@candledottv/cli 0.11.31 → 0.11.32

package/dist/index.js

@@ -10972,6 +10972,7 @@ var init_errors2 = __esm(() => {
     "EVM_RECIPIENT_IS_TOKEN",
     "EVM_TRANSFER_REVERTED",
     "TRANSFER_CHAIN_MISMATCH",
+    "TRANSFER_INSUFFICIENT_FUNDS",
     "SOLANA_COMMAND_EVM_KEY",
     "RPC_RATE_LIMITED",
     "EVM_RECORD_ENTRY_TOO_LONG",
@@ -17577,6 +17578,7 @@ function parseMintAccount(mint, owner, data) {
     tokenProgram: owner,
     token2022: owner === TOKEN_2022_PROGRAM_ID,
     decimals,
+    associatedTokenAccountSize: owner === TOKEN_2022_PROGRAM_ID ? TLV_START + 4 : ACCOUNT_TYPE_OFFSET2,
     nonTransferable: false,
     defaultFrozen: false,
     paused: false,
@@ -17601,6 +17603,7 @@ function parseMintAccount(mint, owner, data) {
       throw new MintReadError(`${mint} has an invalid mint extension length or a duplicate extension`);
     }
     seen.add(type);
+    profile.associatedTokenAccountSize += REQUIRED_ACCOUNT_TLV_SIZE.get(type) ?? 0;
     const requireLength = (expected) => {
       if (length !== expected)
         throw new MintReadError(`${mint} has an invalid extension ${type} length`);
@@ -17890,11 +17893,17 @@ function classifyTokenSendFailure(input) {
     return "TOKEN_2022_HOOK_REFUSED";
   return;
 }
-var MintReadError, MINT_DECIMALS_OFFSET = 44, MINT_IS_INITIALIZED_OFFSET = 45, MINT_BASE_SIZE2 = 82, ACCOUNT_TYPE_OFFSET2 = 165, TLV_START = 166, MULTISIG_SIZE2 = 355, EXT_TRANSFER_FEE_CONFIG = 1, EXT_DEFAULT_ACCOUNT_STATE = 6, EXT_NON_TRANSFERABLE = 9, EXT_PERMANENT_DELEGATE = 12, EXT_TRANSFER_HOOK = 14, EXT_PAUSABLE = 26, EXECUTE_DISCRIMINATOR, EXTRA_ACCOUNT_METAS_SEED, EXTRA_ACCOUNT_META_SIZE = 35, HookResolutionError;
+var MintReadError, MINT_DECIMALS_OFFSET = 44, MINT_IS_INITIALIZED_OFFSET = 45, MINT_BASE_SIZE2 = 82, ACCOUNT_TYPE_OFFSET2 = 165, TLV_START = 166, MULTISIG_SIZE2 = 355, EXT_TRANSFER_FEE_CONFIG = 1, EXT_DEFAULT_ACCOUNT_STATE = 6, EXT_NON_TRANSFERABLE = 9, EXT_PERMANENT_DELEGATE = 12, EXT_TRANSFER_HOOK = 14, EXT_PAUSABLE = 26, REQUIRED_ACCOUNT_TLV_SIZE, EXECUTE_DISCRIMINATOR, EXTRA_ACCOUNT_METAS_SEED, EXTRA_ACCOUNT_META_SIZE = 35, HookResolutionError;
 var init_token_2022 = __esm(() => {
   init_solana_lite();
   MintReadError = class MintReadError extends Error {
   };
+  REQUIRED_ACCOUNT_TLV_SIZE = new Map([
+    [EXT_TRANSFER_FEE_CONFIG, 4 + 8],
+    [EXT_NON_TRANSFERABLE, 4],
+    [EXT_TRANSFER_HOOK, 4 + 1],
+    [EXT_PAUSABLE, 4]
+  ]);
   EXECUTE_DISCRIMINATOR = new Uint8Array([105, 37, 101, 197, 75, 251, 102, 26]);
   EXTRA_ACCOUNT_METAS_SEED = new TextEncoder().encode("extra-account-metas");
   HookResolutionError = class HookResolutionError extends Error {
@@ -19194,6 +19203,12 @@ function describeBiometry(report) {
         suggestion: "Unlock the Mac with its password to reset Touch ID, then retry. Nothing was written and no other factor is substituted."
       };
     case "not-interactive":
+      if (report.laError?.name === "systemCancel") {
+        return {
+          message: `Touch ID did not complete${la}: ${SYSTEM_CANCEL_WORDS}${reason}. This Mac ${report.biometryType && report.biometryType !== "none" ? `has ${biometryTypeWord(report.biometryType)}` : "may have Touch ID"}.`,
+          suggestion: SYSTEM_CANCEL_SUGGESTION
+        };
+      }
       return {
         message: `Touch ID is not available from this session${la}: this Mac ${report.biometryType && report.biometryType !== "none" ? `has ${biometryTypeWord(report.biometryType)}, but` : "may have Touch ID, but"} no prompt can be shown to a process outside the interactive login session (SSH, a background agent, the lid closed with no display)${reason}.`,
         suggestion: NOT_INTERACTIVE_SUGGESTION
@@ -19256,6 +19271,11 @@ function translateEnclaveFailure(code, message) {
     DOMAIN_NOT_ASSOCIATED: `macOS did not associate the helper with cli.candle.tv: ${message}. ${AASA_REQUIREMENT}`,
     NO_CREDENTIAL: `No synced passkey with this envelope's credential id is available to this Mac or this Apple account: ${message}.`
   };
+  if (code === "NOT_INTERACTIVE" && /\bsystemCancel\b/.test(message)) {
+    return new VaultError("VAULT_FACTOR_UNAVAILABLE", `Touch ID did not complete: ${SYSTEM_CANCEL_WORDS}: ${message}.`, {
+      suggestion: SYSTEM_CANCEL_SUGGESTION
+    });
+  }
   const suggestion = {
     BIOMETRY_UNAVAILABLE: "Open the lid, or use a keyboard with Touch ID, or unlock the Mac with its password first. Nothing was derived and no other factor was tried; the passphrase still opens the vault.",
     NOT_INTERACTIVE: NOT_INTERACTIVE_SUGGESTION,
@@ -19470,7 +19490,7 @@ async function deleteEnclaveKey(deps, session, opts) {
     return false;
   }
 }
-var ENCLAVE_HELPER_ENV = "CANDLE_ENCLAVE_HELPER", CODESIGN_PATH = "/usr/bin/codesign", ENCLAVE_HELPER_TIMEOUT_MS = 120000, CODESIGN_TIMEOUT_MS = 30000, AASA_URL = "https://cli.candle.tv/.well-known/apple-app-site-association", AASA_REQUIREMENT, ENCLAVE_INSTALL_SUGGESTION = "Install a release build of the CLI that ships the signed helper (the darwin tarball and Homebrew place candle-enclave.app beside candle), or set CANDLE_ENCLAVE_HELPER to the path of a signed candle-enclave.app. No other factor is substituted.", NOT_INTERACTIVE_SUGGESTION = "Run the command from a Terminal window inside the logged-in session on that Mac (not over SSH, not from a background agent, not with the lid closed and no display), then retry. Nothing was derived and no other factor is substituted; the passphrase still opens the vault.";
+var ENCLAVE_HELPER_ENV = "CANDLE_ENCLAVE_HELPER", CODESIGN_PATH = "/usr/bin/codesign", ENCLAVE_HELPER_TIMEOUT_MS = 120000, CODESIGN_TIMEOUT_MS = 30000, AASA_URL = "https://cli.candle.tv/.well-known/apple-app-site-association", AASA_REQUIREMENT, ENCLAVE_INSTALL_SUGGESTION = "Install a release build of the CLI that ships the signed helper (the darwin tarball and Homebrew place candle-enclave.app beside candle), or set CANDLE_ENCLAVE_HELPER to the path of a signed candle-enclave.app. No other factor is substituted.", NOT_INTERACTIVE_SUGGESTION = "Run the command from a Terminal window inside the logged-in session on that Mac (not over SSH, not from a background agent, not with the lid closed and no display), then retry. Nothing was derived and no other factor is substituted; the passphrase still opens the vault.", SYSTEM_CANCEL_SUGGESTION = "Retry with the Terminal window in front, and leave it in front until the prompt is answered. If it is cancelled again, run the command from a Terminal window inside the logged-in session on that Mac (not over SSH, not from a background agent, not with the lid closed and no display). Nothing was derived and no other factor is substituted; the passphrase still opens the vault.", SYSTEM_CANCEL_WORDS = "the system cancelled the prompt (for example another window took focus, or this is not the logged-in session: SSH, a background agent, the lid closed with no display)";
 var init_enclave = __esm(() => {
   init_sha256();
   init_esm();
@@ -28207,6 +28227,7 @@ __export(exports_vault_support, {
   requireVaultRaw: () => requireVaultRaw,
   requireTty: () => requireTty,
   requirePromptStreams: () => requirePromptStreams,
+  refusePromptsWithoutTerminal: () => refusePromptsWithoutTerminal,
   refuseEnvPassphrase: () => refuseEnvPassphrase,
   openWithTypedPassphrase: () => openWithTypedPassphrase,
   nonDefaultVaultFooter: () => nonDefaultVaultFooter,
@@ -28261,6 +28282,16 @@ function requirePromptStreams(ctx, what) {
   writeVaultFailure(ctx, new VaultError("VAULT_UNLOCK_FAILED", `${what} needs a terminal for the passphrase prompt: standard input and standard error must both be a terminal. Standard output may be redirected; that is where the listing goes.`));
   return false;
 }
+function refusePromptsWithoutTerminal(ctx, what) {
+  if (ctx.deps.isTTY.stdin && ctx.deps.isTTY.stderr)
+    return ctx;
+  const refuse2 = async () => {
+    throw new VaultError("VAULT_UNLOCK_FAILED", `${what} needs a terminal here: this unlock reads a vault passphrase, a security key PIN or a choice from a prompt, and standard input and standard error must both be a terminal for that. Standard output may be redirected.`, {
+      suggestion: "Run it from a terminal, or pass --factor touch-id or --factor passkey to unlock with a factor that reads no prompt. No environment variable or flag supplies a passphrase or PIN."
