@candledottv/cli 0.13.16 → 0.13.18

package/dist/index.js

@@ -532,7 +532,7 @@ var init_terminal_theme = __esm(() => {
 });
 
 // src/version.ts
-var CLI_VERSION = "0.13.16";
+var CLI_VERSION = "0.13.18";
 
 // src/presentation.ts
 function terminalStyle(deps, stream, machine = false) {
@@ -11163,6 +11163,25 @@ var init_solana_alt = __esm(() => {
   ];
 });
 
+// src/account.ts
+async function fetchAccount(deps, apiUrl, apiKey) {
+  const identity = await apiRequest("/api/v1/agent/wallets/embedded", {
+    auth: "key",
+    credentials: { apiKey },
+    apiUrl,
+    fetch: deps.fetch,
+    env: deps.env
+  });
+  const body = identity.ok ? identity.body : undefined;
+  const account = body?.account;
+  if (account)
+    return { account, ...body?.username ? { username: body.username } : {} };
+  return { failure: identity.ok ? "no account in the response" : identity.message };
+}
+var init_account = __esm(() => {
+  init_client();
+});
+
 // src/profiles.ts
 function assertOrdinaryProfile(config, profile) {
   if (profile !== undefined && config.profiles?.[profile]?.apiKeyItem !== undefined) {
@@ -11297,7 +11316,7 @@ function credentialEnvOverrides(env) {
 }
 function identityLine(profile, account, apiUrl, overrides, username, options = {}) {
   const address = account === undefined ? undefined : shortId(account, options.full);
-  const shown = overrides?.length ? `unknown (${overrides.join(", ")} override)` : username && address ? `${username} (${address})` : address ?? "unknown";
+  const shown = overrides?.length ? address ? `${address} (${overrides.join(", ")} override)` : `unknown (${overrides.join(", ")} override)` : username && address ? `${username} (${address})` : address ?? "unknown";
   const name = profile ?? "none";
   const host = apiUrl.replace(/^https:\/\//i, "").replace(/\/+$/, "");
   const sep = options.style ? symbols(options.style).note : "·";
@@ -11308,7 +11327,20 @@ async function printIdentity(ctx) {
     return;
   const config = await ctx.deps.readConfig();
   const fields2 = effectiveProfileFields(config, ctx.profile);
-  const line = identityLine(ctx.profile, fields2.account, ctx.apiUrl, credentialEnvOverrides(ctx.deps.env), fields2.username, identityStyle(ctx.deps, "stdout"));
+  const overrides = credentialEnvOverrides(ctx.deps.env);
+  let account = fields2.account;
+  let username = fields2.username;
+  if (overrides.length > 0) {
+    account = undefined;
+    username = undefined;
+    const key = ctx.deps.env.CANDLE_API_KEY?.trim();
+    if (key) {
+      const lookup = await fetchAccount(ctx.deps, ctx.apiUrl, key);
+      if (lookup.account)
+        account = lookup.account;
+    }
+  }
+  const line = identityLine(ctx.profile, account, ctx.apiUrl, overrides.length > 0 ? overrides : undefined, username, identityStyle(ctx.deps, "stdout"));
   ctx.deps.stdout.write(`${line}
 
 `);
@@ -11352,6 +11384,7 @@ function profileTable(config, now) {
 }
 var ProfileFleetOnlyError, PRE_PROFILE_FIELDS, API_KEY_PREFIXES, API_KEY_RANDOM_LENGTH = 43, INVALID_RPC_HOST = "invalid (fix with profile set)";
 var init_profiles = __esm(() => {
+  init_account();
   init_presentation();
   init_render();
   ProfileFleetOnlyError = class ProfileFleetOnlyError extends Error {
@@ -12603,9 +12636,9 @@ function kekReuseKey(passphrase, kdf) {
   const inputs = JSON.stringify([passphrase, kdf.salt, kdf.m, kdf.t, kdf.p, kdf.version]);
   return b64u(sha2562(new TextEncoder().encode(inputs)));
 }
-async function derivePassphraseKek(passphrase, kdf, notice2) {
+async function derivePassphraseKek(passphrase, kdf, notice2, derivationLabel = "Deriving the vault key") {
   assertKdfInBounds(kdf);
-  notice2?.(`Deriving the vault key (Argon2id, ${Math.round(kdf.m / 1024)} MiB)
+  notice2?.(`${derivationLabel} (Argon2id, ${Math.round(kdf.m / 1024)} MiB)
 `);
   const reuseKey = testKekReuse ? kekReuseKey(passphrase, kdf) : null;
   const reused = reuseKey ? testKekReuse?.get(reuseKey) : undefined;
@@ -13990,7 +14023,7 @@ function closeVault(vault) {
 async function unlockVault(path, raw, request, opts = {}) {
   const file = parseVaultFile(raw);
   const envelope = pickEnvelope(file, request);
-  const dek = await unwrapDek(file, envelope, request, opts.notice);
+  const dek = await unwrapDek(file, envelope, request, opts.notice, opts.derivationLabel);
   if (dek.length !== DEK_BYTES) {
     wipe(dek);
     throw new VaultError("VAULT_UNLOCK_FAILED", "The unwrapped key is the wrong length; this file is corrupt.");
@@ -14030,9 +14063,9 @@ async function openWithDek(path, raw, file, envelope, dek) {
     throw error;
   }
 }
-async function unwrapDek(file, envelope, request, notice2) {
+async function unwrapDek(file, envelope, request, notice2, derivationLabel) {
   if (request.factor === "passphrase") {
-    const kek = await derivePassphraseKek(request.passphrase, passphraseKdf(envelope), notice2);
+    const kek = await derivePassphraseKek(request.passphrase, passphraseKdf(envelope), notice2, derivationLabel);
     return withSecret(kek, async (kekBytes) => {
       const kekKey2 = await importAesKey(kekBytes);
       return open(kekKey2, envelope.wrap, envelopeAad(file, envelope), {
@@ -28989,13 +29022,13 @@ __export(exports_vault_support, {
   runVaultCommand: () => runVaultCommand,
   requireVaultRaw: () => requireVaultRaw,
   requireTty: () => requireTty,
-  requirePromptStreams: () => requirePromptStreams,
   refusePromptsWithoutTerminal: () => refusePromptsWithoutTerminal,
   refuseEnvPassphrase: () => refuseEnvPassphrase,
   openWithTypedPassphrase: () => openWithTypedPassphrase,
   nonDefaultVaultFooter: () => nonDefaultVaultFooter,
   missingVault: () => missingVault,
   menuSafeText: () => menuSafeText,
+  isNoTerminalRefusal: () => isNoTerminalRefusal,
   groupAddress: () => groupAddress,
   findExternalEntry: () => findExternalEntry,
   factorMenu: () => factorMenu,
@@ -29039,22 +29072,23 @@ function requireTty(ctx, what) {
   }));
   return false;
 }
-function requirePromptStreams(ctx, what) {
-  if (ctx.deps.isTTY.stdin && ctx.deps.isTTY.stderr)
-    return true;
-  writeVaultFailure(ctx, new VaultError("VAULT_UNLOCK_FAILED", `${what} needs a terminal for the passphrase prompt: standard input and standard error must both be a terminal. Standard output may be redirected; that is where the listing goes.`));
-  return false;
-}
 function refusePromptsWithoutTerminal(ctx, what) {
   if (ctx.deps.isTTY.stdin && ctx.deps.isTTY.stderr)
     return ctx;
   const refuse2 = async () => {
-    throw new VaultError("VAULT_UNLOCK_FAILED", `${what} needs a terminal here: this unlock reads a vault passphrase, a security key PIN or a choice from a prompt, and standard input and standard error must both be a terminal for that. Standard output may be redirected.`, {
+    throw tagNoTerminal(new VaultError("VAULT_UNLOCK_FAILED", `${what} needs a terminal here: this unlock reads a vault passphrase, a security key PIN or a choice from a prompt, and standard input and standard error must both be a terminal for that. Standard output may be redirected.`, {
       suggestion: "Run it from a terminal, or pass --factor touch-id or --factor passkey to unlock with a factor that reads no prompt. No environment variable or flag supplies a passphrase or PIN."
-    });
+    }));
   };
   return { ...ctx, deps: { ...ctx.deps, promptSecret: refuse2, promptLine: refuse2 } };
 }
+function tagNoTerminal(error) {
+  noTerminalRefusals.add(error);
+  return error;
+}
+function isNoTerminalRefusal(error) {
+  return error instanceof VaultError && noTerminalRefusals.has(error);
+}
 function vaultPathFor(ctx, parsed) {
   const flag = parsed.values["--keystore"];
   if (flag !== undefined)
@@ -29674,7 +29708,7 @@ function takeRepeatedFlag(args, flag) {
   }
   return { values, rest };
 }
-var PASSPHRASE_ONLY_PREFIX = "Passphrase only: ";
+var noTerminalRefusals, PASSPHRASE_ONLY_PREFIX = "Passphrase only: ";
 var init_vault_support = __esm(() => {
   init_args();
   init_presentation();
@@ -29690,6 +29724,7 @@ var init_vault_support = __esm(() => {
   init_platform();
   init_sidecar();
   init_store();
+  noTerminalRefusals = new WeakSet;
 });
 
 // src/vault/ed25519.ts
@@ -38135,6 +38170,7 @@ async function keysList(args, ctx) {
 async function keysCreate(args, ctx) {
   const { deps, apiUrl, json } = ctx;
   const parsed = parseArgs(args, {
+    booleanFlags: ["--no-store"],
     valueFlags: [
       "--scopes",
       "--access",
@@ -38239,11 +38275,12 @@ async function keysCreate(args, ctx) {
     return 1;
   }
   const body = result.body;
+  const noStore = parsed.booleans.has("--no-store");
   const apiKeyRef = ctx.profile ? profileSecretRef(ctx.profile, "apiKey") : SECRET_REFS.apiKey;
   let stored = false;
   let storeError;
   try {
-    if (!await deps.store.get(apiKeyRef)) {
+    if (!noStore && !await deps.store.get(apiKeyRef)) {
       await deps.store.set(apiKeyRef, body.key);
       if (ctx.profile) {
         await deps.updateProfile(ctx.profile, { keyPrefix: body.keyPrefix, scopes: body.scopes });
@@ -38277,7 +38314,7 @@ Or mint it that way: candle keys create --access withdraw --embedded-wallet allo
     ...body.embeddedWallet === "allowed" || body.embeddedWallet === "denied" ? [["Embedded wallet", embeddedWalletSummary(body.embeddedWallet)]] : [],
     [
       "Stored",
-      storeError !== undefined ? "no (store failed)" : stored ? `${deps.backend}, as this CLI's working key` : "no (the CLI already manages a different working key)"
+      storeError !== undefined ? "no (store failed)" : stored ? `${deps.backend}, as this CLI's working key` : noStore ? "no (--no-store)" : "no (the CLI already manages a different working key)"
     ]
   ], style).join(`
 `)}
@@ -38564,7 +38601,7 @@ var init_token_clusters = __esm(() => {
 });
 
 // ../mcp/src/version.ts
-var SERVER_VERSION = "0.10.29";
+var SERVER_VERSION = "0.10.30";
 
