@candledottv/cli 0.11.17 → 0.11.18

package/README.md

@@ -1,6 +1,6 @@
 # @candledottv/cli
 
-The Candle CLI (current version 0.11.17): authorize a device from your browser, keep your own keys
+The Candle CLI (current version 0.11.18): authorize a device from your browser, keep your own keys
 in an encrypted vault on this machine, hand an agent a TEE wallet it can trade, and manage API
 keys, wallets, and setup health from the terminal. Zero runtime dependencies; the whole thing is
 one self-contained `dist/index.js` that runs under plain Node.
@@ -70,16 +70,16 @@ emergency procedure, rebinding, trusted wallets and API key access levels are al
 | `candle auth login [--profile <name>] [--scopes <a,b,c>] [--label <name>] [--no-browser]` | Authorizes this device: prints a code, opens (or prints) an approval URL, polls until approved, then stores the resulting device token and API key. `--label` names both the device and the key. |
 | `candle auth status` | Shows which storage backend is in use, both credential prefixes, the config file path, and a live validity check for each credential. |
 | `candle auth logout [--keep-key]` | Revokes the stored API key (skipped with `--keep-key`), clears local credentials and config, and prints the portal URL for revoking the device itself. |
-| `candle keys list [--scopes]` | Lists this account's API keys: prefix, name, Read, Read:Write or Read:Write:Transfer access, environment, timestamps, and which device minted each one. `--scopes` adds the raw scopes, sorted. |
-| `candle keys create [--access read\|read-write\|read-write-transfer \| --scopes <a,b,c>] [--label <name>] [--expires-in <days>] [--tx-limit <usd> [--reset daily\|weekly\|monthly\|never]] [--embedded-wallet deny\|allow]` | Creates a new API key and prints the plaintext exactly once, with the same optional name, expiration, and USD transaction limit the portal's create form takes. `--access` mints one of the portal's three levels (`read-write-transfer` is Read:Write plus `transfer:bound`: the key can move funds out of the wallet it runs, to wallets you linked while signed in or marked trusted and to that wallet's vault); `--scopes` names raw scopes instead, never both. `--embedded-wallet` defaults to `deny`; `allow` lets the key spend the account's embedded wallet and is confirmed at a terminal. Stored locally only if the CLI does not already hold a working key. An account holds at most 12 active keys. |
-| `candle keys access <prefix\|label\|self> (--access read\|read-write\|read-write-transfer [--yes] \| --history)` | Changes an existing key's level in place (same key, wallets and caps). Widening needs the device token and the prefix typed back at a terminal; `--yes` skips the prompt when narrowing; `self` narrows the profile's own key and can never widen it. `--history` lists the key's changes and who made them. |
+| `candle keys list [--scopes]` | Lists this account's API keys: prefix, name, Read, Write or Withdraw access, environment, timestamps, and which device minted each one. `--scopes` adds the raw scopes, sorted. |
+| `candle keys create [--access read\|write\|withdraw \| --scopes <a,b,c>] [--label <name>] [--expires-in <days>] [--tx-limit <usd> [--reset daily\|weekly\|monthly\|never]] [--embedded-wallet deny\|allow]` | Creates a new API key and prints the plaintext exactly once, with the same optional name, expiration, and USD transaction limit the portal's create form takes. `--access` mints one of the portal's three levels (`withdraw` is Write plus `transfer:bound`: the key can move funds out of the wallet it runs, to wallets you linked while signed in or marked trusted and to that wallet's vault); `--scopes` names raw scopes instead, never both. `--embedded-wallet` defaults to `deny`; `allow` lets the key spend the account's embedded wallet and is confirmed at a terminal. Stored locally only if the CLI does not already hold a working key. An account holds at most 12 active keys. |
+| `candle keys access <prefix\|label\|self> (--access read\|write\|withdraw [--yes] \| --history)` | Changes an existing key's level in place (same key, wallets and caps). Widening needs the device token and the prefix typed back at a terminal; `--yes` skips the prompt when narrowing; `self` narrows the profile's own key and can never widen it. `--history` lists the key's changes and who made them. |
 | `candle keys update <prefix\|label> --embedded-wallet allow\|deny [--yes]`, `candle keys self embedded-wallet deny` | Allow or deny a key the account's embedded wallet, with the device token (allowing needs the prefix typed back at a terminal). `self embedded-wallet deny` lets the profile's own key give it up with no prompt; a key can never allow itself. |
 | `candle keys signer approve <code> --key <prefix\|label> [--reject]`, `candle keys signer move <prefix\|label> [--to-key <prefix\|label>]` | Key signers for bots on a different machine from the vault. `approve` accepts (or rejects) a key's signer request with the device token, after you type the full fingerprint the trading machine printed. `move`, on the machine holding a wallet's current signer, moves every wallet on the key onto its active signer; `--to-key` moves a revoked key's wallets to a live key. |
 | `candle keys revoke <prefix>` | Revokes an API key by prefix. Revoking the CLI's own stored key also clears it locally. |
 | `candle keys wallets <prefix>`, `keys wallets set <prefix> --wallets <id,id>`, `keys wallets scope <prefix> --scope all\|selected` | Each key is an agent profile with its own wallet set: list it, replace it, or limit the profile to its assigned wallets. |
 | `candle wallets` (alias `candle wallet`) | Shows the account's embedded (launch) wallets and any linked wallets, using the API key, with a `Signer` column saying whether this machine holds each linked wallet's signing key and a `Trusted` column saying whether it is yours (linked while signed in, or marked with `trust`). It links and revokes; it never generates or prints a key, which the vault now derives. |
 | `candle wallets import --chain solana\|evm`, `wallets revoke <wallet-id>` | Link a wallet you own (key from `--key-file` or a hidden prompt, sealed to Privy before it leaves the machine), or unlink one. |
-| `candle wallets trust\|untrust <label\|address\|id\|prefix*>...` | Mark linked wallets as yours so an agent's Read:Write:Transfer key can move funds into them, or clear the mark. Owner only, over the device token, with a typed confirm; a trailing `*`, as in `'tr-*'`, selects by prefix. |
+| `candle wallets trust\|untrust <label\|address\|id\|prefix*>...` | Mark linked wallets as yours so an agent's Withdraw key can move funds into them, or clear the mark. Owner only, over the device token, with a typed confirm; a trailing `*`, as in `'tr-*'`, selects by prefix. |
 | `candle wallets allow-launch\|disallow-launch <label\|address\|id\|prefix*>...` | Let TEE wallets pay for a launch (`candle launch`), or stop them. Owner only, over the device token; the screen shows each wallet's label, address and bound key before a typed confirm. `disallow-launch --yes` skips the confirm. |
 | `candle wallets close-empty [--wallet embedded] [--keep <mint>]... [--yes]` | Closes the embedded wallet's empty token accounts and returns their rent to it, after a preview (`transfer:write`). |
