@candledottv/cli 0.11.7 → 0.11.8

package/README.md

@@ -55,8 +55,8 @@ node packages/cli/dist/index.js auth login
 | `candle auth login [--profile <name>] [--scopes <a,b,c>] [--label <name>] [--no-browser]` | Authorizes this device: prints a code, opens (or prints) an approval URL, polls until approved, then stores the resulting device token and API key. `--label` names both the device and the key. |
 | `candle auth status` | Shows which storage backend is in use, both credential prefixes, the config file path, and a live validity check for each credential. |
 | `candle auth logout [--keep-key]` | Revokes the stored API key (skipped with `--keep-key`), clears local credentials and config, and prints the portal URL for revoking the device itself. |
-| `candle keys list [--scopes]` | Lists this account's API keys: prefix, name, Read or Read:Write access, environment, timestamps, and which device minted each one. `--scopes` adds the raw scopes, sorted. |
-| `candle keys create [--scopes <a,b,c>] [--label <name>] [--expires-in <days>] [--tx-limit <usd> [--reset daily\|weekly\|monthly\|never]]` | Creates a new API key and prints the plaintext exactly once, with the same optional name, expiration, and USD transaction limit the portal's create form takes. Stored locally only if the CLI does not already hold a working key. |
+| `candle keys list [--scopes]` | Lists this account's API keys: prefix, name, Read, Read:Write or Read:Write:Transfer access, environment, timestamps, and which device minted each one. `--scopes` adds the raw scopes, sorted. |
+| `candle keys create [--access read\|read-write\|read-write-transfer \| --scopes <a,b,c>] [--label <name>] [--expires-in <days>] [--tx-limit <usd> [--reset daily\|weekly\|monthly\|never]]` | Creates a new API key and prints the plaintext exactly once, with the same optional name, expiration, and USD transaction limit the portal's create form takes. `--access` mints one of the portal's three levels (`read-write-transfer` is Read:Write plus `transfer:bound`: the key can move funds out of the wallet it runs, to wallets you linked while signed in or marked trusted and to that wallet's vault); `--scopes` names raw scopes instead, never both. Stored locally only if the CLI does not already hold a working key. |
 | `candle keys revoke <prefix>` | Revokes an API key by prefix. Revoking the CLI's own stored key also clears it locally. |
 | `candle wallets` | Shows the account's embedded (launch) wallets and any linked wallets, using the API key, with a `Signer` column saying whether this machine holds each linked wallet's signing key. |
 | `candle vault init\|status\|new-key\|phrase show\|restore` | The encrypted local vault, `vault.enc`. `init` creates it with a passphrase factor and a 24-word recovery phrase, `new-key` derives a key inside it, `phrase show` displays the phrase on a terminal (never in `--json`, a log or a pipe), and `restore --phrase` rebuilds the derived keys on another machine (`--count`, `--tee-count`, `--external-count`, or a gap scan with `--rpc-url`). No key ever leaves the vault to reach Candle. See [The vault](https://docs.candle.tv/developers/cli#the-vault). |
@@ -70,6 +70,7 @@ node packages/cli/dist/index.js auth login
 | `candle tee new\|enable\|fund\|status\|disable\|sweep` | A dedicated, capped TEE wallet for one agent: the CLI generates the key and seals it locally in `tee-wallets.enc`, `enable` delegates it to this profile's API key with a pinned sweep vault, `fund` prints what your vault signs, and `disable` then `sweep` stop the agent and move everything back to the vault, signed locally. Solana only. See [TEE wallets](https://docs.candle.tv/developers/cli#tee-wallets). |
 | `candle swap <from> <to> --amount <n>\|--percent <n> --wallet <tee>` | Quote, confirm and swap on Solana through the TEE wallet's bound key; first buy after a launch is this command. |
 | `candle swap status <id> [--kind trade\|swap\|launch]` | Read an operation without resending it. |
+| `candle transfer --to <address\|wallet name\|vault> --asset <SOL\|USDC\|CNDL>\|--mint <mint> --amount <decimal\|max> [--wallet <tee>] [--yes]` | Move funds out of a TEE wallet through its bound Read:Write:Transfer key, to the wallet's own pinned vault (`--to vault`, any token, `max` allowed) or to another of the account's wallets you linked while signed in or marked trusted (base assets, counted against the key's caps). The destination and its kind are shown before you confirm; Candle builds, the relay signs, Candle broadcasts. |
 | `candle launch --name <name> --symbol <symbol> --image-url <url> --wallet <tee>` | Create a Solana token with no first buy; needs `launch:write` and operator-enabled `allowLaunch`. |
 | `candle pnl [--profile <name>]` | P&L: realized net, fees, unrealized and total, then open positions. Without `--profile`, the account's books (every profile, the web app and the CLI, one ledger; needs the Read scope). With `--profile <name>`, that profile's key's own P&L. Unpriced positions are never valued at zero. Where Candle serves LP, DAMM v2 positions are included: realized (withdrawals against the cost basis at the add, plus claimed fees), unrealized (open positions at their share of the pool plus unclaimed fees, against that basis) and vs holding (what the deposited tokens would be worth held), with the total covering tokens and LP. |
 | `candle portfolio [--rpc-url <url>]` | Vault, TEE and embedded wallets in one table with amount, price, value and a total. Vault and external balances are read over your own RPC; Candle is sent only the mints, for prices. Where Candle serves LP, each TEE wallet's DAMM v2 positions follow the tokens, valued by Candle at the same marks, and count in the total; one whose pool could not be read is shown as not read and the total says it is partial. |

package/dist/index.js

@@ -278,6 +278,16 @@ var init_args = __esm(() => {
 });
 
 // src/agent-key-access.ts
+function scopesForPreset(preset) {
+  switch (preset) {
+    case "read":
+      return [...READ_SCOPES];
+    case "readwrite":
+      return [...READWRITE_SCOPES];
+    case "readwritetransfer":
+      return [...READWRITETRANSFER_SCOPES];
+  }
+}
 function sameSet(scopes, preset) {
   const held = new Set(scopes);
   return held.size === preset.length && preset.every((scope) => held.has(scope));
@@ -287,6 +297,8 @@ function presetForScopes(scopes) {
     return "read";
   if (sameSet(scopes, READWRITE_SCOPES))
     return "readwrite";
+  if (sameSet(scopes, READWRITETRANSFER_SCOPES))
+    return "readwritetransfer";
   return null;
 }
 function agentKeyCapabilities(scopes) {
@@ -295,6 +307,7 @@ function agentKeyCapabilities(scopes) {
     launch: scopes.includes("launch:write"),
     trade: scopes.includes("swap:write"),
     transfer: scopes.includes("transfer:write"),
+    linkedTransfer: scopes.includes("transfer:bound"),
     report: scopes.includes("activity:write")
   };
 }
@@ -308,7 +321,7 @@ function agentKeyAccess(scopes) {
 function sortAgentKeyScopes(scopes) {
   return [...scopes].sort();
 }
-var READ_SCOPES, READWRITE_SCOPES, AGENT_KEY_PRESET_LABELS, AGENT_KEY_CAPABILITY_CHIPS;
+var READ_SCOPES, READWRITE_SCOPES, READWRITETRANSFER_SCOPES, AGENT_KEY_PRESET_LABELS, AGENT_KEY_CAPABILITY_CHIPS;
 var init_agent_key_access = __esm(() => {
   READ_SCOPES = ["account:read"];
   READWRITE_SCOPES = [
@@ -319,18 +332,32 @@ var init_agent_key_access = __esm(() => {
     "transfer:write",
     "account:read"
   ];
-  AGENT_KEY_PRESET_LABELS = { read: "Read", readwrite: "Read:Write" };
+  READWRITETRANSFER_SCOPES = [
+    "launch:write",
+    "launch:read",
+    "activity:write",
+    "swap:write",
+    "transfer:write",
+    "account:read",
+    "transfer:bound"
+  ];
+  AGENT_KEY_PRESET_LABELS = {
+    read: "Read",
+    readwrite: "Read:Write",
+    readwritetransfer: "Read:Write:Transfer"
+  };
   AGENT_KEY_CAPABILITY_CHIPS = [
     ["Launch", "launch"],
     ["Trade", "trade"],
     ["Transfer", "transfer"],
+    ["Linked transfer", "linkedTransfer"],
     ["Report", "report"]
   ];
 });
 
 // src/render.ts
 function formatScopesForSummary(scopes) {
-  return sortAgentKeyScopes(scopes).map((scope) => scope === "swap:write" ? `${scope} (${SWAP_WRITE_NOTE})` : scope === "transfer:write" ? `${scope} (${TRANSFER_WRITE_NOTE})` : scope).join(", ");
+  return sortAgentKeyScopes(scopes).map((scope) => scope === "swap:write" ? `${scope} (${SWAP_WRITE_NOTE})` : scope === "transfer:write" ? `${scope} (${TRANSFER_WRITE_NOTE})` : scope === "transfer:bound" ? `${scope} (${TRANSFER_BOUND_NOTE})` : scope).join(", ");
 }
 function terminalText(value) {
   return value.replace(/[\u0000-\u001f\u007f-\u009f]/g, "");
@@ -436,7 +463,7 @@ function portalDeviceUrl(apiUrl, portalOrigin) {