+    });
+  };
+  return { ...ctx, deps: { ...ctx.deps, promptSecret: refuse2, promptLine: refuse2 } };
+}
 function vaultPathFor(ctx, parsed) {
   const flag = parsed.values["--keystore"];
   if (flag !== undefined)
@@ -45684,7 +45715,7 @@ __export(exports_util, {
   joinValues: () => joinValues,
   issue: () => issue,
   isPlainObject: () => isPlainObject,
-  isObject: () => isObject,
+  isObject: () => isObject2,
   hexToUint8Array: () => hexToUint8Array,
   getSizableOrigin: () => getSizableOrigin,
   getParsedType: () => getParsedType3,
@@ -45851,11 +45882,11 @@ function esc(str) {
 function slugify(input) {
   return input.toLowerCase().trim().replace(/[^\w\s-]/g, "").replace(/[\s_-]+/g, "-").replace(/^-+|-+$/g, "");
 }
-function isObject(data) {
+function isObject2(data) {
   return typeof data === "object" && data !== null && !Array.isArray(data);
 }
 function isPlainObject(o) {
-  if (isObject(o) === false)
+  if (isObject2(o) === false)
     return false;
   const ctor = o.constructor;
   if (ctor === undefined)
@@ -45863,7 +45894,7 @@ function isPlainObject(o) {
   if (typeof ctor !== "function")
     return true;
   const prot = ctor.prototype;
-  if (isObject(prot) === false)
+  if (isObject2(prot) === false)
     return false;
   if (Object.prototype.hasOwnProperty.call(prot, "isPrototypeOf") === false) {
     return false;
@@ -47744,13 +47775,13 @@ var init_schemas = __esm(() => {
       }
       return propValues;
     });
-    const isObject2 = isObject;
+    const isObject3 = isObject2;
     const catchall = def.catchall;
     let value;
     inst._zod.parse = (payload, ctx) => {
       value ?? (value = _normalized.value);
       const input = payload.value;
-      if (!isObject2(input)) {
+      if (!isObject3(input)) {
         payload.issues.push({
           expected: "object",
           code: "invalid_type",
@@ -47848,7 +47879,7 @@ var init_schemas = __esm(() => {
       return (payload, ctx) => fn(shape, payload, ctx);
     };
     let fastpass;
-    const isObject2 = isObject;
+    const isObject3 = isObject2;
     const jit = !globalConfig.jitless;
     const allowsEval2 = allowsEval;
     const fastEnabled = jit && allowsEval2.value;
@@ -47857,7 +47888,7 @@ var init_schemas = __esm(() => {
     inst._zod.parse = (payload, ctx) => {
       value ?? (value = _normalized.value);
       const input = payload.value;
-      if (!isObject2(input)) {
+      if (!isObject3(input)) {
         payload.issues.push({
           expected: "object",
           code: "invalid_type",
@@ -47961,7 +47992,7 @@ var init_schemas = __esm(() => {
     });
     inst._zod.parse = (payload, ctx) => {
       const input = payload.value;
-      if (!isObject(input)) {
+      if (!isObject2(input)) {
         payload.issues.push({
           code: "invalid_type",
           expected: "object",
@@ -62370,7 +62401,7 @@ var init_image = __esm(() => {
 });
 
 // ../mcp/src/orchestrate.ts
-import { randomUUID as randomUUID7 } from "node:crypto";
+import { randomUUID as randomUUID8 } from "node:crypto";
 function requireApiKey(cfg) {
   if (!cfg.apiKey) {
     throw new Error("CANDLE_AGENT_API_KEY is required for this tool. Set it in the environment or MCP client config.");
@@ -62483,7 +62514,7 @@ async function readPaperInventory(cfg, doFetch, extra) {
 }
 async function executeTrade(args, cfg, doFetch) {
   const apiKey = requireApiKey(cfg);
-  const clientTradeId = args.clientTradeId ?? randomUUID7();
+  const clientTradeId = args.clientTradeId ?? randomUUID8();
   if (args.amount !== undefined && args.percent !== undefined) {
     return errText("pass exactly one of amount or percent, not both", { clientTradeId });
   }
@@ -62621,7 +62652,7 @@ async function executeTrade(args, cfg, doFetch) {
 }
 async function executeLaunchAndSeed(args, cfg, doFetch, imageDir, imageFs) {
   const apiKey = requireApiKey(cfg);
-  const clientLaunchId = args.clientLaunchId ?? randomUUID7();
+  const clientLaunchId = args.clientLaunchId ?? randomUUID8();
   const { devBuy, dryRun, buyAmount: _rawBuyAmount, ...imageFields } = args;
   let buyAmount;
   if (devBuy !== undefined) {
@@ -63169,7 +63200,7 @@ function checkOrderMarket2(action, intent, market) {
 function verifyPerpsBuild2(build, opts) {
   try {
     const network2 = opts.network ?? "mainnet";
-    if (!EVM_ADDRESS_RE2.test(opts.builder))
+    if (!EVM_ADDRESS_RE3.test(opts.builder))
       return { ok: false, reason: "no valid Candle builder address to check against" };
     if (build.network !== undefined && build.network !== network2) {
       return { ok: false, reason: `the build is for ${build.network}, this client trades ${network2}` };
@@ -63257,7 +63288,7 @@ function hyperliquidExchangeBody2(action, nonce, signature) {
 function hyperliquidRelayBody2(typedData) {
   return { method: "eth_signTypedData_v4", params: { typed_data: typedData } };
 }
-var HYPERLIQUID_ALLOWED_ACTION_TYPES2, HYPERLIQUID_EXCHANGE_URLS2, HYPERLIQUID_INFO_URLS2, CANDLE_HYPERLIQUID_BUILDER_ADDRESS2 = null, HYPERLIQUID_MAX_BUILDER_FEE_TENTHS_BPS2 = 100, HYPERLIQUID_MAX_BUILDER_FEE_RATE2 = "0.1%", HYPERLIQUID_SIGNATURE_CHAIN_ID2 = "0xa4b1", ZERO_ADDRESS2 = "0x0000000000000000000000000000000000000000", UINT64_MAX2, INT64_MIN2, EVM_ADDRESS_RE2, HYPERLIQUID_DEFAULT_SLIPPAGE_BPS2 = 100, HYPERLIQUID_MID_DRIFT_BPS2 = 100, HYPERLIQUID_TPSL_SLIPPAGE_BPS2 = 500;
+var HYPERLIQUID_ALLOWED_ACTION_TYPES2, HYPERLIQUID_EXCHANGE_URLS2, HYPERLIQUID_INFO_URLS2, CANDLE_HYPERLIQUID_BUILDER_ADDRESS2 = null, HYPERLIQUID_MAX_BUILDER_FEE_TENTHS_BPS2 = 100, HYPERLIQUID_MAX_BUILDER_FEE_RATE2 = "0.1%", HYPERLIQUID_SIGNATURE_CHAIN_ID2 = "0xa4b1", ZERO_ADDRESS2 = "0x0000000000000000000000000000000000000000", UINT64_MAX2, INT64_MIN2, EVM_ADDRESS_RE3, HYPERLIQUID_DEFAULT_SLIPPAGE_BPS2 = 100, HYPERLIQUID_MID_DRIFT_BPS2 = 100, HYPERLIQUID_TPSL_SLIPPAGE_BPS2 = 500;
 var init_hyperliquid = __esm(() => {
   init_sha3();
   HYPERLIQUID_ALLOWED_ACTION_TYPES2 = [
@@ -63277,7 +63308,7 @@ var init_hyperliquid = __esm(() => {
   };
   UINT64_MAX2 = (1n << 64n) - 1n;
   INT64_MIN2 = -(1n << 63n);
-  EVM_ADDRESS_RE2 = /^0x[0-9a-fA-F]{40}$/;
+  EVM_ADDRESS_RE3 = /^0x[0-9a-fA-F]{40}$/;
 });
 
 // ../mcp/src/perps.ts
@@ -63764,7 +63795,7 @@ var init_plans = __esm(() => {
 });
 
 // ../mcp/src/tools.ts
-import { randomUUID as randomUUID8 } from "node:crypto";
+import { randomUUID as randomUUID9 } from "node:crypto";
 function resolveToolAllowlist(env) {
   const raw = env.CANDLE_MCP_TOOLS?.trim();
   if (!raw)
@@ -64096,7 +64127,7 @@ async function getOperation(args, cfg, doFetch) {
   };
 }
 async function swap2(args, cfg, doFetch) {
-  const clientSwapId = typeof args.clientSwapId === "string" && args.clientSwapId.length > 0 ? args.clientSwapId : randomUUID8();
+  const clientSwapId = typeof args.clientSwapId === "string" && args.clientSwapId.length > 0 ? args.clientSwapId : randomUUID9();
   const { url, init } = buildRequest("candle_swap", { ...args, clientSwapId }, cfg);
   let ok;
   let body;
@@ -65007,7 +65038,7 @@ init_render();
