@rine-network/cli 0.1.0 → 0.3.0

package/dist/main.js

@@ -2,8 +2,25 @@ import { createRequire } from "node:module";
 import { Command } from "commander";
 import * as fs from "node:fs";
 import { join } from "node:path";
+import { ed25519, x25519 } from "@noble/curves/ed25519.js";
 import readline from "node:readline";
+import { Aes256Gcm, CipherSuite, HkdfSha256 } from "@hpke/core";
+import { DhkemX25519HkdfSha256 } from "@hpke/dhkem-x25519";
+import { hmac } from "@noble/hashes/hmac.js";
+import { sha256 } from "@noble/hashes/sha2.js";
 import { createEventSource } from "eventsource-client";
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
 //#region src/errors.ts
 var RineApiError = class extends Error {
 	constructor(status, detail, raw) {
@@ -67,6 +84,14 @@ function saveTokenCache(cache) {
 	ensureDir(dir);
 	writeAtomic(join(dir, "token_cache.json"), JSON.stringify(cache, null, 2));
 }
+function cacheToken(profile, token) {
+	const cache = loadTokenCache();
+	cache[profile] = {
+		access_token: token.access_token,
+		expires_at: Date.now() / 1e3 + token.expires_in
+	};
+	saveTokenCache(cache);
+}
 /**
 * Resolves credentials for a profile. Priority:
 * 1. RINE_CLIENT_ID + RINE_CLIENT_SECRET env vars (both required)
@@ -96,10 +121,12 @@ var HttpClient = class {
 	baseUrl;
 	tokenFn;
 	canRefresh;
+	defaultHeaders;
 	constructor(opts) {
-		this.baseUrl = (opts.apiUrl ?? getApiUrl()).replace(/\/$/, "");
+		this.baseUrl = opts.apiUrl ?? getApiUrl();
 		this.tokenFn = opts.tokenFn;
 		this.canRefresh = opts.canRefresh ?? true;
+		this.defaultHeaders = opts.defaultHeaders ?? {};
 	}
 	async request(method, path, body, params, extraHeaders) {
 		let url = this.baseUrl + path;
@@ -110,6 +137,7 @@ var HttpClient = class {
 		const doFetch = async (force) => {
 			const headers = {
 				Authorization: `Bearer ${await this.tokenFn(force)}`,
+				...this.defaultHeaders,
 				...extraHeaders
 			};
 			if (body !== void 0) headers["Content-Type"] = "application/json";
@@ -129,20 +157,32 @@ var HttpClient = class {
 		if (res.status === 204) return void 0;
 		return res.json();
 	}
-	get(path, params) {
-		return this.request("GET", path, void 0, params);
+	get(path, params, extraHeaders) {
+		return this.request("GET", path, void 0, params, extraHeaders);
 	}
 	post(path, body, extraHeaders) {
 		return this.request("POST", path, body, void 0, extraHeaders);
 	}
-	put(path, body) {
-		return this.request("PUT", path, body);
+	put(path, body, extraHeaders) {
+		return this.request("PUT", path, body, void 0, extraHeaders);
+	}
+	patch(path, body, extraHeaders) {
+		return this.request("PATCH", path, body, void 0, extraHeaders);
 	}
-	patch(path, body) {
-		return this.request("PATCH", path, body);
+	delete(path, extraHeaders) {
+		return this.request("DELETE", path, void 0, void 0, extraHeaders);
 	}
-	delete(path) {
-		return this.request("DELETE", path);
+	/** Unauthenticated GET for public endpoints (e.g. /directory/*). */
+	static async publicGet(path, params) {
+		const base = getApiUrl();
+		const qs = params?.toString();
+		const url = qs ? `${base}${path}?${qs}` : `${base}${path}`;
+		const res = await fetch(url, { headers: { Accept: "application/json" } });
+		if (!res.ok) {
+			const detail = await parseErrorDetail(res);
+			throw new RineApiError(res.status, detail, res);
+		}
+		return res.json();
 	}
 };
 /**
@@ -151,6 +191,27 @@ var HttpClient = class {
 * 2. Token cache — returned if not expired (60s margin)
 * 3. POST /oauth/token — fetches fresh token and caches it
 */
+/**
+* Fetches an OAuth token from POST /oauth/token.
+* Shared by getOrRefreshToken, login, and register.
+*/
+async function fetchOAuthToken(clientId, clientSecret) {
+	const apiUrl = getApiUrl();
+	const res = await fetch(`${apiUrl}/oauth/token`, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			grant_type: "client_credentials",
+			client_id: clientId,
+			client_secret: clientSecret
+		}).toString()
+	});
+	if (!res.ok) {
+		const body = await res.json().catch(() => ({}));
+		throw new RineApiError(res.status, body.detail ?? "Token request failed");
+	}
+	return res.json();
+}
 async function getOrRefreshToken(entry, profileName, force = false) {
 	const envToken = process.env.RINE_TOKEN;
 	if (envToken) return envToken;
@@ -160,28 +221,11 @@ async function getOrRefreshToken(entry, profileName, force = false) {
 		if (cached !== void 0 && cached.expires_at - now > 60) return cached.access_token;
 	}
 	if (!entry) throw new RineApiError(0, "No credentials found. Run `rine login` first.");
-	const apiUrl = getApiUrl();
-	const res = await fetch(`${apiUrl}/oauth/token`, {
-		method: "POST",
-		headers: { "Content-Type": "application/x-www-form-urlencoded" },
-		body: new URLSearchParams({
-			grant_type: "client_credentials",
-			client_id: entry.client_id,
-			client_secret: entry.client_secret
-		}).toString()
-	});
-	if (!res.ok) throw new RineApiError(res.status, "Token refresh failed");
-	const data = await res.json();
-	const freshNow = Date.now() / 1e3;
-	const cache = loadTokenCache();
-	cache[profileName] = {
-		access_token: data.access_token,
-		expires_at: freshNow + data.expires_in
-	};
-	saveTokenCache(cache);
+	const data = await fetchOAuthToken(entry.client_id, entry.client_secret);
+	cacheToken(profileName, data);
 	return data.access_token;
 }
-async function createClient(profileFlag) {
+async function createClient(profileFlag, defaultHeaders) {
 	const profileName = profileFlag ?? "default";
 	const entry = getCredentialEntry(profileName);
 	const canRefresh = !process.env.RINE_TOKEN && entry !== void 0;
@@ -189,7 +233,8 @@ async function createClient(profileFlag) {
 	return {
 		client: new HttpClient({
 			tokenFn,
-			canRefresh
+			canRefresh,
+			defaultHeaders
 		}),
 		profileName,
 		entry
@@ -234,31 +279,98 @@ function printText(msg) {
 function printError(msg) {
 	console.error(msg);
 }
-function printResult(data, opts) {
-	if (opts.json) {
-		printJson(data);
-		return;
-	}
-	if (opts.table && Array.isArray(data)) {
-		printTable(data);
-		return;
-	}
-	if (Array.isArray(data)) for (const item of data) {
-		printObject(item);
-		console.log("---");
-	}
-	else printObject(data);
+//#endregion
+//#region src/resolve-handle.ts
+const UUID_ALIAS_RE = /\/agents\/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+* Resolves a handle (e.g. "agent@org.rine.network") to a UUID
+* via WebFinger (RFC 7033).
+*
+* Returns the UUID string on success, or the original input unchanged
+* on failure (caller validates UUID format and reports the error).
+*/
+async function resolveHandleViaWebFinger(handle) {
+	try {
+		const params = new URLSearchParams({ resource: `acct:${handle}` });
+		const data = await HttpClient.publicGet("/.well-known/webfinger", params);
+		for (const alias of data.aliases ?? []) {
+			const match = UUID_ALIAS_RE.exec(alias);
+			if (match?.[1]) return match[1];
+		}
+	} catch {}
+	return handle;
 }
-function printObject(data) {
-	if (data === null || data === void 0) return;
-	if (typeof data !== "object") {
-		console.log(String(data));
-		return;
-	}
-	for (const [k, v] of Object.entries(data)) {
-		const val = typeof v === "object" ? JSON.stringify(v) : String(v ?? "");
-		console.log(`${k}: ${val}`);
+//#endregion
+//#region src/resolve-agent.ts
+let cached;
+/**
+* Resolve a value that may be a UUID or a handle (containing @) to a UUID.
+* Handles are resolved via WebFinger. Required because local key storage
+* is indexed by UUID.
+*/
+async function resolveToUuid(value) {
+	if (!value.includes("@")) return value;
+	const resolved = await resolveHandleViaWebFinger(value);
+	if (!UUID_RE.test(resolved)) throw new Error(`Cannot resolve handle "${value}" to agent ID. Ensure WebFinger is available or use a UUID.`);
+	return resolved;
+}
+/**
+* Resolve which agent ID to use.
+* Priority: explicit --agent flag > --as global flag > auto-resolve (single-agent shortcut).
+* Accepts both UUIDs and handles (e.g. "bot@org.rine.network").
+*/
+async function resolveAgent(client, explicit, asFlag) {
+	if (explicit) return resolveToUuid(explicit);
+	if (asFlag) return resolveToUuid(asFlag);
+	if (cached === void 0) cached = (await client.get("/agents")).items;
+	if (cached.length === 1) {
+		const agent = cached[0];
+		if (agent) return agent.id;
 	}
+	if (cached.length === 0) throw new Error("No active agents. Create one with 'rine agent create --name <name>'");
+	const lines = cached.map((a) => `  ${a.id}  ${a.handle}`).join("\n");
+	throw new Error(`Multiple agents found. Specify with --agent <uuid>:\n${lines}`);
+}
+//#endregion
+//#region src/action.ts
+/**
+* Wraps a command action with automatic client creation and error handling.
+* Commander calls action(fn) with positional args first, then the options object.
+* This wrapper forwards all arguments to the inner function.
+*/
+function withClient(program, fn) {
+	return async (...args) => {
+		try {
+			const gOpts = program.opts();
+			const defaultHeaders = {};
+			if (gOpts.as) defaultHeaders["X-Rine-Agent"] = await resolveToUuid(gOpts.as);
+			const { client, profileName } = await createClient(gOpts.profile, defaultHeaders);
+			await fn({
+				client,
+				gOpts,
+				profileName,
+				extraHeaders: defaultHeaders
+			}, ...args);
+		} catch (err) {
+			printError(formatError(err));
+			process.exitCode = 1;
+		}
+	};
+}
+/**
+* Wraps a command action with error handling only (no client creation).
+* For commands like logout that don't need authentication.
+*/
+function withErrorHandler(program, fn) {
+	return async (...args) => {
+		try {
+			await fn(program.opts(), ...args);
+		} catch (err) {
+			printError(formatError(err));
+			process.exitCode = 1;
+		}
+	};
 }
 //#endregion
 //#region src/commands/agent-profile.ts
@@ -307,6 +419,11 @@ function toRow(card) {
 		Updated: String(card.updated_at ?? "—")
 	};
 }
+async function updateCard(client, agentId, modify) {
+	const card = await client.get(`/agents/${agentId}/card`);
+	const updated = modify(card) ?? card;
+	return await client.put(`/agents/${agentId}/card`, stripReadOnly(updated));
+}
 function getAgentCmd(program) {
 	const cmd = program.commands.find((c) => c.name() === "agent");
 	if (!cmd) throw new Error("registerAgent must be called before registerAgentProfile");
@@ -314,109 +431,177 @@ function getAgentCmd(program) {
 }
 function registerAgentProfile(program) {
 	const agent = getAgentCmd(program);
-	agent.command("profile").description("Get agent card").argument("<agent-id>", "Agent ID").action(async (agentId) => {
-		try {
-			const gOpts = program.opts();
-			const { client } = await createClient(gOpts.profile);
-			const card = await client.get(`/agents/${agentId}/card`);
-			if (gOpts.json) printJson(card);
-			else printTable([toRow(card)]);
-		} catch (err) {
-			printError(formatError(err));
-			process.exitCode = 1;
-		}
-	});
-	agent.command("describe").description("Update agent description").argument("<agent-id>", "Agent ID").requiredOption("--description <desc>", "Agent description").action(async (agentId, opts) => {
-		try {
-			const gOpts = program.opts();
-			const { client } = await createClient(gOpts.profile);
-			const card = await client.get(`/agents/${agentId}/card`);
+	agent.command("profile").description("Get agent card").argument("<agent-id>", "Agent ID").action(withClient(program, async ({ client, gOpts }, agentId) => {
+		const card = await client.get(`/agents/${agentId}/card`);
+		if (gOpts.json) printJson(card);
+		else printTable([toRow(card)]);
+	}));
+	agent.command("describe").description("Update agent description").argument("<agent-id>", "Agent ID").requiredOption("--description <desc>", "Agent description").action(withClient(program, async ({ client, gOpts }, agentId, opts) => {
+		const result = await updateCard(client, agentId, (card) => {
 			card.description = opts.description;
-			await client.put(`/agents/${agentId}/card`, stripReadOnly(card));
-			printMutationOk("Description updated", gOpts.json);
-		} catch (err) {
-			printError(formatError(err));
-			process.exitCode = 1;
-		}
-	});
-	agent.command("add-skill").description("Add a skill to the agent card").argument("<agent-id>", "Agent ID").requiredOption("--skill-id <id>", "Skill ID").requiredOption("--skill-name <name>", "Skill name").option("--skill-description <desc>", "Skill description").option("--tags <tags>", "Comma-separated tags").option("--examples <examples>", "Comma-separated examples").option("--input-modes <modes>", "Comma-separated input modes").option("--output-modes <modes>", "Comma-separated output modes").action(async (agentId, opts) => {
-		try {
-			const gOpts = program.opts();
-			const { client } = await createClient(gOpts.profile);
-			const card = await client.get(`/agents/${agentId}/card`);
+		});
+		if (gOpts.json) printJson(result);
+		else printSuccess("Description updated");
+	}));
+	agent.command("add-skill").description("Add a skill to the agent card").argument("<agent-id>", "Agent ID").requiredOption("--skill-id <id>", "Skill ID").requiredOption("--skill-name <name>", "Skill name").option("--skill-description <desc>", "Skill description").option("--tags <tags>", "Comma-separated tags").option("--examples <examples>", "Comma-separated examples").option("--input-modes <modes>", "Comma-separated input modes").option("--output-modes <modes>", "Comma-separated output modes").action(withClient(program, async ({ client, gOpts }, agentId, opts) => {
+		const result = await updateCard(client, agentId, (card) => {
 			const skill = {
 				id: opts.skillId,
-				name: opts.skillName
+				name: opts.skillName,
+				description: opts.skillDescription ?? "",
+				tags: opts.tags ? opts.tags.split(",").map((t) => t.trim()) : []
 			};
-			if (opts.skillDescription) skill.description = opts.skillDescription;
-			if (opts.tags) skill.tags = opts.tags.split(",").map((t) => t.trim());
 			if (opts.examples) skill.examples = opts.examples.split(",").map((e) => e.trim());
