@candledottv/cli 0.11.15 → 0.11.16

package/dist/index.js

@@ -444,6 +444,9 @@ function writeUsageFailure(deps, message, json) {
     deps.stderr.write(`${message}
 `);
 }
+function portalDevicesUrl(apiUrl, portalOrigin) {
+  return `${portalDeviceUrl(apiUrl, portalOrigin)}?tab=keys#connected-devices`;
+}
 function portalDeviceUrl(apiUrl, portalOrigin) {
   if (portalOrigin) {
     try {
@@ -653,7 +656,14 @@ function profileTable(config, now) {
 }
 var PRE_PROFILE_FIELDS, API_KEY_PREFIXES, API_KEY_RANDOM_LENGTH = 43, INVALID_RPC_HOST = "invalid (fix with profile set)";
 var init_profiles = __esm(() => {
-  PRE_PROFILE_FIELDS = ["apiUrl", "keyPrefix", "deviceTokenPrefix", "scopes", "label", "portalOrigin"];
+  PRE_PROFILE_FIELDS = [
+    "apiUrl",
+    "keyPrefix",
+    "deviceTokenPrefix",
+    "scopes",
+    "label",
+    "portalOrigin"
+  ];
   API_KEY_PREFIXES = ["cndl_live_", "cndl_test_"];
 });
 
@@ -821,7 +831,7 @@ class EncryptedFileSecretStore {
 }
 async function promptHiddenSecret(promptText) {
   if (!process.stdin.isTTY) {
-    throw new Error("No TTY available for interactive input; pass --key-file instead");
+    throw new Error("No TTY available for hidden input; run this in a terminal.");
   }
   return readHiddenLine(promptText, realPromptStreams());
 }
@@ -26900,10 +26910,18 @@ async function assertNotOlderCopy(ctx, path, raw, accept) {
 }
 async function confirmLastSix(ctx, address, what) {
   const expected = address.slice(-6);
-  const typed = (await ctx.deps.promptLine(`Type the last six characters of ${what} (${address}) to confirm: `)).trim();
-  if (typed !== expected) {
-    throw new VaultError("DESTINATION_NOT_CONFIRMED", "That is not the last six characters of that address; nothing was done.", { suggestion: "Nothing was signed. Run it again and type the last six characters exactly as shown." });
+  const normalize3 = (value) => address.startsWith("0x") ? value.toLowerCase() : value;
+  for (let attempt = 0;attempt < 3; attempt++) {
+    const typed = (await ctx.deps.promptLine(`Type the last six characters of ${what} (${address}) to confirm: `)).trim();
+    if (normalize3(typed) === normalize3(expected))
+      return;
+    const difference = Array.from({ length: Math.max(expected.length, typed.length) }, (_, i) => i).find((i) => normalize3(typed)[i] !== normalize3(expected)[i]) ?? 0;
+    ctx.deps.stderr.write(`Expected  ${expected}
+You typed ${typed}
+${" ".repeat(10 + difference)}^ character ${difference + 1} differs
+`);
   }
+  throw new VaultError("DESTINATION_NOT_CONFIRMED", "That is not the last six characters of that address; nothing was done.", { suggestion: "Nothing was signed. Run it again and type the last six characters exactly as shown." });
 }
 function writeVaultFailure(ctx, error) {
   if (isUsageError(error))
@@ -30286,399 +30304,1233 @@ var init_wallet_keygen = __esm(() => {
   init_esm();
 });
 
-// src/vault/evm-sweep.ts
-function sameToken(a, b) {
-  return a.toLowerCase() === b.toLowerCase();
+// src/commands/swap.ts
+import { randomUUID } from "node:crypto";
+function tradingFailure(ctx, error, id) {
+  if (error instanceof TradingUsage) {
+    writeUsageFailure(ctx.deps, error.message, ctx.json);
+    return 2;
+  }
+  writeLocalFailure(ctx.deps, {
+    code: error instanceof TradingError ? error.code : "TRADING_FAILED",
+    message: `${error instanceof Error ? describeRpcFailure(error) : "Trading failed."}${id ? ` Operation ${id}; use candle swap status ${id} before another attempt.` : ""}`,
+    ...error instanceof TradingError && error.suggestion ? { suggestion: error.suggestion } : {},
+    ...error instanceof TradingError && error.details ? { details: error.details } : {}
+  }, ctx.json);
+  return error instanceof TradingError ? error.exitCode : 1;
 }
-function mergedTokens(sources) {
-  const out = [];
-  const seen = new Set;
-  for (const token of [
-    ...sources.always,
-    ...sources.flags,
-    ...sources.record.tokens,
-    ...sources.server.tokens,
-    ...sources.logs.tokens
-  ]) {
-    const key = token.toLowerCase();
-    if (seen.has(key))
-      continue;
-    seen.add(key);
-    out.push(toChecksumAddress(token));
+function lazySolanaClient(ctx, flag) {
+  let pending;
+  return () => {
+    pending ??= tradingSolanaClient(ctx, flag);
+    return pending;
+  };
+}
+async function tradingRead(ctx, client, read) {
+  try {
+    return await read();
+  } catch (error) {
+    if (isRateLimited(error))
+      throw tradingRateLimited(ctx, client.endpoint.host, error);
+    throw error;
   }
-  return out;
 }
-function alwaysTokens() {
-  return [toChecksumAddress(HOOD_USDG_ADDRESS), HOOD_WETH_ADDRESS];
+function printTradingResult(ctx, result) {
+  ctx.deps.stdout.write(ctx.json ? `${JSON.stringify(result)}
+` : `${JSON.stringify(result, null, 2)}
+`);
+  return 0;
 }
-function recordSource(read, wallet) {
-  const mine = read.entries.filter((entry) => sameToken(entry.wallet, wallet));
-  return {
-    tokens: mine.flatMap((entry) => entry.kind === "token" ? [entry.token] : []),
-    scanStarts: mine.flatMap((entry) => entry.kind === "scanStart" ? [BigInt(entry.block)] : []),
-    absent: read.absent,
-    noKey: read.noKey,
-    unreadableLines: read.unreadableLines,
-    partialTail: read.partialTail,
-    path: read.path
-  };
+function reportSettlement(ctx, settlement, out, id) {
+  const parsed = settlementSchema.safeParse(settlement);
+  const reading = parsed.success ? parsed.data : undefined;
+  if (reading?.state === "settled" && reading.settledOutRaw !== undefined)
+    ctx.deps.stderr.write(`settled ${decimalAmount(reading.settledOutRaw, out.decimals)} ${out.asset}
+`);
+  else {
+    const state = !reading ? "not measured" : reading.state === "settled" ? "settled, amount not measured" : reading.state;
+    ctx.deps.stderr.write(`Settlement: ${state}. Re-check with GET /api/v1/agent/swap/jobs/${id} (candle swap status ${id}).
+`);
+  }
+  return settlement !== null && typeof settlement === "object" ? { settlement } : {};
 }
-function startBlock(scanStarts, fromBlockFlag) {
-  const recorded = scanStarts.length > 0 ? scanStarts.reduce((a, b) => a < b ? a : b) : undefined;
-  if (recorded === undefined && fromBlockFlag === undefined)
-    return;
-  if (recorded === undefined)
-    return { block: fromBlockFlag, source: "--from-block" };
-  if (fromBlockFlag === undefined)
-    return { block: recorded, source: "record" };
-  return { block: recorded < fromBlockFlag ? recorded : fromBlockFlag, source: "record and --from-block" };
+function validClientId(id) {
+  return /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(id);
 }
-async function discoverTransferLogs(rpc, wallet, fromBlock, toBlock, opts = {}) {
-  const seen = new Map;
-  let page = opts.pageBlocks ?? LOG_PAGE_BLOCKS;
-  let pages = 0;
-  let from = fromBlock;
-  const topics = [ERC20_TRANSFER_TOPIC, null, addressTopic(wallet)];
-  while (from <= toBlock) {
-    const to = from + page - 1n > toBlock ? toBlock : from + page - 1n;
+async function lookupOperation(ctx, key, id, kind) {
+  const local = await savedOperation(ctx, key, id);
+  const kinds = kind ? [kind] : local && local.kind !== "lp" ? [local.kind] : ["trade", "swap", "launch"];
+  const found = [];
+  for (const candidate of kinds) {
     try {
-      const logs = await rpc.getLogs({ fromBlock: from, toBlock: to, topics });
-      pages += 1;
-      for (const log of logs)
-        seen.set(log.address.toLowerCase(), log.address);
-      from = to + 1n;
+      found.push({
+        ...operationSchema.parse(await request(ctx, key, jobPath(candidate, id))),
+        kind: candidate,
+        clientTradeId: id
+      });
     } catch (error) {
-      if (error instanceof EvmRpcError && error.kind === "rpc" && page > LOG_PAGE_FLOOR) {
-        page = page / 2n < LOG_PAGE_FLOOR ? LOG_PAGE_FLOOR : page / 2n;
-        continue;
-      }
-      const reason = error instanceof Error ? error.message : String(error);
-      return { failed: `eth_getLogs from block ${from} failed: ${reason}`, tokens: [...seen.values()], pages };
+      if (!(error instanceof TradingError && error.code === "JOB_NOT_FOUND"))
+        throw error;
     }
   }
-  return { tokens: [...seen.values()], pages };
+  if (found.length > 1)
+    throw new TradingError("AMBIGUOUS_OPERATION", "This id exists on multiple rails; specify --kind trade, swap or launch.");
+  return found[0] ? { ...found[0], ...local?.signature ? { signature: local.signature } : {} } : null;
 }
-function sourceLines(sources, host) {
-  const lines = ["Token sources:", "  USDG and WETH: always read"];
-  const record = sources.record;
-  if (record.noKey && record.absent) {
-    lines.push(`  sealed EVM record: none (this vault has no record key)`);
-  } else if (record.absent) {
-    lines.push(`  sealed EVM record: absent at ${record.path} (not on this machine, or nothing recorded yet)`);
-  } else {
-    const damage = [
-      ...record.unreadableLines > 0 ? [`${record.unreadableLines} unreadable line(s) skipped`] : [],
-      ...record.partialTail ? ["a partial last line skipped"] : []
-    ];
-    lines.push(`  sealed EVM record: ${record.tokens.length} token(s), ${record.scanStarts.length} scan start(s)${damage.length > 0 ? `; ${damage.join(", ")}` : ""}`);
-  }
-  const server = sources.server;
-  if (!server.asked)
-    lines.push(`  server traded-token list: not asked (${server.reason ?? "--emergency calls no Candle API"})`);
-  else if (!server.answered)
-    lines.push(`  server traded-token list: FAILED (${server.reason ?? "no answer"})`);
-  else
-    lines.push(`  server traded-token list: ${server.tokens.length} token(s)${server.truncated ? " (truncated)" : ""}`);
-  lines.push(`  --token: ${sources.flags.length}`);
-  const logs = sources.logs;
-  if (logs.ran && !logs.failed) {
-    lines.push(`  Transfer logs over ${host}: blocks ${logs.fromBlock} to ${logs.toBlock} (start from ${logs.startSource}), ${logs.tokens.length} contract(s)`);
-  } else if (logs.failed) {
-    lines.push(`  Transfer logs over ${host}: FAILED (${logs.reason})`);
-  } else {
-    lines.push(`  Transfer logs: NOT scanned (${logs.reason})`);
+async function swapStatus(args, ctx) {
+  const parsed = parseArgs(args, { valueFlags: ["--kind"], booleanFlags: ["--wait"] });
+  if ("error" in parsed || parsed.positionals.length !== 1 || !validClientId(parsed.positionals[0] ?? "") || parsed.values["--kind"] !== undefined && !["trade", "swap", "launch"].includes(parsed.values["--kind"])) {
+    writeUsageFailure(ctx.deps, "Usage: candle swap status <id> [--kind trade|swap|launch] [--wait]", ctx.json);
+    return 2;
   }
-  if (logs.ran && logs.fromBlock !== undefined) {
-    lines.push(`  A token received before block ${logs.fromBlock}, or from a contract that emits no Transfer log, still needs --token <0x...>.`);
+  try {
+    const key = await tradingKey(ctx);
+    const id = parsed.positionals[0];
+    const kind = parsed.values["--kind"];
+    const facts = bridgeFactsOf((await savedOperation(ctx, key, id))?.bridge);
+    const found = await lookupOperation(ctx, key, id, kind);
+    if (!found)
+      throw new TradingError("JOB_NOT_FOUND", `No operation ${id} is visible to key ${apiKeyPrefix(key) ?? "this key"} on the ${kind ?? "trade, swap, launch"} rail(s). Nothing was resent.`, {
+        suggestion: `Trade and launch jobs are readable by any key on this account; swap jobs only by the key that placed them. If another key or profile placed it, run: candle swap status ${id} --profile <that profile>`
+      });
+    const result = parsed.booleans.has("--wait") ? await waitForSettlement(ctx, key, id, found, facts) : { ...found, ...bridgeStatusField(ctx, found, facts) };
+    return printTradingResult(ctx, result);
+  } catch (error) {
+    return tradingFailure(ctx, error);
   }
-  return lines;
-}
-var LOG_PAGE_BLOCKS = 10000n, LOG_PAGE_FLOOR = 250n;
-var init_evm_sweep = __esm(() => {
-  init_evm_lite();
-});
-
-// src/vault/evm-tee.ts
-function resolveHoodClient(ctx, flag) {
-  const resolved = resolveEvmRpcUrl(flag, ctx.deps.env[EVM_RPC_URL_ENV], "--rpc-url");
-  if ("error" in resolved)
-    return resolved;
-  return {
-    rpc: createEvmRpc(resolved.url, ctx.deps.fetch),
-    url: resolved.url,
-    host: rpcHostOf2(resolved.url),
-    builtIn: resolved.builtIn
-  };
 }
-function hoodHostLine(client, what) {
-  return `Reading ${what} from ${client.host}${client.builtIn ? " (the built-in Hood RPC)" : ""}.`;
+function bridgeFactsOf(raw) {
+  const parsed = bridgeFactsSchema.safeParse(raw);
+  return parsed.success ? parsed.data : undefined;
 }
-async function assertHoodChain(client) {
-  const chainId = await client.rpc.chainId();
-  if (chainId !== BigInt(HOOD_CHAIN_ID)) {
-    throw new VaultError("EVM_CHAIN_MISMATCH", `${client.host} answered chain id ${chainId}; Hood TEE wallets live on Hood, chain id ${HOOD_CHAIN_ID}, only.`, { suggestion: "Nothing was signed or written. Point --rpc-url (or CANDLE_EVM_RPC_URL) at a Hood RPC." });
-  }
+function isBridgeJob(job, facts) {
+  return facts !== undefined || job.bridge !== null && typeof job.bridge === "object";
 }
-async function readEvmHoldings(rpc, address) {
-  const [eth, usdg, weth] = await Promise.all([
-    rpc.getBalance(address),
-    rpc.erc20BalanceOf(toChecksumAddress(HOOD_USDG_ADDRESS), address),
-    rpc.erc20BalanceOf(HOOD_WETH_ADDRESS, address)
-  ]);
-  return { eth, usdg, weth };
+function bridgeStatusField(ctx, found, facts) {
+  const job = found.job ?? {};
+  if (found.kind !== "swap" || !isBridgeJob(job, facts))
+    return {};
+  const status = describeBridgeJob(job, facts);
+  for (const line of status.lines)
+    ctx.deps.stderr.write(`${line}
+`);
+  const { lines: _lines, ...rest } = status;
+  return { bridgeStatus: rest };
 }
-function holdingsLines(address, holdings, observedAt) {
-  return [
-    `Holdings at ${address} on Hood (observed ${observedAt}):`,
-    `  ETH   ${formatUnits(holdings.eth, NATIVE_DECIMALS)}  (${holdings.eth} wei)`,
-    `  USDG  ${formatUnits(holdings.usdg, HOOD_USDG_DECIMALS)}  (${holdings.usdg} raw)`,
-    `  WETH  ${formatUnits(holdings.weth, NATIVE_DECIMALS)}  (${holdings.weth} raw)`,
-    "  Other tokens are not listed: an EVM RPC has no token-account listing."
-  ];
+function waitFinished(current, facts, sent) {
+  const job = current.job ?? {};
+  if (current.kind === "swap" && isBridgeJob(job, facts)) {
+    const status = describeBridgeJob(job, facts);
+    if (sent && status.phase === "not_broadcast")
+      return false;
+    return bridgeStatusFinal(status);
+  }
+  const settlement = settlementSchema.safeParse(job.settlement);
+  return !settlement.success || settlement.data.state !== "pending";
 }
-async function appendScanStart(ctx, vaultPath, wallet, block2) {
-  const outcome = await appendEvmRecordEntry({
-    vaultPath,
-    entry: { kind: "scanStart", wallet, block: Number(block2) },
-    clock: ctx.deps
-  });
-  const repaired = appendNotice(outcome, `the scan start for ${wallet}`);
-  if (outcome.written) {
-    if (repaired !== undefined)
-      ctx.deps.stderr.write(`${repaired}
-`);
-    return { recorded: true, block: block2.toString() };
+async function waitForSettlement(ctx, key, id, first, facts, sent = false) {
+  const deadline = ctx.deps.now() + BRIDGE_WAIT_MS;
+  let current = first;
+  while (!waitFinished(current, facts, sent) && ctx.deps.now() < deadline) {
+    await ctx.deps.sleep(BRIDGE_WAIT_POLL_MS);
+    current = { ...current, ...operationSchema.parse(await request(ctx, key, jobPath(current.kind, id))) };
   }
-  ctx.deps.stderr.write(`The promote height, Hood block ${block2}, was not written to the sealed EVM record at ${evmRecordPath(vaultPath)} (${outcome.detail}).
-` + `Keep it: a later sweep of ${wallet} finds traded tokens from it with: candle tee sweep ${wallet} --from-block ${block2}
+  const field = bridgeStatusField(ctx, current, facts);
+  const finished = waitFinished(current, facts, sent);
+  if (!finished)
+    ctx.deps.stderr.write(`Still not final after ten minutes. Re-check with candle swap status ${id} --wait.
 `);
-  return { recorded: false, block: block2.toString() };
+  return { ...current, ...field, waited: { final: finished } };
 }
-async function appendEvmRecordForTrade(ctx, entry) {
-  let vaultPath;
-  try {
-    vaultPath = defaultVaultPath(ctx.deps.env, ctx.deps.homedir());
-  } catch (error) {
-    return { appended: false, notice: error instanceof Error ? error.message : String(error) };
-  }
+async function decimalsFor(ctx, asset, client) {
+  if (BASES[asset])
+    return BASES[asset].decimals;
+  const reader = await client();
+  let result;
   try {
-    const outcome = await appendEvmRecordEntry({ vaultPath, entry, clock: ctx.deps });
-    if (!outcome.written)
-      return { appended: false, notice: outcome.detail };
-    const repaired = appendNotice(outcome, `token ${entry.token}`);
-    return { appended: true, ...repaired !== undefined ? { notice: repaired } : {} };
+    result = await tradingRead(ctx, reader, () => reader.rpc.getTokenSupply(asset));
   } catch (error) {
-    return { appended: false, notice: error instanceof Error ? error.message : String(error) };
+    if (error instanceof TradingError)
+      throw error;
+    throw new TradingError("RPC_FAILED", "Solana getTokenSupply failed; no automatic re-send was made.");
   }
+  const decimals = result.decimals;
+  if (typeof decimals !== "number" || !Number.isInteger(decimals) || decimals < 0 || decimals > 18)
+    throw new TradingError("INVALID_RESPONSE", "RPC returned invalid mint decimals.");
+  return decimals;
 }
-async function readHoodTeeServer(ctx, entry) {
-  if (entry.linkedWalletId === undefined) {
-    return {
-      lock: {
-        state: "unknown",
-        reason: "this wallet has no linked wallet id recorded",
-        suggestion: `Nothing was signed. This wallet has no server row, so its lock cannot be read. candle tee sweep ${entry.address} --emergency moves the funds and exits 3; it does not record sweptAt or retire the entry.`
-      }
-    };
-  }
-  const apiKey = await resolveApiKey(ctx.deps, ctx.profile);
-  if (apiKey === undefined)
-    return { lock: { state: "unknown", reason: "no API key for this profile" } };
+async function assertDeferredExecuteSupported(ctx, key, id) {
   try {
-    const result = await apiRequest(`/api/v1/agent/wallets/${encodeURIComponent(entry.linkedWalletId)}/hood-tee`, {
-      auth: "key",
-      credentials: { apiKey },
-      apiUrl: ctx.apiUrl,
-      fetch: ctx.deps.fetch,
-      env: ctx.deps.env
-    });
-    if (!result.ok)
-      return { lock: { state: "unknown", reason: result.message ?? `HTTP ${result.status}` } };
-    const body = result.body ?? {};
-    const reported = typeof body.address === "string" ? body.address : undefined;
-    if (reported === undefined || !sameAddress(reported, entry.address)) {
-      return {
-        lock: {
-          state: "unknown",
-          reason: reported === undefined ? "the response named no wallet address" : `the response is for ${reported}, not this wallet`
-        }
-      };
-    }
-    const tradedTokens = Array.isArray(body.tradedTokens) ? body.tradedTokens.filter((token) => typeof token === "string" && /^0x[0-9a-fA-F]{40}$/.test(token)) : undefined;
-    const bridges = walletBridgesOf(result.body);
-    const extras = {
-      ...tradedTokens !== undefined ? { tradedTokens } : {},
-      ...body.tradedTokensTruncated === true ? { tradedTokensTruncated: true } : {},
-      ...bridges !== undefined ? { bridges } : {}
-    };
-    if (body.activeOperation === null)
-      return { lock: { state: "free" }, ...extras };
-    const op = body.activeOperation;
-    if (op === undefined || typeof op.operationId !== "string") {
-      return { lock: { state: "unknown", reason: "the response carried no activeOperation field" }, ...extras };
-    }
-    return {
-      lock: {
-        state: "held",
-        operationId: op.operationId,
-        kind: typeof op.kind === "string" ? op.kind : "operation",
-        expiresAt: typeof op.expiresAt === "number" ? op.expiresAt : 0
-      },
-      ...extras
-    };
+    await request(ctx, key, "/api/v1/trade/agent/execute", { clientTradeId: id });
   } catch (error) {
-    return { lock: { state: "unknown", reason: error instanceof Error ? error.message : String(error) } };
+    if (error instanceof TradingError && error.code === "JOB_NOT_FOUND")
+      return;
+    throw new TradingError("EMBEDDED_PAYER_UNSUPPORTED", "This Candle deployment cannot hold an embedded-wallet trade back for confirmation, so the quote could not be shown before the money moved. Nothing was built. Name a TEE wallet with --wallet, or point at a deployment that has it.");
   }
+  throw new TradingError("INVALID_RESPONSE", "The execute route answered for a trade that does not exist.");
 }
-function busyStatusHint(kind, operationId) {
-  if (kind === "swap")
-    return `candle swap status ${operationId}`;
-  if (kind === "trade" || kind === "launch")
-    return `candle swap status ${operationId} --kind ${kind}`;
-  return `the ${kind} operation ${operationId}`;
-}
-function assertWalletLockFree(entry, lock, now) {
-  if (lock.state === "free")
-    return;
-  if (lock.state === "held") {
-    const left = Math.max(0, Math.ceil((lock.expiresAt - now) / 60000));
-    throw new VaultError("WALLET_BUSY", `${entry.label || entry.address} has a sequenced ${lock.kind} in flight (operation ${lock.operationId}); signing locally now could use the nonce one of its legs holds.`, {
-      suggestion: `Nothing was signed. Wait for operation ${lock.operationId} to finish (${busyStatusHint(lock.kind, lock.operationId)}); the lock expires within ${left} minute(s) at most. If funds must move now, candle tee sweep ${entry.address} --emergency compares the chain's nonces instead.`,
-      details: { operationId: lock.operationId }
-    });
-  }
-  throw new VaultError("WALLET_LOCK_UNKNOWN", `Could not read whether ${entry.label || entry.address} has a sequenced operation in flight (${lock.reason}), so nothing is signed at its nonce.`, {
-    suggestion: lock.suggestion ?? `Nothing was signed. Restore the API key or connectivity and run it again. If the server is unreachable and funds must move: candle tee sweep ${entry.address} --emergency`
+async function swap(args, ctx) {
+  const parsed = parseArgs(args, {
+    valueFlags: ["--amount", "--percent", "--wallet", "--to", "--client-trade-id", "--slippage-bps", "--rpc-url"],
+    booleanFlags: ["--yes", "--wait"]
   });
-}
-var init_evm_tee = __esm(() => {
-  init_bridge();
-  init_deps();
-  init_evm_lite();
-  init_errors();
-  init_evm_record();
-  init_promote_support();
-  init_store();
-});
-
-// src/vault/evm-transfer.ts
-function refuse2(code, message, opts = {}) {
-  return new VaultError(code, message, { suggestion: opts.suggestion ?? "Nothing was signed.", ...opts });
-}
-function checkEvmDestination(to, from) {
-  if (!to.startsWith("0x")) {
-    throw refuse2("TRANSFER_CHAIN_MISMATCH", `${to} is not an EVM address, and ${from.label || from.address} is an EVM key.`, { suggestion: "Nothing was signed. An EVM key sends to a 0x address; a Solana key sends to a Solana address." });
-  }
-  const checked = checkEvmAddress(to);
-  if (!checked.ok) {
-    throw refuse2("EVM_DESTINATION_INVALID", `${to} is not a valid EVM address: ${checked.reason}.`);
-  }
-  if (sameEvmAddress(checked.address, from.address)) {
-    throw refuse2("EVM_SELF_TRANSFER", `${to} is ${from.label || from.address}'s own address.`);
+  if ("error" in parsed) {
+    writeUsageFailure(ctx.deps, parsed.error, ctx.json);
+    return 2;
   }
-  return checked.address;
-}
-function assertSolanaDestination(to, from) {
-  if (!looksLikeEvmAddress(to))
-    return;
-  throw refuse2("TRANSFER_CHAIN_MISMATCH", `${to} is an EVM address, and ${from.label || from.address} is a Solana key.`, { suggestion: "Nothing was signed. A Solana key sends to a Solana address; an EVM key sends to a 0x address." });
-}
-async function resolveEvmAsset(rpc, asset, chainId) {
-  const upper = asset.toUpperCase();
-  if (upper === "ETH")
-    return { kind: "native", symbol: "ETH", decimals: NATIVE_DECIMALS };
-  let token;
-  if (upper === "USDG") {
-    if (chainId !== BigInt(HOOD_CHAIN_ID)) {
-      return {
-        usage: `USDG is named on Hood (chain id ${HOOD_CHAIN_ID}) only; this RPC answered chain id ${chainId}. Name the token by its contract address.`
-      };
-    }
-    token = toChecksumAddress(HOOD_USDG_ADDRESS);
-  } else {
-    const checked = checkEvmAddress(asset);
-    if (!checked.ok)
-      return {
-        usage: `--asset must be ETH, USDG (on Hood), or an ERC-20 contract address: ${asset} is ${checked.reason}.`
-      };
-    token = checked.address;
+  const flags = parsed.values;
+  const id = flags["--client-trade-id"] ?? `swap-${randomUUID()}`;
+  const slippage = Number(flags["--slippage-bps"] ?? "50");
+  if (parsed.positionals.length !== 2 || Boolean(flags["--amount"]) === Boolean(flags["--percent"]) || !validClientId(id) || !Number.isInteger(slippage) || slippage < 0 || slippage > 1e4) {
+    writeUsageFailure(ctx.deps, "Usage: candle swap <from> <to> --amount <decimal> | --percent <n> [--wallet <tee-or-embedded>] [--to <tee>] [--wait] [--client-trade-id <id>] [--slippage-bps 50] [--rpc-url <url>] [--yes]. Solana: SOL, USDC, CNDL or a mint. Hood: ETH, USDG or a 0x token. SOL or USDC to ETH or USDG, or back, is a bridge between two TEE wallets.", ctx.json);
+    return 2;
   }
-  let decimals;
   try {
-    decimals = await rpc.erc20Decimals(token);
-  } catch (error) {
-    throw refuse2("EVM_TOKEN_UNREADABLE", `${token} did not answer decimals(): ${error instanceof Error ? error.message : String(error)}`, { suggestion: "Nothing was signed. Check the contract address, and that this RPC serves the chain it lives on." });
-  }
-  const symbol = upper === "USDG" ? "USDG" : await rpc.erc20Symbol(token) ?? `${token.slice(0, 10)}…`;
-  return { kind: "erc20", symbol, decimals, token };
-}
-function nativeName(hood, chainId) {
-  return hood ? "ETH" : `ETH on chain ${chainId}`;
-}
-function evmDisplayLines(plan) {
-  const { tx, asset, hood, chainId } = plan;
-  const native = nativeName(hood, chainId);
-  const lines = [
-    `chain       ${chainId}${hood ? " (Hood)" : ""}`,
-    `from        ${plan.from.label}  ${plan.from.address}`
-  ];
-  if (asset.kind === "native") {
-    lines.push(`to          ${tx.to}`);
-    lines.push(`amount      ${plan.amount} ${native} = ${plan.amountRaw} wei`);
-  } else {
-    lines.push(`to          ${tx.to}  (the ${asset.symbol} contract, ${asset.decimals} dp)`);
-    lines.push(`recipient   ${plan.recipient}  (decoded from transfer(address,uint256))`);
-    lines.push(`amount      ${plan.amount} ${asset.symbol} = ${plan.amountRaw} raw`);
-  }
-  lines.push(`gas limit   ${tx.gas}`);
-  lines.push(`max fee     ${tx.maxFeePerGas} wei/gas (priority ${tx.maxPriorityFeePerGas} wei/gas)`);
-  lines.push(`fee cap     ${formatUnits(plan.feeCap, NATIVE_DECIMALS)} ${native} (gas × max fee)`);
-  lines.push(`nonce       ${tx.nonce}`);
-  return lines;
-}
-async function planEvmTransfer(rpc, input) {
-  const to = checkEvmDestination(input.to, input.from);
-  const chainId = await rpc.chainId();
-  if (input.builtIn && chainId !== BigInt(HOOD_CHAIN_ID)) {
-    throw refuse2("EVM_CHAIN_MISMATCH", `The built-in Hood RPC answered chain id ${chainId}, not ${HOOD_CHAIN_ID}.`, {
-      suggestion: "Nothing was signed. Pass --rpc-url for another chain; the built-in endpoint is Hood's only."
