@candledottv/cli 0.11.16 → 0.11.18

package/dist/index.js

@@ -343,14 +343,14 @@ var init_agent_key_access = __esm(() => {
   ];
   AGENT_KEY_PRESET_LABELS = {
     read: "Read",
-    readwrite: "Read:Write",
-    readwritetransfer: "Read:Write:Transfer"
+    readwrite: "Write",
+    readwritetransfer: "Withdraw"
   };
   AGENT_KEY_CAPABILITY_CHIPS = [
     ["Launch", "launch"],
     ["Trade", "trade"],
     ["Transfer", "transfer"],
-    ["Linked transfer", "linkedTransfer"],
+    ["Withdraw", "linkedTransfer"],
     ["Report", "report"]
   ];
 });
@@ -1028,7 +1028,7 @@ async function keysCreate(args, ctx) {
   if (parsed.values["--access"] !== undefined) {
     const preset = ACCESS_LEVELS[parsed.values["--access"]];
     if (preset === undefined) {
-      writeUsageFailure(deps, `--access must be one of: ${Object.keys(ACCESS_LEVELS).join(", ")}.`, json);
+      writeUsageFailure(deps, "--access must be one of: read, write, withdraw.", json);
       return 2;
     }
     accessScopes = scopesForPreset(preset);
@@ -1226,6 +1226,9 @@ var init_keys = __esm(() => {
   init_keys_embedded_wallet();
   ACCESS_LEVELS = {
     read: "read",
+    write: "readwrite",
+    withdraw: "readwritetransfer",
+    transfer: "readwritetransfer",
     "read-write": "readwrite",
     "read-write-transfer": "readwritetransfer"
   };
@@ -14506,8 +14509,29 @@ async function request(ctx, key, path, body) {
     fetch: ctx.deps.fetch,
     env: ctx.deps.env
   });
-  if (!result.ok)
-    throw new TradingError(result.code ?? "REQUEST_FAILED", result.message);
+  if (!result.ok) {
+    const raw = result.raw;
+    const error = raw?.error;
+    const details = {};
+    for (const field of [
+      "field",
+      "stage",
+      "signature",
+      "leg",
+      "legs",
+      "hashes",
+      "retryable",
+      "evidenceStored",
+      "terminal"
+    ]) {
+      if (error?.[field] !== undefined && (field === "field" || path === "/api/v1/agent/swap/submit"))
+        details[field] = error[field];
+    }
+    throw new TradingError(result.code ?? "REQUEST_FAILED", result.message, {
+      ...Object.keys(details).length ? { details } : {},
+      ...path === "/api/v1/agent/swap/submit" && error?.stage === "unconfirmed" ? { exitCode: 3 } : {}
+    });
+  }
   if (!result.body || typeof result.body !== "object")
     throw new TradingError("INVALID_RESPONSE", "Candle returned an invalid response.");
   return result.body;
@@ -14553,7 +14577,7 @@ async function completeTradingWallet(ctx, row, appId, scope, chain2 = "solana",
   if (!row.active)
     throw new TradingError("TEE_WALLET_INACTIVE", `The payer must be a verified-active ${chainName(chain2)} TEE wallet.`);
   if (scope === "launch:write" && row.allowLaunch !== true)
-    throw new TradingError("LAUNCH_NOT_ALLOWED", `The operator must enable allowLaunch for wallet ${row.id} through PUT /api/v1/agent/wallets/${row.id}/capabilities using device/session authentication.`);
+    throw new TradingError("LAUNCH_NOT_ALLOWED", `The account owner must turn on allowLaunch for wallet ${row.id}: run candle wallets allow-launch ${row.id} on a profile signed in with candle auth login. An agent key cannot.`);
   if (!appId || !row.privyWalletId)
     throw new TradingError("SIGNER_UNAVAILABLE", "The server did not return its relay public identifiers.");
   const signer = await localSignerFor(ctx.deps, row.id, row.signerQuorumId);
@@ -27434,6 +27458,20 @@ async function resolveTeeAddress(ctx, _parsed, address, openLegacy, access3 = "r
     }
   };
 }
+async function grantSignAccess(resolved) {
+  if (resolved.privateKeyBase58 === null) {
+    const secret = await decryptKey(resolved.vault, resolved.entry.id);
+    try {
+      if (addressFromSecret64(secret) !== resolved.entry.address) {
+        throw new VaultError("VAULT_VERIFY_FAILED", `${resolved.entry.address} in the vault does not re-derive from its stored secret.`);
+      }
+      resolved.privateKeyBase58 = base58.encode(secret);
+    } finally {
+      wipe(secret);
+    }
+  }
+  resolved.legacyView = keyEntryAsKeystore(resolved.entry, resolved.privateKeyBase58);
+}
 function releaseResolvedTee(resolved) {
   if (resolved.source === "vault")
     closeVault(resolved.vault);
@@ -30311,6 +30349,8 @@ function tradingFailure(ctx, error, id) {
     writeUsageFailure(ctx.deps, error.message, ctx.json);
     return 2;
   }
+  if (error instanceof TradingError && error.details)
+    describeSwapEvidence(ctx, error.details, error.details.terminal === true);
   writeLocalFailure(ctx.deps, {
     code: error instanceof TradingError ? error.code : "TRADING_FAILED",
     message: `${error instanceof Error ? describeRpcFailure(error) : "Trading failed."}${id ? ` Operation ${id}; use candle swap status ${id} before another attempt.` : ""}`,
@@ -30335,7 +30375,31 @@ async function tradingRead(ctx, client, read) {
     throw error;
   }
 }
+async function requestSwapBuild(ctx, key, body) {
+  try {
+    return await request(ctx, key, "/api/v1/agent/swap/build", body);
+  } catch (error) {
+    if (body.payer?.type === "main" && error instanceof TradingError && error.code === "VALIDATION_FAILED" && error.details?.field === "payer") {
+      throw new TradingError("EMBEDDED_PAYER_UNSUPPORTED", "This Candle deployment cannot hold an embedded-wallet swap back for confirmation. Nothing was built. Name a TEE wallet with --wallet, or point at a deployment that supports embedded swap builds.");
+    }
+    throw error;
+  }
+}
+function describeSwapEvidence(ctx, details, terminal) {
+  if (details.stage === "not_broadcast" && terminal)
+    ctx.deps.stderr.write(`Nothing was sent. This swap job is terminal; retry with a new id.
+`);
+  if (details.stage === "unconfirmed") {
+    const hashes = Array.isArray(details.hashes) ? details.hashes : typeof details.signature === "string" ? [details.signature] : [];
+    ctx.deps.stderr.write(`Swap outcome needs verification${details.leg !== undefined ? ` (leg ${safeText(String(details.leg))})` : ""}. Known hashes: ${hashes.length ? hashes.map((hash) => safeText(String(hash))).join(", ") : "unknown"}. Do not automatically retry or use a new id.
+`);
+  }
+}
 function printTradingResult(ctx, result) {
+  if (result.kind === "swap" && result.job && typeof result.job === "object") {
+    const job = result.job;
+    describeSwapEvidence(ctx, job, job.status === "failed");
+  }
   ctx.deps.stdout.write(ctx.json ? `${JSON.stringify(result)}
 ` : `${JSON.stringify(result, null, 2)}
 `);
@@ -30533,8 +30597,6 @@ async function swap(args, ctx) {
     if (prior)
       return printTradingResult(ctx, prior);
     const payerWallet = await tradingPayer(ctx, key, flags["--wallet"]);
-    if (payerWallet.kind === "embedded" && kind === "swap")
-      throw new TradingError("PAIR_UNSUPPORTED", "The embedded wallet cannot swap between base assets from this command yet: that rail executes in one call, so there would be nothing to confirm. Trade a token with it, or name a TEE wallet for a base pair.");
     const wallet = payerWallet.kind === "tee" ? payerWallet.wallet : { address: payerWallet.address };
     const solana = lazySolanaClient(ctx, flags["--rpc-url"]);
     const decimals = await decimalsFor(ctx, from, solana);
@@ -30560,14 +30622,14 @@ async function swap(args, ctx) {
       amountRaw = rawAmount(flags["--amount"], decimals);
     if (BigInt(amountRaw) > BigInt(Number.MAX_SAFE_INTEGER))
       throw new TradingError("INVALID_AMOUNT", "Amount exceeds the venue's exact integer range.");
-    if (payerWallet.kind === "embedded")
+    if (payerWallet.kind === "embedded" && kind === "trade")
       await assertDeferredExecuteSupported(ctx, key, id);
     if (!await claimOperation(ctx, key, id, kind))
       throw new TradingError("OPERATION_ALREADY_STARTED", "This machine already started this id; no write was resent.");
     ctx.deps.stderr.write(`Operation: ${id}
 `);
     const payer = payerWallet.kind === "tee" ? { type: "linked", linkedWalletId: payerWallet.wallet.id } : { type: "main" };
-    const built = kind === "swap" ? await request(ctx, key, "/api/v1/agent/swap/build", {
+    const built = kind === "swap" ? await requestSwapBuild(ctx, key, {
       clientTradeId: id,
       from,
       to,
@@ -30589,7 +30651,7 @@ async function swap(args, ctx) {
       return printTradingResult(ctx, { ...built, clientTradeId: id, kind });
     const data = swapBuildSchema.parse(kind === "swap" ? built.payload : built);
     if (kind === "swap" && (data.venue !== "jupiter" || data.recipient !== wallet.address))
-      throw new TradingError("INVALID_RESPONSE", "A TEE base swap must use Jupiter and return to its payer.");
+      throw new TradingError("INVALID_RESPONSE", "A base swap must use Jupiter and return to its payer.");
     if (kind === "trade" && (built.chain !== "solana" || built.walletAddress !== wallet.address))
       throw new TradingError("INVALID_RESPONSE", "The token build does not name the requested Solana payer.");
     const artifacts = kind === "swap" ? { ...data, transactionBase64: undefined, quoteSource: undefined, quoteAsset: undefined } : data.artifacts;
@@ -30616,9 +30678,11 @@ async function swap(args, ctx) {
     if (!Number.isFinite(data.expiresAt) || data.expiresAt <= ctx.deps.now())
       throw new TradingError("QUOTE_EXPIRED", "The quote expired before signing. Start a new intention with a new id.");
     if (payerWallet.kind === "embedded") {
-      const executed = await request(ctx, key, "/api/v1/trade/agent/execute", { clientTradeId: id });
+      const executed = kind === "swap" ? await request(ctx, key, "/api/v1/agent/swap/submit", { clientTradeId: id, swapId: data.swapId }) : await request(ctx, key, "/api/v1/trade/agent/execute", { clientTradeId: id });
+      const settled2 = kind === "swap" ? reportSettlement(ctx, executed.payload?.settlement, { asset: to, decimals: outDecimals }, id) : {};
       return printTradingResult(ctx, {
         ...executed,
+        ...settled2,
         clientTradeId: id,
         kind,
         quote,
@@ -30728,8 +30792,6 @@ async function hoodSwap(ctx, args) {
   if (prior)
     return printTradingResult(ctx, prior);
   const payer = await tradingPayer(ctx, key, flags["--wallet"], "swap:write", "hood");
-  if (payer.kind === "embedded" && kind === "swap")
-    throw new TradingError("PAIR_UNSUPPORTED", "The embedded wallet cannot swap ETH and USDG from this command: that rail executes in one call, so there would be nothing to confirm. Trade a token with it, or name a Hood TEE wallet.");