 // ../mcp/src/update-notice.ts
 function newer(a, b) {
@@ -40422,6 +40459,12 @@ async function executeTrade(args, cfg, doFetch) {
   let amountRaw;
   let resolved = {};
   let paper = isPaperFlag(args.paper);
+  const deferExecution = isPaperFlag(args.deferExecution);
+  if (deferExecution && paper) {
+    return errText("deferExecution cannot be combined with paper; a paper trade records a quote and never executes", {
+      clientTradeId
+    });
+  }
   try {
     if (args.side === "buy") {
       const amount = args.amount;
@@ -40530,6 +40573,9 @@ async function executeTrade(args, cfg, doFetch) {
   } catch (err) {
     return errText(err instanceof Error ? err.message : String(err), { clientTradeId });
   }
+  if (deferExecution && paper) {
+    return errText("deferExecution needs a live holding, and this sell resolved to the paper book (the wallet holds none of the mint); a paper trade never executes", { clientTradeId });
+  }
   const posted = await postJson(`${base(cfg)}/api/v1/trade/agent/build`, apiKey, {
     clientTradeId,
     mint: args.mint,
@@ -40539,7 +40585,8 @@ async function executeTrade(args, cfg, doFetch) {
     payer: { type: "main" },
     ...args.quoteAsset !== undefined ? { quoteAsset: args.quoteAsset } : {},
     ...args.maxSlippageBps !== undefined ? { maxSlippageBps: args.maxSlippageBps } : {},
-    ...paper ? { paper: true } : {}
+    ...paper ? { paper: true } : {},
+    ...deferExecution ? { deferExecution: true } : {}
   }, doFetch);
   if ("thrown" in posted)
     return transportError("clientTradeId", clientTradeId, posted.thrown);
@@ -40791,32 +40838,38 @@ async function executionStatus(cfg, doFetch) {
     }
     return { ok: res.ok, status: res.status, body };
   };
-  const [wallets2, tier, limits] = await Promise.all([
+  const [wallets2, tier, limits, risk] = await Promise.all([
     get("/api/v1/agent/wallets/embedded"),
     get("/api/v1/agent/tier"),
-    get("/api/v1/agent/keys/self/limits")
+    get("/api/v1/agent/keys/self/limits"),
+    get("/api/v1/agent/keys/self/risk")
   ]);
   const unreadable2 = [
     ["wallets", wallets2],
     ["tier", tier],
-    ["limits", limits]
+    ["limits", limits],
+    ["risk", risk]
   ].filter(([, r]) => !r.ok);
   const tierBody = tier.ok ? tier.body : undefined;
+  const riskBody = risk.ok ? risk.body : undefined;
+  const stopped = riskBody?.stopped === true;
   return {
     text: JSON.stringify({
       success: true,
-      ready: unreadable2.length === 0 ? true : undefined,
+      ready: stopped ? false : unreadable2.length === 0 ? true : undefined,
+      stopped: stopped ? { tripped: riskBody?.tripped ?? null, clearedBy: STOP_CLEARED_BY } : undefined,
       notice: tierBody?.maxExpired ? tierBody.maxExpiredNotice : undefined,
       updateAvailable: updateAvailable() ?? undefined,
       unreadable: unreadable2.length > 0 ? unreadable2.map(([name]) => name) : undefined,
       wallets: wallets2.body,
       tier: tier.body,
-      limits: limits.body
+      limits: limits.body,
+      risk: risk.body
     }, null, 2),
     ...unreadable2.length > 0 ? { isError: true } : {}
   };
 }
-var SOLANA_SEED_CEILINGS, MAIN_PAYER, SWEEP_BASE_ASSETS;
+var SOLANA_SEED_CEILINGS, MAIN_PAYER, SWEEP_BASE_ASSETS, STOP_CLEARED_BY = "An account owner reviews the profile and resumes it from the agent console; an API key cannot resume it.";
 var init_orchestrate = __esm(() => {
   init_convert();
   init_image();
@@ -45158,6 +45211,13 @@ function buildRequest(name, args, cfg) {
       const path = kind === "launch" ? `/api/v1/launch/headless/jobs/${id}` : kind === "swap" ? `/api/v1/agent/swap/by-client-id/${id}` : `/api/v1/trade/agent/jobs/${id}`;
       return { url: `${base2}${path}`, init: { method: "GET", headers: jsonHeaders(apiKey) } };
     }
+    case "candle_trade_execute": {
+      const { clientTradeId } = args;
+      return {
+        url: `${base2}/api/v1/trade/agent/execute`,
+        init: { method: "POST", headers: jsonHeaders(requireApiKey2(cfg)), body: JSON.stringify({ clientTradeId }) }
+      };
+    }
     case "candle_get_staking": {
       return { url: `${base2}/api/v1/agent/staking`, init: { method: "GET", headers: jsonHeaders(requireApiKey2(cfg)) } };
     }
@@ -45246,13 +45306,40 @@ function buildRequest(name, args, cfg) {
     }
     case "candle_get_profile_trades": {
       const apiKey = requireApiKey2(cfg);
-      const { keyPrefix, limit } = args;
-      const query2 = limit === undefined ? "" : `?limit=${encodeURIComponent(String(limit))}`;
+      const { keyPrefix, limit, since, until, cursor } = args;
+      const params = new URLSearchParams;
+      if (limit !== undefined)
+        params.set("limit", String(limit));
+      if (since !== undefined)
+        params.set("since", since);
+      if (until !== undefined)
+        params.set("until", until);
+      if (cursor !== undefined)
+        params.set("cursor", cursor);
       return {
-        url: `${base2}/api/v1/agent/keys/${encodeURIComponent(keyPrefix)}/trades${query2}`,
+        url: `${base2}/api/v1/agent/keys/${encodeURIComponent(keyPrefix)}/trades${params.size ? `?${params}` : ""}`,
         init: { method: "GET", headers: jsonHeaders(apiKey) }
       };
     }
+    case "candle_get_paper_inventory": {
+      return {
+        url: `${base2}/api/v1/trade/agent/paper/inventory`,
+        init: { method: "GET", headers: jsonHeaders(requireApiKey2(cfg)) }
+      };
+    }
+    case "candle_get_profile_paper": {
+      const { keyPrefix } = args;
+      return {
+        url: `${base2}/api/v1/agent/keys/${encodeURIComponent(keyPrefix)}/paper`,
+        init: { method: "GET", headers: jsonHeaders(requireApiKey2(cfg)) }
+      };
+    }
+    case "candle_get_account_pnl": {
+      return {
+        url: `${base2}/api/v1/agent/keys/pnl`,
+        init: { method: "GET", headers: jsonHeaders(requireApiKey2(cfg)) }
+      };
+    }
     case "candle_transfer": {
       const apiKey = requireApiKey2(cfg);
       return {
@@ -45697,9 +45784,24 @@ function registerToolSubset(server, options) {
   }, async (args) => callAndRelay("candle_get_profile_pnl", args, getConfig(), doFetch));
   register("candle_get_profile_trades", {
     title: "Read an agent profile's trade history",
-    description: "Orders, actual fills, fees, timestamps and transaction hashes for this profile. Includes FAILED " + "trades, with an errorCode saying why each did not go through, so this answers 'what happened to " + "my order' as well as 'what did I trade'. Reads only; moves nothing.",
+    description: "Orders, actual fills, fees, timestamps and transaction hashes for this profile. Page by time with " + "`since`, `until` and `cursor` (continue with the response's `nextCursor`). Includes FAILED " + "trades, with an errorCode saying why each did not go through, so this answers 'what happened to " + "my order' as well as 'what did I trade'. The profile's swaps are listed among the trades by " + "time, each with kind 'swap', rail ('swap' for candle_swap, 'build' for the CLI's build and " + "submit), fromAsset, toAsset and amountRaw; a candle_swap made without a clientSwapId is not " + "recorded, so it is not listed. Reads only; moves nothing.",
     inputSchema: profileTradesShape
   }, async (args) => callAndRelay("candle_get_profile_trades", args, getConfig(), doFetch));
+  register("candle_get_paper_inventory", {
+    title: "Read this key's paper inventory",
+    description: "This key's PAPER book in raw units: the positions that paper buys have credited and a paper " + "percent sell sizes itself from. Derived from admitted quotes; no money moved and the live " + "wallet is untouched. Never mix it with live holdings (candle_get_portfolio). Fails retryably " + "when the book cannot be read completely. Needs swap:write on the key. Reads only.",
+    inputSchema: noArgsShape
+  }, async (args) => callAndRelay("candle_get_paper_inventory", args, getConfig(), doFetch));
+  register("candle_get_profile_paper", {
+    title: "Read an agent profile's paper P&L",
+    description: "One profile's PAPER results: the same accounting as candle_get_profile_pnl, from trades that " + "never happened. `pnl` is the paper P&L and `trades` its 50 most recent paper trades. Carries " + '`basis: "quote"`: the figures come from quotes at admission and are optimistic by the ' + "slippage and fees real execution pays. Never add them to live P&L. Reads only.",
+    inputSchema: profilePnlShape
+  }, async (args) => callAndRelay("candle_get_profile_paper", args, getConfig(), doFetch));
+  register("candle_get_account_pnl", {
+    title: "Read P&L across all of an account's agent keys",
+    description: "The account's P&L split by agent profile in one read, as `candle pnl` without `--profile` " + "does: one row per profile with its ledger figures and, where it has a board entry, `board` " + "(all-time public total with creator-fee claims credited to the launching agent, so a profile's " + "board total can differ from its per-key ledger P&L). A wallet shared by several keys books a " + "round to its bound key, else the key whose buy opened it. Use candle_get_profile_pnl for one " + "profile's positions. Reads only.",
+    inputSchema: noArgsShape
+  }, async (args) => callAndRelay("candle_get_account_pnl", args, getConfig(), doFetch));
   register("candle_get_portfolio", {
     title: "Read what the account holds, on Solana and Hood",
     description: "Balances and prices for the wallets Candle already knows on this account, on both chains: the " + "embedded wallet and every TEE wallet. Solana wallets are in `embedded` and `tee` (SOL as raw " + "`lamports`, tokens as raw `amountRaw` with `decimals`). Hood wallets are in `hood.embedded` and " + "`hood.tee` (ETH as raw `wei`, ERC-20s including USDG), never in the top-level arrays. Every " + "wallet and holding carries `chain`. Prices are in `prices`: a Solana mint under its own " + "address, Hood ETH under `hood:native`, and a Hood token under `hood:<contract lowercased>`, so " + "lowercase the address before looking it up. An unpriced entry is `priceUsd: null`, never zero; " + "a Hood one says why in `unpricedReason` (no-market-row, unusable-price, stale-mark, " + "source-unavailable), and `hood.unpriced` / `hood.unpricedByReason` count them. A Hood token " + "mark older than six hours is not used, so many Hood tokens read unpriced. A wallet whose read " + "failed has null balances, never zero, and is listed in `unavailable` (Solana) or " + "`hood.unavailable`; check `complete` before quoting a total. `walletsComplete` is false only " + "when the wallet list itself was cut off, and is absent on a server that predates it: then " + "`complete: false` may be a cut-off list or a failed read. Vault and external wallets are " + "not included: Candle does not know their addresses (the Candle CLI's `candle portfolio` reads " + "them over your own RPC). Needs a key with the account:read scope; without it the answer is " + "SCOPE_MISSING. A server that predates Hood in the portfolio omits `hood` and `chain`. Reads " + "only; moves nothing." + (options.localHyperliquid ? " This local server adds `hyperliquid`: each Hood TEE wallet's Hyperliquid account (account value, " + "unrealized P&L, positions, risk level at the default thresholds) read live from Hyperliquid, with a " + "subtotal. It is not in the ledger and is never part of any total. `read: false` with a reason, or " + "entries in `unread`, means those accounts are unknown, not empty." : ""),
@@ -45721,7 +45823,7 @@ function registerToolSubset(server, options) {
   });
   register("candle_execution_status", {
     title: "Can this key execute right now",
-    description: "One call before trading: the embedded wallets to spend from, the tier that decides what " + "may be traded, and this key's own spend limits. Reads only; moves nothing. Call it when " + "a run starts, or after an authorization error, rather than inferring readiness from a " + "failed trade. If a read could not be completed the tool says which one and does NOT " + "claim the account is unready: an unreachable endpoint and a missing tier are different " + "problems with different fixes.",
