@candledottv/cli 0.11.6 → 0.11.8

package/dist/index.js

@@ -278,6 +278,16 @@ var init_args = __esm(() => {
 });
 
 // src/agent-key-access.ts
+function scopesForPreset(preset) {
+  switch (preset) {
+    case "read":
+      return [...READ_SCOPES];
+    case "readwrite":
+      return [...READWRITE_SCOPES];
+    case "readwritetransfer":
+      return [...READWRITETRANSFER_SCOPES];
+  }
+}
 function sameSet(scopes, preset) {
   const held = new Set(scopes);
   return held.size === preset.length && preset.every((scope) => held.has(scope));
@@ -287,6 +297,8 @@ function presetForScopes(scopes) {
     return "read";
   if (sameSet(scopes, READWRITE_SCOPES))
     return "readwrite";
+  if (sameSet(scopes, READWRITETRANSFER_SCOPES))
+    return "readwritetransfer";
   return null;
 }
 function agentKeyCapabilities(scopes) {
@@ -295,6 +307,7 @@ function agentKeyCapabilities(scopes) {
     launch: scopes.includes("launch:write"),
     trade: scopes.includes("swap:write"),
     transfer: scopes.includes("transfer:write"),
+    linkedTransfer: scopes.includes("transfer:bound"),
     report: scopes.includes("activity:write")
   };
 }
@@ -308,7 +321,7 @@ function agentKeyAccess(scopes) {
 function sortAgentKeyScopes(scopes) {
   return [...scopes].sort();
 }
-var READ_SCOPES, READWRITE_SCOPES, AGENT_KEY_PRESET_LABELS, AGENT_KEY_CAPABILITY_CHIPS;
+var READ_SCOPES, READWRITE_SCOPES, READWRITETRANSFER_SCOPES, AGENT_KEY_PRESET_LABELS, AGENT_KEY_CAPABILITY_CHIPS;
 var init_agent_key_access = __esm(() => {
   READ_SCOPES = ["account:read"];
   READWRITE_SCOPES = [
@@ -319,18 +332,35 @@ var init_agent_key_access = __esm(() => {
     "transfer:write",
     "account:read"
   ];
-  AGENT_KEY_PRESET_LABELS = { read: "Read", readwrite: "Read:Write" };
+  READWRITETRANSFER_SCOPES = [
+    "launch:write",
+    "launch:read",
+    "activity:write",
+    "swap:write",
+    "transfer:write",
+    "account:read",
+    "transfer:bound"
+  ];
+  AGENT_KEY_PRESET_LABELS = {
+    read: "Read",
+    readwrite: "Read:Write",
+    readwritetransfer: "Read:Write:Transfer"
+  };
   AGENT_KEY_CAPABILITY_CHIPS = [
     ["Launch", "launch"],
     ["Trade", "trade"],
     ["Transfer", "transfer"],
+    ["Linked transfer", "linkedTransfer"],
     ["Report", "report"]
   ];
 });
 
 // src/render.ts
 function formatScopesForSummary(scopes) {
-  return sortAgentKeyScopes(scopes).map((scope) => scope === "swap:write" ? `${scope} (${SWAP_WRITE_NOTE})` : scope === "transfer:write" ? `${scope} (${TRANSFER_WRITE_NOTE})` : scope).join(", ");
+  return sortAgentKeyScopes(scopes).map((scope) => scope === "swap:write" ? `${scope} (${SWAP_WRITE_NOTE})` : scope === "transfer:write" ? `${scope} (${TRANSFER_WRITE_NOTE})` : scope === "transfer:bound" ? `${scope} (${TRANSFER_BOUND_NOTE})` : scope).join(", ");
+}
+function terminalText(value) {
+  return value.replace(/[\u0000-\u001f\u007f-\u009f]/g, "");
 }
 function renderTable(headers, rows) {
   const widths = headers.map((header, col) => Math.max(header.length, ...rows.map((row) => (row[col] ?? "").length)));
@@ -433,7 +463,7 @@ function portalDeviceUrl(apiUrl, portalOrigin) {
     return `${apiUrl}/agents`;
   }
 }
-var ALL_AGENT_SCOPES, DEFAULT_AGENT_SCOPES, SWAP_WRITE_NOTE = "moves funds -- this key can execute swaps on your behalf", TRANSFER_WRITE_NOTE = "moves funds -- this key can transfer assets between your wallets";
+var ALL_AGENT_SCOPES, DEFAULT_AGENT_SCOPES, SWAP_WRITE_NOTE = "moves funds -- this key can execute swaps on your behalf", TRANSFER_WRITE_NOTE = "moves funds -- this key can transfer assets between your wallets", TRANSFER_BOUND_NOTE = "moves funds -- this key can move funds out of the wallet it runs, to your linked wallets and its vault";
 var init_render = __esm(() => {
   init_agent_key_access();
   ALL_AGENT_SCOPES = [
@@ -442,9 +472,10 @@ var init_render = __esm(() => {
     "account:read",
     "activity:write",
     "swap:write",
-    "transfer:write"
+    "transfer:write",
+    "transfer:bound"
   ];
-  DEFAULT_AGENT_SCOPES = ALL_AGENT_SCOPES.filter((scope) => scope !== "swap:write" && scope !== "transfer:write");
+  DEFAULT_AGENT_SCOPES = ALL_AGENT_SCOPES.filter((scope) => scope !== "swap:write" && scope !== "transfer:write" && scope !== "transfer:bound");
 });
 
 // src/profiles.ts
@@ -2161,6 +2192,9 @@ function libraryInstallInstruction(platform) {
 }
 
 // src/fido2-helper/protocol.ts
+function excludeCapacity(device) {
+  return device.maxCredentialCountInList ?? 1;
+}
 var HELPER_PROTOCOL = 1, RP_ID = "cli.candle.tv", PROBE_MAX_CREDENTIALS = 16, AUTHDATA_FLAG_UP = 1, AUTHDATA_FLAG_UV = 4, AUTHDATA_MIN_LENGTH = 37;
 var init_protocol = () => {};
 
@@ -3140,7 +3174,9 @@ var init_errors = __esm(() => {
     "WALLET_LIMIT_REACHED",
     "TIER_REQUIRED",
     "LINKED_WALLET_ROOM_UNREADABLE",
-    "PROMOTE_ACCOUNT_UNRESOLVED"
+    "PROMOTE_ACCOUNT_UNRESOLVED",
+    "TRANSFER_SWEEP_PENDING",
+    "VAULT_KEY_ALREADY_ENROLLED"
   ];
   VaultError = class VaultError extends Error {
     code;
@@ -5953,6 +5989,9 @@ function translateHelperFailure(code, message, platform) {
     LIBRARY_MISSING: "VAULT_HELPER_MISSING"
   };
   const suggestion = "Nothing was derived and no other factor was tried.";
+  if (code === "CREDENTIAL_EXCLUDED") {
+    return new VaultError("VAULT_KEY_ALREADY_ENROLLED", `This security key already holds one of this vault's credentials, so enrolling it again would not add a second key (${message}). Nothing was written.`, { suggestion: ALREADY_ENROLLED_SUGGESTION });
+  }
   if (code === "DEVICE_NOT_READABLE") {
     return new VaultError("VAULT_AUTHENTICATOR_NOT_READABLE", platform === "linux" ? HIDRAW_MESSAGE : `A security key is attached but this user cannot open it: ${message}.`, { suggestion: "No other factor is substituted." });
   }
@@ -6013,6 +6052,51 @@ async function callHelper(deps, helperPath, request) {
     throw translateHelperFailure(String(response.code), String(response.message), deps.platform);
   return response;
 }
+function alreadyEnrolled(device, envelopeId) {
+  const product = device.product || "This security key";
+  return new VaultError("VAULT_KEY_ALREADY_ENROLLED", `${product} (--device ${device.deviceId}) already holds this vault's security key credential${envelopeId !== undefined ? ` for envelope ${envelopeId}` : ""}, so enrolling it again would not add a second key. Nothing was written.`, {
+    suggestion: ALREADY_ENROLLED_SUGGESTION,
+    ...envelopeId !== undefined ? { details: { envelopeId } } : {}
+  });
+}
+function helperPredatesExcludeList(helperPath, leftover) {
+  return new VaultError("VAULT_HELPER_MISSING", `The security key helper at ${helperPath} predates the exclude list this command needs; reinstall the CLI so candle and candle-fido2 come from the same release.`, {
+    suggestion: leftover ? "Nothing was written to the vault. The credential now on the authenticator can be removed with its vendor's tool. Reinstall the CLI so candle and candle-fido2 come from the same release, then enroll again." : "Nothing was sent to any key and nothing was written. Reinstall the CLI so candle and candle-fido2 come from the same release, then enroll again."
+  });
+}
+function assertHelperExcludeList(info, helperPath, excludeCount) {
+  if (excludeCount === 0)
+    return;
+  const features = Array.isArray(info.features) ? info.features : [];
+  if (!features.includes(EXCLUDE_LIST_FEATURE))
+    throw helperPredatesExcludeList(helperPath, false);
+}
+function assertExcludeListFits(device, excludeCount) {
+  const capacity = excludeCapacity(device);
+  if (excludeCount <= capacity)
+    return;
+  throw new VaultError("VAULT_FACTOR_UNAVAILABLE", `${device.product || "This security key"} (--device ${device.deviceId}) takes at most ${capacity} credential${capacity === 1 ? "" : "s"} in one request${device.maxCredentialCountInList === null ? " (it reports no maxCredentialCountInList)" : ""}, and this vault has ${excludeCount} security key credentials to exclude, so it cannot enroll on this vault. Nothing was sent to it.`, { suggestion: "Nothing was written. Use a security key that reports a larger maxCredentialCountInList." });
+}
+function assertDeviceServesFactor(device) {
+  if (!device.extensions.includes("hmac-secret")) {
+    throw new VaultError("VAULT_PRF_UNSUPPORTED", `${device.product || "This security key"} does not support the hmac-secret extension, which this factor needs.`, { suggestion: "Use a key that supports hmac-secret (FIDO2 with PRF). No other derivation is substituted." });
+  }
+  if (device.options.clientPin !== true && device.options.uv !== true) {
+    throw new VaultError("VAULT_UV_UNSUPPORTED", `${device.product || "This security key"} has no PIN set and no built-in user verification, and this factor uses the user-verified secret only.`, { suggestion: "Set a PIN on this key (its vendor's tool does that) and retry. Nothing was written." });
+  }
+}
+async function listSecurityKeys(deps, opts) {
+  const location = await locateFido2Helper(deps);
+  if (location.state === "absent")
+    throw helperMissing(location);
+  const info = await callHelper(deps, location.path, {
+    op: "info",
+    vaultId: opts.vaultId,
+    envelopeId: opts.envelopeId,
+    digest: base64.encode(operationDigest({ vaultId: opts.vaultId, envelopeId: opts.envelopeId, op: "info", nonce: b64u(randomBytes2(16)) }))
+  });
+  return { helperPath: location.path, info };
+}
 function describeDeviceForList(device) {
   const product = device.product || "security key";
   return `--device ${device.deviceId}  ${product}${device.manufacturer ? ` (${device.manufacturer})` : ""}${device.readable ? "" : "  [not readable by this user]"}`;
@@ -6095,17 +6179,12 @@ async function openSecurityKeySession(deps, opts) {
     deps.stderr.write(`Using the attached security key: ${device.product || "security key"} (--device ${device.deviceId})
 `);
   }
-  if (opts.requireFeatures) {
-    if (!device.extensions.includes("hmac-secret")) {
-      throw new VaultError("VAULT_PRF_UNSUPPORTED", `${device.product || "This security key"} does not support the hmac-secret extension, which this factor needs.`, { suggestion: "Use a key that supports hmac-secret (FIDO2 with PRF). No other derivation is substituted." });
-    }
-    if (device.options.clientPin !== true && device.options.uv !== true) {
-      throw new VaultError("VAULT_UV_UNSUPPORTED", `${device.product || "This security key"} has no PIN set and no built-in user verification, and this factor uses the user-verified secret only.`, { suggestion: "Set a PIN on this key (its vendor's tool does that) and retry. Nothing was written." });
-    }
-  }
+  if (opts.requireFeatures)
+    assertDeviceServesFactor(device);
+  opts.beforePin?.(device, info);
   const session = { helperPath: location.path, device, snapshotId: info.snapshotId };
   if (device.options.clientPin === true) {
-    const typed = await deps.promptSecret(`PIN for ${device.product || "the security key"} (input hidden): `);
+    const typed = await deps.promptSecret(opts.pinPrompt?.(device) ?? `PIN for ${device.product || "the security key"} (input hidden): `);
     if (typed === "") {
       throw new VaultError("VAULT_PIN_REQUIRED", "This security key needs its PIN and none was typed; nothing was sent to it.");
     }
@@ -6159,7 +6238,7 @@ async function probeAttachedKeys(deps, opts) {
       if (opts.deviceFlag === undefined && allReadable && !uncertain)
         state.set(envelopeId, "not attached");
     }
-    return { state, holder };
+    return { state, holder, devices, credentials: credentialOf };
   } catch {
     return;
   }
@@ -6167,20 +6246,37 @@ async function probeAttachedKeys(deps, opts) {
 async function registerCredential(deps, session, opts) {
   deps.stderr.write(`Touch ${session.device.product || "the security key"} to register the vault's credential on it.
 `);
-  const digest = operationDigest({ ...opts, op: "register", nonce: b64u(randomBytes2(16)) });
-  const response = await callHelper(deps, session.helperPath, {
-    op: "register",
+  const digest = operationDigest({
     vaultId: opts.vaultId,
     envelopeId: opts.envelopeId,
-    digest: base64.encode(digest),
-    deviceId: session.device.deviceId,
-    expectSnapshot: session.snapshotId,
-    rpId: RP_ID,
-    userId: base64.encode(userIdFor(opts.vaultId, opts.envelopeId)),
-    userName: userNameFor(opts.vaultId, opts.envelopeId),
-    clientDataHash: base64.encode(digest),
-    ...session.pin !== undefined ? { pin: session.pin } : {}
+    op: "register",
+    nonce: b64u(randomBytes2(16))
   });
+  const exclude = opts.excludeCredentialIds ?? [];
+  let response;
+  try {
+    response = await callHelper(deps, session.helperPath, {
+      op: "register",
+      vaultId: opts.vaultId,
+      envelopeId: opts.envelopeId,
+      digest: base64.encode(digest),
+      deviceId: session.device.deviceId,
+      expectSnapshot: session.snapshotId,
+      rpId: RP_ID,
+      userId: base64.encode(userIdFor(opts.vaultId, opts.envelopeId)),
+      userName: userNameFor(opts.vaultId, opts.envelopeId),
+      clientDataHash: base64.encode(digest),
+      ...session.pin !== undefined ? { pin: session.pin } : {},
+      ...exclude.length > 0 ? { excludeCredentialIds: exclude } : {}
+    });
+  } catch (error) {
+    if (error instanceof VaultError && error.code === "VAULT_KEY_ALREADY_ENROLLED")
+      throw alreadyEnrolled(session.device);
+    throw error;
+  }
+  if (exclude.length > 0 && response.excluded !== exclude.length) {
+    throw helperPredatesExcludeList(session.helperPath, true);
+  }
   const authData = base64.decode(response.authData);
   assertAuthenticatorData(authData, RP_ID, "registration");
   return {
@@ -6220,7 +6316,7 @@ async function assertPrf(deps, session, envelope, vaultId, purpose) {
   }
   return prfOutput;
 }
-var HELPER_NAME = "candle-fido2", HELPER_ENV = "CANDLE_FIDO2_HELPER", HELPER_TIMEOUT_MS = 90000, HELPER_INSTALL_SUGGESTION = "Install a release build of the CLI (the installer script or Homebrew place candle-fido2 beside candle), or set CANDLE_FIDO2_HELPER to the path of a candle-fido2 executable. No other factor is substituted.";
+var HELPER_NAME = "candle-fido2", HELPER_ENV = "CANDLE_FIDO2_HELPER", HELPER_TIMEOUT_MS = 90000, HELPER_INSTALL_SUGGESTION = "Install a release build of the CLI (the installer script or Homebrew place candle-fido2 beside candle), or set CANDLE_FIDO2_HELPER to the path of a candle-fido2 executable. No other factor is substituted.", ALREADY_ENROLLED_SUGGESTION = "Insert a different security key, or name one with --device.", EXCLUDE_LIST_FEATURE = "exclude-list";
 var init_fido2 = __esm(() => {
   init_sha256();
   init_esm();
@@ -8344,6 +8440,23 @@ function retryAfterMs(header, now) {
     return;
   return Math.max(0, at - now);
 }
+function readProgramAccounts(method, entries, sliced) {
+  const pubkeys = entries.map((entry) => {
+    const pubkey = entry?.pubkey;
+    if (typeof pubkey !== "string")
+      throw new SolanaRpcError(`RPC ${method} answered an account without a pubkey`);
+    return pubkey;
+  });
+  if (!sliced)
+    return pubkeys;
+  return entries.map((entry, i) => {
+    const data = entry.account?.data;
+    const encoded = Array.isArray(data) && data[1] === "base64" ? data[0] : undefined;
+    if (typeof encoded !== "string")
+      throw new SolanaRpcError(`RPC ${method} answered an account without base64 data`);
+    return { pubkey: pubkeys[i], data: new Uint8Array(Buffer.from(encoded, "base64")) };
+  });
+}
 function rawAccountView(value, address) {
   if (!value)
     return null;
@@ -8488,28 +8601,31 @@ function createSolanaRpc(url, fetchFn) {
       const r = await call("getSignaturesForAddress", [address, { limit: 1 }]);
       return Array.isArray(r) && r.length > 0;
     },
-    async isBlockhashValid(blockhash) {
-      const r = await call("isBlockhashValid", [blockhash, { commitment: "finalized" }]);
+    async isBlockhashValid(blockhash, commitment = "finalized") {
+      const r = await call("isBlockhashValid", [blockhash, { commitment }]);
       if (typeof r?.value !== "boolean")
         throw new Error("isBlockhashValid answered with a non-boolean value");
       return r.value;
     },
-    async getProgramAccounts(programId, filters, opts) {
-      const r = await call("getProgramAccounts", [programId, { encoding: "base64", commitment: "finalized", dataSlice: { offset: 0, length: 0 }, filters }], opts?.signal);
+    getProgramAccounts: async (programId, filters, opts) => {
+      const r = await call("getProgramAccounts", [
+        programId,
+        {
+          encoding: "base64",
+          commitment: "finalized",
+          dataSlice: opts?.dataSlice ?? { offset: 0, length: 0 },
+          filters
+        }
+      ], opts?.signal);
       if (!Array.isArray(r))
         throw new SolanaRpcError("RPC getProgramAccounts answered without an account list");
-      return r.map((entry) => {
-        if (typeof entry?.pubkey !== "string") {
-          throw new SolanaRpcError("RPC getProgramAccounts answered an account without a pubkey");
-        }
-        return entry.pubkey;
-      });
+      return readProgramAccounts("getProgramAccounts", r, opts?.dataSlice !== undefined);
     },
-    async getProgramAccountsV2(programId, filters, opts) {
+    getProgramAccountsV2: async (programId, filters, opts) => {
       const config = {
         encoding: "base64",
         commitment: "finalized",
-        dataSlice: { offset: 0, length: 0 },
+        dataSlice: opts?.dataSlice ?? { offset: 0, length: 0 },
         filters,
         limit: opts?.limit ?? PROGRAM_ACCOUNTS_V2_LIMIT
       };
@@ -8520,19 +8636,17 @@ function createSolanaRpc(url, fetchFn) {
         throw new SolanaRpcError("RPC getProgramAccountsV2 answered without an account list");
       }
       const page = r;
-      const pubkeys = page.accounts.map((entry) => {
-        if (typeof entry?.pubkey !== "string") {
-          throw new SolanaRpcError("RPC getProgramAccountsV2 answered an account without a pubkey");
-        }
-        return entry.pubkey;
-      });
+      const sliced = opts?.dataSlice !== undefined;
+      const accounts = readProgramAccounts("getProgramAccountsV2", page.accounts, sliced);
       const cursor = page.paginationKey;
-      if (cursor === null || cursor === undefined)
-        return { pubkeys, paginationKey: null };
-      if (typeof cursor !== "string" || cursor.length === 0) {
-        throw new SolanaRpcError("RPC getProgramAccountsV2 answered a paginationKey that is not a string");
+      let paginationKey = null;
+      if (cursor !== null && cursor !== undefined) {
+        if (typeof cursor !== "string" || cursor.length === 0) {
+          throw new SolanaRpcError("RPC getProgramAccountsV2 answered a paginationKey that is not a string");
+        }
+        paginationKey = cursor;
       }
-      return { pubkeys, paginationKey: cursor };
+      return sliced ? { accounts, paginationKey } : { pubkeys: accounts, paginationKey };
     }
   };
 }
@@ -8647,7 +8761,7 @@ async function keysList(args, ctx) {
 async function keysCreate(args, ctx) {
   const { deps, apiUrl, json } = ctx;
   const parsed = parseArgs(args, {
-    valueFlags: ["--scopes", "--environment", "--label", "--expires-in", "--tx-limit", "--reset"]
+    valueFlags: ["--scopes", "--access", "--environment", "--label", "--expires-in", "--tx-limit", "--reset"]
   });
   if ("error" in parsed) {
     writeUsageFailure(deps, parsed.error, json);
@@ -8657,7 +8771,20 @@ async function keysCreate(args, ctx) {
     writeUsageFailure(deps, `Unexpected argument: ${parsed.positionals[0]}`, json);
     return 2;
   }
-  const requestedScopes = parsed.values["--scopes"] ? parseScopesList(parsed.values["--scopes"]) : undefined;
+  if (parsed.values["--access"] !== undefined && parsed.values["--scopes"] !== undefined) {
+    writeUsageFailure(deps, "--access and --scopes are mutually exclusive; pass one of them.", json);
+    return 2;
+  }
+  let accessScopes;
+  if (parsed.values["--access"] !== undefined) {
+    const preset = ACCESS_LEVELS[parsed.values["--access"]];
+    if (preset === undefined) {
+      writeUsageFailure(deps, `--access must be one of: ${Object.keys(ACCESS_LEVELS).join(", ")}.`, json);
+      return 2;
+    }
+    accessScopes = scopesForPreset(preset);
+  }
+  const requestedScopes = accessScopes ?? (parsed.values["--scopes"] ? parseScopesList(parsed.values["--scopes"]) : undefined);
   const environment = parsed.values["--environment"];
   const label = parsed.values["--label"]?.trim();
   if (parsed.values["--label"] !== undefined && (label === undefined || label.length < 1 || label.length > 64)) {
@@ -8753,7 +8880,7 @@ WARNING: the key above was NOT stored in the ${deps.backend} store: ${storeError
 `);
   }
   if (!requestedScopes) {
-    deps.stdout.write(`No --scopes given: the server granted the default scopes (swap:write excluded).
+    deps.stdout.write(`No --access or --scopes given: the server granted the default scopes (swap:write excluded).
 `);
   }
   if (storeError === undefined) {
@@ -8820,7 +8947,7 @@ async function keysRevoke(args, ctx) {
   }
   return 0;
 }
-var KEYS_PATH = "/api/v1/agent/keys", NO_DEVICE_TOKEN;
+var KEYS_PATH = "/api/v1/agent/keys", ACCESS_LEVELS, NO_DEVICE_TOKEN;
 var init_keys = __esm(() => {
   init_agent_key_access();
   init_args();
@@ -8828,6 +8955,11 @@ var init_keys = __esm(() => {
   init_profiles();
   init_render();
   init_secret_store();
+  ACCESS_LEVELS = {
+    read: "read",
+    "read-write": "readwrite",
+    "read-write-transfer": "readwritetransfer"
+  };
   NO_DEVICE_TOKEN = {
     code: "NO_DEVICE_TOKEN",
     message: "No device token available.",
@@ -8837,13 +8969,13 @@ var init_keys = __esm(() => {
 
