@pgnio/helios-mcp 0.2.8 → 0.4.0

package/dist/cli.js

@@ -25,13 +25,94 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
 
+// src/endpoints.ts
+var DEFAULT_HELIOS_BASE_URL = "https://helios.pgn.io";
+var DEFAULT_HELIOS_SESSION_ISSUER = {
+  identityServiceUrl: DEFAULT_HELIOS_BASE_URL,
+  dataBridgeUrl: DEFAULT_HELIOS_BASE_URL
+};
+var LOOPBACK_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
+function assertHeliosBaseUrl(name, value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error(`${name} must be a URL, got ${JSON.stringify(value)}`);
+  }
+  if (url.protocol === "https:") {
+    return value;
+  }
+  if (url.protocol === "http:" && LOOPBACK_HOSTNAMES.has(url.hostname)) {
+    return value;
+  }
+  throw new Error(`${name} must use https (plain http only for localhost, 127.0.0.1 or [::1]), got ${url.origin}`);
+}
+function isSameHeliosIssuer(stored, configured) {
+  const issuer = stored ?? DEFAULT_HELIOS_SESSION_ISSUER;
+  return normalizeBaseUrl(issuer.identityServiceUrl) === normalizeBaseUrl(configured.identityServiceUrl) && normalizeBaseUrl(issuer.dataBridgeUrl) === normalizeBaseUrl(configured.dataBridgeUrl);
+}
+function normalizeBaseUrl(value) {
+  try {
+    const url = new URL(value);
+    return `${url.origin}${url.pathname.replace(/\/+$/, "")}`;
+  } catch {
+    return value.replace(/\/+$/, "");
+  }
+}
+
 // ../agent/dist/index.mjs
 var import_zod = require("zod");
 var import_zod2 = require("zod");
 var import_zod3 = require("zod");
+var import_zod4 = require("zod");
 var __defProp2 = Object.defineProperty;
 var __defNormalProp2 = (obj, key, value) => key in obj ? __defProp2(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
 var __publicField2 = (obj, key, value) => __defNormalProp2(obj, typeof key !== "symbol" ? key + "" : key, value);
+var VERIFIED_AGENT_APPS = [
+  { name: "Claude", redirects: ["https://claude.ai/api/mcp/auth_callback", "https://claude.com/api/mcp/auth_callback"] },
+  { name: "ChatGPT", redirects: ["https://chatgpt.com/connector_platform_oauth_redirect"] },
+  { name: "Cursor", redirects: ["https://www.cursor.com/agents/mcp/oauth/callback"] }
+];
+var RESERVED_AGENT_APP_NAMES = [
+  ...VERIFIED_AGENT_APPS.map((app) => app.name),
+  "VS Code",
+  "Helios",
+  "Wagmi",
+  "Ares",
+  "OpenAI",
+  "Anthropic",
+  "Grok"
+];
+var heliosAgentErrorResponseSchema = import_zod2.z.object({
+  error: import_zod2.z.string().optional(),
+  errorDescription: import_zod2.z.string().optional(),
+  message: import_zod2.z.string().optional()
+});
+var HeliosAgentApiError = class extends Error {
+  constructor(options) {
+    super(options.message);
+    __publicField2(this, "status");
+    __publicField2(this, "code");
+    __publicField2(this, "errorDescription");
+    __publicField2(this, "payload");
+    this.name = "HeliosAgentApiError";
+    this.status = options.status;
+    this.code = options.code;
+    this.errorDescription = options.errorDescription;
+    this.payload = options.payload;
+    if (options.cause !== void 0) {
+      Object.defineProperty(this, "cause", {
+        configurable: true,
+        enumerable: false,
+        value: options.cause,
+        writable: true
+      });
+    }
+  }
+};
+function isHeliosAgentApiError(error) {
+  return error instanceof HeliosAgentApiError;
+}
 var AGENT_SCOPES = {
   ACCOUNT_READ: "account:read",
   MARKET_READ: "market:read",
@@ -44,477 +125,1020 @@ var AGENT_SCOPE_VALUES = [
   AGENT_SCOPES.ORDERS_WRITE,
   AGENT_SCOPES.ORDERS_CANCEL
 ];
-var agentScopeSchema = import_zod.z.enum(AGENT_SCOPE_VALUES);
-var agentGrantStatusSchema = import_zod.z.enum(["active", "revoked"]);
-var agentDeviceRequestStatusSchema = import_zod.z.enum(["pending", "approved", "rejected", "exchanged", "expired"]);
-var agentConstraintsSchema = import_zod.z.record(import_zod.z.string(), import_zod.z.unknown()).default({});
-var agentGrantMetadataSchema = import_zod.z.object({
-  id: import_zod.z.string(),
-  userId: import_zod.z.string(),
-  clientName: import_zod.z.string(),
+var agentScopeSchema = import_zod3.z.enum(AGENT_SCOPE_VALUES);
+var AGENT_TRADING_SCOPES = [AGENT_SCOPES.ORDERS_WRITE, AGENT_SCOPES.ORDERS_CANCEL];
+var agentGrantStatusSchema = import_zod3.z.enum(["active", "revoked"]);
+var agentDeviceRequestStatusSchema = import_zod3.z.enum(["pending", "approved", "rejected", "exchanged", "expired"]);
+var AGENT_CONSTRAINTS_MAX_KEYS = 16;
+var agentConstraintsSchema = import_zod3.z.record(import_zod3.z.string().max(64), import_zod3.z.unknown()).refine((value) => Object.keys(value).length <= AGENT_CONSTRAINTS_MAX_KEYS, {
+  message: `At most ${AGENT_CONSTRAINTS_MAX_KEYS} constraints`
+}).default({});
+var agentGrantMetadataSchema = import_zod3.z.object({
+  id: import_zod3.z.string(),
+  userId: import_zod3.z.string(),
+  clientName: import_zod3.z.string(),
   status: agentGrantStatusSchema,
-  scope: import_zod.z.array(agentScopeSchema).min(1),
+  scope: import_zod3.z.array(agentScopeSchema).min(1),
   constraints: agentConstraintsSchema,
-  tokenVersion: import_zod.z.number().int().nonnegative(),
-  createdAt: import_zod.z.string(),
-  approvedAt: import_zod.z.string().optional(),
-  lastUsedAt: import_zod.z.string().optional(),
-  revokedAt: import_zod.z.string().optional()
-});
-var agentDeviceStartInputSchema = import_zod.z.object({
-  clientName: import_zod.z.string().min(1).max(64),
-  scope: import_zod.z.array(agentScopeSchema).min(1),
-  constraints: agentConstraintsSchema.optional()
+  tokenVersion: import_zod3.z.number().int().nonnegative(),
+  createdAt: import_zod3.z.string(),
+  approvedAt: import_zod3.z.string().optional(),
+  lastUsedAt: import_zod3.z.string().optional(),
+  revokedAt: import_zod3.z.string().optional()
 });
-var agentDeviceStartOutputSchema = import_zod.z.object({
-  deviceCode: import_zod.z.string(),
-  userCode: import_zod.z.string(),
-  verificationUri: import_zod.z.string().url(),
-  verificationUriComplete: import_zod.z.string().url(),
-  expiresInSeconds: import_zod.z.number().int().positive(),
-  pollIntervalSeconds: import_zod.z.number().int().positive()
+var AGENT_START_SECRET_HEADER = "x-helios-agent-start-secret";
+var AGENT_CLIENT_IP_HEADER = "x-helios-client-ip";
+var agentDeviceStartInputSchema = import_zod3.z.object({
+  clientName: import_zod3.z.string().trim().min(1).max(64),
+  scope: import_zod3.z.array(agentScopeSchema).min(1),
+  constraints: agentConstraintsSchema.optional(),
+  /** The app was matched to a known client by the hosted MCP. Ignored unless the start carries the start secret. */
+  verified: import_zod3.z.boolean().optional(),
+  /** The approval answers a one-time proof the device must send with the token exchange (the hosted MCP's redirect). */
+  requireApprovalProof: import_zod3.z.boolean().optional()
 });
-var agentDeviceTokenInputSchema = import_zod.z.object({
-  deviceCode: import_zod.z.string().min(1)
+var agentDeviceStartOutputSchema = import_zod3.z.object({
+  deviceCode: import_zod3.z.string(),
+  userCode: import_zod3.z.string(),
+  verificationUri: import_zod3.z.string().url(),
+  verificationUriComplete: import_zod3.z.string().url(),
+  expiresInSeconds: import_zod3.z.number().int().positive(),
+  pollIntervalSeconds: import_zod3.z.number().int().positive()
 });
-var agentDeviceRequestViewSchema = import_zod.z.object({
-  userCode: import_zod.z.string(),
-  clientName: import_zod.z.string(),
-  scope: import_zod.z.array(agentScopeSchema).min(1),
+var agentDeviceTokenInputSchema = import_zod3.z.object({
+  deviceCode: import_zod3.z.string().min(1),
+  /** Required when the login was started with requireApprovalProof: the proof the approval answered with. */
+  approvalProof: import_zod3.z.string().min(1).max(128).optional()
+});
+var agentDeviceRequestViewSchema = import_zod3.z.object({
+  userCode: import_zod3.z.string(),
+  clientName: import_zod3.z.string(),
+  scope: import_zod3.z.array(agentScopeSchema).min(1),
   constraints: agentConstraintsSchema,
   status: agentDeviceRequestStatusSchema,
-  expiresAt: import_zod.z.string()
+  expiresAt: import_zod3.z.string(),
+  /** False when the app's name wasn't checked by Helios (anyone can start a login under any name). */
+  verified: import_zod3.z.boolean().optional(),
+  /** The signed-in viewer already has an active connection under this name, which approving would replace. */
+  replacesExisting: import_zod3.z.boolean().optional(),
+  /** Where the login was started, as identity saw the device/start call. Absent from older identity builds. */
+  startedFrom: import_zod3.z.object({
+    ip: import_zod3.z.string().nullable(),
+    userAgent: import_zod3.z.string().nullable(),
+    startedAt: import_zod3.z.string()
+  }).optional()
 });
-var agentTokenResponseSchema = import_zod.z.object({
-  accessToken: import_zod.z.string(),
-  refreshToken: import_zod.z.string(),
-  tokenType: import_zod.z.literal("Bearer"),
-  expiresInSeconds: import_zod.z.number().int().positive(),
-  scope: import_zod.z.array(agentScopeSchema).min(1),
-  ownerUserId: import_zod.z.string(),
-  agentGrantId: import_zod.z.string()
+var agentDeviceApproveInputSchema = import_zod3.z.object({
+  /** The person confirmed replacing their existing connection of the same name. */
+  replaceExisting: import_zod3.z.boolean().optional(),
+  /**
+   * The scopes the person allowed: a non-empty subset of the request's scope (identity answers 400 invalid_scope
+   * otherwise). The grant and its tokens get exactly these. Absent: everything the request asked for.
+   */
+  scope: import_zod3.z.array(agentScopeSchema).min(1).max(AGENT_SCOPE_VALUES.length).optional(),
+  /**
+   * The person confirmed they trust an unverified app to trade. Required (else 409 trading_acknowledgement_required)
+   * when the login is unverified and the approved scope includes a trading scope (AGENT_TRADING_SCOPES).
+   */
+  acknowledgeTrading: import_zod3.z.boolean().optional()
+});
+var agentTokenResponseSchema = import_zod3.z.object({
+  accessToken: import_zod3.z.string(),
+  refreshToken: import_zod3.z.string(),
+  tokenType: import_zod3.z.literal("Bearer"),
+  expiresInSeconds: import_zod3.z.number().int().positive(),
+  scope: import_zod3.z.array(agentScopeSchema).min(1),
+  ownerUserId: import_zod3.z.string(),
+  agentGrantId: import_zod3.z.string()
 });
-var agentRefreshInputSchema = import_zod.z.object({
-  refreshToken: import_zod.z.string().min(1)
+var agentRefreshInputSchema = import_zod3.z.object({
+  refreshToken: import_zod3.z.string().min(1)
 });
-var agentApprovalResponseSchema = import_zod.z.object({
+var agentApprovalResponseSchema = import_zod3.z.object({
   request: agentDeviceRequestViewSchema,
-  grant: agentGrantMetadataSchema
+  grant: agentGrantMetadataSchema,
+  /** Present when the login asked for one: hand it back to the device, which sends it with the token exchange. */
+  approvalProof: import_zod3.z.string().optional()
 });
-var agentSessionStateSchema = import_zod.z.object({
-  status: import_zod.z.enum(["pending", "authorized", "rejected", "revoked"]),
+var agentSessionStateSchema = import_zod3.z.object({
+  status: import_zod3.z.enum(["pending", "authorized", "rejected", "revoked"]),
   request: agentDeviceRequestViewSchema.optional(),
   grant: agentGrantMetadataSchema.optional()
 });
-var providerSchema = import_zod.z.enum(["hyperliquid"]);
-var walletStateSchema = import_zod.z.object({
-  provider: import_zod.z.literal("hyperliquid"),
-  accountValue: import_zod.z.number(),
-  availableBalance: import_zod.z.number(),
-  withdrawable: import_zod.z.number(),
-  totalMarginUsed: import_zod.z.number(),
-  totalNotionalPosition: import_zod.z.number(),
-  crossMarginAccountValue: import_zod.z.number(),
-  isActivated: import_zod.z.boolean(),
-  fetchedAt: import_zod.z.string().datetime()
-});
-var openPositionSchema = import_zod.z.object({
-  symbol: import_zod.z.string(),
-  side: import_zod.z.enum(["LONG", "SHORT"]),
-  size: import_zod.z.number(),
-  entryPrice: import_zod.z.number(),
-  markPrice: import_zod.z.number(),
-  unrealizedPnl: import_zod.z.number(),
-  margin: import_zod.z.number(),
-  leverage: import_zod.z.number(),
-  liquidationPrice: import_zod.z.number().optional()
-});
-var openPositionsSnapshotSchema = import_zod.z.object({
-  provider: import_zod.z.literal("hyperliquid"),
-  fetchedAt: import_zod.z.string().datetime(),
-  totalUnrealizedPnl: import_zod.z.number(),
-  positions: import_zod.z.array(openPositionSchema)
-});
-var protectiveOrderKindSchema = import_zod.z.enum(["STOP_LOSS", "TAKE_PROFIT"]);
-var protectiveOrderSideSchema = import_zod.z.enum(["BUY", "SELL"]);
-var protectiveOrderPositionSideSchema = import_zod.z.enum(["BOTH", "LONG", "SHORT"]);
-var protectiveOrderSchema = import_zod.z.object({
-  id: import_zod.z.string(),
-  binanceOrderId: import_zod.z.number().int().nonnegative().optional(),
-  clientOrderId: import_zod.z.string().optional(),
-  symbol: import_zod.z.string(),
+var providerSchema = import_zod3.z.enum(["hyperliquid"]);
+var walletStateSchema = import_zod3.z.object({
+  provider: import_zod3.z.literal("hyperliquid"),
+  accountValue: import_zod3.z.number(),
+  availableBalance: import_zod3.z.number(),
+  withdrawable: import_zod3.z.number(),
+  totalMarginUsed: import_zod3.z.number(),
+  totalNotionalPosition: import_zod3.z.number(),
+  crossMarginAccountValue: import_zod3.z.number(),
+  isActivated: import_zod3.z.boolean(),
+  fetchedAt: import_zod3.z.string().datetime()
+});
+var openPositionSchema = import_zod3.z.object({
+  symbol: import_zod3.z.string(),
+  side: import_zod3.z.enum(["LONG", "SHORT"]),
+  size: import_zod3.z.number(),
+  entryPrice: import_zod3.z.number(),
+  markPrice: import_zod3.z.number(),
+  unrealizedPnl: import_zod3.z.number(),
+  margin: import_zod3.z.number(),
+  leverage: import_zod3.z.number(),
+  liquidationPrice: import_zod3.z.number().optional()
+});
+var openPositionsSnapshotSchema = import_zod3.z.object({
+  provider: import_zod3.z.literal("hyperliquid"),
+  fetchedAt: import_zod3.z.string().datetime(),
+  totalUnrealizedPnl: import_zod3.z.number(),
+  positions: import_zod3.z.array(openPositionSchema)
+});
+var protectiveOrderKindSchema = import_zod3.z.enum(["STOP_LOSS", "TAKE_PROFIT"]);
+var protectiveOrderSideSchema = import_zod3.z.enum(["BUY", "SELL"]);
+var protectiveOrderPositionSideSchema = import_zod3.z.enum(["BOTH", "LONG", "SHORT"]);
+var protectiveOrderSchema = import_zod3.z.object({
+  /** Helios's record id: what helios_positions_delete_tp_sl takes (the Hyperliquid order id works there too). */
+  id: import_zod3.z.string(),
+  /** The Hyperliquid order id (named after the retired Binance field). */
+  binanceOrderId: import_zod3.z.number().int().nonnegative().nullish(),
+  clientOrderId: import_zod3.z.string().nullish(),
+  symbol: import_zod3.z.string(),
   side: protectiveOrderSideSchema,
-  positionSide: protectiveOrderPositionSideSchema,
-  status: import_zod.z.string(),
+  positionSide: protectiveOrderPositionSideSchema.nullish().transform((value) => value ?? "BOTH"),
+  status: import_zod3.z.string(),
   kind: protectiveOrderKindSchema,
-  groupId: import_zod.z.string(),
-  stopPrice: import_zod.z.string().optional(),
-  parentClientOrderId: import_zod.z.string().optional(),
-  assetId: import_zod.z.number().int().nonnegative().optional(),
-  createdAt: import_zod.z.string().datetime()
-});
-var hyperliquidPortfolioSnapshotSchema = import_zod.z.object({
-  provider: import_zod.z.literal("hyperliquid"),
-  totalBalance: import_zod.z.number(),
-  availableBalance: import_zod.z.number(),
-  totalMargin: import_zod.z.number(),
-  unrealizedPnl: import_zod.z.number(),
-  positions: import_zod.z.array(openPositionSchema),
-  protectiveOrders: import_zod.z.array(protectiveOrderSchema)
-});
-var portfolioInputSchema = import_zod.z.object({
+  groupId: import_zod3.z.string().nullish(),
+  stopPrice: import_zod3.z.union([import_zod3.z.string(), import_zod3.z.number()]).nullish().transform((value) => value == null ? value : String(value)),
+  parentClientOrderId: import_zod3.z.string().nullish(),
+  assetId: import_zod3.z.number().int().nonnegative().nullish(),
+  createdAt: import_zod3.z.string().nullish()
+});
+var portfolioSnapshotSchema = import_zod3.z.object({
+  provider: import_zod3.z.literal("hyperliquid"),
+  totalBalance: import_zod3.z.number(),
+  availableBalance: import_zod3.z.number(),
+  totalMargin: import_zod3.z.number(),
+  unrealizedPnl: import_zod3.z.number(),
+  positions: import_zod3.z.array(openPositionSchema),
+  /** Unreadable entries are dropped (see readProtectiveOrders) rather than failing the read. */
+  protectiveOrders: import_zod3.z.array(protectiveOrderSchema)
+});
+var portfolioInputSchema = import_zod3.z.object({
   provider: providerSchema
 });
-var portfolioSnapshotSchema = hyperliquidPortfolioSnapshotSchema;
-var ledgerWindowSchema = import_zod.z.enum(["24h", "7d", "30d"]);
-var ledgerFillsInputSchema = import_zod.z.object({
+var ledgerWindowSchema = import_zod3.z.enum(["24h", "7d", "30d"]);
+var ledgerFillsInputSchema = import_zod3.z.object({
   window: ledgerWindowSchema.optional(),
-  limit: import_zod.z.number().int().positive().max(200).optional(),
-  before: import_zod.z.number().int().nonnegative().optional()
-});
-var ledgerFillSchema = import_zod.z.object({
-  coin: import_zod.z.string(),
-  px: import_zod.z.number(),
-  sz: import_zod.z.number(),
-  side: import_zod.z.enum(["B", "A"]),
-  time: import_zod.z.number().int().nonnegative(),
-  dir: import_zod.z.string(),
-  closedPnl: import_zod.z.number(),
-  fee: import_zod.z.number(),
-  crossed: import_zod.z.boolean(),
-  oid: import_zod.z.number().int().nonnegative(),
-  tid: import_zod.z.number().int().nonnegative()
-});
-var ledgerFillsPageSchema = import_zod.z.object({
+  limit: import_zod3.z.number().int().positive().max(200).optional(),
+  before: import_zod3.z.number().int().nonnegative().optional()
+});
+var ledgerFillSchema = import_zod3.z.object({
+  coin: import_zod3.z.string(),
+  px: import_zod3.z.number(),
+  sz: import_zod3.z.number(),
+  side: import_zod3.z.enum(["B", "A"]),
+  time: import_zod3.z.number().int().nonnegative(),
+  dir: import_zod3.z.string(),
+  closedPnl: import_zod3.z.number(),
+  fee: import_zod3.z.number(),
+  crossed: import_zod3.z.boolean(),
+  oid: import_zod3.z.number().int().nonnegative(),
+  tid: import_zod3.z.number().int().nonnegative()
+});
+var ledgerFillsPageSchema = import_zod3.z.object({
   window: ledgerWindowSchema,
-  limit: import_zod.z.number().int().positive(),
-  before: import_zod.z.number().int().nonnegative().optional(),
-  hasMore: import_zod.z.boolean(),
-  nextBefore: import_zod.z.number().int().nonnegative().optional(),
-  fetchedAt: import_zod.z.string().datetime(),
-  fills: import_zod.z.array(ledgerFillSchema)
-});
-var ledgerPeriodSummarySchema = import_zod.z.object({
-  realizedPnl: import_zod.z.number(),
-  totalFees: import_zod.z.number(),
-  fillCount: import_zod.z.number().int().nonnegative(),
-  closeCount: import_zod.z.number().int().nonnegative(),
-  winCount: import_zod.z.number().int().nonnegative(),
-  lossCount: import_zod.z.number().int().nonnegative(),
-  averageWin: import_zod.z.number(),
-  averageLoss: import_zod.z.number()
-});
-var ledgerSummaryInputSchema = import_zod.z.object({
+  limit: import_zod3.z.number().int().positive(),
+  before: import_zod3.z.number().int().nonnegative().optional(),
+  hasMore: import_zod3.z.boolean(),
+  nextBefore: import_zod3.z.number().int().nonnegative().optional(),
+  fetchedAt: import_zod3.z.string().datetime(),
+  fills: import_zod3.z.array(ledgerFillSchema)
+});
+var ledgerPeriodSummarySchema = import_zod3.z.object({
+  realizedPnl: import_zod3.z.number(),
+  totalFees: import_zod3.z.number(),
+  fillCount: import_zod3.z.number().int().nonnegative(),
+  closeCount: import_zod3.z.number().int().nonnegative(),
+  winCount: import_zod3.z.number().int().nonnegative(),
+  lossCount: import_zod3.z.number().int().nonnegative(),
+  averageWin: import_zod3.z.number(),
+  averageLoss: import_zod3.z.number()
+});
+var ledgerSummaryInputSchema = import_zod3.z.object({
   window: ledgerWindowSchema.optional()
 });
 var ledgerSummarySchema = ledgerPeriodSummarySchema.extend({
   window: ledgerWindowSchema,
-  generatedAt: import_zod.z.string().datetime(),
-  periods: import_zod.z.object({
+  generatedAt: import_zod3.z.string().datetime(),
+  periods: import_zod3.z.object({
     "24h": ledgerPeriodSummarySchema,
     "7d": ledgerPeriodSummarySchema
   })
 });
-var marketSnapshotScopeSchema = import_zod.z.enum(["selected", "all"]);
-var marketSnapshotResolvedScopeSchema = import_zod.z.enum(["selected", "all", "explicit"]);
-var marketSnapshotValueSchema = import_zod.z.union([import_zod.z.string(), import_zod.z.number(), import_zod.z.boolean(), import_zod.z.null()]);
-var marketSnapshotInputSchema = import_zod.z.object({
+var marketSnapshotScopeSchema = import_zod3.z.enum(["selected", "all"]);
+var marketSnapshotResolvedScopeSchema = import_zod3.z.enum(["selected", "all", "explicit"]);
+var marketSnapshotValueSchema = import_zod3.z.union([import_zod3.z.string(), import_zod3.z.number(), import_zod3.z.boolean(), import_zod3.z.null()]);
+var marketSnapshotInputSchema = import_zod3.z.object({
   scope: marketSnapshotScopeSchema.optional(),
-  symbols: import_zod.z.array(import_zod.z.string().min(1)).min(1).optional(),
-  fields: import_zod.z.array(import_zod.z.string().min(1)).min(1).optional().describe("Table columns to return; sym and base always come back. Ids: rank, lp, bv, qv, ts, r1m, r3m, r5m, r15m, r30m, r1h, r2h, r4h, r6h, r8h, r12h, r24h, r3d, r7d, hmi, hmiv, reg, ob, de, hfi, ar, ms, vcc, vcp, obosd, obosp, vwap, vwz, poc, pocd, vap, macdh, macds, macdd, srs, srr, fh24, fl24, fh7, fl7, sr, az, hfiw, trv, tri, trh, hs."),
-  sort: import_zod.z.enum(["rank"]).optional().describe('"rank" orders rows by market cap rank, unranked last.')
