@wlfi-agent/cli 1.4.13 → 1.4.14

package/crates/vault-cli-admin/src/tui.rs

@@ -0,0 +1,3410 @@
+use std::collections::{BTreeMap, BTreeSet};
+use std::io;
+use std::path::PathBuf;
+use std::time::Duration;
+
+use anyhow::{anyhow, bail, Context, Result};
+use crossterm::event::{self, Event, KeyCode, KeyEvent, KeyEventKind, KeyModifiers};
+use crossterm::execute;
+use crossterm::terminal::{
+    disable_raw_mode, enable_raw_mode, EnterAlternateScreen, LeaveAlternateScreen,
+};
+use ratatui::backend::CrosstermBackend;
+use ratatui::layout::{Constraint, Direction, Layout};
+use ratatui::style::{Color, Modifier, Style};
+use ratatui::text::{Line, Span};
+use ratatui::widgets::{Block, Borders, List, ListItem, Paragraph, Wrap};
+use ratatui::Terminal;
+use uuid::Uuid;
+use vault_domain::EvmAddress;
+
+use crate::shared_config::{
+    ChainProfile, LoadedConfig, TokenChainProfile, TokenDestinationOverrideProfile,
+    TokenManualApprovalProfile, TokenPolicyProfile, TokenProfile, WlfiConfig,
+};
+use crate::{
+    BootstrapParams, TokenDestinationPolicyOverride, TokenManualApprovalPolicyConfig,
+    TokenPolicyConfig,
+};
+
+mod amounts;
+mod token_rpc;
+mod utils;
+
+use amounts::{
+    format_gwei_amount, format_token_amount, parse_legacy_amount, parse_optional_gwei_amount,
+    parse_required_token_amount,
+};
+use token_rpc::fetch_token_metadata;
+use utils::*;
+
+fn fetch_token_metadata_sync(
+    chain_key: String,
+    rpc_url: String,
+    expected_chain_id: u64,
+    is_native: bool,
+    address: Option<EvmAddress>,
+) -> Result<token_rpc::FetchedTokenMetadata> {
+    std::thread::spawn(move || -> Result<token_rpc::FetchedTokenMetadata> {
+        let runtime = tokio::runtime::Builder::new_current_thread()
+            .enable_all()
+            .build()
+            .context("failed to create runtime for token metadata refresh")?;
+        runtime.block_on(async move {
+            fetch_token_metadata(
+                &chain_key,
+                &rpc_url,
+                expected_chain_id,
+                is_native,
+                address.as_ref(),
+            )
+            .await
+        })
+    })
+    .join()
+    .map_err(|panic| {
+        let payload = if let Some(message) = panic.downcast_ref::<&str>() {
+            *message
+        } else if let Some(message) = panic.downcast_ref::<String>() {
+            message.as_str()
+        } else {
+            "unknown panic"
+        };
+        anyhow!("token metadata refresh thread panicked: {payload}")
+    })?
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum View {
+    Tokens,
+    Networks,
+    Bootstrap,
+}
+
+impl View {
+    const ALL: [Self; 3] = [Self::Tokens, Self::Networks, Self::Bootstrap];
+
+    fn title(self) -> &'static str {
+        match self {
+            Self::Tokens => "Tokens",
+            Self::Networks => "Networks",
+            Self::Bootstrap => "Bootstrap",
+        }
+    }
+
+    fn description(self) -> &'static str {
+        match self {
+            Self::Tokens => {
+                "Saved tokens are the source of truth. Each token owns its default limits, destination overrides, manual approvals, and network mappings."
+            }
+            Self::Networks => {
+                "Saved networks provide the RPC endpoints and chain ids used for token metadata inference and policy expansion."
+            }
+            Self::Bootstrap => {
+                "Review the saved token inventory and bootstrap all configured token policies in one run."
+            }
+        }
+    }
+
+    fn next(self) -> Self {
+        match self {
+            Self::Tokens => Self::Networks,
+            Self::Networks => Self::Bootstrap,
+            Self::Bootstrap => Self::Tokens,
+        }
+    }
+
+    fn previous(self) -> Self {
+        match self {
+            Self::Tokens => Self::Bootstrap,
+            Self::Networks => Self::Tokens,
+            Self::Bootstrap => Self::Networks,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum Field {
+    SelectedToken,
+    TokenKey,
+    TokenName,
+    TokenSymbol,
+    NetworkMembership,
+    EditingNetwork,
+    NetworkIsNative,
+    NetworkAddress,
+    RefreshTokenMetadata,
+    TokenDecimals,
+    PerTxLimit,
+    DailyLimit,
+    WeeklyLimit,
+    ShowAdvanced,
+    MaxGasPerChainWei,
+    DailyMaxTxCount,
+    PerTxMaxFeePerGasGwei,
+    PerTxMaxPriorityFeePerGasWei,
+    PerTxMaxCalldataBytes,
+    DestinationOverrides,
+    SelectedDestinationOverride,
+    OverrideRecipientAddress,
+    OverridePerTxLimit,
+    OverrideDailyLimit,
+    OverrideWeeklyLimit,
+    OverrideMaxGasPerChainWei,
+    OverrideDailyMaxTxCount,
+    OverridePerTxMaxFeePerGasGwei,
+    OverridePerTxMaxPriorityFeePerGasWei,
+    OverridePerTxMaxCalldataBytes,
+    DeleteDestinationOverride,
+    ManualApprovals,
+    SelectedManualApproval,
+    ManualApprovalRecipientAddress,
+    ManualApprovalMinAmount,
+    ManualApprovalMaxAmount,
+    ManualApprovalPriority,
+    DeleteManualApproval,
+    SaveToken,
+    DeleteToken,
+    SelectedNetwork,
+    ChainConfigKey,
+    ChainConfigId,
+    ChainConfigName,
+    ChainConfigRpcUrl,
+    ChainConfigUseAsActive,
+    SaveNetwork,
+    DeleteNetwork,
+    Execute,
+}
+
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+struct LimitDraft {
+    per_tx_limit: String,
+    daily_limit: String,
+    weekly_limit: String,
+    max_gas_per_chain_wei: String,
+    daily_max_tx_count: String,
+    per_tx_max_fee_per_gas_gwei: String,
+    per_tx_max_priority_fee_per_gas_wei: String,
+    per_tx_max_calldata_bytes: String,
+}
+
+impl LimitDraft {
+    fn empty() -> Self {
+        Self {
+            per_tx_limit: String::new(),
+            daily_limit: String::new(),
+            weekly_limit: String::new(),
+            max_gas_per_chain_wei: String::new(),
+            daily_max_tx_count: String::new(),
+            per_tx_max_fee_per_gas_gwei: String::new(),
+            per_tx_max_priority_fee_per_gas_wei: String::new(),
+            per_tx_max_calldata_bytes: String::new(),
+        }
+    }
+
+    fn from_policy(policy: Option<&TokenPolicyProfile>, decimals: u8) -> Self {
+        let Some(policy) = policy else {
+            return Self::empty();
+        };
+
+        Self {
+            per_tx_limit: display_policy_amount(
+                policy.per_tx_amount_decimal.as_deref(),
+                policy.per_tx_limit.as_deref(),
+                policy.per_tx_amount,
+                decimals,
+            )
+            .unwrap_or_default(),
+            daily_limit: display_policy_amount(
+                policy.daily_amount_decimal.as_deref(),
+                policy.daily_limit.as_deref(),
+                policy.daily_amount,
+                decimals,
+            )
+            .unwrap_or_default(),
+            weekly_limit: display_policy_amount(
+                policy.weekly_amount_decimal.as_deref(),
+                policy.weekly_limit.as_deref(),
+                policy.weekly_amount,
+                decimals,
+            )
+            .unwrap_or_default(),
+            max_gas_per_chain_wei: policy.max_gas_per_chain_wei.clone().unwrap_or_default(),
+            daily_max_tx_count: policy.daily_max_tx_count.clone().unwrap_or_default(),
+            per_tx_max_fee_per_gas_gwei: display_policy_gwei(
+                policy.per_tx_max_fee_per_gas_gwei.as_deref(),
+                policy.per_tx_max_fee_per_gas_wei.as_deref(),
+            )
+            .unwrap_or_default(),
+            per_tx_max_priority_fee_per_gas_wei: policy
+                .per_tx_max_priority_fee_per_gas_wei
+                .clone()
+                .unwrap_or_default(),
+            per_tx_max_calldata_bytes: policy.per_tx_max_calldata_bytes.clone().unwrap_or_default(),
+        }
+    }
+
+    fn as_token_level_policy(&self, validation_decimals: u8) -> Result<TokenPolicyProfile> {
+        validate_limit_draft(self, validation_decimals)?;
+
+        let per_tx_max_fee_per_gas_wei =
+            parse_optional_gwei_amount("max fee per gas", Some(&self.per_tx_max_fee_per_gas_gwei))?;
+        let daily_max_tx_count =
+            parse_optional_non_negative_u128("daily max tx count", &self.daily_max_tx_count)?;
+        let per_tx_max_priority_fee_per_gas_wei = parse_optional_non_negative_u128(
+            "max priority fee per gas",
+            &self.per_tx_max_priority_fee_per_gas_wei,
+        )?;
+        let per_tx_max_calldata_bytes = parse_optional_non_negative_u128(
+            "max calldata bytes",
+            &self.per_tx_max_calldata_bytes,
+        )?;
+
+        Ok(TokenPolicyProfile {
+            per_tx_amount: None,
+            daily_amount: None,
+            weekly_amount: None,
+            per_tx_amount_decimal: Some(self.per_tx_limit.trim().to_string()),
+            daily_amount_decimal: Some(self.daily_limit.trim().to_string()),
+            weekly_amount_decimal: Some(self.weekly_limit.trim().to_string()),
+            per_tx_limit: None,
+            daily_limit: None,
+            weekly_limit: None,
+            max_gas_per_chain_wei: optional_trimmed(&self.max_gas_per_chain_wei),
+            daily_max_tx_count: optional_non_zero_string(daily_max_tx_count),
+            per_tx_max_fee_per_gas_gwei: (per_tx_max_fee_per_gas_wei > 0)
+                .then(|| self.per_tx_max_fee_per_gas_gwei.trim().to_string()),
+            per_tx_max_fee_per_gas_wei: optional_non_zero_string(per_tx_max_fee_per_gas_wei),
+            per_tx_max_priority_fee_per_gas_wei: optional_non_zero_string(
+                per_tx_max_priority_fee_per_gas_wei,
+            ),
+            per_tx_max_calldata_bytes: optional_non_zero_string(per_tx_max_calldata_bytes),
+            extra: BTreeMap::new(),
+        })
+    }
+
+    fn as_chain_policy(&self, decimals: u8) -> Result<TokenPolicyProfile> {
+        let mut policy = self.as_token_level_policy(decimals)?;
+        policy.per_tx_limit = Some(
+            parse_required_token_amount("per-tx limit", &self.per_tx_limit, decimals)?.to_string(),
+        );
+        policy.daily_limit = Some(
+            parse_required_token_amount("daily limit", &self.daily_limit, decimals)?.to_string(),
+        );
+        policy.weekly_limit = Some(
+            parse_required_token_amount("weekly limit", &self.weekly_limit, decimals)?.to_string(),
+        );
+        Ok(policy)
+    }
+}
+
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+struct TokenNetworkDraft {
+    chain_key: String,
+    chain_id: String,
+    is_native: bool,
+    address: String,
+    decimals: String,
+}
+
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+struct DestinationOverrideDraft {
+    recipient_address: String,
+    limits: LimitDraft,
+}
+
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+struct ManualApprovalDraft {
+    recipient_address: String,
+    min_amount: String,
+    max_amount: String,
+    priority: String,
+}
+
+#[derive(Debug, Clone, Default)]
+struct TokenDraft {
+    source_key: Option<String>,
+    key: String,
+    name: String,
+    symbol: String,
+    limits: LimitDraft,
+    networks: Vec<TokenNetworkDraft>,
+    selected_network: usize,
+    available_network_index: usize,
+    destination_overrides: Vec<DestinationOverrideDraft>,
+    selected_override: usize,
+    manual_approvals: Vec<ManualApprovalDraft>,
+    selected_manual_approval: usize,
+}
+
+impl TokenDraft {
+    fn blank(config: &WlfiConfig) -> Self {
+        let mut draft = Self {
+            limits: LimitDraft::empty(),
+            ..Self::default()
+        };
+        if !config.chains.is_empty() {
+            draft.available_network_index = 0;
+        }
+        draft
+    }
+
+    fn from_profile(token_key: &str, profile: &TokenProfile, config: &WlfiConfig) -> Self {
+        let mut networks = profile
+            .chains
+            .iter()
+            .map(|(chain_key, chain_profile)| TokenNetworkDraft {
+                chain_key: chain_key.clone(),
+                chain_id: chain_profile.chain_id.to_string(),
+                is_native: chain_profile.is_native,
+                address: chain_profile.address.clone().unwrap_or_default(),
+                decimals: chain_profile.decimals.to_string(),
+            })
+            .collect::<Vec<_>>();
+        networks.sort_by(|left, right| left.chain_key.cmp(&right.chain_key));
+
+        let selected_decimals = networks
+            .first()
+            .and_then(|network| network.decimals.parse::<u8>().ok())
+            .unwrap_or(18);
+        let policy = profile
+            .default_policy
+            .as_ref()
+            .or_else(|| first_chain_policy(profile));
+        let destination_overrides = profile
+            .destination_overrides
+            .iter()
+            .map(|override_profile| DestinationOverrideDraft {
+                recipient_address: override_profile.recipient.clone(),
+                limits: LimitDraft::from_policy(Some(&override_profile.limits), selected_decimals),
+            })
+            .collect::<Vec<_>>();
+        let manual_approvals = profile
+            .manual_approval_policies
+            .iter()
+            .map(|manual| ManualApprovalDraft {
+                recipient_address: manual.recipient.clone().unwrap_or_default(),
+                min_amount: display_manual_amount(
+                    manual.min_amount_decimal.as_deref(),
+                    manual.min_amount_wei.as_deref(),
+                    manual.min_amount,
+                    selected_decimals,
+                )
+                .unwrap_or_default(),
+                max_amount: display_manual_amount(
+                    manual.max_amount_decimal.as_deref(),
+                    manual.max_amount_wei.as_deref(),
+                    manual.max_amount,
+                    selected_decimals,
+                )
+                .unwrap_or_default(),
+                priority: if manual.priority == 0 {
+                    "100".to_string()
+                } else {
+                    manual.priority.to_string()
+                },
+            })
+            .collect::<Vec<_>>();
+
+        let available_network_index = sorted_chain_keys(config)
+            .iter()
+            .position(|chain_key| {
+                networks
+                    .first()
+                    .map(|network| &network.chain_key == chain_key)
+                    .unwrap_or(false)
+            })
+            .unwrap_or(0);
+
+        Self {
+            source_key: Some(token_key.to_string()),
+            key: token_key.to_string(),
+            name: profile.name.clone().unwrap_or_default(),
+            symbol: profile.symbol.clone(),
+            limits: LimitDraft::from_policy(policy, selected_decimals),
+            networks,
+            selected_network: 0,
+            available_network_index,
+            destination_overrides,
+            selected_override: 0,
+            manual_approvals,
+            selected_manual_approval: 0,
+        }
+    }
+
+    fn selected_network(&self) -> Option<&TokenNetworkDraft> {
+        self.networks.get(self.selected_network)
+    }
+
+    fn selected_network_mut(&mut self) -> Option<&mut TokenNetworkDraft> {
+        self.networks.get_mut(self.selected_network)
+    }
+
+    fn min_network_decimals(&self) -> Result<u8> {
+        let mut decimals = self
+            .networks
+            .iter()
+            .map(|network| {
+                parse_positive_u64("token network decimals", &network.decimals).and_then(|value| {
+                    if value > u8::MAX as u64 {
+                        bail!("token network decimals must be <= {}", u8::MAX);
+                    }
+                    Ok(value as u8)
+                })
+            })
+            .collect::<Result<Vec<_>>>()?;
+        decimals.sort_unstable();
+        decimals
+            .into_iter()
+            .next()
+            .context("select at least one network for the token")
+    }
+
+    fn normalize(&mut self) {
+        if self.networks.is_empty() {
+            self.selected_network = 0;
+        } else if self.selected_network >= self.networks.len() {
+            self.selected_network = self.networks.len() - 1;
+        }
+        if self.destination_overrides.is_empty() {
+            self.selected_override = 0;
+        } else if self.selected_override >= self.destination_overrides.len() {
+            self.selected_override = self.destination_overrides.len() - 1;
+        }
+        if self.manual_approvals.is_empty() {
+            self.selected_manual_approval = 0;
+        } else if self.selected_manual_approval >= self.manual_approvals.len() {
+            self.selected_manual_approval = self.manual_approvals.len() - 1;
+        }
+    }
+
+    fn toggle_network_membership(&mut self, config: &WlfiConfig) -> Result<()> {
+        let available = sorted_chain_keys(config);
+        let Some(chain_key) = available.get(self.available_network_index) else {
+            bail!("save a network before adding it to a token");
+        };
+        if let Some(index) = self
+            .networks
+            .iter()
+            .position(|network| network.chain_key == *chain_key)
+        {
+            self.networks.remove(index);
+            self.normalize();
+            return Ok(());
+        }
+
+        let chain_profile = config
+            .chains
+            .get(chain_key)
+            .with_context(|| format!("saved network '{}' no longer exists", chain_key))?;
+        self.networks.push(TokenNetworkDraft {
+            chain_key: chain_key.clone(),
+            chain_id: chain_profile.chain_id.to_string(),
+            is_native: false,
+            address: String::new(),
+            decimals: String::new(),
+        });
+        self.networks
+            .sort_by(|left, right| left.chain_key.cmp(&right.chain_key));
+        self.selected_network = self
+            .networks
+            .iter()
+            .position(|network| network.chain_key == *chain_key)
+            .unwrap_or(0);
+        Ok(())
+    }
+
+    fn to_profile(&self, config: &WlfiConfig) -> Result<(Option<String>, String, TokenProfile)> {
+        let token_key = self.key.trim().to_lowercase();
+        if token_key.is_empty() {
+            bail!("token key is required");
+        }
+        if self.name.trim().is_empty() {
+            bail!("fetch token metadata before saving the token");
+        }
+        if self.symbol.trim().is_empty() {
+            bail!("fetch token metadata before saving the token");
+        }
+        if self.networks.is_empty() {
+            bail!("select at least one network for the token");
+        }
+
+        let validation_decimals = self.min_network_decimals()?;
+        let default_policy = Some(self.limits.as_token_level_policy(validation_decimals)?);
+
+        let mut chains = BTreeMap::new();
+        for network in &self.networks {
+            let chain_key = network.chain_key.trim().to_lowercase();
+            let chain_profile = config
+                .chains
+                .get(&chain_key)
+                .with_context(|| format!("unknown saved network '{}'", chain_key))?;
+            let decimals = parse_positive_u64(
+                &format!("token '{}:{}' decimals", token_key, chain_key),
+                &network.decimals,
+            )?;
+            if decimals > u8::MAX as u64 {
+                bail!(
+                    "token '{}:{}' decimals must be <= {}",
+                    token_key,
+                    chain_key,
+                    u8::MAX
+                );
+            }
+            let is_native = network.is_native;
+            let address = if is_native {
+                if !network.address.trim().is_empty() {
+                    bail!(
+                        "token '{}:{}' must not set an address when native",
+                        token_key,
+                        chain_key
+                    );
+                }
+                None
+            } else {
+                Some(
+                    parse_address(
+                        &format!("token '{}:{}'", token_key, chain_key),
+                        &network.address,
+                    )?