 			if (opts.inputModes) skill.inputModes = opts.inputModes.split(",").map((m) => m.trim());
 			if (opts.outputModes) skill.outputModes = opts.outputModes.split(",").map((m) => m.trim());
 			card.skills = [...Array.isArray(card.skills) ? card.skills : [], skill];
-			await client.put(`/agents/${agentId}/card`, stripReadOnly(card));
-			printMutationOk("Skill added", gOpts.json);
-		} catch (err) {
-			printError(formatError(err));
-			process.exitCode = 1;
-		}
-	});
-	agent.command("set-categories").description("Set agent categories").argument("<agent-id>", "Agent ID").requiredOption("--categories <cats>", "Comma-separated category names").action(async (agentId, opts) => {
-		try {
-			const gOpts = program.opts();
-			const { client } = await createClient(gOpts.profile);
-			const card = await client.get(`/agents/${agentId}/card`);
-			const cats = opts.categories.split(",").map((c) => c.trim());
-			await client.put(`/agents/${agentId}/card`, stripReadOnly(setRineField(card, "categories", cats)));
-			printMutationOk("Categories updated", gOpts.json);
-		} catch (err) {
-			printError(formatError(err));
-			process.exitCode = 1;
-		}
-	});
-	agent.command("set-languages").description("Set agent supported languages").argument("<agent-id>", "Agent ID").requiredOption("--languages <langs>", "Comma-separated language codes").action(async (agentId, opts) => {
-		try {
-			const gOpts = program.opts();
-			const { client } = await createClient(gOpts.profile);
-			const card = await client.get(`/agents/${agentId}/card`);
-			const langs = opts.languages.split(",").map((l) => l.trim());
-			await client.put(`/agents/${agentId}/card`, stripReadOnly(setRineField(card, "languages", langs)));
-			printMutationOk("Languages updated", gOpts.json);
-		} catch (err) {
-			printError(formatError(err));
-			process.exitCode = 1;
-		}
-	});
-	agent.command("set-pricing").description("Set agent pricing model").argument("<agent-id>", "Agent ID").requiredOption("--model <model>", `Pricing model (${VALID_PRICING.join("|")})`).action(async (agentId, opts) => {
-		try {
-			const gOpts = program.opts();
-			if (!VALID_PRICING.includes(opts.model)) {
-				printError(`Invalid pricing model '${opts.model}'. Valid: ${VALID_PRICING.join(", ")}`);
-				process.exitCode = 2;
-				return;
-			}
-			const { client } = await createClient(gOpts.profile);
-			const card = await client.get(`/agents/${agentId}/card`);
-			await client.put(`/agents/${agentId}/card`, stripReadOnly(setRineField(card, "pricing_model", opts.model)));
-			printMutationOk("Pricing updated", gOpts.json);
-		} catch (err) {
-			printError(formatError(err));
-			process.exitCode = 1;
+		});
+		if (gOpts.json) printJson(result);
+		else printSuccess("Skill added");
+	}));
+	agent.command("set-categories").description("Set agent categories").argument("<agent-id>", "Agent ID").requiredOption("--categories <cats>", "Comma-separated category names").action(withClient(program, async ({ client, gOpts }, agentId, opts) => {
+		const cats = opts.categories.split(",").map((c) => c.trim());
+		const result = await updateCard(client, agentId, (card) => setRineField(card, "categories", cats));
+		if (gOpts.json) printJson(result);
+		else printSuccess("Categories updated");
+	}));
+	agent.command("set-languages").description("Set agent supported languages").argument("<agent-id>", "Agent ID").requiredOption("--languages <langs>", "Comma-separated language codes").action(withClient(program, async ({ client, gOpts }, agentId, opts) => {
+		const langs = opts.languages.split(",").map((l) => l.trim());
+		const result = await updateCard(client, agentId, (card) => setRineField(card, "languages", langs));
+		if (gOpts.json) printJson(result);
+		else printSuccess("Languages updated");
+	}));
+	agent.command("set-pricing").description("Set agent pricing model").argument("<agent-id>", "Agent ID").requiredOption("--model <model>", `Pricing model (${VALID_PRICING.join("|")})`).action(withClient(program, async ({ client, gOpts }, agentId, opts) => {
+		if (!VALID_PRICING.includes(opts.model)) {
+			printError(`Invalid pricing model '${opts.model}'. Valid: ${VALID_PRICING.join(", ")}`);
+			process.exitCode = 2;
+			return;
 		}
+		const result = await updateCard(client, agentId, (card) => setRineField(card, "pricing_model", opts.model));
+		if (gOpts.json) printJson(result);
+		else printSuccess("Pricing updated");
+	}));
+	agent.command("accept-types").description("Set accepted message types").argument("<agent-id>", "Agent ID").requiredOption("--types <types>", "Comma-separated message types").action(withClient(program, async ({ client, gOpts }, agentId, opts) => {
+		const types = opts.types.split(",").map((t) => t.trim());
+		const result = await updateCard(client, agentId, (card) => setRineField(card, "message_types_accepted", types));
+		if (gOpts.json) printJson(result);
+		else printSuccess("Accept types updated");
+	}));
+}
+//#endregion
+//#region src/crypto/keys.ts
+var keys_exports = /* @__PURE__ */ __exportAll({
+	agentIdFromKid: () => agentIdFromKid,
+	agentKeysExist: () => agentKeysExist,
+	encryptionPublicKeyToJWK: () => encryptionPublicKeyToJWK,
+	fromBase64Url: () => fromBase64Url,
+	generateAgentKeys: () => generateAgentKeys,
+	generateEncryptionKeyPair: () => generateEncryptionKeyPair,
+	generateSigningKeyPair: () => generateSigningKeyPair,
+	jwkToPublicKey: () => jwkToPublicKey,
+	loadAgentKeys: () => loadAgentKeys,
+	saveAgentKeys: () => saveAgentKeys,
+	signingPublicKeyToJWK: () => signingPublicKeyToJWK,
+	toBase64Url: () => toBase64Url,
+	validatePathId: () => validatePathId
+});
+function toBase64Url(bytes) {
+	return Buffer.from(bytes).toString("base64url");
+}
+function fromBase64Url(s) {
+	return new Uint8Array(Buffer.from(s, "base64url"));
+}
+function generateSigningKeyPair() {
+	const privateKey = ed25519.utils.randomSecretKey();
+	return {
+		privateKey,
+		publicKey: ed25519.getPublicKey(privateKey)
+	};
+}
+function generateEncryptionKeyPair() {
+	const privateKey = x25519.utils.randomSecretKey();
+	return {
+		privateKey,
+		publicKey: x25519.getPublicKey(privateKey)
+	};
+}
+function generateAgentKeys() {
+	return {
+		signing: generateSigningKeyPair(),
+		encryption: generateEncryptionKeyPair()
+	};
+}
+function signingPublicKeyToJWK(publicKey) {
+	return {
+		kty: "OKP",
+		crv: "Ed25519",
+		x: toBase64Url(publicKey)
+	};
+}
+function encryptionPublicKeyToJWK(publicKey) {
+	return {
+		kty: "OKP",
+		crv: "X25519",
+		x: toBase64Url(publicKey)
+	};
+}
+function jwkToPublicKey(jwk) {
+	const key = fromBase64Url(jwk.x);
+	if (key.length !== 32) throw new Error(`Invalid public key: expected 32 bytes, got ${key.length}`);
+	return key;
+}
+const KID_RE = /^rine:([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
+function agentIdFromKid(kid) {
+	const match = KID_RE.exec(kid);
+	if (!match) throw new Error(`Invalid sender KID format: ${kid}`);
+	return match[1];
+}
+const PATH_SAFE_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function validatePathId(id, label) {
+	if (!PATH_SAFE_RE.test(id)) throw new Error(`Invalid ${label}: must be a UUID, got '${id}'`);
+}
+function getKeysDir$1() {
+	return join(getConfigDir(), "keys");
+}
+function agentKeysDir(agentId) {
+	validatePathId(agentId, "agent ID");
+	return join(getKeysDir$1(), agentId);
+}
+function saveAgentKeys(agentId, keys) {
+	const dir = agentKeysDir(agentId);
+	fs.mkdirSync(dir, {
+		recursive: true,
+		mode: 448
 	});
-	agent.command("accept-types").description("Set accepted message types").argument("<agent-id>", "Agent ID").requiredOption("--types <types>", "Comma-separated message types").action(async (agentId, opts) => {
-		try {
-			const gOpts = program.opts();
-			const { client } = await createClient(gOpts.profile);
-			const card = await client.get(`/agents/${agentId}/card`);
-			const types = opts.types.split(",").map((t) => t.trim());
-			await client.put(`/agents/${agentId}/card`, stripReadOnly(setRineField(card, "message_types_accepted", types)));
-			printMutationOk("Accept types updated", gOpts.json);
-		} catch (err) {
-			printError(formatError(err));
-			process.exitCode = 1;
+	const sigPath = join(dir, "signing.key");
+	fs.writeFileSync(sigPath, toBase64Url(keys.signing.privateKey), "utf-8");
+	fs.chmodSync(sigPath, 384);
+	const encPath = join(dir, "encryption.key");
+	fs.writeFileSync(encPath, toBase64Url(keys.encryption.privateKey), "utf-8");
+	fs.chmodSync(encPath, 384);
+}
+function loadAgentKeys(agentId) {
+	const dir = agentKeysDir(agentId);
+	const sigPriv = fromBase64Url(fs.readFileSync(join(dir, "signing.key"), "utf-8").trim());
+	if (sigPriv.length !== 32) throw new Error(`Corrupt signing key: expected 32 bytes, got ${sigPriv.length}`);
+	const sigPub = ed25519.getPublicKey(sigPriv);
+	const encPriv = fromBase64Url(fs.readFileSync(join(dir, "encryption.key"), "utf-8").trim());
+	if (encPriv.length !== 32) throw new Error(`Corrupt encryption key: expected 32 bytes, got ${encPriv.length}`);
+	const encPub = x25519.getPublicKey(encPriv);
+	return {
+		signing: {
+			privateKey: sigPriv,
+			publicKey: sigPub
+		},
+		encryption: {
+			privateKey: encPriv,
+			publicKey: encPub
 		}
-	});
+	};
+}
+function agentKeysExist(agentId) {
+	const dir = agentKeysDir(agentId);
+	return fs.existsSync(join(dir, "signing.key")) && fs.existsSync(join(dir, "encryption.key"));
 }
 //#endregion
 //#region src/prompt.ts
@@ -466,112 +651,96 @@ async function promptConfirm(question) {
 //#region src/commands/agent.ts
 function toAgentRow(a, opts = {}) {
 	const row = {
-		ID: String(a.id ?? ""),
-		Name: String(a.name ?? ""),
-		Handle: String(a.handle ?? ""),
-		"Human Oversight": String(a.human_oversight ?? ""),
-		Created: String(a.created_at ?? "")
+		ID: a.id,
+		Name: a.name,
+		Handle: a.handle,
+		"Human Oversight": String(a.human_oversight),
+		Created: a.created_at
 	};
-	if (opts.includeVerificationWords && a.verification_words) row["Verification Words"] = String(a.verification_words);
+	if (opts.includeVerificationWords && a.verification_words) row["Verification Words"] = a.verification_words;
 	if (opts.includeCard) row.Card = a.unlisted ? "unlisted" : "public";
 	if (opts.includeRevoked) row.Revoked = a.revoked_at ? String(a.revoked_at) : "—";
 	return row;
 }
 function registerAgent(program) {
 	const agent = program.command("agent").description("Agent management");
-	agent.command("create").description("Create a new agent").option("--name <name>", "Agent name").option("--human-oversight <bool>", "Require human oversight (true/false)").option("--unlisted", "Mark agent as unlisted (not in public directory)").action(async (opts) => {
-		try {
-			const gOpts = program.opts();
-			let name = opts.name;
+	agent.command("create").description("Create a new agent").option("--name <name>", "Agent name").option("--[no-]human-oversight", "Require human oversight (default: true)").option("--unlisted", "Mark agent as unlisted (not in public directory)").action(withClient(program, async ({ client, gOpts }, opts) => {
+		let name = opts.name;
+		if (!name) {
+			name = await promptText("Agent name: ");
 			if (!name) {
-				name = await promptText("Agent name: ");
-				if (!name) {
-					printError("Agent name is required");
-					process.exitCode = 2;
-					return;
-				}
-			}
-			const body = { name };
-			if (opts.humanOversight !== void 0) body.human_oversight = opts.humanOversight === "true";
-			if (opts.unlisted) body.unlisted = true;
-			const { client } = await createClient(gOpts.profile);
-			const data = await client.post("/agents", body);
-			if (gOpts.json) printJson(data);
-			else {
-				printTable([toAgentRow(data, {
-					includeCard: true,
-					includeVerificationWords: true
-				})]);
-				const handle = String(data.handle ?? "");
-				const name = String(data.name ?? "");
-				console.log(`
-Agent '${name}' created — reachable at ${handle}`);
-				if (data.verification_words) console.log(`Verification words: ${data.verification_words}`);
+				printError("Agent name is required");
+				process.exitCode = 2;
+				return;
 			}
-		} catch (err) {
-			printError(formatError(err));
-			process.exitCode = 1;
 		}
-	});
-	agent.command("list").description("List all agents").option("--include-revoked", "Include revoked agents").action(async (opts) => {
-		try {
-			const gOpts = program.opts();
-			const { client } = await createClient(gOpts.profile);
-			const params = opts.includeRevoked ? { include_revoked: true } : void 0;
-			const data = await client.get("/agents", params);
-			if (gOpts.json) printJson(data);
-			else printTable(data.items.map((a) => toAgentRow(a, { includeRevoked: opts.includeRevoked })));
-		} catch (err) {
-			printError(formatError(err));
-			process.exitCode = 1;
+		const agentKeys = generateAgentKeys();
+		const body = {
+			name,
+			signing_public_key: signingPublicKeyToJWK(agentKeys.signing.publicKey),
+			encryption_public_key: encryptionPublicKeyToJWK(agentKeys.encryption.publicKey)
+		};
+		if (opts.humanOversight !== void 0) body.human_oversight = opts.humanOversight;
+		if (opts.unlisted) body.unlisted = true;
+		const data = await client.post("/agents", body);
+		saveAgentKeys(data.id, agentKeys);
+		if (gOpts.json) printJson(data);
+		else {
+			printTable([toAgentRow(data, {
+				includeCard: true,
+				includeVerificationWords: true
+			})]);
+			console.log(`\nAgent '${data.name}' created \u2014 reachable at ${data.handle}`);
+			console.log("E2EE keys generated and stored locally.");
+			if (data.verification_words) console.log(`Verification words: ${data.verification_words}`);
 		}
-	});
-	agent.command("get").description("Get agent details").argument("<agent-id>", "Agent ID").action(async (agentId) => {
-		try {
-			const gOpts = program.opts();
-			const { client } = await createClient(gOpts.profile);
-			const data = await client.get(`/agents/${agentId}`);
-			if (gOpts.json) printJson(data);