 init_secret_store();
 
 // src/version.ts
-var CLI_VERSION = "0.11.31";
+var CLI_VERSION = "0.11.32";
 
 // src/commands/auth.ts
 init_keys_embedded_wallet();
@@ -65438,6 +65469,10 @@ var ENVIRONMENT = [
     description: "candle perps: Candle's Hyperliquid builder address, pinned for the check every build passes before it is signed; without it the release's, else the one the server reports"
   },
   { name: "CANDLE_HYPERLIQUID_NETWORK", description: "candle perps: set to testnet to trade Hyperliquid testnet" },
+  {
+    name: "CANDLE_PERPS_WITHDRAW_PINS",
+    description: "candle perps withdraw: JSON {token, destinationDex, depositories, amountForm} pinning what every withdrawal is checked against before it is signed; this release ships none, so without it withdrawals are refused"
+  },
   { name: "CANDLE_NO_UPDATE_NOTIFIER", description: "Set to 1 to silence the update notice" },
   {
     name: "CANDLE_KEYSTORE_PASSPHRASE",
@@ -65626,8 +65661,8 @@ var HELP = {
   },
   perps: {
     group: "Trade",
-    summary: "Hyperliquid perpetuals from your EVM TEE wallet: setup, deposit, open, close, cancel, orders, positions, leverage",
-    description: "Trade perpetuals on Hyperliquid's main perp exchange from the EVM TEE wallet bound to this key (scope perps:write, opt-in). Candle builds each action within the key's limits; this machine recomputes its hash and checks the action type and Candle's builder before anything is signed, then Candle's relay signs and this machine submits to Hyperliquid. Every plan is eligible for perps, once the deployment has perps enabled. Every plan except Max pays Candle a builder fee on each order (0.1% today); Max pays none. candle plans shows the rate in force. Deposits move SOL, USDC, ETH or USDG onto the Hyperliquid account through Relay, and the account's P&L (candle pnl) carries a Hyperliquid section.",
+    summary: "Hyperliquid perpetuals from your EVM TEE wallet: setup, deposit, withdraw, open, close, cancel, orders, positions, leverage",
+    description: "Trade perpetuals on Hyperliquid's main perp exchange from the EVM TEE wallet bound to this key (scope perps:write, opt-in). Candle builds each action within the key's limits; this machine recomputes its hash and checks the action type and Candle's builder before anything is signed, then Candle's relay signs and this machine submits to Hyperliquid. Every plan is eligible for perps, once the deployment has perps enabled. Every plan except Max pays Candle a builder fee on each order (0.1% today); Max pays none. candle plans shows the rate in force. Deposits move SOL, USDC, ETH or USDG onto the Hyperliquid account through Relay; withdrawals move USDC back through Relay to the key's own Solana or Hood TEE wallet (scope perps:withdraw, opt-in, after one vault unlock and a typed confirm). The account's P&L (candle pnl) carries a Hyperliquid section.",
     usage: ["candle perps <subcommand> [flags]"],
     rows: [
       {
@@ -65648,7 +65683,14 @@ var HELP = {
         invocation: "orders [--wallet <tee>]",
         description: "Open orders on Hyperliquid, and every action Candle built"
       },
-      { invocation: "positions [--wallet <tee>]", description: "Positions and account value, read live" },
+      {
+        invocation: "withdraw <amount> --to solana|hood [--wallet <evm tee>] | withdraw status <id>",
+        description: "Move USDC from the Hyperliquid account to this key's own Solana or Hood TEE wallet through Relay (perps:withdraw); one vault unlock and a typed confirm, no --yes"
+      },
+      {
+        invocation: "positions [--wallet <tee>]",
+        description: "Positions, account value and withdrawable USDC, read live, and any withdrawal in flight"
+      },
       { invocation: "leverage <coin> <x> [--isolated]", description: "Set a market's leverage and margin mode" }
     ],
     flags: [
@@ -65666,7 +65708,8 @@ var HELP = {
         invocation: "--to <evm tee>",
         description: "deposit from Solana: the EVM TEE wallet whose account receives it"
       },
-      { invocation: "--id <clientDepositId>", description: "deposit: the idempotency id (default: a new one)" },
+      { invocation: "--id <id>", description: "deposit and withdraw: the idempotency id (default: a new one)" },
+      { invocation: "--keystore <path>", description: "withdraw: the vault whose unlock confirms the withdrawal" },
       { invocation: "--rpc-url <url>", description: "deposit from Solana: the RPC the deposit check reads" },
       { invocation: "--no-submit", description: "Build and check only; sign and submit nothing" },
       { invocation: "--sign-only", description: "Build, check and sign through the relay; submit nothing" },
@@ -65678,9 +65721,10 @@ var HELP = {
       "candle perps open BTC long 0.01",
       "candle perps open ETH short 0.5 --price 3200 --tp 2900 --sl 3400",
       "candle perps close BTC",
-      "candle perps leverage BTC 5 --isolated"
+      "candle perps leverage BTC 5 --isolated",
+      "candle perps withdraw 25 --to solana"
     ],
-    env: [...ENV_API, "CANDLE_HYPERLIQUID_BUILDER", "CANDLE_HYPERLIQUID_NETWORK"]
+    env: [...ENV_API, "CANDLE_HYPERLIQUID_BUILDER", "CANDLE_HYPERLIQUID_NETWORK", "CANDLE_PERPS_WITHDRAW_PINS"]
   },
   transfer: {
     group: "Trade",
@@ -74258,6 +74302,13 @@ async function perpsLeverage(args, ctx) {
     return tradingFailure(ctx, error);
   }
 }
+function formatUsdcMicros(value) {
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0)
+    return "?";
+  const micros = BigInt(value);
+  const frac = (micros % 1000000n).toString().padStart(6, "0").replace(/0+$/, "");
+  return frac ? `${micros / 1000000n}.${frac}` : `${micros / 1000000n}`;
+}
 async function perpsPositions(args, ctx) {
   const parsed = parseArgs(args, { valueFlags: ["--wallet"] });
   if ("error" in parsed)
@@ -74281,6 +74332,13 @@ async function perpsPositions(args, ctx) {
     for (const p of positions) {
       const leverage = p.leverage ?? {};
       out.write(`  ${safeText(p.coin)} ${safeText(p.szi)} at ${safeText(p.entryPx)}, value ${safeText(p.positionValue)}, uPnL ${safeText(p.unrealizedPnl)}, ${safeText(leverage.value)}x ${safeText(leverage.type)}, liq ${safeText(p.liquidationPx ?? "none")}
+`);
+    }
+    const open5 = Array.isArray(result.openWithdrawals) ? result.openWithdrawals : null;
+    out.write(`Withdrawable now: ${safeText(result.withdrawable)} USDC${open5 === null ? "" : open5.length === 0 ? "; no withdrawal in flight" : ""}.
+`);
+    for (const w of open5 ?? []) {
+      out.write(`  Withdrawal ${safeText(w.id)}: ${safeText(w.status)}, ${formatUsdcMicros(w.amountUsdcMicros)} USDC to ${safeText(w.to)} (candle perps withdraw status ${safeText(w.id)})
 `);
     }
     return 0;
@@ -74466,7 +74524,7 @@ async function perpsDeposit(args, ctx) {
 `);
     output.write(`Relay delivers at least ${minimum} USDC (estimate ${estimate2})${build.firstDeposit ? "; Hyperliquid keeps 1 USDC to activate this new account" : ""}. Candle fee: none.
