@youam/sdk 0.2.1 → 0.4.0

package/dist/cli/index.cjs

@@ -60,11 +60,11 @@ function extractPublicKey(tags) {
   }
   return null;
 }
-async function queryUamTxt(domain, timeout) {
+async function queryUamTxt(domain2, timeout) {
   const controller = new AbortController();
   const timer = timeout != null ? setTimeout(() => controller.abort(), timeout) : void 0;
   try {
-    const records = await (0, import_promises.resolveTxt)(`_uam.${domain}`);
+    const records = await (0, import_promises.resolveTxt)(`_uam.${domain2}`);
     const results = [];
     for (const parts of records) {
       const txtValue = parts.join("");
@@ -79,8 +79,8 @@ async function queryUamTxt(domain, timeout) {
     if (timer != null) clearTimeout(timer);
   }
 }
-async function resolveKeyViaHttps(agentName, domain, timeout) {
-  const url = `https://${domain}/.well-known/uam.json`;
+async function resolveKeyViaHttps(agentName, domain2, timeout) {
+  const url = `https://${domain2}/.well-known/uam.json`;
   try {
     const resp = await fetch(url, {
       signal: AbortSignal.timeout(timeout ?? 1e4)
@@ -115,7 +115,7 @@ var init_dns_verifier = __esm({
 var import_commander = require("commander");
 
 // src/version.ts
-var SDK_VERSION = "0.2.1";
+var SDK_VERSION = "0.4.0";
 
 // src/cli/commands/init.ts
 var import_node_os5 = require("os");
@@ -199,6 +199,18 @@ var KeyPinningError = class _KeyPinningError extends UAMError {
     Object.setPrototypeOf(this, _KeyPinningError.prototype);
   }
 };
+var SendRefusedError = class extends UAMError {
+  messageId;
+  code;
+  detail;
+  constructor(messageId, code, detail) {
+    super(`Relay refused message ${messageId}: [${code}] ${detail ?? ""}`.trimEnd());
+    this.name = "SendRefusedError";
+    this.messageId = messageId;
+    this.code = code;
+    this.detail = detail;
+  }
+};
 
 // src/protocol/address.ts
 var ADDRESS_RE = /^(?<agent>[a-z0-9][a-z0-9_-]{0,62}[a-z0-9]|[a-z0-9])::(?<domain>[a-z0-9](?:[a-z0-9.-]{0,253}[a-z0-9])?)$/;
@@ -325,11 +337,11 @@ function encryptPayload(plaintext, senderSigningKey, recipientVerifyKey) {
   try {
     const senderCurve = import_libsodium_wrappers.default.crypto_sign_ed25519_sk_to_curve25519(senderSigningKey);
     const recipientCurve = import_libsodium_wrappers.default.crypto_sign_ed25519_pk_to_curve25519(recipientVerifyKey);
-    const nonce = import_libsodium_wrappers.default.randombytes_buf(import_libsodium_wrappers.default.crypto_box_NONCEBYTES);
-    const encrypted = import_libsodium_wrappers.default.crypto_box_easy(plaintext, nonce, recipientCurve, senderCurve);
-    const combined = new Uint8Array(nonce.length + encrypted.length);
-    combined.set(nonce, 0);
-    combined.set(encrypted, nonce.length);
+    const nonce2 = import_libsodium_wrappers.default.randombytes_buf(import_libsodium_wrappers.default.crypto_box_NONCEBYTES);
+    const encrypted = import_libsodium_wrappers.default.crypto_box_easy(plaintext, nonce2, recipientCurve, senderCurve);
+    const combined = new Uint8Array(nonce2.length + encrypted.length);
+    combined.set(nonce2, 0);
+    combined.set(encrypted, nonce2.length);
     return b64Encode(combined);
   } catch (err) {
     if (err instanceof EncryptionError) throw err;
@@ -339,11 +351,11 @@ function encryptPayload(plaintext, senderSigningKey, recipientVerifyKey) {
 function decryptPayload(ciphertextB64, recipientSigningKey, senderVerifyKey) {
   try {
     const combined = b64Decode(ciphertextB64);
-    const nonce = combined.slice(0, import_libsodium_wrappers.default.crypto_box_NONCEBYTES);
+    const nonce2 = combined.slice(0, import_libsodium_wrappers.default.crypto_box_NONCEBYTES);
     const ciphertext = combined.slice(import_libsodium_wrappers.default.crypto_box_NONCEBYTES);
     const recipientCurve = import_libsodium_wrappers.default.crypto_sign_ed25519_sk_to_curve25519(recipientSigningKey);
     const senderCurve = import_libsodium_wrappers.default.crypto_sign_ed25519_pk_to_curve25519(senderVerifyKey);
-    return import_libsodium_wrappers.default.crypto_box_open_easy(ciphertext, nonce, senderCurve, recipientCurve);
+    return import_libsodium_wrappers.default.crypto_box_open_easy(ciphertext, nonce2, senderCurve, recipientCurve);
   } catch (err) {
     if (err instanceof DecryptionError) throw err;
     throw new DecryptionError(err instanceof Error ? err.message : String(err));
@@ -451,7 +463,7 @@ async function createEnvelope(fromAddress, toAddress, messageType, payloadPlaint
   parseAddress(fromAddress);
   parseAddress(toAddress);
   const messageId = (0, import_node_crypto2.randomUUID)();
-  const nonce = generateNonce();
+  const nonce2 = generateNonce();
   const timestamp = utcTimestamp();
   let encryptedPayload;
   if (typeValue === "handshake.request" /* HANDSHAKE_REQUEST */) {
@@ -470,7 +482,7 @@ async function createEnvelope(fromAddress, toAddress, messageType, payloadPlaint
     toAddress,
     timestamp,
     type: typeValue,
-    nonce,
+    nonce: nonce2,
     payload: encryptedPayload,
     signature: "",
     threadId: options?.threadId,
@@ -489,7 +501,7 @@ async function createEnvelope(fromAddress, toAddress, messageType, payloadPlaint
     toAddress,
     timestamp,
     type: typeValue,
-    nonce,
+    nonce: nonce2,
     payload: encryptedPayload,
     signature,
     threadId: options?.threadId,
@@ -581,8 +593,8 @@ function contactCardFromDict(d, options) {
   }
   return card;
 }
-async function createContactCard(address, displayName, relay, signingKey, options) {
-  parseAddress(address);
+async function createContactCard(address2, displayName, relay, signingKey, options) {
+  parseAddress(address2);
   const verifyKey = signingKey.slice(32);
   const pubKeyB64 = serializeVerifyKey(verifyKey);
   const fp = publicKeyFingerprint(verifyKey);
@@ -592,7 +604,7 @@ async function createContactCard(address, displayName, relay, signingKey, option
   ];
   const tempCard = {
     version: UAM_VERSION,
-    address,
+    address: address2,
     displayName,
     description: options?.description,
     system: options?.system,
@@ -609,7 +621,7 @@ async function createContactCard(address, displayName, relay, signingKey, option
   const signature = signMessage(canonicalize(signable), signingKey);
   return Object.freeze({
     version: UAM_VERSION,
-    address,
+    address: address2,
     displayName,
     description: options?.description,
     system: options?.system,
@@ -636,6 +648,156 @@ function verifyContactCard(card) {
   verifySignature(canonicalize(signable), card.signature, vk);
 }
 