     return `${apiUrl}/agents`;
   }
 }
-var ALL_AGENT_SCOPES, DEFAULT_AGENT_SCOPES, SWAP_WRITE_NOTE = "moves funds -- this key can execute swaps on your behalf", TRANSFER_WRITE_NOTE = "moves funds -- this key can transfer assets between your wallets";
+var ALL_AGENT_SCOPES, DEFAULT_AGENT_SCOPES, SWAP_WRITE_NOTE = "moves funds -- this key can execute swaps on your behalf", TRANSFER_WRITE_NOTE = "moves funds -- this key can transfer assets between your wallets", TRANSFER_BOUND_NOTE = "moves funds -- this key can move funds out of the wallet it runs, to your linked wallets and its vault";
 var init_render = __esm(() => {
   init_agent_key_access();
   ALL_AGENT_SCOPES = [
@@ -445,9 +472,10 @@ var init_render = __esm(() => {
     "account:read",
     "activity:write",
     "swap:write",
-    "transfer:write"
+    "transfer:write",
+    "transfer:bound"
   ];
-  DEFAULT_AGENT_SCOPES = ALL_AGENT_SCOPES.filter((scope) => scope !== "swap:write" && scope !== "transfer:write");
+  DEFAULT_AGENT_SCOPES = ALL_AGENT_SCOPES.filter((scope) => scope !== "swap:write" && scope !== "transfer:write" && scope !== "transfer:bound");
 });
 
 // src/profiles.ts
@@ -2164,6 +2192,9 @@ function libraryInstallInstruction(platform) {
 }
 
 // src/fido2-helper/protocol.ts
+function excludeCapacity(device) {
+  return device.maxCredentialCountInList ?? 1;
+}
 var HELPER_PROTOCOL = 1, RP_ID = "cli.candle.tv", PROBE_MAX_CREDENTIALS = 16, AUTHDATA_FLAG_UP = 1, AUTHDATA_FLAG_UV = 4, AUTHDATA_MIN_LENGTH = 37;
 var init_protocol = () => {};
 
@@ -3144,7 +3175,8 @@ var init_errors = __esm(() => {
     "TIER_REQUIRED",
     "LINKED_WALLET_ROOM_UNREADABLE",
     "PROMOTE_ACCOUNT_UNRESOLVED",
-    "TRANSFER_SWEEP_PENDING"
+    "TRANSFER_SWEEP_PENDING",
+    "VAULT_KEY_ALREADY_ENROLLED"
   ];
   VaultError = class VaultError extends Error {
     code;
@@ -5957,6 +5989,9 @@ function translateHelperFailure(code, message, platform) {
     LIBRARY_MISSING: "VAULT_HELPER_MISSING"
   };
   const suggestion = "Nothing was derived and no other factor was tried.";
+  if (code === "CREDENTIAL_EXCLUDED") {
+    return new VaultError("VAULT_KEY_ALREADY_ENROLLED", `This security key already holds one of this vault's credentials, so enrolling it again would not add a second key (${message}). Nothing was written.`, { suggestion: ALREADY_ENROLLED_SUGGESTION });
+  }
   if (code === "DEVICE_NOT_READABLE") {
     return new VaultError("VAULT_AUTHENTICATOR_NOT_READABLE", platform === "linux" ? HIDRAW_MESSAGE : `A security key is attached but this user cannot open it: ${message}.`, { suggestion: "No other factor is substituted." });
   }
@@ -6017,6 +6052,51 @@ async function callHelper(deps, helperPath, request) {
     throw translateHelperFailure(String(response.code), String(response.message), deps.platform);
   return response;
 }
+function alreadyEnrolled(device, envelopeId) {
+  const product = device.product || "This security key";
+  return new VaultError("VAULT_KEY_ALREADY_ENROLLED", `${product} (--device ${device.deviceId}) already holds this vault's security key credential${envelopeId !== undefined ? ` for envelope ${envelopeId}` : ""}, so enrolling it again would not add a second key. Nothing was written.`, {
+    suggestion: ALREADY_ENROLLED_SUGGESTION,
+    ...envelopeId !== undefined ? { details: { envelopeId } } : {}
+  });
+}
+function helperPredatesExcludeList(helperPath, leftover) {
+  return new VaultError("VAULT_HELPER_MISSING", `The security key helper at ${helperPath} predates the exclude list this command needs; reinstall the CLI so candle and candle-fido2 come from the same release.`, {
+    suggestion: leftover ? "Nothing was written to the vault. The credential now on the authenticator can be removed with its vendor's tool. Reinstall the CLI so candle and candle-fido2 come from the same release, then enroll again." : "Nothing was sent to any key and nothing was written. Reinstall the CLI so candle and candle-fido2 come from the same release, then enroll again."
+  });
+}
+function assertHelperExcludeList(info, helperPath, excludeCount) {
+  if (excludeCount === 0)
+    return;
+  const features = Array.isArray(info.features) ? info.features : [];
+  if (!features.includes(EXCLUDE_LIST_FEATURE))
+    throw helperPredatesExcludeList(helperPath, false);
+}
+function assertExcludeListFits(device, excludeCount) {
+  const capacity = excludeCapacity(device);
+  if (excludeCount <= capacity)
+    return;
+  throw new VaultError("VAULT_FACTOR_UNAVAILABLE", `${device.product || "This security key"} (--device ${device.deviceId}) takes at most ${capacity} credential${capacity === 1 ? "" : "s"} in one request${device.maxCredentialCountInList === null ? " (it reports no maxCredentialCountInList)" : ""}, and this vault has ${excludeCount} security key credentials to exclude, so it cannot enroll on this vault. Nothing was sent to it.`, { suggestion: "Nothing was written. Use a security key that reports a larger maxCredentialCountInList." });
+}
+function assertDeviceServesFactor(device) {
+  if (!device.extensions.includes("hmac-secret")) {
+    throw new VaultError("VAULT_PRF_UNSUPPORTED", `${device.product || "This security key"} does not support the hmac-secret extension, which this factor needs.`, { suggestion: "Use a key that supports hmac-secret (FIDO2 with PRF). No other derivation is substituted." });
+  }
+  if (device.options.clientPin !== true && device.options.uv !== true) {
+    throw new VaultError("VAULT_UV_UNSUPPORTED", `${device.product || "This security key"} has no PIN set and no built-in user verification, and this factor uses the user-verified secret only.`, { suggestion: "Set a PIN on this key (its vendor's tool does that) and retry. Nothing was written." });
+  }
+}
+async function listSecurityKeys(deps, opts) {
+  const location = await locateFido2Helper(deps);
+  if (location.state === "absent")
+    throw helperMissing(location);
+  const info = await callHelper(deps, location.path, {
+    op: "info",
+    vaultId: opts.vaultId,
+    envelopeId: opts.envelopeId,
+    digest: base64.encode(operationDigest({ vaultId: opts.vaultId, envelopeId: opts.envelopeId, op: "info", nonce: b64u(randomBytes2(16)) }))
+  });
+  return { helperPath: location.path, info };
+}
 function describeDeviceForList(device) {
   const product = device.product || "security key";
   return `--device ${device.deviceId}  ${product}${device.manufacturer ? ` (${device.manufacturer})` : ""}${device.readable ? "" : "  [not readable by this user]"}`;
@@ -6099,17 +6179,12 @@ async function openSecurityKeySession(deps, opts) {
     deps.stderr.write(`Using the attached security key: ${device.product || "security key"} (--device ${device.deviceId})
 `);
   }
-  if (opts.requireFeatures) {
-    if (!device.extensions.includes("hmac-secret")) {
-      throw new VaultError("VAULT_PRF_UNSUPPORTED", `${device.product || "This security key"} does not support the hmac-secret extension, which this factor needs.`, { suggestion: "Use a key that supports hmac-secret (FIDO2 with PRF). No other derivation is substituted." });
-    }
-    if (device.options.clientPin !== true && device.options.uv !== true) {
-      throw new VaultError("VAULT_UV_UNSUPPORTED", `${device.product || "This security key"} has no PIN set and no built-in user verification, and this factor uses the user-verified secret only.`, { suggestion: "Set a PIN on this key (its vendor's tool does that) and retry. Nothing was written." });
-    }
-  }
+  if (opts.requireFeatures)
+    assertDeviceServesFactor(device);
+  opts.beforePin?.(device, info);
   const session = { helperPath: location.path, device, snapshotId: info.snapshotId };
   if (device.options.clientPin === true) {
-    const typed = await deps.promptSecret(`PIN for ${device.product || "the security key"} (input hidden): `);
+    const typed = await deps.promptSecret(opts.pinPrompt?.(device) ?? `PIN for ${device.product || "the security key"} (input hidden): `);
     if (typed === "") {
       throw new VaultError("VAULT_PIN_REQUIRED", "This security key needs its PIN and none was typed; nothing was sent to it.");
     }
@@ -6163,7 +6238,7 @@ async function probeAttachedKeys(deps, opts) {
       if (opts.deviceFlag === undefined && allReadable && !uncertain)
         state.set(envelopeId, "not attached");
     }
-    return { state, holder };
+    return { state, holder, devices, credentials: credentialOf };
   } catch {
     return;
   }
@@ -6171,20 +6246,37 @@ async function probeAttachedKeys(deps, opts) {
 async function registerCredential(deps, session, opts) {
   deps.stderr.write(`Touch ${session.device.product || "the security key"} to register the vault's credential on it.