+    description: "One call before trading: the embedded wallets to spend from, the tier that decides what " + "may be traded, this key's own spend limits, and its loss limits and stop state (risk: " + "lossLimits, state, stopped, tripped). A stopped key reports ready: false and a top-level " + "stopped naming the bound that broke; every trade answers RISK_LIMIT_REACHED until an " + "account owner resumes it, so stop trading and say why rather than retrying. Any scope " + "can read its own. Reads only; moves nothing. Call it when " + "a run starts, or after an authorization error, rather than inferring readiness from a " + "failed trade. If a read could not be completed the tool says which one and does NOT " + "claim the account is unready: an unreachable endpoint and a missing tier are different " + "problems with different fixes.",
     inputSchema: {}
   }, async () => {
     const result = await executionStatus(getConfig(), doFetch);
@@ -45780,6 +45882,13 @@ function registerToolSubset(server, options) {
     const result = await executeTrade(args, getConfig(), doFetch);
     return { content: [{ type: "text", text: result.text }], ...result.isError ? { isError: true } : {} };
   });
+  register("candle_trade_execute", {
+    title: "Execute a deferred trade",
+    description: "Execute a trade you built with candle_trade and deferExecution: true. MOVES REAL FUNDS: Candle signs " + "the plan it kept back from the build with the account's own delegation and broadcasts it. Takes the " + "clientTradeId and nothing else, so nothing you send can change what gets signed; to change the trade, " + `build a new one.
+
+` + "Exactly one execution per build. Calling again never broadcasts a second time: it returns the stored " + "result once the first has confirmed, and a 409 IDEMPOTENCY_CONFLICT while the outcome is still " + "unknown (read candle_get_operation with the clientTradeId, kind trade, before doing anything else). " + "More than 30 minutes after the build it is 409 QUOTE_EXPIRED: build again for a fresh quote. A " + "trade built without deferExecution has already executed and is refused here.",
+    inputSchema: tradeExecuteShape
+  }, async (args) => callAndRelay("candle_trade_execute", args, getConfig(), doFetch));
   register("candle_atomic_launch_dry_run", {
     title: "Dry-run an atomic Solana launch",
     description: "Check a Solana launch bundled with first buys and price each buy, without building anything. Runs the " + "same checks as the atomic build, in the same order (payers, Believer check, fee and spend limits, the " + "key's transaction cap), then returns the launch preview (curveTerms) and one fill per first buy: the " + "tokens it would receive and the floor the build would sign it at. Reads only; moves nothing, reserves " + "nothing, and the clientLaunchId stays unused. It does not check balances, the daily cap, or the " + "transaction's size, so the real launch can still refuse. Needs launch:write, swap:write and Pro or Max.",
@@ -45988,7 +46097,7 @@ async function registerEligibleProfileTool(server, env = process.env, doFetch =
   }
   return eligible;
 }
-var VAMP_CANDIDATES_DESCRIPTION, localProfileTools, STAKING_DISCLOSURE = "No instant unstake. Read pool.withdrawalTimelockSeconds for the wait. Solana rewards accrue to the holding wallet. sCNDL in any eligible account wallet counts toward Pro and earns the account's Hood staking reward, except a wallet another account also claims, wallets past the 200-wallet cap, and an account with no EVM wallet. CNDL in a pending withdrawal counts toward nothing for Pro.", stakingWriteShape, TOOL_NAMES, LAB_TOOL_NAMES, PROFILE_EDIT_TOOL_NAMES, isProfileEditTool = (name) => PROFILE_EDIT_TOOL_NAMES.includes(name), OPERATION_NOT_FOUND_RULE, getMarketShape, priceHistoryShape, TOKEN_EVENTS_LIMIT_MESSAGE = "limit must be a whole number from 1 to 1000", tokenEventsLimit, TOKEN_EVENTS_KIND_NOTE = "kept back from the request and applied to the returned page by this server, so a filtered page can be shorter than limit while older events of other kinds remain: page with nextCursor as before until it is null", tokenCardShape, tokenEventsShape, tokenForensicsShape, FEED_LIMIT_MESSAGE = "limit must be a whole number from 1 to 200", feedLimit, getFeedShape, reportActivityShape, getAgentProfileShape, listAgentsShape, createPostShape, deletePostShape, listAgentPostsShape, getAgentPositionsShape, getOperationShape, vampCandidatesShape, getFeesShape, atomicPayerShape, atomicLaunchDryRunShape, claimFeesShape, resolveTokenShape, profileWalletsShape, profilePnlShape, profileTradesShape, setProfileWalletsShape, swapShape, tradeShape, tokenImageUrl, tokenBannerUrl, localImageShape, localLaunchTokenShape, localLaunchAndSeedShape, IMAGE_PATH_DISCLOSURE, transferShape, sweepShape, PROFILE_PNL_HYPERLIQUID;
+var VAMP_CANDIDATES_DESCRIPTION, localProfileTools, STAKING_DISCLOSURE = "No instant unstake. Read pool.withdrawalTimelockSeconds for the wait. Solana rewards accrue to the holding wallet. sCNDL in any eligible account wallet counts toward Pro and earns the account's Hood staking reward, except a wallet another account also claims, wallets past the 200-wallet cap, and an account with no EVM wallet. CNDL in a pending withdrawal counts toward nothing for Pro.", stakingWriteShape, TOOL_NAMES, LAB_TOOL_NAMES, PROFILE_EDIT_TOOL_NAMES, isProfileEditTool = (name) => PROFILE_EDIT_TOOL_NAMES.includes(name), OPERATION_NOT_FOUND_RULE, getMarketShape, priceHistoryShape, TOKEN_EVENTS_LIMIT_MESSAGE = "limit must be a whole number from 1 to 1000", tokenEventsLimit, TOKEN_EVENTS_KIND_NOTE = "kept back from the request and applied to the returned page by this server, so a filtered page can be shorter than limit while older events of other kinds remain: page with nextCursor as before until it is null", tokenCardShape, tokenEventsShape, tokenForensicsShape, FEED_LIMIT_MESSAGE = "limit must be a whole number from 1 to 200", feedLimit, getFeedShape, reportActivityShape, getAgentProfileShape, listAgentsShape, createPostShape, deletePostShape, listAgentPostsShape, getAgentPositionsShape, getOperationShape, vampCandidatesShape, getFeesShape, atomicPayerShape, atomicLaunchDryRunShape, claimFeesShape, resolveTokenShape, profileWalletsShape, profilePnlShape, profileTradesShape, noArgsShape, setProfileWalletsShape, swapShape, tradeShape, tradeExecuteShape, tokenImageUrl, tokenBannerUrl, localImageShape, localLaunchTokenShape, localLaunchAndSeedShape, IMAGE_PATH_DISCLOSURE, transferShape, sweepShape, PROFILE_PNL_HYPERLIQUID;
 var init_tools = __esm(() => {
   init_zod();
   init_client2();
@@ -46053,6 +46162,7 @@ var init_tools = __esm(() => {
     "candle_get_agent_positions",
     "candle_get_plans",
     "candle_trade",
+    "candle_trade_execute",
     "candle_launch_and_seed",
     "candle_atomic_launch_dry_run",
     "candle_swap",
@@ -46063,6 +46173,9 @@ var init_tools = __esm(() => {
     "candle_set_profile_wallets",
     "candle_get_profile_pnl",
     "candle_get_profile_trades",
+    "candle_get_paper_inventory",
+    "candle_get_profile_paper",
+    "candle_get_account_pnl",
     "candle_get_portfolio",
     "candle_resolve_token",
     "candle_execution_status",
@@ -46245,8 +46358,12 @@ var init_tools = __esm(() => {
   };
   profileTradesShape = {
     keyPrefix: exports_external.string().describe("The profile's API key prefix"),
-    limit: exports_external.number().optional().describe("How many of the most recent trades to return. Default 200, max 1000.")
+    limit: exports_external.number().optional().describe("How many of the most recent trades to return. Default 200, max 1000."),
+    since: exports_external.string().optional().describe("Inclusive lower bound on the trade's createdAt: an ISO 8601 time or epoch milliseconds."),
+    until: exports_external.string().optional().describe("Exclusive upper bound on createdAt, in the same forms as `since`."),
+    cursor: exports_external.string().optional().describe("The `nextCursor` of the previous page, to continue the same window.")
   };
+  noArgsShape = {};
   setProfileWalletsShape = {
     keyPrefix: exports_external.string().describe("The profile's API key prefix"),
     walletIds: exports_external.array(exports_external.string()).describe("The linked-wallet ids the profile may spend from -- ids, not addresses. This REPLACES the " + "whole set: any wallet omitted loses access. An empty array assigns none.")
@@ -46267,7 +46384,11 @@ var init_tools = __esm(() => {
     quoteAsset: exports_external.string().optional().describe('What the wallet spends on a buy or receives on a sell: "sol", "usdc" or "cndl" on Solana, ' + '"eth" or "usdg" on Hood. Echoing the `quoteAsset` a quote (POST /api/v1/trade/agent/quote) returned is safe. On Solana it applies only ' + "to an arbitrary mint Candle never launched (a buy or sell works on any plan) and is ignored for a Candle token, " + "whose quote comes from the token itself. On Hood it is the settlement asset of a DEX " + "trade; a USDG buy adds an approval transaction an ETH buy does not. It is not the route: " + "the cheapest path to the asset is chosen separately. Defaults to sol / ETH settlement."),
     maxSlippageBps: exports_external.number().int().min(0).max(5000).optional().describe("Slippage bound in bps, 0-5000 (50%). Server defaults to 100 (1%)"),
     clientTradeId: exports_external.string().optional().describe("Idempotency key. Auto-generated when omitted and echoed in the result. Retrying with the " + "SAME id is safe (idempotent replay); a new id is a SECOND trade."),
-    paper: exports_external.preprocess((value) => value === "true" || value === 1 || value === "1" ? true : value === "false" || value === 0 || value === "0" ? false : value, exports_external.boolean().optional().describe("Rehearse instead of trading. The request passes every admission rule a live trade passes " + "-- the same planner, spend gate, key cap and loss limits -- and records the quote, but " + "nothing is ever broadcast and no funds move. Use it to check that a strategy is admitted " + "before risking anything on it. A paper fill is optimistic by construction: it books the " + "quoted price, so the gap between a paper arm and a live one IS the execution cost. " + "A sell of a mint this key already paper-bought also closes that paper book when the " + "live wallet is empty, even if this flag is omitted."))
+    paper: exports_external.preprocess((value) => value === "true" || value === 1 || value === "1" ? true : value === "false" || value === 0 || value === "0" ? false : value, exports_external.boolean().optional().describe("Rehearse instead of trading. The request passes every admission rule a live trade passes " + "-- the same planner, spend gate, key cap and loss limits -- and records the quote, but " + "nothing is ever broadcast and no funds move. Use it to check that a strategy is admitted " + "before risking anything on it. A paper fill is optimistic by construction: it books the " + "quoted price, so the gap between a paper arm and a live one IS the execution cost. " + "A sell of a mint this key already paper-bought also closes that paper book when the " + "live wallet is empty, even if this flag is omitted.")),
+    deferExecution: exports_external.preprocess((value) => value === "true" || value === 1 || value === "1" ? true : value === "false" || value === 0 || value === "0" ? false : value, exports_external.boolean().optional().describe("Quote first, spend later. The trade is built and the result carries the quote with " + 'status "built"; NOTHING is signed or spent until candle_trade_execute is called with the same ' + "clientTradeId. The build holds for 30 minutes; executing after that is QUOTE_EXPIRED and you " + "build again for a fresh quote. Rebuilding with the same clientTradeId re-quotes it, until it has " + "been sent to candle_trade_execute. There is no cancel: let an unwanted build expire. Cannot be " + "combined with `paper`."))
+  };
+  tradeExecuteShape = {
+    clientTradeId: exports_external.string().min(1).describe("The clientTradeId of a candle_trade built with deferExecution: true. Nothing else is accepted.")
   };
   tokenImageUrl = launchSchemaField(launchTokenShape, "imageUrl");
   tokenBannerUrl = launchSchemaField(launchTokenShape, "bannerUrl");
@@ -74092,29 +74213,11 @@ ${USAGE3}` : USAGE3, ctx.json);
 }
 