+  symbols: import_zod3.z.array(import_zod3.z.string().min(1)).min(1).optional(),
+  fields: import_zod3.z.array(import_zod3.z.string().min(1)).min(1).optional().describe("Table columns to return; sym and base always come back. Ids: rank, lp, bv, qv, ts, r1m, r3m, r5m, r15m, r30m, r1h, r2h, r4h, r6h, r8h, r12h, r24h, r3d, r7d, hmi, hmiv, reg, ob, de, hfi, ar, ms, vcc, vcp, obosd, obosp, vwap, vwz, poc, pocd, vap, macdh, macds, macdd, srs, srr, fh24, fl24, fh7, fl7, sr, az, hfiw, trv, tri, trh, hs."),
+  sort: import_zod3.z.enum(["rank"]).optional().describe('"rank" orders rows by market cap rank, unranked last.')
 });
 var marketSnapshotChunkInputSchema = marketSnapshotInputSchema.extend({
-  offset: import_zod.z.number().int().nonnegative().optional(),
-  limit: import_zod.z.number().int().positive().max(100).optional()
-});
-var marketFieldBlockSchema = import_zod.z.object({
-  fieldIds: import_zod.z.array(import_zod.z.string()).min(1),
-  values: import_zod.z.array(marketSnapshotValueSchema),
-  symbolLists: import_zod.z.record(import_zod.z.string(), import_zod.z.array(import_zod.z.string())).optional()
-});
-var marketMatrixSchema = import_zod.z.object({
-  fieldIds: import_zod.z.array(import_zod.z.string()).min(1),
-  rows: import_zod.z.array(import_zod.z.array(marketSnapshotValueSchema))
-});
-var marketFieldSemanticsSchema = import_zod.z.object({
-  nullMeans: import_zod.z.literal("unavailable"),
-  percentScale: import_zod.z.literal("already_percent"),
-  percentFields: import_zod.z.array(import_zod.z.string()).min(1),
-  changeMapPercentKeys: import_zod.z.array(import_zod.z.string()).min(1)
-});
-var marketSnapshotSchema = import_zod.z.object({
-  schema: import_zod.z.literal("helios.market_snapshot.v1"),
-  view: import_zod.z.literal("market_overview"),
+  offset: import_zod3.z.number().int().nonnegative().optional(),
+  limit: import_zod3.z.number().int().positive().max(100).optional()
+});
+var marketFieldBlockSchema = import_zod3.z.object({
+  fieldIds: import_zod3.z.array(import_zod3.z.string()).min(1),
+  values: import_zod3.z.array(marketSnapshotValueSchema),
+  symbolLists: import_zod3.z.record(import_zod3.z.string(), import_zod3.z.array(import_zod3.z.string())).optional()
+});
+var marketMatrixSchema = import_zod3.z.object({
+  fieldIds: import_zod3.z.array(import_zod3.z.string()).min(1),
+  rows: import_zod3.z.array(import_zod3.z.array(marketSnapshotValueSchema))
+});
+var marketFieldSemanticsSchema = import_zod3.z.object({
+  nullMeans: import_zod3.z.literal("unavailable"),
+  percentScale: import_zod3.z.literal("already_percent"),
+  percentFields: import_zod3.z.array(import_zod3.z.string()).min(1),
+  changeMapPercentKeys: import_zod3.z.array(import_zod3.z.string()).min(1)
+});
+var marketSnapshotSchema = import_zod3.z.object({
+  schema: import_zod3.z.literal("helios.market_snapshot.v1"),
+  view: import_zod3.z.literal("market_overview"),
   scope: marketSnapshotResolvedScopeSchema,
-  symbolCount: import_zod.z.number().int().nonnegative(),
-  generatedAt: import_zod.z.string().datetime(),
-  returnedSymbols: import_zod.z.array(import_zod.z.string()),
+  symbolCount: import_zod3.z.number().int().nonnegative(),
+  generatedAt: import_zod3.z.string().datetime(),
+  returnedSymbols: import_zod3.z.array(import_zod3.z.string()),
   semantics: marketFieldSemanticsSchema,
   market: marketFieldBlockSchema,
   table: marketMatrixSchema,
-  legend: import_zod.z.record(import_zod.z.string(), import_zod.z.union([import_zod.z.string(), import_zod.z.array(import_zod.z.string())]))
+  legend: import_zod3.z.record(import_zod3.z.string(), import_zod3.z.union([import_zod3.z.string(), import_zod3.z.array(import_zod3.z.string())]))
 });
-var marketSnapshotChunkSchema = import_zod.z.object({
-  schema: import_zod.z.literal("helios.market_snapshot_chunk.v1"),
-  view: import_zod.z.literal("market_overview_chunk"),
+var marketSnapshotChunkSchema = import_zod3.z.object({
+  schema: import_zod3.z.literal("helios.market_snapshot_chunk.v1"),
+  view: import_zod3.z.literal("market_overview_chunk"),
   scope: marketSnapshotResolvedScopeSchema,
-  totalSymbolCount: import_zod.z.number().int().nonnegative(),
-  generatedAt: import_zod.z.string().datetime(),
-  offset: import_zod.z.number().int().nonnegative(),
-  limit: import_zod.z.number().int().positive(),
-  chunkSymbolCount: import_zod.z.number().int().nonnegative(),
-  hasMore: import_zod.z.boolean(),
-  nextOffset: import_zod.z.number().int().nonnegative().optional(),
-  returnedSymbols: import_zod.z.array(import_zod.z.string()),
+  totalSymbolCount: import_zod3.z.number().int().nonnegative(),
+  generatedAt: import_zod3.z.string().datetime(),
+  offset: import_zod3.z.number().int().nonnegative(),
+  limit: import_zod3.z.number().int().positive(),
+  chunkSymbolCount: import_zod3.z.number().int().nonnegative(),
+  hasMore: import_zod3.z.boolean(),
+  nextOffset: import_zod3.z.number().int().nonnegative().optional(),
+  returnedSymbols: import_zod3.z.array(import_zod3.z.string()),
   semantics: marketFieldSemanticsSchema,
   market: marketFieldBlockSchema,
   table: marketMatrixSchema,
-  legend: import_zod.z.record(import_zod.z.string(), import_zod.z.union([import_zod.z.string(), import_zod.z.array(import_zod.z.string())]))
+  legend: import_zod3.z.record(import_zod3.z.string(), import_zod3.z.union([import_zod3.z.string(), import_zod3.z.array(import_zod3.z.string())]))
 });
-var marketSymbolDetailInputSchema = import_zod.z.object({
-  symbol: import_zod.z.string().min(1),
-  full: import_zod.z.boolean().optional().describe("true adds every raw indicator and the price history (large, ~25 KB). Omit for the compact row and market context.")
+var marketSymbolDetailInputSchema = import_zod3.z.object({
+  symbol: import_zod3.z.string().min(1),
+  full: import_zod3.z.boolean().optional().describe("true adds every raw indicator and the price history (large, ~25 KB). Omit for the compact row and market context.")
 });
-var marketSymbolDetailSchema = import_zod.z.object({
-  schema: import_zod.z.literal("helios.market_symbol_detail.v1"),
-  generatedAt: import_zod.z.string().datetime(),
-  symbol: import_zod.z.string(),
+var marketSymbolDetailSchema = import_zod3.z.object({
+  schema: import_zod3.z.literal("helios.market_symbol_detail.v1"),
+  generatedAt: import_zod3.z.string().datetime(),
+  symbol: import_zod3.z.string(),
   semantics: marketFieldSemanticsSchema,
   market: marketFieldBlockSchema,
-  row: import_zod.z.record(import_zod.z.string(), marketSnapshotValueSchema),
-  symbolCtx: import_zod.z.record(import_zod.z.string(), marketSnapshotValueSchema),
-  changeMap: import_zod.z.record(import_zod.z.string(), import_zod.z.number().nullable()),
-  metrics: import_zod.z.record(import_zod.z.string(), import_zod.z.unknown()).nullable(),
-  legend: import_zod.z.record(import_zod.z.string(), import_zod.z.union([import_zod.z.string(), import_zod.z.array(import_zod.z.string())]))
-});
-var tradingDirectionSchema = import_zod.z.enum(["LONG", "SHORT"]);
-var tradingExecutionStyleSchema = import_zod.z.enum(["MARKET", "LIMIT_TAKER", "LIMIT_MAKER", "LIMIT_GTC"]);
-var tradingSizeSchema = import_zod.z.object({
-  mode: import_zod.z.enum(["MARGIN_USD", "BASE_QUANTITY"]),
-  value: import_zod.z.number().positive()
-});
-var tradingProtectionLegSchema = import_zod.z.object({
-  kind: import_zod.z.enum(["LIMIT", "MARKET"]),
-  triggerPrice: import_zod.z.number().positive(),
-  limitPrice: import_zod.z.number().positive().optional()
-});
-var tradingProtectionSchema = import_zod.z.object({
+  row: import_zod3.z.record(import_zod3.z.string(), marketSnapshotValueSchema),
+  symbolCtx: import_zod3.z.record(import_zod3.z.string(), marketSnapshotValueSchema),
+  changeMap: import_zod3.z.record(import_zod3.z.string(), import_zod3.z.number().nullable()),
+  metrics: import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()).nullable(),
+  legend: import_zod3.z.record(import_zod3.z.string(), import_zod3.z.union([import_zod3.z.string(), import_zod3.z.array(import_zod3.z.string())]))
+});
+var tradingDirectionSchema = import_zod3.z.enum(["LONG", "SHORT"]);
+var tradingExecutionStyleSchema = import_zod3.z.enum(["MARKET", "LIMIT_TAKER", "LIMIT_MAKER", "LIMIT_GTC"]);
+var tradingSizeSchema = import_zod3.z.object({
+  mode: import_zod3.z.enum(["MARGIN_USD", "BASE_QUANTITY"]),
+  value: import_zod3.z.number().positive()
+});
+var tradingProtectionLegSchema = import_zod3.z.object({
+  kind: import_zod3.z.enum(["LIMIT", "MARKET"]),
+  triggerPrice: import_zod3.z.number().positive(),
+  limitPrice: import_zod3.z.number().positive().optional()
+});
+var tradingProtectionSchema = import_zod3.z.object({
   takeProfit: tradingProtectionLegSchema.optional(),
   stopLoss: tradingProtectionLegSchema.optional()
 });
-var tradeIntentTypeSchema = import_zod.z.enum(["OPEN", "DCA", "REVERSE", "CLOSE"]);
-var submitTradeIntentInputSchema = import_zod.z.object({
+var tradingSymbolSchema = import_zod3.z.string().regex(/^(?:[a-zA-Z0-9]{1,10}:)?[a-zA-Z0-9]+(?:USDT)?$/);
+var tradeIntentTypeSchema = import_zod3.z.enum(["OPEN", "DCA", "REVERSE", "CLOSE"]);
+var submitTradeIntentInputSchema = import_zod3.z.object({
   provider: providerSchema.optional(),
-  symbol: import_zod.z.string().regex(/^[a-zA-Z0-9]+(?:USDT)?$/),
+  symbol: tradingSymbolSchema,
   intentType: tradeIntentTypeSchema,
   direction: tradingDirectionSchema,
   size: tradingSizeSchema,
-  execution: import_zod.z.object({
+  execution: import_zod3.z.object({
     style: tradingExecutionStyleSchema,
-    timeInForce: import_zod.z.enum(["GTC", "IOC", "FOK", "GTX"]).optional(),
-    limitPrice: import_zod.z.number().positive().optional()
+    timeInForce: import_zod3.z.enum(["GTC", "IOC", "FOK", "GTX"]).optional(),
+    limitPrice: import_zod3.z.number().positive().optional()
   }),
-  maxSlippageBps: import_zod.z.number().int().nonnegative().max(1e3).optional(),
-  leverageOverride: import_zod.z.number().positive().optional(),
-  marginModeOverride: import_zod.z.enum(["ISOLATED", "CROSS"]).optional(),
-  reduceOnly: import_zod.z.boolean().optional(),
+  maxSlippageBps: import_zod3.z.number().int().nonnegative().max(1e3).optional(),
+  leverageOverride: import_zod3.z.number().positive().optional(),
+  marginModeOverride: import_zod3.z.enum(["ISOLATED", "CROSS"]).optional(),
+  reduceOnly: import_zod3.z.boolean().optional(),
   protection: tradingProtectionSchema.optional(),
   /** One per user action, reused on retries: the data-bridge never places a second order for the same key. */
-  idempotencyKey: import_zod.z.string().regex(/^[A-Za-z0-9_-]{8,64}$/).optional()
+  idempotencyKey: import_zod3.z.string().regex(/^[A-Za-z0-9_-]{8,64}$/).optional(),
+  /** With it, idempotencyKey is the order's fingerprint: repeats within this many seconds of the first are one order. */
+  idempotencyWindowSeconds: import_zod3.z.number().int().min(10).max(600).optional()
 });
-var submitTradeIntentResultSchema = import_zod.z.object({
-  status: import_zod.z.literal("submitted"),
+var submitTradeIntentResultSchema = import_zod3.z.object({
+  status: import_zod3.z.literal("submitted"),
   /** `replayed`: an earlier attempt of this action already placed the order; nothing new was sent. */
-  outcome: import_zod.z.enum(["placed", "replayed"]).optional(),
-  clientOrderId: import_zod.z.string().optional(),
-  orderStatus: import_zod.z.string().optional(),
+  outcome: import_zod3.z.enum(["placed", "replayed"]).optional(),
+  clientOrderId: import_zod3.z.string().optional(),
+  orderStatus: import_zod3.z.string().optional(),
   /** TP/SL legs Hyperliquid refused while the entry went through: the position is open without them. */
-  rejectedProtection: import_zod.z.array(import_zod.z.object({ kind: import_zod.z.string(), reason: import_zod.z.string() })).optional(),
+  rejectedProtection: import_zod3.z.array(import_zod3.z.object({ kind: import_zod3.z.string(), reason: import_zod3.z.string() })).optional(),
   provider: providerSchema.optional(),
-  symbol: import_zod.z.string(),
+  symbol: import_zod3.z.string(),
   intentType: tradeIntentTypeSchema,
   direction: tradingDirectionSchema,
   size: tradingSizeSchema,
-  execution: import_zod.z.object({
+  execution: import_zod3.z.object({
     style: tradingExecutionStyleSchema,
-    timeInForce: import_zod.z.enum(["GTC", "IOC", "FOK", "GTX"]).optional(),
-    limitPrice: import_zod.z.number().positive().optional()
+    timeInForce: import_zod3.z.enum(["GTC", "IOC", "FOK", "GTX"]).optional(),
+    limitPrice: import_zod3.z.number().positive().optional()
   }),
-  maxSlippageBps: import_zod.z.number().int().nonnegative().max(1e3).optional(),
-  leverageOverride: import_zod.z.number().positive().optional(),
-  marginModeOverride: import_zod.z.enum(["ISOLATED", "CROSS"]).optional(),
-  reduceOnly: import_zod.z.boolean(),
-  hasProtection: import_zod.z.boolean()
+  maxSlippageBps: import_zod3.z.number().int().nonnegative().max(1e3).optional(),
+  leverageOverride: import_zod3.z.number().positive().optional(),
+  marginModeOverride: import_zod3.z.enum(["ISOLATED", "CROSS"]).optional(),
+  reduceOnly: import_zod3.z.boolean(),
+  hasProtection: import_zod3.z.boolean()
 });
-var closePositionInputSchema = import_zod.z.object({
+var closePositionInputSchema = import_zod3.z.object({
   provider: providerSchema.optional(),
-  symbol: import_zod.z.string().regex(/^[a-zA-Z0-9]+(?:USDT)?$/),
-  maxSlippageBps: import_zod.z.number().int().nonnegative().max(1e3).optional()
+  symbol: tradingSymbolSchema,
+  maxSlippageBps: import_zod3.z.number().int().nonnegative().max(1e3).optional(),
+  /** The share of the position to close (0 < fraction < 1 closes part of it); omitted or 1 closes it all. */
+  fraction: import_zod3.z.number().positive().max(1).optional()
 });
-var closePositionResultSchema = import_zod.z.object({
-  status: import_zod.z.literal("submitted"),
+var closePositionResultSchema = import_zod3.z.object({
+  status: import_zod3.z.literal("submitted"),
+  /** `no_position`: nothing was open on this coin, so no order was sent. Absent from older data-bridges. */
+  outcome: import_zod3.z.enum(["closed", "no_position"]).optional(),
   provider: providerSchema.optional(),
-  symbol: import_zod.z.string(),
-  mode: import_zod.z.literal("FULL"),
-  maxSlippageBps: import_zod.z.number().int().nonnegative().max(1e3).optional()
+  symbol: import_zod3.z.string(),
+  mode: import_zod3.z.enum(["FULL", "PARTIAL"]),
+  fraction: import_zod3.z.number().positive().max(1).optional(),
+  maxSlippageBps: import_zod3.z.number().int().nonnegative().max(1e3).optional()
 });
-var setTpSlInputSchema = import_zod.z.object({
+var setTpSlInputSchema = import_zod3.z.object({
   provider: providerSchema.optional(),
-  symbol: import_zod.z.string().regex(/^[a-zA-Z0-9]+(?:USDT)?$/),
-  applyTo: import_zod.z.enum(["FULL_POSITION", "CUSTOM_QUANTITY"]),
-  quantity: import_zod.z.number().positive().optional(),
-  parentClientOrderId: import_zod.z.string(),
+  symbol: tradingSymbolSchema,
+  applyTo: import_zod3.z.enum(["FULL_POSITION", "CUSTOM_QUANTITY"]),
+  quantity: import_zod3.z.number().positive().optional(),
+  parentClientOrderId: import_zod3.z.string(),
   takeProfit: tradingProtectionLegSchema.optional(),
   stopLoss: tradingProtectionLegSchema.optional()
 });
-var setTpSlResultSchema = import_zod.z.object({
-  status: import_zod.z.literal("submitted"),
+var setTpSlResultSchema = import_zod3.z.object({
+  status: import_zod3.z.literal("submitted"),
   provider: providerSchema.optional(),
-  symbol: import_zod.z.string(),
-  applyTo: import_zod.z.enum(["FULL_POSITION", "CUSTOM_QUANTITY"]),
-  quantity: import_zod.z.number().positive().optional(),
-  parentClientOrderId: import_zod.z.string(),
-  hasTakeProfit: import_zod.z.boolean(),
-  hasStopLoss: import_zod.z.boolean()
-});
-var deleteTpSlInputSchema = import_zod.z.object({
+  symbol: import_zod3.z.string(),
+  applyTo: import_zod3.z.enum(["FULL_POSITION", "CUSTOM_QUANTITY"]),
+  quantity: import_zod3.z.number().positive().optional(),
+  parentClientOrderId: import_zod3.z.string(),
+  hasTakeProfit: import_zod3.z.boolean(),
+  hasStopLoss: import_zod3.z.boolean()
+});
+var deleteTpSlInputSchema = import_zod3.z.object({
   provider: providerSchema.optional(),
-  symbol: import_zod.z.string().regex(/^[a-zA-Z0-9]+(?:USDT)?$/),
-  orderId: import_zod.z.string()
+  symbol: tradingSymbolSchema,
+  orderId: import_zod3.z.string()
 });
-var deleteTpSlResultSchema = import_zod.z.object({
-  status: import_zod.z.literal("deleted"),
+var deleteTpSlResultSchema = import_zod3.z.object({
+  status: import_zod3.z.literal("deleted"),
   provider: providerSchema.optional(),
-  symbol: import_zod.z.string(),
-  orderId: import_zod.z.string()
-});
-var openOrderSchema = import_zod.z.object({
-  coin: import_zod.z.string(),
-  side: import_zod.z.enum(["B", "A"]),
-  limitPx: import_zod.z.string(),
-  sz: import_zod.z.string(),
-  oid: import_zod.z.number().int().nonnegative(),
-  timestamp: import_zod.z.number().int().nonnegative(),
-  origSz: import_zod.z.string(),
-  orderType: import_zod.z.string(),
-  tif: import_zod.z.string().nullable(),
-  reduceOnly: import_zod.z.boolean(),
-  isTrigger: import_zod.z.boolean(),
-  triggerPx: import_zod.z.string(),
-  cloid: import_zod.z.string().nullable(),
-  assetId: import_zod.z.number().int().nonnegative().optional()
-});
-var cancelOrderInputSchema = import_zod.z.object({
-  symbol: import_zod.z.string().regex(/^[a-zA-Z0-9]+(?:USDT)?$/),
-  oid: import_zod.z.number().int().nonnegative()
-});
-var cancelOrderResultSchema = import_zod.z.object({
-  status: import_zod.z.literal("cancelled"),
-  symbol: import_zod.z.string(),
-  oid: import_zod.z.number().int().nonnegative()
+  symbol: import_zod3.z.string(),
+  orderId: import_zod3.z.string()
 });
-var heliosAgentErrorResponseSchema = import_zod2.z.object({
-  error: import_zod2.z.string().optional(),
-  errorDescription: import_zod2.z.string().optional(),
-  message: import_zod2.z.string().optional()
+var openOrderSchema = import_zod3.z.object({
+  coin: import_zod3.z.string(),
+  side: import_zod3.z.enum(["B", "A"]),
+  limitPx: import_zod3.z.string(),
+  sz: import_zod3.z.string(),
+  oid: import_zod3.z.number().int().nonnegative(),
+  timestamp: import_zod3.z.number().int().nonnegative(),
+  origSz: import_zod3.z.string(),
+  orderType: import_zod3.z.string(),
+  tif: import_zod3.z.string().nullable(),
+  reduceOnly: import_zod3.z.boolean(),
+  isTrigger: import_zod3.z.boolean(),
+  triggerPx: import_zod3.z.string(),
+  cloid: import_zod3.z.string().nullable(),
+  assetId: import_zod3.z.number().int().nonnegative().optional()
 });
-var HeliosAgentApiError = class extends Error {
-  constructor(options) {
-    super(options.message);
-    __publicField2(this, "status");
-    __publicField2(this, "code");
-    __publicField2(this, "errorDescription");
-    __publicField2(this, "payload");
-    this.name = "HeliosAgentApiError";
-    this.status = options.status;
-    this.code = options.code;
-    this.errorDescription = options.errorDescription;
-    this.payload = options.payload;
-    if (options.cause !== void 0) {
-      Object.defineProperty(this, "cause", {
-        configurable: true,
-        enumerable: false,
-        value: options.cause,
-        writable: true
-      });
-    }
+var cancelOrderInputSchema = import_zod3.z.object({
+  symbol: tradingSymbolSchema,
+  oid: import_zod3.z.number().int().nonnegative()
+});
+var cancelOrderResultSchema = import_zod3.z.object({
+  status: import_zod3.z.literal("cancelled"),