 `);
-    output.write("There is no withdrawal from Hyperliquid in this release, and `candle tee disable` or `tee sweep` do not reach it.\n");
+    output.write("To bring it back: candle perps withdraw <amount> --to solana|hood (perps:withdraw). `candle tee disable` and `tee sweep` do not reach it, so withdraw before disabling.\n");
     if (sequenced)
       output.write(`Legs, signed one at a time: ${sequenced.plannedLegCount === 2 ? "approval, bridgeDeposit" : "bridgeDeposit"}
 `);
@@ -74520,6 +74578,382 @@ async function perpsDeposit(args, ctx) {
   }
 }
 
+// src/commands/perps-withdraw.ts
+init_args();
+import { randomUUID as randomUUID5 } from "node:crypto";
+
+// src/hyperliquid-withdraw.ts
+var CANDLE_PERPS_WITHDRAW_PINS = null;
+var RELAY_API_URL = "https://api.relay.link";
+var ZERO = "0x0000000000000000000000000000000000000000";
+var EVM_ADDRESS_RE2 = /^0x[0-9a-fA-F]{40}$/;
+var BYTES32_RE = /^0x[0-9a-fA-F]{64}$/;
+var RELAY_NONCE_MAPPING_TYPES = {
+  NonceMapping: [
+    { name: "chainId", type: "string" },
+    { name: "wallet", type: "address" },
+    { name: "depositor", type: "address" },
+    { name: "id", type: "bytes32" },
+    { name: "nonce", type: "uint256" }
+  ]
+};
+var HYPERLIQUID_SEND_ASSET_TYPES = {
+  "HyperliquidTransaction:SendAsset": [
+    { name: "hyperliquidChain", type: "string" },
+    { name: "destination", type: "string" },
+    { name: "sourceDex", type: "string" },
+    { name: "destinationDex", type: "string" },
+    { name: "token", type: "string" },
+    { name: "amount", type: "string" },
+    { name: "fromSubAccount", type: "string" },
+    { name: "nonce", type: "uint64" }
+  ]
+};
+var SEND_ASSET_KEYS = HYPERLIQUID_SEND_ASSET_TYPES["HyperliquidTransaction:SendAsset"].map((field) => field.name);
+var REQUEST_AMOUNT_RE = /^(0|[1-9][0-9]{0,11})(\.[0-9]{1,6})?$/;
+var CANONICAL_RE = /^(0|[1-9][0-9]*)(\.[0-9]{0,5}[1-9])?$/;
+var FIXED6_RE = /^(0|[1-9][0-9]*)\.[0-9]{6}$/;
+function parseWithdrawAmount(value) {
+  if (!REQUEST_AMOUNT_RE.test(value))
+    return null;
+  const [whole = "0", frac = ""] = value.split(".");
+  const micros = BigInt(whole) * 1000000n + BigInt(frac.padEnd(6, "0"));
+  return micros > 0n ? micros : null;
+}
+function formatWithdrawAmount(micros) {
+  const frac = (micros % 1000000n).toString().padStart(6, "0").replace(/0+$/, "");
+  return frac ? `${micros / 1000000n}.${frac}` : `${micros / 1000000n}`;
+}
+function parseSendAssetAmount(value, form) {
+  if (typeof value !== "string" || !(form === "canonical" ? CANONICAL_RE : FIXED6_RE).test(value))
+    return null;
+  const [whole = "0", frac = ""] = value.split(".");
+  if (frac.length > 6)
+    return null;
+  return BigInt(whole) * 1000000n + BigInt(frac.padEnd(6, "0"));
+}
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function exactKeys(value, keys) {
+  const own = Object.keys(value);
+  return own.length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+}
+function sameEvm(a, b) {
+  return typeof a === "string" && EVM_ADDRESS_RE2.test(a) && a.toLowerCase() === b.toLowerCase();
+}
+function typesMatch(types2, expected) {
+  if (!isObject(types2) || !exactKeys(types2, Object.keys(expected)))
+    return false;
+  return Object.entries(expected).every(([key, want]) => {
+    const fields = types2[key];
+    return Array.isArray(fields) && fields.length === want.length && fields.every((field, i) => isObject(field) && exactKeys(field, ["name", "type"]) && field.name === want[i]?.name && field.type === want[i]?.type);
+  });
+}
+function domainMatches(domain, expected) {
+  return isObject(domain) && exactKeys(domain, ["name", "version", "chainId", "verifyingContract"]) && domain.name === expected.name && domain.version === expected.version && domain.chainId === expected.chainId && typeof domain.verifyingContract === "string" && domain.verifyingContract.toLowerCase() === ZERO;
+}
+function verifyWithdrawMapping(build, expect) {
+  const refuse3 = (reason) => ({ ok: false, reason });
+  if (expect.pins === null)
+    return refuse3("the withdrawal pins are pending verification in this release");
+  if (build.id !== expect.id)
+    return refuse3("the build names another withdrawal id");
+  if (!sameEvm(build.from?.address, expect.account))
+    return refuse3("the build withdraws from another account");
+  if (build.to?.chain !== expect.to)
+    return refuse3(`the build lands on ${String(build.to?.chain)}, not ${expect.to}`);
+  const destination = build.to.address;
+  const own = expect.ownDestinations.some((address) => address.startsWith("0x") ? sameEvm(destination, address) : destination === address);
+  if (!own)
+    return refuse3("the build lands on a wallet that is not this key's own");
+  if (parseWithdrawAmount(build.amountUsdc) !== expect.amountMicros)
+    return refuse3("the build is for another amount");
+  const typed = build.typedData;
+  if (!isObject(typed) || typed.primary_type !== "NonceMapping")
+    return refuse3("the typed data is not a NonceMapping");
+  if (!domainMatches(typed.domain, { name: "RelayNonceMapping", version: "2", chainId: 1 }))
+    return refuse3("the NonceMapping domain is not Relay's");
+  if (!typesMatch(typed.types, RELAY_NONCE_MAPPING_TYPES))
+    return refuse3("the NonceMapping type list differs");
+  const message = typed.message;
+  if (!isObject(message) || !exactKeys(message, ["chainId", "wallet", "depositor", "id", "nonce"]))
+    return refuse3("the NonceMapping message has other fields");
+  if (message.chainId !== "hyperliquid")
+    return refuse3("the NonceMapping names another chain");
+  if (!sameEvm(message.wallet, expect.account))
+    return refuse3("the NonceMapping wallet is not this key's account");
+  if (!sameEvm(message.depositor, expect.account))
+    return refuse3("the NonceMapping depositor is not this key's account");
+  if (typeof message.id !== "string" || !BYTES32_RE.test(message.id) || message.id !== build.relayRequestId)
+    return refuse3("the NonceMapping names another Relay request");
+  if (message.nonce !== build.nonce || !Number.isSafeInteger(build.nonce) || build.nonce <= 0)
+    return refuse3("the NonceMapping nonce is not the build's");
+  return { ok: true };
+}
+function verifyWithdrawSendAsset(authorization, expect) {
+  const refuse3 = (reason) => ({ ok: false, reason });
+  const pins = expect.pins;
+  if (pins === null)
+    return refuse3("the withdrawal pins are pending verification in this release");
+  const typed = authorization.typedData;
+  if (!isObject(typed) || typed.primary_type !== "HyperliquidTransaction:SendAsset")
+    return refuse3("the typed data is not a SendAsset");
+  if (!domainMatches(typed.domain, { name: "HyperliquidSignTransaction", version: "1", chainId: 42161 }))
+    return refuse3("the SendAsset domain is not Hyperliquid's user-signed domain");
+  if (!typesMatch(typed.types, HYPERLIQUID_SEND_ASSET_TYPES))
+    return refuse3("the SendAsset type list differs");
+  const m = typed.message;
+  if (!isObject(m) || !exactKeys(m, SEND_ASSET_KEYS))
+    return refuse3("the SendAsset message has other fields");
+  if (m.hyperliquidChain !== "Mainnet")
+    return refuse3("the SendAsset is not on Mainnet");
+  if (m.nonce !== expect.mappingNonce || authorization.nonce !== expect.mappingNonce)
+    return refuse3("the SendAsset nonce is not the NonceMapping's");
+  if (parseSendAssetAmount(m.amount, pins.amountForm) !== expect.amountMicros)
+    return refuse3("the SendAsset amount is not the amount asked for");
+  if (m.fromSubAccount !== "")
+    return refuse3("the SendAsset moves from a sub-account");
+  if (m.sourceDex !== "")
+    return refuse3("the SendAsset moves from another dex");
+  if (m.token !== pins.token)
+    return refuse3("the SendAsset moves another token");
+  if (m.destinationDex !== pins.destinationDex)
+    return refuse3("the SendAsset names another destination dex");
+  if (typeof m.destination !== "string" || !pins.depositories.includes(m.destination.toLowerCase()))