-    });
-  }
-  const hood = chainId === BigInt(HOOD_CHAIN_ID);
-  const asset = await resolveEvmAsset(rpc, input.asset, chainId);
-  if ("usage" in asset)
-    return asset;
-  const max = input.amount.toLowerCase() === "max";
-  if (asset.kind === "erc20" && asset.token !== undefined && sameEvmAddress(to, asset.token)) {
-    throw refuse2("EVM_RECIPIENT_IS_TOKEN", `${to} is the ${asset.symbol} contract itself; sending it its own tokens is a loss.`);
-  }
-  let amountRaw = 0n;
-  if (!max) {
-    const parsed = parseUnits(input.amount, asset.decimals);
-    if (!parsed.ok && parsed.reason === "precision") {
-      throw refuse2("EVM_AMOUNT_PRECISION", `${input.amount} has more decimal places than ${asset.symbol}'s ${asset.decimals}.`);
-    }
-    if (!parsed.ok)
-      return { usage: `--amount must be a positive decimal or max; ${input.amount} is neither.` };
-    amountRaw = parsed.raw;
-  }
-  const nonce = await rpc.getTransactionCount(input.from.address, "pending");
-  const fees = await quoteFees(rpc);
-  const nativeBalance = await rpc.getBalance(input.from.address);
-  if (asset.kind === "erc20" && asset.token !== undefined) {
-    if (max) {
-      amountRaw = await rpc.erc20BalanceOf(asset.token, input.from.address);
-      if (amountRaw === 0n) {
-        throw new VaultError("VAULT_INDEX_INVALID", `${input.from.label} holds no ${asset.symbol}; there is nothing to send.`);
-      }
-    }
-    const draft2 = buildErc20Transfer({
-      chainId,
-      nonce,
-      maxPriorityFeePerGas: fees.maxPriorityFeePerGas,
-      maxFeePerGas: fees.maxFeePerGas,
-      gas: 0n,
-      token: asset.token,
+    const fromAsset = classifyAsset(parsed.positionals[0]);
+    const toAsset = classifyAsset(parsed.positionals[1]);
+    const bridge = bridgePair(fromAsset, toAsset);
+    if (bridge)
+      return await bridgeSwap(ctx, {
+        flags,
+        yes: parsed.booleans.has("--yes"),
+        wait: parsed.booleans.has("--wait"),
+        id,
+        slippage,
+        ...bridge
+      });
+    if (flags["--to"] !== undefined || parsed.booleans.has("--wait"))
+      throw new TradingUsage("--to and --wait are for a bridge: SOL or USDC to ETH or USDG, or back.");
+    const chain2 = pairChain(fromAsset, toAsset);
+    const walletFlag = flags["--wallet"];
+    const named = walletFlag === undefined ? undefined : walletNameChain(walletFlag);
+    if (named !== undefined && named !== chain2)
+      throw chainMismatch(`--wallet ${safeText(walletFlag)}`, named, chain2);
+    if (chain2 === "hood")
+      return await hoodSwap(ctx, {
+        flags,
+        yes: parsed.booleans.has("--yes"),
+        id,
+        slippage,
+        from: fromAsset,
+        to: toAsset
+      });
+    const from = fromAsset.asset;
+    const to = toAsset.asset;
+    if (from === to)
+      throw new TradingError("PAIR_UNSUPPORTED", "Choose two distinct assets.");
+    const fromBase = baseAsset(from);
+    const toBase = baseAsset(to);
+    if (!fromBase && !toBase)
+      throw new TradingError("PAIR_UNSUPPORTED", "A token trade must have SOL, USDC or CNDL on one side; token-to-token routing is unavailable.");
+    if (flags["--amount"])
+      rawAmount(flags["--amount"], 18);
+    const percent = flags["--percent"] ? BigInt(rawAmount(flags["--percent"], 6)) : undefined;
+    if (percent !== undefined && percent > 100000000n)
+      throw new TradingError("INVALID_AMOUNT", "Percent must be greater than 0 and at most 100 (up to six decimal places).");
+    const kind = fromBase && toBase ? "swap" : "trade";
+    const key = await tradingKey(ctx);
+    const prior = await lookupOperation(ctx, key, id, kind);
+    if (prior)
+      return printTradingResult(ctx, prior);
+    const payerWallet = await tradingPayer(ctx, key, flags["--wallet"]);
+    if (payerWallet.kind === "embedded" && kind === "swap")
+      throw new TradingError("PAIR_UNSUPPORTED", "The embedded wallet cannot swap between base assets from this command yet: that rail executes in one call, so there would be nothing to confirm. Trade a token with it, or name a TEE wallet for a base pair.");
+    const wallet = payerWallet.kind === "tee" ? payerWallet.wallet : { address: payerWallet.address };
+    const solana = lazySolanaClient(ctx, flags["--rpc-url"]);
+    const decimals = await decimalsFor(ctx, from, solana);
+    const outDecimals = await decimalsFor(ctx, to, solana);
+    let amountRaw;
+    if (percent !== undefined) {
+      const reader = await solana();
+      let balance;
+      if (from === "SOL")
+        balance = await tradingRead(ctx, reader, () => reader.rpc.getBalance(wallet.address));
+      else {
+        const mint = BASES[from]?.mint ?? from;
+        const accounts = (await tradingRead(ctx, reader, () => Promise.all([
+          reader.rpc.getTokenAccountsByOwner(wallet.address, TOKEN_PROGRAM_ID),
+          reader.rpc.getTokenAccountsByOwner(wallet.address, TOKEN_2022_PROGRAM_ID)
+        ]))).flat();
+        balance = accounts.filter((account) => account.mint === mint).reduce((sum, account) => sum + BigInt(account.amountRaw), 0n);
+      }
+      amountRaw = (balance * percent / 100000000n).toString();
+      if (amountRaw === "0")
+        throw new TradingError("INVALID_AMOUNT", "The selected percentage rounds to zero raw units.");
+    } else
+      amountRaw = rawAmount(flags["--amount"], decimals);
+    if (BigInt(amountRaw) > BigInt(Number.MAX_SAFE_INTEGER))
+      throw new TradingError("INVALID_AMOUNT", "Amount exceeds the venue's exact integer range.");
+    if (payerWallet.kind === "embedded")
+      await assertDeferredExecuteSupported(ctx, key, id);
+    if (!await claimOperation(ctx, key, id, kind))
+      throw new TradingError("OPERATION_ALREADY_STARTED", "This machine already started this id; no write was resent.");
+    ctx.deps.stderr.write(`Operation: ${id}
+`);
+    const payer = payerWallet.kind === "tee" ? { type: "linked", linkedWalletId: payerWallet.wallet.id } : { type: "main" };
+    const built = kind === "swap" ? await request(ctx, key, "/api/v1/agent/swap/build", {
+      clientTradeId: id,
+      from,
+      to,
+      amountRaw,
+      maxSlippageBps: slippage,
+      payer
+    }) : await request(ctx, key, "/api/v1/trade/agent/build", {
+      clientTradeId: id,
+      chain: "solana",
+      mint: fromBase ? to : from,
+      side: fromBase ? "buy" : "sell",
+      quoteAsset: (fromBase ?? toBase)?.toLowerCase(),
+      amountRaw,
+      maxSlippageBps: slippage,
+      payer,
+      ...payerWallet.kind === "embedded" ? { deferExecution: true } : {}
+    });
+    if (built.job || built.status === "executed")
+      return printTradingResult(ctx, { ...built, clientTradeId: id, kind });
+    const data = swapBuildSchema.parse(kind === "swap" ? built.payload : built);
+    if (kind === "swap" && (data.venue !== "jupiter" || data.recipient !== wallet.address))
+      throw new TradingError("INVALID_RESPONSE", "A TEE base swap must use Jupiter and return to its payer.");
+    if (kind === "trade" && (built.chain !== "solana" || built.walletAddress !== wallet.address))
+      throw new TradingError("INVALID_RESPONSE", "The token build does not name the requested Solana payer.");
+    const artifacts = kind === "swap" ? { ...data, transactionBase64: undefined, quoteSource: undefined, quoteAsset: undefined } : data.artifacts;
+    if (!artifacts)
+      throw new TradingError("INVALID_RESPONSE", "Missing quote artifacts.");
+    if (kind === "trade" && artifacts.quoteAsset !== (fromBase ?? toBase)?.toLowerCase())
+      throw new TradingError("PAIR_UNSUPPORTED", `This token settles in ${artifacts.quoteAsset ?? "an unknown asset"}, not the requested pair. Nothing was signed.`);
+    if (data?.status !== "built" || typeof data.minOutRaw !== "string" || !/^\d+$/.test(data.minOutRaw) || !data.fee || !Number.isFinite(data.fee.bps))
+      throw new TradingError("INVALID_RESPONSE", "Candle did not return a complete quote; nothing was signed.");
+    const minimumRaw = !fromBase && artifacts.venue === "curve" ? (BigInt(data.minOutRaw) > BigInt(data.fee.feeRaw) ? BigInt(data.minOutRaw) - BigInt(data.fee.feeRaw) : 0n).toString() : data.minOutRaw;
+    const quote = {
+      intent: `Swap ${decimalAmount(amountRaw, decimals)} ${from} to ${to}`,
+      wallet: wallet.address,
+      venue: artifacts.quoteSource ?? artifacts.venue,
+      priceImpactPct: artifacts.priceImpactPct ?? null,
+      fee: data.fee,
+      minimumReceived: `${decimalAmount(minimumRaw, outDecimals)} ${to}`,
+      minOutRaw: data.minOutRaw,
+      minimumReceivedRaw: minimumRaw,
+      tokenRisks: artifacts.tokenRisks ?? []
+    };
+    if (!await confirmQuote(ctx, quote, parsed.booleans.has("--yes")))
+      return printTradingResult(ctx, { success: true, status: "cancelled", clientTradeId: id, kind, quote });
+    if (!Number.isFinite(data.expiresAt) || data.expiresAt <= ctx.deps.now())
+      throw new TradingError("QUOTE_EXPIRED", "The quote expired before signing. Start a new intention with a new id.");
+    if (payerWallet.kind === "embedded") {
+      const executed = await request(ctx, key, "/api/v1/trade/agent/execute", { clientTradeId: id });
+      return printTradingResult(ctx, {
+        ...executed,
+        clientTradeId: id,
+        kind,
+        quote,
+        wallet: safeText(payerWallet.address)
+      });
+    }
+    const transaction = kind === "swap" ? data.transactionsBase64?.[0] : artifacts.transactionBase64;
+    if (kind === "swap" && data.transactionsBase64?.length !== 1)
+      throw new TradingError("INVALID_RESPONSE", "A TEE swap must contain exactly one same-chain transaction.");
+    if (!transaction)
+      throw new TradingError("INVALID_RESPONSE", "Missing transaction.");
+    const signed = await relaySign(ctx, key, payerWallet.wallet, transaction);
+    const result = kind === "swap" ? await request(ctx, key, "/api/v1/agent/swap/submit", {
+      clientTradeId: id,
+      swapId: data.swapId,
+      signedTransactionsBase64: [signed]
+    }) : await request(ctx, key, "/api/v1/trade/agent/submit", { clientTradeId: id, signedTransactions: [signed] });
+    const settled = kind === "swap" ? reportSettlement(ctx, result.payload?.settlement, { asset: to, decimals: outDecimals }, id) : {};
+    return printTradingResult(ctx, {
+      ...result,
+      clientTradeId: id,
+      kind,
+      quote,
+      wallet: safeText(wallet.address),
+      ...settled
+    });
+  } catch (error) {
+    return tradingFailure(ctx, error, id);
+  }
+}
+function lazyEvmRpc(ctx, flag) {
+  let rpc;
+  return () => {
+    if (rpc)
+      return rpc;
+    const resolved = resolveEvmRpcUrl(flag, ctx.deps.env[EVM_RPC_URL_ENV], "--rpc-url");
+    if ("error" in resolved)
+      throw new TradingUsage(resolved.error);
+    ctx.deps.stderr.write(`Reading from ${rpcHostOf2(resolved.url)} (Hood RPC; reads only, nothing is sent there)
+`);
+    rpc = createEvmRpc(resolved.url, ctx.deps.fetch);
+    return rpc;
+  };
+}
+async function evmRead(what, read) {
+  try {
+    return await read();
+  } catch (error) {
+    if (error instanceof TradingError || error instanceof TradingUsage)
+      throw error;
+    throw new TradingError("RPC_FAILED", `Reading ${what} over the Hood RPC failed; nothing was built or signed.`);
+  }
+}
+async function hoodDecimals(asset, rpc) {
+  const base = asset.base ? HOOD_BASES[asset.base] : undefined;
+  if (base)
+    return base.decimals;
+  const decimals = await evmRead(`${asset.asset} decimals()`, () => rpc().erc20Decimals(asset.asset));
+  if (decimals > 36)
+    throw new TradingError("INVALID_RESPONSE", "The token's decimals() is out of range.");
+  return decimals;
+}
+async function recordTradedToken(ctx, wallet, token) {
+  const skipped = (reason) => `Notice: the sealed EVM record was not updated for ${token} (${reason}). The leg landed. A later sweep still finds this token with --token ${token}, or with --from-block.`;
+  const append = ctx.deps.appendEvmRecord;
+  let notice;
+  if (!append)
+    notice = skipped("this CLI build has no sealed EVM record writer");
+  else {
+    try {
+      const outcome = await append(ctx, { kind: "token", wallet: toChecksumAddress(wallet), token });
+      notice = outcome.appended ? outcome.notice : skipped(outcome.notice);
+    } catch (error) {
+      notice = skipped(error instanceof Error ? error.message : "the append failed");
+    }
+  }
+  if (notice)
+    ctx.deps.stderr.write(`${safeText(notice)}
+`);
+  return notice;
+}
+function describeHoodLegs(first, hasFee, primary = "trade") {
+  const kinds = plannedLegKinds(first.legKind, first.plannedLegCount, hasFee, primary);
+  const names = {
+    approval: "approve",
+    permit2Approval: "Permit2 approve",
+    trade: "trade",
+    feeTransfer: "fee",
+    bridgeDeposit: "bridge deposit"
+  };
+  return kinds ? kinds.map((kind) => names[kind] ?? kind) : [`${first.plannedLegCount} legs, starting with ${names[first.legKind] ?? first.legKind}`];
+}
+async function hoodSwap(ctx, args) {
+  const { flags, id, from, to } = args;
+  if (from.asset === to.asset)
+    throw new TradingError("PAIR_UNSUPPORTED", "Choose two distinct assets.");
+  if (!from.base && !to.base)
+    throw new TradingError("PAIR_UNSUPPORTED", "A Hood token trade must have ETH or USDG on one side; token-to-token routing is unavailable.");
+  if (flags["--amount"])
+    rawAmount(flags["--amount"], 18);
+  const percent = flags["--percent"] ? BigInt(rawAmount(flags["--percent"], 6)) : undefined;
+  if (percent !== undefined && percent > 100000000n)
+    throw new TradingError("INVALID_AMOUNT", "Percent must be greater than 0 and at most 100 (up to six decimal places).");
+  const kind = from.base && to.base ? "swap" : "trade";
+  const key = await tradingKey(ctx);
+  const prior = await lookupOperation(ctx, key, id, kind);
+  if (prior)
+    return printTradingResult(ctx, prior);
+  const payer = await tradingPayer(ctx, key, flags["--wallet"], "swap:write", "hood");
+  if (payer.kind === "embedded" && kind === "swap")
+    throw new TradingError("PAIR_UNSUPPORTED", "The embedded wallet cannot swap ETH and USDG from this command: that rail executes in one call, so there would be nothing to confirm. Trade a token with it, or name a Hood TEE wallet.");
+  const payerAddress = payer.kind === "tee" ? payer.wallet.address : payer.address;
+  const rpc = lazyEvmRpc(ctx, flags["--rpc-url"]);
+  const decimals = await hoodDecimals(from, rpc);
+  const outDecimals = await hoodDecimals(to, rpc);
+  let amountRaw;
+  if (percent !== undefined) {
+    const balance = from.asset === "ETH" ? await evmRead("the ETH balance", () => rpc().getBalance(payerAddress)) : await evmRead(`the ${from.asset} balance`, () => rpc().erc20BalanceOf(from.asset === "USDG" ? HOOD_USDG_ADDRESS : from.asset, payerAddress));
+    amountRaw = (balance * percent / 100000000n).toString();
+    if (amountRaw === "0")
+      throw new TradingError("INVALID_AMOUNT", "The selected percentage rounds to zero raw units.");
+  } else
+    amountRaw = rawAmount(flags["--amount"], decimals);
+  if (payer.kind === "embedded")
+    await assertDeferredExecuteSupported(ctx, key, id);
+  if (!await claimOperation(ctx, key, id, kind))
+    throw new TradingError("OPERATION_ALREADY_STARTED", "This machine already started this id; no write was resent.");
+  ctx.deps.stderr.write(`Operation: ${id}
+`);
+  const payerBody = payer.kind === "tee" ? { type: "linked", linkedWalletId: payer.wallet.id } : { type: "main" };
+  const base = from.base ?? to.base;
+  const token = from.base ? to.asset : from.asset;
+  const built = kind === "swap" ? await request(ctx, key, "/api/v1/agent/swap/build", {
+    clientTradeId: id,
+    from: from.asset,
+    to: to.asset,
+    amountRaw,
+    maxSlippageBps: args.slippage,
+    payer: payerBody
+  }) : await request(ctx, key, "/api/v1/trade/agent/build", {
+    clientTradeId: id,
+    chain: "hood",
+    mint: token,
+    side: from.base ? "buy" : "sell",
+    quoteAsset: base.toLowerCase(),
+    amountRaw,
+    maxSlippageBps: args.slippage,
+    payer: payerBody,
+    ...payer.kind === "embedded" ? { deferExecution: true } : {}
+  });
+  if (built.job || built.status === "executed")
+    return printTradingResult(ctx, { ...built, clientTradeId: id, kind });
+  const body = kind === "swap" ? built.payload : built;
+  const data = swapBuildSchema.parse(body);
+  const echoed = kind === "swap" ? body?.recipient : body?.walletAddress;
+  if (body?.chain !== "hood" || typeof echoed !== "string" || echoed.toLowerCase() !== payerAddress.toLowerCase())
+    throw new TradingError("INVALID_RESPONSE", "The Hood build does not name the requested payer; nothing was signed.");
+  const artifacts = kind === "swap" ? { ...data, quoteAsset: undefined, quoteSource: undefined } : data.artifacts;
+  if (!artifacts)
+    throw new TradingError("INVALID_RESPONSE", "Missing quote artifacts.");
+  if (kind === "trade" && artifacts.quoteAsset !== base.toLowerCase())
+    throw new TradingError("PAIR_UNSUPPORTED", `This token settles in ${artifacts.quoteAsset ?? "an unknown asset"}, not ${base}. Nothing was signed.`);
+  let sequenced;
+  if (payer.kind === "tee") {
+    const parsed = sequencedSchema.safeParse(body);
+    if (!parsed.success)
+      throw new TradingError("SEQUENCED_RAIL_REQUIRED", "A Hood TEE wallet trades one leg at a time, and this Candle deployment did not answer with a sequenced leg. Nothing was signed.");
+    sequenced = parsed.data;
+  }
+  const minimumRaw = !from.base && artifacts.venue === "curve" ? (BigInt(data.minOutRaw) > BigInt(data.fee.feeRaw) ? BigInt(data.minOutRaw) - BigInt(data.fee.feeRaw) : 0n).toString() : data.minOutRaw;
+  const quote = {
+    intent: `Swap ${decimalAmount(amountRaw, decimals)} ${from.asset} to ${to.asset} on Hood`,
+    wallet: payerAddress,
+    venue: artifacts.quoteSource ?? artifacts.venue,
+    priceImpactPct: artifacts.priceImpactPct ?? null,
+    fee: data.fee,
+    minimumReceived: `${decimalAmount(minimumRaw, outDecimals)} ${to.asset}`,
+    minOutRaw: data.minOutRaw,
+    minimumReceivedRaw: minimumRaw,
+    tokenRisks: artifacts.tokenRisks ?? []
+  };
+  if (sequenced) {
+    const leg = sequenced.nextLeg;
+    const maxFee = BigInt(leg.maxFeePerGas);
+    const reserve = sweepReserveFloor(maxFee, kind === "trade" ? [token] : []);
+    quote.legs = describeHoodLegs(sequenced, BigInt(data.fee.feeRaw) > 0n);
+    quote.gas = `the ${sequenced.legKind} leg up to ${formatUnits(BigInt(leg.gas) * maxFee, 18)} ETH (gas ${leg.gas} at ${formatUnits(maxFee, 9)} gwei); each later leg is priced by Candle when it becomes next`;
+    quote.reserve = `at least ${formatUnits(reserve.wei, 18)} ETH stays in the wallet for a sweep home (${reserve.erc20Transfers} ERC-20 transfers and the final ETH transfer at twice the fee); a trade never spends it`;
+    quote.operationId = sequenced.operationId;
+  }
+  if (!await confirmQuote(ctx, quote, args.yes)) {
+    if (sequenced)
+      ctx.deps.stderr.write(`Nothing was signed. Operation ${sequenced.operationId} holds this wallet until ${new Date(sequenced.expiresAt).toISOString()}; a new Hood trade from it is refused as WALLET_BUSY until then.
+`);
+    return printTradingResult(ctx, {
+      success: true,
+      status: "cancelled",
+      clientTradeId: id,
+      kind,
+      quote,
+      ...sequenced ? { operationId: sequenced.operationId, walletHeldUntil: sequenced.expiresAt } : {}
+    });
+  }
+  if (!Number.isFinite(data.expiresAt) || data.expiresAt <= ctx.deps.now())
+    throw new TradingError("QUOTE_EXPIRED", "The quote expired before signing. Start a new intention with a new id.");
+  if (payer.kind === "embedded") {
+    const executed = await request(ctx, key, "/api/v1/trade/agent/execute", { clientTradeId: id });
+    return printTradingResult(ctx, { ...executed, clientTradeId: id, kind, quote, wallet: safeText(payerAddress) });
+  }
+  const wallet = payer.wallet;
+  if (wallet.chain !== "evm" || !sequenced)
+    throw chainMismatch(`TEE wallet ${wallet.id}`, wallet.chain === "evm" ? "hood" : "solana", "hood");
+  const recorded = kind === "trade" ? token : HOOD_USDG_ADDRESS;
+  const notices = [];
+  const run = await runSequencedLegs(ctx, key, {
+    wallet,
+    first: sequenced,
+    submitPath: kind === "swap" ? "/api/v1/agent/swap/submit" : "/api/v1/trade/agent/submit",
+    submitFields: kind === "swap" ? { clientTradeId: id, swapId: data.swapId } : { clientTradeId: id },
+    unwrap: (answer) => kind === "swap" ? answer.payload ?? {} : answer,
+    clientId: id,
+    kind,
+    allowedLegs: HOOD_TRADE_LEGS,
+    onLanded: async (_leg) => {
+      const notice = await recordTradedToken(ctx, wallet.address, toChecksumAddress(recorded));
+      if (notice)
+        notices.push(notice);
+    }
+  });
+  const settled = kind === "swap" ? reportSettlement(ctx, run.final.settlement, { asset: to.asset, decimals: outDecimals }, id) : {};
+  return printTradingResult(ctx, {
+    ...run.final,
+    ...settled,
+    clientTradeId: id,
+    kind,
+    chain: "hood",
+    quote,
+    wallet: safeText(wallet.address),
+    operationId: sequenced.operationId,
+    landedLegs: run.landed,
+    evmRecord: { token: toChecksumAddress(recorded), notices }
+  });
+}
+async function bridgeOriginBalance(ctx, from, address, solana, evm) {
+  if (from === "ETH")
+    return evmRead("the ETH balance", () => evm().getBalance(address));
+  if (from === "USDG")
+    return evmRead("the USDG balance", () => evm().erc20BalanceOf(HOOD_USDG_ADDRESS, address));
+  const reader = await solana();
+  if (from === "SOL")
+    return tradingRead(ctx, reader, () => reader.rpc.getBalance(address));
+  const mint = BASES.USDC?.mint;
+  const accounts = (await tradingRead(ctx, reader, () => Promise.all([
+    reader.rpc.getTokenAccountsByOwner(address, TOKEN_PROGRAM_ID),
+    reader.rpc.getTokenAccountsByOwner(address, TOKEN_2022_PROGRAM_ID)
+  ]))).flat();
+  return accounts.filter((account) => account.mint === mint).reduce((sum, account) => sum + BigInt(account.amountRaw), 0n);
+}
+async function bridgeSwap(ctx, args) {
+  const { flags, id, from, to } = args;
+  const origin = BRIDGE_ASSETS[from].chain;
+  const destination = BRIDGE_ASSETS[to].chain;
+  const walletFlag = flags["--wallet"];
+  const named = walletFlag === undefined ? undefined : walletNameChain(walletFlag);
+  if (named !== undefined && named !== origin)
+    throw chainMismatch(`--wallet ${safeText(walletFlag)}`, named, origin);
+  if (flags["--amount"])
+    rawAmount(flags["--amount"], 18);
+  const percent = flags["--percent"] ? BigInt(rawAmount(flags["--percent"], 6)) : undefined;
+  if (percent !== undefined && percent > 100000000n)
+    throw new TradingError("INVALID_AMOUNT", "Percent must be greater than 0 and at most 100 (up to six decimal places).");
+  const key = await tradingKey(ctx);
+  const prior = await lookupOperation(ctx, key, id, "swap");
+  if (prior)
+    return printTradingResult(ctx, {
+      ...prior,
+      ...bridgeStatusField(ctx, prior, bridgeFactsOf((await savedOperation(ctx, key, id))?.bridge))
+    });
+  const payer = await tradingPayer(ctx, key, walletFlag, "swap:write", origin);
+  if (payer.kind !== "tee")
+    throw new TradingError("CHAIN_MISMATCH", `Only a TEE wallet bridges, and the embedded wallet ${safeText(payer.address)} is not one. Name a ${chainName(origin)} TEE wallet with --wallet. Nothing was built.`);
+  const wallet = payer.wallet;
+  const { rows } = await listTradingWallets(ctx, key, "swap:write");
+  const onDestination = rows.filter((row) => rowChain(row) === destination);
+  const toFlag = flags["--to"];
+  let toWalletId;
+  let candidates = onDestination.filter((row) => row.active);
+  if (toFlag !== undefined) {
+    const matches = rows.filter((row) => matchesName(row, toFlag));
+    const match = matches[0];
+    if (matches.length > 1)
+      throw new TradingError("TEE_WALLET_REQUIRED", `"${safeText(toFlag)}" matches ${matches.length} TEE wallets on this key: ${matches.map(describeWallet).join("; ")}. Name one by id or address.`);
+    if (!match || rowChain(match) !== destination)
+      throw new TradingError("BRIDGE_DESTINATION_MISSING", `--to ${safeText(toFlag)} is not a ${chainName(destination)} TEE wallet on this key. A bridge lands only in this key's own TEE wallet on ${chainName(destination)}${onDestination.length > 0 ? `: ${onDestination.map(describeWallet).join("; ")}` : ""}. Nothing was built.`);
+    if (!match.active)
+      throw new TradingError("TEE_WALLET_INACTIVE", `The destination ${describeWallet(match)} is not a verified-active TEE wallet. Nothing was built.`);
+    toWalletId = match.id;
+    candidates = [match];
+  } else if (candidates.length !== 1) {
+    throw new TradingError("BRIDGE_DESTINATION_MISSING", candidates.length === 0 ? `This key has no active ${chainName(destination)} TEE wallet to bridge into. Promote one onto this key (candle vault promote), then bridge. Nothing was built.` : `This key has more than one ${chainName(destination)} TEE wallet; name the destination with --to: ${candidates.map(describeWallet).join("; ")}. Nothing was built.`);
+  }
+  const solana = lazySolanaClient(ctx, flags["--rpc-url"]);
+  const evm = lazyEvmRpc(ctx, flags["--rpc-url"]);
+  const decimals = BRIDGE_ASSETS[from].decimals;
+  let amountRaw;
+  if (percent !== undefined) {
+    const balance = await bridgeOriginBalance(ctx, from, wallet.address, solana, evm);
+    amountRaw = (balance * percent / 100000000n).toString();
+    if (amountRaw === "0")
+      throw new TradingError("INVALID_AMOUNT", "The selected percentage rounds to zero raw units.");
+  } else
+    amountRaw = rawAmount(flags["--amount"], decimals);
+  if (!await claimOperation(ctx, key, id, "swap"))
+    throw new TradingError("OPERATION_ALREADY_STARTED", "This machine already started this id; no write was resent.");
+  ctx.deps.stderr.write(`Operation: ${id}
+`);
+  const built = await request(ctx, key, "/api/v1/agent/swap/build", {
+    clientTradeId: id,
+    from,
+    to,
+    amountRaw,
+    maxSlippageBps: args.slippage,
+    payer: { type: "linked", linkedWalletId: wallet.id },
+    ...toWalletId !== undefined ? { toWalletId } : {}
+  });
+  if (built.job || built.status === "executed")
+    return printTradingResult(ctx, { ...built, clientTradeId: id, kind: "swap" });
+  const body = built.payload ?? {};
+  const parsedBuild = bridgeBuildSchema.safeParse(body);
+  if (!parsedBuild.success)
+    throw new TradingError("INVALID_RESPONSE", "Candle did not return a complete bridge quote; nothing was signed.");
+  const data = parsedBuild.data;
+  if (data.venue !== "relay")
+    throw new TradingError("INVALID_RESPONSE", `A bridge goes through Relay, not ${safeText(data.venue)}; nothing was signed.`);
+  if (data.fee.bps !== 0 || data.fee.feeRaw !== "0")
+    throw new TradingError("INVALID_RESPONSE", "A bridge carries no Candle fee, and this quote has one; nothing was signed.");
+  const recipient = candidates.find((row) => destination === "hood" ? sameEvmAddress(row.address, data.recipient) : row.address === data.recipient);
+  if (!recipient)
+    throw new TradingError("INVALID_RESPONSE", `Candle named ${safeText(data.recipient)} as the destination, which is not ${toWalletId !== undefined ? "the TEE wallet --to named" : `this key's ${chainName(destination)} TEE wallet`}; nothing was signed.`);
+  const facts = {
+    from,
+    to,
+    recipient: recipient.address,
+    ...data.statusChecks[0] !== undefined ? { statusCheck: data.statusChecks[0] } : {}
+  };
+  await saveOperationBridge(ctx, key, id, { ...facts });
+  const refused = (problem) => new TradingError("RELAY_STEP_REFUSED", `Relay's deposit did not pass this machine's check (${problem}); nothing was signed.`);
+  let sequenced;
+  let transaction;
+  const hoodOrigin = from === "ETH" || from === "USDG" ? from : undefined;
+  if (hoodOrigin) {
+    const parsedLeg = sequencedSchema.safeParse(body);
+    if (!parsedLeg.success)
+      throw new TradingError("SEQUENCED_RAIL_REQUIRED", "A Hood TEE wallet bridges one leg at a time, and this Candle deployment did not answer with a sequenced leg. Nothing was signed.");
+    sequenced = parsedLeg.data;
+    if (typeof data.walletAddress !== "string" || !sameEvmAddress(data.walletAddress, wallet.address))
+      throw new TradingError("INVALID_RESPONSE", "The Hood build does not name the requested payer; nothing was signed.");
+    const plan = plannedLegKinds(sequenced.legKind, sequenced.plannedLegCount, false, "bridgeDeposit");
+    if (!bridgePlanAdmitted(hoodOrigin, plan))
+      throw refused(`the plan is ${sequenced.plannedLegCount} leg(s) starting with ${sequenced.legKind}`);
+    const problem = relayHoodLegProblem(sequenced.legKind, sequenced.nextLeg, {
+      origin: hoodOrigin,
+      payer: wallet.address,
+      amountRaw
+    });
+    if (problem)
+      throw refused(problem);
+  } else {
+    if (data.transactionsBase64?.length !== 1)
+      throw refused(`Candle returned ${data.transactionsBase64?.length ?? 0} transactions, not one deposit`);
+    transaction = data.transactionsBase64[0];
+    const reader = await solana();
+    const problem = await tradingRead(ctx, reader, () => relaySolanaDepositProblem(transaction, wallet.address, reader.rpc));
+    if (problem)
+      throw refused(problem);
+  }
+  const outDecimals = BRIDGE_ASSETS[to].decimals;
+  const minimumRaw = (BigInt(data.expectedOutRaw) * BigInt(1e4 - args.slippage) / 10000n).toString();
+  const quote = {
+    intent: `Bridge ${decimalAmount(amountRaw, decimals)} ${from} on ${chainName(origin)} to ${to} on ${chainName(destination)}`,
+    wallet: wallet.address,
+    venue: "relay",
+    priceImpactPct: null,
+    minimumReceived: `${decimalAmount(minimumRaw, outDecimals)} ${to} (Relay's estimate ${decimalAmount(data.expectedOutRaw, outDecimals)} ${to}, less the ${args.slippage} bps slippage bound)`,
+    minimumReceivedRaw: minimumRaw,
+    expectedOutRaw: data.expectedOutRaw,
+    destination: `${recipient.label ? `${recipient.label} ` : ""}${recipient.address} (${chainName(destination)} TEE wallet on this key)`,
+    candleFee: "none",
+    relayFees: data.venueCostUsd !== undefined ? `about $${data.venueCostUsd} as Relay reports it` : "not reported",
+    estimatedTime: data.venueTimeEstimateSec !== undefined ? `about ${data.venueTimeEstimateSec}s as Relay reports it` : "not reported",
+    tokenRisks: []
+  };
+  if (sequenced) {
+    const leg = sequenced.nextLeg;
+    const maxFee = BigInt(leg.maxFeePerGas);
+    const reserve = sweepReserveFloor(maxFee, []);
+    quote.legs = describeHoodLegs(sequenced, false, "bridgeDeposit");
+    quote.gas = `the ${sequenced.legKind} leg up to ${formatUnits(BigInt(leg.gas) * maxFee, 18)} ETH (gas ${leg.gas} at ${formatUnits(maxFee, 9)} gwei); each later leg is priced by Candle when it becomes next`;
+    quote.reserve = `at least ${formatUnits(reserve.wei, 18)} ETH stays in the wallet for a sweep home (${reserve.erc20Transfers} ERC-20 transfers and the final ETH transfer at twice the fee); a bridge never spends it`;
+    quote.operationId = sequenced.operationId;
+  }
+  if (!await confirmQuote(ctx, quote, args.yes)) {
+    if (sequenced)
+      ctx.deps.stderr.write(`Nothing was signed. Operation ${sequenced.operationId} holds this wallet until ${new Date(sequenced.expiresAt).toISOString()}; a new Hood trade or sweep from it waits until then.