   const payerAddress = payer.kind === "tee" ? payer.wallet.address : payer.address;
   const rpc = lazyEvmRpc(ctx, flags["--rpc-url"]);
   const decimals = await hoodDecimals(from, rpc);
@@ -30742,7 +30804,7 @@ async function hoodSwap(ctx, args) {
       throw new TradingError("INVALID_AMOUNT", "The selected percentage rounds to zero raw units.");
   } else
     amountRaw = rawAmount(flags["--amount"], decimals);
-  if (payer.kind === "embedded")
+  if (payer.kind === "embedded" && kind === "trade")
     await assertDeferredExecuteSupported(ctx, key, id);
   if (!await claimOperation(ctx, key, id, kind))
     throw new TradingError("OPERATION_ALREADY_STARTED", "This machine already started this id; no write was resent.");
@@ -30751,7 +30813,7 @@ async function hoodSwap(ctx, args) {
   const payerBody = payer.kind === "tee" ? { type: "linked", linkedWalletId: payer.wallet.id } : { type: "main" };
   const base = from.base ?? to.base;
   const token = from.base ? to.asset : from.asset;
-  const built = kind === "swap" ? await request(ctx, key, "/api/v1/agent/swap/build", {
+  const built = kind === "swap" ? await requestSwapBuild(ctx, key, {
     clientTradeId: id,
     from: from.asset,
     to: to.asset,
@@ -30825,8 +30887,16 @@ async function hoodSwap(ctx, args) {
   if (!Number.isFinite(data.expiresAt) || data.expiresAt <= ctx.deps.now())
     throw new TradingError("QUOTE_EXPIRED", "The quote expired before signing. Start a new intention with a new id.");
   if (payer.kind === "embedded") {
-    const executed = await request(ctx, key, "/api/v1/trade/agent/execute", { clientTradeId: id });
-    return printTradingResult(ctx, { ...executed, clientTradeId: id, kind, quote, wallet: safeText(payerAddress) });
+    const executed = kind === "swap" ? await request(ctx, key, "/api/v1/agent/swap/submit", { clientTradeId: id, swapId: data.swapId }) : await request(ctx, key, "/api/v1/trade/agent/execute", { clientTradeId: id });
+    const settled2 = kind === "swap" ? reportSettlement(ctx, executed.payload?.settlement, { asset: to.asset, decimals: outDecimals }, id) : {};
+    return printTradingResult(ctx, {
+      ...executed,
+      ...settled2,
+      clientTradeId: id,
+      kind,
+      quote,
+      wallet: safeText(payerAddress)
+    });
   }
   const wallet = payer.wallet;
   if (wallet.chain !== "evm" || !sequenced)
@@ -30935,7 +31005,7 @@ async function bridgeSwap(ctx, args) {
     throw new TradingError("OPERATION_ALREADY_STARTED", "This machine already started this id; no write was resent.");
   ctx.deps.stderr.write(`Operation: ${id}
 `);
-  const built = await request(ctx, key, "/api/v1/agent/swap/build", {
+  const built = await requestSwapBuild(ctx, key, {
     clientTradeId: id,
     from,
     to,
@@ -32319,23 +32389,10 @@ async function teeSweepEvm(args, ctx) {
   if (!address || extra !== undefined) {
     return usage(ctx, "Usage: candle tee sweep <0x address> [--rpc-url <url>] [--emergency] [--token <0x...>]... [--from-block <n>]");
   }
-  const tokens = [];
-  for (const raw of tokenFlags) {
-    const checked = checkEvmAddress(raw);
-    if (!checked.ok)
-      return usage(ctx, `--token must be an ERC-20 contract address: ${raw || "(empty)"} is ${checked.reason}.`);
-    tokens.push(checked.address);
-  }
-  let fromBlock;
-  const fromBlockRaw = parsed.values["--from-block"];
-  if (fromBlockRaw !== undefined) {
-    if (!/^\d+$/.test(fromBlockRaw))
-      return usage(ctx, `--from-block must be a Hood block number: ${fromBlockRaw} is not.`);
-    fromBlock = BigInt(fromBlockRaw);
-  }
-  const client = resolveHoodClient(ctx, parsed.values["--rpc-url"]);
-  if ("error" in client)
-    return usage(ctx, client.error);
+  const options = sweepOptions(ctx, parsed, tokenFlags);
+  if (typeof options === "number")
+    return options;
+  const { tokens, fromBlock, client } = options;
   if (!refuseEnvPassphrase(ctx))
     return 1;
   if (!requireTty(ctx, "tee sweep"))
@@ -32354,6 +32411,26 @@ async function teeSweepEvm(args, ctx) {
     return sweepEvmWallet({ ctx, vault, hold, entry, client, emergency, tokenFlags: tokens, fromBlock });
   });
 }
+function sweepOptions(ctx, parsed, tokenFlags) {
+  const tokens = [];
+  for (const raw of tokenFlags) {
+    const checked = checkEvmAddress(raw);
+    if (!checked.ok)
+      return usage(ctx, `--token must be an ERC-20 contract address: ${raw || "(empty)"} is ${checked.reason}.`);
+    tokens.push(checked.address);
+  }
+  let fromBlock;
+  const fromBlockRaw = parsed.values["--from-block"];
+  if (fromBlockRaw !== undefined) {
+    if (!/^\d+$/.test(fromBlockRaw))
+      return usage(ctx, `--from-block must be a Hood block number: ${fromBlockRaw} is not.`);
+    fromBlock = BigInt(fromBlockRaw);
+  }
+  const client = resolveHoodClient(ctx, parsed.values["--rpc-url"]);
+  if ("error" in client)
+    return usage(ctx, client.error);
+  return { tokens, fromBlock, client };
+}
 async function sweepEvmWallet(input) {
   const { ctx, client, emergency, hold } = input;
   const { deps, json } = ctx;
@@ -32931,78 +33008,83 @@ async function teeDisableEvm(args, ctx) {
   const resolvedVault = vaultPathFor(ctx, parsed);
   if ("error" in resolvedVault)
     return usage(ctx, resolvedVault.error);
-  const { deps, json } = ctx;
   await printIdentity(ctx);
   return runVaultCommand(ctx, async ({ hold }) => {
     const raw = await requireVaultRaw(ctx, resolvedVault);
     const opened = await unlockInteractively(ctx, resolvedVault.path, raw, { acceptOlderCopy: true });
-    let vault = hold(opened.vault);
+    const vault = hold(opened.vault);
     const entry = findEvmTee(vault, address);
     if (entry === undefined)
       return unknownWallet(ctx, address);
-    if (entry.linkedWalletId === undefined) {
-      writeLocalFailure(deps, { code: "TEE_WALLET_NOT_ENABLED", message: `${entry.address} was never enabled; there is nothing to stop.` }, json);
-      return 1;
+    return (await disableEvmEntry(ctx, vault, hold, entry, false)).code;
+  });
+}
+async function disableEvmEntry(ctx, opened, hold, entry, inDemote) {
+  const { deps, json } = ctx;
+  let vault = opened;
+  if (entry.linkedWalletId === undefined) {
+    writeLocalFailure(deps, { code: "TEE_WALLET_NOT_ENABLED", message: `${entry.address} was never enabled; there is nothing to stop.` }, json);
+    return { code: 1, vault };
+  }
+  const linkedWalletId = entry.linkedWalletId;
+  const stopRequestedAt = entry.tee?.stopRequestedAt ?? new Date(deps.now()).toISOString();
+  vault = hold(await patchTee(ctx, vault, entry.id, (tee) => ({ ...tee, stopRequestedAt })));
+  const unconfirmed = (detail, suggestion) => {
+    if (json) {
+      writeJson(deps, {
+        ok: false,
+        code: "STOP_UNCONFIRMED",
+        message: detail,
+        address: entry.address,
+        linkedWalletId,
+        stopRequestedAt,
+        remoteEnforcement: "unconfirmed",
+        suggestion
+      });
+      return { code: 1, vault };
     }
-    const linkedWalletId = entry.linkedWalletId;
-    const stopRequestedAt = entry.tee?.stopRequestedAt ?? new Date(deps.now()).toISOString();
-    vault = hold(await patchTee(ctx, vault, entry.id, (tee) => ({ ...tee, stopRequestedAt })));
-    const unconfirmed = (detail, suggestion) => {
-      if (json) {
-        writeJson(deps, {
-          ok: false,
-          code: "STOP_UNCONFIRMED",
-          message: detail,
-          address: entry.address,
-          linkedWalletId,
-          stopRequestedAt,
-          remoteEnforcement: "unconfirmed",
-          suggestion
-        });
-        return 1;
-      }
-      deps.stderr.write(`${detail}
+    deps.stderr.write(`${detail}
 Stop intent recorded locally at ${stopRequestedAt}: this CLI will not fund ${entry.address} again. Remote enforcement is UNCONFIRMED: the agent may still trade until the server acknowledges the stop.
 ${suggestion}
 `);
-      return 1;
-    };
-    const apiKey = await resolveApiKey(deps, ctx.profile);
-    if (!apiKey) {
-      return unconfirmed("No API key available, so the server was not asked to stop the agent.", `Stop it from your Candle session (revoke linked wallet ${linkedWalletId}), or restore the key and re-run: candle tee disable ${entry.address}`);
-    }
-    const result = await apiRequest(`/api/v1/agent/wallets/${encodeURIComponent(linkedWalletId)}`, {
-      method: "DELETE",
-      auth: "key",
-      credentials: { apiKey },
-      apiUrl: ctx.apiUrl,
-      fetch: deps.fetch,
-      env: deps.env
-    });
-    if (!result.ok) {
-      return unconfirmed(`The stop request failed: ${result.message ?? `HTTP ${result.status}`}.`, `Re-run: candle tee disable ${entry.address}. If the key is lost or revoked, stop it from your Candle session (revoke linked wallet ${linkedWalletId}).`);
-    }
-    const outcome = readDisableOutcome(result.body);
-    for (const warning of bridgeDisableWarnings(entry.address, result.body))
-      deps.stderr.write(`${warning}
+    return { code: 1, vault };
+  };
+  const apiKey = await resolveApiKey(deps, ctx.profile);
+  if (!apiKey) {
+    return unconfirmed("No API key available, so the server was not asked to stop the agent.", `Stop it from your Candle session (revoke linked wallet ${linkedWalletId}), or restore the key and re-run: candle tee disable ${entry.address}`);
+  }
+  const result = await apiRequest(`/api/v1/agent/wallets/${encodeURIComponent(linkedWalletId)}`, {
+    method: "DELETE",
+    auth: "key",
+    credentials: { apiKey },
+    apiUrl: ctx.apiUrl,
+    fetch: deps.fetch,
+    env: deps.env
+  });
+  if (!result.ok) {
+    return unconfirmed(`The stop request failed: ${result.message ?? `HTTP ${result.status}`}.`, `Re-run: candle tee disable ${entry.address}. If the key is lost or revoked, stop it from your Candle session (revoke linked wallet ${linkedWalletId}).`);
+  }
+  const outcome = readDisableOutcome(result.body);
+  for (const warning of bridgeDisableWarnings(entry.address, result.body))
+    deps.stderr.write(`${warning}
 `);
-    if (json) {
-      writeJson(deps, { address: entry.address, linkedWalletId, ...result.body });
-      return outcome.complete ? 0 : 3;
-    }
-    if (outcome.complete) {
-      deps.stdout.write(`Stopped ${entry.address}. Remote signing denial verified; the wallet is quarantined.