+    return refuse3("the SendAsset destination is not a Relay depository on the allow-list");
+  const action = authorization.action;
+  if (!isObject(action) || !exactKeys(action, ["type", "signatureChainId", ...SEND_ASSET_KEYS]))
+    return refuse3("the action has other fields");
+  if (action.type !== "sendAsset" || action.signatureChainId !== "0xa4b1")
+    return refuse3("the action is not a sendAsset");
+  for (const key of SEND_ASSET_KEYS) {
+    if (action[key] !== m[key])
+      return refuse3(`the action's ${key} differs from what is signed`);
+  }
+  return { ok: true };
+}
+async function relayRecipientProblem(fetchImpl, requestId, recipient, relayUrl = RELAY_API_URL) {
+  let body;
+  try {
+    const res = await fetchImpl(`${relayUrl}/requests/v3?id=${encodeURIComponent(requestId)}`, { method: "GET" });
+    if (!res.ok)
+      return `Relay's record of the request could not be read (HTTP ${res.status})`;
+    body = await res.json();
+  } catch (error) {
+    return `Relay's record of the request could not be read (${error instanceof Error ? error.message : "unknown"})`;
+  }
+  const requests = isObject(body) && Array.isArray(body.requests) ? body.requests : [];
+  const match = requests.find((r) => isObject(r) && r.id === requestId);
+  if (!isObject(match))
+    return "Relay does not list this request";
+  const named = match.recipient;
+  const same = recipient.startsWith("0x") ? sameEvm(named, recipient) : named === recipient;
+  return same ? null : `Relay's request pays ${String(named)}, not this key's wallet ${recipient}`;
+}
+
+// src/commands/perps-withdraw.ts
+init_render();
+init_trading();
+init_errors2();
+init_store();
+init_swap();
+init_vault_support();
+var WITHDRAW_SCOPE = "perps:withdraw";
+var ID_RE = /^[A-Za-z0-9._:-]{1,128}$/;
+var USAGE5 = "Usage: candle perps withdraw <amount> --to solana|hood [--wallet <evm tee>] [--id <id>] [--keystore <path>] | candle perps withdraw status <id>";
+var WITHDRAW_POLL_MS = 10 * 60 * 1000;
+var WITHDRAW_POLL_INTERVAL_MS = 5000;
+var TERMINAL = new Set(["settled", "refunded", "failed"]);
+function usage5(ctx, line) {
+  writeUsageFailure(ctx.deps, line, ctx.json);
+  return 2;
+}
+function withdrawPins(env) {
+  const raw = env.CANDLE_PERPS_WITHDRAW_PINS;
+  if (raw === undefined || raw.trim() === "")
+    return CANDLE_PERPS_WITHDRAW_PINS;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new TradingError("INVALID_PINS", "CANDLE_PERPS_WITHDRAW_PINS is not JSON.");
+  }
+  const p = parsed;
+  if (typeof p !== "object" || p === null || typeof p.token !== "string" || typeof p.destinationDex !== "string" || !Array.isArray(p.depositories) || p.depositories.length === 0 || !p.depositories.every((d) => typeof d === "string" && /^0x[0-9a-fA-F]{40}$/.test(d)) || p.amountForm !== "canonical" && p.amountForm !== "fixed6") {
+    throw new TradingError("INVALID_PINS", "CANDLE_PERPS_WITHDRAW_PINS must be {token, destinationDex, depositories: [0x...], amountForm: canonical|fixed6}.");
+  }
+  return {
+    token: p.token,
+    destinationDex: p.destinationDex,
+    depositories: p.depositories.map((d) => d.toLowerCase()),
+    amountForm: p.amountForm
+  };
+}
+async function withdrawStatus(ctx, id) {
+  const key = await tradingKey(ctx);
+  const result = await perpsRequest(ctx, key, `/api/v1/agent/perps/withdraw/${encodeURIComponent(id)}`);
+  if (ctx.json)
+    return printTradingResult(ctx, result);
+  const to = result.to ?? {};
+  const relay = result.relay;
+  ctx.deps.stdout.write(`Withdrawal ${safeText(id)}: ${safeText(result.status)}, ${safeText(result.amountUsdc)} USDC to ${safeText(to.address)} (${safeText(to.chain)}), fees ${safeText(result.feesUsdc)} USDC${result.failureReason ? `, ${safeText(result.failureReason)}` : ""}. Relay: ${relay ? safeText(relay.status) : "not read"}.
+`);
+  return 0;
+}
+async function perpsWithdraw(args, ctx) {
+  if (args[0] === "status") {
+    if (args.length !== 2 || !ID_RE.test(args[1]))
+      return usage5(ctx, USAGE5);
+    try {
+      return await withdrawStatus(ctx, args[1]);
+    } catch (error) {
+      return tradingFailure(ctx, error);
+    }
+  }
+  if (args.includes("--yes") || args.includes("-y")) {
+    return usage5(ctx, "candle perps withdraw has no --yes: every withdrawal is confirmed at the terminal.");
+  }
+  const parsed = parseArgs(args, {
+    valueFlags: ["--to", "--wallet", "--id", "--keystore"],
+    pathFlags: ["--keystore"]
+  });
+  if ("error" in parsed)
+    return usage5(ctx, parsed.error);
+  const [amount] = parsed.positionals;
+  const to = parsed.values["--to"];
+  if (parsed.positionals.length !== 1 || !amount || to !== "solana" && to !== "hood")
+    return usage5(ctx, USAGE5);
+  const amountMicros = parseWithdrawAmount(amount);
+  if (amountMicros === null)
+    return usage5(ctx, "The amount must be a positive USDC decimal with at most 6 decimals.");
+  const id = parsed.values["--id"] ?? `withdraw-${randomUUID5()}`;
+  if (!ID_RE.test(id))
+    return usage5(ctx, "--id must be 1 to 128 letters, digits, '.', '_', ':' or '-'.");
+  if (!refuseEnvPassphrase(ctx))
+    return 1;
+  if (!requireTty(ctx, "perps withdraw"))
+    return 1;
+  const resolvedVault = vaultPathFor(ctx, parsed);
+  if ("error" in resolvedVault)
+    return usage5(ctx, resolvedVault.error);
+  try {
+    const pins = withdrawPins(ctx.deps.env);
+    if (pins === null) {
+      throw new TradingError("PERPS_WITHDRAW_UNVERIFIED", "Hyperliquid withdrawals wait on a recorded verification of Relay's quote shape in this release. Nothing was built.");
+    }
+    const key = await tradingKey(ctx);
+    const { wallet } = await perpsWallet(ctx, key, parsed.values["--wallet"], WITHDRAW_SCOPE);
+    if (!wallet)
+      throw new TradingError("TEE_WALLET_REQUIRED", "No EVM TEE wallet resolved.");
+    const { rows } = await listTradingWallets(ctx, key);
+    const ownDestinations = to === "hood" ? [wallet.address] : rows.filter((row) => row.chain === "solana").map((row) => row.address);
+    if (ownDestinations.length === 0)
+      throw new TradingError("TEE_WALLET_REQUIRED", "This key has no Solana TEE wallet, so --to solana has nowhere to land. Withdraw --to hood instead.");
+    ctx.deps.stderr.write(`Withdrawal: ${id}
+`);
+    const build = await perpsRequest(ctx, key, "/api/v1/agent/perps/withdraw", {
+      clientWithdrawalId: id,
+      amountUsdc: amount,
+      to,
+      wallet: wallet.id
+    });
+    if (build.status !== "quoted")
+      return printTradingResult(ctx, build);
+    const refused = (problem) => new TradingError("PERPS_BUILD_REFUSED", `Refused to sign this withdrawal: ${problem}. Nothing was signed.`);
+    const mapping = verifyWithdrawMapping(build, {
+      id,
+      account: wallet.address,
+      to,
+      amountMicros,
+      ownDestinations,
+      pins
+    });
+    if (!mapping.ok)
+      throw refused(mapping.reason);
+    const recipient = await relayRecipientProblem(ctx.deps.fetch, build.relayRequestId, build.to.address);
+    if (recipient)
+      throw refused(recipient);
+    const output = ctx.json ? ctx.deps.stderr : ctx.deps.stdout;
+    output.write(`Withdraw ${formatWithdrawAmount(amountMicros)} USDC from Hyperliquid account ${safeText(wallet.address)} through Relay.
+`);
+    output.write(`Relay fees ${safeText(build.feesUsdc)} USDC; you receive about ${safeText(build.netUsdc)} USDC, at least ${safeText(build.minimumOutUsdc)}.
+`);
+    output.write(`To this key's ${to === "hood" ? "Hood" : "Solana"} TEE wallet:
+`);
+    output.write(`to   ${groupAddress(build.to.address)}
+`);
+    const positions = await perpsRequest(ctx, key, `/api/v1/agent/perps/positions?walletId=${encodeURIComponent(wallet.id)}`).catch(() => null);
+    if (Array.isArray(positions?.positions) && positions.positions.length > 0)
+      output.write(`This account has open positions: withdrawing margin raises their liquidation risk.