 | `candle vault init\|status\|list\|new-key\|rename\|phrase show\|restore\|reconcile-exposure` | The encrypted local vault, `vault.enc` (Tier 1). `init` creates it with a passphrase factor and a 24-word recovery phrase (and no key), `new-key` derives a key inside it (`--count`, `--labels-from <file>` for many under one unlock), `list [filter] [--balances]` shows one line per key, `rename` changes a label only, `phrase show` displays the phrase on a terminal (never in `--json`, a log or a pipe), and `restore --phrase` rebuilds the derived keys on another machine with a new passphrase (`--count`, `--tee-count`, `--external-count`, `--evm-count` and `--evm-tee-count` for EVM keys and Hood TEE wallets, or a Solana gap scan with `--rpc-url`); a restored vault never allocates new keys. `reconcile-exposure` re-reads the account and adds exposure records, clearing nothing. No key ever leaves the vault to reach Candle. See [CLI custody](https://docs.candle.tv/developers/cli-custody). |
@@ -96,7 +96,7 @@ emergency procedure, rebinding, trusted wallets and API key access levels are al
 | `candle tee new\|enable` | The legacy path: `new` seals a fresh key in its own `tee-wallets.enc` and `enable <address> --vault <address>` delegates it with a pinned sweep vault. New setups use `vault promote`; `vault import-legacy --tee` migrates an existing store. |
 | `candle swap <from> <to> --amount <n>\|--percent <n> --wallet <tee> [--to <tee>] [--wait]` | Quote, confirm and swap through the TEE wallet's bound key; the first buy after a launch is this command, unless `candle launch --buy` made it. The assets decide the chain (ETH, USDG or a 0x token is Hood; SOL, USDC, CNDL or a mint is Solana). SOL or USDC to ETH or USDG, or back, is a bridge through Relay into this key's own TEE wallet on the other chain (`--to` names it when there are several); `--wait` follows it for up to ten minutes. |
 | `candle swap status <id> [--kind trade\|swap\|launch] [--wait]` | Read an operation without resending it; `--wait` follows a bridge until it ends. |
-| `candle transfer --to <address\|wallet name\|vault> --asset <SOL\|USDC\|CNDL\|ETH\|USDG>\|--mint <mint>\|--token <0x...> --amount <decimal\|max> [--wallet <tee>] [--rpc-url <url>] [--yes]` | Move funds out of a TEE wallet through its bound Read:Write:Transfer key, to the wallet's own pinned vault (`--to vault`, any token, `max` allowed, one SOL transfer at most the server's backstop ceiling, 50 SOL by default) or to another of the account's wallets you linked while signed in or marked trusted (a base asset, counted against the key's caps, which must include a per-asset cap and a USD `--tx-limit`). The asset decides the chain: ETH, USDG or `--token` moves from a Hood TEE wallet. The destination and its kind are shown before you confirm; Candle builds, the relay signs, Candle broadcasts. |
+| `candle transfer --to <address\|wallet name\|vault> --asset <SOL\|USDC\|CNDL\|ETH\|USDG>\|--mint <mint>\|--token <0x...> --amount <decimal\|max> [--wallet <tee>] [--rpc-url <url>] [--yes]` | Move funds out of a TEE wallet through its bound Withdraw key, to the wallet's own pinned vault (`--to vault`, any token, `max` allowed, one SOL transfer at most the server's backstop ceiling, 50 SOL by default) or to another of the account's wallets you linked while signed in or marked trusted (a base asset, counted against the key's caps, which must include a per-asset cap and a USD `--tx-limit`). The asset decides the chain: ETH, USDG or `--token` moves from a Hood TEE wallet. The destination and its kind are shown before you confirm; Candle builds, the relay signs, Candle broadcasts. |
 | `candle launch --name <name> --symbol <symbol> --image-url <url> --wallet <tee> [--buy <amount>] [--quote-asset <asset>] [--dex-version v3\|v4]` | Create a token from a TEE wallet. Without `--buy` it makes no first buy. `--buy <amount>` adds one from the same wallet, in whole units of the quote asset, reserved against the key's spend window before signing: in the launch transaction on Solana, as a last leg on Hood. It needs the server's `TEE_LAUNCH_BUYS_ENABLED`, which is off by default; while it is off Candle refuses the buy and nothing is built. Needs `launch:write`, `allowLaunch` turned on for the wallet by the account owner, and the Pro or Max plan. On Free, launch from the embedded wallet instead, with an optional dev buy (same transaction on Solana; best-effort follow-up on Hood): the MCP tool `candle_launch_and_seed` or the SDK's `launch()`. The wallet decides the chain: a Hood TEE wallet launches on Hood and needs `--dex-version`. `--quote-asset` is sol, usdc or cndl on Solana, eth or usdg on Hood. |
 | `candle pnl [--profile <name>]` | P&L: realized net, fees, unrealized and total, then open positions, the same figures the console shows. Without `--profile`, the account's books (every profile, the web app and the CLI, one ledger; needs the Read scope), with a By agent table (each key, then Manual, then the account total). With `--profile <name>`, that profile's key's share of the same P&L: realized on its sales and the open positions that belong to it, with a row per wallet that sums to the total. Each wallet is its own average-cost pool, and a recorded move between the account's wallets carries its cost. Both show a Solana block, a Hood block, then the combined figure, the closed positions as money made, minus money lost, plus partial sells, and a `CHAIN` column (and `WALLET`, where the API names it) on positions. Unpriced positions are never valued at zero; dust (worth under one cent) is marked and still counted. A bridge between Solana and Hood is not a trade, and bridge and Relay costs are not netted. DAMM v2 LP positions are included: realized (withdrawals against the cost basis at the add, plus claimed fees), unrealized (open positions at their share of the pool plus unclaimed fees, against that basis) and vs holding (what the deposited tokens would be worth held); `Total` stays the console's token figure and `Total with LP` covers tokens and LP. |
 | `candle portfolio [<filter>] [--chain solana\|hood] [--rpc-url <url>] [--evm-rpc-url <url>]` | Vault, TEE and embedded wallets on Solana and Hood in one table with chain, amount, price and value, subtotals per group and per chain, and a total. Solana vault and external balances are read over your own Solana RPC; Candle is sent only the mints, for prices. EVM vault keys are read over your own Hood RPC (`--evm-rpc-url`, else `CANDLE_EVM_RPC_URL`, else the built-in Hood RPC) for ETH and USDG only, priced by asset, never by address; an RPC on another chain is refused. An unpriced Hood token shows why (`no-market-row`, `stale-mark`, ...). `--chain` shows one chain. Each TEE wallet's DAMM v2 LP positions follow the tokens, valued by Candle at the same marks, and count in the total; one whose pool could not be read is shown as not read and the total says it is partial. |
@@ -116,6 +116,8 @@ emergency procedure, rebinding, trusted wallets and API key access levels are al
 | `candle completion <zsh\|bash\|fish>` | Prints a shell completion script to stdout, generated from the same data `candle help` prints, so it offers exactly the commands, subcommands and flags the help documents. Install it by redirecting: `candle completion zsh > "${fpath[1]}/_candle"`, `candle completion bash > ~/.local/share/bash-completion/completions/candle`, `candle completion fish > ~/.config/fish/completions/candle.fish`. Static: profile names, key labels and factor ids are not completed, because that would mean reading config or opening the vault at tab time. Regenerate after every `candle update`. |
 | `candle help [<command>]` | The top-level screen (six groups of command words, the global flags, and every environment variable the CLI reads), or one command's own: its subcommands, the flags they share, examples, and the environment it reads. `candle <command> --help` is the same screen. Reads no config and makes no request, so it answers before any profile is selected. |
 
+The documented `--access` values are `read`, `write` and `withdraw`. The older `read-write`, `transfer` and `read-write-transfer` values remain accepted as silent, permanent aliases.