-			else printTable([toAgentRow(data, { includeRevoked: true })]);
-		} catch (err) {
-			printError(formatError(err));
-			process.exitCode = 1;
+	}));
+	agent.command("list").description("List all agents").option("--include-revoked", "Include revoked agents").action(withClient(program, async ({ client, gOpts }, opts) => {
+		const params = opts.includeRevoked ? { include_revoked: true } : void 0;
+		const data = await client.get("/agents", params);
+		if (gOpts.json) printJson(data);
+		else printTable(data.items.map((a) => toAgentRow(a, { includeRevoked: opts.includeRevoked })));
+	}));
+	agent.command("get").description("Get agent details").argument("<agent-id>", "Agent ID").action(withClient(program, async ({ client, gOpts }, agentId) => {
+		const data = await client.get(`/agents/${agentId}`);
+		if (gOpts.json) printJson(data);
+		else printTable([{
+			...toAgentRow(data, { includeRevoked: true }),
+			"Incoming Policy": data.incoming_policy ?? "accept_all",
+			"Outgoing Policy": data.outgoing_policy ?? "send_all"
+		}]);
+	}));
+	agent.command("update").description("Update agent details").argument("<agent-id>", "Agent ID").option("--name <name>", "Agent name").option("--[no-]human-oversight", "Require human oversight").option("--incoming-policy <policy>", "Incoming message policy (accept_all|groups_only)").option("--outgoing-policy <policy>", "Outgoing message policy (send_all|groups_only)").action(withClient(program, async ({ client, gOpts }, agentId, opts) => {
+		const body = {};
+		if (opts.name) body.name = opts.name;
+		if (opts.humanOversight !== void 0) body.human_oversight = opts.humanOversight;
+		if (opts.incomingPolicy) body.incoming_policy = opts.incomingPolicy;
+		if (opts.outgoingPolicy) body.outgoing_policy = opts.outgoingPolicy;
+		if (Object.keys(body).length === 0) {
+			printError("At least one of --name, --human-oversight, --incoming-policy, --outgoing-policy is required");
+			process.exitCode = 2;
+			return;
 		}
-	});
-	agent.command("update").description("Update agent details").argument("<agent-id>", "Agent ID").option("--name <name>", "Agent name").option("--human-oversight <bool>", "Require human oversight (true/false)").action(async (agentId, opts) => {
-		try {
-			const gOpts = program.opts();
-			const body = {};
-			if (opts.name) body.name = opts.name;
-			if (opts.humanOversight !== void 0) body.human_oversight = opts.humanOversight === "true";
-			if (Object.keys(body).length === 0) {
-				printError("At least one of --name, --human-oversight is required");
-				process.exitCode = 2;
-				return;
-			}
-			const { client } = await createClient(gOpts.profile);
-			await client.patch(`/agents/${agentId}`, body);
+		const data = await client.patch(`/agents/${agentId}`, body);
+		if (gOpts.json) printJson(data);
+		else {
 			printMutationOk("Agent updated", gOpts.json);
-		} catch (err) {
-			printError(formatError(err));
-			process.exitCode = 1;
+			if (data.warnings && data.warnings.length > 0) for (const w of data.warnings) process.stderr.write(`Warning: ${w}\n`);
+		}
+	}));
+	agent.command("revoke").description("Revoke an agent").argument("<agent-id>", "Agent ID").option("--yes", "Skip confirmation prompt").action(withClient(program, async ({ client, gOpts }, agentId, opts) => {
+		if (!opts.yes && !gOpts.json) {
+			if (!await promptConfirm(`Revoke agent ${agentId}?`)) return;
 		}
-	});
-	agent.command("revoke").description("Revoke an agent").argument("<agent-id>", "Agent ID").option("--yes", "Skip confirmation prompt").action(async (agentId, opts) => {
 		try {
-			const gOpts = program.opts();
-			if (!opts.yes && !gOpts.json) {
-				if (!await promptConfirm(`Revoke agent ${agentId}?`)) return;
-			}
-			const { client } = await createClient(gOpts.profile);
 			await client.delete(`/agents/${agentId}`);
 			printMutationOk("Agent revoked", gOpts.json);
 		} catch (err) {
 			if (err instanceof RineApiError && err.status === 409) printError("Agent already revoked");
-			else printError(formatError(err));
+			else throw err;
 			process.exitCode = 1;
 		}
-	});
+	}));
 }
 //#endregion
 //#region src/commands/auth.ts
@@ -581,126 +750,114 @@ function registerAuth(program) {
 			const profile = program.opts().profile ?? "default";
 			const clientId = opts.clientId ?? await promptText("Client ID: ");
 			const clientSecret = opts.clientSecret ?? await promptPassword("Client secret: ");
-			const apiUrl = getApiUrl();
-			const res = await fetch(`${apiUrl}/oauth/token`, {
-				method: "POST",
-				headers: { "Content-Type": "application/x-www-form-urlencoded" },
-				body: new URLSearchParams({
-					grant_type: "client_credentials",
-					client_id: clientId,
-					client_secret: clientSecret
-				}).toString()
-			});
-			if (!res.ok) {
-				printError(`Login failed: ${(await res.json().catch(() => ({}))).detail ?? res.statusText}`);
-				process.exitCode = 1;
-				return;
-			}
-			const tokenData = await res.json();
+			const tokenData = await fetchOAuthToken(clientId, clientSecret);
 			const creds = loadCredentials();
 			creds[profile] = {
 				client_id: clientId,
 				client_secret: clientSecret
 			};
 			saveCredentials(creds);
-			const cache = loadTokenCache();
-			cache[profile] = {
-				access_token: tokenData.access_token,
-				expires_at: Date.now() / 1e3 + tokenData.expires_in
-			};
-			saveTokenCache(cache);
+			cacheToken(profile, tokenData);
 			printSuccess(`Logged in as ${clientId}`);
 		} catch (err) {
 			printError(formatError(err));
 			process.exitCode = 1;
 		}
 	});
-	program.command("logout").description("Clear token cache for the current profile").action(() => {
-		try {
-			const profile = program.opts().profile ?? "default";
-			const cache = loadTokenCache();
-			delete cache[profile];
-			saveTokenCache(cache);
-			printSuccess("Logged out (credentials preserved — use 'rine auth token' to re-authenticate)");
-		} catch (err) {
-			printError(formatError(err));
-			process.exitCode = 1;
-		}
-	});
-	program.command("status").description("Show org status").action(async () => {
-		await showOrgStatus(program);
-	});
+	program.command("logout").description("Clear cached token. Credentials are preserved.").action(withErrorHandler(program, (gOpts) => {
+		const profile = gOpts.profile ?? "default";
+		const cache = loadTokenCache();
+		delete cache[profile];
+		saveTokenCache(cache);
+		printSuccess(`Logged out — token cache cleared for profile '${profile}'. Credentials preserved.`);
+	}));
+	program.command("status").description("Show org status").action(withClient(program, async ({ client, gOpts }) => {
+		await showOrgStatus(client, gOpts);
+	}));
 	const authGroup = program.command("auth").description("Auth commands");
-	authGroup.command("token").description("Get or refresh access token").option("--force", "Force token refresh (bypass cache)").action(async (opts) => {
-		try {
-			const gOpts = program.opts();
-			const profile = gOpts.profile ?? "default";
-			const force = opts.force === true;
-			const now = Date.now() / 1e3;
-			const envToken = process.env.RINE_TOKEN;
-			const cached = loadTokenCache()[profile];
-			const source = envToken !== void 0 || !force && cached !== void 0 && cached.expires_at - now > 60 ? "cache" : "server";
-			const token = await getOrRefreshToken(getCredentialEntry(profile), profile, force);
-			if (gOpts.json) printResult({
-				access_token: token,
-				source
-			}, gOpts);
-			else console.log(token);
-		} catch (err) {
-			printError(formatError(err));
-			process.exitCode = 1;
+	authGroup.command("token").description("Get or refresh access token").option("--force", "Force token refresh (bypass cache)").action(withErrorHandler(program, async (gOpts, opts) => {
+		const profile = gOpts.profile ?? "default";
+		const force = opts.force === true;
+		const now = Date.now() / 1e3;
+		const envToken = process.env.RINE_TOKEN;
+		const cached = loadTokenCache()[profile];
+		const source = envToken !== void 0 || !force && cached !== void 0 && cached.expires_at - now > 60 ? "cache" : "server";
+		const token = await getOrRefreshToken(getCredentialEntry(profile), profile, force);
+		if (gOpts.json) printJson({
+			access_token: token,
+			source
+		});
+		else console.log(token);
+	}));
+	authGroup.command("status").description("Show org status").action(withClient(program, async ({ client, gOpts }) => {
+		await showOrgStatus(client, gOpts);
+	}));
+}
+async function showOrgStatus(client, gOpts) {
+	const data = await client.get("/org");
+	if (gOpts.json) {
+		printJson(data);
+		return;
+	}
+	printTable([
+		{
+			Field: "Name",
+			Value: data.name
+		},
+		{
+			Field: "Slug",
+			Value: data.slug
+		},
+		{
+			Field: "Trust Tier",
+			Value: String(data.trust_tier)
+		},
+		{
+			Field: "Agent Count",
+			Value: String(data.agent_count)
 		}
-	});
-	authGroup.command("status").description("Show org status").action(async () => {
-		await showOrgStatus(program);
-	});
+	]);
 }
-async function showOrgStatus(program) {
-	try {
-		const gOpts = program.opts();
-		const { client } = await createClient(gOpts.profile);
-		const data = await client.get("/org");
+//#endregion
+//#region src/commands/discover-groups.ts
+function registerDiscoverGroups(discover, program) {
+	discover.command("groups").description("List public groups in the directory").option("-q, --query <query>", "Search query").option("--limit <n>", "Max results").option("--cursor <cursor>", "Pagination cursor").action(withErrorHandler(program, async (gOpts, opts) => {
+		const params = new URLSearchParams();
+		if (opts.query) params.append("q", opts.query);
+		if (opts.limit) params.append("limit", opts.limit);
+		if (opts.cursor) params.append("cursor", opts.cursor);
+		const data = await HttpClient.publicGet("/directory/groups", params.toString() ? params : void 0);
 		if (gOpts.json) {
-			printResult(data, gOpts);
+			printJson(data);
 			return;
 		}
-		printTable([
-			{
-				Field: "Name",
-				Value: String(data.name ?? "")
-			},
-			{
-				Field: "Slug",
-				Value: String(data.slug ?? "")
-			},
-			{
-				Field: "Trust Tier",
-				Value: String(data.trust_tier ?? "")
-			},
-			{
-				Field: "Agent Count",
-				Value: String(data.agent_count ?? "")
-			}
-		]);
-	} catch (err) {
-		printError(formatError(err));
-		process.exitCode = 1;
-	}
+		printTable((data.items ?? []).map((g) => ({
+			Name: g.name,
+			Handle: g.handle,
+			Description: g.description ?? "",
+			Enrollment: g.enrollment_policy,
+			Members: g.member_count
+		})));
+	})).command("inspect").description("Inspect a public group").argument("<group-id>", "Group ID").action(withErrorHandler(program, async (gOpts, groupId) => {
+		const data = await HttpClient.publicGet(`/directory/groups/${groupId}`);
+		if (gOpts.json) {
+			printJson(data);
+			return;
+		}
+		printTable([{
+			ID: data.id,
+			Name: data.name,
+			Handle: data.handle,
+			Description: data.description ?? "",
+			"Org ID": data.org_id,
+			Enrollment: data.enrollment_policy,
+			Members: data.member_count,
+			Created: data.created_at
+		}]);
+	}));
 }
 //#endregion
 //#region src/commands/discover.ts
-const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-async function directoryFetch(path, params) {
-	const base = getApiUrl();
-	const qs = params?.toString();
-	const url = qs ? `${base}${path}?${qs}` : `${base}${path}`;
-	const res = await fetch(url, { headers: { Accept: "application/json" } });
-	if (!res.ok) {
-		const body = await res.text().catch(() => res.statusText);
-		throw new RineApiError(res.status, body, res);
-	}
-	return res.json();
-}
 function trunc(s, len) {
 	const str = String(s ?? "");
 	return str.length > len ? `${str.slice(0, len - 1)}\u2026` : str;
@@ -720,7 +877,7 @@ async function doAgentSearch(opts, gOpts) {
 	if (opts.limit) params.append("limit", opts.limit);
 	if (opts.cursor) params.append("cursor", opts.cursor);
 	if (opts.sort) params.append("sort", opts.sort);
-	const data = await directoryFetch("/directory/agents", params);
+	const data = await HttpClient.publicGet("/directory/agents", params);
 	if (gOpts.json) {
 		printJson(data);
 		return;
@@ -736,132 +893,832 @@ async function doAgentSearch(opts, gOpts) {
 	if (result.next_cursor) printText(`Next cursor: ${result.next_cursor}`);
 }
 const collect = (v, prev) => [...prev, v];
-function addSearchOptions(cmd, requireQuery) {
+function addAgentSearchCommand(parent, name, description, program, requireQuery) {
+	const cmd = parent.command(name).description(description);
 	if (requireQuery) cmd.requiredOption("-q, --query <query>", "Search query");
 	else cmd.option("-q, --query <query>", "Search query");
-	return cmd.option("--category <cat>", "Category filter (repeatable)", collect, []).option("--tag <tag>", "Tag filter (repeatable)", collect, []).option("--jurisdiction <j>", "Jurisdiction filter").option("--language <lang>", "Language filter (repeatable)", collect, []).option("--verified", "Only verified agents").option("--pricing-model <model>", "Pricing model filter").option("--limit <n>", "Max results").option("--cursor <cursor>", "Pagination cursor").option("--sort <sort>", "Sort order (relevance|name|created_at)");
+	cmd.option("--category <cat>", "Category filter (repeatable)", collect, []).option("--tag <tag>", "Tag filter (repeatable)", collect, []).option("--jurisdiction <j>", "Jurisdiction filter").option("--language <lang>", "Language filter (repeatable)", collect, []).option("--verified", "Only verified agents").option("--no-verified", "Only unverified agents").option("--pricing-model <model>", "Pricing model filter").option("--limit <n>", "Max results").option("--cursor <cursor>", "Pagination cursor").option("--sort <sort>", "Sort order (relevance|name|created_at)").action(withErrorHandler(program, async (gOpts, opts) => {
+		await doAgentSearch(opts, gOpts);
+	}));
 }
 function registerDiscover(program) {
-	const discover = program.command("discover").description("Discover agents in the directory");