 // src/vault/signer-roles.ts
 function tokenMintFilters(key) {
-  return [{ dataSize: 82 }, memcmp(0, concat2(COPTION_SOME_U32, key))];
+  return [{ dataSize: 82 }, memcmp(4, key)];
 }
 function tokenFreezeFilters(key) {
   return [{ dataSize: 82 }, memcmp(46, concat2(COPTION_SOME_U32, key))];
 }
 function token2022MintFilters(key) {
-  const authority = memcmp(0, concat2(COPTION_SOME_U32, key));
+  const authority = memcmp(4, key);
   return [
     [{ dataSize: 82 }, authority],
     [memcmp(165, TOKEN_2022_MINT_ACCOUNT_TYPE), authority]
@@ -8856,6 +8988,9 @@ function token2022FreezeFilters(key) {
     [memcmp(165, TOKEN_2022_MINT_ACCOUNT_TYPE), authority]
   ];
 }
+function keepSetAuthority(hits) {
+  return hits.filter((hit) => hit.data.length === COPTION_SOME_U32.length && hit.data.every((byte, i) => byte === COPTION_SOME_U32[i])).map((hit) => hit.pubkey);
+}
 function programUpgradeFilters(key) {
   return [memcmp(0, LOADER_PROGRAM_DATA_TAG), memcmp(12, concat2(COPTION_SOME_U8, key))];
 }
@@ -8950,19 +9085,31 @@ async function readSignerRoles(rpc, addresses, opts) {
     const timer = timeoutMs > 0 ? setTimeout(() => controller.abort(Object.assign(new Error("timed out"), { name: "TimeoutError" })), timeoutMs) : undefined;
     try {
       requests += 1;
+      const tagSlice = task.group.tagSlice;
       if (task.via === "v2") {
         if (rpc.getProgramAccountsV2 === undefined) {
           throw new SolanaRpcError("RPC getProgramAccountsV2 failed: -32601 Method not found", {
             rpcCode: RPC_METHOD_NOT_FOUND
           });
         }
-        return await rpc.getProgramAccountsV2(task.group.programId, filters, {
+        const pageOpts = {
           signal: controller.signal,
           ...task.paginationKey !== undefined ? { paginationKey: task.paginationKey } : {}
-        });
+        };
+        if (tagSlice === undefined)
+          return await rpc.getProgramAccountsV2(task.group.programId, filters, pageOpts);
+        const page = await rpc.getProgramAccountsV2(task.group.programId, filters, { ...pageOpts, dataSlice: tagSlice });
+        return { pubkeys: keepSetAuthority(page.accounts), paginationKey: page.paginationKey };
       }
-      const pubkeys = await rpc.getProgramAccounts(task.group.programId, filters, { signal: controller.signal });
-      return { pubkeys, paginationKey: null };
+      if (tagSlice === undefined) {
+        const pubkeys = await rpc.getProgramAccounts(task.group.programId, filters, { signal: controller.signal });
+        return { pubkeys, paginationKey: null };
+      }
+      const hits = await rpc.getProgramAccounts(task.group.programId, filters, {
+        signal: controller.signal,
+        dataSlice: tagSlice
+      });
+      return { pubkeys: keepSetAuthority(hits), paginationKey: null };
     } finally {
       if (timer !== undefined)
         clearTimeout(timer);
@@ -9205,7 +9352,7 @@ var BPF_UPGRADEABLE_LOADER_ID = "BPFLoaderUpgradeab1e11111111111111111111111", S
   return out;
 }, COPTION_SOME_U32, COPTION_SOME_U8, LOADER_PROGRAM_DATA_TAG, LOADER_PROGRAM_TAG, TOKEN_2022_MINT_ACCOUNT_TYPE, memcmp = (offset, bytes) => ({
   memcmp: { offset, bytes: b642(bytes), encoding: "base64" }
-}), ROLE_GROUPS, PROGRAM_LABELS, NOT_CHECKED_LINE = "Not checked: multisig membership, Token-2022 extension authorities, metadata update authority.", thousands = (n) => n.toLocaleString("en-US");
+}), MINT_AUTHORITY_TAG_SLICE, ROLE_GROUPS, PROGRAM_LABELS, NOT_CHECKED_LINE = "Not checked: multisig membership, Token-2022 extension authorities, metadata update authority.", thousands = (n) => n.toLocaleString("en-US");
 var init_signer_roles = __esm(() => {
   init_esm();
   init_solana_lite();
@@ -9229,6 +9376,7 @@ var init_signer_roles = __esm(() => {
   LOADER_PROGRAM_DATA_TAG = new Uint8Array([3, 0, 0, 0]);
   LOADER_PROGRAM_TAG = new Uint8Array([2, 0, 0, 0]);
   TOKEN_2022_MINT_ACCOUNT_TYPE = new Uint8Array([1]);
+  MINT_AUTHORITY_TAG_SLICE = { offset: 0, length: 4 };
   ROLE_GROUPS = [
     {
       id: "token-mint",
@@ -9236,7 +9384,8 @@ var init_signer_roles = __esm(() => {
       program: "token",
       programId: TOKEN_PROGRAM_ID,
       label: "token mint",
-      shapes: (key) => [tokenMintFilters(key)]
+      shapes: (key) => [tokenMintFilters(key)],
+      tagSlice: MINT_AUTHORITY_TAG_SLICE
     },
     {
       id: "token-freeze",
@@ -9252,7 +9401,8 @@ var init_signer_roles = __esm(() => {
       program: "token-2022",
       programId: TOKEN_2022_PROGRAM_ID,
       label: "Token-2022 mint",
-      shapes: token2022MintFilters
+      shapes: token2022MintFilters,
+      tagSlice: MINT_AUTHORITY_TAG_SLICE
     },
     {
       id: "token2022-freeze",
@@ -9298,6 +9448,7 @@ var init_signer_roles = __esm(() => {
 // src/vault/promote-support.ts
 var exports_promote_support = {};
 __export(exports_promote_support, {
+  withToKey: () => withToKey,
   subjectPhrase: () => subjectPhrase,
   shortAddress: () => shortAddress,
   runRoleCheck: () => runRoleCheck,
@@ -9307,6 +9458,7 @@ __export(exports_promote_support, {
   promoteSentence: () => promoteSentence,
   printPromoteSentence: () => printPromoteSentence,
   findVaultRoleEntry: () => findVaultRoleEntry,
+  findTransferSource: () => findTransferSource,
   findEntryByLabelOrAddress: () => findEntryByLabelOrAddress,
   controlledByJson: () => controlledByJson,
   confirmPrompt: () => confirmPrompt,
@@ -9352,6 +9504,10 @@ function findVaultRoleEntry(index, labelOrAddress) {
     return byLabel;
   return index.entries.find((entry) => entry.address === labelOrAddress);
 }
+function findTransferSource(index, labelOrAddress) {
+  const byLabel = (role) => index.entries.find((entry) => entry.role === role && entry.label !== undefined && entry.label === labelOrAddress);
+  return byLabel("vault") ?? byLabel("tee-wallet") ?? index.entries.find((entry) => entry.address === labelOrAddress);
+}
 function findEntryByLabelOrAddress(index, labelOrAddress) {
   const byLabel = index.entries.find((entry) => entry.label !== undefined && entry.label === labelOrAddress);
   if (byLabel !== undefined)
@@ -9472,6 +9628,9 @@ async function confirmPromotion(ctx, n) {
 function shortAddress(address) {
   return `${address.slice(0, 6)}…${address.slice(-4)}`;
 }
+function withToKey(controlledBy, toKey) {
+  return { ...controlledBy, toKey };
+}
 function accountUnresolved(reason) {
   return new VaultError("PROMOTE_ACCOUNT_UNRESOLVED", `Could not confirm which Candle account this API key acts for (${reason}); nothing was written.`, {
     suggestion: "Check the key with: candle doctor. Promotion registers the keys to that account, so it does not proceed on a cached value."
@@ -9545,23 +9704,51 @@ function renderControlledBy(controlledBy, n) {
   const label = cleaned.length > 0 ? `(${cleaned})  ` : "";
   const environment = controlledBy.environment ?? "not a Candle host";
   const from = controlledBy.apiUrlFrom !== undefined ? `, from ${controlledBy.apiUrlFrom}` : "";
+  const { toKey } = controlledBy;
+  if (toKey === undefined) {
+    return [
+      `${subject} will be controlled by:`,
+      `  Candle account  ${controlledBy.username ?? "(no username)"}  (${shortAddress(controlledBy.account)})`,
+      `  API key         ${controlledBy.keyPrefix}…  ${label}${source}`,
+      `  API             ${controlledBy.apiUrl}  (${environment}${from})`
+    ].join(`
+`);
+  }
+  const toLabel = toKey.label !== null && labelCell(toKey.label).length > 0 ? `(${labelCell(toKey.label)})  ` : "";
   return [
     `${subject} will be controlled by:`,
     `  Candle account  ${controlledBy.username ?? "(no username)"}  (${shortAddress(controlledBy.account)})`,
-    `  API key         ${controlledBy.keyPrefix}…  ${label}${source}`,
-    `  API             ${controlledBy.apiUrl}  (${environment}${from})`
+    `  API key         ${toKey.keyPrefix}…  ${toLabel}--to-key, bound by a rebind after the import`,
+    `  imported under  ${controlledBy.keyPrefix}…  ${label}${source}`,
+    `  API             ${controlledBy.apiUrl}  (${environment}${from})`,
+    ...toKey.warnings
   ].join(`
 `);
 }
 function controlledByJson(controlledBy) {
+  const importedUnder = {
+    keyPrefix: controlledBy.keyPrefix,
+    keyLabel: controlledBy.keyLabel,
+    keySource: controlledBy.keySource
+  };
+  if (controlledBy.toKey === undefined) {
+    return {
+      account: controlledBy.account,
+      username: controlledBy.username,
+      ...importedUnder,
+      apiUrl: controlledBy.apiUrl,
+      environment: controlledBy.environment
+    };
+  }
   return {
     account: controlledBy.account,
     username: controlledBy.username,
-    keyPrefix: controlledBy.keyPrefix,
-    keyLabel: controlledBy.keyLabel,
-    keySource: controlledBy.keySource,
+    keyPrefix: controlledBy.toKey.keyPrefix,
+    keyLabel: controlledBy.toKey.label,
+    keySource: "--to-key",
     apiUrl: controlledBy.apiUrl,
-    environment: controlledBy.environment
+    environment: controlledBy.environment,
+    importedUnder
   };
 }
 async function runRoleCheck(ctx, rpc, addresses) {
@@ -13625,16 +13812,18 @@ async function request(ctx, key, path, body) {
     throw new TradingError("INVALID_RESPONSE", "Candle returned an invalid response.");
   return result.body;
 }
-async function teeWallets(ctx, key, scope) {
+async function listTradingWallets(ctx, key, scope) {
   let cursor;
   const rows = [];
   const cursors = new Set;
   let appId = "";
+  let scopes = [];
   for (;; ) {
     const response = walletPageSchema.parse(await request(ctx, key, `/api/v1/agent/wallets/trading${cursor ? `?cursor=${encodeURIComponent(cursor)}` : ""}`));
-    if (!response.scopes?.includes(scope))
+    if (scope !== undefined && !response.scopes?.includes(scope))
       throw new TradingError("SCOPE_MISSING", `The bound key needs ${scope}.`);
     appId = response.privyAppId ?? "";
+    scopes = response.scopes;
     if (!Array.isArray(response.page))
       throw new TradingError("INVALID_RESPONSE", "Wallet discovery did not return a page.");
     rows.push(...response.page);
@@ -13645,7 +13834,7 @@ async function teeWallets(ctx, key, scope) {
       throw new TradingError("INVALID_RESPONSE", "Wallet discovery did not complete.");
     cursors.add(cursor);
   }
-  return { rows, appId };
+  return { rows, appId, scopes };
 }
 function matchesName(row, name) {
   return row.id === name || row.address === name || row.label === name;
@@ -13675,32 +13864,31 @@ async function completeTradingWallet(ctx, row, appId, scope) {
   };
 }
 async function tradingWallet(ctx, key, name, scope) {
-  const { rows, appId } = await teeWallets(ctx, key, scope);
+  const { rows, appId } = await listTradingWallets(ctx, key, scope);
   const matches = rows.filter((row) => matchesName(row, name));
   if (matches.length !== 1) {
     throw new TradingError("TEE_WALLET_REQUIRED", matches.length > 1 ? `"${name}" matches ${matches.length} TEE wallets on this key: ${teeWalletList(matches)}. Name one by id or address.` : rows.length === 0 ? "This key has no TEE wallets bound to it. Enrol one, or select the profile whose key holds it." : `No TEE wallet on this key is called "${name}". Bound to this key: ${teeWalletList(rows)}.`);
   }
   return await completeTradingWallet(ctx, matches[0], appId, scope);
 }
-async function tradingPayer(ctx, key, name) {
-  const scope = "swap:write";
-  const { rows, appId } = await teeWallets(ctx, key, scope);
+async function tradingPayer(ctx, key, name, scope = "swap:write") {
+  const { rows, appId, scopes } = await listTradingWallets(ctx, key, scope);
   const embedded = embeddedSchema.parse(await request(ctx, key, "/api/v1/agent/wallets/embedded")).wallets?.solana?.address;
-  const asEmbedded = () => ({ kind: "embedded", address: embedded });
+  const asEmbedded = () => ({ kind: "embedded", address: embedded, scopes });
   const options = [
     ...rows.map((row) => `TEE ${describeWallet(row)}`),
     ...embedded ? [`embedded (${embedded})`] : []
   ].join("; ");
   if (name === undefined) {
     if (rows.length === 1 && !embedded)
-      return { kind: "tee", wallet: await completeTradingWallet(ctx, rows[0], appId, scope) };
+      return { kind: "tee", wallet: await completeTradingWallet(ctx, rows[0], appId, scope), scopes };
     if (rows.length === 0 && embedded)
       return asEmbedded();
     throw new TradingError("PAYER_REQUIRED", options.length === 0 ? "This account has no wallet that can pay for a swap. Enrol a TEE wallet, or create an embedded wallet in the app." : `Name the payer with --wallet. This account can pay from: ${options}.`);
   }
   const matches = rows.filter((row) => matchesName(row, name));
   if (matches.length === 1)
-    return { kind: "tee", wallet: await completeTradingWallet(ctx, matches[0], appId, scope) };
+    return { kind: "tee", wallet: await completeTradingWallet(ctx, matches[0], appId, scope), scopes };
   if (matches.length === 0 && embedded === name)
     return asEmbedded();
   throw new TradingError("TEE_WALLET_REQUIRED", matches.length > 1 ? `"${name}" matches ${matches.length} TEE wallets on this key: ${teeWalletList(matches)}. Name one by id or address.` : options.length === 0 ? `"${name}" is not a wallet this account can pay from, and it has none: enrol a TEE wallet, or create an embedded wallet in the app.` : `"${name}" is not a wallet this account can pay from. It can pay from: ${options}.`);
@@ -13808,7 +13996,7 @@ Minimum received: ${safeText(quote.minimumReceived)}
     throw new TradingError("CONFIRMATION_REQUIRED", "Run interactively to confirm, or use --yes for an ordinary trade prompt.");
   return (await ctx.deps.promptLine("Proceed? [y/N] ")).trim().toLowerCase() === "y";
 }
-async function saveLaunchSignature(ctx, key, id, transaction) {
+async function saveOperationSignature(ctx, key, id, kind, transaction) {
   const bytes = Buffer.from(transaction, "base64");
   let offset = 0;
   let count = 0;
@@ -13825,7 +14013,7 @@ async function saveLaunchSignature(ctx, key, id, transaction) {
   const signature = base58.encode(bytes.subarray(offset, offset + 64));
   const path = operationPath(ctx, key, id);
   const temporary = `${path}.${process.pid}.tmp`;
-  await writeFile4(temporary, JSON.stringify({ id, kind: "launch", signature }), { mode: 384 });
+  await writeFile4(temporary, JSON.stringify({ id, kind, signature }), { mode: 384 });
   const file = await open3(temporary, "r");
   try {
     await file.sync();
@@ -13835,7 +14023,7 @@ async function saveLaunchSignature(ctx, key, id, transaction) {
   await rename3(temporary, path);
   return signature;
 }
-var TradingError, feeSchema, risksSchema, artifactSchema, swapBuildSchema, launchBuildSchema, walletSchema, walletPageSchema, embeddedSchema, operationSchema, BASES;
+var TradingError, feeSchema, risksSchema, artifactSchema, swapBuildSchema, launchBuildSchema, walletSchema, walletPageSchema, embeddedSchema, operationSchema, lpAmountSchema, lpBuildSchema, lpPositionsSchema, lpPoolsSchema, BASES;
 var init_trading = __esm(() => {
   init_esm();
   init_zod();
@@ -13897,6 +14085,51 @@ var init_trading = __esm(() => {
     wallets: exports_external.object({ solana: exports_external.object({ address: exports_external.string() }).passthrough().nullable().optional() }).passthrough().optional()
   }).passthrough();
   operationSchema = exports_external.object({ job: exports_external.object({ status: exports_external.string() }).passthrough() }).passthrough();
+  lpAmountSchema = exports_external.object({ mint: exports_external.string(), raw: exports_external.string().regex(/^\d+$/), decimals: exports_external.number().int() });
+  lpBuildSchema = exports_external.object({
+    build: exports_external.object({
+      action: exports_external.enum(["add", "remove", "claim"]),
+      pool: exports_external.string(),
+      position: exports_external.string(),
+      transaction: exports_external.string().min(1),
+      walletAddress: exports_external.string(),
+      signature: exports_external.string().optional()
+    }).passthrough(),
+    preview: exports_external.object({
+      amounts: exports_external.array(lpAmountSchema).default([]),
+      tokenRisks: risksSchema.default([]),
+      warnings: exports_external.array(exports_external.string()).default([]),
+      candleFeeBps: exports_external.number().optional()
+    }).passthrough().nullable(),
+    replay: exports_external.boolean().optional()
+  });
+  lpPositionsSchema = exports_external.object({
+    positions: exports_external.array(exports_external.object({
+      position: exports_external.string(),
+      pool: exports_external.string(),
+      tokens: exports_external.array(exports_external.object({
+        mint: exports_external.string(),
+        decimals: exports_external.number().int(),
+        amountRaw: exports_external.string(),
+        unclaimedFeesRaw: exports_external.string(),
+        valueUsd: exports_external.number().nullable().optional()
+      }).passthrough()),
+      poolShare: exports_external.number().optional(),
+      valueUsd: exports_external.number().nullable().optional()
+    }).passthrough())
+  });
+  lpPoolsSchema = exports_external.object({
+    page: exports_external.number().int(),
+    pages: exports_external.number().int(),
+    pools: exports_external.array(exports_external.object({
+      pool: exports_external.string(),
+      tokens: exports_external.array(exports_external.string()),
+      liquidityUsd: exports_external.number().nullable().optional(),
+      baseFeePercent: exports_external.number().nullable().optional(),
+      volume24hUsd: exports_external.number().nullable().optional(),
+      estimatedAprPercent: exports_external.number().nullable().optional()
+    }).passthrough())
+  });
   BASES = {
     SOL: { mint: "So11111111111111111111111111111111111111112", decimals: 9 },
     USDC: { mint: "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v", decimals: 6 },
@@ -22057,6 +22290,8 @@ __export(exports_vault_support, {
   menuSafeText: () => menuSafeText,
   findExternalEntry: () => findExternalEntry,
   factorMenu: () => factorMenu,
+  factorAddPassphraseOnlyReason: () => factorAddPassphraseOnlyReason,
+  factorAddAmong: () => factorAddAmong,
   describeRole: () => describeRole,
   describeEntry: () => describeEntry,
   derivationNotice: () => derivationNotice,
@@ -22155,6 +22390,20 @@ async function requireVaultRaw(ctx, resolved) {
     throw missingVault(ctx, resolved);
   return raw;
 }
+function factorAddAmong(envelopes) {
+  return {
+    envelopeIds: envelopes.filter((envelope) => isPassphraseEnvelope(envelope) || isCtap2Envelope(envelope)).map((envelope) => envelope.id),
+    because: factorAddPassphraseOnlyReason,
+    excludedBecause: "adding a factor opens the vault with the passphrase or a security key."
+  };
+}
+function factorAddPassphraseOnlyReason(unusable) {
+  if (unusable.length === 0) {
+    return "adding a factor opens the vault with the passphrase or a security key, and this vault has no security key.";
+  }
+  const keys = unusable.map((entry) => `${entry.word} ${entry.id} cannot be used on this machine: ${entry.availability}`);
+  return `adding a factor opens the vault with the passphrase or a security key, and ${keys.join("; ")}.`;
+}
 function derivationNotice(line, purpose) {
   if (purpose === undefined)
     return line;
@@ -22181,6 +22430,9 @@ async function unlockInteractively(ctx, path, raw, opts = {}) {
   const noticeFor = (purpose) => (line) => deps.stderr.write(derivationNotice(line, purpose));
   const notice = noticeFor(opts.purpose);
   if (choice.kind === "passphrase") {
+    if (opts.onFactorChosen) {
+      await opts.onFactorChosen(choice.envelopeId !== undefined ? { kind: "passphrase", envelopeId: choice.envelopeId } : { kind: "passphrase" });
+    }
     if (choice.onlyBecause !== undefined)
       deps.stderr.write(`${PASSPHRASE_ONLY_PREFIX}${choice.onlyBecause}
 `);
@@ -22202,6 +22454,8 @@ async function unlockInteractively(ctx, path, raw, opts = {}) {
   }
   if (choice.kind === "touch-id") {
     const envelope2 = choice.envelope;
+    if (opts.onFactorChosen)
+      await opts.onFactorChosen({ kind: "touch-id", envelope: envelope2 });
     const session2 = await openEnclaveSession(deps, envelope2.helper);
     const open5 = async (p, r, reason2) => {
       const current = parseVaultFile(r);
@@ -22230,6 +22484,8 @@ async function unlockInteractively(ctx, path, raw, opts = {}) {
   }
   if (choice.kind === "passkey") {
     const envelope2 = choice.envelope;
+    if (opts.onFactorChosen)
+      await opts.onFactorChosen({ kind: "passkey", envelope: envelope2 });
     const session2 = await openPasskeySession(deps, envelope2.helper);
     const open5 = async (p, r, purpose) => {
       const current = parseVaultFile(r);
@@ -22257,11 +22513,14 @@ async function unlockInteractively(ctx, path, raw, opts = {}) {
     };
   }
   const envelope = choice.envelope;
+  const keyDevice = opts.onFactorChosen ? await opts.onFactorChosen({ kind: "security-key", envelope }) : undefined;
   const session = await openSecurityKeySession(deps, {
     vaultId: file.vaultId,
     envelopeId: envelope.id,
-    deviceFlag: ctx.vaultDevice,
-    ...choice.preferDevice !== undefined ? { preferDevice: choice.preferDevice } : {},
+    ...keyDevice !== undefined ? { preferDevice: keyDevice.preferDevice } : {
+      deviceFlag: ctx.vaultDevice,
+      ...choice.preferDevice !== undefined ? { preferDevice: choice.preferDevice } : {}
+    },
     requireFeatures: false
   });
   const open4 = async (p, r) => {
@@ -22355,7 +22614,7 @@ async function chooseFactor(ctx, vaultId, allEnvelopes, facts, requested, opts =
     }
     if (passphrases.length === 0 && drivable.length === 1)
       return choiceFor(drivable[0]);
-    const attached = ctx.deps.isTTY.stdin ? await probeAttachedKeys(ctx.deps, { vaultId, envelopes: drivableKeys, deviceFlag: ctx.vaultDevice }) : undefined;
+    const attached = "attached" in opts ? opts.attached : ctx.deps.isTTY.stdin ? await probeAttachedKeys(ctx.deps, { vaultId, envelopes: drivableKeys, deviceFlag: ctx.vaultDevice }) : undefined;
     const notUsableHere = envelopes.filter((envelope) => !isPassphraseEnvelope(envelope) && !drivable.includes(envelope));
     const menu = factorMenu({
       keys: drivableKeys,
@@ -37604,7 +37863,7 @@ var init_update_notice = __esm(() => {
 });
 
 // ../mcp/src/orchestrate.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
+import { randomUUID as randomUUID4 } from "node:crypto";
 function requireApiKey(cfg) {
   if (!cfg.apiKey) {
     throw new Error("CANDLE_AGENT_API_KEY is required for this tool. Set it in the environment or MCP client config.");
@@ -37716,7 +37975,7 @@ async function readPaperInventory(cfg, doFetch, extra) {
 }
 async function executeTrade(args, cfg, doFetch) {
   const apiKey = requireApiKey(cfg);
-  const clientTradeId = args.clientTradeId ?? randomUUID3();
+  const clientTradeId = args.clientTradeId ?? randomUUID4();
   if (args.amount !== undefined && args.percent !== undefined) {
     return errText("pass exactly one of amount or percent, not both", { clientTradeId });
   }
@@ -37854,7 +38113,7 @@ async function executeTrade(args, cfg, doFetch) {
 }
 async function executeLaunchAndSeed(args, cfg, doFetch) {
   const apiKey = requireApiKey(cfg);
-  const clientLaunchId = args.clientLaunchId ?? randomUUID3();
+  const clientLaunchId = args.clientLaunchId ?? randomUUID4();
   const { devBuy, dryRun, buyAmount: _rawBuyAmount, ...launchFields } = args;
   let buyAmount;
   if (devBuy !== undefined) {
@@ -38263,8 +38522,8 @@ MARKET_NOT_FOUND means Candle has no market for that token and this could not ru
     inputSchema: setProfileWalletsShape
   }, async (args) => callAndRelay("candle_set_profile_wallets", args, cfg));
   register("candle_get_profile_pnl", {
-    title: "Read an agent profile's realized P&L",
-    description: "Realized profit for this profile's own fills, the Candle fees charged against it, and the " + "positions it still holds with their COST BASIS -- not their current value, which is not marked " + "here. Deposits, withdrawals and transfers are excluded: funding a wallet is not profit. Check " + "`unvalued` and `truncated` before quoting the number; they mean the total is partial. Reads only.",
+    title: "Read an agent profile's P&L",
+    description: "Realized profit for this profile's own fills, the Candle fees charged against it, and the " + "positions it still holds with their cost basis, each MARKED at Candle's current price where one " + "exists: `markPriceUsd`, `marketValueUsd` and `unrealizedUsd` per position, and `unrealizedUsd` " + "overall. A position with no price is counted in `unmarkedPositions` and left out of unrealized, " + "never valued at zero; `oldestMarkAt` says how old the marks are. Deposits, withdrawals and " + "transfers are excluded: funding a wallet is not profit. Check `unvalued` and `truncated` before " + "quoting the number; they mean the total is partial. Reads only.",
     inputSchema: profilePnlShape
   }, async (args) => callAndRelay("candle_get_profile_pnl", args, cfg));
   register("candle_get_profile_trades", {
@@ -38593,7 +38852,7 @@ init_render();
 init_secret_store();
 
 // src/version.ts
-var CLI_VERSION = "0.11.6";
+var CLI_VERSION = "0.11.8";
 
 // src/commands/auth.ts
 var DEVICE_CODE_PATH = "/api/v1/agent/device/code";
@@ -38615,6 +38874,10 @@ async function authLogin(args, ctx) {
     return 2;
   }
   const scopes = parsed.values["--scopes"] ? parseScopesList(parsed.values["--scopes"]) : undefined;
+  if (scopes?.includes("transfer:bound")) {
+    writeUsageFailure(deps, "transfer:bound is not available on a device login. Mint a Read:Write:Transfer key with: candle keys create --access read-write-transfer", json);
+    return 2;
+  }
   const label = parsed.values["--label"]?.trim();
   const noBrowser = parsed.booleans.has("--no-browser");
   if (parsed.values["--label"] !== undefined && (label === undefined || label.length < 1 || label.length > MAX_CLIENT_NAME_LENGTH)) {
@@ -39092,6 +39355,71 @@ var HELP = {
     ],
     env: ENV_API
   },
+  lp: {
+    group: "Trade",
+    summary: "Meteora DAMM v2 liquidity from a TEE wallet: pools, add, positions, remove, claim",
+    description: "Provide liquidity on any Meteora DAMM v2 pool from a TEE wallet, through its bound key (scope lp:write, opt-in). Every write is quoted, shown with the pool's Token-2022 warnings, confirmed, signed by Candle's relay and broadcast over your RPC; no Candle fee. A sweep closes open positions itself (tee sweep).",
+    usage: ["candle lp <subcommand> [flags]"],
+    rows: [
+      {
+        invocation: "pools <token> [--page <n>]",
+        description: "Pools listing a token: liquidity, fee, 24h volume, estimated yield"
+      },
+      {
+        invocation: "add <pool> --amount <n> <token> --wallet <tee> [--position <nft>]",
+        description: "Open a position, or add to one; the other side follows the pool's ratio"
+      },
+      { invocation: "positions [--wallet <tee>]", description: "Every position across your TEE wallets" },
+      {
+        invocation: "remove <position> --percent <n> [--wallet <tee>]",
+        description: "Withdraw; at 100% also claims fees and closes the position"
+      },
+      { invocation: "claim <position> [--wallet <tee>]", description: "Claim fees and any rewards" }
+    ],
+    flags: [
+      { invocation: "--wallet <tee>", description: "The TEE wallet by id, address or unique label" },
+      { invocation: "--rpc-url <url>", description: "Your Solana RPC, for mint reads and the broadcast" },
+      {
+        invocation: "--client-trade-id <id>",
+        description: "Idempotency: the same id never deposits or withdraws twice"
+      },
+      { invocation: "--slippage-bps <n>", description: "add and remove: the tolerance, 0 to 1000 (default 100)" },
+      { invocation: "--yes", description: "Skip the confirmation prompt (an ordinary prompt only)" }
+    ],
+    examples: [
+      "candle lp pools So11111111111111111111111111111111111111112",
+      "candle lp add <pool> --amount 0.5 SOL --wallet AgentOne --rpc-url https://<rpc>",
+      "candle lp positions",
+      "candle lp remove <position> --percent 100 --wallet AgentOne --rpc-url https://<rpc>"
+    ],
+    env: ENV_API
+  },
+  transfer: {
+    group: "Trade",
+    summary: "Move funds out of a TEE wallet to your own wallets or its vault, through its bound key",
+    description: "Moves one asset out of a TEE wallet this machine can sign for. The bound key must be a Read:Write:Transfer key (transfer:bound); from that wallet, Candle allows only its own pinned vault or another of the account's wallets you linked while signed in or marked trusted. To a linked wallet the amount counts against the key's spend caps and must be a base asset; to the vault any token and max are allowed. Candle builds the transaction, this machine approves the relay, Privy signs, Candle broadcasts. The destination and its kind are shown before you confirm.",
+    usage: [
+      "candle transfer --to <address|wallet name|vault> --asset <SOL|USDC|CNDL>|--mint <mint> --amount <decimal|max> [--wallet <tee>] [--yes] [--json]"
+    ],
+    rows: [],
+    flags: [
+      {
+        invocation: "--to <address|wallet name|vault>",
+        description: "Where the funds go: vault is the wallet's own pin"
+      },
+      { invocation: "--asset <SOL|USDC|CNDL>", description: "A base asset (required for a linked-wallet destination)" },
+      { invocation: "--mint <mint>", description: "Any Solana mint, instead of --asset (vault destinations only)" },
+      { invocation: "--amount <decimal|max>", description: "How much, or max for the whole spendable balance" },
+      { invocation: "--wallet <tee>", description: "The TEE wallet the funds leave; optional with one payer" },
+      { invocation: "--rpc-url <url>", description: "Your own Solana RPC, to read a --mint's decimals" },
+      { invocation: "--yes", description: "Skip the confirmation prompt (the destination is still printed)" }
+    ],
+    examples: [
+      "candle transfer --to vault --asset SOL --amount max --wallet AgentOne",
+      "candle transfer --to treasury --asset USDC --amount 250 --wallet AgentOne --yes --json"
+    ],
+    env: ENV_API
+  },
   launch: {
     group: "Trade",
     summary: "Create a Solana token (the first buy is a separate swap)",
@@ -39107,6 +39435,31 @@ var HELP = {
     examples: ["candle launch --name Demo --symbol DEMO --image-url https://example.com/d.png --wallet AgentOne"],
     env: ENV_API
   },
+  portfolio: {
+    group: "Account",
+    summary: "Every wallet's holdings, prices and value in one table (vault read over your own RPC)",
+    description: "Vault, TEE and embedded wallets, each token with amount, price and value, then a total. TEE and embedded balances come from Candle; vault and external wallets are read over your own RPC, and Candle is sent only the mints they hold, for prices. Unpriced tokens are shown as unpriced and left out of the total. Where Candle serves LP, each TEE wallet's DAMM v2 positions follow the tokens (share of the pool plus unclaimed fees, valued by Candle at the same marks) and count in the total; a position whose pool could not be read is shown as not read and the total says it is partial.",
+    usage: ["candle portfolio [--rpc-url <url>] [--json]"],
+    rows: [],
+    flags: [
+      {
+        invocation: "--rpc-url <url>",
+        description: "Your own Solana RPC, for the vault. Without it (or CANDLE_SOLANA_RPC_URL) the vault is not read"
+      },
+      KEYSTORE_FLAG
+    ],
+    examples: ["candle portfolio", "candle portfolio --rpc-url https://your-rpc.example --json"],
+    env: [...ENV_API, ...ENV_LOCAL_SIGNING]
+  },
+  pnl: {
+    group: "Account",
+    summary: "P&L: realized, fees, unrealized and open positions (--profile for one key's own)",
+    description: "Without --profile, the account's books: every profile, the web app and the CLI, one ledger, the same figures the web P&L chart shows. Needs a key with the Read scope (account:read). With --profile <name>, that profile's key reads its own P&L. Unpriced positions are shown as unpriced and never valued at zero. Where Candle serves LP, DAMM v2 positions are included: realized (withdrawals against the cost basis at the add, plus claimed fees), unrealized (open positions at their share of the pool plus unclaimed fees, against that basis), and vs holding (what the deposited tokens would be worth held); the total then covers tokens and LP.",
+    usage: ["candle pnl [--profile <name>] [--json]"],
+    rows: [],
+    examples: ["candle pnl", "candle pnl --profile scalper --json"],
+    env: ENV_API
+  },
   keys: {
     group: "Account",
     summary: "API keys, and the wallets each key may use",
@@ -39115,11 +39468,11 @@ var HELP = {
     rows: [
       {
         invocation: "list [--scopes]",
-        description: "List API keys: name and Read or Read:Write access; --scopes adds the raw scopes"
+        description: "List API keys: name and Read, Read:Write or Read:Write:Transfer access; --scopes adds the raw scopes"
       },
       {
-        invocation: "create [--scopes <a,b,c>] [--label <name>] [--expires-in <days>] [--tx-limit <usd> [--reset daily|weekly|monthly|never]]",
-        description: "Create an API key"
+        invocation: "create [--access read|read-write|read-write-transfer | --scopes <a,b,c>] [--label <name>] [--expires-in <days>] [--tx-limit <usd> [--reset daily|weekly|monthly|never]]",
+        description: "Create an API key; --access mints one of the three levels (read-write-transfer can move funds out of the wallet it runs)"
       },
       { invocation: "revoke <prefix>", description: "Revoke an API key" },
       { invocation: "wallets <prefix>", description: "Wallets an agent profile can use" },
@@ -39131,6 +39484,7 @@ var HELP = {
     ],
     examples: [
       "candle keys list",
+      "candle keys create --access read-write-transfer --label rebalancer",
       "candle keys create --scopes trade:write --label agent-one",
       "candle keys wallets ck_live_ab12",
       "candle keys revoke ck_live_ab12"
@@ -39141,19 +39495,28 @@ var HELP = {
     group: "Account",
     display: "wallet",
     summary: "Launch and linked wallets; import or revoke one (wallets is an alias)",
-    description: "The account's embedded launch wallets and any wallet you linked, with a Signer column saying whether this machine holds the signing key. Keys are derived in the vault now: this command links and revokes, it never generates or prints one.",
+    description: "The account's embedded launch wallets and any wallet you linked, with a Signer column saying whether this machine holds the signing key and a Trusted column saying whether it is yours: linked while signed in, or marked with wallet trust. Keys are derived in the vault now: this command links and revokes, it never generates or prints one.",
     usage: ["candle wallet [flags]", "candle wallet <subcommand> [flags]"],
     rows: [
       {
         invocation: "import --chain <solana|evm> [options]",
         description: "Import a wallet you own (key via --key-file or hidden prompt)"
       },
-      { invocation: "revoke <wallet-id>", description: "Revoke a linked wallet" }
+      { invocation: "revoke <wallet-id>", description: "Revoke a linked wallet" },
+      {
+        invocation: "trust <label|address|id|prefix*>...",
+        description: "Mark linked wallets yours, so agents can move funds into them (owner only; typed confirm)"
+      },
+      {
+        invocation: "untrust <label|address|id|prefix*>... [--yes]",
+        description: "Clear the mark; moving funds in needs the withdrawal allowlist again (owner only)"
+      }
     ],
     examples: [
       "candle wallet",
       "candle wallet import --chain solana --key-file ./signer.json",
-      "candle wallet revoke wal_123"
+      "candle wallet revoke wal_123",
+      "candle wallet trust 'tr-*' 'dest-*'"
     ],
     env: ENV_API
   },
@@ -39228,14 +39591,14 @@ var HELP = {
       },
       {
         invocation: "transfer <to> --amount <n> --asset SOL|<mint> --from <label> --rpc-url <url>",
-        description: "Sign a vault-key transfer locally"
+        description: "Sign a transfer locally from a vault key or a promoted TEE wallet"
       },
       {
-        invocation: "promote --from|--in-place <label> [--sweep-to <label>] [--rpc-url <url>]",
+        invocation: "promote --from|--in-place <label> [--sweep-to <label>] [--rpc-url <url>] [--to-key <prefix|label>]",
         description: "Fresh TEE key, or promote one vault key in place. Reads, over your RPC, whether each key is a token mint, freeze, program upgrade or stake authority (9 requests per key; public endpoints refuse the token scans). Multisig membership is not checked."
       },
       {
-        invocation: "promote-batch --pairs-from <file> --rpc-url <url> [--token-holdings]",
+        invocation: "promote-batch --pairs-from <file> --rpc-url <url> [--to-key <prefix|label>] [--token-holdings]",
         description: "Promote many vault keys in place: one unlock, one reviewed acknowledgement. Reads, over your RPC, whether each key is a token mint, freeze, program upgrade or stake authority (9 requests per key; public endpoints refuse the token scans). Multisig membership is not checked."
       },
       {
@@ -39257,7 +39620,10 @@ var HELP = {
         invocation: "--factor <id|kind>",
         description: "Unlock with this envelope: an id from factor list, or passphrase, security-key, touch-id, passkey; without it, a terminal lists the factors to pick by number"
       },
-      { invocation: "--device <id>", description: "The security key to use when more than one is attached" },
+      {
+        invocation: "--device <id>",
+        description: "The security key to use when more than one is attached; on factor add security-key, the key to add (the vault opens with the passphrase or another key)"
+      },
       {
         invocation: "--balances",
         description: "list: SOL per matched key, read from your RPC (one request per 100 matched keys). Every matched address goes to that one endpoint together, which links them; tokens are never read"
@@ -39269,6 +39635,10 @@ var HELP = {
       {
         invocation: "--pairs-from <file>",
         description: "promote-batch: one '<label> <destination>' per line, or a CSV with label and sweep_to columns (max 256). Every row is checked against the whole set before anything is written, and each key is committed on its own, so an interrupted batch keeps what landed and re-running the same file resumes."
+      },
+      {
+        invocation: "--to-key <prefix|label>",
+        description: "promote, promote-batch: bind the promoted wallets to this key instead of the calling one. The import runs under the calling key as before, then the wallets are moved to the named key by a rebind (device token; the target's secret never touches this machine). The target is checked before the unlock; a wallet whose rebind fails is named as still on the calling key, with the tee rebind command that finishes."
       }
     ],
     examples: [
@@ -39278,6 +39648,7 @@ var HELP = {
       "candle vault rename key-7 treasury-cold",
       "candle vault new-key --chain solana --labels-from ./replacement-names.txt",
       "candle vault promote-batch --pairs-from ./promote-plan.csv --rpc-url https://<rpc>",
+      "candle vault promote-batch --pairs-from ./promote-plan.csv --rpc-url https://<rpc> --to-key tr-01",
       "candle vault enroll security-key --label yubikey-a",
       "candle vault backup --to /Volumes/BACKUP/vault.enc",
       "candle vault backup --to icloud",
@@ -39310,7 +39681,7 @@ var HELP = {
       },
       {
         invocation: "sweep <address> --rpc-url <url> [--emergency]",
-        description: "Sign locally and move everything to the pinned vault"
+        description: "Sign locally and move everything to the pinned vault; closes DAMM v2 LP positions after verifying each server-built close (--emergency moves the position NFT instead, with no API)"
       },
       {
         invocation: "rebind <wallet...> --to-key <prefix|label>",
@@ -43820,7 +44191,7 @@ function validClientId(id) {
 }
 async function lookupOperation(ctx, key, id, kind) {
   const local = await savedOperation(ctx, key, id);
-  const kinds = kind ? [kind] : local ? [local.kind] : ["trade", "swap", "launch"];
+  const kinds = kind ? [kind] : local && local.kind !== "lp" ? [local.kind] : ["trade", "swap", "launch"];
   const found = [];
   for (const candidate of kinds) {
     try {
@@ -44095,7 +44466,7 @@ async function launch(args, ctx) {
     if (!Number.isFinite(built.expiresAt) || built.expiresAt <= ctx.deps.now())
       throw new TradingError("QUOTE_EXPIRED", "The launch build expired before signing.");
     const signed = await relaySign(ctx, key, wallet, built.transaction);
-    const signature = await saveLaunchSignature(ctx, key, id, signed);
+    const signature = await saveOperationSignature(ctx, key, id, "launch", signed);
     const broadcastSignature = await createSolanaRpc(url, ctx.deps.fetch).sendTransaction(signed);
     if (broadcastSignature !== signature)
       throw new TradingError("RPC_FAILED", "RPC returned a different transaction signature; check the saved operation.");
@@ -44108,6 +44479,368 @@ async function launch(args, ctx) {
   }
 }
 
