@candledottv/cli 0.11.6 → 0.11.7

package/dist/index.js

@@ -332,6 +332,9 @@ var init_agent_key_access = __esm(() => {
 function formatScopesForSummary(scopes) {
   return sortAgentKeyScopes(scopes).map((scope) => scope === "swap:write" ? `${scope} (${SWAP_WRITE_NOTE})` : scope === "transfer:write" ? `${scope} (${TRANSFER_WRITE_NOTE})` : scope).join(", ");
 }
+function terminalText(value) {
+  return value.replace(/[\u0000-\u001f\u007f-\u009f]/g, "");
+}
 function renderTable(headers, rows) {
   const widths = headers.map((header, col) => Math.max(header.length, ...rows.map((row) => (row[col] ?? "").length)));
   const line = (cells) => cells.map((cell, col) => col === cells.length - 1 ? cell ?? "" : (cell ?? "").padEnd(widths[col] ?? 0)).join("  ");
@@ -3140,7 +3143,8 @@ var init_errors = __esm(() => {
     "WALLET_LIMIT_REACHED",
     "TIER_REQUIRED",
     "LINKED_WALLET_ROOM_UNREADABLE",
-    "PROMOTE_ACCOUNT_UNRESOLVED"
+    "PROMOTE_ACCOUNT_UNRESOLVED",
+    "TRANSFER_SWEEP_PENDING"
   ];
   VaultError = class VaultError extends Error {
     code;
@@ -8344,6 +8348,23 @@ function retryAfterMs(header, now) {
     return;
   return Math.max(0, at - now);
 }
+function readProgramAccounts(method, entries, sliced) {
+  const pubkeys = entries.map((entry) => {
+    const pubkey = entry?.pubkey;
+    if (typeof pubkey !== "string")
+      throw new SolanaRpcError(`RPC ${method} answered an account without a pubkey`);
+    return pubkey;
+  });
+  if (!sliced)
+    return pubkeys;
+  return entries.map((entry, i) => {
+    const data = entry.account?.data;
+    const encoded = Array.isArray(data) && data[1] === "base64" ? data[0] : undefined;
+    if (typeof encoded !== "string")
+      throw new SolanaRpcError(`RPC ${method} answered an account without base64 data`);
+    return { pubkey: pubkeys[i], data: new Uint8Array(Buffer.from(encoded, "base64")) };
+  });
+}
 function rawAccountView(value, address) {
   if (!value)
     return null;
@@ -8488,28 +8509,31 @@ function createSolanaRpc(url, fetchFn) {
       const r = await call("getSignaturesForAddress", [address, { limit: 1 }]);
       return Array.isArray(r) && r.length > 0;
     },
-    async isBlockhashValid(blockhash) {
-      const r = await call("isBlockhashValid", [blockhash, { commitment: "finalized" }]);
+    async isBlockhashValid(blockhash, commitment = "finalized") {
+      const r = await call("isBlockhashValid", [blockhash, { commitment }]);
       if (typeof r?.value !== "boolean")
         throw new Error("isBlockhashValid answered with a non-boolean value");
       return r.value;
     },
-    async getProgramAccounts(programId, filters, opts) {
-      const r = await call("getProgramAccounts", [programId, { encoding: "base64", commitment: "finalized", dataSlice: { offset: 0, length: 0 }, filters }], opts?.signal);
+    getProgramAccounts: async (programId, filters, opts) => {
+      const r = await call("getProgramAccounts", [
+        programId,
+        {
+          encoding: "base64",
+          commitment: "finalized",
+          dataSlice: opts?.dataSlice ?? { offset: 0, length: 0 },
+          filters
+        }
+      ], opts?.signal);
       if (!Array.isArray(r))
         throw new SolanaRpcError("RPC getProgramAccounts answered without an account list");
-      return r.map((entry) => {
-        if (typeof entry?.pubkey !== "string") {
-          throw new SolanaRpcError("RPC getProgramAccounts answered an account without a pubkey");
-        }
-        return entry.pubkey;
-      });
+      return readProgramAccounts("getProgramAccounts", r, opts?.dataSlice !== undefined);
     },
-    async getProgramAccountsV2(programId, filters, opts) {
+    getProgramAccountsV2: async (programId, filters, opts) => {
       const config = {
         encoding: "base64",
         commitment: "finalized",
-        dataSlice: { offset: 0, length: 0 },
+        dataSlice: opts?.dataSlice ?? { offset: 0, length: 0 },
         filters,
         limit: opts?.limit ?? PROGRAM_ACCOUNTS_V2_LIMIT
       };
@@ -8520,19 +8544,17 @@ function createSolanaRpc(url, fetchFn) {
         throw new SolanaRpcError("RPC getProgramAccountsV2 answered without an account list");
       }
       const page = r;
-      const pubkeys = page.accounts.map((entry) => {
-        if (typeof entry?.pubkey !== "string") {
-          throw new SolanaRpcError("RPC getProgramAccountsV2 answered an account without a pubkey");
-        }
-        return entry.pubkey;
-      });
+      const sliced = opts?.dataSlice !== undefined;
+      const accounts = readProgramAccounts("getProgramAccountsV2", page.accounts, sliced);
       const cursor = page.paginationKey;
-      if (cursor === null || cursor === undefined)
-        return { pubkeys, paginationKey: null };
-      if (typeof cursor !== "string" || cursor.length === 0) {
-        throw new SolanaRpcError("RPC getProgramAccountsV2 answered a paginationKey that is not a string");
+      let paginationKey = null;
+      if (cursor !== null && cursor !== undefined) {
+        if (typeof cursor !== "string" || cursor.length === 0) {
+          throw new SolanaRpcError("RPC getProgramAccountsV2 answered a paginationKey that is not a string");
+        }
+        paginationKey = cursor;
       }
-      return { pubkeys, paginationKey: cursor };
+      return sliced ? { accounts, paginationKey } : { pubkeys: accounts, paginationKey };
     }
   };
 }
@@ -8837,13 +8859,13 @@ var init_keys = __esm(() => {
 
 // src/vault/signer-roles.ts
 function tokenMintFilters(key) {
-  return [{ dataSize: 82 }, memcmp(0, concat2(COPTION_SOME_U32, key))];
+  return [{ dataSize: 82 }, memcmp(4, key)];
 }
 function tokenFreezeFilters(key) {
   return [{ dataSize: 82 }, memcmp(46, concat2(COPTION_SOME_U32, key))];
 }
 function token2022MintFilters(key) {
-  const authority = memcmp(0, concat2(COPTION_SOME_U32, key));
+  const authority = memcmp(4, key);
   return [
     [{ dataSize: 82 }, authority],
     [memcmp(165, TOKEN_2022_MINT_ACCOUNT_TYPE), authority]
@@ -8856,6 +8878,9 @@ function token2022FreezeFilters(key) {
     [memcmp(165, TOKEN_2022_MINT_ACCOUNT_TYPE), authority]
   ];
 }
+function keepSetAuthority(hits) {
+  return hits.filter((hit) => hit.data.length === COPTION_SOME_U32.length && hit.data.every((byte, i) => byte === COPTION_SOME_U32[i])).map((hit) => hit.pubkey);
+}
 function programUpgradeFilters(key) {
   return [memcmp(0, LOADER_PROGRAM_DATA_TAG), memcmp(12, concat2(COPTION_SOME_U8, key))];
 }
@@ -8950,19 +8975,31 @@ async function readSignerRoles(rpc, addresses, opts) {
     const timer = timeoutMs > 0 ? setTimeout(() => controller.abort(Object.assign(new Error("timed out"), { name: "TimeoutError" })), timeoutMs) : undefined;
     try {
       requests += 1;
+      const tagSlice = task.group.tagSlice;
       if (task.via === "v2") {
         if (rpc.getProgramAccountsV2 === undefined) {
           throw new SolanaRpcError("RPC getProgramAccountsV2 failed: -32601 Method not found", {
             rpcCode: RPC_METHOD_NOT_FOUND
           });
         }
-        return await rpc.getProgramAccountsV2(task.group.programId, filters, {
+        const pageOpts = {
           signal: controller.signal,
           ...task.paginationKey !== undefined ? { paginationKey: task.paginationKey } : {}
-        });
+        };
+        if (tagSlice === undefined)
+          return await rpc.getProgramAccountsV2(task.group.programId, filters, pageOpts);
+        const page = await rpc.getProgramAccountsV2(task.group.programId, filters, { ...pageOpts, dataSlice: tagSlice });
+        return { pubkeys: keepSetAuthority(page.accounts), paginationKey: page.paginationKey };
       }
-      const pubkeys = await rpc.getProgramAccounts(task.group.programId, filters, { signal: controller.signal });
-      return { pubkeys, paginationKey: null };
+      if (tagSlice === undefined) {
+        const pubkeys = await rpc.getProgramAccounts(task.group.programId, filters, { signal: controller.signal });
+        return { pubkeys, paginationKey: null };
+      }
+      const hits = await rpc.getProgramAccounts(task.group.programId, filters, {
+        signal: controller.signal,
+        dataSlice: tagSlice
+      });
+      return { pubkeys: keepSetAuthority(hits), paginationKey: null };
     } finally {
       if (timer !== undefined)
         clearTimeout(timer);
@@ -9205,7 +9242,7 @@ var BPF_UPGRADEABLE_LOADER_ID = "BPFLoaderUpgradeab1e11111111111111111111111", S
   return out;
 }, COPTION_SOME_U32, COPTION_SOME_U8, LOADER_PROGRAM_DATA_TAG, LOADER_PROGRAM_TAG, TOKEN_2022_MINT_ACCOUNT_TYPE, memcmp = (offset, bytes) => ({
   memcmp: { offset, bytes: b642(bytes), encoding: "base64" }
-}), ROLE_GROUPS, PROGRAM_LABELS, NOT_CHECKED_LINE = "Not checked: multisig membership, Token-2022 extension authorities, metadata update authority.", thousands = (n) => n.toLocaleString("en-US");
+}), MINT_AUTHORITY_TAG_SLICE, ROLE_GROUPS, PROGRAM_LABELS, NOT_CHECKED_LINE = "Not checked: multisig membership, Token-2022 extension authorities, metadata update authority.", thousands = (n) => n.toLocaleString("en-US");
 var init_signer_roles = __esm(() => {
   init_esm();
   init_solana_lite();
@@ -9229,6 +9266,7 @@ var init_signer_roles = __esm(() => {
   LOADER_PROGRAM_DATA_TAG = new Uint8Array([3, 0, 0, 0]);
   LOADER_PROGRAM_TAG = new Uint8Array([2, 0, 0, 0]);
   TOKEN_2022_MINT_ACCOUNT_TYPE = new Uint8Array([1]);
+  MINT_AUTHORITY_TAG_SLICE = { offset: 0, length: 4 };
   ROLE_GROUPS = [
     {
       id: "token-mint",
@@ -9236,7 +9274,8 @@ var init_signer_roles = __esm(() => {
       program: "token",
       programId: TOKEN_PROGRAM_ID,
       label: "token mint",
-      shapes: (key) => [tokenMintFilters(key)]
+      shapes: (key) => [tokenMintFilters(key)],
+      tagSlice: MINT_AUTHORITY_TAG_SLICE
     },
     {
       id: "token-freeze",
@@ -9252,7 +9291,8 @@ var init_signer_roles = __esm(() => {
       program: "token-2022",
       programId: TOKEN_2022_PROGRAM_ID,
       label: "Token-2022 mint",
-      shapes: token2022MintFilters
+      shapes: token2022MintFilters,
+      tagSlice: MINT_AUTHORITY_TAG_SLICE
     },
     {
       id: "token2022-freeze",
@@ -9298,6 +9338,7 @@ var init_signer_roles = __esm(() => {
 // src/vault/promote-support.ts
 var exports_promote_support = {};
 __export(exports_promote_support, {
+  withToKey: () => withToKey,
   subjectPhrase: () => subjectPhrase,
   shortAddress: () => shortAddress,
   runRoleCheck: () => runRoleCheck,
@@ -9307,6 +9348,7 @@ __export(exports_promote_support, {
   promoteSentence: () => promoteSentence,
   printPromoteSentence: () => printPromoteSentence,
   findVaultRoleEntry: () => findVaultRoleEntry,
+  findTransferSource: () => findTransferSource,
   findEntryByLabelOrAddress: () => findEntryByLabelOrAddress,
   controlledByJson: () => controlledByJson,
   confirmPrompt: () => confirmPrompt,
@@ -9352,6 +9394,10 @@ function findVaultRoleEntry(index, labelOrAddress) {
     return byLabel;
   return index.entries.find((entry) => entry.address === labelOrAddress);
 }
+function findTransferSource(index, labelOrAddress) {
+  const byLabel = (role) => index.entries.find((entry) => entry.role === role && entry.label !== undefined && entry.label === labelOrAddress);
+  return byLabel("vault") ?? byLabel("tee-wallet") ?? index.entries.find((entry) => entry.address === labelOrAddress);
+}
 function findEntryByLabelOrAddress(index, labelOrAddress) {
   const byLabel = index.entries.find((entry) => entry.label !== undefined && entry.label === labelOrAddress);
   if (byLabel !== undefined)
@@ -9472,6 +9518,9 @@ async function confirmPromotion(ctx, n) {
 function shortAddress(address) {
   return `${address.slice(0, 6)}…${address.slice(-4)}`;
 }
+function withToKey(controlledBy, toKey) {
+  return { ...controlledBy, toKey };
+}
 function accountUnresolved(reason) {
   return new VaultError("PROMOTE_ACCOUNT_UNRESOLVED", `Could not confirm which Candle account this API key acts for (${reason}); nothing was written.`, {
     suggestion: "Check the key with: candle doctor. Promotion registers the keys to that account, so it does not proceed on a cached value."
@@ -9545,23 +9594,51 @@ function renderControlledBy(controlledBy, n) {
   const label = cleaned.length > 0 ? `(${cleaned})  ` : "";
   const environment = controlledBy.environment ?? "not a Candle host";
   const from = controlledBy.apiUrlFrom !== undefined ? `, from ${controlledBy.apiUrlFrom}` : "";
+  const { toKey } = controlledBy;
+  if (toKey === undefined) {
+    return [
+      `${subject} will be controlled by:`,
+      `  Candle account  ${controlledBy.username ?? "(no username)"}  (${shortAddress(controlledBy.account)})`,
+      `  API key         ${controlledBy.keyPrefix}…  ${label}${source}`,
+      `  API             ${controlledBy.apiUrl}  (${environment}${from})`
+    ].join(`
+`);
+  }
+  const toLabel = toKey.label !== null && labelCell(toKey.label).length > 0 ? `(${labelCell(toKey.label)})  ` : "";
   return [
     `${subject} will be controlled by:`,
     `  Candle account  ${controlledBy.username ?? "(no username)"}  (${shortAddress(controlledBy.account)})`,
-    `  API key         ${controlledBy.keyPrefix}…  ${label}${source}`,
-    `  API             ${controlledBy.apiUrl}  (${environment}${from})`
+    `  API key         ${toKey.keyPrefix}…  ${toLabel}--to-key, bound by a rebind after the import`,
+    `  imported under  ${controlledBy.keyPrefix}…  ${label}${source}`,
+    `  API             ${controlledBy.apiUrl}  (${environment}${from})`,
+    ...toKey.warnings
   ].join(`
 `);
 }
 function controlledByJson(controlledBy) {
+  const importedUnder = {
+    keyPrefix: controlledBy.keyPrefix,
+    keyLabel: controlledBy.keyLabel,
+    keySource: controlledBy.keySource
+  };
+  if (controlledBy.toKey === undefined) {
+    return {
+      account: controlledBy.account,
+      username: controlledBy.username,
+      ...importedUnder,
+      apiUrl: controlledBy.apiUrl,
+      environment: controlledBy.environment
+    };
+  }
   return {
     account: controlledBy.account,
     username: controlledBy.username,
-    keyPrefix: controlledBy.keyPrefix,
-    keyLabel: controlledBy.keyLabel,
-    keySource: controlledBy.keySource,
+    keyPrefix: controlledBy.toKey.keyPrefix,
+    keyLabel: controlledBy.toKey.label,
+    keySource: "--to-key",
     apiUrl: controlledBy.apiUrl,
-    environment: controlledBy.environment
+    environment: controlledBy.environment,
+    importedUnder
   };
 }
 async function runRoleCheck(ctx, rpc, addresses) {
@@ -13625,14 +13702,14 @@ async function request(ctx, key, path, body) {
     throw new TradingError("INVALID_RESPONSE", "Candle returned an invalid response.");
   return result.body;
 }
-async function teeWallets(ctx, key, scope) {
+async function listTradingWallets(ctx, key, scope) {
   let cursor;
   const rows = [];
   const cursors = new Set;
   let appId = "";
   for (;; ) {
     const response = walletPageSchema.parse(await request(ctx, key, `/api/v1/agent/wallets/trading${cursor ? `?cursor=${encodeURIComponent(cursor)}` : ""}`));
-    if (!response.scopes?.includes(scope))
+    if (scope !== undefined && !response.scopes?.includes(scope))
       throw new TradingError("SCOPE_MISSING", `The bound key needs ${scope}.`);
     appId = response.privyAppId ?? "";
     if (!Array.isArray(response.page))
@@ -13675,7 +13752,7 @@ async function completeTradingWallet(ctx, row, appId, scope) {
   };
 }
 async function tradingWallet(ctx, key, name, scope) {
-  const { rows, appId } = await teeWallets(ctx, key, scope);
+  const { rows, appId } = await listTradingWallets(ctx, key, scope);
   const matches = rows.filter((row) => matchesName(row, name));
   if (matches.length !== 1) {
     throw new TradingError("TEE_WALLET_REQUIRED", matches.length > 1 ? `"${name}" matches ${matches.length} TEE wallets on this key: ${teeWalletList(matches)}. Name one by id or address.` : rows.length === 0 ? "This key has no TEE wallets bound to it. Enrol one, or select the profile whose key holds it." : `No TEE wallet on this key is called "${name}". Bound to this key: ${teeWalletList(rows)}.`);
@@ -13684,7 +13761,7 @@ async function tradingWallet(ctx, key, name, scope) {
 }
 async function tradingPayer(ctx, key, name) {
   const scope = "swap:write";
-  const { rows, appId } = await teeWallets(ctx, key, scope);
+  const { rows, appId } = await listTradingWallets(ctx, key, scope);
   const embedded = embeddedSchema.parse(await request(ctx, key, "/api/v1/agent/wallets/embedded")).wallets?.solana?.address;
   const asEmbedded = () => ({ kind: "embedded", address: embedded });
   const options = [
@@ -13808,7 +13885,7 @@ Minimum received: ${safeText(quote.minimumReceived)}
     throw new TradingError("CONFIRMATION_REQUIRED", "Run interactively to confirm, or use --yes for an ordinary trade prompt.");
   return (await ctx.deps.promptLine("Proceed? [y/N] ")).trim().toLowerCase() === "y";
 }
-async function saveLaunchSignature(ctx, key, id, transaction) {
+async function saveOperationSignature(ctx, key, id, kind, transaction) {
   const bytes = Buffer.from(transaction, "base64");
   let offset = 0;
   let count = 0;
@@ -13825,7 +13902,7 @@ async function saveLaunchSignature(ctx, key, id, transaction) {
   const signature = base58.encode(bytes.subarray(offset, offset + 64));
   const path = operationPath(ctx, key, id);
   const temporary = `${path}.${process.pid}.tmp`;
-  await writeFile4(temporary, JSON.stringify({ id, kind: "launch", signature }), { mode: 384 });
+  await writeFile4(temporary, JSON.stringify({ id, kind, signature }), { mode: 384 });
   const file = await open3(temporary, "r");
   try {
     await file.sync();
@@ -13835,7 +13912,7 @@ async function saveLaunchSignature(ctx, key, id, transaction) {
   await rename3(temporary, path);
   return signature;
 }
-var TradingError, feeSchema, risksSchema, artifactSchema, swapBuildSchema, launchBuildSchema, walletSchema, walletPageSchema, embeddedSchema, operationSchema, BASES;
+var TradingError, feeSchema, risksSchema, artifactSchema, swapBuildSchema, launchBuildSchema, walletSchema, walletPageSchema, embeddedSchema, operationSchema, lpAmountSchema, lpBuildSchema, lpPositionsSchema, lpPoolsSchema, BASES;
 var init_trading = __esm(() => {
   init_esm();
   init_zod();
@@ -13897,6 +13974,51 @@ var init_trading = __esm(() => {
     wallets: exports_external.object({ solana: exports_external.object({ address: exports_external.string() }).passthrough().nullable().optional() }).passthrough().optional()
   }).passthrough();
   operationSchema = exports_external.object({ job: exports_external.object({ status: exports_external.string() }).passthrough() }).passthrough();
+  lpAmountSchema = exports_external.object({ mint: exports_external.string(), raw: exports_external.string().regex(/^\d+$/), decimals: exports_external.number().int() });
+  lpBuildSchema = exports_external.object({
+    build: exports_external.object({
+      action: exports_external.enum(["add", "remove", "claim"]),
+      pool: exports_external.string(),
+      position: exports_external.string(),
+      transaction: exports_external.string().min(1),
+      walletAddress: exports_external.string(),
+      signature: exports_external.string().optional()
+    }).passthrough(),
+    preview: exports_external.object({
+      amounts: exports_external.array(lpAmountSchema).default([]),
+      tokenRisks: risksSchema.default([]),
+      warnings: exports_external.array(exports_external.string()).default([]),
+      candleFeeBps: exports_external.number().optional()
+    }).passthrough().nullable(),
+    replay: exports_external.boolean().optional()
+  });
+  lpPositionsSchema = exports_external.object({
+    positions: exports_external.array(exports_external.object({
+      position: exports_external.string(),
+      pool: exports_external.string(),
+      tokens: exports_external.array(exports_external.object({
+        mint: exports_external.string(),
+        decimals: exports_external.number().int(),
+        amountRaw: exports_external.string(),
+        unclaimedFeesRaw: exports_external.string(),
+        valueUsd: exports_external.number().nullable().optional()
+      }).passthrough()),
+      poolShare: exports_external.number().optional(),
+      valueUsd: exports_external.number().nullable().optional()
+    }).passthrough())
+  });
+  lpPoolsSchema = exports_external.object({
+    page: exports_external.number().int(),
+    pages: exports_external.number().int(),
+    pools: exports_external.array(exports_external.object({
+      pool: exports_external.string(),
+      tokens: exports_external.array(exports_external.string()),
+      liquidityUsd: exports_external.number().nullable().optional(),
+      baseFeePercent: exports_external.number().nullable().optional(),
+      volume24hUsd: exports_external.number().nullable().optional(),
+      estimatedAprPercent: exports_external.number().nullable().optional()
+    }).passthrough())
+  });
   BASES = {
     SOL: { mint: "So11111111111111111111111111111111111111112", decimals: 9 },
     USDC: { mint: "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v", decimals: 6 },