 `);
-  const digest = operationDigest({ ...opts, op: "register", nonce: b64u(randomBytes2(16)) });
-  const response = await callHelper(deps, session.helperPath, {
-    op: "register",
+  const digest = operationDigest({
     vaultId: opts.vaultId,
     envelopeId: opts.envelopeId,
-    digest: base64.encode(digest),
-    deviceId: session.device.deviceId,
-    expectSnapshot: session.snapshotId,
-    rpId: RP_ID,
-    userId: base64.encode(userIdFor(opts.vaultId, opts.envelopeId)),
-    userName: userNameFor(opts.vaultId, opts.envelopeId),
-    clientDataHash: base64.encode(digest),
-    ...session.pin !== undefined ? { pin: session.pin } : {}
+    op: "register",
+    nonce: b64u(randomBytes2(16))
   });
+  const exclude = opts.excludeCredentialIds ?? [];
+  let response;
+  try {
+    response = await callHelper(deps, session.helperPath, {
+      op: "register",
+      vaultId: opts.vaultId,
+      envelopeId: opts.envelopeId,
+      digest: base64.encode(digest),
+      deviceId: session.device.deviceId,
+      expectSnapshot: session.snapshotId,
+      rpId: RP_ID,
+      userId: base64.encode(userIdFor(opts.vaultId, opts.envelopeId)),
+      userName: userNameFor(opts.vaultId, opts.envelopeId),
+      clientDataHash: base64.encode(digest),
+      ...session.pin !== undefined ? { pin: session.pin } : {},
+      ...exclude.length > 0 ? { excludeCredentialIds: exclude } : {}
+    });
+  } catch (error) {
+    if (error instanceof VaultError && error.code === "VAULT_KEY_ALREADY_ENROLLED")
+      throw alreadyEnrolled(session.device);
+    throw error;
+  }
+  if (exclude.length > 0 && response.excluded !== exclude.length) {
+    throw helperPredatesExcludeList(session.helperPath, true);
+  }
   const authData = base64.decode(response.authData);
   assertAuthenticatorData(authData, RP_ID, "registration");
   return {
@@ -6224,7 +6316,7 @@ async function assertPrf(deps, session, envelope, vaultId, purpose) {
   }
   return prfOutput;
 }
-var HELPER_NAME = "candle-fido2", HELPER_ENV = "CANDLE_FIDO2_HELPER", HELPER_TIMEOUT_MS = 90000, HELPER_INSTALL_SUGGESTION = "Install a release build of the CLI (the installer script or Homebrew place candle-fido2 beside candle), or set CANDLE_FIDO2_HELPER to the path of a candle-fido2 executable. No other factor is substituted.";
+var HELPER_NAME = "candle-fido2", HELPER_ENV = "CANDLE_FIDO2_HELPER", HELPER_TIMEOUT_MS = 90000, HELPER_INSTALL_SUGGESTION = "Install a release build of the CLI (the installer script or Homebrew place candle-fido2 beside candle), or set CANDLE_FIDO2_HELPER to the path of a candle-fido2 executable. No other factor is substituted.", ALREADY_ENROLLED_SUGGESTION = "Insert a different security key, or name one with --device.", EXCLUDE_LIST_FEATURE = "exclude-list";
 var init_fido2 = __esm(() => {
   init_sha256();
   init_esm();
@@ -8669,7 +8761,7 @@ async function keysList(args, ctx) {
 async function keysCreate(args, ctx) {
   const { deps, apiUrl, json } = ctx;
   const parsed = parseArgs(args, {
-    valueFlags: ["--scopes", "--environment", "--label", "--expires-in", "--tx-limit", "--reset"]
+    valueFlags: ["--scopes", "--access", "--environment", "--label", "--expires-in", "--tx-limit", "--reset"]
   });
   if ("error" in parsed) {
     writeUsageFailure(deps, parsed.error, json);
@@ -8679,7 +8771,20 @@ async function keysCreate(args, ctx) {
     writeUsageFailure(deps, `Unexpected argument: ${parsed.positionals[0]}`, json);
     return 2;
   }
-  const requestedScopes = parsed.values["--scopes"] ? parseScopesList(parsed.values["--scopes"]) : undefined;
+  if (parsed.values["--access"] !== undefined && parsed.values["--scopes"] !== undefined) {
+    writeUsageFailure(deps, "--access and --scopes are mutually exclusive; pass one of them.", json);
+    return 2;
+  }
+  let accessScopes;
+  if (parsed.values["--access"] !== undefined) {
+    const preset = ACCESS_LEVELS[parsed.values["--access"]];
+    if (preset === undefined) {
+      writeUsageFailure(deps, `--access must be one of: ${Object.keys(ACCESS_LEVELS).join(", ")}.`, json);
+      return 2;
+    }
+    accessScopes = scopesForPreset(preset);
+  }
+  const requestedScopes = accessScopes ?? (parsed.values["--scopes"] ? parseScopesList(parsed.values["--scopes"]) : undefined);
   const environment = parsed.values["--environment"];
   const label = parsed.values["--label"]?.trim();
   if (parsed.values["--label"] !== undefined && (label === undefined || label.length < 1 || label.length > 64)) {
@@ -8775,7 +8880,7 @@ WARNING: the key above was NOT stored in the ${deps.backend} store: ${storeError
 `);
   }
   if (!requestedScopes) {
-    deps.stdout.write(`No --scopes given: the server granted the default scopes (swap:write excluded).
+    deps.stdout.write(`No --access or --scopes given: the server granted the default scopes (swap:write excluded).
 `);
   }
   if (storeError === undefined) {
@@ -8842,7 +8947,7 @@ async function keysRevoke(args, ctx) {
   }
   return 0;
 }
-var KEYS_PATH = "/api/v1/agent/keys", NO_DEVICE_TOKEN;
+var KEYS_PATH = "/api/v1/agent/keys", ACCESS_LEVELS, NO_DEVICE_TOKEN;
 var init_keys = __esm(() => {
   init_agent_key_access();
   init_args();
@@ -8850,6 +8955,11 @@ var init_keys = __esm(() => {
   init_profiles();
   init_render();
   init_secret_store();
+  ACCESS_LEVELS = {
+    read: "read",
+    "read-write": "readwrite",
+    "read-write-transfer": "readwritetransfer"
+  };
   NO_DEVICE_TOKEN = {
     code: "NO_DEVICE_TOKEN",
     message: "No device token available.",
@@ -13707,11 +13817,13 @@ async function listTradingWallets(ctx, key, scope) {
   const rows = [];
   const cursors = new Set;
   let appId = "";
+  let scopes = [];
   for (;; ) {
     const response = walletPageSchema.parse(await request(ctx, key, `/api/v1/agent/wallets/trading${cursor ? `?cursor=${encodeURIComponent(cursor)}` : ""}`));
     if (scope !== undefined && !response.scopes?.includes(scope))
       throw new TradingError("SCOPE_MISSING", `The bound key needs ${scope}.`);
     appId = response.privyAppId ?? "";
+    scopes = response.scopes;
     if (!Array.isArray(response.page))
       throw new TradingError("INVALID_RESPONSE", "Wallet discovery did not return a page.");
     rows.push(...response.page);
@@ -13722,7 +13834,7 @@ async function listTradingWallets(ctx, key, scope) {
       throw new TradingError("INVALID_RESPONSE", "Wallet discovery did not complete.");
     cursors.add(cursor);
   }
-  return { rows, appId };
+  return { rows, appId, scopes };
 }
 function matchesName(row, name) {
   return row.id === name || row.address === name || row.label === name;
@@ -13759,25 +13871,24 @@ async function tradingWallet(ctx, key, name, scope) {
   }
   return await completeTradingWallet(ctx, matches[0], appId, scope);
 }
-async function tradingPayer(ctx, key, name) {
-  const scope = "swap:write";
-  const { rows, appId } = await listTradingWallets(ctx, key, scope);
+async function tradingPayer(ctx, key, name, scope = "swap:write") {
+  const { rows, appId, scopes } = await listTradingWallets(ctx, key, scope);
   const embedded = embeddedSchema.parse(await request(ctx, key, "/api/v1/agent/wallets/embedded")).wallets?.solana?.address;
-  const asEmbedded = () => ({ kind: "embedded", address: embedded });
+  const asEmbedded = () => ({ kind: "embedded", address: embedded, scopes });
   const options = [
     ...rows.map((row) => `TEE ${describeWallet(row)}`),
     ...embedded ? [`embedded (${embedded})`] : []
   ].join("; ");
   if (name === undefined) {
     if (rows.length === 1 && !embedded)
-      return { kind: "tee", wallet: await completeTradingWallet(ctx, rows[0], appId, scope) };
+      return { kind: "tee", wallet: await completeTradingWallet(ctx, rows[0], appId, scope), scopes };
     if (rows.length === 0 && embedded)
       return asEmbedded();
     throw new TradingError("PAYER_REQUIRED", options.length === 0 ? "This account has no wallet that can pay for a swap. Enrol a TEE wallet, or create an embedded wallet in the app." : `Name the payer with --wallet. This account can pay from: ${options}.`);
   }
   const matches = rows.filter((row) => matchesName(row, name));
   if (matches.length === 1)
-    return { kind: "tee", wallet: await completeTradingWallet(ctx, matches[0], appId, scope) };
+    return { kind: "tee", wallet: await completeTradingWallet(ctx, matches[0], appId, scope), scopes };
   if (matches.length === 0 && embedded === name)
     return asEmbedded();
   throw new TradingError("TEE_WALLET_REQUIRED", matches.length > 1 ? `"${name}" matches ${matches.length} TEE wallets on this key: ${teeWalletList(matches)}. Name one by id or address.` : options.length === 0 ? `"${name}" is not a wallet this account can pay from, and it has none: enrol a TEE wallet, or create an embedded wallet in the app.` : `"${name}" is not a wallet this account can pay from. It can pay from: ${options}.`);
@@ -22179,6 +22290,8 @@ __export(exports_vault_support, {
   menuSafeText: () => menuSafeText,
   findExternalEntry: () => findExternalEntry,
   factorMenu: () => factorMenu,
+  factorAddPassphraseOnlyReason: () => factorAddPassphraseOnlyReason,
+  factorAddAmong: () => factorAddAmong,
   describeRole: () => describeRole,
   describeEntry: () => describeEntry,
   derivationNotice: () => derivationNotice,
@@ -22277,6 +22390,20 @@ async function requireVaultRaw(ctx, resolved) {
     throw missingVault(ctx, resolved);
   return raw;
 }
+function factorAddAmong(envelopes) {
+  return {
+    envelopeIds: envelopes.filter((envelope) => isPassphraseEnvelope(envelope) || isCtap2Envelope(envelope)).map((envelope) => envelope.id),
+    because: factorAddPassphraseOnlyReason,
+    excludedBecause: "adding a factor opens the vault with the passphrase or a security key."