 // src/commands/auth.ts
-import { homedir as homedir3 } from "node:os";
-import { join as join9 } from "node:path";
-
-// src/account.ts
-init_client();
-async function fetchAccount(deps, apiUrl, apiKey) {
-  const identity = await apiRequest("/api/v1/agent/wallets/embedded", {
-    auth: "key",
-    credentials: { apiKey },
-    apiUrl,
-    fetch: deps.fetch,
-    env: deps.env
-  });
-  const body = identity.ok ? identity.body : undefined;
-  const account = body?.account;
-  if (account)
-    return { account, ...body?.username ? { username: body.username } : {} };
-  return { failure: identity.ok ? "no account in the response" : identity.message };
-}
-
-// src/commands/auth.ts
+init_account();
 init_agent_key_access();
 init_args();
+import { homedir as homedir3 } from "node:os";
+import { join as join9 } from "node:path";
 
 // src/checks.ts
 init_client();
@@ -76510,9 +76613,9 @@ var HELP = {
     group: "Account",
     intro: "Holdings, prices and value of every wallet",
     summary: "Every wallet's holdings, prices and value on Solana and Hood (vault read over your own RPCs)",
-    description: "Vault, TEE and embedded wallets on Solana and Hood, each token with its chain, amount, price and value, then subtotals per group and per chain and one total. TEE and embedded balances, on both chains, come from Candle. Solana vault and external wallets are read over your own Solana RPC, and Candle is sent only the mints they hold, for prices. EVM vault keys are read over your own EVM RPC for ETH and USDG only (the CLI cannot list other tokens), which must be Hood's (chain id 4663); any other chain is refused. Their prices come from Candle by asset (ETH, USDG), never by address. Unpriced tokens are shown as unpriced with the reason (no-market-row, stale-mark, unusable-price, source-unavailable) and left out of the total. A wallet that could not be read in full is marked not read, the footer names its chain, and the exit is 3. Where Candle serves LP, each Solana TEE wallet's DAMM v2 positions follow the tokens (share of the pool plus unclaimed fees, valued by Candle at the same marks) and count in the total; a position whose pool could not be read is shown as not read and the total says it is partial. A bridge moves value between the chain subtotals; it is not a trade. With a filter, only the wallets whose label or address contains it are read and shown, the subtotals and total are for those wallets, and the first line says how many matched. When Candle listed only part of the account's wallets, the result stays partial even if every wallet shown was read, and no match says so. After the totals, a Hyperliquid section (live from Hyperliquid, not in the ledger, and never in the total) lists each EVM TEE wallet's Hyperliquid account value, unrealized P&L, positions and risk at the default thresholds, read from Hyperliquid's public API on this machine; a failed read there is not read and the exit is 3. --chain solana and --no-perps read nothing from Hyperliquid.",
+    description: "Vault, TEE and embedded wallets on Solana and Hood, each token with its chain, amount, price and value, then subtotals per group and per chain and one total. TEE and embedded balances, on both chains, come from Candle. Solana vault and external wallets are read over your own Solana RPC, and Candle is sent only the mints they hold, for prices. EVM vault keys are read over your own EVM RPC for ETH and USDG only (the CLI cannot list other tokens), which must be Hood's (chain id 4663); any other chain is refused. Their prices come from Candle by asset (ETH, USDG), never by address. Unpriced tokens are shown as unpriced with the reason (no-market-row, stale-mark, unusable-price, source-unavailable) and left out of the total. A wallet that could not be read in full is marked not read, the footer names its chain, and the exit is 3. Where Candle serves LP, each Solana TEE wallet's DAMM v2 positions follow the tokens (share of the pool plus unclaimed fees, valued by Candle at the same marks) and count in the total; a position whose pool could not be read is shown as not read and the total says it is partial. A bridge moves value between the chain subtotals; it is not a trade. With a filter, only the wallets whose label or address contains it are read and shown, the subtotals and total are for those wallets, and the first line says how many matched. When Candle listed only part of the account's wallets, the result stays partial even if every wallet shown was read, and no match says so. After the totals, a Hyperliquid section (live from Hyperliquid, not in the ledger, and never in the total) lists each EVM TEE wallet's Hyperliquid account value, unrealized P&L, positions and risk at the default thresholds, read from Hyperliquid's public API on this machine; a failed read there is not read and the exit is 3. --chain solana and --no-perps read nothing from Hyperliquid. The vault is read only for its addresses, so the command needs no terminal: without one, a factor that asks nothing (--factor touch-id or passkey) still unlocks it, and otherwise the vault row says not read and the other groups are shown, but the result is partial: the total says so and the exit is 3. --no-vault leaves the vault out on purpose, and then the result can be complete (exit 0).",
     usage: [
-      "candle portfolio [<filter>] [--chain solana|hood] [--rpc-url <url>] [--evm-rpc-url <url>] [--no-perps] [--json]"
+      "candle portfolio [<filter>] [--chain solana|hood] [--rpc-url <url>] [--evm-rpc-url <url>] [--no-perps] [--no-vault] [--json]"
     ],
     rows: [
       {
@@ -76534,6 +76637,10 @@ var HELP = {
         invocation: "--no-perps",
         description: "Skip the Hyperliquid section: send no EVM TEE address to Hyperliquid's public API"
       },
+      {
+        invocation: "--no-vault",
+        description: "Leave the vault out: no unlock, and no vault address is sent to your RPC"
+      },
       KEYSTORE_FLAG
     ],
     examples: [
@@ -76895,8 +77002,8 @@ var HELP = {
         description: "List live API keys: name and Read, Write or Withdraw access; --all includes revoked keys; --scopes adds the raw scopes"
       },
       {
-        invocation: "create [--access read|write|withdraw|trade-perps | --scopes <a,b,c>] [--label <name>] [--expires-in <days>] [--tx-limit <usd> [--reset daily|weekly|monthly|never]] [--embedded-wallet deny|allow]",
-        description: "Create an API key; --access mints one of the levels (write trades and launches; only withdraw can move funds; trade-perps is exactly account:read and perps:write, for Hyperliquid perps setup and orders, and it cannot fund its own Hyperliquid account: a Relay deposit needs swap:write and a withdrawal needs perps:withdraw, each a separate grant through --scopes). A trade-perps key trades from an EVM TEE wallet promoted onto it (candle vault new-key --chain evm, then candle vault promote --from <cold> --to-key <prefix>; candle tee new is Solana only) and a signer on the trading machine (candle tee signer new --key <prefix>). --embedded-wallet defaults to deny; allow lets the key spend the account's embedded wallet and is confirmed at a terminal"
+        invocation: "create [--access read|write|withdraw|trade-perps | --scopes <a,b,c>] [--label <name>] [--expires-in <days>] [--tx-limit <usd> [--reset daily|weekly|monthly|never]] [--embedded-wallet deny|allow] [--no-store]",
+        description: "Create an API key; --no-store prints it without saving it as the profile's working key (default: store only if no working key exists). --access mints one of the levels (write trades and launches; only withdraw can move funds; trade-perps is exactly account:read and perps:write, for Hyperliquid perps setup and orders, and it cannot fund its own Hyperliquid account: a Relay deposit needs swap:write and a withdrawal needs perps:withdraw, each a separate grant through --scopes). A trade-perps key trades from an EVM TEE wallet promoted onto it (candle vault new-key --chain evm, then candle vault promote --from <cold> --to-key <prefix>; candle tee new is Solana only) and a signer on the trading machine (candle tee signer new --key <prefix>). --embedded-wallet defaults to deny; allow lets the key spend the account's embedded wallet and is confirmed at a terminal"
       },
       {
         invocation: "access <prefix|label|self> (--access read|write|withdraw [--yes] | --history)",
@@ -76910,6 +77017,10 @@ var HELP = {
         invocation: "limit <prefix|label> (--tx-limit <usd> [--reset daily|weekly|monthly|never] | --clear)",
         description: "Set or clear the USD transaction cap on an existing key, with the device token. --reset defaults to daily"
       },
+      {
+        invocation: "limits <prefix> <asset>=<raw> [<asset>=<raw> ...]",
+        description: "Set a key's per-asset caps (sol, usdc, cndl, eth, usdg; a whole number of base units per transaction) with the profile's own API key. It can only lower a cap or add one; raising or removing one is refused (LOOSEN_REQUIRES_SESSION) and is the owner's, in the web key manager. The list replaces the key's caps"
+      },
       {
         invocation: "self embedded-wallet deny",
         description: "The profile's own key gives up the embedded wallet, with no prompt. A key can never allow itself: the owner does that with keys update"
@@ -76946,11 +77057,12 @@ var HELP = {
       "candle keys list",
       "candle keys create --access withdraw --label rebalancer",
       "candle keys create --access trade-perps --label perps-bot",
-      "candle keys create --scopes trade:write --label agent-one",
+      "candle keys create --scopes trade:write --label agent-one --no-store",
       "candle keys access cndl --access withdraw",
       "candle keys access self --access read --yes",
       "candle keys update agent-one --embedded-wallet deny --yes",
       "candle keys self embedded-wallet deny",
+      "candle keys limits Ab3dEf9h sol=1000000000 usdc=50000000",
       "candle keys wallets ck_live_ab12",
       "candle tee rebind --label-prefix dest- --to-key Ab3dEf9h",
       "candle keys signer approve ABCD-EFGH --key tr-2",
@@ -76981,6 +77093,10 @@ var HELP = {
         description: "Give agents access to the account's embedded wallets: opens the Agents page's grant step in your browser (no key is created) and, with an API key, waits until it lands"
       },
       { invocation: "revoke <wallet-id>", description: "Revoke a linked wallet" },
+      {
+        invocation: "allowlist [--all]",
+        description: "The account's withdrawal allowlist (the destinations candle transfer --to <label> resolves by). Any key reads it; approving an address is the owner's, in the agent console's Wallets tab (an API key cannot approve); an acting key can revoke one, a read-only key cannot. --all adds removed rows"
+      },
       {
         invocation: "trust <label|address|id|prefix*>...",
         description: "Mark linked wallets yours, so agents can move funds into them (owner only; typed confirm)"
@@ -77014,6 +77130,7 @@ var HELP = {
       "candle wallet authorize",
       "candle wallet import --chain solana --key-file ./signer.json",
       "candle wallet revoke wal_123",
+      "candle wallet allowlist",
       "candle wallet trust 'tr-*' 'dest-*'",
       "candle wallet allow-launch launcher-1",
       "candle wallet close-empty --keep EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
@@ -77872,6 +77989,9 @@ var TOOL_CLASSES = {
   candle_get_profile_wallets: READ,
   candle_get_profile_pnl: READ,
   candle_get_profile_trades: READ,
+  candle_get_paper_inventory: READ,
+  candle_get_profile_paper: READ,
+  candle_get_account_pnl: READ,
   candle_get_portfolio: READ,
   candle_resolve_token: READ,
   candle_execution_status: READ,
@@ -77891,6 +78011,7 @@ var TOOL_CLASSES = {
   candle_perps_risk: READ,
   candle_perps_thresholds: READ,
   candle_trade: card("trade", "clientTradeId"),
+  candle_trade_execute: card("trade"),
   candle_swap: card("swap", "clientSwapId"),
   candle_launch_token: card("launch", "clientLaunchId"),
   candle_launch_and_seed: card("launch", "clientLaunchId"),
@@ -77980,7 +78101,8 @@ async function readOnce(executor, target, writeKey) {
   if (!readsById(target))
     return { readable: false };
   const kind = target.kind === "launch" ? "launch" : "trade";
-  const outcome = await executor.execute("candle_get_operation", { clientId: target.opId, kind }, writeKey);
+  const clientId = target.tool === "candle_trade_execute" ? target.params.clientTradeId : target.opId;
+  const outcome = await executor.execute("candle_get_operation", { clientId, kind }, writeKey);
   if (outcome.state === "succeeded" || outcome.state === "pending") {
     const job = outcome.result?.job ?? outcome.result;
     const status = typeof job?.status === "string" ? job.status : "";
@@ -89471,8 +89593,7 @@ async function externalList(args, ctx) {
     return usage(ctx, `Unexpected argument: ${parsed.positionals[0]}`);
   if (!refuseEnvPassphrase(ctx))
     return 1;
-  if (!requireTty(ctx, "external list"))
-    return 1;
+  const promptCtx = refusePromptsWithoutTerminal(ctx, "external list");
   const { deps } = ctx;
   const resolvedVault = vaultPathFor(ctx, parsed);
   if ("error" in resolvedVault)
@@ -89480,7 +89601,7 @@ async function externalList(args, ctx) {
   const path = resolvedVault.path;
   return runVaultCommand(ctx, async ({ hold }) => {
     const raw = await requireVaultRaw(ctx, resolvedVault);
-    const vault = hold((await unlockInteractively(ctx, path, raw, { acceptOlderCopy: parsed.booleans.has("--accept-older-copy") })).vault);
+    const vault = hold((await unlockInteractively(promptCtx, path, raw, { acceptOlderCopy: parsed.booleans.has("--accept-older-copy") })).vault);
     const externals = vault.index.entries.filter((entry) => entry.role === "external");
     const rows = externals.map((entry) => ({
       address: entry.address,
@@ -90263,6 +90384,100 @@ ${fields(rows, style).join(`
   return 0;
 }
 
+// src/commands/keys-limits.ts
+init_args();
+init_client();
+init_deps();
+init_presentation();
+init_profiles();
+init_key_output();
+var USAGE8 = "Usage: candle keys limits <prefix> <asset>=<raw-amount> [<asset>=<raw-amount> ...]";
+var KEY_LIMIT_ASSETS = { sol: 9, usdc: 6, cndl: 6, eth: 18, usdg: 6 };
+var RAW_AMOUNT = /^[1-9][0-9]*$/;
+var NO_API_KEY3 = {
+  code: "API_KEY_REQUIRED",
+  message: "candle keys limits changes caps with an API key, and this profile holds none.",
+  suggestion: "Select the profile holding the key with --profile. A device token cannot set per-asset caps."
+};
+var LOOSEN_HINT = "This command can only lower a cap. Raising or removing one needs the owner's session: use the web key manager.";
+async function keysLimits(args, ctx) {
+  const { deps, apiUrl, json } = ctx;
+  const parsed = parseArgs(args, { keyPrefixPositional: true });
+  if ("error" in parsed) {
+    writeScreenUsageFailure(deps, parsed.error, json);
+    return 2;
+  }
+  const target = parsed.positionals[0];
+  const caps = parsed.positionals.slice(1);
+  if (!target || caps.length === 0) {
+    writeScreenUsageFailure(deps, USAGE8, json);
+    return 2;
+  }
+  const limits = [];
+  for (const cap of caps) {
+    const eq = cap.indexOf("=");
+    const asset = (eq < 0 ? cap : cap.slice(0, eq)).toLowerCase();
+    const raw = eq < 0 ? "" : cap.slice(eq + 1);
+    if (!(asset in KEY_LIMIT_ASSETS)) {
+      writeScreenUsageFailure(deps, `The asset must be one of: ${Object.keys(KEY_LIMIT_ASSETS).join(", ")}.`, json);
+      return 2;
+    }
+    if (!RAW_AMOUNT.test(raw)) {
+      writeScreenUsageFailure(deps, `${asset}=<raw> takes a positive whole number of base units (${asset} has ${KEY_LIMIT_ASSETS[asset]} decimals), with no sign, decimal point or leading zero.`, json);
+      return 2;
+    }
+    if (limits.some((limit) => limit.asset === asset)) {
+      writeScreenUsageFailure(deps, `${asset} is named twice.`, json);
+      return 2;
+    }
+    limits.push({ asset, maxPerTxRaw: raw });
+  }
+  await printIdentity(ctx);
+  const apiKey = await resolveApiKey(deps, ctx.profile);
+  if (!apiKey) {
+    writeScreenLocalFailure(deps, NO_API_KEY3, json);
+    return 1;
+  }
+  const result = await apiRequest(`/api/v1/agent/keys/${encodeURIComponent(target)}/limits`, {
+    method: "PUT",
+    auth: "key",
+    credentials: { apiKey },
+    apiUrl,
+    fetch: deps.fetch,
+    env: deps.env,
+    body: { limits }
+  });
+  if (!result.ok) {
+    if (!json && result.code === "LOOSEN_REQUIRES_SESSION")
+      writeScreenLocalFailure(deps, {
+        code: "LOOSEN_REQUIRES_SESSION",
+        message: "That would raise or remove a cap; nothing changed.",
+        suggestion: LOOSEN_HINT
+      }, json);
+    else
+      writeScreenFailure(deps, result, { apiUrl, authType: "key" }, json);
+    return 1;
+  }
+  const stored = result.body.limits ?? limits;
+  if (json) {
+    deps.stdout.write(`${JSON.stringify({ ok: true, keyPrefix: target, limits: stored })}
+`);
+    return 0;
+  }
+  const style = terminalStyle(deps, "stdout");
+  const rows = [
+    ["Key", target],
+    ...stored.map((limit) => [limit.asset, `${limit.maxPerTxRaw} base units per transaction`])
+  ];
+  deps.stdout.write(`${success("Per-asset caps updated", style)}
+
+${heading("Caps", style)}
+${fields(rows, style).join(`
+`)}
+`);
+  return 0;
+}
+
 // src/commands/keys-rotate.ts
 init_args();
 init_client();
@@ -90292,7 +90507,7 @@ var TOKEN_PAGE_BODY_CAP_BYTES = 32 * 1024;
 var TOKEN_PAGE_SECTIONS = ["thesis", "tokenomics", "lore"];
 var FLAG_REASONS = ["spam", "scam", "abuse", "misleading", "unsafe_link", "other"];
 var FLAG_DETAIL_LIMIT = 500;
-var USAGE8 = {
+var USAGE9 = {
   about: "Usage: candle token about <address> [--chain solana|hood] [--capabilities]",
   claim: "Usage: candle token claim <address> [--chain solana|hood] [--creator [--challenge [--message-out <path>] | --challenge-id <id> --signature <sig>]] [--idempotency-key <key>]",
   section: `Usage: candle token section set <address> <thesis|tokenomics|lore> --file <path> --base-revision <n> [--clear] [--chain solana|hood] [--idempotency-key <key>]
@@ -90552,7 +90767,7 @@ function terminalTextKeepingLines(text3) {
 `);
 }
 async function tokenAbout(args, ctx) {
-  const usage4 = usageFor(ctx, USAGE8.about);
+  const usage4 = usageFor(ctx, USAGE9.about);
   const parsed = parseArgs(args, { valueFlags: ["--chain"], booleanFlags: ["--capabilities"] });
   if ("error" in parsed)
     return usage4(parsed.error);
@@ -90598,7 +90813,7 @@ async function tokenAbout(args, ctx) {
   return 0;
 }
 async function tokenClaim(args, ctx) {
-  const usage4 = usageFor(ctx, USAGE8.claim);
+  const usage4 = usageFor(ctx, USAGE9.claim);
   const parsed = parseArgs(args, {
     valueFlags: ["--chain", "--challenge-id", "--signature", "--message-out", "--idempotency-key"],
     booleanFlags: ["--creator", "--challenge"],
@@ -90725,7 +90940,7 @@ var SECTION_FLAGS = {
   restore: { valueFlags: ["--chain", "--version-id", "--base-revision", "--idempotency-key"], booleanFlags: [] }
 };
 async function tokenSection(args, ctx) {
-  const usage4 = usageFor(ctx, USAGE8.section);
+  const usage4 = usageFor(ctx, USAGE9.section);
   const action = args[0];
   if (action !== "set" && action !== "restore")
     return usage4();
@@ -90818,7 +91033,7 @@ async function tokenSection(args, ctx) {
   return 0;
 }
 async function tokenHistory(args, ctx) {
-  const usage4 = usageFor(ctx, USAGE8.history);
+  const usage4 = usageFor(ctx, USAGE9.history);
   const parsed = parseArgs(args, { valueFlags: ["--chain", "--limit", "--cursor"] });
   if ("error" in parsed)
     return usage4(parsed.error);
@@ -90873,7 +91088,7 @@ More: --cursor ${data.nextCursor}
   return 0;
 }
 async function tokenFlag(args, ctx) {
-  const usage4 = usageFor(ctx, USAGE8.flag);
+  const usage4 = usageFor(ctx, USAGE9.flag);
   const parsed = parseArgs(args, { valueFlags: ["--chain", "--content", "--reason", "--detail", "--idempotency-key"] });
   if ("error" in parsed)
     return usage4(parsed.error);
@@ -90968,7 +91183,7 @@ async function tokenUpdate(args, ctx) {
   return 0;
 }
 async function tokenComment(args, ctx) {
-  const usage4 = usageFor(ctx, USAGE8.comment);
+  const usage4 = usageFor(ctx, USAGE9.comment);
   const parsed = parseArgs(args, { valueFlags: ["--chain", "--file", "--idempotency-key"], pathFlags: ["--file"] });
   if ("error" in parsed)
     return usage4(parsed.error);
@@ -91013,7 +91228,7 @@ async function tokenComment(args, ctx) {
   return 0;
 }
 async function tokenComments(args, ctx) {
-  const usage4 = usageFor(ctx, USAGE8.comments);
+  const usage4 = usageFor(ctx, USAGE9.comments);
   const parsed = parseArgs(args, { valueFlags: ["--chain", "--limit", "--cursor"] });
   if ("error" in parsed)
     return usage4(parsed.error);
@@ -91100,7 +91315,7 @@ async function tokenPost(args, ctx) {
 }
 