@@ -37604,7 +37726,7 @@ var init_update_notice = __esm(() => {
 });
 
 // ../mcp/src/orchestrate.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
+import { randomUUID as randomUUID4 } from "node:crypto";
 function requireApiKey(cfg) {
   if (!cfg.apiKey) {
     throw new Error("CANDLE_AGENT_API_KEY is required for this tool. Set it in the environment or MCP client config.");
@@ -37716,7 +37838,7 @@ async function readPaperInventory(cfg, doFetch, extra) {
 }
 async function executeTrade(args, cfg, doFetch) {
   const apiKey = requireApiKey(cfg);
-  const clientTradeId = args.clientTradeId ?? randomUUID3();
+  const clientTradeId = args.clientTradeId ?? randomUUID4();
   if (args.amount !== undefined && args.percent !== undefined) {
     return errText("pass exactly one of amount or percent, not both", { clientTradeId });
   }
@@ -37854,7 +37976,7 @@ async function executeTrade(args, cfg, doFetch) {
 }
 async function executeLaunchAndSeed(args, cfg, doFetch) {
   const apiKey = requireApiKey(cfg);
-  const clientLaunchId = args.clientLaunchId ?? randomUUID3();
+  const clientLaunchId = args.clientLaunchId ?? randomUUID4();
   const { devBuy, dryRun, buyAmount: _rawBuyAmount, ...launchFields } = args;
   let buyAmount;
   if (devBuy !== undefined) {
@@ -38263,8 +38385,8 @@ MARKET_NOT_FOUND means Candle has no market for that token and this could not ru
     inputSchema: setProfileWalletsShape
   }, async (args) => callAndRelay("candle_set_profile_wallets", args, cfg));
   register("candle_get_profile_pnl", {
-    title: "Read an agent profile's realized P&L",
-    description: "Realized profit for this profile's own fills, the Candle fees charged against it, and the " + "positions it still holds with their COST BASIS -- not their current value, which is not marked " + "here. Deposits, withdrawals and transfers are excluded: funding a wallet is not profit. Check " + "`unvalued` and `truncated` before quoting the number; they mean the total is partial. Reads only.",
+    title: "Read an agent profile's P&L",
+    description: "Realized profit for this profile's own fills, the Candle fees charged against it, and the " + "positions it still holds with their cost basis, each MARKED at Candle's current price where one " + "exists: `markPriceUsd`, `marketValueUsd` and `unrealizedUsd` per position, and `unrealizedUsd` " + "overall. A position with no price is counted in `unmarkedPositions` and left out of unrealized, " + "never valued at zero; `oldestMarkAt` says how old the marks are. Deposits, withdrawals and " + "transfers are excluded: funding a wallet is not profit. Check `unvalued` and `truncated` before " + "quoting the number; they mean the total is partial. Reads only.",
     inputSchema: profilePnlShape
   }, async (args) => callAndRelay("candle_get_profile_pnl", args, cfg));
   register("candle_get_profile_trades", {
@@ -38593,7 +38715,7 @@ init_render();
 init_secret_store();
 
 // src/version.ts
-var CLI_VERSION = "0.11.6";
+var CLI_VERSION = "0.11.7";
 
 // src/commands/auth.ts
 var DEVICE_CODE_PATH = "/api/v1/agent/device/code";
@@ -39092,6 +39214,45 @@ var HELP = {
     ],
     env: ENV_API
   },
+  lp: {
+    group: "Trade",
+    summary: "Meteora DAMM v2 liquidity from a TEE wallet: pools, add, positions, remove, claim",
+    description: "Provide liquidity on any Meteora DAMM v2 pool from a TEE wallet, through its bound key (scope lp:write, opt-in). Every write is quoted, shown with the pool's Token-2022 warnings, confirmed, signed by Candle's relay and broadcast over your RPC; no Candle fee. A sweep closes open positions itself (tee sweep).",
+    usage: ["candle lp <subcommand> [flags]"],
+    rows: [
+      {
+        invocation: "pools <token> [--page <n>]",
+        description: "Pools listing a token: liquidity, fee, 24h volume, estimated yield"
+      },
+      {
+        invocation: "add <pool> --amount <n> <token> --wallet <tee> [--position <nft>]",
+        description: "Open a position, or add to one; the other side follows the pool's ratio"
+      },
+      { invocation: "positions [--wallet <tee>]", description: "Every position across your TEE wallets" },
+      {
+        invocation: "remove <position> --percent <n> [--wallet <tee>]",
+        description: "Withdraw; at 100% also claims fees and closes the position"
+      },
+      { invocation: "claim <position> [--wallet <tee>]", description: "Claim fees and any rewards" }
+    ],
+    flags: [
+      { invocation: "--wallet <tee>", description: "The TEE wallet by id, address or unique label" },
+      { invocation: "--rpc-url <url>", description: "Your Solana RPC, for mint reads and the broadcast" },
+      {
+        invocation: "--client-trade-id <id>",
+        description: "Idempotency: the same id never deposits or withdraws twice"
+      },
+      { invocation: "--slippage-bps <n>", description: "add and remove: the tolerance, 0 to 1000 (default 100)" },
+      { invocation: "--yes", description: "Skip the confirmation prompt (an ordinary prompt only)" }
+    ],
+    examples: [
+      "candle lp pools So11111111111111111111111111111111111111112",
+      "candle lp add <pool> --amount 0.5 SOL --wallet AgentOne --rpc-url https://<rpc>",
+      "candle lp positions",
+      "candle lp remove <position> --percent 100 --wallet AgentOne --rpc-url https://<rpc>"
+    ],
+    env: ENV_API
+  },
   launch: {
     group: "Trade",
     summary: "Create a Solana token (the first buy is a separate swap)",
@@ -39107,6 +39268,31 @@ var HELP = {
     examples: ["candle launch --name Demo --symbol DEMO --image-url https://example.com/d.png --wallet AgentOne"],
     env: ENV_API
   },
+  portfolio: {
+    group: "Account",
+    summary: "Every wallet's holdings, prices and value in one table (vault read over your own RPC)",
+    description: "Vault, TEE and embedded wallets, each token with amount, price and value, then a total. TEE and embedded balances come from Candle; vault and external wallets are read over your own RPC, and Candle is sent only the mints they hold, for prices. Unpriced tokens are shown as unpriced and left out of the total. Where Candle serves LP, each TEE wallet's DAMM v2 positions follow the tokens (share of the pool plus unclaimed fees, valued by Candle at the same marks) and count in the total; a position whose pool could not be read is shown as not read and the total says it is partial.",
+    usage: ["candle portfolio [--rpc-url <url>] [--json]"],
+    rows: [],
+    flags: [
+      {
+        invocation: "--rpc-url <url>",
+        description: "Your own Solana RPC, for the vault. Without it (or CANDLE_SOLANA_RPC_URL) the vault is not read"
+      },
+      KEYSTORE_FLAG
+    ],
+    examples: ["candle portfolio", "candle portfolio --rpc-url https://your-rpc.example --json"],
+    env: [...ENV_API, ...ENV_LOCAL_SIGNING]
+  },
+  pnl: {
+    group: "Account",
+    summary: "P&L: realized, fees, unrealized and open positions (--profile for one key's own)",
+    description: "Without --profile, the account's books: every profile, the web app and the CLI, one ledger, the same figures the web P&L chart shows. Needs a key with the Read scope (account:read). With --profile <name>, that profile's key reads its own P&L. Unpriced positions are shown as unpriced and never valued at zero. Where Candle serves LP, DAMM v2 positions are included: realized (withdrawals against the cost basis at the add, plus claimed fees), unrealized (open positions at their share of the pool plus unclaimed fees, against that basis), and vs holding (what the deposited tokens would be worth held); the total then covers tokens and LP.",
+    usage: ["candle pnl [--profile <name>] [--json]"],
+    rows: [],
+    examples: ["candle pnl", "candle pnl --profile scalper --json"],
+    env: ENV_API
+  },
   keys: {
     group: "Account",
     summary: "API keys, and the wallets each key may use",
@@ -39228,14 +39414,14 @@ var HELP = {
       },
       {
         invocation: "transfer <to> --amount <n> --asset SOL|<mint> --from <label> --rpc-url <url>",
-        description: "Sign a vault-key transfer locally"
+        description: "Sign a transfer locally from a vault key or a promoted TEE wallet"
       },
       {
-        invocation: "promote --from|--in-place <label> [--sweep-to <label>] [--rpc-url <url>]",
+        invocation: "promote --from|--in-place <label> [--sweep-to <label>] [--rpc-url <url>] [--to-key <prefix|label>]",
         description: "Fresh TEE key, or promote one vault key in place. Reads, over your RPC, whether each key is a token mint, freeze, program upgrade or stake authority (9 requests per key; public endpoints refuse the token scans). Multisig membership is not checked."
       },
       {
-        invocation: "promote-batch --pairs-from <file> --rpc-url <url> [--token-holdings]",
+        invocation: "promote-batch --pairs-from <file> --rpc-url <url> [--to-key <prefix|label>] [--token-holdings]",
         description: "Promote many vault keys in place: one unlock, one reviewed acknowledgement. Reads, over your RPC, whether each key is a token mint, freeze, program upgrade or stake authority (9 requests per key; public endpoints refuse the token scans). Multisig membership is not checked."
       },
       {
@@ -39269,6 +39455,10 @@ var HELP = {
       {
         invocation: "--pairs-from <file>",
         description: "promote-batch: one '<label> <destination>' per line, or a CSV with label and sweep_to columns (max 256). Every row is checked against the whole set before anything is written, and each key is committed on its own, so an interrupted batch keeps what landed and re-running the same file resumes."
+      },
+      {
+        invocation: "--to-key <prefix|label>",
+        description: "promote, promote-batch: bind the promoted wallets to this key instead of the calling one. The import runs under the calling key as before, then the wallets are moved to the named key by a rebind (device token; the target's secret never touches this machine). The target is checked before the unlock; a wallet whose rebind fails is named as still on the calling key, with the tee rebind command that finishes."
       }
     ],
     examples: [
@@ -39278,6 +39468,7 @@ var HELP = {
       "candle vault rename key-7 treasury-cold",
       "candle vault new-key --chain solana --labels-from ./replacement-names.txt",
       "candle vault promote-batch --pairs-from ./promote-plan.csv --rpc-url https://<rpc>",
+      "candle vault promote-batch --pairs-from ./promote-plan.csv --rpc-url https://<rpc> --to-key tr-01",
       "candle vault enroll security-key --label yubikey-a",
       "candle vault backup --to /Volumes/BACKUP/vault.enc",
       "candle vault backup --to icloud",
@@ -39310,7 +39501,7 @@ var HELP = {
       },
       {
         invocation: "sweep <address> --rpc-url <url> [--emergency]",
-        description: "Sign locally and move everything to the pinned vault"
+        description: "Sign locally and move everything to the pinned vault; closes DAMM v2 LP positions after verifying each server-built close (--emergency moves the position NFT instead, with no API)"
       },
       {
         invocation: "rebind <wallet...> --to-key <prefix|label>",
@@ -43820,7 +44011,7 @@ function validClientId(id) {
 }
 async function lookupOperation(ctx, key, id, kind) {
   const local = await savedOperation(ctx, key, id);
-  const kinds = kind ? [kind] : local ? [local.kind] : ["trade", "swap", "launch"];
+  const kinds = kind ? [kind] : local && local.kind !== "lp" ? [local.kind] : ["trade", "swap", "launch"];
   const found = [];
   for (const candidate of kinds) {
     try {
@@ -44095,7 +44286,7 @@ async function launch(args, ctx) {
     if (!Number.isFinite(built.expiresAt) || built.expiresAt <= ctx.deps.now())
       throw new TradingError("QUOTE_EXPIRED", "The launch build expired before signing.");
     const signed = await relaySign(ctx, key, wallet, built.transaction);
-    const signature = await saveLaunchSignature(ctx, key, id, signed);
+    const signature = await saveOperationSignature(ctx, key, id, "launch", signed);
     const broadcastSignature = await createSolanaRpc(url, ctx.deps.fetch).sendTransaction(signed);
     if (broadcastSignature !== signature)
       throw new TradingError("RPC_FAILED", "RPC returned a different transaction signature; check the saved operation.");
@@ -44108,6 +44299,368 @@ async function launch(args, ctx) {
   }
 }
 
+// src/commands/lp.ts
+init_args();
+init_render();
+init_solana_lite();
+import { randomUUID as randomUUID3 } from "node:crypto";
+init_trading();
+var LP_SCOPE = "lp:write";
+var CONFIRM_POLL_MS2 = 2000;
+var CONFIRM_MAX_POLLS2 = 45;
+async function lpRequest(ctx, key, path, body) {
+  const result = await apiRequest(path, {
+    apiUrl: ctx.apiUrl,
+    credentials: { apiKey: key },
+    auth: "key",
+    method: body ? "POST" : "GET",
+    body,
+    fetch: ctx.deps.fetch,
+    env: ctx.deps.env
+  });
+  if (!result.ok) {
+    if (result.status === 404 && !result.code)
+      throw new TradingError("LP_NOT_ENABLED", "This Candle deployment does not serve LP routes (LP_ENABLED is off there, or the API predates them).");
+    throw new TradingError(result.code ?? "REQUEST_FAILED", result.message);
+  }
+  if (!result.body || typeof result.body !== "object")
+    throw new TradingError("INVALID_RESPONSE", "Candle returned an invalid response.");
+  return result.body;
+}
+function solanaAddress(value, what) {
+  if (!/^[1-9A-HJ-NP-Za-km-z]{32,44}$/.test(value))
+    throw new TradingError("INVALID_ADDRESS", `${what} must be a Solana address (base58).`);
+  return value;
+}
+function poolToken(value) {
+  const base = baseAsset(value);
+  if (base)
+    return BASES[base]?.mint;
+  return solanaAddress(value, "The token");
+}
+function matchesWallet(row, name) {
+  return row.id === name || row.address === name || row.label === name;
+}
+function usage2(ctx, line) {
+  writeUsageFailure(ctx.deps, line, ctx.json);
+  return 2;
+}
+function amountLine(amount) {
+  const base = Object.entries(BASES).find(([, asset]) => asset.mint === amount.mint)?.[0];
+  return `${decimalAmount(amount.raw, amount.decimals)} ${base ?? amount.mint}`;
+}
+async function lpPools(args, ctx) {
+  const parsed = parseArgs(args, { valueFlags: ["--page"] });
+  const page = Number(parsed && !("error" in parsed) ? parsed.values["--page"] ?? "1" : "1");
+  if ("error" in parsed)
+    return usage2(ctx, parsed.error);
+  if (parsed.positionals.length !== 1 || !Number.isSafeInteger(page) || page < 1)
+    return usage2(ctx, "Usage: candle lp pools <token> [--page <n>]");
+  try {
+    const token = poolToken(parsed.positionals[0]);
+    const key = await tradingKey(ctx);
+    const pools = lpPoolsSchema.parse(await lpRequest(ctx, key, `/api/v1/agent/lp/pools/${encodeURIComponent(token)}?page=${page}`));
+    if (ctx.json)
+      return printTradingResult(ctx, { success: true, token, ...pools });
+    const out = ctx.deps.stdout;
+    if (pools.pools.length === 0) {
+      out.write(`No DAMM v2 pool lists ${token} (page ${pools.page} of ${pools.pages}).
+`);
+      return 0;
+    }
+    const usd = (value) => value === null || value === undefined ? "unavailable" : `$${value.toFixed(2)}`;
+    const pct = (value) => value === null || value === undefined ? "unavailable" : `${value.toFixed(2)}%`;
+    out.write(`DAMM v2 pools for ${token} (page ${pools.page} of ${pools.pages}):
+`);
+    for (const pool of pools.pools) {
+      out.write(`  ${safeText(pool.pool)}
+    pair ${pool.tokens.map(safeText).join(" / ")}
+    liquidity ${usd(pool.liquidityUsd)}, fee ${pct(pool.baseFeePercent)}, 24h volume ${usd(pool.volume24hUsd)}, est. yield ${pct(pool.estimatedAprPercent)} APR (indexed, not a quote)
+`);
+    }
+    return 0;
+  } catch (error) {
+    return tradingFailure(ctx, error);
+  }
+}
+async function lpPositions(args, ctx) {
+  const parsed = parseArgs(args, { valueFlags: ["--wallet"] });
+  if ("error" in parsed)
+    return usage2(ctx, parsed.error);
+  if (parsed.positionals.length !== 0)
+    return usage2(ctx, "Usage: candle lp positions [--wallet <tee>]");
+  try {
+    const key = await tradingKey(ctx);
+    const { rows } = await listTradingWallets(ctx, key);
+    const name = parsed.values["--wallet"];
+    const wallets = rows.filter((row) => row.chain === "solana" && (name === undefined || matchesWallet(row, name)));
+    if (name !== undefined && wallets.length === 0)
+      throw new TradingError("TEE_WALLET_REQUIRED", `No TEE wallet on this key is called "${name}".`);
+    const report = [];
+    for (const row of wallets) {
+      const positions = lpPositionsSchema.parse(await lpRequest(ctx, key, `/api/v1/agent/lp/positions?linkedWalletId=${encodeURIComponent(row.id)}`));
+      report.push({
+        id: row.id,
+        address: row.address,
+        ...row.label ? { label: row.label } : {},
+        positions: positions.positions
+      });
+    }
+    if (ctx.json)
+      return printTradingResult(ctx, { success: true, wallets: report });
+    const out = ctx.deps.stdout;
+    const total = report.reduce((n, wallet) => n + wallet.positions.length, 0);
+    if (total === 0) {
+      out.write(`No DAMM v2 positions across ${report.length} TEE wallet(s).
+`);
+      return 0;
+    }
+    for (const wallet of report) {
+      if (wallet.positions.length === 0)
+        continue;
+      out.write(`${wallet.label ? `${safeText(wallet.label)} ` : ""}(${wallet.id}, ${safeText(wallet.address)})
+`);
+      for (const position of wallet.positions) {
+        out.write(`  position ${safeText(position.position)} in pool ${safeText(position.pool)}
+`);
+        for (const token of position.tokens) {
+          out.write(`    ${amountLine({ mint: token.mint, raw: token.amountRaw, decimals: token.decimals })}, unclaimed fees ${decimalAmount(token.unclaimedFeesRaw, token.decimals)}${token.valueUsd === null || token.valueUsd === undefined ? "" : ` ($${token.valueUsd.toFixed(2)})`}
+`);
+        }
+        out.write(`    value ${position.valueUsd === null || position.valueUsd === undefined ? "unpriced" : `$${position.valueUsd.toFixed(2)}`}${position.poolShare === undefined ? "" : `, ${(position.poolShare * 100).toFixed(4)}% of the pool`}
+`);
+      }
+    }
+    return 0;
+  } catch (error) {
+    return tradingFailure(ctx, error);
+  }
+}
+async function walletHolding(ctx, key, position, name) {
+  if (name !== undefined)
+    return tradingWallet(ctx, key, name, LP_SCOPE);
+  const { rows, appId } = await listTradingWallets(ctx, key, LP_SCOPE);
+  for (const row of rows) {
+    if (row.chain !== "solana")
+      continue;
+    const positions = lpPositionsSchema.parse(await lpRequest(ctx, key, `/api/v1/agent/lp/positions?linkedWalletId=${encodeURIComponent(row.id)}`));
+    if (positions.positions.some((held) => held.position === position))
+      return completeTradingWallet(ctx, row, appId, LP_SCOPE);
+  }
+  throw new TradingError("LP_POSITION_NOT_FOUND", `No TEE wallet bound to this key holds position ${position}. See candle lp positions, or name the wallet with --wallet.`);
+}
+async function waitConfirmed(ctx, rpc2, signature, id) {
+  for (let i = 0;i < CONFIRM_MAX_POLLS2; i++) {
+    const observed = classifyStatus(await rpc2.getSignatureStatus(signature));
+    if (observed.kind === "finalized")
+      return;
+    if (observed.kind === "failed")
+      throw new TradingError("LP_TRANSACTION_FAILED", `Transaction ${signature} failed on chain: ${JSON.stringify(observed.err)}.`);
+    if (observed.kind === "nonfinal") {
+      if (observed.err !== null && observed.err !== undefined)
+        throw new TradingError("LP_TRANSACTION_FAILED", `Transaction ${signature} failed: ${JSON.stringify(observed.err)}.`);
+      if (observed.confirmationStatus === "confirmed")
+        return;
+    }
+    await ctx.deps.sleep(CONFIRM_POLL_MS2);
+  }
+  throw new TradingError("LP_CONFIRM_PENDING", `Transaction ${signature} was sent but not confirmed within ${CONFIRM_MAX_POLLS2 * CONFIRM_POLL_MS2 / 1000}s. Re-run the same command with --client-trade-id ${id}: it confirms the saved signature and sends nothing new.`);
+}
+async function confirmPreview(ctx, plan, built) {
+  const output = ctx.json ? ctx.deps.stderr : ctx.deps.stdout;
+  output.write(`${safeText(plan.intent)}
+Payer: ${safeText(plan.wallet.address)}
+`);
+  output.write(`Pool: ${safeText(built.build.pool)}
+Position: ${safeText(built.build.position)}
+`);
+  const preview = built.preview;
+  const amounts = preview?.amounts ?? [];
+  if (amounts.length > 0) {
+    const verb = plan.action === "add" ? "Deposit (maximum, at the pool's ratio)" : plan.action === "remove" ? "Withdraw (minimum)" : "Claim";
+    output.write(`${verb}: ${amounts.map(amountLine).join(" + ")}
+`);
+  }
+  output.write(`Candle LP fee: ${safeText(preview?.candleFeeBps ?? 0)} bps
+`);
+  for (const warning of preview?.warnings ?? [])
+    output.write(`Warning: ${safeText(warning)}
+`);
+  for (const risk of preview?.tokenRisks ?? [])
+    output.write(`Warning (${safeText(risk.mint)}): ${safeText(risk.message)}
+`);
+  if (built.replay)
+    output.write(`This client id was already built; the same artifact is shown again.