+  symbol: import_zod3.z.string(),
+  oid: import_zod3.z.number().int().nonnegative()
+});
+var modifyOrderInputSchema = import_zod3.z.object({
+  symbol: tradingSymbolSchema,
+  oid: import_zod3.z.number().int().nonnegative(),
+  price: import_zod3.z.number().positive().finite(),
+  /** Size in the coin (base quantity). */
+  size: import_zod3.z.number().positive().finite()
+});
+var modifyOrderResultSchema = import_zod3.z.object({
+  status: import_zod3.z.literal("modified"),
+  symbol: import_zod3.z.string(),
+  oid: import_zod3.z.number().int().nonnegative(),
+  price: import_zod3.z.number(),
+  size: import_zod3.z.number()
+});
+var AGENT_PAPER_ACCOUNT = "agent";
+var paperFillSchema = import_zod3.z.object({
+  ts: import_zod3.z.number(),
+  coin: import_zod3.z.string(),
+  kind: import_zod3.z.string(),
+  side: import_zod3.z.enum(["BUY", "SELL"]).nullable(),
+  size: import_zod3.z.number(),
+  price: import_zod3.z.number(),
+  fee: import_zod3.z.number(),
+  pnl: import_zod3.z.number()
+});
+var paperPortfolioSchema = portfolioSnapshotSchema.extend({
+  cash: import_zod3.z.number().optional(),
+  realizedPnl: import_zod3.z.number().optional(),
+  feesPaid: import_zod3.z.number().optional(),
+  fundingPaid: import_zod3.z.number().optional(),
+  liquidations: import_zod3.z.number().optional()
+});
+var agentSetupSchema = import_zod3.z.enum(["turning up from breakdown", "falling, no turn yet", "stretched up", "stretched down", "neutral"]);
+var smSideNameSchema = import_zod3.z.enum(["long", "short"]);
+var agentMarketInputSchema = import_zod3.z.object({
+  coins: import_zod3.z.array(import_zod3.z.string().min(1)).min(1).max(50).optional(),
+  limit: import_zod3.z.number().int().min(1).max(300).optional(),
+  offset: import_zod3.z.number().int().nonnegative().optional(),
+  sort: import_zod3.z.enum(["volume", "rank", "move1h", "move24h", "funding", "lean", "edge"]).optional(),
+  filter: import_zod3.z.enum(["turning", "falling", "stretched_up", "stretched_down", "sm_long", "sm_short", "discount"]).optional()
+});
+var agentMarketRowSchema = import_zod3.z.object({
+  coin: import_zod3.z.string(),
+  rank: import_zod3.z.number().nullable(),
+  px: import_zod3.z.number().nullable(),
+  r15m: import_zod3.z.number().nullable(),
+  r1h: import_zod3.z.number().nullable(),
+  r24h: import_zod3.z.number().nullable(),
+  volUsd: import_zod3.z.number().nullable(),
+  fundAprPct: import_zod3.z.number().nullable(),
+  oiUsd: import_zod3.z.number().nullable(),
+  setup: agentSetupSchema.nullable()
+});
+var agentMarketSchema = import_zod3.z.object({
+  asOf: import_zod3.z.string().nullable(),
+  smAsOf: import_zod3.z.number().nullable(),
+  market: import_zod3.z.object({ os: import_zod3.z.number().nullable(), mti: import_zod3.z.number().nullable(), Mti: import_zod3.z.number().nullable() }),
+  total: import_zod3.z.number().int().nonnegative(),
+  offset: import_zod3.z.number().int().nonnegative(),
+  rows: import_zod3.z.array(
+    agentMarketRowSchema.extend({
+      sm: import_zod3.z.object({
+        side: smSideNameSchema.nullable(),
+        share: import_zod3.z.number(),
+        edgePct: import_zod3.z.number().nullable(),
+        discount: import_zod3.z.enum(["strict", "fill"]).nullable()
+      }).nullable()
+    })
+  ),
+  next: import_zod3.z.number().int().nonnegative().nullable(),
+  unknown: import_zod3.z.array(import_zod3.z.string())
+});
+var smPileInSchema = import_zod3.z.object({
+  coin: import_zod3.z.string(),
+  side: smSideNameSchema,
+  dir: import_zod3.z.enum(["in", "out"]),
+  traders: import_zod3.z.number(),
+  totalUsd: import_zod3.z.number(),
+  weight: import_zod3.z.number(),
+  names: import_zod3.z.array(import_zod3.z.string()),
+  first: import_zod3.z.number(),
+  last: import_zod3.z.number()
+});
+var smartMoneyBoardInputSchema = import_zod3.z.object({
+  view: import_zod3.z.enum(["conviction", "discount", "flows", "pileins"]).optional(),
+  side: import_zod3.z.enum(["long", "short", "any"]).optional(),
+  limit: import_zod3.z.number().int().min(1).max(25).optional()
+});
+var smartMoneyBoardSchema = import_zod3.z.object({
+  asOf: import_zod3.z.number().nullable(),
+  view: import_zod3.z.enum(["conviction", "discount", "flows", "pileins"]),
+  wallets: import_zod3.z.number(),
+  known: import_zod3.z.number(),
+  rows: import_zod3.z.array(
+    import_zod3.z.object({
+      coin: import_zod3.z.string(),
+      side: smSideNameSchema.nullable(),
+      share: import_zod3.z.number(),
+      lean: import_zod3.z.number(),
+      sideUsd: import_zod3.z.number(),
+      heads: import_zod3.z.number(),
+      traders: import_zod3.z.number(),
+      entry: import_zod3.z.number().nullable(),
+      mark: import_zod3.z.number().nullable(),
+      edgePct: import_zod3.z.number().nullable(),
+      flow1hUsd: import_zod3.z.number(),
+      discount: import_zod3.z.enum(["strict", "fill"]).nullable(),
+      setup: agentSetupSchema.nullable(),
+      r24h: import_zod3.z.number().nullable()
+    })
+  ),
+  pileIns: import_zod3.z.array(smPileInSchema),
+  note: import_zod3.z.string().nullable()
+});
+var smartMoneyMovesInputSchema = import_zod3.z.object({
+  since: import_zod3.z.string().regex(/^\d{1,16}-\d{1,16}$/).optional(),
+  coin: import_zod3.z.string().min(1).optional(),
+  kind: import_zod3.z.enum(["entries", "exits", "all"]).optional(),
+  minUsd: import_zod3.z.number().nonnegative().optional(),
+  limit: import_zod3.z.number().int().min(1).max(50).optional()
+});
+var smMoveSchema = import_zod3.z.object({
+  id: import_zod3.z.string(),
+  t: import_zod3.z.number(),
+  coin: import_zod3.z.string(),
+  kind: import_zod3.z.enum(["open", "add", "reduce", "close", "flip"]),
+  side: smSideNameSchema,
+  usd: import_zod3.z.number(),
+  px: import_zod3.z.number(),
+  lev: import_zod3.z.number().nullable(),
+  pnl: import_zod3.z.number().nullable(),
+  pnlPct: import_zod3.z.number().nullable(),
+  nick: import_zod3.z.string(),
+  rank: import_zod3.z.number(),
+  style: import_zod3.z.string(),
+  win: import_zod3.z.number().nullable(),
+  w: import_zod3.z.number()
+});
+var smartMoneyMovesSchema = import_zod3.z.object({
+  order: import_zod3.z.enum(["newest", "oldest"]),
+  moves: import_zod3.z.array(smMoveSchema),
+  next: import_zod3.z.string().nullable(),
+  more: import_zod3.z.boolean(),
+  gap: import_zod3.z.boolean(),
+  note: import_zod3.z.string().nullable()
+});
+var smBookSideSchema = import_zod3.z.object({ usd: import_zod3.z.number(), heads: import_zod3.z.number(), traders: import_zod3.z.number(), entry: import_zod3.z.number().nullable() });
+var smartMoneyCoinSchema = import_zod3.z.object({
+  coin: import_zod3.z.string(),
+  asOf: import_zod3.z.number().nullable(),
+  sm: import_zod3.z.object({
+    coin: import_zod3.z.string(),
+    mark: import_zod3.z.number().nullable(),
+    long: smBookSideSchema,
+    short: smBookSideSchema,
+    lean: import_zod3.z.number(),
+    side: smSideNameSchema.nullable(),
+    share: import_zod3.z.number(),
+    edgePct: import_zod3.z.number().nullable(),
+    flow1hUsd: import_zod3.z.number(),
+    conviction: import_zod3.z.number().nullable(),
+    discount: import_zod3.z.enum(["strict", "fill"]).nullable(),
+    pileIn: smPileInSchema.nullable()
+  }).nullable(),
+  market: agentMarketRowSchema.nullable(),
+  moves: import_zod3.z.array(smMoveSchema),
+  note: import_zod3.z.string().nullable()
+});
+var marketCandlesInputSchema = import_zod3.z.object({
+  symbol: import_zod3.z.string().regex(/^[A-Za-z0-9]{1,20}$/),
+  interval: import_zod3.z.enum(["1m", "3m", "5m", "15m", "30m", "1h", "2h", "4h", "6h", "8h", "12h", "1d", "1w", "1M"]),
+  endTime: import_zod3.z.number().int().positive().optional(),
+  limit: import_zod3.z.number().int().min(1).max(10080).optional()
+});
+var marketCandlesSchema = import_zod3.z.object({
+  candles: import_zod3.z.array(import_zod3.z.object({ t: import_zod3.z.number(), o: import_zod3.z.number(), h: import_zod3.z.number(), l: import_zod3.z.number(), c: import_zod3.z.number(), v: import_zod3.z.number() })),
+  complete: import_zod3.z.boolean()
+});
+var DEFAULT_AGENT_REFRESH_WINDOW_MS = 60 * 1e3;
+var agentConnectionStatusSchema = import_zod4.z.enum([
+  "disconnected",
+  "pending",
+  "connected",
+  "rejected",
+  "expired",
+  "failed"
+]);
+var agentSessionIssuerSchema = import_zod4.z.object({
+  identityServiceUrl: import_zod4.z.string(),
+  dataBridgeUrl: import_zod4.z.string()
+});
+var storedAgentSessionSchema = import_zod4.z.object({
+  accessToken: import_zod4.z.string(),
+  refreshToken: import_zod4.z.string(),
+  tokenType: agentTokenResponseSchema.shape.tokenType,
+  ownerUserId: import_zod4.z.string(),
+  agentGrantId: import_zod4.z.string(),
+  scope: import_zod4.z.array(agentScopeSchema).min(1),
+  accessTokenExpiresAt: import_zod4.z.string().datetime(),
+  createdAt: import_zod4.z.string().datetime(),
+  lastRefreshedAt: import_zod4.z.string().datetime(),
+  issuer: agentSessionIssuerSchema.nullish()
+});
+var agentSessionViewSchema = import_zod4.z.object({
+  connected: import_zod4.z.boolean(),
+  status: agentConnectionStatusSchema,
+  ownerUserId: import_zod4.z.string().optional(),
+  agentGrantId: import_zod4.z.string().optional(),
+  scope: import_zod4.z.array(agentScopeSchema).optional(),
+  accessTokenExpiresAt: import_zod4.z.string().datetime().optional(),
+  lastRefreshedAt: import_zod4.z.string().datetime().optional()
+});
+function createStoredAgentSession(tokenResponse, now = /* @__PURE__ */ new Date()) {
+  const createdAt = now.toISOString();
+  return {
+    accessToken: tokenResponse.accessToken,
+    refreshToken: tokenResponse.refreshToken,
+    tokenType: tokenResponse.tokenType,
+    ownerUserId: tokenResponse.ownerUserId,
+    agentGrantId: tokenResponse.agentGrantId,
+    scope: tokenResponse.scope,
+    accessTokenExpiresAt: new Date(now.getTime() + tokenResponse.expiresInSeconds * 1e3).toISOString(),
+    createdAt,
+    lastRefreshedAt: createdAt
+  };
+}
+function sanitizeAgentSession(session, status = session ? "connected" : "disconnected") {
+  if (!session) {
+    return {
+      connected: false,
+      status: status === "connected" ? "disconnected" : status
+    };
   }
-};
-function isHeliosAgentApiError(error) {
-  return error instanceof HeliosAgentApiError;
+  return {
+    connected: true,
+    status,
+    ownerUserId: session.ownerUserId,
+    agentGrantId: session.agentGrantId,
+    scope: session.scope,
+    accessTokenExpiresAt: session.accessTokenExpiresAt,
+    lastRefreshedAt: session.lastRefreshedAt
+  };
 }
-var HeliosAgentAuthClient = class {
+function shouldRefreshAgentSession(session, now = /* @__PURE__ */ new Date(), refreshWindowMs = DEFAULT_AGENT_REFRESH_WINDOW_MS) {
+  return new Date(session.accessTokenExpiresAt).getTime() - now.getTime() <= refreshWindowMs;
+}
+var pendingAgentLoginSchema = import_zod.z.object({
+  status: import_zod.z.literal("pending"),
+  deviceCode: import_zod.z.string(),
+  userCode: import_zod.z.string(),
+  verificationUri: import_zod.z.string().url(),
+  verificationUriComplete: import_zod.z.string().url(),
+  expiresInSeconds: import_zod.z.number().int().positive(),
+  pollIntervalSeconds: import_zod.z.number().int().positive(),
+  requestedScope: import_zod.z.array(agentScopeSchema).min(1),
+  startedAt: import_zod.z.string().datetime()
+});
+var DEFAULT_SCOPE = [AGENT_SCOPES.ACCOUNT_READ, AGENT_SCOPES.MARKET_READ];
+var AgentAuthService = class {
   constructor(options) {
-    __publicField2(this, "baseUrl");
-    __publicField2(this, "fetchImpl");
-    __publicField2(this, "headers");
-    this.baseUrl = options.baseUrl.replace(/\/+$/, "");
-    this.fetchImpl = options.fetch ?? fetch;
-    this.headers = options.headers ?? {};
+    __publicField2(this, "client");
+    __publicField2(this, "sessionStore");
+    __publicField2(this, "messages");
+    __publicField2(this, "refreshWindowMs");
+    __publicField2(this, "now");
+    __publicField2(this, "defaultClientName");
+    __publicField2(this, "deviceLogin");
+    __publicField2(this, "reloginForMissingScope");
+    __publicField2(this, "refreshInFlight", null);
+    __publicField2(this, "exchangeInFlight", null);
+    this.client = options.client;
+    this.sessionStore = options.sessionStore;
+    this.messages = options.messages;
+    this.refreshWindowMs = options.refreshWindowMs ?? DEFAULT_AGENT_REFRESH_WINDOW_MS;
+    this.now = options.now ?? (() => /* @__PURE__ */ new Date());
+    this.defaultClientName = options.defaultClientName;
+    this.deviceLogin = options.deviceLogin ?? true;
+    this.reloginForMissingScope = options.reloginForMissingScope ?? false;
   }
   async startLogin(input) {
-    const parsed = agentDeviceStartInputSchema.parse(input);
-    return this.post("/api/agents/device/start", parsed, agentDeviceStartOutputSchema);
+    if (!this.deviceLogin) {
+      throw new Error(this.messages.reconnect);
+    }
+    const response = await this.client.startLogin(input);
+    const result = {
+      status: "pending",
+      ...response,
+      requestedScope: input.scope,
+      startedAt: this.now().toISOString()
+    };
+    await this.sessionStore.setPendingLogin(result);
+    return result;
   }
-  async exchangeDeviceCode(deviceCode) {
-    const parsed = agentDeviceStartOutputSchema.shape.deviceCode.parse(deviceCode);
-    return this.post("/api/agents/device/token", { deviceCode: parsed }, agentTokenResponseSchema);
+  async resetSessionAndStartLogin(input) {
+    await this.clearSessionState();
+    return this.startLogin(input);
   }
-  async refreshSession(refreshToken) {
-    const parsed = agentRefreshInputSchema.parse({ refreshToken });
-    return this.post("/api/agents/auth/refresh", parsed, agentTokenResponseSchema);
+  async startRelogin(options = {}) {
+    const started = await this.resetSessionAndStartLogin(this.loginInput(options));
+    return this.pendingResult(started);
   }
-  async post(path3, body, schema) {
-    let response;
-    try {
-      response = await this.fetchImpl(`${this.baseUrl}${path3}`, {
-        method: "POST",
-        headers: {
-          Accept: "application/json",
-          "Content-Type": "application/json",
-          ...this.headers
-        },
-        body: JSON.stringify(body)
-      });
-    } catch (error) {
-      throw new HeliosAgentApiError({
-        status: 0,
-        code: "network_error",
-        message: error instanceof Error ? error.message : "Network error",
-        cause: error
-      });
-    }
-    const payload = await this.parseJson(response);
-    if (!response.ok) {
-      const parsed = heliosAgentErrorResponseSchema.safeParse(payload);
-      throw new HeliosAgentApiError({
-        status: response.status,
-        code: parsed.success ? parsed.data.error ?? "request_failed" : "request_failed",
-        message: parsed.success ? parsed.data.errorDescription ?? parsed.data.message ?? `Request failed with status ${response.status}` : `Request failed with status ${response.status}`,
-        errorDescription: parsed.success ? parsed.data.errorDescription : void 0,
-        payload
-      });
-    }
-    return schema.parse(payload);
+  async clearSessionState() {
+    await this.sessionStore.clearSession();
+    await this.sessionStore.clearPendingLogin();
   }
-  async parseJson(response) {
-    const text = await response.text();
-    if (!text) {
+  /** After a 401 from Helios: drops the session and starts a fresh login. Null for any other error. */
+  async invalidateIfUnauthorized(error, options = {}) {
+    if (!isHeliosAgentApiError(error) || error.status !== 401) {
       return null;
     }
-    try {
-      return JSON.parse(text);
-    } catch (error) {
-      throw new HeliosAgentApiError({
-        status: response.status,
-        code: "invalid_json",
-        message: "Received an invalid JSON response from Helios",
-        cause: error
-      });
+    return this.startRelogin(options);
+  }
+  /** After a 401 from Helios: refreshes the session even if it isn't near expiry. Null for any other error. */
+  async refreshSessionAfterUnauthorized(error) {
+    if (!isHeliosAgentApiError(error) || error.status !== 401) {
+      return null;
     }
+    const session = await this.sessionStore.getSession();
+    return session ? this.refreshStoredSession(session, true) : null;
   }
-};
+  async ensureLogin(options = {}) {
+    const requestedScope = options.scope ?? DEFAULT_SCOPE;
+    const requestedConstraints = options.constraints ?? {};
+    const session = await this.getValidSession();
+    if (session) {
+      if (!this.reloginForMissingScope || hasScopes(session, requestedScope)) {
+        return connectedResult(session);
+      }
+      await this.sessionStore.clearSession();
+    }
+    const pendingLogin = await this.getPendingLogin(requestedScope, requestedConstraints);
+    if (pendingLogin) {
+      const polled = await this.exchangePendingLogin(pendingLogin.deviceCode).catch(() => null);
+      if (polled?.status === "connected") return polled;
+      const stillPending = await this.getPendingLogin(requestedScope, requestedConstraints);
+      if (stillPending) return this.pendingResult(stillPending);
+    }
+    return this.pendingResult(await this.startLogin(this.loginInput(options)));
+  }
+  /**
+   * Polls the stored pending login. A code, when given, must be that login's device code or the user code shown to the
+   * person: a code from anywhere else (a prompt injection carrying a login someone else approved) is never exchanged, so
+   * it can't swap the stored session for another account's.
+   */
+  async pollLogin(code) {
+    const pending = await this.sessionStore.getPendingLogin();
+    if (!pending) {
+      const session = await this.getValidSession();
+      if (session) return connectedResult(session);
+      return { status: "failed", connected: false, message: this.messages.noLoginInProgress };
+    }
+    const given = code?.trim();
+    if (given && given !== pending.deviceCode && given.toUpperCase() !== pending.userCode.toUpperCase()) {
+      return { status: "failed", connected: false, message: this.messages.wrongCode };
+    }
+    return this.exchangePendingLogin(pending.deviceCode);
+  }
+  async whoami() {
+    return sanitizeAgentSession(await this.getValidSession());
+  }
+  async getAccessToken() {
+    return (await this.getValidSession())?.accessToken ?? null;
+  }
+  async getPendingLoginState() {
+    return this.sessionStore.getPendingLogin();
+  }
+  async requireSession() {
+    const session = await this.getValidSession();
+    if (!session) {
+      throw new Error(this.deviceLogin ? "No Helios delegated agent session is connected" : this.messages.reconnect);
+    }
+    return session;
+  }
+  loginInput(options) {
+    return {
+      clientName: options.clientName ?? this.defaultClientName,
+      scope: options.scope ?? DEFAULT_SCOPE,
+      constraints: options.constraints
+    };
+  }
+  pendingResult(started) {
+    return { ...started, connected: false, message: this.messages.loginPrompt(started) };
+  }
+  async getValidSession() {
+    const session = await this.sessionStore.getSession();
+    if (!session) {
+      return null;
+    }
+    if (!shouldRefreshAgentSession(session, this.now(), this.refreshWindowMs)) {
+      return session;
+    }
+    return this.refreshStoredSession(session, false);
+  }
+  /**
+   * Refreshes `seen` (the session the caller read), joining a refresh already in progress. `force` refreshes even a
+   * session that isn't near expiry (Helios just answered 401 to it).
