diff --git a/.cursorignore b/.cursorignore
index 7c4ce5e264e..d888e092815 100644
--- a/.cursorignore
+++ b/.cursorignore
@@ -1,2 +1,3 @@
 env.json
 config.json
+keys.json
diff --git a/.gitignore b/.gitignore
index 78d20f38cd2..a366be5783e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,7 +8,11 @@ temp/
 /android/app/google-services.json
 /android/google-java-format-*.jar
 /deploy-config.json
+/edgeKey.json
 /env.json
+/config.json
+/keys.json
+/keys.*.json
 /fastlane.json
 /ios/edge/GoogleService-Info.plist
 /ios/Pods/
@@ -17,6 +21,7 @@ IDEWorkspaceChecks.plist
 android-release.bundle.map
 ios-release.bundle.map
 keystores/
+/.edgeApiSigner.stamp
 
 # Debugging
 overrideTheme.json
@@ -35,6 +40,16 @@ coverage/
 # Generated headers
 /android/app/src/main/java/co/edgesecure/app/EdgeApiKey.java
 /ios/EdgeApiKey.swift
+/ios/EdgeApiSecret.c
+/ios/EdgeApiSecret.h
+/android/app/src/main/cpp/edge_api_secret.c
+/android/app/src/main/cpp/edge_api_secret.h
+/native/edge-api-signer/node/edge_api_secret.c
+/native/edge-api-signer/node/edge_api_secret.h
+/native/edge-api-signer/node/build/
+/vendor/*.tgz
+/vendor/edge-core-js-*.tgz
+/*.tgz
 
 # Checkpoint jsons
 /android/app/src/main/assets/saplingtree/
@@ -128,3 +143,13 @@ yarn-error.log
 !.yarn/sdks
 !.yarn/versions
 /.husky/_
+
+# Edge CLI runtime
+.edge-cli/
+
+# Built CLI
+lib/
+
+
+# Maestro run output
+/reports/
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d619f314a08..601c59a25d1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,7 +4,9 @@
 
 ## 4.51.0 (staging)
 
+- added: Native Edge API HMAC signer (`edgeKey.json` + XOR-split C shards) so login-server requests can be signed outside the JS bundle via `apiSigner`, with JS `KEYS.EDGE_API_*` remaining as a fallback.
 - added: Push info-server attestation tokens into edge-core-js via `setAttestationToken` so the login server can skip CAPTCHA for attested devices, and allow `LOGIN_SERVER` / `INFO_SERVER` env overrides for local E2E stacks.
+- added: Remote signed `GET /v1/infoRollup/:appId` `appKeys` fetch so plugin secrets can rotate without an app release, with DeviceSettings cache and baked-in `keys.json` fallback
 - added: App/device attestation for gated info-server requests
 - added: Swapter swap provider
 - added: "-m" tag on the version number in the Help scene for Maestro test builds
@@ -14,6 +16,8 @@
 - changed: Adopt the iOS UIScene lifecycle, removing the deprecated app-delegate window and lifecycle APIs ahead of Xcode 27.
 - changed: Target Android 16 (API level 36), which Google Play requires for app updates submitted after Aug 30, 2026. Predictive back is opted out of for now, since React Native 0.79 cannot handle it, so the back button behaves exactly as it did before.
 - changed: Sign MoonPay buy/sell widget URLs and bind them to the customer's IP via the info server, for MoonPay's on-ramp IP-matching security upgrade.
+- changed: Split runtime `env.json` into non-secret `config.json` and secret `keys.json`; deploy-config branch overrides move from `envJson` to `configJson`/`keysJson` (legacy `envJson` is ignored on this GUI)
+- changed: Replace the flat `ENV` singleton with separate `CONFIG`, `KEYS`/`globalKeys`, and `pluginMaps` accessors (no top-level globalKeys flatten)
 - changed: Style the entire "Already have an account? Sign in" line in the getting-started USP carousel with the tertiary link color, not just "Sign in".
 - changed: Refresh the buy, sell, sort, scan-QR and FIO names icons to the updated design.
 - changed: Display "MoonPay" instead of "Moonpay" wherever the partner name appears in the app.
diff --git a/README.md b/README.md
index 986f7a9be7e..60cd0fc9c62 100644
--- a/README.md
+++ b/README.md
@@ -41,11 +41,11 @@ This project uses npm to manage Javascript dependencies (npm ships with Node).
 
 This bundler process needs to run in the background, so feel free to run this in its own terminal window.
 
-### Add API key in env.json
+### Add API key in keys.json
 
 A public API key is built into the edge-core-js which can be used to build and test the Edge app. This key is severely rate limited and should not be used for production. For production use, get an API key by emailing info@edge.app.
 
-Change the `AIRBITZ_API_KEY` in `env.json` to the API key you received from Edge. To use the public API key, leave `AIRBITZ_API_KEY` blank.
+`npm run prepare` creates `config.json` (non-secret) and `keys.json` (secret) with defaults. Set `EDGE_API_KEY` in `keys.json` to the key you received from Edge. To use the public API key, leave `EDGE_API_KEY` blank. If you still have a legacy `env.json`, run `npm run split-env-json` once to produce the two files.
 
 ### Run the app in debug mode
 
diff --git a/WIP_README_DELETE_ME.md b/WIP_README_DELETE_ME.md
new file mode 100644
index 00000000000..139bdf8b164
--- /dev/null
+++ b/WIP_README_DELETE_ME.md
@@ -0,0 +1,52 @@
+# WIP — delete this file before a production PR
+
+This file records temporary state that exists only while `paul/cli` is in
+progress. **None of it should reach a production pull request.** When the
+blockers below clear, delete this file along with the workarounds it describes.
+
+## This branch does not compile from a clean clone
+
+`tsc` reports five errors, and `npm run precommit` therefore fails:
+
+```
+src/cli/engine/fetchPluginKeys.ts   Module '"edge-core-js"' has no exported member 'EdgeApiSigner'
+src/cli/engine/nodeApiSigner.ts     Module '"edge-core-js"' has no exported member 'EdgeApiSigner'
+src/util/edgeApiSigner.ts           Module '"edge-core-js"' has no exported member 'EdgeApiSigner'
+src/util/keysServer.ts              Module '"edge-core-js"' has no exported member 'EdgeApiSigner'
+src/components/services/EdgeCoreManager.tsx
+                                    Property 'apiSigner' does not exist on type 'EdgeContextOptions'
+```
+
+`package.json` asks for `edge-core-js@^2.48.1`, which is the newest published
+version and does not export `EdgeApiSigner`. The five files above are all new
+on this branch and all need it.
+
+### Working around it
+
+Pack `edge-core-js` from its own worktree and install the tarball here. The
+`.tgz` files in the repository root are the packs already made for this — they
+are gitignored, so they exist only on machines that built them.
+
+```bash
+npm install --no-save ./edge-core-js-<version>-<stamp>.tgz
+```
+
+`--no-save` is deliberate: pointing `package.json` at a gitignored tarball
+would break the build for everyone else. That leaves `package.json` and
+`node_modules` disagreeing, which is the whole reason this file exists.
+
+### Clearing it
+
+Either is enough, and both make this section obsolete:
+
+- `edge-core-js` publishes a release exporting `EdgeApiSigner`, and
+  `package.json` moves to it; or
+- the `apiSigner` work comes out of this branch and ships separately.
+
+## Checklist before opening a production PR
+
+- [ ] `EdgeApiSigner` resolves from a published `edge-core-js`
+- [ ] `npx tsc --noEmit` is clean with no `--no-save` install
+- [ ] `npm run precommit` passes from a fresh `npm ci`
+- [ ] No `*.tgz` in the repository root
+- [ ] Delete this file
diff --git a/android/app/build.gradle b/android/app/build.gradle
index f9e22b0d811..7feadb4d03e 100644
--- a/android/app/build.gradle
+++ b/android/app/build.gradle
@@ -103,6 +103,19 @@ android {
         ndk {
             abiFilters 'armeabi-v7a', 'arm64-v8a' // Exclude Intel
         }
+        externalNativeBuild {
+            cmake {
+                cppFlags ""
+                arguments "-DANDROID_STL=c++_shared"
+            }
+        }
+    }
+
+    externalNativeBuild {
+        cmake {
+            path file("src/main/cpp/CMakeLists.txt")
+            version "3.22.1"
+        }
     }
 
     // Edge addition: sideloadable per-ABI APKs for distribution outside
@@ -395,3 +408,55 @@ if (!sentrySlug.contains('SENTRY_ORGANIZATION')) {
       telemetry = true
   }
 }
+
+// Gradle daemons started from Android Studio inherit a minimal PATH that
+// usually lacks nvm / Homebrew node, so reuse the NODE_BINARY that the React
+// Native iOS build already depends on before falling back to a PATH lookup.
+def resolveNodeBinary(File repoRoot) {
+    def pattern = ~'^\\s*export\\s+NODE_BINARY=(.+)$'
+    for (String name : ['ios/.xcode.env.local', 'ios/.xcode.env']) {
+        File file = new File(repoRoot, name)
+        if (!file.exists()) continue
+        for (String line : file.readLines()) {
+            def matcher = pattern.matcher(line)
+            if (!matcher.find()) continue
+            String value = matcher.group(1).trim().replaceAll('^["\']|["\']$', '')
+            // Skip `$(command -v node)` and friends: this is not a shell.
+            if (value.contains('$')) continue
+            if (new File(value).canExecute()) return value
+        }
+    }
+    return 'node'
+}
+
+// Regenerate XOR-split API secret C sources and EdgeApiKey.{swift,java} before
+// every native build. Explicitly clear ALLOW_STUB so a stub from `npm prepare`
+// cannot leak into the signer outputs.
+def nodeBinary = resolveNodeBinary(rootProject.projectDir.parentFile)
+tasks.register("generateEdgeApiSigner", Exec) {
+    def repoRoot = rootProject.projectDir.parentFile
+    workingDir repoRoot
+    environment "EDGE_API_SIGNER_ALLOW_STUB", ""
+    commandLine nodeBinary, "-r", "sucrase/register", "./scripts/makeApiSigner.ts"
+}
+// Same edgeKey.json feeds EdgeApiKey used by native push registration; keep it
+// in lockstep with the signer so a key rotation cannot leave AppDelegate /
+// MessagesWorker on the previous public key.
+tasks.register("generateEdgeApiKeyHeaders", Exec) {
+    def repoRoot = rootProject.projectDir.parentFile
+    workingDir repoRoot
+    commandLine nodeBinary, "-r", "sucrase/register", "./scripts/makeNativeHeaders.ts"
+}
+generateEdgeApiKeyHeaders.dependsOn("generateEdgeApiSigner")
+preBuild.dependsOn("generateEdgeApiKeyHeaders")
+
+// edge_api_secret.c is gitignored but listed in CMakeLists.txt, and the CMake
+// configure/build tasks do not run behind preBuild, so wire them up directly
+// or a fresh checkout fails with "Cannot find source file".
+tasks.matching {
+    it.name.startsWith("configureCMake") ||
+        it.name.startsWith("buildCMake") ||
+        it.name.startsWith("externalNativeBuild")
+}.configureEach {
+    dependsOn("generateEdgeApiSigner")
+}
diff --git a/android/app/src/main/cpp/CMakeLists.txt b/android/app/src/main/cpp/CMakeLists.txt
new file mode 100644
index 00000000000..8ceef11d6d4
--- /dev/null
+++ b/android/app/src/main/cpp/CMakeLists.txt
@@ -0,0 +1,27 @@
+cmake_minimum_required(VERSION 3.18.1)
+project(edge_api_signer)
+
+set(NATIVE_SIGNER_DIR "${CMAKE_SOURCE_DIR}/../../../../../native/edge-api-signer")
+
+add_library(
+  edge_api_signer
+  SHARED
+  edge_api_secret.c
+  edge_api_signer_jni.c
+  "${NATIVE_SIGNER_DIR}/edge_hmac.c"
+)
+
+target_include_directories(
+  edge_api_signer
+  PRIVATE
+  ${CMAKE_SOURCE_DIR}
+  ${NATIVE_SIGNER_DIR}
+)
+
+target_compile_options(edge_api_signer PRIVATE -fvisibility=hidden -O2)
+
+# Pixel / Android 15+: 16 KB page-size ELF alignment
+target_link_options(edge_api_signer PRIVATE "-Wl,-z,max-page-size=16384")
+
+find_library(log-lib log)
+target_link_libraries(edge_api_signer ${log-lib})
diff --git a/android/app/src/main/cpp/edge_api_signer_jni.c b/android/app/src/main/cpp/edge_api_signer_jni.c
new file mode 100644
index 00000000000..17eabf56ea5
--- /dev/null
+++ b/android/app/src/main/cpp/edge_api_signer_jni.c
@@ -0,0 +1,95 @@
+#include <jni.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "edge_api_sign.h"
+
+static void throw_by_name(JNIEnv *env, const char *class_name, const char *msg) {
+  jclass ex = (*env)->FindClass(env, class_name);
+  if (ex != NULL) {
+    (*env)->ThrowNew(env, ex, msg);
+  }
+}
+
+static void throw_illegal_argument(JNIEnv *env, const char *msg) {
+  throw_by_name(env, "java/lang/IllegalArgumentException", msg);
+}
+
+static void throw_runtime(JNIEnv *env, const char *msg) {
+  throw_by_name(env, "java/lang/RuntimeException", msg);
+}
+
+JNIEXPORT jbyteArray JNICALL
+Java_co_edgesecure_app_EdgeApiSignerModule_nativeSignMessage(
+  JNIEnv *env,
+  jobject thiz,
+  jbyteArray message_utf8,
+  jbyteArray package_name_utf8
+) {
+  if (message_utf8 == NULL || package_name_utf8 == NULL) {
+    throw_illegal_argument(env, "messageUtf8 and packageNameUtf8 are required");
+    return NULL;
+  }
+
+  jsize msg_len = (*env)->GetArrayLength(env, message_utf8);
+  jbyte *msg_bytes = (*env)->GetByteArrayElements(env, message_utf8, NULL);
+  if (msg_bytes == NULL) return NULL;
+
+  jsize pkg_len = (*env)->GetArrayLength(env, package_name_utf8);
+  jbyte *pkg_bytes = (*env)->GetByteArrayElements(env, package_name_utf8, NULL);
+  if (pkg_bytes == NULL) {
+    (*env)->ReleaseByteArrayElements(env, message_utf8, msg_bytes, JNI_ABORT);
+    return NULL;
+  }
+
+  /* edge_api_hmac_sign expects a C string bundle id (NUL-terminated). */
+  char *bundle_id = (char *)malloc((size_t)pkg_len + 1);
+  if (bundle_id == NULL) {
+    (*env)->ReleaseByteArrayElements(env, message_utf8, msg_bytes, JNI_ABORT);
+    (*env)->ReleaseByteArrayElements(env, package_name_utf8, pkg_bytes, JNI_ABORT);
+    throw_by_name(env, "java/lang/OutOfMemoryError", "bundle id allocation failed");
+    return NULL;
+  }
+  memcpy(bundle_id, pkg_bytes, (size_t)pkg_len);
+  bundle_id[pkg_len] = '\0';
+
+  uint8_t signature[32];
+  int rc = edge_api_hmac_sign(
+    (const uint8_t *)msg_bytes,
+    (size_t)msg_len,
+    bundle_id,
+    signature
+  );
+  (*env)->ReleaseByteArrayElements(env, message_utf8, msg_bytes, JNI_ABORT);
+  (*env)->ReleaseByteArrayElements(env, package_name_utf8, pkg_bytes, JNI_ABORT);
+  free(bundle_id);
+
+  if (rc != 0) {
+    throw_runtime(env, "edge_api_hmac_sign failed");
+    return NULL;
+  }
+
+  /* nativeSignMessage is declared non-null in Kotlin, so a bare NULL return
+     would surface as an NPE far from its cause. */
+  jbyteArray out = (*env)->NewByteArray(env, 32);
+  if (out == NULL) {
+    throw_by_name(env, "java/lang/OutOfMemoryError", "signature allocation failed");
+    return NULL;
+  }
+  (*env)->SetByteArrayRegion(env, out, 0, 32, (const jbyte *)signature);
+  memset(signature, 0, sizeof(signature));
+  return out;
+}
+
+JNIEXPORT jstring JNICALL
+Java_co_edgesecure_app_EdgeApiSignerModule_nativeApiKey(
+  JNIEnv *env,
+  jobject thiz
+) {
+  jstring out = (*env)->NewStringUTF(env, edge_api_key());
+  if (out == NULL) {
+    throw_runtime(env, "apiKey allocation failed");
+  }
+  return out;
+}
diff --git a/android/app/src/main/java/co/edgesecure/app/EdgeApiSignerModule.kt b/android/app/src/main/java/co/edgesecure/app/EdgeApiSignerModule.kt
new file mode 100644
index 00000000000..68e3e309f90
--- /dev/null
+++ b/android/app/src/main/java/co/edgesecure/app/EdgeApiSignerModule.kt
@@ -0,0 +1,82 @@
+package co.edgesecure.app
+
+import com.facebook.react.bridge.Arguments
+import com.facebook.react.bridge.Promise
+import com.facebook.react.bridge.ReactApplicationContext
+import com.facebook.react.bridge.ReactContextBaseJavaModule
+import com.facebook.react.bridge.ReactMethod
+import com.facebook.react.bridge.WritableMap
+import android.util.Base64
+import java.nio.charset.StandardCharsets
+
+/**
+ * React Native bridge to the native HMAC API signer.
+ * The secret never enters Java as a contiguous plaintext constant.
+ */
+class EdgeApiSignerModule(
+  reactContext: ReactApplicationContext,
+) : ReactContextBaseJavaModule(reactContext) {
+  companion object {
+    /**
+     * React Native constructs every module while building the package list, so
+     * an UnsatisfiedLinkError here would kill the app at startup. Record the
+     * failure instead, so EdgeApiSignerPackage can leave the module unregistered
+     * and JS sees an honestly absent signer rather than one that rejects every
+     * call.
+     */
+    val libraryLoaded: Boolean =
+      try {
+        System.loadLibrary("edge_api_signer")
+        true
+      } catch (e: UnsatisfiedLinkError) {
+        false
+      }
+  }
+
+  override fun getName(): String = "EdgeApiSigner"
+
+  @ReactMethod
+  fun signMessage(
+    message: String,
+    promise: Promise,
+  ) {
+    if (!libraryLoaded) {
+      promise.reject("EDGE_API_SIGNER", "edge_api_signer library is unavailable")
+      return
+    }
+    try {
+      // Real UTF-8 bytes for both message and packageName (not JNI Modified UTF-8).
+      val messageUtf8 = message.toByteArray(StandardCharsets.UTF_8)
+      val packageNameUtf8 =
+        reactApplicationContext.packageName.toByteArray(StandardCharsets.UTF_8)
+      val signature = nativeSignMessage(messageUtf8, packageNameUtf8)
+      val apiKey = nativeApiKey()
+      val map: WritableMap = Arguments.createMap()
+      map.putString("apiKey", apiKey)
+      map.putString("signature", Base64.encodeToString(signature, Base64.NO_WRAP))
+      promise.resolve(map)
+    } catch (e: Throwable) {
+      promise.reject("EDGE_API_SIGNER", e.message, e)
+    }
+  }
+
+  @ReactMethod
+  fun getApiKey(promise: Promise) {
+    if (!libraryLoaded) {
+      promise.reject("EDGE_API_SIGNER", "edge_api_signer library is unavailable")
+      return
+    }
+    try {
+      promise.resolve(nativeApiKey())
+    } catch (e: Throwable) {
+      promise.reject("EDGE_API_SIGNER", e.message, e)
+    }
+  }
+
+  private external fun nativeSignMessage(
+    messageUtf8: ByteArray,
+    packageNameUtf8: ByteArray,
+  ): ByteArray
+
+  private external fun nativeApiKey(): String
+}
diff --git a/android/app/src/main/java/co/edgesecure/app/EdgeApiSignerPackage.kt b/android/app/src/main/java/co/edgesecure/app/EdgeApiSignerPackage.kt
new file mode 100644
index 00000000000..cc8b928a5a3
--- /dev/null
+++ b/android/app/src/main/java/co/edgesecure/app/EdgeApiSignerPackage.kt
@@ -0,0 +1,21 @@
+package co.edgesecure.app
+
+import com.facebook.react.ReactPackage
+import com.facebook.react.bridge.NativeModule
+import com.facebook.react.bridge.ReactApplicationContext
+import com.facebook.react.uimanager.ViewManager
+
+/** Registers the EdgeApiSigner native module with React Native. */
+class EdgeApiSignerPackage : ReactPackage {
+  /**
+   * Registering a module whose JNI library is missing would make
+   * `hasNativeApiSigner()` true and steer JS away from its credential
+   * fallback, so an unusable signer is simply not registered.
+   */
+  override fun createNativeModules(reactContext: ReactApplicationContext): List<NativeModule> =
+    if (EdgeApiSignerModule.libraryLoaded) listOf(EdgeApiSignerModule(reactContext))
+    else emptyList()
+
+  override fun createViewManagers(reactContext: ReactApplicationContext): List<ViewManager<*, *>> =
+    emptyList()
+}
diff --git a/android/app/src/main/java/co/edgesecure/app/MainApplication.kt b/android/app/src/main/java/co/edgesecure/app/MainApplication.kt
index 28e44718e40..b02622f53de 100644
--- a/android/app/src/main/java/co/edgesecure/app/MainApplication.kt
+++ b/android/app/src/main/java/co/edgesecure/app/MainApplication.kt
@@ -36,6 +36,7 @@ class MainApplication :
           // packages.add(new MyReactNativePackage());
           val packages = PackageList(this).packages
           packages.add(EdgeAttestationPackage())
+          packages.add(EdgeApiSignerPackage())
           return packages
         }
 
diff --git a/babel.config.js b/babel.config.js
index 9adf2e4f163..78781a0afbd 100644
--- a/babel.config.js
+++ b/babel.config.js
@@ -4,6 +4,10 @@ module.exports = function (api) {
   return {
     presets: ['module:@react-native/babel-preset'],
     plugins: [
+      // `typechain` emits `export * as factories from './factories'` in
+      // src/plugins/contracts, which the React Native preset does not
+      // transform on its own.
+      '@babel/plugin-transform-export-namespace-from',
       isAndroid
         ? './node_modules/r3-hack/node_modules/react-native-reanimated/plugin'
         : 'react-native-worklets/plugin'
diff --git a/deploy-config.sample.json b/deploy-config.sample.json
index 54d082a4fc9..dcd6219f587 100644
--- a/deploy-config.sample.json
+++ b/deploy-config.sample.json
@@ -29,19 +29,49 @@
       "master": {
         "hockeyAppId": "xxxxxxxxx",
         "splitArchitectures": [
-          { "abi": "arm64-v8a", "zealotChannelKey": "xxxxxxxxxx" },
-          { "abi": "armeabi-v7a", "zealotChannelKey": "xxxxxxxxxx" }
+          {
+            "abi": "arm64-v8a",
+            "zealotChannelKey": "xxxxxxxxxx"
+          },
+          {
+            "abi": "armeabi-v7a",
+            "zealotChannelKey": "xxxxxxxxxx"
+          }
         ]
       },
       "develop": {
         "hockeyAppId": "xxxxxxxxx"
       }
     },
-    "envJson": {
+    "configJson": {
+      "develop": {
+        "corePlugins": { "bitcoin": true },
+        "swapPlugins": { "changelly": true },
+        "guiApiKeys": { "banxa": true, "phaze": false },
+        "rampPlugins": { "moonpay": true },
+        "ENABLE_VISA_PROGRAM": true,
+        "BETA_FEATURES": true
+      },
+      "beta": {
+        "ENABLE_VISA_PROGRAM": true,
+        "BETA_FEATURES": true
+      },
       "yolo": {
         "YOLO_USERNAME": "",
         "YOLO_PASSWORD": ""
       }
+    },
+    "keysJson": {
+      "develop": {
+        "corePlugins": { "bitcoin": { "nowNodesApiKey": "xxxxxxxxx" } },
+        "swapPlugins": { "changelly": { "apiKey": "xxxxxxxxx" } },
+        "guiApiKeys": { "banxa": { "apiKey": "xxxxxxxxx" } },
+        "rampPlugins": { "moonpay": {} },
+        "globalKeys": {
+          "WALLETCONNECT_PROJECT_ID": "xxxxxxxxx",
+          "COINGECKO_API_KEY": "xxxxxxxxx"
+        }
+      }
     }
   }
 }
diff --git a/docs/CONFIG_KEYS_ARCHITECTURE.md b/docs/CONFIG_KEYS_ARCHITECTURE.md
new file mode 100644
index 00000000000..0d5071c76fa
--- /dev/null
+++ b/docs/CONFIG_KEYS_ARCHITECTURE.md
@@ -0,0 +1,715 @@
+# Edge React GUI - Config & Keys Architecture
+
+## Overview
+
+Historically the app was configured through a single, gitignored `env.json`
+file that mixed non-secret settings (feature flags, hosts, debug options,
+plugin enablement) with real credential material (API keys, secrets, tokens) in
+one flat, `ALLCAPS_*_INIT`-keyed blob.
+
+This refactor splits that single file into three gitignored inputs and reshapes
+the schema so that plugin configuration is keyed by real plugin ID:
+
+- **`config.json`** — non-secret app/debug settings and the non-secret halves of
+  each plugin's init options. Safe to commit to a private build-config repo.
+- **`keys.json`** — every secret (API keys, tokens, credentials), including the
+  secret halves of plugin init options — **except** the Edge login HMAC
+  credentials when using the native signer.
+- **`edgeKey.json`** — `{ apiKey, apiSecret }` for Edge login HMAC. Build-time
+  only: `scripts/makeApiSigner.ts` embeds XOR-split native shards from it and
+  `scripts/makeNativeHeaders.ts` reads the public `apiKey`. The Metro bundle
+  never loads it, so `KEYS.EDGE_API_KEY` / `KEYS.EDGE_API_SECRET` are absent in
+  native-signer builds and every consumer must handle that (native
+  `EdgeApiSigner` or JS fallback).
+
+HMAC request signing (login-server via core, and info-server signed
+infoRollup) is documented in [HMAC_SIGNING.md](./HMAC_SIGNING.md).
+
+At runtime the config/keys files stay separate accessors rather than flattening into one
+`ENV` singleton:
+
+- **`CONFIG`** (`src/config.ts`) — immutable cleaned `config.json`. Never updated
+  by remote appKeys overlays.
+- **`KEYS`** / **`globalKeys`** (`src/keys.ts`) — mutable cleaned keys. Partner
+  secrets live only under `KEYS.globalKeys`; `globalKeys` is a live alias of that
+  same object (no top-level flatten onto `KEYS`).
+- **`pluginMaps`** (`src/pluginMaps.ts`) — the four resolved plugin init maps,
+  produced by `resolvePluginMaps(CONFIG, KEYS)` and rebuilt in place when keys
+  overlays apply.
+
+The split is about _where a field lives_ and _which accessor a consumer imports_.
+A golden-equivalence test still proves the merged plugin maps are
+behavior-identical to the legacy `env.json` shape for plugin inits.
+
+## Data flow
+
+```mermaid
+flowchart LR
+  configJson["config.json (non-secret)"] --> cleanC["asConfigJson.withRest"]
+  keysJson["keys.json (secret)"] --> cleanK["asKeysJson.withRest"]
+  cleanC --> CONFIG["CONFIG (immutable)"]
+  cleanK --> nest["nestGlobalKeys"]
+  nest --> baked["bakedKeys"]
+  baked --> KEYS["KEYS + globalKeys alias (mutable)"]
+  CONFIG --> resolve["resolvePluginMaps"]
+  KEYS --> resolve
+  resolve --> maps["pluginMaps"]
+  maps --> core["corePlugins.ts -> allPlugins -> edge-core"]
+  maps --> ramps["useRampPlugins.ts"]
+  maps --> gui["gift-card / revolut / walletconnect / stake consumers"]
+  CONFIG --> configConsumers["feature flags / hosts / PostHog host / YOLO_*"]
+  KEYS --> keyConsumers["EDGE_API_* / SENTRY_* / POSTHOG_API_KEY"]
+  globalKeys["globalKeys"] --> partner["CoinGecko / Kiln / StakeKit / …"]
+```
+
+Each file is validated and cleaned by its own cleaner exactly once. There is no
+union `asEnvConfig` pass over a merged blob: that would re-run single-shot codecs
+such as `EDGE_API_SECRET`'s `asBase16` transform (string ⇄ `Uint8Array`) a second
+time and fail. Runtime types are `ConfigJson`, `KeysJson`, and `RuntimeKeys`
+(after flat partner fields have been nested under `globalKeys`).
+
+### Plugin inits are no longer validated field-by-field
+
+The plugin maps hold each plugin's init options as-is. The legacy flat cleaner
+declared a cleaner per `*_INIT` field, which also meant it supplied defaults for
+fields a config file left out — `thorname: 'ej'`, `affiliateFeeBasis: '50'`,
+`appId: 'edge'`, FIO's `tpid`, and so on.
+
+Those defaults were duplicates: every plugin cleans its own init options and
+declares the same default itself, so an omitted field still ends up with the
+same value. The one exception was `guiApiKeys.paybis.partnerUrl`, whose
+consumer required the field outright, so that default now lives in
+`paybisProvider.ts` where it is used.
+
+The remaining difference is Rango: it applies a referral only when
+`referrerAddress` and `referrerFee` are both set, and no longer invents a
+`referrerFee` of `'0.75'` for a config that sets an address but no fee. Such a
+config was always ambiguous; it now takes no referral rather than a rate nobody
+wrote down.
+
+## Key modules
+
+| File                                    | Responsibility                                                                                                                                                                                   |
+| --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `src/config.ts`                         | Cleans `config.json` with `asConfigJson.withRest` and exports immutable `CONFIG`.                                                                                                                |
+| `src/keys.ts`                           | Cleans `keys.json`, nests flat partner secrets via `nestGlobalKeys`, exports immutable merge-base `bakedKeys`, mutable `KEYS`, live `globalKeys` alias, and `applyRuntimeKeys`.                  |
+| `src/pluginMaps.ts`                     | Builds `pluginMaps` via `resolvePluginMaps(CONFIG, KEYS)` and exports `rebuildPluginMaps` for in-place updates after key overlays.                                                               |
+| `src/util/keysStore.ts`                 | Tier selection, the remote/cache/baked-in resolution promise, the local-only strip list, and `applyKeys` (mutates `KEYS`/`globalKeys`, then `rebuildPluginMaps` + `rebuildAllPlugins`). Prefers native `apiSigner` for signed infoRollup when linked. |
+| `src/util/keysServer.ts`                | Signs and issues `GET /v1/infoRollup/:appId` (JS HMAC or `apiSigner`), extracts `appKeys`, and validates the overlay shape.                                                                                                                              |
+| `src/util/edgeApiSigner.ts`             | Detects the native `EdgeApiSigner` module, builds the core's `apiSigner`, and caches the public `apiKey` for push / notification callers.                                                                                                     |
+| `src/configKeysMerge.ts`                | Runtime merge layer: `deepMerge`, `mergePluginInit`, `nestGlobalKeys`, `resolvePluginMaps`, and `asMergeableKeys`. Also holds redaction helpers for unit tests.                                  |
+| `src/configKeysSchema.ts`               | Per-file cleaners `asConfigJson` (non-secret) and `asKeysJson` (secret), `globalKeysShape` / `asGlobalKeys`, and the `ConfigJson` / `KeysJson` / `RuntimeKeys` / `GlobalKeys` types.             |
+| `scripts/splitEnvJson.ts`               | Migration-only CLI (`npm run split-env-json`) that classifies a legacy `env.json` and writes `config.json` + `keys.json` + `edgeKey.json`. Never prints secrets; `--force` to overwrite. Not imported by the app. |
+| `src/__tests__/configKeysMerge.test.ts` | Golden-equivalence + deep-merge + redaction unit tests.                                                                                                                                          |
+| `scripts/configure.ts`                  | Runs `makeConfig(asConfigJson.withRest, 'config.json')` and `makeConfig(asKeysJson.withRest, 'keys.json')` so `prepare` can bootstrap both files without writing secrets into `config.json`.     |
+
+## The CONFIG / KEYS / pluginMaps schema
+
+`asConfigJson` and `asKeysJson` (`src/configKeysSchema.ts`) define the two
+on-disk shapes. Only plugin-owned data was re-keyed; everything else keeps its
+historical name and shape (`ACTION_QUEUE`, `LOG_CONFIG`, `LOG_SERVER`,
+`THEME_SERVER`, `DEBUG_*`, `APP_CONFIG`, `EDGE_API_KEY`, `SENTRY_*`, `KILN_*`,
+`YOLO_*`, etc.) — but consumers now import the accessor that owns the field.
+
+**Schema is not the same as a data file.** Each cleaner validates one file.
+A secret field such as `EDGE_API_KEY` or `SENTRY_DSN_URL` appearing in
+`asKeysJson` does **not** mean its value lives in `config.json` — the value comes
+from `keys.json`; the cleaner only types that file.
+
+There is no runtime union cleaner that splat-merges both shapes into one object.
+Ownership is enforced by keeping the accessors separate:
+
+```ts
+export const asConfigJson = asObject({
+  corePlugins, swapPlugins, guiApiKeys, rampPlugins, // shared plugin maps
+  ...non-secret config fields
+})
+
+export const asKeysJson = asObject({
+  corePlugins, swapPlugins, guiApiKeys, rampPlugins, // secret-bearing plugin maps
+  globalKeys: asOptional(asGlobalKeys, () => ({})),
+  ...globalKeysShape, // legacy flat partner keys still accepted on disk
+  ...secret fields // EDGE_API_*, SENTRY_*, POSTHOG_API_KEY, …
+})
+
+// RuntimeKeys = KeysJson without flat partner fields, with nested globalKeys
+```
+
+(`.withRest` on each cleaner preserves legacy/extra keys and the JSON "comment"
+separators the files carry.)
+
+Both per-file cleaners are actually used:
+
+- `src/config.ts` runs `asConfigJson.withRest(CONFIG_JSON)` at startup.
+- `src/keys.ts` runs `asKeysJson.withRest(KEYS_JSON)`, then `nestGlobalKeys`, so
+  **each file is validated on its own** (a malformed `keys.json`, or a secret
+  misfiled into `config.json`, fails loudly) before runtime nesting / map
+  resolution.
+- `scripts/configure.ts` runs `makeConfig` with the same cleaners for both
+  files, so `makeConfig` can never default or write a secret field into
+  `config.json`.
+
+The four plugin maps, each `Record<pluginId, init>`, live on `pluginMaps` after
+`resolvePluginMaps`:
+
+- **`corePlugins`** — edge-core currency plugin inits keyed by real edge-core
+  plugin ID (`bitcoin`, `ethereum`, `binancesmartchain`, `thorchainrune`, ...).
+  Each value is the same `object | true | false` union as before.
+- **`swapPlugins`** — swap plugin inits keyed by real swap plugin ID
+  (`changehero`, `thorchain`, `0xgasless`, ...).
+- **`guiApiKeys`** — GUI fiat / gift-card provider credentials (formerly
+  `PLUGIN_API_KEYS`: banxa, paybis, phaze, revolut, simplex, …). WalletConnect
+  is **not** in this map; its `projectId` is `globalKeys.WALLETCONNECT_PROJECT_ID`.
+- **`rampPlugins`** — ramp plugin inits (formerly `RAMP_PLUGIN_INITS`). Kept
+  distinct from `guiApiKeys` on purpose: `banxa` exists in both maps with
+  different shapes, so merging them would collide.
+
+There are **no `*_INIT` fields** left in the schema or in any consumer. The dead
+`WYRE_CLIENT_INIT` (0 consumers) and unmapped legacy `*_INIT` fields were dropped.
+
+## File ownership rule
+
+- **`config.json`** holds non-secret app/debug fields and the non-secret plugin
+  fields: `enabled` flags, `appId`, `affiliateFeeBasis`, `integrator`,
+  `thorname`, `apiHost`, `apiUrl`, `widgetUrl`, `partnerUrl`, `referralId`,
+  `feePercentage`, `feeReceiveAddress`, `host`, `port`, and the like.
+- **`keys.json`** holds all credential material: `apiKey`, `nowNodesApiKey`,
+  `evmScanApiKey`, `ninerealmsClientId`, `thorswapApiKey`, `privateKeyB64`,
+  `hmacUser`, `jwtTokenProvider`, `clientSecret`, `heliusApiKey`,
+  `alchemyApiKey`, `blockfrostProjectId`, `glifApiKey`, `subscanApiKey`,
+  `WALLETCONNECT_PROJECT_ID` (from `WALLET_CONNECT_INIT.projectId`), auth/telemetry top-level
+  fields (`EDGE_API_KEY`/`EDGE_API_SECRET`, `SENTRY_*`, `BUGSNAG_API_KEY`,
+  `POSTHOG_API_KEY`), and the partner secrets — the "global keys". On disk those
+  partner secrets may still appear **flat** at the top level for legacy files;
+  load and overlay paths run `nestGlobalKeys` so the runtime `KEYS` object keeps
+  them only under `KEYS.globalKeys` (`AZTECO_API_KEY`, `COINGECKO_API_KEY`,
+  `IP_API_KEY`, `STAKEKIT_API_KEY`, `UNSTOPPABLE_DOMAINS_API_KEY`,
+  `WALLETCONNECT_PROJECT_ID`, `KILN_*`, …).
+  A signed infoRollup `appKeys` overlay delivers the same partner secrets nested
+  under a `globalKeys` section; the client keeps that nesting (no top-level
+  flatten onto `KEYS`). `YOLO_*` and `POSTHOG_API_HOST` live in `config.json`
+  (local-only developer / host wiring, never served).
+
+Both files are gitignored (`.gitignore` lists `/config.json` and `/keys.json`
+alongside the retained `/env.json`).
+
+## Merge semantics (`resolvePluginMaps` / `nestGlobalKeys`)
+
+`src/configKeysMerge.ts` combines config enablement with keys secrets into the
+resolved `pluginMaps`, and normalizes partner secrets under `globalKeys`:
+
+1. **`CONFIG` top-level fields** stay on `CONFIG` only. They are never overwritten
+   by appKeys overlays (`keysStore` also drops non-`asKeysJson` fields from
+   overlays via `keepKeysFields`).
+2. **`KEYS` top-level secret fields** (`EDGE_API_*`, `SENTRY_*`, `POSTHOG_API_KEY`,
+   plugin maps, …) live on `KEYS`. Remote/cache overlays deep-merge onto
+   `bakedKeys` with keys winning on collision.
+3. **Partner `globalKeys`** — flat on-disk partner fields and any nested
+   `globalKeys` section are normalized by `nestGlobalKeys`. Consumers read
+   `globalKeys.COINGECKO_API_KEY` (or `KEYS.globalKeys.…`); there is no
+   top-level `KEYS.COINGECKO_API_KEY` after nesting.
+4. **Currency & swap plugins** — for each ID present in config or keys
+   `corePlugins` / `swapPlugins` (union), the non-secret config value is
+   combined with the matching secret from `KEYS.corePlugins[id]` /
+   `KEYS.swapPlugins[id]` via `mergePluginInit`:
+   - a `false` config value keeps the plugin disabled (secrets ignored);
+   - a `true`/absent config value with an object secret becomes the secret
+     object (an object always wins over a bare boolean enablement flag);
+   - otherwise the two are deep-merged with the keys side winning.
+   Extra remote IDs on `pluginMaps.corePlugins` do **not** register a new
+   engine — `corePlugins.ts` is a hardcoded table.
+5. **GUI provider keys (`guiApiKeys`)** — union of config and keys IDs, merged
+   per ID. Currency/swap secrets do not live here.
+6. **Ramp plugins (`rampPlugins`)** — `CONFIG.rampPlugins[id]` deep-merged with
+   `KEYS.rampPlugins[id]` per ID.
+
+Objects are merged field-by-field; arrays and primitives replace wholesale;
+`undefined` on either side yields the other side.
+
+## How the legacy file was split (`scripts/splitEnvJson.ts`)
+
+`splitEnv` converts a flat legacy `env.json` object into `{ config, keys }`:
+
+- `CURRENCY_INIT_MAP` / `SWAP_INIT_MAP` map each `*_INIT` field name to its real
+  edge-core plugin ID (e.g. `THORCHAIN_INIT` → `thorchainrune` for currency and
+  `thorchain` for swap).
+- `isSecretField` (a field-name regex) and `isSecretTopLevel` classify each
+  field. Secret-looking fields go to `keys.json`; the rest go to `config.json`.
+- `PLUGIN_API_KEYS` → `guiApiKeys`, `RAMP_PLUGIN_INITS` → `rampPlugins`.
+- `POSTHOG_INIT` → `config.POSTHOG_API_HOST` + a flat `keys.POSTHOG_API_KEY`
+  (PostHog is not a plugin; the api key stays top-level on `KEYS` at runtime).
+- `WALLET_CONNECT_INIT.projectId` → flat `keys.WALLETCONNECT_PROJECT_ID` (then
+  nested under `globalKeys` at load). No config flag; disable = omit the key.
+- Loose partner secrets (`AZTECO_*`, `KILN_*`, CoinGecko, …) → flat top-level
+  fields in `keys.json` (nested under `globalKeys` at runtime load).
+- `YOLO_*` stays in `config.json`.
+- `WYRE_CLIENT_INIT` and any remaining unmapped `*_INIT` fields are dropped.
+
+This same function is what the golden test uses to synthesize `config`/`keys`
+in memory from the historical `env.json`, and what
+`scripts/splitEnvJson.ts` (`npm run split-env-json`) uses to write the real
+files on disk — guaranteeing the split is value-preserving.
+
+## Consumers
+
+Every reader was re-pointed from the old flat `ENV` / `*_INIT` /
+`PLUGIN_API_KEYS` / `RAMP_PLUGIN_INITS` surface to the matching accessor:
+
+- Import **`CONFIG`** for non-secret settings (`APP_CONFIG`, `DEBUG_*`,
+  `LOG_SERVER`, `POSTHOG_API_HOST`, `YOLO_*`, feature flags, …).
+- Import **`KEYS`** for top-level secrets (`EDGE_API_KEY`, `EDGE_API_SECRET`,
+  `SENTRY_*`, `POSTHOG_API_KEY`, …).
+- Import **`globalKeys`** for partner secrets (`COINGECKO_API_KEY`, `KILN_*`,
+  `STAKEKIT_API_KEY`, …).
+- Import **`pluginMaps`** for resolved plugin inits:
+  - `src/util/corePlugins.ts` — maps each edge-core plugin ID to
+    `pluginMaps.corePlugins[id]` / `pluginMaps.swapPlugins[id]`, preserving the
+    existing `true`/`false` hardcodes. Note `thorchainrune` and
+    `thorchainrunestagenet` both read `corePlugins.thorchainrune`.
+  - `src/hooks/useRampPlugins.ts` — `pluginMaps.rampPlugins[pluginId]`.
+  - `src/plugins/gui/util/initializeProviders.ts`, `fetchRevolut.ts`, and the
+    gift-card paths — `pluginMaps.guiApiKeys.*`.
+  - Inner-field readers: `FioAddressUtils.ts` (`pluginMaps.corePlugins.fio`),
+    `thorchainYield.ts` + `stakePlugins.ts` (`pluginMaps.swapPlugins.thorchain`),
+    `fantomEcosystem.ts` (`pluginMaps.corePlugins.fantom`),
+    `WalletConnectService.tsx` (`globalKeys.WALLETCONNECT_PROJECT_ID`),
+    `tracking.ts` (`KEYS.POSTHOG_API_KEY` + `CONFIG.POSTHOG_API_HOST`).
+
+## Scripts
+
+All build/deploy scripts were retargeted from `env.json` to the new files:
+`secretFiles.ts` (copies `config.json` + `keys.json` + `edgeKey.json`),
+`makeNativeHeaders.ts` (reads `{apiKey, apiSecret}` from `edgeKey.json`),
+`patchFiles.ts` (`SENTRY_*` from `keys.json`), `loggingServer.ts` + `themeServer.ts` (point at `config.json`),
+`configure.ts` (config- and keys-scoped cleaners), and `deploy.ts` + `cleaners.ts`
+(`configJson` / `keysJson` branch-override fields — already shaped like the
+files they patch).
+
+After `npm run split-env-json`, `npm run split-baked-and-server-keys` rewrites
+`keys.json` to the local-only keep-list (`slimKeysJson` / `localOnlyKeys`) and
+writes `appKeys.json` for the info-server Couch default layer: `corePlugins`,
+`swapPlugins`, `guiApiKeys`, `rampPlugins`, and nested `globalKeys`. It never
+prints secret values.
+
+---
+
+## Status of remaining Env config code
+
+The following pieces still reference the old configuration world. Each is
+listed with why it remains.
+
+### 1. `env.json` on disk — retained intentionally
+
+`env.json` is still present in the worktree and still gitignored
+(`.gitignore` and `.cursorignore`). **No active runtime code reads it.** It is
+kept as the migration source and a historical copy, per the plan's locked
+decision. The golden-equivalence test reads it opportunistically (guarded by an
+existence check) to prove parity, but the app itself does not depend on it.
+
+### 2. `scripts/splitEnvJson.ts` — committed legacy bridge
+
+The CLI deliberately contains the legacy `*_INIT` maps and the `splitEnv`
+classifier. It remains because it is the bridge that:
+
+- powers the golden-equivalence test (`src/__tests__/configKeysMerge.test.ts`),
+  and
+- regenerates local `config.json` / `keys.json` from an `env.json`
+  (`npm run split-env-json`).
+
+It references legacy names by design; it is the one place that is _supposed_ to
+know about the old shape. If `env.json` is ever fully retired, this module, the
+CLI script, and the golden test can be removed together.
+
+### 3. Temporary `[pipe]` runtime-verification logging — removed
+
+The temporary `[pipe]` harness (`logPipe` and its call sites) has been removed.
+`redactKey` / `redactValue` remain in `src/configKeysMerge.ts` for unit tests
+only.
+
+### 4. Comment / documentation references to `env.json`
+
+Non-functional mentions of `env.json` still exist in `README.md`,
+`ios/Sentry.swift`, `android/.../MainApplication.kt`, and `CHANGELOG.md`. These
+are comments/docs, not runtime code, so they do not affect behavior. They are
+reasonable follow-up cleanup (update README setup instructions and native
+comments to reference `config.json` / `keys.json`) but were out of the strict
+refactor scope.
+
+## Verification status
+
+- **Static:** deep-merge, nest/global-keys, and redaction unit tests pass;
+  `tsc --noEmit` and lint are clean across the edited files. Local
+  `config.json` / `keys.json` golden checks in `configKeysMerge.test.ts` are
+  skipped when those files are absent (typical CI), so they do not substitute
+  for a built-in fixture — run them on a developer machine that has real local
+  files when validating a split.
+- **Cross-repo:** the HMAC signing vector is asserted from both sides —
+  `src/__tests__/util/hmacAuth.test.ts` here and `src/__tests__/hmacAuth.test.ts`
+  in edge-info-server assert the same base64 digest, so the canonical signed
+  string cannot drift on one side unnoticed.
+- **Runtime pipe comparison:** abandoned; temporary logging removed.
+
+## Follow-up notes
+
+- Temporary `[pipe]` logging and the iOS/Android runtime pipe comparison are
+  removed.
+- Private build-config repos must ship `config.json` + `keys.json` instead of
+  `env.json` before release builds use this branch.
+- Deploy deep-merges explicit `configJson` / `keysJson` per-branch overrides into
+  the matching files and does not run overrides through `splitEnv`. Outer keys
+  are **git branch names** (`develop`, `beta`, `yolo`, …). Inner `keysJson[branch]`
+  is the same overlay as `info_keys` layer `keys` / signed rollup `appKeys`
+  (four maps + `globalKeys.WALLETCONNECT_PROJECT_ID`). Inner `configJson[branch]`
+  is enablement / non-secret init. See `deploy-config.sample.json`. Never-serve
+  fields (`POSTHOG_API_KEY`, `EDGE_API_*`, `SENTRY_*`, `YOLO_*`) do not belong
+  in `keysJson`. Legacy `envJson` is ignored (with a migration error when a
+  branch block exists only there) so the same file can still serve older GUI
+  builds that read it.
+- Optional: update `README.md` and native comments to reference the new files;
+  eventually retire `env.json` + `scripts/splitEnvJson.ts` together.
+
+## Remote keys via the info server (signed `infoRollup` `appKeys`)
+
+Client support for remote keys is implemented on this branch (`keysStore`,
+`keysServer`, DeviceSettings `keysCache`, EdgeCoreManager gate). The design
+notes below remain the source of truth for layering and fallbacks.
+
+The goal is to move the secrets in `keys.json` onto the Edge info server, which
+serves them from a new authenticated endpoint. `config.json` / `CONFIG` are
+unaffected — they hold no secrets and stay local, synchronous, and immutable.
+
+### Resolution order
+
+Keys resolve through three tiers, and `getKeysTier()` reports which one won so a
+runtime check can prove the remote path was exercised:
+
+| Tier       | Source                               | When it applies                                                     |
+| ---------- | ------------------------------------ | ------------------------------------------------------------------- |
+| `cache`    | `keysCache` in `DeviceSettings.json` | Any launch with a mergeable on-disk cache (does not expire)         |
+| `remote`   | Signed `GET /v1/infoRollup/:appId` `appKeys` | Cold start (no usable cache), fetch succeeded within budget         |
+| `baked-in` | `keys.json` compiled into the binary | Cold start where the fetch failed/missed budget and no usable cache |
+
+The cache takes precedence over the network rather than the other way round.
+That is deliberate and follows from "never hot-swap a running core" (see
+[Launch sequencing](#launch-sequencing)): a launch that already has keys must not
+stall on the network, so it serves the cache and refreshes in the background for
+the _next_ launch. Only a cold start with no cache has anything to wait for.
+
+A cache whose payload will not merge counts as no cache at all, so that launch
+takes the cold-start path and pays its budget. The alternative — keeping the
+cache's fast launch and skipping the fetch — would strand the app on baked-in
+keys for as long as the bad payload sits on disk, since only a successful fetch
+overwrites it. Paying the budget once repairs it.
+
+Both tiers are held to the same definition of "will not merge", `asMergeableKeys`
+in `configKeysMerge.ts`: a top-level object whose `corePlugins`, `swapPlugins`,
+`guiApiKeys`, `rampPlugins`, and `globalKeys` are objects if present. It is checked in `applyKeys`, which
+every tier passes through, and again at the fetch so a bad response never reaches
+disk. Validating only the fetch would leave the cache unguarded, and because
+`deepMerge` replaces rather than merges when the two sides disagree on type, a
+map that came back as a string or `null` would overwrite the whole baked-in map
+and strip every secret in it while the launch still reported tier `cache`.
+
+A cold start that falls through to `baked-in` because the budget expired keeps
+waiting on that fetch in the background and caches whatever it returns. The gate
+closing does not cancel the request, so without this the answer would be
+discarded and every later launch would pay the full budget again. The late
+payload is only written to disk, never folded into the running `KEYS` /
+`pluginMaps`, which is the same rule the warm path follows. A fetch that failed
+outright has nothing to wait for and simply does nothing.
+
+The on-disk cache does **not** expire. Any mergeable `keysCache` is used as a
+warm start so later launches never block on the network; a background refresh
+updates the cache for the _next_ launch. `fetchedAt` may still be recorded for
+diagnostics, but it does not gate the warm path. There is no TTL.
+
+The baked-in file is the **base layer** of a `deepMerge`, not a wholesale
+replacement, so a partial remote payload degrades gracefully instead of blanking
+fields the build already knew. Boot never blocks on the network and never shows
+an error scene for key retrieval; a failed fetch falls to the next tier and
+retries in the background.
+
+Two consequences worth stating plainly:
+
+- **`keys.json` does not go away.** It keeps its full schema with every field
+  optional. `EDGE_API_KEY` / `EDGE_API_SECRET` authenticate signed infoRollup and login
+  when the native signer is **not** linked. Native-signer builds embed those
+  credentials at compile time from `edgeKey.json` and omit them from the Metro
+  bundle; see [HMAC signing](HMAC_SIGNING.md).
+- **A shipped binary may therefore still contain partner secrets.** This work
+  _reduces_ secret exposure and enables server-side rotation; it does not make
+  the IPA/APK secret-free.
+
+### Authentication
+
+The endpoint uses HMAC `Authorization` plus a required `X-Timestamp`. That is
+the existing login-server scheme (`with-api-key.ts`) with one extra signed line.
+Canonical server behavior, layer matching, and the Couch schema live in
+[edge-info-server `docs/INFO_ROLLUP.md`](https://github.com/EdgeApp/edge-info-server/blob/master/docs/INFO_ROLLUP.md).
+
+```
+GET /v1/infoRollup/{appId}?os={ios|android}&osVersion={x.y.z}&appVersion={semver}
+Authorization:       HMAC {edgeApiKey} {base64(hmacSha256(signedString, secret))}
+X-Timestamp:         {unix seconds}
+x-attestation-token: {ES256 JWT}   // optional; invalid token → HTTP 401
+```
+
+Signed string (empty GET body):
+
+```
+GET\n/v1/infoRollup/{appId}?os=…&osVersion=…&appVersion=…\n\n{timestamp}
+```
+
+The client signs that path **including** `/v1` (`keysServer.ts` `signPath`).
+The info server verifies `req.originalUrl`. Login-server HMAC has **no**
+timestamp line and **no** freshness window.
+
+`appId` in the path is the info-rollup partner id (`config.appId ?? 'edge'`).
+It must match `info_keys` document `_id`. The attested bundle id is a different
+field: the JWT `appId` claim (`co.edgesecure.app`).
+
+Disk cache holds the **`appKeys` overlay only** (`DeviceSettings.keysCache`).
+The public rollup (promo/APY/…) stays **in-memory** on `infoServerData.rollup`.
+A 5-minute / NetInfo unsigned poll may live-update those public fields; KEYS
+never hot-swap this session. Boot is a single signed infoRollup when HMAC
+credentials exist (no parallel unsigned fetch at t=0).
+
+Native `apiSigner` is preferred when `EdgeApiSigner` is linked; otherwise JS
+HMAC uses `KEYS.EDGE_API_KEY` / `KEYS.EDGE_API_SECRET`.
+
+### Attestation-level layering
+
+Payloads are **not** a named ladder (`default` then `debug` then `hardware`)
+nested under each app. The info server walks an ordered `layers` array and
+deep-merges every row that independently matches:
+
+1. Layer `apiKeys` lists the **memo name** of the HMAC that signed the request
+   (not the presented public id).
+2. Token assurance ≥ `minAssurance` (`default` is unattested, below `debug`).
+3. `bundleIds` is `"*"` (only legal at `minAssurance: default`) **or** the JWT
+   `appId` is in the layer’s bundle list. Unattested callers never match a
+   non-wildcard bundle list.
+
+Unknown bundles are not a 403; they receive only wildcard/`default` rows.
+A present-but-invalid attestation token is HTTP 401 — the GUI must not treat
+that as “unattested floor.”
+
+**Invariant:** anything on a `"bundleIds": "*"` / `minAssurance: default` row is
+reachable by any holder of a listed HMAC. App-scoped credentials belong on rows
+that list real bundle IDs and `minAssurance` of `debug` or above.
+
+### `info_keys` document shape
+
+Couch `info_keys/<appId>` (`_id` is the rollup app ID: `edge`,
+`com.testy.wallet`, …). Lookup is the presented HMAC public id via
+`_design/api-key`. Secrets live here, not on login-server Couch (rotate both
+when minting a pair).
+
+```
+apiKeys:
+  <memo name>:
+    type: hmac
+    key: <HMAC public id in Authorization>
+    secret: <base64 HMAC secret>
+    enabled: true | false | returningOnly
+layers:
+  - comment, bundleIds, apiKeys: [<memo name>, ...], minAssurance, keys: { ... }
+```
+
+See the sample document and compile-error rules in the info-server INFO_ROLLUP
+doc. The GUI `LAYER-*` launch log (`[keys] … markers=…`) is how e2e confirms
+which overlay rows fired.
+
+### Never served
+
+The endpoint strips these even if an operator pastes them into a document:
+
+- `EDGE_API_KEY` and `EDGE_API_SECRET` — they _are_ the credentials.
+- All telemetry keys — `SENTRY_*`, `BUGSNAG_API_KEY`, and `POSTHOG_API_KEY`
+  (stripped from the payload's top-level and any `globalKeys` section; legacy
+  `pluginApiKeys.posthog` is also stripped). These stay permanently local
+  because `Sentry.init`
+  (`src/app.ts`) and the PostHog setup (`src/util/tracking.ts`) both run at
+  module scope, before any gate can exist, and crash reporting must cover the
+  launch path that fetches the keys. The consequence is that rotating a Sentry DSN
+  requires an app update.
+- Any pasted `YOLO_*` / `SENTRY_*` top-level fields (matched by prefix). YOLO
+  credentials themselves live in `config.json` on the client and are not part of
+  the keys payload.
+
+Partner globals such as `KILN_*`, `STAKEKIT_API_KEY`, and `COINGECKO_API_KEY`
+**are** served in the payload's `globalKeys` section. The client keeps them
+nested under `KEYS.globalKeys` / the exported `globalKeys` alias (no top-level
+flatten).
+
+### Impact on this document's architecture
+
+The one structural change to what is described above: secrets on `KEYS` /
+`globalKeys` / `pluginMaps` cannot be assumed final at module-evaluation time,
+because the remote fetch is asynchronous. `CONFIG` reads stay synchronous and
+immutable, while secrets move behind an awaited keys store that must be
+populated before `EdgeCoreManager` builds `allPlugins`.
+
+#### Consumers must read secrets lazily
+
+`applyKeys` mutates `KEYS` / `globalKeys` in place and then rebuilds
+`pluginMaps` (and `allPlugins`), so a consumer that reads
+`KEYS.SOME_SECRET`, `globalKeys.SOME_SECRET`, or `pluginMaps.…` **inside a
+function** picks up the remote value, while one that copies it into a
+module-scope constant does not. Metro evaluates the whole static import graph
+synchronously during bundle load, which is strictly before any network fetch can
+resolve, so a module-scope copy is always the baked-in value — permanently, and
+silently.
+
+This is a real constraint, not a theoretical one: `stakeKitUtils.ts`,
+`cardanoKilnPool.ts`, `ethereumKilnPool.ts`, `thorchainYield.ts`, and
+`fantomEcosystem.ts` all originally captured secrets this way and had to be
+converted to functions or property getters. `corePlugins.ts` is the one case that
+does not need this for the compiled plugin table, because `applyKeys` calls
+`rebuildAllPlugins()` and the `allPlugins` export is a live binding.
+
+When adding a consumer of a remotely-servable secret, read it at the point of
+use. Anything that genuinely must be read at module scope belongs in the
+never-served set below, alongside `SENTRY_*` and PostHog.
+
+### Launch sequencing
+
+Cold start (no cache) blocks on the network fetch before core plugins are built.
+Every later launch blocks only on the cache read and refreshes keys in the
+background, writing the result for the _next_ launch; refreshed keys are never
+hot-swapped into a running core.
+
+The resolution promise starts at module scope in
+`src/components/services/EdgeCoreManager.tsx`, which Metro evaluates during the
+initial bundle load, so the disk read and the signed infoRollup fetch overlap
+the rest of
+startup. The WebView is gated behind keys and does **not** overlap that work.
+The component's effect then awaits the same single-flighted promise, which has
+usually already resolved, making the warm-start gate approximately free. The
+native splash is still up at that point, so the gate is not visible.
+
+`initializeKeys()` is idempotent and **never rejects**. Both properties matter:
+it has two callers, and `EdgeCoreManager` renders `LoadingSplashScreen` until it
+resolves, so a rejection cached in the memoized promise would leave the app on
+the splash screen with no way to recover. Every failure inside it simply selects
+a lower tier.
+
+Cold-start budget, worst case:
+
+| Stage                      | Budget | Constant (`keysStore.ts`)     | Enforced          |
+| -------------------------- | ------ | ----------------------------- | ----------------- |
+| Wait for a first token     | 5 s    | `ATTESTATION_BUDGET_MS`       | yes, inside fetch |
+| Signed infoRollup          | 8 s    | `COLD_FETCH_TIMEOUT_MS`       | no, share only    |
+| **Deadline raced**         | 13 s   | `COLD_TOTAL_TIMEOUT_MS`       | yes, the gate     |
+| Settings read (warm path)  | 2 s    | `SETTINGS_READ_TIMEOUT_MS`    | yes, first cap    |
+| Settings salvage (cold)    | 2 s    | `SETTINGS_SALVAGE_TIMEOUT_MS` | yes, second cap   |
+
+Only two things are actually timed: the attestation wait, and the combined
+deadline the app waits on. The two stages share that one deadline rather than
+being timed separately, because attestation happens inside the promise being
+raced, and the deadline is their sum so that a slow first attestation cannot
+spend the fetch's share and abandon a request that was about to answer. The
+fetch's 8 s is therefore a share used to size the total, not a timer of its own:
+whatever is left of the 13 s once attestation settles is what the fetch gets.
+
+The network call uses `FETCH_TIMEOUT_MS` (5 s) in `keysServer.ts` as the
+`asyncWaterfall` per-server stagger (same as the helper's default), not as a
+hard ceiling on the whole signed infoRollup call. With more than one server configured the
+waterfall can outlast the 8 s share, which is why the 13 s gate — not the
+stagger — is what bounds the launch.
+
+These are ceilings on a first install with no network, not typical cost. The
+cache write is deliberately left outside the race and not awaited: a slow disk
+must not be able to discard keys already in hand, and losing the write costs one
+refetch on the next launch.
+
+#### Settings read vs salvage
+
+`SETTINGS_READ_TIMEOUT_MS` and `SETTINGS_SALVAGE_TIMEOUT_MS` are two separate
+2-second waits on the **same** `DeviceSettings.json` load, at different points
+in boot. They have the same duration. Salvage does **not** start a second disk
+read.
+
+**Settings read** is the first cap. At the start of `initializeKeys`, the store
+races `awaitDeviceSettingsDisk()` against 2 seconds.
+
+- Disk wins in time and the cache is mergeable → **warm start**: apply cache
+  now, refresh in the background, never enter the cold network gate.
+- 2 seconds elapse first → boot **continues without cache**. The disk read is
+  still in flight; in-memory `keysCache` may still be empty.
+
+That first timeout exists so a hung or slow settings file cannot stall the
+splash on every launch.
+
+**Settings salvage** is a **second** 2-second wait, only on the cold path,
+**after** the network race has settled (fetch failed, hit
+`COLD_TOTAL_TIMEOUT_MS`, or returned keys). `applyCacheFallback` races that
+same in-flight `settingsLoad` against another 2 seconds, then reads
+`getKeysCache()`.
+
+That exists because the first timeout can fire while the file is only a little
+late. Without salvage, a fast network failure right after the settings timeout
+left **no** remaining disk budget, and boot fell through to baked-in even
+though cache was about to appear. Salvage gives that late read another chance
+to win **this** launch:
+
+- Fetch failed or timed out → prefer late cache over baked-in.
+- Fetch succeeded → still prefer late cache for this launch (warm-start rule),
+  and write the remote payload for the **next** launch.
+
+If attestation finishes inside its budget the fetch goes out attested and
+receives the full payload immediately; otherwise it goes out unattested and takes
+the `default` tier, and the background refresh upgrades the cached payload for the
+next launch. A feature needing a key absent from the current payload can trigger
+an on-demand foreground escalation.
+
+### Where the cache lives
+
+The cache is a `keysCache` field inside **`DeviceSettings.json`**. That file is
+already read for theme setup in `src/app.ts`; the keys promise itself starts in
+`EdgeCoreManager.tsx` and awaits the same single-flighted `initDeviceSettings`
+load.
+
+The other three launch-window files (`remoteConfigSticky.json`, `firstOpen3.json`,
+`utilityServer.json`) are deliberately **left untouched**. Folding them in was
+considered and rejected for two reasons:
+
+- Two of them silently regenerate sticky data when their read fails.
+  `experimentConfig` re-randomizes the A/B variant, and `firstOpen` mints a new
+  `deviceId`, resets `firstOpenEpoch`, and reports `isFirstOpen: 'true'`, making an
+  existing install look brand new. Leaving them alone removes that failure mode
+  instead of mitigating it.
+- There is no latency to gain. `firstOpen3.json` and `utilityServer.json` are read
+  from a `Providers` effect after the core already exists, and the
+  `experimentConfig` read fires during initial bundle evaluation through a fully
+  static import chain, so it has long resolved before `Main` checks its gate. That
+  gate therefore stays as-is.
+
+`logins/*` and `fingerprint.json` are read by `edge-core-js` and
+`edge-login-ui-rn` respectively, and are outside this repo's control.
+
+The tradeoff of hosting the cache here is write amplification rather than read
+cost. `DeviceSettings.json` is the most frequently written of the four, and
+`writeDefaultScreen` fires on every tap of the Home or Assets tab, so writes are
+**serialized immediately** (not debounced) and `DeviceSettingsActions.ts` is the
+single owner of the file, holding the authoritative in-memory copy and chaining
+writes so concurrent patches cannot interleave `setText` calls. The keys store
+mutates the cache through that owner rather than writing the file itself.
+
+`readDeviceSettings` collapses any read failure into `asDeviceSettings({})`, so a
+corrupt file already resets user preferences today. Since the payload is now larger
+and rewritten more often, `keysCache` is cleaned with `asMaybe` so a malformed
+cache degrades to a miss instead of wiping preferences, and a malformed preference
+does not discard the cache. Losing the cache is recoverable by refetching or
+falling back to the baked-in file — which is precisely why this file is a safe host
+and the sticky files are not.
+
+Migration is additive: an existing `DeviceSettings.json` simply lacks `keysCache`,
+which reads as a miss and triggers a fetch.
+
+`initDeviceSettings` is single-flighted, because it now has two callers: the
+existing fire-and-forget theme setup in `app.ts` and the awaited call in the
+keys store. Without that, the read that resolved last would replace the whole
+in-memory settings object and could discard a `keysCache` written in between.
+The theme setup itself is still fire-and-forget, so the pre-existing `themeMode`
+flash on first render is unchanged by this work.
diff --git a/docs/EDGE_CLI.md b/docs/EDGE_CLI.md
new file mode 100644
index 00000000000..91074167db4
--- /dev/null
+++ b/docs/EDGE_CLI.md
@@ -0,0 +1,368 @@
+# Edge CLI
+
+A command-line interface for the Edge platform. Useful for account management,
+wallet operations, debugging, and scripting against edge-core-js.
+
+The CLI is a **thin one-shot client**. A long-lived **engine daemon** owns the
+`EdgeContext`, keeps logged-in accounts alive across invocations, and exposes a
+JSON REST API over a Unix domain socket (TCP is optional).
+
+For the full surface — every command, its REST call, and the `edge-core-js`
+call behind it — see the generated reference at
+[docs/api/dist/index.html](./api/dist/index.html), built from `docs/api/`.
+
+## Overview
+
+| Piece | Role |
+|-------|------|
+| `edge-engine` | Long-lived daemon. Owns one `EdgeContext` and N `EdgeAccount`s keyed by `sessionId`. Serves HTTP. |
+| `edge-cli` | One-shot client. Parses argv, auto-spawns the engine if needed, talks over the Unix socket, prints results. |
+
+By default the client uses only the Unix socket at
+`~/.edge-cli/run/<profile>/engine.sock`. Enable loopback TCP with
+`--tcp=9008` on the engine (useful for `curl` / scripts).
+
+## Running
+
+**Development (from source):**
+
+```bash
+npm run cli -- help                              # One-shot via client (auto-spawns engine)
+npm run cli -- login-with-password --username=u --password=p  # sessionId is persisted
+npm run cli -- balance-map --wallet-id=<id>           # Reuses the engine + session
+
+npm run engine                      # Start the engine alone
+npm run engine -- -t                # Engine against tester servers
+npm run engine -- --tcp=9008        # Also listen on 127.0.0.1:9008
+```
+
+**Built artifact:**
+
+```bash
+npm run build:cli                   # → lib/edgeCli.js + lib/edgeEngine.js
+node lib/edgeCli.js help
+node lib/edgeEngine.js -t --tcp=9008
+```
+
+**Published (npm):**
+
+```bash
+npx edge-cli help
+npx edge-cli -t login-with-password --username=<user> --password=<pass>
+```
+
+### Engine / client flags
+
+| Flag | Who | Description |
+|------|-----|-------------|
+| `-t, --test` | both | Use the six `-tester` servers (see below) |
+| `--fake` | both | Emulate the login, info and sync servers in-process; no network, no API key. Its own engine profile, so it never shares a socket with a real one |
+| `-d, --directory` | both | Working directory for local Edge data |
+| `-a, --app-id` | both | Application ID |
+| `-k, --api-key` | both | Override API key from `keys.json` |
+| `--locale <tag>` | both | Language tag (BCP 47 or POSIX). Also `EDGE_CLI_LOCALE` or `locale` in the config file |
+| `--tcp=9008` | engine | Bind TCP on `127.0.0.1` (off by default; bare `--tcp` is an error; `--tcp=0` = ephemeral) |
+| `--idle-timeout <sec>` | engine | Self-shutdown after idle with no sessions (default `300`; `0` = never) |
+| `--no-spawn` | client | Do not auto-start the engine; fail if none is running |
+| `--session <id>` | client | Override the persisted sessionId |
+| `--solve-captcha` | client | On `CHALLENGE_REQUIRED`, auto-solve ALTCHA PoW and retry |
+| `-c, --config <path>` | both | Configuration file |
+| `--tcp-host=<host>` | engine | TCP bind host (default `127.0.0.1`) |
+| `-u, --username` / `-p, --password` | client | Legacy one-shot login helpers |
+| `-h, --help` | both | Show options |
+
+API keys load from `./keys.json`, then `~/.edge-cli/keys.json`
+(`edgeApiKey`, `edgeApiSecret`, `pluginApiKeys`).
+
+When the native Edge API HMAC signer is available, the engine prefers it over
+`keys.json` secrets for **both** `edge-core-js` and `GET /v1/getKeys` on the
+info server. Plugin secrets (including Monero LWS `edgeApiKey`) come from that
+fetch and overlay local `pluginApiKeys`. Set `EDGE_CLI_FORCE_KEYS_JSON=1`
+(or pass `-k`) to force the JSON key/secret pair instead — useful for tester
+embeds and debugging. `-t` signs getKeys against `info-tester.edge.app`.
+
+Locale (one tag drives language tables and number format): `--locale`, then
+`locale` in `edge-cli.conf`, then `EDGE_CLI_LOCALE`, then `LC_ALL` /
+`LC_MESSAGES` / `LANG`, then `Intl`, then `en-US`. An already-running engine
+keeps its locale; the client warns on mismatch and continues. `GET /engine/status`
+reports `locale`, `decimalSeparator`, and `groupingSeparator`.
+
+## Tester servers
+
+**Always use `-t` / `--test` for testing. Never hit production in tests.**
+
+`-t` points the engine at these six hosts (the only `*-tester.edge.app`
+names that resolve):
+
+| Host | `EdgeContextOptions` field |
+|------|----------------------------|
+| `https://login-tester.edge.app` | `loginServer` |
+| `https://info-tester.edge.app` | `infoServer` |
+| `https://sync-tester-us1.edge.app` | `syncServer` (array) |
+| `https://sync-tester-us2.edge.app` | `syncServer` |
+| `https://sync-tester-us3.edge.app` | `syncServer` |
+| `https://change-tester.edge.app` | `changeServer` |
+
+```bash
+npm run cli -- -t create-account alice --password='pass' --pin=1234
+npm run cli -- -t login-with-password --username=alice --password='pass'
+```
+
+Confirm with `edge-cli engine-config` — `testMode` should be true and every
+server URL should be a `*-tester.edge.app` host.
+
+## Architecture
+
+```mermaid
+flowchart LR
+  cli["edge-cli (one-shot)"] -->|"HTTP / unix socket"| engine
+  script["scripts / curl"] -->|"HTTP / TCP (opt-in --tcp=9008)"| engine
+  subgraph engine [edge-engine daemon]
+    router[Router] --> sessions[SessionStore]
+    sessions --> account1["EdgeAccount (sess_A)"]
+    sessions --> account2["EdgeAccount (sess_B)"]
+    router --> context["EdgeContext (single)"]
+  end
+  context --> core[edge-core-js + currency plugins]
+```
+
+ASCII equivalent:
+
+```
+edge-cli  ──HTTP──►  engine.sock  ──►  edge-engine
+                                         │
+                                         ├─ EdgeContext (one)
+                                         └─ accounts by sessionId
+                                            (sess_… → EdgeAccount)
+```
+
+A *profile* is a hash of `{ appId, directory, testMode, loginServer }`.
+Distinct profiles get distinct run directories, so a tester engine and a
+production engine can coexist.
+
+## Discovery
+
+Under `~/.edge-cli/run/<profile>/` (files mode `0600`):
+
+| File | Purpose |
+|------|---------|
+| `engine.json` | Discovery / lock: pid, apiVersion, socketPath, tcpPort, appId, testMode, startedAt |
+| `engine.sock` | Unix domain socket (always on) |
+| `session.json` | Last `sessionId` written by the client |
+
+Example `engine.json`:
+
+```json
+{
+  "pid": 40123,
+  "apiVersion": "1.0.0",
+  "socketPath": "/Users/you/.edge-cli/run/8f3a.../engine.sock",
+  "tcpPort": null,
+  "appId": "",
+  "testMode": true,
+  "startedAt": "2026-08-06T04:55:00.000Z"
+}
+```
+
+Client flow: read `engine.json` → `GET /engine/status` → on miss, spawn the
+engine (unless `--no-spawn`), poll readiness up to 30 s, retry.
+
+```bash
+# Manual status check over the socket
+curl --unix-socket ~/.edge-cli/run/<profile>/engine.sock \
+  http://localhost/engine/status
+```
+
+## Sessions
+
+Successful login returns an opaque `sessionId` (`sess_` + base58 of 16 random
+bytes). Account-scoped REST paths look like:
+
+```
+/account/{sessionId}/wallet/balance-map?walletId=<id>
+```
+
+There is **no transport-level auth**. Core authenticates via password / PIN /
+key / recovery; `sessionId` scopes everything after that.
+
+The client persists the latest id in `session.json` so commands chain without
+re-typing. Override with `--session <id>` or `EDGE_CLI_SESSION`.
+
+**Auto-logout** mirrors the GUI: the engine reads `autoLogoutTimeInSeconds`
+from the account’s synced `Settings.json` (default `3600`, `0` = disabled) and
+logs the account out after that much idle time since the last REST call that
+touched the session. `edge-cli touch` is an explicit keepalive.
+
+**Engine idle shutdown:** after ~5 minutes with no sessions, no subscribers and
+no traffic, the engine closes the context, unlinks the socket / run file, and
+exits. Configure with `--idle-timeout` (`0` = never). A live `subscribe` holds
+it open — see [Subscribing to events](#subscribing-to-events).
+
+```bash
+edge-cli -t login-with-password --username=alice --password='pass'  # stores sessionId
+edge-cli currency-wallets                 # uses persisted session
+edge-cli engine-sessions
+edge-cli touch
+edge-cli logout
+```
+
+## CAPTCHA
+
+`usernameAvailable`, `createAccount`, and `loginWithPassword` can raise a
+login-server CAPTCHA. The engine does **not** solve it. It returns:
+
+```json
+{
+  "error": {
+    "code": "CHALLENGE_REQUIRED",
+    "status": 403,
+    "message": "Login requires a CAPTCHA",
+    "details": {
+      "challengeId": "GTNMhqW1...",
+      "challengeUri": "https://login-tester.edge.app/api/v2/captcha/..."
+    }
+  }
+}
+```
+
+Options:
+
+1. **CLI helper** — `--solve-captcha` on any login command headlessly
+   solves ALTCHA PoW at `challengeUri` and retries with `challengeId`.
+2. **Manual** — open the URI in a browser, then re-run the command with
+   `--challenge-id <id>` (or pass `challengeId` in the REST body).
+3. **Prefetch** — `edge-cli fetch-challenge` → `POST /fetch-challenge`.
+
+Automated tests use the same ALTCHA solver (see `src/cli/client/solveCaptcha.ts`).
+
+## Edge login (QR / barcode)
+
+`edge-cli request-edge-login` requests a pending Edge login and prints JSON the
+approving device can use:
+
+```json
+{
+  "pendingId": "sess-pending_7Qk3...",
+  "lobbyId": "HbC9mVJ2xR4tN8pL",
+  "uri": "edge://edge/HbC9mVJ2xR4tN8pL",
+  "state": "pending"
+}
+```
+
+Approve from another logged-in Edge device (Scan QR), or paste `uri` /
+`lobbyId` via **Scan QR → Enter** (useful with Maestro on the iOS simulator).
+Poll with `GET /pending-edge-login/{pendingId}` until `state` is `done`
+(it then carries the session) or `error`.
+
+## Command shape
+
+Commands are not listed here. The full reference — every command paired with
+the REST call it makes and the `edge-core-js` call behind it, with request and
+response types and an example — is generated from the route declarations:
+
+**[docs/api/dist/index.html](./api/dist/index.html)**
+
+```bash
+npm run docs:api          # rebuild it
+npm run docs:api:gates    # check it still matches src/cli
+```
+
+Every command follows one shape:
+
+```
+edge-cli [global flags] <command> [--flag=value ...]
+```
+
+| Form | Example |
+|------|---------|
+| Preferred | `--wallet-id=7o7i6` |
+| Also accepted | `--wallet-id 7o7i6` |
+| Optional boolean | `--paused` (presence means true) |
+| Required boolean | `--paused=true` — a bare flag cannot say false |
+| Repeatable | `--answer=rex --answer=oak` |
+| Lists | comma-separated, no spaces: `--export-format=csv,qbo` |
+| JSON | single-quoted: `--spend-info='{"tokenId":null}'` |
+
+Arguments are named. A command takes a bare positional only where the value is
+a base58 identifier the engine issued — an object handle, a pending login —
+because only those are safe as a URL path segment. A wallet id is base64 and a
+username is free text, so both are flags. `edge-cli help <command>` prints the
+exact usage for any of them, and that text is generated from the same source
+as the reference.
+
+For the native asset, omit `--token-id` rather than passing the literal
+`null`. An empty `--name=` is a usage error, as are unknown flags and extra
+positionals.
+
+### Subscribing to events
+
+`edge-cli subscribe` holds a Server-Sent Events stream open and prints one JSON
+object per line until you interrupt it. It runs concurrently with ordinary
+one-shot commands, so a subscriber in one terminal watches what another
+terminal does:
+
+```bash
+# terminal 1
+edge-cli subscribe --type=session.created --type=session.expired
+
+# terminal 2
+edge-cli -t login-with-password --username=alice --password='pass'
+edge-cli logout
+```
+
+A live subscription keeps the **engine** alive past its idle timeout — the
+stream would otherwise die under the subscriber. It does **not** keep an
+**account** logged in: the auto-logout timer still fires on schedule, and when
+it does, subscriptions that depend on that account or one of its wallets are
+closed with a `subscription.closed` frame. Context-level subscriptions survive,
+because the `EdgeContext` outlives every account.
+
+`subscribe` exits `0` on Ctrl-C, `3` when a session ended the stream, and `7`
+when the engine went away.
+
+### Exit codes
+
+| Code | Meaning |
+|------|---------|
+| `0` | Success |
+| `1` | Generic failure |
+| `2` | Usage / bad argv |
+| `3` | Auth / session |
+| `4` | Not found |
+| `5` | Validation / funds |
+| `6` | Network |
+| `7` | Engine unavailable |
+
+## Source layout
+
+```
+src/cli/
+  engine/
+    index.ts           # Daemon entry, argv, signals
+    makeCoreContext.ts # Plugin registration + makeEdgeContext
+    server.ts          # HTTP handler; unix (+ optional TCP) listeners
+    router.ts          # Method + path dispatch
+    sessions.ts        # SessionStore + auto-logout ticker
+    idleShutdown.ts    # Idle self-shutdown
+    discovery.ts       # Profile hash, run-file, socket paths
+    errors.ts          # EngineError + core → HTTP mapping
+    json.ts            # Body parse / Uint8Array·Date·Map codec
+    resolve.ts         # walletId prefix, tokenId parsing
+    events.ts          # SSE hub
+    testerServers.ts   # The six -tester hosts
+    routes/            # status, login, account, wallets, …
+  client/
+    apiClient.ts       # HTTP over socketPath or TCP
+    spawnEngine.ts     # Auto-spawn + readiness poll
+    sessionFile.ts     # Persisted sessionId
+    output.ts          # JSON / table / plain + exit codes
+  commands/            # Argv → apiClient → output (no core imports)
+  index.ts             # One-shot (+ REPL) front-end
+```
+
+## REST API
+
+Full method/path/body/error documentation is generated:
+**[docs/api/dist/index.html](./api/dist/index.html)**, with an OpenAPI 3.1
+document beside it at `docs/api/dist/openapi.json`. The source of truth is
+`docs/api/`; see [docs/api/README.md](./api/README.md).
diff --git a/docs/GUI_PLUGINS_ARCHITECTURE.md b/docs/GUI_PLUGINS_ARCHITECTURE.md
index 620c3d70f05..5df9196da35 100644
--- a/docs/GUI_PLUGINS_ARCHITECTURE.md
+++ b/docs/GUI_PLUGINS_ARCHITECTURE.md
@@ -67,6 +67,9 @@ interface FiatProviderSupportedRegions {
 
 ### 3. Plugin Configuration System
 
+GUI fiat / gift-card provider credentials live in `pluginMaps.guiApiKeys`
+(see [CONFIG_KEYS_ARCHITECTURE.md](./CONFIG_KEYS_ARCHITECTURE.md)).
+
 #### Sell Plugin List (`sellPluginList.json`)
 