-	addSearchOptions(discover.command("agents").description("List agents in the directory"), false).action(async (opts) => {
-		const gOpts = program.opts();
-		try {
-			await doAgentSearch(opts, gOpts);
-		} catch (err) {
-			printError(formatError(err));
-			process.exitCode = 1;
+	const discover = program.command("discover").description("Discover agents and groups in the directory");
+	addAgentSearchCommand(discover, "agents", "List agents in the directory", program, false);
+	addAgentSearchCommand(discover, "search", "Search agents (--query required)", program, true);
+	discover.command("categories").description("List directory categories with counts").action(withErrorHandler(program, async (gOpts) => {
+		const data = await HttpClient.publicGet("/directory/categories");
+		if (gOpts.json) {
+			printJson(data);
+			return;
 		}
-	});
-	addSearchOptions(discover.command("search").description("Search agents (--query required)"), true).action(async (opts) => {
-		const gOpts = program.opts();
-		try {
-			await doAgentSearch(opts, gOpts);
-		} catch (err) {
-			printError(formatError(err));
+		printTable((data.items ?? []).sort((a, b) => a.name.localeCompare(b.name)).map((c) => ({
+			Category: c.name,
+			Count: c.count
+		})));
+	}));
+	discover.command("inspect").description("Inspect a specific agent in the directory").argument("<agent-id>", "Agent UUID or handle").action(withErrorHandler(program, async (gOpts, agentIdArg) => {
+		const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+		let resolvedId = agentIdArg;
+		if (agentIdArg.includes("@")) resolvedId = await resolveHandleViaWebFinger(agentIdArg);
+		if (!UUID_RE.test(resolvedId)) {
+			printError(`Could not resolve '${agentIdArg}' to an agent UUID. Provide a UUID or a valid handle (e.g. agent@org.rine.network).`);
 			process.exitCode = 1;
+			return;
 		}
-	});
-	discover.command("categories").description("List directory categories with counts").action(async () => {
-		const gOpts = program.opts();
-		try {
-			const data = await directoryFetch("/directory/categories");
-			if (gOpts.json) {
-				printJson(data);
-				return;
-			}
-			printTable((data.items ?? []).sort((a, b) => a.name.localeCompare(b.name)).map((c) => ({
-				Category: c.name,
-				Count: c.count
-			})));
-		} catch (err) {
-			printError(formatError(err));
-			process.exitCode = 1;
+		const data = await HttpClient.publicGet(`/directory/agents/${resolvedId}`);
+		if (gOpts.json) {
+			printJson(data);
+			return;
+		}
+		const result = data;
+		const card = result.card ?? data;
+		const meta = result.directory_metadata ?? {};
+		printTable([{
+			Name: String(card.name ?? ""),
+			Description: trunc(card.description, 120),
+			Categories: fmtList(card.rine?.categories ?? card.categories),
+			Tags: fmtList(card.rine?.tags ?? card.tags),
+			Pricing: String(card.rine?.pricing_model ?? card.pricing_model ?? ""),
+			"Registered At": String(meta.registered_at ?? ""),
+			"Messages (30d)": String(meta.messages_processed_30d ?? ""),
+			"Avg Response (ms)": String(meta.avg_response_time_ms ?? "")
+		}]);
+	}));
+	registerDiscoverGroups(discover, program);
+}
+//#endregion
+//#region src/commands/group.ts
+function groupRow(g) {
+	return {
+		ID: g.id,
+		Name: g.name,
+		Handle: g.handle,
+		Enrollment: g.enrollment_policy,
+		Visibility: g.visibility,
+		Members: g.member_count,
+		Created: g.created_at
+	};
+}
+function groupDetailRow(g) {
+	return {
+		ID: g.id,
+		Name: g.name,
+		Handle: g.handle,
+		Description: g.description ?? "",
+		Enrollment: g.enrollment_policy,
+		Visibility: g.visibility,
+		Isolated: g.isolated,
+		"Vote Duration": g.vote_duration_hours,
+		Members: g.member_count,
+		Created: g.created_at
+	};
+}
+function memberRow(m) {
+	return {
+		"Agent ID": m.agent_id,
+		Handle: m.agent_handle ?? "",
+		Role: m.role,
+		Joined: m.joined_at
+	};
+}
+function requestRow(r) {
+	return {
+		"Request ID": r.id,
+		"Agent ID": r.agent_id,
+		Message: r.message ?? "",
+		"Your Vote": r.your_vote ?? "",
+		Expires: r.expires_at ?? "",
+		Created: r.created_at
+	};
+}
+function registerGroup(program) {
+	const group = program.command("group").description("Group management");
+	group.command("create").description("Create a new group").requiredOption("--name <name>", "Group name (DNS-safe slug)").option("--enrollment <policy>", "Enrollment policy (open|closed|majority|unanimity)").option("--visibility <vis>", "Visibility (public|private)").option("--isolated", "Isolate group communication").option("--vote-duration <hours>", "Vote duration in hours (1-72)").action(withClient(program, async ({ client, gOpts }, opts) => {
+		const body = { name: opts.name };
+		if (opts.enrollment) body.enrollment_policy = opts.enrollment;
+		if (opts.visibility) body.visibility = opts.visibility;
+		else {
+			body.visibility = opts.enrollment === "open" ? "public" : "private";
+			if (!gOpts.json) printText(`Visibility defaulted to "${body.visibility}" (enrollment: ${opts.enrollment ?? "closed"})`);
+		}
+		if (opts.isolated) body.isolated = true;
+		if (opts.voteDuration) body.vote_duration_hours = Number(opts.voteDuration);
+		const data = await client.post("/groups", body);
+		if (gOpts.json) printJson(data);
+		else {
+			printTable([groupDetailRow(data)]);
+			printText(`\nGroup created — handle: ${data.handle}`);
 		}
+	}));
+	group.command("list").description("List groups").action(withClient(program, async ({ client, gOpts }) => {
+		const data = await client.get("/groups");
+		if (gOpts.json) printJson(data);
+		else printTable(data.items.map(groupRow));
+	}));
+	group.command("get").description("Get group details").argument("<group-id>", "Group ID").action(withClient(program, async ({ client, gOpts }, groupId) => {
+		const data = await client.get(`/groups/${groupId}`);
+		if (gOpts.json) printJson(data);
+		else printTable([groupDetailRow(data)]);
+	}));
+	group.command("update").description("Update group settings").argument("<group-id>", "Group ID").option("--description <desc>", "Group description").option("--enrollment <policy>", "Enrollment policy (open|closed|majority|unanimity)").option("--visibility <vis>", "Visibility (public|private)").option("--vote-duration <hours>", "Vote duration in hours (1-72)").action(withClient(program, async ({ client, gOpts }, groupId, opts) => {
+		const body = {};
+		if (opts.description !== void 0) body.description = opts.description;
+		if (opts.enrollment) body.enrollment_policy = opts.enrollment;
+		if (opts.visibility) body.visibility = opts.visibility;
+		if (opts.voteDuration) body.vote_duration_hours = Number(opts.voteDuration);
+		if (Object.keys(body).length === 0) {
+			printError("At least one of --description, --enrollment, --visibility, --vote-duration is required");
+			process.exitCode = 2;
+			return;
+		}
+		const data = await client.patch(`/groups/${groupId}`, body);
+		if (gOpts.json) printJson(data);
+		else {
+			printTable([groupDetailRow(data)]);
+			printText("Group updated");
+		}
+	}));
+	group.command("delete").description("Delete a group").argument("<group-id>", "Group ID").option("--yes", "Skip confirmation prompt").action(withClient(program, async ({ client, gOpts }, groupId, opts) => {
+		if (!opts.yes && !gOpts.json) {
+			if (!await promptConfirm(`Delete group ${groupId}?`)) return;
+		}
+		await client.delete(`/groups/${groupId}`);
+		printMutationOk("Group deleted", gOpts.json);
+	}));
+	group.command("members").description("List group members").argument("<group-id>", "Group ID").action(withClient(program, async ({ client, gOpts }, groupId) => {
+		const data = await client.get(`/groups/${groupId}/members`);
+		if (gOpts.json) printJson(data);
+		else printTable(data.items.map(memberRow));
+	}));
+	group.command("join").description("Join a group").argument("<group-id>", "Group ID").option("--message <msg>", "Join request message").action(withClient(program, async ({ client, gOpts }, groupId, opts) => {
+		const body = {};
+		if (opts.message) body.message = opts.message;
+		const data = await client.post(`/groups/${groupId}/join`, body);
+		if (gOpts.json) printJson(data);
+		else if ("role" in data) {
+			printTable([memberRow(data)]);
+			printText("Joined group (member)");
+		} else {
+			printTable([requestRow(data)]);
+			printText("Join request submitted (pending approval)");
+		}
+	}));
+	group.command("leave").description("Leave a group").argument("<group-id>", "Group ID").option("--agent <id>", "Agent ID (defaults to your agent)").action(withClient(program, async ({ client, gOpts }, groupId, opts) => {
+		const agentId = await resolveAgent(client, opts.agent, gOpts.as);
+		await client.delete(`/groups/${groupId}/members/${agentId}`);
+		printMutationOk("Left group", gOpts.json);
+	}));
+	group.command("kick").description("Remove a member from the group (admin)").argument("<group-id>", "Group ID").argument("<agent-id>", "Agent ID to remove").action(withClient(program, async ({ client, gOpts }, groupId, agentId) => {
+		await client.delete(`/groups/${groupId}/members/${agentId}`);
+		printMutationOk("Member removed", gOpts.json);
+	}));
+	group.command("invite").description("Invite an agent to the group").argument("<group-id>", "Group ID").requiredOption("--agent <id>", "Agent ID to invite").option("--message <msg>", "Invitation message").action(withClient(program, async ({ client, gOpts }, groupId, opts) => {
+		const body = { agent_id: opts.agent };
+		if (opts.message) body.message = opts.message;
+		const data = await client.post(`/groups/${groupId}/invite`, body);
+		if (gOpts.json) printJson(data);
+		else {
+			printText("Invitation sent");
+			if (data.id) printTable([requestRow(data)]);
+		}
+	}));
+	group.command("requests").description("List pending join requests").argument("<group-id>", "Group ID").action(withClient(program, async ({ client, gOpts }, groupId) => {
+		const data = await client.get(`/groups/${groupId}/requests`);
+		if (gOpts.json) printJson(data);
+		else printTable(data.items.map(requestRow));
+	}));
+	group.command("vote").description("Vote on a join request").argument("<group-id>", "Group ID").argument("<request-id>", "Join request ID").requiredOption("--vote <vote>", "Vote: approve or deny").action(withClient(program, async ({ client, gOpts }, groupId, requestId, opts) => {
+		if (opts.vote !== "approve" && opts.vote !== "deny") {
+			printError("--vote must be 'approve' or 'deny'");
+			process.exitCode = 2;
+			return;
+		}
+		const data = await client.post(`/groups/${groupId}/requests/${requestId}/vote`, { vote: opts.vote });
+		if (gOpts.json) printJson(data);
+		else printText(`Vote recorded. Request status: ${data.status}`);
+	}));
+}
+//#endregion
+//#region src/crypto/envelope.ts
+const SIGNATURE_SIZE = 64;
+const MAX_KID_LENGTH = 255;
+function encodeEnvelope(kid, signature, payload) {
+	const kidBytes = new TextEncoder().encode(kid);
+	if (kidBytes.length > MAX_KID_LENGTH) throw new Error(`kid too long: ${kidBytes.length} bytes (max ${MAX_KID_LENGTH})`);
+	if (signature.length !== SIGNATURE_SIZE) throw new Error(`signature must be ${SIGNATURE_SIZE} bytes, got ${signature.length}`);
+	const buf = new Uint8Array(1 + kidBytes.length + SIGNATURE_SIZE + payload.length);
+	buf[0] = kidBytes.length;
+	buf.set(kidBytes, 1);
+	buf.set(signature, 1 + kidBytes.length);
+	buf.set(payload, 1 + kidBytes.length + SIGNATURE_SIZE);
+	return buf;
+}
+function decodeEnvelope(data) {
+	if (data.length < 1 + SIGNATURE_SIZE) throw new Error("envelope too short");
+	const kidLen = data[0];
+	const minLen = 1 + kidLen + SIGNATURE_SIZE;
+	if (data.length < minLen) throw new Error("envelope too short for declared kid length");
+	return {
+		kid: new TextDecoder("utf-8", { fatal: true }).decode(data.subarray(1, 1 + kidLen)),
+		signature: data.slice(1 + kidLen, 1 + kidLen + SIGNATURE_SIZE),
+		payload: data.slice(1 + kidLen + SIGNATURE_SIZE)
+	};
+}
+//#endregion
+//#region src/crypto/hpke.ts
+const VERSION_HPKE = 1;
+const ENC_SIZE = 32;
+const INFO = new TextEncoder().encode("rine.e2ee.v1.hpke");
+const suite = new CipherSuite({
+	kem: new DhkemX25519HkdfSha256(),
+	kdf: new HkdfSha256(),
+	aead: new Aes256Gcm()
+});
+async function seal(recipientPublicKey, innerEnvelope, aad) {
+	const pk = await suite.kem.deserializePublicKey(recipientPublicKey);
+	const sender = await suite.createSenderContext({
+		recipientPublicKey: pk,
+		info: INFO
 	});
-	discover.command("inspect").description("Inspect a specific agent in the directory").argument("<agent-id>", "Agent UUID or handle").action(async (agentId) => {
-		const gOpts = program.opts();
-		if (agentId.includes("@")) {
-			const match = ((await directoryFetch("/directory/agents", new URLSearchParams({
-				q: agentId,
-				limit: "5"
-			}))).items ?? []).find((i) => i.handle === agentId);
-			if (!match?.id) {
-				printError(`No agent found with handle: ${agentId}`);
-				process.exitCode = 1;
-				return;
-			}
-			agentId = match.id;
+	const ciphertext = new Uint8Array(await sender.seal(innerEnvelope, aad));
+	const enc = new Uint8Array(sender.enc);
+	const out = new Uint8Array(1 + ENC_SIZE + ciphertext.length);
+	out[0] = VERSION_HPKE;
+	out.set(enc, 1);
+	out.set(ciphertext, 1 + ENC_SIZE);
+	return out;
+}
+async function open(recipientPrivateKey, encryptedPayload, aad) {
+	if (encryptedPayload.length < 1 + ENC_SIZE + 1) throw new Error("encrypted payload too short");
+	const version = encryptedPayload[0];
+	if (version !== VERSION_HPKE) throw new Error(`unsupported version: 0x${version?.toString(16).padStart(2, "0")}`);
+	const enc = encryptedPayload.slice(1, 1 + ENC_SIZE);
+	const ct = encryptedPayload.slice(1 + ENC_SIZE);
+	const sk = await suite.kem.deserializePrivateKey(recipientPrivateKey);
+	const recipient = await suite.createRecipientContext({
+		recipientKey: sk,
+		enc,
+		info: INFO
+	});
+	return new Uint8Array(await recipient.open(ct, aad));
+}
+//#endregion
+//#region src/crypto/sender-keys-helpers.ts
+function uuidToBytes(uuid) {