+`);
+    return printTradingResult(ctx, {
+      success: true,
+      status: "cancelled",
+      clientTradeId: id,
+      kind: "swap",
+      quote,
+      ...sequenced ? { operationId: sequenced.operationId, walletHeldUntil: sequenced.expiresAt } : {}
+    });
+  }
+  if (!Number.isFinite(data.expiresAt) || data.expiresAt <= ctx.deps.now())
+    throw new TradingError("QUOTE_EXPIRED", "The quote expired before signing. Start a new intention with a new id.");
+  let result;
+  let depositHash;
+  if (sequenced && hoodOrigin) {
+    const run = await runSequencedLegs(ctx, key, {
+      wallet,
+      first: sequenced,
+      submitPath: "/api/v1/agent/swap/submit",
+      submitFields: { clientTradeId: id, swapId: data.swapId },
+      unwrap: (answer) => answer.payload ?? {},
+      clientId: id,
+      kind: "swap",
+      primaryLeg: "bridgeDeposit",
+      allowedLegs: bridgeLegKinds(hoodOrigin),
+      checkLeg: (kind, leg) => relayHoodLegProblem(kind, leg, { origin: hoodOrigin, payer: wallet.address, amountRaw }) === null,
+      onLanded: async () => {}
+    });
+    depositHash = run.landed.find((leg) => leg.kind === "bridgeDeposit")?.hash;
+    result = {
+      ...run.final,
+      chain: "hood",
+      operationId: sequenced.operationId,
+      landedLegs: run.landed
+    };
+  } else {
+    const signed = await relaySign(ctx, key, wallet, transaction);
+    const submitted = await request(ctx, key, "/api/v1/agent/swap/submit", {
+      clientTradeId: id,
+      swapId: data.swapId,
+      signedTransactionsBase64: [signed]
+    });
+    const payload = submitted.payload ?? {};
+    const hashes = Array.isArray(payload.hashes) ? payload.hashes.filter((h) => typeof h === "string") : [];
+    depositHash = hashes[0];
+    result = submitted;
+  }
+  ctx.deps.stderr.write(`Deposit ${depositHash ? safeText(depositHash) : "sent"}: filling.${args.wait ? "" : ` Check it with candle swap status ${id} (add --wait to follow it).`}
+`);
+  const receipt = {
+    ...result,
+    clientTradeId: id,
+    kind: "swap",
+    bridge: { from, to, destination: recipient.address, ...depositHash ? { depositHash } : {} },
+    quote,
+    wallet: safeText(wallet.address)
+  };
+  if (!args.wait)
+    return printTradingResult(ctx, receipt);
+  try {
+    const found = await lookupOperation(ctx, key, id, "swap");
+    if (!found)
+      return printTradingResult(ctx, { ...receipt, waited: { final: false } });
+    const waited = await waitForSettlement(ctx, key, id, found, facts, true);
+    return printTradingResult(ctx, {
+      ...receipt,
+      job: waited.job,
+      bridgeStatus: waited.bridgeStatus,
+      waited: waited.waited
+    });
+  } catch (error) {
+    const reason = safeText(error instanceof Error ? describeRpcFailure(error) : String(error));
+    ctx.deps.stderr.write(`Could not follow the bridge (${reason}). The deposit was sent; do not send it again. Re-check with candle swap status ${id} --wait.
+`);
+    return printTradingResult(ctx, { ...receipt, waited: { final: false, error: reason } });
+  }
+}
+var settlementSchema, bridgeFactsSchema, HOOD_TRADE_LEGS, bridgeBuildSchema;
+var init_swap = __esm(() => {
+  init_zod();
+  init_args();
+  init_bridge();
+  init_evm_lite();
+  init_profiles();
+  init_render();
+  init_solana_endpoint();
+  init_solana_lite();
+  init_trading();
+  settlementSchema = exports_external.object({
+    state: exports_external.enum(["settled", "pending", "failed", "uncertain"]),
+    settledOutRaw: exports_external.string().regex(/^\d+$/).optional()
+  });
+  bridgeFactsSchema = exports_external.object({
+    from: exports_external.enum(["SOL", "USDC", "ETH", "USDG"]),
+    to: exports_external.enum(["SOL", "USDC", "ETH", "USDG"]),
+    recipient: exports_external.string(),
+    statusCheck: exports_external.string().optional()
+  });
+  HOOD_TRADE_LEGS = ["approval", "permit2Approval", "trade", "feeTransfer"];
+  bridgeBuildSchema = exports_external.object({
+    status: exports_external.literal("built"),
+    swapId: exports_external.string().min(1),
+    venue: exports_external.string(),
+    fee: exports_external.object({ bps: exports_external.number(), feeRaw: exports_external.string() }).passthrough(),
+    expectedOutRaw: exports_external.string().regex(/^\d+$/),
+    expiresAt: exports_external.number().finite(),
+    recipient: exports_external.string().min(1),
+    statusChecks: exports_external.array(exports_external.string()).default([]),
+    transactionsBase64: exports_external.array(exports_external.string()).optional(),
+    walletAddress: exports_external.string().optional(),
+    venueCostUsd: exports_external.number().finite().optional(),
+    venueTimeEstimateSec: exports_external.number().finite().optional()
+  }).passthrough();
+});
+
+// src/vault/evm-sweep.ts
+function sameToken(a, b) {
+  return a.toLowerCase() === b.toLowerCase();
+}
+function mergedTokens(sources) {
+  const out = [];
+  const seen = new Set;
+  for (const token of [
+    ...sources.always,
+    ...sources.flags,
+    ...sources.record.tokens,
+    ...sources.server.tokens,
+    ...sources.logs.tokens
+  ]) {
+    const key = token.toLowerCase();
+    if (seen.has(key))
+      continue;
+    seen.add(key);
+    out.push(toChecksumAddress(token));
+  }
+  return out;
+}
+function alwaysTokens() {
+  return [toChecksumAddress(HOOD_USDG_ADDRESS), HOOD_WETH_ADDRESS];
+}
+function recordSource(read, wallet) {
+  const mine = read.entries.filter((entry) => sameToken(entry.wallet, wallet));
+  return {
+    tokens: mine.flatMap((entry) => entry.kind === "token" ? [entry.token] : []),
+    scanStarts: mine.flatMap((entry) => entry.kind === "scanStart" ? [BigInt(entry.block)] : []),
+    absent: read.absent,
+    noKey: read.noKey,
+    unreadableLines: read.unreadableLines,
+    partialTail: read.partialTail,
+    path: read.path
+  };
+}
+function startBlock(scanStarts, fromBlockFlag) {
+  const recorded = scanStarts.length > 0 ? scanStarts.reduce((a, b) => a < b ? a : b) : undefined;
+  if (recorded === undefined && fromBlockFlag === undefined)
+    return;
+  if (recorded === undefined)
+    return { block: fromBlockFlag, source: "--from-block" };
+  if (fromBlockFlag === undefined)
+    return { block: recorded, source: "record" };
+  return { block: recorded < fromBlockFlag ? recorded : fromBlockFlag, source: "record and --from-block" };
+}
+async function discoverTransferLogs(rpc, wallet, fromBlock, toBlock, opts = {}) {
+  const seen = new Map;
+  let page = opts.pageBlocks ?? LOG_PAGE_BLOCKS;
+  let pages = 0;
+  let from = fromBlock;
+  const topics = [ERC20_TRANSFER_TOPIC, null, addressTopic(wallet)];
+  while (from <= toBlock) {
+    const to = from + page - 1n > toBlock ? toBlock : from + page - 1n;
+    try {
+      const logs = await rpc.getLogs({ fromBlock: from, toBlock: to, topics });
+      pages += 1;
+      for (const log of logs)
+        seen.set(log.address.toLowerCase(), log.address);
+      from = to + 1n;
+    } catch (error) {
+      if (error instanceof EvmRpcError && error.kind === "rpc" && page > LOG_PAGE_FLOOR) {
+        page = page / 2n < LOG_PAGE_FLOOR ? LOG_PAGE_FLOOR : page / 2n;
+        continue;
+      }
+      const reason = error instanceof Error ? error.message : String(error);
+      return { failed: `eth_getLogs from block ${from} failed: ${reason}`, tokens: [...seen.values()], pages };
+    }
+  }
+  return { tokens: [...seen.values()], pages };
+}
+function sourceLines(sources, host) {
+  const lines = ["Token sources:", "  USDG and WETH: always read"];
+  const record = sources.record;
+  if (record.noKey && record.absent) {
+    lines.push(`  sealed EVM record: none (this vault has no record key)`);
+  } else if (record.absent) {
+    lines.push(`  sealed EVM record: absent at ${record.path} (not on this machine, or nothing recorded yet)`);
+  } else {
+    const damage = [
+      ...record.unreadableLines > 0 ? [`${record.unreadableLines} unreadable line(s) skipped`] : [],
+      ...record.partialTail ? ["a partial last line skipped"] : []
+    ];
+    lines.push(`  sealed EVM record: ${record.tokens.length} token(s), ${record.scanStarts.length} scan start(s)${damage.length > 0 ? `; ${damage.join(", ")}` : ""}`);
+  }
+  const server = sources.server;
+  if (!server.asked)
+    lines.push(`  server traded-token list: not asked (${server.reason ?? "--emergency calls no Candle API"})`);
+  else if (!server.answered)
+    lines.push(`  server traded-token list: FAILED (${server.reason ?? "no answer"})`);
+  else
+    lines.push(`  server traded-token list: ${server.tokens.length} token(s)${server.truncated ? " (truncated)" : ""}`);
+  lines.push(`  --token: ${sources.flags.length}`);
+  const logs = sources.logs;
+  if (logs.ran && !logs.failed) {
+    lines.push(`  Transfer logs over ${host}: blocks ${logs.fromBlock} to ${logs.toBlock} (start from ${logs.startSource}), ${logs.tokens.length} contract(s)`);
+  } else if (logs.failed) {
+    lines.push(`  Transfer logs over ${host}: FAILED (${logs.reason})`);
+  } else {
+    lines.push(`  Transfer logs: NOT scanned (${logs.reason})`);
+  }
+  if (logs.ran && logs.fromBlock !== undefined) {
+    lines.push(`  A token received before block ${logs.fromBlock}, or from a contract that emits no Transfer log, still needs --token <0x...>.`);
+  }
+  return lines;
+}
+var LOG_PAGE_BLOCKS = 10000n, LOG_PAGE_FLOOR = 250n;
+var init_evm_sweep = __esm(() => {
+  init_evm_lite();
+});
+
+// src/vault/evm-tee.ts
+function resolveHoodClient(ctx, flag) {
+  const resolved = resolveEvmRpcUrl(flag, ctx.deps.env[EVM_RPC_URL_ENV], "--rpc-url");
+  if ("error" in resolved)
+    return resolved;
+  return {
+    rpc: createEvmRpc(resolved.url, ctx.deps.fetch),
+    url: resolved.url,
+    host: rpcHostOf2(resolved.url),
+    builtIn: resolved.builtIn
+  };
+}
+function hoodHostLine(client, what) {
+  return `Reading ${what} from ${client.host}${client.builtIn ? " (the built-in Hood RPC)" : ""}.`;
+}
+async function assertHoodChain(client) {
+  const chainId = await client.rpc.chainId();
+  if (chainId !== BigInt(HOOD_CHAIN_ID)) {
+    throw new VaultError("EVM_CHAIN_MISMATCH", `${client.host} answered chain id ${chainId}; Hood TEE wallets live on Hood, chain id ${HOOD_CHAIN_ID}, only.`, { suggestion: "Nothing was signed or written. Point --rpc-url (or CANDLE_EVM_RPC_URL) at a Hood RPC." });
+  }
+}
+async function readEvmHoldings(rpc, address) {
+  const [eth, usdg, weth] = await Promise.all([
+    rpc.getBalance(address),
+    rpc.erc20BalanceOf(toChecksumAddress(HOOD_USDG_ADDRESS), address),
+    rpc.erc20BalanceOf(HOOD_WETH_ADDRESS, address)
+  ]);
+  return { eth, usdg, weth };
+}
+function holdingsLines(address, holdings, observedAt) {
+  return [
+    `Holdings at ${address} on Hood (observed ${observedAt}):`,
+    `  ETH   ${formatUnits(holdings.eth, NATIVE_DECIMALS)}  (${holdings.eth} wei)`,
+    `  USDG  ${formatUnits(holdings.usdg, HOOD_USDG_DECIMALS)}  (${holdings.usdg} raw)`,
+    `  WETH  ${formatUnits(holdings.weth, NATIVE_DECIMALS)}  (${holdings.weth} raw)`,
+    "  Other tokens are not listed: an EVM RPC has no token-account listing."
+  ];
+}
+async function appendScanStart(ctx, vaultPath, wallet, block2) {
+  const outcome = await appendEvmRecordEntry({
+    vaultPath,
+    entry: { kind: "scanStart", wallet, block: Number(block2) },
+    clock: ctx.deps
+  });
+  const repaired = appendNotice(outcome, `the scan start for ${wallet}`);
+  if (outcome.written) {
+    if (repaired !== undefined)
+      ctx.deps.stderr.write(`${repaired}
+`);
+    return { recorded: true, block: block2.toString() };
+  }
+  ctx.deps.stderr.write(`The promote height, Hood block ${block2}, was not written to the sealed EVM record at ${evmRecordPath(vaultPath)} (${outcome.detail}).
+` + `Keep it: a later sweep of ${wallet} finds traded tokens from it with: candle tee sweep ${wallet} --from-block ${block2}
+`);
+  return { recorded: false, block: block2.toString() };
+}
+async function appendEvmRecordForTrade(ctx, entry) {
+  let vaultPath;
+  try {
+    vaultPath = defaultVaultPath(ctx.deps.env, ctx.deps.homedir());
+  } catch (error) {
+    return { appended: false, notice: error instanceof Error ? error.message : String(error) };
+  }
+  try {
+    const outcome = await appendEvmRecordEntry({ vaultPath, entry, clock: ctx.deps });
+    if (!outcome.written)
+      return { appended: false, notice: outcome.detail };
+    const repaired = appendNotice(outcome, `token ${entry.token}`);
+    return { appended: true, ...repaired !== undefined ? { notice: repaired } : {} };
+  } catch (error) {
+    return { appended: false, notice: error instanceof Error ? error.message : String(error) };
+  }
+}
+async function readHoodTeeServer(ctx, entry) {
+  if (entry.linkedWalletId === undefined) {
+    return {
+      lock: {
+        state: "unknown",
+        reason: "this wallet has no linked wallet id recorded",
+        suggestion: `Nothing was signed. This wallet has no server row, so its lock cannot be read. candle tee sweep ${entry.address} --emergency moves the funds and exits 3; it does not record sweptAt or retire the entry.`
+      }
+    };
+  }
+  const apiKey = await resolveApiKey(ctx.deps, ctx.profile);
+  if (apiKey === undefined)
+    return { lock: { state: "unknown", reason: "no API key for this profile" } };
+  try {
+    const result = await apiRequest(`/api/v1/agent/wallets/${encodeURIComponent(entry.linkedWalletId)}/hood-tee`, {
+      auth: "key",
+      credentials: { apiKey },
+      apiUrl: ctx.apiUrl,
+      fetch: ctx.deps.fetch,
+      env: ctx.deps.env
+    });
+    if (!result.ok)
+      return { lock: { state: "unknown", reason: result.message ?? `HTTP ${result.status}` } };
+    const body = result.body ?? {};
+    const reported = typeof body.address === "string" ? body.address : undefined;
+    if (reported === undefined || !sameAddress(reported, entry.address)) {
+      return {
+        lock: {
+          state: "unknown",
+          reason: reported === undefined ? "the response named no wallet address" : `the response is for ${reported}, not this wallet`
+        }
+      };
+    }
+    const tradedTokens = Array.isArray(body.tradedTokens) ? body.tradedTokens.filter((token) => typeof token === "string" && /^0x[0-9a-fA-F]{40}$/.test(token)) : undefined;
+    const bridges = walletBridgesOf(result.body);
+    const extras = {
+      ...tradedTokens !== undefined ? { tradedTokens } : {},
+      ...body.tradedTokensTruncated === true ? { tradedTokensTruncated: true } : {},
+      ...bridges !== undefined ? { bridges } : {}
+    };
+    if (body.activeOperation === null)
+      return { lock: { state: "free" }, ...extras };
+    const op = body.activeOperation;
+    if (op === undefined || typeof op.operationId !== "string") {
+      return { lock: { state: "unknown", reason: "the response carried no activeOperation field" }, ...extras };
+    }
+    return {
+      lock: {
+        state: "held",
+        operationId: op.operationId,
+        kind: typeof op.kind === "string" ? op.kind : "operation",
+        expiresAt: typeof op.expiresAt === "number" ? op.expiresAt : 0
+      },
+      ...extras
+    };
+  } catch (error) {
+    return { lock: { state: "unknown", reason: error instanceof Error ? error.message : String(error) } };
+  }
+}
+function busyStatusHint(kind, operationId) {
+  if (kind === "swap")
+    return `candle swap status ${operationId}`;
+  if (kind === "trade" || kind === "launch")
+    return `candle swap status ${operationId} --kind ${kind}`;
+  return `the ${kind} operation ${operationId}`;
+}
+function assertWalletLockFree(entry, lock, now) {
+  if (lock.state === "free")
+    return;
+  if (lock.state === "held") {
+    const left = Math.max(0, Math.ceil((lock.expiresAt - now) / 60000));
+    throw new VaultError("WALLET_BUSY", `${entry.label || entry.address} has a sequenced ${lock.kind} in flight (operation ${lock.operationId}); signing locally now could use the nonce one of its legs holds.`, {
+      suggestion: `Nothing was signed. Wait for operation ${lock.operationId} to finish (${busyStatusHint(lock.kind, lock.operationId)}); the lock expires within ${left} minute(s) at most. If funds must move now, candle tee sweep ${entry.address} --emergency compares the chain's nonces instead.`,
+      details: { operationId: lock.operationId }
+    });
+  }
+  throw new VaultError("WALLET_LOCK_UNKNOWN", `Could not read whether ${entry.label || entry.address} has a sequenced operation in flight (${lock.reason}), so nothing is signed at its nonce.`, {
+    suggestion: lock.suggestion ?? `Nothing was signed. Restore the API key or connectivity and run it again. If the server is unreachable and funds must move: candle tee sweep ${entry.address} --emergency`
+  });
+}
+var init_evm_tee = __esm(() => {
+  init_bridge();
+  init_deps();
+  init_evm_lite();
+  init_errors();
+  init_evm_record();
+  init_promote_support();
+  init_store();
+});
+
+// src/vault/evm-transfer.ts
+function refuse2(code, message, opts = {}) {
+  return new VaultError(code, message, { suggestion: opts.suggestion ?? "Nothing was signed.", ...opts });
+}
+function checkEvmDestination(to, from) {
+  if (!to.startsWith("0x")) {
+    throw refuse2("TRANSFER_CHAIN_MISMATCH", `${to} is not an EVM address, and ${from.label || from.address} is an EVM key.`, { suggestion: "Nothing was signed. An EVM key sends to a 0x address; a Solana key sends to a Solana address." });
+  }
+  const checked = checkEvmAddress(to);
+  if (!checked.ok) {
+    throw refuse2("EVM_DESTINATION_INVALID", `${to} is not a valid EVM address: ${checked.reason}.`);
+  }
+  if (sameEvmAddress(checked.address, from.address)) {
+    throw refuse2("EVM_SELF_TRANSFER", `${to} is ${from.label || from.address}'s own address.`);
+  }
+  return checked.address;
+}
+function assertSolanaDestination(to, from) {
+  if (!looksLikeEvmAddress(to))
+    return;
+  throw refuse2("TRANSFER_CHAIN_MISMATCH", `${to} is an EVM address, and ${from.label || from.address} is a Solana key.`, { suggestion: "Nothing was signed. A Solana key sends to a Solana address; an EVM key sends to a 0x address." });
+}
+async function resolveEvmAsset(rpc, asset, chainId) {
+  const upper = asset.toUpperCase();
+  if (upper === "ETH")
+    return { kind: "native", symbol: "ETH", decimals: NATIVE_DECIMALS };
+  let token;
+  if (upper === "USDG") {
+    if (chainId !== BigInt(HOOD_CHAIN_ID)) {
+      return {
+        usage: `USDG is named on Hood (chain id ${HOOD_CHAIN_ID}) only; this RPC answered chain id ${chainId}. Name the token by its contract address.`
+      };
+    }
+    token = toChecksumAddress(HOOD_USDG_ADDRESS);
+  } else {
+    const checked = checkEvmAddress(asset);
+    if (!checked.ok)
+      return {
+        usage: `--asset must be ETH, USDG (on Hood), or an ERC-20 contract address: ${asset} is ${checked.reason}.`
+      };
+    token = checked.address;
+  }
+  let decimals;
+  try {
+    decimals = await rpc.erc20Decimals(token);
+  } catch (error) {
+    throw refuse2("EVM_TOKEN_UNREADABLE", `${token} did not answer decimals(): ${error instanceof Error ? error.message : String(error)}`, { suggestion: "Nothing was signed. Check the contract address, and that this RPC serves the chain it lives on." });
+  }
+  const symbol = upper === "USDG" ? "USDG" : await rpc.erc20Symbol(token) ?? `${token.slice(0, 10)}…`;
+  return { kind: "erc20", symbol, decimals, token };
+}
+function nativeName(hood, chainId) {
+  return hood ? "ETH" : `ETH on chain ${chainId}`;
+}
+function evmDisplayLines(plan) {
+  const { tx, asset, hood, chainId } = plan;
+  const native = nativeName(hood, chainId);
+  const lines = [
+    `chain       ${chainId}${hood ? " (Hood)" : ""}`,
+    `from        ${plan.from.label}  ${plan.from.address}`
+  ];
+  if (asset.kind === "native") {
+    lines.push(`to          ${tx.to}`);
+    lines.push(`amount      ${plan.amount} ${native} = ${plan.amountRaw} wei`);
+  } else {
+    lines.push(`to          ${tx.to}  (the ${asset.symbol} contract, ${asset.decimals} dp)`);
+    lines.push(`recipient   ${plan.recipient}  (decoded from transfer(address,uint256))`);
+    lines.push(`amount      ${plan.amount} ${asset.symbol} = ${plan.amountRaw} raw`);
+  }
+  lines.push(`gas limit   ${tx.gas}`);
+  lines.push(`max fee     ${tx.maxFeePerGas} wei/gas (priority ${tx.maxPriorityFeePerGas} wei/gas)`);
+  lines.push(`fee cap     ${formatUnits(plan.feeCap, NATIVE_DECIMALS)} ${native} (gas × max fee)`);
+  lines.push(`nonce       ${tx.nonce}`);
+  return lines;
+}
+async function planEvmTransfer(rpc, input) {
+  const to = checkEvmDestination(input.to, input.from);
+  const chainId = await rpc.chainId();
+  if (input.builtIn && chainId !== BigInt(HOOD_CHAIN_ID)) {
+    throw refuse2("EVM_CHAIN_MISMATCH", `The built-in Hood RPC answered chain id ${chainId}, not ${HOOD_CHAIN_ID}.`, {
+      suggestion: "Nothing was signed. Pass --rpc-url for another chain; the built-in endpoint is Hood's only."