 Each payment method is configured with:
diff --git a/docs/HMAC_SIGNING.md b/docs/HMAC_SIGNING.md
new file mode 100644
index 00000000000..4d13527948c
--- /dev/null
+++ b/docs/HMAC_SIGNING.md
@@ -0,0 +1,124 @@
+# HMAC signing for Edge APIs
+
+The GUI signs requests to the login server (via edge-core-js) and to the
+info-server `GET /v1/infoRollup/:appId` route with HMAC-SHA256. Native release and beta
+builds keep the HMAC secret out of the Metro bundle by embedding XOR-split
+shards from `edgeKey.json` (gitignored). JavaScript-only debug builds can fall
+back to `EDGE_API_KEY` / `EDGE_API_SECRET` in `keys.json`.
+
+This is the GUI-side contract. Core wiring is in
+[edge-core-js `docs/api-signer.md`](https://github.com/EdgeApp/edge-core-js/blob/master/docs/api-signer.md).
+Key file layout is in [CONFIG_KEYS_ARCHITECTURE.md](./CONFIG_KEYS_ARCHITECTURE.md).
+appKeys layer matching lives in
+[edge-info-server `docs/INFO_ROLLUP.md`](https://github.com/EdgeApp/edge-info-server/blob/master/docs/INFO_ROLLUP.md).
+
+## Native signer (`edgeKey.json`)
+
+`edgeKey.json` is `{ "apiKey": "<presented id>", "apiSecret": "<hex>" }`.
+`scripts/makeApiSigner.ts` runs from Gradle/Xcode generate tasks (and
+`prepare.sh`) when that file exists. It XOR-shards the secret:
+
+1. Five random pads plus a stored remainder (`SHARD_COUNT = 6`).
+2. A runtime pad of `sha256(bundleId)` (Android `applicationId` and iOS
+   `PRODUCT_BUNDLE_IDENTIFIER` must match).
+3. The C sources reconstruct `secret = s0 ⊕ … ⊕ s5 ⊕ runtimePad`.
+
+Generated (gitignored) outputs:
+
+- `ios/EdgeApiSecret.c` + `ios/EdgeApiSecret.h`
+- `android/app/src/main/cpp/edge_api_secret.c` + `edge_api_secret.h`
+
+Native modules (`ios/edge/EdgeApiSigner.m`,
+`android/.../EdgeApiSignerModule.kt`) expose `signMessage` and `getApiKey`.
+`src/util/edgeApiSigner.ts` wraps that module as an `EdgeApiSigner` whose
+`signMessage(message)` returns `{ apiKey, signature }` (base64 HMAC-SHA256).
+Release/beta generate tasks fail if `edgeKey.json` is missing. Debug may set
+`EDGE_API_SIGNER_ALLOW_STUB=1` to compile a non-signing stub.
+
+The GUI passes that object into `MakeEdgeContext` as `apiSigner`. Core prefers
+it over `apiKey` / `apiSecret` for login-server HMAC.
+
+## JavaScript fallback
+
+When the native module is absent or returns an unusable key (typical debug
+without `edgeKey.json`), `src/util/hmacAuth.ts` signs with
+`KEYS.EDGE_API_KEY` and `KEYS.EDGE_API_SECRET` from `keys.json`. Those values
+must match a `login-api-keys` row on the login server and an
+`info_keys.apiKeys[].key` on the info server.
+
+`makeNativeApiSigner()` is not used in that build; `MakeEdgeContext` is
+called without `apiSigner`, and core falls back to the JS secret pair (or
+legacy `Token {apiKey}` if there is no secret).
+
+## Two HMAC string formats
+
+Do not reuse one canonical string for both services. Same presented key and
+secret; different signed UTF-8 string and headers.
+
+### Login server (core `loginFetchInner`)
+
+```
+{METHOD}\n/api{path}\n{BODY}
+```
+
+- `METHOD` is upper-case (`POST`, `GET`, …).
+- Path is `/api` plus the login route (`/api/v2/login`, `/api/v2/login/create`,
+  …). Query string is included when present.
+- `BODY` is the JSON body string, or empty when the method is GET or there is
+  no body.
+
+Header:
+
+```
+Authorization: HMAC {apiKey} {base64(hmac-sha256(secret, data))}
+```
+
+There is **no** timestamp and **no** `X-Timestamp` header. The login server
+verifies this exact three-line string (`with-api-key.ts`). A missing secret
+falls back to the legacy `Authorization: Token {apiKey}` header (still accepted
+for some routes such as `messages`).
+
+When an attestation JWT is loaded via `EdgeContext.setAttestationToken`, core
+also sends `x-attestation-token`. Login-server challenge rates may use that
+token; a missing or invalid token is treated as unattested (the request still
+proceeds). That fail-open behavior is **not** how signed infoRollup treats a
+bad token.
+
+### Info-server `GET /v1/infoRollup/:appId` (GUI `keysServer.ts`)
+
+```
+{METHOD}\n{URI}\n{BODY}\n{TIMESTAMP}
+```
+
+- `METHOD` is `GET`.
+- `URI` is `req.originalUrl` on the server (`/v1/infoRollup/{appId}?os=&osVersion=&appVersion=`,
+  including the `/v1` prefix). The client signs `/${fetchPath}` to match.
+- `BODY` is empty.
+- `TIMESTAMP` is Unix seconds as a decimal string, also sent as `X-Timestamp`.
+
+Headers:
+
+```
+Authorization: HMAC {apiKey} {base64(hmac-sha256(secret, data))}
+X-Timestamp: {unixSeconds}
+x-attestation-token: {ES256 JWT}   # optional
+```
+
+A valid HMAC is not enough to receive hardware-gated keys. The info server
+walks an ordered `layers` array; see the info-server INFO_ROLLUP doc. A
+present-but-invalid attestation token is **HTTP 401** — the GUI must not treat
+that as the unattested floor.
+
+Native `apiSigner.signMessage` is preferred when `EdgeApiSigner` is linked
+(`keysServer.ts`); otherwise `signHmacAuthorization` in `hmacAuth.ts`.
+
+## Request coverage
+
+| Caller                    | Signed with                        | Endpoint                   |
+|---------------------------|------------------------------------|----------------------------|
+| Core `loginFetch`         | Native `apiSigner` or JS apiSecret | login-server `/api/v2/*`   |
+| GUI `fetchRemoteKeys`     | Native signer or `hmacAuth.ts`     | info-server `GET /v1/infoRollup/:appId` |
+| GUI `infoServer.ts` (rates, …) | not HMAC                      | other info-server routes   |
+
+Core does not call infoRollup. The GUI does, then writes the `appKeys` overlay into
+`KEYS` / `pluginMaps` through `keysStore`.
diff --git a/docs/api/README.md b/docs/api/README.md
new file mode 100644
index 00000000000..543a49c0eaa
--- /dev/null
+++ b/docs/api/README.md
@@ -0,0 +1,138 @@
+# Edge CLI API docs
+
+The `edge-cli` command line and the `edge-engine` REST API, defined once and
+rendered together. Each call is a single record holding both forms, so the CLI
+usage and the HTTP request cannot drift apart in the documentation.
+
+```bash
+npm run docs:api          # build dist/index.html + dist/openapi.json
+npm run docs:api:verify   # check the docs still match src/cli
+```
+
+Open `docs/api/dist/index.html` in a browser. The command line comes first in
+every entry, the REST call second, and each states the `edge-core-js` call it
+fronts.
+
+**`dist/` is committed on purpose** so the reference can be read on GitHub and
+linked to without a build step. Rebuild and commit it in the same change as any
+route or command edit — `npm run docs:api:verify` will fail otherwise.
+
+## Naming
+
+Routes are named after the core call they front, kebab-cased, and the command
+matches: `context.forgetAccount` becomes `POST /forget-account` and
+`forget-account`. Parameters keep core's names.
+
+A path parameter is a base58 identifier, and nothing else — `sessionId`,
+`objectId`, `pendingId`, `lobbyId`, `syncKey`. Base58 has no `/`, `?` or `#`,
+so it survives a URL as written. A base64 wallet id or a free-text username
+does not, so those are named arguments: the query for `GET`, the body for
+`POST`. Where a path parameter is allowed it comes last, in the order the
+command reads. Collection segments are singular, since each call acts on one. Only `GET` and `POST` are used, since core has no
+HTTP verbs, and a core method returning `void` answers `204`.
+
+Endpoints with no core equivalent set `coreCall: null` and must explain
+themselves in `coreNote` — the verifier enforces that.
+
+## Why generated, not hand-written
+
+The previous hand-maintained `docs/EDGE_CLI_API.md` drifted badly: response
+shapes that no route returned, status codes off by a category, body fields
+under the wrong name, and a documented `confirm=true` guard on account deletion
+that the engine never implemented. None of that is visible by reading either
+the doc or the code alone — only by diffing them.
+
+`scripts/verifyApiDocs.ts` does that diff. It reads `router.add(…)` out of
+`src/cli/engine/routes/` and `command(…)` out of `src/cli/commands/`, then
+asserts the documentation covers exactly that surface. Run it in CI and adding
+a route without documenting it fails the build.
+
+What it checks today:
+
+- every registered route is documented exactly once, and nothing is documented
+  that is not registered
+- every cited `edge-cli` command exists, and every registered command is cited
+  by at least one endpoint
+- each `usage` string starts with its own command name
+- every endpoint names a real `edge-core-js` member, or sets `coreCall: null`
+  with a `coreNote` saying why
+- error codes come from the shared catalogue
+- `204` endpoints declare no body, `200` endpoints declare a schema or prose
+- every `{pathParam}` in a path is declared
+
+What it cannot check yet: that a response *schema* matches what the engine
+really returns. See "Runtime validation" below.
+
+## Layout
+
+```
+docs/api/
+  schema.ts             the schema DSL (s.object, s.ref, …)
+  types.ts              what an Endpoint is
+  shared.ts             shapes reused across routes, error + exit-code tables
+  endpoints/            one file per file in src/cli/engine/routes/
+  index.ts              group order, which is also render order
+  dist/                 generated — do not edit
+scripts/
+  buildApiDocs.ts       -> dist/index.html and dist/openapi.json
+  verifyApiDocs.ts      docs vs. code drift check
+```
+
+`endpoints/` mirrors `src/cli/engine/routes/` deliberately: when you touch a
+route file, the doc file to update sits at the same name.
+
+## Adding an endpoint
+
+Add the route in `src/cli/engine/routes/`, then add the record beside it:
+
+```ts
+endpoint({
+  id: 'balanceMap',                // anchor + OpenAPI operationId
+  summary: 'Balances for every asset in the wallet',
+  description: 'Optional prose. Markdown.',
+  method: 'GET',
+  path: '/account/{sessionId}/wallets/{walletId}/balance-map',
+  source: 'src/cli/engine/routes/wallets.ts',
+  coreCall: 'wallet.balanceMap', // or null + coreNote
+  cli: [
+    {
+      command: 'balance-map',      // must match command(…) in src/cli/commands/
+      usage: 'balance-map <walletId> [--token-id=<id>]',
+      flags: [{ flag: '--token-id=<id>', maps: 'tokenId', target: 'client' }],
+      example: 'edge-cli balance-map abc123'
+    }
+  ],
+  pathParams: [sessionId, walletId],
+  success: { status: 200, schema: s.object([f('balances', s.array(s.ref('Balance')))]) },
+  errors: ['WALLET_NOT_FOUND', 'AMBIGUOUS_WALLET_ID']
+})
+```
+
+Then `npm run docs:api:verify`.
+
+Conventions worth keeping:
+
+- `cli: []` means REST-only. The verifier will not let a documented command
+  name be wrong, but it cannot yet prove a route has *no* command — check by
+  hand before writing `[]`.
+- Reuse `s.ref('…')` for anything in `shared.ts` rather than restating fields.
+  Nine schemas already cover most of the surface.
+- Put anything a caller would get wrong from the schema alone in `notes` —
+  surprising defaults, fields that look symmetric but are not, calls that write
+  when they look like reads.
+- Two commands may share a route (`spend` / `spend-max`), and one command may
+  cover two routes (`balance`, `spam-filter`). Both are fine: list every
+  binding on the route it actually calls.
+
+## Runtime validation
+
+`schema.ts` is deliberately close in shape to `cleaners`, which the repo
+already depends on. The engine does not currently validate its own responses —
+it returns plain objects assembled from edge-core-js types — so there was no
+existing runtime schema to point these docs at.
+
+The next step, if this format earns its keep, is an `asSchema()` that compiles
+a `Schema` into a cleaner and a test that drives a tester-server session
+through every endpoint, asserting real responses satisfy the documented shape.
+That closes the last gap: today the docs are provably complete, but only the
+*shapes* are still trusted rather than verified.
diff --git a/docs/api/dist/index.html b/docs/api/dist/index.html
new file mode 100644
index 00000000000..51bf0e6333b
--- /dev/null
+++ b/docs/api/dist/index.html
@@ -0,0 +1,8207 @@
+<!doctype html>
+<html lang="en"><head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Edge CLI API</title>
+<style>
+:root {
+  --bg: #fff; --fg: #16181d; --dim: #6b7280; --line: #e5e7eb; --card: #fafafa;
+  --accent: #2563eb; --code: #f3f4f6; --warn: #b45309; --ok: #047857;
+  --mono: ui-monospace, SFMono-Regular, "SF Mono", Menlo, monospace;
+}
+@media (prefers-color-scheme: dark) {
+  :root {
+    --bg: #0d1117; --fg: #e6edf3; --dim: #8b949e; --line: #262c36; --card: #131920;
+    --accent: #6ea8ff; --code: #1a212b; --warn: #d29922; --ok: #3fb950;
+  }
+}
+* { box-sizing: border-box; }
+body {
+  margin: 0; background: var(--bg); color: var(--fg);
+  font: 15px/1.6 -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif;
+}
+code, pre { font-family: var(--mono); font-size: 13px; }
+code { background: var(--code); padding: 1px 5px; border-radius: 4px; }
+pre { background: var(--code); padding: 12px 14px; border-radius: 8px; overflow-x: auto; margin: 8px 0; }
+pre code { background: none; padding: 0; }
+a { color: var(--accent); text-decoration: none; }
+a:hover { text-decoration: underline; }
+
+.layout { display: flex; align-items: flex-start; }
+nav {
+  position: sticky; top: 0; height: 100vh; overflow-y: auto; flex: 0 0 270px;
+  border-right: 1px solid var(--line); padding: 20px 12px 60px;
+}
+nav h1 { font-size: 15px; margin: 0 8px 4px; }
+nav .ver { font-size: 12px; color: var(--dim); margin: 0 8px 14px; }
+nav input {
+  width: 100%; padding: 7px 10px; margin-bottom: 14px; font: inherit; font-size: 13px;
+  border: 1px solid var(--line); border-radius: 7px; background: var(--bg); color: var(--fg);
+}
+nav .s { font: 700 12px/1.5 var(--sans); text-transform: uppercase; letter-spacing: .08em;
+  color: var(--fg); margin: 18px 0 4px; padding-top: 10px; border-top: 1px solid var(--line); }
+nav .s:first-child { margin-top: 0; padding-top: 0; border-top: none; }
+nav .g { font-size: 11px; text-transform: uppercase; letter-spacing: .07em; color: var(--dim);
+  margin: 16px 8px 5px; font-weight: 600; }
+nav a.e { display: block; padding: 3px 8px; border-radius: 5px; font-size: 13px; color: var(--fg); }
+nav a.e:hover { background: var(--card); text-decoration: none; }
+nav a.e code { background: none; padding: 0; color: var(--accent); }
+nav a.e .restonly { color: var(--dim); font-style: italic; font-size: 12px; }
+
+main { flex: 1 1 auto; min-width: 0; padding: 32px 40px 120px; max-width: 1000px; }
+h2 { font-size: 22px; margin: 48px 0 6px; padding-top: 14px; border-top: 1px solid var(--line); }
+h3.sub { font-size: 16px; margin: 30px 0 4px; color: var(--fg); }
+h2:first-of-type { border-top: none; margin-top: 8px; }
+.groupdoc { color: var(--dim); margin: 0 0 8px; }
+
+.endpoint { border: 1px solid var(--line); border-radius: 12px; padding: 18px 20px;
+  margin: 18px 0; background: var(--card); }
+.endpoint header { display: flex; flex-wrap: wrap; align-items: baseline;
+  justify-content: space-between; gap: 8px; }
+.endpoint h3 { font-size: 17px; margin: 0; }
+.endpoint h3 a { color: var(--fg); }
+.ids { display: flex; align-items: center; gap: 8px; flex-wrap: wrap; }
+.cmdname { background: var(--accent); color: #fff; font-weight: 600; }
+.restonly { color: var(--dim); font-style: italic; font-size: 12px; }
+.src { color: var(--dim); font-size: 11px; font-family: var(--mono); }
+.shape { margin: 6px 0; }
+.shape-h { font: 600 10px var(--mono); text-transform: uppercase; letter-spacing: .06em;
+  color: var(--dim); margin-bottom: 4px; }
+pre.ts { background: var(--code); border-left: 3px solid var(--accent); }
+pre.json { background: transparent; border: 1px dashed var(--line); }
+.shape details { margin: 6px 0; }
+.shape summary { cursor: pointer; font-size: 12px; color: var(--dim); user-select: none; }
+.shape summary:hover { color: var(--accent); }
+.core { margin: 8px 0 2px; font-size: 13px; display: flex; align-items: baseline;
+  gap: 8px; flex-wrap: wrap; }
+.core .lbl { font: 600 10px var(--mono); text-transform: uppercase; letter-spacing: .06em;
+  color: var(--dim); border: 1px solid var(--line); border-radius: 3px; padding: 1px 5px; }
+.core code { color: var(--ok); }
+.core.none em { color: var(--dim); font-style: italic; }
+.desc { margin: 8px 0 4px; }
+.desc p { margin: 6px 0; }
+
+.panes { display: grid; grid-template-columns: 1fr 1fr; gap: 16px; margin-top: 14px; }
+@media (max-width: 900px) { .panes { grid-template-columns: 1fr; } }
+.pane { background: var(--bg); border: 1px solid var(--line); border-radius: 9px; padding: 12px 14px;
+  /* A grid item defaults to min-width:auto, so a long unbreakable line makes
+     the column wider than its 1fr share and shoves the next pane sideways.
+     `overflow-x` on the <pre> never gets a chance until this is 0. */
+  min-width: 0; }
+.pane h4 { margin: 0 0 8px; font-size: 12px; text-transform: uppercase;
+  letter-spacing: .07em; color: var(--dim); }
+.pane h5 { margin: 12px 0 4px; font-size: 12px; color: var(--dim); font-weight: 600; }
+.pane.resp, .pane.notes { margin-top: 16px; }
+.pane.cli.none p { margin: 0; }
+.cmd + .cmd { margin-top: 14px; padding-top: 14px; border-top: 1px dashed var(--line); }
+/* A command line is a sentence, not a table: wrap it at the spaces rather
+   than making the reader scroll a pane sideways. `get-transactions` is 322
+   characters. */
+.usage, .ex { white-space: pre-wrap; overflow-wrap: break-word; }
+.usage { background: var(--code); }
+.ex { background: transparent; border: 1px dashed var(--line); }
+.lead { margin: 4px 0; color: var(--dim); font-size: 13px; }
+.note { font-size: 13px; }
+.note p { margin: 4px 0; }
+.pane.notes ul { margin: 0; padding-left: 20px; }
+.pane.notes li { margin: 5px 0; }
+
+.route { margin: 0 0 4px; display: flex; align-items: center; gap: 8px; }
+.m { font: 600 11px var(--mono); padding: 2px 7px; border-radius: 4px; color: #fff; }
+.m-GET { background: #2563eb; } .m-POST { background: #047857; }
+.m-PUT { background: #b45309; } .m-PATCH { background: #7c3aed; }
+.m-DELETE { background: #b91c1c; }
+
+table { border-collapse: collapse; width: 100%; margin: 4px 0; }
+table.fields td, table.flags td, table.flags th { padding: 4px 8px 4px 0;
+  vertical-align: top; font-size: 13px; border-bottom: 1px solid var(--line); }
+table.flags th { text-align: left; font-size: 11px; color: var(--dim); text-transform: uppercase; }
+td.k { white-space: nowrap; width: 1%; }
+td.ty { white-space: nowrap; width: 1%; }
+td.doc { color: var(--dim); }
+tr.d1 td.k { padding-left: 18px; } tr.d2 td.k { padding-left: 36px; }
+.t { color: var(--dim); font-family: var(--mono); font-size: 12px; }
+.t.core { color: var(--warn); border-bottom: 1px dotted var(--warn); cursor: help; }
+.dim { color: var(--dim); }
+.ref { font-family: var(--mono); font-size: 12px; }
+.flag { font-size: 10px; padding: 1px 5px; border-radius: 3px; border: 1px solid var(--line);
+  color: var(--dim); text-transform: uppercase; letter-spacing: .04em; }
+.flag.req { color: var(--warn); border-color: var(--warn); }
+.st { font: 600 11px var(--mono); padding: 1px 6px; border-radius: 4px;
+  background: var(--code); margin-right: 5px; }
+.st.ok { color: var(--ok); }
+.errs { display: flex; flex-wrap: wrap; gap: 6px; margin: 4px 0; }
+a.err { font: 12px var(--mono); border: 1px solid var(--line); border-radius: 5px;
+  padding: 2px 7px; color: var(--fg); }
+a.err:hover { border-color: var(--accent); text-decoration: none; }
+
+.schema { border: 1px solid var(--line); border-radius: 10px; padding: 14px 16px; margin: 14px 0;
+  background: var(--card); }
+.schema h3 { margin: 0 0 2px; font-size: 15px; font-family: var(--mono); }
+.schema .src { display: block; margin-bottom: 6px; }
+.hidden { display: none; }
+</style>
+</head><body>
+<div class="layout">
+<nav>
+  <h1>Edge CLI API</h1>
+  <p class="ver">v1.0.0 · 117 calls</p>
+  <input id="q" type="search" placeholder="Filter…" autocomplete="off">
+  <a class="e" href="#overview"><strong>Overview</strong></a>
+  <div class="s">Engine</div><div class="g">Lifecycle</div><a class="e" href="#engineStatus" data-s="engine liveness and summary. /engine/status engine-status"><code>engine-status</code></a><a class="e" href="#engineConfig" data-s="configured context options. /engine/config engine-config"><code>engine-config</code></a><a class="e" href="#engineStop" data-s="stop the engine. /engine/stop engine-stop"><code>engine-stop</code></a><div class="g">Event stream</div><a class="e" href="#engineEvents" data-s="subscribe to engine events. /engine/events subscribe"><code>subscribe</code></a><div class="s">Context</div><div class="g">Device and usernames</div><a class="e" href="#localUsers" data-s="list local users on this device. /local-users local-users"><code>local-users</code></a><a class="e" href="#forgetAccount" data-s="forget an account on this device. /forget-account forget-account"><code>forget-account</code></a><a class="e" href="#usernameAvailable" data-s="check whether a username is free. /username-available username-available"><code>username-available</code></a><a class="e" href="#fixUsername" data-s="normalize a username. /fix-username fix-username"><code>fix-username</code></a><a class="e" href="#checkPasswordRules" data-s="score a candidate password. /check-password-rules check-password-rules"><code>check-password-rules</code></a><a class="e" href="#fetchLoginMessages" data-s="fetch login-server messages for every local user. /fetch-login-messages fetch-login-messages"><code>fetch-login-messages</code></a><a class="e" href="#requestOtpReset" data-s="request a 2fa reset. /request-otp-reset request-otp-reset"><code>request-otp-reset</code></a><a class="e" href="#fetchRecoveryQuestions" data-s="fetch a user’s recovery questions. /fetch-recovery-questions fetch-recovery-questions"><code>fetch-recovery-questions</code></a><a class="e" href="#fetchChallenge" data-s="pre-fetch a captcha challenge. /fetch-challenge fetch-challenge"><code>fetch-challenge</code></a><a class="e" href="#currencyConfigs" data-s="list plugin ids usable for wallet creation. /currency-configs currency-configs"><code>currency-configs</code></a><div class="g">Login methods</div><a class="e" href="#loginWithPassword" data-s="log in with a password. /login-with-password login-with-password"><code>login-with-password</code></a><a class="e" href="#loginWithPin" data-s="log in with a device pin. /login-with-pin login-with-pin"><code>login-with-pin</code></a><a class="e" href="#loginWithKey" data-s="log in with an account login key. /login-with-key login-with-key"><code>login-with-key</code></a><a class="e" href="#loginWithRecovery" data-s="log in with recovery answers. /login-with-recovery login-with-recovery"><code>login-with-recovery</code></a><a class="e" href="#createAccount" data-s="create an account. /create-account create-account"><code>create-account</code></a><a class="e" href="#requestEdgeLogin" data-s="start a qr login. /request-edge-login request-edge-login"><code>request-edge-login</code></a><a class="e" href="#pollEdgeLogin" data-s="poll a pending qr login. /pending-edge-login/{pendingid} poll-edge-login"><code>poll-edge-login</code></a><a class="e" href="#cancelEdgeLogin" data-s="cancel a pending qr login. /pending-edge-login/cancel-request/{pendingid} cancel-request"><code>cancel-request</code></a><a class="e" href="#engineSessions" data-s="list active sessions. /engine/sessions engine-sessions"><code>engine-sessions</code></a><div class="s">Account</div><div class="g">Session</div><a class="e" href="#accountInfo" data-s="account and session summary. /account/{sessionid} account-info"><code>account-info</code></a><a class="e" href="#logout" data-s="log out. /account/{sessionid}/logout logout"><code>logout</code></a><a class="e" href="#touchSession" data-s="keepalive. /account/{sessionid}/touch touch"><code>touch</code></a><a class="e" href="#getLoginKey" data-s="read the account login key. /account/{sessionid}/get-login-key get-login-key"><code>get-login-key</code></a><a class="e" href="#accountSync" data-s="force an account data sync. /account/{sessionid}/sync sync"><code>sync</code></a><a class="e" href="#deleteRemoteAccount" data-s="permanently delete the remote account. /account/{sessionid}/delete-remote-account delete-remote-account"><code>delete-remote-account</code></a><a class="e" href="#waitForAllWallets" data-s="wait for every wallet to finish loading. /account/{sessionid}/wait-for-all-wallets wait-for-all-wallets"><code>wait-for-all-wallets</code></a><a class="e" href="#currencyWallets" data-s="list the account's wallets. /account/{sessionid}/currency-wallets currency-wallets"><code>currency-wallets</code></a><a class="e" href="#createCurrencyWallet" data-s="create a currency wallet. /account/{sessionid}/create-currency-wallet create-currency-wallet"><code>create-currency-wallet</code></a><a class="e" href="#createCurrencyWallets" data-s="create several wallets at once. /account/{sessionid}/create-currency-wallets create-currency-wallets"><code>create-currency-wallets</code></a><div class="g">Credentials</div><a class="e" href="#changePassword" data-s="set or change the password. /account/{sessionid}/change-password change-password"><code>change-password</code></a><a class="e" href="#deletePassword" data-s="remove password login. /account/{sessionid}/delete-password delete-password"><code>delete-password</code></a><a class="e" href="#checkPassword" data-s="verify a password. /account/{sessionid}/check-password check-password"><code>check-password</code></a><a class="e" href="#getPin" data-s="read the account pin. /account/{sessionid}/get-pin get-pin"><code>get-pin</code></a><a class="e" href="#changePin" data-s="set or change the pin. /account/{sessionid}/change-pin change-pin"><code>change-pin</code></a><a class="e" href="#deletePin" data-s="remove the pin. /account/{sessionid}/delete-pin delete-pin"><code>delete-pin</code></a><a class="e" href="#checkPin" data-s="verify a pin. /account/{sessionid}/check-pin check-pin"><code>check-pin</code></a><a class="e" href="#changeUsername" data-s="change the username. /account/{sessionid}/change-username change-username"><code>change-username</code></a><a class="e" href="#changeRecovery" data-s="set recovery questions and answers. /account/{sessionid}/change-recovery change-recovery"><code>change-recovery</code></a><a class="e" href="#deleteRecovery" data-s="disable recovery login. /account/{sessionid}/delete-recovery delete-recovery"><code>delete-recovery</code></a><div class="g">Two-factor authentication</div><a class="e" href="#otpKey" data-s="read the 2fa secret and reset state. /account/{sessionid}/otp-key otp-key"><code>otp-key</code></a><a class="e" href="#enableOtp" data-s="enable 2fa. /account/{sessionid}/enable-otp enable-otp"><code>enable-otp</code></a><a class="e" href="#disableOtp" data-s="disable 2fa. /account/{sessionid}/disable-otp disable-otp"><code>disable-otp</code></a><a class="e" href="#cancelOtpReset" data-s="cancel a pending 2fa reset. /account/{sessionid}/cancel-otp-reset cancel-otp-reset"><code>cancel-otp-reset</code></a><a class="e" href="#repairOtp" data-s="re-point the account at a known 2fa secret. /account/{sessionid}/repair-otp repair-otp"><code>repair-otp</code></a><div class="g">Vouchers</div><a class="e" href="#pendingVouchers" data-s="list pending 2fa vouchers. /account/{sessionid}/pending-vouchers pending-vouchers"><code>pending-vouchers</code></a><a class="e" href="#approveVoucher" data-s="approve a voucher. /account/{sessionid}/approve-voucher approve-voucher"><code>approve-voucher</code></a><a class="e" href="#rejectVoucher" data-s="reject a voucher. /account/{sessionid}/reject-voucher reject-voucher"><code>reject-voucher</code></a><div class="g">Approving a login</div><a class="e" href="#fetchLobby" data-s="inspect a login request. /account/{sessionid}/fetch-lobby/{lobbyid} fetch-lobby"><code>fetch-lobby</code></a><a class="e" href="#approveLoginRequest" data-s="approve a login request. /account/{sessionid}/approve-login-request/{lobbyid} approve-login-request"><code>approve-login-request</code></a><div class="g">Keys</div><a class="e" href="#allKeys" data-s="list every key in the account. /account/{sessionid}/all-keys all-keys"><code>all-keys</code></a><a class="e" href="#createWallet" data-s="create a wallet from raw key json. /account/{sessionid}/create-wallet create-wallet"><code>create-wallet</code></a><a class="e" href="#getWalletInfo" data-s="read one wallet's key info. /account/{sessionid}/get-wallet-info get-wallet-info"><code>get-wallet-info</code></a><a class="e" href="#getRawPrivateKey" data-s="read raw private key material. /account/{sessionid}/get-raw-private-key get-raw-private-key"><code>get-raw-private-key</code></a><a class="e" href="#getRawPublicKey" data-s="read raw public key material. /account/{sessionid}/get-raw-public-key get-raw-public-key"><code>get-raw-public-key</code></a><a class="e" href="#getDisplayPrivateKey" data-s="export the private key for display. /account/{sessionid}/get-display-private-key get-display-private-key"><code>get-display-private-key</code></a><a class="e" href="#getDisplayPublicKey" data-s="export the public key for display. /account/{sessionid}/get-display-public-key get-display-public-key"><code>get-display-public-key</code></a><a class="e" href="#listSplittableWalletTypes" data-s="list chains a wallet can split into. /account/{sessionid}/list-splittable-wallet-types list-splittable-wallet-types"><code>list-splittable-wallet-types</code></a><a class="e" href="#changeWalletStates" data-s="archive, delete, hide, or reorder wallets. /account/{sessionid}/change-wallet-states change-wallet-states"><code>change-wallet-states</code></a><div class="g">Swap quotes</div><a class="e" href="#fetchSwapQuotes" data-s="fetch swap quotes. /account/{sessionid}/fetch-swap-quotes fetch-swap-quotes"><code>fetch-swap-quotes</code></a><a class="e" href="#getSwapQuote" data-s="re-read a quote. /account/{sessionid}/swap-quote/{objectid} swap-quote-get"><code>swap-quote-get</code></a><a class="e" href="#approveSwapQuote" data-s="execute a quote. /account/{sessionid}/swap-quote/approve/{objectid} approve-swap-quote"><code>approve-swap-quote</code></a><a class="e" href="#closeSwapQuote" data-s="discard a quote. /account/{sessionid}/swap-quote/close/{objectid} close-swap-quote"><code>close-swap-quote</code></a><div class="g">Data store</div><a class="e" href="#listStoreIds" data-s="list data-store ids. /account/{sessionid}/list-store-ids list-store-ids"><code>list-store-ids</code></a><a class="e" href="#listItemIds" data-s="list item ids in a store. /account/{sessionid}/list-item-ids list-item-ids"><code>list-item-ids</code></a><a class="e" href="#getItem" data-s="read an item. /account/{sessionid}/get-item get-item"><code>get-item</code></a><a class="e" href="#setItem" data-s="write an item. /account/{sessionid}/set-item set-item"><code>set-item</code></a><a class="e" href="#deleteItem" data-s="delete an item. /account/{sessionid}/delete-item delete-item"><code>delete-item</code></a><a class="e" href="#deleteStore" data-s="delete an entire store. /account/{sessionid}/delete-store delete-store"><code>delete-store</code></a><div class="s">Wallet</div><div class="g">Wallet state</div><a class="e" href="#walletInfo" data-s="wallet detail. /account/{sessionid}/wallet wallet-info"><code>wallet-info</code></a><a class="e" href="#renameWallet" data-s="rename a wallet. /account/{sessionid}/wallet/rename-wallet rename-wallet"><code>rename-wallet</code></a><a class="e" href="#setFiatCurrencyCode" data-s="change a wallet's fiat currency. /account/{sessionid}/wallet/set-fiat-currency-code set-fiat-currency-code"><code>set-fiat-currency-code</code></a><a class="e" href="#changePaused" data-s="pause or resume a wallet engine. /account/{sessionid}/wallet/change-paused change-paused"><code>change-paused</code></a><a class="e" href="#walletSync" data-s="nudge one wallet to sync. /account/{sessionid}/wallet/sync wallet-sync"><code>wallet-sync</code></a><a class="e" href="#resyncBlockchain" data-s="rescan the blockchain from scratch. /account/{sessionid}/wallet/resync-blockchain resync-blockchain"><code>resync-blockchain</code></a><a class="e" href="#splitWallet" data-s="split a wallet into another chain. /account/{sessionid}/wallet/split split"><code>split</code></a><a class="e" href="#dumpData" data-s="dump wallet engine state. /account/{sessionid}/wallet/dump-data dump-data"><code>dump-data</code></a><a class="e" href="#balanceMap" data-s="balances for every asset in the wallet. /account/{sessionid}/wallet/balance-map balance-map"><code>balance-map</code></a><a class="e" href="#getAddresses" data-s="receive addresses. /account/{sessionid}/wallet/get-addresses get-addresses"><code>get-addresses</code></a><div class="g">Tokens</div><a class="e" href="#walletTokens" data-s="list a wallet's tokens. /account/{sessionid}/wallet/tokens wallet-tokens"><code>wallet-tokens</code></a><a class="e" href="#changeEnabledTokenIds" data-s="set the enabled token set. /account/{sessionid}/wallet/change-enabled-token-ids change-enabled-token-ids"><code>change-enabled-token-ids</code></a><div class="g">Transactions</div><a class="e" href="#getTransactions" data-s="list or export a wallet's transactions. /account/{sessionid}/wallet/get-transactions get-transactions"><code>get-transactions</code></a><a class="e" href="#getNumTransactions" data-s="count transactions in a wallet. /account/{sessionid}/wallet/get-num-transactions get-num-transactions"><code>get-num-transactions</code></a><a class="e" href="#saveTxMetadata" data-s="save transaction metadata. /account/{sessionid}/wallet/save-tx-metadata save-tx-metadata"><code>save-tx-metadata</code></a><a class="e" href="#saveTxAction" data-s="save a transaction action. /account/{sessionid}/wallet/save-tx-action save-tx-action"><code>save-tx-action</code></a><div class="g">Spending</div><a class="e" href="#getMaxSpendable" data-s="largest sendable amount. /account/{sessionid}/wallet/get-max-spendable get-max-spendable"><code>get-max-spendable</code></a><a class="e" href="#spend" data-s="send funds. /account/{sessionid}/wallet/spend spend"><code>spend</code></a><a class="e" href="#makeSpend" data-s="build an unsigned transaction. /account/{sessionid}/wallet/make-spend make-spend"><code>make-spend</code></a><a class="e" href="#signTx" data-s="sign a staged transaction. /account/{sessionid}/sign-tx/{objectid} sign-tx"><code>sign-tx</code></a><a class="e" href="#broadcastTx" data-s="broadcast a signed transaction. /account/{sessionid}/broadcast-tx/{objectid} broadcast-tx"><code>broadcast-tx</code></a><a class="e" href="#saveTx" data-s="record a transaction and release its handle. /account/{sessionid}/save-tx/{objectid} save-tx"><code>save-tx</code></a><a class="e" href="#accelerate" data-s="fee-bump a pending transaction. /account/{sessionid}/wallet/accelerate accelerate"><code>accelerate</code></a><a class="e" href="#sweepPrivateKeys" data-s="sweep private keys into this wallet. /account/{sessionid}/wallet/sweep-private-keys sweep-private-keys"><code>sweep-private-keys</code></a><a class="e" href="#signBytes" data-s="sign arbitrary bytes. /account/{sessionid}/wallet/sign-bytes sign-bytes"><code>sign-bytes</code></a><a class="e" href="#getPaymentProtocolInfo" data-s="fetch a bip70 payment request. /account/{sessionid}/wallet/get-payment-protocol-info get-payment-protocol-info"><code>get-payment-protocol-info</code></a><div class="g">URIs</div><a class="e" href="#parseUri" data-s="parse a payment uri or address. /account/{sessionid}/wallet/parse-uri parse-uri"><code>parse-uri</code></a><a class="e" href="#encodeUri" data-s="build a payment uri. /account/{sessionid}/wallet/encode-uri encode-uri"><code>encode-uri</code></a><div class="s">Local settings</div><div class="g">Local settings</div><a class="e" href="#localSettings" data-s="local settings. /account/{sessionid}/local-settings local-settings"><code>local-settings</code></a><a class="e" href="#changeLocalSettings" data-s="change local settings. /account/{sessionid}/change-local-settings local-settings"><code>local-settings</code></a><div class="s">Exchange rates</div><div class="g">Exchange rates</div><a class="e" href="#ratesQuery" data-s="batch crypto and fiat rate lookups. /rates/query rates-query"><code>rates-query</code></a><a class="e" href="#ratesUsdToNative" data-s="convert a usd amount into native units. /rates/usd-to-native rates-usd-to-native"><code>rates-usd-to-native</code></a><div class="s">Object handles</div><div class="g">Object handles</div><a class="e" href="#getObject" data-s="inspect an object handle. /account/{sessionid}/object/{objectid} object-get"><code>object-get</code></a><a class="e" href="#deleteObject" data-s="release an object handle. /account/{sessionid}/object/delete/{objectid} object-delete"><code>object-delete</code></a><div class="s">Admin</div><div class="g">Admin</div><a class="e" href="#adminAuthRequest" data-s="raw login-server request. /admin/auth-request admin-auth-request"><code>admin-auth-request</code></a><a class="e" href="#adminHashUsername" data-s="hash a username. /admin/hash-username admin-hash-username"><code>admin-hash-username</code></a><a class="e" href="#adminMakeLobby" data-s="create a lobby. /admin/make-lobby admin-make-lobby"><code>admin-make-lobby</code></a><a class="e" href="#adminDeleteLobbyHandle" data-s="close a parked lobby. /admin/lobby-handle/delete/{objectid} admin-lobby-handle-delete"><code>admin-lobby-handle-delete</code></a><a class="e" href="#adminFetchLobbyRequest" data-s="read a lobby's contents. /admin/fetch-lobby-request/{lobbyid} admin-fetch-lobby-request"><code>admin-fetch-lobby-request</code></a><a class="e" href="#adminSendLobbyReply" data-s="reply to a lobby. /admin/send-lobby-reply/{lobbyid} admin-send-lobby-reply"><code>admin-send-lobby-reply</code></a><a class="e" href="#adminSyncRepo" data-s="sync a repo. /admin/sync-repo/{synckey} admin-sync-repo"><code>admin-sync-repo</code></a><a class="e" href="#adminRepoList" data-s="list repo contents. /admin/repo-list/{synckey} admin-repo-list"><code>admin-repo-list</code></a><a class="e" href="#adminRepoGet" data-s="read a repo file. /admin/repo-get/{synckey} admin-repo-get"><code>admin-repo-get</code></a><a class="e" href="#adminRepoSet" data-s="write a repo file. /admin/repo-set/{synckey} admin-repo-set"><code>admin-repo-set</code></a><a class="e" href="#adminRepoDelete" data-s="delete a repo file. /admin/repo-delete/{synckey} admin-repo-delete"><code>admin-repo-delete</code></a>
+  <div class="g">Reference</div>
+  <a class="e" href="#errors">Error codes</a>
+  <a class="e" href="#exit-codes">Exit codes</a>
+</nav>
+<main>
+<h2 id="overview">Overview</h2>
+<div class="groupdoc"><p>Every entry is one API call shown twice: as an <code>edge-cli</code> command, then as the JSON REST request that command sends. Both are generated from a single declaration in <code>src/cli/engine/routes/</code>, so the two forms cannot drift apart.</p>
+<p>Routes are named after the <code>edge-core-js</code> call they front, kebab-cased: <code>context.forgetAccount</code> becomes <code>POST /forget-account</code>, and the command is <code>forget-account</code>. Parameters carry core&#39;s own names. Every entry states its core call, or says why there is none. Only <code>GET</code> and <code>POST</code> appear — core has no HTTP verbs, so reads are GET and everything else is POST.</p>
+<p>The <code>edge-cli</code> client is a thin one-shot process. A long-lived <code>edge-engine</code> daemon owns the <code>EdgeContext</code> and every logged-in account, serving this API over a Unix socket at <code>~/.edge-cli/run/&lt;profile&gt;/engine.sock</code>, plus loopback TCP when started with <code>--tcp=9008</code>.</p>
+<p><strong>There is no transport authentication.</strong> The socket is owner-only (<code>0600</code>) and TCP is loopback, so anything that can reach the engine can act as every logged-in account.</p>
+<p><a id="object-handles"></a>
+<strong>Ephemeral object handles.</strong> In <code>edge-core-js</code> a method-bearing value is identified by object reference — you call <code>wallet.signTx(tx)</code> on the very <code>tx</code> that <code>makeSpend</code> returned. That does not survive HTTP, so the engine parks such values under an <code>objectId</code> with a 5 minute TTL and later steps name the id. Reads do not extend the TTL; only a step that updates the value does. Finishing a workflow, or <code>POST …/objects/{objectId}/delete</code>, releases the handle early. Expired handles return <code>410 OBJECT_EXPIRED</code>.</p>
+<p><strong>Serialization.</strong> <code>Uint8Array</code> becomes base64, <code>Date</code> becomes an ISO-8601 string, <code>Map</code> becomes an object, amounts are always decimal strings, and <code>EdgeTokenId</code> is JSON <code>null</code> for a native asset.</p>
+<p><strong>Testing.</strong> Always pass <code>-t</code> / <code>--test</code> to point at the <code>*-tester.edge.app</code> servers.</p>
+</div>
+<h2 id="engine">Engine</h2>
+      <div class="groupdoc"><p>The <code>edge-engine</code> daemon itself. None of these have an <code>edge-core-js</code> equivalent — they describe the process — and none need a session.</p>
+</div>
+      <h3 class="sub" id="status">Lifecycle</h3>
+          <div class="groupdoc"><p>Lifecycle and configuration of the <code>edge-engine</code> daemon. None of these have an <code>edge-core-js</code> equivalent — they describe the daemon itself — and none need a session.</p>
+</div>
+          <section class="endpoint" id="engineStatus">
+    <header>
+      <h3><a href="#engineStatus">Engine liveness and summary.</a></h3>
+      <div class="ids"><code class="cmdname">engine-status</code><span class="src" title="Declared in">src/cli/engine/routes/status.ts</span></div>
+    </header>
+    <p class="core none"><span class="lbl">core</span><em>Engine lifecycle; the daemon is not part of the core API.</em></p>
+    <div class="desc"><p>The readiness probe the client polls after auto-spawning the engine.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>engine-status</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/engine/status</code></p>
+    
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/engine/status'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="note"><p><code>idleShutdownAt</code> is null while a session or a subscription holds the engine open, and <code>tcpPort</code> is null unless started with <code>--tcp</code>.</p>
+</div><div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  pid: number
+  apiVersion: string
+  uptimeSeconds: number
+  sessionCount: number
+  testMode: boolean
+  idleShutdownAt: string | null
+  tcpPort: number | null
+  socketPath: string
+  locale: string
+  decimalSeparator: string
+  groupingSeparator: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;pid&quot;: 0,
+  &quot;apiVersion&quot;: &quot;string&quot;,
+  &quot;uptimeSeconds&quot;: 1,
+  &quot;sessionCount&quot;: 1,
+  &quot;testMode&quot;: true,
+  &quot;idleShutdownAt&quot;: &quot;2026-09-02T16:35:00.000Z&quot;,
+  &quot;tcpPort&quot;: 0,
+  &quot;socketPath&quot;: &quot;string&quot;,
+  &quot;locale&quot;: &quot;string&quot;,
+  &quot;decimalSeparator&quot;: &quot;string&quot;,
+  &quot;groupingSeparator&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>pid</code></td>
+  <td class="ty"><span class="t">number</span></td>
+  <td class="doc">The daemon process, for <code>kill</code> when it will not stop.</td>
+</tr>
+<tr>
+  <td class="k"><code>apiVersion</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The API this engine speaks. A client refusing to talk to an older engine checks this.</td>
+</tr>
+<tr>
+  <td class="k"><code>uptimeSeconds</code></td>
+  <td class="ty"><span class="t">number</span></td>
+  <td class="doc">How long the daemon has been running.</td>
+</tr>
+<tr>
+  <td class="k"><code>sessionCount</code></td>
+  <td class="ty"><span class="t">number</span></td>
+  <td class="doc">Logged-in accounts held open right now.</td>
+</tr>
+<tr>
+  <td class="k"><code>testMode</code></td>
+  <td class="ty"><span class="t">boolean</span></td>
+  <td class="doc">True when pointed at the tester fleet.</td>
+</tr>
+<tr>
+  <td class="k"><code>idleShutdownAt</code></td>
+  <td class="ty"><span class="t">string | null</span></td>
+  <td class="doc">When the engine will exit for want of work. Null while a session or a subscription is holding it open, and null when the timeout is disabled.</td>
+</tr>
+<tr>
+  <td class="k"><code>tcpPort</code></td>
+  <td class="ty"><span class="t">number | null</span></td>
+  <td class="doc">The loopback port, null unless started with <code>--tcp</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>socketPath</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Unix socket the CLI connects to.</td>
+</tr>
+<tr>
+  <td class="k"><code>locale</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Language tag the engine resolved at boot.</td>
+</tr>
+<tr>
+  <td class="k"><code>decimalSeparator</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Decimal mark for that locale.</td>
+</tr>
+<tr>
+  <td class="k"><code>groupingSeparator</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Thousands mark for that locale.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-ENGINE_SHUTTING_DOWN" class="err" title="Idle or explicit shutdown already in progress."><span class="st">503</span>ENGINE_SHUTTING_DOWN</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="engineConfig">
+    <header>
+      <h3><a href="#engineConfig">Configured context options.</a></h3>
+      <div class="ids"><code class="cmdname">engine-config</code><span class="src" title="Declared in">src/cli/engine/routes/status.ts</span></div>
+    </header>
+    <p class="core none"><span class="lbl">core</span><em>Reflects the EdgeContextOptions the engine supplied at startup.</em></p>
+    <div class="desc"><p>What the engine passed to <code>makeEdgeContext</code>. Contains no secrets. Use it to assert tester hosts before a test run.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>engine-config</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/engine/config</code></p>
+    
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/engine/config'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  appId: string
+  testMode: boolean
+  directory: string
+  servers: {
+    [keys: string]: string | string[]
+  }
+  plugins: string[]
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;appId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;testMode&quot;: true,
+  &quot;directory&quot;: &quot;string&quot;,
+  &quot;servers&quot;: {},
+  &quot;plugins&quot;: [
+    &quot;string&quot;
+  ]
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>appId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Application ID the engine was started with.</td>
+</tr>
+<tr>
+  <td class="k"><code>testMode</code></td>
+  <td class="ty"><span class="t">boolean</span></td>
+  <td class="doc">True when the engine is pointed at the tester fleet.</td>
+</tr>
+<tr>
+  <td class="k"><code>directory</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Working directory holding the core data.</td>
+</tr>
+<tr>
+  <td class="k"><code>servers</code></td>
+  <td class="ty"><span class="t">{ [keys: string]: string | string[]; }</span></td>
+  <td class="doc">The URLs this engine talks to, keyed by role. <code>syncServer</code> is a list, since core rotates across the sync fleet.</td>
+</tr>
+<tr>
+  <td class="k"><code>plugins</code></td>
+  <td class="ty"><span class="t">string[]</span></td>
+  <td class="doc">Plugin IDs the engine loaded, sorted.</td>
+</tr></tbody></table>
+  </div>
+    
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>Outside <code>-t</code> / <code>--test</code>, <code>servers</code> is an empty object — core is using its built-in production defaults, so there is nothing to echo back.</li></ul></div>
+  </section><section class="endpoint" id="engineStop">
+    <header>
+      <h3><a href="#engineStop">Stop the engine.</a></h3>
+      <div class="ids"><code class="cmdname">engine-stop</code><span class="src" title="Declared in">src/cli/engine/routes/status.ts</span></div>
+    </header>
+    <p class="core none"><span class="lbl">core</span><em>Engine lifecycle. Internally calls <code>context.close()</code>.</em></p>
+    <div class="desc"><p>Logs out every session, closes the context, unlinks the socket and run-file, then exits. The engine answers before it starts tearing down, so a response is not proof the process is gone.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>engine-stop</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/engine/stop</code></p>
+    
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  'http://localhost/engine/stop'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  ok: boolean
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;ok&quot;: true
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>ok</code></td>
+  <td class="ty"><span class="t">boolean</span></td>
+  <td class="doc">Always true; a failure arrives as an error envelope.</td>
+</tr></tbody></table>
+  </div>
+    
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>In-flight callers may see <code>503 ENGINE_SHUTTING_DOWN</code> once teardown starts.</li></ul></div>
+  </section><h3 class="sub" id="events">Event stream</h3>
+          <div class="groupdoc"><p>A Server-Sent Events feed of engine activity, served outside the router because the response never ends.</p>
+</div>
+          <section class="endpoint" id="engineEvents">
+    <header>
+      <h3><a href="#engineEvents">Subscribe to engine events.</a></h3>
+      <div class="ids"><code class="cmdname">subscribe</code><span class="src" title="Declared in">src/cli/engine/routes/events.ts</span></div>
+    </header>
+    <p class="core none"><span class="lbl">core</span><em>Engine-side fan-out; <code>core.log</code> frames carry core&#39;s onLog output.</em></p>
+    <div class="desc"><p>Holds a Server-Sent Events stream open until the caller disconnects or the engine closes it. Runs concurrently with one-shot calls, so a subscriber in one terminal watches what another terminal does.</p>
+<p>A live subscription holds the engine open past its idle timeout. It does not hold an account logged in: the auto-logout timer still fires, and closes any subscription scoped to that account or one of its wallets. Context-scoped subscriptions survive, because the context outlives every account.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>subscribe [--type=&lt;value&gt;]</code></pre>
+    <h5>Client-only flags</h5><table class="fields"><tbody><tr><td class="k"><code>--type</code></td><td class="ty"><span class="flag opt">optional</span></td><td class="doc">Client-side filter; the engine always sends everything the scope allows.</td></tr></tbody></table>
+    <div class="note"><p>Prints newline-delimited JSON and runs until interrupted. Exits 0 on SIGINT, 3 when a session ended the stream, 7 when the engine went away.</p>
+</div>
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/engine/events</code></p>
+    
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/engine/events'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="note"><p>One frame per event, as <code>event:</code> then <code>data:</code> lines.</p>
+</div><div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  type: string
+  data: unknown
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;type&quot;: &quot;string&quot;,
+  &quot;data&quot;: {}
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>type</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The event name.</td>
+</tr>
+<tr>
+  <td class="k"><code>data</code></td>
+  <td class="ty"><span class="t">unknown</span></td>
+  <td class="doc">Payload, shaped by the event type.</td>
+</tr></tbody></table>
+  </div>
+    
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>Frame types: <code>core.log</code>, <code>session.created</code>, <code>session.expired</code>, <code>engine.shutdown</code>, and <code>subscription.closed</code> when the engine ends it.</li><li><code>sessionId</code> in event payloads is truncated to its first 10 characters.</li><li>A client more than 1 MiB behind is disconnected rather than buffered.</li><li>Served directly by the HTTP handler rather than through the router, because the response never ends.</li></ul></div>
+  </section><h2 id="context">Context</h2>
+      <div class="groupdoc"><p>Calls on the shared <code>EdgeContext</code>: device state, username queries, and every way of logging in. None of them need a session, because a session is what they produce.</p>
+</div>
+      <h3 class="sub" id="context">Device and usernames</h3>
+          <div class="groupdoc"><p>Calls on the shared <code>EdgeContext</code>: local device state and login-server queries that do not need a session.</p>
+</div>
+          <section class="endpoint" id="localUsers">
+    <header>
+      <h3><a href="#localUsers">List local users on this device.</a></h3>
+      <div class="ids"><code class="cmdname">local-users</code><span class="src" title="Declared in">src/cli/engine/routes/context.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>context.localUsers</code></p>
+    
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>local-users</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/local-users</code></p>
+    
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/local-users'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="note"><p>Everything <code>context.localUsers</code> reports, including which login methods each user has enabled on this device.</p>
+</div><div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  localUsers: unknown[]
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;localUsers&quot;: [
+    {}
+  ]
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>localUsers</code></td>
+  <td class="ty"><span class="t">unknown[]</span></td>
+  <td class="doc"><code>EdgeUserInfo[]</code>: one entry per account cached on this device.</td>
+</tr></tbody></table>
+  </div>
+    
+  </div>
+    
+  </section><section class="endpoint" id="forgetAccount">
+    <header>
+      <h3><a href="#forgetAccount">Forget an account on this device.</a></h3>
+      <div class="ids"><code class="cmdname">forget-account</code><span class="src" title="Declared in">src/cli/engine/routes/context.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>context.forgetAccount</code></p>
+    <div class="desc"><p>Removes locally cached credentials. The remote account is untouched.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>forget-account --root-login-id=&lt;rootLoginId&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/forget-account</code></p>
+    
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  rootLoginId: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;rootLoginId&quot;: &quot;FS8xJ2kQ…&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>rootLoginId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Core takes a <code>rootLoginId</code>. A username is also accepted and resolved against <code>localUsers</code> first, so callers need not hash it.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;rootLoginId&quot;:&quot;FS8xJ2kQ…&quot;}' \
+  'http://localhost/forget-account'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">204</span></h4>
+    <p class="lead dim">No body.</p>
+    <h5>Errors</h5><p class="errs"><a href="#err-USER_NOT_FOUND" class="err" title="No local user matches that username or login id."><span class="st">404</span>USER_NOT_FOUND</a> <a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="usernameAvailable">
+    <header>
+      <h3><a href="#usernameAvailable">Check whether a username is free.</a></h3>
+      <div class="ids"><code class="cmdname">username-available</code><span class="src" title="Declared in">src/cli/engine/routes/context.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>context.usernameAvailable</code></p>
+    
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>username-available --username=&lt;username&gt; [--challenge-id=&lt;challengeId&gt;]</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/username-available</code></p>
+    
+    <div class="shape">
+    <div class="shape-h">Query</div>
+    <pre class="ts"><code>{
+  username: string
+  challengeId?: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;username&quot;: &quot;string&quot;,
+  &quot;challengeId&quot;: &quot;FS8xJ2kQ…&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>username</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The name to check.</td>
+</tr>
+<tr>
+  <td class="k"><code>challengeId</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Supply after solving a CAPTCHA to retry the same check.</td>
+</tr></tbody></table>
+  </div>
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/username-available?username=…'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  username: string
+  available: boolean
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;username&quot;: &quot;string&quot;,
+  &quot;available&quot;: true
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>username</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The name that was checked, echoed back.</td>
+</tr>
+<tr>
+  <td class="k"><code>available</code></td>
+  <td class="ty"><span class="t">boolean</span></td>
+  <td class="doc">True when nobody holds this name. It is not reserved by asking.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-USERNAME_ERROR" class="err" title="Unknown username, or an invalid recovery key."><span class="st">400</span>USERNAME_ERROR</a> <a href="#err-CHALLENGE_REQUIRED" class="err" title="The login server wants a CAPTCHA. Retry with `challengeId`."><span class="st">403</span>CHALLENGE_REQUIRED</a> <a href="#err-NETWORK_ERROR" class="err" title="Could not reach an Edge server."><span class="st">503</span>NETWORK_ERROR</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="fixUsername">
+    <header>
+      <h3><a href="#fixUsername">Normalize a username.</a></h3>
+      <div class="ids"><code class="cmdname">fix-username</code><span class="src" title="Declared in">src/cli/engine/routes/context.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>context.fixUsername</code></p>
+    <div class="desc"><p>Applies the same rules the login server does, so a caller can show the user what their name will actually be before creating an account.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>fix-username --username=&lt;username&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/fix-username</code></p>
+    
+    <div class="shape">
+    <div class="shape-h">Query</div>
+    <pre class="ts"><code>{
+  username: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;username&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>username</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The name to normalize.</td>
+</tr></tbody></table>
+  </div>
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/fix-username?username=…'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  username: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;username&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>username</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The normalized value. The input is not echoed.</td>
+</tr></tbody></table>
+  </div>
+    
+  </div>
+    
+  </section><section class="endpoint" id="checkPasswordRules">
+    <header>
+      <h3><a href="#checkPasswordRules">Score a candidate password.</a></h3>
+      <div class="ids"><code class="cmdname">check-password-rules</code><span class="src" title="Declared in">src/cli/engine/routes/context.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>context.checkPasswordRules</code></p>
+    
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>check-password-rules --password=&lt;password&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/check-password-rules</code></p>
+    
+    <div class="shape">
+    <div class="shape-h">Query</div>
+    <pre class="ts"><code>{
+  password: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;password&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>password</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The candidate password to score.</td>
+</tr></tbody></table>
+  </div>
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/check-password-rules?password=…'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="note"><p><code>EdgePasswordRules</code> from core: passed, tooShort, noNumber, noLowerCase, noUpperCase, secondsToCrack.</p>
+</div><pre class="ts"><code>unknown</code></pre>
+    
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>Send it with <code>curl --get --data-urlencode</code> rather than putting it in a shell-visible URL.</li></ul></div>
+  </section><section class="endpoint" id="fetchLoginMessages">
+    <header>
+      <h3><a href="#fetchLoginMessages">Fetch login-server messages for every local user.</a></h3>
+      <div class="ids"><code class="cmdname">fetch-login-messages</code><span class="src" title="Declared in">src/cli/engine/routes/context.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>context.fetchLoginMessages</code></p>
+    
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>fetch-login-messages</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/fetch-login-messages</code></p>
+    
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/fetch-login-messages'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="note"><p><code>EdgeLoginMessages</code> from core, keyed by loginId; each value carries otpResetPending and pendingVouchers.</p>
+</div><pre class="ts"><code>unknown</code></pre>
+    <h5>Errors</h5><p class="errs"><a href="#err-NETWORK_ERROR" class="err" title="Could not reach an Edge server."><span class="st">503</span>NETWORK_ERROR</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="requestOtpReset">
+    <header>
+      <h3><a href="#requestOtpReset">Request a 2FA reset.</a></h3>
+      <div class="ids"><code class="cmdname">request-otp-reset</code><span class="src" title="Declared in">src/cli/engine/routes/context.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>context.requestOtpReset</code></p>
+    <div class="desc"><p>Starts the timed reset a user falls back on after losing their authenticator.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>request-otp-reset --username=&lt;username&gt; --otp-reset-token=&lt;otpResetToken&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/request-otp-reset</code></p>
+    
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  username: string
+  otpResetToken: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;username&quot;: &quot;string&quot;,
+  &quot;otpResetToken&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>username</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Whose 2FA to reset.</td>
+</tr>
+<tr>
+  <td class="k"><code>otpResetToken</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">From <code>details.resetToken</code> on an <code>OTP_REQUIRED</code> error.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;username&quot;:&quot;string&quot;,&quot;otpResetToken&quot;:&quot;string&quot;}' \
+  'http://localhost/request-otp-reset'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="note"><p>When the reset completes if nobody cancels it.</p>
+</div><div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  resetDate: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;resetDate&quot;: &quot;2026-09-02T16:35:00.000Z&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>resetDate</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">When 2FA will actually come off. The login server enforces a waiting period so the real owner has time to cancel.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-USERNAME_ERROR" class="err" title="Unknown username, or an invalid recovery key."><span class="st">400</span>USERNAME_ERROR</a> <a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a> <a href="#err-NETWORK_ERROR" class="err" title="Could not reach an Edge server."><span class="st">503</span>NETWORK_ERROR</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="fetchRecoveryQuestions">
+    <header>
+      <h3><a href="#fetchRecoveryQuestions">Fetch a user’s recovery questions.</a></h3>
+      <div class="ids"><code class="cmdname">fetch-recovery-questions</code><span class="src" title="Declared in">src/cli/engine/routes/context.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>context.fetchRecovery2Questions</code> <span class="dim">Our surface drops the <code>2</code> from the path, command and <code>recoveryKey</code> parameter; a future Recovery1 would be suffixed <code>V1</code>.</span></p><div class="note"><p><strong>Differs from core:</strong></p><ul><li><code>recoveryKey</code> — Core calls it recovery2Key. The <code>2</code> is dropped throughout.</li></ul></div>
+    
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>fetch-recovery-questions --recovery-key=&lt;recoveryKey&gt; --username=&lt;username&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/fetch-recovery-questions</code></p>
+    
+    <div class="shape">
+    <div class="shape-h">Query</div>
+    <pre class="ts"><code>{
+  recoveryKey: string
+  username: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;recoveryKey&quot;: &quot;string&quot;,
+  &quot;username&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>recoveryKey</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">From <code>change-recovery</code>, stored by the user out of band.</td>
+</tr>
+<tr>
+  <td class="k"><code>username</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Whose questions to fetch.</td>
+</tr></tbody></table>
+  </div>
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/fetch-recovery-questions?recoveryKey=…&amp;username=…'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  questions: string[]
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;questions&quot;: [
+    &quot;string&quot;
+  ]
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>questions</code></td>
+  <td class="ty"><span class="t">string[]</span></td>
+  <td class="doc">The questions in the order <code>login-with-recovery</code> expects the answers.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-USERNAME_ERROR" class="err" title="Unknown username, or an invalid recovery key."><span class="st">400</span>USERNAME_ERROR</a> <a href="#err-NETWORK_ERROR" class="err" title="Could not reach an Edge server."><span class="st">503</span>NETWORK_ERROR</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="fetchChallenge">
+    <header>
+      <h3><a href="#fetchChallenge">Pre-fetch a CAPTCHA challenge.</a></h3>
+      <div class="ids"><code class="cmdname">fetch-challenge</code><span class="src" title="Declared in">src/cli/engine/routes/context.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>context.fetchChallenge</code></p>
+    <div class="desc"><p>Lets a client solve a challenge before it hits <code>403 CHALLENGE_REQUIRED</code> mid-flow.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>fetch-challenge</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/fetch-challenge</code></p>
+    
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  'http://localhost/fetch-challenge'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="note"><p><code>challengeUri</code> is absent when the server considers the challenge already satisfied.</p>
+</div><div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  challengeId: string
+  challengeUri?: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;challengeId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;challengeUri&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>challengeId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Pass to the call that demanded a challenge once the user has solved it.</td>
+</tr>
+<tr>
+  <td class="k"><code>challengeUri</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Where to send the user to solve the CAPTCHA. Absent when the server issued a challenge that needs no interaction.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-NETWORK_ERROR" class="err" title="Could not reach an Edge server."><span class="st">503</span>NETWORK_ERROR</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="currencyConfigs">
+    <header>
+      <h3><a href="#currencyConfigs">List plugin ids usable for wallet creation.</a></h3>
+      <div class="ids"><code class="cmdname">currency-configs</code><span class="src" title="Declared in">src/cli/engine/routes/context.ts</span></div>
+    </header>
+    <p class="core none"><span class="lbl">core</span><em>Engine view of the enabled plugin set; core exposes <code>account.currencyConfig</code> per plugin instead.</em></p>
+    <div class="desc"><p>Currency and accountbased plugins only — swap plugins are excluded.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>currency-configs</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/currency-configs</code></p>
+    
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/currency-configs'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  pluginIds: string[]
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;pluginIds&quot;: [
+    &quot;string&quot;
+  ]
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>pluginIds</code></td>
+  <td class="ty"><span class="t">string[]</span></td>
+  <td class="doc">Currency plugins this engine loaded.</td>
+</tr></tbody></table>
+  </div>
+    
+  </div>
+    
+  </section><h3 class="sub" id="login">Login methods</h3>
+          <div class="groupdoc"><p>Every successful login returns a <a href="#schema-Session">Session</a> and registers it in the engine, so later calls need only the <code>sessionId</code>. The CLI writes that id to <code>session.json</code> automatically.</p>
+</div>
+          <section class="endpoint" id="loginWithPassword">
+    <header>
+      <h3><a href="#loginWithPassword">Log in with a password.</a></h3>
+      <div class="ids"><code class="cmdname">login-with-password</code><span class="src" title="Declared in">src/cli/engine/routes/login.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>context.loginWithPassword</code></p>
+    
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>login-with-password [--otp=&lt;otp&gt;] [--otp-key=&lt;otpKey&gt;] [--challenge-id=&lt;challengeId&gt;] --username=&lt;username&gt; --password=&lt;password&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/login-with-password</code></p>
+    
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  otp?: string
+  otpKey?: string
+  challengeId?: string
+  username: string
+  password: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;otp&quot;: &quot;string&quot;,
+  &quot;otpKey&quot;: &quot;string&quot;,
+  &quot;challengeId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;username&quot;: &quot;string&quot;,
+  &quot;password&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>otp</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">A current 2FA code.</td>
+</tr>
+<tr>
+  <td class="k"><code>otpKey</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">The 2FA secret itself, instead of a code.</td>
+</tr>
+<tr>
+  <td class="k"><code>challengeId</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Supply after solving a CAPTCHA to retry the same request.</td>
+</tr>
+<tr>
+  <td class="k"><code>username</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The account name.</td>
+</tr>
+<tr>
+  <td class="k"><code>password</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The account password.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;otp&quot;:&quot;string&quot;,&quot;otpKey&quot;:&quot;string&quot;,&quot;challengeId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;username&quot;:&quot;string&quot;,&quot;password&quot;:&quot;string&quot;}' \
+  'http://localhost/login-with-password'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="note"><p>A session with <code>loginMethod: &quot;password&quot;</code>.</p>
+</div><div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  sessionId: string
+  username?: string
+  rootLoginId: string
+  loginMethod: &quot;password&quot; | &quot;pin&quot; | &quot;key&quot; | &quot;recovery&quot; | &quot;edge&quot; | &quot;create&quot;
+  autoLogoutSeconds: number
+  expiresAt: string | null
+  lastActivityAt: string
+  createdAt: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;sessionId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;username&quot;: &quot;string&quot;,
+  &quot;rootLoginId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;loginMethod&quot;: &quot;&lt;\&quot;password\&quot;&gt;&quot;,
+  &quot;autoLogoutSeconds&quot;: 1,
+  &quot;expiresAt&quot;: &quot;2026-09-02T16:35:00.000Z&quot;,
+  &quot;lastActivityAt&quot;: &quot;2026-09-02T16:35:00.000Z&quot;,
+  &quot;createdAt&quot;: &quot;2026-09-02T16:35:00.000Z&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>sessionId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Identifies this login. Every account-scoped call carries it, and the CLI stores the most recent one so commands can omit it.</td>
+</tr>
+<tr>
+  <td class="k"><code>username</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Absent for a light account, which has no username.</td>
+</tr>
+<tr>
+  <td class="k"><code>rootLoginId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The account root, stable across appIds. Two sessions sharing it are the same account.</td>
+</tr>
+<tr>
+  <td class="k"><code>loginMethod</code></td>
+  <td class="ty"><span class="t">&quot;password&quot; | &quot;pin&quot; | &quot;key&quot; | &quot;recovery&quot; | &quot;edge&quot; | &quot;create&quot;</span></td>
+  <td class="doc">How this session was established.</td>
+</tr>
+<tr>
+  <td class="k"><code>autoLogoutSeconds</code></td>
+  <td class="ty"><span class="t">number</span></td>
+  <td class="doc">Idle time before the engine logs the account out. 0 disables it.</td>
+</tr>
+<tr>
+  <td class="k"><code>expiresAt</code></td>
+  <td class="ty"><span class="t">string | null</span></td>
+  <td class="doc">When auto-logout will fire, or null when it is disabled.</td>
+</tr>
+<tr>
+  <td class="k"><code>lastActivityAt</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Last call on this session, which is what auto-logout measures from.</td>
+</tr>
+<tr>
+  <td class="k"><code>createdAt</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">When the login completed.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-PASSWORD_ERROR" class="err" title="Wrong password, PIN, or recovery answers."><span class="st">401</span>PASSWORD_ERROR</a> <a href="#err-USERNAME_ERROR" class="err" title="Unknown username, or an invalid recovery key."><span class="st">400</span>USERNAME_ERROR</a> <a href="#err-OTP_REQUIRED" class="err" title="Missing or wrong 2FA token."><span class="st">401</span>OTP_REQUIRED</a> <a href="#err-CHALLENGE_REQUIRED" class="err" title="The login server wants a CAPTCHA. Retry with `challengeId`."><span class="st">403</span>CHALLENGE_REQUIRED</a> <a href="#err-NETWORK_ERROR" class="err" title="Could not reach an Edge server."><span class="st">503</span>NETWORK_ERROR</a></p>
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>With <code>--solve-captcha</code> the client solves a <code>CHALLENGE_REQUIRED</code> response headlessly (ALTCHA proof-of-work) and retries once.</li></ul></div>
+  </section><section class="endpoint" id="loginWithPin">
+    <header>
+      <h3><a href="#loginWithPin">Log in with a device PIN.</a></h3>
+      <div class="ids"><code class="cmdname">login-with-pin</code><span class="src" title="Declared in">src/cli/engine/routes/login.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>context.loginWithPIN</code></p>
+    <div class="desc"><p>Only works on a device that has already saved a PIN for the account.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>login-with-pin [--otp=&lt;otp&gt;] [--otp-key=&lt;otpKey&gt;] [--challenge-id=&lt;challengeId&gt;] --username-or-login-id=&lt;usernameOrLoginId&gt; --pin=&lt;pin&gt; [--use-login-id]</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/login-with-pin</code></p>
+    
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  otp?: string
+  otpKey?: string
+  challengeId?: string
+  usernameOrLoginId: string
+  pin: string
+  useLoginId?: boolean
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;otp&quot;: &quot;string&quot;,
+  &quot;otpKey&quot;: &quot;string&quot;,
+  &quot;challengeId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;usernameOrLoginId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;pin&quot;: &quot;string&quot;,
+  &quot;useLoginId&quot;: true
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>otp</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">A current 2FA code.</td>
+</tr>
+<tr>
+  <td class="k"><code>otpKey</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">The 2FA secret itself, instead of a code.</td>
+</tr>
+<tr>
+  <td class="k"><code>challengeId</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Supply after solving a CAPTCHA to retry the same request.</td>
+</tr>
+<tr>
+  <td class="k"><code>usernameOrLoginId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">A username, or a login id.</td>
+</tr>
+<tr>
+  <td class="k"><code>pin</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The device PIN.</td>
+</tr>
+<tr>
+  <td class="k"><code>useLoginId</code></td>
+  <td class="ty"><span class="t">boolean</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Treat the value as a login id.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;otp&quot;:&quot;string&quot;,&quot;otpKey&quot;:&quot;string&quot;,&quot;challengeId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;usernameOrLoginId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;pin&quot;:&quot;string&quot;,&quot;useLoginId&quot;:true}' \
+  'http://localhost/login-with-pin'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="note"><p>A session with <code>loginMethod: &quot;pin&quot;</code>.</p>
+</div><div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  sessionId: string
+  username?: string
+  rootLoginId: string
+  loginMethod: &quot;password&quot; | &quot;pin&quot; | &quot;key&quot; | &quot;recovery&quot; | &quot;edge&quot; | &quot;create&quot;
+  autoLogoutSeconds: number
+  expiresAt: string | null
+  lastActivityAt: string
+  createdAt: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;sessionId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;username&quot;: &quot;string&quot;,
+  &quot;rootLoginId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;loginMethod&quot;: &quot;&lt;\&quot;password\&quot;&gt;&quot;,
+  &quot;autoLogoutSeconds&quot;: 1,
+  &quot;expiresAt&quot;: &quot;2026-09-02T16:35:00.000Z&quot;,
+  &quot;lastActivityAt&quot;: &quot;2026-09-02T16:35:00.000Z&quot;,
+  &quot;createdAt&quot;: &quot;2026-09-02T16:35:00.000Z&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>sessionId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Identifies this login. Every account-scoped call carries it, and the CLI stores the most recent one so commands can omit it.</td>
+</tr>
+<tr>
+  <td class="k"><code>username</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Absent for a light account, which has no username.</td>
+</tr>
+<tr>
+  <td class="k"><code>rootLoginId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The account root, stable across appIds. Two sessions sharing it are the same account.</td>
+</tr>
+<tr>
+  <td class="k"><code>loginMethod</code></td>
+  <td class="ty"><span class="t">&quot;password&quot; | &quot;pin&quot; | &quot;key&quot; | &quot;recovery&quot; | &quot;edge&quot; | &quot;create&quot;</span></td>
+  <td class="doc">How this session was established.</td>
+</tr>
+<tr>
+  <td class="k"><code>autoLogoutSeconds</code></td>
+  <td class="ty"><span class="t">number</span></td>
+  <td class="doc">Idle time before the engine logs the account out. 0 disables it.</td>
+</tr>
+<tr>
+  <td class="k"><code>expiresAt</code></td>
+  <td class="ty"><span class="t">string | null</span></td>
+  <td class="doc">When auto-logout will fire, or null when it is disabled.</td>
+</tr>
+<tr>
+  <td class="k"><code>lastActivityAt</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Last call on this session, which is what auto-logout measures from.</td>
+</tr>
+<tr>
+  <td class="k"><code>createdAt</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">When the login completed.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-PASSWORD_ERROR" class="err" title="Wrong password, PIN, or recovery answers."><span class="st">401</span>PASSWORD_ERROR</a> <a href="#err-PIN_DISABLED" class="err" title="PIN login is not enabled on this device."><span class="st">403</span>PIN_DISABLED</a> <a href="#err-USERNAME_ERROR" class="err" title="Unknown username, or an invalid recovery key."><span class="st">400</span>USERNAME_ERROR</a> <a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a> <a href="#err-NETWORK_ERROR" class="err" title="Could not reach an Edge server."><span class="st">503</span>NETWORK_ERROR</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="loginWithKey">
+    <header>
+      <h3><a href="#loginWithKey">Log in with an account login key.</a></h3>
+      <div class="ids"><code class="cmdname">login-with-key</code><span class="src" title="Declared in">src/cli/engine/routes/login.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>context.loginWithKey</code></p>
+    <div class="desc"><p>The key comes from <code>get-login-key</code> on an already-authenticated session.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>login-with-key [--otp=&lt;otp&gt;] [--otp-key=&lt;otpKey&gt;] [--challenge-id=&lt;challengeId&gt;] --username-or-login-id=&lt;usernameOrLoginId&gt; --login-key=&lt;loginKey&gt; [--use-login-id]</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/login-with-key</code></p>
+    
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  otp?: string
+  otpKey?: string
+  challengeId?: string
+  usernameOrLoginId: string
+  loginKey: string
+  useLoginId?: boolean
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;otp&quot;: &quot;string&quot;,
+  &quot;otpKey&quot;: &quot;string&quot;,
+  &quot;challengeId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;usernameOrLoginId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;loginKey&quot;: &quot;string&quot;,
+  &quot;useLoginId&quot;: true
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>otp</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">A current 2FA code.</td>
+</tr>
+<tr>
+  <td class="k"><code>otpKey</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">The 2FA secret itself, instead of a code.</td>
+</tr>
+<tr>
+  <td class="k"><code>challengeId</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Supply after solving a CAPTCHA to retry the same request.</td>
+</tr>
+<tr>
+  <td class="k"><code>usernameOrLoginId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">A username, or a login id.</td>
+</tr>
+<tr>
+  <td class="k"><code>loginKey</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">From <code>get-login-key</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>useLoginId</code></td>
+  <td class="ty"><span class="t">boolean</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Treat the value as a login id.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;otp&quot;:&quot;string&quot;,&quot;otpKey&quot;:&quot;string&quot;,&quot;challengeId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;usernameOrLoginId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;loginKey&quot;:&quot;string&quot;,&quot;useLoginId&quot;:true}' \
+  'http://localhost/login-with-key'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="note"><p>A session with <code>loginMethod: &quot;key&quot;</code>.</p>
+</div><div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  sessionId: string
+  username?: string
+  rootLoginId: string
+  loginMethod: &quot;password&quot; | &quot;pin&quot; | &quot;key&quot; | &quot;recovery&quot; | &quot;edge&quot; | &quot;create&quot;
+  autoLogoutSeconds: number
+  expiresAt: string | null
+  lastActivityAt: string
+  createdAt: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;sessionId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;username&quot;: &quot;string&quot;,
+  &quot;rootLoginId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;loginMethod&quot;: &quot;&lt;\&quot;password\&quot;&gt;&quot;,
+  &quot;autoLogoutSeconds&quot;: 1,
+  &quot;expiresAt&quot;: &quot;2026-09-02T16:35:00.000Z&quot;,
+  &quot;lastActivityAt&quot;: &quot;2026-09-02T16:35:00.000Z&quot;,
+  &quot;createdAt&quot;: &quot;2026-09-02T16:35:00.000Z&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>sessionId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Identifies this login. Every account-scoped call carries it, and the CLI stores the most recent one so commands can omit it.</td>
+</tr>
+<tr>
+  <td class="k"><code>username</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Absent for a light account, which has no username.</td>
+</tr>
+<tr>
+  <td class="k"><code>rootLoginId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The account root, stable across appIds. Two sessions sharing it are the same account.</td>
+</tr>
+<tr>
+  <td class="k"><code>loginMethod</code></td>
+  <td class="ty"><span class="t">&quot;password&quot; | &quot;pin&quot; | &quot;key&quot; | &quot;recovery&quot; | &quot;edge&quot; | &quot;create&quot;</span></td>
+  <td class="doc">How this session was established.</td>
+</tr>
+<tr>
+  <td class="k"><code>autoLogoutSeconds</code></td>
+  <td class="ty"><span class="t">number</span></td>
+  <td class="doc">Idle time before the engine logs the account out. 0 disables it.</td>
+</tr>
+<tr>
+  <td class="k"><code>expiresAt</code></td>
+  <td class="ty"><span class="t">string | null</span></td>
+  <td class="doc">When auto-logout will fire, or null when it is disabled.</td>
+</tr>
+<tr>
+  <td class="k"><code>lastActivityAt</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Last call on this session, which is what auto-logout measures from.</td>
+</tr>
+<tr>
+  <td class="k"><code>createdAt</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">When the login completed.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-PASSWORD_ERROR" class="err" title="Wrong password, PIN, or recovery answers."><span class="st">401</span>PASSWORD_ERROR</a> <a href="#err-USERNAME_ERROR" class="err" title="Unknown username, or an invalid recovery key."><span class="st">400</span>USERNAME_ERROR</a> <a href="#err-NETWORK_ERROR" class="err" title="Could not reach an Edge server."><span class="st">503</span>NETWORK_ERROR</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="loginWithRecovery">
+    <header>
+      <h3><a href="#loginWithRecovery">Log in with recovery answers.</a></h3>
+      <div class="ids"><code class="cmdname">login-with-recovery</code><span class="src" title="Declared in">src/cli/engine/routes/login.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>context.loginWithRecovery2</code> <span class="dim">Our surface drops the <code>2</code> from core&#39;s recovery2 naming, and calls the key <code>recoveryKey</code> to match what <code>change-recovery</code> returns.</span></p><div class="note"><p><strong>Differs from core:</strong></p><ul><li><code>recoveryKey</code> — Core calls it recovery2Key. The <code>2</code> is dropped throughout.</li></ul></div>
+    <div class="desc"><p>Needs both the recovery key and the answers; neither works alone.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>login-with-recovery [--otp=&lt;otp&gt;] [--otp-key=&lt;otpKey&gt;] [--challenge-id=&lt;challengeId&gt;] --recovery-key=&lt;recoveryKey&gt; --username=&lt;username&gt; --answer=&lt;answers&gt; …</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/login-with-recovery</code></p>
+    
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  otp?: string
+  otpKey?: string
+  challengeId?: string
+  recoveryKey: string
+  username: string
+  answers: string[]
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;otp&quot;: &quot;string&quot;,
+  &quot;otpKey&quot;: &quot;string&quot;,
+  &quot;challengeId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;recoveryKey&quot;: &quot;string&quot;,
+  &quot;username&quot;: &quot;string&quot;,
+  &quot;answers&quot;: [
+    &quot;string&quot;
+  ]
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>otp</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">A current 2FA code.</td>
+</tr>
+<tr>
+  <td class="k"><code>otpKey</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">The 2FA secret itself, instead of a code.</td>
+</tr>
+<tr>
+  <td class="k"><code>challengeId</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Supply after solving a CAPTCHA to retry the same request.</td>
+</tr>
+<tr>
+  <td class="k"><code>recoveryKey</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">From <code>change-recovery</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>username</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The account name.</td>
+</tr>
+<tr>
+  <td class="k"><code>answers</code></td>
+  <td class="ty"><span class="t">string[]</span></td>
+  <td class="doc">In the same order as the questions.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;otp&quot;:&quot;string&quot;,&quot;otpKey&quot;:&quot;string&quot;,&quot;challengeId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;recoveryKey&quot;:&quot;string&quot;,&quot;username&quot;:&quot;string&quot;,&quot;answers&quot;:[&quot;string&quot;]}' \
+  'http://localhost/login-with-recovery'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="note"><p>A session with <code>loginMethod: &quot;recovery&quot;</code>.</p>
+</div><div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  sessionId: string
+  username?: string
+  rootLoginId: string
+  loginMethod: &quot;password&quot; | &quot;pin&quot; | &quot;key&quot; | &quot;recovery&quot; | &quot;edge&quot; | &quot;create&quot;
+  autoLogoutSeconds: number
+  expiresAt: string | null
+  lastActivityAt: string
+  createdAt: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;sessionId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;username&quot;: &quot;string&quot;,
+  &quot;rootLoginId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;loginMethod&quot;: &quot;&lt;\&quot;password\&quot;&gt;&quot;,
+  &quot;autoLogoutSeconds&quot;: 1,
+  &quot;expiresAt&quot;: &quot;2026-09-02T16:35:00.000Z&quot;,
+  &quot;lastActivityAt&quot;: &quot;2026-09-02T16:35:00.000Z&quot;,
+  &quot;createdAt&quot;: &quot;2026-09-02T16:35:00.000Z&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>sessionId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Identifies this login. Every account-scoped call carries it, and the CLI stores the most recent one so commands can omit it.</td>
+</tr>
+<tr>
+  <td class="k"><code>username</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Absent for a light account, which has no username.</td>
+</tr>
+<tr>
+  <td class="k"><code>rootLoginId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The account root, stable across appIds. Two sessions sharing it are the same account.</td>
+</tr>
+<tr>
+  <td class="k"><code>loginMethod</code></td>
+  <td class="ty"><span class="t">&quot;password&quot; | &quot;pin&quot; | &quot;key&quot; | &quot;recovery&quot; | &quot;edge&quot; | &quot;create&quot;</span></td>
+  <td class="doc">How this session was established.</td>
+</tr>
+<tr>
+  <td class="k"><code>autoLogoutSeconds</code></td>
+  <td class="ty"><span class="t">number</span></td>
+  <td class="doc">Idle time before the engine logs the account out. 0 disables it.</td>
+</tr>
+<tr>
+  <td class="k"><code>expiresAt</code></td>
+  <td class="ty"><span class="t">string | null</span></td>
+  <td class="doc">When auto-logout will fire, or null when it is disabled.</td>
+</tr>
+<tr>
+  <td class="k"><code>lastActivityAt</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Last call on this session, which is what auto-logout measures from.</td>
+</tr>
+<tr>
+  <td class="k"><code>createdAt</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">When the login completed.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-PASSWORD_ERROR" class="err" title="Wrong password, PIN, or recovery answers."><span class="st">401</span>PASSWORD_ERROR</a> <a href="#err-USERNAME_ERROR" class="err" title="Unknown username, or an invalid recovery key."><span class="st">400</span>USERNAME_ERROR</a> <a href="#err-NETWORK_ERROR" class="err" title="Could not reach an Edge server."><span class="st">503</span>NETWORK_ERROR</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="createAccount">
+    <header>
+      <h3><a href="#createAccount">Create an account.</a></h3>
+      <div class="ids"><code class="cmdname">create-account</code><span class="src" title="Declared in">src/cli/engine/routes/login.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>context.createAccount</code></p>
+    <div class="desc"><p>Every credential is optional over REST: omitting all three creates a light account with no username.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>create-account [--otp=&lt;otp&gt;] [--otp-key=&lt;otpKey&gt;] [--challenge-id=&lt;challengeId&gt;] [--username=&lt;username&gt;] [--password=&lt;password&gt;] [--pin=&lt;pin&gt;]</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/create-account</code></p>
+    
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  otp?: string
+  otpKey?: string
+  challengeId?: string
+  username?: string
+  password?: string
+  pin?: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;otp&quot;: &quot;string&quot;,
+  &quot;otpKey&quot;: &quot;string&quot;,
+  &quot;challengeId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;username&quot;: &quot;string&quot;,
+  &quot;password&quot;: &quot;string&quot;,
+  &quot;pin&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>otp</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">A current 2FA code.</td>
+</tr>
+<tr>
+  <td class="k"><code>otpKey</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">The 2FA secret itself, instead of a code.</td>
+</tr>
+<tr>
+  <td class="k"><code>challengeId</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Supply after solving a CAPTCHA to retry the same request.</td>
+</tr>
+<tr>
+  <td class="k"><code>username</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">The name to claim.</td>
+</tr>
+<tr>
+  <td class="k"><code>password</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">The account password.</td>
+</tr>
+<tr>
+  <td class="k"><code>pin</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">A device PIN to save.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;otp&quot;:&quot;string&quot;,&quot;otpKey&quot;:&quot;string&quot;,&quot;challengeId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;username&quot;:&quot;string&quot;,&quot;password&quot;:&quot;string&quot;,&quot;pin&quot;:&quot;string&quot;}' \
+  'http://localhost/create-account'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="note"><p>A session with <code>loginMethod: &quot;create&quot;</code>.</p>
+</div><div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  sessionId: string
+  username?: string
+  rootLoginId: string
+  loginMethod: &quot;password&quot; | &quot;pin&quot; | &quot;key&quot; | &quot;recovery&quot; | &quot;edge&quot; | &quot;create&quot;
+  autoLogoutSeconds: number
+  expiresAt: string | null
+  lastActivityAt: string
+  createdAt: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;sessionId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;username&quot;: &quot;string&quot;,
+  &quot;rootLoginId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;loginMethod&quot;: &quot;&lt;\&quot;password\&quot;&gt;&quot;,
+  &quot;autoLogoutSeconds&quot;: 1,
+  &quot;expiresAt&quot;: &quot;2026-09-02T16:35:00.000Z&quot;,
+  &quot;lastActivityAt&quot;: &quot;2026-09-02T16:35:00.000Z&quot;,
+  &quot;createdAt&quot;: &quot;2026-09-02T16:35:00.000Z&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>sessionId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Identifies this login. Every account-scoped call carries it, and the CLI stores the most recent one so commands can omit it.</td>
+</tr>
+<tr>
+  <td class="k"><code>username</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Absent for a light account, which has no username.</td>
+</tr>
+<tr>
+  <td class="k"><code>rootLoginId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The account root, stable across appIds. Two sessions sharing it are the same account.</td>
+</tr>
+<tr>
+  <td class="k"><code>loginMethod</code></td>
+  <td class="ty"><span class="t">&quot;password&quot; | &quot;pin&quot; | &quot;key&quot; | &quot;recovery&quot; | &quot;edge&quot; | &quot;create&quot;</span></td>
+  <td class="doc">How this session was established.</td>
+</tr>
+<tr>
+  <td class="k"><code>autoLogoutSeconds</code></td>
+  <td class="ty"><span class="t">number</span></td>
+  <td class="doc">Idle time before the engine logs the account out. 0 disables it.</td>
+</tr>
+<tr>
+  <td class="k"><code>expiresAt</code></td>
+  <td class="ty"><span class="t">string | null</span></td>
+  <td class="doc">When auto-logout will fire, or null when it is disabled.</td>
+</tr>
+<tr>
+  <td class="k"><code>lastActivityAt</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Last call on this session, which is what auto-logout measures from.</td>
+</tr>
+<tr>
+  <td class="k"><code>createdAt</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">When the login completed.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-USERNAME_ERROR" class="err" title="Unknown username, or an invalid recovery key."><span class="st">400</span>USERNAME_ERROR</a> <a href="#err-CHALLENGE_REQUIRED" class="err" title="The login server wants a CAPTCHA. Retry with `challengeId`."><span class="st">403</span>CHALLENGE_REQUIRED</a> <a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a> <a href="#err-NETWORK_ERROR" class="err" title="Could not reach an Edge server."><span class="st">503</span>NETWORK_ERROR</a></p>
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>The command requires a username, password and PIN. Creating a light account is REST-only.</li></ul></div>
+  </section><section class="endpoint" id="requestEdgeLogin">
+    <header>
+      <h3><a href="#requestEdgeLogin">Start a QR login.</a></h3>
+      <div class="ids"><code class="cmdname">request-edge-login</code><span class="src" title="Declared in">src/cli/engine/routes/login.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>context.requestEdgeLogin</code></p>
+    <div class="desc"><p>Asks the login server for a lobby another logged-in Edge device can approve. The returned <code>lobbyId</code> is what goes in the QR code.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>request-edge-login [--no-wait]</code></pre>
+    <h5>Client-only flags</h5><table class="fields"><tbody><tr><td class="k"><code>--no-wait</code></td><td class="ty"><span class="flag opt">optional</span></td><td class="doc">Print the lobby and exit instead of polling, so the QR can be displayed while <code>poll-edge-login</code> watches the same handle from another process.</td></tr></tbody></table>
+    <div class="note"><p>Prints the pending login, then polls every 2s for up to 5 minutes. On <code>done</code> it stores the session. With <code>--no-wait</code> it returns immediately and <code>poll-edge-login</code> takes over.</p>
+</div>
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/request-edge-login</code></p>
+    
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  'http://localhost/request-edge-login'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  objectId: string
+  pendingId: string
+  kind: string
+  expiresAt: string | null
+  lobbyId: string
+  uri: string
+  state: string
+  username: string | null
+  session: {
+    sessionId: string;
+    username: string | undefined;
+    rootLoginId: string;
+    loginMethod: &quot;password&quot; | &quot;pin&quot; | &quot;key&quot; | &quot;recovery&quot; | &quot;edge&quot; | &quot;create&quot;;
+    autoLogoutSeconds: number;
+    expiresAt: string | null;
+    lastActivityAt: string;
+    createdAt: string
+  } | null
+  error: string | null
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;objectId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;pendingId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;kind&quot;: &quot;string&quot;,
+  &quot;expiresAt&quot;: &quot;2026-09-02T16:35:00.000Z&quot;,
+  &quot;lobbyId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;uri&quot;: &quot;string&quot;,
+  &quot;state&quot;: &quot;string&quot;,
+  &quot;username&quot;: &quot;string&quot;,
+  &quot;session&quot;: {},
+  &quot;error&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>objectId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Handle for the value the engine is holding. Pass it to the calls that consume it.</td>
+</tr>
+<tr>
+  <td class="k"><code>pendingId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Same value as <code>objectId</code>, under the name the poll command takes.</td>
+</tr>
+<tr>
+  <td class="k"><code>kind</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">What the handle refers to, which decides the calls that accept it.</td>
+</tr>
+<tr>
+  <td class="k"><code>expiresAt</code></td>
+  <td class="ty"><span class="t">string | null</span></td>
+  <td class="doc">When the lobby closes and the QR code stops working.</td>
+</tr>
+<tr>
+  <td class="k"><code>lobbyId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Lobby the phone connects to.</td>
+</tr>
+<tr>
+  <td class="k"><code>uri</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The <code>edge://</code> URI to render as a QR code for the phone to scan.</td>
+</tr>
+<tr>
+  <td class="k"><code>state</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">How far the login has got: <code>pending</code> before the phone scans, <code>started</code> once it has, and <code>done</code> when <code>session</code> is filled in.</td>
+</tr>
+<tr>
+  <td class="k"><code>username</code></td>
+  <td class="ty"><span class="t">string | null</span></td>
+  <td class="doc">Account that approved the login, known once the phone has scanned.</td>
+</tr>
+<tr>
+  <td class="k"><code>session</code></td>
+  <td class="ty"><span class="t">{ sessionId: string; username: string | undefined; rootLoginId: string; loginMethod: &quot;password&quot; | &quot;pin&quot; | &quot;key&quot; | &quot;recovery&quot; | &quot;edge&quot; | &quot;create&quot;; autoLogoutSeconds: number; expiresAt: string | null; lastActivityAt: string; createdAt: string; } | null</span></td>
+  <td class="doc">The session, null until <code>state</code> is <code>done</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>error</code></td>
+  <td class="ty"><span class="t">string | null</span></td>
+  <td class="doc">Why the login failed, set only when <code>state</code> is <code>error</code>.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-NETWORK_ERROR" class="err" title="Could not reach an Edge server."><span class="st">503</span>NETWORK_ERROR</a></p>
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>The pending login is an object handle with a 5 minute TTL. On expiry the engine cancels the request on the login server for you.</li></ul></div>
+  </section><section class="endpoint" id="pollEdgeLogin">
+    <header>
+      <h3><a href="#pollEdgeLogin">Poll a pending QR login.</a></h3>
+      <div class="ids"><code class="cmdname">poll-edge-login</code><span class="src" title="Declared in">src/cli/engine/routes/login.ts</span></div>
+    </header>
+    <p class="core none"><span class="lbl">core</span><em>Engine state for an in-flight requestEdgeLogin; core exposes it as EdgePendingEdgeLogin properties.</em></p>
+    <div class="desc"><p>Once <code>state</code> reaches <code>done</code> the engine has already created the session, so the response carries one ready to use.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>poll-edge-login &lt;pendingId&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/pending-edge-login/{pendingId}</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>pendingId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">The <code>pendingId</code> returned when the QR login was requested.</td></tr></tbody></table>
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/pending-edge-login/$PENDINGID'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  objectId: string
+  pendingId: string
+  kind: string
+  expiresAt: string | null
+  lobbyId: string
+  uri: string
+  state: string
+  username: string | null
+  session: {
+    sessionId: string;
+    username: string | undefined;
+    rootLoginId: string;
+    loginMethod: &quot;password&quot; | &quot;pin&quot; | &quot;key&quot; | &quot;recovery&quot; | &quot;edge&quot; | &quot;create&quot;;
+    autoLogoutSeconds: number;
+    expiresAt: string | null;
+    lastActivityAt: string;
+    createdAt: string
+  } | null
+  error: string | null
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;objectId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;pendingId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;kind&quot;: &quot;string&quot;,
+  &quot;expiresAt&quot;: &quot;2026-09-02T16:35:00.000Z&quot;,
+  &quot;lobbyId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;uri&quot;: &quot;string&quot;,
+  &quot;state&quot;: &quot;string&quot;,
+  &quot;username&quot;: &quot;string&quot;,
+  &quot;session&quot;: {},
+  &quot;error&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>objectId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Handle for the value the engine is holding. Pass it to the calls that consume it.</td>
+</tr>
+<tr>
+  <td class="k"><code>pendingId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Same value as <code>objectId</code>, under the name the poll command takes.</td>
+</tr>
+<tr>
+  <td class="k"><code>kind</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">What the handle refers to, which decides the calls that accept it.</td>
+</tr>
+<tr>
+  <td class="k"><code>expiresAt</code></td>
+  <td class="ty"><span class="t">string | null</span></td>
+  <td class="doc">When the lobby closes and the QR code stops working.</td>
+</tr>
+<tr>
+  <td class="k"><code>lobbyId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Lobby the phone connects to.</td>
+</tr>
+<tr>
+  <td class="k"><code>uri</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The <code>edge://</code> URI to render as a QR code for the phone to scan.</td>
+</tr>
+<tr>
+  <td class="k"><code>state</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">How far the login has got: <code>pending</code> before the phone scans, <code>started</code> once it has, and <code>done</code> when <code>session</code> is filled in.</td>
+</tr>
+<tr>
+  <td class="k"><code>username</code></td>
+  <td class="ty"><span class="t">string | null</span></td>
+  <td class="doc">Account that approved the login, known once the phone has scanned.</td>
+</tr>
+<tr>
+  <td class="k"><code>session</code></td>
+  <td class="ty"><span class="t">{ sessionId: string; username: string | undefined; rootLoginId: string; loginMethod: &quot;password&quot; | &quot;pin&quot; | &quot;key&quot; | &quot;recovery&quot; | &quot;edge&quot; | &quot;create&quot;; autoLogoutSeconds: number; expiresAt: string | null; lastActivityAt: string; createdAt: string; } | null</span></td>
+  <td class="doc">The session, null until <code>state</code> is <code>done</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>error</code></td>
+  <td class="ty"><span class="t">string | null</span></td>
+  <td class="doc">Why the login failed, set only when <code>state</code> is <code>error</code>.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-PENDING_LOGIN_NOT_FOUND" class="err" title="No pending Edge login with that `pendingId`."><span class="st">404</span>PENDING_LOGIN_NOT_FOUND</a> <a href="#err-OBJECT_EXPIRED" class="err" title="The handle passed its 5 minute TTL and was released."><span class="st">410</span>OBJECT_EXPIRED</a></p>
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>Session creation is attempted once. A failure is sticky, so later polls report the same <code>error</code> rather than retrying.</li><li>Polling does not extend the handle TTL; only the original 5 minute window applies.</li></ul></div>
+  </section><section class="endpoint" id="cancelEdgeLogin">
+    <header>
+      <h3><a href="#cancelEdgeLogin">Cancel a pending QR login.</a></h3>
+      <div class="ids"><code class="cmdname">cancel-request</code><span class="src" title="Declared in">src/cli/engine/routes/login.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>EdgePendingEdgeLogin.cancelRequest</code></p>
+    
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>cancel-request &lt;pendingId&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/pending-edge-login/cancel-request/{pendingId}</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>pendingId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">The <code>pendingId</code> returned when the QR login was requested.</td></tr></tbody></table>
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  'http://localhost/pending-edge-login/cancel-request/$PENDINGID'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">204</span></h4>
+    <p class="lead dim">No body.</p>
+    <h5>Errors</h5><p class="errs"><a href="#err-PENDING_LOGIN_NOT_FOUND" class="err" title="No pending Edge login with that `pendingId`."><span class="st">404</span>PENDING_LOGIN_NOT_FOUND</a></p>
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>If the login already completed and a session exists, that session is force-logged-out too, so cancelling cannot leave an orphan visible in <code>engine-sessions</code>.</li></ul></div>
+  </section><section class="endpoint" id="engineSessions">
+    <header>
+      <h3><a href="#engineSessions">List active sessions.</a></h3>
+      <div class="ids"><code class="cmdname">engine-sessions</code><span class="src" title="Declared in">src/cli/engine/routes/login.ts</span></div>
+    </header>
+    <p class="core none"><span class="lbl">core</span><em>The session registry is an engine construct; core has no multi-account session concept.</em></p>
+    
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>engine-sessions</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/engine/sessions</code></p>
+    
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/engine/sessions'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="note"><p>A bare array, not wrapped in a key.</p>
+</div><pre class="ts"><code>{
+  sessionId: string;
+  username: string | undefined;
+  rootLoginId: string;
+  loginMethod: &quot;password&quot; | &quot;pin&quot; | &quot;key&quot; | &quot;recovery&quot; | &quot;edge&quot; | &quot;create&quot;;
+  autoLogoutSeconds: number;
+  expiresAt: string | null;
+  lastActivityAt: string;
+  createdAt: string
+}[]</code></pre>
+    
+  </div>
+    
+  </section><h2 id="account">Account</h2>
+      <div class="groupdoc"><p>Calls on a logged-in <code>EdgeAccount</code>, addressed by <code>sessionId</code>. All of these can also return <code>401 INVALID_SESSION</code> or <code>401 SESSION_EXPIRED</code>.</p>
+</div>
+      <h3 class="sub" id="account">Session</h3>
+          <div class="groupdoc"><p>Calls on a logged-in <code>EdgeAccount</code>, addressed by <code>sessionId</code>. All of these can also return <code>401 INVALID_SESSION</code> or <code>401 SESSION_EXPIRED</code>.</p>
+</div>
+          <section class="endpoint" id="accountInfo">
+    <header>
+      <h3><a href="#accountInfo">Account and session summary.</a></h3>
+      <div class="ids"><code class="cmdname">account-info</code><span class="src" title="Declared in">src/cli/engine/routes/account.ts</span></div>
+    </header>
+    <p class="core none"><span class="lbl">core</span><em>Engine composite of the session record plus EdgeAccount properties.</em></p>
+    <div class="desc"><p>Session fields are spread at the top level alongside the account&#39;s own properties — there is no nested <code>session</code> object.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>account-info</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/account/{sessionId}</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/account/$SESS'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  appId: string
+  created: string | null
+  lastLogin: string
+  loggedIn: boolean
+  recoveryKey: string | null
+  otpEnabled: boolean
+  otpResetPending: boolean
+  canDuressLogin: boolean
+  isDuressAccount: boolean
+  edgeLogin: boolean
+  keyLogin: boolean
+  newAccount: boolean
+  passwordLogin: boolean
+  pinLogin: boolean
+  recoveryLogin: boolean
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;appId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;created&quot;: &quot;string&quot;,
+  &quot;lastLogin&quot;: &quot;string&quot;,
+  &quot;loggedIn&quot;: true,
+  &quot;recoveryKey&quot;: &quot;string&quot;,
+  &quot;otpEnabled&quot;: true,
+  &quot;otpResetPending&quot;: true,
+  &quot;canDuressLogin&quot;: true,
+  &quot;isDuressAccount&quot;: true,
+  &quot;edgeLogin&quot;: true,
+  &quot;keyLogin&quot;: true,
+  &quot;newAccount&quot;: true,
+  &quot;passwordLogin&quot;: true,
+  &quot;pinLogin&quot;: true,
+  &quot;recoveryLogin&quot;: true
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>appId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Application this session logged into.</td>
+</tr>
+<tr>
+  <td class="k"><code>created</code></td>
+  <td class="ty"><span class="t">string | null</span></td>
+  <td class="doc">When the account was created, null for accounts predating the field.</td>
+</tr>
+<tr>
+  <td class="k"><code>lastLogin</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The previous login, not this one.</td>
+</tr>
+<tr>
+  <td class="k"><code>loggedIn</code></td>
+  <td class="ty"><span class="t">boolean</span></td>
+  <td class="doc">False once the account has been logged out; the session object outlives it briefly.</td>
+</tr>
+<tr>
+  <td class="k"><code>recoveryKey</code></td>
+  <td class="ty"><span class="t">string | null</span></td>
+  <td class="doc">Present only while recovery is configured.</td>
+</tr>
+<tr>
+  <td class="k"><code>otpEnabled</code></td>
+  <td class="ty"><span class="t">boolean</span></td>
+  <td class="doc">2FA is on for this account.</td>
+</tr>
+<tr>
+  <td class="k"><code>otpResetPending</code></td>
+  <td class="ty"><span class="t">boolean</span></td>
+  <td class="doc">True while somebody has a reset pending against this account.</td>
+</tr>
+<tr>
+  <td class="k"><code>canDuressLogin</code></td>
+  <td class="ty"><span class="t">boolean</span></td>
+  <td class="doc">A duress PIN is configured, so this account can be opened in duress mode.</td>
+</tr>
+<tr>
+  <td class="k"><code>isDuressAccount</code></td>
+  <td class="ty"><span class="t">boolean</span></td>
+  <td class="doc">True when this very session is the duress account rather than the real one.</td>
+</tr>
+<tr>
+  <td class="k"><code>edgeLogin</code></td>
+  <td class="ty"><span class="t">boolean</span></td>
+  <td class="doc">This account was reached by QR login.</td>
+</tr>
+<tr>
+  <td class="k"><code>keyLogin</code></td>
+  <td class="ty"><span class="t">boolean</span></td>
+  <td class="doc">This session was reached with a login key.</td>
+</tr>
+<tr>
+  <td class="k"><code>newAccount</code></td>
+  <td class="ty"><span class="t">boolean</span></td>
+  <td class="doc">This session created the account rather than logging into an existing one.</td>
+</tr>
+<tr>
+  <td class="k"><code>passwordLogin</code></td>
+  <td class="ty"><span class="t">boolean</span></td>
+  <td class="doc">This session was reached with a password.</td>
+</tr>
+<tr>
+  <td class="k"><code>pinLogin</code></td>
+  <td class="ty"><span class="t">boolean</span></td>
+  <td class="doc">This session was reached with a PIN.</td>
+</tr>
+<tr>
+  <td class="k"><code>recoveryLogin</code></td>
+  <td class="ty"><span class="t">boolean</span></td>
+  <td class="doc">This session was reached by answering recovery questions.</td>
+</tr></tbody></table>
+  </div>
+    
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>The <code>otpEnabled</code> and <code>otpResetPending</code> flags here are derived. For the secret itself use <code>otp-key</code>.</li></ul></div>
+  </section><section class="endpoint" id="logout">
+    <header>
+      <h3><a href="#logout">Log out.</a></h3>
+      <div class="ids"><code class="cmdname">logout</code><span class="src" title="Declared in">src/cli/engine/routes/account.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.logout</code></p>
+    <div class="desc"><p>Ends the session and drops it from the engine. Any subscription scoped to this account or its wallets is closed with it.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>logout</code></pre>
+    
+    <div class="note"><p>Also clears the stored id from <code>session.json</code>.</p>
+</div>
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/logout</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  'http://localhost/account/$SESS/logout'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">204</span></h4>
+    <p class="lead dim">No body.</p>
+    
+  </div>
+    
+  </section><section class="endpoint" id="touchSession">
+    <header>
+      <h3><a href="#touchSession">Keepalive.</a></h3>
+      <div class="ids"><code class="cmdname">touch</code><span class="src" title="Declared in">src/cli/engine/routes/account.ts</span></div>
+    </header>
+    <p class="core none"><span class="lbl">core</span><em>Engine auto-logout timer; core has no idle concept.</em></p>
+    <div class="desc"><p>Resets the idle auto-logout timer without doing any other work.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>touch</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/touch</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  'http://localhost/account/$SESS/touch'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="note"><p>The session, with a refreshed <code>expiresAt</code>.</p>
+</div><div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  sessionId: string
+  username?: string
+  rootLoginId: string
+  loginMethod: &quot;password&quot; | &quot;pin&quot; | &quot;key&quot; | &quot;recovery&quot; | &quot;edge&quot; | &quot;create&quot;
+  autoLogoutSeconds: number
+  expiresAt: string | null
+  lastActivityAt: string
+  createdAt: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;sessionId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;username&quot;: &quot;string&quot;,
+  &quot;rootLoginId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;loginMethod&quot;: &quot;&lt;\&quot;password\&quot;&gt;&quot;,
+  &quot;autoLogoutSeconds&quot;: 1,
+  &quot;expiresAt&quot;: &quot;2026-09-02T16:35:00.000Z&quot;,
+  &quot;lastActivityAt&quot;: &quot;2026-09-02T16:35:00.000Z&quot;,
+  &quot;createdAt&quot;: &quot;2026-09-02T16:35:00.000Z&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>sessionId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Identifies this login. Every account-scoped call carries it, and the CLI stores the most recent one so commands can omit it.</td>
+</tr>
+<tr>
+  <td class="k"><code>username</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Absent for a light account, which has no username.</td>
+</tr>
+<tr>
+  <td class="k"><code>rootLoginId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The account root, stable across appIds. Two sessions sharing it are the same account.</td>
+</tr>
+<tr>
+  <td class="k"><code>loginMethod</code></td>
+  <td class="ty"><span class="t">&quot;password&quot; | &quot;pin&quot; | &quot;key&quot; | &quot;recovery&quot; | &quot;edge&quot; | &quot;create&quot;</span></td>
+  <td class="doc">How this session was established.</td>
+</tr>
+<tr>
+  <td class="k"><code>autoLogoutSeconds</code></td>
+  <td class="ty"><span class="t">number</span></td>
+  <td class="doc">Idle time before the engine logs the account out. 0 disables it.</td>
+</tr>
+<tr>
+  <td class="k"><code>expiresAt</code></td>
+  <td class="ty"><span class="t">string | null</span></td>
+  <td class="doc">When auto-logout will fire, or null when it is disabled.</td>
+</tr>
+<tr>
+  <td class="k"><code>lastActivityAt</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Last call on this session, which is what auto-logout measures from.</td>
+</tr>
+<tr>
+  <td class="k"><code>createdAt</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">When the login completed.</td>
+</tr></tbody></table>
+  </div>
+    
+  </div>
+    
+  </section><section class="endpoint" id="getLoginKey">
+    <header>
+      <h3><a href="#getLoginKey">Read the account login key.</a></h3>
+      <div class="ids"><code class="cmdname">get-login-key</code><span class="src" title="Declared in">src/cli/engine/routes/account.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.getLoginKey</code></p>
+    <div class="desc"><p>The key <code>login-with-key</code> takes. It grants full account access, so treat the output as secret.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>get-login-key</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/account/{sessionId}/get-login-key</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/account/$SESS/get-login-key'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  loginKey: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;loginKey&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>loginKey</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">base58. Full account access — keep it safe.</td>
+</tr></tbody></table>
+  </div>
+    
+  </div>
+    
+  </section><section class="endpoint" id="accountSync">
+    <header>
+      <h3><a href="#accountSync">Force an account data sync.</a></h3>
+      <div class="ids"><code class="cmdname">sync</code><span class="src" title="Declared in">src/cli/engine/routes/account.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.sync</code></p>
+    <div class="desc"><p>Pushes and pulls the account repos immediately rather than waiting for the next scheduled sync.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>sync</code></pre>
+    
+    <div class="note"><p>Named <code>sync</code> for the account; the wallet one is <code>wallet-sync</code>.</p>
+</div>
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/sync</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  'http://localhost/account/$SESS/sync'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">204</span></h4>
+    <p class="lead dim">No body.</p>
+    <h5>Errors</h5><p class="errs"><a href="#err-NETWORK_ERROR" class="err" title="Could not reach an Edge server."><span class="st">503</span>NETWORK_ERROR</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="deleteRemoteAccount">
+    <header>
+      <h3><a href="#deleteRemoteAccount">Permanently delete the remote account.</a></h3>
+      <div class="ids"><code class="cmdname">delete-remote-account</code><span class="src" title="Declared in">src/cli/engine/routes/account.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.deleteRemoteAccount</code></p>
+    <div class="desc"><p>Irreversible. The account is removed from the login server, and funds in its wallets are unrecoverable without the keys. The session is logged out afterwards.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>delete-remote-account --yes</code></pre>
+    <h5>Client-only flags</h5><table class="fields"><tbody><tr><td class="k"><code>--yes</code></td><td class="ty"><span class="flag req">required</span></td><td class="doc">Confirms intent. Without it the command refuses to run.</td></tr></tbody></table>
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/delete-remote-account</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  'http://localhost/account/$SESS/delete-remote-account'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">204</span></h4>
+    <p class="lead dim">No body.</p>
+    <h5>Errors</h5><p class="errs"><a href="#err-NETWORK_ERROR" class="err" title="Could not reach an Edge server."><span class="st">503</span>NETWORK_ERROR</a></p>
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>The engine performs no confirmation check — the call runs as soon as it arrives, so any guard has to live in the caller. The command requires <code>--yes</code> for exactly this reason.</li></ul></div>
+  </section><section class="endpoint" id="waitForAllWallets">
+    <header>
+      <h3><a href="#waitForAllWallets">Wait for every wallet to finish loading.</a></h3>
+      <div class="ids"><code class="cmdname">wait-for-all-wallets</code><span class="src" title="Declared in">src/cli/engine/routes/account.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.waitForAllWallets</code></p>
+    <div class="desc"><p>Wallets load in the background after login, so a list taken straight afterwards can be short. This resolves once each active wallet has either loaded or failed — balances may still be syncing afterwards.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>wait-for-all-wallets</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/wait-for-all-wallets</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  'http://localhost/account/$SESS/wait-for-all-wallets'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">204</span></h4>
+    <p class="lead dim">No body.</p>
+    
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>There is no timeout: a wallet that never resolves holds this open. The engine&#39;s own idle shutdown does not fire while a request is in flight, so give the client one.</li><li>Nothing is returned. Call <code>currency-wallets</code> afterwards to see the result, including any wallet that failed to load.</li></ul></div>
+  </section><section class="endpoint" id="currencyWallets">
+    <header>
+      <h3><a href="#currencyWallets">List the account's wallets.</a></h3>
+      <div class="ids"><code class="cmdname">currency-wallets</code><span class="src" title="Declared in">src/cli/engine/routes/account.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.currencyWallets</code> <span class="dim">Filtered by account.activeWalletIds / archivedWalletIds / hiddenWalletIds.</span></p><div class="note"><p><strong>Differs from core:</strong></p><ul><li><code>filter</code> — Core has no filter: it exposes activeWalletIds, archivedWalletIds and hiddenWalletIds as separate lists. This picks between them.</li></ul></div>
+    
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>currency-wallets [--filter=active|archived|hidden|all]</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/account/{sessionId}/currency-wallets</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    <div class="shape">
+    <div class="shape-h">Query</div>
+    <pre class="ts"><code>{
+  filter?: &quot;active&quot; | &quot;archived&quot; | &quot;hidden&quot; | &quot;all&quot;
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;filter&quot;: &quot;&lt;\&quot;active\&quot;&gt;&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>filter</code></td>
+  <td class="ty"><span class="t">&quot;active&quot; | &quot;archived&quot; | &quot;hidden&quot; | &quot;all&quot;</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Which of the account’s wallet lists to read. Defaults to <code>active</code>.</td>
+</tr></tbody></table>
+  </div>
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/account/$SESS/currency-wallets'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  currencyWallets: {
+    walletId: string;
+    id: string;
+    type: string;
+    name: string | null;
+    pluginId: string;
+    currencyCode: string;
+    fiatCurrencyCode: string;
+    blockHeight: number;
+    syncStatus: unknown;
+    syncRatio: string | undefined;
+    paused: boolean;
+    imported: boolean | undefined;
+    created: string | null;
+    enabledTokenIds: string[];
+    detectedTokenIds: string[];
+    unactivatedTokenIds: string[]
+  }[]
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;currencyWallets&quot;: [
+    {}
+  ]
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>currencyWallets</code></td>
+  <td class="ty"><span class="t">{ walletId: string; id: string; type: string; name: string | null; pluginId: string; currencyCode: string; fiatCurrencyCode: string; blockHeight: number; syncStatus: unknown; syncRatio: string | undefined; paused: boolean; imported: boolean | undefined; created: string | null; enabledTokenIds: string[]; detectedTokenIds: string[]; unactivatedTokenIds: string[]; }[]</span></td>
+  <td class="doc">Every wallet in the account, including paused ones.</td>
+</tr></tbody></table>
+  </div>
+    
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>Wallets load in the background after login, so a list taken straight afterwards can be short. Call <code>wait-for-all-wallets</code> first to be sure the account has finished loading.</li></ul></div>
+  </section><section class="endpoint" id="createCurrencyWallet">
+    <header>
+      <h3><a href="#createCurrencyWallet">Create a currency wallet.</a></h3>
+      <div class="ids"><code class="cmdname">create-currency-wallet</code><span class="src" title="Declared in">src/cli/engine/routes/account.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.createCurrencyWallet</code></p>
+    
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>create-currency-wallet --wallet-type=&lt;walletType&gt; [--name=&lt;name&gt;] [--import-text=&lt;importText&gt;]</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/create-currency-wallet</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  walletType: string
+  name?: string
+  importText?: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;walletType&quot;: &quot;string&quot;,
+  &quot;name&quot;: &quot;string&quot;,
+  &quot;importText&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>walletType</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">From <code>currency-configs</code>, e.g. <code>wallet:bitcoin</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>name</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Display name.</td>
+</tr>
+<tr>
+  <td class="k"><code>importText</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Seed or key text to import instead of generating.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;walletType&quot;:&quot;string&quot;,&quot;name&quot;:&quot;string&quot;,&quot;importText&quot;:&quot;string&quot;}' \
+  'http://localhost/account/$SESS/create-currency-wallet'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  walletId: string
+  id: string
+  type: string
+  name: string | null
+  pluginId: string
+  currencyCode: string
+  fiatCurrencyCode: string
+  blockHeight: number
+  syncStatus: unknown
+  syncRatio?: string
+  paused: boolean
+  imported?: boolean
+  created: string | null
+  enabledTokenIds: string[]
+  detectedTokenIds: string[]
+  unactivatedTokenIds: string[]
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;id&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;type&quot;: &quot;string&quot;,
+  &quot;name&quot;: &quot;string&quot;,
+  &quot;pluginId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;currencyCode&quot;: &quot;string&quot;,
+  &quot;fiatCurrencyCode&quot;: &quot;string&quot;,
+  &quot;blockHeight&quot;: 1,
+  &quot;syncStatus&quot;: {},
+  &quot;syncRatio&quot;: &quot;string&quot;,
+  &quot;paused&quot;: true,
+  &quot;imported&quot;: true,
+  &quot;created&quot;: &quot;string&quot;,
+  &quot;enabledTokenIds&quot;: [
+    &quot;string&quot;
+  ],
+  &quot;detectedTokenIds&quot;: [
+    &quot;string&quot;
+  ],
+  &quot;unactivatedTokenIds&quot;: [
+    &quot;string&quot;
+  ]
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The full wallet id. Commands taking a wallet accept any unique prefix.</td>
+</tr>
+<tr>
+  <td class="k"><code>id</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Same value as <code>walletId</code>; core exposes both names.</td>
+</tr>
+<tr>
+  <td class="k"><code>type</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Key type, such as <code>wallet:bitcoin</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>name</code></td>
+  <td class="ty"><span class="t">string | null</span></td>
+  <td class="doc">User-assigned name, null until one is set.</td>
+</tr>
+<tr>
+  <td class="k"><code>pluginId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Currency plugin backing this wallet.</td>
+</tr>
+<tr>
+  <td class="k"><code>currencyCode</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Ticker for the native asset.</td>
+</tr>
+<tr>
+  <td class="k"><code>fiatCurrencyCode</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Fiat the wallet reports value in, as <code>iso:USD</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>blockHeight</code></td>
+  <td class="ty"><span class="t">number</span></td>
+  <td class="doc">Chain height this wallet has seen.</td>
+</tr>
+<tr>
+  <td class="k"><code>syncStatus</code></td>
+  <td class="ty"><span class="t">unknown</span></td>
+  <td class="doc"><code>EdgeWalletSyncStatus</code> from core.</td>
+</tr>
+<tr>
+  <td class="k"><code>syncRatio</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Sync progress as a percentage, for display.</td>
+</tr>
+<tr>
+  <td class="k"><code>paused</code></td>
+  <td class="ty"><span class="t">boolean</span></td>
+  <td class="doc">True while the engine is not syncing this wallet.</td>
+</tr>
+<tr>
+  <td class="k"><code>imported</code></td>
+  <td class="ty"><span class="t">boolean</span> <span class="flag opt">optional</span></td>
+  <td class="doc">True when the keys came from an import rather than being generated here.</td>
+</tr>
+<tr>
+  <td class="k"><code>created</code></td>
+  <td class="ty"><span class="t">string | null</span></td>
+  <td class="doc">When the wallet was created, null for wallets predating the field.</td>
+</tr>
+<tr>
+  <td class="k"><code>enabledTokenIds</code></td>
+  <td class="ty"><span class="t">string[]</span></td>
+  <td class="doc">Tokens the user turned on.</td>
+</tr>
+<tr>
+  <td class="k"><code>detectedTokenIds</code></td>
+  <td class="ty"><span class="t">string[]</span></td>
+  <td class="doc">Tokens found on-chain that are not enabled yet.</td>
+</tr>
+<tr>
+  <td class="k"><code>unactivatedTokenIds</code></td>
+  <td class="ty"><span class="t">string[]</span></td>
+  <td class="doc">Enabled tokens still awaiting on-chain activation.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a></p>
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>The fiat currency is not set here. Core still accepts it on create, but that path is deprecated — use <code>set-fiat-currency-code</code> afterwards, so there is one way to do it.</li></ul></div>
+  </section><section class="endpoint" id="createCurrencyWallets">
+    <header>
+      <h3><a href="#createCurrencyWallets">Create several wallets at once.</a></h3>
+      <div class="ids"><code class="cmdname">create-currency-wallets</code><span class="src" title="Declared in">src/cli/engine/routes/account.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.createCurrencyWallets</code></p>
+    <div class="desc"><p>Partial success is normal: each entry reports its own outcome, and one failure does not roll back the others.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>create-currency-wallets --create-wallets='&lt;json&gt;'</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/create-currency-wallets</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  createWallets: unknown[]
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;createWallets&quot;: [
+    {}
+  ]
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>createWallets</code></td>
+  <td class="ty"><span class="t">unknown[]</span></td>
+  <td class="doc"><code>EdgeCreateCurrencyWallet[]</code>: walletType, name, fiatCurrencyCode.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;createWallets&quot;:[{}]}' \
+  'http://localhost/account/$SESS/create-currency-wallets'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  results: unknown[]
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;results&quot;: [
+    {}
+  ]
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>results</code></td>
+  <td class="ty"><span class="t">unknown[]</span></td>
+  <td class="doc">Mirrors core&#39;s EdgeResult[]: <code>{ ok, wallet }</code> or <code>{ ok: false, error }</code>.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a></p>
+  </div>
+    
+  </section><h3 class="sub" id="credentials">Credentials</h3>
+          <div class="groupdoc"><p>Password, PIN, username and recovery changes on a logged-in account.</p>
+</div>
+          <section class="endpoint" id="changePassword">
+    <header>
+      <h3><a href="#changePassword">Set or change the password.</a></h3>
+      <div class="ids"><code class="cmdname">change-password</code><span class="src" title="Declared in">src/cli/engine/routes/credentials.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.changePassword</code></p>
+    <div class="desc"><p>The login server enforces its own rules; <code>check-password-rules</code> scores a candidate first.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>change-password --password=&lt;password&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/change-password</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  password: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;password&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>password</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The new password.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;password&quot;:&quot;string&quot;}' \
+  'http://localhost/account/$SESS/change-password'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">204</span></h4>
+    <p class="lead dim">No body.</p>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a> <a href="#err-NETWORK_ERROR" class="err" title="Could not reach an Edge server."><span class="st">503</span>NETWORK_ERROR</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="deletePassword">
+    <header>
+      <h3><a href="#deletePassword">Remove password login.</a></h3>
+      <div class="ids"><code class="cmdname">delete-password</code><span class="src" title="Declared in">src/cli/engine/routes/credentials.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.deletePassword</code></p>
+    <div class="desc"><p>The account keeps its other login methods; only the password stops working.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>delete-password</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/delete-password</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  'http://localhost/account/$SESS/delete-password'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">204</span></h4>
+    <p class="lead dim">No body.</p>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a> <a href="#err-NETWORK_ERROR" class="err" title="Could not reach an Edge server."><span class="st">503</span>NETWORK_ERROR</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="checkPassword">
+    <header>
+      <h3><a href="#checkPassword">Verify a password.</a></h3>
+      <div class="ids"><code class="cmdname">check-password</code><span class="src" title="Declared in">src/cli/engine/routes/credentials.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.checkPassword</code></p>
+    <div class="desc"><p>Checks without changing anything, which is how a caller gates a destructive action behind a re-entry prompt.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>check-password --password=&lt;password&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/check-password</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  password: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;password&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>password</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The account password.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;password&quot;:&quot;string&quot;}' \
+  'http://localhost/account/$SESS/check-password'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  ok: boolean
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;ok&quot;: true
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>ok</code></td>
+  <td class="ty"><span class="t">boolean</span></td>
+  <td class="doc">False for a wrong password — not an error response.</td>
+</tr></tbody></table>
+  </div>
+    
+  </div>
+    
+  </section><section class="endpoint" id="getPin">
+    <header>
+      <h3><a href="#getPin">Read the account PIN.</a></h3>
+      <div class="ids"><code class="cmdname">get-pin</code><span class="src" title="Declared in">src/cli/engine/routes/credentials.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.getPin</code></p>
+    <div class="desc"><p>Returns the PIN itself, not a status flag, so treat the output as secret.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>get-pin</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/account/{sessionId}/get-pin</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/account/$SESS/get-pin'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  pin: string | null
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;pin&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>pin</code></td>
+  <td class="ty"><span class="t">string | null</span></td>
+  <td class="doc">Null when no PIN is set.</td>
+</tr></tbody></table>
+  </div>
+    
+  </div>
+    
+  </section><section class="endpoint" id="changePin">
+    <header>
+      <h3><a href="#changePin">Set or change the PIN.</a></h3>
+      <div class="ids"><code class="cmdname">change-pin</code><span class="src" title="Declared in">src/cli/engine/routes/credentials.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.changePin</code></p>
+    
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>change-pin --pin=&lt;pin&gt; [--enable-login] [--for-duress-account]</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/change-pin</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  pin: string
+  enableLogin?: boolean
+  forDuressAccount?: boolean
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;pin&quot;: &quot;string&quot;,
+  &quot;enableLogin&quot;: true,
+  &quot;forDuressAccount&quot;: true
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>pin</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The new PIN.</td>
+</tr>
+<tr>
+  <td class="k"><code>enableLogin</code></td>
+  <td class="ty"><span class="t">boolean</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Allow logging in with this PIN on this device.</td>
+</tr>
+<tr>
+  <td class="k"><code>forDuressAccount</code></td>
+  <td class="ty"><span class="t">boolean</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Act on the duress account rather than the real one.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;pin&quot;:&quot;string&quot;,&quot;enableLogin&quot;:true,&quot;forDuressAccount&quot;:true}' \
+  'http://localhost/account/$SESS/change-pin'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  pin2Key: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;pin2Key&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>pin2Key</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The new PIN login key core returns.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="deletePin">
+    <header>
+      <h3><a href="#deletePin">Remove the PIN.</a></h3>
+      <div class="ids"><code class="cmdname">delete-pin</code><span class="src" title="Declared in">src/cli/engine/routes/credentials.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.deletePin</code></p>
+    <div class="desc"><p>PIN login stops working on this device; other methods are untouched.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>delete-pin</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/delete-pin</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  'http://localhost/account/$SESS/delete-pin'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">204</span></h4>
+    <p class="lead dim">No body.</p>
+    
+  </div>
+    
+  </section><section class="endpoint" id="checkPin">
+    <header>
+      <h3><a href="#checkPin">Verify a PIN.</a></h3>
+      <div class="ids"><code class="cmdname">check-pin</code><span class="src" title="Declared in">src/cli/engine/routes/credentials.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.checkPin</code></p>
+    
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>check-pin --pin=&lt;pin&gt; [--for-duress-account]</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/check-pin</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  pin: string
+  forDuressAccount?: boolean
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;pin&quot;: &quot;string&quot;,
+  &quot;forDuressAccount&quot;: true
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>pin</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The device PIN, usually four digits.</td>
+</tr>
+<tr>
+  <td class="k"><code>forDuressAccount</code></td>
+  <td class="ty"><span class="t">boolean</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Act on the duress account rather than the real one.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;pin&quot;:&quot;string&quot;,&quot;forDuressAccount&quot;:true}' \
+  'http://localhost/account/$SESS/check-pin'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  ok: boolean
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;ok&quot;: true
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>ok</code></td>
+  <td class="ty"><span class="t">boolean</span></td>
+  <td class="doc">False for a wrong PIN — not an error response.</td>
+</tr></tbody></table>
+  </div>
+    
+  </div>
+    
+  </section><section class="endpoint" id="changeUsername">
+    <header>
+      <h3><a href="#changeUsername">Change the username.</a></h3>
+      <div class="ids"><code class="cmdname">change-username</code><span class="src" title="Declared in">src/cli/engine/routes/credentials.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.changeUsername</code></p>
+    <div class="desc"><p>The old name is released, so it becomes available to anyone else.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>change-username --username=&lt;username&gt; [--password=&lt;password&gt;]</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/change-username</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  username: string
+  password?: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;username&quot;: &quot;string&quot;,
+  &quot;password&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>username</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The new username.</td>
+</tr>
+<tr>
+  <td class="k"><code>password</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Required by core when the account has a password.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;username&quot;:&quot;string&quot;,&quot;password&quot;:&quot;string&quot;}' \
+  'http://localhost/account/$SESS/change-username'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">204</span></h4>
+    <p class="lead dim">No body.</p>
+    <h5>Errors</h5><p class="errs"><a href="#err-USERNAME_ERROR" class="err" title="Unknown username, or an invalid recovery key."><span class="st">400</span>USERNAME_ERROR</a> <a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a> <a href="#err-NETWORK_ERROR" class="err" title="Could not reach an Edge server."><span class="st">503</span>NETWORK_ERROR</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="changeRecovery">
+    <header>
+      <h3><a href="#changeRecovery">Set recovery questions and answers.</a></h3>
+      <div class="ids"><code class="cmdname">change-recovery</code><span class="src" title="Declared in">src/cli/engine/routes/credentials.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.changeRecovery</code> <span class="dim">Our surface drops the <code>2</code> from core&#39;s recovery2 naming; a future Recovery1 would be suffixed <code>V1</code>.</span></p>
+    <div class="desc"><p>The returned key is half of the credential: without it the answers alone cannot recover the account, so it has to be stored somewhere else.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>change-recovery --question=&lt;questions&gt; … --answer=&lt;answers&gt; …</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/change-recovery</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  questions: string[]
+  answers: string[]
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;questions&quot;: [
+    &quot;string&quot;
+  ],
+  &quot;answers&quot;: [
+    &quot;string&quot;
+  ]
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>questions</code></td>
+  <td class="ty"><span class="t">string[]</span></td>
+  <td class="doc">The questions to ask.</td>
+</tr>
+<tr>
+  <td class="k"><code>answers</code></td>
+  <td class="ty"><span class="t">string[]</span></td>
+  <td class="doc">Same length and order as <code>questions</code>.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;questions&quot;:[&quot;string&quot;],&quot;answers&quot;:[&quot;string&quot;]}' \
+  'http://localhost/account/$SESS/change-recovery'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  recoveryKey: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;recoveryKey&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>recoveryKey</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Store this out of band. <code>login-with-recovery</code> needs it alongside the answers.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="deleteRecovery">
+    <header>
+      <h3><a href="#deleteRecovery">Disable recovery login.</a></h3>
+      <div class="ids"><code class="cmdname">delete-recovery</code><span class="src" title="Declared in">src/cli/engine/routes/credentials.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.deleteRecovery</code></p>
+    <div class="desc"><p>The existing recovery key stops working.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>delete-recovery</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/delete-recovery</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  'http://localhost/account/$SESS/delete-recovery'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">204</span></h4>
+    <p class="lead dim">No body.</p>
+    
+  </div>
+    
+  </section><h3 class="sub" id="otp">Two-factor authentication</h3>
+          <div class="groupdoc"><p>OTP state and the reset flow a user falls back on after losing their authenticator.</p>
+</div>
+          <section class="endpoint" id="otpKey">
+    <header>
+      <h3><a href="#otpKey">Read the 2FA secret and reset state.</a></h3>
+      <div class="ids"><code class="cmdname">otp-key</code><span class="src" title="Declared in">src/cli/engine/routes/otp.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.otpKey</code> <span class="dim">Also carries account.otpResetDate.</span></p>
+    
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>otp-key</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/account/{sessionId}/otp-key</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/account/$SESS/otp-key'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  otpKey: string | null
+  otpResetDate: string | null
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;otpKey&quot;: &quot;string&quot;,
+  &quot;otpResetDate&quot;: &quot;2026-09-02T16:35:00.000Z&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>otpKey</code></td>
+  <td class="ty"><span class="t">string | null</span></td>
+  <td class="doc">Null when 2FA is off. The 2FA secret itself. Secret material — record it safely.</td>
+</tr>
+<tr>
+  <td class="k"><code>otpResetDate</code></td>
+  <td class="ty"><span class="t">string | null</span></td>
+  <td class="doc">Set once somebody has requested a reset; cancel it with <code>cancel-otp-reset</code>.</td>
+</tr></tbody></table>
+  </div>
+    
+  </div>
+    
+  </section><section class="endpoint" id="enableOtp">
+    <header>
+      <h3><a href="#enableOtp">Enable 2FA.</a></h3>
+      <div class="ids"><code class="cmdname">enable-otp</code><span class="src" title="Declared in">src/cli/engine/routes/otp.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.enableOtp</code></p>
+    <div class="desc"><p>Record the returned key before leaving the terminal: it is the only copy.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>enable-otp [--timeout=&lt;timeout&gt;]</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/enable-otp</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  timeout?: number
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;timeout&quot;: 0
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>timeout</code></td>
+  <td class="ty"><span class="t">number</span> <span class="flag opt">optional</span></td>
+  <td class="doc">How long a reset request must wait before it completes. Core supplies the default when omitted.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;timeout&quot;:0}' \
+  'http://localhost/account/$SESS/enable-otp'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  otpKey: string | null
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;otpKey&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>otpKey</code></td>
+  <td class="ty"><span class="t">string | null</span></td>
+  <td class="doc">The new secret. The 2FA secret itself. Secret material — record it safely.</td>
+</tr></tbody></table>
+  </div>
+    
+  </div>
+    
+  </section><section class="endpoint" id="disableOtp">
+    <header>
+      <h3><a href="#disableOtp">Disable 2FA.</a></h3>
+      <div class="ids"><code class="cmdname">disable-otp</code><span class="src" title="Declared in">src/cli/engine/routes/otp.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.disableOtp</code></p>
+    <div class="desc"><p>Logins stop requiring a code immediately.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>disable-otp</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/disable-otp</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  'http://localhost/account/$SESS/disable-otp'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">204</span></h4>
+    <p class="lead dim">No body.</p>
+    
+  </div>
+    
+  </section><section class="endpoint" id="cancelOtpReset">
+    <header>
+      <h3><a href="#cancelOtpReset">Cancel a pending 2FA reset.</a></h3>
+      <div class="ids"><code class="cmdname">cancel-otp-reset</code><span class="src" title="Declared in">src/cli/engine/routes/otp.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.cancelOtpReset</code></p>
+    <div class="desc"><p>The defence against somebody else requesting a reset on your account: as long as you cancel before the timer runs out, their reset never lands.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>cancel-otp-reset</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/cancel-otp-reset</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  'http://localhost/account/$SESS/cancel-otp-reset'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">204</span></h4>
+    <p class="lead dim">No body.</p>
+    
+  </div>
+    
+  </section><section class="endpoint" id="repairOtp">
+    <header>
+      <h3><a href="#repairOtp">Re-point the account at a known 2FA secret.</a></h3>
+      <div class="ids"><code class="cmdname">repair-otp</code><span class="src" title="Declared in">src/cli/engine/routes/otp.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.repairOtp</code></p>
+    <div class="desc"><p>For a device whose stored secret has drifted from the server&#39;s.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>repair-otp --otp-key=&lt;otpKey&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/repair-otp</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  otpKey: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;otpKey&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>otpKey</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The secret the account should use.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;otpKey&quot;:&quot;string&quot;}' \
+  'http://localhost/account/$SESS/repair-otp'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">204</span></h4>
+    <p class="lead dim">No body.</p>
+    <h5>Errors</h5><p class="errs"><a href="#err-OTP_REQUIRED" class="err" title="Missing or wrong 2FA token."><span class="st">401</span>OTP_REQUIRED</a> <a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a></p>
+  </div>
+    
+  </section><h3 class="sub" id="vouchers">Vouchers</h3>
+          <div class="groupdoc"><p>When 2FA blocks a login, the login server issues a voucher an already-trusted device can approve or reject.</p>
+</div>
+          <section class="endpoint" id="pendingVouchers">
+    <header>
+      <h3><a href="#pendingVouchers">List pending 2FA vouchers.</a></h3>
+      <div class="ids"><code class="cmdname">pending-vouchers</code><span class="src" title="Declared in">src/cli/engine/routes/vouchers.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.pendingVouchers</code></p>
+    <div class="desc"><p>When 2FA blocks a login, the login server issues a voucher that an already-trusted device can approve or reject.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>pending-vouchers</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/account/{sessionId}/pending-vouchers</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/account/$SESS/pending-vouchers'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  pendingVouchers: unknown[]
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;pendingVouchers&quot;: [
+    {}
+  ]
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>pendingVouchers</code></td>
+  <td class="ty"><span class="t">unknown[]</span></td>
+  <td class="doc"><code>EdgePendingVoucher[]</code>: voucherId, activates, created, deviceDescription, ipDescription.</td>
+</tr></tbody></table>
+  </div>
+    
+  </div>
+    
+  </section><section class="endpoint" id="approveVoucher">
+    <header>
+      <h3><a href="#approveVoucher">Approve a voucher.</a></h3>
+      <div class="ids"><code class="cmdname">approve-voucher</code><span class="src" title="Declared in">src/cli/engine/routes/vouchers.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.approveVoucher</code></p>
+    <div class="desc"><p>Lets the waiting device finish logging in.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>approve-voucher --voucher-id=&lt;voucherId&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/approve-voucher</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  voucherId: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;voucherId&quot;: &quot;FS8xJ2kQ…&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>voucherId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">From <code>pending-vouchers</code>, or an <code>OTP_REQUIRED</code> error’s <code>details.voucherId</code>.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;voucherId&quot;:&quot;FS8xJ2kQ…&quot;}' \
+  'http://localhost/account/$SESS/approve-voucher'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">204</span></h4>
+    <p class="lead dim">No body.</p>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a> <a href="#err-NETWORK_ERROR" class="err" title="Could not reach an Edge server."><span class="st">503</span>NETWORK_ERROR</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="rejectVoucher">
+    <header>
+      <h3><a href="#rejectVoucher">Reject a voucher.</a></h3>
+      <div class="ids"><code class="cmdname">reject-voucher</code><span class="src" title="Declared in">src/cli/engine/routes/vouchers.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.rejectVoucher</code></p>
+    <div class="desc"><p>Denies the waiting device. The login it was issued for cannot complete.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>reject-voucher --voucher-id=&lt;voucherId&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/reject-voucher</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  voucherId: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;voucherId&quot;: &quot;FS8xJ2kQ…&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>voucherId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">From <code>pending-vouchers</code>, or an <code>OTP_REQUIRED</code> error’s <code>details.voucherId</code>.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;voucherId&quot;:&quot;FS8xJ2kQ…&quot;}' \
+  'http://localhost/account/$SESS/reject-voucher'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">204</span></h4>
+    <p class="lead dim">No body.</p>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a> <a href="#err-NETWORK_ERROR" class="err" title="Could not reach an Edge server."><span class="st">503</span>NETWORK_ERROR</a></p>
+  </div>
+    
+  </section><h3 class="sub" id="lobby">Approving a login</h3>
+          <div class="groupdoc"><p>The other side of <code>request-edge-login</code>: a logged-in account inspecting and approving a login somebody scanned.</p>
+</div>
+          <section class="endpoint" id="fetchLobby">
+    <header>
+      <h3><a href="#fetchLobby">Inspect a login request.</a></h3>
+      <div class="ids"><code class="cmdname">fetch-lobby</code><span class="src" title="Declared in">src/cli/engine/routes/lobby.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.fetchLobby</code></p>
+    <div class="desc"><p>The other side of <code>request-edge-login</code>: shows who is asking, so a human can decide before approving.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>fetch-lobby &lt;lobbyId&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/account/{sessionId}/fetch-lobby/{lobbyId}</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr><tr><td class="k"><code>lobbyId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From the QR code, or an <code>edge://edge/&lt;lobbyId&gt;</code> link.</td></tr></tbody></table>
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/account/$SESS/fetch-lobby/$LOBBYID?lobbyId=…'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  lobbyId: string
+  loginRequest: {
+    appId: string;
+    displayName: string;
+    displayImageDarkUrl: string | null;
+    displayImageLightUrl: string | null
+  } | null
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;lobbyId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;loginRequest&quot;: {}
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>lobbyId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The lobby that was fetched, echoed back.</td>
+</tr>
+<tr>
+  <td class="k"><code>loginRequest</code></td>
+  <td class="ty"><span class="t">{ appId: string; displayName: string; displayImageDarkUrl: string | null; displayImageLightUrl: string | null; } | null</span></td>
+  <td class="doc">Null when the lobby carries no pending login request.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a> <a href="#err-NETWORK_ERROR" class="err" title="Could not reach an Edge server."><span class="st">503</span>NETWORK_ERROR</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="approveLoginRequest">
+    <header>
+      <h3><a href="#approveLoginRequest">Approve a login request.</a></h3>
+      <div class="ids"><code class="cmdname">approve-login-request</code><span class="src" title="Declared in">src/cli/engine/routes/lobby.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>EdgeLoginRequest.approve</code> <span class="dim">Reached through account.fetchLobby(lobbyId).loginRequest.</span></p><div class="note"><p><strong>Differs from core:</strong></p><ul><li><code>lobbyId</code> — Core calls approve() on a request object. Over HTTP there is no object to hold, so the lobby names which one to approve.</li></ul></div>
+    <div class="desc"><p>Grants the requesting device access to this account.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>approve-login-request &lt;lobbyId&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/approve-login-request/{lobbyId}</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr><tr><td class="k"><code>lobbyId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From the QR code, or an <code>edge://edge/&lt;lobbyId&gt;</code> link.</td></tr></tbody></table>
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;lobbyId&quot;:&quot;FS8xJ2kQ…&quot;}' \
+  'http://localhost/account/$SESS/approve-login-request/$LOBBYID'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  ok: boolean
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;ok&quot;: true
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>ok</code></td>
+  <td class="ty"><span class="t">boolean</span></td>
+  <td class="doc">Always true; a failure arrives as an error envelope.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-NO_LOGIN_REQUEST" class="err" title="The lobby exists but carries no pending login request."><span class="st">404</span>NO_LOGIN_REQUEST</a> <a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a> <a href="#err-NETWORK_ERROR" class="err" title="Could not reach an Edge server."><span class="st">503</span>NETWORK_ERROR</a></p>
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>The lobby is re-fetched on approve, so a request that expired between inspecting and approving fails with <code>404 NO_LOGIN_REQUEST</code>.</li></ul></div>
+  </section><h3 class="sub" id="keys">Keys</h3>
+          <div class="groupdoc"><p>Raw key infrastructure beneath the wallet API. Several of these return private key material, and the engine has no transport auth — treat any process that can reach the socket as fully trusted.</p>
+</div>
+          <section class="endpoint" id="allKeys">
+    <header>
+      <h3><a href="#allKeys">List every key in the account.</a></h3>
+      <div class="ids"><code class="cmdname">all-keys</code><span class="src" title="Declared in">src/cli/engine/routes/keys.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.allKeys</code></p>
+    <div class="desc"><p>Includes archived and deleted keys, unlike <code>currency-wallets</code>.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>all-keys</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/account/{sessionId}/all-keys</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/account/$SESS/all-keys'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  allKeys: unknown[]
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;allKeys&quot;: [
+    {}
+  ]
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>allKeys</code></td>
+  <td class="ty"><span class="t">unknown[]</span></td>
+  <td class="doc"><code>EdgeWalletInfoFull[]</code>: id, type, keys, archived, deleted, hidden, sortIndex.</td>
+</tr></tbody></table>
+  </div>
+    
+  </div>
+    
+  </section><section class="endpoint" id="createWallet">
+    <header>
+      <h3><a href="#createWallet">Create a wallet from raw key JSON.</a></h3>
+      <div class="ids"><code class="cmdname">create-wallet</code><span class="src" title="Declared in">src/cli/engine/routes/keys.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.createWallet</code></p>
+    <div class="desc"><p>The import path. Use <code>create-currency-wallet</code> to make a fresh wallet with generated keys.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>create-wallet --type=&lt;type&gt; [--keys='&lt;json&gt;']</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/create-wallet</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  type: string
+  keys?: unknown
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;type&quot;: &quot;string&quot;,
+  &quot;keys&quot;: {}
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>type</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Wallet type, e.g. <code>wallet:bitcoin</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>keys</code></td>
+  <td class="ty"><span class="t">unknown</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Plugin key material. Omit to let core generate it.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;type&quot;:&quot;string&quot;,&quot;keys&quot;:{}}' \
+  'http://localhost/account/$SESS/create-wallet'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  walletId: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The new wallet. Its keys are already saved.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="getWalletInfo">
+    <header>
+      <h3><a href="#getWalletInfo">Read one wallet's key info.</a></h3>
+      <div class="ids"><code class="cmdname">get-wallet-info</code><span class="src" title="Declared in">src/cli/engine/routes/keys.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.getWalletInfo</code></p>
+    
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>get-wallet-info --id=&lt;id&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/account/{sessionId}/get-wallet-info</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    <div class="shape">
+    <div class="shape-h">Query</div>
+    <pre class="ts"><code>{
+  id: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;id&quot;: &quot;FS8xJ2kQ…&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>id</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The key id, from <code>all-keys</code>. Base64, like a wallet id.</td>
+</tr></tbody></table>
+  </div>
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/account/$SESS/get-wallet-info?id=…'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="note"><p><code>EdgeWalletInfoFull</code>, verbatim from core — including the <code>keys</code> object.</p>
+</div><pre class="ts"><code>unknown</code></pre>
+    <h5>Errors</h5><p class="errs"><a href="#err-WALLET_NOT_FOUND" class="err" title="No wallet matches that id or prefix."><span class="st">404</span>WALLET_NOT_FOUND</a> <a href="#err-AMBIGUOUS_WALLET_ID" class="err" title="A wallet id prefix matched more than one wallet."><span class="st">409</span>AMBIGUOUS_WALLET_ID</a></p>
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>An exact lookup: unlike the wallet-scoped routes this does not accept an id prefix.</li></ul></div>
+  </section><section class="endpoint" id="getRawPrivateKey">
+    <header>
+      <h3><a href="#getRawPrivateKey">Read raw private key material.</a></h3>
+      <div class="ids"><code class="cmdname">get-raw-private-key</code><span class="src" title="Declared in">src/cli/engine/routes/keys.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.getRawPrivateKey</code></p>
+    <div class="desc"><p>Secret. Whatever the plugin stores — seed, mnemonic, xpriv.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>get-raw-private-key --wallet-id=&lt;walletId&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/account/{sessionId}/get-raw-private-key</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    <div class="shape">
+    <div class="shape-h">Query</div>
+    <pre class="ts"><code>{
+  walletId: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns <code>409 AMBIGUOUS_WALLET_ID</code> with <code>details.candidates</code>.</td>
+</tr></tbody></table>
+  </div>
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/account/$SESS/get-raw-private-key?walletId=…'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="note"><p>The plugin&#39;s key object, at the top level.</p>
+</div><pre class="ts"><code>unknown</code></pre>
+    <h5>Errors</h5><p class="errs"><a href="#err-WALLET_NOT_FOUND" class="err" title="No wallet matches that id or prefix."><span class="st">404</span>WALLET_NOT_FOUND</a> <a href="#err-AMBIGUOUS_WALLET_ID" class="err" title="A wallet id prefix matched more than one wallet."><span class="st">409</span>AMBIGUOUS_WALLET_ID</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="getRawPublicKey">
+    <header>
+      <h3><a href="#getRawPublicKey">Read raw public key material.</a></h3>
+      <div class="ids"><code class="cmdname">get-raw-public-key</code><span class="src" title="Declared in">src/cli/engine/routes/keys.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.getRawPublicKey</code></p>
+    
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>get-raw-public-key --wallet-id=&lt;walletId&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/account/{sessionId}/get-raw-public-key</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    <div class="shape">
+    <div class="shape-h">Query</div>
+    <pre class="ts"><code>{
+  walletId: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns <code>409 AMBIGUOUS_WALLET_ID</code> with <code>details.candidates</code>.</td>
+</tr></tbody></table>
+  </div>
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/account/$SESS/get-raw-public-key?walletId=…'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="note"><p>The plugin&#39;s public key object.</p>
+</div><pre class="ts"><code>unknown</code></pre>
+    <h5>Errors</h5><p class="errs"><a href="#err-WALLET_NOT_FOUND" class="err" title="No wallet matches that id or prefix."><span class="st">404</span>WALLET_NOT_FOUND</a> <a href="#err-AMBIGUOUS_WALLET_ID" class="err" title="A wallet id prefix matched more than one wallet."><span class="st">409</span>AMBIGUOUS_WALLET_ID</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="getDisplayPrivateKey">
+    <header>
+      <h3><a href="#getDisplayPrivateKey">Export the private key for display.</a></h3>
+      <div class="ids"><code class="cmdname">get-display-private-key</code><span class="src" title="Declared in">src/cli/engine/routes/keys.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.getDisplayPrivateKey</code></p>
+    <div class="desc"><p>Secret. The human-facing form — WIF, seed phrase, whatever the plugin shows on its export screen.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>get-display-private-key --wallet-id=&lt;walletId&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/account/{sessionId}/get-display-private-key</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    <div class="shape">
+    <div class="shape-h">Query</div>
+    <pre class="ts"><code>{
+  walletId: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns <code>409 AMBIGUOUS_WALLET_ID</code> with <code>details.candidates</code>.</td>
+</tr></tbody></table>
+  </div>
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/account/$SESS/get-display-private-key?walletId=…'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  key: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;key&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>key</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The displayable private key.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-WALLET_NOT_FOUND" class="err" title="No wallet matches that id or prefix."><span class="st">404</span>WALLET_NOT_FOUND</a> <a href="#err-AMBIGUOUS_WALLET_ID" class="err" title="A wallet id prefix matched more than one wallet."><span class="st">409</span>AMBIGUOUS_WALLET_ID</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="getDisplayPublicKey">
+    <header>
+      <h3><a href="#getDisplayPublicKey">Export the public key for display.</a></h3>
+      <div class="ids"><code class="cmdname">get-display-public-key</code><span class="src" title="Declared in">src/cli/engine/routes/keys.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.getDisplayPublicKey</code></p>
+    <div class="desc"><p>The xpub or equivalent — safe to share for watch-only use.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>get-display-public-key --wallet-id=&lt;walletId&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/account/{sessionId}/get-display-public-key</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    <div class="shape">
+    <div class="shape-h">Query</div>
+    <pre class="ts"><code>{
+  walletId: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns <code>409 AMBIGUOUS_WALLET_ID</code> with <code>details.candidates</code>.</td>
+</tr></tbody></table>
+  </div>
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/account/$SESS/get-display-public-key?walletId=…'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  key: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;key&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>key</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The displayable public key.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-WALLET_NOT_FOUND" class="err" title="No wallet matches that id or prefix."><span class="st">404</span>WALLET_NOT_FOUND</a> <a href="#err-AMBIGUOUS_WALLET_ID" class="err" title="A wallet id prefix matched more than one wallet."><span class="st">409</span>AMBIGUOUS_WALLET_ID</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="listSplittableWalletTypes">
+    <header>
+      <h3><a href="#listSplittableWalletTypes">List chains a wallet can split into.</a></h3>
+      <div class="ids"><code class="cmdname">list-splittable-wallet-types</code><span class="src" title="Declared in">src/cli/engine/routes/keys.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.listSplittableWalletTypes</code></p>
+    <div class="desc"><p>Forked-chain support: which wallet types can be derived from these keys.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>list-splittable-wallet-types --wallet-id=&lt;walletId&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/account/{sessionId}/list-splittable-wallet-types</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    <div class="shape">
+    <div class="shape-h">Query</div>
+    <pre class="ts"><code>{
+  walletId: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns <code>409 AMBIGUOUS_WALLET_ID</code> with <code>details.candidates</code>.</td>
+</tr></tbody></table>
+  </div>
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/account/$SESS/list-splittable-wallet-types?walletId=…'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  walletTypes: string[]
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;walletTypes&quot;: [
+    &quot;string&quot;
+  ]
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>walletTypes</code></td>
+  <td class="ty"><span class="t">string[]</span></td>
+  <td class="doc">Types valid for <code>split</code>.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-WALLET_NOT_FOUND" class="err" title="No wallet matches that id or prefix."><span class="st">404</span>WALLET_NOT_FOUND</a> <a href="#err-AMBIGUOUS_WALLET_ID" class="err" title="A wallet id prefix matched more than one wallet."><span class="st">409</span>AMBIGUOUS_WALLET_ID</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="changeWalletStates">
+    <header>
+      <h3><a href="#changeWalletStates">Archive, delete, hide, or reorder wallets.</a></h3>
+      <div class="ids"><code class="cmdname">change-wallet-states</code><span class="src" title="Declared in">src/cli/engine/routes/keys.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.changeWalletStates</code></p>
+    <div class="desc"><p>The canonical backend for every wallet flag; there are no separate archive, unarchive or undelete verbs.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>change-wallet-states [--wallet-states='&lt;json&gt;'] --wallet-id=&lt;value&gt; [--archived=&lt;value&gt;] [--deleted=&lt;value&gt;] [--hidden=&lt;value&gt;] [--sort-index=&lt;value&gt;]</code></pre>
+    <h5>Client-only flags</h5><table class="fields"><tbody><tr><td class="k"><code>--wallet-id</code></td><td class="ty"><span class="flag req">required</span></td><td class="doc">The wallet to change. The command makes it the key of a single-entry <code>walletStates</code> map.</td></tr><tr><td class="k"><code>--archived</code></td><td class="ty"><span class="flag opt">optional</span></td><td class="doc">Hide from the active list.</td></tr><tr><td class="k"><code>--deleted</code></td><td class="ty"><span class="flag opt">optional</span></td><td class="doc">Mark deleted.</td></tr><tr><td class="k"><code>--hidden</code></td><td class="ty"><span class="flag opt">optional</span></td><td class="doc">Hide from the wallet picker.</td></tr><tr><td class="k"><code>--sort-index</code></td><td class="ty"><span class="flag opt">optional</span></td><td class="doc">Position in the wallet list.</td></tr></tbody></table>
+    <div class="note"><p>The command builds a single-wallet <code>walletStates</code> map from these flags, and needs at least one.</p>
+</div>
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/change-wallet-states</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  walletStates?: {
+    [keys: string]: {
+      archived: boolean | undefined;
+      deleted: boolean | undefined;
+      hidden: boolean | undefined;
+      sortIndex: number | undefined
+    }
+  }
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;walletStates&quot;: {}
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>walletStates</code></td>
+  <td class="ty"><span class="t">{ [keys: string]: { archived: boolean | undefined; deleted: boolean | undefined; hidden: boolean | undefined; sortIndex: number | undefined; }; }</span> <span class="flag opt">optional</span></td>
+  <td class="doc"><code>EdgeWalletStates</code>: wallet ids to the flags being changed.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;walletStates&quot;:{}}' \
+  'http://localhost/account/$SESS/change-wallet-states'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">204</span></h4>
+    <p class="lead dim">No body.</p>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a></p>
+  </div>
+    
+  </section><h3 class="sub" id="swap">Swap quotes</h3>
+          <div class="groupdoc"><p>Cross-asset exchange. Quotes are live objects held server-side under a <code>swap_</code> handle, so approving one means naming its <code>objectId</code> rather than re-uploading the quote.</p>
+</div>
+          <section class="endpoint" id="fetchSwapQuotes">
+    <header>
+      <h3><a href="#fetchSwapQuotes">Fetch swap quotes.</a></h3>
+      <div class="ids"><code class="cmdname">fetch-swap-quotes</code><span class="src" title="Declared in">src/cli/engine/routes/swap.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.fetchSwapQuotes</code></p><div class="note"><p><strong>Differs from core:</strong></p><ul><li><code>fromWalletId</code> — Core takes the wallet object; over HTTP it is an id.</li><li><code>toWalletId</code> — Core takes the wallet object; over HTTP it is an id.</li></ul></div>
+    <div class="desc"><p>Polls every enabled swap plugin and parks each result under its own <code>swap_</code> handle with a 5 minute TTL.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>fetch-swap-quotes --from-wallet-id=&lt;fromWalletId&gt; --to-wallet-id=&lt;toWalletId&gt; --native-amount=&lt;nativeAmount&gt; [--from-token-id=&lt;fromTokenId&gt;] [--to-token-id=&lt;toTokenId&gt;] [--quote-for=&lt;quoteFor&gt;] [--plugin-id=&lt;preferPluginId&gt;]</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/fetch-swap-quotes</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  fromWalletId: string
+  toWalletId: string
+  nativeAmount: string
+  fromTokenId?: string | null
+  toTokenId?: string | null
+  quoteFor?: string
+  preferPluginId?: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;fromWalletId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;toWalletId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;nativeAmount&quot;: &quot;12345&quot;,
+  &quot;fromTokenId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;toTokenId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;quoteFor&quot;: &quot;string&quot;,
+  &quot;preferPluginId&quot;: &quot;FS8xJ2kQ…&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>fromWalletId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Source wallet. Accepts a unique prefix.</td>
+</tr>
+<tr>
+  <td class="k"><code>toWalletId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Destination wallet.</td>
+</tr>
+<tr>
+  <td class="k"><code>nativeAmount</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">How much, in native units.</td>
+</tr>
+<tr>
+  <td class="k"><code>fromTokenId</code></td>
+  <td class="ty"><span class="t">string | null</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Defaults to the native asset.</td>
+</tr>
+<tr>
+  <td class="k"><code>toTokenId</code></td>
+  <td class="ty"><span class="t">string | null</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Defaults to the native asset.</td>
+</tr>
+<tr>
+  <td class="k"><code>quoteFor</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc"><code>from</code> spends this much of the source, <code>to</code> receives this much at the destination, <code>max</code> sends everything. Defaults to <code>from</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>preferPluginId</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Restrict to one exchange.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;fromWalletId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;toWalletId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;nativeAmount&quot;:&quot;12345&quot;,&quot;fromTokenId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;toTokenId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;quoteFor&quot;:&quot;string&quot;,&quot;preferPluginId&quot;:&quot;FS8xJ2kQ…&quot;}' \
+  'http://localhost/account/$SESS/fetch-swap-quotes'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  quoteCount: number
+  quotes: {
+    objectId: string;
+    kind: string;
+    expiresAt: string;
+    pluginId: string;
+    isEstimate: boolean;
+    canBePartial: boolean | null;
+    maxFulfillmentSeconds: number | null;
+    minReceiveAmount: string | null;
+    fromNativeAmount: string;
+    toNativeAmount: string;
+    networkFee: {
+      nativeAmount: string;
+      tokenId: string | null
+    };
+    quoteExpirationDate: string | null;
+    swapInfo: {
+      pluginId: string;
+      displayName: string;
+      supportEmail: string;
+      isDex: boolean | null
+    };
+    request: {
+      fromTokenId: string | null;
+      toTokenId: string | null;
+      nativeAmount: string;
+      quoteFor: &quot;to&quot; | &quot;from&quot; | &quot;max&quot;;
+      fromWalletId: string;
+      toWalletId: string
+    }
+  }[]
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;quoteCount&quot;: 1,
+  &quot;quotes&quot;: [
+    {}
+  ]
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>quoteCount</code></td>
+  <td class="ty"><span class="t">number</span></td>
+  <td class="doc">How many plugins answered.</td>
+</tr>
+<tr>
+  <td class="k"><code>quotes</code></td>
+  <td class="ty"><span class="t">{ objectId: string; kind: string; expiresAt: string; pluginId: string; isEstimate: boolean; canBePartial: boolean | null; maxFulfillmentSeconds: number | null; minReceiveAmount: string | null; fromNativeAmount: string; toNativeAmount: string; networkFee: { nativeAmount: string; tokenId: string | null; }; quoteExpirationDate: string | null; swapInfo: { pluginId: string; displayName: string; supportEmail: string; isDex: boolean | null; }; request: { fromTokenId: string | null; toTokenId: string | null; nativeAmount: string; quoteFor: &quot;to&quot; | &quot;from&quot; | &quot;max&quot;; fromWalletId: string; toWalletId: string; }; }[]</span></td>
+  <td class="doc">One quote per plugin that answered, each already parked under its own handle. Plugins that failed or had nothing to offer are simply absent.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a> <a href="#err-SWAP_BELOW_LIMIT" class="err" title="Amount below the plugin minimum."><span class="st">422</span>SWAP_BELOW_LIMIT</a> <a href="#err-SWAP_ABOVE_LIMIT" class="err" title="Amount exceeds the plugin maximum."><span class="st">422</span>SWAP_ABOVE_LIMIT</a> <a href="#err-SWAP_CURRENCY" class="err" title="The plugin does not support that pair."><span class="st">422</span>SWAP_CURRENCY</a> <a href="#err-SWAP_PERMISSION" class="err" title="The swap plugin refused the request."><span class="st">403</span>SWAP_PERMISSION</a> <a href="#err-SWAP_ADDRESS" class="err" title="Address unusable for this swap."><span class="st">422</span>SWAP_ADDRESS</a> <a href="#err-SAME_CURRENCY" class="err" title="Swap between identical currencies."><span class="st">400</span>SAME_CURRENCY</a> <a href="#err-INSUFFICIENT_FUNDS" class="err" title="Not enough balance to cover amount plus fee."><span class="st">422</span>INSUFFICIENT_FUNDS</a> <a href="#err-WALLET_NOT_FOUND" class="err" title="No wallet matches that id or prefix."><span class="st">404</span>WALLET_NOT_FOUND</a> <a href="#err-NETWORK_ERROR" class="err" title="Could not reach an Edge server."><span class="st">503</span>NETWORK_ERROR</a></p>
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>Every returned quote holds an open plugin object. Approving one releases only that handle; close the rest, or let them expire.</li><li>An empty <code>quotes</code> array with <code>quoteCount: 0</code> is a success, not an error — no plugin could serve the pair.</li></ul></div>
+  </section><section class="endpoint" id="getSwapQuote">
+    <header>
+      <h3><a href="#getSwapQuote">Re-read a quote.</a></h3>
+      <div class="ids"><code class="cmdname">swap-quote-get</code><span class="src" title="Declared in">src/cli/engine/routes/swap.ts</span></div>
+    </header>
+    <p class="core none"><span class="lbl">core</span><em>Engine handle store; the quote is a live EdgeSwapQuote held server-side.</em></p>
+    
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>swap-quote-get &lt;objectId&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/account/{sessionId}/swap-quote/{objectId}</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr><tr><td class="k"><code>objectId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">An ephemeral object handle id.</td></tr></tbody></table>
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/account/$SESS/swap-quote/$OBJECTID'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  objectId: string
+  kind: string
+  expiresAt: string
+  pluginId: string
+  isEstimate: boolean
+  canBePartial: boolean | null
+  maxFulfillmentSeconds: number | null
+  minReceiveAmount: string | null
+  fromNativeAmount: string
+  toNativeAmount: string
+  networkFee: {
+    nativeAmount: string;
+    tokenId: string | null
+  }
+  quoteExpirationDate: string | null
+  swapInfo: {
+    pluginId: string;
+    displayName: string;
+    supportEmail: string;
+    isDex: boolean | null
+  }
+  request: {
+    fromTokenId: string | null;
+    toTokenId: string | null;
+    nativeAmount: string;
+    quoteFor: &quot;to&quot; | &quot;from&quot; | &quot;max&quot;;
+    fromWalletId: string;
+    toWalletId: string
+  }
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;objectId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;kind&quot;: &quot;string&quot;,
+  &quot;expiresAt&quot;: &quot;2026-09-02T16:35:00.000Z&quot;,
+  &quot;pluginId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;isEstimate&quot;: true,
+  &quot;canBePartial&quot;: true,
+  &quot;maxFulfillmentSeconds&quot;: 1,
+  &quot;minReceiveAmount&quot;: &quot;12345&quot;,
+  &quot;fromNativeAmount&quot;: &quot;12345&quot;,
+  &quot;toNativeAmount&quot;: &quot;12345&quot;,
+  &quot;networkFee&quot;: {},
+  &quot;quoteExpirationDate&quot;: &quot;2026-09-02T16:35:00.000Z&quot;,
+  &quot;swapInfo&quot;: {},
+  &quot;request&quot;: {}
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>objectId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Handle for the value the engine is holding. Pass it to the calls that consume it.</td>
+</tr>
+<tr>
+  <td class="k"><code>kind</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">What the handle refers to, which decides the calls that accept it.</td>
+</tr>
+<tr>
+  <td class="k"><code>expiresAt</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">When the engine drops the handle. Handles live 5 minutes.</td>
+</tr>
+<tr>
+  <td class="k"><code>pluginId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Swap provider that produced this quote.</td>
+</tr>
+<tr>
+  <td class="k"><code>isEstimate</code></td>
+  <td class="ty"><span class="t">boolean</span></td>
+  <td class="doc">True when the provider may settle at a different rate than quoted.</td>
+</tr>
+<tr>
+  <td class="k"><code>canBePartial</code></td>
+  <td class="ty"><span class="t">boolean | null</span></td>
+  <td class="doc">True when the provider may fill only part of the order. Null when it does not say.</td>
+</tr>
+<tr>
+  <td class="k"><code>maxFulfillmentSeconds</code></td>
+  <td class="ty"><span class="t">number | null</span></td>
+  <td class="doc">Longest the provider expects a partial fill to take.</td>
+</tr>
+<tr>
+  <td class="k"><code>minReceiveAmount</code></td>
+  <td class="ty"><span class="t">string | null</span></td>
+  <td class="doc">Least the provider guarantees to deliver, in the destination’s native units.</td>
+</tr>
+<tr>
+  <td class="k"><code>fromNativeAmount</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Amount leaving the source wallet.</td>
+</tr>
+<tr>
+  <td class="k"><code>toNativeAmount</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Amount arriving in the destination wallet.</td>
+</tr>
+<tr>
+  <td class="k"><code>networkFee</code></td>
+  <td class="ty"><span class="t">{ nativeAmount: string; tokenId: string | null; }</span></td>
+  <td class="doc">On-chain fee for the sending transaction. It is not the provider’s own spread, which is already in the rate.</td>
+</tr>
+<tr>
+  <td class="k"><code>quoteExpirationDate</code></td>
+  <td class="ty"><span class="t">string | null</span></td>
+  <td class="doc">When the provider stops honouring the rate. Null when it does not expire.</td>
+</tr>
+<tr>
+  <td class="k"><code>swapInfo</code></td>
+  <td class="ty"><span class="t">{ pluginId: string; displayName: string; supportEmail: string; isDex: boolean | null; }</span></td>
+  <td class="doc"><code>EdgeSwapInfo</code>: how to name the provider and where to send complaints.</td>
+</tr>
+<tr>
+  <td class="k"><code>request</code></td>
+  <td class="ty"><span class="t">{ fromTokenId: string | null; toTokenId: string | null; nativeAmount: string; quoteFor: &quot;to&quot; | &quot;from&quot; | &quot;max&quot;; fromWalletId: string; toWalletId: string; }</span></td>
+  <td class="doc">The <code>EdgeSwapRequest</code> this quote answers, echoed back so quotes from different plugins can be compared without tracking what was asked.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-OBJECT_NOT_FOUND" class="err" title="No handle with that `objectId`."><span class="st">404</span>OBJECT_NOT_FOUND</a> <a href="#err-OBJECT_EXPIRED" class="err" title="The handle passed its 5 minute TTL and was released."><span class="st">410</span>OBJECT_EXPIRED</a> <a href="#err-OBJECT_KIND_MISMATCH" class="err" title="The handle exists but is a different kind (e.g. a swap quote passed to `sign-tx`)."><span class="st">400</span>OBJECT_KIND_MISMATCH</a> <a href="#err-OBJECT_SESSION_MISMATCH" class="err" title="The handle belongs to a different session."><span class="st">400</span>OBJECT_SESSION_MISMATCH</a></p>
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>Check <code>quoteExpirationDate</code> as well as <code>expiresAt</code>: the plugin&#39;s price can go stale before the handle does.</li></ul></div>
+  </section><section class="endpoint" id="approveSwapQuote">
+    <header>
+      <h3><a href="#approveSwapQuote">Execute a quote.</a></h3>
+      <div class="ids"><code class="cmdname">approve-swap-quote</code><span class="src" title="Declared in">src/cli/engine/routes/swap.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>EdgeSwapQuote.approve</code></p>
+    <div class="desc"><p>Moves funds. The handle is released afterwards whether or not the response is read, so record <code>orderId</code> from it.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>approve-swap-quote &lt;objectId&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/swap-quote/approve/{objectId}</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr><tr><td class="k"><code>objectId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">An ephemeral object handle id.</td></tr></tbody></table>
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  'http://localhost/account/$SESS/swap-quote/approve/$OBJECTID'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  ok: unknown
+  objectId: string
+  orderId: unknown
+  destinationAddress: unknown
+  transaction: unknown
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;ok&quot;: {},
+  &quot;objectId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;orderId&quot;: {},
+  &quot;destinationAddress&quot;: {},
+  &quot;transaction&quot;: {}
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>ok</code></td>
+  <td class="ty"><span class="t">unknown</span></td>
+  <td class="doc">True once the swap is submitted and the send broadcast.</td>
+</tr>
+<tr>
+  <td class="k"><code>objectId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The handle that was consumed.</td>
+</tr>
+<tr>
+  <td class="k"><code>orderId</code></td>
+  <td class="ty"><span class="t">unknown</span></td>
+  <td class="doc">The exchange&#39;s order reference, when it gives one.</td>
+</tr>
+<tr>
+  <td class="k"><code>destinationAddress</code></td>
+  <td class="ty"><span class="t">unknown</span></td>
+  <td class="doc">Address the funds were sent to, when the exchange reports one.</td>
+</tr>
+<tr>
+  <td class="k"><code>transaction</code></td>
+  <td class="ty"><span class="t">unknown</span></td>
+  <td class="doc">The on-chain send to the exchange.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-OBJECT_NOT_FOUND" class="err" title="No handle with that `objectId`."><span class="st">404</span>OBJECT_NOT_FOUND</a> <a href="#err-OBJECT_EXPIRED" class="err" title="The handle passed its 5 minute TTL and was released."><span class="st">410</span>OBJECT_EXPIRED</a> <a href="#err-OBJECT_KIND_MISMATCH" class="err" title="The handle exists but is a different kind (e.g. a swap quote passed to `sign-tx`)."><span class="st">400</span>OBJECT_KIND_MISMATCH</a> <a href="#err-OBJECT_SESSION_MISMATCH" class="err" title="The handle belongs to a different session."><span class="st">400</span>OBJECT_SESSION_MISMATCH</a> <a href="#err-INSUFFICIENT_FUNDS" class="err" title="Not enough balance to cover amount plus fee."><span class="st">422</span>INSUFFICIENT_FUNDS</a> <a href="#err-NETWORK_ERROR" class="err" title="Could not reach an Edge server."><span class="st">503</span>NETWORK_ERROR</a></p>
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>The plugin attaches its own savedAction and assetAction metadata; the engine adds none.</li></ul></div>
+  </section><section class="endpoint" id="closeSwapQuote">
+    <header>
+      <h3><a href="#closeSwapQuote">Discard a quote.</a></h3>
+      <div class="ids"><code class="cmdname">close-swap-quote</code><span class="src" title="Declared in">src/cli/engine/routes/swap.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>EdgeSwapQuote.close</code></p>
+    <div class="desc"><p>Closes the plugin object without executing, freeing whatever the exchange was holding.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>close-swap-quote &lt;objectId&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/swap-quote/close/{objectId}</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr><tr><td class="k"><code>objectId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">An ephemeral object handle id.</td></tr></tbody></table>
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  'http://localhost/account/$SESS/swap-quote/close/$OBJECTID'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  ok: boolean
+  objectId: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;ok&quot;: true,
+  &quot;objectId&quot;: &quot;FS8xJ2kQ…&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>ok</code></td>
+  <td class="ty"><span class="t">boolean</span></td>
+  <td class="doc">Always true; a failure arrives as an error envelope.</td>
+</tr>
+<tr>
+  <td class="k"><code>objectId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The handle this call consumed. It is now expired.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-OBJECT_NOT_FOUND" class="err" title="No handle with that `objectId`."><span class="st">404</span>OBJECT_NOT_FOUND</a> <a href="#err-OBJECT_EXPIRED" class="err" title="The handle passed its 5 minute TTL and was released."><span class="st">410</span>OBJECT_EXPIRED</a> <a href="#err-OBJECT_KIND_MISMATCH" class="err" title="The handle exists but is a different kind (e.g. a swap quote passed to `sign-tx`)."><span class="st">400</span>OBJECT_KIND_MISMATCH</a> <a href="#err-OBJECT_SESSION_MISMATCH" class="err" title="The handle belongs to a different session."><span class="st">400</span>OBJECT_SESSION_MISMATCH</a></p>
+  </div>
+    
+  </section><h3 class="sub" id="dataStore">Data store</h3>
+          <div class="groupdoc"><p>The account’s synced key-value store, where plugins keep their own state. One route per <code>EdgeDataStore</code> method.</p>
+</div>
+          <section class="endpoint" id="listStoreIds">
+    <header>
+      <h3><a href="#listStoreIds">List data-store ids.</a></h3>
+      <div class="ids"><code class="cmdname">list-store-ids</code><span class="src" title="Declared in">src/cli/engine/routes/dataStore.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.dataStore.listStoreIds</code></p>
+    <div class="desc"><p>The account&#39;s synced key-value store, where plugins keep their own state.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>list-store-ids</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/account/{sessionId}/list-store-ids</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/account/$SESS/list-store-ids'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  storeIds: string[]
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;storeIds&quot;: [
+    &quot;string&quot;
+  ]
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>storeIds</code></td>
+  <td class="ty"><span class="t">string[]</span></td>
+  <td class="doc">Every store holding at least one item.</td>
+</tr></tbody></table>
+  </div>
+    
+  </div>
+    
+  </section><section class="endpoint" id="listItemIds">
+    <header>
+      <h3><a href="#listItemIds">List item ids in a store.</a></h3>
+      <div class="ids"><code class="cmdname">list-item-ids</code><span class="src" title="Declared in">src/cli/engine/routes/dataStore.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.dataStore.listItemIds</code></p>
+    
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>list-item-ids --store-id=&lt;storeId&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/account/{sessionId}/list-item-ids</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    <div class="shape">
+    <div class="shape-h">Query</div>
+    <pre class="ts"><code>{
+  storeId: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;storeId&quot;: &quot;FS8xJ2kQ…&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>storeId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Plugin or app namespace within the account data store.</td>
+</tr></tbody></table>
+  </div>
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/account/$SESS/list-item-ids?storeId=…'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  itemIds: string[]
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;itemIds&quot;: [
+    &quot;string&quot;
+  ]
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>itemIds</code></td>
+  <td class="ty"><span class="t">string[]</span></td>
+  <td class="doc">Keys in this store. Empty if it has none.</td>
+</tr></tbody></table>
+  </div>
+    
+  </div>
+    
+  </section><section class="endpoint" id="getItem">
+    <header>
+      <h3><a href="#getItem">Read an item.</a></h3>
+      <div class="ids"><code class="cmdname">get-item</code><span class="src" title="Declared in">src/cli/engine/routes/dataStore.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.dataStore.getItem</code></p>
+    <div class="desc"><p>Values are opaque strings; encoding is the caller&#39;s business.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>get-item --store-id=&lt;storeId&gt; --item-id=&lt;itemId&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/account/{sessionId}/get-item</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    <div class="shape">
+    <div class="shape-h">Query</div>
+    <pre class="ts"><code>{
+  storeId: string
+  itemId: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;storeId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;itemId&quot;: &quot;FS8xJ2kQ…&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>storeId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Plugin or app namespace within the account data store.</td>
+</tr>
+<tr>
+  <td class="k"><code>itemId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Key within the store.</td>
+</tr></tbody></table>
+  </div>
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/account/$SESS/get-item?storeId=…&amp;itemId=…'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  value: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;value&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>value</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The stored string.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-NOT_FOUND" class="err" title="No route matched, or a generic missing resource."><span class="st">404</span>NOT_FOUND</a> <a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="setItem">
+    <header>
+      <h3><a href="#setItem">Write an item.</a></h3>
+      <div class="ids"><code class="cmdname">set-item</code><span class="src" title="Declared in">src/cli/engine/routes/dataStore.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.dataStore.setItem</code></p>
+    <div class="desc"><p>Creates the store if it does not exist.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>set-item --store-id=&lt;storeId&gt; --item-id=&lt;itemId&gt; --value=&lt;value&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/set-item</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  storeId: string
+  itemId: string
+  value: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;storeId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;itemId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;value&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>storeId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Plugin or app namespace within the account data store.</td>
+</tr>
+<tr>
+  <td class="k"><code>itemId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Key within the store.</td>
+</tr>
+<tr>
+  <td class="k"><code>value</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The string to store.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;storeId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;itemId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;value&quot;:&quot;string&quot;}' \
+  'http://localhost/account/$SESS/set-item'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">204</span></h4>
+    <p class="lead dim">No body.</p>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="deleteItem">
+    <header>
+      <h3><a href="#deleteItem">Delete an item.</a></h3>
+      <div class="ids"><code class="cmdname">delete-item</code><span class="src" title="Declared in">src/cli/engine/routes/dataStore.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.dataStore.deleteItem</code></p>
+    
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>delete-item --store-id=&lt;storeId&gt; --item-id=&lt;itemId&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/delete-item</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  storeId: string
+  itemId: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;storeId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;itemId&quot;: &quot;FS8xJ2kQ…&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>storeId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Plugin or app namespace within the account data store.</td>
+</tr>
+<tr>
+  <td class="k"><code>itemId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Key within the store.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;storeId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;itemId&quot;:&quot;FS8xJ2kQ…&quot;}' \
+  'http://localhost/account/$SESS/delete-item'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">204</span></h4>
+    <p class="lead dim">No body.</p>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="deleteStore">
+    <header>
+      <h3><a href="#deleteStore">Delete an entire store.</a></h3>
+      <div class="ids"><code class="cmdname">delete-store</code><span class="src" title="Declared in">src/cli/engine/routes/dataStore.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>account.dataStore.deleteStore</code></p>
+    <div class="desc"><p>Removes every item in it, which cannot be undone from this API.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>delete-store --store-id=&lt;storeId&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/delete-store</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  storeId: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;storeId&quot;: &quot;FS8xJ2kQ…&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>storeId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Plugin or app namespace within the account data store.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;storeId&quot;:&quot;FS8xJ2kQ…&quot;}' \
+  'http://localhost/account/$SESS/delete-store'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">204</span></h4>
+    <p class="lead dim">No body.</p>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a></p>
+  </div>
+    
+  </section><h2 id="wallet">Wallet</h2>
+      <div class="groupdoc"><p>Calls on a single <code>EdgeCurrencyWallet</code>. Each names its wallet with <code>--wallet-id</code>, which accepts a full id or any unique prefix.</p>
+</div>
+      <h3 class="sub" id="wallets">Wallet state</h3>
+          <div class="groupdoc"><p>Account-level wallet listing and creation, then per-wallet calls. A <code>{walletId}</code> segment accepts a unique prefix, so those routes can also return <code>404 WALLET_NOT_FOUND</code> or <code>409 AMBIGUOUS_WALLET_ID</code>.</p>
+</div>
+          <section class="endpoint" id="walletInfo">
+    <header>
+      <h3><a href="#walletInfo">Wallet detail.</a></h3>
+      <div class="ids"><code class="cmdname">wallet-info</code><span class="src" title="Declared in">src/cli/engine/routes/wallets.ts</span></div>
+    </header>
+    <p class="core none"><span class="lbl">core</span><em>Engine composite of EdgeCurrencyWallet properties plus its EdgeCurrencyConfig token map.</em></p>
+    
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>wallet-info --wallet-id=&lt;walletId&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/account/{sessionId}/wallet</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    <div class="shape">
+    <div class="shape-h">Query</div>
+    <pre class="ts"><code>{
+  walletId: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns <code>409 AMBIGUOUS_WALLET_ID</code> with <code>details.candidates</code>.</td>
+</tr></tbody></table>
+  </div>
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/account/$SESS/wallet?walletId=…'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="note"><p>Every WalletSummary field, plus denominations, walletSettings and allTokens.</p>
+</div><pre class="ts"><code>unknown</code></pre>
+    
+  </div>
+    
+  </section><section class="endpoint" id="renameWallet">
+    <header>
+      <h3><a href="#renameWallet">Rename a wallet.</a></h3>
+      <div class="ids"><code class="cmdname">rename-wallet</code><span class="src" title="Declared in">src/cli/engine/routes/wallets.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>wallet.renameWallet</code></p>
+    
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>rename-wallet --wallet-id=&lt;walletId&gt; --name=&lt;name&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/wallet/rename-wallet</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  walletId: string
+  name: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;name&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns <code>409 AMBIGUOUS_WALLET_ID</code> with <code>details.candidates</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>name</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The new display name.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;walletId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;name&quot;:&quot;string&quot;}' \
+  'http://localhost/account/$SESS/wallet/rename-wallet'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">204</span></h4>
+    <p class="lead dim">No body.</p>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="setFiatCurrencyCode">
+    <header>
+      <h3><a href="#setFiatCurrencyCode">Change a wallet's fiat currency.</a></h3>
+      <div class="ids"><code class="cmdname">set-fiat-currency-code</code><span class="src" title="Declared in">src/cli/engine/routes/wallets.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>wallet.setFiatCurrencyCode</code></p>
+    <div class="desc"><p>Affects how balances and history are priced, not the asset itself.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>set-fiat-currency-code --wallet-id=&lt;walletId&gt; --fiat-currency-code=&lt;fiatCurrencyCode&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/wallet/set-fiat-currency-code</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  walletId: string
+  fiatCurrencyCode: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;fiatCurrencyCode&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns <code>409 AMBIGUOUS_WALLET_ID</code> with <code>details.candidates</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>fiatCurrencyCode</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">e.g. <code>iso:EUR</code>.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;walletId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;fiatCurrencyCode&quot;:&quot;string&quot;}' \
+  'http://localhost/account/$SESS/wallet/set-fiat-currency-code'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">204</span></h4>
+    <p class="lead dim">No body.</p>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="changePaused">
+    <header>
+      <h3><a href="#changePaused">Pause or resume a wallet engine.</a></h3>
+      <div class="ids"><code class="cmdname">change-paused</code><span class="src" title="Declared in">src/cli/engine/routes/wallets.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>wallet.changePaused</code></p>
+    <div class="desc"><p>A paused wallet stops syncing, which is how a caller quiets a chain it does not currently care about.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>change-paused --wallet-id=&lt;walletId&gt; --paused=true|false</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/wallet/change-paused</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  walletId: string
+  paused: boolean
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;paused&quot;: true
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns <code>409 AMBIGUOUS_WALLET_ID</code> with <code>details.candidates</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>paused</code></td>
+  <td class="ty"><span class="t">boolean</span></td>
+  <td class="doc">True to stop syncing.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;walletId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;paused&quot;:true}' \
+  'http://localhost/account/$SESS/wallet/change-paused'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">204</span></h4>
+    <p class="lead dim">No body.</p>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="walletSync">
+    <header>
+      <h3><a href="#walletSync">Nudge one wallet to sync.</a></h3>
+      <div class="ids"><code class="cmdname">wallet-sync</code><span class="src" title="Declared in">src/cli/engine/routes/wallets.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>wallet.sync</code></p>
+    
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>wallet-sync --wallet-id=&lt;walletId&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/wallet/sync</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  walletId: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns <code>409 AMBIGUOUS_WALLET_ID</code> with <code>details.candidates</code>.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;walletId&quot;:&quot;FS8xJ2kQ…&quot;}' \
+  'http://localhost/account/$SESS/wallet/sync'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">204</span></h4>
+    <p class="lead dim">No body.</p>
+    
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>Named <code>wallet-sync</code> on the CLI because <code>sync</code> is <code>account.sync</code>.</li></ul></div>
+  </section><section class="endpoint" id="resyncBlockchain">
+    <header>
+      <h3><a href="#resyncBlockchain">Rescan the blockchain from scratch.</a></h3>
+      <div class="ids"><code class="cmdname">resync-blockchain</code><span class="src" title="Declared in">src/cli/engine/routes/wallets.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>wallet.resyncBlockchain</code></p>
+    <div class="desc"><p>Drops cached chain state and re-scans. Expensive, and the wallet reports an incomplete balance until it finishes.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>resync-blockchain --wallet-id=&lt;walletId&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/wallet/resync-blockchain</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  walletId: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns <code>409 AMBIGUOUS_WALLET_ID</code> with <code>details.candidates</code>.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;walletId&quot;:&quot;FS8xJ2kQ…&quot;}' \
+  'http://localhost/account/$SESS/wallet/resync-blockchain'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">204</span></h4>
+    <p class="lead dim">No body.</p>
+    
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>Returns when the resync is requested, not when it completes. Watch <code>syncRatio</code> for progress.</li></ul></div>
+  </section><section class="endpoint" id="splitWallet">
+    <header>
+      <h3><a href="#splitWallet">Split a wallet into another chain.</a></h3>
+      <div class="ids"><code class="cmdname">split</code><span class="src" title="Declared in">src/cli/engine/routes/wallets.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>wallet.split</code></p>
+    <div class="desc"><p>Forked-chain support: derive a wallet of a different type from the same keys. <code>list-splittable-wallet-types</code> says which are valid.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>split --wallet-id=&lt;walletId&gt; --split-wallets='&lt;json&gt;'</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/wallet/split</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  walletId: string
+  splitWallets: unknown[]
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;splitWallets&quot;: [
+    {}
+  ]
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns <code>409 AMBIGUOUS_WALLET_ID</code> with <code>details.candidates</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>splitWallets</code></td>
+  <td class="ty"><span class="t">unknown[]</span></td>
+  <td class="doc"><code>EdgeSplitCurrencyWallet[]</code>: walletType, name, fiatCurrencyCode.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;walletId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;splitWallets&quot;:[{}]}' \
+  'http://localhost/account/$SESS/wallet/split'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  results: unknown[]
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;results&quot;: [
+    {}
+  ]
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>results</code></td>
+  <td class="ty"><span class="t">unknown[]</span></td>
+  <td class="doc">Per-entry outcomes, like batch create.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="dumpData">
+    <header>
+      <h3><a href="#dumpData">Dump wallet engine state.</a></h3>
+      <div class="ids"><code class="cmdname">dump-data</code><span class="src" title="Declared in">src/cli/engine/routes/wallets.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>wallet.dumpData</code></p>
+    <div class="desc"><p>Plugin-defined debug output. Shape varies by plugin and can be very large.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>dump-data --wallet-id=&lt;walletId&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/account/{sessionId}/wallet/dump-data</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    <div class="shape">
+    <div class="shape-h">Query</div>
+    <pre class="ts"><code>{
+  walletId: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns <code>409 AMBIGUOUS_WALLET_ID</code> with <code>details.candidates</code>.</td>
+</tr></tbody></table>
+  </div>
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/account/$SESS/wallet/dump-data?walletId=…'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="note"><p><code>EdgeDataDump</code>, straight from the plugin.</p>
+</div><pre class="ts"><code>unknown</code></pre>
+    
+  </div>
+    
+  </section><section class="endpoint" id="balanceMap">
+    <header>
+      <h3><a href="#balanceMap">Balances for every asset in the wallet.</a></h3>
+      <div class="ids"><code class="cmdname">balance-map</code><span class="src" title="Declared in">src/cli/engine/routes/wallets.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>wallet.balanceMap</code> <span class="dim">Rendered as an array, with currencyCode and displayAmount added from the wallet&#39;s denominations.</span></p>
+    <div class="desc"><p>The native currency plus every enabled token.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>balance-map --wallet-id=&lt;walletId&gt; [--token-id=&lt;value&gt;]</code></pre>
+    <h5>Client-only flags</h5><table class="fields"><tbody><tr><td class="k"><code>--token-id</code></td><td class="ty"><span class="flag opt">optional</span></td><td class="doc">Client-side filter; core has no single-balance accessor.</td></tr></tbody></table>
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/account/{sessionId}/wallet/balance-map</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    <div class="shape">
+    <div class="shape-h">Query</div>
+    <pre class="ts"><code>{
+  walletId: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns <code>409 AMBIGUOUS_WALLET_ID</code> with <code>details.candidates</code>.</td>
+</tr></tbody></table>
+  </div>
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/account/$SESS/wallet/balance-map?walletId=…'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  balances: {
+    tokenId: string | null;
+    currencyCode: string;
+    nativeAmount: string;
+    displayAmount: string
+  }[]
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;balances&quot;: [
+    {}
+  ]
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>balances</code></td>
+  <td class="ty"><span class="t">{ tokenId: string | null; currencyCode: string; nativeAmount: string; displayAmount: string; }[]</span></td>
+  <td class="doc">One entry per asset the wallet holds, native coin first.</td>
+</tr></tbody></table>
+  </div>
+    
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>On the CLI, omit <code>--token-id</code> for the native asset rather than passing the literal <code>null</code>.</li></ul></div>
+  </section><section class="endpoint" id="getAddresses">
+    <header>
+      <h3><a href="#getAddresses">Receive addresses.</a></h3>
+      <div class="ids"><code class="cmdname">get-addresses</code><span class="src" title="Declared in">src/cli/engine/routes/wallets.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>wallet.getAddresses</code></p>
+    
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>get-addresses --wallet-id=&lt;walletId&gt; [--token-id=&lt;tokenId&gt;] [--force-index=&lt;forceIndex&gt;]</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/account/{sessionId}/wallet/get-addresses</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    <div class="shape">
+    <div class="shape-h">Query</div>
+    <pre class="ts"><code>{
+  walletId: string
+  tokenId?: string | null
+  forceIndex?: number
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;tokenId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;forceIndex&quot;: 0
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns <code>409 AMBIGUOUS_WALLET_ID</code> with <code>details.candidates</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>tokenId</code></td>
+  <td class="ty"><span class="t">string | null</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Defaults to the native asset.</td>
+</tr>
+<tr>
+  <td class="k"><code>forceIndex</code></td>
+  <td class="ty"><span class="t">number</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Derive at a specific index.</td>
+</tr></tbody></table>
+  </div>
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/account/$SESS/wallet/get-addresses?walletId=…'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  addresses: unknown[]
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;addresses&quot;: [
+    {}
+  ]
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>addresses</code></td>
+  <td class="ty"><span class="t">unknown[]</span></td>
+  <td class="doc"><code>EdgeAddress[]</code>: addressType, publicAddress, nativeBalance.</td>
+</tr></tbody></table>
+  </div>
+    
+  </div>
+    
+  </section><h3 class="sub" id="tokens">Tokens</h3>
+          <div class="groupdoc"><p>Which tokens a wallet tracks. Enabled tokens are the ones it syncs balances for; detected ones were seen on-chain but are not yet enabled.</p>
+</div>
+          <section class="endpoint" id="walletTokens">
+    <header>
+      <h3><a href="#walletTokens">List a wallet's tokens.</a></h3>
+      <div class="ids"><code class="cmdname">wallet-tokens</code><span class="src" title="Declared in">src/cli/engine/routes/tokens.ts</span></div>
+    </header>
+    <p class="core none"><span class="lbl">core</span><em>Engine composite of the EdgeCurrencyConfig token maps plus wallet.enabledTokenIds and wallet.detectedTokenIds.</em></p>
+    <div class="desc"><p>&quot;Enabled&quot; tokens are the ones the wallet syncs balances for; &quot;detected&quot; ones were seen on-chain but are not yet enabled.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>wallet-tokens --wallet-id=&lt;walletId&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/account/{sessionId}/wallet/tokens</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    <div class="shape">
+    <div class="shape-h">Query</div>
+    <pre class="ts"><code>{
+  walletId: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns <code>409 AMBIGUOUS_WALLET_ID</code> with <code>details.candidates</code>.</td>
+</tr></tbody></table>
+  </div>
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/account/$SESS/wallet/tokens?walletId=…'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  allTokens: {
+    [keys: string]: unknown
+  }
+  builtinTokens: {
+    [keys: string]: unknown
+  }
+  customTokens: {
+    [keys: string]: unknown
+  }
+  enabledTokenIds: string[]
+  detectedTokenIds: string[]
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;allTokens&quot;: {},
+  &quot;builtinTokens&quot;: {},
+  &quot;customTokens&quot;: {},
+  &quot;enabledTokenIds&quot;: [
+    &quot;string&quot;
+  ],
+  &quot;detectedTokenIds&quot;: [
+    &quot;string&quot;
+  ]
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>allTokens</code></td>
+  <td class="ty"><span class="t">{ [keys: string]: unknown; }</span></td>
+  <td class="doc">Built-in and custom together, keyed by tokenId. Large on EVM chains.</td>
+</tr>
+<tr>
+  <td class="k"><code>builtinTokens</code></td>
+  <td class="ty"><span class="t">{ [keys: string]: unknown; }</span></td>
+  <td class="doc"><code>EdgeToken</code> by tokenId: everything the plugin ships with.</td>
+</tr>
+<tr>
+  <td class="k"><code>customTokens</code></td>
+  <td class="ty"><span class="t">{ [keys: string]: unknown; }</span></td>
+  <td class="doc"><code>EdgeToken</code> by tokenId: tokens this account added by hand.</td>
+</tr>
+<tr>
+  <td class="k"><code>enabledTokenIds</code></td>
+  <td class="ty"><span class="t">string[]</span></td>
+  <td class="doc">Which of the above the wallet is actually tracking.</td>
+</tr>
+<tr>
+  <td class="k"><code>detectedTokenIds</code></td>
+  <td class="ty"><span class="t">string[]</span></td>
+  <td class="doc">Seen on-chain but not enabled, so their balances are not synced.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-WALLET_NOT_FOUND" class="err" title="No wallet matches that id or prefix."><span class="st">404</span>WALLET_NOT_FOUND</a> <a href="#err-AMBIGUOUS_WALLET_ID" class="err" title="A wallet id prefix matched more than one wallet."><span class="st">409</span>AMBIGUOUS_WALLET_ID</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="changeEnabledTokenIds">
+    <header>
+      <h3><a href="#changeEnabledTokenIds">Set the enabled token set.</a></h3>
+      <div class="ids"><code class="cmdname">change-enabled-token-ids</code><span class="src" title="Declared in">src/cli/engine/routes/tokens.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>wallet.changeEnabledTokenIds</code></p>
+    <div class="desc"><p>Absolute: anything missing from <code>tokenIds</code> is disabled. Core has only this setter, so there is no add or remove call.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>change-enabled-token-ids --wallet-id=&lt;walletId&gt; --token-ids='&lt;json&gt;' [--add=&lt;value&gt;] [--remove=&lt;value&gt;]</code></pre>
+    <h5>Client-only flags</h5><table class="fields"><tbody><tr><td class="k"><code>--add</code></td><td class="ty"><span class="flag opt">optional</span></td><td class="doc">Read the current set, add this id, write it back.</td></tr><tr><td class="k"><code>--remove</code></td><td class="ty"><span class="flag opt">optional</span></td><td class="doc">Read the current set, drop this id, write it back.</td></tr></tbody></table>
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/wallet/change-enabled-token-ids</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  walletId: string
+  tokenIds: string[]
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;tokenIds&quot;: [
+    &quot;string&quot;
+  ]
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns <code>409 AMBIGUOUS_WALLET_ID</code> with <code>details.candidates</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>tokenIds</code></td>
+  <td class="ty"><span class="t">string[]</span></td>
+  <td class="doc">The complete desired set.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;walletId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;tokenIds&quot;:[&quot;string&quot;]}' \
+  'http://localhost/account/$SESS/wallet/change-enabled-token-ids'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  enabledTokenIds: string[]
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;enabledTokenIds&quot;: [
+    &quot;string&quot;
+  ]
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>enabledTokenIds</code></td>
+  <td class="ty"><span class="t">string[]</span></td>
+  <td class="doc">The wallet’s enabled tokens after the change, not just what changed.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a> <a href="#err-WALLET_NOT_FOUND" class="err" title="No wallet matches that id or prefix."><span class="st">404</span>WALLET_NOT_FOUND</a> <a href="#err-AMBIGUOUS_WALLET_ID" class="err" title="A wallet id prefix matched more than one wallet."><span class="st">409</span>AMBIGUOUS_WALLET_ID</a></p>
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>The command&#39;s <code>--add</code> and <code>--remove</code> are client-side sugar over this one route, and cost an extra read first.</li></ul></div>
+  </section><h3 class="sub" id="transactions">Transactions</h3>
+          <div class="groupdoc"><p>Reading transaction history, exporting it, and editing its metadata.</p>
+</div>
+          <section class="endpoint" id="getTransactions">
+    <header>
+      <h3><a href="#getTransactions">List or export a wallet's transactions.</a></h3>
+      <div class="ids"><code class="cmdname">get-transactions</code><span class="src" title="Declared in">src/cli/engine/routes/transactions.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>wallet.getTransactions</code></p><div class="note"><p><strong>Differs from core:</strong></p><ul><li><code>limit</code> — Engine-side paging; core returns every match.</li><li><code>offset</code> — Engine-side paging; core returns every match.</li><li><code>fiat</code> — Selects the currency the engine values each transaction in.</li><li><code>exportFormat</code> — Engine-side rendering to CSV, QBO or Bitwave.</li><li><code>bitwaveAccountId</code> — Required by the Bitwave export format.</li></ul></div>
+    <div class="desc"><p>Reads history, overlays the display metadata the GUI shows, fills historical fiat, and optionally formats the result — all on this one call.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>get-transactions --wallet-id=&lt;walletId&gt; [--token-id=&lt;tokenId&gt;] [--limit=&lt;limit&gt;] [--offset=&lt;offset&gt;] [--start-date=&lt;startDate&gt;] [--end-date=&lt;endDate&gt;] [--search-string=&lt;searchString&gt;] [--spam-threshold=&lt;spamThreshold&gt;] [--fiat=&lt;fiat&gt;] [--export-format=&lt;exportFormat&gt;] [--bitwave-account=&lt;bitwaveAccountId&gt;] [--out=&lt;value&gt;]</code></pre>
+    <h5>Client-only flags</h5><table class="fields"><tbody><tr><td class="k"><code>--out</code></td><td class="ty"><span class="flag opt">optional</span></td><td class="doc">Where to write the returned files. One format: the path. Several: a stem, plus .csv / .qbo / .bitwave.csv.</td></tr></tbody></table>
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/account/{sessionId}/wallet/get-transactions</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    <div class="shape">
+    <div class="shape-h">Query</div>
+    <pre class="ts"><code>{
+  walletId: string
+  tokenId?: string | null
+  limit?: number
+  offset?: number
+  startDate?: Date
+  endDate?: Date
+  searchString?: string
+  spamThreshold?: string
+  fiat?: string
+  exportFormat?: string
+  bitwaveAccountId?: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;tokenId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;limit&quot;: 0,
+  &quot;offset&quot;: 0,
+  &quot;startDate&quot;: &quot;&lt;Date&gt;&quot;,
+  &quot;endDate&quot;: &quot;&lt;Date&gt;&quot;,
+  &quot;searchString&quot;: &quot;string&quot;,
+  &quot;spamThreshold&quot;: &quot;string&quot;,
+  &quot;fiat&quot;: &quot;2026-09-02T16:35:00.000Z&quot;,
+  &quot;exportFormat&quot;: &quot;2026-09-02T16:35:00.000Z&quot;,
+  &quot;bitwaveAccountId&quot;: &quot;FS8xJ2kQ…&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns <code>409 AMBIGUOUS_WALLET_ID</code> with <code>details.candidates</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>tokenId</code></td>
+  <td class="ty"><span class="t">string | null</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Defaults to the native asset.</td>
+</tr>
+<tr>
+  <td class="k"><code>limit</code></td>
+  <td class="ty"><span class="t">number</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Omitting it returns every transaction from <code>offset</code> on.</td>
+</tr>
+<tr>
+  <td class="k"><code>offset</code></td>
+  <td class="ty"><span class="t">number</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Where to start. Defaults to 0.</td>
+</tr>
+<tr>
+  <td class="k"><code>startDate</code></td>
+  <td class="ty"><span class="t">Date</span> <span class="flag opt">optional</span></td>
+  <td class="doc">ISO-8601, or epoch milliseconds.</td>
+</tr>
+<tr>
+  <td class="k"><code>endDate</code></td>
+  <td class="ty"><span class="t">Date</span> <span class="flag opt">optional</span></td>
+  <td class="doc">ISO-8601, or epoch milliseconds.</td>
+</tr>
+<tr>
+  <td class="k"><code>searchString</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Matches payee, category, notes and txid.</td>
+</tr>
+<tr>
+  <td class="k"><code>spamThreshold</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Native-amount floor. Omitted, the account spam-filter setting applies; passing it always overrides.</td>
+</tr>
+<tr>
+  <td class="k"><code>fiat</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Three-letter ISO 4217 code. Defaults to the account defaultIsoFiat.</td>
+</tr>
+<tr>
+  <td class="k"><code>exportFormat</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Comma list of <code>csv</code>, <code>qbo</code>, <code>bitwave</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>bitwaveAccountId</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">A 400 unless <code>exportFormat</code> includes <code>bitwave</code>.</td>
+</tr></tbody></table>
+  </div>
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/account/$SESS/wallet/get-transactions?walletId=…'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="note"><p><code>{ transactions, total, isoFiat }</code>, or <code>{ ok, isoFiat, total, files }</code> when exportFormat is set.</p>
+</div><pre class="ts"><code>unknown</code></pre>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a> <a href="#err-MISSING_BITWAVE_ACCOUNT_ID" class="err" title="Bitwave export requested with no account id in the query and none saved in the wallet’s `exportTxInfo.json`."><span class="st">400</span>MISSING_BITWAVE_ACCOUNT_ID</a> <a href="#err-WALLET_NOT_FOUND" class="err" title="No wallet matches that id or prefix."><span class="st">404</span>WALLET_NOT_FOUND</a> <a href="#err-AMBIGUOUS_WALLET_ID" class="err" title="A wallet id prefix matched more than one wallet."><span class="st">409</span>AMBIGUOUS_WALLET_ID</a></p>
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>The metadata overlay and the fiat fill are response-only. Neither writes to disk.</li><li><code>limit</code> and <code>offset</code> apply before the fiat fill, so a large page costs proportionally more rates-server work.</li><li>This is the one GET that can write: passing <code>bitwaveAccountId</code> persists it to <code>exportTxInfo.json</code> on the wallet disklet.</li></ul></div>
+  </section><section class="endpoint" id="getNumTransactions">
+    <header>
+      <h3><a href="#getNumTransactions">Count transactions in a wallet.</a></h3>
+      <div class="ids"><code class="cmdname">get-num-transactions</code><span class="src" title="Declared in">src/cli/engine/routes/transactions.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>wallet.getNumTransactions</code></p>
+    <div class="desc"><p>Cheaper than listing when only the total matters.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>get-num-transactions --wallet-id=&lt;walletId&gt; [--token-id=&lt;tokenId&gt;]</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/account/{sessionId}/wallet/get-num-transactions</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    <div class="shape">
+    <div class="shape-h">Query</div>
+    <pre class="ts"><code>{
+  walletId: string
+  tokenId?: string | null
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;tokenId&quot;: &quot;FS8xJ2kQ…&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns <code>409 AMBIGUOUS_WALLET_ID</code> with <code>details.candidates</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>tokenId</code></td>
+  <td class="ty"><span class="t">string | null</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Defaults to the native asset.</td>
+</tr></tbody></table>
+  </div>
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/account/$SESS/wallet/get-num-transactions?walletId=…'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  numTransactions: number
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;numTransactions&quot;: 0
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>numTransactions</code></td>
+  <td class="ty"><span class="t">number</span></td>
+  <td class="doc">Every transaction the wallet knows of.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-WALLET_NOT_FOUND" class="err" title="No wallet matches that id or prefix."><span class="st">404</span>WALLET_NOT_FOUND</a> <a href="#err-AMBIGUOUS_WALLET_ID" class="err" title="A wallet id prefix matched more than one wallet."><span class="st">409</span>AMBIGUOUS_WALLET_ID</a></p>
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>Unfiltered: <code>spamThreshold</code>, dates and <code>searchString</code> do not apply, so this can exceed <code>total</code> from <code>get-transactions</code>.</li></ul></div>
+  </section><section class="endpoint" id="saveTxMetadata">
+    <header>
+      <h3><a href="#saveTxMetadata">Save transaction metadata.</a></h3>
+      <div class="ids"><code class="cmdname">save-tx-metadata</code><span class="src" title="Declared in">src/cli/engine/routes/transactions.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>wallet.saveTxMetadata</code></p>
+    <div class="desc"><p>One of only two routes that write transaction metadata to disk.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>save-tx-metadata --wallet-id=&lt;walletId&gt; --txid=&lt;txid&gt; [--token-id=&lt;tokenId&gt;] --metadata='&lt;json&gt;'</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/wallet/save-tx-metadata</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  walletId: string
+  txid: string
+  tokenId?: string | null
+  metadata: unknown
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;txid&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;tokenId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;metadata&quot;: {}
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns <code>409 AMBIGUOUS_WALLET_ID</code> with <code>details.candidates</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>txid</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Which transaction to tag.</td>
+</tr>
+<tr>
+  <td class="k"><code>tokenId</code></td>
+  <td class="ty"><span class="t">string | null</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Defaults to the native asset.</td>
+</tr>
+<tr>
+  <td class="k"><code>metadata</code></td>
+  <td class="ty"><span class="t">unknown</span></td>
+  <td class="doc"><code>EdgeMetadataChange</code>: name, category, notes, exchangeAmount.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;walletId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;txid&quot;:&quot;FS8xJ2kQ…&quot;,&quot;tokenId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;metadata&quot;:{}}' \
+  'http://localhost/account/$SESS/wallet/save-tx-metadata'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">204</span></h4>
+    <p class="lead dim">No body.</p>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a> <a href="#err-WALLET_NOT_FOUND" class="err" title="No wallet matches that id or prefix."><span class="st">404</span>WALLET_NOT_FOUND</a> <a href="#err-AMBIGUOUS_WALLET_ID" class="err" title="A wallet id prefix matched more than one wallet."><span class="st">409</span>AMBIGUOUS_WALLET_ID</a></p>
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li><code>metadata</code> is an <code>EdgeMetadataChange</code>, so an explicit null clears a field while an omitted one is left alone.</li></ul></div>
+  </section><section class="endpoint" id="saveTxAction">
+    <header>
+      <h3><a href="#saveTxAction">Save a transaction action.</a></h3>
+      <div class="ids"><code class="cmdname">save-tx-action</code><span class="src" title="Declared in">src/cli/engine/routes/transactions.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>wallet.saveTxAction</code></p>
+    <div class="desc"><p>Records what a transaction <em>was</em> — a swap, a stake — beyond its metadata.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>save-tx-action --wallet-id=&lt;walletId&gt; --txid=&lt;txid&gt; [--token-id=&lt;tokenId&gt;] --saved-action='&lt;json&gt;' [--asset-action='&lt;json&gt;']</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/wallet/save-tx-action</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  walletId: string
+  txid: string
+  tokenId?: string | null
+  savedAction: unknown
+  assetAction?: unknown
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;txid&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;tokenId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;savedAction&quot;: {},
+  &quot;assetAction&quot;: {}
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns <code>409 AMBIGUOUS_WALLET_ID</code> with <code>details.candidates</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>txid</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Which transaction to annotate.</td>
+</tr>
+<tr>
+  <td class="k"><code>tokenId</code></td>
+  <td class="ty"><span class="t">string | null</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Defaults to the native asset.</td>
+</tr>
+<tr>
+  <td class="k"><code>savedAction</code></td>
+  <td class="ty"><span class="t">unknown</span></td>
+  <td class="doc"><code>EdgeTxAction</code> describing what happened.</td>
+</tr>
+<tr>
+  <td class="k"><code>assetAction</code></td>
+  <td class="ty"><span class="t">unknown</span> <span class="flag opt">optional</span></td>
+  <td class="doc"><code>EdgeAssetAction</code>.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;walletId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;txid&quot;:&quot;FS8xJ2kQ…&quot;,&quot;tokenId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;savedAction&quot;:{},&quot;assetAction&quot;:{}}' \
+  'http://localhost/account/$SESS/wallet/save-tx-action'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">204</span></h4>
+    <p class="lead dim">No body.</p>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a> <a href="#err-WALLET_NOT_FOUND" class="err" title="No wallet matches that id or prefix."><span class="st">404</span>WALLET_NOT_FOUND</a> <a href="#err-AMBIGUOUS_WALLET_ID" class="err" title="A wallet id prefix matched more than one wallet."><span class="st">409</span>AMBIGUOUS_WALLET_ID</a></p>
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>When <code>assetAction</code> is omitted it defaults to <code>{ assetActionType: &#39;transfer&#39; }</code>.</li></ul></div>
+  </section><h3 class="sub" id="spend">Spending</h3>
+          <div class="groupdoc"><p>Two ways to send funds. <code>spend</code> does the whole thing in one call; the staged workflow — <code>make-spend</code>, <code>sign-tx</code>, <code>broadcast-tx</code>, <code>save-tx</code> — hands back an object handle at each step so fees can be inspected before committing.</p>
+</div>
+          <section class="endpoint" id="getMaxSpendable">
+    <header>
+      <h3><a href="#getMaxSpendable">Largest sendable amount.</a></h3>
+      <div class="ids"><code class="cmdname">get-max-spendable</code><span class="src" title="Declared in">src/cli/engine/routes/spend.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>wallet.getMaxSpendable</code></p><div class="note"><p><strong>Differs from core:</strong></p><ul><li><code>to</code> — Shorthand the engine expands into <code>spendTargets</code>, so a one-output send needs no nested JSON.</li><li><code>nativeAmount</code> — Amount for the <code>to</code> shorthand, in the smallest unit.</li><li><code>amount</code> — Amount for the <code>to</code> shorthand, in whole coins.</li></ul></div>
+    <div class="desc"><p>What empties the wallet after fees. A destination is still required, since fees depend on it.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>get-max-spendable --wallet-id=&lt;walletId&gt; [--spend-info='&lt;json&gt;'] [--to=&lt;to&gt;] [--native-amount=&lt;nativeAmount&gt;] [--amount=&lt;amount&gt;] [--token-id=&lt;tokenId&gt;] [--metadata='&lt;json&gt;']</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/wallet/get-max-spendable</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  walletId: string
+  spendInfo?: unknown
+  to?: string
+  nativeAmount?: string
+  amount?: string
+  tokenId?: string | null
+  metadata?: unknown
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;spendInfo&quot;: {},
+  &quot;to&quot;: &quot;string&quot;,
+  &quot;nativeAmount&quot;: &quot;12345&quot;,
+  &quot;amount&quot;: &quot;12345&quot;,
+  &quot;tokenId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;metadata&quot;: {}
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns <code>409 AMBIGUOUS_WALLET_ID</code> with <code>details.candidates</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>spendInfo</code></td>
+  <td class="ty"><span class="t">unknown</span> <span class="flag opt">optional</span></td>
+  <td class="doc">A full <code>EdgeSpendInfo</code>, used as-is when present.</td>
+</tr>
+<tr>
+  <td class="k"><code>to</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Address or BIP21 URI, run through <code>wallet.parseUri</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>nativeAmount</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">How much, in native units.</td>
+</tr>
+<tr>
+  <td class="k"><code>amount</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Alias of <code>nativeAmount</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>tokenId</code></td>
+  <td class="ty"><span class="t">string | null</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Defaults to the native asset.</td>
+</tr>
+<tr>
+  <td class="k"><code>metadata</code></td>
+  <td class="ty"><span class="t">unknown</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Wins over anything parsed out of the URI.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;walletId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;spendInfo&quot;:{},&quot;to&quot;:&quot;string&quot;,&quot;nativeAmount&quot;:&quot;12345&quot;,&quot;amount&quot;:&quot;12345&quot;,&quot;tokenId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;metadata&quot;:{}}' \
+  'http://localhost/account/$SESS/wallet/get-max-spendable'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  nativeAmount: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;nativeAmount&quot;: &quot;12345&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>nativeAmount</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The most this wallet can send.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-INSUFFICIENT_FUNDS" class="err" title="Not enough balance to cover amount plus fee."><span class="st">422</span>INSUFFICIENT_FUNDS</a> <a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a> <a href="#err-NETWORK_ERROR" class="err" title="Could not reach an Edge server."><span class="st">503</span>NETWORK_ERROR</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="spend">
+    <header>
+      <h3><a href="#spend">Send funds.</a></h3>
+      <div class="ids"><code class="cmdname">spend</code><span class="src" title="Declared in">src/cli/engine/routes/spend.ts</span></div>
+    </header>
+    <p class="core none"><span class="lbl">core</span><em>GUI composite: makeSpend, signTx, broadcastTx and saveTx together.</em></p>
+    <div class="desc"><p><code>makeSpend</code>, then <code>signTx</code>, then optionally <code>broadcastTx</code> and <code>saveTx</code>, in one request. <code>broadcast</code> and <code>save</code> both default to true, so a bare body with a destination and an amount moves real money. A completed spend leaves no handle behind.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>spend --wallet-id=&lt;walletId&gt; [--spend-info='&lt;json&gt;'] [--to=&lt;to&gt;] [--native-amount=&lt;nativeAmount&gt;] [--amount=&lt;amount&gt;] [--token-id=&lt;tokenId&gt;] [--metadata='&lt;json&gt;'] [--use-max] [--dry-run] [--broadcast] [--save]</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/wallet/spend</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  walletId: string
+  spendInfo?: unknown
+  to?: string
+  nativeAmount?: string
+  amount?: string
+  tokenId?: string | null
+  metadata?: unknown
+  useMax?: boolean
+  dryRun?: boolean
+  broadcast?: boolean
+  save?: boolean
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;spendInfo&quot;: {},
+  &quot;to&quot;: &quot;string&quot;,
+  &quot;nativeAmount&quot;: &quot;12345&quot;,
+  &quot;amount&quot;: &quot;12345&quot;,
+  &quot;tokenId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;metadata&quot;: {},
+  &quot;useMax&quot;: true,
+  &quot;dryRun&quot;: true,
+  &quot;broadcast&quot;: true,
+  &quot;save&quot;: true
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns <code>409 AMBIGUOUS_WALLET_ID</code> with <code>details.candidates</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>spendInfo</code></td>
+  <td class="ty"><span class="t">unknown</span> <span class="flag opt">optional</span></td>
+  <td class="doc">A full <code>EdgeSpendInfo</code>, used as-is when present.</td>
+</tr>
+<tr>
+  <td class="k"><code>to</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Address or BIP21 URI, run through <code>wallet.parseUri</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>nativeAmount</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">How much, in native units.</td>
+</tr>
+<tr>
+  <td class="k"><code>amount</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Alias of <code>nativeAmount</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>tokenId</code></td>
+  <td class="ty"><span class="t">string | null</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Defaults to the native asset.</td>
+</tr>
+<tr>
+  <td class="k"><code>metadata</code></td>
+  <td class="ty"><span class="t">unknown</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Wins over anything parsed out of the URI.</td>
+</tr>
+<tr>
+  <td class="k"><code>useMax</code></td>
+  <td class="ty"><span class="t">boolean</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Replace the first target&#39;s amount with the maximum.</td>
+</tr>
+<tr>
+  <td class="k"><code>dryRun</code></td>
+  <td class="ty"><span class="t">boolean</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Build only. Never signs or broadcasts.</td>
+</tr>
+<tr>
+  <td class="k"><code>broadcast</code></td>
+  <td class="ty"><span class="t">boolean</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Defaults to <strong>true</strong>.</td>
+</tr>
+<tr>
+  <td class="k"><code>save</code></td>
+  <td class="ty"><span class="t">boolean</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Defaults to <strong>true</strong>.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;walletId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;spendInfo&quot;:{},&quot;to&quot;:&quot;string&quot;,&quot;nativeAmount&quot;:&quot;12345&quot;,&quot;amount&quot;:&quot;12345&quot;,&quot;tokenId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;metadata&quot;:{},&quot;useMax&quot;:true,&quot;dryRun&quot;:true,&quot;broadcast&quot;:true,&quot;save&quot;:true}' \
+  'http://localhost/account/$SESS/wallet/spend'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="note"><p><code>{ transaction }</code>, plus <code>saveError</code> when the broadcast succeeded but saving failed. With dryRun, a TransactionHandle instead.</p>
+</div><pre class="ts"><code>unknown</code></pre>
+    <h5>Errors</h5><p class="errs"><a href="#err-INSUFFICIENT_FUNDS" class="err" title="Not enough balance to cover amount plus fee."><span class="st">422</span>INSUFFICIENT_FUNDS</a> <a href="#err-DUST_SPEND" class="err" title="Amount below the network dust threshold."><span class="st">422</span>DUST_SPEND</a> <a href="#err-PENDING_FUNDS" class="err" title="Balance exists but is unconfirmed."><span class="st">422</span>PENDING_FUNDS</a> <a href="#err-SPEND_TO_SELF" class="err" title="Destination address belongs to the source wallet."><span class="st">422</span>SPEND_TO_SELF</a> <a href="#err-NO_AMOUNT_SPECIFIED" class="err" title="Zero-amount spend."><span class="st">400</span>NO_AMOUNT_SPECIFIED</a> <a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a> <a href="#err-NETWORK_ERROR" class="err" title="Could not reach an Edge server."><span class="st">503</span>NETWORK_ERROR</a></p>
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>BIP21 <code>label</code> and <code>message</code> from <code>to</code> become metadata name and notes. An explicit <code>metadata</code> object wins.</li><li><code>saveError</code> is the case to handle. Once broadcast, the money is gone, so a failure inside saveTx cannot throw — it would hide the txid of a real payment. The response is 200 with the transaction plus <code>saveError</code>.</li><li>With <code>dryRun</code>, only makeSpend runs and the response is a transaction handle that expires in 5 minutes.</li></ul></div>
+  </section><section class="endpoint" id="makeSpend">
+    <header>
+      <h3><a href="#makeSpend">Build an unsigned transaction.</a></h3>
+      <div class="ids"><code class="cmdname">make-spend</code><span class="src" title="Declared in">src/cli/engine/routes/spend.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>wallet.makeSpend</code></p><div class="note"><p><strong>Differs from core:</strong></p><ul><li><code>to</code> — Shorthand the engine expands into <code>spendTargets</code>, so a one-output send needs no nested JSON.</li><li><code>nativeAmount</code> — Amount for the <code>to</code> shorthand, in the smallest unit.</li><li><code>amount</code> — Amount for the <code>to</code> shorthand, in whole coins.</li></ul></div>
+    <div class="desc"><p>First step of the staged workflow: nothing is signed and no funds move. Inspect <code>transaction.networkFee</code> on the result before signing.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>make-spend --wallet-id=&lt;walletId&gt; [--spend-info='&lt;json&gt;'] [--to=&lt;to&gt;] [--native-amount=&lt;nativeAmount&gt;] [--amount=&lt;amount&gt;] [--token-id=&lt;tokenId&gt;] [--metadata='&lt;json&gt;']</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/wallet/make-spend</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  walletId: string
+  spendInfo?: unknown
+  to?: string
+  nativeAmount?: string
+  amount?: string
+  tokenId?: string | null
+  metadata?: unknown
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;spendInfo&quot;: {},
+  &quot;to&quot;: &quot;string&quot;,
+  &quot;nativeAmount&quot;: &quot;12345&quot;,
+  &quot;amount&quot;: &quot;12345&quot;,
+  &quot;tokenId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;metadata&quot;: {}
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns <code>409 AMBIGUOUS_WALLET_ID</code> with <code>details.candidates</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>spendInfo</code></td>
+  <td class="ty"><span class="t">unknown</span> <span class="flag opt">optional</span></td>
+  <td class="doc">A full <code>EdgeSpendInfo</code>, used as-is when present.</td>
+</tr>
+<tr>
+  <td class="k"><code>to</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Address or BIP21 URI, run through <code>wallet.parseUri</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>nativeAmount</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">How much, in native units.</td>
+</tr>
+<tr>
+  <td class="k"><code>amount</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Alias of <code>nativeAmount</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>tokenId</code></td>
+  <td class="ty"><span class="t">string | null</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Defaults to the native asset.</td>
+</tr>
+<tr>
+  <td class="k"><code>metadata</code></td>
+  <td class="ty"><span class="t">unknown</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Wins over anything parsed out of the URI.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;walletId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;spendInfo&quot;:{},&quot;to&quot;:&quot;string&quot;,&quot;nativeAmount&quot;:&quot;12345&quot;,&quot;amount&quot;:&quot;12345&quot;,&quot;tokenId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;metadata&quot;:{}}' \
+  'http://localhost/account/$SESS/wallet/make-spend'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  objectId: string
+  kind: string
+  expiresAt: string
+  sessionId?: string
+  walletId?: string
+  transaction: unknown
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;objectId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;kind&quot;: &quot;string&quot;,
+  &quot;expiresAt&quot;: &quot;2026-09-02T16:35:00.000Z&quot;,
+  &quot;sessionId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;transaction&quot;: {}
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>objectId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Handle for the value the engine is holding. Pass it to the calls that consume it.</td>
+</tr>
+<tr>
+  <td class="k"><code>kind</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">What the handle refers to, which decides the calls that accept it.</td>
+</tr>
+<tr>
+  <td class="k"><code>expiresAt</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">When the engine drops the handle. Handles live 5 minutes.</td>
+</tr>
+<tr>
+  <td class="k"><code>sessionId</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Session that created the handle; only that session may use it.</td>
+</tr>
+<tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Wallet the handle is bound to, when it belongs to one.</td>
+</tr>
+<tr>
+  <td class="k"><code>transaction</code></td>
+  <td class="ty"><span class="t">unknown</span></td>
+  <td class="doc"><code>EdgeTransaction</code> as it stands after this step. Unsigned after <code>make-spend</code>, signed after <code>sign-tx</code>, and carrying a txid once broadcast.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-INSUFFICIENT_FUNDS" class="err" title="Not enough balance to cover amount plus fee."><span class="st">422</span>INSUFFICIENT_FUNDS</a> <a href="#err-DUST_SPEND" class="err" title="Amount below the network dust threshold."><span class="st">422</span>DUST_SPEND</a> <a href="#err-NO_AMOUNT_SPECIFIED" class="err" title="Zero-amount spend."><span class="st">400</span>NO_AMOUNT_SPECIFIED</a> <a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="signTx">
+    <header>
+      <h3><a href="#signTx">Sign a staged transaction.</a></h3>
+      <div class="ids"><code class="cmdname">sign-tx</code><span class="src" title="Declared in">src/cli/engine/routes/spend.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>wallet.signTx</code></p>
+    <div class="desc"><p>Keeps the same handle and pushes its expiry out another five minutes.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>sign-tx &lt;objectId&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/sign-tx/{objectId}</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr><tr><td class="k"><code>objectId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From <code>make-spend</code>.</td></tr></tbody></table>
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;objectId&quot;:&quot;FS8xJ2kQ…&quot;}' \
+  'http://localhost/account/$SESS/sign-tx/$OBJECTID'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  objectId: string
+  kind: string
+  expiresAt: string
+  sessionId?: string
+  walletId?: string
+  transaction: unknown
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;objectId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;kind&quot;: &quot;string&quot;,
+  &quot;expiresAt&quot;: &quot;2026-09-02T16:35:00.000Z&quot;,
+  &quot;sessionId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;transaction&quot;: {}
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>objectId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Handle for the value the engine is holding. Pass it to the calls that consume it.</td>
+</tr>
+<tr>
+  <td class="k"><code>kind</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">What the handle refers to, which decides the calls that accept it.</td>
+</tr>
+<tr>
+  <td class="k"><code>expiresAt</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">When the engine drops the handle. Handles live 5 minutes.</td>
+</tr>
+<tr>
+  <td class="k"><code>sessionId</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Session that created the handle; only that session may use it.</td>
+</tr>
+<tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Wallet the handle is bound to, when it belongs to one.</td>
+</tr>
+<tr>
+  <td class="k"><code>transaction</code></td>
+  <td class="ty"><span class="t">unknown</span></td>
+  <td class="doc"><code>EdgeTransaction</code> as it stands after this step. Unsigned after <code>make-spend</code>, signed after <code>sign-tx</code>, and carrying a txid once broadcast.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="broadcastTx">
+    <header>
+      <h3><a href="#broadcastTx">Broadcast a signed transaction.</a></h3>
+      <div class="ids"><code class="cmdname">broadcast-tx</code><span class="src" title="Declared in">src/cli/engine/routes/spend.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>wallet.broadcastTx</code></p>
+    <div class="desc"><p>The irreversible step: once this returns, the funds have left the wallet.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>broadcast-tx &lt;objectId&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/broadcast-tx/{objectId}</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr><tr><td class="k"><code>objectId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From <code>sign-tx</code>.</td></tr></tbody></table>
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;objectId&quot;:&quot;FS8xJ2kQ…&quot;}' \
+  'http://localhost/account/$SESS/broadcast-tx/$OBJECTID'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="note"><p>The handle survives, so <code>save-tx</code> can still run.</p>
+</div><div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  objectId: string
+  kind: string
+  expiresAt: string
+  sessionId?: string
+  walletId?: string
+  transaction: unknown
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;objectId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;kind&quot;: &quot;string&quot;,
+  &quot;expiresAt&quot;: &quot;2026-09-02T16:35:00.000Z&quot;,
+  &quot;sessionId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;transaction&quot;: {}
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>objectId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Handle for the value the engine is holding. Pass it to the calls that consume it.</td>
+</tr>
+<tr>
+  <td class="k"><code>kind</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">What the handle refers to, which decides the calls that accept it.</td>
+</tr>
+<tr>
+  <td class="k"><code>expiresAt</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">When the engine drops the handle. Handles live 5 minutes.</td>
+</tr>
+<tr>
+  <td class="k"><code>sessionId</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Session that created the handle; only that session may use it.</td>
+</tr>
+<tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Wallet the handle is bound to, when it belongs to one.</td>
+</tr>
+<tr>
+  <td class="k"><code>transaction</code></td>
+  <td class="ty"><span class="t">unknown</span></td>
+  <td class="doc"><code>EdgeTransaction</code> as it stands after this step. Unsigned after <code>make-spend</code>, signed after <code>sign-tx</code>, and carrying a txid once broadcast.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a> <a href="#err-NETWORK_ERROR" class="err" title="Could not reach an Edge server."><span class="st">503</span>NETWORK_ERROR</a></p>
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>Broadcasting does not record the transaction locally. Follow with <code>save-tx</code>, or it stays missing from history until a sync finds it.</li></ul></div>
+  </section><section class="endpoint" id="saveTx">
+    <header>
+      <h3><a href="#saveTx">Record a transaction and release its handle.</a></h3>
+      <div class="ids"><code class="cmdname">save-tx</code><span class="src" title="Declared in">src/cli/engine/routes/spend.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>wallet.saveTx</code></p>
+    <div class="desc"><p>Final step. The handle is gone afterwards, so a second call is a 404.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>save-tx &lt;objectId&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/save-tx/{objectId}</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr><tr><td class="k"><code>objectId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">The handle to persist and release.</td></tr></tbody></table>
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;objectId&quot;:&quot;FS8xJ2kQ…&quot;}' \
+  'http://localhost/account/$SESS/save-tx/$OBJECTID'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  ok: boolean
+  objectId: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;ok&quot;: true,
+  &quot;objectId&quot;: &quot;FS8xJ2kQ…&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>ok</code></td>
+  <td class="ty"><span class="t">boolean</span></td>
+  <td class="doc">Always true; a failure arrives as an error envelope.</td>
+</tr>
+<tr>
+  <td class="k"><code>objectId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The handle this call consumed. It is now expired.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="accelerate">
+    <header>
+      <h3><a href="#accelerate">Fee-bump a pending transaction.</a></h3>
+      <div class="ids"><code class="cmdname">accelerate</code><span class="src" title="Declared in">src/cli/engine/routes/spend.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>wallet.accelerate</code></p><div class="note"><p><strong>Differs from core:</strong></p><ul><li><code>transaction</code> — Core names the parameter <code>tx</code>. Spelled out here to match the <code>transaction</code> field every staged-transaction response returns.</li></ul></div>
+    <div class="desc"><p>Replace-by-fee, where the plugin supports it. Returns a new unsigned transaction to sign and broadcast.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>accelerate --wallet-id=&lt;walletId&gt; [--object-id=&lt;objectId&gt;] [--transaction='&lt;json&gt;']</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/wallet/accelerate</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  walletId: string
+  objectId?: string
+  transaction?: unknown
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;objectId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;transaction&quot;: {}
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns <code>409 AMBIGUOUS_WALLET_ID</code> with <code>details.candidates</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>objectId</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Handle of the transaction to bump.</td>
+</tr>
+<tr>
+  <td class="k"><code>transaction</code></td>
+  <td class="ty"><span class="t">unknown</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Or the transaction itself.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;walletId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;objectId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;transaction&quot;:{}}' \
+  'http://localhost/account/$SESS/wallet/accelerate'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="note"><p>Given objectId the same handle is updated; given a transaction a new one is created.</p>
+</div><div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  objectId: string
+  kind: string
+  expiresAt: string
+  sessionId?: string
+  walletId?: string
+  transaction: unknown
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;objectId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;kind&quot;: &quot;string&quot;,
+  &quot;expiresAt&quot;: &quot;2026-09-02T16:35:00.000Z&quot;,
+  &quot;sessionId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;transaction&quot;: {}
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>objectId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Handle for the value the engine is holding. Pass it to the calls that consume it.</td>
+</tr>
+<tr>
+  <td class="k"><code>kind</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">What the handle refers to, which decides the calls that accept it.</td>
+</tr>
+<tr>
+  <td class="k"><code>expiresAt</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">When the engine drops the handle. Handles live 5 minutes.</td>
+</tr>
+<tr>
+  <td class="k"><code>sessionId</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Session that created the handle; only that session may use it.</td>
+</tr>
+<tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Wallet the handle is bound to, when it belongs to one.</td>
+</tr>
+<tr>
+  <td class="k"><code>transaction</code></td>
+  <td class="ty"><span class="t">unknown</span></td>
+  <td class="doc"><code>EdgeTransaction</code> as it stands after this step. Unsigned after <code>make-spend</code>, signed after <code>sign-tx</code>, and carrying a txid once broadcast.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a></p>
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>A plugin that cannot accelerate returns 400 rather than a null transaction.</li></ul></div>
+  </section><section class="endpoint" id="sweepPrivateKeys">
+    <header>
+      <h3><a href="#sweepPrivateKeys">Sweep private keys into this wallet.</a></h3>
+      <div class="ids"><code class="cmdname">sweep-private-keys</code><span class="src" title="Declared in">src/cli/engine/routes/spend.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>wallet.sweepPrivateKeys</code></p><div class="note"><p><strong>Differs from core:</strong></p><ul><li><code>spendInfo</code> — Core names this one <code>edgeSpendInfo</code> while <code>makeSpend</code> names the same type <code>spendInfo</code>. Both are <code>spendInfo</code> here.</li></ul></div>
+    <div class="desc"><p>Builds a transaction moving everything from an external key. Returns an unsigned handle: sign, broadcast and save it like any staged spend.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>sweep-private-keys --wallet-id=&lt;walletId&gt; --spend-info='&lt;json&gt;'</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/wallet/sweep-private-keys</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  walletId: string
+  spendInfo: unknown
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;spendInfo&quot;: {}
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns <code>409 AMBIGUOUS_WALLET_ID</code> with <code>details.candidates</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>spendInfo</code></td>
+  <td class="ty"><span class="t">unknown</span></td>
+  <td class="doc">A full <code>EdgeSpendInfo</code>, with the keys to sweep in <code>privateKeys</code>.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;walletId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;spendInfo&quot;:{}}' \
+  'http://localhost/account/$SESS/wallet/sweep-private-keys'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  objectId: string
+  kind: string
+  expiresAt: string
+  sessionId?: string
+  walletId?: string
+  transaction: unknown
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;objectId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;kind&quot;: &quot;string&quot;,
+  &quot;expiresAt&quot;: &quot;2026-09-02T16:35:00.000Z&quot;,
+  &quot;sessionId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;transaction&quot;: {}
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>objectId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Handle for the value the engine is holding. Pass it to the calls that consume it.</td>
+</tr>
+<tr>
+  <td class="k"><code>kind</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">What the handle refers to, which decides the calls that accept it.</td>
+</tr>
+<tr>
+  <td class="k"><code>expiresAt</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">When the engine drops the handle. Handles live 5 minutes.</td>
+</tr>
+<tr>
+  <td class="k"><code>sessionId</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Session that created the handle; only that session may use it.</td>
+</tr>
+<tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Wallet the handle is bound to, when it belongs to one.</td>
+</tr>
+<tr>
+  <td class="k"><code>transaction</code></td>
+  <td class="ty"><span class="t">unknown</span></td>
+  <td class="doc"><code>EdgeTransaction</code> as it stands after this step. Unsigned after <code>make-spend</code>, signed after <code>sign-tx</code>, and carrying a txid once broadcast.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a> <a href="#err-INSUFFICIENT_FUNDS" class="err" title="Not enough balance to cover amount plus fee."><span class="st">422</span>INSUFFICIENT_FUNDS</a> <a href="#err-NETWORK_ERROR" class="err" title="Could not reach an Edge server."><span class="st">503</span>NETWORK_ERROR</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="signBytes">
+    <header>
+      <h3><a href="#signBytes">Sign arbitrary bytes.</a></h3>
+      <div class="ids"><code class="cmdname">sign-bytes</code><span class="src" title="Declared in">src/cli/engine/routes/spend.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>wallet.signBytes</code></p><div class="note"><p><strong>Differs from core:</strong></p><ul><li><code>bytes</code> — Core takes a Uint8Array named <code>buf</code>. JSON cannot carry bytes, so this is base64 text.</li></ul></div>
+    <div class="desc"><p>Message signing and proof-of-ownership, for plugins that support it.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>sign-bytes --wallet-id=&lt;walletId&gt; [--bytes=&lt;bytes&gt;] [--other-params='&lt;json&gt;']</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/wallet/sign-bytes</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  walletId: string
+  bytes?: string
+  otherParams?: unknown
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;bytes&quot;: &quot;string&quot;,
+  &quot;otherParams&quot;: {}
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns <code>409 AMBIGUOUS_WALLET_ID</code> with <code>details.candidates</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>bytes</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Base64. Defaults to empty when absent.</td>
+</tr>
+<tr>
+  <td class="k"><code>otherParams</code></td>
+  <td class="ty"><span class="t">unknown</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Plugin-specific options. Bitcoin needs <code>{ publicAddress }</code>; other plugins take nothing, or refuse the call entirely.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;walletId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;bytes&quot;:&quot;string&quot;,&quot;otherParams&quot;:{}}' \
+  'http://localhost/account/$SESS/wallet/sign-bytes'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  signature: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;signature&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>signature</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Base64.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a></p>
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>Invalid base64 decodes to empty rather than erroring, so validate before sending.</li><li>Support is per plugin, and failures surface as <code>500 INTERNAL_ERROR</code> from the plugin rather than as a typed error: litecoin answers &quot;litecoin doesn&#39;t support signBytes&quot;, and bitcoin requires <code>otherParams.publicAddress</code> naming which address to sign with.</li></ul></div>
+  </section><section class="endpoint" id="getPaymentProtocolInfo">
+    <header>
+      <h3><a href="#getPaymentProtocolInfo">Fetch a BIP70 payment request.</a></h3>
+      <div class="ids"><code class="cmdname">get-payment-protocol-info</code><span class="src" title="Declared in">src/cli/engine/routes/spend.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>wallet.getPaymentProtocolInfo</code></p>
+    <div class="desc"><p>Feed <code>spendTargets</code> from the result into <code>make-spend</code> to pay it.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>get-payment-protocol-info --wallet-id=&lt;walletId&gt; --payment-protocol-url=&lt;paymentProtocolUrl&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/account/{sessionId}/wallet/get-payment-protocol-info</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    <div class="shape">
+    <div class="shape-h">Query</div>
+    <pre class="ts"><code>{
+  walletId: string
+  paymentProtocolUrl: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;paymentProtocolUrl&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns <code>409 AMBIGUOUS_WALLET_ID</code> with <code>details.candidates</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>paymentProtocolUrl</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The payment-request URL.</td>
+</tr></tbody></table>
+  </div>
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/account/$SESS/wallet/get-payment-protocol-info?walletId=…&amp;paymentProtocolUrl=…'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="note"><p><code>EdgePaymentProtocolInfo</code>: domain, memo, merchant, nativeAmount, spendTargets.</p>
+</div><pre class="ts"><code>unknown</code></pre>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a> <a href="#err-NETWORK_ERROR" class="err" title="Could not reach an Edge server."><span class="st">503</span>NETWORK_ERROR</a></p>
+  </div>
+    
+  </section><h3 class="sub" id="uri">URIs</h3>
+          <div class="groupdoc"><p>Parsing and building BIP21-style payment URIs through the wallet’s own plugin, so chain-specific quirks are handled for you.</p>
+</div>
+          <section class="endpoint" id="parseUri">
+    <header>
+      <h3><a href="#parseUri">Parse a payment URI or address.</a></h3>
+      <div class="ids"><code class="cmdname">parse-uri</code><span class="src" title="Declared in">src/cli/engine/routes/uri.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>wallet.parseUri</code></p>
+    <div class="desc"><p>What the GUI address tile does when you paste or scan something.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>parse-uri --wallet-id=&lt;walletId&gt; --uri=&lt;uri&gt; [--currency-code=&lt;currencyCode&gt;]</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/wallet/parse-uri</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  walletId: string
+  uri: string
+  currencyCode?: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;uri&quot;: &quot;string&quot;,
+  &quot;currencyCode&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns <code>409 AMBIGUOUS_WALLET_ID</code> with <code>details.candidates</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>uri</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">A payment URI or a bare address.</td>
+</tr>
+<tr>
+  <td class="k"><code>currencyCode</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Disambiguates on chains that carry several assets.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;walletId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;uri&quot;:&quot;string&quot;,&quot;currencyCode&quot;:&quot;string&quot;}' \
+  'http://localhost/account/$SESS/wallet/parse-uri'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="note"><p><code>EdgeParsedUri</code>: publicAddress, nativeAmount, currencyCode, metadata, paymentProtocolUrl, …</p>
+</div><pre class="ts"><code>unknown</code></pre>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a> <a href="#err-WALLET_NOT_FOUND" class="err" title="No wallet matches that id or prefix."><span class="st">404</span>WALLET_NOT_FOUND</a> <a href="#err-AMBIGUOUS_WALLET_ID" class="err" title="A wallet id prefix matched more than one wallet."><span class="st">409</span>AMBIGUOUS_WALLET_ID</a></p>
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li><code>spend</code> and <code>make-spend</code> run their <code>to</code> field through this same call, so parsing separately is only needed to inspect or confirm first.</li></ul></div>
+  </section><section class="endpoint" id="encodeUri">
+    <header>
+      <h3><a href="#encodeUri">Build a payment URI.</a></h3>
+      <div class="ids"><code class="cmdname">encode-uri</code><span class="src" title="Declared in">src/cli/engine/routes/uri.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>wallet.encodeUri</code></p>
+    <div class="desc"><p>For a receive screen or a QR code.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>encode-uri --wallet-id=&lt;walletId&gt; --public-address=&lt;publicAddress&gt; [--native-amount=&lt;nativeAmount&gt;] [--label=&lt;label&gt;] [--message=&lt;message&gt;] [--currency-code=&lt;currencyCode&gt;]</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/wallet/encode-uri</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  walletId: string
+  publicAddress: string
+  nativeAmount?: string
+  label?: string
+  message?: string
+  currencyCode?: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;publicAddress&quot;: &quot;string&quot;,
+  &quot;nativeAmount&quot;: &quot;12345&quot;,
+  &quot;label&quot;: &quot;string&quot;,
+  &quot;message&quot;: &quot;string&quot;,
+  &quot;currencyCode&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns <code>409 AMBIGUOUS_WALLET_ID</code> with <code>details.candidates</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>publicAddress</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Where the payment should go.</td>
+</tr>
+<tr>
+  <td class="k"><code>nativeAmount</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Amount, in the native unit.</td>
+</tr>
+<tr>
+  <td class="k"><code>label</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">BIP21 <code>label</code>; becomes <code>metadata.name</code> when parsed back.</td>
+</tr>
+<tr>
+  <td class="k"><code>message</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">BIP21 <code>message</code>; becomes <code>metadata.notes</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>currencyCode</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Disambiguates on chains that carry several assets.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;walletId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;publicAddress&quot;:&quot;string&quot;,&quot;nativeAmount&quot;:&quot;12345&quot;,&quot;label&quot;:&quot;string&quot;,&quot;message&quot;:&quot;string&quot;,&quot;currencyCode&quot;:&quot;string&quot;}' \
+  'http://localhost/account/$SESS/wallet/encode-uri'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  uri: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;uri&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>uri</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The encoded URI, ready for a QR code.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a> <a href="#err-WALLET_NOT_FOUND" class="err" title="No wallet matches that id or prefix."><span class="st">404</span>WALLET_NOT_FOUND</a> <a href="#err-AMBIGUOUS_WALLET_ID" class="err" title="A wallet id prefix matched more than one wallet."><span class="st">409</span>AMBIGUOUS_WALLET_ID</a></p>
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>Only these five fields are read; a fuller <code>EdgeEncodeUri</code> has its extras ignored.</li></ul></div>
+  </section><h2 id="local-settings">Local settings</h2>
+      <div class="groupdoc"><p>Device-local account settings, stored outside the synced repos. They follow the account but never leave the machine.</p>
+</div>
+      <h3 class="sub" id="localSettings">Local settings</h3>
+          <div class="groupdoc"><p>Device-local account settings, stored outside the synced repos.</p>
+</div>
+          <section class="endpoint" id="localSettings">
+    <header>
+      <h3><a href="#localSettings">Local settings.</a></h3>
+      <div class="ids"><code class="cmdname">local-settings</code><span class="src" title="Declared in">src/cli/engine/routes/localSettings.ts</span></div>
+    </header>
+    <p class="core none"><span class="lbl">core</span><em>GUI code (src/util/localAccountSettings), reached through account.localDisklet.</em></p>
+    <div class="desc"><p>Device-local account settings, stored in <code>Settings.json</code> on <code>account.localDisklet</code>. They are not synced — a phone and a CLI keep separate copies unless they share an Edge data directory.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>local-settings</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/account/{sessionId}/local-settings</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/account/$SESS/local-settings'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  spamFilterOn: boolean
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;spamFilterOn&quot;: true
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>spamFilterOn</code></td>
+  <td class="ty"><span class="t">boolean</span></td>
+  <td class="doc">Hide spam transactions in <code>get-transactions</code> results. Defaults to <code>true</code>, matching the GUI. The filter hides rows; it never changes stored metadata.</td>
+</tr></tbody></table>
+  </div>
+    
+  </div>
+    
+  </section><section class="endpoint" id="changeLocalSettings">
+    <header>
+      <h3><a href="#changeLocalSettings">Change local settings.</a></h3>
+      <div class="ids"><code class="cmdname">local-settings</code><span class="src" title="Declared in">src/cli/engine/routes/localSettings.ts</span></div>
+    </header>
+    <p class="core none"><span class="lbl">core</span><em>GUI code (src/util/localAccountSettings).</em></p>
+    <div class="desc"><p>Writes device-local account settings. Every option is a field on the body; <code>spamFilterOn</code> is the only one today, and new options are added alongside it.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>local-settings --spam-filter-on=true|false</code></pre>
+    
+    <div class="note"><p>With no flag the command reads; with one it writes.</p>
+</div>
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/change-local-settings</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  spamFilterOn: boolean
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;spamFilterOn&quot;: true
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>spamFilterOn</code></td>
+  <td class="ty"><span class="t">boolean</span></td>
+  <td class="doc">Hide spam transactions in <code>get-transactions</code> results. Defaults to <code>true</code>, matching the GUI. The filter hides rows; it never changes stored metadata.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;spamFilterOn&quot;:true}' \
+  'http://localhost/account/$SESS/change-local-settings'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  spamFilterOn: boolean
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;spamFilterOn&quot;: true
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>spamFilterOn</code></td>
+  <td class="ty"><span class="t">boolean</span></td>
+  <td class="doc">Hide spam transactions in <code>get-transactions</code> results. Defaults to <code>true</code>, matching the GUI. The filter hides rows; it never changes stored metadata.</td>
+</tr></tbody></table>
+  </div>
+    
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>Omitting a field is a <code>400</code>, not a no-op, so a caller cannot clear a setting by accident.</li></ul></div>
+  </section><h2 id="rates">Exchange rates</h2>
+      <div class="groupdoc"><p>Fiat and crypto pricing, current and historical.</p>
+</div>
+      <h3 class="sub" id="rates">Exchange rates</h3>
+          <div class="groupdoc"><p>Historical and current rates through the same batching queue the GUI uses. No session required.</p>
+</div>
+          <section class="endpoint" id="ratesQuery">
+    <header>
+      <h3><a href="#ratesQuery">Batch crypto and fiat rate lookups.</a></h3>
+      <div class="ids"><code class="cmdname">rates-query</code><span class="src" title="Declared in">src/cli/engine/routes/rates.ts</span></div>
+    </header>
+    <p class="core none"><span class="lbl">core</span><em>GUI code (src/util/exchangeRates): getHistoricalCryptoRate and getHistoricalFiatRate.</em></p>
+    <div class="desc"><p>Concurrent lookups share one rates-server queue, so asking for many rates at once costs a single upstream request.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>rates-query [--crypto='&lt;json&gt;'] [--fiat='&lt;json&gt;']</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/rates/query</code></p>
+    
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  crypto?: {
+    pluginId: string;
+    tokenId: string | null | undefined;
+    targetFiat: string | undefined;
+    date: string | undefined
+  }[]
+  fiat?: {
+    fiatCode: string;
+    targetFiat: string | undefined;
+    date: string | undefined
+  }[]
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;crypto&quot;: [
+    {}
+  ],
+  &quot;fiat&quot;: [
+    {}
+  ]
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>crypto</code></td>
+  <td class="ty"><span class="t">{ pluginId: string; tokenId: string | null | undefined; targetFiat: string | undefined; date: string | undefined; }[]</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Crypto rates to fetch.</td>
+</tr>
+<tr>
+  <td class="k"><code>fiat</code></td>
+  <td class="ty"><span class="t">{ fiatCode: string; targetFiat: string | undefined; date: string | undefined; }[]</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Fiat rates to fetch.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;crypto&quot;:[{}],&quot;fiat&quot;:[{}]}' \
+  'http://localhost/rates/query'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  crypto: {
+    pluginId: string;
+    tokenId: string | null;
+    targetFiat: string;
+    date: string;
+    rate: number
+  }[]
+  fiat: {
+    fiatCode: string;
+    targetFiat: string;
+    date: string;
+    rate: number
+  }[]
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;crypto&quot;: [
+    {}
+  ],
+  &quot;fiat&quot;: [
+    {}
+  ]
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>crypto</code></td>
+  <td class="ty"><span class="t">{ pluginId: string; tokenId: string | null; targetFiat: string; date: string; rate: number; }[]</span></td>
+  <td class="doc">Always present; empty when no crypto rates were requested.</td>
+</tr>
+<tr>
+  <td class="k"><code>fiat</code></td>
+  <td class="ty"><span class="t">{ fiatCode: string; targetFiat: string; date: string; rate: number; }[]</span></td>
+  <td class="doc">Always present; empty when no fiat rates were requested.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a> <a href="#err-NETWORK_ERROR" class="err" title="Could not reach an Edge server."><span class="st">503</span>NETWORK_ERROR</a></p>
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>A rate the server cannot supply comes back as <code>0</code> rather than an error, so check for zero before dividing.</li></ul></div>
+  </section><section class="endpoint" id="ratesUsdToNative">
+    <header>
+      <h3><a href="#ratesUsdToNative">Convert a USD amount into native units.</a></h3>
+      <div class="ids"><code class="cmdname">rates-usd-to-native</code><span class="src" title="Declared in">src/cli/engine/routes/rates.ts</span></div>
+    </header>
+    <p class="core none"><span class="lbl">core</span><em>GUI code (src/util/exchangeRates): getHistoricalCryptoRate.</em></p>
+    <div class="desc"><p>Turns a fiat notional into the native amount a spend needs.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>rates-usd-to-native --usd-amount=&lt;usdAmount&gt; --plugin-id=&lt;pluginId&gt; [--token-id=&lt;tokenId&gt;] [--multiplier=&lt;multiplier&gt;] [--date=&lt;date&gt;]</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/rates/usd-to-native</code></p>
+    
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  usdAmount: string
+  pluginId: string
+  tokenId?: string | null
+  multiplier?: string
+  date?: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;usdAmount&quot;: &quot;12345&quot;,
+  &quot;pluginId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;tokenId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;multiplier&quot;: &quot;string&quot;,
+  &quot;date&quot;: &quot;2026-09-02T16:35:00.000Z&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>usdAmount</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">A string, which must parse to a positive finite number.</td>
+</tr>
+<tr>
+  <td class="k"><code>pluginId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Which chain to price.</td>
+</tr>
+<tr>
+  <td class="k"><code>tokenId</code></td>
+  <td class="ty"><span class="t">string | null</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Defaults to the native asset.</td>
+</tr>
+<tr>
+  <td class="k"><code>multiplier</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Native units per whole coin. Defaults per plugin.</td>
+</tr>
+<tr>
+  <td class="k"><code>date</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">ISO-8601. Omitted, the current time is sent to the rates server.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;usdAmount&quot;:&quot;12345&quot;,&quot;pluginId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;tokenId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;multiplier&quot;:&quot;string&quot;,&quot;date&quot;:&quot;2026-09-02T16:35:00.000Z&quot;}' \
+  'http://localhost/rates/usd-to-native'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  usdAmount: number
+  pluginId: string
+  tokenId: string | null
+  multiplier: string
+  date: string
+  rate: number
+  displayAmount: string
+  nativeAmount: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;usdAmount&quot;: 0,
+  &quot;pluginId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;tokenId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;multiplier&quot;: &quot;string&quot;,
+  &quot;date&quot;: &quot;2026-09-02T16:35:00.000Z&quot;,
+  &quot;rate&quot;: 1,
+  &quot;displayAmount&quot;: &quot;12345&quot;,
+  &quot;nativeAmount&quot;: &quot;12345&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>usdAmount</code></td>
+  <td class="ty"><span class="t">number</span></td>
+  <td class="doc">Echoed as a number, though it is sent as a string.</td>
+</tr>
+<tr>
+  <td class="k"><code>pluginId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Currency plugin the amount was converted for.</td>
+</tr>
+<tr>
+  <td class="k"><code>tokenId</code></td>
+  <td class="ty"><span class="t">string | null</span></td>
+  <td class="doc">The asset, or null for the chain’s own coin.</td>
+</tr>
+<tr>
+  <td class="k"><code>multiplier</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Native units per whole coin, which is what the conversion divided by.</td>
+</tr>
+<tr>
+  <td class="k"><code>date</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The timestamp actually used for the rate.</td>
+</tr>
+<tr>
+  <td class="k"><code>rate</code></td>
+  <td class="ty"><span class="t">number</span></td>
+  <td class="doc">USD per whole coin at that date.</td>
+</tr>
+<tr>
+  <td class="k"><code>displayAmount</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Whole coins, to 8 decimal places.</td>
+</tr>
+<tr>
+  <td class="k"><code>nativeAmount</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">What a spend actually takes.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a> <a href="#err-NOT_FOUND" class="err" title="No route matched, or a generic missing resource."><span class="st">404</span>NOT_FOUND</a> <a href="#err-NETWORK_ERROR" class="err" title="Could not reach an Edge server."><span class="st">503</span>NETWORK_ERROR</a></p>
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li><code>displayAmount</code> is rounded to 8 decimals before conversion, so assets with finer precision lose the tail. For an exact figure use <code>rates-query</code> and do the arithmetic yourself.</li><li>Default multipliers cover bitcoin, ethereum, bitcoincash, litecoin and dogecoin; pass <code>multiplier</code> explicitly for anything else.</li></ul></div>
+  </section><h2 id="objects">Object handles</h2>
+      <div class="groupdoc"><p>A core value with methods on it cannot cross JSON, so the engine keeps it and hands back an id. These read and release any of them.</p>
+</div>
+      <h3 class="sub" id="objects">Object handles</h3>
+          <div class="groupdoc"><p>A core value with methods on it — a staged transaction, a swap quote, a pending login — cannot cross JSON, so the engine keeps it and hands back an id. These read and release any of them.</p>
+</div>
+          <section class="endpoint" id="getObject">
+    <header>
+      <h3><a href="#getObject">Inspect an object handle.</a></h3>
+      <div class="ids"><code class="cmdname">object-get</code><span class="src" title="Declared in">src/cli/engine/routes/objects.ts</span></div>
+    </header>
+    <p class="core none"><span class="lbl">core</span><em>Engine handle store; core identifies these values by object reference.</em></p>
+    <div class="desc"><p>Works for every kind: transactions, pending logins, swap quotes.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>object-get &lt;objectId&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/account/{sessionId}/object/{objectId}</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr><tr><td class="k"><code>objectId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">An ephemeral object handle id.</td></tr></tbody></table>
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/account/$SESS/object/$OBJECTID'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="note"><p>The handle fields, plus a <code>value</code> holding the live core object.</p>
+</div><div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  objectId: string
+  kind: string
+  expiresAt: string
+  sessionId?: string
+  walletId?: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;objectId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;kind&quot;: &quot;string&quot;,
+  &quot;expiresAt&quot;: &quot;2026-09-02T16:35:00.000Z&quot;,
+  &quot;sessionId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;walletId&quot;: &quot;FS8xJ2kQ…&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>objectId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Handle for the value the engine is holding. Pass it to the calls that consume it.</td>
+</tr>
+<tr>
+  <td class="k"><code>kind</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">What the handle refers to, which decides the calls that accept it.</td>
+</tr>
+<tr>
+  <td class="k"><code>expiresAt</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">When the engine drops the handle. Handles live 5 minutes.</td>
+</tr>
+<tr>
+  <td class="k"><code>sessionId</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Session that created the handle; only that session may use it.</td>
+</tr>
+<tr>
+  <td class="k"><code>walletId</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Wallet the handle is bound to, when it belongs to one.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-OBJECT_NOT_FOUND" class="err" title="No handle with that `objectId`."><span class="st">404</span>OBJECT_NOT_FOUND</a> <a href="#err-OBJECT_EXPIRED" class="err" title="The handle passed its 5 minute TTL and was released."><span class="st">410</span>OBJECT_EXPIRED</a> <a href="#err-OBJECT_SESSION_MISMATCH" class="err" title="The handle belongs to a different session."><span class="st">400</span>OBJECT_SESSION_MISMATCH</a></p>
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>Reading does not extend the TTL. Only a step that updates the value does.</li></ul></div>
+  </section><section class="endpoint" id="deleteObject">
+    <header>
+      <h3><a href="#deleteObject">Release an object handle.</a></h3>
+      <div class="ids"><code class="cmdname">object-delete</code><span class="src" title="Declared in">src/cli/engine/routes/objects.ts</span></div>
+    </header>
+    <p class="core none"><span class="lbl">core</span><em>Engine handle store.</em></p>
+    <div class="desc"><p>Runs the handle&#39;s cleanup — closing a swap quote, cancelling a pending login — instead of waiting out the TTL.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>object-delete &lt;objectId&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/account/{sessionId}/object/delete/{objectId}</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>sessionId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">From a successful login. The CLI supplies this from <code>session.json</code>, <code>--session</code>, or <code>EDGE_CLI_SESSION</code>.</td></tr><tr><td class="k"><code>objectId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">An ephemeral object handle id.</td></tr></tbody></table>
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  'http://localhost/account/$SESS/object/delete/$OBJECTID'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  ok: boolean
+  objectId: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;ok&quot;: true,
+  &quot;objectId&quot;: &quot;FS8xJ2kQ…&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>ok</code></td>
+  <td class="ty"><span class="t">boolean</span></td>
+  <td class="doc">Always true; a failure arrives as an error envelope.</td>
+</tr>
+<tr>
+  <td class="k"><code>objectId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The handle this call consumed. It is now expired.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-OBJECT_NOT_FOUND" class="err" title="No handle with that `objectId`."><span class="st">404</span>OBJECT_NOT_FOUND</a> <a href="#err-OBJECT_EXPIRED" class="err" title="The handle passed its 5 minute TTL and was released."><span class="st">410</span>OBJECT_EXPIRED</a> <a href="#err-OBJECT_SESSION_MISMATCH" class="err" title="The handle belongs to a different session."><span class="st">400</span>OBJECT_SESSION_MISMATCH</a></p>
+  </div>
+    
+  </section><h2 id="admin">Admin</h2>
+      <div class="groupdoc"><p>The <code>$internalStuff</code> escape hatch: login-server and sync-repo access that no ordinary caller needs.</p>
+</div>
+      <h3 class="sub" id="admin">Admin</h3>
+          <div class="groupdoc"><p><strong>Debugging only — not for production apps.</strong> These reach into <code>context.$internalStuff</code>, the private surface of <code>edge-core-js</code>, and can corrupt an account’s synced repos. They take no <code>sessionId</code>: they act on the context, not on a logged-in account.</p>
+</div>
+          <section class="endpoint" id="adminAuthRequest">
+    <header>
+      <h3><a href="#adminAuthRequest">Raw login-server request.</a></h3>
+      <div class="ids"><code class="cmdname">admin-auth-request</code><span class="src" title="Declared in">src/cli/engine/routes/admin.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>context.$internalStuff.authRequest</code></p>
+    <div class="desc"><p>Sends an arbitrary request with the context&#39;s credentials attached. Debugging only — this is core&#39;s private surface.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>admin-auth-request --method=&lt;method&gt; --path=&lt;path&gt; [--body='&lt;json&gt;']</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/admin/auth-request</code></p>
+    
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  method: string
+  path: string
+  body?: unknown
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;method&quot;: &quot;string&quot;,
+  &quot;path&quot;: &quot;string&quot;,
+  &quot;body&quot;: {}
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>method</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">HTTP method, e.g. <code>GET</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>path</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Login-server path, not an engine path.</td>
+</tr>
+<tr>
+  <td class="k"><code>body</code></td>
+  <td class="ty"><span class="t">unknown</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Request body, when the method takes one.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;method&quot;:&quot;string&quot;,&quot;path&quot;:&quot;string&quot;,&quot;body&quot;:{}}' \
+  'http://localhost/admin/auth-request'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="note"><p>Whatever the login server returned.</p>
+</div><pre class="ts"><code>unknown</code></pre>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a> <a href="#err-NETWORK_ERROR" class="err" title="Could not reach an Edge server."><span class="st">503</span>NETWORK_ERROR</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="adminHashUsername">
+    <header>
+      <h3><a href="#adminHashUsername">Hash a username.</a></h3>
+      <div class="ids"><code class="cmdname">admin-hash-username</code><span class="src" title="Declared in">src/cli/engine/routes/admin.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>context.$internalStuff.hashUsername</code></p>
+    <div class="desc"><p>Reproduces the login server&#39;s hashing, to derive a login id offline.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>admin-hash-username --username=&lt;username&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/admin/hash-username</code></p>
+    
+    <div class="shape">
+    <div class="shape-h">Query</div>
+    <pre class="ts"><code>{
+  username: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;username&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>username</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The name to hash.</td>
+</tr></tbody></table>
+  </div>
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/admin/hash-username?username=…'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  loginId: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;loginId&quot;: &quot;FS8xJ2kQ…&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>loginId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Base58.</td>
+</tr></tbody></table>
+  </div>
+    
+  </div>
+    
+  </section><section class="endpoint" id="adminMakeLobby">
+    <header>
+      <h3><a href="#adminMakeLobby">Create a lobby.</a></h3>
+      <div class="ids"><code class="cmdname">admin-make-lobby</code><span class="src" title="Declared in">src/cli/engine/routes/admin.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>context.$internalStuff.makeLobby</code></p>
+    <div class="desc"><p>A lobby polls the login server until closed, so the engine parks it under a <code>lobby_</code> handle and closes it on expiry rather than leaking the poll.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>admin-make-lobby [--lobby-request='&lt;json&gt;'] [--period-seconds='&lt;json&gt;']</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/admin/make-lobby</code></p>
+    
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  lobbyRequest?: unknown
+  period?: unknown
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;lobbyRequest&quot;: {},
+  &quot;period&quot;: {}
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>lobbyRequest</code></td>
+  <td class="ty"><span class="t">unknown</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Defaults to <code>{}</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>period</code></td>
+  <td class="ty"><span class="t">unknown</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Poll interval in seconds.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;lobbyRequest&quot;:{},&quot;period&quot;:{}}' \
+  'http://localhost/admin/make-lobby'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  objectId: string
+  expiresAt: string
+  lobbyId: string
+  replies: unknown[]
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;objectId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;expiresAt&quot;: &quot;2026-09-02T16:35:00.000Z&quot;,
+  &quot;lobbyId&quot;: &quot;FS8xJ2kQ…&quot;,
+  &quot;replies&quot;: [
+    {}
+  ]
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>objectId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The parked handle.</td>
+</tr>
+<tr>
+  <td class="k"><code>expiresAt</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">When the engine closes the lobby and stops polling.</td>
+</tr>
+<tr>
+  <td class="k"><code>lobbyId</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Identifies the lobby to the party joining it.</td>
+</tr>
+<tr>
+  <td class="k"><code>replies</code></td>
+  <td class="ty"><span class="t">unknown[]</span></td>
+  <td class="doc">Empty at creation; re-read to see replies.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-NETWORK_ERROR" class="err" title="Could not reach an Edge server."><span class="st">503</span>NETWORK_ERROR</a></p>
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>Release it with <code>admin-lobby-handle-delete</code>, or the poll runs for the full five minutes.</li></ul></div>
+  </section><section class="endpoint" id="adminDeleteLobbyHandle">
+    <header>
+      <h3><a href="#adminDeleteLobbyHandle">Close a parked lobby.</a></h3>
+      <div class="ids"><code class="cmdname">admin-lobby-handle-delete</code><span class="src" title="Declared in">src/cli/engine/routes/admin.ts</span></div>
+    </header>
+    <p class="core none"><span class="lbl">core</span><em>Engine handle store for a lobby created via makeLobby.</em></p>
+    
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>admin-lobby-handle-delete &lt;objectId&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/admin/lobby-handle/delete/{objectId}</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>objectId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">An ephemeral object handle id.</td></tr></tbody></table>
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  'http://localhost/admin/lobby-handle/delete/$OBJECTID'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  ok: boolean
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;ok&quot;: true
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>ok</code></td>
+  <td class="ty"><span class="t">boolean</span></td>
+  <td class="doc">Always true; a failure arrives as an error envelope.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-OBJECT_NOT_FOUND" class="err" title="No handle with that `objectId`."><span class="st">404</span>OBJECT_NOT_FOUND</a></p>
+  </div>
+    <div class="pane notes"><h4>Notes</h4><ul><li>Not under <code>/account/{sessionId}/objects/</code>, because admin lobbies belong to no session.</li></ul></div>
+  </section><section class="endpoint" id="adminFetchLobbyRequest">
+    <header>
+      <h3><a href="#adminFetchLobbyRequest">Read a lobby's contents.</a></h3>
+      <div class="ids"><code class="cmdname">admin-fetch-lobby-request</code><span class="src" title="Declared in">src/cli/engine/routes/admin.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>context.$internalStuff.fetchLobbyRequest</code></p>
+    
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>admin-fetch-lobby-request &lt;lobbyId&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/admin/fetch-lobby-request/{lobbyId}</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>lobbyId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">Which lobby to read.</td></tr></tbody></table>
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/admin/fetch-lobby-request/$LOBBYID?lobbyId=…'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="note"><p>The raw lobby request.</p>
+</div><pre class="ts"><code>unknown</code></pre>
+    <h5>Errors</h5><p class="errs"><a href="#err-NETWORK_ERROR" class="err" title="Could not reach an Edge server."><span class="st">503</span>NETWORK_ERROR</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="adminSendLobbyReply">
+    <header>
+      <h3><a href="#adminSendLobbyReply">Reply to a lobby.</a></h3>
+      <div class="ids"><code class="cmdname">admin-send-lobby-reply</code><span class="src" title="Declared in">src/cli/engine/routes/admin.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>context.$internalStuff.sendLobbyReply</code></p>
+    
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>admin-send-lobby-reply &lt;lobbyId&gt; --lobby-request='&lt;json&gt;' [--reply-data='&lt;json&gt;']</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/admin/send-lobby-reply/{lobbyId}</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>lobbyId</code></td><td class="ty"><span class="t">string</span></td><td class="doc">Which lobby to answer.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  lobbyRequest: unknown
+  replyData?: unknown
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;lobbyRequest&quot;: {},
+  &quot;replyData&quot;: {}
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>lobbyRequest</code></td>
+  <td class="ty"><span class="t">unknown</span></td>
+  <td class="doc">Normally the object from <code>admin-fetch-lobby-request</code>.</td>
+</tr>
+<tr>
+  <td class="k"><code>replyData</code></td>
+  <td class="ty"><span class="t">unknown</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Payload for the requester.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;lobbyId&quot;:&quot;FS8xJ2kQ…&quot;,&quot;lobbyRequest&quot;:{},&quot;replyData&quot;:{}}' \
+  'http://localhost/admin/send-lobby-reply/$LOBBYID'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">204</span></h4>
+    <p class="lead dim">No body.</p>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a> <a href="#err-NETWORK_ERROR" class="err" title="Could not reach an Edge server."><span class="st">503</span>NETWORK_ERROR</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="adminSyncRepo">
+    <header>
+      <h3><a href="#adminSyncRepo">Sync a repo.</a></h3>
+      <div class="ids"><code class="cmdname">admin-sync-repo</code><span class="src" title="Declared in">src/cli/engine/routes/admin.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>context.$internalStuff.syncRepo</code></p>
+    
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>admin-sync-repo &lt;syncKey&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/admin/sync-repo/{syncKey}</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>syncKey</code></td><td class="ty"><span class="t">string</span></td><td class="doc">Base58 repo sync key.</td></tr></tbody></table>
+    
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;syncKey&quot;:&quot;string&quot;}' \
+  'http://localhost/admin/sync-repo/$SYNCKEY'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="note"><p>The changeset summary.</p>
+</div><pre class="ts"><code>unknown</code></pre>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a> <a href="#err-NETWORK_ERROR" class="err" title="Could not reach an Edge server."><span class="st">503</span>NETWORK_ERROR</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="adminRepoList">
+    <header>
+      <h3><a href="#adminRepoList">List repo contents.</a></h3>
+      <div class="ids"><code class="cmdname">admin-repo-list</code><span class="src" title="Declared in">src/cli/engine/routes/admin.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>context.$internalStuff.getRepoDisklet</code></p>
+    
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>admin-repo-list &lt;syncKey&gt; [--path=&lt;path&gt;] --data-key=&lt;dataKey&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/admin/repo-list/{syncKey}</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>syncKey</code></td><td class="ty"><span class="t">string</span></td><td class="doc">Base58 repo sync key.</td></tr></tbody></table>
+    <div class="shape">
+    <div class="shape-h">Query</div>
+    <pre class="ts"><code>{
+  path?: string
+  dataKey: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;path&quot;: &quot;string&quot;,
+  &quot;dataKey&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>path</code></td>
+  <td class="ty"><span class="t">string</span> <span class="flag opt">optional</span></td>
+  <td class="doc">Subdirectory. Defaults to the repo root.</td>
+</tr>
+<tr>
+  <td class="k"><code>dataKey</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Base58 repo data key.</td>
+</tr></tbody></table>
+  </div>
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/admin/repo-list/$SYNCKEY?syncKey=…&amp;dataKey=…'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  listing: unknown
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;listing&quot;: {}
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>listing</code></td>
+  <td class="ty"><span class="t">unknown</span></td>
+  <td class="doc">Path to entry type: <code>file</code> or <code>folder</code>.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="adminRepoGet">
+    <header>
+      <h3><a href="#adminRepoGet">Read a repo file.</a></h3>
+      <div class="ids"><code class="cmdname">admin-repo-get</code><span class="src" title="Declared in">src/cli/engine/routes/admin.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>context.$internalStuff.getRepoDisklet</code></p>
+    
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>admin-repo-get &lt;syncKey&gt; --path=&lt;path&gt; --data-key=&lt;dataKey&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-GET">GET</span><code>/admin/repo-get/{syncKey}</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>syncKey</code></td><td class="ty"><span class="t">string</span></td><td class="doc">Base58 repo sync key.</td></tr></tbody></table>
+    <div class="shape">
+    <div class="shape-h">Query</div>
+    <pre class="ts"><code>{
+  path: string
+  dataKey: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;path&quot;: &quot;string&quot;,
+  &quot;dataKey&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>path</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Path within the repo.</td>
+</tr>
+<tr>
+  <td class="k"><code>dataKey</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Base58 repo data key.</td>
+</tr></tbody></table>
+  </div>
+    
+    
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  'http://localhost/admin/repo-get/$SYNCKEY?path=…&amp;syncKey=…&amp;dataKey=…'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">200</span></h4>
+    <div class="shape">
+    <div class="shape-h">Response body</div>
+    <pre class="ts"><code>{
+  text: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;text&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>text</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The file contents.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Errors</h5><p class="errs"><a href="#err-NOT_FOUND" class="err" title="No route matched, or a generic missing resource."><span class="st">404</span>NOT_FOUND</a> <a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="adminRepoSet">
+    <header>
+      <h3><a href="#adminRepoSet">Write a repo file.</a></h3>
+      <div class="ids"><code class="cmdname">admin-repo-set</code><span class="src" title="Declared in">src/cli/engine/routes/admin.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>context.$internalStuff.getRepoDisklet</code></p>
+    <div class="desc"><p>Writes directly into a synced repo, bypassing every core-level invariant. A malformed write can break the account for real clients.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>admin-repo-set &lt;syncKey&gt; --path=&lt;path&gt; --text=&lt;text&gt; --data-key=&lt;dataKey&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/admin/repo-set/{syncKey}</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>syncKey</code></td><td class="ty"><span class="t">string</span></td><td class="doc">Base58 repo sync key.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  path: string
+  text: string
+  dataKey: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;path&quot;: &quot;string&quot;,
+  &quot;text&quot;: &quot;string&quot;,
+  &quot;dataKey&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>path</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Path within the repo.</td>
+</tr>
+<tr>
+  <td class="k"><code>text</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">The contents to write.</td>
+</tr>
+<tr>
+  <td class="k"><code>dataKey</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Base58 repo data key.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;path&quot;:&quot;string&quot;,&quot;text&quot;:&quot;string&quot;,&quot;syncKey&quot;:&quot;string&quot;,&quot;dataKey&quot;:&quot;string&quot;}' \
+  'http://localhost/admin/repo-set/$SYNCKEY'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">204</span></h4>
+    <p class="lead dim">No body.</p>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a></p>
+  </div>
+    
+  </section><section class="endpoint" id="adminRepoDelete">
+    <header>
+      <h3><a href="#adminRepoDelete">Delete a repo file.</a></h3>
+      <div class="ids"><code class="cmdname">admin-repo-delete</code><span class="src" title="Declared in">src/cli/engine/routes/admin.ts</span></div>
+    </header>
+    <p class="core"><span class="lbl">core</span><code>context.$internalStuff.getRepoDisklet</code></p>
+    <div class="desc"><p>Destructive, and not undoable from this API.</p>
+</div>
+    <div class="panes"><div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>admin-repo-delete &lt;syncKey&gt; --path=&lt;path&gt; --data-key=&lt;dataKey&gt;</code></pre>
+    
+    
+  </div><div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-POST">POST</span><code>/admin/repo-delete/{syncKey}</code></p>
+    <h5>Path</h5><table class="fields"><tbody><tr><td class="k"><code>syncKey</code></td><td class="ty"><span class="t">string</span></td><td class="doc">Base58 repo sync key.</td></tr></tbody></table>
+    
+    
+    <div class="shape">
+    <div class="shape-h">Request body</div>
+    <pre class="ts"><code>{
+  path: string
+  dataKey: string
+}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>{
+  &quot;path&quot;: &quot;string&quot;,
+  &quot;dataKey&quot;: &quot;string&quot;
+}</code></pre></details>
+    <table class="fields"><tbody><tr>
+  <td class="k"><code>path</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Path within the repo.</td>
+</tr>
+<tr>
+  <td class="k"><code>dataKey</code></td>
+  <td class="ty"><span class="t">string</span></td>
+  <td class="doc">Base58 repo data key.</td>
+</tr></tbody></table>
+  </div>
+    <h5>Example</h5>
+    <pre class="ex"><code>curl --unix-socket &quot;$SOCK&quot; \
+  -X POST \
+  -H 'Content-Type: application/json' \
+  -d '{&quot;path&quot;:&quot;string&quot;,&quot;syncKey&quot;:&quot;string&quot;,&quot;dataKey&quot;:&quot;string&quot;}' \
+  'http://localhost/admin/repo-delete/$SYNCKEY'</code></pre>
+  </div></div>
+    <div class="pane resp">
+    <h4>Response <span class="st ok">204</span></h4>
+    <p class="lead dim">No body.</p>
+    <h5>Errors</h5><p class="errs"><a href="#err-BAD_REQUEST" class="err" title="Malformed JSON, or a missing / wrongly typed field."><span class="st">400</span>BAD_REQUEST</a></p>
+  </div>
+    
+  </section>
+<h2 id="errors">Error codes</h2>
+<table class="fields"><tbody><tr id="err-BAD_REQUEST"><td class="k"><code>BAD_REQUEST</code></td>
+        <td class="ty"><span class="st">400</span><span class="dim">engine</span></td>
+        <td class="doc">Malformed JSON, or a missing / wrongly typed field.</td></tr><tr id="err-MISSING_BITWAVE_ACCOUNT_ID"><td class="k"><code>MISSING_BITWAVE_ACCOUNT_ID</code></td>
+        <td class="ty"><span class="st">400</span><span class="dim">engine</span></td>
+        <td class="doc">Bitwave export requested with no account id in the query and none saved in the wallet’s <code>exportTxInfo.json</code>.</td></tr><tr id="err-OBJECT_KIND_MISMATCH"><td class="k"><code>OBJECT_KIND_MISMATCH</code></td>
+        <td class="ty"><span class="st">400</span><span class="dim">engine</span></td>
+        <td class="doc">The handle exists but is a different kind (e.g. a swap quote passed to <code>sign-tx</code>).</td></tr><tr id="err-OBJECT_SESSION_MISMATCH"><td class="k"><code>OBJECT_SESSION_MISMATCH</code></td>
+        <td class="ty"><span class="st">400</span><span class="dim">engine</span></td>
+        <td class="doc">The handle belongs to a different session.</td></tr><tr id="err-OBJECT_WALLET_MISMATCH"><td class="k"><code>OBJECT_WALLET_MISMATCH</code></td>
+        <td class="ty"><span class="st">400</span><span class="dim">engine</span></td>
+        <td class="doc">The transaction handle belongs to a different wallet.</td></tr><tr id="err-INVALID_SESSION"><td class="k"><code>INVALID_SESSION</code></td>
+        <td class="ty"><span class="st">401</span><span class="dim">engine</span></td>
+        <td class="doc">Unknown <code>sessionId</code>.</td></tr><tr id="err-SESSION_EXPIRED"><td class="k"><code>SESSION_EXPIRED</code></td>
+        <td class="ty"><span class="st">401</span><span class="dim">engine</span></td>
+        <td class="doc">Auto-logged-out, or explicitly logged out.</td></tr><tr id="err-NOT_FOUND"><td class="k"><code>NOT_FOUND</code></td>
+        <td class="ty"><span class="st">404</span><span class="dim">engine</span></td>
+        <td class="doc">No route matched, or a generic missing resource.</td></tr><tr id="err-NO_LOGIN_REQUEST"><td class="k"><code>NO_LOGIN_REQUEST</code></td>
+        <td class="ty"><span class="st">404</span><span class="dim">engine</span></td>
+        <td class="doc">The lobby exists but carries no pending login request.</td></tr><tr id="err-OBJECT_NOT_FOUND"><td class="k"><code>OBJECT_NOT_FOUND</code></td>
+        <td class="ty"><span class="st">404</span><span class="dim">engine</span></td>
+        <td class="doc">No handle with that <code>objectId</code>.</td></tr><tr id="err-PENDING_LOGIN_NOT_FOUND"><td class="k"><code>PENDING_LOGIN_NOT_FOUND</code></td>
+        <td class="ty"><span class="st">404</span><span class="dim">engine</span></td>
+        <td class="doc">No pending Edge login with that <code>pendingId</code>.</td></tr><tr id="err-TOKEN_NOT_ENABLED"><td class="k"><code>TOKEN_NOT_ENABLED</code></td>
+        <td class="ty"><span class="st">404</span><span class="dim">engine</span></td>
+        <td class="doc">Tried to disable a token that was not enabled.</td></tr><tr id="err-TOKEN_NOT_FOUND"><td class="k"><code>TOKEN_NOT_FOUND</code></td>
+        <td class="ty"><span class="st">404</span><span class="dim">engine</span></td>
+        <td class="doc">Unknown token id for this wallet.</td></tr><tr id="err-USER_NOT_FOUND"><td class="k"><code>USER_NOT_FOUND</code></td>
+        <td class="ty"><span class="st">404</span><span class="dim">engine</span></td>
+        <td class="doc">No local user matches that username or login id.</td></tr><tr id="err-WALLET_NOT_FOUND"><td class="k"><code>WALLET_NOT_FOUND</code></td>
+        <td class="ty"><span class="st">404</span><span class="dim">engine</span></td>
+        <td class="doc">No wallet matches that id or prefix.</td></tr><tr id="err-METHOD_NOT_ALLOWED"><td class="k"><code>METHOD_NOT_ALLOWED</code></td>
+        <td class="ty"><span class="st">405</span><span class="dim">engine</span></td>
+        <td class="doc">The path exists but not for this HTTP method.</td></tr><tr id="err-AMBIGUOUS_WALLET_ID"><td class="k"><code>AMBIGUOUS_WALLET_ID</code></td>
+        <td class="ty"><span class="st">409</span><span class="dim">engine</span></td>
+        <td class="doc">A wallet id prefix matched more than one wallet. <span class="dim">details: <code>details.candidates</code></span></td></tr><tr id="err-OBJECT_EXPIRED"><td class="k"><code>OBJECT_EXPIRED</code></td>
+        <td class="ty"><span class="st">410</span><span class="dim">engine</span></td>
+        <td class="doc">The handle passed its 5 minute TTL and was released.</td></tr><tr id="err-PAYLOAD_TOO_LARGE"><td class="k"><code>PAYLOAD_TOO_LARGE</code></td>
+        <td class="ty"><span class="st">413</span><span class="dim">engine</span></td>
+        <td class="doc">Request body over 4 MiB.</td></tr><tr id="err-UNSUPPORTED_MEDIA_TYPE"><td class="k"><code>UNSUPPORTED_MEDIA_TYPE</code></td>
+        <td class="ty"><span class="st">415</span><span class="dim">engine</span></td>
+        <td class="doc">Body present but not <code>application/json</code>.</td></tr><tr id="err-INTERNAL_ERROR"><td class="k"><code>INTERNAL_ERROR</code></td>
+        <td class="ty"><span class="st">500</span><span class="dim">engine</span></td>
+        <td class="doc">Unmapped engine or plugin failure.</td></tr><tr id="err-ENGINE_SHUTTING_DOWN"><td class="k"><code>ENGINE_SHUTTING_DOWN</code></td>
+        <td class="ty"><span class="st">503</span><span class="dim">engine</span></td>
+        <td class="doc">Idle or explicit shutdown already in progress.</td></tr><tr id="err-USERNAME_ERROR"><td class="k"><code>USERNAME_ERROR</code></td>
+        <td class="ty"><span class="st">400</span><span class="dim">core</span></td>
+        <td class="doc">Unknown username, or an invalid recovery key.</td></tr><tr id="err-NO_AMOUNT_SPECIFIED"><td class="k"><code>NO_AMOUNT_SPECIFIED</code></td>
+        <td class="ty"><span class="st">400</span><span class="dim">core</span></td>
+        <td class="doc">Zero-amount spend.</td></tr><tr id="err-SAME_CURRENCY"><td class="k"><code>SAME_CURRENCY</code></td>
+        <td class="ty"><span class="st">400</span><span class="dim">core</span></td>
+        <td class="doc">Swap between identical currencies.</td></tr><tr id="err-PASSWORD_ERROR"><td class="k"><code>PASSWORD_ERROR</code></td>
+        <td class="ty"><span class="st">401</span><span class="dim">core</span></td>
+        <td class="doc">Wrong password, PIN, or recovery answers. <span class="dim">details: <code>details.wait</code> (seconds) when rate-limited</span></td></tr><tr id="err-OTP_REQUIRED"><td class="k"><code>OTP_REQUIRED</code></td>
+        <td class="ty"><span class="st">401</span><span class="dim">core</span></td>
+        <td class="doc">Missing or wrong 2FA token. <span class="dim">details: <code>reason</code> (<code>ip</code>|<code>otp</code>), <code>loginId</code>, <code>resetToken</code>, <code>resetDate</code>, <code>voucherId</code>, <code>voucherAuth</code>, <code>voucherActivates</code></span></td></tr><tr id="err-CHALLENGE_REQUIRED"><td class="k"><code>CHALLENGE_REQUIRED</code></td>
+        <td class="ty"><span class="st">403</span><span class="dim">core</span></td>
+        <td class="doc">The login server wants a CAPTCHA. Retry with <code>challengeId</code>. <span class="dim">details: <code>challengeId</code>, <code>challengeUri</code></span></td></tr><tr id="err-PIN_DISABLED"><td class="k"><code>PIN_DISABLED</code></td>
+        <td class="ty"><span class="st">403</span><span class="dim">core</span></td>
+        <td class="doc">PIN login is not enabled on this device.</td></tr><tr id="err-SWAP_PERMISSION"><td class="k"><code>SWAP_PERMISSION</code></td>
+        <td class="ty"><span class="st">403</span><span class="dim">core</span></td>
+        <td class="doc">The swap plugin refused the request. <span class="dim">details: <code>pluginId</code>, <code>reason</code>: <code>geoRestriction</code> | <code>noVerification</code> | <code>needsActivation</code></span></td></tr><tr id="err-INSUFFICIENT_FUNDS"><td class="k"><code>INSUFFICIENT_FUNDS</code></td>
+        <td class="ty"><span class="st">422</span><span class="dim">core</span></td>
+        <td class="doc">Not enough balance to cover amount plus fee. <span class="dim">details: <code>tokenId</code>, <code>networkFee</code></span></td></tr><tr id="err-DUST_SPEND"><td class="k"><code>DUST_SPEND</code></td>
+        <td class="ty"><span class="st">422</span><span class="dim">core</span></td>
+        <td class="doc">Amount below the network dust threshold.</td></tr><tr id="err-PENDING_FUNDS"><td class="k"><code>PENDING_FUNDS</code></td>
+        <td class="ty"><span class="st">422</span><span class="dim">core</span></td>
+        <td class="doc">Balance exists but is unconfirmed.</td></tr><tr id="err-SPEND_TO_SELF"><td class="k"><code>SPEND_TO_SELF</code></td>
+        <td class="ty"><span class="st">422</span><span class="dim">core</span></td>
+        <td class="doc">Destination address belongs to the source wallet.</td></tr><tr id="err-SWAP_ABOVE_LIMIT"><td class="k"><code>SWAP_ABOVE_LIMIT</code></td>
+        <td class="ty"><span class="st">422</span><span class="dim">core</span></td>
+        <td class="doc">Amount exceeds the plugin maximum. <span class="dim">details: <code>swapPluginId</code>, <code>nativeMax</code>, <code>direction</code></span></td></tr><tr id="err-SWAP_BELOW_LIMIT"><td class="k"><code>SWAP_BELOW_LIMIT</code></td>
+        <td class="ty"><span class="st">422</span><span class="dim">core</span></td>
+        <td class="doc">Amount below the plugin minimum. <span class="dim">details: <code>swapPluginId</code>, <code>nativeMin</code>, <code>direction</code></span></td></tr><tr id="err-SWAP_CURRENCY"><td class="k"><code>SWAP_CURRENCY</code></td>
+        <td class="ty"><span class="st">422</span><span class="dim">core</span></td>
+        <td class="doc">The plugin does not support that pair. <span class="dim">details: <code>pluginId</code>, <code>fromTokenId</code>, <code>toTokenId</code></span></td></tr><tr id="err-SWAP_ADDRESS"><td class="k"><code>SWAP_ADDRESS</code></td>
+        <td class="ty"><span class="st">422</span><span class="dim">core</span></td>
+        <td class="doc">Address unusable for this swap. <span class="dim">details: <code>swapPluginId</code>, <code>reason</code>: <code>mustMatch</code> | <code>mustBeActivated</code></span></td></tr><tr id="err-OBSOLETE_API"><td class="k"><code>OBSOLETE_API</code></td>
+        <td class="ty"><span class="st">426</span><span class="dim">core</span></td>
+        <td class="doc">The login server rejected this client version.</td></tr><tr id="err-NETWORK_ERROR"><td class="k"><code>NETWORK_ERROR</code></td>
+        <td class="ty"><span class="st">503</span><span class="dim">core</span></td>
+        <td class="doc">Could not reach an Edge server.</td></tr></tbody></table>
+<h2 id="exit-codes">CLI exit codes</h2>
+<table class="fields"><tbody><tr><td class="k"><code>0</code></td><td class="ty"><span class="dim">OK</span></td><td class="doc">Success.</td></tr><tr><td class="k"><code>1</code></td><td class="ty"><span class="dim">GENERIC</span></td><td class="doc">Any failure with no more specific mapping.</td></tr><tr><td class="k"><code>2</code></td><td class="ty"><span class="dim">USAGE</span></td><td class="doc">Bad argv: unknown flag, missing value, extra positional.</td></tr><tr><td class="k"><code>3</code></td><td class="ty"><span class="dim">AUTH</span></td><td class="doc"><code>INVALID_SESSION</code>, <code>SESSION_EXPIRED</code>, <code>PASSWORD_ERROR</code>, <code>OTP_REQUIRED</code>, <code>CHALLENGE_REQUIRED</code>, <code>PIN_DISABLED</code>.</td></tr><tr><td class="k"><code>4</code></td><td class="ty"><span class="dim">NOT_FOUND</span></td><td class="doc"><code>NOT_FOUND</code>, <code>WALLET_NOT_FOUND</code>, <code>TOKEN_NOT_FOUND</code>.</td></tr><tr><td class="k"><code>5</code></td><td class="ty"><span class="dim">VALIDATION</span></td><td class="doc"><code>BAD_REQUEST</code>, <code>INSUFFICIENT_FUNDS</code>, <code>DUST_SPEND</code>, <code>PENDING_FUNDS</code>, <code>SPEND_TO_SELF</code>, <code>NO_AMOUNT_SPECIFIED</code>, <code>AMBIGUOUS_WALLET_ID</code>, <code>USERNAME_ERROR</code>.</td></tr><tr><td class="k"><code>6</code></td><td class="ty"><span class="dim">NETWORK</span></td><td class="doc"><code>NETWORK_ERROR</code>, or any response with HTTP status <code>503</code>.</td></tr><tr><td class="k"><code>7</code></td><td class="ty"><span class="dim">ENGINE</span></td><td class="doc">Could not connect to or spawn the engine.</td></tr></tbody></table>
+</main>
+</div>
+<script>
+const q = document.getElementById('q')
+const links = [...document.querySelectorAll('nav a.e[data-s]')]
+q.addEventListener('input', () => {
+  const v = q.value.trim().toLowerCase()
+  for (const a of links) a.classList.toggle('hidden', v !== '' && !a.dataset.s.includes(v))
+  for (const g of document.querySelectorAll('nav .g')) {
+    let el = g.nextElementSibling, any = false
+    while (el != null && el.classList.contains('e')) {
+      if (!el.classList.contains('hidden')) any = true
+      el = el.nextElementSibling
+    }
+    g.classList.toggle('hidden', !any)
+  }
+  // A section heading outlives its groups unless it is hidden too.
+  for (const sec of document.querySelectorAll('nav .s')) {
+    let el = sec.nextElementSibling, any = false
+    while (el != null && !el.classList.contains('s')) {
+      if (el.classList.contains('e') && !el.classList.contains('hidden')) any = true
+      el = el.nextElementSibling
+    }
+    sec.classList.toggle('hidden', !any)
+  }
+})
+</script>
+</body></html>
\ No newline at end of file
diff --git a/docs/api/dist/openapi.json b/docs/api/dist/openapi.json
new file mode 100644
index 00000000000..4b2b01a4b13
--- /dev/null
+++ b/docs/api/dist/openapi.json
@@ -0,0 +1,9909 @@
+{
+  "openapi": "3.1.0",
+  "info": {
+    "title": "Edge CLI",
+    "version": "1.0.0",
+    "description": "The `edge-cli` command line and the `edge-engine` JSON REST API, generated from the route declarations in `src/cli/engine/routes/`."
+  },
+  "servers": [
+    {
+      "url": "http://localhost",
+      "description": "Unix socket at ~/.edge-cli/run/<profile>/engine.sock"
+    },
+    {
+      "url": "http://127.0.0.1:9008",
+      "description": "Loopback TCP, when started with --tcp=9008"
+    }
+  ],
+  "tags": [
+    {
+      "name": "Lifecycle",
+      "description": "Lifecycle and configuration of the `edge-engine` daemon. None of these have an `edge-core-js` equivalent — they describe the daemon itself — and none need a session."
+    },
+    {
+      "name": "Device and usernames",
+      "description": "Calls on the shared `EdgeContext`: local device state and login-server queries that do not need a session."
+    },
+    {
+      "name": "Login methods",
+      "description": "Every successful login returns a [Session](#schema-Session) and registers it in the engine, so later calls need only the `sessionId`. The CLI writes that id to `session.json` automatically."
+    },
+    {
+      "name": "Session",
+      "description": "Calls on a logged-in `EdgeAccount`, addressed by `sessionId`. All of these can also return `401 INVALID_SESSION` or `401 SESSION_EXPIRED`."
+    },
+    {
+      "name": "Local settings",
+      "description": "Device-local account settings, stored outside the synced repos."
+    },
+    {
+      "name": "Credentials",
+      "description": "Password, PIN, username and recovery changes on a logged-in account."
+    },
+    {
+      "name": "Two-factor authentication",
+      "description": "OTP state and the reset flow a user falls back on after losing their authenticator."
+    },
+    {
+      "name": "Vouchers",
+      "description": "When 2FA blocks a login, the login server issues a voucher an already-trusted device can approve or reject."
+    },
+    {
+      "name": "Approving a login",
+      "description": "The other side of `request-edge-login`: a logged-in account inspecting and approving a login somebody scanned."
+    },
+    {
+      "name": "Keys",
+      "description": "Raw key infrastructure beneath the wallet API. Several of these return private key material, and the engine has no transport auth — treat any process that can reach the socket as fully trusted."
+    },
+    {
+      "name": "Wallet state",
+      "description": "Account-level wallet listing and creation, then per-wallet calls. A `{walletId}` segment accepts a unique prefix, so those routes can also return `404 WALLET_NOT_FOUND` or `409 AMBIGUOUS_WALLET_ID`."
+    },
+    {
+      "name": "Tokens",
+      "description": "Which tokens a wallet tracks. Enabled tokens are the ones it syncs balances for; detected ones were seen on-chain but are not yet enabled."
+    },
+    {
+      "name": "Transactions",
+      "description": "Reading transaction history, exporting it, and editing its metadata."
+    },
+    {
+      "name": "Object handles",
+      "description": "A core value with methods on it — a staged transaction, a swap quote, a pending login — cannot cross JSON, so the engine keeps it and hands back an id. These read and release any of them."
+    },
+    {
+      "name": "Spending",
+      "description": "Two ways to send funds. `spend` does the whole thing in one call; the staged workflow — `make-spend`, `sign-tx`, `broadcast-tx`, `save-tx` — hands back an object handle at each step so fees can be inspected before committing."
+    },
+    {
+      "name": "Swap quotes",
+      "description": "Cross-asset exchange. Quotes are live objects held server-side under a `swap_` handle, so approving one means naming its `objectId` rather than re-uploading the quote."
+    },
+    {
+      "name": "URIs",
+      "description": "Parsing and building BIP21-style payment URIs through the wallet’s own plugin, so chain-specific quirks are handled for you."
+    },
+    {
+      "name": "Exchange rates",
+      "description": "Historical and current rates through the same batching queue the GUI uses. No session required."
+    },
+    {
+      "name": "Data store",
+      "description": "The account’s synced key-value store, where plugins keep their own state. One route per `EdgeDataStore` method."
+    },
+    {
+      "name": "Admin",
+      "description": "**Debugging only — not for production apps.** These reach into `context.$internalStuff`, the private surface of `edge-core-js`, and can corrupt an account’s synced repos. They take no `sessionId`: they act on the context, not on a logged-in account."
+    },
+    {
+      "name": "Event stream",
+      "description": "A Server-Sent Events feed of engine activity, served outside the router because the response never ends."
+    }
+  ],
+  "paths": {
+    "/engine/status": {
+      "get": {
+        "operationId": "engineStatus",
+        "summary": "Engine liveness and summary.",
+        "description": "**Core call:** _none — Engine lifecycle; the daemon is not part of the core API._\n\n**Command line**\n\n```\nengine-status\n```\n\nThe readiness probe the client polls after auto-spawning the engine.",
+        "tags": [
+          "Lifecycle"
+        ],
+        "x-cli": {
+          "command": "engine-status",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": null,
+        "x-core-note": "Engine lifecycle; the daemon is not part of the core API.",
+        "x-source": "src/cli/engine/routes/status.ts",
+        "parameters": [],
+        "responses": {
+          "200": {
+            "description": "`idleShutdownAt` is null while a session or a subscription holds the engine open, and `tcpPort` is null unless started with `--tcp`.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "pid": {
+                      "type": "number",
+                      "description": "The daemon process, for `kill` when it will not stop."
+                    },
+                    "apiVersion": {
+                      "type": "string",
+                      "description": "The API this engine speaks. A client refusing to talk to an older engine checks this."
+                    },
+                    "uptimeSeconds": {
+                      "type": "number",
+                      "description": "How long the daemon has been running."
+                    },
+                    "sessionCount": {
+                      "type": "number",
+                      "description": "Logged-in accounts held open right now."
+                    },
+                    "testMode": {
+                      "type": "boolean",
+                      "description": "True when pointed at the tester fleet."
+                    },
+                    "idleShutdownAt": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "When the engine will exit for want of work. Null while a session or a subscription is holding it open, and null when the timeout is disabled."
+                    },
+                    "tcpPort": {
+                      "anyOf": [
+                        {
+                          "type": "number"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "The loopback port, null unless started with `--tcp`."
+                    },
+                    "socketPath": {
+                      "type": "string",
+                      "description": "Unix socket the CLI connects to."
+                    },
+                    "locale": {
+                      "type": "string",
+                      "description": "Language tag the engine resolved at boot."
+                    },
+                    "decimalSeparator": {
+                      "type": "string",
+                      "description": "Decimal mark for that locale."
+                    },
+                    "groupingSeparator": {
+                      "type": "string",
+                      "description": "Thousands mark for that locale."
+                    }
+                  },
+                  "required": [
+                    "pid",
+                    "apiVersion",
+                    "uptimeSeconds",
+                    "sessionCount",
+                    "testMode",
+                    "idleShutdownAt",
+                    "tcpPort",
+                    "socketPath",
+                    "locale",
+                    "decimalSeparator",
+                    "groupingSeparator"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "ENGINE_SHUTTING_DOWN",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/engine/config": {
+      "get": {
+        "operationId": "engineConfig",
+        "summary": "Configured context options.",
+        "description": "**Core call:** _none — Reflects the EdgeContextOptions the engine supplied at startup._\n\n**Command line**\n\n```\nengine-config\n```\n\nWhat the engine passed to `makeEdgeContext`. Contains no secrets. Use it to assert tester hosts before a test run.",
+        "tags": [
+          "Lifecycle"
+        ],
+        "x-cli": {
+          "command": "engine-config",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": null,
+        "x-core-note": "Reflects the EdgeContextOptions the engine supplied at startup.",
+        "x-source": "src/cli/engine/routes/status.ts",
+        "parameters": [],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "appId": {
+                      "type": "string",
+                      "description": "Application ID the engine was started with."
+                    },
+                    "testMode": {
+                      "type": "boolean",
+                      "description": "True when the engine is pointed at the tester fleet."
+                    },
+                    "directory": {
+                      "type": "string",
+                      "description": "Working directory holding the core data."
+                    },
+                    "servers": {
+                      "anyOf": [
+                        {
+                          "description": "{ [keys: string]: string"
+                        },
+                        {
+                          "description": "string[]; }"
+                        }
+                      ],
+                      "description": "The URLs this engine talks to, keyed by role. `syncServer` is a list, since core rotates across the sync fleet."
+                    },
+                    "plugins": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "description": "Plugin IDs the engine loaded, sorted."
+                    }
+                  },
+                  "required": [
+                    "appId",
+                    "testMode",
+                    "directory",
+                    "servers",
+                    "plugins"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/engine/stop": {
+      "post": {
+        "operationId": "engineStop",
+        "summary": "Stop the engine.",
+        "description": "**Core call:** _none — Engine lifecycle. Internally calls `context.close()`._\n\n**Command line**\n\n```\nengine-stop\n```\n\nLogs out every session, closes the context, unlinks the socket and run-file, then exits. The engine answers before it starts tearing down, so a response is not proof the process is gone.",
+        "tags": [
+          "Lifecycle"
+        ],
+        "x-cli": {
+          "command": "engine-stop",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": null,
+        "x-core-note": "Engine lifecycle. Internally calls `context.close()`.",
+        "x-source": "src/cli/engine/routes/status.ts",
+        "parameters": [],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "ok": {
+                      "type": "boolean",
+                      "description": "Always true; a failure arrives as an error envelope."
+                    }
+                  },
+                  "required": [
+                    "ok"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/local-users": {
+      "get": {
+        "operationId": "localUsers",
+        "summary": "List local users on this device.",
+        "description": "**Core call:** `context.localUsers`\n\n**Command line**\n\n```\nlocal-users\n```\n\n",
+        "tags": [
+          "Device and usernames"
+        ],
+        "x-cli": {
+          "command": "local-users",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "context.localUsers",
+        "x-source": "src/cli/engine/routes/context.ts",
+        "parameters": [],
+        "responses": {
+          "200": {
+            "description": "Everything `context.localUsers` reports, including which login methods each user has enabled on this device.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "localUsers": {
+                      "type": "array",
+                      "items": {},
+                      "description": "`EdgeUserInfo[]`: one entry per account cached on this device."
+                    }
+                  },
+                  "required": [
+                    "localUsers"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/forget-account": {
+      "post": {
+        "operationId": "forgetAccount",
+        "summary": "Forget an account on this device.",
+        "description": "**Core call:** `context.forgetAccount`\n\n**Command line**\n\n```\nforget-account --root-login-id=<rootLoginId>\n```\n\nRemoves locally cached credentials. The remote account is untouched.",
+        "tags": [
+          "Device and usernames"
+        ],
+        "x-cli": {
+          "command": "forget-account",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "context.forgetAccount",
+        "x-source": "src/cli/engine/routes/context.ts",
+        "parameters": [],
+        "responses": {
+          "204": {
+            "description": "No content."
+          },
+          "default": {
+            "description": "USER_NOT_FOUND, BAD_REQUEST",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "rootLoginId": {
+                    "type": "string",
+                    "description": "Core takes a `rootLoginId`. A username is also accepted and resolved against `localUsers` first, so callers need not hash it."
+                  }
+                },
+                "required": [
+                  "rootLoginId"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/username-available": {
+      "get": {
+        "operationId": "usernameAvailable",
+        "summary": "Check whether a username is free.",
+        "description": "**Core call:** `context.usernameAvailable`\n\n**Command line**\n\n```\nusername-available --username=<username> [--challenge-id=<challengeId>]\n```\n\n",
+        "tags": [
+          "Device and usernames"
+        ],
+        "x-cli": {
+          "command": "username-available",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "context.usernameAvailable",
+        "x-source": "src/cli/engine/routes/context.ts",
+        "parameters": [
+          {
+            "name": "username",
+            "in": "query",
+            "required": true,
+            "description": "The name to check.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "challengeId",
+            "in": "query",
+            "required": false,
+            "description": "Supply after solving a CAPTCHA to retry the same check.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "username": {
+                      "type": "string",
+                      "description": "The name that was checked, echoed back."
+                    },
+                    "available": {
+                      "type": "boolean",
+                      "description": "True when nobody holds this name. It is not reserved by asking."
+                    }
+                  },
+                  "required": [
+                    "username",
+                    "available"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "USERNAME_ERROR, CHALLENGE_REQUIRED, NETWORK_ERROR",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/fix-username": {
+      "get": {
+        "operationId": "fixUsername",
+        "summary": "Normalize a username.",
+        "description": "**Core call:** `context.fixUsername`\n\n**Command line**\n\n```\nfix-username --username=<username>\n```\n\nApplies the same rules the login server does, so a caller can show the user what their name will actually be before creating an account.",
+        "tags": [
+          "Device and usernames"
+        ],
+        "x-cli": {
+          "command": "fix-username",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "context.fixUsername",
+        "x-source": "src/cli/engine/routes/context.ts",
+        "parameters": [
+          {
+            "name": "username",
+            "in": "query",
+            "required": true,
+            "description": "The name to normalize.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "username": {
+                      "type": "string",
+                      "description": "The normalized value. The input is not echoed."
+                    }
+                  },
+                  "required": [
+                    "username"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/check-password-rules": {
+      "get": {
+        "operationId": "checkPasswordRules",
+        "summary": "Score a candidate password.",
+        "description": "**Core call:** `context.checkPasswordRules`\n\n**Command line**\n\n```\ncheck-password-rules --password=<password>\n```\n\n",
+        "tags": [
+          "Device and usernames"
+        ],
+        "x-cli": {
+          "command": "check-password-rules",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "context.checkPasswordRules",
+        "x-source": "src/cli/engine/routes/context.ts",
+        "parameters": [
+          {
+            "name": "password",
+            "in": "query",
+            "required": true,
+            "description": "The candidate password to score.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "`EdgePasswordRules` from core: passed, tooShort, noNumber, noLowerCase, noUpperCase, secondsToCrack.",
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            }
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/fetch-login-messages": {
+      "get": {
+        "operationId": "fetchLoginMessages",
+        "summary": "Fetch login-server messages for every local user.",
+        "description": "**Core call:** `context.fetchLoginMessages`\n\n**Command line**\n\n```\nfetch-login-messages\n```\n\n",
+        "tags": [
+          "Device and usernames"
+        ],
+        "x-cli": {
+          "command": "fetch-login-messages",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "context.fetchLoginMessages",
+        "x-source": "src/cli/engine/routes/context.ts",
+        "parameters": [],
+        "responses": {
+          "200": {
+            "description": "`EdgeLoginMessages` from core, keyed by loginId; each value carries otpResetPending and pendingVouchers.",
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            }
+          },
+          "default": {
+            "description": "NETWORK_ERROR",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/request-otp-reset": {
+      "post": {
+        "operationId": "requestOtpReset",
+        "summary": "Request a 2FA reset.",
+        "description": "**Core call:** `context.requestOtpReset`\n\n**Command line**\n\n```\nrequest-otp-reset --username=<username> --otp-reset-token=<otpResetToken>\n```\n\nStarts the timed reset a user falls back on after losing their authenticator.",
+        "tags": [
+          "Device and usernames"
+        ],
+        "x-cli": {
+          "command": "request-otp-reset",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "context.requestOtpReset",
+        "x-source": "src/cli/engine/routes/context.ts",
+        "parameters": [],
+        "responses": {
+          "200": {
+            "description": "When the reset completes if nobody cancels it.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "resetDate": {
+                      "type": "string",
+                      "description": "When 2FA will actually come off. The login server enforces a waiting period so the real owner has time to cancel."
+                    }
+                  },
+                  "required": [
+                    "resetDate"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "USERNAME_ERROR, BAD_REQUEST, NETWORK_ERROR",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "username": {
+                    "type": "string",
+                    "description": "Whose 2FA to reset."
+                  },
+                  "otpResetToken": {
+                    "type": "string",
+                    "description": "From `details.resetToken` on an `OTP_REQUIRED` error."
+                  }
+                },
+                "required": [
+                  "username",
+                  "otpResetToken"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/fetch-recovery-questions": {
+      "get": {
+        "operationId": "fetchRecoveryQuestions",
+        "summary": "Fetch a user’s recovery questions.",
+        "description": "**Core call:** `context.fetchRecovery2Questions`\n\n**Command line**\n\n```\nfetch-recovery-questions --recovery-key=<recoveryKey> --username=<username>\n```\n\n",
+        "tags": [
+          "Device and usernames"
+        ],
+        "x-cli": {
+          "command": "fetch-recovery-questions",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "context.fetchRecovery2Questions",
+        "x-core-note": "Our surface drops the `2` from the path, command and `recoveryKey` parameter; a future Recovery1 would be suffixed `V1`.",
+        "x-source": "src/cli/engine/routes/context.ts",
+        "parameters": [
+          {
+            "name": "recoveryKey",
+            "in": "query",
+            "required": true,
+            "description": "From `change-recovery`, stored by the user out of band.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "username",
+            "in": "query",
+            "required": true,
+            "description": "Whose questions to fetch.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "questions": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "description": "The questions in the order `login-with-recovery` expects the answers."
+                    }
+                  },
+                  "required": [
+                    "questions"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "USERNAME_ERROR, NETWORK_ERROR",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/fetch-challenge": {
+      "post": {
+        "operationId": "fetchChallenge",
+        "summary": "Pre-fetch a CAPTCHA challenge.",
+        "description": "**Core call:** `context.fetchChallenge`\n\n**Command line**\n\n```\nfetch-challenge\n```\n\nLets a client solve a challenge before it hits `403 CHALLENGE_REQUIRED` mid-flow.",
+        "tags": [
+          "Device and usernames"
+        ],
+        "x-cli": {
+          "command": "fetch-challenge",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "context.fetchChallenge",
+        "x-source": "src/cli/engine/routes/context.ts",
+        "parameters": [],
+        "responses": {
+          "200": {
+            "description": "`challengeUri` is absent when the server considers the challenge already satisfied.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "challengeId": {
+                      "type": "string",
+                      "description": "Pass to the call that demanded a challenge once the user has solved it."
+                    },
+                    "challengeUri": {
+                      "type": "string",
+                      "description": "Where to send the user to solve the CAPTCHA. Absent when the server issued a challenge that needs no interaction."
+                    }
+                  },
+                  "required": [
+                    "challengeId"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "NETWORK_ERROR",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/currency-configs": {
+      "get": {
+        "operationId": "currencyConfigs",
+        "summary": "List plugin ids usable for wallet creation.",
+        "description": "**Core call:** _none — Engine view of the enabled plugin set; core exposes `account.currencyConfig` per plugin instead._\n\n**Command line**\n\n```\ncurrency-configs\n```\n\nCurrency and accountbased plugins only — swap plugins are excluded.",
+        "tags": [
+          "Device and usernames"
+        ],
+        "x-cli": {
+          "command": "currency-configs",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": null,
+        "x-core-note": "Engine view of the enabled plugin set; core exposes `account.currencyConfig` per plugin instead.",
+        "x-source": "src/cli/engine/routes/context.ts",
+        "parameters": [],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "pluginIds": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "description": "Currency plugins this engine loaded."
+                    }
+                  },
+                  "required": [
+                    "pluginIds"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/login-with-password": {
+      "post": {
+        "operationId": "loginWithPassword",
+        "summary": "Log in with a password.",
+        "description": "**Core call:** `context.loginWithPassword`\n\n**Command line**\n\n```\nlogin-with-password [--otp=<otp>] [--otp-key=<otpKey>] [--challenge-id=<challengeId>] --username=<username> --password=<password>\n```\n\n",
+        "tags": [
+          "Login methods"
+        ],
+        "x-cli": {
+          "command": "login-with-password",
+          "flags": [],
+          "extra": [],
+          "custom": true,
+          "preset": {}
+        },
+        "x-core-call": "context.loginWithPassword",
+        "x-source": "src/cli/engine/routes/login.ts",
+        "parameters": [],
+        "responses": {
+          "200": {
+            "description": "A session with `loginMethod: \"password\"`.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "sessionId": {
+                      "type": "string",
+                      "description": "Identifies this login. Every account-scoped call carries it, and the CLI stores the most recent one so commands can omit it."
+                    },
+                    "username": {
+                      "type": "string",
+                      "description": "Absent for a light account, which has no username."
+                    },
+                    "rootLoginId": {
+                      "type": "string",
+                      "description": "The account root, stable across appIds. Two sessions sharing it are the same account."
+                    },
+                    "loginMethod": {
+                      "anyOf": [
+                        {
+                          "description": "\"password\""
+                        },
+                        {
+                          "description": "\"pin\""
+                        },
+                        {
+                          "description": "\"key\""
+                        },
+                        {
+                          "description": "\"recovery\""
+                        },
+                        {
+                          "description": "\"edge\""
+                        },
+                        {
+                          "description": "\"create\""
+                        }
+                      ],
+                      "description": "How this session was established."
+                    },
+                    "autoLogoutSeconds": {
+                      "type": "number",
+                      "description": "Idle time before the engine logs the account out. 0 disables it."
+                    },
+                    "expiresAt": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "When auto-logout will fire, or null when it is disabled."
+                    },
+                    "lastActivityAt": {
+                      "type": "string",
+                      "description": "Last call on this session, which is what auto-logout measures from."
+                    },
+                    "createdAt": {
+                      "type": "string",
+                      "description": "When the login completed."
+                    }
+                  },
+                  "required": [
+                    "sessionId",
+                    "rootLoginId",
+                    "loginMethod",
+                    "autoLogoutSeconds",
+                    "expiresAt",
+                    "lastActivityAt",
+                    "createdAt"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "PASSWORD_ERROR, USERNAME_ERROR, OTP_REQUIRED, CHALLENGE_REQUIRED, NETWORK_ERROR",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "otp": {
+                    "type": "string",
+                    "description": "A current 2FA code."
+                  },
+                  "otpKey": {
+                    "type": "string",
+                    "description": "The 2FA secret itself, instead of a code."
+                  },
+                  "challengeId": {
+                    "type": "string",
+                    "description": "Supply after solving a CAPTCHA to retry the same request."
+                  },
+                  "username": {
+                    "type": "string",
+                    "description": "The account name."
+                  },
+                  "password": {
+                    "type": "string",
+                    "description": "The account password."
+                  }
+                },
+                "required": [
+                  "username",
+                  "password"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/login-with-pin": {
+      "post": {
+        "operationId": "loginWithPin",
+        "summary": "Log in with a device PIN.",
+        "description": "**Core call:** `context.loginWithPIN`\n\n**Command line**\n\n```\nlogin-with-pin [--otp=<otp>] [--otp-key=<otpKey>] [--challenge-id=<challengeId>] --username-or-login-id=<usernameOrLoginId> --pin=<pin> [--use-login-id]\n```\n\nOnly works on a device that has already saved a PIN for the account.",
+        "tags": [
+          "Login methods"
+        ],
+        "x-cli": {
+          "command": "login-with-pin",
+          "flags": [],
+          "extra": [],
+          "custom": true,
+          "preset": {}
+        },
+        "x-core-call": "context.loginWithPIN",
+        "x-source": "src/cli/engine/routes/login.ts",
+        "parameters": [],
+        "responses": {
+          "200": {
+            "description": "A session with `loginMethod: \"pin\"`.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "sessionId": {
+                      "type": "string",
+                      "description": "Identifies this login. Every account-scoped call carries it, and the CLI stores the most recent one so commands can omit it."
+                    },
+                    "username": {
+                      "type": "string",
+                      "description": "Absent for a light account, which has no username."
+                    },
+                    "rootLoginId": {
+                      "type": "string",
+                      "description": "The account root, stable across appIds. Two sessions sharing it are the same account."
+                    },
+                    "loginMethod": {
+                      "anyOf": [
+                        {
+                          "description": "\"password\""
+                        },
+                        {
+                          "description": "\"pin\""
+                        },
+                        {
+                          "description": "\"key\""
+                        },
+                        {
+                          "description": "\"recovery\""
+                        },
+                        {
+                          "description": "\"edge\""
+                        },
+                        {
+                          "description": "\"create\""
+                        }
+                      ],
+                      "description": "How this session was established."
+                    },
+                    "autoLogoutSeconds": {
+                      "type": "number",
+                      "description": "Idle time before the engine logs the account out. 0 disables it."
+                    },
+                    "expiresAt": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "When auto-logout will fire, or null when it is disabled."
+                    },
+                    "lastActivityAt": {
+                      "type": "string",
+                      "description": "Last call on this session, which is what auto-logout measures from."
+                    },
+                    "createdAt": {
+                      "type": "string",
+                      "description": "When the login completed."
+                    }
+                  },
+                  "required": [
+                    "sessionId",
+                    "rootLoginId",
+                    "loginMethod",
+                    "autoLogoutSeconds",
+                    "expiresAt",
+                    "lastActivityAt",
+                    "createdAt"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "PASSWORD_ERROR, PIN_DISABLED, USERNAME_ERROR, BAD_REQUEST, NETWORK_ERROR",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "otp": {
+                    "type": "string",
+                    "description": "A current 2FA code."
+                  },
+                  "otpKey": {
+                    "type": "string",
+                    "description": "The 2FA secret itself, instead of a code."
+                  },
+                  "challengeId": {
+                    "type": "string",
+                    "description": "Supply after solving a CAPTCHA to retry the same request."
+                  },
+                  "usernameOrLoginId": {
+                    "type": "string",
+                    "description": "A username, or a login id."
+                  },
+                  "pin": {
+                    "type": "string",
+                    "description": "The device PIN."
+                  },
+                  "useLoginId": {
+                    "type": "boolean",
+                    "description": "Treat the value as a login id."
+                  }
+                },
+                "required": [
+                  "usernameOrLoginId",
+                  "pin"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/login-with-key": {
+      "post": {
+        "operationId": "loginWithKey",
+        "summary": "Log in with an account login key.",
+        "description": "**Core call:** `context.loginWithKey`\n\n**Command line**\n\n```\nlogin-with-key [--otp=<otp>] [--otp-key=<otpKey>] [--challenge-id=<challengeId>] --username-or-login-id=<usernameOrLoginId> --login-key=<loginKey> [--use-login-id]\n```\n\nThe key comes from `get-login-key` on an already-authenticated session.",
+        "tags": [
+          "Login methods"
+        ],
+        "x-cli": {
+          "command": "login-with-key",
+          "flags": [],
+          "extra": [],
+          "custom": true,
+          "preset": {}
+        },
+        "x-core-call": "context.loginWithKey",
+        "x-source": "src/cli/engine/routes/login.ts",
+        "parameters": [],
+        "responses": {
+          "200": {
+            "description": "A session with `loginMethod: \"key\"`.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "sessionId": {
+                      "type": "string",
+                      "description": "Identifies this login. Every account-scoped call carries it, and the CLI stores the most recent one so commands can omit it."
+                    },
+                    "username": {
+                      "type": "string",
+                      "description": "Absent for a light account, which has no username."
+                    },
+                    "rootLoginId": {
+                      "type": "string",
+                      "description": "The account root, stable across appIds. Two sessions sharing it are the same account."
+                    },
+                    "loginMethod": {
+                      "anyOf": [
+                        {
+                          "description": "\"password\""
+                        },
+                        {
+                          "description": "\"pin\""
+                        },
+                        {
+                          "description": "\"key\""
+                        },
+                        {
+                          "description": "\"recovery\""
+                        },
+                        {
+                          "description": "\"edge\""
+                        },
+                        {
+                          "description": "\"create\""
+                        }
+                      ],
+                      "description": "How this session was established."
+                    },
+                    "autoLogoutSeconds": {
+                      "type": "number",
+                      "description": "Idle time before the engine logs the account out. 0 disables it."
+                    },
+                    "expiresAt": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "When auto-logout will fire, or null when it is disabled."
+                    },
+                    "lastActivityAt": {
+                      "type": "string",
+                      "description": "Last call on this session, which is what auto-logout measures from."
+                    },
+                    "createdAt": {
+                      "type": "string",
+                      "description": "When the login completed."
+                    }
+                  },
+                  "required": [
+                    "sessionId",
+                    "rootLoginId",
+                    "loginMethod",
+                    "autoLogoutSeconds",
+                    "expiresAt",
+                    "lastActivityAt",
+                    "createdAt"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "PASSWORD_ERROR, USERNAME_ERROR, NETWORK_ERROR",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "otp": {
+                    "type": "string",
+                    "description": "A current 2FA code."
+                  },
+                  "otpKey": {
+                    "type": "string",
+                    "description": "The 2FA secret itself, instead of a code."
+                  },
+                  "challengeId": {
+                    "type": "string",
+                    "description": "Supply after solving a CAPTCHA to retry the same request."
+                  },
+                  "usernameOrLoginId": {
+                    "type": "string",
+                    "description": "A username, or a login id."
+                  },
+                  "loginKey": {
+                    "type": "string",
+                    "description": "From `get-login-key`."
+                  },
+                  "useLoginId": {
+                    "type": "boolean",
+                    "description": "Treat the value as a login id."
+                  }
+                },
+                "required": [
+                  "usernameOrLoginId",
+                  "loginKey"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/login-with-recovery": {
+      "post": {
+        "operationId": "loginWithRecovery",
+        "summary": "Log in with recovery answers.",
+        "description": "**Core call:** `context.loginWithRecovery2`\n\n**Command line**\n\n```\nlogin-with-recovery [--otp=<otp>] [--otp-key=<otpKey>] [--challenge-id=<challengeId>] --recovery-key=<recoveryKey> --username=<username> --answer=<answers> …\n```\n\nNeeds both the recovery key and the answers; neither works alone.",
+        "tags": [
+          "Login methods"
+        ],
+        "x-cli": {
+          "command": "login-with-recovery",
+          "flags": [
+            {
+              "name": "answer",
+              "maps": "answers",
+              "repeat": true
+            }
+          ],
+          "extra": [],
+          "custom": true,
+          "preset": {}
+        },
+        "x-core-call": "context.loginWithRecovery2",
+        "x-core-note": "Our surface drops the `2` from core's recovery2 naming, and calls the key `recoveryKey` to match what `change-recovery` returns.",
+        "x-source": "src/cli/engine/routes/login.ts",
+        "parameters": [],
+        "responses": {
+          "200": {
+            "description": "A session with `loginMethod: \"recovery\"`.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "sessionId": {
+                      "type": "string",
+                      "description": "Identifies this login. Every account-scoped call carries it, and the CLI stores the most recent one so commands can omit it."
+                    },
+                    "username": {
+                      "type": "string",
+                      "description": "Absent for a light account, which has no username."
+                    },
+                    "rootLoginId": {
+                      "type": "string",
+                      "description": "The account root, stable across appIds. Two sessions sharing it are the same account."
+                    },
+                    "loginMethod": {
+                      "anyOf": [
+                        {
+                          "description": "\"password\""
+                        },
+                        {
+                          "description": "\"pin\""
+                        },
+                        {
+                          "description": "\"key\""
+                        },
+                        {
+                          "description": "\"recovery\""
+                        },
+                        {
+                          "description": "\"edge\""
+                        },
+                        {
+                          "description": "\"create\""
+                        }
+                      ],
+                      "description": "How this session was established."
+                    },
+                    "autoLogoutSeconds": {
+                      "type": "number",
+                      "description": "Idle time before the engine logs the account out. 0 disables it."
+                    },
+                    "expiresAt": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "When auto-logout will fire, or null when it is disabled."
+                    },
+                    "lastActivityAt": {
+                      "type": "string",
+                      "description": "Last call on this session, which is what auto-logout measures from."
+                    },
+                    "createdAt": {
+                      "type": "string",
+                      "description": "When the login completed."
+                    }
+                  },
+                  "required": [
+                    "sessionId",
+                    "rootLoginId",
+                    "loginMethod",
+                    "autoLogoutSeconds",
+                    "expiresAt",
+                    "lastActivityAt",
+                    "createdAt"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "PASSWORD_ERROR, USERNAME_ERROR, NETWORK_ERROR",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "otp": {
+                    "type": "string",
+                    "description": "A current 2FA code."
+                  },
+                  "otpKey": {
+                    "type": "string",
+                    "description": "The 2FA secret itself, instead of a code."
+                  },
+                  "challengeId": {
+                    "type": "string",
+                    "description": "Supply after solving a CAPTCHA to retry the same request."
+                  },
+                  "recoveryKey": {
+                    "type": "string",
+                    "description": "From `change-recovery`."
+                  },
+                  "username": {
+                    "type": "string",
+                    "description": "The account name."
+                  },
+                  "answers": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    },
+                    "description": "In the same order as the questions."
+                  }
+                },
+                "required": [
+                  "recoveryKey",
+                  "username",
+                  "answers"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/create-account": {
+      "post": {
+        "operationId": "createAccount",
+        "summary": "Create an account.",
+        "description": "**Core call:** `context.createAccount`\n\n**Command line**\n\n```\ncreate-account [--otp=<otp>] [--otp-key=<otpKey>] [--challenge-id=<challengeId>] [--username=<username>] [--password=<password>] [--pin=<pin>]\n```\n\nEvery credential is optional over REST: omitting all three creates a light account with no username.",
+        "tags": [
+          "Login methods"
+        ],
+        "x-cli": {
+          "command": "create-account",
+          "flags": [],
+          "extra": [],
+          "custom": true,
+          "preset": {}
+        },
+        "x-core-call": "context.createAccount",
+        "x-source": "src/cli/engine/routes/login.ts",
+        "parameters": [],
+        "responses": {
+          "200": {
+            "description": "A session with `loginMethod: \"create\"`.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "sessionId": {
+                      "type": "string",
+                      "description": "Identifies this login. Every account-scoped call carries it, and the CLI stores the most recent one so commands can omit it."
+                    },
+                    "username": {
+                      "type": "string",
+                      "description": "Absent for a light account, which has no username."
+                    },
+                    "rootLoginId": {
+                      "type": "string",
+                      "description": "The account root, stable across appIds. Two sessions sharing it are the same account."
+                    },
+                    "loginMethod": {
+                      "anyOf": [
+                        {
+                          "description": "\"password\""
+                        },
+                        {
+                          "description": "\"pin\""
+                        },
+                        {
+                          "description": "\"key\""
+                        },
+                        {
+                          "description": "\"recovery\""
+                        },
+                        {
+                          "description": "\"edge\""
+                        },
+                        {
+                          "description": "\"create\""
+                        }
+                      ],
+                      "description": "How this session was established."
+                    },
+                    "autoLogoutSeconds": {
+                      "type": "number",
+                      "description": "Idle time before the engine logs the account out. 0 disables it."
+                    },
+                    "expiresAt": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "When auto-logout will fire, or null when it is disabled."
+                    },
+                    "lastActivityAt": {
+                      "type": "string",
+                      "description": "Last call on this session, which is what auto-logout measures from."
+                    },
+                    "createdAt": {
+                      "type": "string",
+                      "description": "When the login completed."
+                    }
+                  },
+                  "required": [
+                    "sessionId",
+                    "rootLoginId",
+                    "loginMethod",
+                    "autoLogoutSeconds",
+                    "expiresAt",
+                    "lastActivityAt",
+                    "createdAt"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "USERNAME_ERROR, CHALLENGE_REQUIRED, BAD_REQUEST, NETWORK_ERROR",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "otp": {
+                    "type": "string",
+                    "description": "A current 2FA code."
+                  },
+                  "otpKey": {
+                    "type": "string",
+                    "description": "The 2FA secret itself, instead of a code."
+                  },
+                  "challengeId": {
+                    "type": "string",
+                    "description": "Supply after solving a CAPTCHA to retry the same request."
+                  },
+                  "username": {
+                    "type": "string",
+                    "description": "The name to claim."
+                  },
+                  "password": {
+                    "type": "string",
+                    "description": "The account password."
+                  },
+                  "pin": {
+                    "type": "string",
+                    "description": "A device PIN to save."
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/request-edge-login": {
+      "post": {
+        "operationId": "requestEdgeLogin",
+        "summary": "Start a QR login.",
+        "description": "**Core call:** `context.requestEdgeLogin`\n\n**Command line**\n\n```\nrequest-edge-login [--no-wait]\n```\n\nAsks the login server for a lobby another logged-in Edge device can approve. The returned `lobbyId` is what goes in the QR code.",
+        "tags": [
+          "Login methods"
+        ],
+        "x-cli": {
+          "command": "request-edge-login",
+          "flags": [],
+          "extra": [
+            {
+              "name": "no-wait",
+              "kind": "boolean",
+              "required": false,
+              "doc": "Print the lobby and exit instead of polling, so the QR can be displayed while `poll-edge-login` watches the same handle from another process."
+            }
+          ],
+          "custom": true,
+          "preset": {},
+          "notes": "Prints the pending login, then polls every 2s for up to 5 minutes. On `done` it stores the session. With `--no-wait` it returns immediately and `poll-edge-login` takes over."
+        },
+        "x-core-call": "context.requestEdgeLogin",
+        "x-source": "src/cli/engine/routes/login.ts",
+        "parameters": [],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "objectId": {
+                      "type": "string",
+                      "description": "Handle for the value the engine is holding. Pass it to the calls that consume it."
+                    },
+                    "pendingId": {
+                      "type": "string",
+                      "description": "Same value as `objectId`, under the name the poll command takes."
+                    },
+                    "kind": {
+                      "type": "string",
+                      "description": "What the handle refers to, which decides the calls that accept it."
+                    },
+                    "expiresAt": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "When the lobby closes and the QR code stops working."
+                    },
+                    "lobbyId": {
+                      "type": "string",
+                      "description": "Lobby the phone connects to."
+                    },
+                    "uri": {
+                      "type": "string",
+                      "description": "The `edge://` URI to render as a QR code for the phone to scan."
+                    },
+                    "state": {
+                      "type": "string",
+                      "description": "How far the login has got: `pending` before the phone scans, `started` once it has, and `done` when `session` is filled in."
+                    },
+                    "username": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "Account that approved the login, known once the phone has scanned."
+                    },
+                    "session": {
+                      "anyOf": [
+                        {
+                          "description": "{ sessionId: string; username: string"
+                        },
+                        {
+                          "description": "undefined; rootLoginId: string; loginMethod: \"password\""
+                        },
+                        {
+                          "description": "\"pin\""
+                        },
+                        {
+                          "description": "\"key\""
+                        },
+                        {
+                          "description": "\"recovery\""
+                        },
+                        {
+                          "description": "\"edge\""
+                        },
+                        {
+                          "description": "\"create\"; autoLogoutSeconds: number; expiresAt: string"
+                        },
+                        {
+                          "description": "null; lastActivityAt: string; createdAt: string; }"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "The session, null until `state` is `done`."
+                    },
+                    "error": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "Why the login failed, set only when `state` is `error`."
+                    }
+                  },
+                  "required": [
+                    "objectId",
+                    "pendingId",
+                    "kind",
+                    "expiresAt",
+                    "lobbyId",
+                    "uri",
+                    "state",
+                    "username",
+                    "session",
+                    "error"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "NETWORK_ERROR",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/pending-edge-login/{pendingId}": {
+      "get": {
+        "operationId": "pollEdgeLogin",
+        "summary": "Poll a pending QR login.",
+        "description": "**Core call:** _none — Engine state for an in-flight requestEdgeLogin; core exposes it as EdgePendingEdgeLogin properties._\n\n**Command line**\n\n```\npoll-edge-login <pendingId>\n```\n\nOnce `state` reaches `done` the engine has already created the session, so the response carries one ready to use.",
+        "tags": [
+          "Login methods"
+        ],
+        "x-cli": {
+          "command": "poll-edge-login",
+          "positional": "pendingId",
+          "flags": [],
+          "extra": [],
+          "custom": true,
+          "preset": {}
+        },
+        "x-core-call": null,
+        "x-core-note": "Engine state for an in-flight requestEdgeLogin; core exposes it as EdgePendingEdgeLogin properties.",
+        "x-source": "src/cli/engine/routes/login.ts",
+        "parameters": [
+          {
+            "name": "pendingId",
+            "in": "path",
+            "required": true,
+            "description": "The `pendingId` returned when the QR login was requested.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "objectId": {
+                      "type": "string",
+                      "description": "Handle for the value the engine is holding. Pass it to the calls that consume it."
+                    },
+                    "pendingId": {
+                      "type": "string",
+                      "description": "Same value as `objectId`, under the name the poll command takes."
+                    },
+                    "kind": {
+                      "type": "string",
+                      "description": "What the handle refers to, which decides the calls that accept it."
+                    },
+                    "expiresAt": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "When the lobby closes and the QR code stops working."
+                    },
+                    "lobbyId": {
+                      "type": "string",
+                      "description": "Lobby the phone connects to."
+                    },
+                    "uri": {
+                      "type": "string",
+                      "description": "The `edge://` URI to render as a QR code for the phone to scan."
+                    },
+                    "state": {
+                      "type": "string",
+                      "description": "How far the login has got: `pending` before the phone scans, `started` once it has, and `done` when `session` is filled in."
+                    },
+                    "username": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "Account that approved the login, known once the phone has scanned."
+                    },
+                    "session": {
+                      "anyOf": [
+                        {
+                          "description": "{ sessionId: string; username: string"
+                        },
+                        {
+                          "description": "undefined; rootLoginId: string; loginMethod: \"password\""
+                        },
+                        {
+                          "description": "\"pin\""
+                        },
+                        {
+                          "description": "\"key\""
+                        },
+                        {
+                          "description": "\"recovery\""
+                        },
+                        {
+                          "description": "\"edge\""
+                        },
+                        {
+                          "description": "\"create\"; autoLogoutSeconds: number; expiresAt: string"
+                        },
+                        {
+                          "description": "null; lastActivityAt: string; createdAt: string; }"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "The session, null until `state` is `done`."
+                    },
+                    "error": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "Why the login failed, set only when `state` is `error`."
+                    }
+                  },
+                  "required": [
+                    "objectId",
+                    "pendingId",
+                    "kind",
+                    "expiresAt",
+                    "lobbyId",
+                    "uri",
+                    "state",
+                    "username",
+                    "session",
+                    "error"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "PENDING_LOGIN_NOT_FOUND, OBJECT_EXPIRED",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/pending-edge-login/cancel-request/{pendingId}": {
+      "post": {
+        "operationId": "cancelEdgeLogin",
+        "summary": "Cancel a pending QR login.",
+        "description": "**Core call:** `EdgePendingEdgeLogin.cancelRequest`\n\n**Command line**\n\n```\ncancel-request <pendingId>\n```\n\n",
+        "tags": [
+          "Login methods"
+        ],
+        "x-cli": {
+          "command": "cancel-request",
+          "positional": "pendingId",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "EdgePendingEdgeLogin.cancelRequest",
+        "x-source": "src/cli/engine/routes/login.ts",
+        "parameters": [
+          {
+            "name": "pendingId",
+            "in": "path",
+            "required": true,
+            "description": "The `pendingId` returned when the QR login was requested.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No content."
+          },
+          "default": {
+            "description": "PENDING_LOGIN_NOT_FOUND",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/engine/sessions": {
+      "get": {
+        "operationId": "engineSessions",
+        "summary": "List active sessions.",
+        "description": "**Core call:** _none — The session registry is an engine construct; core has no multi-account session concept._\n\n**Command line**\n\n```\nengine-sessions\n```\n\n",
+        "tags": [
+          "Login methods"
+        ],
+        "x-cli": {
+          "command": "engine-sessions",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": null,
+        "x-core-note": "The session registry is an engine construct; core has no multi-account session concept.",
+        "x-source": "src/cli/engine/routes/login.ts",
+        "parameters": [],
+        "responses": {
+          "200": {
+            "description": "A bare array, not wrapped in a key.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "anyOf": [
+                      {
+                        "description": "{ sessionId: string; username: string"
+                      },
+                      {
+                        "description": "undefined; rootLoginId: string; loginMethod: \"password\""
+                      },
+                      {
+                        "description": "\"pin\""
+                      },
+                      {
+                        "description": "\"key\""
+                      },
+                      {
+                        "description": "\"recovery\""
+                      },
+                      {
+                        "description": "\"edge\""
+                      },
+                      {
+                        "description": "\"create\"; autoLogoutSeconds: number; expiresAt: string"
+                      },
+                      {
+                        "description": "null; lastActivityAt: string; createdAt: string; }"
+                      }
+                    ]
+                  }
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}": {
+      "get": {
+        "operationId": "accountInfo",
+        "summary": "Account and session summary.",
+        "description": "**Core call:** _none — Engine composite of the session record plus EdgeAccount properties._\n\n**Command line**\n\n```\naccount-info\n```\n\nSession fields are spread at the top level alongside the account's own properties — there is no nested `session` object.",
+        "tags": [
+          "Session"
+        ],
+        "x-cli": {
+          "command": "account-info",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": null,
+        "x-core-note": "Engine composite of the session record plus EdgeAccount properties.",
+        "x-source": "src/cli/engine/routes/account.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "appId": {
+                      "type": "string",
+                      "description": "Application this session logged into."
+                    },
+                    "created": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "When the account was created, null for accounts predating the field."
+                    },
+                    "lastLogin": {
+                      "type": "string",
+                      "description": "The previous login, not this one."
+                    },
+                    "loggedIn": {
+                      "type": "boolean",
+                      "description": "False once the account has been logged out; the session object outlives it briefly."
+                    },
+                    "recoveryKey": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "Present only while recovery is configured."
+                    },
+                    "otpEnabled": {
+                      "type": "boolean",
+                      "description": "2FA is on for this account."
+                    },
+                    "otpResetPending": {
+                      "type": "boolean",
+                      "description": "True while somebody has a reset pending against this account."
+                    },
+                    "canDuressLogin": {
+                      "type": "boolean",
+                      "description": "A duress PIN is configured, so this account can be opened in duress mode."
+                    },
+                    "isDuressAccount": {
+                      "type": "boolean",
+                      "description": "True when this very session is the duress account rather than the real one."
+                    },
+                    "edgeLogin": {
+                      "type": "boolean",
+                      "description": "This account was reached by QR login."
+                    },
+                    "keyLogin": {
+                      "type": "boolean",
+                      "description": "This session was reached with a login key."
+                    },
+                    "newAccount": {
+                      "type": "boolean",
+                      "description": "This session created the account rather than logging into an existing one."
+                    },
+                    "passwordLogin": {
+                      "type": "boolean",
+                      "description": "This session was reached with a password."
+                    },
+                    "pinLogin": {
+                      "type": "boolean",
+                      "description": "This session was reached with a PIN."
+                    },
+                    "recoveryLogin": {
+                      "type": "boolean",
+                      "description": "This session was reached by answering recovery questions."
+                    }
+                  },
+                  "required": [
+                    "appId",
+                    "created",
+                    "lastLogin",
+                    "loggedIn",
+                    "recoveryKey",
+                    "otpEnabled",
+                    "otpResetPending",
+                    "canDuressLogin",
+                    "isDuressAccount",
+                    "edgeLogin",
+                    "keyLogin",
+                    "newAccount",
+                    "passwordLogin",
+                    "pinLogin",
+                    "recoveryLogin"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/logout": {
+      "post": {
+        "operationId": "logout",
+        "summary": "Log out.",
+        "description": "**Core call:** `account.logout`\n\n**Command line**\n\n```\nlogout\n```\n\nEnds the session and drops it from the engine. Any subscription scoped to this account or its wallets is closed with it.",
+        "tags": [
+          "Session"
+        ],
+        "x-cli": {
+          "command": "logout",
+          "flags": [],
+          "extra": [],
+          "custom": true,
+          "preset": {},
+          "notes": "Also clears the stored id from `session.json`."
+        },
+        "x-core-call": "account.logout",
+        "x-source": "src/cli/engine/routes/account.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No content."
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/touch": {
+      "post": {
+        "operationId": "touchSession",
+        "summary": "Keepalive.",
+        "description": "**Core call:** _none — Engine auto-logout timer; core has no idle concept._\n\n**Command line**\n\n```\ntouch\n```\n\nResets the idle auto-logout timer without doing any other work.",
+        "tags": [
+          "Session"
+        ],
+        "x-cli": {
+          "command": "touch",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": null,
+        "x-core-note": "Engine auto-logout timer; core has no idle concept.",
+        "x-source": "src/cli/engine/routes/account.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The session, with a refreshed `expiresAt`.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "sessionId": {
+                      "type": "string",
+                      "description": "Identifies this login. Every account-scoped call carries it, and the CLI stores the most recent one so commands can omit it."
+                    },
+                    "username": {
+                      "type": "string",
+                      "description": "Absent for a light account, which has no username."
+                    },
+                    "rootLoginId": {
+                      "type": "string",
+                      "description": "The account root, stable across appIds. Two sessions sharing it are the same account."
+                    },
+                    "loginMethod": {
+                      "anyOf": [
+                        {
+                          "description": "\"password\""
+                        },
+                        {
+                          "description": "\"pin\""
+                        },
+                        {
+                          "description": "\"key\""
+                        },
+                        {
+                          "description": "\"recovery\""
+                        },
+                        {
+                          "description": "\"edge\""
+                        },
+                        {
+                          "description": "\"create\""
+                        }
+                      ],
+                      "description": "How this session was established."
+                    },
+                    "autoLogoutSeconds": {
+                      "type": "number",
+                      "description": "Idle time before the engine logs the account out. 0 disables it."
+                    },
+                    "expiresAt": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "When auto-logout will fire, or null when it is disabled."
+                    },
+                    "lastActivityAt": {
+                      "type": "string",
+                      "description": "Last call on this session, which is what auto-logout measures from."
+                    },
+                    "createdAt": {
+                      "type": "string",
+                      "description": "When the login completed."
+                    }
+                  },
+                  "required": [
+                    "sessionId",
+                    "rootLoginId",
+                    "loginMethod",
+                    "autoLogoutSeconds",
+                    "expiresAt",
+                    "lastActivityAt",
+                    "createdAt"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/get-login-key": {
+      "get": {
+        "operationId": "getLoginKey",
+        "summary": "Read the account login key.",
+        "description": "**Core call:** `account.getLoginKey`\n\n**Command line**\n\n```\nget-login-key\n```\n\nThe key `login-with-key` takes. It grants full account access, so treat the output as secret.",
+        "tags": [
+          "Session"
+        ],
+        "x-cli": {
+          "command": "get-login-key",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.getLoginKey",
+        "x-source": "src/cli/engine/routes/account.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "loginKey": {
+                      "type": "string",
+                      "description": "base58. Full account access — keep it safe."
+                    }
+                  },
+                  "required": [
+                    "loginKey"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/sync": {
+      "post": {
+        "operationId": "accountSync",
+        "summary": "Force an account data sync.",
+        "description": "**Core call:** `account.sync`\n\n**Command line**\n\n```\nsync\n```\n\nPushes and pulls the account repos immediately rather than waiting for the next scheduled sync.",
+        "tags": [
+          "Session"
+        ],
+        "x-cli": {
+          "command": "sync",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {},
+          "notes": "Named `sync` for the account; the wallet one is `wallet-sync`."
+        },
+        "x-core-call": "account.sync",
+        "x-source": "src/cli/engine/routes/account.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No content."
+          },
+          "default": {
+            "description": "NETWORK_ERROR",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/delete-remote-account": {
+      "post": {
+        "operationId": "deleteRemoteAccount",
+        "summary": "Permanently delete the remote account.",
+        "description": "**Core call:** `account.deleteRemoteAccount`\n\n**Command line**\n\n```\ndelete-remote-account --yes\n```\n\nIrreversible. The account is removed from the login server, and funds in its wallets are unrecoverable without the keys. The session is logged out afterwards.",
+        "tags": [
+          "Session"
+        ],
+        "x-cli": {
+          "command": "delete-remote-account",
+          "flags": [],
+          "extra": [
+            {
+              "name": "yes",
+              "kind": "boolean",
+              "required": true,
+              "doc": "Confirms intent. Without it the command refuses to run."
+            }
+          ],
+          "custom": true,
+          "preset": {}
+        },
+        "x-core-call": "account.deleteRemoteAccount",
+        "x-source": "src/cli/engine/routes/account.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No content."
+          },
+          "default": {
+            "description": "NETWORK_ERROR",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/wait-for-all-wallets": {
+      "post": {
+        "operationId": "waitForAllWallets",
+        "summary": "Wait for every wallet to finish loading.",
+        "description": "**Core call:** `account.waitForAllWallets`\n\n**Command line**\n\n```\nwait-for-all-wallets\n```\n\nWallets load in the background after login, so a list taken straight afterwards can be short. This resolves once each active wallet has either loaded or failed — balances may still be syncing afterwards.",
+        "tags": [
+          "Session"
+        ],
+        "x-cli": {
+          "command": "wait-for-all-wallets",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.waitForAllWallets",
+        "x-source": "src/cli/engine/routes/account.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No content."
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/currency-wallets": {
+      "get": {
+        "operationId": "currencyWallets",
+        "summary": "List the account's wallets.",
+        "description": "**Core call:** `account.currencyWallets`\n\n**Command line**\n\n```\ncurrency-wallets [--filter=active|archived|hidden|all]\n```\n\n",
+        "tags": [
+          "Session"
+        ],
+        "x-cli": {
+          "command": "currency-wallets",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.currencyWallets",
+        "x-core-note": "Filtered by account.activeWalletIds / archivedWalletIds / hiddenWalletIds.",
+        "x-source": "src/cli/engine/routes/account.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "filter",
+            "in": "query",
+            "required": false,
+            "description": "Which of the account’s wallet lists to read. Defaults to `active`.",
+            "schema": {
+              "anyOf": [
+                {
+                  "description": "\"active\""
+                },
+                {
+                  "description": "\"archived\""
+                },
+                {
+                  "description": "\"hidden\""
+                },
+                {
+                  "description": "\"all\""
+                }
+              ]
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "currencyWallets": {
+                      "type": "array",
+                      "items": {
+                        "anyOf": [
+                          {
+                            "description": "{ walletId: string; id: string; type: string; name: string"
+                          },
+                          {
+                            "description": "null; pluginId: string; currencyCode: string; fiatCurrencyCode: string; blockHeight: number; syncStatus: unknown; syncRatio: string"
+                          },
+                          {
+                            "description": "undefined; paused: boolean; imported: boolean"
+                          },
+                          {
+                            "description": "undefined; created: string"
+                          },
+                          {
+                            "description": "null; enabledTokenIds: string[]; detectedTokenIds: string[]; unactivatedTokenIds: string[]; }"
+                          }
+                        ]
+                      },
+                      "description": "Every wallet in the account, including paused ones."
+                    }
+                  },
+                  "required": [
+                    "currencyWallets"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/create-currency-wallet": {
+      "post": {
+        "operationId": "createCurrencyWallet",
+        "summary": "Create a currency wallet.",
+        "description": "**Core call:** `account.createCurrencyWallet`\n\n**Command line**\n\n```\ncreate-currency-wallet --wallet-type=<walletType> [--name=<name>] [--import-text=<importText>]\n```\n\n",
+        "tags": [
+          "Session"
+        ],
+        "x-cli": {
+          "command": "create-currency-wallet",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.createCurrencyWallet",
+        "x-source": "src/cli/engine/routes/account.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "walletId": {
+                      "type": "string",
+                      "description": "The full wallet id. Commands taking a wallet accept any unique prefix."
+                    },
+                    "id": {
+                      "type": "string",
+                      "description": "Same value as `walletId`; core exposes both names."
+                    },
+                    "type": {
+                      "type": "string",
+                      "description": "Key type, such as `wallet:bitcoin`."
+                    },
+                    "name": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "User-assigned name, null until one is set."
+                    },
+                    "pluginId": {
+                      "type": "string",
+                      "description": "Currency plugin backing this wallet."
+                    },
+                    "currencyCode": {
+                      "type": "string",
+                      "description": "Ticker for the native asset."
+                    },
+                    "fiatCurrencyCode": {
+                      "type": "string",
+                      "description": "Fiat the wallet reports value in, as `iso:USD`."
+                    },
+                    "blockHeight": {
+                      "type": "number",
+                      "description": "Chain height this wallet has seen."
+                    },
+                    "syncStatus": {
+                      "description": "`EdgeWalletSyncStatus` from core."
+                    },
+                    "syncRatio": {
+                      "type": "string",
+                      "description": "Sync progress as a percentage, for display."
+                    },
+                    "paused": {
+                      "type": "boolean",
+                      "description": "True while the engine is not syncing this wallet."
+                    },
+                    "imported": {
+                      "type": "boolean",
+                      "description": "True when the keys came from an import rather than being generated here."
+                    },
+                    "created": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "When the wallet was created, null for wallets predating the field."
+                    },
+                    "enabledTokenIds": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "description": "Tokens the user turned on."
+                    },
+                    "detectedTokenIds": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "description": "Tokens found on-chain that are not enabled yet."
+                    },
+                    "unactivatedTokenIds": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "description": "Enabled tokens still awaiting on-chain activation."
+                    }
+                  },
+                  "required": [
+                    "walletId",
+                    "id",
+                    "type",
+                    "name",
+                    "pluginId",
+                    "currencyCode",
+                    "fiatCurrencyCode",
+                    "blockHeight",
+                    "syncStatus",
+                    "paused",
+                    "created",
+                    "enabledTokenIds",
+                    "detectedTokenIds",
+                    "unactivatedTokenIds"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "BAD_REQUEST",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "walletType": {
+                    "type": "string",
+                    "description": "From `currency-configs`, e.g. `wallet:bitcoin`."
+                  },
+                  "name": {
+                    "type": "string",
+                    "description": "Display name."
+                  },
+                  "importText": {
+                    "type": "string",
+                    "description": "Seed or key text to import instead of generating."
+                  }
+                },
+                "required": [
+                  "walletType"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/create-currency-wallets": {
+      "post": {
+        "operationId": "createCurrencyWallets",
+        "summary": "Create several wallets at once.",
+        "description": "**Core call:** `account.createCurrencyWallets`\n\n**Command line**\n\n```\ncreate-currency-wallets --create-wallets='<json>'\n```\n\nPartial success is normal: each entry reports its own outcome, and one failure does not roll back the others.",
+        "tags": [
+          "Session"
+        ],
+        "x-cli": {
+          "command": "create-currency-wallets",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.createCurrencyWallets",
+        "x-source": "src/cli/engine/routes/account.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "results": {
+                      "type": "array",
+                      "items": {},
+                      "description": "Mirrors core's EdgeResult[]: `{ ok, wallet }` or `{ ok: false, error }`."
+                    }
+                  },
+                  "required": [
+                    "results"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "BAD_REQUEST",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "createWallets": {
+                    "type": "array",
+                    "items": {},
+                    "description": "`EdgeCreateCurrencyWallet[]`: walletType, name, fiatCurrencyCode."
+                  }
+                },
+                "required": [
+                  "createWallets"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/local-settings": {
+      "get": {
+        "operationId": "localSettings",
+        "summary": "Local settings.",
+        "description": "**Core call:** _none — GUI code (src/util/localAccountSettings), reached through account.localDisklet._\n\n**Command line**\n\n```\nlocal-settings\n```\n\nDevice-local account settings, stored in `Settings.json` on `account.localDisklet`. They are not synced — a phone and a CLI keep separate copies unless they share an Edge data directory.",
+        "tags": [
+          "Local settings"
+        ],
+        "x-cli": {
+          "command": "local-settings",
+          "flags": [],
+          "extra": [],
+          "custom": true,
+          "preset": {}
+        },
+        "x-core-call": null,
+        "x-core-note": "GUI code (src/util/localAccountSettings), reached through account.localDisklet.",
+        "x-source": "src/cli/engine/routes/localSettings.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "spamFilterOn": {
+                      "type": "boolean",
+                      "description": "Hide spam transactions in `get-transactions` results. Defaults to `true`, matching the GUI. The filter hides rows; it never changes stored metadata."
+                    }
+                  },
+                  "required": [
+                    "spamFilterOn"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/change-local-settings": {
+      "post": {
+        "operationId": "changeLocalSettings",
+        "summary": "Change local settings.",
+        "description": "**Core call:** _none — GUI code (src/util/localAccountSettings)._\n\n**Command line**\n\n```\nlocal-settings --spam-filter-on=true|false\n```\n\nWrites device-local account settings. Every option is a field on the body; `spamFilterOn` is the only one today, and new options are added alongside it.",
+        "tags": [
+          "Local settings"
+        ],
+        "x-cli": {
+          "command": "local-settings",
+          "flags": [],
+          "extra": [],
+          "custom": true,
+          "preset": {},
+          "notes": "With no flag the command reads; with one it writes."
+        },
+        "x-core-call": null,
+        "x-core-note": "GUI code (src/util/localAccountSettings).",
+        "x-source": "src/cli/engine/routes/localSettings.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "spamFilterOn": {
+                      "type": "boolean",
+                      "description": "Hide spam transactions in `get-transactions` results. Defaults to `true`, matching the GUI. The filter hides rows; it never changes stored metadata."
+                    }
+                  },
+                  "required": [
+                    "spamFilterOn"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "spamFilterOn": {
+                    "type": "boolean",
+                    "description": "Hide spam transactions in `get-transactions` results. Defaults to `true`, matching the GUI. The filter hides rows; it never changes stored metadata."
+                  }
+                },
+                "required": [
+                  "spamFilterOn"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/change-password": {
+      "post": {
+        "operationId": "changePassword",
+        "summary": "Set or change the password.",
+        "description": "**Core call:** `account.changePassword`\n\n**Command line**\n\n```\nchange-password --password=<password>\n```\n\nThe login server enforces its own rules; `check-password-rules` scores a candidate first.",
+        "tags": [
+          "Credentials"
+        ],
+        "x-cli": {
+          "command": "change-password",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.changePassword",
+        "x-source": "src/cli/engine/routes/credentials.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No content."
+          },
+          "default": {
+            "description": "BAD_REQUEST, NETWORK_ERROR",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "password": {
+                    "type": "string",
+                    "description": "The new password."
+                  }
+                },
+                "required": [
+                  "password"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/delete-password": {
+      "post": {
+        "operationId": "deletePassword",
+        "summary": "Remove password login.",
+        "description": "**Core call:** `account.deletePassword`\n\n**Command line**\n\n```\ndelete-password\n```\n\nThe account keeps its other login methods; only the password stops working.",
+        "tags": [
+          "Credentials"
+        ],
+        "x-cli": {
+          "command": "delete-password",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.deletePassword",
+        "x-source": "src/cli/engine/routes/credentials.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No content."
+          },
+          "default": {
+            "description": "BAD_REQUEST, NETWORK_ERROR",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/check-password": {
+      "post": {
+        "operationId": "checkPassword",
+        "summary": "Verify a password.",
+        "description": "**Core call:** `account.checkPassword`\n\n**Command line**\n\n```\ncheck-password --password=<password>\n```\n\nChecks without changing anything, which is how a caller gates a destructive action behind a re-entry prompt.",
+        "tags": [
+          "Credentials"
+        ],
+        "x-cli": {
+          "command": "check-password",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.checkPassword",
+        "x-source": "src/cli/engine/routes/credentials.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "ok": {
+                      "type": "boolean",
+                      "description": "False for a wrong password — not an error response."
+                    }
+                  },
+                  "required": [
+                    "ok"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "password": {
+                    "type": "string",
+                    "description": "The account password."
+                  }
+                },
+                "required": [
+                  "password"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/get-pin": {
+      "get": {
+        "operationId": "getPin",
+        "summary": "Read the account PIN.",
+        "description": "**Core call:** `account.getPin`\n\n**Command line**\n\n```\nget-pin\n```\n\nReturns the PIN itself, not a status flag, so treat the output as secret.",
+        "tags": [
+          "Credentials"
+        ],
+        "x-cli": {
+          "command": "get-pin",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.getPin",
+        "x-source": "src/cli/engine/routes/credentials.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "pin": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "Null when no PIN is set."
+                    }
+                  },
+                  "required": [
+                    "pin"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/change-pin": {
+      "post": {
+        "operationId": "changePin",
+        "summary": "Set or change the PIN.",
+        "description": "**Core call:** `account.changePin`\n\n**Command line**\n\n```\nchange-pin --pin=<pin> [--enable-login] [--for-duress-account]\n```\n\n",
+        "tags": [
+          "Credentials"
+        ],
+        "x-cli": {
+          "command": "change-pin",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.changePin",
+        "x-source": "src/cli/engine/routes/credentials.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "pin2Key": {
+                      "type": "string",
+                      "description": "The new PIN login key core returns."
+                    }
+                  },
+                  "required": [
+                    "pin2Key"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "BAD_REQUEST",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "pin": {
+                    "type": "string",
+                    "description": "The new PIN."
+                  },
+                  "enableLogin": {
+                    "type": "boolean",
+                    "description": "Allow logging in with this PIN on this device."
+                  },
+                  "forDuressAccount": {
+                    "type": "boolean",
+                    "description": "Act on the duress account rather than the real one."
+                  }
+                },
+                "required": [
+                  "pin"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/delete-pin": {
+      "post": {
+        "operationId": "deletePin",
+        "summary": "Remove the PIN.",
+        "description": "**Core call:** `account.deletePin`\n\n**Command line**\n\n```\ndelete-pin\n```\n\nPIN login stops working on this device; other methods are untouched.",
+        "tags": [
+          "Credentials"
+        ],
+        "x-cli": {
+          "command": "delete-pin",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.deletePin",
+        "x-source": "src/cli/engine/routes/credentials.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No content."
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/check-pin": {
+      "post": {
+        "operationId": "checkPin",
+        "summary": "Verify a PIN.",
+        "description": "**Core call:** `account.checkPin`\n\n**Command line**\n\n```\ncheck-pin --pin=<pin> [--for-duress-account]\n```\n\n",
+        "tags": [
+          "Credentials"
+        ],
+        "x-cli": {
+          "command": "check-pin",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.checkPin",
+        "x-source": "src/cli/engine/routes/credentials.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "ok": {
+                      "type": "boolean",
+                      "description": "False for a wrong PIN — not an error response."
+                    }
+                  },
+                  "required": [
+                    "ok"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "pin": {
+                    "type": "string",
+                    "description": "The device PIN, usually four digits."
+                  },
+                  "forDuressAccount": {
+                    "type": "boolean",
+                    "description": "Act on the duress account rather than the real one."
+                  }
+                },
+                "required": [
+                  "pin"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/change-username": {
+      "post": {
+        "operationId": "changeUsername",
+        "summary": "Change the username.",
+        "description": "**Core call:** `account.changeUsername`\n\n**Command line**\n\n```\nchange-username --username=<username> [--password=<password>]\n```\n\nThe old name is released, so it becomes available to anyone else.",
+        "tags": [
+          "Credentials"
+        ],
+        "x-cli": {
+          "command": "change-username",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.changeUsername",
+        "x-source": "src/cli/engine/routes/credentials.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No content."
+          },
+          "default": {
+            "description": "USERNAME_ERROR, BAD_REQUEST, NETWORK_ERROR",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "username": {
+                    "type": "string",
+                    "description": "The new username."
+                  },
+                  "password": {
+                    "type": "string",
+                    "description": "Required by core when the account has a password."
+                  }
+                },
+                "required": [
+                  "username"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/change-recovery": {
+      "post": {
+        "operationId": "changeRecovery",
+        "summary": "Set recovery questions and answers.",
+        "description": "**Core call:** `account.changeRecovery`\n\n**Command line**\n\n```\nchange-recovery --question=<questions> … --answer=<answers> …\n```\n\nThe returned key is half of the credential: without it the answers alone cannot recover the account, so it has to be stored somewhere else.",
+        "tags": [
+          "Credentials"
+        ],
+        "x-cli": {
+          "command": "change-recovery",
+          "flags": [
+            {
+              "name": "question",
+              "maps": "questions",
+              "repeat": true
+            },
+            {
+              "name": "answer",
+              "maps": "answers",
+              "repeat": true
+            }
+          ],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.changeRecovery",
+        "x-core-note": "Our surface drops the `2` from core's recovery2 naming; a future Recovery1 would be suffixed `V1`.",
+        "x-source": "src/cli/engine/routes/credentials.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "recoveryKey": {
+                      "type": "string",
+                      "description": "Store this out of band. `login-with-recovery` needs it alongside the answers."
+                    }
+                  },
+                  "required": [
+                    "recoveryKey"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "BAD_REQUEST",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "questions": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    },
+                    "description": "The questions to ask."
+                  },
+                  "answers": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    },
+                    "description": "Same length and order as `questions`."
+                  }
+                },
+                "required": [
+                  "questions",
+                  "answers"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/delete-recovery": {
+      "post": {
+        "operationId": "deleteRecovery",
+        "summary": "Disable recovery login.",
+        "description": "**Core call:** `account.deleteRecovery`\n\n**Command line**\n\n```\ndelete-recovery\n```\n\nThe existing recovery key stops working.",
+        "tags": [
+          "Credentials"
+        ],
+        "x-cli": {
+          "command": "delete-recovery",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.deleteRecovery",
+        "x-source": "src/cli/engine/routes/credentials.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No content."
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/otp-key": {
+      "get": {
+        "operationId": "otpKey",
+        "summary": "Read the 2FA secret and reset state.",
+        "description": "**Core call:** `account.otpKey`\n\n**Command line**\n\n```\notp-key\n```\n\n",
+        "tags": [
+          "Two-factor authentication"
+        ],
+        "x-cli": {
+          "command": "otp-key",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.otpKey",
+        "x-core-note": "Also carries account.otpResetDate.",
+        "x-source": "src/cli/engine/routes/otp.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "otpKey": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "Null when 2FA is off. The 2FA secret itself. Secret material — record it safely."
+                    },
+                    "otpResetDate": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "Set once somebody has requested a reset; cancel it with `cancel-otp-reset`."
+                    }
+                  },
+                  "required": [
+                    "otpKey",
+                    "otpResetDate"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/enable-otp": {
+      "post": {
+        "operationId": "enableOtp",
+        "summary": "Enable 2FA.",
+        "description": "**Core call:** `account.enableOtp`\n\n**Command line**\n\n```\nenable-otp [--timeout=<timeout>]\n```\n\nRecord the returned key before leaving the terminal: it is the only copy.",
+        "tags": [
+          "Two-factor authentication"
+        ],
+        "x-cli": {
+          "command": "enable-otp",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.enableOtp",
+        "x-source": "src/cli/engine/routes/otp.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "otpKey": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "The new secret. The 2FA secret itself. Secret material — record it safely."
+                    }
+                  },
+                  "required": [
+                    "otpKey"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "timeout": {
+                    "type": "number",
+                    "description": "How long a reset request must wait before it completes. Core supplies the default when omitted."
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/disable-otp": {
+      "post": {
+        "operationId": "disableOtp",
+        "summary": "Disable 2FA.",
+        "description": "**Core call:** `account.disableOtp`\n\n**Command line**\n\n```\ndisable-otp\n```\n\nLogins stop requiring a code immediately.",
+        "tags": [
+          "Two-factor authentication"
+        ],
+        "x-cli": {
+          "command": "disable-otp",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.disableOtp",
+        "x-source": "src/cli/engine/routes/otp.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No content."
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/cancel-otp-reset": {
+      "post": {
+        "operationId": "cancelOtpReset",
+        "summary": "Cancel a pending 2FA reset.",
+        "description": "**Core call:** `account.cancelOtpReset`\n\n**Command line**\n\n```\ncancel-otp-reset\n```\n\nThe defence against somebody else requesting a reset on your account: as long as you cancel before the timer runs out, their reset never lands.",
+        "tags": [
+          "Two-factor authentication"
+        ],
+        "x-cli": {
+          "command": "cancel-otp-reset",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.cancelOtpReset",
+        "x-source": "src/cli/engine/routes/otp.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No content."
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/repair-otp": {
+      "post": {
+        "operationId": "repairOtp",
+        "summary": "Re-point the account at a known 2FA secret.",
+        "description": "**Core call:** `account.repairOtp`\n\n**Command line**\n\n```\nrepair-otp --otp-key=<otpKey>\n```\n\nFor a device whose stored secret has drifted from the server's.",
+        "tags": [
+          "Two-factor authentication"
+        ],
+        "x-cli": {
+          "command": "repair-otp",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.repairOtp",
+        "x-source": "src/cli/engine/routes/otp.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No content."
+          },
+          "default": {
+            "description": "OTP_REQUIRED, BAD_REQUEST",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "otpKey": {
+                    "type": "string",
+                    "description": "The secret the account should use."
+                  }
+                },
+                "required": [
+                  "otpKey"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/pending-vouchers": {
+      "get": {
+        "operationId": "pendingVouchers",
+        "summary": "List pending 2FA vouchers.",
+        "description": "**Core call:** `account.pendingVouchers`\n\n**Command line**\n\n```\npending-vouchers\n```\n\nWhen 2FA blocks a login, the login server issues a voucher that an already-trusted device can approve or reject.",
+        "tags": [
+          "Vouchers"
+        ],
+        "x-cli": {
+          "command": "pending-vouchers",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.pendingVouchers",
+        "x-source": "src/cli/engine/routes/vouchers.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "pendingVouchers": {
+                      "type": "array",
+                      "items": {},
+                      "description": "`EdgePendingVoucher[]`: voucherId, activates, created, deviceDescription, ipDescription."
+                    }
+                  },
+                  "required": [
+                    "pendingVouchers"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/approve-voucher": {
+      "post": {
+        "operationId": "approveVoucher",
+        "summary": "Approve a voucher.",
+        "description": "**Core call:** `account.approveVoucher`\n\n**Command line**\n\n```\napprove-voucher --voucher-id=<voucherId>\n```\n\nLets the waiting device finish logging in.",
+        "tags": [
+          "Vouchers"
+        ],
+        "x-cli": {
+          "command": "approve-voucher",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.approveVoucher",
+        "x-source": "src/cli/engine/routes/vouchers.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No content."
+          },
+          "default": {
+            "description": "BAD_REQUEST, NETWORK_ERROR",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "voucherId": {
+                    "type": "string",
+                    "description": "From `pending-vouchers`, or an `OTP_REQUIRED` error’s `details.voucherId`."
+                  }
+                },
+                "required": [
+                  "voucherId"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/reject-voucher": {
+      "post": {
+        "operationId": "rejectVoucher",
+        "summary": "Reject a voucher.",
+        "description": "**Core call:** `account.rejectVoucher`\n\n**Command line**\n\n```\nreject-voucher --voucher-id=<voucherId>\n```\n\nDenies the waiting device. The login it was issued for cannot complete.",
+        "tags": [
+          "Vouchers"
+        ],
+        "x-cli": {
+          "command": "reject-voucher",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.rejectVoucher",
+        "x-source": "src/cli/engine/routes/vouchers.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No content."
+          },
+          "default": {
+            "description": "BAD_REQUEST, NETWORK_ERROR",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "voucherId": {
+                    "type": "string",
+                    "description": "From `pending-vouchers`, or an `OTP_REQUIRED` error’s `details.voucherId`."
+                  }
+                },
+                "required": [
+                  "voucherId"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/fetch-lobby/{lobbyId}": {
+      "get": {
+        "operationId": "fetchLobby",
+        "summary": "Inspect a login request.",
+        "description": "**Core call:** `account.fetchLobby`\n\n**Command line**\n\n```\nfetch-lobby <lobbyId>\n```\n\nThe other side of `request-edge-login`: shows who is asking, so a human can decide before approving.",
+        "tags": [
+          "Approving a login"
+        ],
+        "x-cli": {
+          "command": "fetch-lobby",
+          "positional": "lobbyId",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.fetchLobby",
+        "x-source": "src/cli/engine/routes/lobby.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "lobbyId",
+            "in": "path",
+            "required": true,
+            "description": "From the QR code, or an `edge://edge/<lobbyId>` link.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "lobbyId": {
+                      "type": "string",
+                      "description": "The lobby that was fetched, echoed back."
+                    },
+                    "loginRequest": {
+                      "anyOf": [
+                        {
+                          "description": "{ appId: string; displayName: string; displayImageDarkUrl: string"
+                        },
+                        {
+                          "description": "null; displayImageLightUrl: string"
+                        },
+                        {
+                          "description": "null; }"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "Null when the lobby carries no pending login request."
+                    }
+                  },
+                  "required": [
+                    "lobbyId",
+                    "loginRequest"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "BAD_REQUEST, NETWORK_ERROR",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/approve-login-request/{lobbyId}": {
+      "post": {
+        "operationId": "approveLoginRequest",
+        "summary": "Approve a login request.",
+        "description": "**Core call:** `EdgeLoginRequest.approve`\n\n**Command line**\n\n```\napprove-login-request <lobbyId>\n```\n\nGrants the requesting device access to this account.",
+        "tags": [
+          "Approving a login"
+        ],
+        "x-cli": {
+          "command": "approve-login-request",
+          "positional": "lobbyId",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "EdgeLoginRequest.approve",
+        "x-core-note": "Reached through account.fetchLobby(lobbyId).loginRequest.",
+        "x-source": "src/cli/engine/routes/lobby.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "lobbyId",
+            "in": "path",
+            "required": true,
+            "description": "From the QR code, or an `edge://edge/<lobbyId>` link.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "ok": {
+                      "type": "boolean",
+                      "description": "Always true; a failure arrives as an error envelope."
+                    }
+                  },
+                  "required": [
+                    "ok"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "NO_LOGIN_REQUEST, BAD_REQUEST, NETWORK_ERROR",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/all-keys": {
+      "get": {
+        "operationId": "allKeys",
+        "summary": "List every key in the account.",
+        "description": "**Core call:** `account.allKeys`\n\n**Command line**\n\n```\nall-keys\n```\n\nIncludes archived and deleted keys, unlike `currency-wallets`.",
+        "tags": [
+          "Keys"
+        ],
+        "x-cli": {
+          "command": "all-keys",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.allKeys",
+        "x-source": "src/cli/engine/routes/keys.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "allKeys": {
+                      "type": "array",
+                      "items": {},
+                      "description": "`EdgeWalletInfoFull[]`: id, type, keys, archived, deleted, hidden, sortIndex."
+                    }
+                  },
+                  "required": [
+                    "allKeys"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/create-wallet": {
+      "post": {
+        "operationId": "createWallet",
+        "summary": "Create a wallet from raw key JSON.",
+        "description": "**Core call:** `account.createWallet`\n\n**Command line**\n\n```\ncreate-wallet --type=<type> [--keys='<json>']\n```\n\nThe import path. Use `create-currency-wallet` to make a fresh wallet with generated keys.",
+        "tags": [
+          "Keys"
+        ],
+        "x-cli": {
+          "command": "create-wallet",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.createWallet",
+        "x-source": "src/cli/engine/routes/keys.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "walletId": {
+                      "type": "string",
+                      "description": "The new wallet. Its keys are already saved."
+                    }
+                  },
+                  "required": [
+                    "walletId"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "BAD_REQUEST",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "type": {
+                    "type": "string",
+                    "description": "Wallet type, e.g. `wallet:bitcoin`."
+                  },
+                  "keys": {
+                    "description": "Plugin key material. Omit to let core generate it."
+                  }
+                },
+                "required": [
+                  "type"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/get-wallet-info": {
+      "get": {
+        "operationId": "getWalletInfo",
+        "summary": "Read one wallet's key info.",
+        "description": "**Core call:** `account.getWalletInfo`\n\n**Command line**\n\n```\nget-wallet-info --id=<id>\n```\n\n",
+        "tags": [
+          "Keys"
+        ],
+        "x-cli": {
+          "command": "get-wallet-info",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.getWalletInfo",
+        "x-source": "src/cli/engine/routes/keys.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "id",
+            "in": "query",
+            "required": true,
+            "description": "The key id, from `all-keys`. Base64, like a wallet id.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "`EdgeWalletInfoFull`, verbatim from core — including the `keys` object.",
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            }
+          },
+          "default": {
+            "description": "WALLET_NOT_FOUND, AMBIGUOUS_WALLET_ID",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/get-raw-private-key": {
+      "get": {
+        "operationId": "getRawPrivateKey",
+        "summary": "Read raw private key material.",
+        "description": "**Core call:** `account.getRawPrivateKey`\n\n**Command line**\n\n```\nget-raw-private-key --wallet-id=<walletId>\n```\n\nSecret. Whatever the plugin stores — seed, mnemonic, xpriv.",
+        "tags": [
+          "Keys"
+        ],
+        "x-cli": {
+          "command": "get-raw-private-key",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.getRawPrivateKey",
+        "x-source": "src/cli/engine/routes/keys.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "walletId",
+            "in": "query",
+            "required": true,
+            "description": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The plugin's key object, at the top level.",
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            }
+          },
+          "default": {
+            "description": "WALLET_NOT_FOUND, AMBIGUOUS_WALLET_ID",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/get-raw-public-key": {
+      "get": {
+        "operationId": "getRawPublicKey",
+        "summary": "Read raw public key material.",
+        "description": "**Core call:** `account.getRawPublicKey`\n\n**Command line**\n\n```\nget-raw-public-key --wallet-id=<walletId>\n```\n\n",
+        "tags": [
+          "Keys"
+        ],
+        "x-cli": {
+          "command": "get-raw-public-key",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.getRawPublicKey",
+        "x-source": "src/cli/engine/routes/keys.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "walletId",
+            "in": "query",
+            "required": true,
+            "description": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The plugin's public key object.",
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            }
+          },
+          "default": {
+            "description": "WALLET_NOT_FOUND, AMBIGUOUS_WALLET_ID",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/get-display-private-key": {
+      "get": {
+        "operationId": "getDisplayPrivateKey",
+        "summary": "Export the private key for display.",
+        "description": "**Core call:** `account.getDisplayPrivateKey`\n\n**Command line**\n\n```\nget-display-private-key --wallet-id=<walletId>\n```\n\nSecret. The human-facing form — WIF, seed phrase, whatever the plugin shows on its export screen.",
+        "tags": [
+          "Keys"
+        ],
+        "x-cli": {
+          "command": "get-display-private-key",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.getDisplayPrivateKey",
+        "x-source": "src/cli/engine/routes/keys.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "walletId",
+            "in": "query",
+            "required": true,
+            "description": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "key": {
+                      "type": "string",
+                      "description": "The displayable private key."
+                    }
+                  },
+                  "required": [
+                    "key"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "WALLET_NOT_FOUND, AMBIGUOUS_WALLET_ID",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/get-display-public-key": {
+      "get": {
+        "operationId": "getDisplayPublicKey",
+        "summary": "Export the public key for display.",
+        "description": "**Core call:** `account.getDisplayPublicKey`\n\n**Command line**\n\n```\nget-display-public-key --wallet-id=<walletId>\n```\n\nThe xpub or equivalent — safe to share for watch-only use.",
+        "tags": [
+          "Keys"
+        ],
+        "x-cli": {
+          "command": "get-display-public-key",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.getDisplayPublicKey",
+        "x-source": "src/cli/engine/routes/keys.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "walletId",
+            "in": "query",
+            "required": true,
+            "description": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "key": {
+                      "type": "string",
+                      "description": "The displayable public key."
+                    }
+                  },
+                  "required": [
+                    "key"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "WALLET_NOT_FOUND, AMBIGUOUS_WALLET_ID",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/list-splittable-wallet-types": {
+      "get": {
+        "operationId": "listSplittableWalletTypes",
+        "summary": "List chains a wallet can split into.",
+        "description": "**Core call:** `account.listSplittableWalletTypes`\n\n**Command line**\n\n```\nlist-splittable-wallet-types --wallet-id=<walletId>\n```\n\nForked-chain support: which wallet types can be derived from these keys.",
+        "tags": [
+          "Keys"
+        ],
+        "x-cli": {
+          "command": "list-splittable-wallet-types",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.listSplittableWalletTypes",
+        "x-source": "src/cli/engine/routes/keys.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "walletId",
+            "in": "query",
+            "required": true,
+            "description": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "walletTypes": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "description": "Types valid for `split`."
+                    }
+                  },
+                  "required": [
+                    "walletTypes"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "WALLET_NOT_FOUND, AMBIGUOUS_WALLET_ID",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/change-wallet-states": {
+      "post": {
+        "operationId": "changeWalletStates",
+        "summary": "Archive, delete, hide, or reorder wallets.",
+        "description": "**Core call:** `account.changeWalletStates`\n\n**Command line**\n\n```\nchange-wallet-states [--wallet-states='<json>'] --wallet-id=<value> [--archived=<value>] [--deleted=<value>] [--hidden=<value>] [--sort-index=<value>]\n```\n\nThe canonical backend for every wallet flag; there are no separate archive, unarchive or undelete verbs.",
+        "tags": [
+          "Keys"
+        ],
+        "x-cli": {
+          "command": "change-wallet-states",
+          "flags": [],
+          "extra": [
+            {
+              "name": "wallet-id",
+              "kind": "string",
+              "required": true,
+              "doc": "The wallet to change. The command makes it the key of a single-entry `walletStates` map."
+            },
+            {
+              "name": "archived",
+              "kind": "boolstr",
+              "required": false,
+              "doc": "Hide from the active list."
+            },
+            {
+              "name": "deleted",
+              "kind": "boolstr",
+              "required": false,
+              "doc": "Mark deleted."
+            },
+            {
+              "name": "hidden",
+              "kind": "boolstr",
+              "required": false,
+              "doc": "Hide from the wallet picker."
+            },
+            {
+              "name": "sort-index",
+              "kind": "string",
+              "required": false,
+              "doc": "Position in the wallet list."
+            }
+          ],
+          "custom": true,
+          "preset": {},
+          "notes": "The command builds a single-wallet `walletStates` map from these flags, and needs at least one."
+        },
+        "x-core-call": "account.changeWalletStates",
+        "x-source": "src/cli/engine/routes/keys.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No content."
+          },
+          "default": {
+            "description": "BAD_REQUEST",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "walletStates": {
+                    "anyOf": [
+                      {
+                        "description": "{ [keys: string]: { archived: boolean"
+                      },
+                      {
+                        "description": "undefined; deleted: boolean"
+                      },
+                      {
+                        "description": "undefined; hidden: boolean"
+                      },
+                      {
+                        "description": "undefined; sortIndex: number"
+                      },
+                      {
+                        "description": "undefined; }; }"
+                      }
+                    ],
+                    "description": "`EdgeWalletStates`: wallet ids to the flags being changed."
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/wallet": {
+      "get": {
+        "operationId": "walletInfo",
+        "summary": "Wallet detail.",
+        "description": "**Core call:** _none — Engine composite of EdgeCurrencyWallet properties plus its EdgeCurrencyConfig token map._\n\n**Command line**\n\n```\nwallet-info --wallet-id=<walletId>\n```\n\n",
+        "tags": [
+          "Wallet state"
+        ],
+        "x-cli": {
+          "command": "wallet-info",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": null,
+        "x-core-note": "Engine composite of EdgeCurrencyWallet properties plus its EdgeCurrencyConfig token map.",
+        "x-source": "src/cli/engine/routes/wallets.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "walletId",
+            "in": "query",
+            "required": true,
+            "description": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Every WalletSummary field, plus denominations, walletSettings and allTokens.",
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            }
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/wallet/rename-wallet": {
+      "post": {
+        "operationId": "renameWallet",
+        "summary": "Rename a wallet.",
+        "description": "**Core call:** `wallet.renameWallet`\n\n**Command line**\n\n```\nrename-wallet --wallet-id=<walletId> --name=<name>\n```\n\n",
+        "tags": [
+          "Wallet state"
+        ],
+        "x-cli": {
+          "command": "rename-wallet",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "wallet.renameWallet",
+        "x-source": "src/cli/engine/routes/wallets.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No content."
+          },
+          "default": {
+            "description": "BAD_REQUEST",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "walletId": {
+                    "type": "string",
+                    "description": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`."
+                  },
+                  "name": {
+                    "type": "string",
+                    "description": "The new display name."
+                  }
+                },
+                "required": [
+                  "walletId",
+                  "name"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/wallet/set-fiat-currency-code": {
+      "post": {
+        "operationId": "setFiatCurrencyCode",
+        "summary": "Change a wallet's fiat currency.",
+        "description": "**Core call:** `wallet.setFiatCurrencyCode`\n\n**Command line**\n\n```\nset-fiat-currency-code --wallet-id=<walletId> --fiat-currency-code=<fiatCurrencyCode>\n```\n\nAffects how balances and history are priced, not the asset itself.",
+        "tags": [
+          "Wallet state"
+        ],
+        "x-cli": {
+          "command": "set-fiat-currency-code",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "wallet.setFiatCurrencyCode",
+        "x-source": "src/cli/engine/routes/wallets.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No content."
+          },
+          "default": {
+            "description": "BAD_REQUEST",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "walletId": {
+                    "type": "string",
+                    "description": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`."
+                  },
+                  "fiatCurrencyCode": {
+                    "type": "string",
+                    "description": "e.g. `iso:EUR`."
+                  }
+                },
+                "required": [
+                  "walletId",
+                  "fiatCurrencyCode"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/wallet/change-paused": {
+      "post": {
+        "operationId": "changePaused",
+        "summary": "Pause or resume a wallet engine.",
+        "description": "**Core call:** `wallet.changePaused`\n\n**Command line**\n\n```\nchange-paused --wallet-id=<walletId> --paused=true|false\n```\n\nA paused wallet stops syncing, which is how a caller quiets a chain it does not currently care about.",
+        "tags": [
+          "Wallet state"
+        ],
+        "x-cli": {
+          "command": "change-paused",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "wallet.changePaused",
+        "x-source": "src/cli/engine/routes/wallets.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No content."
+          },
+          "default": {
+            "description": "BAD_REQUEST",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "walletId": {
+                    "type": "string",
+                    "description": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`."
+                  },
+                  "paused": {
+                    "type": "boolean",
+                    "description": "True to stop syncing."
+                  }
+                },
+                "required": [
+                  "walletId",
+                  "paused"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/wallet/sync": {
+      "post": {
+        "operationId": "walletSync",
+        "summary": "Nudge one wallet to sync.",
+        "description": "**Core call:** `wallet.sync`\n\n**Command line**\n\n```\nwallet-sync --wallet-id=<walletId>\n```\n\n",
+        "tags": [
+          "Wallet state"
+        ],
+        "x-cli": {
+          "command": "wallet-sync",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "wallet.sync",
+        "x-source": "src/cli/engine/routes/wallets.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No content."
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "walletId": {
+                    "type": "string",
+                    "description": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`."
+                  }
+                },
+                "required": [
+                  "walletId"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/wallet/resync-blockchain": {
+      "post": {
+        "operationId": "resyncBlockchain",
+        "summary": "Rescan the blockchain from scratch.",
+        "description": "**Core call:** `wallet.resyncBlockchain`\n\n**Command line**\n\n```\nresync-blockchain --wallet-id=<walletId>\n```\n\nDrops cached chain state and re-scans. Expensive, and the wallet reports an incomplete balance until it finishes.",
+        "tags": [
+          "Wallet state"
+        ],
+        "x-cli": {
+          "command": "resync-blockchain",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "wallet.resyncBlockchain",
+        "x-source": "src/cli/engine/routes/wallets.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No content."
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "walletId": {
+                    "type": "string",
+                    "description": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`."
+                  }
+                },
+                "required": [
+                  "walletId"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/wallet/split": {
+      "post": {
+        "operationId": "splitWallet",
+        "summary": "Split a wallet into another chain.",
+        "description": "**Core call:** `wallet.split`\n\n**Command line**\n\n```\nsplit --wallet-id=<walletId> --split-wallets='<json>'\n```\n\nForked-chain support: derive a wallet of a different type from the same keys. `list-splittable-wallet-types` says which are valid.",
+        "tags": [
+          "Wallet state"
+        ],
+        "x-cli": {
+          "command": "split",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "wallet.split",
+        "x-source": "src/cli/engine/routes/wallets.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "results": {
+                      "type": "array",
+                      "items": {},
+                      "description": "Per-entry outcomes, like batch create."
+                    }
+                  },
+                  "required": [
+                    "results"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "BAD_REQUEST",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "walletId": {
+                    "type": "string",
+                    "description": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`."
+                  },
+                  "splitWallets": {
+                    "type": "array",
+                    "items": {},
+                    "description": "`EdgeSplitCurrencyWallet[]`: walletType, name, fiatCurrencyCode."
+                  }
+                },
+                "required": [
+                  "walletId",
+                  "splitWallets"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/wallet/dump-data": {
+      "get": {
+        "operationId": "dumpData",
+        "summary": "Dump wallet engine state.",
+        "description": "**Core call:** `wallet.dumpData`\n\n**Command line**\n\n```\ndump-data --wallet-id=<walletId>\n```\n\nPlugin-defined debug output. Shape varies by plugin and can be very large.",
+        "tags": [
+          "Wallet state"
+        ],
+        "x-cli": {
+          "command": "dump-data",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "wallet.dumpData",
+        "x-source": "src/cli/engine/routes/wallets.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "walletId",
+            "in": "query",
+            "required": true,
+            "description": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "`EdgeDataDump`, straight from the plugin.",
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            }
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/wallet/balance-map": {
+      "get": {
+        "operationId": "balanceMap",
+        "summary": "Balances for every asset in the wallet.",
+        "description": "**Core call:** `wallet.balanceMap`\n\n**Command line**\n\n```\nbalance-map --wallet-id=<walletId> [--token-id=<value>]\n```\n\nThe native currency plus every enabled token.",
+        "tags": [
+          "Wallet state"
+        ],
+        "x-cli": {
+          "command": "balance-map",
+          "flags": [],
+          "extra": [
+            {
+              "name": "token-id",
+              "kind": "string",
+              "required": false,
+              "doc": "Client-side filter; core has no single-balance accessor."
+            }
+          ],
+          "custom": true,
+          "preset": {}
+        },
+        "x-core-call": "wallet.balanceMap",
+        "x-core-note": "Rendered as an array, with currencyCode and displayAmount added from the wallet's denominations.",
+        "x-source": "src/cli/engine/routes/wallets.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "walletId",
+            "in": "query",
+            "required": true,
+            "description": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "balances": {
+                      "type": "array",
+                      "items": {
+                        "anyOf": [
+                          {
+                            "description": "{ tokenId: string"
+                          },
+                          {
+                            "description": "null; currencyCode: string; nativeAmount: string; displayAmount: string; }"
+                          }
+                        ]
+                      },
+                      "description": "One entry per asset the wallet holds, native coin first."
+                    }
+                  },
+                  "required": [
+                    "balances"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/wallet/get-addresses": {
+      "get": {
+        "operationId": "getAddresses",
+        "summary": "Receive addresses.",
+        "description": "**Core call:** `wallet.getAddresses`\n\n**Command line**\n\n```\nget-addresses --wallet-id=<walletId> [--token-id=<tokenId>] [--force-index=<forceIndex>]\n```\n\n",
+        "tags": [
+          "Wallet state"
+        ],
+        "x-cli": {
+          "command": "get-addresses",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "wallet.getAddresses",
+        "x-source": "src/cli/engine/routes/wallets.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "walletId",
+            "in": "query",
+            "required": true,
+            "description": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "tokenId",
+            "in": "query",
+            "required": false,
+            "description": "Defaults to the native asset.",
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ]
+            }
+          },
+          {
+            "name": "forceIndex",
+            "in": "query",
+            "required": false,
+            "description": "Derive at a specific index.",
+            "schema": {
+              "type": "number"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "addresses": {
+                      "type": "array",
+                      "items": {},
+                      "description": "`EdgeAddress[]`: addressType, publicAddress, nativeBalance."
+                    }
+                  },
+                  "required": [
+                    "addresses"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/wallet/tokens": {
+      "get": {
+        "operationId": "walletTokens",
+        "summary": "List a wallet's tokens.",
+        "description": "**Core call:** _none — Engine composite of the EdgeCurrencyConfig token maps plus wallet.enabledTokenIds and wallet.detectedTokenIds._\n\n**Command line**\n\n```\nwallet-tokens --wallet-id=<walletId>\n```\n\n\"Enabled\" tokens are the ones the wallet syncs balances for; \"detected\" ones were seen on-chain but are not yet enabled.",
+        "tags": [
+          "Tokens"
+        ],
+        "x-cli": {
+          "command": "wallet-tokens",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": null,
+        "x-core-note": "Engine composite of the EdgeCurrencyConfig token maps plus wallet.enabledTokenIds and wallet.detectedTokenIds.",
+        "x-source": "src/cli/engine/routes/tokens.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "walletId",
+            "in": "query",
+            "required": true,
+            "description": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "allTokens": {
+                      "description": "Built-in and custom together, keyed by tokenId. Large on EVM chains."
+                    },
+                    "builtinTokens": {
+                      "description": "`EdgeToken` by tokenId: everything the plugin ships with."
+                    },
+                    "customTokens": {
+                      "description": "`EdgeToken` by tokenId: tokens this account added by hand."
+                    },
+                    "enabledTokenIds": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "description": "Which of the above the wallet is actually tracking."
+                    },
+                    "detectedTokenIds": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "description": "Seen on-chain but not enabled, so their balances are not synced."
+                    }
+                  },
+                  "required": [
+                    "allTokens",
+                    "builtinTokens",
+                    "customTokens",
+                    "enabledTokenIds",
+                    "detectedTokenIds"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "WALLET_NOT_FOUND, AMBIGUOUS_WALLET_ID",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/wallet/change-enabled-token-ids": {
+      "post": {
+        "operationId": "changeEnabledTokenIds",
+        "summary": "Set the enabled token set.",
+        "description": "**Core call:** `wallet.changeEnabledTokenIds`\n\n**Command line**\n\n```\nchange-enabled-token-ids --wallet-id=<walletId> --token-ids='<json>' [--add=<value>] [--remove=<value>]\n```\n\nAbsolute: anything missing from `tokenIds` is disabled. Core has only this setter, so there is no add or remove call.",
+        "tags": [
+          "Tokens"
+        ],
+        "x-cli": {
+          "command": "change-enabled-token-ids",
+          "flags": [],
+          "extra": [
+            {
+              "name": "add",
+              "kind": "repeat",
+              "required": false,
+              "doc": "Read the current set, add this id, write it back."
+            },
+            {
+              "name": "remove",
+              "kind": "repeat",
+              "required": false,
+              "doc": "Read the current set, drop this id, write it back."
+            }
+          ],
+          "custom": true,
+          "preset": {}
+        },
+        "x-core-call": "wallet.changeEnabledTokenIds",
+        "x-source": "src/cli/engine/routes/tokens.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "enabledTokenIds": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "description": "The wallet’s enabled tokens after the change, not just what changed."
+                    }
+                  },
+                  "required": [
+                    "enabledTokenIds"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "BAD_REQUEST, WALLET_NOT_FOUND, AMBIGUOUS_WALLET_ID",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "walletId": {
+                    "type": "string",
+                    "description": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`."
+                  },
+                  "tokenIds": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    },
+                    "description": "The complete desired set."
+                  }
+                },
+                "required": [
+                  "walletId",
+                  "tokenIds"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/wallet/get-transactions": {
+      "get": {
+        "operationId": "getTransactions",
+        "summary": "List or export a wallet's transactions.",
+        "description": "**Core call:** `wallet.getTransactions`\n\n**Command line**\n\n```\nget-transactions --wallet-id=<walletId> [--token-id=<tokenId>] [--limit=<limit>] [--offset=<offset>] [--start-date=<startDate>] [--end-date=<endDate>] [--search-string=<searchString>] [--spam-threshold=<spamThreshold>] [--fiat=<fiat>] [--export-format=<exportFormat>] [--bitwave-account=<bitwaveAccountId>] [--out=<value>]\n```\n\nReads history, overlays the display metadata the GUI shows, fills historical fiat, and optionally formats the result — all on this one call.",
+        "tags": [
+          "Transactions"
+        ],
+        "x-cli": {
+          "command": "get-transactions",
+          "flags": [
+            {
+              "name": "bitwave-account",
+              "maps": "bitwaveAccountId",
+              "repeat": false
+            }
+          ],
+          "extra": [
+            {
+              "name": "out",
+              "kind": "string",
+              "required": false,
+              "requiredWith": "exportFormat",
+              "doc": "Where to write the returned files. One format: the path. Several: a stem, plus .csv / .qbo / .bitwave.csv."
+            }
+          ],
+          "custom": true,
+          "preset": {}
+        },
+        "x-core-call": "wallet.getTransactions",
+        "x-source": "src/cli/engine/routes/transactions.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "walletId",
+            "in": "query",
+            "required": true,
+            "description": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "tokenId",
+            "in": "query",
+            "required": false,
+            "description": "Defaults to the native asset.",
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ]
+            }
+          },
+          {
+            "name": "limit",
+            "in": "query",
+            "required": false,
+            "description": "Omitting it returns every transaction from `offset` on.",
+            "schema": {
+              "type": "number"
+            }
+          },
+          {
+            "name": "offset",
+            "in": "query",
+            "required": false,
+            "description": "Where to start. Defaults to 0.",
+            "schema": {
+              "type": "number"
+            }
+          },
+          {
+            "name": "startDate",
+            "in": "query",
+            "required": false,
+            "description": "ISO-8601, or epoch milliseconds.",
+            "schema": {
+              "description": "Date"
+            }
+          },
+          {
+            "name": "endDate",
+            "in": "query",
+            "required": false,
+            "description": "ISO-8601, or epoch milliseconds.",
+            "schema": {
+              "description": "Date"
+            }
+          },
+          {
+            "name": "searchString",
+            "in": "query",
+            "required": false,
+            "description": "Matches payee, category, notes and txid.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "spamThreshold",
+            "in": "query",
+            "required": false,
+            "description": "Native-amount floor. Omitted, the account spam-filter setting applies; passing it always overrides.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "fiat",
+            "in": "query",
+            "required": false,
+            "description": "Three-letter ISO 4217 code. Defaults to the account defaultIsoFiat.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "exportFormat",
+            "in": "query",
+            "required": false,
+            "description": "Comma list of `csv`, `qbo`, `bitwave`.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "bitwaveAccountId",
+            "in": "query",
+            "required": false,
+            "description": "A 400 unless `exportFormat` includes `bitwave`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "`{ transactions, total, isoFiat }`, or `{ ok, isoFiat, total, files }` when exportFormat is set.",
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            }
+          },
+          "default": {
+            "description": "BAD_REQUEST, MISSING_BITWAVE_ACCOUNT_ID, WALLET_NOT_FOUND, AMBIGUOUS_WALLET_ID",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/wallet/get-num-transactions": {
+      "get": {
+        "operationId": "getNumTransactions",
+        "summary": "Count transactions in a wallet.",
+        "description": "**Core call:** `wallet.getNumTransactions`\n\n**Command line**\n\n```\nget-num-transactions --wallet-id=<walletId> [--token-id=<tokenId>]\n```\n\nCheaper than listing when only the total matters.",
+        "tags": [
+          "Transactions"
+        ],
+        "x-cli": {
+          "command": "get-num-transactions",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "wallet.getNumTransactions",
+        "x-source": "src/cli/engine/routes/transactions.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "walletId",
+            "in": "query",
+            "required": true,
+            "description": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "tokenId",
+            "in": "query",
+            "required": false,
+            "description": "Defaults to the native asset.",
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ]
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "numTransactions": {
+                      "type": "number",
+                      "description": "Every transaction the wallet knows of."
+                    }
+                  },
+                  "required": [
+                    "numTransactions"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "WALLET_NOT_FOUND, AMBIGUOUS_WALLET_ID",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/wallet/save-tx-metadata": {
+      "post": {
+        "operationId": "saveTxMetadata",
+        "summary": "Save transaction metadata.",
+        "description": "**Core call:** `wallet.saveTxMetadata`\n\n**Command line**\n\n```\nsave-tx-metadata --wallet-id=<walletId> --txid=<txid> [--token-id=<tokenId>] --metadata='<json>'\n```\n\nOne of only two routes that write transaction metadata to disk.",
+        "tags": [
+          "Transactions"
+        ],
+        "x-cli": {
+          "command": "save-tx-metadata",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "wallet.saveTxMetadata",
+        "x-source": "src/cli/engine/routes/transactions.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No content."
+          },
+          "default": {
+            "description": "BAD_REQUEST, WALLET_NOT_FOUND, AMBIGUOUS_WALLET_ID",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "walletId": {
+                    "type": "string",
+                    "description": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`."
+                  },
+                  "txid": {
+                    "type": "string",
+                    "description": "Which transaction to tag."
+                  },
+                  "tokenId": {
+                    "anyOf": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ],
+                    "description": "Defaults to the native asset."
+                  },
+                  "metadata": {
+                    "description": "`EdgeMetadataChange`: name, category, notes, exchangeAmount."
+                  }
+                },
+                "required": [
+                  "walletId",
+                  "txid",
+                  "metadata"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/wallet/save-tx-action": {
+      "post": {
+        "operationId": "saveTxAction",
+        "summary": "Save a transaction action.",
+        "description": "**Core call:** `wallet.saveTxAction`\n\n**Command line**\n\n```\nsave-tx-action --wallet-id=<walletId> --txid=<txid> [--token-id=<tokenId>] --saved-action='<json>' [--asset-action='<json>']\n```\n\nRecords what a transaction *was* — a swap, a stake — beyond its metadata.",
+        "tags": [
+          "Transactions"
+        ],
+        "x-cli": {
+          "command": "save-tx-action",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "wallet.saveTxAction",
+        "x-source": "src/cli/engine/routes/transactions.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No content."
+          },
+          "default": {
+            "description": "BAD_REQUEST, WALLET_NOT_FOUND, AMBIGUOUS_WALLET_ID",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "walletId": {
+                    "type": "string",
+                    "description": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`."
+                  },
+                  "txid": {
+                    "type": "string",
+                    "description": "Which transaction to annotate."
+                  },
+                  "tokenId": {
+                    "anyOf": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ],
+                    "description": "Defaults to the native asset."
+                  },
+                  "savedAction": {
+                    "description": "`EdgeTxAction` describing what happened."
+                  },
+                  "assetAction": {
+                    "description": "`EdgeAssetAction`."
+                  }
+                },
+                "required": [
+                  "walletId",
+                  "txid",
+                  "savedAction"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/object/{objectId}": {
+      "get": {
+        "operationId": "getObject",
+        "summary": "Inspect an object handle.",
+        "description": "**Core call:** _none — Engine handle store; core identifies these values by object reference._\n\n**Command line**\n\n```\nobject-get <objectId>\n```\n\nWorks for every kind: transactions, pending logins, swap quotes.",
+        "tags": [
+          "Object handles"
+        ],
+        "x-cli": {
+          "command": "object-get",
+          "positional": "objectId",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": null,
+        "x-core-note": "Engine handle store; core identifies these values by object reference.",
+        "x-source": "src/cli/engine/routes/objects.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "objectId",
+            "in": "path",
+            "required": true,
+            "description": "An ephemeral object handle id.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The handle fields, plus a `value` holding the live core object.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "objectId": {
+                      "type": "string",
+                      "description": "Handle for the value the engine is holding. Pass it to the calls that consume it."
+                    },
+                    "kind": {
+                      "type": "string",
+                      "description": "What the handle refers to, which decides the calls that accept it."
+                    },
+                    "expiresAt": {
+                      "type": "string",
+                      "description": "When the engine drops the handle. Handles live 5 minutes."
+                    },
+                    "sessionId": {
+                      "type": "string",
+                      "description": "Session that created the handle; only that session may use it."
+                    },
+                    "walletId": {
+                      "type": "string",
+                      "description": "Wallet the handle is bound to, when it belongs to one."
+                    }
+                  },
+                  "required": [
+                    "objectId",
+                    "kind",
+                    "expiresAt"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "OBJECT_NOT_FOUND, OBJECT_EXPIRED, OBJECT_SESSION_MISMATCH",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/object/delete/{objectId}": {
+      "post": {
+        "operationId": "deleteObject",
+        "summary": "Release an object handle.",
+        "description": "**Core call:** _none — Engine handle store._\n\n**Command line**\n\n```\nobject-delete <objectId>\n```\n\nRuns the handle's cleanup — closing a swap quote, cancelling a pending login — instead of waiting out the TTL.",
+        "tags": [
+          "Object handles"
+        ],
+        "x-cli": {
+          "command": "object-delete",
+          "positional": "objectId",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": null,
+        "x-core-note": "Engine handle store.",
+        "x-source": "src/cli/engine/routes/objects.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "objectId",
+            "in": "path",
+            "required": true,
+            "description": "An ephemeral object handle id.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "ok": {
+                      "type": "boolean",
+                      "description": "Always true; a failure arrives as an error envelope."
+                    },
+                    "objectId": {
+                      "type": "string",
+                      "description": "The handle this call consumed. It is now expired."
+                    }
+                  },
+                  "required": [
+                    "ok",
+                    "objectId"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "OBJECT_NOT_FOUND, OBJECT_EXPIRED, OBJECT_SESSION_MISMATCH",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/wallet/get-max-spendable": {
+      "post": {
+        "operationId": "getMaxSpendable",
+        "summary": "Largest sendable amount.",
+        "description": "**Core call:** `wallet.getMaxSpendable`\n\n**Command line**\n\n```\nget-max-spendable --wallet-id=<walletId> [--spend-info='<json>'] [--to=<to>] [--native-amount=<nativeAmount>] [--amount=<amount>] [--token-id=<tokenId>] [--metadata='<json>']\n```\n\nWhat empties the wallet after fees. A destination is still required, since fees depend on it.",
+        "tags": [
+          "Spending"
+        ],
+        "x-cli": {
+          "command": "get-max-spendable",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "wallet.getMaxSpendable",
+        "x-source": "src/cli/engine/routes/spend.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "nativeAmount": {
+                      "type": "string",
+                      "description": "The most this wallet can send."
+                    }
+                  },
+                  "required": [
+                    "nativeAmount"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "INSUFFICIENT_FUNDS, BAD_REQUEST, NETWORK_ERROR",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "walletId": {
+                    "type": "string",
+                    "description": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`."
+                  },
+                  "spendInfo": {
+                    "description": "A full `EdgeSpendInfo`, used as-is when present."
+                  },
+                  "to": {
+                    "type": "string",
+                    "description": "Address or BIP21 URI, run through `wallet.parseUri`."
+                  },
+                  "nativeAmount": {
+                    "type": "string",
+                    "description": "How much, in native units."
+                  },
+                  "amount": {
+                    "type": "string",
+                    "description": "Alias of `nativeAmount`."
+                  },
+                  "tokenId": {
+                    "anyOf": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ],
+                    "description": "Defaults to the native asset."
+                  },
+                  "metadata": {
+                    "description": "Wins over anything parsed out of the URI."
+                  }
+                },
+                "required": [
+                  "walletId"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/wallet/spend": {
+      "post": {
+        "operationId": "spend",
+        "summary": "Send funds.",
+        "description": "**Core call:** _none — GUI composite: makeSpend, signTx, broadcastTx and saveTx together._\n\n**Command line**\n\n```\nspend --wallet-id=<walletId> [--spend-info='<json>'] [--to=<to>] [--native-amount=<nativeAmount>] [--amount=<amount>] [--token-id=<tokenId>] [--metadata='<json>'] [--use-max] [--dry-run] [--broadcast] [--save]\n```\n\n`makeSpend`, then `signTx`, then optionally `broadcastTx` and `saveTx`, in one request. `broadcast` and `save` both default to true, so a bare body with a destination and an amount moves real money. A completed spend leaves no handle behind.",
+        "tags": [
+          "Spending"
+        ],
+        "x-cli": {
+          "command": "spend",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": null,
+        "x-core-note": "GUI composite: makeSpend, signTx, broadcastTx and saveTx together.",
+        "x-source": "src/cli/engine/routes/spend.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "`{ transaction }`, plus `saveError` when the broadcast succeeded but saving failed. With dryRun, a TransactionHandle instead.",
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            }
+          },
+          "default": {
+            "description": "INSUFFICIENT_FUNDS, DUST_SPEND, PENDING_FUNDS, SPEND_TO_SELF, NO_AMOUNT_SPECIFIED, BAD_REQUEST, NETWORK_ERROR",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "walletId": {
+                    "type": "string",
+                    "description": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`."
+                  },
+                  "spendInfo": {
+                    "description": "A full `EdgeSpendInfo`, used as-is when present."
+                  },
+                  "to": {
+                    "type": "string",
+                    "description": "Address or BIP21 URI, run through `wallet.parseUri`."
+                  },
+                  "nativeAmount": {
+                    "type": "string",
+                    "description": "How much, in native units."
+                  },
+                  "amount": {
+                    "type": "string",
+                    "description": "Alias of `nativeAmount`."
+                  },
+                  "tokenId": {
+                    "anyOf": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ],
+                    "description": "Defaults to the native asset."
+                  },
+                  "metadata": {
+                    "description": "Wins over anything parsed out of the URI."
+                  },
+                  "useMax": {
+                    "type": "boolean",
+                    "description": "Replace the first target's amount with the maximum."
+                  },
+                  "dryRun": {
+                    "type": "boolean",
+                    "description": "Build only. Never signs or broadcasts."
+                  },
+                  "broadcast": {
+                    "type": "boolean",
+                    "description": "Defaults to **true**."
+                  },
+                  "save": {
+                    "type": "boolean",
+                    "description": "Defaults to **true**."
+                  }
+                },
+                "required": [
+                  "walletId"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/wallet/make-spend": {
+      "post": {
+        "operationId": "makeSpend",
+        "summary": "Build an unsigned transaction.",
+        "description": "**Core call:** `wallet.makeSpend`\n\n**Command line**\n\n```\nmake-spend --wallet-id=<walletId> [--spend-info='<json>'] [--to=<to>] [--native-amount=<nativeAmount>] [--amount=<amount>] [--token-id=<tokenId>] [--metadata='<json>']\n```\n\nFirst step of the staged workflow: nothing is signed and no funds move. Inspect `transaction.networkFee` on the result before signing.",
+        "tags": [
+          "Spending"
+        ],
+        "x-cli": {
+          "command": "make-spend",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "wallet.makeSpend",
+        "x-source": "src/cli/engine/routes/spend.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "objectId": {
+                      "type": "string",
+                      "description": "Handle for the value the engine is holding. Pass it to the calls that consume it."
+                    },
+                    "kind": {
+                      "type": "string",
+                      "description": "What the handle refers to, which decides the calls that accept it."
+                    },
+                    "expiresAt": {
+                      "type": "string",
+                      "description": "When the engine drops the handle. Handles live 5 minutes."
+                    },
+                    "sessionId": {
+                      "type": "string",
+                      "description": "Session that created the handle; only that session may use it."
+                    },
+                    "walletId": {
+                      "type": "string",
+                      "description": "Wallet the handle is bound to, when it belongs to one."
+                    },
+                    "transaction": {
+                      "description": "`EdgeTransaction` as it stands after this step. Unsigned after `make-spend`, signed after `sign-tx`, and carrying a txid once broadcast."
+                    }
+                  },
+                  "required": [
+                    "objectId",
+                    "kind",
+                    "expiresAt",
+                    "transaction"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "INSUFFICIENT_FUNDS, DUST_SPEND, NO_AMOUNT_SPECIFIED, BAD_REQUEST",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "walletId": {
+                    "type": "string",
+                    "description": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`."
+                  },
+                  "spendInfo": {
+                    "description": "A full `EdgeSpendInfo`, used as-is when present."
+                  },
+                  "to": {
+                    "type": "string",
+                    "description": "Address or BIP21 URI, run through `wallet.parseUri`."
+                  },
+                  "nativeAmount": {
+                    "type": "string",
+                    "description": "How much, in native units."
+                  },
+                  "amount": {
+                    "type": "string",
+                    "description": "Alias of `nativeAmount`."
+                  },
+                  "tokenId": {
+                    "anyOf": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ],
+                    "description": "Defaults to the native asset."
+                  },
+                  "metadata": {
+                    "description": "Wins over anything parsed out of the URI."
+                  }
+                },
+                "required": [
+                  "walletId"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/sign-tx/{objectId}": {
+      "post": {
+        "operationId": "signTx",
+        "summary": "Sign a staged transaction.",
+        "description": "**Core call:** `wallet.signTx`\n\n**Command line**\n\n```\nsign-tx <objectId>\n```\n\nKeeps the same handle and pushes its expiry out another five minutes.",
+        "tags": [
+          "Spending"
+        ],
+        "x-cli": {
+          "command": "sign-tx",
+          "positional": "objectId",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "wallet.signTx",
+        "x-source": "src/cli/engine/routes/spend.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "objectId",
+            "in": "path",
+            "required": true,
+            "description": "From `make-spend`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "objectId": {
+                      "type": "string",
+                      "description": "Handle for the value the engine is holding. Pass it to the calls that consume it."
+                    },
+                    "kind": {
+                      "type": "string",
+                      "description": "What the handle refers to, which decides the calls that accept it."
+                    },
+                    "expiresAt": {
+                      "type": "string",
+                      "description": "When the engine drops the handle. Handles live 5 minutes."
+                    },
+                    "sessionId": {
+                      "type": "string",
+                      "description": "Session that created the handle; only that session may use it."
+                    },
+                    "walletId": {
+                      "type": "string",
+                      "description": "Wallet the handle is bound to, when it belongs to one."
+                    },
+                    "transaction": {
+                      "description": "`EdgeTransaction` as it stands after this step. Unsigned after `make-spend`, signed after `sign-tx`, and carrying a txid once broadcast."
+                    }
+                  },
+                  "required": [
+                    "objectId",
+                    "kind",
+                    "expiresAt",
+                    "transaction"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "BAD_REQUEST",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/broadcast-tx/{objectId}": {
+      "post": {
+        "operationId": "broadcastTx",
+        "summary": "Broadcast a signed transaction.",
+        "description": "**Core call:** `wallet.broadcastTx`\n\n**Command line**\n\n```\nbroadcast-tx <objectId>\n```\n\nThe irreversible step: once this returns, the funds have left the wallet.",
+        "tags": [
+          "Spending"
+        ],
+        "x-cli": {
+          "command": "broadcast-tx",
+          "positional": "objectId",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "wallet.broadcastTx",
+        "x-source": "src/cli/engine/routes/spend.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "objectId",
+            "in": "path",
+            "required": true,
+            "description": "From `sign-tx`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The handle survives, so `save-tx` can still run.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "objectId": {
+                      "type": "string",
+                      "description": "Handle for the value the engine is holding. Pass it to the calls that consume it."
+                    },
+                    "kind": {
+                      "type": "string",
+                      "description": "What the handle refers to, which decides the calls that accept it."
+                    },
+                    "expiresAt": {
+                      "type": "string",
+                      "description": "When the engine drops the handle. Handles live 5 minutes."
+                    },
+                    "sessionId": {
+                      "type": "string",
+                      "description": "Session that created the handle; only that session may use it."
+                    },
+                    "walletId": {
+                      "type": "string",
+                      "description": "Wallet the handle is bound to, when it belongs to one."
+                    },
+                    "transaction": {
+                      "description": "`EdgeTransaction` as it stands after this step. Unsigned after `make-spend`, signed after `sign-tx`, and carrying a txid once broadcast."
+                    }
+                  },
+                  "required": [
+                    "objectId",
+                    "kind",
+                    "expiresAt",
+                    "transaction"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "BAD_REQUEST, NETWORK_ERROR",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/save-tx/{objectId}": {
+      "post": {
+        "operationId": "saveTx",
+        "summary": "Record a transaction and release its handle.",
+        "description": "**Core call:** `wallet.saveTx`\n\n**Command line**\n\n```\nsave-tx <objectId>\n```\n\nFinal step. The handle is gone afterwards, so a second call is a 404.",
+        "tags": [
+          "Spending"
+        ],
+        "x-cli": {
+          "command": "save-tx",
+          "positional": "objectId",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "wallet.saveTx",
+        "x-source": "src/cli/engine/routes/spend.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "objectId",
+            "in": "path",
+            "required": true,
+            "description": "The handle to persist and release.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "ok": {
+                      "type": "boolean",
+                      "description": "Always true; a failure arrives as an error envelope."
+                    },
+                    "objectId": {
+                      "type": "string",
+                      "description": "The handle this call consumed. It is now expired."
+                    }
+                  },
+                  "required": [
+                    "ok",
+                    "objectId"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "BAD_REQUEST",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/wallet/accelerate": {
+      "post": {
+        "operationId": "accelerate",
+        "summary": "Fee-bump a pending transaction.",
+        "description": "**Core call:** `wallet.accelerate`\n\n**Command line**\n\n```\naccelerate --wallet-id=<walletId> [--object-id=<objectId>] [--transaction='<json>']\n```\n\nReplace-by-fee, where the plugin supports it. Returns a new unsigned transaction to sign and broadcast.",
+        "tags": [
+          "Spending"
+        ],
+        "x-cli": {
+          "command": "accelerate",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "wallet.accelerate",
+        "x-source": "src/cli/engine/routes/spend.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Given objectId the same handle is updated; given a transaction a new one is created.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "objectId": {
+                      "type": "string",
+                      "description": "Handle for the value the engine is holding. Pass it to the calls that consume it."
+                    },
+                    "kind": {
+                      "type": "string",
+                      "description": "What the handle refers to, which decides the calls that accept it."
+                    },
+                    "expiresAt": {
+                      "type": "string",
+                      "description": "When the engine drops the handle. Handles live 5 minutes."
+                    },
+                    "sessionId": {
+                      "type": "string",
+                      "description": "Session that created the handle; only that session may use it."
+                    },
+                    "walletId": {
+                      "type": "string",
+                      "description": "Wallet the handle is bound to, when it belongs to one."
+                    },
+                    "transaction": {
+                      "description": "`EdgeTransaction` as it stands after this step. Unsigned after `make-spend`, signed after `sign-tx`, and carrying a txid once broadcast."
+                    }
+                  },
+                  "required": [
+                    "objectId",
+                    "kind",
+                    "expiresAt",
+                    "transaction"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "BAD_REQUEST",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "walletId": {
+                    "type": "string",
+                    "description": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`."
+                  },
+                  "objectId": {
+                    "type": "string",
+                    "description": "Handle of the transaction to bump."
+                  },
+                  "transaction": {
+                    "description": "Or the transaction itself."
+                  }
+                },
+                "required": [
+                  "walletId"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/wallet/sweep-private-keys": {
+      "post": {
+        "operationId": "sweepPrivateKeys",
+        "summary": "Sweep private keys into this wallet.",
+        "description": "**Core call:** `wallet.sweepPrivateKeys`\n\n**Command line**\n\n```\nsweep-private-keys --wallet-id=<walletId> --spend-info='<json>'\n```\n\nBuilds a transaction moving everything from an external key. Returns an unsigned handle: sign, broadcast and save it like any staged spend.",
+        "tags": [
+          "Spending"
+        ],
+        "x-cli": {
+          "command": "sweep-private-keys",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "wallet.sweepPrivateKeys",
+        "x-source": "src/cli/engine/routes/spend.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "objectId": {
+                      "type": "string",
+                      "description": "Handle for the value the engine is holding. Pass it to the calls that consume it."
+                    },
+                    "kind": {
+                      "type": "string",
+                      "description": "What the handle refers to, which decides the calls that accept it."
+                    },
+                    "expiresAt": {
+                      "type": "string",
+                      "description": "When the engine drops the handle. Handles live 5 minutes."
+                    },
+                    "sessionId": {
+                      "type": "string",
+                      "description": "Session that created the handle; only that session may use it."
+                    },
+                    "walletId": {
+                      "type": "string",
+                      "description": "Wallet the handle is bound to, when it belongs to one."
+                    },
+                    "transaction": {
+                      "description": "`EdgeTransaction` as it stands after this step. Unsigned after `make-spend`, signed after `sign-tx`, and carrying a txid once broadcast."
+                    }
+                  },
+                  "required": [
+                    "objectId",
+                    "kind",
+                    "expiresAt",
+                    "transaction"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "BAD_REQUEST, INSUFFICIENT_FUNDS, NETWORK_ERROR",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "walletId": {
+                    "type": "string",
+                    "description": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`."
+                  },
+                  "spendInfo": {
+                    "description": "A full `EdgeSpendInfo`, with the keys to sweep in `privateKeys`."
+                  }
+                },
+                "required": [
+                  "walletId",
+                  "spendInfo"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/wallet/sign-bytes": {
+      "post": {
+        "operationId": "signBytes",
+        "summary": "Sign arbitrary bytes.",
+        "description": "**Core call:** `wallet.signBytes`\n\n**Command line**\n\n```\nsign-bytes --wallet-id=<walletId> [--bytes=<bytes>] [--other-params='<json>']\n```\n\nMessage signing and proof-of-ownership, for plugins that support it.",
+        "tags": [
+          "Spending"
+        ],
+        "x-cli": {
+          "command": "sign-bytes",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "wallet.signBytes",
+        "x-source": "src/cli/engine/routes/spend.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "signature": {
+                      "type": "string",
+                      "description": "Base64."
+                    }
+                  },
+                  "required": [
+                    "signature"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "BAD_REQUEST",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "walletId": {
+                    "type": "string",
+                    "description": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`."
+                  },
+                  "bytes": {
+                    "type": "string",
+                    "description": "Base64. Defaults to empty when absent."
+                  },
+                  "otherParams": {
+                    "description": "Plugin-specific options. Bitcoin needs `{ publicAddress }`; other plugins take nothing, or refuse the call entirely."
+                  }
+                },
+                "required": [
+                  "walletId"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/wallet/get-payment-protocol-info": {
+      "get": {
+        "operationId": "getPaymentProtocolInfo",
+        "summary": "Fetch a BIP70 payment request.",
+        "description": "**Core call:** `wallet.getPaymentProtocolInfo`\n\n**Command line**\n\n```\nget-payment-protocol-info --wallet-id=<walletId> --payment-protocol-url=<paymentProtocolUrl>\n```\n\nFeed `spendTargets` from the result into `make-spend` to pay it.",
+        "tags": [
+          "Spending"
+        ],
+        "x-cli": {
+          "command": "get-payment-protocol-info",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "wallet.getPaymentProtocolInfo",
+        "x-source": "src/cli/engine/routes/spend.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "walletId",
+            "in": "query",
+            "required": true,
+            "description": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "paymentProtocolUrl",
+            "in": "query",
+            "required": true,
+            "description": "The payment-request URL.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "`EdgePaymentProtocolInfo`: domain, memo, merchant, nativeAmount, spendTargets.",
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            }
+          },
+          "default": {
+            "description": "BAD_REQUEST, NETWORK_ERROR",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/fetch-swap-quotes": {
+      "post": {
+        "operationId": "fetchSwapQuotes",
+        "summary": "Fetch swap quotes.",
+        "description": "**Core call:** `account.fetchSwapQuotes`\n\n**Command line**\n\n```\nfetch-swap-quotes --from-wallet-id=<fromWalletId> --to-wallet-id=<toWalletId> --native-amount=<nativeAmount> [--from-token-id=<fromTokenId>] [--to-token-id=<toTokenId>] [--quote-for=<quoteFor>] [--plugin-id=<preferPluginId>]\n```\n\nPolls every enabled swap plugin and parks each result under its own `swap_` handle with a 5 minute TTL.",
+        "tags": [
+          "Swap quotes"
+        ],
+        "x-cli": {
+          "command": "fetch-swap-quotes",
+          "flags": [
+            {
+              "name": "plugin-id",
+              "maps": "preferPluginId",
+              "repeat": false
+            }
+          ],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.fetchSwapQuotes",
+        "x-source": "src/cli/engine/routes/swap.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "quoteCount": {
+                      "type": "number",
+                      "description": "How many plugins answered."
+                    },
+                    "quotes": {
+                      "type": "array",
+                      "items": {
+                        "anyOf": [
+                          {
+                            "description": "{ objectId: string; kind: string; expiresAt: string; pluginId: string; isEstimate: boolean; canBePartial: boolean"
+                          },
+                          {
+                            "description": "null; maxFulfillmentSeconds: number"
+                          },
+                          {
+                            "description": "null; minReceiveAmount: string"
+                          },
+                          {
+                            "description": "null; fromNativeAmount: string; toNativeAmount: string; networkFee: { nativeAmount: string; tokenId: string"
+                          },
+                          {
+                            "description": "null; }; quoteExpirationDate: string"
+                          },
+                          {
+                            "description": "null; swapInfo: { pluginId: string; displayName: string; supportEmail: string; isDex: boolean"
+                          },
+                          {
+                            "description": "null; }; request: { fromTokenId: string"
+                          },
+                          {
+                            "description": "null; toTokenId: string"
+                          },
+                          {
+                            "description": "null; nativeAmount: string; quoteFor: \"to\""
+                          },
+                          {
+                            "description": "\"from\""
+                          },
+                          {
+                            "description": "\"max\"; fromWalletId: string; toWalletId: string; }; }"
+                          }
+                        ]
+                      },
+                      "description": "One quote per plugin that answered, each already parked under its own handle. Plugins that failed or had nothing to offer are simply absent."
+                    }
+                  },
+                  "required": [
+                    "quoteCount",
+                    "quotes"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "BAD_REQUEST, SWAP_BELOW_LIMIT, SWAP_ABOVE_LIMIT, SWAP_CURRENCY, SWAP_PERMISSION, SWAP_ADDRESS, SAME_CURRENCY, INSUFFICIENT_FUNDS, WALLET_NOT_FOUND, NETWORK_ERROR",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "fromWalletId": {
+                    "type": "string",
+                    "description": "Source wallet. Accepts a unique prefix."
+                  },
+                  "toWalletId": {
+                    "type": "string",
+                    "description": "Destination wallet."
+                  },
+                  "nativeAmount": {
+                    "type": "string",
+                    "description": "How much, in native units."
+                  },
+                  "fromTokenId": {
+                    "anyOf": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ],
+                    "description": "Defaults to the native asset."
+                  },
+                  "toTokenId": {
+                    "anyOf": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ],
+                    "description": "Defaults to the native asset."
+                  },
+                  "quoteFor": {
+                    "type": "string",
+                    "description": "`from` spends this much of the source, `to` receives this much at the destination, `max` sends everything. Defaults to `from`."
+                  },
+                  "preferPluginId": {
+                    "type": "string",
+                    "description": "Restrict to one exchange."
+                  }
+                },
+                "required": [
+                  "fromWalletId",
+                  "toWalletId",
+                  "nativeAmount"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/swap-quote/{objectId}": {
+      "get": {
+        "operationId": "getSwapQuote",
+        "summary": "Re-read a quote.",
+        "description": "**Core call:** _none — Engine handle store; the quote is a live EdgeSwapQuote held server-side._\n\n**Command line**\n\n```\nswap-quote-get <objectId>\n```\n\n",
+        "tags": [
+          "Swap quotes"
+        ],
+        "x-cli": {
+          "command": "swap-quote-get",
+          "positional": "objectId",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": null,
+        "x-core-note": "Engine handle store; the quote is a live EdgeSwapQuote held server-side.",
+        "x-source": "src/cli/engine/routes/swap.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "objectId",
+            "in": "path",
+            "required": true,
+            "description": "An ephemeral object handle id.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "objectId": {
+                      "type": "string",
+                      "description": "Handle for the value the engine is holding. Pass it to the calls that consume it."
+                    },
+                    "kind": {
+                      "type": "string",
+                      "description": "What the handle refers to, which decides the calls that accept it."
+                    },
+                    "expiresAt": {
+                      "type": "string",
+                      "description": "When the engine drops the handle. Handles live 5 minutes."
+                    },
+                    "pluginId": {
+                      "type": "string",
+                      "description": "Swap provider that produced this quote."
+                    },
+                    "isEstimate": {
+                      "type": "boolean",
+                      "description": "True when the provider may settle at a different rate than quoted."
+                    },
+                    "canBePartial": {
+                      "anyOf": [
+                        {
+                          "type": "boolean"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "True when the provider may fill only part of the order. Null when it does not say."
+                    },
+                    "maxFulfillmentSeconds": {
+                      "anyOf": [
+                        {
+                          "type": "number"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "Longest the provider expects a partial fill to take."
+                    },
+                    "minReceiveAmount": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "Least the provider guarantees to deliver, in the destination’s native units."
+                    },
+                    "fromNativeAmount": {
+                      "type": "string",
+                      "description": "Amount leaving the source wallet."
+                    },
+                    "toNativeAmount": {
+                      "type": "string",
+                      "description": "Amount arriving in the destination wallet."
+                    },
+                    "networkFee": {
+                      "anyOf": [
+                        {
+                          "description": "{ nativeAmount: string; tokenId: string"
+                        },
+                        {
+                          "description": "null; }"
+                        }
+                      ],
+                      "description": "On-chain fee for the sending transaction. It is not the provider’s own spread, which is already in the rate."
+                    },
+                    "quoteExpirationDate": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "When the provider stops honouring the rate. Null when it does not expire."
+                    },
+                    "swapInfo": {
+                      "anyOf": [
+                        {
+                          "description": "{ pluginId: string; displayName: string; supportEmail: string; isDex: boolean"
+                        },
+                        {
+                          "description": "null; }"
+                        }
+                      ],
+                      "description": "`EdgeSwapInfo`: how to name the provider and where to send complaints."
+                    },
+                    "request": {
+                      "anyOf": [
+                        {
+                          "description": "{ fromTokenId: string"
+                        },
+                        {
+                          "description": "null; toTokenId: string"
+                        },
+                        {
+                          "description": "null; nativeAmount: string; quoteFor: \"to\""
+                        },
+                        {
+                          "description": "\"from\""
+                        },
+                        {
+                          "description": "\"max\"; fromWalletId: string; toWalletId: string; }"
+                        }
+                      ],
+                      "description": "The `EdgeSwapRequest` this quote answers, echoed back so quotes from different plugins can be compared without tracking what was asked."
+                    }
+                  },
+                  "required": [
+                    "objectId",
+                    "kind",
+                    "expiresAt",
+                    "pluginId",
+                    "isEstimate",
+                    "canBePartial",
+                    "maxFulfillmentSeconds",
+                    "minReceiveAmount",
+                    "fromNativeAmount",
+                    "toNativeAmount",
+                    "networkFee",
+                    "quoteExpirationDate",
+                    "swapInfo",
+                    "request"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "OBJECT_NOT_FOUND, OBJECT_EXPIRED, OBJECT_KIND_MISMATCH, OBJECT_SESSION_MISMATCH",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/swap-quote/approve/{objectId}": {
+      "post": {
+        "operationId": "approveSwapQuote",
+        "summary": "Execute a quote.",
+        "description": "**Core call:** `EdgeSwapQuote.approve`\n\n**Command line**\n\n```\napprove-swap-quote <objectId>\n```\n\nMoves funds. The handle is released afterwards whether or not the response is read, so record `orderId` from it.",
+        "tags": [
+          "Swap quotes"
+        ],
+        "x-cli": {
+          "command": "approve-swap-quote",
+          "positional": "objectId",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "EdgeSwapQuote.approve",
+        "x-source": "src/cli/engine/routes/swap.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "objectId",
+            "in": "path",
+            "required": true,
+            "description": "An ephemeral object handle id.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "ok": {
+                      "description": "True once the swap is submitted and the send broadcast."
+                    },
+                    "objectId": {
+                      "type": "string",
+                      "description": "The handle that was consumed."
+                    },
+                    "orderId": {
+                      "description": "The exchange's order reference, when it gives one."
+                    },
+                    "destinationAddress": {
+                      "description": "Address the funds were sent to, when the exchange reports one."
+                    },
+                    "transaction": {
+                      "description": "The on-chain send to the exchange."
+                    }
+                  },
+                  "required": [
+                    "ok",
+                    "objectId",
+                    "orderId",
+                    "destinationAddress",
+                    "transaction"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "OBJECT_NOT_FOUND, OBJECT_EXPIRED, OBJECT_KIND_MISMATCH, OBJECT_SESSION_MISMATCH, INSUFFICIENT_FUNDS, NETWORK_ERROR",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/swap-quote/close/{objectId}": {
+      "post": {
+        "operationId": "closeSwapQuote",
+        "summary": "Discard a quote.",
+        "description": "**Core call:** `EdgeSwapQuote.close`\n\n**Command line**\n\n```\nclose-swap-quote <objectId>\n```\n\nCloses the plugin object without executing, freeing whatever the exchange was holding.",
+        "tags": [
+          "Swap quotes"
+        ],
+        "x-cli": {
+          "command": "close-swap-quote",
+          "positional": "objectId",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "EdgeSwapQuote.close",
+        "x-source": "src/cli/engine/routes/swap.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "objectId",
+            "in": "path",
+            "required": true,
+            "description": "An ephemeral object handle id.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "ok": {
+                      "type": "boolean",
+                      "description": "Always true; a failure arrives as an error envelope."
+                    },
+                    "objectId": {
+                      "type": "string",
+                      "description": "The handle this call consumed. It is now expired."
+                    }
+                  },
+                  "required": [
+                    "ok",
+                    "objectId"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "OBJECT_NOT_FOUND, OBJECT_EXPIRED, OBJECT_KIND_MISMATCH, OBJECT_SESSION_MISMATCH",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/wallet/parse-uri": {
+      "post": {
+        "operationId": "parseUri",
+        "summary": "Parse a payment URI or address.",
+        "description": "**Core call:** `wallet.parseUri`\n\n**Command line**\n\n```\nparse-uri --wallet-id=<walletId> --uri=<uri> [--currency-code=<currencyCode>]\n```\n\nWhat the GUI address tile does when you paste or scan something.",
+        "tags": [
+          "URIs"
+        ],
+        "x-cli": {
+          "command": "parse-uri",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "wallet.parseUri",
+        "x-source": "src/cli/engine/routes/uri.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "`EdgeParsedUri`: publicAddress, nativeAmount, currencyCode, metadata, paymentProtocolUrl, …",
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            }
+          },
+          "default": {
+            "description": "BAD_REQUEST, WALLET_NOT_FOUND, AMBIGUOUS_WALLET_ID",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "walletId": {
+                    "type": "string",
+                    "description": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`."
+                  },
+                  "uri": {
+                    "type": "string",
+                    "description": "A payment URI or a bare address."
+                  },
+                  "currencyCode": {
+                    "type": "string",
+                    "description": "Disambiguates on chains that carry several assets."
+                  }
+                },
+                "required": [
+                  "walletId",
+                  "uri"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/wallet/encode-uri": {
+      "post": {
+        "operationId": "encodeUri",
+        "summary": "Build a payment URI.",
+        "description": "**Core call:** `wallet.encodeUri`\n\n**Command line**\n\n```\nencode-uri --wallet-id=<walletId> --public-address=<publicAddress> [--native-amount=<nativeAmount>] [--label=<label>] [--message=<message>] [--currency-code=<currencyCode>]\n```\n\nFor a receive screen or a QR code.",
+        "tags": [
+          "URIs"
+        ],
+        "x-cli": {
+          "command": "encode-uri",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "wallet.encodeUri",
+        "x-source": "src/cli/engine/routes/uri.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "uri": {
+                      "type": "string",
+                      "description": "The encoded URI, ready for a QR code."
+                    }
+                  },
+                  "required": [
+                    "uri"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "BAD_REQUEST, WALLET_NOT_FOUND, AMBIGUOUS_WALLET_ID",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "walletId": {
+                    "type": "string",
+                    "description": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`."
+                  },
+                  "publicAddress": {
+                    "type": "string",
+                    "description": "Where the payment should go."
+                  },
+                  "nativeAmount": {
+                    "type": "string",
+                    "description": "Amount, in the native unit."
+                  },
+                  "label": {
+                    "type": "string",
+                    "description": "BIP21 `label`; becomes `metadata.name` when parsed back."
+                  },
+                  "message": {
+                    "type": "string",
+                    "description": "BIP21 `message`; becomes `metadata.notes`."
+                  },
+                  "currencyCode": {
+                    "type": "string",
+                    "description": "Disambiguates on chains that carry several assets."
+                  }
+                },
+                "required": [
+                  "walletId",
+                  "publicAddress"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/rates/query": {
+      "post": {
+        "operationId": "ratesQuery",
+        "summary": "Batch crypto and fiat rate lookups.",
+        "description": "**Core call:** _none — GUI code (src/util/exchangeRates): getHistoricalCryptoRate and getHistoricalFiatRate._\n\n**Command line**\n\n```\nrates-query [--crypto='<json>'] [--fiat='<json>']\n```\n\nConcurrent lookups share one rates-server queue, so asking for many rates at once costs a single upstream request.",
+        "tags": [
+          "Exchange rates"
+        ],
+        "x-cli": {
+          "command": "rates-query",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": null,
+        "x-core-note": "GUI code (src/util/exchangeRates): getHistoricalCryptoRate and getHistoricalFiatRate.",
+        "x-source": "src/cli/engine/routes/rates.ts",
+        "parameters": [],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "crypto": {
+                      "type": "array",
+                      "items": {
+                        "anyOf": [
+                          {
+                            "description": "{ pluginId: string; tokenId: string"
+                          },
+                          {
+                            "description": "null; targetFiat: string; date: string; rate: number; }"
+                          }
+                        ]
+                      },
+                      "description": "Always present; empty when no crypto rates were requested."
+                    },
+                    "fiat": {
+                      "type": "array",
+                      "items": {
+                        "description": "{ fiatCode: string; targetFiat: string; date: string; rate: number; }"
+                      },
+                      "description": "Always present; empty when no fiat rates were requested."
+                    }
+                  },
+                  "required": [
+                    "crypto",
+                    "fiat"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "BAD_REQUEST, NETWORK_ERROR",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "crypto": {
+                    "type": "array",
+                    "items": {
+                      "anyOf": [
+                        {
+                          "description": "{ pluginId: string; tokenId: string"
+                        },
+                        {
+                          "type": "null"
+                        },
+                        {
+                          "description": "undefined; targetFiat: string"
+                        },
+                        {
+                          "description": "undefined; date: string"
+                        },
+                        {
+                          "description": "undefined; }"
+                        }
+                      ]
+                    },
+                    "description": "Crypto rates to fetch."
+                  },
+                  "fiat": {
+                    "type": "array",
+                    "items": {
+                      "anyOf": [
+                        {
+                          "description": "{ fiatCode: string; targetFiat: string"
+                        },
+                        {
+                          "description": "undefined; date: string"
+                        },
+                        {
+                          "description": "undefined; }"
+                        }
+                      ]
+                    },
+                    "description": "Fiat rates to fetch."
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/rates/usd-to-native": {
+      "post": {
+        "operationId": "ratesUsdToNative",
+        "summary": "Convert a USD amount into native units.",
+        "description": "**Core call:** _none — GUI code (src/util/exchangeRates): getHistoricalCryptoRate._\n\n**Command line**\n\n```\nrates-usd-to-native --usd-amount=<usdAmount> --plugin-id=<pluginId> [--token-id=<tokenId>] [--multiplier=<multiplier>] [--date=<date>]\n```\n\nTurns a fiat notional into the native amount a spend needs.",
+        "tags": [
+          "Exchange rates"
+        ],
+        "x-cli": {
+          "command": "rates-usd-to-native",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": null,
+        "x-core-note": "GUI code (src/util/exchangeRates): getHistoricalCryptoRate.",
+        "x-source": "src/cli/engine/routes/rates.ts",
+        "parameters": [],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "usdAmount": {
+                      "type": "number",
+                      "description": "Echoed as a number, though it is sent as a string."
+                    },
+                    "pluginId": {
+                      "type": "string",
+                      "description": "Currency plugin the amount was converted for."
+                    },
+                    "tokenId": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "The asset, or null for the chain’s own coin."
+                    },
+                    "multiplier": {
+                      "type": "string",
+                      "description": "Native units per whole coin, which is what the conversion divided by."
+                    },
+                    "date": {
+                      "type": "string",
+                      "description": "The timestamp actually used for the rate."
+                    },
+                    "rate": {
+                      "type": "number",
+                      "description": "USD per whole coin at that date."
+                    },
+                    "displayAmount": {
+                      "type": "string",
+                      "description": "Whole coins, to 8 decimal places."
+                    },
+                    "nativeAmount": {
+                      "type": "string",
+                      "description": "What a spend actually takes."
+                    }
+                  },
+                  "required": [
+                    "usdAmount",
+                    "pluginId",
+                    "tokenId",
+                    "multiplier",
+                    "date",
+                    "rate",
+                    "displayAmount",
+                    "nativeAmount"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "BAD_REQUEST, NOT_FOUND, NETWORK_ERROR",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "usdAmount": {
+                    "type": "string",
+                    "description": "A string, which must parse to a positive finite number."
+                  },
+                  "pluginId": {
+                    "type": "string",
+                    "description": "Which chain to price."
+                  },
+                  "tokenId": {
+                    "anyOf": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ],
+                    "description": "Defaults to the native asset."
+                  },
+                  "multiplier": {
+                    "type": "string",
+                    "description": "Native units per whole coin. Defaults per plugin."
+                  },
+                  "date": {
+                    "type": "string",
+                    "description": "ISO-8601. Omitted, the current time is sent to the rates server."
+                  }
+                },
+                "required": [
+                  "usdAmount",
+                  "pluginId"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/list-store-ids": {
+      "get": {
+        "operationId": "listStoreIds",
+        "summary": "List data-store ids.",
+        "description": "**Core call:** `account.dataStore.listStoreIds`\n\n**Command line**\n\n```\nlist-store-ids\n```\n\nThe account's synced key-value store, where plugins keep their own state.",
+        "tags": [
+          "Data store"
+        ],
+        "x-cli": {
+          "command": "list-store-ids",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.dataStore.listStoreIds",
+        "x-source": "src/cli/engine/routes/dataStore.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "storeIds": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "description": "Every store holding at least one item."
+                    }
+                  },
+                  "required": [
+                    "storeIds"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/list-item-ids": {
+      "get": {
+        "operationId": "listItemIds",
+        "summary": "List item ids in a store.",
+        "description": "**Core call:** `account.dataStore.listItemIds`\n\n**Command line**\n\n```\nlist-item-ids --store-id=<storeId>\n```\n\n",
+        "tags": [
+          "Data store"
+        ],
+        "x-cli": {
+          "command": "list-item-ids",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.dataStore.listItemIds",
+        "x-source": "src/cli/engine/routes/dataStore.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "storeId",
+            "in": "query",
+            "required": true,
+            "description": "Plugin or app namespace within the account data store.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "itemIds": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "description": "Keys in this store. Empty if it has none."
+                    }
+                  },
+                  "required": [
+                    "itemIds"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/get-item": {
+      "get": {
+        "operationId": "getItem",
+        "summary": "Read an item.",
+        "description": "**Core call:** `account.dataStore.getItem`\n\n**Command line**\n\n```\nget-item --store-id=<storeId> --item-id=<itemId>\n```\n\nValues are opaque strings; encoding is the caller's business.",
+        "tags": [
+          "Data store"
+        ],
+        "x-cli": {
+          "command": "get-item",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.dataStore.getItem",
+        "x-source": "src/cli/engine/routes/dataStore.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "storeId",
+            "in": "query",
+            "required": true,
+            "description": "Plugin or app namespace within the account data store.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "itemId",
+            "in": "query",
+            "required": true,
+            "description": "Key within the store.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "value": {
+                      "type": "string",
+                      "description": "The stored string."
+                    }
+                  },
+                  "required": [
+                    "value"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "NOT_FOUND, BAD_REQUEST",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/set-item": {
+      "post": {
+        "operationId": "setItem",
+        "summary": "Write an item.",
+        "description": "**Core call:** `account.dataStore.setItem`\n\n**Command line**\n\n```\nset-item --store-id=<storeId> --item-id=<itemId> --value=<value>\n```\n\nCreates the store if it does not exist.",
+        "tags": [
+          "Data store"
+        ],
+        "x-cli": {
+          "command": "set-item",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.dataStore.setItem",
+        "x-source": "src/cli/engine/routes/dataStore.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No content."
+          },
+          "default": {
+            "description": "BAD_REQUEST",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "storeId": {
+                    "type": "string",
+                    "description": "Plugin or app namespace within the account data store."
+                  },
+                  "itemId": {
+                    "type": "string",
+                    "description": "Key within the store."
+                  },
+                  "value": {
+                    "type": "string",
+                    "description": "The string to store."
+                  }
+                },
+                "required": [
+                  "storeId",
+                  "itemId",
+                  "value"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/delete-item": {
+      "post": {
+        "operationId": "deleteItem",
+        "summary": "Delete an item.",
+        "description": "**Core call:** `account.dataStore.deleteItem`\n\n**Command line**\n\n```\ndelete-item --store-id=<storeId> --item-id=<itemId>\n```\n\n",
+        "tags": [
+          "Data store"
+        ],
+        "x-cli": {
+          "command": "delete-item",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.dataStore.deleteItem",
+        "x-source": "src/cli/engine/routes/dataStore.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No content."
+          },
+          "default": {
+            "description": "BAD_REQUEST",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "storeId": {
+                    "type": "string",
+                    "description": "Plugin or app namespace within the account data store."
+                  },
+                  "itemId": {
+                    "type": "string",
+                    "description": "Key within the store."
+                  }
+                },
+                "required": [
+                  "storeId",
+                  "itemId"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{sessionId}/delete-store": {
+      "post": {
+        "operationId": "deleteStore",
+        "summary": "Delete an entire store.",
+        "description": "**Core call:** `account.dataStore.deleteStore`\n\n**Command line**\n\n```\ndelete-store --store-id=<storeId>\n```\n\nRemoves every item in it, which cannot be undone from this API.",
+        "tags": [
+          "Data store"
+        ],
+        "x-cli": {
+          "command": "delete-store",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "account.dataStore.deleteStore",
+        "x-source": "src/cli/engine/routes/dataStore.ts",
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "description": "From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No content."
+          },
+          "default": {
+            "description": "BAD_REQUEST",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "storeId": {
+                    "type": "string",
+                    "description": "Plugin or app namespace within the account data store."
+                  }
+                },
+                "required": [
+                  "storeId"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/admin/auth-request": {
+      "post": {
+        "operationId": "adminAuthRequest",
+        "summary": "Raw login-server request.",
+        "description": "**Core call:** `context.$internalStuff.authRequest`\n\n**Command line**\n\n```\nadmin-auth-request --method=<method> --path=<path> [--body='<json>']\n```\n\nSends an arbitrary request with the context's credentials attached. Debugging only — this is core's private surface.",
+        "tags": [
+          "Admin"
+        ],
+        "x-cli": {
+          "command": "admin-auth-request",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "context.$internalStuff.authRequest",
+        "x-source": "src/cli/engine/routes/admin.ts",
+        "parameters": [],
+        "responses": {
+          "200": {
+            "description": "Whatever the login server returned.",
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            }
+          },
+          "default": {
+            "description": "BAD_REQUEST, NETWORK_ERROR",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "method": {
+                    "type": "string",
+                    "description": "HTTP method, e.g. `GET`."
+                  },
+                  "path": {
+                    "type": "string",
+                    "description": "Login-server path, not an engine path."
+                  },
+                  "body": {
+                    "description": "Request body, when the method takes one."
+                  }
+                },
+                "required": [
+                  "method",
+                  "path"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/admin/hash-username": {
+      "get": {
+        "operationId": "adminHashUsername",
+        "summary": "Hash a username.",
+        "description": "**Core call:** `context.$internalStuff.hashUsername`\n\n**Command line**\n\n```\nadmin-hash-username --username=<username>\n```\n\nReproduces the login server's hashing, to derive a login id offline.",
+        "tags": [
+          "Admin"
+        ],
+        "x-cli": {
+          "command": "admin-hash-username",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "context.$internalStuff.hashUsername",
+        "x-source": "src/cli/engine/routes/admin.ts",
+        "parameters": [
+          {
+            "name": "username",
+            "in": "query",
+            "required": true,
+            "description": "The name to hash.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "loginId": {
+                      "type": "string",
+                      "description": "Base58."
+                    }
+                  },
+                  "required": [
+                    "loginId"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/admin/make-lobby": {
+      "post": {
+        "operationId": "adminMakeLobby",
+        "summary": "Create a lobby.",
+        "description": "**Core call:** `context.$internalStuff.makeLobby`\n\n**Command line**\n\n```\nadmin-make-lobby [--lobby-request='<json>'] [--period-seconds='<json>']\n```\n\nA lobby polls the login server until closed, so the engine parks it under a `lobby_` handle and closes it on expiry rather than leaking the poll.",
+        "tags": [
+          "Admin"
+        ],
+        "x-cli": {
+          "command": "admin-make-lobby",
+          "flags": [
+            {
+              "name": "period-seconds",
+              "maps": "period",
+              "repeat": false
+            }
+          ],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "context.$internalStuff.makeLobby",
+        "x-source": "src/cli/engine/routes/admin.ts",
+        "parameters": [],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "objectId": {
+                      "type": "string",
+                      "description": "The parked handle."
+                    },
+                    "expiresAt": {
+                      "type": "string",
+                      "description": "When the engine closes the lobby and stops polling."
+                    },
+                    "lobbyId": {
+                      "type": "string",
+                      "description": "Identifies the lobby to the party joining it."
+                    },
+                    "replies": {
+                      "type": "array",
+                      "items": {},
+                      "description": "Empty at creation; re-read to see replies."
+                    }
+                  },
+                  "required": [
+                    "objectId",
+                    "expiresAt",
+                    "lobbyId",
+                    "replies"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "NETWORK_ERROR",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "lobbyRequest": {
+                    "description": "Defaults to `{}`."
+                  },
+                  "period": {
+                    "description": "Poll interval in seconds."
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/admin/lobby-handle/delete/{objectId}": {
+      "post": {
+        "operationId": "adminDeleteLobbyHandle",
+        "summary": "Close a parked lobby.",
+        "description": "**Core call:** _none — Engine handle store for a lobby created via makeLobby._\n\n**Command line**\n\n```\nadmin-lobby-handle-delete <objectId>\n```\n\n",
+        "tags": [
+          "Admin"
+        ],
+        "x-cli": {
+          "command": "admin-lobby-handle-delete",
+          "positional": "objectId",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": null,
+        "x-core-note": "Engine handle store for a lobby created via makeLobby.",
+        "x-source": "src/cli/engine/routes/admin.ts",
+        "parameters": [
+          {
+            "name": "objectId",
+            "in": "path",
+            "required": true,
+            "description": "An ephemeral object handle id.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "ok": {
+                      "type": "boolean",
+                      "description": "Always true; a failure arrives as an error envelope."
+                    }
+                  },
+                  "required": [
+                    "ok"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "OBJECT_NOT_FOUND",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/admin/fetch-lobby-request/{lobbyId}": {
+      "get": {
+        "operationId": "adminFetchLobbyRequest",
+        "summary": "Read a lobby's contents.",
+        "description": "**Core call:** `context.$internalStuff.fetchLobbyRequest`\n\n**Command line**\n\n```\nadmin-fetch-lobby-request <lobbyId>\n```\n\n",
+        "tags": [
+          "Admin"
+        ],
+        "x-cli": {
+          "command": "admin-fetch-lobby-request",
+          "positional": "lobbyId",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "context.$internalStuff.fetchLobbyRequest",
+        "x-source": "src/cli/engine/routes/admin.ts",
+        "parameters": [
+          {
+            "name": "lobbyId",
+            "in": "path",
+            "required": true,
+            "description": "Which lobby to read.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The raw lobby request.",
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            }
+          },
+          "default": {
+            "description": "NETWORK_ERROR",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/admin/send-lobby-reply/{lobbyId}": {
+      "post": {
+        "operationId": "adminSendLobbyReply",
+        "summary": "Reply to a lobby.",
+        "description": "**Core call:** `context.$internalStuff.sendLobbyReply`\n\n**Command line**\n\n```\nadmin-send-lobby-reply <lobbyId> --lobby-request='<json>' [--reply-data='<json>']\n```\n\n",
+        "tags": [
+          "Admin"
+        ],
+        "x-cli": {
+          "command": "admin-send-lobby-reply",
+          "positional": "lobbyId",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "context.$internalStuff.sendLobbyReply",
+        "x-source": "src/cli/engine/routes/admin.ts",
+        "parameters": [
+          {
+            "name": "lobbyId",
+            "in": "path",
+            "required": true,
+            "description": "Which lobby to answer.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No content."
+          },
+          "default": {
+            "description": "BAD_REQUEST, NETWORK_ERROR",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "lobbyRequest": {
+                    "description": "Normally the object from `admin-fetch-lobby-request`."
+                  },
+                  "replyData": {
+                    "description": "Payload for the requester."
+                  }
+                },
+                "required": [
+                  "lobbyRequest"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/admin/sync-repo/{syncKey}": {
+      "post": {
+        "operationId": "adminSyncRepo",
+        "summary": "Sync a repo.",
+        "description": "**Core call:** `context.$internalStuff.syncRepo`\n\n**Command line**\n\n```\nadmin-sync-repo <syncKey>\n```\n\n",
+        "tags": [
+          "Admin"
+        ],
+        "x-cli": {
+          "command": "admin-sync-repo",
+          "positional": "syncKey",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "context.$internalStuff.syncRepo",
+        "x-source": "src/cli/engine/routes/admin.ts",
+        "parameters": [
+          {
+            "name": "syncKey",
+            "in": "path",
+            "required": true,
+            "description": "Base58 repo sync key.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The changeset summary.",
+            "content": {
+              "application/json": {
+                "schema": {}
+              }
+            }
+          },
+          "default": {
+            "description": "BAD_REQUEST, NETWORK_ERROR",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/admin/repo-list/{syncKey}": {
+      "get": {
+        "operationId": "adminRepoList",
+        "summary": "List repo contents.",
+        "description": "**Core call:** `context.$internalStuff.getRepoDisklet`\n\n**Command line**\n\n```\nadmin-repo-list <syncKey> [--path=<path>] --data-key=<dataKey>\n```\n\n",
+        "tags": [
+          "Admin"
+        ],
+        "x-cli": {
+          "command": "admin-repo-list",
+          "positional": "syncKey",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "context.$internalStuff.getRepoDisklet",
+        "x-source": "src/cli/engine/routes/admin.ts",
+        "parameters": [
+          {
+            "name": "syncKey",
+            "in": "path",
+            "required": true,
+            "description": "Base58 repo sync key.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "path",
+            "in": "query",
+            "required": false,
+            "description": "Subdirectory. Defaults to the repo root.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "dataKey",
+            "in": "query",
+            "required": true,
+            "description": "Base58 repo data key.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "listing": {
+                      "description": "Path to entry type: `file` or `folder`."
+                    }
+                  },
+                  "required": [
+                    "listing"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "BAD_REQUEST",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/admin/repo-get/{syncKey}": {
+      "get": {
+        "operationId": "adminRepoGet",
+        "summary": "Read a repo file.",
+        "description": "**Core call:** `context.$internalStuff.getRepoDisklet`\n\n**Command line**\n\n```\nadmin-repo-get <syncKey> --path=<path> --data-key=<dataKey>\n```\n\n",
+        "tags": [
+          "Admin"
+        ],
+        "x-cli": {
+          "command": "admin-repo-get",
+          "positional": "syncKey",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "context.$internalStuff.getRepoDisklet",
+        "x-source": "src/cli/engine/routes/admin.ts",
+        "parameters": [
+          {
+            "name": "syncKey",
+            "in": "path",
+            "required": true,
+            "description": "Base58 repo sync key.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "path",
+            "in": "query",
+            "required": true,
+            "description": "Path within the repo.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "dataKey",
+            "in": "query",
+            "required": true,
+            "description": "Base58 repo data key.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "text": {
+                      "type": "string",
+                      "description": "The file contents."
+                    }
+                  },
+                  "required": [
+                    "text"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "NOT_FOUND, BAD_REQUEST",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/admin/repo-set/{syncKey}": {
+      "post": {
+        "operationId": "adminRepoSet",
+        "summary": "Write a repo file.",
+        "description": "**Core call:** `context.$internalStuff.getRepoDisklet`\n\n**Command line**\n\n```\nadmin-repo-set <syncKey> --path=<path> --text=<text> --data-key=<dataKey>\n```\n\nWrites directly into a synced repo, bypassing every core-level invariant. A malformed write can break the account for real clients.",
+        "tags": [
+          "Admin"
+        ],
+        "x-cli": {
+          "command": "admin-repo-set",
+          "positional": "syncKey",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "context.$internalStuff.getRepoDisklet",
+        "x-source": "src/cli/engine/routes/admin.ts",
+        "parameters": [
+          {
+            "name": "syncKey",
+            "in": "path",
+            "required": true,
+            "description": "Base58 repo sync key.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No content."
+          },
+          "default": {
+            "description": "BAD_REQUEST",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "path": {
+                    "type": "string",
+                    "description": "Path within the repo."
+                  },
+                  "text": {
+                    "type": "string",
+                    "description": "The contents to write."
+                  },
+                  "dataKey": {
+                    "type": "string",
+                    "description": "Base58 repo data key."
+                  }
+                },
+                "required": [
+                  "path",
+                  "text",
+                  "dataKey"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/admin/repo-delete/{syncKey}": {
+      "post": {
+        "operationId": "adminRepoDelete",
+        "summary": "Delete a repo file.",
+        "description": "**Core call:** `context.$internalStuff.getRepoDisklet`\n\n**Command line**\n\n```\nadmin-repo-delete <syncKey> --path=<path> --data-key=<dataKey>\n```\n\nDestructive, and not undoable from this API.",
+        "tags": [
+          "Admin"
+        ],
+        "x-cli": {
+          "command": "admin-repo-delete",
+          "positional": "syncKey",
+          "flags": [],
+          "extra": [],
+          "custom": false,
+          "preset": {}
+        },
+        "x-core-call": "context.$internalStuff.getRepoDisklet",
+        "x-source": "src/cli/engine/routes/admin.ts",
+        "parameters": [
+          {
+            "name": "syncKey",
+            "in": "path",
+            "required": true,
+            "description": "Base58 repo sync key.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No content."
+          },
+          "default": {
+            "description": "BAD_REQUEST",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "path": {
+                    "type": "string",
+                    "description": "Path within the repo."
+                  },
+                  "dataKey": {
+                    "type": "string",
+                    "description": "Base58 repo data key."
+                  }
+                },
+                "required": [
+                  "path",
+                  "dataKey"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "/engine/events": {
+      "get": {
+        "operationId": "engineEvents",
+        "summary": "Subscribe to engine events.",
+        "description": "**Core call:** _none — Engine-side fan-out; `core.log` frames carry core's onLog output._\n\n**Command line**\n\n```\nsubscribe [--type=<value>]\n```\n\nHolds a Server-Sent Events stream open until the caller disconnects or the engine closes it. Runs concurrently with one-shot calls, so a subscriber in one terminal watches what another terminal does.\n\nA live subscription holds the engine open past its idle timeout. It does not hold an account logged in: the auto-logout timer still fires, and closes any subscription scoped to that account or one of its wallets. Context-scoped subscriptions survive, because the context outlives every account.",
+        "tags": [
+          "Event stream"
+        ],
+        "x-cli": {
+          "command": "subscribe",
+          "flags": [],
+          "extra": [
+            {
+              "name": "type",
+              "kind": "repeat",
+              "required": false,
+              "doc": "Client-side filter; the engine always sends everything the scope allows."
+            }
+          ],
+          "custom": true,
+          "preset": {},
+          "notes": "Prints newline-delimited JSON and runs until interrupted. Exits 0 on SIGINT, 3 when a session ended the stream, 7 when the engine went away."
+        },
+        "x-core-call": null,
+        "x-core-note": "Engine-side fan-out; `core.log` frames carry core's onLog output.",
+        "x-source": "src/cli/engine/routes/events.ts",
+        "parameters": [],
+        "responses": {
+          "200": {
+            "description": "One frame per event, as `event:` then `data:` lines.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "description": "The event name."
+                    },
+                    "data": {
+                      "description": "Payload, shaped by the event type."
+                    }
+                  },
+                  "required": [
+                    "type",
+                    "data"
+                  ]
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "Error.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorEnvelope"
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  },
+  "components": {
+    "schemas": {
+      "ErrorEnvelope": {
+        "type": "object",
+        "description": "Every failure, on both transports.",
+        "properties": {
+          "error": {
+            "type": "object",
+            "properties": {
+              "code": {
+                "type": "string"
+              },
+              "message": {
+                "type": "string"
+              },
+              "status": {
+                "type": "number"
+              },
+              "details": {}
+            },
+            "required": [
+              "code",
+              "message",
+              "status"
+            ]
+          }
+        },
+        "required": [
+          "error"
+        ]
+      }
+    }
+  }
+}
diff --git a/docs/api/groups.ts b/docs/api/groups.ts
new file mode 100644
index 00000000000..c092fe4f3a7
--- /dev/null
+++ b/docs/api/groups.ts
@@ -0,0 +1,206 @@
+/**
+ * Section titles and order for the generated reference.
+ *
+ * Keyed by route-file basename, which is also the group each `route()` in that
+ * file belongs to. Everything else about an endpoint comes from its
+ * declaration in `src/cli/engine/routes/`.
+ */
+export interface GroupInfo {
+  id: string
+  title: string
+  doc: string
+  /** Section this group sits under, from `sectionOrder`. */
+  section: string
+}
+
+/**
+ * The top level of the reference: the core object a call acts on.
+ *
+ * `EdgeContext`, `EdgeAccount` and `EdgeCurrencyWallet` are the three objects
+ * the API is built on, so they are the three main sections; the engine daemon
+ * is its own, having no core object at all. Everything else that does not
+ * belong to one of them stands alone rather than being filed under a section
+ * it only half fits.
+ */
+export interface SectionInfo {
+  id: string
+  title: string
+  doc: string
+}
+
+export const sectionOrder: SectionInfo[] = [
+  {
+    id: 'engine',
+    title: 'Engine',
+    doc: 'The `edge-engine` daemon itself. None of these have an `edge-core-js` equivalent — they describe the process — and none need a session.'
+  },
+  {
+    id: 'context',
+    title: 'Context',
+    doc: 'Calls on the shared `EdgeContext`: device state, username queries, and every way of logging in. None of them need a session, because a session is what they produce.'
+  },
+  {
+    id: 'account',
+    title: 'Account',
+    doc: 'Calls on a logged-in `EdgeAccount`, addressed by `sessionId`. All of these can also return `401 INVALID_SESSION` or `401 SESSION_EXPIRED`.'
+  },
+  {
+    id: 'wallet',
+    title: 'Wallet',
+    doc: 'Calls on a single `EdgeCurrencyWallet`. Each names its wallet with `--wallet-id`, which accepts a full id or any unique prefix.'
+  },
+  {
+    id: 'local-settings',
+    title: 'Local settings',
+    doc: 'Device-local account settings, stored outside the synced repos. They follow the account but never leave the machine.'
+  },
+  {
+    id: 'swap',
+    title: 'Swap',
+    doc: 'Exchanging one asset for another through the swap plugins.'
+  },
+  {
+    id: 'rates',
+    title: 'Exchange rates',
+    doc: 'Fiat and crypto pricing, current and historical.'
+  },
+  {
+    id: 'objects',
+    title: 'Object handles',
+    doc: 'A core value with methods on it cannot cross JSON, so the engine keeps it and hands back an id. These read and release any of them.'
+  },
+  {
+    id: 'admin',
+    title: 'Admin',
+    doc: 'The `$internalStuff` escape hatch: login-server and sync-repo access that no ordinary caller needs.'
+  }
+]
+
+export const groupOrder: GroupInfo[] = [
+  {
+    id: 'status',
+    title: 'Lifecycle',
+    section: 'engine',
+    doc: 'Lifecycle and configuration of the `edge-engine` daemon. None of these have an `edge-core-js` equivalent — they describe the daemon itself — and none need a session.'
+  },
+  {
+    id: 'context',
+    title: 'Device and usernames',
+    section: 'context',
+    doc: 'Calls on the shared `EdgeContext`: local device state and login-server queries that do not need a session.'
+  },
+  {
+    id: 'login',
+    title: 'Login methods',
+    section: 'context',
+    doc: 'Every successful login returns a [Session](#schema-Session) and registers it in the engine, so later calls need only the `sessionId`. The CLI writes that id to `session.json` automatically.'
+  },
+  {
+    id: 'account',
+    title: 'Session',
+    section: 'account',
+    doc: 'Calls on a logged-in `EdgeAccount`, addressed by `sessionId`. All of these can also return `401 INVALID_SESSION` or `401 SESSION_EXPIRED`.'
+  },
+  {
+    id: 'localSettings',
+    title: 'Local settings',
+    section: 'local-settings',
+    doc: 'Device-local account settings, stored outside the synced repos.'
+  },
+  {
+    id: 'credentials',
+    title: 'Credentials',
+    section: 'account',
+    doc: 'Password, PIN, username and recovery changes on a logged-in account.'
+  },
+  {
+    id: 'otp',
+    title: 'Two-factor authentication',
+    section: 'account',
+    doc: 'OTP state and the reset flow a user falls back on after losing their authenticator.'
+  },
+  {
+    id: 'vouchers',
+    title: 'Vouchers',
+    section: 'account',
+    doc: 'When 2FA blocks a login, the login server issues a voucher an already-trusted device can approve or reject.'
+  },
+  {
+    id: 'lobby',
+    title: 'Approving a login',
+    section: 'account',
+    doc: 'The other side of `request-edge-login`: a logged-in account inspecting and approving a login somebody scanned.'
+  },
+  {
+    id: 'keys',
+    title: 'Keys',
+    section: 'account',
+    doc: 'Raw key infrastructure beneath the wallet API. Several of these return private key material, and the engine has no transport auth — treat any process that can reach the socket as fully trusted.'
+  },
+  {
+    id: 'wallets',
+    title: 'Wallet state',
+    section: 'wallet',
+    doc: 'Account-level wallet listing and creation, then per-wallet calls. A `{walletId}` segment accepts a unique prefix, so those routes can also return `404 WALLET_NOT_FOUND` or `409 AMBIGUOUS_WALLET_ID`.'
+  },
+  {
+    id: 'tokens',
+    title: 'Tokens',
+    section: 'wallet',
+    doc: 'Which tokens a wallet tracks. Enabled tokens are the ones it syncs balances for; detected ones were seen on-chain but are not yet enabled.'
+  },
+  {
+    id: 'transactions',
+    title: 'Transactions',
+    section: 'wallet',
+    doc: 'Reading transaction history, exporting it, and editing its metadata.'
+  },
+  {
+    id: 'objects',
+    title: 'Object handles',
+    section: 'objects',
+    doc: 'A core value with methods on it — a staged transaction, a swap quote, a pending login — cannot cross JSON, so the engine keeps it and hands back an id. These read and release any of them.'
+  },
+  {
+    id: 'spend',
+    title: 'Spending',
+    section: 'wallet',
+    doc: 'Two ways to send funds. `spend` does the whole thing in one call; the staged workflow — `make-spend`, `sign-tx`, `broadcast-tx`, `save-tx` — hands back an object handle at each step so fees can be inspected before committing.'
+  },
+  {
+    id: 'swap',
+    title: 'Swap quotes',
+    section: 'account',
+    doc: 'Cross-asset exchange. Quotes are live objects held server-side under a `swap_` handle, so approving one means naming its `objectId` rather than re-uploading the quote.'
+  },
+  {
+    id: 'uri',
+    title: 'URIs',
+    section: 'wallet',
+    doc: 'Parsing and building BIP21-style payment URIs through the wallet’s own plugin, so chain-specific quirks are handled for you.'
+  },
+  {
+    id: 'rates',
+    title: 'Exchange rates',
+    section: 'rates',
+    doc: 'Historical and current rates through the same batching queue the GUI uses. No session required.'
+  },
+  {
+    id: 'dataStore',
+    title: 'Data store',
+    section: 'account',
+    doc: 'The account’s synced key-value store, where plugins keep their own state. One route per `EdgeDataStore` method.'
+  },
+  {
+    id: 'admin',
+    title: 'Admin',
+    section: 'admin',
+    doc: '**Debugging only — not for production apps.** These reach into `context.$internalStuff`, the private surface of `edge-core-js`, and can corrupt an account’s synced repos. They take no `sessionId`: they act on the context, not on a logged-in account.'
+  },
+  {
+    id: 'events',
+    title: 'Event stream',
+    section: 'engine',
+    doc: 'A Server-Sent Events feed of engine activity, served outside the router because the response never ends.'
+  }
+]
diff --git a/docs/api/shared.ts b/docs/api/shared.ts
new file mode 100644
index 00000000000..2d22d566c0b
--- /dev/null
+++ b/docs/api/shared.ts
@@ -0,0 +1,314 @@
+/**
+ * The error catalogue and the CLI exit-code table.
+ *
+ * Response shapes used to live here too; they are now cleaners in
+ * `src/cli/engine/schemas.ts`, where they both validate and describe.
+ */
+
+export interface ErrorCode {
+  code: string
+  status: number
+  origin: 'engine' | 'core'
+  doc: string
+  details?: string
+}
+
+/**
+ * Every code the engine can emit. Engine codes are thrown by `engineError`;
+ * core codes are mapped from `edge-core-js` error types by `mapCoreError`.
+ */
+export const errorCodes: ErrorCode[] = [
+  {
+    code: 'BAD_REQUEST',
+    status: 400,
+    origin: 'engine',
+    doc: 'Malformed JSON, or a missing / wrongly typed field.'
+  },
+  {
+    code: 'MISSING_BITWAVE_ACCOUNT_ID',
+    status: 400,
+    origin: 'engine',
+    doc: 'Bitwave export requested with no account id in the query and none saved in the wallet’s `exportTxInfo.json`.'
+  },
+  {
+    code: 'OBJECT_KIND_MISMATCH',
+    status: 400,
+    origin: 'engine',
+    doc: 'The handle exists but is a different kind (e.g. a swap quote passed to `sign-tx`).'
+  },
+  {
+    code: 'OBJECT_SESSION_MISMATCH',
+    status: 400,
+    origin: 'engine',
+    doc: 'The handle belongs to a different session.'
+  },
+  {
+    code: 'OBJECT_WALLET_MISMATCH',
+    status: 400,
+    origin: 'engine',
+    doc: 'The transaction handle belongs to a different wallet.'
+  },
+  {
+    code: 'INVALID_SESSION',
+    status: 401,
+    origin: 'engine',
+    doc: 'Unknown `sessionId`.'
+  },
+  {
+    code: 'SESSION_EXPIRED',
+    status: 401,
+    origin: 'engine',
+    doc: 'Auto-logged-out, or explicitly logged out.'
+  },
+  {
+    code: 'NOT_FOUND',
+    status: 404,
+    origin: 'engine',
+    doc: 'No route matched, or a generic missing resource.'
+  },
+  {
+    code: 'NO_LOGIN_REQUEST',
+    status: 404,
+    origin: 'engine',
+    doc: 'The lobby exists but carries no pending login request.'
+  },
+  {
+    code: 'OBJECT_NOT_FOUND',
+    status: 404,
+    origin: 'engine',
+    doc: 'No handle with that `objectId`.'
+  },
+  {
+    code: 'PENDING_LOGIN_NOT_FOUND',
+    status: 404,
+    origin: 'engine',
+    doc: 'No pending Edge login with that `pendingId`.'
+  },
+  {
+    code: 'TOKEN_NOT_ENABLED',
+    status: 404,
+    origin: 'engine',
+    doc: 'Tried to disable a token that was not enabled.'
+  },
+  {
+    code: 'TOKEN_NOT_FOUND',
+    status: 404,
+    origin: 'engine',
+    doc: 'Unknown token id for this wallet.'
+  },
+  {
+    code: 'USER_NOT_FOUND',
+    status: 404,
+    origin: 'engine',
+    doc: 'No local user matches that username or login id.'
+  },
+  {
+    code: 'WALLET_NOT_FOUND',
+    status: 404,
+    origin: 'engine',
+    doc: 'No wallet matches that id or prefix.'
+  },
+  {
+    code: 'METHOD_NOT_ALLOWED',
+    status: 405,
+    origin: 'engine',
+    doc: 'The path exists but not for this HTTP method.'
+  },
+  {
+    code: 'AMBIGUOUS_WALLET_ID',
+    status: 409,
+    origin: 'engine',
+    doc: 'A wallet id prefix matched more than one wallet.',
+    details: '`details.candidates`'
+  },
+  {
+    code: 'OBJECT_EXPIRED',
+    status: 410,
+    origin: 'engine',
+    doc: 'The handle passed its 5 minute TTL and was released.'
+  },
+  {
+    code: 'PAYLOAD_TOO_LARGE',
+    status: 413,
+    origin: 'engine',
+    doc: 'Request body over 4 MiB.'
+  },
+  {
+    code: 'UNSUPPORTED_MEDIA_TYPE',
+    status: 415,
+    origin: 'engine',
+    doc: 'Body present but not `application/json`.'
+  },
+  {
+    code: 'INTERNAL_ERROR',
+    status: 500,
+    origin: 'engine',
+    doc: 'Unmapped engine or plugin failure.'
+  },
+  {
+    code: 'ENGINE_SHUTTING_DOWN',
+    status: 503,
+    origin: 'engine',
+    doc: 'Idle or explicit shutdown already in progress.'
+  },
+
+  {
+    code: 'USERNAME_ERROR',
+    status: 400,
+    origin: 'core',
+    doc: 'Unknown username, or an invalid recovery key.'
+  },
+  {
+    code: 'NO_AMOUNT_SPECIFIED',
+    status: 400,
+    origin: 'core',
+    doc: 'Zero-amount spend.'
+  },
+  {
+    code: 'SAME_CURRENCY',
+    status: 400,
+    origin: 'core',
+    doc: 'Swap between identical currencies.'
+  },
+  {
+    code: 'PASSWORD_ERROR',
+    status: 401,
+    origin: 'core',
+    doc: 'Wrong password, PIN, or recovery answers.',
+    details: '`details.wait` (seconds) when rate-limited'
+  },
+  {
+    code: 'OTP_REQUIRED',
+    status: 401,
+    origin: 'core',
+    doc: 'Missing or wrong 2FA token.',
+    details:
+      '`reason` (`ip`\\|`otp`), `loginId`, `resetToken`, `resetDate`, `voucherId`, `voucherAuth`, `voucherActivates`'
+  },
+  {
+    code: 'CHALLENGE_REQUIRED',
+    status: 403,
+    origin: 'core',
+    doc: 'The login server wants a CAPTCHA. Retry with `challengeId`.',
+    details: '`challengeId`, `challengeUri`'
+  },
+  {
+    code: 'PIN_DISABLED',
+    status: 403,
+    origin: 'core',
+    doc: 'PIN login is not enabled on this device.'
+  },
+  {
+    code: 'SWAP_PERMISSION',
+    status: 403,
+    origin: 'core',
+    doc: 'The swap plugin refused the request.',
+    details:
+      '`pluginId`, `reason`: `geoRestriction` \\| `noVerification` \\| `needsActivation`'
+  },
+  {
+    code: 'INSUFFICIENT_FUNDS',
+    status: 422,
+    origin: 'core',
+    doc: 'Not enough balance to cover amount plus fee.',
+    details: '`tokenId`, `networkFee`'
+  },
+  {
+    code: 'DUST_SPEND',
+    status: 422,
+    origin: 'core',
+    doc: 'Amount below the network dust threshold.'
+  },
+  {
+    code: 'PENDING_FUNDS',
+    status: 422,
+    origin: 'core',
+    doc: 'Balance exists but is unconfirmed.'
+  },
+  {
+    code: 'SPEND_TO_SELF',
+    status: 422,
+    origin: 'core',
+    doc: 'Destination address belongs to the source wallet.'
+  },
+  {
+    code: 'SWAP_ABOVE_LIMIT',
+    status: 422,
+    origin: 'core',
+    doc: 'Amount exceeds the plugin maximum.',
+    details: '`swapPluginId`, `nativeMax`, `direction`'
+  },
+  {
+    code: 'SWAP_BELOW_LIMIT',
+    status: 422,
+    origin: 'core',
+    doc: 'Amount below the plugin minimum.',
+    details: '`swapPluginId`, `nativeMin`, `direction`'
+  },
+  {
+    code: 'SWAP_CURRENCY',
+    status: 422,
+    origin: 'core',
+    doc: 'The plugin does not support that pair.',
+    details: '`pluginId`, `fromTokenId`, `toTokenId`'
+  },
+  {
+    code: 'SWAP_ADDRESS',
+    status: 422,
+    origin: 'core',
+    doc: 'Address unusable for this swap.',
+    details: '`swapPluginId`, `reason`: `mustMatch` \\| `mustBeActivated`'
+  },
+  {
+    code: 'OBSOLETE_API',
+    status: 426,
+    origin: 'core',
+    doc: 'The login server rejected this client version.'
+  },
+  {
+    code: 'NETWORK_ERROR',
+    status: 503,
+    origin: 'core',
+    doc: 'Could not reach an Edge server.'
+  }
+]
+
+/** Errors possible on any session-scoped route. */
+export const SESSION_ERRORS = ['INVALID_SESSION', 'SESSION_EXPIRED']
+/** Errors possible on any route with a `{walletId}` segment. */
+export const WALLET_ERRORS = ['WALLET_NOT_FOUND', 'AMBIGUOUS_WALLET_ID']
+
+export const CLI_EXIT_CODES = [
+  { code: 0, name: 'OK', doc: 'Success.' },
+  {
+    code: 1,
+    name: 'GENERIC',
+    doc: 'Any failure with no more specific mapping.'
+  },
+  {
+    code: 2,
+    name: 'USAGE',
+    doc: 'Bad argv: unknown flag, missing value, extra positional.'
+  },
+  {
+    code: 3,
+    name: 'AUTH',
+    doc: '`INVALID_SESSION`, `SESSION_EXPIRED`, `PASSWORD_ERROR`, `OTP_REQUIRED`, `CHALLENGE_REQUIRED`, `PIN_DISABLED`.'
+  },
+  {
+    code: 4,
+    name: 'NOT_FOUND',
+    doc: '`NOT_FOUND`, `WALLET_NOT_FOUND`, `TOKEN_NOT_FOUND`.'
+  },
+  {
+    code: 5,
+    name: 'VALIDATION',
+    doc: '`BAD_REQUEST`, `INSUFFICIENT_FUNDS`, `DUST_SPEND`, `PENDING_FUNDS`, `SPEND_TO_SELF`, `NO_AMOUNT_SPECIFIED`, `AMBIGUOUS_WALLET_ID`, `USERNAME_ERROR`.'
+  },
+  {
+    code: 6,
+    name: 'NETWORK',
+    doc: '`NETWORK_ERROR`, or any response with HTTP status `503`.'
+  },
+  { code: 7, name: 'ENGINE', doc: 'Could not connect to or spawn the engine.' }
+]
diff --git a/edgeKey.example.json b/edgeKey.example.json
new file mode 100644
index 00000000000..a7ac7fa9823
--- /dev/null
+++ b/edgeKey.example.json
@@ -0,0 +1,4 @@
+{
+  "apiKey": "",
+  "apiSecret": ""
+}
diff --git a/env.json.enc b/env.json.enc
deleted file mode 100644
index 6914338af6f..00000000000
Binary files a/env.json.enc and /dev/null differ
diff --git a/eslint.config.mjs b/eslint.config.mjs
index eb5c9ca5d92..3199d55903d 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -106,24 +106,16 @@ export default [
     files: [
       'scripts/createAndroidKeys.ts',
 