+
 Every command accepts these global options:
 
 | Flag | Effect |

package/dist/index.js

@@ -343,14 +343,14 @@ var init_agent_key_access = __esm(() => {
   ];
   AGENT_KEY_PRESET_LABELS = {
     read: "Read",
-    readwrite: "Read:Write",
-    readwritetransfer: "Read:Write:Transfer"
+    readwrite: "Write",
+    readwritetransfer: "Withdraw"
   };
   AGENT_KEY_CAPABILITY_CHIPS = [
     ["Launch", "launch"],
     ["Trade", "trade"],
     ["Transfer", "transfer"],
-    ["Linked transfer", "linkedTransfer"],
+    ["Withdraw", "linkedTransfer"],
     ["Report", "report"]
   ];
 });
@@ -1028,7 +1028,7 @@ async function keysCreate(args, ctx) {
   if (parsed.values["--access"] !== undefined) {
     const preset = ACCESS_LEVELS[parsed.values["--access"]];
     if (preset === undefined) {
-      writeUsageFailure(deps, `--access must be one of: ${Object.keys(ACCESS_LEVELS).join(", ")}.`, json);
+      writeUsageFailure(deps, "--access must be one of: read, write, withdraw.", json);
       return 2;
     }
     accessScopes = scopesForPreset(preset);
@@ -1226,6 +1226,9 @@ var init_keys = __esm(() => {
   init_keys_embedded_wallet();
   ACCESS_LEVELS = {
     read: "read",
+    write: "readwrite",
+    withdraw: "readwritetransfer",
+    transfer: "readwritetransfer",
     "read-write": "readwrite",
     "read-write-transfer": "readwritetransfer"
   };
@@ -27455,6 +27458,20 @@ async function resolveTeeAddress(ctx, _parsed, address, openLegacy, access3 = "r
     }
   };
 }
+async function grantSignAccess(resolved) {
+  if (resolved.privateKeyBase58 === null) {
+    const secret = await decryptKey(resolved.vault, resolved.entry.id);
+    try {
+      if (addressFromSecret64(secret) !== resolved.entry.address) {
+        throw new VaultError("VAULT_VERIFY_FAILED", `${resolved.entry.address} in the vault does not re-derive from its stored secret.`);
+      }
+      resolved.privateKeyBase58 = base58.encode(secret);
+    } finally {
+      wipe(secret);
+    }
+  }
+  resolved.legacyView = keyEntryAsKeystore(resolved.entry, resolved.privateKeyBase58);
+}
 function releaseResolvedTee(resolved) {
   if (resolved.source === "vault")
     closeVault(resolved.vault);
@@ -32372,23 +32389,10 @@ async function teeSweepEvm(args, ctx) {
   if (!address || extra !== undefined) {
     return usage(ctx, "Usage: candle tee sweep <0x address> [--rpc-url <url>] [--emergency] [--token <0x...>]... [--from-block <n>]");
   }
-  const tokens = [];
-  for (const raw of tokenFlags) {
-    const checked = checkEvmAddress(raw);
-    if (!checked.ok)
-      return usage(ctx, `--token must be an ERC-20 contract address: ${raw || "(empty)"} is ${checked.reason}.`);
-    tokens.push(checked.address);
-  }
-  let fromBlock;
-  const fromBlockRaw = parsed.values["--from-block"];
-  if (fromBlockRaw !== undefined) {
-    if (!/^\d+$/.test(fromBlockRaw))
-      return usage(ctx, `--from-block must be a Hood block number: ${fromBlockRaw} is not.`);
-    fromBlock = BigInt(fromBlockRaw);
-  }
-  const client = resolveHoodClient(ctx, parsed.values["--rpc-url"]);
-  if ("error" in client)
-    return usage(ctx, client.error);
+  const options = sweepOptions(ctx, parsed, tokenFlags);
+  if (typeof options === "number")
+    return options;
+  const { tokens, fromBlock, client } = options;
   if (!refuseEnvPassphrase(ctx))
     return 1;
   if (!requireTty(ctx, "tee sweep"))
@@ -32407,6 +32411,26 @@ async function teeSweepEvm(args, ctx) {
     return sweepEvmWallet({ ctx, vault, hold, entry, client, emergency, tokenFlags: tokens, fromBlock });
   });
 }
+function sweepOptions(ctx, parsed, tokenFlags) {
+  const tokens = [];
+  for (const raw of tokenFlags) {
+    const checked = checkEvmAddress(raw);
+    if (!checked.ok)
+      return usage(ctx, `--token must be an ERC-20 contract address: ${raw || "(empty)"} is ${checked.reason}.`);
+    tokens.push(checked.address);
+  }
+  let fromBlock;
+  const fromBlockRaw = parsed.values["--from-block"];
+  if (fromBlockRaw !== undefined) {
+    if (!/^\d+$/.test(fromBlockRaw))
+      return usage(ctx, `--from-block must be a Hood block number: ${fromBlockRaw} is not.`);
+    fromBlock = BigInt(fromBlockRaw);
+  }
+  const client = resolveHoodClient(ctx, parsed.values["--rpc-url"]);
+  if ("error" in client)
+    return usage(ctx, client.error);
+  return { tokens, fromBlock, client };
+}
 async function sweepEvmWallet(input) {
   const { ctx, client, emergency, hold } = input;
   const { deps, json } = ctx;
@@ -32984,78 +33008,83 @@ async function teeDisableEvm(args, ctx) {
   const resolvedVault = vaultPathFor(ctx, parsed);
   if ("error" in resolvedVault)
     return usage(ctx, resolvedVault.error);
-  const { deps, json } = ctx;
   await printIdentity(ctx);
   return runVaultCommand(ctx, async ({ hold }) => {
     const raw = await requireVaultRaw(ctx, resolvedVault);
     const opened = await unlockInteractively(ctx, resolvedVault.path, raw, { acceptOlderCopy: true });
-    let vault = hold(opened.vault);
+    const vault = hold(opened.vault);
     const entry = findEvmTee(vault, address);
     if (entry === undefined)
       return unknownWallet(ctx, address);
-    if (entry.linkedWalletId === undefined) {