+                    .to_string(),
+                )
+            };
+            chains.insert(
+                chain_key.clone(),
+                TokenChainProfile {
+                    chain_id: chain_profile.chain_id,
+                    is_native,
+                    address,
+                    decimals: decimals as u8,
+                    default_policy: Some(self.limits.as_chain_policy(decimals as u8)?),
+                    extra: BTreeMap::new(),
+                },
+            );
+        }
+
+        let destination_overrides = self
+            .destination_overrides
+            .iter()
+            .map(|override_draft| {
+                Ok(TokenDestinationOverrideProfile {
+                    recipient: parse_address(
+                        "destination override recipient",
+                        &override_draft.recipient_address,
+                    )?
+                    .to_string(),
+                    limits: override_draft
+                        .limits
+                        .as_token_level_policy(validation_decimals)?,
+                })
+            })
+            .collect::<Result<Vec<_>>>()?;
+
+        let manual_approval_policies = self
+            .manual_approvals
+            .iter()
+            .map(|manual_draft| {
+                let priority =
+                    parse_positive_u64("manual approval priority", &manual_draft.priority)?;
+                if priority > u32::MAX as u64 {
+                    bail!("manual approval priority must be <= {}", u32::MAX);
+                }
+                parse_required_token_amount(
+                    "manual approval min amount",
+                    &manual_draft.min_amount,
+                    validation_decimals,
+                )?;
+                parse_required_token_amount(
+                    "manual approval max amount",
+                    &manual_draft.max_amount,
+                    validation_decimals,
+                )?;
+                Ok(TokenManualApprovalProfile {
+                    priority: priority as u32,
+                    recipient: if manual_draft.recipient_address.trim().is_empty() {
+                        None
+                    } else {
+                        Some(
+                            parse_address(
+                                "manual approval recipient",
+                                &manual_draft.recipient_address,
+                            )?
+                            .to_string(),
+                        )
+                    },
+                    min_amount: None,
+                    max_amount: None,
+                    min_amount_decimal: Some(manual_draft.min_amount.trim().to_string()),
+                    max_amount_decimal: Some(manual_draft.max_amount.trim().to_string()),
+                    min_amount_wei: None,
+                    max_amount_wei: None,
+                    extra: BTreeMap::new(),
+                })
+            })
+            .collect::<Result<Vec<_>>>()?;
+
+        Ok((
+            self.source_key.clone(),
+            token_key,
+            TokenProfile {
+                name: Some(self.name.trim().to_string()),
+                symbol: self.symbol.trim().to_string(),
+                default_policy,
+                destination_overrides,
+                manual_approval_policies,
+                chains,
+                extra: BTreeMap::new(),
+            },
+        ))
+    }
+}
+
+#[derive(Debug, Clone, Default)]
+struct NetworkDraft {
+    source_key: Option<String>,
+    key: String,
+    chain_id: String,
+    name: String,
+    rpc_url: String,
+    use_as_active: bool,
+}
+
+impl NetworkDraft {
+    fn blank() -> Self {
+        Self::default()
+    }
+
+    fn from_profile(key: &str, profile: &ChainProfile, config: &WlfiConfig) -> Self {
+        Self {
+            source_key: Some(key.to_string()),
+            key: key.to_string(),
+            chain_id: profile.chain_id.to_string(),
+            name: profile.name.clone(),
+            rpc_url: profile.rpc_url.clone().unwrap_or_default(),
+            use_as_active: config.chain_name.as_deref() == Some(key)
+                || config.chain_id == Some(profile.chain_id),
+        }
+    }
+
+    fn to_profile(&self) -> Result<(Option<String>, String, ChainProfile, bool)> {
+        let key = self.key.trim().to_lowercase();
+        if key.is_empty() {
+            bail!("network key is required");
+        }
+        let chain_id = parse_positive_u64("network chain id", &self.chain_id)?;
+        let name = if self.name.trim().is_empty() {
+            key.clone()
+        } else {
+            self.name.trim().to_string()
+        };
+        let rpc_url = if self.rpc_url.trim().is_empty() {
+            None
+        } else {
+            Some(self.rpc_url.trim().to_string())
+        };
+        Ok((
+            self.source_key.clone(),
+            key,
+            ChainProfile {
+                chain_id,
+                name,
+                rpc_url,
+                extra: BTreeMap::new(),
+            },
+            self.use_as_active,
+        ))
+    }
+}
+
+#[derive(Debug)]
+struct AppState {
+    view: View,
+    selected: usize,
+    config_path: PathBuf,
+    shared_config_draft: WlfiConfig,
+    token_draft: TokenDraft,
+    network_draft: NetworkDraft,
+    show_advanced: bool,
+    print_agent_auth_token: bool,
+    message: Option<String>,
+}
+
+impl AppState {
+    fn from_shared_config(config: &WlfiConfig, print_agent_auth_token: bool) -> Self {
+        let token_draft = sorted_token_keys(config)
+            .first()
+            .and_then(|token_key| {
+                config
+                    .tokens
+                    .get(token_key)
+                    .map(|profile| TokenDraft::from_profile(token_key, profile, config))
+            })
+            .unwrap_or_else(|| TokenDraft::blank(config));
+        let network_draft = sorted_chain_keys(config)
+            .first()
+            .and_then(|chain_key| {
+                config
+                    .chains
+                    .get(chain_key)
+                    .map(|profile| NetworkDraft::from_profile(chain_key, profile, config))
+            })
+            .unwrap_or_else(NetworkDraft::blank);
+
+        Self {
+            view: View::Tokens,
+            selected: 0,
+            config_path: crate::shared_config::default_config_path()
+                .unwrap_or_else(|_| PathBuf::from("config.json")),
+            shared_config_draft: config.clone(),
+            token_draft,
+            network_draft,
+            show_advanced: false,
+            print_agent_auth_token,
+            message: None,
+        }
+    }
+
+    fn visible_fields(&self) -> Vec<Field> {
+        match self.view {
+            View::Tokens => {
+                let mut fields = vec![
+                    Field::SelectedToken,
+                    Field::TokenKey,
+                    Field::TokenName,
+                    Field::TokenSymbol,
+                    Field::NetworkMembership,
+                ];
+                if !self.token_draft.networks.is_empty() {
+                    fields.extend([
+                        Field::EditingNetwork,
+                        Field::NetworkIsNative,
+                        Field::NetworkAddress,
+                        Field::RefreshTokenMetadata,
+                        Field::TokenDecimals,
+                    ]);
+                }
+                fields.extend([
+                    Field::PerTxLimit,
+                    Field::DailyLimit,
+                    Field::WeeklyLimit,
+                    Field::ShowAdvanced,
+                    Field::DestinationOverrides,
+                ]);
+                if self.show_advanced {
+                    fields.extend([
+                        Field::MaxGasPerChainWei,
+                        Field::DailyMaxTxCount,
+                        Field::PerTxMaxFeePerGasGwei,
+                        Field::PerTxMaxPriorityFeePerGasWei,
+                        Field::PerTxMaxCalldataBytes,
+                    ]);
+                }
+                if !self.token_draft.destination_overrides.is_empty() {
+                    fields.extend([
+                        Field::SelectedDestinationOverride,
+                        Field::OverrideRecipientAddress,
+                        Field::OverridePerTxLimit,
+                        Field::OverrideDailyLimit,
+                        Field::OverrideWeeklyLimit,
+                        Field::DeleteDestinationOverride,
+                    ]);
+                    if self.show_advanced {
+                        fields.extend([
+                            Field::OverrideMaxGasPerChainWei,
+                            Field::OverrideDailyMaxTxCount,
+                            Field::OverridePerTxMaxFeePerGasGwei,
+                            Field::OverridePerTxMaxPriorityFeePerGasWei,
+                            Field::OverridePerTxMaxCalldataBytes,
+                        ]);
+                    }
+                }
+                fields.push(Field::ManualApprovals);
+                if !self.token_draft.manual_approvals.is_empty() {
+                    fields.extend([
+                        Field::SelectedManualApproval,
+                        Field::ManualApprovalRecipientAddress,
+                        Field::ManualApprovalMinAmount,
+                        Field::ManualApprovalMaxAmount,
+                        Field::ManualApprovalPriority,
+                        Field::DeleteManualApproval,
+                    ]);
+                }
+                fields.extend([Field::SaveToken, Field::DeleteToken]);
+                fields
+            }
+            View::Networks => vec![
+                Field::SelectedNetwork,
+                Field::ChainConfigKey,
+                Field::ChainConfigId,
+                Field::ChainConfigName,
+                Field::ChainConfigRpcUrl,
+                Field::ChainConfigUseAsActive,
+                Field::SaveNetwork,
+                Field::DeleteNetwork,
+            ],
+            View::Bootstrap => vec![Field::Execute],
+        }
+    }
+
+    fn normalize_selection(&mut self) {
+        let len = self.visible_fields().len();
+        if len == 0 {
+            self.selected = 0;
+        } else if self.selected >= len {
+            self.selected = len - 1;
+        }
+        self.token_draft.normalize();
+    }
+
+    fn selected_field(&self) -> Field {
+        self.visible_fields()[self.selected]
+    }
+
+    fn next_view(&mut self) {
+        self.view = self.view.next();
+        self.selected = 0;
+        self.message = None;
+        self.normalize_selection();
+    }
+
+    fn previous_view(&mut self) {
+        self.view = self.view.previous();
+        self.selected = 0;
+        self.message = None;
+        self.normalize_selection();
+    }
+
+    fn select_next(&mut self) {
+        let len = self.visible_fields().len();
+        if len > 0 {
+            self.selected = (self.selected + 1) % len;
+        }
+    }
+
+    fn select_prev(&mut self) {
+        let len = self.visible_fields().len();
+        if len > 0 {
+            self.selected = if self.selected == 0 {
+                len - 1
+            } else {
+                self.selected - 1
+            };
+        }
+    }
+
+    fn reload_current_view(&mut self) {
+        match self.view {
+            View::Tokens => {
+                let source_key = self.token_draft.source_key.clone();
+                self.load_token_draft(source_key.as_deref());
+            }
+            View::Networks => {
+                let source_key = self.network_draft.source_key.clone();
+                self.load_network_draft(source_key.as_deref());
+            }
+            View::Bootstrap => {}
+        }
+    }
+
+    fn load_token_draft(&mut self, token_key: Option<&str>) {
+        self.token_draft = token_key
+            .and_then(|token_key| {
+                self.shared_config_draft
+                    .tokens
+                    .get(token_key)
+                    .map(|profile| {
+                        TokenDraft::from_profile(token_key, profile, &self.shared_config_draft)
+                    })
+            })
+            .or_else(|| {
+                sorted_token_keys(&self.shared_config_draft)
+                    .first()
+                    .and_then(|token_key| {
+                        self.shared_config_draft
+                            .tokens
+                            .get(token_key)
+                            .map(|profile| {
+                                TokenDraft::from_profile(
+                                    token_key,
+                                    profile,
+                                    &self.shared_config_draft,
+                                )
+                            })
+                    })
+            })
+            .unwrap_or_else(|| TokenDraft::blank(&self.shared_config_draft));
+        self.normalize_selection();
+    }
+
+    fn load_network_draft(&mut self, chain_key: Option<&str>) {
+        self.network_draft = chain_key
+            .and_then(|chain_key| {
+                self.shared_config_draft
+                    .chains
+                    .get(chain_key)
+                    .map(|profile| {
+                        NetworkDraft::from_profile(chain_key, profile, &self.shared_config_draft)
+                    })
+            })
+            .or_else(|| {