+// src/protocol/signed.ts
+var import_node_crypto3 = require("crypto");
+
+// src/protocol/didkey.ts
+var B58 = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+var PREFIX = {
+  ed25519: new Uint8Array([237, 1]),
+  p256: new Uint8Array([128, 36])
+};
+var LENGTH = { ed25519: 32, p256: 33 };
+var InvalidDidKeyError = class extends UAMError {
+  constructor(message) {
+    super(message);
+    this.name = "InvalidDidKeyError";
+  }
+};
+function b58decode(text) {
+  let n = 0n;
+  for (const c of text) {
+    const i = B58.indexOf(c);
+    if (i < 0) throw new InvalidDidKeyError(`not base58btc: ${JSON.stringify(c)}`);
+    n = n * 58n + BigInt(i);
+  }
+  const body = [];
+  while (n > 0n) {
+    body.unshift(Number(n & 0xffn));
+    n >>= 8n;
+  }
+  let zeros = 0;
+  while (zeros < text.length && text[zeros] === "1") zeros += 1;
+  return new Uint8Array([...new Array(zeros).fill(0), ...body]);
+}
+function checkKey(kind, key) {
+  if (key.length !== LENGTH[kind]) {
+    throw new InvalidDidKeyError(`${kind} key must be ${LENGTH[kind]} bytes`);
+  }
+  if (kind === "p256" && key[0] !== 2 && key[0] !== 3) {
+    throw new InvalidDidKeyError("P-256 key must be a compressed point");
+  }
+}
+function decodeDidKey(did2) {
+  if (typeof did2 !== "string" || !did2.startsWith("did:key:z")) {
+    throw new InvalidDidKeyError("not a did:key with base58btc multibase");
+  }
+  const raw = b58decode(did2.slice("did:key:z".length));
+  for (const kind of Object.keys(PREFIX)) {
+    const prefix = PREFIX[kind];
+    if (raw.length >= prefix.length && prefix.every((b, i) => raw[i] === b)) {
+      const key = raw.slice(prefix.length);
+      checkKey(kind, key);
+      return { kind, key };
+    }
+  }
+  throw new InvalidDidKeyError("unsupported key type");
+}
+
+// src/protocol/signed.ts
+var MAX_INT = 2 ** 53 - 1;
+var SignedObjectError = class extends UAMError {
+  constructor(message) {
+    super(message);
+    this.name = "SignedObjectError";
+  }
+};
+var has = (obj, key) => Object.prototype.hasOwnProperty.call(obj, key);
+function isPlainObject(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === null || proto === Object.prototype;
+}
+var HASH_RE = /^[A-Za-z0-9_-]{43}$/;
+var OWNER_ID_RE = /^[A-Za-z0-9_-]{22}$/;
+var NONCE_RE = /^[A-Za-z0-9_-]{16,64}$/;
+var SECRET_RE = /^[A-Za-z0-9_-]{22}$/;
+var DOMAIN_RE = /^(?=.{1,253}$)[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+$/;
+function fail(path, why) {
+  throw new SignedObjectError(`${path}: ${why}`);
+}
+var matching = (re, what) => (v, p) => {
+  if (typeof v !== "string" || !re.test(v)) fail(p, `must be ${what}`);
+};
+var hash = matching(HASH_RE, "a hash (43 base64url characters)");
+var ownerId = matching(OWNER_ID_RE, "an owner id (22 base64url characters)");
+var nonce = matching(NONCE_RE, "a nonce (16-64 base64url characters)");
+var secret = matching(SECRET_RE, "a secret (22 base64url characters)");
+var domain = matching(DOMAIN_RE, "a lowercase domain");
+var constant = (expected) => (v, p) => {
+  if (v !== expected) fail(p, `must be ${JSON.stringify(expected)}`);
+};
+var oneOf = (...options) => (v, p) => {
+  if (typeof v !== "string" || !options.includes(v)) fail(p, `must be one of ${options.join(", ")}`);
+};
+var address = (v, p) => {
+  if (typeof v !== "string") fail(p, "must be an address");
+  let full;
+  try {
+    full = parseAddress(v).full;
+  } catch {
+    return fail(p, "must be an address");
+  }
+  if (full !== v) fail(p, "must be an address in canonical (lowercase) form");
+};
+var did = (kind) => (v, p) => {
+  let found;
+  try {
+    found = decodeDidKey(v).kind;
+  } catch (err) {
+    return fail(p, err instanceof Error ? err.message : String(err));
+  }
+  if (found !== kind) fail(p, `must be a ${kind} did:key`);
+};
+var list = (item, minLen = 1, maxLen = 64) => (v, p) => {
+  if (!Array.isArray(v) || v.length < minLen || v.length > maxLen) {
+    fail(p, `must be a list of ${minLen}-${maxLen} items`);
+  }
+  v.forEach((entry, i) => item(entry, `${p}[${i}]`));
+};
+var object = (required, optional = {}) => (v, p) => {
+  if (!isPlainObject(v)) fail(p, "must be an object");
+  for (const key of Object.keys(v)) {
+    if (!has(required, key) && !has(optional, key)) fail(`${p}.${key}`, "unknown member");
+  }
+  for (const [key, member] of Object.entries(required)) {
+    if (!has(v, key)) fail(`${p}.${key}`, "missing");
+    member(v[key], `${p}.${key}`);
+  }
+  for (const [key, member] of Object.entries(optional)) {
+    if (has(v, key)) member(v[key], `${p}.${key}`);
+  }
+};
+var location = (v, p) => {
+  if (v !== "shared") address(v, p);
+};
+var access = object({ actions: list(oneOf("message"), 1, 1), locations: list(location) });
+var ownerRef = object({ relay: domain, ownerId, keysHash: hash });
+var ownerRefNoKeys = object({ relay: domain, ownerId });
+var passkey = did("p256");
+var agentKey = did("ed25519");
+var keysOwner = object({ relay: domain }, { ownerId });
+var DAY = 24 * 60 * 60 * 1e3;
+var SUBJECTS = {
+  owner: object({ kind: constant("owner"), owner: ownerRef }),
+  invitee: object({ kind: constant("invitee"), invite: hash }),
+  agent: object({ kind: constant("agent"), id: agentKey, address })
+};
+
+// src/protocol/webauthn.ts
+var import_node_crypto4 = require("crypto");
+var import_p256 = require("@noble/curves/p256");
+
 // src/sdk/config.ts
 var import_node_os = require("os");
 var import_node_path = require("path");
@@ -783,11 +945,11 @@ var KeyManager = class {
   /**
    * Store the address `relayUrl` gave this agent.
    */
-  saveAddress(name, address, relayUrl) {
+  saveAddress(name, address2, relayUrl) {
     (0, import_node_fs.mkdirSync)(this._keyDir, { recursive: true });
     (0, import_node_fs.writeFileSync)(
       (0, import_node_path2.join)(this._keyDir, `${name}.address`),
-      JSON.stringify({ address, relay_url: relayUrl })
+      JSON.stringify({ address: address2, relay_url: relayUrl })
     );
   }
   /**
@@ -800,14 +962,14 @@ var KeyManager = class {
     try {
       const path = (0, import_node_path2.join)(this._keyDir, `${name}.address`);
       const saved = JSON.parse((0, import_node_fs.readFileSync)(path, "utf-8"));
-      const address = saved?.address;
+      const address2 = saved?.address;
       const savedRelay = saved?.relay_url;
-      if (typeof address !== "string" || typeof savedRelay !== "string") {
+      if (typeof address2 !== "string" || typeof savedRelay !== "string") {
         return null;
       }
       if (trimRelayUrl(savedRelay) !== trimRelayUrl(relayUrl)) return null;
-      parseAddress(address);
-      return address;
+      parseAddress(address2);
+      return address2;
     } catch {
       return null;
     }
@@ -899,6 +1061,31 @@ function relayVouches(raw, signedAt, now, relayDomain) {
   return Math.abs(receivedAt - signedAt) <= window && age >= 0 && age <= STORED_MAIL_MAX_AGE * 1e3 + window;
 }
 