+// src/commands/lp.ts
+init_args();
+init_render();
+init_solana_lite();
+import { randomUUID as randomUUID3 } from "node:crypto";
+init_trading();
+var LP_SCOPE = "lp:write";
+var CONFIRM_POLL_MS2 = 2000;
+var CONFIRM_MAX_POLLS2 = 45;
+async function lpRequest(ctx, key, path, body) {
+  const result = await apiRequest(path, {
+    apiUrl: ctx.apiUrl,
+    credentials: { apiKey: key },
+    auth: "key",
+    method: body ? "POST" : "GET",
+    body,
+    fetch: ctx.deps.fetch,
+    env: ctx.deps.env
+  });
+  if (!result.ok) {
+    if (result.status === 404 && !result.code)
+      throw new TradingError("LP_NOT_ENABLED", "This Candle deployment does not serve LP routes (LP_ENABLED is off there, or the API predates them).");
+    throw new TradingError(result.code ?? "REQUEST_FAILED", result.message);
+  }
+  if (!result.body || typeof result.body !== "object")
+    throw new TradingError("INVALID_RESPONSE", "Candle returned an invalid response.");
+  return result.body;
+}
+function solanaAddress(value, what) {
+  if (!/^[1-9A-HJ-NP-Za-km-z]{32,44}$/.test(value))
+    throw new TradingError("INVALID_ADDRESS", `${what} must be a Solana address (base58).`);
+  return value;
+}
+function poolToken(value) {
+  const base = baseAsset(value);
+  if (base)
+    return BASES[base]?.mint;
+  return solanaAddress(value, "The token");
+}
+function matchesWallet(row, name) {
+  return row.id === name || row.address === name || row.label === name;
+}
+function usage2(ctx, line) {
+  writeUsageFailure(ctx.deps, line, ctx.json);
+  return 2;
+}
+function amountLine(amount) {
+  const base = Object.entries(BASES).find(([, asset]) => asset.mint === amount.mint)?.[0];
+  return `${decimalAmount(amount.raw, amount.decimals)} ${base ?? amount.mint}`;
+}
+async function lpPools(args, ctx) {
+  const parsed = parseArgs(args, { valueFlags: ["--page"] });
+  const page = Number(parsed && !("error" in parsed) ? parsed.values["--page"] ?? "1" : "1");
+  if ("error" in parsed)
+    return usage2(ctx, parsed.error);
+  if (parsed.positionals.length !== 1 || !Number.isSafeInteger(page) || page < 1)
+    return usage2(ctx, "Usage: candle lp pools <token> [--page <n>]");
+  try {
+    const token = poolToken(parsed.positionals[0]);
+    const key = await tradingKey(ctx);
+    const pools = lpPoolsSchema.parse(await lpRequest(ctx, key, `/api/v1/agent/lp/pools/${encodeURIComponent(token)}?page=${page}`));
+    if (ctx.json)
+      return printTradingResult(ctx, { success: true, token, ...pools });
+    const out = ctx.deps.stdout;
+    if (pools.pools.length === 0) {
+      out.write(`No DAMM v2 pool lists ${token} (page ${pools.page} of ${pools.pages}).
+`);
+      return 0;
+    }
+    const usd = (value) => value === null || value === undefined ? "unavailable" : `$${value.toFixed(2)}`;
+    const pct = (value) => value === null || value === undefined ? "unavailable" : `${value.toFixed(2)}%`;
+    out.write(`DAMM v2 pools for ${token} (page ${pools.page} of ${pools.pages}):
+`);
+    for (const pool of pools.pools) {
+      out.write(`  ${safeText(pool.pool)}
+    pair ${pool.tokens.map(safeText).join(" / ")}
+    liquidity ${usd(pool.liquidityUsd)}, fee ${pct(pool.baseFeePercent)}, 24h volume ${usd(pool.volume24hUsd)}, est. yield ${pct(pool.estimatedAprPercent)} APR (indexed, not a quote)
+`);
+    }
+    return 0;
+  } catch (error) {
+    return tradingFailure(ctx, error);
+  }
+}
+async function lpPositions(args, ctx) {
+  const parsed = parseArgs(args, { valueFlags: ["--wallet"] });
+  if ("error" in parsed)
+    return usage2(ctx, parsed.error);
+  if (parsed.positionals.length !== 0)
+    return usage2(ctx, "Usage: candle lp positions [--wallet <tee>]");
+  try {
+    const key = await tradingKey(ctx);
+    const { rows } = await listTradingWallets(ctx, key);
+    const name = parsed.values["--wallet"];
+    const wallets = rows.filter((row) => row.chain === "solana" && (name === undefined || matchesWallet(row, name)));
+    if (name !== undefined && wallets.length === 0)
+      throw new TradingError("TEE_WALLET_REQUIRED", `No TEE wallet on this key is called "${name}".`);
+    const report = [];
+    for (const row of wallets) {
+      const positions = lpPositionsSchema.parse(await lpRequest(ctx, key, `/api/v1/agent/lp/positions?linkedWalletId=${encodeURIComponent(row.id)}`));
+      report.push({
+        id: row.id,
+        address: row.address,
+        ...row.label ? { label: row.label } : {},
+        positions: positions.positions
+      });
+    }
+    if (ctx.json)
+      return printTradingResult(ctx, { success: true, wallets: report });
+    const out = ctx.deps.stdout;
+    const total = report.reduce((n, wallet) => n + wallet.positions.length, 0);
+    if (total === 0) {
+      out.write(`No DAMM v2 positions across ${report.length} TEE wallet(s).
+`);
+      return 0;
+    }
+    for (const wallet of report) {
+      if (wallet.positions.length === 0)
+        continue;
+      out.write(`${wallet.label ? `${safeText(wallet.label)} ` : ""}(${wallet.id}, ${safeText(wallet.address)})
+`);
+      for (const position of wallet.positions) {
+        out.write(`  position ${safeText(position.position)} in pool ${safeText(position.pool)}
+`);
+        for (const token of position.tokens) {
+          out.write(`    ${amountLine({ mint: token.mint, raw: token.amountRaw, decimals: token.decimals })}, unclaimed fees ${decimalAmount(token.unclaimedFeesRaw, token.decimals)}${token.valueUsd === null || token.valueUsd === undefined ? "" : ` ($${token.valueUsd.toFixed(2)})`}
+`);
+        }
+        out.write(`    value ${position.valueUsd === null || position.valueUsd === undefined ? "unpriced" : `$${position.valueUsd.toFixed(2)}`}${position.poolShare === undefined ? "" : `, ${(position.poolShare * 100).toFixed(4)}% of the pool`}
+`);
+      }
+    }
+    return 0;
+  } catch (error) {
+    return tradingFailure(ctx, error);
+  }
+}
+async function walletHolding(ctx, key, position, name) {
+  if (name !== undefined)
+    return tradingWallet(ctx, key, name, LP_SCOPE);
+  const { rows, appId } = await listTradingWallets(ctx, key, LP_SCOPE);
+  for (const row of rows) {
+    if (row.chain !== "solana")
+      continue;
+    const positions = lpPositionsSchema.parse(await lpRequest(ctx, key, `/api/v1/agent/lp/positions?linkedWalletId=${encodeURIComponent(row.id)}`));
+    if (positions.positions.some((held) => held.position === position))
+      return completeTradingWallet(ctx, row, appId, LP_SCOPE);
+  }
+  throw new TradingError("LP_POSITION_NOT_FOUND", `No TEE wallet bound to this key holds position ${position}. See candle lp positions, or name the wallet with --wallet.`);
+}
+async function waitConfirmed(ctx, rpc2, signature, id) {
+  for (let i = 0;i < CONFIRM_MAX_POLLS2; i++) {
+    const observed = classifyStatus(await rpc2.getSignatureStatus(signature));
+    if (observed.kind === "finalized")
+      return;
+    if (observed.kind === "failed")
+      throw new TradingError("LP_TRANSACTION_FAILED", `Transaction ${signature} failed on chain: ${JSON.stringify(observed.err)}.`);
+    if (observed.kind === "nonfinal") {
+      if (observed.err !== null && observed.err !== undefined)
+        throw new TradingError("LP_TRANSACTION_FAILED", `Transaction ${signature} failed: ${JSON.stringify(observed.err)}.`);
+      if (observed.confirmationStatus === "confirmed")
+        return;
+    }
+    await ctx.deps.sleep(CONFIRM_POLL_MS2);
+  }
+  throw new TradingError("LP_CONFIRM_PENDING", `Transaction ${signature} was sent but not confirmed within ${CONFIRM_MAX_POLLS2 * CONFIRM_POLL_MS2 / 1000}s. Re-run the same command with --client-trade-id ${id}: it confirms the saved signature and sends nothing new.`);
+}
+async function confirmPreview(ctx, plan, built) {
+  const output = ctx.json ? ctx.deps.stderr : ctx.deps.stdout;
+  output.write(`${safeText(plan.intent)}
+Payer: ${safeText(plan.wallet.address)}
+`);
+  output.write(`Pool: ${safeText(built.build.pool)}
+Position: ${safeText(built.build.position)}
+`);
+  const preview = built.preview;
+  const amounts = preview?.amounts ?? [];
+  if (amounts.length > 0) {
+    const verb = plan.action === "add" ? "Deposit (maximum, at the pool's ratio)" : plan.action === "remove" ? "Withdraw (minimum)" : "Claim";
+    output.write(`${verb}: ${amounts.map(amountLine).join(" + ")}
+`);
+  }
+  output.write(`Candle LP fee: ${safeText(preview?.candleFeeBps ?? 0)} bps
+`);
+  for (const warning of preview?.warnings ?? [])
+    output.write(`Warning: ${safeText(warning)}
+`);
+  for (const risk of preview?.tokenRisks ?? [])
+    output.write(`Warning (${safeText(risk.mint)}): ${safeText(risk.message)}
+`);
+  if (built.replay)
+    output.write(`This client id was already built; the same artifact is shown again.
+`);
+  if (plan.yes)
+    return true;
+  if (!ctx.deps.isTTY.stdin)
+    throw new TradingError("CONFIRMATION_REQUIRED", "Run interactively to confirm, or use --yes for an ordinary LP prompt.");
+  return (await ctx.deps.promptLine("Proceed? [y/N] ")).trim().toLowerCase() === "y";
+}
+async function runLpOperation(ctx, plan) {
+  const { id, key, wallet, action } = plan;
+  const confirm = async (signature2, extra) => {
+    const result = await lpRequest(ctx, key, "/api/v1/agent/lp/confirm", { clientTradeId: id, signature: signature2 });
+    return printTradingResult(ctx, {
+      ...result,
+      clientTradeId: id,
+      kind: "lp",
+      action,
+      signature: signature2,
+      wallet: safeText(wallet.address),
+      ...extra
+    });
+  };
+  const local = await savedOperation(ctx, key, id);
+  if (local?.signature)
+    return confirm(local.signature, { resumed: true });
+  if (!local && !await claimOperation(ctx, key, id, "lp"))
+    throw new TradingError("OPERATION_ALREADY_STARTED", "This machine already started this id; no write was resent.");
+  ctx.deps.stderr.write(`Operation: ${id}
+`);
+  const built = lpBuildSchema.parse(await lpRequest(ctx, key, `/api/v1/agent/lp/${action}/build`, {
+    linkedWalletId: wallet.id,
+    clientTradeId: id,
+    ...plan.body
+  }));
+  if (built.build.walletAddress !== wallet.address || built.build.action !== action)
+    throw new TradingError("INVALID_RESPONSE", "The LP build does not name the requested wallet and action; nothing was signed.");
+  if (built.build.signature)
+    return confirm(built.build.signature, { resumed: true });
+  const preview = {
+    pool: built.build.pool,
+    position: built.build.position,
+    amounts: built.preview?.amounts ?? [],
+    warnings: built.preview?.warnings ?? [],
+    tokenRisks: built.preview?.tokenRisks ?? [],
+    candleFeeBps: built.preview?.candleFeeBps ?? 0
+  };
+  if (!await confirmPreview(ctx, plan, built))
+    return printTradingResult(ctx, {
+      success: true,
+      status: "cancelled",
+      clientTradeId: id,
+      kind: "lp",
+      action,
+      preview
+    });
+  const signed = await relaySign(ctx, key, wallet, built.build.transaction);
+  const signature = await saveOperationSignature(ctx, key, id, "lp", signed);
+  const rpc2 = createSolanaRpc(plan.url, ctx.deps.fetch);
+  const echoed = await rpc2.sendTransaction(signed);
+  if (echoed !== signature)
+    throw new TradingError("RPC_FAILED", "RPC returned a different transaction signature; check the saved operation.");
+  ctx.deps.stderr.write(`LP ${action} signature: ${signature}
+`);
+  await waitConfirmed(ctx, rpc2, signature, id);
+  return confirm(signature, { preview });
+}
+function slippageOf(flag) {
+  const slippage = Number(flag ?? "100");
+  if (!Number.isInteger(slippage) || slippage < 0 || slippage > 1000)
+    throw new TradingError("INVALID_AMOUNT", "--slippage-bps must be an integer from 0 to 1000.");
+  return slippage;
+}
+async function lpAdd(args, ctx) {
+  const parsed = parseArgs(args, {
+    valueFlags: ["--amount", "--wallet", "--position", "--client-trade-id", "--slippage-bps", "--rpc-url"],
+    booleanFlags: ["--yes"]
+  });
+  if ("error" in parsed)
+    return usage2(ctx, parsed.error);
+  const flags = parsed.values;
+  const id = flags["--client-trade-id"] ?? `lp-${randomUUID3()}`;
+  if (parsed.positionals.length !== 2 || !flags["--amount"] || !flags["--wallet"] || !validClientId(id))
+    return usage2(ctx, "Usage: candle lp add <pool> --amount <decimal> <token> --wallet <tee> [--position <nft-mint>] [--slippage-bps 100] [--client-trade-id <id>] [--rpc-url <url>] [--yes]");
+  try {
+    const pool = solanaAddress(parsed.positionals[0], "The pool");
+    const token = poolToken(parsed.positionals[1]);
+    const position = flags["--position"] ? solanaAddress(flags["--position"], "--position") : undefined;
+    rawAmount(flags["--amount"], 18);
+    const slippageBps = slippageOf(flags["--slippage-bps"]);
+    const url = rpcUrl(ctx, flags["--rpc-url"]);
+    const key = await tradingKey(ctx);
+    const wallet = await tradingWallet(ctx, key, flags["--wallet"], LP_SCOPE);
+    const decimals = await decimalsFor(ctx, baseAsset(token) ?? token, flags["--rpc-url"]);
+    const amountRaw = rawAmount(flags["--amount"], decimals);
+    return await runLpOperation(ctx, {
+      action: "add",
+      id,
+      key,
+      wallet,
+      url,
+      yes: parsed.booleans.has("--yes"),
+      intent: `Add ${decimalAmount(amountRaw, decimals)} ${baseAsset(token) ?? token} of liquidity to DAMM v2 pool ${pool}${position ? ` (position ${position})` : " (new position)"}`,
+      body: { pool, token, amountRaw, slippageBps, ...position ? { position } : {} }
+    });
+  } catch (error) {
+    return tradingFailure(ctx, error, id);
+  }
+}
+async function lpRemove(args, ctx) {
+  const parsed = parseArgs(args, {
+    valueFlags: ["--percent", "--wallet", "--client-trade-id", "--slippage-bps", "--rpc-url"],
+    booleanFlags: ["--yes"]
+  });
+  if ("error" in parsed)
+    return usage2(ctx, parsed.error);
+  const flags = parsed.values;
+  const id = flags["--client-trade-id"] ?? `lp-${randomUUID3()}`;
+  const percent = Number(flags["--percent"]);
+  if (parsed.positionals.length !== 1 || !flags["--percent"] || !/^\d+(\.\d{1,2})?$/.test(flags["--percent"]) || !(percent > 0 && percent <= 100) || !validClientId(id))
+    return usage2(ctx, "Usage: candle lp remove <position> --percent <0.01-100> [--wallet <tee>] [--slippage-bps 100] [--client-trade-id <id>] [--rpc-url <url>] [--yes]");
+  try {
+    const position = solanaAddress(parsed.positionals[0], "The position");
+    const slippageBps = slippageOf(flags["--slippage-bps"]);
+    const url = rpcUrl(ctx, flags["--rpc-url"]);
+    const key = await tradingKey(ctx);
+    const wallet = await walletHolding(ctx, key, position, flags["--wallet"]);
+    return await runLpOperation(ctx, {
+      action: "remove",
+      id,
+      key,
+      wallet,
+      url,
+      yes: parsed.booleans.has("--yes"),
+      intent: percent === 100 ? `Remove all liquidity from position ${position}, claim its fees and close it (rent returns to the wallet)` : `Remove ${percent}% of the liquidity in position ${position}`,
+      body: { position, percent, slippageBps }
+    });
+  } catch (error) {
+    return tradingFailure(ctx, error, id);
+  }
+}
+async function lpClaim(args, ctx) {
+  const parsed = parseArgs(args, {
+    valueFlags: ["--wallet", "--client-trade-id", "--rpc-url"],
+    booleanFlags: ["--yes"]
+  });
+  if ("error" in parsed)
+    return usage2(ctx, parsed.error);
+  const flags = parsed.values;
+  const id = flags["--client-trade-id"] ?? `lp-${randomUUID3()}`;
+  if (parsed.positionals.length !== 1 || !validClientId(id))
+    return usage2(ctx, "Usage: candle lp claim <position> [--wallet <tee>] [--client-trade-id <id>] [--rpc-url <url>] [--yes]");
+  try {
+    const position = solanaAddress(parsed.positionals[0], "The position");
+    const url = rpcUrl(ctx, flags["--rpc-url"]);
+    const key = await tradingKey(ctx);
+    const wallet = await walletHolding(ctx, key, position, flags["--wallet"]);
+    return await runLpOperation(ctx, {
+      action: "claim",
+      id,
+      key,
+      wallet,
+      url,
+      yes: parsed.booleans.has("--yes"),
+      intent: `Claim the fees and any rewards of position ${position}`,
+      body: { position }
+    });
+  } catch (error) {
+    return tradingFailure(ctx, error, id);
+  }
+}
+
 // src/commands/mcp.ts
 init_args();
 init_deps();
@@ -44434,20 +45167,20 @@ async function writeSecretNames(deps, profile, names) {
   else
     await deps.updateProfile(profile, { secretNames: sorted });
 }
-function usage2(ctx, line) {
+function usage3(ctx, line) {
   writeUsageFailure(ctx.deps, line, ctx.json);
   return 2;
 }
 async function secretsSet(args, ctx) {
   const parsed = parseArgs(args, {});
   if ("error" in parsed)
-    return usage2(ctx, parsed.error);
+    return usage3(ctx, parsed.error);
   const [raw, extra] = parsed.positionals;
   if (!raw || extra !== undefined)
-    return usage2(ctx, "Usage: candle secrets set <name>");
+    return usage3(ctx, "Usage: candle secrets set <name>");
   const name = canonicalSecretName(raw);
   if (name === undefined) {
-    return usage2(ctx, `A secret name is letters, digits and underscores, starting with a letter: ${raw}`);
+    return usage3(ctx, `A secret name is letters, digits and underscores, starting with a letter: ${raw}`);
   }
   if (!ctx.deps.isTTY.stdin || !ctx.deps.isTTY.stdout) {
     writeLocalFailure(ctx.deps, {
@@ -44459,7 +45192,7 @@ async function secretsSet(args, ctx) {
   }
   const value = await ctx.deps.promptSecret(`Value for ${name} (input hidden): `);
   if (value.length === 0)
-    return usage2(ctx, "An empty value was typed; nothing was stored.");
+    return usage3(ctx, "An empty value was typed; nothing was stored.");
   try {
     await ctx.deps.secretsStore.set(secretRef(ctx.profile, name), value);
   } catch (error) {
@@ -44479,9 +45212,9 @@ async function secretsSet(args, ctx) {
 async function secretsList(args, ctx) {
   const parsed = parseArgs(args, {});
   if ("error" in parsed)
-    return usage2(ctx, parsed.error);
+    return usage3(ctx, parsed.error);
   if (parsed.positionals.length > 0)
-    return usage2(ctx, `Unexpected argument: ${parsed.positionals[0]}`);
+    return usage3(ctx, `Unexpected argument: ${parsed.positionals[0]}`);
   const names = await storedSecretNames(ctx.deps, ctx.profile);
   if (ctx.json) {
     ctx.deps.stdout.write(`${JSON.stringify({ ok: true, names, backend: ctx.deps.backend })}
@@ -44500,13 +45233,13 @@ async function secretsList(args, ctx) {
 async function secretsRemove(args, ctx) {
   const parsed = parseArgs(args, {});
   if ("error" in parsed)
-    return usage2(ctx, parsed.error);
+    return usage3(ctx, parsed.error);
   const [raw, extra] = parsed.positionals;
   if (!raw || extra !== undefined)
-    return usage2(ctx, "Usage: candle secrets remove <name>");
+    return usage3(ctx, "Usage: candle secrets remove <name>");
   const name = canonicalSecretName(raw);
   if (name === undefined) {
-    return usage2(ctx, `A secret name is letters, digits and underscores, starting with a letter: ${raw}`);
+    return usage3(ctx, `A secret name is letters, digits and underscores, starting with a letter: ${raw}`);
   }
   await ctx.deps.secretsStore.delete(secretRef(ctx.profile, name));
   const names = await storedSecretNames(ctx.deps, ctx.profile);
@@ -44618,6 +45351,645 @@ async function runPlugin(name, rawArgs, ctx) {
   return ctx.deps.runPlugin(path, split2.passthrough, env);
 }
 