 // src/commands/keys-rotate.ts
-var USAGE9 = `Usage: candle keys rotate <prefix|label> [--grace <duration> | --now] [--force] [--yes] [--idempotency-key <key>]
+var USAGE10 = `Usage: candle keys rotate <prefix|label> [--grace <duration> | --now] [--force] [--yes] [--idempotency-key <key>]
        candle keys rotate <prefix|label> --finish`;
 var MAX_GRACE_SECONDS = 86400;
 var DEFAULT_GRACE_SECONDS = 3600;
@@ -91127,7 +91342,7 @@ async function keysRotate(args, ctx) {
   }
   const target = parsed.positionals[0];
   if (!target || parsed.positionals.length !== 1) {
-    writeScreenUsageFailure(deps, USAGE9, json);
+    writeScreenUsageFailure(deps, USAGE10, json);
     return 2;
   }
   const finish = parsed.booleans.has("--finish");
@@ -91380,7 +91595,7 @@ init_presentation();
 init_profiles();
 init_render();
 init_key_output();
-var NO_API_KEY3 = {
+var NO_API_KEY4 = {
   code: "NO_API_KEY",
   message: "No API key for this profile.",
   suggestion: "Set CANDLE_API_KEY, or run `candle keys create` and store one."
@@ -91404,7 +91619,7 @@ async function keysWalletsList(args, ctx) {
   await printIdentity(ctx);
   const apiKey = await resolveApiKey(deps, ctx.profile);
   if (!apiKey) {
-    writeScreenLocalFailure(deps, NO_API_KEY3, json);
+    writeScreenLocalFailure(deps, NO_API_KEY4, json);
     return 1;
   }
   const result = await apiRequest(`/api/v1/agent/keys/${encodeURIComponent(prefix)}/wallets`, {
@@ -91470,7 +91685,7 @@ async function keysWalletsSet(args, ctx) {
   await printIdentity(ctx);
   const apiKey = await resolveApiKey(deps, ctx.profile);
   if (!apiKey) {
-    writeScreenLocalFailure(deps, NO_API_KEY3, json);
+    writeScreenLocalFailure(deps, NO_API_KEY4, json);
     return 1;
   }
   const result = await apiRequest(`/api/v1/agent/keys/${encodeURIComponent(prefix)}/wallets`, {
@@ -91525,7 +91740,7 @@ async function keysWalletsScope(args, ctx) {
   await printIdentity(ctx);
   const apiKey = await resolveApiKey(deps, ctx.profile);
   if (!apiKey) {
-    writeScreenLocalFailure(deps, NO_API_KEY3, json);
+    writeScreenLocalFailure(deps, NO_API_KEY4, json);
     return 1;
   }
   const result = await apiRequest(`/api/v1/agent/keys/${encodeURIComponent(prefix)}/wallet-scope`, {
@@ -92047,6 +92262,8 @@ init_solana_lite();
 var NATIVE_MINT2 = "So11111111111111111111111111111111111111112";
 var LAMPORTS_PER_SIGNATURE = 5000n;
 var TOKEN_ACCOUNT_RENT_LAMPORTS = 2039280n;
+var BUYER_TALLY_RENT_LAMPORTS = 1461600n;
+var REGISTER_BUYER = [144, 92, 137, 46, 209, 220, 27, 164];
 var DEFAULT_UNITS_PER_INSTRUCTION = 200000n;
 var MAX_COMPUTE_UNITS = 1400000n;
 
@@ -92130,7 +92347,7 @@ function readLeg(tx, index, wallet3) {
     if (program === MEMO_PROGRAM_ID)
       continue;
     if (program !== undefined)
-      others.push({ program, data: ix.data });
+      others.push({ program, data: ix.data, accounts: accounts.map(key) });
   }
   if (unitPrice > 0n) {
     const units = unitLimit ?? (computed * DEFAULT_UNITS_PER_INSTRUCTION > MAX_COMPUTE_UNITS ? MAX_COMPUTE_UNITS : computed * DEFAULT_UNITS_PER_INSTRUCTION);
@@ -92138,12 +92355,36 @@ function readLeg(tx, index, wallet3) {
   }
   return { lamports, tokenOut, systemTransfers, others };
 }
+function isRegisterBuyer(data) {
+  return data.length >= 8 && REGISTER_BUYER.every((byte, i) => data[i] === byte);
+}
+function readRegisterBuyer(register, swap3, wallet3) {
+  if (register.program !== swap3.program)
+    throw new BundleReadError("leg 1 registers the buyer with another program");
+  if (register.data.length !== 12 || u323(register.data, 8) !== 0n)
+    throw new BundleReadError("leg 1 registers the buyer with a proof");
+  const [buyer, rentPayer, rules, tally] = register.accounts;
+  if (buyer !== wallet3)
+    throw new BundleReadError("leg 1 registers a buyer other than this wallet");
+  if (rules === undefined || tally === undefined || !swap3.accounts.includes(rules) || !swap3.accounts.includes(tally))
+    throw new BundleReadError("leg 1 registers the buyer for another pool than the one it buys");
+  return rentPayer === wallet3 ? BUYER_TALLY_RENT_LAMPORTS : 0n;
+}
 function readLaunchBundle(args) {
   const launch = readLeg(decodeLeg(args.legs[0], 0), 0, args.wallet);
   const buy = readLeg(decodeLeg(args.legs[1], 1), 1, args.wallet);
-  if (buy.others.length !== 1)
+  let registerLamports = 0n;
+  const first = buy.others[0];
+  if (first && isRegisterBuyer(first.data)) {
+    if (!args.rules)
+      throw new BundleReadError("leg 1 registers a buyer on a launch without rules");
+    const swap4 = buy.others[1];
+    if (buy.others.length !== 2 || !swap4 || isRegisterBuyer(swap4.data))
+      throw new BundleReadError("leg 1 is not one curve swap");
+    registerLamports = readRegisterBuyer(first, swap4, args.wallet);
+  } else if (buy.others.length !== 1)
     throw new BundleReadError("leg 1 is not one curve swap");
-  const swap3 = buy.others[0];
+  const swap3 = buy.others[buy.others.length - 1];
   if (u64(swap3.data, 8) !== args.buyRaw)
     throw new BundleReadError("leg 1 does not swap the confirmed --buy");
   if (args.minOutRaw !== undefined && u64(swap3.data, 16) !== args.minOutRaw)
@@ -92163,7 +92404,7 @@ function readLaunchBundle(args) {
     feeRaw = buy.tokenOut;
     quoteRaw = args.buyRaw + buy.tokenOut + launch.tokenOut;
   }
-  return { lamports: launch.lamports + buy.lamports, quoteRaw, feeRaw };
+  return { lamports: launch.lamports + buy.lamports + registerLamports, quoteRaw, feeRaw };
 }
 
 // src/launch-check.ts
@@ -92380,7 +92621,7 @@ function poolRequestFields(flags) {
 
 // src/commands/launch.ts
 init_swap();
-var USAGE10 = `Usage: ${LAUNCH_USAGE}`;
+var USAGE11 = `Usage: ${LAUNCH_USAGE}`;
 var EMBEDDED_WALLET_NAMES = new Set(LAUNCH_DEFINITION.wallet.embeddedNames);
 var LAUNCH_ARG_SPEC = {
   valueFlags: [
@@ -92491,7 +92732,7 @@ async function launch(args, ctx) {
   const dryRun = parsed.booleans.has("--dry-run");
   const check = parsed.booleans.has("--check");
   if (check && dryRun) {
-    writeUsageFailure(ctx.deps, `--check and --dry-run are two different stops; pass one. ${USAGE10}`, ctx.json);
+    writeUsageFailure(ctx.deps, `--check and --dry-run are two different stops; pass one. ${USAGE11}`, ctx.json);
     return 2;
   }
   const fieldProblem = launchFieldProblem(flags);
@@ -92501,11 +92742,11 @@ async function launch(args, ctx) {
   }
   const curveProblem = curveFlagProblem(flags);
   if (curveProblem) {
-    writeUsageFailure(ctx.deps, `${curveProblem} ${USAGE10}`, ctx.json);
+    writeUsageFailure(ctx.deps, `${curveProblem} ${USAGE11}`, ctx.json);
     return 2;
   }
   if (flags["--image"] !== undefined && flags["--image-url"] !== undefined) {
-    writeUsageFailure(ctx.deps, `Pass --image <path> or --image-url <https-url>, not both: a launch has one image. ${USAGE10}`, ctx.json);
+    writeUsageFailure(ctx.deps, `Pass --image <path> or --image-url <https-url>, not both: a launch has one image. ${USAGE11}`, ctx.json);
     return 2;
   }
   if (flags["--image-url"] !== undefined && !flags["--image-url"].startsWith("https://")) {
@@ -92518,24 +92759,24 @@ async function launch(args, ctx) {
   }
   const missingRequired = !flags["--name"] || !flags["--symbol"] || flags["--image"] === undefined && flags["--image-url"] === undefined || !flags["--wallet"];
   if (parsed.positionals.length || !check && missingRequired || !validClientId(id)) {
-    writeUsageFailure(ctx.deps, USAGE10, ctx.json);
+    writeUsageFailure(ctx.deps, USAGE11, ctx.json);
     return 2;
   }
   try {
     poolRequestFields(flags);
   } catch (error) {
-    writeUsageFailure(ctx.deps, `${error.message}. ${USAGE10}`, ctx.json);
+    writeUsageFailure(ctx.deps, `${error.message}. ${USAGE11}`, ctx.json);
     return 2;
   }
   let feeWallet;
   try {
     feeWallet = feeWalletSelection(flags);
   } catch (error) {
-    writeUsageFailure(ctx.deps, `${error.message}. ${USAGE10}`, ctx.json);
+    writeUsageFailure(ctx.deps, `${error.message}. ${USAGE11}`, ctx.json);
     return 2;
   }
   if (parsed.booleans.has("--require-fee-wallet") && !feeWallet) {
-    writeUsageFailure(ctx.deps, `--require-fee-wallet needs --fee-wallet <address>: pass the wallet this launch's fees earn to. ${USAGE10}`, ctx.json);
+    writeUsageFailure(ctx.deps, `--require-fee-wallet needs --fee-wallet <address>: pass the wallet this launch's fees earn to. ${USAGE11}`, ctx.json);
     return 2;
   }
   try {
@@ -92543,11 +92784,11 @@ async function launch(args, ctx) {
       launchBuyRaw(flags["--buy"], 18);
     const hinted = flagChain(flags);
     if (hinted === "hood" && feeWalletGiven(flags)) {
-      writeUsageFailure(ctx.deps, `--fee-wallet is Solana only; a Hood launch cannot take it. ${USAGE10}`, ctx.json);
+      writeUsageFailure(ctx.deps, `--fee-wallet is Solana only; a Hood launch cannot take it. ${USAGE11}`, ctx.json);
       return 2;
     }
     if (!check && hinted === "hood" && flags["--dex-version"] === undefined) {
-      writeUsageFailure(ctx.deps, `A Hood launch needs --dex-version v3|v4. ${USAGE10}`, ctx.json);
+      writeUsageFailure(ctx.deps, `A Hood launch needs --dex-version v3|v4. ${USAGE11}`, ctx.json);
       return 2;
     }
     let image;
@@ -92565,7 +92806,7 @@ async function launch(args, ctx) {
     let rules;
     if (!check && launchRulesGiven(flags)) {
       if (hinted === "hood") {
-        writeUsageFailure(ctx.deps, `${LAUNCH_RULES_SOLANA_ONLY} ${USAGE10}`, ctx.json);
+        writeUsageFailure(ctx.deps, `${LAUNCH_RULES_SOLANA_ONLY} ${USAGE11}`, ctx.json);
         return 2;
       }
       try {
@@ -92972,7 +93213,8 @@ async function atomicLaunch(ctx, key, args) {
       wallet: wallet3.address,
       quote: quoteAsset,
       buyRaw: BigInt(buy.raw),
-      ...minOut !== undefined ? { minOutRaw: BigInt(minOut) } : {}
+      ...minOut !== undefined ? { minOutRaw: BigInt(minOut) } : {},
+      rules: args.rules !== undefined
     });
   } catch (error) {
     if (!(error instanceof BundleReadError))
@@ -93385,7 +93627,7 @@ init_presentation();
 init_render();
 init_trading();
 init_swap();
-var USAGE11 = "Usage: candle launch status <mint-or-client-launch-id> [--wait]";
+var USAGE12 = "Usage: candle launch status <mint-or-client-launch-id> [--wait]";
 var LAUNCH_WAIT_MS = 10 * 60 * 1000;
 var LAUNCH_WAIT_POLL_MS = 1e4;
 var LIVE = new Set(["trading", "bonded", "migrated"]);
@@ -93431,7 +93673,7 @@ async function readStatus(ctx, key, id) {
 async function launchStatus(args, ctx) {
   const parsed = parseArgs(args, { booleanFlags: ["--wait"] });
   if ("error" in parsed || parsed.positionals.length !== 1 || !validClientId(parsed.positionals[0] ?? "")) {
-    writeUsageFailure(ctx.deps, USAGE11, ctx.json);
+    writeUsageFailure(ctx.deps, USAGE12, ctx.json);
     return 2;
   }
   const id = parsed.positionals[0];
@@ -93915,6 +94157,7 @@ var MCP_TOOL_NAMES = [
   "candle_get_plans",
   "candle_report_activity",
   "candle_trade",
+  "candle_trade_execute",
   "candle_swap",
   "candle_transfer",
   "candle_sweep",
@@ -93923,6 +94166,9 @@ var MCP_TOOL_NAMES = [
   "candle_set_profile_wallets",
   "candle_get_profile_pnl",
   "candle_get_profile_trades",
+  "candle_get_paper_inventory",
+  "candle_get_profile_paper",
+  "candle_get_account_pnl",
   "candle_get_portfolio",
   "candle_resolve_token",
   "candle_execution_status",
@@ -94044,7 +94290,8 @@ async function mcp(args, ctx) {
   }
   const identityConfig = await deps.readConfig();
   const identityFields = effectiveProfileFields(identityConfig, ctx.profile);
-  deps.stderr.write(`${identityLine(ctx.profile, identityFields.account, apiUrl, credentialEnvOverrides(deps.env), identityFields.username, identityStyle(deps, "stderr"))}
+  const identityOverrides = credentialEnvOverrides(deps.env);
+  deps.stderr.write(`${identityLine(ctx.profile, identityOverrides.length > 0 ? undefined : identityFields.account, apiUrl, identityOverrides.length > 0 ? identityOverrides : undefined, identityFields.username, identityStyle(deps, "stderr"))}
 