+  if (json) {
+    writeJson(deps, { address: entry.address, linkedWalletId, ...result.body });
+    return { code: outcome.complete ? 0 : 3, vault };
+  }
+  if (outcome.complete) {
+    deps.stdout.write(`Stopped ${entry.address}. Remote signing denial verified; the wallet is quarantined.
 `);
+    if (!inDemote)
       deps.stdout.write(`Recover the funds: candle tee sweep ${entry.address}
 `);
-      return 0;
-    }
-    deps.stdout.write(`Agent trading stopped at Candle for ${entry.address}. Remote policy verification is pending${outcome.reasonCode ? ` (${outcome.reasonCode})` : ""}.
+    return { code: 0, vault };
+  }
+  deps.stdout.write(`Agent trading stopped at Candle for ${entry.address}. Remote policy verification is pending${outcome.reasonCode ? ` (${outcome.reasonCode})` : ""}.
 Funds remain in the TEE wallet and its TEE signing authority may still be active. Re-run: candle tee disable ${entry.address}
-If the provider is down or theft is suspected: candle tee sweep ${entry.address} --emergency
-`);
-    return 3;
-  });
+${inDemote ? "" : `If the provider is down or theft is suspected: candle tee sweep ${entry.address} --emergency
+`}`);
+  return { code: 3, vault };
 }
 async function vaultDemoteEvm(args, ctx) {
   const { rest, values: tokenFlags } = extractRepeated(args, "--token");
@@ -33017,6 +33099,9 @@ async function vaultDemoteEvm(args, ctx) {
   if (!address || extra !== undefined) {
     return usage(ctx, "Usage: candle vault demote <tee-address> [--rpc-url <url>] [--emergency] [--sweep-to <label>]");
   }
+  const options = sweepOptions(ctx, parsed, tokenFlags);
+  if (typeof options === "number")
+    return options;
   if (!refuseEnvPassphrase(ctx))
     return 1;
   if (!requireTty(ctx, "vault demote"))
@@ -33026,13 +33111,13 @@ async function vaultDemoteEvm(args, ctx) {
     return usage(ctx, resolvedVault.error);
   const sweepTo = parsed.values["--sweep-to"];
   let emergency = parsed.booleans.has("--emergency");
-  const snapshot = await runVaultCommand(ctx, async ({ hold }) => {
+  return runVaultCommand(ctx, async ({ hold }) => {
     const raw = await requireVaultRaw(ctx, resolvedVault);
     const opened = await unlockInteractively(ctx, resolvedVault.path, raw, {
       acceptOlderCopy: parsed.booleans.has("--accept-older-copy")
     });
-    const vault = hold(opened.vault);
-    const entry = findEvmTee(vault, address);
+    let vault = hold(opened.vault);
+    let entry = findEvmTee(vault, address);
     if (entry === undefined)
       return unknownWallet(ctx, address);
     if (entry.tee?.vaultDestination === undefined) {
@@ -33045,39 +33130,40 @@ async function vaultDemoteEvm(args, ctx) {
         chain: "evm",
         acceptUnknownExposure: parsed.booleans.has("--accept-unknown-exposure")
       });
-      hold(await patchTee(ctx, vault, entry.id, (tee) => ({ ...tee, vaultDestination: destination.address })));
+      vault = hold(await patchTee(ctx, vault, entry.id, (tee) => ({ ...tee, vaultDestination: destination.address })));
+      entry = findEvmTee(vault, address);
     }
     if (entry.linkedWalletId === undefined) {
       ctx.deps.stdout.write(`No linkedWalletId is recorded for ${entry.address}; disable was not called and remote authority stays unknown.
 `);
       emergency = true;
     }
-    return 0;
-  });
-  if (snapshot !== 0)
-    return snapshot;
-  if (!emergency) {
-    const disableCode = await teeDisableEvm([address, ...keystoreArgs(parsed)], ctx);
-    if (disableCode !== 0 && disableCode !== 3)
-      return disableCode;
-    if (disableCode === 3) {
-      ctx.deps.stdout.write(`The disable is not yet verified; the sweep below will wait for quarantine. If the provider is down or theft is suspected, run: candle vault demote ${address} --emergency
+    if (!emergency) {
+      await printIdentity(ctx);
+      const disabled = await disableEvmEntry(ctx, vault, hold, entry, true);
+      if (disabled.code !== 0 && disabled.code !== 3)
+        return disabled.code;
+      vault = disabled.vault;
+      entry = findEvmTee(vault, address);
+      if (disabled.code === 3) {
+        ctx.deps.stdout.write(`The disable is not yet verified; the sweep below will wait for quarantine. If the provider is down or theft is suspected, run: candle vault demote ${address} --emergency
 `);
+      }
     }
-  }
-  const sweepArgs = [address, ...keystoreArgs(parsed)];
-  if (parsed.values["--rpc-url"] !== undefined)
-    sweepArgs.push("--rpc-url", parsed.values["--rpc-url"]);
-  if (parsed.values["--from-block"] !== undefined)
-    sweepArgs.push("--from-block", parsed.values["--from-block"]);
-  for (const token of tokenFlags)
-    sweepArgs.push("--token", token);
-  if (emergency)
-    sweepArgs.push("--emergency");
-  return teeSweepEvm(sweepArgs, ctx);
-}
-function keystoreArgs(parsed) {
-  return parsed.values["--keystore"] !== undefined ? ["--keystore", parsed.values["--keystore"]] : [];
+    if (!ctx.json)
+      ctx.deps.stdout.write(`Sweeping remaining funds to ${entry.tee?.vaultDestination}...
+`);
+    return sweepEvmWallet({
+      ctx,
+      vault,
+      hold,
+      entry,
+      client: options.client,
+      emergency,
+      tokenFlags: options.tokens,
+      fromBlock: options.fromBlock
+    });
+  });
 }
 var MAX_TOKEN_TRANSFER_GAS = 1000000n;
 var init_tee_evm = __esm(() => {
@@ -33445,6 +33531,9 @@ async function commitTee(deps, opened, mutate, opts = {}) {
     };
   }
 }
+function vaultActiveTee(ctx, resolved) {
+  return { source: "vault", resolved, entry: resolved.legacyView, path: "vault", ctx };
+}
 function applyKeystoreViewToVaultEntry(entry, view) {
   if (view.linkedWalletId !== undefined)
     entry.linkedWalletId = view.linkedWalletId;
@@ -33499,18 +33588,8 @@ async function openActiveTee(ctx, parsed, address, access3) {
   const resolved = await resolveTeeAddress(ctx, parsed, address, () => openExistingTeeStore(ctx, parsed), access3);
   if (!resolved.ok)
     return { ok: false, code: resolved.code };
-  if (resolved.resolved.source === "vault") {
-    return {
-      ok: true,
-      active: {
-        source: "vault",
-        resolved: resolved.resolved,
-        entry: resolved.resolved.legacyView,
-        path: "vault",
-        ctx
-      }
-    };
-  }
+  if (resolved.resolved.source === "vault")
+    return { ok: true, active: vaultActiveTee(ctx, resolved.resolved) };
   return {
     ok: true,
     active: {
@@ -34120,7 +34199,7 @@ async function teeStatus(args, ctx) {
       releaseResolvedTee(local);
   }
 }
-async function teeDisable(args, ctx) {
+async function teeDisable(args, ctx, demote) {
   const { deps, apiUrl, json } = ctx;
   if (namesEvmWallet(args))
     return teeDisableEvm(args, ctx);
@@ -34133,7 +34212,7 @@ async function teeDisable(args, ctx) {
   if (!address || extra !== undefined)
     return usage2(ctx, "Usage: candle tee disable <address>");
   await printIdentity(ctx);
-  const openedActive = await openActiveTee(ctx, parsed, address, "read");
+  const openedActive = demote ? { ok: true, active: vaultActiveTee(ctx, demote.resolved) } : await openActiveTee(ctx, parsed, address, "read");
   if (!openedActive.ok)
     return openedActive.code;
   const { active } = openedActive;
@@ -34202,17 +34281,37 @@ ${suggestion}
     if (outcome.complete) {
       deps.stdout.write(`Stopped ${address}. Remote signing denial verified; the wallet is quarantined.
 `);
-      deps.stdout.write(`Recover the funds: candle tee sweep ${address}
+      if (!demote)
+        deps.stdout.write(`Recover the funds: candle tee sweep ${address}
 `);
       return 0;
     }
     deps.stdout.write(`Agent trading stopped at Candle for ${address}. Remote policy verification is pending${outcome.reasonCode ? ` (${outcome.reasonCode})` : ""}.