+`);
+    const raw = await requireVaultRaw(ctx, resolvedVault);
+    const opened = await unlockInteractively(ctx, resolvedVault.path, raw, {
+      promptText: "Vault passphrase (input hidden): ",
+      reason: `withdraw ${formatWithdrawAmount(amountMicros)} USDC to ${build.to.address}`
+    });
+    closeVault(opened.vault);
+    const typed = await ctx.deps.promptLine(`Type confirm to withdraw ${formatWithdrawAmount(amountMicros)} USDC to ${build.to.address}: `);
+    if (typed.trim().toLowerCase() !== "confirm")
+      throw new TradingError("CANCELLED", "The withdrawal was not confirmed; nothing was signed.");
+    if (typeof build.expiresAt !== "number" || build.expiresAt <= ctx.deps.now())
+      throw new TradingError("QUOTE_EXPIRED", "The quote expired before signing. Start again with a new --id.");
+    const mappingSignature = await relaySignature(ctx, key, wallet, build.typedData);
+    const authorization = await perpsRequest(ctx, key, "/api/v1/agent/perps/withdraw/authorize", {
+      clientWithdrawalId: id,
+      signature: mappingSignature
+    });
+    const send = verifyWithdrawSendAsset(authorization, { mappingNonce: build.nonce, amountMicros, pins });
+    if (!send.ok)
+      throw new TradingError("PERPS_BUILD_REFUSED", `Refused to sign the transfer: ${send.reason}. The nonce mapping was posted; nothing can move without this signature.`);
+    const signature = await relaySignature(ctx, key, wallet, authorization.typedData);
+    const exchangeBody = hyperliquidExchangeBody(authorization.action, authorization.nonce, signature);
+    let exchange;
+    try {
+      const res = await ctx.deps.fetch(HYPERLIQUID_EXCHANGE_URLS.mainnet, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(exchangeBody)
+      });
+      const text = await res.text();
+      if (!res.ok)
+        throw new Error(`HTTP ${res.status}`);
+      exchange = JSON.parse(text);
+    } catch (error) {
+      throw new TradingError("PERPS_SUBMIT_FAILED", `Signed, but the submit to Hyperliquid failed (${error instanceof Error ? error.message : "unknown"}). The signed transfer is in details.exchangeBody and stays valid for two days; check candle perps withdraw status ${id} before resubmitting.`, { exitCode: 3, details: { clientWithdrawalId: id, exchangeBody } });
+    }
+    await perpsRequest(ctx, key, "/api/v1/agent/perps/withdraw/submitted", {
+      clientWithdrawalId: id,
+      exchangeResponse: exchange
+    }).catch(() => null);
+    const refusal = venueRefusal(exchange);
+    if (refusal)
+      throw new TradingError("PERPS_VENUE_REFUSED", refusal, { details: { clientWithdrawalId: id, exchange } });
+    ctx.deps.stderr.write(`Submitted to Hyperliquid; following Relay's fill.
+`);
+    const deadline = ctx.deps.now() + WITHDRAW_POLL_MS;
+    let status = await perpsRequest(ctx, key, `/api/v1/agent/perps/withdraw/${encodeURIComponent(id)}`);
+    while (!TERMINAL.has(String(status.status)) && ctx.deps.now() < deadline) {
+      await ctx.deps.sleep(WITHDRAW_POLL_INTERVAL_MS);
+      status = await perpsRequest(ctx, key, `/api/v1/agent/perps/withdraw/${encodeURIComponent(id)}`);
+    }
+    if (!TERMINAL.has(String(status.status)))
+      ctx.deps.stderr.write(`Still ${safeText(status.status)} after 10 minutes. Check it with candle perps withdraw status ${id}.
+`);
+    return printTradingResult(ctx, { ...status, signature, exchange });
+  } catch (error) {
+    if (isVaultError(error))
+      return writeVaultFailure(ctx, error);
+    return tradingFailure(ctx, error);
+  }
+}
+async function relaySignature(ctx, key, wallet, typedData) {
+  const relay = await perpsRequest(ctx, key, `/api/v1/agent/wallets/${encodeURIComponent(wallet.id)}/sign`, typedDataAuthorization(wallet, typedData));
+  if (typeof relay.signature !== "string" || !/^0x[0-9a-fA-F]{130}$/.test(relay.signature))
+    throw new TradingError("INVALID_RESPONSE", "The relay did not return a signature.");
+  return relay.signature;
+}
+
 // src/commands/plans.ts
 init_args();
 init_client();
@@ -74594,12 +75028,12 @@ function planPromotionLine(table) {
 
 // src/commands/plans.ts
 init_render();
-var USAGE5 = "Usage: candle plans";
+var USAGE6 = "Usage: candle plans";
 async function plans(args, ctx) {
   const parsed = parseArgs(args, {});
   if ("error" in parsed || parsed.positionals.length > 0) {
     writeUsageFailure(ctx.deps, "error" in parsed ? `${parsed.error}
-${USAGE5}` : USAGE5, ctx.json);
+${USAGE6}` : USAGE6, ctx.json);
     return 2;
   }
   const result = await apiRequest("/api/v1/agent/plans", {
@@ -74838,20 +75272,20 @@ async function writeSecretNames(deps, profile, names) {
   else
     await deps.updateProfile(profile, { secretNames: sorted });
 }
-function usage5(ctx, line) {
+function usage6(ctx, line) {
   writeUsageFailure(ctx.deps, line, ctx.json);
   return 2;
 }
 async function secretsSet(args, ctx) {
   const parsed = parseArgs(args, {});
   if ("error" in parsed)
-    return usage5(ctx, parsed.error);
+    return usage6(ctx, parsed.error);
   const [raw, extra] = parsed.positionals;
   if (!raw || extra !== undefined)
-    return usage5(ctx, "Usage: candle secrets set <name>");
+    return usage6(ctx, "Usage: candle secrets set <name>");
   const name2 = canonicalSecretName(raw);
   if (name2 === undefined) {
-    return usage5(ctx, `A secret name is letters, digits and underscores, starting with a letter: ${raw}`);
+    return usage6(ctx, `A secret name is letters, digits and underscores, starting with a letter: ${raw}`);
   }
   if (!ctx.deps.isTTY.stdin || !ctx.deps.isTTY.stdout) {
     writeLocalFailure(ctx.deps, {
@@ -74863,7 +75297,7 @@ async function secretsSet(args, ctx) {
   }
   const value = await ctx.deps.promptSecret(`Value for ${name2} (input hidden): `);
   if (value.length === 0)
-    return usage5(ctx, "An empty value was typed; nothing was stored.");
+    return usage6(ctx, "An empty value was typed; nothing was stored.");
   try {
     await ctx.deps.secretsStore.set(secretRef(ctx.profile, name2), value);
   } catch (error) {
@@ -74883,9 +75317,9 @@ async function secretsSet(args, ctx) {
 async function secretsList(args, ctx) {
   const parsed = parseArgs(args, {});
   if ("error" in parsed)
-    return usage5(ctx, parsed.error);
+    return usage6(ctx, parsed.error);
   if (parsed.positionals.length > 0)
-    return usage5(ctx, `Unexpected argument: ${parsed.positionals[0]}`);
+    return usage6(ctx, `Unexpected argument: ${parsed.positionals[0]}`);
   const names = await storedSecretNames(ctx.deps, ctx.profile);
   if (ctx.json) {
     ctx.deps.stdout.write(`${JSON.stringify({ ok: true, names, backend: ctx.deps.backend })}
@@ -74904,13 +75338,13 @@ async function secretsList(args, ctx) {
 async function secretsRemove(args, ctx) {
   const parsed = parseArgs(args, {});
   if ("error" in parsed)
-    return usage5(ctx, parsed.error);
+    return usage6(ctx, parsed.error);
   const [raw, extra] = parsed.positionals;
   if (!raw || extra !== undefined)
-    return usage5(ctx, "Usage: candle secrets remove <name>");
+    return usage6(ctx, "Usage: candle secrets remove <name>");
   const name2 = canonicalSecretName(raw);
   if (name2 === undefined) {
-    return usage5(ctx, `A secret name is letters, digits and underscores, starting with a letter: ${raw}`);
+    return usage6(ctx, `A secret name is letters, digits and underscores, starting with a letter: ${raw}`);
   }
   await ctx.deps.secretsStore.delete(secretRef(ctx.profile, name2));
   const names = await storedSecretNames(ctx.deps, ctx.profile);
@@ -77064,7 +77498,7 @@ init_args();
 init_render();
 init_trading();
 init_swap();
-import { randomUUID as randomUUID5 } from "node:crypto";
+import { randomUUID as randomUUID6 } from "node:crypto";
 var withdrawal = exports_external.object({ withdrawal: exports_external.string(), amountRaw: exports_external.string(), endTime: exports_external.string(), claimable: exports_external.boolean() }).passthrough();
 var positionsSchema = exports_external.object({
   success: exports_external.literal(true),
@@ -77113,16 +77547,16 @@ async function runStake(action, args, ctx) {
     valueFlags: ["--wallet", "--client-stake-id"],
     booleanFlags: ["--yes", ...action === "claim" ? ["--all"] : []]
   });
-  const usage6 = "Usage: candle stake [add <amount> | remove <amount> | finish [<withdrawal>] | claim <rewardId> | claim --all] [--wallet <main|id|address|label>] [--client-stake-id <id>] [--yes] [--json]";
+  const usage7 = "Usage: candle stake [add <amount> | remove <amount> | finish [<withdrawal>] | claim <rewardId> | claim --all] [--wallet <main|id|address|label>] [--client-stake-id <id>] [--yes] [--json]";
   if ("error" in parsed) {
     writeUsageFailure(ctx.deps, parsed.error, ctx.json);
     return 2;
   }
   const { values, positionals, booleans } = parsed;
-  const id = values["--client-stake-id"] ?? `stake-${randomUUID5()}`;
+  const id = values["--client-stake-id"] ?? `stake-${randomUUID6()}`;
   const all = booleans.has("--all");
