@rine-network/cli 0.6.1 → 0.7.1

package/dist/main.js

@@ -1,246 +1,10 @@
 import { createRequire } from "node:module";
 import { Command } from "commander";
+import { HttpClient, RineApiError, UUID_RE, agentKeysExist, cacheToken, decryptGroupMessage, decryptMessage, encryptGroupMessage, encryptMessage, encryptionPublicKeyToJWK, fetchAgents, fetchOAuthToken, fetchRecipientEncryptionKey, formatError, fromBase64Url, generateAgentKeys, getAgentPublicKeys, getCredentialEntry, getOrCreateSenderKey, getOrRefreshToken, ingestSenderKeyDistribution, isBareAgentName, loadAgentKeys, loadCredentials, loadTokenCache, resolveAgent, resolveApiUrl, resolveConfigDir, resolveHandleViaWebFinger, resolveToUuid, saveAgentKeys, saveCredentials, saveTokenCache, signingPublicKeyToJWK, solveTimeLockWithProgress, toBase64Url, validateEncryptionKey, validateSigningKey } from "@rine-network/core";
+import readline from "node:readline";
 import * as fs from "node:fs";
 import { join } from "node:path";
-import { ed25519, x25519 } from "@noble/curves/ed25519.js";
-import readline from "node:readline";
-import { Aes256Gcm, CipherSuite, HkdfSha256 } from "@hpke/core";
-import { DhkemX25519HkdfSha256 } from "@hpke/dhkem-x25519";
-import { hmac } from "@noble/hashes/hmac.js";
-import { sha256 } from "@noble/hashes/sha2.js";
 import { createEventSource } from "eventsource-client";
-//#region \0rolldown/runtime.js
-var __defProp = Object.defineProperty;
-var __exportAll = (all, no_symbols) => {
-	let target = {};
-	for (var name in all) __defProp(target, name, {
-		get: all[name],
-		enumerable: true
-	});
-	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
-	return target;
-};
-//#endregion
-//#region src/errors.ts
-var RineApiError = class extends Error {
-	constructor(status, detail, raw) {
-		super(`${status}: ${detail}`);
-		this.status = status;
-		this.detail = detail;
-		this.raw = raw;
-		this.name = "RineApiError";
-	}
-};
-function formatError(err) {
-	if (err instanceof RineApiError) return err.detail;
-	if (err instanceof Error) return err.message;
-	return String(err);
-}
-//#endregion
-//#region src/config.ts
-function getConfigDir() {
-	return process.env.RINE_CONFIG_DIR ?? join(process.cwd(), ".rine");
-}
-function getApiUrl() {
-	return (process.env.RINE_API_URL ?? "https://rine.network").replace(/\/$/, "");
-}
-function ensureDir(dir) {
-	fs.mkdirSync(dir, {
-		recursive: true,
-		mode: 448
-	});
-}
-function writeAtomic(path, content) {
-	const tmpPath = `${path}.tmp`;
-	fs.writeFileSync(tmpPath, content, "utf-8");
-	fs.renameSync(tmpPath, path);
-	fs.chmodSync(path, 384);
-}
-function loadCredentials() {
-	const path = join(getConfigDir(), "credentials.json");
-	try {
-		const raw = fs.readFileSync(path, "utf-8");
-		return JSON.parse(raw);
-	} catch {
-		return {};
-	}
-}
-function saveCredentials(creds) {
-	const dir = getConfigDir();
-	ensureDir(dir);
-	writeAtomic(join(dir, "credentials.json"), JSON.stringify(creds, null, 2));
-}
-function loadTokenCache() {
-	const path = join(getConfigDir(), "token_cache.json");
-	try {
-		const raw = fs.readFileSync(path, "utf-8");
-		return JSON.parse(raw);
-	} catch {
-		return {};
-	}
-}
-function saveTokenCache(cache) {
-	const dir = getConfigDir();
-	ensureDir(dir);
-	writeAtomic(join(dir, "token_cache.json"), JSON.stringify(cache, null, 2));
-}
-function cacheToken(profile, token) {
-	const cache = loadTokenCache();
-	cache[profile] = {
-		access_token: token.access_token,
-		expires_at: Date.now() / 1e3 + token.expires_in
-	};
-	saveTokenCache(cache);
-}
-/**
-* Resolves credentials for a profile. Priority:
-* 1. RINE_CLIENT_ID + RINE_CLIENT_SECRET env vars (both required)
-* 2. credentials.json for the given profile
-* Returns undefined if no credentials found.
-*/
-function getCredentialEntry(profile = "default") {
-	const envId = process.env.RINE_CLIENT_ID;
-	const envSecret = process.env.RINE_CLIENT_SECRET;
-	if (envId && envSecret) return {
-		client_id: envId,
-		client_secret: envSecret
-	};
-	return loadCredentials()[profile];
-}
-//#endregion
-//#region src/http.ts
-async function parseErrorDetail(res) {
-	try {
-		const body = await res.json();
-		if (typeof body.detail === "string") return body.detail;
-		if (Array.isArray(body.detail)) return body.detail.map((e) => e.msg).join("; ");
-	} catch {}
-	return res.statusText;
-}
-var HttpClient = class {
-	baseUrl;
-	tokenFn;
-	canRefresh;
-	defaultHeaders;
-	constructor(opts) {
-		this.baseUrl = opts.apiUrl ?? getApiUrl();
-		this.tokenFn = opts.tokenFn;
-		this.canRefresh = opts.canRefresh ?? true;
-		this.defaultHeaders = opts.defaultHeaders ?? {};
-	}
-	async request(method, path, body, params, extraHeaders) {
-		let url = this.baseUrl + path;
-		if (params) {
-			const qs = new URLSearchParams(Object.entries(params).filter(([, v]) => v !== void 0 && v !== null).map(([k, v]) => [k, String(v)])).toString();
-			if (qs) url += `?${qs}`;
-		}
-		const doFetch = async (force) => {
-			const headers = {
-				Authorization: `Bearer ${await this.tokenFn(force)}`,
-				...this.defaultHeaders,
-				...extraHeaders
-			};
-			if (body !== void 0) headers["Content-Type"] = "application/json";
-			const init = {
-				method,
-				headers
-			};
-			if (body !== void 0) init.body = JSON.stringify(body);
-			return fetch(url, init);
-		};
-		let res = await doFetch();
-		if (res.status === 401 && this.canRefresh) res = await doFetch(true);
-		if (!res.ok) {
-			const detail = await parseErrorDetail(res);
-			throw new RineApiError(res.status, detail, res);
-		}
-		if (res.status === 204) return void 0;
-		return res.json();
-	}
-	get(path, params, extraHeaders) {
-		return this.request("GET", path, void 0, params, extraHeaders);
-	}
-	post(path, body, extraHeaders) {
-		return this.request("POST", path, body, void 0, extraHeaders);
-	}
-	put(path, body, extraHeaders) {
-		return this.request("PUT", path, body, void 0, extraHeaders);
-	}
-	patch(path, body, extraHeaders) {
-		return this.request("PATCH", path, body, void 0, extraHeaders);
-	}
-	delete(path, extraHeaders) {
-		return this.request("DELETE", path, void 0, void 0, extraHeaders);
-	}
-	/** Unauthenticated GET for public endpoints (e.g. /directory/*). */
-	static async publicGet(path, params) {
-		const base = getApiUrl();
-		const qs = params?.toString();
-		const url = qs ? `${base}${path}?${qs}` : `${base}${path}`;
-		const res = await fetch(url, { headers: { Accept: "application/json" } });
-		if (!res.ok) {
-			const detail = await parseErrorDetail(res);
-			throw new RineApiError(res.status, detail, res);
-		}
-		return res.json();
-	}
-};
-/**
-* Resolves a valid access token. Priority:
-* 1. RINE_TOKEN env var — used directly, no cache/refresh
-* 2. Token cache — returned if not expired (60s margin)
-* 3. POST /oauth/token — fetches fresh token and caches it
-*/
-/**
-* Fetches an OAuth token from POST /oauth/token.
-* Shared by getOrRefreshToken, login, and register.
-*/
-async function fetchOAuthToken(clientId, clientSecret) {
-	const apiUrl = getApiUrl();
-	const res = await fetch(`${apiUrl}/oauth/token`, {
-		method: "POST",
-		headers: { "Content-Type": "application/x-www-form-urlencoded" },
-		body: new URLSearchParams({
-			grant_type: "client_credentials",
-			client_id: clientId,
-			client_secret: clientSecret
-		}).toString()
-	});
-	if (!res.ok) {
-		const body = await res.json().catch(() => ({}));
-		throw new RineApiError(res.status, body.detail ?? "Token request failed");
-	}
-	return res.json();
-}
-async function getOrRefreshToken(entry, profileName, force = false) {
-	const envToken = process.env.RINE_TOKEN;
-	if (envToken) return envToken;
-	const now = Date.now() / 1e3;
-	if (!force) {
-		const cached = loadTokenCache()[profileName];
-		if (cached !== void 0 && cached.expires_at - now > 60) return cached.access_token;
-	}
-	if (!entry) throw new RineApiError(0, "No credentials found. Run `rine login` first.");
-	const data = await fetchOAuthToken(entry.client_id, entry.client_secret);
-	cacheToken(profileName, data);
-	return data.access_token;
-}
-async function createClient(profileFlag, defaultHeaders) {
-	const profileName = profileFlag ?? "default";
-	const entry = getCredentialEntry(profileName);
-	const canRefresh = !process.env.RINE_TOKEN && entry !== void 0;
-	const tokenFn = (force = false) => getOrRefreshToken(entry, profileName, force);
-	return {
-		client: new HttpClient({
-			tokenFn,
-			canRefresh,
-			defaultHeaders
-		}),
-		profileName,
-		entry
-	};
-}
-//#endregion
 //#region src/output.ts
 function printSuccess(msg) {
 	console.log(`✓ ${msg}`);
@@ -280,103 +44,43 @@ function printError(msg) {
 	console.error(msg);
 }
 //#endregion
-//#region src/resolve-handle.ts
-const UUID_ALIAS_RE = /\/agents\/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
-const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-/**
-* Resolves a handle (e.g. "agent@org.rine.network") to a UUID
-* via WebFinger (RFC 7033).
-*
-* Returns the UUID string on success, or the original input unchanged
-* on failure (caller validates UUID format and reports the error).
-*/
-async function resolveHandleViaWebFinger(handle) {
-	try {
-		const params = new URLSearchParams({ resource: `acct:${handle}` });
-		const data = await HttpClient.publicGet("/.well-known/webfinger", params);
-		for (const alias of data.aliases ?? []) {
-			const match = UUID_ALIAS_RE.exec(alias);
-			if (match?.[1]) return match[1];
-		}
-	} catch {}
-	return handle;
-}
-//#endregion
-//#region src/resolve-agent.ts
-let cached;
-/**
-* Resolve a value that may be a UUID or a handle (containing @) to a UUID.
-* Handles are resolved via WebFinger. Required because local key storage
-* is indexed by UUID.