+   */
+  refreshStoredSession(seen, force) {
+    this.refreshInFlight ?? (this.refreshInFlight = this.refreshOnce(seen, force).finally(() => {
+      this.refreshInFlight = null;
+    }));
+    return this.refreshInFlight;
+  }
+  async refreshOnce(seen, force) {
+    const latest = await this.sessionStore.getSession();
+    if (!latest) {
+      return null;
+    }
+    const rotatedElsewhere = latest.refreshToken !== seen.refreshToken;
+    if ((rotatedElsewhere || !force) && !shouldRefreshAgentSession(latest, this.now(), this.refreshWindowMs)) {
+      return latest;
+    }
+    if (!latest.refreshToken) {
+      return null;
+    }
+    try {
+      const refreshed = await this.client.refreshSession(latest.refreshToken);
+      const nextSession = createStoredAgentSession(refreshed, this.now());
+      await this.sessionStore.setSession(nextSession);
+      return nextSession;
+    } catch (error) {
+      const stored = await this.sessionStore.getSession().catch(() => null);
+      if (stored && stored.refreshToken !== latest.refreshToken) {
+        return stored;
+      }
+      if (isHeliosAgentApiError(error) && error.code === "invalid_grant") {
+        await this.clearSessionState();
+        return null;
+      }
+      throw error;
+    }
+  }
+  exchangePendingLogin(deviceCode) {
+    if (this.exchangeInFlight?.deviceCode !== deviceCode) {
+      const flight = {
+        deviceCode,
+        promise: this.exchangeOnce(deviceCode).finally(() => {
+          if (this.exchangeInFlight === flight) this.exchangeInFlight = null;
+        })
+      };
+      this.exchangeInFlight = flight;
+    }
+    return this.exchangeInFlight.promise;
+  }
+  async exchangeOnce(deviceCode) {
+    try {
+      const response = await this.client.exchangeDeviceCode(deviceCode);
+      const session = createStoredAgentSession(response, this.now());
+      await this.sessionStore.setSession(session);
+      await this.sessionStore.clearPendingLogin();
+      return connectedResult(session);
+    } catch (error) {
+      if (!isHeliosAgentApiError(error)) {
+        return {
+          status: "failed",
+          connected: false,
+          message: error instanceof Error ? error.message : "Unexpected Helios login error"
+        };
+      }
+      switch (error.code) {
+        case "authorization_pending":
+          return { status: "pending", connected: false, message: error.message };
+        case "access_denied":
+          await this.clearPendingLoginIfMatches(deviceCode);
+          return { status: "rejected", connected: false, message: error.message };
+        case "expired_token":
+          await this.clearPendingLoginIfMatches(deviceCode);
+          return { status: "expired", connected: false, message: error.message };
+        case "invalid_grant":
+          await this.clearPendingLoginIfMatches(deviceCode);
+          return { status: "failed", connected: false, message: this.messages.staleLogin };
+        default:
+          return { status: "failed", connected: false, message: error.message };
+      }
+    }
+  }
+  async getPendingLogin(requestedScope, requestedConstraints) {
+    const pendingLogin = await this.sessionStore.getPendingLogin();
+    if (!pendingLogin) {
+      return null;
+    }
+    const expiresAt = new Date(pendingLogin.startedAt).getTime() + pendingLogin.expiresInSeconds * 1e3;
+    if (this.now().getTime() >= expiresAt) {
+      await this.sessionStore.clearPendingLogin();
+      return null;
+    }
+    const pendingScope = new Set(pendingLogin.requestedScope);
+    if (!requestedScope.every((scope) => pendingScope.has(scope))) {
+      return null;
+    }
+    return Object.keys(requestedConstraints ?? {}).length === 0 ? pendingLogin : null;
+  }
+  async clearPendingLoginIfMatches(deviceCode) {
+    const pendingLogin = await this.sessionStore.getPendingLogin();
+    if (pendingLogin?.deviceCode === deviceCode) {
+      await this.sessionStore.clearPendingLogin();
+    }
+  }
+};
+async function retryAfterUnauthorizedRefresh(options) {
+  const refreshedSession = await options.authService.refreshSessionAfterUnauthorized(options.error);
+  if (!refreshedSession) {
+    return options.authService.invalidateIfUnauthorized(options.error, options.loginOptions);
+  }
+  try {
+    return await options.retry(refreshedSession.accessToken);
+  } catch (retryError) {
+    const relogin = await options.authService.invalidateIfUnauthorized(retryError, options.loginOptions);
+    if (relogin) {
+      return relogin;
+    }
+    throw retryError;
+  }
+}
+function connectedResult(session) {
+  return { ...sanitizeAgentSession(session), connected: true, status: "connected" };
+}
+function hasScopes(session, requestedScope) {
+  const granted = new Set(session.scope);
+  return requestedScope.every((scope) => granted.has(scope));
+}
+var HeliosAgentAuthClient = class {
+  constructor(options) {
+    __publicField2(this, "baseUrl");
+    __publicField2(this, "fetchImpl");
+    __publicField2(this, "headers");
+    __publicField2(this, "startSecret");
+    this.baseUrl = options.baseUrl.replace(/\/+$/, "");
+    this.fetchImpl = options.fetch ?? fetch;
+    this.headers = options.headers ?? {};
+    this.startSecret = options.startSecret || void 0;
+  }
+  async startLogin(input, options = {}) {
+    const parsed = agentDeviceStartInputSchema.parse(input);
+    const headers = this.startSecret ? { [AGENT_START_SECRET_HEADER]: this.startSecret, ...options.clientIp ? { [AGENT_CLIENT_IP_HEADER]: options.clientIp } : {} } : void 0;
+    return this.post("/api/agents/device/start", parsed, agentDeviceStartOutputSchema, headers);
+  }
+  async exchangeDeviceCode(deviceCode, options = {}) {
+    const parsed = agentDeviceTokenInputSchema.parse({ deviceCode, approvalProof: options.approvalProof });
+    return this.post("/api/agents/device/token", parsed, agentTokenResponseSchema);
+  }
+  async refreshSession(refreshToken) {
+    const parsed = agentRefreshInputSchema.parse({ refreshToken });
+    return this.post("/api/agents/auth/refresh", parsed, agentTokenResponseSchema);
+  }
+  async post(path3, body, schema, extraHeaders) {
+    let response;
+    try {
+      response = await this.fetchImpl(`${this.baseUrl}${path3}`, {
+        method: "POST",
+        headers: {
+          Accept: "application/json",
+          "Content-Type": "application/json",
+          ...this.headers,
+          ...extraHeaders
+        },
+        body: JSON.stringify(body)
+      });
+    } catch (error) {
+      throw new HeliosAgentApiError({
+        status: 0,
+        code: "network_error",
+        message: error instanceof Error ? error.message : "Network error",
+        cause: error
+      });
+    }
+    const payload = await this.parseJson(response);
+    if (!response.ok) {
+      const parsed = heliosAgentErrorResponseSchema.safeParse(payload);
+      throw new HeliosAgentApiError({
+        status: response.status,
+        code: parsed.success ? parsed.data.error ?? "request_failed" : "request_failed",
+        message: parsed.success ? parsed.data.errorDescription ?? parsed.data.message ?? `Request failed with status ${response.status}` : `Request failed with status ${response.status}`,
+        errorDescription: parsed.success ? parsed.data.errorDescription : void 0,
+        payload
+      });
+    }
+    return schema.parse(payload);
+  }
+  async parseJson(response) {
+    const text2 = await response.text();
+    if (!text2) {
+      return null;
+    }
+    try {
+      return JSON.parse(text2);
+    } catch (error) {
+      throw new HeliosAgentApiError({
+        status: response.status,
+        code: "invalid_json",
+        message: "Received an invalid JSON response from Helios",
+        cause: error
+      });
+    }
+  }
+};
 var HeliosAgentDataBridgeClient = class {
   constructor(options) {
     __publicField2(this, "baseUrl");
@@ -544,7 +1168,8 @@ var HeliosAgentDataBridgeClient = class {
     }
     return portfolioSnapshotSchema.parse({
       ...result,
-      provider: parsedInput.provider
+      provider: parsedInput.provider,
+      protectiveOrders: readProtectiveOrders(result.protectiveOrders)
     });
   }
   async getLedgerFills(accessToken, input = {}) {
@@ -572,6 +1197,30 @@ var HeliosAgentDataBridgeClient = class {
     const payload = await this.request(accessToken, "market.getSymbolDetail", parsedInput);
     return marketSymbolDetailSchema.parse(this.unwrapResult(payload));
   }
+  /** The lean market table: price, two returns, volume, funding, open interest, setup label and the smart money lean. */
+  async getAgentMarket(accessToken, input = {}) {
+    const payload = await this.request(accessToken, "market.getAgentTable", agentMarketInputSchema.parse(input));
+    return agentMarketSchema.parse(this.unwrapResult(payload));
+  }
+  async getMarketCandles(accessToken, input) {
+    const payload = await this.request(accessToken, "market.getCandles", marketCandlesInputSchema.parse(input));
+    return marketCandlesSchema.parse(this.unwrapResult(payload));
+  }
+  /** The research wallets' smart money board (conviction, discount, flows or pile-ins). */
+  async getSmartMoneyBoard(accessToken, input = {}) {
+    const payload = await this.request(accessToken, "smartMoney.board", smartMoneyBoardInputSchema.parse(input));
+    return smartMoneyBoardSchema.parse(this.unwrapResult(payload));
+  }
+  /** Their trades by nickname: the latest, or only what came after an earlier call's `next`. */
+  async getSmartMoneyMoves(accessToken, input = {}) {
+    const payload = await this.request(accessToken, "smartMoney.moves", smartMoneyMovesInputSchema.parse(input));
+    return smartMoneyMovesSchema.parse(this.unwrapResult(payload));
+  }
+  /** One coin: their book, its market row and their latest trades on it. */
+  async getSmartMoneyCoin(accessToken, coin2) {
+    const payload = await this.request(accessToken, "smartMoney.coin", { coin: coin2 });
+    return smartMoneyCoinSchema.parse(this.unwrapResult(payload));
+  }
   async submitTradeIntent(accessToken, input) {
     const parsedInput = submitTradeIntentInputSchema.parse(input);
     const payload = await this.request(accessToken, "trading.submitIntent", parsedInput, "POST");
@@ -597,22 +1246,27 @@ var HeliosAgentDataBridgeClient = class {
   }
   async closePosition(accessToken, input) {
     const parsedInput = closePositionInputSchema.parse(input);
-    await this.request(
+    const partial = parsedInput.fraction !== void 0 && parsedInput.fraction < 1;
+    const payload = await this.request(
       accessToken,
       "positions.close",
       {
         ...parsedInput.provider !== void 0 ? { provider: parsedInput.provider } : {},
         symbol: parsedInput.symbol,
-        mode: "FULL",
+        mode: partial ? "PARTIAL" : "FULL",
+        ...partial ? { fraction: parsedInput.fraction } : {},
         ...parsedInput.maxSlippageBps !== void 0 ? { maxSlippageBps: parsedInput.maxSlippageBps } : {}
       },
       "POST"
     );
+    const outcome = this.tryUnwrapResult(payload)?.outcome;
     return closePositionResultSchema.parse({
       status: "submitted",
+      ...outcome === "closed" || outcome === "no_position" ? { outcome } : {},
       provider: parsedInput.provider,
       symbol: parsedInput.symbol,
-      mode: "FULL",
+      mode: partial ? "PARTIAL" : "FULL",
+      ...partial ? { fraction: parsedInput.fraction } : {},
       maxSlippageBps: parsedInput.maxSlippageBps
     });
   }
@@ -653,6 +1307,62 @@ var HeliosAgentDataBridgeClient = class {
       oid: parsedInput.oid
     });
   }
+  async modifyOrder(accessToken, input) {
+    const parsedInput = modifyOrderInputSchema.parse(input);
+    await this.request(accessToken, "positions.modifyOrder", parsedInput, "POST");
+    return modifyOrderResultSchema.parse({ status: "modified", ...parsedInput });
+  }
+  // ---------------------------------------------------------------- paper (AGENT_PAPER_ACCOUNT unless told otherwise)
+  async getPaperPortfolio(accessToken, accountId = AGENT_PAPER_ACCOUNT) {
+    const payload = await this.request(accessToken, "paper.getPortfolio", { accountId, fills: 0 });
+    return paperPortfolioSchema.parse(this.unwrapResult(payload));
+  }
+  /** A paper market order; answers with its fills (none when nothing filled). */
+  async submitPaperIntent(accessToken, input, accountId = AGENT_PAPER_ACCOUNT) {
+    const parsedInput = submitTradeIntentInputSchema.parse(input);
+    const payload = await this.request(accessToken, "paper.submitIntent", { ...parsedInput, accountId }, "POST");
+    return paperFillSchema.array().parse(this.tryUnwrapResult(payload) ?? []);
+  }
+  /** Closes all or part of a paper position; no fills when there was none. */
+  async closePaperPosition(accessToken, input, accountId = AGENT_PAPER_ACCOUNT) {
+    const parsedInput = closePositionInputSchema.parse(input);
+    const partial = parsedInput.fraction !== void 0 && parsedInput.fraction < 1;
+    const payload = await this.request(
+      accessToken,
+      "paper.close",
+      { symbol: parsedInput.symbol, mode: partial ? "PARTIAL" : "FULL", ...partial ? { fraction: parsedInput.fraction } : {}, accountId },
+      "POST"
+    );
+    return paperFillSchema.array().parse(this.tryUnwrapResult(payload) ?? []);
+  }
+  async setPaperTpSl(accessToken, input, accountId = AGENT_PAPER_ACCOUNT) {
+    const parsedInput = setTpSlInputSchema.parse(input);
+    await this.request(accessToken, "paper.setTpSl", { ...parsedInput, accountId }, "POST");
+    return setTpSlResultSchema.parse({
+      status: "submitted",
+      provider: parsedInput.provider,
+      symbol: parsedInput.symbol,
+      applyTo: parsedInput.applyTo,
+      quantity: parsedInput.quantity,
+      parentClientOrderId: parsedInput.parentClientOrderId,
+      hasTakeProfit: Boolean(parsedInput.takeProfit),
+      hasStopLoss: Boolean(parsedInput.stopLoss)
+    });
+  }
+  async deletePaperTpSl(accessToken, input, accountId = AGENT_PAPER_ACCOUNT) {
+    const parsedInput = deleteTpSlInputSchema.parse(input);
+    await this.request(accessToken, "paper.deleteTpSl", { ...parsedInput, accountId }, "POST");
+    return deleteTpSlResultSchema.parse({ status: "deleted", provider: parsedInput.provider, symbol: parsedInput.symbol, orderId: parsedInput.orderId });
+  }
+  async getPaperLedgerFills(accessToken, input = {}, accountId = AGENT_PAPER_ACCOUNT) {
+    const parsedInput = ledgerFillsInputSchema.parse(input);
+    const payload = await this.request(accessToken, "paper.getLedgerFills", { ...parsedInput, accountId });
+    return ledgerFillsPageSchema.parse(this.unwrapResult(payload));
+  }
+  /** Starts the paper account over with `startingBalance` USD (data-bridge's default when omitted). */
+  async resetPaperAccount(accessToken, startingBalance, accountId = AGENT_PAPER_ACCOUNT) {
+    await this.request(accessToken, "paper.reset", { accountId, ...startingBalance ? { startingBalance } : {} }, "POST");
+  }
   async request(accessToken, procedure, input, method = "GET") {
     let response;
     try {
@@ -692,401 +1402,114 @@ var HeliosAgentDataBridgeClient = class {
     return url.toString();
   }
   async parseJson(response) {
-    const text = await response.text();
-    if (!text) {
+    const text2 = await response.text();
+    if (!text2) {
       return null;
     }
     try {
-      return JSON.parse(text);
+      return JSON.parse(text2);
     } catch (error) {
       throw new HeliosAgentApiError({
         status: response.status,
         code: "invalid_json",
         message: "Received an invalid JSON response from Helios data bridge",
         cause: error
-      });
-    }
-  }
-  unwrapResult(payload) {
-    if (!payload || typeof payload !== "object") {
-      throw new HeliosAgentApiError({
-        status: 200,
-        code: "invalid_response",
-        message: "Helios data bridge returned an invalid response payload",
-        payload
-      });
-    }
-    const result = payload.result;
-    if (!result) {
-      throw new HeliosAgentApiError({
-        status: 200,
-        code: "invalid_response",
-        message: "Helios data bridge response is missing a result payload",
-        payload
-      });
-    }
-    const data = result.data;
-    if (data && typeof data === "object" && "json" in data) {
-      return data.json;
-    }
-    return data;
-  }
-  extractErrorCode(payload) {
-    if (payload && typeof payload === "object") {
-      const errorShape = this.unwrapTrpcError(payload);
-      if (errorShape?.data?.code) {
-        return errorShape.data.code;
-      }
-    }
-    return "request_failed";
-  }
-  extractErrorMessage(payload, status) {
-    if (payload && typeof payload === "object") {
-      const errorShape = this.unwrapTrpcError(payload);
-      if (errorShape?.message) {
-        return errorShape.message;
-      }
-    }
-    return `Request failed with status ${status}`;
-  }
-  /**
-   * Unwrap a tRPC error envelope, handling the superjson `{ json: ... }` wrapper
-   * that the data-bridge applies via its transformer configuration.
-   */
-  unwrapTrpcError(payload) {
-    const envelope = payload.error;
-    if (!envelope || typeof envelope !== "object") {
-      return void 0;
-    }
-    if ("json" in envelope) {
-      const inner = envelope.json;
-      if (inner && typeof inner === "object") {
-        return inner;
-      }
-    }
-    return envelope;
-  }
-};
-var DEFAULT_AGENT_REFRESH_WINDOW_MS = 60 * 1e3;
-var agentConnectionStatusSchema = import_zod3.z.enum([
-  "disconnected",
-  "pending",
-  "connected",
-  "rejected",
-  "expired",
-  "failed"
-]);
-var storedAgentSessionSchema = import_zod3.z.object({
-  accessToken: import_zod3.z.string(),
-  refreshToken: import_zod3.z.string(),
-  tokenType: agentTokenResponseSchema.shape.tokenType,
-  ownerUserId: import_zod3.z.string(),
-  agentGrantId: import_zod3.z.string(),
-  scope: import_zod3.z.array(agentScopeSchema).min(1),
-  accessTokenExpiresAt: import_zod3.z.string().datetime(),
-  createdAt: import_zod3.z.string().datetime(),
-  lastRefreshedAt: import_zod3.z.string().datetime()
-});
-var agentSessionViewSchema = import_zod3.z.object({
-  connected: import_zod3.z.boolean(),
-  status: agentConnectionStatusSchema,
-  ownerUserId: import_zod3.z.string().optional(),
-  agentGrantId: import_zod3.z.string().optional(),
-  scope: import_zod3.z.array(agentScopeSchema).optional(),
-  accessTokenExpiresAt: import_zod3.z.string().datetime().optional(),
-  lastRefreshedAt: import_zod3.z.string().datetime().optional()
-});
-function createStoredAgentSession(tokenResponse, now = /* @__PURE__ */ new Date()) {
-  const createdAt = now.toISOString();
-  return {
-    accessToken: tokenResponse.accessToken,
-    refreshToken: tokenResponse.refreshToken,
-    tokenType: tokenResponse.tokenType,
-    ownerUserId: tokenResponse.ownerUserId,
-    agentGrantId: tokenResponse.agentGrantId,
-    scope: tokenResponse.scope,
-    accessTokenExpiresAt: new Date(now.getTime() + tokenResponse.expiresInSeconds * 1e3).toISOString(),
-    createdAt,
-    lastRefreshedAt: createdAt
-  };
-}
-function sanitizeAgentSession(session, status = session ? "connected" : "disconnected") {
-  if (!session) {
-    return {
-      connected: false,
-      status: status === "connected" ? "disconnected" : status
-    };
-  }
-  return {
-    connected: true,
-    status,
-    ownerUserId: session.ownerUserId,
-    agentGrantId: session.agentGrantId,
-    scope: session.scope,
-    accessTokenExpiresAt: session.accessTokenExpiresAt,
-    lastRefreshedAt: session.lastRefreshedAt
-  };
-}
-function shouldRefreshAgentSession(session, now = /* @__PURE__ */ new Date(), refreshWindowMs = DEFAULT_AGENT_REFRESH_WINDOW_MS) {
-  return new Date(session.accessTokenExpiresAt).getTime() - now.getTime() <= refreshWindowMs;
-}
-
-// src/auth-service.ts
-var HOSTED_RECONNECT_MESSAGE = "Helios no longer accepts this connection (it expired or was revoked). Reconnect Helios in your AI app to continue.";
-var HeliosAgentMcpAuthService = class {
-  constructor(options) {
-    __publicField(this, "client");
-    __publicField(this, "sessionStore");
-    __publicField(this, "refreshWindowMs");
-    __publicField(this, "now");
-    __publicField(this, "deviceLogin");
-    this.client = options.client;
-    this.sessionStore = options.sessionStore;
-    this.refreshWindowMs = options.refreshWindowMs ?? 60 * 1e3;
-    this.now = options.now ?? (() => /* @__PURE__ */ new Date());
-    this.deviceLogin = options.deviceLogin ?? true;
-  }
-  async startLogin(input) {
-    const response = await this.startDeviceLogin(input);
-    const result = this.buildStartLoginResult(response, input.scope);
-    await this.sessionStore.setPendingLogin(result);
-    return result;
-  }
-  async resetSessionAndStartLogin(input) {
-    await this.sessionStore.clearSession();
-    await this.sessionStore.clearPendingLogin();
-    const response = await this.startDeviceLogin(input);
-    const result = this.buildStartLoginResult(response, input.scope);
-    await this.sessionStore.setPendingLogin(result);
-    return result;
-  }
-  async startDeviceLogin(input) {
-    if (!this.deviceLogin) {
-      throw new Error(HOSTED_RECONNECT_MESSAGE);
-    }
-    return this.client.startLogin(input);
-  }
-  buildStartLoginResult(response, requestedScope) {
-    return {
-      status: "pending",
-      ...response,
-      requestedScope,
-      startedAt: this.now().toISOString()
-    };
-  }
-  async startRelogin(options = {}) {
-    const requestedScope = options.scope ?? [AGENT_SCOPES.ACCOUNT_READ, AGENT_SCOPES.MARKET_READ];
-    const started = await this.resetSessionAndStartLogin({
-      clientName: options.clientName ?? "Helios MCP",
-      scope: requestedScope,
-      constraints: options.constraints
-    });
-    return {
-      ...started,
-      connected: false,
-      message: formatHeliosLoginPrompt(started)
-    };
-  }
-  async clearSessionState() {
-    await this.sessionStore.clearSession();
-    await this.sessionStore.clearPendingLogin();
-  }
-  async invalidateIfUnauthorized(error, options = {}) {
-    if (!isHeliosAgentApiError(error) || error.status !== 401) {
-      return null;
-    }
-    return this.startRelogin(options);
-  }
-  async refreshSessionAfterUnauthorized(error) {
-    if (!isHeliosAgentApiError(error) || error.status !== 401) {
-      return null;
-    }
-    const session = await this.sessionStore.getSession();
-    if (!session) {
-      return null;
-    }
-    return this.refreshStoredSession(session);
-  }
-  async ensureLogin(options = {}) {
-    const requestedScope = options.scope ?? [AGENT_SCOPES.ACCOUNT_READ, AGENT_SCOPES.MARKET_READ];
-    const requestedConstraints = options.constraints ?? {};
-    const session = await this.getValidSession();
-    if (session) {
-      return {
-        ...sanitizeAgentSession(session),
-        connected: true,
-        status: "connected"
-      };
-    }
-    const pendingLogin = await this.getPendingLogin({
-      requestedScope,
-      requestedConstraints
-    });
-    if (pendingLogin) {
-      const polled = await this.pollLogin(pendingLogin.deviceCode).catch(() => null);
-      if (polled?.status === "connected") return polled;
-      if (polled?.status !== "rejected" && polled?.status !== "expired") {
-        return {
-          ...pendingLogin,
-          connected: false,
-          message: formatHeliosLoginPrompt(pendingLogin)
-        };
-      }
-    }
-    const started = await this.startLogin({
-      clientName: options.clientName ?? "Helios MCP",
-      scope: requestedScope,
-      constraints: options.constraints
-    });
-    return {
-      ...started,
-      connected: false,
-      message: formatHeliosLoginPrompt(started)
-    };
-  }
-  /** Polls the given login, or the stored pending one when no device code is given. */
-  async pollLogin(deviceCode) {
-    if (!deviceCode) {
-      const pending = await this.sessionStore.getPendingLogin();
-      if (!pending) {
-        const session = await this.getValidSession();
-        if (session) return { ...sanitizeAgentSession(session), connected: true, status: "connected" };
-        return {
-          status: "failed",
-          connected: false,
-          message: "No Helios login is in progress. Call helios_auth_ensure_login to start one."
-        };
-      }
-      deviceCode = pending.deviceCode;
-    } else {
-      const pending = await this.sessionStore.getPendingLogin();
-      if (pending && pending.userCode.toUpperCase() === deviceCode.trim().toUpperCase()) deviceCode = pending.deviceCode;
-    }
-    try {
-      const response = await this.client.exchangeDeviceCode(deviceCode);
-      const session = createStoredAgentSession(response, this.now());
-      await this.sessionStore.setSession(session);
-      await this.sessionStore.clearPendingLogin();
-      return {
-        ...sanitizeAgentSession(session),
-        connected: true,
-        status: "connected"
-      };
-    } catch (error) {
-      if (isHeliosAgentApiError(error)) {
-        if (error.code === "authorization_pending") {
-          return {
-            status: "pending",
-            connected: false,
-            message: error.message
-          };
-        }
-        if (error.code === "access_denied") {
-          await this.clearPendingLoginIfMatches(deviceCode);
-          return {
-            status: "rejected",
-            connected: false,
-            message: error.message
-          };
-        }
-        if (error.code === "expired_token") {
-          await this.clearPendingLoginIfMatches(deviceCode);
-          return {
-            status: "expired",
-            connected: false,
-            message: error.message
-          };
-        }
-        return {
-          status: "failed",
-          connected: false,
-          message: error.message
-        };
-      }
-      return {
-        status: "failed",
-        connected: false,
-        message: error instanceof Error ? error.message : "Unexpected Helios login error"
-      };
-    }
-  }
-  async whoami() {
-    const session = await this.getValidSession();
-    return sanitizeAgentSession(session);
-  }
-  async getAccessToken() {
-    const session = await this.getValidSession();
-    return session?.accessToken ?? null;
-  }
-  async requireSession() {
-    const session = await this.getValidSession();
-    if (!session) {
-      throw new Error("No Helios delegated agent session is connected");
-    }
-    return session;
-  }
-  async getValidSession() {
-    const session = await this.sessionStore.getSession();
-    if (!session) {
-      return null;
-    }
-    if (!shouldRefreshAgentSession(session, this.now(), this.refreshWindowMs)) {
-      return session;
-    }
-    return this.refreshStoredSession(session);
-  }
-  async refreshStoredSession(session) {
-    try {
-      const refreshed = await this.client.refreshSession(session.refreshToken);
-      const nextSession = createStoredAgentSession(refreshed, this.now());
-      await this.sessionStore.setSession(nextSession);
-      return nextSession;
-    } catch (error) {
-      if (isHeliosAgentApiError(error) && error.code === "invalid_grant") {
-        await this.sessionStore.clearSession();
-        await this.sessionStore.clearPendingLogin();
-        return null;
-      }
-      throw error;
+      });
     }
   }
-  async getPendingLogin(options) {
-    const pendingLogin = await this.sessionStore.getPendingLogin();
-    if (!pendingLogin) {
+  /** The result of a mutation older data-bridges answer with nothing; null when there is none. */
+  tryUnwrapResult(payload) {
+    try {
+      return this.unwrapResult(payload) ?? null;
+    } catch {
       return null;
     }
-    const expiresAt = new Date(pendingLogin.startedAt).getTime() + pendingLogin.expiresInSeconds * 1e3;
-    if (this.now().getTime() >= expiresAt) {
-      await this.sessionStore.clearPendingLogin();
-      return null;
+  }
+  unwrapResult(payload) {
+    if (!payload || typeof payload !== "object") {
+      throw new HeliosAgentApiError({
+        status: 200,
+        code: "invalid_response",
+        message: "Helios data bridge returned an invalid response payload",
+        payload
+      });
     }
-    if (!isPendingLoginCompatible(pendingLogin, options.requestedScope, options.requestedConstraints)) {
-      return null;
+    const result = payload.result;
+    if (!result) {
+      throw new HeliosAgentApiError({
+        status: 200,
+        code: "invalid_response",
+        message: "Helios data bridge response is missing a result payload",
+        payload
+      });
+    }
+    const data = result.data;
+    if (data && typeof data === "object" && "json" in data) {
+      return data.json;
     }
-    return pendingLogin;
+    return data;
   }
-  async clearPendingLoginIfMatches(deviceCode) {
-    const pendingLogin = await this.sessionStore.getPendingLogin();
-    if (pendingLogin?.deviceCode === deviceCode) {
-      await this.sessionStore.clearPendingLogin();
+  extractErrorCode(payload) {
+    if (payload && typeof payload === "object") {
+      const errorShape = this.unwrapTrpcError(payload);
+      if (errorShape?.data?.code) {
+        return errorShape.data.code;
+      }
     }
+    return "request_failed";
   }
-};
-async function retryAfterUnauthorizedRefresh(options) {
-  const refreshedSession = await options.authService.refreshSessionAfterUnauthorized(options.error);
-  if (!refreshedSession) {
-    return options.authService.invalidateIfUnauthorized(options.error, options.loginOptions);
+  extractErrorMessage(payload, status) {
+    if (payload && typeof payload === "object") {
+      const errorShape = this.unwrapTrpcError(payload);
+      if (errorShape?.message) {
+        return errorShape.message;
+      }
+    }
+    return `Request failed with status ${status}`;
   }
-  try {
-    return await options.retry(refreshedSession.accessToken);
-  } catch (retryError) {
-    const relogin = await options.authService.invalidateIfUnauthorized(retryError, options.loginOptions);
-    if (relogin) {
-      return relogin;
+  /**
+   * Unwrap a tRPC error envelope, handling the superjson `{ json: ... }` wrapper
+   * that the data-bridge applies via its transformer configuration.