+// src/commands/pnl.ts
+init_args();
+init_deps();
+init_profiles();
+init_render();
+
+// src/usd.ts
+function formatUsd(value) {
+  if (!Number.isFinite(value))
+    return "?";
+  const sign2 = value < 0 ? "-" : "";
+  const abs = Math.abs(value);
+  if (abs > 0 && abs < 0.005)
+    return `${sign2}<$0.01`;
+  return `${sign2}$${abs.toLocaleString("en-US", { minimumFractionDigits: 2, maximumFractionDigits: 2 })}`;
+}
+function formatPrice(value) {
+  if (!Number.isFinite(value) || value <= 0)
+    return "?";
+  if (value >= 1)
+    return formatUsd(value);
+  return `$${Number(value.toPrecision(4)).toLocaleString("en-US", { maximumFractionDigits: 12 })}`;
+}
+function formatAmount(raw, decimals) {
+  const digits = BigInt(raw).toString().padStart(decimals + 1, "0");
+  if (decimals === 0)
+    return digits;
+  const whole = digits.slice(0, -decimals);
+  const fraction = digits.slice(-decimals).replace(/0+$/, "");
+  return fraction ? `${whole}.${fraction}` : whole;
+}
+function formatQuantity(value) {
+  if (!Number.isFinite(value))
+    return "?";
+  return value.toLocaleString("en-US", { maximumFractionDigits: 6 });
+}
+function shortAddress2(address) {
+  return address.length > 12 ? `${address.slice(0, 4)}…${address.slice(-4)}` : address;
+}
+
+// src/commands/pnl.ts
+var NO_API_KEY2 = {
+  code: "NO_API_KEY",
+  message: "No API key for this profile.",
+  suggestion: "Set CANDLE_API_KEY, or run `candle auth login` to store one."
+};
+async function pnl(args, ctx) {
+  const { deps, apiUrl, json } = ctx;
+  const parsed = parseArgs(args, {});
+  if ("error" in parsed) {
+    writeUsageFailure(deps, parsed.error, json);
+    return 2;
+  }
+  if (parsed.positionals.length > 0) {
+    writeUsageFailure(deps, `Unexpected argument: ${parsed.positionals[0]}. Usage: candle pnl [--profile <name>]`, json);
+    return 2;
+  }
+  const apiKey = await resolveApiKey(deps, ctx.profile);
+  if (!apiKey) {
+    writeLocalFailure(deps, NO_API_KEY2, json);
+    return 1;
+  }
+  const perProfile = ctx.profileFlag !== undefined;
+  let keyPrefix;
+  if (perProfile) {
+    keyPrefix = apiKeyPrefix(apiKey);
+    if (keyPrefix === undefined) {
+      writeLocalFailure(deps, {
+        code: "BAD_REQUEST",
+        message: `The API key for profile ${ctx.profileFlag} is not a Candle agent key, so it names no profile to read.`,
+        suggestion: "Run `candle auth login --profile <name>` to store a key for that profile."
+      }, json);
+      return 1;
+    }
+  }
+  await printIdentity(ctx);
+  const path = perProfile ? `/api/v1/agent/keys/${encodeURIComponent(keyPrefix)}/pnl` : "/api/v1/agent/books";
+  const result = await apiRequest(path, {
+    auth: "key",
+    credentials: { apiKey },
+    apiUrl,
+    fetch: deps.fetch,
+    env: deps.env
+  });
+  if (!result.ok) {
+    if (!perProfile && result.code === "SCOPE_MISSING") {
+      writeLocalFailure(deps, {
+        code: "SCOPE_MISSING",
+        message: "The account's P&L needs a key with the Read scope (account:read); this profile's key has none.",
+        suggestion: "Log in with a Read or Read:Write key, or read this key's own P&L: candle pnl --profile <name>"
+      }, json);
+      return 1;
+    }
+    writeFailure(deps, result, { apiUrl, authType: "key" }, json);
+    return 1;
+  }
+  const body = result.body;
+  if (json) {
+    const { success: _success, ...rest } = body;
+    deps.stdout.write(`${JSON.stringify({ ok: true, scope: perProfile ? "profile" : "account", ...rest })}
+`);
+    return 0;
+  }
+  if (perProfile) {
+    const { pnl: p, lp } = body;
+    deps.stdout.write(`P&L for profile ${ctx.profileFlag} (key ${keyPrefix}): this key's own fills
+
+`);
+    writeSummary(ctx, {
+      realizedNetUsd: p.realizedNetUsd,
+      realizedGrossUsd: p.realizedGrossUsd,
+      feesUsd: p.feesUsd,
+      unrealizedUsd: p.unrealizedUsd,
+      unmarked: p.unmarkedPositions,
+      unvalued: p.unvalued,
+      counted: p.counted,
+      positions: p.openPositions.length,
+      truncated: p.truncated,
+      lookback: p.lookback,
+      lookbackUnit: "trades",
+      oldestMarkAt: p.oldestMarkAt,
+      lp
+    });
+    writePositions(ctx, p.openPositions, false);
+    writeLpPositions(ctx, lp, false);
+    return 0;
+  }
+  const books = body;
+  deps.stdout.write(`P&L for the account: every profile, the web app and the CLI, one ledger
+
+`);
+  writeSummary(ctx, {
+    ...books.all,
+    positions: books.positions.length,
+    truncated: books.truncated,
+    lookback: books.lookback,
+    lookbackUnit: "ledger rows",
+    oldestMarkAt: books.oldestMarkAt,
+    lp: books.lp
+  });
+  writePositions(ctx, books.positions, true);
+  writeLpPositions(ctx, books.lp, true);
+  return 0;
+}
+function writeSummary(ctx, s) {
+  const marked = s.positions - s.unmarked;
+  const lines = [
+    [
+      "Realized net",
+      formatUsd(s.realizedNetUsd),
+      `gross ${formatUsd(s.realizedGrossUsd)}, fees ${formatUsd(s.feesUsd)}`
+    ],
+    [
+      "Unrealized",
+      formatUsd(s.unrealizedUsd),
+      `${marked} of ${s.positions} open ${s.positions === 1 ? "position" : "positions"} marked${s.unmarked > 0 ? `; ${s.unmarked} unpriced, not counted` : ""}`
+    ]
+  ];
+  const lp = s.lp;
+  if (lp?.read) {
+    const plural = (n, one, many) => `${n} ${n === 1 ? one : many}`;
+    lines.push([
+      "LP realized",
+      formatUsd(lp.realizedUsd),
+      `withdrawn ${formatUsd(lp.withdrawnUsd)} against ${formatUsd(lp.realizedBasisUsd)} of cost basis, plus ${formatUsd(lp.claimedFeesUsd)} claimed fees`
+    ], [
+      "LP unrealized",
+      formatUsd(lp.unrealizedUsd),
+      `${lp.valued} of ${plural(lp.openPositions, "open LP position", "open LP positions")} valued${lp.unpriced > 0 ? `; ${lp.unpriced} unpriced, not counted` : ""}${lp.unreadable > 0 ? `; ${lp.unreadable} not read, not counted` : ""}${lp.closedOutsideLedger > 0 ? `; ${lp.closedOutsideLedger} closed outside the ledger, not counted` : ""}`
+    ], [
+      "LP vs holding",
+      lp.vsHoldingPositions > 0 ? formatUsd(lp.vsHoldingUsd) : "-",
+      lp.vsHoldingPositions > 0 ? `${lp.vsHoldingPositions} of ${lp.valued} valued, against holding the deposited tokens (now ${formatUsd(lp.holdValueUsd)})` : "no valued LP position with every deposit priced"
+    ], [
+      "Total",
+      formatUsd(s.realizedNetUsd + s.unrealizedUsd + lp.realizedUsd + lp.unrealizedUsd),
+      "realized net plus unrealized, tokens and LP"
+    ]);
+  } else if (lp) {
+    lines.push(["LP", "not read", `${terminalText(lp.reason)}; not in the total`], ["Total", formatUsd(s.realizedNetUsd + s.unrealizedUsd), "realized net plus unrealized, tokens only"]);
+  } else {
+    lines.push(["Total", formatUsd(s.realizedNetUsd + s.unrealizedUsd), "realized net plus unrealized"]);
+  }
+  const width = Math.max(...lines.map(([label]) => label.length));
+  const valueWidth = Math.max(...lines.map(([, value]) => value.length));
+  for (const [label, value, note] of lines) {
+    ctx.deps.stdout.write(`${label.padEnd(width)}  ${value.padStart(valueWidth)}  (${note})
+`);
+  }
+  if (s.oldestMarkAt !== undefined) {
+    ctx.deps.stdout.write(`Marks as old as ${new Date(s.oldestMarkAt).toISOString()}.
+`);
+  }
+  if (s.unvalued > 0 || (s.unresolved ?? 0) > 0) {
+    ctx.deps.stdout.write(`${s.unvalued} ${s.unvalued === 1 ? "fill" : "fills"} could not be valued and are not in these figures.
+`);
+  }
+  if (s.truncated) {
+    ctx.deps.stdout.write(`History is truncated: this covers the most recent ${s.lookback} ${s.lookbackUnit}, not the account's lifetime.
+`);
+  }
+  if (lp?.read) {
+    if (lp.unvalued > 0) {
+      ctx.deps.stdout.write(`${lp.unvalued} LP ledger ${lp.unvalued === 1 ? "leg" : "legs"} could not be valued and ${lp.unvalued === 1 ? "is" : "are"} not in these figures.
+`);
+    }
+    if (lp.closedOutsideLedger > 0) {
+      ctx.deps.stdout.write(`${lp.closedOutsideLedger} LP ${lp.closedOutsideLedger === 1 ? "position was" : "positions were"} closed outside the ledger (a sweep close writes no confirmation), so ${lp.closedOutsideLedger === 1 ? "its" : "their"} result is unknown and not in these figures.
+`);
+    }
+    if (lp.truncated) {
+      ctx.deps.stdout.write(`LP history is truncated: this covers the most recent ${lp.lookback} LP operations, not the account's lifetime.
+`);
+    }
+  }
+}
+function writeLpPositions(ctx, lp, withBook) {
+  if (!lp?.read || lp.positions.length === 0)
+    return;
+  const headers = ["POSITION", "POOL", "WALLET", "VALUE", "COST BASIS", "UNREALIZED", "VS HOLDING"];
+  if (withBook)
+    headers.push("BOOK");
+  const value = (p) => p.status === "valued" && p.valueUsd !== undefined ? formatUsd(p.valueUsd) : p.status === "unpriced" ? "unpriced" : p.status === "unreadable" ? "not read" : "closed outside the ledger";
+  const rows = lp.positions.map((p) => {
+    const row = [
+      shortAddress2(p.position),
+      shortAddress2(p.pool),
+      shortAddress2(p.wallet),
+      value(p),
+      formatUsd(p.costBasisUsd),
+      p.unrealizedUsd !== undefined ? formatUsd(p.unrealizedUsd) : "-",
+      p.vsHoldingUsd !== undefined ? formatUsd(p.vsHoldingUsd) : "-"
+    ];
+    if (withBook)
+      row.push(p.book ?? "-");
+    return row;
+  });
+  ctx.deps.stdout.write(`
+Open LP positions
+${renderTable(headers, rows.map((row) => row.map(terminalText)))}
+`);
+}
+function writePositions(ctx, positions, withBook) {
+  if (positions.length === 0) {
+    ctx.deps.stdout.write(`
+No open positions.
+`);
+    return;
+  }
+  const headers = ["TOKEN", "QUANTITY", "AVG ENTRY", "MARK", "UNREALIZED"];
+  if (withBook)
+    headers.push("BOOK");
+  const rows = positions.map((p) => {
+    const row = [
+      p.symbol?.trim() || shortAddress2(p.mint),
+      formatQuantity(p.quantity),
+      formatPrice(p.avgEntryUsd),
+      p.markPriceUsd !== undefined ? formatPrice(p.markPriceUsd) : "unpriced",
+      p.unrealizedUsd !== undefined ? formatUsd(p.unrealizedUsd) : "-"
+    ];
+    if (withBook)
+      row.push(p.book ?? "-");
+    return row;
+  });
+  ctx.deps.stdout.write(`
+Open positions
+${renderTable(headers, rows.map((row) => row.map(terminalText)))}
+`);
+}
+
+// src/commands/portfolio.ts
+init_args();
+init_deps();
+init_profiles();
+init_render();
+init_solana_lite();
+init_store();
+init_vault_support();
+var SOL_MINT = "So11111111111111111111111111111111111111112";
+var KNOWN_SYMBOLS = {
+  [SOL_MINT]: "SOL",
+  EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v: "USDC",
+  "9dXSV8VWuYvGfTzqvkBeoFwH9ihVTybDuWo5VaJPCNDL": "CNDL"
+};
+var CHUNK = 100;
+var TOKEN_READS_IN_FLIGHT = 8;
+var NO_API_KEY3 = {
+  code: "NO_API_KEY",
+  message: "No API key for this profile.",
+  suggestion: "Set CANDLE_API_KEY, or run `candle auth login` to store one."
+};
+async function portfolio(args, ctx) {
+  const parsed = parseArgs(args, { valueFlags: ["--rpc-url", "--keystore"], pathFlags: ["--keystore"] });
+  if ("error" in parsed)
+    return usage(ctx, parsed.error);
+  if (parsed.positionals.length > 0)
+    return usage(ctx, `Unexpected argument: ${parsed.positionals[0]}`);
+  const { deps } = ctx;
+  const apiKey = await resolveApiKey(deps, ctx.profile);
+  if (!apiKey) {
+    writeLocalFailure(deps, NO_API_KEY3, ctx.json);
+    return 1;
+  }
+  const rpcGiven = parsed.values["--rpc-url"] !== undefined || Boolean(deps.env[RPC_URL_ENV]?.trim());
+  let rpcUrl2;
+  if (rpcGiven) {
+    const resolved = rpcUrlFrom(ctx, parsed);
+    if (typeof resolved !== "string")
+      return usage(ctx, resolved.error);
+    rpcUrl2 = resolved;
+  }
+  const resolvedVault = vaultPathFor(ctx, parsed);
+  if ("error" in resolvedVault)
+    return usage(ctx, resolvedVault.error);
+  return runVaultCommand(ctx, async ({ hold }) => {
+    let vaultEntries;
+    let vaultReason;
+    const raw = rpcUrl2 === undefined ? null : await readVaultRaw(resolvedVault.path);
+    if (rpcUrl2 === undefined) {
+      vaultReason = `not read: vault balances are read only over your own RPC; pass --rpc-url or set ${RPC_URL_ENV}`;
+    } else if (raw === null) {
+      vaultReason = `no vault at ${resolvedVault.path}`;
+    } else {
+      if (!refuseEnvPassphrase(ctx))
+        return 1;
+      if (!requirePromptStreams(ctx, "portfolio"))
+        return 1;
+      const vault = hold((await unlockInteractively(ctx, resolvedVault.path, raw)).vault);
+      vaultEntries = vault.index.entries.filter((entry) => entry.chain === "solana" && (entry.role === "vault" || entry.role === "external")).map((entry) => ({ address: entry.address, label: entry.label, role: entry.role }));
+    }
+    await printIdentity(ctx);
+    const rpcHost = rpcUrl2 === undefined ? undefined : new URL(rpcUrl2).host;
+    if (vaultEntries && vaultEntries.length > 0 && rpcHost !== undefined) {
+      const requests = Math.ceil(vaultEntries.length / CHUNK) + vaultEntries.length * 2;
+      deps.stderr.write(`Reading ${vaultEntries.length} vault ${vaultEntries.length === 1 ? "address" : "addresses"} from ${rpcHost} in ${requests} requests. That endpoint sees them together; Candle sees none of them.
+`);
+    }
+    const [candle, vaultRead] = await Promise.all([
+      apiRequest("/api/v1/agent/portfolio", {
+        auth: "key",
+        credentials: { apiKey },
+        apiUrl: ctx.apiUrl,
+        fetch: deps.fetch,
+        env: deps.env
+      }),
+      vaultEntries && rpcUrl2 ? readOwnRpc(vaultEntries.map((entry) => entry.address), rpcUrl2, deps.fetch) : Promise.resolve(undefined)
+    ]);
+    if (!candle.ok) {
+      writeFailure(deps, candle, { apiUrl: ctx.apiUrl, authType: "key" }, ctx.json);
+      return 1;
+    }
+    const fromCandle = candle.body;
+    const prices = { ...fromCandle.prices ?? {} };
+    let priceFailure;
+    if (vaultRead) {
+      const wanted = new Set;
+      for (const wallet2 of vaultRead.byAddress.values()) {
+        if (wallet2.lamports !== null)
+          wanted.add(SOL_MINT);
+        for (const token of wallet2.tokens ?? [])
+          wanted.add(token.mint);
+      }
+      const missing = [...wanted].filter((mint) => prices[mint] === undefined);
+      for (let at = 0;at < missing.length; at += CHUNK) {
+        const priced = await apiRequest("/api/v1/agent/prices", {
+          method: "POST",
+          body: { mints: missing.slice(at, at + CHUNK) },
+          auth: "key",
+          credentials: { apiKey },
+          apiUrl: ctx.apiUrl,
+          fetch: deps.fetch,
+          env: deps.env
+        });
+        if (priced.ok)
+          Object.assign(prices, priced.body.prices ?? {});
+        else
+          priceFailure ??= priced.message;
+      }
+    }
+    if (priceFailure !== undefined) {
+      deps.stderr.write(`Some vault holdings could not be priced: ${terminalText(priceFailure)}. They are shown as unpriced.
+`);
+    }
+    const lpByWallet = new Map;
+    const lpOf = (address) => {
+      const entry = lpByWallet.get(address) ?? { positions: [], unread: [] };
+      lpByWallet.set(address, entry);
+      return entry;
+    };
+    for (const position of fromCandle.lp?.positions ?? [])
+      lpOf(position.wallet).positions.push(lpRow(position, prices));
+    for (const unread of fromCandle.lp?.unreadable ?? [])
+      lpOf(unread.wallet).unread.push(unread.position);
+    const wallet = (address, read, extra) => {
+      const holdings = read === undefined ? null : valueHoldings(read, prices);
+      const unread = read === undefined ? [] : [...read.lamports === null ? ["sol"] : [], ...read.tokens === null ? ["tokens"] : []];
+      const lp2 = fromCandle.lp ? lpOf(address) : undefined;
+      return {
+        address,
+        ...extra,
+        holdings,
+        ...unread.length > 0 ? { unread } : {},
+        ...lp2 ? { lpPositions: lp2.positions } : {},
+        ...lp2 && lp2.unread.length > 0 ? { lpUnread: lp2.unread } : {},
+        valueUsd: (holdings ?? []).reduce((sum, h) => sum + (h.valueUsd ?? 0), 0) + (lp2?.positions ?? []).reduce((sum, p) => sum + (p.valueUsd ?? 0), 0),
+        unpriced: (holdings ?? []).filter((h) => h.priceUsd === null).length + (lp2?.positions ?? []).filter((p) => p.valueUsd === null).length
+      };
+    };
+    const group = (name, wallets, read, reason) => ({
+      group: name,
+      read,
+      ...reason !== undefined ? { reason } : {},
+      wallets,
+      valueUsd: wallets.reduce((sum, w) => sum + w.valueUsd, 0),
+      unpriced: wallets.reduce((sum, w) => sum + w.unpriced, 0)
+    });
+    const orNull = (read) => read.lamports === null && read.tokens === null ? undefined : read;
+    const groups = [
+      group("vault", (vaultEntries ?? []).map((entry) => {
+        const read = vaultRead?.byAddress.get(entry.address);
+        return wallet(entry.address, read ? orNull(read) : undefined, { label: entry.label, role: entry.role });
+      }), vaultEntries !== undefined, vaultReason),
+      group("tee", (fromCandle.tee ?? []).map((row) => wallet(row.address, orNull(row), {
+        id: row.id,
+        ...row.label ? { label: row.label } : {},
+        active: row.active
+      })), true),
+      group("embedded", (fromCandle.embedded ?? []).map((row) => wallet(row.address, orNull(row), {})), true)
+    ];
+    const unavailable = [...vaultRead?.unavailable ?? [], ...fromCandle.unavailable ?? []];
+    const lpUnread = (fromCandle.lp?.unreadable ?? []).length;
+    const complete = fromCandle.complete !== false && unavailable.length === 0 && lpUnread === 0;
+    const totalUsd = groups.reduce((sum, g) => sum + g.valueUsd, 0);
+    const unpriced = groups.reduce((sum, g) => sum + g.unpriced, 0);
+    const lp = fromCandle.lp ? {
+      positions: fromCandle.lp.positions.length,
+      unpriced: fromCandle.lp.positions.filter((p) => p.valueUsd === null).length,
+      unreadable: lpUnread,
+      valueUsd: fromCandle.lp.positions.reduce((sum, p) => sum + (p.valueUsd ?? 0), 0)
+    } : undefined;
+    if (ctx.json) {
+      writeJson(deps, {
+        ok: true,
+        totalUsd,
+        unpriced,
+        complete,
+        unavailable,
+        ...rpcHost !== undefined ? { rpcHost } : {},
+        ...lp ? { lp } : {},
+        groups
+      });
+      return complete ? 0 : 3;
+    }
+    writeTable(ctx, groups, { totalUsd, unpriced, unavailable: unavailable.length, lp });
+    return complete ? 0 : 3;
+  });
+}
+async function readOwnRpc(addresses, rpcUrl2, fetchFn) {
+  const rpc2 = createSolanaRpc(rpcUrl2, fetchFn);
+  const unique = [...new Set(addresses)];
+  const lamports = new Map;
+  for (let at = 0;at < unique.length; at += CHUNK) {
+    const chunk = unique.slice(at, at + CHUNK);
+    try {
+      const accounts = await rpc2.getMultipleAccounts(chunk);
+      for (const [i, address] of chunk.entries())
+        lamports.set(address, (accounts[i]?.lamports ?? 0n).toString());
+    } catch {
+      for (const address of chunk)
+        lamports.set(address, null);
+    }
+  }
+  const tokens = new Map;
+  const failed = new Set;
+  const reads = unique.flatMap((owner) => [TOKEN_PROGRAM_ID, TOKEN_2022_PROGRAM_ID].map((programId) => ({ owner, programId })));
+  let next = 0;
+  await Promise.all(Array.from({ length: Math.min(TOKEN_READS_IN_FLIGHT, reads.length) }, async () => {
+    while (next < reads.length) {
+      const { owner, programId } = reads[next++];
+      try {
+        const accounts = await rpc2.getTokenAccountsByOwner(owner, programId);
+        const held = tokens.get(owner) ?? new Map;
+        tokens.set(owner, held);
+        const program = programId === TOKEN_PROGRAM_ID ? "token" : "token-2022";
+        for (const account of accounts) {
+          if (!/^\d+$/.test(account.amountRaw) || BigInt(account.amountRaw) === 0n)
+            continue;
+          const key = `${program}:${account.mint}`;
+          const prior = held.get(key);
+          held.set(key, {
+            mint: account.mint,
+            amountRaw: (BigInt(prior?.amountRaw ?? "0") + BigInt(account.amountRaw)).toString(),
+            decimals: account.decimals,
+            program
+          });
+        }
+      } catch {
+        failed.add(owner);
+      }
+    }
+  }));
+  const byAddress = new Map;
+  const unavailable = [];
+  for (const address of unique) {
+    const sol = lamports.get(address) ?? null;
+    const held = failed.has(address) ? null : [...tokens.get(address)?.values() ?? []];
+    byAddress.set(address, { lamports: sol, tokens: held });
+    if (sol === null || held === null)
+      unavailable.push(address);
+  }
+  return { byAddress, unavailable };
+}
+function valueHoldings(read, prices) {
+  const raw = [];
+  if (read.lamports !== null && BigInt(read.lamports) > 0n) {
+    raw.push({ mint: SOL_MINT, amountRaw: read.lamports, decimals: 9, program: "native" });
+  }
+  for (const token of read.tokens ?? [])
+    raw.push(token);
+  return raw.map((h) => {
+    const price = prices[h.mint];
+    const priceUsd = price?.priceUsd ?? null;
+    const amount = formatAmount(h.amountRaw, h.decimals);
+    return {
+      ...h,
+      symbol: KNOWN_SYMBOLS[h.mint] ?? price?.symbol ?? null,
+      amount,
+      priceUsd,
+      valueUsd: priceUsd === null ? null : Number(amount) * priceUsd,
+      priceSource: price?.source ?? null
+    };
+  });
+}
+function lpRow(position, prices) {
+  return {
+    position: position.position,
+    pool: position.pool,
+    tokens: position.tokens.map((token) => ({
+      ...token,
+      symbol: KNOWN_SYMBOLS[token.mint] ?? token.symbol ?? prices[token.mint]?.symbol ?? null,
+      amount: formatAmount(token.amountRaw, token.decimals),
+      unclaimedFees: formatAmount(token.unclaimedFeesRaw, token.decimals)
+    })),
+    ...position.poolShare !== undefined ? { poolShare: position.poolShare } : {},
+    valueUsd: position.valueUsd,
+    unpriced: position.unpriced
+  };
+}
+function writeTable(ctx, groups, totals) {
+  const { deps } = ctx;
+  const rows = [];
+  const lpRows = [];
+  const notes = [];
+  for (const g of groups) {
+    const shown = g.wallets.filter((w) => w.holdings === null || w.holdings.length > 0 || (w.unread?.length ?? 0) > 0 || (w.lpPositions?.length ?? 0) > 0 || (w.lpUnread?.length ?? 0) > 0).sort((a, b) => b.valueUsd - a.valueUsd);
+    let lpCount = 0;
+    let lpUnread = 0;
+    for (const w of shown) {
+      const name = `${w.label ? `${w.label} ` : ""}(${shortAddress2(w.address)})${w.role === "external" ? " external" : ""}`;
+      const side = (t, amount) => `${amount} ${t.symbol ?? shortAddress2(t.mint)}`;
+      for (const p of [...w.lpPositions ?? []].sort((a, b) => (b.valueUsd ?? -1) - (a.valueUsd ?? -1))) {
+        lpCount += 1;
+        lpRows.push([
+          g.group,
+          name,
+          shortAddress2(p.position),
+          shortAddress2(p.pool),
+          p.tokens.map((t) => side(t, t.amount)).join(" + "),
+          p.tokens.map((t) => side(t, t.unclaimedFees)).join(" + "),
+          p.valueUsd === null ? "unpriced" : formatUsd(p.valueUsd)
+        ]);
+      }
+      for (const position of w.lpUnread ?? []) {
+        lpUnread += 1;
+        lpRows.push([g.group, name, shortAddress2(position), "-", "not read", "-", "-"]);
+      }
+      if (w.holdings === null) {
+        rows.push([g.group, name, "-", "not read", "-", "-"]);
+        continue;
+      }
+      const sorted = [...w.holdings].sort((a, b) => (b.valueUsd ?? -1) - (a.valueUsd ?? -1));
+      for (const h of sorted) {
+        rows.push([
+          g.group,
+          name,
+          h.symbol ?? shortAddress2(h.mint),
+          h.amount,
+          h.priceUsd === null ? "unpriced" : formatPrice(h.priceUsd),
+          h.valueUsd === null ? "-" : formatUsd(h.valueUsd)
+        ]);
+      }
+      for (const part of w.unread ?? [])
+        rows.push([g.group, name, part === "sol" ? "SOL" : "tokens", "not read", "-", "-"]);
+    }
+    const empty = g.wallets.length - shown.length;
+    const count = `${g.wallets.length} ${g.wallets.length === 1 ? "wallet" : "wallets"}`;
+    notes.push([
+      g.group,
+      g.read ? formatUsd(g.valueUsd) : "-",
+      g.read ? `${count}${empty > 0 ? `, ${empty} empty not shown` : ""}${lpCount > 0 ? `, ${lpCount} LP ${lpCount === 1 ? "position" : "positions"}` : ""}${lpUnread > 0 ? `, ${lpUnread} LP not read` : ""}${g.unpriced > 0 ? `, ${g.unpriced} unpriced` : ""}` : g.reason ?? "not read"
+    ]);
+  }
+  if (rows.length > 0)
+    deps.stdout.write(`
+${renderTable(["GROUP", "WALLET", "TOKEN", "AMOUNT", "PRICE", "VALUE"], rows.map((row) => row.map(terminalText)))}
+`);
+  else
+    deps.stdout.write(`
+Nothing held in any wallet read.
+`);
+  if (lpRows.length > 0)
+    deps.stdout.write(`
+LP positions
+${renderTable(["GROUP", "WALLET", "POSITION", "POOL", "HOLDINGS", "UNCLAIMED FEES", "VALUE"], lpRows.map((row) => row.map(terminalText)))}
+`);
+  notes.push([
+    "total",
+    formatUsd(totals.totalUsd),
+    totals.unpriced > 0 ? `${totals.unpriced} unpriced ${totals.unpriced === 1 ? "holding" : "holdings"} not counted` : "every holding priced"
+  ]);
+  const width = Math.max(...notes.map(([label]) => label.length));
+  const valueWidth = Math.max(...notes.map(([, value]) => value.length));
+  deps.stdout.write(`
+`);
+  for (const [label, value, note] of notes) {
+    deps.stdout.write(`${label.padEnd(width)}  ${value.padStart(valueWidth)}  ${note}
+`);
+  }
+  if (totals.unavailable > 0) {
+    deps.stdout.write(`${totals.unavailable} ${totals.unavailable === 1 ? "wallet" : "wallets"} could not be read in full. What was not read is marked "not read" and is not in the total.
+`);
+  }
+  if ((totals.lp?.unreadable ?? 0) > 0) {
+    const n = totals.lp?.unreadable ?? 0;
+    deps.stdout.write(`${n} LP ${n === 1 ? "position" : "positions"} could not be read (the pool did not answer). ${n === 1 ? "It is" : "They are"} marked "not read" and not in the total.
+`);
+  }
+}
+
 // src/commands/profile.ts
 init_args();
 init_profiles();
@@ -45353,7 +46725,7 @@ async function readMints(rpc2, mints) {
   }
   return out;
 }
-function formatAmount(raw, decimals) {
+function formatAmount2(raw, decimals) {
   if (decimals === undefined)
     return `${raw} raw`;
   const negative = raw < 0n;
@@ -45363,7 +46735,7 @@ function formatAmount(raw, decimals) {
   return `${negative ? "-" : ""}${whole}${frac ? `.${frac}` : ""}`;
 }
 function formatSol(lamports) {
-  return `${formatAmount(lamports, 9)} SOL`;
+  return `${formatAmount2(lamports, 9)} SOL`;
 }
 function displayLines(input) {
   const { tx, compiled, signers, simulation, mints } = input;
@@ -45386,7 +46758,7 @@ function displayLines(input) {
     }
     for (const token of deltas.tokens.filter((delta) => delta.owner === entry.address)) {
       const info = mints.get(token.mint);
-      lines.push(`            ${token.mint}: ${formatAmount(token.before, info?.decimals)} -> ${formatAmount(token.after, info?.decimals)} (${token.after >= token.before ? "+" : ""}${formatAmount(token.after - token.before, info?.decimals)}${info?.decimals === undefined ? "" : `, ${info.decimals} dp`}) in ${token.account}`);
+      lines.push(`            ${token.mint}: ${formatAmount2(token.before, info?.decimals)} -> ${formatAmount2(token.after, info?.decimals)} (${token.after >= token.before ? "+" : ""}${formatAmount2(token.after - token.before, info?.decimals)}${info?.decimals === undefined ? "" : `, ${info.decimals} dp`}) in ${token.account}`);
     }
   }
   const others = [];
@@ -45401,7 +46773,7 @@ function displayLines(input) {
     if (signerAddresses.has(token.owner) || token.after <= token.before)
       continue;
     const info = mints.get(token.mint);
-    others.push(`${token.owner} receives +${formatAmount(token.after - token.before, info?.decimals)} of ${token.mint} (account ${token.account})`);
+    others.push(`${token.owner} receives +${formatAmount2(token.after - token.before, info?.decimals)} of ${token.mint} (account ${token.account})`);
   }
   if (others.length === 0)
     lines.push("others      no other account gains a balance in the simulation");
@@ -45689,6 +47061,285 @@ async function signMessage2(args, ctx) {
 init_esm();
 init_args();
 init_deps();
+
+// src/lp-close.ts
+init_solana_lite();
+var DAMM_V2_PROGRAM_ID = "cpamdpZCGKUy5JxQXB4dcpGPiikHawvSWAd6mEn1sGG";
+var CLOSE_PROGRAM_ALLOWLIST = new Set([
+  DAMM_V2_PROGRAM_ID,
+  TOKEN_PROGRAM_ID,
+  TOKEN_2022_PROGRAM_ID,
+  ASSOCIATED_TOKEN_PROGRAM_ID,
+  COMPUTE_BUDGET_PROGRAM_ID,
+  SYSTEM_PROGRAM_ID
+]);
+var DAMM_POSITION_CLOSE_UNAVAILABLE = "DAMM_POSITION_CLOSE_UNAVAILABLE";
+var DAMM_CLOSE_TRANSACTION_REFUSED = "DAMM_CLOSE_TRANSACTION_REFUSED";
+function isPositionCandidate(account) {
+  return account.programId === TOKEN_2022_PROGRAM_ID && account.amountRaw === "1" && account.decimals === 0;
+}
+function parseCloseArtifact(body) {
+  if (!body || typeof body !== "object")
+    return;
+  const { transaction, accountKeys } = body;
+  if (typeof transaction !== "string" || transaction.length === 0)
+    return;
+  if (!Array.isArray(accountKeys) || !accountKeys.every((key) => typeof key === "string" && key.length > 0))
+    return;
+  return { transaction, accountKeys };
+}
+var MINT_BASE_SIZE2 = 82;
+var ACCOUNT_TYPE_OFFSET2 = 165;
+var ACCOUNT_TYPE_MINT = 1;
+var MULTISIG_SIZE2 = 355;
+var TOKEN_ACCOUNT_SIZE2 = 165;
+var TOKEN_ACCOUNT_STATE_INITIALIZED = 1;
+var CONTROL_RANGES = [
+  [0, 32, "mint"],
+  [32, 64, "authority"],
+  [72, 108, "delegate"],
+  [108, 109, "state"],
+  [121, 129, "delegated amount"],
+  [129, 165, "close authority"]
+];
+var TOKEN_IX_CLOSE_ACCOUNT = 9;
+var ATA_IX_CREATE = 0;
+var ATA_IX_CREATE_IDEMPOTENT = 1;
+function isTokenProgram(owner) {
+  return owner === TOKEN_PROGRAM_ID || owner === TOKEN_2022_PROGRAM_ID;
+}
+function isMintAccount(view) {
+  if (view === null || !isTokenProgram(view.owner))
+    return false;
+  if (view.data.length === MINT_BASE_SIZE2)
+    return true;
+  if (view.data.length === MULTISIG_SIZE2)
+    return false;
+  return view.data.length > ACCOUNT_TYPE_OFFSET2 && view.data[ACCOUNT_TYPE_OFFSET2] === ACCOUNT_TYPE_MINT;
+}
+function isUnsigned(tx) {
+  return tx.signatures.every((slot) => slot.every((byte) => byte === 0));
+}
+function bytesEqual2(a, b) {
+  return a.length === b.length && a.every((byte, i) => byte === b[i]);
+}
+function allZero(bytes) {
+  return bytes.every((byte) => byte === 0);
+}
+async function verifyCloseArtifact(input) {
+  const { artifact, rpc: rpc2, tee, vault, nftMint, nftAccount } = input;
+  const refuse2 = (reason) => ({ ok: false, reason });
+  const allowedOwner = (address) => address === tee || address === vault;
+  let tx;
+  try {
+    tx = decodeTransaction(decodeStrictBase64(artifact.transaction));
+  } catch (error) {
+    if (error instanceof TransactionDecodeError)
+      return refuse2(`the close transaction is undecodable: ${error.message}`);
+    return refuse2(`the close transaction could not be read: ${error instanceof Error ? error.message : error}`);
+  }
+  if (tx.message.version !== 0)
+    return refuse2("the close transaction is not a v0 message");
+  if (!isUnsigned(tx))
+    return refuse2("the close transaction already carries a signature; close-build must return it unsigned");
+  if (tx.message.numRequiredSignatures !== 1)
+    return refuse2(`the close transaction requires ${tx.message.numRequiredSignatures} signers; a position close needs only the TEE wallet`);
+  if (tx.message.staticKeys[0] !== tee)
+    return refuse2(`the fee payer is ${tx.message.staticKeys[0]}, not the TEE wallet`);
+  let compiled;
+  try {
+    compiled = await resolveCompiledKeys(tx.message, rpc2);
+  } catch (error) {
+    if (error instanceof LookupTableError)
+      return refuse2(`a lookup table could not be resolved: ${error.message}`);
+    return refuse2(`the lookup tables could not be read: ${error instanceof Error ? error.message : error}`);
+  }
+  if (compiled.keys.length !== artifact.accountKeys.length)
+    return refuse2(`the server listed ${artifact.accountKeys.length} account keys and the transaction resolves to ${compiled.keys.length}`);
+  for (const [i, key] of compiled.keys.entries()) {
+    if (artifact.accountKeys[i] !== key)
+      return refuse2(`account key ${i} is ${key} in the transaction and ${artifact.accountKeys[i]} in the server's ordered array`);
+  }
+  let dammCalls = 0;
+  for (const [i, ix] of tx.message.instructions.entries()) {
+    const program = compiled.keys[ix.programIdIndex];
+    const account = (at) => compiled.keys[ix.accountIndexes[at] ?? -1];
+    if (program === undefined || !CLOSE_PROGRAM_ALLOWLIST.has(program))
+      return refuse2(`instruction ${i} calls ${program ?? "an unknown program"}, which a position close never does`);
+    switch (program) {
+      case DAMM_V2_PROGRAM_ID:
+        dammCalls += 1;
+        break;
+      case COMPUTE_BUDGET_PROGRAM_ID:
+        break;
+      case ASSOCIATED_TOKEN_PROGRAM_ID: {
+        const kind = ix.data.length === 0 ? ATA_IX_CREATE : ix.data.length === 1 ? ix.data[0] : -1;
+        if (kind !== ATA_IX_CREATE && kind !== ATA_IX_CREATE_IDEMPOTENT)
+          return refuse2(`instruction ${i} is an Associated Token instruction other than Create, which a close never needs`);
+        if (account(0) !== tee || !allowedOwner(account(2) ?? ""))
+          return refuse2(`instruction ${i} creates a token account for ${account(2) ?? "?"}, not the TEE wallet or its vault`);
+        break;
+      }
+      case TOKEN_PROGRAM_ID:
+      case TOKEN_2022_PROGRAM_ID: {
+        if (ix.data[0] !== TOKEN_IX_CLOSE_ACCOUNT || ix.data.length !== 1)
+          return refuse2(`instruction ${i} is a token instruction other than CloseAccount, which a close never issues at the top level`);
+        if (account(1) !== tee || account(2) !== tee)
+          return refuse2(`instruction ${i} closes a token account to ${account(1) ?? "?"}, not the TEE wallet`);
+        break;
+      }
+      default:
+        return refuse2(`instruction ${i} is a top-level System instruction, which a close never issues`);
+    }
+  }
+  if (dammCalls === 0)
+    return refuse2("the transaction calls no DAMM v2 instruction, so it cannot close a position");
+  let simulation;
+  try {
+    simulation = await simulateWithSnapshots(rpc2, artifact.transaction, compiled);
+  } catch (error) {
+    return refuse2(`the simulation could not be run: ${error instanceof Error ? error.message : error}`);
+  }
+  if (simulation.result.err !== null && simulation.result.err !== undefined)
+    return refuse2(`the simulation failed: ${JSON.stringify(simulation.result.err)}`);
+  const deltas = computeDeltas(simulation.snapshots);
+  const postState = new Map(simulation.snapshots.map((snapshot) => [snapshot.address, snapshot.after]));
+  for (const token of deltas.tokens) {
+    if (token.after > token.before && !allowedOwner(token.owner))
+      return refuse2(`${token.owner} would receive ${token.after - token.before} raw of ${token.mint} in account ${token.account}`);
+  }
+  for (const sol of deltas.sol) {
+    if (sol.after <= sol.before)
+      continue;
+    if (allowedOwner(sol.address))
+      continue;
+    const balance = tokenBalanceOf(postState.get(sol.address) ?? null);
+    if (balance !== undefined && allowedOwner(balance.owner))
+      continue;
+    return refuse2(`${sol.address} would receive ${sol.after - sol.before} lamports`);
+  }
+  const nftSnapshot = simulation.snapshots.find((snapshot) => snapshot.address === nftAccount);
+  if (nftSnapshot === undefined)
+    return refuse2(`the position NFT account ${nftAccount} is not written by this transaction`);
+  const nftAfter = tokenBalanceOf(nftSnapshot.after);
+  if (nftAfter !== undefined && nftAfter.amount !== 0n)
+    return refuse2(`the position NFT account ${nftAccount} still holds ${nftAfter.amount} after the simulation`);
+  for (const { address, before, after } of simulation.snapshots) {
+    if (allowedOwner(address)) {
+      if (after === null || after.owner !== SYSTEM_PROGRAM_ID || after.data.length !== 0)
+        return refuse2(`${address === tee ? "the TEE wallet" : "the vault"} would no longer be a plain System account after this transaction`);
+    }
+    if (after === null)
+      continue;
+    if (before !== null && after.owner !== before.owner)
+      return refuse2(`writable account ${address} would change owner from ${before.owner} to ${after.owner}`);
+    if (before !== null) {
+      const controlled = tokenBalanceOf(before);
+      if (controlled !== undefined && allowedOwner(controlled.owner)) {
+        if (after.data.length < TOKEN_ACCOUNT_SIZE2)
+          return refuse2(`token account ${address} would no longer decode as a token account`);
+        for (const [start, end, what] of CONTROL_RANGES) {
+          if (!bytesEqual2(before.data.subarray(start, end), after.data.subarray(start, end)))
+            return refuse2(`token account ${address} would change its ${what}, which a close never does`);
+        }
+        continue;
+      }
+    }
+    const created = before === null ? tokenBalanceOf(after) : undefined;
+    if (created !== undefined) {
+      if (!allowedOwner(created.owner))
+        return refuse2(`created token account ${address} would be controlled by ${created.owner}`);
+      if (!allZero(after.data.subarray(72, 108)) || after.data[108] !== TOKEN_ACCOUNT_STATE_INITIALIZED || !allZero(after.data.subarray(121, 129)) || !allZero(after.data.subarray(129, 165)))
+        return refuse2(`created token account ${address} would start with a delegate, a close authority, or a frozen state`);
+    }
+  }
+  const infos = new Map;
+  const infoOf = async (address) => {
+    if (!infos.has(address))
+      infos.set(address, await rpc2.getAccountInfo(address));
+    return infos.get(address) ?? null;
+  };
+  const canonical = new Set;
+  for (const key of compiled.keys) {
+    const view = await infoOf(key);
+    if (!isMintAccount(view) || view === null)
+      continue;
+    const mint = decodePubkey(key);
+    const program = decodePubkey(view.owner);
+    canonical.add(encodePubkey(associatedTokenAddress(decodePubkey(tee), mint, program)));
+    canonical.add(encodePubkey(associatedTokenAddress(decodePubkey(vault), mint, program)));
+  }
+  for (const [i, key] of compiled.keys.entries()) {
+    if (!compiled.isWritable[i])
+      continue;
+    const view = await infoOf(key);
+    if (view === null) {
+      if (canonical.has(key))
+        continue;
+      return refuse2(`writable account ${key} does not exist and is not a TEE or vault associated token account for a mint this transaction names`);
+    }
+    if (isTokenProgram(view.owner)) {
+      if (key === nftMint)
+        continue;
+      const balance = tokenBalanceOf(view);
+      if (balance === undefined)
+        return refuse2(`writable account ${key} is owned by a token program but is not a token account`);
+      if (allowedOwner(balance.owner) || key === nftAccount)
+        continue;
+      const authority = await infoOf(balance.owner);
+      if (authority !== null && authority.owner === DAMM_V2_PROGRAM_ID)
+        continue;
+      return refuse2(`writable token account ${key} is controlled by ${balance.owner}, which is neither this wallet, its vault, nor a DAMM v2 pool`);
+    }
+    if (view.owner === SYSTEM_PROGRAM_ID) {
+      if (allowedOwner(key))
+        continue;
+      return refuse2(`writable system account ${key} is neither the TEE wallet nor its vault`);
+    }
+    if (view.owner !== DAMM_V2_PROGRAM_ID)
+      return refuse2(`writable account ${key} is owned by ${view.owner}, not DAMM v2`);
+  }
+  return { ok: true, tx, compiled, simulation };
+}
+function formatSol2(lamports) {
+  const negative = lamports < 0n;
+  const abs = negative ? -lamports : lamports;
+  const whole = abs / 1000000000n;
+  const frac = (abs % 1000000000n).toString().padStart(9, "0").replace(/0+$/, "");
+  return `${negative ? "-" : ""}${whole}${frac ? `.${frac}` : ""} SOL`;
+}
+function describeClose(input) {
+  const { verdict, tee, vault, nftMint, nftAccount } = input;
+  const { tx, compiled, simulation } = verdict;
+  const lines = [];
+  lines.push(`message     v0, ${tx.message.instructions.length} instruction(s), ${compiled.keys.length} account(s)${tx.message.lookups.length > 0 ? ` (${tx.message.lookups.length} lookup table(s) resolved)` : ""}, blockhash ${tx.message.recentBlockhash}`);
+  lines.push(`fee payer   ${compiled.keys[0]} (this TEE wallet)`);
+  lines.push(`position    NFT mint ${nftMint}, account ${nftAccount}`);
+  const programs = [...new Set(tx.message.instructions.map((ix) => compiled.keys[ix.programIdIndex] ?? "?"))];
+  for (const program of programs)
+    lines.push(`program     ${program === DAMM_V2_PROGRAM_ID ? `Meteora DAMM v2 (${program})` : programNameOf(program)}`);
+  const deltas = computeDeltas(simulation.snapshots);
+  const who = (address) => address === tee ? "wallet" : address === vault ? "vault" : address;
+  for (const address of [tee, vault]) {
+    const sol = deltas.sol.find((delta) => delta.address === address);
+    if (sol && sol.after !== sol.before)
+      lines.push(`${who(address).padEnd(11)} ${formatSol2(sol.before)} -> ${formatSol2(sol.after)} (${sol.after >= sol.before ? "+" : ""}${formatSol2(sol.after - sol.before)})`);
+    for (const token of deltas.tokens.filter((delta) => delta.owner === address && delta.after !== delta.before)) {
+      lines.push(`${who(address).padEnd(11)} ${token.mint}: ${token.before} -> ${token.after} raw (${token.after >= token.before ? "+" : ""}${token.after - token.before}) in ${token.account}${token.account === nftAccount ? " (position NFT, burned)" : ""}`);
+    }
+  }
+  const nft = simulation.snapshots.find((snapshot) => snapshot.address === nftAccount);
+  if (nft && nft.after === null)
+    lines.push(`position    NFT account ${nftAccount} is closed by this transaction`);
+  const others = deltas.tokens.filter((token) => token.owner !== tee && token.owner !== vault && token.after !== token.before);
+  for (const token of others)
+    lines.push(`${token.owner === undefined ? "?" : "pool"}        ${token.mint}: ${token.before} -> ${token.after} raw in ${token.account} (authority ${token.owner})`);
+  lines.push("checked     ordered keys, programs, simulation, positive deltas, control, writable accounts: all passed");
+  lines.push("note        the simulation is evidence, not a guarantee: a program can behave differently once signed");
+  return lines;
+}
+
+// src/commands/tee.ts
 init_profiles();
 init_render();
 init_solana_lite();
@@ -48994,6 +50645,11 @@ init_deps();
 init_profiles();
 init_render();
 init_secret_store();
+function trustedCell(row) {
+  if (row.revokedAt)
+    return "-";
+  return row.addedVia === "session" || typeof row.trustedAt === "number" ? "yes" : "no";
+}
 var TEE_PROFILES = new Set(["ember-tee", "ember-hot"]);
 function isTeeRow(row) {
   return row.profile !== undefined && TEE_PROFILES.has(row.profile);
@@ -49044,6 +50700,9 @@ var NONE_HINT = `A wallet marked none has no signer on this machine, so a trade
 var TEE_HINT = `A wallet marked tee is a TEE trading wallet: pass its id, address or label to candle swap --wallet.
 ` + `This account's embedded wallet, shown above, can pay for a token trade too.
 `;
+var UNTRUSTED_HINT = `A wallet marked Trusted no was linked by an API key: agents can move funds into it only once you mark it.
+` + `Run: candle wallets trust <label|address|prefix*>  (the device token, never an API key)
+`;
 var STALE_HINT = `A wallet marked stale is revoked but its signer is still stored here. Run: candle wallets revoke <id>
 `;
 async function probeSignerStates(rows, store) {
@@ -49150,24 +50809,28 @@ Linked wallets (${linkedRows.length}):
 `);
   } else {
     const cells = linkedRows.map((wallet) => signerCell(signerStates.get(wallet._id), wallet));
-    deps.stdout.write(`${renderTable(["Id", "Wallet", "Address", "Label", "Kind", "Revoked", "Signer"], linkedRows.map((wallet, index) => [
+    deps.stdout.write(`${renderTable(["Id", "Wallet", "Address", "Label", "Kind", "Revoked", "Trusted", "Signer"], linkedRows.map((wallet, index) => [
       wallet._id,
       wallet.chain,
       wallet.address,
       wallet.label ?? "-",
       isTeeRow(wallet) ? "tee" : "linked",
       wallet.revokedAt ? "yes" : "no",
+      trustedCell(wallet),
       cells[index] ?? "-"
     ]))}
 `);
     const anyNone = cells.includes("none");
     const anyStale = cells.includes("stale");
     const anyTee = linkedRows.some(isTeeRow);
-    if (anyNone || anyStale || anyTee)
+    const anyUntrusted = linkedRows.some((row) => trustedCell(row) === "no");
+    if (anyNone || anyStale || anyTee || anyUntrusted)
       deps.stdout.write(`
 `);
     if (anyTee)
       deps.stdout.write(TEE_HINT);
+    if (anyUntrusted)
+      deps.stdout.write(UNTRUSTED_HINT);
     if (anyNone)
       deps.stdout.write(NONE_HINT);
     if (anyStale)
@@ -49429,8 +51092,8 @@ function readDisableOutcome(body) {
 var MIN_PASSPHRASE_LENGTH = 12;
 var USDC_MINT = "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v";
 var RPC_URL_ENV2 = "CANDLE_SOLANA_RPC_URL";
-var CONFIRM_POLL_MS2 = 2000;
-var CONFIRM_MAX_POLLS2 = 45;
+var CONFIRM_POLL_MS3 = 2000;
+var CONFIRM_MAX_POLLS3 = 45;
 function refuseEnvPassphrase2(ctx) {
   if (ctx.deps.env.CANDLE_KEYSTORE_PASSPHRASE === undefined)
     return true;
@@ -49441,7 +51104,7 @@ function refuseEnvPassphrase2(ctx) {
   }, ctx.json);
   return false;
 }
-function usage3(ctx, line) {
+function usage4(ctx, line) {
   writeUsageFailure(ctx.deps, line, ctx.json);
   return 2;
 }
@@ -49661,7 +51324,7 @@ async function openExistingTeeStore(ctx, parsed) {
   const { deps, json } = ctx;
   const found = await readTeeStore(ctx, parsed);
   if ("usage" in found)
-    return { ok: false, code: usage3(ctx, found.usage) };
+    return { ok: false, code: usage4(ctx, found.usage) };
   const { path } = found;
   if ("error" in found) {
     writeLocalFailure(deps, {
@@ -49758,12 +51421,12 @@ async function teeNew(args, ctx) {
     return 1;
   const parsed = parseArgs(args, { valueFlags: ["--label", "--keystore"], pathFlags: ["--keystore"] });
   if ("error" in parsed)
-    return usage3(ctx, parsed.error);
+    return usage4(ctx, parsed.error);
   if (parsed.positionals.length > 0)
-    return usage3(ctx, `Unexpected argument: ${parsed.positionals[0]}`);
+    return usage4(ctx, `Unexpected argument: ${parsed.positionals[0]}`);
   const found = await readTeeStore(ctx, parsed);
   if ("usage" in found)
-    return usage3(ctx, found.usage);
+    return usage4(ctx, found.usage);
   const { path } = found;
   if ("error" in found) {
     writeLocalFailure(deps, {
@@ -49840,15 +51503,15 @@ async function teeEnable(args, ctx) {
     pathFlags: ["--keystore"]
   });
   if ("error" in parsed)
-    return usage3(ctx, parsed.error);
+    return usage4(ctx, parsed.error);
   const [address, extra] = parsed.positionals;
   if (!address || extra !== undefined) {
-    return usage3(ctx, "Usage: candle tee enable <address> --vault <address> | --vault-key <label>");
+    return usage4(ctx, "Usage: candle tee enable <address> --vault <address> | --vault-key <label>");
   }
   const vaultFlag = parsed.values["--vault"];
   const vaultKey = parsed.values["--vault-key"];
   if (vaultFlag !== undefined && vaultKey !== undefined) {
-    return usage3(ctx, "Use either --vault or --vault-key, not both.");
+    return usage4(ctx, "Use either --vault or --vault-key, not both.");
   }
   let vault = vaultFlag;
   if (vaultKey !== undefined) {
@@ -49858,7 +51521,7 @@ async function teeEnable(args, ctx) {
     const { isVaultError: isVaultError2 } = await Promise.resolve().then(() => (init_errors(), exports_errors));
     const resolvedVault = vaultPathFor2(ctx, parsed);
     if ("error" in resolvedVault)
-      return usage3(ctx, resolvedVault.error);
+      return usage4(ctx, resolvedVault.error);
     const vaultPath = resolvedVault.path;
     const raw = await readVaultRaw2(vaultPath);
     if (raw === null) {
@@ -49896,11 +51559,11 @@ async function teeEnable(args, ctx) {
     }
   }
   if (!vault)
-    return usage3(ctx, "--vault <address> or --vault-key <label> is required: the destination every sweep sends to.");
+    return usage4(ctx, "--vault <address> or --vault-key <label> is required: the destination every sweep sends to.");
   if (!isSolanaAddress(vault))
-    return usage3(ctx, "--vault is not a valid Solana address.");
+    return usage4(ctx, "--vault is not a valid Solana address.");
   if (vault === address)
-    return usage3(ctx, "--vault must be a different address from the TEE wallet.");
+    return usage4(ctx, "--vault must be a different address from the TEE wallet.");
   const vaultOwned = await addressOwnedByVault(ctx, address);
   if (vaultOwned === "usage")
     return 2;
@@ -50037,20 +51700,20 @@ async function teeFund(args, ctx) {
     return 1;
   const parsed = parseArgs(args, { valueFlags: ["--amount", "--asset", "--keystore"], pathFlags: ["--keystore"] });
   if ("error" in parsed)
-    return usage3(ctx, parsed.error);
+    return usage4(ctx, parsed.error);
   const [address, extra] = parsed.positionals;
   if (!address || extra !== undefined)
-    return usage3(ctx, "Usage: candle tee fund <address> --amount <n> [--asset SOL|USDC]");
+    return usage4(ctx, "Usage: candle tee fund <address> --amount <n> [--asset SOL|USDC]");
   const asset = (parsed.values["--asset"] ?? "SOL").toUpperCase();
   if (asset !== "SOL" && asset !== "USDC")
-    return usage3(ctx, "--asset must be SOL or USDC.");
+    return usage4(ctx, "--asset must be SOL or USDC.");
   const amount = parsed.values["--amount"];
   if (!amount)
-    return usage3(ctx, "--amount <n> is required.");
+    return usage4(ctx, "--amount <n> is required.");
   const decimals = asset === "SOL" ? 9 : 6;
   const raw = decimalToRaw(amount, decimals);
   if (raw === null || raw === 0n)
-    return usage3(ctx, `--amount must be a positive decimal with at most ${decimals} decimal places.`);
+    return usage4(ctx, `--amount must be a positive decimal with at most ${decimals} decimal places.`);
   const resolved = await resolveTeeAddress(ctx, parsed, address, () => openExistingTeeStore(ctx, parsed));
   if (!resolved.ok)
     return resolved.code;
@@ -50117,10 +51780,10 @@ async function teeStatus(args, ctx) {
     return 1;
   const parsed = parseArgs(args, { valueFlags: ["--rpc-url", "--keystore"], pathFlags: ["--keystore"] });
   if ("error" in parsed)
-    return usage3(ctx, parsed.error);
+    return usage4(ctx, parsed.error);
   const [address, extra] = parsed.positionals;
   if (!address || extra !== undefined)
-    return usage3(ctx, "Usage: candle tee status <address> [--rpc-url <url>]");
+    return usage4(ctx, "Usage: candle tee status <address> [--rpc-url <url>]");
   const resolved = await resolveTeeAddress(ctx, parsed, address, () => openExistingTeeStore(ctx, parsed));
   if (!resolved.ok)
     return resolved.code;
@@ -50162,7 +51825,7 @@ async function teeStatus(args, ctx) {
     if (rpcUrl2) {
       const checked = rpcUrlFrom2(ctx, parsed);
       if (typeof checked !== "string")
-        return usage3(ctx, checked.error);
+        return usage4(ctx, checked.error);
       const rpc2 = createSolanaRpc(checked, deps.fetch);
       try {
         const lamports = await rpc2.getBalance(address);
@@ -50243,10 +51906,10 @@ async function teeDisable(args, ctx) {
     return 1;
   const parsed = parseArgs(args, { valueFlags: ["--keystore"], pathFlags: ["--keystore"] });
   if ("error" in parsed)
-    return usage3(ctx, parsed.error);
+    return usage4(ctx, parsed.error);
   const [address, extra] = parsed.positionals;
   if (!address || extra !== undefined)
-    return usage3(ctx, "Usage: candle tee disable <address>");
+    return usage4(ctx, "Usage: candle tee disable <address>");
   await printIdentity(ctx);
   const openedActive = await openActiveTee(ctx, parsed, address, "read");
   if (!openedActive.ok)
@@ -50341,6 +52004,9 @@ function refusalState(raw) {
 async function broadcastAndFinalize2(rpc2, deps, secret, feePayer, instructions, pending, recordPending, clearPending) {
   const blockhash = await rpc2.getLatestBlockhash();
   const message = compileLegacyMessage({ feePayer, recentBlockhash: blockhash, instructions });
+  return broadcastMessage(rpc2, deps, secret, message, blockhash, pending, recordPending, clearPending);
+}
+async function broadcastMessage(rpc2, deps, secret, message, blockhash, pending, recordPending, clearPending) {
   const signatureBytes = signMessage(message, secret);
   const signature = base58.encode(signatureBytes);
   const wire = serializeSignedTransaction(message, signatureBytes);
@@ -50366,7 +52032,7 @@ async function broadcastAndFinalize2(rpc2, deps, secret, feePayer, instructions,
       error: `send did not answer cleanly (${error instanceof Error ? error.message : error}); it may still land`
     };
   }
-  for (let i = 0;i < CONFIRM_MAX_POLLS2; i++) {
+  for (let i = 0;i < CONFIRM_MAX_POLLS3; i++) {
     let status;
     try {
       status = await rpc2.getSignatureStatus(signature);
@@ -50388,12 +52054,12 @@ async function broadcastAndFinalize2(rpc2, deps, secret, feePayer, instructions,
         error: `transaction ${signature} failed on chain: ${JSON.stringify(observed.err)}`
       };
     }
-    await deps.sleep(CONFIRM_POLL_MS2);
+    await deps.sleep(CONFIRM_POLL_MS3);
   }
   return {
     status: "uncertain",
     signature,
-    error: `transaction ${signature} was not finalized within ${CONFIRM_MAX_POLLS2 * CONFIRM_POLL_MS2 / 1000}s; it may still land${echoNote}`
+    error: `transaction ${signature} was not finalized within ${CONFIRM_MAX_POLLS3 * CONFIRM_POLL_MS3 / 1000}s; it may still land${echoNote}`
   };
 }
 async function teeSweep(args, ctx) {
@@ -50406,13 +52072,13 @@ async function teeSweep(args, ctx) {
     pathFlags: ["--keystore"]
   });
   if ("error" in parsed)
-    return usage3(ctx, parsed.error);
+    return usage4(ctx, parsed.error);
   const [address, extra] = parsed.positionals;
   if (!address || extra !== undefined)
-    return usage3(ctx, "Usage: candle tee sweep <address> --rpc-url <url> [--emergency]");
+    return usage4(ctx, "Usage: candle tee sweep <address> --rpc-url <url> [--emergency]");
   const rpcUrl2 = rpcUrlFrom2(ctx, parsed);
   if (typeof rpcUrl2 !== "string")
-    return usage3(ctx, rpcUrl2.error);
+    return usage4(ctx, rpcUrl2.error);
   const emergency = parsed.booleans.has("--emergency");
   const openedActive = await openActiveTee(ctx, parsed, address, "sign");
   if (!openedActive.ok)
@@ -50615,6 +52281,116 @@ Stop the agent from your Candle session if you have not, and re-run candle tee d
       pendingStill.push(p);
       signingBlocked = true;
     }
+    const candidateAccounts = new Set;
+    const lpCloses = [];
+    {
+      let token2022Accounts = [];
+      try {
+        token2022Accounts = await rpc2.getTokenAccountsByOwner(address, TOKEN_2022_PROGRAM_ID);
+      } catch (error) {
+        residuals.push({
+          kind: "inventory",
+          detail: `could not list Token-2022 accounts for position discovery: ${error instanceof Error ? error.message : error}`
+        });
+      }
+      const candidates = token2022Accounts.filter(isPositionCandidate);
+      for (const acct of candidates)
+        candidateAccounts.add(acct.pubkey);
+      const leftover = (kind, acct, detail) => residuals.push({ kind, detail, mint: acct.mint, account: acct.pubkey, amountRaw: acct.amountRaw });
+      if (!emergency && candidates.length > 0) {
+        if (!json)
+          deps.stdout.write(`  ${candidates.length} position NFT candidate(s) (Token-2022, amount 1, decimals 0)
+`);
+        const verified = [];
+        for (const acct of candidates) {
+          if (signingBlocked)
+            break;
+          if (!apiKey || !entry.linkedWalletId) {
+            leftover(DAMM_POSITION_CLOSE_UNAVAILABLE, acct, "no bound API key is available to build the close; the NFT was left in place");
+            continue;
+          }
+          const result = await apiRequest(`/api/v1/agent/lp/positions/${encodeURIComponent(acct.mint)}/close-build`, {
+            method: "POST",
+            auth: "key",
+            credentials: { apiKey },
+            apiUrl,
+            fetch: deps.fetch,
+            env: deps.env,
+            body: {}
+          });
+          if (!result.ok) {
+            leftover(DAMM_POSITION_CLOSE_UNAVAILABLE, acct, `close-build ${result.code ?? `HTTP ${result.status}`}: ${result.message}; the NFT was left in place`);
+            continue;
+          }
+          const artifact = parseCloseArtifact(result.body);
+          if (artifact === undefined) {
+            leftover(DAMM_POSITION_CLOSE_UNAVAILABLE, acct, "close-build answered without a transaction and an ordered account key array; the NFT was left in place");
+            continue;
+          }
+          const verdict = await verifyCloseArtifact({
+            artifact,
+            rpc: rpc2,
+            tee: address,
+            vault,
+            nftMint: acct.mint,
+            nftAccount: acct.pubkey
+          });
+          if (!verdict.ok) {
+            leftover(DAMM_CLOSE_TRANSACTION_REFUSED, acct, `${verdict.reason}; refused before signing`);
+            continue;
+          }
+          verified.push({ acct, verdict });
+        }
+        for (const { acct, verdict } of verified) {
+          if (signingBlocked) {
+            leftover(DAMM_POSITION_CLOSE_UNAVAILABLE, acct, "not signed: an earlier transaction is still in flight");
+            continue;
+          }
+          let blockhashValid;
+          try {
+            blockhashValid = await rpc2.isBlockhashValid(verdict.tx.message.recentBlockhash, "confirmed");
+          } catch (error) {
+            leftover(DAMM_POSITION_CLOSE_UNAVAILABLE, acct, `could not check the close build's blockhash: ${error instanceof Error ? error.message : error}; not signed`);
+            continue;
+          }
+          if (!blockhashValid) {
+            leftover(DAMM_POSITION_CLOSE_UNAVAILABLE, acct, "the close build's blockhash has expired; not signed, re-run the sweep for a fresh close");
+            continue;
+          }
+          const display = describeClose({ verdict, tee: address, vault, nftMint: acct.mint, nftAccount: acct.pubkey });
+          lpCloses.push({ mint: acct.mint, account: acct.pubkey, display });
+          if (!json) {
+            deps.stdout.write(`  Close for position ${acct.mint} (verified, unsigned; about to sign):
+`);
+            for (const line of display)
+              deps.stdout.write(`    ${line}
+`);
+          }
+          const pending = {
+            kind: "lp-close",
+            mint: acct.mint,
+            account: acct.pubkey,
+            amountRaw: acct.amountRaw
+          };
+          const outcome = await broadcastMessage(rpc2, deps, secret, verdict.tx.message.bytes, verdict.tx.message.recentBlockhash, pending, recordPending, clearPending);
+          if (outcome.status !== "finalized") {
+            if (!settle2(outcome, pending, "lp-close"))
+              signingBlocked = true;
+            continue;
+          }
+          await retainReceipt({
+            kind: "lp-close",
+            mint: acct.mint,
+            amountRaw: acct.amountRaw,
+            signature: outcome.signature,
+            finalizedAt: new Date(deps.now()).toISOString()
+          });
+          if (!json)
+            deps.stdout.write(`  closed LP position ${acct.mint} and withdrew its liquidity: ${outcome.signature}
+`);
+        }
+      }
+    }
     const tokenAccounts = [];
     for (const programId of [TOKEN_PROGRAM_ID, TOKEN_2022_PROGRAM_ID]) {
       try {
@@ -50631,6 +52407,13 @@ Stop the agent from your Candle session if you have not, and re-run candle tee d
       if (signingBlocked)
         break;
       const token2022 = acct.programId === TOKEN_2022_PROGRAM_ID;
+      if (candidateAccounts.has(acct.pubkey)) {
+        if (!emergency)
+          continue;
+        if (!json)
+          deps.stdout.write(`  ${acct.mint}: position NFT moved as-is to the vault (emergency; unwind it from a fresh TEE wallet)
+`);
+      }
       if (acct.state !== "initialized") {
         residuals.push({
           kind: token2022 && acct.state === "frozen" ? "TOKEN_2022_FROZEN" : "frozen-or-uninitialized",
@@ -50885,7 +52668,8 @@ Stop the agent from your Candle session if you have not, and re-run candle tee d
           signature: p.signature
         })),
         inventory,
-        recordedOnServer
+        recordedOnServer,
+        ...lpCloses.length > 0 ? { lpCloses } : {}
       })}
 `);
       return finalState === "swept" ? 0 : 3;
@@ -50968,8 +52752,7 @@ function launchWarning(keyPrefix, toKey, rows) {
   return `Warning: key ${keyPrefix} lacks launch:write; ${launchers.join(", ")} ${launchers.length === 1 ? "has" : "have"} allowLaunch but cannot launch under it.`;
 }
 var RELAY_SIGNER_LINE = "The relay signer does not move: trade these wallets from the machine that promoted them.";
-function writeRebindFailure(ctx, result, context) {
-  const { deps, apiUrl, json } = ctx;
+function rebindFailureDetails(result, context) {
   let code = result.code;
   let message = result.message;
   let suggestion;
@@ -50989,31 +52772,61 @@ function writeRebindFailure(ctx, result, context) {
   } else if (result.code === "REBIND_STALE") {
     suggestion = "Run the command again; the preview will show the current binding.";
   }
+  return {
+    code: code ?? `HTTP ${result.status}`,
+    message,
+    ...suggestion !== undefined ? { suggestion } : {},
+    status: result.status
+  };
+}
+function writeRebindFailure(ctx, result, context) {
+  const { deps, apiUrl, json } = ctx;
+  const { code, message, suggestion } = rebindFailureDetails(result, context);
   const envelope = errorEnvelope({ ...result, code, message }, { apiUrl, authType: "device" });
   if (json) {
     deps.stdout.write(`${JSON.stringify({ ...envelope, ...suggestion ? { suggestion } : {} })}
 `);
   } else {
-    deps.stderr.write(`${code ?? `HTTP ${result.status}`}: ${message}${suggestion ? ` ${suggestion}` : ""}
+    deps.stderr.write(`${code}: ${message}${suggestion ? ` ${suggestion}` : ""}
 `);
   }
   return 1;
 }
-async function resolveTargetKey(ctx, deviceToken, raw) {
-  const { deps, apiUrl, json } = ctx;
-  if (KEY_PREFIX_RE.test(raw))
-    return { ok: true, keyPrefix: raw };
-  const result = await apiRequest(KEYS_PATH2, {
+async function listAccountKeys(ctx, deviceToken) {
+  const { deps, apiUrl } = ctx;
+  return apiRequest(KEYS_PATH2, {
     auth: "device",
     credentials: { deviceToken },
     apiUrl,
     fetch: deps.fetch,
     env: deps.env
   });
-  if (!result.ok) {
-    return { ok: false, code: writeRebindFailure(ctx, result, {}) };
+}
+async function postRebind(ctx, deviceToken, body) {
+  const { deps, apiUrl } = ctx;
+  return apiRequest(REBIND_PATH, {
+    method: "POST",
+    body,
+    auth: "device",
+    credentials: { deviceToken },
+    apiUrl,
+    fetch: deps.fetch,
+    env: deps.env
+  });
+}
+async function resolveTargetKey(ctx, deviceToken, raw, opts = {}) {
+  const { deps, json } = ctx;
+  if (KEY_PREFIX_RE.test(raw))
+    return { ok: true, keyPrefix: raw };
+  let listed = opts.keys;
+  if (listed === undefined) {
+    const result = await listAccountKeys(ctx, deviceToken);
+    if (!result.ok) {
+      return { ok: false, code: writeRebindFailure(ctx, result, {}) };
+    }
+    listed = result.body?.keys ?? [];
   }
-  const keys = (result.body?.keys ?? []).filter((key) => !key.revokedAt);
+  const keys = listed.filter((key) => !key.revokedAt);
   const matches = keys.filter((key) => key.label === raw);
   if (matches.length === 1)
     return { ok: true, keyPrefix: matches[0].keyPrefix };
@@ -51071,15 +52884,7 @@ async function teeRebind(args, ctx) {
   const target = await resolveTargetKey(ctx, deviceToken, toKey);
   if (!target.ok)
     return target.code;
-  const call = (body) => apiRequest(REBIND_PATH, {
-    method: "POST",
-    body,
-    auth: "device",
-    credentials: { deviceToken },
-    apiUrl,
-    fetch: deps.fetch,
-    env: deps.env
-  });
+  const call = (body) => postRebind(ctx, deviceToken, body);
   const preview = await call({
     dryRun: true,
     toKeyPrefix: target.keyPrefix,
@@ -51221,6 +53026,150 @@ async function teeRebinds(args, ctx) {
   return 0;
 }
 