-*/
-async function resolveToUuid(value) {
-	if (!value.includes("@")) {
-		if (UUID_RE.test(value)) return value;
-		throw new Error(`Invalid agent identifier '${value}': expected a UUID or handle (e.g. agent@org.rine.network).`);
-	}
-	const resolved = await resolveHandleViaWebFinger(value);
-	if (!UUID_RE.test(resolved)) throw new Error(`Cannot resolve handle "${value}" to agent ID. Ensure WebFinger is available or use a UUID.`);
-	return resolved;
-}
-/** Check if a value is a bare agent name (not a UUID, not a handle). */
-function isBareAgentName(value) {
-	return !value.includes("@") && !UUID_RE.test(value);
-}
-async function fetchAgents(client) {
-	if (cached === void 0) cached = (await client.get("/agents")).items;
-	return cached;
-}
-/** Resolve a bare agent name against the org's agent list (case-insensitive). */
-async function resolveBareName(client, name) {
-	const agents = await fetchAgents(client);
-	const lower = name.toLowerCase();
-	const match = agents.find((a) => a.name.toLowerCase() === lower);
-	if (match) return match.id;
-	const lines = agents.map((a) => `  ${a.name}  ${a.handle}`).join("\n");
-	throw new Error(agents.length > 0 ? `No agent named '${name}'. Available agents:\n${lines}` : `No agent named '${name}'. No active agents found.`);
-}
-/**
-* Resolve which agent ID to use.
-* Priority: explicit --agent flag > --as global flag > auto-resolve (single-agent shortcut).
-* Accepts UUIDs, handles (e.g. "bot@org.rine.network"), or bare names (e.g. "kofi").
-*/
-async function resolveAgent(client, explicit, asFlag) {
-	if (explicit) {
-		if (isBareAgentName(explicit)) return resolveBareName(client, explicit);
-		return resolveToUuid(explicit);
-	}
-	if (asFlag) {
-		if (isBareAgentName(asFlag)) return resolveBareName(client, asFlag);
-		return resolveToUuid(asFlag);
-	}
-	const agents = await fetchAgents(client);
-	if (agents.length === 1) {
-		const agent = agents[0];
-		if (agent) return agent.id;
-	}
-	if (agents.length === 0) throw new Error("No active agents. Create one with 'rine agent create --name <name>'");
-	const lines = agents.map((a) => `  ${a.id}  ${a.handle}`).join("\n");
-	throw new Error(`Multiple agents found. Specify with --agent <uuid>:\n${lines}`);
-}
-//#endregion
 //#region src/action.ts
-/**
-* Wraps a command action with automatic client creation and error handling.
-* Commander calls action(fn) with positional args first, then the options object.
-* This wrapper forwards all arguments to the inner function.
-*/
+async function createClient(configDir, apiUrl, profileFlag, defaultHeaders) {
+	const profileName = profileFlag ?? "default";
+	const entry = getCredentialEntry(configDir, profileName);
+	const envToken = process.env.RINE_TOKEN;
+	const canRefresh = !envToken && entry !== void 0;
+	const tokenFn = (force = false) => getOrRefreshToken(configDir, apiUrl, entry, profileName, {
+		force,
+		envToken
+	});
+	return {
+		client: new HttpClient({
+			tokenFn,
+			apiUrl,
+			canRefresh,
+			defaultHeaders
+		}),
+		profileName,
+		entry
+	};
+}
 function withClient(program, fn) {
 	return async (...args) => {
 		try {
 			const gOpts = program.opts();
+			const configDir = resolveConfigDir();
+			const apiUrl = resolveApiUrl();
 			const defaultHeaders = {};
-			if (gOpts.as && !isBareAgentName(gOpts.as)) defaultHeaders["X-Rine-Agent"] = await resolveToUuid(gOpts.as);
-			const { client, profileName } = await createClient(gOpts.profile, defaultHeaders);
-			if (gOpts.as && isBareAgentName(gOpts.as)) defaultHeaders["X-Rine-Agent"] = await resolveAgent(client, void 0, gOpts.as);
+			if (gOpts.as && !isBareAgentName(gOpts.as)) defaultHeaders["X-Rine-Agent"] = await resolveToUuid(apiUrl, gOpts.as);
+			const { client, profileName } = await createClient(configDir, apiUrl, gOpts.profile, defaultHeaders);
+			if (gOpts.as && isBareAgentName(gOpts.as)) defaultHeaders["X-Rine-Agent"] = await resolveAgent(apiUrl, await fetchAgents(client), void 0, gOpts.as);
 			await fn({
 				client,
 				gOpts,
 				profileName,
+				configDir,
+				apiUrl,
 				extraHeaders: defaultHeaders
 			}, ...args);
 		} catch (err) {
@@ -385,10 +89,6 @@ function withClient(program, fn) {
 		}
 	};
 }
-/**
-* Wraps a command action with error handling only (no client creation).
-* For commands like logout that don't need authentication.
-*/
 function withErrorHandler(program, fn) {
 	return async (...args) => {
 		try {
@@ -516,121 +216,6 @@ function registerAgentProfile(program) {
 	}));
 }
 //#endregion
-//#region src/crypto/keys.ts
-var keys_exports = /* @__PURE__ */ __exportAll({
-	agentIdFromKid: () => agentIdFromKid,
-	agentKeysExist: () => agentKeysExist,
-	encryptionPublicKeyToJWK: () => encryptionPublicKeyToJWK,
-	fromBase64Url: () => fromBase64Url,
-	generateAgentKeys: () => generateAgentKeys,
-	generateEncryptionKeyPair: () => generateEncryptionKeyPair,
-	generateSigningKeyPair: () => generateSigningKeyPair,
-	jwkToPublicKey: () => jwkToPublicKey,
-	loadAgentKeys: () => loadAgentKeys,
-	saveAgentKeys: () => saveAgentKeys,
-	signingPublicKeyToJWK: () => signingPublicKeyToJWK,
-	toBase64Url: () => toBase64Url,
-	validatePathId: () => validatePathId
-});
-function toBase64Url(bytes) {
-	return Buffer.from(bytes).toString("base64url");
-}
-function fromBase64Url(s) {
-	return new Uint8Array(Buffer.from(s, "base64url"));
-}
-function generateSigningKeyPair() {
-	const privateKey = ed25519.utils.randomSecretKey();
-	return {
-		privateKey,
-		publicKey: ed25519.getPublicKey(privateKey)
-	};
-}
-function generateEncryptionKeyPair() {
-	const privateKey = x25519.utils.randomSecretKey();
-	return {
-		privateKey,
-		publicKey: x25519.getPublicKey(privateKey)
-	};
-}
-function generateAgentKeys() {
-	return {
-		signing: generateSigningKeyPair(),
-		encryption: generateEncryptionKeyPair()
-	};
-}
-function signingPublicKeyToJWK(publicKey) {
-	return {
-		kty: "OKP",
-		crv: "Ed25519",
-		x: toBase64Url(publicKey)
-	};
-}
-function encryptionPublicKeyToJWK(publicKey) {
-	return {
-		kty: "OKP",
-		crv: "X25519",
-		x: toBase64Url(publicKey)
-	};
-}
-function jwkToPublicKey(jwk) {
-	const key = fromBase64Url(jwk.x);
-	if (key.length !== 32) throw new Error(`Invalid public key: expected 32 bytes, got ${key.length}`);
-	return key;
-}
-const KID_RE = /^rine:([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
-function agentIdFromKid(kid) {
-	const match = KID_RE.exec(kid);
-	if (!match) throw new Error(`Invalid sender KID format: ${kid}`);
-	return match[1];
-}
-const PATH_SAFE_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-function validatePathId(id, label) {
-	if (!PATH_SAFE_RE.test(id)) throw new Error(`Invalid ${label}: must be a UUID, got '${id}'`);
-}
-function getKeysDir$1() {
-	return join(getConfigDir(), "keys");
-}
-function agentKeysDir(agentId) {
-	validatePathId(agentId, "agent ID");
-	return join(getKeysDir$1(), agentId);
-}
-function saveAgentKeys(agentId, keys) {
-	const dir = agentKeysDir(agentId);
-	fs.mkdirSync(dir, {
-		recursive: true,
-		mode: 448
-	});
-	const sigPath = join(dir, "signing.key");
-	fs.writeFileSync(sigPath, toBase64Url(keys.signing.privateKey), "utf-8");
-	fs.chmodSync(sigPath, 384);
-	const encPath = join(dir, "encryption.key");
-	fs.writeFileSync(encPath, toBase64Url(keys.encryption.privateKey), "utf-8");
-	fs.chmodSync(encPath, 384);
-}
-function loadAgentKeys(agentId) {
-	const dir = agentKeysDir(agentId);
-	const sigPriv = fromBase64Url(fs.readFileSync(join(dir, "signing.key"), "utf-8").trim());
-	if (sigPriv.length !== 32) throw new Error(`Corrupt signing key: expected 32 bytes, got ${sigPriv.length}`);
-	const sigPub = ed25519.getPublicKey(sigPriv);
-	const encPriv = fromBase64Url(fs.readFileSync(join(dir, "encryption.key"), "utf-8").trim());
-	if (encPriv.length !== 32) throw new Error(`Corrupt encryption key: expected 32 bytes, got ${encPriv.length}`);
-	const encPub = x25519.getPublicKey(encPriv);
-	return {
-		signing: {
-			privateKey: sigPriv,
-			publicKey: sigPub
-		},
-		encryption: {
-			privateKey: encPriv,
-			publicKey: encPub
-		}
-	};
-}
-function agentKeysExist(agentId) {
-	const dir = agentKeysDir(agentId);
-	return fs.existsSync(join(dir, "signing.key")) && fs.existsSync(join(dir, "encryption.key"));
-}
-//#endregion
 //#region src/prompt.ts
 /** Prompt for a plain-text value on stdout/stdin. */
 async function promptText(question) {
@@ -691,7 +276,7 @@ function toAgentRow(a, opts = {}) {
 }
 function registerAgent(program) {
 	const agent = program.command("agent").description("Agent management");
-	agent.command("create").description("Create a new agent").option("--name <name>", "Agent name").option("--[no-]human-oversight", "Require human oversight (default: true)").option("--unlisted", "Mark agent as unlisted (not in public directory)").action(withClient(program, async ({ client, gOpts }, opts) => {
+	agent.command("create").description("Create a new agent").option("--name <name>", "Agent name").option("--[no-]human-oversight", "Require human oversight (default: true)").option("--unlisted", "Mark agent as unlisted (not in public directory)").action(withClient(program, async ({ client, gOpts, configDir }, opts) => {
 		let name = opts.name;
 		if (!name) {
 			name = await promptText("Agent name: ");
@@ -710,13 +295,13 @@ function registerAgent(program) {
 		if (opts.humanOversight !== void 0) body.human_oversight = opts.humanOversight;
 		if (opts.unlisted) body.unlisted = true;
 		const data = await client.post("/agents", body);
-		saveAgentKeys(data.id, agentKeys);