-      writeLocalFailure(deps, { code: "TEE_WALLET_NOT_ENABLED", message: `${entry.address} was never enabled; there is nothing to stop.` }, json);
-      return 1;
+    return (await disableEvmEntry(ctx, vault, hold, entry, false)).code;
+  });
+}
+async function disableEvmEntry(ctx, opened, hold, entry, inDemote) {
+  const { deps, json } = ctx;
+  let vault = opened;
+  if (entry.linkedWalletId === undefined) {
+    writeLocalFailure(deps, { code: "TEE_WALLET_NOT_ENABLED", message: `${entry.address} was never enabled; there is nothing to stop.` }, json);
+    return { code: 1, vault };
+  }
+  const linkedWalletId = entry.linkedWalletId;
+  const stopRequestedAt = entry.tee?.stopRequestedAt ?? new Date(deps.now()).toISOString();
+  vault = hold(await patchTee(ctx, vault, entry.id, (tee) => ({ ...tee, stopRequestedAt })));
+  const unconfirmed = (detail, suggestion) => {
+    if (json) {
+      writeJson(deps, {
+        ok: false,
+        code: "STOP_UNCONFIRMED",
+        message: detail,
+        address: entry.address,
+        linkedWalletId,
+        stopRequestedAt,
+        remoteEnforcement: "unconfirmed",
+        suggestion
+      });
+      return { code: 1, vault };
     }
-    const linkedWalletId = entry.linkedWalletId;
-    const stopRequestedAt = entry.tee?.stopRequestedAt ?? new Date(deps.now()).toISOString();
-    vault = hold(await patchTee(ctx, vault, entry.id, (tee) => ({ ...tee, stopRequestedAt })));
-    const unconfirmed = (detail, suggestion) => {
-      if (json) {
-        writeJson(deps, {
-          ok: false,
-          code: "STOP_UNCONFIRMED",
-          message: detail,
-          address: entry.address,
-          linkedWalletId,
-          stopRequestedAt,
-          remoteEnforcement: "unconfirmed",
-          suggestion
-        });
-        return 1;
-      }
-      deps.stderr.write(`${detail}
+    deps.stderr.write(`${detail}
 Stop intent recorded locally at ${stopRequestedAt}: this CLI will not fund ${entry.address} again. Remote enforcement is UNCONFIRMED: the agent may still trade until the server acknowledges the stop.
 ${suggestion}
 `);
-      return 1;
-    };
-    const apiKey = await resolveApiKey(deps, ctx.profile);
-    if (!apiKey) {
-      return unconfirmed("No API key available, so the server was not asked to stop the agent.", `Stop it from your Candle session (revoke linked wallet ${linkedWalletId}), or restore the key and re-run: candle tee disable ${entry.address}`);
-    }
-    const result = await apiRequest(`/api/v1/agent/wallets/${encodeURIComponent(linkedWalletId)}`, {
-      method: "DELETE",
-      auth: "key",
-      credentials: { apiKey },
-      apiUrl: ctx.apiUrl,
-      fetch: deps.fetch,
-      env: deps.env
-    });
-    if (!result.ok) {
-      return unconfirmed(`The stop request failed: ${result.message ?? `HTTP ${result.status}`}.`, `Re-run: candle tee disable ${entry.address}. If the key is lost or revoked, stop it from your Candle session (revoke linked wallet ${linkedWalletId}).`);
-    }
-    const outcome = readDisableOutcome(result.body);
-    for (const warning of bridgeDisableWarnings(entry.address, result.body))
-      deps.stderr.write(`${warning}
+    return { code: 1, vault };
+  };
+  const apiKey = await resolveApiKey(deps, ctx.profile);
+  if (!apiKey) {
+    return unconfirmed("No API key available, so the server was not asked to stop the agent.", `Stop it from your Candle session (revoke linked wallet ${linkedWalletId}), or restore the key and re-run: candle tee disable ${entry.address}`);
+  }
+  const result = await apiRequest(`/api/v1/agent/wallets/${encodeURIComponent(linkedWalletId)}`, {
+    method: "DELETE",
+    auth: "key",
+    credentials: { apiKey },
+    apiUrl: ctx.apiUrl,
+    fetch: deps.fetch,
+    env: deps.env
+  });
+  if (!result.ok) {
+    return unconfirmed(`The stop request failed: ${result.message ?? `HTTP ${result.status}`}.`, `Re-run: candle tee disable ${entry.address}. If the key is lost or revoked, stop it from your Candle session (revoke linked wallet ${linkedWalletId}).`);
+  }
+  const outcome = readDisableOutcome(result.body);
+  for (const warning of bridgeDisableWarnings(entry.address, result.body))
+    deps.stderr.write(`${warning}
 `);
-    if (json) {
-      writeJson(deps, { address: entry.address, linkedWalletId, ...result.body });
-      return outcome.complete ? 0 : 3;
-    }
-    if (outcome.complete) {
-      deps.stdout.write(`Stopped ${entry.address}. Remote signing denial verified; the wallet is quarantined.
+  if (json) {
+    writeJson(deps, { address: entry.address, linkedWalletId, ...result.body });
+    return { code: outcome.complete ? 0 : 3, vault };
+  }
+  if (outcome.complete) {
+    deps.stdout.write(`Stopped ${entry.address}. Remote signing denial verified; the wallet is quarantined.
 `);
+    if (!inDemote)
       deps.stdout.write(`Recover the funds: candle tee sweep ${entry.address}
 `);
-      return 0;
-    }
-    deps.stdout.write(`Agent trading stopped at Candle for ${entry.address}. Remote policy verification is pending${outcome.reasonCode ? ` (${outcome.reasonCode})` : ""}.
+    return { code: 0, vault };
+  }
+  deps.stdout.write(`Agent trading stopped at Candle for ${entry.address}. Remote policy verification is pending${outcome.reasonCode ? ` (${outcome.reasonCode})` : ""}.
