-key file path");
-  command.option("--passphrase <passphrase>", "Private-key passphrase");
-  command.option("--config <path>", "Configuration file path");
-  command.option("--profile <name>", "Named server profile");
-  command.option("--recursive", "Transfer directories recursively");
-  command.option("--overwrite", "Overwrite existing destination files");
-  command.option("--create-directories", "Create missing destination directories");
-  command.option("--no-create-directories", "Do not create missing destination directories");
-  command.option("--dry-run", "Resolve and validate without connecting or transferring");
-  command.addOption(new Option("--timeout <milliseconds>", "Connection/operation timeout").argParser(parseInteger2));
-  command.option("--verbose", "Print verbose diagnostic output");
-  command.option("--quiet", "Disable progress and non-error output");
-  return command;
-}
-function parseInteger2(value) {
-  const parsed = Number.parseInt(value, 10);
-  if (!Number.isFinite(parsed)) {
-    throw new Error("Expected a number.");
-  }
-  return parsed;
+function addTransferOptions(command, options = {}) {
+    command.option("--host <host>", "SSH server host");
+    command.addOption(new Option("--port <port>", "SSH server port").argParser(parseInteger));
+    command.option("--username <username>", "SSH username");
+    command.option("--password <password>", "SSH password (prefer environment variables or key files)");
+    command.option("--private-key <privateKey>", "Private-key content");
+    command.option("--private-key-file <privateKeyFile>", "Private-key file path");
+    command.option("--passphrase <passphrase>", "Private-key passphrase");
+    command.option("--config <path>", "Configuration file path");
+    command.option("--profile <name>", "Named server profile");
+    command.option("--recursive", "Transfer directories recursively");
+    command.option("--overwrite", "Overwrite existing destination files");
+    command.option("--create-directories", "Create missing destination directories");
+    command.option("--no-create-directories", "Do not create missing destination directories");
+    command.option("--dry-run", "Resolve and validate without connecting or transferring");
+    command.addOption(new Option("--timeout <milliseconds>", "SSH connection ready timeout").argParser(parseInteger));
+    command.option("--verbose", "Print verbose diagnostic output");
+    command.option("--quiet", "Disable progress and non-error output");
+    if (options.postUploadCommand) {
+        command.option("--post-upload-command <command>", "Run a remote command after a successful upload (repeatable)", collectValues);
+    }
+    return command;
+}
+function parseInteger(value) {
+    const parsed = Number.parseInt(value, 10);
+    if (!Number.isFinite(parsed)) {
+        throw new Error("Expected a number.");
+    }
+    return parsed;
+}
+function collectValues(value, previous) {
+    return [...(previous ?? []), value];
 }
 function toCliOptions(options) {
-  return {
-    host: options.host,
-    port: options.port,
-    username: options.username,
-    password: options.password,
-    privateKey: options.privateKey,
-    privateKeyFile: options.privateKeyFile,
-    passphrase: options.passphrase,
-    profile: options.profile,
-    recursive: options.recursive,
-    overwrite: options.overwrite,
-    createDirectories: options.createDirectories,
-    dryRun: options.dryRun,
-    timeout: options.timeout
-  };
+    return {
+        host: options.host,
+        port: options.port,
+        username: options.username,
+        password: options.password,
+        privateKey: options.privateKey,
+        privateKeyFile: options.privateKeyFile,
+        passphrase: options.passphrase,
+        profile: options.profile,
+        recursive: options.recursive,
+        overwrite: options.overwrite,
+        createDirectories: options.createDirectories,
+        dryRun: options.dryRun,
+        timeout: options.timeout,
+        postUploadCommands: options.postUploadCommand
+    };
 }
 async function resolveForCli(input) {
-  const loaded = await loadConfig(input.options.config, input.cwd);
-  return resolveTransferConfig({
-    operation: input.operation,
-    source: input.source,
-    destination: input.destination,
-    jobName: input.jobName,