+    });
+  }
+  const hood = chainId === BigInt(HOOD_CHAIN_ID);
+  const asset = await resolveEvmAsset(rpc, input.asset, chainId);
+  if ("usage" in asset)
+    return asset;
+  const max = input.amount.toLowerCase() === "max";
+  if (asset.kind === "erc20" && asset.token !== undefined && sameEvmAddress(to, asset.token)) {
+    throw refuse2("EVM_RECIPIENT_IS_TOKEN", `${to} is the ${asset.symbol} contract itself; sending it its own tokens is a loss.`);
+  }
+  let amountRaw = 0n;
+  if (!max) {
+    const parsed = parseUnits(input.amount, asset.decimals);
+    if (!parsed.ok && parsed.reason === "precision") {
+      throw refuse2("EVM_AMOUNT_PRECISION", `${input.amount} has more decimal places than ${asset.symbol}'s ${asset.decimals}.`);
+    }
+    if (!parsed.ok)
+      return { usage: `--amount must be a positive decimal or max; ${input.amount} is neither.` };
+    amountRaw = parsed.raw;
+  }
+  const nonce = await rpc.getTransactionCount(input.from.address, "pending");
+  const fees = await quoteFees(rpc);
+  const nativeBalance = await rpc.getBalance(input.from.address);
+  if (asset.kind === "erc20" && asset.token !== undefined) {
+    if (max) {
+      amountRaw = await rpc.erc20BalanceOf(asset.token, input.from.address);
+      if (amountRaw === 0n) {
+        throw new VaultError("VAULT_INDEX_INVALID", `${input.from.label} holds no ${asset.symbol}; there is nothing to send.`);
+      }
+    }
+    const draft2 = buildErc20Transfer({
+      chainId,
+      nonce,
+      maxPriorityFeePerGas: fees.maxPriorityFeePerGas,
+      maxFeePerGas: fees.maxFeePerGas,
+      gas: 0n,
+      token: asset.token,
       recipient: to,
       amount: amountRaw
     });
@@ -31128,6 +31980,8 @@ async function resolveKeyMaterial(keyFile, chain2, ctx) {
       return { ok: false, message: `Could not read --key-file: ${error instanceof Error ? error.message : error}` };
     }
   }
+  if (!ctx.deps.isTTY.stdin)
+    return { ok: false, message: "No TTY available for private key input; pass --key-file instead" };
   try {
     const promptText = chain2 === "solana" ? "Solana private key (base58 or id.json contents; input hidden): " : "EVM private key (hex; input hidden): ";
     const entered = (await ctx.deps.promptSecret(promptText)).trim();
@@ -32244,6 +33098,26 @@ var init_tee_evm = __esm(() => {
   init_wallets();
 });
 
+// src/commands/tee-status-wallet.ts
+async function serverTeeWallet(ctx, address, chain2) {
+  const apiKey = await resolveApiKey(ctx.deps, ctx.profile);
+  const suggestion = "Pass --verify to read it from this machine's vault, or select the profile holding its key.";
+  if (!apiKey)
+    throw new TradingError("TEE_WALLET_NOT_ON_KEY", `${address}: no API key available.`, { suggestion });
+  const { rows } = await listTradingWallets(ctx, apiKey);
+  const row = rows.find((candidate) => candidate.chain === chain2 && (chain2 === "evm" ? sameEvmAddress(candidate.address, address) : candidate.address === address));
+  if (!row)
+    throw new TradingError("TEE_WALLET_NOT_ON_KEY", `${address} is not a TEE wallet bound to key ${apiKeyPrefix(apiKey) ?? "this key"}.`, { suggestion });
+  return { row, apiKey };
+}
+var UNVERIFIED_KEY_LINE = "Key not verified on this machine. Pass --verify to open the vault and check it.";
+var init_tee_status_wallet = __esm(() => {
+  init_deps();
+  init_evm_lite();
+  init_profiles();
+  init_trading();
+});
+
 // src/commands/tee-status-evm.ts
 async function readVaultEntry(ctx, address) {
   const resolved = vaultPathFor(ctx, { values: {}, booleans: new Set, positionals: [] });
@@ -32282,9 +33156,10 @@ async function teeStatusEvm(ctx, parsed, address) {
     writeUsageFailure(deps, rpcUrl.error, json);
     return 2;
   }
+  const verify = parsed.booleans.has("--verify");
   let vault;
   try {
-    vault = await readVaultEntry(ctx, checked.address);
+    vault = verify ? await readVaultEntry(ctx, checked.address) : null;
   } catch (error) {
     if (error instanceof TradingError && error.code === "USAGE") {
       writeUsageFailure(deps, error.message, json);
@@ -32296,11 +33171,21 @@ async function teeStatusEvm(ctx, parsed, address) {
     }
     throw error;
   }
+  let serverWallet = null;
+  if (!verify) {
+    try {
+      serverWallet = await serverTeeWallet(ctx, address, "evm");
+    } catch (error) {
+      return tradingFailure(ctx, error);
+    }
+  }
   const report = {
     address: checked.address,
     chain: "hood",
     label: vault?.label ?? null,
     source: vault ? "vault" : "server",
+    verified: verify,
+    ...!verify ? { localState: null, retainedSweepReceipts: null, pendingSweepTransactions: null, vaultLifecycle: null } : {},
     linkedWalletId: vault?.linkedWalletId ?? null,
     vaultDestination: vault?.vaultDestination ?? null,
     observedAt: new Date(deps.now()).toISOString()
@@ -32310,7 +33195,7 @@ async function teeStatusEvm(ctx, parsed, address) {
     report.server = { error: "no API key available; server state not read" };
   else {
     try {
-      const { rows } = await listTradingWallets(ctx, apiKey);
+      const rows = serverWallet ? [serverWallet.row] : (await listTradingWallets(ctx, apiKey)).rows;
       const row = rows.find((candidate) => candidate.chain === "evm" && sameEvmAddress(candidate.address, address));
       if (row) {
         report.linkedWalletId ??= row.id;
@@ -32377,6 +33262,9 @@ async function teeStatusEvm(ctx, parsed, address) {
   deps.stdout.write(`  chain         Hood (4663)
 `);
   deps.stdout.write(`  source        ${report.source}
+`);
+  if (!verify)
+    deps.stdout.write(`${UNVERIFIED_KEY_LINE}
 `);
   if (vault?.vaultDestination)
     deps.stdout.write(`  vault         ${vault.vaultDestination}
@@ -32417,6 +33305,8 @@ var init_tee_status_evm = __esm(() => {
   init_trading();
   init_errors();
   init_store();
+  init_swap();
+  init_tee_status_wallet();
   init_vault_support();
 });
 
@@ -33082,43 +33972,59 @@ async function readLifecycle(ctx, apiKey, linkedWalletId) {
 }
 async function teeStatus(args, ctx) {
   const { deps, json } = ctx;
-  if (!refuseEnvPassphrase2(ctx))
-    return 1;
-  const parsed = parseArgs(args, { valueFlags: ["--rpc-url", "--keystore"], pathFlags: ["--keystore"] });
+  const parsed = parseArgs(args, {
+    valueFlags: ["--rpc-url", "--keystore"],
+    pathFlags: ["--keystore"],
+    booleanFlags: ["--verify"]
+  });
   if ("error" in parsed)
     return usage2(ctx, parsed.error);
+  const verify = parsed.booleans.has("--verify");
+  if (verify && !refuseEnvPassphrase2(ctx))
+    return 1;
   const [address, extra] = parsed.positionals;
   if (!address || extra !== undefined)
-    return usage2(ctx, "Usage: candle tee status <address> [--rpc-url <url>]");
+    return usage2(ctx, "Usage: candle tee status <address> [--rpc-url <url>] [--verify]");
   if (/^0x/i.test(address))
     return await teeStatusEvm(ctx, parsed, address);
   const solana = await openSolanaClient(ctx, parsed.values["--rpc-url"]);
   if ("error" in solana)
     return usage2(ctx, solana.error);
-  const resolved = await resolveTeeAddress(ctx, parsed, address, () => openExistingTeeStore(ctx, parsed));
-  if (!resolved.ok)
-    return resolved.code;
+  let local = null;
+  let entry;
+  if (verify) {
+    const resolved = await resolveTeeAddress(ctx, parsed, address, () => openExistingTeeStore(ctx, parsed));
+    if (!resolved.ok)
+      return resolved.code;
+    local = resolved.resolved;
+    entry = local.source === "vault" ? local.legacyView : local.entry;
+  } else {
+    try {
+      const { row } = await serverTeeWallet(ctx, address, "solana");
+      entry = { address, label: row.label ?? "", linkedWalletId: row.id };
+    } catch (error) {
+      return tradingFailure(ctx, error);
+    }
+  }
   try {
-    if (resolved.resolved.source === "vault") {
-      const reconciled = await maybeReconcileVaultTee(ctx, resolved.resolved);
+    if (local?.source === "vault") {
+      const reconciled = await maybeReconcileVaultTee(ctx, local);
       if (reconciled.code !== null)
         return reconciled.code;
     }
-    const entry = resolved.resolved.source === "vault" ? resolved.resolved.legacyView : resolved.resolved.entry;
     const report = {
       address,
       label: entry.label,
-      source: resolved.resolved.source,
+      source: local?.source ?? "server",
+      verified: verify,
       linkedWalletId: entry.linkedWalletId ?? null,
-      vaultDestination: entry.tee?.vaultDestination ?? null,
-      localState: entry.tee?.sweptAt ? "swept" : entry.tee?.stopRequestedAt ? "stop-requested" : entry.linkedWalletId ? "enabled" : "local-only",
-      retainedSweepReceipts: entry.tee?.sweepReceipts?.length ?? 0,
-      pendingSweepTransactions: entry.tee?.sweepPending?.length ?? 0,
+      vaultDestination: verify ? entry.tee?.vaultDestination ?? null : null,
+      vaultLifecycle: local?.source === "vault" ? local.entry.tee?.lifecycle ?? null : null,
+      localState: !verify ? null : entry.tee?.sweptAt ? "swept" : entry.tee?.stopRequestedAt ? "stop-requested" : entry.linkedWalletId ? "enabled" : "local-only",
+      retainedSweepReceipts: verify ? entry.tee?.sweepReceipts?.length ?? 0 : null,
+      pendingSweepTransactions: verify ? entry.tee?.sweepPending?.length ?? 0 : null,
       observedAt: new Date(deps.now()).toISOString()
     };
-    if (resolved.resolved.source === "vault") {
-      report.vaultLifecycle = resolved.resolved.entry.tee?.lifecycle ?? null;
-    }
     if (entry.linkedWalletId) {
       const apiKey = await resolveApiKey(deps, ctx.profile);
       if (apiKey) {
@@ -33164,13 +34070,17 @@ async function teeStatus(args, ctx) {
     }
     deps.stdout.write(`${address}  ${entry.label}
 `);
-    if (resolved.resolved.source === "vault") {
+    if (local?.source === "vault") {
       deps.stdout.write(`  source        vault (Phase 1 store is read-only for this address)
 `);
-      deps.stdout.write(`  vault life    ${resolved.resolved.entry.tee?.lifecycle ?? "?"}
+      deps.stdout.write(`  vault life    ${local.entry.tee?.lifecycle ?? "?"}
 `);
     }
-    deps.stdout.write(`  local state   ${report.localState}
+    if (!verify)
+      deps.stdout.write(`${UNVERIFIED_KEY_LINE}
+`);
+    else
+      deps.stdout.write(`  local state   ${report.localState}
 `);
     if (entry.tee?.vaultDestination)
       deps.stdout.write(`  vault         ${entry.tee.vaultDestination}
@@ -33206,7 +34116,8 @@ async function teeStatus(args, ctx) {
 `);
     return 0;
   } finally {
-    releaseResolvedTee(resolved.resolved);
+    if (local)
+      releaseResolvedTee(local);
   }
 }
 async function teeDisable(args, ctx) {
@@ -34233,8 +35144,10 @@ var init_tee = __esm(() => {
   init_wallet_import_flow();
   init_wallet_keygen();
   init_wallet_keystore();
+  init_swap();
   init_tee_evm();
   init_tee_status_evm();
+  init_tee_status_wallet();
   init_wallets();
   StoreChangedError = class StoreChangedError extends Error {
   };
@@ -34400,7 +35313,7 @@ function missingSignerFailure(missing) {
     message: `The target key has a signer, so the owner of ${missing.length === 1 ? "this wallet" : "these wallets"} must change with the binding, and this machine does not hold the current owner. Nothing changed.
 ${missing.map((m) => `  ${m.walletId}: on ${m.where}`).join(`
 `)}`,
-    suggestion: "Run the same rebind on the machine named for each wallet, with the device token there."
+    suggestion: "Run the same rebind on the machine named for each wallet. If that is a trading machine with no login, sign in there on a temporary profile for the move: https://docs.candle.tv/developers/cli-headless#moving-wallets-onto-a-key-that-has-a-signer"
   };
 }
 function rebindFailureDetails(result, context) {
@@ -34750,7 +35663,7 @@ function effectiveEmbeddedWallet(value) {
   return value === "denied" ? "denied" : "allowed";
 }
 function embeddedWalletLine(permission, keyPrefix) {
-  return permission === "allowed" ? "Embedded wallet: allowed. This key may trade, launch and transfer from the account's embedded wallet, with Candle signing." : `Embedded wallet: denied. This key cannot spend the account's embedded wallet; the owner can allow it with: candle keys update ${keyPrefix} --embedded-wallet allow`;
+  return permission === "allowed" ? "Embedded wallet: allowed. This key may use the account's embedded wallet, with Candle signing, for what its scopes allow: trades with swap:write, launches with launch:write, transfers only with transfer:write." : `Embedded wallet: denied. This key cannot spend the account's embedded wallet; the owner can allow it with: candle keys update ${keyPrefix} --embedded-wallet allow`;
 }
 function keyName(keyPrefix, label) {
   const cleaned = labelCell(label ?? undefined);
@@ -34791,7 +35704,7 @@ async function confirmCreateAllow(ctx) {
     writeLocalFailure(deps, ALLOW_REQUIRES_TTY, json);
     return 1;
   }
-  deps.stderr.write(`This key will be allowed to trade, launch and transfer from the account's embedded wallet, with Candle signing.
+  deps.stderr.write(`This key will be allowed to use the account's embedded wallet, with Candle signing, for what its scopes allow: trades with swap:write, launches with launch:write, transfers only with transfer:write.
 ` + `A key that only trades its own TEE wallets does not need it.
 `);
   const answer = await deps.promptLine("Create the key with the embedded wallet allowed? [y/N] ");
@@ -34890,7 +35803,7 @@ async function keysUpdate(args, ctx) {
     `API             ${apiUrl}  (${candleEnvironment(apiUrl) ?? "not a Candle host"})`,
     "",
     `Embedded wallet ${shown.from}  ->  ${shown.to}   (${shown.direction})`,
-    widen ? "It can trade, launch and transfer from the account's embedded wallet as soon as you confirm." : "It stops spending the account's embedded wallet from its next request.",
+    widen ? "It can use the account's embedded wallet for what its scopes allow: trades with swap:write, launches with launch:write, transfers only with transfer:write." : "It stops spending the account's embedded wallet from its next request.",
     "",
     ""
   ].join(`
@@ -39338,8 +40251,8 @@ var require_checkpoint = __commonJS((exports) => {
       const split2 = envelope.indexOf(CHECKPOINT_SEPARATOR);
       const header = envelope.slice(0, split2 + 1);
       const data = envelope.slice(split2 + CHECKPOINT_SEPARATOR.length);
-      const matches = data.matchAll(SIGNATURE_REGEX);
-      const signatures = Array.from(matches, (match) => {
+      const matches2 = data.matchAll(SIGNATURE_REGEX);
+      const signatures = Array.from(matches2, (match) => {
         const [, name2, signature] = match;
         const sigBytes = Buffer.from(signature, "base64");
         if (sigBytes.length < 5) {
@@ -43413,11 +44326,11 @@ var require_validate2 = __commonJS((exports) => {
       jsonPointer = $data;
       data = names_1.default.rootData;
     } else {
-      const matches2 = RELATIVE_JSON_POINTER.exec($data);
-      if (!matches2)
+      const matches3 = RELATIVE_JSON_POINTER.exec($data);
+      if (!matches3)
         throw new Error(`Invalid JSON-pointer: ${$data}`);
-      const up = +matches2[1];
-      jsonPointer = matches2[2];
+      const up = +matches3[1];
+      jsonPointer = matches3[2];
       if (jsonPointer === "#") {
         if (up >= dataLevel)
           throw new Error(errorMsg("property/index", up));
@@ -44094,11 +45007,11 @@ var require_schemes = __commonJS((exports, module) => {
       urnComponent.error = "URN can not be parsed";
       return urnComponent;
     }
-    const matches2 = urnComponent.path.match(URN_REG);
-    if (matches2) {
+    const matches3 = urnComponent.path.match(URN_REG);
+    if (matches3) {
       const scheme = options.scheme || urnComponent.scheme || "urn";
-      urnComponent.nid = matches2[1].toLowerCase();
-      urnComponent.nss = matches2[2];
+      urnComponent.nid = matches3[1].toLowerCase();
+      urnComponent.nss = matches3[2];
       const urnScheme = `${scheme}:${options.nid || urnComponent.nid}`;
       const schemeHandler = getSchemeHandler(urnScheme);
       urnComponent.path = undefined;
@@ -44344,8 +45257,8 @@ var require_fast_uri = __commonJS((exports, module) => {
   var URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u;
   var AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/;
   var AUTHORITY_INTRODUCER_REGION = /^(?:[^#/:?]+:)?([/\\\t\n\r]*)/;
-  function getParseError(parsed, matches2) {
-    if (matches2[2] !== undefined && parsed.path && parsed.path[0] !== "/") {
+  function getParseError(parsed, matches3) {
+    if (matches3[2] !== undefined && parsed.path && parsed.path[0] !== "/") {
       return 'URI path must start with "/" when authority is present.';
     }
     if (typeof parsed.port === "number" && (parsed.port < 0 || parsed.port > 65535)) {
@@ -44392,19 +45305,19 @@ var require_fast_uri = __commonJS((exports, module) => {
         }
       }
     }
-    const matches2 = uri.match(URI_PARSE);
-    if (matches2) {
-      parsed.scheme = matches2[1];
-      parsed.userinfo = matches2[3];
-      parsed.host = matches2[4];
-      parsed.port = parseInt(matches2[5], 10);
-      parsed.path = matches2[6] || "";
-      parsed.query = matches2[7];
-      parsed.fragment = matches2[8];
+    const matches3 = uri.match(URI_PARSE);
+    if (matches3) {
+      parsed.scheme = matches3[1];
+      parsed.userinfo = matches3[3];
+      parsed.host = matches3[4];
+      parsed.port = parseInt(matches3[5], 10);
+      parsed.path = matches3[6] || "";
+      parsed.query = matches3[7];
+      parsed.fragment = matches3[8];
       if (isNaN(parsed.port)) {
-        parsed.port = matches2[5];
+        parsed.port = matches3[5];
       }
-      const parseError = getParseError(parsed, matches2);
+      const parseError = getParseError(parsed, matches3);
       if (parseError !== undefined) {
         parsed.error = parsed.error || parseError;
         malformedAuthorityOrPort = true;
@@ -47063,12 +47976,12 @@ var require_formats = __commonJS((exports) => {
   var DATE = /^(\d\d\d\d)-(\d\d)-(\d\d)$/;
   var DAYS = [0, 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
   function date(str) {
-    const matches2 = DATE.exec(str);
-    if (!matches2)
+    const matches3 = DATE.exec(str);
+    if (!matches3)
       return false;
-    const year = +matches2[1];
-    const month = +matches2[2];
-    const day = +matches2[3];
+    const year = +matches3[1];
+    const month = +matches3[2];
+    const day = +matches3[3];
     return month >= 1 && month <= 12 && day >= 1 && day <= (month === 2 && isLeapYear(year) ? 29 : DAYS[month]);
   }
   function compareDate(d1, d2) {
@@ -47083,16 +47996,16 @@ var require_formats = __commonJS((exports) => {
   var TIME = /^(\d\d):(\d\d):(\d\d(?:\.\d+)?)(z|([+-])(\d\d)(?::?(\d\d))?)?$/i;
   function getTime(strictTimeZone) {
     return function time(str) {
-      const matches2 = TIME.exec(str);
-      if (!matches2)
+      const matches3 = TIME.exec(str);
+      if (!matches3)
         return false;
-      const hr = +matches2[1];
-      const min = +matches2[2];
-      const sec = +matches2[3];
-      const tz = matches2[4];
-      const tzSign = matches2[5] === "-" ? -1 : 1;
-      const tzH = +(matches2[6] || 0);
-      const tzM = +(matches2[7] || 0);
+      const hr = +matches3[1];
+      const min = +matches3[2];
+      const sec = +matches3[3];
+      const tz = matches3[4];
+      const tzSign = matches3[5] === "-" ? -1 : 1;
+      const tzH = +(matches3[6] || 0);
+      const tzM = +(matches3[7] || 0);
       if (tzH > 23 || tzM > 59 || strictTimeZone && !tz)
         return false;
       if (hr <= 23 && min <= 59 && sec < 60)
@@ -50732,10 +51645,10 @@ async function walletFor(cfg, fetch2, name2, scope) {
     throw new Refusal(fail3("SCOPE_MISSING", `The key needs ${scope}.`));
   const rows = Array.isArray(listed.page) ? listed.page : [];
   const evm = rows.filter((row) => row.chain === "evm");
-  const matches2 = name2 === undefined ? evm : evm.filter((row) => row.id === name2 || row.label === name2 || row.address.toLowerCase() === name2.toLowerCase());
-  if (matches2.length !== 1)
+  const matches3 = name2 === undefined ? evm : evm.filter((row) => row.id === name2 || row.label === name2 || row.address.toLowerCase() === name2.toLowerCase());
+  if (matches3.length !== 1)
     throw new Refusal(fail3("TEE_WALLET_REQUIRED", evm.length === 0 ? "This key has no EVM TEE wallet bound to it." : `Name exactly one EVM TEE wallet: ${evm.map((row) => row.label ?? row.id).join(", ")}`));
-  return { row: matches2[0], appId: typeof listed.privyAppId === "string" ? listed.privyAppId : "" };
+  return { row: matches3[0], appId: typeof listed.privyAppId === "string" ? listed.privyAppId : "" };
 }
 async function builderPin2(cfg, fetch2, env) {
   const pinned = env.CANDLE_HYPERLIQUID_BUILDER?.trim() || CANDLE_HYPERLIQUID_BUILDER_ADDRESS2;
@@ -50869,10 +51782,10 @@ function rawUnits(amount, decimals) {
 }
 function pickWallet(rows, chain2, name2, what) {
   const onChain = rows.filter((row) => row.chain === chain2);
-  const matches2 = name2 === undefined ? onChain : onChain.filter((row) => row.id === name2 || row.label === name2 || row.address.toLowerCase() === name2.toLowerCase());
-  if (matches2.length !== 1)
+  const matches3 = name2 === undefined ? onChain : onChain.filter((row) => row.id === name2 || row.label === name2 || row.address.toLowerCase() === name2.toLowerCase());
+  if (matches3.length !== 1)
     throw new Refusal(fail3("TEE_WALLET_REQUIRED", onChain.length === 0 ? `This key has no ${what} bound to it.` : `Name exactly one ${what}: ${onChain.map((row) => row.label ?? row.id).join(", ")}`));
-  return matches2[0];
+  return matches3[0];
 }
 function depositProblem(build, expect) {
   const destination = build.destination ?? {};
@@ -51467,7 +52380,7 @@ MARKET_NOT_FOUND means Candle has no market for that token and this could not ru
   }, async (args) => callAndRelay("candle_get_profile_trades", args, cfg));
   register("candle_get_portfolio", {
     title: "Read what the account holds, on Solana and Hood",
-    description: "Balances and prices for the wallets Candle already knows on this account, on both chains: the " + "embedded wallet and every TEE wallet. Solana wallets are in `embedded` and `tee` (SOL as raw " + "`lamports`, tokens as raw `amountRaw` with `decimals`). Hood wallets are in `hood.embedded` and " + "`hood.tee` (ETH as raw `wei`, ERC-20s including USDG), never in the top-level arrays. Every " + "wallet and holding carries `chain`. Prices are in `prices`: a Solana mint under its own " + "address, Hood ETH under `hood:native`, and a Hood token under `hood:<contract lowercased>`, so " + "lowercase the address before looking it up. An unpriced entry is `priceUsd: null`, never zero; " + "a Hood one says why in `unpricedReason` (no-market-row, unusable-price, stale-mark, " + "source-unavailable), and `hood.unpriced` / `hood.unpricedByReason` count them. A Hood token " + "mark older than six hours is not used, so many Hood tokens read unpriced. A wallet whose read " + "failed has null balances, never zero, and is listed in `unavailable` (Solana) or " + "`hood.unavailable`; check `complete` before quoting a total. Vault and external wallets are " + "not included: Candle does not know their addresses (the Candle CLI's `candle portfolio` reads " + "them over your own RPC). Needs a key with the account:read scope; without it the answer is " + "SCOPE_MISSING. A server that predates Hood in the portfolio omits `hood` and `chain`. Reads " + "only; moves nothing.",
+    description: "Balances and prices for the wallets Candle already knows on this account, on both chains: the " + "embedded wallet and every TEE wallet. Solana wallets are in `embedded` and `tee` (SOL as raw " + "`lamports`, tokens as raw `amountRaw` with `decimals`). Hood wallets are in `hood.embedded` and " + "`hood.tee` (ETH as raw `wei`, ERC-20s including USDG), never in the top-level arrays. Every " + "wallet and holding carries `chain`. Prices are in `prices`: a Solana mint under its own " + "address, Hood ETH under `hood:native`, and a Hood token under `hood:<contract lowercased>`, so " + "lowercase the address before looking it up. An unpriced entry is `priceUsd: null`, never zero; " + "a Hood one says why in `unpricedReason` (no-market-row, unusable-price, stale-mark, " + "source-unavailable), and `hood.unpriced` / `hood.unpricedByReason` count them. A Hood token " + "mark older than six hours is not used, so many Hood tokens read unpriced. A wallet whose read " + "failed has null balances, never zero, and is listed in `unavailable` (Solana) or " + "`hood.unavailable`; check `complete` before quoting a total. `walletsComplete` is false only " + "when the wallet list itself was cut off, and is absent on a server that predates it: then " + "`complete: false` may be a cut-off list or a failed read. Vault and external wallets are " + "not included: Candle does not know their addresses (the Candle CLI's `candle portfolio` reads " + "them over your own RPC). Needs a key with the account:read scope; without it the answer is " + "SCOPE_MISSING. A server that predates Hood in the portfolio omits `hood` and `chain`. Reads " + "only; moves nothing.",
     inputSchema: {}
   }, async () => callAndRelay("candle_get_portfolio", {}, cfg));
   register("candle_resolve_token", {
@@ -51857,7 +52770,7 @@ init_render();
 init_secret_store();
 
 // src/version.ts
-var CLI_VERSION = "0.11.15";
+var CLI_VERSION = "0.11.16";
 
 // src/commands/auth.ts
 init_keys_embedded_wallet();
@@ -52084,7 +52997,7 @@ async function authLogout(args, ctx) {
   const keepKey = parsed.booleans.has("--keep-key");
   await printIdentity(ctx);
   const config = await deps.readConfig();
-  const { keyPrefix, portalOrigin } = effectiveProfileFields(config, ctx.profile);
+  const { keyPrefix, portalOrigin, deviceTokenPrefix, label } = effectiveProfileFields(config, ctx.profile);
   const deviceToken = await resolveDeviceToken(deps, ctx.profile);
   let revokedKey;
   if (!keepKey && deviceToken && keyPrefix) {
@@ -52120,12 +53033,18 @@ async function authLogout(args, ctx) {
   } else {
     await deps.store.delete(SECRET_REFS.deviceToken);
     await deps.store.delete(SECRET_REFS.apiKey);
-    await deps.clearConfig();
+    const patch = Object.fromEntries(PRE_PROFILE_FIELDS.map((field) => [field, undefined]));
+    const remaining = { ...config, ...patch };
+    if (Object.values(remaining).some((value) => value !== undefined))
+      await deps.writeConfig(patch);
+    else
+      await deps.clearConfig();
   }
-  const portalUrl = portalDeviceUrl(apiUrl, portalOrigin);
+  const portalUrl = portalDevicesUrl(apiUrl, portalOrigin);
+  const device = deviceTokenPrefix ? { prefix: deviceTokenPrefix, label: label ?? null } : null;
   const liveEnvOverrides = credentialEnvOverrides(deps.env);
   if (json) {
-    deps.stdout.write(`${JSON.stringify({ success: true, revokedKey: revokedKey ?? null, portalUrl, envOverrides: liveEnvOverrides })}
+    deps.stdout.write(`${JSON.stringify({ success: true, revokedKey: revokedKey ?? null, portalUrl, device, envOverrides: liveEnvOverrides })}
 `);
     return 0;
   }
@@ -52137,7 +53056,11 @@ async function authLogout(args, ctx) {
   }
   deps.stdout.write(`The device token itself is session-only to revoke -- that is intentional (a stolen token cannot read device metadata or revoke a sibling device). Sign in to the portal to revoke it there.
 `);
-  deps.stdout.write(`Portal: ${portalUrl}
+  if (device)
+    deps.stdout.write(`Device ${device.prefix}${device.label ? ` (${device.label})` : ""} is still live on the server. Revoke it under Connected devices: ${portalUrl}
+`);
+  else
+    deps.stdout.write(`Connected devices: ${portalUrl}
 `);
   return 0;
 }
@@ -52543,9 +53466,14 @@ var HELP = {
   portfolio: {
     group: "Account",
     summary: "Every wallet's holdings, prices and value on Solana and Hood (vault read over your own RPCs)",
-    description: "Vault, TEE and embedded wallets on Solana and Hood, each token with its chain, amount, price and value, then subtotals per group and per chain and one total. TEE and embedded balances, on both chains, come from Candle. Solana vault and external wallets are read over your own Solana RPC, and Candle is sent only the mints they hold, for prices. EVM vault keys are read over your own EVM RPC for ETH and USDG only (the CLI cannot list other tokens), which must be Hood's (chain id 4663); any other chain is refused. Their prices come from Candle by asset (ETH, USDG), never by address. Unpriced tokens are shown as unpriced with the reason (no-market-row, stale-mark, unusable-price, source-unavailable) and left out of the total. A wallet that could not be read in full is marked not read, the footer names its chain, and the exit is 3. Where Candle serves LP, each Solana TEE wallet's DAMM v2 positions follow the tokens (share of the pool plus unclaimed fees, valued by Candle at the same marks) and count in the total; a position whose pool could not be read is shown as not read and the total says it is partial. A bridge moves value between the chain subtotals; it is not a trade.",
-    usage: ["candle portfolio [--chain solana|hood] [--rpc-url <url>] [--evm-rpc-url <url>] [--json]"],
-    rows: [],
+    description: "Vault, TEE and embedded wallets on Solana and Hood, each token with its chain, amount, price and value, then subtotals per group and per chain and one total. TEE and embedded balances, on both chains, come from Candle. Solana vault and external wallets are read over your own Solana RPC, and Candle is sent only the mints they hold, for prices. EVM vault keys are read over your own EVM RPC for ETH and USDG only (the CLI cannot list other tokens), which must be Hood's (chain id 4663); any other chain is refused. Their prices come from Candle by asset (ETH, USDG), never by address. Unpriced tokens are shown as unpriced with the reason (no-market-row, stale-mark, unusable-price, source-unavailable) and left out of the total. A wallet that could not be read in full is marked not read, the footer names its chain, and the exit is 3. Where Candle serves LP, each Solana TEE wallet's DAMM v2 positions follow the tokens (share of the pool plus unclaimed fees, valued by Candle at the same marks) and count in the total; a position whose pool could not be read is shown as not read and the total says it is partial. A bridge moves value between the chain subtotals; it is not a trade. With a filter, only the wallets whose label or address contains it are read and shown, the subtotals and total are for those wallets, and the first line says how many matched. When Candle listed only part of the account's wallets, the result stays partial even if every wallet shown was read, and no match says so.",
+    usage: ["candle portfolio [<filter>] [--chain solana|hood] [--rpc-url <url>] [--evm-rpc-url <url>] [--json]"],
+    rows: [
+      {
+        invocation: "<filter>",
+        description: "Keep the wallets whose label or address contains this text, in every group. Vault keys it leaves out are never sent to your RPC"
+      }
+    ],
     flags: [
       { invocation: "--chain solana|hood", description: "Show one chain, and read nothing on the other" },
       {
@@ -52561,6 +53489,7 @@ var HELP = {
     examples: [
       "candle portfolio",
       "candle portfolio --chain hood",
+      "candle portfolio p-",
       "candle portfolio --rpc-url https://your-rpc.example --evm-rpc-url https://your-hood-rpc.example --json"
     ],
     env: [...ENV_API, ...ENV_LOCAL_SIGNING]
@@ -52859,8 +53788,8 @@ var HELP = {
         description: "Print the funding instruction for your vault to sign"
       },
       {
-        invocation: "status <address> [--rpc-url <url>]",
-        description: "Server lifecycle state and on-chain balances; on Hood, ETH, USDG, the gas reserve and gas: low"
+        invocation: "status <address> [--rpc-url <url>] [--verify]",
+        description: "Server lifecycle state and on-chain balances without unlocking; --verify opens the vault and checks the key. On Hood, ETH, USDG, the gas reserve and gas: low"
       },
       {
         invocation: "disable <address>",
@@ -52877,7 +53806,7 @@ var HELP = {
       { invocation: "rebinds [wallet]", description: "List TEE wallet rebinds for this account (owner only)" },
       {
         invocation: "signer new --key <prefix|label> [--out <pem>] [--force]",
-        description: "On the trading machine, with that key's API key: generate the key's signer here and wait for the owner to approve it. Its wallets then trade from this machine. --out also writes a plaintext PEM for an SDK process (weaker than the secret store); --force adds a signer while an old one here still owns wallets"
+        description: "On the trading machine, with that key's API key: generate the key's signer here and wait for the owner to approve it. Its wallets then trade from this machine. --out also writes a plaintext PEM for an SDK process (weaker than the secret store); --force adds a signer while an older signer on THIS machine still owns wallets; it moves, revokes and deletes nothing"
       }
     ],
     flags: [KEYSTORE_FLAG],
@@ -53943,7 +54872,7 @@ init_tee_rebind();
 var USAGE_TEE_SIGNER = "Usage: candle tee signer new --key <prefix|label> [--out <pem>] [--force] [--json]";
 var USAGE_KEYS_SIGNER = "Usage: candle keys signer approve <code> --key <prefix|label> [--reject] | candle keys signer move <prefix|label> [--to-key <prefix|label>] [--json]";
 var SIGNER_POLL_MS = 5000;
-var DEVICE_TOKEN_BESIDE_SIGNER_LINE = "Warning: this machine holds a device token as well as a key signer. A machine with both can approve its own signer request. Do not log the trading machine in: run candle auth logout here, and approve from the owner's machine.";
+var DEVICE_TOKEN_BESIDE_SIGNER_LINE = "Warning: this machine holds a device token as well as a key signer. A machine with both can approve its own signer request. Do not leave the trading machine logged in. If you signed in for a move, run candle auth logout --profile <that profile> here, and approve from the owner's machine.";
 var unsupported = {
   code: "KEY_SIGNER_UNSUPPORTED",
   message: "This Candle API does not serve key signers yet; nothing changed.",
@@ -54026,6 +54955,7 @@ async function teeSignerNew(args, ctx) {
     await writeOut(ctx, out, recorded);
     return reportApproved(ctx, view, recorded, { resumed: true, requested: false });
   }
+  let replaces = null;
   let resumed = entry !== undefined;
   if (entry === undefined) {
     const all = allSignerWallets(view);
@@ -54040,6 +54970,11 @@ async function teeSignerNew(args, ctx) {
       }, json);
       return 1;
     }
+    if (active !== null) {
+      replaces = { fingerprint: active.fingerprint, wallets: view.wallets.onSigner.length };
+      deps.stderr.write(`Key ${keyPrefix} already has active signer ${replaces.fingerprint}. Approving this request replaces it. ${replaces.wallets > 0 ? `Its ${plural(replaces.wallets, "wallet")} keep trading only from the machine that holds it until candle keys signer move ${keyPrefix} runs there.` : "It owns no wallets, so nothing has to move."}
+`);
+    }
     const pair = generatePair();
     const spkiSha256 = spkiSha256Of(pair.publicKeyDer);
     const ref = keySignerRef(keyPrefix, spkiSha256);
@@ -54069,7 +55004,8 @@ async function teeSignerNew(args, ctx) {
         const reread = await readSigner(ctx, "self", { apiKey });
         return reportApproved(ctx, reread.ok ? reread.body : view, recorded, {
           resumed,
-          requested: true
+          requested: true,
+          replaces
         });
       }
     }
@@ -54080,6 +55016,9 @@ async function teeSignerNew(args, ctx) {
     return 1;
   }
   const body = requested.body;
+  if (body.supersededPending)
+    deps.stderr.write(`An earlier pending request for this key was cancelled.