 Funds remain in the TEE wallet and its TEE signing authority may still be active. Re-run: candle tee disable ${entry.address}
-If the provider is down or theft is suspected: candle tee sweep ${entry.address} --emergency
-`);
-    return 3;
-  });
+${inDemote ? "" : `If the provider is down or theft is suspected: candle tee sweep ${entry.address} --emergency
+`}`);
+  return { code: 3, vault };
 }
 async function vaultDemoteEvm(args, ctx) {
   const { rest, values: tokenFlags } = extractRepeated(args, "--token");
@@ -33070,6 +33099,9 @@ async function vaultDemoteEvm(args, ctx) {
   if (!address || extra !== undefined) {
     return usage(ctx, "Usage: candle vault demote <tee-address> [--rpc-url <url>] [--emergency] [--sweep-to <label>]");
   }
+  const options = sweepOptions(ctx, parsed, tokenFlags);
+  if (typeof options === "number")
+    return options;
   if (!refuseEnvPassphrase(ctx))
     return 1;
   if (!requireTty(ctx, "vault demote"))
@@ -33079,13 +33111,13 @@ async function vaultDemoteEvm(args, ctx) {
     return usage(ctx, resolvedVault.error);
   const sweepTo = parsed.values["--sweep-to"];
   let emergency = parsed.booleans.has("--emergency");
-  const snapshot = await runVaultCommand(ctx, async ({ hold }) => {
+  return runVaultCommand(ctx, async ({ hold }) => {
     const raw = await requireVaultRaw(ctx, resolvedVault);
     const opened = await unlockInteractively(ctx, resolvedVault.path, raw, {
       acceptOlderCopy: parsed.booleans.has("--accept-older-copy")
     });
-    const vault = hold(opened.vault);
-    const entry = findEvmTee(vault, address);
+    let vault = hold(opened.vault);
+    let entry = findEvmTee(vault, address);
     if (entry === undefined)
       return unknownWallet(ctx, address);
     if (entry.tee?.vaultDestination === undefined) {
@@ -33098,39 +33130,40 @@ async function vaultDemoteEvm(args, ctx) {
         chain: "evm",
         acceptUnknownExposure: parsed.booleans.has("--accept-unknown-exposure")
       });
-      hold(await patchTee(ctx, vault, entry.id, (tee) => ({ ...tee, vaultDestination: destination.address })));
+      vault = hold(await patchTee(ctx, vault, entry.id, (tee) => ({ ...tee, vaultDestination: destination.address })));
+      entry = findEvmTee(vault, address);
     }
     if (entry.linkedWalletId === undefined) {
       ctx.deps.stdout.write(`No linkedWalletId is recorded for ${entry.address}; disable was not called and remote authority stays unknown.
 `);
       emergency = true;
     }
-    return 0;
-  });
-  if (snapshot !== 0)
-    return snapshot;
-  if (!emergency) {
-    const disableCode = await teeDisableEvm([address, ...keystoreArgs(parsed)], ctx);
-    if (disableCode !== 0 && disableCode !== 3)
-      return disableCode;
-    if (disableCode === 3) {
-      ctx.deps.stdout.write(`The disable is not yet verified; the sweep below will wait for quarantine. If the provider is down or theft is suspected, run: candle vault demote ${address} --emergency
+    if (!emergency) {
+      await printIdentity(ctx);
+      const disabled = await disableEvmEntry(ctx, vault, hold, entry, true);
+      if (disabled.code !== 0 && disabled.code !== 3)
+        return disabled.code;
+      vault = disabled.vault;
+      entry = findEvmTee(vault, address);
+      if (disabled.code === 3) {
+        ctx.deps.stdout.write(`The disable is not yet verified; the sweep below will wait for quarantine. If the provider is down or theft is suspected, run: candle vault demote ${address} --emergency
 `);
+      }
     }
-  }
-  const sweepArgs = [address, ...keystoreArgs(parsed)];
-  if (parsed.values["--rpc-url"] !== undefined)
-    sweepArgs.push("--rpc-url", parsed.values["--rpc-url"]);
-  if (parsed.values["--from-block"] !== undefined)
-    sweepArgs.push("--from-block", parsed.values["--from-block"]);
-  for (const token of tokenFlags)
-    sweepArgs.push("--token", token);
-  if (emergency)
-    sweepArgs.push("--emergency");
-  return teeSweepEvm(sweepArgs, ctx);
-}
-function keystoreArgs(parsed) {
-  return parsed.values["--keystore"] !== undefined ? ["--keystore", parsed.values["--keystore"]] : [];
+    if (!ctx.json)
+      ctx.deps.stdout.write(`Sweeping remaining funds to ${entry.tee?.vaultDestination}...
+`);
+    return sweepEvmWallet({
+      ctx,
+      vault,
+      hold,
+      entry,
+      client: options.client,
+      emergency,
+      tokenFlags: options.tokens,
+      fromBlock: options.fromBlock
+    });
+  });
 }
 var MAX_TOKEN_TRANSFER_GAS = 1000000n;
 var init_tee_evm = __esm(() => {
@@ -33498,6 +33531,9 @@ async function commitTee(deps, opened, mutate, opts = {}) {
     };
   }
 }
+function vaultActiveTee(ctx, resolved) {
+  return { source: "vault", resolved, entry: resolved.legacyView, path: "vault", ctx };
+}
 function applyKeystoreViewToVaultEntry(entry, view) {
   if (view.linkedWalletId !== undefined)
     entry.linkedWalletId = view.linkedWalletId;
@@ -33552,18 +33588,8 @@ async function openActiveTee(ctx, parsed, address, access3) {
   const resolved = await resolveTeeAddress(ctx, parsed, address, () => openExistingTeeStore(ctx, parsed), access3);
   if (!resolved.ok)
     return { ok: false, code: resolved.code };
-  if (resolved.resolved.source === "vault") {
-    return {
-      ok: true,
-      active: {
-        source: "vault",
-        resolved: resolved.resolved,
-        entry: resolved.resolved.legacyView,
-        path: "vault",
-        ctx
-      }
-    };
-  }
+  if (resolved.resolved.source === "vault")
+    return { ok: true, active: vaultActiveTee(ctx, resolved.resolved) };
   return {
     ok: true,
     active: {
@@ -34173,7 +34199,7 @@ async function teeStatus(args, ctx) {
       releaseResolvedTee(local);
   }
 }
-async function teeDisable(args, ctx) {
+async function teeDisable(args, ctx, demote) {
   const { deps, apiUrl, json } = ctx;
   if (namesEvmWallet(args))
     return teeDisableEvm(args, ctx);
@@ -34186,7 +34212,7 @@ async function teeDisable(args, ctx) {
   if (!address || extra !== undefined)
     return usage2(ctx, "Usage: candle tee disable <address>");
   await printIdentity(ctx);
-  const openedActive = await openActiveTee(ctx, parsed, address, "read");
+  const openedActive = demote ? { ok: true, active: vaultActiveTee(ctx, demote.resolved) } : await openActiveTee(ctx, parsed, address, "read");
   if (!openedActive.ok)
     return openedActive.code;
   const { active } = openedActive;
@@ -34255,17 +34281,37 @@ ${suggestion}
     if (outcome.complete) {
       deps.stdout.write(`Stopped ${address}. Remote signing denial verified; the wallet is quarantined.
 `);
-      deps.stdout.write(`Recover the funds: candle tee sweep ${address}
+      if (!demote)
+        deps.stdout.write(`Recover the funds: candle tee sweep ${address}
 `);
       return 0;
     }
     deps.stdout.write(`Agent trading stopped at Candle for ${address}. Remote policy verification is pending${outcome.reasonCode ? ` (${outcome.reasonCode})` : ""}.