 `);
   if (parsed.booleans.has("--print-config")) {
@@ -99328,7 +99575,7 @@ init_swap();
 init_vault_support();
 var WITHDRAW_SCOPE = "perps:withdraw";
 var ID_RE = /^[A-Za-z0-9._:-]{1,128}$/;
-var USAGE12 = "Usage: candle perps withdraw <amount> --to solana|hood [--wallet <evm tee>] [--id <id>] [--keystore <path>] | candle perps withdraw status <id>";
+var USAGE13 = "Usage: candle perps withdraw <amount> --to solana|hood [--wallet <evm tee>] [--id <id>] [--keystore <path>] | candle perps withdraw status <id>";
 var WITHDRAW_POLL_MS = 10 * 60 * 1000;
 var WITHDRAW_POLL_INTERVAL_MS = 5000;
 var TERMINAL = new Set(["settled", "refunded", "failed"]);
@@ -99379,7 +99626,7 @@ async function withdrawStatus(ctx, id) {
 async function perpsWithdraw(args, ctx) {
   if (args[0] === "status") {
     if (args.length !== 2 || !ID_RE.test(args[1]))
-      return usage10(ctx, USAGE12);
+      return usage10(ctx, USAGE13);
     try {
       return await withdrawStatus(ctx, args[1]);
     } catch (error) {
@@ -99398,7 +99645,7 @@ async function perpsWithdraw(args, ctx) {
   const [amount] = parsed.positionals;
   const to = parsed.values["--to"];
   if (parsed.positionals.length !== 1 || !amount || to !== "solana" && to !== "hood")
-    return usage10(ctx, USAGE12);
+    return usage10(ctx, USAGE13);
   const amountMicros = parseWithdrawAmount(amount);
   if (amountMicros === null)
     return usage10(ctx, "The amount must be a positive USDC decimal with at most 6 decimals.");
@@ -101480,12 +101727,12 @@ function planPromotionLine2(table) {
 init_presentation();
 init_render();
 init_key_output();
-var USAGE13 = "Usage: candle plans";
+var USAGE14 = "Usage: candle plans";
 async function plans(args, ctx) {
   const parsed = parseArgs(args, {});
   if ("error" in parsed || parsed.positionals.length > 0) {
     writeScreenUsageFailure(ctx.deps, "error" in parsed ? `${parsed.error}
-${USAGE13}` : USAGE13, ctx.json);
+${USAGE14}` : USAGE14, ctx.json);
     return 2;
   }
   const result = await apiRequest("/api/v1/agent/plans", {
@@ -101874,15 +102121,14 @@ async function runPlugin(name2, rawArgs, ctx) {
   if (split2.wallets.length > 0) {
     if (!refuseEnvPassphrase(ctx))
       return 1;
-    if (!requireTty(ctx, "candle <plugin> --wallet"))
-      return 1;
+    const promptCtx = refusePromptsWithoutTerminal(ctx, "candle <plugin> --wallet");
     const resolvedVault = vaultPathFor(ctx, { values: {}, booleans: new Set, positionals: [] });
     if ("error" in resolvedVault)
       return usage(ctx, resolvedVault.error);
     const vaultPath = resolvedVault.path;
     const resolved = await runVaultCommand(ctx, async ({ hold }) => {
       const raw = await requireVaultRaw(ctx, resolvedVault);
-      const vault = hold((await unlockInteractively(ctx, vaultPath, raw)).vault);
+      const vault = hold((await unlockInteractively(promptCtx, vaultPath, raw)).vault);
       for (const requested of split2.wallets) {
         const entry = findExternalEntry(vault.index, requested);
         if (entry === undefined) {
@@ -102100,7 +102346,7 @@ function writePosition(ctx, p) {
 // src/commands/pnl.ts
 var CHAINS = ["solana", "hood"];
 var CHAIN_TITLES = { solana: "Solana", hood: "Hood" };
-var NO_API_KEY4 = {
+var NO_API_KEY5 = {
   code: "NO_API_KEY",
   message: "No API key for this profile.",
   suggestion: "Set CANDLE_API_KEY, or run `candle auth login` to store one."
@@ -102119,7 +102365,7 @@ async function pnl(args, ctx) {
   }
   const apiKey = await resolveApiKey(deps, ctx.profile);
   if (!apiKey) {
-    writeLocalFailure(deps, NO_API_KEY4, json);
+    writeLocalFailure(deps, NO_API_KEY5, json);
     return 1;
   }
   const perProfile = ctx.profileFlag !== undefined;
@@ -102567,19 +102813,25 @@ var UNREAD_LABELS = {
   usdg: "USDG",
   "hood-tokens": "tokens"
 };
-var NO_API_KEY5 = {
+var NO_API_KEY6 = {
   code: "NO_API_KEY",
   message: "No API key for this profile.",
   suggestion: "Set CANDLE_API_KEY, or run `candle auth login` to store one."
 };
+var NO_TERMINAL_REASON = "not read: no terminal for its unlock";
+var NO_TERMINAL_NOTE = "The vault was not read: its unlock needs a prompt, and standard input and standard error are not both a terminal. Run it at a terminal, pass --factor touch-id or --factor passkey to unlock without a prompt, or pass --no-vault to leave it out.";
 async function portfolio(args, ctx) {
   const parsed = parseArgs(args, {
     valueFlags: ["--rpc-url", "--evm-rpc-url", "--keystore", "--chain"],
-    booleanFlags: ["--no-perps"],
+    booleanFlags: ["--no-perps", "--no-vault"],
     pathFlags: ["--keystore"]
   });
   if ("error" in parsed)
     return usage(ctx, parsed.error);
+  const noVault = parsed.booleans.has("--no-vault");
+  if (noVault && parsed.values["--keystore"] !== undefined) {
+    return usage(ctx, "--keystore names the vault to read and has no effect with --no-vault.");
+  }
   if (parsed.positionals.length > 1)
     return usage(ctx, `Unexpected argument: ${parsed.positionals[1]}`);
   const filter = parsed.positionals[0];
@@ -102602,7 +102854,7 @@ async function portfolio(args, ctx) {
   }
   const apiKey = await resolveApiKey(deps, ctx.profile);
   if (!apiKey) {
-    writeLocalFailure(deps, NO_API_KEY5, ctx.json);
+    writeLocalFailure(deps, NO_API_KEY6, ctx.json);
     return 1;
   }
   let solana;
@@ -102626,16 +102878,30 @@ async function portfolio(args, ctx) {
     let vaultEntries;
     let evmEntries;
     let vaultReason;
+    let vaultSkipped = false;
     let known = 0;
-    const raw = await readVaultRaw(resolvedVault.path);
-    if (raw === null) {
-      vaultReason = `no vault at ${resolvedVault.path}`;
-    } else {
+    const raw = noVault ? null : await readVaultRaw(resolvedVault.path);
+    let vault;
+    if (raw !== null) {
       if (!refuseEnvPassphrase(ctx))
         return 1;
-      if (!requirePromptStreams(ctx, "portfolio"))
-        return 1;
-      const vault = hold((await unlockInteractively(ctx, resolvedVault.path, raw)).vault);
+      try {
+        const unlockCtx = refusePromptsWithoutTerminal(ctx, "portfolio");
+        vault = hold((await unlockInteractively(unlockCtx, resolvedVault.path, raw)).vault);
+      } catch (error) {
+        if (!isNoTerminalRefusal(error))
+          throw error;
+      }
+    }
+    if (noVault) {
+      vaultReason = "not read (--no-vault)";
+    } else if (raw === null) {
+      vaultReason = `no vault at ${resolvedVault.path}`;
+    } else if (vault === undefined) {
+      vaultReason = NO_TERMINAL_REASON;
+      vaultSkipped = true;
+      notice(deps, "stderr", "note", NO_TERMINAL_NOTE);
+    } else {
       vaultEntries = showSolana ? vault.index.entries.filter((entry) => entry.chain === "solana" && (entry.role === "vault" || entry.role === "external")).map((entry) => ({ address: entry.address, label: entry.label, role: entry.role })) : [];
       evmEntries = showHood ? vault.index.entries.filter((entry) => entry.chain === "evm" && entry.role === "vault").map((entry) => ({ address: entry.address, label: entry.label })) : [];
       known += vaultEntries.length + evmEntries.length;
@@ -102850,7 +103116,7 @@ async function portfolio(args, ctx) {
     const listStatus = walletListStatus(answered);
     const shownUnread = unavailable6.length > 0 || lpUnread > 0;
     const listNote = listStatus === "cut-off" ? "cut-off" : listStatus === "unknown" && !shownUnread ? "unknown" : null;
-    const complete = listNote === null && !shownUnread && !perpsPartial;
+    const complete = listNote === null && !shownUnread && !perpsPartial && !vaultSkipped;
     const totalUsd = groups.reduce((sum, g) => sum + g.valueUsd, 0);
     const unpriced = groups.reduce((sum, g) => sum + g.unpriced, 0);
     const lp = lpSection ? {
@@ -102927,6 +103193,7 @@ async function portfolio(args, ctx) {
       byChain,
       unavailableByChain,
       listNote,
+      vaultSkipped,
       lp
     });
     if (perps)
@@ -103302,7 +103569,7 @@ ${tableBlock(ctx, "LP positions", ["GROUP", "WALLET", "POSITION", "POOL", "HOLDI
   notes.push([
     "total",
     formatUsd(totals.totalUsd),
-    totals.unpriced > 0 ? `${totals.unpriced} unpriced ${totals.unpriced === 1 ? "holding" : "holdings"} not counted` : "every holding priced"
+    (totals.vaultSkipped ? "partial: the vault was not read (no terminal for its unlock). " : "") + (totals.unpriced > 0 ? `${totals.unpriced} unpriced ${totals.unpriced === 1 ? "holding" : "holdings"} not counted` : totals.vaultSkipped ? "other holdings priced" : "every holding priced")
   ]);
   const style = terminalStyle(deps, "stdout");
   const width = Math.max(...notes.map(([label]) => displayWidth(label)));
@@ -103324,6 +103591,8 @@ ${tableBlock(ctx, "LP positions", ["GROUP", "WALLET", "POSITION", "POOL", "HOLDI
   if (unavailable6 > 0) {
     warnings.push(`${unavailable6} ${unavailable6 === 1 ? "wallet" : "wallets"} could not be read in full (${unreadByChain.map(([chain2, n]) => `${n} on ${CHAIN_NAMES[chain2]}`).join(", ")}). What was not read is marked "not read" and is not in the total.`);
   }
+  if (totals.vaultSkipped)
+    warnings.push("The vault was not read: no terminal for its unlock. Its holdings are not in the total, so the total is partial (exit 3). Run it in a terminal, or pass --no-vault to leave the vault out on purpose.");
   writeNotes2(ctx, warnings);
   writeListNote(ctx, totals.listNote);
   const later = [];
@@ -103377,6 +103646,7 @@ ${financialHeading("Hyperliquid (live from Hyperliquid, not in the ledger; not i
 }
 