+   */
+  unwrapTrpcError(payload) {
+    const envelope = payload.error;
+    if (!envelope || typeof envelope !== "object") {
+      return void 0;
     }
-    throw retryError;
+    if ("json" in envelope) {
+      const inner = envelope.json;
+      if (inner && typeof inner === "object") {
+        return inner;
+      }
+    }
+    return envelope;
   }
+};
+function readProtectiveOrders(value) {
+  if (!Array.isArray(value)) return [];
+  return value.flatMap((entry) => {
+    const parsed = protectiveOrderSchema.safeParse(entry);
+    return parsed.success ? [parsed.data] : [];
+  });
 }
+
+// src/auth-service.ts
+var HOSTED_RECONNECT_MESSAGE = "Helios no longer accepts this connection (it expired or was revoked). Reconnect Helios in your AI app to continue.";
+var HeliosAgentMcpAuthService = class extends AgentAuthService {
+  constructor(options) {
+    super({
+      ...options,
+      defaultClientName: "Helios MCP",
+      messages: {
+        loginPrompt: formatHeliosLoginPrompt,
+        noLoginInProgress: "No Helios login is in progress. Call helios_auth_ensure_login to start one.",
+        wrongCode: "That code is not the Helios login in progress. Call helios_auth_poll_login without a code to check it.",
+        staleLogin: "Helios no longer knows this login request. Call helios_auth_ensure_login to start a fresh one.",
+        reconnect: HOSTED_RECONNECT_MESSAGE
+      }
+    });
+  }
+};
 function formatHeliosLoginPrompt(result) {
   return `Log in to Helios by opening this URL in your browser:
 
@@ -1098,14 +1521,6 @@ Requested scopes: ${result.requestedScope.join(", ")}
 
 After approving access, call helios_auth_ensure_login (or helios_auth_poll_login) again to finish connecting.`;
 }
-function isPendingLoginCompatible(pendingLogin, requestedScope, requestedConstraints) {
-  const pendingScope = new Set(pendingLogin.requestedScope);
-  const scopeCompatible = requestedScope.every((scope) => pendingScope.has(scope));
-  if (!scopeCompatible) {
-    return false;
-  }
-  return Object.keys(requestedConstraints ?? {}).length === 0;
-}
 
 // src/account-service.ts
 var HeliosAgentMcpAccountService = class {
@@ -1220,6 +1635,9 @@ var HeliosAgentMcpDocsService = class {
   }
   async getDocument(input) {
     const documentPath = resolveDocumentPath(this.docsRoot, input.path);
+    if (!(0, import_node_fs.existsSync)(documentPath) || !(0, import_node_fs.statSync)(documentPath).isFile()) {
+      throw new Error(`No document "${input.path}". helios_docs_get_index lists the documents.`);
+    }
     const body = (0, import_node_fs.readFileSync)(documentPath, "utf8");
     const stats = (0, import_node_fs.statSync)(documentPath);
     const relativePath = toPosixPath(import_node_path.default.relative(this.docsRoot, documentPath));
@@ -1645,160 +2063,211 @@ var HeliosAgentMcpProviderService = class {
 };
 
 // src/session-store.ts
+var import_node_crypto = require("crypto");
+var import_node_fs2 = require("fs");
 var import_promises = require("fs/promises");
 var import_node_os = require("os");
 var import_node_path2 = __toESM(require("path"));
-var import_zod4 = require("zod");
+var import_zod5 = require("zod");
 function getDefaultHeliosAgentMcpSessionPath() {
   return import_node_path2.default.join((0, import_node_os.homedir)(), ".helios-agent-mcp", "session.json");
 }
-var pendingAgentLoginSchema = import_zod4.z.object({
-  status: import_zod4.z.literal("pending"),
-  deviceCode: import_zod4.z.string(),
-  userCode: import_zod4.z.string(),
-  verificationUri: import_zod4.z.string().url(),
-  verificationUriComplete: import_zod4.z.string().url(),
-  expiresInSeconds: import_zod4.z.number().int().positive(),
-  pollIntervalSeconds: import_zod4.z.number().int().positive(),
-  requestedScope: import_zod4.z.array(agentScopeSchema).min(1),
-  startedAt: import_zod4.z.string().datetime()
-});
-var mcpSessionStateSchema = import_zod4.z.object({
+var pendingAgentLoginSchema2 = pendingAgentLoginSchema.extend({
+  /** The hosts the login was started with (FileAgentSessionStoreOptions.issuer); its device code is only polled there. */
+  issuer: agentSessionIssuerSchema.nullish()
+});
+var mcpSessionStateSchema = import_zod5.z.object({
   session: storedAgentSessionSchema.nullish(),
-  pendingLogin: pendingAgentLoginSchema.nullish(),
+  pendingLogin: pendingAgentLoginSchema2.nullish(),
   // A provider pinned before Binance was retired ('binance') reads as unpinned, so the agent must pick again, rather than
   // failing the whole file (which would drop the session) or silently switching it to Hyperliquid.
   activeProvider: providerSchema.nullish().catch(null)
 });
+var EMPTY_STATE = { session: null, pendingLogin: null, activeProvider: null };
 var FileAgentSessionStore = class {
-  constructor(filePath = getDefaultHeliosAgentMcpSessionPath()) {
-    this.filePath = filePath;
+  constructor(filePath = getDefaultHeliosAgentMcpSessionPath(), options = {}) {
+    __publicField(this, "filePath", filePath);
+    __publicField(this, "issuer");
+    this.issuer = options.issuer ?? null;
   }
   async getSession() {
-    return (await this.readState()).session;
+    const { session } = await this.readState();
+    if (!session || !this.isFromIssuer(session.issuer)) return null;
+    const { issuer: _issuer, ...rest } = session;
+    return rest;
   }
   async getPendingLogin() {
-    return (await this.readState()).pendingLogin;
+    const { pendingLogin } = await this.readState();
+    if (!pendingLogin || !this.isFromIssuer(pendingLogin.issuer)) return null;
+    const { issuer: _issuer, ...rest } = pendingLogin;
+    return rest;
   }
   async getActiveProvider() {
     return (await this.readState()).activeProvider;
   }
   async setSession(session) {
-    const state = await this.readState();
-    await this.writeState({
+    await this.update((state) => ({
       ...state,
-      session
-    });
+      session: this.issuer ? { ...session, issuer: this.issuer } : session
+    }));
   }
   async setPendingLogin(pendingLogin) {
-    const state = await this.readState();
-    await this.writeState({
+    await this.update((state) => ({
       ...state,
-      pendingLogin
-    });
+      pendingLogin: this.issuer ? { ...pendingLogin, issuer: this.issuer } : pendingLogin
+    }));
   }
   async setActiveProvider(activeProvider) {
-    const state = await this.readState();
-    await this.writeState({
+    await this.update((state) => ({
       ...state,
       activeProvider
-    });
+    }));
   }
   async clearSession() {
-    const state = await this.readState();
-    await this.writeStateOrDelete({
-      ...state,
-      session: null
-    });
+    await this.update((state) => ({ ...state, session: null }), { deleteWhenEmpty: true });
   }
   async clearPendingLogin() {
-    const state = await this.readState();
-    await this.writeStateOrDelete({
-      ...state,
-      pendingLogin: null
-    });
+    await this.update((state) => ({ ...state, pendingLogin: null }), { deleteWhenEmpty: true });
   }
   async clearActiveProvider() {
-    const state = await this.readState();
-    await this.writeStateOrDelete({
-      ...state,
-      activeProvider: null
+    await this.update((state) => ({ ...state, activeProvider: null }), { deleteWhenEmpty: true });
+  }
+  isFromIssuer(issuer) {
+    return !this.issuer || isSameHeliosIssuer(issuer, this.issuer);
+  }
+  /**
+   * Read-modify-write under the file's lock: tool calls run concurrently and several MCP processes can share the file,
+   * so without it one write could drop another's (a refreshed session, a pending login).
+   */
+  async update(change, options = {}) {
+    await withSessionFileLock(this.filePath, async () => {
+      const state = change(await this.readState());
+      if (options.deleteWhenEmpty && !state.session && !state.pendingLogin && !state.activeProvider) {
+        await this.deleteFile();
+        return;
+      }
+      await this.writeState(state);
     });
   }
   async readState() {
+    let parsed;
     try {
-      const raw = await (0, import_promises.readFile)(this.filePath, "utf8");
-      const parsed = JSON.parse(raw);
-      if (parsed && typeof parsed === "object" && ("session" in parsed || "pendingLogin" in parsed || "activeProvider" in parsed)) {
-        const envelope = mcpSessionStateSchema.safeParse(parsed);
-        if (envelope.success) {
-          return {
-            session: envelope.data.session ?? null,
-            pendingLogin: envelope.data.pendingLogin ?? null,
-            activeProvider: envelope.data.activeProvider ?? null
-          };
-        }
+      parsed = JSON.parse(await readFileNoFollow(this.filePath));
+    } catch (error) {
+      if (isErrnoException(error, "ENOENT") || isErrnoException(error, "ELOOP") || error instanceof SyntaxError) {
+        return { ...EMPTY_STATE };
       }
-      const legacySession = storedAgentSessionSchema.safeParse(parsed);
-      if (legacySession.success) {
+      throw error;
+    }
+    if (parsed && typeof parsed === "object" && ("session" in parsed || "pendingLogin" in parsed || "activeProvider" in parsed)) {
+      const envelope = mcpSessionStateSchema.safeParse(parsed);
+      if (envelope.success) {
         return {
-          session: legacySession.data,
-          pendingLogin: null,
-          activeProvider: null
+          session: envelope.data.session ?? null,
+          pendingLogin: envelope.data.pendingLogin ?? null,
+          activeProvider: envelope.data.activeProvider ?? null
         };
       }
+    }
+    const legacySession = storedAgentSessionSchema.safeParse(parsed);
+    if (legacySession.success) {
       return {
-        session: null,
+        session: legacySession.data,
         pendingLogin: null,
         activeProvider: null
       };
-    } catch (error) {
-      if (isMissingFileError(error)) {
-        return {
-          session: null,
-          pendingLogin: null,
-          activeProvider: null
-        };
-      }
-      if (error instanceof Error && error.name === "ZodError") {
-        return {
-          session: null,
-          pendingLogin: null,
-          activeProvider: null
-        };
-      }
-      throw error;
     }
+    return { ...EMPTY_STATE };
   }
   async writeState(state) {
-    await (0, import_promises.mkdir)(import_node_path2.default.dirname(this.filePath), { recursive: true });
-    await (0, import_promises.writeFile)(this.filePath, `${JSON.stringify(state, null, 2)}
-`, { encoding: "utf8", mode: 384 });
-    await (0, import_promises.chmod)(this.filePath, 384).catch(() => void 0);
-  }
-  async writeStateOrDelete(state) {
-    if (!state.session && !state.pendingLogin && !state.activeProvider) {
-      await this.deleteFile();
-      return;
+    const directory = import_node_path2.default.dirname(this.filePath);
+    await (0, import_promises.mkdir)(directory, { recursive: true, mode: 448 });
+    if (import_node_path2.default.resolve(directory) === import_node_path2.default.dirname(getDefaultHeliosAgentMcpSessionPath())) {
+      await (0, import_promises.chmod)(directory, 448).catch(() => void 0);
+    }
+    const tempPath = `${this.filePath}.${process.pid}.${(0, import_node_crypto.randomBytes)(6).toString("hex")}.tmp`;
+    const handle = await (0, import_promises.open)(tempPath, "wx", 384);
+    try {
+      try {
+        await handle.writeFile(`${JSON.stringify(state, null, 2)}
+`, "utf8");
+        await handle.chmod(384);
+        await handle.sync();
+      } finally {
+        await handle.close();
+      }
+      await (0, import_promises.rename)(tempPath, this.filePath);
+    } catch (error) {
+      await (0, import_promises.rm)(tempPath, { force: true }).catch(() => void 0);
+      throw error;
     }
-    await this.writeState(state);
   }
   async deleteFile() {
     try {
       await (0, import_promises.rm)(this.filePath, { force: true });
     } catch (error) {
-      if (!isMissingFileError(error)) {
+      if (!isErrnoException(error, "ENOENT")) {
         throw error;
       }
     }
   }
 };
-function isMissingFileError(error) {
-  return error instanceof Error && "code" in error && error.code === "ENOENT";
+function isErrnoException(error, code) {
+  return error instanceof Error && "code" in error && error.code === code;
+}
+async function readFileNoFollow(filePath) {
+  const flags = process.platform === "win32" || import_node_fs2.constants.O_NOFOLLOW === void 0 ? "r" : import_node_fs2.constants.O_RDONLY | import_node_fs2.constants.O_NOFOLLOW;
+  const handle = await (0, import_promises.open)(filePath, flags);
+  try {
+    return await handle.readFile("utf8");
+  } finally {
+    await handle.close();
+  }
+}
+var sessionFileQueues = /* @__PURE__ */ new Map();
+var LOCK_FILE_STALE_MS = 1e4;
+var LOCK_FILE_WAIT_MS = 2e3;
+async function withSessionFileLock(filePath, task) {
+  const key = import_node_path2.default.resolve(filePath);
+  const previous = sessionFileQueues.get(key) ?? Promise.resolve();
+  let release;
+  const done = new Promise((resolve) => release = resolve);
+  const queued = previous.then(() => done);
+  sessionFileQueues.set(key, queued);
+  await previous;
+  try {
+    const locked = await acquireLockFile(`${key}.lock`);
+    try {
+      return await task();
+    } finally {
+      if (locked) await (0, import_promises.rm)(`${key}.lock`, { force: true }).catch(() => void 0);
+    }
+  } finally {
+    release();
+    if (sessionFileQueues.get(key) === queued) sessionFileQueues.delete(key);
+  }
+}
+async function acquireLockFile(lockPath) {
+  const deadline = Date.now() + LOCK_FILE_WAIT_MS;
+  for (; ; ) {
+    try {
+      await (await (0, import_promises.open)(lockPath, "wx", 384)).close();
+      return true;
+    } catch (error) {
+      if (!isErrnoException(error, "EEXIST")) return false;
+    }
+    const stats = await (0, import_promises.lstat)(lockPath).catch(() => null);
+    if (stats && Date.now() - stats.mtimeMs > LOCK_FILE_STALE_MS) {
+      await (0, import_promises.rm)(lockPath, { force: true }).catch(() => void 0);
+      continue;
+    }
+    if (Date.now() >= deadline) return false;
+    await new Promise((resolve) => setTimeout(resolve, 20 + Math.floor(Math.random() * 30)));
+  }
 }
 
 // src/trading-service.ts
-var import_node_crypto = require("crypto");
+var import_node_crypto2 = require("crypto");
 var HeliosAgentMcpTradingService = class {
   constructor(options) {
     __publicField(this, "authService");
@@ -2019,317 +2488,1026 @@ var HeliosAgentMcpTradingService = class {
             cancellation
           };
         }
-      });
-      if (recovery) {
-        return recovery;
+      });
+      if (recovery) {
+        return recovery;
+      }
+      throw error;
+    }
+  }
+  async submitIntent(intentType, input) {
+    const loginOptions = {
+      clientName: "Helios MCP",
+      scope: [AGENT_SCOPES.ORDERS_WRITE]
+    };
+    const login = await this.authService.ensureLogin(loginOptions);
+    if (login.status !== "connected") {
+      return asPending2(login);
+    }
+    const session = await this.authService.requireSession();
+    const idempotencyKey = input.idempotencyKey ?? (0, import_node_crypto2.randomUUID)().replace(/-/g, "");
+    try {
+      const provider = await this.providerService.resolveProvider(input.provider);
+      const submission = await this.dataBridgeClient.submitTradeIntent(session.accessToken, {
+        ...input,
+        provider,
+        intentType,
+        idempotencyKey
+      });
+      return {
+        status: "connected",
+        connected: true,
+        submission
+      };
+    } catch (error) {
+      const recovery = await retryAfterUnauthorizedRefresh({
+        authService: this.authService,
+        error,
+        loginOptions,
+        retry: async (accessToken) => {
+          const provider = await this.providerService.resolveProvider(input.provider);
+          const submission = await this.dataBridgeClient.submitTradeIntent(accessToken, {
+            ...input,
+            provider,
+            intentType,
+            idempotencyKey
+          });
+          return {
+            status: "connected",
+            connected: true,
+            submission
+          };
+        }
+      });
+      if (recovery) {
+        return recovery;
+      }
+      throw error;
+    }
+  }
+};
+function asPending2(login) {
+  return {
+    ...login,
+    status: "pending",
+    connected: false
+  };
+}
+
+// src/lean/tools.ts
+var import_node_crypto3 = require("crypto");
+var import_zod6 = require("zod");
+
+// src/lean/format.ts
+var usd = (v, signed = false) => {
+  if (v === null || v === void 0 || !Number.isFinite(v)) return "n/a";
+  const sign = v < 0 ? "-" : signed && v > 0 ? "+" : "";
+  const a = Math.abs(v);
+  const body = a >= 1e9 ? `${trim(a / 1e9, 2)}B` : a >= 1e6 ? `${trim(a / 1e6, 2)}M` : a >= 1e4 ? `${Math.round(a / 1e3)}k` : a >= 1e3 ? `${trim(a / 1e3, 1)}k` : `${Math.round(a)}`;
+  return `${sign}$${body}`;
+};
+var trim = (v, places) => String(Number(v.toFixed(places)));
+var pct = (v, places = 1) => v === null || v === void 0 || !Number.isFinite(v) ? "n/a" : `${v > 0 ? "+" : ""}${v.toFixed(places)}%`;
+var price = (v) => {
+  if (v === null || v === void 0 || !Number.isFinite(v)) return "n/a";
+  const a = Math.abs(v);
+  if (a >= 1e3) return v.toLocaleString("en-US", { maximumFractionDigits: a >= 1e4 ? 0 : 2 });
+  if (a >= 1) return v.toFixed(a >= 100 ? 2 : a >= 10 ? 2 : 3);
+  return v.toPrecision(4);
+};
+var ago = (t, now) => {
+  if (t === null || t === void 0) return "n/a";
+  const s = Math.max(0, Math.round((now - t) / 1e3));
+  if (s < 60) return `${s}s`;
+  if (s < 3600) return `${Math.round(s / 60)}m`;
+  if (s < 172800) return `${Math.round(s / 3600)}h`;
+  return `${Math.round(s / 86400)}d`;
+};
+var STYLE = {
+  scalper: "scalper",
+  "intraday trader": "intraday",
+  "swing trader": "swing",
+  "position trader": "position"
+};
+var trader = (m) => {
+  const tags = [STYLE[m.style], m.win === null ? null : `${Math.round(m.win)}% win`].filter(Boolean);
+  return `${m.nick} #${m.rank}${tags.length ? ` (${tags.join(", ")})` : ""}`;
+};
+var VERB = { open: "opened", add: "added", reduce: "trimmed", close: "closed", flip: "flipped to" };
+var moveText = (m) => {
+  const pnl = m.pnl === null ? "" : ` ${usd(m.pnl, true)}${m.pnlPct === null ? "" : ` (${pct(m.pnlPct)})`}`;
+  const lev = m.lev && (m.kind === "open" || m.kind === "add" || m.kind === "flip") ? ` ${trim(m.lev, 1)}x` : "";
+  return `${VERB[m.kind]} ${m.side} ${m.coin} ${usd(m.usd)} @ ${price(m.px)}${lev}${pnl}`;
+};
+var entryText = (side, edgePct) => {
+  if (!side || edgePct === null) return null;
+  const below = side === "long" ? edgePct >= 0 : edgePct < 0;
+  return `${Math.abs(edgePct).toFixed(1)}% ${below ? "under" : "over"} their entry`;
+};
+function renderMarket(m, now = Date.now()) {
+  const head = [`market \xB7 ${m.rows.length} of ${m.total}${m.offset ? ` from #${m.offset + 1}` : ""}`];
+  if (m.market.os !== null) head.push(`${m.market.os} of 23 large coins down >7% in 24h`);
+  if (m.market.Mti !== null) head.push(`majors trend ${pct(m.market.Mti, 2)}`);
+  if (m.asOf) head.push(`as of ${ago(Date.parse(m.asOf), now)} ago`);
+  const lines = [head.join(" \xB7 ")];
+  if (m.rows.length) {
+    lines.push("coin | price | 1h | 24h | vol 24h | funding APR | open interest | setup | top traders");
+    for (const r of m.rows) {
+      const sm = r.sm?.side ? [`${r.sm.side} ${Math.round(r.sm.share * 100)}%`, entryText(r.sm.side, r.sm.edgePct), r.sm.discount === "strict" ? "discount" : null].filter(Boolean).join(", ") : "none";
+      lines.push(
+        [r.coin, price(r.px), pct(r.r1h), pct(r.r24h), usd(r.volUsd), pct(r.fundAprPct, 0), usd(r.oiUsd), r.setup ?? "n/a", sm].join(
+          " | "
+        )
+      );
+    }
+  } else lines.push("No coins match.");
+  if (m.unknown.length) lines.push(`Not listed on Hyperliquid: ${m.unknown.join(", ")}`);
+  if (m.next !== null) lines.push(`More: call again with offset=${m.next}.`);
+  return lines.join("\n");
+}
+var pileText = (p, now) => `${p.coin} | ${p.traders} traders ${p.dir === "in" ? "into" : "out of"} ${p.side} | ${usd(p.totalUsd)} | ${ago(p.first, now)} to ${ago(p.last, now)} ago | ${p.names.join(", ")}`;
+function renderBoard(b, now = Date.now()) {
+  const title = {
+    conviction: "where the top traders agree (weighted by track record)",
+    discount: "coins below the top traders\u2019 entry (longs) or above it (shorts)",
+    flows: "biggest net flows of the last hour",
+    pileins: "pile-ins: 3+ top traders moving the same way within 45 min, last 2h"
+  };
+  const lines = [`smart money \xB7 ${title[b.view]}${b.asOf ? ` \xB7 as of ${ago(b.asOf, now)} ago` : ""}`];
+  if (b.view === "pileins") {
+    if (b.pileIns.length) lines.push("coin | who | size | when | biggest movers", ...b.pileIns.map((p) => pileText(p, now)));
+    else lines.push("No pile-ins in the last 2 hours.");
+  } else if (b.rows.length) {
+    lines.push("coin | side | share | size | traders | their entry | price | vs entry | 1h flow | setup | 24h");
+    for (const r of b.rows)
+      lines.push(
+        [
+          r.coin,
+          r.side ?? "n/a",
+          `${Math.round(r.share * 100)}%`,
+          usd(r.sideUsd),
+          `${r.traders} (${trim(r.heads, 1)} weighted)`,
+          price(r.entry),
+          price(r.mark),
+          entryText(r.side, r.edgePct) ?? "n/a",
+          usd(r.flow1hUsd, true),
+          r.setup ?? "n/a",
+          pct(r.r24h)
+        ].join(" | ")
+      );
+  } else lines.push("No coins on this board right now.");
+  if (b.note) lines.push(b.note);
+  return lines.join("\n");
+}
+function renderMoves(m, now = Date.now()) {
+  const lines = [];
+  if (m.order === "oldest") lines.push(m.moves.length ? `${m.moves.length} new move${m.moves.length === 1 ? "" : "s"}, oldest first` : "No new moves.");
+  else lines.push(m.moves.length ? `latest ${m.moves.length} moves, newest first` : "No moves match.");
+  for (const mv of m.moves) lines.push(`${ago(mv.t, now)} ago | ${trader(mv)} | ${moveText(mv)}`);
+  if (m.gap) lines.push("Some moves before these were missed: the cursor was older than the moves kept.");
+  if (m.more) lines.push(`More waiting: call again with since=${m.next}.`);
+  else if (m.next) lines.push(`next=${m.next} (pass as since to get only newer moves)`);