   if (!validClientId(id) || id.length > 128 || (action === "positions" ? positionals.length !== 0 : action === "finish" ? positionals.length > 1 : action === "claim" ? all ? positionals.length !== 0 : positionals.length !== 1 : positionals.length !== 1)) {
-    writeUsageFailure(ctx.deps, usage6, ctx.json);
+    writeUsageFailure(ctx.deps, usage7, ctx.json);
     return 2;
   }
   try {
@@ -77904,7 +78338,7 @@ init_render();
 init_solana_verify();
 init_trading();
 init_swap();
-var USAGE6 = "Usage: candle transfer --to <address|wallet name|vault> --asset <SOL|USDC|CNDL|ETH|USDG>|--mint <mint>|--token <0x...> --amount <decimal|max> [--wallet <name>] [--rpc-url <url>] [--yes] [--json]";
+var USAGE7 = "Usage: candle transfer --to <address|wallet name|vault> --asset <SOL|USDC|CNDL|ETH|USDG>|--mint <mint>|--token <0x...> --amount <decimal|max> [--wallet <name>] [--rpc-url <url>] [--yes] [--json]";
 var TRANSFER_ASSETS = [...Object.keys(BASES), ...Object.keys(HOOD_BASES)];
 var BASE58_ADDRESS = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;
 async function readLinkedWallets(ctx, key) {
@@ -77990,7 +78424,7 @@ async function transfer(args, ctx) {
   const flags = parsed.values;
   const asset = flags["--asset"]?.toUpperCase();
   if (parsed.positionals.length !== 0 || !flags["--to"] || !flags["--amount"] || [flags["--asset"], flags["--mint"], flags["--token"]].filter(Boolean).length !== 1 || asset !== undefined && !TRANSFER_ASSETS.includes(asset) || flags["--mint"] !== undefined && !BASE58_ADDRESS.test(flags["--mint"]) || flags["--token"] !== undefined && !checkEvmAddress(flags["--token"]).ok) {
-    writeUsageFailure(ctx.deps, USAGE6, ctx.json);
+    writeUsageFailure(ctx.deps, USAGE7, ctx.json);
     return 2;
   }
   const to = flags["--to"];
@@ -81225,9 +81659,11 @@ async function planTransfer(input) {
   const destination = ataFor(profile, toKey);
   const instructions = [];
   const accountCreationLines = [];
+  let accountRent;
   const destinationState = await tokenAccountFrozen(rpc, encodePubkey(destination));
   if (!destinationState.exists) {
-    const rent = await rpc.getMinimumBalanceForRentExemption(165);
+    const rent = await rpc.getMinimumBalanceForRentExemption(profile.associatedTokenAccountSize);
+    accountRent = rent;
     instructions.push(createAssociatedTokenAccountIdempotent({ payer: fromKey, owner: toKey, mint, tokenProgram }));
     accountCreationLines.push(`create associated token account ${encodePubkey(destination)} (idempotent)`, `account owner ${input.to}`, `account rent ${rent} lamports, paid by ${input.from} if created`);
   }
@@ -81263,6 +81699,8 @@ async function planTransfer(input) {
     from: input.from,
     to: input.to,
     instructions,
+    sourceTokenAccount: encodePubkey(source),
+    ...accountRent !== undefined ? { accountRent } : {},
     token: {
       profile,
       extraAccountsMissing: !hook.ok,
@@ -81293,6 +81731,45 @@ async function quoteTransferFee(rpc, from, instructions) {
   });
   return rpc.getFeeForMessage(toBase642(message));
 }
+var FALLBACK_FEE_LAMPORTS = 5000n;
+var TOKEN_ACCOUNT_AMOUNT_OFFSET = 64;
+function tokenAccountAmount(data) {
+  if (data.length < TOKEN_ACCOUNT_AMOUNT_OFFSET + 8)
+    return 0n;
+  return new DataView(data.buffer, data.byteOffset + TOKEN_ACCOUNT_AMOUNT_OFFSET, 8).getBigUint64(0, true);
+}
+async function assertTransferAffordable(solana, plan, feeQuote) {
+  const fee = feeQuote ?? FALLBACK_FEE_LAMPORTS;
+  const rent = plan.accountRent ?? 0n;
+  const lamportsNeeded = (plan.asset === "SOL" ? plan.amountRaw : 0n) + fee + rent;
+  const lamports = await solana.read(() => solana.rpc.getBalance(plan.from));
+  if (plan.sourceTokenAccount !== undefined) {
+    const account = await solana.read(() => solana.rpc.getAccountInfo(plan.sourceTokenAccount));
+    const held = account === null ? 0n : tokenAccountAmount(account.data);
+    if (held < plan.amountRaw) {
+      throw new VaultError("TRANSFER_INSUFFICIENT_FUNDS", `${plan.from} holds ${held} raw of ${plan.asset} and this transfer moves ${plan.amountRaw} raw (${plan.amount}). Nothing was signed or sent.`, {
+        suggestion: "Fund the key with this token first, or send a smaller --amount.",
+        details: {
+          from: plan.from,
+          asset: plan.asset,
+          heldRaw: held.toString(),
+          neededRaw: plan.amountRaw.toString()
+        }
+      });
+    }
+  }
+  if (lamports < lamportsNeeded) {
+    const parts = [
+      ...plan.asset === "SOL" ? [`${plan.amountRaw} to send`] : [],
+      `${fee} fee${feeQuote === null ? " (estimated)" : ""}`,
+      ...rent > 0n ? [`${rent} token account rent`] : []
+    ];
+    throw new VaultError("TRANSFER_INSUFFICIENT_FUNDS", `${plan.from} holds ${lamports} lamports and this transfer needs ${lamportsNeeded} (${parts.join(" + ")}). Nothing was signed or sent.`, {
+      suggestion: "Fund the key with SOL first, or send a smaller --amount. candle vault list --balances shows each key's SOL.",
+      details: { from: plan.from, heldLamports: lamports.toString(), neededLamports: lamportsNeeded.toString() }
+    });
+  }
+}
 function displayTransferPlan(ctx, plan, feeQuote) {
   ctx.deps.stdout.write(`Decoded transfer (local signing only):
 `);
@@ -81327,8 +81804,9 @@ async function signAndBroadcastTransfer(input) {
   } catch (error) {
     if (isRateLimited(error))
       notePostSignatureRateLimit(input.ctx, sigB58);
-    return { signature: sigB58, finalized: false };
+    return { signature: sigB58, finalized: false, seen: true };
   }
+  let seen = false;
   for (let i = 0;i < 30; i++) {
     await input.ctx.deps.sleep(500);
     let status;
@@ -81337,17 +81815,24 @@ async function signAndBroadcastTransfer(input) {
     } catch (error) {
       if (isRateLimited(error))
         notePostSignatureRateLimit(input.ctx, sigB58);
-      return { signature: sigB58, finalized: false };
+      return { signature: sigB58, finalized: false, seen: true };
     }
+    if (status)
+      seen = true;
     if (status?.confirmationStatus === "finalized") {
       if (status.err) {
         const named = namedSendFailure(input.plan);
         throw new VaultError("VAULT_WRITE_FAILED", `Transfer failed on chain${named ? ` (${named})` : ""}. Any pending funding receipt will be reconciled on a rerun.`);
       }
-      return { signature: sigB58, finalized: true };
+      return { signature: sigB58, finalized: true, seen: true };
     }
   }
-  return { signature: sigB58, finalized: false };
+  return { signature: sigB58, finalized: false, seen };
+}
+function unfinalizedSendLine(result, suffix = "") {
+  return result.seen ? `Submitted ${result.signature}; finality is not yet confirmed.${suffix}
+` : `Sent ${result.signature}, but no status read found it on the network: it was most likely dropped and nothing moved. Check the signature in an explorer before sending again.${suffix}
+`;
 }
 
 // src/commands/vault-fund.ts
@@ -81386,6 +81871,7 @@ async function fundExternal(ctx, vault, external2, input) {
   }));
   const feeQuote = await solana.read(() => quoteTransferFee(solana.rpc, plan.from, plan.instructions));
   displayTransferPlan(ctx, plan, feeQuote);
+  await assertTransferAffordable(solana, plan, feeQuote);
   await confirmSend(ctx, { amount: plan.amount, asset: plan.asset, address: external2.address });
   const secret = await decryptKey(vault, fromEntry.id);
   try {
@@ -81399,12 +81885,12 @@ async function fundExternal(ctx, vault, external2, input) {
         from: plan.from,
         amount: plan.amount,
         asset: plan.asset,
-        finalized: result.finalized
+        finalized: result.finalized,
+        ...result.finalized ? {} : { seen: result.seen }
       });
     } else {
       ctx.deps.stdout.write(result.finalized ? `Funded ${external2.label} (${external2.address}) with ${plan.amount} ${plan.asset}: ${result.signature}
-` : `Submitted ${result.signature}; finality is not yet confirmed.
-`);
+` : unfinalizedSendLine(result));
     }
     return result.finalized ? 0 : 3;
   } finally {
@@ -81501,6 +81987,7 @@ async function vaultFund(args, ctx) {
     }));
     const feeQuote = await solana.read(() => quoteTransferFee(solana.rpc, plan.from, plan.instructions));
     displayTransferPlan(ctx, plan, feeQuote);
+    await assertTransferAffordable(solana, plan, feeQuote);
     await confirmSend(ctx, { amount: plan.amount, asset: plan.asset, address: teeAddress });
     const secret = await decryptKey(vault, fromEntry.id);
     try {
@@ -81535,12 +82022,12 @@ async function vaultFund(args, ctx) {
           from: plan.from,
           amount: plan.amount,
           asset: plan.asset,
-          finalized: result.finalized
+          finalized: result.finalized,
+          ...result.finalized ? {} : { seen: result.seen }
         });
       } else {
         ctx.deps.stdout.write(result.finalized ? `Funded ${teeAddress} with ${plan.amount} ${plan.asset}: ${result.signature}
-` : `Submitted ${result.signature}; finality is not yet confirmed. Receipt recorded.