+		saveAgentKeys(configDir, data.id, agentKeys);
 		if (data.poll_url) {
 			const profile = gOpts.profile ?? "default";
-			const creds = loadCredentials();
+			const creds = loadCredentials(configDir);
 			if (creds[profile]) {
 				creds[profile].poll_url = data.poll_url;
-				saveCredentials(creds);
+				saveCredentials(configDir, creds);
 			}
 		}
 		if (gOpts.json) printJson(data);
@@ -784,16 +369,18 @@ function registerAuth(program) {
 	program.command("login").description("Log in with OAuth2 client credentials").option("--client-id <id>", "Client ID").option("--client-secret <secret>", "Client secret").action(async (opts) => {
 		try {
 			const profile = program.opts().profile ?? "default";
+			const configDir = resolveConfigDir();
+			const apiUrl = resolveApiUrl();
 			const clientId = opts.clientId ?? await promptText("Client ID: ");
 			const clientSecret = opts.clientSecret ?? await promptPassword("Client secret: ");
-			const tokenData = await fetchOAuthToken(clientId, clientSecret);
-			const creds = loadCredentials();
+			const tokenData = await fetchOAuthToken(apiUrl, clientId, clientSecret);
+			const creds = loadCredentials(configDir);
 			creds[profile] = {
 				client_id: clientId,
 				client_secret: clientSecret
 			};
-			saveCredentials(creds);
-			cacheToken(profile, tokenData);
+			saveCredentials(configDir, creds);
+			cacheToken(configDir, profile, tokenData);
 			printSuccess(`Logged in as ${clientId}`);
 		} catch (err) {
 			printError(formatError(err));
@@ -802,9 +389,10 @@ function registerAuth(program) {
 	});
 	program.command("logout").description("Clear cached token. Credentials are preserved.").action(withErrorHandler(program, (gOpts) => {
 		const profile = gOpts.profile ?? "default";
-		const cache = loadTokenCache();
+		const configDir = resolveConfigDir();
+		const cache = loadTokenCache(configDir);
 		delete cache[profile];
-		saveTokenCache(cache);
+		saveTokenCache(configDir, cache);
 		printSuccess(`Logged out — token cache cleared for profile '${profile}'. Credentials preserved.`);
 	}));
 	program.command("status").description("Show org status").action(withClient(program, async ({ client, gOpts }) => {
@@ -813,7 +401,9 @@ function registerAuth(program) {
 	program.command("whoami").description("Show current identity and status").action(async () => {
 		const gOpts = program.opts();
 		const profile = gOpts.profile ?? "default";
-		const entry = getCredentialEntry(profile);
+		const configDir = resolveConfigDir();
+		const apiUrl = resolveApiUrl();
+		const entry = getCredentialEntry(configDir, profile);
 		if (!entry) {
 			if (gOpts.json) printJson({ logged_in: false });
 			else printTable([{
@@ -823,9 +413,10 @@ function registerAuth(program) {
 			return;
 		}
 		try {
-			const token = await getOrRefreshToken(entry, profile);
+			const token = await getOrRefreshToken(configDir, apiUrl, entry, profile);
 			const client = new HttpClient({
 				tokenFn: () => Promise.resolve(token),
+				apiUrl,
 				canRefresh: false,
 				defaultHeaders: {}
 			});
@@ -834,9 +425,10 @@ function registerAuth(program) {
 			let agentId;
 			let keysLabel;
 			try {
-				agentId = await resolveAgent(client, void 0, gOpts.as);
-				agentHandle = (await client.get("/agents")).items.find((a) => a.id === agentId)?.handle;
-				const hasLocal = agentKeysExist(agentId);
+				const agents = await fetchAgents(client);
+				agentId = await resolveAgent(apiUrl, agents, void 0, gOpts.as);
+				agentHandle = agents.find((a) => a.id === agentId)?.handle;
+				const hasLocal = agentKeysExist(configDir, agentId);
 				let hasServer = false;
 				try {
 					await client.get(`/agents/${agentId}/keys`);
@@ -846,7 +438,7 @@ function registerAuth(program) {
 			} catch {}
 			if (gOpts.json) printJson({
 				profile,
-				api: getApiUrl(),
+				api: apiUrl,
 				org: {
 					name: org.name,
 					slug: org.slug
@@ -866,7 +458,7 @@ function registerAuth(program) {
 					},
 					{
 						Field: "API",
-						Value: getApiUrl()
+						Value: apiUrl
 					},
 					{
 						Field: "Org",
@@ -902,11 +494,16 @@ function registerAuth(program) {
 	authGroup.command("token").description("Get or refresh access token").option("--force", "Force token refresh (bypass cache)").action(withErrorHandler(program, async (gOpts, opts) => {
 		const profile = gOpts.profile ?? "default";
 		const force = opts.force === true;
+		const configDir = resolveConfigDir();
+		const apiUrl = resolveApiUrl();
 		const now = Date.now() / 1e3;
 		const envToken = process.env.RINE_TOKEN;
-		const cached = loadTokenCache()[profile];
+		const cached = loadTokenCache(configDir)[profile];
 		const source = envToken !== void 0 || !force && cached !== void 0 && cached.expires_at - now > 60 ? "cache" : "server";
-		const token = await getOrRefreshToken(getCredentialEntry(profile), profile, force);
+		const token = await getOrRefreshToken(configDir, apiUrl, getCredentialEntry(configDir, profile), profile, {
+			force,
+			envToken
+		});
 		if (gOpts.json) printJson({
 			access_token: token,
 			source
@@ -946,11 +543,12 @@ async function showOrgStatus(client, gOpts) {
 //#region src/commands/discover-groups.ts
 function registerDiscoverGroups(discover, program) {
 	discover.command("groups").description("List public groups in the directory").option("-q, --query <query>", "Search query").option("--limit <n>", "Max results").option("--cursor <cursor>", "Pagination cursor").action(withErrorHandler(program, async (gOpts, opts) => {
+		const apiUrl = resolveApiUrl();
 		const params = new URLSearchParams();
 		if (opts.query) params.append("q", opts.query);
 		if (opts.limit) params.append("limit", opts.limit);
 		if (opts.cursor) params.append("cursor", opts.cursor);
-		const data = await HttpClient.publicGet("/directory/groups", params.toString() ? params : void 0);
+		const data = await HttpClient.publicGet(apiUrl, "/directory/groups", params.toString() ? params : void 0);
 		if (gOpts.json) {
 			printJson(data);
 			return;
@@ -963,7 +561,8 @@ function registerDiscoverGroups(discover, program) {
 			Members: g.member_count
 		})));
 	})).command("inspect").description("Inspect a public group").argument("<group-id>", "Group ID").action(withErrorHandler(program, async (gOpts, groupId) => {
-		const data = await HttpClient.publicGet(`/directory/groups/${groupId}`);
+		const apiUrl = resolveApiUrl();
+		const data = await HttpClient.publicGet(apiUrl, `/directory/groups/${groupId}`);
 		if (gOpts.json) {
 			printJson(data);
 			return;
@@ -990,6 +589,7 @@ function fmtList(v) {
 	return Array.isArray(v) ? v.join(", ") : String(v ?? "");
 }
 async function doAgentSearch(opts, gOpts) {
+	const apiUrl = resolveApiUrl();
 	const params = new URLSearchParams();
 	if (opts.query) params.append("q", opts.query);
 	for (const c of opts.category) params.append("category", c);
@@ -1001,7 +601,7 @@ async function doAgentSearch(opts, gOpts) {
 	if (opts.limit) params.append("limit", opts.limit);
 	if (opts.cursor) params.append("cursor", opts.cursor);
 	if (opts.sort) params.append("sort", opts.sort);
-	const data = await HttpClient.publicGet("/directory/agents", params);
+	const data = await HttpClient.publicGet(apiUrl, "/directory/agents", params);
 	if (gOpts.json) {
 		printJson(data);
 		return;
@@ -1030,7 +630,8 @@ function registerDiscover(program) {
 	addAgentSearchCommand(discover, "agents", "List agents in the directory", program, false);
 	addAgentSearchCommand(discover, "search", "Search agents (--query required)", program, true);
 	discover.command("categories").description("List directory categories with counts").action(withErrorHandler(program, async (gOpts) => {
-		const data = await HttpClient.publicGet("/directory/categories");
+		const apiUrl = resolveApiUrl();
+		const data = await HttpClient.publicGet(apiUrl, "/directory/categories");
 		if (gOpts.json) {
 			printJson(data);
 			return;
@@ -1041,15 +642,15 @@ function registerDiscover(program) {
 		})));
 	}));
 	discover.command("inspect").description("Inspect a specific agent in the directory").argument("<agent-id>", "Agent UUID or handle").action(withErrorHandler(program, async (gOpts, agentIdArg) => {
-		const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+		const apiUrl = resolveApiUrl();
 		let resolvedId = agentIdArg;
-		if (agentIdArg.includes("@")) resolvedId = await resolveHandleViaWebFinger(agentIdArg);
+		if (agentIdArg.includes("@")) resolvedId = await resolveHandleViaWebFinger(apiUrl, agentIdArg);
 		if (!UUID_RE.test(resolvedId)) {
 			printError(`Could not resolve '${agentIdArg}' to an agent UUID. Provide a UUID or a valid handle (e.g. agent@org.rine.network).`);
 			process.exitCode = 1;
 			return;
 		}
-		const data = await HttpClient.publicGet(`/directory/agents/${resolvedId}`);
+		const data = await HttpClient.publicGet(apiUrl, `/directory/agents/${resolvedId}`);
 		if (gOpts.json) {
 			printJson(data);
 			return;
@@ -1187,18 +788,18 @@ function registerGroup(program) {
 			printText("Join request submitted (pending approval)");
 		}
 	}));
-	group.command("leave").description("Leave a group").argument("<group-id>", "Group ID").option("--agent <id>", "Agent ID (defaults to your agent)").action(withClient(program, async ({ client, gOpts }, groupId, opts) => {
-		const agentId = await resolveAgent(client, opts.agent, gOpts.as);
+	group.command("leave").description("Leave a group").argument("<group-id>", "Group ID").option("--agent <id>", "Agent ID (defaults to your agent)").action(withClient(program, async ({ client, gOpts, apiUrl }, groupId, opts) => {