+	const matches = uuid.replace(/-/g, "").match(/../g);
+	if (!matches) throw new Error(`Invalid UUID: ${uuid}`);
+	return new Uint8Array(matches.map((b) => Number.parseInt(b, 16)));
+}
+function bytesToUuid(bytes) {
+	const hex = Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+function senderKeysDir(agentId) {
+	validatePathId(agentId, "agent ID");
+	return join(getConfigDir(), "keys", agentId, "sender_keys");
+}
+function saveSenderKeyState(agentId, groupId, states) {
+	validatePathId(groupId, "group ID");
+	const dir = senderKeysDir(agentId);
+	fs.mkdirSync(dir, {
+		recursive: true,
+		mode: 448
+	});
+	const filePath = join(dir, `${groupId}.json`);
+	const data = states.map((s) => ({
+		...s,
+		chainKey: toBase64Url(s.chainKey)
+	}));
+	fs.writeFileSync(filePath, JSON.stringify(data), "utf-8");
+	fs.chmodSync(filePath, 384);
+}
+function loadSenderKeyStates(agentId, groupId) {
+	validatePathId(groupId, "group ID");
+	const filePath = join(senderKeysDir(agentId), `${groupId}.json`);
+	if (!fs.existsSync(filePath)) return [];
+	const raw = fs.readFileSync(filePath, "utf-8");
+	return JSON.parse(raw).map((s) => ({
+		...s,
+		chainKey: fromBase64Url(s.chainKey)
+	}));
+}
+//#endregion
+//#region src/crypto/sign.ts
+function signPayload(signingPrivateKey, plaintext) {
+	return ed25519.sign(plaintext, signingPrivateKey);
+}
+function verifySignature(signingPublicKey, plaintext, signature) {
+	try {
+		return ed25519.verify(signature, plaintext, signingPublicKey);
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/crypto/sender-keys.ts
+const ROTATION_MESSAGE_LIMIT = 100;
+const ROTATION_AGE_MS = 10080 * 60 * 1e3;
+function needsRotation(state) {
+	if (state.messageIndex >= ROTATION_MESSAGE_LIMIT) return true;
+	if (state.createdAt && Date.now() - state.createdAt > ROTATION_AGE_MS) return true;
+	return false;
+}
+const VERSION_SENDER_KEY = 2;
+const SENDER_KEY_ID_SIZE = 16;
+const MESSAGE_INDEX_SIZE = 4;
+const NONCE_SIZE = 12;
+const MAX_SKIP = 1e3;
+/** Copy Uint8Array into a plain ArrayBuffer-backed Uint8Array (required by Web Crypto). */
+function toPlainBuffer(src) {
+	const buf = new Uint8Array(src.length);
+	buf.set(src);
+	return buf;
+}
+function generateSenderKey(groupId, senderAgentId) {
+	const chainKey = new Uint8Array(32);
+	crypto.getRandomValues(chainKey);
+	return {
+		senderKeyId: crypto.randomUUID(),
+		groupId,
+		senderAgentId,
+		chainKey,
+		messageIndex: 0,
+		createdAt: Date.now()
+	};
+}
+function deriveMessageKey(chainKey) {
+	return {
+		messageKey: hmac(sha256, chainKey, new Uint8Array([1])),
+		nextChainKey: hmac(sha256, chainKey, new Uint8Array([2]))
+	};
+}
+function advanceChain(state, targetIndex) {
+	if (targetIndex - state.messageIndex > MAX_SKIP) throw new Error(`too many skipped messages: ${targetIndex - state.messageIndex} (max ${MAX_SKIP})`);
+	const skippedKeys = /* @__PURE__ */ new Map();
+	let chainKey = state.chainKey;
+	let index = state.messageIndex;
+	while (index < targetIndex) {
+		const { messageKey, nextChainKey } = deriveMessageKey(chainKey);
+		skippedKeys.set(index, messageKey);
+		chainKey = nextChainKey;
+		index++;
+	}
+	return {
+		updatedState: {
+			...state,
+			chainKey,
+			messageIndex: index
+		},
+		skippedKeys
+	};
+}
+/** Build AAD for sender-key encryption: binds ciphertext to sender_key_id and message_index. */
+function buildSenderKeyAad(senderKeyId, messageIndex) {
+	const aad = new Uint8Array(SENDER_KEY_ID_SIZE + MESSAGE_INDEX_SIZE);
+	aad.set(senderKeyId, 0);
+	new DataView(aad.buffer).setUint32(SENDER_KEY_ID_SIZE, messageIndex, false);
+	return aad;
+}
+async function sealGroup(senderSigningPrivateKey, senderSigningKid, state, plaintext) {
+	const innerEnvelope = encodeEnvelope(senderSigningKid, signPayload(senderSigningPrivateKey, plaintext), plaintext);
+	const { messageKey, nextChainKey } = deriveMessageKey(state.chainKey);
+	const nonce = new Uint8Array(NONCE_SIZE);
+	crypto.getRandomValues(nonce);
+	const idBytes = uuidToBytes(state.senderKeyId);
+	const aad = buildSenderKeyAad(idBytes, state.messageIndex);
+	const cryptoKey = await crypto.subtle.importKey("raw", toPlainBuffer(messageKey), "AES-GCM", false, ["encrypt"]);
+	const ciphertext = new Uint8Array(await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv: nonce,
+		additionalData: toPlainBuffer(aad)
+	}, cryptoKey, toPlainBuffer(innerEnvelope)));
+	messageKey.fill(0);
+	const out = new Uint8Array(1 + SENDER_KEY_ID_SIZE + MESSAGE_INDEX_SIZE + NONCE_SIZE + ciphertext.length);
+	let offset = 0;
+	out[offset++] = VERSION_SENDER_KEY;
+	out.set(idBytes, offset);
+	offset += SENDER_KEY_ID_SIZE;
+	new DataView(out.buffer).setUint32(offset, state.messageIndex, false);
+	offset += MESSAGE_INDEX_SIZE;
+	out.set(nonce, offset);
+	offset += NONCE_SIZE;
+	out.set(ciphertext, offset);
+	return {
+		encryptedPayload: out,
+		updatedState: {
+			...state,
+			chainKey: nextChainKey,
+			messageIndex: state.messageIndex + 1
+		}
+	};
+}
+async function openGroup(senderKeyStates, encryptedPayload) {
+	const minLen = 1 + SENDER_KEY_ID_SIZE + MESSAGE_INDEX_SIZE + NONCE_SIZE;
+	if (encryptedPayload.length < minLen) throw new Error("encrypted payload too short");
+	const version = encryptedPayload[0];
+	if (version !== VERSION_SENDER_KEY) throw new Error(`unsupported version: 0x${version?.toString(16).padStart(2, "0")}`);
+	let offset = 1;
+	const senderKeyId = bytesToUuid(encryptedPayload.slice(offset, offset + SENDER_KEY_ID_SIZE));
+	offset += SENDER_KEY_ID_SIZE;
+	const messageIndex = new DataView(encryptedPayload.buffer, encryptedPayload.byteOffset).getUint32(offset, false);
+	offset += MESSAGE_INDEX_SIZE;
+	const nonce = encryptedPayload.slice(offset, offset + NONCE_SIZE);
+	offset += NONCE_SIZE;
+	const ciphertext = encryptedPayload.slice(offset);
+	const state = senderKeyStates.get(senderKeyId);
+	if (!state) throw new Error(`unknown sender key id: ${senderKeyId}`);
+	let messageKey;
+	let updatedState;
+	if (messageIndex < state.messageIndex) {
+		const cached = state.skippedKeys?.[messageIndex];
+		if (!cached) throw new Error("message key expired or already consumed");
+		const { fromBase64Url } = await Promise.resolve().then(() => keys_exports);
+		messageKey = fromBase64Url(cached);
+		const newSkipped = { ...state.skippedKeys };
+		delete newSkipped[messageIndex];
+		updatedState = {
+			...state,
+			skippedKeys: newSkipped
+		};
+	} else if (messageIndex === state.messageIndex) {
+		const { messageKey: mk, nextChainKey } = deriveMessageKey(state.chainKey);
+		messageKey = mk;
+		updatedState = {
+			...state,
+			chainKey: nextChainKey,
+			messageIndex: state.messageIndex + 1
+		};
+	} else {
+		const { updatedState: advanced, skippedKeys: newSkipped } = advanceChain(state, messageIndex);
+		const { messageKey: mk, nextChainKey } = deriveMessageKey(advanced.chainKey);
+		messageKey = mk;
+		const mergedSkipped = { ...state.skippedKeys ?? {} };
+		for (const [idx, key] of newSkipped) {
+			mergedSkipped[idx] = toBase64Url(key);
+			key.fill(0);
+		}
+		const entries = Object.entries(mergedSkipped);
+		if (entries.length > MAX_SKIP) {
+			entries.sort((a, b) => Number(a[0]) - Number(b[0]));
+			const excess = entries.length - MAX_SKIP;
+			for (let i = 0; i < excess; i++) delete mergedSkipped[Number(entries[i][0])];
+		}
+		updatedState = {
+			...advanced,
+			chainKey: nextChainKey,
+			messageIndex: messageIndex + 1,
+			skippedKeys: mergedSkipped
+		};
+	}
+	const aad = buildSenderKeyAad(encryptedPayload.slice(1, 1 + SENDER_KEY_ID_SIZE), messageIndex);
+	const cryptoKey = await crypto.subtle.importKey("raw", toPlainBuffer(messageKey), "AES-GCM", false, ["decrypt"]);
+	const innerEnvelope = new Uint8Array(await crypto.subtle.decrypt({
+		name: "AES-GCM",
+		iv: nonce,
+		additionalData: toPlainBuffer(aad)
+	}, cryptoKey, toPlainBuffer(ciphertext)));
+	messageKey.fill(0);
+	return {
+		innerEnvelope,
+		senderKeyId,
+		messageIndex,
+		updatedState
+	};
+}
+//#endregion
+//#region src/crypto/message.ts
+async function verifyEnvelopeSender(decoded, client) {
+	let verified = false;
+	let verificationStatus = "unverifiable";
+	try {
+		const senderAgentId = agentIdFromKid(decoded.kid);
+		verified = verifySignature(jwkToPublicKey((await client.get(`/agents/${senderAgentId}/keys`)).signing_public_key), decoded.payload, decoded.signature);
+		verificationStatus = verified ? "verified" : "invalid";
+	} catch {}
+	return {
+		verified,
+		verificationStatus
+	};
+}
+function signingKid(agentId) {
+	return `rine:${agentId}`;
+}
+async function encryptMessage(senderAgentId, recipientEncryptionPk, payload) {
+	const keys = loadAgentKeys(senderAgentId);
+	const plaintext = new TextEncoder().encode(JSON.stringify(payload));
+	const kid = signingKid(senderAgentId);
+	return {
+		encrypted_payload: toBase64Url(await seal(recipientEncryptionPk, encodeEnvelope(kid, signPayload(keys.signing.privateKey, plaintext), plaintext))),
+		encryption_version: "hpke-v1",
+		sender_signing_kid: kid
+	};
+}
+async function fetchRecipientEncryptionKey(client, agentId) {
+	return jwkToPublicKey((await client.get(`/agents/${agentId}/keys`)).encryption_public_key);
+}
+async function decryptMessage(recipientAgentId, encryptedPayloadB64, client) {
+	const keys = loadAgentKeys(recipientAgentId);
+	const encrypted = fromBase64Url(encryptedPayloadB64);
+	const decoded = decodeEnvelope(await open(keys.encryption.privateKey, encrypted));
+	const plaintext = new TextDecoder("utf-8", { fatal: true }).decode(decoded.payload);
+	const { verified, verificationStatus } = await verifyEnvelopeSender(decoded, client);
+	return {
+		plaintext,
+		senderKid: decoded.kid,
+		verified,
+		verificationStatus
+	};
+}
+async function encryptGroupMessage(senderAgentId, groupId, senderKeyState, payload) {
+	const keys = loadAgentKeys(senderAgentId);
+	const plaintext = new TextEncoder().encode(JSON.stringify(payload));
+	const kid = signingKid(senderAgentId);
+	const selfReadKey = deriveMessageKey(senderKeyState.chainKey).messageKey;
+	const selfReadIndex = senderKeyState.messageIndex;
+	const { encryptedPayload, updatedState } = await sealGroup(keys.signing.privateKey, kid, senderKeyState, plaintext);
+	updatedState.skippedKeys = {
+		...updatedState.skippedKeys ?? {},
+		[selfReadIndex]: toBase64Url(selfReadKey)
+	};
+	selfReadKey.fill(0);
+	saveSenderKeyState(senderAgentId, groupId, [...loadSenderKeyStates(senderAgentId, groupId).filter((s) => s.senderKeyId !== updatedState.senderKeyId), updatedState]);
+	return {
+		result: {
+			encrypted_payload: toBase64Url(encryptedPayload),
+			encryption_version: "sender-key-v1",
+			sender_signing_kid: kid
+		},
+		updatedState
+	};
+}
+async function decryptGroupMessage(recipientAgentId, groupId, encryptedPayloadB64, client) {
+	const states = loadSenderKeyStates(recipientAgentId, groupId);
+	const stateMap = /* @__PURE__ */ new Map();
+	for (const s of states) stateMap.set(s.senderKeyId, s);
+	const { innerEnvelope, updatedState, messageIndex } = await openGroup(stateMap, fromBase64Url(encryptedPayloadB64));
+	const decoded = decodeEnvelope(innerEnvelope);
+	const plaintext = new TextDecoder("utf-8", { fatal: true }).decode(decoded.payload);
+	const { verified, verificationStatus } = await verifyEnvelopeSender(decoded, client);
+	if (verificationStatus === "invalid") throw new Error("Sender signature verification failed");
+	if (updatedState.senderAgentId === recipientAgentId) {
+		const prevCached = stateMap.get(updatedState.senderKeyId)?.skippedKeys?.[messageIndex];
+		if (prevCached && !updatedState.skippedKeys?.[messageIndex]) updatedState.skippedKeys = {
+			...updatedState.skippedKeys ?? {},
+			[messageIndex]: prevCached
+		};
+	}
+	stateMap.set(updatedState.senderKeyId, updatedState);
+	saveSenderKeyState(recipientAgentId, groupId, Array.from(stateMap.values()));
+	return {
+		plaintext,
+		senderKid: decoded.kid,
+		verified,
+		verificationStatus
+	};
+}
+function getAgentPublicKeys(agentId, agentKeys) {
+	const keys = agentKeys ?? loadAgentKeys(agentId);
+	return {
+		signing_public_key: signingPublicKeyToJWK(keys.signing.publicKey),
+		encryption_public_key: {
+			kty: "OKP",
+			crv: "X25519",
+			x: toBase64Url(keys.encryption.publicKey)
 		}
-		if (!UUID_RE.test(agentId)) {
-			printError("agent-id must be a valid UUID");
+	};
+}
+//#endregion
+//#region src/commands/keys.ts
+function getKeysDir(agentId) {
+	return join(getConfigDir(), "keys", agentId);
+}
+function backupKeys(agentId) {
+	const dir = getKeysDir(agentId);
+	const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+	for (const name of ["signing.key", "encryption.key"]) {
+		const src = join(dir, name);
+		if (!fs.existsSync(src)) continue;
+		for (const f of fs.readdirSync(dir)) if (f.startsWith(`${name}.bak.`)) fs.unlinkSync(join(dir, f));
+		fs.copyFileSync(src, join(dir, `${name}.bak.${ts}`));
+	}
+}
+async function verifyServerKeys(client, agentId, expected) {
+	const server = await client.get(`/agents/${agentId}/keys`);
+	if (server.signing_public_key.x !== expected.signing_public_key.x || server.encryption_public_key.x !== expected.encryption_public_key.x) throw new Error("Server key verification failed: uploaded keys do not match. Old keys preserved locally.");
+}
+function registerKeys(program) {
+	const keys = program.command("keys").description("E2EE key management");
+	keys.command("generate").description("Generate new E2EE keys for an agent").option("--agent <id>", "Agent ID").action(withClient(program, async ({ client, gOpts }, opts) => {
+		const agentId = await resolveAgent(client, opts.agent, gOpts.as);
+		if (agentKeysExist(agentId)) {
+			printError(`Keys already exist for agent ${agentId}. Use 'rine keys rotate' to replace them.`);
+			process.exitCode = 1;
+			return;
+		}
+		const agentKeys = generateAgentKeys();
+		const pubKeys = getAgentPublicKeys(agentId, agentKeys);
+		await client.post(`/agents/${agentId}/keys`, pubKeys);
+		await verifyServerKeys(client, agentId, pubKeys);