+// src/commands/transfer.ts
+init_args();
+init_render();
+init_trading();
+var USAGE2 = "Usage: candle transfer --to <address|wallet name|vault> --asset <SOL|USDC|CNDL>|--mint <mint> --amount <decimal|max> [--wallet <name>] [--rpc-url <url>] [--yes] [--json]";
+var TRANSFER_ASSETS = Object.keys(BASES);
+var BASE58_ADDRESS = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;
+async function readLinkedWallets(ctx, key) {
+  const rows = [];
+  let cursor = null;
+  const seen = new Set;
+  for (let page = 0;page < 25; page++) {
+    const query = cursor === null ? "?limit=100" : `?limit=100&cursor=${encodeURIComponent(cursor)}`;
+    const body = await request(ctx, key, `/api/v1/agent/wallets${query}`);
+    if (!Array.isArray(body.page))
+      throw new TradingError("INVALID_RESPONSE", "Wallet discovery did not return a page.");
+    rows.push(...body.page);
+    if (body.isDone !== false || typeof body.continueCursor !== "string" || seen.has(body.continueCursor))
+      return rows;
+    seen.add(body.continueCursor);
+    cursor = body.continueCursor;
+  }
+  return rows;
+}
+async function resolveDestination(ctx, key, source, to) {
+  if (to === "vault") {
+    const lifecycle = await request(ctx, key, `/api/v1/agent/wallets/${encodeURIComponent(source.id)}/lifecycle`);
+    const vault = lifecycle.vaultDestination;
+    if (typeof vault !== "string" || vault.length === 0)
+      throw new TradingError("VAULT_NOT_PINNED", "This wallet has no pinned vault recorded on Candle, so --to vault names nothing. Pass the address instead.");
+    return { kind: "vault", address: vault };
+  }
+  const rows = (await readLinkedWallets(ctx, key)).filter((row) => row.chain === "solana" && row.revokedAt === undefined && row.address !== source.address);
+  const matches = rows.filter((row) => row.label === to || row._id === to || row.address === to);
+  if (matches.length > 1)
+    throw new TradingError("DESTINATION_AMBIGUOUS", `"${to}" names ${matches.length} linked wallets: ${matches.map((row) => `${row.label ?? ""} (${row._id}, ${row.address})`.trim()).join("; ")}. Name one by id or address.`);
+  const match = matches[0];
+  if (match)
+    return { kind: "linked", address: match.address, id: match._id, ...match.label ? { label: match.label } : {} };
+  if (to === source.address)
+    throw new TradingError("DESTINATION_IS_SOURCE", "--to names the wallet the funds would leave. Name a different destination.");
+  if (BASE58_ADDRESS.test(to))
+    return { kind: "address", address: to };
+  throw new TradingError("DESTINATION_UNKNOWN", rows.length === 0 ? `"${to}" is not vault, a Solana address, or a linked wallet on this account (it has no other active Solana linked wallets).` : `"${to}" is not vault, a Solana address, or a linked wallet on this account. Linked wallets: ${rows.map((row) => `${row.label ?? ""} (${row._id}, ${row.address})`.trim()).join("; ")}.`);
+}
+function describeDestination(destination) {
+  switch (destination.kind) {
+    case "vault":
+      return `this wallet's pinned vault ${destination.address}`;
+    case "linked":
+      return `linked wallet ${destination.label ? `${destination.label} ` : ""}(${destination.id}, ${destination.address})`;
+    case "address":
+      return `address ${destination.address} (not one of this account's linked wallets; Candle decides whether it is allowed)`;
+  }
+}
+async function confirmTransfer(ctx, lines, yes) {
+  const output = ctx.json ? ctx.deps.stderr : ctx.deps.stdout;
+  for (const line of lines)
+    output.write(`${safeText(line)}
+`);
+  if (yes)
+    return true;
+  if (!ctx.deps.isTTY.stdin)
+    throw new TradingError("CONFIRMATION_REQUIRED", "Run interactively to confirm, or use --yes for an ordinary transfer prompt.");
+  return (await ctx.deps.promptLine("Proceed? [y/N] ")).trim().toLowerCase() === "y";
+}
+async function transfer(args, ctx) {
+  const parsed = parseArgs(args, {
+    valueFlags: ["--wallet", "--to", "--asset", "--mint", "--amount", "--rpc-url"],
+    booleanFlags: ["--yes"]
+  });
+  if ("error" in parsed) {
+    writeUsageFailure(ctx.deps, parsed.error, ctx.json);
+    return 2;
+  }
+  const flags = parsed.values;
+  const asset = flags["--asset"]?.toUpperCase();
+  if (parsed.positionals.length !== 0 || !flags["--to"] || !flags["--amount"] || Boolean(flags["--asset"]) === Boolean(flags["--mint"]) || asset !== undefined && !TRANSFER_ASSETS.includes(asset) || flags["--mint"] !== undefined && !BASE58_ADDRESS.test(flags["--mint"])) {
+    writeUsageFailure(ctx.deps, USAGE2, ctx.json);
+    return 2;
+  }
+  const to = flags["--to"];
+  const isMax = flags["--amount"] === "max";
+  try {
+    if (!isMax)
+      rawAmount(flags["--amount"], 18);
+    const key = await tradingKey(ctx);
+    const payer = await tradingPayer(ctx, key, flags["--wallet"], "transfer:write");
+    if (payer.kind === "embedded")
+      throw new TradingError("PAYER_UNSUPPORTED", "This command moves a linked wallet this machine can sign for. The embedded wallet transfers through the agent transfer rail (MCP candle_transfer), not from here. Name a TEE wallet with --wallet.");
+    if (!payer.scopes.includes("transfer:bound"))
+      throw new TradingError("SCOPE_MISSING", "Moving funds out of a TEE wallet needs a Read:Write:Transfer key. Mint one with: candle keys create --access read-write-transfer, then bind the wallet to it with: candle tee rebind");
+    const wallet = payer.wallet;
+    const destination = await resolveDestination(ctx, key, wallet, to);
+    const label = asset ?? flags["--mint"];
+    let amountRaw;
+    if (isMax)
+      amountRaw = "max";
+    else {
+      const decimals = asset ? BASES[asset]?.decimals ?? 9 : await decimalsFor(ctx, flags["--mint"], flags["--rpc-url"]);
+      amountRaw = rawAmount(flags["--amount"], decimals);
+    }
+    const amountText = isMax ? `the full spendable balance of ${label}` : `${flags["--amount"]} ${label}`;
+    const confirmed = await confirmTransfer(ctx, [
+      `Transfer ${amountText} from ${wallet.address} (${wallet.id}) to ${describeDestination(destination)}`,
+      destination.kind === "vault" ? "Destination: this wallet's own vault, pinned when it was imported." : destination.kind === "linked" ? "Destination: a linked wallet on this account. Candle allows it only if you linked it while signed in or marked it trusted, and the amount counts against this key's spend caps." : "Destination: an address Candle will classify at build; from a TEE wallet only its vault or a trusted linked wallet is allowed."
+    ], parsed.booleans.has("--yes"));
+    if (!confirmed)
+      return printTradingResult(ctx, { success: true, status: "cancelled", walletId: wallet.id, destination });
+    const built = await request(ctx, key, "/api/v1/agent/transfer/build", {
+      walletId: wallet.id,
+      chain: "solana",
+      ...asset ? { asset } : { mint: flags["--mint"] },
+      amountRaw,
+      to: destination.address
+    });
+    const transferId = built.transferId;
+    const unsigned = built.unsignedTransactionsBase64;
+    if (typeof transferId !== "string" || !Array.isArray(unsigned) || unsigned.length !== 1 || typeof unsigned[0] !== "string")
+      throw new TradingError("INVALID_RESPONSE", "Candle did not return one unsigned transfer transaction; nothing was signed.");
+    if (typeof built.payerAddress === "string" && built.payerAddress !== wallet.address)
+      throw new TradingError("INVALID_RESPONSE", "The transfer build does not name the requested payer; nothing was signed.");
+    const builtAmount = typeof built.amountRaw === "string" ? built.amountRaw : amountRaw;
+    ctx.deps.stderr.write(`Built transfer ${transferId}: ${asset ? `${decimalAmount(builtAmount, BASES[asset]?.decimals ?? 0)} ${asset}` : `${builtAmount} raw units of ${label}`}${typeof built.destinationKind === "string" ? ` to ${built.destinationKind === "vault" ? "the vault" : "a linked wallet"}` : ""}.
+`);
+    const signed = await relaySign(ctx, key, wallet, unsigned[0]);
+    const result = await request(ctx, key, "/api/v1/agent/transfer/submit", {
+      transferId,
+      signedTransactionsBase64: [signed]
+    });
+    const receipt = {
+      ...result,
+      transferId,
+      walletId: wallet.id,
+      wallet: safeText(wallet.address),
+      destination,
+      ...typeof built.destinationKind === "string" ? { destinationKind: built.destinationKind } : {}
+    };
+    return printTradingResult(ctx, receipt);
+  } catch (error) {
+    return tradingFailure(ctx, error);
+  }
+}
+
 // src/commands/update.ts
 init_args();
 import { randomBytes as randomBytes3 } from "node:crypto";
@@ -52793,10 +54742,15 @@ async function addPasskeyFactor(ctx, parsed, resolvedVault, hold) {
   const opened = await unlockInteractively(ctx, path, raw, {
     acceptOlderCopy: parsed.booleans.has("--accept-older-copy"),
     promptText: "Current vault passphrase, to unlock (input hidden): ",
-    factor: "passphrase",
-    passphraseOnlyBecause: "adding a factor opens the vault with the passphrase. A security key does not authorise enrollment: adding a second key while one is plugged in needs a device-selection rule this command does not have (D10)."
+    among: factorAddAmong(parseVaultFile(raw).envelopes)
   });
   const vault = hold(opened.vault);
+  const openedWith = {
+    factor: opened.factor.kind === "passphrase" ? "passphrase" : "security-key",
+    envelopeId: opened.factor.envelopeId
+  };
+  if (opened.factor.kind === "security-key")
+    opened.factor.session.pin = undefined;
   const vaultId = vault.file.vaultId;
   let registered;
   try {
@@ -52894,7 +54848,8 @@ async function addPasskeyFactor(ctx, parsed, resolvedVault, hold) {
       saltDerivation: "platform",
       helper: envelope.helper,
       recoverableFactors: recoverable,
-      verified: true
+      verified: true,
+      openedWith
     });
     return 0;
   }
@@ -52917,6 +54872,7 @@ ${PASSKEY_NOTE}
 }
 