+`);
   if (body.spkiSha256 !== entry.spkiSha256) {
     writeLocalFailure(deps, {
       code: "KEY_SIGNER_CHANGED",
@@ -54109,7 +55048,7 @@ async function teeSignerNew(args, ctx) {
     if (now !== null && now.spkiSha256 === entry.spkiSha256) {
       const recorded = { ...entry, signerQuorumId: now.signerQuorumId };
       await saveKeySignerEntry(deps, recorded);
-      return reportApproved(ctx, view, recorded, { resumed, requested: true });
+      return reportApproved(ctx, view, recorded, { resumed, requested: true, replaces });
     }
     if (view.pending === null || view.pending.spkiSha256 !== entry.spkiSha256) {
       writeLocalFailure(deps, {
@@ -54153,6 +55092,7 @@ function reportApproved(ctx, view, entry, how) {
       signerQuorumId: entry.signerQuorumId,
       resumed: how.resumed,
       requested: how.requested,
+      replaces: how.replaces ?? null,
       wallets: {
         onSigner: onSigner.map((w) => w.id),
         legacy: legacy.map((w) => w.id),
@@ -54261,6 +55201,7 @@ async function keysSignerApprove(args, ctx) {
     "",
     "Requested from a machine using this key. Compare the fingerprint with what that machine printed.",
     `Wallets on this key: ${all.length}.`,
+    ...active !== null ? [`Approving replaces signer ${active.fingerprint} as this key's active signer.`] : [],
     ...active !== null && onActive > 0 ? [
       `${plural(onActive, "wallet")} ${onActive === 1 ? "is" : "are"} owned by signer ${active.fingerprint}. They keep trading from the machine that holds that signer until you move them.`
     ] : [],
@@ -58254,1491 +59195,662 @@ async function externalList(args, ctx) {
       return 0;
     }
     for (const row of rows) {
-      deps.stdout.write(`${row.address}
-`);
-      deps.stdout.write(`  label       ${row.label || "(none)"}
-`);
-      if (row.derivation)
-        deps.stdout.write(`  derivation  ${row.derivation}
-`);
-      if (row.exposureUnknown)
-        deps.stdout.write(`  history     unknown (restored from the phrase)
-`);
-    }
-    deps.stdout.write(`External wallets are never delegated to Privy and never registered with Candle. Balances are read over your own RPC; Candle is not in their transactions.
-`);
-    return 0;
-  });
-}
-async function externalSweep(args, ctx) {
-  const parsed = parseArgs(args, {
-    valueFlags: ["--to", "--rpc-url", "--keystore"],
-    booleanFlags: ["--accept-older-copy"],
-    pathFlags: ["--keystore"]
-  });
-  if ("error" in parsed)
-    return usage(ctx, parsed.error);
-  const [source, extra] = parsed.positionals;
-  if (!source || extra !== undefined) {
-    return usage(ctx, "Usage: candle external sweep <external> --to <vault> [--rpc-url <url>]");
-  }
-  const to = parsed.values["--to"];
-  if (!to)
-    return usage(ctx, "--to <vault> is required: the vault receive key everything is sent to (never inferred).");
-  const solana = await openSolanaClient(ctx, parsed.values["--rpc-url"]);
-  if ("error" in solana)
-    return usage(ctx, solana.error);
-  if (!refuseEnvPassphrase(ctx))
-    return 1;
-  if (!requireTty(ctx, "external sweep"))
-    return 1;
-  const { deps } = ctx;
-  const resolvedVault = vaultPathFor(ctx, parsed);
-  if ("error" in resolvedVault)
-    return usage(ctx, resolvedVault.error);
-  const path = resolvedVault.path;
-  return runVaultCommand(ctx, async ({ hold }) => {
-    const raw = await requireVaultRaw(ctx, resolvedVault);
-    const opened = await unlockInteractively(ctx, path, raw, {
-      acceptOlderCopy: parsed.booleans.has("--accept-older-copy")
-    });
-    const vault = hold(opened.vault);
-    assertNotEvmEntry(vault.index, source, "external sweep");
-    assertNotEvmEntry(vault.index, to, "external sweep");
-    const sourceEntry = requireExternalEntry(vault.index, source);
-    const destination = findVaultRoleEntry(vault.index, to);
-    if (destination === undefined || destination.role !== "vault") {
-      const other = vault.index.entries.find((candidate) => candidate.label === to || candidate.address === to);
-      throw new VaultError("VAULT_INDEX_INVALID", other === undefined ? `No vault key matches --to ${to}.` : `--to ${to} is ${describeRole(other)}; a sweep goes to a role:vault receive key only.`, { suggestion: "Name a vault key by label or address: candle vault status --unlock", exitCode: 2 });
-    }
-    if (destination.address === sourceEntry.address) {
-      return usage(ctx, "The source and the destination are the same address.");
-    }
-    if (!ctx.json) {
-      deps.stdout.write(`Sweep everything from external wallet:
-`);
-      deps.stdout.write(`  source      ${sourceEntry.label}  ${sourceEntry.address}
-`);
-      deps.stdout.write(`to vault receive key:
-`);
-      deps.stdout.write(`  destination ${destination.label}  ${destination.address}
-`);
-      deps.stdout.write(`SOL, classic SPL and Token-2022 balances move, signed locally with the external key.
-`);
-    }
-    await confirmLastSix(ctx, destination.address, "the vault destination");
-    await opened.confirm(`sweep ${sourceEntry.label} to ${destination.address}`);
-    const secret = await decryptKey(vault, sourceEntry.id);
-    try {
-      const outcome = await sweepEverythingTo({
-        rpc: solana.rpc,
-        ctx,
-        secret64: secret,
-        owner: sourceEntry.address,
-        destination: destination.address,
-        say: ctx.json ? () => {} : (line) => deps.stdout.write(`${line}
-`)
-      });
-      const complete = outcome.leftovers.length === 0;
-      if (ctx.json) {
-        writeJson(deps, {
-          ok: complete,
-          source: sourceEntry.address,
-          sourceLabel: sourceEntry.label,
-          destination: destination.address,
-          receipts: outcome.receipts,
-          leftovers: outcome.leftovers
-        });
-        return complete ? 0 : 3;
-      }
-      if (outcome.receipts.length === 0 && outcome.leftovers.length === 0) {
-        deps.stdout.write(`Nothing to sweep: no balances found.
-`);
-        return 0;
-      }
-      if (complete) {
-        deps.stdout.write(`Swept: ${outcome.receipts.length} transaction(s) finalized.
-`);
-        return 0;
-      }
-      deps.stdout.write(`Sweep incomplete: ${outcome.leftovers.length} leftover(s).
-`);
-      for (const l of outcome.leftovers) {
-        deps.stdout.write(`  - ${l.kind}${l.mint ? ` ${l.mint}` : ""}${l.amountRaw ? ` (${l.amountRaw} raw)` : ""}: ${l.detail}
-`);
-      }
-      deps.stdout.write(`Re-run this sweep once the leftovers are resolved.
-`);
-      return 3;
-    } finally {
-      wipe(secret);
-    }
-  });
-}
-
-// src/commands/help.ts
-async function help(args, ctx) {
-  const word2 = args[0];
-  if (word2 === undefined) {
-    ctx.deps.stdout.write(renderTopLevel());
-    return 0;
-  }
-  const topic = renderTopic(word2);
-  if (topic === undefined) {
-    ctx.deps.stderr.write(`Unknown command: ${word2}
-`);
-    ctx.deps.stderr.write(renderTopLevel());
-    return 1;
-  }
-  ctx.deps.stdout.write(topic);
-  return 0;
-}
-
-// src/index.ts
-init_keys();
-
-// src/commands/keys-access.ts
-init_agent_key_access();
-init_args();
-init_deps();
-init_profiles();
-init_render();
-init_promote_support();
-init_keys();
-init_tee_rebind();
-var KEYS_PATH4 = "/api/v1/agent/keys";
-var USAGE_ACCESS = `Usage: candle keys access <prefix|label|self> --access <read|read-write|read-write-transfer> [--yes] [--json]
-` + "       candle keys access <prefix|label> --history [--json]";
-var SELF = "self";
-var CLI_SPELLING = Object.fromEntries(Object.entries(ACCESS_LEVELS).map(([spelling, preset]) => [preset, spelling]));
-var NO_API_KEY2 = {
-  code: "API_KEY_REQUIRED",
-  message: "candle keys access self changes the profile's own API key, and this profile holds none.",
-  suggestion: "Select the profile holding the key with --profile, or name the key by prefix to use the device token."
-};
-var REQUIRES_TTY = {
-  code: "KEY_ACCESS_REQUIRES_TTY",
-  message: "Widening a key needs a terminal: the key prefix is typed back, and nothing else supplies it.",
-  suggestion: "Run it in an interactive shell; there is no flag and no environment variable to widen a key."
-};
-function levelName(side) {
-  const preset = side.access ?? presetForScopes(side.scopes);
-  if (preset)
-    return AGENT_KEY_PRESET_LABELS[preset];
-  return `custom (${accessCell(side.scopes)})`;
-}
-function keyName2(keyPrefix, label) {
-  const cleaned = labelCell(label ?? undefined);
-  return cleaned ? `${keyPrefix} (${cleaned})` : keyPrefix;
-}
-function listWords(words) {
-  return words.length <= 1 ? words.join("") : `${words.slice(0, -1).join(", ")} and ${words[words.length - 1]}`;
-}
-function linkedTransferLine(ready) {
-  const assets = Object.entries(ready.assets);
-  const missing = assets.filter(([, ok]) => !ok).map(([asset]) => asset.toUpperCase());
-  const readyAssets = assets.filter(([, ok]) => ok).map(([asset]) => asset.toUpperCase());
-  const needs = [];
-  if (!ready.txLimit)
-    needs.push("a USD transaction limit");
-  if (missing.length > 0) {
-    needs.push(`${missing.map((asset) => `a ${asset}`).join(" and ")} spend cap`);
-  }
-  if (needs.length === 0)
-    return null;
-  const readyPart = readyAssets.length > 0 ? `; ${listWords(readyAssets)} ${readyAssets.length === 1 ? "is" : "are"} ready` : "";
-  return [
-    `Warning: to send to linked wallets it also needs ${needs.join(" and ")}${readyPart}.`,
-    "         Set them in the web key manager: Agents, Keys, this key, Spend limits."
-  ].join(`
-`);
-}
-var LOCALLY_RENDERED = new Set(["MOVES_FUNDS", "VAULT_TRANSFER_READY", "LINKED_TRANSFER_NEEDS_LIMITS"]);
-function accessScreen(shown, identity) {
-  const environment = candleEnvironment(identity.apiUrl) ?? "not a Candle host";
-  const label = labelCell(shown.label ?? undefined);
-  const lines = [
-    `Key             ${shown.keyPrefix}${label ? `  ${label}` : ""}`,
-    `Candle account  ${identity.account}`,
-    `API             ${identity.apiUrl}  (${environment})`,
-    "",
-    `Access          ${levelName(shown.from)}  ->  ${levelName(shown.to)}   (${shown.direction})`,
-    `Adds            ${shown.added.length > 0 ? formatScopesForSummary(shown.added) : "nothing"}`,
-    `Removes         ${shown.removed.length > 0 ? shown.removed.join(", ") : "nothing"}`,
-    ""
-  ];
-  const bound = shown.effects.boundTeeWallets;
-  if (bound && bound.count > 0) {
-    const names = bound.sample.map((w) => labelCell(w.label ?? undefined) || shortAddress(w.address));
-    const more = bound.count > names.length ? `, and ${bound.count - names.length} more` : "";
-    lines.push(`TEE wallets on this key: ${bound.count}  (${names.join(", ")}${more})`);
-    if (shown.direction === "widen" && shown.added.includes("transfer:bound")) {
-      lines.push("It can move these wallets' funds to their vaults as soon as you confirm.");
-    }
-  }
-  const ready = shown.effects.linkedTransferReady;
-  if (shown.direction === "widen" && ready) {
-    const line = linkedTransferLine(ready);
-    if (line)
-      lines.push(line);
-  }
-  for (const warning of shown.warnings) {
-    if (!LOCALLY_RENDERED.has(warning.code))
-      lines.push(`Warning: ${warning.message}`);
-  }
-  if (lines[lines.length - 1] !== "")
-    lines.push("");
-  return lines.join(`
-`);
-}
-function accessFailureDetails(result, context) {
-  let code = result.code;
-  let message = result.message;
-  let suggestion;
-  if (result.status === 404 && result.code === undefined) {
-    code = "KEY_ACCESS_UNSUPPORTED";
-    message = context.history ? "This Candle API has no key access history yet." : "This Candle API cannot change a key's access yet; nothing changed.";
-  } else if (result.code === "LOOSEN_REQUIRES_SESSION" && context.self) {
-    const level = context.preset ? CLI_SPELLING[context.preset] : "<level>";
-    suggestion = `Widen it from a signed-in session or with the device token: candle keys access <prefix> --access ${level}`;
-  } else if (result.code === "KEY_ACCESS_STALE") {
-    suggestion = "Run the command again; the preview will show the key's current access.";
-  } else if (result.code === "KEY_ACCESS_PARTNER_KEY") {
-    suggestion = "Partner keys are managed by Candle; ask your Candle contact to change one.";
-  } else if (result.status === 404 && result.code === "VALIDATION_FAILED") {
-    suggestion = "Run: candle keys list, to see this account's keys and their prefixes.";
-  }
-  return { code: code ?? `HTTP ${result.status}`, message, ...suggestion !== undefined ? { suggestion } : {} };
-}
-function writeAccessFailure(ctx, result, context) {
-  const { deps, apiUrl, json } = ctx;
-  const { code, message, suggestion } = accessFailureDetails(result, context);
-  const envelope = errorEnvelope({ ...result, code, message }, { apiUrl, authType: context.self ? "key" : "device" });
-  if (json) {
-    deps.stdout.write(`${JSON.stringify({ ...envelope, ...suggestion ? { suggestion } : {} })}
-`);
-  } else {
-    deps.stderr.write(`${code}: ${message}${suggestion ? ` ${suggestion}` : ""}
-`);
-  }
-  return 1;
-}
-async function keysAccess(args, ctx) {
-  const { deps, apiUrl, json } = ctx;
-  const parsed = parseArgs(args, { valueFlags: ["--access"], booleanFlags: ["--yes", "--history"] });
-  if ("error" in parsed) {
-    writeUsageFailure(deps, parsed.error, json);
-    return 2;
-  }
-  const [target, extra] = parsed.positionals;
-  if (target === undefined || extra !== undefined) {
-    writeUsageFailure(deps, `${extra !== undefined ? `Unexpected argument: ${extra}. ` : "Name one key. "}${USAGE_ACCESS}`, json);
-    return 2;
-  }
-  const accessFlag = parsed.values["--access"];
-  const history = parsed.booleans.has("--history");
-  const yes = parsed.booleans.has("--yes");
-  if (accessFlag === undefined === !history) {
-    writeUsageFailure(deps, `Pass exactly one of --access and --history. ${USAGE_ACCESS}`, json);
-    return 2;
-  }
-  if (history) {
-    if (yes) {
-      writeUsageFailure(deps, "--yes only applies to a change, not to --history.", json);
-      return 2;
-    }
-    if (target === SELF) {
-      writeUsageFailure(deps, "--history needs the device token: name the key by prefix or label, not self.", json);
-      return 2;
-    }
-    return keysAccessHistory(target, ctx);
-  }
-  const preset = ACCESS_LEVELS[accessFlag];
-  if (preset === undefined) {
-    writeUsageFailure(deps, `--access must be one of: ${Object.keys(ACCESS_LEVELS).join(", ")}.`, json);
-    return 2;
-  }
-  await printIdentity(ctx);
-  const self = target === SELF;
-  let path;
-  let auth;
-  let credentials;
-  if (self) {
-    const apiKey = await resolveApiKey(deps, ctx.profile);
-    if (!apiKey) {
-      writeLocalFailure(deps, NO_API_KEY2, json);
-      return 1;
-    }
-    path = `${KEYS_PATH4}/self/access`;
-    auth = "key";
-    credentials = { apiKey };
-  } else {
-    const deviceToken = await resolveDeviceToken(deps, ctx.profile);
-    if (!deviceToken) {
-      writeLocalFailure(deps, NO_DEVICE_TOKEN, json);
-      return 1;
-    }
-    const resolved = await resolveTargetKey(ctx, deviceToken, target, {
-      codePrefix: "KEY_ACCESS",
-      writeListFailure: (result2) => writeAccessFailure(ctx, result2, { self: false })
-    });
-    if (!resolved.ok)
-      return resolved.code;
-    path = `${KEYS_PATH4}/${encodeURIComponent(resolved.keyPrefix)}/access`;
-    auth = "device";
-    credentials = { deviceToken };
-  }
-  const failureContext = { self, preset };
-  const call = (body) => apiRequest(path, { method: "PUT", body, auth, credentials, apiUrl, fetch: deps.fetch, env: deps.env });
-  const preview = await call({ access: preset, dryRun: true });
-  if (!preview.ok)
-    return writeAccessFailure(ctx, preview, failureContext);
-  const shown = preview.body;
-  const name2 = keyName2(shown.keyPrefix, shown.label);
-  if (shown.direction === "unchanged") {
-    if (json)
-      deps.stdout.write(`${JSON.stringify({ ...shown, command: "keys access" })}
-`);
-    else
-      deps.stdout.write(`${name2} is already ${levelName(shown.to)}. Nothing changed.
-`);
-    return 0;
-  }
-  const widen = shown.direction === "widen";
-  const interactive = deps.isTTY.stdin && deps.isTTY.stdout;
-  if (widen && yes) {
-    writeUsageFailure(deps, "--yes only skips the prompt when narrowing; nothing changed.", json);
-    return 2;
-  }
-  if (widen && !interactive) {
-    writeLocalFailure(deps, REQUIRES_TTY, json);
-    return 1;
-  }
-  if (!widen && !yes && !interactive) {
-    writeUsageFailure(deps, "Narrowing a key without a terminal needs --yes; nothing changed. Run it in an interactive shell, or pass --yes.", json);
-    return 2;
-  }
-  const config = await deps.readConfig();
-  const fields = effectiveProfileFields(config, ctx.profile);
-  const account = fields.account ? shortAddress(fields.account) : "unknown";
-  deps.stderr.write(`${accessScreen(shown, { account: fields.username ? `${fields.username}  (${account})` : account, apiUrl })}
-`);
-  if (widen) {
-    const typed = await deps.promptLine(`Type the key prefix ${shown.keyPrefix} to widen it: `);
-    if (typed.trim() !== shown.keyPrefix) {
-      writeLocalFailure(deps, {
-        code: "KEY_ACCESS_NOT_ACKNOWLEDGED",
-        message: `The acknowledgement is the key prefix ${shown.keyPrefix}; nothing changed.`,
-        suggestion: `Run the command again and type ${shown.keyPrefix} at the prompt.`
-      }, json);
-      return 1;
-    }
-  } else if (!yes) {
-    const answer = await deps.promptLine(`Change ${name2} from ${levelName(shown.from)} to ${levelName(shown.to)}? [y/N] `);
-    if (!["y", "yes"].includes(answer.trim().toLowerCase())) {
-      writeLocalFailure(deps, {
-        code: "KEY_ACCESS_NOT_ACKNOWLEDGED",
-        message: "Not confirmed; nothing changed.",
-        suggestion: "Run the command again and answer y, or pass --yes."
-      }, json);
-      return 1;
-    }
-  }
-  const committed = await call({ access: preset, expectScopes: shown.from.scopes });
-  if (!committed.ok)
-    return writeAccessFailure(ctx, committed, failureContext);
-  const result = committed.body;
-  if (fields.keyPrefix !== undefined && fields.keyPrefix === result.keyPrefix && result.direction !== "unchanged") {
-    const scopes = scopesForPreset(result.to.access);
-    if (ctx.profile)
-      await deps.updateProfile(ctx.profile, { scopes });
-    else
-      await deps.writeConfig({ scopes });
-  }
-  if (json) {
-    deps.stdout.write(`${JSON.stringify({ ...result, command: "keys access" })}
-`);
-    return 0;
-  }
-  if (result.direction === "unchanged") {
-    deps.stdout.write(`${keyName2(result.keyPrefix, result.label)} is already ${levelName(result.to)}. Nothing changed.
-`);
-    return 0;
-  }
-  deps.stdout.write(`Changed ${keyName2(result.keyPrefix, result.label)} to ${levelName(result.to)}.` + `${result.changeId ? ` Change id ${result.changeId}` : ""}
-`);
-  return 0;
-}
-async function keysAccessHistory(target, ctx) {
-  const { deps, apiUrl, json } = ctx;
-  await printIdentity(ctx);
-  const deviceToken = await resolveDeviceToken(deps, ctx.profile);
-  if (!deviceToken) {
-    writeLocalFailure(deps, NO_DEVICE_TOKEN, json);
-    return 1;
-  }
-  const resolved = await resolveTargetKey(ctx, deviceToken, target, {
-    codePrefix: "KEY_ACCESS",
-    writeListFailure: (result2) => writeAccessFailure(ctx, result2, { self: false, history: true })
-  });
-  if (!resolved.ok)
-    return resolved.code;
-  const result = await apiRequest(`${KEYS_PATH4}/${encodeURIComponent(resolved.keyPrefix)}/access-changes`, {
-    auth: "device",
-    credentials: { deviceToken },
-    apiUrl,
-    fetch: deps.fetch,
-    env: deps.env
-  });
-  if (!result.ok)
-    return writeAccessFailure(ctx, result, { self: false, history: true });
-  if (json) {
-    deps.stdout.write(`${JSON.stringify({ ...result.body, command: "keys access" })}
+      deps.stdout.write(`${row.address}
 `);
-    return 0;
-  }
-  const rows = result.body.changes ?? [];
-  if (rows.length === 0) {
-    deps.stdout.write(`No access changes on key ${resolved.keyPrefix}.
+      deps.stdout.write(`  label       ${row.label || "(none)"}
 `);
-    return 0;
-  }
-  deps.stdout.write(`${renderTable(["Time", "From", "To", "Actor", "Device or key"], rows.map((row) => [
-    formatTimestamp(row.at),
-    levelName(row.from),
-    levelName(row.to),
-    row.actor,
-    row.actorDevicePrefix ?? row.actorKeyPrefix ?? ""
-  ]))}
+      if (row.derivation)
+        deps.stdout.write(`  derivation  ${row.derivation}
 `);
-  if (rows.some((row) => row.actor === "device"))
-    deps.stdout.write(`${PORTAL_REVOKE_LINE}
+      if (row.exposureUnknown)
+        deps.stdout.write(`  history     unknown (restored from the phrase)
 `);
-  return 0;
-}
-
-// src/index.ts
-init_keys_embedded_wallet();
-
-// src/commands/keys-wallets.ts
-init_args();
-init_deps();
-init_profiles();
-init_render();
-var NO_API_KEY3 = {
-  code: "NO_API_KEY",
-  message: "No API key for this profile.",
-  suggestion: "Set CANDLE_API_KEY, or run `candle keys create` and store one."
-};
-function widenRefusedHint(prefix, walletIds) {
-  const wallets2 = walletIds.length > 0 ? walletIds.join(" ") : "<wallet...>";
-  return `To move TEE wallets to this key, run: candle tee rebind ${wallets2} --to-key ${prefix} ` + "(owner, device token; --label-prefix <p> names many at once). To grant a linked wallet to the key " + "instead, use the agent console's Agents tab in a signed-in session. If `tee rebind` says the wallets " + "are already bound, grant them to the key in the agent console's Agents tab (signed in).";
-}
-function formatTimestamp2(ms) {
-  return ms ? new Date(ms).toISOString().replace("T", " ").slice(0, 16) : "-";
+    }
+    deps.stdout.write(`External wallets are never delegated to Privy and never registered with Candle. Balances are read over your own RPC; Candle is not in their transactions.
+`);
+    return 0;
+  });
 }
-async function keysWalletsList(args, ctx) {
-  const { deps, apiUrl, json } = ctx;
-  const parsed = parseArgs(args, {});
-  if ("error" in parsed) {
-    writeUsageFailure(deps, parsed.error, json);
-    return 2;
-  }
-  const prefix = parsed.positionals[0];
-  if (!prefix) {
-    writeUsageFailure(deps, "Usage: candle keys wallets <prefix>", json);
-    return 2;
+async function externalSweep(args, ctx) {
+  const parsed = parseArgs(args, {
+    valueFlags: ["--to", "--rpc-url", "--keystore"],
+    booleanFlags: ["--accept-older-copy"],
+    pathFlags: ["--keystore"]
+  });
+  if ("error" in parsed)
+    return usage(ctx, parsed.error);
+  const [source, extra] = parsed.positionals;
+  if (!source || extra !== undefined) {
+    return usage(ctx, "Usage: candle external sweep <external> --to <vault> [--rpc-url <url>]");
   }
-  await printIdentity(ctx);
-  const apiKey = await resolveApiKey(deps, ctx.profile);
-  if (!apiKey) {
-    writeLocalFailure(deps, NO_API_KEY3, json);
+  const to = parsed.values["--to"];
+  if (!to)
+    return usage(ctx, "--to <vault> is required: the vault receive key everything is sent to (never inferred).");
+  const solana = await openSolanaClient(ctx, parsed.values["--rpc-url"]);
+  if ("error" in solana)
+    return usage(ctx, solana.error);
+  if (!refuseEnvPassphrase(ctx))
     return 1;
-  }
-  const result = await apiRequest(`/api/v1/agent/keys/${encodeURIComponent(prefix)}/wallets`, {
-    auth: "key",
-    credentials: { apiKey },
-    apiUrl,
-    fetch: deps.fetch,
-    env: deps.env
-  });
-  if (!result.ok) {
-    writeFailure(deps, result, { apiUrl, authType: "key" }, json);
+  if (!requireTty(ctx, "external sweep"))
     return 1;
-  }
-  if (json) {
-    deps.stdout.write(`${JSON.stringify(result.body)}
+  const { deps } = ctx;
+  const resolvedVault = vaultPathFor(ctx, parsed);
+  if ("error" in resolvedVault)
+    return usage(ctx, resolvedVault.error);
+  const path = resolvedVault.path;
+  return runVaultCommand(ctx, async ({ hold }) => {
+    const raw = await requireVaultRaw(ctx, resolvedVault);
+    const opened = await unlockInteractively(ctx, path, raw, {
+      acceptOlderCopy: parsed.booleans.has("--accept-older-copy")
+    });
+    const vault = hold(opened.vault);
+    assertNotEvmEntry(vault.index, source, "external sweep");
+    assertNotEvmEntry(vault.index, to, "external sweep");
+    const sourceEntry = requireExternalEntry(vault.index, source);
+    const destination = findVaultRoleEntry(vault.index, to);
+    if (destination === undefined || destination.role !== "vault") {
+      const other = vault.index.entries.find((candidate) => candidate.label === to || candidate.address === to);
+      throw new VaultError("VAULT_INDEX_INVALID", other === undefined ? `No vault key matches --to ${to}.` : `--to ${to} is ${describeRole(other)}; a sweep goes to a role:vault receive key only.`, { suggestion: "Name a vault key by label or address: candle vault status --unlock", exitCode: 2 });
+    }
+    if (destination.address === sourceEntry.address) {
+      return usage(ctx, "The source and the destination are the same address.");
+    }
+    if (!ctx.json) {
+      deps.stdout.write(`Sweep everything from external wallet:
 `);
-    return 0;
-  }
-  const body = result.body;
-  deps.stdout.write(body.walletScope === "selected" ? `Scope: selected — this profile can only spend from the wallets below.
-` : `Scope: all — this profile can spend from every wallet on the account, listed here or not.
+      deps.stdout.write(`  source      ${sourceEntry.label}  ${sourceEntry.address}
 `);
-  if (body.profileId)
-    deps.stdout.write(`Profile: ${body.profileId}
+      deps.stdout.write(`to vault receive key:
 `);
-  if (body.wallets.length === 0) {
-    deps.stdout.write(`No wallets assigned.
+      deps.stdout.write(`  destination ${destination.label}  ${destination.address}
 `);
-    return 0;
-  }
-  const rows = body.wallets.map((w) => [
-    w.linkedWalletId,
-    w.chain,
-    w.address,
-    w.label ?? "-",
-    w.spendCapable ? "yes" : "no",
-    formatTimestamp2(w.assignedAt)
-  ]);
-  deps.stdout.write(`${renderTable(["Id", "Chain", "Address", "Label", "Can sign", "Assigned"], rows)}
+      deps.stdout.write(`SOL, classic SPL and Token-2022 balances move, signed locally with the external key.
 `);
-  return 0;
-}
-async function keysWalletsSet(args, ctx) {
-  const { deps, apiUrl, json } = ctx;
-  const parsed = parseArgs(args, { valueFlags: ["--wallets"] });
-  if ("error" in parsed) {
-    writeUsageFailure(deps, parsed.error, json);
-    return 2;
-  }
-  const prefix = parsed.positionals[0];
-  if (!prefix) {
-    writeUsageFailure(deps, "Usage: candle keys wallets set <prefix> --wallets <id,id,...>", json);
-    return 2;
-  }
-  const raw = parsed.values["--wallets"];
-  if (raw === undefined) {
-    writeUsageFailure(deps, 'Missing --wallets. Pass a comma-separated list, or "" to assign none.', json);
-    return 2;
-  }
-  const walletIds = raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
-  await printIdentity(ctx);
-  const apiKey = await resolveApiKey(deps, ctx.profile);
-  if (!apiKey) {
-    writeLocalFailure(deps, NO_API_KEY3, json);
-    return 1;
-  }
-  const result = await apiRequest(`/api/v1/agent/keys/${encodeURIComponent(prefix)}/wallets`, {
-    method: "PUT",
-    body: { walletIds },
-    auth: "key",
-    credentials: { apiKey },
-    apiUrl,
-    fetch: deps.fetch,
-    env: deps.env
-  });
-  if (!result.ok) {
-    if (result.code !== "LOOSEN_REQUIRES_SESSION") {
-      writeFailure(deps, result, { apiUrl, authType: "key" }, json);
-      return 1;
     }
-    const hint = widenRefusedHint(prefix, walletIds);
-    writeFailure(deps, { ...result, uiHint: hint }, { apiUrl, authType: "key" }, json);
-    if (!json)
-      deps.stderr.write(`${hint}
+    await confirmLastSix(ctx, destination.address, "the vault destination");
+    await opened.confirm(`sweep ${sourceEntry.label} to ${destination.address}`);
+    const secret = await decryptKey(vault, sourceEntry.id);
+    try {
+      const outcome = await sweepEverythingTo({
+        rpc: solana.rpc,
+        ctx,
+        secret64: secret,
+        owner: sourceEntry.address,
+        destination: destination.address,
+        say: ctx.json ? () => {} : (line) => deps.stdout.write(`${line}
+`)
+      });
+      const complete = outcome.leftovers.length === 0;
+      if (ctx.json) {
+        writeJson(deps, {
+          ok: complete,
+          source: sourceEntry.address,
+          sourceLabel: sourceEntry.label,
+          destination: destination.address,
+          receipts: outcome.receipts,
+          leftovers: outcome.leftovers
+        });
+        return complete ? 0 : 3;
+      }
+      if (outcome.receipts.length === 0 && outcome.leftovers.length === 0) {
+        deps.stdout.write(`Nothing to sweep: no balances found.