 Funds remain in the TEE wallet and its TEE signing authority may still be active. Re-run: candle tee disable ${address}
-If the provider is down or theft is suspected: candle tee sweep ${address} --emergency
+If the provider is down or theft is suspected: ${demote ? `candle vault demote ${address}` : `candle tee sweep ${address}`} --emergency
 `);
     return 3;
   } finally {
-    releaseActiveTee(active);
+    if (!demote)
+      releaseActiveTee(active);
+  }
+}
+async function nothingLeftToSweep(solana, entry) {
+  const tee = entry.tee;
+  if ((tee?.sweepPending?.length ?? 0) > 0)
+    return false;
+  if ((tee?.sweepReceipts?.length ?? 0) > 0 && tee?.sweptAt === undefined)
+    return false;
+  try {
+    if (await solana.rpc.getBalance(entry.address) > 0n)
+      return false;
+    for (const programId of [TOKEN_PROGRAM_ID, TOKEN_2022_PROGRAM_ID]) {
+      if ((await solana.rpc.getTokenAccountsByOwner(entry.address, programId)).length > 0)
+        return false;
+    }
+    return true;
+  } catch {
+    return false;
   }
 }
 function refusalState(raw) {
@@ -34373,7 +34419,7 @@ async function broadcastMessage(rpc, ctx, secret, message, blockhash, pending, r
     error: `transaction ${signature} was not finalized within ${CONFIRM_MAX_POLLS * CONFIRM_POLL_MS / 1000}s; it may still land${echoNote}`
   };
 }
-async function teeSweep(args, ctx) {
+async function teeSweep(args, ctx, demote) {
   const { deps, apiUrl, json } = ctx;
   if (namesEvmWallet(args))
     return teeSweepEvm(args, ctx);
@@ -34389,11 +34435,24 @@ async function teeSweep(args, ctx) {
   const [address, extra] = parsed.positionals;
   if (!address || extra !== undefined)
     return usage2(ctx, "Usage: candle tee sweep <address> [--rpc-url <url>] [--emergency]");
-  const solana = await openSolanaClient(ctx, parsed.values["--rpc-url"]);
+  const solana = demote ? demote.solana : await openSolanaClient(ctx, parsed.values["--rpc-url"]);
   if ("error" in solana)
     return usage2(ctx, solana.error);
   const emergency = parsed.booleans.has("--emergency");
-  const openedActive = await openActiveTee(ctx, parsed, address, "sign");
+  let openedActive;
+  if (demote) {
+    try {
+      await grantSignAccess(demote.resolved);
+    } catch (error) {
+      if (!isVaultError(error))
+        throw error;
+      writeLocalFailure(deps, { code: error.code, message: error.message }, json);
+      return error.exitCode;
+    }
+    openedActive = { ok: true, active: vaultActiveTee(ctx, demote.resolved) };
+  } else {
+    openedActive = await openActiveTee(ctx, parsed, address, "sign");
+  }
   if (!openedActive.ok)
     return openedActive.code;
   const { active } = openedActive;
@@ -35177,7 +35236,8 @@ Stop the agent from your Candle session if you have not, and re-run candle tee d
 `);
     return 3;
   } finally {
-    releaseActiveTee(active);
+    if (!demote)
+      releaseActiveTee(active);
   }
 }
 var MIN_PASSPHRASE_LENGTH = 12, USDC_MINT = "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v", CONFIRM_POLL_MS = 2000, CONFIRM_MAX_POLLS = 45, StoreChangedError, TOKEN_ACCOUNT_STATE_OFFSET = 108, TOKEN_ACCOUNT_STATE_FROZEN = 2;
@@ -35192,6 +35252,7 @@ var init_tee = __esm(() => {
   init_solana_endpoint();
   init_solana_lite();
   init_token_2022();
+  init_errors();
   init_store();
   init_tee_resolve();
   init_wallet_import_flow();
@@ -52823,7 +52884,7 @@ init_render();
 init_secret_store();
 
 // src/version.ts
-var CLI_VERSION = "0.11.17";
+var CLI_VERSION = "0.11.18";
 
 // src/commands/auth.ts
 init_keys_embedded_wallet();
@@ -52847,7 +52908,7 @@ async function authLogin(args, ctx) {
   }
   const scopes = parsed.values["--scopes"] ? parseScopesList(parsed.values["--scopes"]) : undefined;
   if (scopes?.includes("transfer:bound")) {
-    writeUsageFailure(deps, "transfer:bound is not available on a device login. Mint a Read:Write:Transfer key with: candle keys create --access read-write-transfer, or widen an existing key with: candle keys access <prefix> --access read-write-transfer", json);
+    writeUsageFailure(deps, "transfer:bound is not available on a device login. Mint a Withdraw key with: candle keys create --access withdraw, or widen an existing key with: candle keys access <prefix> --access withdraw", json);
     return 2;
   }
   const label = parsed.values["--label"]?.trim();
@@ -53460,7 +53521,7 @@ var HELP = {
   transfer: {
     group: "Trade",
     summary: "Move funds out of a TEE wallet to your own wallets or its vault, through its bound key",
-    description: "Moves one asset out of a TEE wallet this machine can sign for. The bound key must be a Read:Write:Transfer key (transfer:bound); from that wallet, Candle allows only its own pinned vault or another of the account's wallets you linked while signed in or marked trusted. To a linked wallet the amount counts against the key's spend caps and must be a base asset; to the vault any token and max are allowed. Candle builds the transaction, this machine approves the relay, Privy signs, Candle broadcasts. The destination and its kind are shown before you confirm. The asset decides the chain: ETH, USDG or --token is Hood, from a Hood TEE wallet, where this machine checks the one leg moves exactly what you confirmed before it is signed, and ETH max leaves the gas reserve.",
+    description: "Moves one asset out of a TEE wallet this machine can sign for. The bound key must be a Withdraw key (transfer:bound); from that wallet, Candle allows only its own pinned vault or another of the account's wallets you linked while signed in or marked trusted. To a linked wallet the amount counts against the key's spend caps and must be a base asset; to the vault any token and max are allowed. Candle builds the transaction, this machine approves the relay, Privy signs, Candle broadcasts. The destination and its kind are shown before you confirm. The asset decides the chain: ETH, USDG or --token is Hood, from a Hood TEE wallet, where this machine checks the one leg moves exactly what you confirmed before it is signed, and ETH max leaves the gas reserve.",
     usage: [
       "candle transfer --to <address|wallet name|vault> --asset <SOL|USDC|CNDL|ETH|USDG>|--mint <mint>|--token <0x...> --amount <decimal|max> [--wallet <tee>] [--yes] [--json]"
     ],
@@ -53578,14 +53639,14 @@ var HELP = {
     rows: [
       {
         invocation: "list [--scopes]",