+                sorted_chain_keys(&self.shared_config_draft)
+                    .first()
+                    .and_then(|chain_key| {
+                        self.shared_config_draft
+                            .chains
+                            .get(chain_key)
+                            .map(|profile| {
+                                NetworkDraft::from_profile(
+                                    chain_key,
+                                    profile,
+                                    &self.shared_config_draft,
+                                )
+                            })
+                    })
+            })
+            .unwrap_or_else(NetworkDraft::blank);
+        self.normalize_selection();
+    }
+
+    fn new_token_draft(&mut self) {
+        self.token_draft = TokenDraft::blank(&self.shared_config_draft);
+        self.message = Some("new token draft ready".to_string());
+    }
+
+    fn new_network_draft(&mut self) {
+        self.network_draft = NetworkDraft::blank();
+        self.message = Some("new network draft ready".to_string());
+    }
+
+    fn step_selected(&mut self, direction: i8) {
+        match self.selected_field() {
+            Field::SelectedToken => self.cycle_saved_token(direction),
+            Field::NetworkMembership => self.cycle_available_network(direction),
+            Field::EditingNetwork => self.cycle_selected_network_mapping(direction),
+            Field::NetworkIsNative => {
+                if let Some(network) = self.token_draft.selected_network_mut() {
+                    network.is_native = !network.is_native;
+                    if network.is_native {
+                        network.address.clear();
+                    }
+                }
+            }
+            Field::SelectedDestinationOverride => {
+                cycle_index(
+                    &mut self.token_draft.selected_override,
+                    self.token_draft.destination_overrides.len(),
+                    direction,
+                );
+            }
+            Field::SelectedManualApproval => {
+                cycle_index(
+                    &mut self.token_draft.selected_manual_approval,
+                    self.token_draft.manual_approvals.len(),
+                    direction,
+                );
+            }
+            Field::SelectedNetwork => self.cycle_saved_network(direction),
+            Field::ShowAdvanced => {
+                self.show_advanced = !self.show_advanced;
+            }
+            Field::ChainConfigUseAsActive => {
+                self.network_draft.use_as_active = !self.network_draft.use_as_active;
+            }
+            _ => {}
+        }
+    }
+
+    fn cycle_saved_token(&mut self, direction: i8) {
+        let saved = sorted_token_keys(&self.shared_config_draft);
+        if saved.is_empty() {
+            self.new_token_draft();
+            return;
+        }
+        let mut entries = saved;
+        entries.push("<new>".to_string());
+        let current = self
+            .token_draft
+            .source_key
+            .clone()
+            .unwrap_or_else(|| "<new>".to_string());
+        let mut index = entries
+            .iter()
+            .position(|entry| *entry == current)
+            .unwrap_or(entries.len() - 1);
+        cycle_index(&mut index, entries.len(), direction);
+        if entries[index] == "<new>" {
+            self.new_token_draft();
+        } else {
+            let key = entries[index].clone();
+            self.load_token_draft(Some(&key));
+            self.message = None;
+        }
+    }
+
+    fn cycle_saved_network(&mut self, direction: i8) {
+        let saved = sorted_chain_keys(&self.shared_config_draft);
+        if saved.is_empty() {
+            self.new_network_draft();
+            return;
+        }
+        let mut entries = saved;
+        entries.push("<new>".to_string());
+        let current = self
+            .network_draft
+            .source_key
+            .clone()
+            .unwrap_or_else(|| "<new>".to_string());
+        let mut index = entries
+            .iter()
+            .position(|entry| *entry == current)
+            .unwrap_or(entries.len() - 1);
+        cycle_index(&mut index, entries.len(), direction);
+        if entries[index] == "<new>" {
+            self.new_network_draft();
+        } else {
+            let key = entries[index].clone();
+            self.load_network_draft(Some(&key));
+            self.message = None;
+        }
+    }
+
+    fn cycle_available_network(&mut self, direction: i8) {
+        let available = sorted_chain_keys(&self.shared_config_draft);
+        cycle_index(
+            &mut self.token_draft.available_network_index,
+            available.len(),
+            direction,
+        );
+    }
+
+    fn cycle_selected_network_mapping(&mut self, direction: i8) {
+        cycle_index(
+            &mut self.token_draft.selected_network,
+            self.token_draft.networks.len(),
+            direction,
+        );
+    }
+
+    fn edit_selected(&mut self, key: KeyEvent) {
+        let selected_field = self.selected_field();
+        let target = match selected_field {
+            Field::TokenKey => Some(&mut self.token_draft.key),
+            Field::NetworkAddress => self
+                .token_draft
+                .selected_network_mut()
+                .map(|network| &mut network.address),
+            Field::PerTxLimit => Some(&mut self.token_draft.limits.per_tx_limit),
+            Field::DailyLimit => Some(&mut self.token_draft.limits.daily_limit),
+            Field::WeeklyLimit => Some(&mut self.token_draft.limits.weekly_limit),
+            Field::MaxGasPerChainWei => Some(&mut self.token_draft.limits.max_gas_per_chain_wei),
+            Field::DailyMaxTxCount => Some(&mut self.token_draft.limits.daily_max_tx_count),
+            Field::PerTxMaxFeePerGasGwei => {
+                Some(&mut self.token_draft.limits.per_tx_max_fee_per_gas_gwei)
+            }
+            Field::PerTxMaxPriorityFeePerGasWei => {
+                Some(&mut self.token_draft.limits.per_tx_max_priority_fee_per_gas_wei)
+            }
+            Field::PerTxMaxCalldataBytes => {
+                Some(&mut self.token_draft.limits.per_tx_max_calldata_bytes)
+            }
+            Field::OverrideRecipientAddress => self
+                .token_draft
+                .destination_overrides
+                .get_mut(self.token_draft.selected_override)
+                .map(|item| &mut item.recipient_address),
+            Field::OverridePerTxLimit => self
+                .token_draft
+                .destination_overrides
+                .get_mut(self.token_draft.selected_override)
+                .map(|item| &mut item.limits.per_tx_limit),
+            Field::OverrideDailyLimit => self
+                .token_draft
+                .destination_overrides
+                .get_mut(self.token_draft.selected_override)
+                .map(|item| &mut item.limits.daily_limit),
+            Field::OverrideWeeklyLimit => self
+                .token_draft
+                .destination_overrides
+                .get_mut(self.token_draft.selected_override)
+                .map(|item| &mut item.limits.weekly_limit),
+            Field::OverrideMaxGasPerChainWei => self
+                .token_draft
+                .destination_overrides
+                .get_mut(self.token_draft.selected_override)
+                .map(|item| &mut item.limits.max_gas_per_chain_wei),
+            Field::OverrideDailyMaxTxCount => self
+                .token_draft
+                .destination_overrides
+                .get_mut(self.token_draft.selected_override)
+                .map(|item| &mut item.limits.daily_max_tx_count),
+            Field::OverridePerTxMaxFeePerGasGwei => self
+                .token_draft
+                .destination_overrides
+                .get_mut(self.token_draft.selected_override)
+                .map(|item| &mut item.limits.per_tx_max_fee_per_gas_gwei),
+            Field::OverridePerTxMaxPriorityFeePerGasWei => self
+                .token_draft
+                .destination_overrides
+                .get_mut(self.token_draft.selected_override)
+                .map(|item| &mut item.limits.per_tx_max_priority_fee_per_gas_wei),
+            Field::OverridePerTxMaxCalldataBytes => self
+                .token_draft
+                .destination_overrides
+                .get_mut(self.token_draft.selected_override)
+                .map(|item| &mut item.limits.per_tx_max_calldata_bytes),
+            Field::ManualApprovalRecipientAddress => self
+                .token_draft
+                .manual_approvals
+                .get_mut(self.token_draft.selected_manual_approval)
+                .map(|item| &mut item.recipient_address),
+            Field::ManualApprovalMinAmount => self
+                .token_draft
+                .manual_approvals
+                .get_mut(self.token_draft.selected_manual_approval)
+                .map(|item| &mut item.min_amount),
+            Field::ManualApprovalMaxAmount => self
+                .token_draft
+                .manual_approvals
+                .get_mut(self.token_draft.selected_manual_approval)
+                .map(|item| &mut item.max_amount),
+            Field::ManualApprovalPriority => self
+                .token_draft
+                .manual_approvals
+                .get_mut(self.token_draft.selected_manual_approval)
+                .map(|item| &mut item.priority),
+            Field::ChainConfigKey => Some(&mut self.network_draft.key),
+            Field::ChainConfigId => Some(&mut self.network_draft.chain_id),
+            Field::ChainConfigName => Some(&mut self.network_draft.name),
+            Field::ChainConfigRpcUrl => Some(&mut self.network_draft.rpc_url),
+            _ => None,
+        };
+
+        let Some(target) = target else {
+            return;
+        };
+
+        match key.code {
+            KeyCode::Backspace => {
+                target.pop();
+                self.message = None;
+            }
+            KeyCode::Char(ch)
+                if !key.modifiers.contains(KeyModifiers::CONTROL)
+                    && !key.modifiers.contains(KeyModifiers::ALT) =>
+            {
+                if is_allowed_input_char(selected_field, ch) {
+                    target.push(ch);
+                    self.message = None;
+                } else {
+                    self.message = Some(format!("invalid character '{ch}' for the selected field"));
+                }
+            }
+            _ => {}
+        }
+    }
+
+    fn add_destination_override(&mut self) {
+        self.token_draft
+            .destination_overrides
+            .push(DestinationOverrideDraft {
+                recipient_address: String::new(),
+                limits: self.token_draft.limits.clone(),
+            });
+        self.token_draft.selected_override = self
+            .token_draft
+            .destination_overrides
+            .len()
+            .saturating_sub(1);
+        self.message = Some("destination override added".to_string());
+    }
+
+    fn delete_destination_override(&mut self) {
+        if self.token_draft.destination_overrides.is_empty() {
+            self.message = Some("no destination override is selected".to_string());
+            return;
+        }
+        self.token_draft
+            .destination_overrides
+            .remove(self.token_draft.selected_override);
+        self.token_draft.normalize();
+        self.message = Some("destination override removed".to_string());
+    }
+
+    fn add_manual_approval(&mut self) {
+        self.token_draft.manual_approvals.push(ManualApprovalDraft {
+            recipient_address: String::new(),
+            min_amount: self.token_draft.limits.daily_limit.clone(),
+            max_amount: self.token_draft.limits.weekly_limit.clone(),
+            priority: "100".to_string(),
+        });
+        self.token_draft.selected_manual_approval =
+            self.token_draft.manual_approvals.len().saturating_sub(1);
+        self.message = Some("manual approval policy added".to_string());
+    }
+
+    fn delete_manual_approval(&mut self) {
+        if self.token_draft.manual_approvals.is_empty() {
+            self.message = Some("no manual approval policy is selected".to_string());
+            return;
+        }
+        self.token_draft
+            .manual_approvals
+            .remove(self.token_draft.selected_manual_approval);
+        self.token_draft.normalize();
+        self.message = Some("manual approval policy removed".to_string());
+    }
+
+    fn refresh_token_metadata(&mut self) -> Result<()> {
+        let selected_network = self
+            .token_draft
+            .selected_network()
+            .cloned()
+            .context("select a token network first")?;
+        let chain_profile = self
+            .shared_config_draft
+            .chains
+            .get(&selected_network.chain_key)
+            .with_context(|| format!("unknown saved network '{}'", selected_network.chain_key))?;
+        let rpc_url = chain_profile
+            .rpc_url
+            .as_deref()
+            .or(self.shared_config_draft.rpc_url.as_deref())
+            .context("the selected network needs an rpc url before metadata can be fetched")?;
+        let address = if selected_network.is_native {
+            None
+        } else {
+            Some(parse_address("token address", &selected_network.address)?)