+`);
+  if (plan.yes)
+    return true;
+  if (!ctx.deps.isTTY.stdin)
+    throw new TradingError("CONFIRMATION_REQUIRED", "Run interactively to confirm, or use --yes for an ordinary LP prompt.");
+  return (await ctx.deps.promptLine("Proceed? [y/N] ")).trim().toLowerCase() === "y";
+}
+async function runLpOperation(ctx, plan) {
+  const { id, key, wallet, action } = plan;
+  const confirm = async (signature2, extra) => {
+    const result = await lpRequest(ctx, key, "/api/v1/agent/lp/confirm", { clientTradeId: id, signature: signature2 });
+    return printTradingResult(ctx, {
+      ...result,
+      clientTradeId: id,
+      kind: "lp",
+      action,
+      signature: signature2,
+      wallet: safeText(wallet.address),
+      ...extra
+    });
+  };
+  const local = await savedOperation(ctx, key, id);
+  if (local?.signature)
+    return confirm(local.signature, { resumed: true });
+  if (!local && !await claimOperation(ctx, key, id, "lp"))
+    throw new TradingError("OPERATION_ALREADY_STARTED", "This machine already started this id; no write was resent.");
+  ctx.deps.stderr.write(`Operation: ${id}
+`);
+  const built = lpBuildSchema.parse(await lpRequest(ctx, key, `/api/v1/agent/lp/${action}/build`, {
+    linkedWalletId: wallet.id,
+    clientTradeId: id,
+    ...plan.body
+  }));
+  if (built.build.walletAddress !== wallet.address || built.build.action !== action)
+    throw new TradingError("INVALID_RESPONSE", "The LP build does not name the requested wallet and action; nothing was signed.");
+  if (built.build.signature)
+    return confirm(built.build.signature, { resumed: true });
+  const preview = {
+    pool: built.build.pool,
+    position: built.build.position,
+    amounts: built.preview?.amounts ?? [],
+    warnings: built.preview?.warnings ?? [],
+    tokenRisks: built.preview?.tokenRisks ?? [],
+    candleFeeBps: built.preview?.candleFeeBps ?? 0
+  };
+  if (!await confirmPreview(ctx, plan, built))
+    return printTradingResult(ctx, {
+      success: true,
+      status: "cancelled",
+      clientTradeId: id,
+      kind: "lp",
+      action,
+      preview
+    });
+  const signed = await relaySign(ctx, key, wallet, built.build.transaction);
+  const signature = await saveOperationSignature(ctx, key, id, "lp", signed);
+  const rpc2 = createSolanaRpc(plan.url, ctx.deps.fetch);
+  const echoed = await rpc2.sendTransaction(signed);
+  if (echoed !== signature)
+    throw new TradingError("RPC_FAILED", "RPC returned a different transaction signature; check the saved operation.");
+  ctx.deps.stderr.write(`LP ${action} signature: ${signature}
+`);
+  await waitConfirmed(ctx, rpc2, signature, id);
+  return confirm(signature, { preview });
+}
+function slippageOf(flag) {
+  const slippage = Number(flag ?? "100");
+  if (!Number.isInteger(slippage) || slippage < 0 || slippage > 1000)
+    throw new TradingError("INVALID_AMOUNT", "--slippage-bps must be an integer from 0 to 1000.");
+  return slippage;
+}
+async function lpAdd(args, ctx) {
+  const parsed = parseArgs(args, {
+    valueFlags: ["--amount", "--wallet", "--position", "--client-trade-id", "--slippage-bps", "--rpc-url"],
+    booleanFlags: ["--yes"]
+  });
+  if ("error" in parsed)
+    return usage2(ctx, parsed.error);
+  const flags = parsed.values;
+  const id = flags["--client-trade-id"] ?? `lp-${randomUUID3()}`;
+  if (parsed.positionals.length !== 2 || !flags["--amount"] || !flags["--wallet"] || !validClientId(id))
+    return usage2(ctx, "Usage: candle lp add <pool> --amount <decimal> <token> --wallet <tee> [--position <nft-mint>] [--slippage-bps 100] [--client-trade-id <id>] [--rpc-url <url>] [--yes]");
+  try {
+    const pool = solanaAddress(parsed.positionals[0], "The pool");
+    const token = poolToken(parsed.positionals[1]);
+    const position = flags["--position"] ? solanaAddress(flags["--position"], "--position") : undefined;
+    rawAmount(flags["--amount"], 18);
+    const slippageBps = slippageOf(flags["--slippage-bps"]);
+    const url = rpcUrl(ctx, flags["--rpc-url"]);
+    const key = await tradingKey(ctx);
+    const wallet = await tradingWallet(ctx, key, flags["--wallet"], LP_SCOPE);
+    const decimals = await decimalsFor(ctx, baseAsset(token) ?? token, flags["--rpc-url"]);
+    const amountRaw = rawAmount(flags["--amount"], decimals);
+    return await runLpOperation(ctx, {
+      action: "add",
+      id,
+      key,
+      wallet,
+      url,
+      yes: parsed.booleans.has("--yes"),
+      intent: `Add ${decimalAmount(amountRaw, decimals)} ${baseAsset(token) ?? token} of liquidity to DAMM v2 pool ${pool}${position ? ` (position ${position})` : " (new position)"}`,
+      body: { pool, token, amountRaw, slippageBps, ...position ? { position } : {} }
+    });
+  } catch (error) {
+    return tradingFailure(ctx, error, id);
+  }
+}
+async function lpRemove(args, ctx) {
+  const parsed = parseArgs(args, {
+    valueFlags: ["--percent", "--wallet", "--client-trade-id", "--slippage-bps", "--rpc-url"],
+    booleanFlags: ["--yes"]
+  });
+  if ("error" in parsed)
+    return usage2(ctx, parsed.error);
+  const flags = parsed.values;
+  const id = flags["--client-trade-id"] ?? `lp-${randomUUID3()}`;
+  const percent = Number(flags["--percent"]);
+  if (parsed.positionals.length !== 1 || !flags["--percent"] || !/^\d+(\.\d{1,2})?$/.test(flags["--percent"]) || !(percent > 0 && percent <= 100) || !validClientId(id))
+    return usage2(ctx, "Usage: candle lp remove <position> --percent <0.01-100> [--wallet <tee>] [--slippage-bps 100] [--client-trade-id <id>] [--rpc-url <url>] [--yes]");
+  try {
+    const position = solanaAddress(parsed.positionals[0], "The position");
+    const slippageBps = slippageOf(flags["--slippage-bps"]);
+    const url = rpcUrl(ctx, flags["--rpc-url"]);
+    const key = await tradingKey(ctx);
+    const wallet = await walletHolding(ctx, key, position, flags["--wallet"]);
+    return await runLpOperation(ctx, {
+      action: "remove",
+      id,
+      key,
+      wallet,
+      url,
+      yes: parsed.booleans.has("--yes"),
+      intent: percent === 100 ? `Remove all liquidity from position ${position}, claim its fees and close it (rent returns to the wallet)` : `Remove ${percent}% of the liquidity in position ${position}`,
+      body: { position, percent, slippageBps }
+    });
+  } catch (error) {
+    return tradingFailure(ctx, error, id);
+  }
+}
+async function lpClaim(args, ctx) {
+  const parsed = parseArgs(args, {
+    valueFlags: ["--wallet", "--client-trade-id", "--rpc-url"],
+    booleanFlags: ["--yes"]
+  });
+  if ("error" in parsed)
+    return usage2(ctx, parsed.error);
+  const flags = parsed.values;
+  const id = flags["--client-trade-id"] ?? `lp-${randomUUID3()}`;
+  if (parsed.positionals.length !== 1 || !validClientId(id))
+    return usage2(ctx, "Usage: candle lp claim <position> [--wallet <tee>] [--client-trade-id <id>] [--rpc-url <url>] [--yes]");
+  try {
+    const position = solanaAddress(parsed.positionals[0], "The position");
+    const url = rpcUrl(ctx, flags["--rpc-url"]);
+    const key = await tradingKey(ctx);
+    const wallet = await walletHolding(ctx, key, position, flags["--wallet"]);
+    return await runLpOperation(ctx, {
+      action: "claim",
+      id,
+      key,
+      wallet,
+      url,
+      yes: parsed.booleans.has("--yes"),
+      intent: `Claim the fees and any rewards of position ${position}`,
+      body: { position }
+    });
+  } catch (error) {
+    return tradingFailure(ctx, error, id);
+  }
+}
+
 // src/commands/mcp.ts
 init_args();
 init_deps();
@@ -44434,20 +44987,20 @@ async function writeSecretNames(deps, profile, names) {
   else
     await deps.updateProfile(profile, { secretNames: sorted });
 }
-function usage2(ctx, line) {
+function usage3(ctx, line) {
   writeUsageFailure(ctx.deps, line, ctx.json);
   return 2;
 }
 async function secretsSet(args, ctx) {
   const parsed = parseArgs(args, {});
   if ("error" in parsed)
-    return usage2(ctx, parsed.error);
+    return usage3(ctx, parsed.error);
   const [raw, extra] = parsed.positionals;
   if (!raw || extra !== undefined)
-    return usage2(ctx, "Usage: candle secrets set <name>");
+    return usage3(ctx, "Usage: candle secrets set <name>");
   const name = canonicalSecretName(raw);
   if (name === undefined) {
-    return usage2(ctx, `A secret name is letters, digits and underscores, starting with a letter: ${raw}`);
+    return usage3(ctx, `A secret name is letters, digits and underscores, starting with a letter: ${raw}`);
   }
   if (!ctx.deps.isTTY.stdin || !ctx.deps.isTTY.stdout) {
     writeLocalFailure(ctx.deps, {
@@ -44459,7 +45012,7 @@ async function secretsSet(args, ctx) {
   }
   const value = await ctx.deps.promptSecret(`Value for ${name} (input hidden): `);
   if (value.length === 0)
-    return usage2(ctx, "An empty value was typed; nothing was stored.");
+    return usage3(ctx, "An empty value was typed; nothing was stored.");
   try {
     await ctx.deps.secretsStore.set(secretRef(ctx.profile, name), value);
   } catch (error) {
@@ -44479,9 +45032,9 @@ async function secretsSet(args, ctx) {
 async function secretsList(args, ctx) {
   const parsed = parseArgs(args, {});
   if ("error" in parsed)
-    return usage2(ctx, parsed.error);
+    return usage3(ctx, parsed.error);
   if (parsed.positionals.length > 0)
-    return usage2(ctx, `Unexpected argument: ${parsed.positionals[0]}`);
+    return usage3(ctx, `Unexpected argument: ${parsed.positionals[0]}`);
   const names = await storedSecretNames(ctx.deps, ctx.profile);
   if (ctx.json) {
     ctx.deps.stdout.write(`${JSON.stringify({ ok: true, names, backend: ctx.deps.backend })}
@@ -44500,13 +45053,13 @@ async function secretsList(args, ctx) {
 async function secretsRemove(args, ctx) {
   const parsed = parseArgs(args, {});
   if ("error" in parsed)
-    return usage2(ctx, parsed.error);
+    return usage3(ctx, parsed.error);
   const [raw, extra] = parsed.positionals;
   if (!raw || extra !== undefined)
-    return usage2(ctx, "Usage: candle secrets remove <name>");
+    return usage3(ctx, "Usage: candle secrets remove <name>");
   const name = canonicalSecretName(raw);
   if (name === undefined) {
-    return usage2(ctx, `A secret name is letters, digits and underscores, starting with a letter: ${raw}`);
+    return usage3(ctx, `A secret name is letters, digits and underscores, starting with a letter: ${raw}`);
   }
   await ctx.deps.secretsStore.delete(secretRef(ctx.profile, name));
   const names = await storedSecretNames(ctx.deps, ctx.profile);
@@ -44618,6 +45171,645 @@ async function runPlugin(name, rawArgs, ctx) {
   return ctx.deps.runPlugin(path, split2.passthrough, env);
 }
 
+// src/commands/pnl.ts
+init_args();
+init_deps();
+init_profiles();
+init_render();
+
+// src/usd.ts
+function formatUsd(value) {
+  if (!Number.isFinite(value))
+    return "?";
+  const sign2 = value < 0 ? "-" : "";
+  const abs = Math.abs(value);
+  if (abs > 0 && abs < 0.005)
+    return `${sign2}<$0.01`;
+  return `${sign2}$${abs.toLocaleString("en-US", { minimumFractionDigits: 2, maximumFractionDigits: 2 })}`;
+}
+function formatPrice(value) {
+  if (!Number.isFinite(value) || value <= 0)
+    return "?";
+  if (value >= 1)
+    return formatUsd(value);
+  return `$${Number(value.toPrecision(4)).toLocaleString("en-US", { maximumFractionDigits: 12 })}`;
+}
+function formatAmount(raw, decimals) {
+  const digits = BigInt(raw).toString().padStart(decimals + 1, "0");
+  if (decimals === 0)
+    return digits;
+  const whole = digits.slice(0, -decimals);
+  const fraction = digits.slice(-decimals).replace(/0+$/, "");
+  return fraction ? `${whole}.${fraction}` : whole;
+}
+function formatQuantity(value) {
+  if (!Number.isFinite(value))
+    return "?";
+  return value.toLocaleString("en-US", { maximumFractionDigits: 6 });
+}
+function shortAddress2(address) {
+  return address.length > 12 ? `${address.slice(0, 4)}…${address.slice(-4)}` : address;
+}
+
+// src/commands/pnl.ts
+var NO_API_KEY2 = {
+  code: "NO_API_KEY",
+  message: "No API key for this profile.",
+  suggestion: "Set CANDLE_API_KEY, or run `candle auth login` to store one."
+};
+async function pnl(args, ctx) {
+  const { deps, apiUrl, json } = ctx;
+  const parsed = parseArgs(args, {});
+  if ("error" in parsed) {
+    writeUsageFailure(deps, parsed.error, json);
+    return 2;
+  }
+  if (parsed.positionals.length > 0) {
+    writeUsageFailure(deps, `Unexpected argument: ${parsed.positionals[0]}. Usage: candle pnl [--profile <name>]`, json);
+    return 2;
+  }
+  const apiKey = await resolveApiKey(deps, ctx.profile);
+  if (!apiKey) {
+    writeLocalFailure(deps, NO_API_KEY2, json);
+    return 1;
+  }
+  const perProfile = ctx.profileFlag !== undefined;
+  let keyPrefix;
+  if (perProfile) {
+    keyPrefix = apiKeyPrefix(apiKey);
+    if (keyPrefix === undefined) {
+      writeLocalFailure(deps, {
+        code: "BAD_REQUEST",
+        message: `The API key for profile ${ctx.profileFlag} is not a Candle agent key, so it names no profile to read.`,
+        suggestion: "Run `candle auth login --profile <name>` to store a key for that profile."
+      }, json);
+      return 1;
+    }
+  }
+  await printIdentity(ctx);
+  const path = perProfile ? `/api/v1/agent/keys/${encodeURIComponent(keyPrefix)}/pnl` : "/api/v1/agent/books";
+  const result = await apiRequest(path, {
+    auth: "key",
+    credentials: { apiKey },
+    apiUrl,
+    fetch: deps.fetch,
+    env: deps.env
+  });
+  if (!result.ok) {
+    if (!perProfile && result.code === "SCOPE_MISSING") {
+      writeLocalFailure(deps, {
+        code: "SCOPE_MISSING",
+        message: "The account's P&L needs a key with the Read scope (account:read); this profile's key has none.",
+        suggestion: "Log in with a Read or Read:Write key, or read this key's own P&L: candle pnl --profile <name>"
+      }, json);
+      return 1;
+    }
+    writeFailure(deps, result, { apiUrl, authType: "key" }, json);
+    return 1;
+  }
+  const body = result.body;
+  if (json) {
+    const { success: _success, ...rest } = body;
+    deps.stdout.write(`${JSON.stringify({ ok: true, scope: perProfile ? "profile" : "account", ...rest })}
+`);
+    return 0;
+  }
+  if (perProfile) {
+    const { pnl: p, lp } = body;
+    deps.stdout.write(`P&L for profile ${ctx.profileFlag} (key ${keyPrefix}): this key's own fills
+
+`);
+    writeSummary(ctx, {
+      realizedNetUsd: p.realizedNetUsd,
+      realizedGrossUsd: p.realizedGrossUsd,
+      feesUsd: p.feesUsd,
+      unrealizedUsd: p.unrealizedUsd,
+      unmarked: p.unmarkedPositions,
+      unvalued: p.unvalued,
+      counted: p.counted,
+      positions: p.openPositions.length,
+      truncated: p.truncated,
+      lookback: p.lookback,
+      lookbackUnit: "trades",
+      oldestMarkAt: p.oldestMarkAt,
+      lp
+    });
+    writePositions(ctx, p.openPositions, false);
+    writeLpPositions(ctx, lp, false);
+    return 0;
+  }
+  const books = body;
+  deps.stdout.write(`P&L for the account: every profile, the web app and the CLI, one ledger
+
+`);
+  writeSummary(ctx, {
+    ...books.all,
+    positions: books.positions.length,
+    truncated: books.truncated,
+    lookback: books.lookback,
+    lookbackUnit: "ledger rows",
+    oldestMarkAt: books.oldestMarkAt,
+    lp: books.lp
+  });
+  writePositions(ctx, books.positions, true);
+  writeLpPositions(ctx, books.lp, true);
+  return 0;
+}
+function writeSummary(ctx, s) {
+  const marked = s.positions - s.unmarked;
+  const lines = [
+    [
+      "Realized net",
+      formatUsd(s.realizedNetUsd),
+      `gross ${formatUsd(s.realizedGrossUsd)}, fees ${formatUsd(s.feesUsd)}`
+    ],
+    [
+      "Unrealized",
+      formatUsd(s.unrealizedUsd),
+      `${marked} of ${s.positions} open ${s.positions === 1 ? "position" : "positions"} marked${s.unmarked > 0 ? `; ${s.unmarked} unpriced, not counted` : ""}`
+    ]
+  ];
+  const lp = s.lp;
+  if (lp?.read) {
+    const plural = (n, one, many) => `${n} ${n === 1 ? one : many}`;
+    lines.push([
+      "LP realized",
+      formatUsd(lp.realizedUsd),
+      `withdrawn ${formatUsd(lp.withdrawnUsd)} against ${formatUsd(lp.realizedBasisUsd)} of cost basis, plus ${formatUsd(lp.claimedFeesUsd)} claimed fees`
+    ], [
+      "LP unrealized",
+      formatUsd(lp.unrealizedUsd),
+      `${lp.valued} of ${plural(lp.openPositions, "open LP position", "open LP positions")} valued${lp.unpriced > 0 ? `; ${lp.unpriced} unpriced, not counted` : ""}${lp.unreadable > 0 ? `; ${lp.unreadable} not read, not counted` : ""}${lp.closedOutsideLedger > 0 ? `; ${lp.closedOutsideLedger} closed outside the ledger, not counted` : ""}`
+    ], [
+      "LP vs holding",
+      lp.vsHoldingPositions > 0 ? formatUsd(lp.vsHoldingUsd) : "-",
+      lp.vsHoldingPositions > 0 ? `${lp.vsHoldingPositions} of ${lp.valued} valued, against holding the deposited tokens (now ${formatUsd(lp.holdValueUsd)})` : "no valued LP position with every deposit priced"
+    ], [
+      "Total",
+      formatUsd(s.realizedNetUsd + s.unrealizedUsd + lp.realizedUsd + lp.unrealizedUsd),
+      "realized net plus unrealized, tokens and LP"
+    ]);
+  } else if (lp) {
+    lines.push(["LP", "not read", `${terminalText(lp.reason)}; not in the total`], ["Total", formatUsd(s.realizedNetUsd + s.unrealizedUsd), "realized net plus unrealized, tokens only"]);
+  } else {
+    lines.push(["Total", formatUsd(s.realizedNetUsd + s.unrealizedUsd), "realized net plus unrealized"]);
+  }
+  const width = Math.max(...lines.map(([label]) => label.length));
+  const valueWidth = Math.max(...lines.map(([, value]) => value.length));
+  for (const [label, value, note] of lines) {
+    ctx.deps.stdout.write(`${label.padEnd(width)}  ${value.padStart(valueWidth)}  (${note})
+`);
+  }
+  if (s.oldestMarkAt !== undefined) {
+    ctx.deps.stdout.write(`Marks as old as ${new Date(s.oldestMarkAt).toISOString()}.
+`);
+  }
+  if (s.unvalued > 0 || (s.unresolved ?? 0) > 0) {
+    ctx.deps.stdout.write(`${s.unvalued} ${s.unvalued === 1 ? "fill" : "fills"} could not be valued and are not in these figures.
+`);
+  }
+  if (s.truncated) {
+    ctx.deps.stdout.write(`History is truncated: this covers the most recent ${s.lookback} ${s.lookbackUnit}, not the account's lifetime.
+`);
+  }
+  if (lp?.read) {
+    if (lp.unvalued > 0) {
+      ctx.deps.stdout.write(`${lp.unvalued} LP ledger ${lp.unvalued === 1 ? "leg" : "legs"} could not be valued and ${lp.unvalued === 1 ? "is" : "are"} not in these figures.
+`);
+    }
+    if (lp.closedOutsideLedger > 0) {
+      ctx.deps.stdout.write(`${lp.closedOutsideLedger} LP ${lp.closedOutsideLedger === 1 ? "position was" : "positions were"} closed outside the ledger (a sweep close writes no confirmation), so ${lp.closedOutsideLedger === 1 ? "its" : "their"} result is unknown and not in these figures.
+`);
+    }
+    if (lp.truncated) {
+      ctx.deps.stdout.write(`LP history is truncated: this covers the most recent ${lp.lookback} LP operations, not the account's lifetime.