-      'scripts/loggingServer.ts',
-      'scripts/makeNativeHeaders.ts',
-      'scripts/patchFiles.ts',
-      'scripts/secretFiles.ts',
-
       'scripts/updateVersion.ts',
       'src/actions/BackupModalActions.tsx',
 
       'src/actions/CreateWalletActions.tsx',
 
-      'src/actions/DeviceSettingsActions.ts',
-
       'src/actions/FioActions.tsx',
       'src/actions/FioAddressActions.ts',
       'src/actions/FirstOpenActions.tsx',
       'src/actions/LoanWelcomeActions.tsx',
 
-      'src/actions/NotificationActions.ts',
       'src/actions/PaymentProtoActions.tsx',
       'src/actions/ReceiveDropdown.tsx',
       'src/actions/RecoveryReminderActions.tsx',
@@ -318,7 +310,6 @@ export default [
       'src/components/services/AirshipInstance.tsx',
       'src/components/services/AutoLogout.ts',
       'src/components/services/ContactsLoader.ts',
-
       'src/components/services/EdgeContextCallbackManager.tsx',
 
       'src/components/services/FioService.ts',
@@ -330,7 +321,6 @@ export default [
 
       'src/components/services/SortedWalletList.ts',
       'src/components/services/StatusBarManager.tsx',
-      'src/components/services/WalletConnectService.tsx',
       'src/components/services/WalletLifecycle.ts',
       'src/components/services/WipeLogsService.tsx',
 
@@ -449,10 +439,6 @@ export default [
 
       'src/plugins/gui/providers/revolutProvider.ts',
       'src/plugins/gui/RewardsCardPlugin.tsx',
-
-      'src/plugins/gui/util/fetchRevolut.ts',
-      'src/plugins/gui/util/initializeProviders.ts',
-
       'src/plugins/stake-plugins/generic/pluginInfo/optimismTarotPool.ts',
       'src/plugins/stake-plugins/generic/policyAdapters/CardanoKilnAdaptor.ts',
       'src/plugins/stake-plugins/generic/policyAdapters/EthereumKilnAdaptor.ts',
@@ -463,7 +449,6 @@ export default [
       'src/plugins/stake-plugins/generic/util/KilnApi.ts',
       'src/plugins/stake-plugins/generic/util/tarotUtils.ts',
       'src/plugins/stake-plugins/metadataCache.ts',
-      'src/plugins/stake-plugins/stakePlugins.ts',
 
       'src/plugins/stake-plugins/uniswapV2/Ecosystem.ts',
 
@@ -488,17 +473,13 @@ export default [
       'src/util/crypto.ts',
       'src/util/CryptoAmount.ts',
       'src/util/cryptoTextUtils.ts',
-      'src/util/CurrencyInfoHelpers.ts',
-      'src/util/CurrencyWalletHelpers.ts',
 
-      'src/util/exchangeRates.ts',
+      'src/util/CurrencyWalletHelpers.ts',
 
-      'src/util/FioAddressUtils.ts',
       'src/util/getAccountUsername.ts',
       'src/util/GuiPluginTools.ts',
       'src/util/haptic.ts',
       'src/util/infoUtils.ts',
-
       'src/util/memoUtils.ts',
       'src/util/middleware/perfLogger.ts',
 
@@ -509,7 +490,7 @@ export default [
 
       'src/util/ukComplianceUtils.ts',
       'src/util/utils.ts',
-      'src/util/WebUtils.ts',
+
       'src/util/withWatchableProps.ts'
     ],
     languageOptions: {
@@ -533,6 +514,7 @@ export default [
       'android/*',
       'artifacts/*',
       'ios/*',
+      'lib/*',
       'src/plugins/contracts/*',
       'src/controllers/edgeProvider/client/rolledUp.js',
       'src/controllers/edgeProvider/injectThisInWebView.js'
diff --git a/index.ts b/index.ts
index 3a27fe7aef1..1e8c5262e6d 100644
--- a/index.ts
+++ b/index.ts
@@ -5,6 +5,10 @@
 // no-ops and the home screen shortcuts never appear.
 import 'expo-modules-core'
 import 'react-native-gesture-handler'
+// Locale selection must precede ./src/app, whose import graph evaluates
+// locales/strings: anything capturing lstrings at module scope would otherwise
+// be frozen in English.
+import './src/locales/initLocale'
 import './src/app'
 import './src/perf'
 
diff --git a/ios/edge.xcodeproj/project.pbxproj b/ios/edge.xcodeproj/project.pbxproj
index c33f10cde43..cade6a5e4ba 100644
--- a/ios/edge.xcodeproj/project.pbxproj
+++ b/ios/edge.xcodeproj/project.pbxproj
@@ -9,6 +9,9 @@
 /* Begin PBXBuildFile section */
 		04DBAACE71E94A3B9BCAF10A /* EdgeAttestation.swift in Sources */ = {isa = PBXBuildFile; fileRef = A6252FDC1E314D61A7E315B7 /* EdgeAttestation.swift */; };
 		13B07FBF1A68108700A75B9A /* Images.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 13B07FB51A68108700A75B9A /* Images.xcassets */; };
+		A1EDGEHMACBF01 /* edge_hmac.c in Sources */ = {isa = PBXBuildFile; fileRef = A1EDGEHMACFR01 /* edge_hmac.c */; };
+		A1APISECRETBF01 /* EdgeApiSecret.c in Sources */ = {isa = PBXBuildFile; fileRef = A1APISECRETFR01 /* EdgeApiSecret.c */; };
+		A1APISIGNERBF01 /* EdgeApiSigner.m in Sources */ = {isa = PBXBuildFile; fileRef = A1APISIGNERFR01 /* EdgeApiSigner.m */; };
 		3D18A8FA2A5333DC00F3B19B /* audio_received.mp3 in Resources */ = {isa = PBXBuildFile; fileRef = 3D18A8F82A5333DC00F3B19B /* audio_received.mp3 */; };
 		3D18A8FB2A5333DC00F3B19B /* audio_sent.mp3 in Resources */ = {isa = PBXBuildFile; fileRef = 3D18A8F92A5333DC00F3B19B /* audio_sent.mp3 */; };
 		3D5BD9852A4CEFB900590088 /* EdgeApiKey.swift in Sources */ = {isa = PBXBuildFile; fileRef = 3D5BD9832A4CEFB900590088 /* EdgeApiKey.swift */; };
@@ -55,6 +58,9 @@
 		3D18A8F82A5333DC00F3B19B /* audio_received.mp3 */ = {isa = PBXFileReference; lastKnownFileType = audio.mp3; name = audio_received.mp3; path = ../android/app/src/main/res/raw/audio_received.mp3; sourceTree = "<group>"; };
 		3D18A8F92A5333DC00F3B19B /* audio_sent.mp3 */ = {isa = PBXFileReference; lastKnownFileType = audio.mp3; name = audio_sent.mp3; path = ../android/app/src/main/res/raw/audio_sent.mp3; sourceTree = "<group>"; };
 		3D5BD9832A4CEFB900590088 /* EdgeApiKey.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = EdgeApiKey.swift; sourceTree = "<group>"; };
+		A1APISECRETFR01 /* EdgeApiSecret.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; path = EdgeApiSecret.c; sourceTree = "<group>"; };
+		A1EDGEHMACFR01 /* edge_hmac.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; name = edge_hmac.c; path = ../native/edge-api-signer/edge_hmac.c; sourceTree = "<group>"; };
+		A1APISIGNERFR01 /* EdgeApiSigner.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; name = EdgeApiSigner.m; path = edge/EdgeApiSigner.m; sourceTree = "<group>"; };
 		3D5BD9842A4CEFB900590088 /* EdgeCore.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = EdgeCore.swift; sourceTree = "<group>"; };
 		3D5BD9872A4CEFC700590088 /* Base58.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = Base58.swift; sourceTree = "<group>"; };
 		3D5BD9892A4CF04C00590088 /* GoogleService-Info.plist */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.plist.xml; name = "GoogleService-Info.plist"; path = "edge/GoogleService-Info.plist"; sourceTree = "<group>"; };
@@ -119,6 +125,7 @@
 				81AB9BB72411601600AC10FF /* LaunchScreen.storyboard */,
 				A6252FDC1E314D61A7E315B7 /* EdgeAttestation.swift */,
 				79E2D7E4637343A7B1DCB004 /* EdgeAttestation.m */,
+				A1APISIGNERFR01 /* EdgeApiSigner.m */,
 			);
 			name = edge;
 			sourceTree = "<group>";
@@ -184,6 +191,8 @@
 				3D5BD9872A4CEFC700590088 /* Base58.swift */,
 				13B07FAE1A68108700A75B9A /* edge */,
 				3D5BD9832A4CEFB900590088 /* EdgeApiKey.swift */,
+				A1APISECRETFR01 /* EdgeApiSecret.c */,
+				A1EDGEHMACFR01 /* edge_hmac.c */,
 				3D5BD9842A4CEFB900590088 /* EdgeCore.swift */,
 				2D16E6871FA4F8E400B85C8A /* Frameworks */,
 				832341AE1AAA6A7D00B99B32 /* Libraries */,
@@ -231,6 +240,7 @@
 			buildConfigurationList = 13B07F931A680F5B00A75B9A /* Build configuration list for PBXNativeTarget "edge" */;
 			buildPhases = (
 				C38B50BA6285516D6DCD4F65 /* [CP] Check Pods Manifest.lock */,
+				A1MAKEAPISIGNER01 /* Generate Edge API Signer */,
 				FD10A7F022414F080027D42C /* Start Packager */,
 				F9C2825A723B345D6CFC5D07 /* [Expo] Configure project */,
 				13B07F871A680F5B00A75B9A /* Sources */,
@@ -456,6 +466,37 @@
 			shellScript = "export RCT_METRO_PORT=\"${RCT_METRO_PORT:=8081}\"\necho \"export RCT_METRO_PORT=${RCT_METRO_PORT}\" > \"${SRCROOT}/../node_modules/react-native/scripts/.packager.env\"\nif [ -z \"${RCT_NO_LAUNCH_PACKAGER+xxx}\" ] ; then\n  if nc -w 5 -z localhost ${RCT_METRO_PORT} ; then\n    if ! curl -s \"http://localhost:${RCT_METRO_PORT}/status\" | grep -q \"packager-status:running\" ; then\n      echo \"Port ${RCT_METRO_PORT} already in use, packager is either not running or not running correctly\"\n      exit 2\n    fi\n  else\n    open \"$SRCROOT/../node_modules/react-native/scripts/launchPackager.command\" || echo \"Can't start packager automatically\"\n  fi\nfi\n";
 			showEnvVarsInLog = 0;
 		};
+		A1MAKEAPISIGNER01 /* Generate Edge API Signer */ = {
+			isa = PBXShellScriptBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			inputFileListPaths = (
+			);
+			/* alwaysOutOfDate: deployPatches rewrites applicationId / PRODUCT_BUNDLE_IDENTIFIER;
+			   dependency analysis on edgeKey alone would still skip regen after ID-only patches. */
+			alwaysOutOfDate = 1;
+			inputPaths = (
+				"$(SRCROOT)/.xcode.env.local",
+				"$(SRCROOT)/.xcode.env",
+				"$(SRCROOT)/../edgeKey.json",
+				"$(SRCROOT)/../android/app/build.gradle",
+				"$(SRCROOT)/edge.xcodeproj/project.pbxproj",
+				"$(SRCROOT)/../scripts/makeApiSigner.ts",
+				"$(SRCROOT)/../scripts/makeNativeHeaders.ts",
+			);
+			name = "Generate Edge API Signer";
+			outputFileListPaths = (
+			);
+			outputPaths = (
+				"$(SRCROOT)/EdgeApiSecret.c",
+				"$(SRCROOT)/EdgeApiSecret.h",
+				"$(SRCROOT)/EdgeApiKey.swift",
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+			shellPath = /bin/sh;
+			shellScript = "# Xcode build phases run with a sanitized PATH, so pick up NODE_BINARY the\n# same way the React Native bundle phase does.\nset -e\nif [ -f \"$SRCROOT/.xcode.env\" ]; then . \"$SRCROOT/.xcode.env\"; fi\nif [ -f \"$SRCROOT/.xcode.env.local\" ]; then . \"$SRCROOT/.xcode.env.local\"; fi\ncd \"${SRCROOT}/..\"\nenv -u EDGE_API_SIGNER_ALLOW_STUB \"${NODE_BINARY:-node}\" -r sucrase/register ./scripts/makeApiSigner.ts\n\"${NODE_BINARY:-node}\" -r sucrase/register ./scripts/makeNativeHeaders.ts\n";
+		};
 /* End PBXShellScriptBuildPhase section */
 
 /* Begin PBXSourcesBuildPhase section */
@@ -472,6 +513,9 @@
 				812B284944A10A722B22763D /* ExpoModulesProvider.swift in Sources */,
 				04DBAACE71E94A3B9BCAF10A /* EdgeAttestation.swift in Sources */,
 				E180252EBEC449FE9A1DFAE6 /* EdgeAttestation.m in Sources */,
+				A1APISIGNERBF01 /* EdgeApiSigner.m in Sources */,
+				A1APISECRETBF01 /* EdgeApiSecret.c in Sources */,
+				A1EDGEHMACBF01 /* edge_hmac.c in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -488,6 +532,11 @@
 				CURRENT_PROJECT_VERSION = 1;
 				DEVELOPMENT_TEAM = G5LQ7MERPK;
 				ENABLE_BITCODE = NO;
+				HEADER_SEARCH_PATHS = (
+					"$(inherited)",
+					"$(SRCROOT)",
+					"$(SRCROOT)/../native/edge-api-signer",
+				);
 				INFOPLIST_FILE = edge/Info.plist;
 				IPHONEOS_DEPLOYMENT_TARGET = 15.6;
 				LD_RUNPATH_SEARCH_PATHS = (
@@ -518,6 +567,11 @@
 				CODE_SIGN_ENTITLEMENTS = edge/edge.entitlements;
 				CURRENT_PROJECT_VERSION = 1;
 				DEVELOPMENT_TEAM = G5LQ7MERPK;
+				HEADER_SEARCH_PATHS = (
+					"$(inherited)",
+					"$(SRCROOT)",
+					"$(SRCROOT)/../native/edge-api-signer",
+				);
 				INFOPLIST_FILE = edge/Info.plist;
 				IPHONEOS_DEPLOYMENT_TARGET = 15.6;
 				LD_RUNPATH_SEARCH_PATHS = (
diff --git a/ios/edge/EdgeApiSigner.m b/ios/edge/EdgeApiSigner.m
new file mode 100644
index 00000000000..5ebcb7b97b9
--- /dev/null
+++ b/ios/edge/EdgeApiSigner.m
@@ -0,0 +1,99 @@
+#import <React/RCTBridgeModule.h>
+#import <Foundation/Foundation.h>
+
+#include "edge_api_sign.h"
+
+@interface EdgeApiSigner : NSObject <RCTBridgeModule>
+@end
+
+@implementation EdgeApiSigner
+
+RCT_EXPORT_MODULE();
+
++ (BOOL)requiresMainQueueSetup
+{
+  return NO;
+}
+
+static NSString *edgeBase64(const uint8_t *bytes, size_t len)
+{
+  NSData *data = [NSData dataWithBytes:bytes length:len];
+  return [data base64EncodedStringWithOptions:0];
+}
+
+RCT_EXPORT_METHOD(signMessage
+                  : (NSString *)message
+                  resolver:(RCTPromiseResolveBlock)resolve
+                  rejecter:(RCTPromiseRejectBlock)reject)
+{
+  if (message == nil) {
+    reject(@"EDGE_API_SIGNER", @"message is required", nil);
+    return;
+  }
+
+  NSString *bundleId = [[NSBundle mainBundle] bundleIdentifier];
+  if (bundleId == nil) {
+    reject(@"EDGE_API_SIGNER", @"bundleIdentifier is nil", nil);
+    return;
+  }
+
+  // Real UTF-8 bytes + explicit length (not UTF8String/strlen, which truncate
+  // on embedded NUL and can return NULL for unpaired surrogates).
+  NSData *msgData = [message dataUsingEncoding:NSUTF8StringEncoding];
+  if (msgData == nil) {
+    reject(@"EDGE_API_SIGNER", @"message is not valid UTF-8", nil);
+    return;
+  }
+
+  const char *bundleCStr = [bundleId UTF8String];
+  if (bundleCStr == NULL) {
+    reject(@"EDGE_API_SIGNER", @"bundleIdentifier UTF-8 conversion failed", nil);
+    return;
+  }
+
+  // `NSData.bytes` is NULL for a zero-length NSData, which would trip the
+  // `message == NULL` guard in edge_api_hmac_sign and reject. Android signs the
+  // empty message happily, so point at a valid zero-length buffer to keep the
+  // two platforms byte-compatible.
+  const uint8_t *msgBytes =
+    msgData.length == 0 ? (const uint8_t *)"" : (const uint8_t *)msgData.bytes;
+
+  uint8_t signature[32];
+  int rc = edge_api_hmac_sign(
+    msgBytes,
+    (size_t)msgData.length,
+    bundleCStr,
+    signature
+  );
+  if (rc != 0) {
+    reject(@"EDGE_API_SIGNER", @"edge_api_hmac_sign failed", nil);
+    return;
+  }
+
+  // stringWithUTF8String returns nil on invalid UTF-8, and a nil value in a
+  // dictionary literal raises rather than rejecting.
+  NSString *apiKey = [NSString stringWithUTF8String:edge_api_key()];
+  if (apiKey == nil) {
+    reject(@"EDGE_API_SIGNER", @"apiKey is not valid UTF-8", nil);
+    return;
+  }
+
+  resolve(@{
+    @"apiKey" : apiKey,
+    @"signature" : edgeBase64(signature, 32)
+  });
+}
+
+RCT_EXPORT_METHOD(getApiKey
+                  : (RCTPromiseResolveBlock)resolve
+                  rejecter:(RCTPromiseRejectBlock)reject)
+{
+  NSString *apiKey = [NSString stringWithUTF8String:edge_api_key()];
+  if (apiKey == nil) {
+    reject(@"EDGE_API_SIGNER", @"apiKey is not valid UTF-8", nil);
+    return;
+  }
+  resolve(apiKey);
+}
+
+@end
diff --git a/jestSetup.js b/jestSetup.js
index 2bae801fbaf..9838bfa4207 100644
--- a/jestSetup.js
+++ b/jestSetup.js
@@ -246,7 +246,8 @@ jest.mock('react-native-device-info', () => {
     getDeviceType: jest.fn(),
     hasNotch: jest.fn(),
     getBuildNumber: jest.fn(),
-    getVersion: jest.fn()
+    getVersion: jest.fn(() => '1.2.3'),
+    getSystemVersion: jest.fn(() => '18.0.0')
   }
 })
 
diff --git a/native/edge-api-signer/edge_api_sign.h b/native/edge-api-signer/edge_api_sign.h
new file mode 100644
index 00000000000..f5419c7d328
--- /dev/null
+++ b/native/edge-api-signer/edge_api_sign.h
@@ -0,0 +1,31 @@
+#ifndef EDGE_API_SIGN_H
+#define EDGE_API_SIGN_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/** Public API key identifier (not secret). */
+const char *edge_api_key(void);
+
+/**
+ * HMAC-SHA256 the UTF-8 message with the reassembled API secret.
+ * Writes 32 bytes to signature_out.
+ * bundle_id is used as a runtime pad (typically "co.edgesecure.app").
+ * Returns 0 on success, non-zero on failure.
+ */
+int edge_api_hmac_sign(
+  const uint8_t *message,
+  size_t message_len,
+  const char *bundle_id,
+  uint8_t signature_out[32]
+);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* EDGE_API_SIGN_H */
diff --git a/native/edge-api-signer/edge_hmac.c b/native/edge-api-signer/edge_hmac.c
new file mode 100644
index 00000000000..02ca42514ca
--- /dev/null
+++ b/native/edge-api-signer/edge_hmac.c
@@ -0,0 +1,177 @@
+#include "edge_hmac.h"
+
+#include <string.h>
+
+#define ROTRIGHT(a, b) (((a) >> (b)) | ((a) << (32 - (b))))
+#define CH(x, y, z) (((x) & (y)) ^ (~(x) & (z)))
+#define MAJ(x, y, z) (((x) & (y)) ^ ((x) & (z)) ^ ((y) & (z)))
+#define EP0(x) (ROTRIGHT(x, 2) ^ ROTRIGHT(x, 13) ^ ROTRIGHT(x, 22))
+#define EP1(x) (ROTRIGHT(x, 6) ^ ROTRIGHT(x, 11) ^ ROTRIGHT(x, 25))
+#define SIG0(x) (ROTRIGHT(x, 7) ^ ROTRIGHT(x, 18) ^ ((x) >> 3))
+#define SIG1(x) (ROTRIGHT(x, 17) ^ ROTRIGHT(x, 19) ^ ((x) >> 10))
+
+static const uint32_t k[64] = {
+  0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1,
+  0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
+  0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786,
+  0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+  0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147,
+  0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
+  0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b,
+  0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+  0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a,
+  0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
+  0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
+};
+
+void edge_secure_wipe(void *ptr, size_t len) {
+  volatile uint8_t *p = (volatile uint8_t *)ptr;
+  while (len--) {
+    *p++ = 0;
+  }
+}
+
+static void sha256_transform(edge_sha256_ctx *ctx, const uint8_t data[]) {
+  uint32_t a, b, c, d, e, f, g, h, i, j, t1, t2, m[64];
+
+  for (i = 0, j = 0; i < 16; ++i, j += 4)
+    m[i] = ((uint32_t)data[j] << 24) | ((uint32_t)data[j + 1] << 16) |
+           ((uint32_t)data[j + 2] << 8) | ((uint32_t)data[j + 3]);
+  for (; i < 64; ++i)
+    m[i] = SIG1(m[i - 2]) + m[i - 7] + SIG0(m[i - 15]) + m[i - 16];
+
+  a = ctx->state[0];
+  b = ctx->state[1];
+  c = ctx->state[2];
+  d = ctx->state[3];
+  e = ctx->state[4];
+  f = ctx->state[5];
+  g = ctx->state[6];
+  h = ctx->state[7];
+
+  for (i = 0; i < 64; ++i) {
+    t1 = h + EP1(e) + CH(e, f, g) + k[i] + m[i];
+    t2 = EP0(a) + MAJ(a, b, c);
+    h = g;
+    g = f;
+    f = e;
+    e = d + t1;
+    d = c;
+    c = b;
+    b = a;
+    a = t1 + t2;
+  }
+
+  ctx->state[0] += a;
+  ctx->state[1] += b;
+  ctx->state[2] += c;
+  ctx->state[3] += d;
+  ctx->state[4] += e;
+  ctx->state[5] += f;
+  ctx->state[6] += g;
+  ctx->state[7] += h;
+}
+
+void edge_sha256_init(edge_sha256_ctx *ctx) {
+  ctx->datalen = 0;
+  ctx->bitlen = 0;
+  ctx->state[0] = 0x6a09e667;
+  ctx->state[1] = 0xbb67ae85;
+  ctx->state[2] = 0x3c6ef372;
+  ctx->state[3] = 0xa54ff53a;
+  ctx->state[4] = 0x510e527f;
+  ctx->state[5] = 0x9b05688c;
+  ctx->state[6] = 0x1f83d9ab;
+  ctx->state[7] = 0x5be0cd19;
+}
+
+void edge_sha256_update(edge_sha256_ctx *ctx, const uint8_t *data, size_t len) {
+  size_t i;
+  for (i = 0; i < len; ++i) {
+    ctx->data[ctx->datalen] = data[i];
+    ctx->datalen++;
+    if (ctx->datalen == EDGE_SHA256_BLOCK_SIZE) {
+      sha256_transform(ctx, ctx->data);
+      ctx->bitlen += 512;
+      ctx->datalen = 0;
+    }
+  }
+}
+
+void edge_sha256_final(edge_sha256_ctx *ctx, uint8_t hash[EDGE_SHA256_DIGEST_SIZE]) {
+  uint32_t i = ctx->datalen;
+
+  if (ctx->datalen < 56) {
+    ctx->data[i++] = 0x80;
+    while (i < 56) ctx->data[i++] = 0x00;
+  } else {
+    ctx->data[i++] = 0x80;
+    while (i < 64) ctx->data[i++] = 0x00;
+    sha256_transform(ctx, ctx->data);
+    memset(ctx->data, 0, 56);
+  }
+
+  ctx->bitlen += ctx->datalen * 8;
+  ctx->data[63] = (uint8_t)(ctx->bitlen);
+  ctx->data[62] = (uint8_t)(ctx->bitlen >> 8);
+  ctx->data[61] = (uint8_t)(ctx->bitlen >> 16);
+  ctx->data[60] = (uint8_t)(ctx->bitlen >> 24);
+  ctx->data[59] = (uint8_t)(ctx->bitlen >> 32);
+  ctx->data[58] = (uint8_t)(ctx->bitlen >> 40);
+  ctx->data[57] = (uint8_t)(ctx->bitlen >> 48);
+  ctx->data[56] = (uint8_t)(ctx->bitlen >> 56);
+  sha256_transform(ctx, ctx->data);
+
+  for (i = 0; i < 4; ++i) {
+    hash[i] = (ctx->state[0] >> (24 - i * 8)) & 0xff;
+    hash[i + 4] = (ctx->state[1] >> (24 - i * 8)) & 0xff;
+    hash[i + 8] = (ctx->state[2] >> (24 - i * 8)) & 0xff;
+    hash[i + 12] = (ctx->state[3] >> (24 - i * 8)) & 0xff;
+    hash[i + 16] = (ctx->state[4] >> (24 - i * 8)) & 0xff;
+    hash[i + 20] = (ctx->state[5] >> (24 - i * 8)) & 0xff;
+    hash[i + 24] = (ctx->state[6] >> (24 - i * 8)) & 0xff;
+    hash[i + 28] = (ctx->state[7] >> (24 - i * 8)) & 0xff;
+  }
+}
+
+void edge_hmac_sha256(
+  const uint8_t *key,
+  size_t key_len,
+  const uint8_t *msg,
+  size_t msg_len,
+  uint8_t out[EDGE_SHA256_DIGEST_SIZE]
+) {
+  uint8_t k_pad[EDGE_SHA256_BLOCK_SIZE];
+  uint8_t tk[EDGE_SHA256_DIGEST_SIZE];
+  uint8_t i_hash[EDGE_SHA256_DIGEST_SIZE];
+  edge_sha256_ctx ctx;
+  size_t i;
+
+  if (key_len > EDGE_SHA256_BLOCK_SIZE) {
+    edge_sha256_init(&ctx);
+    edge_sha256_update(&ctx, key, key_len);
+    edge_sha256_final(&ctx, tk);
+    key = tk;
+    key_len = EDGE_SHA256_DIGEST_SIZE;
+  }
+
+  memset(k_pad, 0, sizeof(k_pad));
+  memcpy(k_pad, key, key_len);
+
+  for (i = 0; i < EDGE_SHA256_BLOCK_SIZE; ++i) k_pad[i] ^= 0x36;
+  edge_sha256_init(&ctx);
+  edge_sha256_update(&ctx, k_pad, EDGE_SHA256_BLOCK_SIZE);
+  edge_sha256_update(&ctx, msg, msg_len);
+  edge_sha256_final(&ctx, i_hash);
+
+  for (i = 0; i < EDGE_SHA256_BLOCK_SIZE; ++i) k_pad[i] ^= (0x36 ^ 0x5c);
+  edge_sha256_init(&ctx);
+  edge_sha256_update(&ctx, k_pad, EDGE_SHA256_BLOCK_SIZE);
+  edge_sha256_update(&ctx, i_hash, EDGE_SHA256_DIGEST_SIZE);
+  edge_sha256_final(&ctx, out);
+
+  edge_secure_wipe(k_pad, sizeof(k_pad));
+  edge_secure_wipe(tk, sizeof(tk));
+  edge_secure_wipe(i_hash, sizeof(i_hash));
+  edge_secure_wipe(&ctx, sizeof(ctx));
+}
diff --git a/native/edge-api-signer/edge_hmac.h b/native/edge-api-signer/edge_hmac.h
new file mode 100644
index 00000000000..3c522ff4257
--- /dev/null
+++ b/native/edge-api-signer/edge_hmac.h
@@ -0,0 +1,44 @@
+/* Compact public-domain SHA-256 + HMAC-SHA256 for Edge API signing.
+ * Based on Brad Conte's public-domain SHA-256 (unlicense / public domain). */
+
+#ifndef EDGE_HMAC_H
+#define EDGE_HMAC_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define EDGE_SHA256_DIGEST_SIZE 32
+#define EDGE_SHA256_BLOCK_SIZE 64
+
+typedef struct {
+  uint8_t data[EDGE_SHA256_BLOCK_SIZE];
+  uint32_t datalen;
+  uint64_t bitlen;
+  uint32_t state[8];
+} edge_sha256_ctx;
+
+void edge_sha256_init(edge_sha256_ctx *ctx);
+void edge_sha256_update(edge_sha256_ctx *ctx, const uint8_t *data, size_t len);
+void edge_sha256_final(edge_sha256_ctx *ctx, uint8_t hash[EDGE_SHA256_DIGEST_SIZE]);
+
+/** HMAC-SHA256. out must be EDGE_SHA256_DIGEST_SIZE bytes. */
+void edge_hmac_sha256(
+  const uint8_t *key,
+  size_t key_len,
+  const uint8_t *msg,
+  size_t msg_len,
+  uint8_t out[EDGE_SHA256_DIGEST_SIZE]
+);
+
+/** Best-effort wipe that compilers should not optimize away. */
+void edge_secure_wipe(void *ptr, size_t len);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* EDGE_HMAC_H */
diff --git a/native/edge-api-signer/node/binding.gyp b/native/edge-api-signer/node/binding.gyp
new file mode 100644
index 00000000000..1b6040dbf75
--- /dev/null
+++ b/native/edge-api-signer/node/binding.gyp
@@ -0,0 +1,18 @@
+{
+  "targets": [
+    {
+      "target_name": "edge_api_signer",
+      "sources": [
+        "edge_api_signer_napi.c",
+        "edge_api_secret.c",
+        "../edge_hmac.c"
+      ],
+      "include_dirs": ["..", "."],
+      "cflags": ["-Wall", "-Wextra", "-Wno-unused-parameter"],
+      "xcode_settings": {
+        "OTHER_CFLAGS": ["-Wall", "-Wextra", "-Wno-unused-parameter"],
+        "MACOSX_DEPLOYMENT_TARGET": "11.0"
+      }
+    }
+  ]
+}
diff --git a/native/edge-api-signer/node/edge_api_signer_napi.c b/native/edge-api-signer/node/edge_api_signer_napi.c
new file mode 100644
index 00000000000..31821b9fb29
--- /dev/null
+++ b/native/edge-api-signer/node/edge_api_signer_napi.c
@@ -0,0 +1,176 @@
+/**
+ * Node N-API bindings for the shared Edge API HMAC C core.
+ *
+ * The runtime pad comes from the generated edge_api_secret.h rather than a
+ * literal here, so it is always the id scripts/makeApiSigner.ts baked into the
+ * shards. A stale or hand-edited header fails the build instead of silently
+ * producing signatures the login server rejects.
+ */
+
+#include <node_api.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "edge_api_secret.h"
+#include "edge_api_sign.h"
+
+#ifndef EDGE_NODE_BUNDLE_ID
+#error "EDGE_NODE_BUNDLE_ID missing - regenerate with scripts/makeApiSigner.ts"
+#endif
+
+static const char kBase64Table[] =
+  "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+
+static char *edge_base64_encode(const uint8_t *data, size_t len) {
+  size_t out_len = 4 * ((len + 2) / 3);
+  char *out = (char *)malloc(out_len + 1);
+  size_t i;
+  size_t j = 0;
+  if (out == NULL) return NULL;
+
+  for (i = 0; i + 2 < len; i += 3) {
+    uint32_t n = ((uint32_t)data[i] << 16) | ((uint32_t)data[i + 1] << 8) |
+                 (uint32_t)data[i + 2];
+    out[j++] = kBase64Table[(n >> 18) & 63];
+    out[j++] = kBase64Table[(n >> 12) & 63];
+    out[j++] = kBase64Table[(n >> 6) & 63];
+    out[j++] = kBase64Table[n & 63];
+  }
+  if (i < len) {
+    uint32_t n = ((uint32_t)data[i] << 16);
+    out[j++] = kBase64Table[(n >> 18) & 63];
+    if (i + 1 < len) {
+      n |= ((uint32_t)data[i + 1] << 8);
+      out[j++] = kBase64Table[(n >> 12) & 63];
+      out[j++] = kBase64Table[(n >> 6) & 63];
+      out[j++] = '=';
+    } else {
+      out[j++] = kBase64Table[(n >> 12) & 63];
+      out[j++] = '=';
+      out[j++] = '=';
+    }
+  }
+  out[j] = '\0';
+  return out;
+}
+
+static napi_value edge_throw(napi_env env, const char *message) {
+  napi_throw_error(env, NULL, message);
+  return NULL;
+}
+
+static napi_value SignMessage(napi_env env, napi_callback_info info) {
+  size_t argc = 1;
+  napi_value argv[1];
+  napi_status status;
+  napi_valuetype value_type;
+  size_t msg_len = 0;
+  char *msg = NULL;
+  uint8_t signature[32];
+  char *signature_b64 = NULL;
+  napi_value result;
+  napi_value api_key_val;
+  napi_value signature_val;
+  int rc;
+
+  status = napi_get_cb_info(env, info, &argc, argv, NULL, NULL);
+  if (status != napi_ok || argc < 1) {
+    return edge_throw(env, "signMessage(message) requires a string");
+  }
+
+  status = napi_typeof(env, argv[0], &value_type);
+  if (status != napi_ok || value_type != napi_string) {
+    return edge_throw(env, "message must be a string");
+  }
+
+  status = napi_get_value_string_utf8(env, argv[0], NULL, 0, &msg_len);
+  if (status != napi_ok) {
+    return edge_throw(env, "failed to read message length");
+  }
+
+  msg = (char *)malloc(msg_len + 1);
+  if (msg == NULL) {
+    return edge_throw(env, "out of memory");
+  }
+
+  status = napi_get_value_string_utf8(env, argv[0], msg, msg_len + 1, &msg_len);
+  if (status != napi_ok) {
+    free(msg);
+    return edge_throw(env, "failed to read message");
+  }
+
+  rc = edge_api_hmac_sign(
+    (const uint8_t *)msg, msg_len, EDGE_NODE_BUNDLE_ID, signature
+  );
+  free(msg);
+  if (rc != 0) {
+    return edge_throw(env, "edge_api_hmac_sign failed");
+  }
+
+  signature_b64 = edge_base64_encode(signature, 32);
+  if (signature_b64 == NULL) {
+    return edge_throw(env, "out of memory");
+  }
+
+  status = napi_create_object(env, &result);
+  if (status != napi_ok) {
+    free(signature_b64);
+    return edge_throw(env, "failed to create result object");
+  }
+
+  status = napi_create_string_utf8(env, edge_api_key(), NAPI_AUTO_LENGTH, &api_key_val);
+  if (status != napi_ok) {
+    free(signature_b64);
+    return edge_throw(env, "failed to create apiKey");
+  }
+
+  status = napi_create_string_utf8(
+    env, signature_b64, NAPI_AUTO_LENGTH, &signature_val
+  );
+  free(signature_b64);
+  if (status != napi_ok) {
+    return edge_throw(env, "failed to create signature");
+  }
+
+  status = napi_set_named_property(env, result, "apiKey", api_key_val);
+  if (status != napi_ok) {
+    return edge_throw(env, "failed to set apiKey");
+  }
+  status = napi_set_named_property(env, result, "signature", signature_val);
+  if (status != napi_ok) {
+    return edge_throw(env, "failed to set signature");
+  }
+
+  return result;
+}
+
+static napi_value GetApiKey(napi_env env, napi_callback_info info) {
+  napi_value result;
+  napi_status status =
+    napi_create_string_utf8(env, edge_api_key(), NAPI_AUTO_LENGTH, &result);
+  if (status != napi_ok) {
+    return edge_throw(env, "failed to create apiKey");
+  }
+  return result;
+}
+
+static napi_value Init(napi_env env, napi_value exports) {
+  napi_value sign_fn;
+  napi_value get_key_fn;
+  napi_status status;
+
+  status = napi_create_function(env, "signMessage", NAPI_AUTO_LENGTH, SignMessage, NULL, &sign_fn);
+  if (status != napi_ok) return NULL;
+  status = napi_set_named_property(env, exports, "signMessage", sign_fn);
+  if (status != napi_ok) return NULL;
+
+  status = napi_create_function(env, "getApiKey", NAPI_AUTO_LENGTH, GetApiKey, NULL, &get_key_fn);
+  if (status != napi_ok) return NULL;
+  status = napi_set_named_property(env, exports, "getApiKey", get_key_fn);
+  if (status != napi_ok) return NULL;
+
+  return exports;
+}
+
+NAPI_MODULE(NODE_GYP_MODULE_NAME, Init)
diff --git a/package-lock.json b/package-lock.json
index a78c2afdca1..7ef397eb10d 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -56,8 +56,11 @@
         "ethers": "^5.7.2",
         "expo": "^53.0.0",
         "expo-quick-actions": "^5.0.0",
+        "hash.js": "^1.1.7",
         "jsrsasign": "^11.1.0",
+        "lib-cmdparse": "^0.1.0",
         "marked": "^15.0.9",
+        "nanocolors": "^0.1.2",
         "p-debounce": "^4.0.0",
         "posthog-js": "^1.88.1",
         "posthog-react-native": "^2.8.1",
@@ -122,10 +125,12 @@
         "rn-qr-generator": "^1.4.6",
         "scheduler": "^0.23.0",
         "sha.js": "^2.4.11",
+        "source-map-support": "^0.4.14",
         "sprintf-js": "^1.1.1",
         "url": "^0.11.0",
         "url-parse": "^1.5.2",
         "use-context-selector": "^2.0.0",
+        "xdg-basedir": "^4.0.0",
         "yaob": "^0.4.0",
         "yavent": "^0.1.5",
         "zcashname-sdk": "^0.7.2"
@@ -142,7 +147,9 @@
         "@react-native/babel-preset": "0.79.2",
         "@react-native/metro-config": "0.79.2",
         "@react-native/typescript-config": "0.79.2",
-        "@rollup/plugin-babel": "^6.0.3",
+        "@rollup/plugin-babel": "^6.1.0",
+        "@rollup/plugin-json": "^6.1.0",
+        "@rollup/plugin-node-resolve": "^16.0.3",
         "@stakekit/api-hooks": "^0.0.93",
         "@testing-library/react-native": "^13.2.0",
         "@typechain/ethers-v5": "^11.1.2",
@@ -170,6 +177,7 @@
         "add": "^2.0.6",
         "babel-eslint": "^10.1.0",
         "babel-jest": "^29.6.3",
+        "babel-plugin-transform-fake-error-class": "^1.0.0",
         "body-parser": "^1.18.2",
         "buffer": "^6.0.3",
         "crypto-browserify": "^3.12.0",
@@ -186,6 +194,7 @@
         "msw": "^2.8.4",
         "msw-snapshot": "^5.3.0",
         "node-fetch": "2.x",
+        "node-gyp": "^13.0.1",
         "os-browserify": "^0.3.0",
         "patch-package": "^8.0.0",
         "path-browserify": "^1.0.1",
@@ -3800,6 +3809,16 @@
       "version": "2.0.0",
       "license": "MIT"
     },
+    "node_modules/@expo/cli/node_modules/source-map-support": {
+      "version": "0.5.21",
+      "resolved": "https://registry.npmjs.org/source-map-support/-/source-map-support-0.5.21.tgz",
+      "integrity": "sha512-uBHU3L3czsIyYXKX88fdrGovxdSCoTGDRZ6SYXtSRxLZUzHg5P/66Ht6uoUlHu9EZod+inXhKo3qQgwXUT/y1w==",
+      "license": "MIT",
+      "dependencies": {
+        "buffer-from": "^1.0.0",
+        "source-map": "^0.6.0"
+      }
+    },
     "node_modules/@expo/cli/node_modules/undici": {
       "version": "6.21.3",
       "license": "MIT",
@@ -8506,7 +8525,9 @@
       }
     },
     "node_modules/@rollup/plugin-babel": {
-      "version": "6.0.3",
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/@rollup/plugin-babel/-/plugin-babel-6.1.0.tgz",
+      "integrity": "sha512-dFZNuFD2YRcoomP4oYf+DvQNSUA9ih+A3vUqopQx5EdtPGo3WBnQcI/S8pwpz91UsGfL0HsMSOlaMld8HrbubA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -8519,7 +8540,7 @@
       "peerDependencies": {
         "@babel/core": "^7.0.0",
         "@types/babel__core": "^7.1.9",
-        "rollup": "^1.20.0||^2.0.0||^3.0.0"
+        "rollup": "^1.20.0||^2.0.0||^3.0.0||^4.0.0"
       },
       "peerDependenciesMeta": {
         "@types/babel__core": {
@@ -8530,20 +8551,68 @@
         }
       }
     },
+    "node_modules/@rollup/plugin-json": {
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/@rollup/plugin-json/-/plugin-json-6.1.0.tgz",
+      "integrity": "sha512-EGI2te5ENk1coGeADSIwZ7G2Q8CJS2sF120T7jLw4xFw9n7wIOXHo+kIYRAoVpJAN+kmqZSoO3Fp4JtoNF4ReA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@rollup/pluginutils": "^5.1.0"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      },
+      "peerDependencies": {
+        "rollup": "^1.20.0||^2.0.0||^3.0.0||^4.0.0"
+      },
+      "peerDependenciesMeta": {
+        "rollup": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@rollup/plugin-node-resolve": {
+      "version": "16.0.3",
+      "resolved": "https://registry.npmjs.org/@rollup/plugin-node-resolve/-/plugin-node-resolve-16.0.3.tgz",
+      "integrity": "sha512-lUYM3UBGuM93CnMPG1YocWu7X802BrNF3jW2zny5gQyLQgRFJhV1Sq0Zi74+dh/6NBx1DxFC4b4GXg9wUCG5Qg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@rollup/pluginutils": "^5.0.1",
+        "@types/resolve": "1.20.2",
+        "deepmerge": "^4.2.2",
+        "is-module": "^1.0.0",
+        "resolve": "^1.22.1"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      },
+      "peerDependencies": {
+        "rollup": "^2.78.0||^3.0.0||^4.0.0"
+      },
+      "peerDependenciesMeta": {
+        "rollup": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/@rollup/pluginutils": {
-      "version": "5.0.2",
+      "version": "5.4.0",
+      "resolved": "https://registry.npmjs.org/@rollup/pluginutils/-/pluginutils-5.4.0.tgz",
+      "integrity": "sha512-MfPp06CjRLfXQ3wY0R8vJDYBy/MvVcc9OulEfR0B8Iv9ko+GCNaRZ+EpJYFl27LhKsZK0o420sYCRHCjfCgeUg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/estree": "^1.0.0",
         "estree-walker": "^2.0.2",
-        "picomatch": "^2.3.1"
+        "picomatch": "^4.0.2"
       },
       "engines": {
         "node": ">=14.0.0"
       },
       "peerDependencies": {
-        "rollup": "^1.20.0||^2.0.0||^3.0.0"
+        "rollup": "^1.20.0||^2.0.0||^3.0.0||^4.0.0"
       },
       "peerDependenciesMeta": {
         "rollup": {
@@ -8551,6 +8620,19 @@
         }
       }
     },
+    "node_modules/@rollup/pluginutils/node_modules/picomatch": {
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
+      "integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
     "node_modules/@rtsao/scc": {
       "version": "1.1.0",
       "dev": true,
@@ -10529,6 +10611,13 @@
         "redux": "^4.0.0"
       }
     },
+    "node_modules/@types/resolve": {
+      "version": "1.20.2",
+      "resolved": "https://registry.npmjs.org/@types/resolve/-/resolve-1.20.2.tgz",
+      "integrity": "sha512-60BCwRFOZCQhDncwQdxxeOEEkbc5dIMccYLwbxsS4TUNeVECQ/pBJ0j09mrHOl/JJvpRPGwO9SvE4nR2Nb/a4Q==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@types/secp256k1": {
       "version": "4.0.3",
       "license": "MIT",
@@ -11625,6 +11714,16 @@
         "node": ">=14.0.0"
       }
     },
+    "node_modules/abbrev": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/abbrev/-/abbrev-5.0.0.tgz",
+      "integrity": "sha512-/XrFJgzQQQHpti1raDJC6m4ws6aNktmjBlhk8Fdlk7LwCEuDoieEJJY9OFHjfiFJFFRM2tK+Ky/IsfbbmlMu1w==",
+      "dev": true,
+      "license": "ISC",
+      "engines": {
+        "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+      }
+    },
     "node_modules/abort-controller": {
       "version": "3.0.0",
       "license": "MIT",
@@ -12022,6 +12121,12 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/array-filter": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/array-filter/-/array-filter-0.0.1.tgz",
+      "integrity": "sha512-VW0FpCIhjZdarWjIz8Vpva7U95fl2Jn+b+mmFFMLn8PIVscOQcAgEznwUzTEuUHuqZqIxwzRlcaN/urTFFQoiw==",
+      "license": "MIT"
+    },
     "node_modules/array-flatten": {
       "version": "1.1.1",
       "dev": true,
@@ -12048,6 +12153,21 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/array-map": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/array-map/-/array-map-0.0.1.tgz",
+      "integrity": "sha512-sxHIeJTGEsRC8/hYkZzdJNNPZ41EXHVys7pqMw1iwE/Kx8/hto0UbDuGQsSJ0ujPovj9qUZl6EOY/EiZ2g3d9Q==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/array-reduce": {
+      "version": "0.0.0",
+      "resolved": "https://registry.npmjs.org/array-reduce/-/array-reduce-0.0.0.tgz",
+      "integrity": "sha512-8jR+StqaC636u7h3ye1co3lQRefgVVUQUhuAmRbDqIMeR2yuXzRvkCNQiQ5J/wbREmoBLNtp13dhaaVpZQDRUw==",
+      "license": "MIT"
+    },
     "node_modules/array.prototype.findlast": {
       "version": "1.2.5",
       "dev": true,
@@ -12540,6 +12660,16 @@
         "hermes-parser": "0.25.1"
       }
     },
+    "node_modules/babel-plugin-transform-fake-error-class": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/babel-plugin-transform-fake-error-class/-/babel-plugin-transform-fake-error-class-1.0.0.tgz",
+      "integrity": "sha512-ZhsIoZTA5m5i0o87HGw11lVgQkAwdQzMYLrgio1u8C5M4/uXoVxlMO5FcYQiOCUe2uPV4ABDBrF2QVaW7BzcHA==",
+      "dev": true,
+      "license": "MIT",
+      "peerDependencies": {
+        "@babel/core": "^7.0.0"
+      }
+    },
     "node_modules/babel-plugin-transform-flow-enums": {
       "version": "0.0.2",
       "license": "MIT",
@@ -17398,6 +17528,24 @@
         "bser": "2.1.1"
       }
     },
+    "node_modules/fdir": {
+      "version": "6.5.0",
+      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
+      "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.0.0"
+      },
+      "peerDependencies": {
+        "picomatch": "^3 || ^4"
+      },
+      "peerDependenciesMeta": {
+        "picomatch": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/feaxios": {
       "version": "0.0.23",
       "resolved": "https://registry.npmjs.org/feaxios/-/feaxios-0.0.23.tgz",
@@ -20256,7 +20404,6 @@
       "version": "0.0.1",
       "resolved": "https://registry.npmjs.org/jsonify/-/jsonify-0.0.1.tgz",
       "integrity": "sha512-2/Ki0GcmuqSrgFyelQq9M05y7PS0mEwuIzrf3f1fPqkVDVRvZrPZtVSMHxdgo8Aq0sxAOb/cr2aqqA3LeWHVPg==",
-      "dev": true,
       "license": "Public Domain",
       "funding": {
         "url": "https://github.com/sponsors/ljharb"
@@ -20385,6 +20532,27 @@
         "node": ">= 0.8.0"
       }
     },
+    "node_modules/lib-cmdparse": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/lib-cmdparse/-/lib-cmdparse-0.1.0.tgz",
+      "integrity": "sha512-D4sP6p4h5/lbxkvnwFRvr/uBe0l73yRJOxVBeB9uRMdZK/e6s3FhCw6y2+eUCiJBBSYNFPPWP8h35ejHq6X/mQ==",
+      "license": "MIT",
+      "dependencies": {
+        "shell-quote": "~1.4.0"
+      }
+    },
+    "node_modules/lib-cmdparse/node_modules/shell-quote": {
+      "version": "1.4.3",
+      "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.4.3.tgz",
+      "integrity": "sha512-0Y4SH6mnoNZNW29pNEC0E1F//X7AmbpOj/j5oTssXFUvg2J9MbKIVH3S5ca8Je1Hr36utXJqlzCbYxEYsPAR4A==",
+      "license": "MIT",
+      "dependencies": {
+        "array-filter": "~0.0.0",
+        "array-map": "~0.0.0",
+        "array-reduce": "~0.0.0",
+        "jsonify": "~0.0.0"
+      }
+    },
     "node_modules/libsodium-sumo": {
       "version": "0.7.16",
       "resolved": "https://registry.npmjs.org/libsodium-sumo/-/libsodium-sumo-0.7.16.tgz",
@@ -21774,7 +21942,9 @@
       }
     },
     "node_modules/minizlib": {
-      "version": "3.0.2",
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-3.1.0.tgz",
+      "integrity": "sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw==",
       "license": "MIT",
       "dependencies": {
         "minipass": "^7.1.2"
@@ -22014,6 +22184,12 @@
       "version": "1.0.1",
       "license": "MIT"
     },
+    "node_modules/nanocolors": {
+      "version": "0.1.12",
+      "resolved": "https://registry.npmjs.org/nanocolors/-/nanocolors-0.1.12.tgz",
+      "integrity": "sha512-2nMHqg1x5PU+unxX7PGY7AuYxl2qDx7PSrTRjizr8sxdd3l/3hBuWWaki62qmtYm2U5i4Z5E7GbjlyDFhs9/EQ==",
+      "license": "MIT"
+    },
     "node_modules/nanoid": {
       "version": "3.3.11",
       "funding": [
@@ -22153,6 +22329,31 @@
         "node": ">= 6.13.0"
       }
     },
+    "node_modules/node-gyp": {
+      "version": "13.0.1",
+      "resolved": "https://registry.npmjs.org/node-gyp/-/node-gyp-13.0.1.tgz",
+      "integrity": "sha512-piOr0S10qy5THB+q5BdqkoOx65XL/tjTMUAit3vciPNp+snTOBnGunWH1Rz7XZUxf2T9uFrfT/Ty4+aC3yPeyg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "env-paths": "^2.2.0",
+        "exponential-backoff": "^3.1.1",
+        "graceful-fs": "^4.2.6",
+        "nopt": "^10.0.0",
+        "proc-log": "^7.0.0",
+        "semver": "^7.3.5",
+        "tar": "^7.5.4",
+        "tinyglobby": "^0.2.12",
+        "undici": "^8.4.1",
+        "which": "^7.0.0"
+      },
+      "bin": {
+        "node-gyp": "bin/node-gyp.js"
+      },
+      "engines": {
+        "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+      }
+    },
     "node_modules/node-gyp-build": {
       "version": "4.5.0",
       "license": "MIT",
@@ -22162,6 +22363,52 @@
         "node-gyp-build-test": "build-test.js"
       }
     },
+    "node_modules/node-gyp/node_modules/isexe": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-4.0.0.tgz",
+      "integrity": "sha512-FFUtZMpoZ8RqHS3XeXEmHWLA4thH+ZxCv2lOiPIn1Xc7CxrqhWzNSDzD+/chS/zbYezmiwWLdQC09JdQKmthOw==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/node-gyp/node_modules/proc-log": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/proc-log/-/proc-log-7.0.0.tgz",
+      "integrity": "sha512-FYgfaA69XZ93zaXLoMNQ+ViDXGGBgR8aLh03txzcFhV+9xOXx7+8DLCULrKKpR9+GsH9ZfHm82aSUPpozX0Ztg==",
+      "dev": true,
+      "license": "ISC",
+      "engines": {
+        "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+      }
+    },
+    "node_modules/node-gyp/node_modules/undici": {
+      "version": "8.9.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-8.9.0.tgz",
+      "integrity": "sha512-aWZpUj7XoGonMClx4gdDRfgBjqeA+F473aDmROQQbM9n6PRfK/u1q/a0X4wMTgcHfT8H6fpbt98PFuDUwFg2YA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=22.19.0"
+      }
+    },
+    "node_modules/node-gyp/node_modules/which": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/which/-/which-7.0.0.tgz",
+      "integrity": "sha512-RancgH2dmbLdHl6LRhEqvklWMgl/Hdnun0Y90KhBOLkMefg8Qa7/Zel8Sm+8HEcP6DEjzsWzpkuBQEZok58isA==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "isexe": "^4.0.0"
+      },
+      "bin": {
+        "node-which": "bin/which.js"
+      },
+      "engines": {
+        "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+      }
+    },
     "node_modules/node-html-parser": {
       "version": "7.0.1",
       "license": "MIT",
@@ -22207,6 +22454,22 @@
       "version": "10.17.60",
       "license": "MIT"
     },
+    "node_modules/nopt": {
+      "version": "10.0.1",
+      "resolved": "https://registry.npmjs.org/nopt/-/nopt-10.0.1.tgz",
+      "integrity": "sha512-df3sBr/6ax9hSGuC3CspvLlbnX8cP5L5nZwXF8cGN8l0zSWR6BvzmQ6jPUKjvo6+/xdpkNvEcucBNUdBeeV13g==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "abbrev": "^5.0.0"
+      },
+      "bin": {
+        "nopt": "bin/nopt.js"
+      },
+      "engines": {
+        "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+      }
+    },
     "node_modules/normalize-path": {
       "version": "3.0.0",
       "license": "MIT",
@@ -25983,11 +26246,21 @@
       }
     },
     "node_modules/source-map-support": {
-      "version": "0.5.21",
+      "version": "0.4.18",
+      "resolved": "https://registry.npmjs.org/source-map-support/-/source-map-support-0.4.18.tgz",
+      "integrity": "sha512-try0/JqxPLF9nOjvSta7tVondkP5dwgyLDjVoyMDlmjugT2lRZ1OfsrYTkCd2hkDnJTKRbO/Rl3orm8vlsUzbA==",
       "license": "MIT",
       "dependencies": {
-        "buffer-from": "^1.0.0",
-        "source-map": "^0.6.0"
+        "source-map": "^0.5.6"
+      }
+    },
+    "node_modules/source-map-support/node_modules/source-map": {
+      "version": "0.5.7",
+      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.5.7.tgz",
+      "integrity": "sha512-LbrmJOMUSdEVxIKvdcJzQC+nQhe8FUZQTXQy6+I75skNgn3OoQ0DZA8YnFa7gp8tqtL3KPf1kmo0R5DoApeSGQ==",
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=0.10.0"
       }
     },
     "node_modules/spark-md5": {
@@ -26616,14 +26889,15 @@
       }
     },
     "node_modules/tar": {
-      "version": "7.4.3",
-      "license": "ISC",
+      "version": "7.5.22",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.22.tgz",
+      "integrity": "sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==",
+      "license": "BlueOak-1.0.0",
       "dependencies": {
         "@isaacs/fs-minipass": "^4.0.0",
         "chownr": "^3.0.0",
         "minipass": "^7.1.2",
-        "minizlib": "^3.0.1",
-        "mkdirp": "^3.0.1",
+        "minizlib": "^3.1.0",
         "yallist": "^5.0.0"
       },
       "engines": {
@@ -26651,19 +26925,6 @@
         "streamx": "^2.15.0"
       }
     },
-    "node_modules/tar/node_modules/mkdirp": {
-      "version": "3.0.1",
-      "license": "MIT",
-      "bin": {
-        "mkdirp": "dist/cjs/src/bin.js"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
     "node_modules/tar/node_modules/yallist": {
       "version": "5.0.0",
       "license": "BlueOak-1.0.0",
@@ -26712,6 +26973,16 @@
       "version": "2.20.3",
       "license": "MIT"
     },
+    "node_modules/terser/node_modules/source-map-support": {
+      "version": "0.5.21",
+      "resolved": "https://registry.npmjs.org/source-map-support/-/source-map-support-0.5.21.tgz",
+      "integrity": "sha512-uBHU3L3czsIyYXKX88fdrGovxdSCoTGDRZ6SYXtSRxLZUzHg5P/66Ht6uoUlHu9EZod+inXhKo3qQgwXUT/y1w==",
+      "license": "MIT",
+      "dependencies": {
+        "buffer-from": "^1.0.0",
+        "source-map": "^0.6.0"
+      }
+    },
     "node_modules/teslabot": {
       "version": "1.5.0",
       "license": "MIT"
@@ -26828,6 +27099,36 @@
       "version": "1.6.0",
       "license": "MIT"
     },
+    "node_modules/tinyglobby": {
+      "version": "0.2.17",
+      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",
+      "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "fdir": "^6.5.0",
+        "picomatch": "^4.0.4"
+      },
+      "engines": {
+        "node": ">=12.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/SuperchupuDev"
+      }
+    },
+    "node_modules/tinyglobby/node_modules/picomatch": {
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
+      "integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
     "node_modules/tmp": {
       "version": "0.2.7",
       "resolved": "https://registry.npmjs.org/tmp/-/tmp-0.2.7.tgz",
@@ -28210,6 +28511,15 @@
         "uuid": "dist/bin/uuid"
       }
     },
+    "node_modules/xdg-basedir": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/xdg-basedir/-/xdg-basedir-4.0.0.tgz",
+      "integrity": "sha512-PSNhEJDejZYV7h50BohL09Er9VaIefr2LMAf3OEmpCkjOi34eYyQYAXUTjEQtZJTKcF0E2UKTh+osDLsgNim9Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/xhr": {
       "version": "2.6.0",
       "license": "MIT",
diff --git a/package.json b/package.json
index d607d2c2f3b..e0d569a8aee 100644
--- a/package.json
+++ b/package.json
@@ -46,20 +46,47 @@
     "maestro": "node -r sucrase/register ./scripts/runMaestro.ts",
     "maestro:ios": "node -r sucrase/register ./scripts/runMaestro.ts test --include-tags all,ios maestro",
     "maestro:android": "node -r sucrase/register ./scripts/runMaestro.ts test --include-tags all,android maestro",
-    "precommit": "npm run localize && npm run update-eslint-warnings && lint-staged && tsc && npm test",
+    "precommit": "npm run localize && npm run update-eslint-warnings && lint-staged && npm run docs:api:gates && npm run test:cli:node-safe && tsc && npm test",
     "prepare.ios": "(cd ios; pod repo update; pod install)",
     "prepare": "husky install && ./scripts/prepare.sh",
     "rates-cache-replay": "node -r sucrase/register scripts/ratesCacheReplay.ts",
     "server": "node ./loggingServer.js",
+    "split-env-json": "node -r sucrase/register scripts/splitEnvJson.ts",
+    "split-baked-and-server-keys": "node -r sucrase/register scripts/splitBakedAndServerKeys.js",
     "start": "react-native start",
-    "test": "NODE_ENV=test TZ=America/Los_Angeles jest",
+    "test": "NODE_ENV=test TZ=America/Los_Angeles jest && npm run test:cli:offline",
     "typechain": "rm -rf './src/plugins/contracts/' && typechain --target ethers-v5 --out-dir ./src/plugins/contracts/ './src/plugins/abis/*.json'",
     "theme": "node -r sucrase/register ./scripts/themeServer.ts",
     "updateVersion": "node -r sucrase/register scripts/updateVersion.ts",
     "updot": "EDGE_MODE=development updot",
-    "verify": "npm run lint && npm run typechain && tsc && npm run test",
+    "verify": "npm run lint && npm run typechain && tsc && npm run test:cli:node-safe && npm run test",
     "watch": "npm test -- --watch",
-    "update-eslint-warnings": "node -r sucrase/register ./scripts/updateEslintWarnings.ts"
+    "update-eslint-warnings": "node -r sucrase/register ./scripts/updateEslintWarnings.ts",
+    "cli": "node -r sucrase/register src/cli/index.ts",
+    "engine": "node -r sucrase/register src/cli/engine/index.ts",
+    "build:cli": "npm run build:cli:native && rollup -c rollup.config.cli.mjs && npm run build:cli:copy-native",
+    "build:cli:native": "bash ./scripts/buildNodeApiSigner.sh",
+    "build:cli:copy-native": "mkdir -p lib && cp -f native/edge-api-signer/node/build/Release/edge_api_signer.node lib/edge_api_signer.node",
+    "publish:cli": "npm run build:cli && node -r sucrase/register scripts/publishCli.ts",
+    "docs:api": "npm run docs:api:cli && node -r sucrase/register scripts/buildApiDocs.ts",
+    "docs:api:cli": "node -r sucrase/register scripts/buildCliCommands.ts && node -r sucrase/register scripts/buildCliHelp.ts",
+    "docs:api:check": "npm run docs:api:cli -- --check && node -r sucrase/register scripts/buildApiDocs.ts --check",
+    "docs:api:verify": "node -r sucrase/register scripts/verifyApiDocs.ts",
+    "docs:api:contracts": "node -r sucrase/register scripts/checkRouteContracts.ts",
+    "docs:api:core": "node -r sucrase/register scripts/checkCoreAlignment.ts",
+    "docs:api:coverage": "node -r sucrase/register scripts/checkCliCoverage.ts",
+    "docs:api:gates": "npm run docs:api:check && npm run docs:api:verify && npm run docs:api:contracts && npm run docs:api:core && npm run docs:api:coverage",
+    "test:cli:offline": "node -r sucrase/register scripts/testCliFake.ts && node -r sucrase/register scripts/testCliSubscribe.ts",
+    "test:cli:fake": "node -r sucrase/register scripts/testCliFake.ts",
+    "test:cli:subscribe": "node -r sucrase/register scripts/testCliSubscribe.ts",
+    "test:cli:interactive": "node -r sucrase/register scripts/testCliInteractive.ts",
+    "test:cli:oneshot": "node -r sucrase/register scripts/testCli.ts",
+    "test:cli:captcha": "node -r sucrase/register scripts/testCliCaptcha.ts",
+    "test:cli:edge-login": "node -r sucrase/register scripts/testEdgeLogin.ts",
+    "test:cli:node-safe": "node scripts/cliNodeSafeSmoke.js",
+    "test:cli:node-hmac": "node -r sucrase/register scripts/testNodeApiSigner.ts",
+    "test:cli": "node -r sucrase/register scripts/testCli.ts && node -r sucrase/register scripts/testCliCaptcha.ts",
+    "test:cli:network": "npm run test:cli:oneshot && npm run test:cli:captcha && npm run test:cli:edge-login"
   },
   "lint-staged": {
     "*.{js,jsx,ts,tsx}": "eslint"
@@ -115,8 +142,11 @@
     "ethers": "^5.7.2",
     "expo": "^53.0.0",
     "expo-quick-actions": "^5.0.0",
+    "hash.js": "^1.1.7",
     "jsrsasign": "^11.1.0",
+    "lib-cmdparse": "^0.1.0",
     "marked": "^15.0.9",
+    "nanocolors": "^0.1.2",
     "p-debounce": "^4.0.0",
     "posthog-js": "^1.88.1",
     "posthog-react-native": "^2.8.1",
@@ -181,10 +211,12 @@
     "rn-qr-generator": "^1.4.6",
     "scheduler": "^0.23.0",
     "sha.js": "^2.4.11",
+    "source-map-support": "^0.4.14",
     "sprintf-js": "^1.1.1",
     "url": "^0.11.0",
     "url-parse": "^1.5.2",
     "use-context-selector": "^2.0.0",
+    "xdg-basedir": "^4.0.0",
     "yaob": "^0.4.0",
     "yavent": "^0.1.5",
     "zcashname-sdk": "^0.7.2"
@@ -201,7 +233,9 @@
     "@react-native/babel-preset": "0.79.2",
     "@react-native/metro-config": "0.79.2",
     "@react-native/typescript-config": "0.79.2",
-    "@rollup/plugin-babel": "^6.0.3",
+    "@rollup/plugin-babel": "^6.1.0",
+    "@rollup/plugin-json": "^6.1.0",
+    "@rollup/plugin-node-resolve": "^16.0.3",
     "@stakekit/api-hooks": "^0.0.93",
     "@testing-library/react-native": "^13.2.0",
     "@typechain/ethers-v5": "^11.1.2",
@@ -229,6 +263,7 @@
     "add": "^2.0.6",
     "babel-eslint": "^10.1.0",
     "babel-jest": "^29.6.3",
+    "babel-plugin-transform-fake-error-class": "^1.0.0",
     "body-parser": "^1.18.2",
     "buffer": "^6.0.3",
     "crypto-browserify": "^3.12.0",
@@ -245,6 +280,7 @@
     "msw": "^2.8.4",
     "msw-snapshot": "^5.3.0",
     "node-fetch": "2.x",
+    "node-gyp": "^13.0.1",
     "os-browserify": "^0.3.0",
     "patch-package": "^8.0.0",
     "path-browserify": "^1.0.1",
diff --git a/rollup.config.cli.mjs b/rollup.config.cli.mjs
new file mode 100644
index 00000000000..da136fc12f2
--- /dev/null
+++ b/rollup.config.cli.mjs
@@ -0,0 +1,65 @@
+import babel from '@rollup/plugin-babel'
+import json from '@rollup/plugin-json'
+import resolve from '@rollup/plugin-node-resolve'
+import { createRequire } from 'module'
+
+const require = createRequire(import.meta.url)
+const packageJson = require('./package.json')
+
+const extensions = ['.ts']
+const babelOpts = {
+  babelHelpers: 'bundled',
+  babelrc: false,
+  configFile: false,
+  extensions,
+  include: ['src/**/*'],
+  presets: [
+    [
+      '@babel/preset-env',
+      {
+        exclude: ['transform-regenerator'],
+        loose: true
+      }
+    ],
+    '@babel/typescript'
+  ],
+  plugins: ['transform-fake-error-class']
+}
+const resolveOpts = { extensions }
+
+const external = [
+  'buffer',
+  'child_process',
+  'crypto',
+  'fs',
+  'http',
+  'https',
+  'net',
+  'os',
+  'path',
+  'readline',
+  ...Object.keys(packageJson.dependencies)
+]
+
+export default [
+  {
+    external,
+    input: 'src/cli/index.ts',
+    output: {
+      banner: '#!/usr/bin/env node',
+      file: 'lib/edgeCli.js',
+      format: 'cjs'
+    },
+    plugins: [json(), babel(babelOpts), resolve(resolveOpts)]
+  },
+  {
+    external,
+    input: 'src/cli/engine/index.ts',
+    output: {
+      banner: '#!/usr/bin/env node',
+      file: 'lib/edgeEngine.js',
+      format: 'cjs'
+    },
+    plugins: [json(), babel(babelOpts), resolve(resolveOpts)]
+  }
+]
diff --git a/scripts/apiDocs.css b/scripts/apiDocs.css
new file mode 100644
index 00000000000..6bf6811bce9
--- /dev/null
+++ b/scripts/apiDocs.css
@@ -0,0 +1,137 @@
+
+:root {
+  --bg: #fff; --fg: #16181d; --dim: #6b7280; --line: #e5e7eb; --card: #fafafa;
+  --accent: #2563eb; --code: #f3f4f6; --warn: #b45309; --ok: #047857;
+  --mono: ui-monospace, SFMono-Regular, "SF Mono", Menlo, monospace;
+}
+@media (prefers-color-scheme: dark) {
+  :root {
+    --bg: #0d1117; --fg: #e6edf3; --dim: #8b949e; --line: #262c36; --card: #131920;
+    --accent: #6ea8ff; --code: #1a212b; --warn: #d29922; --ok: #3fb950;
+  }
+}
+* { box-sizing: border-box; }
+body {
+  margin: 0; background: var(--bg); color: var(--fg);
+  font: 15px/1.6 -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif;
+}
+code, pre { font-family: var(--mono); font-size: 13px; }
+code { background: var(--code); padding: 1px 5px; border-radius: 4px; }
+pre { background: var(--code); padding: 12px 14px; border-radius: 8px; overflow-x: auto; margin: 8px 0; }
+pre code { background: none; padding: 0; }
+a { color: var(--accent); text-decoration: none; }
+a:hover { text-decoration: underline; }
+
+.layout { display: flex; align-items: flex-start; }
+nav {
+  position: sticky; top: 0; height: 100vh; overflow-y: auto; flex: 0 0 270px;
+  border-right: 1px solid var(--line); padding: 20px 12px 60px;
+}
+nav h1 { font-size: 15px; margin: 0 8px 4px; }
+nav .ver { font-size: 12px; color: var(--dim); margin: 0 8px 14px; }
+nav input {
+  width: 100%; padding: 7px 10px; margin-bottom: 14px; font: inherit; font-size: 13px;
+  border: 1px solid var(--line); border-radius: 7px; background: var(--bg); color: var(--fg);
+}
+nav .s { font: 700 12px/1.5 var(--sans); text-transform: uppercase; letter-spacing: .08em;
+  color: var(--fg); margin: 18px 0 4px; padding-top: 10px; border-top: 1px solid var(--line); }
+nav .s:first-child { margin-top: 0; padding-top: 0; border-top: none; }
+nav .g { font-size: 11px; text-transform: uppercase; letter-spacing: .07em; color: var(--dim);
+  margin: 16px 8px 5px; font-weight: 600; }
+nav a.e { display: block; padding: 3px 8px; border-radius: 5px; font-size: 13px; color: var(--fg); }
+nav a.e:hover { background: var(--card); text-decoration: none; }
+nav a.e code { background: none; padding: 0; color: var(--accent); }
+nav a.e .restonly { color: var(--dim); font-style: italic; font-size: 12px; }
+
+main { flex: 1 1 auto; min-width: 0; padding: 32px 40px 120px; max-width: 1000px; }
+h2 { font-size: 22px; margin: 48px 0 6px; padding-top: 14px; border-top: 1px solid var(--line); }
+h3.sub { font-size: 16px; margin: 30px 0 4px; color: var(--fg); }
+h2:first-of-type { border-top: none; margin-top: 8px; }
+.groupdoc { color: var(--dim); margin: 0 0 8px; }
+
+.endpoint { border: 1px solid var(--line); border-radius: 12px; padding: 18px 20px;
+  margin: 18px 0; background: var(--card); }
+.endpoint header { display: flex; flex-wrap: wrap; align-items: baseline;
+  justify-content: space-between; gap: 8px; }
+.endpoint h3 { font-size: 17px; margin: 0; }
+.endpoint h3 a { color: var(--fg); }
+.ids { display: flex; align-items: center; gap: 8px; flex-wrap: wrap; }
+.cmdname { background: var(--accent); color: #fff; font-weight: 600; }
+.restonly { color: var(--dim); font-style: italic; font-size: 12px; }
+.src { color: var(--dim); font-size: 11px; font-family: var(--mono); }
+.shape { margin: 6px 0; }
+.shape-h { font: 600 10px var(--mono); text-transform: uppercase; letter-spacing: .06em;
+  color: var(--dim); margin-bottom: 4px; }
+pre.ts { background: var(--code); border-left: 3px solid var(--accent); }
+pre.json { background: transparent; border: 1px dashed var(--line); }
+.shape details { margin: 6px 0; }
+.shape summary { cursor: pointer; font-size: 12px; color: var(--dim); user-select: none; }
+.shape summary:hover { color: var(--accent); }
+.core { margin: 8px 0 2px; font-size: 13px; display: flex; align-items: baseline;
+  gap: 8px; flex-wrap: wrap; }
+.core .lbl { font: 600 10px var(--mono); text-transform: uppercase; letter-spacing: .06em;
+  color: var(--dim); border: 1px solid var(--line); border-radius: 3px; padding: 1px 5px; }
+.core code { color: var(--ok); }
+.core.none em { color: var(--dim); font-style: italic; }
+.desc { margin: 8px 0 4px; }
+.desc p { margin: 6px 0; }
+
+.panes { display: grid; grid-template-columns: 1fr 1fr; gap: 16px; margin-top: 14px; }
+@media (max-width: 900px) { .panes { grid-template-columns: 1fr; } }
+.pane { background: var(--bg); border: 1px solid var(--line); border-radius: 9px; padding: 12px 14px;
+  /* A grid item defaults to min-width:auto, so a long unbreakable line makes
+     the column wider than its 1fr share and shoves the next pane sideways.
+     `overflow-x` on the <pre> never gets a chance until this is 0. */
+  min-width: 0; }
+.pane h4 { margin: 0 0 8px; font-size: 12px; text-transform: uppercase;
+  letter-spacing: .07em; color: var(--dim); }
+.pane h5 { margin: 12px 0 4px; font-size: 12px; color: var(--dim); font-weight: 600; }
+.pane.resp, .pane.notes { margin-top: 16px; }
+.pane.cli.none p { margin: 0; }
+.cmd + .cmd { margin-top: 14px; padding-top: 14px; border-top: 1px dashed var(--line); }
+/* A command line is a sentence, not a table: wrap it at the spaces rather
+   than making the reader scroll a pane sideways. `get-transactions` is 322
+   characters. */
+.usage, .ex { white-space: pre-wrap; overflow-wrap: break-word; }
+.usage { background: var(--code); }
+.ex { background: transparent; border: 1px dashed var(--line); }
+.lead { margin: 4px 0; color: var(--dim); font-size: 13px; }
+.note { font-size: 13px; }
+.note p { margin: 4px 0; }
+.pane.notes ul { margin: 0; padding-left: 20px; }
+.pane.notes li { margin: 5px 0; }
+
+.route { margin: 0 0 4px; display: flex; align-items: center; gap: 8px; }
+.m { font: 600 11px var(--mono); padding: 2px 7px; border-radius: 4px; color: #fff; }
+.m-GET { background: #2563eb; } .m-POST { background: #047857; }
+.m-PUT { background: #b45309; } .m-PATCH { background: #7c3aed; }
+.m-DELETE { background: #b91c1c; }
+
+table { border-collapse: collapse; width: 100%; margin: 4px 0; }
+table.fields td, table.flags td, table.flags th { padding: 4px 8px 4px 0;
+  vertical-align: top; font-size: 13px; border-bottom: 1px solid var(--line); }
+table.flags th { text-align: left; font-size: 11px; color: var(--dim); text-transform: uppercase; }
+td.k { white-space: nowrap; width: 1%; }
+td.ty { white-space: nowrap; width: 1%; }
+td.doc { color: var(--dim); }
+tr.d1 td.k { padding-left: 18px; } tr.d2 td.k { padding-left: 36px; }
+.t { color: var(--dim); font-family: var(--mono); font-size: 12px; }
+.t.core { color: var(--warn); border-bottom: 1px dotted var(--warn); cursor: help; }
+.dim { color: var(--dim); }
+.ref { font-family: var(--mono); font-size: 12px; }
+.flag { font-size: 10px; padding: 1px 5px; border-radius: 3px; border: 1px solid var(--line);
+  color: var(--dim); text-transform: uppercase; letter-spacing: .04em; }
+.flag.req { color: var(--warn); border-color: var(--warn); }
+.st { font: 600 11px var(--mono); padding: 1px 6px; border-radius: 4px;
+  background: var(--code); margin-right: 5px; }
+.st.ok { color: var(--ok); }
+.errs { display: flex; flex-wrap: wrap; gap: 6px; margin: 4px 0; }
+a.err { font: 12px var(--mono); border: 1px solid var(--line); border-radius: 5px;
+  padding: 2px 7px; color: var(--fg); }
+a.err:hover { border-color: var(--accent); text-decoration: none; }
+
+.schema { border: 1px solid var(--line); border-radius: 10px; padding: 14px 16px; margin: 14px 0;
+  background: var(--card); }
+.schema h3 { margin: 0 0 2px; font-size: 15px; font-family: var(--mono); }
+.schema .src { display: block; margin-bottom: 6px; }
+.hidden { display: none; }
diff --git a/scripts/buildApiDocs.ts b/scripts/buildApiDocs.ts
new file mode 100644
index 00000000000..50d30141f83
--- /dev/null
+++ b/scripts/buildApiDocs.ts
@@ -0,0 +1,749 @@
+/**
+ * Compiles the API reference from the route declarations.
+ *
+ *   docs/api/dist/openapi.json   OpenAPI 3.1, with `x-cli` and `x-core-call`
+ *   docs/api/dist/index.html     self-contained human-readable reference
+ *
+ *   node -r sucrase/register scripts/buildApiDocs.ts
+ *
+ * Everything here comes from `src/cli/engine/routes/*.ts`: the JSDoc above each
+ * `route(…)` supplies the prose, and the cleaners supply the shapes, resolved
+ * through the TypeScript checker. The command line is rendered first in each
+ * entry, because the two are one call seen from two directions.
+ */
+import fs from 'fs'
+import { marked } from 'marked'
+import path from 'path'
+
+import { groupOrder, sectionOrder } from '../docs/api/groups'
+import { CLI_EXIT_CODES, errorCodes } from '../docs/api/shared'
+import { SCOPE_PARAMS } from '../src/cli/engine/doc'
+import { usageFor } from './cliUsage'
+import {
+  type ExtractedCli,
+  type ExtractedField,
+  type ExtractedRoute,
+  extractRoutes
+} from './extractRoutes'
+import { writeIfChanged } from './writeIfChanged'
+
+/**
+ * What a path parameter is, in prose.
+ *
+ * A derived positional keeps the description written beside its cleaner; a
+ * scope parameter means the same thing everywhere and is described once.
+ */
+function pathParamDoc(e: ExtractedRoute, name: string): string {
+  if (name === e.pathPositional) {
+    const field = [...(e.query ?? []), ...(e.body ?? [])].find(
+      f => f.name === name
+    )
+    if (field?.doc != null) return field.doc
+  }
+  return SCOPE_PARAMS[name] ?? ''
+}
+
+/**
+ * Request fields, minus the one the path carries.
+ *
+ * A positional is declared as an ordinary field but travels as a path
+ * segment. Listing it in both tables would tell a reader to send it twice.
+ */
+function requestFields(
+  e: ExtractedRoute,
+  fields: ExtractedField[] | undefined
+): ExtractedField[] | undefined {
+  if (fields == null) return undefined
+  const out = fields.filter(f => f.name !== e.pathPositional)
+  return out.length === 0 ? undefined : out
+}
+
+const OUT = path.resolve(__dirname, '../docs/api/dist')
+const API_VERSION = '1.0.0'
+
+interface Group {
+  id: string
+  title: string
+  doc: string
+  section: string
+  endpoints: ExtractedRoute[]
+}
+
+function buildGroups(): Group[] {
+  const routes = extractRoutes()
+  const out: Group[] = []
+  for (const info of groupOrder) {
+    const endpoints = routes.filter(r => r.group === info.id)
+    if (endpoints.length > 0) out.push({ ...info, endpoints })
+  }
+  const placed = new Set(out.flatMap(g => g.endpoints.map(e => e.id)))
+  const rest = routes.filter(r => !placed.has(r.id))
+  if (rest.length > 0) {
+    out.push({
+      id: 'other',
+      title: 'Other',
+      doc: '',
+      section: 'other',
+      endpoints: rest
+    })
+  }
+  return out
+}
+
+const groups = buildGroups()
+
+interface Section {
+  id: string
+  title: string
+  doc: string
+  groups: Group[]
+}
+
+/** Sections in declared order, each holding the groups that named it. */
+function buildSections(): Section[] {
+  const out: Section[] = []
+  for (const info of sectionOrder) {
+    const inSection = groups.filter(g => g.section === info.id)
+    if (inSection.length > 0) out.push({ ...info, groups: inSection })
+  }
+  const placed = new Set(out.flatMap(s => s.groups.map(g => g.id)))
+  const rest = groups.filter(g => !placed.has(g.id))
+  if (rest.length > 0) {
+    out.push({ id: 'other', title: 'Other', doc: '', groups: rest })
+  }
+  return out
+}
+
+const sections = buildSections()
+
+// ------------------------------------------------------------------ helpers
+
+function esc(text: string): string {
+  return text
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+}
+
+function md(text: string | undefined): string {
+  if (text == null || text === '') return ''
+  return marked.parseInline(text) as string
+}
+
+function mdBlock(text: string | undefined): string {
+  if (text == null || text === '') return ''
+  return marked.parse(text) as string
+}
+
+/** A resolved type string, rendered with the primitives played down. */
+function typeLabel(type: string): string {
+  return `<span class="t">${esc(type)}</span>`
+}
+
+/** Plausible JSON for a resolved type, so examples read like real payloads. */
+function exampleFor(type: string, name = ''): unknown {
+  const t = type.trim()
+  if (t.endsWith('[]')) return [exampleFor(t.slice(0, -2), name)]
+  if (t.startsWith('Array<')) return [exampleFor(t.slice(6, -1), name)]
+  if (t.includes('|')) {
+    const parts = t.split('|').map(p => p.trim())
+    const first = parts.find(p => p !== 'null' && p !== 'undefined')
+    return first != null ? exampleFor(first, name) : null
+  }
+  if (t === 'boolean') return true
+  if (t === 'number')
+    return /Height|Count|Seconds|Ratio|rate/i.test(name) ? 1 : 0
+  if (t === 'null') return null
+  if (t.startsWith("'")) return t.replace(/'/g, '').split(' ')[0]
+  if (t === 'string') {
+    if (/date|At$/i.test(name)) return '2026-09-02T16:35:00.000Z'
+    if (/Amount|Fee/i.test(name)) return '12345'
+    if (/Id$/i.test(name)) return 'FS8xJ2kQ…'
+    return 'string'
+  }
+  if (t === 'unknown' || t === 'any') return {}
+  if (t.startsWith('{')) return {}
+  return `<${t}>`
+}
+
+function exampleObject(fields: ExtractedField[]): Record<string, unknown> {
+  const out: Record<string, unknown> = {}
+  for (const f of fields) out[f.name] = exampleFor(f.type, f.name)
+  return out
+}
+
+/**
+ * Break a resolved type across lines the way a person would write it.
+ *
+ * The compiler hands back one long string —
+ * `{ tokenId: string | null; currencyCode: string; … }[]` — which is
+ * unreadable past a couple of fields. This indents nested object literals and
+ * puts one member per line. Only `{`, `;` and `}` matter; a `;` inside a
+ * string literal type would be misread, and no cleaner produces one.
+ */
+function formatType(type: string, indent = 0): string {
+  let out = ''
+  let depth = indent
+  const pad = (n: number): string => '  '.repeat(n)
+  for (let i = 0; i < type.length; i++) {
+    const c = type[i]
+    if (c === '{') {
+      depth++
+      out += '{\n' + pad(depth)
+    } else if (c === '}') {
+      depth--
+      out = out.replace(/[ \n]+$/, '')
+      out += '\n' + pad(depth) + '}'
+    } else if (c === ';') {
+      // A trailing `;` before `}` would leave a blank line.
+      const rest = type.slice(i + 1).trimStart()
+      out += rest.startsWith('}') ? '' : ';\n' + pad(depth)
+    } else if (c === ' ' && out.endsWith('\n' + pad(depth))) {
+      // Swallow the space the compiler puts after `{` and `;`.
+    } else {
+      out += c
+    }
+  }
+  return out
+}
+
+function tsInterface(fields: ExtractedField[]): string {
+  const lines = fields.map(
+    f =>
+      `  ${f.name}${f.optional ? '?' : ''}: ${formatType(
+        f.type,
+        1
+      ).trimStart()}`
+  )
+  return `{\n${lines.join('\n')}\n}`
+}
+
+function fieldRows(fields: ExtractedField[]): string {
+  return fields
+    .map(
+      f => `<tr>
+  <td class="k"><code>${esc(f.name)}</code></td>
+  <td class="ty">${typeLabel(f.type)}${
+        f.optional ? ' <span class="flag opt">optional</span>' : ''
+      }</td>
+  <td class="doc">${md(f.doc)}</td>
+</tr>`
+    )
+    .join('\n')
+}
+
+/** Type, example and per-field prose: three views of one shape. */
+function shapeBlock(fields: ExtractedField[], label: string): string {
+  if (fields.length === 0) return ''
+  return `<div class="shape">
+    <div class="shape-h">${esc(label)}</div>
+    <pre class="ts"><code>${esc(tsInterface(fields))}</code></pre>
+    <details><summary>Example</summary><pre class="json"><code>${esc(
+      JSON.stringify(exampleObject(fields), null, 2)
+    )}</code></pre></details>
+    <table class="fields"><tbody>${fieldRows(fields)}</tbody></table>
+  </div>`
+}
+
+// ------------------------------------------------------------ endpoint HTML
+
+function coreLine(e: ExtractedRoute): string {
+  const note =
+    e.coreNote != null ? ` <span class="dim">${md(e.coreNote)}</span>` : ''
+  if (e.core == null) {
+    return `<p class="core none"><span class="lbl">core</span><em>${
+      e.coreNote != null ? md(e.coreNote) : 'No direct core call.'
+    }</em></p>`
+  }
+  const diffs = Object.entries(e.coreExtra)
+  const extra =
+    diffs.length === 0
+      ? ''
+      : `<div class="note"><p><strong>Differs from core:</strong></p><ul>${diffs
+          .map(([k, v]) => `<li><code>${esc(k)}</code> — ${md(v)}</li>`)
+          .join('')}</ul></div>`
+  return `<p class="core"><span class="lbl">core</span><code>${esc(
+    e.core
+  )}</code>${note}</p>${extra}`
+}
+
+function cliBlock(e: ExtractedRoute): string {
+  if (e.cli == null) {
+    return `<div class="pane cli none"><h4>Command line</h4>
+      <p class="dim">No <code>edge-cli</code> command. REST only.</p></div>`
+  }
+  const cli: ExtractedCli = e.cli
+  const extras =
+    cli.extra.length === 0
+      ? ''
+      : `<h5>Client-only flags</h5><table class="fields"><tbody>${cli.extra
+          .map(
+            x =>
+              `<tr><td class="k"><code>--${esc(
+                x.name
+              )}</code></td><td class="ty">${
+                x.required === true
+                  ? '<span class="flag req">required</span>'
+                  : '<span class="flag opt">optional</span>'
+              }</td><td class="doc">${md(x.doc)}</td></tr>`
+          )
+          .join('')}</tbody></table>`
+  return `<div class="pane cli">
+    <h4>Command line</h4>
+    <pre class="usage"><code>${esc(usageFor(e, e.cli))}</code></pre>
+    ${extras}
+    ${cli.notes != null ? `<div class="note">${mdBlock(cli.notes)}</div>` : ''}
+  </div>`
+}
+
+function curlFor(e: ExtractedRoute): string {
+  const p = e.routePath
+    .replace('{sessionId}', '$SESS')
+    .replace('{walletId}', '$WID')
+    .replace(/\{(\w+)\}/g, (_m, n) => `$${String(n).toUpperCase()}`)
+  const required = (e.query ?? []).filter(q => !q.optional)
+  const qs =
+    required.length > 0 ? '?' + required.map(q => `${q.name}=…`).join('&') : ''
+  const lines = ['curl --unix-socket "$SOCK" \\']
+  if (e.method !== 'GET') lines.push(`  -X ${e.method} \\`)
+  if (e.body != null && e.body.length > 0) {
+    lines.push(`  -H 'Content-Type: application/json' \\`)
+    lines.push(`  -d '${JSON.stringify(exampleObject(e.body))}' \\`)
+  }
+  lines.push(`  'http://localhost${p}${qs}'`)
+  return lines.join('\n')
+}
+
+function restBlock(e: ExtractedRoute): string {
+  const pathTable =
+    e.pathParams.length === 0
+      ? ''
+      : `<h5>Path</h5><table class="fields"><tbody>${e.pathParams
+          .map(
+            n =>
+              `<tr><td class="k"><code>${esc(
+                n
+              )}</code></td><td class="ty">${typeLabel(
+                'string'
+              )}</td><td class="doc">${md(pathParamDoc(e, n))}</td></tr>`
+          )
+          .join('')}</tbody></table>`
+  return `<div class="pane rest">
+    <h4>REST</h4>
+    <p class="route"><span class="m m-${e.method}">${
+    e.method
+  }</span><code>${esc(e.routePath)}</code></p>
+    ${pathTable}
+    ${
+      requestFields(e, e.query) != null
+        ? shapeBlock(requestFields(e, e.query)!, 'Query')
+        : ''
+    }
+    ${
+      e.bodyNote != null ? `<div class="note">${mdBlock(e.bodyNote)}</div>` : ''
+    }
+    ${
+      requestFields(e, e.body) != null
+        ? shapeBlock(requestFields(e, e.body)!, 'Request body')
+        : ''
+    }
+    <h5>Example</h5>
+    <pre class="ex"><code>${esc(curlFor(e))}</code></pre>
+  </div>`
+}
+
+function responseBlock(e: ExtractedRoute): string {
+  const status = e.returns == null && e.returnsType == null ? 204 : 200
+  const errs =
+    e.errors.length === 0
+      ? ''
+      : `<h5>Errors</h5><p class="errs">${e.errors
+          .map(code => {
+            const known = errorCodes.find(x => x.code === code)
+            return `<a href="#err-${code}" class="err" title="${esc(
+              known?.doc ?? ''
+            )}"><span class="st">${known?.status ?? '?'}</span>${code}</a>`
+          })
+          .join(' ')}</p>`
+  const prose = e.returnsProse ?? e.returnsDoc
+  const body =
+    status === 204
+      ? '<p class="lead dim">No body.</p>'
+      : `${prose != null ? `<div class="note">${mdBlock(prose)}</div>` : ''}${
+          e.returns != null && e.returns.length > 0
+            ? shapeBlock(e.returns, 'Response body')
+            : `<pre class="ts"><code>${esc(
+                formatType(e.returnsType ?? 'unknown')
+              )}</code></pre>`
+        }`
+  return `<div class="pane resp">
+    <h4>Response <span class="st ok">${status}</span></h4>
+    ${body}
+    ${errs}
+  </div>`
+}
+
+function endpointHtml(e: ExtractedRoute): string {
+  const name =
+    e.cli != null
+      ? `<code class="cmdname">${esc(e.cli.command)}</code>`
+      : '<span class="restonly">REST only</span>'
+  const notes =
+    e.notes.length === 0
+      ? ''
+      : `<div class="pane notes"><h4>Notes</h4><ul>${e.notes
+          .map(n => `<li>${md(n)}</li>`)
+          .join('')}</ul></div>`
+  return `<section class="endpoint" id="${e.id}">
+    <header>
+      <h3><a href="#${e.id}">${esc(e.summary)}</a></h3>
+      <div class="ids">${name}<span class="src" title="Declared in">src/cli/engine/routes/${esc(
+    e.file
+  )}</span></div>
+    </header>
+    ${coreLine(e)}
+    ${
+      e.description != null
+        ? `<div class="desc">${mdBlock(e.description)}</div>`
+        : ''
+    }
+    <div class="panes">${cliBlock(e)}${restBlock(e)}</div>
+    ${responseBlock(e)}
+    ${notes}
+  </section>`
+}
+
+// ------------------------------------------------------------------- OpenAPI
+
+/** A resolved type string, as JSON Schema. */
+function jsonSchema(type: string): Record<string, unknown> {
+  const t = type.trim()
+  if (t.endsWith('[]'))
+    return { type: 'array', items: jsonSchema(t.slice(0, -2)) }
+  if (t.startsWith('Array<')) {
+    return { type: 'array', items: jsonSchema(t.slice(6, -1)) }
+  }
+  if (t.includes('|')) {
+    const parts = t
+      .split('|')
+      .map(p => p.trim())
+      .filter(p => p !== 'undefined')
+    if (parts.every(p => p.startsWith("'"))) {
+      return { type: 'string', enum: parts.map(p => p.replace(/'/g, '')) }
+    }
+    return { anyOf: parts.map(jsonSchema) }
+  }
+  if (t === 'string' || t.startsWith("'")) return { type: 'string' }
+  if (t === 'number') return { type: 'number' }
+  if (t === 'boolean') return { type: 'boolean' }
+  if (t === 'null') return { type: 'null' }
+  if (t === 'unknown' || t === 'any') return {}
+  return { description: t }
+}
+
+function objectSchema(fields: ExtractedField[]): Record<string, unknown> {
+  const properties: Record<string, unknown> = {}
+  const required: string[] = []
+  for (const f of fields) {
+    properties[f.name] =
+      f.doc != null
+        ? { ...jsonSchema(f.type), description: f.doc }
+        : jsonSchema(f.type)
+    if (!f.optional) required.push(f.name)
+  }
+  const out: Record<string, unknown> = { type: 'object', properties }
+  if (required.length > 0) out.required = required
+  return out
+}
+
+function buildOpenApi(): Record<string, unknown> {
+  const paths: Record<string, Record<string, unknown>> = {}
+  for (const g of groups) {
+    for (const e of g.endpoints) {
+      const coreMd =
+        e.core != null
+          ? `**Core call:** \`${e.core}\`\n\n`
+          : `**Core call:** _none — ${e.coreNote ?? ''}_\n\n`
+      const cliMd =
+        e.cli != null
+          ? '**Command line**\n\n```\n' + usageFor(e, e.cli) + '\n```\n\n'
+          : '_No `edge-cli` command; REST only._\n\n'
+      const op: Record<string, unknown> = {
+        operationId: e.id,
+        summary: e.summary,
+        description: coreMd + cliMd + (e.description ?? ''),
+        tags: [g.title],
+        'x-cli': e.cli,
+        'x-core-call': e.core,
+        'x-core-note': e.coreNote,
+        'x-source': `src/cli/engine/routes/${e.file}`,
+        parameters: [
+          ...e.pathParams.map(n => ({
+            name: n,
+            in: 'path',
+            required: true,
+            description: pathParamDoc(e, n),
+            schema: { type: 'string' }
+          })),
+          ...(requestFields(e, e.query) ?? []).map(q => ({
+            name: q.name,
+            in: 'query',
+            required: !q.optional,
+            description: q.doc,
+            schema: jsonSchema(q.type)
+          }))
+        ],
+        responses: {
+          [e.returns == null && e.returnsType == null ? '204' : '200']:
+            e.returns == null && e.returnsType == null
+              ? { description: 'No content.' }
+              : {
+                  description: e.returnsProse ?? e.returnsDoc ?? 'Success.',
+                  content: {
+                    'application/json': {
+                      schema:
+                        e.returns != null && e.returns.length > 0
+                          ? objectSchema(e.returns)
+                          : jsonSchema(e.returnsType ?? 'unknown')
+                    }
+                  }
+                },
+          default: {
+            description: e.errors.length > 0 ? e.errors.join(', ') : 'Error.',
+            content: {
+              'application/json': {
+                schema: { $ref: '#/components/schemas/ErrorEnvelope' }
+              }
+            }
+          }
+        }
+      }
+      const bodyFields = requestFields(e, e.body)
+      if (bodyFields != null) {
+        op.requestBody = {
+          required: true,
+          description: e.bodyNote,
+          content: { 'application/json': { schema: objectSchema(bodyFields) } }
+        }
+      }
+      paths[e.routePath] = paths[e.routePath] ?? {}
+      paths[e.routePath][e.method.toLowerCase()] = op
+    }
+  }
+
+  return {
+    openapi: '3.1.0',
+    info: {
+      title: 'Edge CLI',
+      version: API_VERSION,
+      description:
+        'The `edge-cli` command line and the `edge-engine` JSON REST API, generated from the route declarations in `src/cli/engine/routes/`.'
+    },
+    servers: [
+      {
+        url: 'http://localhost',
+        description: 'Unix socket at ~/.edge-cli/run/<profile>/engine.sock'
+      },
+      {
+        url: 'http://127.0.0.1:9008',
+        description: 'Loopback TCP, when started with --tcp=9008'
+      }
+    ],
+    tags: groups.map(g => ({ name: g.title, description: g.doc })),
+    paths,
+    components: {
+      schemas: {
+        ErrorEnvelope: {
+          type: 'object',
+          description: 'Every failure, on both transports.',
+          properties: {
+            error: {
+              type: 'object',
+              properties: {
+                code: { type: 'string' },
+                message: { type: 'string' },
+                status: { type: 'number' },
+                details: {}
+              },
+              required: ['code', 'message', 'status']
+            }
+          },
+          required: ['error']
+        }
+      }
+    }
+  }
+}
+
+// ---------------------------------------------------------------------- CSS
+
+const CSS = fs.readFileSync(path.join(__dirname, 'apiDocs.css'), 'utf8')
+
+// --------------------------------------------------------------------- HTML
+
+function buildHtml(): string {
+  const nav = sections
+    .map(
+      s =>
+        `<div class="s">${esc(s.title)}</div>` +
+        s.groups
+          .map(
+            g =>
+              `<div class="g">${esc(g.title)}</div>` +
+              g.endpoints
+                .map(e => {
+                  const label =
+                    e.cli != null
+                      ? `<code>${esc(e.cli.command)}</code>`
+                      : `<span class="restonly">${esc(e.summary)}</span>`
+                  return `<a class="e" href="#${e.id}" data-s="${esc(
+                    (
+                      e.summary +
+                      ' ' +
+                      e.routePath +
+                      ' ' +
+                      (e.cli?.command ?? '')
+                    ).toLowerCase()
+                  )}">${label}</a>`
+                })
+                .join('')
+          )
+          .join('')
+    )
+    .join('')
+
+  const body = sections
+    .map(
+      s => `<h2 id="${s.id}">${esc(s.title)}</h2>
+      ${s.doc !== '' ? `<div class="groupdoc">${mdBlock(s.doc)}</div>` : ''}
+      ${s.groups
+        .map(
+          g => `<h3 class="sub" id="${g.id}">${esc(g.title)}</h3>
+          ${g.doc !== '' ? `<div class="groupdoc">${mdBlock(g.doc)}</div>` : ''}
+          ${g.endpoints.map(endpointHtml).join('')}`
+        )
+        .join('')}`
+    )
+    .join('')
+
+  const errorSection = `<table class="fields"><tbody>${errorCodes
+    .map(
+      e =>
+        `<tr id="err-${e.code}"><td class="k"><code>${e.code}</code></td>
+        <td class="ty"><span class="st">${e.status}</span><span class="dim">${
+          e.origin
+        }</span></td>
+        <td class="doc">${md(e.doc)}${
+          e.details != null
+            ? ` <span class="dim">details: ${md(e.details)}</span>`
+            : ''
+        }</td></tr>`
+    )
+    .join('')}</tbody></table>`
+
+  const exitSection = `<table class="fields"><tbody>${CLI_EXIT_CODES.map(
+    x =>
+      `<tr><td class="k"><code>${
+        x.code
+      }</code></td><td class="ty"><span class="dim">${
+        x.name
+      }</span></td><td class="doc">${md(x.doc)}</td></tr>`
+  ).join('')}</tbody></table>`
+
+  const count = groups.reduce((n, g) => n + g.endpoints.length, 0)
+
+  return `<!doctype html>
+<html lang="en"><head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Edge CLI API</title>
+<style>${CSS}</style>
+</head><body>
+<div class="layout">
+<nav>
+  <h1>Edge CLI API</h1>
+  <p class="ver">v${API_VERSION} · ${count} calls</p>
+  <input id="q" type="search" placeholder="Filter…" autocomplete="off">
+  <a class="e" href="#overview"><strong>Overview</strong></a>
+  ${nav}
+  <div class="g">Reference</div>
+  <a class="e" href="#errors">Error codes</a>
+  <a class="e" href="#exit-codes">Exit codes</a>
+</nav>
+<main>
+<h2 id="overview">Overview</h2>
+<div class="groupdoc">${mdBlock(
+    `Every entry is one API call shown twice: as an \`edge-cli\` command, then as the JSON REST request that command sends. Both are generated from a single declaration in \`src/cli/engine/routes/\`, so the two forms cannot drift apart.
+
+Routes are named after the \`edge-core-js\` call they front, kebab-cased: \`context.forgetAccount\` becomes \`POST /forget-account\`, and the command is \`forget-account\`. Parameters carry core's own names. Every entry states its core call, or says why there is none. Only \`GET\` and \`POST\` appear — core has no HTTP verbs, so reads are GET and everything else is POST.
+
+The \`edge-cli\` client is a thin one-shot process. A long-lived \`edge-engine\` daemon owns the \`EdgeContext\` and every logged-in account, serving this API over a Unix socket at \`~/.edge-cli/run/<profile>/engine.sock\`, plus loopback TCP when started with \`--tcp=9008\`.
+
+**There is no transport authentication.** The socket is owner-only (\`0600\`) and TCP is loopback, so anything that can reach the engine can act as every logged-in account.
+
+<a id="object-handles"></a>
+**Ephemeral object handles.** In \`edge-core-js\` a method-bearing value is identified by object reference — you call \`wallet.signTx(tx)\` on the very \`tx\` that \`makeSpend\` returned. That does not survive HTTP, so the engine parks such values under an \`objectId\` with a 5 minute TTL and later steps name the id. Reads do not extend the TTL; only a step that updates the value does. Finishing a workflow, or \`POST …/objects/{objectId}/delete\`, releases the handle early. Expired handles return \`410 OBJECT_EXPIRED\`.
+
+**Serialization.** \`Uint8Array\` becomes base64, \`Date\` becomes an ISO-8601 string, \`Map\` becomes an object, amounts are always decimal strings, and \`EdgeTokenId\` is JSON \`null\` for a native asset.
+
+**Testing.** Always pass \`-t\` / \`--test\` to point at the \`*-tester.edge.app\` servers.`
+  )}</div>
+${body}
+<h2 id="errors">Error codes</h2>
+${errorSection}
+<h2 id="exit-codes">CLI exit codes</h2>
+${exitSection}
+</main>
+</div>
+<script>
+const q = document.getElementById('q')
+const links = [...document.querySelectorAll('nav a.e[data-s]')]
+q.addEventListener('input', () => {
+  const v = q.value.trim().toLowerCase()
+  for (const a of links) a.classList.toggle('hidden', v !== '' && !a.dataset.s.includes(v))
+  for (const g of document.querySelectorAll('nav .g')) {
+    let el = g.nextElementSibling, any = false
+    while (el != null && el.classList.contains('e')) {
+      if (!el.classList.contains('hidden')) any = true
+      el = el.nextElementSibling
+    }
+    g.classList.toggle('hidden', !any)
+  }
+  // A section heading outlives its groups unless it is hidden too.
+  for (const sec of document.querySelectorAll('nav .s')) {
+    let el = sec.nextElementSibling, any = false
+    while (el != null && !el.classList.contains('s')) {
+      if (el.classList.contains('e') && !el.classList.contains('hidden')) any = true
+      el = el.nextElementSibling
+    }
+    sec.classList.toggle('hidden', !any)
+  }
+})
+</script>
+</body></html>`
+}
+
+// ---------------------------------------------------------------------- main
+
+fs.mkdirSync(OUT, { recursive: true })
+const spec = buildOpenApi()
+const html = buildHtml()
+const wroteJson = writeIfChanged(
+  path.join(OUT, 'openapi.json'),
+  JSON.stringify(spec, null, 2) + '\n'
+)
+const wroteHtml = writeIfChanged(path.join(OUT, 'index.html'), html)
+
+const count = groups.reduce((n, g) => n + g.endpoints.length, 0)
+console.log(`✓ ${count} calls in ${groups.length} groups`)
+console.log(
+  `  ${wroteJson ? 'wrote' : 'unchanged'} docs/api/dist/openapi.json  ${
+    (JSON.stringify(spec).length / 1024) | 0
+  } KB`
+)
+console.log(
+  `  ${wroteHtml ? 'wrote' : 'unchanged'} docs/api/dist/index.html    ${
+    (html.length / 1024) | 0
+  } KB`
+)
diff --git a/scripts/buildCliCommands.ts b/scripts/buildCliCommands.ts
new file mode 100644
index 00000000000..15df344606d
--- /dev/null
+++ b/scripts/buildCliCommands.ts
@@ -0,0 +1,158 @@
+/**
+ * Generates the CLI's command table from the route declarations.
+ *
+ * A command that only maps arguments onto a request needs no code: its
+ * positional, flags, method and path all come from the route. This emits that
+ * table as JSON, which `src/cli/commands/generated.ts` turns into commands at
+ * startup.
+ *
+ * Commands marked `custom` in their declaration are hand-written, because they
+ * do something the request shape cannot describe — writing export files,
+ * storing a session, holding a stream open.
+ *
+ * The file is committed, so `src/` never depends on `scripts/`.
+ *
+ *   node -r sucrase/register scripts/buildCliCommands.ts
+ */
+import path from 'path'
+
+import { usageFor } from './cliUsage'
+import {
+  type ExtractedCli,
+  type ExtractedRoute,
+  extractRoutes,
+  kebab
+} from './extractRoutes'
+import { writeIfChanged } from './writeIfChanged'
+
+const OUT = path.resolve(__dirname, '../src/cli/generated/commands.json')
+
+interface ArgSpec {
+  /** Flag name, without dashes. Absent when taken as the positional. */
+  flag?: string
+  /** Request field it fills. */
+  field: string
+  /** Where it goes. */
+  target: 'query' | 'body'
+  kind: 'string' | 'boolean' | 'boolstr' | 'repeat' | 'json'
+  required: boolean
+}
+
+interface CommandSpec {
+  command: string
+  method: string
+  path: string
+  usage: string
+  help: string
+  needsSession: boolean
+  /**
+   * Path parameter taken as the bare positional argument.
+   *
+   * Every positional is a path parameter now, whether it started as scope
+   * (`{walletId}`) or as a declared field the route path appends.
+   */
+  pathPositional?: string
+  args: ArgSpec[]
+  /** Flag carrying the whole body as one JSON argument. */
+  bodyFlag?: string
+  /** Fields sent at fixed values. */
+  preset?: Record<string, boolean>
+}
+
+/** A JSON blob is anything the caller cannot express as a scalar flag. */
+function kindOf(type: string, required: boolean): ArgSpec['kind'] {
+  const t = type.replace(/ \| (null|undefined)/g, '').trim()
+  // A bare `--flag` can only ever mean true, so a field that must be sent
+  // takes an explicit `--flag=true|false`. `change-paused` could not be
+  // turned off until this distinction existed.
+  if (t === 'boolean') return required ? 'boolstr' : 'boolean'
+  if (t.endsWith('[]') || t.startsWith('Array<') || t.startsWith('{')) {
+    return 'json'
+  }
+  if (t === 'unknown') return 'json'
+  return 'string'
+}
+
+function specFor(r: ExtractedRoute, cli: ExtractedCli): CommandSpec {
+  const fields = [
+    ...(r.query ?? []).map(f => ({ f, target: 'query' as const })),
+    ...(r.body ?? []).map(f => ({ f, target: 'body' as const }))
+  ]
+
+  // `{sessionId}` comes from the stored session; any other path parameter is
+  // the command's positional argument. A positional that is also a declared
+  // field is already on the path, so it must not be sent again as a flag.
+  const pathPositional = r.pathParams.find(p => p !== 'sessionId')
+  const args: ArgSpec[] = []
+  for (const { f, target } of fields) {
+    if (f.name === pathPositional) continue
+    const mapped = cli.flags.find(x => x.maps === f.name)
+    args.push({
+      flag: mapped?.name ?? kebab(f.name),
+      field: f.name,
+      target,
+      kind: mapped?.repeat === true ? 'repeat' : kindOf(f.type, !f.optional),
+      required: !f.optional
+    })
+  }
+
+  // `bodyFlag` means one JSON argument *is* the body, so any other declared
+  // field would be silently dropped. Better to fail the build than to send a
+  // request missing a field the route requires.
+  if (cli.bodyFlag != null && args.length > 0) {
+    throw new Error(
+      `${cli.command}: has bodyFlag "${cli.bodyFlag}" and also declares ` +
+        `${args.map(a => a.field).join(', ')}; drop the bodyFlag so every ` +
+        'field gets its own flag'
+    )
+  }
+
+  return {
+    command: cli.command,
+    method: r.method,
+    path: r.routePath,
+    usage: usageFor(r, cli),
+    help: r.summary,
+    needsSession: r.pathParams.includes('sessionId'),
+    pathPositional,
+    args: cli.bodyFlag != null ? [] : args,
+    bodyFlag: cli.bodyFlag,
+    preset: Object.keys(cli.preset).length > 0 ? cli.preset : undefined
+  }
+}
+
+const commands: CommandSpec[] = []
+const custom: string[] = []
+for (const r of extractRoutes()) {
+  if (r.isStream) continue
+  for (const cli of [r.cli, ...r.cliExtra]) {
+    if (cli == null) continue
+    if (cli.custom) {
+      custom.push(cli.command)
+      continue
+    }
+    if (commands.some(c => c.command === cli.command)) {
+      throw new Error(
+        `Command "${cli.command}" is declared on more than one route. ` +
+          'Mark it `custom: true` and hand-write the dispatch.'
+      )
+    }
+    commands.push(specFor(r, cli))
+  }
+}
+commands.sort((a, b) => a.command.localeCompare(b.command))
+
+const payload = {
+  $comment:
+    'GENERATED FILE — DO NOT EDIT. Produced by scripts/buildCliCommands.ts ' +
+    'from the route declarations in src/cli/engine/routes. Commands marked ' +
+    '`custom: true` in a declaration are hand-written instead; see ' +
+    'src/cli/commands/.',
+  commands
+}
+
+const changed = writeIfChanged(OUT, JSON.stringify(payload, null, 2) + '\n')
+console.log(
+  `${changed ? '✓ wrote' : '· unchanged'} src/cli/generated/commands.json ` +
+    `(${commands.length} generated, ${custom.length} hand-written)`
+)
diff --git a/scripts/buildCliHelp.ts b/scripts/buildCliHelp.ts
new file mode 100644
index 00000000000..76ac18edb1f
--- /dev/null
+++ b/scripts/buildCliHelp.ts
@@ -0,0 +1,120 @@
+/**
+ * Generates the CLI's runtime help text from the route declarations.
+ *
+ * JSDoc is erased at compile time, so `edge-cli help <command>` cannot read it
+ * directly. This lifts the prose out of `src/cli/engine/routes/*.ts` into a
+ * committed JSON file that the CLI imports, keeping a single copy of every
+ * sentence: the declaration itself.
+ *
+ * The file is committed, so a fresh clone runs without ever executing this —
+ * `src/` never depends on `scripts/`. Regenerated by `npm run prepare`.
+ *
+ *   node -r sucrase/register scripts/buildCliHelp.ts
+ */
+import path from 'path'
+
+import { passForm, usageFor } from './cliUsage'
+import {
+  type ExtractedCli,
+  type ExtractedRoute,
+  extractRoutes
+} from './extractRoutes'
+import { writeIfChanged } from './writeIfChanged'
+
+const OUT = path.resolve(__dirname, '../src/cli/generated/helpDocs.json')
+
+interface ParamHelp {
+  /** How to supply it on the command line, or null when REST-only. */
+  pass: string | null
+  doc?: string
+  optional?: boolean
+  restOnly?: boolean
+}
+
+interface CommandHelp {
+  summary: string
+  description?: string
+  core?: string
+  method: string
+  path: string
+  usage: string
+  params?: Record<string, ParamHelp>
+  returns?: Record<string, string>
+  returnsDoc?: string
+  notes?: string[]
+  errors?: string[]
+}
+
+function helpFor(r: ExtractedRoute, cli: ExtractedCli): CommandHelp {
+  const entry: CommandHelp = {
+    summary: r.summary,
+    method: r.method,
+    path: r.routePath,
+    usage: usageFor(r, cli)
+  }
+  if (r.description != null) entry.description = r.description
+  if (r.core != null) entry.core = r.core
+
+  const params: Record<string, ParamHelp> = {}
+  for (const f of [...(r.query ?? []), ...(r.body ?? [])]) {
+    params[f.name] = {
+      pass: passForm(cli, f),
+      doc: f.doc,
+      optional: f.optional
+    }
+  }
+  for (const x of cli.extra) {
+    params[x.name] = {
+      pass: x.kind === 'boolean' ? `--${x.name}` : `--${x.name}=<value>`,
+      doc: x.doc,
+      optional: x.required !== true
+    }
+  }
+  if (Object.keys(params).length > 0) entry.params = params
+
+  if (r.returns != null && r.returns.length > 0) {
+    entry.returns = Object.fromEntries(
+      r.returns.map(f => [
+        f.name + (f.optional ? '?' : ''),
+        f.doc != null ? `${f.type} — ${f.doc}` : f.type
+      ])
+    )
+  } else if (r.returnsType != null && r.returnsType !== 'unknown') {
+    entry.returns = { '': r.returnsType }
+  }
+  const returnsProse = r.returnsProse ?? r.returnsDoc
+  if (returnsProse != null) entry.returnsDoc = returnsProse
+
+  const notes = [...r.notes]
+  if (cli.notes != null) notes.push(cli.notes)
+  if (notes.length > 0) entry.notes = notes
+  if (r.errors.length > 0) entry.errors = r.errors
+  return entry
+}
+
+const commands: Record<string, CommandHelp> = {}
+for (const r of extractRoutes()) {
+  for (const cli of [r.cli, ...r.cliExtra]) {
+    if (cli == null) continue
+    commands[cli.command] = helpFor(r, cli)
+  }
+}
+
+const payload = {
+  $comment:
+    'GENERATED FILE — DO NOT EDIT. Produced by scripts/buildCliHelp.ts from ' +
+    'the route declarations in src/cli/engine/routes. Edit the declaration, ' +
+    'then run `npm run prepare` (or `npm run docs:api`).',
+  commands: Object.fromEntries(
+    Object.keys(commands)
+      .sort((a, b) => a.localeCompare(b))
+      .map(k => [k, commands[k]])
+  )
+}
+
+const changed = writeIfChanged(OUT, JSON.stringify(payload, null, 2) + '\n')
+const count = Object.keys(commands).length
+console.log(
+  `${changed ? '✓ wrote' : '· unchanged'} src/cli/generated/helpDocs.json ` +
+    `(${count} command${count === 1 ? '' : 's'})`
+)
diff --git a/scripts/buildNodeApiSigner.sh b/scripts/buildNodeApiSigner.sh
new file mode 100755
index 00000000000..fb25d129091
--- /dev/null
+++ b/scripts/buildNodeApiSigner.sh
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# Generate secret shards from edgeKey.json and build the Node N-API Edge API
+# HMAC signer. Requires a real apiSecret — refuses to link a stub addon.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+if [ ! -f edgeKey.json ]; then
+  echo "error: edgeKey.json required to build the Node API signer" >&2
+  exit 1
+fi
+
+node -r sucrase/register ./scripts/makeApiSigner.ts
+
+NODE_DIR=native/edge-api-signer/node
+if [ ! -f "$NODE_DIR/edge_api_secret.c" ]; then
+  echo "error: $NODE_DIR/edge_api_secret.c missing (edgeKey.json apiSecret required)" >&2
+  exit 1
+fi
+
+(
+  cd "$NODE_DIR"
+  node ../../../node_modules/node-gyp/bin/node-gyp.js configure
+  node ../../../node_modules/node-gyp/bin/node-gyp.js build
+)
+
+echo "built $NODE_DIR/build/Release/edge_api_signer.node"
diff --git a/scripts/checkCliCoverage.ts b/scripts/checkCliCoverage.ts
new file mode 100644
index 00000000000..33da56e8ed5
--- /dev/null
+++ b/scripts/checkCliCoverage.ts
@@ -0,0 +1,75 @@
+/**
+ * Which commands no automated test ever runs.
+ *
+ * Live coverage was about half the surface until the fake world existed, and
+ * the only way anyone knew that was by counting by hand. This counts instead,
+ * and fails on a command that nothing exercises unless it is listed below with
+ * a reason.
+ */
+import fs from 'fs'
+import path from 'path'
+
+const ROOT = path.resolve(__dirname, '..')
+
+/**
+ * Commands no test can reach, and why.
+ *
+ * Each of these calls a third-party API over the real internet, which the fake
+ * world does not intercept, so they cannot run in a pre-commit hook.
+ * `npm run test:cli:network` is where they belong.
+ */
+const NETWORK_ONLY: Record<string, string> = {
+  'rates-query': 'Fetches exchange rates from an external API.',
+  'rates-usd-to-native': 'Fetches exchange rates from an external API.',
+  'fetch-swap-quotes': 'Polls the swap providers.',
+  'get-payment-protocol-info': 'Fetches a BIP70 request from a merchant.'
+}
+
+const generated = JSON.parse(
+  fs.readFileSync(path.join(ROOT, 'src/cli/generated/commands.json'), 'utf8')
+) as { commands: Array<{ command: string }> }
+
+const commands = new Set(generated.commands.map(c => c.command))
+const handDir = path.join(ROOT, 'src/cli/commands')
+for (const file of fs.readdirSync(handDir)) {
+  const text = fs.readFileSync(path.join(handDir, file), 'utf8')
+  for (const m of text.matchAll(/\bcommand\(\s*'([a-z0-9-]+)'/g)) {
+    commands.add(m[1])
+  }
+}
+
+const tests = ['scripts/testCliFake.ts', 'scripts/testCliSubscribe.ts']
+  .map(f => fs.readFileSync(path.join(ROOT, f), 'utf8'))
+  .join('\n')
+const run = new Set([...tests.matchAll(/'([a-z0-9-]+)'/g)].map(m => m[1]))
+
+const missing: string[] = []
+const stale: string[] = []
+for (const name of [...commands].sort()) {
+  const covered = run.has(name)
+  const excused = NETWORK_ONLY[name] != null
+  if (!covered && !excused) missing.push(name)
+  if (covered && excused) stale.push(name)
+}
+
+const offline = [...commands].filter(c => run.has(c)).length
+if (missing.length > 0 || stale.length > 0) {
+  console.error('✗ CLI coverage:\n')
+  for (const name of missing) {
+    console.error(
+      `  ${name}: no offline test runs it. Add one to testCliFake.ts, or ` +
+        'list it in NETWORK_ONLY with the reason it cannot run offline.'
+    )
+  }
+  for (const name of stale) {
+    console.error(
+      `  ${name}: listed as network-only, but an offline test runs it. ` +
+        'Remove the entry.'
+    )
+  }
+  process.exit(1)
+}
+console.log(
+  `✓ ${offline}/${commands.size} commands run offline ` +
+    `(${Object.keys(NETWORK_ONLY).length} need the network)`
+)
diff --git a/scripts/checkCoreAlignment.ts b/scripts/checkCoreAlignment.ts
new file mode 100644
index 00000000000..e99b586c617
--- /dev/null
+++ b/scripts/checkCoreAlignment.ts
@@ -0,0 +1,155 @@
+/**
+ * Compare each route's request against the core call it fronts.
+ *
+ * `verifyApiDocs` only checks that the core member exists by name, which is
+ * how `currency-wallets` came to carry a `waitForAll` parameter that
+ * `account.currencyWallets` does not have — it is a property, and waiting is a
+ * separate method. This resolves the real signature and compares names.
+ */
+import path from 'path'
+import ts from 'typescript'
+
+import { extractRoutes } from './extractRoutes'
+
+const CORE = path.resolve(
+  __dirname,
+  '../node_modules/edge-core-js/src/types/types.ts'
+)
+
+/** Which core interface a `core:` prefix refers to. */
+const INTERFACES: Record<string, string> = {
+  context: 'EdgeContext',
+  account: 'EdgeAccount',
+  wallet: 'EdgeCurrencyWallet',
+  'account.dataStore': 'EdgeDataStore',
+  EdgeSwapQuote: 'EdgeSwapQuote',
+  EdgeLoginRequest: 'EdgeLoginRequest',
+  EdgePendingEdgeLogin: 'EdgePendingEdgeLogin'
+}
+
+const program = ts.createProgram([CORE], {
+  target: ts.ScriptTarget.ES2020,
+  moduleResolution: ts.ModuleResolutionKind.NodeJs
+})
+const checker = program.getTypeChecker()
+const source = program.getSourceFile(CORE)
+if (source == null) throw new Error(`Cannot read ${CORE}`)
+
+/** Every named interface in core's public types. */
+const interfaces = new Map<string, ts.InterfaceDeclaration>()
+source.forEachChild(node => {
+  if (ts.isInterfaceDeclaration(node)) interfaces.set(node.name.text, node)
+})
+
+/**
+ * Property names a type exposes, for an options object.
+ *
+ * Primitives are skipped: asking a `string` for its properties yields
+ * `charAt`, `toUpperCase` and forty more, none of which is a parameter.
+ */
+function paramNames(type: ts.Type): Set<string> {
+  const out = new Set<string>()
+  const objectish =
+    (type.flags & ts.TypeFlags.Object) !== 0 ||
+    (type.isUnionOrIntersection() &&
+      type.types.some(t => (t.flags & ts.TypeFlags.Object) !== 0))
+  if (!objectish) return out
+  // An array or a typed array is a value, not a bag of named options.
+  const name = checker.typeToString(type)
+  if (/\[\]$|^(Array|Uint8Array|Promise)\b/.test(name)) return out
+  for (const prop of checker.getPropertiesOfType(type)) {
+    if (prop.name.startsWith('__@')) continue
+    out.add(prop.name)
+  }
+  return out
+}
+
+interface Signature {
+  kind: 'method' | 'property'
+  params: Set<string>
+}
+
+function signatureOf(coreCall: string): Signature | null {
+  const parts = coreCall.split('.')
+  const member = parts.pop() ?? ''
+  const owner = INTERFACES[parts.join('.')] ?? INTERFACES[parts[0]]
+  const decl = owner != null ? interfaces.get(owner) : undefined
+  if (decl == null) return null
+
+  for (const m of decl.members) {
+    if (m.name?.getText() !== member) continue
+    // Core writes its methods as properties holding function types
+    // (`changePassword: (opts: …) => Promise<void>`), so asking the type for
+    // its call signatures is what distinguishes a method from a real property.
+    const type = checker.getTypeAtLocation(m)
+    const calls = type.getCallSignatures()
+    if (calls.length === 0) return { kind: 'property', params: new Set() }
+
+    const params = new Set<string>()
+    for (const p of calls[0].getParameters()) {
+      const pType = checker.getTypeOfSymbolAtLocation(p, m)
+      const inner = paramNames(pType)
+      // A parameter that is an object of options contributes its properties;
+      // the parameter's own name is not something a caller ever sends.
+      if (inner.size > 0) {
+        for (const n of inner) params.add(n)
+      }
+      params.add(p.name)
+    }
+    return { kind: 'method', params }
+  }
+  return null
+}
+
+// Scope, not arguments: these identify the receiver, not what is passed to it.
+const SCOPE = new Set(['sessionId', 'walletId', 'objectId', 'pendingId'])
+
+let checked = 0
+const problems: string[] = []
+for (const r of extractRoutes()) {
+  if (r.core == null || r.core.includes('$internalStuff')) continue
+  const sig = signatureOf(r.core)
+  if (sig == null) continue
+  checked++
+
+  const declared = [...(r.query ?? []), ...(r.body ?? [])]
+    .map(f => f.name)
+    .filter(n => !SCOPE.has(n))
+
+  const extra =
+    sig.kind === 'property'
+      ? declared
+      : declared.filter(n => !sig.params.has(n))
+  const takes =
+    sig.kind === 'property'
+      ? 'nothing — it is a property, not a method'
+      : [...sig.params].join(', ')
+
+  for (const name of extra) {
+    if (r.coreExtra[name] == null) {
+      problems.push(
+        `${r.id}: ${r.core} has no parameter "${name}". Drop it, or record ` +
+          `in \`coreExtra\` why it exists. Core takes: ${takes}`
+      )
+    }
+  }
+  // A justification that no longer applies is worse than none: it claims a
+  // difference was weighed when the difference is gone.
+  for (const name of Object.keys(r.coreExtra)) {
+    if (!extra.includes(name)) {
+      problems.push(
+        `${r.id}: coreExtra lists "${name}", which is not a divergence any ` +
+          'more. Remove the entry.'
+      )
+    }
+  }
+}
+
+if (problems.length > 0) {
+  console.error(`✗ ${problems.length} core-alignment problem(s):\n`)
+  for (const p of problems) console.error(`  ${p}`)
+  process.exit(1)
+}
+console.log(
+  `✓ ${checked} routes match their core signature, ` + `or say why they differ`
+)
diff --git a/scripts/checkRouteContracts.ts b/scripts/checkRouteContracts.ts
new file mode 100644
index 00000000000..01380f29ca6
--- /dev/null
+++ b/scripts/checkRouteContracts.ts
@@ -0,0 +1,132 @@
+/**
+ * Checks each route declaration against itself and against its handler.
+ *
+ * `verifyApiDocs` compares the surface — routes, commands, flags, core names.
+ * This checks the contract: that every field a caller can send is described,
+ * that nothing described has gone away, and that a handler does not read a
+ * field its cleaner would have stripped.
+ *
+ *   node -r sucrase/register scripts/checkRouteContracts.ts
+ */
+import fs from 'fs'
+import path from 'path'
+
+import { errorCodes } from '../docs/api/shared'
+import { extractRoutes } from './extractRoutes'
+
+const ROOT = path.resolve(__dirname, '..')
+const ROUTES = path.join(ROOT, 'src/cli/engine/routes')
+
+/** Source of every route declaration's handler, keyed by `METHOD path`. */
+function handlerSources(): Map<string, string> {
+  const out = new Map<string, string>()
+  for (const name of fs.readdirSync(ROUTES)) {
+    if (!name.endsWith('.ts') || name === 'index.ts' || name === 'helpers.ts') {
+      continue
+    }
+    const src = fs.readFileSync(path.join(ROUTES, name), 'utf8')
+    const re =
+      /\broute\(\{([\s\S]*?\bmethod:\s*'([A-Z]+)',\s*\n?\s*path:\s*'([^']+)'[\s\S]*?)\n\}\)/g
+    let m: RegExpExecArray | null
+    while ((m = re.exec(src)) != null) out.set(`${m[2]} ${m[3]}`, m[1])
+  }
+  return out
+}
+
+/** Fields a handler pulls off `ctx.body` or the validated query. */
+function readsFrom(fn: string, source: 'body' | 'query'): Set<string> {
+  const out = new Set<string>()
+  const base = source === 'body' ? 'ctx\\.body' : 'ctx\\.query\\.valid'
+  for (const m of fn.matchAll(new RegExp(`${base}\\.([a-zA-Z_][\\w]*)`, 'g'))) {
+    out.add(m[1])
+  }
+  // Destructured: `const { a, b } = ctx.body`
+  for (const m of fn.matchAll(
+    new RegExp(`const \\{([^}]*)\\} = ${base}\\b`, 'g')
+  )) {
+    for (const part of m[1].split(',')) {
+      // `{ filter = 'active' }` and `{ tokenId: id }` both name one field.
+      const name = part.split(':')[0].split('=')[0].trim()
+      if (name !== '') out.add(name)
+    }
+  }
+  return out
+}
+
+const handlers = handlerSources()
+const problems: string[] = []
+let described = 0
+let total = 0
+
+for (const r of extractRoutes()) {
+  const fields = [...(r.query ?? []), ...(r.body ?? [])]
+  const names = new Set(fields.map(f => f.name))
+
+  // Every field a caller can send needs a description, beside the field.
+  for (const field of fields) {
+    if (field.doc == null) {
+      problems.push(
+        `${r.id}: field "${field.name}" has no description — wrap it as ` +
+          `doc(cleaner, '…')`
+      )
+    }
+  }
+
+  // A handler must not read a field its cleaner would have stripped.
+  const fn = handlers.get(`${r.method} ${r.routePath}`)
+  if (fn != null) {
+    for (const name of readsFrom(fn, 'body')) {
+      if (r.body != null && !names.has(name)) {
+        problems.push(
+          `${r.id}: handler reads ctx.body.${name}, absent from the body cleaner`
+        )
+      }
+    }
+    for (const name of readsFrom(fn, 'query')) {
+      if (!names.has(name)) {
+        problems.push(
+          `${r.id}: handler reads query "${name}", absent from the query cleaner`
+        )
+      }
+    }
+
+    // A route that declares a query cleaner must read the cleaned result. A
+    // handler that re-parses the raw URLSearchParams gets whatever the caller
+    // sent, so the declared type stops being the enforced type — which is how
+    // `waitForAll` came to be documented as a string while the command wanted
+    // a switch.
+    if (r.query != null) {
+      const raw =
+        /\b(optionalQuery(String|Int|Date|Boolean)|requireQuery(String|Int)|ctx\.query\.(get|has))\b/.exec(
+          fn
+        )
+      if (raw != null) {
+        problems.push(
+          `${r.id}: handler calls ${raw[1]} on the raw query; read ` +
+            'ctx.query.valid instead, so the declared cleaner is what runs'
+        )
+      }
+    }
+  }
+
+  // Error codes must exist in the catalogue.
+  const known = new Set(errorCodes.map(e => e.code))
+  for (const code of r.errors) {
+    if (!known.has(code)) {
+      problems.push(`${r.id}: lists error "${code}", absent from the catalogue`)
+    }
+  }
+
+  described += (r.returns ?? []).filter(f => f.doc != null).length
+  total += (r.returns ?? []).length
+}
+
+if (problems.length > 0) {
+  console.error(`✗ ${problems.length} contract problem(s):\n`)
+  for (const p of problems) console.error(`  ${p}`)
+  process.exit(1)
+}
+console.log(
+  `✓ contracts hold across ${handlers.size} declarations ` +
+    `(${described}/${total} response fields carry prose)`
+)
diff --git a/scripts/cleaners.ts b/scripts/cleaners.ts
index 3be3cdb91de..3596d3d76a7 100644
--- a/scripts/cleaners.ts
+++ b/scripts/cleaners.ts
@@ -34,8 +34,9 @@ export const asReleaseConfig = asObject({
   ios: asObject(asObject({ appCenterAppName: asString })),
   android: asObject(asObject({ appCenterAppName: asString })),
 