-        description: "List API keys: name and Read, Read:Write or Read:Write:Transfer access; --scopes adds the raw scopes"
+        description: "List API keys: name and Read, Write or Withdraw access; --scopes adds the raw scopes"
       },
       {
-        invocation: "create [--access read|read-write|read-write-transfer | --scopes <a,b,c>] [--label <name>] [--expires-in <days>] [--tx-limit <usd> [--reset daily|weekly|monthly|never]] [--embedded-wallet deny|allow]",
-        description: "Create an API key; --access mints one of the three levels (read-write-transfer can move funds out of the wallet it runs). --embedded-wallet defaults to deny; allow lets the key spend the account's embedded wallet and is confirmed at a terminal"
+        invocation: "create [--access read|write|withdraw | --scopes <a,b,c>] [--label <name>] [--expires-in <days>] [--tx-limit <usd> [--reset daily|weekly|monthly|never]] [--embedded-wallet deny|allow]",
+        description: "Create an API key; --access mints one of the three levels (withdraw can move funds out of the wallet it runs). --embedded-wallet defaults to deny; allow lets the key spend the account's embedded wallet and is confirmed at a terminal"
       },
       {
-        invocation: "access <prefix|label|self> (--access read|read-write|read-write-transfer [--yes] | --history)",
+        invocation: "access <prefix|label|self> (--access read|write|withdraw [--yes] | --history)",
         description: "Change an existing key's level in place (same key, wallets and caps). Widening needs the device token and the prefix typed back at a terminal; --yes skips the prompt when narrowing; self narrows the profile's own key. --history lists the key's changes and who made them"
       },
       {
@@ -53620,9 +53681,9 @@ var HELP = {
     ],
     examples: [
       "candle keys list",
-      "candle keys create --access read-write-transfer --label rebalancer",
+      "candle keys create --access withdraw --label rebalancer",
       "candle keys create --scopes trade:write --label agent-one",
-      "candle keys access cndl --access read-write-transfer",
+      "candle keys access cndl --access withdraw",
       "candle keys access self --access read --yes",
       "candle keys update agent-one --embedded-wallet deny --yes",
       "candle keys self embedded-wallet deny",
@@ -59415,10 +59476,14 @@ init_promote_support();
 init_keys();
 init_tee_rebind();
 var KEYS_PATH4 = "/api/v1/agent/keys";
-var USAGE_ACCESS = `Usage: candle keys access <prefix|label|self> --access <read|read-write|read-write-transfer> [--yes] [--json]
+var USAGE_ACCESS = `Usage: candle keys access <prefix|label|self> --access <read|write|withdraw> [--yes] [--json]
 ` + "       candle keys access <prefix|label> --history [--json]";
 var SELF = "self";
-var CLI_SPELLING = Object.fromEntries(Object.entries(ACCESS_LEVELS).map(([spelling, preset]) => [preset, spelling]));
+var CLI_SPELLING = {
+  read: "read",
+  readwrite: "write",
+  readwritetransfer: "withdraw"
+};
 var NO_API_KEY2 = {
   code: "API_KEY_REQUIRED",
   message: "candle keys access self changes the profile's own API key, and this profile holds none.",
@@ -59563,7 +59628,7 @@ async function keysAccess(args, ctx) {
   }
   const preset = ACCESS_LEVELS[accessFlag];
   if (preset === undefined) {
-    writeUsageFailure(deps, `--access must be one of: ${Object.keys(ACCESS_LEVELS).join(", ")}.`, json);
+    writeUsageFailure(deps, "--access must be one of: read, write, withdraw.", json);
     return 2;
   }
   await printIdentity(ctx);
@@ -62384,7 +62449,7 @@ async function pnl(args, ctx) {
       writeLocalFailure(deps, {
         code: "SCOPE_MISSING",
         message: "The account's P&L needs a key with the Read scope (account:read); this profile's key has none.",
-        suggestion: "Log in with a Read or Read:Write key, or read this key's own P&L: candle pnl --profile <name>"
+        suggestion: "Log in with a Read or Write key, or read this key's own P&L: candle pnl --profile <name>"
       }, json);
       return 1;
     }
@@ -64381,7 +64446,7 @@ async function transfer(args, ctx) {
     if (payer.kind === "embedded")
       throw new TradingError("PAYER_UNSUPPORTED", "This command moves a linked wallet this machine can sign for. The embedded wallet transfers through the agent transfer rail (MCP candle_transfer), not from here. Name a TEE wallet with --wallet.");
     if (!payer.scopes.includes("transfer:bound"))
-      throw new TradingError("SCOPE_MISSING", `Moving funds out of a TEE wallet needs a Read:Write:Transfer key. Widen the bound key with: candle keys access ${apiKeyPrefix(key) ?? "<bound prefix>"} --access read-write-transfer. Or mint one with: candle keys create --access read-write-transfer, then bind the wallet to it with: candle tee rebind`);
+      throw new TradingError("SCOPE_MISSING", `Moving funds out of a TEE wallet needs a Withdraw key. Widen the bound key with: candle keys access ${apiKeyPrefix(key) ?? "<bound prefix>"} --access withdraw. Or mint one with: candle keys create --access withdraw, then bind the wallet to it with: candle tee rebind`);
     const wallet = payer.wallet;
     const destination = await resolveDestination(ctx, key, wallet, to);
     const label = asset ?? flags["--mint"];
@@ -64453,7 +64518,7 @@ async function hoodTransfer(ctx, args) {
   if (payer.kind === "embedded")
     throw new TradingError("PAYER_UNSUPPORTED", "This command moves a linked wallet this machine can sign for. The embedded wallet transfers through the agent transfer rail (MCP candle_transfer), not from here. Name a Hood TEE wallet with --wallet.");
   if (!payer.scopes.includes("transfer:bound"))
-    throw new TradingError("SCOPE_MISSING", `Moving funds out of a TEE wallet needs a Read:Write:Transfer key. Widen the bound key with: candle keys access ${apiKeyPrefix(key) ?? "<bound prefix>"} --access read-write-transfer. Or mint one with: candle keys create --access read-write-transfer, then bind the wallet to it with: candle tee rebind`);
+    throw new TradingError("SCOPE_MISSING", `Moving funds out of a TEE wallet needs a Withdraw key. Widen the bound key with: candle keys access ${apiKeyPrefix(key) ?? "<bound prefix>"} --access withdraw. Or mint one with: candle keys create --access withdraw, then bind the wallet to it with: candle tee rebind`);
   const wallet = payer.wallet;
   const destination = await resolveDestination(ctx, key, wallet, to, "hood");