 Funds remain in the TEE wallet and its TEE signing authority may still be active. Re-run: candle tee disable ${address}
-If the provider is down or theft is suspected: candle tee sweep ${address} --emergency
+If the provider is down or theft is suspected: ${demote ? `candle vault demote ${address}` : `candle tee sweep ${address}`} --emergency
 `);
     return 3;
   } finally {
-    releaseActiveTee(active);
+    if (!demote)
+      releaseActiveTee(active);
+  }
+}
+async function nothingLeftToSweep(solana, entry) {
+  const tee = entry.tee;
+  if ((tee?.sweepPending?.length ?? 0) > 0)
+    return false;
+  if ((tee?.sweepReceipts?.length ?? 0) > 0 && tee?.sweptAt === undefined)
+    return false;
+  try {
+    if (await solana.rpc.getBalance(entry.address) > 0n)
+      return false;
+    for (const programId of [TOKEN_PROGRAM_ID, TOKEN_2022_PROGRAM_ID]) {
+      if ((await solana.rpc.getTokenAccountsByOwner(entry.address, programId)).length > 0)
+        return false;
+    }
+    return true;
+  } catch {
+    return false;
   }
 }
 function refusalState(raw) {
@@ -34320,7 +34419,7 @@ async function broadcastMessage(rpc, ctx, secret, message, blockhash, pending, r
     error: `transaction ${signature} was not finalized within ${CONFIRM_MAX_POLLS * CONFIRM_POLL_MS / 1000}s; it may still land${echoNote}`
   };
 }
-async function teeSweep(args, ctx) {
+async function teeSweep(args, ctx, demote) {
   const { deps, apiUrl, json } = ctx;
   if (namesEvmWallet(args))
     return teeSweepEvm(args, ctx);
@@ -34336,11 +34435,24 @@ async function teeSweep(args, ctx) {
   const [address, extra] = parsed.positionals;
   if (!address || extra !== undefined)
     return usage2(ctx, "Usage: candle tee sweep <address> [--rpc-url <url>] [--emergency]");
-  const solana = await openSolanaClient(ctx, parsed.values["--rpc-url"]);
+  const solana = demote ? demote.solana : await openSolanaClient(ctx, parsed.values["--rpc-url"]);
   if ("error" in solana)
     return usage2(ctx, solana.error);
   const emergency = parsed.booleans.has("--emergency");
-  const openedActive = await openActiveTee(ctx, parsed, address, "sign");
+  let openedActive;
+  if (demote) {
+    try {
+      await grantSignAccess(demote.resolved);
+    } catch (error) {
+      if (!isVaultError(error))
+        throw error;
+      writeLocalFailure(deps, { code: error.code, message: error.message }, json);
+      return error.exitCode;
+    }
+    openedActive = { ok: true, active: vaultActiveTee(ctx, demote.resolved) };
+  } else {
+    openedActive = await openActiveTee(ctx, parsed, address, "sign");
+  }
   if (!openedActive.ok)
     return openedActive.code;
   const { active } = openedActive;
@@ -35124,7 +35236,8 @@ Stop the agent from your Candle session if you have not, and re-run candle tee d
 `);
     return 3;
   } finally {
-    releaseActiveTee(active);
+    if (!demote)
+      releaseActiveTee(active);
   }
 }
 var MIN_PASSPHRASE_LENGTH = 12, USDC_MINT = "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v", CONFIRM_POLL_MS = 2000, CONFIRM_MAX_POLLS = 45, StoreChangedError, TOKEN_ACCOUNT_STATE_OFFSET = 108, TOKEN_ACCOUNT_STATE_FROZEN = 2;
@@ -35139,6 +35252,7 @@ var init_tee = __esm(() => {
   init_solana_endpoint();
   init_solana_lite();
   init_token_2022();
+  init_errors();
   init_store();
   init_tee_resolve();
   init_wallet_import_flow();
@@ -50758,7 +50872,7 @@ var init_convert = __esm(() => {
 });
 
 // ../mcp/src/version.ts
-var SERVER_VERSION = "0.10.6";
+var SERVER_VERSION = "0.10.7";
 
 // ../mcp/src/update-notice.ts
 function newer(a, b) {
@@ -52063,7 +52177,7 @@ function planTableMarkdown(table) {
   return [line(headers2), line(headers2.map(() => "---")), ...rows.map(line)].join(`
 `);
 }
-var PLAN_CAPABILITY_NOTE2 = "A capability marked yes is what the plan allows. It is subject to the deployment's own switches (perps and own-wallet bridges each have one) and to the wallet, scopes and setup the feature needs.", PLAN_CAPABILITY_LABELS2, PLAN_LABELS2;
+var PLAN_CAPABILITY_NOTE2 = "A capability marked yes is what the plan allows. It is subject to the deployment's own switches (perps and own-wallet bridges each have one) and to the wallet, scopes and setup the feature needs. Every plan can launch a token from its embedded wallet, with an optional dev buy (same transaction on Solana; best-effort follow-up on Hood), through the headless launch; the two launch rows are additional routes, not the only ones.", PLAN_CAPABILITY_LABELS2, PLAN_LABELS2;
 var init_plans = __esm(() => {
   PLAN_CAPABILITY_LABELS2 = {
     tradeCandleTokens: "Trade Candle-launched tokens",
@@ -52072,8 +52186,8 @@ var init_plans = __esm(() => {
     sellExternalTokens: "Sell tokens not launched on Candle",
     buyExternalTokens: "Buy tokens not launched on Candle",
     hyperliquidPerps: "Hyperliquid perps (when enabled)",
-    selfLaunch: "Self-launch from a linked wallet",
-    atomicLaunch: "Atomic launch with first buys",
+    selfLaunch: "Launch from a linked or TEE wallet (self-signed)",
+    atomicLaunch: "Atomic launch: launch + 1–4 first buys in one bundle",
     createLinkedWallets: "Create linked wallets",
     importLinkedWallets: "Import linked wallets",
     limitOrders: "Limit orders",
@@ -52288,7 +52402,7 @@ function registerTools(server, env = process.env) {
   };
   register("candle_launch_token", {
     title: "Launch a token on Candle",
-    description: "Launch a new token via the Candle headless launch API. Set dryRun: true to validate without spending anything.",
+    description: "Launch a new token via the Candle headless launch API, from the account's embedded wallet. Works on every plan, Free included. Set dryRun: true to validate without spending anything.",
     inputSchema: launchTokenShape
   }, async (args) => callAndRelay("candle_launch_token", args, cfg));
   register("candle_get_market", {
@@ -52454,7 +52568,7 @@ MARKET_NOT_FOUND means Candle has no market for that token and this could not ru
   });
   register("candle_launch_and_seed", {
     title: "Launch a token and seed it",
-    description: "Launch a new token with an optional dev-buy seed bundled into the launch itself, then " + "return the fresh market state and token links in one result. MOVES REAL FUNDS unless " + "dryRun. Seeds above the platform dev-buy ceiling are rejected (DEV_BUY_TOO_HIGH); " + "launch, then top up with candle_trade.",
+    description: "Launch a new token from the account's embedded wallet, with an optional dev-buy seed (in the " + "launch transaction on solana, a best-effort follow-up on hood). Works on every plan, Free included (this is not the atomic launch). Then " + "return the fresh market state and token links in one result. MOVES REAL FUNDS unless " + "dryRun. Seeds above the platform dev-buy ceiling are rejected (DEV_BUY_TOO_HIGH); " + "launch, then top up with candle_trade.",
     inputSchema: launchAndSeedShape
   }, async (args) => {
     const result = await executeLaunchAndSeed(args, cfg, fetch);
@@ -52631,7 +52745,7 @@ var init_tools = __esm(() => {
   launchAndSeedShape = {
     ...seedableLaunchShape,
     clientLaunchId: exports_external.string().optional().describe("Idempotency key. Auto-generated when omitted and echoed in the result."),
-    devBuy: exports_external.string().optional().describe('Seed buy in DECIMAL units of the quote asset this launch selects (e.g. "0.25" SOL, or ' + "ETH on hood), bundled into the launch transaction itself. Follows quoteAsset, which " + "defaults to sol on solana and eth on hood. Capped by the platform dev-buy ceiling; for " + "a larger seed, launch then follow with candle_trade.")
+    devBuy: exports_external.string().optional().describe('Seed buy in DECIMAL units of the quote asset this launch selects (e.g. "0.25" SOL, or ' + "ETH on hood), bundled into the launch transaction itself on solana and sent as a follow-up " + "transaction on hood. Paid from the account's embedded wallet. Follows quoteAsset, which " + "defaults to sol on solana and eth on hood. Capped by the platform dev-buy ceiling; for " + "a larger seed, launch then follow with candle_trade.")
   };
   transferShape = {
     chain: exports_external.enum(["solana", "hood"]).describe("Which chain the transfer executes on"),
@@ -52770,7 +52884,7 @@ init_render();
 init_secret_store();
 
 // src/version.ts
-var CLI_VERSION = "0.11.16";
+var CLI_VERSION = "0.11.18";
 
 // src/commands/auth.ts
 init_keys_embedded_wallet();
@@ -52794,7 +52908,7 @@ async function authLogin(args, ctx) {
   }
   const scopes = parsed.values["--scopes"] ? parseScopesList(parsed.values["--scopes"]) : undefined;
   if (scopes?.includes("transfer:bound")) {
-    writeUsageFailure(deps, "transfer:bound is not available on a device login. Mint a Read:Write:Transfer key with: candle keys create --access read-write-transfer, or widen an existing key with: candle keys access <prefix> --access read-write-transfer", json);
+    writeUsageFailure(deps, "transfer:bound is not available on a device login. Mint a Withdraw key with: candle keys create --access withdraw, or widen an existing key with: candle keys access <prefix> --access withdraw", json);
     return 2;
   }
   const label = parsed.values["--label"]?.trim();
@@ -53282,7 +53396,7 @@ var HELP = {
   swap: {
     group: "Trade",
     summary: "Quote, confirm and swap on Solana or Hood, bridge between them; read an operation by id",
-    description: "Swaps run through a TEE wallet's bound key: the quote is shown and confirmed before anything is sent, and the first buy after a launch is this command rather than part of the launch. The assets decide the chain (ETH, USDG or a 0x token is Hood; SOL, USDC, CNDL or a mint is Solana) and a named wallet must be on it. A Hood TEE wallet signs one leg at a time: approve, Permit2, trade, then the fee, each only after the one before it landed. SOL or USDC to ETH or USDG, or back, is a bridge through Relay from a TEE wallet into this key's own TEE wallet on the other chain (--to names it when there are several); Candle charges no fee, the key needs a raw cap on the origin asset, and this machine checks Relay's deposit before it is signed. The bridge prints its deposit and returns while Relay fills; --wait follows it for up to ten minutes. While it is open, a sweep of either wallet refuses BRIDGE_IN_FLIGHT for two hours. Vault to vault: fund the Solana TEE wallet from the vault, bridge, then disable and sweep the Hood TEE wallet into its vault. Every plan can trade Candle-launched tokens and base assets, and sell a token it holds that was not launched on Candle; buying such a token needs Pro or Max (TIER_REQUIRED otherwise). Each trade pays the plan's agent fee on top; a base-pair swap or a bridge between this key's own wallets pays none. candle plans shows the fees in force.",
+    description: "Swaps run through a TEE wallet's bound key: the quote is shown and confirmed before anything is sent. The first buy after a launch is this command, unless the launch carried it with candle launch --buy. The assets decide the chain (ETH, USDG or a 0x token is Hood; SOL, USDC, CNDL or a mint is Solana) and a named wallet must be on it. A Hood TEE wallet signs one leg at a time: approve, Permit2, trade, then the fee, each only after the one before it landed. SOL or USDC to ETH or USDG, or back, is a bridge through Relay from a TEE wallet into this key's own TEE wallet on the other chain (--to names it when there are several); Candle charges no fee, the key needs a raw cap on the origin asset, and this machine checks Relay's deposit before it is signed. The bridge prints its deposit and returns while Relay fills; --wait follows it for up to ten minutes. While it is open, a sweep of either wallet refuses BRIDGE_IN_FLIGHT for two hours. Vault to vault: fund the Solana TEE wallet from the vault, bridge, then disable and sweep the Hood TEE wallet into its vault. Every plan can trade Candle-launched tokens and base assets, and sell a token it holds that was not launched on Candle; buying such a token needs Pro or Max (TIER_REQUIRED otherwise). Each trade pays the plan's agent fee on top; a base-pair swap or a bridge between this key's own wallets pays none. candle plans shows the fees in force.",
     usage: ["candle swap <from> <to> [flags]", "candle swap status <id>"],
     rows: [
       {
@@ -53407,7 +53521,7 @@ var HELP = {
   transfer: {
     group: "Trade",
     summary: "Move funds out of a TEE wallet to your own wallets or its vault, through its bound key",