+// src/sdk/message.ts
+var SEND_STATUSES = [
+  "delivered",
+  "stored",
+  "relayed",
+  "queued",
+  "duplicate",
+  "dropped",
+  "pending",
+  "accepted",
+  "unknown"
+];
+function sendStatus(answer) {
+  if (answer === null) return "unknown";
+  const status = answer["status"];
+  if (typeof status === "string" && SEND_STATUSES.includes(status) && status !== "accepted" && status !== "unknown") {
+    return status;
+  }
+  return "accepted";
+}
+var PENDING_NOTE = "Not delivered: {to} only accepts messages from approved contacts. Do not resend it.";
+function pendingNote(to) {
+  return PENDING_NOTE.replace("{to}", to);
+}
+
 // src/sdk/contact-book.ts
 var import_node_fs3 = require("fs");
 var import_node_path3 = require("path");
@@ -996,36 +1183,36 @@ var ContactBook = class {
   /**
    * Check if an address is in the contact book (in-memory, no I/O).
    */
-  isKnown(address) {
-    return this._knownAddresses.has(address);
+  isKnown(address2) {
+    return this._knownAddresses.has(address2);
   }
   /**
    * Check if an address matches any blocked pattern (O(1) set lookup).
    */
-  isBlocked(address) {
-    if (this._blockedExact.has(address)) {
+  isBlocked(address2) {
+    if (this._blockedExact.has(address2)) {
       return true;
     }
-    if (address.includes("::")) {
-      const domain = address.split("::")[1];
-      return this._blockedDomains.has(domain);
+    if (address2.includes("::")) {
+      const domain2 = address2.split("::")[1];
+      return this._blockedDomains.has(domain2);
     }
     return false;
   }
   /**
    * Look up the public key for a known contact.
    */
-  getPublicKey(address) {
+  getPublicKey(address2) {
     if (this._db === null) return null;
-    const row = this._db.prepare("SELECT public_key FROM contacts WHERE address = ?").get(address);
+    const row = this._db.prepare("SELECT public_key FROM contacts WHERE address = ?").get(address2);
     return row?.public_key ?? null;
   }
   /**
    * Return the relay URLs for a known contact (CARD-04).
    */
-  getRelayUrls(address) {
+  getRelayUrls(address2) {
     if (this._db === null) return null;
-    const row = this._db.prepare("SELECT relay, relays_json FROM contacts WHERE address = ?").get(address);
+    const row = this._db.prepare("SELECT relay, relays_json FROM contacts WHERE address = ?").get(address2);
     if (!row) return null;
     if (row.relays_json !== null) {
       return JSON.parse(row.relays_json);
@@ -1046,19 +1233,19 @@ var ContactBook = class {
    * @throws {KeyPinningError} If a pinned/verified contact's key would be
    *   replaced by a different key without `force`.
    */
-  addContact(address, publicKey, options) {
+  addContact(address2, publicKey, options) {
     if (this._db === null) {
       throw new Error("ContactBook not open. Call open() first.");
     }
-    const existing = this._db.prepare("SELECT public_key, trust_state FROM contacts WHERE address = ?").get(address);
+    const existing = this._db.prepare("SELECT public_key, trust_state FROM contacts WHERE address = ?").get(address2);
     if (existing !== void 0 && (existing.trust_state === "pinned" || existing.trust_state === "verified") && existing.public_key !== publicKey) {
       if (!options?.force) {
         throw new KeyPinningError(
-          `Refusing to overwrite ${existing.trust_state} contact ${JSON.stringify(address)}: stored public key does not match the new key. Pass force: true to rotate.`
+          `Refusing to overwrite ${existing.trust_state} contact ${JSON.stringify(address2)}: stored public key does not match the new key. Pass force: true to rotate.`
         );
       }
       log.warn(
-        `Force-replacing the key of ${existing.trust_state} contact ${address} (key rotation)`
+        `Force-replacing the key of ${existing.trust_state} contact ${address2} (key rotation)`
       );
     }
     const displayName = options?.displayName ?? null;
@@ -1077,8 +1264,8 @@ var ContactBook = class {
            relay = COALESCE(excluded.relay, contacts.relay),
            relays_json = COALESCE(excluded.relays_json, contacts.relays_json),
            last_seen = datetime('now')`
-    ).run(address, publicKey, displayName, trustState, trustSource, relay, relaysJson);
-    this._knownAddresses.add(address);
+    ).run(address2, publicKey, displayName, trustState, trustSource, relay, relaysJson);
+    this._knownAddresses.add(address2);
   }
   /**
    * Return all contacts sorted by last_seen DESC.
@@ -1099,13 +1286,13 @@ var ContactBook = class {
   /**
    * Store a pending handshake request.
    */
-  addPending(address, contactCardJson) {
+  addPending(address2, contactCardJson) {
     if (this._db === null) {
       throw new Error("ContactBook not open. Call open() first.");
     }
     this._db.prepare(
       `INSERT OR REPLACE INTO pending_handshakes (address, contact_card) VALUES (?, ?)`
-    ).run(address, contactCardJson);
+    ).run(address2, contactCardJson);
   }
   /**
    * Retrieve all pending handshake requests.
@@ -1124,9 +1311,9 @@ var ContactBook = class {
   /**
    * Remove a pending handshake request.
    */
-  removePending(address) {
+  removePending(address2) {
     if (this._db === null) return;
-    this._db.prepare("DELETE FROM pending_handshakes WHERE address = ?").run(address);
+    this._db.prepare("DELETE FROM pending_handshakes WHERE address = ?").run(address2);
   }
   /**
    * Return pending handshakes older than N days.
@@ -1146,31 +1333,31 @@ var ContactBook = class {
   /**
    * Return the trust_state for an address, or null if unknown.
    */
-  getTrustState(address) {
+  getTrustState(address2) {
     if (this._db === null) return null;
-    const row = this._db.prepare("SELECT trust_state FROM contacts WHERE address = ?").get(address);
+    const row = this._db.prepare("SELECT trust_state FROM contacts WHERE address = ?").get(address2);
     return row?.trust_state ?? null;
   }
   /**
    * Set the pinned_at timestamp and trust_state='pinned' for a contact (TOFU).
    */
-  setPinnedAt(address) {
+  setPinnedAt(address2) {
     if (this._db === null) {
       throw new Error("ContactBook not open. Call open() first.");
     }
     this._db.prepare(
       "UPDATE contacts SET pinned_at = datetime('now'), trust_state = 'pinned' WHERE address = ?"
-    ).run(address);
+    ).run(address2);
   }
   /**
    * Remove a contact by address. Returns true if a contact was deleted.
    */
-  removeContact(address) {
+  removeContact(address2) {
     if (this._db === null) {
       throw new Error("ContactBook not open. Call open() first.");
     }
-    const result = this._db.prepare("DELETE FROM contacts WHERE address = ?").run(address);
-    this._knownAddresses.delete(address);
+    const result = this._db.prepare("DELETE FROM contacts WHERE address = ?").run(address2);
+    this._knownAddresses.delete(address2);
     return result.changes > 0;
   }
   /**
@@ -1178,8 +1365,8 @@ var ContactBook = class {
    *
    * Convenience helper for inbound message filtering (CARD-05, TOFU-02).
    */
-  isTrustedOrVerified(address) {
-    const state = this.getTrustState(address);
+  isTrustedOrVerified(address2) {
+    const state = this.getTrustState(address2);
     return state === "trusted" || state === "verified" || state === "pinned";
   }
   /**
@@ -1476,8 +1663,8 @@ var Tier3Resolver = class extends AddressResolver {
       transport: (0, import_viem.http)(rpcUrl)
     });
   }
-  async resolvePublicKey(address, _token, _relayUrl) {
-    const parsed = parseAddress(address);
+  async resolvePublicKey(address2, _token, _relayUrl) {
+    const parsed = parseAddress(address2);
     const name = parsed.domain;
     const cached = this._cache.get(name);
     if (cached && cached.expiresAt > Date.now()) {
@@ -1541,12 +1728,12 @@ var Tier3Resolver = class extends AddressResolver {
 // src/sdk/resolver.ts
 init_dns_verifier();
 var Tier1Resolver = class extends AddressResolver {
-  async resolvePublicKey(address, _token, relayUrl) {
+  async resolvePublicKey(address2, _token, relayUrl) {
     const resp = await fetch(
-      `${relayUrl}/api/v1/agents/${address}/public-key`
+      `${relayUrl}/api/v1/agents/${address2}/public-key`
     );
     if (resp.status === 404) {
-      throw new UAMError(`Agent not found: ${address}`);
+      throw new UAMError(`Agent not found: ${address2}`);
     }
     if (!resp.ok) {
       throw new UAMError(
@@ -1558,8 +1745,8 @@ var Tier1Resolver = class extends AddressResolver {
   }
 };
 var Tier2Resolver = class extends AddressResolver {
-  async resolvePublicKey(address, _token, _relayUrl) {
-    const parsed = parseAddress(address);
+  async resolvePublicKey(address2, _token, _relayUrl) {
+    const parsed = parseAddress(address2);
     const txtRecords = await queryUamTxt(parsed.domain);
     for (const txt of txtRecords) {
       const tags = parseUamTxt(txt);
@@ -1571,7 +1758,7 @@ var Tier2Resolver = class extends AddressResolver {
     const httpsKey = await resolveKeyViaHttps(parsed.agent, parsed.domain);
     if (httpsKey) return httpsKey;
     throw new UAMError(
-      `Could not resolve public key for ${address} via DNS or HTTPS`
+      `Could not resolve public key for ${address2} via DNS or HTTPS`
     );
   }
 };
@@ -1587,21 +1774,21 @@ var SmartResolver = class extends AddressResolver {
     this._tier2 = new Tier2Resolver();
     this._tier3 = tier3Config ? new Tier3Resolver(tier3Config) : null;
   }
-  async resolvePublicKey(address, token, relayUrl) {
-    const parsed = parseAddress(address);
-    const domain = parsed.domain;
-    if (domain === this.relayDomain) {
-      return this._tier1.resolvePublicKey(address, token, relayUrl);
+  async resolvePublicKey(address2, token, relayUrl) {
+    const parsed = parseAddress(address2);
+    const domain2 = parsed.domain;
+    if (domain2 === this.relayDomain) {
+      return this._tier1.resolvePublicKey(address2, token, relayUrl);
     }
-    if (domain.includes(".")) {
-      return this._tier2.resolvePublicKey(address, token, relayUrl);
+    if (domain2.includes(".")) {
+      return this._tier2.resolvePublicKey(address2, token, relayUrl);
     }
     if (!this._tier3) {
       throw new UAMError(
-        `Tier 3 resolution requires contract config. Cannot resolve dot-free domain: '${domain}'`
+        `Tier 3 resolution requires contract config. Cannot resolve dot-free domain: '${domain2}'`
       );
     }
-    return this._tier3.resolvePublicKey(address, token, relayUrl);
+    return this._tier3.resolvePublicKey(address2, token, relayUrl);
   }
 };
 