+        };
+        let metadata = fetch_token_metadata_sync(
+            selected_network.chain_key.clone(),
+            rpc_url.to_string(),
+            chain_profile.chain_id,
+            selected_network.is_native,
+            address,
+        )?;
+
+        self.token_draft.name = metadata.name;
+        self.token_draft.symbol = metadata.symbol;
+        if self.token_draft.key.trim().is_empty() {
+            self.token_draft.key = self.token_draft.symbol.to_lowercase();
+        }
+        if let Some(network) = self.token_draft.selected_network_mut() {
+            network.chain_id = metadata.chain_id.to_string();
+            network.decimals = metadata.decimals.to_string();
+        }
+        self.message = Some("token metadata refreshed from rpc".to_string());
+        Ok(())
+    }
+
+    fn selected_token_requires_metadata_refresh(&self) -> bool {
+        let Some(selected_network) = self.token_draft.selected_network() else {
+            return false;
+        };
+        let has_asset_locator =
+            selected_network.is_native || !selected_network.address.trim().is_empty();
+        let missing_metadata = self.token_draft.name.trim().is_empty()
+            || self.token_draft.symbol.trim().is_empty()
+            || selected_network.chain_id.trim().is_empty()
+            || selected_network.decimals.trim().is_empty();
+        has_asset_locator && missing_metadata
+    }
+
+    fn persist_shared_config(&mut self) -> Result<()> {
+        let loaded = LoadedConfig {
+            path: self.config_path.clone(),
+            config: self.shared_config_draft.clone(),
+        };
+        loaded.save()
+    }
+
+    fn save_token_config(&mut self) -> Result<()> {
+        let (source_key, token_key, token_profile) =
+            self.token_draft.to_profile(&self.shared_config_draft)?;
+        let mut candidate = self.shared_config_draft.clone();
+        if let Some(old_key) = source_key.as_ref() {
+            if old_key != &token_key {
+                candidate.tokens.remove(old_key);
+            }
+        }
+        candidate.tokens.insert(token_key.clone(), token_profile);
+
+        let token_policies = resolve_all_token_policies(&candidate)?;
+        let _ = resolve_all_token_destination_overrides(&candidate, &token_policies)?;
+        let _ = resolve_all_token_manual_approval_policies(&candidate, &token_policies)?;
+
+        self.shared_config_draft = candidate;
+        self.persist_shared_config()?;
+        self.load_token_draft(Some(&token_key));
+        self.message = Some(format!("saved token '{}'", token_key));
+        Ok(())
+    }
+
+    fn delete_token_config(&mut self) -> Result<()> {
+        let key = self
+            .token_draft
+            .source_key
+            .clone()
+            .or_else(|| {
+                let trimmed = self.token_draft.key.trim().to_lowercase();
+                (!trimmed.is_empty()).then_some(trimmed)
+            })
+            .context("no saved token is selected")?;
+        if self.shared_config_draft.tokens.remove(&key).is_none() {
+            bail!("no saved token exists for '{}'", key);
+        }
+        self.persist_shared_config()?;
+        self.load_token_draft(None);
+        self.message = Some(format!("deleted token '{}'", key));
+        Ok(())
+    }
+
+    fn save_network_config(&mut self) -> Result<()> {
+        let (source_key, chain_key, profile, use_as_active) = self.network_draft.to_profile()?;
+        let mut candidate = self.shared_config_draft.clone();
+
+        if let Some(old_key) = source_key.as_ref() {
+            if old_key != &chain_key {
+                if candidate.chains.remove(old_key).is_none() {
+                    bail!("no saved network exists for '{}'", old_key);
+                }
+                for token_profile in candidate.tokens.values_mut() {
+                    if let Some(chain_profile) = token_profile.chains.remove(old_key) {
+                        token_profile
+                            .chains
+                            .insert(chain_key.clone(), chain_profile);
+                    }
+                }
+            }
+        }
+
+        candidate.chains.insert(chain_key.clone(), profile.clone());
+        if use_as_active {
+            candidate.chain_id = Some(profile.chain_id);
+            candidate.chain_name = Some(profile.name.clone());
+            candidate.rpc_url = profile.rpc_url.clone();
+        }
+
+        self.shared_config_draft = candidate;
+        self.persist_shared_config()?;
+        self.load_network_draft(Some(&chain_key));
+        let token_source_key = self.token_draft.source_key.clone();
+        self.load_token_draft(token_source_key.as_deref());
+        self.message = Some(format!("saved network '{}'", chain_key));
+        Ok(())
+    }
+
+    fn delete_network_config(&mut self) -> Result<()> {
+        let key = self
+            .network_draft
+            .source_key
+            .clone()
+            .or_else(|| {
+                let trimmed = self.network_draft.key.trim().to_lowercase();
+                (!trimmed.is_empty()).then_some(trimmed)
+            })
+            .context("no saved network is selected")?;
+        if let Some(token_key) =
+            self.shared_config_draft
+                .tokens
+                .iter()
+                .find_map(|(token_key, token_profile)| {
+                    token_profile
+                        .chains
+                        .contains_key(&key)
+                        .then_some(token_key.clone())
+                })
+        {
+            bail!(
+                "network '{}' is still used by token '{}'; remove the mapping first",
+                key,
+                token_key
+            );
+        }
+        if self.shared_config_draft.chains.remove(&key).is_none() {
+            bail!("no saved network exists for '{}'", key);
+        }
+        self.persist_shared_config()?;
+        self.load_network_draft(None);
+        self.message = Some(format!("deleted network '{}'", key));
+        Ok(())
+    }
+
+    fn build_params(&self) -> Result<BootstrapParams> {
+        build_bootstrap_params_from_shared_config(
+            &self.shared_config_draft,
+            self.print_agent_auth_token,
+            true,
+        )
+    }
+}
+
+pub(crate) fn build_bootstrap_params_from_shared_config(
+    config: &WlfiConfig,
+    print_agent_auth_token: bool,
+    reuse_existing_wallet: bool,
+) -> Result<BootstrapParams> {
+    let token_policies = resolve_all_token_policies(config)?;
+    let token_destination_overrides =
+        resolve_all_token_destination_overrides(config, &token_policies)?;
+    let token_manual_approval_policies =
+        resolve_all_token_manual_approval_policies(config, &token_policies)?;
+
+    if token_policies.is_empty() {
+        bail!("save at least one token before running bootstrap");
+    }
+
+    let (existing_vault_key_id, existing_vault_public_key) = if reuse_existing_wallet {
+        let wallet = config.wallet.as_ref();
+        let parsed_vault_key_id = wallet
+            .and_then(|profile| profile.vault_key_id.as_deref())
+            .map(|value| {
+                Uuid::parse_str(value)
+                    .with_context(|| format!("wallet.vaultKeyId '{value}' must be a valid UUID"))
+            })
+            .transpose()?;
+        let vault_public_key = wallet.and_then(|profile| {
+            let trimmed = profile.vault_public_key.trim();
+            (!trimmed.is_empty()).then(|| trimmed.to_string())
+        });
+        (parsed_vault_key_id, vault_public_key)
+    } else {
+        (None, None)
+    };
+
+    Ok(BootstrapParams {
+        per_tx_max_wei: 0,
+        daily_max_wei: 0,
+        weekly_max_wei: 0,
+        max_gas_per_chain_wei: 0,
+        daily_max_tx_count: 0,
+        per_tx_max_fee_per_gas_wei: 0,
+        per_tx_max_priority_fee_per_gas_wei: 0,
+        per_tx_max_calldata_bytes: 0,
+        tokens: Vec::new(),
+        allow_native_eth: false,
+        network: None,
+        recipient: None,
+        token_policies,
+        destination_overrides: Vec::new(),
+        token_destination_overrides,
+        token_manual_approval_policies,
+        attach_policy_ids: Vec::new(),
+        print_agent_auth_token,
+        print_vault_private_key: false,
+        existing_vault_key_id,
+        existing_vault_public_key,
+    })
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+struct ResolvedLimitFields {
+    per_tx_max_wei: u128,
+    daily_max_wei: u128,
+    weekly_max_wei: u128,
+    max_gas_per_chain_wei: u128,
+    daily_max_tx_count: u128,
+    per_tx_max_fee_per_gas_wei: u128,
+    per_tx_max_priority_fee_per_gas_wei: u128,
+    per_tx_max_calldata_bytes: u128,
+}
+
+impl ResolvedLimitFields {
+    fn from_token_policy(policy: &TokenPolicyConfig) -> Self {
+        Self {
+            per_tx_max_wei: policy.per_tx_max_wei,
+            daily_max_wei: policy.daily_max_wei,
+            weekly_max_wei: policy.weekly_max_wei,
+            max_gas_per_chain_wei: policy.max_gas_per_chain_wei,
+            daily_max_tx_count: policy.daily_max_tx_count,
+            per_tx_max_fee_per_gas_wei: policy.per_tx_max_fee_per_gas_wei,
+            per_tx_max_priority_fee_per_gas_wei: policy.per_tx_max_priority_fee_per_gas_wei,
+            per_tx_max_calldata_bytes: policy.per_tx_max_calldata_bytes,
+        }
+    }
+
+    fn from_override(override_policy: &TokenDestinationPolicyOverride) -> Self {
+        Self {
+            per_tx_max_wei: override_policy.per_tx_max_wei,
+            daily_max_wei: override_policy.daily_max_wei,
+            weekly_max_wei: override_policy.weekly_max_wei,
+            max_gas_per_chain_wei: override_policy.max_gas_per_chain_wei,
+            daily_max_tx_count: override_policy.daily_max_tx_count,
+            per_tx_max_fee_per_gas_wei: override_policy.per_tx_max_fee_per_gas_wei,
+            per_tx_max_priority_fee_per_gas_wei: override_policy
+                .per_tx_max_priority_fee_per_gas_wei,
+            per_tx_max_calldata_bytes: override_policy.per_tx_max_calldata_bytes,
+        }
+    }
+}
+
+enum LoopAction {
+    Continue,
+    ApplyAndContinue {
+        params: Box<BootstrapParams>,
+        success_message: String,
+    },
+    ApplyAndExit(Box<BootstrapParams>),
+    Cancel,
+}
+
+pub(crate) fn run_bootstrap_tui<T>(
+    shared_config: &WlfiConfig,
+    print_agent_auth_token: bool,
+    on_apply: impl FnMut(BootstrapParams) -> Result<T>,
+) -> Result<Option<T>> {
+    enable_raw_mode().context("failed to enable raw mode")?;
+    let mut stdout = io::stdout();
+    execute!(stdout, EnterAlternateScreen).context("failed to enter alternate screen")?;
+    let backend = CrosstermBackend::new(stdout);
+    let mut terminal = Terminal::new(backend).context("failed to initialize terminal backend")?;
+
+    let run_result = run_event_loop(
+        &mut terminal,
+        AppState::from_shared_config(shared_config, print_agent_auth_token),
+        on_apply,
+    );
+    let cleanup_result = cleanup_terminal(&mut terminal);
+    match (run_result, cleanup_result) {
+        (Ok(output), Ok(())) => Ok(output),
+        (Err(run_err), Ok(())) => Err(run_err),
+        (Ok(_), Err(cleanup_err)) => Err(cleanup_err),
+        (Err(run_err), Err(cleanup_err)) => Err(run_err.context(cleanup_err.to_string())),
+    }
+}
+
+fn cleanup_terminal(terminal: &mut Terminal<CrosstermBackend<io::Stdout>>) -> Result<()> {
+    disable_raw_mode().context("failed to disable raw mode")?;
+    execute!(terminal.backend_mut(), LeaveAlternateScreen)
+        .context("failed to leave alternate screen")?;
+    terminal.show_cursor().context("failed to show cursor")?;
+    Ok(())
+}
+
+fn run_event_loop<T>(
+    terminal: &mut Terminal<CrosstermBackend<io::Stdout>>,
+    mut app: AppState,
+    mut on_apply: impl FnMut(BootstrapParams) -> Result<T>,
+) -> Result<Option<T>> {
+    let mut last_output = None;
+    loop {
+        app.normalize_selection();
+        terminal
+            .draw(|frame| draw_ui(frame, &app))
+            .context("failed to render tui frame")?;
+
+        if !event::poll(Duration::from_millis(250)).context("failed to poll terminal events")? {
+            continue;
+        }
+
+        let Event::Key(key) = event::read().context("failed to read terminal event")? else {
+            continue;
+        };
+        if key.kind != KeyEventKind::Press {
+            continue;
+        }
+
+        match handle_key_event(&mut app, key)? {
+            LoopAction::Continue => {}
+            LoopAction::ApplyAndContinue {
+                params,
+                success_message,
+            } => match on_apply(*params) {
+                Ok(output) => {
+                    last_output = Some(output);
+                    app.message = Some(success_message);
+                }
+                Err(err) => {
+                    app.message = Some(err.to_string());
+                }
+            },
+            LoopAction::ApplyAndExit(params) => match on_apply(*params) {
+                Ok(output) => return Ok(Some(output)),
+                Err(err) => {
+                    app.message = Some(err.to_string());
+                }
+            },
+            LoopAction::Cancel => return Ok(last_output),
+        }
+    }
+}
+
+fn handle_key_event(app: &mut AppState, key: KeyEvent) -> Result<LoopAction> {
+    if key.code == KeyCode::Char('s') && key.modifiers.contains(KeyModifiers::CONTROL) {
+        match app.build_params() {
+            Ok(params) => return Ok(LoopAction::ApplyAndExit(Box::new(params))),
+            Err(err) => {
+                app.message = Some(err.to_string());
+                return Ok(LoopAction::Continue);
+            }
+        }
+    }
+
+    if key.code == KeyCode::Char('r') && key.modifiers.contains(KeyModifiers::CONTROL) {
+        app.reload_current_view();
+        app.message = Some("reloaded saved data into the current draft".to_string());
+        return Ok(LoopAction::Continue);
+    }
+
+    if key.code == KeyCode::Char('n') && key.modifiers.contains(KeyModifiers::CONTROL) {
+        match app.view {
+            View::Tokens => app.new_token_draft(),
+            View::Networks => app.new_network_draft(),
+            View::Bootstrap => {}
+        }
+        return Ok(LoopAction::Continue);
+    }
+
+    if key.code == KeyCode::Char('o') && key.modifiers.contains(KeyModifiers::CONTROL) {
+        if app.view == View::Tokens {
+            app.add_destination_override();
+        }
+        return Ok(LoopAction::Continue);
+    }
+
+    if key.code == KeyCode::Char('m') && key.modifiers.contains(KeyModifiers::CONTROL) {
+        if app.view == View::Tokens {
+            app.add_manual_approval();
+        }
+        return Ok(LoopAction::Continue);
+    }
+
+    match key.code {
+        KeyCode::Esc => return Ok(LoopAction::Cancel),
+        KeyCode::Char('c') if key.modifiers.contains(KeyModifiers::CONTROL) => {
+            return Ok(LoopAction::Cancel);
+        }
+        KeyCode::Char('q') if key.modifiers.is_empty() => return Ok(LoopAction::Cancel),
+        KeyCode::Down | KeyCode::Char('j') => {
+            app.select_next();
+            app.message = None;
+            return Ok(LoopAction::Continue);
+        }
+        KeyCode::Up | KeyCode::Char('k') => {
+            app.select_prev();
+            app.message = None;
+            return Ok(LoopAction::Continue);
+        }
+        KeyCode::BackTab => {
+            app.previous_view();
+            return Ok(LoopAction::Continue);
+        }
+        KeyCode::Tab => {
+            app.next_view();
+            return Ok(LoopAction::Continue);