+  if (m.note) lines.push(m.note);
+  return lines.join("\n");
+}
+function renderCoin(c, you, now = Date.now()) {
+  const lines = [];
+  const sm = c.sm;
+  const mk = c.market;
+  if (sm && sm.side) {
+    const ours = sm.side === "long" ? sm.long : sm.short;
+    const theirs = sm.side === "long" ? sm.short : sm.long;
+    const tags = [sm.discount === "strict" ? "on the discount board" : null, sm.conviction !== null ? "on the conviction board" : null].filter(Boolean);
+    lines.push(
+      `${c.coin}: top traders lean ${sm.side.toUpperCase()} ${Math.round(sm.share * 100)}% (${usd(ours.usd)} vs ${usd(theirs.usd)})${tags.length ? ` \xB7 ${tags.join(", ")}` : ""}`
+    );
+    lines.push(
+      `book | long ${sm.long.traders} traders (${trim(sm.long.heads, 1)} weighted), avg entry ${price(sm.long.entry)} | short ${sm.short.traders} traders (${trim(sm.short.heads, 1)} weighted), avg entry ${price(sm.short.entry)}`
+    );
+  } else lines.push(`${c.coin}: no top-trader positions right now`);
+  if (mk) {
+    const vs = sm?.side ? entryText(sm.side, sm.edgePct) : null;
+    lines.push(`price | ${price(mk.px)}${vs ? ` (${vs})` : ""} \xB7 15m ${pct(mk.r15m)} \xB7 1h ${pct(mk.r1h)} \xB7 24h ${pct(mk.r24h)}`);
+    lines.push(`setup | ${mk.setup ?? "n/a"} \xB7 funding ${pct(mk.fundAprPct, 0)} APR \xB7 open interest ${usd(mk.oiUsd)} \xB7 vol ${usd(mk.volUsd)}`);
+  } else lines.push("price | no market data for this coin");
+  if (sm && sm.flow1hUsd !== 0) lines.push(`flow | ${usd(Math.abs(sm.flow1hUsd))} net toward ${sm.flow1hUsd > 0 ? "long" : "short"} in the last hour`);
+  if (sm?.pileIn) lines.push(`pile-in | ${pileText(sm.pileIn, now)}`);
+  if (c.moves.length) lines.push(...c.moves.map((m) => `move | ${ago(m.t, now)} ago | ${trader(m)} | ${moveText(m)}`));
+  else lines.push("move | none of $10k+ recently");
+  if (you) {
+    const p = you.position;
+    lines.push(
+      p ? `you | ${p.side.toLowerCase()} ${trim(Math.abs(p.size), 6)} @ ${price(p.entryPrice)}, open PnL ${usd(p.unrealizedPnl, true)}, ${trim(p.leverage, 1)}x \xB7 ${usd(you.availableBalance)} free` : `you | no ${c.coin} position \xB7 ${usd(you.availableBalance)} free`
+    );
+  }
+  if (c.note) lines.push(c.note);
+  return lines.join("\n");
+}
+function renderAccount(p, orders, summary) {
+  const lines = [
+    `account \xB7 value ${usd(p.totalBalance)} \xB7 free ${usd(p.availableBalance)} \xB7 margin used ${usd(p.totalMargin)} \xB7 open PnL ${usd(p.unrealizedPnl, true)}`
+  ];
+  if (p.positions.length) {
+    lines.push("positions: coin | side | size @ entry | now | open PnL | leverage | liquidation | TP/SL (id)");
+    for (const pos of p.positions) {
+      const prot = p.protectiveOrders.filter((o) => o.symbol.replace(/USDT$/, "").toUpperCase() === pos.symbol.replace(/USDT$/, "").toUpperCase()).map((o) => `${o.kind === "TAKE_PROFIT" ? "TP" : "SL"} ${o.stopPrice ?? "n/a"} (${o.id})`);
+      lines.push(
+        [
+          pos.symbol,
+          pos.side.toLowerCase(),
+          `${trim(Math.abs(pos.size), 6)} @ ${price(pos.entryPrice)}`,
+          price(pos.markPrice),
+          usd(pos.unrealizedPnl, true),
+          `${trim(pos.leverage, 1)}x`,
+          price(pos.liquidationPrice ?? null),
+          prot.length ? prot.join(", ") : "none"
+        ].join(" | ")
+      );
+    }
+  } else lines.push("positions: none");
+  if (orders) {
+    const working = orders.filter((o) => !o.isTrigger);
+    if (working.length) {
+      lines.push("open orders: coin | side | size @ price | type | oid");
+      for (const o of working) lines.push([o.coin, o.side === "B" ? "buy" : "sell", `${o.sz} @ ${o.limitPx}`, `${o.orderType}${o.tif ? ` ${o.tif}` : ""}${o.reduceOnly ? " reduce-only" : ""}`, o.oid].join(" | "));
+    } else lines.push("open orders: none");
+  }
+  if (summary)
+    lines.push(
+      `${summary.window}: realized ${usd(summary.realizedPnl, true)} \xB7 fees ${usd(summary.totalFees)} \xB7 ${summary.winCount} wins / ${summary.lossCount} losses`
+    );
+  return lines.join("\n");
+}
+function positionLine(pos) {
+  return [
+    `${pos.side.toLowerCase()} ${trim(Math.abs(pos.size), 6)} ${pos.symbol.replace(/USDT$/, "")} @ ${price(pos.entryPrice)}`,
+    `mark ${price(pos.markPrice)}`,
+    `open PnL ${usd(pos.unrealizedPnl, true)}`,
+    `${trim(pos.leverage, 1)}x`,
+    `liquidation ${price(pos.liquidationPrice ?? null)}`
+  ].join(" \xB7 ");
+}
+var cents = (v, signed = false) => Math.abs(v) >= 1e3 ? usd(v, signed) : `${v < 0 ? "-" : signed && v > 0 ? "+" : ""}$${Math.abs(v).toFixed(2)}`;
+function renderTrades(page, paper2, coin2, now = Date.now()) {
+  const f = page.fills;
+  const closes = f.filter((x) => x.closedPnl !== 0);
+  const pnl = f.reduce((sum, x) => sum + x.closedPnl, 0);
+  const fees = f.reduce((sum, x) => sum + x.fee, 0);
+  const wins = closes.filter((x) => x.closedPnl > 0).length;
+  const head = `${paper2 ? "PRACTICE " : ""}trades ${page.window}${coin2 ? ` ${coin2}` : ""} \xB7 ${f.length} fills \xB7 realized ${cents(pnl, true)} \xB7 fees ${cents(fees)} \xB7 net ${cents(pnl - fees, true)} \xB7 ${wins} wins / ${closes.length - wins} losses`;
+  if (!f.length) return `${head}
+no fills in this window`;
+  const lines = [head, "ago | coin | what | size @ price | realized PnL | fee"];
+  for (const x of f)
+    lines.push([ago(x.time, now), x.coin, x.dir, `${x.sz} @ ${price(x.px)}`, x.closedPnl === 0 ? "-" : cents(x.closedPnl, true), cents(x.fee)].join(" | "));
+  if (page.hasMore) lines.push("more fills are older: widen window or raise limit");
+  return lines.join("\n");
+}
+function renderCandles(coin2, interval, c) {
+  const iso = (t) => new Date(t).toISOString().slice(0, 16).replace("T", " ");
+  const lines = [`${coin2} ${interval} candles \xB7 ${c.candles.length}, oldest first${c.complete ? "" : " \xB7 some missing minutes left gaps"}`, "time UTC,open,high,low,close,volume"];
+  for (const k of c.candles) lines.push([iso(k.t), k.o, k.h, k.l, k.c, k.v].join(","));
+  return lines.join("\n");
+}
+
+// src/lean/tools.ts
+var text = (body, data) => ({
+  content: [{ type: "text", text: body }],
+  structuredContent: data
+});
+var loginText = (login) => `Helios is not connected yet. Open this link to approve access, then call this tool again:
+${login.verificationUriComplete}
+User code: ${login.userCode}`;
+var pendingResult = (login) => text(loginText(login), {
+  status: "pending",
+  connected: false,
+  actionRequired: true,
+  loginUrl: login.verificationUriComplete,
+  userCode: login.userCode
+});
+async function withSession(auth, scope, call) {
+  const loginOptions = { clientName: "Helios MCP", scope };
+  const login = await auth.ensureLogin(loginOptions);
+  if (login.status !== "connected") return { ok: false, pending: login };
+  const session = await auth.requireSession();
+  try {
+    return { ok: true, value: await call(session.accessToken) };
+  } catch (error) {
+    const recovery = await retryAfterUnauthorizedRefresh({ authService: auth, error, loginOptions, retry: call });
+    if (recovery === null) throw error;
+    if (isPending(recovery)) return { ok: false, pending: recovery };
+    return { ok: true, value: recovery };
+  }
+}
+function isPending(value) {
+  return Boolean(value && typeof value === "object" && value.connected === false && "verificationUriComplete" in value);
+}
+async function sessionScopes(auth) {
+  const session = await auth.requireSession().catch(() => null);
+  return new Set(session?.scope ?? []);
+}
+var coin = import_zod6.z.string().trim().min(1).max(36).describe("e.g. BTC, kPEPE, xyz:TSLA");
+var smBoardInputSchema = import_zod6.z.object({
+  view: import_zod6.z.enum(["conviction", "discount", "flows", "pileins"]).optional().describe("conviction (default): where they agree; discount: price better than their entry; flows: last hour; pileins: 3+ moving together"),
+  side: import_zod6.z.enum(["long", "short", "any"]).optional(),
+  limit: import_zod6.z.number().int().min(1).max(25).optional().describe("Default 8")
+});
+var smMovesInputSchema = import_zod6.z.object({
+  since: import_zod6.z.string().regex(/^\d{1,16}-\d{1,16}$/).optional().describe("next from your last call: only newer moves"),
+  coin: coin.optional(),
+  kind: import_zod6.z.enum(["entries", "exits", "all"]).optional().describe("entries = opens, adds; exits = trims, closes"),
+  min_usd: import_zod6.z.number().nonnegative().optional().describe("Default 25000"),
+  limit: import_zod6.z.number().int().min(1).max(50).optional().describe("Default 15")
+});
+var smCoinInputSchema = import_zod6.z.object({ coin });
+var marketInputSchema = import_zod6.z.object({
+  coins: import_zod6.z.string().max(400).optional().describe('Comma list, e.g. "BTC,HYPE"; omit for all'),
+  limit: import_zod6.z.number().int().min(1).max(300).optional().describe("Default 20"),
+  offset: import_zod6.z.number().int().nonnegative().optional(),
+  sort: import_zod6.z.enum(["volume", "rank", "move1h", "move24h", "funding", "lean", "edge"]).optional(),
+  filter: import_zod6.z.enum(["turning", "falling", "stretched_up", "stretched_down", "sm_long", "sm_short", "discount"]).optional().describe("turning = turning up from breakdown (held up in backtests); discount = better than their entry")
+});
+var paper = import_zod6.z.boolean().optional().describe("true = your practice account: live prices, simulated fills, no real money (market orders only)");
+var accountInputSchema = import_zod6.z.object({ paper });
+var tradeInputSchema = import_zod6.z.object({
+  coin,
+  action: import_zod6.z.enum(["open", "add", "close", "reverse", "reset"]).describe("reset = start the practice account over (paper only; margin_usd = starting balance, default $10k)"),
+  side: import_zod6.z.enum(["long", "short"]).optional().describe("For open, add, reverse"),
+  // Only obviously absurd values are cut here; Hyperliquid's margin check and the person's approval do the rest.
+  margin_usd: import_zod6.z.number().positive().max(1e6).optional().describe("Size = margin x leverage"),
+  leverage: import_zod6.z.number().positive().max(100).optional(),
+  sl_pct: import_zod6.z.number().positive().max(95).optional().describe("Stop, % from entry"),
+  tp_pct: import_zod6.z.number().positive().max(1e3).optional().describe("Take profit, % from entry"),
+  limit_px: import_zod6.z.number().positive().optional().describe("Omit for market"),
+  slippage_bps: import_zod6.z.number().int().min(1).max(1e3).optional().describe("Market only: worst fill vs price, bps. Default 300 (3%)"),
+  fraction: import_zod6.z.number().positive().max(1).optional().describe("close only: share to close, e.g. 0.5 = half. Default 1 = all"),
+  paper,
+  key: import_zod6.z.string().regex(/^[A-Za-z0-9_-]{8,64}$/).optional().describe("Same key on retry = never placed twice. Omitted: repeats of the same call within 60s of the first are placed once")
+});
+var TRADE_KEY_WINDOW_SECONDS = 60;
+function tradeKeyFor(input, account) {
+  const order = [
+    account,
+    input.coin.toUpperCase(),
+    input.action,
+    input.side ?? "",
+    input.margin_usd ?? "",
+    input.leverage ?? "",
+    input.sl_pct ?? "",
+    input.tp_pct ?? "",
+    input.limit_px ?? "",
+    input.slippage_bps ?? "",
+    input.fraction ?? ""
+  ];
+  return `mcpw-${(0, import_node_crypto3.createHash)("sha256").update(`trade:${order.join("|")}`).digest("base64url")}`;
+}
+var protectInputSchema = import_zod6.z.object({
+  coin,
+  op: import_zod6.z.enum(["set", "remove", "cancel", "move"]).describe("set TP/SL; remove a TP/SL; cancel an order; move an open order to px"),
+  tp_px: import_zod6.z.number().positive().optional(),
+  sl_px: import_zod6.z.number().positive().optional(),
+  order_id: import_zod6.z.string().max(64).optional().describe("From account: TP/SL id or order oid"),
+  px: import_zod6.z.number().positive().optional().describe("move only: the new limit (or trigger) price"),
+  paper
+});
+var tradesInputSchema = import_zod6.z.object({
+  window: import_zod6.z.enum(["24h", "7d", "30d"]).optional().describe("Default 7d"),
+  coin: coin.optional(),
+  limit: import_zod6.z.number().int().min(1).max(100).optional().describe("Default 20"),
+  paper
+});
+var candlesInputSchema = import_zod6.z.object({
+  coin: import_zod6.z.string().regex(/^[A-Za-z0-9]{1,20}$/).describe("e.g. BTC, kPEPE"),
+  interval: import_zod6.z.enum(["1m", "5m", "15m", "1h", "4h", "1d"]),
+  limit: import_zod6.z.number().int().min(1).max(1e3).optional().describe("Default 100")
+});
+var READ = [AGENT_SCOPES.MARKET_READ];
+var sameCoinName = (a, b) => a.replace(/USDT$/, "").toUpperCase() === b.replace(/USDT$/, "").toUpperCase();
+var sameCoin = (pos, coin2) => sameCoinName(pos.symbol, coin2);
+var paperTotals = (p) => p.realizedPnl === void 0 ? "" : `
+practice totals: realized ${p.realizedPnl >= 0 ? "+" : "-"}$${Math.abs(p.realizedPnl).toFixed(2)} \xB7 fees $${(p.feesPaid ?? 0).toFixed(2)} \xB7 funding $${(p.fundingPaid ?? 0).toFixed(2)} \xB7 liquidations ${p.liquidations ?? 0}`;
+function wrongSideTpSl(side, mark, tp, sl) {
+  const long = side === "LONG";
+  const at = `${side.toLowerCase()} (price ${price(mark)})`;
+  if (sl !== void 0 && (long ? sl >= mark : sl <= mark)) return `Stop ${price(sl)} must be ${long ? "under" : "over"} the price for a ${at}`;
+  if (tp !== void 0 && (long ? tp <= mark : tp >= mark)) return `Take profit ${price(tp)} must be ${long ? "over" : "under"} the price for a ${at}`;
+  return null;
+}
+function createLeanToolDefinitions(services) {
+  const { auth, dataBridge } = services;
+  const smBoard = {
+    name: "sm_board",
+    title: "Smart Money Board",
+    description: "Where the top Hyperliquid traders (ranked on a year of results) are positioned: side, size, entry vs price.",
+    inputSchema: smBoardInputSchema,
+    async execute(input) {
+      const r = await withSession(auth, READ, (token) => dataBridge.getSmartMoneyBoard(token, input));
+      return r.ok ? text(renderBoard(r.value), r.value) : pendingResult(r.pending);
+    }
+  };
+  const smMoves = {
+    name: "sm_moves",
+    title: "Smart Money Moves",
+    description: "Top traders\u2019 latest trades. Poll with since=next for new ones only.",
+    inputSchema: smMovesInputSchema,
+    async execute(input) {
+      const r = await withSession(
+        auth,
+        READ,
+        (token) => dataBridge.getSmartMoneyMoves(token, { since: input.since, coin: input.coin, kind: input.kind, minUsd: input.min_usd, limit: input.limit })
+      );
+      return r.ok ? text(renderMoves(r.value), r.value) : pendingResult(r.pending);
+    }
+  };
+  const smCoin = {
+    name: "sm_coin",
+    title: "Smart Money Coin Brief",
+    description: "One coin in one call: top traders\u2019 book, entries and trades, price, setup, funding, OI, your position.",
+    inputSchema: smCoinInputSchema,
+    async execute(input) {
+      const r = await withSession(auth, READ, (token) => dataBridge.getSmartMoneyCoin(token, input.coin));
+      if (!r.ok) return pendingResult(r.pending);
+      let you = null;
+      if ((await sessionScopes(auth)).has(AGENT_SCOPES.ACCOUNT_READ)) {
+        const p = await withSession(auth, [AGENT_SCOPES.ACCOUNT_READ], (token) => dataBridge.getPortfolio(token, { provider: "hyperliquid" })).catch(
+          () => null
+        );
+        if (p?.ok) {
+          you = {
+            position: p.value.positions.find((pos) => sameCoin(pos, r.value.coin)) ?? null,
+            availableBalance: p.value.availableBalance
+          };
+        }
       }
-      throw error;
+      return text(renderCoin(r.value, you), { ...r.value, you });
     }
-  }
-  async submitIntent(intentType, input) {
-    const loginOptions = {
-      clientName: "Helios MCP",
-      scope: [AGENT_SCOPES.ORDERS_WRITE]
-    };
-    const login = await this.authService.ensureLogin(loginOptions);
-    if (login.status !== "connected") {
-      return asPending2(login);
+  };
+  const market = {
+    name: "market",
+    title: "Market Scan",
+    description: "All coins: price, moves, volume, funding, OI, setup label, top traders\u2019 lean. Filter, sort, page.",
+    inputSchema: marketInputSchema,
+    async execute(input) {
+      const coins = input.coins?.split(",").map((c) => c.trim()).filter(Boolean).slice(0, 50);
+      const r = await withSession(
+        auth,
+        READ,
+        (token) => dataBridge.getAgentMarket(token, {
+          ...coins?.length ? { coins } : {},
+          limit: input.limit,
+          offset: input.offset,
+          sort: input.sort,
+          filter: input.filter
+        })
+      );
+      return r.ok ? text(renderMarket(r.value), r.value) : pendingResult(r.pending);
     }
-    const session = await this.authService.requireSession();
-    const idempotencyKey = input.idempotencyKey ?? (0, import_node_crypto.randomUUID)().replace(/-/g, "");
-    try {
-      const provider = await this.providerService.resolveProvider(input.provider);
-      const submission = await this.dataBridgeClient.submitTradeIntent(session.accessToken, {
-        ...input,
-        provider,
-        intentType,
-        idempotencyKey
-      });
-      return {
-        status: "connected",
-        connected: true,
-        submission
-      };
-    } catch (error) {
-      const recovery = await retryAfterUnauthorizedRefresh({
-        authService: this.authService,
-        error,
-        loginOptions,
-        retry: async (accessToken) => {
-          const provider = await this.providerService.resolveProvider(input.provider);
-          const submission = await this.dataBridgeClient.submitTradeIntent(accessToken, {
-            ...input,
-            provider,
-            intentType,
-            idempotencyKey
-          });
-          return {
-            status: "connected",
-            connected: true,
-            submission
-          };
+  };
+  const account = {
+    name: "account",
+    title: "Account",
+    description: "Balance, positions with TP/SL ids, open orders, 30-day result. paper=true for the practice account.",
+    inputSchema: accountInputSchema,
+    async execute(input) {
+      if (input.paper) {
+        const p = await withSession(auth, [AGENT_SCOPES.ACCOUNT_READ], (token) => dataBridge.getPaperPortfolio(token));
+        if (!p.ok) return pendingResult(p.pending);
+        return text(`PRACTICE ${renderAccount(p.value, null, null)}${paperTotals(p.value)}`, { paper: true, portfolio: p.value });
+      }
+      const r = await withSession(
+        auth,
+        [AGENT_SCOPES.ACCOUNT_READ],
+        (token) => Promise.all([
+          dataBridge.getPortfolio(token, { provider: "hyperliquid" }),
+          dataBridge.getOpenOrders(token).catch(() => null),
+          dataBridge.getLedgerSummary(token, { window: "30d" }).catch(() => null)
+        ])
+      );
+      if (!r.ok) return pendingResult(r.pending);
+      const [portfolio, orders, summary] = r.value;
+      return text(renderAccount(portfolio, orders, summary), { portfolio, orders, summary });
+    }
+  };
+  const trade = {
+    name: "trade",
+    title: "Trade",
+    description: "Open, add to, close (all or part) or reverse a position, sized by margin in USD. Answers with the position after the order. paper=true to practice.",
+    inputSchema: tradeInputSchema,
+    acts: true,
+    async execute(input) {
+      if (input.fraction !== void 0 && input.action !== "close") throw new Error("fraction is for close only");
+      if (input.action === "reset") {
+        if (!input.paper) throw new Error("reset is for the practice account only: pass paper=true");
+        const r2 = await withSession(auth, [AGENT_SCOPES.ORDERS_WRITE], (token) => dataBridge.resetPaperAccount(token, input.margin_usd));
+        if (!r2.ok) return pendingResult(r2.pending);
+        return text(`Practice account started over with ${input.margin_usd ? `$${input.margin_usd}` : "the default balance"}.`, { paper: true, reset: true });
+      }
+      if (input.paper) return paperTrade(input);
+      if (input.action === "close") {
+        const r2 = await withSession(
+          auth,
+          [AGENT_SCOPES.ORDERS_WRITE],
+          (token) => dataBridge.closePosition(token, {
+            provider: "hyperliquid",
+            symbol: input.coin,
+            ...input.fraction !== void 0 && input.fraction < 1 ? { fraction: input.fraction } : {},
+            // A close is a market order: the same cap applies (unset, data-bridge uses its default).
+            ...input.slippage_bps ? { maxSlippageBps: input.slippage_bps } : {}
+          })
+        );
+        if (!r2.ok) return pendingResult(r2.pending);
+        if (r2.value.outcome === "no_position") return text(`No open ${input.coin} position: nothing was sent.`, r2.value);
+        const after2 = await positionAfter(input.coin, false);
+        const what = r2.value.mode === "PARTIAL" ? `${Math.round((input.fraction ?? 1) * 100)}% of the ${input.coin} position` : `the whole ${input.coin} position`;
+        return text(`Sent a market order closing ${what}. ${after2.text}`, { ...r2.value, after: after2.position });
+      }
+      if (!input.side || !input.margin_usd) throw new Error(`${input.action} needs side and margin_usd`);
+      if (input.limit_px && input.slippage_bps) throw new Error("slippage_bps is for market orders: a limit order fills at limit_px or better");
+      const prot = await protectionFor(input);
+      if ("pending" in prot) return pendingResult(prot.pending);
+      const protection = prot.value;
+      const intentType = input.action === "open" ? "OPEN" : input.action === "add" ? "DCA" : "REVERSE";
+      let idempotencyKey = input.key;
+      const r = await withSession(auth, [AGENT_SCOPES.ORDERS_WRITE], async (token) => {
+        if (!idempotencyKey) {
+          const session = await auth.requireSession();
+          idempotencyKey = tradeKeyFor(input, `${session.ownerUserId}|${session.agentGrantId}`);
         }
+        return dataBridge.submitTradeIntent(token, {
+          provider: "hyperliquid",
+          symbol: input.coin,
+          intentType,
+          direction: input.side === "long" ? "LONG" : "SHORT",
+          size: { mode: "MARGIN_USD", value: input.margin_usd },
+          execution: input.limit_px ? { style: "LIMIT_GTC", limitPrice: input.limit_px } : { style: "MARKET" },
+          // Unset, data-bridge caps a market order at its own default (300 bps).