+`);
+    }
+  }
+}
+function writeLpPositions(ctx, lp, withBook) {
+  if (!lp?.read || lp.positions.length === 0)
+    return;
+  const headers = ["POSITION", "POOL", "WALLET", "VALUE", "COST BASIS", "UNREALIZED", "VS HOLDING"];
+  if (withBook)
+    headers.push("BOOK");
+  const value = (p) => p.status === "valued" && p.valueUsd !== undefined ? formatUsd(p.valueUsd) : p.status === "unpriced" ? "unpriced" : p.status === "unreadable" ? "not read" : "closed outside the ledger";
+  const rows = lp.positions.map((p) => {
+    const row = [
+      shortAddress2(p.position),
+      shortAddress2(p.pool),
+      shortAddress2(p.wallet),
+      value(p),
+      formatUsd(p.costBasisUsd),
+      p.unrealizedUsd !== undefined ? formatUsd(p.unrealizedUsd) : "-",
+      p.vsHoldingUsd !== undefined ? formatUsd(p.vsHoldingUsd) : "-"
+    ];
+    if (withBook)
+      row.push(p.book ?? "-");
+    return row;
+  });
+  ctx.deps.stdout.write(`
+Open LP positions
+${renderTable(headers, rows.map((row) => row.map(terminalText)))}
+`);
+}
+function writePositions(ctx, positions, withBook) {
+  if (positions.length === 0) {
+    ctx.deps.stdout.write(`
+No open positions.
+`);
+    return;
+  }
+  const headers = ["TOKEN", "QUANTITY", "AVG ENTRY", "MARK", "UNREALIZED"];
+  if (withBook)
+    headers.push("BOOK");
+  const rows = positions.map((p) => {
+    const row = [
+      p.symbol?.trim() || shortAddress2(p.mint),
+      formatQuantity(p.quantity),
+      formatPrice(p.avgEntryUsd),
+      p.markPriceUsd !== undefined ? formatPrice(p.markPriceUsd) : "unpriced",
+      p.unrealizedUsd !== undefined ? formatUsd(p.unrealizedUsd) : "-"
+    ];
+    if (withBook)
+      row.push(p.book ?? "-");
+    return row;
+  });
+  ctx.deps.stdout.write(`
+Open positions
+${renderTable(headers, rows.map((row) => row.map(terminalText)))}
+`);
+}
+
+// src/commands/portfolio.ts
+init_args();
+init_deps();
+init_profiles();
+init_render();
+init_solana_lite();
+init_store();
+init_vault_support();
+var SOL_MINT = "So11111111111111111111111111111111111111112";
+var KNOWN_SYMBOLS = {
+  [SOL_MINT]: "SOL",
+  EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v: "USDC",
+  "9dXSV8VWuYvGfTzqvkBeoFwH9ihVTybDuWo5VaJPCNDL": "CNDL"
+};
+var CHUNK = 100;
+var TOKEN_READS_IN_FLIGHT = 8;
+var NO_API_KEY3 = {
+  code: "NO_API_KEY",
+  message: "No API key for this profile.",
+  suggestion: "Set CANDLE_API_KEY, or run `candle auth login` to store one."
+};
+async function portfolio(args, ctx) {
+  const parsed = parseArgs(args, { valueFlags: ["--rpc-url", "--keystore"], pathFlags: ["--keystore"] });
+  if ("error" in parsed)
+    return usage(ctx, parsed.error);
+  if (parsed.positionals.length > 0)
+    return usage(ctx, `Unexpected argument: ${parsed.positionals[0]}`);
+  const { deps } = ctx;
+  const apiKey = await resolveApiKey(deps, ctx.profile);
+  if (!apiKey) {
+    writeLocalFailure(deps, NO_API_KEY3, ctx.json);
+    return 1;
+  }
+  const rpcGiven = parsed.values["--rpc-url"] !== undefined || Boolean(deps.env[RPC_URL_ENV]?.trim());
+  let rpcUrl2;
+  if (rpcGiven) {
+    const resolved = rpcUrlFrom(ctx, parsed);
+    if (typeof resolved !== "string")
+      return usage(ctx, resolved.error);
+    rpcUrl2 = resolved;
+  }
+  const resolvedVault = vaultPathFor(ctx, parsed);
+  if ("error" in resolvedVault)
+    return usage(ctx, resolvedVault.error);
+  return runVaultCommand(ctx, async ({ hold }) => {
+    let vaultEntries;
+    let vaultReason;
+    const raw = rpcUrl2 === undefined ? null : await readVaultRaw(resolvedVault.path);
+    if (rpcUrl2 === undefined) {
+      vaultReason = `not read: vault balances are read only over your own RPC; pass --rpc-url or set ${RPC_URL_ENV}`;
+    } else if (raw === null) {
+      vaultReason = `no vault at ${resolvedVault.path}`;
+    } else {
+      if (!refuseEnvPassphrase(ctx))
+        return 1;
+      if (!requirePromptStreams(ctx, "portfolio"))
+        return 1;
+      const vault = hold((await unlockInteractively(ctx, resolvedVault.path, raw)).vault);
+      vaultEntries = vault.index.entries.filter((entry) => entry.chain === "solana" && (entry.role === "vault" || entry.role === "external")).map((entry) => ({ address: entry.address, label: entry.label, role: entry.role }));
+    }
+    await printIdentity(ctx);
+    const rpcHost = rpcUrl2 === undefined ? undefined : new URL(rpcUrl2).host;
+    if (vaultEntries && vaultEntries.length > 0 && rpcHost !== undefined) {
+      const requests = Math.ceil(vaultEntries.length / CHUNK) + vaultEntries.length * 2;
+      deps.stderr.write(`Reading ${vaultEntries.length} vault ${vaultEntries.length === 1 ? "address" : "addresses"} from ${rpcHost} in ${requests} requests. That endpoint sees them together; Candle sees none of them.
+`);
+    }
+    const [candle, vaultRead] = await Promise.all([
+      apiRequest("/api/v1/agent/portfolio", {
+        auth: "key",
+        credentials: { apiKey },
+        apiUrl: ctx.apiUrl,
+        fetch: deps.fetch,
+        env: deps.env
+      }),
+      vaultEntries && rpcUrl2 ? readOwnRpc(vaultEntries.map((entry) => entry.address), rpcUrl2, deps.fetch) : Promise.resolve(undefined)
+    ]);
+    if (!candle.ok) {
+      writeFailure(deps, candle, { apiUrl: ctx.apiUrl, authType: "key" }, ctx.json);
+      return 1;
+    }
+    const fromCandle = candle.body;
+    const prices = { ...fromCandle.prices ?? {} };
+    let priceFailure;
+    if (vaultRead) {
+      const wanted = new Set;
+      for (const wallet2 of vaultRead.byAddress.values()) {
+        if (wallet2.lamports !== null)
+          wanted.add(SOL_MINT);
+        for (const token of wallet2.tokens ?? [])
+          wanted.add(token.mint);
+      }
+      const missing = [...wanted].filter((mint) => prices[mint] === undefined);
+      for (let at = 0;at < missing.length; at += CHUNK) {
+        const priced = await apiRequest("/api/v1/agent/prices", {
+          method: "POST",
+          body: { mints: missing.slice(at, at + CHUNK) },
+          auth: "key",
+          credentials: { apiKey },
+          apiUrl: ctx.apiUrl,
+          fetch: deps.fetch,
+          env: deps.env
+        });
+        if (priced.ok)
+          Object.assign(prices, priced.body.prices ?? {});
+        else
+          priceFailure ??= priced.message;
+      }
+    }
+    if (priceFailure !== undefined) {
+      deps.stderr.write(`Some vault holdings could not be priced: ${terminalText(priceFailure)}. They are shown as unpriced.
+`);
+    }
+    const lpByWallet = new Map;
+    const lpOf = (address) => {
+      const entry = lpByWallet.get(address) ?? { positions: [], unread: [] };
+      lpByWallet.set(address, entry);
+      return entry;
+    };
+    for (const position of fromCandle.lp?.positions ?? [])
+      lpOf(position.wallet).positions.push(lpRow(position, prices));
+    for (const unread of fromCandle.lp?.unreadable ?? [])
+      lpOf(unread.wallet).unread.push(unread.position);
+    const wallet = (address, read, extra) => {
+      const holdings = read === undefined ? null : valueHoldings(read, prices);
+      const unread = read === undefined ? [] : [...read.lamports === null ? ["sol"] : [], ...read.tokens === null ? ["tokens"] : []];
+      const lp2 = fromCandle.lp ? lpOf(address) : undefined;
+      return {
+        address,
+        ...extra,
+        holdings,
+        ...unread.length > 0 ? { unread } : {},
+        ...lp2 ? { lpPositions: lp2.positions } : {},
+        ...lp2 && lp2.unread.length > 0 ? { lpUnread: lp2.unread } : {},
+        valueUsd: (holdings ?? []).reduce((sum, h) => sum + (h.valueUsd ?? 0), 0) + (lp2?.positions ?? []).reduce((sum, p) => sum + (p.valueUsd ?? 0), 0),
+        unpriced: (holdings ?? []).filter((h) => h.priceUsd === null).length + (lp2?.positions ?? []).filter((p) => p.valueUsd === null).length
+      };
+    };
+    const group = (name, wallets, read, reason) => ({
+      group: name,
+      read,
+      ...reason !== undefined ? { reason } : {},
+      wallets,
+      valueUsd: wallets.reduce((sum, w) => sum + w.valueUsd, 0),
+      unpriced: wallets.reduce((sum, w) => sum + w.unpriced, 0)
+    });
+    const orNull = (read) => read.lamports === null && read.tokens === null ? undefined : read;
+    const groups = [
+      group("vault", (vaultEntries ?? []).map((entry) => {
+        const read = vaultRead?.byAddress.get(entry.address);
+        return wallet(entry.address, read ? orNull(read) : undefined, { label: entry.label, role: entry.role });
+      }), vaultEntries !== undefined, vaultReason),
+      group("tee", (fromCandle.tee ?? []).map((row) => wallet(row.address, orNull(row), {
+        id: row.id,
+        ...row.label ? { label: row.label } : {},
+        active: row.active
+      })), true),
+      group("embedded", (fromCandle.embedded ?? []).map((row) => wallet(row.address, orNull(row), {})), true)
+    ];
+    const unavailable = [...vaultRead?.unavailable ?? [], ...fromCandle.unavailable ?? []];
+    const lpUnread = (fromCandle.lp?.unreadable ?? []).length;
+    const complete = fromCandle.complete !== false && unavailable.length === 0 && lpUnread === 0;
+    const totalUsd = groups.reduce((sum, g) => sum + g.valueUsd, 0);
+    const unpriced = groups.reduce((sum, g) => sum + g.unpriced, 0);
+    const lp = fromCandle.lp ? {
+      positions: fromCandle.lp.positions.length,
+      unpriced: fromCandle.lp.positions.filter((p) => p.valueUsd === null).length,
+      unreadable: lpUnread,
+      valueUsd: fromCandle.lp.positions.reduce((sum, p) => sum + (p.valueUsd ?? 0), 0)
+    } : undefined;
+    if (ctx.json) {
+      writeJson(deps, {
+        ok: true,
+        totalUsd,
+        unpriced,
+        complete,
+        unavailable,
+        ...rpcHost !== undefined ? { rpcHost } : {},
+        ...lp ? { lp } : {},
+        groups
+      });
+      return complete ? 0 : 3;
+    }
+    writeTable(ctx, groups, { totalUsd, unpriced, unavailable: unavailable.length, lp });
+    return complete ? 0 : 3;
+  });
+}
+async function readOwnRpc(addresses, rpcUrl2, fetchFn) {
+  const rpc2 = createSolanaRpc(rpcUrl2, fetchFn);
+  const unique = [...new Set(addresses)];
+  const lamports = new Map;
+  for (let at = 0;at < unique.length; at += CHUNK) {
+    const chunk = unique.slice(at, at + CHUNK);
+    try {
+      const accounts = await rpc2.getMultipleAccounts(chunk);
+      for (const [i, address] of chunk.entries())
+        lamports.set(address, (accounts[i]?.lamports ?? 0n).toString());
+    } catch {
+      for (const address of chunk)
+        lamports.set(address, null);
+    }
+  }
+  const tokens = new Map;
+  const failed = new Set;
+  const reads = unique.flatMap((owner) => [TOKEN_PROGRAM_ID, TOKEN_2022_PROGRAM_ID].map((programId) => ({ owner, programId })));
+  let next = 0;
+  await Promise.all(Array.from({ length: Math.min(TOKEN_READS_IN_FLIGHT, reads.length) }, async () => {
+    while (next < reads.length) {
+      const { owner, programId } = reads[next++];
+      try {
+        const accounts = await rpc2.getTokenAccountsByOwner(owner, programId);
+        const held = tokens.get(owner) ?? new Map;
+        tokens.set(owner, held);
+        const program = programId === TOKEN_PROGRAM_ID ? "token" : "token-2022";
+        for (const account of accounts) {
+          if (!/^\d+$/.test(account.amountRaw) || BigInt(account.amountRaw) === 0n)
+            continue;
+          const key = `${program}:${account.mint}`;
+          const prior = held.get(key);
+          held.set(key, {
+            mint: account.mint,
+            amountRaw: (BigInt(prior?.amountRaw ?? "0") + BigInt(account.amountRaw)).toString(),
+            decimals: account.decimals,
+            program
+          });
+        }
+      } catch {
+        failed.add(owner);
+      }
+    }
+  }));
+  const byAddress = new Map;
+  const unavailable = [];
+  for (const address of unique) {
+    const sol = lamports.get(address) ?? null;
+    const held = failed.has(address) ? null : [...tokens.get(address)?.values() ?? []];
+    byAddress.set(address, { lamports: sol, tokens: held });
+    if (sol === null || held === null)
+      unavailable.push(address);
+  }
+  return { byAddress, unavailable };
+}
+function valueHoldings(read, prices) {
+  const raw = [];
+  if (read.lamports !== null && BigInt(read.lamports) > 0n) {
+    raw.push({ mint: SOL_MINT, amountRaw: read.lamports, decimals: 9, program: "native" });
+  }
+  for (const token of read.tokens ?? [])
+    raw.push(token);
+  return raw.map((h) => {
+    const price = prices[h.mint];
+    const priceUsd = price?.priceUsd ?? null;
+    const amount = formatAmount(h.amountRaw, h.decimals);
+    return {
+      ...h,
+      symbol: KNOWN_SYMBOLS[h.mint] ?? price?.symbol ?? null,
+      amount,
+      priceUsd,
+      valueUsd: priceUsd === null ? null : Number(amount) * priceUsd,
+      priceSource: price?.source ?? null
+    };
+  });
+}
+function lpRow(position, prices) {
+  return {
+    position: position.position,
+    pool: position.pool,
+    tokens: position.tokens.map((token) => ({
+      ...token,
+      symbol: KNOWN_SYMBOLS[token.mint] ?? token.symbol ?? prices[token.mint]?.symbol ?? null,
+      amount: formatAmount(token.amountRaw, token.decimals),
+      unclaimedFees: formatAmount(token.unclaimedFeesRaw, token.decimals)
+    })),
+    ...position.poolShare !== undefined ? { poolShare: position.poolShare } : {},
+    valueUsd: position.valueUsd,
+    unpriced: position.unpriced
+  };
+}
+function writeTable(ctx, groups, totals) {
+  const { deps } = ctx;
+  const rows = [];
+  const lpRows = [];
+  const notes = [];
+  for (const g of groups) {
+    const shown = g.wallets.filter((w) => w.holdings === null || w.holdings.length > 0 || (w.unread?.length ?? 0) > 0 || (w.lpPositions?.length ?? 0) > 0 || (w.lpUnread?.length ?? 0) > 0).sort((a, b) => b.valueUsd - a.valueUsd);
+    let lpCount = 0;
+    let lpUnread = 0;
+    for (const w of shown) {
+      const name = `${w.label ? `${w.label} ` : ""}(${shortAddress2(w.address)})${w.role === "external" ? " external" : ""}`;
+      const side = (t, amount) => `${amount} ${t.symbol ?? shortAddress2(t.mint)}`;
+      for (const p of [...w.lpPositions ?? []].sort((a, b) => (b.valueUsd ?? -1) - (a.valueUsd ?? -1))) {
+        lpCount += 1;
+        lpRows.push([
+          g.group,
+          name,
+          shortAddress2(p.position),
+          shortAddress2(p.pool),
+          p.tokens.map((t) => side(t, t.amount)).join(" + "),
+          p.tokens.map((t) => side(t, t.unclaimedFees)).join(" + "),
+          p.valueUsd === null ? "unpriced" : formatUsd(p.valueUsd)
+        ]);
+      }
+      for (const position of w.lpUnread ?? []) {
+        lpUnread += 1;
+        lpRows.push([g.group, name, shortAddress2(position), "-", "not read", "-", "-"]);
+      }
+      if (w.holdings === null) {
+        rows.push([g.group, name, "-", "not read", "-", "-"]);
+        continue;
+      }
+      const sorted = [...w.holdings].sort((a, b) => (b.valueUsd ?? -1) - (a.valueUsd ?? -1));
+      for (const h of sorted) {
+        rows.push([
+          g.group,
+          name,
+          h.symbol ?? shortAddress2(h.mint),
+          h.amount,
+          h.priceUsd === null ? "unpriced" : formatPrice(h.priceUsd),
+          h.valueUsd === null ? "-" : formatUsd(h.valueUsd)
+        ]);
+      }
+      for (const part of w.unread ?? [])
+        rows.push([g.group, name, part === "sol" ? "SOL" : "tokens", "not read", "-", "-"]);
+    }
+    const empty = g.wallets.length - shown.length;
+    const count = `${g.wallets.length} ${g.wallets.length === 1 ? "wallet" : "wallets"}`;
+    notes.push([
+      g.group,
+      g.read ? formatUsd(g.valueUsd) : "-",
+      g.read ? `${count}${empty > 0 ? `, ${empty} empty not shown` : ""}${lpCount > 0 ? `, ${lpCount} LP ${lpCount === 1 ? "position" : "positions"}` : ""}${lpUnread > 0 ? `, ${lpUnread} LP not read` : ""}${g.unpriced > 0 ? `, ${g.unpriced} unpriced` : ""}` : g.reason ?? "not read"
+    ]);
+  }
+  if (rows.length > 0)
+    deps.stdout.write(`
+${renderTable(["GROUP", "WALLET", "TOKEN", "AMOUNT", "PRICE", "VALUE"], rows.map((row) => row.map(terminalText)))}
+`);
+  else
+    deps.stdout.write(`
+Nothing held in any wallet read.
+`);
+  if (lpRows.length > 0)
+    deps.stdout.write(`
+LP positions
+${renderTable(["GROUP", "WALLET", "POSITION", "POOL", "HOLDINGS", "UNCLAIMED FEES", "VALUE"], lpRows.map((row) => row.map(terminalText)))}
+`);
+  notes.push([
+    "total",
+    formatUsd(totals.totalUsd),
+    totals.unpriced > 0 ? `${totals.unpriced} unpriced ${totals.unpriced === 1 ? "holding" : "holdings"} not counted` : "every holding priced"
+  ]);
+  const width = Math.max(...notes.map(([label]) => label.length));
+  const valueWidth = Math.max(...notes.map(([, value]) => value.length));
+  deps.stdout.write(`
+`);
+  for (const [label, value, note] of notes) {
+    deps.stdout.write(`${label.padEnd(width)}  ${value.padStart(valueWidth)}  ${note}
+`);
+  }
+  if (totals.unavailable > 0) {
+    deps.stdout.write(`${totals.unavailable} ${totals.unavailable === 1 ? "wallet" : "wallets"} could not be read in full. What was not read is marked "not read" and is not in the total.
+`);
+  }
+  if ((totals.lp?.unreadable ?? 0) > 0) {
+    const n = totals.lp?.unreadable ?? 0;
+    deps.stdout.write(`${n} LP ${n === 1 ? "position" : "positions"} could not be read (the pool did not answer). ${n === 1 ? "It is" : "They are"} marked "not read" and not in the total.