-    description: "Moves one asset out of a TEE wallet this machine can sign for. The bound key must be a Read:Write:Transfer key (transfer:bound); from that wallet, Candle allows only its own pinned vault or another of the account's wallets you linked while signed in or marked trusted. To a linked wallet the amount counts against the key's spend caps and must be a base asset; to the vault any token and max are allowed. Candle builds the transaction, this machine approves the relay, Privy signs, Candle broadcasts. The destination and its kind are shown before you confirm. The asset decides the chain: ETH, USDG or --token is Hood, from a Hood TEE wallet, where this machine checks the one leg moves exactly what you confirmed before it is signed, and ETH max leaves the gas reserve.",
+    description: "Moves one asset out of a TEE wallet this machine can sign for. The bound key must be a Withdraw key (transfer:bound); from that wallet, Candle allows only its own pinned vault or another of the account's wallets you linked while signed in or marked trusted. To a linked wallet the amount counts against the key's spend caps and must be a base asset; to the vault any token and max are allowed. Candle builds the transaction, this machine approves the relay, Privy signs, Candle broadcasts. The destination and its kind are shown before you confirm. The asset decides the chain: ETH, USDG or --token is Hood, from a Hood TEE wallet, where this machine checks the one leg moves exactly what you confirmed before it is signed, and ETH max leaves the gas reserve.",
     usage: [
       "candle transfer --to <address|wallet name|vault> --asset <SOL|USDC|CNDL|ETH|USDG>|--mint <mint>|--token <0x...> --amount <decimal|max> [--wallet <tee>] [--yes] [--json]"
     ],
@@ -53440,10 +53554,10 @@ var HELP = {
   },
   launch: {
     group: "Trade",
-    summary: "Create a token on Solana or Hood (the first buy is a separate swap)",
-    description: "Creates a token with no first buy, so the launch and the position are two decisions rather than one. Needs the launch:write scope and an operator-enabled allowLaunch. The wallet decides the chain: a Hood TEE wallet launches on Hood, needs --dex-version, and signs one leg at a time (the curve, then the fee), each only after the one before it landed. Launching from a TEE wallet needs Pro or Max (TIER_REQUIRED otherwise; candle plans).",
+    summary: "Create a token on Solana or Hood, with an optional first buy",
+    description: "Creates a token from a TEE wallet. Without --buy it makes no first buy, so the launch and the position are two decisions, and the buy is a separate candle swap. --buy <amount> adds a first buy from the same wallet, in whole units of the quote asset (SOL, USDC or CNDL on Solana, ETH on Hood; not USDG), within the dev-buy ceilings: on Solana it rides in the launch transaction, and on Hood it is a last leg after the curve and the fee. Candle reserves the buy against the key's spend window before anything is signed. --buy needs a server with TEE_LAUNCH_BUYS_ENABLED on, which is off by default; while it is off Candle refuses the buy and nothing is built. Needs the launch:write scope and allowLaunch on the wallet, which only the account owner can turn on (candle wallets allow-launch <wallet>, over the device token; an agent key cannot). The wallet decides the chain: a Hood TEE wallet launches on Hood, needs --dex-version, and signs one leg at a time (the curve, then the fee, then the buy with --buy), each only after the one before it landed. Launching from a TEE wallet needs Pro or Max (TIER_REQUIRED otherwise; candle plans). Every plan, Free included, can launch from its embedded wallet with an optional dev buy (same transaction on Solana; best-effort follow-up on Hood), through the MCP tool candle_launch_and_seed or the SDK's launch(); this command does not use that path.",
     usage: [
-      "candle launch --name <name> --symbol <symbol> --image-url <url> --wallet <tee> [--quote-asset <asset>] [--dex-version v3|v4]"
+      "candle launch --name <name> --symbol <symbol> --image-url <url> --wallet <tee> [--buy <amount>] [--quote-asset <asset>] [--dex-version v3|v4]"
     ],
     rows: [],
     flags: [
@@ -53451,6 +53565,10 @@ var HELP = {
       { invocation: "--symbol <symbol>", description: "The token's ticker" },
       { invocation: "--image-url <url>", description: "The token image, already hosted" },
       { invocation: "--wallet <tee>", description: "The TEE wallet that creates it" },
+      {
+        invocation: "--buy <amount>",
+        description: "A first buy from the same wallet, in whole units of the quote asset; needs TEE_LAUNCH_BUYS_ENABLED on the server"
+      },
       { invocation: "--quote-asset <asset>", description: "sol, usdc or cndl on Solana; eth or usdg on Hood" },
       {
         invocation: "--dex-version v3|v4",
@@ -53459,7 +53577,8 @@ var HELP = {
     ],
     examples: [
       "candle launch --name Demo --symbol DEMO --image-url https://example.com/d.png --wallet AgentOne",
-      "candle launch --name Demo --symbol DEMO --image-url https://example.com/d.png --wallet HoodAgent --dex-version v4"
+      "candle launch --name Demo --symbol DEMO --image-url https://example.com/d.png --wallet HoodAgent --dex-version v4",
+      "candle launch --name Demo --symbol DEMO --image-url https://example.com/d.png --wallet AgentOne --buy 0.1"
     ],
     env: ENV_API
   },
@@ -53520,14 +53639,14 @@ var HELP = {
     rows: [
       {
         invocation: "list [--scopes]",
-        description: "List API keys: name and Read, Read:Write or Read:Write:Transfer access; --scopes adds the raw scopes"
+        description: "List API keys: name and Read, Write or Withdraw access; --scopes adds the raw scopes"
       },
       {
-        invocation: "create [--access read|read-write|read-write-transfer | --scopes <a,b,c>] [--label <name>] [--expires-in <days>] [--tx-limit <usd> [--reset daily|weekly|monthly|never]] [--embedded-wallet deny|allow]",
-        description: "Create an API key; --access mints one of the three levels (read-write-transfer can move funds out of the wallet it runs). --embedded-wallet defaults to deny; allow lets the key spend the account's embedded wallet and is confirmed at a terminal"
+        invocation: "create [--access read|write|withdraw | --scopes <a,b,c>] [--label <name>] [--expires-in <days>] [--tx-limit <usd> [--reset daily|weekly|monthly|never]] [--embedded-wallet deny|allow]",
+        description: "Create an API key; --access mints one of the three levels (withdraw can move funds out of the wallet it runs). --embedded-wallet defaults to deny; allow lets the key spend the account's embedded wallet and is confirmed at a terminal"
       },
       {
-        invocation: "access <prefix|label|self> (--access read|read-write|read-write-transfer [--yes] | --history)",
+        invocation: "access <prefix|label|self> (--access read|write|withdraw [--yes] | --history)",
         description: "Change an existing key's level in place (same key, wallets and caps). Widening needs the device token and the prefix typed back at a terminal; --yes skips the prompt when narrowing; self narrows the profile's own key. --history lists the key's changes and who made them"
       },
       {
@@ -53562,9 +53681,9 @@ var HELP = {
     ],
     examples: [
       "candle keys list",
-      "candle keys create --access read-write-transfer --label rebalancer",
+      "candle keys create --access withdraw --label rebalancer",
       "candle keys create --scopes trade:write --label agent-one",
-      "candle keys access cndl --access read-write-transfer",
+      "candle keys access cndl --access withdraw",
       "candle keys access self --access read --yes",
       "candle keys update agent-one --embedded-wallet deny --yes",
       "candle keys self embedded-wallet deny",
@@ -53596,6 +53715,14 @@ var HELP = {
         invocation: "untrust <label|address|id|prefix*>... [--yes]",
         description: "Clear the mark; moving funds in needs the withdrawal allowlist again (owner only)"
       },
+      {
+        invocation: "allow-launch <label|address|id|prefix*>...",
+        description: "Let TEE wallets pay for a launch (candle launch), after a screen of label, address and bound key (owner only; typed confirm)"
+      },
+      {
+        invocation: "disallow-launch <label|address|id|prefix*>... [--yes]",
+        description: "Stop TEE wallets paying for a launch; trading is unchanged (owner only)"
+      },
       {
         invocation: "close-empty [--wallet embedded] [--keep <mint>]... [--client-trade-id <id>] [--yes]",
         description: "Close the embedded wallet's empty token accounts and return their rent to it, after a preview (transfer:write)"
@@ -53606,6 +53733,7 @@ var HELP = {
       "candle wallet import --chain solana --key-file ./signer.json",
       "candle wallet revoke wal_123",
       "candle wallet trust 'tr-*' 'dest-*'",
+      "candle wallet allow-launch launcher-1",
       "candle wallet close-empty --keep EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v"
     ],
     env: ENV_API
@@ -59348,10 +59476,14 @@ init_promote_support();
 init_keys();
 init_tee_rebind();
 var KEYS_PATH4 = "/api/v1/agent/keys";
-var USAGE_ACCESS = `Usage: candle keys access <prefix|label|self> --access <read|read-write|read-write-transfer> [--yes] [--json]
+var USAGE_ACCESS = `Usage: candle keys access <prefix|label|self> --access <read|write|withdraw> [--yes] [--json]
 ` + "       candle keys access <prefix|label> --history [--json]";
 var SELF = "self";
-var CLI_SPELLING = Object.fromEntries(Object.entries(ACCESS_LEVELS).map(([spelling, preset]) => [preset, spelling]));
+var CLI_SPELLING = {
+  read: "read",
+  readwrite: "write",
+  readwritetransfer: "withdraw"
+};
 var NO_API_KEY2 = {
   code: "API_KEY_REQUIRED",
   message: "candle keys access self changes the profile's own API key, and this profile holds none.",
@@ -59496,7 +59628,7 @@ async function keysAccess(args, ctx) {
   }
   const preset = ACCESS_LEVELS[accessFlag];
   if (preset === undefined) {
-    writeUsageFailure(deps, `--access must be one of: ${Object.keys(ACCESS_LEVELS).join(", ")}.`, json);
+    writeUsageFailure(deps, "--access must be one of: read, write, withdraw.", json);
     return 2;
   }
   await printIdentity(ctx);
@@ -59851,7 +59983,7 @@ init_solana_lite();
 init_trading();
 init_swap();
 import { randomUUID as randomUUID2 } from "node:crypto";
-var USAGE2 = "Usage: candle launch --name <name> --symbol <symbol> --image-url <https-url> --wallet <tee> [--client-trade-id <id>] [--quote-asset sol|usdc|cndl|eth|usdg] [--dex-version v3|v4] [--mode <mode>] [--rpc-url <url>] [--yes]. A Hood TEE wallet launches on Hood and needs --dex-version.";
+var USAGE2 = "Usage: candle launch --name <name> --symbol <symbol> --image-url <https-url> --wallet <tee> [--buy <amount>] [--client-trade-id <id>] [--quote-asset sol|usdc|cndl|eth|usdg] [--dex-version v3|v4] [--mode <mode>] [--rpc-url <url>] [--yes]. A Hood TEE wallet launches on Hood and needs --dex-version.";
 var QUOTE_CHAIN = {
   sol: "solana",
   usdc: "solana",
@@ -59860,6 +59992,34 @@ var QUOTE_CHAIN = {
   usdg: "hood"
 };
 var HOOD_LAUNCH_LEGS = ["createCurve", "feeTransfer"];
+var HOOD_LAUNCH_BUY_LEGS = ["createCurve", "feeTransfer", "trade"];
+function launchBuy(flags, chain2) {
+  const amount = flags["--buy"];
+  if (amount === undefined)
+    return;
+  const quote = (flags["--quote-asset"] ?? (chain2 === "hood" ? "eth" : "sol")).toUpperCase();
+  const decimals = chain2 === "hood" ? HOOD_BASES[quote]?.decimals : BASES[quote]?.decimals;
+  if (decimals === undefined)
+    throw new TradingError("INVALID_AMOUNT", `--buy is in the launch's quote asset, and ${safeText(quote)} is not one on ${chainName(chain2)}. Nothing was built.`);
+  const raw = rawAmount(amount, decimals);
+  return { raw, display: `${decimalAmount(raw, decimals)} ${quote}` };
+}
+function buyRefusal(error) {
+  if (!(error instanceof TradingError) || error.code !== "VALIDATION_FAILED" || error.details?.field !== "buyAmount")
+    return error;
+  return new TradingError("VALIDATION_FAILED", `Candle refused the first buy on this TEE launch: ${safeText(error.message)}. A TEE wallet's launch takes --buy only where the server has TEE_LAUNCH_BUYS_ENABLED on, and it is off on this deployment. Nothing was built or signed.`, {
+    suggestion: "Launch without --buy under a new --client-trade-id, then make the first buy with candle swap once the token lands.",
+    details: error.details
+  });
+}
+function buyNotice(buy, chain2) {
+  if (!buy)
+    return `Launch creates the token only. Make the first buy with a separate candle swap. Price impact does not apply to creation.