+        }
+        KeyCode::Home => {
+            app.selected = 0;
+            return Ok(LoopAction::Continue);
+        }
+        KeyCode::End => {
+            app.selected = app.visible_fields().len().saturating_sub(1);
+            return Ok(LoopAction::Continue);
+        }
+        KeyCode::Left | KeyCode::Char('h') => {
+            app.step_selected(-1);
+            app.message = None;
+            return Ok(LoopAction::Continue);
+        }
+        KeyCode::Right | KeyCode::Char('l') => {
+            app.step_selected(1);
+            app.message = None;
+            return Ok(LoopAction::Continue);
+        }
+        KeyCode::Char(' ') => match app.selected_field() {
+            Field::NetworkMembership => {
+                if let Err(err) = app
+                    .token_draft
+                    .toggle_network_membership(&app.shared_config_draft)
+                {
+                    app.message = Some(err.to_string());
+                } else {
+                    app.message = Some("updated token network selection".to_string());
+                }
+                return Ok(LoopAction::Continue);
+            }
+            Field::SelectedToken
+            | Field::EditingNetwork
+            | Field::SelectedDestinationOverride
+            | Field::SelectedManualApproval
+            | Field::SelectedNetwork
+            | Field::NetworkIsNative
+            | Field::ShowAdvanced
+            | Field::ChainConfigUseAsActive => {
+                app.step_selected(1);
+                return Ok(LoopAction::Continue);
+            }
+            _ => {}
+        },
+        KeyCode::Char('[') if key.modifiers.is_empty() => {
+            app.previous_view();
+            return Ok(LoopAction::Continue);
+        }
+        KeyCode::Char(']') if key.modifiers.is_empty() => {
+            app.next_view();
+            return Ok(LoopAction::Continue);
+        }
+        KeyCode::Enter => match app.selected_field() {
+            Field::Execute => match app.build_params() {
+                Ok(params) => return Ok(LoopAction::ApplyAndExit(Box::new(params))),
+                Err(err) => {
+                    app.message = Some(err.to_string());
+                    return Ok(LoopAction::Continue);
+                }
+            },
+            Field::NetworkMembership => {
+                if let Err(err) = app
+                    .token_draft
+                    .toggle_network_membership(&app.shared_config_draft)
+                {
+                    app.message = Some(err.to_string());
+                } else {
+                    app.message = Some("updated token network selection".to_string());
+                }
+                return Ok(LoopAction::Continue);
+            }
+            Field::RefreshTokenMetadata => {
+                if let Err(err) = app.refresh_token_metadata() {
+                    app.message = Some(err.to_string());
+                }
+                return Ok(LoopAction::Continue);
+            }
+            Field::DestinationOverrides => {
+                app.add_destination_override();
+                return Ok(LoopAction::Continue);
+            }
+            Field::DeleteDestinationOverride => {
+                app.delete_destination_override();
+                return Ok(LoopAction::Continue);
+            }
+            Field::ManualApprovals => {
+                app.add_manual_approval();
+                return Ok(LoopAction::Continue);
+            }
+            Field::DeleteManualApproval => {
+                app.delete_manual_approval();
+                return Ok(LoopAction::Continue);
+            }
+            Field::SaveToken => {
+                if app.selected_token_requires_metadata_refresh() {
+                    if let Err(err) = app.refresh_token_metadata() {
+                        app.message = Some(err.to_string());
+                        return Ok(LoopAction::Continue);
+                    }
+                }
+                if let Err(err) = app.save_token_config() {
+                    app.message = Some(err.to_string());
+                    return Ok(LoopAction::Continue);
+                }
+                let success_message = app
+                    .message
+                    .clone()
+                    .unwrap_or_else(|| "saved token".to_string());
+                match app.build_params() {
+                    Ok(params) => {
+                        return Ok(LoopAction::ApplyAndContinue {
+                            params: Box::new(params),
+                            success_message: format!("{success_message} and applied to wallet"),
+                        });
+                    }
+                    Err(err) => {
+                        app.message = Some(format!(
+                            "{success_message} but failed to apply to wallet: {err}"
+                        ));
+                        return Ok(LoopAction::Continue);
+                    }
+                }
+            }
+            Field::DeleteToken => {
+                if let Err(err) = app.delete_token_config() {
+                    app.message = Some(err.to_string());
+                }
+                return Ok(LoopAction::Continue);
+            }
+            Field::SaveNetwork => {
+                if let Err(err) = app.save_network_config() {
+                    app.message = Some(err.to_string());
+                }
+                return Ok(LoopAction::Continue);
+            }
+            Field::DeleteNetwork => {
+                if let Err(err) = app.delete_network_config() {
+                    app.message = Some(err.to_string());
+                }
+                return Ok(LoopAction::Continue);
+            }
+            Field::SelectedToken
+            | Field::EditingNetwork
+            | Field::SelectedDestinationOverride
+            | Field::SelectedManualApproval
+            | Field::SelectedNetwork
+            | Field::NetworkIsNative
+            | Field::ShowAdvanced
+            | Field::ChainConfigUseAsActive => {
+                app.step_selected(1);
+                return Ok(LoopAction::Continue);
+            }
+            _ => {}
+        },
+        _ => {}
+    }
+
+    app.edit_selected(key);
+    Ok(LoopAction::Continue)
+}
+
+fn draw_ui(frame: &mut ratatui::Frame<'_>, app: &AppState) {
+    let areas = Layout::default()
+        .direction(Direction::Vertical)
+        .constraints([
+            Constraint::Length(4),
+            Constraint::Min(18),
+            Constraint::Length(8),
+            Constraint::Length(3),
+        ])
+        .split(frame.area());
+
+    let header_lines = vec![
+        Line::from(Span::styled(
+            "WLFI Admin Policy Editor",
+            Style::default()
+                .fg(Color::Cyan)
+                .add_modifier(Modifier::BOLD),
+        )),
+        Line::from(app.view.description()),
+        Line::from(
+            View::ALL
+                .iter()
+                .map(|view| {
+                    let style = if *view == app.view {
+                        Style::default()
+                            .fg(Color::Black)
+                            .bg(Color::Cyan)
+                            .add_modifier(Modifier::BOLD)
+                    } else {
+                        Style::default().fg(Color::Gray)
+                    };
+                    Span::styled(format!(" {} ", view.title()), style)
+                })
+                .collect::<Vec<_>>(),
+        ),
+    ];
+    let header =
+        Paragraph::new(header_lines).block(Block::default().borders(Borders::ALL).title("Views"));
+    frame.render_widget(header, areas[0]);
+
+    let body = Layout::default()
+        .direction(Direction::Horizontal)
+        .constraints([Constraint::Percentage(53), Constraint::Percentage(47)])
+        .split(areas[1]);
+
+    let fields = app.visible_fields();
+    let items: Vec<ListItem<'_>> = fields
+        .iter()
+        .enumerate()
+        .map(|(index, field)| {
+            let selected = index == app.selected;
+            let style = if selected {
+                Style::default()
+                    .fg(Color::Black)
+                    .bg(Color::Cyan)
+                    .add_modifier(Modifier::BOLD)
+            } else {
+                Style::default()
+            };
+            ListItem::new(Line::from(vec![
+                Span::styled(field_label(*field), style),
+                Span::styled(": ", style),
+                Span::styled(field_value(app, *field), style),
+            ]))
+        })
+        .collect();
+    let form = List::new(items).block(
+        Block::default()
+            .borders(Borders::ALL)
+            .title(app.view.title()),
+    );
+    frame.render_widget(form, body[0]);
+
+    let panel = Paragraph::new(build_panel_lines(app))
+        .wrap(Wrap { trim: true })
+        .block(
+            Block::default()
+                .borders(Borders::ALL)
+                .title(build_panel_title(app.view)),
+        );
+    frame.render_widget(panel, body[1]);
+
+    let help = Paragraph::new(build_help_lines(app.view))
+        .wrap(Wrap { trim: true })
+        .block(Block::default().borders(Borders::ALL).title("Keys"));
+    frame.render_widget(help, areas[2]);
+
+    let default_message =
+        "Ready. Start with tokens; saved tokens expand across all selected networks at bootstrap.";
+    let message = app.message.as_deref().unwrap_or(default_message);
+    let style = if app.message.is_some() {
+        Style::default().fg(Color::Red)
+    } else {
+        Style::default().fg(Color::Green)
+    };
+    frame.render_widget(
+        Paragraph::new(Line::from(Span::styled(message, style)))
+            .block(Block::default().borders(Borders::ALL).title("Status")),
+        areas[3],
+    );
+}
+
+fn build_help_lines(view: View) -> Vec<Line<'static>> {
+    let mut lines = vec![
+        Line::from("Views: Tab/Shift+Tab or ]/["),
+        Line::from("Fields: ↑/↓ j/k Home End"),
+        Line::from("Toggle/cycle: ←/→ h/l Space"),
+        Line::from("Actions: Enter"),
+        Line::from("Drafts: Ctrl+N new, Ctrl+R reload, Ctrl+S bootstrap"),
+    ];
+    match view {
+        View::Tokens => {
+            lines.push(Line::from(
+                "Tokens: Ctrl+O add override, Ctrl+M add manual approval",
+            ));
+            lines.push(Line::from(
+                "Token name, symbol, and decimals come from RPC metadata refresh.",
+            ));
+            lines.push(Line::from(
+                "Advanced exposes gas, fee, tx count, and calldata limits.",
+            ));
+        }
+        View::Networks => {
+            lines.push(Line::from(
+                "Networks: save an rpc url before fetching token metadata.",
+            ));
+        }
+        View::Bootstrap => {
+            lines.push(Line::from(
+                "Bootstrap uses every saved token, override, and manual approval.",
+            ));
+        }
+    }
+    lines
+}
+
+fn build_panel_title(view: View) -> &'static str {
+    match view {
+        View::Tokens => "Token Inventory",
+        View::Networks => "Network Inventory",
+        View::Bootstrap => "Bootstrap Summary",
+    }
+}
+
+fn build_panel_lines(app: &AppState) -> Vec<Line<'static>> {
+    match app.view {
+        View::Tokens => build_token_panel_lines(app),
+        View::Networks => build_network_panel_lines(app),
+        View::Bootstrap => build_bootstrap_panel_lines(app),
+    }
+}
+
+fn build_token_panel_lines(app: &AppState) -> Vec<Line<'static>> {
+    let mut lines = vec![Line::from(Span::styled(
+        "Saved tokens",
+        Style::default().add_modifier(Modifier::BOLD),
+    ))];
+    if app.shared_config_draft.tokens.is_empty() {
+        lines.push(Line::from("No saved tokens yet."));
+    } else {
+        for token_key in sorted_token_keys(&app.shared_config_draft)
+            .into_iter()
+            .take(6)
+        {
+            if let Some(profile) = app.shared_config_draft.tokens.get(&token_key) {
+                lines.push(Line::from(render_saved_token_summary(&token_key, profile)));
+            }
+        }
+    }
+
+    lines.push(Line::from(""));
+    lines.push(Line::from(Span::styled(
+        "Current token draft",
+        Style::default().add_modifier(Modifier::BOLD),
+    )));
+    lines.extend(render_token_draft_lines(
+        &app.token_draft,
+        app.show_advanced,
+    ));
+    lines
+}
+
+fn build_network_panel_lines(app: &AppState) -> Vec<Line<'static>> {
+    let mut lines = vec![Line::from(Span::styled(
+        "Saved networks",
+        Style::default().add_modifier(Modifier::BOLD),
+    ))];
+    if app.shared_config_draft.chains.is_empty() {
+        lines.push(Line::from("No saved networks yet."));
+    } else {
+        for chain_key in sorted_chain_keys(&app.shared_config_draft) {
+            let profile = &app.shared_config_draft.chains[&chain_key];
+            let active =
+                if app.shared_config_draft.chain_name.as_deref() == Some(chain_key.as_str()) {
+                    " (active)"
+                } else {
+                    ""
+                };
+            let rpc = profile
+                .rpc_url
+                .as_deref()
+                .map(|value| format!(" @ {value}"))
+                .unwrap_or_default();
+            lines.push(Line::from(format!(
+                "{} — chain {}{}{}",
+                chain_key, profile.chain_id, rpc, active
+            )));
+        }
+    }
+
+    lines.push(Line::from(""));
+    lines.push(Line::from(Span::styled(
+        "Current network draft",
+        Style::default().add_modifier(Modifier::BOLD),
+    )));
+    lines.push(Line::from(format!(
+        "key={} chain_id={} name={}",
+        if app.network_draft.key.trim().is_empty() {
+            "<new>"
+        } else {
+            app.network_draft.key.trim()
+        },
+        blank_if_empty(&app.network_draft.chain_id),
+        blank_if_empty(&app.network_draft.name)
+    )));
+    lines.push(Line::from(format!(
+        "rpc={}",
+        blank_if_empty(&app.network_draft.rpc_url)
+    )));
+    lines.push(Line::from(format!(
+        "active network: {}",
+        bool_label(app.network_draft.use_as_active)
+    )));
+    lines
+}
+
+fn build_bootstrap_panel_lines(app: &AppState) -> Vec<Line<'static>> {
+    let mut lines = vec![Line::from(Span::styled(
+        "Saved token policies",
+        Style::default().add_modifier(Modifier::BOLD),
+    ))];
+    match resolve_all_token_policies(&app.shared_config_draft) {
+        Ok(token_policies) => {
+            lines.push(Line::from(format!(
+                "{} per-token policy bundle(s) are ready.",
+                token_policies.len()
+            )));
+        }
+        Err(err) => lines.push(Line::from(format!("Not ready yet: {}", err))),
+    }
+    match resolve_all_token_policies(&app.shared_config_draft)
+        .and_then(|token_policies| {
+            resolve_all_token_destination_overrides(&app.shared_config_draft, &token_policies)
+                .map(|overrides| (token_policies, overrides))
+        })
+        .and_then(|(token_policies, overrides)| {
+            resolve_all_token_manual_approval_policies(&app.shared_config_draft, &token_policies)
+                .map(|manual| (overrides, manual))
+        }) {
+        Ok((overrides, manual_approvals)) => {
+            lines.push(Line::from(format!(
+                "{} destination override(s); {} manual approval policy/policies.",
+                overrides.len(),
+                manual_approvals.len()
+            )));
+        }