+		saveAgentKeys(agentId, agentKeys);
+		printMutationOk(`E2EE keys generated for agent ${agentId}`, gOpts.json);
+	}));
+	keys.command("rotate").description("Rotate E2EE keys for an agent").option("--agent <id>", "Agent ID").action(withClient(program, async ({ client, gOpts }, opts) => {
+		const agentId = await resolveAgent(client, opts.agent, gOpts.as);
+		if (agentKeysExist(agentId)) backupKeys(agentId);
+		const agentKeys = generateAgentKeys();
+		const pubKeys = getAgentPublicKeys(agentId, agentKeys);
+		await client.post(`/agents/${agentId}/keys`, pubKeys);
+		await verifyServerKeys(client, agentId, pubKeys);
+		saveAgentKeys(agentId, agentKeys);
+		printMutationOk(`E2EE keys rotated for agent ${agentId}`, gOpts.json);
+	}));
+	keys.command("export").description("Export private keys to a file").option("--agent <id>", "Agent ID").requiredOption("--output <file>", "Output file path").action(withClient(program, async ({ client, gOpts }, opts) => {
+		const agentId = await resolveAgent(client, opts.agent, gOpts.as);
+		if (!agentKeysExist(agentId)) {
+			printError(`No keys found for agent ${agentId}`);
+			process.exitCode = 1;
+			return;
+		}
+		const agentKeys = loadAgentKeys(agentId);
+		const exported = {
+			agent_id: agentId,
+			signing_private_key: toBase64Url(agentKeys.signing.privateKey),
+			encryption_private_key: toBase64Url(agentKeys.encryption.privateKey)
+		};
+		fs.writeFileSync(opts.output, JSON.stringify(exported, null, 2));
+		fs.chmodSync(opts.output, 384);
+		if (gOpts.json) printJson({
+			ok: true,
+			path: opts.output
+		});
+		else console.log(`Keys exported to ${opts.output}`);
+	}));
+	keys.command("import").description("Import private keys from a file").requiredOption("--input <file>", "Input file path").action(withErrorHandler(program, (gOpts, opts) => {
+		const raw = fs.readFileSync(opts.input, "utf-8");
+		const data = JSON.parse(raw);
+		if (!data.agent_id || !data.signing_private_key || !data.encryption_private_key) {
+			printError("Invalid key export file");
+			process.exitCode = 2;
+			return;
+		}
+		const sigBytes = fromBase64Url(data.signing_private_key);
+		if (sigBytes.length !== 32) {
+			printError(`Invalid signing key: expected 32 bytes, got ${sigBytes.length}`);
 			process.exitCode = 2;
 			return;
 		}
 		try {
-			const data = await directoryFetch(`/directory/agents/${agentId}`);
-			if (gOpts.json) {
-				printJson(data);
-				return;
-			}
-			const result = data;
-			const card = result.card ?? data;
-			const meta = result.directory_metadata ?? {};
-			printTable([{
-				Name: String(card.name ?? ""),
-				Description: trunc(card.description, 120),
-				Categories: fmtList(card.rine?.categories ?? card.categories),
-				Tags: fmtList(card.rine?.tags ?? card.tags),
-				Pricing: String(card.rine?.pricing_model ?? card.pricing_model ?? ""),
-				"Registered At": String(meta.registered_at ?? ""),
-				"Messages (30d)": String(meta.messages_processed_30d ?? ""),
-				"Avg Response (ms)": String(meta.avg_response_time_ms ?? "")
-			}]);
-		} catch (err) {
-			printError(formatError(err));
-			process.exitCode = 1;
+			ed25519.getPublicKey(sigBytes);
+		} catch {
+			printError("Invalid signing key: not a valid Ed25519 private key");
+			process.exitCode = 2;
+			return;
 		}
-	});
+		const encBytes = fromBase64Url(data.encryption_private_key);
+		if (encBytes.length !== 32) {
+			printError(`Invalid encryption key: expected 32 bytes, got ${encBytes.length}`);
+			process.exitCode = 2;
+			return;
+		}
+		try {
+			x25519.getPublicKey(encBytes);
+		} catch {
+			printError("Invalid encryption key: not a valid X25519 private key");
+			process.exitCode = 2;
+			return;
+		}
+		const dir = join(getConfigDir(), "keys", data.agent_id);
+		fs.mkdirSync(dir, {
+			recursive: true,
+			mode: 448
+		});
+		const sigPath = join(dir, "signing.key");
+		fs.writeFileSync(sigPath, data.signing_private_key, "utf-8");
+		fs.chmodSync(sigPath, 384);
+		const encPath = join(dir, "encryption.key");
+		fs.writeFileSync(encPath, data.encryption_private_key, "utf-8");
+		fs.chmodSync(encPath, 384);
+		printMutationOk(`Keys imported for agent ${data.agent_id}`, gOpts.json);
+	}));
 }
 //#endregion
-//#region src/commands/resolve.ts
+//#region src/crypto/ingest.ts
 /**
-* Resolve the first active agent for the authenticated org.
-* Used by inbox and stream commands when no explicit --agent is given.
+* Auto-ingest a sender key distribution from a decrypted message.
+* Only ingests if the message is a `rine.v1.sender_key_distribution`,
+* the signature was verified, and the key ID is not already known.
+*
+* Returns true if a new key was ingested.
 */
-async function resolveFirstAgent(client) {
-	const agents = ((await client.get("/agents")).items ?? []).filter((a) => !a.revoked_at);
-	if (agents.length === 0) throw new Error("No active agents found. Create one with `rine agent create`.");
-	const first = agents[0];
-	if (agents.length > 1) process.stderr.write(`Warning: multiple agents found, using first: ${first.id}\n`);
-	return first.id;
+function ingestSenderKeyDistribution(agentId, messageType, result) {
+	if (messageType !== "rine.v1.sender_key_distribution") return false;
+	if (!result.verified) return false;
+	try {
+		const dist = JSON.parse(result.plaintext);
+		const existing = loadSenderKeyStates(agentId, dist.group_id);
+		if (existing.some((s) => s.senderKeyId === dist.sender_key_id)) return false;
+		const newState = {
+			senderKeyId: dist.sender_key_id,
+			groupId: dist.group_id,
+			senderAgentId: agentIdFromKid(result.senderKid),
+			chainKey: fromBase64Url(dist.chain_key),
+			messageIndex: dist.message_index
+		};
+		saveSenderKeyState(agentId, dist.group_id, [...existing, newState]);
+		return true;
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/commands/sender-key-ops.ts
+async function distributeSenderKey(client, senderAgentId, state, groupId, recipientIds, extraHeaders) {
+	if (recipientIds.length === 0) return [];
+	const batchKeys = await client.get("/agents/keys", { ids: recipientIds.join(",") });
+	const distPayload = {
+		group_id: groupId,
+		sender_key_id: state.senderKeyId,
+		chain_key: toBase64Url(state.chainKey),
+		message_index: state.messageIndex,
+		sender_agent_id: senderAgentId
+	};
+	const succeeded = [];
+	const failed = [];
+	for (const recipientId of recipientIds) {
+		const recipientKeyData = batchKeys.keys[recipientId];
+		if (!recipientKeyData) {
+			failed.push(recipientId);
+			continue;
+		}
+		try {
+			const encrypted = await encryptMessage(senderAgentId, fromBase64Url(recipientKeyData.encryption_public_key.x), distPayload);
+			await client.post("/messages", {
+				to_agent_id: recipientId,
+				type: "rine.v1.sender_key_distribution",
+				...encrypted
+			}, extraHeaders);
+			succeeded.push(recipientId);
+		} catch {
+			failed.push(recipientId);
+		}
+	}
+	if (failed.length > 0) printError(`Sender key distribution failed for ${failed.length} recipient(s): ${failed.join(", ")}`);
+	return succeeded;
+}
+async function getOrCreateSenderKey(client, senderAgentId, groupHandle, extraHeaders) {
+	const firstGroup = (await client.get("/groups", { handle: groupHandle })).items?.[0];
+	if (!firstGroup) throw new Error(`Group not found: ${groupHandle}`);
+	const groupId = firstGroup.id;
+	const memberIds = (await client.get(`/groups/${groupId}/members`)).items.map((m) => m.agent_id);
+	const senderIdLower = senderAgentId.toLowerCase();
+	if (!memberIds.some((id) => id.toLowerCase() === senderIdLower)) throw new Error("You are not a member of this group");
+	const recipientIds = memberIds.filter((id) => id.toLowerCase() !== senderIdLower);
+	const states = loadSenderKeyStates(senderAgentId, groupId);
+	const own = states.find((s) => s.senderAgentId === senderAgentId);
+	const currentMemberSet = new Set(memberIds.map((id) => id.toLowerCase()));
+	const memberRemoved = own?.distributedTo?.some((id) => !currentMemberSet.has(id.toLowerCase())) ?? false;
+	if (own && !needsRotation(own) && !memberRemoved) {
+		const alreadyDistributed = new Set((own.distributedTo ?? []).map((id) => id.toLowerCase()));
+		const undistributed = recipientIds.filter((id) => !alreadyDistributed.has(id.toLowerCase()));
+		if (undistributed.length > 0) {
+			const succeeded = await distributeSenderKey(client, senderAgentId, own, groupId, undistributed, extraHeaders);
+			if (succeeded.length > 0) {
+				own.distributedTo = [...own.distributedTo ?? [], ...succeeded];
+				saveSenderKeyState(senderAgentId, groupId, states);
+			}
+		}
+		return {
+			state: own,
+			groupId
+		};
+	}
+	const newState = generateSenderKey(groupId, senderAgentId);
+	newState.distributedTo = await distributeSenderKey(client, senderAgentId, newState, groupId, recipientIds, extraHeaders);
+	saveSenderKeyState(senderAgentId, groupId, [...memberRemoved ? states.filter((s) => currentMemberSet.has(s.senderAgentId.toLowerCase())) : states, newState]);
+	return {
+		state: newState,
+		groupId
+	};
 }
 //#endregion
 //#region src/commands/messages.ts
 function msgFrom(m) {
-	return String(m.sender_handle ?? m.from_agent_id ?? "");
+	return m.sender_handle ?? m.from_agent_id ?? "";
 }
 function msgTo(m) {
-	return String(m.recipient_handle ?? m.to_agent_id ?? "");
+	return m.recipient_handle ?? m.to_agent_id ?? "";
 }
-function sendRow(m) {
-	return {
-		ID: m.id,
-		"Conversation ID": m.conversation_id,
-		From: msgFrom(m),
-		To: msgTo(m),
-		Type: m.type,
-		Created: m.created_at
-	};
+function msgGroup(m) {
+	return m.group_handle ?? "";
 }
-function readRow(m) {
+function sendRow(m) {
 	return {
 		ID: m.id,
 		"Conversation ID": m.conversation_id,
 		From: msgFrom(m),
 		To: msgTo(m),
+		Group: msgGroup(m),
 		Type: m.type,
-		Preview: m.payload_preview ? String(m.payload_preview).slice(0, 60) : "",
-		Payload: JSON.stringify(m.payload ?? {}),
 		Created: m.created_at
 	};
 }
@@ -869,98 +1726,133 @@ function inboxRow(m) {
 	return {
 		ID: m.id,
 		From: msgFrom(m),
+		Group: msgGroup(m),
 		Type: m.type,
-		Preview: m.payload_preview ? String(m.payload_preview).slice(0, 60) : "",
+		Encryption: m.encryption_version,
 		Created: m.created_at
 	};
 }
 function addMessageCommands(parent, program) {
-	parent.command("send").description("Send a message").requiredOption("--to <address>", "Recipient address (agent ID or handle with @)").requiredOption("--type <type>", "Message type (e.g. rine.v1.task_request)").requiredOption("--payload <json>", "Message payload as JSON string").option("--from <address>", "Sender address (agent ID or handle with @)").option("--idempotency-key <key>", "Idempotency key header").action(async (opts) => {
+	parent.command("send").description("Send an encrypted message").requiredOption("--to <address>", "Recipient: agent handle, agent ID, or #group@org handle").requiredOption("--type <type>", "Message type (e.g. rine.v1.task_request)").requiredOption("--payload <json>", "Message payload as JSON string").option("--from <address>", "Sender address (agent ID or handle with @)").option("--idempotency-key <key>", "Idempotency key header").action(withClient(program, async ({ client, gOpts }, opts) => {
+		let parsedPayload;
 		try {
-			const gOpts = program.opts();
-			const { client } = await createClient(gOpts.profile);
-			let parsedPayload;
-			try {
-				parsedPayload = JSON.parse(opts.payload);
-			} catch {
-				printError("--payload must be valid JSON");
-				process.exitCode = 2;
-				return;
-			}
-			const body = {
-				type: opts.type,
-				payload: parsedPayload
-			};
-			if (opts.to.includes("@")) body.to_handle = opts.to;
-			else body.to_agent_id = opts.to;
-			if (opts.from !== void 0) if (opts.from.includes("@")) body.from_handle = opts.from;
-			else body.from_agent_id = opts.from;
-			const extraHeaders = {};
-			if (opts.idempotencyKey) extraHeaders["Idempotency-Key"] = opts.idempotencyKey;
-			const data = await client.post("/messages", body, Object.keys(extraHeaders).length > 0 ? extraHeaders : void 0);
-			if (gOpts.json) printJson(data);
-			else printTable([sendRow(data)]);
-		} catch (err) {
-			printError(formatError(err));
-			process.exitCode = 1;
+			parsedPayload = JSON.parse(opts.payload);
+		} catch {
+			printError("--payload must be valid JSON");
+			process.exitCode = 2;
+			return;
 		}
-	});
-	parent.command("read").description("Read a message by ID").argument("<message-id>", "Message ID").action(async (messageId) => {
-		try {
-			const gOpts = program.opts();
-			const { client } = await createClient(gOpts.profile);
-			const data = await client.get(`/messages/${messageId}`);
-			if (gOpts.json) printJson(data);
-			else printTable([readRow(data)]);
+		const extraHeaders = {};
+		let senderAgentId;
+		if (opts.from !== void 0) {
+			senderAgentId = await resolveToUuid(opts.from);
+			extraHeaders["X-Rine-Agent"] = senderAgentId;
+		} else if (!gOpts.as) {
+			senderAgentId = await resolveAgent(client, void 0, void 0);
+			extraHeaders["X-Rine-Agent"] = senderAgentId;
+		} else senderAgentId = await resolveToUuid(gOpts.as);
+		if (opts.idempotencyKey) extraHeaders["Idempotency-Key"] = opts.idempotencyKey;
+		let recipientAgentId;
+		if (!opts.to.includes("@")) recipientAgentId = opts.to;
+		else if (!opts.to.startsWith("#")) recipientAgentId = await resolveToUuid(opts.to);
+		const body = { type: opts.type };
+		if (opts.to.includes("@")) body.to_handle = opts.to;
+		else body.to_agent_id = opts.to;
+		if (opts.from?.includes("@")) body.from_handle = opts.from;
+		if (opts.to.startsWith("#") && senderAgentId) {
+			const { state, groupId } = await getOrCreateSenderKey(client, senderAgentId, opts.to, Object.keys(extraHeaders).length > 0 ? extraHeaders : void 0);
+			const { result } = await encryptGroupMessage(senderAgentId, groupId, state, parsedPayload);
+			Object.assign(body, result);
+		} else if (senderAgentId && recipientAgentId) {
+			const recipientPk = await fetchRecipientEncryptionKey(client, recipientAgentId);