   const decimals = asset ? HOOD_BASES[asset]?.decimals ?? 18 : await hoodDecimals({ chain: "hood", asset: tokenAddress }, lazyEvmRpc(ctx, flags["--rpc-url"]));
@@ -65817,10 +65882,10 @@ function recordCopyLine(outcome) {
 // src/commands/vault-demote.ts
 init_args();
 init_render();
+init_solana_endpoint();
 init_errors();
 init_promote_support();
 init_reconcile_grant();
-init_store();
 init_tee_resolve();
 init_tee();
 init_tee_evm();
@@ -65839,7 +65904,6 @@ async function vaultDemote(args, ctx) {
   if (!address || extra !== undefined) {
     return usage(ctx, "Usage: candle vault demote <tee-address> [--rpc-url <url>] [--emergency] [--sweep-to <label>]");
   }
-  const rpcUrl = parsed.values["--rpc-url"];
   if (!refuseEnvPassphrase(ctx))
     return 1;
   if (!requireTty(ctx, "vault demote"))
@@ -65850,6 +65914,9 @@ async function vaultDemote(args, ctx) {
   const path = resolvedVault.path;
   const emergency = parsed.booleans.has("--emergency");
   const sweepTo = parsed.values["--sweep-to"];
+  const solana = await openSolanaClient(ctx, parsed.values["--rpc-url"]);
+  if ("error" in solana)
+    return usage(ctx, solana.error);
   const resolved = await resolveTeeAddress(ctx, parsed, address, async () => ({
     ok: false,
     code: 1
@@ -65872,49 +65939,33 @@ async function vaultDemote(args, ctx) {
     }, ctx.json);
     return 1;
   }
-  let released = false;
+  const vaultResolved = resolved.resolved;
   try {
-    const vaultResolved = resolved.resolved;
     const reconciled = await maybeReconcileVaultTee(ctx, vaultResolved, "demote");
     if (reconciled.code !== null)
       return reconciled.code;
     const entry = reconciled.entry;
+    const step = { resolved: vaultResolved, solana };
     if (entry.tee?.vaultDestination === undefined) {
       if (sweepTo === undefined) {
         throw new VaultError("GRANT_DESTINATION_UNRESOLVED", `${address} has no pinned vault destination.`, {
           suggestion: "Pass --sweep-to <vault-key-label> (subject to the recovery destination rule), or adopt the server's pin."
         });
       }
-      releaseResolvedTee(resolved.resolved);
-      released = true;
-      return await runVaultCommand(ctx, async ({ hold }) => {
-        const raw = await requireVaultRaw(ctx, resolvedVault);
-        const opened = await unlockInteractively(ctx, path, raw, {
-          acceptOlderCopy: parsed.booleans.has("--accept-older-copy")
-        });
-        const vault = hold(opened.vault);
-        const destination = assertColdVaultDestination(vault.index, sweepTo, {});
-        await commitVault(vault, {
-          index: {
-            hd: vault.index.hd,
-            entries: vault.index.entries.map((e) => e.address === address ? {
-              ...e,
-              tee: {
-                ...e.tee ?? { network: "solana-mainnet", lifecycle: "local-candidate" },
-                vaultDestination: destination.address
-              }
-            } : e)
-          }
-        }, ctx.deps);
-        return demoteWithAdapter(ctx, { linkedWalletId: entry.linkedWalletId }, address, rpcUrl, true);
+      await assertNotOlderCopy(ctx, path, vaultResolved.vault.raw, parsed.booleans.has("--accept-older-copy"));
+      const destination = assertColdVaultDestination(vaultResolved.vault.index, sweepTo, {});
+      const next = await commitVaultTeeEntry(ctx, vaultResolved.vault, entry.id, (target) => {
+        target.tee = {
+          ...target.tee ?? { network: "solana-mainnet", lifecycle: "local-candidate" },
+          vaultDestination: destination.address
+        };
       });
+      applyVault(vaultResolved, next);
+      return await demoteWithAdapter(ctx, step, address, parsed.values["--rpc-url"], true);
     }
     requireTeeDestination(entry);
     const needsEmergency = emergency || entry.linkedWalletId === undefined || entry.tee?.lifecycle === "stranded";
-    const snapshot = { linkedWalletId: entry.linkedWalletId };
-    releaseResolvedTee(resolved.resolved);
-    released = true;
-    return demoteWithAdapter(ctx, snapshot, address, rpcUrl, needsEmergency);
+    return await demoteWithAdapter(ctx, step, address, parsed.values["--rpc-url"], needsEmergency);
   } catch (error) {
     if (error instanceof VaultError) {
       writeLocalFailure(ctx.deps, {
@@ -65926,23 +65977,39 @@ async function vaultDemote(args, ctx) {
     }
     throw error;
   } finally {
-    if (!released)
-      releaseResolvedTee(resolved.resolved);
+    releaseResolvedTee(vaultResolved);
   }
 }
-async function demoteWithAdapter(ctx, entry, address, rpcUrl, emergency) {
-  if (entry.linkedWalletId !== undefined) {
-    const disableCode = await teeDisable([address], ctx);
+async function demoteWithAdapter(ctx, step, address, rpcUrl, emergency) {
+  const linkedWalletId = step.resolved.entry.linkedWalletId;
+  let disableCode = null;
+  if (linkedWalletId !== undefined) {
+    disableCode = await teeDisable([address], ctx, step);
     if (disableCode !== 0 && disableCode !== 3 && !emergency)
       return disableCode;
   } else {
     ctx.deps.stdout.write(`No linkedWalletId is recorded for ${address}; the grant could not be identified, so disable was not called and remote authority stays unknown.
 `);
   }
+  const destination = step.resolved.entry.tee?.vaultDestination;
+  if (await nothingLeftToSweep(step.solana, step.resolved.entry)) {
+    const code = disableCode === 0 ? 0 : 3;
+    if (ctx.json) {
+      ctx.deps.stdout.write(`${JSON.stringify({ address, vaultDestination: destination, swept: false, nothingToSweep: true, lamports: "0", tokenAccounts: 0 })}
+`);
+    } else {
+      ctx.deps.stdout.write(`Nothing to sweep: 0 SOL, 0 token accounts.
+`);
+    }
+    return code;
+  }
+  if (!ctx.json)
+    ctx.deps.stdout.write(`Sweeping remaining funds to ${destination}...
+`);
   const sweepArgs = rpcUrl === undefined ? [address] : [address, "--rpc-url", rpcUrl];
-  if (emergency || entry.linkedWalletId === undefined)
+  if (emergency || linkedWalletId === undefined)
     sweepArgs.push("--emergency");
-  return teeSweep(sweepArgs, ctx);
+  return teeSweep(sweepArgs, ctx, step);
 }
 
 // src/commands/vault-export-key.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@candledottv/cli",
-  "version": "0.11.17",
+  "version": "0.11.18",
   "description": "The Candle CLI: authorize a device from your browser, then manage API keys, wallets, and setup health from the terminal",
   "type": "module",
   "bin": {