 // src/commands/vault-factor-security-key.ts
+init_esm();
 init_crypto();
 init_errors();
 init_fido2();
@@ -53040,20 +54996,84 @@ async function addSecurityKeyFactor(ctx, parsed, resolvedVault, hold) {
   const raw = await requireVaultRaw(ctx, resolvedVault);
   const file = parseVaultFile(raw);
   const envelopeId = freshEnvelopeId();
-  const session = await openSecurityKeySession(deps, {
-    vaultId: file.vaultId,
-    envelopeId,
-    deviceFlag: ctx.vaultDevice,
-    requireFeatures: true
-  });
+  const vaultId = file.vaultId;
+  const keysInHeader = file.envelopes.filter(isCtap2Envelope);
+  const { helperPath, info } = await listSecurityKeys(deps, { vaultId, envelopeId });
+  assertHelperExcludeList(info, helperPath, keysInHeader.length);
+  const attached = keysInHeader.length > 0 ? await probeAttachedKeys(deps, { vaultId, envelopes: keysInHeader }) : undefined;
+  const excludeCountNow = keysInHeader.length;
+  const addingLine = (device) => deps.stderr.write(`Adding: ${device.product || "security key"} (--device ${device.deviceId}), a different key from the one that opened the vault.
+`);
+  let session;
+  let enrolling;
+  let deferredAfter;
   const opened = await unlockInteractively(ctx, path, raw, {
     acceptOlderCopy: parsed.booleans.has("--accept-older-copy"),
     promptText: "Current vault passphrase, to unlock (input hidden): ",
-    factor: "passphrase",
-    passphraseOnlyBecause: "this command's security key session is for the key being added, so the vault opens with the passphrase here."
+    among: factorAddAmong(file.envelopes),
+    attached,
+    onFactorChosen: async (chosen) => {
+      if (chosen.kind === "passphrase") {
+        session = await openSecurityKeySession(deps, {
+          vaultId,
+          envelopeId,
+          deviceFlag: ctx.vaultDevice,
+          requireFeatures: true,
+          beforePin: (device) => {
+            refuseIfEnrolled(device, attached);
+            assertExcludeListFits(device, excludeCountNow);
+          }
+        });
+        return;
+      }
+      if (chosen.kind !== "security-key")
+        return;
+      const plan = planDevices(ctx, chosen.envelope, info.devices, attached);
+      if (plan.enrolling !== undefined) {
+        refuseIfEnrolled(plan.enrolling, attached);
+        assertDeviceServesFactor(plan.enrolling);
+        assertExcludeListFits(plan.enrolling, excludeCountNow);
+        enrolling = plan.enrolling;
+        addingLine(plan.enrolling);
+      } else {
+        deferredAfter = plan.opening;
+      }
+      return { preferDevice: plan.opening.deviceId };
+    }
   });
   const vault = hold(opened.vault);
-  const registered = await registerCredential(deps, session, { vaultId: vault.file.vaultId, envelopeId });
+  const openedWith = {
+    factor: opened.factor.kind === "passphrase" ? "passphrase" : "security-key",
+    envelopeId: opened.factor.envelopeId
+  };
+  if (opened.factor.kind === "security-key")
+    opened.factor.session.pin = undefined;
+  const enrolledKeys = vault.file.envelopes.filter(isCtap2Envelope);
+  const excludeCredentialIds = enrolledKeys.map((envelope2) => base64.encode(unb64u(envelope2.credentialId, "credentialId")));
+  if (session === undefined) {
+    if (deferredAfter !== undefined) {
+      await deps.promptLine(`The vault is open. Unplug ${deferredAfter.product || "the security key that opened it"}, insert the security key to add, then press Enter.`);
+      const again = await listSecurityKeys(deps, { vaultId, envelopeId });
+      const probeAgain = enrolledKeys.length > 0 ? await probeAttachedKeys(deps, { vaultId, envelopes: enrolledKeys }) : undefined;
+      const inserted = chooseAfterInsert(ctx, again.info.devices, probeAgain);
+      refuseIfEnrolled(inserted, probeAgain);
+      assertDeviceServesFactor(inserted);
+      assertExcludeListFits(inserted, excludeCredentialIds.length);
+      addingLine(inserted);
+      enrolling = inserted;
+    }
+    if (enrolling === undefined)
+      throw new Error("factor add security-key: no enrolling device was decided");
+    const target = enrolling;
+    session = await openSecurityKeySession(deps, {
+      vaultId,
+      envelopeId,
+      deviceFlag: target.deviceId,
+      requireFeatures: true,
+      pinPrompt: (device) => `PIN for the key being added, ${device.product || "the security key"} (input hidden): `
+    });
+  }
+  const registered = await registerCredential(deps, session, { vaultId, envelopeId, excludeCredentialIds });
   if (registered.backupEligible) {
     throw new VaultError("VAULT_FACTOR_UNAVAILABLE", `${session.device.product || "This authenticator"} reports the credential it created as backup-eligible (synced), so it is not a hardware-bound security key credential and cannot be recorded as a hardware-token factor.`, {
       suggestion: "Nothing was written to the vault. The credential now on the authenticator can be removed with its vendor's tool. Use a hardware security key for this factor."
@@ -53110,7 +55130,8 @@ async function addSecurityKeyFactor(ctx, parsed, resolvedVault, hold) {
       backupState: envelope.backupState,
       userVerification: "required",
       recoverableFactors: recoverable,
-      verified: true
+      verified: true,
+      openedWith
     });
     return 0;
   }
@@ -53129,6 +55150,76 @@ ${SECURITY_KEY_PAIR_NOTE}
 `);
   return 0;
 }
+function refuseIfEnrolled(device, attached) {
+  const entry = attached?.devices?.find((candidate) => candidate.deviceId === device.deviceId);
+  if (entry === undefined || attached?.credentials === undefined)
+    return;
+  for (const [envelopeId, credentialId] of attached.credentials) {
+    if (entry.present.includes(credentialId))
+      throw alreadyEnrolled(device, envelopeId);
+  }
+}
+function planDevices(ctx, opener, devices, attached) {
+  const platform = ctx.deps.platform;
+  if (devices.length === 0) {
+    throw new VaultError("VAULT_FACTOR_UNAVAILABLE", "No security key is attached.", {
+      suggestion: "Plug the key in and run the command again. No other factor is substituted."
+    });
+  }
+  const named = ctx.vaultDevice;
+  const openerCredential = attached?.credentials?.get(opener.id);
+  const holders = openerCredential === undefined ? [] : (attached?.devices ?? []).filter((device) => device.present.includes(openerCredential));
+  let opening;
+  if (holders.length === 1) {
+    opening = devices.find((device) => device.deviceId === holders[0].deviceId);
+  }
+  if (opening === undefined) {
+    const candidates = devices.filter((device) => device.deviceId !== named);
+    if (candidates.length === 1)
+      opening = candidates[0];
+    else if (devices.length === 1)
+      opening = devices[0];
+  }
+  if (opening === undefined) {
+    throw new VaultError("VAULT_AUTHENTICATOR_AMBIGUOUS", `${devices.length} security keys are attached and the one that opens the vault could not be told apart. Leave only the key that opens the vault attached; this command asks for the key to add after the vault is open.`, { suggestion: "Nothing was sent to any key. Run again with only the key that opens the vault attached." });
+  }
+  if (!opening.readable)
+    selectDevice([opening], undefined, platform);
+  const others = devices.filter((device) => device.deviceId !== opening.deviceId);
+  if (named !== undefined) {
+    if (named === opening.deviceId)
+      throw alreadyEnrolled(opening, opener.id);
+    return { opening, enrolling: selectDevice(others, named, platform) };
+  }
+  if (others.length === 1)
+    return { opening, enrolling: selectDevice(others, undefined, platform) };
+  if (others.length > 1) {
+    const listing = others.map((device) => `  ${describeDeviceForList(device)}`).join(`
+`);
+    throw new VaultError("VAULT_AUTHENTICATOR_AMBIGUOUS", `${others.length} security keys are attached besides the one that opens the vault, and none was named, so nothing was sent to any of them:
+${listing}`, { suggestion: "Run again with --device <id> naming the key to add." });
+  }
+  return { opening, enrolling: undefined };
+}
+function chooseAfterInsert(ctx, devices, probe) {
+  const platform = ctx.deps.platform;
+  if (devices.length === 0) {
+    throw new VaultError("VAULT_FACTOR_UNAVAILABLE", "No security key other than the one that opened the vault is attached. Nothing was written.", { suggestion: "Run the command again with the key to add inserted when asked." });
+  }
+  if (devices.length === 1)
+    return selectDevice(devices, undefined, platform);
+  const holdsVault = (device) => (probe?.devices?.find((entry) => entry.deviceId === device.deviceId)?.present.length ?? 0) > 0;
+  const others = devices.filter((device) => !holdsVault(device));
+  if (others.length === 1)
+    return selectDevice(others, undefined, platform);
+  if (others.length === 0) {
+    throw new VaultError("VAULT_FACTOR_UNAVAILABLE", "Every attached security key already holds one of this vault's credentials, so there is no key to add. Nothing was written.", { suggestion: "Run the command again with a security key this vault does not have inserted when asked." });
+  }
+  const listing = others.map((device) => `  ${describeDeviceForList(device)}`).join(`
+`);
+  throw new VaultError("VAULT_AUTHENTICATOR_AMBIGUOUS", `${others.length} security keys are attached besides the one that opened the vault, so nothing was sent to any of them:
+${listing}`, { suggestion: "Run the command again with only the key to add inserted when asked. Nothing was written." });
+}
 
 // src/commands/vault-factor-touch-id.ts
 init_enclave();
@@ -53167,10 +55258,15 @@ async function addTouchIdFactor(ctx, parsed, resolvedVault, hold) {
   const opened = await unlockInteractively(ctx, path, raw, {
     acceptOlderCopy: parsed.booleans.has("--accept-older-copy"),
     promptText: "Current vault passphrase, to unlock (input hidden): ",
-    factor: "passphrase",
-    passphraseOnlyBecause: "adding a factor opens the vault with the passphrase. A security key does not authorise enrollment: adding a second key while one is plugged in needs a device-selection rule this command does not have (D10)."
+    among: factorAddAmong(parseVaultFile(raw).envelopes)
   });
   const vault = hold(opened.vault);
+  const openedWith = {
+    factor: opened.factor.kind === "passphrase" ? "passphrase" : "security-key",
+    envelopeId: opened.factor.envelopeId
+  };
+  if (opened.factor.kind === "security-key")
+    opened.factor.session.pin = undefined;
   const vaultId = vault.file.vaultId;
   const keyTag = keyTagFor(vaultId, envelopeId);
   let created;
@@ -53254,7 +55350,8 @@ async function addTouchIdFactor(ctx, parsed, resolvedVault, hold) {
       helper: { teamId: session.identity.teamId, bundleId: session.identity.bundleId, minVersion: session.version },
       accessControl: "biometryCurrentSet",
       recoverableFactors: recoverable,
-      verified: true
+      verified: true,
+      openedWith
     });
     return 0;
   }
@@ -53960,9 +56057,18 @@ function decimalToRaw2(decimal, decimals) {
 }
 function assertVaultSigner(entry) {
   if (entry.role !== "vault") {
-    throw new VaultError("PROMOTE_NOT_VAULT_KEY", `${entry.label ?? entry.address} is a TEE wallet entry and cannot sign vault transfer or fund shapes (ED-10 / N3).`);
+    throw new VaultError("PROMOTE_NOT_VAULT_KEY", `${entry.label ?? entry.address} is not a vault key, and vault fund signs from vault keys only (ED-10).`, {
+      suggestion: `To move funds out of a promoted wallet, use: candle vault transfer <to> --from ${entry.label ?? entry.address}`
+    });
   }
 }
+function assertTransferSigner(entry) {
+  if (entry.role === "vault" || entry.role === "tee-wallet")
+    return;
+  throw new VaultError("PROMOTE_NOT_VAULT_KEY", `${entry.label ?? entry.address} is an external wallet and cannot sign vault transfer shapes (ED-10).`, {
+    suggestion: `Move funds out of an external wallet with: candle external sweep ${entry.label} --to <vault> --rpc-url <url>`
+  });
+}
 function namedSendFailure(plan) {
   if (!plan.token)
     return;
@@ -54707,9 +56813,9 @@ init_render();
 init_solana_lite();
 init_store();
 init_vault_support();
-var CHUNK = 100;
+var CHUNK2 = 100;
 var LAMPORTS_PER_SOL = 1000000000n;
-function formatSol2(lamports) {
+function formatSol3(lamports) {
   const whole = lamports / LAMPORTS_PER_SOL;
   const fraction = (lamports % LAMPORTS_PER_SOL).toString().padStart(9, "0").replace(/0+$/, "");
   return fraction === "" ? whole.toString() : `${whole}.${fraction}`;
@@ -54719,8 +56825,8 @@ async function readLamports(addresses, rpcUrl2, fetchFn) {
   const lamports = new Map;
   const unavailable = [];
   let failure;
-  for (let at = 0;at < addresses.length; at += CHUNK) {
-    const chunk = addresses.slice(at, at + CHUNK);
+  for (let at = 0;at < addresses.length; at += CHUNK2) {
+    const chunk = addresses.slice(at, at + CHUNK2);
     try {
       const accounts = await rpc2.getMultipleAccounts(chunk);
       for (const [i, address] of chunk.entries())
@@ -54771,7 +56877,7 @@ async function vaultList(args, ctx) {
     const all = vault.index.entries;
     const matched = filter === undefined ? all : all.filter((entry) => matches(entry, filter));
     const solana = balances ? matched.filter((entry) => entry.chain === "solana") : [];
-    const requests = Math.ceil(solana.length / CHUNK);
+    const requests = Math.ceil(solana.length / CHUNK2);
     const rpcHost = rpcUrl2 === undefined ? undefined : new URL(rpcUrl2).host;
     if (balances && solana.length > 0 && rpcHost !== undefined) {
       deps.stderr.write(`Reading SOL for ${solana.length} addresses from ${rpcHost}, in ${requests} ${requests === 1 ? "request" : "requests"}. That endpoint sees all ${solana.length} together.
@@ -54833,7 +56939,7 @@ async function vaultList(args, ctx) {
       const row = [entry.address, entry.label || "(none)", entry.role, entry.derivation?.path ?? "-"];
       if (balances) {
         const held = lamports.get(entry.address);
-        row.push(entry.chain !== "solana" ? "-" : held === undefined ? "?" : formatSol2(held));
+        row.push(entry.chain !== "solana" ? "-" : held === undefined ? "?" : formatSol3(held));
       }
       return row;
     });
@@ -54842,9 +56948,9 @@ ${renderTable(headers, rows)}
 `);
     if (balances) {
       deps.stdout.write(complete ? `
-total  ${formatSol2(totalLamports)} SOL across ${solana.length} keys
+total  ${formatSol3(totalLamports)} SOL across ${solana.length} keys
 ` : `
-total  ${formatSol2(totalLamports)} SOL across ${solana.length - unavailable.length} of ${solana.length} keys read
+total  ${formatSol3(totalLamports)} SOL across ${solana.length - unavailable.length} of ${solana.length} keys read
 `);
     }
     return complete ? 0 : 3;
@@ -54870,6 +56976,7 @@ async function vaultPhrase(args, ctx) {
 init_esm();
 init_args();
 init_deps();
+init_profiles();
 init_render();
 init_solana_lite();
 