+`);
+  }
+}
+
 // src/commands/profile.ts
 init_args();
 init_profiles();
@@ -45353,7 +46545,7 @@ async function readMints(rpc2, mints) {
   }
   return out;
 }
-function formatAmount(raw, decimals) {
+function formatAmount2(raw, decimals) {
   if (decimals === undefined)
     return `${raw} raw`;
   const negative = raw < 0n;
@@ -45363,7 +46555,7 @@ function formatAmount(raw, decimals) {
   return `${negative ? "-" : ""}${whole}${frac ? `.${frac}` : ""}`;
 }
 function formatSol(lamports) {
-  return `${formatAmount(lamports, 9)} SOL`;
+  return `${formatAmount2(lamports, 9)} SOL`;
 }
 function displayLines(input) {
   const { tx, compiled, signers, simulation, mints } = input;
@@ -45386,7 +46578,7 @@ function displayLines(input) {
     }
     for (const token of deltas.tokens.filter((delta) => delta.owner === entry.address)) {
       const info = mints.get(token.mint);
-      lines.push(`            ${token.mint}: ${formatAmount(token.before, info?.decimals)} -> ${formatAmount(token.after, info?.decimals)} (${token.after >= token.before ? "+" : ""}${formatAmount(token.after - token.before, info?.decimals)}${info?.decimals === undefined ? "" : `, ${info.decimals} dp`}) in ${token.account}`);
+      lines.push(`            ${token.mint}: ${formatAmount2(token.before, info?.decimals)} -> ${formatAmount2(token.after, info?.decimals)} (${token.after >= token.before ? "+" : ""}${formatAmount2(token.after - token.before, info?.decimals)}${info?.decimals === undefined ? "" : `, ${info.decimals} dp`}) in ${token.account}`);
     }
   }
   const others = [];
@@ -45401,7 +46593,7 @@ function displayLines(input) {
     if (signerAddresses.has(token.owner) || token.after <= token.before)
       continue;
     const info = mints.get(token.mint);
-    others.push(`${token.owner} receives +${formatAmount(token.after - token.before, info?.decimals)} of ${token.mint} (account ${token.account})`);
+    others.push(`${token.owner} receives +${formatAmount2(token.after - token.before, info?.decimals)} of ${token.mint} (account ${token.account})`);
   }
   if (others.length === 0)
     lines.push("others      no other account gains a balance in the simulation");
@@ -45689,6 +46881,285 @@ async function signMessage2(args, ctx) {
 init_esm();
 init_args();
 init_deps();
+
+// src/lp-close.ts
+init_solana_lite();
+var DAMM_V2_PROGRAM_ID = "cpamdpZCGKUy5JxQXB4dcpGPiikHawvSWAd6mEn1sGG";
+var CLOSE_PROGRAM_ALLOWLIST = new Set([
+  DAMM_V2_PROGRAM_ID,
+  TOKEN_PROGRAM_ID,
+  TOKEN_2022_PROGRAM_ID,
+  ASSOCIATED_TOKEN_PROGRAM_ID,
+  COMPUTE_BUDGET_PROGRAM_ID,
+  SYSTEM_PROGRAM_ID
+]);
+var DAMM_POSITION_CLOSE_UNAVAILABLE = "DAMM_POSITION_CLOSE_UNAVAILABLE";
+var DAMM_CLOSE_TRANSACTION_REFUSED = "DAMM_CLOSE_TRANSACTION_REFUSED";
+function isPositionCandidate(account) {
+  return account.programId === TOKEN_2022_PROGRAM_ID && account.amountRaw === "1" && account.decimals === 0;
+}
+function parseCloseArtifact(body) {
+  if (!body || typeof body !== "object")
+    return;
+  const { transaction, accountKeys } = body;
+  if (typeof transaction !== "string" || transaction.length === 0)
+    return;
+  if (!Array.isArray(accountKeys) || !accountKeys.every((key) => typeof key === "string" && key.length > 0))
+    return;
+  return { transaction, accountKeys };
+}
+var MINT_BASE_SIZE2 = 82;
+var ACCOUNT_TYPE_OFFSET2 = 165;
+var ACCOUNT_TYPE_MINT = 1;
+var MULTISIG_SIZE2 = 355;
+var TOKEN_ACCOUNT_SIZE2 = 165;
+var TOKEN_ACCOUNT_STATE_INITIALIZED = 1;
+var CONTROL_RANGES = [
+  [0, 32, "mint"],
+  [32, 64, "authority"],
+  [72, 108, "delegate"],
+  [108, 109, "state"],
+  [121, 129, "delegated amount"],
+  [129, 165, "close authority"]
+];
+var TOKEN_IX_CLOSE_ACCOUNT = 9;
+var ATA_IX_CREATE = 0;
+var ATA_IX_CREATE_IDEMPOTENT = 1;
+function isTokenProgram(owner) {
+  return owner === TOKEN_PROGRAM_ID || owner === TOKEN_2022_PROGRAM_ID;
+}
+function isMintAccount(view) {
+  if (view === null || !isTokenProgram(view.owner))
+    return false;
+  if (view.data.length === MINT_BASE_SIZE2)
+    return true;
+  if (view.data.length === MULTISIG_SIZE2)
+    return false;
+  return view.data.length > ACCOUNT_TYPE_OFFSET2 && view.data[ACCOUNT_TYPE_OFFSET2] === ACCOUNT_TYPE_MINT;
+}
+function isUnsigned(tx) {
+  return tx.signatures.every((slot) => slot.every((byte) => byte === 0));
+}
+function bytesEqual2(a, b) {
+  return a.length === b.length && a.every((byte, i) => byte === b[i]);
+}
+function allZero(bytes) {
+  return bytes.every((byte) => byte === 0);
+}
+async function verifyCloseArtifact(input) {
+  const { artifact, rpc: rpc2, tee, vault, nftMint, nftAccount } = input;
+  const refuse2 = (reason) => ({ ok: false, reason });
+  const allowedOwner = (address) => address === tee || address === vault;
+  let tx;
+  try {
+    tx = decodeTransaction(decodeStrictBase64(artifact.transaction));
+  } catch (error) {
+    if (error instanceof TransactionDecodeError)
+      return refuse2(`the close transaction is undecodable: ${error.message}`);
+    return refuse2(`the close transaction could not be read: ${error instanceof Error ? error.message : error}`);
+  }
+  if (tx.message.version !== 0)
+    return refuse2("the close transaction is not a v0 message");
+  if (!isUnsigned(tx))
+    return refuse2("the close transaction already carries a signature; close-build must return it unsigned");
+  if (tx.message.numRequiredSignatures !== 1)
+    return refuse2(`the close transaction requires ${tx.message.numRequiredSignatures} signers; a position close needs only the TEE wallet`);
+  if (tx.message.staticKeys[0] !== tee)
+    return refuse2(`the fee payer is ${tx.message.staticKeys[0]}, not the TEE wallet`);
+  let compiled;
+  try {
+    compiled = await resolveCompiledKeys(tx.message, rpc2);
+  } catch (error) {
+    if (error instanceof LookupTableError)
+      return refuse2(`a lookup table could not be resolved: ${error.message}`);
+    return refuse2(`the lookup tables could not be read: ${error instanceof Error ? error.message : error}`);
+  }
+  if (compiled.keys.length !== artifact.accountKeys.length)
+    return refuse2(`the server listed ${artifact.accountKeys.length} account keys and the transaction resolves to ${compiled.keys.length}`);
+  for (const [i, key] of compiled.keys.entries()) {
+    if (artifact.accountKeys[i] !== key)
+      return refuse2(`account key ${i} is ${key} in the transaction and ${artifact.accountKeys[i]} in the server's ordered array`);
+  }
+  let dammCalls = 0;
+  for (const [i, ix] of tx.message.instructions.entries()) {
+    const program = compiled.keys[ix.programIdIndex];
+    const account = (at) => compiled.keys[ix.accountIndexes[at] ?? -1];
+    if (program === undefined || !CLOSE_PROGRAM_ALLOWLIST.has(program))
+      return refuse2(`instruction ${i} calls ${program ?? "an unknown program"}, which a position close never does`);
+    switch (program) {
+      case DAMM_V2_PROGRAM_ID:
+        dammCalls += 1;
+        break;
+      case COMPUTE_BUDGET_PROGRAM_ID:
+        break;
+      case ASSOCIATED_TOKEN_PROGRAM_ID: {
+        const kind = ix.data.length === 0 ? ATA_IX_CREATE : ix.data.length === 1 ? ix.data[0] : -1;
+        if (kind !== ATA_IX_CREATE && kind !== ATA_IX_CREATE_IDEMPOTENT)
+          return refuse2(`instruction ${i} is an Associated Token instruction other than Create, which a close never needs`);
+        if (account(0) !== tee || !allowedOwner(account(2) ?? ""))
+          return refuse2(`instruction ${i} creates a token account for ${account(2) ?? "?"}, not the TEE wallet or its vault`);
+        break;
+      }
+      case TOKEN_PROGRAM_ID:
+      case TOKEN_2022_PROGRAM_ID: {
+        if (ix.data[0] !== TOKEN_IX_CLOSE_ACCOUNT || ix.data.length !== 1)
+          return refuse2(`instruction ${i} is a token instruction other than CloseAccount, which a close never issues at the top level`);
+        if (account(1) !== tee || account(2) !== tee)
+          return refuse2(`instruction ${i} closes a token account to ${account(1) ?? "?"}, not the TEE wallet`);
+        break;
+      }
+      default:
+        return refuse2(`instruction ${i} is a top-level System instruction, which a close never issues`);
+    }
+  }
+  if (dammCalls === 0)
+    return refuse2("the transaction calls no DAMM v2 instruction, so it cannot close a position");
+  let simulation;
+  try {
+    simulation = await simulateWithSnapshots(rpc2, artifact.transaction, compiled);
+  } catch (error) {
+    return refuse2(`the simulation could not be run: ${error instanceof Error ? error.message : error}`);
+  }
+  if (simulation.result.err !== null && simulation.result.err !== undefined)
+    return refuse2(`the simulation failed: ${JSON.stringify(simulation.result.err)}`);
+  const deltas = computeDeltas(simulation.snapshots);
+  const postState = new Map(simulation.snapshots.map((snapshot) => [snapshot.address, snapshot.after]));
+  for (const token of deltas.tokens) {
+    if (token.after > token.before && !allowedOwner(token.owner))
+      return refuse2(`${token.owner} would receive ${token.after - token.before} raw of ${token.mint} in account ${token.account}`);
+  }
+  for (const sol of deltas.sol) {
+    if (sol.after <= sol.before)
+      continue;
+    if (allowedOwner(sol.address))
+      continue;
+    const balance = tokenBalanceOf(postState.get(sol.address) ?? null);
+    if (balance !== undefined && allowedOwner(balance.owner))
+      continue;
+    return refuse2(`${sol.address} would receive ${sol.after - sol.before} lamports`);
+  }
+  const nftSnapshot = simulation.snapshots.find((snapshot) => snapshot.address === nftAccount);
+  if (nftSnapshot === undefined)
+    return refuse2(`the position NFT account ${nftAccount} is not written by this transaction`);
+  const nftAfter = tokenBalanceOf(nftSnapshot.after);
+  if (nftAfter !== undefined && nftAfter.amount !== 0n)
+    return refuse2(`the position NFT account ${nftAccount} still holds ${nftAfter.amount} after the simulation`);
+  for (const { address, before, after } of simulation.snapshots) {
+    if (allowedOwner(address)) {
+      if (after === null || after.owner !== SYSTEM_PROGRAM_ID || after.data.length !== 0)
+        return refuse2(`${address === tee ? "the TEE wallet" : "the vault"} would no longer be a plain System account after this transaction`);
+    }
+    if (after === null)
+      continue;
+    if (before !== null && after.owner !== before.owner)
+      return refuse2(`writable account ${address} would change owner from ${before.owner} to ${after.owner}`);
+    if (before !== null) {
+      const controlled = tokenBalanceOf(before);
+      if (controlled !== undefined && allowedOwner(controlled.owner)) {
+        if (after.data.length < TOKEN_ACCOUNT_SIZE2)
+          return refuse2(`token account ${address} would no longer decode as a token account`);
+        for (const [start, end, what] of CONTROL_RANGES) {
+          if (!bytesEqual2(before.data.subarray(start, end), after.data.subarray(start, end)))
+            return refuse2(`token account ${address} would change its ${what}, which a close never does`);
+        }
+        continue;
+      }
+    }
+    const created = before === null ? tokenBalanceOf(after) : undefined;
+    if (created !== undefined) {
+      if (!allowedOwner(created.owner))
+        return refuse2(`created token account ${address} would be controlled by ${created.owner}`);
+      if (!allZero(after.data.subarray(72, 108)) || after.data[108] !== TOKEN_ACCOUNT_STATE_INITIALIZED || !allZero(after.data.subarray(121, 129)) || !allZero(after.data.subarray(129, 165)))
+        return refuse2(`created token account ${address} would start with a delegate, a close authority, or a frozen state`);
+    }
+  }
+  const infos = new Map;
+  const infoOf = async (address) => {
+    if (!infos.has(address))
+      infos.set(address, await rpc2.getAccountInfo(address));
+    return infos.get(address) ?? null;
+  };
+  const canonical = new Set;
+  for (const key of compiled.keys) {
+    const view = await infoOf(key);
+    if (!isMintAccount(view) || view === null)
+      continue;
+    const mint = decodePubkey(key);
+    const program = decodePubkey(view.owner);
+    canonical.add(encodePubkey(associatedTokenAddress(decodePubkey(tee), mint, program)));
+    canonical.add(encodePubkey(associatedTokenAddress(decodePubkey(vault), mint, program)));
+  }
+  for (const [i, key] of compiled.keys.entries()) {
+    if (!compiled.isWritable[i])
+      continue;
+    const view = await infoOf(key);
+    if (view === null) {
+      if (canonical.has(key))
+        continue;
+      return refuse2(`writable account ${key} does not exist and is not a TEE or vault associated token account for a mint this transaction names`);
+    }
+    if (isTokenProgram(view.owner)) {
+      if (key === nftMint)
+        continue;
+      const balance = tokenBalanceOf(view);
+      if (balance === undefined)
+        return refuse2(`writable account ${key} is owned by a token program but is not a token account`);
+      if (allowedOwner(balance.owner) || key === nftAccount)
+        continue;
+      const authority = await infoOf(balance.owner);
+      if (authority !== null && authority.owner === DAMM_V2_PROGRAM_ID)
+        continue;
+      return refuse2(`writable token account ${key} is controlled by ${balance.owner}, which is neither this wallet, its vault, nor a DAMM v2 pool`);
+    }
+    if (view.owner === SYSTEM_PROGRAM_ID) {
+      if (allowedOwner(key))
+        continue;
+      return refuse2(`writable system account ${key} is neither the TEE wallet nor its vault`);
+    }
+    if (view.owner !== DAMM_V2_PROGRAM_ID)
+      return refuse2(`writable account ${key} is owned by ${view.owner}, not DAMM v2`);
+  }
+  return { ok: true, tx, compiled, simulation };
+}
+function formatSol2(lamports) {
+  const negative = lamports < 0n;
+  const abs = negative ? -lamports : lamports;
+  const whole = abs / 1000000000n;
+  const frac = (abs % 1000000000n).toString().padStart(9, "0").replace(/0+$/, "");
+  return `${negative ? "-" : ""}${whole}${frac ? `.${frac}` : ""} SOL`;
+}
+function describeClose(input) {
+  const { verdict, tee, vault, nftMint, nftAccount } = input;
+  const { tx, compiled, simulation } = verdict;
+  const lines = [];
+  lines.push(`message     v0, ${tx.message.instructions.length} instruction(s), ${compiled.keys.length} account(s)${tx.message.lookups.length > 0 ? ` (${tx.message.lookups.length} lookup table(s) resolved)` : ""}, blockhash ${tx.message.recentBlockhash}`);
+  lines.push(`fee payer   ${compiled.keys[0]} (this TEE wallet)`);
+  lines.push(`position    NFT mint ${nftMint}, account ${nftAccount}`);
+  const programs = [...new Set(tx.message.instructions.map((ix) => compiled.keys[ix.programIdIndex] ?? "?"))];
+  for (const program of programs)
+    lines.push(`program     ${program === DAMM_V2_PROGRAM_ID ? `Meteora DAMM v2 (${program})` : programNameOf(program)}`);
+  const deltas = computeDeltas(simulation.snapshots);
+  const who = (address) => address === tee ? "wallet" : address === vault ? "vault" : address;
+  for (const address of [tee, vault]) {
+    const sol = deltas.sol.find((delta) => delta.address === address);
+    if (sol && sol.after !== sol.before)
+      lines.push(`${who(address).padEnd(11)} ${formatSol2(sol.before)} -> ${formatSol2(sol.after)} (${sol.after >= sol.before ? "+" : ""}${formatSol2(sol.after - sol.before)})`);
+    for (const token of deltas.tokens.filter((delta) => delta.owner === address && delta.after !== delta.before)) {
+      lines.push(`${who(address).padEnd(11)} ${token.mint}: ${token.before} -> ${token.after} raw (${token.after >= token.before ? "+" : ""}${token.after - token.before}) in ${token.account}${token.account === nftAccount ? " (position NFT, burned)" : ""}`);
+    }
+  }
+  const nft = simulation.snapshots.find((snapshot) => snapshot.address === nftAccount);
+  if (nft && nft.after === null)
+    lines.push(`position    NFT account ${nftAccount} is closed by this transaction`);
+  const others = deltas.tokens.filter((token) => token.owner !== tee && token.owner !== vault && token.after !== token.before);
+  for (const token of others)
+    lines.push(`${token.owner === undefined ? "?" : "pool"}        ${token.mint}: ${token.before} -> ${token.after} raw in ${token.account} (authority ${token.owner})`);
+  lines.push("checked     ordered keys, programs, simulation, positive deltas, control, writable accounts: all passed");
+  lines.push("note        the simulation is evidence, not a guarantee: a program can behave differently once signed");
+  return lines;
+}
+
+// src/commands/tee.ts
 init_profiles();
 init_render();
 init_solana_lite();
@@ -49429,8 +50900,8 @@ function readDisableOutcome(body) {
 var MIN_PASSPHRASE_LENGTH = 12;
 var USDC_MINT = "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v";
 var RPC_URL_ENV2 = "CANDLE_SOLANA_RPC_URL";
-var CONFIRM_POLL_MS2 = 2000;
-var CONFIRM_MAX_POLLS2 = 45;
+var CONFIRM_POLL_MS3 = 2000;
+var CONFIRM_MAX_POLLS3 = 45;
 function refuseEnvPassphrase2(ctx) {
   if (ctx.deps.env.CANDLE_KEYSTORE_PASSPHRASE === undefined)
     return true;
@@ -49441,7 +50912,7 @@ function refuseEnvPassphrase2(ctx) {
   }, ctx.json);
   return false;
 }
-function usage3(ctx, line) {
+function usage4(ctx, line) {
   writeUsageFailure(ctx.deps, line, ctx.json);
   return 2;
 }
@@ -49661,7 +51132,7 @@ async function openExistingTeeStore(ctx, parsed) {
   const { deps, json } = ctx;
   const found = await readTeeStore(ctx, parsed);
   if ("usage" in found)
-    return { ok: false, code: usage3(ctx, found.usage) };
+    return { ok: false, code: usage4(ctx, found.usage) };
   const { path } = found;
   if ("error" in found) {
     writeLocalFailure(deps, {
@@ -49758,12 +51229,12 @@ async function teeNew(args, ctx) {
     return 1;
   const parsed = parseArgs(args, { valueFlags: ["--label", "--keystore"], pathFlags: ["--keystore"] });
   if ("error" in parsed)
-    return usage3(ctx, parsed.error);
+    return usage4(ctx, parsed.error);
   if (parsed.positionals.length > 0)
-    return usage3(ctx, `Unexpected argument: ${parsed.positionals[0]}`);
+    return usage4(ctx, `Unexpected argument: ${parsed.positionals[0]}`);
   const found = await readTeeStore(ctx, parsed);
   if ("usage" in found)
-    return usage3(ctx, found.usage);
+    return usage4(ctx, found.usage);
   const { path } = found;
   if ("error" in found) {
     writeLocalFailure(deps, {
@@ -49840,15 +51311,15 @@ async function teeEnable(args, ctx) {
     pathFlags: ["--keystore"]
   });
   if ("error" in parsed)
-    return usage3(ctx, parsed.error);
+    return usage4(ctx, parsed.error);
   const [address, extra] = parsed.positionals;
   if (!address || extra !== undefined) {
-    return usage3(ctx, "Usage: candle tee enable <address> --vault <address> | --vault-key <label>");
+    return usage4(ctx, "Usage: candle tee enable <address> --vault <address> | --vault-key <label>");
   }
   const vaultFlag = parsed.values["--vault"];
   const vaultKey = parsed.values["--vault-key"];
   if (vaultFlag !== undefined && vaultKey !== undefined) {
-    return usage3(ctx, "Use either --vault or --vault-key, not both.");
+    return usage4(ctx, "Use either --vault or --vault-key, not both.");
   }
   let vault = vaultFlag;
   if (vaultKey !== undefined) {
@@ -49858,7 +51329,7 @@ async function teeEnable(args, ctx) {
     const { isVaultError: isVaultError2 } = await Promise.resolve().then(() => (init_errors(), exports_errors));
     const resolvedVault = vaultPathFor2(ctx, parsed);
     if ("error" in resolvedVault)
-      return usage3(ctx, resolvedVault.error);
+      return usage4(ctx, resolvedVault.error);
     const vaultPath = resolvedVault.path;
     const raw = await readVaultRaw2(vaultPath);
     if (raw === null) {
@@ -49896,11 +51367,11 @@ async function teeEnable(args, ctx) {
     }
   }
   if (!vault)
-    return usage3(ctx, "--vault <address> or --vault-key <label> is required: the destination every sweep sends to.");
+    return usage4(ctx, "--vault <address> or --vault-key <label> is required: the destination every sweep sends to.");
   if (!isSolanaAddress(vault))
-    return usage3(ctx, "--vault is not a valid Solana address.");
+    return usage4(ctx, "--vault is not a valid Solana address.");
   if (vault === address)
-    return usage3(ctx, "--vault must be a different address from the TEE wallet.");
+    return usage4(ctx, "--vault must be a different address from the TEE wallet.");
   const vaultOwned = await addressOwnedByVault(ctx, address);
   if (vaultOwned === "usage")
     return 2;
@@ -50037,20 +51508,20 @@ async function teeFund(args, ctx) {
     return 1;
   const parsed = parseArgs(args, { valueFlags: ["--amount", "--asset", "--keystore"], pathFlags: ["--keystore"] });
   if ("error" in parsed)
-    return usage3(ctx, parsed.error);
+    return usage4(ctx, parsed.error);
   const [address, extra] = parsed.positionals;
   if (!address || extra !== undefined)
-    return usage3(ctx, "Usage: candle tee fund <address> --amount <n> [--asset SOL|USDC]");
+    return usage4(ctx, "Usage: candle tee fund <address> --amount <n> [--asset SOL|USDC]");
   const asset = (parsed.values["--asset"] ?? "SOL").toUpperCase();
   if (asset !== "SOL" && asset !== "USDC")
-    return usage3(ctx, "--asset must be SOL or USDC.");
+    return usage4(ctx, "--asset must be SOL or USDC.");
   const amount = parsed.values["--amount"];
   if (!amount)
-    return usage3(ctx, "--amount <n> is required.");
+    return usage4(ctx, "--amount <n> is required.");
   const decimals = asset === "SOL" ? 9 : 6;
   const raw = decimalToRaw(amount, decimals);
   if (raw === null || raw === 0n)
-    return usage3(ctx, `--amount must be a positive decimal with at most ${decimals} decimal places.`);
+    return usage4(ctx, `--amount must be a positive decimal with at most ${decimals} decimal places.`);
   const resolved = await resolveTeeAddress(ctx, parsed, address, () => openExistingTeeStore(ctx, parsed));
   if (!resolved.ok)
     return resolved.code;
@@ -50117,10 +51588,10 @@ async function teeStatus(args, ctx) {
     return 1;
   const parsed = parseArgs(args, { valueFlags: ["--rpc-url", "--keystore"], pathFlags: ["--keystore"] });
   if ("error" in parsed)
-    return usage3(ctx, parsed.error);