+		const agentId = await resolveAgent(apiUrl, await fetchAgents(client), opts.agent, gOpts.as);
 		await client.delete(`/groups/${groupId}/members/${agentId}`);
 		printMutationOk("Left group", gOpts.json);
 	}));
-	group.command("kick").description("Remove a member from the group (admin)").argument("<group-id>", "Group ID").argument("<agent-id>", "Agent ID or handle to remove").action(withClient(program, async ({ client, gOpts }, groupId, agentId) => {
-		const resolved = await resolveToUuid(agentId);
+	group.command("kick").description("Remove a member from the group (admin)").argument("<group-id>", "Group ID").argument("<agent-id>", "Agent ID or handle to remove").action(withClient(program, async ({ client, gOpts, apiUrl }, groupId, agentId) => {
+		const resolved = await resolveToUuid(apiUrl, agentId);
 		await client.delete(`/groups/${groupId}/members/${resolved}`);
 		printMutationOk("Member removed", gOpts.json);
 	}));
-	group.command("invite").description("Invite an agent to the group").argument("<group-id>", "Group ID").requiredOption("--agent <id>", "Agent ID to invite").option("--message <msg>", "Invitation message").action(withClient(program, async ({ client, gOpts }, groupId, opts) => {
-		const body = { agent_id: await resolveToUuid(opts.agent) };
+	group.command("invite").description("Invite an agent to the group").argument("<group-id>", "Group ID").requiredOption("--agent <id>", "Agent ID to invite").option("--message <msg>", "Invitation message").action(withClient(program, async ({ client, gOpts, apiUrl }, groupId, opts) => {
+		const body = { agent_id: await resolveToUuid(apiUrl, opts.agent) };
 		if (opts.message) body.message = opts.message;
 		const data = await client.post(`/groups/${groupId}/invite`, body);
 		if (gOpts.json) printJson(data);
@@ -1224,401 +825,12 @@ function registerGroup(program) {
 	}));
 }
 //#endregion
-//#region src/crypto/envelope.ts
-const SIGNATURE_SIZE = 64;
-const MAX_KID_LENGTH = 255;
-function encodeEnvelope(kid, signature, payload) {
-	const kidBytes = new TextEncoder().encode(kid);
-	if (kidBytes.length > MAX_KID_LENGTH) throw new Error(`kid too long: ${kidBytes.length} bytes (max ${MAX_KID_LENGTH})`);
-	if (signature.length !== SIGNATURE_SIZE) throw new Error(`signature must be ${SIGNATURE_SIZE} bytes, got ${signature.length}`);
-	const buf = new Uint8Array(1 + kidBytes.length + SIGNATURE_SIZE + payload.length);
-	buf[0] = kidBytes.length;
-	buf.set(kidBytes, 1);
-	buf.set(signature, 1 + kidBytes.length);
-	buf.set(payload, 1 + kidBytes.length + SIGNATURE_SIZE);
-	return buf;
-}
-function decodeEnvelope(data) {
-	if (data.length < 1 + SIGNATURE_SIZE) throw new Error("envelope too short");
-	const kidLen = data[0];
-	const minLen = 1 + kidLen + SIGNATURE_SIZE;
-	if (data.length < minLen) throw new Error("envelope too short for declared kid length");
-	return {
-		kid: new TextDecoder("utf-8", { fatal: true }).decode(data.subarray(1, 1 + kidLen)),
-		signature: data.slice(1 + kidLen, 1 + kidLen + SIGNATURE_SIZE),
-		payload: data.slice(1 + kidLen + SIGNATURE_SIZE)
-	};
-}
-//#endregion
-//#region src/crypto/hpke.ts
-const VERSION_HPKE = 1;
-const ENC_SIZE = 32;
-const INFO = new TextEncoder().encode("rine.e2ee.v1.hpke");
-const suite = new CipherSuite({
-	kem: new DhkemX25519HkdfSha256(),
-	kdf: new HkdfSha256(),
-	aead: new Aes256Gcm()
-});
-async function seal(recipientPublicKey, innerEnvelope, aad) {
-	const pk = await suite.kem.deserializePublicKey(recipientPublicKey);
-	const sender = await suite.createSenderContext({
-		recipientPublicKey: pk,
-		info: INFO
-	});
-	const ciphertext = new Uint8Array(await sender.seal(innerEnvelope, aad));
-	const enc = new Uint8Array(sender.enc);
-	const out = new Uint8Array(1 + ENC_SIZE + ciphertext.length);
-	out[0] = VERSION_HPKE;
-	out.set(enc, 1);
-	out.set(ciphertext, 1 + ENC_SIZE);
-	return out;
-}
-async function open(recipientPrivateKey, encryptedPayload, aad) {
-	if (encryptedPayload.length < 1 + ENC_SIZE + 1) throw new Error("encrypted payload too short");
-	const version = encryptedPayload[0];
-	if (version !== VERSION_HPKE) throw new Error(`unsupported version: 0x${version?.toString(16).padStart(2, "0")}`);
-	const enc = encryptedPayload.slice(1, 1 + ENC_SIZE);
-	const ct = encryptedPayload.slice(1 + ENC_SIZE);
-	const sk = await suite.kem.deserializePrivateKey(recipientPrivateKey);
-	const recipient = await suite.createRecipientContext({
-		recipientKey: sk,
-		enc,
-		info: INFO
-	});
-	return new Uint8Array(await recipient.open(ct, aad));
-}
-//#endregion
-//#region src/crypto/sender-keys-helpers.ts
-function uuidToBytes(uuid) {
-	const matches = uuid.replace(/-/g, "").match(/../g);
-	if (!matches) throw new Error(`Invalid UUID: ${uuid}`);
-	return new Uint8Array(matches.map((b) => Number.parseInt(b, 16)));
-}
-function bytesToUuid(bytes) {
-	const hex = Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
-	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
-}
-function senderKeysDir(agentId) {
-	validatePathId(agentId, "agent ID");
-	return join(getConfigDir(), "keys", agentId, "sender_keys");
-}
-function saveSenderKeyState(agentId, groupId, states) {
-	validatePathId(groupId, "group ID");
-	const dir = senderKeysDir(agentId);
-	fs.mkdirSync(dir, {
-		recursive: true,
-		mode: 448
-	});
-	const filePath = join(dir, `${groupId}.json`);
-	const data = states.map((s) => ({
-		...s,
-		chainKey: toBase64Url(s.chainKey)
-	}));
-	fs.writeFileSync(filePath, JSON.stringify(data), "utf-8");
-	fs.chmodSync(filePath, 384);
-}
-function loadSenderKeyStates(agentId, groupId) {
-	validatePathId(groupId, "group ID");
-	const filePath = join(senderKeysDir(agentId), `${groupId}.json`);
-	if (!fs.existsSync(filePath)) return [];
-	const raw = fs.readFileSync(filePath, "utf-8");
-	return JSON.parse(raw).map((s) => ({
-		...s,
-		chainKey: fromBase64Url(s.chainKey)
-	}));
-}
-//#endregion
-//#region src/crypto/sign.ts
-function signPayload(signingPrivateKey, plaintext) {
-	return ed25519.sign(plaintext, signingPrivateKey);
-}
-function verifySignature(signingPublicKey, plaintext, signature) {
-	try {
-		return ed25519.verify(signature, plaintext, signingPublicKey);
-	} catch {
-		return false;
-	}
-}
-//#endregion
-//#region src/crypto/sender-keys.ts
-const ROTATION_MESSAGE_LIMIT = 100;
-const ROTATION_AGE_MS = 10080 * 60 * 1e3;
-function needsRotation(state) {
-	if (state.messageIndex >= ROTATION_MESSAGE_LIMIT) return true;
-	if (state.createdAt && Date.now() - state.createdAt > ROTATION_AGE_MS) return true;
-	return false;
-}
-const VERSION_SENDER_KEY = 2;
-const SENDER_KEY_ID_SIZE = 16;
-const MESSAGE_INDEX_SIZE = 4;
-const NONCE_SIZE = 12;
-const MAX_SKIP = 1e3;
-/** Copy Uint8Array into a plain ArrayBuffer-backed Uint8Array (required by Web Crypto). */
-function toPlainBuffer(src) {
-	const buf = new Uint8Array(src.length);
-	buf.set(src);
-	return buf;
-}
-function generateSenderKey(groupId, senderAgentId) {
-	const chainKey = new Uint8Array(32);
-	crypto.getRandomValues(chainKey);
-	return {
-		senderKeyId: crypto.randomUUID(),
-		groupId,
-		senderAgentId,
-		chainKey,
-		messageIndex: 0,
-		createdAt: Date.now()
-	};
-}
-function deriveMessageKey(chainKey) {
-	return {
-		messageKey: hmac(sha256, chainKey, new Uint8Array([1])),
-		nextChainKey: hmac(sha256, chainKey, new Uint8Array([2]))
-	};
-}
-function advanceChain(state, targetIndex) {
-	if (targetIndex - state.messageIndex > MAX_SKIP) throw new Error(`too many skipped messages: ${targetIndex - state.messageIndex} (max ${MAX_SKIP})`);
-	const skippedKeys = /* @__PURE__ */ new Map();
-	let chainKey = state.chainKey;
-	let index = state.messageIndex;
-	while (index < targetIndex) {
-		const { messageKey, nextChainKey } = deriveMessageKey(chainKey);
-		skippedKeys.set(index, messageKey);
-		chainKey = nextChainKey;
-		index++;
-	}
-	return {
-		updatedState: {
-			...state,
-			chainKey,
-			messageIndex: index
-		},
-		skippedKeys
-	};
-}
-/** Build AAD for sender-key encryption: binds ciphertext to sender_key_id and message_index. */
-function buildSenderKeyAad(senderKeyId, messageIndex) {
-	const aad = new Uint8Array(SENDER_KEY_ID_SIZE + MESSAGE_INDEX_SIZE);
-	aad.set(senderKeyId, 0);
-	new DataView(aad.buffer).setUint32(SENDER_KEY_ID_SIZE, messageIndex, false);
-	return aad;
-}
-async function sealGroup(senderSigningPrivateKey, senderSigningKid, state, plaintext) {
-	const innerEnvelope = encodeEnvelope(senderSigningKid, signPayload(senderSigningPrivateKey, plaintext), plaintext);
-	const { messageKey, nextChainKey } = deriveMessageKey(state.chainKey);
-	const nonce = new Uint8Array(NONCE_SIZE);
-	crypto.getRandomValues(nonce);
-	const idBytes = uuidToBytes(state.senderKeyId);
-	const aad = buildSenderKeyAad(idBytes, state.messageIndex);
-	const cryptoKey = await crypto.subtle.importKey("raw", toPlainBuffer(messageKey), "AES-GCM", false, ["encrypt"]);
-	const ciphertext = new Uint8Array(await crypto.subtle.encrypt({
-		name: "AES-GCM",
-		iv: nonce,
-		additionalData: toPlainBuffer(aad)
-	}, cryptoKey, toPlainBuffer(innerEnvelope)));
-	messageKey.fill(0);
-	const out = new Uint8Array(1 + SENDER_KEY_ID_SIZE + MESSAGE_INDEX_SIZE + NONCE_SIZE + ciphertext.length);
-	let offset = 0;
-	out[offset++] = VERSION_SENDER_KEY;
-	out.set(idBytes, offset);
-	offset += SENDER_KEY_ID_SIZE;
-	new DataView(out.buffer).setUint32(offset, state.messageIndex, false);
-	offset += MESSAGE_INDEX_SIZE;
-	out.set(nonce, offset);
-	offset += NONCE_SIZE;
-	out.set(ciphertext, offset);
-	return {
-		encryptedPayload: out,
-		updatedState: {