-  // Maps from branch names to env.json settings:
-  envJson: asOptional(asObject(asObject(asUnknown)), () => ({}))
+  // Maps from branch names to config.json / keys.json settings:
+  configJson: asOptional(asObject(asObject(asUnknown)), () => ({})),
+  keysJson: asOptional(asObject(asObject(asUnknown)), () => ({}))
 })
 export type ReleaseConfig = ReturnType<typeof asReleaseConfig>
 
diff --git a/scripts/cliNodeSafeSmoke.js b/scripts/cliNodeSafeSmoke.js
new file mode 100644
index 00000000000..7fa1c771523
--- /dev/null
+++ b/scripts/cliNodeSafeSmoke.js
@@ -0,0 +1,116 @@
+#!/usr/bin/env node
+/**
+ * Pre-commit / CI smoke: ensure CLI-shared GUI modules stay Node-loadable
+ * (no react-native* on the require graph) and the CLI entry parses.
+ *
+ * Usage: node scripts/cliNodeSafeSmoke.js
+ */
+'use strict'
+
+const path = require('path')
+const { spawnSync } = require('child_process')
+
+const root = path.join(__dirname, '..')
+
+const SHARED_MODULES = [
+  'src/util/fiatConstants.ts',
+  'src/util/network.ts',
+  'src/util/utils.ts',
+  'src/util/exchangeRates.ts',
+  'src/locales/strings.ts',
+  'src/locales/intl.ts',
+  'src/locales/bootLocale.ts',
+  'src/locales/nodeLocale.ts',
+  'src/cli/bootNodeLocale.ts',
+  'src/util/txDisplay/index.ts',
+  'src/util/localAccountSettings.ts',
+  'src/util/spamThreshold.ts',
+  'src/util/txTagging/index.ts',
+  'src/util/exchangeDenom.ts',
+  'src/util/fillTxsFiat.ts',
+  'src/util/txExport/index.ts',
+  'src/util/exportTxInfo.ts',
+  'src/cli/engine/routes/rates.ts',
+  'src/cli/engine/nodeApiSigner.ts',
+  'src/util/keysServer.ts',
+  'src/cli/engine/fetchPluginKeys.ts',
+  'src/cli/engine/makeCoreContext.ts'
+]
+
+const CHILD_TIMEOUT_MS = 60_000
+
+/**
+ * A child killed by a signal (segfault in the native addon, OOM, timeout)
+ * reports `status: null`, so the exit code has to be derived rather than
+ * forwarded — `process.exit(null)` would exit 0 and pass the gate.
+ */
+function failIfUnsuccessful(result, label) {
+  if (result.error == null && result.signal == null && result.status === 0) {
+    return
+  }
+  console.error(`FAIL ${label}`)
+  const out = `${result.stdout || ''}${result.stderr || ''}`.trim()
+  if (out !== '') console.error(out)
+  if (result.error != null)
+    console.error(`spawn error: ${result.error.message}`)
+  if (result.signal != null) console.error(`killed by signal: ${result.signal}`)
+  process.exit(
+    typeof result.status === 'number' && result.status !== 0 ? result.status : 1
+  )
+}
+
+function assertNodeSafe(relPath) {
+  const abs = path.join(root, relPath)
+  const probe = `
+const Module = require('module')
+const orig = Module._load
+Module._load = function (request, parent, isMain) {
+  const id = request
+  if (
+    id === 'react-native' ||
+    id.startsWith('react-native/') ||
+    id.startsWith('react-native-') ||
+    id === '@sentry/react-native' ||
+    id.startsWith('@react-native')
+  ) {
+    const from = parent && parent.filename ? parent.filename : '(unknown)'
+    const err = new Error('RN_LEAK ' + id + ' from ' + from)
+    err.code = 'RN_LEAK'
+    throw err
+  }
+  return orig.apply(this, arguments)
+}
+require(${JSON.stringify(abs)})
+console.log('OK ' + ${JSON.stringify(relPath)})
+`
+  const result = spawnSync(
+    process.execPath,
+    ['-r', 'sucrase/register', '-e', probe],
+    {
+      cwd: root,
+      encoding: 'utf8',
+      env: process.env,
+      timeout: CHILD_TIMEOUT_MS
+    }
+  )
+  failIfUnsuccessful(result, relPath)
+  process.stdout.write(result.stdout || '')
+}
+
+function assertCliHelp() {
+  const result = spawnSync(
+    process.execPath,
+    ['-r', 'sucrase/register', 'src/cli/index.ts', '--help'],
+    { cwd: root, encoding: 'utf8', env: process.env, timeout: CHILD_TIMEOUT_MS }
+  )
+  failIfUnsuccessful(result, 'cli --help')
+  console.log('OK cli --help')
+}
+
+console.log('cliNodeSafeSmoke: checking shared modules…')
+for (const mod of SHARED_MODULES) {
+  assertNodeSafe(mod)
+}
+console.log('cliNodeSafeSmoke: checking CLI entry…')
+assertCliHelp()
+console.log('cliNodeSafeSmoke: all checks passed')
diff --git a/scripts/cliUsage.ts b/scripts/cliUsage.ts
new file mode 100644
index 00000000000..4ce9f69c30c
--- /dev/null
+++ b/scripts/cliUsage.ts
@@ -0,0 +1,104 @@
+/**
+ * How a command is typed, derived from its route declaration.
+ *
+ * There were three copies of this: one for the command table the CLI runs on,
+ * one for `help`, and one for the HTML reference. They drifted, which is how
+ * `local-settings` came to document `--spam-filter-on=<spamFilterOn>` in the
+ * reference while `help` correctly said `--spam-filter-on=true|false`. One
+ * function means they cannot disagree again.
+ */
+import {
+  type ExtractedCli,
+  type ExtractedField,
+  type ExtractedRoute,
+  kebab
+} from './extractRoutes'
+
+/** The declared type, with the optional/null wrappers taken off. */
+function bareType(type: string): string {
+  return type.replace(/ \| (null|undefined)/g, '').trim()
+}
+
+/**
+ * The allowed values, when the declared type is a union of literals.
+ *
+ * `asValue('active', 'archived', …)` resolves to `"active" | "archived" | …`,
+ * which is exactly the list a reader wants in the usage line. Rendering it as
+ * `<value>` throws away something the declaration already knows.
+ */
+function literalChoices(type: string): string | null {
+  const parts = bareType(type)
+    .split('|')
+    .map(p => p.trim())
+  if (parts.length < 2) return null
+  if (!parts.every(p => /^(['"]).*\1$/.test(p))) return null
+  return parts.map(p => p.slice(1, -1)).join('|')
+}
+
+/**
+ * True for a field the command takes as a bare switch.
+ *
+ * Only an optional boolean qualifies. A required one needs `=true|false`,
+ * because a bare flag has no way to say false — which is how `change-paused`
+ * came to have no way to unpause a wallet.
+ */
+function isSwitch(field: ExtractedField): boolean {
+  return field.optional && bareType(field.type) === 'boolean'
+}
+
+/** How one request field is supplied on the command line. */
+/** True when the value has to be written as JSON rather than a bare word. */
+function isJson(type: string): boolean {
+  const t = bareType(type)
+  return (
+    t.endsWith('[]') ||
+    t.startsWith('Array<') ||
+    t.startsWith('{') ||
+    t === 'unknown'
+  )
+}
+
+/**
+ * What a field's value looks like on the command line.
+ *
+ * The placeholder names the field rather than saying `<value>`, so a usage
+ * line reads as something a person could type. Where the declaration knows
+ * the exact values — a boolean, or a union of literals — it says them.
+ */
+function valueForm(field: ExtractedField): string {
+  if (bareType(field.type) === 'boolean') return 'true|false'
+  const choices = literalChoices(field.type)
+  if (choices != null) return choices
+  if (isJson(field.type)) return "'<json>'"
+  return `<${field.name}>`
+}
+
+export function passForm(cli: ExtractedCli, field: ExtractedField): string {
+  // A positional rides on the path, so it is typed bare, not as a flag.
+  if (cli.positional === field.name) return `<${field.name}>`
+  const mapped = cli.flags.find(f => f.maps === field.name)
+  const name = mapped?.name ?? kebab(field.name)
+  const token = isSwitch(field)
+    ? `--${name}`
+    : mapped?.repeat === true
+    ? `--${name}=<${field.name}> …`
+    : `--${name}=${valueForm(field)}`
+  return field.optional ? `[${token}]` : token
+}
+
+/** The full usage line: command, positional, then every named argument. */
+export function usageFor(r: ExtractedRoute, cli: ExtractedCli): string {
+  const parts = [cli.command]
+  // A positional is a path parameter, so the path is the single source for
+  // it; `cli.positional` only names which field it carries.
+  for (const p of r.pathParams) if (p !== 'sessionId') parts.push(`<${p}>`)
+  for (const f of [...(r.query ?? []), ...(r.body ?? [])]) {
+    if (r.pathParams.includes(f.name)) continue
+    parts.push(passForm(cli, f))
+  }
+  for (const x of cli.extra) {
+    const token = x.kind === 'boolean' ? `--${x.name}` : `--${x.name}=<value>`
+    parts.push(x.required === true ? token : `[${token}]`)
+  }
+  return parts.join(' ')
+}
diff --git a/scripts/configure.ts b/scripts/configure.ts
index 4929dc4b6f1..46f8f335a8e 100644
--- a/scripts/configure.ts
+++ b/scripts/configure.ts
@@ -1,5 +1,11 @@
 import { makeConfig } from 'cleaner-config'
 
-import { asEnvConfig } from '../src/envConfig'
+import { asConfigJson, asKeysJson } from '../src/configKeysSchema'
 
-export const config = makeConfig(asEnvConfig, 'env.json')
+// `config.json` holds non-secret CONFIG settings. Secrets belong in
+// `keys.json` (KEYS / globalKeys / plugin maps). Both files are bootstrapped
+// here during `prepare` so a fresh clone can bundle without running
+// `split-env-json` first. `.withRest` preserves any extra or "comment" keys
+// already present in the file.
+export const config = makeConfig(asConfigJson.withRest, 'config.json')
+export const keys = makeConfig(asKeysJson.withRest, 'keys.json')
diff --git a/scripts/deploy.ts b/scripts/deploy.ts
index 182d55a203c..3875a1a0494 100644
--- a/scripts/deploy.ts
+++ b/scripts/deploy.ts
@@ -3,6 +3,7 @@ import fs from 'fs'
 import { join } from 'path'
 import { sprintf } from 'sprintf-js'
 
+import { deepMerge } from '../src/configKeysMerge'
 import { deleteOldDirsSync } from './cleanDirectories'
 
 const BUILD_ARCHIVE_MONTHS = 6
@@ -34,8 +35,15 @@ interface SplitArchitecture {
  * Things we expect to be set in the config file:
  */
 interface BuildConfigFile {
-  // Common build options:
-  envJson: Record<string, object>
+  // Per-branch overrides already shaped like the files they patch. Each maps
+  // branch name -> partial config.json / keys.json. Legacy flat `envJson` is
+  // ignored with a log (not translated). Legacy `*_INIT` field names are not
+  // handled here.
+  configJson?: Record<string, object>
+  keysJson?: Record<string, object>
+  // Legacy single-block overrides. Kept in deploy-config so old GUI builds
+  // still apply branch overrides; this branch ignores it.
+  envJson?: unknown
 
   // Android build options:
   androidKeyStore: string
@@ -163,23 +171,82 @@ function makeProject(buildObj: BuildObj): void {
   )
 }
 
+/**
+ * Deep-merge a branch's override object into the file contents, or return the
+ * file unchanged when this branch has nothing to say.
+ */
+function applyBranchOverrides(
+  file: Record<string, unknown> | undefined,
+  overridesByBranch: Record<string, object> | undefined,
+  branch: string,
+  fileLabel: string
+): Record<string, unknown> | undefined {
+  const overrides = overridesByBranch?.[branch]
+  if (overrides == null) return file
+  if (file == null) throw new Error(`${fileLabel} file is missing`)
+  return deepMerge(file, overrides) as Record<string, unknown>
+}
+
 function makeCommonPost(buildObj: BuildObj): void {
-  const envJsonPath = buildObj.guiDir + '/env.json'
-  let envJson
-  if (fs.existsSync(envJsonPath)) {
-    envJson = JSON.parse(fs.readFileSync(envJsonPath, 'utf8'))
+  const configJsonPath = buildObj.guiDir + '/config.json'
+  const keysJsonPath = buildObj.guiDir + '/keys.json'
+  let configJson: Record<string, unknown> | undefined
+  if (fs.existsSync(configJsonPath)) {
+    configJson = JSON.parse(fs.readFileSync(configJsonPath, 'utf8'))
   }
+  let keysJson: Record<string, unknown> | undefined
+  if (fs.existsSync(keysJsonPath)) {
+    keysJson = JSON.parse(fs.readFileSync(keysJsonPath, 'utf8'))
+  }
+
+  // Old GUI builds still read `envJson`. New builds use `configJson` /
+  // `keysJson` only, so the same deploy-config can serve both: leave
+  // `envJson` in the file for legacy deploys and ignore it here.
   if (buildObj.envJson != null) {
-    if (envJson == null) throw new Error('env.json file is missing')
-    envJson = { ...envJson, ...buildObj.envJson[buildObj.repoBranch] }
+    mylog(
+      'deploy-config.json: ignoring "envJson" (legacy). Using "configJson" / "keysJson".'
+    )
+    const branch = buildObj.repoBranch
+    const envJson = buildObj.envJson
+    const hasLegacyBranchBlock =
+      typeof envJson === 'object' &&
+      envJson != null &&
+      !Array.isArray(envJson) &&
+      Object.prototype.hasOwnProperty.call(envJson, branch)
+    if (
+      hasLegacyBranchBlock &&
+      buildObj.configJson?.[branch] == null &&
+      buildObj.keysJson?.[branch] == null
+    ) {
+      throw new Error(
+        `deploy-config.json: migrate envJson["${branch}"] to configJson / keysJson`
+      )
+    }
   }
+
+  configJson = applyBranchOverrides(
+    configJson,
+    buildObj.configJson,
+    buildObj.repoBranch,
+    'config.json'
+  )
+  keysJson = applyBranchOverrides(
+    keysJson,
+    buildObj.keysJson,
+    buildObj.repoBranch,
+    'keys.json'
+  )
   if (buildObj.maestroBuild) {
-    if (envJson == null) throw new Error('env.json file is missing')
-    envJson = { ...envJson, ENABLE_MAESTRO_BUILD: true }
+    if (configJson == null) throw new Error('config.json file is missing')
+    configJson = { ...configJson, ENABLE_MAESTRO_BUILD: true }
+  }
+  if (configJson != null) {
+    fs.chmodSync(configJsonPath, 0o600)
+    fs.writeFileSync(configJsonPath, JSON.stringify(configJson, null, 2))
   }
-  if (envJson != null) {
-    fs.chmodSync(envJsonPath, 0o600)
-    fs.writeFileSync(envJsonPath, JSON.stringify(envJson, null, 2))
+  if (keysJson != null) {
+    fs.chmodSync(keysJsonPath, 0o600)
+    fs.writeFileSync(keysJsonPath, JSON.stringify(keysJson, null, 2))
   }
 
   const buildVersionFile = buildObj.guiDir + '/release-version.json'
diff --git a/scripts/extractRoutes.ts b/scripts/extractRoutes.ts
new file mode 100644
index 00000000000..086165fe3c7
--- /dev/null
+++ b/scripts/extractRoutes.ts
@@ -0,0 +1,685 @@
+/**
+ * Reads route declarations out of `src/cli/engine/routes/*.ts`.
+ *
+ * The JSDoc above each `route(…)` is the prose; the `query`, `body` and
+ * `returns` cleaners are the shapes, resolved through the TypeScript checker
+ * so the documented type is literally the validator's type.
+ */
+import fs from 'fs'
+import path from 'path'
+import ts from 'typescript'
+
+const ROOT = path.resolve(__dirname, '..')
+const ROUTES = path.join(ROOT, 'src/cli/engine/routes')
+
+export interface ExtractedField {
+  name: string
+  type: string
+  optional: boolean
+  doc?: string
+}
+
+export interface ExtractedCliFlag {
+  /** Flag name as typed, without the leading dashes. */
+  name: string
+  /** Request field it carries. */
+  maps: string
+  repeat?: boolean
+  doc?: string
+}
+
+export interface ExtractedCliExtra {
+  name: string
+  kind: string
+  required?: boolean
+  requiredWith?: string
+  doc?: string
+}
+
+export interface ExtractedCli {
+  command: string
+  positional?: string
+  bodyFlag?: string
+  flags: ExtractedCliFlag[]
+  extra: ExtractedCliExtra[]
+  notes?: string
+  custom: boolean
+  /** Fields sent at fixed values. */
+  preset: Record<string, boolean>
+  exits?: Record<string, number>
+}
+
+export interface ExtractedRoute {
+  id: string
+  file: string
+  summary: string
+  description?: string
+  core: string | null
+  coreNote?: string
+  method: string
+  routePath: string
+  /** Fields core has no parameter for, mapped to the reason they exist. */
+  coreExtra: Record<string, string>
+  /** The `path` as written, before the positional is appended. */
+  declaredPath: string
+  /** Field the path carries as its final segment, or null. */
+  pathPositional: string | null
+  cli: ExtractedCli | null
+  /** Additional commands this route backs, e.g. `spend-max`. */
+  cliExtra: ExtractedCli[]
+  /** Path parameters, in order of appearance. */
+  pathParams: string[]
+  /** Source file basename, which is also the documentation group. */
+  group: string
+  isStream: boolean
+  errors: string[]
+  notes: string[]
+  bodyNote?: string
+  returnsDoc?: string
+  params: Record<string, string>
+  query?: ExtractedField[]
+  body?: ExtractedField[]
+  returns?: ExtractedField[]
+  returnsProse?: string
+  returnsType?: string
+}
+
+const FORMAT = ts.TypeFormatFlags.NoTruncation | ts.TypeFormatFlags.InTypeAlias
+
+function sourceFiles(): string[] {
+  return fs
+    .readdirSync(ROUTES)
+    .filter(n => n.endsWith('.ts') && n !== 'index.ts' && n !== 'helpers.ts')
+    .map(n => path.join(ROUTES, n))
+}
+
+/** Literal value of a property in the `route({…})` object. */
+function literal(obj: ts.ObjectLiteralExpression, key: string): string | null {
+  for (const prop of obj.properties) {
+    if (!ts.isPropertyAssignment(prop)) continue
+    if (prop.name.getText() !== key) continue
+    const init = prop.initializer
+    if (ts.isStringLiteral(init)) return init.text
+    if (init.kind === ts.SyntaxKind.NullKeyword) return null
+    return init.getText()
+  }
+  return undefined as unknown as string
+}
+
+function arrayLiteral(obj: ts.ObjectLiteralExpression, key: string): string[] {
+  for (const prop of obj.properties) {
+    if (!ts.isPropertyAssignment(prop)) continue
+    if (prop.name.getText() !== key) continue
+    if (!ts.isArrayLiteralExpression(prop.initializer)) return []
+    return prop.initializer.elements.filter(ts.isStringLiteral).map(e => e.text)
+  }
+  return []
+}
+
+function propNode(
+  obj: ts.ObjectLiteralExpression,
+  key: string
+): ts.Expression | undefined {
+  for (const prop of obj.properties) {
+    if (ts.isPropertyAssignment(prop) && prop.name.getText() === key) {
+      return prop.initializer
+    }
+  }
+  return undefined
+}
+
+/** Expand a cleaner's resolved output type into documented fields. */
+function fieldsOf(
+  checker: ts.TypeChecker,
+  node: ts.Expression
+): { fields: ExtractedField[]; type: string } {
+  const cleanerType = checker.getTypeAtLocation(node)
+  const call = cleanerType.getCallSignatures()[0]
+  if (call == null) {
+    return { fields: [], type: checker.typeToString(cleanerType, node, FORMAT) }
+  }
+  const out = checker.getReturnTypeOfSignature(call)
+  const typeText = checker.typeToString(out, node, FORMAT)
+  // A primitive or `unknown` has no fields of its own — asking for its
+  // properties yields the prototype's, which are not part of the API.
+  const isObjectLike =
+    (out.flags & ts.TypeFlags.Object) !== 0 && !typeText.endsWith('[]')
+  const fields = (isObjectLike ? checker.getPropertiesOfType(out) : []).map(
+    prop => {
+      const t = checker.getTypeOfSymbolAtLocation(prop, node)
+      let text = checker.typeToString(t, node, FORMAT)
+      // Cleaners type optional fields as `T | undefined`; render them as `T?`.
+      const optional =
+        (prop.flags & ts.SymbolFlags.Optional) !== 0 ||
+        text.endsWith(' | undefined')
+      text = text.replace(/ \| undefined$/, '')
+      return { name: prop.name, type: text, optional }
+    }
+  )
+  return { fields, type: typeText }
+}
+
+/**
+ * Field prose written as `doc(cleaner, 'text')`.
+ *
+ * Read from the syntax tree rather than at runtime, because request cleaners
+ * use `.withRest`, which discards the `.shape` a runtime walk would need.
+ * Resolves a bare identifier (`returns: asSession`) back to its declaration,
+ * so a shared response shape carries its prose once.
+ */
+function proseFor(
+  checker: ts.TypeChecker,
+  node: ts.Expression
+): Record<string, string> {
+  // Null-prototype, so a field called `toString` cannot pick up an inherited
+  // member instead of its own prose.
+  const out: Record<string, string> = Object.create(null)
+
+  const objectOf = (expr: ts.Expression): ts.Expression | undefined => {
+    // A shared field group is a bare object literal, not an asObject() call.
+    if (ts.isObjectLiteralExpression(expr)) return expr
+    // asObject({…}) / asObject({…}).withRest / a name pointing at either.
+    let cur: ts.Expression = expr
+    if (ts.isPropertyAccessExpression(cur)) cur = cur.expression
+    if (ts.isIdentifier(cur)) {
+      let sym = checker.getSymbolAtLocation(cur)
+      // An import is an alias; follow it to the real declaration so a shared
+      // response shape carries its prose from wherever it is defined.
+      if (sym != null && (sym.flags & ts.SymbolFlags.Alias) !== 0) {
+        sym = checker.getAliasedSymbol(sym)
+      }
+      const decl = sym?.declarations?.[0]
+      if (
+        decl != null &&
+        ts.isVariableDeclaration(decl) &&
+        decl.initializer != null
+      ) {
+        return objectOf(decl.initializer)
+      }
+      return undefined
+    }
+    if (ts.isCallExpression(cur)) {
+      const callee = cur.expression.getText()
+      if (callee === 'doc') return objectOf(cur.arguments[0])
+      if (callee.startsWith('asObject')) return cur.arguments[0]
+    }
+    return undefined
+  }
+
+  // Resolve the prose argument: a literal, a `'a' + 'b'` concatenation, or a
+  // named constant shared between fields.
+  const proseText = (expr: ts.Expression): string | undefined => {
+    if (ts.isStringLiteral(expr) || ts.isNoSubstitutionTemplateLiteral(expr)) {
+      return expr.text
+    }
+    if (
+      ts.isBinaryExpression(expr) &&
+      expr.operatorToken.kind === ts.SyntaxKind.PlusToken
+    ) {
+      const left = proseText(expr.left)
+      const right = proseText(expr.right)
+      if (left != null && right != null) return left + right
+    }
+    if (ts.isIdentifier(expr)) {
+      let sym = checker.getSymbolAtLocation(expr)
+      if (sym != null && (sym.flags & ts.SymbolFlags.Alias) !== 0) {
+        sym = checker.getAliasedSymbol(sym)
+      }
+      const decl = sym?.declarations?.[0]
+      if (
+        decl != null &&
+        ts.isVariableDeclaration(decl) &&
+        decl.initializer != null
+      ) {
+        return proseText(decl.initializer)
+      }
+    }
+    return undefined
+  }
+
+  // A `doc(…)` call may sit inside a combinator — `asOptional(doc(…))` — so
+  // search the expression rather than only looking at its outermost call.
+  const findDoc = (expr: ts.Expression): string | undefined => {
+    // A shared field cleaner is named: `walletId: asWalletId`, where
+    // `asWalletId` is `doc(asString, '…')` exported from schemas. Follow the
+    // name to its declaration so one description serves every route using it.
+    if (ts.isIdentifier(expr)) {
+      let sym = checker.getSymbolAtLocation(expr)
+      if (sym != null && (sym.flags & ts.SymbolFlags.Alias) !== 0) {
+        sym = checker.getAliasedSymbol(sym)
+      }
+      const decl = sym?.declarations?.[0]
+      if (
+        decl != null &&
+        ts.isVariableDeclaration(decl) &&
+        decl.initializer != null
+      ) {
+        return findDoc(decl.initializer)
+      }
+      return undefined
+    }
+    if (ts.isCallExpression(expr)) {
+      if (expr.expression.getText() === 'doc' && expr.arguments.length > 1) {
+        return proseText(expr.arguments[1])
+      }
+      for (const arg of expr.arguments) {
+        const found = findDoc(arg)
+        if (found != null) return found
+      }
+    }
+    if (ts.isPropertyAccessExpression(expr)) return findDoc(expr.expression)
+    return undefined
+  }
+
+  // Prose attached to the whole cleaner, for pass-through responses. Only the
+  // outermost call counts: a nested field's prose is not the response's.
+  let outer: ts.Expression = node
+  if (ts.isPropertyAccessExpression(outer)) outer = outer.expression
+  if (
+    ts.isCallExpression(outer) &&
+    outer.expression.getText() === 'doc' &&
+    outer.arguments.length > 1
+  ) {
+    const whole = proseText(outer.arguments[1])
+    if (whole != null) out[''] = whole
+  }
+
+  const shape = objectOf(node)
+  if (shape == null || !ts.isObjectLiteralExpression(shape)) return out
+  for (const prop of shape.properties) {
+    if (ts.isSpreadAssignment(prop)) {
+      // `...loginOptionFields` — the spread object carries prose too.
+      Object.assign(out, proseFor(checker, prop.expression))
+      continue
+    }
+    if (!ts.isPropertyAssignment(prop)) continue
+    const found = findDoc(prop.initializer)
+    if (found != null) out[prop.name.getText()] = found
+  }
+  return out
+}
+
+/** Read `{ key: 'text', … }` from a property, for `coreExtra`. */
+function recordLiteral(
+  arg: ts.ObjectLiteralExpression,
+  key: string
+): Record<string, string> {
+  const out: Record<string, string> = {}
+  const node = propNode(arg, key)
+  if (node == null || !ts.isObjectLiteralExpression(node)) return out
+  for (const prop of node.properties) {
+    if (!ts.isPropertyAssignment(prop)) continue
+    const name = prop.name.getText().replace(/'/g, '')
+    const init = prop.initializer
+    if (ts.isStringLiteral(init) || ts.isNoSubstitutionTemplateLiteral(init)) {
+      out[name] = init.text
+    } else {
+      // A concatenation spanning lines.
+      out[name] = init
+        .getText()
+        .replace(/'\s*\+\s*'/g, '')
+        .replace(/^'|'$/g, '')
+    }
+  }
+  return out
+}
+
+/** Parse the `cli` field: a bare command name, an object spec, or null. */
+function parseCli(node: ts.Expression | undefined): ExtractedCli | null {
+  if (node == null) return null
+  if (node.kind === ts.SyntaxKind.NullKeyword) return null
+  if (ts.isStringLiteral(node)) {
+    return {
+      command: node.text,
+      flags: [],
+      extra: [],
+      custom: false,
+      preset: {}
+    }
+  }
+  if (!ts.isObjectLiteralExpression(node)) return null
+
+  const str = (
+    o: ts.ObjectLiteralExpression,
+    key: string
+  ): string | undefined => {
+    for (const prop of o.properties) {
+      if (!ts.isPropertyAssignment(prop)) continue
+      if (prop.name.getText() !== key) continue
+      if (ts.isStringLiteral(prop.initializer)) return prop.initializer.text
+      if (ts.isNoSubstitutionTemplateLiteral(prop.initializer)) {
+        return prop.initializer.text
+      }
+      // A concatenated string spanning lines.
+      const text = prop.initializer.getText()
+      const parts = [...text.matchAll(/'([^']*)'/g)].map(m => m[1])
+      if (parts.length > 0) return parts.join('')
+    }
+    return undefined
+  }
+  const obj = (
+    o: ts.ObjectLiteralExpression,
+    key: string
+  ): ts.ObjectLiteralExpression | undefined => {
+    for (const prop of o.properties) {
+      if (
+        ts.isPropertyAssignment(prop) &&
+        prop.name.getText() === key &&
+        ts.isObjectLiteralExpression(prop.initializer)
+      ) {
+        return prop.initializer
+      }
+    }
+    return undefined
+  }
+
+  const command = str(node, 'command') ?? ''
+  const flags: ExtractedCliFlag[] = []
+  const flagsObj = obj(node, 'flags')
+  if (flagsObj != null) {
+    for (const prop of flagsObj.properties) {
+      if (!ts.isPropertyAssignment(prop)) continue
+      const name = prop.name.getText().replace(/'/g, '')
+      const spec = ts.isObjectLiteralExpression(prop.initializer)
+        ? prop.initializer
+        : undefined
+      flags.push({
+        name: kebab(name),
+        maps: spec != null ? str(spec, 'maps') ?? name : name,
+        repeat: spec != null ? /repeat:\s*true/.test(spec.getText()) : false,
+        doc: spec != null ? str(spec, 'doc') : undefined
+      })
+    }
+  }
+  const extra: ExtractedCliExtra[] = []
+  const extraObj = obj(node, 'extra')
+  if (extraObj != null) {
+    for (const prop of extraObj.properties) {
+      if (!ts.isPropertyAssignment(prop)) continue
+      const name = prop.name.getText().replace(/'/g, '')
+      const spec = ts.isObjectLiteralExpression(prop.initializer)
+        ? prop.initializer
+        : undefined
+      extra.push({
+        name: kebab(name),
+        kind: spec != null ? str(spec, 'kind') ?? 'string' : 'string',
+        required:
+          spec != null ? /required:\s*true/.test(spec.getText()) : false,
+        requiredWith: spec != null ? str(spec, 'requiredWith') : undefined,
+        doc: spec != null ? str(spec, 'doc') : undefined
+      })
+    }
+  }
+  return {
+    command,
+    positional: str(node, 'positional'),
+    bodyFlag: str(node, 'bodyFlag'),
+    flags,
+    extra,
+    custom: /custom:\s*true/.test(node.getText()),
+    preset: (() => {
+      const out: Record<string, boolean> = {}
+      const o = obj(node, 'preset')
+      if (o != null) {
+        for (const prop of o.properties) {
+          if (!ts.isPropertyAssignment(prop)) continue
+          const v = prop.initializer.getText()
+          if (v === 'true' || v === 'false') {
+            out[prop.name.getText().replace(/'/g, '')] = v === 'true'
+          }
+        }
+      }
+      return out
+    })(),
+    notes: str(node, 'notes')
+  }
+}
+
+/** `cli` may be one command or several. */
+function parseCliList(node: ts.Expression | undefined): ExtractedCli[] {
+  if (node != null && ts.isArrayLiteralExpression(node)) {
+    return node.elements
+      .map(el => parseCli(el))
+      .filter((c): c is ExtractedCli => c != null)
+  }
+  const one = parseCli(node)
+  return one != null ? [one] : []
+}
+
+/** camelCase to kebab-case, the CLI's flag spelling. */
+export function kebab(name: string): string {
+  return name.replace(/[A-Z]/g, c => '-' + c.toLowerCase())
+}
+
+/** Split a JSDoc comment into prose and tags. */
+function readJsDoc(node: ts.Node): {
+  summary: string
+  description?: string
+  tags: Array<[string, string]>
+} {
+  const docs = (node as unknown as { jsDoc?: ts.JSDoc[] }).jsDoc
+  if (docs == null || docs.length === 0) return { summary: '', tags: [] }
+  const doc = docs[docs.length - 1]
+  const comment =
+    typeof doc.comment === 'string'
+      ? doc.comment
+      : (doc.comment ?? []).map(c => c.text).join('')
+  const paras = comment
+    .split('\n\n')
+    .map(p => p.replace(/\s*\n\s*/g, ' ').trim())
+  const tags: Array<[string, string]> = []
+  for (const tag of doc.tags ?? []) {
+    const name = tag.tagName.text
+    const text =
+      typeof tag.comment === 'string'
+        ? tag.comment
+        : (tag.comment ?? []).map(c => c.text).join('')
+    const paramName = ts.isJSDocParameterTag(tag)
+      ? tag.name.getText()
+      : undefined
+    // Tag text wraps across comment lines; collapse it back to one line.
+    const flat = text.replace(/\s*\n\s*/g, ' ').trim()
+    tags.push([name, (paramName != null ? `${paramName} ` : '') + flat])
+  }
+  return {
+    summary: paras[0] ?? '',
+    description: paras.length > 1 ? paras.slice(1).join('\n\n') : undefined,
+    tags
+  }
+}
+
+/**
+ * Property names wrapped in `asOptional(…)`.
+ *
+ * `asOptional(asUnknown)` resolves to plain `unknown`, because `unknown`
+ * absorbs `undefined` — so optionality has to be read from the source.
+ */
+function optionalNames(
+  checker: ts.TypeChecker,
+  node: ts.Expression
+): Set<string> {
+  const out = new Set<string>()
+  const walk = (expr: ts.Expression): ts.Expression | undefined => {
+    let cur: ts.Expression = expr
+    if (ts.isPropertyAccessExpression(cur)) cur = cur.expression
+    if (ts.isObjectLiteralExpression(cur)) return cur
+    if (ts.isIdentifier(cur)) {
+      let sym = checker.getSymbolAtLocation(cur)
+      if (sym != null && (sym.flags & ts.SymbolFlags.Alias) !== 0) {
+        sym = checker.getAliasedSymbol(sym)
+      }
+      const decl = sym?.declarations?.[0]
+      if (
+        decl != null &&
+        ts.isVariableDeclaration(decl) &&
+        decl.initializer != null
+      ) {
+        return walk(decl.initializer)
+      }
+      return undefined
+    }
+    if (ts.isCallExpression(cur)) {
+      const callee = cur.expression.getText()
+      if (callee === 'doc') return walk(cur.arguments[0])
+      if (callee.startsWith('asObject')) return cur.arguments[0]
+    }
+    return undefined
+  }
+  const shape = walk(node)
+  if (shape == null || !ts.isObjectLiteralExpression(shape)) return out
+  for (const prop of shape.properties) {
+    if (ts.isSpreadAssignment(prop)) {
+      for (const n of optionalNames(checker, prop.expression)) out.add(n)
+      continue
+    }
+    if (!ts.isPropertyAssignment(prop)) continue
+    if (/\basOptional\s*\(/.test(prop.initializer.getText())) {
+      out.add(prop.name.getText().replace(/'/g, ''))
+    }
+  }
+  return out
+}
+
+/** Resolved fields, each carrying the prose written beside it. */
+function withProse(
+  checker: ts.TypeChecker,
+  node: ts.Expression | undefined
+): ExtractedField[] | undefined {
+  if (node == null) return undefined
+  const prose = proseFor(checker, node)
+  const optional = optionalNames(checker, node)
+  return fieldsOf(checker, node).fields.map(f => ({
+    ...f,
+    optional: f.optional || optional.has(f.name),
+    doc: prose[f.name]
+  }))
+}
+
+export function extractRoutes(): ExtractedRoute[] {
+  const files = sourceFiles()
+  const program = ts.createProgram(files, {
+    strict: true,
+    target: ts.ScriptTarget.ES2020,
+    moduleResolution: ts.ModuleResolutionKind.NodeJs,
+    skipLibCheck: true,
+    noEmit: true
+  })
+  const checker = program.getTypeChecker()
+  const out: ExtractedRoute[] = []
+
+  for (const file of files) {
+    const src = program.getSourceFile(file)
+    if (src == null) continue
+    for (const stmt of src.statements) {
+      if (!ts.isVariableStatement(stmt)) continue
+      for (const decl of stmt.declarationList.declarations) {
+        const init = decl.initializer
+        if (
+          init == null ||
+          !ts.isCallExpression(init) ||
+          init.expression.getText() !== 'route'
+        ) {
+          continue
+        }
+        const arg = init.arguments[0]
+        if (arg == null || !ts.isObjectLiteralExpression(arg)) continue
+
+        const { summary, description, tags } = readJsDoc(stmt)
+        const params: Record<string, string> = {}
+        const notes: string[] = []
+        let bodyNote: string | undefined
+        let returnsDoc: string | undefined
+        let coreNote: string | undefined
+        for (const [tag, text] of tags) {
+          if (tag === 'param') {
+            const [name, ...rest] = text.split(' ')
+            params[name] = rest.join(' ').trim()
+          } else if (tag === 'note') notes.push(text.trim())
+          else if (tag === 'bodyNote') bodyNote = text.trim()
+          else if (tag === 'returns') returnsDoc = text.trim()
+          else if (tag === 'coreNote') coreNote = text.trim()
+        }
+
+        const queryNode = propNode(arg, 'query')
+        const bodyNode = propNode(arg, 'body')
+        const returnsNode = propNode(arg, 'returns')
+        const cliNode = propNode(arg, 'cli')
+
+        // The declared `path` carries scope and command; a positional is
+        // appended to it. Mirrors `routePath` in src/cli/engine/route.ts,
+        // which is what the engine actually serves.
+        const declaredPath = literal(arg, 'path') ?? ''
+        const cli = parseCliList(cliNode)[0] ?? null
+        const pathPositional = cli?.positional ?? null
+        const routePath =
+          pathPositional == null
+            ? declaredPath
+            : `${declaredPath}/{${pathPositional}}`
+
+        out.push({
+          id: decl.name.getText(),
+          file: path.basename(file),
+          summary,
+          description,
+          core: literal(arg, 'core'),
+          coreNote,
+          coreExtra: recordLiteral(arg, 'coreExtra'),
+          method: literal(arg, 'method') ?? '',
+          routePath,
+          declaredPath,
+          pathPositional,
+          cli,
+          cliExtra: parseCliList(cliNode).slice(1),
+          pathParams: [...routePath.matchAll(/\{(\w+)\}/g)].map(m => m[1]),
+          group: path.basename(file, '.ts'),
+          isStream: propNode(arg, 'stream') != null,
+          errors: arrayLiteral(arg, 'errors'),
+          notes,
+          bodyNote,
+          returnsDoc,
+          params,
+          query: withProse(checker, queryNode),
+          body: withProse(checker, bodyNode),
+          returns: withProse(checker, returnsNode),
+          returnsProse:
+            returnsNode != null
+              ? proseFor(checker, returnsNode)['']
+              : undefined,
+          returnsType:
+            returnsNode != null
+              ? fieldsOf(checker, returnsNode).type
+              : undefined
+        })
+      }
+    }
+  }
+  return out
+}
+
+if (require.main === module) {
+  const routes = extractRoutes()
+  console.log(`extracted ${routes.length} route declaration(s)\n`)
+  for (const r of routes) {
+    console.log(`${r.id}  [${r.file}]`)
+    console.log(`  ${r.method} ${r.routePath}   cli=${r.cli?.command ?? '—'}`)
+    console.log(
+      `  core: ${r.core ?? 'null'}${
+        r.coreNote != null ? ' — ' + r.coreNote.slice(0, 60) : ''
+      }`
+    )
+    console.log(`  summary: ${r.summary}`)
+    if (r.description != null)
+      console.log(`  desc: ${r.description.slice(0, 80)}…`)
+    for (const n of r.notes) console.log(`  note: ${n.slice(0, 78)}`)
+    if (r.returnsDoc != null)
+      console.log(`  returns doc: ${r.returnsDoc.slice(0, 70)}`)
+    if (r.returns != null) {
+      console.log(
+        `  returns: ${r.returns
+          .map(f => f.name + (f.optional ? '?' : '') + ': ' + f.type)
+          .join(', ')}`
+      )
+    }
+    console.log()
+  }
+}
diff --git a/scripts/loggingServer.ts b/scripts/loggingServer.ts
index 4482582b526..b1bd0f62fae 100644
--- a/scripts/loggingServer.ts
+++ b/scripts/loggingServer.ts
@@ -5,12 +5,12 @@ import os from 'os'
 
 const ifaces = os.networkInterfaces()
 const PORT = 8080
-const envFile = './env.json'
+const configFile = './config.json'
 let address = ''
-let envJSON = { LOG_SERVER: {} }
+let configJson = { LOG_SERVER: {} }
 
 try {
-  envJSON = JSON.parse(fs.readFileSync(envFile, 'utf8'))
+  configJson = JSON.parse(fs.readFileSync(configFile, 'utf8'))
 } catch (e) {
   console.log(e)
 }
@@ -32,12 +32,12 @@ try {
     })
   })
 
-  // Set env.json with correct path
-  envJSON.LOG_SERVER = {
+  // Set config.json with correct path
+  configJson.LOG_SERVER = {
     host: `http://${address}`,
     port: `${PORT}`
   }
-  fs.writeFileSync(envFile, JSON.stringify(envJSON, null, 2))
+  fs.writeFileSync(configFile, JSON.stringify(configJson, null, 2))
 } catch (e) {
   console.log(e)
 }
@@ -49,7 +49,7 @@ app.use(bodyParser.json())
 app.use(bodyParser.urlencoded({ extended: true }))
 
 app.post('/log', function (req, res) {
-  if (req.body?.data) console.log(req.body.data.toString())
+  if (req.body?.data != null) console.log(req.body.data.toString())
   res.sendStatus(200)
 })
 
diff --git a/scripts/makeApiSigner.ts b/scripts/makeApiSigner.ts
new file mode 100644
index 00000000000..cb0a143ca48
--- /dev/null
+++ b/scripts/makeApiSigner.ts
@@ -0,0 +1,461 @@
+/**
+ * Generates XOR-split native C sources embedding apiKey / apiSecret from edgeKey.json.
+ *
+ * Bundle / application ID for the runtime XOR pad is read from the post-patch
+ * project files (must match):
+ *   - android/app/build.gradle → applicationId (not namespace)
+ *   - ios/edge.xcodeproj/project.pbxproj → PRODUCT_BUNDLE_IDENTIFIER
+ *
+ * Outputs (gitignored):
+ *   ios/EdgeApiSecret.c + ios/EdgeApiSecret.h
+ *   android/app/src/main/cpp/edge_api_secret.c (+ header)
+ *   native/edge-api-signer/node/edge_api_secret.c (+ header)
+ *
+ * Stub secret (`00`) only when EDGE_API_SIGNER_ALLOW_STUB=1 (used by prepare.sh
+ * before Jenkins secretFiles). Native generate tasks omit the flag so missing
+ * edgeKey.json fails closed.
+ */
+
+import { createHash, randomBytes } from 'crypto'
+import fs from 'fs'
+import path from 'path'
+
+import { NODE_API_SIGNER_BUNDLE_ID } from '../src/cli/engine/nodeApiSigner'
+
+const ROOT = path.join(__dirname, '..')
+const SHARD_COUNT = 6 // 5 random pads + 1 stored remainder (after runtime pad)
+export const MAX_SECRET_LEN = 32
+const STAMP_PATH = path.join(ROOT, '.edgeApiSigner.stamp')
+const ANDROID_CPP = path.join(ROOT, 'android/app/src/main/cpp')
+const NODE_CPP = path.join(ROOT, 'native/edge-api-signer/node')
+const NODE_SOURCE = path.join(NODE_CPP, 'edge_api_secret.c')
+const NODE_HEADER = path.join(NODE_CPP, 'edge_api_secret.h')
+const OUTPUT_PATHS = {
+  iosSource: path.join(ROOT, 'ios/EdgeApiSecret.c'),
+  iosHeader: path.join(ROOT, 'ios/EdgeApiSecret.h'),
+  androidSource: path.join(ANDROID_CPP, 'edge_api_secret.c'),
+  androidHeader: path.join(ANDROID_CPP, 'edge_api_secret.h')
+}
+export const API_KEY_PLACEHOLDER =
+  'Error: Set up edgeKey.json apiKey & re-run scripts/makeApiSigner.ts'
+const MISSING_SECRET_MESSAGE =
+  'edgeKey.json apiSecret missing. Copy edgeKey.example.json to edgeKey.json ' +
+  'and fill in apiKey / apiSecret (Jenkins gets these from scripts/secretFiles.ts). ' +
+  'To compile without working signing, set EDGE_API_SIGNER_ALLOW_STUB=1.'
+
+function parseHexSecret(hex: string): Buffer {
+  const cleaned = hex.replace(/^0x/i, '').trim()
+  if (!/^[0-9a-fA-F]*$/.test(cleaned) || cleaned.length % 2 !== 0) {
+    throw new Error('apiSecret must be even-length hex')
+  }
+  const buf = Buffer.from(cleaned, 'hex')
+  if (buf.length === 0 || buf.length > MAX_SECRET_LEN) {
+    throw new Error(
+      `apiSecret length must be 1..${MAX_SECRET_LEN} bytes (got ${buf.length})`
+    )
+  }
+  return buf
+}
+
+function cByteArray(name: string, bytes: Buffer): string {
+  const body = Array.from(bytes)
+    .map(b => `0x${b.toString(16).padStart(2, '0')}`)
+    .join(', ')
+  // `volatile` is load-bearing, not decoration. Without it clang -O2
+  // constant-folds the whole XOR chain: the shard and decoy arrays are dropped
+  // entirely (no `__const` section is emitted) and a single 32-byte literal
+  // equal to `secret XOR sha256(bundleId)` is left in `__literal16`. Marking
+  // them volatile forces every byte to be read at runtime, so the shards
+  // survive as distinct symbols and the reassembly actually happens.
+  return `static volatile const unsigned char ${name}[${bytes.length}] = { ${body} };\n`
+}
+
+/**
+ * Read Android applicationId (not namespace) from build.gradle.
+ */
+export function readAndroidApplicationId(gradlePath: string): string {
+  const text = fs.readFileSync(gradlePath, 'utf8')
+  const match = /applicationId\s+"([^"]+)"/.exec(text)
+  if (match == null) {
+    throw new Error(`applicationId not found in ${gradlePath}`)
+  }
+  return match[1]
+}
+
+/**
+ * Read PRODUCT_BUNDLE_IDENTIFIER from Xcode project.pbxproj.
+ * All Debug/Release entries must agree.
+ */
+export function readIosBundleId(pbxPath: string): string {
+  const text = fs.readFileSync(pbxPath, 'utf8')
+  const matches = [
+    ...text.matchAll(/PRODUCT_BUNDLE_IDENTIFIER\s*=\s*([^;]+);/g)
+  ].map(m => m[1].trim().replace(/^"|"$/g, ''))
+  if (matches.length === 0) {
+    throw new Error(`PRODUCT_BUNDLE_IDENTIFIER not found in ${pbxPath}`)
+  }
+  const unique = [...new Set(matches)]
+  if (unique.length !== 1) {
+    throw new Error(
+      `Conflicting PRODUCT_BUNDLE_IDENTIFIER values in ${pbxPath}: ${unique.join(
+        ', '
+      )}`
+    )
+  }
+  return unique[0]
+}
+
+/**
+ * Canonical app id after any deployPatches: Android applicationId and iOS
+ * PRODUCT_BUNDLE_IDENTIFIER must match.
+ */
+export function readBundleId(root: string = ROOT): string {
+  const androidId = readAndroidApplicationId(
+    path.join(root, 'android/app/build.gradle')
+  )
+  const iosId = readIosBundleId(
+    path.join(root, 'ios/edge.xcodeproj/project.pbxproj')
+  )
+  if (androidId !== iosId) {
+    throw new Error(
+      `Bundle ID mismatch: Android applicationId="${androidId}" vs iOS PRODUCT_BUNDLE_IDENTIFIER="${iosId}"`
+    )
+  }
+  return androidId
+}
+
+function makeSource(apiKey: string, secret: Buffer, bundleId: string): string {
+  const len = secret.length
+  const runtimePad = createHash('sha256')
+    .update(bundleId, 'utf8')
+    .digest()
+    .subarray(0, len)
+
+  // P1..P5 random; stored = S xor P1..P5 xor runtimePad
+  const pads: Buffer[] = []
+  for (let i = 0; i < SHARD_COUNT - 1; i++) {
+    pads.push(randomBytes(len))
+  }
+  const stored = Buffer.alloc(len)
+  for (let i = 0; i < len; i++) {
+    let v = secret[i] ^ runtimePad[i]
+    for (const p of pads) v ^= p[i]
+    stored[i] = v
+  }
+  pads.push(stored)
+
+  // Decoy arrays (same shape). They are `volatile const` like the shards and
+  // are read at runtime below, so -O2 cannot drop them.
+  const decoys = [randomBytes(len), randomBytes(len), randomBytes(len)]
+
+  const shardNames = ['ea_s0', 'ea_s1', 'ea_s2', 'ea_s3', 'ea_s4', 'ea_s5']
+  const decoyNames = ['ea_d0', 'ea_d1', 'ea_d2']
+
+  // JSON.stringify doubles as a C string escaper only while the key stays
+  // printable ASCII: \uXXXX escapes are not valid C.
+  if (!/^[\x20-\x7e]+$/.test(apiKey)) {
+    throw new Error('apiKey must be printable ASCII')
+  }
+
+  let out = `/* auto-generated by scripts/makeApiSigner.ts — do not edit */
+#include <stddef.h>
+#include <stdint.h>
+#include <string.h>
+#include "edge_hmac.h"
+#include "edge_api_sign.h"
+
+#define EDGE_API_SECRET_LEN ${len}
+
+`
+  for (let i = 0; i < shardNames.length; i++) {
+    out += cByteArray(shardNames[i], pads[i])
+    if (i < decoyNames.length) {
+      out += cByteArray(decoyNames[i], decoys[i])
+    }
+  }
+
+  out += `
+static const char ea_api_key[] = ${JSON.stringify(apiKey)};
+
+const char *edge_api_key(void) {
+  return ea_api_key;
+}
+
+/* Opaque accessors so the arrays are not one contiguous blob in .rodata order
+ * alone. Byte loops rather than memcpy: memcpy from a volatile array is
+ * ill-typed, and the per-byte volatile reads are what defeat constant folding. */
+#define EDGE_API_LOAD(fn, arr)                                   \
+  static void fn(uint8_t *o) {                                   \
+    size_t i;                                                    \
+    for (i = 0; i < EDGE_API_SECRET_LEN; ++i) o[i] = arr[i];     \
+  }
+EDGE_API_LOAD(ea_load0, ea_s0)
+EDGE_API_LOAD(ea_load1, ea_s1)
+EDGE_API_LOAD(ea_load2, ea_s2)
+EDGE_API_LOAD(ea_load3, ea_s3)
+EDGE_API_LOAD(ea_load4, ea_s4)
+EDGE_API_LOAD(ea_load5, ea_s5)
+
+int edge_api_hmac_sign(
+  const uint8_t *message,
+  size_t message_len,
+  const char *bundle_id,
+  uint8_t signature_out[32]
+) {
+  uint8_t secret[EDGE_API_SECRET_LEN];
+  uint8_t tmp[EDGE_API_SECRET_LEN];
+  uint8_t runtime_pad[32];
+  edge_sha256_ctx sha;
+  size_t i;
+  size_t pad_len;
+  volatile uint8_t decoy_sink;
+
+  if (message == NULL || signature_out == NULL || bundle_id == NULL) {
+    return 1;
+  }
+
+  /* Keep decoy symbols live under -O2 / LTO. */
+  decoy_sink = (uint8_t)(ea_d0[0] ^ ea_d1[0] ^ ea_d2[0]);
+  (void)decoy_sink;
+
+  memset(secret, 0, sizeof(secret));
+  ea_load0(tmp); for (i = 0; i < EDGE_API_SECRET_LEN; ++i) secret[i] ^= tmp[i];
+  ea_load1(tmp); for (i = 0; i < EDGE_API_SECRET_LEN; ++i) secret[i] ^= tmp[i];
+  ea_load2(tmp); for (i = 0; i < EDGE_API_SECRET_LEN; ++i) secret[i] ^= tmp[i];
+  ea_load3(tmp); for (i = 0; i < EDGE_API_SECRET_LEN; ++i) secret[i] ^= tmp[i];
+  ea_load4(tmp); for (i = 0; i < EDGE_API_SECRET_LEN; ++i) secret[i] ^= tmp[i];
+  ea_load5(tmp); for (i = 0; i < EDGE_API_SECRET_LEN; ++i) secret[i] ^= tmp[i];
+
+  edge_sha256_init(&sha);
+  edge_sha256_update(&sha, (const uint8_t *)bundle_id, strlen(bundle_id));
+  edge_sha256_final(&sha, runtime_pad);
+  pad_len = EDGE_API_SECRET_LEN < 32 ? EDGE_API_SECRET_LEN : 32;
+  for (i = 0; i < pad_len; ++i) secret[i] ^= runtime_pad[i];
+
+  edge_hmac_sha256(secret, EDGE_API_SECRET_LEN, message, message_len, signature_out);
+
+  edge_secure_wipe(secret, sizeof(secret));
+  edge_secure_wipe(tmp, sizeof(tmp));
+  edge_secure_wipe(runtime_pad, sizeof(runtime_pad));
+  edge_secure_wipe(&sha, sizeof(sha));
+  return 0;
+}
+`
+  return out
+}
+
+/**
+ * Declares nothing itself: consumers include edge_api_sign.h directly. It
+ * exists so the Xcode phase has a stable output path to track alongside the
+ * generated source.
+ */
+function makeHeader(): string {
+  return `/* auto-generated by scripts/makeApiSigner.ts — do not edit */
+#ifndef EDGE_API_SECRET_GEN_H
+#define EDGE_API_SECRET_GEN_H
+#include "edge_api_sign.h"
+#endif
+`
+}
+
+/**
+ * The Node header additionally publishes the runtime pad, so
+ * edge_api_signer_napi.c unpads with exactly the id the shards were built
+ * against instead of repeating the literal.
+ */
+function makeNodeHeader(nodeBundleId: string): string {
+  if (!/^[\x20-\x7e]+$/.test(nodeBundleId)) {
+    throw new Error('nodeBundleId must be printable ASCII')
+  }
+  return `/* auto-generated by scripts/makeApiSigner.ts — do not edit */
+#ifndef EDGE_API_SECRET_GEN_H
+#define EDGE_API_SECRET_GEN_H
+#include "edge_api_sign.h"
+#define EDGE_NODE_BUNDLE_ID ${JSON.stringify(nodeBundleId)}
+#endif
+`
+}
+
+/**
+ * Write through a temp file so a concurrent Gradle and Xcode generate cannot
+ * leave a half-written source for the compiler to read.
+ */
+function writeFile(filePath: string, contents: string): void {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true })
+  const tempPath = `${filePath}.${process.pid}.tmp`
+  fs.writeFileSync(tempPath, contents)
+  fs.renameSync(tempPath, filePath)
+  console.log('wrote', path.relative(ROOT, filePath))
+}
+
+function anyOutputsExist(): boolean {
+  return Object.values(OUTPUT_PATHS).some(p => fs.existsSync(p))
+}
+
+/** True when all four generated secret sources exist (complete tree). */
+export function signerOutputsExist(): boolean {
+  return Object.values(OUTPUT_PATHS).every(p => fs.existsSync(p))
+}
+
+function outputsExist(): boolean {
+  return signerOutputsExist()
+}
+
+function readStampBundleId(): string | undefined {
+  if (!fs.existsSync(STAMP_PATH)) return undefined
+  const lines = fs.readFileSync(STAMP_PATH, 'utf8').split('\n')
+  // stamp format: <sha256>\n<bundleId>\n (older stamps had only the hash)
+  return lines.length >= 2 && lines[1] !== '' ? lines[1] : undefined
+}
+
+/**
+ * Read the public apiKey embedded in a generated secret source so EdgeApiKey
+ * can stay in lockstep when edgeKey.json is incomplete.
+ */
+export function readEmbeddedSignerApiKey(): string | undefined {
+  for (const filePath of [OUTPUT_PATHS.iosSource, OUTPUT_PATHS.androidSource]) {
+    if (!fs.existsSync(filePath)) continue
+    const text = fs.readFileSync(filePath, 'utf8')
+    const match =
+      /static const char ea_api_key\[\] = ("(?:\\.|[^"\\])*");/.exec(text)
+    if (match == null) continue
+    try {
+      const value = JSON.parse(match[1])
+      if (typeof value === 'string' && value !== '') return value
+    } catch {
+      // fall through
+    }
+  }
+  return undefined
+}
+
+function main(): void {
+  const mobileBundleId = readBundleId()
+  const nodeBundleId = NODE_API_SIGNER_BUNDLE_ID
+  console.log('bundleId', mobileBundleId)
+  console.log('nodeBundleId', nodeBundleId)
+
+  let apiKey = API_KEY_PLACEHOLDER
+  let secretHex = ''
+  try {
+    const edgeKey = require('../edgeKey.json')
+    if (typeof edgeKey.apiKey === 'string' && edgeKey.apiKey !== '') {
+      apiKey = edgeKey.apiKey
+    }
+    if (typeof edgeKey.apiSecret === 'string' && edgeKey.apiSecret !== '') {
+      secretHex = edgeKey.apiSecret
+    }
+  } catch (error: unknown) {
+    const err = error as { code?: string; message?: string }
+    const missing =
+      err.code === 'MODULE_NOT_FOUND' &&
+      String(err.message).includes('edgeKey.json')
+    if (!missing) throw error
+    // A missing edgeKey.json follows the stub / fail-closed policy below.
+    console.log(
+      'warn: could not read edgeKey.json:',
+      error instanceof Error ? error.message : String(error)
+    )
+  }
+
+  let missingSecret = false
+  if (secretHex === '') {
+    if (process.env.EDGE_API_SIGNER_ALLOW_STUB !== '1') {
+      throw new Error(MISSING_SECRET_MESSAGE)
+    }
+    missingSecret = true
+    for (const output of [NODE_SOURCE, NODE_HEADER]) {
+      if (fs.existsSync(output)) fs.unlinkSync(output)
+    }
+    // Keep a complete existing tree only when its stamp still matches this
+    // bundleId — deployPatches can rewrite applicationId after a prior stub.
+    if (outputsExist() && readStampBundleId() === mobileBundleId) {
+      console.log(
+        'warn: apiSecret missing; keeping existing EdgeApiSecret outputs'
+      )
+      return
+    }
+    if (outputsExist()) {
+      console.log(
+        'warn: apiSecret missing; bundleId changed since last generate — regenerating stub'
+      )
+    } else if (anyOutputsExist()) {
+      console.log(
+        'warn: apiSecret missing; regenerating incomplete EdgeApiSecret outputs as stub'
+      )
+    }
+    // First-time compile stub only — do not pair a real apiKey with secret 00.
+    apiKey = API_KEY_PLACEHOLDER
+    secretHex = '00'
+    console.log(
+      'warn: apiSecret missing; emitting mobile stub and skipping Node signer'
+    )
+  } else if (apiKey === API_KEY_PLACEHOLDER) {
+    // A real secret with no apiKey would sign correctly while advertising the
+    // placeholder in Authorization / getApiKey — refuse that pairing.
+    throw new Error(
+      'edgeKey.json apiKey missing while apiSecret is present. ' +
+        'Copy edgeKey.example.json to edgeKey.json and fill in both fields.'
+    )
+  }
+
+  // Skip rewrite when inputs unchanged so random shards do not force native rebuilds.
+  // The generator's own source is an input: editing the emitted C must
+  // invalidate outputs that are otherwise byte-identical in their inputs.
+  const inputStamp = createHash('sha256')
+    .update(apiKey, 'utf8')
+    .update('\0')
+    .update(secretHex, 'utf8')
+    .update('\0')
+    .update(mobileBundleId, 'utf8')
+    .update('\0')
+    .update(nodeBundleId, 'utf8')
+    .update('\0')
+    .update(fs.readFileSync(__filename))
+    .digest('hex')
+  if (
+    outputsExist() &&
+    (missingSecret ||
+      (fs.existsSync(NODE_SOURCE) && fs.existsSync(NODE_HEADER))) &&
+    fs.existsSync(STAMP_PATH) &&
+    fs.readFileSync(STAMP_PATH, 'utf8').split('\n')[0].trim() === inputStamp
+  ) {
+    console.log('makeApiSigner: inputs unchanged, skipping rewrite')
+    return
+  }
+
+  const secret = parseHexSecret(secretHex)
+  const mobileSource = makeSource(apiKey, secret, mobileBundleId)
+  const nodeSource = makeSource(apiKey, secret, nodeBundleId)
+  const header = makeHeader()
+
+  writeFile(OUTPUT_PATHS.iosSource, mobileSource)
+  writeFile(OUTPUT_PATHS.iosHeader, header)
+  writeFile(OUTPUT_PATHS.androidSource, mobileSource)
+  writeFile(OUTPUT_PATHS.androidHeader, header)
+
+  if (!missingSecret) {
+    writeFile(NODE_SOURCE, nodeSource)
+    writeFile(NODE_HEADER, makeNodeHeader(nodeBundleId))
+  }
+
+  fs.writeFileSync(STAMP_PATH, `${inputStamp}\n${mobileBundleId}\n`)
+
+  // Stub embeds the placeholder apiKey; rewrite EdgeApiKey immediately so a
+  // later makeNativeHeaders keep-existing pass cannot leave a prior real key.
+  if (apiKey === API_KEY_PLACEHOLDER) {
+    // Dynamic require avoids a load-time cycle (makeNativeHeaders imports us).
+    require('./makeNativeHeaders').writeStubEdgeApiKeyHeaders()
+  }
+}
+
+// Importing this module (secretFiles.ts reuses MAX_SECRET_LEN) must not
+// generate anything.
+if (require.main === module) {
+  try {
+    main()
+  } catch (e) {
+    console.error(e)
+    process.exit(1)
+  }
+}
diff --git a/scripts/makeNativeHeaders.ts b/scripts/makeNativeHeaders.ts
index 76441b5e1b5..b8e2bb87860 100644
--- a/scripts/makeNativeHeaders.ts
+++ b/scripts/makeNativeHeaders.ts
@@ -1,48 +1,125 @@
 import fs from 'fs'
 import path from 'path'
 
-function makeNativeHeaders() {
-  // Grab the API key:
-  let apiKey = 'Error: Set up env.json & re-run scripts/makeNativeHeaders.js'
-  try {
-    apiKey = require('../env.json').EDGE_API_KEY
-  } catch (e) {
-    console.log(apiKey)
+import {
+  API_KEY_PLACEHOLDER,
+  readEmbeddedSignerApiKey,
+  signerOutputsExist
+} from './makeApiSigner'
+
+function writeEdgeApiKeyFiles(apiKey: string): void {
+  // Same printable-ASCII rule as makeApiSigner: quotes/backslashes would break
+  // the Swift/Java string literals below if we only JSON-escaped for C.
+  if (!/^[\x20-\x7e]+$/.test(apiKey)) {
+    throw new Error('edgeKey.json apiKey must be printable ASCII')
   }
+  const escapedApiKey = apiKey.replace(/\\/g, '\\\\').replace(/"/g, '\\"')
 
-  // Grab the push notification server:
   let pushServer = 'https://push2.edge.app'
   try {
-    pushServer = require('../src/theme/appConfig.js').notificationServers[0]
-  } catch (e) {}
+    const servers = require('../src/theme/appConfig.js').notificationServers
+    if (typeof servers?.[0] === 'string') pushServer = servers[0]
+  } catch (error: unknown) {
+    console.error('makeNativeHeaders: notificationServers', error)
+  }
+  const escapedPushServer = pushServer
+    .replace(/\\/g, '\\\\')
+    .replace(/"/g, '\\"')
 
   const iosPath = path.join(__dirname, '../ios/EdgeApiKey.swift')
-  const iosSource = `/* auto-generated by scripts/makeNativeHeaders.js */
+  fs.writeFileSync(
+    iosPath,
+    `/* auto-generated by scripts/makeNativeHeaders.ts */
 
 public class EdgeApiKey {
-  public static let apiKey = "${apiKey}"
-  public static let pushServer = "${pushServer}"
+  public static let apiKey = "${escapedApiKey}"
+  public static let pushServer = "${escapedPushServer}"
 }
 `
-  fs.writeFileSync(iosPath, iosSource)
+  )
 
   const androidPath = path.join(
     __dirname,
     '../android/app/src/main/java/co/edgesecure/app/EdgeApiKey.java'
   )
-  const androidSource = `/* auto-generated by scripts/makeNativeHeaders.js */
+  fs.writeFileSync(
+    androidPath,
+    `/* auto-generated by scripts/makeNativeHeaders.ts */
 package co.edgesecure.app;
 
 public class EdgeApiKey {
-  public static final String apiKey = "${apiKey}";
-  public static final String pushServer = "${pushServer}";
+  public static final String apiKey = "${escapedApiKey}";
+  public static final String pushServer = "${escapedPushServer}";
 }
 `
-  fs.writeFileSync(androidPath, androidSource)
+  )
 }
 
-try {
-  makeNativeHeaders()
-} catch (e) {
-  console.log(e)
+/**
+ * Called from makeApiSigner when it emits a stub: EdgeApiKey must advertise
+ * the same placeholder the C sources embed, even if older headers exist.
+ */
+export function writeStubEdgeApiKeyHeaders(): void {
+  writeEdgeApiKeyFiles(API_KEY_PLACEHOLDER)
+  console.log('wrote EdgeApiKey.swift/java stub apiKey (lockstep with signer)')
+}
+
+function makeNativeHeaders(): void {
+  // Match makeApiSigner stub policy: never pair a real public apiKey with a
+  // missing apiSecret, or EdgeCore push and EdgeApiSigner login disagree.
+  let apiKey = API_KEY_PLACEHOLDER
+  let hasSecret = false
+  try {
+    const edgeKey = require('../edgeKey.json')
+    hasSecret =
+      typeof edgeKey.apiSecret === 'string' && edgeKey.apiSecret !== ''
+    const hasKey = typeof edgeKey.apiKey === 'string' && edgeKey.apiKey !== ''
+    if (hasSecret && hasKey) apiKey = edgeKey.apiKey
+    else console.log(apiKey)
+  } catch (error: unknown) {
+    const err = error as { code?: string; message?: string }
+    const missing =
+      err.code === 'MODULE_NOT_FOUND' &&
+      String(err.message).includes('edgeKey.json')
+    if (!missing) throw error
+    console.log(apiKey)
+  }
+
+  const iosPath = path.join(__dirname, '../ios/EdgeApiKey.swift')
+  const androidPath = path.join(
+    __dirname,
+    '../android/app/src/main/java/co/edgesecure/app/EdgeApiKey.java'
+  )
+  // When the signer kept a complete tree, sync EdgeApiKey from the embedded
+  // C apiKey whenever either header is missing — never invent the placeholder
+  // while native login still exposes a real edge_api_key().
+  if (!hasSecret && signerOutputsExist()) {
+    const iosExists = fs.existsSync(iosPath)
+    const androidExists = fs.existsSync(androidPath)
+    if (iosExists && androidExists) {
+      console.log(
+        'warn: apiSecret missing; keeping existing EdgeApiKey.swift/java'
+      )
+      return
+    }
+    const embedded = readEmbeddedSignerApiKey()
+    if (embedded != null) {
+      console.log(
+        'warn: apiSecret missing; restoring EdgeApiKey from embedded signer apiKey'
+      )
+      writeEdgeApiKeyFiles(embedded)
+      return
+    }
+  }
+
+  writeEdgeApiKeyFiles(apiKey)
+}
+
+if (require.main === module) {
+  try {
+    makeNativeHeaders()
+  } catch (error: unknown) {
+    console.error(error)
+    process.exit(1)
+  }
 }
diff --git a/scripts/obfuscateString.ts b/scripts/obfuscateString.ts
deleted file mode 100644
index 962269fb50a..00000000000
--- a/scripts/obfuscateString.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-// Generates the obfuscated char-code array to paste into env.json for
-// fields cleaned by asObfuscatedString.
-//
-// Usage:
-//   node -r sucrase/register scripts/obfuscateString.ts <plaintext...>
-
-import { wasObfuscatedString } from '../src/util/cleaners/asObfuscatedString'
-
-const plaintext = process.argv.slice(2).join(' ')
-
-if (plaintext === '') {
-  console.error('Usage: obfuscateString.ts <plaintext>')
-  process.exit(1)
-}
-
-console.log(JSON.stringify(wasObfuscatedString(plaintext)))
diff --git a/scripts/patchFiles.ts b/scripts/patchFiles.ts
index f3e3de93797..1a754d0a2ec 100644
--- a/scripts/patchFiles.ts
+++ b/scripts/patchFiles.ts
@@ -9,12 +9,12 @@ const _rootProjectDir = join(__dirname, '../')
 
 let _currentPath = __dirname
 
-main().catch(error => {
+main().catch((error: unknown) => {
   console.error(error)
   process.exit(1)
 })
 
-async function main() {
+async function main(): Promise<void> {
   if (argv.length < 4) {
     mylog('Usage: node -r sucrase/register patchFiles.ts [project] [branch]')
     mylog('  project options: edge')
@@ -39,7 +39,7 @@ async function main() {
   }
 
   // Patch native files for Sentry
-  const env = require('../env.json')
+  const keys = require('../keys.json')
   const sentryFiles = [
     './android/sentry.properties',
     './ios/sentry.properties',
@@ -52,20 +52,20 @@ async function main() {
     await searchReplace(
       file,
       'SENTRY_MAP_UPLOAD_URL',
-      env.SENTRY_MAP_UPLOAD_URL
+      keys.SENTRY_MAP_UPLOAD_URL
     )
-    await searchReplace(file, 'SENTRY_DSN_URL', env.SENTRY_DSN_URL)
+    await searchReplace(file, 'SENTRY_DSN_URL', keys.SENTRY_DSN_URL)
     await searchReplace(
       file,
       'SENTRY_MAP_UPLOAD_AUTH_TOKEN',
-      env.SENTRY_MAP_UPLOAD_AUTH_TOKEN
+      keys.SENTRY_MAP_UPLOAD_AUTH_TOKEN
     )
     await searchReplace(
       file,
       'SENTRY_ORGANIZATION_SLUG',
-      env.SENTRY_ORGANIZATION_SLUG
+      keys.SENTRY_ORGANIZATION_SLUG
     )
-    await searchReplace(file, 'SENTRY_PROJECT_SLUG', env.SENTRY_PROJECT_SLUG)
+    await searchReplace(file, 'SENTRY_PROJECT_SLUG', keys.SENTRY_PROJECT_SLUG)
   }
 }
 
@@ -80,12 +80,12 @@ export async function searchReplace(
   fs.writeFileSync(file, newText, { encoding: 'utf8' })
 }
 
-function chdir(path: string) {
+function chdir(path: string): void {
   console.log('chdir: ' + path)
   _currentPath = path
 }
 
-function call(cmdstring: string) {
+function call(cmdstring: string): void {
   console.log('call: ' + cmdstring)
   childProcess.execSync(cmdstring, {
     encoding: 'utf8',
diff --git a/scripts/prepare.sh b/scripts/prepare.sh
index c833a6fb434..d5b9358f4d3 100755
--- a/scripts/prepare.sh
+++ b/scripts/prepare.sh
@@ -7,7 +7,7 @@
 set -e
 cd "$(dirname "$0")/.."
 
-# Assemble the env.json config file:
+# Assemble the config.json config file:
 node -r sucrase/register ./scripts/configure.ts
 
 ## Fix broken packages:
@@ -18,7 +18,13 @@ npx patch-package
 # that were later renamed by Google.
 npx jetify
 
-# Copy the API key to native code:
+# Generate XOR-split API secret C sources for native HMAC signing, then copy
+# the public apiKey into EdgeApiKey.swift/java. Order matters: makeApiSigner
+# may force a stub placeholder when apiSecret is missing, and makeNativeHeaders
+# must write the same public key EdgeApiSigner will advertise.
+# Stub allowed here so `npm ci` / prepare can run before secretFiles lands edgeKey.json;
+# Android/iOS generate tasks re-run without this flag once the real secret is present.
+EDGE_API_SIGNER_ALLOW_STUB=1 node -r sucrase/register ./scripts/makeApiSigner.ts
 node -r sucrase/register ./scripts/makeNativeHeaders.ts
 
 # Copy Firebase configs
@@ -33,5 +39,11 @@ fi
 node ./node_modules/.bin/rollup -c
 node -r sucrase/register ./scripts/stringifyBridge.ts
 
+# Regenerate the API reference and the CLI's command table and help text
+# from the route declarations. All are committed, so a fresh clone works
+# without this; the writes are skipped when nothing changed, so prepare never
+# dirties git.
+npm run docs:api
+
 # Create contract type definitions:
 npm run typechain
diff --git a/scripts/publishCli.ts b/scripts/publishCli.ts
new file mode 100644
index 00000000000..a2b66c7d5ec
--- /dev/null
+++ b/scripts/publishCli.ts
@@ -0,0 +1,9 @@
+/**
+ * Placeholder for CLI npm publish. The full publish pipeline is not wired in
+ * this branch yet; `npm run publish:cli` builds artifacts then lands here.
+ */
+console.error(
+  'publishCli.ts is not implemented on this branch yet.\n' +
+    'Built artifacts are in lib/ after `npm run build:cli`.'
+)
+process.exit(1)
diff --git a/scripts/runCliFullReview.sh b/scripts/runCliFullReview.sh
new file mode 100755
index 00000000000..8be19f066b1
--- /dev/null
+++ b/scripts/runCliFullReview.sh
@@ -0,0 +1,267 @@
+#!/usr/bin/env bash
+# Full Edge CLI review log — every command + response for human review.
+# Always uses tester servers (-t). Never production.
+set -u
+set -o pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$ROOT"
+
+LOG_DIR="$HOME/.cursor/logs"
+mkdir -p "$LOG_DIR"
+STAMP=$(date +%Y%m%d-%H%M%S)
+LOG="$LOG_DIR/edgeCliFullReview-${STAMP}.log"
+TMP=$(mktemp -d /tmp/edge-cli-review-XXXXXX)
+USER="review$(openssl rand -hex 3)"
+PASS="Pass$(openssl rand -hex 4)!r1"
+PIN="1357"
+
+CLI=(node -r sucrase/register src/cli/index.ts -t -d "$TMP" --no-spawn --solve-captcha)
+
+exec > >(tee -a "$LOG") 2>&1
+
+echo "================================================================"
+echo "Edge CLI full review log"
+echo "Started: $(date -Iseconds)"
+echo "Log file: $LOG"
+echo "Work dir: $TMP"
+echo "Test user: $USER"
+echo "Branch: $(git rev-parse --abbrev-ref HEAD) @ $(git rev-parse --short HEAD)"
+echo "================================================================"
+echo
+echo "\$ echo LOG_PATH"
+echo "$LOG"
+echo
+
+section() {
+  echo
+  echo "----------------------------------------------------------------"
+  echo "## $1"
+  echo "----------------------------------------------------------------"
+}
+
+run() {
+  local label="$1"
+  shift
+  echo
+  echo "\$ ${CLI[*]} $*"
+  echo "---"
+  set +e
+  "${CLI[@]}" "$@"
+  local code=$?
+  set -e
+  echo "---"
+  echo "exit=$code  ($label)"
+  return 0
+}
+
+# --- Start engine ---
+section "Start engine (tester servers, TCP 9008)"
+pkill -f "src/cli/engine/index.ts" 2>/dev/null || true
+sleep 1
+node -r sucrase/register src/cli/engine/index.ts -t -d "$TMP" --tcp=9008 --idle-timeout=600 \
+  >/tmp/edge-engine-review.out 2>/tmp/edge-engine-review.err &
+ENG_PID=$!
+echo "engine pid=$ENG_PID"
+for i in $(seq 1 60); do
+  if grep -q Ready /tmp/edge-engine-review.err 2>/dev/null; then break; fi
+  sleep 1
+done
+echo
+echo "\$ cat /tmp/edge-engine-review.err"
+cat /tmp/edge-engine-review.err
+SOCK=$(sed -n 's/.*unix:\(.*\)$/\1/p' /tmp/edge-engine-review.err | tail -1)
+echo
+echo "socket=$SOCK"
+
+# --- Engine / context ---
+section "Engine & context"
+run engine-status engine-status
+run engine-config engine-config
+run local-users local-users
+run fetch-challenge fetch-challenge
+run fetch-login-messages fetch-login-messages
+echo
+echo "\$ curl --unix-socket \$SOCK http://localhost/currency-configs"
+curl -s --unix-socket "$SOCK" http://localhost/currency-configs | head -c 2000
+echo
+echo "..."
+
+# --- Account create + login (CAPTCHA) ---
+section "Account create (CAPTCHA) + credential logins"
+run create-account create-account "$USER" --password="$PASS" --pin="$PIN"
+run account-info account-info
+run get-login-key get-login-key
+run engine-sessions engine-sessions
+run touch touch
+
+# Logout and password login again
+run logout logout
+run login-with-password login-with-password "$USER" --password="$PASS"
+
+# PIN login (after logout)
+run logout logout
+run login-with-pin login-with-pin "$USER" --pin="$PIN"
+
+# Account key login
+KEY=$(node -r sucrase/register src/cli/index.ts -t -d "$TMP" --no-spawn get-login-key 2>/dev/null | tail -1 | tr -d '"' | tr -d '[:space:]')
+# get-login-key returns JSON { loginKey: "..." } typically
+LOGIN_KEY=$(node -r sucrase/register -e "
+const {execSync}=require('child_process');
+const out=execSync('node -r sucrase/register src/cli/index.ts -t -d $TMP --no-spawn get-login-key',{encoding:'utf8'});
+try { const j=JSON.parse(out); console.log(j.loginKey||j); } catch { console.log(out.trim()); }
+" 2>/dev/null | tail -1)
+echo
+echo "# extracted loginKey=$LOGIN_KEY"
+run logout logout
+if [ -n "$LOGIN_KEY" ] && [ "$LOGIN_KEY" != "undefined" ]; then
+  run login-with-key login-with-key "$USER" --login-key="$LOGIN_KEY"
+else
+  echo "# SKIP login-with-key (could not extract loginKey)"
+  run login-with-password login-with-password "$USER" --password="$PASS"
+fi
+
+# --- Username / availability ---
+section "Username helpers"
+run account-available-taken username-available "$USER"
+run account-available-free username-available "${USER}zz_nope"
+run local-users local-users
+
+# --- OTP / password / pin / recovery ---
+section "OTP, password, PIN, recovery"
+run otp-key otp-key
+run enable-otp enable-otp
+run otp-status-2 otp-key
+run disable-otp disable-otp
+run change-pin change-pin --pin=2468
+run change-password change-password --password="${PASS}x"
+# restore password for later
+run password-setup-restore change-password --password="$PASS"
+run change-recovery change-recovery --question="What is your favorite color?" --answer=blue --question="What is your pet name?" --answer=fluffy
+
+# --- Wallets ---
+section "Wallets"
+run create-currency-wallet create-currency-wallet wallet:bitcoin --name="Review BTC"
+WALLET_JSON=$(node -r sucrase/register src/cli/index.ts -t -d "$TMP" --no-spawn currency-wallets 2>/dev/null)
+echo
+echo "# currency-wallets raw for id extraction:"
+echo "$WALLET_JSON"
+WID=$(node -r sucrase/register -e "
+const {execSync}=require('child_process');
+const out=execSync('node -r sucrase/register src/cli/index.ts -t -d $TMP --no-spawn currency-wallets',{encoding:'utf8'});
+const j=JSON.parse(out);
+const w=(j.wallets||j)[0];
+console.log(w.walletId||w.id||'');
+" 2>/dev/null | tail -1)
+echo "# walletId=$WID"
+
+run currency-wallets currency-wallets
+if [ -n "$WID" ]; then
+  run wallet-info wallet-info "$WID"
+  run rename-wallet rename-wallet "$WID" --name="Renamed BTC"
+  run balance-map balance-map "$WID"
+  run get-addresses get-addresses "$WID"
+  run get-transactions get-transactions "$WID"
+  run wallet-tokens wallet-tokens "$WID"
+  run wallet-tokens wallet-tokens "$WID"
+  run get-display-public-key get-display-public-key "$WID"
+  # dry-run spend / max — may fail with insufficient funds; still log
+  ADDR=$(node -r sucrase/register -e "
+const {execSync}=require('child_process');
+const out=execSync('node -r sucrase/register src/cli/index.ts -t -d $TMP --no-spawn get-addresses $WID',{encoding:'utf8'});
+const j=JSON.parse(out);
+console.log(j.publicAddress||j.segwitAddress||Object.values(j).find(v=>typeof v==='string'&&v.length>10)||'');
+" 2>/dev/null | tail -1)
+  echo "# receive get-addresses for dry-run=$ADDR"
+  if [ -n "$ADDR" ]; then
+    run get-max-spendable get-max-spendable "$WID" --to="$ADDR"
+    run spend-dry spend "$WID" --to="$ADDR" --native-amount=1000 --dry-run
+    run spend-max-dry spend-max "$WID" --to="$ADDR" --dry-run
+  fi
+  run all-keys all-keys
+  run get-raw-private-key get-raw-private-key "$WID"
+  run wallet-state-archive change-wallet-states "$WID" --archived=true
+  run wallet-state-unarchive change-wallet-states "$WID" --archived=false
+fi
+
+# --- Data store ---
+section "Data store"
+run set-item set-item reviewStore --item-id=item1 --value="hello-cli-review"
+run list-store-ids list-store-ids
+run data-store-list-items list-store-ids reviewStore
+run get-item get-item reviewStore --item-id=item1
+run delete-item delete-item reviewStore --item-id=item1
+
+# --- Edge login ---
+section "Edge login (request lobbyId)"
+# Run in background-ish: just POST and print, cancel after
+echo
+echo "\$ ${CLI[*]} request-edge-login   # will poll; we use REST instead for controlled log"
+curl -s --unix-socket "$SOCK" -X POST http://localhost/request-edge-login | tee /tmp/edge-pending.json
+echo
+PENDING=$(node -e "const j=require('/tmp/edge-pending.json'); console.log(j.pendingId)")
+LOBBY=$(node -e "const j=require('/tmp/edge-pending.json'); console.log(j.lobbyId)")
+URI=$(node -e "const j=require('/tmp/edge-pending.json'); console.log(j.uri)")
+echo "pendingId=$PENDING lobbyId=$LOBBY uri=$URI"
+echo
+echo "\$ curl --unix-socket \$SOCK GET /request-edge-login/\$PENDING"
+curl -s --unix-socket "$SOCK" "http://localhost/request-edge-login/$PENDING"
+echo
+# Approve from same logged-in session via CLI lobby commands
+run fetch-lobby fetch-lobby "$LOBBY"
+run approve-login-request approve-login-request "$LOBBY"
+echo
+echo "\$ curl --unix-socket \$SOCK GET /request-edge-login/\$PENDING (after approve)"
+sleep 2
+curl -s --unix-socket "$SOCK" "http://localhost/request-edge-login/$PENDING"
+echo
+
+# --- Transport parity ---
+section "Unix vs TCP parity"
+echo
+echo "\$ curl --unix-socket \$SOCK http://localhost/engine/status"
+curl -s --unix-socket "$SOCK" http://localhost/engine/status
+echo
+echo
+echo "\$ curl http://127.0.0.1:9008/engine/status"
+curl -s http://127.0.0.1:9008/engine/status
+echo
+
+# --- Help ---
+section "Help"
+run help help
+run help-wallet help create-currency-wallet
+
+# --- Automated suites ---
+section "Automated suite: testCliCaptcha"
+set +e
+node -r sucrase/register scripts/testCliCaptcha.ts
+echo "exit=$?"
+set -e
+
+section "Automated suite: testEdgeLogin"
+set +e
+node -r sucrase/register scripts/testEdgeLogin.ts
+echo "exit=$?"
+set -e
+
+section "Automated suite: testCli (oneshot)"
+set +e
+node -r sucrase/register scripts/testCli.ts
+echo "exit=$?"
+set -e
+
+# --- Cleanup ---
+section "Cleanup"
+run logout logout
+echo
+echo "\$ kill engine $ENG_PID"
+kill "$ENG_PID" 2>/dev/null || true
+sleep 1
+rm -rf "$TMP"
+
+echo
+echo "================================================================"
+echo "Review complete: $(date -Iseconds)"
+echo "Full log: $LOG"
+echo "================================================================"
diff --git a/scripts/runCliFullReviewRaw.sh b/scripts/runCliFullReviewRaw.sh
new file mode 100755
index 00000000000..17c8ae1e7c5
--- /dev/null
+++ b/scripts/runCliFullReviewRaw.sh
@@ -0,0 +1,251 @@
+#!/usr/bin/env bash
+# Full Edge CLI suite with raw command/response logging only.
+# Always uses tester servers (-t). Never production.
+# First CLI command auto-spawns the engine; later commands reuse it.
+set -u
+set -o pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$ROOT"
+
+LOG_DIR="$HOME/.cursor/logs"
+mkdir -p "$LOG_DIR"
+STAMP=$(date +%Y%m%d-%H%M%S)
+LOG="$LOG_DIR/edgeCliFullReviewRaw-${STAMP}.log"
+: >"$LOG"
+TMP=$(mktemp -d /tmp/edge-cli-review-XXXXXX)
+USER="review$(openssl rand -hex 3)"
+PASS="Pass$(openssl rand -hex 4)!r1"
+PIN="1357"
+META="$TMP/meta"
+mkdir -p "$META"
+
+# No --no-spawn: first command must auto-start the engine.
+CLI=(node -r sucrase/register src/cli/index.ts -t -d "$TMP" --solve-captcha --tcp=9008)
+
+ensure_nl() {
+  if [[ ! -s "$LOG" ]]; then return 0; fi
+  local last
+  last=$(tail -c1 "$LOG" | od -An -tx1 | tr -d ' \n')
+  if [[ "$last" != "0a" ]]; then
+    printf '\n' >>"$LOG"
+  fi
+}
+
+run() {
+  local line="" a
+  ensure_nl
+  for a in "$@"; do
+    line+=$(printf '%q' "$a")
+    line+=' '
+  done
+  printf '%s\n' "${line% }" >>"$LOG"
+  set +e
+  "$@" >>"$LOG" 2>&1
+  set -e
+  ensure_nl
+  return 0
+}
+
+run_capture() {
+  local out="$1"
+  shift
+  local line="" a
+  ensure_nl
+  for a in "$@"; do
+    line+=$(printf '%q' "$a")
+    line+=' '
+  done
+  printf '%s\n' "${line% }" >>"$LOG"
+  set +e
+  "$@" >"$out" 2>"$META/run.err"
+  local code=$?
+  cat "$out" >>"$LOG"
+  cat "$META/run.err" >>"$LOG"
+  set -e
+  ensure_nl
+  return 0
+}
+
+silent_capture() {
+  local out="$1"
+  shift
+  set +e
+  "$@" >"$out" 2>/dev/null
+  set -e
+  return 0
+}
+
+# Ensure no prior engine is running for a clean auto-spawn.
+pkill -f "src/cli/engine/index.ts" 2>/dev/null || true
+sleep 1
+
+# --- Engine / context (first command auto-spawns) ---
+run_capture "$META/status.json" "${CLI[@]}" engine-status
+SOCK=$(node -e '
+try {
+  const j=JSON.parse(require("fs").readFileSync(process.argv[1],"utf8"));
+  process.stdout.write(String(j.socketPath||""));
+} catch { process.stdout.write(""); }
+' "$META/status.json")
+
+run "${CLI[@]}" engine-config
+run "${CLI[@]}" local-users
+run "${CLI[@]}" fetch-challenge
+run "${CLI[@]}" fetch-login-messages
+if [ -n "$SOCK" ]; then
+  run curl -s --unix-socket "$SOCK" http://localhost/currency-configs
+fi
+
+# --- Account create + login ---
+run "${CLI[@]}" create-account "$USER" --password="$PASS" --pin="$PIN"
+run "${CLI[@]}" account-info
+run "${CLI[@]}" get-login-key
+run "${CLI[@]}" engine-sessions
+run "${CLI[@]}" touch
+
+run "${CLI[@]}" logout
+run "${CLI[@]}" login-with-password "$USER" --password="$PASS"
+
+run "${CLI[@]}" logout
+run "${CLI[@]}" login-with-pin "$USER" --pin="$PIN"
+
+silent_capture "$META/account-key.json" "${CLI[@]}" get-login-key
+LOGIN_KEY=$(node -e '
+const fs=require("fs");
+try {
+  const j=JSON.parse(fs.readFileSync(process.argv[1],"utf8"));
+  process.stdout.write(String(j.loginKey||""));
+} catch { process.stdout.write(""); }
+' "$META/account-key.json")
+
+run "${CLI[@]}" logout
+if [ -n "$LOGIN_KEY" ]; then
+  run "${CLI[@]}" login-with-key "$USER" --login-key="$LOGIN_KEY"
+else
+  run "${CLI[@]}" login-with-password "$USER" --password="$PASS"
+fi
+
+run "${CLI[@]}" username-available "$USER"
+run "${CLI[@]}" username-available "${USER}zz_nope"
+run "${CLI[@]}" local-users
+
+run "${CLI[@]}" otp-key
+run "${CLI[@]}" enable-otp
+run "${CLI[@]}" otp-key
+run "${CLI[@]}" disable-otp
+run "${CLI[@]}" change-pin --pin=2468
+run "${CLI[@]}" change-password --password="${PASS}x"
+run "${CLI[@]}" change-password --password="$PASS"
+run "${CLI[@]}" change-recovery --question="What is your favorite color?" --answer=blue --question="What is your pet name?" --answer=fluffy
+
+# --- Wallets ---
+run "${CLI[@]}" create-currency-wallet wallet:bitcoin --name="Review BTC"
+silent_capture "$META/wallet-list.json" "${CLI[@]}" currency-wallets
+WID=$(node -e '
+const fs=require("fs");
+try {
+  const j=JSON.parse(fs.readFileSync(process.argv[1],"utf8"));
+  const w=(j.wallets||j)[0];
+  process.stdout.write(String(w.walletId||w.id||""));
+} catch { process.stdout.write(""); }
+' "$META/wallet-list.json")
+
+run "${CLI[@]}" currency-wallets
+if [ -n "$WID" ]; then
+  run "${CLI[@]}" wallet-info "$WID"
+  run "${CLI[@]}" rename-wallet "$WID" --name="Renamed BTC"
+  run "${CLI[@]}" balance-map "$WID"
+  run "${CLI[@]}" get-addresses "$WID"
+  run "${CLI[@]}" get-transactions "$WID"
+  run "${CLI[@]}" wallet-tokens "$WID"
+  run "${CLI[@]}" wallet-tokens "$WID"
+  run "${CLI[@]}" get-display-public-key "$WID"
+
+  silent_capture "$META/address.json" "${CLI[@]}" get-addresses "$WID"
+  ADDR=$(node -e '
+const fs=require("fs");
+try {
+  const j=JSON.parse(fs.readFileSync(process.argv[1],"utf8"));
+  const walk=v=>{
+    if(v==null)return "";
+    if(typeof v==="string"&&(v.startsWith("bc1")||v.startsWith("1")||v.startsWith("3")||v.startsWith("bitcoincash:")))return v;
+    if(Array.isArray(v)){for(const x of v){const r=walk(x);if(r)return r}}
+    if(typeof v==="object"){
+      if(typeof v.publicAddress==="string")return v.publicAddress;
+      if(typeof v.segwitAddress==="string")return v.segwitAddress;
+      for(const x of Object.values(v)){const r=walk(x);if(r)return r}
+    }
+    return "";
+  };
+  process.stdout.write(walk(j));
+} catch { process.stdout.write(""); }
+' "$META/address.json")
+
+  if [ -n "$ADDR" ]; then
+    run "${CLI[@]}" get-max-spendable "$WID" --to="$ADDR"
+    run "${CLI[@]}" spend "$WID" --to="$ADDR" --native-amount=1000 --dry-run
+    # Staged spend handle path (make → object-get → object-delete)
+    run_capture "$META/make-spend.json" "${CLI[@]}" make-spend "$WID" --to="$ADDR" --native-amount=1000
+    OID=$(node -e '
+try {
+  const j=JSON.parse(require("fs").readFileSync(process.argv[1],"utf8"));
+  process.stdout.write(String(j.objectId||""));
+} catch { process.stdout.write(""); }
+' "$META/make-spend.json")
+    if [ -n "$OID" ]; then
+      run "${CLI[@]}" object-get "$OID"
+      run "${CLI[@]}" object-delete "$OID"
+    fi
+    run "${CLI[@]}" spend-max "$WID" --to="$ADDR" --dry-run
+  fi
+  run "${CLI[@]}" all-keys
+  run "${CLI[@]}" get-raw-private-key "$WID"
+  run "${CLI[@]}" change-wallet-states "$WID" --archived=true
+  run "${CLI[@]}" change-wallet-states "$WID" --archived=false
+fi
+
+# --- Data store ---
+run "${CLI[@]}" set-item reviewStore --item-id=item1 --value="hello-cli-review"
+run "${CLI[@]}" list-store-ids
+run "${CLI[@]}" list-store-ids reviewStore
+run "${CLI[@]}" get-item reviewStore --item-id=item1
+run "${CLI[@]}" delete-item reviewStore --item-id=item1
+
+# --- Edge login via REST ---
+if [ -n "$SOCK" ]; then
+  run_capture "$META/edge-pending.json" curl -s --unix-socket "$SOCK" -X POST http://localhost/request-edge-login
+  PENDING=$(node -e 'const j=JSON.parse(require("fs").readFileSync(process.argv[1],"utf8")); process.stdout.write(String(j.pendingId||j.objectId||""))' "$META/edge-pending.json")
+  LOBBY=$(node -e 'const j=JSON.parse(require("fs").readFileSync(process.argv[1],"utf8")); process.stdout.write(String(j.lobbyId||""))' "$META/edge-pending.json")
+
+  if [ -n "$PENDING" ]; then
+    run curl -s --unix-socket "$SOCK" "http://localhost/request-edge-login/$PENDING"
+  fi
+  if [ -n "$LOBBY" ]; then
+    run "${CLI[@]}" fetch-lobby "$LOBBY"
+    run "${CLI[@]}" approve-login-request "$LOBBY"
+    sleep 2
+    run curl -s --unix-socket "$SOCK" "http://localhost/request-edge-login/$PENDING"
+  fi
+
+  run curl -s --unix-socket "$SOCK" http://localhost/engine/status
+fi
+run curl -s http://127.0.0.1:9008/engine/status
+
+# --- Help ---
+run "${CLI[@]}" help
+run "${CLI[@]}" help create-currency-wallet
+
+# --- Stop this review's engine so automated suites can spawn their own ---
+run "${CLI[@]}" logout
+run "${CLI[@]}" engine-stop
+pkill -f "src/cli/engine/index.ts" 2>/dev/null || true
+sleep 1
+
+# --- Automated suites (each starts its own engine via auto-spawn / explicit start) ---
+run node -r sucrase/register scripts/testCliCaptcha.ts
+run node -r sucrase/register scripts/testEdgeLogin.ts
+run node -r sucrase/register scripts/testCli.ts
+
+rm -rf "$TMP"
+printf '%s\n' "$LOG" >&2
diff --git a/scripts/runCliSwapQuotesRaw.sh b/scripts/runCliSwapQuotesRaw.sh
new file mode 100755
index 00000000000..eb4f54968e9
--- /dev/null
+++ b/scripts/runCliSwapQuotesRaw.sh
@@ -0,0 +1,151 @@
+#!/usr/bin/env bash
+# Raw CLI suite: BTC→ETH swap quotes (~$90) for all enabled exchange plugins.
+# Source wallet must be the funded persistent BTC wallet.
+set -u
+set -o pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$ROOT"
+
+LOG_DIR="$HOME/.cursor/logs"
+mkdir -p "$LOG_DIR"
+STAMP=$(date +%Y%m%d-%H%M%S)
+LOG="$LOG_DIR/edgeCliSwapQuotesRaw-${STAMP}.log"
+: >"$LOG"
+
+PERSIST="$HOME/.edge-cli/persistent-test"
+ACCT="$PERSIST/ACCOUNT.md"
+USER=$(awk -F'[`]' '/Username/{print $2; exit}' "$ACCT")
+PASS=$(awk -F'[`]' '/Password/{print $2; exit}' "$ACCT")
+CLI=(node -r sucrase/register src/cli/index.ts -t -d "$PERSIST" --solve-captcha)
+
+ensure_nl() {
+  if [[ ! -s "$LOG" ]]; then return 0; fi
+  local last
+  last=$(tail -c1 "$LOG" | od -An -tx1 | tr -d ' \n')
+  if [[ "$last" != "0a" ]]; then printf '\n' >>"$LOG"; fi
+}
+
+run() {
+  local line="" a
+  ensure_nl
+  for a in "$@"; do
+    line+=$(printf '%q' "$a")
+    line+=' '
+  done
+  printf '%s\n' "${line% }" >>"$LOG"
+  set +e
+  "$@" >>"$LOG" 2>&1
+  set -e
+  ensure_nl
+  return 0
+}
+
+run_capture() {
+  local out="$1"
+  shift
+  local line="" a
+  ensure_nl
+  for a in "$@"; do
+    line+=$(printf '%q' "$a")
+    line+=' '
+  done
+  printf '%s\n' "${line% }" >>"$LOG"
+  set +e
+  "$@" >"$out" 2>"$out.err"
+  cat "$out" >>"$LOG"
+  cat "$out.err" >>"$LOG"
+  set -e
+  ensure_nl
+  return 0
+}
+
+pkill -f "src/cli/engine/index.ts" 2>/dev/null || true
+sleep 1
+
+META=$(mktemp -d /tmp/edge-cli-swap-XXXXXX)
+
+run_capture "$META/login.json" "${CLI[@]}" login-with-password "$USER" --password="$PASS"
+run_capture "$META/wallets.json" "${CLI[@]}" currency-wallets
+
+BTC_ID=$(node -e '
+const j=JSON.parse(require("fs").readFileSync(process.argv[1],"utf8"));
+const w=(j.wallets||[]).find(x=>x.type==="wallet:bitcoin");
+process.stdout.write(w?w.walletId:"");
+' "$META/wallets.json")
+ETH_ID=$(node -e '
+const j=JSON.parse(require("fs").readFileSync(process.argv[1],"utf8"));
+const w=(j.wallets||[]).find(x=>x.type==="wallet:ethereum");
+process.stdout.write(w?w.walletId:"");
+' "$META/wallets.json")
+
+run "${CLI[@]}" balance-map "$BTC_ID"
+run "${CLI[@]}" balance-map "$ETH_ID"
+
+# $90 of BTC as source (quoteFor=from)
+run_capture "$META/rate-from.json" "${CLI[@]}" rates-usd-to-native --usd-amount=90 --plugin-id=bitcoin
+NATIVE_FROM=$(node -e 'const j=JSON.parse(require("fs").readFileSync(process.argv[1],"utf8")); process.stdout.write(String(j.nativeAmount||""))' "$META/rate-from.json")
+
+# $90 of ETH as destination (quoteFor=to / reverse)
+run_capture "$META/rate-to.json" "${CLI[@]}" rates-usd-to-native --usd-amount=90 --plugin-id=ethereum
+NATIVE_TO=$(node -e 'const j=JSON.parse(require("fs").readFileSync(process.argv[1],"utf8")); process.stdout.write(String(j.nativeAmount||""))' "$META/rate-to.json")
+
+# Also show $500 conversion (as requested for sizing context)
+run "${CLI[@]}" rates-usd-to-native --usd-amount=500 --plugin-id=bitcoin
+run "${CLI[@]}" rates-usd-to-native --usd-amount=500 --plugin-id=ethereum
+
+PLUGINS=(changehero changenow exolix godex letsexchange swapuz rango thorchain swapkit sideshift lifi)
+
+# Forward quotes: spend ~$90 BTC → ETH
+for p in "${PLUGINS[@]}"; do
+  run_capture "$META/q-from-$p.json" "${CLI[@]}" fetch-swap-quotes --from-wallet-id="$BTC_ID" --to-wallet-id="$ETH_ID" --native-amount="$NATIVE_FROM" --quote-for=from --plugin-id="$p"
+  OID=$(node -e '
+try {
+  const j=JSON.parse(require("fs").readFileSync(process.argv[1],"utf8"));
+  const q=(j.quotes||[])[0];
+  process.stdout.write(q&&q.objectId?q.objectId:"");
+} catch { process.stdout.write(""); }
+' "$META/q-from-$p.json")
+  if [ -n "$OID" ]; then
+    run "${CLI[@]}" swap-quote-get "$OID"
+    run "${CLI[@]}" close-swap-quote "$OID"
+  fi
+done
+
+# Reverse quotes: receive ~$90 ETH, source BTC
+for p in "${PLUGINS[@]}"; do
+  run_capture "$META/q-to-$p.json" "${CLI[@]}" fetch-swap-quotes --from-wallet-id="$BTC_ID" --to-wallet-id="$ETH_ID" --native-amount="$NATIVE_TO" --quote-for=to --plugin-id="$p"
+  OID=$(node -e '
+try {
+  const j=JSON.parse(require("fs").readFileSync(process.argv[1],"utf8"));
+  const q=(j.quotes||[])[0];
+  process.stdout.write(q&&q.objectId?q.objectId:"");
+} catch { process.stdout.write(""); }
+' "$META/q-to-$p.json")
+  if [ -n "$OID" ]; then
+    run "${CLI[@]}" close-swap-quote "$OID"
+  fi
+done
+
+# All providers at once (no preferPluginId)
+run_capture "$META/q-all-from.json" "${CLI[@]}" fetch-swap-quotes --from-wallet-id="$BTC_ID" --to-wallet-id="$ETH_ID" --native-amount="$NATIVE_FROM" --quote-for=from
+# Close any returned handles
+node -e '
+const fs=require("fs");
+const {execSync}=require("child_process");
+try {
+  const j=JSON.parse(fs.readFileSync(process.argv[1],"utf8"));
+  for (const q of j.quotes||[]) {
+    if (!q.objectId) continue;
+    try {
+      execSync("node -r sucrase/register src/cli/index.ts -t -d "+JSON.stringify(process.env.HOME+"/.edge-cli/persistent-test")+" --solve-captcha close-swap-quote "+q.objectId, {stdio:"ignore"});
+    } catch {}
+  }
+} catch {}
+' "$META/q-all-from.json"
+
+run "${CLI[@]}" logout
+run "${CLI[@]}" engine-stop
+
+printf '%s\n' "$LOG" >&2
+rm -rf "$META"
diff --git a/scripts/secretFiles.ts b/scripts/secretFiles.ts
index 7ac5f044693..17884d4b980 100644
--- a/scripts/secretFiles.ts
+++ b/scripts/secretFiles.ts
@@ -3,6 +3,8 @@ import fs from 'fs'
 import { copySync } from 'fs-extra'
 import { join } from 'path'
 
+import { MAX_SECRET_LEN } from './makeApiSigner'
+
 const argv = process.argv
 const mylog = console.log
 
@@ -12,15 +14,19 @@ let _currentPath = __dirname
 const baseDir = join(_currentPath, '..')
 const githubSshKey = process.env.GITHUB_SSH_KEY ?? join(baseDir, 'id_github')
 
+const REQUIRED_FILES = ['config.json', 'keys.json'] as const
+
 const filePaths = [
   { file: 'deploy-config.json', path: './' },
-  { file: 'env.json', path: './' },
+  { file: 'config.json', path: './' },
+  { file: 'keys.json', path: './' },
+  { file: 'edgeKey.json', path: './' },
   { file: 'fastlane.json', path: './' },
   { file: 'GoogleService-Info.plist', path: './ios/edge/' },
   { file: 'google-services.json', path: './android/app/' }
 ]
 
-async function main() {
+async function main(): Promise<void> {
   if (argv.length < 4) {
     mylog(
       'Usage: node -r sucrase/register secretFiles.ts [branch] [secret files path]'
@@ -47,7 +53,7 @@ async function main() {
   if (repoBranch.length < 3) throw new Error(`Invalid branch ${repoBranch}`)
   if (filesDir.length < 3) throw new Error(`Invalid filesDir ${filesDir}`)
 
-  const copyFiles = (branch: string) => {
+  const copyFiles = (branch: string): void => {
     filePaths.forEach(filePath => {
       const src = join(filesDir, branch, filePath.file)
       const dest = join(_rootProjectDir, filePath.path, filePath.file)
@@ -66,32 +72,78 @@ async function main() {
   if (repoBranch !== 'master') {
     copyFiles(repoBranch)
   }
+
+  const missing = REQUIRED_FILES.filter(
+    file => !fs.existsSync(join(_rootProjectDir, file))
+  )
+  if (missing.length > 0) {
+    throw new Error(
+      `Required secret file(s) missing after copy: ${missing.join(', ')}`
+    )
+  }
+
+  // edgeKey.json is required for native HMAC codegen after this step.
+  const edgeKeyDest = join(_rootProjectDir, 'edgeKey.json')
+  if (!fs.existsSync(edgeKeyDest)) {
+    const searched =
+      repoBranch === 'master' ? 'master' : `master, ${repoBranch}`
+    throw new Error(
+      `edgeKey.json missing after secretFiles copy (expected under ${filesDir}/{${searched}}/)`
+    )
+  }
+  let edgeKey: { apiKey?: unknown; apiSecret?: unknown }
+  try {
+    edgeKey = JSON.parse(fs.readFileSync(edgeKeyDest, 'utf8'))
+  } catch (error: unknown) {
+    throw new Error(
+      `edgeKey.json is not valid JSON: ${
+        error instanceof Error ? error.message : String(error)
+      }`
+    )
+  }
+  if (typeof edgeKey.apiKey !== 'string' || edgeKey.apiKey === '') {
+    throw new Error('edgeKey.json apiKey must be a non-empty string')
+  }
+  if (typeof edgeKey.apiSecret !== 'string' || edgeKey.apiSecret === '') {
+    throw new Error('edgeKey.json apiSecret must be a non-empty hex string')
+  }
+  const secretHex = edgeKey.apiSecret.replace(/^0x/i, '').trim()
+  if (!/^[0-9a-fA-F]+$/.test(secretHex) || secretHex.length % 2 !== 0) {
+    throw new Error('edgeKey.json apiSecret must be even-length hex')
+  }
+  const secretBytes = secretHex.length / 2
+  if (secretBytes > MAX_SECRET_LEN) {
+    throw new Error(
+      `edgeKey.json apiSecret must be 1..${MAX_SECRET_LEN} bytes (got ${secretBytes})`
+    )
+  }
 }
 
 // Copies a file if it exists and overwrites destination
-function quietCopy(src: string, dest: string) {
+function quietCopy(src: string, dest: string): void {
   if (fs.existsSync(src)) {
     console.log(`Copying ${src} > ${dest}`)
     fs.copyFileSync(src, dest)
   }
 }
 
-function chdir(path: string) {
+function chdir(path: string): void {
   console.log('chdir: ' + path)
   _currentPath = path
 }
 
-function call(cmdstring: string) {
+function call(cmdstring: string): void {
   console.log('call: ' + cmdstring)
   childProcess.execSync(cmdstring, {
     encoding: 'utf8',
     timeout: 3600000,
+    killSignal: 'SIGKILL',
     stdio: 'inherit',
-    cwd: _currentPath,
-    killSignal: 'SIGKILL'
+    cwd: _currentPath
   })
 }
 
-main().catch(e => {
-  console.log(e.message)
+main().catch((e: unknown) => {
+  console.error(e instanceof Error ? e.message : String(e))
+  process.exit(1)
 })
diff --git a/scripts/slimKeysJson.ts b/scripts/slimKeysJson.ts
new file mode 100644
index 00000000000..37c49c180cd
--- /dev/null
+++ b/scripts/slimKeysJson.ts
@@ -0,0 +1,69 @@
+/**
+ * Reduce a full `keys.json` to the local-only secrets a build needs before the
+ * remote signed infoRollup `appKeys` fetch can run. Everything else is dropped, because
+ * the info server supplies it at boot.
+ *
+ * The keep-list is imported from `src/localOnlyKeys.ts`, the same inventory
+ * `keysStore` uses to strip overlays, so a build that omitted them would have
+ * no way to get them back.
+ *
+ * Usage:
+ *   node -r sucrase/register scripts/slimKeysJson.ts <in.json> <out.json>
+ *
+ * Never prints secret values - only field names.
+ */
+
+import fs from 'fs'
+
+import { LOCAL_ONLY_PREFIXES, LOCAL_ONLY_TOP_LEVEL } from '../src/localOnlyKeys'
+
+const KEEP_FIELDS = new Set<string>(LOCAL_ONLY_TOP_LEVEL)
+const KEEP_PREFIXES: readonly string[] = LOCAL_ONLY_PREFIXES
+
+export function slimKeys(keys: Record<string, unknown>): {
+  slim: Record<string, unknown>
+  kept: string[]
+  dropped: string[]
+} {
+  const slim: Record<string, unknown> = {}
+  const kept: string[] = []
+  const dropped: string[] = []
+  for (const [field, value] of Object.entries(keys)) {
+    const keep =
+      KEEP_FIELDS.has(field) ||
+      KEEP_PREFIXES.some(prefix => field.startsWith(prefix))
+    if (keep) {
+      slim[field] = value
+      kept.push(field)
+    } else dropped.push(field)
+  }
+  return { slim, kept, dropped }
+}
+
+function main(): void {
+  const [inPath, outPath] = process.argv.slice(2)
+  if (inPath == null || outPath == null) {
+    console.error(
+      'Usage: node -r sucrase/register scripts/slimKeysJson.ts <in.json> <out.json>'
+    )
+    process.exit(1)
+  }
+  const keys = JSON.parse(fs.readFileSync(inPath, 'utf8'))
+  const { slim, kept, dropped } = slimKeys(keys)
+
+  const missing = [...KEEP_FIELDS].filter(field => !(field in slim))
+  if (missing.length > 0) {
+    console.warn(
+      `WARNING: keep-list fields absent from input: ${missing.join(', ')}`
+    )
+  }
+
+  fs.writeFileSync(outPath, JSON.stringify(slim, null, 2) + '\n', {
+    mode: 0o600
+  })
+  console.log(`kept (${kept.length}): ${kept.sort().join(', ')}`)
+  console.log(`dropped (${dropped.length}): ${dropped.sort().join(', ')}`)
+  console.log(`wrote ${outPath}`)
+}
+
+if (require.main === module) main()
diff --git a/scripts/splitBakedAndServerKeys.js b/scripts/splitBakedAndServerKeys.js
new file mode 100644
index 00000000000..aec8fec0abb
--- /dev/null
+++ b/scripts/splitBakedAndServerKeys.js
@@ -0,0 +1,119 @@
+#!/usr/bin/env node
+/**
+ * After `split-env-json`, split a full `keys.json` into:
+ *   - baked `keys.json` — local-only secrets (same keep-list as slimKeysJson)
+ *   - `appKeys.json` — Couch / infoRollup payload (plugin maps + globalKeys)
+ *
+ * Usage:
+ *   node -r sucrase/register scripts/splitBakedAndServerKeys.js [dir]
+ *
+ * Never prints secret values.
+ */
+
+const fs = require('fs')
+const path = require('path')
+
+const { slimKeys } = require('./slimKeysJson')
+
+const PLUGIN_MAPS = ['corePlugins', 'swapPlugins', 'guiApiKeys', 'rampPlugins']
+const GLOBAL_KEY_NAMES = [
+  'AZTECO_API_KEY',
+  'COINGECKO_API_KEY',
+  'IP_API_KEY',
+  'STAKEKIT_API_KEY',
+  'UNSTOPPABLE_DOMAINS_API_KEY',
+  'WALLETCONNECT_PROJECT_ID',
+  'KILN_TESTNET_API_KEY',
+  'KILN_TESTNET_ACCOUNT_ID',
+  'KILN_MAINNET_API_KEY',
+  'KILN_MAINNET_ACCOUNT_ID'
+]
+const NEVER_SERVE_TOP = new Set([
+  'EDGE_API_KEY',
+  'EDGE_API_SECRET',
+  'BUGSNAG_API_KEY',
+  'POSTHOG_API_KEY'
+])
+const NEVER_SERVE_PREFIXES = ['YOLO_', 'SENTRY_']
+
+const isPlainObject = v =>
+  v != null && typeof v === 'object' && !Array.isArray(v)
+
+const isNeverServed = key =>
+  NEVER_SERVE_TOP.has(key) || NEVER_SERVE_PREFIXES.some(p => key.startsWith(p))
+
+function main() {
+  const dir = path.resolve(process.argv[2] ?? '.')
+  const keysPath = path.join(dir, 'keys.json')
+  const serverPath = path.join(dir, 'appKeys.json')
+
+  if (!fs.existsSync(keysPath)) {
+    console.error(`keys.json not found: ${keysPath}`)
+    process.exit(1)
+  }
+
+  const keys = JSON.parse(fs.readFileSync(keysPath, 'utf8'))
+  if (!isPlainObject(keys)) {
+    console.error('keys.json is not an object')
+    process.exit(1)
+  }
+
+  const server = {}
+  const mapCounts = {}
+  for (const mapName of PLUGIN_MAPS) {
+    const src = isPlainObject(keys[mapName]) ? keys[mapName] : {}
+    const out = {}
+    let objects = 0
+    let flags = 0
+    for (const [id, value] of Object.entries(src)) {
+      if (id === 'posthog' && mapName === 'guiApiKeys') continue
+      if (isPlainObject(value) || Array.isArray(value)) {
+        out[id] = value
+        objects++
+      } else {
+        flags++
+      }
+    }
+    server[mapName] = out
+    mapCounts[mapName] = {
+      ids: Object.keys(out).length,
+      objects,
+      flagsSkipped: flags
+    }
+  }
+
+  const globalKeys = {}
+  if (isPlainObject(keys.globalKeys)) {
+    for (const [k, v] of Object.entries(keys.globalKeys)) {
+      if (isNeverServed(k)) continue
+      globalKeys[k] = v
+    }
+  }
+  for (const [k, v] of Object.entries(keys)) {
+    if (PLUGIN_MAPS.includes(k) || k === 'globalKeys') continue
+    if (isNeverServed(k)) continue
+    const named = GLOBAL_KEY_NAMES.includes(k) || k.startsWith('KILN_')
+    const leftoverPartner = typeof v === 'string'
+    if (named || leftoverPartner) globalKeys[k] = v
+  }
+  server.globalKeys = globalKeys
+
+  const { slim, kept, dropped } = slimKeys(keys)
+  fs.writeFileSync(keysPath, JSON.stringify(slim, null, 2) + '\n', {
+    mode: 0o600
+  })
+  fs.writeFileSync(serverPath, JSON.stringify(server, null, 2) + '\n', {
+    mode: 0o600
+  })
+
+  console.log(`server maps ${JSON.stringify(mapCounts)}`)
+  console.log(
+    `server globalKeys ids ${Object.keys(globalKeys).sort().join(',')}`
+  )
+  console.log(`baked kept (${kept.length}): ${kept.sort().join(', ')}`)
+  console.log(`baked dropped (${dropped.length}): ${dropped.sort().join(', ')}`)
+  console.log(`wrote ${keysPath}`)
+  console.log(`wrote ${serverPath}`)
+}
+
+if (require.main === module) main()
diff --git a/scripts/splitEnvJson.ts b/scripts/splitEnvJson.ts
new file mode 100644
index 00000000000..931f5e5d8eb
--- /dev/null
+++ b/scripts/splitEnvJson.ts
@@ -0,0 +1,542 @@
+/**
+ * Split a legacy `env.json` into `config.json` (non-secret), `keys.json`
+ * (secret) and `edgeKey.json` (`EDGE_API_KEY` / `EDGE_API_SECRET`, rewritten as
+ * `{apiKey, apiSecret}` for the native HMAC codegen). Classification lives
+ * here with the CLI — it is migration-only and is not part of the app runtime.
+ *
+ * Usage:
+ *   socket npm run split-env-json
+ *   socket npm run split-env-json -- --force
+ *   socket npm run split-env-json -- path/to/env.json
+ *   socket npm run split-env-json -- --force path/to/env.json outDir/
+ *
+ * Never prints secret values. Refuses to overwrite existing outputs unless
+ * `--force` is passed.
+ */
+
+import { asMap, asUnknown } from 'cleaners'
+import fs from 'fs'
+import path from 'path'
+
+import { deepMerge, isPlainObject } from '../src/configKeysMerge'
+
+const asUnknownMap = asMap(asUnknown)
+
+/** Legacy `*_INIT` field name -> edge-core currency plugin ID. */
+export const CURRENCY_INIT_MAP: Record<string, string> = {
+  ABSTRACT_INIT: 'abstract',
+  ALGORAND_INIT: 'algorand',
+  AMOY_INIT: 'amoy',
+  ARBITRUM_INIT: 'arbitrum',
+  AVALANCHE_INIT: 'avalanche',
+  AXELAR_INIT: 'axelar',
+  BASE_INIT: 'base',
+  BINANCE_SMART_CHAIN_INIT: 'binancesmartchain',
+  BOTANIX_INIT: 'botanix',
+  CARDANO_INIT: 'cardano',
+  CARDANO_TESTNET_INIT: 'cardanotestnet',
+  MAYACHAIN_INIT: 'mayachain',
+  CELO_INIT: 'celo',
+  COREUM_INIT: 'coreum',
+  COSMOSHUB_INIT: 'cosmoshub',
+  ECASH_INIT: 'ecash',
+  ETHEREUM_INIT: 'ethereum',
+  ETHEREUM_POW_INIT: 'ethereumpow',
+  FANTOM_INIT: 'fantom',
+  FILECOIN_INIT: 'filecoin',
+  FILECOINFEVM_INIT: 'filecoinfevm',
+  FILECOINFEVM_CALIBRATION_INIT: 'filecoinfevmcalibration',
+  FIO_INIT: 'fio',
+  HEDERA_INIT: 'hedera',
+  HOLESKY_INIT: 'holesky',
+  HYPEREVM_INIT: 'hyperevm',
+  LIBERLAND_INIT: 'liberland',
+  OPBNB_INIT: 'opbnb',
+  MONAD_INIT: 'monad',
+  MONERO_INIT: 'monero',
+  NYM_INIT: 'nym',
+  OPTIMISM_INIT: 'optimism',
+  OSMOSIS_INIT: 'osmosis',
+  POLKADOT_INIT: 'polkadot',
+  POLYGON_INIT: 'polygon',
+  PULSECHAIN_INIT: 'pulsechain',
+  RSK_INIT: 'rsk',
+  SEPOLIA_INIT: 'sepolia',
+  SOLANA_INIT: 'solana',
+  SONIC_INIT: 'sonic',
+  THORCHAIN_INIT: 'thorchainrune',
+  TON_INIT: 'ton',
+  ZKSYNC_INIT: 'zksync',
+  BITCOIN_INIT: 'bitcoin',
+  BITCOINCASH_INIT: 'bitcoincash',
+  DASH_INIT: 'dash',
+  DIGIBYTE_INIT: 'digibyte',
+  DOGE_INIT: 'dogecoin',
+  GROESTLCOIN_INIT: 'groestlcoin',
+  LITECOIN_INIT: 'litecoin',
+  PIVX_INIT: 'pivx',
+  ZCOIN_INIT: 'zcoin'
+}
+
+/** Legacy `*_INIT` field name -> swap plugin ID. */
+export const SWAP_INIT_MAP: Record<string, string> = {
+  CHANGEHERO_INIT: 'changehero',
+  CHANGE_NOW_INIT: 'changenow',
+  CHANGELLY_INIT: 'changelly',
+  EXOLIX_INIT: 'exolix',
+  GODEX_INIT: 'godex',
+  LIFI_INIT: 'lifi',
+  LETSEXCHANGE_INIT: 'letsexchange',
+  NEXCHANGE_INIT: 'nexchange',
+  SIDESHIFT_INIT: 'sideshift',
+  SWAPTER_INIT: 'swapter',
+  SWAPUZ_INIT: 'swapuz',
+  XGRAM_INIT: 'xgram',
+  NYM_SWAP_INIT: 'nymswap',
+  BRIDGELESS_INIT: 'bridgeless',
+  RANGO_INIT: 'rango',
+  MAYA_PROTOCOL_INIT: 'mayaprotocol',
+  THORCHAIN_INIT: 'thorchain',
+  SWAPKIT_INIT: 'swapkit',
+  SWAPKITV3_INIT: 'swapkitv3',
+  TOMB_SWAP_INIT: 'tombSwap',
+  XRPDEX_INIT: 'xrpdex',
+  '0XGASLESS_INIT': '0xgasless'
+}
+
+// Field names (in plugin init objects) that hold secrets and therefore belong
+// in keys.json rather than the committable config.json.
+// Case-insensitive. Prefer generic patterns; name only what the generics miss.
+// `apiKey(?!s)` already covers *ApiKey fields. `tonCenterApiKeys` needs an
+// explicit entry because the `(?!s)` lookahead excludes the trailing `s`.
+// Partner / affiliate identifiers that look "public" still go to keys.json so
+// they can be rotated via signed infoRollup appKeys without a store release.
+const SECRET_FIELD_RE =
+  /(apiKey(?!s)|API_KEY|SECRET|TOKEN|DSN|ACCOUNT_ID|PROJECT_SLUG|ORGANIZATION_SLUG|privateKey|hmacUser|ninerealmsClientId|tonCenterApiKeys|projectId|affiliateId|partnerId|referrerAddress|publicKey|orgId)/i
+
+// Top-level env fields that are secret regardless of their (non-object) value.
+// Loose partner secrets and auth + Sentry all land flat in keys.json; the
+// server delivers the same loose secrets nested under a `globalKeys` section.
+const SECRET_TOP_LEVEL = new Set([
+  'EDGE_API_KEY',
+  'EDGE_API_SECRET',
+  'AIRBITZ_API_KEY',
+  'BUGSNAG_API_KEY',
+  'CMC_PRO_API_KEY'
+])
+const SECRET_TOP_LEVEL_PREFIXES = ['SENTRY_']
+
+/**
+ * Loose partner secrets that are the "global keys": stored flat in keys.json
+ * (not inside a plugin map). The signed infoRollup `appKeys` overlay delivers
+ * the same secrets nested under `globalKeys`.
+ */
+const GLOBAL_KEYS_FIELDS = new Set([
+  'AZTECO_API_KEY',
+  'COINGECKO_API_KEY',
+  'IP_API_KEY',
+  'STAKEKIT_API_KEY',
+  'UNSTOPPABLE_DOMAINS_API_KEY',
+  'WALLETCONNECT_PROJECT_ID',
+  'POSTHOG_API_KEY'
+])
+const GLOBAL_KEYS_PREFIXES = ['KILN_']
+
+/**
+ * Top-level legacy fields to drop entirely on split (neither config nor keys).
+ * Unused leftovers that no runtime code reads.
+ */
+const DROP_TOP_LEVEL = new Set(['ZEC_NODE'])
+
+/**
+ * PLUGIN_API_KEYS providers to drop entirely on split (neither config nor
+ * keys). Retired partners that should not ship in either file.
+ */
+function shouldDropPluginApiKeyProvider(provider: string): boolean {
+  const id = provider.toLowerCase()
+  if (id === 'bity') return true
+  if (id === 'ionia' || id.startsWith('ionia-')) return true
+  if (id === 'kado' || id.startsWith('kado')) return true
+  return false
+}
+
+function isGlobalKeysField(field: string): boolean {
+  if (GLOBAL_KEYS_FIELDS.has(field)) return true
+  return GLOBAL_KEYS_PREFIXES.some(prefix => field.startsWith(prefix))
+}
+
+export function isSecretField(fieldName: string): boolean {
+  return SECRET_FIELD_RE.test(fieldName)
+}
+
+export function isSecretTopLevel(field: string): boolean {
+  if (SECRET_TOP_LEVEL.has(field)) return true
+  if (SECRET_TOP_LEVEL_PREFIXES.some(prefix => field.startsWith(prefix))) {
+    return true
+  }
+  return isSecretField(field)
+}
+
+export interface ConfigFile {
+  [key: string]: unknown
+  corePlugins: Record<string, unknown>
+  swapPlugins: Record<string, unknown>
+  guiApiKeys: Record<string, unknown>
+  rampPlugins: Record<string, unknown>
+}
+
+export interface KeysFile {
+  [key: string]: unknown
+  corePlugins: Record<string, unknown>
+  swapPlugins: Record<string, unknown>
+  guiApiKeys: Record<string, unknown>
+  rampPlugins: Record<string, unknown>
+}
+
+export interface SplitResult {
+  config: ConfigFile
+  keys: KeysFile
+}
+
+/**
+ * Legacy XOR mask used by `asObfuscatedString` (not a secret). A handful of
+ * env.json fields — notably Changelly's apiKey — were stored as char-code
+ * arrays XOR'd with this constant. Decode them to plain strings at split time
+ * so keys.json never carries the array form the plugins cannot consume.
+ */
+const OBFUSCATION_MASK = 0x5a
+
+function isCharCodeArray(value: unknown): value is number[] {
+  return (
+    Array.isArray(value) &&
+    value.length > 0 &&
+    value.every(item => typeof item === 'number')
+  )
+}
+
+function deobfuscateSecret(path: string, value: unknown): unknown {
+  if (!isCharCodeArray(value)) return value
+  const plain = String.fromCharCode(
+    ...value.map(code => code ^ OBFUSCATION_MASK)
+  )
+  console.log(
+    `deobfuscated ${path} (${value.length} codes -> ${plain.length} chars)`
+  )
+  return plain
+}
+
+/**
+ * Classify a legacy plugin init value for the flag-only config model.
+ *
+ * Config only stores enablement: `true` / `false`. The entire init object (or
+ * bare string) lands in keys so signed infoRollup appKeys can rotate every
+ * field. Char-code arrays on secret-named fields are still deobfuscated at
+ * split time.
+ */
+function splitPluginValue(
+  value: unknown,
+  path: string
+): {
+  config: boolean | undefined
+  keys: unknown
+} {
+  if (value === false) return { config: false, keys: undefined }
+  if (value === true) return { config: true, keys: undefined }
+  if (!isPlainObject(value)) {
+    // Bare strings (e.g. moonpay) are keys-only; config stays absent.
+    return { config: undefined, keys: deobfuscateSecret(path, value) }
+  }
+
+  const keysPart: Record<string, unknown> = {}
+  for (const [field, fieldValue] of Object.entries(value)) {
+    keysPart[field] = isSecretField(field)
+      ? deobfuscateSecret(`${path}.${field}`, fieldValue)
+      : fieldValue
+  }
+  // Empty `{}` is still stored in keys so merge(true, {}) === {} (legacy
+  // "enabled with defaults"), rather than collapsing to a bare `true`.
+  return { config: true, keys: keysPart }
+}
+
+function assignKeys(
+  target: Record<string, unknown>,
+  id: string,
+  value: unknown
+): void {
+  if (value === undefined) return
+  if (isPlainObject(value) && isPlainObject(target[id])) {
+    target[id] = deepMerge(target[id], value)
+    return
+  }
+  target[id] = value
+}
+
+/**
+ * Convert a legacy flat `env.json` object into the split `{ config, keys }`
+ * files. Unmapped `*_INIT` fields (and WYRE_CLIENT_INIT) are intentionally
+ * dropped; WALLET_CONNECT_INIT becomes a flat keys.WALLETCONNECT_PROJECT_ID
+ * string (not a plugin); POSTHOG_INIT becomes config.POSTHOG_API_HOST + a
+ * flat keys.POSTHOG_API_KEY; loose partner secrets (Azteco, Kiln, …) land
+ * flat in keys.json; YOLO_* stays in config.
+ *
+ * Plugin maps in config.json are flag-only (`true` / `false`). Init objects
+ * live in the matching keys.json map (`corePlugins`, `swapPlugins`,
+ * `guiApiKeys`, `rampPlugins`).
+ */
+export function splitEnv(legacyEnv: unknown): SplitResult {
+  const env = isPlainObject(legacyEnv) ? legacyEnv : {}
+
+  const config: ConfigFile = {
+    corePlugins: {},
+    swapPlugins: {},
+    guiApiKeys: {},
+    rampPlugins: {}
+  }
+  const keys: KeysFile = {
+    corePlugins: {},
+    swapPlugins: {},
+    guiApiKeys: {},
+    rampPlugins: {}
+  }
+
+  for (const [field, value] of Object.entries(env)) {
+    const coreId = CURRENCY_INIT_MAP[field]
+    const swapId = SWAP_INIT_MAP[field]
+
+    if (coreId != null || swapId != null) {
+      const { config: flag, keys: init } = splitPluginValue(value, field)
+      if (coreId != null) {
+        if (flag !== undefined) config.corePlugins[coreId] = flag
+        assignKeys(keys.corePlugins, coreId, init)
+      }
+      if (swapId != null) {
+        if (flag !== undefined) config.swapPlugins[swapId] = flag
+        assignKeys(keys.swapPlugins, swapId, init)
+      }
+      continue
+    }
+
+    if (field === 'PLUGIN_API_KEYS') {
+      for (const [provider, providerValue] of Object.entries(
+        asUnknownMap(value ?? {})
+      )) {
+        if (shouldDropPluginApiKeyProvider(provider)) continue
+        const path = `PLUGIN_API_KEYS.${provider}`
+        if (provider === 'posthog') {
+          // Legacy: posthog lived under PLUGIN_API_KEYS; promote out of plugins.
+          if (isPlainObject(providerValue)) {
+            if (typeof providerValue.apiHost === 'string') {
+              config.POSTHOG_API_HOST = providerValue.apiHost
+            }
+            if (providerValue.apiKey != null) {
+              keys.POSTHOG_API_KEY = deobfuscateSecret(
+                `${path}.apiKey`,
+                providerValue.apiKey
+              )
+            }
+          }
+          continue
+        }
+        const { config: flag, keys: init } = splitPluginValue(
+          providerValue,
+          path
+        )
+        if (flag !== undefined) config.guiApiKeys[provider] = flag
+        assignKeys(keys.guiApiKeys, provider, init)
+      }
+      continue
+    }
+
+    if (field === 'RAMP_PLUGIN_INITS') {
+      for (const [id, rampValue] of Object.entries(asUnknownMap(value ?? {}))) {
+        const { config: flag, keys: init } = splitPluginValue(
+          rampValue,
+          `RAMP_PLUGIN_INITS.${id}`
+        )
+        // Always record a flag for object/boolean ramps so config lists them.
+        if (flag !== undefined) config.rampPlugins[id] = flag
+        assignKeys(keys.rampPlugins, id, init)
+      }
+      continue
+    }
+
+    if (field === 'POSTHOG_INIT') {
+      // Host stays in config; api key is a flat global key.
+      if (isPlainObject(value)) {
+        if (typeof value.apiHost === 'string') {
+          config.POSTHOG_API_HOST = value.apiHost
+        }
+        if (value.apiKey != null) {
+          keys.POSTHOG_API_KEY = deobfuscateSecret(
+            `${field}.apiKey`,
+            value.apiKey
+          )
+        }
+      }
+      continue
+    }
+
+    if (field === 'WALLET_CONNECT_INIT') {
+      // WalletConnect is not a plugin. Extract projectId as a global key;
+      // disable = omit the key. Never write a config flag or a plugin map entry.
+      if (value === false || value == null) continue
+      if (isPlainObject(value) && value.projectId != null) {
+        keys.WALLETCONNECT_PROJECT_ID = deobfuscateSecret(
+          `${field}.projectId`,
+          value.projectId
+        )
+      }
+      continue
+    }
+
+    // Drop all remaining legacy *_INIT fields (unused plugins, WYRE, etc.).
+    if (field.endsWith('_INIT')) continue
+
+    // Drop unused top-level leftovers (no runtime reader).
+    if (DROP_TOP_LEVEL.has(field)) continue
+
+    // Everything else is a top-level app/debug field.
+    if (isGlobalKeysField(field)) {
+      keys[field] = deobfuscateSecret(field, value)
+      continue
+    }
+    if (isSecretTopLevel(field)) {
+      const plain = deobfuscateSecret(field, value)
+      // Legacy env.json used AIRBITZ_API_KEY; the runtime and HMAC auth read
+      // EDGE_API_KEY. Rename on split so a migrated keys.json is usable.
+      if (field === 'AIRBITZ_API_KEY') {
+        keys.EDGE_API_KEY ??= plain
+        continue
+      }
+      keys[field] = plain
+    } else config[field] = value
+  }
+
+  return { config, keys }
+}
+
+function usage(): never {
+  console.error(`Usage: splitEnvJson.ts [--force] [env.json] [outDir]
+
+Reads a legacy env.json and writes config.json + keys.json (gitignored).
+Defaults: ./env.json -> ./config.json and ./keys.json
+Pass --force to overwrite existing output files.`)
+  process.exit(1)
+}
+
+function parseArgs(argv: string[]): {
+  force: boolean
+  envPath: string
+  outDir: string
+} {
+  let force = false
+  const positional: string[] = []
+  for (const arg of argv) {
+    if (arg === '--force' || arg === '-f') {
+      force = true
+      continue
+    }
+    if (arg === '--help' || arg === '-h') usage()
+    if (arg.startsWith('-')) {
+      console.error(`Unknown flag: ${arg}`)
+      usage()
+    }
+    positional.push(arg)
+  }
+  return {
+    force,
+    envPath: path.resolve(positional[0] ?? 'env.json'),
+    outDir: path.resolve(positional[1] ?? '.')
+  }
+}
+
+function writeJson(filePath: string, value: unknown, force: boolean): void {
+  if (!force && fs.existsSync(filePath)) {
+    console.error(
+      `Refusing to overwrite existing ${filePath} (pass --force to replace)`
+    )
+    process.exit(1)
+  }
+  fs.writeFileSync(filePath, JSON.stringify(value, null, 2) + '\n', {
+    mode: 0o600
+  })
+}
+
+function main(): void {
+  const { force, envPath, outDir } = parseArgs(process.argv.slice(2))
+
+  if (!fs.existsSync(envPath)) {
+    console.error(`env.json not found: ${envPath}`)
+    process.exit(1)
+  }
+
+  let legacyEnv: unknown
+  try {
+    legacyEnv = JSON.parse(fs.readFileSync(envPath, 'utf8'))
+  } catch (error) {
+    console.error(`Failed to parse ${envPath}: ${String(error)}`)
+    process.exit(1)
+  }
+
+  const { config, keys } = splitEnv(legacyEnv)
+
+  // Edge login HMAC credentials belong in edgeKey.json, not keys.json.
+  const edgeKey: { apiKey?: string; apiSecret?: string } = {}
+  if (typeof keys.EDGE_API_KEY === 'string' && keys.EDGE_API_KEY !== '') {
+    edgeKey.apiKey = keys.EDGE_API_KEY
+  }
+  if (typeof keys.EDGE_API_SECRET === 'string' && keys.EDGE_API_SECRET !== '') {
+    edgeKey.apiSecret = keys.EDGE_API_SECRET
+  }
+  delete keys.EDGE_API_KEY
+  delete keys.EDGE_API_SECRET
+
+  fs.mkdirSync(outDir, { recursive: true })
+  const configPath = path.join(outDir, 'config.json')
+  const keysPath = path.join(outDir, 'keys.json')
+  const edgeKeyPath = path.join(outDir, 'edgeKey.json')
+
+  const hasEdgeKey = edgeKey.apiKey != null || edgeKey.apiSecret != null
+
+  writeJson(configPath, config, force)
+  writeJson(keysPath, keys, force)
+  if (hasEdgeKey) writeJson(edgeKeyPath, edgeKey, force)
+
+  const configPluginCounts = {
+    corePlugins: Object.keys(config.corePlugins).length,
+    swapPlugins: Object.keys(config.swapPlugins).length,
+    guiApiKeys: Object.keys(config.guiApiKeys).length,
+    rampPlugins: Object.keys(config.rampPlugins).length
+  }
+  const keysPluginCounts = {
+    corePlugins: Object.keys(keys.corePlugins).length,
+    swapPlugins: Object.keys(keys.swapPlugins).length,
+    guiApiKeys: Object.keys(keys.guiApiKeys).length,
+    rampPlugins: Object.keys(keys.rampPlugins).length
+  }
+
+  // Counts only — never dump field values (keys.json / edgeKey.json are secret).
+  console.log(`Wrote ${configPath}`)
+  console.log(`  plugin map sizes: ${JSON.stringify(configPluginCounts)}`)
+  console.log(`Wrote ${keysPath}`)
+  console.log(`  plugin map sizes: ${JSON.stringify(keysPluginCounts)}`)
+  // Every native build needs a complete edgeKey.json, so say so here rather
+  // than letting the codegen fail much later with no link to this step.
+  if (!hasEdgeKey) {
+    console.log(
+      `No EDGE_API_KEY / EDGE_API_SECRET in the source env.json: ${edgeKeyPath} was not written, and native builds will need it.`
+    )
+  } else {
+    console.log(`Wrote ${edgeKeyPath}`)
+    if (edgeKey.apiKey == null || edgeKey.apiSecret == null) {
+      console.log(
+        '  warning: incomplete — apiKey and apiSecret are both required'
+      )
+    }
+  }
+}
+
+// Only run the CLI when this file is the entry script (tests import helpers).
+if (require.main === module) {
+  main()
+}
diff --git a/scripts/testCli.ts b/scripts/testCli.ts
new file mode 100644
index 00000000000..0c7eb15d4dd
--- /dev/null
+++ b/scripts/testCli.ts
@@ -0,0 +1,393 @@
+/**
+ * End-to-end one-shot tests for the engine-based Edge CLI.
+ * Always uses tester servers (-t). Never hits production.
+ *
+ * Usage: node -r sucrase/register scripts/testCli.ts
+ */
+import { execSync, spawn } from 'child_process'
+import crypto from 'crypto'
+import fs from 'fs'
+import http from 'http'
+import os from 'os'
+import path from 'path'
+
+import { solveCaptcha } from '../src/cli/client/solveCaptcha'
+import { isTesterConfig } from '../src/cli/engine/testerServers'
+
+interface TestResult {
+  name: string
+  status: 'PASS' | 'FAIL' | 'SKIP'
+  durationMs: number
+  detail?: string
+}
+
+const results: TestResult[] = []
+const TMP = fs.mkdtempSync(path.join(os.tmpdir(), 'edge-cli-test-'))
+const TEST_USER = `clieng${crypto.randomBytes(4).toString('hex')}`
+const TEST_PASS = `Pass${crypto.randomBytes(4).toString('hex')}!a1`
+const TEST_PIN = '1234'
+
+function cli(
+  args: string,
+  timeoutMs = 120_000
+): { code: number; stdout: string; stderr: string } {
+  const cmd = `node -r sucrase/register src/cli/index.ts -t -d ${TMP} --no-spawn ${args}`
+  try {
+    const stdout = execSync(cmd, {
+      cwd: process.cwd(),
+      timeout: timeoutMs,
+      encoding: 'utf8',
+      stdio: ['pipe', 'pipe', 'pipe']
+    })
+    return { code: 0, stdout, stderr: '' }
+  } catch (err: unknown) {
+    const error = err as { status?: number; stdout?: string; stderr?: string }
+    return {
+      code: error.status ?? 1,
+      stdout: String(error.stdout ?? ''),
+      stderr: String(error.stderr ?? '')
+    }
+  }
+}
+
+async function unixRequest(
+  socketPath: string,
+  method: string,
+  urlPath: string,
+  body?: unknown
+): Promise<{ status: number; json: any }> {
+  const payload =
+    body === undefined ? undefined : Buffer.from(JSON.stringify(body))
+  return await new Promise((resolve, reject) => {
+    const req = http.request(
+      {
+        method,
+        path: urlPath,
+        socketPath,
+        headers: {
+          Accept: 'application/json',
+          ...(payload != null
+            ? {
+                'Content-Type': 'application/json',
+                'Content-Length': String(payload.length)
+              }
+            : {})
+        }
+      },
+      res => {
+        const chunks: Buffer[] = []
+        res.on('data', c => chunks.push(c))
+        res.on('end', () => {
+          const raw = Buffer.concat(chunks).toString('utf8')
+          let json: any
+          try {
+            json = raw === '' ? undefined : JSON.parse(raw)
+          } catch {
+            json = { raw }
+          }
+          resolve({ status: res.statusCode ?? 0, json })
+        })
+      }
+    )
+    req.on('error', reject)
+    if (payload != null) req.write(payload)
+    req.end()
+  })
+}
+
+function record(
+  name: string,
+  start: number,
+  ok: boolean,
+  detail?: string
+): void {
+  results.push({
+    name,
+    status: ok ? 'PASS' : 'FAIL',
+    durationMs: Date.now() - start,
+    detail
+  })
+  console.log(
+    `${ok ? 'PASS' : 'FAIL'} ${name}${detail != null ? ' — ' + detail : ''}`
+  )
+}
+
+async function main(): Promise<void> {
+  console.log(`Test directory: ${TMP}`)
+  console.log(`Test user: ${TEST_USER}`)
+
+  // Start engine with TCP for parity check
+  const engine = spawn(
+    process.execPath,
+    [
+      '-r',
+      'sucrase/register',
+      'src/cli/engine/index.ts',
+      '-t',
+      '-d',
+      TMP,
+      '--tcp=9008',
+      '--idle-timeout=120'
+    ],
+    { stdio: ['ignore', 'pipe', 'pipe'] }
+  )
+
+  let sock = ''
+  await new Promise<void>((resolve, reject) => {
+    const timer = setTimeout(() => {
+      reject(new Error('engine start timeout'))
+    }, 60_000)
+    engine.stderr?.on('data', (buf: Buffer) => {
+      const line = buf.toString()
+      process.stderr.write(line)
+      const m = /Listening on unix:(.+)/.exec(line)
+      if (m != null) sock = m[1].trim()
+      if (line.includes('[edge-engine] Ready')) {
+        clearTimeout(timer)
+        resolve()
+      }
+    })
+    engine.on('exit', code => {
+      clearTimeout(timer)
+      reject(new Error(`engine exited early: ${code}`))
+    })
+  })
+
+  try {
+    // Config asserts tester servers
+    let start = Date.now()
+    const config = await unixRequest(sock, 'GET', '/engine/config')
+    const okConfig =
+      config.status === 200 &&
+      config.json.testMode === true &&
+      isTesterConfig(config.json.servers)
+    record(
+      'config uses tester servers',
+      start,
+      okConfig,
+      JSON.stringify(config.json.servers)
+    )
+    if (!okConfig) {
+      throw new Error('Refusing to continue — not on tester servers')
+    }
+
+    // Status over unix and TCP must match
+    start = Date.now()
+    const statusUnix = await unixRequest(sock, 'GET', '/engine/status')
+    const statusTcp = await new Promise<{ status: number; json: any }>(
+      (resolve, reject) => {
+        const req = http.request(
+          {
+            method: 'GET',
+            host: '127.0.0.1',
+            port: 9008,
+            path: '/engine/status'
+          },
+          res => {
+            const chunks: Buffer[] = []
+            res.on('data', c => chunks.push(c))
+            res.on('end', () => {
+              resolve({
+                status: res.statusCode ?? 0,
+                json: JSON.parse(Buffer.concat(chunks).toString('utf8'))
+              })
+            })
+          }
+        )
+        req.on('error', reject)
+        req.end()
+      }
+    )
+    record(
+      'unix/tcp status parity',
+      start,
+      statusUnix.status === 200 &&
+        statusTcp.status === 200 &&
+        statusUnix.json.apiVersion === statusTcp.json.apiVersion &&
+        statusUnix.json.pid === statusTcp.json.pid
+    )
+
+    // CLI engine-status
+    start = Date.now()
+    const st = cli('engine-status')
+    record(
+      'cli engine-status',
+      start,
+      st.code === 0 && st.stdout.includes('apiVersion')
+    )
+
+    // Challenge + account create with CAPTCHA
+    start = Date.now()
+    let create = await unixRequest(sock, 'POST', '/create-account', {
+      username: TEST_USER,
+      password: TEST_PASS,
+      pin: TEST_PIN
+    })
+    if (
+      create.status === 403 &&
+      create.json?.error?.code === 'CHALLENGE_REQUIRED'
+    ) {
+      const { challengeId, challengeUri } = create.json.error.details
+      const ok = await solveCaptcha(challengeUri)
+      if (!ok) throw new Error('CAPTCHA solve failed')
+      create = await unixRequest(sock, 'POST', '/create-account', {
+        username: TEST_USER,
+        password: TEST_PASS,
+        pin: TEST_PIN,
+        challengeId
+      })
+    }
+    const sessionId = create.json?.sessionId as string | undefined
+    record(
+      'account create (with captcha retry)',
+      start,
+      create.status === 200 && typeof sessionId === 'string',
+      `status=${create.status} user=${TEST_USER}`
+    )
+
+    if (sessionId == null) {
+      throw new Error('No sessionId — aborting remaining tests')
+    }
+
+    // Persist session for CLI commands
+    fs.writeFileSync(
+      path.join(path.dirname(sock), 'session.json'),
+      JSON.stringify({
+        sessionId,
+        username: TEST_USER,
+        updatedAt: new Date().toISOString()
+      })
+    )
+
+    // Password login (new session), then create a wallet immediately.
+    // The engine must settle the account before returning the session so
+    // this create-account → login → create-wallet path is a first-try success.
+    start = Date.now()
+    await unixRequest(sock, 'POST', `/account/${sessionId}/logout`)
+    let login = await unixRequest(sock, 'POST', '/login-with-password', {
+      username: TEST_USER,
+      password: TEST_PASS
+    })
+    if (
+      login.status === 403 &&
+      login.json?.error?.code === 'CHALLENGE_REQUIRED'
+    ) {
+      const { challengeId, challengeUri } = login.json.error.details
+      await solveCaptcha(challengeUri)
+      login = await unixRequest(sock, 'POST', '/login-with-password', {
+        username: TEST_USER,
+        password: TEST_PASS,
+        challengeId
+      })
+    }
+    const sessionId2 = login.json?.sessionId as string | undefined
+    record(
+      'password login (with captcha retry)',
+      start,
+      login.status === 200 && typeof sessionId2 === 'string'
+    )
+
+    const sid = sessionId2 ?? sessionId
+    fs.writeFileSync(
+      path.join(path.dirname(sock), 'session.json'),
+      JSON.stringify({
+        sessionId: sid,
+        username: TEST_USER,
+        updatedAt: new Date().toISOString()
+      })
+    )
+
+    start = Date.now()
+    const wallet = await unixRequest(
+      sock,
+      'POST',
+      `/account/${sid}/create-currency-wallet`,
+      {
+        walletType: 'wallet:bitcoin',
+        name: 'Test BTC'
+      }
+    )
+    record(
+      'wallet create',
+      start,
+      wallet.status === 200 &&
+        (wallet.json?.walletId != null || wallet.json?.id != null),
+      wallet.json?.walletId ??
+        wallet.json?.id ??
+        `status=${wallet.status} body=${JSON.stringify(wallet.json)}`
+    )
+    const walletId = (wallet.json?.walletId ?? wallet.json?.id) as string
+
+    start = Date.now()
+    const list = cli('currency-wallets --filter=all')
+    record('cli currency-wallets', start, list.code === 0)
+
+    if (walletId != null) {
+      start = Date.now()
+      const info = cli(`wallet-info --wallet-id=${walletId}`)
+      record('cli wallet-info', start, info.code === 0)
+
+      start = Date.now()
+      const bal = cli(`balance-map --wallet-id=${walletId}`)
+      record('cli balance-map', start, bal.code === 0)
+
+      start = Date.now()
+      const addr = cli(`get-addresses --wallet-id=${walletId}`)
+      record('cli get-addresses', start, addr.code === 0)
+    }
+
+    // Session touch
+    start = Date.now()
+    const touch = await unixRequest(sock, 'POST', `/account/${sid}/touch`)
+    record('session touch', start, touch.status === 200)
+
+    // Logout
+    start = Date.now()
+    const logout = await unixRequest(sock, 'POST', `/account/${sid}/logout`)
+    record('logout', start, logout.status === 204 || logout.status === 200)
+
+    // Edge login request returns lobbyId
+    start = Date.now()
+    const edge = await unixRequest(sock, 'POST', '/request-edge-login')
+    record(
+      'request-edge-login returns lobbyId',
+      start,
+      edge.status === 200 &&
+        typeof edge.json?.lobbyId === 'string' &&
+        typeof edge.json?.uri === 'string' &&
+        edge.json.uri.startsWith('edge://edge/'),
+      edge.json?.uri
+    )
+    if (edge.json?.pendingId != null) {
+      await unixRequest(
+        sock,
+        'POST',
+        `/pending-edge-login/${edge.json.pendingId}/cancel-request`
+      )
+    }
+  } finally {
+    engine.kill('SIGTERM')
+    try {
+      fs.rmSync(TMP, { recursive: true, force: true })
+    } catch {
+      // ignore
+    }
+  }
+
+  console.log('\n=== Summary ===')
+  const failed = results.filter(r => r.status === 'FAIL')
+  for (const r of results) {
+    console.log(
+      `${r.status} ${r.name} (${r.durationMs}ms)${
+        r.detail != null ? ' ' + r.detail : ''
+      }`
+    )
+  }
+  console.log(`\n${results.length - failed.length}/${results.length} passed`)
+  if (failed.length > 0) process.exit(1)
+}
+
+main().catch((err: unknown) => {
+  console.error(err)
+  process.exit(1)
+})
diff --git a/scripts/testCliCaptcha.ts b/scripts/testCliCaptcha.ts
new file mode 100644
index 00000000000..b55ae634b60
--- /dev/null
+++ b/scripts/testCliCaptcha.ts
@@ -0,0 +1,163 @@
+/**
+ * Focused CAPTCHA + account create + password login test against login-tester.
+ *
+ * Usage: node -r sucrase/register scripts/testCliCaptcha.ts
+ */
+import { spawn } from 'child_process'
+import crypto from 'crypto'
+import fs from 'fs'
+import http from 'http'
+import os from 'os'
+import path from 'path'
+
+import { solveCaptcha } from '../src/cli/client/solveCaptcha'
+
+const TMP = fs.mkdtempSync(path.join(os.tmpdir(), 'edge-cli-captcha-'))
+const USER = `captcha${crypto.randomBytes(4).toString('hex')}`
+const PASS = `Pass${crypto.randomBytes(4).toString('hex')}!b2`
+const PIN = '4321'
+
+async function req(
+  sock: string,
+  method: string,
+  urlPath: string,
+  body?: unknown
+): Promise<{ status: number; json: any }> {
+  const payload =
+    body === undefined ? undefined : Buffer.from(JSON.stringify(body))
+  return await new Promise((resolve, reject) => {
+    const r = http.request(
+      {
+        method,
+        path: urlPath,
+        socketPath: sock,
+        headers: {
+          Accept: 'application/json',
+          ...(payload != null
+            ? {
+                'Content-Type': 'application/json',
+                'Content-Length': String(payload.length)
+              }
+            : {})
+        }
+      },
+      res => {
+        const chunks: Buffer[] = []
+        res.on('data', c => chunks.push(c))
+        res.on('end', () => {
+          const raw = Buffer.concat(chunks).toString('utf8')
+          resolve({
+            status: res.statusCode ?? 0,
+            json: raw === '' ? undefined : JSON.parse(raw)
+          })
+        })
+      }
+    )
+    r.on('error', reject)
+    if (payload != null) r.write(payload)
+    r.end()
+  })
+}
+
+async function main(): Promise<void> {
+  console.log(`user=${USER} dir=${TMP}`)
+  const engine = spawn(
+    process.execPath,
+    [
+      '-r',
+      'sucrase/register',
+      'src/cli/engine/index.ts',
+      '-t',
+      '-d',
+      TMP,
+      '--idle-timeout=120'
+    ],
+    { stdio: ['ignore', 'pipe', 'pipe'] }
+  )
+  let sock = ''
+  await new Promise<void>((resolve, reject) => {
+    const t = setTimeout(() => {
+      reject(new Error('timeout'))
+    }, 60_000)
+    engine.stderr?.on('data', (b: Buffer) => {
+      const line = b.toString()
+      process.stderr.write(line)
+      const m = /Listening on unix:(.+)/.exec(line)
+      if (m != null) sock = m[1].trim()
+      if (line.includes('Ready')) {
+        clearTimeout(t)
+        resolve()
+      }
+    })
+  })
+
+  try {
+    // Create — expect challenge or success
+    let create = await req(sock, 'POST', '/create-account', {
+      username: USER,
+      password: PASS,
+      pin: PIN
+    })
+    console.log(
+      'create initial status',
+      create.status,
+      create.json?.error?.code
+    )
+    if (create.json?.error?.code === 'CHALLENGE_REQUIRED') {
+      const { challengeId, challengeUri } = create.json.error.details
+      console.log('challengeUri', challengeUri)
+      const ok = await solveCaptcha(challengeUri)
+      console.log('solveCaptcha', ok)
+      if (!ok) throw new Error('CAPTCHA failed')
+      create = await req(sock, 'POST', '/create-account', {
+        username: USER,
+        password: PASS,
+        pin: PIN,
+        challengeId
+      })
+    }
+    if (create.status !== 200) {
+      throw new Error(`create failed: ${JSON.stringify(create.json)}`)
+    }
+    console.log('CREATED session', create.json.sessionId)
+
+    // Logout
+    await req(sock, 'POST', `/account/${create.json.sessionId}/logout`)
+
+    // Login again with captcha path
+    let login = await req(sock, 'POST', '/login-with-password', {
+      username: USER,
+      password: PASS
+    })
+    console.log('login initial status', login.status, login.json?.error?.code)
+    if (login.json?.error?.code === 'CHALLENGE_REQUIRED') {
+      const { challengeId, challengeUri } = login.json.error.details
+      await solveCaptcha(challengeUri)
+      login = await req(sock, 'POST', '/login-with-password', {
+        username: USER,
+        password: PASS,
+        challengeId
+      })
+    }
+    if (login.status !== 200) {
+      throw new Error(`login failed: ${JSON.stringify(login.json)}`)
+    }
+    console.log('LOGGED IN session', login.json.sessionId)
+
+    // Cleanup remote account
+    await req(
+      sock,
+      'POST',
+      `/account/${login.json.sessionId}/delete-remote-account`
+    )
+    console.log('PASS captcha account create + login')
+  } finally {
+    engine.kill('SIGTERM')
+    fs.rmSync(TMP, { recursive: true, force: true })
+  }
+}
+
+main().catch((e: unknown) => {
+  console.error(e)
+  process.exit(1)
+})
diff --git a/scripts/testCliFake.ts b/scripts/testCliFake.ts
new file mode 100644
index 00000000000..da8069d5a5e
--- /dev/null
+++ b/scripts/testCliFake.ts
@@ -0,0 +1,552 @@
+/**
+ * Exercise the CLI against the in-process fake world.
+ *
+ * `makeFakeEdgeWorld` emulates the login, info and sync servers and cuts the
+ * currency plugins off from the network, so every account-shaped command runs
+ * with no server, no API key and no internet. That is what lets these run in a
+ * pre-commit hook, where `testCli.ts` and friends cannot: they need
+ * login-tester.
+ *
+ * Responses are checked against each route's `returns` cleaner in strict mode,
+ * so a shape that drifts from the reference fails here.
+ *
+ *   node -r sucrase/register scripts/testCliFake.ts
+ */
+import { spawnSync } from 'child_process'
+import fs from 'fs'
+import os from 'os'
+import path from 'path'
+
+const DIR = path.join(os.tmpdir(), `edge-cli-fake-${process.pid}`)
+const CLI = ['-r', 'sucrase/register', 'src/cli/index.ts']
+const BASE = ['--fake', `--directory=${DIR}`]
+
+const USER = `faker${process.pid}`
+const PASS = 'y768Mv4PLFupQjMu'
+const PIN = '1111'
+
+let failures = 0
+let passes = 0
+
+interface Run {
+  status: number
+  out: string
+  json: any
+}
+
+function cli(...args: string[]): Run {
+  const result = spawnSync('node', [...CLI, ...BASE, ...args], {
+    encoding: 'utf8',
+    env: { ...process.env, EDGE_CLI_CHECK_RESPONSES: 'strict' }
+  })
+  const out = (result.stdout ?? '') + (result.stderr ?? '')
+  let json: any
+  try {
+    json = JSON.parse(result.stdout ?? '')
+  } catch {
+    json = undefined
+  }
+  return { status: result.status ?? -1, out, json }
+}
+
+/** Run a command and require it to succeed. */
+function ok(label: string, ...args: string[]): Run {
+  const run = cli(...args)
+  // `"error": null` is an ordinary field on a pending login, not a failure.
+  const good = run.status === 0 && !/"error":\s*\{/.test(run.out)
+  if (good) {
+    passes++
+    console.log(`OK   ${label}`)
+  } else {
+    failures++
+    console.error(
+      `FAIL ${label} — ${run.out.replace(/\s+/g, ' ').slice(0, 160)}`
+    )
+  }
+  return run
+}
+
+/** Run a command that is expected to fail, and say why that is correct. */
+function refuses(label: string, code: string, ...args: string[]): void {
+  const run = cli(...args)
+  if (run.status !== 0 && run.out.includes(code)) {
+    passes++
+    console.log(`OK   ${label} (refused with ${code})`)
+  } else {
+    failures++
+    console.error(
+      `FAIL ${label} — expected ${code}, got ${run.out
+        .replace(/\s+/g, ' ')
+        .slice(0, 140)}`
+    )
+  }
+}
+
+/**
+ * A command the fake world cannot serve.
+ *
+ * Asserted rather than skipped, so that if `makeFakeEdgeWorld` ever grows the
+ * missing piece this fails and the check gets promoted to a real one.
+ */
+function notInFakeWorld(
+  label: string,
+  marker: string,
+  ...args: string[]
+): void {
+  const run = cli(...args)
+  if (run.status !== 0 && run.out.includes(marker)) {
+    passes++
+    console.log(`OK   ${label} (fake world cannot serve it yet)`)
+  } else {
+    failures++
+    console.error(
+      `FAIL ${label} — expected the fake world to reject with "${marker}"; ` +
+        `promote this to a real check. Got: ${run.out
+          .replace(/\s+/g, ' ')
+          .slice(0, 140)}`
+    )
+  }
+}
+
+function main(): void {
+  fs.mkdirSync(DIR, { recursive: true })
+  try {
+    ok('engine-status', 'engine-status')
+    ok('engine-config', 'engine-config')
+    ok('engine-sessions', 'engine-sessions')
+    ok('check-password-rules', 'check-password-rules', `--password=${PASS}`)
+    ok('fix-username', 'fix-username', '--username=Mixed Case')
+
+    // ---------------------------------------------------------- account
+    ok(
+      'create-account',
+      'create-account',
+      `--username=${USER}`,
+      `--password=${PASS}`,
+      `--pin=${PIN}`
+    )
+    ok('account-info', 'account-info')
+    ok('local-users', 'local-users')
+    ok('get-login-key', 'get-login-key')
+    ok('touch', 'touch')
+    ok('sync', 'sync')
+    ok('wait-for-all-wallets', 'wait-for-all-wallets')
+    ok('pending-vouchers', 'pending-vouchers')
+    ok('local-settings read', 'local-settings')
+    ok('local-settings write', 'local-settings', '--spam-filter-on=true')
+    ok('help', 'help', 'balance-map')
+
+    // ------------------------------------------------------ credentials
+    ok('check-password', 'check-password', `--password=${PASS}`)
+    ok('get-pin', 'get-pin')
+    ok('check-pin', 'check-pin', `--pin=${PIN}`)
+    ok('change-pin', 'change-pin', '--pin=2222')
+    ok('check-pin after change', 'check-pin', '--pin=2222')
+    // Every login method, each exercised while its credential still exists.
+    const key = ok('get-login-key for re-login', 'get-login-key')
+    ok('logout before login-with-key', 'logout')
+    ok(
+      'login-with-key',
+      'login-with-key',
+      `--username-or-login-id=${USER}`,
+      `--login-key=${String(key.json?.loginKey ?? '')}`
+    )
+    ok('logout before login-with-pin', 'logout')
+    ok(
+      'login-with-pin',
+      'login-with-pin',
+      `--username-or-login-id=${USER}`,
+      '--pin=2222'
+    )
+    ok('delete-pin', 'delete-pin')
+    ok('change-password', 'change-password', '--password=Zq7WmT4rNs2xVb9d')
+    const rec = ok(
+      'change-recovery',
+      'change-recovery',
+      '--question=First pet?',
+      '--answer=rex',
+      '--question=First street?',
+      '--answer=oak'
+    )
+    ok(
+      'fetch-recovery-questions',
+      'fetch-recovery-questions',
+      `--recovery-key=${String(rec.json?.recoveryKey ?? '')}`,
+      `--username=${USER}`
+    )
+    ok('logout before login-with-recovery', 'logout')
+    ok(
+      'login-with-recovery',
+      'login-with-recovery',
+      `--username=${USER}`,
+      `--recovery-key=${String(rec.json?.recoveryKey ?? '')}`,
+      '--answer=rex',
+      '--answer=oak'
+    )
+    ok('delete-recovery', 'delete-recovery')
+
+    // -------------------------------------------------------------- otp
+    ok('otp-key before enabling', 'otp-key')
+    ok('enable-otp', 'enable-otp')
+    const otpKey = ok('otp-key', 'otp-key')
+    ok(
+      'repair-otp',
+      'repair-otp',
+      `--otp-key=${String(otpKey.json?.otpKey ?? '')}`
+    )
+    ok('disable-otp', 'disable-otp')
+
+    // -------------------------------------------------------- data store
+    ok('set-item', 'set-item', '--store-id=probe', '--item-id=a', '--value=1')
+    ok('list-store-ids', 'list-store-ids')
+    ok('list-item-ids', 'list-item-ids', '--store-id=probe')
+    ok('get-item', 'get-item', '--store-id=probe', '--item-id=a')
+    ok('delete-item', 'delete-item', '--store-id=probe', '--item-id=a')
+    ok('delete-store', 'delete-store', '--store-id=probe')
+
+    // ----------------------------------------------------------- wallets
+    const made = ok(
+      'create-currency-wallet',
+      'create-currency-wallet',
+      '--wallet-type=wallet:bitcoin',
+      '--name=Fake BTC'
+    )
+    const walletId: string = made.json?.walletId ?? ''
+    const w = `--wallet-id=${walletId}`
+
+    ok('currency-wallets', 'currency-wallets')
+    ok('wallet-info', 'wallet-info', w)
+    ok('all-keys', 'all-keys')
+    ok('get-wallet-info', 'get-wallet-info', `--id=${walletId}`)
+    ok('get-raw-public-key', 'get-raw-public-key', w)
+    ok('get-raw-private-key', 'get-raw-private-key', w)
+    ok('get-display-public-key', 'get-display-public-key', w)
+    ok('get-display-private-key', 'get-display-private-key', w)
+    ok('list-splittable-wallet-types', 'list-splittable-wallet-types', w)
+    ok('rename-wallet', 'rename-wallet', w, '--name=Renamed')
+    ok(
+      'set-fiat-currency-code',
+      'set-fiat-currency-code',
+      w,
+      '--fiat-currency-code=iso:EUR'
+    )
+    ok('change-paused on', 'change-paused', w, '--paused=true')
+    ok('change-paused off', 'change-paused', w, '--paused=false')
+    ok('change-wallet-states', 'change-wallet-states', w, '--archived=true')
+    ok(
+      'change-wallet-states off',
+      'change-wallet-states',
+      w,
+      '--archived=false'
+    )
+    // The fake world emulates the sync server for account repos, but a wallet
+    // repo still resolves to a real sync-fakeN.edge.app hostname.
+    notInFakeWorld('wallet-sync', 'sync-fake', 'wallet-sync', w)
+    ok('dump-data', 'dump-data', w)
+    ok('balance-map', 'balance-map', w)
+    ok('get-addresses', 'get-addresses', w)
+    ok('wallet-tokens', 'wallet-tokens', w)
+    // `--remove` of a token that is not enabled leaves the set as it is,
+    // which exercises the read-modify-write path without needing a token.
+    ok(
+      'change-enabled-token-ids',
+      'change-enabled-token-ids',
+      w,
+      '--remove=notatoken'
+    )
+    ok('get-num-transactions', 'get-num-transactions', w)
+    ok('get-transactions', 'get-transactions', w)
+    ok(
+      'encode-uri',
+      'encode-uri',
+      w,
+      '--public-address=bc1q0qsagl9n0lrsutam6zncd6vf07rq3mekn3phl7'
+    )
+    ok(
+      'parse-uri',
+      'parse-uri',
+      w,
+      '--uri=bitcoin:bc1q0qsagl9n0lrsutam6zncd6vf07rq3mekn3phl7?amount=0.001'
+    )
+
+    // An empty wallet cannot fund a spend, and saying so is the correct
+    // answer — it proves the spend path runs, not just that it errors.
+    refuses(
+      'make-spend on an empty wallet',
+      'INSUFFICIENT_FUNDS',
+      'make-spend',
+      w,
+      '--to=bc1q0qsagl9n0lrsutam6zncd6vf07rq3mekn3phl7',
+      '--native-amount=100000'
+    )
+
+    // ------------------------------------------------- local / no server
+    ok('currency-configs', 'currency-configs')
+    ok('admin-hash-username', 'admin-hash-username', `--username=${USER}`)
+    ok('create-wallet', 'create-wallet', '--type=wallet:bitcoin')
+    ok(
+      'create-currency-wallets',
+      'create-currency-wallets',
+      '--create-wallets=[{"walletType":"wallet:bitcoin","name":"Batch"}]'
+    )
+    ok('split', 'split', w, '--split-wallets=[]')
+    ok('resync-blockchain', 'resync-blockchain', w)
+    // No transaction exists to annotate, and saying so proves the path runs.
+    refuses(
+      'save-tx-metadata for an unknown txid',
+      'missing tx',
+      'save-tx-metadata',
+      w,
+      '--txid=deadbeef',
+      '--token-id=null',
+      '--metadata={"name":"x"}'
+    )
+    refuses(
+      'save-tx-action for an unknown txid',
+      'missing tx',
+      'save-tx-action',
+      w,
+      '--txid=deadbeef',
+      '--token-id=null',
+      '--saved-action={"actionType":"swap"}'
+    )
+
+    // ------------------------------------------------------ login server
+    ok('fetch-login-messages', 'fetch-login-messages')
+    notInFakeWorld('fetch-challenge', 'Unknown API endpoint', 'fetch-challenge')
+    ok(
+      'change-username',
+      'change-username',
+      `--username=${USER}b`,
+      '--password=Zq7WmT4rNs2xVb9d'
+    )
+    // 2FA was disabled above, so refusing is the correct answer.
+    refuses('cancel-otp-reset with 2FA off', 'not enabled', 'cancel-otp-reset')
+
+    // ------------------------------------------------- object handles
+    const pending = ok('request-edge-login', 'request-edge-login', '--no-wait')
+    const pendingId: string = pending.json?.pendingId ?? ''
+    const lobbyId: string = pending.json?.lobbyId ?? ''
+    ok('poll-edge-login', 'poll-edge-login', pendingId)
+    ok('object-get', 'object-get', pendingId)
+    ok('fetch-lobby', 'fetch-lobby', lobbyId)
+    ok('approve-login-request', 'approve-login-request', lobbyId)
+    ok('cancel-request', 'cancel-request', pendingId)
+
+    // ------------------------------------------------------------ admin
+    const lobby = ok('admin-make-lobby', 'admin-make-lobby')
+    const handle: string = lobby.json?.objectId ?? ''
+    ok(
+      'admin-fetch-lobby-request',
+      'admin-fetch-lobby-request',
+      lobby.json?.lobbyId ?? ''
+    )
+    ok('admin-lobby-handle-delete', 'admin-lobby-handle-delete', handle)
+
+    // ------------------------------------------------- refusals that prove
+    // the path runs even though the fake world cannot fund a wallet
+    ok(
+      'get-max-spendable',
+      'get-max-spendable',
+      w,
+      '--to=bc1q0qsagl9n0lrsutam6zncd6vf07rq3mekn3phl7'
+    )
+    refuses(
+      'sign-tx with an unknown handle',
+      'OBJECT_NOT_FOUND',
+      'sign-tx',
+      'tx_nosuchhandle'
+    )
+    refuses(
+      'broadcast-tx with an unknown handle',
+      'OBJECT_NOT_FOUND',
+      'broadcast-tx',
+      'tx_nosuchhandle'
+    )
+    refuses(
+      'save-tx with an unknown handle',
+      'OBJECT_NOT_FOUND',
+      'save-tx',
+      'tx_nosuchhandle'
+    )
+    refuses(
+      'object-delete with an unknown handle',
+      'OBJECT_NOT_FOUND',
+      'object-delete',
+      'tx_nosuchhandle'
+    )
+    refuses(
+      'swap-quote-get with an unknown handle',
+      'OBJECT_NOT_FOUND',
+      'swap-quote-get',
+      'swap_nosuchhandle'
+    )
+
+    // --------------------------------------------------- signing / admin
+    const addr = ok(
+      'get-addresses for signing',
+      'get-addresses',
+      w,
+      '--token-id=null'
+    )
+    const publicAddress: string = addr.json?.addresses?.[0]?.publicAddress ?? ''
+    ok(
+      'sign-bytes',
+      'sign-bytes',
+      w,
+      '--bytes=aGVsbG8=',
+      `--other-params={"publicAddress":"${publicAddress}"}`
+    )
+    ok(
+      'admin-auth-request',
+      'admin-auth-request',
+      '--method=POST',
+      '--path=/v2/messages',
+      '--body={"loginIds":[]}'
+    )
+
+    // These need state the fake world cannot produce, so the refusal is what
+    // proves the route runs at all.
+    // Core accepts any voucher id without complaint, so success here is the
+    // engine reporting core faithfully, not the voucher having existed.
+    ok('approve-voucher', 'approve-voucher', '--voucher-id=nosuchvoucher')
+    ok('reject-voucher', 'reject-voucher', '--voucher-id=nosuchvoucher')
+    refuses(
+      'request-otp-reset with a bad token',
+      'error',
+      'request-otp-reset',
+      `--username=${USER}b`,
+      '--otp-reset-token=nosuchtoken'
+    )
+    refuses(
+      'admin-repo-get with a bad key',
+      'error',
+      'admin-repo-get',
+      '--sync-key=11111111111111111111',
+      '--data-key=11111111111111111111',
+      '--path=x'
+    )
+    refuses(
+      'admin-repo-list with a bad key',
+      'error',
+      'admin-repo-list',
+      '--sync-key=11111111111111111111',
+      '--data-key=11111111111111111111'
+    )
+    refuses(
+      'admin-repo-set with a bad key',
+      'error',
+      'admin-repo-set',
+      '--sync-key=11111111111111111111',
+      '--data-key=11111111111111111111',
+      '--path=x',
+      '--text=y'
+    )
+    refuses(
+      'admin-repo-delete with a bad key',
+      'error',
+      'admin-repo-delete',
+      '--sync-key=11111111111111111111',
+      '--data-key=11111111111111111111',
+      '--path=x'
+    )
+    refuses(
+      'admin-sync-repo with a bad key',
+      'error',
+      'admin-sync-repo',
+      '--sync-key=11111111111111111111'
+    )
+    refuses(
+      'admin-send-lobby-reply to an unknown lobby',
+      'error',
+      'admin-send-lobby-reply',
+      '--lobby-id=nosuchlobby',
+      '--reply={}'
+    )
+    refuses(
+      'spend on an empty wallet',
+      'error',
+      'spend',
+      w,
+      '--to=bc1q0qsagl9n0lrsutam6zncd6vf07rq3mekn3phl7',
+      '--native-amount=100000'
+    )
+    refuses(
+      'spend-max on an empty wallet',
+      'error',
+      'spend-max',
+      w,
+      '--to=bc1q0qsagl9n0lrsutam6zncd6vf07rq3mekn3phl7'
+    )
+    refuses(
+      'sweep-private-keys with no funds',
+      'error',
+      'sweep-private-keys',
+      w,
+      '--spend-info={"tokenId":null,"privateKeys":["x"]}'
+    )
+    refuses(
+      'accelerate an unknown transaction',
+      'error',
+      'accelerate',
+      w,
+      '--object-id=tx_nosuchhandle'
+    )
+
+    // Rates, swap quotes and payment requests reach third-party APIs over the
+    // real internet, which the fake world does not intercept. They belong to
+    // `npm run test:cli:network`, not to a hook that must work offline.
+    refuses(
+      'approve-swap-quote with an unknown handle',
+      'OBJECT_NOT_FOUND',
+      'approve-swap-quote',
+      'swap_nosuchhandle'
+    )
+    refuses(
+      'close-swap-quote with an unknown handle',
+      'OBJECT_NOT_FOUND',
+      'close-swap-quote',
+      'swap_nosuchhandle'
+    )
+
+    // ------------------------------------------------------------- login
+    ok('logout', 'logout')
+    ok(
+      'login-with-password',
+      'login-with-password',
+      `--username=${USER}b`,
+      '--password=Zq7WmT4rNs2xVb9d'
+    )
+    ok('username-available', 'username-available', `--username=${USER}nobody`)
+    // Core refuses while the account is open, which is the interesting half
+    // of the contract; forgetting it for real would end the session the rest
+    // of this suite still needs.
+    refuses(
+      'forget-account while logged in',
+      'Cannot remove logged-in user',
+      'forget-account',
+      `--root-login-id=${USER}b`
+    )
+
+    // Last, because it leaves the account with no password to log in with.
+    ok('delete-password', 'delete-password')
+
+    // ---------------------------------------------------------- teardown
+    // The fake login server implements no /api/v2/login/delete.
+    notInFakeWorld(
+      'delete-remote-account',
+      'Unknown API endpoint',
+      'delete-remote-account',
+      '--yes'
+    )
+    ok('engine-stop', 'engine-stop')
+  } finally {
+    cli('engine-stop')
+    fs.rmSync(DIR, { recursive: true, force: true })
+  }
+
+  console.log(`\ntestCliFake: ${passes} passed, ${failures} failed`)
+  if (failures > 0) process.exit(1)
+}
+
+main()
diff --git a/scripts/testCliInteractive.ts b/scripts/testCliInteractive.ts
new file mode 100644
index 00000000000..72d26d586b8
--- /dev/null
+++ b/scripts/testCliInteractive.ts
@@ -0,0 +1,54 @@
+/**
+ * Interactive smoke test — boots engine, runs a short command sequence.
+ * Always uses tester servers.
+ */
+import { execSync, spawn } from 'child_process'
+import fs from 'fs'
+import os from 'os'
+import path from 'path'
+
+const TMP = fs.mkdtempSync(path.join(os.tmpdir(), 'edge-cli-interactive-'))
+
+async function main(): Promise<void> {
+  const engine = spawn(
+    process.execPath,
+    [
+      '-r',
+      'sucrase/register',
+      'src/cli/engine/index.ts',
+      '-t',
+      '-d',
+      TMP,
+      '--idle-timeout=60'
+    ],
+    { stdio: ['ignore', 'inherit', 'inherit'] }
+  )
+
+  // Wait for ready by polling
+  await new Promise(resolve => setTimeout(resolve, 15000))
+
+  const run = (args: string): void => {
+    console.log('>', args)
+    const out = execSync(
+      `node -r sucrase/register src/cli/index.ts -t -d ${TMP} --no-spawn ${args}`,
+      { encoding: 'utf8' }
+    )
+    console.log(out)
+  }
+
+  try {
+    run('engine-status')
+    run('engine-config')
+    run('local-users')
+    run('fetch-challenge')
+    console.log('PASS interactive smoke')
+  } finally {
+    engine.kill('SIGTERM')
+    fs.rmSync(TMP, { recursive: true, force: true })
+  }
+}
+
+main().catch((e: unknown) => {
+  console.error(e)
+  process.exit(1)
+})
diff --git a/scripts/testCliSubscribe.ts b/scripts/testCliSubscribe.ts
new file mode 100644
index 00000000000..0a9aa7a2eae
--- /dev/null
+++ b/scripts/testCliSubscribe.ts
@@ -0,0 +1,109 @@
+/**
+ * Proves the subscribe/one-shot concurrency contract against a real engine:
+ *
+ *   1. A subscriber holds the engine open even with no account logged in.
+ *   2. One-shot commands run normally while a subscriber is attached.
+ *   3. The idle timer re-arms once the last subscriber detaches.
+ *   4. Stopping the engine closes the stream with a reason and exit code 7.
+ *
+ * Uses its own --directory so it never touches a developer's live engine, and
+ * the fake world so the contract holds without an Edge API key or a network.
+ *
+ *   node -r sucrase/register scripts/testCliSubscribe.ts
+ */
+import { type ChildProcess, spawn, spawnSync } from 'child_process'
+import fs from 'fs'
+import os from 'os'
+import path from 'path'
+
+const DIR = path.join(os.tmpdir(), `edge-cli-subscribe-${process.pid}`)
+const CLI = ['-r', 'sucrase/register', 'src/cli/index.ts']
+const BASE = ['--fake', `--directory=${DIR}`]
+
+let failures = 0
+function check(label: string, ok: boolean, detail = ''): void {
+  if (ok) console.log(`OK   ${label}`)
+  else {
+    failures++
+    console.error(`FAIL ${label}${detail !== '' ? ` — ${detail}` : ''}`)
+  }
+}
+
+function cli(...args: string[]): { status: number; out: string } {
+  const result = spawnSync('node', [...CLI, ...BASE, ...args], {
+    encoding: 'utf8'
+  })
+  return { status: result.status ?? -1, out: result.stdout + result.stderr }
+}
+
+async function sleep(ms: number): Promise<void> {
+  await new Promise(resolve => setTimeout(resolve, ms))
+}
+
+async function main(): Promise<void> {
+  fs.mkdirSync(DIR, { recursive: true })
+
+  const status = cli('engine-status')
+  check('engine starts', status.status === 0, status.out.slice(0, 200))
+
+  let subOut = ''
+  const sub: ChildProcess = spawn('node', [...CLI, ...BASE, 'subscribe'], {
+    stdio: ['ignore', 'pipe', 'pipe']
+  })
+  sub.stdout?.on('data', d => (subOut += String(d)))
+  sub.stderr?.on('data', d => (subOut += String(d)))
+  const subExit = new Promise<number>(resolve => {
+    sub.on('exit', code => {
+      resolve(code ?? -1)
+    })
+  })
+  await sleep(2500)
+
+  const held = cli('engine-status')
+  check(
+    'a subscriber holds off idle shutdown',
+    /"idleShutdownAt":\s*null/.test(held.out) &&
+      /"sessionCount":\s*0/.test(held.out),
+    held.out.slice(0, 200)
+  )
+
+  const concurrent = cli('local-users')
+  check(
+    'one-shot commands run while subscribed',
+    concurrent.status === 0 && concurrent.out.includes('localUsers'),
+    concurrent.out.slice(0, 200)
+  )
+
+  const stopped = cli('engine-stop')
+  check('engine-stop succeeds', stopped.status === 0, stopped.out.slice(0, 200))
+
+  const code = await Promise.race([subExit, sleep(8000).then(() => -2)])
+  check('subscriber exits when the engine stops', code === 7, `exit ${code}`)
+  check(
+    'subscriber is told why the stream ended',
+    subOut.includes('engineShutdown'),
+    subOut.slice(0, 300)
+  )
+
+  // A fresh engine must re-arm its idle timer with no subscriber attached.
+  const rearmed = cli('engine-status')
+  check(
+    'idle timer re-arms with no subscriber',
+    /"idleShutdownAt":\s*"/.test(rearmed.out),
+    rearmed.out.slice(0, 200)
+  )
+  cli('engine-stop')
+
+  fs.rmSync(DIR, { recursive: true, force: true })
+  if (failures > 0) {
+    console.error(`\n${failures} check(s) failed`)
+    process.exit(1)
+  }
+  console.log('\ntestCliSubscribe: all checks passed')
+}
+
+main().catch((error: unknown) => {
+  console.error(error)
+  fs.rmSync(DIR, { recursive: true, force: true })
+  process.exit(1)
+})
diff --git a/scripts/testEdgeLogin.ts b/scripts/testEdgeLogin.ts
new file mode 100644
index 00000000000..c951f0f24de
--- /dev/null
+++ b/scripts/testEdgeLogin.ts
@@ -0,0 +1,185 @@
+/**
+ * Edge-login E2E against login-tester without the GUI:
+ * 1. Create+login an approving account
+ * 2. Request request-edge-login (returns lobbyId + uri)
+ * 3. Approve the lobby from the logged-in account
+ * 4. Poll until the pending login completes with a session
+ *
+ * Also prints the lobby URI for optional Maestro approval on a
+ * tester-configured Edge build.
+ *
+ * Usage: node -r sucrase/register scripts/testEdgeLogin.ts
+ */
+import { spawn } from 'child_process'
+import crypto from 'crypto'
+import fs from 'fs'
+import http from 'http'
+import os from 'os'
+import path from 'path'
+
+import { solveCaptcha } from '../src/cli/client/solveCaptcha'
+
+const TMP = fs.mkdtempSync(path.join(os.tmpdir(), 'edge-cli-edgelogin-'))
+const USER = `edgelogin${crypto.randomBytes(3).toString('hex')}`
+const PASS = `Pass${crypto.randomBytes(4).toString('hex')}!e1`
+const PIN = '2468'
+
+async function req(
+  sock: string,
+  method: string,
+  urlPath: string,
+  body?: unknown
+): Promise<{ status: number; json: any }> {
+  const payload =
+    body === undefined ? undefined : Buffer.from(JSON.stringify(body))
+  return await new Promise((resolve, reject) => {
+    const r = http.request(
+      {
+        method,
+        path: urlPath,
+        socketPath: sock,
+        headers: {
+          Accept: 'application/json',
+          ...(payload != null
+            ? {
+                'Content-Type': 'application/json',
+                'Content-Length': String(payload.length)
+              }
+            : {})
+        }
+      },
+      res => {
+        const chunks: Buffer[] = []
+        res.on('data', c => chunks.push(c))
+        res.on('end', () => {
+          const raw = Buffer.concat(chunks).toString('utf8')
+          resolve({
+            status: res.statusCode ?? 0,
+            json: raw === '' ? undefined : JSON.parse(raw)
+          })
+        })
+      }
+    )
+    r.on('error', reject)
+    if (payload != null) r.write(payload)
+    r.end()
+  })
+}
+
+async function createWithCaptcha(sock: string): Promise<string> {
+  let create = await req(sock, 'POST', '/create-account', {
+    username: USER,
+    password: PASS,
+    pin: PIN
+  })
+  if (create.json?.error?.code === 'CHALLENGE_REQUIRED') {
+    const { challengeId, challengeUri } = create.json.error.details
+    const ok = await solveCaptcha(challengeUri)
+    if (!ok) throw new Error('CAPTCHA failed')
+    create = await req(sock, 'POST', '/create-account', {
+      username: USER,
+      password: PASS,
+      pin: PIN,
+      challengeId
+    })
+  }
+  if (create.status !== 200) {
+    throw new Error(`create failed: ${JSON.stringify(create.json)}`)
+  }
+  return create.json.sessionId as string
+}
+
+async function main(): Promise<void> {
+  console.log(`Approver user=${USER} dir=${TMP}`)
+  const engine = spawn(
+    process.execPath,
+    [
+      '-r',
+      'sucrase/register',
+      'src/cli/engine/index.ts',
+      '-t',
+      '-d',
+      TMP,
+      '--idle-timeout=180'
+    ],
+    { stdio: ['ignore', 'pipe', 'pipe'] }
+  )
+  let sock = ''
+  await new Promise<void>((resolve, reject) => {
+    const t = setTimeout(() => {
+      reject(new Error('engine timeout'))
+    }, 60_000)
+    engine.stderr?.on('data', (b: Buffer) => {
+      const line = b.toString()
+      process.stderr.write(line)
+      const m = /unix:(.+)/.exec(line)
+      if (m != null) sock = m[1].trim()
+      if (line.includes('Ready')) {
+        clearTimeout(t)
+        resolve()
+      }
+    })
+  })
+
+  try {
+    const approverSession = await createWithCaptcha(sock)
+    console.log('approver session', approverSession)
+
+    const pending = await req(sock, 'POST', '/request-edge-login')
+    if (pending.status !== 200) {
+      throw new Error(`edge login failed: ${JSON.stringify(pending.json)}`)
+    }
+    const { pendingId, lobbyId, uri } = pending.json
+    console.log(JSON.stringify({ pendingId, lobbyId, uri }, null, 2))
+    console.log(
+      'Maestro tip: paste this URI into Scan QR → Enter on a tester-server Edge build:'
+    )
+    console.log(`  LOBBY_URI=${uri}`)
+    console.log(
+      `  maestro-runner --platform ios -e LOBBY_URI=${uri} test ~/.edge-cli/maestro/C999006-edge-login-approve.yaml`
+    )
+
+    // Approve via REST (same tester login server)
+    const fetched = await req(
+      sock,
+      'GET',
+      `/account/${approverSession}/fetch-lobby/${lobbyId}`
+    )
+    console.log('lobby fetch', fetched.status, JSON.stringify(fetched.json))
+    const approved = await req(
+      sock,
+      'POST',
+      `/account/${approverSession}/approve-login-request/${lobbyId}`
+    )
+    console.log('lobby approve', approved.status, JSON.stringify(approved.json))
+
+    const deadline = Date.now() + 60_000
+    while (Date.now() < deadline) {
+      const st = await req(sock, 'GET', `/pending-edge-login/${pendingId}`)
+      console.log('poll', st.json?.state)
+      if (st.json?.state === 'done' && st.json?.session != null) {
+        console.log('PASS request-edge-login', st.json.session.sessionId)
+        // Cleanup
+        await req(
+          sock,
+          'POST',
+          `/account/${approverSession}/delete-remote-account`
+        )
+        return
+      }
+      if (st.json?.state === 'error' || st.json?.state === 'closed') {
+        throw new Error(`edge login ended: ${JSON.stringify(st.json)}`)
+      }
+      await new Promise(resolve => setTimeout(resolve, 1500))
+    }
+    throw new Error('Timed out waiting for request-edge-login approval')
+  } finally {
+    engine.kill('SIGTERM')
+    fs.rmSync(TMP, { recursive: true, force: true })
+  }
+}
+
+main().catch((e: unknown) => {
+  console.error(e)
+  process.exit(1)
+})
diff --git a/scripts/testNodeApiSigner.ts b/scripts/testNodeApiSigner.ts
new file mode 100644
index 00000000000..15921266958
--- /dev/null
+++ b/scripts/testNodeApiSigner.ts
@@ -0,0 +1,116 @@
+/**
+ * Verify the Node N-API Edge API HMAC signer against a JS HMAC-SHA256
+ * reference using edgeKey.json, and that makeCoreContext prefers apiSigner.
+ */
+import { createHmac } from 'crypto'
+import fs from 'fs'
+import os from 'os'
+import path from 'path'
+
+import { EventHub } from '../src/cli/engine/events'
+import type { EngineLogger } from '../src/cli/engine/logger'
+import { makeCoreContext } from '../src/cli/engine/makeCoreContext'
+import {
+  hasNodeApiSigner,
+  makeNodeApiSigner,
+  NODE_API_SIGNER_BUNDLE_ID,
+  resetNodeApiSignerCacheForTests
+} from '../src/cli/engine/nodeApiSigner'
+
+function assert(cond: boolean, msg: string): asserts cond {
+  if (!cond) throw new Error(msg)
+}
+
+async function main(): Promise<void> {
+  resetNodeApiSignerCacheForTests()
+
+  assert(
+    hasNodeApiSigner(),
+    'Node API signer addon missing — run npm run build:cli:native first'
+  )
+
+  const edgeKeyPath = path.join(__dirname, '..', 'edgeKey.json')
+  assert(fs.existsSync(edgeKeyPath), 'edgeKey.json required for HMAC reference')
+  const edgeKey = JSON.parse(fs.readFileSync(edgeKeyPath, 'utf8')) as {
+    apiKey: string
+    apiSecret: string
+  }
+  assert(typeof edgeKey.apiKey === 'string' && edgeKey.apiKey !== '', 'apiKey')
+  assert(
+    typeof edgeKey.apiSecret === 'string' && edgeKey.apiSecret !== '',
+    'apiSecret'
+  )
+
+  const secret = Buffer.from(edgeKey.apiSecret.replace(/^0x/i, ''), 'hex')
+  const message = 'POST\n/v2/login\n{"userId":"test"}'
+  const expectedSig = createHmac('sha256', secret)
+    .update(message, 'utf8')
+    .digest('base64')
+
+  const signer = makeNodeApiSigner()
+  const signed = await signer.signMessage(message)
+
+  assert(
+    signed.apiKey === edgeKey.apiKey,
+    `apiKey mismatch: ${signed.apiKey} !== ${edgeKey.apiKey}`
+  )
+  assert(
+    signed.signature === expectedSig,
+    `signature mismatch\n native=${signed.signature}\n expect=${expectedSig}\n pad=${NODE_API_SIGNER_BUNDLE_ID}`
+  )
+  console.log('PASS node HMAC matches JS reference')
+
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'edge-cli-node-hmac-'))
+  const events = new EventHub()
+  const logs: string[] = []
+  const logger = {
+    logPath: path.join(dir, 'test.log'),
+    write(level: string, message: string) {
+      logs.push(`${level}:${message}`)
+    },
+    info(message: string) {
+      logs.push(`info:${message}`)
+    },
+    warn(message: string) {
+      logs.push(`warn:${message}`)
+    },
+    error(message: string) {
+      logs.push(`error:${message}`)
+    },
+    close() {}
+  } as unknown as EngineLogger
+
+  const bundle = await makeCoreContext({
+    directory: dir,
+    testMode: true,
+    events,
+    logger
+  })
+  assert(
+    logs.some(l => l.includes('Node native Edge API HMAC')),
+    'expected makeCoreContext to log native signer use'
+  )
+  assert(
+    logs.some(l => l.includes('Fetched infoRollup appKeys')),
+    `expected makeCoreContext to fetch infoRollup appKeys with the native HMAC signer\nlogs:\n${logs.join(
+      '\n'
+    )}`
+  )
+  assert(
+    !logs.some(l => l.includes('infoRollup appKeys fetch failed')),
+    `infoRollup appKeys fetch failed; native HMAC signer should authorize info-tester\nlogs:\n${logs.join(
+      '\n'
+    )}`
+  )
+  assert(bundle.context != null, 'missing context')
+  console.log('PASS makeCoreContext uses native signer on tester')
+  console.log(
+    'PASS makeCoreContext fetched infoRollup appKeys with native signer'
+  )
+  await bundle.context.close()
+}
+
+main().catch((err: unknown) => {
+  console.error(err)
+  process.exit(1)
+})
diff --git a/scripts/themeServer.ts b/scripts/themeServer.ts
index 7b0e7c2426c..5531767ba6e 100644
--- a/scripts/themeServer.ts
+++ b/scripts/themeServer.ts
@@ -4,19 +4,19 @@ import fs from 'fs'
 import os from 'os'
 import path from 'path'
 