+    return usage4(ctx, parsed.error);
   const [address, extra] = parsed.positionals;
   if (!address || extra !== undefined)
-    return usage3(ctx, "Usage: candle tee status <address> [--rpc-url <url>]");
+    return usage4(ctx, "Usage: candle tee status <address> [--rpc-url <url>]");
   const resolved = await resolveTeeAddress(ctx, parsed, address, () => openExistingTeeStore(ctx, parsed));
   if (!resolved.ok)
     return resolved.code;
@@ -50162,7 +51633,7 @@ async function teeStatus(args, ctx) {
     if (rpcUrl2) {
       const checked = rpcUrlFrom2(ctx, parsed);
       if (typeof checked !== "string")
-        return usage3(ctx, checked.error);
+        return usage4(ctx, checked.error);
       const rpc2 = createSolanaRpc(checked, deps.fetch);
       try {
         const lamports = await rpc2.getBalance(address);
@@ -50243,10 +51714,10 @@ async function teeDisable(args, ctx) {
     return 1;
   const parsed = parseArgs(args, { valueFlags: ["--keystore"], pathFlags: ["--keystore"] });
   if ("error" in parsed)
-    return usage3(ctx, parsed.error);
+    return usage4(ctx, parsed.error);
   const [address, extra] = parsed.positionals;
   if (!address || extra !== undefined)
-    return usage3(ctx, "Usage: candle tee disable <address>");
+    return usage4(ctx, "Usage: candle tee disable <address>");
   await printIdentity(ctx);
   const openedActive = await openActiveTee(ctx, parsed, address, "read");
   if (!openedActive.ok)
@@ -50341,6 +51812,9 @@ function refusalState(raw) {
 async function broadcastAndFinalize2(rpc2, deps, secret, feePayer, instructions, pending, recordPending, clearPending) {
   const blockhash = await rpc2.getLatestBlockhash();
   const message = compileLegacyMessage({ feePayer, recentBlockhash: blockhash, instructions });
+  return broadcastMessage(rpc2, deps, secret, message, blockhash, pending, recordPending, clearPending);
+}
+async function broadcastMessage(rpc2, deps, secret, message, blockhash, pending, recordPending, clearPending) {
   const signatureBytes = signMessage(message, secret);
   const signature = base58.encode(signatureBytes);
   const wire = serializeSignedTransaction(message, signatureBytes);
@@ -50366,7 +51840,7 @@ async function broadcastAndFinalize2(rpc2, deps, secret, feePayer, instructions,
       error: `send did not answer cleanly (${error instanceof Error ? error.message : error}); it may still land`
     };
   }
-  for (let i = 0;i < CONFIRM_MAX_POLLS2; i++) {
+  for (let i = 0;i < CONFIRM_MAX_POLLS3; i++) {
     let status;
     try {
       status = await rpc2.getSignatureStatus(signature);
@@ -50388,12 +51862,12 @@ async function broadcastAndFinalize2(rpc2, deps, secret, feePayer, instructions,
         error: `transaction ${signature} failed on chain: ${JSON.stringify(observed.err)}`
       };
     }
-    await deps.sleep(CONFIRM_POLL_MS2);
+    await deps.sleep(CONFIRM_POLL_MS3);
   }
   return {
     status: "uncertain",
     signature,
-    error: `transaction ${signature} was not finalized within ${CONFIRM_MAX_POLLS2 * CONFIRM_POLL_MS2 / 1000}s; it may still land${echoNote}`
+    error: `transaction ${signature} was not finalized within ${CONFIRM_MAX_POLLS3 * CONFIRM_POLL_MS3 / 1000}s; it may still land${echoNote}`
   };
 }
 async function teeSweep(args, ctx) {
@@ -50406,13 +51880,13 @@ async function teeSweep(args, ctx) {
     pathFlags: ["--keystore"]
   });
   if ("error" in parsed)
-    return usage3(ctx, parsed.error);
+    return usage4(ctx, parsed.error);
   const [address, extra] = parsed.positionals;
   if (!address || extra !== undefined)
-    return usage3(ctx, "Usage: candle tee sweep <address> --rpc-url <url> [--emergency]");
+    return usage4(ctx, "Usage: candle tee sweep <address> --rpc-url <url> [--emergency]");
   const rpcUrl2 = rpcUrlFrom2(ctx, parsed);
   if (typeof rpcUrl2 !== "string")
-    return usage3(ctx, rpcUrl2.error);
+    return usage4(ctx, rpcUrl2.error);
   const emergency = parsed.booleans.has("--emergency");
   const openedActive = await openActiveTee(ctx, parsed, address, "sign");
   if (!openedActive.ok)
@@ -50615,6 +52089,116 @@ Stop the agent from your Candle session if you have not, and re-run candle tee d
       pendingStill.push(p);
       signingBlocked = true;
     }
+    const candidateAccounts = new Set;
+    const lpCloses = [];
+    {
+      let token2022Accounts = [];
+      try {
+        token2022Accounts = await rpc2.getTokenAccountsByOwner(address, TOKEN_2022_PROGRAM_ID);
+      } catch (error) {
+        residuals.push({
+          kind: "inventory",
+          detail: `could not list Token-2022 accounts for position discovery: ${error instanceof Error ? error.message : error}`
+        });
+      }
+      const candidates = token2022Accounts.filter(isPositionCandidate);
+      for (const acct of candidates)
+        candidateAccounts.add(acct.pubkey);
+      const leftover = (kind, acct, detail) => residuals.push({ kind, detail, mint: acct.mint, account: acct.pubkey, amountRaw: acct.amountRaw });
+      if (!emergency && candidates.length > 0) {
+        if (!json)
+          deps.stdout.write(`  ${candidates.length} position NFT candidate(s) (Token-2022, amount 1, decimals 0)
+`);
+        const verified = [];
+        for (const acct of candidates) {
+          if (signingBlocked)
+            break;
+          if (!apiKey || !entry.linkedWalletId) {
+            leftover(DAMM_POSITION_CLOSE_UNAVAILABLE, acct, "no bound API key is available to build the close; the NFT was left in place");
+            continue;
+          }
+          const result = await apiRequest(`/api/v1/agent/lp/positions/${encodeURIComponent(acct.mint)}/close-build`, {
+            method: "POST",
+            auth: "key",
+            credentials: { apiKey },
+            apiUrl,
+            fetch: deps.fetch,
+            env: deps.env,
+            body: {}
+          });
+          if (!result.ok) {
+            leftover(DAMM_POSITION_CLOSE_UNAVAILABLE, acct, `close-build ${result.code ?? `HTTP ${result.status}`}: ${result.message}; the NFT was left in place`);
+            continue;
+          }
+          const artifact = parseCloseArtifact(result.body);
+          if (artifact === undefined) {
+            leftover(DAMM_POSITION_CLOSE_UNAVAILABLE, acct, "close-build answered without a transaction and an ordered account key array; the NFT was left in place");
+            continue;
+          }
+          const verdict = await verifyCloseArtifact({
+            artifact,
+            rpc: rpc2,
+            tee: address,
+            vault,
+            nftMint: acct.mint,
+            nftAccount: acct.pubkey
+          });
+          if (!verdict.ok) {
+            leftover(DAMM_CLOSE_TRANSACTION_REFUSED, acct, `${verdict.reason}; refused before signing`);
+            continue;
+          }
+          verified.push({ acct, verdict });
+        }
+        for (const { acct, verdict } of verified) {
+          if (signingBlocked) {
+            leftover(DAMM_POSITION_CLOSE_UNAVAILABLE, acct, "not signed: an earlier transaction is still in flight");
+            continue;
+          }
+          let blockhashValid;
+          try {
+            blockhashValid = await rpc2.isBlockhashValid(verdict.tx.message.recentBlockhash, "confirmed");
+          } catch (error) {
+            leftover(DAMM_POSITION_CLOSE_UNAVAILABLE, acct, `could not check the close build's blockhash: ${error instanceof Error ? error.message : error}; not signed`);
+            continue;
+          }
+          if (!blockhashValid) {
+            leftover(DAMM_POSITION_CLOSE_UNAVAILABLE, acct, "the close build's blockhash has expired; not signed, re-run the sweep for a fresh close");
+            continue;
+          }
+          const display = describeClose({ verdict, tee: address, vault, nftMint: acct.mint, nftAccount: acct.pubkey });
+          lpCloses.push({ mint: acct.mint, account: acct.pubkey, display });
+          if (!json) {
+            deps.stdout.write(`  Close for position ${acct.mint} (verified, unsigned; about to sign):
+`);
+            for (const line of display)
+              deps.stdout.write(`    ${line}
+`);
+          }
+          const pending = {
+            kind: "lp-close",
+            mint: acct.mint,
+            account: acct.pubkey,
+            amountRaw: acct.amountRaw
+          };
+          const outcome = await broadcastMessage(rpc2, deps, secret, verdict.tx.message.bytes, verdict.tx.message.recentBlockhash, pending, recordPending, clearPending);
+          if (outcome.status !== "finalized") {
+            if (!settle2(outcome, pending, "lp-close"))
+              signingBlocked = true;
+            continue;
+          }
+          await retainReceipt({
+            kind: "lp-close",
+            mint: acct.mint,
+            amountRaw: acct.amountRaw,
+            signature: outcome.signature,
+            finalizedAt: new Date(deps.now()).toISOString()
+          });
+          if (!json)
+            deps.stdout.write(`  closed LP position ${acct.mint} and withdrew its liquidity: ${outcome.signature}
+`);
+        }
+      }
+    }
     const tokenAccounts = [];
     for (const programId of [TOKEN_PROGRAM_ID, TOKEN_2022_PROGRAM_ID]) {
       try {
@@ -50631,6 +52215,13 @@ Stop the agent from your Candle session if you have not, and re-run candle tee d
       if (signingBlocked)
         break;
       const token2022 = acct.programId === TOKEN_2022_PROGRAM_ID;
+      if (candidateAccounts.has(acct.pubkey)) {
+        if (!emergency)
+          continue;
+        if (!json)
+          deps.stdout.write(`  ${acct.mint}: position NFT moved as-is to the vault (emergency; unwind it from a fresh TEE wallet)
+`);
+      }
       if (acct.state !== "initialized") {
         residuals.push({
           kind: token2022 && acct.state === "frozen" ? "TOKEN_2022_FROZEN" : "frozen-or-uninitialized",
@@ -50885,7 +52476,8 @@ Stop the agent from your Candle session if you have not, and re-run candle tee d
           signature: p.signature
         })),
         inventory,
-        recordedOnServer
+        recordedOnServer,
+        ...lpCloses.length > 0 ? { lpCloses } : {}
       })}
 `);
       return finalState === "swept" ? 0 : 3;
@@ -50968,8 +52560,7 @@ function launchWarning(keyPrefix, toKey, rows) {
   return `Warning: key ${keyPrefix} lacks launch:write; ${launchers.join(", ")} ${launchers.length === 1 ? "has" : "have"} allowLaunch but cannot launch under it.`;
 }
 var RELAY_SIGNER_LINE = "The relay signer does not move: trade these wallets from the machine that promoted them.";
-function writeRebindFailure(ctx, result, context) {
-  const { deps, apiUrl, json } = ctx;
+function rebindFailureDetails(result, context) {
   let code = result.code;
   let message = result.message;
   let suggestion;
@@ -50989,31 +52580,61 @@ function writeRebindFailure(ctx, result, context) {
   } else if (result.code === "REBIND_STALE") {
     suggestion = "Run the command again; the preview will show the current binding.";
   }
+  return {
+    code: code ?? `HTTP ${result.status}`,
+    message,
+    ...suggestion !== undefined ? { suggestion } : {},
+    status: result.status
+  };
+}
+function writeRebindFailure(ctx, result, context) {
+  const { deps, apiUrl, json } = ctx;
+  const { code, message, suggestion } = rebindFailureDetails(result, context);
   const envelope = errorEnvelope({ ...result, code, message }, { apiUrl, authType: "device" });
   if (json) {
     deps.stdout.write(`${JSON.stringify({ ...envelope, ...suggestion ? { suggestion } : {} })}
 `);
   } else {
-    deps.stderr.write(`${code ?? `HTTP ${result.status}`}: ${message}${suggestion ? ` ${suggestion}` : ""}
+    deps.stderr.write(`${code}: ${message}${suggestion ? ` ${suggestion}` : ""}
 `);
   }
   return 1;
 }
-async function resolveTargetKey(ctx, deviceToken, raw) {
-  const { deps, apiUrl, json } = ctx;
-  if (KEY_PREFIX_RE.test(raw))
-    return { ok: true, keyPrefix: raw };
-  const result = await apiRequest(KEYS_PATH2, {
+async function listAccountKeys(ctx, deviceToken) {
+  const { deps, apiUrl } = ctx;
+  return apiRequest(KEYS_PATH2, {
     auth: "device",
     credentials: { deviceToken },
     apiUrl,
     fetch: deps.fetch,
     env: deps.env
   });
-  if (!result.ok) {
-    return { ok: false, code: writeRebindFailure(ctx, result, {}) };
+}
+async function postRebind(ctx, deviceToken, body) {
+  const { deps, apiUrl } = ctx;
+  return apiRequest(REBIND_PATH, {
+    method: "POST",
+    body,
+    auth: "device",
+    credentials: { deviceToken },
+    apiUrl,
+    fetch: deps.fetch,
+    env: deps.env
+  });
+}
+async function resolveTargetKey(ctx, deviceToken, raw, opts = {}) {
+  const { deps, json } = ctx;
+  if (KEY_PREFIX_RE.test(raw))
+    return { ok: true, keyPrefix: raw };
+  let listed = opts.keys;
+  if (listed === undefined) {
+    const result = await listAccountKeys(ctx, deviceToken);
+    if (!result.ok) {
+      return { ok: false, code: writeRebindFailure(ctx, result, {}) };
+    }
+    listed = result.body?.keys ?? [];
   }
-  const keys = (result.body?.keys ?? []).filter((key) => !key.revokedAt);
+  const keys = listed.filter((key) => !key.revokedAt);
   const matches = keys.filter((key) => key.label === raw);
   if (matches.length === 1)
     return { ok: true, keyPrefix: matches[0].keyPrefix };
@@ -51071,15 +52692,7 @@ async function teeRebind(args, ctx) {
   const target = await resolveTargetKey(ctx, deviceToken, toKey);
   if (!target.ok)
     return target.code;
-  const call = (body) => apiRequest(REBIND_PATH, {
-    method: "POST",
-    body,
-    auth: "device",
-    credentials: { deviceToken },
-    apiUrl,
-    fetch: deps.fetch,
-    env: deps.env
-  });
+  const call = (body) => postRebind(ctx, deviceToken, body);
   const preview = await call({
     dryRun: true,
     toKeyPrefix: target.keyPrefix,
@@ -53960,9 +55573,18 @@ function decimalToRaw2(decimal, decimals) {
 }
 function assertVaultSigner(entry) {
   if (entry.role !== "vault") {
-    throw new VaultError("PROMOTE_NOT_VAULT_KEY", `${entry.label ?? entry.address} is a TEE wallet entry and cannot sign vault transfer or fund shapes (ED-10 / N3).`);
+    throw new VaultError("PROMOTE_NOT_VAULT_KEY", `${entry.label ?? entry.address} is not a vault key, and vault fund signs from vault keys only (ED-10).`, {
+      suggestion: `To move funds out of a promoted wallet, use: candle vault transfer <to> --from ${entry.label ?? entry.address}`
+    });
   }
 }
+function assertTransferSigner(entry) {
+  if (entry.role === "vault" || entry.role === "tee-wallet")
+    return;
+  throw new VaultError("PROMOTE_NOT_VAULT_KEY", `${entry.label ?? entry.address} is an external wallet and cannot sign vault transfer shapes (ED-10).`, {
+    suggestion: `Move funds out of an external wallet with: candle external sweep ${entry.label} --to <vault> --rpc-url <url>`
+  });
+}
 function namedSendFailure(plan) {
   if (!plan.token)
     return;
@@ -54707,9 +56329,9 @@ init_render();
 init_solana_lite();
 init_store();
 init_vault_support();
-var CHUNK = 100;
+var CHUNK2 = 100;
 var LAMPORTS_PER_SOL = 1000000000n;
-function formatSol2(lamports) {
+function formatSol3(lamports) {
   const whole = lamports / LAMPORTS_PER_SOL;
   const fraction = (lamports % LAMPORTS_PER_SOL).toString().padStart(9, "0").replace(/0+$/, "");
   return fraction === "" ? whole.toString() : `${whole}.${fraction}`;
@@ -54719,8 +56341,8 @@ async function readLamports(addresses, rpcUrl2, fetchFn) {
   const lamports = new Map;
   const unavailable = [];
   let failure;
-  for (let at = 0;at < addresses.length; at += CHUNK) {
-    const chunk = addresses.slice(at, at + CHUNK);
+  for (let at = 0;at < addresses.length; at += CHUNK2) {
+    const chunk = addresses.slice(at, at + CHUNK2);
     try {
       const accounts = await rpc2.getMultipleAccounts(chunk);
       for (const [i, address] of chunk.entries())
@@ -54771,7 +56393,7 @@ async function vaultList(args, ctx) {
     const all = vault.index.entries;
     const matched = filter === undefined ? all : all.filter((entry) => matches(entry, filter));
     const solana = balances ? matched.filter((entry) => entry.chain === "solana") : [];
-    const requests = Math.ceil(solana.length / CHUNK);
+    const requests = Math.ceil(solana.length / CHUNK2);
     const rpcHost = rpcUrl2 === undefined ? undefined : new URL(rpcUrl2).host;
     if (balances && solana.length > 0 && rpcHost !== undefined) {
       deps.stderr.write(`Reading SOL for ${solana.length} addresses from ${rpcHost}, in ${requests} ${requests === 1 ? "request" : "requests"}. That endpoint sees all ${solana.length} together.
@@ -54833,7 +56455,7 @@ async function vaultList(args, ctx) {
       const row = [entry.address, entry.label || "(none)", entry.role, entry.derivation?.path ?? "-"];
       if (balances) {
         const held = lamports.get(entry.address);
-        row.push(entry.chain !== "solana" ? "-" : held === undefined ? "?" : formatSol2(held));
+        row.push(entry.chain !== "solana" ? "-" : held === undefined ? "?" : formatSol3(held));
       }
       return row;
     });
@@ -54842,9 +56464,9 @@ ${renderTable(headers, rows)}
 `);
     if (balances) {
       deps.stdout.write(complete ? `
-total  ${formatSol2(totalLamports)} SOL across ${solana.length} keys
+total  ${formatSol3(totalLamports)} SOL across ${solana.length} keys
 ` : `
-total  ${formatSol2(totalLamports)} SOL across ${solana.length - unavailable.length} of ${solana.length} keys read
+total  ${formatSol3(totalLamports)} SOL across ${solana.length - unavailable.length} of ${solana.length} keys read
 `);
     }
     return complete ? 0 : 3;
@@ -54870,6 +56492,7 @@ async function vaultPhrase(args, ctx) {
 init_esm();
 init_args();
 init_deps();
+init_profiles();
 init_render();
 init_solana_lite();
 
@@ -54976,12 +56599,299 @@ function restoreRefusedFailure(init, error) {
 // src/commands/vault-promote.ts
 init_errors();
 init_promote_support();
+// src/vault/promote-to-key.ts
+init_deps();
+init_render();
+var REBIND_CHUNK = 200;
+var SELECTED_SCOPE_LIMIT = 50;
+function targetKeyRefusal(row, keyPrefix, now) {
+  const written = "Nothing was written.";
+  if (row === undefined) {
+    return {
+      code: "REBIND_KEY_NOT_FOUND",
+      message: `No key ${keyPrefix} on this account. ${written}`,
+      suggestion: "The target must be a key on the same account: candle keys list"
+    };
+  }
+  if (row.revokedAt !== undefined) {
+    return {
+      code: "REBIND_TARGET_INVALID",
+      message: `The target key ${keyPrefix} is revoked. ${written}`,
+      suggestion: "Pick an active key: candle keys list"
+    };
+  }
+  if (row.expiresAt !== undefined && row.expiresAt !== null && row.expiresAt <= now) {
+    return {
+      code: "REBIND_TARGET_INVALID",
+      message: `The target key ${keyPrefix} has expired. ${written}`,
+      suggestion: "Pick an active key: candle keys list"
+    };
+  }
+  if (row.environment !== "production") {
+    return {
+      code: "REBIND_TARGET_INVALID",
+      message: `The target key ${keyPrefix} is a test key; the trade rail refuses test keys. ${written}`,
+      suggestion: "Pick a production key: candle keys list"
+    };
+  }
+  if (!row.scopes.includes("swap:write")) {
+    return {
+      code: "REBIND_TARGET_INVALID",
+      message: `The target key ${keyPrefix} lacks swap:write, which a TEE wallet needs to trade. ${written}`,
+      suggestion: "Pick a key with swap:write, or mint one: candle keys create"
+    };
+  }
+  return null;
+}
+function tradeReadinessOf(row) {
+  const hasTxLimit = row.txLimit !== null && row.txLimit !== undefined;
+  const limits = row.spendLimits ?? [];
+  const cap = (asset) => limits.some((limit) => limit.asset === asset.toLowerCase() || limit.asset === asset.toUpperCase());
+  const sol = cap("sol");
+  const usdc = cap("usdc");
+  const missingCaps = [];
+  if (!hasTxLimit)
+    missingCaps.push("txLimit");
+  if (!sol)
+    missingCaps.push("spendLimits.sol");
+  if (!usdc)
+    missingCaps.push("spendLimits.usdc");
+  return { tradeReady: { sol: hasTxLimit && sol, usdc: hasTxLimit && usdc }, missingCaps };
+}
+function targetWarnings(target) {
+  return capWarnings(target.keyPrefix, {
+    keyPrefix: target.keyPrefix,
+    label: target.label,
+    paused: target.paused,
+    walletScope: target.walletScope,
+    tradeReady: target.tradeReady,
+    missingCaps: target.missingCaps,
+    launchScope: target.launchScope
+  });
+}
+async function preflightToKey(ctx, raw, opts) {
+  const { deps, json } = ctx;
+  const refuse2 = (failure) => {
+    writeLocalFailure(deps, failure, json);
+    return { ok: false, exit: 1 };
+  };
+  const deviceToken = await resolveDeviceToken(deps, ctx.profile);
+  if (!deviceToken)
+    return refuse2(DEVICE_TOKEN_REQUIRED);
+  const listing = await listAccountKeys(ctx, deviceToken);
+  if (!listing.ok) {
+    return refuse2({
+      code: listing.code ?? `HTTP ${listing.status}`,
+      message: `Could not read this account's keys to check --to-key (${listing.status === 0 ? listing.message : `HTTP ${listing.status}`}). Nothing was written.`,
+      suggestion: "Check the device token with: candle auth status"
+    });
+  }
+  const keys = listing.body?.keys ?? [];
+  const resolved = await resolveTargetKey(ctx, deviceToken, raw, { keys });
+  if (!resolved.ok)
+    return { ok: false, exit: resolved.code };
+  const keyPrefix = resolved.keyPrefix;
+  const row = keys.find((key) => key.keyPrefix === keyPrefix);
+  const refusal = targetKeyRefusal(row, keyPrefix, deps.now());
+  if (refusal !== null)
+    return refuse2(refusal);
+  const target = row;
+  const walletScope = target.walletScope === "selected" ? "selected" : "all";
+  if (walletScope === "selected") {
+    const room = await readSelectedScopeRoom(ctx, keyPrefix);
+    if (room.ok) {
+      const moving = opts.labels.filter((label) => !room.heldLabels.has(label)).length;
+      if (room.held + moving > SELECTED_SCOPE_LIMIT) {
+        return refuse2({
+          code: "REBIND_SCOPE_FULL",
+          message: `Key ${keyPrefix} is scoped to selected wallets and holds ${room.held} of ${SELECTED_SCOPE_LIMIT}; the ${moving} this run would move do not fit. Nothing was written.`,
+          suggestion: "Widen the key's wallet scope from the portal, or name a key with room."