-			...state,
-			chainKey: nextChainKey,
-			messageIndex: state.messageIndex + 1
-		}
-	};
-}
-async function openGroup(senderKeyStates, encryptedPayload) {
-	const minLen = 1 + SENDER_KEY_ID_SIZE + MESSAGE_INDEX_SIZE + NONCE_SIZE;
-	if (encryptedPayload.length < minLen) throw new Error("encrypted payload too short");
-	const version = encryptedPayload[0];
-	if (version !== VERSION_SENDER_KEY) throw new Error(`unsupported version: 0x${version?.toString(16).padStart(2, "0")}`);
-	let offset = 1;
-	const senderKeyId = bytesToUuid(encryptedPayload.slice(offset, offset + SENDER_KEY_ID_SIZE));
-	offset += SENDER_KEY_ID_SIZE;
-	const messageIndex = new DataView(encryptedPayload.buffer, encryptedPayload.byteOffset).getUint32(offset, false);
-	offset += MESSAGE_INDEX_SIZE;
-	const nonce = encryptedPayload.slice(offset, offset + NONCE_SIZE);
-	offset += NONCE_SIZE;
-	const ciphertext = encryptedPayload.slice(offset);
-	const state = senderKeyStates.get(senderKeyId);
-	if (!state) throw new Error(`unknown sender key id: ${senderKeyId}`);
-	let messageKey;
-	let updatedState;
-	if (messageIndex < state.messageIndex) {
-		const cached = state.skippedKeys?.[messageIndex];
-		if (!cached) throw new Error("message key expired or already consumed");
-		const { fromBase64Url } = await Promise.resolve().then(() => keys_exports);
-		messageKey = fromBase64Url(cached);
-		const newSkipped = { ...state.skippedKeys };
-		delete newSkipped[messageIndex];
-		updatedState = {
-			...state,
-			skippedKeys: newSkipped
-		};
-	} else if (messageIndex === state.messageIndex) {
-		const { messageKey: mk, nextChainKey } = deriveMessageKey(state.chainKey);
-		messageKey = mk;
-		updatedState = {
-			...state,
-			chainKey: nextChainKey,
-			messageIndex: state.messageIndex + 1
-		};
-	} else {
-		const { updatedState: advanced, skippedKeys: newSkipped } = advanceChain(state, messageIndex);
-		const { messageKey: mk, nextChainKey } = deriveMessageKey(advanced.chainKey);
-		messageKey = mk;
-		const mergedSkipped = { ...state.skippedKeys ?? {} };
-		for (const [idx, key] of newSkipped) {
-			mergedSkipped[idx] = toBase64Url(key);
-			key.fill(0);
-		}
-		const entries = Object.entries(mergedSkipped);
-		if (entries.length > MAX_SKIP) {
-			entries.sort((a, b) => Number(a[0]) - Number(b[0]));
-			const excess = entries.length - MAX_SKIP;
-			for (let i = 0; i < excess; i++) delete mergedSkipped[Number(entries[i][0])];
-		}
-		updatedState = {
-			...advanced,
-			chainKey: nextChainKey,
-			messageIndex: messageIndex + 1,
-			skippedKeys: mergedSkipped
-		};
-	}
-	const aad = buildSenderKeyAad(encryptedPayload.slice(1, 1 + SENDER_KEY_ID_SIZE), messageIndex);
-	const cryptoKey = await crypto.subtle.importKey("raw", toPlainBuffer(messageKey), "AES-GCM", false, ["decrypt"]);
-	const innerEnvelope = new Uint8Array(await crypto.subtle.decrypt({
-		name: "AES-GCM",
-		iv: nonce,
-		additionalData: toPlainBuffer(aad)
-	}, cryptoKey, toPlainBuffer(ciphertext)));
-	messageKey.fill(0);
-	return {
-		innerEnvelope,
-		senderKeyId,
-		messageIndex,
-		updatedState
-	};
-}
-//#endregion
-//#region src/crypto/message.ts
-async function verifyEnvelopeSender(decoded, client) {
-	let verified = false;
-	let verificationStatus = "unverifiable";
-	try {
-		const senderAgentId = agentIdFromKid(decoded.kid);
-		verified = verifySignature(jwkToPublicKey((await client.get(`/agents/${senderAgentId}/keys`)).signing_public_key), decoded.payload, decoded.signature);
-		verificationStatus = verified ? "verified" : "invalid";
-	} catch {}
-	return {
-		verified,
-		verificationStatus
-	};
-}
-function signingKid(agentId) {
-	return `rine:${agentId}`;
-}
-async function encryptMessage(senderAgentId, recipientEncryptionPk, payload) {
-	const keys = loadAgentKeys(senderAgentId);
-	const plaintext = new TextEncoder().encode(JSON.stringify(payload));
-	const kid = signingKid(senderAgentId);
-	return {
-		encrypted_payload: toBase64Url(await seal(recipientEncryptionPk, encodeEnvelope(kid, signPayload(keys.signing.privateKey, plaintext), plaintext))),
-		encryption_version: "hpke-v1",
-		sender_signing_kid: kid
-	};
-}
-async function fetchRecipientEncryptionKey(client, agentId) {
-	return jwkToPublicKey((await client.get(`/agents/${agentId}/keys`)).encryption_public_key);
-}
-async function decryptMessage(recipientAgentId, encryptedPayloadB64, client) {
-	const keys = loadAgentKeys(recipientAgentId);
-	const encrypted = fromBase64Url(encryptedPayloadB64);
-	const decoded = decodeEnvelope(await open(keys.encryption.privateKey, encrypted));
-	const plaintext = new TextDecoder("utf-8", { fatal: true }).decode(decoded.payload);
-	const { verified, verificationStatus } = await verifyEnvelopeSender(decoded, client);
-	return {
-		plaintext,
-		senderKid: decoded.kid,
-		verified,
-		verificationStatus
-	};
-}
-async function encryptGroupMessage(senderAgentId, groupId, senderKeyState, payload) {
-	const keys = loadAgentKeys(senderAgentId);
-	const plaintext = new TextEncoder().encode(JSON.stringify(payload));
-	const kid = signingKid(senderAgentId);
-	const selfReadKey = deriveMessageKey(senderKeyState.chainKey).messageKey;
-	const selfReadIndex = senderKeyState.messageIndex;
-	const { encryptedPayload, updatedState } = await sealGroup(keys.signing.privateKey, kid, senderKeyState, plaintext);
-	updatedState.skippedKeys = {
-		...updatedState.skippedKeys ?? {},
-		[selfReadIndex]: toBase64Url(selfReadKey)
-	};
-	selfReadKey.fill(0);
-	saveSenderKeyState(senderAgentId, groupId, [...loadSenderKeyStates(senderAgentId, groupId).filter((s) => s.senderKeyId !== updatedState.senderKeyId), updatedState]);
-	return {
-		result: {
-			encrypted_payload: toBase64Url(encryptedPayload),
-			encryption_version: "sender-key-v1",
-			sender_signing_kid: kid
-		},
-		updatedState
-	};
-}
-async function decryptGroupMessage(recipientAgentId, groupId, encryptedPayloadB64, client) {
-	const states = loadSenderKeyStates(recipientAgentId, groupId);
-	const stateMap = /* @__PURE__ */ new Map();
-	for (const s of states) stateMap.set(s.senderKeyId, s);
-	const { innerEnvelope, updatedState, messageIndex } = await openGroup(stateMap, fromBase64Url(encryptedPayloadB64));
-	const decoded = decodeEnvelope(innerEnvelope);
-	const plaintext = new TextDecoder("utf-8", { fatal: true }).decode(decoded.payload);
-	const { verified, verificationStatus } = await verifyEnvelopeSender(decoded, client);
-	if (verificationStatus === "invalid") throw new Error("Sender signature verification failed");
-	if (updatedState.senderAgentId === recipientAgentId) {
-		const prevCached = stateMap.get(updatedState.senderKeyId)?.skippedKeys?.[messageIndex];
-		if (prevCached && !updatedState.skippedKeys?.[messageIndex]) updatedState.skippedKeys = {
-			...updatedState.skippedKeys ?? {},
-			[messageIndex]: prevCached
-		};
-	}
-	stateMap.set(updatedState.senderKeyId, updatedState);
-	saveSenderKeyState(recipientAgentId, groupId, Array.from(stateMap.values()));
-	return {
-		plaintext,
-		senderKid: decoded.kid,
-		verified,
-		verificationStatus
-	};
-}
-function getAgentPublicKeys(agentId, agentKeys) {
-	const keys = agentKeys ?? loadAgentKeys(agentId);
-	return {
-		signing_public_key: signingPublicKeyToJWK(keys.signing.publicKey),
-		encryption_public_key: {
-			kty: "OKP",
-			crv: "X25519",
-			x: toBase64Url(keys.encryption.publicKey)
-		}
-	};
-}
-//#endregion
 //#region src/commands/keys.ts
-function getKeysDir(agentId) {
-	return join(getConfigDir(), "keys", agentId);
+function getKeysDir(configDir, agentId) {
+	return join(configDir, "keys", agentId);
 }
-function backupKeys(agentId) {
-	const dir = getKeysDir(agentId);
+function backupKeys(configDir, agentId) {
+	const dir = getKeysDir(configDir, agentId);
 	const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
 	for (const name of ["signing.key", "encryption.key"]) {
 		const src = join(dir, name);
@@ -1633,10 +845,11 @@ async function verifyServerKeys(client, agentId, expected) {
 }
 function registerKeys(program) {
 	const keys = program.command("keys").description("E2EE key management");
-	keys.command("status").description("Show E2EE key status for an agent").option("--agent <id>", "Agent ID").action(withClient(program, async ({ client, gOpts }, opts) => {
-		const agentId = await resolveAgent(client, opts.agent, gOpts.as);
-		const handle = (await client.get("/agents")).items.find((a) => a.id === agentId)?.handle ?? "unknown";
-		const hasLocal = agentKeysExist(agentId);
+	keys.command("status").description("Show E2EE key status for an agent").option("--agent <id>", "Agent ID").action(withClient(program, async ({ client, gOpts, configDir, apiUrl }, opts) => {
+		const agents = await fetchAgents(client);
+		const agentId = await resolveAgent(apiUrl, agents, opts.agent, gOpts.as);
+		const handle = agents.find((a) => a.id === agentId)?.handle ?? "unknown";
+		const hasLocal = agentKeysExist(configDir, agentId);
 		let hasServer = false;
 		let serverKeys;
 		try {
@@ -1648,9 +861,9 @@ function registerKeys(program) {
 		let sigFingerprint = "-";
 		let encFingerprint = "-";
 		if (hasLocal) {
-			const keys = loadAgentKeys(agentId);
-			sigFingerprint = toBase64Url(keys.signing.publicKey).slice(0, 8);
-			encFingerprint = toBase64Url(keys.encryption.publicKey).slice(0, 8);
+			const agentKeys = loadAgentKeys(configDir, agentId);
+			sigFingerprint = toBase64Url(agentKeys.signing.publicKey).slice(0, 8);
+			encFingerprint = toBase64Url(agentKeys.encryption.publicKey).slice(0, 8);
 		} else if (serverKeys) {