 `);
-    return 1;
-  }
-  if (json) {
-    deps.stdout.write(`${JSON.stringify(result.body)}
+        return 0;
+      }
+      if (complete) {
+        deps.stdout.write(`Swept: ${outcome.receipts.length} transaction(s) finalized.
 `);
-    return 0;
-  }
-  deps.stdout.write(walletIds.length === 0 ? `Cleared every wallet assignment on ${prefix}.
-` : `Assigned ${walletIds.length} wallet${walletIds.length === 1 ? "" : "s"} to ${prefix}.
+        return 0;
+      }
+      deps.stdout.write(`Sweep incomplete: ${outcome.leftovers.length} leftover(s).
 `);
-  return 0;
-}
-async function keysWalletsScope(args, ctx) {
-  const { deps, apiUrl, json } = ctx;
-  const parsed = parseArgs(args, { valueFlags: ["--scope"] });
-  if ("error" in parsed) {
-    writeUsageFailure(deps, parsed.error, json);
-    return 2;
-  }
-  const prefix = parsed.positionals[0];
-  const scope = parsed.values["--scope"];
-  if (!prefix || scope !== "all" && scope !== "selected") {
-    writeUsageFailure(deps, "Usage: candle keys wallets scope <prefix> --scope <all|selected>", json);
-    return 2;
-  }
-  await printIdentity(ctx);
-  const apiKey = await resolveApiKey(deps, ctx.profile);
-  if (!apiKey) {
-    writeLocalFailure(deps, NO_API_KEY3, json);
-    return 1;
-  }
-  const result = await apiRequest(`/api/v1/agent/keys/${encodeURIComponent(prefix)}/wallet-scope`, {
-    method: "PUT",
-    body: { scope },
-    auth: "key",
-    credentials: { apiKey },
-    apiUrl,
-    fetch: deps.fetch,
-    env: deps.env
-  });
-  if (!result.ok) {
-    writeFailure(deps, result, { apiUrl, authType: "key" }, json);
-    return 1;
-  }
-  if (json) {
-    deps.stdout.write(`${JSON.stringify(result.body)}
+      for (const l of outcome.leftovers) {
+        deps.stdout.write(`  - ${l.kind}${l.mint ? ` ${l.mint}` : ""}${l.amountRaw ? ` (${l.amountRaw} raw)` : ""}: ${l.detail}
+`);
+      }
+      deps.stdout.write(`Re-run this sweep once the leftovers are resolved.
 `);
+      return 3;
+    } finally {
+      wipe(secret);
+    }
+  });
+}
+
+// src/commands/help.ts
+async function help(args, ctx) {
+  const word2 = args[0];
+  if (word2 === undefined) {
+    ctx.deps.stdout.write(renderTopLevel());
     return 0;
   }
-  deps.stdout.write(scope === "selected" ? `${prefix} is now limited to its assigned wallets.
-` : `${prefix} can now spend from every wallet on the account.
+  const topic = renderTopic(word2);
+  if (topic === undefined) {
+    ctx.deps.stderr.write(`Unknown command: ${word2}
 `);
+    ctx.deps.stderr.write(renderTopLevel());
+    return 1;
+  }
+  ctx.deps.stdout.write(topic);
   return 0;
 }
-async function keysWallets(args, ctx) {
-  const [verb, ...rest] = args;
-  if (verb === "set")
-    return keysWalletsSet(rest, ctx);
-  if (verb === "scope")
-    return keysWalletsScope(rest, ctx);
-  return keysWalletsList(args, ctx);
-}
 
-// src/commands/launch.ts
-init_args();
-init_evm_lite();
-init_render();
-init_solana_endpoint();
-init_solana_lite();
-init_trading();
-import { randomUUID as randomUUID2 } from "node:crypto";
+// src/index.ts
+init_keys();
 
-// src/commands/swap.ts
-init_zod();
+// src/commands/keys-access.ts
+init_agent_key_access();
 init_args();
-init_bridge();
-init_evm_lite();
+init_deps();
+init_profiles();
 init_render();
-init_solana_endpoint();
-init_solana_lite();
-init_trading();
-import { randomUUID } from "node:crypto";
-function tradingFailure(ctx, error, id) {
-  if (error instanceof TradingUsage) {
-    writeUsageFailure(ctx.deps, error.message, ctx.json);
-    return 2;
-  }
-  writeLocalFailure(ctx.deps, {
-    code: error instanceof TradingError ? error.code : "TRADING_FAILED",
-    message: `${error instanceof Error ? describeRpcFailure(error) : "Trading failed."}${id ? ` Operation ${id}; use candle swap status ${id} before another attempt.` : ""}`,
-    ...error instanceof TradingError && error.suggestion ? { suggestion: error.suggestion } : {},
-    ...error instanceof TradingError && error.details ? { details: error.details } : {}
-  }, ctx.json);
-  return error instanceof TradingError ? error.exitCode : 1;
-}
-function lazySolanaClient(ctx, flag) {
-  let pending;
-  return () => {
-    pending ??= tradingSolanaClient(ctx, flag);
-    return pending;
-  };
+init_promote_support();
+init_keys();
+init_tee_rebind();
+var KEYS_PATH4 = "/api/v1/agent/keys";
+var USAGE_ACCESS = `Usage: candle keys access <prefix|label|self> --access <read|read-write|read-write-transfer> [--yes] [--json]
+` + "       candle keys access <prefix|label> --history [--json]";
+var SELF = "self";
+var CLI_SPELLING = Object.fromEntries(Object.entries(ACCESS_LEVELS).map(([spelling, preset]) => [preset, spelling]));
+var NO_API_KEY2 = {
+  code: "API_KEY_REQUIRED",
+  message: "candle keys access self changes the profile's own API key, and this profile holds none.",
+  suggestion: "Select the profile holding the key with --profile, or name the key by prefix to use the device token."
+};
+var REQUIRES_TTY = {
+  code: "KEY_ACCESS_REQUIRES_TTY",
+  message: "Widening a key needs a terminal: the key prefix is typed back, and nothing else supplies it.",
+  suggestion: "Run it in an interactive shell; there is no flag and no environment variable to widen a key."
+};
+function levelName(side) {
+  const preset = side.access ?? presetForScopes(side.scopes);
+  if (preset)
+    return AGENT_KEY_PRESET_LABELS[preset];
+  return `custom (${accessCell(side.scopes)})`;
 }
-async function tradingRead(ctx, client, read) {
-  try {
-    return await read();
-  } catch (error) {
-    if (isRateLimited(error))
-      throw tradingRateLimited(ctx, client.endpoint.host, error);
-    throw error;
-  }
+function keyName2(keyPrefix, label) {
+  const cleaned = labelCell(label ?? undefined);
+  return cleaned ? `${keyPrefix} (${cleaned})` : keyPrefix;
 }
-function printTradingResult(ctx, result) {
-  ctx.deps.stdout.write(ctx.json ? `${JSON.stringify(result)}
-` : `${JSON.stringify(result, null, 2)}
-`);
-  return 0;
+function listWords(words) {
+  return words.length <= 1 ? words.join("") : `${words.slice(0, -1).join(", ")} and ${words[words.length - 1]}`;
 }
-var settlementSchema = exports_external.object({
-  state: exports_external.enum(["settled", "pending", "failed", "uncertain"]),
-  settledOutRaw: exports_external.string().regex(/^\d+$/).optional()
-});
-function reportSettlement(ctx, settlement, out, id) {
-  const parsed = settlementSchema.safeParse(settlement);
-  const reading = parsed.success ? parsed.data : undefined;
-  if (reading?.state === "settled" && reading.settledOutRaw !== undefined)
-    ctx.deps.stderr.write(`settled ${decimalAmount(reading.settledOutRaw, out.decimals)} ${out.asset}
-`);
-  else {
-    const state = !reading ? "not measured" : reading.state === "settled" ? "settled, amount not measured" : reading.state;
-    ctx.deps.stderr.write(`Settlement: ${state}. Re-check with GET /api/v1/agent/swap/jobs/${id} (candle swap status ${id}).
-`);
+function linkedTransferLine(ready) {
+  const assets = Object.entries(ready.assets);
+  const missing = assets.filter(([, ok]) => !ok).map(([asset]) => asset.toUpperCase());
+  const readyAssets = assets.filter(([, ok]) => ok).map(([asset]) => asset.toUpperCase());
+  const needs = [];
+  if (!ready.txLimit)
+    needs.push("a USD transaction limit");
+  if (missing.length > 0) {
+    needs.push(`${missing.map((asset) => `a ${asset}`).join(" and ")} spend cap`);
   }
-  return settlement !== null && typeof settlement === "object" ? { settlement } : {};
-}
-function validClientId(id) {
-  return /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(id);
+  if (needs.length === 0)
+    return null;
+  const readyPart = readyAssets.length > 0 ? `; ${listWords(readyAssets)} ${readyAssets.length === 1 ? "is" : "are"} ready` : "";
+  return [
+    `Warning: to send to linked wallets it also needs ${needs.join(" and ")}${readyPart}.`,
+    "         Set them in the web key manager: Agents, Keys, this key, Spend limits."
+  ].join(`
+`);
 }
-async function lookupOperation(ctx, key, id, kind) {
-  const local = await savedOperation(ctx, key, id);
-  const kinds = kind ? [kind] : local && local.kind !== "lp" ? [local.kind] : ["trade", "swap", "launch"];
-  const found = [];
-  for (const candidate of kinds) {
-    try {
-      found.push({
-        ...operationSchema.parse(await request(ctx, key, jobPath(candidate, id))),
-        kind: candidate,
-        clientTradeId: id
-      });
-    } catch (error) {
-      if (!(error instanceof TradingError && error.code === "JOB_NOT_FOUND"))
-        throw error;
+var LOCALLY_RENDERED = new Set(["MOVES_FUNDS", "VAULT_TRANSFER_READY", "LINKED_TRANSFER_NEEDS_LIMITS"]);
+function accessScreen(shown, identity) {
+  const environment = candleEnvironment(identity.apiUrl) ?? "not a Candle host";
+  const label = labelCell(shown.label ?? undefined);
+  const lines = [
+    `Key             ${shown.keyPrefix}${label ? `  ${label}` : ""}`,
+    `Candle account  ${identity.account}`,
+    `API             ${identity.apiUrl}  (${environment})`,
+    "",
+    `Access          ${levelName(shown.from)}  ->  ${levelName(shown.to)}   (${shown.direction})`,
+    `Adds            ${shown.added.length > 0 ? formatScopesForSummary(shown.added) : "nothing"}`,
+    `Removes         ${shown.removed.length > 0 ? shown.removed.join(", ") : "nothing"}`,
+    ""
+  ];
+  const bound = shown.effects.boundTeeWallets;
+  if (bound && bound.count > 0) {
+    const names = bound.sample.map((w) => labelCell(w.label ?? undefined) || shortAddress(w.address));
+    const more = bound.count > names.length ? `, and ${bound.count - names.length} more` : "";
+    lines.push(`TEE wallets on this key: ${bound.count}  (${names.join(", ")}${more})`);
+    if (shown.direction === "widen" && shown.added.includes("transfer:bound")) {
+      lines.push("It can move these wallets' funds to their vaults as soon as you confirm.");
     }
   }
-  if (found.length > 1)
-    throw new TradingError("AMBIGUOUS_OPERATION", "This id exists on multiple rails; specify --kind trade, swap or launch.");
-  return found[0] ? { ...found[0], ...local?.signature ? { signature: local.signature } : {} } : null;
-}
-async function swapStatus(args, ctx) {
-  const parsed = parseArgs(args, { valueFlags: ["--kind"], booleanFlags: ["--wait"] });
-  if ("error" in parsed || parsed.positionals.length !== 1 || !validClientId(parsed.positionals[0] ?? "") || parsed.values["--kind"] !== undefined && !["trade", "swap", "launch"].includes(parsed.values["--kind"])) {
-    writeUsageFailure(ctx.deps, "Usage: candle swap status <id> [--kind trade|swap|launch] [--wait]", ctx.json);
-    return 2;
-  }
-  try {
-    const key = await tradingKey(ctx);
-    const id = parsed.positionals[0];
-    const kind = parsed.values["--kind"];
-    const facts = bridgeFactsOf((await savedOperation(ctx, key, id))?.bridge);
-    const found = await lookupOperation(ctx, key, id, kind);
-    if (!found)
-      throw new TradingError("JOB_NOT_FOUND", "No operation found on the selected rail(s). This command does not resend a write.");
-    const result = parsed.booleans.has("--wait") ? await waitForSettlement(ctx, key, id, found, facts) : { ...found, ...bridgeStatusField(ctx, found, facts) };
-    return printTradingResult(ctx, result);
-  } catch (error) {
-    return tradingFailure(ctx, error);
-  }
-}
-var bridgeFactsSchema = exports_external.object({
-  from: exports_external.enum(["SOL", "USDC", "ETH", "USDG"]),
-  to: exports_external.enum(["SOL", "USDC", "ETH", "USDG"]),
-  recipient: exports_external.string(),
-  statusCheck: exports_external.string().optional()
-});
-function bridgeFactsOf(raw) {
-  const parsed = bridgeFactsSchema.safeParse(raw);
-  return parsed.success ? parsed.data : undefined;
-}
-function isBridgeJob(job, facts) {
-  return facts !== undefined || job.bridge !== null && typeof job.bridge === "object";
-}
-function bridgeStatusField(ctx, found, facts) {
-  const job = found.job ?? {};
-  if (found.kind !== "swap" || !isBridgeJob(job, facts))
-    return {};
-  const status = describeBridgeJob(job, facts);
-  for (const line of status.lines)
-    ctx.deps.stderr.write(`${line}
-`);
-  const { lines: _lines, ...rest } = status;
-  return { bridgeStatus: rest };
-}
-function waitFinished(current, facts, sent) {
-  const job = current.job ?? {};
-  if (current.kind === "swap" && isBridgeJob(job, facts)) {
-    const status = describeBridgeJob(job, facts);
-    if (sent && status.phase === "not_broadcast")
-      return false;
-    return bridgeStatusFinal(status);
+  const ready = shown.effects.linkedTransferReady;
+  if (shown.direction === "widen" && ready) {
+    const line = linkedTransferLine(ready);
+    if (line)
+      lines.push(line);
   }
-  const settlement = settlementSchema.safeParse(job.settlement);
-  return !settlement.success || settlement.data.state !== "pending";
-}
-async function waitForSettlement(ctx, key, id, first, facts, sent = false) {
-  const deadline = ctx.deps.now() + BRIDGE_WAIT_MS;
-  let current = first;
-  while (!waitFinished(current, facts, sent) && ctx.deps.now() < deadline) {
-    await ctx.deps.sleep(BRIDGE_WAIT_POLL_MS);
-    current = { ...current, ...operationSchema.parse(await request(ctx, key, jobPath(current.kind, id))) };
+  for (const warning of shown.warnings) {
+    if (!LOCALLY_RENDERED.has(warning.code))
+      lines.push(`Warning: ${warning.message}`);
   }
-  const field = bridgeStatusField(ctx, current, facts);
-  const finished = waitFinished(current, facts, sent);
-  if (!finished)
-    ctx.deps.stderr.write(`Still not final after ten minutes. Re-check with candle swap status ${id} --wait.
+  if (lines[lines.length - 1] !== "")
+    lines.push("");
+  return lines.join(`
 `);
-  return { ...current, ...field, waited: { final: finished } };
 }
-async function decimalsFor(ctx, asset, client) {
-  if (BASES[asset])
-    return BASES[asset].decimals;
-  const reader = await client();
-  let result;
-  try {
-    result = await tradingRead(ctx, reader, () => reader.rpc.getTokenSupply(asset));
-  } catch (error) {
-    if (error instanceof TradingError)
-      throw error;
-    throw new TradingError("RPC_FAILED", "Solana getTokenSupply failed; no automatic re-send was made.");
+function accessFailureDetails(result, context) {
+  let code = result.code;
+  let message = result.message;
+  let suggestion;
+  if (result.status === 404 && result.code === undefined) {
+    code = "KEY_ACCESS_UNSUPPORTED";
+    message = context.history ? "This Candle API has no key access history yet." : "This Candle API cannot change a key's access yet; nothing changed.";
+  } else if (result.code === "LOOSEN_REQUIRES_SESSION" && context.self) {
+    const level = context.preset ? CLI_SPELLING[context.preset] : "<level>";
+    suggestion = `Widen it from a signed-in session or with the device token: candle keys access <prefix> --access ${level}`;
+  } else if (result.code === "KEY_ACCESS_STALE") {
+    suggestion = "Run the command again; the preview will show the key's current access.";
+  } else if (result.code === "KEY_ACCESS_PARTNER_KEY") {
+    suggestion = "Partner keys are managed by Candle; ask your Candle contact to change one.";
+  } else if (result.status === 404 && result.code === "VALIDATION_FAILED") {
+    suggestion = "Run: candle keys list, to see this account's keys and their prefixes.";
   }
-  const decimals = result.decimals;
-  if (typeof decimals !== "number" || !Number.isInteger(decimals) || decimals < 0 || decimals > 18)
-    throw new TradingError("INVALID_RESPONSE", "RPC returned invalid mint decimals.");
-  return decimals;
+  return { code: code ?? `HTTP ${result.status}`, message, ...suggestion !== undefined ? { suggestion } : {} };
 }
-async function assertDeferredExecuteSupported(ctx, key, id) {
-  try {
-    await request(ctx, key, "/api/v1/trade/agent/execute", { clientTradeId: id });
-  } catch (error) {
-    if (error instanceof TradingError && error.code === "JOB_NOT_FOUND")
-      return;
-    throw new TradingError("EMBEDDED_PAYER_UNSUPPORTED", "This Candle deployment cannot hold an embedded-wallet trade back for confirmation, so the quote could not be shown before the money moved. Nothing was built. Name a TEE wallet with --wallet, or point at a deployment that has it.");
+function writeAccessFailure(ctx, result, context) {
+  const { deps, apiUrl, json } = ctx;
+  const { code, message, suggestion } = accessFailureDetails(result, context);
+  const envelope = errorEnvelope({ ...result, code, message }, { apiUrl, authType: context.self ? "key" : "device" });
+  if (json) {
+    deps.stdout.write(`${JSON.stringify({ ...envelope, ...suggestion ? { suggestion } : {} })}
+`);
+  } else {
+    deps.stderr.write(`${code}: ${message}${suggestion ? ` ${suggestion}` : ""}
+`);
   }
-  throw new TradingError("INVALID_RESPONSE", "The execute route answered for a trade that does not exist.");
+  return 1;
 }
-async function swap(args, ctx) {
-  const parsed = parseArgs(args, {
-    valueFlags: ["--amount", "--percent", "--wallet", "--to", "--client-trade-id", "--slippage-bps", "--rpc-url"],
-    booleanFlags: ["--yes", "--wait"]
-  });
+async function keysAccess(args, ctx) {
+  const { deps, apiUrl, json } = ctx;
+  const parsed = parseArgs(args, { valueFlags: ["--access"], booleanFlags: ["--yes", "--history"] });
   if ("error" in parsed) {
-    writeUsageFailure(ctx.deps, parsed.error, ctx.json);
+    writeUsageFailure(deps, parsed.error, json);
     return 2;
   }
-  const flags = parsed.values;
-  const id = flags["--client-trade-id"] ?? `swap-${randomUUID()}`;
-  const slippage = Number(flags["--slippage-bps"] ?? "50");
-  if (parsed.positionals.length !== 2 || Boolean(flags["--amount"]) === Boolean(flags["--percent"]) || !validClientId(id) || !Number.isInteger(slippage) || slippage < 0 || slippage > 1e4) {
-    writeUsageFailure(ctx.deps, "Usage: candle swap <from> <to> --amount <decimal> | --percent <n> [--wallet <tee-or-embedded>] [--to <tee>] [--wait] [--client-trade-id <id>] [--slippage-bps 50] [--rpc-url <url>] [--yes]. Solana: SOL, USDC, CNDL or a mint. Hood: ETH, USDG or a 0x token. SOL or USDC to ETH or USDG, or back, is a bridge between two TEE wallets.", ctx.json);
+  const [target, extra] = parsed.positionals;
+  if (target === undefined || extra !== undefined) {
+    writeUsageFailure(deps, `${extra !== undefined ? `Unexpected argument: ${extra}. ` : "Name one key. "}${USAGE_ACCESS}`, json);
     return 2;
   }
-  try {
-    const fromAsset = classifyAsset(parsed.positionals[0]);
-    const toAsset = classifyAsset(parsed.positionals[1]);
-    const bridge = bridgePair(fromAsset, toAsset);
-    if (bridge)
-      return await bridgeSwap(ctx, {
-        flags,
-        yes: parsed.booleans.has("--yes"),
-        wait: parsed.booleans.has("--wait"),
-        id,
-        slippage,
-        ...bridge
-      });
-    if (flags["--to"] !== undefined || parsed.booleans.has("--wait"))
-      throw new TradingUsage("--to and --wait are for a bridge: SOL or USDC to ETH or USDG, or back.");
-    const chain2 = pairChain(fromAsset, toAsset);
-    const walletFlag = flags["--wallet"];
-    const named = walletFlag === undefined ? undefined : walletNameChain(walletFlag);
-    if (named !== undefined && named !== chain2)
-      throw chainMismatch(`--wallet ${safeText(walletFlag)}`, named, chain2);
-    if (chain2 === "hood")
-      return await hoodSwap(ctx, {
-        flags,
-        yes: parsed.booleans.has("--yes"),
-        id,
-        slippage,
-        from: fromAsset,
-        to: toAsset
-      });
-    const from = fromAsset.asset;
-    const to = toAsset.asset;
-    if (from === to)
-      throw new TradingError("PAIR_UNSUPPORTED", "Choose two distinct assets.");
-    const fromBase = baseAsset(from);
-    const toBase = baseAsset(to);
-    if (!fromBase && !toBase)
-      throw new TradingError("PAIR_UNSUPPORTED", "A token trade must have SOL, USDC or CNDL on one side; token-to-token routing is unavailable.");
-    if (flags["--amount"])
-      rawAmount(flags["--amount"], 18);
-    const percent = flags["--percent"] ? BigInt(rawAmount(flags["--percent"], 6)) : undefined;
-    if (percent !== undefined && percent > 100000000n)
-      throw new TradingError("INVALID_AMOUNT", "Percent must be greater than 0 and at most 100 (up to six decimal places).");
-    const kind = fromBase && toBase ? "swap" : "trade";
-    const key = await tradingKey(ctx);
-    const prior = await lookupOperation(ctx, key, id, kind);
-    if (prior)
-      return printTradingResult(ctx, prior);
-    const payerWallet = await tradingPayer(ctx, key, flags["--wallet"]);
-    if (payerWallet.kind === "embedded" && kind === "swap")
-      throw new TradingError("PAIR_UNSUPPORTED", "The embedded wallet cannot swap between base assets from this command yet: that rail executes in one call, so there would be nothing to confirm. Trade a token with it, or name a TEE wallet for a base pair.");
-    const wallet = payerWallet.kind === "tee" ? payerWallet.wallet : { address: payerWallet.address };
-    const solana = lazySolanaClient(ctx, flags["--rpc-url"]);
-    const decimals = await decimalsFor(ctx, from, solana);
-    const outDecimals = await decimalsFor(ctx, to, solana);
-    let amountRaw;
-    if (percent !== undefined) {
-      const reader = await solana();
-      let balance;
-      if (from === "SOL")
-        balance = await tradingRead(ctx, reader, () => reader.rpc.getBalance(wallet.address));
-      else {
-        const mint = BASES[from]?.mint ?? from;
-        const accounts = (await tradingRead(ctx, reader, () => Promise.all([
-          reader.rpc.getTokenAccountsByOwner(wallet.address, TOKEN_PROGRAM_ID),
-          reader.rpc.getTokenAccountsByOwner(wallet.address, TOKEN_2022_PROGRAM_ID)
-        ]))).flat();
-        balance = accounts.filter((account) => account.mint === mint).reduce((sum, account) => sum + BigInt(account.amountRaw), 0n);
-      }
-      amountRaw = (balance * percent / 100000000n).toString();
-      if (amountRaw === "0")
-        throw new TradingError("INVALID_AMOUNT", "The selected percentage rounds to zero raw units.");
-    } else
-      amountRaw = rawAmount(flags["--amount"], decimals);
-    if (BigInt(amountRaw) > BigInt(Number.MAX_SAFE_INTEGER))
-      throw new TradingError("INVALID_AMOUNT", "Amount exceeds the venue's exact integer range.");
-    if (payerWallet.kind === "embedded")
-      await assertDeferredExecuteSupported(ctx, key, id);
-    if (!await claimOperation(ctx, key, id, kind))
-      throw new TradingError("OPERATION_ALREADY_STARTED", "This machine already started this id; no write was resent.");
-    ctx.deps.stderr.write(`Operation: ${id}
-`);
-    const payer = payerWallet.kind === "tee" ? { type: "linked", linkedWalletId: payerWallet.wallet.id } : { type: "main" };
-    const built = kind === "swap" ? await request(ctx, key, "/api/v1/agent/swap/build", {
-      clientTradeId: id,
-      from,
-      to,
-      amountRaw,
-      maxSlippageBps: slippage,
-      payer
-    }) : await request(ctx, key, "/api/v1/trade/agent/build", {
-      clientTradeId: id,
-      chain: "solana",
-      mint: fromBase ? to : from,
-      side: fromBase ? "buy" : "sell",
-      quoteAsset: (fromBase ?? toBase)?.toLowerCase(),
-      amountRaw,
-      maxSlippageBps: slippage,
-      payer,
-      ...payerWallet.kind === "embedded" ? { deferExecution: true } : {}
-    });
-    if (built.job || built.status === "executed")
-      return printTradingResult(ctx, { ...built, clientTradeId: id, kind });
-    const data = swapBuildSchema.parse(kind === "swap" ? built.payload : built);
-    if (kind === "swap" && (data.venue !== "jupiter" || data.recipient !== wallet.address))
-      throw new TradingError("INVALID_RESPONSE", "A TEE base swap must use Jupiter and return to its payer.");
-    if (kind === "trade" && (built.chain !== "solana" || built.walletAddress !== wallet.address))
-      throw new TradingError("INVALID_RESPONSE", "The token build does not name the requested Solana payer.");
-    const artifacts = kind === "swap" ? { ...data, transactionBase64: undefined, quoteSource: undefined, quoteAsset: undefined } : data.artifacts;
-    if (!artifacts)
-      throw new TradingError("INVALID_RESPONSE", "Missing quote artifacts.");
-    if (kind === "trade" && artifacts.quoteAsset !== (fromBase ?? toBase)?.toLowerCase())
-      throw new TradingError("PAIR_UNSUPPORTED", `This token settles in ${artifacts.quoteAsset ?? "an unknown asset"}, not the requested pair. Nothing was signed.`);
-    if (data?.status !== "built" || typeof data.minOutRaw !== "string" || !/^\d+$/.test(data.minOutRaw) || !data.fee || !Number.isFinite(data.fee.bps))
-      throw new TradingError("INVALID_RESPONSE", "Candle did not return a complete quote; nothing was signed.");
-    const minimumRaw = !fromBase && artifacts.venue === "curve" ? (BigInt(data.minOutRaw) > BigInt(data.fee.feeRaw) ? BigInt(data.minOutRaw) - BigInt(data.fee.feeRaw) : 0n).toString() : data.minOutRaw;
-    const quote = {
-      intent: `Swap ${decimalAmount(amountRaw, decimals)} ${from} to ${to}`,
-      wallet: wallet.address,
-      venue: artifacts.quoteSource ?? artifacts.venue,
-      priceImpactPct: artifacts.priceImpactPct ?? null,
-      fee: data.fee,
-      minimumReceived: `${decimalAmount(minimumRaw, outDecimals)} ${to}`,
-      minOutRaw: data.minOutRaw,
-      minimumReceivedRaw: minimumRaw,
-      tokenRisks: artifacts.tokenRisks ?? []
-    };
-    if (!await confirmQuote(ctx, quote, parsed.booleans.has("--yes")))
-      return printTradingResult(ctx, { success: true, status: "cancelled", clientTradeId: id, kind, quote });
-    if (!Number.isFinite(data.expiresAt) || data.expiresAt <= ctx.deps.now())
-      throw new TradingError("QUOTE_EXPIRED", "The quote expired before signing. Start a new intention with a new id.");
-    if (payerWallet.kind === "embedded") {
-      const executed = await request(ctx, key, "/api/v1/trade/agent/execute", { clientTradeId: id });
-      return printTradingResult(ctx, {
-        ...executed,
-        clientTradeId: id,
-        kind,
-        quote,
-        wallet: safeText(payerWallet.address)
-      });
+  const accessFlag = parsed.values["--access"];
+  const history = parsed.booleans.has("--history");
+  const yes = parsed.booleans.has("--yes");
+  if (accessFlag === undefined === !history) {
+    writeUsageFailure(deps, `Pass exactly one of --access and --history. ${USAGE_ACCESS}`, json);
+    return 2;
+  }
+  if (history) {
+    if (yes) {
+      writeUsageFailure(deps, "--yes only applies to a change, not to --history.", json);
+      return 2;
     }
-    const transaction = kind === "swap" ? data.transactionsBase64?.[0] : artifacts.transactionBase64;
-    if (kind === "swap" && data.transactionsBase64?.length !== 1)
-      throw new TradingError("INVALID_RESPONSE", "A TEE swap must contain exactly one same-chain transaction.");
-    if (!transaction)
-      throw new TradingError("INVALID_RESPONSE", "Missing transaction.");
-    const signed = await relaySign(ctx, key, payerWallet.wallet, transaction);
-    const result = kind === "swap" ? await request(ctx, key, "/api/v1/agent/swap/submit", {
-      clientTradeId: id,
-      swapId: data.swapId,
-      signedTransactionsBase64: [signed]
-    }) : await request(ctx, key, "/api/v1/trade/agent/submit", { clientTradeId: id, signedTransactions: [signed] });
-    const settled = kind === "swap" ? reportSettlement(ctx, result.payload?.settlement, { asset: to, decimals: outDecimals }, id) : {};
-    return printTradingResult(ctx, {
-      ...result,
-      clientTradeId: id,
-      kind,
-      quote,
-      wallet: safeText(wallet.address),
-      ...settled
-    });
-  } catch (error) {
-    return tradingFailure(ctx, error, id);
+    if (target === SELF) {
+      writeUsageFailure(deps, "--history needs the device token: name the key by prefix or label, not self.", json);
+      return 2;
+    }
+    return keysAccessHistory(target, ctx);
   }
-}
-function lazyEvmRpc(ctx, flag) {
-  let rpc;
-  return () => {
-    if (rpc)
-      return rpc;
-    const resolved = resolveEvmRpcUrl(flag, ctx.deps.env[EVM_RPC_URL_ENV], "--rpc-url");
-    if ("error" in resolved)
-      throw new TradingUsage(resolved.error);
-    ctx.deps.stderr.write(`Reading from ${rpcHostOf2(resolved.url)} (Hood RPC; reads only, nothing is sent there)
-`);
-    rpc = createEvmRpc(resolved.url, ctx.deps.fetch);
-    return rpc;
-  };
-}
-async function evmRead(what, read) {
-  try {
-    return await read();
-  } catch (error) {
-    if (error instanceof TradingError || error instanceof TradingUsage)
-      throw error;
-    throw new TradingError("RPC_FAILED", `Reading ${what} over the Hood RPC failed; nothing was built or signed.`);
+  const preset = ACCESS_LEVELS[accessFlag];
+  if (preset === undefined) {
+    writeUsageFailure(deps, `--access must be one of: ${Object.keys(ACCESS_LEVELS).join(", ")}.`, json);
+    return 2;
   }
-}
-async function hoodDecimals(asset, rpc) {
-  const base = asset.base ? HOOD_BASES[asset.base] : undefined;
-  if (base)
-    return base.decimals;
-  const decimals = await evmRead(`${asset.asset} decimals()`, () => rpc().erc20Decimals(asset.asset));
-  if (decimals > 36)
-    throw new TradingError("INVALID_RESPONSE", "The token's decimals() is out of range.");
-  return decimals;
-}
-async function recordTradedToken(ctx, wallet, token) {
-  const skipped = (reason) => `Notice: the sealed EVM record was not updated for ${token} (${reason}). The leg landed. A later sweep still finds this token with --token ${token}, or with --from-block.`;
-  const append = ctx.deps.appendEvmRecord;
-  let notice;
-  if (!append)
-    notice = skipped("this CLI build has no sealed EVM record writer");
-  else {
-    try {
-      const outcome = await append(ctx, { kind: "token", wallet: toChecksumAddress(wallet), token });
-      notice = outcome.appended ? outcome.notice : skipped(outcome.notice);
-    } catch (error) {
-      notice = skipped(error instanceof Error ? error.message : "the append failed");
+  await printIdentity(ctx);
+  const self = target === SELF;
+  let path;
+  let auth;
+  let credentials;
+  if (self) {
+    const apiKey = await resolveApiKey(deps, ctx.profile);
+    if (!apiKey) {
+      writeLocalFailure(deps, NO_API_KEY2, json);
+      return 1;
+    }
+    path = `${KEYS_PATH4}/self/access`;
+    auth = "key";
+    credentials = { apiKey };
+  } else {
+    const deviceToken = await resolveDeviceToken(deps, ctx.profile);
+    if (!deviceToken) {
+      writeLocalFailure(deps, NO_DEVICE_TOKEN, json);
+      return 1;
     }
+    const resolved = await resolveTargetKey(ctx, deviceToken, target, {
+      codePrefix: "KEY_ACCESS",
+      writeListFailure: (result2) => writeAccessFailure(ctx, result2, { self: false })
+    });
+    if (!resolved.ok)
+      return resolved.code;
+    path = `${KEYS_PATH4}/${encodeURIComponent(resolved.keyPrefix)}/access`;
+    auth = "device";
+    credentials = { deviceToken };
   }
-  if (notice)
-    ctx.deps.stderr.write(`${safeText(notice)}
+  const failureContext = { self, preset };
+  const call = (body) => apiRequest(path, { method: "PUT", body, auth, credentials, apiUrl, fetch: deps.fetch, env: deps.env });
+  const preview = await call({ access: preset, dryRun: true });
+  if (!preview.ok)
+    return writeAccessFailure(ctx, preview, failureContext);
+  const shown = preview.body;
+  const name2 = keyName2(shown.keyPrefix, shown.label);
+  if (shown.direction === "unchanged") {
+    if (json)
+      deps.stdout.write(`${JSON.stringify({ ...shown, command: "keys access" })}
 `);
-  return notice;
-}
-var HOOD_TRADE_LEGS = ["approval", "permit2Approval", "trade", "feeTransfer"];
-function describeHoodLegs(first, hasFee, primary = "trade") {
-  const kinds = plannedLegKinds(first.legKind, first.plannedLegCount, hasFee, primary);
-  const names = {
-    approval: "approve",
-    permit2Approval: "Permit2 approve",
-    trade: "trade",
-    feeTransfer: "fee",
-    bridgeDeposit: "bridge deposit"
-  };
-  return kinds ? kinds.map((kind) => names[kind] ?? kind) : [`${first.plannedLegCount} legs, starting with ${names[first.legKind] ?? first.legKind}`];
-}
-async function hoodSwap(ctx, args) {
-  const { flags, id, from, to } = args;
-  if (from.asset === to.asset)
-    throw new TradingError("PAIR_UNSUPPORTED", "Choose two distinct assets.");
-  if (!from.base && !to.base)
-    throw new TradingError("PAIR_UNSUPPORTED", "A Hood token trade must have ETH or USDG on one side; token-to-token routing is unavailable.");
-  if (flags["--amount"])
-    rawAmount(flags["--amount"], 18);
-  const percent = flags["--percent"] ? BigInt(rawAmount(flags["--percent"], 6)) : undefined;
-  if (percent !== undefined && percent > 100000000n)
-    throw new TradingError("INVALID_AMOUNT", "Percent must be greater than 0 and at most 100 (up to six decimal places).");
-  const kind = from.base && to.base ? "swap" : "trade";
-  const key = await tradingKey(ctx);
-  const prior = await lookupOperation(ctx, key, id, kind);
-  if (prior)
-    return printTradingResult(ctx, prior);
-  const payer = await tradingPayer(ctx, key, flags["--wallet"], "swap:write", "hood");
-  if (payer.kind === "embedded" && kind === "swap")
-    throw new TradingError("PAIR_UNSUPPORTED", "The embedded wallet cannot swap ETH and USDG from this command: that rail executes in one call, so there would be nothing to confirm. Trade a token with it, or name a Hood TEE wallet.");
-  const payerAddress = payer.kind === "tee" ? payer.wallet.address : payer.address;
-  const rpc = lazyEvmRpc(ctx, flags["--rpc-url"]);
-  const decimals = await hoodDecimals(from, rpc);
-  const outDecimals = await hoodDecimals(to, rpc);
-  let amountRaw;
-  if (percent !== undefined) {
-    const balance = from.asset === "ETH" ? await evmRead("the ETH balance", () => rpc().getBalance(payerAddress)) : await evmRead(`the ${from.asset} balance`, () => rpc().erc20BalanceOf(from.asset === "USDG" ? HOOD_USDG_ADDRESS : from.asset, payerAddress));
-    amountRaw = (balance * percent / 100000000n).toString();
-    if (amountRaw === "0")
-      throw new TradingError("INVALID_AMOUNT", "The selected percentage rounds to zero raw units.");
-  } else
-    amountRaw = rawAmount(flags["--amount"], decimals);
-  if (payer.kind === "embedded")
-    await assertDeferredExecuteSupported(ctx, key, id);
-  if (!await claimOperation(ctx, key, id, kind))
-    throw new TradingError("OPERATION_ALREADY_STARTED", "This machine already started this id; no write was resent.");
-  ctx.deps.stderr.write(`Operation: ${id}
+    else
+      deps.stdout.write(`${name2} is already ${levelName(shown.to)}. Nothing changed.