-import { asEnvConfig } from '../src/envConfig'
+import { asConfigJson } from '../src/configKeysSchema'
 import { mergeTheme, parseOverrideTheme } from './themeParser'
 
 const ifaces = os.networkInterfaces()
 const PORT = 8090
-const envFile = './env.json'
+const configFile = './config.json'
 const THEME_SOURCE_PATH = path.join(
   __dirname,
   '../src/theme/variables/edgeDark.ts'
 )
 
 let address = ''
-let envJSON = { THEME_SERVER: {} }
+let configJson = { THEME_SERVER: {} }
 
 function mylog(...args: unknown[]): void {
   const now = new Date().toISOString()
@@ -24,13 +24,14 @@ function mylog(...args: unknown[]): void {
 }
 
 try {
-  envJSON = JSON.parse(fs.readFileSync(envFile, 'utf8'))
+  configJson = JSON.parse(fs.readFileSync(configFile, 'utf8'))
 } catch (e) {
   console.log(e)
 }
 
-const envConfig = asEnvConfig(envJSON)
-const { overrideThemeFile } = envConfig.THEME_SERVER
+// Match configure.ts: local config.json may contain "comment" and other extras.
+const config = asConfigJson.withRest(configJson)
+const { overrideThemeFile } = config.THEME_SERVER
 
 try {
   // Get Local Host Address
@@ -49,12 +50,12 @@ try {
     })
   })
 
-  // Set env.json with correct path
-  envJSON.THEME_SERVER = {
+  // Set config.json with correct path
+  configJson.THEME_SERVER = {
     host: `http://${address}`,
     port: `${PORT}`
   }
-  fs.writeFileSync(envFile, JSON.stringify(envJSON, null, 2))
+  fs.writeFileSync(configFile, JSON.stringify(configJson, null, 2))
 } catch (e) {
   console.log(e)
 }
diff --git a/scripts/util/solveCaptcha.ts b/scripts/util/solveCaptcha.ts
new file mode 100644
index 00000000000..67c10897a12
--- /dev/null
+++ b/scripts/util/solveCaptcha.ts
@@ -0,0 +1 @@
+export { solveCaptcha, solveChallenge } from '../../src/cli/client/solveCaptcha'
diff --git a/scripts/verifyApiDocs.ts b/scripts/verifyApiDocs.ts
new file mode 100644
index 00000000000..b5cccc5c06b
--- /dev/null
+++ b/scripts/verifyApiDocs.ts
@@ -0,0 +1,381 @@
+/**
+ * Drift checker for the API surface.
+ *
+ * Reads the route declarations and the registered CLI commands out of
+ * `src/cli`, and asserts they describe the same API: no route without a
+ * command it claims, no command nobody declares, no flag on one side missing
+ * from the other, and no `core` naming a member `edge-core-js` does not have.
+ *
+ *   node -r sucrase/register scripts/verifyApiDocs.ts
+ *
+ * Exits non-zero on any drift, so it can gate CI.
+ */
+import fs from 'fs'
+import path from 'path'
+
+import { groupOrder } from '../docs/api/groups'
+import { errorCodes } from '../docs/api/shared'
+import { extractRoutes, kebab } from './extractRoutes'
+
+const ROOT = path.resolve(__dirname, '..')
+const COMMANDS_DIR = path.join(ROOT, 'src/cli/commands')
+const CORE_TYPES = path.join(
+  ROOT,
+  'node_modules/edge-core-js/src/types/types.ts'
+)
+const INTERNAL_TYPES = path.join(ROOT, 'src/cli/engine/internal.ts')
+
+/** Commands that talk to no route. */
+const LOCAL_ONLY_COMMANDS = new Set(['help'])
+
+function read(dir: string): string {
+  return fs
+    .readdirSync(dir)
+    .filter(name => name.endsWith('.ts'))
+    .map(name => fs.readFileSync(path.join(dir, name), 'utf8'))
+    .join('\n')
+}
+
+const commandSource = read(COMMANDS_DIR)
+
+interface GeneratedTable {
+  commands: Array<{
+    command: string
+    args: Array<{ flag?: string }>
+    bodyFlag?: string
+  }>
+}
+
+/** The generated table, alongside the hand-written modules. */
+const generated: GeneratedTable = JSON.parse(
+  fs.readFileSync(path.join(ROOT, 'src/cli/generated/commands.json'), 'utf8')
+)
+
+function registeredCommands(): Set<string> {
+  const found = new Set<string>()
+  const re =
+    /(?<![\w.])(?:command|objectIdCmd|walletActionCmd)\(\s*'([a-z0-9-]+)'/g
+  let m: RegExpExecArray | null
+  while ((m = re.exec(commandSource)) != null) found.add(m[1])
+  for (const c of generated.commands) found.add(c.command)
+  return found
+}
+
+/** Flags each command's parser really accepts. */
+function registeredFlags(): Map<string, Set<string>> {
+  const out = new Map<string, Set<string>>()
+  const flagsIn = (text: string): Set<string> => {
+    const flags = new Set<string>()
+    const block = /flags:\s*\{([\s\S]*?)\}/.exec(text)
+    if (block == null) return flags
+    const re =
+      /['"]?([a-zA-Z0-9-]+)['"]?\s*:\s*'(?:string|boolean|repeat|boolstr)'/g
+    let m: RegExpExecArray | null
+    while ((m = re.exec(block[1])) != null) flags.add(m[1])
+    return flags
+  }
+  const helpers: Array<[RegExp, RegExp]> = [
+    [
+      /function objectIdCmd\([\s\S]*?\n\}/,
+      /^objectIdCmd\(\s*\n?\s*'([a-z0-9-]+)'/gm
+    ],
+    [
+      /function walletActionCmd\([\s\S]*?\n\}/,
+      /^walletActionCmd\(\s*\n?\s*'([a-z0-9-]+)'/gm
+    ]
+  ]
+  for (const block of commandSource.split(/\n(?=(?:const \w+ = )?command\()/)) {
+    const name = /^(?:const \w+ = )?command\(\s*\n?\s*'([a-z0-9-]+)'/.exec(
+      block
+    )
+    if (name != null) out.set(name[1], flagsIn(block))
+  }
+  for (const [bodyRe, callRe] of helpers) {
+    const body = bodyRe.exec(commandSource)
+    const flags = body != null ? flagsIn(body[0]) : new Set<string>()
+    let m: RegExpExecArray | null
+    while ((m = callRe.exec(commandSource)) != null) out.set(m[1], flags)
+  }
+  for (const c of generated.commands) {
+    const flags = new Set<string>()
+    for (const a of c.args) if (a.flag != null) flags.add(a.flag)
+    if (c.bodyFlag != null) flags.add(c.bodyFlag)
+    out.set(c.command, flags)
+  }
+  return out
+}
+
+const problems: string[] = []
+function fail(kind: string, detail: string): void {
+  problems.push(`${kind}: ${detail}`)
+}
+
+const routes = extractRoutes()
+const commands = registeredCommands()
+const flagsByCommand = registeredFlags()
+const coreSource = fs.existsSync(CORE_TYPES)
+  ? fs.readFileSync(CORE_TYPES, 'utf8')
+  : ''
+const internalSource = fs.existsSync(INTERNAL_TYPES)
+  ? fs.readFileSync(INTERNAL_TYPES, 'utf8')
+  : ''
+
+// -------------------------------------------------------------- uniqueness
+const seen = new Map<string, number>()
+for (const r of routes) {
+  const key = `${r.method} ${r.routePath}`
+  seen.set(key, (seen.get(key) ?? 0) + 1)
+}
+for (const [key, count] of seen) {
+  if (count > 1) fail('duplicate route', `${key} declared ${count} times`)
+}
+
+// ------------------------------------------------------------ path shape
+// Path parameters are base58 identifiers, and nothing else. Base58 has no
+// `/`, `?` or `#`, so such a value survives a URL as written. A base64 wallet
+// id (`7o7i6/tlI+qi…=`) or a free-text username does not: it needs
+// percent-encoding, and a caller who forgets gets a 404 rather than an error
+// that names the mistake. Those travel as named arguments instead.
+const BASE58_PARAMS = new Set([
+  'sessionId',
+  'objectId',
+  'pendingId',
+  'lobbyId',
+  'syncKey'
+])
+
+// A REST path reads in the same order the command does: scope, then command,
+// then the one argument the command takes bare. Anything the caller names
+// stays in the query or the body.
+for (const r of routes) {
+  const segments = r.routePath.split('/').filter(x => x !== '')
+  const params = segments.filter(x => x.startsWith('{'))
+
+  for (const seg of params) {
+    const name = seg.slice(1, -1)
+    if (!BASE58_PARAMS.has(name)) {
+      fail(
+        'path shape',
+        `${r.method} ${r.routePath} carries "${name}" on the path; only ` +
+          `base58 identifiers (${[...BASE58_PARAMS].join(', ')}) may be path ` +
+          'parameters — everything else needs a named argument'
+      )
+    }
+  }
+
+  for (const [i, seg] of segments.entries()) {
+    if (!seg.startsWith('{')) continue
+    const name = seg.slice(1, -1)
+    if (name === 'sessionId') continue
+    if (i !== segments.length - 1) {
+      fail(
+        'path shape',
+        `${r.method} ${r.routePath} puts {${name}} before a literal segment; ` +
+          'a positional is the final segment'
+      )
+    }
+  }
+
+  // `{sessionId}` is scope, so it may lead; nothing else may repeat it.
+  if (params.length > 2) {
+    fail(
+      'path shape',
+      `${r.method} ${r.routePath} takes more than one argument`
+    )
+  }
+
+  // A plural collection segment means the call acts on many; these all act on
+  // exactly one.
+  for (const seg of segments) {
+    if (seg === 'wallets' || seg === 'objects' || seg === 'swap-quotes') {
+      fail(
+        'path shape',
+        `${r.method} ${r.routePath} names "${seg}" plural but acts on one`
+      )
+    }
+  }
+
+  // The positional must actually be on the path, or the CLI and REST disagree
+  // about where the argument goes.
+  const pos = r.cli?.positional
+  if (pos != null) {
+    if (!r.routePath.endsWith(`/{${pos}}`)) {
+      fail(
+        'path shape',
+        `${r.method} ${r.routePath} declares positional "${pos}" but does not ` +
+          'carry it as the final path segment'
+      )
+    }
+  }
+
+  // A written `path` carries scope and command only. The positional is
+  // appended from `cli.positional`, so spelling it out here would be a second
+  // copy of the same name, free to disagree with the first. `{sessionId}` is
+  // scope rather than an argument, and a route with no command has nothing to
+  // derive from.
+  for (const m of r.declaredPath.matchAll(/\{(\w+)\}/g)) {
+    if (m[1] === 'sessionId') continue
+    if (r.cli == null) continue
+    fail(
+      'path shape',
+      `${r.id} writes {${m[1]}} into its path; declare ` +
+        `\`positional: '${m[1]}'\` on the command and let the path derive it`
+    )
+  }
+}
+
+// --------------------------------------------------------- section by core
+// A call is filed under the object it acts on. That is the rule the reference
+// is organised by, and it is easy to break by putting a route in a convenient
+// file: `account.createCurrencyWallet` sat in `wallets.ts`, and so appeared
+// under Wallet, for as long as nobody read that section closely.
+const SECTION_BY_CORE: Array<[RegExp, string]> = [
+  [/^context\.\$internalStuff\./, 'admin'],
+  [/^context\./, 'context'],
+  [/^account\./, 'account'],
+  [/^wallet\./, 'wallet'],
+  [/^EdgeSwapQuote\./, 'account'],
+  [/^EdgeLoginRequest\./, 'account']
+]
+const sectionOf = new Map<string, string>(
+  groupOrder.map(g => [g.id, g.section])
+)
+for (const r of routes) {
+  if (r.core == null) continue
+  const rule = SECTION_BY_CORE.find(([re]) => re.test(r.core ?? ''))
+  if (rule == null) continue
+  const actual = sectionOf.get(r.group)
+  if (actual !== rule[1]) {
+    fail(
+      'section',
+      `${r.id} fronts ${r.core} but sits in "${r.group}", which is filed ` +
+        `under "${actual ?? '?'}" instead of "${rule[1]}"`
+    )
+  }
+}
+
+// ---------------------------------------------------------------- commands
+const claimed = new Set<string>()
+for (const r of routes) {
+  for (const cli of [r.cli, ...r.cliExtra]) {
+    if (cli == null) continue
+    claimed.add(cli.command)
+    if (!commands.has(cli.command)) {
+      fail(
+        'phantom command',
+        `"${cli.command}" claimed by ${r.id} is not registered`
+      )
+    }
+  }
+}
+for (const name of commands) {
+  if (!claimed.has(name) && !LOCAL_ONLY_COMMANDS.has(name)) {
+    fail('undeclared command', `"${name}" is registered but no route claims it`)
+  }
+}
+
+// ------------------------------------------------------------------- flags
+// A command may serve several routes, so gather what it declares across all.
+const declaredFlags = new Map<string, Set<string>>()
+for (const r of routes) {
+  for (const cli of [r.cli, ...r.cliExtra]) {
+    if (cli == null) continue
+    const set = declaredFlags.get(cli.command) ?? new Set<string>()
+    for (const f of cli.flags) set.add(f.name)
+    for (const x of cli.extra) set.add(x.name)
+    if (cli.bodyFlag != null) set.add(cli.bodyFlag)
+    // Fields with no override become their kebab-cased name.
+    for (const f of [...(r.query ?? []), ...(r.body ?? [])]) {
+      if (f.name === cli.positional) continue
+      set.add(kebab(f.name))
+    }
+    declaredFlags.set(cli.command, set)
+  }
+}
+for (const [command, real] of flagsByCommand) {
+  const declared = declaredFlags.get(command)
+  if (declared == null) continue
+  for (const name of real) {
+    if (!declared.has(name)) {
+      fail(
+        'undeclared flag',
+        `"${command}" accepts --${name}, no route declares it`
+      )
+    }
+  }
+}
+
+// -------------------------------------------------------------- core calls
+for (const r of routes) {
+  if (r.core == null) {
+    if (r.coreNote == null || r.coreNote === '') {
+      fail('missing core note', `${r.id} has no core call and no @coreNote`)
+    }
+    continue
+  }
+  const member = r.core.split('.').pop() ?? ''
+  const haystack = r.core.includes('$internalStuff')
+    ? internalSource
+    : coreSource
+  if (haystack !== '' && !new RegExp(`\\b${member}\\b`).test(haystack)) {
+    fail('unknown core call', `${r.id} names "${r.core}", absent from core`)
+  }
+}
+
+// ------------------------------------------------------------------ shapes
+const knownCodes = new Set(errorCodes.map(e => e.code))
+for (const r of routes) {
+  for (const code of r.errors) {
+    if (!knownCodes.has(code)) {
+      fail('unknown error code', `${r.id} lists "${code}"`)
+    }
+  }
+  if (r.summary === '') fail('missing summary', `${r.id} has no JSDoc summary`)
+}
+
+// ------------------------------------------------- paths named in the prose
+// Narrative text is not generated, so a rename can leave it behind. Any
+// `METHOD /path` mentioned anywhere in the docs must be a real route.
+const realPaths = new Set(routes.map(r => `${r.method} ${r.routePath}`))
+/** Paths on other services that the prose legitimately mentions. */
+const EXTERNAL_PATHS = new Set(['GET /v1/getKeys'])
+const proseSources: Array<[string, string]> = []
+for (const file of ['docs/EDGE_CLI.md', 'docs/api/README.md']) {
+  const full = path.join(ROOT, file)
+  if (fs.existsSync(full))
+    proseSources.push([file, fs.readFileSync(full, 'utf8')])
+}
+for (const r of routes) {
+  const text = [
+    r.summary,
+    r.description ?? '',
+    ...r.notes,
+    r.coreNote ?? ''
+  ].join(' ')
+  proseSources.push([r.id, text])
+}
+for (const [where, text] of proseSources) {
+  for (const m of text.matchAll(
+    /\b(GET|POST|PUT|PATCH|DELETE) (\/[\w{}/-]+)/g
+  )) {
+    const cited = `${m[1]} ${m[2]}`
+    // `…` stands in for an elided prefix; only check fully-written paths.
+    if (m[2].includes('…')) continue
+    if (!realPaths.has(cited) && !EXTERNAL_PATHS.has(cited)) {
+      fail(
+        'stale path in prose',
+        `${where} cites "${cited}", which is not a route`
+      )
+    }
+  }
+}
+
+if (problems.length > 0) {
+  console.error(`✗ ${problems.length} problem(s):\n`)
+  for (const p of problems) console.error(`  ${p}`)
+  process.exit(1)
+}
+console.log(
+  `✓ surface matches: ${routes.length} routes, ` +
+    `${claimed.size} of ${commands.size} commands (${LOCAL_ONLY_COMMANDS.size} local-only)`
+)
diff --git a/scripts/writeIfChanged.ts b/scripts/writeIfChanged.ts
new file mode 100644
index 00000000000..164794aa265
--- /dev/null
+++ b/scripts/writeIfChanged.ts
@@ -0,0 +1,40 @@
+import fs from 'fs'
+import path from 'path'
+
+/**
+ * True when the generators may only verify, not write.
+ *
+ * `--check` turns every generator into a staleness test: it derives what the
+ * artifact should contain and fails if the committed copy disagrees. That is
+ * what makes committing the generated files safe — an edited declaration
+ * cannot reach a commit while `commands.json` still describes the old one.
+ */
+export const CHECK_ONLY = process.argv.includes('--check')
+
+/**
+ * Write a file only when its contents actually change.
+ *
+ * `npm run prepare` regenerates every artifact on each install, so an
+ * unconditional write would touch mtimes and show up as a git diff even when
+ * nothing about the source moved. Returns true when something was written.
+ *
+ * Under `--check` nothing is written; a file that would have changed throws
+ * instead.
+ */
+export function writeIfChanged(file: string, contents: string): boolean {
+  if (fs.existsSync(file) && fs.readFileSync(file, 'utf8') === contents) {
+    return false
+  }
+  if (CHECK_ONLY) {
+    // A stack trace would bury the one line that matters.
+    console.error(
+      `✗ ${path.relative(process.cwd(), file)} is out of date.\n` +
+        '  A route declaration changed without regenerating it.\n' +
+        '  Run `npm run docs:api` and commit the result.'
+    )
+    process.exit(1)
+  }
+  fs.mkdirSync(path.dirname(file), { recursive: true })
+  fs.writeFileSync(file, contents)
+  return true
+}
diff --git a/src/__tests__/actions/DeviceSettingsActions.test.ts b/src/__tests__/actions/DeviceSettingsActions.test.ts
new file mode 100644
index 00000000000..ff6dbfa9033
--- /dev/null
+++ b/src/__tests__/actions/DeviceSettingsActions.test.ts
@@ -0,0 +1,159 @@
+import { beforeEach, describe, expect, it, jest } from '@jest/globals'
+
+import type * as DeviceSettingsActions from '../../actions/DeviceSettingsActions'
+import type { DeviceSettings } from '../../types/types'
+
+const FILENAME = 'DeviceSettings.json'
+
+let mockFiles: Record<string, string> = {}
+// Held open so a write can be issued while the initial load is still in flight.
+let mockReadGate: Promise<void> = Promise.resolve()
+let mockFailWrites = 0
+// Optional per-write delay so overlapping writes can prove serialization.
+let mockWriteHook: ((callIndex: number) => Promise<void>) | undefined
+let mockWriteCallIndex = 0
+const mockWriteCallOrder: string[] = []
+
+jest.mock('disklet', () => ({
+  makeReactNativeDisklet: () => ({
+    getText: async (name: string): Promise<string> => {
+      await mockReadGate
+      const text = mockFiles[name]
+      if (text == null) throw new Error(`${name} not found`)
+      return text
+    },
+    setText: async (name: string, text: string): Promise<void> => {
+      const callIndex = mockWriteCallIndex++
+      mockWriteCallOrder.push(`start:${callIndex}`)
+      if (mockWriteHook != null) await mockWriteHook(callIndex)
+      if (mockFailWrites > 0) {
+        mockFailWrites--
+        mockWriteCallOrder.push(`fail:${callIndex}`)
+        throw new Error('disk full')
+      }
+      mockFiles[name] = text
+      mockWriteCallOrder.push(`end:${callIndex}`)
+    }
+  })
+}))
+
+const readFile = (): DeviceSettings => JSON.parse(mockFiles[FILENAME])
+
+// Each case needs its own copy of the module's in-memory settings and its
+// single-flighted load promise.
+const freshModule = (): typeof DeviceSettingsActions => {
+  let module: typeof DeviceSettingsActions
+  jest.isolateModules(() => {
+    module = require('../../actions/DeviceSettingsActions')
+  })
+  // @ts-expect-error assigned by the synchronous isolateModules callback
+  return module
+}
+
+describe('patchDeviceSettings', () => {
+  beforeEach(() => {
+    mockFiles = {}
+    mockReadGate = Promise.resolve()
+    mockFailWrites = 0
+    mockWriteHook = undefined
+    mockWriteCallIndex = 0
+    mockWriteCallOrder.length = 0
+  })
+
+  it('keeps fields already on disk when a write beats the initial load', async () => {
+    // themeMode and defaultScreen both differ from the cleaner's defaults, so a
+    // write built on the defaults instead of the file is visible here.
+    mockFiles[FILENAME] = JSON.stringify({
+      themeMode: 'light',
+      defaultScreen: 'assets'
+    })
+    let openGate: () => void = () => {}
+    mockReadGate = new Promise<void>(resolve => {
+      openGate = resolve
+    })
+
+    const { initDeviceSettings, writeKeysCache } = freshModule()
+    const loaded = initDeviceSettings()
+    const written = writeKeysCache({
+      keys: { EDGE_API_KEY: 'k' },
+      fetchedAt: 1,
+      assuranceLevel: 'default'
+    })
+
+    openGate()
+    await Promise.all([loaded, written])
+
+    const file = readFile()
+    expect(file.themeMode).toBe('light')
+    expect(file.defaultScreen).toBe('assets')
+    expect(file.keysCache?.assuranceLevel).toBe('default')
+  })
+
+  it('preserves on-disk fields when write runs without initDeviceSettings first', async () => {
+    mockFiles[FILENAME] = JSON.stringify({
+      themeMode: 'light',
+      defaultScreen: 'assets'
+    })
+    const { writeThemeMode } = freshModule()
+    await writeThemeMode('dark')
+
+    const file = readFile()
+    expect(file.themeMode).toBe('dark')
+    expect(file.defaultScreen).toBe('assets')
+  })
+
+  it('lands every field when writes overlap', async () => {
+    mockFiles[FILENAME] = JSON.stringify({})
+    const { initDeviceSettings, writeDefaultScreen, writeThemeMode } =
+      freshModule()
+    await initDeviceSettings()
+
+    let releaseFirstWrite: () => void = () => {}
+    const firstWriteHold = new Promise<void>(resolve => {
+      releaseFirstWrite = resolve
+    })
+    let signalFirstStarted: () => void = () => {}
+    const firstStarted = new Promise<void>(resolve => {
+      signalFirstStarted = resolve
+    })
+    mockWriteHook = async (callIndex: number) => {
+      if (callIndex === 0) {
+        signalFirstStarted()
+        await firstWriteHold
+      }
+    }
+
+    const first = writeThemeMode('light')
+    const second = writeDefaultScreen('assets')
+
+    // Wait until the first setText is in flight, then prove the second has not
+    // started while the first is still held open.
+    await firstStarted
+    expect(mockWriteCallOrder).toEqual(['start:0'])
+
+    releaseFirstWrite()
+    await Promise.all([first, second])
+
+    expect(mockWriteCallOrder).toEqual(['start:0', 'end:0', 'start:1', 'end:1'])
+
+    const file = readFile()
+    expect(file.themeMode).toBe('light')
+    expect(file.defaultScreen).toBe('assets')
+  })
+
+  it('does not let a failed write block later writes', async () => {
+    mockFiles[FILENAME] = JSON.stringify({})
+    const { initDeviceSettings, writeDefaultScreen, writeThemeMode } =
+      freshModule()
+    await initDeviceSettings()
+
+    mockFailWrites = 1
+    await expect(writeThemeMode('light')).rejects.toThrow('disk full')
+    await writeDefaultScreen('assets')
+
+    const file = readFile()
+    expect(file.defaultScreen).toBe('assets')
+    // The failed write's patch stayed in memory, so the next one carries it.
+    expect(file.themeMode).toBe('light')
+  })
+})
diff --git a/src/__tests__/actions/RequestReviewActions.test.ts b/src/__tests__/actions/RequestReviewActions.test.ts
index e064e05d111..e2b5c80bd4c 100644
--- a/src/__tests__/actions/RequestReviewActions.test.ts
+++ b/src/__tests__/actions/RequestReviewActions.test.ts
@@ -22,8 +22,9 @@ import {
 import type { RootState } from '../../reducers/RootReducer'
 import type { LocalAccountSettings, ReviewTriggerData } from '../../types/types'
 
-// Provide a virtual env.json so importing env.ts does not fail
-jest.mock('../../../env.json', () => ({}), { virtual: true })
+// Provide virtual local config files for importing config.json / keys.json
+jest.mock('../../../config.json', () => ({}), { virtual: true })
+jest.mock('../../../keys.json', () => ({}), { virtual: true })
 
 // Mock the store dispatch function
 const mockDispatch = jest.fn() as jest.MockedFunction<Dispatch<Action>>
diff --git a/src/__tests__/actions/TransactionExportActions.test.ts b/src/__tests__/actions/TransactionExportActions.test.ts
index cb590dcfacf..c23aeb6a78b 100644
--- a/src/__tests__/actions/TransactionExportActions.test.ts
+++ b/src/__tests__/actions/TransactionExportActions.test.ts
@@ -6,7 +6,7 @@ import {
   exportTransactionsToBitwave,
   exportTransactionsToCSVInner,
   exportTransactionsToQBO
-} from '../../actions/TransactionExportActions'
+} from '../../util/txExport'
 
 const csvResult = fs.readFileSync('./src/__tests__/exportCsvResult.csv', {
   encoding: 'utf8'
diff --git a/src/__tests__/cli/fetchPluginKeys.test.ts b/src/__tests__/cli/fetchPluginKeys.test.ts
new file mode 100644
index 00000000000..de45fbc17d3
--- /dev/null
+++ b/src/__tests__/cli/fetchPluginKeys.test.ts
@@ -0,0 +1,21 @@
+import { describe, expect, it } from '@jest/globals'
+
+import { fetchPluginKeys, getKeysAppId } from '../../cli/engine/fetchPluginKeys'
+
+describe('getKeysAppId', () => {
+  it('uses edge when the CLI appId is empty, matching the GUI infoRollup slug', () => {
+    expect(getKeysAppId('')).toBe('edge')
+  })
+
+  it('keeps an explicit CLI appId', () => {
+    expect(getKeysAppId('co.edgesecure.app')).toBe('co.edgesecure.app')
+  })
+})
+
+describe('fetchPluginKeys', () => {
+  it('throws when neither a native signer nor apiKey/apiSecret is provided', async () => {
+    await expect(
+      fetchPluginKeys({ appId: '', testMode: true })
+    ).rejects.toThrow('No HMAC credentials available for infoRollup appKeys')
+  })
+})
diff --git a/src/__tests__/cli/keysConfig.test.ts b/src/__tests__/cli/keysConfig.test.ts
new file mode 100644
index 00000000000..affc39b2eeb
--- /dev/null
+++ b/src/__tests__/cli/keysConfig.test.ts
@@ -0,0 +1,17 @@
+import { describe, expect, it } from '@jest/globals'
+
+import { mergePluginApiKeys } from '../../cli/engine/keysConfig'
+
+describe('mergePluginApiKeys', () => {
+  it('lets the preferred object win field-by-field', () => {
+    expect(
+      mergePluginApiKeys(
+        { monero: { edgeApiKey: 'remote' } },
+        { monero: { edgeApiKey: 'local', apiKey: 'keep' }, bitcoin: true }
+      )
+    ).toEqual({
+      bitcoin: true,
+      monero: { apiKey: 'keep', edgeApiKey: 'remote' }
+    })
+  })
+})
diff --git a/src/__tests__/components/TransactionListTop.test.tsx b/src/__tests__/components/TransactionListTop.test.tsx
index 0d8e0d54472..e4e0ea5398b 100644
--- a/src/__tests__/components/TransactionListTop.test.tsx
+++ b/src/__tests__/components/TransactionListTop.test.tsx
@@ -4,7 +4,7 @@ import type { EdgeCurrencyInfo } from 'edge-core-js'
 import * as React from 'react'
 
 import { TransactionListTop } from '../../components/themed/TransactionListTop'
-import { ENV } from '../../env'
+import { CONFIG } from '../../config'
 import { makeFakeCurrencyConfig } from '../../util/fake/fakeCurrencyConfig'
 import { FakeProviders, type FakeState } from '../../util/fake/FakeProviders'
 import { fakeNavigation } from '../../util/fake/fakeSceneProps'
@@ -60,7 +60,7 @@ describe('TransactionListTop', () => {
   }
 
   it('should render', () => {
-    ENV.ENABLE_VISA_PROGRAM = false
+    CONFIG.ENABLE_VISA_PROGRAM = false
     const rendered = render(
       <FakeProviders initialState={fakeState}>
         <TransactionListTop
@@ -78,7 +78,7 @@ describe('TransactionListTop', () => {
   })
 
   it('should render (with ENABLE_VISA_PROGRAM)', () => {
-    ENV.ENABLE_VISA_PROGRAM = true
+    CONFIG.ENABLE_VISA_PROGRAM = true
     const rendered = render(
       <FakeProviders initialState={fakeState}>
         <TransactionListTop
diff --git a/src/__tests__/configKeysMerge.test.ts b/src/__tests__/configKeysMerge.test.ts
new file mode 100644
index 00000000000..9f8ed094133
--- /dev/null
+++ b/src/__tests__/configKeysMerge.test.ts
@@ -0,0 +1,324 @@
+import { describe, expect, it } from '@jest/globals'
+import fs from 'fs'
+import path from 'path'
+
+import {
+  asMergeableKeys,
+  deepMerge,
+  nestGlobalKeys,
+  redactKey,
+  redactValue,
+  resolvePluginMaps
+} from '../configKeysMerge'
+import { asConfigJson, asKeysJson } from '../configKeysSchema'
+
+describe('asMergeableKeys', () => {
+  it('accepts a partial overlay without defaulting absent fields', () => {
+    const payload = { guiApiKeys: { changelly: { apiKey: 'k' } } }
+    expect(asMergeableKeys(payload)).toEqual(payload)
+    expect(asMergeableKeys({})).toEqual({})
+  })
+
+  it('rejects a payload that is not an object', () => {
+    expect(() => asMergeableKeys(null)).toThrow('not an object')
+    expect(() => asMergeableKeys('nope')).toThrow('not an object')
+    expect(() => asMergeableKeys([])).toThrow('not an object')
+  })
+
+  it('rejects a plugin map that would replace the baked-in map', () => {
+    // deepMerge replaces instead of merging when the sides disagree on type, so
+    // any of these would drop every baked-in secret in that map.
+    expect(() => asMergeableKeys({ guiApiKeys: null })).toThrow('guiApiKeys')
+    expect(() => asMergeableKeys({ guiApiKeys: 'oops' })).toThrow('guiApiKeys')
+    expect(() => asMergeableKeys({ rampPlugins: [] })).toThrow('rampPlugins')
+  })
+
+  it('rejects __proto__ on the overlay and nested maps', () => {
+    expect(() => asMergeableKeys(JSON.parse('{"__proto__":{"x":1}}'))).toThrow(
+      'forbidden key'
+    )
+    expect(() =>
+      asMergeableKeys(JSON.parse('{"guiApiKeys":{"__proto__":{"x":1}}}'))
+    ).toThrow('forbidden key')
+  })
+})
+
+describe('deepMerge', () => {
+  it('merges plain objects recursively with the keys side winning', () => {
+    const config = { a: 1, b: { x: 1, y: 1 }, c: 'config' }
+    const keys = { b: { y: 2, z: 2 }, c: 'keys' }
+    expect(deepMerge(config, keys)).toEqual({
+      a: 1,
+      b: { x: 1, y: 2, z: 2 },
+      c: 'keys'
+    })
+  })
+
+  it('returns the defined side when the other is undefined', () => {
+    expect(deepMerge(undefined, { a: 1 })).toEqual({ a: 1 })
+    expect(deepMerge({ a: 1 }, undefined)).toEqual({ a: 1 })
+  })
+
+  it('replaces arrays and primitives wholesale', () => {
+    expect(deepMerge([1, 2], [3])).toEqual([3])
+    expect(deepMerge('a', 'b')).toBe('b')
+  })
+
+  it('skips __proto__, constructor, and prototype overlay keys', () => {
+    const overlay = JSON.parse('{"__proto__":{"polluted":true},"a":1}')
+    const merged = deepMerge({ a: 0 }, overlay) as Record<string, unknown>
+    expect(merged.a).toBe(1)
+    expect(Object.prototype.hasOwnProperty.call(merged, 'polluted')).toBe(false)
+    expect((merged as { polluted?: boolean }).polluted).toBeUndefined()
+  })
+})
+
+describe('nestGlobalKeys', () => {
+  it('moves flat partner keys under globalKeys', () => {
+    const nested = nestGlobalKeys({
+      EDGE_API_KEY: 'secret',
+      COINGECKO_API_KEY: 'cg',
+      AZTECO_API_KEY: 'az'
+    })
+    expect(nested.EDGE_API_KEY).toBe('secret')
+    expect(
+      Object.prototype.hasOwnProperty.call(nested, 'COINGECKO_API_KEY')
+    ).toBe(false)
+    expect(nested.globalKeys.COINGECKO_API_KEY).toBe('cg')
+    expect(nested.globalKeys.AZTECO_API_KEY).toBe('az')
+  })
+
+  it('prefers an existing nested value over a flat duplicate', () => {
+    const nested = nestGlobalKeys({
+      IP_API_KEY: 'flat',
+      globalKeys: { IP_API_KEY: 'nested' }
+    })
+    expect(nested.globalKeys.IP_API_KEY).toBe('nested')
+  })
+
+  it('lets a real flat value win over an empty nested slot', () => {
+    // `asGlobalKeys` defaults every missing field to '', so a keys.json that
+    // has been through a cleaner-config round-trip (which `npm run prepare`
+    // performs) carries a full globalKeys block of empty strings. Those must
+    // not shadow the real values still sitting flat at the top level.
+    const nested = nestGlobalKeys({
+      COINGECKO_API_KEY: 'cg-real',
+      IP_API_KEY: 'ip-real',
+      globalKeys: {
+        COINGECKO_API_KEY: '',
+        IP_API_KEY: '',
+        WALLETCONNECT_PROJECT_ID: 'wc-real'
+      }
+    })
+    expect(nested.globalKeys.COINGECKO_API_KEY).toBe('cg-real')
+    expect(nested.globalKeys.IP_API_KEY).toBe('ip-real')
+    expect(nested.globalKeys.WALLETCONNECT_PROJECT_ID).toBe('wc-real')
+  })
+
+  it('lets a real flat value win over a null nested slot', () => {
+    const nested = nestGlobalKeys({
+      IP_API_KEY: 'ip-real',
+      globalKeys: { IP_API_KEY: null }
+    })
+    expect(nested.globalKeys.IP_API_KEY).toBe('ip-real')
+  })
+})
+
+describe('resolvePluginMaps', () => {
+  it('uses the keys object when config enables a plugin with true', () => {
+    const config = { corePlugins: { bitcoin: true } }
+    const keys = { corePlugins: { bitcoin: { nowNodesApiKey: 'abc' } } }
+    const maps = resolvePluginMaps(config as any, keys)
+    expect(maps.corePlugins.bitcoin).toEqual({ nowNodesApiKey: 'abc' })
+  })
+
+  it('keeps true when config is true and keys has no entry', () => {
+    const config = { corePlugins: { bitcoin: true } }
+    const maps = resolvePluginMaps(config as any, {})
+    expect(maps.corePlugins.bitcoin).toBe(true)
+  })
+
+  it('keeps a disabled (false) core plugin disabled despite secrets', () => {
+    const config = { corePlugins: { bitcoin: false } }
+    const keys = { corePlugins: { bitcoin: { nowNodesApiKey: 'abc' } } }
+    const maps = resolvePluginMaps(config as any, keys)
+    expect(maps.corePlugins.bitcoin).toBe(false)
+  })
+
+  it('uses keys alone when config omits the plugin id', () => {
+    const keys = {
+      guiApiKeys: { banxa: { apiKey: 'def' } },
+      rampPlugins: { infinite: { orgId: 'org_1' } }
+    }
+    const maps = resolvePluginMaps({} as any, keys)
+    expect(maps.guiApiKeys.banxa).toEqual({ apiKey: 'def' })
+    expect(maps.rampPlugins.infinite).toEqual({ orgId: 'org_1' })
+  })
+
+  it('does not steal currency or swap ids out of guiApiKeys', () => {
+    const config = {
+      corePlugins: { bitcoin: true },
+      swapPlugins: { thorchain: true },
+      guiApiKeys: { banxa: true }
+    }
+    const keys = {
+      corePlugins: { bitcoin: { nowNodesApiKey: 'abc' } },
+      swapPlugins: { thorchain: { ninerealmsClientId: 'xyz' } },
+      guiApiKeys: { banxa: { apiKey: 'def' } }
+    }
+    const maps = resolvePluginMaps(config as any, keys)
+    expect(Object.keys(maps.guiApiKeys)).toEqual(['banxa'])
+    expect(maps.guiApiKeys.banxa).toEqual({ apiKey: 'def' })
+    expect(maps.corePlugins.bitcoin).toEqual({ nowNodesApiKey: 'abc' })
+    expect(maps.swapPlugins.thorchain).toEqual({ ninerealmsClientId: 'xyz' })
+  })
+
+  it('takes the full swap init object from keys when config is true', () => {
+    const config = { swapPlugins: { changelly: true } }
+    const keys = {
+      swapPlugins: { changelly: { partnerId: 'edge', apiKey: 'hunter2' } }
+    }
+    const maps = resolvePluginMaps(config as any, keys)
+    expect(maps.swapPlugins.changelly).toEqual({
+      partnerId: 'edge',
+      apiKey: 'hunter2'
+    })
+  })
+})
+
+describe('redaction', () => {
+  it('redactKey truncates strings to at most 8 characters', () => {
+    expect(redactKey('supersecretlongkey')).toBe('supersec')
+    expect(
+      (redactKey('supersecretlongkey') as string).length
+    ).toBeLessThanOrEqual(8)
+  })
+
+  it('redactKey leaves non-strings untouched', () => {
+    expect(redactKey(12345)).toBe(12345)
+    expect(redactKey(true)).toBe(true)
+  })
+
+  it('redactValue recursively truncates every string', () => {
+    const input = {
+      apiKey: 'longsecretvalue',
+      nested: { token: 'anothersecret', list: ['itemvaluelong'] },
+      count: 42,
+      enabled: true
+    }
+    expect(redactValue(input)).toEqual({
+      apiKey: 'longsecr',
+      nested: { token: 'anothers', list: ['itemvalu'] },
+      count: 42,
+      enabled: true
+    })
+  })
+})
+
+const PLUGIN_MAPS = [
+  'corePlugins',
+  'swapPlugins',
+  'guiApiKeys',
+  'rampPlugins'
+] as const
+
+/** Retired providers that must not appear in either file. */
+const DROPPED_PROVIDERS = ['bity', 'ionia', 'ionia-staging', 'kado', 'kadoOtc']
+
+/**
+ * Invariants on the real split outputs. Skipped when the files are absent
+ * (CI without local secrets); developers and Jenkins checkouts that ship
+ * config.json / keys.json exercise them.
+ */
+describe('config.json and keys.json', () => {
+  const root = path.join(__dirname, '../..')
+  const configPath = path.join(root, 'config.json')
+  const keysPath = path.join(root, 'keys.json')
+  const present = fs.existsSync(configPath) && fs.existsSync(keysPath)
+
+  const config: Record<string, unknown> = present
+    ? JSON.parse(fs.readFileSync(configPath, 'utf8'))
+    : {}
+  const keys: Record<string, unknown> = present
+    ? JSON.parse(fs.readFileSync(keysPath, 'utf8'))
+    : {}
+
+  const itIfPresent = present ? it : it.skip
+
+  itIfPresent('parse with asConfigJson / asKeysJson', () => {
+    expect(() => asConfigJson.withRest(config)).not.toThrow()
+    expect(() => asKeysJson.withRest(keys)).not.toThrow()
+  })
+
+  itIfPresent('keeps only boolean flags in config plugin maps', () => {
+    for (const mapName of PLUGIN_MAPS) {
+      const map = config[mapName]
+      expect(map == null || typeof map === 'object').toBe(true)
+      for (const [id, value] of Object.entries(
+        (map ?? {}) as Record<string, unknown>
+      )) {
+        expect({ map: mapName, id, value }).toEqual({
+          map: mapName,
+          id,
+          value: expect.any(Boolean)
+        })
+      }
+    }
+  })
+
+  itIfPresent('puts no credential material in config.json top-level', () => {
+    const secretName =
+      /(API_KEY|API_SECRET|SECRET|TOKEN|DSN|ACCOUNT_ID|SENTRY_)/i
+    for (const key of Object.keys(config)) {
+      if ((PLUGIN_MAPS as readonly string[]).includes(key)) continue
+      expect({ key, looksSecret: secretName.test(key) }).toEqual({
+        key,
+        looksSecret: false
+      })
+    }
+  })
+
+  itIfPresent('omits retired providers from both files', () => {
+    for (const id of DROPPED_PROVIDERS) {
+      const configMap = (config.guiApiKeys ?? {}) as Record<string, unknown>
+      const keysMap = (keys.guiApiKeys ?? {}) as Record<string, unknown>
+      expect(configMap[id]).toBeUndefined()
+      expect(keysMap[id]).toBeUndefined()
+    }
+  })
+
+  itIfPresent('omits unused ZEC_NODE from both files', () => {
+    expect(config.ZEC_NODE).toBeUndefined()
+    expect(keys.ZEC_NODE).toBeUndefined()
+  })
+
+  itIfPresent('resolves plugin maps without throwing', () => {
+    const cleanedConfig = asConfigJson.withRest(config)
+    const cleanedKeys = nestGlobalKeys(
+      asKeysJson.withRest(keys) as unknown as Record<string, unknown>
+    )
+    const maps = resolvePluginMaps(cleanedConfig, cleanedKeys)
+    expect(maps.corePlugins).toBeDefined()
+    expect(maps.swapPlugins).toBeDefined()
+    expect(maps.guiApiKeys).toBeDefined()
+    expect(maps.rampPlugins).toBeDefined()
+  })
+
+  itIfPresent('does not put currency or swap ids in guiApiKeys', () => {
+    const coreIds = Object.keys((config.corePlugins ?? {}) as object)
+    const swapIds = Object.keys((config.swapPlugins ?? {}) as object)
+    const guiConfig = (config.guiApiKeys ?? {}) as Record<string, unknown>
+    const guiKeys = (keys.guiApiKeys ?? {}) as Record<string, unknown>
+    for (const id of [...coreIds, ...swapIds]) {
+      expect(guiConfig[id]).toBeUndefined()
+      expect(guiKeys[id]).toBeUndefined()
+    }
+  })
+
+  itIfPresent('keeps WalletConnect out of guiApiKeys', () => {
+    const guiConfig = (config.guiApiKeys ?? {}) as Record<string, unknown>
+    const guiKeys = (keys.guiApiKeys ?? {}) as Record<string, unknown>
+    expect(guiConfig.walletconnect).toBeUndefined()
+    expect(guiKeys.walletconnect).toBeUndefined()
+  })
+})
diff --git a/src/__tests__/fillTxsFiat.test.ts b/src/__tests__/fillTxsFiat.test.ts
new file mode 100644
index 00000000000..0bca24efb9b
--- /dev/null
+++ b/src/__tests__/fillTxsFiat.test.ts
@@ -0,0 +1,108 @@
+import { describe, expect, it, jest } from '@jest/globals'
+import type { EdgeCurrencyWallet, EdgeTransaction } from 'edge-core-js'
+
+import { fillTxsFiat, toIsoFiatCode } from '../util/fillTxsFiat'
+
+jest.mock('../util/exchangeRates', () => ({
+  getHistoricalCryptoRate: jest.fn(
+    async (_pluginId: string, _tokenId: unknown, isoFiat: string) => {
+      if (isoFiat === 'iso:EUR') return 40000
+      return 50000
+    }
+  )
+}))
+
+function makeWallet(): EdgeCurrencyWallet {
+  // Incomplete core wallet — fillTxsFiat only reads currencyInfo and
+  // currencyConfig, so the cast says what the shape really is.
+  const wallet = {
+    currencyInfo: { pluginId: 'bitcoin' },
+    currencyConfig: {
+      currencyInfo: {
+        pluginId: 'bitcoin',
+        denominations: [{ name: 'BTC', multiplier: '100000000', symbol: '₿' }]
+      },
+      allTokens: {}
+    }
+  }
+  return wallet as unknown as EdgeCurrencyWallet
+}
+
+function makeTx(overrides: Partial<EdgeTransaction> = {}): EdgeTransaction {
+  const tx: EdgeTransaction = {
+    blockHeight: 1,
+    currencyCode: 'BTC',
+    date: 1700000000,
+    deviceDescription: 'test',
+    isSend: false,
+    memos: [],
+    nativeAmount: '100000000',
+    networkFee: '0',
+    networkFees: [],
+    ourReceiveAddresses: [],
+    parentNetworkFee: '0',
+    signedTx: '',
+    tokenId: null,
+    txid: 'txid',
+    walletId: '',
+    ...overrides
+  }
+  return tx
+}
+
+describe('fillTxsFiat', () => {
+  it('fills missing isoFiat from the historical rate', async () => {
+    const tx = makeTx({ metadata: { name: 'Keep me' } })
+    await fillTxsFiat({
+      wallet: makeWallet(),
+      tokenId: null,
+      isoFiat: 'iso:USD',
+      txs: [tx]
+    })
+    expect(tx.metadata?.name).toBe('Keep me')
+    expect(tx.metadata?.exchangeAmount?.['iso:USD']).toBe(50000)
+  })
+
+  it('skips txs that already have a non-zero amount for that fiat', async () => {
+    const tx = makeTx({
+      metadata: { exchangeAmount: { 'iso:USD': 12.5 } }
+    })
+    await fillTxsFiat({
+      wallet: makeWallet(),
+      tokenId: null,
+      isoFiat: 'iso:USD',
+      txs: [tx]
+    })
+    expect(tx.metadata?.exchangeAmount?.['iso:USD']).toBe(12.5)
+  })
+
+  it('fills an override fiat without dropping other stored amounts', async () => {
+    const tx = makeTx({
+      metadata: { exchangeAmount: { 'iso:USD': 12.5 } }
+    })
+    await fillTxsFiat({
+      wallet: makeWallet(),
+      tokenId: null,
+      isoFiat: 'iso:EUR',
+      txs: [tx]
+    })
+    expect(tx.metadata?.exchangeAmount?.['iso:USD']).toBe(12.5)
+    expect(tx.metadata?.exchangeAmount?.['iso:EUR']).toBe(40000)
+  })
+})
+
+describe('toIsoFiatCode', () => {
+  it('accepts a 3-letter code, optional iso: prefix, and any case', () => {
+    expect(toIsoFiatCode('USD')).toBe('iso:USD')
+    expect(toIsoFiatCode('eur')).toBe('iso:EUR')
+    expect(toIsoFiatCode('iso:GBP')).toBe('iso:GBP')
+    expect(toIsoFiatCode('  cad ')).toBe('iso:CAD')
+  })
+
+  it('rejects non-fiat codes', () => {
+    expect(toIsoFiatCode('')).toBeUndefined()
+    expect(toIsoFiatCode('US')).toBeUndefined()
+    expect(toIsoFiatCode('USDT')).toBeUndefined()
+    expect(toIsoFiatCode('123')).toBeUndefined()
+  })
+})
diff --git a/src/__tests__/modals/__snapshots__/HelpModal.test.tsx.snap b/src/__tests__/modals/__snapshots__/HelpModal.test.tsx.snap
index a7be2947056..33a047f2511 100644
--- a/src/__tests__/modals/__snapshots__/HelpModal.test.tsx.snap
+++ b/src/__tests__/modals/__snapshots__/HelpModal.test.tsx.snap
@@ -996,7 +996,7 @@ exports[`HelpModal should render with loading props 1`] = `
               ]
             }
           >
-            Version undefined
+            Version 1.2.3
           </Text>
           <Text
             adjustsFontSizeToFit={true}
diff --git a/src/__tests__/nodeLocale.test.ts b/src/__tests__/nodeLocale.test.ts
new file mode 100644
index 00000000000..dbf3067db36
--- /dev/null
+++ b/src/__tests__/nodeLocale.test.ts
@@ -0,0 +1,100 @@
+import { afterEach, describe, expect, test } from '@jest/globals'
+
+import { applyLocale } from '../locales/bootLocale'
+import {
+  detectNodeLocale,
+  localeTagsMatch,
+  normalizePosixLocale,
+  numberSeparators,
+  parseLocaleFlag
+} from '../locales/nodeLocale'
+import { lstrings, selectLocale } from '../locales/strings'
+
+describe('normalizePosixLocale', () => {
+  test('strips encoding and modifier', () => {
+    expect(normalizePosixLocale('es_MX.UTF-8@euro')).toBe('es-MX')
+  })
+  test('C and POSIX become en-US', () => {
+    expect(normalizePosixLocale('C')).toBe('en-US')
+    expect(normalizePosixLocale('POSIX')).toBe('en-US')
+    expect(normalizePosixLocale('')).toBe('en-US')
+  })
+  test('keeps hyphenated tags', () => {
+    expect(normalizePosixLocale('de-DE')).toBe('de-DE')
+  })
+})
+
+describe('parseLocaleFlag', () => {
+  test('reads --locale value', () => {
+    expect(parseLocaleFlag(['--locale', 'fr'])).toBe('fr')
+  })
+  test('reads --locale=', () => {
+    expect(parseLocaleFlag(['--locale=ja'])).toBe('ja')
+  })
+})
+
+describe('detectNodeLocale', () => {
+  test('argv wins over env', () => {
+    const source = detectNodeLocale({
+      argv: ['--locale', 'de-DE'],
+      env: { LANG: 'fr_FR.UTF-8', EDGE_CLI_LOCALE: 'es' }
+    })
+    expect(source.languageTag).toBe('de-DE')
+  })
+  test('config wins over EDGE_CLI_LOCALE', () => {
+    const source = detectNodeLocale({
+      argv: [],
+      env: { EDGE_CLI_LOCALE: 'ja' },
+      configLocale: 'it'
+    })
+    expect(source.languageTag).toBe('it')
+  })
+  test('LANG es_MX.UTF-8', () => {
+    const source = detectNodeLocale({
+      argv: [],
+      env: { LANG: 'es_MX.UTF-8' }
+    })
+    expect(source.languageTag).toBe('es-MX')
+  })
+})
+
+describe('numberSeparators', () => {
+  test('de-DE uses comma decimal', () => {
+    const seps = numberSeparators('de-DE')
+    expect(seps.decimalSeparator).toBe(',')
+    expect(seps.groupingSeparator).toBe('.')
+  })
+})
+
+describe('selectLocale', () => {
+  afterEach(() => {
+    selectLocale('en')
+    applyLocale({
+      languageTag: 'en-US',
+      decimalSeparator: '.',
+      groupingSeparator: ','
+    })
+  })
+
+  test('de changes a known string', () => {
+    const english = lstrings.action_queue_display_unknown_message
+    const matched = selectLocale('de')
+    expect(matched).toBe(true)
+    expect(lstrings.action_queue_display_unknown_message).not.toBe(english)
+  })
+
+  test('zh_CN falls back to zh', () => {
+    expect(selectLocale('zh-CN')).toBe(true)
+  })
+
+  test('es-MX matches esMX table', () => {
+    expect(selectLocale('es-MX')).toBe(true)
+  })
+})
+
+describe('localeTagsMatch', () => {
+  test('hyphen vs underscore', () => {
+    expect(localeTagsMatch('en-US', 'en_US')).toBe(true)
+    expect(localeTagsMatch('de', 'fr')).toBe(false)
+  })
+})
diff --git a/src/__tests__/util/hmacAuth.test.ts b/src/__tests__/util/hmacAuth.test.ts
new file mode 100644
index 00000000000..7949d8e5593
--- /dev/null
+++ b/src/__tests__/util/hmacAuth.test.ts
@@ -0,0 +1,38 @@
+import { describe, expect, it } from '@jest/globals'
+
+import {
+  buildSignedRequestText,
+  hmacSha256,
+  signHmacAuthorization
+} from '../../util/hmacAuth'
+
+describe('hmacAuth', () => {
+  const secret = new Uint8Array(
+    Buffer.from('0123456789abcdef0123456789abcdef', 'hex')
+  )
+  const method = 'GET'
+  const url = '/v1/infoRollup/edge?os=ios&osVersion=18.0.0&appVersion=4.51.0'
+  const body = ''
+  const timestamp = '1723050000'
+  const apiKey = 'test-api-key'
+  const expectedSignatureBase64 = '81m1scHFo4b3NQytMq/oNMZNpegCG2y8+afEOJ67Vw4='
+
+  it('builds the signed request text', () => {
+    expect(buildSignedRequestText(method, url, body, timestamp)).toBe(
+      'GET\n/v1/infoRollup/edge?os=ios&osVersion=18.0.0&appVersion=4.51.0\n\n1723050000'
+    )
+  })
+
+  it('matches the shared HMAC-SHA256 fixture', () => {
+    const signedText = buildSignedRequestText(method, url, body, timestamp)
+    const digest = hmacSha256(signedText, secret)
+    const signature = Buffer.from(digest).toString('base64')
+    expect(signature).toBe(expectedSignatureBase64)
+  })
+
+  it('formats the Authorization header', () => {
+    expect(
+      signHmacAuthorization(method, url, body, timestamp, apiKey, secret)
+    ).toBe(`HMAC ${apiKey} ${expectedSignatureBase64}`)
+  })
+})
diff --git a/src/__tests__/util/keysServer.test.ts b/src/__tests__/util/keysServer.test.ts
new file mode 100644
index 00000000000..9213930026f
--- /dev/null
+++ b/src/__tests__/util/keysServer.test.ts
@@ -0,0 +1,203 @@
+import { describe, expect, it, jest } from '@jest/globals'
+import type { EdgeFetchFunction } from 'edge-core-js'
+
+import { signHmacAuthorization } from '../../util/hmacAuth'
+import { fetchRemoteKeys } from '../../util/keysServer'
+
+const apiKey = 'test-api-key'
+const secret = new Uint8Array(
+  Buffer.from('0123456789abcdef0123456789abcdef', 'hex')
+)
+
+const query = {
+  os: 'ios',
+  osVersion: '18.0.0',
+  appVersion: '4.51.0'
+}
+
+const rollupPath = (appId: string): string =>
+  `/v1/infoRollup/${encodeURIComponent(appId)}?os=${query.os}&osVersion=${
+    query.osVersion
+  }&appVersion=${query.appVersion}`
+
+const makeOkResponse = (body: unknown): Response =>
+  ({
+    ok: true,
+    status: 200,
+    json: async () => body,
+    text: async () => JSON.stringify(body)
+  } as unknown as Response)
+
+describe('fetchRemoteKeys', () => {
+  it('requests v1/infoRollup with a URL-encoded appId', async () => {
+    const infoFetch = jest.fn<EdgeFetchFunction>(async () =>
+      makeOkResponse({ appKeys: {} })
+    )
+
+    await fetchRemoteKeys({
+      apiKey,
+      secret,
+      appId: 'co.edgesecure.app',
+      infoFetch,
+      ...query
+    })
+
+    expect(infoFetch).toHaveBeenCalled()
+    const url = String(infoFetch.mock.calls[0][0])
+    const parsed = new URL(url)
+    expect(parsed.pathname).toBe('/v1/infoRollup/co.edgesecure.app')
+    expect(parsed.searchParams.get('os')).toBe('ios')
+    expect(url).toContain(rollupPath('co.edgesecure.app').slice(1))
+  })
+
+  it('URL-encodes special characters in appId', async () => {
+    const infoFetch = jest.fn<EdgeFetchFunction>(async () =>
+      makeOkResponse({ appKeys: {} })
+    )
+
+    await fetchRemoteKeys({
+      apiKey,
+      secret,
+      appId: 'app id/with?weird=chars',
+      infoFetch,
+      ...query
+    })
+
+    const url = String(infoFetch.mock.calls[0][0])
+    expect(url).toContain(
+      `/v1/infoRollup/${encodeURIComponent('app id/with?weird=chars')}?`
+    )
+  })
+
+  it('signs Authorization with a leading slash on the path', async () => {
+    const infoFetch = jest.fn<EdgeFetchFunction>(async () =>
+      makeOkResponse({ appKeys: {} })
+    )
+    const appId = 'edge'
+
+    await fetchRemoteKeys({ apiKey, secret, appId, infoFetch, ...query })
+
+    const opts = infoFetch.mock.calls[0][1] as RequestInit
+    const headers = opts.headers as Record<string, string>
+    const timestamp = headers['X-Timestamp']
+    const signPath = rollupPath(appId)
+    expect(headers.Authorization).toBe(
+      signHmacAuthorization('GET', signPath, '', timestamp, apiKey, secret)
+    )
+  })
+
+  it('omits x-attestation-token when the token is missing or empty', async () => {
+    const infoFetch = jest.fn<EdgeFetchFunction>(async () =>
+      makeOkResponse({ appKeys: {} })
+    )
+
+    await fetchRemoteKeys({
+      apiKey,
+      secret,
+      appId: 'edge',
+      infoFetch,
+      ...query
+    })
+    await fetchRemoteKeys({
+      apiKey,
+      secret,
+      appId: 'edge',
+      infoFetch,
+      attestationToken: '',
+      ...query
+    })
+
+    for (const call of infoFetch.mock.calls) {
+      const headers = (call[1] as RequestInit).headers as Record<string, string>
+      expect(headers['x-attestation-token']).toBeUndefined()
+    }
+  })
+
+  it('includes x-attestation-token when the token is non-empty', async () => {
+    const infoFetch = jest.fn<EdgeFetchFunction>(async () =>
+      makeOkResponse({ appKeys: {} })
+    )
+
+    await fetchRemoteKeys({
+      apiKey,
+      secret,
+      appId: 'edge',
+      infoFetch,
+      attestationToken: 'attested-token',
+      ...query
+    })
+
+    const headers = (infoFetch.mock.calls[0][1] as RequestInit)
+      .headers as Record<string, string>
+    expect(headers['x-attestation-token']).toBe('attested-token')
+  })
+
+  it('passes through appKeys and assuranceLevel', async () => {
+    const infoFetch = jest.fn<EdgeFetchFunction>(async () =>
+      makeOkResponse({
+        appKeys: { AZTECO_API_KEY: 'k' },
+        assuranceLevel: 'hardware'
+      })
+    )
+
+    const result = await fetchRemoteKeys({
+      apiKey,
+      secret,
+      appId: 'edge',
+      infoFetch,
+      ...query
+    })
+
+    expect(result.keys).toEqual({ AZTECO_API_KEY: 'k' })
+    expect(result.assuranceLevel).toBe('hardware')
+  })
+
+  it('throws with the status on a non-OK response', async () => {
+    const infoFetch = jest.fn<EdgeFetchFunction>(
+      async () =>
+        ({
+          ok: false,
+          status: 503,
+          json: async () => ({}),
+          text: async () => 'unavailable'
+        } as unknown as Response)
+    )
+
+    await expect(
+      fetchRemoteKeys({ apiKey, secret, appId: 'edge', infoFetch, ...query })
+    ).rejects.toThrow('fetchRemoteKeys 503: unavailable')
+  })
+
+  it('rejects a malformed body where appKeys is a string', async () => {
+    const infoFetch = jest.fn<EdgeFetchFunction>(async () =>
+      makeOkResponse({ appKeys: 'not-an-object' })
+    )
+
+    await expect(
+      fetchRemoteKeys({ apiKey, secret, appId: 'edge', infoFetch, ...query })
+    ).rejects.toThrow('not an object')
+  })
+
+  it('signs via apiSigner when provided', async () => {
+    const infoFetch = jest.fn<EdgeFetchFunction>(async () =>
+      makeOkResponse({ appKeys: {} })
+    )
+    const apiSigner = {
+      signMessage: async () => ({
+        apiKey: 'native-key',
+        signature: 'native-sig'
+      })
+    }
+
+    await fetchRemoteKeys({
+      apiSigner,
+      appId: 'edge',
+      infoFetch,
+      ...query
+    })
+
+    const opts = infoFetch.mock.calls[0][1] as RequestInit
+    const headers = opts.headers as Record<string, string>
+    expect(headers.Authorization).toBe('HMAC native-key native-sig')
+  })
+})
diff --git a/src/__tests__/util/keysStore.test.ts b/src/__tests__/util/keysStore.test.ts
new file mode 100644
index 00000000000..b8901aeffd8
--- /dev/null
+++ b/src/__tests__/util/keysStore.test.ts
@@ -0,0 +1,452 @@
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  jest
+} from '@jest/globals'
+
+import type * as ConfigModule from '../../config'
+import type * as KeysModule from '../../keys'
+import type * as PluginMapsModule from '../../pluginMaps'
+import type * as KeysStore from '../../util/keysStore'
+
+// Controlled baked-in halves so isolateModules gets deterministic KEYS/CONFIG.
+jest.mock(
+  '../../../config.json',
+  () => ({
+    APP_CONFIG: 'edge',
+    USE_FAKE_CORE: false,
+    POSTHOG_API_HOST: 'https://app.posthog.com',
+    YOLO_USERNAME: 'baked-yolo',
+    corePlugins: {},
+    swapPlugins: {},
+    guiApiKeys: {},
+    rampPlugins: {}
+  }),
+  { virtual: true }
+)
+
+jest.mock(
+  '../../../keys.json',
+  () => ({
+    EDGE_API_KEY: 'test-api-key',
+    EDGE_API_SECRET: '0123456789abcdef0123456789abcdef',
+    SENTRY_DSN_URL: 'https://baked.sentry',
+    // Flat global keys (keys.json is the local global-keys set):
+    AZTECO_API_KEY: 'baked-azteco',
+    STAKEKIT_API_KEY: 'baked-stakekit',
+    POSTHOG_API_KEY: 'baked-posthog',
+    guiApiKeys: {
+      moonpay: 'baked-moonpay'
+    },
+    rampPlugins: {}
+  }),
+  { virtual: true }
+)
+
+const mockInitDeviceSettings = jest.fn(async (..._args: unknown[]) => {})
+const mockAwaitDeviceSettingsDisk = jest.fn(async (..._args: unknown[]) => {})
+const mockGetKeysCache = jest.fn(
+  () =>
+    undefined as
+      | undefined
+      | {
+          keys: unknown
+          fetchedAt: number
+          assuranceLevel: string
+        }
+)
+const mockWriteKeysCache = jest.fn(
+  async (_entry: {
+    keys: unknown
+    fetchedAt: number
+    assuranceLevel: string
+  }) => {}
+)
+
+jest.mock('../../actions/DeviceSettingsActions', () => ({
+  initDeviceSettings: async (...args: unknown[]) => {
+    await mockInitDeviceSettings(...args)
+  },
+  awaitDeviceSettingsDisk: async (...args: unknown[]) => {
+    await mockAwaitDeviceSettingsDisk(...args)
+  },
+  getKeysCache: () => mockGetKeysCache(),
+  writeKeysCache: async (...args: unknown[]) => {
+    await mockWriteKeysCache(
+      ...(args as [
+        {
+          keys: unknown
+          fetchedAt: number
+          assuranceLevel: string
+        }
+      ])
+    )
+  }
+}))
+
+const mockFetchRemoteKeys = jest.fn<
+  (opts: unknown) => Promise<{
+    keys: Record<string, unknown>
+    assuranceLevel?: string
+  }>
+>()
+
+jest.mock('../../util/keysServer', () => ({
+  fetchRemoteKeys: async (...args: unknown[]) =>
+    await mockFetchRemoteKeys(...(args as [unknown]))
+}))
+const mockGetAttestationToken = jest.fn(
+  async (_ms?: number) => undefined as string | undefined
+)
+
+jest.mock('../../util/attestation', () => ({
+  getAttestationToken: async (...args: unknown[]) =>
+    await mockGetAttestationToken(...(args as [number?]))
+}))
+
+const mockRebuildAllPlugins = jest.fn()
+
+jest.mock('../../util/corePlugins', () => ({
+  rebuildAllPlugins: () => mockRebuildAllPlugins()
+}))
+
+interface FreshModules {
+  keysStore: typeof KeysStore
+  config: typeof ConfigModule
+  keys: typeof KeysModule
+  pluginMaps: typeof PluginMapsModule
+}
+
+const freshModules = (): FreshModules => {
+  let keysStore: typeof KeysStore
+  let config: typeof ConfigModule
+  let keys: typeof KeysModule
+  let pluginMaps: typeof PluginMapsModule
+  jest.isolateModules(() => {
+    keysStore = require('../../util/keysStore')
+    config = require('../../config')
+    keys = require('../../keys')
+    pluginMaps = require('../../pluginMaps')
+  })
+  // @ts-expect-error assigned by the synchronous isolateModules callback
+  return { keysStore, config, keys, pluginMaps }
+}
+
+const flushMicrotasks = async (): Promise<void> => {
+  for (let i = 0; i < 20; i++) await Promise.resolve()
+}
+
+describe('keysStoreInternalsForTests', () => {
+  it('nests flat partner keys under globalKeys', () => {
+    const { keysStore } = freshModules()
+    const { nestGlobalKeys } = keysStore.keysStoreInternalsForTests
+
+    expect(
+      nestGlobalKeys({
+        AZTECO_API_KEY: 'from-remote',
+        KILN_MAINNET_API_KEY: 'kiln',
+        guiApiKeys: { moonpay: 'm' }
+      })
+    ).toEqual({
+      globalKeys: {
+        AZTECO_API_KEY: 'from-remote',
+        KILN_MAINNET_API_KEY: 'kiln'
+      },
+      guiApiKeys: { moonpay: 'm' }
+    })
+  })
+
+  it('keeps an existing globalKeys entry over a flat duplicate', () => {
+    const { keysStore } = freshModules()
+    const { nestGlobalKeys } = keysStore.keysStoreInternalsForTests
+
+    expect(
+      nestGlobalKeys({
+        AZTECO_API_KEY: 'flat-loses',
+        globalKeys: { AZTECO_API_KEY: 'nested-wins' }
+      })
+    ).toEqual({ globalKeys: { AZTECO_API_KEY: 'nested-wins' } })
+  })
+
+  it('strips local-only fields including the flat POSTHOG_API_KEY', () => {
+    const { keysStore } = freshModules()
+    const { stripLocalOnlyFields } = keysStore.keysStoreInternalsForTests
+
+    expect(
+      stripLocalOnlyFields({
+        EDGE_API_KEY: 'remote-key',
+        EDGE_API_SECRET: 'deadbeef',
+        SENTRY_DSN_URL: 'https://remote.sentry',
+        BUGSNAG_API_KEY: 'bugsnag',
+        POSTHOG_API_KEY: 'ph',
+        AZTECO_API_KEY: 'keep-me',
+        guiApiKeys: {
+          moonpay: 'keep-moonpay'
+        }
+      })
+    ).toEqual({
+      AZTECO_API_KEY: 'keep-me',
+      guiApiKeys: {
+        moonpay: 'keep-moonpay'
+      }
+    })
+  })
+
+  it('drops config-only fields via keepKeysFields', () => {
+    const { keysStore } = freshModules()
+    const { keepKeysFields } = keysStore.keysStoreInternalsForTests
+
+    expect(
+      keepKeysFields({
+        USE_FAKE_CORE: true,
+        DEBUG_CORE: true,
+        AZTECO_API_KEY: 'az',
+        guiApiKeys: { moonpay: 'm' }
+      })
+    ).toEqual({
+      AZTECO_API_KEY: 'az',
+      guiApiKeys: { moonpay: 'm' }
+    })
+  })
+})
+
+describe('initializeKeys', () => {
+  beforeEach(() => {
+    jest.clearAllMocks()
+    mockInitDeviceSettings.mockImplementation(async () => {})
+    mockAwaitDeviceSettingsDisk.mockImplementation(async () => {})
+    mockGetKeysCache.mockReturnValue(undefined)
+    mockWriteKeysCache.mockImplementation(async () => {})
+    mockGetAttestationToken.mockResolvedValue(undefined)
+    mockFetchRemoteKeys.mockReset()
+  })
+
+  afterEach(() => {
+    jest.useRealTimers()
+  })
+
+  it('uses the cache tier on a mergeable cache hit', async () => {
+    mockGetKeysCache.mockReturnValue({
+      keys: { globalKeys: { AZTECO_API_KEY: 'from-cache' } },
+      fetchedAt: Date.now(),
+      assuranceLevel: 'attested'
+    })
+    // Background refresh for next launch.
+    mockFetchRemoteKeys.mockResolvedValue({
+      keys: { globalKeys: { AZTECO_API_KEY: 'bg-refresh' } },
+      assuranceLevel: 'attested'
+    })
+
+    const { keysStore, keys } = freshModules()
+    await keysStore.initializeKeys()
+
+    expect(keysStore.getKeysTier()).toBe('cache')
+    expect(keys.globalKeys.AZTECO_API_KEY).toBe('from-cache')
+    expect(mockRebuildAllPlugins).toHaveBeenCalled()
+  })
+
+  it('uses an aged cache as a warm start (cache never expires)', async () => {
+    mockGetKeysCache.mockReturnValue({
+      keys: { globalKeys: { AZTECO_API_KEY: 'from-old-cache' } },
+      // Far older than any former TTL window.
+      fetchedAt: Date.now() - 365 * 24 * 60 * 60 * 1000,
+      assuranceLevel: 'attested'
+    })
+    mockFetchRemoteKeys.mockResolvedValue({
+      keys: { globalKeys: { AZTECO_API_KEY: 'bg-refresh' } },
+      assuranceLevel: 'attested'
+    })
+
+    const { keysStore, keys } = freshModules()
+    await keysStore.initializeKeys()
+
+    expect(keysStore.getKeysTier()).toBe('cache')
+    expect(keys.globalKeys.AZTECO_API_KEY).toBe('from-old-cache')
+    // Warm path still schedules a background refresh for the next launch.
+    expect(mockFetchRemoteKeys).toHaveBeenCalled()
+  })
+
+  it('falls through an unmergeable cache to a remote fetch', async () => {
+    mockGetKeysCache.mockReturnValue({
+      keys: { guiApiKeys: 'not-an-object' },
+      fetchedAt: 1,
+      assuranceLevel: 'default'
+    })
+    mockFetchRemoteKeys.mockResolvedValue({
+      keys: { globalKeys: { AZTECO_API_KEY: 'from-remote' } },
+      assuranceLevel: 'unattested'
+    })
+
+    const { keysStore, keys } = freshModules()
+    await keysStore.initializeKeys()
+
+    expect(keysStore.getKeysTier()).toBe('remote')
+    expect(keys.globalKeys.AZTECO_API_KEY).toBe('from-remote')
+    expect(mockWriteKeysCache).toHaveBeenCalled()
+  })
+
+  it('uses the remote tier on a successful cold fetch', async () => {
+    mockFetchRemoteKeys.mockResolvedValue({
+      keys: { globalKeys: { AZTECO_API_KEY: 'from-remote' } },
+      assuranceLevel: 'attested'
+    })
+
+    const { keysStore, keys } = freshModules()
+    await keysStore.initializeKeys()
+
+    expect(keysStore.getKeysTier()).toBe('remote')
+    expect(keys.globalKeys.AZTECO_API_KEY).toBe('from-remote')
+    expect(mockFetchRemoteKeys).toHaveBeenCalledWith(
+      expect.objectContaining({ appId: 'edge' })
+    )
+    expect(mockWriteKeysCache).toHaveBeenCalledWith(
+      expect.objectContaining({
+        keys: { globalKeys: { AZTECO_API_KEY: 'from-remote' } },
+        assuranceLevel: 'attested'
+      })
+    )
+  })
+
+  it('keeps unrelated baked-in secrets when the remote payload is partial', async () => {
+    mockFetchRemoteKeys.mockResolvedValue({
+      keys: { globalKeys: { AZTECO_API_KEY: 'from-remote' } },
+      assuranceLevel: 'unattested'
+    })
+
+    const { keysStore, keys, pluginMaps } = freshModules()
+    await keysStore.initializeKeys()
+
+    expect(keys.globalKeys.AZTECO_API_KEY).toBe('from-remote')
+    expect(keys.globalKeys.STAKEKIT_API_KEY).toBe('baked-stakekit')
+    expect((pluginMaps.pluginMaps.guiApiKeys as any).moonpay).toBe(
+      'baked-moonpay'
+    )
+  })
+
+  it('does not let USE_FAKE_CORE from a payload reach CONFIG', async () => {
+    mockFetchRemoteKeys.mockResolvedValue({
+      keys: {
+        USE_FAKE_CORE: true,
+        globalKeys: { AZTECO_API_KEY: 'from-remote' }
+      },
+      assuranceLevel: 'unattested'
+    })
+
+    const { keysStore, config, keys } = freshModules()
+    expect(config.CONFIG.USE_FAKE_CORE).toBe(false)
+    await keysStore.initializeKeys()
+
+    expect(keysStore.getKeysTier()).toBe('remote')
+    expect(config.CONFIG.USE_FAKE_CORE).toBe(false)
+    expect(keys.globalKeys.AZTECO_API_KEY).toBe('from-remote')
+  })
+
+  it('nests remote globalKeys but keeps the top-level baked POSTHOG_API_KEY', async () => {
+    mockFetchRemoteKeys.mockResolvedValue({
+      keys: {
+        globalKeys: {
+          COINGECKO_API_KEY: 'remote-coingecko',
+          KILN_MAINNET_API_KEY: 'remote-kiln',
+          // A hostile server must not be able to rotate the telemetry key.
+          POSTHOG_API_KEY: 'evil-posthog'
+        }
+      },
+      assuranceLevel: 'hardware'
+    })
+
+    const { keysStore, keys } = freshModules()
+    await keysStore.initializeKeys()
+
+    expect(keysStore.getKeysTier()).toBe('remote')
+    expect(keys.globalKeys.COINGECKO_API_KEY).toBe('remote-coingecko')
+    expect(keys.globalKeys.KILN_MAINNET_API_KEY).toBe('remote-kiln')
+    // The top-level, local-only POSTHOG_API_KEY survives untouched.
+    expect(keys.KEYS.POSTHOG_API_KEY).toBe('baked-posthog')
+  })
+
+  it('strips EDGE_API_SECRET from a remote payload before applying', async () => {
+    const remoteSecret = new Uint8Array(32).fill(0xaa)
+    mockFetchRemoteKeys.mockResolvedValue({
+      keys: {
+        EDGE_API_SECRET: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+        globalKeys: { AZTECO_API_KEY: 'from-remote' }
+      },
+      assuranceLevel: 'unattested'
+    })
+
+    const { keysStore, keys } = freshModules()
+    const before = keys.KEYS.EDGE_API_SECRET
+    await keysStore.initializeKeys()
+
+    expect(keys.KEYS.EDGE_API_SECRET).toEqual(before)
+    expect(keys.KEYS.EDGE_API_SECRET).not.toEqual(remoteSecret)
+    expect(keys.globalKeys.AZTECO_API_KEY).toBe('from-remote')
+    expect(mockWriteKeysCache).toHaveBeenCalledWith(
+      expect.objectContaining({
+        keys: { globalKeys: { AZTECO_API_KEY: 'from-remote' } }
+      })
+    )
+    expect(mockWriteKeysCache.mock.calls[0][0].keys).not.toHaveProperty(
+      'EDGE_API_SECRET'
+    )
+  })
+
+  it('never rejects even when the fetch fails', async () => {
+    mockFetchRemoteKeys.mockRejectedValue(new Error('network down'))
+
+    const { keysStore } = freshModules()
+    await expect(keysStore.initializeKeys()).resolves.toBeUndefined()
+    expect(keysStore.getKeysTier()).toBe('baked-in')
+  })
+
+  it('never rejects even when awaitDeviceSettingsDisk throws', async () => {
+    mockAwaitDeviceSettingsDisk.mockRejectedValue(new Error('disk broken'))
+
+    const { keysStore } = freshModules()
+    await expect(keysStore.initializeKeys()).resolves.toBeUndefined()
+  })
+
+  it('falls to baked-in on cold deadline expiry and still caches a late fetch', async () => {
+    jest.useFakeTimers()
+
+    let resolveFetch!: (value: {
+      keys: Record<string, unknown>
+      assuranceLevel?: string
+    }) => void
+    mockFetchRemoteKeys.mockImplementation(
+      async () =>
+        await new Promise(resolve => {
+          resolveFetch = resolve
+        })
+    )
+
+    const { keysStore } = freshModules()
+    const pending = keysStore.initializeKeys()
+
+    // COLD_TOTAL_TIMEOUT_MS = 5000 + 8000
+    await jest.advanceTimersByTimeAsync(13_000)
+    await pending
+
+    expect(keysStore.getKeysTier()).toBe('baked-in')
+    expect(mockWriteKeysCache).not.toHaveBeenCalled()
+
+    resolveFetch({
+      keys: { globalKeys: { AZTECO_API_KEY: 'late-remote' } },
+      assuranceLevel: 'unattested'
+    })
+    await flushMicrotasks()
+    // Allow the background cache write promise to settle.
+    await Promise.resolve()
+    await flushMicrotasks()
+
+    expect(mockWriteKeysCache).toHaveBeenCalledWith(
+      expect.objectContaining({
+        keys: { globalKeys: { AZTECO_API_KEY: 'late-remote' } },
+        assuranceLevel: 'unattested'
+      })
+    )
+  })
+})
diff --git a/src/actions/CategoriesActions.ts b/src/actions/CategoriesActions.ts
index 681bde025b9..901fe705c83 100644
--- a/src/actions/CategoriesActions.ts
+++ b/src/actions/CategoriesActions.ts
@@ -1,29 +1,18 @@
-import { eq } from 'biggystring'
-import type {
-  EdgeAccount,
-  EdgeAssetAction,
-  EdgeAssetAmount,
-  EdgeCurrencyWallet,
-  EdgeMetadata,
-  EdgeTransaction,
-  EdgeTxAction
-} from 'edge-core-js'
-import { sprintf } from 'sprintf-js'
+import type { EdgeAccount } from 'edge-core-js'
 
 import { showError } from '../components/services/AirshipInstance'
 import { EDGE_CONTENT_SERVER_URI } from '../constants/CdnConstants'
-import { TX_ACTION_LABEL_MAP } from '../constants/txActionConstants'
 import { lstrings } from '../locales/strings'
 import type { ThunkAction } from '../types/reduxTypes'
-import { getCurrencyCodeWithAccount } from '../util/CurrencyInfoHelpers'
-import { cleanFiatCurrencyCode } from '../util/CurrencyWalletHelpers'
+import type { EdgeCategory } from '../util/txDisplay'
 
-export type Category = 'transfer' | 'exchange' | 'expense' | 'income'
-
-export interface EdgeCategory {
-  category: Category
-  subcategory: string
-}
+export type { Category, EdgeCategory } from '../util/txDisplay'
+export {
+  getTxActionDisplayInfo,
+  joinCategory,
+  splitCategory
+} from '../util/txDisplay'
+export type { ActionDisplayInfo } from '../util/txDisplay'
 
 /**
  * Use these strings to show categories in a user's language.
@@ -71,43 +60,6 @@ export function setNewSubcategory(
   }
 }
 
-/**
- * Splits a string into its category and subcategory strings.
- * The category must fit our enum type, or we will use a fallback.
- * The subcategory can be localized and freely edited.
- */
-export function splitCategory(
-  fullCategory: string = '',
-  defaultCategory: Category = 'income'
-): EdgeCategory {
-  if (fullCategory.length > 0 && !fullCategory.includes(':')) {
-    fullCategory += ':'
-  }
-  for (const [category, test, n] of tests) {
-    if (test.test(fullCategory)) {
-      return {
-        category,
-        subcategory: fullCategory.slice(n)
-      }
-    }
-  }
-
-  // We can't guarantee that data on disk is correct,
-  // but this should usually never happen:
-  return {
-    category: defaultCategory,
-    subcategory: fullCategory.replace(/^[^:]:/, '')
-  }
-}
-
-/**
- * Combine the category and subcategory into a single string,
- * with the correct capitalization.
- */
-export function joinCategory(split: EdgeCategory): string {
-  return prefixes[split.category] + split.subcategory
-}
-
 /**
  * Localizes a category string for display.
  */
@@ -116,23 +68,6 @@ export function formatCategory(split: EdgeCategory): string {
   return `${displayCategories[split.category]}:${split.subcategory}`
 }
 
-/**
- * Internal prefixes used on disk.
- */
-const prefixes = {
-  transfer: 'Transfer:',
-  exchange: 'Exchange:',
-  expense: 'Expense:',
-  income: 'Income:'
-}
-
-const tests: Array<[Category, RegExp, number]> = [
-  ['transfer', /^Transfer:/i, 9],
-  ['exchange', /^Exchange:/i, 9],
-  ['expense', /^Expense:/i, 8],
-  ['income', /^Income:/i, 7]
-]
-
 export interface CategoriesFile {
   categories: string[]
 }
@@ -284,427 +219,6 @@ export const defaultCategories = [
   'Transfer:Dark Wallet'
 ]
 
-/**
- * Given an EdgeTxAction, returns the display value for pre-filling the
- * 'Category' and 'Notes' tiles, if they are not already user-modified.
- */
-
-export interface ActionDisplayInfo {
-  direction: 'send' | 'receive'
-  iconPluginId?: string
-  userData: EdgeMetadata
-  savedData: EdgeMetadata
-  mergedData: EdgeMetadata
-  action?: EdgeTxAction
-  assetAction?: EdgeAssetAction
-}
-
-export const getTxActionDisplayInfo = (
-  tx: EdgeTransaction,
-  account: EdgeAccount,
-  wallet: EdgeCurrencyWallet
-): ActionDisplayInfo => {
-  const {
-    assetAction,
-    chainAction,
-    chainAssetAction,
-    metadata,
-    savedAction,
-    swapData,
-    tokenId
-  } = tx
-  const { currencyConfig, currencyInfo } = wallet
-
-  const displayName =
-    tokenId == null
-      ? currencyInfo.assetDisplayName
-      : currencyConfig.allTokens[tokenId]?.displayName ?? ''
-
-  const action = savedAction ?? chainAction
-  const assetAct = assetAction ?? chainAssetAction
-
-  const getCurrencyCodes = (assets: EdgeAssetAmount[]): string[] =>
-    assets
-      .map(asset =>
-        getCurrencyCodeWithAccount(account, asset.pluginId, asset.tokenId)
-      )
-      .filter((currencyCode): currencyCode is string => currencyCode != null)
-
-  const isSentTransaction =
-    tx.nativeAmount.startsWith('-') || (eq(tx.nativeAmount, '0') && tx.isSend)
-
-  let payeeText: string | undefined
-  let edgeCategory: EdgeCategory
-  let direction: 'send' | 'receive'
-  let notes: string | undefined
-  let iconPluginId: string | undefined
-
-  // Default text for send or receive
-  if (isSentTransaction) {
-    payeeText = sprintf(lstrings.transaction_sent_1s, displayName)
-    direction = 'send'
-    edgeCategory = {
-      category: 'expense',
-      subcategory: ''
-    }
-  } else {
-    payeeText = sprintf(lstrings.transaction_received_1s, displayName)
-    direction = 'receive'
-    edgeCategory = {
-      category: 'income',
-      subcategory: ''
-    }
-  }
-
-  // Override with swapData
-  if (swapData != null) {
-    const { payoutCurrencyCode } = swapData
-    payeeText = sprintf(
-      lstrings.transaction_details_swap_to_subcat_1s,
-      payoutCurrencyCode
-    )
-  }
-
-  if (action != null && assetAct != null) {
-    const { actionType } = action
-    const { assetActionType } = assetAct
-    payeeText = TX_ACTION_LABEL_MAP[assetActionType]
-
-    let unsupported = false
-
-    switch (actionType) {
-      case 'swap': {
-        iconPluginId = action.swapInfo.pluginId
-        switch (assetActionType) {
-          case 'transfer': {
-            const txSrc = action.payoutWalletId !== wallet.id
-            const toFromStr = txSrc
-              ? lstrings.transaction_details_swap_to_subcat_1s
-              : lstrings.transaction_details_swap_from_subcat_1s
-            const walletName =
-              account.currencyWallets[action.payoutWalletId]?.name ??
-              displayName
-            edgeCategory = {
-              category: 'transfer',
-              subcategory: sprintf(toFromStr, walletName)
-            }
-            break
-          }
-          case 'transferNetworkFee':
-          case 'swapNetworkFee': {
-            edgeCategory = {
-              category: 'expense',
-              subcategory: lstrings.wc_smartcontract_network_fee
-            }
-            break
-          }
-          case 'swap':
-          case 'swapOrderFill': {
-            // Determine if the swap destination was to a different asset or if the
-            // swap source was from a different asset.
-            const txSrcSameAsset =
-              action.fromAsset.tokenId === tokenId &&
-              action.fromAsset.pluginId === wallet.currencyInfo.pluginId
-            const toFromStr = txSrcSameAsset
-              ? lstrings.transaction_details_swap_to_subcat_1s
-              : lstrings.transaction_details_swap_from_subcat_1s
-            const otherAsset = txSrcSameAsset
-              ? action.toAsset
-              : action.fromAsset
-
-            edgeCategory = {
-              category: 'exchange',
-              subcategory: sprintf(
-                toFromStr,
-                getCurrencyCodeWithAccount(
-                  account,
-                  otherAsset.pluginId,
-                  otherAsset.tokenId
-                )
-              )
-            }
-            direction = txSrcSameAsset ? 'send' : 'receive'
-            break
-          }
-
-          case 'swapOrderPost': {
-            edgeCategory = {
-              category: 'expense',
-              subcategory: sprintf(lstrings.transaction_details_swap_order_post)
-            }
-            direction = 'send'
-            break
-          }
-          case 'swapOrderCancel': {
-            edgeCategory = {
-              category: 'expense',
-              subcategory: sprintf(
-                lstrings.transaction_details_swap_order_cancel
-              )
-            }
-            direction = 'send'
-            break
-          }
-          default:
-            unsupported = true
-        }
-        break
-      }
-      case 'stake': {
-        iconPluginId = action.pluginId
-        switch (assetActionType) {
-          case 'stake': {
-            let subcategory
-            if (action.stakeAssets.length === 1)
-              subcategory = sprintf(
-                lstrings.transaction_details_stake_subcat_1s,
-                ...getCurrencyCodes(action.stakeAssets)
-              )
-            else if (action.stakeAssets.length === 2)
-              subcategory = sprintf(
-                lstrings.transaction_details_stake_subcat_2s,
-                ...getCurrencyCodes(action.stakeAssets)
-              )
-            else {
-              console.warn(
-                `Unsupported number of assets for '${assetActionType}' EdgeTxActionSwapType`
-              )
-              break
-            }
-            edgeCategory = { category: 'transfer', subcategory }
-            direction = 'send'
-            break
-          }
-          case 'stakeOrder': {
-            if (action.stakeAssets.length === 1)
-              notes = sprintf(
-                lstrings.transaction_details_unstake_order_notes_1s,
-                ...getCurrencyCodes(action.stakeAssets)
-              )
-            else if (action.stakeAssets.length === 2)
-              notes = sprintf(
-                lstrings.transaction_details_unstake_order_notes_2s,
-                ...getCurrencyCodes(action.stakeAssets)
-              )
-            else {
-              console.error(
-                `Unsupported number of assets for '${assetActionType}' EdgeTxActionSwapType`
-              )
-              break
-            }
-
-            edgeCategory = {
-              category: 'expense',
-              subcategory: lstrings.transaction_details_stake_order_subcat
-            }
-            direction = 'send'
-            break
-          }
-          case 'claim': {
-            let subcategory
-            if (action.stakeAssets.length === 1)
-              subcategory = sprintf(
-                lstrings.transaction_details_unstake_subcat_1s,
-                ...getCurrencyCodes(action.stakeAssets)
-              )
-            else if (action.stakeAssets.length === 2)
-              subcategory = sprintf(
-                lstrings.transaction_details_unstake_subcat_2s,
-                ...getCurrencyCodes(action.stakeAssets)
-              )
-            else {
-              console.error(
-                `Unsupported number of assets for '${assetActionType}' EdgeTxActionSwapType`
-              )
-              break
-            }
-            edgeCategory = { category: 'transfer', subcategory }
-            if (
-              action.stakeAssets.every(
-                asset => asset.pluginId === currencyInfo.pluginId
-              )
-            ) {
-              direction = 'receive'
-            } else {
-              direction = 'send'
-            }
-            break
-          }
-          case 'unstake': {
-            let subcategory
-            if (action.stakeAssets.length === 1)
-              subcategory = sprintf(
-                lstrings.transaction_details_unstake_subcat_1s,
-                ...getCurrencyCodes(action.stakeAssets)
-              )
-            else if (action.stakeAssets.length === 2)
-              subcategory = sprintf(
-                lstrings.transaction_details_unstake_subcat_2s,
-                ...getCurrencyCodes(action.stakeAssets)
-              )
-            else {
-              console.error(
-                `Unsupported number of assets for '${assetActionType}' EdgeTxActionSwapType`
-              )
-              break
-            }
-            edgeCategory = { category: 'transfer', subcategory }
-            direction = 'receive'
-            break
-          }
-          case 'claimOrder':
-          case 'unstakeOrder': {
-            if (action.stakeAssets.length === 1)
-              notes = sprintf(
-                lstrings.transaction_details_unstake_order_notes_1s,
-                ...getCurrencyCodes(action.stakeAssets)
-              )
-            else if (action.stakeAssets.length === 2)
-              notes = sprintf(
-                lstrings.transaction_details_unstake_order_notes_2s,
-                ...getCurrencyCodes(action.stakeAssets)
-              )
-            else {
-              console.error(
-                `Unsupported number of assets for '${assetActionType}' EdgeTxActionSwapType`
-              )
-              break
-            }
-
-            edgeCategory = {
-              category: 'expense',
-              subcategory: lstrings.transaction_details_unstake_order
-            }
-            direction = 'send'
-            break
-          }
-          case 'unstakeNetworkFee':
-          case 'stakeNetworkFee': {
-            edgeCategory = {
-              category: 'expense',
-              subcategory: lstrings.wc_smartcontract_network_fee
-            }
-            break
-          }
-
-          default:
-            unsupported = true
-        }
-        break
-      }
-      case 'fiat': {
-        iconPluginId = action.fiatPlugin.providerId
-        switch (assetActionType) {
-          case 'buy': {
-            payeeText = sprintf(payeeText, displayName)
-            const { fiatAsset } = action
-            const { fiatCurrencyCode } = cleanFiatCurrencyCode(
-              fiatAsset.fiatCurrencyCode
-            )
-            edgeCategory = {
-              category: 'exchange',
-              subcategory: sprintf(
-                lstrings.transaction_details_swap_from_subcat_1s,
-                fiatCurrencyCode
-              )
-            }
-            direction = 'receive'
-            break
-          }
-          case 'sell': {
-            payeeText = sprintf(payeeText, displayName)
-            const { fiatAsset } = action
-            const { fiatCurrencyCode } = cleanFiatCurrencyCode(
-              fiatAsset.fiatCurrencyCode
-            )
-            edgeCategory = {
-              category: 'exchange',
-              subcategory: sprintf(
-                lstrings.transaction_details_swap_to_subcat_1s,
-                fiatCurrencyCode
-              )
-            }
-            direction = 'send'
-            break
-          }
-          case 'sellNetworkFee': {
-            edgeCategory = {
-              category: 'expense',
-              subcategory: lstrings.wc_smartcontract_network_fee
-            }
-            direction = 'send'
-            break
-          }
-          default:
-            unsupported = true
-        }
-        break
-      }
-      case 'tokenApproval': {
-        switch (assetActionType) {
-          case 'tokenApproval': {
-            edgeCategory = {
-              category: 'expense',
-              subcategory: lstrings.wc_smartcontract_network_fee
-            }
-            break
-          }
-          default:
-            unsupported = true
-        }
-        break
-      }
-      case 'giftCard': {
-        iconPluginId = action.provider.providerId
-        payeeText = lstrings.gift_card_recipient_name
-        edgeCategory = {
-          category: 'expense',
-          subcategory: action.card.name
-        }
-        direction = 'send'
-        break
-      }
-      default:
-        unsupported = true
-    }
-
-    if (unsupported)
-      console.error(
-        `Unsupported EdgeTxAction assetAction:assetActionType '${assetActionType}'`
-      )
-  }
-  const savedData: EdgeMetadata = {
-    name: payeeText,
-    category: joinCategory(edgeCategory),
-    notes
-  }
-
-  const mergedData: EdgeMetadata = {
-    name:
-      metadata?.name != null && metadata.name.length > 0
-        ? metadata.name
-        : savedData.name,
-    category:
-      metadata?.category != null && metadata.category.length > 0
-        ? metadata.category
-        : savedData.category,
-    notes:
-      metadata?.notes != null && metadata.notes.length > 0
-        ? metadata.notes
-        : savedData.notes
-  }
-
-  return {
-    action,
-    assetAction,
-    direction,
-    iconPluginId,
-    savedData,
-    userData: metadata ?? {},
-    mergedData
-  }
-}
-
 export const pluginIdIcons: Record<string, string> = {
   '0xgasless': EDGE_CONTENT_SERVER_URI + '/0xgasless.png',
   bitrefill: EDGE_CONTENT_SERVER_URI + '/bitrefill.png',
diff --git a/src/actions/DeviceSettingsActions.ts b/src/actions/DeviceSettingsActions.ts
index 7e375a076a3..2a50ec66cc4 100644
--- a/src/actions/DeviceSettingsActions.ts
+++ b/src/actions/DeviceSettingsActions.ts
@@ -1,3 +1,4 @@
+import { asJSON } from 'cleaners'
 import { makeReactNativeDisklet } from 'disklet'
 
 import {
@@ -9,71 +10,136 @@ import {
 
 const disklet = makeReactNativeDisklet()
 const DEVICE_SETTINGS_FILENAME = 'DeviceSettings.json'
+/**
+ * Bound the single-flighted disk read so a hung `getText` cannot leave
+ * `initPromise` pending forever. Writers always `await initDeviceSettings`, so
+ * an unsettled load would wedge the entire write chain (including keys cache).
+ */
+const INIT_READ_TIMEOUT_MS = 2000
+/** Extra wait before a write may persist without the on-disk file applied. */
+const WRITE_DISK_WAIT_MS = INIT_READ_TIMEOUT_MS
+
+const asDeviceSettingsFile = asJSON(asDeviceSettings)
+
 let deviceSettings: DeviceSettings = asDeviceSettings({})
+let initPromise: Promise<void> | undefined
+/**
+ * Resolves when the on-disk file has been applied (or the read failed). Unlike
+ * `initPromise`, this stays pending through a read-timeout so callers that need
+ * the real cache (keys cold-start salvage) can still wait for a late disk result
+ * without wedging writers.
+ */
+let diskLoadPromise: Promise<void> | undefined
+/** True after init timed out for writers while the file read was still open. */
+let readTimedOut = false
+// Every field written this session. Replayed over the loaded file so a write
+// that lands while the initial read is still in flight is not lost when it
+// resolves - the write is newer than what is on disk.
+const writtenFields: Partial<DeviceSettings> = {}
+// Writes are serialized rather than concurrent, so two settings saved at once
+// cannot interleave their `setText` calls and leave a truncated file.
+let writeChain: Promise<void> = Promise.resolve()
 
 export const getDeviceSettings = (): DeviceSettings => deviceSettings
-export const initDeviceSettings = async () => {
-  deviceSettings = await readDeviceSettings()
+
+export const getKeysCache = (): DeviceSettings['keysCache'] =>
+  deviceSettings.keysCache
+
+const enqueuePersist = (): void => {
+  const write = writeChain.then(async () => {
+    const text = JSON.stringify(deviceSettings)
+    await disklet.setText(DEVICE_SETTINGS_FILENAME, text)
+  })
+  writeChain = write.catch(() => {})
 }
 
-export const writeDeveloperPluginUri = async (developerPluginUri: string) => {
-  try {
-    const raw = await disklet.getText(DEVICE_SETTINGS_FILENAME)
-    const json = JSON.parse(raw)
-    deviceSettings = asDeviceSettings(json)
-  } catch (e) {
-    console.log(e)
-  }
-  const updatedSettings = { ...deviceSettings, developerPluginUri }
-  return await writeDeviceSettings(updatedSettings)
+/**
+ * Load the file into the module's authoritative in-memory copy.
+ *
+ * Single-flighted because this has two callers during boot: the theme setup in
+ * `app.ts` and the keys store. Without it, the read that resolved last replaced
+ * the whole settings object.
+ *
+ * The promise always settles: a hung read times out with cleaner defaults (plus
+ * any `writtenFields` already applied), and a late disk result still merges
+ * underneath those writes so a slow read is not discarded forever.
+ */
+export const initDeviceSettings = async (): Promise<void> => {
+  initPromise ??= (async () => {
+    let timer: ReturnType<typeof setTimeout> | undefined
+    const timeout = new Promise<'timeout'>(resolve => {
+      timer = setTimeout(() => {
+        resolve('timeout')
+      }, INIT_READ_TIMEOUT_MS)
+    })
+    const read = readDeviceSettings()
+    diskLoadPromise = read
+      .then(settings => {
+        deviceSettings = { ...settings, ...writtenFields }
+        // A write during the timeout window may have persisted cleaner defaults
+        // over the real file. Re-flush the merged view once the late read lands.
+        if (readTimedOut) enqueuePersist()
+      })
+      .catch((error: unknown) => {
+        console.warn('initDeviceSettings: disk read failed', String(error))
+        deviceSettings = { ...asDeviceSettings({}), ...writtenFields }
+      })
+    try {
+      const raced = await Promise.race([
+        diskLoadPromise.then(() => 'ok' as const),
+        timeout
+      ])
+      if (raced === 'timeout') {
+        console.warn(
+          `initDeviceSettings: read timed out after ${INIT_READ_TIMEOUT_MS}ms`
+        )
+        readTimedOut = true
+        // Unblock writers; diskLoadPromise still carries the late apply.
+        deviceSettings = { ...asDeviceSettings({}), ...writtenFields }
+      }
+    } finally {
+      if (timer != null) clearTimeout(timer)
+    }
+  })()
+  await initPromise
 }
 
-export const writeDisableAnimations = async (disableAnimations: boolean) => {
-  try {
-    const raw = await disklet.getText(DEVICE_SETTINGS_FILENAME)
-    const json = JSON.parse(raw)
-    deviceSettings = asDeviceSettings(json)
-  } catch (e) {
-    console.log(e)
-  }
-  const updatedSettings: DeviceSettings = {
-    ...deviceSettings,
-    disableAnimations
-  }
-  return await writeDeviceSettings(updatedSettings)
+/**
+ * Wait until the DeviceSettings.json read has been applied (including a late
+ * result after `initDeviceSettings` timed out for writers). Bounded waits belong
+ * at the call site.
+ */
+export const awaitDeviceSettingsDisk = async (): Promise<void> => {
+  await initDeviceSettings()
+  if (diskLoadPromise != null) await diskLoadPromise
 }
 
-export const writeDefaultScreen = async (defaultScreen: DefaultScreen) => {
-  try {
-    const raw = await disklet.getText(DEVICE_SETTINGS_FILENAME)
-    const json = JSON.parse(raw)
-    deviceSettings = asDeviceSettings(json)
-  } catch (e) {
-    console.log(e)
-  }
-  const updatedSettings: DeviceSettings = { ...deviceSettings, defaultScreen }
-  return await writeDeviceSettings(updatedSettings)
+export const writeDeveloperPluginUri = async (
+  developerPluginUri: string
+): Promise<void> => {
+  await patchDeviceSettings({ developerPluginUri })
+}
+
+export const writeDisableAnimations = async (
+  disableAnimations: boolean
+): Promise<void> => {
+  await patchDeviceSettings({ disableAnimations })
+}
+
+export const writeDefaultScreen = async (
+  defaultScreen: DefaultScreen
+): Promise<void> => {
+  await patchDeviceSettings({ defaultScreen })
 }
 
 export const writeForceLightAccountCreate = async (
   forceLightAccountCreate: boolean
-) => {
-  try {
-    const raw = await disklet.getText(DEVICE_SETTINGS_FILENAME)
-    const json = JSON.parse(raw)
-    deviceSettings = asDeviceSettings(json)
-  } catch (e) {
-    console.log(e)
-  }
-  const updatedSettings: DeviceSettings = {
-    ...deviceSettings,
-    forceLightAccountCreate
-  }
-  return await writeDeviceSettings(updatedSettings)
+): Promise<void> => {
+  await patchDeviceSettings({ forceLightAccountCreate })
 }
 
-export const writeThemeMode = async (themeMode: ThemeMode) => {
-  return await writeDeviceSettings({ ...deviceSettings, themeMode })
+export const writeThemeMode = async (themeMode: ThemeMode): Promise<void> => {
+  await patchDeviceSettings({ themeMode })
 }
 
 /**
@@ -81,23 +147,73 @@ export const writeThemeMode = async (themeMode: ThemeMode) => {
  **/
 export const writeIsSurveyDiscoverShown = async (
   isSurveyDiscoverShown: boolean
-) => {
-  return await writeDeviceSettings({ ...deviceSettings, isSurveyDiscoverShown })
+): Promise<void> => {
+  await patchDeviceSettings({ isSurveyDiscoverShown })
+}
+
+export const writeKeysCache = async (
+  keysCache: NonNullable<DeviceSettings['keysCache']>
+): Promise<void> => {
+  await patchDeviceSettings({ keysCache })
 }
 
 const readDeviceSettings = async (): Promise<DeviceSettings> => {
   try {
     const text = await disklet.getText(DEVICE_SETTINGS_FILENAME)
-    const json = JSON.parse(text)
-    const settings = asDeviceSettings(json)
-    return settings
+    return asDeviceSettingsFile(text)
   } catch (e) {
     return asDeviceSettings({})
   }
 }
 
-const writeDeviceSettings = async (settings: DeviceSettings) => {
-  deviceSettings = settings
-  const text = JSON.stringify(settings)
-  return await disklet.setText(DEVICE_SETTINGS_FILENAME, text)
+/**
+ * Update one or more settings and write the file.
+ *
+ * Writers pass only the fields they own, rather than a whole settings object
+ * built from a spread of the current one. Spreading made every writer a
+ * read-modify-write of the entire file, so any writer holding a stale copy
+ * silently reverted the others.
+ *
+ * The write is issued immediately, and the returned promise resolves once it is
+ * on disk. Nothing here is hot enough to need coalescing, and delaying the
+ * write would only create a window in which the app can be killed and the
+ * setting lost - including a fresh keys cache, which no caller awaits.
+ */
+const patchDeviceSettings = async (
+  patch: Partial<DeviceSettings>
+): Promise<void> => {
+  Object.assign(writtenFields, patch)
+  deviceSettings = { ...deviceSettings, ...patch }
+  const write = writeChain.then(async () => {
+    // Always start (or await) the single-flighted load before persisting. A
+    // write that ran with `initPromise` still undefined used to stringify the
+    // cleaner defaults and blank every field already on disk. `initDeviceSettings`
+    // only reads, so waiting on it cannot deadlock.
+    await initDeviceSettings()
+    // Prefer applying the real file before setText so a timeout-window write
+    // does not persist cleaner defaults over themeMode / defaultScreen / etc.
+    // Bound the wait so a hung getText cannot wedge writeChain forever.
+    if (diskLoadPromise != null) {
+      let waitTimer: ReturnType<typeof setTimeout> | undefined
+      const waitTimeout = new Promise<'timeout'>(resolve => {
+        waitTimer = setTimeout(() => {
+          resolve('timeout')
+        }, WRITE_DISK_WAIT_MS)
+      })
+      try {
+        await Promise.race([diskLoadPromise, waitTimeout])
+      } finally {
+        if (waitTimer != null) clearTimeout(waitTimer)
+      }
+    }
+    // Serialized here rather than when the patch was applied, so the file
+    // always receives the newest in-memory state: whichever write runs last
+    // wins, and it wins with every field, not just the ones it owns.
+    const text = JSON.stringify(deviceSettings)
+    await disklet.setText(DEVICE_SETTINGS_FILENAME, text)
+  })
+  // The chain is kept settled so one failed write does not fail every write
+  // after it, while this caller still sees its own failure.
+  writeChain = write.catch(() => {})
+  await write
 }
diff --git a/src/actions/LocalSettingsActions.ts b/src/actions/LocalSettingsActions.ts
index 44224f17d4f..23e52dd514b 100644
--- a/src/actions/LocalSettingsActions.ts
+++ b/src/actions/LocalSettingsActions.ts
@@ -15,9 +15,14 @@ import {
   type PasswordReminder,
   type SpendingLimits
 } from '../types/types'
+import {
+  LOCAL_SETTINGS_FILENAME,
+  readLocalAccountSettingsFromDisk,
+  writeLocalAccountSettingsToDisk
+} from '../util/localAccountSettings'
 import { logActivity } from '../util/logger'
 
-export const LOCAL_SETTINGS_FILENAME = 'Settings.json'
+export { LOCAL_SETTINGS_FILENAME }
 
 // Long enough to read the instructions in the balance-hidden toast:
 const TOAST_HIDE_MS = 5000
@@ -304,21 +309,10 @@ export const readLocalAccountSettings = async (
     return localAccountSettings
   }
 
-  try {
-    const text = await account.localDisklet.getText(LOCAL_SETTINGS_FILENAME)
-    const json = JSON.parse(text)
-    const settings = asLocalAccountSettings(json)
-    emitAccountSettings(settings)
-    readSettingsFromDisk = true
-    return settings
-  } catch (error: unknown) {
-    // If Settings.json doesn't exist yet, return defaults without writing.
-    // Defaults can be derived from cleaners. Only write when values change.
-    const defaults = asLocalAccountSettings({})
-    emitAccountSettings(defaults)
-    readSettingsFromDisk = true
-    return defaults
-  }
+  const settings = await readLocalAccountSettingsFromDisk(account)
+  emitAccountSettings(settings)
+  readSettingsFromDisk = true
+  return settings
 }
 
 export const writeLocalAccountSettings = async (
@@ -327,9 +321,6 @@ export const writeLocalAccountSettings = async (
 ): Promise<LocalAccountSettings> => {
   // Refresh cache, notify callers
   emitAccountSettings(settings)
-
-  const text = JSON.stringify(settings)
-  await account.localDisklet.setText(LOCAL_SETTINGS_FILENAME, text)
-
+  await writeLocalAccountSettingsToDisk(account, settings)
   return settings
 }
diff --git a/src/actions/LogActions.tsx b/src/actions/LogActions.tsx
index 00a5a4d6b2c..0cbc012aa3a 100644
--- a/src/actions/LogActions.tsx
+++ b/src/actions/LogActions.tsx
@@ -31,7 +31,7 @@ import type { ThunkAction } from '../types/reduxTypes'
 import { getCurrencyCode } from '../util/CurrencyInfoHelpers'
 import { base58 } from '../util/encoding'
 import { clearLogs, logWithType, readLogs } from '../util/logger'
-import { getOsVersion } from '../util/utils'
+import { getOsVersion } from '../util/rnUtils'
 import { getExchangeRateCacheDump } from './ExchangeRateActions'
 
 const logsUri = 'https://logs1.edge.app/v1/log/'
diff --git a/src/actions/LoginActions.tsx b/src/actions/LoginActions.tsx
index d6eafb4c779..1f69fa3b5c1 100644
--- a/src/actions/LoginActions.tsx
+++ b/src/actions/LoginActions.tsx
@@ -28,6 +28,7 @@ import type {
   NavigationBase,
   RootSceneProps
 } from '../types/routerTypes'
+import { allPlugins } from '../util/corePlugins'
 import { currencyCodesToEdgeAssets } from '../util/CurrencyInfoHelpers'
 import { logActivity } from '../util/logger'
 import { clearReverseLookupCache } from '../util/nameServices'
@@ -55,6 +56,40 @@ import {
 const PER_WALLET_TIMEOUT = 5000
 const MIN_CREATE_WALLET_TIMEOUT = 20000
 
+// Plugin loading happens once per core context, so a plugin that is missing at
+// the first login stays missing for every later one. Report it a single time.
+let missingPluginsReported = false
+
+/**
+ * Reports plugins that we asked the core to load but never got back, which
+ * happens when a plugin's API keys are absent or malformed. The core leaves
+ * such a plugin out of `currencyConfig` / `swapConfig` rather than failing the
+ * login, so the app still works without whatever that plugin provides.
+ */
+function reportMissingPlugins(account: EdgeAccount): void {
+  if (missingPluginsReported) return
+  missingPluginsReported = true
+
+  const missingPluginIds = Object.keys(allPlugins).filter(pluginId => {
+    const init = allPlugins[pluginId]
+    if (init === false || init == null) return false
+    return (
+      account.currencyConfig[pluginId] == null &&
+      account.swapConfig[pluginId] == null
+    )
+  })
+  if (missingPluginIds.length === 0) return
+
+  showError(
+    new Error(
+      sprintf(
+        lstrings.plugins_unavailable_message_s,
+        missingPluginIds.join(', ')
+      )
+    )
+  )
+}
+
 export function initializeAccount(
   navigation: RootSceneProps<'login'>['navigation'],
   account: EdgeAccount
@@ -78,6 +113,8 @@ export function initializeAccount(
       }
     })
 
+    reportMissingPlugins(account)
+
     const referralPromise = dispatch(loadAccountReferral(account))
 
     // Navigate immediately - all settings are now in Redux
diff --git a/src/actions/NotificationActions.ts b/src/actions/NotificationActions.ts
index 62f9eae205a..9f82a16b0f0 100644
--- a/src/actions/NotificationActions.ts
+++ b/src/actions/NotificationActions.ts
@@ -14,10 +14,10 @@ import {
 } from '../controllers/action-queue/types/pushApiTypes'
 import { asPriceChangeTrigger } from '../controllers/action-queue/types/pushCleaners'
 import type { PriceChangeTrigger } from '../controllers/action-queue/types/pushTypes'
-import { ENV } from '../env'
 import { lstrings } from '../locales/strings'
 import { getActiveWalletCurrencyInfos } from '../selectors/WalletSelectors'
 import type { ThunkAction } from '../types/reduxTypes'
+import { resolveApiKeyAsync } from '../util/edgeApiSigner'
 import { base58 } from '../util/encoding'
 import { fetchPush } from '../util/network'
 import { getDenomFromIsoCode, removeIsoPrefix } from '../util/utils'
@@ -53,8 +53,12 @@ export function registerNotificationsV2(
         .getToken()
         .catch(() => '')
 
+      const apiKey = await resolveApiKeyAsync()
+      if (apiKey === '') {
+        throw new Error('registerNotificationsV2: missing Edge API key')
+      }
       const body = {
-        apiKey: ENV.EDGE_API_KEY,
+        apiKey,
         deviceId: state.core.context.clientId,
         deviceToken,
         loginId: base64.stringify(base58.parse(state.core.account.rootLoginId))
@@ -81,7 +85,8 @@ export function registerNotificationsV2(
         for (const currencyInfo of activeCurrencyInfos) {
           if (
             // Must not be deprecated
-            !SPECIAL_CURRENCY_INFO[currencyInfo.pluginId].keysOnlyMode &&
+            SPECIAL_CURRENCY_INFO[currencyInfo.pluginId].keysOnlyMode !==
+              true &&
             // Must not already be present with current fiat setting
             !serverSettings.events.some(
               event =>
@@ -107,7 +112,7 @@ export function registerNotificationsV2(
             )
             if (
               currencyInfo != null &&
-              SPECIAL_CURRENCY_INFO[currencyInfo.pluginId].keysOnlyMode
+              SPECIAL_CURRENCY_INFO[currencyInfo.pluginId].keysOnlyMode === true
             ) {
               removeEvents.push(event.eventId)
             }
@@ -150,7 +155,7 @@ export function registerNotificationsV2(
           )
 
           for (const [i, setting] of currencySettings.entries()) {
-            if (setting.fallbackSettings) {
+            if (setting.fallbackSettings === true) {
               // Settings didn't exist for that currency code so we'll create them using default options
               createEvents.push(
                 newPriceChangeEvent(
@@ -244,8 +249,12 @@ async function updateServerSettings(
     .getToken()
     .catch(() => '')
 
+  const apiKey = await resolveApiKeyAsync()
+  if (apiKey === '') {
+    throw new Error('updateServerSettings: missing Edge API key')
+  }
   const body = {
-    apiKey: ENV.EDGE_API_KEY,
+    apiKey,
     deviceId,
     deviceToken,
     data: { ...data, loginIds }
@@ -345,7 +354,11 @@ export const newPriceChangeEvent = (
 export const fetchLegacySettings = async (
   userId: string,
   currencyCode: string
-) => {
+): Promise<{
+  '1': boolean
+  '24': boolean
+  fallbackSettings?: boolean
+}> => {
   const deviceId = await getUniqueId()
   const deviceIdEncoded = encodeURIComponent(deviceId)
   const encodedUserId = encodeURIComponent(userId)
@@ -354,12 +367,16 @@ export const fetchLegacySettings = async (
   )
 }
 
-async function legacyGet(path: string) {
+async function legacyGet(path: string): Promise<any> {
+  const apiKey = await resolveApiKeyAsync()
+  if (apiKey === '') {
+    throw new Error('legacyGet: missing Edge API key')
+  }
   const response = await fetchPush(`v1/${path}`, {
     method: 'GET',
     headers: {
       'Content-Type': 'application/json',
-      'X-Api-Key': ENV.EDGE_API_KEY
+      'X-Api-Key': apiKey
     }
   })
   if (response.ok) {
diff --git a/src/actions/TransactionExportActions.tsx b/src/actions/TransactionExportActions.tsx
index 5ebace768a9..ed5042739b8 100644
--- a/src/actions/TransactionExportActions.tsx
+++ b/src/actions/TransactionExportActions.tsx
@@ -1,41 +1,19 @@
-import { abs, add, div, gt, lt, mul } from 'biggystring'
-import csvStringify from 'csv-stringify/lib/browser/sync'
 import type {
   EdgeCurrencyWallet,
   EdgeTokenId,
   EdgeTransaction
 } from 'edge-core-js'
-import shajs from 'sha.js'
 
-import { getExchangeDenom } from '../selectors/DenominationSelectors'
 import type { ThunkAction } from '../types/reduxTypes'
-import { getHistoricalCryptoRate } from '../util/exchangeRates'
-import { DECIMAL_PRECISION } from '../util/utils'
+import { fillTxsFiat } from '../util/fillTxsFiat'
 
-const UPDATE_TXS_MAX_PROMISES = 10
-
-export async function exportTransactionsToCSV(
-  wallet: EdgeCurrencyWallet,
-  defaultIsoFiat: string,
-  txs: EdgeTransaction[],
-  currencyCode: string,
-  denomination?: string
-): Promise<string> {
-  let denomName = ''
-  if (denomination != null) {
-    const denomObj = wallet.currencyInfo.denominations.find(
-      edgeDenom => edgeDenom.multiplier === denomination
-    )
-    if (denomObj != null) denomName = denomObj.name
-  }
-  return exportTransactionsToCSVInner(
-    txs,
-    currencyCode,
-    defaultIsoFiat,
-    denomination,
-    denomName
-  )
-}
+export {
+  exportTransactionsToBitwave,
+  exportTransactionsToCSV,
+  exportTransactionsToCSVInner,
+  exportTransactionsToQBO,
+  getTransferTx
+} from '../util/txExport'
 
 export function updateTxsFiat(
   wallet: EdgeCurrencyWallet,
@@ -44,486 +22,12 @@ export function updateTxsFiat(
   txs: EdgeTransaction[]
 ): ThunkAction<Promise<void>> {
   return async (dispatch, getState) => {
-    const state = getState()
-    const defaultIsoFiat = state.ui.settings.defaultIsoFiat
-
-    const exchangeDenom = getExchangeDenom(wallet.currencyConfig, tokenId)
-
-    let promises: Array<Promise<void>> = []
-    for (const tx of txs) {
-      const amountFiat = tx.metadata?.exchangeAmount?.[defaultIsoFiat] ?? 0
-
-      if (amountFiat === 0) {
-        const date = new Date(tx.date * 1000).toISOString()
-        promises.push(
-          getHistoricalCryptoRate(
-            wallet.currencyInfo.pluginId,
-            tokenId,
-            defaultIsoFiat,
-            date
-          )
-            .then(rate => {
-              tx.metadata = {
-                ...tx.metadata,
-                exchangeAmount: {
-                  ...tx.metadata?.exchangeAmount,
-                  [defaultIsoFiat]:
-                    rate *
-                    Number(
-                      div(
-                        tx.nativeAmount,
-                        exchangeDenom.multiplier,
-                        DECIMAL_PRECISION
-                      )
-                    )
-                }
-              }
-            })
-            .catch((e: unknown) => {
-              console.warn(e instanceof Error ? e.message : String(e))
-            })
-        )
-        if (promises.length >= UPDATE_TXS_MAX_PROMISES) {
-          await Promise.all(promises)
-          promises = []
-        }
-      }
-    }
-    if (promises.length > 0) {
-      await Promise.all(promises)
-    }
-  }
-}
-
-function padZero(val: string): string {
-  if (val.length === 1) {
-    return '0' + val
-  }
-  return val
-}
-
-function escapeOFXString(str: string): string {
-  str = str.replace(/&/g, '&amp;')
-  str = str.replace(/>/g, '&gt;')
-  return str.replace(/</g, '&lt;')
-}
-
-function exportOfxHeader(inputObj: any): string {
-  let out = ''
-  for (const key of Object.keys(inputObj)) {
-    let element = inputObj[key]
-    if (typeof element === 'string') {
-      element = escapeOFXString(element)
-      out += `${key}:${element}\n`
-    } else {
-      throw new Error('Invalid OFX header')
-    }
-  }
-  return out
-}
-
-function exportOfxBody(inputObj: any): string {
-  let out = ''
-  for (const key of Object.keys(inputObj)) {
-    let element = inputObj[key]
-    if (typeof element === 'string') {
-      element = escapeOFXString(element)
-      out += `<${key}>${element}\n`
-    } else if (element instanceof Array) {
-      for (const a of element) {
-        out += `<${key}>\n`
-        out += exportOfxBody(a)
-        out += `</${key}>\n`
-      }
-    } else if (typeof element === 'object') {
-      out += `<${key}>\n`
-      out += exportOfxBody(element)
-      out += `</${key}>\n`
-    } else {
-      throw new Error('Invalid OFX body')
-    }
-  }
-  return out
-}
-
-function exportOfx(header: any, body: any): string {
-  let out = exportOfxHeader(header) + '\n'
-  out += '<OFX>\n'
-  out += exportOfxBody(body)
-  out += '</OFX>\n'
-  return out
-}
-
-function makeOfxDate(date: number): string {
-  const d = new Date(date * 1000)
-  const yyyy = d.getUTCFullYear().toString()
-  const mm = padZero((d.getUTCMonth() + 1).toString())
-  const dd = padZero(d.getUTCDate().toString())
-  const hh = padZero(d.getUTCHours().toString())
-  const min = padZero(d.getUTCMinutes().toString())
-  const ss = padZero(d.getUTCSeconds().toString())
-  return `${yyyy}${mm}${dd}${hh}${min}${ss}.000`
-}
-
-function makeCsvDateTime(date: number): { date: string; time: string } {
-  const d = new Date(date * 1000)
-  const yyyy = d.getUTCFullYear().toString()
-  const mm = padZero((d.getUTCMonth() + 1).toString())
-  const dd = padZero(d.getUTCDate().toString())
-  const hh = padZero(d.getUTCHours().toString())
-  const min = padZero(d.getUTCMinutes().toString())
-
-  return {
-    date: `${yyyy}-${mm}-${dd}`,
-    time: `${hh}:${min}`
-  }
-}
-
-/** ISO 8601 UTC, the timestamp format Bitwave requires for imports. */
-function makeBitwaveDateTime(date: number): string {
-  const d = new Date(date * 1000)
-  const yyyy = d.getUTCFullYear().toString()
-  const mm = padZero((d.getUTCMonth() + 1).toString())
-  const dd = padZero(d.getUTCDate().toString())
-  const hh = padZero(d.getUTCHours().toString())
-  const min = padZero(d.getUTCMinutes().toString())
-  const ss = padZero(d.getUTCSeconds().toString())
-
-  return `${yyyy}-${mm}-${dd}T${hh}:${min}:${ss}Z`
-}
-
-//
-// Check if tx is
-// 1. A transfer
-// 2. Outgoing spend
-// 3. Has a network fee
-// If so:
-//  1. Modify transaction to reduce the nativeAmount by the networkFee
-//  2. Set networkFee to 0
-//  3. Return a new transaction that has:
-//      1. nativeAmount and networkFee set to original tx fee
-//      2. category set to 'Expense:Network Fee'
-//      3. txid set to old txid + '-TRANSFER_TX'
-
-export function getTransferTx(
-  oldEdgeTransaction: EdgeTransaction,
-  fiatCurrencyCode: string
-): EdgeTransaction[] | null {
-  const edgeTransaction = { ...oldEdgeTransaction }
-  edgeTransaction.metadata = { ...oldEdgeTransaction.metadata }
-
-  const category = edgeTransaction.metadata?.category ?? ''
-  if (!category.toLowerCase().startsWith('transfer:')) return null
-  if (!lt(edgeTransaction.nativeAmount, '0')) return null
-  if (!gt(edgeTransaction.networkFee, '0')) return null
-
-  const nativeAmountNoFee = add(
-    edgeTransaction.nativeAmount,
-    edgeTransaction.networkFee
-  )
-  let newTxFiatFee = 0
-  let amountFiat =
-    edgeTransaction.metadata?.exchangeAmount?.[fiatCurrencyCode] ?? 0
-
-  if (amountFiat > 0) {
-    const exchangeRate: string = div(
-      amountFiat.toString(),
-      edgeTransaction.nativeAmount,
-      16
-    )
-    const newTxFiatFeeString: string = mul(
-      exchangeRate,
-      edgeTransaction.networkFee
-    )
-    newTxFiatFee = Math.abs(Number(newTxFiatFeeString))
-    amountFiat = Number(mul(exchangeRate, nativeAmountNoFee))
-  }
-
-  const newEdgeTransaction: EdgeTransaction = { ...edgeTransaction }
-  newEdgeTransaction.nativeAmount = `-${edgeTransaction.networkFee}`
-  newEdgeTransaction.metadata = {
-    ...edgeTransaction.metadata,
-    category: `Expense:Network Fee`,
-    exchangeAmount: {
-      ...edgeTransaction.metadata?.exchangeAmount,
-      [fiatCurrencyCode]: newTxFiatFee
-    }
-  }
-  newEdgeTransaction.txid += '-TRANSFER_TX'
-  edgeTransaction.nativeAmount = nativeAmountNoFee
-  edgeTransaction.networkFee = '0'
-  edgeTransaction.metadata = {
-    ...edgeTransaction.metadata,
-    exchangeAmount: {
-      ...edgeTransaction.metadata?.exchangeAmount,
-      [fiatCurrencyCode]: amountFiat
-    }
-  }
-  return [edgeTransaction, newEdgeTransaction]
-}
-
-export function exportTransactionsToQBO(
-  edgeTransactions: EdgeTransaction[],
-  fiatCurrencyCode: string,
-  denom: string | undefined,
-  /** For unit testing */
-  testDateNow?: number
-): string {
-  const STMTTRN: any[] = []
-  const now = makeOfxDate((testDateNow ?? Date.now()) / 1000)
-  const hasDenom = denom != null
-
-  for (const tx of edgeTransactions) {
-    const newTxs = getTransferTx(tx, fiatCurrencyCode)
-    if (newTxs != null) {
-      edgeTxToQbo(newTxs[0])
-      edgeTxToQbo(newTxs[1])
-    } else {
-      edgeTxToQbo(tx)
-    }
-  }
-
-  function edgeTxToQbo(edgeTx: EdgeTransaction): void {
-    const TRNAMT: string = hasDenom
-      ? div(edgeTx.nativeAmount, denom, DECIMAL_PRECISION)
-      : edgeTx.nativeAmount
-    const TRNTYPE = lt(edgeTx.nativeAmount, '0') ? 'DEBIT' : 'CREDIT'
-    const DTPOSTED = makeOfxDate(edgeTx.date)
-    const NAME: string = edgeTx.metadata?.name ?? ''
-    const amountFiat: number =
-      edgeTx.metadata?.exchangeAmount?.[fiatCurrencyCode] ?? 0
-    const category: string = edgeTx.metadata?.category ?? ''
-    const notes: string = edgeTx.metadata?.notes ?? ''
-
-    const absFiat = abs(amountFiat.toString())
-    const absAmount = abs(TRNAMT)
-    const CURRATE = absAmount !== '0' ? div(absFiat, absAmount, 8) : '0'
-    let memo = `// Rate=${CURRATE} ${fiatCurrencyCode}=${amountFiat} category="${category}" memo="${notes}"`
-    if (memo.length > 250) {
-      memo = memo.substring(0, 250) + '...'
-    }
-    const qboTxNamed = {
-      TRNTYPE,
-      DTPOSTED,
-      TRNAMT,
-      FITID: edgeTx.txid,
-      NAME,
-      MEMO: memo,
-      CURRENCY: {
-        CURRATE,
-        CURSYM: fiatCurrencyCode
-      }
-    }
-    const qboTx = {
-      TRNTYPE,
-      DTPOSTED,
-      TRNAMT,
-      FITID: edgeTx.txid,
-      MEMO: memo,
-      CURRENCY: {
-        CURRATE,
-        CURSYM: fiatCurrencyCode
-      }
-    }
-    const use = NAME === '' ? qboTx : qboTxNamed
-    STMTTRN.push(use)
-  }
-
-  const header = {
-    OFXHEADER: '100',
-    DATA: 'OFXSGML',
-    VERSION: '102',
-    SECURITY: 'NONE',
-    ENCODING: 'USASCII',
-    CHARSET: '1252',
-    COMPRESSION: 'NONE',
-    OLDFILEUID: 'NONE',
-    NEWFILEUID: 'NONE'
-  }
-
-  const body = {
-    SIGNONMSGSRSV1: {
-      SONRS: {
-        STATUS: {
-          CODE: '0',
-          SEVERITY: 'INFO'
-        },
-        DTSERVER: now,
-        LANGUAGE: 'ENG',
-        'INTU.BID': '3000'
-      }
-    },
-    BANKMSGSRSV1: {
-      STMTTRNRS: {
-        TRNUID: now,
-        STATUS: {
-          CODE: '0',
-          SEVERITY: 'INFO',
-          MESSAGE: 'OK'
-        },
-        STMTRS: {
-          CURDEF: 'USD',
-          BANKACCTFROM: {
-            BANKID: '999999999',
-            ACCTID: '999999999999',
-            ACCTTYPE: 'CHECKING'
-          },
-          BANKTRANLIST: {
-            DTSTART: now,
-            DTEND: now,
-            STMTTRN
-          },
-          LEDGERBAL: {
-            BALAMT: '0.00',
-            DTASOF: now
-          },
-          AVAILBAL: {
-            BALAMT: '0.00',
-            DTASOF: now
-          }
-        }
-      }
-    }
-  }
-
-  return exportOfx(header, body)
-}
-
-export function exportTransactionsToCSVInner(
-  edgeTransactions: EdgeTransaction[],
-  currencyCode: string,
-  fiatCurrencyCode: string,
-  denom?: string,
-  denomName: string = ''
-): string {
-  const items: any[] = []
-  const hasDenom = denom != null
-
-  for (const tx of edgeTransactions) {
-    const newTxs = getTransferTx(tx, fiatCurrencyCode)
-    if (newTxs != null) {
-      edgeTxToCsv(newTxs[0])
-      edgeTxToCsv(newTxs[1])
-    } else {
-      edgeTxToCsv(tx)
-    }
-  }
-
-  function edgeTxToCsv(edgeTx: EdgeTransaction): void {
-    const amount: string = hasDenom
-      ? div(edgeTx.nativeAmount, denom, DECIMAL_PRECISION)
-      : edgeTx.nativeAmount
-    const networkFeeField: string = hasDenom
-      ? div(edgeTx.networkFee, denom, DECIMAL_PRECISION)
-      : edgeTx.networkFee
-    const { date, time } = makeCsvDateTime(edgeTx.date)
-    const name: string = edgeTx.metadata?.name ?? ''
-    const amountFiat: number =
-      edgeTx.metadata?.exchangeAmount?.[fiatCurrencyCode] ?? 0
-    const category: string = edgeTx.metadata?.category ?? ''
-    const notes: string = edgeTx.metadata?.notes ?? ''
-
-    items.push({
-      CURRENCY_CODE: currencyCode,
-      DATE: date,
-      TIME: time,
-      PAYEE_PAYER_NAME: name,
-      AMT_ASSET: amount,
-      DENOMINATION: denomName,
-      [fiatCurrencyCode]: String(amountFiat),
-      CATEGORY: category,
-      NOTES: notes,
-      AMT_NETWORK_FEES_ASSET: networkFeeField,
-      TXID: edgeTx.txid,
-      OUR_RECEIVE_ADDRESSES: edgeTx.ourReceiveAddresses.join(','),
-      VER: 1,
-      DEVICE_DESCRIPTION: edgeTx.deviceDescription ?? ''
-    })
-  }
-
-  return csvStringify(items, {
-    header: true,
-    quoted_string: true,
-    record_delimiter: '\n'
-  })
-}
-
-export async function exportTransactionsToBitwave(
-  accountId: string,
-  edgeTransactions: EdgeTransaction[],
-  currencyCode: string,
-  multiplier: string
-): Promise<string> {
-  const items: any[] = []
-
-  for (const tx of edgeTransactions) {
-    edgeTxToCsv(tx)
-  }
-
-  function edgeTxToCsv(edgeTx: EdgeTransaction): void {
-    const {
-      date,
-      isSend,
-      metadata,
-      nativeAmount,
-      networkFee,
-      ourReceiveAddresses,
-      spendTargets,
-      txid
-    } = edgeTx
-    const amount: string = abs(div(nativeAmount, multiplier, DECIMAL_PRECISION))
-    const time = makeBitwaveDateTime(date)
-    const { name = '', category = '', notes = '' } = metadata ?? {}
-
-    let toAddress = ''
-    if (isSend) {
-      if (spendTargets != null && spendTargets.length > 0) {
-        // We can only choose 1 `toAddress` so pick the first spendTarget
-        toAddress = spendTargets[0].publicAddress
-      }
-    } else {
-      // We can only choose 1 `toAddress` so pick the first receive address
-      toAddress = ourReceiveAddresses != null ? ourReceiveAddresses[0] : ''
-    }
-
-    const id = shajs('sha256')
-      .update(`${txid}_${nativeAmount}_${networkFee}_${toAddress}`)
-      .digest('hex')
-      .slice(0, 16)
-
-    items.push({
-      id,
-      remoteContactId: '',
-      amount,
-      amountTicker: currencyCode,
-      cost: '',
-      costTicker: '',
-      // Bitwave calculates transaction fees on its own side. Exporting them
-      // here duplicates the fees after import, so both columns stay blank:
-      fee: '',
-      feeTicker: '',
-      time,
-      blockchainId: txid,
-      memo: notes,
-      transactionType: isSend ? 'withdrawal' : 'deposit',
-      accountId,
-      contactId: '',
-      categoryId: '',
-      taxExempt: 'FALSE',
-      tradeId: '',
-      description: name,
-      fromAddress: '',
-      toAddress,
-      groupId: '',
-      'metadata:myCustomMetadata1': category,
-      // Bitwave expects this to mirror the description column:
-      'metadata:myCustomMetadata2': name
+    const defaultIsoFiat = getState().ui.settings.defaultIsoFiat
+    await fillTxsFiat({
+      wallet,
+      tokenId,
+      isoFiat: defaultIsoFiat,
+      txs
     })
   }
-
-  return csvStringify(items, {
-    header: true,
-    quoted_string: true,
-    record_delimiter: '\n'
-  })
 }
diff --git a/src/actions/scene/StakingActions.tsx b/src/actions/scene/StakingActions.tsx
index b25537bd6b6..09861d8bb99 100644
--- a/src/actions/scene/StakingActions.tsx
+++ b/src/actions/scene/StakingActions.tsx
@@ -1,7 +1,7 @@
 import type { EdgeAccount, EdgeCurrencyWallet, EdgeTokenId } from 'edge-core-js'
 
+import { CONFIG } from '../../config'
 import { SPECIAL_CURRENCY_INFO } from '../../constants/WalletAndCurrencyConstants'
-import { ENV } from '../../env'
 import { lstrings } from '../../locales/strings'
 import { getStakePlugins } from '../../plugins/stake-plugins/stakePlugins'
 import type { StakePlugin } from '../../plugins/stake-plugins/types'
@@ -26,7 +26,7 @@ export const updateStakingState = (
     // Exit with empty state if staking is not supported
     if (
       SPECIAL_CURRENCY_INFO[pluginId]?.isStakingSupported !== true ||
-      !ENV.ENABLE_STAKING
+      !CONFIG.ENABLE_STAKING
     ) {
       dispatch({ type: 'STAKING/FINISH_LOADING', walletId })
       return
diff --git a/src/app.ts b/src/app.ts
index 9c834099c68..a9c1f8d5e45 100644
--- a/src/app.ts
+++ b/src/app.ts
@@ -9,21 +9,46 @@ import NetInfo from '@react-native-community/netinfo'
 import * as Sentry from '@sentry/react-native'
 import { Buffer } from 'buffer'
 import { asObject, asString } from 'cleaners'
-import { Appearance, InteractionManager, LogBox } from 'react-native'
+import { Appearance, InteractionManager, LogBox, Platform } from 'react-native'
 import { getVersion } from 'react-native-device-info'
 import RNFS from 'react-native-fs'
 
 import {
-  getDeviceSettings,
-  initDeviceSettings
+  awaitDeviceSettingsDisk,
+  getDeviceSettings
 } from './actions/DeviceSettingsActions'
 import { showError } from './components/services/AirshipInstance'
 import { changeTheme, getTheme } from './components/services/ThemeContext'
-import { ENV } from './env'
+import { CONFIG } from './config'
+import { KEYS } from './keys'
 import { config } from './theme/appConfig'
 import type { NumberMap } from './types/types'
+import { initAttestation } from './util/attestation'
+import { willSignInfoRollup } from './util/edgeApiSigner'
 import { log, logToServer } from './util/logger'
-import { initCoinrankList, initInfoServer } from './util/network'
+import { INFO_TEST_SERVER, shouldUseTestServers } from './util/maestro'
+import {
+  configureNetwork,
+  initCoinrankList,
+  initInfoServer
+} from './util/network'
+import { getOsVersion } from './util/rnUtils'
+import { runOnce } from './util/runOnce'
+import { checkAppVersion } from './util/versionCheck'
+
+// `CONFIG.INFO_SERVER` overrides the production info servers,
+// e.g. to point a debug build at a local info server. Absent in production
+// builds.
+configureNetwork({
+  infoServers:
+    CONFIG.INFO_SERVER != null && CONFIG.INFO_SERVER.length > 0
+      ? CONFIG.INFO_SERVER
+      : shouldUseTestServers()
+      ? [INFO_TEST_SERVER]
+      : undefined,
+  referralServers: config.referralServers ?? [],
+  notificationServers: config.notificationServers
+})
 
 export type Environment = 'development' | 'testing' | 'production'
 
@@ -35,11 +60,11 @@ const environment: Environment =
     ? 'testing'
     : 'production'
 
-if (ENV.SENTRY_ORGANIZATION_SLUG.includes('SENTRY_ORGANIZATION')) {
+if (KEYS.SENTRY_ORGANIZATION_SLUG.includes('SENTRY_ORGANIZATION')) {
   console.log('Sentry keys not set. Sentry disabled.')
 } else {
   Sentry.init({
-    dsn: ENV.SENTRY_DSN_URL,
+    dsn: KEYS.SENTRY_DSN_URL,
     tracesSampleRate:
       environment === 'production' || environment === 'testing' ? 0.2 : 1.0,
     maxBreadcrumbs: 25,
@@ -57,8 +82,8 @@ if (ENV.SENTRY_ORGANIZATION_SLUG.includes('SENTRY_ORGANIZATION')) {
   })
 }
 
-// Set ENV.LOGBOX_DISABLE to remove popup warning/error boxes.
-if (ENV.LOGBOX_DISABLE) {
+// Set CONFIG.LOGBOX_DISABLE to remove popup warning/error boxes.
+if (CONFIG.LOGBOX_DISABLE) {
   LogBox.ignoreAllLogs()
 } else {
   LogBox.ignoreLogs([
@@ -69,7 +94,7 @@ if (ENV.LOGBOX_DISABLE) {
 
 // Mute specific console output types.
 // Useful for debugging using console output, i.e. mute everything but `debug`
-for (const consoleOutputType of ENV.MUTE_CONSOLE_OUTPUT) {
+for (const consoleOutputType of CONFIG.MUTE_CONSOLE_OUTPUT) {
   switch (consoleOutputType) {
     case 'log':
       console.log = () => {}
@@ -117,7 +142,7 @@ console.log('***********************')
 console.log('App directory: ' + RNFS.DocumentDirectoryPath)
 console.log('***********************')
 
-// @ts-expect-error
+// @ts-expect-error: untyped global clog
 global.clog = console.log
 
 if (!__DEV__) {
@@ -127,7 +152,7 @@ if (!__DEV__) {
   console.error = log
 }
 
-if (ENV.LOG_SERVER) {
+if (CONFIG.LOG_SERVER != null) {
   console.log = function () {
     logToServer(arguments)
   }
@@ -146,12 +171,12 @@ if (PERF_LOGGING_ONLY) {
 }
 
 if (ENABLE_PERF_LOGGING) {
-  // @ts-expect-error
-  if (!global.nativePerformanceNow && window?.performance) {
-    // @ts-expect-error
+  // @ts-expect-error: untyped global nativePerformanceNow
+  if (global.nativePerformanceNow == null && window?.performance != null) {
+    // @ts-expect-error: untyped global nativePerformanceNow
     global.nativePerformanceNow = () => window.performance.now()
   }
-  const makeDate = () => {
+  const makeDate = (): string => {
     const d = new Date(Date.now())
     const h = ('0' + d.getHours().toString()).slice(-2)
     const m = ('0' + d.getMinutes().toString()).slice(-2)
@@ -160,33 +185,33 @@ if (ENABLE_PERF_LOGGING) {
     return `${h}:${m}:${s}.${ms}`
   }
 
-  // @ts-expect-error
+  // @ts-expect-error: untyped global pnow
   global.pnow = function (label: string) {
     const d = makeDate()
     clog(`${d} PTIMER PNOW: ${label}`)
   }
 
-  // @ts-expect-error
+  // @ts-expect-error: untyped global pstart
   global.pstart = function (label: string) {
     const d = makeDate()
-    if (!perfTotals[label]) {
+    if (perfTotals[label] == null || perfTotals[label] === 0) {
       perfTotals[label] = 0
       perfCounters[label] = 0
     }
     if (typeof perfTimers.get(label) === 'undefined') {
-      // @ts-expect-error
+      // @ts-expect-error: untyped global nativePerformanceNow
       perfTimers.set(label, global.nativePerformanceNow())
     } else {
       clog(`${d}: PTIMER Error: PTimer already started: ${label}`)
     }
   }
 
-  // @ts-expect-error
+  // @ts-expect-error: untyped global pend
   global.pend = function (label: string) {
     const d = makeDate()
     const timer = perfTimers.get(label)
     if (typeof timer === 'number') {
-      // @ts-expect-error
+      // @ts-expect-error: untyped global nativePerformanceNow
       const elapsed = global.nativePerformanceNow() - timer
       perfTotals[label] += elapsed
       perfCounters[label]++
@@ -199,7 +224,7 @@ if (ENABLE_PERF_LOGGING) {
     }
   }
 
-  // @ts-expect-error
+  // @ts-expect-error: untyped global pcount
   global.pcount = function (label: string) {
     const d = makeDate()
     if (typeof perfCounters[label] === 'undefined') {
@@ -212,36 +237,37 @@ if (ENABLE_PERF_LOGGING) {
     }
   }
 } else {
-  // @ts-expect-error
+  // @ts-expect-error: untyped global pnow
   global.pnow = function (label: string) {}
-  // @ts-expect-error
+  // @ts-expect-error: untyped global pstart
   global.pstart = function (label: string) {}
-  // @ts-expect-error
+  // @ts-expect-error: untyped global pend
   global.pend = function (label: string) {}
-  // @ts-expect-error
+  // @ts-expect-error: untyped global pcount
   global.pcount = function (label: string) {}
 }
 
 const realFetch = fetch
-// @ts-expect-error
+// @ts-expect-error: reassigning global fetch
 // eslint-disable-next-line no-global-assign
 fetch = async (...args: any) => {
-  // @ts-expect-error
-  return await realFetch(...args).catch(e => {
+  // @ts-expect-error: reassigned fetch return type
+  return await realFetch(...args).catch((e: unknown) => {
+    const err = e as { name?: string; message?: string }
     Sentry.addBreadcrumb({
-      event_id: e.name,
-      message: e.message,
+      event_id: err.name,
+      message: err.message,
       data: args[0]
     })
     throw e
   })
 }
 
-if (ENV.DEBUG_THEME) {
-  const themeFunc = async () => {
+if (CONFIG.DEBUG_THEME) {
+  const themeFunc = async (): Promise<void> => {
     try {
       const oldTheme = getTheme()
-      const { host, port } = asServerDetails(ENV.THEME_SERVER)
+      const { host, port } = asServerDetails(CONFIG.THEME_SERVER)
       const url = `${host}:${port}/theme`
       console.log('THEME:\n' + JSON.stringify(oldTheme, null, 2))
       const postOptions = {
@@ -283,13 +309,21 @@ if (ENV.DEBUG_THEME) {
       console.log(`Failed to access theme server`)
     }
   }
-  themeFunc().catch(err => {
+  themeFunc().catch((err: unknown) => {
     console.error(err)
   })
 }
 
-// Theme initialization and system theme listener
-initDeviceSettings()
+// Theme initialization and system theme listener. Prefer the on-disk
+// themeMode even when the writer-facing init timed out; bound the wait so a
+// hung disk cannot delay boot forever.
+const THEME_SETTINGS_WAIT_MS = 3000
+Promise.race([
+  awaitDeviceSettingsDisk(),
+  new Promise<void>(resolve => {
+    setTimeout(resolve, THEME_SETTINGS_WAIT_MS)
+  })
+])
   .then(() => {
     const { themeMode } = getDeviceSettings()
 
@@ -320,7 +354,7 @@ initDeviceSettings()
       }
     })
   })
-  .catch(err => {
+  .catch((err: unknown) => {
     console.log(err)
   })
 