+			const encrypted = await encryptMessage(senderAgentId, recipientPk, parsedPayload);
+			Object.assign(body, encrypted);
+		} else throw new Error("Cannot encrypt: unable to resolve sender or recipient. Use UUIDs or ensure WebFinger is available.");
+		const data = await client.post("/messages", body, Object.keys(extraHeaders).length > 0 ? extraHeaders : void 0);
+		if (gOpts.json) printJson(data);
+		else printTable([sendRow(data)]);
+	}));
+	parent.command("read").description("Read and decrypt a message by ID").argument("<message-id>", "Message ID").option("--agent <id>", "Agent ID (for decryption key)").action(withClient(program, async ({ client, gOpts }, messageId, opts) => {
+		const data = await client.get(`/messages/${messageId}`);
+		const agentId = await resolveAgent(client, opts.agent, gOpts.as);
+		if ((data.encryption_version === "hpke-v1" || data.encryption_version === "sender-key-v1") && agentKeysExist(agentId)) try {
+			let result;
+			if (data.encryption_version === "sender-key-v1" && data.group_id) result = await decryptGroupMessage(agentId, data.group_id, data.encrypted_payload, client);
+			else result = await decryptMessage(agentId, data.encrypted_payload, client);
+			if (ingestSenderKeyDistribution(agentId, data.type, result)) printText("Sender key ingested");
+			if (gOpts.json) printJson({
+				...data,
+				decrypted_payload: JSON.parse(result.plaintext),
+				signature_verified: result.verified,
+				verification_status: result.verificationStatus,
+				sender_kid: result.senderKid
+			});
+			else printTable([{
+				ID: data.id,
+				"Conversation ID": data.conversation_id,
+				From: msgFrom(data),
+				To: msgTo(data),
+				Group: msgGroup(data),
+				Type: data.type,
+				Verified: result.verificationStatus === "verified" ? "✓" : result.verificationStatus === "invalid" ? "✗ INVALID" : "?",
+				Payload: result.plaintext.slice(0, 200),
+				Created: data.created_at
+			}]);
+			return;
 		} catch (err) {
-			printError(formatError(err));
-			process.exitCode = 1;
+			if (!gOpts.json) printError(`Decryption failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
-	});
-	parent.command("inbox").description("List inbox messages").option("--agent <id>", "Agent ID (auto-resolved if omitted)").option("--limit <n>", "Maximum number of messages to return").option("--cursor <cursor>", "Pagination cursor").action(async (opts) => {
+		if (gOpts.json) printJson(data);
+		else printTable([{
+			ID: data.id,
+			"Conversation ID": data.conversation_id,
+			From: msgFrom(data),
+			To: msgTo(data),
+			Group: msgGroup(data),
+			Type: data.type,
+			Encryption: data.encryption_version,
+			"Encrypted Payload": `${data.encrypted_payload.slice(0, 40)}...`,
+			Created: data.created_at
+		}]);
+	}));
+	parent.command("inbox").description("List inbox messages").option("--agent <id>", "Agent ID (defaults to your agent)").option("--limit <n>", "Maximum number of messages to return").option("--cursor <cursor>", "Pagination cursor").action(withClient(program, async ({ client, gOpts }, opts) => {
+		const agentId = await resolveAgent(client, opts.agent, gOpts.as);
+		const params = {};
+		if (opts.limit) params.limit = opts.limit;
+		if (opts.cursor) params.cursor = opts.cursor;
+		const data = await client.get(`/agents/${agentId}/messages`, params);
+		if (gOpts.json) printJson(data);
+		else {
+			printTable(data.items.map(inboxRow));
+			if (data.next_cursor) printText(`Next cursor: ${data.next_cursor}`);
+		}
+	}));
+	parent.command("reply").description("Reply to a message (encrypted)").argument("<message-id>", "Message ID to reply to").requiredOption("--type <type>", "Message type").requiredOption("--payload <json>", "Reply payload as JSON string").action(withClient(program, async ({ client, gOpts }, messageId, opts) => {
+		let parsedPayload;
 		try {
-			const gOpts = program.opts();
-			const { client } = await createClient(gOpts.profile);
-			let agentId = opts.agent;
-			if (!agentId) agentId = await resolveFirstAgent(client);
-			const params = {};
-			if (opts.limit) params.limit = opts.limit;
-			if (opts.cursor) params.cursor = opts.cursor;
-			const data = await client.get(`/agents/${agentId}/messages`, params);
-			if (gOpts.json) printJson(data);
-			else {
-				printTable(data.items.map(inboxRow));
-				if (data.next_cursor) printText(`Next cursor: ${data.next_cursor}`);
-			}
-		} catch (err) {
-			printError(formatError(err));
-			process.exitCode = 1;
+			parsedPayload = JSON.parse(opts.payload);
+		} catch {
+			printError("--payload must be valid JSON");
+			process.exitCode = 2;
+			return;
 		}
-	});
-	parent.command("reply").description("Reply to a message").argument("<message-id>", "Message ID to reply to").requiredOption("--type <type>", "Message type").requiredOption("--payload <json>", "Reply payload as JSON string").action(async (messageId, opts) => {
+		const original = await client.get(`/messages/${messageId}`);
+		const senderAgentId = await resolveAgent(client, void 0, gOpts.as);
+		const recipientAgentId = original.from_agent_id;
 		try {
-			const gOpts = program.opts();
-			const { client } = await createClient(gOpts.profile);
-			let parsedPayload;
-			try {
-				parsedPayload = JSON.parse(opts.payload);
-			} catch {
-				printError("--payload must be valid JSON");
-				process.exitCode = 2;
-				return;
-			}
-			const data = await client.post(`/messages/${messageId}/reply`, {
-				type: opts.type,
-				payload: parsedPayload
-			});
+			const body = { type: opts.type };
+			if (!recipientAgentId || !agentKeysExist(senderAgentId)) throw new Error("Cannot reply: encryption keys unavailable. Run 'rine keys generate' first.");
+			const encrypted = await encryptMessage(senderAgentId, await fetchRecipientEncryptionKey(client, recipientAgentId), parsedPayload);
+			Object.assign(body, encrypted);
+			const data = await client.post(`/messages/${messageId}/reply`, body);
 			if (gOpts.json) printJson(data);
 			else printTable([sendRow(data)]);
 		} catch (err) {
 			if (err instanceof RineApiError && err.status === 409) printError("Conversation is closed");
-			else printError(formatError(err));
+			else throw err;
 			process.exitCode = 1;
 		}
-	});
+	}));
 }
 function registerMessages(program) {
 	addMessageCommands(program, program);
@@ -974,45 +1866,31 @@ function renderOrg(data, opts) {
 		return;
 	}
 	printTable([{
-		ID: String(data.id ?? ""),
-		Name: String(data.name ?? ""),
-		"Contact Email": String(data.contact_email ?? ""),
-		Country: String(data.country_code ?? ""),
-		Created: String(data.created_at ?? "")
+		ID: data.id,
+		Name: data.name,
+		"Contact Email": data.contact_email ?? "",
+		Country: data.country_code ?? "",
+		Created: data.created_at
 	}]);
 }
 function registerOrg(program) {
 	const org = program.command("org").description("Organization management");
-	org.command("get").description("Get organization details").action(async () => {
-		try {
-			const gOpts = program.opts();
-			const { client } = await createClient(gOpts.profile);
-			renderOrg(await client.get("/org"), gOpts);
-		} catch (err) {
-			printError(formatError(err));
-			process.exitCode = 1;
-		}
-	});
-	org.command("update").description("Update organization details").option("--name <name>", "Organization name").option("--contact-email <email>", "Contact email address").option("--country-code <cc>", "ISO country code (e.g. DE)").action(async (opts) => {
-		try {
-			const gOpts = program.opts();
-			const body = {};
-			if (opts.name) body.name = opts.name;
-			if (opts.contactEmail) body.contact_email = opts.contactEmail;
-			if (opts.countryCode) body.country_code = opts.countryCode;
-			if (Object.keys(body).length === 0) {
-				printError("At least one of --name, --contact-email, --country-code is required");
-				process.exitCode = 2;
-				return;
-			}
-			const { client } = await createClient(gOpts.profile);
-			await client.patch("/org", body);
-			printMutationOk("Org updated", gOpts.json);
-		} catch (err) {
-			printError(formatError(err));
-			process.exitCode = 1;
+	org.command("get").description("Get organization details").action(withClient(program, async ({ client, gOpts }) => {
+		renderOrg(await client.get("/org"), gOpts);
+	}));
+	org.command("update").description("Update organization details").option("--name <name>", "Organization name").option("--contact-email <email>", "Contact email address").option("--country-code <cc>", "ISO country code (e.g. DE)").action(withClient(program, async ({ client, gOpts }, opts) => {
+		const body = {};
+		if (opts.name) body.name = opts.name;
+		if (opts.contactEmail) body.contact_email = opts.contactEmail;
+		if (opts.countryCode) body.country_code = opts.countryCode;
+		if (Object.keys(body).length === 0) {
+			printError("At least one of --name, --contact-email, --country-code is required");
+			process.exitCode = 2;
+			return;
 		}
-	});
+		await client.patch("/org", body);
+		printMutationOk("Org updated", gOpts.json);
+	}));
 }
 //#endregion
 //#region src/timelock.ts
@@ -1032,129 +1910,122 @@ async function solveTimeLockWithProgress(baseHex, modulusHex, T, onProgress) {
 //#endregion
 //#region src/commands/register.ts
 function registerRegister(program) {
-	program.command("register").description("Register a new organization (two-step PoW flow)").requiredOption("--email <email>", "Email address").requiredOption("--name <name>", "Organization name").requiredOption("--slug <slug>", "Organization slug").action(async (opts) => {
-		try {
-			const gOpts = program.opts();
-			const profile = gOpts.profile ?? "default";
-			const apiUrl = getApiUrl();
-			const challengeRes = await fetch(`${apiUrl}/auth/register`, {
-				method: "POST",
-				headers: { "Content-Type": "application/json" },
-				body: JSON.stringify({
-					email: opts.email,
-					org_slug: opts.slug
-				})
-			});
-			if (challengeRes.status === 409) {
-				printError("Email or slug already registered");
-				process.exitCode = 1;
-				return;
-			}
-			if (challengeRes.status === 429) {
-				printError("Rate limited — please wait before retrying");
-				process.exitCode = 1;
-				return;
-			}
-			if (!challengeRes.ok) {
-				printError(`Registration failed: ${(await challengeRes.json().catch(() => ({}))).detail ?? challengeRes.statusText}`);
-				process.exitCode = 1;
-				return;
-			}
-			const challenge = await challengeRes.json();
-			if (challenge.algorithm !== "rsa-timelock-v1") {
-				printError(`Unsupported algorithm: ${challenge.algorithm}. Please upgrade rine-cli.`);
-				process.exitCode = 1;
-				return;
-			}
-			process.stderr.write("By registering, you accept the rine terms of service and privacy policy:\n  https://rine.network/terms.html\n  https://rine.network/privacy.html\n");
-			const nonce = await solveTimeLockWithProgress(challenge.prefix, challenge.modulus, challenge.difficulty, (pct) => {
-				process.stdout.write(`\rSolving PoW challenge: ${pct}%`);
-			});
-			process.stdout.write("\rSolving PoW challenge: 100%\n");
-			const solveRes = await fetch(`${apiUrl}/auth/register/solve`, {
-				method: "POST",
-				headers: { "Content-Type": "application/json" },
-				body: JSON.stringify({
-					challenge_id: challenge.challenge_id,
-					nonce,
-					org_name: opts.name,
-					org_slug: opts.slug,
-					consent: true
-				})
-			});
-			if (solveRes.status === 409) {
-				printError("Conflict: email or slug already registered");
-				process.exitCode = 1;
-				return;
-			}
-			if (solveRes.status === 410) {
-				printError("Challenge expired — please register again");
-				process.exitCode = 1;
-				return;
-			}
-			if (!solveRes.ok) {
-				printError(`Solve failed: ${(await solveRes.json().catch(() => ({}))).detail ?? solveRes.statusText}`);
-				process.exitCode = 1;
-				return;
-			}
-			const data = await solveRes.json();
-			const creds = loadCredentials();
-			creds[profile] = {
-				client_id: data.client_id,
-				client_secret: data.client_secret
-			};
-			saveCredentials(creds);
-			try {
-				const tokenRes = await fetch(`${apiUrl}/oauth/token`, {
-					method: "POST",
-					headers: { "Content-Type": "application/x-www-form-urlencoded" },
-					body: new URLSearchParams({
-						grant_type: "client_credentials",
-						client_id: data.client_id,
-						client_secret: data.client_secret
-					}).toString()
-				});
-				if (tokenRes.ok) {
-					const tokenData = await tokenRes.json();
-					const cache = loadTokenCache();
-					cache[profile] = {
-						access_token: tokenData.access_token,
-						expires_at: Date.now() / 1e3 + tokenData.expires_in
-					};
-					saveTokenCache(cache);
-				}
-			} catch {
-				process.stderr.write("Warning: initial token cache failed\n");
-			}
-			if (gOpts.json) printJson(data);
-			else {
-				printSuccess(`Registered '${opts.name}' (${opts.slug})`);
-				console.log("Credentials saved to .rine/credentials.json");
-				console.log("Next: create an agent with 'rine agent create --name <agent-name>'");
-			}
-		} catch (err) {
-			printError(formatError(err));
+	program.command("register").description("Register a new organization (two-step PoW flow)").requiredOption("--email <email>", "Email address").requiredOption("--name <name>", "Organization name").requiredOption("--slug <slug>", "Organization slug").action(withErrorHandler(program, async (gOpts, opts) => {
+		const profile = gOpts.profile ?? "default";
+		const apiUrl = getApiUrl();
+		const challengeRes = await fetch(`${apiUrl}/auth/register`, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({
+				email: opts.email,
+				org_slug: opts.slug
+			})
+		});
+		if (challengeRes.status === 409) {
+			printError("Email or slug already registered");
 			process.exitCode = 1;
+			return;
 		}
-	});
+		if (challengeRes.status === 429) {
+			printError("Rate limited — please wait before retrying");
+			process.exitCode = 1;
+			return;
+		}
+		if (!challengeRes.ok) {
+			printError(`Registration failed: ${(await challengeRes.json().catch(() => ({}))).detail ?? challengeRes.statusText}`);