+  };
+}
+function factorAddPassphraseOnlyReason(unusable) {
+  if (unusable.length === 0) {
+    return "adding a factor opens the vault with the passphrase or a security key, and this vault has no security key.";
+  }
+  const keys = unusable.map((entry) => `${entry.word} ${entry.id} cannot be used on this machine: ${entry.availability}`);
+  return `adding a factor opens the vault with the passphrase or a security key, and ${keys.join("; ")}.`;
+}
 function derivationNotice(line, purpose) {
   if (purpose === undefined)
     return line;
@@ -22303,6 +22430,9 @@ async function unlockInteractively(ctx, path, raw, opts = {}) {
   const noticeFor = (purpose) => (line) => deps.stderr.write(derivationNotice(line, purpose));
   const notice = noticeFor(opts.purpose);
   if (choice.kind === "passphrase") {
+    if (opts.onFactorChosen) {
+      await opts.onFactorChosen(choice.envelopeId !== undefined ? { kind: "passphrase", envelopeId: choice.envelopeId } : { kind: "passphrase" });
+    }
     if (choice.onlyBecause !== undefined)
       deps.stderr.write(`${PASSPHRASE_ONLY_PREFIX}${choice.onlyBecause}
 `);
@@ -22324,6 +22454,8 @@ async function unlockInteractively(ctx, path, raw, opts = {}) {
   }
   if (choice.kind === "touch-id") {
     const envelope2 = choice.envelope;
+    if (opts.onFactorChosen)
+      await opts.onFactorChosen({ kind: "touch-id", envelope: envelope2 });
     const session2 = await openEnclaveSession(deps, envelope2.helper);
     const open5 = async (p, r, reason2) => {
       const current = parseVaultFile(r);
@@ -22352,6 +22484,8 @@ async function unlockInteractively(ctx, path, raw, opts = {}) {
   }
   if (choice.kind === "passkey") {
     const envelope2 = choice.envelope;
+    if (opts.onFactorChosen)
+      await opts.onFactorChosen({ kind: "passkey", envelope: envelope2 });
     const session2 = await openPasskeySession(deps, envelope2.helper);
     const open5 = async (p, r, purpose) => {
       const current = parseVaultFile(r);
@@ -22379,11 +22513,14 @@ async function unlockInteractively(ctx, path, raw, opts = {}) {
     };
   }
   const envelope = choice.envelope;
+  const keyDevice = opts.onFactorChosen ? await opts.onFactorChosen({ kind: "security-key", envelope }) : undefined;
   const session = await openSecurityKeySession(deps, {
     vaultId: file.vaultId,
     envelopeId: envelope.id,
-    deviceFlag: ctx.vaultDevice,
-    ...choice.preferDevice !== undefined ? { preferDevice: choice.preferDevice } : {},
+    ...keyDevice !== undefined ? { preferDevice: keyDevice.preferDevice } : {
+      deviceFlag: ctx.vaultDevice,
+      ...choice.preferDevice !== undefined ? { preferDevice: choice.preferDevice } : {}
+    },
     requireFeatures: false
   });
   const open4 = async (p, r) => {
@@ -22477,7 +22614,7 @@ async function chooseFactor(ctx, vaultId, allEnvelopes, facts, requested, opts =
     }
     if (passphrases.length === 0 && drivable.length === 1)
       return choiceFor(drivable[0]);
-    const attached = ctx.deps.isTTY.stdin ? await probeAttachedKeys(ctx.deps, { vaultId, envelopes: drivableKeys, deviceFlag: ctx.vaultDevice }) : undefined;
+    const attached = "attached" in opts ? opts.attached : ctx.deps.isTTY.stdin ? await probeAttachedKeys(ctx.deps, { vaultId, envelopes: drivableKeys, deviceFlag: ctx.vaultDevice }) : undefined;
     const notUsableHere = envelopes.filter((envelope) => !isPassphraseEnvelope(envelope) && !drivable.includes(envelope));
     const menu = factorMenu({
       keys: drivableKeys,
@@ -38715,7 +38852,7 @@ init_render();
 init_secret_store();
 
 // src/version.ts
-var CLI_VERSION = "0.11.7";
+var CLI_VERSION = "0.11.8";
 
 // src/commands/auth.ts
 var DEVICE_CODE_PATH = "/api/v1/agent/device/code";
@@ -38737,6 +38874,10 @@ async function authLogin(args, ctx) {
     return 2;
   }
   const scopes = parsed.values["--scopes"] ? parseScopesList(parsed.values["--scopes"]) : undefined;
+  if (scopes?.includes("transfer:bound")) {
+    writeUsageFailure(deps, "transfer:bound is not available on a device login. Mint a Read:Write:Transfer key with: candle keys create --access read-write-transfer", json);
+    return 2;
+  }
   const label = parsed.values["--label"]?.trim();
   const noBrowser = parsed.booleans.has("--no-browser");
   if (parsed.values["--label"] !== undefined && (label === undefined || label.length < 1 || label.length > MAX_CLIENT_NAME_LENGTH)) {
@@ -39253,6 +39394,32 @@ var HELP = {
     ],
     env: ENV_API
   },
+  transfer: {
+    group: "Trade",
+    summary: "Move funds out of a TEE wallet to your own wallets or its vault, through its bound key",
+    description: "Moves one asset out of a TEE wallet this machine can sign for. The bound key must be a Read:Write:Transfer key (transfer:bound); from that wallet, Candle allows only its own pinned vault or another of the account's wallets you linked while signed in or marked trusted. To a linked wallet the amount counts against the key's spend caps and must be a base asset; to the vault any token and max are allowed. Candle builds the transaction, this machine approves the relay, Privy signs, Candle broadcasts. The destination and its kind are shown before you confirm.",
+    usage: [
+      "candle transfer --to <address|wallet name|vault> --asset <SOL|USDC|CNDL>|--mint <mint> --amount <decimal|max> [--wallet <tee>] [--yes] [--json]"
+    ],
+    rows: [],
+    flags: [
+      {
+        invocation: "--to <address|wallet name|vault>",
+        description: "Where the funds go: vault is the wallet's own pin"
+      },
+      { invocation: "--asset <SOL|USDC|CNDL>", description: "A base asset (required for a linked-wallet destination)" },
+      { invocation: "--mint <mint>", description: "Any Solana mint, instead of --asset (vault destinations only)" },
+      { invocation: "--amount <decimal|max>", description: "How much, or max for the whole spendable balance" },
+      { invocation: "--wallet <tee>", description: "The TEE wallet the funds leave; optional with one payer" },
+      { invocation: "--rpc-url <url>", description: "Your own Solana RPC, to read a --mint's decimals" },
+      { invocation: "--yes", description: "Skip the confirmation prompt (the destination is still printed)" }
+    ],
+    examples: [
+      "candle transfer --to vault --asset SOL --amount max --wallet AgentOne",
+      "candle transfer --to treasury --asset USDC --amount 250 --wallet AgentOne --yes --json"
+    ],
+    env: ENV_API
+  },
   launch: {
     group: "Trade",
     summary: "Create a Solana token (the first buy is a separate swap)",
@@ -39301,11 +39468,11 @@ var HELP = {
     rows: [
       {
         invocation: "list [--scopes]",
-        description: "List API keys: name and Read or Read:Write access; --scopes adds the raw scopes"
+        description: "List API keys: name and Read, Read:Write or Read:Write:Transfer access; --scopes adds the raw scopes"
       },
       {
-        invocation: "create [--scopes <a,b,c>] [--label <name>] [--expires-in <days>] [--tx-limit <usd> [--reset daily|weekly|monthly|never]]",
-        description: "Create an API key"
+        invocation: "create [--access read|read-write|read-write-transfer | --scopes <a,b,c>] [--label <name>] [--expires-in <days>] [--tx-limit <usd> [--reset daily|weekly|monthly|never]]",
+        description: "Create an API key; --access mints one of the three levels (read-write-transfer can move funds out of the wallet it runs)"
       },
       { invocation: "revoke <prefix>", description: "Revoke an API key" },
       { invocation: "wallets <prefix>", description: "Wallets an agent profile can use" },
@@ -39317,6 +39484,7 @@ var HELP = {
     ],
     examples: [
       "candle keys list",
+      "candle keys create --access read-write-transfer --label rebalancer",
       "candle keys create --scopes trade:write --label agent-one",
       "candle keys wallets ck_live_ab12",
       "candle keys revoke ck_live_ab12"
@@ -39327,19 +39495,28 @@ var HELP = {
     group: "Account",
     display: "wallet",
     summary: "Launch and linked wallets; import or revoke one (wallets is an alias)",
-    description: "The account's embedded launch wallets and any wallet you linked, with a Signer column saying whether this machine holds the signing key. Keys are derived in the vault now: this command links and revokes, it never generates or prints one.",
+    description: "The account's embedded launch wallets and any wallet you linked, with a Signer column saying whether this machine holds the signing key and a Trusted column saying whether it is yours: linked while signed in, or marked with wallet trust. Keys are derived in the vault now: this command links and revokes, it never generates or prints one.",
     usage: ["candle wallet [flags]", "candle wallet <subcommand> [flags]"],
     rows: [
       {
         invocation: "import --chain <solana|evm> [options]",
         description: "Import a wallet you own (key via --key-file or hidden prompt)"
       },
-      { invocation: "revoke <wallet-id>", description: "Revoke a linked wallet" }
+      { invocation: "revoke <wallet-id>", description: "Revoke a linked wallet" },
+      {
+        invocation: "trust <label|address|id|prefix*>...",
+        description: "Mark linked wallets yours, so agents can move funds into them (owner only; typed confirm)"
+      },
+      {
+        invocation: "untrust <label|address|id|prefix*>... [--yes]",
+        description: "Clear the mark; moving funds in needs the withdrawal allowlist again (owner only)"
+      }
     ],
     examples: [
       "candle wallet",
       "candle wallet import --chain solana --key-file ./signer.json",
-      "candle wallet revoke wal_123"
+      "candle wallet revoke wal_123",
+      "candle wallet trust 'tr-*' 'dest-*'"
     ],
     env: ENV_API
   },
@@ -39443,7 +39620,10 @@ var HELP = {