@@ -54976,12 +57083,299 @@ function restoreRefusedFailure(init, error) {
 // src/commands/vault-promote.ts
 init_errors();
 init_promote_support();
+// src/vault/promote-to-key.ts
+init_deps();
+init_render();
+var REBIND_CHUNK = 200;
+var SELECTED_SCOPE_LIMIT = 50;
+function targetKeyRefusal(row, keyPrefix, now) {
+  const written = "Nothing was written.";
+  if (row === undefined) {
+    return {
+      code: "REBIND_KEY_NOT_FOUND",
+      message: `No key ${keyPrefix} on this account. ${written}`,
+      suggestion: "The target must be a key on the same account: candle keys list"
+    };
+  }
+  if (row.revokedAt !== undefined) {
+    return {
+      code: "REBIND_TARGET_INVALID",
+      message: `The target key ${keyPrefix} is revoked. ${written}`,
+      suggestion: "Pick an active key: candle keys list"
+    };
+  }
+  if (row.expiresAt !== undefined && row.expiresAt !== null && row.expiresAt <= now) {
+    return {
+      code: "REBIND_TARGET_INVALID",
+      message: `The target key ${keyPrefix} has expired. ${written}`,
+      suggestion: "Pick an active key: candle keys list"
+    };
+  }
+  if (row.environment !== "production") {
+    return {
+      code: "REBIND_TARGET_INVALID",
+      message: `The target key ${keyPrefix} is a test key; the trade rail refuses test keys. ${written}`,
+      suggestion: "Pick a production key: candle keys list"
+    };
+  }
+  if (!row.scopes.includes("swap:write")) {
+    return {
+      code: "REBIND_TARGET_INVALID",
+      message: `The target key ${keyPrefix} lacks swap:write, which a TEE wallet needs to trade. ${written}`,
+      suggestion: "Pick a key with swap:write, or mint one: candle keys create"
+    };
+  }
+  return null;
+}
+function tradeReadinessOf(row) {
+  const hasTxLimit = row.txLimit !== null && row.txLimit !== undefined;
+  const limits = row.spendLimits ?? [];
+  const cap = (asset) => limits.some((limit) => limit.asset === asset.toLowerCase() || limit.asset === asset.toUpperCase());
+  const sol = cap("sol");
+  const usdc = cap("usdc");
+  const missingCaps = [];
+  if (!hasTxLimit)
+    missingCaps.push("txLimit");
+  if (!sol)
+    missingCaps.push("spendLimits.sol");
+  if (!usdc)
+    missingCaps.push("spendLimits.usdc");
+  return { tradeReady: { sol: hasTxLimit && sol, usdc: hasTxLimit && usdc }, missingCaps };
+}
+function targetWarnings(target) {
+  return capWarnings(target.keyPrefix, {
+    keyPrefix: target.keyPrefix,
+    label: target.label,
+    paused: target.paused,
+    walletScope: target.walletScope,
+    tradeReady: target.tradeReady,
+    missingCaps: target.missingCaps,
+    launchScope: target.launchScope
+  });
+}
+async function preflightToKey(ctx, raw, opts) {
+  const { deps, json } = ctx;
+  const refuse2 = (failure) => {
+    writeLocalFailure(deps, failure, json);
+    return { ok: false, exit: 1 };
+  };
+  const deviceToken = await resolveDeviceToken(deps, ctx.profile);
+  if (!deviceToken)
+    return refuse2(DEVICE_TOKEN_REQUIRED);
+  const listing = await listAccountKeys(ctx, deviceToken);
+  if (!listing.ok) {
+    return refuse2({
+      code: listing.code ?? `HTTP ${listing.status}`,
+      message: `Could not read this account's keys to check --to-key (${listing.status === 0 ? listing.message : `HTTP ${listing.status}`}). Nothing was written.`,
+      suggestion: "Check the device token with: candle auth status"
+    });
+  }
+  const keys = listing.body?.keys ?? [];
+  const resolved = await resolveTargetKey(ctx, deviceToken, raw, { keys });
+  if (!resolved.ok)
+    return { ok: false, exit: resolved.code };
+  const keyPrefix = resolved.keyPrefix;
+  const row = keys.find((key) => key.keyPrefix === keyPrefix);
+  const refusal = targetKeyRefusal(row, keyPrefix, deps.now());
+  if (refusal !== null)
+    return refuse2(refusal);
+  const target = row;
+  const walletScope = target.walletScope === "selected" ? "selected" : "all";
+  if (walletScope === "selected") {
+    const room = await readSelectedScopeRoom(ctx, keyPrefix);
+    if (room.ok) {
+      const moving = opts.labels.filter((label) => !room.heldLabels.has(label)).length;
+      if (room.held + moving > SELECTED_SCOPE_LIMIT) {
+        return refuse2({
+          code: "REBIND_SCOPE_FULL",
+          message: `Key ${keyPrefix} is scoped to selected wallets and holds ${room.held} of ${SELECTED_SCOPE_LIMIT}; the ${moving} this run would move do not fit. Nothing was written.`,
+          suggestion: "Widen the key's wallet scope from the portal, or name a key with room."
+        });
+      }
+    } else {
+      deps.stderr.write(`Could not read key ${keyPrefix}'s wallet set (${room.reason}); its selected-scope room is checked at the rebind.
+`);
+    }
+  }
+  const readiness = tradeReadinessOf(target);
+  return {
+    ok: true,
+    deviceToken,
+    target: {
+      keyPrefix,
+      label: typeof target.label === "string" && target.label.length > 0 ? target.label : null,
+      walletScope,
+      paused: target.pausedAt !== undefined && target.pausedAt !== null,
+      launchScope: target.scopes.includes("launch:write"),
+      ...readiness
+    }
+  };
+}
+async function readSelectedScopeRoom(ctx, keyPrefix) {
+  const apiKey = await resolveApiKey(ctx.deps, ctx.profile);
+  if (!apiKey)
+    return { ok: false, reason: "no API key" };
+  const result = await apiRequest(`/api/v1/agent/keys/${encodeURIComponent(keyPrefix)}/wallets`, {
+    auth: "key",
+    credentials: { apiKey },
+    apiUrl: ctx.apiUrl,
+    fetch: ctx.deps.fetch,
+    env: ctx.deps.env
+  });
+  if (!result.ok)
+    return { ok: false, reason: result.status === 0 ? result.message : `HTTP ${result.status}` };
+  const wallets2 = result.body?.wallets;
+  if (!Array.isArray(wallets2))
+    return { ok: false, reason: "no wallet list in the response" };
+  const heldLabels = new Set;
+  for (const wallet of wallets2)
+    if (typeof wallet?.label === "string")
+      heldLabels.add(wallet.label);
+  return { ok: true, held: wallets2.length, heldLabels };
+}
+function chunkWallets(wallets2, size = REBIND_CHUNK) {
+  const out = [];
+  for (let at = 0;at < wallets2.length; at += size)
+    out.push(wallets2.slice(at, at + size));
+  return out;
+}
+async function rebindPromoted(ctx, deviceToken, toKeyPrefix, wallets2) {
+  const run = { ok: true, requests: 0, outcomes: new Map };
+  for (const wallet of wallets2)
+    run.outcomes.set(wallet.id, { state: "not-reached" });
+  const chunks = chunkWallets(wallets2);
+  for (const [at, chunk] of chunks.entries()) {
+    run.requests += 1;
+    const preview = await postRebind(ctx, deviceToken, {
+      dryRun: true,
+      toKeyPrefix,
+      wallets: chunk.map((wallet) => wallet.id)
+    });
+    if (!preview.ok) {
+      run.ok = false;
+      run.failure = { ...rebindFailureDetails(preview, {}), chunk: at + 1 };
+      return run;
+    }
+    const shown = preview.body;
+    if (run.toKey === undefined)
+      run.toKey = shown.toKey;
+    for (const row of shown.unchanged)
+      run.outcomes.set(row.id, { state: "unchanged" });
+    const moving = shown.rebound;
+    if (moving.length === 0)
+      continue;
+    run.requests += 1;
+    const committed = await postRebind(ctx, deviceToken, {
+      toKeyPrefix,
+      walletIds: moving.map((row) => row.id),
+      expect: Object.fromEntries(moving.map((row) => [row.id, row.fromKeyPrefix]))
+    });
+    if (!committed.ok) {
+      run.ok = false;
+      run.failure = {
+        ...rebindFailureDetails(committed, {
+          fromKeyPrefixes: Array.from(new Set(moving.map((row) => row.fromKeyPrefix)))
+        }),
+        chunk: at + 1
+      };
+      for (const row of moving)
+        run.outcomes.set(row.id, { state: "failed" });
+      return run;
+    }
+    const result = committed.body;
+    for (const row of result.rebound) {
+      run.outcomes.set(row.id, { state: "rebound", ...row.auditId !== undefined ? { auditId: row.auditId } : {} });
+    }
+    for (const row of result.unchanged)
+      run.outcomes.set(row.id, { state: "unchanged" });
+  }
+  return run;
+}
+function finishingCommands(addresses, toKeyPrefix) {
+  return chunkWallets(addresses).map((chunk) => `candle tee rebind ${chunk.join(" ")} --to-key ${toKeyPrefix}`);
+}
+function pendingWallets(wallets2, run) {
+  return wallets2.filter((wallet) => {
+    const state = run?.outcomes.get(wallet.id)?.state;
+    return state !== "rebound" && state !== "unchanged";
+  });
+}
+function renderRebindReport(input) {
+  const { target, wallets: wallets2, run, notRebindable } = input;
+  const lines = [];
+  const name = (wallet) => `${wallet.label} (${wallet.address})`;
+  if (run !== undefined) {
+    const rebound = wallets2.filter((wallet) => run.outcomes.get(wallet.id)?.state === "rebound").length;
+    const unchanged = wallets2.filter((wallet) => run.outcomes.get(wallet.id)?.state === "unchanged").length;
+    if (rebound > 0 || unchanged > 0) {
+      lines.push(`✓ ${rebound} wallet${rebound === 1 ? "" : "s"} moved to key ${target.keyPrefix}${unchanged > 0 ? ` (${unchanged} already there)` : ""} in ${run.requests} request${run.requests === 1 ? "" : "s"}.`);
+    }
+    if (run.failure !== undefined) {
+      lines.push(`Rebind ${run.failure.code}: ${run.failure.message}${run.failure.suggestion ? ` ${run.failure.suggestion}` : ""}`);
+    }
+  }
+  const pending = pendingWallets(wallets2, run);
+  if (pending.length > 0) {
+    lines.push(`${pending.length} promoted wallet${pending.length === 1 ? " is" : "s are"} still bound to the calling key ${input.callingKeyPrefix}, not ${target.keyPrefix}:`, ...pending.map((wallet) => `  ${name(wallet)}`), "Finish with:", ...finishingCommands(pending.map((wallet) => wallet.address), target.keyPrefix).map((command) => `  ${command}`));
+  }
+  if (notRebindable.length > 0) {
+    lines.push(`${notRebindable.length} wallet${notRebindable.length === 1 ? "" : "s"} cannot be rebound yet (only a verified-active wallet moves):`, ...notRebindable.map((wallet) => `  ${name(wallet)}: ${wallet.reason}`));
+  }
+  return lines.join(`
+`);
+}
+function walletRebindJson(wallet, run) {
+  if (wallet.id === null || wallet.remoteAuthority !== "verified-active") {
+    return {
+      state: "not-rebindable",
+      reason: wallet.id === null ? "no linked wallet id" : `remote authority is ${wallet.remoteAuthority ?? "unknown"}, not verified-active`
+    };
+  }
+  const outcome = run?.outcomes.get(wallet.id);
+  if (outcome === undefined)
+    return { state: "not-reached" };
+  return { state: outcome.state, ...outcome.auditId !== undefined ? { auditId: outcome.auditId } : {} };
+}
+function finalBoundKey(wallet, run, toKeyPrefix) {
+  const state = wallet.id === null ? undefined : run?.outcomes.get(wallet.id)?.state;
+  return state === "rebound" || state === "unchanged" ? toKeyPrefix : wallet.importedTo;
+}
+function rebindJson(input) {
+  const { target, wallets: wallets2, run } = input;
+  const pending = pendingWallets(wallets2, run);
+  const count = (state) => wallets2.filter((wallet) => run?.outcomes.get(wallet.id)?.state === state).length;
+  return {
+    toKey: {
+      keyPrefix: target.keyPrefix,
+      label: target.label,
+      tradeReady: run?.toKey?.tradeReady ?? target.tradeReady,
+      missingCaps: run?.toKey?.missingCaps ?? target.missingCaps
+    },
+    rebind: {
+      ok: run !== undefined && run.ok && input.notRebindable.length === 0,
+      reached: run !== undefined,
+      requests: run?.requests ?? 0,
+      rebound: count("rebound"),
+      unchanged: count("unchanged"),
+      pending: pending.map((wallet) => wallet.address),
+      notRebindable: input.notRebindable.length,
+      ...run?.failure !== undefined ? {
+        code: run.failure.code,
+        message: run.failure.message,
+        ...run.failure.suggestion !== undefined ? { suggestion: run.failure.suggestion } : {}
+      } : {},
+      finishWith: finishingCommands(pending.map((wallet) => wallet.address), target.keyPrefix)
+    }
+  };
+}
+
+// src/commands/vault-promote.ts
 init_signer_roles();
 init_store();
 init_vault_support();
 async function vaultPromote(args, ctx) {
   const parsed = parseArgs(args, {
-    valueFlags: ["--from", "--in-place", "--sweep-to", "--label", "--rpc-url", "--keystore"],
+    valueFlags: ["--from", "--in-place", "--sweep-to", "--label", "--rpc-url", "--keystore", "--to-key"],
     booleanFlags: ["--accept-unknown-exposure", "--accept-older-copy"],
     pathFlags: ["--keystore"]
   });
@@ -54995,21 +57389,73 @@ async function vaultPromote(args, ctx) {
     return usage(ctx, "Use either --from or --in-place, not both.");
   }
   if (fromLabel === undefined && inPlaceLabel === undefined) {
-    return usage(ctx, "Usage: candle vault promote --from <vault-key-label> | --in-place <vault-key-label> --sweep-to <label> --rpc-url <url>");
+    return usage(ctx, "Usage: candle vault promote --from <vault-key-label> | --in-place <vault-key-label> --sweep-to <label> --rpc-url <url> [--to-key <label|prefix>]");
   }
+  const toKeyRaw = parsed.values["--to-key"];
+  if (toKeyRaw !== undefined && toKeyRaw.trim().length === 0)
+    return usage(ctx, "--to-key needs a label or a prefix.");
   if (!refuseEnvPassphrase(ctx))
     return 1;
   if (!requireTty(ctx, "vault promote"))
     return 1;
-  if (fromLabel !== undefined) {
-    if (parsed.values["--sweep-to"] !== undefined) {
-      return usage(ctx, "Fresh-key promote takes --from, not --sweep-to.");
+  if (fromLabel !== undefined && parsed.values["--sweep-to"] !== undefined) {
+    return usage(ctx, "Fresh-key promote takes --from, not --sweep-to.");
+  }
+  let toKey;
+  if (toKeyRaw !== undefined) {
+    const label = parsed.values["--label"] ?? inPlaceLabel ?? (fromLabel !== undefined ? "<fresh>" : undefined);
+    const preflight = await preflightToKey(ctx, toKeyRaw, { labels: label !== undefined ? [label] : [] });
+    if (!preflight.ok)
+      return preflight.exit;
+    toKey = { target: preflight.target, deviceToken: preflight.deviceToken };
+  }
+  if (fromLabel !== undefined)
+    return promoteFresh(ctx, parsed, fromLabel, toKey);
+  return promoteInPlace(ctx, parsed, inPlaceLabel, toKey);
+}
+async function rebindAfterImport(ctx, toKey, wallet, callingKeyPrefix) {
+  const rebindable = wallet.linkedWalletId !== null && wallet.remoteAuthority === "verified-active" ? [{ id: wallet.linkedWalletId, address: wallet.address, label: wallet.label }] : [];
+  const notRebindable = rebindable.length === 0 ? [
+    {
+      address: wallet.address,
+      label: wallet.label,
+      reason: wallet.linkedWalletId === null ? "no linked wallet id" : `remote authority is ${wallet.remoteAuthority ?? "unknown"}, not verified-active`
+    }
+  ] : [];
+  const run = rebindable.length > 0 ? await rebindPromoted(ctx, toKey.deviceToken, toKey.target.keyPrefix, rebindable) : undefined;
+  const input = { target: toKey.target, callingKeyPrefix, wallets: rebindable, run, notRebindable };
+  const report = renderRebindReport(input);
+  if (report.length > 0)
+    ctx.deps.stderr.write(`${report}
+`);
+  const id = wallet.linkedWalletId;
+  return {
+    exit: run !== undefined && !run.ok ? 1 : 0,
+    json: {
+      ...rebindJson(input),
+      boundKeyPrefix: finalBoundKey({ id, importedTo: wallet.importedTo }, run, toKey.target.keyPrefix),
+      walletRebind: walletRebindJson({ id, remoteAuthority: wallet.remoteAuthority }, run)
     }
-    return promoteFresh(ctx, parsed, fromLabel);
+  };
+}
+async function confirmResumeRebind(ctx, toKey) {
+  const name = toKey.target.label !== null ? `  (${toKey.target.label})` : "";
+  ctx.deps.stderr.write(`${[
+    `This wallet will be bound to key ${toKey.target.keyPrefix}${name} by a rebind after the import.`,
+    ...targetWarnings(toKey.target)
+  ].join(`
+`)}
+`);
+  const typed = await ctx.deps.promptLine(`Type ${CONFIRM_WORD} to move this wallet to ${toKey.target.keyPrefix}: `);
+  if (typed.trim().toLowerCase() !== CONFIRM_WORD) {
+    throw new VaultError("PROMOTE_NOT_ACKNOWLEDGED", `The acknowledgement is the word ${CONFIRM_WORD}; nothing was moved, and nothing was written.`, { suggestion: `Run the command again and type ${CONFIRM_WORD} at the prompt.` });
   }
-  return promoteInPlace(ctx, parsed, inPlaceLabel);
 }
-async function promoteFresh(ctx, parsed, fromLabel) {
+async function callingKeyPrefixFor(ctx) {
+  const apiKey = await resolveApiKey(ctx.deps, ctx.profile);
+  return (apiKey !== undefined ? apiKeyPrefix(apiKey) : undefined) ?? "(the calling key)";
+}
+async function promoteFresh(ctx, parsed, fromLabel, toKey) {
   if ("error" in parsed)
     return usage(ctx, parsed.error);
   const resolvedVault = vaultPathFor(ctx, parsed);
@@ -55088,10 +57534,19 @@ async function promoteFresh(ctx, parsed, fromLabel) {
       addKeys: [blob]
     }, ctx.deps));
     await confirmLastSix(ctx, destination.address, "the sweep vault destination");
+    if (toKey !== undefined) {
+      const name = toKey.target.label !== null ? `  (${toKey.target.label})` : "";
+      ctx.deps.stderr.write(`${[
+        `This wallet will be bound to key ${toKey.target.keyPrefix}${name} by a rebind after the import.`,
+        ...targetWarnings(toKey.target)
+      ].join(`
+`)}
+`);
+    }
     const privateKey = base58.encode(secret64);
     wipe(secret64);
     const importCount = { n: 0 };
-    const { exit: code } = await runTeeImport(ctx, {
+    const { exit: code, submitted } = await runTeeImport(ctx, {
       address,
       privateKey,
       label: entry.label,
@@ -55110,22 +57565,35 @@ async function promoteFresh(ctx, parsed, fromLabel) {
     if (target === undefined) {
       throw new VaultError("VAULT_INDEX_INVALID", `Entry ${keyId} missing after import.`);
     }
+    let rebound;
+    if (toKey !== undefined) {
+      const importedTo = submitted?.boundKeyPrefix ?? null;
+      rebound = await rebindAfterImport(ctx, toKey, {
+        linkedWalletId: target.linkedWalletId ?? null,
+        address,
+        label: entry.label,
+        remoteAuthority: target.tee?.remoteAuthority ?? submitted?.remoteAuthority ?? null,
+        importedTo
+      }, await callingKeyPrefixFor(ctx));
+    }
+    const exit = Math.max(code, rebound?.exit ?? 0);
     if (ctx.json) {
       writeJson(ctx.deps, {
-        ok: true,
+        ok: rebound === undefined || rebound.exit === 0,
         mode: "fresh",
         address,
         label: entry.label,
         vaultDestination: destination.address,
         lifecycle: target.tee?.lifecycle,
         linkedWalletId: target.linkedWalletId ?? null,
-        importCalls: importCount.n
+        importCalls: importCount.n,
+        ...rebound?.json ?? {}
       });
     } else {
       ctx.deps.stdout.write(`Promoted fresh TEE wallet ${address} (sweep to ${destination.address}).
 `);
     }
-    return code;
+    return exit;
   });
 }
 async function refuseWithoutRoom(ctx) {
@@ -55147,7 +57615,7 @@ async function reopenFromDisk(path, reopen, previous) {
     });
   return reopen(path, raw);
 }
-async function promoteInPlace(ctx, parsed, subjectLabel) {
+async function promoteInPlace(ctx, parsed, subjectLabel, toKey) {
   if ("error" in parsed)
     return usage(ctx, parsed.error);
   const resolvedVault = vaultPathFor(ctx, parsed);
@@ -55174,7 +57642,9 @@ async function promoteInPlace(ctx, parsed, subjectLabel) {
       if (sweepTo !== undefined) {
         return usage(ctx, "A resume of promote takes no --sweep-to (exit 2).");
       }
-      const { exit } = await resumePromote(ctx, vault, existing, opened.reopen, path, hold, {
+      if (toKey !== undefined)
+        await confirmResumeRebind(ctx, toKey);
+      const resumed = await resumePromote(ctx, vault, existing, opened.reopen, path, hold, {
         confirmAccount: (account) => confirmLastSix(ctx, account, "that account"),
         confirmDestination: async (destination2) => {
           try {
@@ -55183,9 +57653,36 @@ async function promoteInPlace(ctx, parsed, subjectLabel) {
           } catch {
             return false;
           }
-        }
+        },
+        report: toKey !== undefined ? "return" : "write"
       });
-      return exit;
+      if (toKey === undefined)
+        return resumed.exit;
+      if (resumed.failure !== undefined || resumed.exit !== 0) {
+        writeLocalFailure(ctx.deps, resumed.failure ?? { code: "PROMOTE_OUTCOME_UNRESOLVED", message: "The resume did not complete." }, ctx.json);
+        return resumed.exit;
+      }
+      const rebound2 = await rebindAfterImport(ctx, toKey, {
+        linkedWalletId: resumed.adopted?.linkedWalletId ?? null,
+        address: existing.address,
+        label: existing.label,
+        remoteAuthority: resumed.adopted?.remoteAuthority ?? null,
+        importedTo: existing.tee?.boundKeyPrefix ?? null
+      }, await callingKeyPrefixFor(ctx));
+      if (ctx.json) {
+        writeJson(ctx.deps, {
+          ok: rebound2.exit === 0,
+          mode: "resume",
+          address: existing.address,
+          lifecycle: "enabled",
+          importCalls: 0,
+          ...rebound2.json
+        });
+      } else {
+        ctx.deps.stdout.write(`Resumed ${existing.address}: grant adopted; no re-import.
+`);
+      }
+      return rebound2.exit;
     }
     if (sweepTo === undefined || rpcUrl2 === undefined) {
       return usage(ctx, "Usage: candle vault promote --in-place <label> --sweep-to <label> --rpc-url <url> [--label] [--accept-unknown-exposure]");
@@ -55197,7 +57694,12 @@ async function promoteInPlace(ctx, parsed, subjectLabel) {
       return usage(ctx, "A resume of promote takes no --sweep-to (exit 2).");
     }
     await refuseWithoutRoom(ctx);
-    const controlledBy = await readControlledBy(ctx);
+    const live = await readControlledBy(ctx);
+    const controlledBy = toKey === undefined ? live : withToKey(live, {
+      keyPrefix: toKey.target.keyPrefix,
+      label: toKey.target.label,
+      warnings: targetWarnings(toKey.target)
+    });
     const rpc2 = createSolanaRpc(rpcUrl2, ctx.deps.fetch);
     const host = new URL(rpcUrl2).host;
     await displayHoldings(ctx, rpc2, first.subject.address);
@@ -55267,24 +57769,37 @@ async function promoteInPlace(ctx, parsed, subjectLabel) {
       writeLocalFailure(ctx.deps, failure, ctx.json);
       return code;
     }
+    let rebound;
+    if (toKey !== undefined && imported.submitted !== undefined) {
+      const importedTo = imported.submitted.boundKeyPrefix ?? null;
+      rebound = await rebindAfterImport(ctx, toKey, {
+        linkedWalletId: imported.submitted.id ?? null,
+        address: subject.address,
+        label: parsed.values["--label"] ?? subject.label,
+        remoteAuthority: imported.submitted.remoteAuthority ?? null,
+        importedTo
+      }, controlledBy.keyPrefix);
+    }
+    const exit = Math.max(code, rebound?.exit ?? 0);
     if (ctx.json) {
       const reopened = hold(await reopenFromDisk(path, opened.reopen, vault));
       const updated = reopened.index.entries.find((e) => e.id === subject.id);
       writeJson(ctx.deps, {
-        ok: code === 0 || code === 3,
+        ok: (code === 0 || code === 3) && (rebound === undefined || rebound.exit === 0),
         mode: "in-place",
         address: subject.address,
         vaultDestination: destination.address,
         lifecycle: updated?.tee?.lifecycle ?? null,
         linkedWalletId: updated?.linkedWalletId ?? null,
         controlledBy: controlledByJson(controlledBy),
-        authorities: authoritiesJson(roles)
+        authorities: authoritiesJson(roles),
+        ...rebound?.json ?? {}
       });
     } else if (code === 0 || code === 3) {
       ctx.deps.stdout.write(`Promoted ${subject.address} in place (sweep to ${destination.address}). This address never returns to cold.
 `);
     }
-    return code;
+    return exit;
   });
 }
 async function resumePromote(ctx, vault, entry, reopen, path, hold, confirmations) {
@@ -55870,12 +58385,12 @@ function parseValueUsdCell(raw) {
   const value = Number(cleaned);
   return Number.isFinite(value) ? value : undefined;
 }
-function formatUsd(value) {
+function formatUsd2(value) {
   const [whole, fraction] = value.toFixed(2).split(".");
   const grouped = (whole ?? "0").replace(/\B(?=(\d{3})+(?!\d))/g, ",");
   return `$${grouped}.${fraction ?? "00"}`;
 }
-function formatSol3(lamports) {
+function formatSol4(lamports) {
   const whole = lamports / 1000000000n;
   const fraction = lamports % 1000000000n;
   return `${whole}.${fraction.toString().padStart(9, "0").slice(0, 6)}`;
@@ -55904,14 +58419,37 @@ init_promote_support();
 init_signer_roles();
 init_store();
 init_vault_support();
-var USAGE_LINE = "Usage: candle vault promote-batch --pairs-from <file> --rpc-url <url> [--token-holdings] [--accept-unknown-exposure]";
+var USAGE_LINE = "Usage: candle vault promote-batch --pairs-from <file> --rpc-url <url> [--to-key <label|prefix>] [--token-holdings] [--accept-unknown-exposure]";
 var rowObserver = null;
+function splitRebindable(results) {
+  const wallets2 = [];
+  const notRebindable = [];
+  for (const row of results) {
+    if (row.linkedWalletId !== null && row.remoteAuthority === "verified-active") {
+      wallets2.push({ id: row.linkedWalletId, address: row.address, label: row.label });
+    } else {
+      notRebindable.push({
+        address: row.address,
+        label: row.label,
+        reason: row.linkedWalletId === null ? `no linked wallet id (${row.lifecycle})` : `remote authority is ${row.remoteAuthority ?? "unknown"}, not verified-active`
+      });
+    }
+  }
+  return { wallets: wallets2, notRebindable };
+}
+function keysWithRebind(results, phase, run) {
+  return results.map((row) => ({
+    ...row,
+    boundKeyPrefix: finalBoundKey({ id: row.linkedWalletId, importedTo: phase.importedTo.get(row.address) ?? null }, run, phase.toKey.target.keyPrefix),
+    rebind: walletRebindJson({ id: row.linkedWalletId, remoteAuthority: row.remoteAuthority }, run)
+  }));
+}
 async function vaultPromoteBatch(args, ctx) {
   if (args.some((arg) => arg === "--from" || arg.startsWith("--from="))) {
     return usage(ctx, "promote-batch promotes existing vault keys in place and takes no --from. For fresh keys: candle vault new-key --chain solana --labels-from <file>, then candle vault promote --from <label> for each.");
   }
   const parsed = parseArgs(args, {
-    valueFlags: ["--pairs-from", "--rpc-url", "--keystore"],
+    valueFlags: ["--pairs-from", "--rpc-url", "--keystore", "--to-key"],
     booleanFlags: ["--token-holdings", "--accept-unknown-exposure", "--accept-older-copy"],
     pathFlags: ["--keystore", "--pairs-from"]
   });
@@ -55922,6 +58460,9 @@ async function vaultPromoteBatch(args, ctx) {
   const pairsFile = parsed.values["--pairs-from"];
   if (pairsFile === undefined)
     return usage(ctx, USAGE_LINE);
+  const toKeyRaw = parsed.values["--to-key"];
+  if (toKeyRaw !== undefined && toKeyRaw.trim().length === 0)
+    return usage(ctx, "--to-key needs a label or a prefix.");
   if (!refuseEnvPassphrase(ctx))
     return 1;
   if (!requireTty(ctx, "vault promote-batch"))
@@ -55946,6 +58487,13 @@ async function vaultPromoteBatch(args, ctx) {
   if (!parsedFile.ok)
     return usage(ctx, renderPhaseAFindings(pairsFile, parsedFile.findings));
   const { rows, hasValueUsd } = parsedFile;
+  let toKey;
+  if (toKeyRaw !== undefined) {
+    const preflight = await preflightToKey(ctx, toKeyRaw, { labels: rows.map((row) => row.label) });
+    if (!preflight.ok)
+      return preflight.exit;
+    toKey = { target: preflight.target, deviceToken: preflight.deviceToken };
+  }
   return runVaultCommand(ctx, async ({ hold }) => {
     const raw = await requireVaultRaw(ctx, resolvedVault);
     const opened = await unlockInteractively(ctx, path, raw, {
@@ -55981,7 +58529,17 @@ async function vaultPromoteBatch(args, ctx) {
     if (roomRefusal !== null)
       throw roomRefusal;
     const room = roomRead.room;
-    const controlledBy = await readControlledBy(ctx);
+    const live = await readControlledBy(ctx);
+    const controlledBy = toKey === undefined ? live : withToKey(live, {
+      keyPrefix: toKey.target.keyPrefix,
+      label: toKey.target.label,
+      warnings: targetWarnings(toKey.target)
+    });
+    const rebindPhase = toKey === undefined ? undefined : { toKey, callingKeyPrefix: live.keyPrefix, importedTo: new Map };
+    for (const item of planned) {
+      if (item.kind === "skip")
+        rebindPhase?.importedTo.set(item.subject.address, item.subject.tee?.boundKeyPrefix ?? null);
+    }
     const addresses = planned.map((item) => item.subject.address);
     const rpc2 = createSolanaRpc(rpcUrl2, deps.fetch);
     const host = new URL(rpcUrl2).host;
@@ -56040,28 +58598,58 @@ ${footer}
       });
     }
     if (acting.length === 0) {
-      deps.stderr.write(`
+      const roles2 = {
+        checked: [...ROLE_GROUP_IDS],
+        notChecked: [],
+        found: [],
+        requests: 0,
+        planned: 0,
+        rateLimited: 0,
+        elapsedMs: 0
+      };
+      const skipped = planned.map((item) => skippedResult(item));
+      const rebindable = rebindPhase === undefined ? undefined : splitRebindable(skipped);
+      if (rebindPhase === undefined || rebindable === undefined || rebindable.wallets.length === 0) {
+        deps.stderr.write(`
 ${table}
 