@@ -1610,15 +1797,23 @@ var TransportBase = class {
 };
 
 // src/sdk/transport/http.ts
+async function readAnswer(resp) {
+  try {
+    const body = await resp.json();
+    return body !== null && typeof body === "object" && !Array.isArray(body) ? body : {};
+  } catch {
+    return {};
+  }
+}
 var HTTPTransport = class extends TransportBase {
   _relayUrl;
   _token;
   _address;
-  constructor(relayUrl, token, address) {
+  constructor(relayUrl, token, address2) {
     super();
     this._relayUrl = relayUrl.replace(/\/+$/, "");
     this._token = token;
-    this._address = address;
+    this._address = address2;
   }
   async connect() {
   }
@@ -1638,6 +1833,7 @@ var HTTPTransport = class extends TransportBase {
         `HTTP send failed: ${resp.status} ${resp.statusText}`
       );
     }
+    return readAnswer(resp);
   }
   async receive(limit = 50) {
     const url = new URL(
@@ -1670,6 +1866,7 @@ var BASE_DELAY = 1;
 var MAX_DELAY = 60;
 var JITTER_RANGE = 1;
 var SEND_SETTLE_SECONDS = 5;
+var ACK_TIMEOUT_SECONDS = 5;
 var WebSocketTransport = class extends TransportBase {
   _url;
   _token;
@@ -1685,8 +1882,12 @@ var WebSocketTransport = class extends TransportBase {
   _unanswered = 0;
   _settling = null;
   _settled = null;
+  /** Sends waiting for the relay's answer, by message_id. */
+  _waiting = /* @__PURE__ */ new Map();
   /** @internal How long a close waits, in ms. Replaceable in tests. */
   _settleMs = SEND_SETTLE_SECONDS * 1e3;
+  /** @internal How long send() waits for an answer, in ms. Replaceable in tests. */
+  _ackMs = ACK_TIMEOUT_SECONDS * 1e3;
   constructor(wsUrl, token, onMessage) {
     super();
     this._url = wsUrl;
@@ -1730,13 +1931,42 @@ var WebSocketTransport = class extends TransportBase {
       this._ws = null;
     }
     this._connected = false;
+    this._abandonWaiting();
   }
+  /**
+   * Send an envelope and wait for the relay's answer.
+   *
+   * Resolves with the ack that names the message, or null when none came
+   * within _ackMs or the socket went: the message may still have arrived.
+   * Rejects with SendRefusedError when the relay refuses it by message_id
+   * (relays before 1.1 don't name it, so their refusals end as null).
+   */
   async send(envelope) {
     if (!this._ws || this._ws.readyState !== import_ws.default.OPEN) {
       throw new Error("WebSocket not connected");
     }
+    const messageId = envelope["message_id"];
+    let answer = null;
+    let timer;
+    if (typeof messageId === "string" && !this._waiting.has(messageId)) {
+      answer = new Promise((resolve, reject) => {
+        this._waiting.set(messageId, { resolve, reject });
+        timer = setTimeout(() => {
+          log.warn(
+            `No answer from the relay for ${messageId} within ${this._ackMs / 1e3}s`
+          );
+          this._settle(messageId, null);
+        }, this._ackMs);
+      });
+    }
     this._ws.send(JSON.stringify(envelope));
     this._unanswered += 1;
+    if (answer === null) return null;
+    try {
+      return await answer;
+    } finally {
+      clearTimeout(timer);
+    }
   }
   async receive(limit = 50) {
     const result = this._pending.slice(0, limit);
@@ -1763,6 +1993,21 @@ var WebSocketTransport = class extends TransportBase {
     });
     return this._settling;
   }
+  /** Hand the relay's answer (or a refusal) to the send waiting for it. */
+  _settle(messageId, answer, error) {
+    if (typeof messageId !== "string") return;
+    const waiting = this._waiting.get(messageId);
+    if (!waiting) return;
+    this._waiting.delete(messageId);
+    if (error) waiting.reject(error);
+    else waiting.resolve(answer);
+  }
+  /** The socket went: no answers will come for what it carried. */
+  _abandonWaiting() {
+    const waiting = [...this._waiting.values()];
+    this._waiting.clear();
+    for (const w of waiting) w.resolve(null);
+  }
   _answered() {
     this._unanswered = Math.max(0, this._unanswered - 1);
     if (this._unanswered === 0) this._settled?.();
@@ -1794,6 +2039,7 @@ var WebSocketTransport = class extends TransportBase {
         this._ws = null;
         this._unanswered = 0;
         this._settled?.();
+        this._abandonWaiting();
         if (!this._running) return;
         attempt += 1;
         const delay = Math.min(BASE_DELAY * Math.pow(2, attempt), MAX_DELAY);
@@ -1823,16 +2069,28 @@ var WebSocketTransport = class extends TransportBase {
       }
     } else if (msgType === "ack") {
       this._answered();
+      this._settle(msg["message_id"], msg);
+    } else if (msgType === "relay.notice") {
+      log.warn(
+        `Relay notice: message ${String(msg["message_id"])} is ${String(msg["status"])}`
+      );
     } else if (msgType === "error" || "error" in msg) {
       this._answered();
+      const code = String(msg["error"] ?? msg["code"] ?? "error");
+      const detail = typeof msg["detail"] === "string" ? msg["detail"] : void 0;
+      log.warn(`Relay error: [${code}] ${detail ?? ""}`.trimEnd());
+      const messageId = msg["message_id"];
+      if (typeof messageId === "string") {
+        this._settle(messageId, null, new SendRefusedError(messageId, code, detail));
+      }
     }
   }
 };
 