         invocation: "--factor <id|kind>",
         description: "Unlock with this envelope: an id from factor list, or passphrase, security-key, touch-id, passkey; without it, a terminal lists the factors to pick by number"
       },
-      { invocation: "--device <id>", description: "The security key to use when more than one is attached" },
+      {
+        invocation: "--device <id>",
+        description: "The security key to use when more than one is attached; on factor add security-key, the key to add (the vault opens with the passphrase or another key)"
+      },
       {
         invocation: "--balances",
         description: "list: SOL per matched key, read from your RPC (one request per 100 matched keys). Every matched address goes to that one endpoint together, which links them; tokens are never read"
@@ -50465,6 +50645,11 @@ init_deps();
 init_profiles();
 init_render();
 init_secret_store();
+function trustedCell(row) {
+  if (row.revokedAt)
+    return "-";
+  return row.addedVia === "session" || typeof row.trustedAt === "number" ? "yes" : "no";
+}
 var TEE_PROFILES = new Set(["ember-tee", "ember-hot"]);
 function isTeeRow(row) {
   return row.profile !== undefined && TEE_PROFILES.has(row.profile);
@@ -50515,6 +50700,9 @@ var NONE_HINT = `A wallet marked none has no signer on this machine, so a trade
 var TEE_HINT = `A wallet marked tee is a TEE trading wallet: pass its id, address or label to candle swap --wallet.
 ` + `This account's embedded wallet, shown above, can pay for a token trade too.
 `;
+var UNTRUSTED_HINT = `A wallet marked Trusted no was linked by an API key: agents can move funds into it only once you mark it.
+` + `Run: candle wallets trust <label|address|prefix*>  (the device token, never an API key)
+`;
 var STALE_HINT = `A wallet marked stale is revoked but its signer is still stored here. Run: candle wallets revoke <id>
 `;
 async function probeSignerStates(rows, store) {
@@ -50621,24 +50809,28 @@ Linked wallets (${linkedRows.length}):
 `);
   } else {
     const cells = linkedRows.map((wallet) => signerCell(signerStates.get(wallet._id), wallet));
-    deps.stdout.write(`${renderTable(["Id", "Wallet", "Address", "Label", "Kind", "Revoked", "Signer"], linkedRows.map((wallet, index) => [
+    deps.stdout.write(`${renderTable(["Id", "Wallet", "Address", "Label", "Kind", "Revoked", "Trusted", "Signer"], linkedRows.map((wallet, index) => [
       wallet._id,
       wallet.chain,
       wallet.address,
       wallet.label ?? "-",
       isTeeRow(wallet) ? "tee" : "linked",
       wallet.revokedAt ? "yes" : "no",
+      trustedCell(wallet),
       cells[index] ?? "-"
     ]))}
 `);
     const anyNone = cells.includes("none");
     const anyStale = cells.includes("stale");
     const anyTee = linkedRows.some(isTeeRow);
-    if (anyNone || anyStale || anyTee)
+    const anyUntrusted = linkedRows.some((row) => trustedCell(row) === "no");
+    if (anyNone || anyStale || anyTee || anyUntrusted)
       deps.stdout.write(`
 `);
     if (anyTee)
       deps.stdout.write(TEE_HINT);
+    if (anyUntrusted)
+      deps.stdout.write(UNTRUSTED_HINT);
     if (anyNone)
       deps.stdout.write(NONE_HINT);
     if (anyStale)
@@ -52834,6 +53026,150 @@ async function teeRebinds(args, ctx) {
   return 0;
 }
 
+// src/commands/transfer.ts
+init_args();
+init_render();
+init_trading();
+var USAGE2 = "Usage: candle transfer --to <address|wallet name|vault> --asset <SOL|USDC|CNDL>|--mint <mint> --amount <decimal|max> [--wallet <name>] [--rpc-url <url>] [--yes] [--json]";
+var TRANSFER_ASSETS = Object.keys(BASES);
+var BASE58_ADDRESS = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;
+async function readLinkedWallets(ctx, key) {
+  const rows = [];
+  let cursor = null;
+  const seen = new Set;
+  for (let page = 0;page < 25; page++) {
+    const query = cursor === null ? "?limit=100" : `?limit=100&cursor=${encodeURIComponent(cursor)}`;
+    const body = await request(ctx, key, `/api/v1/agent/wallets${query}`);
+    if (!Array.isArray(body.page))
+      throw new TradingError("INVALID_RESPONSE", "Wallet discovery did not return a page.");
+    rows.push(...body.page);
+    if (body.isDone !== false || typeof body.continueCursor !== "string" || seen.has(body.continueCursor))
+      return rows;
+    seen.add(body.continueCursor);
+    cursor = body.continueCursor;
+  }
+  return rows;
+}
+async function resolveDestination(ctx, key, source, to) {
+  if (to === "vault") {
+    const lifecycle = await request(ctx, key, `/api/v1/agent/wallets/${encodeURIComponent(source.id)}/lifecycle`);
+    const vault = lifecycle.vaultDestination;
+    if (typeof vault !== "string" || vault.length === 0)
+      throw new TradingError("VAULT_NOT_PINNED", "This wallet has no pinned vault recorded on Candle, so --to vault names nothing. Pass the address instead.");
+    return { kind: "vault", address: vault };
+  }
+  const rows = (await readLinkedWallets(ctx, key)).filter((row) => row.chain === "solana" && row.revokedAt === undefined && row.address !== source.address);
+  const matches = rows.filter((row) => row.label === to || row._id === to || row.address === to);
+  if (matches.length > 1)
+    throw new TradingError("DESTINATION_AMBIGUOUS", `"${to}" names ${matches.length} linked wallets: ${matches.map((row) => `${row.label ?? ""} (${row._id}, ${row.address})`.trim()).join("; ")}. Name one by id or address.`);
+  const match = matches[0];
+  if (match)
+    return { kind: "linked", address: match.address, id: match._id, ...match.label ? { label: match.label } : {} };
+  if (to === source.address)
+    throw new TradingError("DESTINATION_IS_SOURCE", "--to names the wallet the funds would leave. Name a different destination.");
+  if (BASE58_ADDRESS.test(to))
+    return { kind: "address", address: to };
+  throw new TradingError("DESTINATION_UNKNOWN", rows.length === 0 ? `"${to}" is not vault, a Solana address, or a linked wallet on this account (it has no other active Solana linked wallets).` : `"${to}" is not vault, a Solana address, or a linked wallet on this account. Linked wallets: ${rows.map((row) => `${row.label ?? ""} (${row._id}, ${row.address})`.trim()).join("; ")}.`);
+}
+function describeDestination(destination) {
+  switch (destination.kind) {
+    case "vault":
+      return `this wallet's pinned vault ${destination.address}`;
+    case "linked":
+      return `linked wallet ${destination.label ? `${destination.label} ` : ""}(${destination.id}, ${destination.address})`;
+    case "address":
+      return `address ${destination.address} (not one of this account's linked wallets; Candle decides whether it is allowed)`;
+  }
+}
+async function confirmTransfer(ctx, lines, yes) {
+  const output = ctx.json ? ctx.deps.stderr : ctx.deps.stdout;
+  for (const line of lines)
+    output.write(`${safeText(line)}
+`);
+  if (yes)
+    return true;
+  if (!ctx.deps.isTTY.stdin)
+    throw new TradingError("CONFIRMATION_REQUIRED", "Run interactively to confirm, or use --yes for an ordinary transfer prompt.");
+  return (await ctx.deps.promptLine("Proceed? [y/N] ")).trim().toLowerCase() === "y";
+}
+async function transfer(args, ctx) {
+  const parsed = parseArgs(args, {
+    valueFlags: ["--wallet", "--to", "--asset", "--mint", "--amount", "--rpc-url"],
+    booleanFlags: ["--yes"]
+  });
+  if ("error" in parsed) {
+    writeUsageFailure(ctx.deps, parsed.error, ctx.json);
+    return 2;
+  }
+  const flags = parsed.values;
+  const asset = flags["--asset"]?.toUpperCase();
+  if (parsed.positionals.length !== 0 || !flags["--to"] || !flags["--amount"] || Boolean(flags["--asset"]) === Boolean(flags["--mint"]) || asset !== undefined && !TRANSFER_ASSETS.includes(asset) || flags["--mint"] !== undefined && !BASE58_ADDRESS.test(flags["--mint"])) {
+    writeUsageFailure(ctx.deps, USAGE2, ctx.json);
+    return 2;
+  }
+  const to = flags["--to"];
+  const isMax = flags["--amount"] === "max";
+  try {
+    if (!isMax)
+      rawAmount(flags["--amount"], 18);
+    const key = await tradingKey(ctx);
+    const payer = await tradingPayer(ctx, key, flags["--wallet"], "transfer:write");
+    if (payer.kind === "embedded")
+      throw new TradingError("PAYER_UNSUPPORTED", "This command moves a linked wallet this machine can sign for. The embedded wallet transfers through the agent transfer rail (MCP candle_transfer), not from here. Name a TEE wallet with --wallet.");
+    if (!payer.scopes.includes("transfer:bound"))
+      throw new TradingError("SCOPE_MISSING", "Moving funds out of a TEE wallet needs a Read:Write:Transfer key. Mint one with: candle keys create --access read-write-transfer, then bind the wallet to it with: candle tee rebind");
+    const wallet = payer.wallet;
+    const destination = await resolveDestination(ctx, key, wallet, to);
+    const label = asset ?? flags["--mint"];
+    let amountRaw;
+    if (isMax)
+      amountRaw = "max";
+    else {
+      const decimals = asset ? BASES[asset]?.decimals ?? 9 : await decimalsFor(ctx, flags["--mint"], flags["--rpc-url"]);
+      amountRaw = rawAmount(flags["--amount"], decimals);
+    }
+    const amountText = isMax ? `the full spendable balance of ${label}` : `${flags["--amount"]} ${label}`;
+    const confirmed = await confirmTransfer(ctx, [
+      `Transfer ${amountText} from ${wallet.address} (${wallet.id}) to ${describeDestination(destination)}`,
+      destination.kind === "vault" ? "Destination: this wallet's own vault, pinned when it was imported." : destination.kind === "linked" ? "Destination: a linked wallet on this account. Candle allows it only if you linked it while signed in or marked it trusted, and the amount counts against this key's spend caps." : "Destination: an address Candle will classify at build; from a TEE wallet only its vault or a trusted linked wallet is allowed."