+        Err(err) => lines.push(Line::from(format!("Validation: {}", err))),
+    }
+
+    lines.push(Line::from(""));
+    lines.push(Line::from(Span::styled(
+        "Execution",
+        Style::default().add_modifier(Modifier::BOLD),
+    )));
+    lines.push(Line::from(
+        "Bootstrap applies every saved token across its selected networks.",
+    ));
+    lines
+}
+
+fn field_label(field: Field) -> &'static str {
+    match field {
+        Field::SelectedToken => "Selected Token",
+        Field::TokenKey => "Token Key",
+        Field::TokenName => "Token Name (RPC)",
+        Field::TokenSymbol => "Token Symbol (RPC)",
+        Field::NetworkMembership => "Network Multi-Select",
+        Field::EditingNetwork => "Editing Network",
+        Field::NetworkIsNative => "Native Asset",
+        Field::NetworkAddress => "Token Address",
+        Field::RefreshTokenMetadata => "Fetch Metadata",
+        Field::TokenDecimals => "Token Decimals (RPC)",
+        Field::PerTxLimit => "Per-Tx Limit",
+        Field::DailyLimit => "Daily Limit",
+        Field::WeeklyLimit => "Weekly Limit",
+        Field::ShowAdvanced => "Advanced",
+        Field::MaxGasPerChainWei => "Max Gas Spend Per Chain (wei)",
+        Field::DailyMaxTxCount => "Daily Max Tx Count",
+        Field::PerTxMaxFeePerGasGwei => "Max Fee Per Gas (gwei)",
+        Field::PerTxMaxPriorityFeePerGasWei => "Max Priority Fee Per Gas (wei)",
+        Field::PerTxMaxCalldataBytes => "Max Calldata Bytes",
+        Field::DestinationOverrides => "Add Destination Override",
+        Field::SelectedDestinationOverride => "Selected Override",
+        Field::OverrideRecipientAddress => "Override Recipient",
+        Field::OverridePerTxLimit => "Override Per-Tx Limit",
+        Field::OverrideDailyLimit => "Override Daily Limit",
+        Field::OverrideWeeklyLimit => "Override Weekly Limit",
+        Field::OverrideMaxGasPerChainWei => "Override Gas/Chain (wei)",
+        Field::OverrideDailyMaxTxCount => "Override Daily Tx Count",
+        Field::OverridePerTxMaxFeePerGasGwei => "Override Max Fee/Gas (gwei)",
+        Field::OverridePerTxMaxPriorityFeePerGasWei => "Override Priority Fee/Gas (wei)",
+        Field::OverridePerTxMaxCalldataBytes => "Override Calldata Bytes",
+        Field::DeleteDestinationOverride => "Delete Override",
+        Field::ManualApprovals => "Add Manual Approval",
+        Field::SelectedManualApproval => "Selected Manual Approval",
+        Field::ManualApprovalRecipientAddress => "Approval Recipient",
+        Field::ManualApprovalMinAmount => "Approval Min Amount",
+        Field::ManualApprovalMaxAmount => "Approval Max Amount",
+        Field::ManualApprovalPriority => "Approval Priority",
+        Field::DeleteManualApproval => "Delete Manual Approval",
+        Field::SaveToken => "Save Token",
+        Field::DeleteToken => "Delete Token",
+        Field::SelectedNetwork => "Selected Network",
+        Field::ChainConfigKey => "Network Key",
+        Field::ChainConfigId => "Network Chain ID",
+        Field::ChainConfigName => "Network Name",
+        Field::ChainConfigRpcUrl => "Network RPC URL",
+        Field::ChainConfigUseAsActive => "Use As Active Network",
+        Field::SaveNetwork => "Save Network",
+        Field::DeleteNetwork => "Delete Network",
+        Field::Execute => "Bootstrap",
+    }
+}
+
+fn field_value(app: &AppState, field: Field) -> String {
+    match field {
+        Field::SelectedToken => app
+            .token_draft
+            .source_key
+            .clone()
+            .unwrap_or_else(|| "<new token>".to_string()),
+        Field::TokenKey => blank_if_empty(&app.token_draft.key),
+        Field::TokenName => blank_if_empty(&app.token_draft.name),
+        Field::TokenSymbol => blank_if_empty(&app.token_draft.symbol),
+        Field::NetworkMembership => {
+            render_network_membership_value(&app.token_draft, &app.shared_config_draft)
+        }
+        Field::EditingNetwork => app
+            .token_draft
+            .selected_network()
+            .map(|network| network.chain_key.clone())
+            .unwrap_or_else(|| "<none>".to_string()),
+        Field::NetworkIsNative => app
+            .token_draft
+            .selected_network()
+            .map(|network| bool_label(network.is_native).to_string())
+            .unwrap_or_else(|| "n/a".to_string()),
+        Field::NetworkAddress => app
+            .token_draft
+            .selected_network()
+            .map(|network| {
+                if network.is_native {
+                    "native".to_string()
+                } else {
+                    blank_if_empty(&network.address)
+                }
+            })
+            .unwrap_or_else(|| "n/a".to_string()),
+        Field::RefreshTokenMetadata => "press Enter".to_string(),
+        Field::TokenDecimals => app
+            .token_draft
+            .selected_network()
+            .map(|network| blank_if_empty(&network.decimals))
+            .unwrap_or_else(|| "n/a".to_string()),
+        Field::PerTxLimit => blank_if_empty(&app.token_draft.limits.per_tx_limit),
+        Field::DailyLimit => blank_if_empty(&app.token_draft.limits.daily_limit),
+        Field::WeeklyLimit => blank_if_empty(&app.token_draft.limits.weekly_limit),
+        Field::ShowAdvanced => bool_label(app.show_advanced).to_string(),
+        Field::MaxGasPerChainWei => {
+            display_unlimited_if_empty(&app.token_draft.limits.max_gas_per_chain_wei)
+        }
+        Field::DailyMaxTxCount => {
+            display_unlimited_if_empty(&app.token_draft.limits.daily_max_tx_count)
+        }
+        Field::PerTxMaxFeePerGasGwei => {
+            display_unlimited_if_empty(&app.token_draft.limits.per_tx_max_fee_per_gas_gwei)
+        }
+        Field::PerTxMaxPriorityFeePerGasWei => {
+            display_unlimited_if_empty(&app.token_draft.limits.per_tx_max_priority_fee_per_gas_wei)
+        }
+        Field::PerTxMaxCalldataBytes => {
+            display_unlimited_if_empty(&app.token_draft.limits.per_tx_max_calldata_bytes)
+        }
+        Field::DestinationOverrides => format!(
+            "{} saved draft(s) — press Enter",
+            app.token_draft.destination_overrides.len()
+        ),
+        Field::SelectedDestinationOverride => app
+            .token_draft
+            .destination_overrides
+            .get(app.token_draft.selected_override)
+            .map(render_destination_override_label)
+            .unwrap_or_else(|| "<none>".to_string()),
+        Field::OverrideRecipientAddress => app
+            .token_draft
+            .destination_overrides
+            .get(app.token_draft.selected_override)
+            .map(|item| blank_if_empty(&item.recipient_address))
+            .unwrap_or_else(|| "n/a".to_string()),
+        Field::OverridePerTxLimit => app
+            .token_draft
+            .destination_overrides
+            .get(app.token_draft.selected_override)
+            .map(|item| blank_if_empty(&item.limits.per_tx_limit))
+            .unwrap_or_else(|| "n/a".to_string()),
+        Field::OverrideDailyLimit => app
+            .token_draft
+            .destination_overrides
+            .get(app.token_draft.selected_override)
+            .map(|item| blank_if_empty(&item.limits.daily_limit))
+            .unwrap_or_else(|| "n/a".to_string()),
+        Field::OverrideWeeklyLimit => app
+            .token_draft
+            .destination_overrides
+            .get(app.token_draft.selected_override)
+            .map(|item| blank_if_empty(&item.limits.weekly_limit))
+            .unwrap_or_else(|| "n/a".to_string()),
+        Field::OverrideMaxGasPerChainWei => app
+            .token_draft
+            .destination_overrides
+            .get(app.token_draft.selected_override)
+            .map(|item| display_unlimited_if_empty(&item.limits.max_gas_per_chain_wei))
+            .unwrap_or_else(|| "n/a".to_string()),
+        Field::OverrideDailyMaxTxCount => app
+            .token_draft
+            .destination_overrides
+            .get(app.token_draft.selected_override)
+            .map(|item| display_unlimited_if_empty(&item.limits.daily_max_tx_count))
+            .unwrap_or_else(|| "n/a".to_string()),
+        Field::OverridePerTxMaxFeePerGasGwei => app
+            .token_draft
+            .destination_overrides
+            .get(app.token_draft.selected_override)
+            .map(|item| display_unlimited_if_empty(&item.limits.per_tx_max_fee_per_gas_gwei))
+            .unwrap_or_else(|| "n/a".to_string()),
+        Field::OverridePerTxMaxPriorityFeePerGasWei => app
+            .token_draft
+            .destination_overrides
+            .get(app.token_draft.selected_override)
+            .map(|item| {
+                display_unlimited_if_empty(&item.limits.per_tx_max_priority_fee_per_gas_wei)
+            })
+            .unwrap_or_else(|| "n/a".to_string()),
+        Field::OverridePerTxMaxCalldataBytes => app
+            .token_draft
+            .destination_overrides
+            .get(app.token_draft.selected_override)
+            .map(|item| display_unlimited_if_empty(&item.limits.per_tx_max_calldata_bytes))
+            .unwrap_or_else(|| "n/a".to_string()),
+        Field::DeleteDestinationOverride => "press Enter".to_string(),
+        Field::ManualApprovals => format!(
+            "{} saved draft(s) — press Enter",
+            app.token_draft.manual_approvals.len()
+        ),
+        Field::SelectedManualApproval => app
+            .token_draft
+            .manual_approvals
+            .get(app.token_draft.selected_manual_approval)
+            .map(render_manual_approval_label)
+            .unwrap_or_else(|| "<none>".to_string()),
+        Field::ManualApprovalRecipientAddress => app
+            .token_draft
+            .manual_approvals
+            .get(app.token_draft.selected_manual_approval)
+            .map(|item| blank_if_empty(&item.recipient_address))
+            .unwrap_or_else(|| "n/a".to_string()),
+        Field::ManualApprovalMinAmount => app
+            .token_draft
+            .manual_approvals
+            .get(app.token_draft.selected_manual_approval)
+            .map(|item| blank_if_empty(&item.min_amount))
+            .unwrap_or_else(|| "n/a".to_string()),
+        Field::ManualApprovalMaxAmount => app
+            .token_draft
+            .manual_approvals
+            .get(app.token_draft.selected_manual_approval)
+            .map(|item| blank_if_empty(&item.max_amount))
+            .unwrap_or_else(|| "n/a".to_string()),
+        Field::ManualApprovalPriority => app
+            .token_draft
+            .manual_approvals
+            .get(app.token_draft.selected_manual_approval)
+            .map(|item| blank_if_empty(&item.priority))
+            .unwrap_or_else(|| "n/a".to_string()),
+        Field::DeleteManualApproval => "press Enter".to_string(),
+        Field::SaveToken => "press Enter".to_string(),
+        Field::DeleteToken => "press Enter".to_string(),
+        Field::SelectedNetwork => app
+            .network_draft
+            .source_key
+            .clone()
+            .unwrap_or_else(|| "<new network>".to_string()),
+        Field::ChainConfigKey => blank_if_empty(&app.network_draft.key),
+        Field::ChainConfigId => blank_if_empty(&app.network_draft.chain_id),
+        Field::ChainConfigName => blank_if_empty(&app.network_draft.name),
+        Field::ChainConfigRpcUrl => blank_if_empty(&app.network_draft.rpc_url),
+        Field::ChainConfigUseAsActive => bool_label(app.network_draft.use_as_active).to_string(),
+        Field::SaveNetwork => "press Enter".to_string(),
+        Field::DeleteNetwork => "press Enter".to_string(),
+        Field::Execute => "press Enter".to_string(),
+    }
+}
+
+fn blank_if_empty(value: &str) -> String {
+    if value.trim().is_empty() {
+        "<blank>".to_string()
+    } else {
+        value.trim().to_string()
+    }
+}
+
+fn display_unlimited_if_empty(value: &str) -> String {
+    if value.trim().is_empty() {
+        "unlimited".to_string()
+    } else {
+        value.trim().to_string()
+    }
+}
+
+fn render_network_membership_value(token_draft: &TokenDraft, config: &WlfiConfig) -> String {
+    let available = sorted_chain_keys(config);
+    if available.is_empty() {
+        return "no saved networks".to_string();
+    }
+    let focus = available
+        .get(token_draft.available_network_index)
+        .cloned()
+        .unwrap_or_else(|| available[0].clone());
+    let selected = available
+        .iter()
+        .map(|chain_key| {
+            let checked = token_draft
+                .networks
+                .iter()
+                .any(|network| network.chain_key == *chain_key);
+            format!("[{}] {}", if checked { "x" } else { " " }, chain_key)
+        })
+        .collect::<Vec<_>>()
+        .join(" ");
+    format!("focus={} {}", focus, selected)
+}
+
+fn render_destination_override_label(override_item: &DestinationOverrideDraft) -> String {
+    if override_item.recipient_address.trim().is_empty() {
+        "<recipient required>".to_string()
+    } else {
+        override_item.recipient_address.trim().to_string()
+    }
+}
+
+fn render_manual_approval_label(manual_approval: &ManualApprovalDraft) -> String {
+    let recipient = if manual_approval.recipient_address.trim().is_empty() {
+        "all recipients"
+    } else {
+        manual_approval.recipient_address.trim()
+    };
+    format!(
+        "{} -> {}..{}",
+        recipient,
+        blank_if_empty(&manual_approval.min_amount),
+        blank_if_empty(&manual_approval.max_amount)
+    )
+}
+
+fn render_token_draft_lines(token_draft: &TokenDraft, show_advanced: bool) -> Vec<Line<'static>> {
+    let mut lines = vec![Line::from(format!(
+        "{} ({})",
+        if token_draft.name.trim().is_empty() {
+            "<name pending>"
+        } else {
+            token_draft.name.trim()
+        },
+        if token_draft.symbol.trim().is_empty() {
+            token_draft.key.trim()
+        } else {
+            token_draft.symbol.trim()
+        }
+    ))];
+    if token_draft.networks.is_empty() {
+        lines.push(Line::from("No network mappings yet."));
+    } else {
+        lines.push(Line::from("Network mappings:"));
+        for network in token_draft.networks.iter().take(4) {
+            let address = if network.is_native {
+                "native".to_string()
+            } else {
+                blank_if_empty(&network.address)
+            };
+            lines.push(Line::from(format!(
+                "- {} / chain {} / decimals {} / {}",
+                network.chain_key,
+                blank_if_empty(&network.chain_id),
+                blank_if_empty(&network.decimals),
+                address
+            )));
+        }
+    }
+    lines.push(Line::from(format!(
+        "Default limits: per-tx {} / daily {} / weekly {}.",
+        blank_if_empty(&token_draft.limits.per_tx_limit),
+        blank_if_empty(&token_draft.limits.daily_limit),
+        blank_if_empty(&token_draft.limits.weekly_limit),
+    )));
+    if show_advanced {
+        lines.push(Line::from(format!(
+            "Advanced limits: gas {} wei / daily tx {} / max fee {} gwei / priority fee {} wei / calldata {} bytes.",
+            display_unlimited_if_empty(&token_draft.limits.max_gas_per_chain_wei),
+            display_unlimited_if_empty(&token_draft.limits.daily_max_tx_count),
+            display_unlimited_if_empty(&token_draft.limits.per_tx_max_fee_per_gas_gwei),
+            display_unlimited_if_empty(&token_draft.limits.per_tx_max_priority_fee_per_gas_wei),
+            display_unlimited_if_empty(&token_draft.limits.per_tx_max_calldata_bytes),