+`;
+  return chain2 === "hood" ? `Launch creates the token, then spends ${buy.display} on a first buy on the new curve, as the last leg. Candle reserves the buy against this key's spend window before any leg is signed. If the buy leg never lands, the token exists with no first buy. Price impact does not apply to creation.
+` : `Launch creates the token and spends ${buy.display} on a first buy in the same transaction. Candle reserves the whole debit against this key's spend window before anything is signed. Price impact does not apply to creation.
+`;
+}
 function flagChain(flags) {
   const said = [];
   const named = walletNameChain(flags["--wallet"] ?? "");
@@ -59889,7 +60049,8 @@ async function launch(args, ctx) {
       "--rpc-url",
       "--quote-asset",
       "--mode",
-      "--dex-version"
+      "--dex-version",
+      "--buy"
     ],
     booleanFlags: ["--yes"]
   });
@@ -59904,6 +60065,8 @@ async function launch(args, ctx) {
     return 2;
   }
   try {
+    if (flags["--buy"] !== undefined)
+      rawAmount(flags["--buy"], 18);
     const hinted = flagChain(flags);
     if (hinted === "hood" && flags["--dex-version"] === undefined) {
       writeUsageFailure(ctx.deps, `A Hood launch needs --dex-version v3|v4. ${USAGE2}`, ctx.json);
@@ -59929,8 +60092,10 @@ async function launch(args, ctx) {
     if (wallet.chain === "evm") {
       if (flags["--dex-version"] === undefined)
         throw new TradingUsage(`${wallet.address} is a Hood TEE wallet, and a Hood launch needs --dex-version v3|v4.`);
-      return await hoodLaunch(ctx, key, { flags, id, wallet, yes: parsed.booleans.has("--yes") });
+      const buy2 = launchBuy(flags, "hood");
+      return await hoodLaunch(ctx, key, { flags, id, wallet, buy: buy2, yes: parsed.booleans.has("--yes") });
     }
+    const buy = launchBuy(flags, "solana");
     const solana = await tradingSolanaClient(ctx, flags["--rpc-url"]);
     if (!await claimOperation(ctx, key, id, "launch"))
       throw new TradingError("OPERATION_ALREADY_STARTED", "This machine already started this launch id; no write was resent.");
@@ -59939,7 +60104,7 @@ async function launch(args, ctx) {
     const built = launchBuildSchema.parse(await request(ctx, key, "/api/v1/launch/self/build", {
       clientLaunchId: id,
       chain: "solana",
-      buyAmount: 0,
+      buyAmount: buy ? buy.raw : 0,
       name: flags["--name"],
       symbol: flags["--symbol"],
       imageUrl: flags["--image-url"],
@@ -59947,21 +60112,22 @@ async function launch(args, ctx) {
       ...flags["--description"] ? { description: flags["--description"] } : {},
       ...flags["--quote-asset"] ? { quoteAsset: flags["--quote-asset"] } : {},
       ...flags["--mode"] ? { mode: flags["--mode"] } : {}
+    }).catch((error) => {
+      throw buyRefusal(error);
     }));
     if (!built.transaction || !/^\d+$/.test(built.maxDebitLamports ?? ""))
       throw new TradingError("INVALID_RESPONSE", "Candle did not return a launch transaction and maximum debit; nothing was signed.");
     const quote = {
-      intent: `Launch ${flags["--name"]} (${flags["--symbol"]})`,
+      intent: `Launch ${flags["--name"]} (${flags["--symbol"]})${buy ? ` with a first buy of ${buy.display}` : ""}`,
       wallet: wallet.address,
       venue: "curve launch",
       priceImpactPct: null,
       fee: built.fee ?? { bps: 0, feeRaw: "0" },
-      minimumReceived: "0 tokens (no first buy)",
+      minimumReceived: buy ? "not quoted (the first buy on the new curve)" : "0 tokens (no first buy)",
       maxDebitLamports: built.maxDebitLamports,
       tokenRisks: []
     };
-    ctx.deps.stderr.write(`Launch creates the token only. Make the first buy with a separate candle swap. Price impact does not apply to creation.
-`);
+    ctx.deps.stderr.write(buyNotice(buy, "solana"));
     if (!await confirmQuote(ctx, quote, parsed.booleans.has("--yes")))
       return printTradingResult(ctx, { success: true, status: "cancelled", clientTradeId: id, kind: "launch", quote });
     if (!Number.isFinite(built.expiresAt) || built.expiresAt <= ctx.deps.now())
@@ -59987,7 +60153,8 @@ async function launch(args, ctx) {
   }
 }
 async function hoodLaunch(ctx, key, args) {
-  const { flags, id, wallet } = args;
+  const { flags, id, wallet, buy } = args;
+  const allowedLegs = buy ? HOOD_LAUNCH_BUY_LEGS : HOOD_LAUNCH_LEGS;
   if (!await claimOperation(ctx, key, id, "launch"))
     throw new TradingError("OPERATION_ALREADY_STARTED", "This machine already started this launch id; no write was resent.");
   ctx.deps.stderr.write(`Operation: ${id}
@@ -59995,7 +60162,7 @@ async function hoodLaunch(ctx, key, args) {
   const built = await request(ctx, key, "/api/v1/launch/self/build", {
     clientLaunchId: id,
     chain: "hood",
-    buyAmount: 0,
+    buyAmount: buy ? buy.raw : 0,
     name: flags["--name"],
     symbol: flags["--symbol"],
     imageUrl: flags["--image-url"],
@@ -60004,6 +60171,8 @@ async function hoodLaunch(ctx, key, args) {
     ...flags["--description"] ? { description: flags["--description"] } : {},
     ...flags["--quote-asset"] ? { quoteAsset: flags["--quote-asset"].toLowerCase() } : {},
     ...flags["--mode"] ? { mode: flags["--mode"] } : {}
+  }).catch((error) => {
+    throw buyRefusal(error);
   });
   const parsed = sequencedSchema.safeParse(built);
   if (!parsed.success)
@@ -60012,26 +60181,25 @@ async function hoodLaunch(ctx, key, args) {
   const curve = typeof built.curveAddress === "string" ? checkEvmAddress(built.curveAddress) : undefined;
   if (built.chain !== "hood" || built.clientLaunchId !== id || typeof built.walletAddress !== "string" || !sameEvmAddress(built.walletAddress, wallet.address) || !curve?.ok)
     throw new TradingError("INVALID_RESPONSE", "The Hood launch build does not name this launch and payer; nothing was signed.");
-  if (first.legKind !== "createCurve" || first.plannedLegCount > HOOD_LAUNCH_LEGS.length)
+  if (first.legKind !== "createCurve" || first.plannedLegCount > allowedLegs.length || buy !== undefined && first.plannedLegCount < 2)
     throw new TradingError("INVALID_RESPONSE", `A Hood launch starts with its createCurve leg, and Candle offered ${safeText(first.legKind)} of ${first.plannedLegCount}; nothing was signed.`);
   const leg = first.nextLeg;
   const maxFee = BigInt(leg.maxFeePerGas);
   const reserve = sweepReserveFloor(maxFee);
   const quote = {
-    intent: `Launch ${flags["--name"]} (${flags["--symbol"]}) on Hood`,
+    intent: `Launch ${flags["--name"]} (${flags["--symbol"]}) on Hood${buy ? ` with a first buy of ${buy.display}` : ""}`,
     wallet: wallet.address,
     venue: "curve launch",
     priceImpactPct: null,
-    minimumReceived: "0 tokens (no first buy)",
+    minimumReceived: buy ? "not quoted (Candle's buy leg sets its floor on the new curve)" : "0 tokens (no first buy)",
     tokenRisks: [],
-    legs: first.plannedLegCount === 2 ? ["create curve", "fee"] : ["create curve"],
-    gas: `the createCurve leg up to ${formatUnits(BigInt(leg.gas) * maxFee, 18)} ETH (gas ${leg.gas} at ${formatUnits(maxFee, 9)} gwei)${first.plannedLegCount === 2 ? "; the fee leg is priced by Candle when it becomes next" : ""}`,
+    legs: hoodLaunchLegNames(first.plannedLegCount, buy !== undefined),
+    gas: `the createCurve leg up to ${formatUnits(BigInt(leg.gas) * maxFee, 18)} ETH (gas ${leg.gas} at ${formatUnits(maxFee, 9)} gwei)${hoodLaterLegsGas(first.plannedLegCount, buy !== undefined)}`,
     reserve: `at least ${formatUnits(reserve.wei, 18)} ETH stays in the wallet for a sweep home (${reserve.erc20Transfers} ERC-20 transfers and the final ETH transfer at twice the fee)`,
     curveAddress: curve.address,
     operationId: first.operationId
   };
-  ctx.deps.stderr.write(`Launch creates the token only. Make the first buy with a separate candle swap. Price impact does not apply to creation.
-`);
+  ctx.deps.stderr.write(buyNotice(buy, "hood"));
   if (!await confirmQuote(ctx, quote, args.yes)) {
     ctx.deps.stderr.write(`Nothing was signed. Operation ${first.operationId} holds this wallet until ${new Date(first.expiresAt).toISOString()}; a new Hood operation from it is refused as WALLET_BUSY until then.