+        });
+      }
+    } else {
+      deps.stderr.write(`Could not read key ${keyPrefix}'s wallet set (${room.reason}); its selected-scope room is checked at the rebind.
+`);
+    }
+  }
+  const readiness = tradeReadinessOf(target);
+  return {
+    ok: true,
+    deviceToken,
+    target: {
+      keyPrefix,
+      label: typeof target.label === "string" && target.label.length > 0 ? target.label : null,
+      walletScope,
+      paused: target.pausedAt !== undefined && target.pausedAt !== null,
+      launchScope: target.scopes.includes("launch:write"),
+      ...readiness
+    }
+  };
+}
+async function readSelectedScopeRoom(ctx, keyPrefix) {
+  const apiKey = await resolveApiKey(ctx.deps, ctx.profile);
+  if (!apiKey)
+    return { ok: false, reason: "no API key" };
+  const result = await apiRequest(`/api/v1/agent/keys/${encodeURIComponent(keyPrefix)}/wallets`, {
+    auth: "key",
+    credentials: { apiKey },
+    apiUrl: ctx.apiUrl,
+    fetch: ctx.deps.fetch,
+    env: ctx.deps.env
+  });
+  if (!result.ok)
+    return { ok: false, reason: result.status === 0 ? result.message : `HTTP ${result.status}` };
+  const wallets2 = result.body?.wallets;
+  if (!Array.isArray(wallets2))
+    return { ok: false, reason: "no wallet list in the response" };
+  const heldLabels = new Set;
+  for (const wallet of wallets2)
+    if (typeof wallet?.label === "string")
+      heldLabels.add(wallet.label);
+  return { ok: true, held: wallets2.length, heldLabels };
+}
+function chunkWallets(wallets2, size = REBIND_CHUNK) {
+  const out = [];
+  for (let at = 0;at < wallets2.length; at += size)
+    out.push(wallets2.slice(at, at + size));
+  return out;
+}
+async function rebindPromoted(ctx, deviceToken, toKeyPrefix, wallets2) {
+  const run = { ok: true, requests: 0, outcomes: new Map };
+  for (const wallet of wallets2)
+    run.outcomes.set(wallet.id, { state: "not-reached" });
+  const chunks = chunkWallets(wallets2);
+  for (const [at, chunk] of chunks.entries()) {
+    run.requests += 1;
+    const preview = await postRebind(ctx, deviceToken, {
+      dryRun: true,
+      toKeyPrefix,
+      wallets: chunk.map((wallet) => wallet.id)
+    });
+    if (!preview.ok) {
+      run.ok = false;
+      run.failure = { ...rebindFailureDetails(preview, {}), chunk: at + 1 };
+      return run;
+    }
+    const shown = preview.body;
+    if (run.toKey === undefined)
+      run.toKey = shown.toKey;
+    for (const row of shown.unchanged)
+      run.outcomes.set(row.id, { state: "unchanged" });
+    const moving = shown.rebound;
+    if (moving.length === 0)
+      continue;
+    run.requests += 1;
+    const committed = await postRebind(ctx, deviceToken, {
+      toKeyPrefix,
+      walletIds: moving.map((row) => row.id),
+      expect: Object.fromEntries(moving.map((row) => [row.id, row.fromKeyPrefix]))
+    });
+    if (!committed.ok) {
+      run.ok = false;
+      run.failure = {
+        ...rebindFailureDetails(committed, {
+          fromKeyPrefixes: Array.from(new Set(moving.map((row) => row.fromKeyPrefix)))
+        }),
+        chunk: at + 1
+      };
+      for (const row of moving)
+        run.outcomes.set(row.id, { state: "failed" });
+      return run;
+    }
+    const result = committed.body;
+    for (const row of result.rebound) {
+      run.outcomes.set(row.id, { state: "rebound", ...row.auditId !== undefined ? { auditId: row.auditId } : {} });
+    }
+    for (const row of result.unchanged)
+      run.outcomes.set(row.id, { state: "unchanged" });
+  }
+  return run;
+}
+function finishingCommands(addresses, toKeyPrefix) {
+  return chunkWallets(addresses).map((chunk) => `candle tee rebind ${chunk.join(" ")} --to-key ${toKeyPrefix}`);
+}
+function pendingWallets(wallets2, run) {
+  return wallets2.filter((wallet) => {
+    const state = run?.outcomes.get(wallet.id)?.state;
+    return state !== "rebound" && state !== "unchanged";
+  });
+}
+function renderRebindReport(input) {
+  const { target, wallets: wallets2, run, notRebindable } = input;
+  const lines = [];
+  const name = (wallet) => `${wallet.label} (${wallet.address})`;
+  if (run !== undefined) {
+    const rebound = wallets2.filter((wallet) => run.outcomes.get(wallet.id)?.state === "rebound").length;
+    const unchanged = wallets2.filter((wallet) => run.outcomes.get(wallet.id)?.state === "unchanged").length;
+    if (rebound > 0 || unchanged > 0) {
+      lines.push(`✓ ${rebound} wallet${rebound === 1 ? "" : "s"} moved to key ${target.keyPrefix}${unchanged > 0 ? ` (${unchanged} already there)` : ""} in ${run.requests} request${run.requests === 1 ? "" : "s"}.`);
+    }
+    if (run.failure !== undefined) {
+      lines.push(`Rebind ${run.failure.code}: ${run.failure.message}${run.failure.suggestion ? ` ${run.failure.suggestion}` : ""}`);
+    }
+  }
+  const pending = pendingWallets(wallets2, run);
+  if (pending.length > 0) {
+    lines.push(`${pending.length} promoted wallet${pending.length === 1 ? " is" : "s are"} still bound to the calling key ${input.callingKeyPrefix}, not ${target.keyPrefix}:`, ...pending.map((wallet) => `  ${name(wallet)}`), "Finish with:", ...finishingCommands(pending.map((wallet) => wallet.address), target.keyPrefix).map((command) => `  ${command}`));
+  }
+  if (notRebindable.length > 0) {
+    lines.push(`${notRebindable.length} wallet${notRebindable.length === 1 ? "" : "s"} cannot be rebound yet (only a verified-active wallet moves):`, ...notRebindable.map((wallet) => `  ${name(wallet)}: ${wallet.reason}`));
+  }
+  return lines.join(`
+`);
+}
+function walletRebindJson(wallet, run) {
+  if (wallet.id === null || wallet.remoteAuthority !== "verified-active") {
+    return {
+      state: "not-rebindable",
+      reason: wallet.id === null ? "no linked wallet id" : `remote authority is ${wallet.remoteAuthority ?? "unknown"}, not verified-active`
+    };
+  }
+  const outcome = run?.outcomes.get(wallet.id);
+  if (outcome === undefined)
+    return { state: "not-reached" };
+  return { state: outcome.state, ...outcome.auditId !== undefined ? { auditId: outcome.auditId } : {} };
+}
+function finalBoundKey(wallet, run, toKeyPrefix) {
+  const state = wallet.id === null ? undefined : run?.outcomes.get(wallet.id)?.state;
+  return state === "rebound" || state === "unchanged" ? toKeyPrefix : wallet.importedTo;
+}
+function rebindJson(input) {
+  const { target, wallets: wallets2, run } = input;
+  const pending = pendingWallets(wallets2, run);
+  const count = (state) => wallets2.filter((wallet) => run?.outcomes.get(wallet.id)?.state === state).length;
+  return {
+    toKey: {
+      keyPrefix: target.keyPrefix,
+      label: target.label,
+      tradeReady: run?.toKey?.tradeReady ?? target.tradeReady,
+      missingCaps: run?.toKey?.missingCaps ?? target.missingCaps
+    },
+    rebind: {
+      ok: run !== undefined && run.ok && input.notRebindable.length === 0,
+      reached: run !== undefined,
+      requests: run?.requests ?? 0,
+      rebound: count("rebound"),
+      unchanged: count("unchanged"),
+      pending: pending.map((wallet) => wallet.address),
+      notRebindable: input.notRebindable.length,
+      ...run?.failure !== undefined ? {
+        code: run.failure.code,
+        message: run.failure.message,
+        ...run.failure.suggestion !== undefined ? { suggestion: run.failure.suggestion } : {}
+      } : {},
+      finishWith: finishingCommands(pending.map((wallet) => wallet.address), target.keyPrefix)
+    }
+  };
+}
+
+// src/commands/vault-promote.ts
 init_signer_roles();
 init_store();
 init_vault_support();
 async function vaultPromote(args, ctx) {
   const parsed = parseArgs(args, {
-    valueFlags: ["--from", "--in-place", "--sweep-to", "--label", "--rpc-url", "--keystore"],
+    valueFlags: ["--from", "--in-place", "--sweep-to", "--label", "--rpc-url", "--keystore", "--to-key"],
     booleanFlags: ["--accept-unknown-exposure", "--accept-older-copy"],
     pathFlags: ["--keystore"]
   });
@@ -54995,21 +56905,73 @@ async function vaultPromote(args, ctx) {
     return usage(ctx, "Use either --from or --in-place, not both.");
   }
   if (fromLabel === undefined && inPlaceLabel === undefined) {
-    return usage(ctx, "Usage: candle vault promote --from <vault-key-label> | --in-place <vault-key-label> --sweep-to <label> --rpc-url <url>");
+    return usage(ctx, "Usage: candle vault promote --from <vault-key-label> | --in-place <vault-key-label> --sweep-to <label> --rpc-url <url> [--to-key <label|prefix>]");
   }
+  const toKeyRaw = parsed.values["--to-key"];
+  if (toKeyRaw !== undefined && toKeyRaw.trim().length === 0)
+    return usage(ctx, "--to-key needs a label or a prefix.");
   if (!refuseEnvPassphrase(ctx))
     return 1;
   if (!requireTty(ctx, "vault promote"))
     return 1;
-  if (fromLabel !== undefined) {
-    if (parsed.values["--sweep-to"] !== undefined) {
-      return usage(ctx, "Fresh-key promote takes --from, not --sweep-to.");
+  if (fromLabel !== undefined && parsed.values["--sweep-to"] !== undefined) {
+    return usage(ctx, "Fresh-key promote takes --from, not --sweep-to.");
+  }
+  let toKey;
+  if (toKeyRaw !== undefined) {
+    const label = parsed.values["--label"] ?? inPlaceLabel ?? (fromLabel !== undefined ? "<fresh>" : undefined);
+    const preflight = await preflightToKey(ctx, toKeyRaw, { labels: label !== undefined ? [label] : [] });
+    if (!preflight.ok)
+      return preflight.exit;
+    toKey = { target: preflight.target, deviceToken: preflight.deviceToken };
+  }
+  if (fromLabel !== undefined)
+    return promoteFresh(ctx, parsed, fromLabel, toKey);
+  return promoteInPlace(ctx, parsed, inPlaceLabel, toKey);
+}
+async function rebindAfterImport(ctx, toKey, wallet, callingKeyPrefix) {
+  const rebindable = wallet.linkedWalletId !== null && wallet.remoteAuthority === "verified-active" ? [{ id: wallet.linkedWalletId, address: wallet.address, label: wallet.label }] : [];
+  const notRebindable = rebindable.length === 0 ? [
+    {
+      address: wallet.address,
+      label: wallet.label,
+      reason: wallet.linkedWalletId === null ? "no linked wallet id" : `remote authority is ${wallet.remoteAuthority ?? "unknown"}, not verified-active`
+    }
+  ] : [];
+  const run = rebindable.length > 0 ? await rebindPromoted(ctx, toKey.deviceToken, toKey.target.keyPrefix, rebindable) : undefined;
+  const input = { target: toKey.target, callingKeyPrefix, wallets: rebindable, run, notRebindable };
+  const report = renderRebindReport(input);
+  if (report.length > 0)
+    ctx.deps.stderr.write(`${report}
+`);
+  const id = wallet.linkedWalletId;
+  return {
+    exit: run !== undefined && !run.ok ? 1 : 0,
+    json: {
+      ...rebindJson(input),
+      boundKeyPrefix: finalBoundKey({ id, importedTo: wallet.importedTo }, run, toKey.target.keyPrefix),
+      walletRebind: walletRebindJson({ id, remoteAuthority: wallet.remoteAuthority }, run)
     }
-    return promoteFresh(ctx, parsed, fromLabel);
+  };
+}
+async function confirmResumeRebind(ctx, toKey) {
+  const name = toKey.target.label !== null ? `  (${toKey.target.label})` : "";
+  ctx.deps.stderr.write(`${[
+    `This wallet will be bound to key ${toKey.target.keyPrefix}${name} by a rebind after the import.`,
+    ...targetWarnings(toKey.target)
+  ].join(`
+`)}
+`);
+  const typed = await ctx.deps.promptLine(`Type ${CONFIRM_WORD} to move this wallet to ${toKey.target.keyPrefix}: `);
+  if (typed.trim().toLowerCase() !== CONFIRM_WORD) {
+    throw new VaultError("PROMOTE_NOT_ACKNOWLEDGED", `The acknowledgement is the word ${CONFIRM_WORD}; nothing was moved, and nothing was written.`, { suggestion: `Run the command again and type ${CONFIRM_WORD} at the prompt.` });
   }
-  return promoteInPlace(ctx, parsed, inPlaceLabel);
 }
-async function promoteFresh(ctx, parsed, fromLabel) {
+async function callingKeyPrefixFor(ctx) {
+  const apiKey = await resolveApiKey(ctx.deps, ctx.profile);
+  return (apiKey !== undefined ? apiKeyPrefix(apiKey) : undefined) ?? "(the calling key)";
+}
+async function promoteFresh(ctx, parsed, fromLabel, toKey) {
   if ("error" in parsed)
     return usage(ctx, parsed.error);
   const resolvedVault = vaultPathFor(ctx, parsed);
@@ -55088,10 +57050,19 @@ async function promoteFresh(ctx, parsed, fromLabel) {
       addKeys: [blob]
     }, ctx.deps));
     await confirmLastSix(ctx, destination.address, "the sweep vault destination");
+    if (toKey !== undefined) {
+      const name = toKey.target.label !== null ? `  (${toKey.target.label})` : "";
+      ctx.deps.stderr.write(`${[
+        `This wallet will be bound to key ${toKey.target.keyPrefix}${name} by a rebind after the import.`,
+        ...targetWarnings(toKey.target)
+      ].join(`
+`)}
+`);
+    }
     const privateKey = base58.encode(secret64);
     wipe(secret64);
     const importCount = { n: 0 };
-    const { exit: code } = await runTeeImport(ctx, {
+    const { exit: code, submitted } = await runTeeImport(ctx, {
       address,
       privateKey,
       label: entry.label,
@@ -55110,22 +57081,35 @@ async function promoteFresh(ctx, parsed, fromLabel) {
     if (target === undefined) {
       throw new VaultError("VAULT_INDEX_INVALID", `Entry ${keyId} missing after import.`);
     }
+    let rebound;
+    if (toKey !== undefined) {
+      const importedTo = submitted?.boundKeyPrefix ?? null;
+      rebound = await rebindAfterImport(ctx, toKey, {
+        linkedWalletId: target.linkedWalletId ?? null,
+        address,
+        label: entry.label,
+        remoteAuthority: target.tee?.remoteAuthority ?? submitted?.remoteAuthority ?? null,
+        importedTo
+      }, await callingKeyPrefixFor(ctx));
+    }
+    const exit = Math.max(code, rebound?.exit ?? 0);
     if (ctx.json) {
       writeJson(ctx.deps, {
-        ok: true,
+        ok: rebound === undefined || rebound.exit === 0,
         mode: "fresh",
         address,
         label: entry.label,
         vaultDestination: destination.address,
         lifecycle: target.tee?.lifecycle,
         linkedWalletId: target.linkedWalletId ?? null,
-        importCalls: importCount.n
+        importCalls: importCount.n,
+        ...rebound?.json ?? {}
       });
     } else {
       ctx.deps.stdout.write(`Promoted fresh TEE wallet ${address} (sweep to ${destination.address}).
 `);
     }
-    return code;
+    return exit;
   });
 }
 async function refuseWithoutRoom(ctx) {
@@ -55147,7 +57131,7 @@ async function reopenFromDisk(path, reopen, previous) {
     });
   return reopen(path, raw);
 }
-async function promoteInPlace(ctx, parsed, subjectLabel) {
+async function promoteInPlace(ctx, parsed, subjectLabel, toKey) {
   if ("error" in parsed)
     return usage(ctx, parsed.error);
   const resolvedVault = vaultPathFor(ctx, parsed);
@@ -55174,7 +57158,9 @@ async function promoteInPlace(ctx, parsed, subjectLabel) {
       if (sweepTo !== undefined) {
         return usage(ctx, "A resume of promote takes no --sweep-to (exit 2).");
       }
-      const { exit } = await resumePromote(ctx, vault, existing, opened.reopen, path, hold, {
+      if (toKey !== undefined)
+        await confirmResumeRebind(ctx, toKey);
+      const resumed = await resumePromote(ctx, vault, existing, opened.reopen, path, hold, {
         confirmAccount: (account) => confirmLastSix(ctx, account, "that account"),
         confirmDestination: async (destination2) => {
           try {
@@ -55183,9 +57169,36 @@ async function promoteInPlace(ctx, parsed, subjectLabel) {
           } catch {
             return false;
           }
-        }
+        },
+        report: toKey !== undefined ? "return" : "write"
       });
-      return exit;
+      if (toKey === undefined)
+        return resumed.exit;
+      if (resumed.failure !== undefined || resumed.exit !== 0) {
+        writeLocalFailure(ctx.deps, resumed.failure ?? { code: "PROMOTE_OUTCOME_UNRESOLVED", message: "The resume did not complete." }, ctx.json);
+        return resumed.exit;
+      }
+      const rebound2 = await rebindAfterImport(ctx, toKey, {
+        linkedWalletId: resumed.adopted?.linkedWalletId ?? null,
+        address: existing.address,
+        label: existing.label,
+        remoteAuthority: resumed.adopted?.remoteAuthority ?? null,
+        importedTo: existing.tee?.boundKeyPrefix ?? null
+      }, await callingKeyPrefixFor(ctx));
+      if (ctx.json) {
+        writeJson(ctx.deps, {
+          ok: rebound2.exit === 0,
+          mode: "resume",
+          address: existing.address,
+          lifecycle: "enabled",
+          importCalls: 0,
+          ...rebound2.json
+        });
+      } else {
+        ctx.deps.stdout.write(`Resumed ${existing.address}: grant adopted; no re-import.
+`);
+      }
+      return rebound2.exit;
     }
     if (sweepTo === undefined || rpcUrl2 === undefined) {
       return usage(ctx, "Usage: candle vault promote --in-place <label> --sweep-to <label> --rpc-url <url> [--label] [--accept-unknown-exposure]");
@@ -55197,7 +57210,12 @@ async function promoteInPlace(ctx, parsed, subjectLabel) {
       return usage(ctx, "A resume of promote takes no --sweep-to (exit 2).");
     }
     await refuseWithoutRoom(ctx);
-    const controlledBy = await readControlledBy(ctx);
+    const live = await readControlledBy(ctx);
+    const controlledBy = toKey === undefined ? live : withToKey(live, {
+      keyPrefix: toKey.target.keyPrefix,
+      label: toKey.target.label,
+      warnings: targetWarnings(toKey.target)
+    });
     const rpc2 = createSolanaRpc(rpcUrl2, ctx.deps.fetch);
     const host = new URL(rpcUrl2).host;
     await displayHoldings(ctx, rpc2, first.subject.address);
@@ -55267,24 +57285,37 @@ async function promoteInPlace(ctx, parsed, subjectLabel) {
       writeLocalFailure(ctx.deps, failure, ctx.json);
       return code;
     }
+    let rebound;
+    if (toKey !== undefined && imported.submitted !== undefined) {
+      const importedTo = imported.submitted.boundKeyPrefix ?? null;
+      rebound = await rebindAfterImport(ctx, toKey, {
+        linkedWalletId: imported.submitted.id ?? null,
+        address: subject.address,
+        label: parsed.values["--label"] ?? subject.label,
+        remoteAuthority: imported.submitted.remoteAuthority ?? null,
+        importedTo
+      }, controlledBy.keyPrefix);
+    }
+    const exit = Math.max(code, rebound?.exit ?? 0);
     if (ctx.json) {
       const reopened = hold(await reopenFromDisk(path, opened.reopen, vault));
       const updated = reopened.index.entries.find((e) => e.id === subject.id);
       writeJson(ctx.deps, {
-        ok: code === 0 || code === 3,
+        ok: (code === 0 || code === 3) && (rebound === undefined || rebound.exit === 0),
         mode: "in-place",
         address: subject.address,
         vaultDestination: destination.address,
         lifecycle: updated?.tee?.lifecycle ?? null,
         linkedWalletId: updated?.linkedWalletId ?? null,
         controlledBy: controlledByJson(controlledBy),
-        authorities: authoritiesJson(roles)
+        authorities: authoritiesJson(roles),
+        ...rebound?.json ?? {}
       });
     } else if (code === 0 || code === 3) {
       ctx.deps.stdout.write(`Promoted ${subject.address} in place (sweep to ${destination.address}). This address never returns to cold.