+        )));
+    }
+    lines.push(Line::from(format!(
+        "{} destination override(s); {} manual approval policy/policies.",
+        token_draft.destination_overrides.len(),
+        token_draft.manual_approvals.len()
+    )));
+    lines
+}
+
+fn render_saved_token_summary(token_key: &str, profile: &TokenProfile) -> String {
+    let decimals = profile
+        .chains
+        .values()
+        .next()
+        .map(|chain| chain.decimals)
+        .unwrap_or(18);
+    let limits = LimitDraft::from_policy(
+        profile
+            .default_policy
+            .as_ref()
+            .or_else(|| first_chain_policy(profile)),
+        decimals,
+    );
+    let networks = profile
+        .chains
+        .keys()
+        .cloned()
+        .collect::<Vec<_>>()
+        .join(", ");
+    format!(
+        "{} ({}) — networks [{}] — default per-tx {} / daily {} / weekly {} — overrides {} — manual approvals {}",
+        profile.name.as_deref().unwrap_or(&profile.symbol),
+        token_key,
+        networks,
+        blank_if_empty(&limits.per_tx_limit),
+        blank_if_empty(&limits.daily_limit),
+        blank_if_empty(&limits.weekly_limit),
+        profile.destination_overrides.len(),
+        profile.manual_approval_policies.len(),
+    )
+}
+
+fn first_chain_policy(profile: &TokenProfile) -> Option<&TokenPolicyProfile> {
+    profile
+        .chains
+        .values()
+        .find_map(|chain_profile| chain_profile.default_policy.as_ref())
+}
+
+fn sorted_token_keys(config: &WlfiConfig) -> Vec<String> {
+    let mut keys = config.tokens.keys().cloned().collect::<Vec<_>>();
+    keys.sort();
+    keys
+}
+
+fn sorted_chain_keys(config: &WlfiConfig) -> Vec<String> {
+    let mut keys = config.chains.keys().cloned().collect::<Vec<_>>();
+    keys.sort();
+    keys
+}
+
+fn cycle_index(index: &mut usize, len: usize, direction: i8) {
+    if len == 0 {
+        *index = 0;
+        return;
+    }
+    if direction < 0 {
+        *index = if *index == 0 { len - 1 } else { *index - 1 };
+    } else {
+        *index = (*index + 1) % len;
+    }
+}
+
+fn validate_limit_draft(limits: &LimitDraft, decimals: u8) -> Result<()> {
+    parse_required_token_amount("per-tx limit", &limits.per_tx_limit, decimals)?;
+    parse_required_token_amount("daily limit", &limits.daily_limit, decimals)?;
+    parse_required_token_amount("weekly limit", &limits.weekly_limit, decimals)?;
+    if !limits.max_gas_per_chain_wei.trim().is_empty() {
+        parse_positive_u128("max gas spend per chain", &limits.max_gas_per_chain_wei)?;
+    }
+    parse_optional_non_negative_u128("daily max tx count", &limits.daily_max_tx_count)?;
+    parse_optional_gwei_amount("max fee per gas", Some(&limits.per_tx_max_fee_per_gas_gwei))?;
+    parse_optional_non_negative_u128(
+        "max priority fee per gas",
+        &limits.per_tx_max_priority_fee_per_gas_wei,
+    )?;
+    parse_optional_non_negative_u128("max calldata bytes", &limits.per_tx_max_calldata_bytes)?;
+    Ok(())
+}
+
+fn display_policy_amount(
+    decimal_value: Option<&str>,
+    raw_value: Option<&str>,
+    legacy_value: Option<f64>,
+    decimals: u8,
+) -> Result<String> {
+    if let Some(value) = decimal_value {
+        if !value.trim().is_empty() {
+            return Ok(value.trim().to_string());
+        }
+    }
+    if let Some(value) = raw_value {
+        if !value.trim().is_empty() {
+            let raw = parse_positive_u128("policy amount", value)?;
+            return format_token_amount(raw, decimals);
+        }
+    }
+    if let Some(value) = legacy_value {
+        return format_token_amount(
+            parse_legacy_amount("policy amount", value, decimals)?,
+            decimals,
+        );
+    }
+    Ok(String::new())
+}
+
+fn display_policy_gwei(gwei_value: Option<&str>, raw_wei_value: Option<&str>) -> Result<String> {
+    if let Some(value) = gwei_value {
+        if !value.trim().is_empty() {
+            return Ok(value.trim().to_string());
+        }
+    }
+    if let Some(value) = raw_wei_value {
+        if !value.trim().is_empty() {
+            return format_gwei_amount(parse_non_negative_u128("policy gwei", value)?);
+        }
+    }
+    Ok(String::new())
+}
+
+fn optional_trimmed(value: &str) -> Option<String> {
+    let trimmed = value.trim();
+    (!trimmed.is_empty()).then(|| trimmed.to_string())
+}
+
+fn optional_non_zero_string(value: u128) -> Option<String> {
+    (value > 0).then(|| value.to_string())
+}
+
+fn parse_optional_non_negative_u128(label: &str, value: &str) -> Result<u128> {
+    if value.trim().is_empty() {
+        Ok(0)
+    } else {
+        parse_non_negative_u128(label, value)
+    }
+}
+
+fn display_manual_amount(
+    decimal_value: Option<&str>,
+    raw_value: Option<&str>,
+    legacy_value: Option<f64>,
+    decimals: u8,
+) -> Result<String> {
+    if let Some(value) = decimal_value {
+        if !value.trim().is_empty() {
+            return Ok(value.trim().to_string());
+        }
+    }
+    if let Some(value) = raw_value {
+        if !value.trim().is_empty() {
+            return format_token_amount(
+                parse_positive_u128("manual approval amount", value)?,
+                decimals,
+            );
+        }
+    }
+    if let Some(value) = legacy_value {
+        return format_token_amount(
+            parse_legacy_amount("manual approval amount", value, decimals)?,
+            decimals,
+        );
+    }
+    Ok(String::new())
+}
+
+fn resolve_all_token_policies(config: &WlfiConfig) -> Result<Vec<TokenPolicyConfig>> {
+    let mut token_policies = Vec::new();
+    for token_key in sorted_token_keys(config) {
+        let token_profile = &config.tokens[&token_key];
+        for (chain_key, chain_profile) in token_profile.chains.iter() {
+            let policy = token_profile
+                .default_policy
+                .as_ref()
+                .or(chain_profile.default_policy.as_ref())
+                .with_context(|| {
+                    format!(
+                        "token '{}' chain '{}' is missing default limits",
+                        token_key, chain_key
+                    )
+                })?;
+            token_policies.push(resolve_token_policy_config(
+                &token_key,
+                token_profile,
+                chain_key,
+                chain_profile,
+                policy,
+            )?);
+        }
+    }
+    Ok(token_policies)
+}
+
+fn resolve_token_policy_config(
+    token_key: &str,
+    token_profile: &TokenProfile,
+    chain_key: &str,
+    chain_profile: &TokenChainProfile,
+    policy: &TokenPolicyProfile,
+) -> Result<TokenPolicyConfig> {
+    let decimals = chain_profile.decimals;
+    let per_tx_max_wei = resolve_required_policy_amount(
+        "per-tx limit",
+        policy.per_tx_amount_decimal.as_deref(),
+        policy.per_tx_limit.as_deref(),
+        policy.per_tx_amount,
+        decimals,
+    )?;
+    let daily_max_wei = resolve_required_policy_amount(
+        "daily limit",
+        policy.daily_amount_decimal.as_deref(),
+        policy.daily_limit.as_deref(),
+        policy.daily_amount,
+        decimals,
+    )?;
+    let weekly_max_wei = resolve_required_policy_amount(
+        "weekly limit",
+        policy.weekly_amount_decimal.as_deref(),
+        policy.weekly_limit.as_deref(),
+        policy.weekly_amount,
+        decimals,
+    )?;
+
+    Ok(TokenPolicyConfig {
+        token_key: token_key.to_string(),
+        symbol: token_profile.symbol.clone(),
+        chain_key: chain_key.to_string(),
+        chain_id: chain_profile.chain_id,
+        is_native: chain_profile.is_native,
+        address: if chain_profile.is_native {
+            None
+        } else {
+            Some(parse_address(
+                &format!("token '{}:{}'", token_key, chain_key),
+                chain_profile.address.as_deref().unwrap_or_default(),
+            )?)
+        },
+        per_tx_max_wei,
+        daily_max_wei,
+        weekly_max_wei,
+        max_gas_per_chain_wei: resolve_optional_policy_value(
+            policy.max_gas_per_chain_wei.as_deref(),
+        )?,
+        daily_max_tx_count: resolve_optional_policy_value(policy.daily_max_tx_count.as_deref())?,
+        per_tx_max_fee_per_gas_wei: resolve_optional_gwei_or_wei(
+            policy.per_tx_max_fee_per_gas_gwei.as_deref(),
+            policy.per_tx_max_fee_per_gas_wei.as_deref(),
+        )?,
+        per_tx_max_priority_fee_per_gas_wei: resolve_optional_policy_value(
+            policy.per_tx_max_priority_fee_per_gas_wei.as_deref(),
+        )?,
+        per_tx_max_calldata_bytes: resolve_optional_policy_value(
+            policy.per_tx_max_calldata_bytes.as_deref(),
+        )?,
+    })
+}
+
+fn resolve_all_token_destination_overrides(
+    config: &WlfiConfig,
+    token_policies: &[TokenPolicyConfig],
+) -> Result<Vec<TokenDestinationPolicyOverride>> {
+    let mut overrides = Vec::new();
+    let mut seen = BTreeSet::new();
+    for token_key in sorted_token_keys(config) {
+        let token_profile = &config.tokens[&token_key];
+        for override_profile in &token_profile.destination_overrides {
+            let recipient = parse_address(
+                "destination override recipient",
+                &override_profile.recipient,
+            )?;
+            for (chain_key, chain_profile) in &token_profile.chains {
+                if !seen.insert((token_key.clone(), chain_key.clone(), recipient.clone())) {
+                    bail!(
+                        "duplicate per-token destination override: {}:{} for {}",
+                        token_key,
+                        chain_key,
+                        recipient
+                    );
+                }
+                let default_policy = token_policies
+                    .iter()
+                    .find(|policy| policy.token_key == token_key && policy.chain_key == *chain_key)
+                    .with_context(|| {
+                        format!(
+                            "destination override references unknown token selector '{}:{}'",
+                            token_key, chain_key
+                        )
+                    })?;
+                let default_limits = ResolvedLimitFields::from_token_policy(default_policy);
+                let resolved = TokenDestinationPolicyOverride {
+                    token_key: token_key.clone(),
+                    chain_key: chain_key.clone(),
+                    recipient: recipient.clone(),
+                    per_tx_max_wei: resolve_policy_amount_or_default(
+                        override_profile.limits.per_tx_amount_decimal.as_deref(),
+                        override_profile.limits.per_tx_limit.as_deref(),
+                        override_profile.limits.per_tx_amount,
+                        default_limits.per_tx_max_wei,
+                        chain_profile.decimals,
+                    )?,
+                    daily_max_wei: resolve_policy_amount_or_default(
+                        override_profile.limits.daily_amount_decimal.as_deref(),
+                        override_profile.limits.daily_limit.as_deref(),
+                        override_profile.limits.daily_amount,
+                        default_limits.daily_max_wei,
+                        chain_profile.decimals,
+                    )?,
+                    weekly_max_wei: resolve_policy_amount_or_default(
+                        override_profile.limits.weekly_amount_decimal.as_deref(),
+                        override_profile.limits.weekly_limit.as_deref(),
+                        override_profile.limits.weekly_amount,
+                        default_limits.weekly_max_wei,
+                        chain_profile.decimals,
+                    )?,
+                    max_gas_per_chain_wei: resolve_optional_policy_value_or_default(
+                        override_profile.limits.max_gas_per_chain_wei.as_deref(),
+                        default_limits.max_gas_per_chain_wei,
+                    )?,
+                    daily_max_tx_count: resolve_optional_policy_value_or_default(
+                        override_profile.limits.daily_max_tx_count.as_deref(),
+                        default_limits.daily_max_tx_count,
+                    )?,
+                    per_tx_max_fee_per_gas_wei: resolve_gwei_or_wei_or_default(
+                        override_profile
+                            .limits
+                            .per_tx_max_fee_per_gas_gwei
+                            .as_deref(),
+                        override_profile
+                            .limits
+                            .per_tx_max_fee_per_gas_wei
+                            .as_deref(),
+                        default_limits.per_tx_max_fee_per_gas_wei,
+                    )?,
+                    per_tx_max_priority_fee_per_gas_wei: resolve_optional_policy_value_or_default(
+                        override_profile
+                            .limits
+                            .per_tx_max_priority_fee_per_gas_wei
+                            .as_deref(),
+                        default_limits.per_tx_max_priority_fee_per_gas_wei,
+                    )?,
+                    per_tx_max_calldata_bytes: resolve_optional_policy_value_or_default(
+                        override_profile.limits.per_tx_max_calldata_bytes.as_deref(),
+                        default_limits.per_tx_max_calldata_bytes,
+                    )?,
+                };
+                if ResolvedLimitFields::from_override(&resolved) == default_limits {
+                    continue;
+                }
+                validate_destination_override_overlay(
+                    &recipient.to_string(),
+                    &default_limits,
+                    &ResolvedLimitFields::from_override(&resolved),
+                )?;
+                overrides.push(resolved);
+            }
+        }
+    }
+    Ok(overrides)
+}
+
+fn resolve_all_token_manual_approval_policies(
+    config: &WlfiConfig,
+    token_policies: &[TokenPolicyConfig],
+) -> Result<Vec<TokenManualApprovalPolicyConfig>> {
+    let mut policies = Vec::new();
+    for token_key in sorted_token_keys(config) {
+        let token_profile = &config.tokens[&token_key];
+        for manual_profile in &token_profile.manual_approval_policies {
+            for (chain_key, chain_profile) in &token_profile.chains {
+                let token_policy = token_policies
+                    .iter()
+                    .find(|policy| policy.token_key == token_key && policy.chain_key == *chain_key)
+                    .with_context(|| {
+                        format!(
+                            "manual approval references unknown token selector '{}:{}'",
+                            token_key, chain_key
+                        )
+                    })?;
+                policies.push(TokenManualApprovalPolicyConfig {
+                    token_key: token_key.clone(),
+                    symbol: token_profile.symbol.clone(),
+                    chain_key: chain_key.clone(),
+                    chain_id: chain_profile.chain_id,
+                    is_native: chain_policy_is_native(token_policy),
+                    address: chain_policy_address(token_policy),
+                    priority: if manual_profile.priority == 0 {
+                        100
+                    } else {
+                        manual_profile.priority
+                    },
+                    recipient: match manual_profile.recipient.as_deref() {
+                        Some(value) if !value.trim().is_empty() => {
+                            Some(parse_address("manual approval recipient", value)?)