-`);
+` : unfinalizedSendLine(result, " Receipt recorded."));
       }
       return result.finalized ? 0 : 3;
     } finally {
@@ -85350,8 +85837,7 @@ async function vaultStatus(args, ctx) {
     return usage(ctx, resolvedVault.error);
   const path = resolvedVault.path;
   const unlock = parsed.booleans.has("--unlock");
-  if (unlock && !requireTty(ctx, "vault status --unlock"))
-    return 1;
+  const unlockCtx = refusePromptsWithoutTerminal(ctx, "vault status --unlock");
   return runVaultCommand(ctx, async ({ hold }) => {
     const raw = await readVaultRaw(path);
     if (raw === null)
@@ -85368,7 +85854,9 @@ async function vaultStatus(args, ctx) {
     const backup = sidecar ? describeLastBackup(sidecar, file.envelopes) : undefined;
     let unlocked;
     if (unlock) {
-      const vault = hold((await unlockInteractively(ctx, path, raw, { acceptOlderCopy: parsed.booleans.has("--accept-older-copy") })).vault);
+      const vault = hold((await unlockInteractively(unlockCtx, path, raw, {
+        acceptOlderCopy: parsed.booleans.has("--accept-older-copy")
+      })).vault);
       unlocked = {
         entries: vault.index.entries.map(describeEntry),
         duplicateLabels: duplicateLabels(vault.index).map((duplicate) => ({
@@ -85794,6 +86282,7 @@ async function vaultTransfer(args, ctx) {
     }));
     const feeQuote = await solana.read(() => quoteTransferFee(solana.rpc, plan.from, plan.instructions));
     displayTransferPlan(ctx, plan, feeQuote);
+    await assertTransferAffordable(solana, plan, feeQuote);
     if (promoted) {
       const notice = serverStateNotice(await readTeeServerState(ctx, fromEntry, apiKey));
       if (notice !== undefined)
@@ -85822,12 +86311,12 @@ async function vaultTransfer(args, ctx) {
           asset: plan.asset,
           amountRaw: plan.amountRaw.toString(),
           finalized: result.finalized,
+          ...result.finalized ? {} : { seen: result.seen },
           ...activityReport !== undefined ? { activityReport } : {}
         });
       } else {
         ctx.deps.stdout.write(result.finalized ? `Transferred ${plan.amount} ${plan.asset} to ${to}: ${result.signature}
-` : `Submitted ${result.signature}; finality is not yet confirmed.
-`);
+` : unfinalizedSendLine(result));
       }
       return result.finalized ? 0 : 3;
     } finally {
@@ -85841,7 +86330,7 @@ init_args();
 init_release();
 import { dirname as dirname10, join as join11 } from "node:path";
 init_render();
-var USAGE7 = "Usage: candle verify <file> --bundle <path> [--identity <uri>] [--issuer <url>]";
+var USAGE8 = "Usage: candle verify <file> --bundle <path> [--identity <uri>] [--issuer <url>]";
 async function resolveIdentity(deps, bundlePath, flag) {
   if (flag)
     return { kind: "ok", uri: flag, provenance: "identity from --identity" };
@@ -85873,19 +86362,19 @@ async function verify(args, ctx) {
   });
   if ("error" in parsed) {
     writeUsageFailure(deps, `${parsed.error}
-${USAGE7}`, json);
+${USAGE8}`, json);
     return 2;
   }
   const file = parsed.positionals[0];
   if (parsed.positionals.length !== 1 || file === undefined) {
     writeUsageFailure(deps, `verify takes exactly one file.
-${USAGE7}`, json);
+${USAGE8}`, json);
     return 2;
   }
   const bundlePath = parsed.values["--bundle"];
   if (!bundlePath) {
     writeUsageFailure(deps, `--bundle is required.
-${USAGE7}`, json);
+${USAGE8}`, json);
     return 2;
   }
   const resolved = await resolveIdentity(deps, bundlePath, parsed.values["--identity"]);
@@ -85899,7 +86388,7 @@ ${USAGE7}`, json);
   }
   if (resolved.kind === "absent") {
     writeUsageFailure(deps, `--identity is required: there is no latest.json beside ${bundlePath} to take the release version from.
-${USAGE7}`, json);
+${USAGE8}`, json);
     return 2;
   }
   const identity = resolved.uri;
@@ -86008,7 +86497,7 @@ function writeFailure2(ctx, result) {
 }
 async function setAllowLaunch(args, ctx, enabled) {
   const { deps, apiUrl, json } = ctx;
-  const usage6 = enabled ? USAGE_ALLOW : USAGE_DISALLOW;
+  const usage7 = enabled ? USAGE_ALLOW : USAGE_DISALLOW;
   const command = enabled ? "wallets allow-launch" : "wallets disallow-launch";
   const parsed = parseArgs(args, enabled ? {} : { booleanFlags: ["--yes"] });
   if ("error" in parsed) {
@@ -86016,7 +86505,7 @@ async function setAllowLaunch(args, ctx, enabled) {
     return 2;
   }
   if (parsed.positionals.length === 0) {
-    writeUsageFailure(deps, `Name at least one wallet. ${usage6}`, json);
+    writeUsageFailure(deps, `Name at least one wallet. ${usage7}`, json);
     return 2;
   }
   const skipConfirm = !enabled && parsed.booleans.has("--yes");
@@ -86119,8 +86608,8 @@ init_args();
 init_render();
 init_trading();
 init_swap();
-import { randomUUID as randomUUID6 } from "node:crypto";
-var USAGE8 = "Usage: candle wallet close-empty [--wallet embedded] [--keep <mint>]... [--client-trade-id <id>] [--yes] [--json]";
+import { randomUUID as randomUUID7 } from "node:crypto";
+var USAGE9 = "Usage: candle wallet close-empty [--wallet embedded] [--keep <mint>]... [--client-trade-id <id>] [--yes] [--json]";
 var BASE58_ADDRESS2 = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;
 var LISTED_ROWS = 50;
 function splitKeep(args) {
@@ -86195,7 +86684,7 @@ async function embeddedSolana(ctx, key, wallet) {
 async function walletsCloseEmpty(args, ctx) {
   const lifted = splitKeep(args);
   if ("error" in lifted) {
-    writeUsageFailure(ctx.deps, `${lifted.error}. ${USAGE8}`, ctx.json);
+    writeUsageFailure(ctx.deps, `${lifted.error}. ${USAGE9}`, ctx.json);
     return 2;
   }
   const parsed = parseArgs(lifted.rest, { valueFlags: ["--wallet", "--client-trade-id"], booleanFlags: ["--yes"] });
@@ -86204,9 +86693,9 @@ async function walletsCloseEmpty(args, ctx) {
     return 2;
   }
   const named = parsed.values["--client-trade-id"];
-  const id = named ?? `close-${randomUUID6()}`;
+  const id = named ?? `close-${randomUUID7()}`;
   if (parsed.positionals.length !== 0 || !validClientId(id) || !lifted.keep.every((m) => BASE58_ADDRESS2.test(m))) {
-    writeUsageFailure(ctx.deps, USAGE8, ctx.json);
+    writeUsageFailure(ctx.deps, USAGE9, ctx.json);
     return 2;
   }
   const keep = lifted.keep;
@@ -86335,7 +86824,7 @@ function trustTable(rows) {
 }
 async function setTrust(args, ctx, trusted) {
   const { deps, apiUrl, json } = ctx;
-  const usage6 = trusted ? USAGE_TRUST : USAGE_UNTRUST;
+  const usage7 = trusted ? USAGE_TRUST : USAGE_UNTRUST;
   const command = trusted ? "wallets trust" : "wallets untrust";
   const parsed = parseArgs(args, trusted ? {} : { booleanFlags: ["--yes"] });
   if ("error" in parsed) {
@@ -86343,7 +86832,7 @@ async function setTrust(args, ctx, trusted) {
     return 2;
   }
   if (parsed.positionals.length === 0) {
-    writeUsageFailure(deps, `Name at least one wallet. ${usage6}`, json);
+    writeUsageFailure(deps, `Name at least one wallet. ${usage7}`, json);
     return 2;
   }
   const skipConfirm = !trusted && parsed.booleans.has("--yes");
@@ -86630,7 +87119,8 @@ var COMMANDS = {
       cancel: perpsCancel,
       orders: perpsOrders,
       positions: perpsPositions,
-      leverage: perpsLeverage
+      leverage: perpsLeverage,
+      withdraw: perpsWithdraw
     }
   },
   auth: { subcommands: { login: authLogin, status: authStatus, logout: authLogout } },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@candledottv/cli",
-  "version": "0.11.31",
+  "version": "0.11.32",
   "description": "The Candle CLI: authorize a device from your browser, then manage API keys, wallets, and setup health from the terminal",
   "type": "module",
   "bin": {