 			sigFingerprint = serverKeys.signing_public_key.x.slice(0, 8);
 			encFingerprint = serverKeys.encryption_public_key.x.slice(0, 8);
@@ -1695,38 +908,38 @@ function registerKeys(program) {
 			}
 		]);
 	}));
-	keys.command("generate").description("Generate new E2EE keys for an agent").option("--agent <id>", "Agent ID").action(withClient(program, async ({ client, gOpts }, opts) => {
-		const agentId = await resolveAgent(client, opts.agent, gOpts.as);
-		if (agentKeysExist(agentId)) {
+	keys.command("generate").description("Generate new E2EE keys for an agent").option("--agent <id>", "Agent ID").action(withClient(program, async ({ client, gOpts, configDir, apiUrl }, opts) => {
+		const agentId = await resolveAgent(apiUrl, await fetchAgents(client), opts.agent, gOpts.as);
+		if (agentKeysExist(configDir, agentId)) {
 			printError(`Keys already exist for agent ${agentId}. Use 'rine keys rotate' to replace them.`);
 			process.exitCode = 1;
 			return;
 		}
 		const agentKeys = generateAgentKeys();
-		const pubKeys = getAgentPublicKeys(agentId, agentKeys);
+		const pubKeys = getAgentPublicKeys(configDir, agentId, agentKeys);
 		await client.post(`/agents/${agentId}/keys`, pubKeys);
 		await verifyServerKeys(client, agentId, pubKeys);
-		saveAgentKeys(agentId, agentKeys);
+		saveAgentKeys(configDir, agentId, agentKeys);
 		printMutationOk(`E2EE keys generated for agent ${agentId}`, gOpts.json);
 	}));
-	keys.command("rotate").description("Rotate E2EE keys for an agent").option("--agent <id>", "Agent ID").action(withClient(program, async ({ client, gOpts }, opts) => {
-		const agentId = await resolveAgent(client, opts.agent, gOpts.as);
-		if (agentKeysExist(agentId)) backupKeys(agentId);
+	keys.command("rotate").description("Rotate E2EE keys for an agent").option("--agent <id>", "Agent ID").action(withClient(program, async ({ client, gOpts, configDir, apiUrl }, opts) => {
+		const agentId = await resolveAgent(apiUrl, await fetchAgents(client), opts.agent, gOpts.as);
+		if (agentKeysExist(configDir, agentId)) backupKeys(configDir, agentId);
 		const agentKeys = generateAgentKeys();
-		const pubKeys = getAgentPublicKeys(agentId, agentKeys);
+		const pubKeys = getAgentPublicKeys(configDir, agentId, agentKeys);
 		await client.post(`/agents/${agentId}/keys`, pubKeys);
 		await verifyServerKeys(client, agentId, pubKeys);
-		saveAgentKeys(agentId, agentKeys);
+		saveAgentKeys(configDir, agentId, agentKeys);
 		printMutationOk(`E2EE keys rotated for agent ${agentId}`, gOpts.json);
 	}));
-	keys.command("export").description("Export private keys to a file").option("--agent <id>", "Agent ID").requiredOption("--output <file>", "Output file path").action(withClient(program, async ({ client, gOpts }, opts) => {
-		const agentId = await resolveAgent(client, opts.agent, gOpts.as);
-		if (!agentKeysExist(agentId)) {
+	keys.command("export").description("Export private keys to a file").option("--agent <id>", "Agent ID").requiredOption("--output <file>", "Output file path").action(withClient(program, async ({ client, gOpts, configDir, apiUrl }, opts) => {
+		const agentId = await resolveAgent(apiUrl, await fetchAgents(client), opts.agent, gOpts.as);
+		if (!agentKeysExist(configDir, agentId)) {
 			printError(`No keys found for agent ${agentId}`);
 			process.exitCode = 1;
 			return;
 		}
-		const agentKeys = loadAgentKeys(agentId);
+		const agentKeys = loadAgentKeys(configDir, agentId);
 		const exported = {
 			agent_id: agentId,
 			signing_private_key: toBase64Url(agentKeys.signing.privateKey),
@@ -1748,33 +961,21 @@ function registerKeys(program) {
 			process.exitCode = 2;
 			return;
 		}
-		const sigBytes = fromBase64Url(data.signing_private_key);
-		if (sigBytes.length !== 32) {
-			printError(`Invalid signing key: expected 32 bytes, got ${sigBytes.length}`);
-			process.exitCode = 2;
-			return;
-		}
 		try {
-			ed25519.getPublicKey(sigBytes);
-		} catch {
-			printError("Invalid signing key: not a valid Ed25519 private key");
-			process.exitCode = 2;
-			return;
-		}
-		const encBytes = fromBase64Url(data.encryption_private_key);
-		if (encBytes.length !== 32) {
-			printError(`Invalid encryption key: expected 32 bytes, got ${encBytes.length}`);
+			validateSigningKey(fromBase64Url(data.signing_private_key));
+		} catch (err) {
+			printError(`Invalid signing key: ${err.message}`);
 			process.exitCode = 2;
 			return;
 		}
 		try {
-			x25519.getPublicKey(encBytes);
-		} catch {
-			printError("Invalid encryption key: not a valid X25519 private key");
+			validateEncryptionKey(fromBase64Url(data.encryption_private_key));
+		} catch (err) {
+			printError(`Invalid encryption key: ${err.message}`);
 			process.exitCode = 2;
 			return;
 		}
-		const dir = join(getConfigDir(), "keys", data.agent_id);
+		const dir = join(resolveConfigDir(), "keys", data.agent_id);
 		fs.mkdirSync(dir, {
 			recursive: true,
 			mode: 448
@@ -1789,104 +990,7 @@ function registerKeys(program) {
 	}));
 }
 //#endregion
-//#region src/crypto/ingest.ts
-/**
-* Auto-ingest a sender key distribution from a decrypted message.
-* Only ingests if the message is a `rine.v1.sender_key_distribution`,
-* the signature was verified, and the key ID is not already known.
-*
-* Returns true if a new key was ingested.
-*/
-function ingestSenderKeyDistribution(agentId, messageType, result) {
-	if (messageType !== "rine.v1.sender_key_distribution") return false;
-	if (!result.verified) return false;
-	try {
-		const dist = JSON.parse(result.plaintext);
-		const existing = loadSenderKeyStates(agentId, dist.group_id);
-		if (existing.some((s) => s.senderKeyId === dist.sender_key_id)) return false;
-		const newState = {
-			senderKeyId: dist.sender_key_id,
-			groupId: dist.group_id,
-			senderAgentId: agentIdFromKid(result.senderKid),
-			chainKey: fromBase64Url(dist.chain_key),
-			messageIndex: dist.message_index
-		};
-		saveSenderKeyState(agentId, dist.group_id, [...existing, newState]);
-		return true;
-	} catch {
-		return false;
-	}
-}
-//#endregion
 //#region src/commands/sender-key-ops.ts
-async function distributeSenderKey(client, senderAgentId, state, groupId, recipientIds, extraHeaders) {
-	if (recipientIds.length === 0) return [];
-	const batchKeys = await client.get("/agents/keys", { ids: recipientIds.join(",") });
-	const distPayload = {
-		group_id: groupId,
-		sender_key_id: state.senderKeyId,
-		chain_key: toBase64Url(state.chainKey),
-		message_index: state.messageIndex,
-		sender_agent_id: senderAgentId
-	};
-	const succeeded = [];
-	const failed = [];
-	for (const recipientId of recipientIds) {
-		const recipientKeyData = batchKeys.keys[recipientId];
-		if (!recipientKeyData) {
-			failed.push(recipientId);
-			continue;
-		}
-		try {
-			const encrypted = await encryptMessage(senderAgentId, fromBase64Url(recipientKeyData.encryption_public_key.x), distPayload);
-			await client.post("/messages", {
-				to_agent_id: recipientId,
-				type: "rine.v1.sender_key_distribution",
-				...encrypted
-			}, extraHeaders);
-			succeeded.push(recipientId);
-		} catch {
-			failed.push(recipientId);
-		}
-	}
-	if (failed.length > 0) printError(`Sender key distribution failed for ${failed.length} recipient(s): ${failed.join(", ")}`);
-	return succeeded;
-}
-async function getOrCreateSenderKey(client, senderAgentId, groupHandle, extraHeaders) {
-	const firstGroup = (await client.get("/groups", { handle: groupHandle })).items?.[0];
-	if (!firstGroup) throw new Error(`Group not found: ${groupHandle}`);
-	const groupId = firstGroup.id;
-	const memberIds = (await client.get(`/groups/${groupId}/members`)).items.map((m) => m.agent_id);
-	const senderIdLower = senderAgentId.toLowerCase();
-	if (!memberIds.some((id) => id.toLowerCase() === senderIdLower)) throw new Error("You are not a member of this group");
-	const recipientIds = memberIds.filter((id) => id.toLowerCase() !== senderIdLower);
-	const states = loadSenderKeyStates(senderAgentId, groupId);
-	const own = states.find((s) => s.senderAgentId === senderAgentId);
-	const currentMemberSet = new Set(memberIds.map((id) => id.toLowerCase()));
-	const memberRemoved = own?.distributedTo?.some((id) => !currentMemberSet.has(id.toLowerCase())) ?? false;
-	if (own && !needsRotation(own) && !memberRemoved) {
-		const alreadyDistributed = new Set((own.distributedTo ?? []).map((id) => id.toLowerCase()));
-		const undistributed = recipientIds.filter((id) => !alreadyDistributed.has(id.toLowerCase()));
-		if (undistributed.length > 0) {
-			const succeeded = await distributeSenderKey(client, senderAgentId, own, groupId, undistributed, extraHeaders);
-			if (succeeded.length > 0) {
-				own.distributedTo = [...own.distributedTo ?? [], ...succeeded];
-				saveSenderKeyState(senderAgentId, groupId, states);
-			}
-		}
-		return {
-			state: own,
-			groupId
-		};
-	}
-	const newState = generateSenderKey(groupId, senderAgentId);
-	newState.distributedTo = await distributeSenderKey(client, senderAgentId, newState, groupId, recipientIds, extraHeaders);
-	saveSenderKeyState(senderAgentId, groupId, [...memberRemoved ? states.filter((s) => currentMemberSet.has(s.senderAgentId.toLowerCase())) : states, newState]);
-	return {
-		state: newState,
-		groupId
-	};
-}
 /**
 * Fetch pending sender key distributions from the inbox and ingest them.
 * Used by `read` and `stream` to auto-recover when a sender key is missing.
@@ -1894,7 +998,7 @@ async function getOrCreateSenderKey(client, senderAgentId, groupHandle, extraHea
 * Optionally short-circuits once `targetSenderKeyId` is ingested.
 * Returns the number of newly ingested keys.