@@ -330,10 +364,22 @@ NetInfo.addEventListener(state => {
   const currentConnectionState = state.isConnected ?? false
   if (!previousConnectionState && currentConnectionState) {
     console.log('Network connected, refreshing info and coinrank...')
-    initInfoServer().catch(err => {
+    // Start attestation at reconnect (idempotent); previously lived in
+    // initInfoServer before network.ts was made Node-safe.
+    initAttestation()
+    initInfoServer({
+      osType: Platform.OS.toLowerCase(),
+      osVersion: getOsVersion(),
+      appVersion: getVersion(),
+      appId: config.appId ?? 'edge',
+      skipUnsignedLaunchFetch: willSignInfoRollup(),
+      onRollup: async () => {
+        await runOnce('checkAppVersion', checkAppVersion)
+      }
+    }).catch((err: unknown) => {
       console.log(err)
     })
-    initCoinrankList().catch(err => {
+    initCoinrankList().catch((err: unknown) => {
       console.log(err)
     })
   }
diff --git a/src/cli/bootNodeLocale.ts b/src/cli/bootNodeLocale.ts
new file mode 100644
index 00000000000..fa11d4e5779
--- /dev/null
+++ b/src/cli/bootNodeLocale.ts
@@ -0,0 +1,17 @@
+/**
+ * Side-effect locale boot for the CLI client and engine.
+ * Must be the first import in src/cli/index.ts and src/cli/engine/index.ts.
+ */
+import { applyLocale } from '../locales/bootLocale'
+import { detectNodeLocale, parseConfigPathFlag } from '../locales/nodeLocale'
+import { loadConfig } from './engine/cliConfig'
+
+const argv = process.argv.slice(2)
+const fileConfig = loadConfig(parseConfigPathFlag(argv))
+applyLocale(
+  detectNodeLocale({
+    argv,
+    env: process.env,
+    configLocale: fileConfig.locale
+  })
+)
diff --git a/src/cli/client/apiClient.ts b/src/cli/client/apiClient.ts
new file mode 100644
index 00000000000..3768aaea4a1
--- /dev/null
+++ b/src/cli/client/apiClient.ts
@@ -0,0 +1,255 @@
+import http from 'http'
+
+import { stringifyJson } from '../engine/json'
+
+export interface ApiErrorBody {
+  error: {
+    code: string
+    message: string
+    status: number
+    details?: Record<string, unknown>
+  }
+}
+
+export class ApiClientError extends Error {
+  status: number
+  code: string
+  details?: Record<string, unknown>
+
+  constructor(body: ApiErrorBody['error']) {
+    super(body.message)
+    this.name = 'ApiClientError'
+    this.status = body.status
+    this.code = body.code
+    this.details = body.details
+  }
+}
+
+export interface ApiClientOptions {
+  socketPath?: string
+  host?: string
+  port?: number
+  timeoutMs?: number
+}
+
+export class ApiClient {
+  private readonly opts: ApiClientOptions
+
+  constructor(opts: ApiClientOptions) {
+    this.opts = opts
+  }
+
+  async request<T = unknown>(
+    method: string,
+    path: string,
+    body?: unknown
+  ): Promise<T> {
+    const payload =
+      body === undefined ? undefined : Buffer.from(stringifyJson(body), 'utf8')
+
+    const headers: Record<string, string> = {
+      Accept: 'application/json'
+    }
+    if (payload != null) {
+      headers['Content-Type'] = 'application/json; charset=utf-8'
+      headers['Content-Length'] = String(payload.length)
+    }
+
+    const response = await new Promise<{
+      status: number
+      raw: string
+    }>((resolve, reject) => {
+      const req = http.request(
+        {
+          method,
+          path,
+          headers,
+          ...(this.opts.socketPath != null
+            ? { socketPath: this.opts.socketPath }
+            : {
+                host: this.opts.host ?? '127.0.0.1',
+                port: this.opts.port ?? 9008
+              }),
+          timeout: this.opts.timeoutMs ?? 120_000
+        },
+        res => {
+          const chunks: Buffer[] = []
+          res.on('data', (c: Buffer) => chunks.push(c))
+          res.on('end', () => {
+            resolve({
+              status: res.statusCode ?? 0,
+              raw: Buffer.concat(chunks).toString('utf8')
+            })
+          })
+        }
+      )
+      req.on('error', reject)
+      req.on('timeout', () => {
+        req.destroy(new Error('Request timed out'))
+      })
+      if (payload != null) req.write(payload)
+      req.end()
+    })
+
+    if (response.status === 204 || response.raw === '') {
+      if (response.status >= 400) {
+        throw new ApiClientError({
+          code: 'INTERNAL_ERROR',
+          message: `HTTP ${response.status}`,
+          status: response.status
+        })
+      }
+      return undefined as T
+    }
+
+    let parsed: unknown
+    try {
+      parsed = JSON.parse(response.raw)
+    } catch {
+      throw new ApiClientError({
+        code: 'INTERNAL_ERROR',
+        message: `Non-JSON response (${response.status}): ${response.raw.slice(
+          0,
+          200
+        )}`,
+        status: response.status
+      })
+    }
+
+    if (
+      response.status >= 400 &&
+      parsed != null &&
+      typeof parsed === 'object' &&
+      'error' in parsed
+    ) {
+      throw new ApiClientError((parsed as ApiErrorBody).error)
+    }
+
+    if (response.status >= 400) {
+      throw new ApiClientError({
+        code: 'INTERNAL_ERROR',
+        message: `HTTP ${response.status}`,
+        status: response.status,
+        details: parsed as Record<string, unknown>
+      })
+    }
+
+    return parsed as T
+  }
+
+  /**
+   * Hold a Server-Sent Events stream open, handing each frame to `onEvent` as
+   * it arrives. Unlike `request`, nothing is buffered: the response body never
+   * ends until the engine closes it or the caller aborts.
+   *
+   * Resolves when the engine ends the stream, rejects if it cannot be opened.
+   */
+  async stream(
+    path: string,
+    onEvent: (event: string, data: unknown) => void,
+    opts: { signal?: AbortSignal } = {}
+  ): Promise<void> {
+    await new Promise<void>((resolve, reject) => {
+      const req = http.request(
+        {
+          socketPath: this.opts.socketPath,
+          host: this.opts.host,
+          port: this.opts.port,
+          method: 'GET',
+          path,
+          headers: { Accept: 'text/event-stream' }
+        },
+        res => {
+          if (res.statusCode != null && res.statusCode >= 400) {
+            let raw = ''
+            res.setEncoding('utf8')
+            res.on('data', chunk => (raw += chunk))
+            res.on('end', () => {
+              try {
+                const parsed = JSON.parse(raw) as ApiErrorBody
+                reject(new ApiClientError(parsed.error))
+              } catch {
+                reject(
+                  new ApiClientError({
+                    code: 'INTERNAL_ERROR',
+                    message: `HTTP ${res.statusCode ?? 0}`,
+                    status: res.statusCode ?? 500
+                  })
+                )
+              }
+            })
+            return
+          }
+
+          // SSE frames are separated by a blank line. Hold a partial tail
+          // between chunks, since a frame can straddle a TCP read.
+          let buffer = ''
+          res.setEncoding('utf8')
+          res.on('data', (chunk: string) => {
+            buffer += chunk
+            let split = buffer.indexOf('\n\n')
+            while (split !== -1) {
+              const frame = buffer.slice(0, split)
+              buffer = buffer.slice(split + 2)
+              emitFrame(frame, onEvent)
+              split = buffer.indexOf('\n\n')
+            }
+          })
+          res.on('end', () => {
+            resolve()
+          })
+          res.on('error', reject)
+        }
+      )
+      req.on('error', reject)
+      opts.signal?.addEventListener('abort', () => {
+        req.destroy()
+        resolve()
+      })
+      req.end()
+    })
+  }
+
+  async get<T = unknown>(path: string): Promise<T> {
+    return await this.request<T>('GET', path)
+  }
+
+  async post<T = unknown>(path: string, body?: unknown): Promise<T> {
+    return await this.request<T>('POST', path, body)
+  }
+
+  async put<T = unknown>(path: string, body?: unknown): Promise<T> {
+    return await this.request<T>('PUT', path, body)
+  }
+
+  async patch<T = unknown>(path: string, body?: unknown): Promise<T> {
+    return await this.request<T>('PATCH', path, body)
+  }
+
+  async delete<T = unknown>(path: string, body?: unknown): Promise<T> {
+    return await this.request<T>('DELETE', path, body)
+  }
+}
+
+/** Parse one `event:` / `data:` frame. Comment lines (`: ok`) are ignored. */
+function emitFrame(
+  frame: string,
+  onEvent: (event: string, data: unknown) => void
+): void {
+  let event = 'message'
+  const dataLines: string[] = []
+  for (const line of frame.split('\n')) {
+    if (line === '' || line.startsWith(':')) continue
+    if (line.startsWith('event:')) event = line.slice(6).trim()
+    else if (line.startsWith('data:')) dataLines.push(line.slice(5).trim())
+  }
+  if (dataLines.length === 0) return
+  const raw = dataLines.join('\n')
+  let data: unknown = raw
+  try {
+    data = JSON.parse(raw)
+  } catch {
+    // Leave non-JSON payloads as the raw string.
+  }
+  onEvent(event, data)
+}
diff --git a/src/cli/client/output.ts b/src/cli/client/output.ts
new file mode 100644
index 00000000000..b0a0aeaec7a
--- /dev/null
+++ b/src/cli/client/output.ts
@@ -0,0 +1,107 @@
+import { ApiClientError } from './apiClient'
+
+export const EXIT = {
+  OK: 0,
+  GENERIC: 1,
+  USAGE: 2,
+  AUTH: 3,
+  NOT_FOUND: 4,
+  VALIDATION: 5,
+  NETWORK: 6,
+  ENGINE: 7
+} as const
+
+export function printJson(value: unknown): void {
+  if (typeof value === 'string') {
+    console.log(value)
+  } else {
+    console.log(JSON.stringify(value, null, 2))
+  }
+}
+
+/**
+ * Always emit a single JSON object on stderr for machine-readable errors.
+ * No prose banners (e.g. CAPTCHA hints).
+ */
+export function printError(error: unknown): number {
+  if (error instanceof ApiClientError) {
+    const body = {
+      error: {
+        code: error.code,
+        message: error.message,
+        status: error.status,
+        ...(error.details != null ? { details: error.details } : {})
+      }
+    }
+    console.error(JSON.stringify(body, null, 2))
+    return exitCodeForApiError(error.code, error.status)
+  }
+  if (error instanceof Error) {
+    const body = {
+      error: {
+        code: 'INTERNAL_ERROR',
+        message: error.message,
+        status: 500
+      }
+    }
+    console.error(JSON.stringify(body, null, 2))
+    if (
+      /Engine is not running|Timed out waiting for engine/.test(error.message)
+    ) {
+      return EXIT.ENGINE
+    }
+    return EXIT.GENERIC
+  }
+  console.error(
+    JSON.stringify(
+      {
+        error: {
+          code: 'INTERNAL_ERROR',
+          message: String(error),
+          status: 500
+        }
+      },
+      null,
+      2
+    )
+  )
+  return EXIT.GENERIC
+}
+
+function exitCodeForApiError(code: string, status: number): number {
+  if (
+    code === 'INVALID_SESSION' ||
+    code === 'SESSION_EXPIRED' ||
+    code === 'PASSWORD_ERROR' ||
+    code === 'OTP_REQUIRED' ||
+    code === 'CHALLENGE_REQUIRED' ||
+    code === 'PIN_DISABLED'
+  ) {
+    return EXIT.AUTH
+  }
+  if (
+    code === 'NOT_FOUND' ||
+    code === 'WALLET_NOT_FOUND' ||
+    code === 'TOKEN_NOT_FOUND'
+  ) {
+    return EXIT.NOT_FOUND
+  }
+  if (
+    code === 'BAD_REQUEST' ||
+    code === 'INSUFFICIENT_FUNDS' ||
+    code === 'DUST_SPEND' ||
+    code === 'PENDING_FUNDS' ||
+    code === 'SPEND_TO_SELF' ||
+    code === 'NO_AMOUNT_SPECIFIED' ||
+    code === 'AMBIGUOUS_WALLET_ID' ||
+    code === 'USERNAME_ERROR'
+  ) {
+    return EXIT.VALIDATION
+  }
+  // Before the 503 test below: the engine only ever sends this code with a
+  // 503, so testing status first made EXIT.ENGINE unreachable and reported a
+  // daemon that is going away as a network failure.
+  if (code === 'ENGINE_SHUTTING_DOWN') return EXIT.ENGINE
+  if (code === 'NETWORK_ERROR' || status === 503) return EXIT.NETWORK
+  return EXIT.GENERIC
+}
diff --git a/src/cli/client/sessionFile.ts b/src/cli/client/sessionFile.ts
new file mode 100644
index 00000000000..b8a95a88314
--- /dev/null
+++ b/src/cli/client/sessionFile.ts
@@ -0,0 +1,46 @@
+import fs from 'fs'
+
+import { ensureRunDir, sessionFilePath } from '../engine/discovery'
+
+export interface SessionFile {
+  sessionId: string
+  username?: string
+  updatedAt: string
+}
+
+export function readSessionFile(profile: string): SessionFile | null {
+  try {
+    const text = fs.readFileSync(sessionFilePath(profile), 'utf8')
+    return JSON.parse(text) as SessionFile
+  } catch {
+    return null
+  }
+}
+
+export function writeSessionFile(
+  profile: string,
+  sessionId: string,
+  username?: string
+): void {
+  ensureRunDir(profile)
+  const data: SessionFile = {
+    sessionId,
+    username,
+    updatedAt: new Date().toISOString()
+  }
+  const file = sessionFilePath(profile)
+  fs.writeFileSync(file, JSON.stringify(data, null, 2) + '\n', { mode: 0o600 })
+  // `mode` only applies when the file is created, so a session file written
+  // before that option was added keeps its old permissions forever. The run
+  // directory is already 0700, but a session id is a bearer token — narrow it
+  // on every write rather than trusting the directory alone.
+  fs.chmodSync(file, 0o600)
+}
+
+export function clearSessionFile(profile: string): void {
+  try {
+    fs.unlinkSync(sessionFilePath(profile))
+  } catch {
+    // ignore
+  }
+}
diff --git a/src/cli/client/solveCaptcha.ts b/src/cli/client/solveCaptcha.ts
new file mode 100644
index 00000000000..aa22204f639
--- /dev/null
+++ b/src/cli/client/solveCaptcha.ts
@@ -0,0 +1,117 @@
+/**
+ * Headless ALTCHA proof-of-work CAPTCHA solver for login-tester.
+ */
+import crypto from 'crypto'
+import https from 'https'
+
+const REQUEST_TIMEOUT_MS = 30_000
+
+async function httpsGet(
+  url: string
+): Promise<{ status: number; data: string }> {
+  return await new Promise((resolve, reject) => {
+    const req = https.get(url, res => {
+      const chunks: Buffer[] = []
+      res.on('data', (chunk: Buffer | string) => {
+        chunks.push(typeof chunk === 'string' ? Buffer.from(chunk) : chunk)
+      })
+      res.on('end', () => {
+        resolve({
+          status: res.statusCode ?? 0,
+          data: Buffer.concat(chunks).toString('utf8')
+        })
+      })
+    })
+    req.setTimeout(REQUEST_TIMEOUT_MS, () => {
+      req.destroy(
+        new Error(`CAPTCHA GET timed out after ${REQUEST_TIMEOUT_MS}ms`)
+      )
+    })
+    req.on('error', reject)
+  })
+}
+
+async function httpsPost(
+  url: string,
+  body: object
+): Promise<{ status: number; data: string }> {
+  const u = new URL(url)
+  const payload = Buffer.from(JSON.stringify(body), 'utf8')
+  return await new Promise((resolve, reject) => {
+    const req = https.request(
+      {
+        hostname: u.hostname,
+        port: u.port !== '' ? Number(u.port) : 443,
+        path: u.pathname + u.search,
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          'Content-Length': payload.length
+        }
+      },
+      res => {
+        const chunks: Buffer[] = []
+        res.on('data', (chunk: Buffer | string) => {
+          chunks.push(typeof chunk === 'string' ? Buffer.from(chunk) : chunk)
+        })
+        res.on('end', () => {
+          resolve({
+            status: res.statusCode ?? 0,
+            data: Buffer.concat(chunks).toString('utf8')
+          })
+        })
+      }
+    )
+    req.setTimeout(REQUEST_TIMEOUT_MS, () => {
+      req.destroy(
+        new Error(`CAPTCHA POST timed out after ${REQUEST_TIMEOUT_MS}ms`)
+      )
+    })
+    req.on('error', reject)
+    req.write(payload)
+    req.end()
+  })
+}
+
+export async function solveCaptcha(challengeUri: string): Promise<boolean> {
+  const page = await httpsGet(challengeUri)
+  if (page.status < 200 || page.status >= 300) {
+    throw new Error(`CAPTCHA challenge GET failed with status ${page.status}`)
+  }
+  const match = /challenge:\s*(\{[^}]+\})/.exec(page.data)
+  if (match == null) throw new Error('Could not find challenge in page')
+
+  const ch = JSON.parse(match[1]) as {
+    algorithm: string
+    challenge: string
+    maxnumber: number
+    salt: string
+  }
+
+  for (let i = 0; i <= ch.maxnumber; i++) {
+    const hash = crypto
+      .createHash('sha256')
+      .update(ch.salt + String(i))
+      .digest('hex')
+    if (hash === ch.challenge) {
+      const resp = await httpsPost(challengeUri, { solution: i, trail: [] })
+      return resp.status >= 200 && resp.status < 300
+    }
+  }
+  return false
+}
+
+/**
+ * Given challengeId + challengeUri from a CHALLENGE_REQUIRED error,
+ * solve the CAPTCHA and return the challengeId for retry.
+ */
+export async function solveChallenge(details: {
+  challengeId: string
+  challengeUri?: string
+}): Promise<string> {
+  if (details.challengeUri != null) {
+    const ok = await solveCaptcha(details.challengeUri)
+    if (!ok) throw new Error('Failed to solve CAPTCHA')
+  }
+  return details.challengeId
+}
diff --git a/src/cli/client/spawnEngine.ts b/src/cli/client/spawnEngine.ts
new file mode 100644
index 00000000000..ec4234fb8fd
--- /dev/null
+++ b/src/cli/client/spawnEngine.ts
@@ -0,0 +1,188 @@
+import { spawn } from 'child_process'
+import fs from 'fs'
+import path from 'path'
+
+import { getAppliedLocale } from '../../locales/bootLocale'
+import { localeTagsMatch } from '../../locales/nodeLocale'
+import {
+  type EngineRunFile,
+  ensureRunDir,
+  profileHash,
+  type ProfileKey,
+  readRunFile,
+  socketPathFor
+} from '../engine/discovery'
+import { ApiClient } from './apiClient'
+
+/** Last few KB of the spawned engine's output, for error messages. */
+function readTail(path: string, maxBytes: number): string {
+  try {
+    const text = fs.readFileSync(path, 'utf8').trimEnd()
+    if (text === '') return ''
+    return text.length > maxBytes ? text.slice(-maxBytes) : text
+  } catch {
+    return ''
+  }
+}
+
+export interface EnsureEngineOpts extends ProfileKey {
+  /** Serve an in-process fake world instead of a login server. */
+  fake?: boolean
+  apiKey?: string
+  noSpawn?: boolean
+  tcpPort?: number | null
+  idleTimeoutSeconds?: number
+  spawnTimeoutMs?: number
+}
+
+async function sleep(ms: number): Promise<void> {
+  await new Promise(resolve => setTimeout(resolve, ms))
+}
+
+async function pingEngine(socketPath: string): Promise<boolean> {
+  try {
+    const client = new ApiClient({ socketPath, timeoutMs: 3000 })
+    await client.get('/engine/status')
+    return true
+  } catch {
+    return false
+  }
+}
+
+async function warnIfEngineLocaleDiffers(client: ApiClient): Promise<void> {
+  try {
+    const status = await client.get<{ locale?: string }>('/engine/status')
+    const wanted = getAppliedLocale().languageTag
+    if (
+      status.locale != null &&
+      status.locale !== '' &&
+      !localeTagsMatch(status.locale, wanted)
+    ) {
+      console.error(
+        `[edge-cli] Warning: engine locale is ${status.locale}; this client requested ${wanted}. Using the engine locale.`
+      )
+    }
+  } catch {
+    // Status is optional for locale mismatch; spend/login still work.
+  }
+}
+
+export async function ensureEngine(
+  opts: EnsureEngineOpts
+): Promise<{ profile: string; run: EngineRunFile; client: ApiClient }> {
+  const profile = profileHash({
+    appId: opts.appId,
+    directory: opts.directory,
+    testMode: opts.testMode,
+    loginServer: opts.loginServer
+  })
+  const socketPath = socketPathFor(profile)
+
+  if (await pingEngine(socketPath)) {
+    const run = readRunFile(profile)
+    if (run == null) {
+      throw new Error('Engine is up but run file is missing')
+    }
+    const client = new ApiClient({ socketPath })
+    await warnIfEngineLocaleDiffers(client)
+    return {
+      profile,
+      run,
+      client
+    }
+  }
+
+  if (opts.noSpawn === true) {
+    throw new Error(
+      `Engine is not running for profile ${profile} (socket ${socketPath}). Start it with: npm run engine -- -t`
+    )
+  }
+
+  // Resolve engine entry relative to this source file or the package root.
+  // The sibling bundle comes first. Rollup flattens src/cli into lib/edgeCli.js,
+  // so in a built or installed tree (npm, Homebrew's libexec, /usr/lib/edgecli)
+  // `__dirname` is the package's `lib/` and its sibling is lib/edgeEngine.js —
+  // while `../engine/index.ts` resolves above the package and the cwd
+  // candidates point at whatever directory the user's shell happens to be in.
+  // Running from source it cannot false-positive: `__dirname` is
+  // src/cli/client, which has no edgeEngine.js.
+  const candidates = [
+    path.resolve(__dirname, 'edgeEngine.js'),
+    path.resolve(__dirname, '../engine/index.ts'),
+    path.resolve(process.cwd(), 'src/cli/engine/index.ts'),
+    path.resolve(process.cwd(), 'lib/edgeEngine.js')
+  ]
+  const engineEntry = candidates.find(p => {
+    try {
+      return fs.existsSync(p)
+    } catch {
+      return false
+    }
+  })
+  if (engineEntry == null) {
+    throw new Error(
+      `Could not find edge-engine entry. Tried:\n${candidates
+        .map(p => `  - ${p}`)
+        .join('\n')}`
+    )
+  }
+  const args = engineEntry.endsWith('.js')
+    ? [engineEntry]
+    : ['-r', 'sucrase/register', engineEntry]
+  if (opts.testMode) args.push('-t')
+  if (opts.fake === true) args.push('--fake')
+  if (opts.directory !== '') args.push('-d', opts.directory)
+  if (opts.appId !== '') args.push('-a', opts.appId)
+  if (opts.apiKey != null && opts.apiKey !== '') args.push('-k', opts.apiKey)
+  if (opts.tcpPort != null) args.push(`--tcp=${opts.tcpPort}`)
+  if (opts.idleTimeoutSeconds != null) {
+    args.push(`--idle-timeout=${opts.idleTimeoutSeconds}`)
+  }
+  const applied = getAppliedLocale()
+  args.push(`--locale=${applied.languageTag}`)
+
+  // Ensure directory exists for core data
+  try {
+    fs.mkdirSync(opts.directory, { recursive: true })
+  } catch {
+    // ignore
+  }
+
+  // Capture the child's output: a detached engine that dies during startup
+  // (bad keys.json, plugin load failure) would otherwise fail silently and
+  // surface only as a spawn timeout.
+  const startupLog = path.join(ensureRunDir(profile), 'engine-startup.log')
+  const logFd = fs.openSync(startupLog, 'w')
+  const child = spawn(process.execPath, args, {
+    detached: true,
+    stdio: ['ignore', logFd, logFd],
+    env: { ...process.env, EDGE_CLI_LOCALE: applied.languageTag }
+  })
+  child.unref()
+  fs.closeSync(logFd)
+
+  const timeout = opts.spawnTimeoutMs ?? 30_000
+  const start = Date.now()
+  while (Date.now() - start < timeout) {
+    await sleep(250)
+    if (await pingEngine(socketPath)) {
+      const run = readRunFile(profile)
+      if (run == null) continue
+      const client = new ApiClient({ socketPath })
+      await warnIfEngineLocaleDiffers(client)
+      return {
+        profile,
+        run,
+        client
+      }
+    }
+  }
+
+  const tail = readTail(startupLog, 2000)
+  throw new Error(
+    `Timed out waiting for engine to start (profile ${profile}).` +
+      (tail === ''
+        ? ` No engine output; see ${startupLog}.`
+        : `\n--- engine output (${startupLog}) ---\n${tail}`)
+  )
+}
diff --git a/src/cli/command.ts b/src/cli/command.ts
new file mode 100644
index 00000000000..406cbe5941a
--- /dev/null
+++ b/src/cli/command.ts
@@ -0,0 +1,78 @@
+import type { ApiClient } from './client/apiClient'
+
+export interface CliContext {
+  client: ApiClient
+  profile: string
+  sessionId: string | null
+  setSessionId: (sessionId: string | null, username?: string) => void
+  testMode: boolean
+  /** Set when --solve-captcha retries a login after CHALLENGE_REQUIRED. */
+  challengeId?: string
+}
+
+export type CommandHandler = (
+  ctx: CliContext,
+  argv: string[]
+) => Promise<void> | void
+
+export interface Command {
+  name: string
+  usage?: string
+  help?: string
+  needsSession?: boolean
+  invoke: CommandHandler
+}
+
+// A null-prototype map, so user input like `constructor` or `toString` cannot
+// resolve to an inherited Object.prototype member instead of a Command.
+const commands: Record<string, Command> = Object.create(null)
+
+export class UsageError extends Error {
+  command?: Command
+  constructor(command?: Command, message = 'Incorrect arguments') {
+    super(message)
+    this.name = 'UsageError'
+    this.command = command
+  }
+}
+
+export function command(
+  name: string,
+  opts: {
+    usage?: string
+    help?: string
+    needsSession?: boolean
+    replace?: boolean
+  },
+  invoke: CommandHandler
+): Command {
+  if (name in commands && opts.replace !== true) {
+    throw new Error(`Command "${name}" defined twice`)
+  }
+  const cmd: Command = {
+    name,
+    usage: opts.usage,
+    help: opts.help,
+    needsSession: opts.needsSession === true,
+    invoke
+  }
+  commands[name] = cmd
+  return cmd
+}
+
+export function findCommand(name: string): Command {
+  const cmd = commands[name]
+  if (cmd == null) throw new UsageError(undefined, `No command named "${name}"`)
+  return cmd
+}
+
+export function listCommands(): string[] {
+  return Object.keys(commands).sort((a, b) => a.localeCompare(b))
+}
+
+export function requireSession(ctx: CliContext): string {
+  if (ctx.sessionId == null) {
+    throw new UsageError(undefined, 'Please log in first (no sessionId)')
+  }
+  return ctx.sessionId
+}
diff --git a/src/cli/commandArgs.ts b/src/cli/commandArgs.ts
new file mode 100644
index 00000000000..2bc80aa0db0
--- /dev/null
+++ b/src/cli/commandArgs.ts
@@ -0,0 +1,123 @@
+import { type Command, UsageError } from './command'
+
+export type FlagKind = 'string' | 'boolean' | 'repeat' | 'boolstr'
+
+export interface ParseSpec {
+  /** Default `required` when omitted and a positional is expected. */
+  positional?: 'required' | 'optional' | 'none'
+  flags?: Record<string, FlagKind>
+}
+
+export interface ParsedCommandArgs {
+  positional?: string
+  string: (name: string) => string | undefined
+  requireString: (name: string) => string
+  strings: (name: string) => string[]
+  boolean: (name: string) => boolean
+  boolstr: (name: string) => boolean | undefined
+}
+
+function flagKind(spec: ParseSpec, name: string): FlagKind | undefined {
+  return spec.flags?.[name]
+}
+
+function parseBoolstr(cmd: Command, name: string, raw: string): boolean {
+  if (raw === 'true' || raw === '1') return true
+  if (raw === 'false' || raw === '0') return false
+  throw new UsageError(cmd, `--${name} must be true or false`)
+}
+
+/**
+ * Parse command-local argv after the command name.
+ * `--name=value` is preferred; `--name value` is accepted.
+ * Boolean flags are presence-only (`--dry-run`).
+ */
+export function parseCommandArgs(
+  cmd: Command,
+  argv: string[],
+  spec: ParseSpec
+): ParsedCommandArgs {
+  const positionalMode = spec.positional ?? 'none'
+  const strings: Record<string, string[]> = Object.create(null)
+  const booleans: Record<string, boolean> = Object.create(null)
+  let positional: string | undefined
+  let sawPositional = false
+
+  const takeValue = (
+    name: string,
+    current: string,
+    i: number
+  ): { value: string; next: number } => {
+    const eq = current.indexOf('=')
+    if (eq !== -1) {
+      const value = current.slice(eq + 1)
+      if (value === '') {
+        throw new UsageError(cmd, `--${name} requires a value`)
+      }
+      return { value, next: i }
+    }
+    const next = argv[i + 1]
+    if (next == null || next.startsWith('-')) {
+      throw new UsageError(cmd, `--${name} requires a value`)
+    }
+    return { value: next, next: i + 1 }
+  }
+
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i]
+    if (arg === '--') {
+      throw new UsageError(cmd, 'Unexpected --')
+    }
+    if (arg.startsWith('--')) {
+      const name = arg.slice(2).split('=')[0]
+      const kind = flagKind(spec, name)
+      if (kind == null) {
+        throw new UsageError(cmd, `Unknown option --${name}`)
+      }
+      if (kind === 'boolean') {
+        if (arg.includes('=')) {
+          throw new UsageError(cmd, `--${name} does not take a value`)
+        }
+        booleans[name] = true
+        continue
+      }
+      const { value, next } = takeValue(name, arg, i)
+      i = next
+      if (kind === 'repeat') {
+        strings[name] = [...(strings[name] ?? []), value]
+      } else {
+        strings[name] = [value]
+      }
+      continue
+    }
+    if (arg.startsWith('-')) {
+      throw new UsageError(cmd, `Unknown option ${arg}`)
+    }
+    if (positionalMode === 'none' || sawPositional) {
+      throw new UsageError(cmd)
+    }
+    positional = arg
+    sawPositional = true
+  }
+
+  if (positionalMode === 'required' && positional == null) {
+    throw new UsageError(cmd)
+  }
+
+  return {
+    positional,
+    string: name => strings[name]?.[0],
+    requireString: name => {
+      const value = strings[name]?.[0]
+      if (value == null) throw new UsageError(cmd, `Missing --${name}`)
+      return value
+    },
+    strings: name => strings[name] ?? [],
+    boolean: name => booleans[name],
+    boolstr: name => {
+      const raw = strings[name]?.[0]
+      if (raw == null) return undefined
+      return parseBoolstr(cmd, name, raw)
+    }
+  }
+}
diff --git a/src/cli/commands/account.ts b/src/cli/commands/account.ts
new file mode 100644
index 00000000000..ed23e462582
--- /dev/null
+++ b/src/cli/commands/account.ts
@@ -0,0 +1,34 @@
+import { printJson } from '../client/output'
+import { command, requireSession, UsageError } from '../command'
+import { parseCommandArgs } from '../commandArgs'
+
+function accountPath(sessionId: string, suffix: string): string {
+  return `/account/${encodeURIComponent(sessionId)}${suffix}`
+}
+
+const deleteRemoteCmd = command(
+  'delete-remote-account',
+  {
+    usage: 'delete-remote-account --yes',
+    help: 'Permanently delete the remote account (account.deleteRemoteAccount)',
+    needsSession: true
+  },
+  async (ctx, argv) => {
+    const args = parseCommandArgs(deleteRemoteCmd, argv, {
+      positional: 'none',
+      flags: { yes: 'boolean' }
+    })
+    // The endpoint has no guard, so the guard lives here: this is
+    // irreversible and takes the account's funds with it.
+    if (!args.boolean('yes')) {
+      throw new UsageError(
+        deleteRemoteCmd,
+        'delete-remote-account is irreversible; pass --yes to confirm'
+      )
+    }
+    const sessionId = requireSession(ctx)
+    await ctx.client.post(accountPath(sessionId, '/delete-remote-account'))
+    ctx.setSessionId(null)
+    printJson({ ok: true })
+  }
+)
diff --git a/src/cli/commands/all.ts b/src/cli/commands/all.ts
new file mode 100644
index 00000000000..c5bc699f6a1
--- /dev/null
+++ b/src/cli/commands/all.ts
@@ -0,0 +1,12 @@
+/**
+ * Importing this module registers every one-shot CLI command as a
+ * side-effect. Import it once from the CLI entry point.
+ */
+import './account'
+import './generated'
+import './edge'
+import './help'
+import './localSettings'
+import './login'
+import './subscribe'
+import './wallet'
diff --git a/src/cli/commands/edge.ts b/src/cli/commands/edge.ts
new file mode 100644
index 00000000000..e5fcd8c76a4
--- /dev/null
+++ b/src/cli/commands/edge.ts
@@ -0,0 +1,94 @@
+import { printJson } from '../client/output'
+import { command } from '../command'
+import { parseCommandArgs } from '../commandArgs'
+
+interface PendingEdgeLogin {
+  pendingId: string
+  lobbyId: string
+  uri: string
+  state: 'pending' | 'started' | 'done' | 'error' | 'closed'
+  username: string | null
+  session?: { sessionId: string; username?: string } | null
+  error?: string | null
+}
+
+const POLL_INTERVAL_MS = 2000
+const TIMEOUT_MS = 5 * 60 * 1000
+
+async function sleep(ms: number): Promise<void> {
+  await new Promise(resolve => setTimeout(resolve, ms))
+}
+
+const requestCmd = command(
+  'request-edge-login',
+  {
+    usage: 'request-edge-login [--no-wait]',
+    help: 'Request a QR / lobby Edge login and wait for approval'
+  },
+  async (ctx, argv) => {
+    const args = parseCommandArgs(requestCmd, argv, {
+      positional: 'none',
+      flags: { 'no-wait': 'boolean' }
+    })
+    const pending = await ctx.client.post<PendingEdgeLogin>(
+      '/request-edge-login'
+    )
+    // `--no-wait` prints the lobby and stops, so the QR can be shown while
+    // another process polls the same handle with `poll-edge-login`.
+    if (args.boolean('no-wait')) {
+      printJson(pending)
+      return
+    }
+    printJson(pending)
+
+    const deadline = Date.now() + TIMEOUT_MS
+    let current = pending
+    while (
+      current.state !== 'done' &&
+      current.state !== 'error' &&
+      current.state !== 'closed'
+    ) {
+      if (Date.now() > deadline) {
+        throw new Error('Timed out waiting for Edge login approval')
+      }
+      await sleep(POLL_INTERVAL_MS)
+      current = await ctx.client.get<PendingEdgeLogin>(
+        `/pending-edge-login/${encodeURIComponent(pending.pendingId)}`
+      )
+    }
+
+    if (current.state === 'done' && current.session != null) {
+      ctx.setSessionId(current.session.sessionId, current.session.username)
+      printJson(current)
+    } else {
+      printJson(current)
+      throw new Error(
+        current.error ?? `Edge login ended in state "${current.state}"`
+      )
+    }
+  }
+)
+
+const pollCmd = command(
+  'poll-edge-login',
+  {
+    usage: 'poll-edge-login <pendingId>',
+    help: 'Check a pending QR login once, without waiting',
+    needsSession: false
+  },
+  async (ctx, argv) => {
+    const args = parseCommandArgs(pollCmd, argv, {
+      positional: 'required',
+      flags: {}
+    })
+    const current = await ctx.client.get<PendingEdgeLogin>(
+      `/pending-edge-login/${encodeURIComponent(args.positional ?? '')}`
+    )
+    // A finished poll carries the session, so store it here rather than
+    // making the caller copy a sessionId out of the JSON.
+    if (current.state === 'done' && current.session != null) {
+      ctx.setSessionId(current.session.sessionId, current.session.username)
+    }
+    printJson(current)
+  }
+)
diff --git a/src/cli/commands/generated.ts b/src/cli/commands/generated.ts
new file mode 100644
index 00000000000..be814a1b58a
--- /dev/null
+++ b/src/cli/commands/generated.ts
@@ -0,0 +1,150 @@
+/**
+ * Registers every command that is just an argument mapping.
+ *
+ * The table comes from `src/cli/generated/commands.json`, produced from the
+ * route declarations. A command listed there needs no code: its positional,
+ * flags, method and path are all in the declaration, so the mapping below is
+ * the same for all of them.
+ *
+ * Commands doing something the request shape cannot describe are hand-written
+ * in their own module and marked `custom: true` on the route.
+ */
+import { printJson } from '../client/output'
+import { command, requireSession, UsageError } from '../command'
+import { type FlagKind, parseCommandArgs } from '../commandArgs'
+import table from '../generated/commands.json'
+
+interface ArgSpec {
+  flag?: string
+  field: string
+  target: 'query' | 'body'
+  kind: 'string' | 'boolean' | 'boolstr' | 'repeat' | 'json'
+  required: boolean
+}
+
+interface CommandSpec {
+  command: string
+  method: string
+  path: string
+  usage: string
+  help: string
+  needsSession: boolean
+  pathPositional?: string
+  args: ArgSpec[]
+  bodyFlag?: string
+  preset?: Record<string, boolean>
+}
+
+/** Argument kinds map onto the parser's flag kinds. */
+function flagKind(kind: ArgSpec['kind']): FlagKind {
+  if (kind === 'boolean') return 'boolean'
+  if (kind === 'repeat') return 'repeat'
+  return 'string'
+}
+
+function parseJson(raw: string, spec: CommandSpec, what: string): unknown {
+  try {
+    return JSON.parse(raw)
+  } catch {
+    throw new UsageError(undefined, `--${what} must be valid JSON`)
+  }
+}
+
+for (const spec of (table as { commands: CommandSpec[] }).commands) {
+  const cmd = command(
+    spec.command,
+    {
+      usage: spec.usage,
+      help: spec.help,
+      needsSession: spec.needsSession
+    },
+    async (ctx, argv) => {
+      const flags: Record<string, FlagKind> = {}
+      for (const a of spec.args) {
+        if (a.flag != null) flags[a.flag] = flagKind(a.kind)
+      }
+      if (spec.bodyFlag != null) flags[spec.bodyFlag] = 'string'
+
+      const args = parseCommandArgs(cmd, argv, {
+        positional: spec.pathPositional != null ? 'required' : 'none',
+        flags
+      })
+
+      const query = new URLSearchParams()
+      let body: Record<string, unknown> | undefined
+
+      const put = (a: ArgSpec, value: unknown): void => {
+        if (a.target === 'query') {
+          query.set(a.field, String(value))
+        } else {
+          body = body ?? {}
+          body[a.field] = value
+        }
+      }
+
+      if (spec.preset != null) {
+        body = { ...(body ?? {}), ...spec.preset }
+      }
+      if (spec.bodyFlag != null) {
+        const raw = args.requireString(spec.bodyFlag)
+        body = parseJson(raw, spec, spec.bodyFlag) as Record<string, unknown>
+      } else {
+        for (const a of spec.args) {
+          if (a.flag == null) continue
+          if (a.kind === 'boolean') {
+            if (args.boolean(a.flag)) put(a, true)
+            continue
+          }
+          if (a.kind === 'boolstr') {
+            // `--flag=true|false`, for a field that must be sent either way.
+            const value = args.boolstr(a.flag)
+            if (value == null) {
+              if (a.required) throw new UsageError(cmd, `Missing --${a.flag}`)
+              continue
+            }
+            put(a, value)
+            continue
+          }
+          if (a.kind === 'repeat') {
+            const values = args.strings(a.flag)
+            if (values.length > 0) put(a, values)
+            else if (a.required)
+              throw new UsageError(cmd, `Missing --${a.flag}`)
+            continue
+          }
+          const value = args.string(a.flag)
+          if (value == null) {
+            if (a.required) throw new UsageError(cmd, `Missing --${a.flag}`)
+            continue
+          }
+          put(a, a.kind === 'json' ? parseJson(value, spec, a.flag) : value)
+        }
+      }
+
+      // `{sessionId}` is filled from the stored session; other path params
+      // come from the command's positional.
+      let path = spec.path
+      if (spec.needsSession) {
+        path = path.replace(
+          '{sessionId}',
+          encodeURIComponent(requireSession(ctx))
+        )
+      }
+      if (spec.pathPositional != null) {
+        path = path.replace(
+          `{${spec.pathPositional}}`,
+          encodeURIComponent(String(args.positional ?? ''))
+        )
+      }
+
+      const qs = query.toString()
+      if (qs !== '') path += (path.includes('?') ? '&' : '?') + qs
+
+      const result =
+        spec.method === 'GET'
+          ? await ctx.client.get(path)
+          : await ctx.client.post(path, body)
+      printJson(result ?? { ok: true })
+    }
+  )
+}
diff --git a/src/cli/commands/help.ts b/src/cli/commands/help.ts
new file mode 100644
index 00000000000..ea11ade59db
--- /dev/null
+++ b/src/cli/commands/help.ts
@@ -0,0 +1,65 @@
+import { printJson } from '../client/output'
+import { command, findCommand, listCommands, UsageError } from '../command'
+import helpDocs from '../generated/helpDocs.json'
+
+interface ParamHelp {
+  /** How to supply it on the command line, or null when REST-only. */
+  pass: string | null
+  doc?: string
+  optional?: boolean
+}
+
+interface CommandHelp {
+  summary: string
+  description?: string
+  core?: string
+  method: string
+  path: string
+  usage: string
+  params?: Record<string, ParamHelp>
+  returns?: Record<string, string>
+  returnsDoc?: string
+  notes?: string[]
+  errors?: string[]
+}
+
+const generated: Record<string, CommandHelp> = helpDocs.commands as Record<
+  string,
+  CommandHelp
+>
+
+const helpCmd = command(
+  'help',
+  {
+    usage: 'help [<command>]',
+    help: 'List all commands, or show usage and documentation for one command'
+  },
+  (_ctx, argv) => {
+    if (argv.length > 1) throw new UsageError(helpCmd)
+
+    if (argv.length === 0) {
+      printJson({ commands: listCommands() })
+      return
+    }
+
+    const [name] = argv
+    const target = findCommand(name)
+    // Prose comes from the route's JSDoc via src/cli/generated/helpDocs.json.
+    // Commands not yet declared with route() fall back to their own string.
+    const docs = generated[target.name]
+    printJson({
+      name: target.name,
+      usage: docs?.usage ?? target.usage ?? target.name,
+      summary: docs?.summary ?? target.help ?? null,
+      ...(docs?.description != null ? { description: docs.description } : {}),
+      ...(docs?.core != null ? { core: docs.core } : {}),
+      ...(docs != null ? { rest: `${docs.method} ${docs.path}` } : {}),
+      ...(docs?.params != null ? { params: docs.params } : {}),
+      ...(docs?.returns != null ? { returns: docs.returns } : {}),
+      ...(docs?.returnsDoc != null ? { returnsDoc: docs.returnsDoc } : {}),
+      ...(docs?.notes != null ? { notes: docs.notes } : {}),
+      ...(docs?.errors != null ? { errors: docs.errors } : {}),
+      needsSession: target.needsSession === true
+    })
+  }
+)
diff --git a/src/cli/commands/localSettings.ts b/src/cli/commands/localSettings.ts
new file mode 100644
index 00000000000..e6aa7640cd8
--- /dev/null
+++ b/src/cli/commands/localSettings.ts
@@ -0,0 +1,38 @@
+import { printJson } from '../client/output'
+import { command, requireSession } from '../command'
+import { parseCommandArgs } from '../commandArgs'
+
+/**
+ * One command over two routes: reading with no flag, writing with one. That
+ * dispatch is why this is hand-written rather than generated.
+ */
+const localSettingsCmd = command(
+  'local-settings',
+  {
+    usage: 'local-settings [--spam-filter-on=true|false]',
+    help: 'Show or set device-local account settings',
+    needsSession: true
+  },
+  async (ctx, argv) => {
+    const args = parseCommandArgs(localSettingsCmd, argv, {
+      positional: 'none',
+      flags: { 'spam-filter-on': 'boolstr' }
+    })
+    const sessionId = requireSession(ctx)
+    const spamFilterOn = args.boolstr('spam-filter-on')
+    if (spamFilterOn == null) {
+      printJson(
+        await ctx.client.get(
+          `/account/${encodeURIComponent(sessionId)}/local-settings`
+        )
+      )
+      return
+    }
+    printJson(
+      await ctx.client.post(
+        `/account/${encodeURIComponent(sessionId)}/change-local-settings`,
+        { spamFilterOn }
+      )
+    )
+  }
+)
diff --git a/src/cli/commands/login.ts b/src/cli/commands/login.ts
new file mode 100644
index 00000000000..79ff367621b
--- /dev/null
+++ b/src/cli/commands/login.ts
@@ -0,0 +1,184 @@
+import { printJson } from '../client/output'
+import {
+  type CliContext,
+  command,
+  requireSession,
+  UsageError
+} from '../command'
+import { parseCommandArgs } from '../commandArgs'
+
+interface Session {
+  sessionId: string
+  username?: string
+  [key: string]: unknown
+}
+
+const accountCreateCmd = command(
+  'create-account',
+  {
+    usage:
+      'create-account [--username=<name>] --password=<pass> --pin=<pin> [--otp=<code>] [--otp-key=<key>] [--challenge-id=<id>]',
+    help: 'Create a new Edge account'
+  },
+  async (ctx, argv) => {
+    const args = parseCommandArgs(accountCreateCmd, argv, {
+      positional: 'none',
+      flags: {
+        username: 'string',
+        password: 'string',
+        pin: 'string',
+        otp: 'string',
+        'otp-key': 'string',
+        'challenge-id': 'string'
+      }
+    })
+    const session = await ctx.client.post<Session>('/create-account', {
+      username: args.string('username'),
+      password: args.requireString('password'),
+      pin: args.requireString('pin'),
+      otp: args.string('otp'),
+      otpKey: args.string('otp-key'),
+      challengeId: args.string('challenge-id') ?? ctx.challengeId
+    })
+    ctx.setSessionId(session.sessionId, session.username)
+    printJson(session)
+  }
+)
+
+const passwordLoginCmd = command(
+  'login-with-password',
+  {
+    usage:
+      'login-with-password --username=<name> --password=<pass> [--otp=<code>] [--otp-key=<key>] [--challenge-id=<id>]',
+    help: 'Log in with a username and password'
+  },
+  async (ctx, argv) => {
+    const args = parseCommandArgs(passwordLoginCmd, argv, {
+      positional: 'none',
+      flags: {
+        username: 'string',
+        password: 'string',
+        otp: 'string',
+        'otp-key': 'string',
+        'challenge-id': 'string'
+      }
+    })
+    const session = await ctx.client.post<Session>('/login-with-password', {
+      username: args.requireString('username'),
+      password: args.requireString('password'),
+      otp: args.string('otp'),
+      otpKey: args.string('otp-key'),
+      challengeId: args.string('challenge-id') ?? ctx.challengeId
+    })
+    ctx.setSessionId(session.sessionId, session.username)
+    printJson(session)
+  }
+)
+
+const keyLoginCmd = command(
+  'login-with-key',
+  {
+    usage:
+      'login-with-key --username-or-login-id=<value> --login-key=<key> [--otp=<code>] [--otp-key=<key>] [--challenge-id=<id>]',
+    help: 'Log in with a raw account login key'
+  },
+  async (ctx, argv) => {
+    const args = parseCommandArgs(keyLoginCmd, argv, {
+      positional: 'none',
+      flags: {
+        'username-or-login-id': 'string',
+        'login-key': 'string',
+        otp: 'string',
+        'otp-key': 'string',
+        'challenge-id': 'string'
+      }
+    })
+    const session = await ctx.client.post<Session>('/login-with-key', {
+      usernameOrLoginId: args.requireString('username-or-login-id'),
+      loginKey: args.requireString('login-key'),
+      otp: args.string('otp'),
+      otpKey: args.string('otp-key'),
+      challengeId: args.string('challenge-id') ?? ctx.challengeId
+    })
+    ctx.setSessionId(session.sessionId, session.username)
+    printJson(session)
+  }
+)
+
+const pinLoginCmd = command(
+  'login-with-pin',
+  {
+    usage:
+      'login-with-pin --username-or-login-id=<value> --pin=<pin> [--otp=<code>] [--otp-key=<key>] [--challenge-id=<id>]',
+    help: 'Log in with a device PIN'
+  },
+  async (ctx, argv) => {
+    const args = parseCommandArgs(pinLoginCmd, argv, {
+      positional: 'none',
+      flags: {
+        'username-or-login-id': 'string',
+        pin: 'string',
+        otp: 'string',
+        'otp-key': 'string',
+        'challenge-id': 'string'
+      }
+    })
+    const session = await ctx.client.post<Session>('/login-with-pin', {
+      usernameOrLoginId: args.requireString('username-or-login-id'),
+      pin: args.requireString('pin'),
+      otp: args.string('otp'),
+      otpKey: args.string('otp-key'),
+      challengeId: args.string('challenge-id') ?? ctx.challengeId
+    })
+    ctx.setSessionId(session.sessionId, session.username)
+    printJson(session)
+  }
+)
+
+const recoveryLoginCmd = command(
+  'login-with-recovery',
+  {
+    usage:
+      'login-with-recovery --username=<name> --recovery-key=<key> --answer=<text> [--answer=…] [--otp=<code>] [--otp-key=<key>] [--challenge-id=<id>]',
+    help: 'Log in with recovery-question answers'
+  },
+  async (ctx, argv) => {
+    const args = parseCommandArgs(recoveryLoginCmd, argv, {
+      positional: 'none',
+      flags: {
+        username: 'string',
+        'recovery-key': 'string',
+        answer: 'repeat',
+        otp: 'string',
+        'otp-key': 'string',
+        'challenge-id': 'string'
+      }
+    })
+    const answers = args.strings('answer')
+    if (answers.length === 0) {
+      throw new UsageError(recoveryLoginCmd, 'Missing --answer')
+    }
+    const session = await ctx.client.post<Session>('/login-with-recovery', {
+      username: args.requireString('username'),
+      recoveryKey: args.requireString('recovery-key'),
+      answers
+    })
+    ctx.setSessionId(session.sessionId, session.username)
+    printJson(session)
+  }
+)
+
+command(
+  'logout',
+  {
+    usage: 'logout',
+    help: 'Log out of the current session',
+    needsSession: true
+  },
+  async (ctx: CliContext) => {
+    const sessionId = requireSession(ctx)
+    await ctx.client.post(`/account/${encodeURIComponent(sessionId)}/logout`)
+    ctx.setSessionId(null)
+    printJson({ ok: true })
+  }
+)
diff --git a/src/cli/commands/subscribe.ts b/src/cli/commands/subscribe.ts
new file mode 100644
index 00000000000..cabfa2c95c9
--- /dev/null
+++ b/src/cli/commands/subscribe.ts
@@ -0,0 +1,73 @@
+import { EXIT, printJson } from '../client/output'
+import { command } from '../command'
+import { parseCommandArgs } from '../commandArgs'
+
+interface ClosedData {
+  reason?: string
+}
+
+/**
+ * Why the engine ended a stream decides the exit code, using the same table
+ * one-shot commands use: a session ending is an auth condition, the engine
+ * going away is an engine condition.
+ */
+function exitCodeForClose(reason: string | undefined): number {
+  switch (reason) {
+    case 'logout':
+    case 'expired':
+    case 'cancelled':
+      return EXIT.AUTH
+    case 'engineShutdown':
+    case 'shutdown':
+      return EXIT.ENGINE
+    default:
+      return EXIT.ENGINE
+  }
+}
+
+const subscribeCmd = command(
+  'subscribe',
+  {
+    usage: 'subscribe [--type=<eventType>]',
+    help: 'Stream engine events as newline-delimited JSON until interrupted'
+  },
+  async (ctx, argv) => {
+    const args = parseCommandArgs(subscribeCmd, argv, {
+      positional: 'none',
+      flags: { type: 'repeat' }
+    })
+    const wanted = new Set(args.strings('type'))
+
+    const controller = new AbortController()
+    let closeReason: string | undefined
+    let interrupted = false
+
+    const stop = (): void => {
+      interrupted = true
+      controller.abort()
+    }
+    process.on('SIGINT', stop)
+    process.on('SIGTERM', stop)
+
+    await ctx.client.stream(
+      '/engine/events',
+      (type, data) => {
+        if (type === 'subscription.closed') {
+          closeReason = (data as ClosedData)?.reason
+        }
+        if (wanted.size > 0 && !wanted.has(type)) return
+        // One JSON object per line, so the stream pipes into jq or a log.
+        printJson({ type, data })
+      },
+      { signal: controller.signal }
+    )
+
+    process.off('SIGINT', stop)
+    process.off('SIGTERM', stop)
+
+    if (interrupted) return
+    // The engine ended the stream. Say why, and exit accordingly.
+    printJson({ type: 'subscription.ended', data: { reason: closeReason } })
+    process.exit(exitCodeForClose(closeReason))
+  }
+)
diff --git a/src/cli/commands/wallet.ts b/src/cli/commands/wallet.ts
new file mode 100644
index 00000000000..1abba602f90
--- /dev/null
+++ b/src/cli/commands/wallet.ts
@@ -0,0 +1,292 @@
+import fs from 'fs'
+import path from 'path'
+
+import { parseExportFormats, type TxExportFormat } from '../../util/txExport'
+import { printJson } from '../client/output'
+import { command, requireSession, UsageError } from '../command'
+import { parseCommandArgs } from '../commandArgs'
+
+/**
+ * A wallet-scoped URL.
+ *
+ * The wallet id is not in it: ids are base64, so `7o7i6/tlI+qi…=` contains a
+ * path delimiter. It travels as a named argument instead — in the query for
+ * `GET`, the body for `POST`.
+ */
+function walletPath(sessionId: string, verb = ''): string {
+  return `/account/${encodeURIComponent(sessionId)}/wallet${verb}`
+}
+
+const walletStateCmd = command(
+  'change-wallet-states',
+  {
+    usage:
+      'change-wallet-states --wallet-id=<id> [--archived=true|false] [--deleted=true|false] [--hidden=true|false] [--sort-index=N]',
+    help: 'Set wallet archived/deleted/hidden/sortIndex (account.changeWalletStates)',
+    needsSession: true
+  },
+  async (ctx, argv) => {
+    const args = parseCommandArgs(walletStateCmd, argv, {
+      positional: 'none',
+      flags: {
+        'wallet-id': 'string',
+        archived: 'boolstr',
+        deleted: 'boolstr',
+        hidden: 'boolstr',
+        'sort-index': 'string'
+      }
+    })
+    const state: Record<string, unknown> = {}
+    const archived = args.boolstr('archived')
+    const deleted = args.boolstr('deleted')
+    const hidden = args.boolstr('hidden')
+    const sortIndexRaw = args.string('sort-index')
+    if (archived != null) state.archived = archived
+    if (deleted != null) state.deleted = deleted
+    if (hidden != null) state.hidden = hidden
+    if (sortIndexRaw != null) {
+      const sortIndex = Number(sortIndexRaw)
+      if (!Number.isFinite(sortIndex)) {
+        throw new UsageError(walletStateCmd, '--sort-index must be a number')
+      }
+      state.sortIndex = sortIndex
+    }
+    if (Object.keys(state).length === 0) {
+      throw new UsageError(
+        walletStateCmd,
+        'Provide at least one of --archived, --deleted, --hidden, --sort-index'
+      )
+    }
+    const sessionId = requireSession(ctx)
+    await ctx.client.post(
+      `/account/${encodeURIComponent(sessionId)}/change-wallet-states`,
+      { walletStates: { [args.requireString('wallet-id')]: state } }
+    )
+    printJson({ ok: true })
+  }
+)
+
+const balanceCmd = command(
+  'balance-map',
+  {
+    usage: 'balance-map --wallet-id=<id> [--token-id=<tokenId>]',
+    help: 'Show native and exchange balance-map for a wallet (or one token)',
+    needsSession: true
+  },
+  async (ctx, argv) => {
+    const args = parseCommandArgs(balanceCmd, argv, {
+      positional: 'none',
+      flags: { 'wallet-id': 'string', 'token-id': 'string' }
+    })
+    const sessionId = requireSession(ctx)
+    const tokenId = args.string('token-id')
+    const result = await ctx.client.get<{
+      balances: Array<{ tokenId: string | null }>
+    }>(
+      walletPath(sessionId, '/balance-map') +
+        `?walletId=${encodeURIComponent(args.requireString('wallet-id'))}`
+    )
+    if (tokenId == null) {
+      printJson(result)
+      return
+    }
+    printJson({
+      balances: result.balances.filter(entry => entry.tokenId === tokenId)
+    })
+  }
+)
+
+const txListCmd = command(
+  'get-transactions',
+  {
+    usage:
+      'get-transactions --wallet-id=<id> [--token-id=<id>] [--limit=<n>] [--offset=<n>] [--start-date=<ISO-8601>] [--end-date=<ISO-8601>] [--search-string=<text>] [--fiat=USD] [--export-format=csv,qbo,bitwave] [--out=<path>] [--bitwave-account=<id>]',
+    help: 'List or export wallet transactions (JSON by default; CSV/QBO/Bitwave via REST exportFormat)',
+    needsSession: true
+  },
+  async (ctx, argv) => {
+    const args = parseCommandArgs(txListCmd, argv, {
+      positional: 'none',
+      flags: {
+        'wallet-id': 'string',
+        'token-id': 'string',
+        limit: 'string',
+        offset: 'string',
+        'start-date': 'string',
+        'end-date': 'string',
+        'search-string': 'string',
+        fiat: 'string',
+        'export-format': 'string',
+        out: 'string',
+        'bitwave-account': 'string'
+      }
+    })
+    let formats: TxExportFormat[]
+    try {
+      formats = parseExportFormats(args.string('export-format'))
+    } catch (error: unknown) {
+      const message = error instanceof Error ? error.message : String(error)
+      throw new UsageError(txListCmd, message)
+    }
+    const out = args.string('out')
+    if (formats.length > 0 && out == null) {
+      throw new UsageError(
+        txListCmd,
+        '--export-format requires --out=<path> (relative to the current directory or absolute)'
+      )
+    }
+    if (formats.length === 0 && out != null) {
+      throw new UsageError(txListCmd, '--out requires --export-format')
+    }
+    const bitwaveAccount = args.string('bitwave-account')
+    if (bitwaveAccount != null && !formats.includes('bitwave')) {
+      throw new UsageError(
+        txListCmd,
+        '--bitwave-account requires bitwave in --export-format'
+      )
+    }
+
+    const sessionId = requireSession(ctx)
+    const query = new URLSearchParams()
+    query.set('walletId', args.requireString('wallet-id'))
+    const tokenId = args.string('token-id')
+    const limit = args.string('limit')
+    const offset = args.string('offset')
+    const startDate = args.string('start-date')
+    const endDate = args.string('end-date')
+    const searchString = args.string('search-string')
+    const fiat = args.string('fiat')
+    if (tokenId != null) query.set('tokenId', tokenId)
+    if (limit != null) query.set('limit', limit)
+    if (offset != null) query.set('offset', offset)
+    if (startDate != null) query.set('startDate', startDate)
+    if (endDate != null) query.set('endDate', endDate)
+    if (searchString != null) query.set('searchString', searchString)
+    if (fiat != null) query.set('fiat', fiat)
+    if (formats.length > 0) query.set('exportFormat', formats.join(','))
+    if (bitwaveAccount != null) query.set('bitwaveAccountId', bitwaveAccount)
+    const qs = query.toString()
+    const result = await ctx.client.get<{
+      ok?: boolean
+      isoFiat?: string
+      total?: number
+      transactions?: unknown
+      files?: Array<{ format: TxExportFormat; contents: string }>
+    }>(walletPath(sessionId, '/get-transactions') + `?${qs}`)
+
+    if (formats.length === 0 || result.files == null) {
+      printJson(result)
+      return
+    }
+
+    const written = await writeExportFiles(out!, result.files)
+    printJson({
+      ok: true,
+      isoFiat: result.isoFiat,
+      total: result.total,
+      files: written
+    })
+  }
+)
+
+function resolveUserPath(out: string): string {
+  return path.isAbsolute(out) ? out : path.resolve(process.cwd(), out)
+}
+
+function exportFilePath(
+  out: string,
+  format: TxExportFormat,
+  count: number
+): string {
+  const resolved = resolveUserPath(out)
+  if (count <= 1) return resolved
+  let stem = resolved
+  if (stem.endsWith('.bitwave.csv')) {
+    stem = stem.slice(0, -'.bitwave.csv'.length)
+  } else if (stem.endsWith('.csv')) {
+    stem = stem.slice(0, -'.csv'.length)
+  } else if (stem.endsWith('.qbo')) {
+    stem = stem.slice(0, -'.qbo'.length)
+  }
+  if (format === 'bitwave') return `${stem}.bitwave.csv`
+  if (format === 'qbo') return `${stem}.qbo`
+  return `${stem}.csv`
+}
+
+async function writeExportFiles(
+  out: string,
+  files: Array<{ format: TxExportFormat; contents: string }>
+): Promise<Array<{ format: TxExportFormat; path: string }>> {
+  const written: Array<{ format: TxExportFormat; path: string }> = []
+  for (const file of files) {
+    const filePath = exportFilePath(out, file.format, files.length)
+    await fs.promises.mkdir(path.dirname(filePath), { recursive: true })
+    await fs.promises.writeFile(filePath, file.contents, 'utf8')
+    written.push({ format: file.format, path: filePath })
+  }
+  return written
+}
+
+const changeEnabledTokenIdsCmd = command(
+  'change-enabled-token-ids',
+  {
+    usage:
+      'change-enabled-token-ids --wallet-id=<id> (--token-ids=<a,b,c> | --add=<id> | --remove=<id>)',
+    help: 'Set the wallet\u2019s enabled token set (wallet.changeEnabledTokenIds)',
+    needsSession: true
+  },
+  async (ctx, argv) => {
+    const args = parseCommandArgs(changeEnabledTokenIdsCmd, argv, {
+      positional: 'none',
+      flags: {
+        'wallet-id': 'string',
+        'token-ids': 'string',
+        add: 'repeat',
+        remove: 'repeat'
+      }
+    })
+    const sessionId = requireSession(ctx)
+    const walletId = args.requireString('wallet-id')
+    const listed = args.string('token-ids')
+    const added = args.strings('add')
+    const removed = args.strings('remove')
+
+    if (listed != null && (added.length > 0 || removed.length > 0)) {
+      throw new UsageError(
+        changeEnabledTokenIdsCmd,
+        '--token-ids cannot be combined with --add or --remove'
+      )
+    }
+
+    let tokenIds: string[]
+    if (listed != null) {
+      tokenIds = listed
+        .split(',')
+        .map(id => id.trim())
+        .filter(id => id !== '')
+    } else if (added.length > 0 || removed.length > 0) {
+      // --add / --remove are client-side sugar: core only has a full setter,
+      // so read the current set first and send back the whole list.
+      const current = await ctx.client.get<{ enabledTokenIds: string[] }>(
+        walletPath(sessionId, '/tokens') +
+          `?walletId=${encodeURIComponent(walletId)}`
+      )
+      const next = new Set(current.enabledTokenIds)
+      for (const id of added) next.add(id)
+      for (const id of removed) next.delete(id)
+      tokenIds = [...next]
+    } else {
+      throw new UsageError(
+        changeEnabledTokenIdsCmd,
+        'Provide --token-ids, --add, or --remove'
+      )
+    }
+
+    printJson(
+      await ctx.client.post(
+        walletPath(sessionId, '/change-enabled-token-ids'),
+        { walletId, tokenIds }
+      )
+    )
+  }
+)
diff --git a/src/cli/declare-modules.d.ts b/src/cli/declare-modules.d.ts
new file mode 100644
index 00000000000..05202f9c3a3
--- /dev/null
+++ b/src/cli/declare-modules.d.ts
@@ -0,0 +1,3 @@
+declare module 'lib-cmdparse'
+declare module 'source-map-support'
+declare module 'xdg-basedir'
diff --git a/src/cli/engine/appConfig.ts b/src/cli/engine/appConfig.ts
new file mode 100644
index 00000000000..d1d9aeec717
--- /dev/null
+++ b/src/cli/engine/appConfig.ts
@@ -0,0 +1,72 @@
+/**
+ * Load GUI-style config.json (swapPlugins).
+ * Searches ./config.json then ~/.edge-cli/config.json.
+ */
+import { asObject, asOptional, asUnknown, type Cleaner } from 'cleaners'
+import fs from 'fs'
+import os from 'os'
+import { join, resolve } from 'path'
+
+export interface AppConfigFile {
+  swapPlugins?: Record<string, unknown>
+}
+
+const asAppConfigFile: Cleaner<AppConfigFile> = asObject({
+  swapPlugins: asOptional(asObject(asUnknown))
+})
+
+function isMissingFile(error: unknown): boolean {
+  return (
+    error != null &&
+    typeof error === 'object' &&
+    'code' in error &&
+    (error as { code: string }).code === 'ENOENT'
+  )
+}
+
+/** Where loadAppConfig looks, in order. */
+export function appConfigSearchPaths(): string[] {
+  return [
+    resolve('./config.json'),
+    join(os.homedir(), '.edge-cli', 'config.json')
+  ]
+}
+
+function readAppConfigFile(path: string): AppConfigFile | null {
+  let text: string
+  try {
+    text = fs.readFileSync(path, 'utf8')
+  } catch (error: unknown) {
+    if (isMissingFile(error)) return null
+    throw error
+  }
+  let json: unknown
+  try {
+    json = JSON.parse(text)
+  } catch (error: unknown) {
+    const message = error instanceof Error ? error.message : String(error)
+    throw new Error(`Invalid JSON in ${path}: ${message}`)
+  }
+  try {
+    return asAppConfigFile(json)
+  } catch (error: unknown) {
+    const message = error instanceof Error ? error.message : String(error)
+    throw new Error(`Invalid config.json at ${path}: ${message}`)
+  }
+}
+
+/**
+ * Loads config.json from (in order):
+ * 1. ./config.json
+ * 2. ~/.edge-cli/config.json
+ *
+ * Missing files are skipped. Present but invalid JSON/cleaner failures throw,
+ * matching loadKeys, so a typo cannot silently disable every swap plugin.
+ */
+export function loadAppConfig(): AppConfigFile {
+  for (const path of appConfigSearchPaths()) {
+    const parsed = readAppConfigFile(path)
+    if (parsed != null) return parsed
+  }
+  return {}
+}
diff --git a/src/cli/engine/cliConfig.ts b/src/cli/engine/cliConfig.ts
new file mode 100644
index 00000000000..96a302c4301
--- /dev/null
+++ b/src/cli/engine/cliConfig.ts
@@ -0,0 +1,65 @@
+import { asBoolean, asObject, asOptional, asString } from 'cleaners'
+import fs from 'fs'
+import os from 'os'
+import { join, resolve } from 'path'
+
+export interface CliConfig {
+  apiKey?: string
+  appId?: string
+  authServer?: string
+  directory?: string
+  locale?: string
+  password?: string
+  testMode?: boolean
+  username?: string
+  workingDir?: string
+}
+
+const asCliConfig = asObject<CliConfig>({
+  apiKey: asOptional(asString),
+  appId: asOptional(asString),
+  authServer: asOptional(asString),
+  directory: asOptional(asString),
+  locale: asOptional(asString),
+  password: asOptional(asString),
+  testMode: asOptional(asBoolean),
+  username: asOptional(asString),
+  workingDir: asOptional(asString)
+})
+
+export function loadConfig(configPath?: string): CliConfig {
+  let where: string | undefined
+  let text: string | undefined
+
+  if (configPath != null) {
+    try {
+      where = resolve(configPath)
+      text = fs.readFileSync(where, 'utf8')
+    } catch (error) {
+      throw new Error(
+        `Cannot load config file "${configPath}": ${String(error)}`
+      )
+    }
+  } else {
+    try {
+      where = resolve(
+        join(os.homedir(), '.config', 'edge-cli', 'edge-cli.conf')
+      )
+      text = fs.readFileSync(where, 'utf8')
+    } catch {
+      // optional
+    }
+  }
+
+  if (text == null || where == null) return {}
+
+  try {
+    return asCliConfig(JSON.parse(text))
+  } catch (error) {
+    throw new Error(`Cannot load config file "${where}": ${String(error)}`)
+  }
+}
+
+export function defaultDirectory(): string {
+  return join(os.homedir(), '.config', 'edge-cli')
+}
diff --git a/src/cli/engine/discovery.ts b/src/cli/engine/discovery.ts
new file mode 100644
index 00000000000..2947e33cf16
--- /dev/null
+++ b/src/cli/engine/discovery.ts
@@ -0,0 +1,129 @@
+import crypto from 'crypto'
+import fs from 'fs'
+import os from 'os'
+import { join } from 'path'
+
+export const API_VERSION = '1.0.0'
+
+export interface ProfileKey {
+  appId: string
+  directory: string
+  testMode: boolean
+  loginServer?: string
+}
+
+export interface EngineRunFile {
+  pid: number
+  apiVersion: string
+  socketPath: string
+  tcpPort: number | null
+  appId: string
+  testMode: boolean
+  startedAt: string
+}
+
+export function profileHash(key: ProfileKey): string {
+  const payload = JSON.stringify({
+    appId: key.appId,
+    directory: key.directory,
+    testMode: key.testMode,
+    loginServer: key.loginServer ?? null
+  })
+  return crypto.createHash('sha256').update(payload).digest('hex').slice(0, 16)
+}
+
+export function runDir(profile: string): string {
+  return join(os.homedir(), '.edge-cli', 'run', profile)
+}
+
+export function socketPathFor(profile: string): string {
+  return join(runDir(profile), 'engine.sock')
+}
+
+export function runFilePath(profile: string): string {
+  return join(runDir(profile), 'engine.json')
+}
+
+export function sessionFilePath(profile: string): string {
+  return join(runDir(profile), 'session.json')
+}
+
+export function ensureRunDir(profile: string): string {
+  const dir = runDir(profile)
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 })
+  return dir
+}
+
+export function writeRunFile(profile: string, data: EngineRunFile): void {
+  ensureRunDir(profile)
+  const path = runFilePath(profile)
+  fs.writeFileSync(path, JSON.stringify(data, null, 2) + '\n', {
+    mode: 0o600
+  })
+  try {
+    // `mode` only applies when creating; force 0600 on rewrite.
+    fs.chmodSync(path, 0o600)
+  } catch {
+    // ignore
+  }
+}
+
+export function readRunFile(profile: string): EngineRunFile | null {
+  try {
+    const text = fs.readFileSync(runFilePath(profile), 'utf8')
+    return JSON.parse(text) as EngineRunFile
+  } catch {
+    return null
+  }
+}
+
+export function removeRunArtifacts(profile: string): void {
+  const sock = socketPathFor(profile)
+  const run = runFilePath(profile)
+  try {
+    fs.unlinkSync(sock)
+  } catch {
+    // ignore
+  }
+  try {
+    fs.unlinkSync(run)
+  } catch {
+    // ignore
+  }
+}
+
+function isProcessAlive(pid: number): boolean {
+  try {
+    process.kill(pid, 0)
+    return true
+  } catch (error: unknown) {
+    // EPERM means the pid exists but belongs to another user.
+    return (
+      error != null &&
+      typeof error === 'object' &&
+      'code' in error &&
+      (error as { code: string }).code === 'EPERM'
+    )
+  }
+}
+
+/**
+ * Remove stale socket / run-file if the recorded pid is dead. Returns the pid
+ * of an engine that is still running for this profile, so the caller can
+ * refuse to start rather than unlinking a live socket out from under it.
+ */
+export function cleanupStaleLock(profile: string): number | null {
+  const run = readRunFile(profile)
+  if (run == null) {
+    // Orphan socket?
+    try {
+      fs.unlinkSync(socketPathFor(profile))
+    } catch {
+      // ignore
+    }
+    return null
+  }
+  if (isProcessAlive(run.pid)) return run.pid
+  removeRunArtifacts(profile)
+  return null
+}
diff --git a/src/cli/engine/doc.ts b/src/cli/engine/doc.ts
new file mode 100644
index 00000000000..f297667f268
--- /dev/null
+++ b/src/cli/engine/doc.ts
@@ -0,0 +1,37 @@
+/**
+ * Attaches prose to a cleaner.
+ *
+ * `doc(asString, 'The name to normalize.')` returns the same cleaner, so it is
+ * invisible at runtime and safe to wrap anything. The documentation build
+ * reads these calls out of the source, which means a field's description sits
+ * against the field itself rather than in a separate tag that has to repeat
+ * its name to find it.
+ *
+ * It works on a whole cleaner too, for responses the engine passes straight
+ * through from core:
+ *
+ *     returns: doc(asCoreValue, 'EdgeLoginMessages, keyed by loginId.')
+ */
+import type { Cleaner } from 'cleaners'
+
+export function doc<T>(cleaner: Cleaner<T>, _prose: string): Cleaner<T> {
+  return cleaner
+}
+
+/**
+ * Path parameters carry scope, and mean the same thing on every route that
+ * takes them, so they are described once here rather than per route.
+ *
+ * Every one of these is base58, which is the rule for a path parameter: no
+ * `/`, `?` or `#`, so it survives a URL without percent-encoding. Anything
+ * else — a base64 wallet id, a free-text username — travels in the query or
+ * the body instead.
+ */
+export const SCOPE_PARAMS: Record<string, string> = {
+  sessionId:
+    'From a successful login. The CLI supplies this from `session.json`, `--session`, or `EDGE_CLI_SESSION`.',
+  objectId: 'An ephemeral object handle id.',
+  pendingId: 'The `pendingId` returned when the QR login was requested.',
+  lobbyId: 'The lobby to act on.',
+  syncKey: 'Base58 sync key for the repo.'
+}
diff --git a/src/cli/engine/encoding.ts b/src/cli/engine/encoding.ts
new file mode 100644
index 00000000000..e497a0dca8e
--- /dev/null
+++ b/src/cli/engine/encoding.ts
@@ -0,0 +1,40 @@
+import baseX from 'base-x'
+
+const base58Codec = baseX(
+  '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz'
+)
+
+export const base58 = {
+  parse(text: string): Uint8Array {
+    return base58Codec.decode(text)
+  },
+  stringify(data: Uint8Array | number[]): string {
+    return base58Codec.encode(data)
+  }
+}
+
+export const utf8 = {
+  parse(text: string): Uint8Array {
+    const byteString = encodeURI(text)
+    const out = new Uint8Array(byteString.length)
+    let di = 0
+    for (let i = 0; i < byteString.length; ++i) {
+      const c = byteString.charCodeAt(i)
+      if (c === 0x25) {
+        out[di++] = parseInt(byteString.slice(i + 1, i + 3), 16)
+        i += 2
+      } else {
+        out[di++] = c
+      }
+    }
+    return out.subarray(0, di)
+  },
+
+  stringify(data: ArrayLike<number>): string {
+    let byteString = ''
+    for (const byte of Array.from(data)) {
+      byteString += '%' + (byte >> 4).toString(16) + (byte & 0xf).toString(16)
+    }
+    return decodeURIComponent(byteString)
+  }
+}
diff --git a/src/cli/engine/errors.ts b/src/cli/engine/errors.ts
new file mode 100644
index 00000000000..602c13087ff
--- /dev/null
+++ b/src/cli/engine/errors.ts
@@ -0,0 +1,402 @@
+import {
+  asMaybeChallengeError,
+  asMaybeDustSpendError,
+  asMaybeInsufficientFundsError,
+  asMaybeNetworkError,
+  asMaybeNoAmountSpecifiedError,
+  asMaybeObsoleteApiError,
+  asMaybeOtpError,
+  asMaybePasswordError,
+  asMaybePendingFundsError,
+  asMaybePinDisabledError,
+  asMaybeSameCurrencyError,
+  asMaybeSpendToSelfError,
+  asMaybeSwapAboveLimitError,
+  asMaybeSwapAddressError,
+  asMaybeSwapBelowLimitError,
+  asMaybeSwapCurrencyError,
+  asMaybeSwapPermissionError,
+  asMaybeUsernameError
+} from 'edge-core-js'
+
+export class EngineError extends Error {
+  code: string
+  status: number
+  details?: Record<string, unknown>
+
+  constructor(
+    code: string,
+    message: string,
+    status: number,
+    details?: Record<string, unknown>
+  ) {
+    super(message)
+    this.name = 'EngineError'
+    this.code = code
+    this.status = status
+    this.details = details
+  }
+}
+
+export function engineError(
+  code: string,
+  message: string,
+  status: number,
+  details?: Record<string, unknown>
+): EngineError {
+  return new EngineError(code, message, status, details)
+}
+
+export function toErrorBody(error: unknown): {
+  status: number
+  body: {
+    error: {
+      code: string
+      message: string
+      status: number
+      details?: Record<string, unknown>
+    }
+  }
+} {
+  if (error instanceof EngineError) {
+    return {
+      status: error.status,
+      body: {
+        error: {
+          code: error.code,
+          message: error.message,
+          status: error.status,
+          details: error.details
+        }
+      }
+    }
+  }
+
+  const mapped = mapCoreError(error)
+  if (mapped != null) return mapped
+
+  const message = error instanceof Error ? error.message : String(error)
+  return {
+    status: 500,
+    body: {
+      error: {
+        code: 'INTERNAL_ERROR',
+        message,
+        status: 500
+      }
+    }
+  }
+}
+
+function mapCoreError(error: unknown): {
+  status: number
+  body: {
+    error: {
+      code: string
+      message: string
+      status: number
+      details?: Record<string, unknown>
+    }
+  }
+} | null {
+  const challenge = asMaybeChallengeError(error)
+  if (challenge != null) {
+    const challengeId = challenge.challengeId
+    const challengeUri = challenge.challengeUri
+    const messageParts = [
+      challenge.message !== '' && challenge.message != null
+        ? challenge.message
+        : 'Login requires a CAPTCHA challenge',
+      challengeId != null ? `challengeId=${challengeId}` : null,
+      challengeUri != null ? `challengeUri=${challengeUri}` : null,
+      'Retry the same request with body/query challengeId after solving, or use CLI --solve-captcha.'
+    ].filter((part): part is string => part != null && part !== '')
+    return {
+      status: 403,
+      body: {
+        error: {
+          code: 'CHALLENGE_REQUIRED',
+          message: messageParts.join(' '),
+          status: 403,
+          details: {
+            challengeId,
+            challengeUri
+          }
+        }
+      }
+    }
+  }
+
+  const password = asMaybePasswordError(error)
+  if (password != null) {
+    return {
+      status: 401,
+      body: {
+        error: {
+          code: 'PASSWORD_ERROR',
+          message: password.message,
+          status: 401,
+          details: password.wait != null ? { wait: password.wait } : undefined
+        }
+      }
+    }
+  }
+
+  const otp = asMaybeOtpError(error)
+  if (otp != null) {
+    return {
+      status: 401,
+      body: {
+        error: {
+          code: 'OTP_REQUIRED',
+          message: otp.message,
+          status: 401,
+          details: {
+            reason: otp.reason,
+            loginId: otp.loginId,
+            resetDate: otp.resetDate?.toISOString(),
+            resetToken: otp.resetToken,
+            voucherId: otp.voucherId,
+            voucherAuth: otp.voucherAuth,
+            voucherActivates: otp.voucherActivates?.toISOString()
+          }
+        }
+      }
+    }
+  }
+
+  const username = asMaybeUsernameError(error)
+  if (username != null) {
+    return {
+      status: 400,
+      body: {
+        error: {
+          code: 'USERNAME_ERROR',
+          message: username.message,
+          status: 400
+        }
+      }
+    }
+  }
+
+  const pinDisabled = asMaybePinDisabledError(error)
+  if (pinDisabled != null) {
+    return {
+      status: 403,
+      body: {
+        error: {
+          code: 'PIN_DISABLED',
+          message: pinDisabled.message,
+          status: 403
+        }
+      }
+    }
+  }
+
+  const insufficient = asMaybeInsufficientFundsError(error)
+  if (insufficient != null) {
+    return {
+      status: 422,
+      body: {
+        error: {
+          code: 'INSUFFICIENT_FUNDS',
+          message: insufficient.message,
+          status: 422,
+          details: {
+            tokenId: insufficient.tokenId,
+            networkFee: insufficient.networkFee
+          }
+        }
+      }
+    }
+  }
+
+  const dust = asMaybeDustSpendError(error)
+  if (dust != null) {
+    return {
+      status: 422,
+      body: {
+        error: { code: 'DUST_SPEND', message: dust.message, status: 422 }
+      }
+    }
+  }
+
+  const pending = asMaybePendingFundsError(error)
+  if (pending != null) {
+    return {
+      status: 422,
+      body: {
+        error: {
+          code: 'PENDING_FUNDS',
+          message: pending.message,
+          status: 422
+        }
+      }
+    }
+  }
+
+  const self = asMaybeSpendToSelfError(error)
+  if (self != null) {
+    return {
+      status: 422,
+      body: {
+        error: {
+          code: 'SPEND_TO_SELF',
+          message: self.message,
+          status: 422
+        }
+      }
+    }
+  }
+
+  const noAmount = asMaybeNoAmountSpecifiedError(error)
+  if (noAmount != null) {
+    return {
+      status: 400,
+      body: {
+        error: {
+          code: 'NO_AMOUNT_SPECIFIED',
+          message: noAmount.message,
+          status: 400
+        }
+      }
+    }
+  }
+
+  const network = asMaybeNetworkError(error)
+  if (network != null) {
+    return {
+      status: 503,
+      body: {
+        error: {
+          code: 'NETWORK_ERROR',
+          message: network.message,
+          status: 503
+        }
+      }
+    }
+  }
+
+  const obsolete = asMaybeObsoleteApiError(error)
+  if (obsolete != null) {
+    return {
+      status: 426,
+      body: {
+        error: {
+          code: 'OBSOLETE_API',
+          message: obsolete.message,
+          status: 426
+        }
+      }
+    }
+  }
+
+  const swapAbove = asMaybeSwapAboveLimitError(error)
+  if (swapAbove != null) {
+    return {
+      status: 422,
+      body: {
+        error: {
+          code: 'SWAP_ABOVE_LIMIT',
+          message: swapAbove.message,
+          status: 422,
+          details: {
+            swapPluginId: swapAbove.swapPluginId,
+            nativeMax: swapAbove.nativeMax,
+            direction: swapAbove.direction
+          }
+        }
+      }
+    }
+  }
+
+  const swapBelow = asMaybeSwapBelowLimitError(error)
+  if (swapBelow != null) {
+    return {
+      status: 422,
+      body: {
+        error: {
+          code: 'SWAP_BELOW_LIMIT',
+          message: swapBelow.message,
+          status: 422,
+          details: {
+            swapPluginId: swapBelow.swapPluginId,
+            nativeMin: swapBelow.nativeMin,
+            direction: swapBelow.direction
+          }
+        }
+      }
+    }
+  }
+
+  const swapCurrency = asMaybeSwapCurrencyError(error)
+  if (swapCurrency != null) {
+    return {
+      status: 422,
+      body: {
+        error: {
+          code: 'SWAP_CURRENCY',
+          message: swapCurrency.message,
+          status: 422,
+          details: {
+            pluginId: swapCurrency.pluginId,
+            fromTokenId: swapCurrency.fromTokenId,
+            toTokenId: swapCurrency.toTokenId
+          }
+        }
+      }
+    }
+  }
+
+  const swapPerm = asMaybeSwapPermissionError(error)
+  if (swapPerm != null) {
+    return {
+      status: 403,
+      body: {
+        error: {
+          code: 'SWAP_PERMISSION',
+          message: swapPerm.message,
+          status: 403,
+          details: {
+            pluginId: swapPerm.pluginId,
+            reason: swapPerm.reason
+          }
+        }
+      }
+    }
+  }
+
+  const swapAddr = asMaybeSwapAddressError(error)
+  if (swapAddr != null) {
+    return {
+      status: 422,
+      body: {
+        error: {
+          code: 'SWAP_ADDRESS',
+          message: swapAddr.message,
+          status: 422,
+          details: {
+            swapPluginId: swapAddr.swapPluginId,
+            reason: swapAddr.reason
+          }
+        }
+      }
+    }
+  }
+
+  const sameCurrency = asMaybeSameCurrencyError(error)
+  if (sameCurrency != null) {
+    return {
+      status: 400,
+      body: {
+        error: {
+          code: 'SAME_CURRENCY',
+          message: sameCurrency.message,
+          status: 400
+        }
+      }
+    }
+  }
+
+  return null
+}
diff --git a/src/cli/engine/events.ts b/src/cli/engine/events.ts
new file mode 100644
index 00000000000..c3cfe310b99
--- /dev/null
+++ b/src/cli/engine/events.ts
@@ -0,0 +1,154 @@
+import type { ServerResponse } from 'http'
+
+type Listener = (event: string, data: unknown) => void
+
+/**
+ * Drop an SSE client once this much data is queued for it. A subscriber that
+ * stops reading would otherwise grow the engine's heap without bound.
+ */
+const MAX_SSE_BUFFER_BYTES = 1024 * 1024
+
+/**
+ * What a subscription depends on, which decides when it has to die.
+ *
+ * The `EdgeContext` outlives every account, so `context` streams survive
+ * logout. Anything reading an account or a wallet cannot outlive the session
+ * that owns it, and is torn down when that session goes away.
+ */
+export type SubscriptionScope =
+  | { kind: 'context' }
+  | { kind: 'session'; sessionId: string }
+  | { kind: 'wallet'; sessionId: string; walletId: string }
+
+interface SseClient {
+  res: ServerResponse
+  scope: SubscriptionScope
+}
+
+/** Simple SSE hub. Clients connect via GET /engine/events. */
+export class EventHub {
+  private readonly listeners = new Set<Listener>()
+  private readonly clients = new Set<SseClient>()
+
+  /**
+   * Notified whenever a subscriber attaches or detaches, so the idle timer can
+   * re-arm once the last one leaves.
+   */
+  onClientsChanged: (() => void) | null = null
+
+  /** Live subscriber count. The idle timer holds off while this is non-zero. */
+  get clientCount(): number {
+    return this.clients.size
+  }
+
+  private clientsChanged(): void {
+    try {
+      this.onClientsChanged?.()
+    } catch {
+      // A listener must never break subscribe or logout.
+    }
+  }
+
+  private write(client: SseClient, event: string, data: unknown): boolean {
+    const { res } = client
+    if (res.writableEnded || res.destroyed) return false
+    if (res.writableLength > MAX_SSE_BUFFER_BYTES) {
+      res.destroy()
+      return false
+    }
+    try {
+      res.write(`event: ${event}\ndata: ${JSON.stringify(data)}\n\n`)
+      return true
+    } catch {
+      return false
+    }
+  }
+
+  emit(event: string, data: unknown, scope?: SubscriptionScope): void {
+    for (const listener of this.listeners) {
+      try {
+        listener(event, data)
+      } catch {
+        // ignore
+      }
+    }
+    for (const client of [...this.clients]) {
+      if (scope != null && !scopeMatches(client.scope, scope)) continue
+      if (!this.write(client, event, data)) {
+        this.clients.delete(client)
+        this.clientsChanged()
+      }
+    }
+  }
+
+  subscribe(listener: Listener): () => void {
+    this.listeners.add(listener)
+    return () => {
+      this.listeners.delete(listener)
+    }
+  }
+
+  addSseClient(
+    res: ServerResponse,
+    scope: SubscriptionScope = { kind: 'context' }
+  ): void {
+    res.writeHead(200, {
+      'Content-Type': 'text/event-stream',
+      'Cache-Control': 'no-cache',
+      Connection: 'keep-alive',
+      'X-Edge-Api-Version': '1.0.0'
+    })
+    res.write(': ok\n\n')
+    const client: SseClient = { res, scope }
+    this.clients.add(client)
+    this.clientsChanged()
+    res.on('close', () => {
+      if (this.clients.delete(client)) this.clientsChanged()
+    })
+  }
+
+  /**
+   * End every subscription that depends on this session, so an auto-logout
+   * cannot leave a stream reading an account that no longer exists. Context
+   * subscriptions are untouched.
+   */
+  closeScope(sessionId: string, reason: string): void {
+    for (const client of [...this.clients]) {
+      if (client.scope.kind === 'context') continue
+      if (client.scope.sessionId !== sessionId) continue
+      this.write(client, 'subscription.closed', { reason, sessionId })
+      this.clients.delete(client)
+      try {
+        client.res.end()
+      } catch {
+        // best effort
+      }
+      this.clientsChanged()
+    }
+  }
+
+  closeAll(reason: string): void {
+    for (const client of [...this.clients]) {
+      this.write(client, 'subscription.closed', { reason })
+      this.clients.delete(client)
+      try {
+        client.res.end()
+      } catch {
+        // best effort
+      }
+    }
+    this.clientsChanged()
+  }
+}
+
+/** A client receives an event when its scope is the event's scope or broader. */
+function scopeMatches(
+  client: SubscriptionScope,
+  event: SubscriptionScope
+): boolean {
+  if (client.kind === 'context') return true
+  if (event.kind === 'context') return false
+  if (client.sessionId !== event.sessionId) return false
+  if (client.kind === 'session') return true
+  return event.kind === 'wallet' && client.walletId === event.walletId
+}
diff --git a/src/cli/engine/fetchPluginKeys.ts b/src/cli/engine/fetchPluginKeys.ts
new file mode 100644
index 00000000000..10b3e31f4b8
--- /dev/null
+++ b/src/cli/engine/fetchPluginKeys.ts
@@ -0,0 +1,111 @@
+/**
+ * Fetch plugin secrets from the info server signed infoRollup (`appKeys`)
+ * the same way the GUI `keysStore` does, using the Node native HMAC addon
+ * when available.
+ */
+import { asMaybe } from 'cleaners'
+import type { EdgeApiSigner } from 'edge-core-js'
+import { asInfoRollup } from 'edge-info-server'
+import os from 'os'
+
+import { version as APP_VERSION } from '../../../package.json'
+import { fetchRemoteKeys } from '../../util/keysServer'
+import { configureNetwork, infoServerData } from '../../util/network'
+import { TESTER_SERVERS } from './testerServers'
+
+const PROD_INFO_SERVERS = ['https://info1.edge.app', 'https://info2.edge.app']
+
+export interface FetchPluginKeysOpts {
+  apiSigner?: EdgeApiSigner
+  apiKey?: string
+  apiSecret?: Uint8Array
+  appId: string
+  testMode: boolean
+}
+
+export interface FetchedPluginKeys {
+  pluginApiKeys: Record<string, unknown>
+  assuranceLevel?: string
+}
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return value != null && typeof value === 'object' && !Array.isArray(value)
+}
+
+/**
+ * HMAC appKeys is a keys.json overlay (`corePlugins` / `swapPlugins`).
+ * Older getKeys payloads used a top-level `pluginApiKeys` map.
+ */
+function pluginApiKeysFromRemote(keys: unknown): Record<string, unknown> {
+  if (!isPlainObject(keys)) return {}
+  const core = isPlainObject(keys.corePlugins) ? keys.corePlugins : {}
+  const swap = isPlainObject(keys.swapPlugins) ? keys.swapPlugins : {}
+  const legacy = isPlainObject(keys.pluginApiKeys) ? keys.pluginApiKeys : {}
+  return { ...legacy, ...swap, ...core }
+}
+
+/**
+ * GUI infoRollup uses theme `config.appId ?? 'edge'`. The CLI core context
+ * often boots with an empty appId; the info server still expects the Edge slug.
+ */
+export function getKeysAppId(cliAppId: string): string {
+  return cliAppId === '' ? 'edge' : cliAppId
+}
+
+function rememberPublicRollup(rollup: unknown): void {
+  if (infoServerData.rollup != null) return
+  const cleaned = asMaybe(asInfoRollup)(rollup)
+  if (cleaned != null) infoServerData.rollup = cleaned
+}
+
+function cliOsParams(): {
+  os: 'ios' | 'android'
+  osVersion: string
+  appVersion: string
+} {
+  // infoRollup's HMAC cleaner only accepts the GUI's two OS tags.
+  // Map Node platforms onto those: darwin matches iOS; everything else Android.
+  return {
+    os: os.platform() === 'darwin' ? 'ios' : 'android',
+    osVersion: `${os.platform()}-${os.release()}`,
+    appVersion: APP_VERSION
+  }
+}
+
+export async function fetchPluginKeys(
+  opts: FetchPluginKeysOpts
+): Promise<FetchedPluginKeys> {
+  const infoServers = opts.testMode
+    ? [TESTER_SERVERS.infoServer]
+    : PROD_INFO_SERVERS
+  configureNetwork({ infoServers })
+
+  const appId = getKeysAppId(opts.appId)
+  const osParams = cliOsParams()
+  if (opts.apiSigner != null) {
+    const result = await fetchRemoteKeys({
+      apiSigner: opts.apiSigner,
+      appId,
+      ...osParams
+    })
+    rememberPublicRollup(result.rollup)
+    return {
+      pluginApiKeys: pluginApiKeysFromRemote(result.keys),
+      assuranceLevel: result.assuranceLevel
+    }
+  }
+  if (opts.apiKey != null && opts.apiKey !== '' && opts.apiSecret != null) {
+    const result = await fetchRemoteKeys({
+      apiKey: opts.apiKey,
+      secret: opts.apiSecret,
+      appId,
+      ...osParams
+    })
+    rememberPublicRollup(result.rollup)
+    return {
+      pluginApiKeys: pluginApiKeysFromRemote(result.keys),
+      assuranceLevel: result.assuranceLevel
+    }
+  }
+  throw new Error('No HMAC credentials available for infoRollup appKeys')
+}
diff --git a/src/cli/engine/idleShutdown.ts b/src/cli/engine/idleShutdown.ts
new file mode 100644
index 00000000000..1500e57c9b6
--- /dev/null
+++ b/src/cli/engine/idleShutdown.ts
@@ -0,0 +1,106 @@
+/**
+ * Engine self-shutdown after idle with no logged-in accounts and no live
+ * subscriptions. Default: 300 seconds (5 minutes). Set 0 to disable.
+ *
+ * A subscription holds the engine open even with no account logged in — the
+ * stream would otherwise die under the subscriber. The account auto-logout
+ * timer is separate and is *not* held off by a subscription.
+ */
+export class IdleShutdown {
+  private idleTimeoutMs: number
+  private timer: ReturnType<typeof setTimeout> | null = null
+  private lastActivityAt = Date.now()
+  private readonly onFire: () => void | Promise<void>
+  private readonly getSessionCount: () => number
+  private readonly getSubscriberCount: () => number
+  private shuttingDown = false
+
+  constructor(opts: {
+    idleTimeoutSeconds: number
+    getSessionCount: () => number
+    getSubscriberCount?: () => number
+    onFire: () => void | Promise<void>
+  }) {
+    this.idleTimeoutMs = opts.idleTimeoutSeconds * 1000
+    this.getSessionCount = opts.getSessionCount
+    this.getSubscriberCount = opts.getSubscriberCount ?? (() => 0)
+    this.onFire = opts.onFire
+    this.reset()
+  }
+
+  /** True while something is keeping the engine deliberately alive. */
+  private get held(): boolean {
+    return this.getSessionCount() > 0 || this.getSubscriberCount() > 0
+  }
+
+  get idleShutdownAt(): string | null {
+    if (this.idleTimeoutMs === 0) return null
+    if (this.held) return null
+    return new Date(this.lastActivityAt + this.idleTimeoutMs).toISOString()
+  }
+
+  touch(): void {
+    this.lastActivityAt = Date.now()
+    this.reset()
+  }
+
+  /**
+   * Re-evaluate the timer after a login or logout. Without this the engine
+   * disarms itself while an account is logged in and never re-arms when the
+   * last session goes away, so it would linger until the next request.
+   */
+  notifySessionsChanged(): void {
+    if (this.shuttingDown) return
+    this.touch()
+  }
+
+  /**
+   * Re-evaluate after a subscriber attaches or detaches. Without this the
+   * engine would stay disarmed after the last subscriber left.
+   */
+  notifySubscribersChanged(): void {
+    if (this.shuttingDown) return
+    this.touch()
+  }
+
+  setTimeoutSeconds(seconds: number): void {
+    this.idleTimeoutMs = seconds * 1000
+    this.reset()
+  }
+
+  stop(): void {
+    if (this.timer != null) {
+      clearTimeout(this.timer)
+      this.timer = null
+    }
+  }
+
+  private reset(): void {
+    this.stop()
+    if (this.idleTimeoutMs === 0) return
+    if (this.held) return
+    this.timer = setTimeout(() => {
+      this.fire().catch((error: unknown) => {
+        const message = error instanceof Error ? error.message : String(error)
+        console.warn(`[edge-cli] idle shutdown failed: ${message}`)
+      })
+    }, this.idleTimeoutMs)
+    this.timer.unref?.()
+  }
+
+  private async fire(): Promise<void> {
+    if (this.shuttingDown) return
+    if (this.held) {
+      this.reset()
+      return
+    }
+    this.shuttingDown = true
+    try {
+      await this.onFire()
+    } catch (error: unknown) {
+      this.shuttingDown = false
+      this.reset()
+      throw error
+    }
+  }
+}
diff --git a/src/cli/engine/index.ts b/src/cli/engine/index.ts
new file mode 100644
index 00000000000..e42fff37b74
--- /dev/null
+++ b/src/cli/engine/index.ts
@@ -0,0 +1,340 @@
+/**
+ * Edge CLI engine daemon entry point.
+ *
+ * Usage:
+ *   node -r sucrase/register src/cli/engine/index.ts [options]
+ *   edge-engine -t --tcp=9008
+ *
+ * Options:
+ *   -t, --test              Use tester servers
+ *   --fake                  Emulate login/info/sync in-process (no network)
+ *   -d, --directory <path>  Working directory for core data
+ *   -a, --app-id <id>       Application ID
+ *   -k, --api-key <key>     Override API key
+ *   --locale <tag>          Language tag (BCP 47 / POSIX)
+ *   --tcp=<port>            Also listen on 127.0.0.1:<port> (off by default)
+ *   --tcp-host=<host>       TCP bind host (default 127.0.0.1)
+ *   --idle-timeout=<sec>    Self-shutdown after idle with no sessions (default 300; 0=never)
+ *   -c, --config <path>     Config file
+ *   -h, --help
+ */
+
+import '../bootNodeLocale'
+
+import sourceMapSupport from 'source-map-support'
+
+import { defaultDirectory, loadConfig } from './cliConfig'
+import {
+  API_VERSION,
+  cleanupStaleLock,
+  ensureRunDir,
+  profileHash,
+  removeRunArtifacts,
+  socketPathFor,
+  writeRunFile
+} from './discovery'
+import { EventHub } from './events'
+import { IdleShutdown } from './idleShutdown'
+import { EngineLogger } from './logger'
+import { makeCoreContext } from './makeCoreContext'
+import { ObjectHandleStore } from './objectHandles'
+import { type EngineState, Router } from './router'
+import { registerRoutes } from './routes'
+import { createRequestHandler, listenTcp, listenUnix } from './server'
+import { SessionStore } from './sessions'
+import { TESTER_SERVERS } from './testerServers'
+
+sourceMapSupport.install()
+
+interface EngineArgs {
+  testMode: boolean
+  fake: boolean
+  directory?: string
+  appId?: string
+  apiKey?: string
+  locale?: string
+  tcpPort: number | null
+  tcpHost: string
+  idleTimeoutSeconds: number
+  configPath?: string
+  help: boolean
+}
+
+function parseArgs(argv: string[]): EngineArgs {
+  const args: EngineArgs = {
+    testMode: false,
+    fake: false,
+    tcpPort: null,
+    tcpHost: '127.0.0.1',
+    idleTimeoutSeconds: 300,
+    help: false
+  }
+
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i]
+    if (a === '-h' || a === '--help') {
+      args.help = true
+    } else if (a === '-t' || a === '--test') {
+      args.testMode = true
+    } else if (a === '--fake') {
+      args.fake = true
+    } else if (a === '-d' || a === '--directory') {
+      args.directory = argv[++i]
+    } else if (a.startsWith('--directory=')) {
+      args.directory = a.slice('--directory='.length)
+    } else if (a === '-a' || a === '--app-id') {
+      args.appId = argv[++i]
+    } else if (a.startsWith('--app-id=')) {
+      args.appId = a.slice('--app-id='.length)
+    } else if (a === '-k' || a === '--api-key') {
+      args.apiKey = argv[++i]
+    } else if (a.startsWith('--api-key=')) {
+      args.apiKey = a.slice('--api-key='.length)
+    } else if (a === '--locale') {
+      args.locale = argv[++i]
+    } else if (a.startsWith('--locale=')) {
+      args.locale = a.slice('--locale='.length)
+    } else if (a === '-c' || a === '--config') {
+      args.configPath = argv[++i]
+    } else if (a.startsWith('--config=')) {
+      args.configPath = a.slice('--config='.length)
+    } else if (a === '--tcp') {
+      throw new Error('--tcp requires a port, e.g. --tcp=9008')
+    } else if (a.startsWith('--tcp=')) {
+      const port = Number(a.slice('--tcp='.length))
+      if (!Number.isFinite(port) || port < 0) {
+        throw new Error(`Invalid --tcp port: ${a}`)
+      }
+      args.tcpPort = port
+    } else if (a.startsWith('--tcp-host=')) {
+      args.tcpHost = a.slice('--tcp-host='.length)
+    } else if (a.startsWith('--idle-timeout=')) {
+      const seconds = Number(a.slice('--idle-timeout='.length))
+      if (!Number.isFinite(seconds) || seconds < 0) {
+        throw new Error(`Invalid --idle-timeout: ${a}`)
+      }
+      args.idleTimeoutSeconds = seconds
+    } else if (a === '--idle-timeout') {
+      const raw = argv[++i]
+      const seconds = Number(raw)
+      if (!Number.isFinite(seconds) || seconds < 0) {
+        throw new Error(`Invalid --idle-timeout: ${raw}`)
+      }
+      args.idleTimeoutSeconds = seconds
+    } else {
+      throw new Error(`Unknown argument: ${a}`)
+    }
+  }
+  return args
+}
+
+function printHelp(): void {
+  console.log(`Usage: edge-engine [options]
+
+Options:
+  -t, --test                 Use tester servers (login/info/sync/change-tester)
+      --fake                 Emulate the login/info/sync servers in-process
+  -d, --directory <path>     Working directory for core data
+  -a, --app-id <id>          Application ID
+  -k, --api-key <key>        Override API key from keys.json
+      --locale <tag>         Language tag (BCP 47 or POSIX)
+  --tcp=<port>               Also listen on 127.0.0.1:<port> (off by default)
+  --tcp-host=<host>          TCP bind host (default 127.0.0.1)
+  --idle-timeout=<seconds>   Self-shutdown when idle with no sessions (default 300; 0=never)
+  -c, --config <path>        Config file
+  -h, --help                 Show help
+`)
+}
+
+async function main(): Promise<void> {
+  const args = parseArgs(process.argv.slice(2))
+  if (args.help) {
+    printHelp()
+    process.exit(0)
+  }
+
+  const fileConfig = loadConfig(args.configPath)
+  const appId = args.appId ?? fileConfig.appId ?? ''
+  const directory =
+    args.directory ??
+    fileConfig.directory ??
+    fileConfig.workingDir ??
+    defaultDirectory()
+  const testMode = args.testMode || fileConfig.testMode === true
+  const apiKey = args.apiKey ?? fileConfig.apiKey
+
+  const events = new EventHub()
+  const sessions = new SessionStore(events)
+  const objects = new ObjectHandleStore()
+
+  // The fake world is its own profile, so a fake engine never answers on the
+  // socket a real one is using, or vice versa.
+  const profile = profileHash({
+    appId,
+    directory,
+    testMode,
+    loginServer: args.fake
+      ? 'fake://login'
+      : testMode
+      ? TESTER_SERVERS.loginServer
+      : undefined
+  })
+  const logger = new EngineLogger(profile)
+  logger.info('Engine starting', {
+    pid: process.pid,
+    appId,
+    directory,
+    testMode,
+    locale: args.locale
+  })
+
+  const core = await makeCoreContext({
+    apiKey,
+    appId,
+    directory,
+    testMode,
+    fake: args.fake,
+    events,
+    logger
+  })
+
+  const livePid = cleanupStaleLock(profile)
+  if (livePid != null) {
+    console.error(
+      `[edge-engine] An engine is already running for profile ${profile} (pid ${livePid}).\n` +
+        `Stop it first (edge-cli engine-stop) or use a different --directory/--app-id.`
+    )
+    process.exit(1)
+  }
+  ensureRunDir(profile)
+  const socketPath = socketPathFor(profile)
+
+  let shuttingDown = false
+  let unixServer: Awaited<ReturnType<typeof listenUnix>> | null = null
+  let tcpServer: Awaited<ReturnType<typeof listenTcp>>['server'] | null = null
+  let boundTcpPort: number | null = null
+
+  const shutdown = async (): Promise<void> => {
+    if (shuttingDown) return
+    shuttingDown = true
+    state.shuttingDown = true
+    events.emit('engine.shutdown', { reason: 'requested' })
+    idle.stop()
+    sessions.stopAutoLogoutTicker()
+    objects.stopTicker()
+    await objects.clearAll()
+    await sessions.logoutAll()
+    try {
+      await core.context.close()
+    } catch {
+      // ignore
+    }
+    // Let subscribers learn why the stream ended before the socket closes.
+    events.closeAll('engineShutdown')
+    logger.info('Engine shutdown complete')
+    await logger.close()
+    await new Promise<void>(resolve => {
+      if (unixServer == null) {
+        resolve()
+        return
+      }
+      unixServer.close(() => {
+        resolve()
+      })
+    })
+    await new Promise<void>(resolve => {
+      if (tcpServer == null) {
+        resolve()
+        return
+      }
+      tcpServer.close(() => {
+        resolve()
+      })
+    })
+    removeRunArtifacts(profile)
+    process.exit(0)
+  }
+
+  const idle = new IdleShutdown({
+    idleTimeoutSeconds: args.idleTimeoutSeconds,
+    getSessionCount: () => sessions.size,
+    getSubscriberCount: () => events.clientCount,
+    onFire: async () => {
+      logger.warn('Idle timeout — shutting down')
+      await shutdown()
+    }
+  })
+  sessions.onSessionsChanged = () => {
+    idle.notifySessionsChanged()
+  }
+  events.onClientsChanged = () => {
+    idle.notifySubscribersChanged()
+  }
+
+  const state: EngineState = {
+    core,
+    sessions,
+    objects,
+    events,
+    idle,
+    logger,
+    profile,
+    socketPath,
+    tcpPort: null,
+    startedAt: Date.now(),
+    shuttingDown: false,
+    shutdown
+  }
+
+  const router = new Router()
+  registerRoutes(router)
+
+  unixServer = await listenUnix(createRequestHandler(state, router), socketPath)
+  console.error(`[edge-engine] Listening on unix:${socketPath}`)
+
+  if (args.tcpPort != null) {
+    // Opt-in loopback TCP for local scripts. No transport auth: the engine is
+    // a local convenience daemon; Edge account auth still happens on the login
+    // server (password / PIN / login key / OTP).
+    const tcp = await listenTcp(
+      createRequestHandler(state, router),
+      args.tcpPort,
+      args.tcpHost
+    )
+    tcpServer = tcp.server
+    boundTcpPort = tcp.port
+    state.tcpPort = boundTcpPort
+    console.error(
+      `[edge-engine] Listening on http://${args.tcpHost}:${boundTcpPort}`
+    )
+  }
+
+  writeRunFile(profile, {
+    pid: process.pid,
+    apiVersion: API_VERSION,
+    socketPath,
+    tcpPort: boundTcpPort,
+    appId,
+    testMode,
+    startedAt: new Date().toISOString()
+  })
+
+  sessions.startAutoLogoutTicker()
+  objects.startTicker()
+
+  const onSignal = (): void => {
+    shutdown().catch(() => {})
+  }
+  process.on('SIGINT', onSignal)
+  process.on('SIGTERM', onSignal)
+
+  console.error(
+    `[edge-engine] Ready (pid=${process.pid}, profile=${profile}, testMode=${testMode}, log=${logger.logPath})`
+  )
+  logger.info('Ready', { pid: process.pid, profile, testMode })
+}
+
+main().catch((error: unknown) => {
+  console.error('[edge-engine] Fatal:', error)
+  process.exit(1)
+})
diff --git a/src/cli/engine/internal.ts b/src/cli/engine/internal.ts
new file mode 100644
index 00000000000..b04df7921e8
--- /dev/null
+++ b/src/cli/engine/internal.ts
@@ -0,0 +1,45 @@
+import type { Disklet } from 'disklet'
+import type { EdgeContext } from 'edge-core-js'
+import type { Subscriber } from 'yaob'
+
+export interface LobbyRequest {
+  timeout?: number
+  publicKey?: string
+  loginRequest?: { appId: string }
+  replies?: unknown[]
+}
+
+interface EdgeLobby {
+  readonly on: Subscriber<{ error: Error }>
+  readonly watch: Subscriber<EdgeLobby>
+  readonly lobbyId: string
+  readonly replies: unknown[]
+  close: () => void
+}
+
+export interface SyncResult {
+  changes: Record<string, unknown>
+  status: {
+    lastHash?: string | null
+    lastSync: number
+  }
+}
+
+export interface EdgeInternalStuff {
+  authRequest: (method: string, path: string, body?: object) => Promise<unknown>
+  hashUsername: (username: string) => Promise<Uint8Array>
+  makeLobby: (lobbyRequest: LobbyRequest, period?: number) => Promise<EdgeLobby>
+  fetchLobbyRequest: (lobbyId: string) => Promise<LobbyRequest>
+  sendLobbyReply: (
+    lobbyId: string,
+    lobbyRequest: LobbyRequest,
+    replyData: unknown
+  ) => Promise<void>
+  syncRepo: (syncKey: Uint8Array) => Promise<SyncResult>
+  getRepoDisklet: (syncKey: Uint8Array, dataKey: Uint8Array) => Promise<Disklet>
+}
+
+export function getInternalStuff(context: EdgeContext): EdgeInternalStuff {
+  return (context as unknown as { $internalStuff: EdgeInternalStuff })
+    .$internalStuff
+}
diff --git a/src/cli/engine/json.ts b/src/cli/engine/json.ts
new file mode 100644
index 00000000000..2090715e14a
--- /dev/null
+++ b/src/cli/engine/json.ts
@@ -0,0 +1,63 @@
+/**
+ * JSON helpers for the engine REST API.
+ * Uint8Array -> base64, Date -> ISO-8601, Map -> object.
+ */
+
+export function jsonReplacer(_key: string, value: unknown): unknown {
+  if (value instanceof Uint8Array) {
+    return Buffer.from(value).toString('base64')
+  }
+  if (value instanceof Date) {
+    return value.toISOString()
+  }
+  if (value instanceof Map) {
+    const obj: Record<string, unknown> = {}
+    for (const [k, v] of value.entries()) {
+      obj[String(k)] = v
+    }
+    return obj
+  }
+  return value
+}
+
+export function stringifyJson(value: unknown): string {
+  return JSON.stringify(value, jsonReplacer)
+}
+
+/** Nothing the REST API accepts is anywhere near this large. */
+export const MAX_BODY_BYTES = 4 * 1024 * 1024
+
+function tooLarge(): Error {
+  return Object.assign(
+    new Error(`Request body exceeds ${MAX_BODY_BYTES} bytes`),
+    { code: 'PAYLOAD_TOO_LARGE', status: 413 }
+  )
+}
+
+export async function readJsonBody(
+  req: NodeJS.ReadableStream & {
+    headers?: Record<string, string | string[] | undefined>
+  }
+): Promise<unknown> {
+  const declared = Number(req.headers?.['content-length'] ?? '0')
+  if (Number.isFinite(declared) && declared > MAX_BODY_BYTES) throw tooLarge()
+
+  const chunks: Buffer[] = []
+  let total = 0
+  for await (const chunk of req) {
+    const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+    total += buf.length
+    if (total > MAX_BODY_BYTES) throw tooLarge()
+    chunks.push(buf)
+  }
+  const raw = Buffer.concat(chunks).toString('utf8')
+  if (raw === '') return undefined
+  try {
+    return JSON.parse(raw)
+  } catch {
+    throw Object.assign(new Error('Invalid JSON body'), {
+      code: 'BAD_REQUEST',
+      status: 400
+    })
+  }
+}
diff --git a/src/cli/engine/keysConfig.ts b/src/cli/engine/keysConfig.ts
new file mode 100644
index 00000000000..7ec002ca9a5
--- /dev/null
+++ b/src/cli/engine/keysConfig.ts
@@ -0,0 +1,122 @@
+import {
+  asObject,
+  asOptional,
+  asString,
+  asUnknown,
+  type Cleaner
+} from 'cleaners'
+import fs from 'fs'
+import os from 'os'
+import { join, resolve } from 'path'
+
+export interface KeysConfig {
+  edgeApiKey: string
+  edgeApiSecret?: string
+  pluginApiKeys: Record<string, unknown>
+}
+
+const asKeysConfig: Cleaner<KeysConfig> = asObject({
+  edgeApiKey: asOptional(asString, ''),
+  edgeApiSecret: asOptional(asString),
+  pluginApiKeys: asOptional(asObject(asUnknown), () => ({}))
+})
+
+function makeDefaultKeys(): KeysConfig {
+  return { edgeApiKey: '', edgeApiSecret: undefined, pluginApiKeys: {} }
+}
+
+function isObject(value: unknown): value is Record<string, unknown> {
+  return value != null && typeof value === 'object' && !Array.isArray(value)
+}
+
+/**
+ * Merge plugin settings with the earlier search path taking precedence.
+ * Object values merge field-by-field so a CLI fallback key can supplement,
+ * but cannot replace, GUI config such as Changelly's partnerId.
+ */
+export function mergePluginApiKeys(
+  preferred: Record<string, unknown>,
+  fallback: Record<string, unknown>
+): Record<string, unknown> {
+  const out = { ...fallback }
+  for (const [pluginId, preferredValue] of Object.entries(preferred)) {
+    const fallbackValue = out[pluginId]
+    out[pluginId] =
+      isObject(preferredValue) && isObject(fallbackValue)
+        ? { ...fallbackValue, ...preferredValue }
+        : preferredValue
+  }
+  return out
+}
+
+function isMissingFile(error: unknown): boolean {
+  return (
+    error != null &&
+    typeof error === 'object' &&
+    'code' in error &&
+    (error as { code: string }).code === 'ENOENT'
+  )
+}
+
+/** Where loadKeys looks, in order. */
+export function keysSearchPaths(): string[] {
+  return [resolve('./keys.json'), join(os.homedir(), '.edge-cli', 'keys.json')]
+}
+
+function readKeysFile(path: string): KeysConfig | null {
+  let text: string
+  try {
+    text = fs.readFileSync(path, 'utf8')
+  } catch (error: unknown) {
+    if (isMissingFile(error)) return null
+    throw error
+  }
+  let json: unknown
+  try {
+    json = JSON.parse(text)
+  } catch (error: unknown) {
+    const message = error instanceof Error ? error.message : String(error)
+    throw new Error(`Invalid JSON in ${path}: ${message}`)
+  }
+  try {
+    return asKeysConfig(json)
+  } catch (error: unknown) {
+    const message = error instanceof Error ? error.message : String(error)
+    throw new Error(`Invalid keys.json at ${path}: ${message}`)
+  }
+}
+
+/**
+ * Loads keys.json from (in order):
+ * 1. ./keys.json
+ * 2. ~/.edge-cli/keys.json
+ *
+ * Missing files are skipped. Present but invalid JSON/cleaner failures throw
+ * so misconfiguration is not silently treated as empty defaults. A file that
+ * parses but carries no `edgeApiKey` — such as the GUI's own repo-root
+ * keys.json — does not shadow a later file that does have one.
+ *
+ * Plugin secrets (including Monero LWS `edgeApiKey`) come from signed
+ * infoRollup `appKeys` at engine boot, not from leftover `env.json`
+ * `MONERO_INIT`.
+ */
+export function loadKeys(): KeysConfig {
+  const out = makeDefaultKeys()
+  let foundApiKey = false
+
+  for (const path of keysSearchPaths()) {
+    const parsed = readKeysFile(path)
+    if (parsed == null) continue
+    out.pluginApiKeys = mergePluginApiKeys(
+      out.pluginApiKeys,
+      parsed.pluginApiKeys
+    )
+    if (!foundApiKey && parsed.edgeApiKey !== '') {
+      out.edgeApiKey = parsed.edgeApiKey
+      out.edgeApiSecret = parsed.edgeApiSecret
+      foundApiKey = true
+    }
+  }
+
+  return out
+}
diff --git a/src/cli/engine/logger.ts b/src/cli/engine/logger.ts
new file mode 100644
index 00000000000..ba4e20a8548
--- /dev/null
+++ b/src/cli/engine/logger.ts
@@ -0,0 +1,67 @@
+/**
+ * Engine file logger — background/core logs go here, not to the CLI user's
+ * stdout/stderr. Lifecycle "Ready" lines may still go to stderr for scripts
+ * that wait on startup.
+ */
+import fs from 'fs'
+import os from 'os'
+import path from 'path'
+
+export class EngineLogger {
+  private stream: fs.WriteStream | null = null
+  readonly logPath: string
+
+  constructor(profile: string) {
+    // Engine logs carry usernames, login ids and core diagnostics, so keep
+    // them owner-only rather than at the default umask.
+    const dir = path.join(os.homedir(), '.edge-cli', 'logs')
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 })
+    this.logPath = path.join(dir, `engine-${profile}.log`)
+    this.stream = fs.createWriteStream(this.logPath, {
+      flags: 'a',
+      mode: 0o600
+    })
+    try {
+      // `mode` only applies on creation, so tighten anything an earlier,
+      // laxer run left behind.
+      fs.chmodSync(dir, 0o700)
+      fs.chmodSync(this.logPath, 0o600)
+    } catch {
+      // ignore
+    }
+  }
+
+  write(level: string, message: string, extra?: Record<string, unknown>): void {
+    const line = JSON.stringify({
+      time: new Date().toISOString(),
+      level,
+      message,
+      ...extra
+    })
+    this.stream?.write(line + '\n')
+  }
+
+  info(message: string, extra?: Record<string, unknown>): void {
+    this.write('info', message, extra)
+  }
+
+  warn(message: string, extra?: Record<string, unknown>): void {
+    this.write('warn', message, extra)
+  }
+
+  error(message: string, extra?: Record<string, unknown>): void {
+    this.write('error', message, extra)
+  }
+
+  /** Resolves once buffered lines reach disk, so shutdown can await it. */
+  async close(): Promise<void> {
+    const stream = this.stream
+    this.stream = null
+    if (stream == null) return
+    await new Promise<void>(resolve => {
+      stream.end(() => {
+        resolve()
+      })
+    })
+  }
+}
diff --git a/src/cli/engine/makeCoreContext.ts b/src/cli/engine/makeCoreContext.ts
new file mode 100644
index 00000000000..a9e49d0b994
--- /dev/null
+++ b/src/cli/engine/makeCoreContext.ts
@@ -0,0 +1,337 @@
+import {
+  addEdgeCorePlugins,
+  type EdgeContext,
+  type EdgeCorePluginsInit,
+  lockEdgeCorePlugins,
+  makeEdgeContext,
+  makeFakeEdgeWorld
+} from 'edge-core-js'
+import accountbasedPluginsImport from 'edge-currency-accountbased'
+import currencyPluginsImport from 'edge-currency-plugins'
+import exchangePluginsImport from 'edge-exchange-plugins'
+
+import { loadAppConfig } from './appConfig'
+import { defaultDirectory } from './cliConfig'
+import type { EventHub } from './events'
+import { fetchPluginKeys } from './fetchPluginKeys'
+import { keysSearchPaths, loadKeys, mergePluginApiKeys } from './keysConfig'
+import type { EngineLogger } from './logger'
+import { hasNodeApiSigner, makeNodeApiSigner } from './nodeApiSigner'
+import { TESTER_SERVERS } from './testerServers'
+
+let pluginsLocked = false
+
+/**
+ * CJS/ESM interop: these packages often export `{ default: { bitcoin, … } }`.
+ */
+function unwrapPlugins(mod: Record<string, unknown>): Record<string, unknown> {
+  const inner = mod.default
+  if (
+    inner != null &&
+    typeof inner === 'object' &&
+    !Array.isArray(inner) &&
+    Object.keys(mod).length <= 2
+  ) {
+    return inner as Record<string, unknown>
+  }
+  return mod
+}
+
+function mergePluginInit(
+  configValue: unknown,
+  keysValue: unknown
+): boolean | Record<string, unknown> {
+  if (configValue === false || keysValue === false) return false
+  const cfg =
+    configValue != null &&
+    typeof configValue === 'object' &&
+    !Array.isArray(configValue)
+      ? { ...(configValue as Record<string, unknown>) }
+      : {}
+  const keys =
+    keysValue != null &&
+    typeof keysValue === 'object' &&
+    !Array.isArray(keysValue)
+      ? { ...(keysValue as Record<string, unknown>) }
+      : {}
+  const { enabled: cfgEnabled, ...cfgRest } = cfg
+  const { enabled: keysEnabled, ...keysRest } = keys
+  if (cfgEnabled === false || keysEnabled === false) return false
+  const merged = { ...cfgRest, ...keysRest }
+  if (Object.keys(merged).length > 0) return merged
+  if (configValue === true || keysValue === true) return true
+  if (configValue != null || keysValue != null) return true
+  return false
+}
+
+const currencyPlugins = unwrapPlugins(
+  currencyPluginsImport as unknown as Record<string, unknown>
+)
+const accountbasedPlugins = unwrapPlugins(
+  accountbasedPluginsImport as unknown as Record<string, unknown>
+)
+const exchangePlugins = unwrapPlugins(
+  exchangePluginsImport as unknown as Record<string, unknown>
+)
+
+function ensurePlugins(): void {
+  if (pluginsLocked) return
+  addEdgeCorePlugins(
+    currencyPlugins as Parameters<typeof addEdgeCorePlugins>[0]
+  )
+  addEdgeCorePlugins(
+    accountbasedPlugins as Parameters<typeof addEdgeCorePlugins>[0]
+  )
+  addEdgeCorePlugins(
+    exchangePlugins as Parameters<typeof addEdgeCorePlugins>[0]
+  )
+  lockEdgeCorePlugins()
+  pluginsLocked = true
+}
+
+export interface MakeCoreContextOpts {
+  apiKey?: string
+  appId?: string
+  directory?: string
+  testMode?: boolean
+  /**
+   * Serve a `makeFakeEdgeWorld` context instead of talking to a server.
+   *
+   * The login, info and sync servers are emulated in-process and currency
+   * plugins are cut off from the network, so the whole API can be exercised
+   * with no account, no key and no internet. That is what lets the CLI tests
+   * run in a pre-commit hook.
+   */
+  fake?: boolean
+  events: EventHub
+  logger?: EngineLogger
+}
+
+/**
+ * A context backed by the in-process fake world.
+ *
+ * No API key is needed and `fetchPluginKeys` is skipped, because there is no
+ * server to authenticate to. Only the currency plugins are registered: the
+ * swap and exchange-rate plugins exist to call other people's APIs, which is
+ * exactly what this mode forbids.
+ */
+async function makeFakeCoreContext(
+  opts: MakeCoreContextOpts
+): Promise<CoreContextBundle> {
+  const appId = opts.appId ?? ''
+  const directory = opts.directory ?? defaultDirectory()
+  const pluginsInit: EdgeCorePluginsInit = {}
+  for (const id of Object.keys(currencyPlugins)) pluginsInit[id] = true
+
+  const world = await makeFakeEdgeWorld([], {
+    onLog(event) {
+      opts.logger?.write(String(event.type ?? 'info'), event.message, {
+        source: event.source
+      })
+    }
+  })
+  const context = await world.makeEdgeContext({
+    appId,
+    apiKey: 'fake',
+    cleanDevice: true,
+    plugins: pluginsInit
+  })
+  opts.logger?.info('Using the fake world; no network, no server')
+
+  return {
+    context,
+    appId,
+    testMode: true,
+    directory,
+    servers: { loginServer: 'fake://login', syncServer: 'fake://sync' },
+    pluginsInit,
+    currencyPluginIds: Object.keys(currencyPlugins)
+  }
+}
+
+export interface CoreContextBundle {
+  context: EdgeContext
+  appId: string
+  testMode: boolean
+  directory: string
+  servers: {
+    loginServer?: string
+    infoServer?: string
+    changeServer?: string
+    syncServer?: string | string[]
+  }
+  pluginsInit: EdgeCorePluginsInit
+  /** Enabled currency/accountbased plugin ids (not swap). For wallet-create. */
+  currencyPluginIds: string[]
+}
+
+export async function makeCoreContext(
+  opts: MakeCoreContextOpts
+): Promise<CoreContextBundle> {
+  ensurePlugins()
+  if (opts.fake === true) return await makeFakeCoreContext(opts)
+  const keysConfig = loadKeys()
+  const appConfig = loadAppConfig()
+  const pluginsInit: EdgeCorePluginsInit = {}
+
+  const appId = opts.appId ?? ''
+  const directory = opts.directory ?? defaultDirectory()
+  const testMode = opts.testMode === true
+  const effectiveApiKey = opts.apiKey ?? keysConfig.edgeApiKey
+  // An explicit -k replaces the key, so the keys.json secret no longer belongs
+  // to it. Pairing them would sign every request with a mismatched secret.
+  const apiSecretHex =
+    opts.apiKey != null ? undefined : keysConfig.edgeApiSecret
+  const apiSecret =
+    apiSecretHex != null
+      ? Buffer.from(apiSecretHex.replace(/^0x/i, ''), 'hex')
+      : undefined
+  // Explicit -k / EDGE_CLI_FORCE_KEYS_JSON skips the N-API signer so operators
+  // can point a native-built engine at alternate keys for tester/debug.
+  const forceKeysJson =
+    opts.apiKey != null || process.env.EDGE_CLI_FORCE_KEYS_JSON === '1'
+  const useNativeSigner = !forceKeysJson && hasNodeApiSigner()
+  const apiSigner = useNativeSigner ? makeNodeApiSigner() : undefined
+
+  if (apiSigner == null && effectiveApiKey === '') {
+    throw new Error(
+      'No Edge API key available. Pass one with -k, build the native signer, ' +
+        `or add "edgeApiKey" to one of: ${keysSearchPaths().join(', ')}`
+    )
+  }
+
+  const servers = testMode
+    ? {
+        loginServer: TESTER_SERVERS.loginServer,
+        infoServer: TESTER_SERVERS.infoServer,
+        changeServer: TESTER_SERVERS.changeServer,
+        syncServer: [...TESTER_SERVERS.syncServer]
+      }
+    : {}
+
+  if (testMode) {
+    opts.logger?.info('Using tester servers', { servers })
+  }
+  if (useNativeSigner) {
+    opts.logger?.info('Using Node native Edge API HMAC signer')
+  }
+
+  try {
+    const remote = await fetchPluginKeys({
+      apiSigner,
+      apiKey: effectiveApiKey,
+      apiSecret,
+      appId,
+      testMode
+    })
+    keysConfig.pluginApiKeys = mergePluginApiKeys(
+      remote.pluginApiKeys,
+      keysConfig.pluginApiKeys
+    )
+    const monero = remote.pluginApiKeys.monero
+    const moneroHasKey =
+      monero != null &&
+      typeof monero === 'object' &&
+      typeof (monero as { edgeApiKey?: unknown }).edgeApiKey === 'string' &&
+      (monero as { edgeApiKey: string }).edgeApiKey !== ''
+    opts.logger?.info('Fetched infoRollup appKeys', {
+      pluginApiKeys: Object.keys(remote.pluginApiKeys).length,
+      moneroEdgeApiKey: moneroHasKey,
+      assuranceLevel: remote.assuranceLevel,
+      signer: apiSigner != null ? 'native' : 'js'
+    })
+  } catch (error: unknown) {
+    const message = error instanceof Error ? error.message : String(error)
+    opts.logger?.warn(
+      `infoRollup appKeys fetch failed; using local plugin keys: ${message}`
+    )
+  }
+
+  const applyCurrencyPluginKeys = (pluginId: string): void => {
+    const pluginKeys = keysConfig.pluginApiKeys[pluginId]
+    if (pluginKeys === false) {
+      pluginsInit[pluginId] = false
+    } else if (pluginKeys != null && typeof pluginKeys === 'object') {
+      const { enabled, ...rest } = pluginKeys as Record<string, unknown>
+      if (enabled === false) {
+        pluginsInit[pluginId] = false
+      } else {
+        pluginsInit[pluginId] = Object.keys(rest).length > 0 ? rest : true
+      }
+    } else {
+      pluginsInit[pluginId] = true
+    }
+  }
+
+  for (const pluginId of Object.keys(currencyPlugins)) {
+    applyCurrencyPluginKeys(pluginId)
+  }
+
+  for (const pluginId of Object.keys(accountbasedPlugins)) {
+    applyCurrencyPluginKeys(pluginId)
+  }
+
+  const swapConfig = appConfig.swapPlugins ?? {}
+  for (const pluginId of Object.keys(exchangePlugins)) {
+    pluginsInit[pluginId] = mergePluginInit(
+      swapConfig[pluginId],
+      keysConfig.pluginApiKeys[pluginId]
+    )
+  }
+
+  const moneroInit = pluginsInit.monero
+  const moneroEdgeApiKey =
+    typeof moneroInit === 'object' && moneroInit != null
+      ? (moneroInit as { edgeApiKey?: unknown }).edgeApiKey
+      : undefined
+  if (moneroInit === true) {
+    opts.logger?.warn(
+      'Monero enabled without edgeApiKey; Edge LWS /login will omit api_key'
+    )
+  } else if (typeof moneroEdgeApiKey === 'string' && moneroEdgeApiKey !== '') {
+    opts.logger?.info('Monero LWS edgeApiKey configured')
+  }
+
+  const enabledSwap = Object.keys(exchangePlugins).filter(
+    id => pluginsInit[id] !== false && pluginsInit[id] != null
+  )
+  opts.logger?.info('Swap plugins enabled', { plugins: enabledSwap })
+
+  const currencyPluginIds = [
+    ...Object.keys(currencyPlugins),
+    ...Object.keys(accountbasedPlugins)
+  ].filter(id => pluginsInit[id] !== false && pluginsInit[id] != null)
+
+  const context = await makeEdgeContext({
+    ...(apiSigner != null
+      ? { apiSigner }
+      : {
+          apiKey: effectiveApiKey,
+          apiSecret
+        }),
+    appId,
+    path: directory,
+    plugins: pluginsInit,
+    ...servers,
+    onLog(event) {
+      opts.logger?.write(String(event.type ?? 'info'), event.message, {
+        source: event.source
+      })
+      opts.events.emit('core.log', {
+        source: event.source,
+        message: event.message,
+        type: event.type
+      })
+    }
+  })
+
+  return {
+    context,
+    appId,
+    testMode,
+    directory,
+    servers,
+    pluginsInit,
+    currencyPluginIds
+  }
+}
diff --git a/src/cli/engine/nodeApiSigner.ts b/src/cli/engine/nodeApiSigner.ts
new file mode 100644
index 00000000000..66248c1d1c7
--- /dev/null
+++ b/src/cli/engine/nodeApiSigner.ts
@@ -0,0 +1,97 @@
+import type { EdgeApiSigner } from 'edge-core-js'
+import fs from 'fs'
+import path from 'path'
+
+/**
+ * Runtime XOR pad for the Node signer's embedded secret. The CLI gets its own
+ * id rather than reusing the mobile bundle id, so a CLI shard set cannot be
+ * lifted into a mobile build (or the reverse). Three places must agree, and
+ * `scripts/testNodeApiSigner.ts` fails if they drift:
+ *
+ *   - this constant, which `scripts/makeApiSigner.ts` bakes into the shards
+ *   - `EDGE_NODE_BUNDLE_ID` in the generated `edge_api_secret.h`
+ *   - the pad `edge_api_signer_napi.c` passes to `edge_api_hmac_sign`
+ *
+ * It is a local obfuscation detail only: nothing sends it to a server.
+ */
+export const NODE_API_SIGNER_BUNDLE_ID = 'app.edge.cli'
+
+interface EdgeApiSignerNative {
+  signMessage: (message: string) => {
+    apiKey: string
+    signature: string
+  }
+  getApiKey: () => string
+}
+
+let cachedNative: EdgeApiSignerNative | null | undefined
+
+function candidatePaths(): string[] {
+  const here = __dirname
+  return [
+    // Dev: built next to binding.gyp
+    path.join(
+      here,
+      '../../../native/edge-api-signer/node/build/Release/edge_api_signer.node'
+    ),
+    path.join(
+      here,
+      '../../../../native/edge-api-signer/node/build/Release/edge_api_signer.node'
+    ),
+    // Published CLI: .node shipped beside the rolled-up engine
+    path.join(here, 'edge_api_signer.node'),
+    path.join(here, '../edge_api_signer.node')
+  ]
+}
+
+/**
+ * Lazily load the N-API addon. Returns null when the binary is missing so
+ * local/dev CLI can keep using keys.json apiKey/apiSecret.
+ */
+export function loadNodeApiSignerNative(): EdgeApiSignerNative | null {
+  if (cachedNative !== undefined) return cachedNative
+
+  for (const candidate of candidatePaths()) {
+    try {
+      if (!fs.existsSync(candidate)) continue
+      // Native addon — loaded at runtime when the .node binary exists.
+      const mod = require(candidate) as EdgeApiSignerNative
+      if (typeof mod.signMessage === 'function') {
+        cachedNative = mod
+        return cachedNative
+      }
+    } catch (error: unknown) {
+      const message = error instanceof Error ? error.message : String(error)
+      console.warn(
+        `[edge-cli] failed to load Edge API signer at ${candidate}: ${message}`
+      )
+    }
+  }
+
+  cachedNative = null
+  return null
+}
+
+export function hasNodeApiSigner(): boolean {
+  return loadNodeApiSignerNative() != null
+}
+
+/**
+ * EdgeContextOptions.apiSigner backed by the Node N-API addon.
+ */
+export function makeNodeApiSigner(): EdgeApiSigner {
+  const native = loadNodeApiSignerNative()
+  if (native == null) {
+    throw new Error('EdgeApiSigner Node native module is not available')
+  }
+  return {
+    async signMessage(message: string) {
+      return native.signMessage(message)
+    }
+  }
+}
+
+/** Test helper: clear the cached require result. */
+export function resetNodeApiSignerCacheForTests(): void {
+  cachedNative = undefined
+}
diff --git a/src/cli/engine/objectHandles.ts b/src/cli/engine/objectHandles.ts
new file mode 100644
index 00000000000..2407b8db623
--- /dev/null
+++ b/src/cli/engine/objectHandles.ts
@@ -0,0 +1,190 @@
+/**
+ * Ephemeral handles for core objects that expose methods.
+ *
+ * In the core JS API, identity is "the object reference." Over HTTP that
+ * does not work, so the engine stores the live value under an `objectId` and
+ * deletes it after OBJECT_HANDLE_TTL_MS (5 minutes) from create/update, or
+ * sooner when the caller finishes (e.g. save-tx) or explicitly deletes the
+ * handle. Reads do not refresh the TTL; only `update` does.
+ *
+ * Use this for makeSpend transactions, pending Edge logins, and future swap
+ * quote / exchange objects — anything returned from core that you later call
+ * methods on.
+ */
+import crypto from 'crypto'
+
+import { base58 } from './encoding'
+import { engineError } from './errors'
+
+/** Default TTL for method-bearing core object handles. */
+export const OBJECT_HANDLE_TTL_MS = 5 * 60 * 1000
+
+export type ObjectHandleKind = 'transaction' | 'pendingLogin' | 'swap' | 'lobby'
+
+export interface ObjectHandleInfo {
+  objectId: string
+  kind: ObjectHandleKind
+  expiresAt: string
+  sessionId?: string
+  walletId?: string
+}
+
+interface HandleRecord<T = unknown> {
+  objectId: string
+  kind: ObjectHandleKind
+  value: T
+  sessionId?: string
+  walletId?: string
+  createdAt: number
+  expiresAt: number
+  onExpire?: (value: T) => void | Promise<void>
+}
+
+function makeObjectId(prefix: string): string {
+  return prefix + base58.stringify(crypto.randomBytes(12))
+}
+
+export class ObjectHandleStore {
+  private readonly handles = new Map<string, HandleRecord>()
+  private ticker: ReturnType<typeof setInterval> | null = null
+  private sweepInFlight: Promise<void> | null = null
+
+  get size(): number {
+    return this.handles.size
+  }
+
+  startTicker(): void {
+    if (this.ticker != null) return
+    this.ticker = setInterval(() => {
+      if (this.sweepInFlight != null) return
+      this.sweepInFlight = this.sweep()
+        .catch(() => {})
+        .finally(() => {
+          this.sweepInFlight = null
+        })
+    }, 15_000)
+    this.ticker.unref?.()
+  }
+
+  stopTicker(): void {
+    if (this.ticker != null) {
+      clearInterval(this.ticker)
+      this.ticker = null
+    }
+  }
+
+  async clearAll(): Promise<void> {
+    const ids = [...this.handles.keys()]
+    for (const id of ids) {
+      await this.delete(id)
+    }
+  }
+
+  create<T>(opts: {
+    kind: ObjectHandleKind
+    prefix: string
+    value: T
+    sessionId?: string
+    walletId?: string
+    onExpire?: (value: T) => void | Promise<void>
+    ttlMs?: number
+  }): ObjectHandleInfo & { value: T } {
+    const ttlMs = opts.ttlMs ?? OBJECT_HANDLE_TTL_MS
+    const now = Date.now()
+    const objectId = makeObjectId(opts.prefix)
+    const record: HandleRecord<T> = {
+      objectId,
+      kind: opts.kind,
+      value: opts.value,
+      sessionId: opts.sessionId,
+      walletId: opts.walletId,
+      createdAt: now,
+      expiresAt: now + ttlMs,
+      onExpire: opts.onExpire
+    }
+    this.handles.set(objectId, record as HandleRecord)
+    return {
+      objectId,
+      kind: opts.kind,
+      expiresAt: new Date(record.expiresAt).toISOString(),
+      sessionId: opts.sessionId,
+      walletId: opts.walletId,
+      value: opts.value
+    }
+  }
+
+  get<T>(objectId: string, kind?: ObjectHandleKind): HandleRecord<T> {
+    const record = this.handles.get(objectId)
+    if (record == null) {
+      throw engineError(
+        'OBJECT_NOT_FOUND',
+        `No object handle: ${objectId}`,
+        404
+      )
+    }
+    if (Date.now() > record.expiresAt) {
+      this.delete(objectId).catch(() => {})
+      throw engineError(
+        'OBJECT_EXPIRED',
+        `Object handle expired: ${objectId}`,
+        410
+      )
+    }
+    if (kind != null && record.kind !== kind) {
+      throw engineError(
+        'OBJECT_KIND_MISMATCH',
+        `Expected kind ${kind}, got ${record.kind}`,
+        400
+      )
+    }
+    return record as HandleRecord<T>
+  }
+
+  /**
+   * Replace the stored value and refresh the TTL (another full window).
+   */
+  update<T>(
+    objectId: string,
+    value: T,
+    opts?: { ttlMs?: number }
+  ): ObjectHandleInfo {
+    const record = this.get<T>(objectId)
+    const ttlMs = opts?.ttlMs ?? OBJECT_HANDLE_TTL_MS
+    record.value = value
+    record.expiresAt = Date.now() + ttlMs
+    return this.toInfo(record)
+  }
+
+  toInfo<T = unknown>(record: HandleRecord<T>): ObjectHandleInfo {
+    return {
+      objectId: record.objectId,
+      kind: record.kind,
+      expiresAt: new Date(record.expiresAt).toISOString(),
+      sessionId: record.sessionId,
+      walletId: record.walletId
+    }
+  }
+
+  async delete(objectId: string): Promise<boolean> {
+    const record = this.handles.get(objectId)
+    if (record == null) return false
+    this.handles.delete(objectId)
+    if (record.onExpire != null) {
+      try {
+        await record.onExpire(record.value)
+      } catch {
+        // best effort
+      }
+    }
+    return true
+  }
+
+  private async sweep(): Promise<void> {
+    const now = Date.now()
+    for (const [id, record] of this.handles) {
+      if (now > record.expiresAt) {
+        await this.delete(id)
+      }
+    }
+  }
+}
diff --git a/src/cli/engine/resolve.ts b/src/cli/engine/resolve.ts
new file mode 100644
index 00000000000..1dbf2ddb7f7
--- /dev/null
+++ b/src/cli/engine/resolve.ts
@@ -0,0 +1,66 @@
+import type { EdgeAccount, EdgeCurrencyWallet, EdgeTokenId } from 'edge-core-js'
+
+import { engineError } from './errors'
+
+/**
+ * Resolve a wallet id or unique prefix against account.currencyWallets.
+ */
+export function findWallet(
+  account: EdgeAccount,
+  prefix: string
+): EdgeCurrencyWallet {
+  const wallets = account.currencyWallets
+  if (wallets[prefix] != null) return wallets[prefix]
+
+  const matches = Object.keys(wallets).filter(id => id.startsWith(prefix))
+  if (matches.length === 0) {
+    throw engineError(
+      'WALLET_NOT_FOUND',
+      `No wallet found matching: ${prefix}`,
+      404
+    )
+  }
+  if (matches.length > 1) {
+    throw engineError(
+      'AMBIGUOUS_WALLET_ID',
+      `Ambiguous wallet ID "${prefix}"`,
+      409,
+      { candidates: matches }
+    )
+  }
+  return wallets[matches[0]]
+}
+
+/**
+ * Parse tokenId from path/query. Literal "null" or empty -> null (native).
+ */
+export function parseTokenId(arg: string | null | undefined): EdgeTokenId {
+  if (arg == null || arg === '' || arg === 'null') return null
+  return arg
+}
+
+export function getCurrencyCode(
+  wallet: EdgeCurrencyWallet,
+  tokenId: EdgeTokenId
+): string {
+  if (tokenId == null) return wallet.currencyInfo.currencyCode
+  const token = wallet.currencyConfig.allTokens[tokenId]
+  if (token == null) {
+    throw engineError('TOKEN_NOT_FOUND', `Unknown token: ${tokenId}`, 404)
+  }
+  return token.currencyCode
+}
+
+export function getMultiplier(
+  wallet: EdgeCurrencyWallet,
+  tokenId: EdgeTokenId
+): string {
+  if (tokenId == null) {
+    return wallet.currencyInfo.denominations[0]?.multiplier ?? '1'
+  }
+  const token = wallet.currencyConfig.allTokens[tokenId]
+  if (token == null) {
+    throw engineError('TOKEN_NOT_FOUND', `Unknown token: ${tokenId}`, 404)
+  }
+  return token.denominations[0]?.multiplier ?? '1'
+}
diff --git a/src/cli/engine/route.ts b/src/cli/engine/route.ts
new file mode 100644
index 00000000000..aeceab02c5c
--- /dev/null
+++ b/src/cli/engine/route.ts
@@ -0,0 +1,254 @@
+/**
+ * A single API call: one typed function, its cleaners, and the prose above it.
+ *
+ * The JSDoc comment on each `route(…)` call is the documentation source. The
+ * `query` / `body` cleaners validate the request *and* describe it — the
+ * documented shape is the enforced shape, so the two cannot disagree. The
+ * `returns` cleaner does the same for the response.
+ *
+ * `scripts/buildApiDocs.ts` reads these declarations with the TypeScript
+ * compiler API: the resolved cleaner types render the request and response
+ * shapes, and the JSDoc supplies the prose.
+ */
+import type { Cleaner } from 'cleaners'
+
+import { engineError } from './errors'
+import { requireBodyObject, type RouteContext, type Router } from './router'
+
+export type HttpMethod = 'GET' | 'POST'
+
+/** How a CLI flag differs from the field it carries. */
+export interface CliFlagSpec {
+  /** Request field this flag supplies, when the names differ. */
+  maps?: string
+  /** Repeatable; collected into an array. */
+  repeat?: boolean
+  doc?: string
+}
+
+/** A flag with no request counterpart — purely client-side behaviour. */
+export interface CliExtraSpec {
+  kind: 'string' | 'boolean' | 'boolstr' | 'repeat'
+  required?: boolean
+  /** Required whenever this request field is present. */
+  requiredWith?: string
+  doc?: string
+}
+
+export interface CliSpec {
+  command: string
+  /**
+   * Request field taken as the bare positional argument.
+   *
+   * A positional also decides the REST path: it becomes the final path
+   * segment, so `<objectId>` on the command line and `{objectId}` in the URL
+   * are the same value declared once. `routePath` derives that, which is why
+   * `path` must not spell the parameter out itself.
+   *
+   * Only base58 identifiers qualify. A value that can contain `/`, `?` or `#`
+   * — a base64 wallet id, a free-text username — cannot be a path segment
+   * without percent-encoding that callers forget, so it travels as a named
+   * argument in the query or the body instead.
+   */
+  positional?: string
+  /** Overrides for flags whose name is not the kebab-cased field name. */
+  flags?: Record<string, CliFlagSpec>
+  /** Client-only flags. */
+  extra?: Record<string, CliExtraSpec>
+  /** Fields sent at fixed values, for commands that preset part of a body. */
+  preset?: Record<string, unknown>
+  /** Flag carrying the entire body as one JSON argument. */
+  bodyFlag?: string
+  /** Exit codes for a streaming command. */
+  exits?: Record<string, number>
+  /** Behaviour the request shape cannot express. */
+  notes?: string
+  /**
+   * Hand-written because the command does something the request shape cannot
+   * describe — writing files, storing a session, holding a stream open.
+   * Everything else is generated from this spec.
+   */
+  custom?: boolean
+}
+
+export interface StreamSpec {
+  scope: 'context' | 'session' | 'wallet'
+  /** Event type names this stream can emit. */
+  frames: string[]
+}
+
+export interface RouteSpec<Q = unknown, B = unknown, R = unknown> {
+  /** The `edge-core-js` call this fronts, or null with a `coreNote`. */
+  core: string | null
+  coreNote?: string
+  /**
+   * Request fields the core call has no parameter for, and why.
+   *
+   * The API is core's signature in another representation, so a field core
+   * does not know about is either a deliberate convenience or a mistake.
+   * Writing the reason is what tells the two apart: `currency-wallets` once
+   * carried a `waitForAll` that core has no parameter for — waiting is a
+   * separate method — and nothing caught it.
+   *
+   * `checkCoreAlignment` resolves the real signature and fails on a
+   * difference that is not listed here, or a listing that is no longer true.
+   */
+  coreExtra?: Record<string, string>
+  method: HttpMethod
+  path: string
+  /** Command name, a spec, or several when one route backs more than one. */
+  cli?: string | CliSpec | CliSpec[] | null
+  query?: Cleaner<Q>
+  body?: Cleaner<B>
+  /** Response shape. Omit for a `204`. */
+  returns?: Cleaner<R>
+  /** Codes raised indirectly; directly-thrown ones are read from the handler. */
+  errors?: string[]
+  /** Set when the stream is served outside the router. */
+  stream?: StreamSpec
+  handler: (ctx: TypedContext<Q, B>) => Promise<unknown> | unknown
+}
+
+/** A `RouteContext` whose query and body have been through their cleaners. */
+export interface TypedContext<Q, B> extends Omit<RouteContext, 'body'> {
+  query: URLSearchParams & { valid: Q }
+  body: B
+}
+
+const registry: Array<RouteSpec<any, any, any>> = []
+
+export function route<Q, B, R>(spec: RouteSpec<Q, B, R>): RouteSpec<Q, B, R> {
+  registry.push(spec)
+  return spec
+}
+
+export function allRoutes(): Array<RouteSpec<any, any, any>> {
+  return registry
+}
+
+/** Turn a cleaner failure into a `400` instead of a `500`. */
+/**
+ * How hard a response that fails its own `returns` cleaner should land.
+ *
+ * A mismatch is a documentation bug: the reference says one shape and the
+ * engine sends another. It is never the caller's fault, so the default is to
+ * log it and send the response through untouched rather than fail a request
+ * that would otherwise have worked. Tests set `strict` to turn drift into a
+ * failure, and `off` skips the check.
+ */
+export type ResponseCheckMode = 'warn' | 'strict' | 'off'
+
+function responseCheckMode(): ResponseCheckMode {
+  const raw = process.env.EDGE_CLI_CHECK_RESPONSES
+  if (raw === 'strict' || raw === '1') return 'strict'
+  if (raw === 'off' || raw === '0') return 'off'
+  return 'warn'
+}
+
+/**
+ * Confirms a response matches the cleaner that documents it.
+ *
+ * The cleaned value is discarded. Response cleaners strip unknown keys, so
+ * returning it would quietly delete fields the engine means to send — the
+ * check exists to report drift, not to reshape anything.
+ */
+function checkResponse(
+  spec: RouteSpec<any, any, any>,
+  ctx: RouteContext,
+  response: unknown
+): void {
+  if (spec.returns == null) return
+  const mode = responseCheckMode()
+  if (mode === 'off') return
+  try {
+    spec.returns(response)
+  } catch (error: unknown) {
+    const message = error instanceof Error ? error.message : String(error)
+    const detail = `${spec.method} ${spec.path} response does not match its documented type: ${message}`
+    if (mode === 'strict') throw engineError('INTERNAL_ERROR', detail, 500)
+    ctx.state.logger.warn('Response type mismatch', {
+      route: `${spec.method} ${spec.path}`,
+      message
+    })
+  }
+}
+
+function clean<T>(cleaner: Cleaner<T>, raw: unknown, what: string): T {
+  try {
+    return cleaner(raw)
+  } catch (error: unknown) {
+    const message = error instanceof Error ? error.message : String(error)
+    throw engineError('BAD_REQUEST', `Invalid ${what}: ${message}`, 400)
+  }
+}
+
+/** Query strings are all strings; coerce to what the cleaner expects. */
+function queryToObject(query: URLSearchParams): Record<string, unknown> {
+  const out: Record<string, unknown> = {}
+  for (const [key, value] of query.entries()) {
+    if (value === '') continue
+    out[key] = value
+  }
+  return out
+}
+
+/**
+ * The URL a route actually answers on.
+ *
+ * `path` carries the scope — the account, the wallet, the handle — and the
+ * command. A positional argument is appended to it, so the REST path reads in
+ * the same order the command does: `wallet/get-addresses/{walletId}` for
+ * `get-addresses <walletId>`. Named arguments stay in the query or the body.
+ */
+export function routePath(spec: RouteSpec<any, any, any>): string {
+  const positional = positionalParam(spec)
+  return positional == null ? spec.path : `${spec.path}/{${positional}}`
+}
+
+/** The field a route carries on the path, or null when it takes none. */
+export function positionalParam(spec: RouteSpec<any, any, any>): string | null {
+  const cli = spec.cli
+  if (cli == null || typeof cli === 'string' || Array.isArray(cli)) return null
+  if (cli.positional == null) return null
+  return cli.positional
+}
+
+export function registerRoute(
+  router: Router,
+  spec: RouteSpec<any, any, any>
+): void {
+  if (spec.stream != null) return // served directly by the HTTP handler
+  const positional = positionalParam(spec)
+  router.add(spec.method, routePath(spec), async ctx => {
+    // The positional arrives as a path segment, but it is declared as an
+    // ordinary field, so it is folded back in before the cleaner runs. The
+    // handler reads it from the same place whichever transport it came over.
+    const fromPath = (raw: Record<string, unknown>): Record<string, unknown> =>
+      positional == null
+        ? raw
+        : { ...raw, [positional]: ctx.params[positional] }
+
+    if (spec.query != null) {
+      const parsed = clean(
+        spec.query,
+        fromPath(queryToObject(ctx.query)),
+        'query'
+      )
+      ;(ctx.query as any).valid = parsed
+    }
+    if (spec.body != null) {
+      // A POST whose every field rides on the path has nothing left to send,
+      // so an absent body means an empty one. A body that is present but not
+      // an object is still a bad request, and the cleaner reports any field
+      // that is genuinely missing.
+      const raw =
+        spec.method === 'GET' || ctx.body == null
+          ? {}
+          : requireBodyObject(ctx.body)
+      ctx.body = clean(spec.body, fromPath(raw), 'body')
+    }
+    const response = await spec.handler(ctx as any)
+    checkResponse(spec, ctx, response)
+    return response
+  })
+}
diff --git a/src/cli/engine/router.ts b/src/cli/engine/router.ts
new file mode 100644
index 00000000000..5abbcd6c63d
--- /dev/null
+++ b/src/cli/engine/router.ts
@@ -0,0 +1,99 @@
+import type { IncomingMessage, ServerResponse } from 'http'
+
+import { engineError } from './errors'
+import type { EventHub } from './events'
+import type { IdleShutdown } from './idleShutdown'
+import type { EngineLogger } from './logger'
+import type { CoreContextBundle } from './makeCoreContext'
+import type { ObjectHandleStore } from './objectHandles'
+import type { SessionStore } from './sessions'
+
+export const API_VERSION = '1.0.0'
+
+export interface EngineState {
+  core: CoreContextBundle
+  sessions: SessionStore
+  objects: ObjectHandleStore
+  events: EventHub
+  idle: IdleShutdown
+  logger: EngineLogger
+  profile: string
+  socketPath: string
+  tcpPort: number | null
+  startedAt: number
+  shuttingDown: boolean
+  shutdown: () => Promise<void>
+}
+
+export interface RouteContext {
+  state: EngineState
+  req: IncomingMessage
+  res: ServerResponse
+  params: Record<string, string>
+  query: URLSearchParams
+  body: unknown
+}
+
+export type RouteHandler = (ctx: RouteContext) => Promise<unknown> | unknown
+
+export interface Route {
+  method: string
+  pattern: string
+  handler: RouteHandler
+}
+
+interface CompiledRoute {
+  method: string
+  regex: RegExp
+  keys: string[]
+  handler: RouteHandler
+}
+
+function compile(pattern: string): { regex: RegExp; keys: string[] } {
+  const keys: string[] = []
+  const parts = pattern.split('/').map(part => {
+    if (part.startsWith('{') && part.endsWith('}')) {
+      keys.push(part.slice(1, -1))
+      return '([^/]+)'
+    }
+    return part.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+  })
+  return {
+    regex: new RegExp('^' + parts.join('/') + '$'),
+    keys
+  }
+}
+
+export class Router {
+  private readonly routes: CompiledRoute[] = []
+
+  add(method: string, pattern: string, handler: RouteHandler): void {
+    const { regex, keys } = compile(pattern)
+    this.routes.push({ method: method.toUpperCase(), regex, keys, handler })
+  }
+
+  match(
+    method: string,
+    pathname: string
+  ): { handler: RouteHandler; params: Record<string, string> } | null {
+    const m = method.toUpperCase()
+    for (const route of this.routes) {
+      if (route.method !== m) continue
+      const match = route.regex.exec(pathname)
+      if (match == null) continue
+      const params: Record<string, string> = {}
+      route.keys.forEach((key, i) => {
+        params[key] = decodeURIComponent(match[i + 1])
+      })
+      return { handler: route.handler, params }
+    }
+    return null
+  }
+}
+
+export function requireBodyObject(body: unknown): Record<string, unknown> {
+  if (body == null || typeof body !== 'object' || Array.isArray(body)) {
+    throw engineError('BAD_REQUEST', 'JSON object body required', 400)
+  }
+  return body as Record<string, unknown>
+}
diff --git a/src/cli/engine/routes/account.ts b/src/cli/engine/routes/account.ts
new file mode 100644
index 00000000000..e55060f0988
--- /dev/null
+++ b/src/cli/engine/routes/account.ts
@@ -0,0 +1,400 @@
+import {
+  asArray,
+  asBoolean,
+  asEither,
+  asObject,
+  asOptional,
+  asString,
+  asValue
+} from 'cleaners'
+import type {
+  EdgeAccount,
+  EdgeCreateCurrencyWallet,
+  EdgeCurrencyWallet
+} from 'edge-core-js'
+
+import { doc } from '../doc'
+import { route } from '../route'
+import { asCoreValue, asSession, asWalletSummary } from '../schemas'
+import { getAccount, getSession, summarizeWallet } from './helpers'
+
+/** Which of the account's three wallet lists to read. */
+const asWalletFilter = asValue('active', 'archived', 'hidden', 'all')
+type WalletFilter = ReturnType<typeof asWalletFilter>
+
+function walletIdsForFilter(
+  account: EdgeAccount,
+  filter: WalletFilter
+): string[] {
+  switch (filter) {
+    case 'archived':
+      return account.archivedWalletIds
+    case 'hidden':
+      return account.hiddenWalletIds
+    case 'all':
+      return [
+        ...account.activeWalletIds,
+        ...account.archivedWalletIds,
+        ...account.hiddenWalletIds
+      ]
+    case 'active':
+    default:
+      return account.activeWalletIds
+  }
+}
+
+/**
+ * Account and session summary.
+ *
+ * Session fields are spread at the top level alongside the account's own
+ * properties — there is no nested `session` object.
+ *
+ * @note The `otpEnabled` and `otpResetPending` flags here are derived. For the
+ *   secret itself use `otp-key`.
+ * @coreNote Engine composite of the session record plus EdgeAccount
+ *   properties.
+ */
+export const accountInfo = route({
+  core: null,
+  method: 'GET',
+  path: '/account/{sessionId}',
+  cli: 'account-info',
+  returns: asObject({
+    appId: doc(asString, 'Application this session logged into.'),
+    created: doc(
+      asEither(asString, asValue(null)),
+      'When the account was created, null for accounts predating the field.'
+    ),
+    lastLogin: doc(asString, 'The previous login, not this one.'),
+    loggedIn: doc(
+      asBoolean,
+      'False once the account has been logged out; the session object outlives it briefly.'
+    ),
+    recoveryKey: doc(
+      asEither(asString, asValue(null)),
+      'Present only while recovery is configured.'
+    ),
+    otpEnabled: doc(asBoolean, '2FA is on for this account.'),
+    otpResetPending: doc(
+      asBoolean,
+      'True while somebody has a reset pending against this account.'
+    ),
+    canDuressLogin: doc(
+      asBoolean,
+      'A duress PIN is configured, so this account can be opened in duress mode.'
+    ),
+    isDuressAccount: doc(
+      asBoolean,
+      'True when this very session is the duress account rather than the real one.'
+    ),
+    edgeLogin: doc(asBoolean, 'This account was reached by QR login.'),
+    keyLogin: doc(asBoolean, 'This session was reached with a login key.'),
+    newAccount: doc(
+      asBoolean,
+      'This session created the account rather than logging into an existing one.'
+    ),
+    passwordLogin: doc(asBoolean, 'This session was reached with a password.'),
+    pinLogin: doc(asBoolean, 'This session was reached with a PIN.'),
+    recoveryLogin: doc(
+      asBoolean,
+      'This session was reached by answering recovery questions.'
+    )
+  }).withRest,
+
+  handler(ctx) {
+    const session = getSession(ctx)
+    const { account } = session
+    const info = ctx.state.sessions.toInfo(session)
+    return {
+      ...info,
+      username: account.username,
+      rootLoginId: account.rootLoginId,
+      appId: account.appId,
+      created: account.created?.toISOString() ?? null,
+      lastLogin: account.lastLogin.toISOString(),
+      loggedIn: account.loggedIn,
+      recoveryKey: account.recoveryKey ?? null,
+      otpEnabled: account.otpKey != null,
+      otpResetPending: account.otpResetDate != null,
+      canDuressLogin: account.canDuressLogin,
+      isDuressAccount: account.isDuressAccount,
+      edgeLogin: account.edgeLogin,
+      keyLogin: account.keyLogin,
+      newAccount: account.newAccount,
+      passwordLogin: account.passwordLogin,
+      pinLogin: account.pinLogin,
+      recoveryLogin: account.recoveryLogin
+    }
+  }
+})
+
+/**
+ * Log out.
+ *
+ * Ends the session and drops it from the engine. Any subscription scoped to
+ * this account or its wallets is closed with it.
+ */
+export const logout = route({
+  core: 'account.logout',
+  method: 'POST',
+  path: '/account/{sessionId}/logout',
+  cli: {
+    command: 'logout',
+    custom: true,
+    notes: 'Also clears the stored id from `session.json`.'
+  },
+
+  async handler(ctx) {
+    await ctx.state.sessions.logout(ctx.params.sessionId)
+    return undefined
+  }
+})
+
+/**
+ * Keepalive.
+ *
+ * Resets the idle auto-logout timer without doing any other work.
+ *
+ * @coreNote Engine auto-logout timer; core has no idle concept.
+ */
+export const touchSession = route({
+  core: null,
+  method: 'POST',
+  path: '/account/{sessionId}/touch',
+  cli: 'touch',
+  returns: doc(asSession, 'The session, with a refreshed `expiresAt`.'),
+
+  handler(ctx) {
+    return ctx.state.sessions.touch(ctx.params.sessionId)
+  }
+})
+
+/**
+ * Read the account login key.
+ *
+ * The key `login-with-key` takes. It grants full account access, so treat the
+ * output as secret.
+ */
+export const getLoginKey = route({
+  core: 'account.getLoginKey',
+  method: 'GET',
+  path: '/account/{sessionId}/get-login-key',
+  cli: 'get-login-key',
+  returns: asObject({
+    loginKey: doc(asString, 'base58. Full account access — keep it safe.')
+  }),
+
+  async handler(ctx) {
+    return { loginKey: await getAccount(ctx).getLoginKey() }
+  }
+})
+
+/**
+ * Force an account data sync.
+ *
+ * Pushes and pulls the account repos immediately rather than waiting for the
+ * next scheduled sync.
+ */
+export const accountSync = route({
+  core: 'account.sync',
+  method: 'POST',
+  path: '/account/{sessionId}/sync',
+  cli: {
+    command: 'sync',
+    notes: 'Named `sync` for the account; the wallet one is `wallet-sync`.'
+  },
+  errors: ['NETWORK_ERROR'],
+
+  async handler(ctx) {
+    await getAccount(ctx).sync()
+    return undefined
+  }
+})
+
+/**
+ * Permanently delete the remote account.
+ *
+ * Irreversible. The account is removed from the login server, and funds in its
+ * wallets are unrecoverable without the keys. The session is logged out
+ * afterwards.
+ *
+ * @note The engine performs no confirmation check — the call runs as soon as
+ *   it arrives, so any guard has to live in the caller. The command requires
+ *   `--yes` for exactly this reason.
+ */
+export const deleteRemoteAccount = route({
+  core: 'account.deleteRemoteAccount',
+  method: 'POST',
+  path: '/account/{sessionId}/delete-remote-account',
+  cli: {
+    command: 'delete-remote-account',
+    custom: true,
+    extra: {
+      yes: {
+        kind: 'boolean',
+        required: true,
+        doc: 'Confirms intent. Without it the command refuses to run.'
+      }
+    }
+  },
+  errors: ['NETWORK_ERROR'],
+
+  async handler(ctx) {
+    await getAccount(ctx).deleteRemoteAccount()
+    await ctx.state.sessions.logout(ctx.params.sessionId)
+    return undefined
+  }
+})
+
+/**
+ * Wait for every wallet to finish loading.
+ *
+ * Wallets load in the background after login, so a list taken straight
+ * afterwards can be short. This resolves once each active wallet has either
+ * loaded or failed — balances may still be syncing afterwards.
+ *
+ * @note There is no timeout: a wallet that never resolves holds this open.
+ *   The engine's own idle shutdown does not fire while a request is in
+ *   flight, so give the client one.
+ * @note Nothing is returned. Call `currency-wallets` afterwards to see the
+ *   result, including any wallet that failed to load.
+ */
+export const waitForAllWallets = route({
+  core: 'account.waitForAllWallets',
+  method: 'POST',
+  path: '/account/{sessionId}/wait-for-all-wallets',
+  cli: 'wait-for-all-wallets',
+
+  async handler(ctx) {
+    await getAccount(ctx).waitForAllWallets()
+    return undefined
+  }
+})
+
+/**
+ * List the account's wallets.
+ *
+ * @note Wallets load in the background after login, so a list taken straight
+ *   afterwards can be short. Call `wait-for-all-wallets` first to be sure the
+ *   account has finished loading.
+ * @coreNote Filtered by account.activeWalletIds / archivedWalletIds /
+ *   hiddenWalletIds.
+ */
+export const currencyWallets = route({
+  core: 'account.currencyWallets',
+  coreExtra: {
+    filter:
+      'Core has no filter: it exposes activeWalletIds, archivedWalletIds and ' +
+      'hiddenWalletIds as separate lists. This picks between them.'
+  },
+  method: 'GET',
+  path: '/account/{sessionId}/currency-wallets',
+  cli: 'currency-wallets',
+  query: asObject({
+    filter: asOptional(
+      doc(
+        asWalletFilter,
+        'Which of the account\u2019s wallet lists to read. Defaults to `active`.'
+      )
+    )
+  }).withRest,
+  returns: asObject({
+    currencyWallets: doc(
+      asArray(asWalletSummary),
+      'Every wallet in the account, including paused ones.'
+    )
+  }),
+
+  async handler(ctx) {
+    const account = getAccount(ctx)
+    const { filter = 'active' } = ctx.query.valid
+
+    const currencyWallets = walletIdsForFilter(account, filter)
+      .map(id => account.currencyWallets[id])
+      .filter((wallet): wallet is EdgeCurrencyWallet => wallet != null)
+      .map(summarizeWallet)
+    return { currencyWallets }
+  }
+})
+
+/**
+ * Create a currency wallet.
+ *
+ * @note The fiat currency is not set here. Core still accepts it on create,
+ *   but that path is deprecated — use `set-fiat-currency-code` afterwards, so
+ *   there is one way to do it.
+ */
+export const createCurrencyWallet = route({
+  core: 'account.createCurrencyWallet',
+  method: 'POST',
+  path: '/account/{sessionId}/create-currency-wallet',
+  cli: 'create-currency-wallet',
+  body: asObject({
+    walletType: doc(
+      asString,
+      'From `currency-configs`, e.g. `wallet:bitcoin`.'
+    ),
+    name: asOptional(doc(asString, 'Display name.')),
+    importText: asOptional(
+      doc(asString, 'Seed or key text to import instead of generating.')
+    )
+  }).withRest,
+  returns: asWalletSummary,
+  errors: ['BAD_REQUEST'],
+
+  async handler(ctx) {
+    const wallet = await getAccount(ctx).createCurrencyWallet(
+      ctx.body.walletType,
+      {
+        name: ctx.body.name,
+        importText: ctx.body.importText
+      }
+    )
+    return summarizeWallet(wallet)
+  }
+})
+
+/**
+ * Create several wallets at once.
+ *
+ * Partial success is normal: each entry reports its own outcome, and one
+ * failure does not roll back the others.
+ */
+export const createCurrencyWallets = route({
+  core: 'account.createCurrencyWallets',
+  method: 'POST',
+  path: '/account/{sessionId}/create-currency-wallets',
+  cli: 'create-currency-wallets',
+  body: asObject({
+    createWallets: doc(
+      asArray(asCoreValue),
+      '`EdgeCreateCurrencyWallet[]`: walletType, name, fiatCurrencyCode.'
+    )
+  }).withRest,
+  returns: asObject({
+    results: doc(
+      asArray(asCoreValue),
+      "Mirrors core's EdgeResult[]: `{ ok, wallet }` or `{ ok: false, error }`."
+    )
+  }),
+  errors: ['BAD_REQUEST'],
+
+  async handler(ctx) {
+    const results = await getAccount(ctx).createCurrencyWallets(
+      ctx.body.createWallets as EdgeCreateCurrencyWallet[]
+    )
+    return {
+      results: results.map(result =>
+        result.ok
+          ? { ok: true, wallet: summarizeWallet(result.result) }
+          : {
+              ok: false,
+              error:
+                result.error instanceof Error
+                  ? result.error.message
+                  : String(result.error)
+            }
+      )
+    }
+  }
+})
diff --git a/src/cli/engine/routes/admin.ts b/src/cli/engine/routes/admin.ts
new file mode 100644
index 00000000000..91bab0fb299
--- /dev/null
+++ b/src/cli/engine/routes/admin.ts
@@ -0,0 +1,351 @@
+import { asArray, asObject, asOptional, asString } from 'cleaners'
+
+import { doc } from '../doc'
+import { base58 } from '../encoding'
+import { engineError } from '../errors'
+import { getInternalStuff, type LobbyRequest } from '../internal'
+import { route } from '../route'
+import { asCoreValue, asOk } from '../schemas'
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return value != null && typeof value === 'object' && !Array.isArray(value)
+}
+
+const REPO_KEYS = {
+  syncKey: doc(asString, 'Base58 repo sync key.'),
+  dataKey: doc(asString, 'Base58 repo data key.')
+}
+
+/**
+ * Raw login-server request.
+ *
+ * Sends an arbitrary request with the context's credentials attached.
+ * Debugging only — this is core's private surface.
+ */
+export const adminAuthRequest = route({
+  core: 'context.$internalStuff.authRequest',
+  method: 'POST',
+  path: '/admin/auth-request',
+  cli: 'admin-auth-request',
+  body: asObject({
+    method: doc(asString, 'HTTP method, e.g. `GET`.'),
+    path: doc(asString, 'Login-server path, not an engine path.'),
+    body: asOptional(
+      doc(asCoreValue, 'Request body, when the method takes one.')
+    )
+  }).withRest,
+  returns: doc(asCoreValue, 'Whatever the login server returned.'),
+  errors: ['BAD_REQUEST', 'NETWORK_ERROR'],
+
+  async handler(ctx) {
+    const body = ctx.body
+    const { method, path } = body
+    const requestBody = isPlainObject(body.body) ? body.body : undefined
+    const internal = getInternalStuff(ctx.state.core.context)
+    return await internal.authRequest(method, path, requestBody)
+  }
+})
+
+/**
+ * Hash a username.
+ *
+ * Reproduces the login server's hashing, to derive a login id offline.
+ */
+export const adminHashUsername = route({
+  core: 'context.$internalStuff.hashUsername',
+  method: 'GET',
+  path: '/admin/hash-username',
+  cli: 'admin-hash-username',
+  query: asObject({ username: doc(asString, 'The name to hash.') }).withRest,
+  returns: asObject({ loginId: doc(asString, 'Base58.') }),
+
+  async handler(ctx) {
+    const { username } = ctx.query.valid
+    const internal = getInternalStuff(ctx.state.core.context)
+    const hash = await internal.hashUsername(username)
+    return { loginId: base58.stringify(hash) }
+  }
+})
+
+/**
+ * Create a lobby.
+ *
+ * A lobby polls the login server until closed, so the engine parks it under a
+ * `lobby_` handle and closes it on expiry rather than leaking the poll.
+ *
+ * @note Release it with `admin-lobby-handle-delete`, or the poll runs for the
+ *   full five minutes.
+ */
+export const adminMakeLobby = route({
+  core: 'context.$internalStuff.makeLobby',
+  method: 'POST',
+  path: '/admin/make-lobby',
+  cli: {
+    command: 'admin-make-lobby',
+    flags: { periodSeconds: { maps: 'period' } }
+  },
+  body: asObject({
+    lobbyRequest: asOptional(doc(asCoreValue, 'Defaults to `{}`.')),
+    period: asOptional(doc(asCoreValue, 'Poll interval in seconds.'))
+  }).withRest,
+  returns: asObject({
+    objectId: doc(asString, 'The parked handle.'),
+    expiresAt: doc(
+      asString,
+      'When the engine closes the lobby and stops polling.'
+    ),
+    lobbyId: doc(asString, 'Identifies the lobby to the party joining it.'),
+    replies: doc(
+      asArray(asCoreValue),
+      'Empty at creation; re-read to see replies.'
+    )
+  }),
+  errors: ['NETWORK_ERROR'],
+
+  async handler(ctx) {
+    const body = ctx.body
+    const lobbyRequest = isPlainObject(body.lobbyRequest)
+      ? (body.lobbyRequest as unknown as LobbyRequest)
+      : {}
+    const period = typeof body.period === 'number' ? body.period : undefined
+    const internal = getInternalStuff(ctx.state.core.context)
+    const lobby = await internal.makeLobby(lobbyRequest, period)
+    // A lobby polls the login server until it is closed. Returning only its id
+    // would drop the last reference and leave that poll running for the life
+    // of the engine, so park it in the handle store and close it on expiry.
+    const handle = ctx.state.objects.create({
+      kind: 'lobby',
+      prefix: 'lobby_',
+      value: lobby,
+      onExpire: value => {
+        value.close()
+      }
+    })
+    return {
+      objectId: handle.objectId,
+      expiresAt: handle.expiresAt,
+      lobbyId: lobby.lobbyId,
+      replies: lobby.replies
+    }
+  }
+})
+
+/**
+ * Close a parked lobby.
+ *
+ * @note Not under `/account/{sessionId}/objects/`, because admin lobbies
+ *   belong to no session.
+ * @coreNote Engine handle store for a lobby created via makeLobby.
+ */
+export const adminDeleteLobbyHandle = route({
+  core: null,
+  method: 'POST',
+  path: '/admin/lobby-handle/delete',
+  cli: { command: 'admin-lobby-handle-delete', positional: 'objectId' },
+  returns: asOk,
+  errors: ['OBJECT_NOT_FOUND'],
+
+  async handler(ctx) {
+    const deleted = await ctx.state.objects.delete(ctx.params.objectId)
+    if (!deleted) {
+      throw engineError(
+        'OBJECT_NOT_FOUND',
+        `No object handle: ${ctx.params.objectId}`,
+        404
+      )
+    }
+    return { ok: true }
+  }
+})
+
+/**
+ * Read a lobby's contents.
+ */
+export const adminFetchLobbyRequest = route({
+  core: 'context.$internalStuff.fetchLobbyRequest',
+  method: 'GET',
+  path: '/admin/fetch-lobby-request',
+  cli: { command: 'admin-fetch-lobby-request', positional: 'lobbyId' },
+  query: asObject({ lobbyId: doc(asString, 'Which lobby to read.') }).withRest,
+  returns: doc(asCoreValue, 'The raw lobby request.'),
+  errors: ['NETWORK_ERROR'],
+
+  async handler(ctx) {
+    const { lobbyId } = ctx.query.valid
+    const internal = getInternalStuff(ctx.state.core.context)
+    return await internal.fetchLobbyRequest(lobbyId)
+  }
+})
+
+/**
+ * Reply to a lobby.
+ */
+export const adminSendLobbyReply = route({
+  core: 'context.$internalStuff.sendLobbyReply',
+  method: 'POST',
+  path: '/admin/send-lobby-reply',
+  cli: { command: 'admin-send-lobby-reply', positional: 'lobbyId' },
+  body: asObject({
+    lobbyId: doc(asString, 'Which lobby to answer.'),
+    lobbyRequest: doc(
+      asCoreValue,
+      'Normally the object from `admin-fetch-lobby-request`.'
+    ),
+    replyData: asOptional(doc(asCoreValue, 'Payload for the requester.'))
+  }).withRest,
+  errors: ['BAD_REQUEST', 'NETWORK_ERROR'],
+
+  async handler(ctx) {
+    const body = ctx.body
+    const { lobbyId } = body
+    if (!isPlainObject(body.lobbyRequest)) {
+      throw engineError(
+        'BAD_REQUEST',
+        'Missing required field "lobbyRequest"',
+        400
+      )
+    }
+    const internal = getInternalStuff(ctx.state.core.context)
+    await internal.sendLobbyReply(
+      lobbyId,
+      body.lobbyRequest as unknown as LobbyRequest,
+      body.replyData
+    )
+    return undefined
+  }
+})
+
+/**
+ * Sync a repo.
+ */
+export const adminSyncRepo = route({
+  core: 'context.$internalStuff.syncRepo',
+  method: 'POST',
+  path: '/admin/sync-repo',
+  cli: { command: 'admin-sync-repo', positional: 'syncKey' },
+  body: asObject({ syncKey: doc(asString, 'Base58 repo sync key.') }).withRest,
+  returns: doc(asCoreValue, 'The changeset summary.'),
+  errors: ['BAD_REQUEST', 'NETWORK_ERROR'],
+
+  async handler(ctx) {
+    const body = ctx.body
+    const { syncKey } = body
+    const internal = getInternalStuff(ctx.state.core.context)
+    return await internal.syncRepo(base58.parse(syncKey))
+  }
+})
+
+/**
+ * List repo contents.
+ */
+export const adminRepoList = route({
+  core: 'context.$internalStuff.getRepoDisklet',
+  method: 'GET',
+  path: '/admin/repo-list',
+  cli: { command: 'admin-repo-list', positional: 'syncKey' },
+  query: asObject({
+    ...REPO_KEYS,
+    path: asOptional(doc(asString, 'Subdirectory. Defaults to the repo root.'))
+  }).withRest,
+  returns: asObject({
+    listing: doc(asCoreValue, 'Path to entry type: `file` or `folder`.')
+  }),
+  errors: ['BAD_REQUEST'],
+
+  async handler(ctx) {
+    const { syncKey, dataKey } = ctx.query.valid
+    const path = ctx.query.valid.path ?? ''
+    const internal = getInternalStuff(ctx.state.core.context)
+    const disklet = await internal.getRepoDisklet(
+      base58.parse(syncKey),
+      base58.parse(dataKey)
+    )
+    const listing = await disklet.list(path)
+    return { listing }
+  }
+})
+
+/**
+ * Read a repo file.
+ */
+export const adminRepoGet = route({
+  core: 'context.$internalStuff.getRepoDisklet',
+  method: 'GET',
+  path: '/admin/repo-get',
+  cli: { command: 'admin-repo-get', positional: 'syncKey' },
+  query: asObject({
+    ...REPO_KEYS,
+    path: doc(asString, 'Path within the repo.')
+  }).withRest,
+  returns: asObject({ text: doc(asString, 'The file contents.') }),
+  errors: ['NOT_FOUND', 'BAD_REQUEST'],
+
+  async handler(ctx) {
+    const { syncKey, dataKey, path } = ctx.query.valid
+    const internal = getInternalStuff(ctx.state.core.context)
+    const disklet = await internal.getRepoDisklet(
+      base58.parse(syncKey),
+      base58.parse(dataKey)
+    )
+    const text = await disklet.getText(path)
+    return { text }
+  }
+})
+
+/**
+ * Write a repo file.
+ *
+ * Writes directly into a synced repo, bypassing every core-level invariant. A
+ * malformed write can break the account for real clients.
+ */
+export const adminRepoSet = route({
+  core: 'context.$internalStuff.getRepoDisklet',
+  method: 'POST',
+  path: '/admin/repo-set',
+  cli: { command: 'admin-repo-set', positional: 'syncKey' },
+  body: asObject({
+    ...REPO_KEYS,
+    path: doc(asString, 'Path within the repo.'),
+    text: doc(asString, 'The contents to write.')
+  }).withRest,
+  errors: ['BAD_REQUEST'],
+
+  async handler(ctx) {
+    const body = ctx.body
+    const { syncKey, dataKey, path, text } = body
+    const internal = getInternalStuff(ctx.state.core.context)
+    const disklet = await internal.getRepoDisklet(
+      base58.parse(syncKey),
+      base58.parse(dataKey)
+    )
+    await disklet.setText(path, text)
+    return undefined
+  }
+})
+
+/**
+ * Delete a repo file.
+ *
+ * Destructive, and not undoable from this API.
+ */
+export const adminRepoDelete = route({
+  core: 'context.$internalStuff.getRepoDisklet',
+  method: 'POST',
+  path: '/admin/repo-delete',
+  cli: { command: 'admin-repo-delete', positional: 'syncKey' },
+  body: asObject({ ...REPO_KEYS, path: doc(asString, 'Path within the repo.') })
+    .withRest,
+  errors: ['BAD_REQUEST'],
+
+  async handler(ctx) {
+    const body = ctx.body
+    const { syncKey, dataKey, path } = body
+    const internal = getInternalStuff(ctx.state.core.context)
+    const disklet = await internal.getRepoDisklet(
+      base58.parse(syncKey),
+      base58.parse(dataKey)
+    )
+    await disklet.delete(path)
+    return undefined
+  }
+})
diff --git a/src/cli/engine/routes/context.ts b/src/cli/engine/routes/context.ts
new file mode 100644
index 00000000000..cbf822c0cda
--- /dev/null
+++ b/src/cli/engine/routes/context.ts
@@ -0,0 +1,307 @@
+import { asArray, asBoolean, asObject, asOptional, asString } from 'cleaners'
+
+import { doc } from '../doc'
+import { engineError } from '../errors'
+import { route } from '../route'
+import { asCoreValue } from '../schemas'
+
+const asUsernameQuery = asObject({
+  username: doc(asString, 'The name to check.'),
+  challengeId: asOptional(
+    doc(asString, 'Supply after solving a CAPTCHA to retry the same check.')
+  )
+}).withRest
+
+const asForgetAccountBody = asObject({
+  rootLoginId: doc(
+    asString,
+    'Core takes a `rootLoginId`. A username is also accepted and resolved against `localUsers` first, so callers need not hash it.'
+  )
+}).withRest
+const asOtpResetBody = asObject({
+  username: doc(asString, 'Whose 2FA to reset.'),
+  otpResetToken: doc(
+    asString,
+    'From `details.resetToken` on an `OTP_REQUIRED` error.'
+  )
+}).withRest
+const asRecoveryQuestionsQuery = asObject({
+  recoveryKey: doc(
+    asString,
+    'From `change-recovery`, stored by the user out of band.'
+  ),
+  username: doc(asString, 'Whose questions to fetch.')
+}).withRest
+
+/**
+ * List local users on this device.
+ *
+ * @returns Everything `context.localUsers` reports, including which login
+ *   methods each user has enabled on this device.
+ */
+export const localUsers = route({
+  core: 'context.localUsers',
+  method: 'GET',
+  path: '/local-users',
+  cli: 'local-users',
+  returns: asObject({
+    localUsers: doc(
+      asArray(asCoreValue),
+      '`EdgeUserInfo[]`: one entry per account cached on this device.'
+    )
+  }),
+
+  handler(ctx) {
+    return { localUsers: ctx.state.core.context.localUsers }
+  }
+})
+
+/**
+ * Forget an account on this device.
+ *
+ * Removes locally cached credentials. The remote account is untouched.
+ *
+ */
+export const forgetAccount = route({
+  core: 'context.forgetAccount',
+  method: 'POST',
+  path: '/forget-account',
+  cli: 'forget-account',
+  body: asForgetAccountBody,
+  errors: ['USER_NOT_FOUND', 'BAD_REQUEST'],
+
+  async handler(ctx) {
+    const { rootLoginId } = ctx.body
+    const { context } = ctx.state.core
+    const found = context.localUsers.find(
+      user => user.loginId === rootLoginId || user.username === rootLoginId
+    )
+    if (found == null) {
+      throw engineError(
+        'USER_NOT_FOUND',
+        `No local user matching: ${rootLoginId}`,
+        404
+      )
+    }
+    await context.forgetAccount(found.loginId)
+    return undefined
+  }
+})
+
+/**
+ * Check whether a username is free.
+ *
+ */
+export const usernameAvailable = route({
+  core: 'context.usernameAvailable',
+  method: 'GET',
+  path: '/username-available',
+  cli: 'username-available',
+  query: asUsernameQuery,
+  returns: asObject({
+    username: doc(asString, 'The name that was checked, echoed back.'),
+    available: doc(
+      asBoolean,
+      'True when nobody holds this name. It is not reserved by asking.'
+    )
+  }),
+  errors: ['USERNAME_ERROR', 'CHALLENGE_REQUIRED', 'NETWORK_ERROR'],
+
+  async handler(ctx) {
+    const { username, challengeId } = ctx.query.valid
+    const available = await ctx.state.core.context.usernameAvailable(username, {
+      challengeId
+    })
+    return { username, available }
+  }
+})
+
+/**
+ * Normalize a username.
+ *
+ * Applies the same rules the login server does, so a caller can show the user
+ * what their name will actually be before creating an account.
+ */
+export const fixUsername = route({
+  core: 'context.fixUsername',
+  method: 'GET',
+  path: '/fix-username',
+  cli: 'fix-username',
+  query: asObject({
+    username: doc(asString, 'The name to normalize.')
+  }).withRest,
+  returns: asObject({
+    username: doc(asString, 'The normalized value. The input is not echoed.')
+  }),
+
+  handler(ctx) {
+    return {
+      username: ctx.state.core.context.fixUsername(ctx.query.valid.username)
+    }
+  }
+})
+
+/**
+ * Score a candidate password.
+ *
+ * @note Send it with `curl --get --data-urlencode` rather than putting it in a
+ *   shell-visible URL.
+ * @returns `EdgePasswordRules` from core: passed, tooShort, noNumber,
+ *   noLowerCase, noUpperCase, secondsToCrack.
+ */
+export const checkPasswordRules = route({
+  core: 'context.checkPasswordRules',
+  method: 'GET',
+  path: '/check-password-rules',
+  cli: 'check-password-rules',
+  query: asObject({
+    password: doc(asString, 'The candidate password to score.')
+  }).withRest,
+  returns: asCoreValue,
+
+  handler(ctx) {
+    return ctx.state.core.context.checkPasswordRules(ctx.query.valid.password)
+  }
+})
+
+/**
+ * Fetch login-server messages for every local user.
+ *
+ * @returns `EdgeLoginMessages` from core, keyed by loginId; each value carries
+ *   otpResetPending and pendingVouchers. Passed straight through.
+ */
+export const fetchLoginMessages = route({
+  core: 'context.fetchLoginMessages',
+  method: 'GET',
+  path: '/fetch-login-messages',
+  cli: 'fetch-login-messages',
+  returns: doc(
+    asCoreValue,
+    '`EdgeLoginMessages` from core, keyed by loginId; each value carries otpResetPending and pendingVouchers.'
+  ),
+  errors: ['NETWORK_ERROR'],
+
+  async handler(ctx) {
+    return await ctx.state.core.context.fetchLoginMessages()
+  }
+})
+
+/**
+ * Request a 2FA reset.
+ *
+ * Starts the timed reset a user falls back on after losing their
+ * authenticator.
+ *
+ * @returns When the reset completes if nobody cancels it.
+ */
+export const requestOtpReset = route({
+  core: 'context.requestOtpReset',
+  method: 'POST',
+  path: '/request-otp-reset',
+  cli: 'request-otp-reset',
+  body: asOtpResetBody,
+  returns: asObject({
+    resetDate: doc(
+      asString,
+      'When 2FA will actually come off. The login server enforces a waiting ' +
+        'period so the real owner has time to cancel.'
+    )
+  }),
+  errors: ['USERNAME_ERROR', 'BAD_REQUEST', 'NETWORK_ERROR'],
+
+  async handler(ctx) {
+    const resetDate = await ctx.state.core.context.requestOtpReset(
+      ctx.body.username,
+      ctx.body.otpResetToken
+    )
+    return { resetDate: resetDate.toISOString() }
+  }
+})
+
+/**
+ * Fetch a user’s recovery questions.
+ *
+ * @coreNote Our surface drops the `2` from the path, command and `recoveryKey`
+ *   parameter; a future Recovery1 would be suffixed `V1`.
+ */
+export const fetchRecoveryQuestions = route({
+  core: 'context.fetchRecovery2Questions',
+  coreExtra: {
+    recoveryKey: 'Core calls it recovery2Key. The `2` is dropped throughout.'
+  },
+  method: 'GET',
+  path: '/fetch-recovery-questions',
+  cli: 'fetch-recovery-questions',
+  query: asRecoveryQuestionsQuery,
+  returns: asObject({
+    questions: doc(
+      asArray(asString),
+      'The questions in the order `login-with-recovery` expects the answers.'
+    )
+  }),
+  errors: ['USERNAME_ERROR', 'NETWORK_ERROR'],
+
+  async handler(ctx) {
+    const { recoveryKey, username } = ctx.query.valid
+    const questions = await ctx.state.core.context.fetchRecovery2Questions(
+      recoveryKey,
+      username
+    )
+    return { questions }
+  }
+})
+
+/**
+ * Pre-fetch a CAPTCHA challenge.
+ *
+ * Lets a client solve a challenge before it hits `403 CHALLENGE_REQUIRED`
+ * mid-flow.
+ *
+ * @returns `challengeUri` is absent when the server considers the challenge
+ *   already satisfied.
+ */
+export const fetchChallenge = route({
+  core: 'context.fetchChallenge',
+  method: 'POST',
+  path: '/fetch-challenge',
+  cli: 'fetch-challenge',
+  body: asObject({}).withRest,
+  returns: asObject({
+    challengeId: doc(
+      asString,
+      'Pass to the call that demanded a challenge once the user has solved it.'
+    ),
+    challengeUri: doc(
+      asOptional(asString),
+      'Where to send the user to solve the CAPTCHA. Absent when the server ' +
+        'issued a challenge that needs no interaction.'
+    )
+  }),
+  errors: ['NETWORK_ERROR'],
+
+  async handler(ctx) {
+    return await ctx.state.core.context.fetchChallenge()
+  }
+})
+
+/**
+ * List plugin ids usable for wallet creation.
+ *
+ * Currency and accountbased plugins only — swap plugins are excluded.
+ *
+ * @coreNote Engine view of the enabled plugin set; core exposes
+ *   `account.currencyConfig` per plugin instead.
+ */
+export const currencyConfigs = route({
+  core: null,
+  method: 'GET',
+  path: '/currency-configs',
+  cli: 'currency-configs',
+  returns: asObject({
+    pluginIds: doc(asArray(asString), 'Currency plugins this engine loaded.')
+  }),
+
+  handler(ctx) {
+    return { pluginIds: ctx.state.core.currencyPluginIds }
+  }
+})
diff --git a/src/cli/engine/routes/credentials.ts b/src/cli/engine/routes/credentials.ts
new file mode 100644
index 00000000000..3d13c7d4feb
--- /dev/null
+++ b/src/cli/engine/routes/credentials.ts
@@ -0,0 +1,252 @@
+import {
+  asArray,
+  asBoolean,
+  asEither,
+  asObject,
+  asOptional,
+  asString,
+  asValue
+} from 'cleaners'
+
+import { doc } from '../doc'
+import { route } from '../route'
+import { getAccount } from './helpers'
+
+const PASSWORD_DOC = 'The account password.'
+const PIN_DOC = 'The device PIN, usually four digits.'
+const DURESS_DOC = 'Act on the duress account rather than the real one.'
+
+/**
+ * Set or change the password.
+ *
+ * The login server enforces its own rules; `check-password-rules` scores a
+ * candidate first.
+ */
+export const changePassword = route({
+  core: 'account.changePassword',
+  method: 'POST',
+  path: '/account/{sessionId}/change-password',
+  cli: 'change-password',
+  body: asObject({ password: doc(asString, 'The new password.') }).withRest,
+  errors: ['BAD_REQUEST', 'NETWORK_ERROR'],
+
+  async handler(ctx) {
+    await getAccount(ctx).changePassword(ctx.body.password)
+    return undefined
+  }
+})
+
+/**
+ * Remove password login.
+ *
+ * The account keeps its other login methods; only the password stops working.
+ */
+export const deletePassword = route({
+  core: 'account.deletePassword',
+  method: 'POST',
+  path: '/account/{sessionId}/delete-password',
+  cli: 'delete-password',
+  errors: ['BAD_REQUEST', 'NETWORK_ERROR'],
+
+  async handler(ctx) {
+    await getAccount(ctx).deletePassword()
+    return undefined
+  }
+})
+
+/**
+ * Verify a password.
+ *
+ * Checks without changing anything, which is how a caller gates a destructive
+ * action behind a re-entry prompt.
+ */
+export const checkPassword = route({
+  core: 'account.checkPassword',
+  method: 'POST',
+  path: '/account/{sessionId}/check-password',
+  cli: 'check-password',
+  body: asObject({ password: doc(asString, PASSWORD_DOC) }).withRest,
+  returns: asObject({
+    ok: doc(asBoolean, 'False for a wrong password — not an error response.')
+  }),
+
+  async handler(ctx) {
+    return { ok: await getAccount(ctx).checkPassword(ctx.body.password) }
+  }
+})
+
+/**
+ * Read the account PIN.
+ *
+ * Returns the PIN itself, not a status flag, so treat the output as secret.
+ */
+export const getPin = route({
+  core: 'account.getPin',
+  method: 'GET',
+  path: '/account/{sessionId}/get-pin',
+  cli: 'get-pin',
+  returns: asObject({
+    pin: doc(asEither(asString, asValue(null)), 'Null when no PIN is set.')
+  }),
+
+  async handler(ctx) {
+    const pin = await getAccount(ctx).getPin()
+    return { pin: pin ?? null }
+  }
+})
+
+/**
+ * Set or change the PIN.
+ */
+export const changePin = route({
+  core: 'account.changePin',
+  method: 'POST',
+  path: '/account/{sessionId}/change-pin',
+  cli: 'change-pin',
+  body: asObject({
+    pin: doc(asString, 'The new PIN.'),
+    enableLogin: asOptional(
+      doc(asBoolean, 'Allow logging in with this PIN on this device.')
+    ),
+    forDuressAccount: asOptional(doc(asBoolean, DURESS_DOC))
+  }).withRest,
+  returns: asObject({
+    pin2Key: doc(asString, 'The new PIN login key core returns.')
+  }),
+  errors: ['BAD_REQUEST'],
+
+  async handler(ctx) {
+    const pin2Key = await getAccount(ctx).changePin({
+      pin: ctx.body.pin,
+      enableLogin: ctx.body.enableLogin,
+      forDuressAccount: ctx.body.forDuressAccount
+    })
+    return { pin2Key }
+  }
+})
+
+/**
+ * Remove the PIN.
+ *
+ * PIN login stops working on this device; other methods are untouched.
+ */
+export const deletePin = route({
+  core: 'account.deletePin',
+  method: 'POST',
+  path: '/account/{sessionId}/delete-pin',
+  cli: 'delete-pin',
+
+  async handler(ctx) {
+    await getAccount(ctx).deletePin()
+    return undefined
+  }
+})
+
+/**
+ * Verify a PIN.
+ */
+export const checkPin = route({
+  core: 'account.checkPin',
+  method: 'POST',
+  path: '/account/{sessionId}/check-pin',
+  cli: 'check-pin',
+  body: asObject({
+    pin: doc(asString, PIN_DOC),
+    forDuressAccount: asOptional(doc(asBoolean, DURESS_DOC))
+  }).withRest,
+  returns: asObject({
+    ok: doc(asBoolean, 'False for a wrong PIN — not an error response.')
+  }),
+
+  async handler(ctx) {
+    const ok = await getAccount(ctx).checkPin(ctx.body.pin, {
+      forDuressAccount: ctx.body.forDuressAccount
+    })
+    return { ok }
+  }
+})
+
+/**
+ * Change the username.
+ *
+ * The old name is released, so it becomes available to anyone else.
+ */
+export const changeUsername = route({
+  core: 'account.changeUsername',
+  method: 'POST',
+  path: '/account/{sessionId}/change-username',
+  cli: 'change-username',
+  body: asObject({
+    username: doc(asString, 'The new username.'),
+    password: asOptional(
+      doc(asString, 'Required by core when the account has a password.')
+    )
+  }).withRest,
+  errors: ['USERNAME_ERROR', 'BAD_REQUEST', 'NETWORK_ERROR'],
+
+  async handler(ctx) {
+    await getAccount(ctx).changeUsername({
+      username: ctx.body.username,
+      password: ctx.body.password
+    })
+    return undefined
+  }
+})
+
+/**
+ * Set recovery questions and answers.
+ *
+ * The returned key is half of the credential: without it the answers alone
+ * cannot recover the account, so it has to be stored somewhere else.
+ *
+ * @coreNote Our surface drops the `2` from core's recovery2 naming; a future
+ *   Recovery1 would be suffixed `V1`.
+ */
+export const changeRecovery = route({
+  core: 'account.changeRecovery',
+  method: 'POST',
+  path: '/account/{sessionId}/change-recovery',
+  cli: {
+    command: 'change-recovery',
+    flags: {
+      question: { maps: 'questions', repeat: true },
+      answer: { maps: 'answers', repeat: true }
+    }
+  },
+  body: asObject({
+    questions: doc(asArray(asString), 'The questions to ask.'),
+    answers: doc(asArray(asString), 'Same length and order as `questions`.')
+  }).withRest,
+  returns: asObject({
+    recoveryKey: doc(
+      asString,
+      'Store this out of band. `login-with-recovery` needs it alongside the answers.'
+    )
+  }),
+  errors: ['BAD_REQUEST'],
+
+  async handler(ctx) {
+    const recoveryKey = await getAccount(ctx).changeRecovery(
+      ctx.body.questions,
+      ctx.body.answers
+    )
+    return { recoveryKey }
+  }
+})
+
+/**
+ * Disable recovery login.
+ *
+ * The existing recovery key stops working.
+ */
+export const deleteRecovery = route({
+  core: 'account.deleteRecovery',
+  method: 'POST',
+  path: '/account/{sessionId}/delete-recovery',
+  cli: 'delete-recovery',
+
+  async handler(ctx) {
+    await getAccount(ctx).deleteRecovery()
+    return undefined
+  }
+})
diff --git a/src/cli/engine/routes/dataStore.ts b/src/cli/engine/routes/dataStore.ts
new file mode 100644
index 00000000000..909a14b3b40
--- /dev/null
+++ b/src/cli/engine/routes/dataStore.ts
@@ -0,0 +1,138 @@
+import { asArray, asObject, asString } from 'cleaners'
+
+import { doc } from '../doc'
+import { route } from '../route'
+import { getAccount } from './helpers'
+
+const STORE_ID_DOC = 'Plugin or app namespace within the account data store.'
+const ITEM_ID_DOC = 'Key within the store.'
+
+/**
+ * List data-store ids.
+ *
+ * The account's synced key-value store, where plugins keep their own state.
+ */
+export const listStoreIds = route({
+  core: 'account.dataStore.listStoreIds',
+  method: 'GET',
+  path: '/account/{sessionId}/list-store-ids',
+  cli: 'list-store-ids',
+  returns: asObject({
+    storeIds: doc(asArray(asString), 'Every store holding at least one item.')
+  }),
+
+  async handler(ctx) {
+    return { storeIds: await getAccount(ctx).dataStore.listStoreIds() }
+  }
+})
+
+/**
+ * List item ids in a store.
+ */
+export const listItemIds = route({
+  core: 'account.dataStore.listItemIds',
+  method: 'GET',
+  path: '/account/{sessionId}/list-item-ids',
+  cli: 'list-item-ids',
+  query: asObject({ storeId: doc(asString, STORE_ID_DOC) }).withRest,
+  returns: asObject({
+    itemIds: doc(asArray(asString), 'Keys in this store. Empty if it has none.')
+  }),
+
+  async handler(ctx) {
+    const itemIds = await getAccount(ctx).dataStore.listItemIds(
+      ctx.query.valid.storeId
+    )
+    return { itemIds }
+  }
+})
+
+/**
+ * Read an item.
+ *
+ * Values are opaque strings; encoding is the caller's business.
+ */
+export const getItem = route({
+  core: 'account.dataStore.getItem',
+  method: 'GET',
+  path: '/account/{sessionId}/get-item',
+  cli: 'get-item',
+  query: asObject({
+    storeId: doc(asString, STORE_ID_DOC),
+    itemId: doc(asString, ITEM_ID_DOC)
+  }).withRest,
+  returns: asObject({ value: doc(asString, 'The stored string.') }),
+  errors: ['NOT_FOUND', 'BAD_REQUEST'],
+
+  async handler(ctx) {
+    const { storeId, itemId } = ctx.query.valid
+    const value = await getAccount(ctx).dataStore.getItem(storeId, itemId)
+    return { value }
+  }
+})
+
+/**
+ * Write an item.
+ *
+ * Creates the store if it does not exist.
+ */
+export const setItem = route({
+  core: 'account.dataStore.setItem',
+  method: 'POST',
+  path: '/account/{sessionId}/set-item',
+  cli: 'set-item',
+  body: asObject({
+    storeId: doc(asString, STORE_ID_DOC),
+    itemId: doc(asString, ITEM_ID_DOC),
+    value: doc(asString, 'The string to store.')
+  }).withRest,
+  errors: ['BAD_REQUEST'],
+
+  async handler(ctx) {
+    const { storeId, itemId, value } = ctx.body
+    await getAccount(ctx).dataStore.setItem(storeId, itemId, value)
+    return undefined
+  }
+})
+
+/**
+ * Delete an item.
+ */
+export const deleteItem = route({
+  core: 'account.dataStore.deleteItem',
+  method: 'POST',
+  path: '/account/{sessionId}/delete-item',
+  cli: 'delete-item',
+  body: asObject({
+    storeId: doc(asString, STORE_ID_DOC),
+    itemId: doc(asString, ITEM_ID_DOC)
+  }).withRest,
+  errors: ['BAD_REQUEST'],
+
+  async handler(ctx) {
+    await getAccount(ctx).dataStore.deleteItem(
+      ctx.body.storeId,
+      ctx.body.itemId
+    )
+    return undefined
+  }
+})
+
+/**
+ * Delete an entire store.
+ *
+ * Removes every item in it, which cannot be undone from this API.
+ */
+export const deleteStore = route({
+  core: 'account.dataStore.deleteStore',
+  method: 'POST',
+  path: '/account/{sessionId}/delete-store',
+  cli: 'delete-store',
+  body: asObject({ storeId: doc(asString, STORE_ID_DOC) }).withRest,
+  errors: ['BAD_REQUEST'],
+
+  async handler(ctx) {
+    await getAccount(ctx).dataStore.deleteStore(ctx.body.storeId)
+    return undefined
+  }
+})
diff --git a/src/cli/engine/routes/events.ts b/src/cli/engine/routes/events.ts
new file mode 100644
index 00000000000..3b03ff5b83e
--- /dev/null
+++ b/src/cli/engine/routes/events.ts
@@ -0,0 +1,65 @@
+import { asObject, asString, asUnknown } from 'cleaners'
+
+import { doc } from '../doc'
+import { route } from '../route'
+
+/**
+ * Subscribe to engine events.
+ *
+ * Holds a Server-Sent Events stream open until the caller disconnects or the
+ * engine closes it. Runs concurrently with one-shot calls, so a subscriber in
+ * one terminal watches what another terminal does.
+ *
+ * A live subscription holds the engine open past its idle timeout. It does not
+ * hold an account logged in: the auto-logout timer still fires, and closes any
+ * subscription scoped to that account or one of its wallets. Context-scoped
+ * subscriptions survive, because the context outlives every account.
+ *
+ * @note Frame types: `core.log`, `session.created`, `session.expired`,
+ *   `engine.shutdown`, and `subscription.closed` when the engine ends it.
+ * @note `sessionId` in event payloads is truncated to its first 10 characters.
+ * @note A client more than 1 MiB behind is disconnected rather than buffered.
+ * @note Served directly by the HTTP handler rather than through the router,
+ *   because the response never ends.
+ * @coreNote Engine-side fan-out; `core.log` frames carry core's onLog output.
+ */
+export const engineEvents = route({
+  core: null,
+  method: 'GET',
+  path: '/engine/events',
+  cli: {
+    command: 'subscribe',
+    custom: true,
+    extra: {
+      type: {
+        kind: 'repeat',
+        doc: 'Client-side filter; the engine always sends everything the scope allows.'
+      }
+    },
+    exits: { interrupted: 0, sessionClosed: 3, engineClosed: 7 },
+    notes:
+      'Prints newline-delimited JSON and runs until interrupted. Exits 0 on SIGINT, 3 when a session ended the stream, 7 when the engine went away.'
+  },
+  stream: {
+    scope: 'context',
+    frames: [
+      'core.log',
+      'session.created',
+      'session.expired',
+      'engine.shutdown',
+      'subscription.closed'
+    ]
+  },
+  returns: doc(
+    asObject({
+      type: doc(asString, 'The event name.'),
+      data: doc(asUnknown, 'Payload, shaped by the event type.')
+    }),
+    'One frame per event, as `event:` then `data:` lines.'
+  ),
+
+  handler() {
+    // The SSE upgrade happens in server.ts, which owns the response.
+    return undefined
+  }
+})
diff --git a/src/cli/engine/routes/helpers.ts b/src/cli/engine/routes/helpers.ts
new file mode 100644
index 00000000000..f071d63fee8
--- /dev/null
+++ b/src/cli/engine/routes/helpers.ts
@@ -0,0 +1,196 @@
+/**
+ * Shared helpers for route handlers: session/account lookup, body field
+ * validation, and query-string parsing. Not part of the core engine
+ * infrastructure — just utilities reused across route modules.
+ */
+import type { EdgeAccount, EdgeCurrencyWallet } from 'edge-core-js'
+
+import { engineError } from '../errors'
+import type { RouteContext } from '../router'
+import type { SessionRecord } from '../sessions'
+
+export function getSession(ctx: RouteContext): SessionRecord {
+  const session = ctx.state.sessions.get(ctx.params.sessionId)
+  ctx.state.sessions.touch(ctx.params.sessionId)
+  return session
+}
+
+export function getAccount(ctx: RouteContext): EdgeAccount {
+  return getSession(ctx).account
+}
+
+export function requireString(
+  body: Record<string, unknown>,
+  key: string
+): string {
+  const value = body[key]
+  if (typeof value !== 'string' || value === '') {
+    throw engineError('BAD_REQUEST', `Missing required field "${key}"`, 400)
+  }
+  return value
+}
+
+export function optionalString(
+  body: Record<string, unknown>,
+  key: string
+): string | undefined {
+  const value = body[key]
+  if (value == null) return undefined
+  if (typeof value !== 'string') {
+    throw engineError('BAD_REQUEST', `Field "${key}" must be a string`, 400)
+  }
+  return value
+}
+
+export function requireStringArray(
+  body: Record<string, unknown>,
+  key: string
+): string[] {
+  const value = body[key]
+  if (!Array.isArray(value) || !value.every(v => typeof v === 'string')) {
+    throw engineError(
+      'BAD_REQUEST',
+      `Field "${key}" must be an array of strings`,
+      400
+    )
+  }
+  return value as string[]
+}
+
+export function optionalStringArray(
+  body: Record<string, unknown>,
+  key: string
+): string[] | undefined {
+  const value = body[key]
+  if (value == null) return undefined
+  return requireStringArray(body, key)
+}
+
+export function optionalBoolean(
+  body: Record<string, unknown>,
+  key: string
+): boolean | undefined {
+  const value = body[key]
+  if (value == null) return undefined
+  if (typeof value !== 'boolean') {
+    throw engineError('BAD_REQUEST', `Field "${key}" must be a boolean`, 400)
+  }
+  return value
+}
+
+export function requireBoolean(
+  body: Record<string, unknown>,
+  key: string
+): boolean {
+  const value = body[key]
+  if (typeof value !== 'boolean') {
+    throw engineError('BAD_REQUEST', `Missing required field "${key}"`, 400)
+  }
+  return value
+}
+
+export function optionalNumber(
+  body: Record<string, unknown>,
+  key: string
+): number | undefined {
+  const value = body[key]
+  if (value == null) return undefined
+  if (typeof value !== 'number' || Number.isNaN(value)) {
+    throw engineError('BAD_REQUEST', `Field "${key}" must be a number`, 400)
+  }
+  return value
+}
+
+export function requireQueryString(
+  query: URLSearchParams,
+  key: string
+): string {
+  const value = query.get(key)
+  if (value == null || value === '') {
+    throw engineError(
+      'BAD_REQUEST',
+      `Missing required query parameter "${key}"`,
+      400
+    )
+  }
+  return value
+}
+
+export function optionalQueryString(
+  query: URLSearchParams,
+  key: string
+): string | undefined {
+  return query.get(key) ?? undefined
+}
+
+export function optionalQueryDate(
+  query: URLSearchParams,
+  key: string
+): Date | undefined {
+  const raw = query.get(key)
+  if (raw == null || raw === '') return undefined
+  const ms = Number(raw)
+  const date =
+    Number.isFinite(ms) && raw.trim() !== '' ? new Date(ms) : new Date(raw)
+  if (Number.isNaN(date.getTime())) {
+    throw engineError(
+      'BAD_REQUEST',
+      `Query parameter "${key}" must be a valid date`,
+      400
+    )
+  }
+  return date
+}
+
+export function optionalQueryInt(
+  query: URLSearchParams,
+  key: string
+): number | undefined {
+  const raw = query.get(key)
+  if (raw == null || raw === '') return undefined
+  const value = Number.parseInt(raw, 10)
+  if (Number.isNaN(value)) {
+    throw engineError(
+      'BAD_REQUEST',
+      `Query parameter "${key}" must be an integer`,
+      400
+    )
+  }
+  return value
+}
+
+export function optionalQueryBoolean(
+  query: URLSearchParams,
+  key: string
+): boolean | undefined {
+  const raw = query.get(key)
+  if (raw == null || raw === '') return undefined
+  return raw === 'true' || raw === '1'
+}
+
+/** The wallet fields every listing and creation route returns. */
+export function summarizeWallet(
+  wallet: EdgeCurrencyWallet
+): Record<string, unknown> {
+  return {
+    walletId: wallet.id,
+    id: wallet.id,
+    type: wallet.type,
+    name: wallet.name,
+    pluginId: wallet.currencyInfo.pluginId,
+    currencyCode: wallet.currencyInfo.currencyCode,
+    fiatCurrencyCode: wallet.fiatCurrencyCode,
+    blockHeight: wallet.blockHeight,
+    syncStatus: wallet.syncStatus,
+    syncRatio:
+      wallet.syncStatus?.totalRatio != null
+        ? `${Math.round(wallet.syncStatus.totalRatio * 100)}%`
+        : undefined,
+    paused: wallet.paused,
+    imported: wallet.imported,
+    created: wallet.created?.toISOString() ?? null,
+    enabledTokenIds: wallet.enabledTokenIds,
+    detectedTokenIds: wallet.detectedTokenIds,
+    unactivatedTokenIds: wallet.unactivatedTokenIds
+  }
+}
diff --git a/src/cli/engine/routes/index.ts b/src/cli/engine/routes/index.ts
new file mode 100644
index 00000000000..ae3d3708e88
--- /dev/null
+++ b/src/cli/engine/routes/index.ts
@@ -0,0 +1,34 @@
+/**
+ * Route registration.
+ *
+ * Every call is declared with `route(…)`, which records it in a registry, so
+ * importing the module is all the registration a route needs.
+ */
+import './account'
+import './admin'
+import './context'
+import './credentials'
+import './dataStore'
+import './events'
+import './keys'
+import './lobby'
+import './localSettings'
+import './login'
+import './objects'
+import './otp'
+import './rates'
+import './spend'
+import './status'
+import './swap'
+import './tokens'
+import './transactions'
+import './uri'
+import './vouchers'
+import './wallets'
+
+import { allRoutes, registerRoute } from '../route'
+import type { Router } from '../router'
+
+export function registerRoutes(router: Router): void {
+  for (const spec of allRoutes()) registerRoute(router, spec)
+}
diff --git a/src/cli/engine/routes/keys.ts b/src/cli/engine/routes/keys.ts
new file mode 100644
index 00000000000..03c6285ce9a
--- /dev/null
+++ b/src/cli/engine/routes/keys.ts
@@ -0,0 +1,274 @@
+import {
+  asArray,
+  asBoolean,
+  asNumber,
+  asObject,
+  asOptional,
+  asString
+} from 'cleaners'
+import type { EdgeWalletStates } from 'edge-core-js'
+
+import { doc } from '../doc'
+import { engineError } from '../errors'
+import { findWallet } from '../resolve'
+import { route } from '../route'
+import type { RouteContext } from '../router'
+import { asCoreValue, asWalletId } from '../schemas'
+import { getAccount } from './helpers'
+
+/**
+ * The full wallet id behind a `walletId` query field.
+ *
+ * These routes hand the id straight to core, which only knows full ids. The
+ * documented contract is that any unique prefix works, so resolve it here
+ * rather than making these five calls the exceptions.
+ */
+function walletIdFor(
+  ctx: RouteContext & {
+    query: { valid: { walletId: string } }
+  }
+): string {
+  return findWallet(getAccount(ctx), ctx.query.valid.walletId).id
+}
+
+const asWalletIdQuery = asObject({ walletId: asWalletId }).withRest
+
+/**
+ * List every key in the account.
+ *
+ * Includes archived and deleted keys, unlike `currency-wallets`.
+ */
+export const allKeys = route({
+  core: 'account.allKeys',
+  method: 'GET',
+  path: '/account/{sessionId}/all-keys',
+  cli: 'all-keys',
+  returns: asObject({
+    allKeys: doc(
+      asArray(asCoreValue),
+      '`EdgeWalletInfoFull[]`: id, type, keys, archived, deleted, hidden, sortIndex.'
+    )
+  }),
+
+  handler(ctx) {
+    return { allKeys: getAccount(ctx).allKeys }
+  }
+})
+
+/**
+ * Create a wallet from raw key JSON.
+ *
+ * The import path. Use `create-currency-wallet` to make a fresh wallet with
+ * generated keys.
+ */
+export const createWallet = route({
+  core: 'account.createWallet',
+  method: 'POST',
+  path: '/account/{sessionId}/create-wallet',
+  cli: 'create-wallet',
+  body: asObject({
+    type: doc(asString, 'Wallet type, e.g. `wallet:bitcoin`.'),
+    keys: asOptional(
+      doc(asCoreValue, 'Plugin key material. Omit to let core generate it.')
+    )
+  }).withRest,
+  returns: asObject({
+    walletId: doc(asString, 'The new wallet. Its keys are already saved.')
+  }),
+  errors: ['BAD_REQUEST'],
+
+  async handler(ctx) {
+    const keys =
+      ctx.body.keys != null && typeof ctx.body.keys === 'object'
+        ? (ctx.body.keys as Record<string, unknown>)
+        : undefined
+    const walletId = await getAccount(ctx).createWallet(ctx.body.type, keys)
+    return { walletId }
+  }
+})
+
+/**
+ * Read one wallet's key info.
+ *
+ * @note An exact lookup: unlike the wallet-scoped routes this does not accept
+ *   an id prefix.
+ */
+export const getWalletInfo = route({
+  core: 'account.getWalletInfo',
+  method: 'GET',
+  path: '/account/{sessionId}/get-wallet-info',
+  cli: 'get-wallet-info',
+  query: asObject({
+    id: doc(asString, 'The key id, from `all-keys`. Base64, like a wallet id.')
+  }).withRest,
+  returns: doc(
+    asCoreValue,
+    '`EdgeWalletInfoFull`, verbatim from core — including the `keys` object.'
+  ),
+  errors: ['WALLET_NOT_FOUND', 'AMBIGUOUS_WALLET_ID'],
+
+  handler(ctx) {
+    const info = getAccount(ctx).getWalletInfo(ctx.query.valid.id)
+    if (info == null) {
+      throw engineError(
+        'WALLET_NOT_FOUND',
+        `No wallet found matching: ${ctx.query.valid.id}`,
+        404
+      )
+    }
+    return info
+  }
+})
+
+/**
+ * Read raw private key material.
+ *
+ * Secret. Whatever the plugin stores — seed, mnemonic, xpriv.
+ */
+export const getRawPrivateKey = route({
+  core: 'account.getRawPrivateKey',
+  method: 'GET',
+  path: '/account/{sessionId}/get-raw-private-key',
+  cli: 'get-raw-private-key',
+  query: asWalletIdQuery,
+  returns: doc(asCoreValue, "The plugin's key object, at the top level."),
+  errors: ['WALLET_NOT_FOUND', 'AMBIGUOUS_WALLET_ID'],
+
+  async handler(ctx) {
+    const account = getAccount(ctx)
+    return await account.getRawPrivateKey(walletIdFor(ctx))
+  }
+})
+
+/**
+ * Read raw public key material.
+ */
+export const getRawPublicKey = route({
+  core: 'account.getRawPublicKey',
+  method: 'GET',
+  path: '/account/{sessionId}/get-raw-public-key',
+  cli: 'get-raw-public-key',
+  query: asWalletIdQuery,
+  returns: doc(asCoreValue, "The plugin's public key object."),
+  errors: ['WALLET_NOT_FOUND', 'AMBIGUOUS_WALLET_ID'],
+
+  async handler(ctx) {
+    const account = getAccount(ctx)
+    return await account.getRawPublicKey(walletIdFor(ctx))
+  }
+})
+
+/**
+ * Export the private key for display.
+ *
+ * Secret. The human-facing form — WIF, seed phrase, whatever the plugin shows
+ * on its export screen.
+ */
+export const getDisplayPrivateKey = route({
+  core: 'account.getDisplayPrivateKey',
+  method: 'GET',
+  path: '/account/{sessionId}/get-display-private-key',
+  cli: 'get-display-private-key',
+  query: asWalletIdQuery,
+  returns: asObject({ key: doc(asString, 'The displayable private key.') }),
+  errors: ['WALLET_NOT_FOUND', 'AMBIGUOUS_WALLET_ID'],
+
+  async handler(ctx) {
+    const key = await getAccount(ctx).getDisplayPrivateKey(walletIdFor(ctx))
+    return { key }
+  }
+})
+
+/**
+ * Export the public key for display.
+ *
+ * The xpub or equivalent — safe to share for watch-only use.
+ */
+export const getDisplayPublicKey = route({
+  core: 'account.getDisplayPublicKey',
+  method: 'GET',
+  path: '/account/{sessionId}/get-display-public-key',
+  cli: 'get-display-public-key',
+  query: asWalletIdQuery,
+  returns: asObject({ key: doc(asString, 'The displayable public key.') }),
+  errors: ['WALLET_NOT_FOUND', 'AMBIGUOUS_WALLET_ID'],
+
+  async handler(ctx) {
+    const key = await getAccount(ctx).getDisplayPublicKey(walletIdFor(ctx))
+    return { key }
+  }
+})
+
+/**
+ * List chains a wallet can split into.
+ *
+ * Forked-chain support: which wallet types can be derived from these keys.
+ */
+export const listSplittableWalletTypes = route({
+  core: 'account.listSplittableWalletTypes',
+  method: 'GET',
+  path: '/account/{sessionId}/list-splittable-wallet-types',
+  cli: 'list-splittable-wallet-types',
+  query: asWalletIdQuery,
+  returns: asObject({
+    walletTypes: doc(asArray(asString), 'Types valid for `split`.')
+  }),
+  errors: ['WALLET_NOT_FOUND', 'AMBIGUOUS_WALLET_ID'],
+
+  async handler(ctx) {
+    const walletTypes = await getAccount(ctx).listSplittableWalletTypes(
+      walletIdFor(ctx)
+    )
+    return { walletTypes }
+  }
+})
+
+/**
+ * Archive, delete, hide, or reorder wallets.
+ *
+ * The canonical backend for every wallet flag; there are no separate archive,
+ * unarchive or undelete verbs.
+ */
+export const changeWalletStates = route({
+  core: 'account.changeWalletStates',
+  method: 'POST',
+  path: '/account/{sessionId}/change-wallet-states',
+  cli: {
+    command: 'change-wallet-states',
+    custom: true,
+    extra: {
+      walletId: {
+        kind: 'string',
+        required: true,
+        doc: 'The wallet to change. The command makes it the key of a single-entry `walletStates` map.'
+      },
+      archived: { kind: 'boolstr', doc: 'Hide from the active list.' },
+      deleted: { kind: 'boolstr', doc: 'Mark deleted.' },
+      hidden: { kind: 'boolstr', doc: 'Hide from the wallet picker.' },
+      sortIndex: { kind: 'string', doc: 'Position in the wallet list.' }
+    },
+    notes:
+      'The command builds a single-wallet `walletStates` map from these flags, and needs at least one.'
+  },
+  body: asObject({
+    walletStates: doc(
+      asObject(
+        asObject({
+          archived: asOptional(asBoolean),
+          deleted: asOptional(asBoolean),
+          hidden: asOptional(asBoolean),
+          sortIndex: asOptional(asNumber)
+        }).withRest
+      ),
+      '`EdgeWalletStates`: wallet ids to the flags being changed.'
+    )
+  }).withRest,
+  errors: ['BAD_REQUEST'],
+
+  async handler(ctx) {
+    await getAccount(ctx).changeWalletStates(
+      ctx.body.walletStates as unknown as EdgeWalletStates
+    )
+    return undefined
+  }
+})
diff --git a/src/cli/engine/routes/lobby.ts b/src/cli/engine/routes/lobby.ts
new file mode 100644
index 00000000000..428876094de
--- /dev/null
+++ b/src/cli/engine/routes/lobby.ts
@@ -0,0 +1,94 @@
+import { asEither, asObject, asString, asValue } from 'cleaners'
+
+import { doc } from '../doc'
+import { engineError } from '../errors'
+import { route } from '../route'
+import { asOk } from '../schemas'
+import { getAccount } from './helpers'
+
+const LOBBY_ID_DOC = 'From the QR code, or an `edge://edge/<lobbyId>` link.'
+
+/**
+ * Inspect a login request.
+ *
+ * The other side of `request-edge-login`: shows who is asking, so a human can
+ * decide before approving.
+ */
+export const fetchLobby = route({
+  core: 'account.fetchLobby',
+  method: 'GET',
+  path: '/account/{sessionId}/fetch-lobby',
+  cli: { command: 'fetch-lobby', positional: 'lobbyId' },
+  query: asObject({ lobbyId: doc(asString, LOBBY_ID_DOC) }).withRest,
+  returns: asObject({
+    lobbyId: doc(asString, 'The lobby that was fetched, echoed back.'),
+    loginRequest: doc(
+      asEither(
+        asObject({
+          appId: asString,
+          displayName: asString,
+          displayImageDarkUrl: asEither(asString, asValue(null)),
+          displayImageLightUrl: asEither(asString, asValue(null))
+        }),
+        asValue(null)
+      ),
+      'Null when the lobby carries no pending login request.'
+    )
+  }),
+  errors: ['BAD_REQUEST', 'NETWORK_ERROR'],
+
+  async handler(ctx) {
+    const { lobbyId } = ctx.query.valid
+    const lobby = await getAccount(ctx).fetchLobby(lobbyId)
+    const { loginRequest } = lobby
+    return {
+      lobbyId,
+      loginRequest:
+        loginRequest == null
+          ? null
+          : {
+              appId: loginRequest.appId,
+              displayName: loginRequest.displayName,
+              displayImageDarkUrl: loginRequest.displayImageDarkUrl ?? null,
+              displayImageLightUrl: loginRequest.displayImageLightUrl ?? null
+            }
+    }
+  }
+})
+
+/**
+ * Approve a login request.
+ *
+ * Grants the requesting device access to this account.
+ *
+ * @note The lobby is re-fetched on approve, so a request that expired between
+ *   inspecting and approving fails with `404 NO_LOGIN_REQUEST`.
+ * @coreNote Reached through account.fetchLobby(lobbyId).loginRequest.
+ */
+export const approveLoginRequest = route({
+  core: 'EdgeLoginRequest.approve',
+  coreExtra: {
+    lobbyId:
+      'Core calls approve() on a request object. Over HTTP there is no ' +
+      'object to hold, so the lobby names which one to approve.'
+  },
+  method: 'POST',
+  path: '/account/{sessionId}/approve-login-request',
+  cli: { command: 'approve-login-request', positional: 'lobbyId' },
+  body: asObject({ lobbyId: doc(asString, LOBBY_ID_DOC) }).withRest,
+  returns: asOk,
+  errors: ['NO_LOGIN_REQUEST', 'BAD_REQUEST', 'NETWORK_ERROR'],
+
+  async handler(ctx) {
+    const lobby = await getAccount(ctx).fetchLobby(ctx.body.lobbyId)
+    if (lobby.loginRequest == null) {
+      throw engineError(
+        'NO_LOGIN_REQUEST',
+        'Lobby has no pending login request',
+        404
+      )
+    }
+    await lobby.loginRequest.approve()
+    return { ok: true }
+  }
+})
diff --git a/src/cli/engine/routes/localSettings.ts b/src/cli/engine/routes/localSettings.ts
new file mode 100644
index 00000000000..a14d34ce590
--- /dev/null
+++ b/src/cli/engine/routes/localSettings.ts
@@ -0,0 +1,74 @@
+import { asBoolean, asObject } from 'cleaners'
+
+import {
+  readLocalAccountSettingsFromDisk,
+  writeLocalAccountSettingsToDisk
+} from '../../../util/localAccountSettings'
+import { doc } from '../doc'
+import { route } from '../route'
+import { getAccount } from './helpers'
+
+const SPAM_FILTER_DOC =
+  'Hide spam transactions in `get-transactions` results. Defaults to `true`, ' +
+  'matching the GUI. The filter hides rows; it never changes stored metadata.'
+
+/** Every device-local setting. One today; new ones are added as fields here. */
+const asLocalSettings = asObject({
+  spamFilterOn: doc(asBoolean, SPAM_FILTER_DOC)
+})
+
+/**
+ * Local settings.
+ *
+ * Device-local account settings, stored in `Settings.json` on
+ * `account.localDisklet`. They are not synced — a phone and a CLI keep
+ * separate copies unless they share an Edge data directory.
+ *
+ * @coreNote GUI code (src/util/localAccountSettings), reached through
+ *   account.localDisklet.
+ */
+export const localSettings = route({
+  core: null,
+  method: 'GET',
+  path: '/account/{sessionId}/local-settings',
+  cli: { command: 'local-settings', custom: true },
+  returns: asLocalSettings,
+
+  async handler(ctx) {
+    const settings = await readLocalAccountSettingsFromDisk(getAccount(ctx))
+    return { spamFilterOn: settings.spamFilterOn }
+  }
+})
+
+/**
+ * Change local settings.
+ *
+ * Writes device-local account settings. Every option is a field on the body;
+ * `spamFilterOn` is the only one today, and new options are added alongside it.
+ *
+ * @note Omitting a field is a `400`, not a no-op, so a caller cannot clear a
+ *   setting by accident.
+ * @coreNote GUI code (src/util/localAccountSettings).
+ */
+export const changeLocalSettings = route({
+  core: null,
+  method: 'POST',
+  path: '/account/{sessionId}/change-local-settings',
+  cli: {
+    command: 'local-settings',
+    custom: true,
+    notes: 'With no flag the command reads; with one it writes.'
+  },
+  body: asLocalSettings.withRest,
+  returns: asLocalSettings,
+
+  async handler(ctx) {
+    const account = getAccount(ctx)
+    const settings = await readLocalAccountSettingsFromDisk(account)
+    const updated = await writeLocalAccountSettingsToDisk(account, {
+      ...settings,
+      spamFilterOn: ctx.body.spamFilterOn
+    })
+    return { spamFilterOn: updated.spamFilterOn }
+  }
+})
diff --git a/src/cli/engine/routes/login.ts b/src/cli/engine/routes/login.ts
new file mode 100644
index 00000000000..e79d67ff9a0
--- /dev/null
+++ b/src/cli/engine/routes/login.ts
@@ -0,0 +1,519 @@
+import { asArray, asBoolean, asObject, asOptional, asString } from 'cleaners'
+import type {
+  EdgeAccount,
+  EdgeAccountOptions,
+  EdgePendingEdgeLogin
+} from 'edge-core-js'
+
+import { doc } from '../doc'
+import { engineError } from '../errors'
+import { route } from '../route'
+import { asPendingEdgeLogin, asSession } from '../schemas'
+import type { SessionInfo } from '../sessions'
+
+interface PendingRecord {
+  pendingId: string
+  pending: EdgePendingEdgeLogin
+  createdAt: number
+  cancelled?: boolean
+  session?: SessionInfo
+  sessionPromise?: Promise<SessionInfo>
+  error?: string
+  unwatchState?: () => void
+}
+
+/** Secondary index so pendingId lookups stay O(1) alongside ObjectHandleStore. */
+const pendingById = new Map<string, PendingRecord>()
+
+interface EdgeSessionApi {
+  create: (account: EdgeAccount, method: 'edge') => Promise<SessionInfo>
+  forceLogout: (
+    sessionId: string,
+    reason: 'expired' | 'shutdown' | 'cancelled'
+  ) => Promise<void>
+}
+
+function ensureEdgeSession(
+  record: PendingRecord,
+  sessions: EdgeSessionApi
+): Promise<SessionInfo> | undefined {
+  if (record.cancelled === true) return undefined
+  if (record.session != null) return Promise.resolve(record.session)
+  if (record.sessionPromise != null) return record.sessionPromise
+  // A prior create failure is sticky until the pending login is cancelled or
+  // expires — retrying on every GET can wedge the account into a loop.
+  if (record.error != null) return undefined
+  if (record.pending.account == null) return undefined
+
+  record.sessionPromise = sessions
+    .create(record.pending.account, 'edge')
+    .then(async session => {
+      if (record.cancelled === true) {
+        try {
+          await sessions.forceLogout(session.sessionId, 'cancelled')
+        } catch {
+          // best effort
+        }
+        throw engineError(
+          'PENDING_LOGIN_NOT_FOUND',
+          `Pending edge login cancelled: ${record.pendingId}`,
+          404
+        )
+      }
+      record.session = session
+      return session
+    })
+    .catch((error: unknown) => {
+      record.error = error instanceof Error ? error.message : String(error)
+      record.sessionPromise = undefined
+      throw error
+    })
+  return record.sessionPromise
+}
+
+interface LoginOptions {
+  otp?: string
+  otpKey?: string
+  challengeId?: string
+}
+
+function accountOptions(body: LoginOptions): EdgeAccountOptions {
+  const opts: EdgeAccountOptions = {}
+  if (body.challengeId != null) opts.challengeId = body.challengeId
+  if (body.otp != null) opts.otp = body.otp
+  if (body.otpKey != null) opts.otpKey = body.otpKey
+  return opts
+}
+
+/** Options every login and create call accepts, from `EdgeAccountOptions`. */
+const loginOptionFields = {
+  otp: asOptional(doc(asString, 'A current 2FA code.')),
+  otpKey: asOptional(
+    doc(asString, 'The 2FA secret itself, instead of a code.')
+  ),
+  challengeId: asOptional(
+    doc(asString, 'Supply after solving a CAPTCHA to retry the same request.')
+  )
+}
+
+function pendingSummary(
+  record: PendingRecord,
+  expiresAt?: string
+): Record<string, unknown> {
+  const { pending } = record
+  return {
+    objectId: record.pendingId,
+    pendingId: record.pendingId,
+    kind: 'pendingLogin',
+    expiresAt: expiresAt ?? null,
+    lobbyId: pending.id,
+    uri: 'edge://edge/' + pending.id,
+    state: pending.state,
+    username: pending.username ?? null,
+    session: record.session ?? null,
+    error: record.error ?? null
+  }
+}
+
+function getPending(pendingId: string): PendingRecord {
+  const record = pendingById.get(pendingId)
+  if (record == null) {
+    throw engineError(
+      'PENDING_LOGIN_NOT_FOUND',
+      `No pending edge login: ${pendingId}`,
+      404
+    )
+  }
+  return record
+}
+
+/**
+ * Log in with a password.
+ *
+ * @note With `--solve-captcha` the client solves a `CHALLENGE_REQUIRED`
+ *   response headlessly (ALTCHA proof-of-work) and retries once.
+ */
+export const loginWithPassword = route({
+  core: 'context.loginWithPassword',
+  method: 'POST',
+  path: '/login-with-password',
+  cli: { command: 'login-with-password', custom: true },
+  body: asObject({
+    username: doc(asString, 'The account name.'),
+    password: doc(asString, 'The account password.'),
+    ...loginOptionFields
+  }).withRest,
+  returns: doc(asSession, 'A session with `loginMethod: "password"`.'),
+  errors: [
+    'PASSWORD_ERROR',
+    'USERNAME_ERROR',
+    'OTP_REQUIRED',
+    'CHALLENGE_REQUIRED',
+    'NETWORK_ERROR'
+  ],
+
+  async handler(ctx) {
+    const account: EdgeAccount = await ctx.state.core.context.loginWithPassword(
+      ctx.body.username,
+      ctx.body.password,
+      accountOptions(ctx.body)
+    )
+    return await ctx.state.sessions.create(account, 'password')
+  }
+})
+
+/**
+ * Log in with a device PIN.
+ *
+ * Only works on a device that has already saved a PIN for the account.
+ */
+export const loginWithPin = route({
+  core: 'context.loginWithPIN',
+  method: 'POST',
+  path: '/login-with-pin',
+  cli: {
+    command: 'login-with-pin',
+    custom: true
+  },
+  body: asObject({
+    usernameOrLoginId: doc(asString, 'A username, or a login id.'),
+    pin: doc(asString, 'The device PIN.'),
+    useLoginId: asOptional(doc(asBoolean, 'Treat the value as a login id.')),
+    ...loginOptionFields
+  }).withRest,
+  returns: doc(asSession, 'A session with `loginMethod: "pin"`.'),
+  errors: [
+    'PASSWORD_ERROR',
+    'PIN_DISABLED',
+    'USERNAME_ERROR',
+    'BAD_REQUEST',
+    'NETWORK_ERROR'
+  ],
+
+  async handler(ctx) {
+    const account: EdgeAccount = await ctx.state.core.context.loginWithPIN(
+      ctx.body.usernameOrLoginId,
+      ctx.body.pin,
+      { ...accountOptions(ctx.body), useLoginId: ctx.body.useLoginId }
+    )
+    return await ctx.state.sessions.create(account, 'pin')
+  }
+})
+
+/**
+ * Log in with an account login key.
+ *
+ * The key comes from `get-login-key` on an already-authenticated session.
+ */
+export const loginWithKey = route({
+  core: 'context.loginWithKey',
+  method: 'POST',
+  path: '/login-with-key',
+  cli: {
+    command: 'login-with-key',
+    custom: true
+  },
+  body: asObject({
+    usernameOrLoginId: doc(asString, 'A username, or a login id.'),
+    loginKey: doc(asString, 'From `get-login-key`.'),
+    useLoginId: asOptional(doc(asBoolean, 'Treat the value as a login id.')),
+    ...loginOptionFields
+  }).withRest,
+  returns: doc(asSession, 'A session with `loginMethod: "key"`.'),
+  errors: ['PASSWORD_ERROR', 'USERNAME_ERROR', 'NETWORK_ERROR'],
+
+  async handler(ctx) {
+    const account: EdgeAccount = await ctx.state.core.context.loginWithKey(
+      ctx.body.usernameOrLoginId,
+      ctx.body.loginKey,
+      { ...accountOptions(ctx.body), useLoginId: ctx.body.useLoginId }
+    )
+    return await ctx.state.sessions.create(account, 'key')
+  }
+})
+
+/**
+ * Log in with recovery answers.
+ *
+ * Needs both the recovery key and the answers; neither works alone.
+ *
+ * @coreNote Our surface drops the `2` from core's recovery2 naming, and calls
+ *   the key `recoveryKey` to match what `change-recovery` returns.
+ */
+export const loginWithRecovery = route({
+  core: 'context.loginWithRecovery2',
+  coreExtra: {
+    recoveryKey: 'Core calls it recovery2Key. The `2` is dropped throughout.'
+  },
+  method: 'POST',
+  path: '/login-with-recovery',
+  cli: {
+    command: 'login-with-recovery',
+    custom: true,
+    flags: { answer: { maps: 'answers', repeat: true } }
+  },
+  body: asObject({
+    recoveryKey: doc(asString, 'From `change-recovery`.'),
+    username: doc(asString, 'The account name.'),
+    answers: doc(asArray(asString), 'In the same order as the questions.'),
+    ...loginOptionFields
+  }).withRest,
+  returns: doc(asSession, 'A session with `loginMethod: "recovery"`.'),
+  errors: ['PASSWORD_ERROR', 'USERNAME_ERROR', 'NETWORK_ERROR'],
+
+  async handler(ctx) {
+    const account: EdgeAccount =
+      await ctx.state.core.context.loginWithRecovery2(
+        ctx.body.recoveryKey,
+        ctx.body.username,
+        ctx.body.answers,
+        accountOptions(ctx.body)
+      )
+    return await ctx.state.sessions.create(account, 'recovery')
+  }
+})
+
+/**
+ * Create an account.
+ *
+ * Every credential is optional over REST: omitting all three creates a light
+ * account with no username.
+ *
+ * @note The command requires a username, password and PIN. Creating a light
+ *   account is REST-only.
+ */
+export const createAccount = route({
+  core: 'context.createAccount',
+  method: 'POST',
+  path: '/create-account',
+  cli: {
+    command: 'create-account',
+    custom: true
+  },
+  body: asObject({
+    username: asOptional(doc(asString, 'The name to claim.')),
+    password: asOptional(doc(asString, 'The account password.')),
+    pin: asOptional(doc(asString, 'A device PIN to save.')),
+    ...loginOptionFields
+  }).withRest,
+  returns: doc(asSession, 'A session with `loginMethod: "create"`.'),
+  errors: [
+    'USERNAME_ERROR',
+    'CHALLENGE_REQUIRED',
+    'BAD_REQUEST',
+    'NETWORK_ERROR'
+  ],
+
+  async handler(ctx) {
+    const account: EdgeAccount = await ctx.state.core.context.createAccount({
+      ...accountOptions(ctx.body),
+      username: ctx.body.username,
+      password: ctx.body.password,
+      pin: ctx.body.pin
+    })
+    return await ctx.state.sessions.create(account, 'create')
+  }
+})
+
+/**
+ * Start a QR login.
+ *
+ * Asks the login server for a lobby another logged-in Edge device can approve.
+ * The returned `lobbyId` is what goes in the QR code.
+ *
+ * @note The pending login is an object handle with a 5 minute TTL. On expiry
+ *   the engine cancels the request on the login server for you.
+ */
+export const requestEdgeLogin = route({
+  core: 'context.requestEdgeLogin',
+  method: 'POST',
+  path: '/request-edge-login',
+  cli: {
+    command: 'request-edge-login',
+    custom: true,
+    extra: {
+      noWait: {
+        kind: 'boolean',
+        doc: 'Print the lobby and exit instead of polling, so the QR can be displayed while `poll-edge-login` watches the same handle from another process.'
+      }
+    },
+    notes:
+      'Prints the pending login, then polls every 2s for up to 5 minutes. On `done` it stores the session. With `--no-wait` it returns immediately and `poll-edge-login` takes over.'
+  },
+  body: asObject({}).withRest,
+  returns: asPendingEdgeLogin,
+  errors: ['NETWORK_ERROR'],
+
+  async handler(ctx) {
+    const pending = await ctx.state.core.context.requestEdgeLogin({})
+    const record: PendingRecord = {
+      pendingId: '',
+      pending,
+      createdAt: Date.now()
+    }
+
+    const handle = ctx.state.objects.create({
+      kind: 'pendingLogin',
+      prefix: 'pending_',
+      value: record,
+      onExpire: async value => {
+        value.cancelled = true
+        try {
+          value.unwatchState?.()
+        } catch {
+          // best effort
+        }
+        pendingById.delete(value.pendingId)
+        try {
+          await value.pending.cancelRequest()
+        } catch {
+          // best effort
+        }
+      }
+    })
+    record.pendingId = handle.objectId
+    pendingById.set(handle.objectId, record)
+
+    record.unwatchState = pending.watch(
+      'state',
+      (state: EdgePendingEdgeLogin['state']) => {
+        if (state === 'done' && pending.account != null) {
+          const promise = ensureEdgeSession(record, ctx.state.sessions)
+          if (promise != null) {
+            promise.catch(() => {
+              // error already stored on record
+            })
+          }
+        } else if (state === 'error') {
+          const { error } = pending
+          record.error = error instanceof Error ? error.message : String(error)
+        }
+      }
+    )
+
+    return pendingSummary(record, handle.expiresAt)
+  }
+})
+
+/**
+ * Poll a pending QR login.
+ *
+ * Once `state` reaches `done` the engine has already created the session, so
+ * the response carries one ready to use.
+ *
+ * @note Session creation is attempted once. A failure is sticky, so later
+ *   polls report the same `error` rather than retrying.
+ * @note Polling does not extend the handle TTL; only the original 5 minute
+ *   window applies.
+ * @coreNote Engine state for an in-flight requestEdgeLogin; core exposes it as
+ *   EdgePendingEdgeLogin properties.
+ */
+export const pollEdgeLogin = route({
+  core: null,
+  method: 'GET',
+  path: '/pending-edge-login',
+  cli: {
+    command: 'poll-edge-login',
+    positional: 'pendingId',
+    // Hand-written: a poll that reaches `done` carries a session, and the
+    // command has to store it the way the other login commands do.
+    custom: true
+  },
+  returns: asPendingEdgeLogin,
+  errors: ['PENDING_LOGIN_NOT_FOUND', 'OBJECT_EXPIRED'],
+
+  async handler(ctx) {
+    let expiresAt: string | undefined
+    try {
+      const handle = ctx.state.objects.get<PendingRecord>(
+        ctx.params.pendingId,
+        'pendingLogin'
+      )
+      expiresAt = ctx.state.objects.toInfo(handle).expiresAt
+    } catch (error: unknown) {
+      // Fall through to map; may surface PENDING_LOGIN_NOT_FOUND below.
+      if (
+        error instanceof Error &&
+        'code' in error &&
+        (error as { code: string }).code === 'OBJECT_EXPIRED'
+      ) {
+        pendingById.delete(ctx.params.pendingId)
+        throw error
+      }
+    }
+    const record = getPending(ctx.params.pendingId)
+    if (
+      record.pending.state === 'done' &&
+      record.session == null &&
+      record.error == null &&
+      record.pending.account != null
+    ) {
+      try {
+        await ensureEdgeSession(record, ctx.state.sessions)
+      } catch {
+        // error already stored on record
+      }
+    }
+    return pendingSummary(record, expiresAt)
+  }
+})
+
+/**
+ * Cancel a pending QR login.
+ *
+ * @note If the login already completed and a session exists, that session is
+ *   force-logged-out too, so cancelling cannot leave an orphan visible in
+ *   `engine-sessions`.
+ */
+export const cancelEdgeLogin = route({
+  core: 'EdgePendingEdgeLogin.cancelRequest',
+  method: 'POST',
+  path: '/pending-edge-login/cancel-request',
+  cli: { command: 'cancel-request', positional: 'pendingId' },
+  errors: ['PENDING_LOGIN_NOT_FOUND'],
+
+  async handler(ctx) {
+    const record = getPending(ctx.params.pendingId)
+    record.cancelled = true
+    try {
+      record.unwatchState?.()
+    } catch {
+      // best effort
+    }
+    // A completed edge login may already have created a session before the
+    // caller cancelled. Tear it down so cancelling cannot leave a logged-in
+    // orphan discoverable via GET /engine/sessions.
+    if (record.session != null) {
+      try {
+        await ctx.state.sessions.forceLogout(
+          record.session.sessionId,
+          'cancelled'
+        )
+      } catch {
+        // best effort
+      }
+      record.session = undefined
+    }
+    await ctx.state.objects.delete(ctx.params.pendingId)
+    pendingById.delete(ctx.params.pendingId)
+    return undefined
+  }
+})
+
+/**
+ * List active sessions.
+ *
+ * @coreNote The session registry is an engine construct; core has no
+ *   multi-account session concept.
+ */
+export const engineSessions = route({
+  core: null,
+  method: 'GET',
+  path: '/engine/sessions',
+  cli: 'engine-sessions',
+  returns: doc(asArray(asSession), 'A bare array, not wrapped in a key.'),
+
+  handler(ctx) {
+    return ctx.state.sessions.list()
+  }
+})
diff --git a/src/cli/engine/routes/objects.ts b/src/cli/engine/routes/objects.ts
new file mode 100644
index 00000000000..717f608d498
--- /dev/null
+++ b/src/cli/engine/routes/objects.ts
@@ -0,0 +1,78 @@
+/**
+ * Ephemeral object handles.
+ *
+ * Core values with methods on them — a staged transaction, a swap quote, a
+ * pending login — cannot cross JSON, so the engine keeps them and hands back
+ * an id. These two calls read and release any of them, whatever kind it is.
+ */
+import { doc } from '../doc'
+import { engineError } from '../errors'
+import { route } from '../route'
+import { asObjectHandle, asOkObject } from '../schemas'
+
+/**
+ * Inspect an object handle.
+ *
+ * Works for every kind: transactions, pending logins, swap quotes.
+ *
+ * @note Reading does not extend the TTL. Only a step that updates the value
+ *   does.
+ * @coreNote Engine handle store; core identifies these values by object
+ *   reference.
+ */
+export const getObject = route({
+  core: null,
+  method: 'GET',
+  path: '/account/{sessionId}/object',
+  cli: { command: 'object-get', positional: 'objectId' },
+  returns: doc(
+    asObjectHandle,
+    'The handle fields, plus a `value` holding the live core object.'
+  ),
+  errors: ['OBJECT_NOT_FOUND', 'OBJECT_EXPIRED', 'OBJECT_SESSION_MISMATCH'],
+
+  handler(ctx) {
+    const record = ctx.state.objects.get(ctx.params.objectId)
+    if (record.sessionId != null && record.sessionId !== ctx.params.sessionId) {
+      throw engineError(
+        'OBJECT_SESSION_MISMATCH',
+        `objectId belongs to a different session`,
+        400
+      )
+    }
+    return {
+      ...ctx.state.objects.toInfo(record),
+      value: record.value
+    }
+  }
+})
+
+/**
+ * Release an object handle.
+ *
+ * Runs the handle's cleanup — closing a swap quote, cancelling a pending
+ * login — instead of waiting out the TTL.
+ *
+ * @coreNote Engine handle store.
+ */
+export const deleteObject = route({
+  core: null,
+  method: 'POST',
+  path: '/account/{sessionId}/object/delete',
+  cli: { command: 'object-delete', positional: 'objectId' },
+  returns: asOkObject,
+  errors: ['OBJECT_NOT_FOUND', 'OBJECT_EXPIRED', 'OBJECT_SESSION_MISMATCH'],
+
+  async handler(ctx) {
+    const record = ctx.state.objects.get(ctx.params.objectId)
+    if (record.sessionId != null && record.sessionId !== ctx.params.sessionId) {
+      throw engineError(
+        'OBJECT_SESSION_MISMATCH',
+        `objectId belongs to a different session`,
+        400
+      )
+    }
+    await ctx.state.objects.delete(ctx.params.objectId)
+    return { ok: true, objectId: ctx.params.objectId }
+  }
+})
diff --git a/src/cli/engine/routes/otp.ts b/src/cli/engine/routes/otp.ts
new file mode 100644
index 00000000000..19586bf9d10
--- /dev/null
+++ b/src/cli/engine/routes/otp.ts
@@ -0,0 +1,132 @@
+import {
+  asEither,
+  asNumber,
+  asObject,
+  asOptional,
+  asString,
+  asValue
+} from 'cleaners'
+
+import { doc } from '../doc'
+import { route } from '../route'
+import { getAccount } from './helpers'
+
+const OTP_KEY_DOC = 'The 2FA secret itself. Secret material — record it safely.'
+
+/**
+ * Read the 2FA secret and reset state.
+ *
+ * @coreNote Also carries account.otpResetDate.
+ */
+export const otpKey = route({
+  core: 'account.otpKey',
+  method: 'GET',
+  path: '/account/{sessionId}/otp-key',
+  cli: 'otp-key',
+  returns: asObject({
+    otpKey: doc(
+      asEither(asString, asValue(null)),
+      'Null when 2FA is off. ' + OTP_KEY_DOC
+    ),
+    otpResetDate: doc(
+      asEither(asString, asValue(null)),
+      'Set once somebody has requested a reset; cancel it with `cancel-otp-reset`.'
+    )
+  }),
+
+  handler(ctx) {
+    const account = getAccount(ctx)
+    return {
+      otpKey: account.otpKey ?? null,
+      otpResetDate: account.otpResetDate?.toISOString() ?? null
+    }
+  }
+})
+
+/**
+ * Enable 2FA.
+ *
+ * Record the returned key before leaving the terminal: it is the only copy.
+ */
+export const enableOtp = route({
+  core: 'account.enableOtp',
+  method: 'POST',
+  path: '/account/{sessionId}/enable-otp',
+  cli: 'enable-otp',
+  body: asObject({
+    timeout: asOptional(
+      doc(
+        asNumber,
+        'How long a reset request must wait before it completes. Core supplies the default when omitted.'
+      )
+    )
+  }).withRest,
+  returns: asObject({
+    otpKey: doc(
+      asEither(asString, asValue(null)),
+      'The new secret. ' + OTP_KEY_DOC
+    )
+  }),
+
+  async handler(ctx) {
+    const account = getAccount(ctx)
+    await account.enableOtp(ctx.body.timeout)
+    return { otpKey: account.otpKey ?? null }
+  }
+})
+
+/**
+ * Disable 2FA.
+ *
+ * Logins stop requiring a code immediately.
+ */
+export const disableOtp = route({
+  core: 'account.disableOtp',
+  method: 'POST',
+  path: '/account/{sessionId}/disable-otp',
+  cli: 'disable-otp',
+
+  async handler(ctx) {
+    await getAccount(ctx).disableOtp()
+    return undefined
+  }
+})
+
+/**
+ * Cancel a pending 2FA reset.
+ *
+ * The defence against somebody else requesting a reset on your account: as
+ * long as you cancel before the timer runs out, their reset never lands.
+ */
+export const cancelOtpReset = route({
+  core: 'account.cancelOtpReset',
+  method: 'POST',
+  path: '/account/{sessionId}/cancel-otp-reset',
+  cli: 'cancel-otp-reset',
+
+  async handler(ctx) {
+    await getAccount(ctx).cancelOtpReset()
+    return undefined
+  }
+})
+
+/**
+ * Re-point the account at a known 2FA secret.
+ *
+ * For a device whose stored secret has drifted from the server's.
+ */
+export const repairOtp = route({
+  core: 'account.repairOtp',
+  method: 'POST',
+  path: '/account/{sessionId}/repair-otp',
+  cli: 'repair-otp',
+  body: asObject({
+    otpKey: doc(asString, 'The secret the account should use.')
+  }).withRest,
+  errors: ['OTP_REQUIRED', 'BAD_REQUEST'],
+
+  async handler(ctx) {
+    await getAccount(ctx).repairOtp(ctx.body.otpKey)
+    return undefined
+  }
+})
diff --git a/src/cli/engine/routes/rates.ts b/src/cli/engine/routes/rates.ts
new file mode 100644
index 00000000000..44b9ff6a609
--- /dev/null
+++ b/src/cli/engine/routes/rates.ts
@@ -0,0 +1,249 @@
+import { asArray, asNumber, asObject, asOptional, asString } from 'cleaners'
+import type { EdgeFetchFunction, EdgeTokenId } from 'edge-core-js'
+
+import {
+  getHistoricalCryptoRate,
+  getHistoricalFiatRate
+} from '../../../util/exchangeRates'
+import { doc } from '../doc'
+import { engineError } from '../errors'
+import { route } from '../route'
+import { asTokenId } from '../schemas'
+
+const DEFAULT_MULTIPLIERS: Record<string, string> = {
+  bitcoin: '100000000',
+  ethereum: '1000000000000000000',
+  bitcoincash: '100000000',
+  litecoin: '100000000',
+  dogecoin: '100000000'
+}
+
+const nodeFetch: EdgeFetchFunction = async (uri, opts) =>
+  await fetch(uri, opts as RequestInit)
+
+function displayToNative(displayAmount: string, multiplier: string): string {
+  const [whole, frac = ''] = displayAmount.split('.')
+  const decimals = multiplier.replace(/^1/, '').length
+  const fracPadded = (frac + '0'.repeat(decimals)).slice(0, decimals)
+  const stripped = `${whole}${fracPadded}`.replace(/^0+(?=\d)/, '')
+  const combined = stripped !== '' ? stripped : '0'
+  const digits = combined.replace(/\D/g, '')
+  return digits !== '' ? digits : '0'
+}
+
+function parseTokenId(value: unknown): EdgeTokenId {
+  if (value === undefined || value === null || value === 'null') return null
+  if (typeof value === 'string') return value
+  if (typeof value === 'number' || typeof value === 'boolean') {
+    return String(value)
+  }
+  throw engineError('BAD_REQUEST', 'tokenId must be a string or null', 400)
+}
+
+const TARGET_FIAT_DOC = 'ISO 4217 code to price against. Defaults to `iso:USD`.'
+const DATE_DOC =
+  'ISO-8601. Omitted, the current time is sent to the rates server.'
+
+const asCryptoQuery = asObject({
+  pluginId: doc(asString, 'Which chain, e.g. `bitcoin`.'),
+  tokenId: asOptional(doc(asTokenId, 'Defaults to the native asset.')),
+  targetFiat: asOptional(doc(asString, TARGET_FIAT_DOC)),
+  date: asOptional(doc(asString, DATE_DOC))
+}).withRest
+
+const asFiatQuery = asObject({
+  fiatCode: doc(asString, 'The fiat to price, e.g. `EUR`.'),
+  targetFiat: asOptional(doc(asString, TARGET_FIAT_DOC)),
+  date: asOptional(doc(asString, DATE_DOC))
+}).withRest
+
+/**
+ * Batch crypto and fiat rate lookups.
+ *
+ * Concurrent lookups share one rates-server queue, so asking for many rates at
+ * once costs a single upstream request.
+ *
+ * @note A rate the server cannot supply comes back as `0` rather than an
+ *   error, so check for zero before dividing.
+ * @coreNote GUI code (src/util/exchangeRates): getHistoricalCryptoRate and
+ *   getHistoricalFiatRate.
+ */
+export const ratesQuery = route({
+  core: null,
+  method: 'POST',
+  path: '/rates/query',
+  cli: 'rates-query',
+  body: asObject({
+    crypto: asOptional(doc(asArray(asCryptoQuery), 'Crypto rates to fetch.')),
+    fiat: asOptional(doc(asArray(asFiatQuery), 'Fiat rates to fetch.'))
+  }).withRest,
+  returns: asObject({
+    crypto: doc(
+      asArray(
+        asObject({
+          pluginId: asString,
+          tokenId: asTokenId,
+          targetFiat: asString,
+          date: doc(asString, 'The timestamp actually queried.'),
+          rate: asNumber
+        })
+      ),
+      'Always present; empty when no crypto rates were requested.'
+    ),
+    fiat: doc(
+      asArray(
+        asObject({
+          fiatCode: asString,
+          targetFiat: asString,
+          date: asString,
+          rate: asNumber
+        })
+      ),
+      'Always present; empty when no fiat rates were requested.'
+    )
+  }),
+  errors: ['BAD_REQUEST', 'NETWORK_ERROR'],
+
+  async handler(ctx) {
+    const cryptoRaw = ctx.body.crypto
+    const fiatRaw = ctx.body.fiat
+    if (
+      (cryptoRaw == null || cryptoRaw.length === 0) &&
+      (fiatRaw == null || fiatRaw.length === 0)
+    ) {
+      throw engineError(
+        'BAD_REQUEST',
+        'Provide at least one crypto or fiat rate query',
+        400
+      )
+    }
+    const now = new Date().toISOString()
+
+    const crypto = await Promise.all(
+      (cryptoRaw ?? []).map(async item => {
+        const tokenId = parseTokenId(item.tokenId)
+        const targetFiat = item.targetFiat ?? 'iso:USD'
+        const date = item.date ?? now
+        const rate = await getHistoricalCryptoRate(
+          item.pluginId,
+          tokenId,
+          targetFiat,
+          date,
+          undefined,
+          nodeFetch
+        )
+        return { pluginId: item.pluginId, tokenId, targetFiat, date, rate }
+      })
+    )
+
+    const fiat = await Promise.all(
+      (fiatRaw ?? []).map(async item => {
+        const targetFiat = item.targetFiat ?? 'iso:USD'
+        const date = item.date ?? now
+        const rate = await getHistoricalFiatRate(
+          item.fiatCode,
+          targetFiat,
+          date,
+          undefined,
+          nodeFetch
+        )
+        return { fiatCode: item.fiatCode, targetFiat, date, rate }
+      })
+    )
+
+    return { crypto, fiat }
+  }
+})
+
+/**
+ * Convert a USD amount into native units.
+ *
+ * Turns a fiat notional into the native amount a spend needs.
+ *
+ * @note `displayAmount` is rounded to 8 decimals before conversion, so assets
+ *   with finer precision lose the tail. For an exact figure use `rates-query`
+ *   and do the arithmetic yourself.
+ * @note Default multipliers cover bitcoin, ethereum, bitcoincash, litecoin and
+ *   dogecoin; pass `multiplier` explicitly for anything else.
+ * @coreNote GUI code (src/util/exchangeRates): getHistoricalCryptoRate.
+ */
+export const ratesUsdToNative = route({
+  core: null,
+  method: 'POST',
+  path: '/rates/usd-to-native',
+  cli: 'rates-usd-to-native',
+  body: asObject({
+    usdAmount: doc(
+      asString,
+      'A string, which must parse to a positive finite number.'
+    ),
+    pluginId: doc(asString, 'Which chain to price.'),
+    tokenId: asOptional(doc(asTokenId, 'Defaults to the native asset.')),
+    multiplier: asOptional(
+      doc(asString, 'Native units per whole coin. Defaults per plugin.')
+    ),
+    date: asOptional(doc(asString, DATE_DOC))
+  }).withRest,
+  returns: asObject({
+    usdAmount: doc(
+      asNumber,
+      'Echoed as a number, though it is sent as a string.'
+    ),
+    pluginId: doc(asString, 'Currency plugin the amount was converted for.'),
+    tokenId: doc(
+      asTokenId,
+      'The asset, or null for the chain\u2019s own coin.'
+    ),
+    multiplier: doc(
+      asString,
+      'Native units per whole coin, which is what the conversion divided by.'
+    ),
+    date: doc(asString, 'The timestamp actually used for the rate.'),
+    rate: doc(asNumber, 'USD per whole coin at that date.'),
+    displayAmount: doc(asString, 'Whole coins, to 8 decimal places.'),
+    nativeAmount: doc(asString, 'What a spend actually takes.')
+  }),
+  errors: ['BAD_REQUEST', 'NOT_FOUND', 'NETWORK_ERROR'],
+
+  async handler(ctx) {
+    const usdAmount = Number(ctx.body.usdAmount)
+    if (!(usdAmount > 0) || !Number.isFinite(usdAmount)) {
+      throw engineError(
+        'BAD_REQUEST',
+        'usdAmount must be a positive number',
+        400
+      )
+    }
+    const { pluginId } = ctx.body
+    const tokenId = parseTokenId(ctx.body.tokenId)
+    const multiplier =
+      ctx.body.multiplier ?? DEFAULT_MULTIPLIERS[pluginId] ?? '100000000'
+    const date = ctx.body.date ?? new Date().toISOString()
+    const rate = await getHistoricalCryptoRate(
+      pluginId,
+      tokenId,
+      'iso:USD',
+      date,
+      undefined,
+      nodeFetch
+    )
+    if (!(rate > 0)) {
+      throw engineError(
+        'NOT_FOUND',
+        `No USD rate for ${pluginId}/${String(tokenId)}`,
+        404
+      )
+    }
+    const displayAmount = (usdAmount / rate).toFixed(8)
+    return {
+      usdAmount,
+      pluginId,
+      tokenId,
+      multiplier,
+      date,
+      rate,
+      displayAmount,
+      nativeAmount: displayToNative(displayAmount, multiplier)
+    }
+  }
+})
diff --git a/src/cli/engine/routes/spend.ts b/src/cli/engine/routes/spend.ts
new file mode 100644
index 00000000000..d031c356f5f
--- /dev/null
+++ b/src/cli/engine/routes/spend.ts
@@ -0,0 +1,750 @@
+import { asBoolean, asObject, asOptional, asString } from 'cleaners'
+import type {
+  EdgeCurrencyWallet,
+  EdgeMemo,
+  EdgeMetadata,
+  EdgeSpendInfo,
+  EdgeSpendTarget,
+  EdgeTransaction
+} from 'edge-core-js'
+
+import { saveTxAndMetadata } from '../../../util/txTagging'
+import { doc } from '../doc'
+import { engineError } from '../errors'
+import type { ObjectHandleInfo } from '../objectHandles'
+import { findWallet, parseTokenId } from '../resolve'
+import { route } from '../route'
+import type { RouteContext } from '../router'
+import {
+  asCoreValue,
+  asOkObject,
+  asTokenId,
+  asTransactionHandle,
+  asWalletId
+} from '../schemas'
+import { getAccount, optionalBoolean, optionalString } from './helpers'
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return value != null && typeof value === 'object' && !Array.isArray(value)
+}
+
+/** The cleaned body, still carrying whatever `.withRest` let through. */
+type SpendBody = Record<string, unknown>
+
+function asMetadata(value: unknown): EdgeMetadata | undefined {
+  if (!isPlainObject(value)) return undefined
+  return value as EdgeMetadata
+}
+
+function mergeMetadata(
+  base: EdgeMetadata | undefined,
+  overlay: EdgeMetadata | undefined
+): EdgeMetadata | undefined {
+  if (base == null && overlay == null) return undefined
+  const merged = { ...base, ...overlay }
+  return Object.keys(merged).length > 0 ? merged : undefined
+}
+
+async function buildSpendInfo(
+  wallet: EdgeCurrencyWallet,
+  body: Record<string, unknown>,
+  opts: { requireAmount: boolean }
+): Promise<EdgeSpendInfo> {
+  const bodyMetadata = asMetadata(body.metadata)
+
+  if (isPlainObject(body.spendInfo)) {
+    const spendInfo = { ...(body.spendInfo as unknown as EdgeSpendInfo) }
+    const metadata = mergeMetadata(spendInfo.metadata, bodyMetadata)
+    if (metadata != null) spendInfo.metadata = metadata
+    return spendInfo
+  }
+
+  const tokenId = parseTokenId(optionalString(body, 'tokenId'))
+  const to = optionalString(body, 'to')
+  const amount =
+    optionalString(body, 'nativeAmount') ?? optionalString(body, 'amount')
+  const spendTargets: EdgeSpendTarget[] = []
+  let metadata = bodyMetadata
+  let memos: EdgeMemo[] | undefined
+
+  if (to != null) {
+    let parsed
+    try {
+      parsed = await wallet.parseUri(to)
+    } catch (error: unknown) {
+      const message = error instanceof Error ? error.message : String(error)
+      throw engineError(
+        'BAD_REQUEST',
+        `Could not parse destination: ${message}`,
+        400
+      )
+    }
+    if (parsed.publicAddress == null || parsed.publicAddress === '') {
+      throw engineError(
+        'BAD_REQUEST',
+        parsed.paymentProtocolUrl != null
+          ? 'Payment protocol URIs are not supported on convenience spend; use GET .../payment-protocol'
+          : 'Destination did not contain a public address',
+        400
+      )
+    }
+    const nativeAmount = amount ?? parsed.nativeAmount
+    if (opts.requireAmount && nativeAmount == null) {
+      throw engineError(
+        'BAD_REQUEST',
+        'Missing required field "nativeAmount" or "amount"',
+        400
+      )
+    }
+    spendTargets.push({
+      publicAddress: parsed.publicAddress,
+      nativeAmount
+    })
+    if (parsed.uniqueIdentifier != null) {
+      memos = [{ type: 'text', value: parsed.uniqueIdentifier }]
+    }
+    metadata = mergeMetadata(parsed.metadata, bodyMetadata)
+  }
+
+  const spendInfo: EdgeSpendInfo = { tokenId, spendTargets }
+  if (metadata != null) spendInfo.metadata = metadata
+  if (memos != null) spendInfo.memos = memos
+  return spendInfo
+}
+
+function storeTransaction(
+  ctx: RouteContext,
+  opts: {
+    sessionId: string
+    walletId: string
+    transaction: EdgeTransaction
+  }
+): ObjectHandleInfo & { transaction: EdgeTransaction } {
+  const handle = ctx.state.objects.create({
+    kind: 'transaction',
+    prefix: 'tx_',
+    value: opts.transaction,
+    sessionId: opts.sessionId,
+    walletId: opts.walletId
+  })
+  return {
+    objectId: handle.objectId,
+    kind: handle.kind,
+    expiresAt: handle.expiresAt,
+    sessionId: handle.sessionId,
+    walletId: handle.walletId,
+    transaction: opts.transaction
+  }
+}
+
+function requireTxHandle(
+  ctx: RouteContext,
+  body: Record<string, unknown>,
+  walletId: string
+): { objectId: string; transaction: EdgeTransaction } {
+  const objectId = optionalString(body, 'objectId')
+  if (objectId == null) {
+    throw engineError(
+      'BAD_REQUEST',
+      'Missing required field "objectId" (from make-spend / prior step)',
+      400
+    )
+  }
+  const record = ctx.state.objects.get<EdgeTransaction>(objectId, 'transaction')
+  if (record.walletId != null && record.walletId !== walletId) {
+    throw engineError(
+      'OBJECT_WALLET_MISMATCH',
+      `objectId ${objectId} belongs to a different wallet`,
+      400
+    )
+  }
+  if (record.sessionId != null && record.sessionId !== ctx.params.sessionId) {
+    throw engineError(
+      'OBJECT_SESSION_MISMATCH',
+      `objectId ${objectId} belongs to a different session`,
+      400
+    )
+  }
+  return { objectId, transaction: record.value }
+}
+
+/**
+ * The wallet and transaction behind a `tx_` handle.
+ *
+ * A handle records the wallet it was staged against, so the later steps do
+ * not ask for it again: `make-spend` names a wallet, and everything after it
+ * names the handle. The session check still runs, so one session cannot
+ * advance another's transaction.
+ */
+function stagedTx(
+  ctx: RouteContext,
+  objectId: string
+): {
+  objectId: string
+  wallet: EdgeCurrencyWallet
+  transaction: EdgeTransaction
+} {
+  const record = ctx.state.objects.get<EdgeTransaction>(objectId, 'transaction')
+  if (record.sessionId != null && record.sessionId !== ctx.params.sessionId) {
+    throw engineError(
+      'OBJECT_SESSION_MISMATCH',
+      `objectId ${objectId} belongs to a different session`,
+      400
+    )
+  }
+  if (record.walletId == null) {
+    throw engineError(
+      'OBJECT_WALLET_MISMATCH',
+      `objectId ${objectId} is not bound to a wallet`,
+      400
+    )
+  }
+  return {
+    objectId,
+    wallet: findWallet(getAccount(ctx), record.walletId),
+    transaction: record.value
+  }
+}
+
+function txHandleResponse(
+  ctx: RouteContext,
+  objectId: string,
+  transaction: EdgeTransaction
+): ObjectHandleInfo & { transaction: EdgeTransaction } {
+  const info = ctx.state.objects.update(objectId, transaction)
+  return {
+    ...info,
+    transaction
+  }
+}
+
+const WALLET_ERRORS = ['WALLET_NOT_FOUND', 'AMBIGUOUS_WALLET_ID']
+const HANDLE_ERRORS = [
+  'OBJECT_NOT_FOUND',
+  'OBJECT_EXPIRED',
+  'OBJECT_KIND_MISMATCH',
+  'OBJECT_WALLET_MISMATCH',
+  'OBJECT_SESSION_MISMATCH'
+]
+
+/**
+ * Largest sendable amount.
+ *
+ * What empties the wallet after fees. A destination is still required, since
+ * fees depend on it.
+ */
+export const getMaxSpendable = route({
+  core: 'wallet.getMaxSpendable',
+  coreExtra: {
+    to:
+      'Shorthand the engine expands into `spendTargets`, so a one-output ' +
+      'send needs no nested JSON.',
+    nativeAmount: 'Amount for the `to` shorthand, in the smallest unit.',
+    amount: 'Amount for the `to` shorthand, in whole coins.'
+  },
+  method: 'POST',
+  path: '/account/{sessionId}/wallet/get-max-spendable',
+  cli: 'get-max-spendable',
+  body: asObject({
+    walletId: asWalletId,
+    spendInfo: asOptional(
+      doc(asCoreValue, 'A full `EdgeSpendInfo`, used as-is when present.')
+    ),
+    to: asOptional(
+      doc(asString, 'Address or BIP21 URI, run through `wallet.parseUri`.')
+    ),
+    nativeAmount: asOptional(doc(asString, 'How much, in native units.')),
+    amount: asOptional(doc(asString, 'Alias of `nativeAmount`.')),
+    tokenId: asOptional(doc(asTokenId, 'Defaults to the native asset.')),
+    metadata: asOptional(
+      doc(asCoreValue, 'Wins over anything parsed out of the URI.')
+    )
+  }).withRest,
+  returns: asObject({
+    nativeAmount: doc(asString, 'The most this wallet can send.')
+  }),
+  errors: [
+    'INSUFFICIENT_FUNDS',
+    'BAD_REQUEST',
+    'NETWORK_ERROR',
+    ...WALLET_ERRORS
+  ],
+
+  async handler(ctx) {
+    const body = ctx.body as SpendBody
+    const wallet = findWallet(getAccount(ctx), ctx.body.walletId)
+    const spendInfo = await buildSpendInfo(wallet, body, {
+      requireAmount: false
+    })
+    const nativeAmount = await wallet.getMaxSpendable(spendInfo)
+    return { nativeAmount }
+  }
+})
+
+/**
+ * Send funds.
+ *
+ * `makeSpend`, then `signTx`, then optionally `broadcastTx` and `saveTx`, in
+ * one request. `broadcast` and `save` both default to true, so a bare body
+ * with a destination and an amount moves real money. A completed spend leaves
+ * no handle behind.
+ *
+ * @note BIP21 `label` and `message` from `to` become metadata name and notes.
+ *   An explicit `metadata` object wins.
+ * @note `saveError` is the case to handle. Once broadcast, the money is gone,
+ *   so a failure inside saveTx cannot throw — it would hide the txid of a real
+ *   payment. The response is 200 with the transaction plus `saveError`.
+ * @note With `dryRun`, only makeSpend runs and the response is a transaction
+ *   handle that expires in 5 minutes.
+ * @coreNote GUI composite: makeSpend, signTx, broadcastTx and saveTx together.
+ */
+export const spend = route({
+  core: null,
+  method: 'POST',
+  path: '/account/{sessionId}/wallet/spend',
+  cli: [
+    { command: 'spend' },
+    {
+      command: 'spend-max',
+      preset: { useMax: true },
+      notes: 'The same route with `useMax` preset, so it sends everything.'
+    }
+  ],
+  body: asObject({
+    walletId: asWalletId,
+    spendInfo: asOptional(
+      doc(asCoreValue, 'A full `EdgeSpendInfo`, used as-is when present.')
+    ),
+    to: asOptional(
+      doc(asString, 'Address or BIP21 URI, run through `wallet.parseUri`.')
+    ),
+    nativeAmount: asOptional(doc(asString, 'How much, in native units.')),
+    amount: asOptional(doc(asString, 'Alias of `nativeAmount`.')),
+    tokenId: asOptional(doc(asTokenId, 'Defaults to the native asset.')),
+    metadata: asOptional(
+      doc(asCoreValue, 'Wins over anything parsed out of the URI.')
+    ),
+    useMax: asOptional(
+      doc(asBoolean, "Replace the first target's amount with the maximum.")
+    ),
+    dryRun: asOptional(
+      doc(asBoolean, 'Build only. Never signs or broadcasts.')
+    ),
+    broadcast: asOptional(doc(asBoolean, 'Defaults to **true**.')),
+    save: asOptional(doc(asBoolean, 'Defaults to **true**.'))
+  }).withRest,
+  returns: doc(
+    asCoreValue,
+    '`{ transaction }`, plus `saveError` when the broadcast succeeded but saving failed. With dryRun, a TransactionHandle instead.'
+  ),
+  errors: [
+    'INSUFFICIENT_FUNDS',
+    'DUST_SPEND',
+    'PENDING_FUNDS',
+    'SPEND_TO_SELF',
+    'NO_AMOUNT_SPECIFIED',
+    'BAD_REQUEST',
+    'NETWORK_ERROR',
+    ...WALLET_ERRORS
+  ],
+
+  async handler(ctx) {
+    const body = ctx.body as SpendBody
+    const wallet = findWallet(getAccount(ctx), ctx.body.walletId)
+    const useMax = optionalBoolean(body, 'useMax') ?? false
+    const spendInfo = await buildSpendInfo(wallet, body, {
+      requireAmount: !useMax
+    })
+
+    if (useMax && spendInfo.spendTargets[0] != null) {
+      const nativeAmount = await wallet.getMaxSpendable(spendInfo)
+      spendInfo.spendTargets[0].nativeAmount = nativeAmount
+    }
+
+    const unsignedTx = await wallet.makeSpend(spendInfo)
+    const dryRun = optionalBoolean(body, 'dryRun') ?? false
+    if (dryRun) {
+      // Dry-run returns a handle so the caller can inspect fees, then the
+      // object expires (or they delete it) — nothing is signed/broadcast.
+      return storeTransaction(ctx, {
+        sessionId: ctx.params.sessionId,
+        walletId: ctx.body.walletId,
+        transaction: unsignedTx
+      })
+    }
+
+    const signedTx = await wallet.signTx(unsignedTx)
+    const broadcast = optionalBoolean(body, 'broadcast') ?? true
+    const save = optionalBoolean(body, 'save') ?? true
+
+    let finalTx: EdgeTransaction = signedTx
+    if (broadcast) finalTx = await wallet.broadcastTx(signedTx)
+
+    let saveError: string | undefined
+    if (save) {
+      const txToSave: EdgeTransaction = {
+        ...finalTx,
+        metadata: {
+          ...spendInfo.metadata,
+          ...finalTx.metadata
+        }
+      }
+      try {
+        await saveTxAndMetadata(wallet, txToSave)
+        finalTx = txToSave
+      } catch (error: unknown) {
+        // Once broadcast, the spend is real. Throwing here would deny the
+        // caller the txid of money that already left the wallet, so report
+        // the failure alongside the transaction instead.
+        if (!broadcast) throw error
+        saveError = error instanceof Error ? error.message : String(error)
+        ctx.state.logger.warn('saveTx failed after broadcast', {
+          walletId: ctx.body.walletId,
+          txid: finalTx.txid,
+          error: saveError
+        })
+      }
+    }
+
+    // Completed spends do not leave an engine-side handle.
+    return saveError == null
+      ? { transaction: finalTx }
+      : { transaction: finalTx, saveError }
+  }
+})
+
+/**
+ * Build an unsigned transaction.
+ *
+ * First step of the staged workflow: nothing is signed and no funds move.
+ * Inspect `transaction.networkFee` on the result before signing.
+ */
+export const makeSpend = route({
+  core: 'wallet.makeSpend',
+  coreExtra: {
+    to:
+      'Shorthand the engine expands into `spendTargets`, so a one-output ' +
+      'send needs no nested JSON.',
+    nativeAmount: 'Amount for the `to` shorthand, in the smallest unit.',
+    amount: 'Amount for the `to` shorthand, in whole coins.'
+  },
+  method: 'POST',
+  path: '/account/{sessionId}/wallet/make-spend',
+  cli: 'make-spend',
+  body: asObject({
+    walletId: asWalletId,
+    spendInfo: asOptional(
+      doc(asCoreValue, 'A full `EdgeSpendInfo`, used as-is when present.')
+    ),
+    to: asOptional(
+      doc(asString, 'Address or BIP21 URI, run through `wallet.parseUri`.')
+    ),
+    nativeAmount: asOptional(doc(asString, 'How much, in native units.')),
+    amount: asOptional(doc(asString, 'Alias of `nativeAmount`.')),
+    tokenId: asOptional(doc(asTokenId, 'Defaults to the native asset.')),
+    metadata: asOptional(
+      doc(asCoreValue, 'Wins over anything parsed out of the URI.')
+    )
+  }).withRest,
+  returns: asTransactionHandle,
+  errors: [
+    'INSUFFICIENT_FUNDS',
+    'DUST_SPEND',
+    'NO_AMOUNT_SPECIFIED',
+    'BAD_REQUEST',
+    ...WALLET_ERRORS
+  ],
+
+  async handler(ctx) {
+    const body = ctx.body as SpendBody
+    const wallet = findWallet(getAccount(ctx), ctx.body.walletId)
+    const spendInfo = await buildSpendInfo(wallet, body, {
+      requireAmount: true
+    })
+    const transaction = await wallet.makeSpend(spendInfo)
+    return storeTransaction(ctx, {
+      sessionId: ctx.params.sessionId,
+      walletId: ctx.body.walletId,
+      transaction
+    })
+  }
+})
+
+/**
+ * Sign a staged transaction.
+ *
+ * Keeps the same handle and pushes its expiry out another five minutes.
+ */
+export const signTx = route({
+  core: 'wallet.signTx',
+  method: 'POST',
+  path: '/account/{sessionId}/sign-tx',
+  cli: { command: 'sign-tx', positional: 'objectId' },
+  body: asObject({
+    objectId: doc(asString, 'From `make-spend`.')
+  }).withRest,
+  returns: asTransactionHandle,
+  errors: ['BAD_REQUEST', ...HANDLE_ERRORS],
+
+  async handler(ctx) {
+    const {
+      objectId,
+      wallet,
+      transaction: unsigned
+    } = stagedTx(ctx, ctx.body.objectId)
+    const transaction = await wallet.signTx(unsigned)
+    return txHandleResponse(ctx, objectId, transaction)
+  }
+})
+
+/**
+ * Broadcast a signed transaction.
+ *
+ * The irreversible step: once this returns, the funds have left the wallet.
+ *
+ * @note Broadcasting does not record the transaction locally. Follow with
+ *   `save-tx`, or it stays missing from history until a sync finds it.
+ */
+export const broadcastTx = route({
+  core: 'wallet.broadcastTx',
+  method: 'POST',
+  path: '/account/{sessionId}/broadcast-tx',
+  cli: { command: 'broadcast-tx', positional: 'objectId' },
+  body: asObject({
+    objectId: doc(asString, 'From `sign-tx`.')
+  }).withRest,
+  returns: doc(
+    asTransactionHandle,
+    'The handle survives, so `save-tx` can still run.'
+  ),
+  errors: ['BAD_REQUEST', 'NETWORK_ERROR', ...HANDLE_ERRORS],
+
+  async handler(ctx) {
+    const {
+      objectId,
+      wallet,
+      transaction: signed
+    } = stagedTx(ctx, ctx.body.objectId)
+    const transaction = await wallet.broadcastTx(signed)
+    return txHandleResponse(ctx, objectId, transaction)
+  }
+})
+
+/**
+ * Record a transaction and release its handle.
+ *
+ * Final step. The handle is gone afterwards, so a second call is a 404.
+ */
+export const saveTx = route({
+  core: 'wallet.saveTx',
+  method: 'POST',
+  path: '/account/{sessionId}/save-tx',
+  cli: { command: 'save-tx', positional: 'objectId' },
+  body: asObject({
+    objectId: doc(asString, 'The handle to persist and release.')
+  }).withRest,
+  returns: asOkObject,
+  errors: ['BAD_REQUEST', ...HANDLE_ERRORS],
+
+  async handler(ctx) {
+    const { objectId, wallet, transaction } = stagedTx(ctx, ctx.body.objectId)
+    await saveTxAndMetadata(wallet, transaction)
+    await ctx.state.objects.delete(objectId)
+    return { ok: true, objectId }
+  }
+})
+
+/**
+ * Fee-bump a pending transaction.
+ *
+ * Replace-by-fee, where the plugin supports it. Returns a new unsigned
+ * transaction to sign and broadcast.
+ *
+ * @note A plugin that cannot accelerate returns 400 rather than a null
+ *   transaction.
+ */
+export const accelerate = route({
+  core: 'wallet.accelerate',
+  coreExtra: {
+    transaction:
+      'Core names the parameter `tx`. Spelled out here to match the ' +
+      '`transaction` field every staged-transaction response returns.'
+  },
+  method: 'POST',
+  path: '/account/{sessionId}/wallet/accelerate',
+  cli: 'accelerate',
+  body: asObject({
+    walletId: asWalletId,
+    objectId: asOptional(doc(asString, 'Handle of the transaction to bump.')),
+    transaction: asOptional(doc(asCoreValue, 'Or the transaction itself.'))
+  }).withRest,
+  returns: doc(
+    asTransactionHandle,
+    'Given objectId the same handle is updated; given a transaction a new one is created.'
+  ),
+  errors: ['BAD_REQUEST', ...HANDLE_ERRORS, ...WALLET_ERRORS],
+
+  async handler(ctx) {
+    const body = ctx.body as SpendBody
+    const wallet = findWallet(getAccount(ctx), ctx.body.walletId)
+    const objectId = optionalString(body, 'objectId')
+    let source: EdgeTransaction
+    if (objectId != null) {
+      source = requireTxHandle(ctx, body, ctx.body.walletId).transaction
+    } else if (isPlainObject(body.transaction)) {
+      source = body.transaction as unknown as EdgeTransaction
+    } else {
+      throw engineError(
+        'BAD_REQUEST',
+        'Missing required field "objectId" or "transaction"',
+        400
+      )
+    }
+    const transaction = await wallet.accelerate(source)
+    if (transaction == null) {
+      throw engineError(
+        'BAD_REQUEST',
+        'Wallet could not accelerate this transaction',
+        400
+      )
+    }
+    if (objectId != null) {
+      return txHandleResponse(ctx, objectId, transaction)
+    }
+    return storeTransaction(ctx, {
+      sessionId: ctx.params.sessionId,
+      walletId: ctx.body.walletId,
+      transaction
+    })
+  }
+})
+
+/**
+ * Sweep private keys into this wallet.
+ *
+ * Builds a transaction moving everything from an external key. Returns an
+ * unsigned handle: sign, broadcast and save it like any staged spend.
+ */
+export const sweepPrivateKeys = route({
+  core: 'wallet.sweepPrivateKeys',
+  coreExtra: {
+    spendInfo:
+      'Core names this one `edgeSpendInfo` while `makeSpend` names the same ' +
+      'type `spendInfo`. Both are `spendInfo` here.'
+  },
+  method: 'POST',
+  path: '/account/{sessionId}/wallet/sweep-private-keys',
+  cli: 'sweep-private-keys',
+  body: asObject({
+    walletId: asWalletId,
+    spendInfo: doc(
+      asCoreValue,
+      'A full `EdgeSpendInfo`, with the keys to sweep in `privateKeys`.'
+    )
+  }).withRest,
+  returns: asTransactionHandle,
+  errors: [
+    'BAD_REQUEST',
+    'INSUFFICIENT_FUNDS',
+    'NETWORK_ERROR',
+    ...WALLET_ERRORS
+  ],
+
+  async handler(ctx) {
+    const body = ctx.body as SpendBody
+    const wallet = findWallet(getAccount(ctx), ctx.body.walletId)
+    if (!isPlainObject(body.spendInfo)) {
+      throw engineError(
+        'BAD_REQUEST',
+        'Missing required field "spendInfo"',
+        400
+      )
+    }
+    const transaction = await wallet.sweepPrivateKeys(
+      body.spendInfo as unknown as EdgeSpendInfo
+    )
+    return storeTransaction(ctx, {
+      sessionId: ctx.params.sessionId,
+      walletId: ctx.body.walletId,
+      transaction
+    })
+  }
+})
+
+/**
+ * Sign arbitrary bytes.
+ *
+ * Message signing and proof-of-ownership, for plugins that support it.
+ *
+ * @note Invalid base64 decodes to empty rather than erroring, so validate
+ *   before sending.
+ * @note Support is per plugin, and failures surface as `500 INTERNAL_ERROR`
+ *   from the plugin rather than as a typed error: litecoin answers
+ *   "litecoin doesn't support signBytes", and bitcoin requires
+ *   `otherParams.publicAddress` naming which address to sign with.
+ */
+export const signBytes = route({
+  core: 'wallet.signBytes',
+  coreExtra: {
+    bytes:
+      'Core takes a Uint8Array named `buf`. JSON cannot carry bytes, so this ' +
+      'is base64 text.'
+  },
+  method: 'POST',
+  path: '/account/{sessionId}/wallet/sign-bytes',
+  cli: 'sign-bytes',
+  body: asObject({
+    walletId: asWalletId,
+    bytes: asOptional(doc(asString, 'Base64. Defaults to empty when absent.')),
+    otherParams: asOptional(
+      doc(
+        asCoreValue,
+        'Plugin-specific options. Bitcoin needs `{ publicAddress }`; other ' +
+          'plugins take nothing, or refuse the call entirely.'
+      )
+    )
+  }).withRest,
+  returns: asObject({ signature: doc(asString, 'Base64.') }),
+  errors: ['BAD_REQUEST', ...WALLET_ERRORS],
+
+  async handler(ctx) {
+    const body = ctx.body as SpendBody
+    const wallet = findWallet(getAccount(ctx), ctx.body.walletId)
+    const bytes = new Uint8Array(
+      Buffer.from(optionalString(body, 'bytes') ?? '', 'base64')
+    )
+    const otherParams = isPlainObject(body.otherParams)
+      ? body.otherParams
+      : undefined
+    const signature = await wallet.signBytes(bytes, { otherParams })
+    return { signature }
+  }
+})
+
+/**
+ * Fetch a BIP70 payment request.
+ *
+ * Feed `spendTargets` from the result into `make-spend` to pay it.
+ */
+export const getPaymentProtocolInfo = route({
+  core: 'wallet.getPaymentProtocolInfo',
+  method: 'GET',
+  path: '/account/{sessionId}/wallet/get-payment-protocol-info',
+  cli: 'get-payment-protocol-info',
+  query: asObject({
+    walletId: asWalletId,
+    paymentProtocolUrl: doc(asString, 'The payment-request URL.')
+  }).withRest,
+  returns: doc(
+    asCoreValue,
+    '`EdgePaymentProtocolInfo`: domain, memo, merchant, nativeAmount, spendTargets.'
+  ),
+  errors: ['BAD_REQUEST', 'NETWORK_ERROR', ...WALLET_ERRORS],
+
+  async handler(ctx) {
+    const wallet = findWallet(getAccount(ctx), ctx.query.valid.walletId)
+    return await wallet.getPaymentProtocolInfo(
+      ctx.query.valid.paymentProtocolUrl
+    )
+  }
+})
diff --git a/src/cli/engine/routes/status.ts b/src/cli/engine/routes/status.ts
new file mode 100644
index 00000000000..1a50f952802
--- /dev/null
+++ b/src/cli/engine/routes/status.ts
@@ -0,0 +1,150 @@
+import {
+  asArray,
+  asBoolean,
+  asEither,
+  asNumber,
+  asObject,
+  asString,
+  asValue
+} from 'cleaners'
+
+import { getAppliedLocale } from '../../../locales/bootLocale'
+import { doc } from '../doc'
+import { route } from '../route'
+import { API_VERSION } from '../router'
+import { asOk } from '../schemas'
+
+const asEngineStatus = asObject({
+  pid: doc(asNumber, 'The daemon process, for `kill` when it will not stop.'),
+  apiVersion: doc(
+    asString,
+    'The API this engine speaks. A client refusing to talk to an older engine ' +
+      'checks this.'
+  ),
+  uptimeSeconds: doc(asNumber, 'How long the daemon has been running.'),