 `);
     }
-    return code;
+    return exit;
   });
 }
 async function resumePromote(ctx, vault, entry, reopen, path, hold, confirmations) {
@@ -55870,12 +57901,12 @@ function parseValueUsdCell(raw) {
   const value = Number(cleaned);
   return Number.isFinite(value) ? value : undefined;
 }
-function formatUsd(value) {
+function formatUsd2(value) {
   const [whole, fraction] = value.toFixed(2).split(".");
   const grouped = (whole ?? "0").replace(/\B(?=(\d{3})+(?!\d))/g, ",");
   return `$${grouped}.${fraction ?? "00"}`;
 }
-function formatSol3(lamports) {
+function formatSol4(lamports) {
   const whole = lamports / 1000000000n;
   const fraction = lamports % 1000000000n;
   return `${whole}.${fraction.toString().padStart(9, "0").slice(0, 6)}`;
@@ -55904,14 +57935,37 @@ init_promote_support();
 init_signer_roles();
 init_store();
 init_vault_support();
-var USAGE_LINE = "Usage: candle vault promote-batch --pairs-from <file> --rpc-url <url> [--token-holdings] [--accept-unknown-exposure]";
+var USAGE_LINE = "Usage: candle vault promote-batch --pairs-from <file> --rpc-url <url> [--to-key <label|prefix>] [--token-holdings] [--accept-unknown-exposure]";
 var rowObserver = null;
+function splitRebindable(results) {
+  const wallets2 = [];
+  const notRebindable = [];
+  for (const row of results) {
+    if (row.linkedWalletId !== null && row.remoteAuthority === "verified-active") {
+      wallets2.push({ id: row.linkedWalletId, address: row.address, label: row.label });
+    } else {
+      notRebindable.push({
+        address: row.address,
+        label: row.label,
+        reason: row.linkedWalletId === null ? `no linked wallet id (${row.lifecycle})` : `remote authority is ${row.remoteAuthority ?? "unknown"}, not verified-active`
+      });
+    }
+  }
+  return { wallets: wallets2, notRebindable };
+}
+function keysWithRebind(results, phase, run) {
+  return results.map((row) => ({
+    ...row,
+    boundKeyPrefix: finalBoundKey({ id: row.linkedWalletId, importedTo: phase.importedTo.get(row.address) ?? null }, run, phase.toKey.target.keyPrefix),
+    rebind: walletRebindJson({ id: row.linkedWalletId, remoteAuthority: row.remoteAuthority }, run)
+  }));
+}
 async function vaultPromoteBatch(args, ctx) {
   if (args.some((arg) => arg === "--from" || arg.startsWith("--from="))) {
     return usage(ctx, "promote-batch promotes existing vault keys in place and takes no --from. For fresh keys: candle vault new-key --chain solana --labels-from <file>, then candle vault promote --from <label> for each.");
   }
   const parsed = parseArgs(args, {
-    valueFlags: ["--pairs-from", "--rpc-url", "--keystore"],
+    valueFlags: ["--pairs-from", "--rpc-url", "--keystore", "--to-key"],
     booleanFlags: ["--token-holdings", "--accept-unknown-exposure", "--accept-older-copy"],
     pathFlags: ["--keystore", "--pairs-from"]
   });
@@ -55922,6 +57976,9 @@ async function vaultPromoteBatch(args, ctx) {
   const pairsFile = parsed.values["--pairs-from"];
   if (pairsFile === undefined)
     return usage(ctx, USAGE_LINE);
+  const toKeyRaw = parsed.values["--to-key"];
+  if (toKeyRaw !== undefined && toKeyRaw.trim().length === 0)
+    return usage(ctx, "--to-key needs a label or a prefix.");
   if (!refuseEnvPassphrase(ctx))
     return 1;
   if (!requireTty(ctx, "vault promote-batch"))
@@ -55946,6 +58003,13 @@ async function vaultPromoteBatch(args, ctx) {
   if (!parsedFile.ok)
     return usage(ctx, renderPhaseAFindings(pairsFile, parsedFile.findings));
   const { rows, hasValueUsd } = parsedFile;
+  let toKey;
+  if (toKeyRaw !== undefined) {
+    const preflight = await preflightToKey(ctx, toKeyRaw, { labels: rows.map((row) => row.label) });
+    if (!preflight.ok)
+      return preflight.exit;
+    toKey = { target: preflight.target, deviceToken: preflight.deviceToken };
+  }
   return runVaultCommand(ctx, async ({ hold }) => {
     const raw = await requireVaultRaw(ctx, resolvedVault);
     const opened = await unlockInteractively(ctx, path, raw, {
@@ -55981,7 +58045,17 @@ async function vaultPromoteBatch(args, ctx) {
     if (roomRefusal !== null)
       throw roomRefusal;
     const room = roomRead.room;
-    const controlledBy = await readControlledBy(ctx);
+    const live = await readControlledBy(ctx);
+    const controlledBy = toKey === undefined ? live : withToKey(live, {
+      keyPrefix: toKey.target.keyPrefix,
+      label: toKey.target.label,
+      warnings: targetWarnings(toKey.target)
+    });
+    const rebindPhase = toKey === undefined ? undefined : { toKey, callingKeyPrefix: live.keyPrefix, importedTo: new Map };
+    for (const item of planned) {
+      if (item.kind === "skip")
+        rebindPhase?.importedTo.set(item.subject.address, item.subject.tee?.boundKeyPrefix ?? null);
+    }
     const addresses = planned.map((item) => item.subject.address);
     const rpc2 = createSolanaRpc(rpcUrl2, deps.fetch);
     const host = new URL(rpcUrl2).host;
@@ -56040,28 +58114,58 @@ ${footer}
       });
     }
     if (acting.length === 0) {
-      deps.stderr.write(`
+      const roles2 = {
+        checked: [...ROLE_GROUP_IDS],
+        notChecked: [],
+        found: [],
+        requests: 0,
+        planned: 0,
+        rateLimited: 0,
+        elapsedMs: 0
+      };
+      const skipped = planned.map((item) => skippedResult(item));
+      const rebindable = rebindPhase === undefined ? undefined : splitRebindable(skipped);
+      if (rebindPhase === undefined || rebindable === undefined || rebindable.wallets.length === 0) {
+        deps.stderr.write(`
 ${table}
 
 ${footer}
 Nothing to do: every row already landed.
 `);
+        return finish(ctx, {
+          file: pairsFile,
+          rows: rows.length,
+          keys: skipped,
+          destinations,
+          exit: 0,
+          controlledBy,
+          roles: roles2
+        });
+      }
+      const n = rebindable.wallets.length;
+      deps.stderr.write(`
+${table}
+
+${footer}
+Every row already landed; ${n} wallet${n === 1 ? "" : "s"} to rebind.
+`);
+      deps.stderr.write(`
+${renderControlledBy(controlledBy, n)}
+`);
+      const typed = await deps.promptLine(`Type ${CONFIRM_WORD} to move ${n === 1 ? "this wallet" : `these ${n} wallets`} to ${rebindPhase.toKey.target.keyPrefix}: `);
+      if (typed.trim().toLowerCase() !== CONFIRM_WORD) {
+        throw new VaultError("PROMOTE_NOT_ACKNOWLEDGED", `The acknowledgement is the word ${CONFIRM_WORD}; nothing was moved, and nothing was written.`, { suggestion: `Run the command again and type ${CONFIRM_WORD} at the prompt.` });
+      }
+      const rebound2 = await runRebindPhase(ctx, rebindPhase, skipped);
       return finish(ctx, {
         file: pairsFile,
         rows: rows.length,
-        keys: planned.map((item) => skippedResult(item)),
+        keys: skipped,
         destinations,
         exit: 0,
         controlledBy,
-        roles: {
-          checked: [...ROLE_GROUP_IDS],
-          notChecked: [],
-          found: [],
-          requests: 0,
-          planned: 0,
-          rateLimited: 0,
-          elapsedMs: 0
-        }
+        roles: roles2,
+        rebound: rebound2
       });
     }
     const checked = roles;
@@ -56152,6 +58256,7 @@ ${renderControlledBy(controlledBy, acting.length)}
           worst = Math.max(worst, imported.exit);
           done += 1;
           last = { address: subject2.address, keyId: subject2.id };
+          rebindPhase?.importedTo.set(subject2.address, imported.submitted.boundKeyPrefix ?? null);
           results.push({
             line: row2.line,
             label: subject2.label,
@@ -56191,6 +58296,7 @@ ${renderControlledBy(controlledBy, acting.length)}
         await rowObserver?.({ line: row.line, stage: "resumed", vault: current });
         done += 1;
         last = { address: subject.address, keyId: subject.id };
+        rebindPhase?.importedTo.set(subject.address, subject.tee?.boundKeyPrefix ?? null);
         results.push({
           line: row.line,
           label: subject.label,
@@ -56216,6 +58322,20 @@ ${renderControlledBy(controlledBy, acting.length)}
     }
     if (stopped !== undefined) {
       reportPartial(ctx, { landed: done, acting: acting.length, failure: stopped });
+      let notReached;
+      if (rebindPhase !== undefined) {
+        const { wallets: wallets2, notRebindable } = splitRebindable(results);
+        notReached = {
+          target: rebindPhase.toKey.target,
+          callingKeyPrefix: rebindPhase.callingKeyPrefix,
+          wallets: wallets2,
+          notRebindable
+        };
+        const report = renderRebindReport(notReached);
+        if (report.length > 0)
+          deps.stderr.write(`${report}
+`);
+      }
       if (ctx.json) {
         writeJson(deps, {
           ok: false,
@@ -56226,13 +58346,14 @@ ${renderControlledBy(controlledBy, acting.length)}
           resumed: results.filter((r) => r.state === "resumed").length,
           skipped: results.filter((r) => r.state === "skipped").length,
           destinations: destinations.map(({ label, address, keys }) => ({ label, address, keys })),
-          keys: results,
+          keys: rebindPhase === undefined ? results : keysWithRebind(results, rebindPhase, undefined),
           failedLine: stopped.line,
           code: stopped.code,
           message: stopped.message,
           ...stopped.suggestion !== undefined ? { suggestion: stopped.suggestion } : {},
           controlledBy: controlledByJson(controlledBy),
-          authorities: authoritiesJson(checked)
+          authorities: authoritiesJson(checked),
+          ...notReached !== undefined ? rebindJson(notReached) : {}
         });
       } else {
         deps.stderr.write(`${stopped.message}${stopped.suggestion ? ` ${stopped.suggestion}` : ""}
@@ -56242,6 +58363,7 @@ ${renderControlledBy(controlledBy, acting.length)}
     }
     if (last !== undefined)
       await verifyWritten(path, last.address, last.keyId, opened.reopen, ctx);
+    const rebound = rebindPhase === undefined ? undefined : await runRebindPhase(ctx, rebindPhase, results);
     return finish(ctx, {
       file: pairsFile,
       rows: rows.length,
@@ -56249,10 +58371,27 @@ ${renderControlledBy(controlledBy, acting.length)}
       destinations,
       exit: worst,
       controlledBy,
-      roles: checked
+      roles: checked,
+      ...rebound !== undefined ? { rebound } : {}
     });
   });
 }
+async function runRebindPhase(ctx, phase, results) {
+  const { wallets: wallets2, notRebindable } = splitRebindable(results);
+  const run = wallets2.length > 0 ? await rebindPromoted(ctx, phase.toKey.deviceToken, phase.toKey.target.keyPrefix, wallets2) : undefined;
+  const input = {
+    target: phase.toKey.target,
+    callingKeyPrefix: phase.callingKeyPrefix,
+    wallets: wallets2,
+    run,
+    notRebindable
+  };
+  const report = renderRebindReport(input);
+  if (report.length > 0)
+    ctx.deps.stderr.write(`${report}
+`);
+  return { phase, run, input };
+}
 async function verifySubjectSecret(vault, subject) {
   const secret = await decryptKey(vault, subject.id);
   try {
@@ -56375,7 +58514,7 @@ function renderBatchTable(planned, opts) {
     const authority = item.kind === "skip" ? "" : opts.roles === undefined ? "?" : authorityCell(address, opts.roles);
     const cells = [String(item.row.line), state, item.subject.label, address, destination, authority];
     const lamports = opts.lamports?.get(address);
-    cells.push(lamports === undefined ? "unread" : formatSol3(lamports));
+    cells.push(lamports === undefined ? "unread" : formatSol4(lamports));
     if (opts.tokenCounts !== undefined)
       cells.push(String(opts.tokenCounts.get(address) ?? 0));
     if (opts.hasValueUsd)
@@ -56414,7 +58553,7 @@ function renderFooter(opts) {
       else
         total += value;
     }
-    lines.push(`value_usd totals your file's own column; this CLI reads no price. Total for the ${opts.acting.length} rows this run will act on: ${formatUsd(total)}${excluded > 0 ? ` (${excluded} row${excluded === 1 ? "" : "s"} excluded: the cell did not parse)` : ""}`);
+    lines.push(`value_usd totals your file's own column; this CLI reads no price. Total for the ${opts.acting.length} rows this run will act on: ${formatUsd2(total)}${excluded > 0 ? ` (${excluded} row${excluded === 1 ? "" : "s"} excluded: the cell did not parse)` : ""}`);
   }
   const accepted = opts.acting.filter((item) => item.kind === "promote" && item.acceptedUnknown);
   if (accepted.length > 0) {
@@ -56439,10 +58578,12 @@ function finish(ctx, opts) {
   const resumed = opts.keys.filter((r) => r.state === "resumed").length;
   const skipped = opts.keys.filter((r) => r.state === "skipped").length;
   const unverified = opts.keys.filter((r) => r.state !== "skipped" && r.remoteAuthority !== "verified-active");
-  const complete = opts.exit === 0;
+  const rebindFailed = opts.rebound?.run !== undefined && !opts.rebound.run.ok;
+  const exit = rebindFailed ? Math.max(opts.exit, 1) : opts.exit;
+  const complete = exit === 0;
   if (ctx.json) {
     writeJson(ctx.deps, {
-      ok: true,
+      ok: !rebindFailed,
       complete,
       file: opts.file,
       rows: opts.rows,
@@ -56450,11 +58591,12 @@ function finish(ctx, opts) {
       resumed,
       skipped,
       destinations: opts.destinations.map(({ label, address, keys }) => ({ label, address, keys })),
-      keys: opts.keys,
+      keys: opts.rebound === undefined ? opts.keys : keysWithRebind(opts.keys, opts.rebound.phase, opts.rebound.run),
       controlledBy: controlledByJson(opts.controlledBy),
-      authorities: authoritiesJson(opts.roles)
+      authorities: authoritiesJson(opts.roles),
+      ...opts.rebound !== undefined ? rebindJson(opts.rebound.input) : {}
     });
-    return opts.exit;
+    return exit;
   }
   const parts = [];
   if (promoted > 0)
@@ -56465,11 +58607,19 @@ function finish(ctx, opts) {
     parts.push(`${skipped} already promoted (skipped)`);
   ctx.deps.stdout.write(`${parts.join("; ")}.
 `);
-  if (!complete) {
+  if (unverified.length > 0) {
     ctx.deps.stdout.write(`${unverified.length} import${unverified.length === 1 ? "" : "s"} did not report verified-active: ${unverified.map((r) => r.address).join(", ")}
 `);
   }
-  return opts.exit;
+  if (opts.rebound !== undefined) {
+    const { input, run } = opts.rebound;
+    const moved = input.wallets.filter((w) => run?.outcomes.get(w.id)?.state === "rebound").length;
+    const already = input.wallets.filter((w) => run?.outcomes.get(w.id)?.state === "unchanged").length;
+    const pending = input.wallets.length - moved - already;
+    ctx.deps.stdout.write(`${moved + already} of ${input.wallets.length + input.notRebindable.length} wallets bound to ${input.target.keyPrefix}${pending > 0 ? `; ${pending} still on ${input.callingKeyPrefix}` : ""}${input.notRebindable.length > 0 ? `; ${input.notRebindable.length} not yet rebindable` : ""}.
+`);
+  }
+  return exit;
 }
 
 // src/commands/vault-rename.ts
@@ -57555,8 +59705,78 @@ function describeEnvelope(envelope, facts) {
 
 // src/commands/vault-transfer.ts
 init_args();
+init_deps();
 init_promote_support();
 init_store();
+
+// src/vault/tee-transfer.ts
+init_errors();
+function assertNoPendingSweep(entry) {
+  const pending = entry.tee?.sweepPending?.length ?? 0;
+  if (pending === 0)
+    return;
+  throw new VaultError("TRANSFER_SWEEP_PENDING", `${entry.label} (${entry.address}) has ${pending} pending sweep transaction(s); a transfer would interleave with that sweep.`, { suggestion: `Finish the sweep first: candle tee sweep ${entry.address} --rpc-url <url>` });
+}
+async function readTeeServerState(ctx, entry, apiKey) {
+  if (entry.linkedWalletId === undefined) {
+    return { read: false, reason: "this wallet has no linked wallet id recorded" };
+  }
+  if (apiKey === undefined)
+    return { read: false, reason: "no API key for this profile" };
+  try {
+    const result = await apiRequest(`/api/v1/agent/wallets/${encodeURIComponent(entry.linkedWalletId)}/lifecycle`, {
+      auth: "key",
+      credentials: { apiKey },
+      apiUrl: ctx.apiUrl,
+      fetch: ctx.deps.fetch,
+      env: ctx.deps.env
+    });
+    if (!result.ok)
+      return { read: false, reason: result.message };
+    const state = result.body.state;
+    if (typeof state !== "string")
+      return { read: false, reason: "the lifecycle response carried no state" };
+    return { read: true, state };
+  } catch (error) {
+    return { read: false, reason: error instanceof Error ? error.message : String(error) };
+  }
+}
+function serverStateNotice(state) {
+  if (!state.read) {
+    return `Could not read this wallet's Candle state (${state.reason}); proceeding. An agent may be trading it.`;
+  }
+  if (state.state === "enabled") {
+    return "Warning: this wallet is enabled, so an agent may be trading it now; a trade may fail if this transfer leaves too little.";
+  }
+  return;
+}
+async function reportTransferActivity(ctx, apiKey, signature) {
+  const unseen = "Candle's history will not show this transfer.";
+  if (apiKey === undefined)
+    return { outcome: "no-api-key", line: `No API key for this profile, so ${unseen}` };
+  try {
+    const result = await apiRequest("/api/v1/activity/report", {
+      method: "POST",
+      body: { chain: "solana", signature },
+      auth: "key",
+      credentials: { apiKey },
+      apiUrl: ctx.apiUrl,
+      fetch: ctx.deps.fetch,
+      env: ctx.deps.env
+    });
+    if (result.ok)
+      return { outcome: "reported", line: "Reported to Candle's history." };
+    if (result.code === "SCOPE_MISSING") {
+      return { outcome: "scope-missing", line: `This profile's API key lacks activity:write, so ${unseen}` };
+    }
+    return { outcome: "failed", line: `Could not report this transfer (${result.message}); ${unseen}` };
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    return { outcome: "failed", line: `Could not report this transfer (${reason}); ${unseen}` };
+  }
+}
+
+// src/commands/vault-transfer.ts
 init_vault_support();
 async function vaultTransfer(args, ctx) {
   const parsed = parseArgs(args, {
@@ -57597,11 +59817,17 @@ async function vaultTransfer(args, ctx) {
       promptText: "Vault passphrase (input hidden): "
     });
     const vault = hold(opened.vault);
-    const fromEntry = findVaultRoleEntry(vault.index, fromLabel);
+    const fromEntry = findTransferSource(vault.index, fromLabel);
     if (fromEntry === undefined) {
-      return usage(ctx, `No vault key matches --from ${fromLabel}.`);
+      return usage(ctx, `No vault key or promoted wallet matches --from ${fromLabel}.`);
     }
-    assertVaultSigner(fromEntry);
+    assertTransferSigner(fromEntry);
+    const promoted = fromEntry.role === "tee-wallet";
+    if (promoted)
+      assertNoPendingSweep(fromEntry);
+    const note = (line) => (ctx.json ? ctx.deps.stderr : ctx.deps.stdout).write(`${line}
+`);
+    const apiKey = promoted ? await resolveApiKey(ctx.deps, ctx.profile) : undefined;
     const reconciled = await reconcileFundingReceipts(vault, [fromEntry.address, to], rpcUrl2, ctx);
     if (reconciled !== null)
       return reconciled;
@@ -57615,11 +59841,25 @@ async function vaultTransfer(args, ctx) {
     });
     const feeQuote = await quoteTransferFee(rpcUrl2, ctx.deps.fetch, plan.from, plan.instructions);
     displayTransferPlan(ctx, plan, feeQuote);
+    if (promoted) {
+      const notice = serverStateNotice(await readTeeServerState(ctx, fromEntry, apiKey));
+      if (notice !== undefined)
+        note(notice);
+    }
     await confirmLastSix(ctx, to, "the destination");
     await opened.confirm(`sign transfer of ${plan.amount} ${plan.asset} to ${to}`);
     const secret = await decryptKey(vault, fromEntry.id);
     try {
       const result = await signAndBroadcastTransfer({ ctx, rpcUrl: rpcUrl2, secret64: secret, plan });
+      let activityReport;
+      if (promoted && result.finalized) {
+        const report = await reportTransferActivity(ctx, apiKey, result.signature);
+        activityReport = report.outcome;
+        note(report.line);
+      } else if (promoted) {
+        activityReport = "not-finalized";
+        note("Not reported to Candle's history: finality is not yet confirmed.");
+      }
       if (ctx.json) {
         writeJson(ctx.deps, {
           ok: result.finalized,
@@ -57629,7 +59869,8 @@ async function vaultTransfer(args, ctx) {
           amount: plan.amount,
           asset: plan.asset,
           amountRaw: plan.amountRaw.toString(),
-          finalized: result.finalized
+          finalized: result.finalized,
+          ...activityReport !== undefined ? { activityReport } : {}
         });
       } else {
         ctx.deps.stdout.write(result.finalized ? `Transferred ${plan.amount} ${plan.asset} to ${to}: ${result.signature}
@@ -58063,6 +60304,9 @@ function extractGlobalFlags(argv) {
 var COMMANDS = {
   swap: { bare: swap, subcommands: { status: swapStatus } },
   launch: { bare: launch },
+  pnl: { bare: pnl },
+  portfolio: { bare: portfolio },
+  lp: { subcommands: { pools: lpPools, add: lpAdd, positions: lpPositions, remove: lpRemove, claim: lpClaim } },
   auth: { subcommands: { login: authLogin, status: authStatus, logout: authLogout } },
   keys: { subcommands: { list: keysList, create: keysCreate, revoke: keysRevoke, wallets: keysWallets } },
   wallets: {