+    ], parsed.booleans.has("--yes"));
+    if (!confirmed)
+      return printTradingResult(ctx, { success: true, status: "cancelled", walletId: wallet.id, destination });
+    const built = await request(ctx, key, "/api/v1/agent/transfer/build", {
+      walletId: wallet.id,
+      chain: "solana",
+      ...asset ? { asset } : { mint: flags["--mint"] },
+      amountRaw,
+      to: destination.address
+    });
+    const transferId = built.transferId;
+    const unsigned = built.unsignedTransactionsBase64;
+    if (typeof transferId !== "string" || !Array.isArray(unsigned) || unsigned.length !== 1 || typeof unsigned[0] !== "string")
+      throw new TradingError("INVALID_RESPONSE", "Candle did not return one unsigned transfer transaction; nothing was signed.");
+    if (typeof built.payerAddress === "string" && built.payerAddress !== wallet.address)
+      throw new TradingError("INVALID_RESPONSE", "The transfer build does not name the requested payer; nothing was signed.");
+    const builtAmount = typeof built.amountRaw === "string" ? built.amountRaw : amountRaw;
+    ctx.deps.stderr.write(`Built transfer ${transferId}: ${asset ? `${decimalAmount(builtAmount, BASES[asset]?.decimals ?? 0)} ${asset}` : `${builtAmount} raw units of ${label}`}${typeof built.destinationKind === "string" ? ` to ${built.destinationKind === "vault" ? "the vault" : "a linked wallet"}` : ""}.
+`);
+    const signed = await relaySign(ctx, key, wallet, unsigned[0]);
+    const result = await request(ctx, key, "/api/v1/agent/transfer/submit", {
+      transferId,
+      signedTransactionsBase64: [signed]
+    });
+    const receipt = {
+      ...result,
+      transferId,
+      walletId: wallet.id,
+      wallet: safeText(wallet.address),
+      destination,
+      ...typeof built.destinationKind === "string" ? { destinationKind: built.destinationKind } : {}
+    };
+    return printTradingResult(ctx, receipt);
+  } catch (error) {
+    return tradingFailure(ctx, error);
+  }
+}
+
 // src/commands/update.ts
 init_args();
 import { randomBytes as randomBytes3 } from "node:crypto";
@@ -54406,10 +54742,15 @@ async function addPasskeyFactor(ctx, parsed, resolvedVault, hold) {
   const opened = await unlockInteractively(ctx, path, raw, {
     acceptOlderCopy: parsed.booleans.has("--accept-older-copy"),
     promptText: "Current vault passphrase, to unlock (input hidden): ",
-    factor: "passphrase",
-    passphraseOnlyBecause: "adding a factor opens the vault with the passphrase. A security key does not authorise enrollment: adding a second key while one is plugged in needs a device-selection rule this command does not have (D10)."
+    among: factorAddAmong(parseVaultFile(raw).envelopes)
   });
   const vault = hold(opened.vault);
+  const openedWith = {
+    factor: opened.factor.kind === "passphrase" ? "passphrase" : "security-key",
+    envelopeId: opened.factor.envelopeId
+  };
+  if (opened.factor.kind === "security-key")
+    opened.factor.session.pin = undefined;
   const vaultId = vault.file.vaultId;
   let registered;
   try {
@@ -54507,7 +54848,8 @@ async function addPasskeyFactor(ctx, parsed, resolvedVault, hold) {
       saltDerivation: "platform",
       helper: envelope.helper,
       recoverableFactors: recoverable,
-      verified: true
+      verified: true,
+      openedWith
     });
     return 0;
   }
@@ -54530,6 +54872,7 @@ ${PASSKEY_NOTE}
 }
 
 // src/commands/vault-factor-security-key.ts
+init_esm();
 init_crypto();
 init_errors();
 init_fido2();
@@ -54653,20 +54996,84 @@ async function addSecurityKeyFactor(ctx, parsed, resolvedVault, hold) {
   const raw = await requireVaultRaw(ctx, resolvedVault);
   const file = parseVaultFile(raw);
   const envelopeId = freshEnvelopeId();
-  const session = await openSecurityKeySession(deps, {
-    vaultId: file.vaultId,
-    envelopeId,
-    deviceFlag: ctx.vaultDevice,
-    requireFeatures: true
-  });
+  const vaultId = file.vaultId;
+  const keysInHeader = file.envelopes.filter(isCtap2Envelope);
+  const { helperPath, info } = await listSecurityKeys(deps, { vaultId, envelopeId });
+  assertHelperExcludeList(info, helperPath, keysInHeader.length);
+  const attached = keysInHeader.length > 0 ? await probeAttachedKeys(deps, { vaultId, envelopes: keysInHeader }) : undefined;
+  const excludeCountNow = keysInHeader.length;
+  const addingLine = (device) => deps.stderr.write(`Adding: ${device.product || "security key"} (--device ${device.deviceId}), a different key from the one that opened the vault.
+`);
+  let session;
+  let enrolling;
+  let deferredAfter;
   const opened = await unlockInteractively(ctx, path, raw, {
     acceptOlderCopy: parsed.booleans.has("--accept-older-copy"),
     promptText: "Current vault passphrase, to unlock (input hidden): ",
-    factor: "passphrase",
-    passphraseOnlyBecause: "this command's security key session is for the key being added, so the vault opens with the passphrase here."