+  sessionCount: doc(asNumber, 'Logged-in accounts held open right now.'),
+  testMode: doc(asBoolean, 'True when pointed at the tester fleet.'),
+  idleShutdownAt: doc(
+    asEither(asString, asValue(null)),
+    'When the engine will exit for want of work. Null while a session or a ' +
+      'subscription is holding it open, and null when the timeout is disabled.'
+  ),
+  tcpPort: doc(
+    asEither(asNumber, asValue(null)),
+    'The loopback port, null unless started with `--tcp`.'
+  ),
+  socketPath: doc(asString, 'Unix socket the CLI connects to.'),
+  locale: doc(asString, 'Language tag the engine resolved at boot.'),
+  decimalSeparator: doc(asString, 'Decimal mark for that locale.'),
+  groupingSeparator: doc(asString, 'Thousands mark for that locale.')
+})
+
+const asEngineConfig = asObject({
+  appId: doc(asString, 'Application ID the engine was started with.'),
+  testMode: doc(
+    asBoolean,
+    'True when the engine is pointed at the tester fleet.'
+  ),
+  directory: doc(asString, 'Working directory holding the core data.'),
+  servers: doc(
+    asObject(asEither(asString, asArray(asString))),
+    'The URLs this engine talks to, keyed by role. `syncServer` is a list, ' +
+      'since core rotates across the sync fleet.'
+  ),
+  plugins: doc(asArray(asString), 'Plugin IDs the engine loaded, sorted.')
+})
+
+/**
+ * Engine liveness and summary.
+ *
+ * The readiness probe the client polls after auto-spawning the engine.
+ *
+ * @returns `idleShutdownAt` is null while a session or a subscription holds
+ *   the engine open, and `tcpPort` is null unless started with `--tcp`.
+ * @coreNote Engine lifecycle; the daemon is not part of the core API.
+ */
+export const engineStatus = route({
+  core: null,
+  method: 'GET',
+  path: '/engine/status',
+  cli: 'engine-status',
+  returns: asEngineStatus,
+  errors: ['ENGINE_SHUTTING_DOWN'],
+
+  handler(ctx) {
+    const { state } = ctx
+    const applied = getAppliedLocale()
+    return {
+      pid: process.pid,
+      apiVersion: API_VERSION,
+      uptimeSeconds: (Date.now() - state.startedAt) / 1000,
+      sessionCount: state.sessions.size,
+      testMode: state.core.testMode,
+      idleShutdownAt: state.idle.idleShutdownAt,
+      tcpPort: state.tcpPort,
+      socketPath: state.socketPath,
+      locale: applied.languageTag,
+      decimalSeparator: applied.decimalSeparator,
+      groupingSeparator: applied.groupingSeparator
+    }
+  }
+})
+
+/**
+ * Configured context options.
+ *
+ * What the engine passed to `makeEdgeContext`. Contains no secrets. Use it to
+ * assert tester hosts before a test run.
+ *
+ * @note Outside `-t` / `--test`, `servers` is an empty object — core is using
+ *   its built-in production defaults, so there is nothing to echo back.
+ * @coreNote Reflects the EdgeContextOptions the engine supplied at startup.
+ */
+export const engineConfig = route({
+  core: null,
+  method: 'GET',
+  path: '/engine/config',
+  cli: 'engine-config',
+  returns: asEngineConfig,
+
+  handler(ctx) {
+    const { core } = ctx.state
+    const plugins = Object.keys(core.pluginsInit).filter(pluginId =>
+      Boolean(core.pluginsInit[pluginId])
+    )
+    return {
+      appId: core.appId,
+      testMode: core.testMode,
+      directory: core.directory,
+      servers: core.servers,
+      plugins
+    }
+  }
+})
+
+/**
+ * Stop the engine.
+ *
+ * Logs out every session, closes the context, unlinks the socket and run-file,
+ * then exits. The engine answers before it starts tearing down, so a response
+ * is not proof the process is gone.
+ *
+ * @note In-flight callers may see `503 ENGINE_SHUTTING_DOWN` once teardown
+ *   starts.
+ * @coreNote Engine lifecycle. Internally calls `context.close()`.
+ */
+export const engineStop = route({
+  core: null,
+  method: 'POST',
+  path: '/engine/stop',
+  cli: 'engine-stop',
+  returns: asOk,
+
+  handler(ctx) {
+    // Respond first; process.exit inside shutdown would otherwise hang the client.
+    setImmediate(() => {
+      ctx.state.shutdown().catch(() => {})
+    })
+    return { ok: true }
+  }
+})
diff --git a/src/cli/engine/routes/swap.ts b/src/cli/engine/routes/swap.ts
new file mode 100644
index 00000000000..fce30a17f9f
--- /dev/null
+++ b/src/cli/engine/routes/swap.ts
@@ -0,0 +1,308 @@
+/**
+ * Swap quote / execute routes.
+ *
+ * Quotes are ephemeral object handles (`swap_` prefix, 5 min TTL). Approve
+ * consumes the handle; close/delete releases it early.
+ */
+import { asArray, asNumber, asObject, asOptional, asString } from 'cleaners'
+import type { EdgeSwapQuote, EdgeSwapRequest } from 'edge-core-js'
+
+import { doc } from '../doc'
+import { engineError } from '../errors'
+import { findWallet, parseTokenId } from '../resolve'
+import { route } from '../route'
+import { asCoreValue, asOkObject, asSwapQuote, asTokenId } from '../schemas'
+import { getAccount } from './helpers'
+
+function summarizeQuote(
+  objectId: string,
+  expiresAt: string,
+  quote: EdgeSwapQuote
+): Record<string, unknown> {
+  return {
+    objectId,
+    kind: 'swap',
+    expiresAt,
+    pluginId: quote.pluginId,
+    isEstimate: quote.isEstimate,
+    canBePartial: quote.canBePartial ?? null,
+    maxFulfillmentSeconds: quote.maxFulfillmentSeconds ?? null,
+    minReceiveAmount: quote.minReceiveAmount ?? null,
+    fromNativeAmount: quote.fromNativeAmount,
+    toNativeAmount: quote.toNativeAmount,
+    networkFee: {
+      nativeAmount: quote.networkFee.nativeAmount,
+      tokenId: quote.networkFee.tokenId
+    },
+    quoteExpirationDate: quote.expirationDate?.toISOString() ?? null,
+    swapInfo: {
+      pluginId: quote.swapInfo.pluginId,
+      displayName: quote.swapInfo.displayName,
+      supportEmail: quote.swapInfo.supportEmail,
+      isDex: quote.swapInfo.isDex ?? null
+    },
+    request: {
+      fromTokenId: quote.request.fromTokenId,
+      toTokenId: quote.request.toTokenId,
+      nativeAmount: quote.request.nativeAmount,
+      quoteFor: quote.request.quoteFor,
+      fromWalletId: quote.request.fromWallet.id,
+      toWalletId: quote.request.toWallet.id
+    }
+  }
+}
+
+/**
+ * Fetch swap quotes.
+ *
+ * Polls every enabled swap plugin and parks each result under its own `swap_`
+ * handle with a 5 minute TTL.
+ *
+ * @note Every returned quote holds an open plugin object. Approving one
+ *   releases only that handle; close the rest, or let them expire.
+ * @note An empty `quotes` array with `quoteCount: 0` is a success, not an
+ *   error — no plugin could serve the pair.
+ */
+export const fetchSwapQuotes = route({
+  core: 'account.fetchSwapQuotes',
+  coreExtra: {
+    fromWalletId: 'Core takes the wallet object; over HTTP it is an id.',
+    toWalletId: 'Core takes the wallet object; over HTTP it is an id.'
+  },
+  method: 'POST',
+  path: '/account/{sessionId}/fetch-swap-quotes',
+  cli: {
+    command: 'fetch-swap-quotes',
+    flags: { pluginId: { maps: 'preferPluginId' } }
+  },
+  body: asObject({
+    fromWalletId: doc(asString, 'Source wallet. Accepts a unique prefix.'),
+    toWalletId: doc(asString, 'Destination wallet.'),
+    nativeAmount: doc(asString, 'How much, in native units.'),
+    fromTokenId: asOptional(doc(asTokenId, 'Defaults to the native asset.')),
+    toTokenId: asOptional(doc(asTokenId, 'Defaults to the native asset.')),
+    quoteFor: asOptional(
+      doc(
+        asString,
+        '`from` spends this much of the source, `to` receives this much at the destination, `max` sends everything. Defaults to `from`.'
+      )
+    ),
+    preferPluginId: asOptional(doc(asString, 'Restrict to one exchange.'))
+  }).withRest,
+  returns: asObject({
+    quoteCount: doc(asNumber, 'How many plugins answered.'),
+    quotes: doc(
+      asArray(asSwapQuote),
+      'One quote per plugin that answered, each already parked under its own ' +
+        'handle. Plugins that failed or had nothing to offer are simply absent.'
+    )
+  }),
+  errors: [
+    'BAD_REQUEST',
+    'SWAP_BELOW_LIMIT',
+    'SWAP_ABOVE_LIMIT',
+    'SWAP_CURRENCY',
+    'SWAP_PERMISSION',
+    'SWAP_ADDRESS',
+    'SAME_CURRENCY',
+    'INSUFFICIENT_FUNDS',
+    'WALLET_NOT_FOUND',
+    'NETWORK_ERROR'
+  ],
+
+  async handler(ctx) {
+    const account = getAccount(ctx)
+    const fromWallet = findWallet(account, ctx.body.fromWalletId)
+    const toWallet = findWallet(account, ctx.body.toWalletId)
+    const fromTokenId = parseTokenId(ctx.body.fromTokenId ?? undefined)
+    const toTokenId = parseTokenId(ctx.body.toTokenId ?? undefined)
+    const { nativeAmount } = ctx.body
+    const quoteForRaw = ctx.body.quoteFor ?? 'from'
+    if (
+      quoteForRaw !== 'from' &&
+      quoteForRaw !== 'to' &&
+      quoteForRaw !== 'max'
+    ) {
+      throw engineError(
+        'BAD_REQUEST',
+        'quoteFor must be "from", "to", or "max"',
+        400
+      )
+    }
+    const quoteFor = quoteForRaw
+    const { preferPluginId } = ctx.body
+
+    const request: EdgeSwapRequest = {
+      fromWallet,
+      toWallet,
+      fromTokenId,
+      toTokenId,
+      nativeAmount,
+      quoteFor
+    }
+
+    const opts = preferPluginId != null ? { preferPluginId } : undefined
+
+    const quotes: EdgeSwapQuote[] = await account.fetchSwapQuotes(request, opts)
+
+    const results = []
+    for (const quote of quotes) {
+      const handle = ctx.state.objects.create({
+        kind: 'swap',
+        prefix: 'swap_',
+        value: quote,
+        sessionId: ctx.params.sessionId,
+        onExpire: async value => {
+          try {
+            await value.close()
+          } catch {
+            // best effort
+          }
+        }
+      })
+      results.push(summarizeQuote(handle.objectId, handle.expiresAt, quote))
+    }
+
+    return {
+      quoteCount: results.length,
+      quotes: results
+    }
+  }
+})
+
+/**
+ * Re-read a quote.
+ *
+ * @note Check `quoteExpirationDate` as well as `expiresAt`: the plugin's price
+ *   can go stale before the handle does.
+ * @coreNote Engine handle store; the quote is a live EdgeSwapQuote held
+ *   server-side.
+ */
+export const getSwapQuote = route({
+  core: null,
+  method: 'GET',
+  path: '/account/{sessionId}/swap-quote',
+  cli: { command: 'swap-quote-get', positional: 'objectId' },
+  returns: asSwapQuote,
+  errors: [
+    'OBJECT_NOT_FOUND',
+    'OBJECT_EXPIRED',
+    'OBJECT_KIND_MISMATCH',
+    'OBJECT_SESSION_MISMATCH'
+  ],
+
+  async handler(ctx) {
+    const record = ctx.state.objects.get<EdgeSwapQuote>(
+      ctx.params.objectId,
+      'swap'
+    )
+    if (record.sessionId != null && record.sessionId !== ctx.params.sessionId) {
+      throw engineError(
+        'OBJECT_SESSION_MISMATCH',
+        'objectId belongs to a different session',
+        400
+      )
+    }
+    const info = ctx.state.objects.toInfo(record)
+    return summarizeQuote(info.objectId, info.expiresAt, record.value)
+  }
+})
+
+/**
+ * Execute a quote.
+ *
+ * Moves funds. The handle is released afterwards whether or not the response
+ * is read, so record `orderId` from it.
+ *
+ * @note The plugin attaches its own savedAction and assetAction metadata; the
+ *   engine adds none.
+ */
+export const approveSwapQuote = route({
+  core: 'EdgeSwapQuote.approve',
+  method: 'POST',
+  path: '/account/{sessionId}/swap-quote/approve',
+  cli: { command: 'approve-swap-quote', positional: 'objectId' },
+  returns: asObject({
+    ok: doc(
+      asCoreValue,
+      'True once the swap is submitted and the send broadcast.'
+    ),
+    objectId: doc(asString, 'The handle that was consumed.'),
+    orderId: doc(
+      asCoreValue,
+      "The exchange's order reference, when it gives one."
+    ),
+    destinationAddress: doc(
+      asCoreValue,
+      'Address the funds were sent to, when the exchange reports one.'
+    ),
+    transaction: doc(asCoreValue, 'The on-chain send to the exchange.')
+  }),
+  errors: [
+    'OBJECT_NOT_FOUND',
+    'OBJECT_EXPIRED',
+    'OBJECT_KIND_MISMATCH',
+    'OBJECT_SESSION_MISMATCH',
+    'INSUFFICIENT_FUNDS',
+    'NETWORK_ERROR'
+  ],
+
+  async handler(ctx) {
+    const record = ctx.state.objects.get<EdgeSwapQuote>(
+      ctx.params.objectId,
+      'swap'
+    )
+    if (record.sessionId != null && record.sessionId !== ctx.params.sessionId) {
+      throw engineError(
+        'OBJECT_SESSION_MISMATCH',
+        'objectId belongs to a different session',
+        400
+      )
+    }
+    const result = await record.value.approve()
+    await ctx.state.objects.delete(ctx.params.objectId)
+    return {
+      ok: true,
+      objectId: ctx.params.objectId,
+      orderId: result.orderId ?? null,
+      destinationAddress: result.destinationAddress ?? null,
+      transaction: result.transaction
+    }
+  }
+})
+
+/**
+ * Discard a quote.
+ *
+ * Closes the plugin object without executing, freeing whatever the exchange
+ * was holding.
+ */
+export const closeSwapQuote = route({
+  core: 'EdgeSwapQuote.close',
+  method: 'POST',
+  path: '/account/{sessionId}/swap-quote/close',
+  cli: { command: 'close-swap-quote', positional: 'objectId' },
+  returns: asOkObject,
+  errors: [
+    'OBJECT_NOT_FOUND',
+    'OBJECT_EXPIRED',
+    'OBJECT_KIND_MISMATCH',
+    'OBJECT_SESSION_MISMATCH'
+  ],
+
+  async handler(ctx) {
+    const record = ctx.state.objects.get<EdgeSwapQuote>(
+      ctx.params.objectId,
+      'swap'
+    )
+    if (record.sessionId != null && record.sessionId !== ctx.params.sessionId) {
+      throw engineError(
+        'OBJECT_SESSION_MISMATCH',
+        'objectId belongs to a different session',
+        400
+      )
+    }
+    await ctx.state.objects.delete(ctx.params.objectId)
+    return { ok: true, objectId: ctx.params.objectId }
+  }
+})
diff --git a/src/cli/engine/routes/tokens.ts b/src/cli/engine/routes/tokens.ts
new file mode 100644
index 00000000000..8d0a30489a9
--- /dev/null
+++ b/src/cli/engine/routes/tokens.ts
@@ -0,0 +1,99 @@
+import { asArray, asObject, asString } from 'cleaners'
+
+import { doc } from '../doc'
+import { findWallet } from '../resolve'
+import { route } from '../route'
+import { asCoreValue, asEnabledTokens, asWalletId } from '../schemas'
+import { getAccount } from './helpers'
+
+/**
+ * List a wallet's tokens.
+ *
+ * "Enabled" tokens are the ones the wallet syncs balances for; "detected" ones
+ * were seen on-chain but are not yet enabled.
+ *
+ * @coreNote Engine composite of the EdgeCurrencyConfig token maps plus
+ *   wallet.enabledTokenIds and wallet.detectedTokenIds.
+ */
+export const walletTokens = route({
+  core: null,
+  method: 'GET',
+  path: '/account/{sessionId}/wallet/tokens',
+  cli: 'wallet-tokens',
+  query: asObject({ walletId: asWalletId }).withRest,
+  returns: asObject({
+    allTokens: doc(
+      asObject(asCoreValue),
+      'Built-in and custom together, keyed by tokenId. Large on EVM chains.'
+    ),
+    builtinTokens: doc(
+      asObject(asCoreValue),
+      '`EdgeToken` by tokenId: everything the plugin ships with.'
+    ),
+    customTokens: doc(
+      asObject(asCoreValue),
+      '`EdgeToken` by tokenId: tokens this account added by hand.'
+    ),
+    enabledTokenIds: doc(
+      asArray(asString),
+      'Which of the above the wallet is actually tracking.'
+    ),
+    detectedTokenIds: doc(
+      asArray(asString),
+      'Seen on-chain but not enabled, so their balances are not synced.'
+    )
+  }),
+  errors: ['WALLET_NOT_FOUND', 'AMBIGUOUS_WALLET_ID'],
+
+  handler(ctx) {
+    const wallet = findWallet(getAccount(ctx), ctx.query.valid.walletId)
+    return {
+      allTokens: wallet.currencyConfig.allTokens,
+      builtinTokens: wallet.currencyConfig.builtinTokens,
+      customTokens: wallet.currencyConfig.customTokens,
+      enabledTokenIds: wallet.enabledTokenIds,
+      detectedTokenIds: wallet.detectedTokenIds
+    }
+  }
+})
+
+/**
+ * Set the enabled token set.
+ *
+ * Absolute: anything missing from `tokenIds` is disabled. Core has only this
+ * setter, so there is no add or remove call.
+ *
+ * @note The command's `--add` and `--remove` are client-side sugar over this
+ *   one route, and cost an extra read first.
+ */
+export const changeEnabledTokenIds = route({
+  core: 'wallet.changeEnabledTokenIds',
+  method: 'POST',
+  path: '/account/{sessionId}/wallet/change-enabled-token-ids',
+  cli: {
+    command: 'change-enabled-token-ids',
+    custom: true,
+    extra: {
+      add: {
+        kind: 'repeat',
+        doc: 'Read the current set, add this id, write it back.'
+      },
+      remove: {
+        kind: 'repeat',
+        doc: 'Read the current set, drop this id, write it back.'
+      }
+    }
+  },
+  body: asObject({
+    walletId: asWalletId,
+    tokenIds: doc(asArray(asString), 'The complete desired set.')
+  }).withRest,
+  returns: asEnabledTokens,
+  errors: ['BAD_REQUEST', 'WALLET_NOT_FOUND', 'AMBIGUOUS_WALLET_ID'],
+
+  async handler(ctx) {
+    const wallet = findWallet(getAccount(ctx), ctx.body.walletId)
+    await wallet.changeEnabledTokenIds(ctx.body.tokenIds)
+    return { enabledTokenIds: wallet.enabledTokenIds }
+  }
+})
diff --git a/src/cli/engine/routes/transactions.ts b/src/cli/engine/routes/transactions.ts
new file mode 100644
index 00000000000..f172c34a21c
--- /dev/null
+++ b/src/cli/engine/routes/transactions.ts
@@ -0,0 +1,405 @@
+import { asNumber, asObject, asOptional, asString } from 'cleaners'
+import type {
+  EdgeAccount,
+  EdgeAssetAction,
+  EdgeCurrencyWallet,
+  EdgeMetadataChange,
+  EdgeTransaction,
+  EdgeTxAction
+} from 'edge-core-js'
+
+import { getExchangeDenom } from '../../../util/exchangeDenom'
+import {
+  exportTxInfoKey,
+  mergeExportTxInfo,
+  readExportTxInfoMap
+} from '../../../util/exportTxInfo'
+import { fillTxsFiat, toIsoFiatCode } from '../../../util/fillTxsFiat'
+import {
+  readDefaultIsoFiat,
+  resolveListSpamThreshold
+} from '../../../util/spamThreshold'
+import {
+  fillTxMetadataForDisplay,
+  getTxActionDisplayInfo
+} from '../../../util/txDisplay'
+import {
+  exportTransactionsToBitwave,
+  exportTransactionsToCSVInner,
+  exportTransactionsToQBO,
+  parseExportFormats,
+  type TxExportFormat
+} from '../../../util/txExport'
+import { doc } from '../doc'
+import { engineError } from '../errors'
+import { findWallet, parseTokenId } from '../resolve'
+import { route } from '../route'
+import {
+  asCoreValue,
+  asQueryDate,
+  asQueryInteger,
+  asQueryTokenId,
+  asTokenId,
+  asWalletId
+} from '../schemas'
+import { getAccount } from './helpers'
+
+/**
+ * Fill name/category/notes from the same merge the GUI list uses.
+ * Response-only — does not call saveTxMetadata.
+ */
+function overlayDisplayMetadata(
+  tx: EdgeTransaction,
+  account: EdgeAccount,
+  wallet: EdgeCurrencyWallet
+): EdgeTransaction {
+  const { mergedData } = getTxActionDisplayInfo(tx, account, wallet)
+  return fillTxMetadataForDisplay(tx, mergedData)
+}
+
+const TOKEN_ID_DOC = 'Defaults to the native asset.'
+
+/**
+ * List or export a wallet's transactions.
+ *
+ * Reads history, overlays the display metadata the GUI shows, fills historical
+ * fiat, and optionally formats the result — all on this one call.
+ *
+ * @note The metadata overlay and the fiat fill are response-only. Neither
+ *   writes to disk.
+ * @note `limit` and `offset` apply before the fiat fill, so a large page costs
+ *   proportionally more rates-server work.
+ * @note This is the one GET that can write: passing `bitwaveAccountId`
+ *   persists it to `exportTxInfo.json` on the wallet disklet.
+ * @returns Without `exportFormat`, the transactions themselves. With it, the
+ *   formatted files instead — the two shapes are mutually exclusive.
+ */
+export const getTransactions = route({
+  core: 'wallet.getTransactions',
+  coreExtra: {
+    limit: 'Engine-side paging; core returns every match.',
+    offset: 'Engine-side paging; core returns every match.',
+    fiat: 'Selects the currency the engine values each transaction in.',
+    exportFormat: 'Engine-side rendering to CSV, QBO or Bitwave.',
+    bitwaveAccountId: 'Required by the Bitwave export format.'
+  },
+  method: 'GET',
+  path: '/account/{sessionId}/wallet/get-transactions',
+  cli: {
+    command: 'get-transactions',
+    custom: true,
+    flags: { bitwaveAccount: { maps: 'bitwaveAccountId' } },
+    extra: {
+      out: {
+        kind: 'string',
+        requiredWith: 'exportFormat',
+        doc: 'Where to write the returned files. One format: the path. Several: a stem, plus .csv / .qbo / .bitwave.csv.'
+      }
+    }
+  },
+  query: asObject({
+    walletId: asWalletId,
+    tokenId: asOptional(doc(asQueryTokenId, TOKEN_ID_DOC), null),
+    limit: asOptional(
+      doc(
+        asQueryInteger,
+        'Omitting it returns every transaction from `offset` on.'
+      )
+    ),
+    offset: asOptional(
+      doc(asQueryInteger, 'Where to start. Defaults to 0.'),
+      0
+    ),
+    startDate: asOptional(doc(asQueryDate, 'ISO-8601, or epoch milliseconds.')),
+    endDate: asOptional(doc(asQueryDate, 'ISO-8601, or epoch milliseconds.')),
+    searchString: asOptional(
+      doc(asString, 'Matches payee, category, notes and txid.')
+    ),
+    spamThreshold: asOptional(
+      doc(
+        asString,
+        'Native-amount floor. Omitted, the account spam-filter setting applies; passing it always overrides.'
+      )
+    ),
+    fiat: asOptional(
+      doc(
+        asString,
+        'Three-letter ISO 4217 code. Defaults to the account defaultIsoFiat.'
+      )
+    ),
+    exportFormat: asOptional(
+      doc(asString, 'Comma list of `csv`, `qbo`, `bitwave`.')
+    ),
+    bitwaveAccountId: asOptional(
+      doc(asString, 'A 400 unless `exportFormat` includes `bitwave`.')
+    )
+  }).withRest,
+  returns: doc(
+    asCoreValue,
+    '`{ transactions, total, isoFiat }`, or `{ ok, isoFiat, total, files }` when exportFormat is set.'
+  ),
+  errors: [
+    'BAD_REQUEST',
+    'MISSING_BITWAVE_ACCOUNT_ID',
+    'WALLET_NOT_FOUND',
+    'AMBIGUOUS_WALLET_ID'
+  ],
+
+  async handler(ctx) {
+    const account = getAccount(ctx)
+    const wallet = findWallet(account, ctx.query.valid.walletId)
+    const { tokenId, startDate, endDate, searchString, limit, offset } =
+      ctx.query.valid
+    const spamThreshold = await resolveListSpamThreshold({
+      account,
+      wallet,
+      tokenId,
+      queryOverride: ctx.query.valid.spamThreshold
+    })
+
+    const fiatRaw = ctx.query.valid.fiat
+    let isoFiat: string
+    if (fiatRaw != null && fiatRaw !== '') {
+      const parsed = toIsoFiatCode(fiatRaw)
+      if (parsed == null) {
+        throw engineError(
+          'BAD_REQUEST',
+          'Query "fiat" must be a 3-letter currency code (e.g. USD)',
+          400
+        )
+      }
+      isoFiat = parsed
+    } else {
+      isoFiat = await readDefaultIsoFiat(account)
+    }
+
+    const transactions = await wallet.getTransactions({
+      tokenId,
+      startDate,
+      endDate,
+      searchString,
+      spamThreshold
+    })
+
+    const sliced =
+      limit == null
+        ? transactions.slice(offset)
+        : transactions.slice(offset, offset + limit)
+
+    const overlayed = sliced.map(tx =>
+      overlayDisplayMetadata(tx, account, wallet)
+    )
+    await fillTxsFiat({
+      wallet,
+      tokenId,
+      isoFiat,
+      txs: overlayed
+    })
+
+    const exportRaw = ctx.query.valid.exportFormat
+    let formats: TxExportFormat[]
+    try {
+      formats = parseExportFormats(exportRaw)
+    } catch (error: unknown) {
+      const message = error instanceof Error ? error.message : String(error)
+      throw engineError('BAD_REQUEST', message, 400)
+    }
+
+    const bitwaveAccountIdQuery = ctx.query.valid.bitwaveAccountId
+    if (bitwaveAccountIdQuery != null && !formats.includes('bitwave')) {
+      throw engineError(
+        'BAD_REQUEST',
+        'Query "bitwaveAccountId" requires exportFormat to include bitwave',
+        400
+      )
+    }
+
+    if (formats.length === 0) {
+      return {
+        transactions: overlayed,
+        total: transactions.length,
+        isoFiat
+      }
+    }
+
+    const denom = getExchangeDenom(wallet.currencyConfig, tokenId)
+    const currencyCode =
+      tokenId == null
+        ? wallet.currencyInfo.currencyCode
+        : wallet.currencyConfig.allTokens[tokenId]?.currencyCode ?? tokenId
+
+    let bitwaveAccountId: string | undefined
+    if (formats.includes('bitwave')) {
+      if (bitwaveAccountIdQuery != null && bitwaveAccountIdQuery !== '') {
+        bitwaveAccountId = bitwaveAccountIdQuery
+        await mergeExportTxInfo(wallet, tokenId, {
+          bitwaveAccountId,
+          isExportBitwave: true
+        })
+      } else {
+        let saved: string | undefined
+        try {
+          const map = await readExportTxInfoMap(wallet)
+          saved = map[exportTxInfoKey(wallet, tokenId)]?.bitwaveAccountId
+        } catch {
+          saved = undefined
+        }
+        if (saved == null || saved === '') {
+          throw engineError(
+            'MISSING_BITWAVE_ACCOUNT_ID',
+            'Bitwave export requires bitwaveAccountId (query or exportTxInfo.json)',
+            400
+          )
+        }
+        bitwaveAccountId = saved
+      }
+    }
+
+    const files: Array<{ format: TxExportFormat; contents: string }> = []
+    for (const format of formats) {
+      if (format === 'csv') {
+        files.push({
+          format,
+          contents: exportTransactionsToCSVInner(
+            overlayed,
+            currencyCode,
+            isoFiat,
+            denom.multiplier,
+            denom.name
+          )
+        })
+      } else if (format === 'qbo') {
+        files.push({
+          format,
+          contents: exportTransactionsToQBO(
+            overlayed,
+            isoFiat,
+            denom.multiplier
+          )
+        })
+      } else {
+        files.push({
+          format,
+          contents: await exportTransactionsToBitwave(
+            bitwaveAccountId!,
+            overlayed,
+            currencyCode,
+            denom.multiplier
+          )
+        })
+      }
+    }
+
+    return {
+      ok: true,
+      isoFiat,
+      total: transactions.length,
+      files
+    }
+  }
+})
+
+/**
+ * Count transactions in a wallet.
+ *
+ * Cheaper than listing when only the total matters.
+ *
+ * @note Unfiltered: `spamThreshold`, dates and `searchString` do not apply, so
+ *   this can exceed `total` from `get-transactions`.
+ */
+export const getNumTransactions = route({
+  core: 'wallet.getNumTransactions',
+  method: 'GET',
+  path: '/account/{sessionId}/wallet/get-num-transactions',
+  cli: 'get-num-transactions',
+  query: asObject({
+    walletId: asWalletId,
+    tokenId: asOptional(doc(asQueryTokenId, TOKEN_ID_DOC), null)
+  }).withRest,
+  returns: asObject({
+    numTransactions: doc(asNumber, 'Every transaction the wallet knows of.')
+  }),
+  errors: ['WALLET_NOT_FOUND', 'AMBIGUOUS_WALLET_ID'],
+
+  async handler(ctx) {
+    const wallet = findWallet(getAccount(ctx), ctx.query.valid.walletId)
+    const { tokenId } = ctx.query.valid
+    // Typed as returning a number, but plugins resolve a promise here, so
+    // awaiting is what actually yields a serializable value.
+    const numTransactions = await wallet.getNumTransactions({ tokenId })
+    return { numTransactions }
+  }
+})
+
+/**
+ * Save transaction metadata.
+ *
+ * One of only two routes that write transaction metadata to disk.
+ *
+ * @note `metadata` is an `EdgeMetadataChange`, so an explicit null clears a
+ *   field while an omitted one is left alone.
+ */
+export const saveTxMetadata = route({
+  core: 'wallet.saveTxMetadata',
+  method: 'POST',
+  path: '/account/{sessionId}/wallet/save-tx-metadata',
+  cli: 'save-tx-metadata',
+  body: asObject({
+    walletId: asWalletId,
+    txid: doc(asString, 'Which transaction to tag.'),
+    tokenId: asOptional(doc(asTokenId, TOKEN_ID_DOC)),
+    metadata: doc(
+      asCoreValue,
+      '`EdgeMetadataChange`: name, category, notes, exchangeAmount.'
+    )
+  }).withRest,
+  errors: ['BAD_REQUEST', 'WALLET_NOT_FOUND', 'AMBIGUOUS_WALLET_ID'],
+
+  async handler(ctx) {
+    const wallet = findWallet(getAccount(ctx), ctx.body.walletId)
+    await wallet.saveTxMetadata({
+      txid: ctx.body.txid,
+      tokenId: parseTokenId(ctx.body.tokenId ?? undefined),
+      metadata: ctx.body.metadata as EdgeMetadataChange
+    })
+    return undefined
+  }
+})
+
+/**
+ * Save a transaction action.
+ *
+ * Records what a transaction *was* — a swap, a stake — beyond its metadata.
+ *
+ * @note When `assetAction` is omitted it defaults to
+ *   `{ assetActionType: 'transfer' }`.
+ */
+export const saveTxAction = route({
+  core: 'wallet.saveTxAction',
+  method: 'POST',
+  path: '/account/{sessionId}/wallet/save-tx-action',
+  cli: 'save-tx-action',
+  body: asObject({
+    walletId: asWalletId,
+    txid: doc(asString, 'Which transaction to annotate.'),
+    tokenId: asOptional(doc(asTokenId, TOKEN_ID_DOC)),
+    savedAction: doc(asCoreValue, '`EdgeTxAction` describing what happened.'),
+    assetAction: asOptional(doc(asCoreValue, '`EdgeAssetAction`.'))
+  }).withRest,
+  errors: ['BAD_REQUEST', 'WALLET_NOT_FOUND', 'AMBIGUOUS_WALLET_ID'],
+
+  async handler(ctx) {
+    const wallet = findWallet(getAccount(ctx), ctx.body.walletId)
+    const assetAction =
+      ctx.body.assetAction != null && typeof ctx.body.assetAction === 'object'
+        ? (ctx.body.assetAction as EdgeAssetAction)
+        : { assetActionType: 'transfer' as const }
+    await wallet.saveTxAction({
+      txid: ctx.body.txid,
+      tokenId: parseTokenId(ctx.body.tokenId ?? undefined),
+      assetAction,
+      savedAction: ctx.body.savedAction as EdgeTxAction
+    })
+    return undefined
+  }
+})
diff --git a/src/cli/engine/routes/uri.ts b/src/cli/engine/routes/uri.ts
new file mode 100644
index 00000000000..aba123d354e
--- /dev/null
+++ b/src/cli/engine/routes/uri.ts
@@ -0,0 +1,84 @@
+import { asObject, asOptional, asString } from 'cleaners'
+import type { EdgeEncodeUri } from 'edge-core-js'
+
+import { doc } from '../doc'
+import { findWallet } from '../resolve'
+import { route } from '../route'
+import { asCoreValue, asWalletId } from '../schemas'
+import { getAccount } from './helpers'
+
+const CURRENCY_CODE_DOC = 'Disambiguates on chains that carry several assets.'
+
+/**
+ * Parse a payment URI or address.
+ *
+ * What the GUI address tile does when you paste or scan something.
+ *
+ * @note `spend` and `make-spend` run their `to` field through this same call,
+ *   so parsing separately is only needed to inspect or confirm first.
+ */
+export const parseUri = route({
+  core: 'wallet.parseUri',
+  method: 'POST',
+  path: '/account/{sessionId}/wallet/parse-uri',
+  cli: 'parse-uri',
+  body: asObject({
+    walletId: asWalletId,
+    uri: doc(asString, 'A payment URI or a bare address.'),
+    currencyCode: asOptional(doc(asString, CURRENCY_CODE_DOC))
+  }).withRest,
+  returns: doc(
+    asCoreValue,
+    '`EdgeParsedUri`: publicAddress, nativeAmount, currencyCode, metadata, paymentProtocolUrl, …'
+  ),
+  errors: ['BAD_REQUEST', 'WALLET_NOT_FOUND', 'AMBIGUOUS_WALLET_ID'],
+
+  async handler(ctx) {
+    const wallet = findWallet(getAccount(ctx), ctx.body.walletId)
+    return await wallet.parseUri(ctx.body.uri, ctx.body.currencyCode)
+  }
+})
+
+/**
+ * Build a payment URI.
+ *
+ * For a receive screen or a QR code.
+ *
+ * @note Only these five fields are read; a fuller `EdgeEncodeUri` has its
+ *   extras ignored.
+ */
+export const encodeUri = route({
+  core: 'wallet.encodeUri',
+  method: 'POST',
+  path: '/account/{sessionId}/wallet/encode-uri',
+  cli: 'encode-uri',
+  body: asObject({
+    walletId: asWalletId,
+    publicAddress: doc(asString, 'Where the payment should go.'),
+    nativeAmount: asOptional(doc(asString, 'Amount, in the native unit.')),
+    label: asOptional(
+      doc(asString, 'BIP21 `label`; becomes `metadata.name` when parsed back.')
+    ),
+    message: asOptional(
+      doc(asString, 'BIP21 `message`; becomes `metadata.notes`.')
+    ),
+    currencyCode: asOptional(doc(asString, CURRENCY_CODE_DOC))
+  }).withRest,
+  returns: asObject({
+    uri: doc(asString, 'The encoded URI, ready for a QR code.')
+  }),
+  errors: ['BAD_REQUEST', 'WALLET_NOT_FOUND', 'AMBIGUOUS_WALLET_ID'],
+
+  async handler(ctx) {
+    const wallet = findWallet(getAccount(ctx), ctx.body.walletId)
+    const obj: EdgeEncodeUri = {
+      publicAddress: ctx.body.publicAddress,
+      nativeAmount: ctx.body.nativeAmount,
+      label: ctx.body.label,
+      message: ctx.body.message,
+      currencyCode: ctx.body.currencyCode
+    }
+    const uri = await wallet.encodeUri(obj)
+    return { uri }
+  }
+})
diff --git a/src/cli/engine/routes/vouchers.ts b/src/cli/engine/routes/vouchers.ts
new file mode 100644
index 00000000000..fb0e946e8e4
--- /dev/null
+++ b/src/cli/engine/routes/vouchers.ts
@@ -0,0 +1,76 @@
+import { asArray, asObject, asString } from 'cleaners'
+
+import { doc } from '../doc'
+import { route } from '../route'
+import { asCoreValue } from '../schemas'
+import { getAccount } from './helpers'
+
+const VOUCHER_ID_DOC =
+  'From `pending-vouchers`, or an `OTP_REQUIRED` error’s `details.voucherId`.'
+
+const asVoucherBody = asObject({
+  voucherId: doc(asString, VOUCHER_ID_DOC)
+}).withRest
+
+/**
+ * List pending 2FA vouchers.
+ *
+ * When 2FA blocks a login, the login server issues a voucher that an
+ * already-trusted device can approve or reject.
+ */
+export const pendingVouchers = route({
+  core: 'account.pendingVouchers',
+  method: 'GET',
+  path: '/account/{sessionId}/pending-vouchers',
+  cli: 'pending-vouchers',
+  returns: asObject({
+    pendingVouchers: doc(
+      asArray(asCoreValue),
+      '`EdgePendingVoucher[]`: voucherId, activates, created, deviceDescription, ipDescription.'
+    )
+  }),
+
+  handler(ctx) {
+    // Core leaves this undefined until the login server has reported on it,
+    // and the documented type is an array either way.
+    return { pendingVouchers: getAccount(ctx).pendingVouchers ?? [] }
+  }
+})
+
+/**
+ * Approve a voucher.
+ *
+ * Lets the waiting device finish logging in.
+ */
+export const approveVoucher = route({
+  core: 'account.approveVoucher',
+  method: 'POST',
+  path: '/account/{sessionId}/approve-voucher',
+  cli: 'approve-voucher',
+  body: asVoucherBody,
+  errors: ['BAD_REQUEST', 'NETWORK_ERROR'],
+
+  async handler(ctx) {
+    await getAccount(ctx).approveVoucher(ctx.body.voucherId)
+    return undefined
+  }
+})
+
+/**
+ * Reject a voucher.
+ *
+ * Denies the waiting device. The login it was issued for cannot complete.
+ */
+export const rejectVoucher = route({
+  core: 'account.rejectVoucher',
+  method: 'POST',
+  path: '/account/{sessionId}/reject-voucher',
+  cli: 'reject-voucher',
+  body: asVoucherBody,
+  errors: ['BAD_REQUEST', 'NETWORK_ERROR'],
+
+  async handler(ctx) {
+    await getAccount(ctx).rejectVoucher(ctx.body.voucherId)
+    return undefined
+  }
+})
diff --git a/src/cli/engine/routes/wallets.ts b/src/cli/engine/routes/wallets.ts
new file mode 100644
index 00000000000..82b39590cd7
--- /dev/null
+++ b/src/cli/engine/routes/wallets.ts
@@ -0,0 +1,308 @@
+import { div } from 'biggystring'
+import { asArray, asBoolean, asObject, asOptional, asString } from 'cleaners'
+import type { EdgeSplitCurrencyWallet } from 'edge-core-js'
+
+import { doc } from '../doc'
+import { findWallet, getMultiplier } from '../resolve'
+import { route } from '../route'
+import {
+  asBalance,
+  asCoreValue,
+  asQueryInteger,
+  asQueryTokenId,
+  asWalletId
+} from '../schemas'
+import { getAccount, summarizeWallet } from './helpers'
+
+const WALLET_ERRORS = ['WALLET_NOT_FOUND', 'AMBIGUOUS_WALLET_ID']
+
+/**
+ * Wallet detail.
+ *
+ * @coreNote Engine composite of EdgeCurrencyWallet properties plus its
+ *   EdgeCurrencyConfig token map.
+ */
+export const walletInfo = route({
+  core: null,
+  method: 'GET',
+  path: '/account/{sessionId}/wallet',
+  cli: 'wallet-info',
+  query: asObject({ walletId: asWalletId }).withRest,
+  returns: doc(
+    asCoreValue,
+    'Every WalletSummary field, plus denominations, walletSettings and allTokens.'
+  ),
+  errors: WALLET_ERRORS,
+
+  handler(ctx) {
+    const wallet = findWallet(getAccount(ctx), ctx.query.valid.walletId)
+    return {
+      ...summarizeWallet(wallet),
+      denominations: wallet.currencyInfo.denominations,
+      walletSettings: wallet.walletSettings,
+      allTokens: wallet.currencyConfig.allTokens
+    }
+  }
+})
+
+/**
+ * Rename a wallet.
+ */
+export const renameWallet = route({
+  core: 'wallet.renameWallet',
+  method: 'POST',
+  path: '/account/{sessionId}/wallet/rename-wallet',
+  cli: 'rename-wallet',
+  body: asObject({
+    walletId: asWalletId,
+    name: doc(asString, 'The new display name.')
+  }).withRest,
+  errors: ['BAD_REQUEST', ...WALLET_ERRORS],
+
+  async handler(ctx) {
+    const wallet = findWallet(getAccount(ctx), ctx.body.walletId)
+    await wallet.renameWallet(ctx.body.name)
+    return undefined
+  }
+})
+
+/**
+ * Change a wallet's fiat currency.
+ *
+ * Affects how balances and history are priced, not the asset itself.
+ */
+export const setFiatCurrencyCode = route({
+  core: 'wallet.setFiatCurrencyCode',
+  method: 'POST',
+  path: '/account/{sessionId}/wallet/set-fiat-currency-code',
+  cli: 'set-fiat-currency-code',
+  body: asObject({
+    walletId: asWalletId,
+    fiatCurrencyCode: doc(asString, 'e.g. `iso:EUR`.')
+  }).withRest,
+  errors: ['BAD_REQUEST', ...WALLET_ERRORS],
+
+  async handler(ctx) {
+    const wallet = findWallet(getAccount(ctx), ctx.body.walletId)
+    await wallet.setFiatCurrencyCode(ctx.body.fiatCurrencyCode)
+    return undefined
+  }
+})
+
+/**
+ * Pause or resume a wallet engine.
+ *
+ * A paused wallet stops syncing, which is how a caller quiets a chain it does
+ * not currently care about.
+ */
+export const changePaused = route({
+  core: 'wallet.changePaused',
+  method: 'POST',
+  path: '/account/{sessionId}/wallet/change-paused',
+  cli: 'change-paused',
+  body: asObject({
+    walletId: asWalletId,
+    paused: doc(asBoolean, 'True to stop syncing.')
+  }).withRest,
+  errors: ['BAD_REQUEST', ...WALLET_ERRORS],
+
+  async handler(ctx) {
+    const wallet = findWallet(getAccount(ctx), ctx.body.walletId)
+    await wallet.changePaused(ctx.body.paused)
+    return undefined
+  }
+})
+
+/**
+ * Nudge one wallet to sync.
+ *
+ * @note Named `wallet-sync` on the CLI because `sync` is `account.sync`.
+ */
+export const walletSync = route({
+  core: 'wallet.sync',
+  method: 'POST',
+  path: '/account/{sessionId}/wallet/sync',
+  cli: 'wallet-sync',
+  body: asObject({ walletId: asWalletId }).withRest,
+  errors: WALLET_ERRORS,
+
+  async handler(ctx) {
+    const wallet = findWallet(getAccount(ctx), ctx.body.walletId)
+    await wallet.sync()
+    return undefined
+  }
+})
+
+/**
+ * Rescan the blockchain from scratch.
+ *
+ * Drops cached chain state and re-scans. Expensive, and the wallet reports an
+ * incomplete balance until it finishes.
+ *
+ * @note Returns when the resync is requested, not when it completes. Watch
+ *   `syncRatio` for progress.
+ */
+export const resyncBlockchain = route({
+  core: 'wallet.resyncBlockchain',
+  method: 'POST',
+  path: '/account/{sessionId}/wallet/resync-blockchain',
+  cli: 'resync-blockchain',
+  body: asObject({ walletId: asWalletId }).withRest,
+  errors: WALLET_ERRORS,
+
+  async handler(ctx) {
+    const wallet = findWallet(getAccount(ctx), ctx.body.walletId)
+    await wallet.resyncBlockchain()
+    return undefined
+  }
+})
+
+/**
+ * Split a wallet into another chain.
+ *
+ * Forked-chain support: derive a wallet of a different type from the same
+ * keys. `list-splittable-wallet-types` says which are valid.
+ */
+export const splitWallet = route({
+  core: 'wallet.split',
+  method: 'POST',
+  path: '/account/{sessionId}/wallet/split',
+  cli: 'split',
+  body: asObject({
+    walletId: asWalletId,
+    splitWallets: doc(
+      asArray(asCoreValue),
+      '`EdgeSplitCurrencyWallet[]`: walletType, name, fiatCurrencyCode.'
+    )
+  }).withRest,
+  returns: asObject({
+    results: doc(asArray(asCoreValue), 'Per-entry outcomes, like batch create.')
+  }),
+  errors: ['BAD_REQUEST', ...WALLET_ERRORS],
+
+  async handler(ctx) {
+    const wallet = findWallet(getAccount(ctx), ctx.body.walletId)
+    const results = await wallet.split(
+      ctx.body.splitWallets as EdgeSplitCurrencyWallet[]
+    )
+    return {
+      results: results.map(result =>
+        result.ok
+          ? { ok: true, wallet: summarizeWallet(result.result) }
+          : {
+              ok: false,
+              error:
+                result.error instanceof Error
+                  ? result.error.message
+                  : String(result.error)
+            }
+      )
+    }
+  }
+})
+
+/**
+ * Dump wallet engine state.
+ *
+ * Plugin-defined debug output. Shape varies by plugin and can be very large.
+ */
+export const dumpData = route({
+  core: 'wallet.dumpData',
+  method: 'GET',
+  path: '/account/{sessionId}/wallet/dump-data',
+  cli: 'dump-data',
+  query: asObject({ walletId: asWalletId }).withRest,
+  returns: doc(asCoreValue, '`EdgeDataDump`, straight from the plugin.'),
+  errors: WALLET_ERRORS,
+
+  async handler(ctx) {
+    const wallet = findWallet(getAccount(ctx), ctx.query.valid.walletId)
+    return await wallet.dumpData()
+  }
+})
+
+/**
+ * Balances for every asset in the wallet.
+ *
+ * The native currency plus every enabled token.
+ *
+ * @note On the CLI, omit `--token-id` for the native asset rather than passing
+ *   the literal `null`.
+ * @coreNote Rendered as an array, with currencyCode and displayAmount added
+ *   from the wallet's denominations.
+ */
+export const balanceMap = route({
+  core: 'wallet.balanceMap',
+  method: 'GET',
+  path: '/account/{sessionId}/wallet/balance-map',
+  cli: {
+    command: 'balance-map',
+    custom: true,
+    extra: {
+      tokenId: {
+        kind: 'string',
+        doc: 'Client-side filter; core has no single-balance accessor.'
+      }
+    }
+  },
+  query: asObject({ walletId: asWalletId }).withRest,
+  returns: asObject({
+    balances: doc(
+      asArray(asBalance),
+      'One entry per asset the wallet holds, native coin first.'
+    )
+  }),
+  errors: WALLET_ERRORS,
+
+  handler(ctx) {
+    const wallet = findWallet(getAccount(ctx), ctx.query.valid.walletId)
+    const balances = [...wallet.balanceMap.entries()].map(
+      ([tokenId, nativeAmount]) => {
+        const multiplier = getMultiplier(wallet, tokenId)
+        return {
+          tokenId,
+          currencyCode:
+            tokenId == null
+              ? wallet.currencyInfo.currencyCode
+              : wallet.currencyConfig.allTokens[tokenId]?.currencyCode ??
+                tokenId,
+          nativeAmount,
+          displayAmount: div(nativeAmount, multiplier, 18)
+        }
+      }
+    )
+    return { balances }
+  }
+})
+
+/**
+ * Receive addresses.
+ */
+export const getAddresses = route({
+  core: 'wallet.getAddresses',
+  method: 'GET',
+  path: '/account/{sessionId}/wallet/get-addresses',
+  cli: 'get-addresses',
+  query: asObject({
+    walletId: asWalletId,
+    tokenId: asOptional(
+      doc(asQueryTokenId, 'Defaults to the native asset.'),
+      null
+    ),
+    forceIndex: asOptional(doc(asQueryInteger, 'Derive at a specific index.'))
+  }).withRest,
+  returns: asObject({
+    addresses: doc(
+      asArray(asCoreValue),
+      '`EdgeAddress[]`: addressType, publicAddress, nativeBalance.'
+    )
+  }),
+  errors: WALLET_ERRORS,
+
+  async handler(ctx) {
+    const wallet = findWallet(getAccount(ctx), ctx.query.valid.walletId)
+    const { tokenId, forceIndex } = ctx.query.valid
+    const addresses = await wallet.getAddresses({ tokenId, forceIndex })
+    return { addresses }
+  }
+})
diff --git a/src/cli/engine/schemas.ts b/src/cli/engine/schemas.ts
new file mode 100644
index 00000000000..7a8ae48c0c6
--- /dev/null
+++ b/src/cli/engine/schemas.ts
@@ -0,0 +1,403 @@
+/**
+ * Response shapes the engine reuses across routes.
+ *
+ * These describe what a handler returns. They are *not* run against live
+ * responses — a strict cleaner would strip fields a plugin adds — but they are
+ * the documented shape, and tests can assert real responses against them.
+ *
+ * Request cleaners live beside their route. They use `.withRest` so declared
+ * fields are validated while anything a handler forwards wholesale to core
+ * still passes through untouched.
+ */
+import type { Cleaner } from 'cleaners'
+import {
+  asArray,
+  asBoolean,
+  asDate,
+  asEither,
+  asNumber,
+  asObject,
+  asOptional,
+  asString,
+  asUnknown,
+  asValue
+} from 'cleaners'
+
+import { doc } from './doc'
+
+/** `EdgeTokenId`: a contract id, or null for the native asset. */
+export const asTokenId = asEither(asString, asValue(null))
+
+/**
+ * The wallet a call acts on.
+ *
+ * Not a path parameter. A wallet id is base64 — `7o7i6/tlI+qi…=` is an
+ * ordinary one — and a value containing `/` cannot be a path segment without
+ * percent-encoding that callers forget. Path parameters are reserved for
+ * base58 identifiers, which have no such character.
+ */
+export const asWalletId = doc(
+  asString,
+  'The wallet to act on. A full wallet id, or any unique prefix of one. An ' +
+    'ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with ' +
+    '`details.candidates`.'
+)
+
+// ------------------------------------------------------------ query values
+// A query string carries only text, so `?waitForAll=true` arrives as the four
+// characters "true". These cleaners convert on the way in, which lets a route
+// declare the type it actually means: the documented type, the type the
+// handler reads, and the CLI flag kind all follow from one declaration. A
+// route that declared `asString` and converted inside the handler documented a
+// string and produced a `--flag=<value>` where a bare switch belonged.
+
+/** A boolean written out in a query string. */
+export const asQueryBoolean: Cleaner<boolean> = raw => {
+  if (typeof raw === 'boolean') return raw
+  if (raw === 'true') return true
+  if (raw === 'false') return false
+  throw new TypeError('Expected "true" or "false"')
+}
+
+/** A whole number written out in a query string. */
+export const asQueryInteger: Cleaner<number> = raw => {
+  if (typeof raw === 'number' && Number.isInteger(raw)) return raw
+  if (typeof raw !== 'string' || raw === '') {
+    throw new TypeError('Expected a whole number')
+  }
+  const n = Number(raw)
+  if (!Number.isInteger(n)) throw new TypeError('Expected a whole number')
+  return n
+}
+
+/**
+ * A date written out in a query string, as ISO-8601 or epoch milliseconds.
+ */
+export const asQueryDate: Cleaner<Date> = raw => {
+  if (raw instanceof Date) return raw
+  if (typeof raw !== 'string' || raw.trim() === '') {
+    throw new TypeError('Expected an ISO-8601 date or epoch milliseconds')
+  }
+  const ms = Number(raw)
+  const date = Number.isFinite(ms) ? new Date(ms) : new Date(raw)
+  if (Number.isNaN(date.getTime())) {
+    throw new TypeError('Expected an ISO-8601 date or epoch milliseconds')
+  }
+  return date
+}
+
+/**
+ * `EdgeTokenId` from a query string.
+ *
+ * The native asset is `null`, which a URL can only spell as the text "null" —
+ * or by omitting the parameter. Both mean the same thing.
+ */
+export const asQueryTokenId: Cleaner<string | null> = raw => {
+  if (raw == null || raw === '' || raw === 'null') return null
+  if (typeof raw === 'string') return raw
+  throw new TypeError('Expected a token id or null')
+}
+
+/** A core value passed through untouched. Documented by name in JSDoc. */
+export const asCoreValue = asUnknown
+
+export const asVoid = asValue(undefined)
+
+/** A bare acknowledgement. */
+export const asOk = asObject({
+  ok: doc(asBoolean, 'Always true; a failure arrives as an error envelope.')
+})
+
+/** An acknowledgement naming the handle the call consumed. */
+export const asOkObject = asObject({
+  ok: doc(asBoolean, 'Always true; a failure arrives as an error envelope.'),
+  objectId: doc(asString, 'The handle this call consumed. It is now expired.')
+})
+
+export const asLoginMethod = asValue(
+  'password',
+  'pin',
+  'key',
+  'recovery',
+  'edge',
+  'create'
+)
+
+/** Returned by every successful login, by session listing, and by keepalive. */
+export const asSession = asObject({
+  sessionId: doc(
+    asString,
+    'Identifies this login. Every account-scoped call carries it, and the ' +
+      'CLI stores the most recent one so commands can omit it.'
+  ),
+  username: doc(
+    asOptional(asString),
+    'Absent for a light account, which has no username.'
+  ),
+  rootLoginId: doc(
+    asString,
+    'The account root, stable across appIds. Two sessions sharing it are the ' +
+      'same account.'
+  ),
+  loginMethod: doc(asLoginMethod, 'How this session was established.'),
+  autoLogoutSeconds: doc(
+    asNumber,
+    'Idle time before the engine logs the account out. 0 disables it.'
+  ),
+  expiresAt: doc(
+    asEither(asString, asValue(null)),
+    'When auto-logout will fire, or null when it is disabled.'
+  ),
+  lastActivityAt: doc(
+    asString,
+    'Last call on this session, which is what auto-logout measures from.'
+  ),
+  createdAt: doc(asString, 'When the login completed.')
+})
+
+/** One currency wallet. `walletId` and `id` are the same value. */
+export const asWalletSummary = asObject({
+  walletId: doc(
+    asString,
+    'The full wallet id. Commands taking a wallet accept any unique prefix.'
+  ),
+  id: doc(asString, 'Same value as `walletId`; core exposes both names.'),
+  type: doc(asString, 'Key type, such as `wallet:bitcoin`.'),
+  name: doc(
+    asEither(asString, asValue(null)),
+    'User-assigned name, null until one is set.'
+  ),
+  pluginId: doc(asString, 'Currency plugin backing this wallet.'),
+  currencyCode: doc(asString, 'Ticker for the native asset.'),
+  fiatCurrencyCode: doc(
+    asString,
+    'Fiat the wallet reports value in, as `iso:USD`.'
+  ),
+  blockHeight: doc(asNumber, 'Chain height this wallet has seen.'),
+  syncStatus: doc(asCoreValue, '`EdgeWalletSyncStatus` from core.'),
+  syncRatio: doc(
+    asOptional(asString),
+    'Sync progress as a percentage, for display.'
+  ),
+  paused: doc(asBoolean, 'True while the engine is not syncing this wallet.'),
+  imported: doc(
+    asOptional(asBoolean),
+    'True when the keys came from an import rather than being generated here.'
+  ),
+  created: doc(
+    asEither(asString, asValue(null)),
+    'When the wallet was created, null for wallets predating the field.'
+  ),
+  enabledTokenIds: doc(asArray(asString), 'Tokens the user turned on.'),
+  detectedTokenIds: doc(
+    asArray(asString),
+    'Tokens found on-chain that are not enabled yet.'
+  ),
+  unactivatedTokenIds: doc(
+    asArray(asString),
+    'Enabled tokens still awaiting on-chain activation.'
+  )
+})
+
+/** One asset balance, with the display amount already divided out. */
+export const asBalance = asObject({
+  tokenId: doc(asTokenId, 'The asset, or null for the chain\u2019s own coin.'),
+  currencyCode: doc(asString, 'Ticker for this asset.'),
+  nativeAmount: doc(
+    asString,
+    'The balance in the smallest unit, as a decimal string.'
+  ),
+  displayAmount: doc(
+    asString,
+    'The same balance divided by the display multiplier.'
+  )
+})
+
+/** Identity for a method-bearing core value held server-side. */
+export const asObjectHandle = asObject({
+  objectId: doc(
+    asString,
+    'Handle for the value the engine is holding. Pass it to the calls that consume it.'
+  ),
+  kind: doc(
+    asValue('transaction', 'pendingLogin', 'swap', 'lobby'),
+    'What the handle refers to, which decides the calls that accept it.'
+  ),
+  expiresAt: doc(
+    asString,
+    'When the engine drops the handle. Handles live 5 minutes.'
+  ),
+  sessionId: doc(
+    asOptional(asString),
+    'Session that created the handle; only that session may use it.'
+  ),
+  walletId: doc(
+    asOptional(asString),
+    'Wallet the handle is bound to, when it belongs to one.'
+  )
+})
+
+/** An object handle carrying the transaction it refers to. */
+export const asTransactionHandle = asObject({
+  objectId: doc(
+    asString,
+    'Handle for the value the engine is holding. Pass it to the calls that consume it.'
+  ),
+  kind: doc(
+    asValue('transaction'),
+    'What the handle refers to, which decides the calls that accept it.'
+  ),
+  expiresAt: doc(
+    asString,
+    'When the engine drops the handle. Handles live 5 minutes.'
+  ),
+  sessionId: doc(
+    asOptional(asString),
+    'Session that created the handle; only that session may use it.'
+  ),
+  walletId: doc(
+    asOptional(asString),
+    'Wallet the handle is bound to, when it belongs to one.'
+  ),
+  transaction: doc(
+    asCoreValue,
+    '`EdgeTransaction` as it stands after this step. Unsigned after ' +
+      '`make-spend`, signed after `sign-tx`, and carrying a txid once broadcast.'
+  )
+})
+
+/** A swap quote, held under a `swap_` handle with a 5 minute TTL. */
+export const asSwapQuote = asObject({
+  objectId: doc(
+    asString,
+    'Handle for the value the engine is holding. Pass it to the calls that consume it.'
+  ),
+  kind: doc(
+    asValue('swap'),
+    'What the handle refers to, which decides the calls that accept it.'
+  ),
+  expiresAt: doc(
+    asString,
+    'When the engine drops the handle. Handles live 5 minutes.'
+  ),
+  pluginId: doc(asString, 'Swap provider that produced this quote.'),
+  isEstimate: doc(
+    asBoolean,
+    'True when the provider may settle at a different rate than quoted.'
+  ),
+  canBePartial: doc(
+    asEither(asBoolean, asValue(null)),
+    'True when the provider may fill only part of the order. Null when it ' +
+      'does not say.'
+  ),
+  maxFulfillmentSeconds: doc(
+    asEither(asNumber, asValue(null)),
+    'Longest the provider expects a partial fill to take.'
+  ),
+  minReceiveAmount: doc(
+    asEither(asString, asValue(null)),
+    'Least the provider guarantees to deliver, in the destination\u2019s ' +
+      'native units.'
+  ),
+  fromNativeAmount: doc(asString, 'Amount leaving the source wallet.'),
+  toNativeAmount: doc(asString, 'Amount arriving in the destination wallet.'),
+  networkFee: doc(
+    asObject({ nativeAmount: asString, tokenId: asTokenId }),
+    'On-chain fee for the sending transaction. It is not the provider\u2019s ' +
+      'own spread, which is already in the rate.'
+  ),
+  quoteExpirationDate: doc(
+    asEither(asString, asValue(null)),
+    'When the provider stops honouring the rate. Null when it does not expire.'
+  ),
+  swapInfo: doc(
+    asObject({
+      pluginId: asString,
+      displayName: asString,
+      supportEmail: asString,
+      isDex: asEither(asBoolean, asValue(null))
+    }),
+    '`EdgeSwapInfo`: how to name the provider and where to send complaints.'
+  ),
+  request: doc(
+    asObject({
+      fromTokenId: asTokenId,
+      toTokenId: asTokenId,
+      nativeAmount: asString,
+      quoteFor: asValue('from', 'to', 'max'),
+      fromWalletId: asString,
+      toWalletId: asString
+    }),
+    'The `EdgeSwapRequest` this quote answers, echoed back so quotes from ' +
+      'different plugins can be compared without tracking what was asked.'
+  )
+})
+
+/** A QR / lobby login in progress. `session` fills once `state` is `done`. */
+export const asPendingEdgeLogin = asObject({
+  objectId: doc(
+    asString,
+    'Handle for the value the engine is holding. Pass it to the calls that consume it.'
+  ),
+  pendingId: doc(
+    asString,
+    'Same value as `objectId`, under the name the poll command takes.'
+  ),
+  kind: doc(
+    asValue('pendingLogin'),
+    'What the handle refers to, which decides the calls that accept it.'
+  ),
+  expiresAt: doc(
+    asEither(asString, asValue(null)),
+    'When the lobby closes and the QR code stops working.'
+  ),
+  lobbyId: doc(asString, 'Lobby the phone connects to.'),
+  uri: doc(
+    asString,
+    'The `edge://` URI to render as a QR code for the phone to scan.'
+  ),
+  state: doc(
+    asValue('pending', 'started', 'done', 'error', 'closed'),
+    'How far the login has got: `pending` before the phone scans, `started` ' +
+      'once it has, and `done` when `session` is filled in.'
+  ),
+  username: doc(
+    asEither(asString, asValue(null)),
+    'Account that approved the login, known once the phone has scanned.'
+  ),
+  session: doc(
+    asEither(asSession, asValue(null)),
+    'The session, null until `state` is `done`.'
+  ),
+  error: doc(
+    asEither(asString, asValue(null)),
+    'Why the login failed, set only when `state` is `error`.'
+  )
+})
+
+/** The enabled token set after a change. */
+export const asEnabledTokens = asObject({
+  enabledTokenIds: doc(
+    asArray(asString),
+    'The wallet\u2019s enabled tokens after the change, not just what changed.'
+  )
+})
+
+/** Every failure, on both transports. */
+export const asErrorEnvelope = asObject({
+  error: doc(
+    asObject({
+      code: asString,
+      message: asString,
+      status: asNumber,
+      details: asOptional(asUnknown)
+    }),
+    'Stable `code` to branch on, human-readable `message`, the HTTP `status` ' +
+      'repeated for clients that only see the body, and `details` when the ' +
+      'code carries extra data.'
+  )
+})
+
+// `asDate` is re-exported so route files can describe date fields without
+// each importing it from `cleaners` directly.
+export { asDate }
diff --git a/src/cli/engine/server.ts b/src/cli/engine/server.ts
new file mode 100644
index 00000000000..a8047a62b1e
--- /dev/null
+++ b/src/cli/engine/server.ts
@@ -0,0 +1,177 @@
+import fs from 'fs'
+import http, { type IncomingMessage, type ServerResponse } from 'http'
+
+import { engineError, toErrorBody } from './errors'
+import { readJsonBody, stringifyJson } from './json'
+import { API_VERSION, type EngineState, type Router } from './router'
+
+/** Drop connections that never finish sending headers or a body. */
+const HEADERS_TIMEOUT_MS = 20_000
+const REQUEST_TIMEOUT_MS = 120_000
+
+function setCommonHeaders(res: ServerResponse): void {
+  res.setHeader('X-Edge-Api-Version', API_VERSION)
+  res.setHeader('Content-Type', 'application/json; charset=utf-8')
+}
+
+function sendJson(res: ServerResponse, status: number, body: unknown): void {
+  setCommonHeaders(res)
+  res.statusCode = status
+  if (body === undefined || status === 204) {
+    res.end()
+    return
+  }
+  res.end(stringifyJson(body))
+}
+
+export function createRequestHandler(
+  state: EngineState,
+  router: Router
+): (req: IncomingMessage, res: ServerResponse) => void {
+  return (req, res) => {
+    handleRequest(state, router, req, res).catch(() => {})
+  }
+}
+
+async function handleRequest(
+  state: EngineState,
+  router: Router,
+  req: IncomingMessage,
+  res: ServerResponse
+): Promise<void> {
+  state.idle.touch()
+
+  try {
+    if (state.shuttingDown) {
+      throw engineError('ENGINE_SHUTTING_DOWN', 'Engine is shutting down', 503)
+    }
+
+    const host = req.headers.host ?? 'localhost'
+    const url = new URL(req.url ?? '/', `http://${host}`)
+    const pathname = url.pathname
+
+    // SSE special-case
+    if (req.method === 'GET' && pathname === '/engine/events') {
+      state.events.addSseClient(res)
+      return
+    }
+
+    const matched = router.match(req.method ?? 'GET', pathname)
+    if (matched == null) {
+      // Check if path exists with different method
+      const methods = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE']
+      const other = methods.find(
+        m =>
+          m !== (req.method ?? '').toUpperCase() &&
+          router.match(m, pathname) != null
+      )
+      if (other != null) {
+        throw engineError(
+          'METHOD_NOT_ALLOWED',
+          `Method ${req.method} not allowed`,
+          405
+        )
+      }
+      throw engineError('NOT_FOUND', `No route for ${pathname}`, 404)
+    }
+
+    let body: unknown
+    if (
+      req.method === 'POST' ||
+      req.method === 'PUT' ||
+      req.method === 'PATCH'
+    ) {
+      const ct = String(req.headers['content-type'] ?? '')
+      const len = Number(req.headers['content-length'] ?? '0')
+      const hasBody = len > 0 || req.headers['transfer-encoding'] != null
+      if (hasBody && !ct.includes('application/json')) {
+        throw engineError(
+          'UNSUPPORTED_MEDIA_TYPE',
+          'Content-Type must be application/json',
+          415
+        )
+      }
+      try {
+        body = await readJsonBody(req)
+      } catch (error: unknown) {
+        const code =
+          error != null && typeof error === 'object' && 'code' in error
+            ? (error as { code: string }).code
+            : ''
+        if (code === 'BAD_REQUEST') {
+          throw engineError('BAD_REQUEST', 'Invalid JSON body', 400)
+        }
+        if (code === 'PAYLOAD_TOO_LARGE') {
+          // Answer first, then drop the connection so the rest of the
+          // oversized upload is never read into memory.
+          res.setHeader('Connection', 'close')
+          res.once('finish', () => req.destroy())
+          throw engineError('PAYLOAD_TOO_LARGE', (error as Error).message, 413)
+        }
+        throw error
+      }
+    }
+
+    const result = await matched.handler({
+      state,
+      req,
+      res,
+      params: matched.params,
+      query: url.searchParams,
+      body
+    })
+
+    if (res.writableEnded) return
+
+    if (result === undefined) {
+      sendJson(res, 204, undefined)
+    } else {
+      sendJson(res, 200, result)
+    }
+  } catch (error: unknown) {
+    if (res.writableEnded) return
+    const { status, body } = toErrorBody(error)
+    sendJson(res, status, body)
+  }
+}
+
+export async function listenUnix(
+  handler: (req: IncomingMessage, res: ServerResponse) => void,
+  socketPath: string
+): Promise<http.Server> {
+  const server = http.createServer(handler)
+  server.headersTimeout = HEADERS_TIMEOUT_MS
+  server.requestTimeout = REQUEST_TIMEOUT_MS
+  await new Promise<void>((resolve, reject) => {
+    server.once('error', reject)
+    server.listen(socketPath, () => {
+      try {
+        fs.chmodSync(socketPath, 0o600)
+      } catch {
+        // ignore
+      }
+      resolve()
+    })
+  })
+  return server
+}
+
+export async function listenTcp(
+  handler: (req: IncomingMessage, res: ServerResponse) => void,
+  port: number,
+  host = '127.0.0.1'
+): Promise<{ server: http.Server; port: number }> {
+  const server = http.createServer(handler)
+  server.headersTimeout = HEADERS_TIMEOUT_MS
+  server.requestTimeout = REQUEST_TIMEOUT_MS
+  await new Promise<void>((resolve, reject) => {
+    server.once('error', reject)
+    server.listen(port, host, () => {
+      resolve()
+    })
+  })
+  const address = server.address()
+  const bound =
+    address != null && typeof address === 'object' ? address.port : port
+  return { server, port: bound }
+}
diff --git a/src/cli/engine/sessions.ts b/src/cli/engine/sessions.ts
new file mode 100644
index 00000000000..90b3422303c
--- /dev/null
+++ b/src/cli/engine/sessions.ts
@@ -0,0 +1,239 @@
+import crypto from 'crypto'
+import type { EdgeAccount } from 'edge-core-js'
+
+import { base58 } from './encoding'
+import { engineError } from './errors'
+import type { EventHub } from './events'
+
+const DEFAULT_AUTO_LOGOUT_SECONDS = 3600
+
+export type LoginMethod =
+  | 'password'
+  | 'pin'
+  | 'key'
+  | 'recovery'
+  | 'create'
+  | 'edge'
+
+export interface SessionInfo {
+  sessionId: string
+  username: string | undefined
+  rootLoginId: string
+  loginMethod: LoginMethod
+  autoLogoutSeconds: number
+  expiresAt: string | null
+  lastActivityAt: string
+  createdAt: string
+}
+
+export interface SessionRecord {
+  sessionId: string
+  account: EdgeAccount
+  loginMethod: LoginMethod
+  autoLogoutSeconds: number
+  lastActivityAt: number
+  createdAt: number
+}
+
+export function makeSessionId(): string {
+  const bytes = crypto.randomBytes(16)
+  return 'sess_' + base58.stringify(bytes)
+}
+
+async function readAutoLogoutSeconds(account: EdgeAccount): Promise<number> {
+  try {
+    const text = await account.disklet.getText('Settings.json')
+    const json = JSON.parse(text) as { autoLogoutTimeInSeconds?: number }
+    if (typeof json.autoLogoutTimeInSeconds === 'number') {
+      return json.autoLogoutTimeInSeconds
+    }
+  } catch {
+    // missing or invalid — use default
+  }
+  return DEFAULT_AUTO_LOGOUT_SECONDS
+}
+
+export class SessionStore {
+  private readonly sessions = new Map<string, SessionRecord>()
+  private ticker: ReturnType<typeof setInterval> | null = null
+  private tickInFlight: Promise<void> | null = null
+  private readonly events: EventHub
+
+  /** Notified whenever the number of live sessions changes. */
+  onSessionsChanged: (() => void) | null = null
+
+  constructor(events: EventHub) {
+    this.events = events
+  }
+
+  private sessionsChanged(): void {
+    try {
+      this.onSessionsChanged?.()
+    } catch {
+      // A listener must never break login/logout.
+    }
+  }
+
+  get size(): number {
+    return this.sessions.size
+  }
+
+  list(): SessionInfo[] {
+    return [...this.sessions.values()].map(r => this.toInfo(r))
+  }
+
+  async create(
+    account: EdgeAccount,
+    loginMethod: LoginMethod
+  ): Promise<SessionInfo> {
+    // edge-core-js resolves login from inside the account pixie's first
+    // update(), then returns stopUpdates. createCurrencyWallet's internal
+    // waitForCurrencyWallet throws if the new wallet id is missing from
+    // Redux, so a same-turn create after login never lands the keys.
+    // Drain the pixie stack before exposing the session so POST /wallets
+    // is safe immediately. waitForAllWallets is a no-op on empty accounts.
+    await new Promise<void>(resolve => {
+      setImmediate(resolve)
+    })
+    await account.waitForAllWallets()
+
+    const sessionId = makeSessionId()
+    const autoLogoutSeconds = await readAutoLogoutSeconds(account)
+    const now = Date.now()
+    const record: SessionRecord = {
+      sessionId,
+      account,
+      loginMethod,
+      autoLogoutSeconds,
+      lastActivityAt: now,
+      createdAt: now
+    }
+    this.sessions.set(sessionId, record)
+    this.sessionsChanged()
+    this.events.emit('session.created', {
+      sessionId: sessionId.slice(0, 10) + '…',
+      username: account.username,
+      loginMethod
+    })
+    return this.toInfo(record)
+  }
+
+  get(sessionId: string): SessionRecord {
+    const record = this.sessions.get(sessionId)
+    if (record == null) {
+      throw engineError('INVALID_SESSION', 'Unknown sessionId', 401)
+    }
+    if (this.isExpired(record)) {
+      this.forceLogout(sessionId, 'expired').catch(() => {})
+      throw engineError('SESSION_EXPIRED', 'Session auto-logged out', 401)
+    }
+    return record
+  }
+
+  touch(sessionId: string): SessionInfo {
+    const record = this.get(sessionId)
+    record.lastActivityAt = Date.now()
+    return this.toInfo(record)
+  }
+
+  async logout(sessionId: string): Promise<void> {
+    const record = this.sessions.get(sessionId)
+    if (record == null) {
+      throw engineError('INVALID_SESSION', 'Unknown sessionId', 401)
+    }
+    this.sessions.delete(sessionId)
+    this.sessionsChanged()
+    try {
+      await record.account.logout()
+    } catch {
+      // best effort
+    }
+    // Anything reading this account cannot outlive it. Context streams stay.
+    this.events.closeScope(sessionId, 'logout')
+    this.events.emit('session.expired', {
+      sessionId: sessionId.slice(0, 10) + '…',
+      reason: 'logout'
+    })
+  }
+
+  async forceLogout(
+    sessionId: string,
+    reason: 'expired' | 'shutdown' | 'cancelled'
+  ): Promise<void> {
+    const record = this.sessions.get(sessionId)
+    if (record == null) return
+    this.sessions.delete(sessionId)
+    this.sessionsChanged()
+    try {
+      await record.account.logout()
+    } catch {
+      // best effort
+    }
+    this.events.closeScope(sessionId, reason)
+    this.events.emit('session.expired', {
+      sessionId: sessionId.slice(0, 10) + '…',
+      reason
+    })
+  }
+
+  async logoutAll(): Promise<void> {
+    const ids = [...this.sessions.keys()]
+    for (const id of ids) {
+      await this.forceLogout(id, 'shutdown')
+    }
+  }
+
+  startAutoLogoutTicker(): void {
+    if (this.ticker != null) return
+    this.ticker = setInterval(() => {
+      if (this.tickInFlight != null) return
+      this.tickInFlight = this.tick()
+        .catch(() => {})
+        .finally(() => {
+          this.tickInFlight = null
+        })
+    }, 15_000)
+    // Don't keep the process alive solely for the ticker
+    this.ticker.unref?.()
+  }
+
+  stopAutoLogoutTicker(): void {
+    if (this.ticker != null) {
+      clearInterval(this.ticker)
+      this.ticker = null
+    }
+  }
+
+  private isExpired(record: SessionRecord): boolean {
+    if (record.autoLogoutSeconds === 0) return false
+    const elapsed = (Date.now() - record.lastActivityAt) / 1000
+    return elapsed > record.autoLogoutSeconds
+  }
+
+  private async tick(): Promise<void> {
+    for (const [id, record] of this.sessions) {
+      if (this.isExpired(record)) {
+        await this.forceLogout(id, 'expired')
+      }
+    }
+  }
+
+  toInfo(record: SessionRecord): SessionInfo {
+    const expiresAt =
+      record.autoLogoutSeconds === 0
+        ? null
+        : new Date(
+            record.lastActivityAt + record.autoLogoutSeconds * 1000
+          ).toISOString()
+    return {
+      sessionId: record.sessionId,
+      username: record.account.username,
+      rootLoginId: record.account.rootLoginId,
+      loginMethod: record.loginMethod,
+      autoLogoutSeconds: record.autoLogoutSeconds,
+      expiresAt,
+      lastActivityAt: new Date(record.lastActivityAt).toISOString(),
+      createdAt: new Date(record.createdAt).toISOString()
+    }
+  }
+}
diff --git a/src/cli/engine/testerServers.ts b/src/cli/engine/testerServers.ts
new file mode 100644
index 00000000000..b6c0968d553
--- /dev/null
+++ b/src/cli/engine/testerServers.ts
@@ -0,0 +1,35 @@
+/**
+ * Edge tester fleet. Automated tests MUST use these — never production.
+ *
+ * Enumerated by DNS probe of *.edge.app (2026-08-05). Only these six resolve.
+ */
+export const TESTER_SERVERS = {
+  loginServer: 'https://login-tester.edge.app',
+  infoServer: 'https://info-tester.edge.app',
+  changeServer: 'https://change-tester.edge.app',
+  syncServer: [
+    'https://sync-tester-us1.edge.app',
+    'https://sync-tester-us2.edge.app',
+    'https://sync-tester-us3.edge.app'
+  ]
+} as const
+
+export type TesterServers = typeof TESTER_SERVERS
+
+/** True if every configured URL looks like a -tester host. */
+export function isTesterConfig(servers: {
+  loginServer?: string
+  infoServer?: string
+  changeServer?: string
+  syncServer?: string | string[]
+}): boolean {
+  const hosts: string[] = []
+  if (servers.loginServer != null) hosts.push(servers.loginServer)
+  if (servers.infoServer != null) hosts.push(servers.infoServer)
+  if (servers.changeServer != null) hosts.push(servers.changeServer)
+  const sync = servers.syncServer
+  if (typeof sync === 'string') hosts.push(sync)
+  else if (Array.isArray(sync)) hosts.push(...sync)
+  if (hosts.length === 0) return false
+  return hosts.every(h => h.includes('-tester') || h.includes('tester-'))
+}
diff --git a/src/cli/generated/commands.json b/src/cli/generated/commands.json
new file mode 100644
index 00000000000..f50c8c30fb7
--- /dev/null
+++ b/src/cli/generated/commands.json
@@ -0,0 +1,2123 @@
+{
+  "$comment": "GENERATED FILE — DO NOT EDIT. Produced by scripts/buildCliCommands.ts from the route declarations in src/cli/engine/routes. Commands marked `custom: true` in a declaration are hand-written instead; see src/cli/commands/.",
+  "commands": [
+    {
+      "command": "accelerate",
+      "method": "POST",
+      "path": "/account/{sessionId}/wallet/accelerate",
+      "usage": "accelerate --wallet-id=<walletId> [--object-id=<objectId>] [--transaction='<json>']",
+      "help": "Fee-bump a pending transaction.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "wallet-id",
+          "field": "walletId",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "object-id",
+          "field": "objectId",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        },
+        {
+          "flag": "transaction",
+          "field": "transaction",
+          "target": "body",
+          "kind": "json",
+          "required": false
+        }
+      ]
+    },
+    {
+      "command": "account-info",
+      "method": "GET",
+      "path": "/account/{sessionId}",
+      "usage": "account-info",
+      "help": "Account and session summary.",
+      "needsSession": true,
+      "args": []
+    },
+    {
+      "command": "admin-auth-request",
+      "method": "POST",
+      "path": "/admin/auth-request",
+      "usage": "admin-auth-request --method=<method> --path=<path> [--body='<json>']",
+      "help": "Raw login-server request.",
+      "needsSession": false,
+      "args": [
+        {
+          "flag": "method",
+          "field": "method",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "path",
+          "field": "path",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "body",
+          "field": "body",
+          "target": "body",
+          "kind": "json",
+          "required": false
+        }
+      ]
+    },
+    {
+      "command": "admin-fetch-lobby-request",
+      "method": "GET",
+      "path": "/admin/fetch-lobby-request/{lobbyId}",
+      "usage": "admin-fetch-lobby-request <lobbyId>",
+      "help": "Read a lobby's contents.",
+      "needsSession": false,
+      "pathPositional": "lobbyId",
+      "args": []
+    },
+    {
+      "command": "admin-hash-username",
+      "method": "GET",
+      "path": "/admin/hash-username",
+      "usage": "admin-hash-username --username=<username>",
+      "help": "Hash a username.",
+      "needsSession": false,
+      "args": [
+        {
+          "flag": "username",
+          "field": "username",
+          "target": "query",
+          "kind": "string",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "admin-lobby-handle-delete",
+      "method": "POST",
+      "path": "/admin/lobby-handle/delete/{objectId}",
+      "usage": "admin-lobby-handle-delete <objectId>",
+      "help": "Close a parked lobby.",
+      "needsSession": false,
+      "pathPositional": "objectId",
+      "args": []
+    },
+    {
+      "command": "admin-make-lobby",
+      "method": "POST",
+      "path": "/admin/make-lobby",
+      "usage": "admin-make-lobby [--lobby-request='<json>'] [--period-seconds='<json>']",
+      "help": "Create a lobby.",
+      "needsSession": false,
+      "args": [
+        {
+          "flag": "lobby-request",
+          "field": "lobbyRequest",
+          "target": "body",
+          "kind": "json",
+          "required": false
+        },
+        {
+          "flag": "period-seconds",
+          "field": "period",
+          "target": "body",
+          "kind": "json",
+          "required": false
+        }
+      ]
+    },
+    {
+      "command": "admin-repo-delete",
+      "method": "POST",
+      "path": "/admin/repo-delete/{syncKey}",
+      "usage": "admin-repo-delete <syncKey> --path=<path> --data-key=<dataKey>",
+      "help": "Delete a repo file.",
+      "needsSession": false,
+      "pathPositional": "syncKey",
+      "args": [
+        {
+          "flag": "path",
+          "field": "path",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "data-key",
+          "field": "dataKey",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "admin-repo-get",
+      "method": "GET",
+      "path": "/admin/repo-get/{syncKey}",
+      "usage": "admin-repo-get <syncKey> --path=<path> --data-key=<dataKey>",
+      "help": "Read a repo file.",
+      "needsSession": false,
+      "pathPositional": "syncKey",
+      "args": [
+        {
+          "flag": "path",
+          "field": "path",
+          "target": "query",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "data-key",
+          "field": "dataKey",
+          "target": "query",
+          "kind": "string",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "admin-repo-list",
+      "method": "GET",
+      "path": "/admin/repo-list/{syncKey}",
+      "usage": "admin-repo-list <syncKey> [--path=<path>] --data-key=<dataKey>",
+      "help": "List repo contents.",
+      "needsSession": false,
+      "pathPositional": "syncKey",
+      "args": [
+        {
+          "flag": "path",
+          "field": "path",
+          "target": "query",
+          "kind": "string",
+          "required": false
+        },
+        {
+          "flag": "data-key",
+          "field": "dataKey",
+          "target": "query",
+          "kind": "string",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "admin-repo-set",
+      "method": "POST",
+      "path": "/admin/repo-set/{syncKey}",
+      "usage": "admin-repo-set <syncKey> --path=<path> --text=<text> --data-key=<dataKey>",
+      "help": "Write a repo file.",
+      "needsSession": false,
+      "pathPositional": "syncKey",
+      "args": [
+        {
+          "flag": "path",
+          "field": "path",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "text",
+          "field": "text",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "data-key",
+          "field": "dataKey",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "admin-send-lobby-reply",
+      "method": "POST",
+      "path": "/admin/send-lobby-reply/{lobbyId}",
+      "usage": "admin-send-lobby-reply <lobbyId> --lobby-request='<json>' [--reply-data='<json>']",
+      "help": "Reply to a lobby.",
+      "needsSession": false,
+      "pathPositional": "lobbyId",
+      "args": [
+        {
+          "flag": "lobby-request",
+          "field": "lobbyRequest",
+          "target": "body",
+          "kind": "json",
+          "required": true
+        },
+        {
+          "flag": "reply-data",
+          "field": "replyData",
+          "target": "body",
+          "kind": "json",
+          "required": false
+        }
+      ]
+    },
+    {
+      "command": "admin-sync-repo",
+      "method": "POST",
+      "path": "/admin/sync-repo/{syncKey}",
+      "usage": "admin-sync-repo <syncKey>",
+      "help": "Sync a repo.",
+      "needsSession": false,
+      "pathPositional": "syncKey",
+      "args": []
+    },
+    {
+      "command": "all-keys",
+      "method": "GET",
+      "path": "/account/{sessionId}/all-keys",
+      "usage": "all-keys",
+      "help": "List every key in the account.",
+      "needsSession": true,
+      "args": []
+    },
+    {
+      "command": "approve-login-request",
+      "method": "POST",
+      "path": "/account/{sessionId}/approve-login-request/{lobbyId}",
+      "usage": "approve-login-request <lobbyId>",
+      "help": "Approve a login request.",
+      "needsSession": true,
+      "pathPositional": "lobbyId",
+      "args": []
+    },
+    {
+      "command": "approve-swap-quote",
+      "method": "POST",
+      "path": "/account/{sessionId}/swap-quote/approve/{objectId}",
+      "usage": "approve-swap-quote <objectId>",
+      "help": "Execute a quote.",
+      "needsSession": true,
+      "pathPositional": "objectId",
+      "args": []
+    },
+    {
+      "command": "approve-voucher",
+      "method": "POST",
+      "path": "/account/{sessionId}/approve-voucher",
+      "usage": "approve-voucher --voucher-id=<voucherId>",
+      "help": "Approve a voucher.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "voucher-id",
+          "field": "voucherId",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "broadcast-tx",
+      "method": "POST",
+      "path": "/account/{sessionId}/broadcast-tx/{objectId}",
+      "usage": "broadcast-tx <objectId>",
+      "help": "Broadcast a signed transaction.",
+      "needsSession": true,
+      "pathPositional": "objectId",
+      "args": []
+    },
+    {
+      "command": "cancel-otp-reset",
+      "method": "POST",
+      "path": "/account/{sessionId}/cancel-otp-reset",
+      "usage": "cancel-otp-reset",
+      "help": "Cancel a pending 2FA reset.",
+      "needsSession": true,
+      "args": []
+    },
+    {
+      "command": "cancel-request",
+      "method": "POST",
+      "path": "/pending-edge-login/cancel-request/{pendingId}",
+      "usage": "cancel-request <pendingId>",
+      "help": "Cancel a pending QR login.",
+      "needsSession": false,
+      "pathPositional": "pendingId",
+      "args": []
+    },
+    {
+      "command": "change-password",
+      "method": "POST",
+      "path": "/account/{sessionId}/change-password",
+      "usage": "change-password --password=<password>",
+      "help": "Set or change the password.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "password",
+          "field": "password",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "change-paused",
+      "method": "POST",
+      "path": "/account/{sessionId}/wallet/change-paused",
+      "usage": "change-paused --wallet-id=<walletId> --paused=true|false",
+      "help": "Pause or resume a wallet engine.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "wallet-id",
+          "field": "walletId",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "paused",
+          "field": "paused",
+          "target": "body",
+          "kind": "boolstr",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "change-pin",
+      "method": "POST",
+      "path": "/account/{sessionId}/change-pin",
+      "usage": "change-pin --pin=<pin> [--enable-login] [--for-duress-account]",
+      "help": "Set or change the PIN.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "pin",
+          "field": "pin",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "enable-login",
+          "field": "enableLogin",
+          "target": "body",
+          "kind": "boolean",
+          "required": false
+        },
+        {
+          "flag": "for-duress-account",
+          "field": "forDuressAccount",
+          "target": "body",
+          "kind": "boolean",
+          "required": false
+        }
+      ]
+    },
+    {
+      "command": "change-recovery",
+      "method": "POST",
+      "path": "/account/{sessionId}/change-recovery",
+      "usage": "change-recovery --question=<questions> … --answer=<answers> …",
+      "help": "Set recovery questions and answers.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "question",
+          "field": "questions",
+          "target": "body",
+          "kind": "repeat",
+          "required": true
+        },
+        {
+          "flag": "answer",
+          "field": "answers",
+          "target": "body",
+          "kind": "repeat",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "change-username",
+      "method": "POST",
+      "path": "/account/{sessionId}/change-username",
+      "usage": "change-username --username=<username> [--password=<password>]",
+      "help": "Change the username.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "username",
+          "field": "username",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "password",
+          "field": "password",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        }
+      ]
+    },
+    {
+      "command": "check-password",
+      "method": "POST",
+      "path": "/account/{sessionId}/check-password",
+      "usage": "check-password --password=<password>",
+      "help": "Verify a password.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "password",
+          "field": "password",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "check-password-rules",
+      "method": "GET",
+      "path": "/check-password-rules",
+      "usage": "check-password-rules --password=<password>",
+      "help": "Score a candidate password.",
+      "needsSession": false,
+      "args": [
+        {
+          "flag": "password",
+          "field": "password",
+          "target": "query",
+          "kind": "string",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "check-pin",
+      "method": "POST",
+      "path": "/account/{sessionId}/check-pin",
+      "usage": "check-pin --pin=<pin> [--for-duress-account]",
+      "help": "Verify a PIN.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "pin",
+          "field": "pin",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "for-duress-account",
+          "field": "forDuressAccount",
+          "target": "body",
+          "kind": "boolean",
+          "required": false
+        }
+      ]
+    },
+    {
+      "command": "close-swap-quote",
+      "method": "POST",
+      "path": "/account/{sessionId}/swap-quote/close/{objectId}",
+      "usage": "close-swap-quote <objectId>",
+      "help": "Discard a quote.",
+      "needsSession": true,
+      "pathPositional": "objectId",
+      "args": []
+    },
+    {
+      "command": "create-currency-wallet",
+      "method": "POST",
+      "path": "/account/{sessionId}/create-currency-wallet",
+      "usage": "create-currency-wallet --wallet-type=<walletType> [--name=<name>] [--import-text=<importText>]",
+      "help": "Create a currency wallet.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "wallet-type",
+          "field": "walletType",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "name",
+          "field": "name",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        },
+        {
+          "flag": "import-text",
+          "field": "importText",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        }
+      ]
+    },
+    {
+      "command": "create-currency-wallets",
+      "method": "POST",
+      "path": "/account/{sessionId}/create-currency-wallets",
+      "usage": "create-currency-wallets --create-wallets='<json>'",
+      "help": "Create several wallets at once.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "create-wallets",
+          "field": "createWallets",
+          "target": "body",
+          "kind": "json",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "create-wallet",
+      "method": "POST",
+      "path": "/account/{sessionId}/create-wallet",
+      "usage": "create-wallet --type=<type> [--keys='<json>']",
+      "help": "Create a wallet from raw key JSON.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "type",
+          "field": "type",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "keys",
+          "field": "keys",
+          "target": "body",
+          "kind": "json",
+          "required": false
+        }
+      ]
+    },
+    {
+      "command": "currency-configs",
+      "method": "GET",
+      "path": "/currency-configs",
+      "usage": "currency-configs",
+      "help": "List plugin ids usable for wallet creation.",
+      "needsSession": false,
+      "args": []
+    },
+    {
+      "command": "currency-wallets",
+      "method": "GET",
+      "path": "/account/{sessionId}/currency-wallets",
+      "usage": "currency-wallets [--filter=active|archived|hidden|all]",
+      "help": "List the account's wallets.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "filter",
+          "field": "filter",
+          "target": "query",
+          "kind": "string",
+          "required": false
+        }
+      ]
+    },
+    {
+      "command": "delete-item",
+      "method": "POST",
+      "path": "/account/{sessionId}/delete-item",
+      "usage": "delete-item --store-id=<storeId> --item-id=<itemId>",
+      "help": "Delete an item.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "store-id",
+          "field": "storeId",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "item-id",
+          "field": "itemId",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "delete-password",
+      "method": "POST",
+      "path": "/account/{sessionId}/delete-password",
+      "usage": "delete-password",
+      "help": "Remove password login.",
+      "needsSession": true,
+      "args": []
+    },
+    {
+      "command": "delete-pin",
+      "method": "POST",
+      "path": "/account/{sessionId}/delete-pin",
+      "usage": "delete-pin",
+      "help": "Remove the PIN.",
+      "needsSession": true,
+      "args": []
+    },
+    {
+      "command": "delete-recovery",
+      "method": "POST",
+      "path": "/account/{sessionId}/delete-recovery",
+      "usage": "delete-recovery",
+      "help": "Disable recovery login.",
+      "needsSession": true,
+      "args": []
+    },
+    {
+      "command": "delete-store",
+      "method": "POST",
+      "path": "/account/{sessionId}/delete-store",
+      "usage": "delete-store --store-id=<storeId>",
+      "help": "Delete an entire store.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "store-id",
+          "field": "storeId",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "disable-otp",
+      "method": "POST",
+      "path": "/account/{sessionId}/disable-otp",
+      "usage": "disable-otp",
+      "help": "Disable 2FA.",
+      "needsSession": true,
+      "args": []
+    },
+    {
+      "command": "dump-data",
+      "method": "GET",
+      "path": "/account/{sessionId}/wallet/dump-data",
+      "usage": "dump-data --wallet-id=<walletId>",
+      "help": "Dump wallet engine state.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "wallet-id",
+          "field": "walletId",
+          "target": "query",
+          "kind": "string",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "enable-otp",
+      "method": "POST",
+      "path": "/account/{sessionId}/enable-otp",
+      "usage": "enable-otp [--timeout=<timeout>]",
+      "help": "Enable 2FA.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "timeout",
+          "field": "timeout",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        }
+      ]
+    },
+    {
+      "command": "encode-uri",
+      "method": "POST",
+      "path": "/account/{sessionId}/wallet/encode-uri",
+      "usage": "encode-uri --wallet-id=<walletId> --public-address=<publicAddress> [--native-amount=<nativeAmount>] [--label=<label>] [--message=<message>] [--currency-code=<currencyCode>]",
+      "help": "Build a payment URI.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "wallet-id",
+          "field": "walletId",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "public-address",
+          "field": "publicAddress",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "native-amount",
+          "field": "nativeAmount",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        },
+        {
+          "flag": "label",
+          "field": "label",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        },
+        {
+          "flag": "message",
+          "field": "message",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        },
+        {
+          "flag": "currency-code",
+          "field": "currencyCode",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        }
+      ]
+    },
+    {
+      "command": "engine-config",
+      "method": "GET",
+      "path": "/engine/config",
+      "usage": "engine-config",
+      "help": "Configured context options.",
+      "needsSession": false,
+      "args": []
+    },
+    {
+      "command": "engine-sessions",
+      "method": "GET",
+      "path": "/engine/sessions",
+      "usage": "engine-sessions",
+      "help": "List active sessions.",
+      "needsSession": false,
+      "args": []
+    },
+    {
+      "command": "engine-status",
+      "method": "GET",
+      "path": "/engine/status",
+      "usage": "engine-status",
+      "help": "Engine liveness and summary.",
+      "needsSession": false,
+      "args": []
+    },
+    {
+      "command": "engine-stop",
+      "method": "POST",
+      "path": "/engine/stop",
+      "usage": "engine-stop",
+      "help": "Stop the engine.",
+      "needsSession": false,
+      "args": []
+    },
+    {
+      "command": "fetch-challenge",
+      "method": "POST",
+      "path": "/fetch-challenge",
+      "usage": "fetch-challenge",
+      "help": "Pre-fetch a CAPTCHA challenge.",
+      "needsSession": false,
+      "args": []
+    },
+    {
+      "command": "fetch-lobby",
+      "method": "GET",
+      "path": "/account/{sessionId}/fetch-lobby/{lobbyId}",
+      "usage": "fetch-lobby <lobbyId>",
+      "help": "Inspect a login request.",
+      "needsSession": true,
+      "pathPositional": "lobbyId",
+      "args": []
+    },
+    {
+      "command": "fetch-login-messages",
+      "method": "GET",
+      "path": "/fetch-login-messages",
+      "usage": "fetch-login-messages",
+      "help": "Fetch login-server messages for every local user.",
+      "needsSession": false,
+      "args": []
+    },
+    {
+      "command": "fetch-recovery-questions",
+      "method": "GET",
+      "path": "/fetch-recovery-questions",
+      "usage": "fetch-recovery-questions --recovery-key=<recoveryKey> --username=<username>",
+      "help": "Fetch a user’s recovery questions.",
+      "needsSession": false,
+      "args": [
+        {
+          "flag": "recovery-key",
+          "field": "recoveryKey",
+          "target": "query",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "username",
+          "field": "username",
+          "target": "query",
+          "kind": "string",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "fetch-swap-quotes",
+      "method": "POST",
+      "path": "/account/{sessionId}/fetch-swap-quotes",
+      "usage": "fetch-swap-quotes --from-wallet-id=<fromWalletId> --to-wallet-id=<toWalletId> --native-amount=<nativeAmount> [--from-token-id=<fromTokenId>] [--to-token-id=<toTokenId>] [--quote-for=<quoteFor>] [--plugin-id=<preferPluginId>]",
+      "help": "Fetch swap quotes.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "from-wallet-id",
+          "field": "fromWalletId",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "to-wallet-id",
+          "field": "toWalletId",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "native-amount",
+          "field": "nativeAmount",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "from-token-id",
+          "field": "fromTokenId",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        },
+        {
+          "flag": "to-token-id",
+          "field": "toTokenId",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        },
+        {
+          "flag": "quote-for",
+          "field": "quoteFor",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        },
+        {
+          "flag": "plugin-id",
+          "field": "preferPluginId",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        }
+      ]
+    },
+    {
+      "command": "fix-username",
+      "method": "GET",
+      "path": "/fix-username",
+      "usage": "fix-username --username=<username>",
+      "help": "Normalize a username.",
+      "needsSession": false,
+      "args": [
+        {
+          "flag": "username",
+          "field": "username",
+          "target": "query",
+          "kind": "string",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "forget-account",
+      "method": "POST",
+      "path": "/forget-account",
+      "usage": "forget-account --root-login-id=<rootLoginId>",
+      "help": "Forget an account on this device.",
+      "needsSession": false,
+      "args": [
+        {
+          "flag": "root-login-id",
+          "field": "rootLoginId",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "get-addresses",
+      "method": "GET",
+      "path": "/account/{sessionId}/wallet/get-addresses",
+      "usage": "get-addresses --wallet-id=<walletId> [--token-id=<tokenId>] [--force-index=<forceIndex>]",
+      "help": "Receive addresses.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "wallet-id",
+          "field": "walletId",
+          "target": "query",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "token-id",
+          "field": "tokenId",
+          "target": "query",
+          "kind": "string",
+          "required": false
+        },
+        {
+          "flag": "force-index",
+          "field": "forceIndex",
+          "target": "query",
+          "kind": "string",
+          "required": false
+        }
+      ]
+    },
+    {
+      "command": "get-display-private-key",
+      "method": "GET",
+      "path": "/account/{sessionId}/get-display-private-key",
+      "usage": "get-display-private-key --wallet-id=<walletId>",
+      "help": "Export the private key for display.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "wallet-id",
+          "field": "walletId",
+          "target": "query",
+          "kind": "string",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "get-display-public-key",
+      "method": "GET",
+      "path": "/account/{sessionId}/get-display-public-key",
+      "usage": "get-display-public-key --wallet-id=<walletId>",
+      "help": "Export the public key for display.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "wallet-id",
+          "field": "walletId",
+          "target": "query",
+          "kind": "string",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "get-item",
+      "method": "GET",
+      "path": "/account/{sessionId}/get-item",
+      "usage": "get-item --store-id=<storeId> --item-id=<itemId>",
+      "help": "Read an item.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "store-id",
+          "field": "storeId",
+          "target": "query",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "item-id",
+          "field": "itemId",
+          "target": "query",
+          "kind": "string",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "get-login-key",
+      "method": "GET",
+      "path": "/account/{sessionId}/get-login-key",
+      "usage": "get-login-key",
+      "help": "Read the account login key.",
+      "needsSession": true,
+      "args": []
+    },
+    {
+      "command": "get-max-spendable",
+      "method": "POST",
+      "path": "/account/{sessionId}/wallet/get-max-spendable",
+      "usage": "get-max-spendable --wallet-id=<walletId> [--spend-info='<json>'] [--to=<to>] [--native-amount=<nativeAmount>] [--amount=<amount>] [--token-id=<tokenId>] [--metadata='<json>']",
+      "help": "Largest sendable amount.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "wallet-id",
+          "field": "walletId",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "spend-info",
+          "field": "spendInfo",
+          "target": "body",
+          "kind": "json",
+          "required": false
+        },
+        {
+          "flag": "to",
+          "field": "to",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        },
+        {
+          "flag": "native-amount",
+          "field": "nativeAmount",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        },
+        {
+          "flag": "amount",
+          "field": "amount",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        },
+        {
+          "flag": "token-id",
+          "field": "tokenId",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        },
+        {
+          "flag": "metadata",
+          "field": "metadata",
+          "target": "body",
+          "kind": "json",
+          "required": false
+        }
+      ]
+    },
+    {
+      "command": "get-num-transactions",
+      "method": "GET",
+      "path": "/account/{sessionId}/wallet/get-num-transactions",
+      "usage": "get-num-transactions --wallet-id=<walletId> [--token-id=<tokenId>]",
+      "help": "Count transactions in a wallet.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "wallet-id",
+          "field": "walletId",
+          "target": "query",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "token-id",
+          "field": "tokenId",
+          "target": "query",
+          "kind": "string",
+          "required": false
+        }
+      ]
+    },
+    {
+      "command": "get-payment-protocol-info",
+      "method": "GET",
+      "path": "/account/{sessionId}/wallet/get-payment-protocol-info",
+      "usage": "get-payment-protocol-info --wallet-id=<walletId> --payment-protocol-url=<paymentProtocolUrl>",
+      "help": "Fetch a BIP70 payment request.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "wallet-id",
+          "field": "walletId",
+          "target": "query",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "payment-protocol-url",
+          "field": "paymentProtocolUrl",
+          "target": "query",
+          "kind": "string",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "get-pin",
+      "method": "GET",
+      "path": "/account/{sessionId}/get-pin",
+      "usage": "get-pin",
+      "help": "Read the account PIN.",
+      "needsSession": true,
+      "args": []
+    },
+    {
+      "command": "get-raw-private-key",
+      "method": "GET",
+      "path": "/account/{sessionId}/get-raw-private-key",
+      "usage": "get-raw-private-key --wallet-id=<walletId>",
+      "help": "Read raw private key material.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "wallet-id",
+          "field": "walletId",
+          "target": "query",
+          "kind": "string",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "get-raw-public-key",
+      "method": "GET",
+      "path": "/account/{sessionId}/get-raw-public-key",
+      "usage": "get-raw-public-key --wallet-id=<walletId>",
+      "help": "Read raw public key material.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "wallet-id",
+          "field": "walletId",
+          "target": "query",
+          "kind": "string",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "get-wallet-info",
+      "method": "GET",
+      "path": "/account/{sessionId}/get-wallet-info",
+      "usage": "get-wallet-info --id=<id>",
+      "help": "Read one wallet's key info.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "id",
+          "field": "id",
+          "target": "query",
+          "kind": "string",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "list-item-ids",
+      "method": "GET",
+      "path": "/account/{sessionId}/list-item-ids",
+      "usage": "list-item-ids --store-id=<storeId>",
+      "help": "List item ids in a store.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "store-id",
+          "field": "storeId",
+          "target": "query",
+          "kind": "string",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "list-splittable-wallet-types",
+      "method": "GET",
+      "path": "/account/{sessionId}/list-splittable-wallet-types",
+      "usage": "list-splittable-wallet-types --wallet-id=<walletId>",
+      "help": "List chains a wallet can split into.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "wallet-id",
+          "field": "walletId",
+          "target": "query",
+          "kind": "string",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "list-store-ids",
+      "method": "GET",
+      "path": "/account/{sessionId}/list-store-ids",
+      "usage": "list-store-ids",
+      "help": "List data-store ids.",
+      "needsSession": true,
+      "args": []
+    },
+    {
+      "command": "local-users",
+      "method": "GET",
+      "path": "/local-users",
+      "usage": "local-users",
+      "help": "List local users on this device.",
+      "needsSession": false,
+      "args": []
+    },
+    {
+      "command": "make-spend",
+      "method": "POST",
+      "path": "/account/{sessionId}/wallet/make-spend",
+      "usage": "make-spend --wallet-id=<walletId> [--spend-info='<json>'] [--to=<to>] [--native-amount=<nativeAmount>] [--amount=<amount>] [--token-id=<tokenId>] [--metadata='<json>']",
+      "help": "Build an unsigned transaction.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "wallet-id",
+          "field": "walletId",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "spend-info",
+          "field": "spendInfo",
+          "target": "body",
+          "kind": "json",
+          "required": false
+        },
+        {
+          "flag": "to",
+          "field": "to",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        },
+        {
+          "flag": "native-amount",
+          "field": "nativeAmount",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        },
+        {
+          "flag": "amount",
+          "field": "amount",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        },
+        {
+          "flag": "token-id",
+          "field": "tokenId",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        },
+        {
+          "flag": "metadata",
+          "field": "metadata",
+          "target": "body",
+          "kind": "json",
+          "required": false
+        }
+      ]
+    },
+    {
+      "command": "object-delete",
+      "method": "POST",
+      "path": "/account/{sessionId}/object/delete/{objectId}",
+      "usage": "object-delete <objectId>",
+      "help": "Release an object handle.",
+      "needsSession": true,
+      "pathPositional": "objectId",
+      "args": []
+    },
+    {
+      "command": "object-get",
+      "method": "GET",
+      "path": "/account/{sessionId}/object/{objectId}",
+      "usage": "object-get <objectId>",
+      "help": "Inspect an object handle.",
+      "needsSession": true,
+      "pathPositional": "objectId",
+      "args": []
+    },
+    {
+      "command": "otp-key",
+      "method": "GET",
+      "path": "/account/{sessionId}/otp-key",
+      "usage": "otp-key",
+      "help": "Read the 2FA secret and reset state.",
+      "needsSession": true,
+      "args": []
+    },
+    {
+      "command": "parse-uri",
+      "method": "POST",
+      "path": "/account/{sessionId}/wallet/parse-uri",
+      "usage": "parse-uri --wallet-id=<walletId> --uri=<uri> [--currency-code=<currencyCode>]",
+      "help": "Parse a payment URI or address.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "wallet-id",
+          "field": "walletId",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "uri",
+          "field": "uri",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "currency-code",
+          "field": "currencyCode",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        }
+      ]
+    },
+    {
+      "command": "pending-vouchers",
+      "method": "GET",
+      "path": "/account/{sessionId}/pending-vouchers",
+      "usage": "pending-vouchers",
+      "help": "List pending 2FA vouchers.",
+      "needsSession": true,
+      "args": []
+    },
+    {
+      "command": "rates-query",
+      "method": "POST",
+      "path": "/rates/query",
+      "usage": "rates-query [--crypto='<json>'] [--fiat='<json>']",
+      "help": "Batch crypto and fiat rate lookups.",
+      "needsSession": false,
+      "args": [
+        {
+          "flag": "crypto",
+          "field": "crypto",
+          "target": "body",
+          "kind": "json",
+          "required": false
+        },
+        {
+          "flag": "fiat",
+          "field": "fiat",
+          "target": "body",
+          "kind": "json",
+          "required": false
+        }
+      ]
+    },
+    {
+      "command": "rates-usd-to-native",
+      "method": "POST",
+      "path": "/rates/usd-to-native",
+      "usage": "rates-usd-to-native --usd-amount=<usdAmount> --plugin-id=<pluginId> [--token-id=<tokenId>] [--multiplier=<multiplier>] [--date=<date>]",
+      "help": "Convert a USD amount into native units.",
+      "needsSession": false,
+      "args": [
+        {
+          "flag": "usd-amount",
+          "field": "usdAmount",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "plugin-id",
+          "field": "pluginId",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "token-id",
+          "field": "tokenId",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        },
+        {
+          "flag": "multiplier",
+          "field": "multiplier",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        },
+        {
+          "flag": "date",
+          "field": "date",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        }
+      ]
+    },
+    {
+      "command": "reject-voucher",
+      "method": "POST",
+      "path": "/account/{sessionId}/reject-voucher",
+      "usage": "reject-voucher --voucher-id=<voucherId>",
+      "help": "Reject a voucher.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "voucher-id",
+          "field": "voucherId",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "rename-wallet",
+      "method": "POST",
+      "path": "/account/{sessionId}/wallet/rename-wallet",
+      "usage": "rename-wallet --wallet-id=<walletId> --name=<name>",
+      "help": "Rename a wallet.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "wallet-id",
+          "field": "walletId",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "name",
+          "field": "name",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "repair-otp",
+      "method": "POST",
+      "path": "/account/{sessionId}/repair-otp",
+      "usage": "repair-otp --otp-key=<otpKey>",
+      "help": "Re-point the account at a known 2FA secret.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "otp-key",
+          "field": "otpKey",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "request-otp-reset",
+      "method": "POST",
+      "path": "/request-otp-reset",
+      "usage": "request-otp-reset --username=<username> --otp-reset-token=<otpResetToken>",
+      "help": "Request a 2FA reset.",
+      "needsSession": false,
+      "args": [
+        {
+          "flag": "username",
+          "field": "username",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "otp-reset-token",
+          "field": "otpResetToken",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "resync-blockchain",
+      "method": "POST",
+      "path": "/account/{sessionId}/wallet/resync-blockchain",
+      "usage": "resync-blockchain --wallet-id=<walletId>",
+      "help": "Rescan the blockchain from scratch.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "wallet-id",
+          "field": "walletId",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "save-tx",
+      "method": "POST",
+      "path": "/account/{sessionId}/save-tx/{objectId}",
+      "usage": "save-tx <objectId>",
+      "help": "Record a transaction and release its handle.",
+      "needsSession": true,
+      "pathPositional": "objectId",
+      "args": []
+    },
+    {
+      "command": "save-tx-action",
+      "method": "POST",
+      "path": "/account/{sessionId}/wallet/save-tx-action",
+      "usage": "save-tx-action --wallet-id=<walletId> --txid=<txid> [--token-id=<tokenId>] --saved-action='<json>' [--asset-action='<json>']",
+      "help": "Save a transaction action.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "wallet-id",
+          "field": "walletId",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "txid",
+          "field": "txid",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "token-id",
+          "field": "tokenId",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        },
+        {
+          "flag": "saved-action",
+          "field": "savedAction",
+          "target": "body",
+          "kind": "json",
+          "required": true
+        },
+        {
+          "flag": "asset-action",
+          "field": "assetAction",
+          "target": "body",
+          "kind": "json",
+          "required": false
+        }
+      ]
+    },
+    {
+      "command": "save-tx-metadata",
+      "method": "POST",
+      "path": "/account/{sessionId}/wallet/save-tx-metadata",
+      "usage": "save-tx-metadata --wallet-id=<walletId> --txid=<txid> [--token-id=<tokenId>] --metadata='<json>'",
+      "help": "Save transaction metadata.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "wallet-id",
+          "field": "walletId",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "txid",
+          "field": "txid",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "token-id",
+          "field": "tokenId",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        },
+        {
+          "flag": "metadata",
+          "field": "metadata",
+          "target": "body",
+          "kind": "json",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "set-fiat-currency-code",
+      "method": "POST",
+      "path": "/account/{sessionId}/wallet/set-fiat-currency-code",
+      "usage": "set-fiat-currency-code --wallet-id=<walletId> --fiat-currency-code=<fiatCurrencyCode>",
+      "help": "Change a wallet's fiat currency.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "wallet-id",
+          "field": "walletId",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "fiat-currency-code",
+          "field": "fiatCurrencyCode",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "set-item",
+      "method": "POST",
+      "path": "/account/{sessionId}/set-item",
+      "usage": "set-item --store-id=<storeId> --item-id=<itemId> --value=<value>",
+      "help": "Write an item.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "store-id",
+          "field": "storeId",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "item-id",
+          "field": "itemId",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "value",
+          "field": "value",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "sign-bytes",
+      "method": "POST",
+      "path": "/account/{sessionId}/wallet/sign-bytes",
+      "usage": "sign-bytes --wallet-id=<walletId> [--bytes=<bytes>] [--other-params='<json>']",
+      "help": "Sign arbitrary bytes.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "wallet-id",
+          "field": "walletId",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "bytes",
+          "field": "bytes",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        },
+        {
+          "flag": "other-params",
+          "field": "otherParams",
+          "target": "body",
+          "kind": "json",
+          "required": false
+        }
+      ]
+    },
+    {
+      "command": "sign-tx",
+      "method": "POST",
+      "path": "/account/{sessionId}/sign-tx/{objectId}",
+      "usage": "sign-tx <objectId>",
+      "help": "Sign a staged transaction.",
+      "needsSession": true,
+      "pathPositional": "objectId",
+      "args": []
+    },
+    {
+      "command": "spend",
+      "method": "POST",
+      "path": "/account/{sessionId}/wallet/spend",
+      "usage": "spend --wallet-id=<walletId> [--spend-info='<json>'] [--to=<to>] [--native-amount=<nativeAmount>] [--amount=<amount>] [--token-id=<tokenId>] [--metadata='<json>'] [--use-max] [--dry-run] [--broadcast] [--save]",
+      "help": "Send funds.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "wallet-id",
+          "field": "walletId",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "spend-info",
+          "field": "spendInfo",
+          "target": "body",
+          "kind": "json",
+          "required": false
+        },
+        {
+          "flag": "to",
+          "field": "to",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        },
+        {
+          "flag": "native-amount",
+          "field": "nativeAmount",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        },
+        {
+          "flag": "amount",
+          "field": "amount",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        },
+        {
+          "flag": "token-id",
+          "field": "tokenId",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        },
+        {
+          "flag": "metadata",
+          "field": "metadata",
+          "target": "body",
+          "kind": "json",
+          "required": false
+        },
+        {
+          "flag": "use-max",
+          "field": "useMax",
+          "target": "body",
+          "kind": "boolean",
+          "required": false
+        },
+        {
+          "flag": "dry-run",
+          "field": "dryRun",
+          "target": "body",
+          "kind": "boolean",
+          "required": false
+        },
+        {
+          "flag": "broadcast",
+          "field": "broadcast",
+          "target": "body",
+          "kind": "boolean",
+          "required": false
+        },
+        {
+          "flag": "save",
+          "field": "save",
+          "target": "body",
+          "kind": "boolean",
+          "required": false
+        }
+      ]
+    },
+    {
+      "command": "spend-max",
+      "method": "POST",
+      "path": "/account/{sessionId}/wallet/spend",
+      "usage": "spend-max --wallet-id=<walletId> [--spend-info='<json>'] [--to=<to>] [--native-amount=<nativeAmount>] [--amount=<amount>] [--token-id=<tokenId>] [--metadata='<json>'] [--use-max] [--dry-run] [--broadcast] [--save]",
+      "help": "Send funds.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "wallet-id",
+          "field": "walletId",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "spend-info",
+          "field": "spendInfo",
+          "target": "body",
+          "kind": "json",
+          "required": false
+        },
+        {
+          "flag": "to",
+          "field": "to",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        },
+        {
+          "flag": "native-amount",
+          "field": "nativeAmount",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        },
+        {
+          "flag": "amount",
+          "field": "amount",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        },
+        {
+          "flag": "token-id",
+          "field": "tokenId",
+          "target": "body",
+          "kind": "string",
+          "required": false
+        },
+        {
+          "flag": "metadata",
+          "field": "metadata",
+          "target": "body",
+          "kind": "json",
+          "required": false
+        },
+        {
+          "flag": "use-max",
+          "field": "useMax",
+          "target": "body",
+          "kind": "boolean",
+          "required": false
+        },
+        {
+          "flag": "dry-run",
+          "field": "dryRun",
+          "target": "body",
+          "kind": "boolean",
+          "required": false
+        },
+        {
+          "flag": "broadcast",
+          "field": "broadcast",
+          "target": "body",
+          "kind": "boolean",
+          "required": false
+        },
+        {
+          "flag": "save",
+          "field": "save",
+          "target": "body",
+          "kind": "boolean",
+          "required": false
+        }
+      ],
+      "preset": {
+        "useMax": true
+      }
+    },
+    {
+      "command": "split",
+      "method": "POST",
+      "path": "/account/{sessionId}/wallet/split",
+      "usage": "split --wallet-id=<walletId> --split-wallets='<json>'",
+      "help": "Split a wallet into another chain.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "wallet-id",
+          "field": "walletId",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "split-wallets",
+          "field": "splitWallets",
+          "target": "body",
+          "kind": "json",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "swap-quote-get",
+      "method": "GET",
+      "path": "/account/{sessionId}/swap-quote/{objectId}",
+      "usage": "swap-quote-get <objectId>",
+      "help": "Re-read a quote.",
+      "needsSession": true,
+      "pathPositional": "objectId",
+      "args": []
+    },
+    {
+      "command": "sweep-private-keys",
+      "method": "POST",
+      "path": "/account/{sessionId}/wallet/sweep-private-keys",
+      "usage": "sweep-private-keys --wallet-id=<walletId> --spend-info='<json>'",
+      "help": "Sweep private keys into this wallet.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "wallet-id",
+          "field": "walletId",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "spend-info",
+          "field": "spendInfo",
+          "target": "body",
+          "kind": "json",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "sync",
+      "method": "POST",
+      "path": "/account/{sessionId}/sync",
+      "usage": "sync",
+      "help": "Force an account data sync.",
+      "needsSession": true,
+      "args": []
+    },
+    {
+      "command": "touch",
+      "method": "POST",
+      "path": "/account/{sessionId}/touch",
+      "usage": "touch",
+      "help": "Keepalive.",
+      "needsSession": true,
+      "args": []
+    },
+    {
+      "command": "username-available",
+      "method": "GET",
+      "path": "/username-available",
+      "usage": "username-available --username=<username> [--challenge-id=<challengeId>]",
+      "help": "Check whether a username is free.",
+      "needsSession": false,
+      "args": [
+        {
+          "flag": "username",
+          "field": "username",
+          "target": "query",
+          "kind": "string",
+          "required": true
+        },
+        {
+          "flag": "challenge-id",
+          "field": "challengeId",
+          "target": "query",
+          "kind": "string",
+          "required": false
+        }
+      ]
+    },
+    {
+      "command": "wait-for-all-wallets",
+      "method": "POST",
+      "path": "/account/{sessionId}/wait-for-all-wallets",
+      "usage": "wait-for-all-wallets",
+      "help": "Wait for every wallet to finish loading.",
+      "needsSession": true,
+      "args": []
+    },
+    {
+      "command": "wallet-info",
+      "method": "GET",
+      "path": "/account/{sessionId}/wallet",
+      "usage": "wallet-info --wallet-id=<walletId>",
+      "help": "Wallet detail.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "wallet-id",
+          "field": "walletId",
+          "target": "query",
+          "kind": "string",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "wallet-sync",
+      "method": "POST",
+      "path": "/account/{sessionId}/wallet/sync",
+      "usage": "wallet-sync --wallet-id=<walletId>",
+      "help": "Nudge one wallet to sync.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "wallet-id",
+          "field": "walletId",
+          "target": "body",
+          "kind": "string",
+          "required": true
+        }
+      ]
+    },
+    {
+      "command": "wallet-tokens",
+      "method": "GET",
+      "path": "/account/{sessionId}/wallet/tokens",
+      "usage": "wallet-tokens --wallet-id=<walletId>",
+      "help": "List a wallet's tokens.",
+      "needsSession": true,
+      "args": [
+        {
+          "flag": "wallet-id",
+          "field": "walletId",
+          "target": "query",
+          "kind": "string",
+          "required": true
+        }
+      ]
+    }
+  ]
+}
diff --git a/src/cli/generated/helpDocs.json b/src/cli/generated/helpDocs.json
new file mode 100644
index 00000000000..627ffed7c53
--- /dev/null
+++ b/src/cli/generated/helpDocs.json
@@ -0,0 +1,3121 @@
+{
+  "$comment": "GENERATED FILE — DO NOT EDIT. Produced by scripts/buildCliHelp.ts from the route declarations in src/cli/engine/routes. Edit the declaration, then run `npm run prepare` (or `npm run docs:api`).",
+  "commands": {
+    "accelerate": {
+      "summary": "Fee-bump a pending transaction.",
+      "method": "POST",
+      "path": "/account/{sessionId}/wallet/accelerate",
+      "usage": "accelerate --wallet-id=<walletId> [--object-id=<objectId>] [--transaction='<json>']",
+      "description": "Replace-by-fee, where the plugin supports it. Returns a new unsigned transaction to sign and broadcast.",
+      "core": "wallet.accelerate",
+      "params": {
+        "walletId": {
+          "pass": "--wallet-id=<walletId>",
+          "doc": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+          "optional": false
+        },
+        "objectId": {
+          "pass": "[--object-id=<objectId>]",
+          "doc": "Handle of the transaction to bump.",
+          "optional": true
+        },
+        "transaction": {
+          "pass": "[--transaction='<json>']",
+          "doc": "Or the transaction itself.",
+          "optional": true
+        }
+      },
+      "returns": {
+        "objectId": "string — Handle for the value the engine is holding. Pass it to the calls that consume it.",
+        "kind": "string — What the handle refers to, which decides the calls that accept it.",
+        "expiresAt": "string — When the engine drops the handle. Handles live 5 minutes.",
+        "sessionId?": "string — Session that created the handle; only that session may use it.",
+        "walletId?": "string — Wallet the handle is bound to, when it belongs to one.",
+        "transaction": "unknown — `EdgeTransaction` as it stands after this step. Unsigned after `make-spend`, signed after `sign-tx`, and carrying a txid once broadcast."
+      },
+      "returnsDoc": "Given objectId the same handle is updated; given a transaction a new one is created.",
+      "notes": [
+        "A plugin that cannot accelerate returns 400 rather than a null transaction."
+      ],
+      "errors": [
+        "BAD_REQUEST"
+      ]
+    },
+    "account-info": {
+      "summary": "Account and session summary.",
+      "method": "GET",
+      "path": "/account/{sessionId}",
+      "usage": "account-info",
+      "description": "Session fields are spread at the top level alongside the account's own properties — there is no nested `session` object.",
+      "returns": {
+        "appId": "string — Application this session logged into.",
+        "created": "string | null — When the account was created, null for accounts predating the field.",
+        "lastLogin": "string — The previous login, not this one.",
+        "loggedIn": "boolean — False once the account has been logged out; the session object outlives it briefly.",
+        "recoveryKey": "string | null — Present only while recovery is configured.",
+        "otpEnabled": "boolean — 2FA is on for this account.",
+        "otpResetPending": "boolean — True while somebody has a reset pending against this account.",
+        "canDuressLogin": "boolean — A duress PIN is configured, so this account can be opened in duress mode.",
+        "isDuressAccount": "boolean — True when this very session is the duress account rather than the real one.",
+        "edgeLogin": "boolean — This account was reached by QR login.",
+        "keyLogin": "boolean — This session was reached with a login key.",
+        "newAccount": "boolean — This session created the account rather than logging into an existing one.",
+        "passwordLogin": "boolean — This session was reached with a password.",
+        "pinLogin": "boolean — This session was reached with a PIN.",
+        "recoveryLogin": "boolean — This session was reached by answering recovery questions."
+      },
+      "notes": [
+        "The `otpEnabled` and `otpResetPending` flags here are derived. For the secret itself use `otp-key`."
+      ]
+    },
+    "admin-auth-request": {
+      "summary": "Raw login-server request.",
+      "method": "POST",
+      "path": "/admin/auth-request",
+      "usage": "admin-auth-request --method=<method> --path=<path> [--body='<json>']",
+      "description": "Sends an arbitrary request with the context's credentials attached. Debugging only — this is core's private surface.",
+      "core": "context.$internalStuff.authRequest",
+      "params": {
+        "method": {
+          "pass": "--method=<method>",
+          "doc": "HTTP method, e.g. `GET`.",
+          "optional": false
+        },
+        "path": {
+          "pass": "--path=<path>",
+          "doc": "Login-server path, not an engine path.",
+          "optional": false
+        },
+        "body": {
+          "pass": "[--body='<json>']",
+          "doc": "Request body, when the method takes one.",
+          "optional": true
+        }
+      },
+      "returnsDoc": "Whatever the login server returned.",
+      "errors": [
+        "BAD_REQUEST",
+        "NETWORK_ERROR"
+      ]
+    },
+    "admin-fetch-lobby-request": {
+      "summary": "Read a lobby's contents.",
+      "method": "GET",
+      "path": "/admin/fetch-lobby-request/{lobbyId}",
+      "usage": "admin-fetch-lobby-request <lobbyId>",
+      "core": "context.$internalStuff.fetchLobbyRequest",
+      "params": {
+        "lobbyId": {
+          "pass": "<lobbyId>",
+          "doc": "Which lobby to read.",
+          "optional": false
+        }
+      },
+      "returnsDoc": "The raw lobby request.",
+      "errors": [
+        "NETWORK_ERROR"
+      ]
+    },
+    "admin-hash-username": {
+      "summary": "Hash a username.",
+      "method": "GET",
+      "path": "/admin/hash-username",
+      "usage": "admin-hash-username --username=<username>",
+      "description": "Reproduces the login server's hashing, to derive a login id offline.",
+      "core": "context.$internalStuff.hashUsername",
+      "params": {
+        "username": {
+          "pass": "--username=<username>",
+          "doc": "The name to hash.",
+          "optional": false
+        }
+      },
+      "returns": {
+        "loginId": "string — Base58."
+      }
+    },
+    "admin-lobby-handle-delete": {
+      "summary": "Close a parked lobby.",
+      "method": "POST",
+      "path": "/admin/lobby-handle/delete/{objectId}",
+      "usage": "admin-lobby-handle-delete <objectId>",
+      "returns": {
+        "ok": "boolean — Always true; a failure arrives as an error envelope."
+      },
+      "notes": [
+        "Not under `/account/{sessionId}/objects/`, because admin lobbies belong to no session."
+      ],
+      "errors": [
+        "OBJECT_NOT_FOUND"
+      ]
+    },
+    "admin-make-lobby": {
+      "summary": "Create a lobby.",
+      "method": "POST",
+      "path": "/admin/make-lobby",
+      "usage": "admin-make-lobby [--lobby-request='<json>'] [--period-seconds='<json>']",
+      "description": "A lobby polls the login server until closed, so the engine parks it under a `lobby_` handle and closes it on expiry rather than leaking the poll.",
+      "core": "context.$internalStuff.makeLobby",
+      "params": {
+        "lobbyRequest": {
+          "pass": "[--lobby-request='<json>']",
+          "doc": "Defaults to `{}`.",
+          "optional": true
+        },
+        "period": {
+          "pass": "[--period-seconds='<json>']",
+          "doc": "Poll interval in seconds.",
+          "optional": true
+        }
+      },
+      "returns": {
+        "objectId": "string — The parked handle.",
+        "expiresAt": "string — When the engine closes the lobby and stops polling.",
+        "lobbyId": "string — Identifies the lobby to the party joining it.",
+        "replies": "unknown[] — Empty at creation; re-read to see replies."
+      },
+      "notes": [
+        "Release it with `admin-lobby-handle-delete`, or the poll runs for the full five minutes."
+      ],
+      "errors": [
+        "NETWORK_ERROR"
+      ]
+    },
+    "admin-repo-delete": {
+      "summary": "Delete a repo file.",
+      "method": "POST",
+      "path": "/admin/repo-delete/{syncKey}",
+      "usage": "admin-repo-delete <syncKey> --path=<path> --data-key=<dataKey>",
+      "description": "Destructive, and not undoable from this API.",
+      "core": "context.$internalStuff.getRepoDisklet",
+      "params": {
+        "path": {
+          "pass": "--path=<path>",
+          "doc": "Path within the repo.",
+          "optional": false
+        },
+        "syncKey": {
+          "pass": "<syncKey>",
+          "doc": "Base58 repo sync key.",
+          "optional": false
+        },
+        "dataKey": {
+          "pass": "--data-key=<dataKey>",
+          "doc": "Base58 repo data key.",
+          "optional": false
+        }
+      },
+      "errors": [
+        "BAD_REQUEST"
+      ]
+    },
+    "admin-repo-get": {
+      "summary": "Read a repo file.",
+      "method": "GET",
+      "path": "/admin/repo-get/{syncKey}",
+      "usage": "admin-repo-get <syncKey> --path=<path> --data-key=<dataKey>",
+      "core": "context.$internalStuff.getRepoDisklet",
+      "params": {
+        "path": {
+          "pass": "--path=<path>",
+          "doc": "Path within the repo.",
+          "optional": false
+        },
+        "syncKey": {
+          "pass": "<syncKey>",
+          "doc": "Base58 repo sync key.",
+          "optional": false
+        },
+        "dataKey": {
+          "pass": "--data-key=<dataKey>",
+          "doc": "Base58 repo data key.",
+          "optional": false
+        }
+      },
+      "returns": {
+        "text": "string — The file contents."
+      },
+      "errors": [
+        "NOT_FOUND",
+        "BAD_REQUEST"
+      ]
+    },
+    "admin-repo-list": {
+      "summary": "List repo contents.",
+      "method": "GET",
+      "path": "/admin/repo-list/{syncKey}",
+      "usage": "admin-repo-list <syncKey> [--path=<path>] --data-key=<dataKey>",
+      "core": "context.$internalStuff.getRepoDisklet",
+      "params": {
+        "path": {
+          "pass": "[--path=<path>]",
+          "doc": "Subdirectory. Defaults to the repo root.",
+          "optional": true
+        },
+        "syncKey": {
+          "pass": "<syncKey>",
+          "doc": "Base58 repo sync key.",
+          "optional": false
+        },
+        "dataKey": {
+          "pass": "--data-key=<dataKey>",
+          "doc": "Base58 repo data key.",
+          "optional": false
+        }
+      },
+      "returns": {
+        "listing": "unknown — Path to entry type: `file` or `folder`."
+      },
+      "errors": [
+        "BAD_REQUEST"
+      ]
+    },
+    "admin-repo-set": {
+      "summary": "Write a repo file.",
+      "method": "POST",
+      "path": "/admin/repo-set/{syncKey}",
+      "usage": "admin-repo-set <syncKey> --path=<path> --text=<text> --data-key=<dataKey>",
+      "description": "Writes directly into a synced repo, bypassing every core-level invariant. A malformed write can break the account for real clients.",
+      "core": "context.$internalStuff.getRepoDisklet",
+      "params": {
+        "path": {
+          "pass": "--path=<path>",
+          "doc": "Path within the repo.",
+          "optional": false
+        },
+        "text": {
+          "pass": "--text=<text>",
+          "doc": "The contents to write.",
+          "optional": false
+        },
+        "syncKey": {
+          "pass": "<syncKey>",
+          "doc": "Base58 repo sync key.",
+          "optional": false
+        },
+        "dataKey": {
+          "pass": "--data-key=<dataKey>",
+          "doc": "Base58 repo data key.",
+          "optional": false
+        }
+      },
+      "errors": [
+        "BAD_REQUEST"
+      ]
+    },
+    "admin-send-lobby-reply": {
+      "summary": "Reply to a lobby.",
+      "method": "POST",
+      "path": "/admin/send-lobby-reply/{lobbyId}",
+      "usage": "admin-send-lobby-reply <lobbyId> --lobby-request='<json>' [--reply-data='<json>']",
+      "core": "context.$internalStuff.sendLobbyReply",
+      "params": {
+        "lobbyId": {
+          "pass": "<lobbyId>",
+          "doc": "Which lobby to answer.",
+          "optional": false
+        },
+        "lobbyRequest": {
+          "pass": "--lobby-request='<json>'",
+          "doc": "Normally the object from `admin-fetch-lobby-request`.",
+          "optional": false
+        },
+        "replyData": {
+          "pass": "[--reply-data='<json>']",
+          "doc": "Payload for the requester.",
+          "optional": true
+        }
+      },
+      "errors": [
+        "BAD_REQUEST",
+        "NETWORK_ERROR"
+      ]
+    },
+    "admin-sync-repo": {
+      "summary": "Sync a repo.",
+      "method": "POST",
+      "path": "/admin/sync-repo/{syncKey}",
+      "usage": "admin-sync-repo <syncKey>",
+      "core": "context.$internalStuff.syncRepo",
+      "params": {
+        "syncKey": {
+          "pass": "<syncKey>",
+          "doc": "Base58 repo sync key.",
+          "optional": false
+        }
+      },
+      "returnsDoc": "The changeset summary.",
+      "errors": [
+        "BAD_REQUEST",
+        "NETWORK_ERROR"
+      ]
+    },
+    "all-keys": {
+      "summary": "List every key in the account.",
+      "method": "GET",
+      "path": "/account/{sessionId}/all-keys",
+      "usage": "all-keys",
+      "description": "Includes archived and deleted keys, unlike `currency-wallets`.",
+      "core": "account.allKeys",
+      "returns": {
+        "allKeys": "unknown[] — `EdgeWalletInfoFull[]`: id, type, keys, archived, deleted, hidden, sortIndex."
+      }
+    },
+    "approve-login-request": {
+      "summary": "Approve a login request.",
+      "method": "POST",
+      "path": "/account/{sessionId}/approve-login-request/{lobbyId}",
+      "usage": "approve-login-request <lobbyId>",
+      "description": "Grants the requesting device access to this account.",
+      "core": "EdgeLoginRequest.approve",
+      "params": {
+        "lobbyId": {
+          "pass": "<lobbyId>",
+          "doc": "From the QR code, or an `edge://edge/<lobbyId>` link.",
+          "optional": false
+        }
+      },
+      "returns": {
+        "ok": "boolean — Always true; a failure arrives as an error envelope."
+      },
+      "notes": [
+        "The lobby is re-fetched on approve, so a request that expired between inspecting and approving fails with `404 NO_LOGIN_REQUEST`."
+      ],
+      "errors": [
+        "NO_LOGIN_REQUEST",
+        "BAD_REQUEST",
+        "NETWORK_ERROR"
+      ]
+    },
+    "approve-swap-quote": {
+      "summary": "Execute a quote.",
+      "method": "POST",
+      "path": "/account/{sessionId}/swap-quote/approve/{objectId}",
+      "usage": "approve-swap-quote <objectId>",
+      "description": "Moves funds. The handle is released afterwards whether or not the response is read, so record `orderId` from it.",
+      "core": "EdgeSwapQuote.approve",
+      "returns": {
+        "ok": "unknown — True once the swap is submitted and the send broadcast.",
+        "objectId": "string — The handle that was consumed.",
+        "orderId": "unknown — The exchange's order reference, when it gives one.",
+        "destinationAddress": "unknown — Address the funds were sent to, when the exchange reports one.",
+        "transaction": "unknown — The on-chain send to the exchange."
+      },
+      "notes": [
+        "The plugin attaches its own savedAction and assetAction metadata; the engine adds none."
+      ],
+      "errors": [
+        "OBJECT_NOT_FOUND",
+        "OBJECT_EXPIRED",
+        "OBJECT_KIND_MISMATCH",
+        "OBJECT_SESSION_MISMATCH",
+        "INSUFFICIENT_FUNDS",
+        "NETWORK_ERROR"
+      ]
+    },
+    "approve-voucher": {
+      "summary": "Approve a voucher.",
+      "method": "POST",
+      "path": "/account/{sessionId}/approve-voucher",
+      "usage": "approve-voucher --voucher-id=<voucherId>",
+      "description": "Lets the waiting device finish logging in.",
+      "core": "account.approveVoucher",
+      "params": {
+        "voucherId": {
+          "pass": "--voucher-id=<voucherId>",
+          "doc": "From `pending-vouchers`, or an `OTP_REQUIRED` error’s `details.voucherId`.",
+          "optional": false
+        }
+      },
+      "errors": [
+        "BAD_REQUEST",
+        "NETWORK_ERROR"
+      ]
+    },
+    "balance-map": {
+      "summary": "Balances for every asset in the wallet.",
+      "method": "GET",
+      "path": "/account/{sessionId}/wallet/balance-map",
+      "usage": "balance-map --wallet-id=<walletId> [--token-id=<value>]",
+      "description": "The native currency plus every enabled token.",
+      "core": "wallet.balanceMap",
+      "params": {
+        "walletId": {
+          "pass": "--wallet-id=<walletId>",
+          "doc": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+          "optional": false
+        },
+        "token-id": {
+          "pass": "--token-id=<value>",
+          "doc": "Client-side filter; core has no single-balance accessor.",
+          "optional": true
+        }
+      },
+      "returns": {
+        "balances": "{ tokenId: string | null; currencyCode: string; nativeAmount: string; displayAmount: string; }[] — One entry per asset the wallet holds, native coin first."
+      },
+      "notes": [
+        "On the CLI, omit `--token-id` for the native asset rather than passing the literal `null`."
+      ]
+    },
+    "broadcast-tx": {
+      "summary": "Broadcast a signed transaction.",
+      "method": "POST",
+      "path": "/account/{sessionId}/broadcast-tx/{objectId}",
+      "usage": "broadcast-tx <objectId>",
+      "description": "The irreversible step: once this returns, the funds have left the wallet.",
+      "core": "wallet.broadcastTx",
+      "params": {
+        "objectId": {
+          "pass": "<objectId>",
+          "doc": "From `sign-tx`.",
+          "optional": false
+        }
+      },
+      "returns": {
+        "objectId": "string — Handle for the value the engine is holding. Pass it to the calls that consume it.",
+        "kind": "string — What the handle refers to, which decides the calls that accept it.",
+        "expiresAt": "string — When the engine drops the handle. Handles live 5 minutes.",
+        "sessionId?": "string — Session that created the handle; only that session may use it.",
+        "walletId?": "string — Wallet the handle is bound to, when it belongs to one.",
+        "transaction": "unknown — `EdgeTransaction` as it stands after this step. Unsigned after `make-spend`, signed after `sign-tx`, and carrying a txid once broadcast."
+      },
+      "returnsDoc": "The handle survives, so `save-tx` can still run.",
+      "notes": [
+        "Broadcasting does not record the transaction locally. Follow with `save-tx`, or it stays missing from history until a sync finds it."
+      ],
+      "errors": [
+        "BAD_REQUEST",
+        "NETWORK_ERROR"
+      ]
+    },
+    "cancel-otp-reset": {
+      "summary": "Cancel a pending 2FA reset.",
+      "method": "POST",
+      "path": "/account/{sessionId}/cancel-otp-reset",
+      "usage": "cancel-otp-reset",
+      "description": "The defence against somebody else requesting a reset on your account: as long as you cancel before the timer runs out, their reset never lands.",
+      "core": "account.cancelOtpReset"
+    },
+    "cancel-request": {
+      "summary": "Cancel a pending QR login.",
+      "method": "POST",
+      "path": "/pending-edge-login/cancel-request/{pendingId}",
+      "usage": "cancel-request <pendingId>",
+      "core": "EdgePendingEdgeLogin.cancelRequest",
+      "notes": [
+        "If the login already completed and a session exists, that session is force-logged-out too, so cancelling cannot leave an orphan visible in `engine-sessions`."
+      ],
+      "errors": [
+        "PENDING_LOGIN_NOT_FOUND"
+      ]
+    },
+    "change-enabled-token-ids": {
+      "summary": "Set the enabled token set.",
+      "method": "POST",
+      "path": "/account/{sessionId}/wallet/change-enabled-token-ids",
+      "usage": "change-enabled-token-ids --wallet-id=<walletId> --token-ids='<json>' [--add=<value>] [--remove=<value>]",
+      "description": "Absolute: anything missing from `tokenIds` is disabled. Core has only this setter, so there is no add or remove call.",
+      "core": "wallet.changeEnabledTokenIds",
+      "params": {
+        "walletId": {
+          "pass": "--wallet-id=<walletId>",
+          "doc": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+          "optional": false
+        },
+        "tokenIds": {
+          "pass": "--token-ids='<json>'",
+          "doc": "The complete desired set.",
+          "optional": false
+        },
+        "add": {
+          "pass": "--add=<value>",
+          "doc": "Read the current set, add this id, write it back.",
+          "optional": true
+        },
+        "remove": {
+          "pass": "--remove=<value>",
+          "doc": "Read the current set, drop this id, write it back.",
+          "optional": true
+        }
+      },
+      "returns": {
+        "enabledTokenIds": "string[] — The wallet’s enabled tokens after the change, not just what changed."
+      },
+      "notes": [
+        "The command's `--add` and `--remove` are client-side sugar over this one route, and cost an extra read first."
+      ],
+      "errors": [
+        "BAD_REQUEST",
+        "WALLET_NOT_FOUND",
+        "AMBIGUOUS_WALLET_ID"
+      ]
+    },
+    "change-password": {
+      "summary": "Set or change the password.",
+      "method": "POST",
+      "path": "/account/{sessionId}/change-password",
+      "usage": "change-password --password=<password>",
+      "description": "The login server enforces its own rules; `check-password-rules` scores a candidate first.",
+      "core": "account.changePassword",
+      "params": {
+        "password": {
+          "pass": "--password=<password>",
+          "doc": "The new password.",
+          "optional": false
+        }
+      },
+      "errors": [
+        "BAD_REQUEST",
+        "NETWORK_ERROR"
+      ]
+    },
+    "change-paused": {
+      "summary": "Pause or resume a wallet engine.",
+      "method": "POST",
+      "path": "/account/{sessionId}/wallet/change-paused",
+      "usage": "change-paused --wallet-id=<walletId> --paused=true|false",
+      "description": "A paused wallet stops syncing, which is how a caller quiets a chain it does not currently care about.",
+      "core": "wallet.changePaused",
+      "params": {
+        "walletId": {
+          "pass": "--wallet-id=<walletId>",
+          "doc": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+          "optional": false
+        },
+        "paused": {
+          "pass": "--paused=true|false",
+          "doc": "True to stop syncing.",
+          "optional": false
+        }
+      },
+      "errors": [
+        "BAD_REQUEST"
+      ]
+    },
+    "change-pin": {
+      "summary": "Set or change the PIN.",
+      "method": "POST",
+      "path": "/account/{sessionId}/change-pin",
+      "usage": "change-pin --pin=<pin> [--enable-login] [--for-duress-account]",
+      "core": "account.changePin",
+      "params": {
+        "pin": {
+          "pass": "--pin=<pin>",
+          "doc": "The new PIN.",
+          "optional": false
+        },
+        "enableLogin": {
+          "pass": "[--enable-login]",
+          "doc": "Allow logging in with this PIN on this device.",
+          "optional": true
+        },
+        "forDuressAccount": {
+          "pass": "[--for-duress-account]",
+          "doc": "Act on the duress account rather than the real one.",
+          "optional": true
+        }
+      },
+      "returns": {
+        "pin2Key": "string — The new PIN login key core returns."
+      },
+      "errors": [
+        "BAD_REQUEST"
+      ]
+    },
+    "change-recovery": {
+      "summary": "Set recovery questions and answers.",
+      "method": "POST",
+      "path": "/account/{sessionId}/change-recovery",
+      "usage": "change-recovery --question=<questions> … --answer=<answers> …",
+      "description": "The returned key is half of the credential: without it the answers alone cannot recover the account, so it has to be stored somewhere else.",
+      "core": "account.changeRecovery",
+      "params": {
+        "questions": {
+          "pass": "--question=<questions> …",
+          "doc": "The questions to ask.",
+          "optional": false
+        },
+        "answers": {
+          "pass": "--answer=<answers> …",
+          "doc": "Same length and order as `questions`.",
+          "optional": false
+        }
+      },
+      "returns": {
+        "recoveryKey": "string — Store this out of band. `login-with-recovery` needs it alongside the answers."
+      },
+      "errors": [
+        "BAD_REQUEST"
+      ]
+    },
+    "change-username": {
+      "summary": "Change the username.",
+      "method": "POST",
+      "path": "/account/{sessionId}/change-username",
+      "usage": "change-username --username=<username> [--password=<password>]",
+      "description": "The old name is released, so it becomes available to anyone else.",
+      "core": "account.changeUsername",
+      "params": {
+        "username": {
+          "pass": "--username=<username>",
+          "doc": "The new username.",
+          "optional": false
+        },
+        "password": {
+          "pass": "[--password=<password>]",
+          "doc": "Required by core when the account has a password.",
+          "optional": true
+        }
+      },
+      "errors": [
+        "USERNAME_ERROR",
+        "BAD_REQUEST",
+        "NETWORK_ERROR"
+      ]
+    },
+    "change-wallet-states": {
+      "summary": "Archive, delete, hide, or reorder wallets.",
+      "method": "POST",
+      "path": "/account/{sessionId}/change-wallet-states",
+      "usage": "change-wallet-states [--wallet-states='<json>'] --wallet-id=<value> [--archived=<value>] [--deleted=<value>] [--hidden=<value>] [--sort-index=<value>]",
+      "description": "The canonical backend for every wallet flag; there are no separate archive, unarchive or undelete verbs.",
+      "core": "account.changeWalletStates",
+      "params": {
+        "walletStates": {
+          "pass": "[--wallet-states='<json>']",
+          "doc": "`EdgeWalletStates`: wallet ids to the flags being changed.",
+          "optional": true
+        },
+        "wallet-id": {
+          "pass": "--wallet-id=<value>",
+          "doc": "The wallet to change. The command makes it the key of a single-entry `walletStates` map.",
+          "optional": false
+        },
+        "archived": {
+          "pass": "--archived=<value>",
+          "doc": "Hide from the active list.",
+          "optional": true
+        },
+        "deleted": {
+          "pass": "--deleted=<value>",
+          "doc": "Mark deleted.",
+          "optional": true
+        },
+        "hidden": {
+          "pass": "--hidden=<value>",
+          "doc": "Hide from the wallet picker.",
+          "optional": true
+        },
+        "sort-index": {
+          "pass": "--sort-index=<value>",
+          "doc": "Position in the wallet list.",
+          "optional": true
+        }
+      },
+      "notes": [
+        "The command builds a single-wallet `walletStates` map from these flags, and needs at least one."
+      ],
+      "errors": [
+        "BAD_REQUEST"
+      ]
+    },
+    "check-password": {
+      "summary": "Verify a password.",
+      "method": "POST",
+      "path": "/account/{sessionId}/check-password",
+      "usage": "check-password --password=<password>",
+      "description": "Checks without changing anything, which is how a caller gates a destructive action behind a re-entry prompt.",
+      "core": "account.checkPassword",
+      "params": {
+        "password": {
+          "pass": "--password=<password>",
+          "doc": "The account password.",
+          "optional": false
+        }
+      },
+      "returns": {
+        "ok": "boolean — False for a wrong password — not an error response."
+      }
+    },
+    "check-password-rules": {
+      "summary": "Score a candidate password.",
+      "method": "GET",
+      "path": "/check-password-rules",
+      "usage": "check-password-rules --password=<password>",
+      "core": "context.checkPasswordRules",
+      "params": {
+        "password": {
+          "pass": "--password=<password>",
+          "doc": "The candidate password to score.",
+          "optional": false
+        }
+      },
+      "returnsDoc": "`EdgePasswordRules` from core: passed, tooShort, noNumber, noLowerCase, noUpperCase, secondsToCrack.",
+      "notes": [
+        "Send it with `curl --get --data-urlencode` rather than putting it in a shell-visible URL."
+      ]
+    },
+    "check-pin": {
+      "summary": "Verify a PIN.",
+      "method": "POST",
+      "path": "/account/{sessionId}/check-pin",
+      "usage": "check-pin --pin=<pin> [--for-duress-account]",
+      "core": "account.checkPin",
+      "params": {
+        "pin": {
+          "pass": "--pin=<pin>",
+          "doc": "The device PIN, usually four digits.",
+          "optional": false
+        },
+        "forDuressAccount": {
+          "pass": "[--for-duress-account]",
+          "doc": "Act on the duress account rather than the real one.",
+          "optional": true
+        }
+      },
+      "returns": {
+        "ok": "boolean — False for a wrong PIN — not an error response."
+      }
+    },
+    "close-swap-quote": {
+      "summary": "Discard a quote.",
+      "method": "POST",
+      "path": "/account/{sessionId}/swap-quote/close/{objectId}",
+      "usage": "close-swap-quote <objectId>",
+      "description": "Closes the plugin object without executing, freeing whatever the exchange was holding.",
+      "core": "EdgeSwapQuote.close",
+      "returns": {
+        "ok": "boolean — Always true; a failure arrives as an error envelope.",
+        "objectId": "string — The handle this call consumed. It is now expired."
+      },
+      "errors": [
+        "OBJECT_NOT_FOUND",
+        "OBJECT_EXPIRED",
+        "OBJECT_KIND_MISMATCH",
+        "OBJECT_SESSION_MISMATCH"
+      ]
+    },
+    "create-account": {
+      "summary": "Create an account.",
+      "method": "POST",
+      "path": "/create-account",
+      "usage": "create-account [--otp=<otp>] [--otp-key=<otpKey>] [--challenge-id=<challengeId>] [--username=<username>] [--password=<password>] [--pin=<pin>]",
+      "description": "Every credential is optional over REST: omitting all three creates a light account with no username.",
+      "core": "context.createAccount",
+      "params": {
+        "otp": {
+          "pass": "[--otp=<otp>]",
+          "doc": "A current 2FA code.",
+          "optional": true
+        },
+        "otpKey": {
+          "pass": "[--otp-key=<otpKey>]",
+          "doc": "The 2FA secret itself, instead of a code.",
+          "optional": true
+        },
+        "challengeId": {
+          "pass": "[--challenge-id=<challengeId>]",
+          "doc": "Supply after solving a CAPTCHA to retry the same request.",
+          "optional": true
+        },
+        "username": {
+          "pass": "[--username=<username>]",
+          "doc": "The name to claim.",
+          "optional": true
+        },
+        "password": {
+          "pass": "[--password=<password>]",
+          "doc": "The account password.",
+          "optional": true
+        },
+        "pin": {
+          "pass": "[--pin=<pin>]",
+          "doc": "A device PIN to save.",
+          "optional": true
+        }
+      },
+      "returns": {
+        "sessionId": "string — Identifies this login. Every account-scoped call carries it, and the CLI stores the most recent one so commands can omit it.",
+        "username?": "string — Absent for a light account, which has no username.",
+        "rootLoginId": "string — The account root, stable across appIds. Two sessions sharing it are the same account.",
+        "loginMethod": "\"password\" | \"pin\" | \"key\" | \"recovery\" | \"edge\" | \"create\" — How this session was established.",
+        "autoLogoutSeconds": "number — Idle time before the engine logs the account out. 0 disables it.",
+        "expiresAt": "string | null — When auto-logout will fire, or null when it is disabled.",
+        "lastActivityAt": "string — Last call on this session, which is what auto-logout measures from.",
+        "createdAt": "string — When the login completed."
+      },
+      "returnsDoc": "A session with `loginMethod: \"create\"`.",
+      "notes": [
+        "The command requires a username, password and PIN. Creating a light account is REST-only."
+      ],
+      "errors": [
+        "USERNAME_ERROR",
+        "CHALLENGE_REQUIRED",
+        "BAD_REQUEST",
+        "NETWORK_ERROR"
+      ]
+    },
+    "create-currency-wallet": {
+      "summary": "Create a currency wallet.",
+      "method": "POST",
+      "path": "/account/{sessionId}/create-currency-wallet",
+      "usage": "create-currency-wallet --wallet-type=<walletType> [--name=<name>] [--import-text=<importText>]",
+      "core": "account.createCurrencyWallet",
+      "params": {
+        "walletType": {
+          "pass": "--wallet-type=<walletType>",
+          "doc": "From `currency-configs`, e.g. `wallet:bitcoin`.",
+          "optional": false
+        },
+        "name": {
+          "pass": "[--name=<name>]",
+          "doc": "Display name.",
+          "optional": true
+        },
+        "importText": {
+          "pass": "[--import-text=<importText>]",
+          "doc": "Seed or key text to import instead of generating.",
+          "optional": true
+        }
+      },
+      "returns": {
+        "walletId": "string — The full wallet id. Commands taking a wallet accept any unique prefix.",
+        "id": "string — Same value as `walletId`; core exposes both names.",
+        "type": "string — Key type, such as `wallet:bitcoin`.",
+        "name": "string | null — User-assigned name, null until one is set.",
+        "pluginId": "string — Currency plugin backing this wallet.",
+        "currencyCode": "string — Ticker for the native asset.",
+        "fiatCurrencyCode": "string — Fiat the wallet reports value in, as `iso:USD`.",
+        "blockHeight": "number — Chain height this wallet has seen.",
+        "syncStatus": "unknown — `EdgeWalletSyncStatus` from core.",
+        "syncRatio?": "string — Sync progress as a percentage, for display.",
+        "paused": "boolean — True while the engine is not syncing this wallet.",
+        "imported?": "boolean — True when the keys came from an import rather than being generated here.",
+        "created": "string | null — When the wallet was created, null for wallets predating the field.",
+        "enabledTokenIds": "string[] — Tokens the user turned on.",
+        "detectedTokenIds": "string[] — Tokens found on-chain that are not enabled yet.",
+        "unactivatedTokenIds": "string[] — Enabled tokens still awaiting on-chain activation."
+      },
+      "notes": [
+        "The fiat currency is not set here. Core still accepts it on create, but that path is deprecated — use `set-fiat-currency-code` afterwards, so there is one way to do it."
+      ],
+      "errors": [
+        "BAD_REQUEST"
+      ]
+    },
+    "create-currency-wallets": {
+      "summary": "Create several wallets at once.",
+      "method": "POST",
+      "path": "/account/{sessionId}/create-currency-wallets",
+      "usage": "create-currency-wallets --create-wallets='<json>'",
+      "description": "Partial success is normal: each entry reports its own outcome, and one failure does not roll back the others.",
+      "core": "account.createCurrencyWallets",
+      "params": {
+        "createWallets": {
+          "pass": "--create-wallets='<json>'",
+          "doc": "`EdgeCreateCurrencyWallet[]`: walletType, name, fiatCurrencyCode.",
+          "optional": false
+        }
+      },
+      "returns": {
+        "results": "unknown[] — Mirrors core's EdgeResult[]: `{ ok, wallet }` or `{ ok: false, error }`."
+      },
+      "errors": [
+        "BAD_REQUEST"
+      ]
+    },
+    "create-wallet": {
+      "summary": "Create a wallet from raw key JSON.",
+      "method": "POST",
+      "path": "/account/{sessionId}/create-wallet",
+      "usage": "create-wallet --type=<type> [--keys='<json>']",
+      "description": "The import path. Use `create-currency-wallet` to make a fresh wallet with generated keys.",
+      "core": "account.createWallet",
+      "params": {
+        "type": {
+          "pass": "--type=<type>",
+          "doc": "Wallet type, e.g. `wallet:bitcoin`.",
+          "optional": false
+        },
+        "keys": {
+          "pass": "[--keys='<json>']",
+          "doc": "Plugin key material. Omit to let core generate it.",
+          "optional": true
+        }
+      },
+      "returns": {
+        "walletId": "string — The new wallet. Its keys are already saved."
+      },
+      "errors": [
+        "BAD_REQUEST"
+      ]
+    },
+    "currency-configs": {
+      "summary": "List plugin ids usable for wallet creation.",
+      "method": "GET",
+      "path": "/currency-configs",
+      "usage": "currency-configs",
+      "description": "Currency and accountbased plugins only — swap plugins are excluded.",
+      "returns": {
+        "pluginIds": "string[] — Currency plugins this engine loaded."
+      }
+    },
+    "currency-wallets": {
+      "summary": "List the account's wallets.",
+      "method": "GET",
+      "path": "/account/{sessionId}/currency-wallets",
+      "usage": "currency-wallets [--filter=active|archived|hidden|all]",
+      "core": "account.currencyWallets",
+      "params": {
+        "filter": {
+          "pass": "[--filter=active|archived|hidden|all]",
+          "doc": "Which of the account’s wallet lists to read. Defaults to `active`.",
+          "optional": true
+        }
+      },
+      "returns": {
+        "currencyWallets": "{ walletId: string; id: string; type: string; name: string | null; pluginId: string; currencyCode: string; fiatCurrencyCode: string; blockHeight: number; syncStatus: unknown; syncRatio: string | undefined; paused: boolean; imported: boolean | undefined; created: string | null; enabledTokenIds: string[]; detectedTokenIds: string[]; unactivatedTokenIds: string[]; }[] — Every wallet in the account, including paused ones."
+      },
+      "notes": [
+        "Wallets load in the background after login, so a list taken straight afterwards can be short. Call `wait-for-all-wallets` first to be sure the account has finished loading."
+      ]
+    },
+    "delete-item": {
+      "summary": "Delete an item.",
+      "method": "POST",
+      "path": "/account/{sessionId}/delete-item",
+      "usage": "delete-item --store-id=<storeId> --item-id=<itemId>",
+      "core": "account.dataStore.deleteItem",
+      "params": {
+        "storeId": {
+          "pass": "--store-id=<storeId>",
+          "doc": "Plugin or app namespace within the account data store.",
+          "optional": false
+        },
+        "itemId": {
+          "pass": "--item-id=<itemId>",
+          "doc": "Key within the store.",
+          "optional": false
+        }
+      },
+      "errors": [
+        "BAD_REQUEST"
+      ]
+    },
+    "delete-password": {
+      "summary": "Remove password login.",
+      "method": "POST",
+      "path": "/account/{sessionId}/delete-password",
+      "usage": "delete-password",
+      "description": "The account keeps its other login methods; only the password stops working.",
+      "core": "account.deletePassword",
+      "errors": [
+        "BAD_REQUEST",
+        "NETWORK_ERROR"
+      ]
+    },
+    "delete-pin": {
+      "summary": "Remove the PIN.",
+      "method": "POST",
+      "path": "/account/{sessionId}/delete-pin",
+      "usage": "delete-pin",
+      "description": "PIN login stops working on this device; other methods are untouched.",
+      "core": "account.deletePin"
+    },
+    "delete-recovery": {
+      "summary": "Disable recovery login.",
+      "method": "POST",
+      "path": "/account/{sessionId}/delete-recovery",
+      "usage": "delete-recovery",
+      "description": "The existing recovery key stops working.",
+      "core": "account.deleteRecovery"
+    },
+    "delete-remote-account": {
+      "summary": "Permanently delete the remote account.",
+      "method": "POST",
+      "path": "/account/{sessionId}/delete-remote-account",
+      "usage": "delete-remote-account --yes",
+      "description": "Irreversible. The account is removed from the login server, and funds in its wallets are unrecoverable without the keys. The session is logged out afterwards.",
+      "core": "account.deleteRemoteAccount",
+      "params": {
+        "yes": {
+          "pass": "--yes",
+          "doc": "Confirms intent. Without it the command refuses to run.",
+          "optional": false
+        }
+      },
+      "notes": [
+        "The engine performs no confirmation check — the call runs as soon as it arrives, so any guard has to live in the caller. The command requires `--yes` for exactly this reason."
+      ],
+      "errors": [
+        "NETWORK_ERROR"
+      ]
+    },
+    "delete-store": {
+      "summary": "Delete an entire store.",
+      "method": "POST",
+      "path": "/account/{sessionId}/delete-store",
+      "usage": "delete-store --store-id=<storeId>",
+      "description": "Removes every item in it, which cannot be undone from this API.",
+      "core": "account.dataStore.deleteStore",
+      "params": {
+        "storeId": {
+          "pass": "--store-id=<storeId>",
+          "doc": "Plugin or app namespace within the account data store.",
+          "optional": false
+        }
+      },
+      "errors": [
+        "BAD_REQUEST"
+      ]
+    },
+    "disable-otp": {
+      "summary": "Disable 2FA.",
+      "method": "POST",
+      "path": "/account/{sessionId}/disable-otp",
+      "usage": "disable-otp",
+      "description": "Logins stop requiring a code immediately.",
+      "core": "account.disableOtp"
+    },
+    "dump-data": {
+      "summary": "Dump wallet engine state.",
+      "method": "GET",
+      "path": "/account/{sessionId}/wallet/dump-data",
+      "usage": "dump-data --wallet-id=<walletId>",
+      "description": "Plugin-defined debug output. Shape varies by plugin and can be very large.",
+      "core": "wallet.dumpData",
+      "params": {
+        "walletId": {
+          "pass": "--wallet-id=<walletId>",
+          "doc": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+          "optional": false
+        }
+      },
+      "returnsDoc": "`EdgeDataDump`, straight from the plugin."
+    },
+    "enable-otp": {
+      "summary": "Enable 2FA.",
+      "method": "POST",
+      "path": "/account/{sessionId}/enable-otp",
+      "usage": "enable-otp [--timeout=<timeout>]",
+      "description": "Record the returned key before leaving the terminal: it is the only copy.",
+      "core": "account.enableOtp",
+      "params": {
+        "timeout": {
+          "pass": "[--timeout=<timeout>]",
+          "doc": "How long a reset request must wait before it completes. Core supplies the default when omitted.",
+          "optional": true
+        }
+      },
+      "returns": {
+        "otpKey": "string | null — The new secret. The 2FA secret itself. Secret material — record it safely."
+      }
+    },
+    "encode-uri": {
+      "summary": "Build a payment URI.",
+      "method": "POST",
+      "path": "/account/{sessionId}/wallet/encode-uri",
+      "usage": "encode-uri --wallet-id=<walletId> --public-address=<publicAddress> [--native-amount=<nativeAmount>] [--label=<label>] [--message=<message>] [--currency-code=<currencyCode>]",
+      "description": "For a receive screen or a QR code.",
+      "core": "wallet.encodeUri",
+      "params": {
+        "walletId": {
+          "pass": "--wallet-id=<walletId>",
+          "doc": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+          "optional": false
+        },
+        "publicAddress": {
+          "pass": "--public-address=<publicAddress>",
+          "doc": "Where the payment should go.",
+          "optional": false
+        },
+        "nativeAmount": {
+          "pass": "[--native-amount=<nativeAmount>]",
+          "doc": "Amount, in the native unit.",
+          "optional": true
+        },
+        "label": {
+          "pass": "[--label=<label>]",
+          "doc": "BIP21 `label`; becomes `metadata.name` when parsed back.",
+          "optional": true
+        },
+        "message": {
+          "pass": "[--message=<message>]",
+          "doc": "BIP21 `message`; becomes `metadata.notes`.",
+          "optional": true
+        },
+        "currencyCode": {
+          "pass": "[--currency-code=<currencyCode>]",
+          "doc": "Disambiguates on chains that carry several assets.",
+          "optional": true
+        }
+      },
+      "returns": {
+        "uri": "string — The encoded URI, ready for a QR code."
+      },
+      "notes": [
+        "Only these five fields are read; a fuller `EdgeEncodeUri` has its extras ignored."
+      ],
+      "errors": [
+        "BAD_REQUEST",
+        "WALLET_NOT_FOUND",
+        "AMBIGUOUS_WALLET_ID"
+      ]
+    },
+    "engine-config": {
+      "summary": "Configured context options.",
+      "method": "GET",
+      "path": "/engine/config",
+      "usage": "engine-config",
+      "description": "What the engine passed to `makeEdgeContext`. Contains no secrets. Use it to assert tester hosts before a test run.",
+      "returns": {
+        "appId": "string — Application ID the engine was started with.",
+        "testMode": "boolean — True when the engine is pointed at the tester fleet.",
+        "directory": "string — Working directory holding the core data.",
+        "servers": "{ [keys: string]: string | string[]; } — The URLs this engine talks to, keyed by role. `syncServer` is a list, since core rotates across the sync fleet.",
+        "plugins": "string[] — Plugin IDs the engine loaded, sorted."
+      },
+      "notes": [
+        "Outside `-t` / `--test`, `servers` is an empty object — core is using its built-in production defaults, so there is nothing to echo back."
+      ]
+    },
+    "engine-sessions": {
+      "summary": "List active sessions.",
+      "method": "GET",
+      "path": "/engine/sessions",
+      "usage": "engine-sessions",
+      "returns": {
+        "": "{ sessionId: string; username: string | undefined; rootLoginId: string; loginMethod: \"password\" | \"pin\" | \"key\" | \"recovery\" | \"edge\" | \"create\"; autoLogoutSeconds: number; expiresAt: string | null; lastActivityAt: string; createdAt: string; }[]"
+      },
+      "returnsDoc": "A bare array, not wrapped in a key."
+    },
+    "engine-status": {
+      "summary": "Engine liveness and summary.",
+      "method": "GET",
+      "path": "/engine/status",
+      "usage": "engine-status",
+      "description": "The readiness probe the client polls after auto-spawning the engine.",
+      "returns": {
+        "pid": "number — The daemon process, for `kill` when it will not stop.",
+        "apiVersion": "string — The API this engine speaks. A client refusing to talk to an older engine checks this.",
+        "uptimeSeconds": "number — How long the daemon has been running.",
+        "sessionCount": "number — Logged-in accounts held open right now.",
+        "testMode": "boolean — True when pointed at the tester fleet.",
+        "idleShutdownAt": "string | null — When the engine will exit for want of work. Null while a session or a subscription is holding it open, and null when the timeout is disabled.",
+        "tcpPort": "number | null — The loopback port, null unless started with `--tcp`.",
+        "socketPath": "string — Unix socket the CLI connects to.",
+        "locale": "string — Language tag the engine resolved at boot.",
+        "decimalSeparator": "string — Decimal mark for that locale.",
+        "groupingSeparator": "string — Thousands mark for that locale."
+      },
+      "returnsDoc": "`idleShutdownAt` is null while a session or a subscription holds the engine open, and `tcpPort` is null unless started with `--tcp`.",
+      "errors": [
+        "ENGINE_SHUTTING_DOWN"
+      ]
+    },
+    "engine-stop": {
+      "summary": "Stop the engine.",
+      "method": "POST",
+      "path": "/engine/stop",
+      "usage": "engine-stop",
+      "description": "Logs out every session, closes the context, unlinks the socket and run-file, then exits. The engine answers before it starts tearing down, so a response is not proof the process is gone.",
+      "returns": {
+        "ok": "boolean — Always true; a failure arrives as an error envelope."
+      },
+      "notes": [
+        "In-flight callers may see `503 ENGINE_SHUTTING_DOWN` once teardown starts."
+      ]
+    },
+    "fetch-challenge": {
+      "summary": "Pre-fetch a CAPTCHA challenge.",
+      "method": "POST",
+      "path": "/fetch-challenge",
+      "usage": "fetch-challenge",
+      "description": "Lets a client solve a challenge before it hits `403 CHALLENGE_REQUIRED` mid-flow.",
+      "core": "context.fetchChallenge",
+      "returns": {
+        "challengeId": "string — Pass to the call that demanded a challenge once the user has solved it.",
+        "challengeUri?": "string — Where to send the user to solve the CAPTCHA. Absent when the server issued a challenge that needs no interaction."
+      },
+      "returnsDoc": "`challengeUri` is absent when the server considers the challenge already satisfied.",
+      "errors": [
+        "NETWORK_ERROR"
+      ]
+    },
+    "fetch-lobby": {
+      "summary": "Inspect a login request.",
+      "method": "GET",
+      "path": "/account/{sessionId}/fetch-lobby/{lobbyId}",
+      "usage": "fetch-lobby <lobbyId>",
+      "description": "The other side of `request-edge-login`: shows who is asking, so a human can decide before approving.",
+      "core": "account.fetchLobby",
+      "params": {
+        "lobbyId": {
+          "pass": "<lobbyId>",
+          "doc": "From the QR code, or an `edge://edge/<lobbyId>` link.",
+          "optional": false
+        }
+      },
+      "returns": {
+        "lobbyId": "string — The lobby that was fetched, echoed back.",
+        "loginRequest": "{ appId: string; displayName: string; displayImageDarkUrl: string | null; displayImageLightUrl: string | null; } | null — Null when the lobby carries no pending login request."
+      },
+      "errors": [
+        "BAD_REQUEST",
+        "NETWORK_ERROR"
+      ]
+    },
+    "fetch-login-messages": {
+      "summary": "Fetch login-server messages for every local user.",
+      "method": "GET",
+      "path": "/fetch-login-messages",
+      "usage": "fetch-login-messages",
+      "core": "context.fetchLoginMessages",
+      "returnsDoc": "`EdgeLoginMessages` from core, keyed by loginId; each value carries otpResetPending and pendingVouchers.",
+      "errors": [
+        "NETWORK_ERROR"
+      ]
+    },
+    "fetch-recovery-questions": {
+      "summary": "Fetch a user’s recovery questions.",
+      "method": "GET",
+      "path": "/fetch-recovery-questions",
+      "usage": "fetch-recovery-questions --recovery-key=<recoveryKey> --username=<username>",
+      "core": "context.fetchRecovery2Questions",
+      "params": {
+        "recoveryKey": {
+          "pass": "--recovery-key=<recoveryKey>",
+          "doc": "From `change-recovery`, stored by the user out of band.",
+          "optional": false
+        },
+        "username": {
+          "pass": "--username=<username>",
+          "doc": "Whose questions to fetch.",
+          "optional": false
+        }
+      },
+      "returns": {
+        "questions": "string[] — The questions in the order `login-with-recovery` expects the answers."
+      },
+      "errors": [
+        "USERNAME_ERROR",
+        "NETWORK_ERROR"
+      ]
+    },
+    "fetch-swap-quotes": {
+      "summary": "Fetch swap quotes.",
+      "method": "POST",
+      "path": "/account/{sessionId}/fetch-swap-quotes",
+      "usage": "fetch-swap-quotes --from-wallet-id=<fromWalletId> --to-wallet-id=<toWalletId> --native-amount=<nativeAmount> [--from-token-id=<fromTokenId>] [--to-token-id=<toTokenId>] [--quote-for=<quoteFor>] [--plugin-id=<preferPluginId>]",
+      "description": "Polls every enabled swap plugin and parks each result under its own `swap_` handle with a 5 minute TTL.",
+      "core": "account.fetchSwapQuotes",
+      "params": {
+        "fromWalletId": {
+          "pass": "--from-wallet-id=<fromWalletId>",
+          "doc": "Source wallet. Accepts a unique prefix.",
+          "optional": false
+        },
+        "toWalletId": {
+          "pass": "--to-wallet-id=<toWalletId>",
+          "doc": "Destination wallet.",
+          "optional": false
+        },
+        "nativeAmount": {
+          "pass": "--native-amount=<nativeAmount>",
+          "doc": "How much, in native units.",
+          "optional": false
+        },
+        "fromTokenId": {
+          "pass": "[--from-token-id=<fromTokenId>]",
+          "doc": "Defaults to the native asset.",
+          "optional": true
+        },
+        "toTokenId": {
+          "pass": "[--to-token-id=<toTokenId>]",
+          "doc": "Defaults to the native asset.",
+          "optional": true
+        },
+        "quoteFor": {
+          "pass": "[--quote-for=<quoteFor>]",
+          "doc": "`from` spends this much of the source, `to` receives this much at the destination, `max` sends everything. Defaults to `from`.",
+          "optional": true
+        },
+        "preferPluginId": {
+          "pass": "[--plugin-id=<preferPluginId>]",
+          "doc": "Restrict to one exchange.",
+          "optional": true
+        }
+      },
+      "returns": {
+        "quoteCount": "number — How many plugins answered.",
+        "quotes": "{ objectId: string; kind: string; expiresAt: string; pluginId: string; isEstimate: boolean; canBePartial: boolean | null; maxFulfillmentSeconds: number | null; minReceiveAmount: string | null; fromNativeAmount: string; toNativeAmount: string; networkFee: { nativeAmount: string; tokenId: string | null; }; quoteExpirationDate: string | null; swapInfo: { pluginId: string; displayName: string; supportEmail: string; isDex: boolean | null; }; request: { fromTokenId: string | null; toTokenId: string | null; nativeAmount: string; quoteFor: \"to\" | \"from\" | \"max\"; fromWalletId: string; toWalletId: string; }; }[] — One quote per plugin that answered, each already parked under its own handle. Plugins that failed or had nothing to offer are simply absent."
+      },
+      "notes": [
+        "Every returned quote holds an open plugin object. Approving one releases only that handle; close the rest, or let them expire.",
+        "An empty `quotes` array with `quoteCount: 0` is a success, not an error — no plugin could serve the pair."
+      ],
+      "errors": [
+        "BAD_REQUEST",
+        "SWAP_BELOW_LIMIT",
+        "SWAP_ABOVE_LIMIT",
+        "SWAP_CURRENCY",
+        "SWAP_PERMISSION",
+        "SWAP_ADDRESS",
+        "SAME_CURRENCY",
+        "INSUFFICIENT_FUNDS",
+        "WALLET_NOT_FOUND",
+        "NETWORK_ERROR"
+      ]
+    },
+    "fix-username": {
+      "summary": "Normalize a username.",
+      "method": "GET",
+      "path": "/fix-username",
+      "usage": "fix-username --username=<username>",
+      "description": "Applies the same rules the login server does, so a caller can show the user what their name will actually be before creating an account.",
+      "core": "context.fixUsername",
+      "params": {
+        "username": {
+          "pass": "--username=<username>",
+          "doc": "The name to normalize.",
+          "optional": false
+        }
+      },
+      "returns": {
+        "username": "string — The normalized value. The input is not echoed."
+      }
+    },
+    "forget-account": {
+      "summary": "Forget an account on this device.",
+      "method": "POST",
+      "path": "/forget-account",
+      "usage": "forget-account --root-login-id=<rootLoginId>",
+      "description": "Removes locally cached credentials. The remote account is untouched.",
+      "core": "context.forgetAccount",
+      "params": {
+        "rootLoginId": {
+          "pass": "--root-login-id=<rootLoginId>",
+          "doc": "Core takes a `rootLoginId`. A username is also accepted and resolved against `localUsers` first, so callers need not hash it.",
+          "optional": false
+        }
+      },
+      "errors": [
+        "USER_NOT_FOUND",
+        "BAD_REQUEST"
+      ]
+    },
+    "get-addresses": {
+      "summary": "Receive addresses.",
+      "method": "GET",
+      "path": "/account/{sessionId}/wallet/get-addresses",
+      "usage": "get-addresses --wallet-id=<walletId> [--token-id=<tokenId>] [--force-index=<forceIndex>]",
+      "core": "wallet.getAddresses",
+      "params": {
+        "walletId": {
+          "pass": "--wallet-id=<walletId>",
+          "doc": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+          "optional": false
+        },
+        "tokenId": {
+          "pass": "[--token-id=<tokenId>]",
+          "doc": "Defaults to the native asset.",
+          "optional": true
+        },
+        "forceIndex": {
+          "pass": "[--force-index=<forceIndex>]",
+          "doc": "Derive at a specific index.",
+          "optional": true
+        }
+      },
+      "returns": {
+        "addresses": "unknown[] — `EdgeAddress[]`: addressType, publicAddress, nativeBalance."
+      }
+    },
+    "get-display-private-key": {
+      "summary": "Export the private key for display.",
+      "method": "GET",
+      "path": "/account/{sessionId}/get-display-private-key",
+      "usage": "get-display-private-key --wallet-id=<walletId>",
+      "description": "Secret. The human-facing form — WIF, seed phrase, whatever the plugin shows on its export screen.",
+      "core": "account.getDisplayPrivateKey",
+      "params": {
+        "walletId": {
+          "pass": "--wallet-id=<walletId>",
+          "doc": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+          "optional": false
+        }
+      },
+      "returns": {
+        "key": "string — The displayable private key."
+      },
+      "errors": [
+        "WALLET_NOT_FOUND",
+        "AMBIGUOUS_WALLET_ID"
+      ]
+    },
+    "get-display-public-key": {
+      "summary": "Export the public key for display.",
+      "method": "GET",
+      "path": "/account/{sessionId}/get-display-public-key",
+      "usage": "get-display-public-key --wallet-id=<walletId>",
+      "description": "The xpub or equivalent — safe to share for watch-only use.",
+      "core": "account.getDisplayPublicKey",
+      "params": {
+        "walletId": {
+          "pass": "--wallet-id=<walletId>",
+          "doc": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+          "optional": false
+        }
+      },
+      "returns": {
+        "key": "string — The displayable public key."
+      },
+      "errors": [
+        "WALLET_NOT_FOUND",
+        "AMBIGUOUS_WALLET_ID"
+      ]
+    },
+    "get-item": {
+      "summary": "Read an item.",
+      "method": "GET",
+      "path": "/account/{sessionId}/get-item",
+      "usage": "get-item --store-id=<storeId> --item-id=<itemId>",
+      "description": "Values are opaque strings; encoding is the caller's business.",
+      "core": "account.dataStore.getItem",
+      "params": {
+        "storeId": {
+          "pass": "--store-id=<storeId>",
+          "doc": "Plugin or app namespace within the account data store.",
+          "optional": false
+        },
+        "itemId": {
+          "pass": "--item-id=<itemId>",
+          "doc": "Key within the store.",
+          "optional": false
+        }
+      },
+      "returns": {
+        "value": "string — The stored string."
+      },
+      "errors": [
+        "NOT_FOUND",
+        "BAD_REQUEST"
+      ]
+    },
+    "get-login-key": {
+      "summary": "Read the account login key.",
+      "method": "GET",
+      "path": "/account/{sessionId}/get-login-key",
+      "usage": "get-login-key",
+      "description": "The key `login-with-key` takes. It grants full account access, so treat the output as secret.",
+      "core": "account.getLoginKey",
+      "returns": {
+        "loginKey": "string — base58. Full account access — keep it safe."
+      }
+    },
+    "get-max-spendable": {
+      "summary": "Largest sendable amount.",
+      "method": "POST",
+      "path": "/account/{sessionId}/wallet/get-max-spendable",
+      "usage": "get-max-spendable --wallet-id=<walletId> [--spend-info='<json>'] [--to=<to>] [--native-amount=<nativeAmount>] [--amount=<amount>] [--token-id=<tokenId>] [--metadata='<json>']",
+      "description": "What empties the wallet after fees. A destination is still required, since fees depend on it.",
+      "core": "wallet.getMaxSpendable",
+      "params": {
+        "walletId": {
+          "pass": "--wallet-id=<walletId>",
+          "doc": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+          "optional": false
+        },
+        "spendInfo": {
+          "pass": "[--spend-info='<json>']",
+          "doc": "A full `EdgeSpendInfo`, used as-is when present.",
+          "optional": true
+        },
+        "to": {
+          "pass": "[--to=<to>]",
+          "doc": "Address or BIP21 URI, run through `wallet.parseUri`.",
+          "optional": true
+        },
+        "nativeAmount": {
+          "pass": "[--native-amount=<nativeAmount>]",
+          "doc": "How much, in native units.",
+          "optional": true
+        },
+        "amount": {
+          "pass": "[--amount=<amount>]",
+          "doc": "Alias of `nativeAmount`.",
+          "optional": true
+        },
+        "tokenId": {
+          "pass": "[--token-id=<tokenId>]",
+          "doc": "Defaults to the native asset.",
+          "optional": true
+        },
+        "metadata": {
+          "pass": "[--metadata='<json>']",
+          "doc": "Wins over anything parsed out of the URI.",
+          "optional": true
+        }
+      },
+      "returns": {
+        "nativeAmount": "string — The most this wallet can send."
+      },
+      "errors": [
+        "INSUFFICIENT_FUNDS",
+        "BAD_REQUEST",
+        "NETWORK_ERROR"
+      ]
+    },
+    "get-num-transactions": {
+      "summary": "Count transactions in a wallet.",
+      "method": "GET",
+      "path": "/account/{sessionId}/wallet/get-num-transactions",
+      "usage": "get-num-transactions --wallet-id=<walletId> [--token-id=<tokenId>]",
+      "description": "Cheaper than listing when only the total matters.",
+      "core": "wallet.getNumTransactions",
+      "params": {
+        "walletId": {
+          "pass": "--wallet-id=<walletId>",
+          "doc": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+          "optional": false
+        },
+        "tokenId": {
+          "pass": "[--token-id=<tokenId>]",
+          "doc": "Defaults to the native asset.",
+          "optional": true
+        }
+      },
+      "returns": {
+        "numTransactions": "number — Every transaction the wallet knows of."
+      },
+      "notes": [
+        "Unfiltered: `spamThreshold`, dates and `searchString` do not apply, so this can exceed `total` from `get-transactions`."
+      ],
+      "errors": [
+        "WALLET_NOT_FOUND",
+        "AMBIGUOUS_WALLET_ID"
+      ]
+    },
+    "get-payment-protocol-info": {
+      "summary": "Fetch a BIP70 payment request.",
+      "method": "GET",
+      "path": "/account/{sessionId}/wallet/get-payment-protocol-info",
+      "usage": "get-payment-protocol-info --wallet-id=<walletId> --payment-protocol-url=<paymentProtocolUrl>",
+      "description": "Feed `spendTargets` from the result into `make-spend` to pay it.",
+      "core": "wallet.getPaymentProtocolInfo",
+      "params": {
+        "walletId": {
+          "pass": "--wallet-id=<walletId>",
+          "doc": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+          "optional": false
+        },
+        "paymentProtocolUrl": {
+          "pass": "--payment-protocol-url=<paymentProtocolUrl>",
+          "doc": "The payment-request URL.",
+          "optional": false
+        }
+      },
+      "returnsDoc": "`EdgePaymentProtocolInfo`: domain, memo, merchant, nativeAmount, spendTargets.",
+      "errors": [
+        "BAD_REQUEST",
+        "NETWORK_ERROR"
+      ]
+    },
+    "get-pin": {
+      "summary": "Read the account PIN.",
+      "method": "GET",
+      "path": "/account/{sessionId}/get-pin",
+      "usage": "get-pin",
+      "description": "Returns the PIN itself, not a status flag, so treat the output as secret.",
+      "core": "account.getPin",
+      "returns": {
+        "pin": "string | null — Null when no PIN is set."
+      }
+    },
+    "get-raw-private-key": {
+      "summary": "Read raw private key material.",
+      "method": "GET",
+      "path": "/account/{sessionId}/get-raw-private-key",
+      "usage": "get-raw-private-key --wallet-id=<walletId>",
+      "description": "Secret. Whatever the plugin stores — seed, mnemonic, xpriv.",
+      "core": "account.getRawPrivateKey",
+      "params": {
+        "walletId": {
+          "pass": "--wallet-id=<walletId>",
+          "doc": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+          "optional": false
+        }
+      },
+      "returnsDoc": "The plugin's key object, at the top level.",
+      "errors": [
+        "WALLET_NOT_FOUND",
+        "AMBIGUOUS_WALLET_ID"
+      ]
+    },
+    "get-raw-public-key": {
+      "summary": "Read raw public key material.",
+      "method": "GET",
+      "path": "/account/{sessionId}/get-raw-public-key",
+      "usage": "get-raw-public-key --wallet-id=<walletId>",
+      "core": "account.getRawPublicKey",
+      "params": {
+        "walletId": {
+          "pass": "--wallet-id=<walletId>",
+          "doc": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+          "optional": false
+        }
+      },
+      "returnsDoc": "The plugin's public key object.",
+      "errors": [
+        "WALLET_NOT_FOUND",
+        "AMBIGUOUS_WALLET_ID"
+      ]
+    },
+    "get-transactions": {
+      "summary": "List or export a wallet's transactions.",
+      "method": "GET",
+      "path": "/account/{sessionId}/wallet/get-transactions",
+      "usage": "get-transactions --wallet-id=<walletId> [--token-id=<tokenId>] [--limit=<limit>] [--offset=<offset>] [--start-date=<startDate>] [--end-date=<endDate>] [--search-string=<searchString>] [--spam-threshold=<spamThreshold>] [--fiat=<fiat>] [--export-format=<exportFormat>] [--bitwave-account=<bitwaveAccountId>] [--out=<value>]",
+      "description": "Reads history, overlays the display metadata the GUI shows, fills historical fiat, and optionally formats the result — all on this one call.",
+      "core": "wallet.getTransactions",
+      "params": {
+        "walletId": {
+          "pass": "--wallet-id=<walletId>",
+          "doc": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+          "optional": false
+        },
+        "tokenId": {
+          "pass": "[--token-id=<tokenId>]",
+          "doc": "Defaults to the native asset.",
+          "optional": true
+        },
+        "limit": {
+          "pass": "[--limit=<limit>]",
+          "doc": "Omitting it returns every transaction from `offset` on.",
+          "optional": true
+        },
+        "offset": {
+          "pass": "[--offset=<offset>]",
+          "doc": "Where to start. Defaults to 0.",
+          "optional": true
+        },
+        "startDate": {
+          "pass": "[--start-date=<startDate>]",
+          "doc": "ISO-8601, or epoch milliseconds.",
+          "optional": true
+        },
+        "endDate": {
+          "pass": "[--end-date=<endDate>]",
+          "doc": "ISO-8601, or epoch milliseconds.",
+          "optional": true
+        },
+        "searchString": {
+          "pass": "[--search-string=<searchString>]",
+          "doc": "Matches payee, category, notes and txid.",
+          "optional": true
+        },
+        "spamThreshold": {
+          "pass": "[--spam-threshold=<spamThreshold>]",
+          "doc": "Native-amount floor. Omitted, the account spam-filter setting applies; passing it always overrides.",
+          "optional": true
+        },
+        "fiat": {
+          "pass": "[--fiat=<fiat>]",
+          "doc": "Three-letter ISO 4217 code. Defaults to the account defaultIsoFiat.",
+          "optional": true
+        },
+        "exportFormat": {
+          "pass": "[--export-format=<exportFormat>]",
+          "doc": "Comma list of `csv`, `qbo`, `bitwave`.",
+          "optional": true
+        },
+        "bitwaveAccountId": {
+          "pass": "[--bitwave-account=<bitwaveAccountId>]",
+          "doc": "A 400 unless `exportFormat` includes `bitwave`.",
+          "optional": true
+        },
+        "out": {
+          "pass": "--out=<value>",
+          "doc": "Where to write the returned files. One format: the path. Several: a stem, plus .csv / .qbo / .bitwave.csv.",
+          "optional": true
+        }
+      },
+      "returnsDoc": "`{ transactions, total, isoFiat }`, or `{ ok, isoFiat, total, files }` when exportFormat is set.",
+      "notes": [
+        "The metadata overlay and the fiat fill are response-only. Neither writes to disk.",
+        "`limit` and `offset` apply before the fiat fill, so a large page costs proportionally more rates-server work.",
+        "This is the one GET that can write: passing `bitwaveAccountId` persists it to `exportTxInfo.json` on the wallet disklet."
+      ],
+      "errors": [
+        "BAD_REQUEST",
+        "MISSING_BITWAVE_ACCOUNT_ID",
+        "WALLET_NOT_FOUND",
+        "AMBIGUOUS_WALLET_ID"
+      ]
+    },
+    "get-wallet-info": {
+      "summary": "Read one wallet's key info.",
+      "method": "GET",
+      "path": "/account/{sessionId}/get-wallet-info",
+      "usage": "get-wallet-info --id=<id>",
+      "core": "account.getWalletInfo",
+      "params": {
+        "id": {
+          "pass": "--id=<id>",
+          "doc": "The key id, from `all-keys`. Base64, like a wallet id.",
+          "optional": false
+        }
+      },
+      "returnsDoc": "`EdgeWalletInfoFull`, verbatim from core — including the `keys` object.",
+      "notes": [
+        "An exact lookup: unlike the wallet-scoped routes this does not accept an id prefix."
+      ],
+      "errors": [
+        "WALLET_NOT_FOUND",
+        "AMBIGUOUS_WALLET_ID"
+      ]
+    },
+    "list-item-ids": {
+      "summary": "List item ids in a store.",
+      "method": "GET",
+      "path": "/account/{sessionId}/list-item-ids",
+      "usage": "list-item-ids --store-id=<storeId>",
+      "core": "account.dataStore.listItemIds",
+      "params": {
+        "storeId": {
+          "pass": "--store-id=<storeId>",
+          "doc": "Plugin or app namespace within the account data store.",
+          "optional": false
+        }
+      },
+      "returns": {
+        "itemIds": "string[] — Keys in this store. Empty if it has none."
+      }
+    },
+    "list-splittable-wallet-types": {
+      "summary": "List chains a wallet can split into.",
+      "method": "GET",
+      "path": "/account/{sessionId}/list-splittable-wallet-types",
+      "usage": "list-splittable-wallet-types --wallet-id=<walletId>",
+      "description": "Forked-chain support: which wallet types can be derived from these keys.",
+      "core": "account.listSplittableWalletTypes",
+      "params": {
+        "walletId": {
+          "pass": "--wallet-id=<walletId>",
+          "doc": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+          "optional": false
+        }
+      },
+      "returns": {
+        "walletTypes": "string[] — Types valid for `split`."
+      },
+      "errors": [
+        "WALLET_NOT_FOUND",
+        "AMBIGUOUS_WALLET_ID"
+      ]
+    },
+    "list-store-ids": {
+      "summary": "List data-store ids.",
+      "method": "GET",
+      "path": "/account/{sessionId}/list-store-ids",
+      "usage": "list-store-ids",
+      "description": "The account's synced key-value store, where plugins keep their own state.",
+      "core": "account.dataStore.listStoreIds",
+      "returns": {
+        "storeIds": "string[] — Every store holding at least one item."
+      }
+    },
+    "local-settings": {
+      "summary": "Change local settings.",
+      "method": "POST",
+      "path": "/account/{sessionId}/change-local-settings",
+      "usage": "local-settings --spam-filter-on=true|false",
+      "description": "Writes device-local account settings. Every option is a field on the body; `spamFilterOn` is the only one today, and new options are added alongside it.",
+      "params": {
+        "spamFilterOn": {
+          "pass": "--spam-filter-on=true|false",
+          "doc": "Hide spam transactions in `get-transactions` results. Defaults to `true`, matching the GUI. The filter hides rows; it never changes stored metadata.",
+          "optional": false
+        }
+      },
+      "returns": {
+        "spamFilterOn": "boolean — Hide spam transactions in `get-transactions` results. Defaults to `true`, matching the GUI. The filter hides rows; it never changes stored metadata."
+      },
+      "notes": [
+        "Omitting a field is a `400`, not a no-op, so a caller cannot clear a setting by accident.",
+        "With no flag the command reads; with one it writes."
+      ]
+    },
+    "local-users": {
+      "summary": "List local users on this device.",
+      "method": "GET",
+      "path": "/local-users",
+      "usage": "local-users",
+      "core": "context.localUsers",
+      "returns": {
+        "localUsers": "unknown[] — `EdgeUserInfo[]`: one entry per account cached on this device."
+      },
+      "returnsDoc": "Everything `context.localUsers` reports, including which login methods each user has enabled on this device."
+    },
+    "login-with-key": {
+      "summary": "Log in with an account login key.",
+      "method": "POST",
+      "path": "/login-with-key",
+      "usage": "login-with-key [--otp=<otp>] [--otp-key=<otpKey>] [--challenge-id=<challengeId>] --username-or-login-id=<usernameOrLoginId> --login-key=<loginKey> [--use-login-id]",
+      "description": "The key comes from `get-login-key` on an already-authenticated session.",
+      "core": "context.loginWithKey",
+      "params": {
+        "otp": {
+          "pass": "[--otp=<otp>]",
+          "doc": "A current 2FA code.",
+          "optional": true
+        },
+        "otpKey": {
+          "pass": "[--otp-key=<otpKey>]",
+          "doc": "The 2FA secret itself, instead of a code.",
+          "optional": true
+        },
+        "challengeId": {
+          "pass": "[--challenge-id=<challengeId>]",
+          "doc": "Supply after solving a CAPTCHA to retry the same request.",
+          "optional": true
+        },
+        "usernameOrLoginId": {
+          "pass": "--username-or-login-id=<usernameOrLoginId>",
+          "doc": "A username, or a login id.",
+          "optional": false
+        },
+        "loginKey": {
+          "pass": "--login-key=<loginKey>",
+          "doc": "From `get-login-key`.",
+          "optional": false
+        },
+        "useLoginId": {
+          "pass": "[--use-login-id]",
+          "doc": "Treat the value as a login id.",
+          "optional": true
+        }
+      },
+      "returns": {
+        "sessionId": "string — Identifies this login. Every account-scoped call carries it, and the CLI stores the most recent one so commands can omit it.",
+        "username?": "string — Absent for a light account, which has no username.",
+        "rootLoginId": "string — The account root, stable across appIds. Two sessions sharing it are the same account.",
+        "loginMethod": "\"password\" | \"pin\" | \"key\" | \"recovery\" | \"edge\" | \"create\" — How this session was established.",
+        "autoLogoutSeconds": "number — Idle time before the engine logs the account out. 0 disables it.",
+        "expiresAt": "string | null — When auto-logout will fire, or null when it is disabled.",
+        "lastActivityAt": "string — Last call on this session, which is what auto-logout measures from.",
+        "createdAt": "string — When the login completed."
+      },
+      "returnsDoc": "A session with `loginMethod: \"key\"`.",
+      "errors": [
+        "PASSWORD_ERROR",
+        "USERNAME_ERROR",
+        "NETWORK_ERROR"
+      ]
+    },
+    "login-with-password": {
+      "summary": "Log in with a password.",
+      "method": "POST",
+      "path": "/login-with-password",
+      "usage": "login-with-password [--otp=<otp>] [--otp-key=<otpKey>] [--challenge-id=<challengeId>] --username=<username> --password=<password>",
+      "core": "context.loginWithPassword",
+      "params": {
+        "otp": {
+          "pass": "[--otp=<otp>]",
+          "doc": "A current 2FA code.",
+          "optional": true
+        },
+        "otpKey": {
+          "pass": "[--otp-key=<otpKey>]",
+          "doc": "The 2FA secret itself, instead of a code.",
+          "optional": true
+        },
+        "challengeId": {
+          "pass": "[--challenge-id=<challengeId>]",
+          "doc": "Supply after solving a CAPTCHA to retry the same request.",
+          "optional": true
+        },
+        "username": {
+          "pass": "--username=<username>",
+          "doc": "The account name.",
+          "optional": false
+        },
+        "password": {
+          "pass": "--password=<password>",
+          "doc": "The account password.",
+          "optional": false
+        }
+      },
+      "returns": {
+        "sessionId": "string — Identifies this login. Every account-scoped call carries it, and the CLI stores the most recent one so commands can omit it.",
+        "username?": "string — Absent for a light account, which has no username.",
+        "rootLoginId": "string — The account root, stable across appIds. Two sessions sharing it are the same account.",
+        "loginMethod": "\"password\" | \"pin\" | \"key\" | \"recovery\" | \"edge\" | \"create\" — How this session was established.",
+        "autoLogoutSeconds": "number — Idle time before the engine logs the account out. 0 disables it.",
+        "expiresAt": "string | null — When auto-logout will fire, or null when it is disabled.",
+        "lastActivityAt": "string — Last call on this session, which is what auto-logout measures from.",
+        "createdAt": "string — When the login completed."
+      },
+      "returnsDoc": "A session with `loginMethod: \"password\"`.",
+      "notes": [
+        "With `--solve-captcha` the client solves a `CHALLENGE_REQUIRED` response headlessly (ALTCHA proof-of-work) and retries once."
+      ],
+      "errors": [
+        "PASSWORD_ERROR",
+        "USERNAME_ERROR",
+        "OTP_REQUIRED",
+        "CHALLENGE_REQUIRED",
+        "NETWORK_ERROR"
+      ]
+    },
+    "login-with-pin": {
+      "summary": "Log in with a device PIN.",
+      "method": "POST",
+      "path": "/login-with-pin",
+      "usage": "login-with-pin [--otp=<otp>] [--otp-key=<otpKey>] [--challenge-id=<challengeId>] --username-or-login-id=<usernameOrLoginId> --pin=<pin> [--use-login-id]",
+      "description": "Only works on a device that has already saved a PIN for the account.",
+      "core": "context.loginWithPIN",
+      "params": {
+        "otp": {
+          "pass": "[--otp=<otp>]",
+          "doc": "A current 2FA code.",
+          "optional": true
+        },
+        "otpKey": {
+          "pass": "[--otp-key=<otpKey>]",
+          "doc": "The 2FA secret itself, instead of a code.",
+          "optional": true
+        },
+        "challengeId": {
+          "pass": "[--challenge-id=<challengeId>]",
+          "doc": "Supply after solving a CAPTCHA to retry the same request.",
+          "optional": true
+        },
+        "usernameOrLoginId": {
+          "pass": "--username-or-login-id=<usernameOrLoginId>",
+          "doc": "A username, or a login id.",
+          "optional": false
+        },
+        "pin": {
+          "pass": "--pin=<pin>",
+          "doc": "The device PIN.",
+          "optional": false
+        },
+        "useLoginId": {
+          "pass": "[--use-login-id]",
+          "doc": "Treat the value as a login id.",
+          "optional": true
+        }
+      },
+      "returns": {
+        "sessionId": "string — Identifies this login. Every account-scoped call carries it, and the CLI stores the most recent one so commands can omit it.",
+        "username?": "string — Absent for a light account, which has no username.",
+        "rootLoginId": "string — The account root, stable across appIds. Two sessions sharing it are the same account.",
+        "loginMethod": "\"password\" | \"pin\" | \"key\" | \"recovery\" | \"edge\" | \"create\" — How this session was established.",
+        "autoLogoutSeconds": "number — Idle time before the engine logs the account out. 0 disables it.",
+        "expiresAt": "string | null — When auto-logout will fire, or null when it is disabled.",
+        "lastActivityAt": "string — Last call on this session, which is what auto-logout measures from.",
+        "createdAt": "string — When the login completed."
+      },
+      "returnsDoc": "A session with `loginMethod: \"pin\"`.",
+      "errors": [
+        "PASSWORD_ERROR",
+        "PIN_DISABLED",
+        "USERNAME_ERROR",
+        "BAD_REQUEST",
+        "NETWORK_ERROR"
+      ]
+    },
+    "login-with-recovery": {
+      "summary": "Log in with recovery answers.",
+      "method": "POST",
+      "path": "/login-with-recovery",
+      "usage": "login-with-recovery [--otp=<otp>] [--otp-key=<otpKey>] [--challenge-id=<challengeId>] --recovery-key=<recoveryKey> --username=<username> --answer=<answers> …",
+      "description": "Needs both the recovery key and the answers; neither works alone.",
+      "core": "context.loginWithRecovery2",
+      "params": {
+        "otp": {
+          "pass": "[--otp=<otp>]",
+          "doc": "A current 2FA code.",
+          "optional": true
+        },
+        "otpKey": {
+          "pass": "[--otp-key=<otpKey>]",
+          "doc": "The 2FA secret itself, instead of a code.",
+          "optional": true
+        },
+        "challengeId": {
+          "pass": "[--challenge-id=<challengeId>]",
+          "doc": "Supply after solving a CAPTCHA to retry the same request.",
+          "optional": true
+        },
+        "recoveryKey": {
+          "pass": "--recovery-key=<recoveryKey>",
+          "doc": "From `change-recovery`.",
+          "optional": false
+        },
+        "username": {
+          "pass": "--username=<username>",
+          "doc": "The account name.",
+          "optional": false
+        },
+        "answers": {
+          "pass": "--answer=<answers> …",
+          "doc": "In the same order as the questions.",
+          "optional": false
+        }
+      },
+      "returns": {
+        "sessionId": "string — Identifies this login. Every account-scoped call carries it, and the CLI stores the most recent one so commands can omit it.",
+        "username?": "string — Absent for a light account, which has no username.",
+        "rootLoginId": "string — The account root, stable across appIds. Two sessions sharing it are the same account.",
+        "loginMethod": "\"password\" | \"pin\" | \"key\" | \"recovery\" | \"edge\" | \"create\" — How this session was established.",
+        "autoLogoutSeconds": "number — Idle time before the engine logs the account out. 0 disables it.",
+        "expiresAt": "string | null — When auto-logout will fire, or null when it is disabled.",
+        "lastActivityAt": "string — Last call on this session, which is what auto-logout measures from.",
+        "createdAt": "string — When the login completed."
+      },
+      "returnsDoc": "A session with `loginMethod: \"recovery\"`.",
+      "errors": [
+        "PASSWORD_ERROR",
+        "USERNAME_ERROR",
+        "NETWORK_ERROR"
+      ]
+    },
+    "logout": {
+      "summary": "Log out.",
+      "method": "POST",
+      "path": "/account/{sessionId}/logout",
+      "usage": "logout",
+      "description": "Ends the session and drops it from the engine. Any subscription scoped to this account or its wallets is closed with it.",
+      "core": "account.logout",
+      "notes": [
+        "Also clears the stored id from `session.json`."
+      ]
+    },
+    "make-spend": {
+      "summary": "Build an unsigned transaction.",
+      "method": "POST",
+      "path": "/account/{sessionId}/wallet/make-spend",
+      "usage": "make-spend --wallet-id=<walletId> [--spend-info='<json>'] [--to=<to>] [--native-amount=<nativeAmount>] [--amount=<amount>] [--token-id=<tokenId>] [--metadata='<json>']",
+      "description": "First step of the staged workflow: nothing is signed and no funds move. Inspect `transaction.networkFee` on the result before signing.",
+      "core": "wallet.makeSpend",
+      "params": {
+        "walletId": {
+          "pass": "--wallet-id=<walletId>",
+          "doc": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+          "optional": false
+        },
+        "spendInfo": {
+          "pass": "[--spend-info='<json>']",
+          "doc": "A full `EdgeSpendInfo`, used as-is when present.",
+          "optional": true
+        },
+        "to": {
+          "pass": "[--to=<to>]",
+          "doc": "Address or BIP21 URI, run through `wallet.parseUri`.",
+          "optional": true
+        },
+        "nativeAmount": {
+          "pass": "[--native-amount=<nativeAmount>]",
+          "doc": "How much, in native units.",
+          "optional": true
+        },
+        "amount": {
+          "pass": "[--amount=<amount>]",
+          "doc": "Alias of `nativeAmount`.",
+          "optional": true
+        },
+        "tokenId": {
+          "pass": "[--token-id=<tokenId>]",
+          "doc": "Defaults to the native asset.",
+          "optional": true
+        },
+        "metadata": {
+          "pass": "[--metadata='<json>']",
+          "doc": "Wins over anything parsed out of the URI.",
+          "optional": true
+        }
+      },
+      "returns": {
+        "objectId": "string — Handle for the value the engine is holding. Pass it to the calls that consume it.",
+        "kind": "string — What the handle refers to, which decides the calls that accept it.",
+        "expiresAt": "string — When the engine drops the handle. Handles live 5 minutes.",
+        "sessionId?": "string — Session that created the handle; only that session may use it.",
+        "walletId?": "string — Wallet the handle is bound to, when it belongs to one.",
+        "transaction": "unknown — `EdgeTransaction` as it stands after this step. Unsigned after `make-spend`, signed after `sign-tx`, and carrying a txid once broadcast."
+      },
+      "errors": [
+        "INSUFFICIENT_FUNDS",
+        "DUST_SPEND",
+        "NO_AMOUNT_SPECIFIED",
+        "BAD_REQUEST"
+      ]
+    },
+    "object-delete": {
+      "summary": "Release an object handle.",
+      "method": "POST",
+      "path": "/account/{sessionId}/object/delete/{objectId}",
+      "usage": "object-delete <objectId>",
+      "description": "Runs the handle's cleanup — closing a swap quote, cancelling a pending login — instead of waiting out the TTL.",
+      "returns": {
+        "ok": "boolean — Always true; a failure arrives as an error envelope.",
+        "objectId": "string — The handle this call consumed. It is now expired."
+      },
+      "errors": [
+        "OBJECT_NOT_FOUND",
+        "OBJECT_EXPIRED",
+        "OBJECT_SESSION_MISMATCH"
+      ]
+    },
+    "object-get": {
+      "summary": "Inspect an object handle.",
+      "method": "GET",
+      "path": "/account/{sessionId}/object/{objectId}",
+      "usage": "object-get <objectId>",
+      "description": "Works for every kind: transactions, pending logins, swap quotes.",
+      "returns": {
+        "objectId": "string — Handle for the value the engine is holding. Pass it to the calls that consume it.",
+        "kind": "string — What the handle refers to, which decides the calls that accept it.",
+        "expiresAt": "string — When the engine drops the handle. Handles live 5 minutes.",
+        "sessionId?": "string — Session that created the handle; only that session may use it.",
+        "walletId?": "string — Wallet the handle is bound to, when it belongs to one."
+      },
+      "returnsDoc": "The handle fields, plus a `value` holding the live core object.",
+      "notes": [
+        "Reading does not extend the TTL. Only a step that updates the value does."
+      ],
+      "errors": [
+        "OBJECT_NOT_FOUND",
+        "OBJECT_EXPIRED",
+        "OBJECT_SESSION_MISMATCH"
+      ]
+    },
+    "otp-key": {
+      "summary": "Read the 2FA secret and reset state.",
+      "method": "GET",
+      "path": "/account/{sessionId}/otp-key",
+      "usage": "otp-key",
+      "core": "account.otpKey",
+      "returns": {
+        "otpKey": "string | null — Null when 2FA is off. The 2FA secret itself. Secret material — record it safely.",
+        "otpResetDate": "string | null — Set once somebody has requested a reset; cancel it with `cancel-otp-reset`."
+      }
+    },
+    "parse-uri": {
+      "summary": "Parse a payment URI or address.",
+      "method": "POST",
+      "path": "/account/{sessionId}/wallet/parse-uri",
+      "usage": "parse-uri --wallet-id=<walletId> --uri=<uri> [--currency-code=<currencyCode>]",
+      "description": "What the GUI address tile does when you paste or scan something.",
+      "core": "wallet.parseUri",
+      "params": {
+        "walletId": {
+          "pass": "--wallet-id=<walletId>",
+          "doc": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+          "optional": false
+        },
+        "uri": {
+          "pass": "--uri=<uri>",
+          "doc": "A payment URI or a bare address.",
+          "optional": false
+        },
+        "currencyCode": {
+          "pass": "[--currency-code=<currencyCode>]",
+          "doc": "Disambiguates on chains that carry several assets.",
+          "optional": true
+        }
+      },
+      "returnsDoc": "`EdgeParsedUri`: publicAddress, nativeAmount, currencyCode, metadata, paymentProtocolUrl, …",
+      "notes": [
+        "`spend` and `make-spend` run their `to` field through this same call, so parsing separately is only needed to inspect or confirm first."
+      ],
+      "errors": [
+        "BAD_REQUEST",
+        "WALLET_NOT_FOUND",
+        "AMBIGUOUS_WALLET_ID"
+      ]
+    },
+    "pending-vouchers": {
+      "summary": "List pending 2FA vouchers.",
+      "method": "GET",
+      "path": "/account/{sessionId}/pending-vouchers",
+      "usage": "pending-vouchers",
+      "description": "When 2FA blocks a login, the login server issues a voucher that an already-trusted device can approve or reject.",
+      "core": "account.pendingVouchers",
+      "returns": {
+        "pendingVouchers": "unknown[] — `EdgePendingVoucher[]`: voucherId, activates, created, deviceDescription, ipDescription."
+      }
+    },
+    "poll-edge-login": {
+      "summary": "Poll a pending QR login.",
+      "method": "GET",
+      "path": "/pending-edge-login/{pendingId}",
+      "usage": "poll-edge-login <pendingId>",
+      "description": "Once `state` reaches `done` the engine has already created the session, so the response carries one ready to use.",
+      "returns": {
+        "objectId": "string — Handle for the value the engine is holding. Pass it to the calls that consume it.",
+        "pendingId": "string — Same value as `objectId`, under the name the poll command takes.",
+        "kind": "string — What the handle refers to, which decides the calls that accept it.",
+        "expiresAt": "string | null — When the lobby closes and the QR code stops working.",
+        "lobbyId": "string — Lobby the phone connects to.",
+        "uri": "string — The `edge://` URI to render as a QR code for the phone to scan.",
+        "state": "string — How far the login has got: `pending` before the phone scans, `started` once it has, and `done` when `session` is filled in.",
+        "username": "string | null — Account that approved the login, known once the phone has scanned.",
+        "session": "{ sessionId: string; username: string | undefined; rootLoginId: string; loginMethod: \"password\" | \"pin\" | \"key\" | \"recovery\" | \"edge\" | \"create\"; autoLogoutSeconds: number; expiresAt: string | null; lastActivityAt: string; createdAt: string; } | null — The session, null until `state` is `done`.",
+        "error": "string | null — Why the login failed, set only when `state` is `error`."
+      },
+      "notes": [
+        "Session creation is attempted once. A failure is sticky, so later polls report the same `error` rather than retrying.",
+        "Polling does not extend the handle TTL; only the original 5 minute window applies."
+      ],
+      "errors": [
+        "PENDING_LOGIN_NOT_FOUND",
+        "OBJECT_EXPIRED"
+      ]
+    },
+    "rates-query": {
+      "summary": "Batch crypto and fiat rate lookups.",
+      "method": "POST",
+      "path": "/rates/query",
+      "usage": "rates-query [--crypto='<json>'] [--fiat='<json>']",
+      "description": "Concurrent lookups share one rates-server queue, so asking for many rates at once costs a single upstream request.",
+      "params": {
+        "crypto": {
+          "pass": "[--crypto='<json>']",
+          "doc": "Crypto rates to fetch.",
+          "optional": true
+        },
+        "fiat": {
+          "pass": "[--fiat='<json>']",
+          "doc": "Fiat rates to fetch.",
+          "optional": true
+        }
+      },
+      "returns": {
+        "crypto": "{ pluginId: string; tokenId: string | null; targetFiat: string; date: string; rate: number; }[] — Always present; empty when no crypto rates were requested.",
+        "fiat": "{ fiatCode: string; targetFiat: string; date: string; rate: number; }[] — Always present; empty when no fiat rates were requested."
+      },
+      "notes": [
+        "A rate the server cannot supply comes back as `0` rather than an error, so check for zero before dividing."
+      ],
+      "errors": [
+        "BAD_REQUEST",
+        "NETWORK_ERROR"
+      ]
+    },
+    "rates-usd-to-native": {
+      "summary": "Convert a USD amount into native units.",
+      "method": "POST",
+      "path": "/rates/usd-to-native",
+      "usage": "rates-usd-to-native --usd-amount=<usdAmount> --plugin-id=<pluginId> [--token-id=<tokenId>] [--multiplier=<multiplier>] [--date=<date>]",
+      "description": "Turns a fiat notional into the native amount a spend needs.",
+      "params": {
+        "usdAmount": {
+          "pass": "--usd-amount=<usdAmount>",
+          "doc": "A string, which must parse to a positive finite number.",
+          "optional": false
+        },
+        "pluginId": {
+          "pass": "--plugin-id=<pluginId>",
+          "doc": "Which chain to price.",
+          "optional": false
+        },
+        "tokenId": {
+          "pass": "[--token-id=<tokenId>]",
+          "doc": "Defaults to the native asset.",
+          "optional": true
+        },
+        "multiplier": {
+          "pass": "[--multiplier=<multiplier>]",
+          "doc": "Native units per whole coin. Defaults per plugin.",
+          "optional": true
+        },
+        "date": {
+          "pass": "[--date=<date>]",
+          "doc": "ISO-8601. Omitted, the current time is sent to the rates server.",
+          "optional": true
+        }
+      },
+      "returns": {
+        "usdAmount": "number — Echoed as a number, though it is sent as a string.",
+        "pluginId": "string — Currency plugin the amount was converted for.",
+        "tokenId": "string | null — The asset, or null for the chain’s own coin.",
+        "multiplier": "string — Native units per whole coin, which is what the conversion divided by.",
+        "date": "string — The timestamp actually used for the rate.",
+        "rate": "number — USD per whole coin at that date.",
+        "displayAmount": "string — Whole coins, to 8 decimal places.",
+        "nativeAmount": "string — What a spend actually takes."
+      },
+      "notes": [
+        "`displayAmount` is rounded to 8 decimals before conversion, so assets with finer precision lose the tail. For an exact figure use `rates-query` and do the arithmetic yourself.",
+        "Default multipliers cover bitcoin, ethereum, bitcoincash, litecoin and dogecoin; pass `multiplier` explicitly for anything else."
+      ],
+      "errors": [
+        "BAD_REQUEST",
+        "NOT_FOUND",
+        "NETWORK_ERROR"
+      ]
+    },
+    "reject-voucher": {
+      "summary": "Reject a voucher.",
+      "method": "POST",
+      "path": "/account/{sessionId}/reject-voucher",
+      "usage": "reject-voucher --voucher-id=<voucherId>",
+      "description": "Denies the waiting device. The login it was issued for cannot complete.",
+      "core": "account.rejectVoucher",
+      "params": {
+        "voucherId": {
+          "pass": "--voucher-id=<voucherId>",
+          "doc": "From `pending-vouchers`, or an `OTP_REQUIRED` error’s `details.voucherId`.",
+          "optional": false
+        }
+      },
+      "errors": [
+        "BAD_REQUEST",
+        "NETWORK_ERROR"
+      ]
+    },
+    "rename-wallet": {
+      "summary": "Rename a wallet.",
+      "method": "POST",
+      "path": "/account/{sessionId}/wallet/rename-wallet",
+      "usage": "rename-wallet --wallet-id=<walletId> --name=<name>",
+      "core": "wallet.renameWallet",
+      "params": {
+        "walletId": {
+          "pass": "--wallet-id=<walletId>",
+          "doc": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+          "optional": false
+        },
+        "name": {
+          "pass": "--name=<name>",
+          "doc": "The new display name.",
+          "optional": false
+        }
+      },
+      "errors": [
+        "BAD_REQUEST"
+      ]
+    },
+    "repair-otp": {
+      "summary": "Re-point the account at a known 2FA secret.",
+      "method": "POST",
+      "path": "/account/{sessionId}/repair-otp",
+      "usage": "repair-otp --otp-key=<otpKey>",
+      "description": "For a device whose stored secret has drifted from the server's.",
+      "core": "account.repairOtp",
+      "params": {
+        "otpKey": {
+          "pass": "--otp-key=<otpKey>",
+          "doc": "The secret the account should use.",
+          "optional": false
+        }
+      },
+      "errors": [
+        "OTP_REQUIRED",
+        "BAD_REQUEST"
+      ]
+    },
+    "request-edge-login": {
+      "summary": "Start a QR login.",
+      "method": "POST",
+      "path": "/request-edge-login",
+      "usage": "request-edge-login [--no-wait]",
+      "description": "Asks the login server for a lobby another logged-in Edge device can approve. The returned `lobbyId` is what goes in the QR code.",
+      "core": "context.requestEdgeLogin",
+      "params": {
+        "no-wait": {
+          "pass": "--no-wait",
+          "doc": "Print the lobby and exit instead of polling, so the QR can be displayed while `poll-edge-login` watches the same handle from another process.",
+          "optional": true
+        }
+      },
+      "returns": {
+        "objectId": "string — Handle for the value the engine is holding. Pass it to the calls that consume it.",
+        "pendingId": "string — Same value as `objectId`, under the name the poll command takes.",
+        "kind": "string — What the handle refers to, which decides the calls that accept it.",
+        "expiresAt": "string | null — When the lobby closes and the QR code stops working.",
+        "lobbyId": "string — Lobby the phone connects to.",
+        "uri": "string — The `edge://` URI to render as a QR code for the phone to scan.",
+        "state": "string — How far the login has got: `pending` before the phone scans, `started` once it has, and `done` when `session` is filled in.",
+        "username": "string | null — Account that approved the login, known once the phone has scanned.",
+        "session": "{ sessionId: string; username: string | undefined; rootLoginId: string; loginMethod: \"password\" | \"pin\" | \"key\" | \"recovery\" | \"edge\" | \"create\"; autoLogoutSeconds: number; expiresAt: string | null; lastActivityAt: string; createdAt: string; } | null — The session, null until `state` is `done`.",
+        "error": "string | null — Why the login failed, set only when `state` is `error`."
+      },
+      "notes": [
+        "The pending login is an object handle with a 5 minute TTL. On expiry the engine cancels the request on the login server for you.",
+        "Prints the pending login, then polls every 2s for up to 5 minutes. On `done` it stores the session. With `--no-wait` it returns immediately and `poll-edge-login` takes over."
+      ],
+      "errors": [
+        "NETWORK_ERROR"
+      ]
+    },
+    "request-otp-reset": {
+      "summary": "Request a 2FA reset.",
+      "method": "POST",
+      "path": "/request-otp-reset",
+      "usage": "request-otp-reset --username=<username> --otp-reset-token=<otpResetToken>",
+      "description": "Starts the timed reset a user falls back on after losing their authenticator.",
+      "core": "context.requestOtpReset",
+      "params": {
+        "username": {
+          "pass": "--username=<username>",
+          "doc": "Whose 2FA to reset.",
+          "optional": false
+        },
+        "otpResetToken": {
+          "pass": "--otp-reset-token=<otpResetToken>",
+          "doc": "From `details.resetToken` on an `OTP_REQUIRED` error.",
+          "optional": false
+        }
+      },
+      "returns": {
+        "resetDate": "string — When 2FA will actually come off. The login server enforces a waiting period so the real owner has time to cancel."
+      },
+      "returnsDoc": "When the reset completes if nobody cancels it.",
+      "errors": [
+        "USERNAME_ERROR",
+        "BAD_REQUEST",
+        "NETWORK_ERROR"
+      ]
+    },
+    "resync-blockchain": {
+      "summary": "Rescan the blockchain from scratch.",
+      "method": "POST",
+      "path": "/account/{sessionId}/wallet/resync-blockchain",
+      "usage": "resync-blockchain --wallet-id=<walletId>",
+      "description": "Drops cached chain state and re-scans. Expensive, and the wallet reports an incomplete balance until it finishes.",
+      "core": "wallet.resyncBlockchain",
+      "params": {
+        "walletId": {
+          "pass": "--wallet-id=<walletId>",
+          "doc": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+          "optional": false
+        }
+      },
+      "notes": [
+        "Returns when the resync is requested, not when it completes. Watch `syncRatio` for progress."
+      ]
+    },
+    "save-tx": {
+      "summary": "Record a transaction and release its handle.",
+      "method": "POST",
+      "path": "/account/{sessionId}/save-tx/{objectId}",
+      "usage": "save-tx <objectId>",
+      "description": "Final step. The handle is gone afterwards, so a second call is a 404.",
+      "core": "wallet.saveTx",
+      "params": {
+        "objectId": {
+          "pass": "<objectId>",
+          "doc": "The handle to persist and release.",
+          "optional": false
+        }
+      },
+      "returns": {
+        "ok": "boolean — Always true; a failure arrives as an error envelope.",
+        "objectId": "string — The handle this call consumed. It is now expired."
+      },
+      "errors": [
+        "BAD_REQUEST"
+      ]
+    },
+    "save-tx-action": {
+      "summary": "Save a transaction action.",
+      "method": "POST",
+      "path": "/account/{sessionId}/wallet/save-tx-action",
+      "usage": "save-tx-action --wallet-id=<walletId> --txid=<txid> [--token-id=<tokenId>] --saved-action='<json>' [--asset-action='<json>']",
+      "description": "Records what a transaction *was* — a swap, a stake — beyond its metadata.",
+      "core": "wallet.saveTxAction",
+      "params": {
+        "walletId": {
+          "pass": "--wallet-id=<walletId>",
+          "doc": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+          "optional": false
+        },
+        "txid": {
+          "pass": "--txid=<txid>",
+          "doc": "Which transaction to annotate.",
+          "optional": false
+        },
+        "tokenId": {
+          "pass": "[--token-id=<tokenId>]",
+          "doc": "Defaults to the native asset.",
+          "optional": true
+        },
+        "savedAction": {
+          "pass": "--saved-action='<json>'",
+          "doc": "`EdgeTxAction` describing what happened.",
+          "optional": false
+        },
+        "assetAction": {
+          "pass": "[--asset-action='<json>']",
+          "doc": "`EdgeAssetAction`.",
+          "optional": true
+        }
+      },
+      "notes": [
+        "When `assetAction` is omitted it defaults to `{ assetActionType: 'transfer' }`."
+      ],
+      "errors": [
+        "BAD_REQUEST",
+        "WALLET_NOT_FOUND",
+        "AMBIGUOUS_WALLET_ID"
+      ]
+    },
+    "save-tx-metadata": {
+      "summary": "Save transaction metadata.",
+      "method": "POST",
+      "path": "/account/{sessionId}/wallet/save-tx-metadata",
+      "usage": "save-tx-metadata --wallet-id=<walletId> --txid=<txid> [--token-id=<tokenId>] --metadata='<json>'",
+      "description": "One of only two routes that write transaction metadata to disk.",
+      "core": "wallet.saveTxMetadata",
+      "params": {
+        "walletId": {
+          "pass": "--wallet-id=<walletId>",
+          "doc": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+          "optional": false
+        },
+        "txid": {
+          "pass": "--txid=<txid>",
+          "doc": "Which transaction to tag.",
+          "optional": false
+        },
+        "tokenId": {
+          "pass": "[--token-id=<tokenId>]",
+          "doc": "Defaults to the native asset.",
+          "optional": true
+        },
+        "metadata": {
+          "pass": "--metadata='<json>'",
+          "doc": "`EdgeMetadataChange`: name, category, notes, exchangeAmount.",
+          "optional": false
+        }
+      },
+      "notes": [
+        "`metadata` is an `EdgeMetadataChange`, so an explicit null clears a field while an omitted one is left alone."
+      ],
+      "errors": [
+        "BAD_REQUEST",
+        "WALLET_NOT_FOUND",
+        "AMBIGUOUS_WALLET_ID"
+      ]
+    },
+    "set-fiat-currency-code": {
+      "summary": "Change a wallet's fiat currency.",
+      "method": "POST",
+      "path": "/account/{sessionId}/wallet/set-fiat-currency-code",
+      "usage": "set-fiat-currency-code --wallet-id=<walletId> --fiat-currency-code=<fiatCurrencyCode>",
+      "description": "Affects how balances and history are priced, not the asset itself.",
+      "core": "wallet.setFiatCurrencyCode",
+      "params": {
+        "walletId": {
+          "pass": "--wallet-id=<walletId>",
+          "doc": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+          "optional": false
+        },
+        "fiatCurrencyCode": {
+          "pass": "--fiat-currency-code=<fiatCurrencyCode>",
+          "doc": "e.g. `iso:EUR`.",
+          "optional": false
+        }
+      },
+      "errors": [
+        "BAD_REQUEST"
+      ]
+    },
+    "set-item": {
+      "summary": "Write an item.",
+      "method": "POST",
+      "path": "/account/{sessionId}/set-item",
+      "usage": "set-item --store-id=<storeId> --item-id=<itemId> --value=<value>",
+      "description": "Creates the store if it does not exist.",
+      "core": "account.dataStore.setItem",
+      "params": {
+        "storeId": {
+          "pass": "--store-id=<storeId>",
+          "doc": "Plugin or app namespace within the account data store.",
+          "optional": false
+        },
+        "itemId": {
+          "pass": "--item-id=<itemId>",
+          "doc": "Key within the store.",
+          "optional": false
+        },
+        "value": {
+          "pass": "--value=<value>",
+          "doc": "The string to store.",
+          "optional": false
+        }
+      },
+      "errors": [
+        "BAD_REQUEST"
+      ]
+    },
+    "sign-bytes": {
+      "summary": "Sign arbitrary bytes.",
+      "method": "POST",
+      "path": "/account/{sessionId}/wallet/sign-bytes",
+      "usage": "sign-bytes --wallet-id=<walletId> [--bytes=<bytes>] [--other-params='<json>']",
+      "description": "Message signing and proof-of-ownership, for plugins that support it.",
+      "core": "wallet.signBytes",
+      "params": {
+        "walletId": {
+          "pass": "--wallet-id=<walletId>",
+          "doc": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+          "optional": false
+        },
+        "bytes": {
+          "pass": "[--bytes=<bytes>]",
+          "doc": "Base64. Defaults to empty when absent.",
+          "optional": true
+        },
+        "otherParams": {
+          "pass": "[--other-params='<json>']",
+          "doc": "Plugin-specific options. Bitcoin needs `{ publicAddress }`; other plugins take nothing, or refuse the call entirely.",
+          "optional": true
+        }
+      },
+      "returns": {
+        "signature": "string — Base64."
+      },
+      "notes": [
+        "Invalid base64 decodes to empty rather than erroring, so validate before sending.",
+        "Support is per plugin, and failures surface as `500 INTERNAL_ERROR` from the plugin rather than as a typed error: litecoin answers \"litecoin doesn't support signBytes\", and bitcoin requires `otherParams.publicAddress` naming which address to sign with."
+      ],
+      "errors": [
+        "BAD_REQUEST"
+      ]
+    },
+    "sign-tx": {
+      "summary": "Sign a staged transaction.",
+      "method": "POST",
+      "path": "/account/{sessionId}/sign-tx/{objectId}",
+      "usage": "sign-tx <objectId>",
+      "description": "Keeps the same handle and pushes its expiry out another five minutes.",
+      "core": "wallet.signTx",
+      "params": {
+        "objectId": {
+          "pass": "<objectId>",
+          "doc": "From `make-spend`.",
+          "optional": false
+        }
+      },
+      "returns": {
+        "objectId": "string — Handle for the value the engine is holding. Pass it to the calls that consume it.",
+        "kind": "string — What the handle refers to, which decides the calls that accept it.",
+        "expiresAt": "string — When the engine drops the handle. Handles live 5 minutes.",
+        "sessionId?": "string — Session that created the handle; only that session may use it.",
+        "walletId?": "string — Wallet the handle is bound to, when it belongs to one.",
+        "transaction": "unknown — `EdgeTransaction` as it stands after this step. Unsigned after `make-spend`, signed after `sign-tx`, and carrying a txid once broadcast."
+      },
+      "errors": [
+        "BAD_REQUEST"
+      ]
+    },
+    "spend": {
+      "summary": "Send funds.",
+      "method": "POST",
+      "path": "/account/{sessionId}/wallet/spend",
+      "usage": "spend --wallet-id=<walletId> [--spend-info='<json>'] [--to=<to>] [--native-amount=<nativeAmount>] [--amount=<amount>] [--token-id=<tokenId>] [--metadata='<json>'] [--use-max] [--dry-run] [--broadcast] [--save]",
+      "description": "`makeSpend`, then `signTx`, then optionally `broadcastTx` and `saveTx`, in one request. `broadcast` and `save` both default to true, so a bare body with a destination and an amount moves real money. A completed spend leaves no handle behind.",
+      "params": {
+        "walletId": {
+          "pass": "--wallet-id=<walletId>",
+          "doc": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+          "optional": false
+        },
+        "spendInfo": {
+          "pass": "[--spend-info='<json>']",
+          "doc": "A full `EdgeSpendInfo`, used as-is when present.",
+          "optional": true
+        },
+        "to": {
+          "pass": "[--to=<to>]",
+          "doc": "Address or BIP21 URI, run through `wallet.parseUri`.",
+          "optional": true
+        },
+        "nativeAmount": {
+          "pass": "[--native-amount=<nativeAmount>]",
+          "doc": "How much, in native units.",
+          "optional": true
+        },
+        "amount": {
+          "pass": "[--amount=<amount>]",
+          "doc": "Alias of `nativeAmount`.",
+          "optional": true
+        },
+        "tokenId": {
+          "pass": "[--token-id=<tokenId>]",
+          "doc": "Defaults to the native asset.",
+          "optional": true
+        },
+        "metadata": {
+          "pass": "[--metadata='<json>']",
+          "doc": "Wins over anything parsed out of the URI.",
+          "optional": true
+        },
+        "useMax": {
+          "pass": "[--use-max]",
+          "doc": "Replace the first target's amount with the maximum.",
+          "optional": true
+        },
+        "dryRun": {
+          "pass": "[--dry-run]",
+          "doc": "Build only. Never signs or broadcasts.",
+          "optional": true
+        },
+        "broadcast": {
+          "pass": "[--broadcast]",
+          "doc": "Defaults to **true**.",
+          "optional": true
+        },
+        "save": {
+          "pass": "[--save]",
+          "doc": "Defaults to **true**.",
+          "optional": true
+        }
+      },
+      "returnsDoc": "`{ transaction }`, plus `saveError` when the broadcast succeeded but saving failed. With dryRun, a TransactionHandle instead.",
+      "notes": [
+        "BIP21 `label` and `message` from `to` become metadata name and notes. An explicit `metadata` object wins.",
+        "`saveError` is the case to handle. Once broadcast, the money is gone, so a failure inside saveTx cannot throw — it would hide the txid of a real payment. The response is 200 with the transaction plus `saveError`.",
+        "With `dryRun`, only makeSpend runs and the response is a transaction handle that expires in 5 minutes."
+      ],
+      "errors": [
+        "INSUFFICIENT_FUNDS",
+        "DUST_SPEND",
+        "PENDING_FUNDS",
+        "SPEND_TO_SELF",
+        "NO_AMOUNT_SPECIFIED",
+        "BAD_REQUEST",
+        "NETWORK_ERROR"
+      ]
+    },
+    "spend-max": {
+      "summary": "Send funds.",
+      "method": "POST",
+      "path": "/account/{sessionId}/wallet/spend",
+      "usage": "spend-max --wallet-id=<walletId> [--spend-info='<json>'] [--to=<to>] [--native-amount=<nativeAmount>] [--amount=<amount>] [--token-id=<tokenId>] [--metadata='<json>'] [--use-max] [--dry-run] [--broadcast] [--save]",
+      "description": "`makeSpend`, then `signTx`, then optionally `broadcastTx` and `saveTx`, in one request. `broadcast` and `save` both default to true, so a bare body with a destination and an amount moves real money. A completed spend leaves no handle behind.",
+      "params": {
+        "walletId": {
+          "pass": "--wallet-id=<walletId>",
+          "doc": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+          "optional": false
+        },
+        "spendInfo": {
+          "pass": "[--spend-info='<json>']",
+          "doc": "A full `EdgeSpendInfo`, used as-is when present.",
+          "optional": true
+        },
+        "to": {
+          "pass": "[--to=<to>]",
+          "doc": "Address or BIP21 URI, run through `wallet.parseUri`.",
+          "optional": true
+        },
+        "nativeAmount": {
+          "pass": "[--native-amount=<nativeAmount>]",
+          "doc": "How much, in native units.",
+          "optional": true
+        },
+        "amount": {
+          "pass": "[--amount=<amount>]",
+          "doc": "Alias of `nativeAmount`.",
+          "optional": true
+        },
+        "tokenId": {
+          "pass": "[--token-id=<tokenId>]",
+          "doc": "Defaults to the native asset.",
+          "optional": true
+        },
+        "metadata": {
+          "pass": "[--metadata='<json>']",
+          "doc": "Wins over anything parsed out of the URI.",
+          "optional": true
+        },
+        "useMax": {
+          "pass": "[--use-max]",
+          "doc": "Replace the first target's amount with the maximum.",
+          "optional": true
+        },
+        "dryRun": {
+          "pass": "[--dry-run]",
+          "doc": "Build only. Never signs or broadcasts.",
+          "optional": true
+        },
+        "broadcast": {
+          "pass": "[--broadcast]",
+          "doc": "Defaults to **true**.",
+          "optional": true
+        },
+        "save": {
+          "pass": "[--save]",
+          "doc": "Defaults to **true**.",
+          "optional": true
+        }
+      },
+      "returnsDoc": "`{ transaction }`, plus `saveError` when the broadcast succeeded but saving failed. With dryRun, a TransactionHandle instead.",
+      "notes": [
+        "BIP21 `label` and `message` from `to` become metadata name and notes. An explicit `metadata` object wins.",
+        "`saveError` is the case to handle. Once broadcast, the money is gone, so a failure inside saveTx cannot throw — it would hide the txid of a real payment. The response is 200 with the transaction plus `saveError`.",
+        "With `dryRun`, only makeSpend runs and the response is a transaction handle that expires in 5 minutes.",
+        "The same route with `useMax` preset, so it sends everything."
+      ],
+      "errors": [
+        "INSUFFICIENT_FUNDS",
+        "DUST_SPEND",
+        "PENDING_FUNDS",
+        "SPEND_TO_SELF",
+        "NO_AMOUNT_SPECIFIED",
+        "BAD_REQUEST",
+        "NETWORK_ERROR"
+      ]
+    },
+    "split": {
+      "summary": "Split a wallet into another chain.",
+      "method": "POST",
+      "path": "/account/{sessionId}/wallet/split",
+      "usage": "split --wallet-id=<walletId> --split-wallets='<json>'",
+      "description": "Forked-chain support: derive a wallet of a different type from the same keys. `list-splittable-wallet-types` says which are valid.",
+      "core": "wallet.split",
+      "params": {
+        "walletId": {
+          "pass": "--wallet-id=<walletId>",
+          "doc": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+          "optional": false
+        },
+        "splitWallets": {
+          "pass": "--split-wallets='<json>'",
+          "doc": "`EdgeSplitCurrencyWallet[]`: walletType, name, fiatCurrencyCode.",
+          "optional": false
+        }
+      },
+      "returns": {
+        "results": "unknown[] — Per-entry outcomes, like batch create."
+      },
+      "errors": [
+        "BAD_REQUEST"
+      ]
+    },
+    "subscribe": {
+      "summary": "Subscribe to engine events.",
+      "method": "GET",
+      "path": "/engine/events",
+      "usage": "subscribe [--type=<value>]",
+      "description": "Holds a Server-Sent Events stream open until the caller disconnects or the engine closes it. Runs concurrently with one-shot calls, so a subscriber in one terminal watches what another terminal does.\n\nA live subscription holds the engine open past its idle timeout. It does not hold an account logged in: the auto-logout timer still fires, and closes any subscription scoped to that account or one of its wallets. Context-scoped subscriptions survive, because the context outlives every account.",
+      "params": {
+        "type": {
+          "pass": "--type=<value>",
+          "doc": "Client-side filter; the engine always sends everything the scope allows.",
+          "optional": true
+        }
+      },
+      "returns": {
+        "type": "string — The event name.",
+        "data": "unknown — Payload, shaped by the event type."
+      },
+      "returnsDoc": "One frame per event, as `event:` then `data:` lines.",
+      "notes": [
+        "Frame types: `core.log`, `session.created`, `session.expired`, `engine.shutdown`, and `subscription.closed` when the engine ends it.",
+        "`sessionId` in event payloads is truncated to its first 10 characters.",
+        "A client more than 1 MiB behind is disconnected rather than buffered.",
+        "Served directly by the HTTP handler rather than through the router, because the response never ends.",
+        "Prints newline-delimited JSON and runs until interrupted. Exits 0 on SIGINT, 3 when a session ended the stream, 7 when the engine went away."
+      ]
+    },
+    "swap-quote-get": {
+      "summary": "Re-read a quote.",
+      "method": "GET",
+      "path": "/account/{sessionId}/swap-quote/{objectId}",
+      "usage": "swap-quote-get <objectId>",
+      "returns": {
+        "objectId": "string — Handle for the value the engine is holding. Pass it to the calls that consume it.",
+        "kind": "string — What the handle refers to, which decides the calls that accept it.",
+        "expiresAt": "string — When the engine drops the handle. Handles live 5 minutes.",
+        "pluginId": "string — Swap provider that produced this quote.",
+        "isEstimate": "boolean — True when the provider may settle at a different rate than quoted.",
+        "canBePartial": "boolean | null — True when the provider may fill only part of the order. Null when it does not say.",
+        "maxFulfillmentSeconds": "number | null — Longest the provider expects a partial fill to take.",
+        "minReceiveAmount": "string | null — Least the provider guarantees to deliver, in the destination’s native units.",
+        "fromNativeAmount": "string — Amount leaving the source wallet.",
+        "toNativeAmount": "string — Amount arriving in the destination wallet.",
+        "networkFee": "{ nativeAmount: string; tokenId: string | null; } — On-chain fee for the sending transaction. It is not the provider’s own spread, which is already in the rate.",
+        "quoteExpirationDate": "string | null — When the provider stops honouring the rate. Null when it does not expire.",
+        "swapInfo": "{ pluginId: string; displayName: string; supportEmail: string; isDex: boolean | null; } — `EdgeSwapInfo`: how to name the provider and where to send complaints.",
+        "request": "{ fromTokenId: string | null; toTokenId: string | null; nativeAmount: string; quoteFor: \"to\" | \"from\" | \"max\"; fromWalletId: string; toWalletId: string; } — The `EdgeSwapRequest` this quote answers, echoed back so quotes from different plugins can be compared without tracking what was asked."
+      },
+      "notes": [
+        "Check `quoteExpirationDate` as well as `expiresAt`: the plugin's price can go stale before the handle does."
+      ],
+      "errors": [
+        "OBJECT_NOT_FOUND",
+        "OBJECT_EXPIRED",
+        "OBJECT_KIND_MISMATCH",
+        "OBJECT_SESSION_MISMATCH"
+      ]
+    },
+    "sweep-private-keys": {
+      "summary": "Sweep private keys into this wallet.",
+      "method": "POST",
+      "path": "/account/{sessionId}/wallet/sweep-private-keys",
+      "usage": "sweep-private-keys --wallet-id=<walletId> --spend-info='<json>'",
+      "description": "Builds a transaction moving everything from an external key. Returns an unsigned handle: sign, broadcast and save it like any staged spend.",
+      "core": "wallet.sweepPrivateKeys",
+      "params": {
+        "walletId": {
+          "pass": "--wallet-id=<walletId>",
+          "doc": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+          "optional": false
+        },
+        "spendInfo": {
+          "pass": "--spend-info='<json>'",
+          "doc": "A full `EdgeSpendInfo`, with the keys to sweep in `privateKeys`.",
+          "optional": false
+        }
+      },
+      "returns": {
+        "objectId": "string — Handle for the value the engine is holding. Pass it to the calls that consume it.",
+        "kind": "string — What the handle refers to, which decides the calls that accept it.",
+        "expiresAt": "string — When the engine drops the handle. Handles live 5 minutes.",
+        "sessionId?": "string — Session that created the handle; only that session may use it.",
+        "walletId?": "string — Wallet the handle is bound to, when it belongs to one.",
+        "transaction": "unknown — `EdgeTransaction` as it stands after this step. Unsigned after `make-spend`, signed after `sign-tx`, and carrying a txid once broadcast."
+      },
+      "errors": [
+        "BAD_REQUEST",
+        "INSUFFICIENT_FUNDS",
+        "NETWORK_ERROR"
+      ]
+    },
+    "sync": {
+      "summary": "Force an account data sync.",
+      "method": "POST",
+      "path": "/account/{sessionId}/sync",
+      "usage": "sync",
+      "description": "Pushes and pulls the account repos immediately rather than waiting for the next scheduled sync.",
+      "core": "account.sync",
+      "notes": [
+        "Named `sync` for the account; the wallet one is `wallet-sync`."
+      ],
+      "errors": [
+        "NETWORK_ERROR"
+      ]
+    },
+    "touch": {
+      "summary": "Keepalive.",
+      "method": "POST",
+      "path": "/account/{sessionId}/touch",
+      "usage": "touch",
+      "description": "Resets the idle auto-logout timer without doing any other work.",
+      "returns": {
+        "sessionId": "string — Identifies this login. Every account-scoped call carries it, and the CLI stores the most recent one so commands can omit it.",
+        "username?": "string — Absent for a light account, which has no username.",
+        "rootLoginId": "string — The account root, stable across appIds. Two sessions sharing it are the same account.",
+        "loginMethod": "\"password\" | \"pin\" | \"key\" | \"recovery\" | \"edge\" | \"create\" — How this session was established.",
+        "autoLogoutSeconds": "number — Idle time before the engine logs the account out. 0 disables it.",
+        "expiresAt": "string | null — When auto-logout will fire, or null when it is disabled.",
+        "lastActivityAt": "string — Last call on this session, which is what auto-logout measures from.",
+        "createdAt": "string — When the login completed."
+      },
+      "returnsDoc": "The session, with a refreshed `expiresAt`."
+    },
+    "username-available": {
+      "summary": "Check whether a username is free.",
+      "method": "GET",
+      "path": "/username-available",
+      "usage": "username-available --username=<username> [--challenge-id=<challengeId>]",
+      "core": "context.usernameAvailable",
+      "params": {
+        "username": {
+          "pass": "--username=<username>",
+          "doc": "The name to check.",
+          "optional": false
+        },
+        "challengeId": {
+          "pass": "[--challenge-id=<challengeId>]",
+          "doc": "Supply after solving a CAPTCHA to retry the same check.",
+          "optional": true
+        }
+      },
+      "returns": {
+        "username": "string — The name that was checked, echoed back.",
+        "available": "boolean — True when nobody holds this name. It is not reserved by asking."
+      },
+      "errors": [
+        "USERNAME_ERROR",
+        "CHALLENGE_REQUIRED",
+        "NETWORK_ERROR"
+      ]
+    },
+    "wait-for-all-wallets": {
+      "summary": "Wait for every wallet to finish loading.",
+      "method": "POST",
+      "path": "/account/{sessionId}/wait-for-all-wallets",
+      "usage": "wait-for-all-wallets",
+      "description": "Wallets load in the background after login, so a list taken straight afterwards can be short. This resolves once each active wallet has either loaded or failed — balances may still be syncing afterwards.",
+      "core": "account.waitForAllWallets",
+      "notes": [
+        "There is no timeout: a wallet that never resolves holds this open. The engine's own idle shutdown does not fire while a request is in flight, so give the client one.",
+        "Nothing is returned. Call `currency-wallets` afterwards to see the result, including any wallet that failed to load."
+      ]
+    },
+    "wallet-info": {
+      "summary": "Wallet detail.",
+      "method": "GET",
+      "path": "/account/{sessionId}/wallet",
+      "usage": "wallet-info --wallet-id=<walletId>",
+      "params": {
+        "walletId": {
+          "pass": "--wallet-id=<walletId>",
+          "doc": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+          "optional": false
+        }
+      },
+      "returnsDoc": "Every WalletSummary field, plus denominations, walletSettings and allTokens."
+    },
+    "wallet-sync": {
+      "summary": "Nudge one wallet to sync.",
+      "method": "POST",
+      "path": "/account/{sessionId}/wallet/sync",
+      "usage": "wallet-sync --wallet-id=<walletId>",
+      "core": "wallet.sync",
+      "params": {
+        "walletId": {
+          "pass": "--wallet-id=<walletId>",
+          "doc": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+          "optional": false
+        }
+      },
+      "notes": [
+        "Named `wallet-sync` on the CLI because `sync` is `account.sync`."
+      ]
+    },
+    "wallet-tokens": {
+      "summary": "List a wallet's tokens.",
+      "method": "GET",
+      "path": "/account/{sessionId}/wallet/tokens",
+      "usage": "wallet-tokens --wallet-id=<walletId>",
+      "description": "\"Enabled\" tokens are the ones the wallet syncs balances for; \"detected\" ones were seen on-chain but are not yet enabled.",
+      "params": {
+        "walletId": {
+          "pass": "--wallet-id=<walletId>",
+          "doc": "The wallet to act on. A full wallet id, or any unique prefix of one. An ambiguous prefix returns `409 AMBIGUOUS_WALLET_ID` with `details.candidates`.",
+          "optional": false
+        }
+      },
+      "returns": {
+        "allTokens": "{ [keys: string]: unknown; } — Built-in and custom together, keyed by tokenId. Large on EVM chains.",
+        "builtinTokens": "{ [keys: string]: unknown; } — `EdgeToken` by tokenId: everything the plugin ships with.",
+        "customTokens": "{ [keys: string]: unknown; } — `EdgeToken` by tokenId: tokens this account added by hand.",
+        "enabledTokenIds": "string[] — Which of the above the wallet is actually tracking.",
+        "detectedTokenIds": "string[] — Seen on-chain but not enabled, so their balances are not synced."
+      },
+      "errors": [
+        "WALLET_NOT_FOUND",
+        "AMBIGUOUS_WALLET_ID"
+      ]
+    }
+  }
+}
diff --git a/src/cli/index.ts b/src/cli/index.ts
new file mode 100644
index 00000000000..7e79258ec3c
--- /dev/null
+++ b/src/cli/index.ts
@@ -0,0 +1,283 @@
+import './bootNodeLocale'
+import './commands/all'
+
+import parse from 'lib-cmdparse'
+import { red } from 'nanocolors'
+import readline from 'readline'
+import sourceMapSupport from 'source-map-support'
+
+import { ApiClientError } from './client/apiClient'
+import { EXIT, printError } from './client/output'
+import {
+  clearSessionFile,
+  readSessionFile,
+  writeSessionFile
+} from './client/sessionFile'
+import { solveChallenge } from './client/solveCaptcha'
+import { ensureEngine } from './client/spawnEngine'
+import {
+  type CliContext,
+  findCommand,
+  listCommands,
+  UsageError
+} from './command'
+import { defaultDirectory, loadConfig } from './engine/cliConfig'
+import { parseCliArgs, showCliHelp } from './parseArgs'
+
+sourceMapSupport.install()
+
+function formatUsage(cmd: {
+  name: string
+  usage?: string
+  needsSession?: boolean
+}): string {
+  let out = `Usage: edge-cli ${cmd.name}`
+  if (cmd.needsSession === true) out += ' [--session <id>]'
+  if (cmd.usage != null) out += ` ${cmd.usage}`
+  return out
+}
+
+async function buildContext(options: {
+  'api-key'?: string
+  'app-id'?: string
+  config?: string
+  directory?: string
+  test?: boolean
+  fake?: boolean
+  session?: string
+  'no-spawn'?: boolean
+  tcp?: string
+}): Promise<CliContext> {
+  const fileConfig = loadConfig(options.config)
+  const appId = options['app-id'] ?? fileConfig.appId ?? ''
+  const directory =
+    options.directory ??
+    fileConfig.directory ??
+    fileConfig.workingDir ??
+    defaultDirectory()
+  const testMode = options.test != null || fileConfig.testMode === true
+  const apiKey = options['api-key'] ?? fileConfig.apiKey
+
+  const fake = options.fake != null
+  const { profile, client } = await ensureEngine({
+    appId,
+    directory,
+    testMode,
+    fake,
+    apiKey,
+    noSpawn: options['no-spawn'] != null,
+    tcpPort:
+      options.tcp != null && options.tcp !== '' ? Number(options.tcp) : null,
+    loginServer: fake
+      ? 'fake://login'
+      : testMode
+      ? 'https://login-tester.edge.app'
+      : undefined
+  })
+
+  const envSession = process.env.EDGE_CLI_SESSION
+  const fileSession = readSessionFile(profile)
+  let sessionId: string | null =
+    options.session ?? envSession ?? fileSession?.sessionId ?? null
+
+  const ctx: CliContext = {
+    client,
+    profile,
+    sessionId,
+    testMode,
+    setSessionId(id, username) {
+      sessionId = id
+      ctx.sessionId = id
+      if (id == null) clearSessionFile(profile)
+      else writeSessionFile(profile, id, username)
+    }
+  }
+  return ctx
+}
+
+async function maybeSolveAndRetry<T>(
+  solve: boolean,
+  run: (challengeId?: string) => Promise<T>
+): Promise<T> {
+  try {
+    return await run()
+  } catch (error: unknown) {
+    if (
+      !solve ||
+      !(error instanceof ApiClientError) ||
+      error.code !== 'CHALLENGE_REQUIRED' ||
+      error.details == null
+    ) {
+      throw error
+    }
+    const challengeId = await solveChallenge({
+      challengeId: String(error.details.challengeId),
+      challengeUri:
+        error.details.challengeUri != null
+          ? String(error.details.challengeUri as string)
+          : undefined
+    })
+    return await run(challengeId)
+  }
+}
+
+async function runPrompt(ctx: CliContext): Promise<void> {
+  console.log('Use the `help` command for usage information')
+  const rl = readline.createInterface({
+    input: process.stdin,
+    output: process.stdout,
+    completer(line: string) {
+      const commands = listCommands()
+      const match = commands.filter(c => c.startsWith(line))
+      return [match.length > 0 ? match : commands, line]
+    }
+  })
+
+  await new Promise<void>(resolve => {
+    const done = (): void => {
+      resolve()
+      rl.close()
+    }
+    const prompt = (): void => {
+      rl.question('> ', text => {
+        const trimmed = text.trim()
+        if (trimmed === 'exit' || trimmed === 'quit') {
+          done()
+          return
+        }
+        ;(async () => {
+          try {
+            const parsed = parse(text)
+            if (parsed.exec == null) return
+            const cmd = findCommand(parsed.exec)
+            if (cmd.needsSession === true && ctx.sessionId == null) {
+              throw new UsageError(cmd, 'Please log in first')
+            }
+            await cmd.invoke(ctx, parsed.args)
+          } catch (error: unknown) {
+            if (error instanceof UsageError) {
+              console.error(red(error.message))
+              if (error.command != null) {
+                console.error(formatUsage(error.command))
+              }
+            } else {
+              printError(error)
+            }
+          } finally {
+            prompt()
+          }
+        })().catch(() => {})
+      })
+    }
+    rl.on('close', done)
+    prompt()
+  })
+}
+
+async function main(): Promise<number> {
+  const { argv, options } = parseCliArgs(process.argv.slice(2))
+
+  if (options.help != null && argv.length === 0) {
+    showCliHelp()
+    console.log('Commands:')
+    for (const name of listCommands()) console.log(`  ${name}`)
+    return EXIT.OK
+  }
+
+  const ctx = await buildContext(options)
+  const solveCaptcha = options['solve-captcha'] != null
+
+  if (argv.length === 0) {
+    await runPrompt(ctx)
+    return EXIT.OK
+  }
+
+  const name = argv.shift()!
+  const cmd = options.help != null ? findCommand('help') : findCommand(name)
+
+  if (cmd.needsSession === true && ctx.sessionId == null) {
+    // Legacy helper: -u/-p auto password-login
+    if (options.username != null && options.password != null) {
+      const session = await maybeSolveAndRetry(
+        solveCaptcha,
+        async challengeId =>
+          await ctx.client.post<{
+            sessionId: string
+            username?: string
+          }>('/login-with-password', {
+            username: options.username,
+            password: options.password,
+            challengeId
+          })
+      )
+      ctx.setSessionId(session.sessionId, session.username)
+    } else {
+      throw new UsageError(cmd, 'Please log in first (no sessionId)')
+    }
+  }
+
+  // Special-case login commands with --solve-captcha by wrapping client.post
+  // The individual commands call client directly; we handle retry at invoke
+  // for known login command names:
+  const loginCommands = new Set([
+    'password-login',
+    'account-create',
+    'account-available',
+    'pin-login',
+    'key-login'
+  ])
+
+  if (solveCaptcha && loginCommands.has(cmd.name)) {
+    // Re-invoke with challenge retry by intercepting ApiClientError
+    try {
+      await cmd.invoke(ctx, argv)
+    } catch (error: unknown) {
+      if (
+        error instanceof ApiClientError &&
+        error.code === 'CHALLENGE_REQUIRED' &&
+        error.details != null
+      ) {
+        const challengeId = await solveChallenge({
+          challengeId: String(error.details.challengeId),
+          challengeUri:
+            error.details.challengeUri != null
+              ? String(error.details.challengeUri as string)
+              : undefined
+        })
+        ctx.challengeId = challengeId
+        await cmd.invoke(ctx, argv)
+      } else {
+        throw error
+      }
+    }
+  } else {
+    await cmd.invoke(ctx, argv)
+  }
+
+  return EXIT.OK
+}
+
+main()
+  .then(code => {
+    process.exit(code)
+  })
+  .catch((error: unknown) => {
+    if (error instanceof UsageError) {
+      console.error(
+        JSON.stringify(
+          {
+            error: {
+              code: 'USAGE',
+              message: error.message,
+              status: 400
+            }
+          },
+          null,
+          2
+        )
+      )
+      process.exit(EXIT.USAGE)
+    }
+    const code = printError(error)
+    process.exit(code)
+  })
diff --git a/src/cli/parseArgs.ts b/src/cli/parseArgs.ts
new file mode 100644
index 00000000000..cfb569b13cc
--- /dev/null
+++ b/src/cli/parseArgs.ts
@@ -0,0 +1,174 @@
+/**
+ * Minimal argv parser replacing node-getopt (which emits DEP0128 because its
+ * package.json has `"main": "./lib"` instead of a file path).
+ */
+
+export interface CliOptions {
+  'api-key'?: string
+  'app-id'?: string
+  config?: string
+  directory?: string
+  locale?: string
+  username?: string
+  password?: string
+  test?: boolean
+  fake?: boolean
+  session?: string
+  'no-spawn'?: boolean
+  'solve-captcha'?: boolean
+  tcp?: string
+  help?: boolean
+}
+
+export interface ParsedArgs {
+  options: CliOptions
+  argv: string[]
+}
+
+const HELP_TEXT = `Usage: edge-cli [options] [command] [args...]
+
+Options:
+  -k, --api-key <key>     Auth server API key
+  -a, --app-id <id>       Application ID
+  -c, --config <path>     Configuration file
+  -d, --directory <path>  Working directory
+  -u, --username <user>   Username (legacy one-shot login helper)
+  -p, --password <pass>   Password (legacy one-shot login helper)
+  -t, --test              Use tester servers
+      --session <id>      Override sessionId
+      --locale <tag>      Language tag (BCP 47 or POSIX)
+      --fake              Emulate login/info/sync in-process (no network)
+      --no-spawn          Do not auto-start the engine
+      --solve-captcha     Auto-solve CAPTCHA challenges (ALTCHA PoW)
+      --tcp=<port>        Also pass --tcp=<port> when spawning the engine
+  -h, --help              Display options
+`
+
+function takeValue(
+  argv: string[],
+  i: number,
+  flag: string
+): { value: string; next: number } {
+  const cur = argv[i]
+  const eq = cur.indexOf('=')
+  if (eq !== -1) {
+    return { value: cur.slice(eq + 1), next: i }
+  }
+  const next = argv[i + 1]
+  if (next == null || next.startsWith('-')) {
+    throw new Error(`Missing value for ${flag}`)
+  }
+  return { value: next, next: i + 1 }
+}
+
+export function parseCliArgs(argv: string[]): ParsedArgs {
+  const options: CliOptions = {}
+  const positional: string[] = []
+
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i]
+
+    if (a === '--') {
+      positional.push(...argv.slice(i + 1))
+      break
+    }
+
+    if (a === '-h' || a === '--help') {
+      options.help = true
+      continue
+    }
+    if (a === '-t' || a === '--test') {
+      options.test = true
+      continue
+    }
+    if (a === '--fake') {
+      options.fake = true
+      continue
+    }
+    if (a === '--no-spawn') {
+      options['no-spawn'] = true
+      continue
+    }
+    if (a === '--solve-captcha') {
+      options['solve-captcha'] = true
+      continue
+    }
+
+    if (a === '-k' || a === '--api-key' || a.startsWith('--api-key=')) {
+      const { value, next } = takeValue(argv, i, '--api-key')
+      options['api-key'] = value
+      i = next
+      continue
+    }
+    if (a === '-a' || a === '--app-id' || a.startsWith('--app-id=')) {
+      const { value, next } = takeValue(argv, i, '--app-id')
+      options['app-id'] = value
+      i = next
+      continue
+    }
+    if (a === '-c' || a === '--config' || a.startsWith('--config=')) {
+      const { value, next } = takeValue(argv, i, '--config')
+      options.config = value
+      i = next
+      continue
+    }
+    if (a === '-d' || a === '--directory' || a.startsWith('--directory=')) {
+      const { value, next } = takeValue(argv, i, '--directory')
+      options.directory = value
+      i = next
+      continue
+    }
+    if (a === '-u' || a === '--username' || a.startsWith('--username=')) {
+      const { value, next } = takeValue(argv, i, '--username')
+      options.username = value
+      i = next
+      continue
+    }
+    if (a === '-p' || a === '--password' || a.startsWith('--password=')) {
+      const { value, next } = takeValue(argv, i, '--password')
+      options.password = value
+      i = next
+      continue
+    }
+    if (a === '--session' || a.startsWith('--session=')) {
+      const { value, next } = takeValue(argv, i, '--session')
+      options.session = value
+      i = next
+      continue
+    }
+    if (a === '--locale' || a.startsWith('--locale=')) {
+      const { value, next } = takeValue(argv, i, '--locale')
+      options.locale = value
+      i = next
+      continue
+    }
+    if (a === '--tcp' || a.startsWith('--tcp=')) {
+      if (a === '--tcp') {
+        throw new Error('--tcp requires a port, e.g. --tcp=9008')
+      }
+      options.tcp = a.slice('--tcp='.length)
+      continue
+    }
+
+    if (a.startsWith('-')) {
+      if (positional.length === 0) {
+        throw new Error(`Unknown option: ${a}`)
+      }
+      // Command-local flags (e.g. --dry-run) after the command name.
+      positional.push(a)
+      continue
+    }
+
+    // First non-option is the command name; remaining args (including
+    // flags) belong to the command.
+    positional.push(a)
+    positional.push(...argv.slice(i + 1))
+    break
+  }
+
+  return { options, argv: positional }
+}
+
+export function showCliHelp(): void {
+  console.log(HELP_TEXT)
+}
diff --git a/src/components/App.tsx b/src/components/App.tsx
index 5f73973ea2d..7396e002bb5 100644
--- a/src/components/App.tsx
+++ b/src/components/App.tsx
@@ -1,4 +1,5 @@
 import '@ethersproject/shims'
+import '../util/exchangeRatesGui'
 