 `);
-  const payerBody = payer.kind === "tee" ? { type: "linked", linkedWalletId: payer.wallet.id } : { type: "main" };
-  const base = from.base ?? to.base;
-  const token = from.base ? to.asset : from.asset;
-  const built = kind === "swap" ? await request(ctx, key, "/api/v1/agent/swap/build", {
-    clientTradeId: id,
-    from: from.asset,
-    to: to.asset,
-    amountRaw,
-    maxSlippageBps: args.slippage,
-    payer: payerBody
-  }) : await request(ctx, key, "/api/v1/trade/agent/build", {
-    clientTradeId: id,
-    chain: "hood",
-    mint: token,
-    side: from.base ? "buy" : "sell",
-    quoteAsset: base.toLowerCase(),
-    amountRaw,
-    maxSlippageBps: args.slippage,
-    payer: payerBody,
-    ...payer.kind === "embedded" ? { deferExecution: true } : {}
-  });
-  if (built.job || built.status === "executed")
-    return printTradingResult(ctx, { ...built, clientTradeId: id, kind });
-  const body = kind === "swap" ? built.payload : built;
-  const data = swapBuildSchema.parse(body);
-  const echoed = kind === "swap" ? body?.recipient : body?.walletAddress;
-  if (body?.chain !== "hood" || typeof echoed !== "string" || echoed.toLowerCase() !== payerAddress.toLowerCase())
-    throw new TradingError("INVALID_RESPONSE", "The Hood build does not name the requested payer; nothing was signed.");
-  const artifacts = kind === "swap" ? { ...data, quoteAsset: undefined, quoteSource: undefined } : data.artifacts;
-  if (!artifacts)
-    throw new TradingError("INVALID_RESPONSE", "Missing quote artifacts.");
-  if (kind === "trade" && artifacts.quoteAsset !== base.toLowerCase())
-    throw new TradingError("PAIR_UNSUPPORTED", `This token settles in ${artifacts.quoteAsset ?? "an unknown asset"}, not ${base}. Nothing was signed.`);
-  let sequenced;
-  if (payer.kind === "tee") {
-    const parsed = sequencedSchema.safeParse(body);
-    if (!parsed.success)
-      throw new TradingError("SEQUENCED_RAIL_REQUIRED", "A Hood TEE wallet trades one leg at a time, and this Candle deployment did not answer with a sequenced leg. Nothing was signed.");
-    sequenced = parsed.data;
+    return 0;
   }
-  const minimumRaw = !from.base && artifacts.venue === "curve" ? (BigInt(data.minOutRaw) > BigInt(data.fee.feeRaw) ? BigInt(data.minOutRaw) - BigInt(data.fee.feeRaw) : 0n).toString() : data.minOutRaw;
-  const quote = {
-    intent: `Swap ${decimalAmount(amountRaw, decimals)} ${from.asset} to ${to.asset} on Hood`,
-    wallet: payerAddress,
-    venue: artifacts.quoteSource ?? artifacts.venue,
-    priceImpactPct: artifacts.priceImpactPct ?? null,
-    fee: data.fee,
-    minimumReceived: `${decimalAmount(minimumRaw, outDecimals)} ${to.asset}`,
-    minOutRaw: data.minOutRaw,
-    minimumReceivedRaw: minimumRaw,
-    tokenRisks: artifacts.tokenRisks ?? []
-  };
-  if (sequenced) {
-    const leg = sequenced.nextLeg;
-    const maxFee = BigInt(leg.maxFeePerGas);
-    const reserve = sweepReserveFloor(maxFee, kind === "trade" ? [token] : []);
-    quote.legs = describeHoodLegs(sequenced, BigInt(data.fee.feeRaw) > 0n);
-    quote.gas = `the ${sequenced.legKind} leg up to ${formatUnits(BigInt(leg.gas) * maxFee, 18)} ETH (gas ${leg.gas} at ${formatUnits(maxFee, 9)} gwei); each later leg is priced by Candle when it becomes next`;
-    quote.reserve = `at least ${formatUnits(reserve.wei, 18)} ETH stays in the wallet for a sweep home (${reserve.erc20Transfers} ERC-20 transfers and the final ETH transfer at twice the fee); a trade never spends it`;
-    quote.operationId = sequenced.operationId;
+  const widen = shown.direction === "widen";
+  const interactive = deps.isTTY.stdin && deps.isTTY.stdout;
+  if (widen && yes) {
+    writeUsageFailure(deps, "--yes only skips the prompt when narrowing; nothing changed.", json);
+    return 2;
   }
-  if (!await confirmQuote(ctx, quote, args.yes)) {
-    if (sequenced)
-      ctx.deps.stderr.write(`Nothing was signed. Operation ${sequenced.operationId} holds this wallet until ${new Date(sequenced.expiresAt).toISOString()}; a new Hood trade from it is refused as WALLET_BUSY until then.
+  if (widen && !interactive) {
+    writeLocalFailure(deps, REQUIRES_TTY, json);
+    return 1;
+  }
+  if (!widen && !yes && !interactive) {
+    writeUsageFailure(deps, "Narrowing a key without a terminal needs --yes; nothing changed. Run it in an interactive shell, or pass --yes.", json);
+    return 2;
+  }
+  const config = await deps.readConfig();
+  const fields = effectiveProfileFields(config, ctx.profile);
+  const account = fields.account ? shortAddress(fields.account) : "unknown";
+  deps.stderr.write(`${accessScreen(shown, { account: fields.username ? `${fields.username}  (${account})` : account, apiUrl })}
+`);
+  if (widen) {
+    const typed = await deps.promptLine(`Type the key prefix ${shown.keyPrefix} to widen it: `);
+    if (typed.trim() !== shown.keyPrefix) {
+      writeLocalFailure(deps, {
+        code: "KEY_ACCESS_NOT_ACKNOWLEDGED",
+        message: `The acknowledgement is the key prefix ${shown.keyPrefix}; nothing changed.`,
+        suggestion: `Run the command again and type ${shown.keyPrefix} at the prompt.`
+      }, json);
+      return 1;
+    }
+  } else if (!yes) {
+    const answer = await deps.promptLine(`Change ${name2} from ${levelName(shown.from)} to ${levelName(shown.to)}? [y/N] `);
+    if (!["y", "yes"].includes(answer.trim().toLowerCase())) {
+      writeLocalFailure(deps, {
+        code: "KEY_ACCESS_NOT_ACKNOWLEDGED",
+        message: "Not confirmed; nothing changed.",
+        suggestion: "Run the command again and answer y, or pass --yes."
+      }, json);
+      return 1;
+    }
+  }
+  const committed = await call({ access: preset, expectScopes: shown.from.scopes });
+  if (!committed.ok)
+    return writeAccessFailure(ctx, committed, failureContext);
+  const result = committed.body;
+  if (fields.keyPrefix !== undefined && fields.keyPrefix === result.keyPrefix && result.direction !== "unchanged") {
+    const scopes = scopesForPreset(result.to.access);
+    if (ctx.profile)
+      await deps.updateProfile(ctx.profile, { scopes });
+    else
+      await deps.writeConfig({ scopes });
+  }
+  if (json) {
+    deps.stdout.write(`${JSON.stringify({ ...result, command: "keys access" })}
+`);
+    return 0;
+  }
+  if (result.direction === "unchanged") {
+    deps.stdout.write(`${keyName2(result.keyPrefix, result.label)} is already ${levelName(result.to)}. Nothing changed.
 `);
-    return printTradingResult(ctx, {
-      success: true,
-      status: "cancelled",
-      clientTradeId: id,
-      kind,
-      quote,
-      ...sequenced ? { operationId: sequenced.operationId, walletHeldUntil: sequenced.expiresAt } : {}
-    });
+    return 0;
   }
-  if (!Number.isFinite(data.expiresAt) || data.expiresAt <= ctx.deps.now())
-    throw new TradingError("QUOTE_EXPIRED", "The quote expired before signing. Start a new intention with a new id.");
-  if (payer.kind === "embedded") {
-    const executed = await request(ctx, key, "/api/v1/trade/agent/execute", { clientTradeId: id });
-    return printTradingResult(ctx, { ...executed, clientTradeId: id, kind, quote, wallet: safeText(payerAddress) });
+  deps.stdout.write(`Changed ${keyName2(result.keyPrefix, result.label)} to ${levelName(result.to)}.` + `${result.changeId ? ` Change id ${result.changeId}` : ""}
+`);
+  return 0;
+}
+async function keysAccessHistory(target, ctx) {
+  const { deps, apiUrl, json } = ctx;
+  await printIdentity(ctx);
+  const deviceToken = await resolveDeviceToken(deps, ctx.profile);
+  if (!deviceToken) {
+    writeLocalFailure(deps, NO_DEVICE_TOKEN, json);
+    return 1;
   }
-  const wallet = payer.wallet;
-  if (wallet.chain !== "evm" || !sequenced)
-    throw chainMismatch(`TEE wallet ${wallet.id}`, wallet.chain === "evm" ? "hood" : "solana", "hood");
-  const recorded = kind === "trade" ? token : HOOD_USDG_ADDRESS;
-  const notices = [];
-  const run2 = await runSequencedLegs(ctx, key, {
-    wallet,
-    first: sequenced,
-    submitPath: kind === "swap" ? "/api/v1/agent/swap/submit" : "/api/v1/trade/agent/submit",
-    submitFields: kind === "swap" ? { clientTradeId: id, swapId: data.swapId } : { clientTradeId: id },
-    unwrap: (answer) => kind === "swap" ? answer.payload ?? {} : answer,
-    clientId: id,
-    kind,
-    allowedLegs: HOOD_TRADE_LEGS,
-    onLanded: async (_leg) => {
-      const notice = await recordTradedToken(ctx, wallet.address, toChecksumAddress(recorded));
-      if (notice)
-        notices.push(notice);
-    }
+  const resolved = await resolveTargetKey(ctx, deviceToken, target, {
+    codePrefix: "KEY_ACCESS",
+    writeListFailure: (result2) => writeAccessFailure(ctx, result2, { self: false, history: true })
   });
-  const settled = kind === "swap" ? reportSettlement(ctx, run2.final.settlement, { asset: to.asset, decimals: outDecimals }, id) : {};
-  return printTradingResult(ctx, {
-    ...run2.final,
-    ...settled,
-    clientTradeId: id,
-    kind,
-    chain: "hood",
-    quote,
-    wallet: safeText(wallet.address),
-    operationId: sequenced.operationId,
-    landedLegs: run2.landed,
-    evmRecord: { token: toChecksumAddress(recorded), notices }
+  if (!resolved.ok)
+    return resolved.code;
+  const result = await apiRequest(`${KEYS_PATH4}/${encodeURIComponent(resolved.keyPrefix)}/access-changes`, {
+    auth: "device",
+    credentials: { deviceToken },
+    apiUrl,
+    fetch: deps.fetch,
+    env: deps.env
   });
+  if (!result.ok)
+    return writeAccessFailure(ctx, result, { self: false, history: true });
+  if (json) {
+    deps.stdout.write(`${JSON.stringify({ ...result.body, command: "keys access" })}
+`);
+    return 0;
+  }
+  const rows = result.body.changes ?? [];
+  if (rows.length === 0) {
+    deps.stdout.write(`No access changes on key ${resolved.keyPrefix}.
+`);
+    return 0;
+  }
+  deps.stdout.write(`${renderTable(["Time", "From", "To", "Actor", "Device or key"], rows.map((row) => [
+    formatTimestamp(row.at),
+    levelName(row.from),
+    levelName(row.to),
+    row.actor,
+    row.actorDevicePrefix ?? row.actorKeyPrefix ?? ""
+  ]))}
+`);
+  if (rows.some((row) => row.actor === "device"))
+    deps.stdout.write(`${PORTAL_REVOKE_LINE}
+`);
+  return 0;
 }
-var bridgeBuildSchema = exports_external.object({
-  status: exports_external.literal("built"),
-  swapId: exports_external.string().min(1),
-  venue: exports_external.string(),
-  fee: exports_external.object({ bps: exports_external.number(), feeRaw: exports_external.string() }).passthrough(),
-  expectedOutRaw: exports_external.string().regex(/^\d+$/),
-  expiresAt: exports_external.number().finite(),
-  recipient: exports_external.string().min(1),
-  statusChecks: exports_external.array(exports_external.string()).default([]),
-  transactionsBase64: exports_external.array(exports_external.string()).optional(),
-  walletAddress: exports_external.string().optional(),
-  venueCostUsd: exports_external.number().finite().optional(),
-  venueTimeEstimateSec: exports_external.number().finite().optional()
-}).passthrough();
-async function bridgeOriginBalance(ctx, from, address, solana, evm) {
-  if (from === "ETH")
-    return evmRead("the ETH balance", () => evm().getBalance(address));
-  if (from === "USDG")
-    return evmRead("the USDG balance", () => evm().erc20BalanceOf(HOOD_USDG_ADDRESS, address));
-  const reader = await solana();
-  if (from === "SOL")
-    return tradingRead(ctx, reader, () => reader.rpc.getBalance(address));
-  const mint = BASES.USDC?.mint;
-  const accounts = (await tradingRead(ctx, reader, () => Promise.all([
-    reader.rpc.getTokenAccountsByOwner(address, TOKEN_PROGRAM_ID),
-    reader.rpc.getTokenAccountsByOwner(address, TOKEN_2022_PROGRAM_ID)
-  ]))).flat();
-  return accounts.filter((account) => account.mint === mint).reduce((sum, account) => sum + BigInt(account.amountRaw), 0n);
+
+// src/index.ts
+init_keys_embedded_wallet();
+
+// src/commands/keys-wallets.ts
+init_args();
+init_deps();
+init_profiles();
+init_render();
+var NO_API_KEY3 = {
+  code: "NO_API_KEY",
+  message: "No API key for this profile.",
+  suggestion: "Set CANDLE_API_KEY, or run `candle keys create` and store one."
+};
+function widenRefusedHint(prefix, walletIds) {
+  const wallets2 = walletIds.length > 0 ? walletIds.join(" ") : "<wallet...>";
+  return `To move TEE wallets to this key, run: candle tee rebind ${wallets2} --to-key ${prefix} ` + "(owner, device token; --label-prefix <p> names many at once). To grant a linked wallet to the key " + "instead, use the agent console's Agents tab in a signed-in session. If `tee rebind` says the wallets " + "are already bound, grant them to the key in the agent console's Agents tab (signed in).";
 }
-async function bridgeSwap(ctx, args) {
-  const { flags, id, from, to } = args;
-  const origin = BRIDGE_ASSETS[from].chain;
-  const destination = BRIDGE_ASSETS[to].chain;
-  const walletFlag = flags["--wallet"];
-  const named = walletFlag === undefined ? undefined : walletNameChain(walletFlag);
-  if (named !== undefined && named !== origin)
-    throw chainMismatch(`--wallet ${safeText(walletFlag)}`, named, origin);
-  if (flags["--amount"])
-    rawAmount(flags["--amount"], 18);
-  const percent = flags["--percent"] ? BigInt(rawAmount(flags["--percent"], 6)) : undefined;
-  if (percent !== undefined && percent > 100000000n)
-    throw new TradingError("INVALID_AMOUNT", "Percent must be greater than 0 and at most 100 (up to six decimal places).");
-  const key = await tradingKey(ctx);
-  const prior = await lookupOperation(ctx, key, id, "swap");
-  if (prior)
-    return printTradingResult(ctx, {
-      ...prior,
-      ...bridgeStatusField(ctx, prior, bridgeFactsOf((await savedOperation(ctx, key, id))?.bridge))
-    });
-  const payer = await tradingPayer(ctx, key, walletFlag, "swap:write", origin);
-  if (payer.kind !== "tee")
-    throw new TradingError("CHAIN_MISMATCH", `Only a TEE wallet bridges, and the embedded wallet ${safeText(payer.address)} is not one. Name a ${chainName(origin)} TEE wallet with --wallet. Nothing was built.`);
-  const wallet = payer.wallet;
-  const { rows } = await listTradingWallets(ctx, key, "swap:write");
-  const onDestination = rows.filter((row) => rowChain(row) === destination);
-  const toFlag = flags["--to"];
-  let toWalletId;
-  let candidates = onDestination.filter((row) => row.active);
-  if (toFlag !== undefined) {
-    const matches = rows.filter((row) => matchesName(row, toFlag));
-    const match = matches[0];
-    if (matches.length > 1)
-      throw new TradingError("TEE_WALLET_REQUIRED", `"${safeText(toFlag)}" matches ${matches.length} TEE wallets on this key: ${matches.map(describeWallet).join("; ")}. Name one by id or address.`);
-    if (!match || rowChain(match) !== destination)
-      throw new TradingError("BRIDGE_DESTINATION_MISSING", `--to ${safeText(toFlag)} is not a ${chainName(destination)} TEE wallet on this key. A bridge lands only in this key's own TEE wallet on ${chainName(destination)}${onDestination.length > 0 ? `: ${onDestination.map(describeWallet).join("; ")}` : ""}. Nothing was built.`);
-    if (!match.active)
-      throw new TradingError("TEE_WALLET_INACTIVE", `The destination ${describeWallet(match)} is not a verified-active TEE wallet. Nothing was built.`);
-    toWalletId = match.id;
-    candidates = [match];
-  } else if (candidates.length !== 1) {
-    throw new TradingError("BRIDGE_DESTINATION_MISSING", candidates.length === 0 ? `This key has no active ${chainName(destination)} TEE wallet to bridge into. Promote one onto this key (candle vault promote), then bridge. Nothing was built.` : `This key has more than one ${chainName(destination)} TEE wallet; name the destination with --to: ${candidates.map(describeWallet).join("; ")}. Nothing was built.`);
+function formatTimestamp2(ms) {
+  return ms ? new Date(ms).toISOString().replace("T", " ").slice(0, 16) : "-";
+}
+async function keysWalletsList(args, ctx) {
+  const { deps, apiUrl, json } = ctx;
+  const parsed = parseArgs(args, {});
+  if ("error" in parsed) {
+    writeUsageFailure(deps, parsed.error, json);
+    return 2;
   }
-  const solana = lazySolanaClient(ctx, flags["--rpc-url"]);
-  const evm = lazyEvmRpc(ctx, flags["--rpc-url"]);
-  const decimals = BRIDGE_ASSETS[from].decimals;
-  let amountRaw;
-  if (percent !== undefined) {
-    const balance = await bridgeOriginBalance(ctx, from, wallet.address, solana, evm);
-    amountRaw = (balance * percent / 100000000n).toString();
-    if (amountRaw === "0")
-      throw new TradingError("INVALID_AMOUNT", "The selected percentage rounds to zero raw units.");
-  } else
-    amountRaw = rawAmount(flags["--amount"], decimals);
-  if (!await claimOperation(ctx, key, id, "swap"))
-    throw new TradingError("OPERATION_ALREADY_STARTED", "This machine already started this id; no write was resent.");
-  ctx.deps.stderr.write(`Operation: ${id}
-`);
-  const built = await request(ctx, key, "/api/v1/agent/swap/build", {
-    clientTradeId: id,
-    from,
-    to,
-    amountRaw,
-    maxSlippageBps: args.slippage,
-    payer: { type: "linked", linkedWalletId: wallet.id },
-    ...toWalletId !== undefined ? { toWalletId } : {}
+  const prefix = parsed.positionals[0];
+  if (!prefix) {
+    writeUsageFailure(deps, "Usage: candle keys wallets <prefix>", json);
+    return 2;
+  }
+  await printIdentity(ctx);
+  const apiKey = await resolveApiKey(deps, ctx.profile);
+  if (!apiKey) {
+    writeLocalFailure(deps, NO_API_KEY3, json);
+    return 1;
+  }
+  const result = await apiRequest(`/api/v1/agent/keys/${encodeURIComponent(prefix)}/wallets`, {
+    auth: "key",
+    credentials: { apiKey },
+    apiUrl,
+    fetch: deps.fetch,
+    env: deps.env
   });
-  if (built.job || built.status === "executed")
-    return printTradingResult(ctx, { ...built, clientTradeId: id, kind: "swap" });
-  const body = built.payload ?? {};
-  const parsedBuild = bridgeBuildSchema.safeParse(body);
-  if (!parsedBuild.success)
-    throw new TradingError("INVALID_RESPONSE", "Candle did not return a complete bridge quote; nothing was signed.");
-  const data = parsedBuild.data;
-  if (data.venue !== "relay")
-    throw new TradingError("INVALID_RESPONSE", `A bridge goes through Relay, not ${safeText(data.venue)}; nothing was signed.`);
-  if (data.fee.bps !== 0 || data.fee.feeRaw !== "0")
-    throw new TradingError("INVALID_RESPONSE", "A bridge carries no Candle fee, and this quote has one; nothing was signed.");
-  const recipient = candidates.find((row) => destination === "hood" ? sameEvmAddress(row.address, data.recipient) : row.address === data.recipient);
-  if (!recipient)
-    throw new TradingError("INVALID_RESPONSE", `Candle named ${safeText(data.recipient)} as the destination, which is not ${toWalletId !== undefined ? "the TEE wallet --to named" : `this key's ${chainName(destination)} TEE wallet`}; nothing was signed.`);
-  const facts = {
-    from,
-    to,
-    recipient: recipient.address,
-    ...data.statusChecks[0] !== undefined ? { statusCheck: data.statusChecks[0] } : {}
-  };
-  await saveOperationBridge(ctx, key, id, { ...facts });
-  const refused = (problem) => new TradingError("RELAY_STEP_REFUSED", `Relay's deposit did not pass this machine's check (${problem}); nothing was signed.`);
-  let sequenced;
-  let transaction;
-  const hoodOrigin = from === "ETH" || from === "USDG" ? from : undefined;
-  if (hoodOrigin) {
-    const parsedLeg = sequencedSchema.safeParse(body);
-    if (!parsedLeg.success)
-      throw new TradingError("SEQUENCED_RAIL_REQUIRED", "A Hood TEE wallet bridges one leg at a time, and this Candle deployment did not answer with a sequenced leg. Nothing was signed.");
-    sequenced = parsedLeg.data;
-    if (typeof data.walletAddress !== "string" || !sameEvmAddress(data.walletAddress, wallet.address))
-      throw new TradingError("INVALID_RESPONSE", "The Hood build does not name the requested payer; nothing was signed.");
-    const plan = plannedLegKinds(sequenced.legKind, sequenced.plannedLegCount, false, "bridgeDeposit");
-    if (!bridgePlanAdmitted(hoodOrigin, plan))
-      throw refused(`the plan is ${sequenced.plannedLegCount} leg(s) starting with ${sequenced.legKind}`);
-    const problem = relayHoodLegProblem(sequenced.legKind, sequenced.nextLeg, {
-      origin: hoodOrigin,
-      payer: wallet.address,
-      amountRaw
-    });
-    if (problem)
-      throw refused(problem);
-  } else {
-    if (data.transactionsBase64?.length !== 1)
-      throw refused(`Candle returned ${data.transactionsBase64?.length ?? 0} transactions, not one deposit`);
-    transaction = data.transactionsBase64[0];
-    const reader = await solana();
-    const problem = await tradingRead(ctx, reader, () => relaySolanaDepositProblem(transaction, wallet.address, reader.rpc));
-    if (problem)
-      throw refused(problem);
+  if (!result.ok) {
+    writeFailure(deps, result, { apiUrl, authType: "key" }, json);
+    return 1;
   }
-  const outDecimals = BRIDGE_ASSETS[to].decimals;
-  const minimumRaw = (BigInt(data.expectedOutRaw) * BigInt(1e4 - args.slippage) / 10000n).toString();
-  const quote = {
-    intent: `Bridge ${decimalAmount(amountRaw, decimals)} ${from} on ${chainName(origin)} to ${to} on ${chainName(destination)}`,
-    wallet: wallet.address,
-    venue: "relay",
-    priceImpactPct: null,
-    minimumReceived: `${decimalAmount(minimumRaw, outDecimals)} ${to} (Relay's estimate ${decimalAmount(data.expectedOutRaw, outDecimals)} ${to}, less the ${args.slippage} bps slippage bound)`,
-    minimumReceivedRaw: minimumRaw,
-    expectedOutRaw: data.expectedOutRaw,
-    destination: `${recipient.label ? `${recipient.label} ` : ""}${recipient.address} (${chainName(destination)} TEE wallet on this key)`,
-    candleFee: "none",
-    relayFees: data.venueCostUsd !== undefined ? `about $${data.venueCostUsd} as Relay reports it` : "not reported",
-    estimatedTime: data.venueTimeEstimateSec !== undefined ? `about ${data.venueTimeEstimateSec}s as Relay reports it` : "not reported",
-    tokenRisks: []
-  };
-  if (sequenced) {
-    const leg = sequenced.nextLeg;
-    const maxFee = BigInt(leg.maxFeePerGas);
-    const reserve = sweepReserveFloor(maxFee, []);
-    quote.legs = describeHoodLegs(sequenced, false, "bridgeDeposit");
-    quote.gas = `the ${sequenced.legKind} leg up to ${formatUnits(BigInt(leg.gas) * maxFee, 18)} ETH (gas ${leg.gas} at ${formatUnits(maxFee, 9)} gwei); each later leg is priced by Candle when it becomes next`;
-    quote.reserve = `at least ${formatUnits(reserve.wei, 18)} ETH stays in the wallet for a sweep home (${reserve.erc20Transfers} ERC-20 transfers and the final ETH transfer at twice the fee); a bridge never spends it`;
-    quote.operationId = sequenced.operationId;
+  if (json) {
+    deps.stdout.write(`${JSON.stringify(result.body)}
+`);
+    return 0;
   }
-  if (!await confirmQuote(ctx, quote, args.yes)) {
-    if (sequenced)
-      ctx.deps.stderr.write(`Nothing was signed. Operation ${sequenced.operationId} holds this wallet until ${new Date(sequenced.expiresAt).toISOString()}; a new Hood trade or sweep from it waits until then.