-    cli: toCliOptions(input.options),
-    env: readEnvironment(),
-    config: loaded.config,
-    configDirectory: loaded.directory,
-    cwd: input.cwd
-  });
+    if (input.options.postUploadCommand?.some((command) => !command.trim())) {
+        throw new ValidationError("Each --post-upload-command value must be a non-empty command.");
+    }
+    const loaded = await loadConfig(input.options.config, input.cwd);
+    return resolveTransferConfig({
+        operation: input.operation,
+        source: input.source,
+        destination: input.destination,
+        jobName: input.jobName,
+        cli: toCliOptions(input.options),
+        env: readEnvironment(),
+        config: loaded.config,
+        configDirectory: loaded.directory,
+        cwd: input.cwd
+    });
 }
 async function executeResolvedTransfer(config, handlers, output, commandOptions) {
-  if (commandOptions.verbose) {
-    verbosePlan(output, config);
-  }
-  if (config.dryRun) {
-    if (!commandOptions.quiet) {
-      writeDryRun(output, config);
-    }
-    return;
-  }
-  const onProgress = createProgressReporter(output, commandOptions.quiet);
-  if (config.operation === "upload") {
-    const uploadOptions = {
-      ...config,
-      localPath: config.source,
-      remotePath: config.destination
+    if (commandOptions.verbose) {
+        verbosePlan(output, config);
+    }
+    if (config.dryRun) {
+        if (!commandOptions.quiet) {
+            writeDryRun(output, config);
+        }
+        return;
+    }
+    const onProgress = createProgressReporter(output, commandOptions.quiet);
+    if (config.operation === "upload") {
+        const uploadOptions = {
+            ...config,
+            localPath: config.source,
+            remotePath: config.destination
+        };
+        if (onProgress)
+            uploadOptions.onProgress = onProgress;
+        const results = await handlers.upload(uploadOptions);
+        if (!commandOptions.quiet) {
+            writeCommandResults(output, results, config);
+        }
+        return;
+    }
+    const downloadOptions = {
+        ...config,
+        remotePath: config.source,
+        localPath: config.destination
     };
-    if (onProgress) uploadOptions.onProgress = onProgress;
-    await handlers.upload(uploadOptions);
-    return;
-  }
-  const downloadOptions = {
-    ...config,
-    remotePath: config.source,
-    localPath: config.destination
-  };
-  if (onProgress) downloadOptions.onProgress = onProgress;
-  await handlers.download(downloadOptions);
+    if (onProgress)
+        downloadOptions.onProgress = onProgress;
+    await handlers.download(downloadOptions);
 }
 
-// src/cli/commands/download.ts
 function createDownloadCommand(handlers, output, cwd) {
-  const command = new Command("download").description("Download a remote source path to a local destination path").usage("<source> <destination> [options]").argument("[source]", "Remote file or directory path").argument("[destination]", "Local file or directory").action(async (source, destination, options) => {
-    assertSourceDestination("download", source, destination);
-    const resolved = await resolveForCli({
-      operation: "download",
-      source,
-      destination,
-      options,
-      cwd
+    const command = new Command("download")
+        .description("Download a remote source path to a local destination path")
+        .usage("<source> <destination> [options]")
+        .argument("[source]", "Remote file or directory path")
+        .argument("[destination]", "Local file or directory")
+        .action(async (source, destination, options) => {
+        assertSourceDestination("download", source, destination);
+        const resolved = await resolveForCli({
+            operation: "download",
+            source,
+            destination,
+            options,
+            cwd
+        });
+        await executeResolvedTransfer(resolved, handlers, output, options);
     });
-    await executeResolvedTransfer(resolved, handlers, output, options);
-  });
-  addTransferOptions(command);
-  return command;
+    addTransferOptions(command);
+    return command;
 }
 
-// src/cli/commands/run.ts
-import { Command as Command2 } from "commander";
 function createRunCommand(handlers, output, cwd) {