+    among: factorAddAmong(file.envelopes),
+    attached,
+    onFactorChosen: async (chosen) => {
+      if (chosen.kind === "passphrase") {
+        session = await openSecurityKeySession(deps, {
+          vaultId,
+          envelopeId,
+          deviceFlag: ctx.vaultDevice,
+          requireFeatures: true,
+          beforePin: (device) => {
+            refuseIfEnrolled(device, attached);
+            assertExcludeListFits(device, excludeCountNow);
+          }
+        });
+        return;
+      }
+      if (chosen.kind !== "security-key")
+        return;
+      const plan = planDevices(ctx, chosen.envelope, info.devices, attached);
+      if (plan.enrolling !== undefined) {
+        refuseIfEnrolled(plan.enrolling, attached);
+        assertDeviceServesFactor(plan.enrolling);
+        assertExcludeListFits(plan.enrolling, excludeCountNow);
+        enrolling = plan.enrolling;
+        addingLine(plan.enrolling);
+      } else {
+        deferredAfter = plan.opening;
+      }
+      return { preferDevice: plan.opening.deviceId };
+    }
   });
   const vault = hold(opened.vault);
-  const registered = await registerCredential(deps, session, { vaultId: vault.file.vaultId, envelopeId });
+  const openedWith = {
+    factor: opened.factor.kind === "passphrase" ? "passphrase" : "security-key",
+    envelopeId: opened.factor.envelopeId
+  };
+  if (opened.factor.kind === "security-key")
+    opened.factor.session.pin = undefined;
+  const enrolledKeys = vault.file.envelopes.filter(isCtap2Envelope);
+  const excludeCredentialIds = enrolledKeys.map((envelope2) => base64.encode(unb64u(envelope2.credentialId, "credentialId")));
+  if (session === undefined) {
+    if (deferredAfter !== undefined) {
+      await deps.promptLine(`The vault is open. Unplug ${deferredAfter.product || "the security key that opened it"}, insert the security key to add, then press Enter.`);
+      const again = await listSecurityKeys(deps, { vaultId, envelopeId });
+      const probeAgain = enrolledKeys.length > 0 ? await probeAttachedKeys(deps, { vaultId, envelopes: enrolledKeys }) : undefined;
+      const inserted = chooseAfterInsert(ctx, again.info.devices, probeAgain);
+      refuseIfEnrolled(inserted, probeAgain);
+      assertDeviceServesFactor(inserted);
+      assertExcludeListFits(inserted, excludeCredentialIds.length);
+      addingLine(inserted);
+      enrolling = inserted;
+    }
+    if (enrolling === undefined)
+      throw new Error("factor add security-key: no enrolling device was decided");
+    const target = enrolling;
+    session = await openSecurityKeySession(deps, {
+      vaultId,
+      envelopeId,
+      deviceFlag: target.deviceId,
+      requireFeatures: true,
+      pinPrompt: (device) => `PIN for the key being added, ${device.product || "the security key"} (input hidden): `
+    });
+  }
+  const registered = await registerCredential(deps, session, { vaultId, envelopeId, excludeCredentialIds });
   if (registered.backupEligible) {
     throw new VaultError("VAULT_FACTOR_UNAVAILABLE", `${session.device.product || "This authenticator"} reports the credential it created as backup-eligible (synced), so it is not a hardware-bound security key credential and cannot be recorded as a hardware-token factor.`, {
       suggestion: "Nothing was written to the vault. The credential now on the authenticator can be removed with its vendor's tool. Use a hardware security key for this factor."
@@ -54723,7 +55130,8 @@ async function addSecurityKeyFactor(ctx, parsed, resolvedVault, hold) {
       backupState: envelope.backupState,
       userVerification: "required",
       recoverableFactors: recoverable,
-      verified: true
+      verified: true,
+      openedWith
     });
     return 0;
   }
@@ -54742,6 +55150,76 @@ ${SECURITY_KEY_PAIR_NOTE}
 `);
   return 0;
 }
+function refuseIfEnrolled(device, attached) {
+  const entry = attached?.devices?.find((candidate) => candidate.deviceId === device.deviceId);
+  if (entry === undefined || attached?.credentials === undefined)
+    return;
+  for (const [envelopeId, credentialId] of attached.credentials) {
+    if (entry.present.includes(credentialId))
+      throw alreadyEnrolled(device, envelopeId);
+  }
+}
+function planDevices(ctx, opener, devices, attached) {
+  const platform = ctx.deps.platform;
+  if (devices.length === 0) {
+    throw new VaultError("VAULT_FACTOR_UNAVAILABLE", "No security key is attached.", {
+      suggestion: "Plug the key in and run the command again. No other factor is substituted."
+    });
+  }
+  const named = ctx.vaultDevice;
+  const openerCredential = attached?.credentials?.get(opener.id);
+  const holders = openerCredential === undefined ? [] : (attached?.devices ?? []).filter((device) => device.present.includes(openerCredential));
+  let opening;
+  if (holders.length === 1) {
+    opening = devices.find((device) => device.deviceId === holders[0].deviceId);
+  }
+  if (opening === undefined) {
+    const candidates = devices.filter((device) => device.deviceId !== named);
+    if (candidates.length === 1)
+      opening = candidates[0];
+    else if (devices.length === 1)
+      opening = devices[0];
+  }
+  if (opening === undefined) {
+    throw new VaultError("VAULT_AUTHENTICATOR_AMBIGUOUS", `${devices.length} security keys are attached and the one that opens the vault could not be told apart. Leave only the key that opens the vault attached; this command asks for the key to add after the vault is open.`, { suggestion: "Nothing was sent to any key. Run again with only the key that opens the vault attached." });
+  }
+  if (!opening.readable)
+    selectDevice([opening], undefined, platform);
+  const others = devices.filter((device) => device.deviceId !== opening.deviceId);
+  if (named !== undefined) {
+    if (named === opening.deviceId)
+      throw alreadyEnrolled(opening, opener.id);
+    return { opening, enrolling: selectDevice(others, named, platform) };
+  }
+  if (others.length === 1)
+    return { opening, enrolling: selectDevice(others, undefined, platform) };
+  if (others.length > 1) {
+    const listing = others.map((device) => `  ${describeDeviceForList(device)}`).join(`
+`);
+    throw new VaultError("VAULT_AUTHENTICATOR_AMBIGUOUS", `${others.length} security keys are attached besides the one that opens the vault, and none was named, so nothing was sent to any of them:
+${listing}`, { suggestion: "Run again with --device <id> naming the key to add." });
+  }
+  return { opening, enrolling: undefined };
+}
+function chooseAfterInsert(ctx, devices, probe) {
+  const platform = ctx.deps.platform;
+  if (devices.length === 0) {
+    throw new VaultError("VAULT_FACTOR_UNAVAILABLE", "No security key other than the one that opened the vault is attached. Nothing was written.", { suggestion: "Run the command again with the key to add inserted when asked." });
+  }
+  if (devices.length === 1)
+    return selectDevice(devices, undefined, platform);
+  const holdsVault = (device) => (probe?.devices?.find((entry) => entry.deviceId === device.deviceId)?.present.length ?? 0) > 0;
+  const others = devices.filter((device) => !holdsVault(device));
+  if (others.length === 1)
+    return selectDevice(others, undefined, platform);
+  if (others.length === 0) {
+    throw new VaultError("VAULT_FACTOR_UNAVAILABLE", "Every attached security key already holds one of this vault's credentials, so there is no key to add. Nothing was written.", { suggestion: "Run the command again with a security key this vault does not have inserted when asked." });
+  }
+  const listing = others.map((device) => `  ${describeDeviceForList(device)}`).join(`
+`);
+  throw new VaultError("VAULT_AUTHENTICATOR_AMBIGUOUS", `${others.length} security keys are attached besides the one that opened the vault, so nothing was sent to any of them:
+${listing}`, { suggestion: "Run the command again with only the key to add inserted when asked. Nothing was written." });
+}
 
 // src/commands/vault-factor-touch-id.ts
 init_enclave();
@@ -54780,10 +55258,15 @@ async function addTouchIdFactor(ctx, parsed, resolvedVault, hold) {
   const opened = await unlockInteractively(ctx, path, raw, {
     acceptOlderCopy: parsed.booleans.has("--accept-older-copy"),
     promptText: "Current vault passphrase, to unlock (input hidden): ",
-    factor: "passphrase",
-    passphraseOnlyBecause: "adding a factor opens the vault with the passphrase. A security key does not authorise enrollment: adding a second key while one is plugged in needs a device-selection rule this command does not have (D10)."
+    among: factorAddAmong(parseVaultFile(raw).envelopes)
   });
   const vault = hold(opened.vault);
+  const openedWith = {
+    factor: opened.factor.kind === "passphrase" ? "passphrase" : "security-key",
+    envelopeId: opened.factor.envelopeId
+  };
+  if (opened.factor.kind === "security-key")
+    opened.factor.session.pin = undefined;
   const vaultId = vault.file.vaultId;
   const keyTag = keyTagFor(vaultId, envelopeId);
   let created;
@@ -54867,7 +55350,8 @@ async function addTouchIdFactor(ctx, parsed, resolvedVault, hold) {
       helper: { teamId: session.identity.teamId, bundleId: session.identity.bundleId, minVersion: session.version },
       accessControl: "biometryCurrentSet",
       recoverableFactors: recoverable,
-      verified: true
+      verified: true,
+      openedWith
     });
     return 0;
   }
@@ -59889,7 +60373,7 @@ init_args();
 init_release();
 import { dirname as dirname10, join as join11 } from "node:path";
 init_render();
-var USAGE2 = "Usage: candle verify <file> --bundle <path> [--identity <uri>] [--issuer <url>]";
+var USAGE3 = "Usage: candle verify <file> --bundle <path> [--identity <uri>] [--issuer <url>]";
 async function resolveIdentity(deps, bundlePath, flag) {
   if (flag)
     return { kind: "ok", uri: flag, provenance: "identity from --identity" };
@@ -59921,19 +60405,19 @@ async function verify(args, ctx) {
   });
   if ("error" in parsed) {
     writeUsageFailure(deps, `${parsed.error}
-${USAGE2}`, json);
+${USAGE3}`, json);
     return 2;
   }
   const file = parsed.positionals[0];
   if (parsed.positionals.length !== 1 || file === undefined) {
     writeUsageFailure(deps, `verify takes exactly one file.
-${USAGE2}`, json);
+${USAGE3}`, json);
     return 2;
   }
   const bundlePath = parsed.values["--bundle"];
   if (!bundlePath) {
     writeUsageFailure(deps, `--bundle is required.
-${USAGE2}`, json);
+${USAGE3}`, json);
     return 2;
   }
   const resolved = await resolveIdentity(deps, bundlePath, parsed.values["--identity"]);
@@ -59947,7 +60431,7 @@ ${USAGE2}`, json);
   }
   if (resolved.kind === "absent") {
     writeUsageFailure(deps, `--identity is required: there is no latest.json beside ${bundlePath} to take the release version from.