 // src/sdk/transport/index.ts
-function createTransport(config, token, address, onMessage) {
+function createTransport(config, token, address2, onMessage) {
   if (config.transportType === "http") {
-    return new HTTPTransport(config.relayUrl, token, address);
+    return new HTTPTransport(config.relayUrl, token, address2);
   } else {
     return new WebSocketTransport(config.relayWsUrl, token, onMessage);
   }
@@ -2225,7 +2483,12 @@ var Agent = class {
   }
   // -- Messaging -----------------------------------------------------------
   /**
-   * Send an encrypted, signed message. Returns the message_id.
+   * Send an encrypted, signed message.
+   *
+   * Returns the message id with what the relay did with it: `status`
+   * "pending" means the recipient only takes approved contacts, and the
+   * message was not kept (don't resend it). `delivered` is true only when
+   * the relay says the recipient has it.
    */
   async send(toAddress, message, options) {
     await this._ensureConnected();
@@ -2257,14 +2520,20 @@ var Agent = class {
     );
     const wire = toWireDict(envelope);
     const relayUrls = await this._getRelayUrls(toAddress);
+    let answer;
     if (relayUrls !== null && relayUrls.length === 1 && relayUrls[0] === this._config.relayUrl) {
-      await this._transport.send(wire);
+      answer = await this._transport.send(wire);
     } else if (relayUrls !== null && relayUrls.length > 0) {
-      await this._trySendWithFailover(wire, relayUrls);
+      answer = await this._trySendWithFailover(wire, relayUrls);
     } else {
-      await this._transport.send(wire);
+      answer = await this._transport.send(wire);
     }
-    return envelope.messageId;
+    const status = sendStatus(answer);
+    return {
+      messageId: envelope.messageId,
+      status,
+      delivered: status === "delivered"
+    };
   }
   /**
    * Retrieve, decrypt, and verify pending messages.
@@ -2309,43 +2578,43 @@ var Agent = class {
    * Adds the sender to contacts with trust_source='explicit-approval'
    * and sends handshake.accept back.
    */
-  async approve(address) {
+  async approve(address2) {
     await this._ensureConnected();
     const pendingList = this._contactBook.getPending();
-    const entry = pendingList.find((p) => p.address === address);
+    const entry = pendingList.find((p) => p.address === address2);
     if (!entry) {
-      throw new UAMError(`No pending handshake from ${address}`);
+      throw new UAMError(`No pending handshake from ${address2}`);
     }
     const cardDict = JSON.parse(entry.contactCard);
     const card = contactCardFromDict(cardDict);
     verifyContactCard(card);
     const senderVk = deserializeVerifyKey(card.publicKey);
-    bindCardToEnvelope(card, { fromAddress: address }, senderVk);
+    bindCardToEnvelope(card, { fromAddress: address2 }, senderVk);
     this._contactBook.addContact(card.address, card.publicKey, {
       displayName: card.displayName,
       trustState: "trusted",
       trustSource: "explicit-approval"
     });
-    this._contactBook.removePending(address);
-    await this._handshake._sendAccept(this, address, senderVk);
+    this._contactBook.removePending(address2);
+    await this._handshake._sendAccept(this, address2, senderVk);
   }
   /**
    * Deny a pending handshake request.
    *
    * Removes the entry from pending and sends handshake.deny.
    */
-  async deny(address) {
+  async deny(address2) {
     await this._ensureConnected();
     const pendingList = this._contactBook.getPending();
-    const entry = pendingList.find((p) => p.address === address);
+    const entry = pendingList.find((p) => p.address === address2);
     if (!entry) {
-      throw new UAMError(`No pending handshake from ${address}`);
+      throw new UAMError(`No pending handshake from ${address2}`);
     }
     const cardDict = JSON.parse(entry.contactCard);
     const card = contactCardFromDict(cardDict);
     const senderVk = deserializeVerifyKey(card.publicKey);
-    this._contactBook.removePending(address);
-    await this._handshake._sendDeny(this, address, senderVk);
+    this._contactBook.removePending(address2);
+    await this._handshake._sendDeny(this, address2, senderVk);
   }
   /**
    * Block an address or domain pattern (HAND-04).
@@ -2371,7 +2640,7 @@ var Agent = class {
    *
    * Returns `true` if verified, `false` on timeout.
    */
-  async verifyDomain(domain, options) {
+  async verifyDomain(domain2, options) {
     const { generateTxtRecord: generateTxtRecord2 } = await Promise.resolve().then(() => (init_dns_verifier(), dns_verifier_exports));
     await this._ensureConnected();
     const timeout = options?.timeout ?? 3e5;
@@ -2392,7 +2661,7 @@ var Agent = class {
               "Content-Type": "application/json",
               Authorization: `Bearer ${this._token}`
             },
-            body: JSON.stringify({ domain }),
+            body: JSON.stringify({ domain: domain2 }),
             signal: AbortSignal.timeout(3e4)
           }
         );
@@ -2445,7 +2714,7 @@ var Agent = class {
         if (!resp.ok) {
           throw new Error(`HTTP ${resp.status}`);
         }
-        return;
+        return await readAnswer(resp);
       } catch (err) {
         lastError = err instanceof Error ? err : new Error(String(err));
       }
@@ -2743,13 +3012,13 @@ var Agent = class {
     };
     let resp = await this._postRegistration(body);
     if (resp.status === 409) {
-      const address2 = await this._addressOnRelay();
+      const address3 = await this._addressOnRelay();
       resp = await this._postRegistration({
         ...body,
-        proof: this._registrationProof(address2)
+        proof: this._registrationProof(address3)
       });
       if (resp.status === 409 || resp.status === 403) {
-        throw this._ownershipNotProven(address2);
+        throw this._ownershipNotProven(address3);
       }
     }
     if (!resp.ok) {
@@ -2759,26 +3028,26 @@ var Agent = class {
       );
     }
     const data = await resp.json();
-    const address = data["address"];
-    this._useAddress(address);
+    const address2 = data["address"];
+    this._useAddress(address2);
     this._token = data["token"];
     const { name } = this._config;