+  const body = result.body;
+  deps.stdout.write(body.walletScope === "selected" ? `Scope: selected — this profile can only spend from the wallets below.
+` : `Scope: all — this profile can spend from every wallet on the account, listed here or not.
 `);
-    return printTradingResult(ctx, {
-      success: true,
-      status: "cancelled",
-      clientTradeId: id,
-      kind: "swap",
-      quote,
-      ...sequenced ? { operationId: sequenced.operationId, walletHeldUntil: sequenced.expiresAt } : {}
-    });
+  if (body.profileId)
+    deps.stdout.write(`Profile: ${body.profileId}
+`);
+  if (body.wallets.length === 0) {
+    deps.stdout.write(`No wallets assigned.
+`);
+    return 0;
   }
-  if (!Number.isFinite(data.expiresAt) || data.expiresAt <= ctx.deps.now())
-    throw new TradingError("QUOTE_EXPIRED", "The quote expired before signing. Start a new intention with a new id.");
-  let result;
-  let depositHash;
-  if (sequenced && hoodOrigin) {
-    const run2 = await runSequencedLegs(ctx, key, {
-      wallet,
-      first: sequenced,
-      submitPath: "/api/v1/agent/swap/submit",
-      submitFields: { clientTradeId: id, swapId: data.swapId },
-      unwrap: (answer) => answer.payload ?? {},
-      clientId: id,
-      kind: "swap",
-      primaryLeg: "bridgeDeposit",
-      allowedLegs: bridgeLegKinds(hoodOrigin),
-      checkLeg: (kind, leg) => relayHoodLegProblem(kind, leg, { origin: hoodOrigin, payer: wallet.address, amountRaw }) === null,
-      onLanded: async () => {}
-    });
-    depositHash = run2.landed.find((leg) => leg.kind === "bridgeDeposit")?.hash;
-    result = {
-      ...run2.final,
-      chain: "hood",
-      operationId: sequenced.operationId,
-      landedLegs: run2.landed
-    };
-  } else {
-    const signed = await relaySign(ctx, key, wallet, transaction);
-    const submitted = await request(ctx, key, "/api/v1/agent/swap/submit", {
-      clientTradeId: id,
-      swapId: data.swapId,
-      signedTransactionsBase64: [signed]
-    });
-    const payload = submitted.payload ?? {};
-    const hashes = Array.isArray(payload.hashes) ? payload.hashes.filter((h) => typeof h === "string") : [];
-    depositHash = hashes[0];
-    result = submitted;
+  const rows = body.wallets.map((w) => [
+    w.linkedWalletId,
+    w.chain,
+    w.address,
+    w.label ?? "-",
+    w.spendCapable ? "yes" : "no",
+    formatTimestamp2(w.assignedAt)
+  ]);
+  deps.stdout.write(`${renderTable(["Id", "Chain", "Address", "Label", "Can sign", "Assigned"], rows)}
+`);
+  return 0;
+}
+async function keysWalletsSet(args, ctx) {
+  const { deps, apiUrl, json } = ctx;
+  const parsed = parseArgs(args, { valueFlags: ["--wallets"] });
+  if ("error" in parsed) {
+    writeUsageFailure(deps, parsed.error, json);
+    return 2;
   }
-  ctx.deps.stderr.write(`Deposit ${depositHash ? safeText(depositHash) : "sent"}: filling.${args.wait ? "" : ` Check it with candle swap status ${id} (add --wait to follow it).`}
+  const prefix = parsed.positionals[0];
+  if (!prefix) {
+    writeUsageFailure(deps, "Usage: candle keys wallets set <prefix> --wallets <id,id,...>", json);
+    return 2;
+  }
+  const raw = parsed.values["--wallets"];
+  if (raw === undefined) {
+    writeUsageFailure(deps, 'Missing --wallets. Pass a comma-separated list, or "" to assign none.', json);
+    return 2;
+  }
+  const walletIds = raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+  await printIdentity(ctx);
+  const apiKey = await resolveApiKey(deps, ctx.profile);
+  if (!apiKey) {
+    writeLocalFailure(deps, NO_API_KEY3, json);
+    return 1;
+  }
+  const result = await apiRequest(`/api/v1/agent/keys/${encodeURIComponent(prefix)}/wallets`, {
+    method: "PUT",
+    body: { walletIds },
+    auth: "key",
+    credentials: { apiKey },
+    apiUrl,
+    fetch: deps.fetch,
+    env: deps.env
+  });
+  if (!result.ok) {
+    if (result.code !== "LOOSEN_REQUIRES_SESSION") {
+      writeFailure(deps, result, { apiUrl, authType: "key" }, json);
+      return 1;
+    }
+    const hint = widenRefusedHint(prefix, walletIds);
+    writeFailure(deps, { ...result, uiHint: hint }, { apiUrl, authType: "key" }, json);
+    if (!json)
+      deps.stderr.write(`${hint}
 `);
-  const receipt = {
-    ...result,
-    clientTradeId: id,
-    kind: "swap",
-    bridge: { from, to, destination: recipient.address, ...depositHash ? { depositHash } : {} },
-    quote,
-    wallet: safeText(wallet.address)
-  };
-  if (!args.wait)
-    return printTradingResult(ctx, receipt);
-  try {
-    const found = await lookupOperation(ctx, key, id, "swap");
-    if (!found)
-      return printTradingResult(ctx, { ...receipt, waited: { final: false } });
-    const waited = await waitForSettlement(ctx, key, id, found, facts, true);
-    return printTradingResult(ctx, {
-      ...receipt,
-      job: waited.job,
-      bridgeStatus: waited.bridgeStatus,
-      waited: waited.waited
-    });
-  } catch (error) {
-    const reason = safeText(error instanceof Error ? describeRpcFailure(error) : String(error));
-    ctx.deps.stderr.write(`Could not follow the bridge (${reason}). The deposit was sent; do not send it again. Re-check with candle swap status ${id} --wait.
+    return 1;
+  }
+  if (json) {
+    deps.stdout.write(`${JSON.stringify(result.body)}
 `);
-    return printTradingResult(ctx, { ...receipt, waited: { final: false, error: reason } });
+    return 0;
+  }
+  deps.stdout.write(walletIds.length === 0 ? `Cleared every wallet assignment on ${prefix}.
+` : `Assigned ${walletIds.length} wallet${walletIds.length === 1 ? "" : "s"} to ${prefix}.
+`);
+  return 0;
+}
+async function keysWalletsScope(args, ctx) {
+  const { deps, apiUrl, json } = ctx;
+  const parsed = parseArgs(args, { valueFlags: ["--scope"] });
+  if ("error" in parsed) {
+    writeUsageFailure(deps, parsed.error, json);
+    return 2;
+  }
+  const prefix = parsed.positionals[0];
+  const scope = parsed.values["--scope"];
+  if (!prefix || scope !== "all" && scope !== "selected") {
+    writeUsageFailure(deps, "Usage: candle keys wallets scope <prefix> --scope <all|selected>", json);
+    return 2;
+  }
+  await printIdentity(ctx);
+  const apiKey = await resolveApiKey(deps, ctx.profile);
+  if (!apiKey) {
+    writeLocalFailure(deps, NO_API_KEY3, json);
+    return 1;
+  }
+  const result = await apiRequest(`/api/v1/agent/keys/${encodeURIComponent(prefix)}/wallet-scope`, {
+    method: "PUT",
+    body: { scope },
+    auth: "key",
+    credentials: { apiKey },
+    apiUrl,
+    fetch: deps.fetch,
+    env: deps.env
+  });
+  if (!result.ok) {
+    writeFailure(deps, result, { apiUrl, authType: "key" }, json);
+    return 1;
+  }
+  if (json) {
+    deps.stdout.write(`${JSON.stringify(result.body)}
+`);
+    return 0;
   }
+  deps.stdout.write(scope === "selected" ? `${prefix} is now limited to its assigned wallets.
+` : `${prefix} can now spend from every wallet on the account.
+`);
+  return 0;
+}
+async function keysWallets(args, ctx) {
+  const [verb, ...rest] = args;
+  if (verb === "set")
+    return keysWalletsSet(rest, ctx);
+  if (verb === "scope")
+    return keysWalletsScope(rest, ctx);
+  return keysWalletsList(args, ctx);
 }
 
 // src/commands/launch.ts
+init_args();
+init_evm_lite();
+init_render();
+init_solana_endpoint();
+init_solana_lite();
+init_trading();
+init_swap();
+import { randomUUID as randomUUID2 } from "node:crypto";
 var USAGE2 = "Usage: candle launch --name <name> --symbol <symbol> --image-url <https-url> --wallet <tee> [--client-trade-id <id>] [--quote-asset sol|usdc|cndl|eth|usdg] [--dex-version v3|v4] [--mode <mode>] [--rpc-url <url>] [--yes]. A Hood TEE wallet launches on Hood and needs --dex-version.";
 var QUOTE_CHAIN = {
   sol: "solana",
@@ -59985,6 +60097,7 @@ init_render();
 init_solana_endpoint();
 init_solana_lite();
 init_trading();
+init_swap();
 import { randomUUID as randomUUID3 } from "node:crypto";
 var LP_SCOPE = "lp:write";
 var CONFIRM_POLL_MS3 = 2000;
@@ -60916,6 +61029,7 @@ function hyperliquidRelayBody(typedData) {
 // src/commands/perps.ts
 init_render();
 init_trading();
+init_swap();
 var PERPS_SCOPE = "perps:write";
 var DEC_RE = /^(0|[1-9][0-9]*)(\.[0-9]+)?$/;
 var CLOID_RE = /^0x[0-9a-fA-F]{32}$/;
@@ -62508,8 +62622,12 @@ async function portfolio(args, ctx) {
   });
   if ("error" in parsed)
     return usage(ctx, parsed.error);
-  if (parsed.positionals.length > 0)
-    return usage(ctx, `Unexpected argument: ${parsed.positionals[0]}`);
+  if (parsed.positionals.length > 1)
+    return usage(ctx, `Unexpected argument: ${parsed.positionals[1]}`);
+  const filter = parsed.positionals[0];
+  if (filter !== undefined && filter.trim() === "")
+    return usage(ctx, "The filter is empty.");
+  const keep = (wallet) => filter === undefined || matches(wallet, filter);
   const { deps } = ctx;
   const chainFlag = parsed.values["--chain"];
   if (chainFlag !== undefined && !CHAINS2.includes(chainFlag)) {
@@ -62550,6 +62668,7 @@ async function portfolio(args, ctx) {
     let vaultEntries;
     let evmEntries;
     let vaultReason;
+    let known = 0;
     const raw = await readVaultRaw(resolvedVault.path);
     if (raw === null) {
       vaultReason = `no vault at ${resolvedVault.path}`;
@@ -62561,6 +62680,9 @@ async function portfolio(args, ctx) {
       const vault = hold((await unlockInteractively(ctx, resolvedVault.path, raw)).vault);
       vaultEntries = showSolana ? vault.index.entries.filter((entry) => entry.chain === "solana" && (entry.role === "vault" || entry.role === "external")).map((entry) => ({ address: entry.address, label: entry.label, role: entry.role })) : [];
       evmEntries = showHood ? vault.index.entries.filter((entry) => entry.chain === "evm" && entry.role === "vault").map((entry) => ({ address: entry.address, label: entry.label })) : [];
+      known += vaultEntries.length + evmEntries.length;
+      vaultEntries = vaultEntries.filter(keep);
+      evmEntries = evmEntries.filter(keep);
     }
     await printIdentity(ctx);
     const rpcHost = solana?.endpoint.host;
@@ -62603,7 +62725,9 @@ async function portfolio(args, ctx) {
       writeFailure(deps, candle, { apiUrl: ctx.apiUrl, authType: "key" }, ctx.json);
       return 1;
     }
-    const fromCandle = candle.body;
+    const answered = candle.body;
+    known += (showSolana ? (answered.tee ?? []).length + (answered.embedded ?? []).length : 0) + (showHood ? (answered.hood?.tee ?? []).length + (answered.hood?.embedded ?? []).length : 0);
+    const fromCandle = filter === undefined ? answered : filterCandle(answered, keep);
     const prices = { ...fromCandle.prices ?? {} };
     const candleHood = showHood ? fromCandle.hood : undefined;
     let priceFailure;
@@ -62750,9 +62874,10 @@ async function portfolio(args, ctx) {
     };
     const unavailable = chains.flatMap((chain2) => unavailableByChain[chain2]);
     const lpUnread = (lpSection?.unreadable ?? []).length;
-    const candleExplained = (fromCandle.unavailable ?? []).length > 0 || (fromCandle.hood?.unavailable ?? []).length > 0 || (fromCandle.lp?.unreadable ?? []).length > 0;
-    const listCutOff = fromCandle.complete === false && !candleExplained;
-    const complete = !listCutOff && unavailable.length === 0 && lpUnread === 0;
+    const listStatus = walletListStatus(answered);
+    const shownUnread = unavailable.length > 0 || lpUnread > 0;
+    const listNote = listStatus === "cut-off" ? "cut-off" : listStatus === "unknown" && !shownUnread ? "unknown" : null;
+    const complete = listNote === null && !shownUnread;
     const totalUsd = groups.reduce((sum, g) => sum + g.valueUsd, 0);
     const unpriced = groups.reduce((sum, g) => sum + g.unpriced, 0);
     const lp = lpSection ? {
@@ -62772,26 +62897,31 @@ async function portfolio(args, ctx) {
     }
     const hoodTotals = byChain.hood;
     if (hoodTotals) {
-      const reasons = { ...candleHood?.unpricedByReason ?? {} };
-      let vaultUnpriced = 0;
-      for (const w of groups[0]?.wallets ?? []) {
+      const counted = filter === undefined ? groups[0]?.wallets ?? [] : all;
+      const reasons = filter === undefined ? { ...candleHood?.unpricedByReason ?? {} } : {};
+      let localUnpriced = 0;
+      for (const w of counted) {
         if (w.chain !== "hood")
           continue;
         for (const h of w.holdings ?? []) {
           if (h.priceUsd !== null)
             continue;
-          vaultUnpriced += 1;
+          localUnpriced += 1;
           const reason = h.unpricedReason ?? "source-unavailable";
           reasons[reason] = (reasons[reason] ?? 0) + 1;
         }
       }
-      if (candleHood)
-        hoodTotals.unpriced = (candleHood.unpriced ?? 0) + vaultUnpriced;
+      if (filter !== undefined)
+        hoodTotals.unpriced = localUnpriced;
+      else if (candleHood)
+        hoodTotals.unpriced = (candleHood.unpriced ?? 0) + localUnpriced;
       hoodTotals.unpricedByReason = reasons;
     }
+    const matched = filter === undefined ? undefined : { filter, matched: all.length, wallets: known };
     if (ctx.json) {
       writeJson(deps, {
         ok: true,
+        ...matched ?? {},
         chains,
         totalUsd,
         unpriced,
@@ -62806,18 +62936,79 @@ async function portfolio(args, ctx) {
       });
       return complete ? 0 : 3;
     }
+    if (matched) {
+      deps.stdout.write(matched.matched === 0 ? `No wallet matches "${terminalText(matched.filter)}". ${matched.wallets} ${matched.wallets === 1 ? "wallet" : "wallets"} on this account and vault; candle portfolio with no filter shows them.
+` : `${matched.matched} of ${matched.wallets} wallets match "${terminalText(matched.filter)}". Every figure below is for those wallets only.
+`);
+      if (matched.matched === 0) {
+        writeListNote(deps.stdout, listNote);
+        return complete ? 0 : 3;
+      }
+    }
     writeTable(ctx, groups, {
       totalUsd,
       unpriced,
       chains,
       byChain,
       unavailableByChain,
-      listCutOff,
+      listNote,
       lp
     });
     return complete ? 0 : 3;
   });
 }
+function matches(wallet, filter) {
+  const needle = filter.toLowerCase();
+  return (wallet.label ?? "").toLowerCase().includes(needle) || wallet.address.toLowerCase().includes(needle);
+}
+function filterCandle(body, keep) {
+  const tee = (body.tee ?? []).filter(keep);
+  const embedded = (body.embedded ?? []).filter(keep);
+  const kept = new Set([...tee, ...embedded].map((row) => row.address));
+  const hoodTee = (body.hood?.tee ?? []).filter(keep);
+  const hoodEmbedded = (body.hood?.embedded ?? []).filter(keep);
+  const hoodKept = new Set([...hoodTee, ...hoodEmbedded].map((row) => row.address));
+  return {
+    ...body,
+    tee,
+    embedded,
+    unavailable: (body.unavailable ?? []).filter((address) => kept.has(address)),
+    ...body.lp ? {
+      lp: {
+        ...body.lp,
+        positions: body.lp.positions.filter((position) => kept.has(position.wallet)),
+        unreadable: body.lp.unreadable.filter((position) => kept.has(position.wallet))
+      }
+    } : {},
+    ...body.hood ? {
+      hood: {
+        tee: hoodTee,
+        embedded: hoodEmbedded,
+        unavailable: (body.hood.unavailable ?? []).filter((address) => hoodKept.has(address)),
+        unpriced: 0,
+        unpricedByReason: {}
+      }
+    } : {}
+  };
+}
+function walletListStatus(answered) {
+  if (typeof answered.walletsComplete === "boolean")
+    return answered.walletsComplete ? "complete" : "cut-off";
+  if (answered.complete !== false)
+    return "complete";
+  const readFailed = (answered.unavailable ?? []).length > 0 || (answered.hood?.unavailable ?? []).length > 0 || (answered.lp?.unreadable ?? []).length > 0;
+  return readFailed ? "unknown" : "cut-off";
+}
+var LIST_CUT_OFF_LINE = `Candle listed only part of this account's wallets. The total is partial.
+`;
+var LIST_UNKNOWN_LINE = `Candle did not say whether it listed every wallet. One it left out would be missing here, so this is not a complete result.
+`;
+function writeListNote(stdout, note) {
+  if (note === "cut-off")
+    stdout.write(LIST_CUT_OFF_LINE);
+  else if (note === "unknown")
+    stdout.write(LIST_UNKNOWN_LINE);
+}
 async function startEvmRead(addresses, rpcUrl, fetchFn) {
   const rpc = createEvmRpc(rpcUrl, fetchFn);
   const host = rpcHostOf2(rpcUrl);
@@ -63128,10 +63319,7 @@ ${renderTable(["GROUP", "WALLET", "POSITION", "POOL", "HOLDINGS", "UNCLAIMED FEE
     deps.stdout.write(`${unavailable} ${unavailable === 1 ? "wallet" : "wallets"} could not be read in full (${unreadByChain.map(([chain2, n]) => `${n} on ${CHAIN_NAMES[chain2]}`).join(", ")}). What was not read is marked "not read" and is not in the total.
 `);
   }
-  if (totals.listCutOff) {
-    deps.stdout.write(`Candle listed only part of this account's wallets. The total is partial.
-`);
-  }
+  writeListNote(deps.stdout, totals.listNote);
   const truncated = groups.flatMap((g) => g.wallets).filter((w) => w.truncated).length;
   if (truncated > 0) {
     deps.stdout.write(`${truncated} Hood ${truncated === 1 ? "wallet holds" : "wallets hold"} more tokens than Candle lists. The rest are not shown and not in the total.
@@ -63953,6 +64141,7 @@ async function signMessage2(args, ctx) {
 }
 
 // src/index.ts
+init_swap();
 init_tee();
 init_tee_rebind();
 
@@ -63962,6 +64151,7 @@ init_evm_lite();
 init_profiles();
 init_render();
 init_trading();
+init_swap();
 var USAGE4 = "Usage: candle transfer --to <address|wallet name|vault> --asset <SOL|USDC|CNDL|ETH|USDG>|--mint <mint>|--token <0x...> --amount <decimal|max> [--wallet <name>] [--rpc-url <url>] [--yes] [--json]";
 var TRANSFER_ASSETS = [...Object.keys(BASES), ...Object.keys(HOOD_BASES)];
 var BASE58_ADDRESS = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;
@@ -63999,10 +64189,10 @@ async function resolveDestination(ctx, key, source, to, chain2 = "solana") {
   }
   const rowChain2 = hood ? "evm" : "solana";
   const rows = (await readLinkedWallets(ctx, key)).filter((row) => row.chain === rowChain2 && row.revokedAt === undefined && !same(row.address, source.address));
-  const matches = rows.filter((row) => row.label === to || row._id === to || same(row.address, to));
-  if (matches.length > 1)
-    throw new TradingError("DESTINATION_AMBIGUOUS", `"${to}" names ${matches.length} linked wallets: ${matches.map((row) => `${row.label ?? ""} (${row._id}, ${row.address})`.trim()).join("; ")}. Name one by id or address.`);
-  const match = matches[0];
+  const matches2 = rows.filter((row) => row.label === to || row._id === to || same(row.address, to));
+  if (matches2.length > 1)
+    throw new TradingError("DESTINATION_AMBIGUOUS", `"${to}" names ${matches2.length} linked wallets: ${matches2.map((row) => `${row.label ?? ""} (${row._id}, ${row.address})`.trim()).join("; ")}. Name one by id or address.`);
+  const match = matches2[0];
   if (match)
     return { kind: "linked", address: match.address, id: match._id, ...match.label ? { label: match.label } : {} };
   if (same(to, source.address))
@@ -68149,7 +68339,7 @@ async function vaultList(args, ctx) {
       throw missingVault(ctx, resolvedVault);
     const vault = hold((await unlockInteractively(ctx, path, raw, { acceptOlderCopy: parsed.booleans.has("--accept-older-copy") })).vault);
     const all = vault.index.entries;
-    const matched = filter === undefined ? all : all.filter((entry) => matches(entry, filter));
+    const matched = filter === undefined ? all : all.filter((entry) => matches2(entry, filter));
     const solana = balances ? matched.filter((entry) => entry.chain === "solana") : [];
     const requests = Math.ceil(solana.length / CHUNK2);
     const rpcHost = solanaClient?.endpoint.host;
@@ -68284,7 +68474,7 @@ total  ${formatSol3(totalLamports)} SOL across ${solana.length - unavailable.len
     return complete ? 0 : 3;
   });
 }
-function matches(entry, filter) {
+function matches2(entry, filter) {
   const needle = filter.toLowerCase();
   return entry.label.toLowerCase().includes(needle) || entry.address.toLowerCase().includes(needle);
 }
@@ -70346,8 +70536,8 @@ async function runRebindPhase(ctx, phase, results) {
 async function verifySubjectSecret(vault, subject) {
   const secret = await decryptKey(vault, subject.id);
   try {
-    const matches2 = subject.chain === "evm" ? sameEvmAddress(evmAddressFromSecret(secret), subject.address) : addressFromSecret64(secret) === subject.address;
-    if (!matches2) {
+    const matches3 = subject.chain === "evm" ? sameEvmAddress(evmAddressFromSecret(secret), subject.address) : addressFromSecret64(secret) === subject.address;
+    if (!matches3) {
       throw new VaultError("VAULT_VERIFY_FAILED", "Stored secret does not match the subject address.");
     }
   } catch (error) {
@@ -70837,7 +71027,7 @@ New vault at ${path}, verified in full (all eight steps).
       const solana = rpcUrlFlag === undefined ? undefined : solanaClientFor(ctx, flagEndpoint(rpcUrlFlag));
       const derived = await deriveWithinBounds(ctx, vault, counts, solana);
       const apiKey = await resolveApiKey(deps, ctx.profile);
-      let matches2 = {
+      let matches3 = {
         matched: [],
         unmatched: [],
         account: undefined,
@@ -70845,16 +71035,16 @@ New vault at ${path}, verified in full (all eight steps).
         reason: "no API key is stored, so no exposure could be read"
       };
       if (apiKey !== undefined) {
-        matches2 = await matchAgainstAccount(ctx, apiKey, derived);
+        matches3 = await matchAgainstAccount(ctx, apiKey, derived);
       } else {
         deps.stderr.write(`No API key is stored for this profile, so this restore read no exposure at all.
 `);
       }
-      const outcome = await writeRestoredIndex(ctx, vault, derived, matches2, counts);
+      const outcome = await writeRestoredIndex(ctx, vault, derived, matches3, counts);
       committed = true;
       const config = await deps.readConfig();
       const ambient = Boolean(deps.env[RPC_URL_ENV]?.trim()) || Boolean(ctx.profile !== undefined && config.profiles?.[ctx.profile]?.rpcUrl?.trim());
-      const result = reportRestore(ctx, vault, derived, matches2, outcome, counts, ambient);
+      const result = reportRestore(ctx, vault, derived, matches3, outcome, counts, ambient);
       const footer = nonDefaultVaultFooter(resolvedVault);
       if (footer !== undefined)
         deps.stdout.write(footer);
@@ -71071,9 +71261,9 @@ This profile acts as account ${read.account}.
   }
   return { matched, unmatched, externalListed, account: read.account, complete: true };
 }
-async function writeRestoredIndex(ctx, vault, derived, matches2, counts) {
+async function writeRestoredIndex(ctx, vault, derived, matches3, counts) {
   const now = new Date(ctx.deps.now()).toISOString();
-  const matchByAddress = new Map(matches2.matched.map((match) => [match.entry.address, match.row]));
+  const matchByAddress = new Map(matches3.matched.map((match) => [match.entry.address, match.row]));
   const entries = derived.entries.map((entry) => {
     const row = matchByAddress.get(entry.address);
     if (entry.branch === "evmTee") {
@@ -71143,7 +71333,7 @@ async function writeRestoredIndex(ctx, vault, derived, matches2, counts) {
       exposed[located.branch].push(located.index);
   }
   const highestMatched = { solanaVault: -1, solanaTee: -1, solanaExternal: -1 };
-  for (const match of matches2.matched) {
+  for (const match of matches3.matched) {
     if (match.entry.branch === "solanaVault")
       highestMatched.solanaVault = Math.max(highestMatched.solanaVault, match.entry.index);
     if (match.entry.branch === "solanaTee")
@@ -71168,12 +71358,12 @@ async function writeRestoredIndex(ctx, vault, derived, matches2, counts) {
     },
     discovery: {
       restoredAt: now,
-      account: matches2.account ?? "",
+      account: matches3.account ?? "",
       requestedCounts: counts.requested,
       highestMatched,
       complete: false
     },
-    ...matches2.complete ? { exposureReconciledAt: now } : {}
+    ...matches3.complete ? { exposureReconciledAt: now } : {}
   };
   await commitVault(vault, { index: { hd, entries }, addKeys: derived.entries.map((entry) => entry.blob) }, ctx.deps);
   return { entries, hd };
@@ -71201,7 +71391,7 @@ function teeFieldsFor(row, ctx, network2 = "solana-mainnet") {
   }
   return { role: "tee-wallet", tee: { ...common, lifecycle: "stranded", grantIdentity } };
 }
-function reportRestore(ctx, vault, derived, matches2, outcome, counts, ambientSolanaEndpoint) {
+function reportRestore(ctx, vault, derived, matches3, outcome, counts, ambientSolanaEndpoint) {
   const { deps } = ctx;
   deps.stdout.write(`
 Recovered ${outcome.entries.length} address(es) from the phrase.
@@ -71244,29 +71434,29 @@ Every one of them is recorded with an unknown history and stays that way: this p
     deps.stdout.write(`  evm tee: indices 0 to ${counts.evmTee - 1}, on m/44'/60'/n'/1'/0'. The sealed EVM record is not restored by a phrase: a sweep of these wallets needs --from-block <n> (a Hood block at or before the first transfer in) or --token <0x...> to find tokens beyond USDG and WETH.
 `);
   }
-  if ((matches2.externalListed?.length ?? 0) > 0) {
+  if ((matches3.externalListed?.length ?? 0) > 0) {
     deps.stdout.write(`
-${matches2.externalListed?.length} address(es) this account imported are external-branch keys of this root. An external key is never registered with Candle, so this read does not flag them; their history is unknown like every other recovered key's.
+${matches3.externalListed?.length} address(es) this account imported are external-branch keys of this root. An external key is never registered with Candle, so this read does not flag them; their history is unknown like every other recovered key's.
 `);
   }
-  if (!matches2.complete) {
-    if (matches2.refused !== undefined)
+  if (!matches3.complete) {
+    if (matches3.refused !== undefined)
       deps.stdout.write(`
-${matches2.refused}: the account was not confirmed.
+${matches3.refused}: the account was not confirmed.
 `);
     deps.stdout.write(`
-No exposure was recorded: ${matches2.reason ?? "the linked-wallet read did not complete"}.
+No exposure was recorded: ${matches3.reason ?? "the linked-wallet read did not complete"}.
 `);
-    deps.stdout.write(matches2.refused !== undefined ? `The vault was created, verified and written in full; nothing in it is flagged. Run \`candle vault reconcile-exposure\` once you are on the right profile.
+    deps.stdout.write(matches3.refused !== undefined ? `The vault was created, verified and written in full; nothing in it is flagged. Run \`candle vault reconcile-exposure\` once you are on the right profile.
 ` : `A partial list that happened to be empty would read as good news, so nothing was flagged at all. Run \`candle vault reconcile-exposure\` once the read succeeds.
 `);
     return 3;
   }
-  if (matches2.unmatched.length > 0) {
+  if (matches3.unmatched.length > 0) {
     deps.stdout.write(`
-${matches2.unmatched.length} address(es) this account imported were NOT derived by this restore:
+${matches3.unmatched.length} address(es) this account imported were NOT derived by this restore:
 `);
-    for (const address of matches2.unmatched)
+    for (const address of matches3.unmatched)
       deps.stdout.write(`  ${address}
 `);
     deps.stdout.write(`
@@ -71278,7 +71468,7 @@ Either this root derives them at an index beyond the bounds used here, in which
   }
   closeVault(vault);
   deps.stdout.write(`
-${matches2.matched.length} of them are addresses this account imported, and each is flagged as remotely exposed.
+${matches3.matched.length} of them are addresses this account imported, and each is flagged as remotely exposed.
 `);
   return 0;
 }
@@ -72141,6 +72331,7 @@ init_wallets();
 init_args();
 init_render();
 init_trading();
+init_swap();
 import { randomUUID as randomUUID5 } from "node:crypto";
 var USAGE6 = "Usage: candle wallet close-empty [--wallet embedded] [--keep <mint>]... [--client-trade-id <id>] [--yes] [--json]";
 var BASE58_ADDRESS2 = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;