 `);
@@ -60046,6 +60214,8 @@ async function hoodLaunch(ctx, key, args) {
       walletHeldUntil: first.expiresAt
     });
   }
+  const confirmedPlan = buy ? first.plannedLegCount === 3 ? ["createCurve", "feeTransfer", "trade"] : ["createCurve", "trade"] : undefined;
+  let position = 0;
   const run2 = await runSequencedLegs(ctx, key, {
     wallet,
     first,
@@ -60055,10 +60225,16 @@ async function hoodLaunch(ctx, key, args) {
     clientId: id,
     kind: "launch",
     primaryLeg: "createCurve",
-    allowedLegs: HOOD_LAUNCH_LEGS,
-    checkLeg: (kind, leg2) => kind !== "createCurve" || leg2.value === "0",
+    allowedLegs,
+    checkLeg: (kind, leg2) => {
+      if (confirmedPlan && confirmedPlan[position++] !== kind)
+        return false;
+      return kind === "createCurve" ? leg2.value === "0" : kind !== "trade" || buy !== undefined && leg2.value === buy.raw && sameEvmAddress(leg2.to, curve.address);
+    },
     onLanded: async () => {}
   });
+  if (confirmedPlan && run2.landed.map((done) => done.kind).join() !== confirmedPlan.join())
+    throw new TradingError("INVALID_RESPONSE", `Candle ended the launch before every confirmed leg landed (${confirmedPlan.join(", ")}).${run2.landed.length === 0 ? " No leg landed." : ` Landed: ${run2.landed.map((done) => `${done.kind} ${safeText(done.hash)}`).join(", ")}.`}`, { details: { operationId: first.operationId, landedLegs: run2.landed } });
   return printTradingResult(ctx, {
     ...run2.final,
     ...await recordLaunchedToken(ctx, wallet, run2.final),
@@ -60071,6 +60247,16 @@ async function hoodLaunch(ctx, key, args) {
     landedLegs: run2.landed
   });
 }
+function hoodLaterLegsGas(count, buys) {
+  if (count < 2)
+    return "";
+  return buys ? "; the later legs are priced by Candle when each becomes next" : "; the fee leg is priced by Candle when it becomes next";
+}
+function hoodLaunchLegNames(count, buys) {
+  if (!buys)
+    return count === 2 ? ["create curve", "fee"] : ["create curve"];
+  return count === 3 ? ["create curve", "fee", "first buy"] : ["create curve", "first buy"];
+}
 async function recordLaunchedToken(ctx, wallet, final) {
   const mint = typeof final.mint === "string" ? checkEvmAddress(final.mint) : undefined;
   if (!mint?.ok) {
@@ -61633,7 +61819,7 @@ async function perpsDeposit(args, ctx) {
 init_args();
 
 // src/plans.ts
-var PLAN_CAPABILITY_NOTE = "A capability marked yes is what the plan allows. It is subject to the deployment's own switches (perps and own-wallet bridges each have one) and to the wallet, scopes and setup the feature needs.";
+var PLAN_CAPABILITY_NOTE = "A capability marked yes is what the plan allows. It is subject to the deployment's own switches (perps and own-wallet bridges each have one) and to the wallet, scopes and setup the feature needs. Every plan can launch a token from its embedded wallet, with an optional dev buy (same transaction on Solana; best-effort follow-up on Hood), through the headless launch; the two launch rows are additional routes, not the only ones.";
 var PLAN_CAPABILITY_LABELS = {
   tradeCandleTokens: "Trade Candle-launched tokens",
   tradeBaseAssets: "Trade base assets",
@@ -61641,8 +61827,8 @@ var PLAN_CAPABILITY_LABELS = {
   sellExternalTokens: "Sell tokens not launched on Candle",
   buyExternalTokens: "Buy tokens not launched on Candle",
   hyperliquidPerps: "Hyperliquid perps (when enabled)",
-  selfLaunch: "Self-launch from a linked wallet",
-  atomicLaunch: "Atomic launch with first buys",
+  selfLaunch: "Launch from a linked or TEE wallet (self-signed)",
+  atomicLaunch: "Atomic launch: launch + 1–4 first buys in one bundle",
   createLinkedWallets: "Create linked wallets",
   importLinkedWallets: "Import linked wallets",
   limitOrders: "Limit orders",
@@ -62263,7 +62449,7 @@ async function pnl(args, ctx) {
       writeLocalFailure(deps, {
         code: "SCOPE_MISSING",
         message: "The account's P&L needs a key with the Read scope (account:read); this profile's key has none.",
-        suggestion: "Log in with a Read or Read:Write key, or read this key's own P&L: candle pnl --profile <name>"
+        suggestion: "Log in with a Read or Write key, or read this key's own P&L: candle pnl --profile <name>"
       }, json);
       return 1;
     }
@@ -64260,7 +64446,7 @@ async function transfer(args, ctx) {
     if (payer.kind === "embedded")
       throw new TradingError("PAYER_UNSUPPORTED", "This command moves a linked wallet this machine can sign for. The embedded wallet transfers through the agent transfer rail (MCP candle_transfer), not from here. Name a TEE wallet with --wallet.");
     if (!payer.scopes.includes("transfer:bound"))
-      throw new TradingError("SCOPE_MISSING", `Moving funds out of a TEE wallet needs a Read:Write:Transfer key. Widen the bound key with: candle keys access ${apiKeyPrefix(key) ?? "<bound prefix>"} --access read-write-transfer. Or mint one with: candle keys create --access read-write-transfer, then bind the wallet to it with: candle tee rebind`);
+      throw new TradingError("SCOPE_MISSING", `Moving funds out of a TEE wallet needs a Withdraw key. Widen the bound key with: candle keys access ${apiKeyPrefix(key) ?? "<bound prefix>"} --access withdraw. Or mint one with: candle keys create --access withdraw, then bind the wallet to it with: candle tee rebind`);
     const wallet = payer.wallet;
     const destination = await resolveDestination(ctx, key, wallet, to);
     const label = asset ?? flags["--mint"];
@@ -64332,7 +64518,7 @@ async function hoodTransfer(ctx, args) {
   if (payer.kind === "embedded")
     throw new TradingError("PAYER_UNSUPPORTED", "This command moves a linked wallet this machine can sign for. The embedded wallet transfers through the agent transfer rail (MCP candle_transfer), not from here. Name a Hood TEE wallet with --wallet.");
   if (!payer.scopes.includes("transfer:bound"))
-    throw new TradingError("SCOPE_MISSING", `Moving funds out of a TEE wallet needs a Read:Write:Transfer key. Widen the bound key with: candle keys access ${apiKeyPrefix(key) ?? "<bound prefix>"} --access read-write-transfer. Or mint one with: candle keys create --access read-write-transfer, then bind the wallet to it with: candle tee rebind`);
+    throw new TradingError("SCOPE_MISSING", `Moving funds out of a TEE wallet needs a Withdraw key. Widen the bound key with: candle keys access ${apiKeyPrefix(key) ?? "<bound prefix>"} --access withdraw. Or mint one with: candle keys create --access withdraw, then bind the wallet to it with: candle tee rebind`);
   const wallet = payer.wallet;
   const destination = await resolveDestination(ctx, key, wallet, to, "hood");
   const decimals = asset ? HOOD_BASES[asset]?.decimals ?? 18 : await hoodDecimals({ chain: "hood", asset: tokenAddress }, lazyEvmRpc(ctx, flags["--rpc-url"]));
@@ -65696,10 +65882,10 @@ function recordCopyLine(outcome) {
 // src/commands/vault-demote.ts
 init_args();
 init_render();
+init_solana_endpoint();
 init_errors();
 init_promote_support();
 init_reconcile_grant();
-init_store();
 init_tee_resolve();
 init_tee();
 init_tee_evm();
@@ -65718,7 +65904,6 @@ async function vaultDemote(args, ctx) {
   if (!address || extra !== undefined) {
     return usage(ctx, "Usage: candle vault demote <tee-address> [--rpc-url <url>] [--emergency] [--sweep-to <label>]");
   }
-  const rpcUrl = parsed.values["--rpc-url"];
   if (!refuseEnvPassphrase(ctx))
     return 1;
   if (!requireTty(ctx, "vault demote"))
@@ -65729,6 +65914,9 @@ async function vaultDemote(args, ctx) {
   const path = resolvedVault.path;
   const emergency = parsed.booleans.has("--emergency");
   const sweepTo = parsed.values["--sweep-to"];
+  const solana = await openSolanaClient(ctx, parsed.values["--rpc-url"]);
+  if ("error" in solana)
+    return usage(ctx, solana.error);
   const resolved = await resolveTeeAddress(ctx, parsed, address, async () => ({
     ok: false,
     code: 1
@@ -65751,49 +65939,33 @@ async function vaultDemote(args, ctx) {
     }, ctx.json);
     return 1;
   }
-  let released = false;
+  const vaultResolved = resolved.resolved;
   try {
-    const vaultResolved = resolved.resolved;
     const reconciled = await maybeReconcileVaultTee(ctx, vaultResolved, "demote");
     if (reconciled.code !== null)
       return reconciled.code;
     const entry = reconciled.entry;
+    const step = { resolved: vaultResolved, solana };
     if (entry.tee?.vaultDestination === undefined) {
       if (sweepTo === undefined) {
         throw new VaultError("GRANT_DESTINATION_UNRESOLVED", `${address} has no pinned vault destination.`, {
           suggestion: "Pass --sweep-to <vault-key-label> (subject to the recovery destination rule), or adopt the server's pin."
         });
       }
-      releaseResolvedTee(resolved.resolved);
-      released = true;
-      return await runVaultCommand(ctx, async ({ hold }) => {
-        const raw = await requireVaultRaw(ctx, resolvedVault);
-        const opened = await unlockInteractively(ctx, path, raw, {
-          acceptOlderCopy: parsed.booleans.has("--accept-older-copy")
-        });
-        const vault = hold(opened.vault);
-        const destination = assertColdVaultDestination(vault.index, sweepTo, {});
-        await commitVault(vault, {
-          index: {
-            hd: vault.index.hd,
-            entries: vault.index.entries.map((e) => e.address === address ? {
-              ...e,
-              tee: {
-                ...e.tee ?? { network: "solana-mainnet", lifecycle: "local-candidate" },
-                vaultDestination: destination.address
-              }
-            } : e)
-          }
-        }, ctx.deps);
-        return demoteWithAdapter(ctx, { linkedWalletId: entry.linkedWalletId }, address, rpcUrl, true);
+      await assertNotOlderCopy(ctx, path, vaultResolved.vault.raw, parsed.booleans.has("--accept-older-copy"));
+      const destination = assertColdVaultDestination(vaultResolved.vault.index, sweepTo, {});
+      const next = await commitVaultTeeEntry(ctx, vaultResolved.vault, entry.id, (target) => {
+        target.tee = {
+          ...target.tee ?? { network: "solana-mainnet", lifecycle: "local-candidate" },
+          vaultDestination: destination.address
+        };
       });
+      applyVault(vaultResolved, next);
+      return await demoteWithAdapter(ctx, step, address, parsed.values["--rpc-url"], true);
     }
     requireTeeDestination(entry);
     const needsEmergency = emergency || entry.linkedWalletId === undefined || entry.tee?.lifecycle === "stranded";
-    const snapshot = { linkedWalletId: entry.linkedWalletId };
-    releaseResolvedTee(resolved.resolved);
-    released = true;
-    return demoteWithAdapter(ctx, snapshot, address, rpcUrl, needsEmergency);
+    return await demoteWithAdapter(ctx, step, address, parsed.values["--rpc-url"], needsEmergency);
   } catch (error) {
     if (error instanceof VaultError) {
       writeLocalFailure(ctx.deps, {
@@ -65805,23 +65977,39 @@ async function vaultDemote(args, ctx) {
     }
     throw error;
   } finally {
-    if (!released)
-      releaseResolvedTee(resolved.resolved);
+    releaseResolvedTee(vaultResolved);
   }
 }
-async function demoteWithAdapter(ctx, entry, address, rpcUrl, emergency) {
-  if (entry.linkedWalletId !== undefined) {
-    const disableCode = await teeDisable([address], ctx);
+async function demoteWithAdapter(ctx, step, address, rpcUrl, emergency) {
+  const linkedWalletId = step.resolved.entry.linkedWalletId;
+  let disableCode = null;
+  if (linkedWalletId !== undefined) {
+    disableCode = await teeDisable([address], ctx, step);
     if (disableCode !== 0 && disableCode !== 3 && !emergency)
       return disableCode;
   } else {
     ctx.deps.stdout.write(`No linkedWalletId is recorded for ${address}; the grant could not be identified, so disable was not called and remote authority stays unknown.
 `);
   }
+  const destination = step.resolved.entry.tee?.vaultDestination;
+  if (await nothingLeftToSweep(step.solana, step.resolved.entry)) {
+    const code = disableCode === 0 ? 0 : 3;
+    if (ctx.json) {
+      ctx.deps.stdout.write(`${JSON.stringify({ address, vaultDestination: destination, swept: false, nothingToSweep: true, lamports: "0", tokenAccounts: 0 })}
+`);
+    } else {
+      ctx.deps.stdout.write(`Nothing to sweep: 0 SOL, 0 token accounts.
+`);
+    }
+    return code;
+  }
+  if (!ctx.json)
+    ctx.deps.stdout.write(`Sweeping remaining funds to ${destination}...