     const token = this._token;
     this._tryToSave("token", () => this._keyManager.saveToken(name, token));
-    this._saveAddress(address);
+    this._saveAddress(address2);
   }
   /** This agent's address on the relay, for signing a proof. */
   async _addressOnRelay() {
     const { name, explicitRelayDomain, relayDomain, relayUrl } = this._config;
     if (explicitRelayDomain !== null) return `${name}::${explicitRelayDomain}`;
-    const domain = await this._fetchRelayDomain();
-    if (domain === null) return `${name}::${relayDomain}`;
-    if (!this._relayMayUse(domain)) {
+    const domain2 = await this._fetchRelayDomain();
+    if (domain2 === null) return `${name}::${relayDomain}`;
+    if (!this._relayMayUse(domain2)) {
       throw new UAMError(
-        `The relay at ${relayUrl} says its domain is ${domain}. Pass the domain option as ${JSON.stringify(domain)} if that is right.`
+        `The relay at ${relayUrl} says its domain is ${domain2}. Pass the domain option as ${JSON.stringify(domain2)} if that is right.`
       );
     }
-    return `${name}::${domain}`;
+    return `${name}::${domain2}`;
   }
   /**
    * True if the relay's URL fits `domain`, so a proof can be signed for it.
@@ -2786,14 +3055,14 @@ var Agent = class {
    * A proof names an address on one relay, so it is only signed for a domain
    * this URL belongs to. A relay on this machine may use any domain.
    */
-  _relayMayUse(domain) {
+  _relayMayUse(domain2) {
     let host;
     try {
       host = new URL(this._config.relayUrl).hostname.toLowerCase();
     } catch {
       return false;
     }
-    const wanted = domain.toLowerCase();
+    const wanted = domain2.toLowerCase();
     return host === wanted || host.endsWith(`.${wanted}`) || host === "localhost" || host === "[::1]" || /^127\.\d+\.\d+\.\d+$/.test(host);
   }
   _postRegistration(body) {
@@ -2808,27 +3077,27 @@ var Agent = class {
    *
    * The signed string must stay byte-identical to the Python SDK's.
    */
-  _registrationProof(address) {
+  _registrationProof(address2) {
     const timestamp = utcTimestamp();
     const signature = signMessage(
       new TextEncoder().encode(`uam-register-v1
-${address}
+${address2}
 ${timestamp}`),
       this._keyManager.signingKey
     );
     return { timestamp, signature };
   }
-  _ownershipNotProven(address) {
+  _ownershipNotProven(address2) {
     return new UAMError(
-      `Address already registered, and this key could not prove ownership: ` + address
+      `Address already registered, and this key could not prove ownership: ` + address2
     );
   }
   /** Remember `address` for this relay, if the key folder allows it. */
-  _saveAddress(address) {
+  _saveAddress(address2) {
     const { name, relayUrl } = this._config;
     this._tryToSave(
       "address",
-      () => this._keyManager.saveAddress(name, address, relayUrl)
+      () => this._keyManager.saveAddress(name, address2, relayUrl)
     );
   }
   /** Saving is best effort: a key folder we can't write doesn't stop us. */
@@ -2841,12 +3110,12 @@ ${timestamp}`),
     }
   }
   /** Take `address` as ours; its domain is this relay's real domain. */
-  _useAddress(address) {
-    this._address = address;
-    const domain = parseAddress(address).domain;
-    this._config.relayDomain = domain;
+  _useAddress(address2) {
+    this._address = address2;
+    const domain2 = parseAddress(address2).domain;
+    this._config.relayDomain = domain2;
     if (this._resolver instanceof SmartResolver) {
-      this._resolver.relayDomain = domain;
+      this._resolver.relayDomain = domain2;
     }
   }
   /**
@@ -2861,11 +3130,11 @@ ${timestamp}`),
     if (explicitRelayDomain !== null) return `${name}::${explicitRelayDomain}`;
     const saved = this._keyManager.loadAddress(name, this._config.relayUrl);
     if (saved) return saved;
-    const domain = await this._fetchRelayDomain();
-    if (domain === null) return `${name}::${this._config.relayDomain}`;
-    const address = `${name}::${domain}`;
-    this._saveAddress(address);
-    return address;
+    const domain2 = await this._fetchRelayDomain();
+    if (domain2 === null) return `${name}::${this._config.relayDomain}`;
+    const address2 = `${name}::${domain2}`;
+    this._saveAddress(address2);
+    return address2;
   }
   /** Ask the relay for its domain; null if it cannot say. */
   async _fetchRelayDomain() {
@@ -2874,9 +3143,9 @@ ${timestamp}`),
       const resp = await fetch(url, { signal: AbortSignal.timeout(1e4) });
       if (!resp.ok) return null;
       const data = await resp.json();
-      const domain = data["relay_domain"];
-      if (typeof domain !== "string" || domain === "") return null;
-      return parseAddress(`${this._config.name}::${domain}`).domain;
+      const domain2 = data["relay_domain"];
+      if (typeof domain2 !== "string" || domain2 === "") return null;
+      return parseAddress(`${this._config.name}::${domain2}`).domain;
     } catch {
       return null;
     }
@@ -2915,18 +3184,18 @@ async function initCommand(options) {
     const keyPath = (0, import_node_path7.join)(cfg.keyDir, `${agentName}.key`);
     if ((0, import_node_fs6.existsSync)(keyPath)) {
       km.loadOrGenerate(agentName);
-      const address2 = km.loadAddress(agentName, cfg.relayUrl) ?? `${agentName}::${cfg.relayDomain}`;
+      const address3 = km.loadAddress(agentName, cfg.relayUrl) ?? `${agentName}::${cfg.relayDomain}`;
       const fp2 = publicKeyFingerprint(km.verifyKey);
-      console.log(`Agent already initialized: ${address2}`);
+      console.log(`Agent already initialized: ${address3}`);
       console.log(`Fingerprint: ${fp2}`);
       return;
     }
     const agent = new Agent(agentName, { relay: options.relay });
     await agent.connect();
-    const address = agent.address;
+    const address2 = agent.address;
     const fp = publicKeyFingerprint(agent._keyManager.verifyKey);
     await agent.close();
-    console.log(`Initialized agent: ${address}`);
+    console.log(`Initialized agent: ${address2}`);
     console.log(`Fingerprint: ${fp}`);
   } catch (err) {
     cliError(`Error: ${err instanceof Error ? err.message : String(err)}`);
@@ -2934,7 +3203,7 @@ async function initCommand(options) {
 }
 