 */
-async function fetchAndIngestPendingSKDistributions(client, agentId, targetSenderKeyId) {
+async function fetchAndIngestPendingSKDistributions(client, configDir, agentId, targetSenderKeyId) {
 	const inbox = await client.get(`/agents/${agentId}/messages`, {
 		type: "rine.v1.sender_key_distribution",
 		limit: 100
@@ -1902,8 +1006,8 @@ async function fetchAndIngestPendingSKDistributions(client, agentId, targetSende
 	let ingested = 0;
 	for (const msg of inbox.items) try {
 		const full = await client.get(`/messages/${msg.id}`);
-		const result = await decryptMessage(agentId, full.encrypted_payload, client);
-		if (ingestSenderKeyDistribution(agentId, full.type, result)) {
+		const result = await decryptMessage(configDir, agentId, full.encrypted_payload, client);
+		if (ingestSenderKeyDistribution(configDir, agentId, full.type, result)) {
 			ingested++;
 			if (targetSenderKeyId) {
 				if (JSON.parse(result.plaintext).sender_key_id === targetSenderKeyId) break;
@@ -1961,7 +1065,7 @@ function resolvePayload(payload, payloadFile) {
 	}
 }
 function addMessageCommands(parent, program) {
-	parent.command("send").description("Send an encrypted message").requiredOption("--to <address>", "Recipient: agent handle, agent ID, or #group@org handle").option("--type <type>", "Message type (default: rine.v1.dm)").option("--payload <json>", "Message payload as JSON string").option("--payload-file <path>", "Read payload JSON from file (use - for stdin)").option("--from <address>", "Sender address (agent ID or handle with @)").option("--idempotency-key <key>", "Idempotency key header").action(withClient(program, async ({ client, gOpts }, opts) => {
+	parent.command("send").description("Send an encrypted message").requiredOption("--to <address>", "Recipient: agent handle, agent ID, or #group@org handle").option("--type <type>", "Message type (default: rine.v1.dm)").option("--payload <json>", "Message payload as JSON string").option("--payload-file <path>", "Read payload JSON from file (use - for stdin)").option("--from <address>", "Sender address (agent ID or handle with @)").option("--idempotency-key <key>", "Idempotency key header").action(withClient(program, async ({ client, gOpts, configDir, apiUrl }, opts) => {
 		const result = resolvePayload(opts.payload, opts.payloadFile);
 		if ("error" in result) {
 			printError(result.error);
@@ -1972,45 +1076,45 @@ function addMessageCommands(parent, program) {
 		const extraHeaders = {};
 		let senderAgentId;
 		if (opts.from !== void 0) {
-			senderAgentId = await resolveToUuid(opts.from);
+			senderAgentId = await resolveToUuid(apiUrl, opts.from);
 			extraHeaders["X-Rine-Agent"] = senderAgentId;
 		} else if (!gOpts.as) {
-			senderAgentId = await resolveAgent(client, void 0, void 0);
+			senderAgentId = await resolveAgent(apiUrl, await fetchAgents(client), void 0, void 0);
 			extraHeaders["X-Rine-Agent"] = senderAgentId;
-		} else senderAgentId = await resolveAgent(client, void 0, gOpts.as);
+		} else senderAgentId = await resolveAgent(apiUrl, await fetchAgents(client), void 0, gOpts.as);
 		if (opts.idempotencyKey) extraHeaders["Idempotency-Key"] = opts.idempotencyKey;
 		let recipientAgentId;
 		if (!opts.to.includes("@")) recipientAgentId = opts.to;
-		else if (!opts.to.startsWith("#")) recipientAgentId = await resolveToUuid(opts.to);
+		else if (!opts.to.startsWith("#")) recipientAgentId = await resolveToUuid(apiUrl, opts.to);
 		const body = { type: opts.type ?? "rine.v1.dm" };
 		if (opts.to.includes("@")) body.to_handle = opts.to;
 		else body.to_agent_id = opts.to;
 		if (opts.from?.includes("@")) body.from_handle = opts.from;
 		if (opts.to.startsWith("#") && senderAgentId) {
-			const { state, groupId } = await getOrCreateSenderKey(client, senderAgentId, opts.to, Object.keys(extraHeaders).length > 0 ? extraHeaders : void 0);
-			const { result } = await encryptGroupMessage(senderAgentId, groupId, state, parsedPayload);
-			Object.assign(body, result);
+			const { state, groupId } = await getOrCreateSenderKey(client, configDir, senderAgentId, opts.to, Object.keys(extraHeaders).length > 0 ? extraHeaders : void 0);
+			const { result: encResult } = await encryptGroupMessage(configDir, senderAgentId, groupId, state, parsedPayload);
+			Object.assign(body, encResult);
 		} else if (senderAgentId && recipientAgentId) {
 			const recipientPk = await fetchRecipientEncryptionKey(client, recipientAgentId);
-			const encrypted = await encryptMessage(senderAgentId, recipientPk, parsedPayload);
+			const encrypted = await encryptMessage(configDir, senderAgentId, recipientPk, parsedPayload);
 			Object.assign(body, encrypted);
 		} else throw new Error("Cannot encrypt: unable to resolve sender or recipient. Use UUIDs or ensure WebFinger is available.");
 		const data = await client.post("/messages", body, Object.keys(extraHeaders).length > 0 ? extraHeaders : void 0);
 		if (gOpts.json) printJson(data);
 		else printTable([sendRow(data)]);
 	}));
-	parent.command("read").description("Read and decrypt a message by ID").argument("<message-id>", "Message ID").option("--agent <id>", "Agent ID (for decryption key)").action(withClient(program, async ({ client, gOpts }, messageId, opts) => {
+	parent.command("read").description("Read and decrypt a message by ID").argument("<message-id>", "Message ID").option("--agent <id>", "Agent ID (for decryption key)").action(withClient(program, async ({ client, gOpts, configDir, apiUrl }, messageId, opts) => {
 		const data = await client.get(`/messages/${messageId}`);
-		const agentId = await resolveAgent(client, opts.agent, gOpts.as);
-		if ((data.encryption_version === "hpke-v1" || data.encryption_version === "sender-key-v1") && agentKeysExist(agentId)) {
-			let result;
+		const agentId = await resolveAgent(apiUrl, await fetchAgents(client), opts.agent, gOpts.as);
+		if ((data.encryption_version === "hpke-v1" || data.encryption_version === "sender-key-v1") && agentKeysExist(configDir, agentId)) {
+			let decResult;
 			if (data.encryption_version === "sender-key-v1" && data.group_id) try {
-				result = await decryptGroupMessage(agentId, data.group_id, data.encrypted_payload, client);
+				decResult = await decryptGroupMessage(configDir, agentId, data.group_id, data.encrypted_payload, client);
 			} catch (err) {
 				const match = err instanceof Error && err.message.match(/^unknown sender key id: (.+)$/);
 				if (match) {
-					if (await fetchAndIngestPendingSKDistributions(client, agentId, match[1]) > 0) try {
-						result = await decryptGroupMessage(agentId, data.group_id, data.encrypted_payload, client);
+					if (await fetchAndIngestPendingSKDistributions(client, configDir, agentId, match[1]) > 0) try {
+						decResult = await decryptGroupMessage(configDir, agentId, data.group_id, data.encrypted_payload, client);
 					} catch (retryErr) {
 						if (!gOpts.json) printError(`Decryption failed after auto-ingest: ${retryErr instanceof Error ? retryErr.message : String(retryErr)}`);
 					}
@@ -2018,18 +1122,18 @@ function addMessageCommands(parent, program) {
 				} else if (!gOpts.json) printError(`Decryption failed: ${err instanceof Error ? err.message : String(err)}`);
 			}
 			else try {
-				result = await decryptMessage(agentId, data.encrypted_payload, client);
+				decResult = await decryptMessage(configDir, agentId, data.encrypted_payload, client);
 			} catch (err) {
 				if (!gOpts.json) printError(`Decryption failed: ${err instanceof Error ? err.message : String(err)}`);
 			}
-			if (result) {
-				if (ingestSenderKeyDistribution(agentId, data.type, result)) printText("Sender key ingested");
+			if (decResult) {
+				if (ingestSenderKeyDistribution(configDir, agentId, data.type, decResult)) printText("Sender key ingested");
 				if (gOpts.json) printJson({
 					...data,
-					decrypted_payload: JSON.parse(result.plaintext),
-					signature_verified: result.verified,
-					verification_status: result.verificationStatus,
-					sender_kid: result.senderKid
+					decrypted_payload: JSON.parse(decResult.plaintext),
+					signature_verified: decResult.verified,
+					verification_status: decResult.verificationStatus,
+					sender_kid: decResult.senderKid
 				});
 				else printTable([{
 					ID: data.id,
@@ -2038,8 +1142,8 @@ function addMessageCommands(parent, program) {
 					To: msgTo(data),
 					Group: msgGroup(data),
 					Type: data.type,
-					Verified: result.verificationStatus === "verified" ? "✓" : result.verificationStatus === "invalid" ? "✗ INVALID" : "?",
-					Payload: result.plaintext.slice(0, 200),
+					Verified: decResult.verificationStatus === "verified" ? "✓" : decResult.verificationStatus === "invalid" ? "✗ INVALID" : "?",
+					Payload: decResult.plaintext.slice(0, 200),
 					Created: data.created_at
 				}]);
 				return;
@@ -2058,8 +1162,8 @@ function addMessageCommands(parent, program) {
 			Created: data.created_at
 		}]);
 	}));
-	parent.command("inbox").description("List inbox messages").option("--agent <id>", "Agent ID (defaults to your agent)").option("--limit <n>", "Maximum number of messages to return").option("--cursor <cursor>", "Pagination cursor").action(withClient(program, async ({ client, gOpts }, opts) => {
-		const agentId = await resolveAgent(client, opts.agent, gOpts.as);
+	parent.command("inbox").description("List inbox messages").option("--agent <id>", "Agent ID (defaults to your agent)").option("--limit <n>", "Maximum number of messages to return").option("--cursor <cursor>", "Pagination cursor").action(withClient(program, async ({ client, gOpts, apiUrl }, opts) => {
+		const agentId = await resolveAgent(apiUrl, await fetchAgents(client), opts.agent, gOpts.as);
 		const params = {};
 		if (opts.limit) params.limit = opts.limit;
 		if (opts.cursor) params.cursor = opts.cursor;
@@ -2070,7 +1174,7 @@ function addMessageCommands(parent, program) {
 			if (data.next_cursor) printText(`Next cursor: ${data.next_cursor}`);
 		}
 	}));
-	parent.command("reply").description("Reply to a message (encrypted)").argument("<message-id>", "Message ID to reply to").option("--type <type>", "Message type (defaults to original message type)").option("--payload <json>", "Reply payload as JSON string").option("--payload-file <path>", "Read payload JSON from file (use - for stdin)").action(withClient(program, async ({ client, gOpts }, messageId, opts) => {