 ${footer}
 Nothing to do: every row already landed.
 `);
+        return finish(ctx, {
+          file: pairsFile,
+          rows: rows.length,
+          keys: skipped,
+          destinations,
+          exit: 0,
+          controlledBy,
+          roles: roles2
+        });
+      }
+      const n = rebindable.wallets.length;
+      deps.stderr.write(`
+${table}
+
+${footer}
+Every row already landed; ${n} wallet${n === 1 ? "" : "s"} to rebind.
+`);
+      deps.stderr.write(`
+${renderControlledBy(controlledBy, n)}
+`);
+      const typed = await deps.promptLine(`Type ${CONFIRM_WORD} to move ${n === 1 ? "this wallet" : `these ${n} wallets`} to ${rebindPhase.toKey.target.keyPrefix}: `);
+      if (typed.trim().toLowerCase() !== CONFIRM_WORD) {
+        throw new VaultError("PROMOTE_NOT_ACKNOWLEDGED", `The acknowledgement is the word ${CONFIRM_WORD}; nothing was moved, and nothing was written.`, { suggestion: `Run the command again and type ${CONFIRM_WORD} at the prompt.` });
+      }
+      const rebound2 = await runRebindPhase(ctx, rebindPhase, skipped);
       return finish(ctx, {
         file: pairsFile,
         rows: rows.length,
-        keys: planned.map((item) => skippedResult(item)),
+        keys: skipped,
         destinations,
         exit: 0,
         controlledBy,
-        roles: {
-          checked: [...ROLE_GROUP_IDS],
-          notChecked: [],
-          found: [],
-          requests: 0,
-          planned: 0,
-          rateLimited: 0,
-          elapsedMs: 0
-        }
+        roles: roles2,
+        rebound: rebound2
       });
     }
     const checked = roles;
@@ -56152,6 +58740,7 @@ ${renderControlledBy(controlledBy, acting.length)}
           worst = Math.max(worst, imported.exit);
           done += 1;
           last = { address: subject2.address, keyId: subject2.id };
+          rebindPhase?.importedTo.set(subject2.address, imported.submitted.boundKeyPrefix ?? null);
           results.push({
             line: row2.line,
             label: subject2.label,
@@ -56191,6 +58780,7 @@ ${renderControlledBy(controlledBy, acting.length)}
         await rowObserver?.({ line: row.line, stage: "resumed", vault: current });
         done += 1;
         last = { address: subject.address, keyId: subject.id };
+        rebindPhase?.importedTo.set(subject.address, subject.tee?.boundKeyPrefix ?? null);
         results.push({
           line: row.line,
           label: subject.label,
@@ -56216,6 +58806,20 @@ ${renderControlledBy(controlledBy, acting.length)}
     }
     if (stopped !== undefined) {
       reportPartial(ctx, { landed: done, acting: acting.length, failure: stopped });
+      let notReached;
+      if (rebindPhase !== undefined) {
+        const { wallets: wallets2, notRebindable } = splitRebindable(results);
+        notReached = {
+          target: rebindPhase.toKey.target,
+          callingKeyPrefix: rebindPhase.callingKeyPrefix,
+          wallets: wallets2,
+          notRebindable
+        };
+        const report = renderRebindReport(notReached);
+        if (report.length > 0)
+          deps.stderr.write(`${report}
+`);
+      }
       if (ctx.json) {
         writeJson(deps, {
           ok: false,
@@ -56226,13 +58830,14 @@ ${renderControlledBy(controlledBy, acting.length)}
           resumed: results.filter((r) => r.state === "resumed").length,
           skipped: results.filter((r) => r.state === "skipped").length,
           destinations: destinations.map(({ label, address, keys }) => ({ label, address, keys })),
-          keys: results,
+          keys: rebindPhase === undefined ? results : keysWithRebind(results, rebindPhase, undefined),
           failedLine: stopped.line,
           code: stopped.code,
           message: stopped.message,
           ...stopped.suggestion !== undefined ? { suggestion: stopped.suggestion } : {},
           controlledBy: controlledByJson(controlledBy),
-          authorities: authoritiesJson(checked)
+          authorities: authoritiesJson(checked),
+          ...notReached !== undefined ? rebindJson(notReached) : {}
         });
       } else {
         deps.stderr.write(`${stopped.message}${stopped.suggestion ? ` ${stopped.suggestion}` : ""}
@@ -56242,6 +58847,7 @@ ${renderControlledBy(controlledBy, acting.length)}
     }
     if (last !== undefined)
       await verifyWritten(path, last.address, last.keyId, opened.reopen, ctx);
+    const rebound = rebindPhase === undefined ? undefined : await runRebindPhase(ctx, rebindPhase, results);
     return finish(ctx, {
       file: pairsFile,
       rows: rows.length,
@@ -56249,10 +58855,27 @@ ${renderControlledBy(controlledBy, acting.length)}
       destinations,
       exit: worst,
       controlledBy,
-      roles: checked
+      roles: checked,
+      ...rebound !== undefined ? { rebound } : {}
     });
   });
 }
+async function runRebindPhase(ctx, phase, results) {
+  const { wallets: wallets2, notRebindable } = splitRebindable(results);
+  const run = wallets2.length > 0 ? await rebindPromoted(ctx, phase.toKey.deviceToken, phase.toKey.target.keyPrefix, wallets2) : undefined;
+  const input = {
+    target: phase.toKey.target,
+    callingKeyPrefix: phase.callingKeyPrefix,
+    wallets: wallets2,
+    run,
+    notRebindable
+  };
+  const report = renderRebindReport(input);
+  if (report.length > 0)
+    ctx.deps.stderr.write(`${report}
+`);
+  return { phase, run, input };
+}
 async function verifySubjectSecret(vault, subject) {
   const secret = await decryptKey(vault, subject.id);
   try {
@@ -56375,7 +58998,7 @@ function renderBatchTable(planned, opts) {
     const authority = item.kind === "skip" ? "" : opts.roles === undefined ? "?" : authorityCell(address, opts.roles);
     const cells = [String(item.row.line), state, item.subject.label, address, destination, authority];
     const lamports = opts.lamports?.get(address);
-    cells.push(lamports === undefined ? "unread" : formatSol3(lamports));
+    cells.push(lamports === undefined ? "unread" : formatSol4(lamports));
     if (opts.tokenCounts !== undefined)
       cells.push(String(opts.tokenCounts.get(address) ?? 0));
     if (opts.hasValueUsd)
@@ -56414,7 +59037,7 @@ function renderFooter(opts) {
       else
         total += value;
     }
-    lines.push(`value_usd totals your file's own column; this CLI reads no price. Total for the ${opts.acting.length} rows this run will act on: ${formatUsd(total)}${excluded > 0 ? ` (${excluded} row${excluded === 1 ? "" : "s"} excluded: the cell did not parse)` : ""}`);
+    lines.push(`value_usd totals your file's own column; this CLI reads no price. Total for the ${opts.acting.length} rows this run will act on: ${formatUsd2(total)}${excluded > 0 ? ` (${excluded} row${excluded === 1 ? "" : "s"} excluded: the cell did not parse)` : ""}`);
   }
   const accepted = opts.acting.filter((item) => item.kind === "promote" && item.acceptedUnknown);
   if (accepted.length > 0) {
@@ -56439,10 +59062,12 @@ function finish(ctx, opts) {
   const resumed = opts.keys.filter((r) => r.state === "resumed").length;
   const skipped = opts.keys.filter((r) => r.state === "skipped").length;
   const unverified = opts.keys.filter((r) => r.state !== "skipped" && r.remoteAuthority !== "verified-active");
-  const complete = opts.exit === 0;
+  const rebindFailed = opts.rebound?.run !== undefined && !opts.rebound.run.ok;
+  const exit = rebindFailed ? Math.max(opts.exit, 1) : opts.exit;
+  const complete = exit === 0;
   if (ctx.json) {
     writeJson(ctx.deps, {
-      ok: true,
+      ok: !rebindFailed,
       complete,
       file: opts.file,
       rows: opts.rows,
@@ -56450,11 +59075,12 @@ function finish(ctx, opts) {
       resumed,
       skipped,
       destinations: opts.destinations.map(({ label, address, keys }) => ({ label, address, keys })),
-      keys: opts.keys,
+      keys: opts.rebound === undefined ? opts.keys : keysWithRebind(opts.keys, opts.rebound.phase, opts.rebound.run),
       controlledBy: controlledByJson(opts.controlledBy),
-      authorities: authoritiesJson(opts.roles)
+      authorities: authoritiesJson(opts.roles),
+      ...opts.rebound !== undefined ? rebindJson(opts.rebound.input) : {}
     });
-    return opts.exit;
+    return exit;
   }
   const parts = [];
   if (promoted > 0)
@@ -56465,11 +59091,19 @@ function finish(ctx, opts) {
     parts.push(`${skipped} already promoted (skipped)`);
   ctx.deps.stdout.write(`${parts.join("; ")}.
 `);
-  if (!complete) {
+  if (unverified.length > 0) {
     ctx.deps.stdout.write(`${unverified.length} import${unverified.length === 1 ? "" : "s"} did not report verified-active: ${unverified.map((r) => r.address).join(", ")}
 `);
   }
-  return opts.exit;
+  if (opts.rebound !== undefined) {
+    const { input, run } = opts.rebound;
+    const moved = input.wallets.filter((w) => run?.outcomes.get(w.id)?.state === "rebound").length;
+    const already = input.wallets.filter((w) => run?.outcomes.get(w.id)?.state === "unchanged").length;
+    const pending = input.wallets.length - moved - already;
+    ctx.deps.stdout.write(`${moved + already} of ${input.wallets.length + input.notRebindable.length} wallets bound to ${input.target.keyPrefix}${pending > 0 ? `; ${pending} still on ${input.callingKeyPrefix}` : ""}${input.notRebindable.length > 0 ? `; ${input.notRebindable.length} not yet rebindable` : ""}.
+`);
+  }
+  return exit;
 }
 
 // src/commands/vault-rename.ts
@@ -57555,8 +60189,78 @@ function describeEnvelope(envelope, facts) {
 
 // src/commands/vault-transfer.ts
 init_args();
+init_deps();
 init_promote_support();
 init_store();
+
+// src/vault/tee-transfer.ts
+init_errors();
+function assertNoPendingSweep(entry) {
+  const pending = entry.tee?.sweepPending?.length ?? 0;
+  if (pending === 0)
+    return;
+  throw new VaultError("TRANSFER_SWEEP_PENDING", `${entry.label} (${entry.address}) has ${pending} pending sweep transaction(s); a transfer would interleave with that sweep.`, { suggestion: `Finish the sweep first: candle tee sweep ${entry.address} --rpc-url <url>` });
+}
+async function readTeeServerState(ctx, entry, apiKey) {
+  if (entry.linkedWalletId === undefined) {
+    return { read: false, reason: "this wallet has no linked wallet id recorded" };
+  }
+  if (apiKey === undefined)
+    return { read: false, reason: "no API key for this profile" };
+  try {
+    const result = await apiRequest(`/api/v1/agent/wallets/${encodeURIComponent(entry.linkedWalletId)}/lifecycle`, {
+      auth: "key",
+      credentials: { apiKey },
+      apiUrl: ctx.apiUrl,
+      fetch: ctx.deps.fetch,
+      env: ctx.deps.env
+    });
+    if (!result.ok)
+      return { read: false, reason: result.message };
+    const state = result.body.state;
+    if (typeof state !== "string")
+      return { read: false, reason: "the lifecycle response carried no state" };
+    return { read: true, state };
+  } catch (error) {
+    return { read: false, reason: error instanceof Error ? error.message : String(error) };
+  }
+}
+function serverStateNotice(state) {
+  if (!state.read) {
+    return `Could not read this wallet's Candle state (${state.reason}); proceeding. An agent may be trading it.`;
+  }
+  if (state.state === "enabled") {
+    return "Warning: this wallet is enabled, so an agent may be trading it now; a trade may fail if this transfer leaves too little.";
+  }
+  return;
+}
+async function reportTransferActivity(ctx, apiKey, signature) {
+  const unseen = "Candle's history will not show this transfer.";
+  if (apiKey === undefined)
+    return { outcome: "no-api-key", line: `No API key for this profile, so ${unseen}` };
+  try {
+    const result = await apiRequest("/api/v1/activity/report", {
+      method: "POST",
+      body: { chain: "solana", signature },
+      auth: "key",
+      credentials: { apiKey },
+      apiUrl: ctx.apiUrl,
+      fetch: ctx.deps.fetch,
+      env: ctx.deps.env
+    });
+    if (result.ok)
+      return { outcome: "reported", line: "Reported to Candle's history." };
+    if (result.code === "SCOPE_MISSING") {
+      return { outcome: "scope-missing", line: `This profile's API key lacks activity:write, so ${unseen}` };
+    }
+    return { outcome: "failed", line: `Could not report this transfer (${result.message}); ${unseen}` };
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    return { outcome: "failed", line: `Could not report this transfer (${reason}); ${unseen}` };
+  }
+}
+
+// src/commands/vault-transfer.ts
 init_vault_support();
 async function vaultTransfer(args, ctx) {
   const parsed = parseArgs(args, {
@@ -57597,11 +60301,17 @@ async function vaultTransfer(args, ctx) {
       promptText: "Vault passphrase (input hidden): "
     });
     const vault = hold(opened.vault);
-    const fromEntry = findVaultRoleEntry(vault.index, fromLabel);
+    const fromEntry = findTransferSource(vault.index, fromLabel);
     if (fromEntry === undefined) {
-      return usage(ctx, `No vault key matches --from ${fromLabel}.`);
+      return usage(ctx, `No vault key or promoted wallet matches --from ${fromLabel}.`);
     }
-    assertVaultSigner(fromEntry);
+    assertTransferSigner(fromEntry);
+    const promoted = fromEntry.role === "tee-wallet";
+    if (promoted)
+      assertNoPendingSweep(fromEntry);
+    const note = (line) => (ctx.json ? ctx.deps.stderr : ctx.deps.stdout).write(`${line}
+`);
+    const apiKey = promoted ? await resolveApiKey(ctx.deps, ctx.profile) : undefined;
     const reconciled = await reconcileFundingReceipts(vault, [fromEntry.address, to], rpcUrl2, ctx);
     if (reconciled !== null)
       return reconciled;
@@ -57615,11 +60325,25 @@ async function vaultTransfer(args, ctx) {
     });
     const feeQuote = await quoteTransferFee(rpcUrl2, ctx.deps.fetch, plan.from, plan.instructions);
     displayTransferPlan(ctx, plan, feeQuote);
+    if (promoted) {
+      const notice = serverStateNotice(await readTeeServerState(ctx, fromEntry, apiKey));
+      if (notice !== undefined)
+        note(notice);
+    }
     await confirmLastSix(ctx, to, "the destination");
     await opened.confirm(`sign transfer of ${plan.amount} ${plan.asset} to ${to}`);
     const secret = await decryptKey(vault, fromEntry.id);
     try {
       const result = await signAndBroadcastTransfer({ ctx, rpcUrl: rpcUrl2, secret64: secret, plan });
+      let activityReport;
+      if (promoted && result.finalized) {
+        const report = await reportTransferActivity(ctx, apiKey, result.signature);
+        activityReport = report.outcome;
+        note(report.line);
+      } else if (promoted) {
+        activityReport = "not-finalized";
+        note("Not reported to Candle's history: finality is not yet confirmed.");
+      }
       if (ctx.json) {
         writeJson(ctx.deps, {
           ok: result.finalized,
@@ -57629,7 +60353,8 @@ async function vaultTransfer(args, ctx) {
           amount: plan.amount,
           asset: plan.asset,
           amountRaw: plan.amountRaw.toString(),
-          finalized: result.finalized
+          finalized: result.finalized,
+          ...activityReport !== undefined ? { activityReport } : {}
         });
       } else {
         ctx.deps.stdout.write(result.finalized ? `Transferred ${plan.amount} ${plan.asset} to ${to}: ${result.signature}
@@ -57648,7 +60373,7 @@ init_args();
 init_release();
 import { dirname as dirname10, join as join11 } from "node:path";
 init_render();
-var USAGE2 = "Usage: candle verify <file> --bundle <path> [--identity <uri>] [--issuer <url>]";
+var USAGE3 = "Usage: candle verify <file> --bundle <path> [--identity <uri>] [--issuer <url>]";
 async function resolveIdentity(deps, bundlePath, flag) {
   if (flag)
     return { kind: "ok", uri: flag, provenance: "identity from --identity" };
@@ -57680,19 +60405,19 @@ async function verify(args, ctx) {
   });
   if ("error" in parsed) {
     writeUsageFailure(deps, `${parsed.error}
-${USAGE2}`, json);
+${USAGE3}`, json);
     return 2;
   }
   const file = parsed.positionals[0];
   if (parsed.positionals.length !== 1 || file === undefined) {
     writeUsageFailure(deps, `verify takes exactly one file.
-${USAGE2}`, json);
+${USAGE3}`, json);
     return 2;
   }
   const bundlePath = parsed.values["--bundle"];
   if (!bundlePath) {
     writeUsageFailure(deps, `--bundle is required.
-${USAGE2}`, json);
+${USAGE3}`, json);
     return 2;
   }
   const resolved = await resolveIdentity(deps, bundlePath, parsed.values["--identity"]);
@@ -57706,7 +60431,7 @@ ${USAGE2}`, json);
   }
   if (resolved.kind === "absent") {
     writeUsageFailure(deps, `--identity is required: there is no latest.json beside ${bundlePath} to take the release version from.
-${USAGE2}`, json);
+${USAGE3}`, json);
     return 2;
   }
   const identity = resolved.uri;
@@ -57747,6 +60472,177 @@ function messageOf2(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
+// src/commands/wallets-trust.ts
+init_args();
+init_deps();
+init_profiles();
+init_render();
+init_promote_support();
+var TRUST_PATH = "/api/v1/agent/linked-wallets/trust";
+var USAGE_TRUST = "Usage: candle wallets trust <label|address|id|prefix*>... [--json]";
+var USAGE_UNTRUST = "Usage: candle wallets untrust <label|address|id|prefix*>... [--yes] [--json]";
+var DEVICE_TOKEN_REQUIRED2 = {
+  code: "DEVICE_TOKEN_REQUIRED",
+  message: "Marking a wallet trusted needs the device token, the owner's credential; an API key cannot do it.",
+  suggestion: "Run: candle auth login"
+};
+function sessionLinkedLine(rows) {
+  const n = rows.length;
+  const it = n === 1 ? "it" : "them";
+  const names = rows.map((row) => row.label ?? row.address).join(", ");
+  return `${n} linked while signed in (${names}): always yours while linked. Revoke ${it} to remove ${it}.`;
+}
+function nothingToChangeLine(shown, trusted) {
+  const session = shown.sessionLinked ?? [];
+  const unchanged = shown.unchanged;
+  if (session.length > 0 && unchanged.length === 0) {
+    const one = session.length === 1;
+    return `Nothing to change: ${one ? "that wallet is" : `those ${session.length} wallets are`} always yours while linked. Revoke ${one ? "it" : "them"} to remove ${one ? "it" : "them"}.
+`;
+  }
+  const bits = [];
+  if (session.length > 0)
+    bits.push(sessionLinkedLine(session).replace(/\.$/, ""));
+  if (unchanged.length > 0) {
+    bits.push(unchanged.length === 1 ? `that wallet is already ${trusted ? "trusted" : "untrusted"}` : `all ${unchanged.length} wallets are already ${trusted ? "trusted" : "untrusted"}`);
+  }
+  if (bits.length === 0)
+    return `Nothing to change.
+`;
+  return `Nothing to change: ${bits.join("; ")}.
+`;
+}
+function writeTrustFailure(ctx, result) {
+  const { deps, apiUrl, json } = ctx;
+  let code = result.code;
+  let message = result.message;
+  let suggestion;
+  if (result.status === 404) {
+    code = "TRUST_UNSUPPORTED";
+    message = "This Candle API does not support trusting wallets yet; nothing changed.";
+  } else {
+    const error = result.raw?.error;
+    if (error?.reason === "ambiguous" && Array.isArray(error.matches)) {
+      const ids = error.matches.map((m) => String(m.id)).join(", ");
+      suggestion = `Name one of them by id or address: ${ids}`;
+    } else if (error?.reason === "not_found") {
+      suggestion = "Run: candle wallets, to see this account's linked wallets and their labels.";
+    }
+  }
+  const envelope = errorEnvelope({ ...result, code, message }, { apiUrl, authType: "device" });
+  if (json) {
+    deps.stdout.write(`${JSON.stringify({ ...envelope, ...suggestion ? { suggestion } : {} })}
+`);
+  } else {
+    deps.stderr.write(`${code ?? `HTTP ${result.status}`}: ${message}${suggestion ? ` ${suggestion}` : ""}
+`);
+  }
+  return 1;
+}
+function trustTable(rows) {
+  return renderTable(["line", "label", "wallet", "address"], rows.map((row, i) => [String(i + 1), row.label ?? "-", row.chain, row.address]));
+}
+async function setTrust(args, ctx, trusted) {
+  const { deps, apiUrl, json } = ctx;
+  const usage5 = trusted ? USAGE_TRUST : USAGE_UNTRUST;
+  const command = trusted ? "wallets trust" : "wallets untrust";
+  const parsed = parseArgs(args, trusted ? {} : { booleanFlags: ["--yes"] });
+  if ("error" in parsed) {
+    writeUsageFailure(deps, parsed.error, json);
+    return 2;
+  }
+  if (parsed.positionals.length === 0) {
+    writeUsageFailure(deps, `Name at least one wallet. ${usage5}`, json);
+    return 2;
+  }
+  const skipConfirm = !trusted && parsed.booleans.has("--yes");
+  await printIdentity(ctx);
+  const deviceToken = await resolveDeviceToken(deps, ctx.profile);
+  if (!deviceToken) {
+    writeLocalFailure(deps, DEVICE_TOKEN_REQUIRED2, json);
+    return 1;
+  }
+  if (!skipConfirm && (!deps.isTTY.stdin || !deps.isTTY.stdout)) {
+    writeLocalFailure(deps, {
+      code: "TRUST_REQUIRES_TTY",
+      message: `candle ${command} needs a terminal: the acknowledgement is typed, and nothing else supplies it.`,
+      suggestion: trusted ? "Run it in an interactive shell; there is no flag and no environment variable for confirm." : "Run it in an interactive shell, or pass --yes to untrust without the prompt."
+    }, json);
+    return 1;
+  }
+  const call = (body) => apiRequest(TRUST_PATH, {
+    method: "POST",
+    body,
+    auth: "device",
+    credentials: { deviceToken },
+    apiUrl,
+    fetch: deps.fetch,
+    env: deps.env
+  });
+  const preview = await call({ dryRun: true, wallets: parsed.positionals, trusted });
+  if (!preview.ok)
+    return writeTrustFailure(ctx, preview);
+  const shown = preview.body;
+  const changing = shown.changed;
+  if (changing.length === 0) {
+    if (json) {
+      deps.stdout.write(`${JSON.stringify({ ...shown, command })}
+`);
+    } else {
+      deps.stdout.write(nothingToChangeLine(shown, trusted));
+    }
+    return 0;
+  }
+  const n = changing.length;
+  const screen = [
+    trustTable(changing),
+    ...shown.unchanged.length > 0 ? [
+      `${shown.unchanged.length} already ${trusted ? "trusted" : "untrusted"}: ${shown.unchanged.map((row) => row.label ?? row.address).join(", ")}`
+    ] : [],
+    ...(shown.sessionLinked?.length ?? 0) > 0 ? [sessionLinkedLine(shown.sessionLinked ?? [])] : [],
+    "",
+    trusted ? `${n === 1 ? "This wallet" : `These ${n} wallets`} will be trusted: your agents can move funds into ${n === 1 ? "it" : "them"} with no cap, like a wallet you linked while signed in.` : `${n === 1 ? "This wallet" : `These ${n} wallets`} will no longer be trusted: moving funds into ${n === 1 ? "it" : "them"} will need the withdrawal allowlist again.`,
+    ""
+  ];
+  deps.stderr.write(`${screen.join(`
+`)}
+`);
+  if (!skipConfirm) {
+    const typed = await deps.promptLine(`Type ${CONFIRM_WORD} to ${trusted ? "trust" : "untrust"} ${n === 1 ? "this wallet" : `these ${n} wallets`}: `);
+    if (typed.trim().toLowerCase() !== CONFIRM_WORD) {
+      writeLocalFailure(deps, {
+        code: "TRUST_NOT_ACKNOWLEDGED",
+        message: `The acknowledgement is the word ${CONFIRM_WORD}; nothing changed.`,
+        suggestion: `Run the command again and type ${CONFIRM_WORD} at the prompt.`
+      }, json);
+      return 1;
+    }
+  }
+  const committed = await call({ walletIds: changing.map((row) => row.id), trusted });
+  if (!committed.ok)
+    return writeTrustFailure(ctx, committed);
+  const result = committed.body;
+  if (json) {
+    deps.stdout.write(`${JSON.stringify({ ...result, command })}
+`);
+    return result.skipped.length > 0 ? 1 : 0;
+  }
+  const done = result.changed.length;
+  deps.stdout.write(`${trusted ? "Trusted" : "Untrusted"} ${done} wallet${done === 1 ? "" : "s"}.
+`);
+  for (const skip of result.skipped) {
+    deps.stderr.write(`Skipped ${skip.walletId}: ${skip.reason === "revoked" ? "revoked" : "not on this account"}.
+`);
+  }
+  return result.skipped.length > 0 ? 1 : 0;
+}
+function walletsTrust(args, ctx) {
+  return setTrust(args, ctx, true);
+}
+function walletsUntrust(args, ctx) {
+  return setTrust(args, ctx, false);
+}
+
 // src/config.ts
 import { chmod as chmod7, mkdir as mkdir7, readFile as readFile7, rm as rm4, writeFile as writeFile6 } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
@@ -58062,11 +60958,15 @@ function extractGlobalFlags(argv) {
 }
 var COMMANDS = {
   swap: { bare: swap, subcommands: { status: swapStatus } },
+  transfer: { bare: transfer },
   launch: { bare: launch },
+  pnl: { bare: pnl },
+  portfolio: { bare: portfolio },
+  lp: { subcommands: { pools: lpPools, add: lpAdd, positions: lpPositions, remove: lpRemove, claim: lpClaim } },
   auth: { subcommands: { login: authLogin, status: authStatus, logout: authLogout } },
   keys: { subcommands: { list: keysList, create: keysCreate, revoke: keysRevoke, wallets: keysWallets } },
   wallets: {
-    subcommands: { import: walletsImport, revoke: walletsRevoke },
+    subcommands: { import: walletsImport, revoke: walletsRevoke, trust: walletsTrust, untrust: walletsUntrust },
     bare: wallets
   },
   vault: {