 // src/commands/profile.ts
+init_account();
 init_args();
 init_client();
 init_human_output();
@@ -103673,7 +103943,7 @@ candle profile use <name>`);
 init_args();
 init_deps();
 init_key_output();
-var USAGE14 = 'Usage: candle quant ask "<text>" [--timeout <s>] [--json]';
+var USAGE15 = 'Usage: candle quant ask "<text>" [--timeout <s>] [--json]';
 var QUANT_ASK_DEFAULT_TIMEOUT_S = 300;
 var QUANT_ASK_MAX_TIMEOUT_S = 3600;
 var QUANT_ASK_SEND_TRIES = 3;
@@ -103842,7 +104112,7 @@ async function quantAsk(args, ctx) {
   const timeoutS = timeoutRaw === undefined ? QUANT_ASK_DEFAULT_TIMEOUT_S : Number(timeoutRaw);
   const text4 = "error" in parsed ? "" : parsed.positionals[0] ?? "";
   if ("error" in parsed || parsed.positionals.length !== 1 || !text4.trim() || !Number.isInteger(timeoutS) || timeoutS < 1 || timeoutS > QUANT_ASK_MAX_TIMEOUT_S) {
-    writeScreenUsageFailure(ctx.deps, USAGE14, ctx.json);
+    writeScreenUsageFailure(ctx.deps, USAGE15, ctx.json);
     return 2;
   }
   const apiKey = await resolveApiKey(ctx.deps, ctx.profile);
@@ -104051,7 +104321,7 @@ init_client();
 init_human_output();
 init_presentation();
 init_render();
-var USAGE15 = "Usage: candle scan <contract address> [--chain solana|hood] [--json]";
+var USAGE16 = "Usage: candle scan <contract address> [--chain solana|hood] [--json]";
 var OTHER_CHAIN = "Candle trades Solana and Hood today; that is not a Solana or Hood contract address.";
 var HOOD_ADDRESS = /^0x[0-9a-fA-F]{40}$/;
 var SOLANA_ADDRESS = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;
@@ -104151,20 +104421,20 @@ async function scan(args, ctx) {
   }
   const named = parsed.values["--chain"];
   if (parsed.positionals.length !== 1 || named !== undefined && named !== "solana" && named !== "hood") {
-    writeUsageFailure(ctx.deps, USAGE15, ctx.json);
+    writeUsageFailure(ctx.deps, USAGE16, ctx.json);
     return 2;
   }
   const address = parsed.positionals[0].trim();
   const found = chainOfAddress(address);
   if (found === null) {
     writeUsageFailure(ctx.deps, `${OTHER_CHAIN}
-${USAGE15}`, ctx.json);
+${USAGE16}`, ctx.json);
     return 2;
   }
   if (named !== undefined && named !== found) {
     const label = (c) => c === "hood" ? "Hood" : "Solana";
     writeUsageFailure(ctx.deps, `That address is a ${label(found)} contract, not a ${label(named)} one. Candle trades Solana and Hood today.
-${USAGE15}`, ctx.json);
+${USAGE16}`, ctx.json);
     return 2;
   }
   const chain2 = found;
@@ -104507,8 +104777,7 @@ async function sign5(args, ctx) {
     return usage(ctx, solana.error);
   if (!refuseEnvPassphrase(ctx))
     return 1;
-  if (!requireTty(ctx, "candle sign"))
-    return 1;
+  const promptCtx = refusePromptsWithoutTerminal(ctx, "candle sign");
   const { deps } = ctx;
   const resolvedVault = vaultPathFor(ctx, parsed);
   if ("error" in resolvedVault)
@@ -104538,7 +104807,7 @@ async function sign5(args, ctx) {
       throw error;
     }
     const raw = await requireVaultRaw(ctx, resolvedVault);
-    const opened = await unlockInteractively(ctx, path, raw, {
+    const opened = await unlockInteractively(promptCtx, path, raw, {
       acceptOlderCopy: parsed.booleans.has("--accept-older-copy")
     });
     const vault = hold(opened.vault);
@@ -104697,8 +104966,7 @@ async function signMessage2(args, ctx) {
   const requested = lifted.values[0];
   if (!refuseEnvPassphrase(ctx))
     return 1;
-  if (!requireTty(ctx, "candle sign message"))
-    return 1;
+  const promptCtx = refusePromptsWithoutTerminal(ctx, "candle sign message");
   const { deps } = ctx;
   const resolvedVault = vaultPathFor(ctx, parsed);
   if ("error" in resolvedVault)
@@ -104712,7 +104980,7 @@ async function signMessage2(args, ctx) {
       throw new VaultError("VAULT_UNREADABLE", `The message could not be read: ${error instanceof Error ? error.message : error}.`);
     }
     const raw = await requireVaultRaw(ctx, resolvedVault);
-    const opened = await unlockInteractively(ctx, path, raw, {
+    const opened = await unlockInteractively(promptCtx, path, raw, {
       acceptOlderCopy: parsed.booleans.has("--accept-older-copy")
     });
     const vault = hold(opened.vault);
@@ -105480,8 +105748,7 @@ async function vaultRename(args, ctx) {
   const id = parsed.values["--id"];
   if (!refuseEnvPassphrase(ctx))
     return 1;
-  if (!requireTty(ctx, "vault rename"))
-    return 1;
+  const promptCtx = refusePromptsWithoutTerminal(ctx, "vault rename");
   const { deps } = ctx;
   const resolvedVault = vaultPathFor(ctx, parsed);
   if ("error" in resolvedVault)
@@ -105502,7 +105769,7 @@ async function vaultRename(args, ctx) {
   }
   return runVaultCommand(ctx, async ({ hold }) => {
     const raw = await requireVaultRaw(ctx, resolvedVault);
-    const opened = await unlockInteractively(ctx, path, raw, {
+    const opened = await unlockInteractively(promptCtx, path, raw, {
       acceptOlderCopy: parsed.booleans.has("--accept-older-copy")
     });
     const vault = hold(opened.vault);
@@ -105773,10 +106040,9 @@ async function teeRename(args, ctx) {
   if ("error" in vaultPath)
     return usage(ctx, vaultPath.error);
   const raw = rows.some((row2) => row2.tee) ? await readVaultRaw(vaultPath.path) : null;
-  if (raw !== null && !requireTty(ctx, "tee rename"))
-    return 1;
+  const promptCtx = refusePromptsWithoutTerminal(ctx, "tee rename");
   return runVaultCommand(ctx, async ({ hold }) => {
-    const vault = raw === null ? null : hold((await unlockInteractively(ctx, vaultPath.path, raw, {
+    const vault = raw === null ? null : hold((await unlockInteractively(promptCtx, vaultPath.path, raw, {
       acceptOlderCopy: parsed.booleans.has("--accept-older-copy")
     })).vault);
     const local = [];
@@ -106042,7 +106308,7 @@ init_deps();
 init_human_output();
 init_render();
 var KINDS = ["trade", "signal", "callout"];
-var USAGE16 = "Usage: candle token events <mint> [--chain solana|hood] [--kind trade|signal|callout] [--since <iso-8601>] [--limit <n>] [--before <cursor>] [--json]";
+var USAGE17 = "Usage: candle token events <mint> [--chain solana|hood] [--kind trade|signal|callout] [--since <iso-8601>] [--limit <n>] [--before <cursor>] [--json]";
 function readEventsBody(body) {
   if (body === null || typeof body !== "object" || !Array.isArray(body.events))
     return null;
@@ -106100,11 +106366,11 @@ async function tokenEvents(args, ctx) {
   const since = parsed.values["--since"];
   const before = parsed.values["--before"];
   if (parsed.positionals.length !== 1 || chain2 !== "solana" && chain2 !== "hood") {
-    writeUsageFailure(ctx.deps, USAGE16, ctx.json);
+    writeUsageFailure(ctx.deps, USAGE17, ctx.json);
     return 2;
   }
   if (kind !== undefined && !KINDS.includes(kind)) {
-    writeUsageFailure(ctx.deps, USAGE16, ctx.json);
+    writeUsageFailure(ctx.deps, USAGE17, ctx.json);
     return 2;
   }
   if (limit !== undefined && !/^[1-9][0-9]{0,3}$/.test(limit) || Number(limit) > 1000) {
@@ -106443,7 +106709,7 @@ init_render();
 init_solana_verify();
 init_trading();
 init_swap();
-var USAGE17 = "Usage: candle transfer --to <address|wallet name|allowlist label|vault> --asset <SOL|USDC|CNDL|ETH|USDG>|--mint <mint>|--token <0x...> --amount <decimal|max> [--wallet <name>] [--rpc-url <url>] [--yes] [--json]";
+var USAGE18 = "Usage: candle transfer --to <address|wallet name|allowlist label|vault> --asset <SOL|USDC|CNDL|ETH|USDG>|--mint <mint>|--token <0x...> --amount <decimal|max> [--wallet <name>] [--rpc-url <url>] [--yes] [--json]";
 var TRANSFER_ASSETS = [...Object.keys(BASES), ...Object.keys(HOOD_BASES)];
 var BASE58_ADDRESS = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;
 async function readLinkedWallets(ctx, key) {
@@ -106588,7 +106854,7 @@ async function transfer(args, ctx) {
   const flags2 = parsed.values;
   const asset = flags2["--asset"]?.toUpperCase();
   if (parsed.positionals.length !== 0 || !flags2["--to"] || !flags2["--amount"] || [flags2["--asset"], flags2["--mint"], flags2["--token"]].filter(Boolean).length !== 1 || asset !== undefined && !TRANSFER_ASSETS.includes(asset) || flags2["--mint"] !== undefined && !BASE58_ADDRESS.test(flags2["--mint"]) || flags2["--token"] !== undefined && !checkEvmAddress(flags2["--token"]).ok) {
-    writeUsageFailure(ctx.deps, USAGE17, ctx.json);
+    writeUsageFailure(ctx.deps, USAGE18, ctx.json);
     return 2;
   }
   const to = flags2["--to"];
@@ -109585,7 +109851,10 @@ async function createVault(request2, clock) {
   if (raw === null) {
     throw new VaultError("VAULT_WRITE_FAILED", `The vault was written to ${request2.path} but could not be read back.`);
   }
-  return unlockWithPassphrase(request2.path, raw, request2.passphrase, { notice: request2.notice });
+  return unlockWithPassphrase(request2.path, raw, request2.passphrase, {
+    notice: request2.notice,
+    derivationLabel: request2.verificationLabel
+  });
 }
 
 // src/commands/vault-init.ts
@@ -109659,8 +109928,8 @@ async function runPhraseCeremony(ctx, vault, opts = {}) {
     const { closeVault: closeVault2 } = await Promise.resolve().then(() => (init_store(), exports_store));
     closeVault2(reopened);
   }
-  notice(deps, "stdout", "danger", `The 24 words below re-derive every key this vault derives, on any BIP-39 wallet, with no passphrase and no server.
-They do NOT restore any key imported from the Phase 1 TEE wallet store; the vault file plus a factor does that.
+  notice(deps, "stdout", "warning", `The 24 words below re-derive every key this vault derives, on any BIP-39 wallet, with no passphrase and no server.
+They do NOT restore any key you imported from an older wallet store; the vault file plus a factor does that.
 Anyone who reads them can move every derived key's funds.
 