-  const command = new Command2("run").description("Run a configured transfer job").usage("<job> [source] [destination] [options]").argument("<job>", "Configured job name").argument("[source]", "Optional source override").argument("[destination]", "Optional destination override").action(
-    async (jobName, source, destination, options) => {
-      const resolved = await resolveForCli({
-        source,
-        destination,
-        jobName,
-        options,
-        cwd
-      });
-      await executeResolvedTransfer(resolved, handlers, output, options);
-    }
-  );
-  addTransferOptions(command);
-  return command;
+    const command = new Command("run")
+        .description("Run a configured transfer job")
+        .usage("<job> [source] [destination] [options]")
+        .argument("<job>", "Configured job name")
+        .argument("[source]", "Optional source override")
+        .argument("[destination]", "Optional destination override")
+        .action(async (jobName, source, destination, options) => {
+        const resolved = await resolveForCli({
+            source,
+            destination,
+            jobName,
+            options,
+            cwd
+        });
+        await executeResolvedTransfer(resolved, handlers, output, options);
+    });
+    addTransferOptions(command, { postUploadCommand: true });
+    return command;
 }
 
-// src/cli/commands/upload.ts
-import { Command as Command3 } from "commander";
 function createUploadCommand(handlers, output, cwd) {
-  const command = new Command3("upload").description("Upload a local source path to a remote destination path").usage("<source> <destination> [options]").argument("[source]", "Local file or directory").argument("[destination]", "Remote file or directory path").action(async (source, destination, options) => {
-    assertSourceDestination("upload", source, destination);
-    const resolved = await resolveForCli({
-      operation: "upload",
-      source,
-      destination,
-      options,
-      cwd
+    const command = new Command("upload")
+        .description("Upload a local source path to a remote destination path")
+        .usage("<source> <destination> [options]")
+        .argument("[source]", "Local file or directory")
+        .argument("[destination]", "Remote file or directory path")
+        .action(async (source, destination, options) => {
+        assertSourceDestination("upload", source, destination);
+        const resolved = await resolveForCli({
+            operation: "upload",
+            source,
+            destination,
+            options,
+            cwd
+        });
+        await executeResolvedTransfer(resolved, handlers, output, options);
     });
-    await executeResolvedTransfer(resolved, handlers, output, options);
-  });
-  addTransferOptions(command);
-  return command;
+    addTransferOptions(command, { postUploadCommand: true });
+    return command;
 }
 
-// src/cli/index.ts
 function readPackageVersion(currentModuleUrl = import.meta.url) {
-  const currentFile = fileURLToPath(currentModuleUrl);
-  const packageJsonPath = resolve(dirname(currentFile), "..", "..", "package.json");
-  const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf8"));
-  return packageJson.version ?? "0.0.0";
+    const currentFile = fileURLToPath(currentModuleUrl);
+    const packageJsonPath = resolve(dirname(currentFile), "..", "..", "package.json");
+    const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf8"));
+    return packageJson.version ?? "0.0.0";
 }
 function isCliEntrypoint(currentModuleUrl = import.meta.url, argv = process.argv) {
-  const executedFile = argv[1];
-  if (!executedFile) {
-    return false;
-  }
-  try {
-    return realpathSync(fileURLToPath(currentModuleUrl)) === realpathSync(executedFile);
-  } catch {
-    return false;
-  }
+    const executedFile = argv[1];
+    if (!executedFile) {
+        return false;
+    }
+    try {
+        return realpathSync(fileURLToPath(currentModuleUrl)) === realpathSync(executedFile);
+    }
+    catch {
+        return false;
+    }
 }
 async function runCli(options = {}) {
-  const output = options.output ?? { stdout: process.stdout, stderr: process.stderr };
-  const cwd = options.cwd ?? process.cwd();
-  const handlers = options.handlers ?? { upload, download };
-  const program = new Command4();
-  program.name("scp-next").description("Secure file transfers over SSH using SFTP").version(readPackageVersion()).configureOutput({