+                        }
+                        _ => None,
+                    },
+                    min_amount_wei: resolve_required_policy_amount(
+                        "manual approval min amount",
+                        manual_profile.min_amount_decimal.as_deref(),
+                        manual_profile.min_amount_wei.as_deref(),
+                        manual_profile.min_amount,
+                        chain_profile.decimals,
+                    )?,
+                    max_amount_wei: resolve_required_policy_amount(
+                        "manual approval max amount",
+                        manual_profile.max_amount_decimal.as_deref(),
+                        manual_profile.max_amount_wei.as_deref(),
+                        manual_profile.max_amount,
+                        chain_profile.decimals,
+                    )?,
+                });
+            }
+        }
+    }
+    Ok(policies)
+}
+
+fn chain_policy_is_native(policy: &TokenPolicyConfig) -> bool {
+    policy.is_native
+}
+
+fn chain_policy_address(policy: &TokenPolicyConfig) -> Option<EvmAddress> {
+    policy.address.clone()
+}
+
+fn resolve_required_policy_amount(
+    label: &str,
+    decimal_value: Option<&str>,
+    raw_value: Option<&str>,
+    legacy_value: Option<f64>,
+    decimals: u8,
+) -> Result<u128> {
+    if let Some(value) = decimal_value {
+        if !value.trim().is_empty() {
+            return parse_required_token_amount(label, value, decimals);
+        }
+    }
+    if let Some(value) = raw_value {
+        if !value.trim().is_empty() {
+            return parse_positive_u128(label, value);
+        }
+    }
+    if let Some(value) = legacy_value {
+        return parse_legacy_amount(label, value, decimals);
+    }
+    bail!("{label} is required");
+}
+
+fn resolve_policy_amount_or_default(
+    decimal_value: Option<&str>,
+    raw_value: Option<&str>,
+    legacy_value: Option<f64>,
+    default_value: u128,
+    decimals: u8,
+) -> Result<u128> {
+    if let Some(value) = decimal_value {
+        if !value.trim().is_empty() {
+            return parse_required_token_amount("policy amount", value, decimals);
+        }
+    }
+    if let Some(value) = raw_value {
+        if !value.trim().is_empty() {
+            return parse_positive_u128("policy amount", value);
+        }
+    }
+    if let Some(value) = legacy_value {
+        return parse_legacy_amount("policy amount", value, decimals);
+    }
+    Ok(default_value)
+}
+
+fn resolve_optional_gwei_or_wei(
+    gwei_value: Option<&str>,
+    raw_wei_value: Option<&str>,
+) -> Result<u128> {
+    if let Some(value) = gwei_value {
+        if !value.trim().is_empty() {
+            return parse_optional_gwei_amount("gwei value", Some(value));
+        }
+    }
+    resolve_optional_policy_value(raw_wei_value)
+}
+
+fn resolve_gwei_or_wei_or_default(
+    gwei_value: Option<&str>,
+    raw_wei_value: Option<&str>,
+    default_value: u128,
+) -> Result<u128> {
+    if let Some(value) = gwei_value {
+        if !value.trim().is_empty() {
+            return parse_optional_gwei_amount("gwei value", Some(value));
+        }
+    }
+    resolve_optional_policy_value_or_default(raw_wei_value, default_value)
+}
+
+fn resolve_optional_policy_value(value: Option<&str>) -> Result<u128> {
+    match value {
+        Some(value) if !value.trim().is_empty() => parse_non_negative_u128("policy value", value),
+        _ => Ok(0),
+    }
+}
+
+fn resolve_optional_policy_value_or_default(
+    value: Option<&str>,
+    default_value: u128,
+) -> Result<u128> {
+    match value {
+        Some(value) if !value.trim().is_empty() => parse_non_negative_u128("policy value", value),
+        _ => Ok(default_value),
+    }
+}
+
+fn validate_destination_override_overlay(
+    recipient: &str,
+    defaults: &ResolvedLimitFields,
+    override_limits: &ResolvedLimitFields,
+) -> Result<()> {
+    validate_overlay_limit(
+        recipient,
+        "per-tx max",
+        defaults.per_tx_max_wei,
+        override_limits.per_tx_max_wei,
+    )?;
+    validate_overlay_limit(
+        recipient,
+        "daily max",
+        defaults.daily_max_wei,
+        override_limits.daily_max_wei,
+    )?;
+    validate_overlay_limit(
+        recipient,
+        "weekly max",
+        defaults.weekly_max_wei,
+        override_limits.weekly_max_wei,
+    )?;
+    validate_optional_overlay_limit(
+        recipient,
+        "gas max",
+        defaults.max_gas_per_chain_wei,
+        override_limits.max_gas_per_chain_wei,
+    )?;
+    validate_optional_overlay_limit(
+        recipient,
+        "daily tx count",
+        defaults.daily_max_tx_count,
+        override_limits.daily_max_tx_count,
+    )?;
+    validate_optional_overlay_limit(
+        recipient,
+        "per-tx max fee per gas",
+        defaults.per_tx_max_fee_per_gas_wei,
+        override_limits.per_tx_max_fee_per_gas_wei,
+    )?;
+    validate_optional_overlay_limit(
+        recipient,
+        "per-tx max priority fee per gas",
+        defaults.per_tx_max_priority_fee_per_gas_wei,
+        override_limits.per_tx_max_priority_fee_per_gas_wei,
+    )?;
+    validate_optional_overlay_limit(
+        recipient,
+        "per-tx max calldata bytes",
+        defaults.per_tx_max_calldata_bytes,
+        override_limits.per_tx_max_calldata_bytes,
+    )?;
+    Ok(())
+}
+
+fn validate_overlay_limit(
+    recipient: &str,
+    label: &str,
+    defaults: u128,
+    overlay: u128,
+) -> Result<()> {
+    if overlay > defaults {
+        bail!(
+            "destination override for {recipient} must not increase {label} above the default value"
+        );
+    }
+    Ok(())
+}
+
+fn validate_optional_overlay_limit(
+    recipient: &str,
+    label: &str,
+    defaults: u128,
+    overlay: u128,
+) -> Result<()> {
+    match (defaults == 0, overlay == 0) {
+        (true, false) => bail!(
+            "destination override for {recipient} must keep {label} disabled because the default value is disabled"
+        ),
+        (false, true) => bail!(
+            "destination override for {recipient} must keep {label} enabled because the default value is enabled"
+        ),
+        _ if overlay > defaults => bail!(
+            "destination override for {recipient} must not increase {label} above the default value"
+        ),
+        _ => Ok(()),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{
+        build_bootstrap_panel_lines, build_token_panel_lines, handle_key_event,
+        resolve_all_token_manual_approval_policies, resolve_all_token_policies, AppState,
+        ChainProfile, Field, KeyCode, KeyEvent, KeyModifiers, LoopAction, TokenChainProfile,
+        TokenDestinationOverrideProfile, TokenManualApprovalProfile, TokenPolicyProfile,
+        TokenProfile, View, WlfiConfig,
+    };
+    use crate::shared_config::WalletProfile;
+    use std::collections::BTreeMap;
+    use std::fs;
+    use uuid::Uuid;
+
+    fn sample_policy(per_tx: &str, daily: &str, weekly: &str) -> TokenPolicyProfile {
+        TokenPolicyProfile {
+            per_tx_amount: None,
+            daily_amount: None,
+            weekly_amount: None,
+            per_tx_amount_decimal: Some(per_tx.to_string()),
+            daily_amount_decimal: Some(daily.to_string()),
+            weekly_amount_decimal: Some(weekly.to_string()),
+            per_tx_limit: Some(per_tx.to_string()),
+            daily_limit: Some(daily.to_string()),
+            weekly_limit: Some(weekly.to_string()),
+            max_gas_per_chain_wei: Some("1000000000000000".to_string()),
+            daily_max_tx_count: Some("0".to_string()),
+            per_tx_max_fee_per_gas_gwei: Some("25".to_string()),
+            per_tx_max_fee_per_gas_wei: Some("25000000000".to_string()),
+            per_tx_max_priority_fee_per_gas_wei: Some("0".to_string()),
+            per_tx_max_calldata_bytes: Some("0".to_string()),
+            extra: BTreeMap::new(),
+        }
+    }
+
+    fn empty_config() -> WlfiConfig {
+        WlfiConfig {
+            rpc_url: None,
+            chain_id: None,
+            chain_name: None,
+            daemon_socket: None,
+            state_file: None,
+            rust_bin_dir: None,
+            agent_key_id: None,
+            agent_auth_token: None,
+            wallet: None,
+            chains: BTreeMap::new(),
+            tokens: BTreeMap::new(),
+            extra: BTreeMap::new(),
+        }
+    }
+
+    fn sample_config() -> WlfiConfig {
+        let mut config = empty_config();
+        config.chains.insert(
+            "sepolia".to_string(),
+            ChainProfile {
+                chain_id: 11155111,
+                name: "sepolia".to_string(),
+                rpc_url: Some("https://rpc.sepolia.example".to_string()),
+                extra: BTreeMap::new(),
+            },
+        );
+        config.chains.insert(
+            "base".to_string(),
+            ChainProfile {
+                chain_id: 8453,
+                name: "base".to_string(),
+                rpc_url: Some("https://mainnet.base.example".to_string()),
+                extra: BTreeMap::new(),
+            },
+        );
+        config.tokens.insert(
+            "usdc".to_string(),
+            TokenProfile {
+                name: Some("USD Coin".to_string()),
+                symbol: "USDC".to_string(),
+                default_policy: Some(sample_policy("10", "100", "500")),
+                destination_overrides: vec![TokenDestinationOverrideProfile {
+                    recipient: "0x1000000000000000000000000000000000000001".to_string(),
+                    limits: sample_policy("5", "50", "200"),
+                }],
+                manual_approval_policies: vec![TokenManualApprovalProfile {
+                    priority: 120,
+                    recipient: None,
+                    min_amount: None,
+                    max_amount: None,
+                    min_amount_decimal: Some("250".to_string()),
+                    max_amount_decimal: Some("500".to_string()),
+                    min_amount_wei: None,
+                    max_amount_wei: None,
+                    extra: BTreeMap::new(),
+                }],
+                chains: BTreeMap::from([
+                    (
+                        "sepolia".to_string(),
+                        TokenChainProfile {
+                            chain_id: 11155111,
+                            is_native: false,
+                            address: Some("0x1000000000000000000000000000000000000000".to_string()),
+                            decimals: 6,
+                            default_policy: Some(sample_policy("10", "100", "500")),
+                            extra: BTreeMap::new(),
+                        },
+                    ),
+                    (
+                        "base".to_string(),
+                        TokenChainProfile {
+                            chain_id: 8453,
+                            is_native: false,
+                            address: Some("0x2000000000000000000000000000000000000000".to_string()),
+                            decimals: 6,
+                            default_policy: Some(sample_policy("10", "100", "500")),
+                            extra: BTreeMap::new(),
+                        },
+                    ),
+                ]),
+                extra: BTreeMap::new(),
+            },
+        );
+        config
+    }
+
+    #[test]
+    fn tokens_view_is_default_and_not_numbered() {
+        let app = AppState::from_shared_config(&sample_config(), false);
+        assert_eq!(app.view, View::Tokens);
+        assert_eq!(app.visible_fields()[0], Field::SelectedToken);
+    }
+
+    #[test]
+    fn token_panel_mentions_overrides_and_manual_approvals() {
+        let app = AppState::from_shared_config(&sample_config(), false);
+        let rendered = build_token_panel_lines(&app)
+            .into_iter()
+            .map(|line| line.to_string())
+            .collect::<Vec<_>>()
+            .join("\n");
+        assert!(rendered.contains("USD Coin (usdc)"));
+        assert!(rendered.contains("overrides 1"));
+        assert!(rendered.contains("manual approvals 1"));
+    }
+
+    #[test]
+    fn build_params_expands_multi_network_token_and_manual_approval() {
+        let app = AppState::from_shared_config(&sample_config(), false);
+        let params = app.build_params().expect("params");
+        assert_eq!(params.token_policies.len(), 2);
+        assert_eq!(params.token_destination_overrides.len(), 2);
+        assert_eq!(params.token_manual_approval_policies.len(), 2);
+    }
+
+    #[test]
+    fn build_params_skips_empty_destination_override_limits() {
+        let mut config = sample_config();
+        if let Some(token) = config.tokens.get_mut("usdc") {
+            token.destination_overrides = vec![TokenDestinationOverrideProfile {
+                recipient: "0x1000000000000000000000000000000000000001".to_string(),
+                limits: TokenPolicyProfile::default(),
+            }];
+        }
+
+        let app = AppState::from_shared_config(&config, false);
+        let params = app.build_params().expect("params");
+        assert_eq!(params.token_policies.len(), 2);
+        assert_eq!(params.token_destination_overrides.len(), 0);
+    }
+
+    #[test]
+    fn build_params_reuses_existing_wallet_metadata_when_available() {
+        let mut config = sample_config();
+        config.wallet = Some(WalletProfile {
+            vault_key_id: Some("11111111-1111-1111-1111-111111111111".to_string()),
+            vault_public_key: "031111111111111111111111111111111111111111111111111111111111111111"
+                .to_string(),
+            address: Some("0x1111111111111111111111111111111111111111".to_string()),
+            agent_key_id: Some("22222222-2222-2222-2222-222222222222".to_string()),
+            policy_attachment: "policy_set".to_string(),
+            attached_policy_ids: Vec::new(),
+            policy_note: None,
+            network_scope: None,
+            asset_scope: None,
+            recipient_scope: None,
+            extra: BTreeMap::new(),
+        });
+
+        let app = AppState::from_shared_config(&config, false);
+        let params = app.build_params().expect("params");
+        assert_eq!(
+            params
+                .existing_vault_key_id
+                .map(|value| value.to_string())
+                .as_deref(),
+            Some("11111111-1111-1111-1111-111111111111")
+        );
+        assert_eq!(
+            params.existing_vault_public_key.as_deref(),
+            Some("031111111111111111111111111111111111111111111111111111111111111111")
+        );
+    }
+
+    #[test]
+    fn resolve_manual_approval_uses_all_token_networks() {
+        let config = sample_config();
+        let token_policies = resolve_all_token_policies(&config).expect("token policies");
+        let manual = resolve_all_token_manual_approval_policies(&config, &token_policies)
+            .expect("manual approvals");
+        assert_eq!(manual.len(), 2);
+        assert_eq!(manual[0].priority, 120);
+    }
+
+    #[test]
+    fn network_membership_toggle_adds_saved_network_to_new_token() {
+        let config = sample_config();
+        let mut app = AppState::from_shared_config(&config, false);
+        app.new_token_draft();
+        app.selected = app
+            .visible_fields()
+            .iter()
+            .position(|field| *field == Field::NetworkMembership)
+            .expect("network membership field");
+
+        let _ = handle_key_event(&mut app, KeyEvent::new(KeyCode::Enter, KeyModifiers::NONE))
+            .expect("handle");
+
+        assert_eq!(app.token_draft.networks.len(), 1);
+    }
+
+    #[test]
+    fn bootstrap_panel_mentions_manual_approval_counts() {
+        let app = AppState::from_shared_config(&sample_config(), false);
+        let rendered = build_bootstrap_panel_lines(&app)
+            .into_iter()
+            .map(|line| line.to_string())
+            .collect::<Vec<_>>()
+            .join("\n");
+        assert!(rendered.contains("2 destination override(s); 2 manual approval policy/policies."));
+    }
+
+    #[test]
+    fn token_limit_fields_are_decimal_strings_not_raw_wei_labels() {
+        let config = sample_config();
+        let app = AppState::from_shared_config(&config, false);
+        assert_eq!(super::field_label(Field::PerTxLimit), "Per-Tx Limit");
+        assert_eq!(super::field_value(&app, Field::PerTxLimit), "10");
+    }
+
+    #[test]
+    fn save_token_returns_live_apply_action_when_metadata_is_complete() {
+        let config = sample_config();
+        let mut app = AppState::from_shared_config(&config, false);
+        let config_root =
+            std::env::temp_dir().join(format!("wlfi-agent-admin-save-token-{}", Uuid::new_v4()));
+        fs::create_dir_all(&config_root).expect("create temp config root");
+        app.config_path = config_root.join("config.json");
+        app.selected = app
+            .visible_fields()
+            .iter()
+            .position(|field| *field == Field::SaveToken)
+            .expect("save token field");
+
+        let action = handle_key_event(&mut app, KeyEvent::new(KeyCode::Enter, KeyModifiers::NONE))
+            .expect("handle");
+
+        match action {
+            LoopAction::ApplyAndContinue {
+                params,
+                success_message,
+            } => {
+                assert_eq!(params.token_policies.len(), 2);
+                assert!(success_message.contains("saved token 'usdc'"));
+                assert!(success_message.contains("applied to wallet"));
+            }
+            _ => panic!("expected save token to apply and continue"),
+        }
+
+        fs::remove_dir_all(config_root).expect("cleanup temp config root");
+    }
+
+    #[test]
+    fn advanced_fields_are_hidden_by_default() {
+        let app = AppState::from_shared_config(&sample_config(), false);
+        let fields = app.visible_fields();
+        assert!(fields.contains(&Field::ShowAdvanced));
+        assert!(!fields.contains(&Field::MaxGasPerChainWei));
+        assert!(!fields.contains(&Field::PerTxMaxFeePerGasGwei));
+        assert!(!fields.contains(&Field::OverrideMaxGasPerChainWei));
+    }
+
+    #[test]
+    fn advanced_fields_show_unlimited_when_enabled_without_values() {
+        let mut app = AppState::from_shared_config(&sample_config(), false);
+        app.show_advanced = true;
+        app.token_draft.limits.max_gas_per_chain_wei.clear();
+        app.token_draft.limits.daily_max_tx_count.clear();
+        app.token_draft.limits.per_tx_max_fee_per_gas_gwei.clear();
+        app.token_draft
+            .limits
+            .per_tx_max_priority_fee_per_gas_wei
+            .clear();
+        app.token_draft.limits.per_tx_max_calldata_bytes.clear();
+
+        assert_eq!(
+            super::field_value(&app, Field::MaxGasPerChainWei),
+            "unlimited"
+        );
+        assert_eq!(
+            super::field_value(&app, Field::DailyMaxTxCount),
+            "unlimited"
+        );
+        assert_eq!(
+            super::field_value(&app, Field::PerTxMaxFeePerGasGwei),
+            "unlimited"
+        );
+    }
+
+    #[test]
+    fn native_token_address_field_is_rendered_as_native() {
+        let app = AppState::from_shared_config(&WlfiConfig::default(), false);
+        assert_eq!(super::field_value(&app, Field::NetworkAddress), "native");
+    }
+}