+`);
   const sweepArgs = rpcUrl === undefined ? [address] : [address, "--rpc-url", rpcUrl];
-  if (emergency || entry.linkedWalletId === undefined)
+  if (emergency || linkedWalletId === undefined)
     sweepArgs.push("--emergency");
-  return teeSweep(sweepArgs, ctx);
+  return teeSweep(sweepArgs, ctx, step);
 }
 
 // src/commands/vault-export-key.ts
@@ -72327,6 +72515,176 @@ function messageOf3(error) {
 // src/index.ts
 init_wallets();
 
+// src/commands/wallets-allow-launch.ts
+init_args();
+init_deps();
+init_profiles();
+init_render();
+init_promote_support();
+var PREVIEW_PATH = "/api/v1/agent/tee-wallets/allow-launch/preview";
+var capabilityPath = (id) => `/api/v1/agent/wallets/${encodeURIComponent(id)}/capabilities`;
+var USAGE_ALLOW = "Usage: candle wallets allow-launch <label|address|id|prefix*>... [--json]";
+var USAGE_DISALLOW = "Usage: candle wallets disallow-launch <label|address|id|prefix*>... [--yes] [--json]";
+var DEVICE_TOKEN_REQUIRED2 = {
+  code: "DEVICE_TOKEN_REQUIRED",
+  message: "Changing whether a TEE wallet may launch needs the device token, the owner's credential; an API key cannot do it.",
+  suggestion: "Run: candle auth login"
+};
+var nameOf = (row) => row.label ?? row.address;
+function allowLaunchTable(rows) {
+  return renderTable(["line", "label", "wallet", "address", "bound key"], rows.map((row, i) => [String(i + 1), row.label ?? "-", row.chain, row.address, row.boundKeyPrefix ?? "-"]));
+}
+function nothingToChangeLine(shown, enabled) {
+  const bits = [];
+  if (shown.unchanged.length === 1)
+    bits.push(`that wallet already has allowLaunch ${enabled ? "on" : "off"}`);
+  else if (shown.unchanged.length > 1) {
+    bits.push(`all ${shown.unchanged.length} wallets already have allowLaunch ${enabled ? "on" : "off"}`);
+  }
+  if (shown.notTee.length > 0) {
+    bits.push(`${shown.notTee.map(nameOf).join(", ")} ${shown.notTee.length === 1 ? "is" : "are"} not a TEE wallet`);
+  }
+  if (bits.length === 0)
+    return `Nothing to change.
+`;
+  return `Nothing to change: ${bits.join("; ")}.
+`;
+}
+function writeFailure2(ctx, result) {
+  const { deps, apiUrl, json } = ctx;
+  let code = result.code;
+  let message = result.message;
+  let suggestion;
+  if (result.status === 404) {
+    code = "ALLOW_LAUNCH_UNSUPPORTED";
+    message = "This Candle API does not offer allowLaunch on TEE wallets (an older API, or TEE launch is off); nothing changed.";
+  } else {
+    const error = result.raw?.error;
+    if (error?.reason === "ambiguous" && Array.isArray(error.matches)) {
+      const ids = error.matches.map((m) => String(m.id)).join(", ");
+      suggestion = `Name one of them by id or address: ${ids}`;
+    } else if (error?.reason === "not_found") {
+      suggestion = "Run: candle wallets, to see this account's linked wallets and their labels.";
+    }
+  }
+  const envelope = errorEnvelope({ ...result, code, message }, { apiUrl, authType: "device" });
+  if (json) {
+    deps.stdout.write(`${JSON.stringify({ ...envelope, ...suggestion ? { suggestion } : {} })}
+`);
+  } else {
+    deps.stderr.write(`${code ?? `HTTP ${result.status}`}: ${message}${suggestion ? ` ${suggestion}` : ""}
+`);
+  }
+  return 1;
+}
+async function setAllowLaunch(args, ctx, enabled) {
+  const { deps, apiUrl, json } = ctx;
+  const usage6 = enabled ? USAGE_ALLOW : USAGE_DISALLOW;
+  const command = enabled ? "wallets allow-launch" : "wallets disallow-launch";
+  const parsed = parseArgs(args, enabled ? {} : { booleanFlags: ["--yes"] });
+  if ("error" in parsed) {
+    writeUsageFailure(deps, parsed.error, json);
+    return 2;
+  }
+  if (parsed.positionals.length === 0) {
+    writeUsageFailure(deps, `Name at least one wallet. ${usage6}`, json);
+    return 2;
+  }
+  const skipConfirm = !enabled && parsed.booleans.has("--yes");
+  await printIdentity(ctx);
+  const deviceToken = await resolveDeviceToken(deps, ctx.profile);
+  if (!deviceToken) {
+    writeLocalFailure(deps, DEVICE_TOKEN_REQUIRED2, json);
+    return 1;
+  }
+  if (!skipConfirm && (!deps.isTTY.stdin || !deps.isTTY.stdout)) {
+    writeLocalFailure(deps, {
+      code: "ALLOW_LAUNCH_REQUIRES_TTY",
+      message: `candle ${command} needs a terminal: the acknowledgement is typed, and nothing else supplies it.`,
+      suggestion: enabled ? "Run it in an interactive shell; there is no flag and no environment variable for confirm." : "Run it in an interactive shell, or pass --yes to turn it off without the prompt."
+    }, json);
+    return 1;
+  }
+  const request2 = (path, method, body) => apiRequest(path, {
+    method,
+    body,
+    auth: "device",
+    credentials: { deviceToken },
+    apiUrl,
+    fetch: deps.fetch,
+    env: deps.env
+  });
+  const preview = await request2(PREVIEW_PATH, "POST", { wallets: parsed.positionals, enabled });
+  if (!preview.ok)
+    return writeFailure2(ctx, preview);
+  const shown = preview.body;
+  const changing = shown.changed;
+  if (changing.length === 0) {
+    if (json)
+      deps.stdout.write(`${JSON.stringify({ ...shown, command })}
+`);
+    else
+      deps.stdout.write(nothingToChangeLine(shown, enabled));
+    return shown.unchanged.length === 0 && shown.notTee.length > 0 ? 1 : 0;
+  }
+  const n = changing.length;
+  const screen = [
+    allowLaunchTable(changing),
+    ...shown.unchanged.length > 0 ? [`${shown.unchanged.length} already ${enabled ? "on" : "off"}: ${shown.unchanged.map(nameOf).join(", ")}`] : [],
+    ...shown.notTee.length > 0 ? [`Not a TEE wallet, left alone: ${shown.notTee.map(nameOf).join(", ")}`] : [],
+    "",
+    enabled ? `${n === 1 ? "This wallet" : `These ${n} wallets`} will be allowed to pay for a launch: the bound key, with launch:write, can create tokens from ${n === 1 ? "it" : "them"} (candle launch).` : `${n === 1 ? "This wallet" : `These ${n} wallets`} will no longer be able to pay for a launch. Trading is unchanged.`,
+    ""
+  ];
+  deps.stderr.write(`${screen.join(`
+`)}
+`);
+  if (!skipConfirm) {
+    const typed = await deps.promptLine(`Type ${CONFIRM_WORD} to ${enabled ? "allow" : "stop"} launches from ${n === 1 ? "this wallet" : `these ${n} wallets`}: `);
+    if (typed.trim().toLowerCase() !== CONFIRM_WORD) {
+      writeLocalFailure(deps, {
+        code: "ALLOW_LAUNCH_NOT_ACKNOWLEDGED",
+        message: `The acknowledgement is the word ${CONFIRM_WORD}; nothing changed.`,
+        suggestion: `Run the command again and type ${CONFIRM_WORD} at the prompt.`
+      }, json);
+      return 1;
+    }
+  }
+  const done = [];
+  const failed = [];
+  for (const row of changing) {
+    const result = await request2(capabilityPath(row.id), "PUT", { capability: "allowLaunch", enabled });
+    if (result.ok)
+      done.push({ ...row, allowLaunch: enabled });
+    else {
+      failed.push({
+        id: row.id,
+        code: result.status === 404 ? "WALLET_NOT_FOUND" : result.code ?? null,
+        message: result.status === 404 ? "no longer an active TEE wallet on this account" : result.message
+      });
+    }
+  }
+  if (json) {
+    deps.stdout.write(`${JSON.stringify({ success: failed.length === 0, command, enabled, changed: done, unchanged: shown.unchanged, notTee: shown.notTee, failed })}
+`);
+    return failed.length > 0 ? 1 : 0;
+  }
+  const verb = enabled ? "Allowed launches from" : "Stopped launches from";
+  deps.stdout.write(`${verb} ${done.length} wallet${done.length === 1 ? "" : "s"}.
+`);
+  for (const failure of failed) {
+    deps.stderr.write(`Not changed: ${failure.id}: ${failure.message}${failure.code ? ` (${failure.code})` : ""}.
+`);
+  }
+  return failed.length > 0 ? 1 : 0;
+}
+function walletsAllowLaunch(args, ctx) {
+  return setAllowLaunch(args, ctx, true);
+}
+function walletsDisallowLaunch(args, ctx) {
+  return setAllowLaunch(args, ctx, false);
+}
+
 // src/commands/wallets-close-empty.ts
 init_args();
 init_render();
@@ -72484,7 +72842,7 @@ init_promote_support();
 var TRUST_PATH = "/api/v1/agent/linked-wallets/trust";
 var USAGE_TRUST = "Usage: candle wallets trust <label|address|id|prefix*>... [--json]";
 var USAGE_UNTRUST = "Usage: candle wallets untrust <label|address|id|prefix*>... [--yes] [--json]";
-var DEVICE_TOKEN_REQUIRED2 = {
+var DEVICE_TOKEN_REQUIRED3 = {
   code: "DEVICE_TOKEN_REQUIRED",
   message: "Marking a wallet trusted needs the device token, the owner's credential; an API key cannot do it.",
   suggestion: "Run: candle auth login"
@@ -72495,7 +72853,7 @@ function sessionLinkedLine(rows) {
   const names = rows.map((row) => row.label ?? row.address).join(", ");
   return `${n} linked while signed in (${names}): always yours while linked. Revoke ${it} to remove ${it}.`;
 }
-function nothingToChangeLine(shown, trusted) {
+function nothingToChangeLine2(shown, trusted) {
   const session = shown.sessionLinked ?? [];
   const unchanged = shown.unchanged;
   if (session.length > 0 && unchanged.length === 0) {
@@ -72562,7 +72920,7 @@ async function setTrust(args, ctx, trusted) {
   await printIdentity(ctx);
   const deviceToken = await resolveDeviceToken(deps, ctx.profile);
   if (!deviceToken) {
-    writeLocalFailure(deps, DEVICE_TOKEN_REQUIRED2, json);
+    writeLocalFailure(deps, DEVICE_TOKEN_REQUIRED3, json);
     return 1;
   }
   if (!skipConfirm && (!deps.isTTY.stdin || !deps.isTTY.stdout)) {
@@ -72592,7 +72950,7 @@ async function setTrust(args, ctx, trusted) {
       deps.stdout.write(`${JSON.stringify({ ...shown, command })}
 `);
     } else {
-      deps.stdout.write(nothingToChangeLine(shown, trusted));
+      deps.stdout.write(nothingToChangeLine2(shown, trusted));
     }
     return 0;
   }
@@ -72859,6 +73217,8 @@ var COMMANDS = {
       revoke: walletsRevoke,
       trust: walletsTrust,
       untrust: walletsUntrust,
+      "allow-launch": walletsAllowLaunch,
+      "disallow-launch": walletsDisallowLaunch,
       "close-empty": walletsCloseEmpty
     },
     bare: wallets