-    writeOut: (message) => output.stdout.write(message),
-    writeErr: (message) => output.stderr.write(message)
-  }).configureHelp({
-    subcommandTerm: (command) => `${command.name()} ${command.usage()}`
-  }).showHelpAfterError().exitOverride();
-  program.addCommand(createUploadCommand(handlers, output, cwd));
-  program.addCommand(createDownloadCommand(handlers, output, cwd));
-  program.addCommand(createRunCommand(handlers, output, cwd));
-  try {
-    await program.parseAsync(options.argv ?? process.argv, { from: "node" });
-    return 0;
-  } catch (error) {
-    if (error instanceof CommanderError) {
-      if (error.code === "commander.helpDisplayed" || error.code === "commander.version") {
+    const output = options.output ?? { stdout: process.stdout, stderr: process.stderr };
+    const cwd = options.cwd ?? process.cwd();
+    const handlers = options.handlers ?? { upload, download };
+    const program = new Command();
+    program
+        .name("scp-next")
+        .description("Secure file transfers over SSH using SFTP")
+        .version(readPackageVersion())
+        .configureOutput({
+        writeOut: (message) => output.stdout.write(message),
+        writeErr: (message) => output.stderr.write(message)
+    })
+        .configureHelp({
+        subcommandTerm: (command) => `${command.name()} ${command.usage()}`
+    })
+        .showHelpAfterError()
+        .exitOverride();
+    program.addCommand(createUploadCommand(handlers, output, cwd));
+    program.addCommand(createDownloadCommand(handlers, output, cwd));
+    program.addCommand(createRunCommand(handlers, output, cwd));
+    try {
+        await program.parseAsync(options.argv ?? process.argv, { from: "node" });
         return 0;
-      }
-      output.stderr.write(`${formatErrorMessage(error.message)}
-`);
-      return error.exitCode || 1;
     }
-    const verbose = (options.argv ?? process.argv).includes("--verbose");
-    if (error instanceof ScpNextError) {
-      output.stderr.write(`Error: ${formatErrorMessage(error.message)}
-`);
-      if (verbose && error.cause instanceof Error) {
-        output.stderr.write(`${formatErrorMessage(error.cause.stack ?? error.cause.message)}
-`);
-      }
-      return 1;
-    }
-    output.stderr.write(`Error: ${formatErrorMessage(error)}
-`);
-    if (verbose && error instanceof Error && error.stack) {
-      output.stderr.write(`${formatErrorMessage(error.stack)}
-`);
-    }
-    return 1;
-  }
+    catch (error) {
+        if (error instanceof CommanderError) {
+            if (error.code === "commander.helpDisplayed" || error.code === "commander.version") {
+                return 0;
+            }
+            output.stderr.write(`${formatErrorMessage(error.message)}\n`);
+            return error.exitCode || 1;
+        }
+        const verbose = (options.argv ?? process.argv).includes("--verbose");
+        if (error instanceof RemoteCommandError) {
+            if (error.stdout) {
+                output.stdout.write(redactKnownSensitiveValues(error.stdout, {}));
+                if (!error.stdout.endsWith("\n"))
+                    output.stdout.write("\n");
+            }
+            if (error.stderr) {
+                output.stderr.write(redactKnownSensitiveValues(error.stderr, {}));
+                if (!error.stderr.endsWith("\n"))
+                    output.stderr.write("\n");
+            }
+        }
+        if (error instanceof ScpNextError) {
+            output.stderr.write(`Error: ${formatErrorMessage(error.message)}\n`);
+            if (verbose && error.cause instanceof Error) {
+                output.stderr.write(`${formatErrorMessage(error.cause.stack ?? error.cause.message)}\n`);
+            }
+            return 1;
+        }
+        output.stderr.write(`Error: ${formatErrorMessage(error)}\n`);
+        if (verbose && error instanceof Error && error.stack) {
+            output.stderr.write(`${formatErrorMessage(error.stack)}\n`);
+        }
+        return 1;
+    }
 }
 if (isCliEntrypoint()) {
-  void runCli().then((exitCode) => {
-    process.exitCode = exitCode;
-  });
+    void runCli().then((exitCode) => {
+        process.exitCode = exitCode;
+    });
 }
-export {
-  isCliEntrypoint,
-  runCli
-};
-//# sourceMappingURL=index.js.map
+
+export { isCliEntrypoint, runCli };
+//# sourceMappingURL=index.js.map