+			process.exitCode = 1;
+			return;
+		}
+		const challenge = await challengeRes.json();
+		if (challenge.algorithm !== "rsa-timelock-v1") {
+			printError(`Unsupported algorithm: ${challenge.algorithm}. Please upgrade rine-cli.`);
+			process.exitCode = 1;
+			return;
+		}
+		process.stderr.write("By registering, you accept the rine terms of service and privacy policy:\n  https://rine.network/terms.html\n  https://rine.network/privacy.html\n");
+		const progressStream = gOpts.json ? process.stderr : process.stdout;
+		const nonce = await solveTimeLockWithProgress(challenge.prefix, challenge.modulus, challenge.difficulty, (pct) => {
+			progressStream.write(`\rSolving PoW challenge: ${pct}%`);
+		});
+		progressStream.write("\rSolving PoW challenge: 100%\n");
+		const solveRes = await fetch(`${apiUrl}/auth/register/solve`, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({
+				challenge_id: challenge.challenge_id,
+				nonce,
+				org_name: opts.name,
+				org_slug: opts.slug,
+				consent: true
+			})
+		});
+		if (solveRes.status === 409) {
+			printError("Conflict: email or slug already registered");
+			process.exitCode = 1;
+			return;
+		}
+		if (solveRes.status === 410) {
+			printError("Challenge expired — please register again");
+			process.exitCode = 1;
+			return;
+		}
+		if (!solveRes.ok) {
+			printError(`Solve failed: ${(await solveRes.json().catch(() => ({}))).detail ?? solveRes.statusText}`);
+			process.exitCode = 1;
+			return;
+		}
+		const data = await solveRes.json();
+		const creds = loadCredentials();
+		creds[profile] = {
+			client_id: data.client_id,
+			client_secret: data.client_secret
+		};
+		saveCredentials(creds);
+		try {
+			cacheToken(profile, await fetchOAuthToken(data.client_id, data.client_secret));
+		} catch {
+			process.stderr.write("Warning: initial token cache failed\n");
+		}
+		if (gOpts.json) printJson(data);
+		else {
+			printSuccess(`Registered '${opts.name}' (${opts.slug})`);
+			console.log("Credentials saved to .rine/credentials.json");
+			console.log("Next: create an agent with 'rine agent create --name <agent-name>'");
+		}
+	}));
 }
 //#endregion
 //#region src/commands/stream.ts
-function formatMessageLine(dataStr) {
+async function formatMessageLine(dataStr, agentId, client) {
 	try {
 		const data = JSON.parse(dataStr);
-		return `[${(data.created_at ?? "").slice(0, 19) || "?"}] ${data.sender_handle ?? String(data.from_agent_id ?? "?")} \u2192 ${data.type ?? "?"}: ${data.payload ? JSON.stringify(data.payload).slice(0, 60) : ""}`;
+		const ts = (data.created_at ?? "").slice(0, 19) || "?";
+		const sender = data.sender_handle ?? String(data.from_agent_id ?? "?");
+		const msgType = data.type ?? "?";
+		const target = data.group_handle ? `${data.group_handle} (${msgType})` : msgType;
+		let preview = "[encrypted]";
+		if (data.encrypted_payload && agentKeysExist(agentId)) try {
+			let result;
+			if (data.encryption_version === "sender-key-v1" && data.group_id) result = await decryptGroupMessage(agentId, data.group_id, data.encrypted_payload, client);
+			else if (data.encryption_version === "hpke-v1") {
+				result = await decryptMessage(agentId, data.encrypted_payload, client);
+				ingestSenderKeyDistribution(agentId, data.type ?? "", result);
+			} else return `[${ts}] ${sender} \u2192 ${target}: [encrypted]`;
+			preview = `[${result.verified ? "✓" : "?"}] ${result.plaintext.slice(0, 60)}`;
+		} catch {
+			preview = "[decrypt failed]";
+		}
+		return `[${ts}] ${sender} \u2192 ${target}: ${preview}`;
 	} catch {
 		return `[message] ${dataStr.slice(0, 80)}`;
 	}
 }
 function registerStream(program) {
-	program.command("stream").description("Stream incoming messages via SSE").option("--agent <id>", "Agent ID (auto-resolved if omitted)").option("--verbose", "Show heartbeats and reconnect details").action(async (opts) => {
+	program.command("stream").description("Stream incoming messages via SSE").option("--agent <id>", "Agent ID to stream (defaults to your agent)").option("--verbose", "Show heartbeats and reconnect details").action(async (opts) => {
 		try {
 			const gOpts = program.opts();
 			const { client, profileName, entry } = await createClient(gOpts.profile);
-			let agentId = opts.agent;
-			if (!agentId) agentId = await resolveFirstAgent(client);
+			const agentId = await resolveAgent(client, opts.agent, gOpts.as);
 			const url = `${getApiUrl()}/agents/${agentId}/stream`;
 			let lastEventId;
 			let backoff = 1;
@@ -1169,7 +2040,7 @@ function registerStream(program) {
 					Accept: "text/event-stream"
 				};
 				if (lastEventId) headers["Last-Event-ID"] = lastEventId;
-				await new Promise((resolve, reject) => {
+				await new Promise((resolve) => {
 					if (stopped) {
 						resolve();
 						return;
@@ -1184,7 +2055,7 @@ function registerStream(program) {
 								id,
 								data
 							}));
-							else if (event === "message") console.log(formatMessageLine(data));
+							else if (event === "message") formatMessageLine(data, agentId, client).then((line) => console.log(line), () => console.log(`[message] ${data.slice(0, 80)}`));
 							else if (event === "heartbeat" && opts.verbose) process.stderr.write(`[heartbeat] ${data}\n`);
 						},
 						onDisconnect: () => resolve(),
@@ -1204,7 +2075,7 @@ function registerStream(program) {
 					process.once("SIGINT", onStop);
 				});
 				backoff = 1;
-			} catch (err) {
+			} catch {
 				if (stopped) break;
 				if (opts.verbose) process.stderr.write(`Reconnecting in ${backoff}s...\n`);
 				else process.stderr.write("Reconnecting...\n");
@@ -1221,125 +2092,86 @@ function registerStream(program) {
 //#region src/commands/webhook.ts
 function registerWebhook(program) {
 	const webhook = program.command("webhook").description("Manage webhooks");
-	webhook.command("create").description("Create a new webhook").requiredOption("--agent <id>", "Agent ID to attach webhook to").requiredOption("--url <url>", "Webhook target URL (must be https://)").action(async (opts) => {
-		const gOpts = program.opts();
+	webhook.command("create").description("Create a new webhook").option("--agent <id>", "Agent ID (defaults to your agent)").requiredOption("--url <url>", "Webhook target URL (must be https://)").action(withClient(program, async ({ client, gOpts }, opts) => {
 		if (!opts.url.startsWith("https://")) {
 			printError("Webhook URL must start with https://");
 			process.exitCode = 2;
 			return;
 		}
-		try {
-			const { client } = await createClient(gOpts.profile);
-			const data = await client.post("/webhooks", {
-				agent_id: opts.agent,
-				url: opts.url
-			});
-			if (gOpts.json) printJson(data);
-			else printTable([{
-				ID: data.id,
-				"Agent ID": data.agent_id,
-				URL: data.url,
-				Secret: data.secret,
-				Active: data.active,
-				Created: data.created_at
-			}]);
-		} catch (err) {
-			printError(formatError(err));
-			process.exitCode = 1;
-		}
-	});
-	webhook.command("list").description("List webhooks").option("--agent <id>", "Filter by agent ID").option("--include-inactive", "Include inactive webhooks").action(async (opts) => {
-		const gOpts = program.opts();
-		try {
-			const { client } = await createClient(gOpts.profile);
-			const params = {};
-			if (opts.agent) params.agent_id = opts.agent;
-			if (opts.includeInactive) params.include_inactive = true;
-			const data = await client.get("/webhooks", params);
-			if (gOpts.json) printJson(data);
-			else printTable((data.items ?? []).map((w) => ({
-				ID: w.id,
-				"Agent ID": w.agent_id,
-				URL: w.url,
-				Active: w.active,
-				Created: w.created_at
-			})));
-		} catch (err) {
-			printError(formatError(err));
-			process.exitCode = 1;
-		}
-	});
-	webhook.command("delete").description("Delete a webhook").argument("<webhook-id>", "Webhook ID").option("--yes", "Skip confirmation prompt").action(async (webhookId, opts) => {
-		const gOpts = program.opts();
-		try {
-			if (!opts.yes && !gOpts.json) {
-				if (!await promptConfirm(`Delete webhook ${webhookId}?`)) return;
-			}
-			const { client } = await createClient(gOpts.profile);
-			await client.delete(`/webhooks/${webhookId}`);
-			printMutationOk("Webhook deleted", gOpts.json);
-		} catch (err) {
-			printError(formatError(err));
-			process.exitCode = 1;
-		}
-	});
-	webhook.command("deactivate").description("Deactivate a webhook").argument("<webhook-id>", "Webhook ID").action(async (webhookId) => {
-		const gOpts = program.opts();
-		try {
-			const { client } = await createClient(gOpts.profile);
-			await client.patch(`/webhooks/${webhookId}`, { active: false });
-			printMutationOk("Webhook deactivated", gOpts.json);
-		} catch (err) {
-			printError(formatError(err));
-			process.exitCode = 1;
-		}
-	});
-	webhook.command("activate").description("Activate a webhook").argument("<webhook-id>", "Webhook ID").action(async (webhookId) => {
-		const gOpts = program.opts();
-		try {
-			const { client } = await createClient(gOpts.profile);
-			await client.patch(`/webhooks/${webhookId}`, { active: true });
-			printMutationOk("Webhook activated", gOpts.json);
-		} catch (err) {
-			printError(formatError(err));
-			process.exitCode = 1;
-		}
-	});
-	webhook.command("deliveries").description("List deliveries for a webhook").argument("<webhook-id>", "Webhook ID").option("--status <status>", "Filter by delivery status").option("--limit <n>", "Maximum number of deliveries").action(async (webhookId, opts) => {
-		const gOpts = program.opts();
-		try {
-			const { client } = await createClient(gOpts.profile);
-			const params = {};
-			if (opts.status) params.status = opts.status;
-			if (opts.limit) params.limit = opts.limit;
-			const data = await client.get(`/webhooks/${webhookId}/deliveries`, params);
-			if (gOpts.json) printJson(data);
-			else printTable((data.items ?? []).map((d) => ({
-				ID: d.id,
-				"Message ID": d.message_id,
-				Status: d.status,
-				Attempts: d.attempts,
-				"Last Error": d.last_error ?? "—",
-				Created: d.created_at
-			})));
-		} catch (err) {
-			printError(formatError(err));
-			process.exitCode = 1;
+		const agentId = await resolveAgent(client, opts.agent, gOpts.as);
+		const data = await client.post("/webhooks", {
+			agent_id: agentId,
+			url: opts.url
+		});
+		if (gOpts.json) printJson(data);
+		else printTable([{
+			ID: data.id,
+			"Agent ID": data.agent_id,
+			URL: data.url,
+			Secret: data.secret,
+			Active: data.active,
+			Created: data.created_at
+		}]);
+	}));
+	webhook.command("list").description("List webhooks").option("--agent <id>", "Filter by agent ID").option("--include-inactive", "Include inactive webhooks").action(withClient(program, async ({ client, gOpts }, opts) => {
+		const params = {};
+		if (opts.agent) params.agent_id = opts.agent;
+		if (opts.includeInactive) params.include_inactive = true;
+		const data = await client.get("/webhooks", params);
+		if (gOpts.json) printJson(data);
+		else printTable(data.items.map((w) => ({
+			ID: w.id,
+			"Agent ID": w.agent_id,
+			URL: w.url,
+			Active: w.active,
+			Created: w.created_at
+		})));
+	}));
+	webhook.command("delete").description("Delete a webhook").argument("<webhook-id>", "Webhook ID").option("--yes", "Skip confirmation prompt").action(withClient(program, async ({ client, gOpts }, webhookId, opts) => {
+		if (!opts.yes && !gOpts.json) {
+			if (!await promptConfirm(`Delete webhook ${webhookId}?`)) return;
 		}
-	});
+		await client.delete(`/webhooks/${webhookId}`);
+		printMutationOk("Webhook deleted", gOpts.json);
+	}));
+	webhook.command("deactivate").description("Deactivate a webhook").argument("<webhook-id>", "Webhook ID").action(withClient(program, async ({ client, gOpts }, webhookId) => {
+		await client.patch(`/webhooks/${webhookId}`, { active: false });
+		printMutationOk("Webhook deactivated", gOpts.json);
+	}));
+	webhook.command("activate").description("Activate a webhook").argument("<webhook-id>", "Webhook ID").action(withClient(program, async ({ client, gOpts }, webhookId) => {
+		await client.patch(`/webhooks/${webhookId}`, { active: true });
+		printMutationOk("Webhook activated", gOpts.json);
+	}));
+	webhook.command("deliveries").description("List deliveries for a webhook").argument("<webhook-id>", "Webhook ID").option("--status <status>", "Filter by delivery status").option("--limit <n>", "Maximum number of deliveries").action(withClient(program, async ({ client, gOpts }, webhookId, opts) => {
+		const params = {};
+		if (opts.status) params.status = opts.status;
+		if (opts.limit) params.limit = opts.limit;
+		const data = await client.get(`/webhooks/${webhookId}/deliveries`, params);
+		if (gOpts.json) printJson(data);
+		else printTable(data.items.map((d) => ({
+			ID: d.id,
+			"Message ID": d.message_id,
+			Status: d.status,
+			Attempts: d.attempts,
+			"Last Error": d.last_error ?? "—",
+			Created: d.created_at
+		})));
+	}));
 }
 //#endregion
 //#region src/main.ts
 const { version } = createRequire(import.meta.url)("../package.json");
-const program = new Command("rine").version(version).description("rine.network CLI — messaging infrastructure for AI agents").option("--profile <name>", "credential profile to use", "default").option("--json", "output as JSON").option("--table", "output as table");
+const program = new Command("rine").version(version).description("rine.network CLI — messaging infrastructure for AI agents").option("--profile <name>", "credential profile to use", "default").option("--json", "output as JSON").option("--table", "output as table").option("--as <agent>", "act as a specific agent (UUID or handle, e.g. bot@org.rine.network)");
 registerAuth(program);
 registerRegister(program);
 registerOrg(program);
 registerAgent(program);
 registerAgentProfile(program);
 registerMessages(program);
+registerGroup(program);
 registerDiscover(program);
 registerWebhook(program);
+registerKeys(program);
 registerStream(program);
 program.parse();
 //#endregion