-${USAGE2}`, json);
+${USAGE3}`, json);
     return 2;
   }
   const identity = resolved.uri;
@@ -59988,6 +60472,177 @@ function messageOf2(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
+// src/commands/wallets-trust.ts
+init_args();
+init_deps();
+init_profiles();
+init_render();
+init_promote_support();
+var TRUST_PATH = "/api/v1/agent/linked-wallets/trust";
+var USAGE_TRUST = "Usage: candle wallets trust <label|address|id|prefix*>... [--json]";
+var USAGE_UNTRUST = "Usage: candle wallets untrust <label|address|id|prefix*>... [--yes] [--json]";
+var DEVICE_TOKEN_REQUIRED2 = {
+  code: "DEVICE_TOKEN_REQUIRED",
+  message: "Marking a wallet trusted needs the device token, the owner's credential; an API key cannot do it.",
+  suggestion: "Run: candle auth login"
+};
+function sessionLinkedLine(rows) {
+  const n = rows.length;
+  const it = n === 1 ? "it" : "them";
+  const names = rows.map((row) => row.label ?? row.address).join(", ");
+  return `${n} linked while signed in (${names}): always yours while linked. Revoke ${it} to remove ${it}.`;
+}
+function nothingToChangeLine(shown, trusted) {
+  const session = shown.sessionLinked ?? [];
+  const unchanged = shown.unchanged;
+  if (session.length > 0 && unchanged.length === 0) {
+    const one = session.length === 1;
+    return `Nothing to change: ${one ? "that wallet is" : `those ${session.length} wallets are`} always yours while linked. Revoke ${one ? "it" : "them"} to remove ${one ? "it" : "them"}.
+`;
+  }
+  const bits = [];
+  if (session.length > 0)
+    bits.push(sessionLinkedLine(session).replace(/\.$/, ""));
+  if (unchanged.length > 0) {
+    bits.push(unchanged.length === 1 ? `that wallet is already ${trusted ? "trusted" : "untrusted"}` : `all ${unchanged.length} wallets are already ${trusted ? "trusted" : "untrusted"}`);
+  }
+  if (bits.length === 0)
+    return `Nothing to change.
+`;
+  return `Nothing to change: ${bits.join("; ")}.
+`;
+}
+function writeTrustFailure(ctx, result) {
+  const { deps, apiUrl, json } = ctx;
+  let code = result.code;
+  let message = result.message;
+  let suggestion;
+  if (result.status === 404) {
+    code = "TRUST_UNSUPPORTED";
+    message = "This Candle API does not support trusting wallets yet; nothing changed.";
+  } else {
+    const error = result.raw?.error;
+    if (error?.reason === "ambiguous" && Array.isArray(error.matches)) {
+      const ids = error.matches.map((m) => String(m.id)).join(", ");
+      suggestion = `Name one of them by id or address: ${ids}`;
+    } else if (error?.reason === "not_found") {
+      suggestion = "Run: candle wallets, to see this account's linked wallets and their labels.";
+    }
+  }
+  const envelope = errorEnvelope({ ...result, code, message }, { apiUrl, authType: "device" });
+  if (json) {
+    deps.stdout.write(`${JSON.stringify({ ...envelope, ...suggestion ? { suggestion } : {} })}
+`);
+  } else {
+    deps.stderr.write(`${code ?? `HTTP ${result.status}`}: ${message}${suggestion ? ` ${suggestion}` : ""}
+`);
+  }
+  return 1;
+}
+function trustTable(rows) {
+  return renderTable(["line", "label", "wallet", "address"], rows.map((row, i) => [String(i + 1), row.label ?? "-", row.chain, row.address]));
+}
+async function setTrust(args, ctx, trusted) {
+  const { deps, apiUrl, json } = ctx;
+  const usage5 = trusted ? USAGE_TRUST : USAGE_UNTRUST;
+  const command = trusted ? "wallets trust" : "wallets untrust";
+  const parsed = parseArgs(args, trusted ? {} : { booleanFlags: ["--yes"] });
+  if ("error" in parsed) {
+    writeUsageFailure(deps, parsed.error, json);
+    return 2;
+  }
+  if (parsed.positionals.length === 0) {
+    writeUsageFailure(deps, `Name at least one wallet. ${usage5}`, json);
+    return 2;
+  }
+  const skipConfirm = !trusted && parsed.booleans.has("--yes");
+  await printIdentity(ctx);
+  const deviceToken = await resolveDeviceToken(deps, ctx.profile);
+  if (!deviceToken) {
+    writeLocalFailure(deps, DEVICE_TOKEN_REQUIRED2, json);
+    return 1;
+  }
+  if (!skipConfirm && (!deps.isTTY.stdin || !deps.isTTY.stdout)) {
+    writeLocalFailure(deps, {
+      code: "TRUST_REQUIRES_TTY",
+      message: `candle ${command} needs a terminal: the acknowledgement is typed, and nothing else supplies it.`,
+      suggestion: trusted ? "Run it in an interactive shell; there is no flag and no environment variable for confirm." : "Run it in an interactive shell, or pass --yes to untrust without the prompt."
+    }, json);
+    return 1;
+  }
+  const call = (body) => apiRequest(TRUST_PATH, {
+    method: "POST",
+    body,
+    auth: "device",
+    credentials: { deviceToken },
+    apiUrl,
+    fetch: deps.fetch,
+    env: deps.env
+  });
+  const preview = await call({ dryRun: true, wallets: parsed.positionals, trusted });
+  if (!preview.ok)
+    return writeTrustFailure(ctx, preview);
+  const shown = preview.body;
+  const changing = shown.changed;
+  if (changing.length === 0) {
+    if (json) {
+      deps.stdout.write(`${JSON.stringify({ ...shown, command })}
+`);
+    } else {
+      deps.stdout.write(nothingToChangeLine(shown, trusted));
+    }
+    return 0;
+  }
+  const n = changing.length;
+  const screen = [
+    trustTable(changing),
+    ...shown.unchanged.length > 0 ? [
+      `${shown.unchanged.length} already ${trusted ? "trusted" : "untrusted"}: ${shown.unchanged.map((row) => row.label ?? row.address).join(", ")}`
+    ] : [],
+    ...(shown.sessionLinked?.length ?? 0) > 0 ? [sessionLinkedLine(shown.sessionLinked ?? [])] : [],
+    "",
+    trusted ? `${n === 1 ? "This wallet" : `These ${n} wallets`} will be trusted: your agents can move funds into ${n === 1 ? "it" : "them"} with no cap, like a wallet you linked while signed in.` : `${n === 1 ? "This wallet" : `These ${n} wallets`} will no longer be trusted: moving funds into ${n === 1 ? "it" : "them"} will need the withdrawal allowlist again.`,
+    ""
+  ];
+  deps.stderr.write(`${screen.join(`
+`)}
+`);
+  if (!skipConfirm) {
+    const typed = await deps.promptLine(`Type ${CONFIRM_WORD} to ${trusted ? "trust" : "untrust"} ${n === 1 ? "this wallet" : `these ${n} wallets`}: `);
+    if (typed.trim().toLowerCase() !== CONFIRM_WORD) {
+      writeLocalFailure(deps, {
+        code: "TRUST_NOT_ACKNOWLEDGED",
+        message: `The acknowledgement is the word ${CONFIRM_WORD}; nothing changed.`,
+        suggestion: `Run the command again and type ${CONFIRM_WORD} at the prompt.`
+      }, json);
+      return 1;
+    }
+  }
+  const committed = await call({ walletIds: changing.map((row) => row.id), trusted });
+  if (!committed.ok)
+    return writeTrustFailure(ctx, committed);
+  const result = committed.body;
+  if (json) {
+    deps.stdout.write(`${JSON.stringify({ ...result, command })}
+`);
+    return result.skipped.length > 0 ? 1 : 0;
+  }
+  const done = result.changed.length;
+  deps.stdout.write(`${trusted ? "Trusted" : "Untrusted"} ${done} wallet${done === 1 ? "" : "s"}.
+`);
+  for (const skip of result.skipped) {
+    deps.stderr.write(`Skipped ${skip.walletId}: ${skip.reason === "revoked" ? "revoked" : "not on this account"}.
+`);
+  }
+  return result.skipped.length > 0 ? 1 : 0;
+}
+function walletsTrust(args, ctx) {
+  return setTrust(args, ctx, true);
+}
+function walletsUntrust(args, ctx) {
+  return setTrust(args, ctx, false);
+}
+
 // src/config.ts
 import { chmod as chmod7, mkdir as mkdir7, readFile as readFile7, rm as rm4, writeFile as writeFile6 } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
@@ -60303,6 +60958,7 @@ function extractGlobalFlags(argv) {
 }
 var COMMANDS = {
   swap: { bare: swap, subcommands: { status: swapStatus } },
+  transfer: { bare: transfer },
   launch: { bare: launch },
   pnl: { bare: pnl },
   portfolio: { bare: portfolio },
@@ -60310,7 +60966,7 @@ var COMMANDS = {
   auth: { subcommands: { login: authLogin, status: authStatus, logout: authLogout } },
   keys: { subcommands: { list: keysList, create: keysCreate, revoke: keysRevoke, wallets: keysWallets } },
   wallets: {
-    subcommands: { import: walletsImport, revoke: walletsRevoke },
+    subcommands: { import: walletsImport, revoke: walletsRevoke, trust: walletsTrust, untrust: walletsUntrust },
     bare: wallets
   },
   vault: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@candledottv/cli",
-  "version": "0.11.7",
+  "version": "0.11.8",
   "description": "The Candle CLI: authorize a device from your browser, then manage API keys, wallets, and setup health from the terminal",
   "type": "module",
   "bin": {