 // src/cli/commands/send.ts
-async function sendCommand(address, message, options) {
+async function sendCommand(address2, message, options) {
   const agentName = options.name ?? findAgentName();
   if (!agentName) {
     cliError("No agent initialized. Run `uam init` first.");
@@ -2942,9 +3211,12 @@ async function sendCommand(address, message, options) {
   try {
     const agent = new Agent(agentName);
     await agent.connect();
-    const msgId = await agent.send(address, message);
+    const result = await agent.send(address2, message);
     await agent.close();
-    console.log(`Message sent to ${address} (id: ${msgId})`);
+    console.log(`Message to ${address2}: ${result.status} (id: ${result.messageId})`);
+    if (result.status === "pending") {
+      console.log(pendingNote(address2));
+    }
   } catch (err) {
     cliError(`Error: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -3011,9 +3283,9 @@ async function whoamiCommand(options) {
   await sodiumReady;
   const km = new KeyManager(cfg.keyDir);
   km.loadOrGenerate(agentName);
-  const address = km.loadAddress(agentName, cfg.relayUrl) ?? `${agentName}::${cfg.relayDomain}`;
+  const address2 = km.loadAddress(agentName, cfg.relayUrl) ?? `${agentName}::${cfg.relayDomain}`;
   const fp = publicKeyFingerprint(km.verifyKey);
-  console.log(`Address:     ${address}`);
+  console.log(`Address:     ${address2}`);
   console.log(`Fingerprint: ${fp}`);
   console.log(`Key file:    ${keyPath}`);
 }
@@ -3084,7 +3356,7 @@ async function pendingCommand(options) {
 }
 
 // src/cli/commands/approve.ts
-async function approveCommand(address, options) {
+async function approveCommand(address2, options) {
   const agentName = options.name ?? findAgentName();
   if (!agentName) {
     cliError("No agent initialized. Run `uam init` first.");
@@ -3092,16 +3364,16 @@ async function approveCommand(address, options) {
   try {
     const agent = new Agent(agentName);
     await agent.connect();
-    await agent.approve(address);
+    await agent.approve(address2);
     await agent.close();
-    console.log(`Approved: ${address}`);
+    console.log(`Approved: ${address2}`);
   } catch (err) {
     cliError(`Error: ${err instanceof Error ? err.message : err}`);
   }
 }
 
 // src/cli/commands/deny.ts
-async function denyCommand(address, options) {
+async function denyCommand(address2, options) {
   const agentName = options.name ?? findAgentName();
   if (!agentName) {
     cliError("No agent initialized. Run `uam init` first.");
@@ -3109,9 +3381,9 @@ async function denyCommand(address, options) {
   try {
     const agent = new Agent(agentName);
     await agent.connect();
-    await agent.deny(address);
+    await agent.deny(address2);
     await agent.close();
-    console.log(`Denied: ${address}`);
+    console.log(`Denied: ${address2}`);
   } catch (err) {
     cliError(`Error: ${err instanceof Error ? err.message : err}`);
   }
@@ -3153,21 +3425,21 @@ async function unblockCommand(pattern, options) {
 }
 
 // src/cli/commands/contact.ts
-async function contactFingerprintCommand(address, options) {
+async function contactFingerprintCommand(address2, options) {
   const agentName = options.name ?? findAgentName();
   const cfg = new SDKConfig({ name: agentName ?? "_probe" });
   const book = new ContactBook(cfg.dataDir);
   try {
     book.open();
-    const pkStr = book.getPublicKey(address);
+    const pkStr = book.getPublicKey(address2);
     book.close();
     if (pkStr === null) {
-      cliError(`Contact not found: ${address}`);
+      cliError(`Contact not found: ${address2}`);
     }
     const vk = deserializeVerifyKey(pkStr);
     const fp = publicKeyFingerprint(vk);
     const shortFp = fp.slice(0, 16);
-    console.log(`Address:     ${address}`);
+    console.log(`Address:     ${address2}`);
     console.log(`Fingerprint: ${shortFp}`);
     console.log(`Full:        ${fp}`);
   } catch (err) {
@@ -3177,43 +3449,43 @@ async function contactFingerprintCommand(address, options) {
     cliError(`Error: ${err instanceof Error ? err.message : err}`);
   }
 }
-async function contactVerifyCommand(address, options) {
+async function contactVerifyCommand(address2, options) {
   const agentName = options.name ?? findAgentName();
   const cfg = new SDKConfig({ name: agentName ?? "_probe" });
   const book = new ContactBook(cfg.dataDir);
   try {
     book.open();
-    const pkStr = book.getPublicKey(address);
+    const pkStr = book.getPublicKey(address2);
     if (pkStr === null) {
       book.close();
-      cliError(`Contact not found: ${address}`);
+      cliError(`Contact not found: ${address2}`);
     }
     const vk = deserializeVerifyKey(pkStr);
     const fp = publicKeyFingerprint(vk);
-    console.log(`Fingerprint for ${address}: ${fp.slice(0, 16)}`);
-    book.addContact(address, pkStr, {
+    console.log(`Fingerprint for ${address2}: ${fp.slice(0, 16)}`);
+    book.addContact(address2, pkStr, {
       trustState: "verified",
       trustSource: "manual-verify"
     });
     book.close();
-    console.log(`Contact ${address} verified. Trust state: verified`);
+    console.log(`Contact ${address2} verified. Trust state: verified`);
   } catch (err) {
     cliError(`Error: ${err instanceof Error ? err.message : err}`);
   }
 }
-async function contactRemoveCommand(address, options) {
+async function contactRemoveCommand(address2, options) {
   const agentName = options.name ?? findAgentName();
   const cfg = new SDKConfig({ name: agentName ?? "_probe" });
   const book = new ContactBook(cfg.dataDir);
   try {
     book.open();
-    const removed = book.removeContact(address);
+    const removed = book.removeContact(address2);
     book.close();
     if (!removed) {
-      cliError(`Contact not found: ${address}`);
+      cliError(`Contact not found: ${address2}`);
     }
     console.log(
-      `Contact ${address} removed. Future messages will re-resolve the public key.`
+      `Contact ${address2} removed. Future messages will re-resolve the public key.`
     );
   } catch (err) {
     cliError(`Error: ${err instanceof Error ? err.message : err}`);
@@ -3222,7 +3494,7 @@ async function contactRemoveCommand(address, options) {
 