 `);
@@ -109688,6 +109957,9 @@ Anyone who reads them can move every derived key's funds.
   }
   deps.stdout.write(`
 `);
+  await deps.promptLine("Press Enter when you have saved the 24 words offline; the screen will clear for the check: ");
+  deps.stdout.write("\x1B[2J\x1B[H");
+  notice(deps, "stdout", "warning", "The phrase is no longer on screen. Clear your terminal's scrollback: the words were rendered there and this CLI cannot remove them.");
   const positions = randomPositions(3, words.length);
   let confirmed = true;
   for (const position of positions) {
@@ -109696,8 +109968,6 @@ Anyone who reads them can move every derived key's funds.
       confirmed = false;
   }
   deps.stdout.write("\x1B[2J\x1B[H");
-  notice(deps, "stdout", "warning", `The phrase is no longer on screen. Clear your terminal's scrollback: the words were rendered there and this CLI cannot remove them.
-`.trim());
   notice(deps, "stdout", "warning", `This vault now records that the recovery phrase was exported; that record never resets.
 `.trim());
   words.fill("");
@@ -109768,7 +110038,8 @@ async function vaultInit(args, ctx) {
       strength: strengthFor(own),
       rootEntropy,
       label: parsed.values["--label"],
-      notice: (line) => deps.stderr.write(line)
+      notice: (line) => deps.stderr.write(line),
+      verificationLabel: "Verifying the vault key"
     }, deps));
     try {
       if (ctx.json) {
@@ -109798,12 +110069,13 @@ async function vaultInit(args, ctx) {
         ["Verified", "file re-read, opened with your passphrase, root blob decrypted"],
         ["Create a key", "candle vault new-key --chain solana"]
       ]);
-      notice(deps, "stdout", "note", `
+      if (deps.platform === "darwin")
+        notice(deps, "stdout", "note", `
 ${APPLE_ACCOUNT_NOTICE}
 `.trim());
       if (countRecoverableFactors(vault.file.envelopes) === 1) {
         notice(deps, "stdout", "warning", `
-This vault has exactly one recoverable factor: the passphrase. Lose it and no copy of this file can be opened, and the recovery phrase becomes the only route back. Add a second when you can: candle vault enroll security-key
+This vault has exactly one recoverable factor: the passphrase. Lose it and no copy of this file can be opened, and the recovery phrase becomes the only route back. To add a security key later, run this separate optional command: candle vault enroll security-key
 `.trim());
       }
       notice(deps, "stdout", "note", `
@@ -110962,13 +111234,12 @@ async function vaultList(args, ctx) {
   if (balances && "error" in evmRpc)
     return usage(ctx, evmRpc.error);
   const evmRpcUrl = "url" in evmRpc ? evmRpc.url : DEFAULT_HOOD_RPC_URL;
-  if (!requirePromptStreams(ctx, "vault list"))
-    return 1;
+  const promptCtx = refusePromptsWithoutTerminal(ctx, "vault list");
   return runVaultCommand(ctx, async ({ hold }) => {
     const raw = await readVaultRaw(path);
     if (raw === null)
       throw missingVault(ctx, resolvedVault);
-    const vault = hold((await unlockInteractively(ctx, path, raw, { acceptOlderCopy: parsed.booleans.has("--accept-older-copy") })).vault);
+    const vault = hold((await unlockInteractively(promptCtx, path, raw, { acceptOlderCopy: parsed.booleans.has("--accept-older-copy") })).vault);
     const all = vault.index.entries;
     const filtered = filter === undefined ? all : all.filter((entry) => matches2(entry, filter));
     const showRetired = parsed.booleans.has("--all");
@@ -111358,7 +111629,7 @@ async function promoteEvmFresh(input, fromLabel) {
       addKeys: [blob]
     }, ctx.deps));
     scanStart = await appendScanStart(ctx, vault.path, address, height);
-    await confirmAddress(ctx, "vault", destination.address, `sweep this wallet home to ${destination.address}`);
+    await confirmAddress(ctx, "vault", destination.address, `promote a new TEE wallet with pinned vault ${destination.address}`);
     if (toKey !== undefined) {
       notice(ctx.deps, "stderr", "note", `${[toKeyPlanLine(toKey), ...signerStaysLines(toKey), ...targetWarnings(toKey.target, "evm")].join(`
 `)}
@@ -111738,7 +112009,7 @@ async function promoteFresh(ctx, parsed, fromLabel, toKey) {
       },
       addKeys: [blob]
     }, ctx.deps));
-    await confirmAddress(ctx, "vault", destination.address, `sweep this wallet home to ${destination.address}`);
+    await confirmAddress(ctx, "vault", destination.address, `promote a new TEE wallet with pinned vault ${destination.address}`);
     if (toKey !== undefined) {
       notice(ctx.deps, "stderr", "note", `${[toKeyPlanLine(toKey), ...signerStaysLines(toKey), ...targetWarnings(toKey.target, "solana")].join(`
 `)}
@@ -114249,8 +114520,8 @@ init_store();
 init_vault_support();
 var LIST_POINTER = "One line per key, with an optional SOL balance: candle vault list";
 var NO_VERIFIED_BACKUP_NOTE = `No backup of this vault has ever been verified from this machine. If this file is lost, only the 24-word recovery phrase can rebuild it, and it rebuilds derived keys only. Take one now:
-candle vault backup --to <path>
-on a Mac with iCloud Drive: candle vault backup --to icloud`;
+candle vault backup --to <path>`;
+var ICLOUD_BACKUP_LINE = "on a Mac with iCloud Drive: candle vault backup --to icloud";
 async function vaultStatus(args, ctx) {
   const parsed = parseArgs(args, {
     valueFlags: ["--keystore"],
@@ -114392,7 +114663,8 @@ async function vaultStatus(args, ctx) {
       notice(deps, "stdout", "note", "No vault.state.json beside this vault, so an older copy of it cannot be recognized on this machine.");
     }
     if (sidecar?.lastVerifiedBackupAt === undefined)
-      notice(deps, "stdout", "warning", NO_VERIFIED_BACKUP_NOTE);
+      notice(deps, "stdout", "warning", deps.platform === "darwin" ? `${NO_VERIFIED_BACKUP_NOTE}
+${ICLOUD_BACKUP_LINE}` : NO_VERIFIED_BACKUP_NOTE);
     if (legacyPresent) {
       notice(deps, "stdout", "warning", `A legacy wallets.enc exists at ${legacy}; this CLI does not read it.
 A key it holds that was imported is already a linked wallet, managed with: candle wallets
@@ -114698,7 +114970,7 @@ init_human_output();
 init_release();
 import { dirname as dirname13, join as join15 } from "node:path";
 init_key_output();
-var USAGE18 = "Usage: candle verify <file> --bundle <path> [--identity <uri>] [--issuer <url>]";
+var USAGE19 = "Usage: candle verify <file> --bundle <path> [--identity <uri>] [--issuer <url>]";
 async function resolveIdentity(deps, bundlePath, flag) {
   if (flag)
     return { kind: "ok", uri: flag, provenance: "identity from --identity" };
@@ -114730,19 +115002,19 @@ async function verify(args, ctx) {
   });
   if ("error" in parsed) {
     writeScreenUsageFailure(deps, `${parsed.error}
-${USAGE18}`, json);
+${USAGE19}`, json);
     return 2;
   }
   const file = parsed.positionals[0];
   if (parsed.positionals.length !== 1 || file === undefined) {
     writeScreenUsageFailure(deps, `verify takes exactly one file.
-${USAGE18}`, json);
+${USAGE19}`, json);
     return 2;
   }
   const bundlePath = parsed.values["--bundle"];
   if (!bundlePath) {
     writeScreenUsageFailure(deps, `--bundle is required.
-${USAGE18}`, json);
+${USAGE19}`, json);
     return 2;
   }
   const resolved = await resolveIdentity(deps, bundlePath, parsed.values["--identity"]);
@@ -114756,7 +115028,7 @@ ${USAGE18}`, json);
   }
   if (resolved.kind === "absent") {
     writeScreenUsageFailure(deps, `--identity is required: there is no latest.json beside ${bundlePath} to take the release version from.
-${USAGE18}`, json);
+${USAGE19}`, json);
     return 2;
   }
   const identity4 = resolved.uri;
@@ -115006,6 +115278,101 @@ function walletsDisallowLaunch(args, ctx) {
   return setAllowLaunch(args, ctx, false);
 }
 
+// src/commands/wallets-allowlist.ts
+init_args();
+init_client();
+init_deps();
+init_human_output();
+init_presentation();
+init_profiles();
+init_render();
+init_key_output();
+var EMPTY_NOTE = "No approved withdrawal addresses. An agent can move funds only to the account's own wallets and its vault.";
+var MANAGED_HINT = "Approving an address needs the owner signed in to the agent console's Wallets tab; an API key cannot approve. An acting key can revoke one; a read-only key cannot.";
+async function walletsAllowlist(args, ctx) {
+  const { deps, apiUrl, json } = ctx;
+  const parsed = parseArgs(args, { booleanFlags: ["--all"] });
+  if ("error" in parsed) {
+    writeScreenUsageFailure(deps, parsed.error, json);
+    return 2;
+  }
+  if (parsed.positionals.length > 0) {
+    writeScreenUsageFailure(deps, `Unexpected argument: ${parsed.positionals[0]}`, json);
+    return 2;
+  }
+  await printIdentity(ctx);
+  const apiKey = await resolveApiKey(deps, ctx.profile);
+  if (!apiKey) {
+    writeScreenLocalFailure(deps, { code: "NO_API_KEY", message: "No API key available.", suggestion: "Run: candle keys create" }, json);
+    return 1;
+  }
+  const query3 = parsed.booleans.has("--all") ? "?includeRevoked=true" : "";
+  const result = await apiRequest(`/api/v1/agent/withdrawal-addresses${query3}`, {
+    method: "GET",
+    auth: "key",
+    credentials: { apiKey },
+    apiUrl,
+    fetch: deps.fetch,
+    env: deps.env
+  });
+  if (!result.ok) {
+    writeScreenFailure(deps, result, { apiUrl, authType: "key" }, json);
+    return 1;
+  }
+  const body = result.body;
+  if (!Array.isArray(body.addresses)) {
+    writeScreenLocalFailure(deps, { code: "INVALID_RESPONSE", message: "The withdrawal allowlist read did not return a list." }, json);
+    return 1;
+  }
+  const rows = body.addresses;
+  if (json) {
+    deps.stdout.write(`${JSON.stringify({ success: true, addresses: rows, count: rows.length })}
+`);
+    return 0;
+  }
+  const style = terminalStyle(deps, "stdout");
+  deps.stdout.write(`${heading(`Withdrawal allowlist (${rows.length})`, style)}
+
+`);
+  if (rows.length === 0) {
+    notice(deps, "stdout", "note", EMPTY_NOTE);
+    notice(deps, "stdout", "note", MANAGED_HINT);
+    return 0;
+  }
+  if (style.width < 100) {
+    for (const row2 of rows) {
+      writeFields(deps, "stdout", [
+        ["Id", row2.id],
+        ["Address", row2.address],
+        ["Label", row2.label],
+        ["Chain", row2.chain],
+        ["Revoked", row2.revokedAt ? "yes" : "no"]
+      ]);
+      deps.stdout.write(`
+`);
+    }
+  } else {
+    deps.stdout.write(`${renderTable(["Id", "Chain", "Address", "Label", "Revoked"], rows.map((row2) => [
+      row2.id,
+      row2.chain,
+      row2.address,
+      row2.label ?? symbols(style).missing,
+      row2.revokedAt ? "yes" : "no"
+    ]), {
+      style,
+      width: style.width,
+      indent: 2,
+      rule: false,
+      columns: [{ id: true }, { priority: 3 }, { id: true }, { priority: 2 }, { priority: 1 }]
+    })}
+`);
+  }
+  deps.stdout.write(`
+`);
+  notice(deps, "stdout", "note", MANAGED_HINT);
+  return 0;
+}
+
 // src/commands/wallets-authorize.ts
 init_args();
 init_client();
@@ -115015,7 +115382,7 @@ init_presentation();
 init_profiles();
 init_render();
 init_key_output();
-var USAGE19 = "Usage: candle wallets authorize [--no-browser] [--no-wait] [--timeout <seconds>] [--json]";
+var USAGE20 = "Usage: candle wallets authorize [--no-browser] [--no-wait] [--timeout <seconds>] [--json]";
 var AUTHORIZE_WAIT_DEFAULT_SECONDS = 600;
 var AUTHORIZE_POLL_MS = 3000;
 function authorizeUrl(apiUrl, portalOrigin) {
@@ -115038,12 +115405,12 @@ async function walletsAuthorize(args, ctx) {
   const parsed = parseArgs(args, { booleanFlags: ["--no-browser", "--no-wait"], valueFlags: ["--timeout"] });
   if ("error" in parsed) {
     writeScreenUsageFailure(deps, `${parsed.error}
-${USAGE19}`, json);
+${USAGE20}`, json);
     return 2;
   }
   if (parsed.positionals.length > 0) {
     writeScreenUsageFailure(deps, `Unexpected argument: ${parsed.positionals[0]}
-${USAGE19}`, json);
+${USAGE20}`, json);
     return 2;
   }
   let timeoutSeconds = AUTHORIZE_WAIT_DEFAULT_SECONDS;
@@ -115052,7 +115419,7 @@ ${USAGE19}`, json);
     const n = Number(rawTimeout);
     if (!Number.isInteger(n) || n <= 0) {
       writeScreenUsageFailure(deps, `--timeout must be a whole number of seconds above 0, got ${rawTimeout}
-${USAGE19}`, json);
+${USAGE20}`, json);
       return 2;
     }
     timeoutSeconds = n;
@@ -115159,7 +115526,7 @@ init_solana_lite();
 init_trading();
 init_swap();
 import { randomUUID as randomUUID16 } from "node:crypto";
-var USAGE20 = "Usage: candle wallet close-empty [--wallet embedded|<tee address|label>] [--keep <mint>]... [--client-trade-id <id>] [--preview] [--yes] [--json]";
+var USAGE21 = "Usage: candle wallet close-empty [--wallet embedded|<tee address|label>] [--keep <mint>]... [--client-trade-id <id>] [--preview] [--yes] [--json]";
 var BASE58_ADDRESS2 = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;
 var LISTED_ROWS = 50;
 var TOKEN_IX_CLOSE_ACCOUNT3 = 9;
@@ -115434,7 +115801,7 @@ async function closeTee(ctx, key, wallet3, name2, run2) {
 async function walletsCloseEmpty(args, ctx) {
   const lifted = splitKeep(args);
   if ("error" in lifted) {
-    writeUsageFailure(ctx.deps, `${lifted.error}. ${USAGE20}`, ctx.json);
+    writeUsageFailure(ctx.deps, `${lifted.error}. ${USAGE21}`, ctx.json);
     return 2;
   }
   const parsed = parseArgs(lifted.rest, {
@@ -115448,7 +115815,7 @@ async function walletsCloseEmpty(args, ctx) {
   const named = parsed.values["--client-trade-id"];
   const id = named ?? `close-${randomUUID16()}`;
   if (parsed.positionals.length !== 0 || !validClientId(id) || !lifted.keep.every((m) => BASE58_ADDRESS2.test(m))) {
-    writeUsageFailure(ctx.deps, USAGE20, ctx.json);
+    writeUsageFailure(ctx.deps, USAGE21, ctx.json);
     return 2;
   }
   const run2 = {
@@ -115708,6 +116075,7 @@ init_ownership();
 init_file_lock();
 
 // src/guard.ts
+init_account();
 init_profiles();
 async function verifyProfileAccount(ctx, config) {
   const { deps, profile } = ctx;
@@ -115956,6 +116324,7 @@ var COMMANDS = {
       access: keysAccess,
       update: keysUpdate,
       limit: keysLimit,
+      limits: keysLimits,
       self: keysSelf,
       rotate: keysRotate,
       revoke: keysRevoke,
@@ -115974,7 +116343,8 @@ var COMMANDS = {
       "allow-launch": walletsAllowLaunch,
       "disallow-launch": walletsDisallowLaunch,
       "close-empty": walletsCloseEmpty,
-      authorize: walletsAuthorize
+      authorize: walletsAuthorize,
+      allowlist: walletsAllowlist
     },
     bare: wallets
   },