+	parent.command("reply").description("Reply to a message (encrypted)").argument("<message-id>", "Message ID to reply to").option("--type <type>", "Message type (defaults to original message type)").option("--payload <json>", "Reply payload as JSON string").option("--payload-file <path>", "Read payload JSON from file (use - for stdin)").action(withClient(program, async ({ client, gOpts, configDir, apiUrl }, messageId, opts) => {
 		const result = resolvePayload(opts.payload, opts.payloadFile);
 		if ("error" in result) {
 			printError(result.error);
@@ -2079,13 +1183,13 @@ function addMessageCommands(parent, program) {
 		}
 		const parsedPayload = result.parsed;
 		const original = await client.get(`/messages/${messageId}`);
-		const senderAgentId = await resolveAgent(client, void 0, gOpts.as);
+		const senderAgentId = await resolveAgent(apiUrl, await fetchAgents(client), void 0, gOpts.as);
 		const recipientAgentId = original.from_agent_id;
 		const resolvedType = opts.type ?? original.type;
 		try {
 			const body = { type: resolvedType };
-			if (!recipientAgentId || !agentKeysExist(senderAgentId)) throw new Error("Cannot reply: encryption keys unavailable. Run 'rine keys generate' first.");
-			const encrypted = await encryptMessage(senderAgentId, await fetchRecipientEncryptionKey(client, recipientAgentId), parsedPayload);
+			if (!recipientAgentId || !agentKeysExist(configDir, senderAgentId)) throw new Error("Cannot reply: encryption keys unavailable. Run 'rine keys generate' first.");
+			const encrypted = await encryptMessage(configDir, senderAgentId, await fetchRecipientEncryptionKey(client, recipientAgentId), parsedPayload);
 			Object.assign(body, encrypted);
 			const data = await client.post(`/messages/${messageId}/reply`, body);
 			if (gOpts.json) printJson(data);
@@ -2104,23 +1208,23 @@ function registerMessages(program) {
 //#endregion
 //#region src/commands/poll-token.ts
 function registerPollToken(program) {
-	program.command("poll-token").description("Generate or revoke a poll token for inbox monitoring").option("--agent <id>", "Agent ID (auto-resolved for single-agent orgs)").option("--revoke", "Revoke the poll token").action(withClient(program, async ({ client, gOpts, profileName }, opts) => {
-		const agentId = await resolveAgent(client, opts.agent, gOpts.as);
+	program.command("poll-token").description("Generate or revoke a poll token for inbox monitoring").option("--agent <id>", "Agent ID (auto-resolved for single-agent orgs)").option("--revoke", "Revoke the poll token").action(withClient(program, async ({ client, gOpts, profileName, configDir, apiUrl }, opts) => {
+		const agentId = await resolveAgent(apiUrl, await fetchAgents(client), opts.agent, gOpts.as);
 		if (opts.revoke) {
 			await client.delete(`/agents/${agentId}/poll-token`);
-			const creds = loadCredentials();
+			const creds = loadCredentials(configDir);
 			if (creds[profileName]) {
 				delete creds[profileName].poll_url;
-				saveCredentials(creds);
+				saveCredentials(configDir, creds);
 			}
 			printMutationOk("Poll token revoked", gOpts.json);
 			return;
 		}
 		const data = await client.post(`/agents/${agentId}/poll-token`, {});
-		const creds = loadCredentials();
+		const creds = loadCredentials(configDir);
 		if (creds[profileName]) {
 			creds[profileName].poll_url = data.poll_url;
-			saveCredentials(creds);
+			saveCredentials(configDir, creds);
 		}
 		if (gOpts.json) printJson(data);
 		else {
@@ -2164,26 +1268,12 @@ function registerOrg(program) {
 	}));
 }
 //#endregion
-//#region src/timelock.ts
-async function solveTimeLockWithProgress(baseHex, modulusHex, T, onProgress) {
-	const N = BigInt(`0x${modulusHex}`);
-	let x = BigInt(`0x${baseHex}`) % N;
-	const step = Math.max(1, Math.floor(T / 100));
-	for (let i = 0; i < T; i++) {
-		x = x * x % N;
-		if (i % step === 0) {
-			onProgress?.(Math.floor(i / T * 100));
-			await new Promise((resolve) => setImmediate(resolve));
-		}
-	}
-	return x.toString(16);
-}
-//#endregion
 //#region src/commands/register.ts
 function registerRegister(program) {
 	program.command("register").description("Register a new organization (two-step PoW flow)").requiredOption("--email <email>", "Email address").requiredOption("--name <name>", "Organization name").requiredOption("--slug <slug>", "Organization slug").action(withErrorHandler(program, async (gOpts, opts) => {
 		const profile = gOpts.profile ?? "default";
-		const apiUrl = getApiUrl();
+		const configDir = resolveConfigDir();
+		const apiUrl = resolveApiUrl();
 		const challengeRes = await fetch(`${apiUrl}/auth/register`, {
 			method: "POST",
 			headers: { "Content-Type": "application/json" },
@@ -2246,14 +1336,14 @@ function registerRegister(program) {
 			return;
 		}
 		const data = await solveRes.json();
-		const creds = loadCredentials();
+		const creds = loadCredentials(configDir);
 		creds[profile] = {
 			client_id: data.client_id,
 			client_secret: data.client_secret
 		};
-		saveCredentials(creds);
+		saveCredentials(configDir, creds);
 		try {
-			cacheToken(profile, await fetchOAuthToken(data.client_id, data.client_secret));
+			cacheToken(configDir, profile, await fetchOAuthToken(apiUrl, data.client_id, data.client_secret));
 		} catch {
 			process.stderr.write("Warning: initial token cache failed\n");
 		}
@@ -2267,7 +1357,7 @@ function registerRegister(program) {
 }
 //#endregion
 //#region src/commands/stream.ts
-async function formatMessageLine(dataStr, agentId, client) {
+async function formatMessageLine(dataStr, agentId, configDir, client) {
 	try {
 		const data = JSON.parse(dataStr);
 		const ts = (data.created_at ?? "").slice(0, 19) || "?";
@@ -2275,23 +1365,23 @@ async function formatMessageLine(dataStr, agentId, client) {
 		const msgType = data.type ?? "?";
 		const target = data.group_handle ? `${data.group_handle} (${msgType})` : msgType;
 		let preview = "[encrypted]";
-		if (data.encrypted_payload && agentKeysExist(agentId)) {
+		if (data.encrypted_payload && agentKeysExist(configDir, agentId)) {
 			let result;
 			if (data.encryption_version === "sender-key-v1" && data.group_id) try {
-				result = await decryptGroupMessage(agentId, data.group_id, data.encrypted_payload, client);
+				result = await decryptGroupMessage(configDir, agentId, data.group_id, data.encrypted_payload, client);
 			} catch (err) {
 				const match = err instanceof Error && err.message.match(/^unknown sender key id: (.+)$/);
 				if (match) {
-					if (await fetchAndIngestPendingSKDistributions(client, agentId, match[1]) > 0) try {
-						result = await decryptGroupMessage(agentId, data.group_id, data.encrypted_payload, client);
+					if (await fetchAndIngestPendingSKDistributions(client, configDir, agentId, match[1]) > 0) try {
+						result = await decryptGroupMessage(configDir, agentId, data.group_id, data.encrypted_payload, client);
 					} catch {}
 				}
 			}
 			else if (data.encryption_version === "hpke-v1") try {
-				result = await decryptMessage(agentId, data.encrypted_payload, client);
+				result = await decryptMessage(configDir, agentId, data.encrypted_payload, client);
 			} catch {}
 			if (result) {
-				ingestSenderKeyDistribution(agentId, data.type ?? "", result);
+				ingestSenderKeyDistribution(configDir, agentId, data.type ?? "", result);
 				preview = `[${result.verified ? "✓" : "?"}] ${result.plaintext.slice(0, 60)}`;
 			} else if (data.encryption_version === "hpke-v1" || data.encryption_version === "sender-key-v1") preview = "[decrypt failed]";
 		}
@@ -2304,9 +1394,11 @@ function registerStream(program) {
 	program.command("stream").description("Stream incoming messages via SSE").option("--agent <id>", "Agent ID to stream (defaults to your agent)").option("--verbose", "Show heartbeats and reconnect details").action(async (opts) => {
 		try {
 			const gOpts = program.opts();
-			const { client, profileName, entry } = await createClient(gOpts.profile);
-			const agentId = await resolveAgent(client, opts.agent, gOpts.as);
-			const url = `${getApiUrl()}/agents/${agentId}/stream`;
+			const configDir = resolveConfigDir();
+			const apiUrl = resolveApiUrl();
+			const { client, profileName, entry } = await createClient(configDir, apiUrl, gOpts.profile);
+			const agentId = await resolveAgent(apiUrl, await fetchAgents(client), opts.agent, gOpts.as);
+			const url = `${apiUrl}/agents/${agentId}/stream`;
 			let lastEventId;
 			let backoff = 1;
 			let stopped = false;
@@ -2315,8 +1407,12 @@ function registerStream(program) {
 				process.exitCode = 0;
 			});
 			while (!stopped) try {
+				const envToken = process.env.RINE_TOKEN;
 				const headers = {
-					Authorization: `Bearer ${await getOrRefreshToken(entry, profileName, false)}`,
+					Authorization: `Bearer ${await getOrRefreshToken(configDir, apiUrl, entry, profileName, {
+						force: false,
+						envToken
+					})}`,
 					Accept: "text/event-stream"
 				};
 				if (lastEventId) headers["Last-Event-ID"] = lastEventId;
@@ -2335,7 +1431,7 @@ function registerStream(program) {
 								id,
 								data
 							}));
-							else if (event === "message") formatMessageLine(data, agentId, client).then((line) => console.log(line), () => console.log(`[message] ${data.slice(0, 80)}`));
+							else if (event === "message") formatMessageLine(data, agentId, configDir, client).then((line) => console.log(line), () => console.log(`[message] ${data.slice(0, 80)}`));
 							else if (event === "heartbeat" && opts.verbose) process.stderr.write(`[heartbeat] ${data}\n`);
 						},
 						onDisconnect: () => resolve(),
@@ -2372,13 +1468,13 @@ function registerStream(program) {
 //#region src/commands/webhook.ts
 function registerWebhook(program) {
 	const webhook = program.command("webhook").description("Manage webhooks");
-	webhook.command("create").description("Create a new webhook").option("--agent <id>", "Agent ID (defaults to your agent)").requiredOption("--url <url>", "Webhook target URL (must be https://)").action(withClient(program, async ({ client, gOpts }, opts) => {
+	webhook.command("create").description("Create a new webhook").option("--agent <id>", "Agent ID (defaults to your agent)").requiredOption("--url <url>", "Webhook target URL (must be https://)").action(withClient(program, async ({ client, gOpts, apiUrl }, opts) => {
 		if (!opts.url.startsWith("https://")) {
 			printError("Webhook URL must start with https://");
 			process.exitCode = 2;
 			return;
 		}
-		const agentId = await resolveAgent(client, opts.agent, gOpts.as);
+		const agentId = await resolveAgent(apiUrl, await fetchAgents(client), opts.agent, gOpts.as);
 		const data = await client.post("/webhooks", {
 			agent_id: agentId,
 			url: opts.url