 // src/cli/commands/verify-domain.ts
 init_dns_verifier();
-async function verifyDomainCommand(domain, options) {
+async function verifyDomainCommand(domain2, options) {
   const agentName = options.name ?? findAgentName();
   if (!agentName) {
     cliError("No agent initialized. Run `uam init` first.");
@@ -3235,27 +3507,27 @@ async function verifyDomainCommand(domain, options) {
     const pubkey = agent.publicKey;
     const relayUrl = agent._config.relayUrl;
     const txtValue = generateTxtRecord(pubkey, relayUrl);
-    console.log(`Add this DNS TXT record to verify ${domain}:`);
+    console.log(`Add this DNS TXT record to verify ${domain2}:`);
     console.log();
-    console.log(`  Host:  _uam.${domain}`);
+    console.log(`  Host:  _uam.${domain2}`);
     console.log(`  Type:  TXT`);
     console.log(`  Value: ${txtValue}`);
     console.log();
     console.log(`Or serve this HTTPS fallback:`);
     console.log();
-    console.log(`  URL: https://${domain}/.well-known/uam.json`);
+    console.log(`  URL: https://${domain2}/.well-known/uam.json`);
     console.log();
     console.log(`See documentation for .well-known/uam.json format.`);
     console.log();
     console.log("Polling for verification...");
-    const verified = await agent.verifyDomain(domain, {
+    const verified = await agent.verifyDomain(domain2, {
       timeout: timeout * 1e3,
       pollInterval: pollInterval * 1e3
     });
     await agent.close();
     if (verified) {
       console.log(
-        `Verified! ${agent.address} is now Tier 2 via ${domain}.`
+        `Domain checked by ${agent.address.split("::")[1] ?? "your relay"}: ${agent.address} is now Tier 2 via ${domain2}.`
       );
     } else {
       console.log(
@@ -3278,9 +3550,9 @@ program.command("init").description("Initialize a new agent: generate keys and r
     relay: opts.relay
   });
 });
-program.command("send <address> <message>").description("Send a message to another agent").action(async (address, message) => {
+program.command("send <address> <message>").description("Send a message to another agent").action(async (address2, message) => {
   const globalName = program.opts().name;
-  await sendCommand(address, message, { name: globalName });
+  await sendCommand(address2, message, { name: globalName });
 });
 program.command("inbox").description("Check your inbox for pending messages").option("-l, --limit <number>", "Max messages to retrieve", "20").action(async (opts) => {
   const globalName = program.opts().name;
@@ -3302,21 +3574,21 @@ program.command("contacts").description("List known contacts from the local cont
   await contactsCommand({ name: globalName });
 });
 var contactCmd = program.command("contact").description("Contact management commands (fingerprint, verify, remove)");
-contactCmd.command("fingerprint <address>").description("Display the fingerprint for a known contact's public key").action(async (address) => {
+contactCmd.command("fingerprint <address>").description("Display the fingerprint for a known contact's public key").action(async (address2) => {
   const globalName = program.opts().name;
-  await contactFingerprintCommand(address, { name: globalName });
+  await contactFingerprintCommand(address2, { name: globalName });
 });
-contactCmd.command("verify <address>").description("Manually verify a contact, upgrading trust state to verified").option("-y, --yes", "Skip confirmation prompt").action(async (address, opts) => {
+contactCmd.command("verify <address>").description("Manually verify a contact, upgrading trust state to verified").option("-y, --yes", "Skip confirmation prompt").action(async (address2, opts) => {
   const globalName = program.opts().name;
-  await contactVerifyCommand(address, { name: globalName, yes: opts.yes });
+  await contactVerifyCommand(address2, { name: globalName, yes: opts.yes });
 });
-contactCmd.command("remove <address>").description("Remove a contact from the contact book").action(async (address) => {
+contactCmd.command("remove <address>").description("Remove a contact from the contact book").action(async (address2) => {
   const globalName = program.opts().name;
-  await contactRemoveCommand(address, { name: globalName });
+  await contactRemoveCommand(address2, { name: globalName });
 });
-program.command("verify-domain <domain>").description("Verify domain ownership for Tier 2 DNS-verified status").option("-t, --timeout <seconds>", "Polling timeout in seconds", "300").option("--poll-interval <seconds>", "Polling interval in seconds", "10").action(async (domain, opts) => {
+program.command("verify-domain <domain>").description("Verify domain ownership for Tier 2 DNS-verified status").option("-t, --timeout <seconds>", "Polling timeout in seconds", "300").option("--poll-interval <seconds>", "Polling interval in seconds", "10").action(async (domain2, opts) => {
   const globalName = program.opts().name;
-  await verifyDomainCommand(domain, {
+  await verifyDomainCommand(domain2, {
     name: globalName,
     timeout: parseInt(opts.timeout, 10),
     pollInterval: parseInt(opts.pollInterval, 10)
@@ -3326,13 +3598,13 @@ program.command("pending").description("List pending handshake requests awaiting
   const globalName = program.opts().name;
   await pendingCommand({ name: globalName });
 });
-program.command("approve <address>").description("Approve a pending handshake request").action(async (address) => {
+program.command("approve <address>").description("Approve a pending handshake request").action(async (address2) => {
   const globalName = program.opts().name;
-  await approveCommand(address, { name: globalName });
+  await approveCommand(address2, { name: globalName });
 });
-program.command("deny <address>").description("Deny a pending handshake request").action(async (address) => {
+program.command("deny <address>").description("Deny a pending handshake request").action(async (address2) => {
   const globalName = program.opts().name;
-  await denyCommand(address, { name: globalName });
+  await denyCommand(address2, { name: globalName });
 });
 program.command("block <pattern>").description("Block an address or domain pattern (e.g., spammer::evil.com or *::evil.com)").action(async (pattern) => {
   const globalName = program.opts().name;