+          ...input.slippage_bps ? { maxSlippageBps: input.slippage_bps } : {},
+          ...input.leverage ? { leverageOverride: input.leverage } : {},
+          ...protection ? { protection } : {},
+          idempotencyKey,
+          ...input.key ? {} : { idempotencyWindowSeconds: TRADE_KEY_WINDOW_SECONDS }
+        });
+      }).catch((error) => {
+        if (!isHeliosAgentApiError(error) || error.code !== "CONFLICT" || !/being placed/.test(error.message)) throw error;
+        const why = input.key ? `key ${idempotencyKey} was already used` : `an identical trade call within ${TRADE_KEY_WINDOW_SECONDS}s of the first is the same order`;
+        throw new Error(
+          `${error.message} (${why}, so this may be that earlier order.) Call account to see whether it went through. To place another one on purpose, call trade again with a new key.`
+        );
       });
-      if (recovery) {
-        return recovery;
+      if (!r.ok) return pendingResult(r.pending);
+      const s = r.value;
+      const parts = [
+        s.outcome === "replayed" ? `Already sent earlier with key ${idempotencyKey}${input.key ? "" : ` (an identical call within ${TRADE_KEY_WINDOW_SECONDS}s of the first is the same order)`}: nothing new was placed. To place another on purpose, pass a new key.` : `Sent: ${input.action} ${input.side} ${input.coin}, $${input.margin_usd} margin${input.leverage ? ` at ${input.leverage}x` : ""}, ${input.limit_px ? `limit ${price(input.limit_px)}` : "market"}.`
+      ];
+      if (protection?.stopLoss) parts.push(`Stop ${price(protection.stopLoss.triggerPrice)}.`);
+      if (protection?.takeProfit) parts.push(`Take profit ${price(protection.takeProfit.triggerPrice)}.`);
+      if (s.orderStatus) parts.push(`Order status: ${s.orderStatus}.`);
+      if (s.rejectedProtection?.length) parts.push(`Hyperliquid refused part of the TP/SL; check account and set it with protect.`);
+      parts.push(input.key ? `key=${idempotencyKey}` : `key=${idempotencyKey} (an identical call within ${TRADE_KEY_WINDOW_SECONDS}s of the first is the same order)`);
+      let after;
+      if (!input.limit_px && s.outcome !== "replayed") {
+        const a = await positionAfter(input.coin, false);
+        parts.push(a.text);
+        after = a.position;
+      } else if (input.limit_px) parts.push("A limit order rests until filled: see it in account; move it with protect op=move.");
+      return text(parts.join(" "), { ...s, idempotencyKey, ...after !== void 0 ? { after } : {} });
+    }
+  };
+  const protect = {
+    name: "protect",
+    title: "Protect",
+    description: "Set or remove TP/SL on a position, or cancel an order.",
+    inputSchema: protectInputSchema,
+    acts: true,
+    async execute(input) {
+      if (input.op === "set") {
+        if (!input.tp_px && !input.sl_px) throw new Error("set needs tp_px, sl_px or both");
+        const p = await withSession(
+          auth,
+          [AGENT_SCOPES.ACCOUNT_READ],
+          (token) => input.paper ? dataBridge.getPaperPortfolio(token) : dataBridge.getPortfolio(token, { provider: "hyperliquid" })
+        ).catch(
+          (error) => {
+            throw new Error(
+              `Could not read your ${input.coin} position to check the TP/SL side (${error instanceof Error ? error.message : String(error)}); nothing was set.`
+            );
+          }
+        );
+        if (!p.ok) return pendingResult(p.pending);
+        const position = p.value.positions.find((pos) => sameCoin(pos, input.coin));
+        if (!position) throw new Error(`No open ${input.coin} position: nothing was set.`);
+        if (!(position.markPrice > 0)) throw new Error(`No price for ${input.coin} to check the TP/SL against: nothing was set. Try again shortly.`);
+        const wrong = wrongSideTpSl(position.side, position.markPrice, input.tp_px, input.sl_px);
+        if (wrong) throw new Error(`${wrong}: it would trigger at once and close the position. Nothing was set.`);
+        const tpSl = {
+          provider: "hyperliquid",
+          symbol: input.coin,
+          applyTo: "FULL_POSITION",
+          // TP/SL attach to the position on Hyperliquid; data-bridge links them to the order that opened it.
+          parentClientOrderId: `hl-position:${input.coin}`,
+          ...input.tp_px ? { takeProfit: { kind: "MARKET", triggerPrice: input.tp_px } } : {},
+          ...input.sl_px ? { stopLoss: { kind: "MARKET", triggerPrice: input.sl_px } } : {}
+        };
+        const r2 = await withSession(
+          auth,
+          [AGENT_SCOPES.ORDERS_WRITE],
+          (token) => input.paper ? dataBridge.setPaperTpSl(token, tpSl) : dataBridge.setTpSl(token, tpSl)
+        );
+        if (!r2.ok) return pendingResult(r2.pending);
+        const legs = [input.tp_px ? `take profit ${price(input.tp_px)}` : null, input.sl_px ? `stop ${price(input.sl_px)}` : null].filter(Boolean);
+        return text(`${input.paper ? "Practice: s" : "S"}et on the whole ${input.coin} position: ${legs.join(", ")}.`, r2.value);
       }
-      throw error;
+      if (!input.order_id) throw new Error(`${input.op} needs order_id (from account)`);
+      if (input.op === "remove") {
+        const del = { provider: "hyperliquid", symbol: input.coin, orderId: input.order_id };
+        const r2 = await withSession(
+          auth,
+          [AGENT_SCOPES.ORDERS_CANCEL],
+          (token) => input.paper ? dataBridge.deletePaperTpSl(token, del) : dataBridge.deleteTpSl(token, del)
+        );
+        return r2.ok ? text(`Removed TP/SL ${input.order_id} on ${input.coin}.`, r2.value) : pendingResult(r2.pending);
+      }
+      if (input.paper) throw new Error("The practice account has no resting orders (every order fills at market): nothing to cancel or move");
+      const oid = Number(input.order_id);
+      if (!Number.isInteger(oid) || oid < 0) throw new Error(`${input.op} needs the numeric order oid from account`);
+      if (input.op === "move") {
+        if (!input.px) throw new Error("move needs px, the new price");
+        const o = await withSession(auth, [AGENT_SCOPES.ACCOUNT_READ], (token) => dataBridge.getOpenOrders(token));
+        if (!o.ok) return pendingResult(o.pending);
+        const order = o.value.find((x) => x.oid === oid);
+        if (!order) throw new Error(`No open order ${oid}: it may have filled or been cancelled. Call account.`);
+        const size = Number(order.sz);
+        const r2 = await withSession(auth, [AGENT_SCOPES.ORDERS_WRITE], (token) => dataBridge.modifyOrder(token, { symbol: order.coin, oid, price: input.px, size }));
+        return r2.ok ? text(`Moved order ${oid} on ${order.coin} to ${price(input.px)} (size ${order.sz}).`, r2.value) : pendingResult(r2.pending);
+      }
+      const r = await withSession(auth, [AGENT_SCOPES.ORDERS_CANCEL], (token) => dataBridge.cancelOrder(token, { symbol: input.coin, oid }));
+      return r.ok ? text(`Cancelled order ${oid} on ${input.coin}.`, r.value) : pendingResult(r.pending);
+    }
+  };
+  const trades = {
+    name: "trades",
+    title: "Your Trades",
+    description: "Your recent fills, newest first: price, size, realized PnL and fees, with totals. Learn from results. paper=true for practice.",
+    inputSchema: tradesInputSchema,
+    async execute(input) {
+      const window = input.window ?? "7d";
+      const want = input.limit ?? 20;
+      const ask = { window, limit: input.coin ? 200 : want };
+      const r = await withSession(
+        auth,
+        [AGENT_SCOPES.ACCOUNT_READ],
+        (token) => input.paper ? dataBridge.getPaperLedgerFills(token, ask) : dataBridge.getLedgerFills(token, ask)
+      );
+      if (!r.ok) return pendingResult(r.pending);
+      const fills = r.value.fills.filter((f) => !input.coin || sameCoinName(f.coin, input.coin)).slice(0, want);
+      const page = { ...r.value, fills };
+      return text(renderTrades(page, Boolean(input.paper), input.coin ?? null), { paper: Boolean(input.paper), ...page });
+    }
+  };
+  const candles = {
+    name: "candles",
+    title: "Candles",
+    description: "OHLCV candles for one coin (up to 7 days), oldest first, as CSV.",
+    inputSchema: candlesInputSchema,
+    async execute(input) {
+      const r = await withSession(
+        auth,
+        READ,
+        (token) => dataBridge.getMarketCandles(token, { symbol: input.coin, interval: input.interval, limit: input.limit ?? 100 })
+      );
+      return r.ok ? text(renderCandles(input.coin, input.interval, r.value), r.value) : pendingResult(r.pending);
     }
-  }
-};
-function asPending2(login) {
-  return {
-    ...login,
-    status: "pending",
-    connected: false
   };
+  async function positionAfter(coinName, isPaper) {
+    const p = await withSession(
+      auth,
+      [AGENT_SCOPES.ACCOUNT_READ],
+      (token) => isPaper ? dataBridge.getPaperPortfolio(token) : dataBridge.getPortfolio(token, { provider: "hyperliquid" })
+    ).catch(() => null);
+    if (!p?.ok || !Array.isArray(p.value?.positions)) return { text: "Call account to see the position.", position: null };
+    const position = p.value.positions.find((pos) => sameCoin(pos, coinName)) ?? null;
+    return { text: position ? `Now: ${positionLine(position)}.` : `Now: no ${coinName} position.`, position };
+  }
+  async function paperTrade(input) {
+    if (input.limit_px) throw new Error("The practice account fills market orders only: leave out limit_px");
+    if (input.action === "close") {
+      const r2 = await withSession(
+        auth,
+        [AGENT_SCOPES.ORDERS_WRITE],
+        (token) => dataBridge.closePaperPosition(token, { symbol: input.coin, ...input.fraction !== void 0 && input.fraction < 1 ? { fraction: input.fraction } : {} })
+      );
+      if (!r2.ok) return pendingResult(r2.pending);
+      if (!r2.value.length) return text(`Practice: no open ${input.coin} position, nothing closed.`, { paper: true, fills: [] });
+      const after2 = await positionAfter(input.coin, true);
+      const pnl = r2.value.reduce((sum, f) => sum + f.pnl - f.fee, 0);
+      return text(`Practice: closed ${input.fraction && input.fraction < 1 ? `${Math.round(input.fraction * 100)}% of ` : ""}${input.coin} @ ${price(r2.value[r2.value.length - 1].price)}, ${pnl >= 0 ? "+" : "-"}$${Math.abs(pnl).toFixed(2)} after fees. ${after2.text}`, {
+        paper: true,
+        fills: r2.value,
+        after: after2.position
+      });
+    }
+    if (!input.side || !input.margin_usd) throw new Error(`${input.action} needs side and margin_usd`);
+    const protection = await protectionFor(input);
+    if ("pending" in protection) return pendingResult(protection.pending);
+    const r = await withSession(
+      auth,
+      [AGENT_SCOPES.ORDERS_WRITE],
+      (token) => dataBridge.submitPaperIntent(token, {
+        provider: "hyperliquid",
+        symbol: input.coin,
+        intentType: input.action === "open" ? "OPEN" : input.action === "add" ? "DCA" : "REVERSE",
+        direction: input.side === "long" ? "LONG" : "SHORT",
+        size: { mode: "MARGIN_USD", value: input.margin_usd },
+        execution: { style: "MARKET" },
+        ...input.leverage ? { leverageOverride: input.leverage } : {},
+        ...protection.value ? { protection: protection.value } : {}
+      })
+    );
+    if (!r.ok) return pendingResult(r.pending);
+    const after = await positionAfter(input.coin, true);
+    const filled = r.value.filter((f) => f.side !== null);
+    const parts = [
+      filled.length ? `Practice: ${input.action} ${input.side} ${input.coin} filled @ ${price(filled[filled.length - 1].price)}, $${input.margin_usd} margin${input.leverage ? ` at ${input.leverage}x` : ""}.` : `Practice: ${input.action} ${input.side} ${input.coin} sent, no fill reported.`
+    ];
+    if (protection.value?.stopLoss) parts.push(`Stop ${price(protection.value.stopLoss.triggerPrice)}.`);
+    if (protection.value?.takeProfit) parts.push(`Take profit ${price(protection.value.takeProfit.triggerPrice)}.`);
+    parts.push(after.text);
+    return text(parts.join(" "), { paper: true, fills: r.value, after: after.position });
+  }
+  async function protectionFor(input) {
+    if (input.side === "short" && (input.tp_pct ?? 0) >= 100) throw new Error("A short can gain at most 100%: tp_pct must be under 100");
+    if (!input.sl_pct && !input.tp_pct) return { value: void 0 };
+    let ref = input.limit_px ?? null;
+    if (ref === null) {
+      const m = await withSession(auth, READ, (token) => dataBridge.getAgentMarket(token, { coins: [input.coin], limit: 1 }));
+      if (!m.ok) return { pending: m.pending };
+      ref = m.value.rows[0]?.px ?? null;
+    }
+    if (ref === null) throw new Error(`No price for ${input.coin} to place the stop from; trade without sl_pct/tp_pct, then use protect`);
+    const long = input.side === "long";
+    const at = (p, away) => Number((p * (1 + away / 100)).toPrecision(6));
+    return {
+      value: {
+        ...input.sl_pct ? { stopLoss: { kind: "MARKET", triggerPrice: at(ref, long ? -input.sl_pct : input.sl_pct) } } : {},
+        ...input.tp_pct ? { takeProfit: { kind: "MARKET", triggerPrice: at(ref, long ? input.tp_pct : -input.tp_pct) } } : {}
+      }
+    };
+  }
+  return { smBoard, smMoves, smCoin, market, account, trade, protect, trades, candles };
+}
+function leanToolsFor(tools, profile) {
+  const reads = [tools.smBoard, tools.smMoves, tools.smCoin, tools.market];
+  const list = profile === "signals" ? [...reads, tools.account, tools.trades, tools.candles] : [...reads, tools.account, tools.trades, tools.trade, tools.protect, tools.candles];
+  return list;
 }
 
 // src/tools.ts
-var import_zod5 = require("zod");
-var pollLoginInputSchema = import_zod5.z.object({
-  /** Optional: defaults to the login started by helios_auth_ensure_login / helios_auth_start_login. */
-  deviceCode: import_zod5.z.string().min(1).optional()
-});
-var startLoginOutputSchema = import_zod5.z.object({
-  status: import_zod5.z.literal("pending"),
-  deviceCode: import_zod5.z.string(),
-  userCode: import_zod5.z.string(),
-  verificationUri: import_zod5.z.string().url(),
-  verificationUriComplete: import_zod5.z.string().url(),
-  expiresInSeconds: import_zod5.z.number().int().positive(),
-  pollIntervalSeconds: import_zod5.z.number().int().positive(),
-  requestedScope: import_zod5.z.array(agentScopeSchema).min(1),
-  startedAt: import_zod5.z.string().datetime()
-});
-var ensureLoginInputSchema = import_zod5.z.object({
-  clientName: import_zod5.z.string().min(1).max(64).optional(),
-  scope: import_zod5.z.array(agentScopeSchema).min(1).optional(),
+var import_zod7 = require("zod");
+var pollLoginInputSchema = import_zod7.z.object({
+  /**
+   * Optional, kept for older agents: the login in progress is always the one polled, and any other code (one that isn't
+   * its user code) is refused.
+   */
+  deviceCode: import_zod7.z.string().min(1).optional()
+});
+var startLoginOutputSchema = import_zod7.z.object({
+  status: import_zod7.z.literal("pending"),
+  userCode: import_zod7.z.string(),
+  verificationUri: import_zod7.z.string().url(),
+  verificationUriComplete: import_zod7.z.string().url(),
+  expiresInSeconds: import_zod7.z.number().int().positive(),
+  pollIntervalSeconds: import_zod7.z.number().int().positive(),
+  requestedScope: import_zod7.z.array(agentScopeSchema).min(1),
+  startedAt: import_zod7.z.string().datetime()
+});
+var ensureLoginInputSchema = import_zod7.z.object({
+  clientName: import_zod7.z.string().min(1).max(64).optional(),
+  scope: import_zod7.z.array(agentScopeSchema).min(1).optional(),
   constraints: agentConstraintsSchema.optional()
 });
-var providerSelectionInputSchema = import_zod5.z.object({
+var providerSelectionInputSchema = import_zod7.z.object({
   provider: providerSchema.optional()
 });
-var providerSetInputSchema = import_zod5.z.object({
+var providerSetInputSchema = import_zod7.z.object({
   provider: providerSchema
 });
-var activeProviderSchema = import_zod5.z.object({
-  configured: import_zod5.z.boolean(),
+var activeProviderSchema = import_zod7.z.object({
+  configured: import_zod7.z.boolean(),
   provider: providerSchema.nullable()
 });
-var ensureLoginOutputSchema = import_zod5.z.discriminatedUnion("status", [
+var ensureLoginOutputSchema = import_zod7.z.discriminatedUnion("status", [
   agentSessionViewSchema.extend({
-    status: import_zod5.z.literal("connected"),
-    connected: import_zod5.z.literal(true)
+    status: import_zod7.z.literal("connected"),
+    connected: import_zod7.z.literal(true)
   }),
   startLoginOutputSchema.extend({
-    status: import_zod5.z.literal("pending"),
-    connected: import_zod5.z.literal(false),
-    message: import_zod5.z.string()
+    status: import_zod7.z.literal("pending"),
+    connected: import_zod7.z.literal(false),
+    message: import_zod7.z.string()
   })
 ]);
-var pollLoginOutputSchema = import_zod5.z.discriminatedUnion("status", [
+var pollLoginOutputSchema = import_zod7.z.discriminatedUnion("status", [
   agentSessionViewSchema.extend({
-    status: import_zod5.z.literal("connected"),
-    connected: import_zod5.z.literal(true)
+    status: import_zod7.z.literal("connected"),
+    connected: import_zod7.z.literal(true)
   }),
-  import_zod5.z.object({
-    status: import_zod5.z.enum(["pending", "rejected", "expired", "failed"]),
-    connected: import_zod5.z.literal(false),
-    message: import_zod5.z.string()
+  import_zod7.z.object({
+    status: import_zod7.z.enum(["pending", "rejected", "expired", "failed"]),
+    connected: import_zod7.z.literal(false),
+    message: import_zod7.z.string()
   })
 ]);
-var walletStateToolOutputSchema = import_zod5.z.discriminatedUnion("status", [
-  import_zod5.z.object({
-    status: import_zod5.z.literal("connected"),
-    connected: import_zod5.z.literal(true),
+var walletStateToolOutputSchema = import_zod7.z.discriminatedUnion("status", [
+  import_zod7.z.object({
+    status: import_zod7.z.literal("connected"),
+    connected: import_zod7.z.literal(true),
     walletState: walletStateSchema
   }),
   startLoginOutputSchema.extend({
-    status: import_zod5.z.literal("pending"),
-    connected: import_zod5.z.literal(false),
-    message: import_zod5.z.string()
+    status: import_zod7.z.literal("pending"),
+    connected: import_zod7.z.literal(false),
+    message: import_zod7.z.string()
   })
 ]);
-var portfolioToolOutputSchema = import_zod5.z.discriminatedUnion("status", [
-  import_zod5.z.object({
-    status: import_zod5.z.literal("connected"),
-    connected: import_zod5.z.literal(true),
+var portfolioToolOutputSchema = import_zod7.z.discriminatedUnion("status", [
+  import_zod7.z.object({
+    status: import_zod7.z.literal("connected"),
+    connected: import_zod7.z.literal(true),
     portfolio: portfolioSnapshotSchema
   }),
   startLoginOutputSchema.extend({
-    status: import_zod5.z.literal("pending"),
-    connected: import_zod5.z.literal(false),
-    message: import_zod5.z.string()
+    status: import_zod7.z.literal("pending"),
+    connected: import_zod7.z.literal(false),
+    message: import_zod7.z.string()
   })
 ]);
-var openPositionsToolOutputSchema = import_zod5.z.discriminatedUnion("status", [
-  import_zod5.z.object({
-    status: import_zod5.z.literal("connected"),
-    connected: import_zod5.z.literal(true),
+var openPositionsToolOutputSchema = import_zod7.z.discriminatedUnion("status", [
+  import_zod7.z.object({
+    status: import_zod7.z.literal("connected"),
+    connected: import_zod7.z.literal(true),
     openPositions: openPositionsSnapshotSchema
   }),
   startLoginOutputSchema.extend({
-    status: import_zod5.z.literal("pending"),
-    connected: import_zod5.z.literal(false),
-    message: import_zod5.z.string()
+    status: import_zod7.z.literal("pending"),
+    connected: import_zod7.z.literal(false),
+    message: import_zod7.z.string()
   })
 ]);
-var ledgerFillsToolOutputSchema = import_zod5.z.discriminatedUnion("status", [
-  import_zod5.z.object({
-    status: import_zod5.z.literal("connected"),
-    connected: import_zod5.z.literal(true),
+var ledgerFillsToolOutputSchema = import_zod7.z.discriminatedUnion("status", [
+  import_zod7.z.object({
+    status: import_zod7.z.literal("connected"),
+    connected: import_zod7.z.literal(true),
     fills: ledgerFillsPageSchema
   }),
   startLoginOutputSchema.extend({
-    status: import_zod5.z.literal("pending"),
-    connected: import_zod5.z.literal(false),
-    message: import_zod5.z.string()
+    status: import_zod7.z.literal("pending"),
+    connected: import_zod7.z.literal(false),
+    message: import_zod7.z.string()
   })
 ]);
-var ledgerSummaryToolOutputSchema = import_zod5.z.discriminatedUnion("status", [
-  import_zod5.z.object({
-    status: import_zod5.z.literal("connected"),
-    connected: import_zod5.z.literal(true),
+var ledgerSummaryToolOutputSchema = import_zod7.z.discriminatedUnion("status", [
+  import_zod7.z.object({
+    status: import_zod7.z.literal("connected"),
+    connected: import_zod7.z.literal(true),
     summary: ledgerSummarySchema
   }),
   startLoginOutputSchema.extend({
-    status: import_zod5.z.literal("pending"),
-    connected: import_zod5.z.literal(false),
-    message: import_zod5.z.string()
+    status: import_zod7.z.literal("pending"),
+    connected: import_zod7.z.literal(false),
+    message: import_zod7.z.string()
   })
 ]);
-var marketSnapshotToolOutputSchema = import_zod5.z.discriminatedUnion("status", [
-  import_zod5.z.object({
-    status: import_zod5.z.literal("connected"),
-    connected: import_zod5.z.literal(true),
+var marketSnapshotToolOutputSchema = import_zod7.z.discriminatedUnion("status", [
+  import_zod7.z.object({
+    status: import_zod7.z.literal("connected"),
+    connected: import_zod7.z.literal(true),
     snapshot: marketSnapshotSchema
   }),
   startLoginOutputSchema.extend({
-    status: import_zod5.z.literal("pending"),
-    connected: import_zod5.z.literal(false),
-    message: import_zod5.z.string()
+    status: import_zod7.z.literal("pending"),
+    connected: import_zod7.z.literal(false),
+    message: import_zod7.z.string()
   })
 ]);
-var marketSnapshotChunkToolOutputSchema = import_zod5.z.discriminatedUnion("status", [
-  import_zod5.z.object({
-    status: import_zod5.z.literal("connected"),
-    connected: import_zod5.z.literal(true),
+var marketSnapshotChunkToolOutputSchema = import_zod7.z.discriminatedUnion("status", [
+  import_zod7.z.object({
+    status: import_zod7.z.literal("connected"),
+    connected: import_zod7.z.literal(true),
     snapshotChunk: marketSnapshotChunkSchema
   }),
   startLoginOutputSchema.extend({
-    status: import_zod5.z.literal("pending"),
-    connected: import_zod5.z.literal(false),
-    message: import_zod5.z.string()
+    status: import_zod7.z.literal("pending"),
+    connected: import_zod7.z.literal(false),
+    message: import_zod7.z.string()
   })
 ]);
-var marketSymbolDetailToolOutputSchema = import_zod5.z.discriminatedUnion("status", [
-  import_zod5.z.object({
-    status: import_zod5.z.literal("connected"),
-    connected: import_zod5.z.literal(true),
+var marketSymbolDetailToolOutputSchema = import_zod7.z.discriminatedUnion("status", [
+  import_zod7.z.object({
+    status: import_zod7.z.literal("connected"),
+    connected: import_zod7.z.literal(true),
     detail: marketSymbolDetailSchema
   }),
   startLoginOutputSchema.extend({
-    status: import_zod5.z.literal("pending"),
-    connected: import_zod5.z.literal(false),
-    message: import_zod5.z.string()
+    status: import_zod7.z.literal("pending"),
+    connected: import_zod7.z.literal(false),
+    message: import_zod7.z.string()
   })
 ]);
 var tradeActionInputSchema = submitTradeIntentInputSchema.omit({
   intentType: true
 });
-var tradeActionToolOutputSchema = import_zod5.z.discriminatedUnion("status", [
-  import_zod5.z.object({
-    status: import_zod5.z.literal("connected"),
-    connected: import_zod5.z.literal(true),
+var tradeActionToolOutputSchema = import_zod7.z.discriminatedUnion("status", [
+  import_zod7.z.object({
+    status: import_zod7.z.literal("connected"),
+    connected: import_zod7.z.literal(true),
     submission: submitTradeIntentResultSchema
   }),
   startLoginOutputSchema.extend({
-    status: import_zod5.z.literal("pending"),
-    connected: import_zod5.z.literal(false),
-    message: import_zod5.z.string()
+    status: import_zod7.z.literal("pending"),
+    connected: import_zod7.z.literal(false),
+    message: import_zod7.z.string()
   })
 ]);
-var closeTradeToolOutputSchema = import_zod5.z.discriminatedUnion("status", [
-  import_zod5.z.object({
-    status: import_zod5.z.literal("connected"),
-    connected: import_zod5.z.literal(true),
+var closeTradeToolOutputSchema = import_zod7.z.discriminatedUnion("status", [
+  import_zod7.z.object({
+    status: import_zod7.z.literal("connected"),
+    connected: import_zod7.z.literal(true),
     closure: closePositionResultSchema
   }),
   startLoginOutputSchema.extend({
-    status: import_zod5.z.literal("pending"),
-    connected: import_zod5.z.literal(false),
-    message: import_zod5.z.string()
+    status: import_zod7.z.literal("pending"),
+    connected: import_zod7.z.literal(false),
+    message: import_zod7.z.string()
   })
 ]);
-var setTpSlToolOutputSchema = import_zod5.z.discriminatedUnion("status", [
-  import_zod5.z.object({
-    status: import_zod5.z.literal("connected"),
-    connected: import_zod5.z.literal(true),
+var setTpSlToolOutputSchema = import_zod7.z.discriminatedUnion("status", [
+  import_zod7.z.object({
+    status: import_zod7.z.literal("connected"),
+    connected: import_zod7.z.literal(true),
     protection: setTpSlResultSchema
   }),
   startLoginOutputSchema.extend({
-    status: import_zod5.z.literal("pending"),
-    connected: import_zod5.z.literal(false),
-    message: import_zod5.z.string()
+    status: import_zod7.z.literal("pending"),
+    connected: import_zod7.z.literal(false),
+    message: import_zod7.z.string()
   })
 ]);
-var deleteTpSlToolOutputSchema = import_zod5.z.discriminatedUnion("status", [
-  import_zod5.z.object({
-    status: import_zod5.z.literal("connected"),
-    connected: import_zod5.z.literal(true),
+var deleteTpSlToolOutputSchema = import_zod7.z.discriminatedUnion("status", [
+  import_zod7.z.object({
+    status: import_zod7.z.literal("connected"),
+    connected: import_zod7.z.literal(true),
     deletion: deleteTpSlResultSchema
   }),
   startLoginOutputSchema.extend({
-    status: import_zod5.z.literal("pending"),
-    connected: import_zod5.z.literal(false),
-    message: import_zod5.z.string()
+    status: import_zod7.z.literal("pending"),
+    connected: import_zod7.z.literal(false),
+    message: import_zod7.z.string()
   })
 ]);
-var openOrdersToolOutputSchema = import_zod5.z.discriminatedUnion("status", [
-  import_zod5.z.object({
-    status: import_zod5.z.literal("connected"),
-    connected: import_zod5.z.literal(true),
-    orders: import_zod5.z.array(openOrderSchema)
+var openOrdersToolOutputSchema = import_zod7.z.discriminatedUnion("status", [
+  import_zod7.z.object({
+    status: import_zod7.z.literal("connected"),
+    connected: import_zod7.z.literal(true),
+    orders: import_zod7.z.array(openOrderSchema)
   }),
   startLoginOutputSchema.extend({
-    status: import_zod5.z.literal("pending"),
-    connected: import_zod5.z.literal(false),
-    message: import_zod5.z.string()
+    status: import_zod7.z.literal("pending"),
+    connected: import_zod7.z.literal(false),
+    message: import_zod7.z.string()
   })
 ]);
-var cancelOrderToolOutputSchema = import_zod5.z.discriminatedUnion("status", [
-  import_zod5.z.object({
-    status: import_zod5.z.literal("connected"),
-    connected: import_zod5.z.literal(true),
+var cancelOrderToolOutputSchema = import_zod7.z.discriminatedUnion("status", [
+  import_zod7.z.object({
+    status: import_zod7.z.literal("connected"),
+    connected: import_zod7.z.literal(true),
     cancellation: cancelOrderResultSchema
   }),
   startLoginOutputSchema.extend({
-    status: import_zod5.z.literal("pending"),
-    connected: import_zod5.z.literal(false),
-    message: import_zod5.z.string()
+    status: import_zod7.z.literal("pending"),
+    connected: import_zod7.z.literal(false),
+    message: import_zod7.z.string()
   })
 ]);
-var documentPathInputSchema = import_zod5.z.object({
-  path: import_zod5.z.string().min(1)
-});
-var docsIndexSchema = import_zod5.z.object({
-  root: import_zod5.z.literal("docs"),
-  documents: import_zod5.z.array(
-    import_zod5.z.object({
-      path: import_zod5.z.string(),
-      section: import_zod5.z.string(),
-      title: import_zod5.z.string(),
-      bytes: import_zod5.z.number().int().nonnegative()
+var documentPathInputSchema = import_zod7.z.object({
+  path: import_zod7.z.string().min(1)
+});
+var docsIndexSchema = import_zod7.z.object({
+  root: import_zod7.z.literal("docs"),
+  documents: import_zod7.z.array(
+    import_zod7.z.object({
+      path: import_zod7.z.string(),
+      section: import_zod7.z.string(),
+      title: import_zod7.z.string(),
+      bytes: import_zod7.z.number().int().nonnegative()
     })
   )
 });
-var documentSchema = import_zod5.z.object({
-  path: import_zod5.z.string(),
-  section: import_zod5.z.string(),
-  title: import_zod5.z.string(),
-  body: import_zod5.z.string(),
-  bytes: import_zod5.z.number().int().nonnegative()
+var documentSchema = import_zod7.z.object({
+  path: import_zod7.z.string(),
+  section: import_zod7.z.string(),
+  title: import_zod7.z.string(),
+  body: import_zod7.z.string(),
+  bytes: import_zod7.z.number().int().nonnegative()
 });
 function createHeliosDocsToolDefinitions(service) {
   return [
@@ -2337,7 +3515,7 @@ function createHeliosDocsToolDefinitions(service) {
       name: "helios_docs_get_index",
       title: "Get Helios Docs Index",
       description: "Lists the package-local Helios MCP and indicator .txt documentation available to the agent.",
-      inputSchema: import_zod5.z.object({}),
+      inputSchema: import_zod7.z.object({}),
       async execute() {
         const result = docsIndexSchema.parse(await service.getIndex());
         return {
@@ -2420,7 +3598,7 @@ function createHeliosAuthToolDefinitions(service) {
     {
       name: "helios_auth_poll_login",
       title: "Poll Helios Login",
-      description: "Checks whether the Helios login was approved and finishes connecting. The device code is optional; without it, the login in progress is checked.",
+      description: "Checks whether the Helios login in progress was approved and finishes connecting. No code is needed.",
       inputSchema: pollLoginInputSchema,
       async execute(input) {
         const result = pollLoginOutputSchema.parse(await service.pollLogin(input.deviceCode));
@@ -2439,7 +3617,7 @@ function createHeliosAuthToolDefinitions(service) {
       name: "helios_auth_whoami",
       title: "Helios Login Status",
       description: "Returns the delegated Helios session state currently stored by the MCP server.",
-      inputSchema: import_zod5.z.object({}),
+      inputSchema: import_zod7.z.object({}),
       async execute() {
         const result = agentSessionViewSchema.parse(await service.whoami());
         return {
@@ -2455,101 +3633,13 @@ function createHeliosAuthToolDefinitions(service) {
     }
   ];
 }
-function createHeliosProviderToolDefinitions(service) {
-  return [
-    {
-      name: "helios_provider_get_active",
-      title: "Get Helios Active Provider",
-      description: "Returns the provider currently pinned for this MCP session, if any.",
-      inputSchema: import_zod5.z.object({}),
-      async execute() {
-        const result = activeProviderSchema.parse(await service.getActiveProvider());
-        return {
-          content: [
-            {
-              type: "text",
-              text: result.configured ? `Helios active provider is ${result.provider}.` : "No Helios active provider is configured for this session."
-            }
-          ],
-          structuredContent: result
-        };
-      }
-    },
-    {
-      name: "helios_provider_set_active",
-      title: "Set Helios Active Provider",
-      description: "Pins the active provider for this MCP session so portfolio and trading tools can omit provider.",
-      inputSchema: providerSetInputSchema,
-      async execute(input) {
-        const result = activeProviderSchema.parse(await service.setActiveProvider(input.provider));
-        return {
-          content: [
-            {
-              type: "text",
-              text: `Helios active provider set to ${result.provider}.`
-            }
-          ],
-          structuredContent: result
-        };
-      }
-    }
-  ];
-}
-function createHeliosAccountToolDefinitions(service) {
-  return [
-    {
-      name: "helios_account_get_wallet_state",
-      title: "Get Helios Wallet State",
-      description: "Returns the current Hyperliquid wallet snapshot for the connected Helios account.",
-      inputSchema: import_zod5.z.object({}),
-      async execute() {
-        const result = walletStateToolOutputSchema.parse(await service.getWalletState());
-        const structuredContent = result.status === "connected" ? result : {
-          ...result,
-          ...withManualLoginFields(result)
-        };
-        return {
-          content: [
-            {
-              type: "text",
-              text: result.status === "connected" ? `Helios wallet state: available balance ${result.walletState.availableBalance}, account value ${result.walletState.accountValue}.` : result.message
-            }
-          ],
-          structuredContent
-        };
-      }
-    },
-    {
-      name: "helios_portfolio_get",
-      title: "Get Helios Portfolio",
-      description: "Returns a provider-specific portfolio snapshot. Provider may be omitted if one is already pinned with helios_provider_set_active.",
-      inputSchema: providerSelectionInputSchema,
-      async execute(input) {
-        const result = portfolioToolOutputSchema.parse(await service.getPortfolio(input));
-        const structuredContent = result.status === "connected" ? result : {
-          ...result,
-          ...withManualLoginFields(result)
-        };
-        return {
-          content: [
-            {
-              type: "text",
-              text: result.status === "connected" ? buildPortfolioText(result.portfolio) : result.message
-            }
-          ],
-          structuredContent
-        };
-      }
-    }
-  ];
-}
 function createHeliosLedgerToolDefinitions(service) {
   return [
     {
       name: "helios_positions_get_open",
       title: "Get Helios Open Positions",
       description: "Returns the current open Hyperliquid positions for the connected Helios account.",
-      inputSchema: import_zod5.z.object({}),
+      inputSchema: import_zod7.z.object({}),
       async execute() {
         const result = openPositionsToolOutputSchema.parse(await service.getOpenPositions());
         const structuredContent = result.status === "connected" ? result : {
@@ -2683,178 +3773,6 @@ function createHeliosMarketToolDefinitions(service) {
     }
   ];
 }
-function createHeliosTradingToolDefinitions(service) {
-  return [
-    {
-      name: "helios_trading_open",
-      title: "Open Helios Position",
-      description: "Submits a Helios OPEN trading intent. Provider may be omitted if one is already pinned with helios_provider_set_active.",
-      inputSchema: tradeActionInputSchema,
-      async execute(input) {
-        const result = tradeActionToolOutputSchema.parse(await service.open(input));
-        return {
-          content: [
-            {
-              type: "text",
-              text: result.status === "connected" ? `Submitted Helios OPEN intent for ${result.submission.provider ?? input.provider} ${result.submission.symbol} ${result.submission.direction} with ${result.submission.execution.style} execution.` : result.message
-            }
-          ],
-          structuredContent: result.status === "connected" ? result : {
-            ...result,
-            ...withManualLoginFields(result)
-          }
-        };
-      }
-    },
-    {
-      name: "helios_trading_dca",
-      title: "DCA Helios Position",
-      description: "Submits a Helios DCA trading intent. Provider may be omitted if one is already pinned with helios_provider_set_active.",
-      inputSchema: tradeActionInputSchema,
-      async execute(input) {
-        const result = tradeActionToolOutputSchema.parse(await service.dca(input));
-        return {
-          content: [
-            {
-              type: "text",
-              text: result.status === "connected" ? `Submitted Helios DCA intent for ${result.submission.provider ?? input.provider} ${result.submission.symbol} ${result.submission.direction} with ${result.submission.execution.style} execution.` : result.message
-            }
-          ],
-          structuredContent: result.status === "connected" ? result : {
-            ...result,
-            ...withManualLoginFields(result)
-          }
-        };
-      }
-    },
-    {
-      name: "helios_trading_reverse",
-      title: "Reverse Helios Position",
-      description: "Submits a Helios REVERSE trading intent. Provider may be omitted if one is already pinned with helios_provider_set_active.",
-      inputSchema: tradeActionInputSchema,
-      async execute(input) {
-        const result = tradeActionToolOutputSchema.parse(await service.reverse(input));
-        return {
-          content: [
-            {
-              type: "text",
-              text: result.status === "connected" ? `Submitted Helios REVERSE intent for ${result.submission.provider ?? input.provider} ${result.submission.symbol} ${result.submission.direction} with ${result.submission.execution.style} execution.` : result.message
-            }
-          ],
-          structuredContent: result.status === "connected" ? result : {
-            ...result,
-            ...withManualLoginFields(result)
-          }
-        };
-      }
-    },
-    {
-      name: "helios_trading_close",
-      title: "Close Helios Position",
-      description: "Closes the full Helios position using the dedicated backend close route. Provider may be omitted if one is already pinned with helios_provider_set_active.",
-      inputSchema: closePositionInputSchema,
-      async execute(input) {
-        const result = closeTradeToolOutputSchema.parse(await service.close(input));
-        return {
-          content: [
-            {
-              type: "text",
-              text: result.status === "connected" ? `Submitted Helios full close for ${result.closure.provider ?? input.provider} ${result.closure.symbol}.` : result.message
-            }
-          ],
-          structuredContent: result.status === "connected" ? result : {
-            ...result,
-            ...withManualLoginFields(result)
-          }
-        };
-      }
-    },
-    {
-      name: "helios_positions_set_tp_sl",
-      title: "Set Helios TP/SL",
-      description: "Creates or replaces take-profit and stop-loss protection for an existing Helios position. Provider may be omitted if one is already pinned with helios_provider_set_active.",
-      inputSchema: setTpSlInputSchema,
-      async execute(input) {
-        const result = setTpSlToolOutputSchema.parse(await service.setTpSl(input));
-        return {
-          content: [
-            {
-              type: "text",
-              text: result.status === "connected" ? `Submitted ${result.protection.provider ?? input.provider} TP/SL protection update for ${result.protection.symbol}.` : result.message
-            }
-          ],
-          structuredContent: result.status === "connected" ? result : {
-            ...result,
-            ...withManualLoginFields(result)
-          }
-        };
-      }
-    },
-    {
-      name: "helios_positions_delete_tp_sl",
-      title: "Delete Helios TP/SL",
-      description: "Deletes an existing Helios take-profit or stop-loss order by order id. Provider may be omitted if one is already pinned with helios_provider_set_active.",
-      inputSchema: deleteTpSlInputSchema,
-      async execute(input) {
-        const result = deleteTpSlToolOutputSchema.parse(await service.deleteTpSl(input));
-        return {
-          content: [
-            {
-              type: "text",
-              text: result.status === "connected" ? `Deleted ${result.deletion.provider ?? input.provider} TP/SL order ${result.deletion.orderId} for ${result.deletion.symbol}.` : result.message
-            }
-          ],
-          structuredContent: result.status === "connected" ? result : {
-            ...result,
-            ...withManualLoginFields(result)
-          }
-        };
-      }
-    },
-    {
-      name: "helios_orders_get_open",
-      title: "Get Helios Open Orders",
-      description: "Lists the currently open Hyperliquid orders for the connected account.",
-      inputSchema: import_zod5.z.object({}),
-      async execute() {
-        const result = openOrdersToolOutputSchema.parse(await service.getOpenOrders());
-        return {
-          content: [
-            {
-              type: "text",
-              text: result.status === "connected" ? `Retrieved ${result.orders.length} open Helios orders.` : result.message
-            }
-          ],
-          structuredContent: result.status === "connected" ? result : {
-            ...result,
-            ...withManualLoginFields(result)
-          }
-        };
-      }
-    },
-    {
-      name: "helios_orders_cancel",
-      title: "Cancel Helios Order",
-      description: "Cancels an open Hyperliquid order by symbol and order id.",
-      inputSchema: cancelOrderInputSchema,
-      async execute(input) {
-        const result = cancelOrderToolOutputSchema.parse(await service.cancelOrder(input));
-        return {
-          content: [
-            {
-              type: "text",
-              text: result.status === "connected" ? `Cancelled Helios order ${result.cancellation.oid} for ${result.cancellation.symbol}.` : result.message
-            }
-          ],
-          structuredContent: result.status === "connected" ? result : {
-            ...result,
-            ...withManualLoginFields(result)
-          }
-        };
-      }
-    }
-  ];
-}
 function withManualLoginFields(result) {
   return {
     actionRequired: true,
@@ -2862,9 +3780,6 @@ function withManualLoginFields(result) {
     nextStep: "Open the login URL in your browser, approve Helios access, then call helios_auth_ensure_login again to finish connecting."
   };
 }
-function buildPortfolioText(result) {
-  return `Helios Hyperliquid portfolio: ${result.positions.length} positions, available balance ${result.availableBalance}, total balance ${result.totalBalance}.`;
-}
 function buildManualLoginText(result) {
   return `Log in to Helios by opening this URL in your browser:
 
@@ -2876,6 +3791,8 @@ After approving access, call helios_auth_ensure_login (or helios_auth_poll_login
 }
 
 // src/server.ts
+var MCP_PROFILES = ["lean", "signals", "full"];
+var MAX_TOOL_INPUT_ELEMENTS = 1e4;
 async function createHeliosAgentMcpServer(options) {
   if (!options.identityServiceUrl) {
     throw new Error("identityServiceUrl is required");
@@ -2884,11 +3801,23 @@ async function createHeliosAgentMcpServer(options) {
     throw new Error("dataBridgeUrl is required");
   }
   const { McpServer } = await import("@modelcontextprotocol/sdk/server/mcp.js");
-  const server = new McpServer({
-    name: "helios",
-    version: "0.2.8"
+  const server = new McpServer(
+    {
+      name: "helios",
+      version: "0.4.0"
+    },
+    // Caps the array elements plus object keys one tools/call may carry (GHSA-46jr-4wx8-v453: without it, one request
+    // under the body size limit could run the hosted server out of memory while validating). The largest real input is
+    // a snapshot over every symbol and field, a few hundred entries, so this is far above normal use.
+    { maxToolInputElements: MAX_TOOL_INPUT_ELEMENTS }
+  );
+  if (!options.hosted) {
+    assertHeliosBaseUrl("identityServiceUrl (HELIOS_IDENTITY_SERVICE_URL)", options.identityServiceUrl);
+    assertHeliosBaseUrl("dataBridgeUrl (HELIOS_DATA_BRIDGE_URL)", options.dataBridgeUrl);
+  }
+  const sessionStore = options.sessionStore ?? new FileAgentSessionStore(options.sessionPath ?? getDefaultHeliosAgentMcpSessionPath(), {
+    issuer: { identityServiceUrl: options.identityServiceUrl, dataBridgeUrl: options.dataBridgeUrl }
   });
-  const sessionStore = options.sessionStore ?? new FileAgentSessionStore(options.sessionPath ?? getDefaultHeliosAgentMcpSessionPath());
   const client = new HeliosAgentAuthClient({
     baseUrl: options.identityServiceUrl,
     fetch: options.fetch
@@ -2927,39 +3856,29 @@ async function createHeliosAgentMcpServer(options) {
   const docsService = new HeliosAgentMcpDocsService({
     docsRoot: options.docsRoot ?? getDefaultHeliosAgentMcpDocsRoot()
   });
-  const docsTools = createHeliosDocsToolDefinitions(docsService);
-  const authTools = createHeliosAuthToolDefinitions(authService);
-  const providerTools = createHeliosProviderToolDefinitions(providerService);
-  const accountTools = createHeliosAccountToolDefinitions(accountService);
-  const ledgerTools = createHeliosLedgerToolDefinitions(ledgerService);
-  const marketTools = createHeliosMarketToolDefinitions(marketService);
-  const tradingTools = createHeliosTradingToolDefinitions(tradingService);
-  registerTool(server, docsTools[0]);
-  registerTool(server, docsTools[1]);
-  if (!options.hosted) {
-    registerTool(server, authTools[0]);
-    registerTool(server, authTools[1]);
-    registerTool(server, authTools[2]);
-  }
-  registerTool(server, authTools[3]);
-  registerTool(server, providerTools[0]);
-  registerTool(server, providerTools[1]);
-  registerTool(server, accountTools[0]);
-  registerTool(server, accountTools[1]);
-  registerTool(server, ledgerTools[0]);
-  registerTool(server, ledgerTools[1]);
-  registerTool(server, ledgerTools[2]);
-  registerTool(server, marketTools[0]);
-  registerTool(server, marketTools[1]);
-  registerTool(server, marketTools[2]);
-  registerTool(server, tradingTools[0]);
-  registerTool(server, tradingTools[1]);
-  registerTool(server, tradingTools[2]);
-  registerTool(server, tradingTools[3]);
-  registerTool(server, tradingTools[4]);
-  registerTool(server, tradingTools[5]);
-  registerTool(server, tradingTools[6]);
-  registerTool(server, tradingTools[7]);
+  const profile = options.profile ?? "full";
+  const lean = createLeanToolDefinitions({ auth: authService, dataBridge: dataBridgeClient });
+  for (const tool of leanToolsFor(lean, profile)) {
+    registerTool(server, { ...tool, textIsResult: true });
+  }
+  if (profile === "full") {
+    const docsTools = createHeliosDocsToolDefinitions(docsService);
+    const authTools = createHeliosAuthToolDefinitions(authService);
+    const ledgerTools = createHeliosLedgerToolDefinitions(ledgerService);
+    const marketTools = createHeliosMarketToolDefinitions(marketService);
+    if (!options.hosted) {
+      registerTool(server, authTools[0]);
+      registerTool(server, authTools[1]);
+      registerTool(server, authTools[2]);
+    }
+    registerTool(server, authTools[3]);
+    registerTool(server, marketTools[0]);
+    registerTool(server, marketTools[1]);
+    registerTool(server, marketTools[2]);
+    registerTool(server, ledgerTools[1]);
+    registerTool(server, docsTools[0]);
+    registerTool(server, docsTools[1]);
+  }
   return {
     server,
     authService,
@@ -2973,9 +3892,10 @@ async function createHeliosAgentMcpServer(options) {
   };
 }
 var ACTS_ON_ACCOUNT = /^helios_(trading_|positions_set_tp_sl|positions_delete_tp_sl|orders_cancel)/;
+var LEAN_ACTS = /* @__PURE__ */ new Set(["trade", "protect"]);
 var CHANGES_SESSION = /^helios_(auth_start_login|auth_ensure_login|auth_poll_login|provider_set_active)$/;
 function toolAnnotations(name) {
-  if (ACTS_ON_ACCOUNT.test(name)) return { readOnlyHint: false, destructiveHint: true, openWorldHint: true };
+  if (ACTS_ON_ACCOUNT.test(name) || LEAN_ACTS.has(name)) return { readOnlyHint: false, destructiveHint: true, openWorldHint: true };
   if (CHANGES_SESSION.test(name)) return { readOnlyHint: false, destructiveHint: false, openWorldHint: false };
   return { readOnlyHint: true, destructiveHint: false, openWorldHint: true };
 }
@@ -2999,7 +3919,7 @@ function registerTool(server, tool) {
     async (input) => {
       const result = await tool.execute(tool.inputSchema.parse(input));
       return {
-        content: withDataText(tool.name, result.content, result.structuredContent),
+        content: tool.textIsResult ? result.content : withDataText(tool.name, result.content, result.structuredContent),
         structuredContent: result.structuredContent
       };
     }
@@ -3008,13 +3928,15 @@ function registerTool(server, tool) {
 
 // src/cli.ts
 async function main() {
-  const identityServiceUrl = process.env.HELIOS_IDENTITY_SERVICE_URL || "https://helios.pgn.io";
-  const dataBridgeUrl = process.env.HELIOS_DATA_BRIDGE_URL || "https://helios.pgn.io";
+  const identityServiceUrl = process.env.HELIOS_IDENTITY_SERVICE_URL || DEFAULT_HELIOS_BASE_URL;
+  const dataBridgeUrl = process.env.HELIOS_DATA_BRIDGE_URL || DEFAULT_HELIOS_BASE_URL;
   const { StdioServerTransport } = await import("@modelcontextprotocol/sdk/server/stdio.js");
   const { server } = await createHeliosAgentMcpServer({
     identityServiceUrl,
     dataBridgeUrl,
-    sessionPath: process.env.HELIOS_AGENT_MCP_SESSION_PATH
+    sessionPath: process.env.HELIOS_AGENT_MCP_SESSION_PATH,
+    // lean (default): smart money first, short answers for small models; full adds candles and every indicator.
+    profile: MCP_PROFILES.includes(process.env.HELIOS_MCP_PROFILE) ? process.env.HELIOS_MCP_PROFILE : "lean"
   });
   const transport = new StdioServerTransport();
   await server.connect(transport);