 import { ErrorBoundary, type Scope, wrap } from '@sentry/react-native'
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
diff --git a/src/components/Main.tsx b/src/components/Main.tsx
index 90b6c02013b..9db67594d7a 100644
--- a/src/components/Main.tsx
+++ b/src/components/Main.tsx
@@ -13,7 +13,7 @@ import { Platform } from 'react-native'
 
 import { getDeviceSettings } from '../actions/DeviceSettingsActions'
 import { SwapCreateScene as SwapCreateSceneComponent } from '../components/scenes/SwapCreateScene'
-import { ENV } from '../env'
+import { CONFIG } from '../config'
 import { useExperimentConfig } from '../hooks/useExperimentConfig'
 import { useMount } from '../hooks/useMount'
 import { lstrings } from '../locales/strings'
@@ -1246,7 +1246,7 @@ export const Main: React.FC = () => {
   const experimentConfig = useExperimentConfig()
 
   const initialRouteName =
-    ENV.USE_WELCOME_SCREENS && localUsers.length === 0
+    CONFIG.USE_WELCOME_SCREENS && localUsers.length === 0
       ? 'gettingStarted'
       : 'login'
 
diff --git a/src/components/cards/InfoCardCarousel.tsx b/src/components/cards/InfoCardCarousel.tsx
index 10fea2da109..f1cafbe4435 100644
--- a/src/components/cards/InfoCardCarousel.tsx
+++ b/src/components/cards/InfoCardCarousel.tsx
@@ -12,7 +12,7 @@ import { useDispatch, useSelector } from '../../types/reactRedux'
 import type { NavigationBase } from '../../types/routerTypes'
 import { type DisplayInfoCard, getDisplayInfoCards } from '../../util/infoUtils'
 import { addPromoCardToNotifications } from '../../util/promoCardUtils'
-import { getOsVersion } from '../../util/utils'
+import { getOsVersion } from '../../util/rnUtils'
 import { type Anim, EdgeAnim } from '../common/EdgeAnim'
 import { type CarouselRenderItem, EdgeCarousel } from '../common/EdgeCarousel'
 import { useTheme } from '../services/ThemeContext'
diff --git a/src/components/cards/VisaCardCard.tsx b/src/components/cards/VisaCardCard.tsx
index f2c3dfb4d84..8708a759932 100644
--- a/src/components/cards/VisaCardCard.tsx
+++ b/src/components/cards/VisaCardCard.tsx
@@ -3,8 +3,8 @@ import * as React from 'react'
 import FastImage from 'react-native-fast-image'
 
 import { executePluginAction } from '../../actions/PluginActions'
+import { CONFIG } from '../../config'
 import { SPECIAL_CURRENCY_INFO } from '../../constants/WalletAndCurrencyConstants'
-import { ENV } from '../../env'
 import { useHandler } from '../../hooks/useHandler'
 import { lstrings } from '../../locales/strings'
 import { getDefaultFiat } from '../../selectors/SettingsSelectors'
@@ -24,7 +24,7 @@ import { EdgeCard } from './EdgeCard'
 export const IONIA_SUPPORTED_FIATS = ['USD']
 
 export const ioniaPluginIds = Object.keys(SPECIAL_CURRENCY_INFO).filter(
-  pluginId => !!SPECIAL_CURRENCY_INFO[pluginId].displayIoniaRewards
+  pluginId => SPECIAL_CURRENCY_INFO[pluginId].displayIoniaRewards === true
 )
 
 interface Props {
@@ -33,7 +33,7 @@ interface Props {
   navigation: WalletsTabSceneProps<'walletDetails'>['navigation']
 }
 
-export const VisaCardCard = (props: Props) => {
+export const VisaCardCard = (props: Props): React.ReactElement | null => {
   const { wallet, tokenId, navigation } = props
   const theme = useTheme()
   const styles = getStyles(theme)
@@ -43,7 +43,7 @@ export const VisaCardCard = (props: Props) => {
     dispatch(logEvent('Visa_Card_Launch'))
     dispatch(
       executePluginAction(navigation as NavigationBase, 'rewardscard', 'sell')
-    ).catch(err => {
+    ).catch((err: unknown) => {
       showError(err)
     })
   })
@@ -53,7 +53,7 @@ export const VisaCardCard = (props: Props) => {
     return null
   }
 
-  if (!ENV.ENABLE_VISA_PROGRAM) return null
+  if (!CONFIG.ENABLE_VISA_PROGRAM) return null
 
   const { pluginId } = wallet.currencyInfo
   const icon = getCurrencyIconUris(pluginId, tokenId)
diff --git a/src/components/charts/SwipeChart.tsx b/src/components/charts/SwipeChart.tsx
index 156f6aecf3a..76467eda1bd 100644
--- a/src/components/charts/SwipeChart.tsx
+++ b/src/components/charts/SwipeChart.tsx
@@ -26,10 +26,10 @@ import IonIcon from 'react-native-vector-icons/Ionicons'
 import { sprintf } from 'sprintf-js'
 
 import { getFiatSymbol } from '../../constants/WalletAndCurrencyConstants'
-import { ENV } from '../../env'
 import { useAsyncEffect } from '../../hooks/useAsyncEffect'
 import { formatFiatString } from '../../hooks/useFiatText'
 import { useHandler } from '../../hooks/useHandler'
+import { globalKeys } from '../../keys'
 import { formatDate } from '../../locales/intl'
 import { lstrings } from '../../locales/strings'
 import { getCoingeckoFiat } from '../../selectors/SettingsSelectors'
@@ -297,9 +297,9 @@ export const SwipeChart: React.FC<Props> = props => {
               // Rate limit error, use our API key as a fallback
               if (
                 !fetchUrl.includes('x_cg_pro_api_key') &&
-                ENV.COINGECKO_API_KEY !== ''
+                globalKeys.COINGECKO_API_KEY !== ''
               ) {
-                fetchUrl = `${COINGECKO_URL_PRO}${fetchPath}&x_cg_pro_api_key=${ENV.COINGECKO_API_KEY}`
+                fetchUrl = `${COINGECKO_URL_PRO}${fetchPath}&x_cg_pro_api_key=${globalKeys.COINGECKO_API_KEY}`
               }
               // Wait 2 second before retrying. It typically takes 1 minute
               // before rate limiting is relieved, so even 2 seconds is hasty.
diff --git a/src/components/modals/AddressModal.tsx b/src/components/modals/AddressModal.tsx
index 2eb818fe68b..ada750e5b9f 100644
--- a/src/components/modals/AddressModal.tsx
+++ b/src/components/modals/AddressModal.tsx
@@ -17,7 +17,7 @@ import {
   SPECIAL_CURRENCY_INFO,
   UNSTOPPABLE_DOMAINS
 } from '../../constants/WalletAndCurrencyConstants'
-import { ENV } from '../../env'
+import { globalKeys } from '../../keys'
 import { lstrings } from '../../locales/strings'
 import { useDispatch, useSelector } from '../../types/reactRedux'
 import type { Dispatch } from '../../types/reduxTypes'
@@ -304,10 +304,10 @@ export class AddressModalComponent extends React.Component<Props, State> {
       ).catch(() => undefined)
       if (
         this.checkIfUnstoppableDomain(name) &&
-        ENV.UNSTOPPABLE_DOMAINS_API_KEY != null
+        globalKeys.UNSTOPPABLE_DOMAINS_API_KEY != null
       ) {
         address = await this.fetchUnstoppableDomainAddress(
-          new Resolver({ apiKey: ENV.UNSTOPPABLE_DOMAINS_API_KEY }),
+          new Resolver({ apiKey: globalKeys.UNSTOPPABLE_DOMAINS_API_KEY }),
           name,
           unstoppableDomainsPluginIds[
             this.props.coreWallet.currencyInfo.pluginId
diff --git a/src/components/scenes/GiftCardAccountInfoScene.tsx b/src/components/scenes/GiftCardAccountInfoScene.tsx
index 439598f84f7..53f9a2e45ea 100644
--- a/src/components/scenes/GiftCardAccountInfoScene.tsx
+++ b/src/components/scenes/GiftCardAccountInfoScene.tsx
@@ -3,12 +3,12 @@ import { useQuery, useQueryClient } from '@tanstack/react-query'
 import * as React from 'react'
 import { View } from 'react-native'
 
-import { ENV } from '../../env'
 import { useGiftCardProvider } from '../../hooks/useGiftCardProvider'
 import { useHandler } from '../../hooks/useHandler'
 import { lstrings } from '../../locales/strings'
 import { useSelector } from '../../types/reactRedux'
 import type { EdgeAppSceneProps } from '../../types/routerTypes'
+import { getPhazeConfig } from '../../util/phazeConfig'
 import { SceneButtons } from '../buttons/SceneButtons'
 import { EdgeCard } from '../cards/EdgeCard'
 import { SceneWrapper } from '../common/SceneWrapper'
@@ -38,8 +38,7 @@ export const GiftCardAccountInfoScene: React.FC<
   const queryClient = useQueryClient()
 
   // Provider for identity lookup
-  const phazeConfig = (ENV.PLUGIN_API_KEYS as Record<string, unknown>)
-    ?.phaze as { apiKey?: string; baseUrl?: string } | undefined
+  const phazeConfig = getPhazeConfig()
   const { provider } = useGiftCardProvider({
     account,
     apiKey: phazeConfig?.apiKey ?? '',
diff --git a/src/components/scenes/GiftCardListScene.tsx b/src/components/scenes/GiftCardListScene.tsx
index 1340a5dae25..f070bc7a233 100644
--- a/src/components/scenes/GiftCardListScene.tsx
+++ b/src/components/scenes/GiftCardListScene.tsx
@@ -7,7 +7,6 @@ import { showCountrySelectionModal } from '../../actions/CountryListActions'
 import { readSyncedSettings } from '../../actions/SettingsActions'
 import { SCROLL_INDICATOR_INSET_FIX } from '../../constants/constantSettings'
 import { getFiatSymbol } from '../../constants/WalletAndCurrencyConstants'
-import { ENV } from '../../env'
 import { useAsyncEffect } from '../../hooks/useAsyncEffect'
 import { useGiftCardProvider } from '../../hooks/useGiftCardProvider'
 import { useHandler } from '../../hooks/useHandler'
@@ -23,6 +22,7 @@ import type { FooterRender } from '../../state/SceneFooterState'
 import { useDispatch, useSelector } from '../../types/reactRedux'
 import type { EdgeAppSceneProps } from '../../types/routerTypes'
 import { debugLog } from '../../util/logger'
+import { getPhazeConfig } from '../../util/phazeConfig'
 import { SceneButtons } from '../buttons/SceneButtons'
 import { AlertCardUi4 } from '../cards/AlertCard'
 import { EdgeCard } from '../cards/EdgeCard'
@@ -66,8 +66,7 @@ export const GiftCardListScene: React.FC<Props> = (props: Props) => {
   const isFocused = useIsFocused()
 
   // Get Phaze provider for API access
-  const phazeConfig = (ENV.PLUGIN_API_KEYS as Record<string, unknown>)
-    ?.phaze as { apiKey?: string; baseUrl?: string } | undefined
+  const phazeConfig = getPhazeConfig()
   const { provider, isReady } = useGiftCardProvider({
     account,
     apiKey: phazeConfig?.apiKey ?? '',
diff --git a/src/components/scenes/GiftCardMarketScene.tsx b/src/components/scenes/GiftCardMarketScene.tsx
index 54eec5f82cb..53da6dd152b 100644
--- a/src/components/scenes/GiftCardMarketScene.tsx
+++ b/src/components/scenes/GiftCardMarketScene.tsx
@@ -14,7 +14,6 @@ import { readSyncedSettings } from '../../actions/SettingsActions'
 import { EDGE_CONTENT_SERVER_URI } from '../../constants/CdnConstants'
 import { SCROLL_INDICATOR_INSET_FIX } from '../../constants/constantSettings'
 import { guiPlugins } from '../../constants/plugins/GuiPlugins'
-import { ENV } from '../../env'
 import { useAsyncEffect } from '../../hooks/useAsyncEffect'
 import { useGiftCardProvider } from '../../hooks/useGiftCardProvider'
 import { useHandler } from '../../hooks/useHandler'
@@ -26,6 +25,7 @@ import { useSceneScrollHandler } from '../../state/SceneScrollState'
 import { useDispatch, useSelector } from '../../types/reactRedux'
 import type { EdgeAppSceneProps } from '../../types/routerTypes'
 import { debugLog } from '../../util/logger'
+import { getPhazeConfig } from '../../util/phazeConfig'
 import { CountryButton } from '../buttons/RegionButton'
 import { AlertCardUi4 } from '../cards/AlertCard'
 import { EdgeCard } from '../cards/EdgeCard'
@@ -126,7 +126,7 @@ export const GiftCardMarketScene: React.FC<Props> = props => {
   )
 
   // Provider (requires API key configured)
-  const phazeConfig = ENV.PLUGIN_API_KEYS?.phaze
+  const phazeConfig = getPhazeConfig()
   const { provider, isReady } = useGiftCardProvider({
     account,
     apiKey: phazeConfig?.apiKey ?? '',
diff --git a/src/components/scenes/GiftCardPurchaseScene.tsx b/src/components/scenes/GiftCardPurchaseScene.tsx
index c52a0035cf7..cb80061b17d 100644
--- a/src/components/scenes/GiftCardPurchaseScene.tsx
+++ b/src/components/scenes/GiftCardPurchaseScene.tsx
@@ -17,7 +17,6 @@ import { v4 as uuidv4 } from 'uuid'
 
 import { checkAndShowLightBackupModal } from '../../actions/BackupModalActions'
 import { getFiatSymbol } from '../../constants/WalletAndCurrencyConstants'
-import { ENV } from '../../env'
 import { displayFiatAmount } from '../../hooks/useFiatText'
 import { useGiftCardProvider } from '../../hooks/useGiftCardProvider'
 import { useHandler } from '../../hooks/useHandler'
@@ -35,6 +34,7 @@ import type { EdgeAsset } from '../../types/types'
 import { caip19ToEdgeAsset } from '../../util/caip19Utils'
 import { debugLog } from '../../util/logger'
 import { parseLinkedText } from '../../util/parseLinkedText'
+import { getPhazeConfig } from '../../util/phazeConfig'
 import { DECIMAL_PRECISION } from '../../util/utils'
 import { DropdownInputButton } from '../buttons/DropdownInputButton'
 import { KavButtons } from '../buttons/KavButtons'
@@ -94,8 +94,7 @@ export const GiftCardPurchaseScene: React.FC<Props> = props => {
   const isConnected = useSelector(state => state.network.isConnected)
 
   // Provider (requires API key configured)
-  const phazeConfig = (ENV.PLUGIN_API_KEYS as Record<string, unknown>)
-    ?.phaze as { apiKey?: string; baseUrl?: string } | undefined
+  const phazeConfig = getPhazeConfig()
   const {
     provider,
     isReady,
diff --git a/src/components/scenes/GuiPluginListScene.tsx b/src/components/scenes/GuiPluginListScene.tsx
index bebb3aa859e..de6592ef365 100644
--- a/src/components/scenes/GuiPluginListScene.tsx
+++ b/src/components/scenes/GuiPluginListScene.tsx
@@ -20,6 +20,7 @@ import {
 } from '../../actions/DeviceSettingsActions'
 import type { NestedDisableMap } from '../../actions/ExchangeInfoActions'
 import paymentTypeLogoApplePay from '../../assets/images/paymentTypes/paymentTypeLogoApplePay.png'
+import { CONFIG } from '../../config'
 import { FLAG_LOGO_URL } from '../../constants/CdnConstants'
 import { COUNTRY_CODES } from '../../constants/CountryConstants'
 import buyPluginJsonRaw from '../../constants/plugins/buyPluginList.json'
@@ -27,7 +28,6 @@ import buyPluginJsonOverrideRaw from '../../constants/plugins/buyPluginListOverr
 import { customPluginRow, guiPlugins } from '../../constants/plugins/GuiPlugins'
 import sellPluginJsonRaw from '../../constants/plugins/sellPluginList.json'
 import sellPluginJsonOverrideRaw from '../../constants/plugins/sellPluginListOverride.json'
-import { ENV } from '../../env'
 import { useAsyncNavigation } from '../../hooks/useAsyncNavigation'
 import { useHandler } from '../../hooks/useHandler'
 import { lstrings } from '../../locales/strings'
@@ -56,8 +56,9 @@ import { filterGuiPluginJson } from '../../util/GuiPluginTools'
 import { getDisplayInfoCards } from '../../util/infoUtils'
 import { infoServerData } from '../../util/network'
 import { bestOfPlugins } from '../../util/ReferralHelpers'
+import { getOsVersion } from '../../util/rnUtils'
 import { logEvent, type OnLogEvent } from '../../util/tracking'
-import { base58ToUuid, getOsVersion } from '../../util/utils'
+import { base58ToUuid } from '../../util/utils'
 import { EdgeCard } from '../cards/EdgeCard'
 import { PaymentOptionCard } from '../cards/PaymentOptionCard'
 import {
@@ -463,7 +464,7 @@ class GuiPluginList extends React.PureComponent<Props, State> {
     const plugin = guiPlugins[pluginId]
     if (plugin == null) return null
 
-    if (plugin.betaOnly === true && !ENV.BETA_FEATURES) return null
+    if (plugin.betaOnly === true && !CONFIG.BETA_FEATURES) return null
 
     const styles = getStyles(this.props.theme)
     const partnerLogoThemeKey = pluginPartnerLogos[pluginId]
@@ -649,7 +650,7 @@ class GuiPluginList extends React.PureComponent<Props, State> {
     )
     plugins = plugins.filter(plugin => !activePlugins.disabled[plugin.pluginId])
 
-    if (!ENV.ENABLE_VISA_PROGRAM) {
+    if (!CONFIG.ENABLE_VISA_PROGRAM) {
       plugins = plugins.filter(plugin => plugin.pluginId !== 'rewardscard')
     }
 
diff --git a/src/components/scenes/HomeScene.tsx b/src/components/scenes/HomeScene.tsx
index e8b141579e3..6b05ad18645 100644
--- a/src/components/scenes/HomeScene.tsx
+++ b/src/components/scenes/HomeScene.tsx
@@ -8,7 +8,6 @@ import { useSafeAreaFrame } from 'react-native-safe-area-context'
 import { navigateToGiftCards } from '../../actions/GiftCardActions'
 import { SCROLL_INDICATOR_INSET_FIX } from '../../constants/constantSettings'
 import { guiPlugins } from '../../constants/plugins/GuiPlugins'
-import { ENV } from '../../env'
 import { useHandler } from '../../hooks/useHandler'
 import { lstrings } from '../../locales/strings'
 import { useSceneScrollHandler } from '../../state/SceneScrollState'
@@ -19,7 +18,9 @@ import type {
   NavigationBase
 } from '../../types/routerTypes'
 import { getUi4ImageUri } from '../../util/CdnUris'
+import { isCurrencyPluginEnabled } from '../../util/corePlugins'
 import { infoServerData } from '../../util/network'
+import { getPhazeConfig } from '../../util/phazeConfig'
 import { BalanceCard } from '../cards/BalanceCard'
 import { ContentPostCarousel } from '../cards/ContentPostCarousel'
 import { HomeTileCard } from '../cards/HomeTileCard'
@@ -116,7 +117,7 @@ export const HomeScene: React.FC<Props> = props => {
   })
   const handleSpendPress = useHandler(async () => {
     // If Phaze API key is not configured, go directly to Bitrefill
-    if (ENV.PLUGIN_API_KEYS?.phaze?.apiKey == null) {
+    if (getPhazeConfig()?.apiKey == null) {
       navigation.navigate('pluginView', { plugin: guiPlugins.bitrefill })
       return
     }
@@ -175,7 +176,7 @@ export const HomeScene: React.FC<Props> = props => {
     () => [styles.homeRowContainer, { height: cardSize }],
     [styles, cardSize]
   )
-  const hideFio = ENV.FIO_INIT == null || ENV.FIO_INIT === false
+  const hideFio = !isCurrencyPluginEnabled('fio')
   const hideSwap = config.disableSwaps === true
 
   return (
@@ -281,7 +282,7 @@ export const HomeScene: React.FC<Props> = props => {
                   <HomeTileCard
                     title={lstrings.spend_crypto}
                     footer={
-                      ENV.PLUGIN_API_KEYS?.phaze?.apiKey == null
+                      getPhazeConfig()?.apiKey == null
                         ? lstrings.spend_crypto_footer
                         : lstrings.spend_crypto_gift_cards_footer
                     }
diff --git a/src/components/scenes/LoginScene.tsx b/src/components/scenes/LoginScene.tsx
index ec8bc8fb71b..99aeed174e9 100644
--- a/src/components/scenes/LoginScene.tsx
+++ b/src/components/scenes/LoginScene.tsx
@@ -12,7 +12,7 @@ import {
   type Theme,
   useTheme
 } from '../../components/services/ThemeContext'
-import { ENV } from '../../env'
+import { CONFIG } from '../../config'
 import type { ExperimentConfig } from '../../experimentConfig'
 import { useHandler } from '../../hooks/useHandler'
 import { useWatch } from '../../hooks/useWatch'
@@ -67,7 +67,9 @@ export const LoginScene: React.FC<Props> = props => {
 
   React.useEffect(() => {
     if (!firstRun) return
-    const { YOLO_USERNAME, YOLO_PASSWORD, YOLO_PIN } = ENV
+    const YOLO_USERNAME = CONFIG.YOLO_USERNAME
+    const YOLO_PASSWORD = CONFIG.YOLO_PASSWORD
+    const YOLO_PIN = CONFIG.YOLO_PIN
     if (
       YOLO_USERNAME != null &&
       (Boolean(YOLO_PASSWORD) || Boolean(YOLO_PIN))
@@ -131,7 +133,7 @@ export const LoginScene: React.FC<Props> = props => {
     [navigation]
   )
 
-  const maybeHandleComplete = ENV.USE_WELCOME_SCREENS
+  const maybeHandleComplete = CONFIG.USE_WELCOME_SCREENS
     ? () => {
         navigation.replace('gettingStarted', { experimentConfig })
       }
diff --git a/src/components/scenes/RampSelectOptionScene.tsx b/src/components/scenes/RampSelectOptionScene.tsx
index d08a1b2f89c..2db8a8e1cdc 100644
--- a/src/components/scenes/RampSelectOptionScene.tsx
+++ b/src/components/scenes/RampSelectOptionScene.tsx
@@ -3,8 +3,8 @@ import { ActivityIndicator, Image, View } from 'react-native'
 import { sprintf } from 'sprintf-js'
 
 import paymentTypeLogoApplePay from '../../assets/images/paymentTypes/paymentTypeLogoApplePay.png'
+import { CONFIG } from '../../config'
 import { COUNTRY_CODES } from '../../constants/CountryConstants'
-import { ENV } from '../../env'
 import { formatFiatString } from '../../hooks/useFiatText'
 import { useHandler } from '../../hooks/useHandler'
 import { useRampPlugins } from '../../hooks/useRampPlugins'
@@ -171,7 +171,7 @@ export const RampSelectOptionScene: React.FC<Props> = (props: Props) => {
     // Checked before the scan, not after: this effect re-runs on every quote
     // refresh (30s) in production, where the scan's only consumer is a log line
     // that never prints.
-    if (!ENV.DEBUG_VERBOSE_LOGGING) return
+    if (!CONFIG.DEBUG_VERBOSE_LOGGING) return
     if (isLoadingQuotes || allQuotes.length === 0) return
     const unmatched = getUnmatchedRampQuotePriority(allQuotes, quotePriority)
     if (unmatched.length > 0) {
diff --git a/src/components/scenes/SendScene2.tsx b/src/components/scenes/SendScene2.tsx
index 050a7e8ddf2..7e94b0bb6c8 100644
--- a/src/components/scenes/SendScene2.tsx
+++ b/src/components/scenes/SendScene2.tsx
@@ -67,6 +67,7 @@ import {
   getMemoLabel,
   getMemoTitle
 } from '../../util/memoUtils'
+import { saveTxAndMetadata } from '../../util/txTagging'
 import {
   convertTransactionFeeToDisplayFee,
   darkenHexColor,
@@ -1436,28 +1437,11 @@ const SendComponent: React.FC<Props> = props => {
   spendTargets: ${JSON.stringify(spendInfo.spendTargets)}
   ourReceiveAddresses: ${JSON.stringify(ourReceiveAddresses)}`)
 
-        await coreWallet.saveTx(broadcastedTx)
-
-        // edge-core-js's saveTx silently drops tx.metadata when the engine
-        // has already registered the txid in walletState before we get here
-        // (race against the engine's onTransactionsChanged callback, which
-        // calls setupNewTxMetadata with no metadata for the engine's view of
-        // the tx). Re-apply via saveTxMetadata so payeeName and fio notes
-        // survive a reload from disk.
-        if (payeeName != null) {
-          await coreWallet
-            .saveTxMetadata({
-              txid: broadcastedTx.txid,
-              tokenId: broadcastedTx.tokenId,
-              metadata: {
-                name: broadcastedTx.metadata.name,
-                notes: broadcastedTx.metadata.notes
-              }
-            })
-            .catch((error: unknown) => {
-              showError(error)
-            })
-        }
+        await saveTxAndMetadata(coreWallet, broadcastedTx, {
+          onMetadataError: (error: unknown) => {
+            showError(error)
+          }
+        })
 
         for (const target of spendInfo.spendTargets) {
           // Write FIO OBT per spendTarget
diff --git a/src/components/scenes/SettingsScene.tsx b/src/components/scenes/SettingsScene.tsx
index 7606ac6da46..466bf5949d6 100644
--- a/src/components/scenes/SettingsScene.tsx
+++ b/src/components/scenes/SettingsScene.tsx
@@ -32,7 +32,7 @@ import {
   showReEnableOtpModal,
   showUnlockSettingsModal
 } from '../../actions/SettingsActions'
-import { ENV } from '../../env'
+import { CONFIG } from '../../config'
 import { useAsyncEffect } from '../../hooks/useAsyncEffect'
 import { useHandler } from '../../hooks/useHandler'
 import { useWatch } from '../../hooks/useWatch'
@@ -740,7 +740,7 @@ export const SettingsScene: React.FC<Props> = props => {
             />
           </EdgeCard>
         </>
-        {ENV.ALLOW_DEVELOPER_MODE && (
+        {CONFIG.ALLOW_DEVELOPER_MODE && (
           <EdgeCard sections>
             <SettingsSwitchRow
               key="developerMode"
diff --git a/src/components/scenes/Staking/EarnScene.tsx b/src/components/scenes/Staking/EarnScene.tsx
index 4082a2d7720..31d70a15ec7 100644
--- a/src/components/scenes/Staking/EarnScene.tsx
+++ b/src/components/scenes/Staking/EarnScene.tsx
@@ -4,9 +4,9 @@ import * as React from 'react'
 import { ActivityIndicator, type ListRenderItemInfo, View } from 'react-native'
 import Animated from 'react-native-reanimated'
 
+import { CONFIG } from '../../../config'
 import { SCROLL_INDICATOR_INSET_FIX } from '../../../constants/constantSettings'
 import { SPECIAL_CURRENCY_INFO } from '../../../constants/WalletAndCurrencyConstants'
-import { ENV } from '../../../env'
 import { useAsyncEffect } from '../../../hooks/useAsyncEffect'
 import { useHandler } from '../../../hooks/useHandler'
 import { useWatch } from '../../../hooks/useWatch'
@@ -67,7 +67,11 @@ interface WalletStakeInfo {
 
 /** Hook to ensure the UI updates on map changes, while retaining cached data
  * functionality */
-const useStakeMaps = () => {
+const useStakeMaps = (): {
+  discoverMap: DiscoverStakeMap
+  portfolioMap: PortfolioStakeMap
+  updateMaps: (updates: () => void) => void
+} => {
   const [, forceUpdate] = React.useReducer(x => x + 1, 0)
 
   const updateMaps = React.useCallback((updates: () => void) => {
@@ -82,7 +86,7 @@ const useStakeMaps = () => {
   }
 }
 
-export const EarnScene = (props: Props) => {
+export const EarnScene = (props: Props): React.ReactElement => {
   const { navigation } = props
   const theme = useTheme()
   const styles = getStyles(theme)
@@ -148,7 +152,7 @@ export const EarnScene = (props: Props) => {
 
         const isStakingSupported =
           SPECIAL_CURRENCY_INFO[pluginId]?.isStakingSupported === true &&
-          ENV.ENABLE_STAKING
+          CONFIG.ENABLE_STAKING
         if (!isStakingSupported) continue
 
         const stakePlugins = await getStakePlugins(pluginId)
@@ -157,7 +161,7 @@ export const EarnScene = (props: Props) => {
           for (const stakePlugin of stakePlugins) {
             for (const stakePolicy of stakePlugin
               .getPolicies({ pluginId })
-              .filter(stakePolicy => !stakePolicy.deprecated)) {
+              .filter(stakePolicy => stakePolicy.deprecated !== true)) {
               DISCOVER_MAP[stakePolicy.stakePolicyId] = {
                 stakePlugin,
                 stakePolicy
@@ -179,7 +183,7 @@ export const EarnScene = (props: Props) => {
   // Refresh stake positions when re-entering the scene or on initial load
   useAsyncEffect(
     async () => {
-      if (!isLoadingDiscover || (isFocused && !isPrevFocused)) {
+      if (!isLoadingDiscover || (isFocused && isPrevFocused !== true)) {
         setIsLoadingPortfolio(true)
 
         const controller = new AbortController()
@@ -265,7 +269,7 @@ export const EarnScene = (props: Props) => {
   const filterStakeInfo = (
     info: DiscoverStakeInfo | PortfolioStakeInfo
   ): boolean => {
-    if (!searchText) return true
+    if (searchText === '') return true
     const searchLower = searchText.toLowerCase()
 
     // Match against policy provider name
@@ -284,9 +288,9 @@ export const EarnScene = (props: Props) => {
       if (currencyInfo.currencyCode.toLowerCase().includes(searchLower))
         return true
       // Also check asset's own display name if available
-      if (stakeAsset.displayName?.toLowerCase().includes(searchLower))
+      if (stakeAsset.displayName?.toLowerCase().includes(searchLower) === true)
         return true
-      if (stakeAsset.currencyCode?.toLowerCase().includes(searchLower))
+      if (stakeAsset.currencyCode.toLowerCase().includes(searchLower))
         return true
     }
 
@@ -298,9 +302,9 @@ export const EarnScene = (props: Props) => {
       if (currencyInfo.currencyCode.toLowerCase().includes(searchLower))
         return true
       // Also check asset's own display name if available
-      if (rewardAsset.displayName?.toLowerCase().includes(searchLower))
+      if (rewardAsset.displayName?.toLowerCase().includes(searchLower) === true)
         return true
-      if (rewardAsset.currencyCode?.toLowerCase().includes(searchLower))
+      if (rewardAsset.currencyCode.toLowerCase().includes(searchLower))
         return true
     }
 
@@ -311,7 +315,7 @@ export const EarnScene = (props: Props) => {
     (discoverStakeInfo: DiscoverStakeInfo, currencyInfo: EdgeCurrencyInfo) => {
       const { stakePlugin, stakePolicy } = discoverStakeInfo
 
-      const handlePress = async () => {
+      const handlePress = async (): Promise<void> => {
         let walletId: string | undefined
 
         const matchingWallets = wallets.filter(
@@ -378,7 +382,7 @@ export const EarnScene = (props: Props) => {
       const { stakePlugin, stakePolicy, walletStakeInfos } = portfolioStakeInfo
       if (walletStakeInfos.length === 0) return null
 
-      const handlePress = async () => {
+      const handlePress = async (): Promise<void> => {
         let walletId: string | undefined
         let stakePosition: StakePosition | undefined
 
diff --git a/src/components/scenes/TransactionsExportScene.tsx b/src/components/scenes/TransactionsExportScene.tsx
index 3ea018673e3..5a59ba13a9d 100644
--- a/src/components/scenes/TransactionsExportScene.tsx
+++ b/src/components/scenes/TransactionsExportScene.tsx
@@ -1,4 +1,3 @@
-import { asBoolean, asObject, asString } from 'cleaners'
 import type {
   EdgeAccount,
   EdgeCurrencyWallet,
@@ -28,6 +27,13 @@ import { connect } from '../../types/reactRedux'
 import type { EdgeAppSceneProps } from '../../types/routerTypes'
 import { getCurrencyCode } from '../../util/CurrencyInfoHelpers'
 import { getWalletName } from '../../util/CurrencyWalletHelpers'
+import {
+  EXPORT_TX_INFO_FILE,
+  type ExportTxInfo,
+  exportTxInfoKey,
+  mergeExportTxInfo,
+  readExportTxInfoMap
+} from '../../util/exportTxInfo'
 import { SceneWrapper } from '../common/SceneWrapper'
 import { DateModal } from '../modals/DateModal'
 import { TextInputModal } from '../modals/TextInputModal'
@@ -79,20 +85,6 @@ interface State {
   isExportBitwave: boolean
 }
 
-const EXPORT_TX_INFO_FILE = 'exportTxInfo.json'
-
-const asExportTxInfo = asObject({
-  bitwaveAccountId: asString,
-  isExportQbo: asBoolean,
-  isExportCsv: asBoolean,
-  isExportBitwave: asBoolean
-})
-
-const asExportTxInfoMap = asObject(asExportTxInfo)
-
-type ExportTxInfoMap = ReturnType<typeof asExportTxInfoMap>
-type ExportTxInfo = ReturnType<typeof asExportTxInfo>
-
 class TransactionsExportSceneComponent extends React.PureComponent<
   Props,
   State
@@ -165,13 +157,12 @@ class TransactionsExportSceneComponent extends React.PureComponent<
 
   loadInfoFile = async (): Promise<void> => {
     const { sourceWallet, tokenId } = this.props.route.params
-    const { disklet } = sourceWallet
-    const result = await disklet.getText(EXPORT_TX_INFO_FILE)
-    const exportTxInfoMap = asExportTxInfoMap(JSON.parse(result))
-    const tokenCurrencyCode = tokenId ?? sourceWallet.currencyInfo.currencyCode
+    const exportTxInfoMap = await readExportTxInfoMap(sourceWallet)
+    const tokenCurrencyCode = exportTxInfoKey(sourceWallet, tokenId)
+    const info = exportTxInfoMap[tokenCurrencyCode]
+    if (info == null) return
 
-    const { isExportBitwave, isExportCsv, isExportQbo } =
-      exportTxInfoMap[tokenCurrencyCode]
+    const { isExportBitwave, isExportCsv, isExportQbo } = info
 
     this.setState({
       isExportBitwave,
@@ -307,13 +298,11 @@ class TransactionsExportSceneComponent extends React.PureComponent<
     const { sourceWallet, tokenId } = route.params
     const { isExportBitwave, isExportQbo, isExportCsv, startDate, endDate } =
       this.state
-    const tokenCurrencyCode = tokenId ?? sourceWallet.currencyInfo.currencyCode
+    const tokenCurrencyCode = exportTxInfoKey(sourceWallet, tokenId)
 
     let exportTxInfo: ExportTxInfo | undefined
-    let exportTxInfoMap: ExportTxInfoMap | undefined
     try {
-      const result = await sourceWallet.disklet.getText(EXPORT_TX_INFO_FILE)
-      exportTxInfoMap = asExportTxInfoMap(JSON.parse(result))
+      const exportTxInfoMap = await readExportTxInfoMap(sourceWallet)
       exportTxInfo = exportTxInfoMap[tokenCurrencyCode]
     } catch (e) {
       console.log(
@@ -357,17 +346,12 @@ class TransactionsExportSceneComponent extends React.PureComponent<
       exportTxInfo?.isExportCsv !== isExportCsv ||
       exportTxInfo?.isExportQbo !== isExportQbo
     ) {
-      exportTxInfoMap ??= {}
-      exportTxInfoMap[tokenCurrencyCode] = {
+      await mergeExportTxInfo(sourceWallet, tokenId, {
         bitwaveAccountId: accountId,
         isExportBitwave,
         isExportQbo,
         isExportCsv
-      }
-      await sourceWallet.disklet.setText(
-        EXPORT_TX_INFO_FILE,
-        JSON.stringify(exportTxInfoMap)
-      )
+      })
     }
 
     if (startDate.getTime() > endDate.getTime()) {
diff --git a/src/components/scenes/WalletDetailsScene.tsx b/src/components/scenes/WalletDetailsScene.tsx
index a15947e4691..93f91e67cf3 100644
--- a/src/components/scenes/WalletDetailsScene.tsx
+++ b/src/components/scenes/WalletDetailsScene.tsx
@@ -41,11 +41,11 @@ import type {
 } from '../../types/routerTypes'
 import { getDisplayInfoCards } from '../../util/infoUtils'
 import { coinrankListData, infoServerData } from '../../util/network'
+import { getOsVersion } from '../../util/rnUtils'
 import {
   calculateSpamThreshold,
   convertNativeToDenomination,
-  darkenHexColor,
-  getOsVersion
+  darkenHexColor
 } from '../../util/utils'
 import { EdgeCard } from '../cards/EdgeCard'
 import { InfoCardCarousel } from '../cards/InfoCardCarousel'
diff --git a/src/components/services/DeepLinkingManager.tsx b/src/components/services/DeepLinkingManager.tsx
index e36fc649e59..9dea5777e8b 100644
--- a/src/components/services/DeepLinkingManager.tsx
+++ b/src/components/services/DeepLinkingManager.tsx
@@ -10,7 +10,7 @@ import {
   getDeepLinkReadiness,
   launchDeepLink
 } from '../../actions/DeepLinkingActions'
-import { ENV } from '../../env'
+import { CONFIG } from '../../config'
 import { useAsyncEffect } from '../../hooks/useAsyncEffect'
 import { useWatch } from '../../hooks/useWatch'
 import { defaultAccount } from '../../reducers/CoreReducer'
@@ -163,7 +163,7 @@ export const DeepLinkingManager: React.FC<Props> = props => {
       })
 
       // Load any tapped links:
-      const url = (await Linking.getInitialURL()) ?? ENV.YOLO_DEEP_LINK
+      const url = (await Linking.getInitialURL()) ?? CONFIG.YOLO_DEEP_LINK
       if (url != null) handleDeepLink(url)
 
       // Load any links sent by push messages:
diff --git a/src/components/services/EdgeCoreManager.tsx b/src/components/services/EdgeCoreManager.tsx
index cb43e9d5129..cebb70a38fd 100644
--- a/src/components/services/EdgeCoreManager.tsx
+++ b/src/components/services/EdgeCoreManager.tsx
@@ -28,53 +28,47 @@ import {
   pluginUri as exchangeUri
 } from 'edge-exchange-plugins'
 import * as React from 'react'
-import { Platform } from 'react-native'
+import { Platform, Text, View } from 'react-native'
 import BootSplash from 'react-native-bootsplash'
 import { getBrand, getDeviceId, getVersion } from 'react-native-device-info'
 
-import { ENV } from '../../env'
+import { CONFIG } from '../../config'
 import { useAsyncEffect } from '../../hooks/useAsyncEffect'
 import { useHandler } from '../../hooks/useHandler'
 import { useIsAppForeground } from '../../hooks/useIsAppForeground'
-import { lstrings } from '../../locales/strings'
+import { KEYS } from '../../keys'
 import { addMetadataToContext } from '../../util/addMetadataToContext'
 import { onAttestationToken } from '../../util/attestation'
 import { allPlugins } from '../../util/corePlugins'
+import {
+  hasNativeApiSigner,
+  isUsableApiKey,
+  makeNativeApiSigner,
+  warmNativeApiKey
+} from '../../util/edgeApiSigner'
 import { fakeUser } from '../../util/fake-user'
+import { initializeKeys } from '../../util/keysStore'
 import {
   INFO_TEST_SERVER,
   LOGIN_TEST_SERVER,
   shouldUseTestServers,
   SYNC_TEST_SERVER
 } from '../../util/maestro'
-import { getOsVersion } from '../../util/utils'
-import { ButtonsModal } from '../modals/ButtonsModal'
+import { getOsVersion } from '../../util/rnUtils'
 import { LoadingSplashScreen } from '../progress-indicators/LoadingSplashScreen'
-import { Airship, showError } from './AirshipInstance'
+import { showError } from './AirshipInstance'
 import { Providers } from './Providers'
 
-interface Props {}
-
-const contextOptions: EdgeContextOptions = {
-  apiKey: ENV.EDGE_API_KEY,
-  apiSecret: ENV.EDGE_API_SECRET,
-  appId: '',
-  appVersion: getVersion(),
-  deviceDescription: `${getBrand()} ${getDeviceId()}`,
-  osType: Platform.OS,
-  osVersion: getOsVersion(),
+// Start the disk read and signed infoRollup fetch during bundle evaluation so they
+// overlap the rest of startup. The WebView is gated behind keys and does not
+// overlap. The effect below awaits the same single-flighted promise, which by
+// then has usually already resolved.
+initializeKeys().catch((error: unknown) => {
+  console.warn('EdgeCoreManager: keys warm-up failed', String(error))
+})
 
-  // Use this to adjust logging verbosity on a plugin-by-plugin basis:
-  logSettings: {
-    defaultLogLevel: 'warn',
-    sources: {
-      'edge-core': 'warn'
-    }
-  },
+interface Props {}
 
-  plugins: allPlugins,
-  skipBlockHeight: true
-}
 const nativeIo: EdgeNativeIo = detectBundler.isReactNative
   ? {
       'edge-currency-accountbased': makeAccountbasedIo(),
@@ -125,12 +119,63 @@ const crashReporter: EdgeCrashReporter = {
   }
 }
 
+async function buildContextOptions(): Promise<EdgeContextOptions> {
+  const { EDGE_API_KEY: apiKey, EDGE_API_SECRET: apiSecret } = KEYS
+  const nativeKey = hasNativeApiSigner() ? await warmNativeApiKey() : ''
+  const nativeApiSigner = nativeKey !== '' ? makeNativeApiSigner() : undefined
+  const jsPair =
+    isUsableApiKey(apiKey) && apiSecret != null && apiSecret.byteLength > 0
+      ? { apiKey, apiSecret }
+      : undefined
+  console.log(
+    `[apiSigner] native=${nativeApiSigner != null} keysFallback=${
+      jsPair != null
+    }`
+  )
+  if (nativeApiSigner == null && jsPair == null) {
+    // A context with no credentials still boots, then fails every login-server
+    // call with an opaque error, so say plainly what is missing.
+    console.error(
+      'EdgeCoreManager: no usable native EdgeApiSigner and no KEYS.EDGE_API_KEY / EDGE_API_SECRET; login-server requests will fail'
+    )
+  }
+  return {
+    ...(nativeApiSigner != null
+      ? { apiSigner: nativeApiSigner }
+      : jsPair ?? {}),
+    appId: '',
+    appVersion: getVersion(),
+    deviceDescription: `${getBrand()} ${getDeviceId()}`,
+    osType: Platform.OS,
+    osVersion: getOsVersion(),
+
+    // Use this to adjust logging verbosity on a plugin-by-plugin basis:
+    logSettings: {
+      defaultLogLevel: 'warn',
+      sources: {
+        'edge-core': 'warn'
+      }
+    },
+
+    plugins: allPlugins,
+    skipBlockHeight: true
+  }
+}
+
 /**
  * Mounts the edge-core-js WebView, and then mounts the rest of the app
  * once the core context is ready.
  */
 export const EdgeCoreManager: React.FC<Props> = props => {
+  // Null until the keys store has resolved. `buildContextOptions` reads secrets
+  // and plugin inits out of KEYS / pluginMaps, which the keys store mutates in
+  // place, so the options can only be built once that has settled.
+  const [contextOptions, setContextOptions] =
+    React.useState<EdgeContextOptions | null>(null)
   const [context, setContext] = React.useState<EdgeContext | null>(null)
+  const [bootFatalError, setBootFatalError] = React.useState<string | null>(
+    null
+  )
 
   // Scratchpad values that should not trigger re-renders:
   const counter = React.useRef<number>(0)
@@ -139,6 +184,51 @@ export const EdgeCoreManager: React.FC<Props> = props => {
   // Get the application state:
   const isAppForeground = useIsAppForeground()
 
+  function hideSplash(): void {
+    if (!splashHidden.current) {
+      setTimeout(() => {
+        BootSplash.hide({ fade: true }).catch((err: unknown) => {
+          showError(err)
+        })
+      }, 200)
+      splashHidden.current = true
+    }
+  }
+
+  useAsyncEffect(
+    async () => {
+      try {
+        await initializeKeys()
+        setContextOptions(await buildContextOptions())
+      } catch (error: unknown) {
+        // initializeKeys itself never rejects, but buildContextOptions can.
+        // Without a fallback, contextOptions stays null, Providers/Airship never
+        // mount, and native BootSplash never hides.
+        console.warn(
+          'EdgeCoreManager: keys boot failed; using baked-in plugins',
+          String(error)
+        )
+        try {
+          setContextOptions(await buildContextOptions())
+        } catch (fallbackError: unknown) {
+          hideSplash()
+          setBootFatalError(String(fallbackError))
+        }
+      }
+    },
+    [],
+    'EdgeCoreManager'
+  )
+
+  // Cache the public API key from native for push / notification callers:
+  useAsyncEffect(
+    async () => {
+      if (hasNativeApiSigner()) await warmNativeApiKey()
+    },
+    [],
+    'EdgeCoreManager.warmNativeApiKey'
+  )
+
   // Keep the core in sync with the application state:
   useAsyncEffect(
     async () => {
@@ -151,17 +241,6 @@ export const EdgeCoreManager: React.FC<Props> = props => {
     'EdgeCoreManager'
   )
 
-  function hideSplash(): void {
-    if (!splashHidden.current) {
-      setTimeout(() => {
-        BootSplash.hide({ fade: true }).catch((err: unknown) => {
-          showError(err)
-        })
-      }, 200)
-      splashHidden.current = true
-    }
-  }
-
   const handleContext = useHandler((context: EdgeContext) => {
     console.log('EdgeContext opened')
     let active = true
@@ -188,26 +267,28 @@ export const EdgeCoreManager: React.FC<Props> = props => {
   const handleError = useHandler((error: Error) => {
     console.log('EdgeContext failed', error)
     hideSplash()
-    Airship.show<'ok' | undefined>(bridge => (
-      <ButtonsModal
-        bridge={bridge}
-        buttons={{ ok: { label: lstrings.string_ok_cap } }}
-        title="Edge core failed to load"
-        message={String(error)}
-      />
-    )).catch(() => {})
+    // Providers (Airship host) mounts only after context is set. A core load
+    // failure must use the same pre-Providers surface as buildContextOptions.
+    setBootFatalError(String(error))
   })
 
   const handleFakeEdgeWorld = useHandler((world: EdgeFakeWorld) => {
-    world
-      .makeEdgeContext({ ...contextOptions })
-      .then(handleContext, handleError)
+    if (contextOptions == null) return
+    // `world` is already a yaob proxy, so anything passed through it is packed
+    // as plain data. `MakeEdgeContext` bridgifies `apiSigner` on the real path,
+    // but here `signMessage` would be packed as a bare function and blow up
+    // inside the WebView with "Unsupported value of type function". The fake
+    // core never reaches the login server, so it does not need a signer.
+    const { apiSigner, ...fakeOptions } = contextOptions
+    world.makeEdgeContext({ ...fakeOptions }).then(handleContext, handleError)
   })
 
   const pluginUris = [
-    ENV.DEBUG_ACCOUNTBASED ? accountbasedDebugUri : accountbasedUri,
-    ENV.DEBUG_CURRENCY_PLUGINS ? currencyPluginsDebugUri : currencyPluginsUri,
-    ENV.DEBUG_EXCHANGES ? exchangeDebugUri : exchangeUri
+    CONFIG.DEBUG_ACCOUNTBASED ? accountbasedDebugUri : accountbasedUri,
+    CONFIG.DEBUG_CURRENCY_PLUGINS
+      ? currencyPluginsDebugUri
+      : currencyPluginsUri,
+    CONFIG.DEBUG_EXCHANGES ? exchangeDebugUri : exchangeUri
   ]
 
   let infoServer: string | string[] | undefined
@@ -221,19 +302,31 @@ export const EdgeCoreManager: React.FC<Props> = props => {
     syncServer = SYNC_TEST_SERVER
   }
 
-  if (ENV.LOGIN_SERVER != null && ENV.LOGIN_SERVER.length > 0) {
-    loginServer = ENV.LOGIN_SERVER
+  if (CONFIG.LOGIN_SERVER != null && CONFIG.LOGIN_SERVER.length > 0) {
+    loginServer = CONFIG.LOGIN_SERVER
+  }
+  if (CONFIG.INFO_SERVER != null && CONFIG.INFO_SERVER.length > 0) {
+    infoServer = CONFIG.INFO_SERVER
+  }
+
+  if (bootFatalError != null) {
+    return (
+      <View style={{ flex: 1, justifyContent: 'center', padding: 24 }}>
+        <Text>Edge failed to start: {bootFatalError}</Text>
+      </View>
+    )
   }
-  if (ENV.INFO_SERVER != null && ENV.INFO_SERVER.length > 0) {
-    infoServer = ENV.INFO_SERVER
+
+  if (contextOptions == null) {
+    return <LoadingSplashScreen />
   }
 
   return (
     <>
-      {ENV.USE_FAKE_CORE ? (
+      {CONFIG.USE_FAKE_CORE ? (
         <MakeFakeEdgeWorld
           crashReporter={crashReporter}
-          debug={ENV.DEBUG_CORE}
+          debug={CONFIG.DEBUG_CORE}
           nativeIo={nativeIo}
           pluginUris={pluginUris}
           users={[fakeUser]}
@@ -244,11 +337,11 @@ export const EdgeCoreManager: React.FC<Props> = props => {
         <MakeEdgeContext
           {...contextOptions}
           crashReporter={crashReporter}
-          debug={ENV.DEBUG_CORE}
+          debug={CONFIG.DEBUG_CORE}
           allowDebugging={
-            ENV.DEBUG_ACCOUNTBASED ||
-            ENV.DEBUG_CORE ||
-            ENV.DEBUG_CURRENCY_PLUGINS
+            CONFIG.DEBUG_ACCOUNTBASED ||
+            CONFIG.DEBUG_CORE ||
+            CONFIG.DEBUG_CURRENCY_PLUGINS
           }
           nativeIo={nativeIo}
           pluginUris={pluginUris}
diff --git a/src/components/services/Providers.tsx b/src/components/services/Providers.tsx
index 3d670b93055..815cecc283f 100644
--- a/src/components/services/Providers.tsx
+++ b/src/components/services/Providers.tsx
@@ -11,7 +11,7 @@ import thunk from 'redux-thunk'
 
 import { fetchCountryCode } from '../../actions/CountryCodeActions'
 import { loadDeviceReferral } from '../../actions/DeviceReferralActions'
-import { ENV } from '../../env'
+import { CONFIG } from '../../config'
 import { rootReducer } from '../../reducers/RootReducer'
 import { renderStateProviders } from '../../state/renderStateProviders'
 import type { Dispatch, RootState, Store } from '../../types/reduxTypes'
@@ -29,7 +29,7 @@ interface Props {
  * Provides various global providers to the application,
  * including the Redux store, pop-up menus, modals, etc.
  */
-export function Providers(props: Props) {
+export function Providers(props: Props): React.ReactElement {
   const { context } = props
   const theme = useTheme()
   const isDesktop =
@@ -43,7 +43,7 @@ export function Providers(props: Props) {
   // The `useState` hook lets us pass an initializer that only runs once:
   const [store] = React.useState<Store>(() => {
     const middleware = [loginStatusChecker, thunk]
-    if (ENV.ENABLE_REDUX_PERF_LOGGING) middleware.push(perfLogger)
+    if (CONFIG.ENABLE_REDUX_PERF_LOGGING) middleware.push(perfLogger)
 
     const enhancer = applyMiddleware<Dispatch, RootState>(...middleware)
     const store = createStore(rootReducer, undefined, enhancer)
@@ -60,10 +60,10 @@ export function Providers(props: Props) {
 
   // Actions to perform at startup:
   React.useEffect(() => {
-    store.dispatch(loadDeviceReferral()).catch(err => {
+    store.dispatch(loadDeviceReferral()).catch((err: unknown) => {
       console.warn(err)
     })
-    store.dispatch(fetchCountryCode()).catch(err => {
+    store.dispatch(fetchCountryCode()).catch((err: unknown) => {
       console.warn(err)
     })
   }, [store])
@@ -72,7 +72,7 @@ export function Providers(props: Props) {
     <Provider store={store}>
       <LoginUiProvider
         isDesktop={isDesktop}
-        // @ts-expect-error
+        // @ts-expect-error: themeOverride prop typing mismatch
         themeOverride={theme}
       >
         <KeyboardProvider statusBarTranslucent>
diff --git a/src/components/services/Services.tsx b/src/components/services/Services.tsx
index be66975bbb5..c7e71f92733 100644
--- a/src/components/services/Services.tsx
+++ b/src/components/services/Services.tsx
@@ -13,7 +13,7 @@ import { updateGiftCardInfo } from '../../actions/GiftCardInfoActions'
 import { registerNotificationsV2 } from '../../actions/NotificationActions'
 import { trackAppUsageAfterUpgrade } from '../../actions/RequestReviewActions'
 import { checkCompromisedKeys } from '../../actions/WalletActions'
-import { ENV } from '../../env'
+import { CONFIG } from '../../config'
 import { useAsyncEffect } from '../../hooks/useAsyncEffect'
 import { useRefresher } from '../../hooks/useRefresher'
 import { lstrings } from '../../locales/strings'
@@ -154,11 +154,11 @@ export const Services: React.FC<Props> = props => {
     REFRESH_INFO_SERVER_MS
   )
 
-  const startLoanManager = ENV.BETA_FEATURES && account != null
+  const startLoanManager = CONFIG.BETA_FEATURES && account != null
 
   return (
     <>
-      {ENV.BETA_FEATURES ? <ActionQueueService /> : null}
+      {CONFIG.BETA_FEATURES ? <ActionQueueService /> : null}
       {account == null ? null : <NotificationService account={account} />}
       <AutoLogout />
       <ContactsLoader />
diff --git a/src/components/services/WalletConnectService.tsx b/src/components/services/WalletConnectService.tsx
index 21d0037435f..9295ce8bc8c 100644
--- a/src/components/services/WalletConnectService.tsx
+++ b/src/components/services/WalletConnectService.tsx
@@ -6,7 +6,6 @@ import { asNumber, asObject, asString, asUnknown } from 'cleaners'
 import type { EdgeAccount } from 'edge-core-js'
 import * as React from 'react'
 
-import { ENV } from '../../env'
 import { useAsyncEffect } from '../../hooks/useAsyncEffect'
 import {
   getAccounts,
@@ -15,6 +14,7 @@ import {
   waitingClients,
   walletConnectClient
 } from '../../hooks/useWalletConnect'
+import { globalKeys } from '../../keys'
 import { asLegacyTokenId } from '../../types/types'
 import { snooze } from '../../util/utils'
 import { WcSmartContractModal } from '../modals/WcSmartContractModal'
@@ -26,10 +26,10 @@ interface Props {
   account: EdgeAccount
 }
 
-export const WalletConnectService = (props: Props) => {
+export const WalletConnectService: React.FC<Props> = (props: Props) => {
   const { account } = props
 
-  const handleSessionRequest = async (event: any) => {
+  const handleSessionRequest = async (event: any): Promise<void> => {
     const client = await getClient()
     const request = asSessionRequest(event)
 
@@ -84,12 +84,10 @@ export const WalletConnectService = (props: Props) => {
   useAsyncEffect(
     async () => {
       if (walletConnectClient.client == null) {
-        let projectId: string | undefined
-        if (
-          typeof ENV.WALLET_CONNECT_INIT === 'object' &&
-          ENV.WALLET_CONNECT_INIT.projectId != null
-        ) {
-          projectId = ENV.WALLET_CONNECT_INIT.projectId
+        const projectId = globalKeys.WALLETCONNECT_PROJECT_ID
+        if (projectId == null || projectId === '') {
+          console.warn('WalletConnectService: no projectId; skipping init')
+          return
         }
 
         // If init fails, retry every 2 seconds
@@ -116,8 +114,8 @@ export const WalletConnectService = (props: Props) => {
       }
       const handleSessionRequestSync = (
         event: Web3WalletTypes.SessionRequest
-      ) => {
-        handleSessionRequest(event).catch(err => {
+      ): void => {
+        handleSessionRequest(event).catch((err: unknown) => {
           showError(err)
         })
       }
diff --git a/src/components/themed/MenuTabs.tsx b/src/components/themed/MenuTabs.tsx
index 049b01201c9..cdcb17647fe 100644
--- a/src/components/themed/MenuTabs.tsx
+++ b/src/components/themed/MenuTabs.tsx
@@ -21,7 +21,7 @@ import SimpleLineIcons from 'react-native-vector-icons/SimpleLineIcons'
 
 import { writeDefaultScreen } from '../../actions/DeviceSettingsActions'
 import { Fontello } from '../../assets/vector/index'
-import { ENV } from '../../env'
+import { CONFIG } from '../../config'
 import { useHandler } from '../../hooks/useHandler'
 import type { LocaleStringKey } from '../../locales/en_US'
 import { lstrings } from '../../locales/strings'
@@ -66,7 +66,7 @@ const title: Readonly<Record<string, string>> = {
   devTab: lstrings.title_dev_tab
 }
 
-export const MenuTabs = (props: BottomTabBarProps) => {
+export const MenuTabs = (props: BottomTabBarProps): React.ReactElement => {
   const { navigation, state } = props
   const theme = useTheme()
   const activeTabFullIndex = state.index
@@ -79,7 +79,7 @@ export const MenuTabs = (props: BottomTabBarProps) => {
         if (config.extraTab == null && route.name === 'extraTab') {
           return false
         }
-        if (!ENV.DEV_TAB && route.name === 'devTab') {
+        if (!CONFIG.DEV_TAB && route.name === 'devTab') {
           return false
         }
         if (config.disableSwaps === true && route.name === 'swapTab') {
@@ -230,7 +230,7 @@ const Tab = ({
   route: BottomTabBarProps['state']['routes'][number]
   footerOpenRatio: SharedValue<number>
   navigation: NavigationHelpers<ParamListBase, BottomTabNavigationEventMap>
-}) => {
+}): React.ReactElement => {
   const theme = useTheme()
   const insets = useSafeAreaInsets()
   const color = isActive ? theme.tabBarIconHighlighted : theme.tabBarIcon
@@ -262,7 +262,7 @@ const Tab = ({
     switch (route.name) {
       case 'home':
         setTimeout(() => {
-          writeDefaultScreen('home').catch(e => {
+          writeDefaultScreen('home').catch((e: unknown) => {
             console.error('Failed to write defaultScreen setting: home')
           })
         }, SAVE_DEFAULT_SCREEN_DELAY)
@@ -270,7 +270,7 @@ const Tab = ({
         return
       case 'walletsTab':
         setTimeout(() => {
-          writeDefaultScreen('assets').catch(e => {
+          writeDefaultScreen('assets').catch((e: unknown) => {
             console.error('Failed to write defaultScreen setting: assets')
           })
         }, SAVE_DEFAULT_SCREEN_DELAY)
diff --git a/src/components/themed/SideMenu.tsx b/src/components/themed/SideMenu.tsx
index 0dece84236f..4309c182396 100644
--- a/src/components/themed/SideMenu.tsx
+++ b/src/components/themed/SideMenu.tsx
@@ -34,8 +34,8 @@ import { useNotifCount } from '../../actions/LocalSettingsActions'
 import { getRootNavigation, logoutRequest } from '../../actions/LoginActions'
 import { executePluginAction } from '../../actions/PluginActions'
 import { Fontello } from '../../assets/vector'
+import { CONFIG } from '../../config'
 import { SCROLL_INDICATOR_INSET_FIX } from '../../constants/constantSettings'
-import { ENV } from '../../env'
 import { useWatch } from '../../hooks/useWatch'
 import { lstrings } from '../../locales/strings'
 import { getDefaultFiat } from '../../selectors/SettingsSelectors'
@@ -43,8 +43,10 @@ import { config } from '../../theme/appConfig'
 import { useDispatch, useSelector } from '../../types/reactRedux'
 import type { NavigationBase } from '../../types/routerTypes'
 import { arrangeUsers } from '../../util/arrangeUsers'
+import { isCurrencyPluginEnabled } from '../../util/corePlugins'
 import { parseDeepLink } from '../../util/DeepLinkParser'
 import { getUserInfoUsername } from '../../util/getAccountUsername'
+import { getPhazeConfig } from '../../util/phazeConfig'
 import { getDisplayUsername } from '../../util/utils'
 import { IONIA_SUPPORTED_FIATS } from '../cards/VisaCardCard'
 import { EdgeTouchableOpacity } from '../common/EdgeTouchableOpacity'
@@ -316,7 +318,7 @@ export function SideMenuComponent(props: Props): React.ReactElement {
       title: lstrings.title_markets
     },
     // Only show gift card menu option if Phaze API key is configured
-    ...(ENV.PLUGIN_API_KEYS?.phaze?.apiKey != null
+    ...(getPhazeConfig()?.apiKey != null
       ? [
           {
             handlePress: async () => {
@@ -328,7 +330,7 @@ export function SideMenuComponent(props: Props): React.ReactElement {
           }
         ]
       : []),
-    ...(ENV.BETA_FEATURES
+    ...(CONFIG.BETA_FEATURES
       ? [
           {
             handlePress: handleBorrow,
@@ -364,7 +366,7 @@ export function SideMenuComponent(props: Props): React.ReactElement {
     }
   ]
 
-  if (ENV.FIO_INIT == null || ENV.FIO_INIT === false) {
+  if (!isCurrencyPluginEnabled('fio')) {
     // Remove FIO rows
     let index = rowDatas.findIndex(
       row => row.title === lstrings.drawer_fio_names
@@ -376,7 +378,10 @@ export function SideMenuComponent(props: Props): React.ReactElement {
     if (index >= 0) rowDatas.splice(index, 1)
   }
 
-  if (ENV.ENABLE_VISA_PROGRAM && IONIA_SUPPORTED_FIATS.includes(defaultFiat)) {
+  if (
+    CONFIG.ENABLE_VISA_PROGRAM &&
+    IONIA_SUPPORTED_FIATS.includes(defaultFiat)
+  ) {
     rowDatas.unshift({
       handlePress: () => {
         dispatch(
diff --git a/src/config.ts b/src/config.ts
new file mode 100644
index 00000000000..cda810e9901
--- /dev/null
+++ b/src/config.ts
@@ -0,0 +1,8 @@
+import CONFIG_JSON from '../config.json'
+import { asConfigJson, type ConfigJson } from './configKeysSchema'
+
+/**
+ * Immutable non-secret settings from `config.json`. Never updated by remote
+ * appKeys overlays.
+ */
+export const CONFIG: ConfigJson = asConfigJson.withRest(CONFIG_JSON)
diff --git a/src/configKeysMerge.ts b/src/configKeysMerge.ts
new file mode 100644
index 00000000000..75aaaf276c9
--- /dev/null
+++ b/src/configKeysMerge.ts
@@ -0,0 +1,225 @@
+// Helpers for merging config.json enablement with keys.json secrets into
+// resolved plugin maps, and for deep-merging remote key overlays.
+
+import { asObject, asUnknown } from 'cleaners'
+
+import {
+  type ConfigJson,
+  GLOBAL_KEY_NAMES,
+  type GlobalKeys,
+  type RuntimeKeys
+} from './configKeysSchema'
+
+/** Open string-keyed object; fails closed on non-objects (unlike a soft coerce). */
+const asUnknownMap = asObject(asUnknown)
+
+export function isPlainObject(
+  value: unknown
+): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+/** Maps inside a keys payload that must stay objects to merge safely. */
+const KEYS_PAYLOAD_MAP_FIELDS = [
+  'corePlugins',
+  'swapPlugins',
+  'guiApiKeys',
+  'rampPlugins',
+  'globalKeys'
+]
+const FORBIDDEN_MERGE_KEYS = new Set(['__proto__', 'constructor', 'prototype'])
+
+/**
+ * Structural check on a keys payload about to be merged into KEYS, whichever
+ * tier it came from: a signed infoRollup `appKeys` overlay or the on-disk cache.
+ *
+ * Deliberately not `asKeysJson`. That cleaner defaults every absent field, and
+ * these payloads are partial overlays, so defaulting would let a sparse one
+ * blank out baked-in values during the merge.
+ */
+export function asMergeableKeys(raw: unknown): Record<string, unknown> {
+  if (!isPlainObject(raw)) {
+    throw new TypeError('keys payload is not an object')
+  }
+  for (const key of Object.keys(raw)) {
+    if (FORBIDDEN_MERGE_KEYS.has(key)) {
+      throw new TypeError(`keys payload contains forbidden key ${key}`)
+    }
+  }
+  for (const field of KEYS_PAYLOAD_MAP_FIELDS) {
+    const value = raw[field]
+    if (value !== undefined && !isPlainObject(value)) {
+      throw new TypeError(`keys payload field ${field} is not an object`)
+    }
+    if (isPlainObject(value)) {
+      for (const key of Object.keys(value)) {
+        if (FORBIDDEN_MERGE_KEYS.has(key)) {
+          throw new TypeError(`keys payload contains forbidden key ${key}`)
+        }
+      }
+    }
+  }
+  return raw
+}
+
+/**
+ * Recursively merge two values. `b` (the "keys" side) always wins on conflict.
+ * Plain objects are merged field-by-field; arrays and primitives are replaced
+ * wholesale. `undefined` on either side yields the other side.
+ */
+export function deepMerge(a: unknown, b: unknown): unknown {
+  if (b === undefined) return a
+  if (a === undefined) return b
+  if (isPlainObject(a) && isPlainObject(b)) {
+    const out: Record<string, unknown> = { ...a }
+    for (const key of Object.keys(b)) {
+      if (FORBIDDEN_MERGE_KEYS.has(key)) continue
+      out[key] = deepMerge(a[key], b[key])
+    }
+    return out
+  }
+  return b
+}
+
+/**
+ * Combine the config-side enablement flag with the keys-side value for one
+ * plugin ID across corePlugins, swapPlugins, guiApiKeys, and rampPlugins.
+ */
+export function mergePluginInit(
+  configValue: unknown,
+  keysValue: unknown
+): unknown {
+  if (configValue === false) return false
+  if (configValue === true) {
+    return keysValue !== undefined ? keysValue : true
+  }
+  if (configValue === undefined) {
+    return keysValue
+  }
+  // Legacy: config still carries a non-secret object (or other leftover).
+  return deepMerge(configValue, keysValue)
+}
+
+export interface PluginMaps {
+  corePlugins: Record<string, unknown>
+  swapPlugins: Record<string, unknown>
+  guiApiKeys: Record<string, unknown>
+  rampPlugins: Record<string, unknown>
+}
+
+interface ConfigFiles {
+  [key: string]: unknown
+  corePlugins?: Record<string, unknown>
+  swapPlugins?: Record<string, unknown>
+  guiApiKeys?: Record<string, unknown>
+  rampPlugins?: Record<string, unknown>
+}
+
+interface KeysFiles {
+  [key: string]: unknown
+  corePlugins?: Record<string, unknown>
+  swapPlugins?: Record<string, unknown>
+  guiApiKeys?: Record<string, unknown>
+  rampPlugins?: Record<string, unknown>
+  globalKeys?: Record<string, unknown>
+}
+
+/**
+ * Nest flat partner-key fields into `globalKeys` and drop them from the top
+ * level. Accepts cleaned `asKeysJson` output or a remote/cache overlay.
+ *
+ * Precedence is value-based, not presence-based: an empty nested slot loses to
+ * a real flat value. `asGlobalKeys` defaults every missing field to `''`, so a
+ * `keys.json` that has been through a `cleaner-config` round-trip (which
+ * `scripts/configure.ts` performs on every `npm run prepare`) carries a full
+ * `globalKeys` block of empty strings. Treating those as "already set" would
+ * permanently shadow the real flat values still sitting at the top level.
+ */
+export function nestGlobalKeys(keysJson: Record<string, unknown>): RuntimeKeys {
+  const nested: Record<string, unknown> = {
+    ...(isPlainObject(keysJson.globalKeys) ? keysJson.globalKeys : {})
+  }
+  const out: Record<string, unknown> = {}
+  for (const [key, value] of Object.entries(keysJson)) {
+    if (key === 'globalKeys') continue
+    if (GLOBAL_KEY_NAMES.includes(key)) {
+      const slot = nested[key]
+      if (!(key in nested) || slot == null || slot === '') nested[key] = value
+      continue
+    }
+    out[key] = value
+  }
+  out.globalKeys = nested
+  return out as unknown as RuntimeKeys
+}
+
+function mergePluginMap(
+  configMap: Record<string, unknown>,
+  keysMap: Record<string, unknown>
+): Record<string, unknown> {
+  const out: Record<string, unknown> = {}
+  const ids = new Set([...Object.keys(configMap), ...Object.keys(keysMap)])
+  for (const id of ids) {
+    out[id] = mergePluginInit(configMap[id], keysMap[id])
+  }
+  return out
+}
+
+/**
+ * Resolve the four plugin maps from immutable CONFIG and the current KEYS.
+ * Each map unions IDs from both sides and merges per ID. Extra remote IDs on
+ * corePlugins do not register a new engine — `corePlugins.ts` is a table.
+ */
+export function resolvePluginMaps(
+  configJson: ConfigJson | Record<string, unknown>,
+  keysJson: RuntimeKeys | Record<string, unknown>
+): PluginMaps {
+  const config = asUnknownMap(configJson) as ConfigFiles
+  const keys = asUnknownMap(keysJson) as KeysFiles
+
+  return {
+    corePlugins: mergePluginMap(
+      asUnknownMap(config.corePlugins ?? {}),
+      asUnknownMap(keys.corePlugins ?? {})
+    ),
+    swapPlugins: mergePluginMap(
+      asUnknownMap(config.swapPlugins ?? {}),
+      asUnknownMap(keys.swapPlugins ?? {})
+    ),
+    guiApiKeys: mergePluginMap(
+      asUnknownMap(config.guiApiKeys ?? {}),
+      asUnknownMap(keys.guiApiKeys ?? {})
+    ),
+    rampPlugins: mergePluginMap(
+      asUnknownMap(config.rampPlugins ?? {}),
+      asUnknownMap(keys.rampPlugins ?? {})
+    )
+  }
+}
+
+/**
+ * Truncate a single secret to its first 8 characters so it can be shown for
+ * debugging without leaking the full value. Non-strings are returned as-is.
+ */
+export function redactKey(value: unknown): unknown {
+  if (typeof value === 'string') return value.slice(0, 8)
+  return value
+}
+
+/**
+ * Recursively redact every string within a value to at most 8 characters.
+ */
+export function redactValue(value: unknown): unknown {
+  if (typeof value === 'string') return value.slice(0, 8)
+  if (Array.isArray(value)) return value.map(redactValue)
+  if (isPlainObject(value)) {
+    const out: Record<string, unknown> = {}
+    for (const [key, item] of Object.entries(value)) {
+      out[key] = redactValue(item)
+    }
+    return out
+  }
+  return value
+}
+
+export type { GlobalKeys }
diff --git a/src/configKeysSchema.ts b/src/configKeysSchema.ts
new file mode 100644
index 00000000000..2c6c9163913
--- /dev/null
+++ b/src/configKeysSchema.ts
@@ -0,0 +1,223 @@
+import {
+  asArray,
+  asBoolean,
+  asObject,
+  asOptional,
+  asString,
+  asUnknown,
+  asValue,
+  type Cleaner
+} from 'cleaners'
+
+import { asBase16 } from './util/cleaners/asHex'
+
+function asNullable<T>(cleaner: Cleaner<T>): Cleaner<T | null> {
+  return function asNullable(raw) {
+    if (raw == null) return null
+    return cleaner(raw)
+  }
+}
+
+// Plugin init maps are keyed by plugin ID and hold arbitrary init options that
+// are validated by each plugin, so we intentionally keep the values loose here.
+// They live in BOTH files: config.json owns enablement flags (plus every map's
+// key set) and keys.json owns the secret halves. `resolvePluginMaps`
+// deep-merges them per plugin ID.
+const asPluginMap = asOptional(
+  asObject<unknown>(asUnknown),
+  (): Record<string, unknown> => ({})
+)
+
+/**
+ * Cleaner for the committable, non-secret `config.json` file. This is the
+ * source of truth for which fields are config-owned; `scripts/configure.ts`
+ * runs it through `makeConfig` so secrets can never be defaulted/written here.
+ */
+export const asConfigJson = asObject({
+  // Plugin init maps, keyed by plugin ID:
+  corePlugins: asPluginMap,
+  swapPlugins: asPluginMap,
+  guiApiKeys: asPluginMap,
+  rampPlugins: asPluginMap,
+
+  // PostHog host (the api key is KEYS.POSTHOG_API_KEY):
+  POSTHOG_API_HOST: asOptional(asString),
+
+  // Per-developer login shortcuts — temporary, never served remotely:
+  YOLO_DEEP_LINK: asNullable(asString),
+  YOLO_PASSWORD: asNullable(asString),
+  YOLO_PIN: asNullable(asString),
+  YOLO_USERNAME: asNullable(asString),
+
+  // GUI plugin options:
+  ACTION_QUEUE: asOptional(
+    asObject({
+      debugStore: asOptional(asBoolean, false),
+      enableDryrun: asOptional(asBoolean, true),
+      pushServerUri: asOptional(asString, 'https://push.edge.app'),
+      mockMode: asOptional(asBoolean, false)
+    }),
+    {
+      debugStore: false,
+      enableDryrun: true,
+      pushServerUri: 'https://push.edge.app',
+      mockMode: false
+    }
+  ),
+
+  // Debug logging configuration:
+  LOG_CONFIG: asOptional(
+    asObject({
+      enabledCategories: asOptional(asArray(asString), () => []),
+      maskSensitiveHeaders: asOptional(asBoolean, true),
+      sensitiveHeaders: asOptional(asArray(asString), () => [
+        'api-key',
+        'user-api-key',
+        'authorization',
+        'x-api-key'
+      ])
+    }),
+    () => ({
+      enabledCategories: [],
+      maskSensitiveHeaders: true,
+      sensitiveHeaders: [
+        'api-key',
+        'user-api-key',
+        'authorization',
+        'x-api-key'
+      ]
+    })
+  ),
+
+  // App options:
+  APP_CONFIG: asOptional(asString, 'edge'),
+  ENABLE_STAKING: asOptional(asBoolean, true),
+  ENABLE_VISA_PROGRAM: asOptional(asBoolean, false),
+  BETA_FEATURES: asOptional(asBoolean, false),
+  KEYS_ONLY_PLUGINS: asOptional(asObject(asBoolean), {}),
+  USE_FAKE_CORE: asOptional(asBoolean, false),
+  USE_FIREBASE: asOptional(asBoolean, true),
+  USE_WELCOME_SCREENS: asOptional(asBoolean, true),
+
+  // Debug options:
+  ALLOW_DEVELOPER_MODE: asOptional(asBoolean, true),
+  DEV_TAB: asOptional(asBoolean, false),
+  DEBUG_CORE: asOptional(asBoolean, false),
+  DEBUG_CURRENCY_PLUGINS: asOptional(asBoolean, false),
+  DEBUG_PLUGINS: asOptional(asBoolean, false),
+  DEBUG_ACCOUNTBASED: asOptional(asBoolean, false),
+  DEBUG_EXCHANGES: asOptional(asBoolean, false),
+  DEBUG_VERBOSE_LOGGING: asOptional(asBoolean, false),
+  DEBUG_THEME: asOptional(asBoolean, false),
+  MUTE_CONSOLE_OUTPUT: asOptional(
+    asArray(
+      asValue(
+        'log',
+        'info',
+        'warn',
+        'error',
+        'debug',
+        'trace',
+        'group',
+        'groupCollapsed',
+        'groupEnd'
+      )
+    ),
+    []
+  ),
+  ENABLE_FIAT_SANDBOX: asOptional(asBoolean, false),
+  ENABLE_MAESTRO_BUILD: asOptional(asBoolean, false),
+  ENABLE_TEST_SERVERS: asOptional(asBoolean),
+  INFO_SERVER: asOptional(asArray(asString)),
+  // Optional override of the login server URL(s), e.g. for pointing a debug
+  // build at a local login server: ["http://192.168.1.50:3123"]. Do not include
+  // `/api` in the path. Absent in production.
+  LOGIN_SERVER: asOptional(asArray(asString)),
+  ENABLE_REDUX_PERF_LOGGING: asOptional(asBoolean, false),
+  LOG_SERVER: asNullable(
+    asObject({
+      host: asOptional(asString, 'localhost'),
+      port: asOptional(asString, '8008')
+    })
+  ),
+  THEME_SERVER: asOptional(
+    asObject({
+      host: asOptional(asString, 'localhost'),
+      port: asOptional(asString, '8008'),
+      overrideThemeFile: asOptional(
+        asString,
+        '/Users/username/Documents/overrideTheme.json'
+      )
+    }),
+    {
+      host: 'localhost',
+      port: '8008',
+      overrideThemeFile: '/Users/username/Documents/overrideTheme.json'
+    }
+  ),
+  EXPERIMENT_CONFIG_OVERRIDE: asOptional(asObject(asString), {}),
+  LOGBOX_DISABLE: asOptional(asBoolean, false)
+})
+
+/**
+ * Partner secrets nested under `KEYS.globalKeys` (and the exported
+ * `globalKeys` alias). On-disk `keys.json` may still carry these flat; load
+ * and overlay paths nest them once. POSTHOG_API_KEY stays top-level on KEYS
+ * (local-only, never served).
+ */
+export const globalKeysShape = {
+  AZTECO_API_KEY: asNullable(asString),
+  COINGECKO_API_KEY: asOptional(asString, ''),
+  IP_API_KEY: asOptional(asString, ''),
+  STAKEKIT_API_KEY: asNullable(asString),
+  UNSTOPPABLE_DOMAINS_API_KEY: asNullable(asString),
+  WALLETCONNECT_PROJECT_ID: asOptional(asString, ''),
+  KILN_TESTNET_API_KEY: asNullable(asString),
+  KILN_TESTNET_ACCOUNT_ID: asNullable(asString),
+  KILN_MAINNET_API_KEY: asNullable(asString),
+  KILN_MAINNET_ACCOUNT_ID: asNullable(asString)
+}
+export const asGlobalKeys = asObject(globalKeysShape).withRest
+export const GLOBAL_KEY_NAMES = Object.keys(globalKeysShape)
+
+/**
+ * Cleaner for the private `keys.json` file. Flat partner-key fields are still
+ * accepted for legacy on-disk files; `nestGlobalKeys` nests them under
+ * `globalKeys` for the runtime `KEYS` object.
+ */
+export const asKeysJson = asObject({
+  corePlugins: asPluginMap,
+  swapPlugins: asPluginMap,
+  guiApiKeys: asPluginMap,
+  rampPlugins: asPluginMap,
+  globalKeys: asOptional(asGlobalKeys, () => ({})),
+
+  // Legacy flat partner keys (normalized into globalKeys at load):
+  ...globalKeysShape,
+
+  // Local-only telemetry credential (never served); stays top-level on KEYS:
+  POSTHOG_API_KEY: asNullable(asString),
+
+  // Auth + local-only telemetry (never served via signed infoRollup):
+  EDGE_API_KEY: asOptional(asString, ''),
+  EDGE_API_SECRET: asOptional(asBase16),
+  BUGSNAG_API_KEY: asNullable(asString),
+
+  SENTRY_DSN_URL: asOptional(asString, 'SENTRY_DSN_URL'),
+  SENTRY_MAP_UPLOAD_URL: asOptional(asString, 'SENTRY_MAP_UPLOAD_URL'),
+  SENTRY_MAP_UPLOAD_AUTH_TOKEN: asOptional(
+    asString,
+    'SENTRY_MAP_UPLOAD_AUTH_TOKEN'
+  ),
+  SENTRY_ORGANIZATION_SLUG: asOptional(asString, 'SENTRY_ORGANIZATION_SLUG'),
+  SENTRY_PROJECT_SLUG: asOptional(asString, 'SENTRY_PROJECT_SLUG')
+})
+
+export type ConfigJson = ReturnType<typeof asConfigJson>
+export type KeysJson = ReturnType<typeof asKeysJson>
+export type GlobalKeys = ReturnType<typeof asGlobalKeys>
+
+/** Runtime keys after flat partner fields have been nested under globalKeys. */
+export type RuntimeKeys = Omit<KeysJson, keyof typeof globalKeysShape> & {
+  globalKeys: GlobalKeys
+}
diff --git a/src/constants/WalletAndCurrencyConstants.ts b/src/constants/WalletAndCurrencyConstants.ts
index 4e43c3d4191..7fc2858fcc1 100644
--- a/src/constants/WalletAndCurrencyConstants.ts
+++ b/src/constants/WalletAndCurrencyConstants.ts
@@ -5,17 +5,28 @@ import { Platform } from 'react-native'
 
 import { lstrings } from '../locales/strings'
 import type { WalletConnectChainId } from '../types/types'
+import {
+  FEE_ALERT_THRESHOLD,
+  FEE_COLOR_THRESHOLD,
+  FIAT_CODES_SYMBOLS,
+  FIAT_PRECISION,
+  getFiatSymbol
+} from '../util/fiatConstants'
 import { asMoneroUserSettings, isMoneroEdgeLws } from '../util/monero'
-import { removeIsoPrefix } from '../util/utils'
 
-export const MAX_TOKEN_CODE_CHARACTERS = 7
+// Re-export fiat helpers so existing importers stay unchanged
+export {
+  FEE_ALERT_THRESHOLD,
+  FEE_COLOR_THRESHOLD,
+  FIAT_CODES_SYMBOLS,
+  FIAT_PRECISION,
+  getFiatSymbol
+}
 
-export const FEE_COLOR_THRESHOLD = 2.0 // this is denominated in dollars
-export const FEE_ALERT_THRESHOLD = 5.0 // this is denominated in dollars
+export const MAX_TOKEN_CODE_CHARACTERS = 7
 
 export const MAX_ADDRESS_CHARACTERS = 17 // for displaying a truncated wallet address
 export const MAX_CRYPTO_AMOUNT_CHARACTERS = 10 // includes both whole and fractional characters
-export const FIAT_PRECISION = 2
 const UTXO_MAX_SPEND_TARGETS = 32
 
 // Sync status consts
@@ -1160,177 +1171,6 @@ export function isKeysOnlyModeDate(date: Date): boolean {
 }
 
 export const USD_FIAT = 'iso:USD'
-/**
- * Get the fiat symbol from an iso:[fiat] OR fiat currency code
- */
-export const getFiatSymbol = (isoOrFiatCurrencyCode: string): string => {
-  if (typeof isoOrFiatCurrencyCode !== 'string') return ''
-  const codeWithoutIso = removeIsoPrefix(isoOrFiatCurrencyCode)
-  const out = FIAT_CODES_SYMBOLS[codeWithoutIso.toUpperCase()]
-  return out ?? ''
-}
-export const FIAT_CODES_SYMBOLS: Record<string, string> = {
-  AED: 'د.إ',
-  AFN: '؋',
-  ALL: 'L',
-  AMD: '֏',
-  ANG: 'ƒ',
-  AOA: 'Kz',
-  ARS: '$',
-  AUD: '$',
-  AWG: 'ƒ',
-  AZN: '₼',
-  BAM: 'KM',
-  BBD: '$',
-  BDT: '৳',
-  BGN: 'лв',
-  BIF: 'Fr',
-  BMD: '$',
-  BND: '$',
-  BOB: 'Bs.',
-  BRL: 'R$',
-  BSD: '$',
-  BTN: 'Nu.',
-  BWP: 'P',
-  BYN: 'Br',
-  BZD: '$',
-  CAD: '$',
-  CDF: 'Fr',
-  CHF: 'Fr',
-  CLP: '$',
-  CNY: '¥',
-  COP: '$',
-  CRC: '₡',
-  CUC: '$',
-  CUP: '$',
-  CVE: '$',
-  CZK: 'Kč',
-  DJF: 'Fr',
-  DKK: 'kr',
-  DOP: '$',
-  DZD: 'د.ج',
-  EGP: 'ج.م',
-  ERN: 'Nfk',
-  ETB: 'Br',
-  EUR: '€',
-  FJD: '$',
-  FKP: '£',
-  GBP: '£',
-  GEL: '₾',
-  GGP: '£',
-  GHS: '₵',
-  GIP: '£',
-  GMD: 'D',
-  GNF: 'Fr',
-  GTQ: 'Q',
-  GYD: '$',
-  HKD: '$',
-  HNL: 'L',
-  HRK: 'kn',
-  HTG: 'G',
-  HUF: 'Ft',
-  IDR: 'Rp',
-  ILS: '₪',
-  IMP: '£',
-  INR: '₹',
-  IQD: 'ع.د',
-  IRR: '﷼',
-  ISK: 'kr',
-  JEP: '£',
-  JMD: '$',
-  JOD: 'د.ا',
-  JPY: '¥',
-  KES: 'Sh',
-  KGS: 'с',
-  KHR: '៛',
-  KMF: 'Fr',
-  KPW: '₩',
-  KRW: '₩',
-  KWD: 'د.ك',
-  KYD: '$',
-  KZT: '₸',
-  LAK: '₭',
-  LBP: 'ل.ل',
-  LKR: 'Rs',
-  LRD: '$',
-  LSL: 'L',
-  LYD: 'ل.د',
-  MAD: 'د. م.',
-  MDL: 'L',
-  MGA: 'Ar',
-  MKD: 'ден',
-  MMK: 'Ks',
-  MNT: '₮',
-  MOP: 'P',
-  MRO: 'UM',
-  MRU: 'UM',
-  MUR: '₨',
-  MWK: 'MK',
-  MXN: '$',
-  MYR: 'RM',
-  MZN: 'MT',
-  NAD: '$',
-  NGN: '₦',
-  NIO: 'C$',
-  NOK: 'kr',
-  NPR: '₨',
-  NZD: '$',
-  OMR: 'ر.ع.',
-  PAB: 'B/.',
-  PEN: 'S/.',
-  PGK: 'K',
-  PHP: '₱',
-  PKR: '₨',
-  PLN: 'zł',
-  PRB: 'р.',
-  PYG: '₲',
-  QAR: 'ر.ق',
-  RON: 'lei',
-  RSD: 'дин',
-  RUB: '₽',
-  RWF: 'Fr',
-  SAR: 'ر.س',
-  SBD: '$',
-  SCR: '₨',
-  SDG: 'ج.س.',
-  SEK: 'kr',
-  SGD: '$',
-  SHP: '£',
-  SLL: 'Le',
-  SOS: 'Sh',
-  SRD: '$',
-  SSP: '£',
-  STD: 'Db',
-  SYP: 'ل.س',
-  SZL: 'L',
-  THB: '฿',
-  TJS: 'ЅМ',
-  TMT: 'm',
-  TND: 'د.ت',
-  TOP: 'T$',
-  TRY: '₺',
-  TTD: '$',
-  TVD: '$',
-  TWD: '$',
-  TZS: 'Sh',
-  UAH: '₴',
-  UGX: 'Sh',
-  USD: '$',
-  UYU: '$',
-  UZS: '',
-  VEF: 'Bs',
-  VND: '₫',
-  VUV: 'Vt',
-  WST: 'T',
-  XAF: 'Fr',
-  XCD: '$',
-  XOF: 'Fr',
-  XPF: 'Fr',
-  YER: '﷼',
-  ZAR: 'R',
-  ZMW: 'ZK'
-}
-
 export const FIO_WALLET_TYPE = 'wallet:fio'
 export const FIO_STR = 'FIO'
 export const FIO_PLUGIN_ID = 'fio'
diff --git a/src/constants/txActionConstants.ts b/src/constants/txActionConstants.ts
index 13d811cb8ec..88825201127 100644
--- a/src/constants/txActionConstants.ts
+++ b/src/constants/txActionConstants.ts
@@ -1,26 +1 @@
-import type { EdgeAssetActionType } from 'edge-core-js'
-
-import { lstrings } from '../locales/strings'
-
-export const TX_ACTION_LABEL_MAP: Record<EdgeAssetActionType, string> = {
-  buy: lstrings.transaction_details_bought_1s,
-  claim: lstrings.transaction_details_claim,
-  claimOrder: lstrings.transaction_details_claim_order,
-  giftCard: lstrings.transaction_details_gift_card,
-  sell: lstrings.transaction_details_sold_1s,
-  sellNetworkFee: lstrings.fiat_plugin_sell_network_fee,
-  swap: lstrings.transaction_details_swap,
-  swapNetworkFee: lstrings.transaction_details_swap_network_fee,
-  swapOrderPost: lstrings.transaction_details_swap_order_post,
-  swapOrderFill: lstrings.transaction_details_swap_order_fill,
-  swapOrderCancel: lstrings.transaction_details_swap_order_cancel,
-  stake: lstrings.transaction_details_stake,
-  stakeNetworkFee: lstrings.transaction_details_stake_network_fee,
-  stakeOrder: lstrings.transaction_details_stake_order,
-  tokenApproval: lstrings.transaction_details_token_approval,
-  transfer: lstrings.transaction_details_transfer_funds,
-  transferNetworkFee: lstrings.transaction_details_transfer_network_fee,
-  unstake: lstrings.transaction_details_unstake,
-  unstakeNetworkFee: lstrings.transaction_details_unstake_network_fee,
-  unstakeOrder: lstrings.transaction_details_unstake_order
-}
+export { TX_ACTION_LABEL_MAP } from '../util/txDisplay/txActionLabels'
diff --git a/src/controllers/action-queue/ActionProgram.ts b/src/controllers/action-queue/ActionProgram.ts
index fb061750b4e..5df507f6ffa 100644
--- a/src/controllers/action-queue/ActionProgram.ts
+++ b/src/controllers/action-queue/ActionProgram.ts
@@ -1,4 +1,4 @@
-import { ENV } from '../../env'
+import { CONFIG } from '../../config'
 import { lstrings } from '../../locales/strings'
 import type {
   ActionOp,
@@ -21,6 +21,6 @@ export async function makeActionProgram(
       title: lstrings.action_display_title_complete_default,
       message: lstrings.action_display_message_complete_default
     },
-    mockMode: ENV.ACTION_QUEUE.mockMode
+    mockMode: CONFIG.ACTION_QUEUE.mockMode
   }
 }
diff --git a/src/controllers/action-queue/ActionQueueStore.ts b/src/controllers/action-queue/ActionQueueStore.ts
index 98f101986f3..8aeffd25bf7 100644
--- a/src/controllers/action-queue/ActionQueueStore.ts
+++ b/src/controllers/action-queue/ActionQueueStore.ts
@@ -2,7 +2,7 @@ import { asEither, type Cleaner, uncleaner } from 'cleaners'
 import { navigateDisklet } from 'disklet'
 import type { EdgeAccount } from 'edge-core-js'
 
-import { ENV } from '../../env'
+import { CONFIG } from '../../config'
 import { useSelector } from '../../types/reactRedux'
 import { filterUndefined } from '../../util/safeFilters'
 import type { LoanProgramEdge, LoanProgramType } from '../loan-manager/store'
@@ -16,7 +16,7 @@ import type {
 import { checkEffectIsDone } from './util/checkEffectIsDone'
 import { makeInitialProgramState } from './util/makeInitialProgramState'
 
-const { debugStore } = ENV.ACTION_QUEUE
+const { debugStore } = CONFIG.ACTION_QUEUE
 
 export const ACTION_QUEUE_DATASTORE_ID = 'actionQueue'
 
@@ -43,7 +43,7 @@ export const makeActionQueueStore = (
     path: string,
     data: unknown,
     cleaner: Cleaner<any>
-  ) {
+  ): Promise<void> {
     try {
       const uncleanData = uncleaner(cleaner)(data)
       const serializedData = JSON.stringify(uncleanData)
@@ -81,7 +81,7 @@ export const makeActionQueueStore = (
       )
 
       // Only add the mockMode field if environment is configured with the flag enabled
-      if (ENV.ACTION_QUEUE.mockMode) program.mockMode = true
+      if (CONFIG.ACTION_QUEUE.mockMode) program.mockMode = true
 
       // Save to disk
       await Promise.all([
@@ -127,7 +127,7 @@ export const makeActionQueueStore = (
       )
       const promises = programIds.map(
         async programId =>
-          await instance.getActionQueueItem(programId).catch(err => {
+          await instance.getActionQueueItem(programId).catch((err: unknown) => {
             // Silently fail on reads
             console.error(`Failed to get ActionQueueItem for '${programId}'`, {
               err
diff --git a/src/controllers/action-queue/runtime/executeActionProgram.ts b/src/controllers/action-queue/runtime/executeActionProgram.ts
index 2c94d5cb695..89c7770cfee 100644
--- a/src/controllers/action-queue/runtime/executeActionProgram.ts
+++ b/src/controllers/action-queue/runtime/executeActionProgram.ts
@@ -1,4 +1,4 @@
-import { ENV } from '../../../env'
+import { CONFIG } from '../../../config'
 import { logActivity } from '../../../util/logger'
 import {
   effectCanBeATrigger,
@@ -28,7 +28,7 @@ export const executeActionProgram = async (
   //
 
   if (
-    ENV.ACTION_QUEUE?.enableDryrun &&
+    CONFIG.ACTION_QUEUE?.enableDryrun &&
     effect != null &&
     (await effectCanBeATrigger(context, effect))
   ) {
@@ -125,7 +125,7 @@ export const executeActionProgram = async (
     return {
       nextState: {
         ...state,
-        ...(effectCheck.updatedEffect
+        ...(effectCheck.updatedEffect != null
           ? { effect: effectCheck.updatedEffect }
           : {}),
         effective: effectCheck.isEffective,
diff --git a/src/env.ts b/src/env.ts
deleted file mode 100644
index ed6bad685e6..00000000000
--- a/src/env.ts
+++ /dev/null
@@ -1,4 +0,0 @@
-import ENV_JSON from '../env.json'
-import { asEnvConfig } from './envConfig'
-
-export const ENV = asEnvConfig(ENV_JSON)
diff --git a/src/envConfig.ts b/src/envConfig.ts
deleted file mode 100644
index 3f3f1836df7..00000000000
--- a/src/envConfig.ts
+++ /dev/null
@@ -1,598 +0,0 @@
-import {
-  asArray,
-  asBoolean,
-  asEither,
-  asNumber,
-  asObject,
-  asOptional,
-  asString,
-  asValue,
-  type Cleaner
-} from 'cleaners'
-
-import { asInitOptions as asBanxaInitOptions } from './plugins/ramps/banxa/banxaRampTypes'
-import { asInitOptions as asBitsofgoldInitOptions } from './plugins/ramps/bitsofgold/bitsofgoldRampTypes'
-import { asInitOptions as asInfiniteInitOptions } from './plugins/ramps/infinite/infiniteRampTypes'
-import { asInitOptions as asLibertyxInitOptions } from './plugins/ramps/libertyx/libertyxRampTypes'
-import { asInitOptions as asMoonpayInitOptions } from './plugins/ramps/moonpay/moonpayRampTypes'
-import { asInitOptions as asPaybisInitOptions } from './plugins/ramps/paybis/paybisRampTypes'
-import { asInitOptions as asRevolutInitOptions } from './plugins/ramps/revolut/revolutRampTypes'
-import { asInitOptions as asSimplexInitOptions } from './plugins/ramps/simplex/simplexRampTypes'
-import { asBase16 } from './util/cleaners/asHex'
-import { asObfuscatedString } from './util/cleaners/asObfuscatedString'
-
-function asNullable<T>(cleaner: Cleaner<T>): Cleaner<T | null> {
-  return function asNullable(raw) {
-    if (raw == null) return null
-    return cleaner(raw)
-  }
-}
-
-function asCorePluginInit<T>(cleaner: Cleaner<T>): Cleaner<T | false> {
-  return function asCorePlugin(raw) {
-    if (raw === false || raw == null) return false
-    return cleaner(raw)
-  }
-}
-
-const asEvmApiKeys = asObject({
-  alethioApiKey: asOptional(asString, ''),
-  amberdataApiKey: asOptional(asString, ''),
-  blockchairApiKey: asOptional(asString, ''),
-  drpcApiKey: asOptional(asString, ''),
-  evmScanApiKey: asOptional(asArray(asString), () => []),
-  gasStationApiKey: asOptional(asString, ''),
-  infuraProjectId: asOptional(asString, ''),
-  nowNodesApiKey: asOptional(asString, ''),
-  poktPortalApiKey: asOptional(asString, ''),
-  quiknodeApiKey: asOptional(asString, '')
-}).withRest
-
-export const asEnvConfig = asObject({
-  // API keys:
-  EDGE_API_KEY: asOptional(asString, ''),
-  EDGE_API_SECRET: asOptional(asBase16),
-
-  COINGECKO_API_KEY: asOptional(asString, ''),
-  IP_API_KEY: asOptional(asString, ''),
-  SENTRY_DSN_URL: asOptional(asString, 'SENTRY_DSN_URL'),
-  SENTRY_MAP_UPLOAD_URL: asOptional(asString, 'SENTRY_MAP_UPLOAD_URL'),
-  SENTRY_MAP_UPLOAD_AUTH_TOKEN: asOptional(
-    asString,
-    'SENTRY_MAP_UPLOAD_AUTH_TOKEN'
-  ),
-  SENTRY_ORGANIZATION_SLUG: asOptional(asString, 'SENTRY_ORGANIZATION_SLUG'),
-  SENTRY_PROJECT_SLUG: asOptional(asString, 'SENTRY_PROJECT_SLUG'),
-
-  // GUI plugin options:
-  ACTION_QUEUE: asOptional(
-    asObject({
-      debugStore: asOptional(asBoolean, false),
-      enableDryrun: asOptional(asBoolean, true),
-      pushServerUri: asOptional(asString, 'https://push.edge.app'),
-      mockMode: asOptional(asBoolean, false)
-    }),
-    {
-      debugStore: false,
-      enableDryrun: true,
-      pushServerUri: 'https://push.edge.app',
-      mockMode: false
-    }
-  ),
-
-  // Debug logging configuration:
-  LOG_CONFIG: asOptional(
-    asObject({
-      // Categories to enable (e.g., ['phaze', 'coinrank'])
-      enabledCategories: asOptional(asArray(asString), () => []),
-      // Whether to mask sensitive headers in API logs
-      maskSensitiveHeaders: asOptional(asBoolean, true),
-      // Header names to mask (case-insensitive)
-      sensitiveHeaders: asOptional(asArray(asString), () => [
-        'api-key',
-        'user-api-key',
-        'authorization',
-        'x-api-key'
-      ])
-    }),
-    () => ({
-      enabledCategories: [],
-      maskSensitiveHeaders: true,
-      sensitiveHeaders: [
-        'api-key',
-        'user-api-key',
-        'authorization',
-        'x-api-key'
-      ]
-    })
-  ),
-  PLUGIN_API_KEYS: asOptional(
-    asObject({
-      banxa: asOptional(
-        asObject({
-          partnerUrl: asString,
-          hmacUser: asString,
-          apiKey: asString
-        })
-      ),
-      Bitrefill: asOptional(asString),
-      kado: asOptional(
-        asObject({
-          apiKey: asString
-        })
-      ),
-      kadoOtc: asOptional(
-        asObject({
-          apiKey: asString,
-          apiUserEmail: asString
-        })
-      ),
-      moonpay: asOptional(asString),
-      mtpelerin: asOptional(
-        asObject({
-          apiKey: asString,
-          referralCode: asOptional(asString)
-        })
-      ),
-      paybis: asOptional(
-        asObject({
-          partnerUrl: asOptional(asString, 'https://widget-api.paybis.com'),
-          apiKey: asString,
-          privateKeyB64: asString
-        })
-      ),
-      revolut: asOptional(
-        asObject({
-          apiKey: asString
-        })
-      ),
-      simplex: asOptional(
-        asObject({
-          partner: asString,
-          jwtTokenProvider: asString,
-          publicKey: asString
-        })
-      ),
-      ionia: asOptional(
-        asObject({
-          clientId: asString,
-          clientSecret: asString,
-          ioniaBaseUrl: asString,
-          merchantId: asNumber,
-          scope: asString
-        })
-      ),
-      phaze: asOptional(
-        asObject({
-          apiKey: asString,
-          baseUrl: asString
-        })
-      )
-    }).withRest,
-    () => ({
-      banxa: undefined,
-      Bitrefill: undefined,
-      kado: undefined,
-      kadoOtc: undefined,
-      moonpay: undefined,
-      mtpelerin: undefined,
-      paybis: undefined,
-      revolut: undefined,
-      simplex: undefined,
-      ionia: undefined,
-      phaze: undefined
-    })
-  ),
-  RAMP_PLUGIN_INITS: asOptional(
-    asObject<Record<string, unknown>>({
-      banxa: asOptional(asBanxaInitOptions),
-      bitsofgold: asOptional(asBitsofgoldInitOptions),
-      libertyx: asOptional(asLibertyxInitOptions),
-      moonpay: asOptional(asMoonpayInitOptions),
-      infinite: asOptional(asInfiniteInitOptions),
-      paybis: asOptional(asPaybisInitOptions),
-      revolut: asOptional(asRevolutInitOptions),
-      simplex: asOptional(asSimplexInitOptions)
-    }).withRest,
-    () => ({
-      banxa: undefined,
-      bitsofgold: undefined,
-      libertyx: undefined,
-      moonpay: undefined,
-      infinite: undefined,
-      paybis: undefined,
-      revolut: undefined,
-      simplex: undefined
-    })
-  ),
-  WYRE_CLIENT_INIT: asOptional(
-    asObject({
-      baseUri: asString
-    }),
-    () => ({
-      baseUri: 'https://api.sendwyre.com'
-    })
-  ),
-  AZTECO_API_KEY: asNullable(asString),
-  STAKEKIT_API_KEY: asNullable(asString),
-  KILN_TESTNET_API_KEY: asNullable(asString),
-  KILN_TESTNET_ACCOUNT_ID: asNullable(asString),
-  KILN_MAINNET_API_KEY: asNullable(asString),
-  KILN_MAINNET_ACCOUNT_ID: asNullable(asString),
-  UNSTOPPABLE_DOMAINS_API_KEY: asNullable(asString),
-
-  // Core plugin options:
-  ABSTRACT_INIT: asCorePluginInit(asEvmApiKeys),
-  ARBITRUM_INIT: asCorePluginInit(asEvmApiKeys),
-  AMOY_INIT: asCorePluginInit(asEvmApiKeys),
-  ALGORAND_INIT: asOptional(asBoolean, true),
-  AVALANCHE_INIT: asCorePluginInit(asEvmApiKeys),
-  AXELAR_INIT: asOptional(asBoolean, true),
-  BASE_INIT: asCorePluginInit(asEvmApiKeys),
-  BINANCE_SMART_CHAIN_INIT: asCorePluginInit(asEvmApiKeys),
-  BITCOIN_INIT: asCorePluginInit(
-    asObject({
-      nowNodesApiKey: asOptional(asString, '')
-    })
-  ),
-  BITCOINCASH_INIT: asCorePluginInit(
-    asObject({
-      nowNodesApiKey: asOptional(asString, '')
-    })
-  ),
-  BOTANIX_INIT: asCorePluginInit(asEvmApiKeys),
-  // Bridgeless is enabled by default (no key required). An optional referralId
-  // (uint16) is passed through to the swap plugin to earn referral revenue.
-  BRIDGELESS_INIT: asOptional(
-    asObject({
-      referralId: asOptional(asNumber)
-    }).withRest,
-    { referralId: undefined }
-  ),
-  MAYACHAIN_INIT: asCorePluginInit(asBoolean),
-  CARDANO_INIT: asCorePluginInit(
-    asObject({
-      blockfrostProjectId: asOptional(asString),
-      koiosApiKey: asOptional(asString),
-      maestroApiKey: asOptional(asString)
-    })
-  ),
-  CARDANO_TESTNET_INIT: asCorePluginInit(
-    asObject({
-      blockfrostProjectId: asOptional(asString),
-      koiosApiKey: asOptional(asString),
-      maestroApiKey: asOptional(asString)
-    })
-  ),
-  CELO_INIT: asCorePluginInit(asEvmApiKeys),
-  CHANGE_NOW_INIT: asCorePluginInit(
-    asObject({
-      apiKey: asOptional(asString, '')
-    }).withRest
-  ),
-  CHANGEHERO_INIT: asCorePluginInit(
-    asObject({
-      apiKey: asOptional(asString, '')
-    }).withRest
-  ),
-  CHANGELLY_INIT: asCorePluginInit(
-    asObject({
-      // Arrays of XOR-masked char codes; see asObfuscatedString.
-      // No fallback values: the plugin itself refuses to load when either
-      // member is missing, so a partial entry disables Changelly instead of
-      // supplying placeholder credentials.
-      apiKey: asOptional(asObfuscatedString),
-      partnerId: asOptional(asString)
-    }).withRest
-  ),
-  COREUM_INIT: asCorePluginInit(asBoolean),
-  COSMOSHUB_INIT: asCorePluginInit(asBoolean),
-  DASH_INIT: asCorePluginInit(
-    asObject({
-      nowNodesApiKey: asOptional(asString, '')
-    })
-  ),
-  DIGIBYTE_INIT: asCorePluginInit(
-    asObject({
-      nowNodesApiKey: asOptional(asString, '')
-    })
-  ),
-  DOGE_INIT: asCorePluginInit(
-    asObject({
-      nowNodesApiKey: asOptional(asString, '')
-    })
-  ),
-  ECASH_INIT: asCorePluginInit(
-    asObject({
-      nowNodesApiKey: asOptional(asString, '')
-    })
-  ),
-  ETHEREUM_INIT: asCorePluginInit(asEvmApiKeys),
-  ETHEREUM_POW_INIT: asCorePluginInit(asEvmApiKeys),
-  EXOLIX_INIT: asCorePluginInit(
-    asObject({
-      apiKey: asOptional(asString, '')
-    }).withRest
-  ),
-  FANTOM_INIT: asCorePluginInit(asEvmApiKeys),
-  FIO_INIT: asEither(
-    asOptional(asBoolean, true), // Defaults to true if missing.
-    asObject({
-      fioRegApiToken: asOptional(asString, ''),
-      tpid: asOptional(asString, 'finance@edge')
-    }).withRest
-  ),
-  FILECOINFEVM_INIT: asCorePluginInit(asEvmApiKeys),
-  FILECOINFEVM_CALIBRATION_INIT: asCorePluginInit(asEvmApiKeys),
-  FILECOIN_INIT: asCorePluginInit(
-    asObject({
-      glifApiKey: asOptional(asString, '')
-    })
-  ),
-  GROESTLCOIN_INIT: asCorePluginInit(
-    asObject({
-      nowNodesApiKey: asOptional(asString, '')
-    })
-  ),
-  GODEX_INIT: asCorePluginInit(
-    asObject({
-      apiKey: asOptional(asString, '')
-    }).withRest
-  ),
-  HOLESKY_INIT: asCorePluginInit(asEvmApiKeys),
-  HEDERA_INIT: asOptional(asBoolean, true),
-  HYPEREVM_INIT: asCorePluginInit(asEvmApiKeys),
-  LIBERLAND_INIT: asOptional(asBoolean, true),
-  LIFI_INIT: asCorePluginInit(
-    asObject({
-      affiliateFeeBasis: asOptional(asString, '50'),
-      appId: asOptional(asString, 'edge'),
-      integrator: asOptional(asString, 'edgeapp')
-    }).withRest
-  ),
-  LITECOIN_INIT: asCorePluginInit(
-    asObject({
-      nowNodesApiKey: asOptional(asString, '')
-    })
-  ),
-  LETSEXCHANGE_INIT: asCorePluginInit(
-    asObject({
-      apiKey: asOptional(asString, '')
-    }).withRest
-  ),
-  MONAD_INIT: asCorePluginInit(asEvmApiKeys),
-  MONERO_INIT: asCorePluginInit(
-    asObject({
-      apiKey: asOptional(asString, ''),
-      edgeApiKey: asOptional(asString, '')
-    }).withRest
-  ),
-  NEXCHANGE_INIT: asCorePluginInit(
-    asObject({
-      apiKey: asOptional(asString, ''),
-      referralCode: asOptional(asString, '')
-    }).withRest
-  ),
-  NYM_INIT: asCorePluginInit(asBoolean),
-  NYM_SWAP_INIT: asCorePluginInit(
-    asObject({
-      apiKey: asOptional(asString, '')
-    }).withRest
-  ),
-  OPBNB_INIT: asCorePluginInit(asEvmApiKeys),
-  OPTIMISM_INIT: asCorePluginInit(asEvmApiKeys),
-  OSMOSIS_INIT: asCorePluginInit(asEvmApiKeys),
-  PIVX_INIT: asCorePluginInit(
-    asObject({
-      nowNodesApiKey: asOptional(asString, '')
-    })
-  ),
-  PULSECHAIN_INIT: asCorePluginInit(asEvmApiKeys),
-  POLKADOT_INIT: asEither(
-    asOptional(asBoolean, true), // Defaults to true if missing.
-    asCorePluginInit(
-      asObject({
-        subscanApiKey: asOptional(asString, '')
-      })
-    )
-  ),
-  POLYGON_INIT: asCorePluginInit(asEvmApiKeys),
-  RANGO_INIT: asCorePluginInit(
-    asObject({
-      appId: asOptional(asString, 'edge'),
-      rangoApiKey: asOptional(asString, ''),
-      referrerAddress: asOptional(asString, ''),
-      referrerFee: asOptional(asString, '0.75')
-    }).withRest
-  ),
-  RSK_INIT: asCorePluginInit(asEvmApiKeys),
-  SEPOLIA_INIT: asCorePluginInit(asEvmApiKeys),
-  SIDESHIFT_INIT: asCorePluginInit(
-    asObject({
-      affiliateId: asOptional(asString, '')
-    })
-  ),
-  SOLANA_INIT: asCorePluginInit(
-    asObject({
-      alchemyApiKey: asOptional(asString, ''),
-      heliusApiKey: asOptional(asString),
-      poktPortalApiKey: asOptional(asString, '')
-    }).withRest
-  ),
-  SONIC_INIT: asCorePluginInit(asEvmApiKeys),
-  SPOOKY_SWAP_INIT: asCorePluginInit(
-    asObject({
-      quiknodeApiKey: asOptional(asString, '')
-    }).withRest
-  ),
-  SWAPTER_INIT: asCorePluginInit(
-    asObject({
-      apiKey: asOptional(asString, '')
-    }).withRest
-  ),
-  SWAPUZ_INIT: asCorePluginInit(
-    asObject({
-      apiKey: asOptional(asString, '')
-    }).withRest
-  ),
-  XGRAM_INIT: asCorePluginInit(
-    asObject({
-      apiKey: asOptional(asString, '')
-    }).withRest
-  ),
-  UNIZEN_INIT: asCorePluginInit(
-    asObject({
-      apiKey: asOptional(asString, '')
-    }).withRest
-  ),
-  MAYA_PROTOCOL_INIT: asCorePluginInit(
-    asObject({
-      affiliateFeeBasis: asOptional(asString, '50'),
-      appId: asOptional(asString, 'edge'),
-      thorname: asOptional(asString, 'ej')
-    }).withRest
-  ),
-  THORCHAIN_INIT: asCorePluginInit(
-    asObject({
-      affiliateFeeBasis: asOptional(asString, '50'),
-      appId: asOptional(asString, 'edge'),
-      ninerealmsClientId: asOptional(asString, ''),
-      thorname: asOptional(asString, 'ej')
-    }).withRest
-  ),
-  SWAPKIT_INIT: asCorePluginInit(
-    asObject({
-      affiliateFeeBasis: asOptional(asString, '50'),
-      appId: asOptional(asString, 'edge'),
-      ninerealmsClientId: asOptional(asString, ''),
-      thorname: asOptional(asString, 'ej'),
-      thorswapApiKey: asOptional(asString)
-    }).withRest
-  ),
-  SWAPKITV3_INIT: asCorePluginInit(
-    asObject({
-      affiliateFeeBasis: asOptional(asString, '50'),
-      appId: asOptional(asString, 'edge'),
-      thorswapApiKey: asOptional(asString)
-    }).withRest
-  ),
-  TOMB_SWAP_INIT: asCorePluginInit(
-    asObject({
-      quiknodeApiKey: asOptional(asString, '')
-    }).withRest
-  ),
-  TON_INIT: asCorePluginInit(
-    asObject({
-      drpcApiKey: asOptional(asString, ''),
-      tonCenterApiKeys: asOptional(asArray(asString), () => [])
-    }).withRest
-  ),
-  WALLET_CONNECT_INIT: asCorePluginInit(
-    asObject({
-      projectId: asOptional(asString, '')
-    }).withRest
-  ),
-  XRPDEX_INIT: asCorePluginInit(
-    asObject({
-      appId: asOptional(asString, 'edge')
-    }).withRest
-  ),
-  ZCOIN_INIT: asCorePluginInit(
-    asObject({
-      nowNodesApiKey: asOptional(asString, '')
-    })
-  ),
-  '0XGASLESS_INIT': asCorePluginInit(
-    asObject({
-      apiKey: asOptional(asString, ''),
-      feePercentage: asOptional(asNumber, 0.0075),
-      feeReceiveAddress: asOptional(
-        asString,
-        '0xd75eB391357b89C48eb64Ea621A785FF9B77e661'
-      )
-    })
-  ),
-  ZKSYNC_INIT: asCorePluginInit(asEvmApiKeys),
-
-  // App options:
-  APP_CONFIG: asOptional(asString, 'edge'),
-  ENABLE_STAKING: asOptional(asBoolean, true),
-  ENABLE_VISA_PROGRAM: asOptional(asBoolean, false),
-  BETA_FEATURES: asOptional(asBoolean, false),
-  KEYS_ONLY_PLUGINS: asOptional(asObject(asBoolean), {}),
-  USE_FAKE_CORE: asOptional(asBoolean, false),
-  USE_FIREBASE: asOptional(asBoolean, true),
-  USE_WELCOME_SCREENS: asOptional(asBoolean, true), // Used by whitelabels
-  POSTHOG_INIT: asOptional(
-    asObject({
-      apiKey: asOptional(asString, ''),
-      apiHost: asOptional(asString, '')
-    })
-  ),
-
-  YOLO_DEEP_LINK: asNullable(asString),
-  YOLO_PASSWORD: asNullable(asString),
-  YOLO_PIN: asNullable(asString),
-  YOLO_USERNAME: asNullable(asString),
-
-  // Debug options:
-  ALLOW_DEVELOPER_MODE: asOptional(asBoolean, true),
-  DEV_TAB: asOptional(asBoolean, false),
-  DEBUG_CORE: asOptional(asBoolean, false),
-  DEBUG_CURRENCY_PLUGINS: asOptional(asBoolean, false),
-  DEBUG_PLUGINS: asOptional(asBoolean, false),
-  DEBUG_ACCOUNTBASED: asOptional(asBoolean, false),
-  DEBUG_EXCHANGES: asOptional(asBoolean, false),
-  DEBUG_VERBOSE_LOGGING: asOptional(asBoolean, false),
-  DEBUG_THEME: asOptional(asBoolean, false),
-  MUTE_CONSOLE_OUTPUT: asOptional(
-    asArray(
-      asValue(
-        'log',
-        'info',
-        'warn',
-        'error',
-        'debug',
-        'trace',
-        'group',
-        'groupCollapsed',
-        'groupEnd'
-      )
-    ),
-    []
-  ),
-  ENABLE_FIAT_SANDBOX: asOptional(asBoolean, false),
-  ENABLE_MAESTRO_BUILD: asOptional(asBoolean, false),
-  ENABLE_TEST_SERVERS: asOptional(asBoolean),
-  // Optional override of the info server URL(s), e.g. for pointing a debug build
-  // at a local info server: ["http://127.0.0.1:8008"]. Absent in production.
-  INFO_SERVER: asOptional(asArray(asString)),
-  // Optional override of the login server URL(s), e.g. for pointing a debug
-  // build at a local login server: ["http://192.168.1.50:3123"]. Do not include
-  // `/api` in the path. Absent in production.
-  LOGIN_SERVER: asOptional(asArray(asString)),
-  ENABLE_REDUX_PERF_LOGGING: asOptional(asBoolean, false),
-  LOG_SERVER: asNullable(
-    asObject({
-      host: asOptional(asString, 'localhost'),
-      port: asOptional(asString, '8008')
-    })
-  ),
-  THEME_SERVER: asOptional(
-    asObject({
-      host: asOptional(asString, 'localhost'),
-      port: asOptional(asString, '8008'),
-      overrideThemeFile: asOptional(
-        asString,
-        '/Users/username/Documents/overrideTheme.json'
-      )
-    }),
-    {
-      host: 'localhost',
-      port: '8008',
-      overrideThemeFile: '/Users/username/Documents/overrideTheme.json'
-    }
-  ),
-  EXPERIMENT_CONFIG_OVERRIDE: asOptional(asObject(asString), {}),
-  LOGBOX_DISABLE: asOptional(asBoolean, false)
-}).withRest
diff --git a/src/experimentConfig.ts b/src/experimentConfig.ts
index 9ed5fb44e7c..61f6553240e 100644
--- a/src/experimentConfig.ts
+++ b/src/experimentConfig.ts
@@ -1,8 +1,8 @@
 import { asMaybe, asObject, asValue, type Cleaner } from 'cleaners'
 import { makeReactNativeDisklet } from 'disklet'
 
+import { CONFIG } from './config'
 import { LOCAL_EXPERIMENT_CONFIG } from './constants/constantSettings'
-import { ENV } from './env'
 import { isMaestro } from './util/maestro'
 
 // Persistent experiment config for A/B testing. Values initialized in this
@@ -114,15 +114,15 @@ const experimentConfigPromise: Promise<ExperimentConfig> =
 export const getExperimentConfig = async (): Promise<ExperimentConfig> => {
   if (isMaestro()) return DEFAULT_EXPERIMENT_CONFIG // Test with forced defaults
   else if (
-    ENV.EXPERIMENT_CONFIG_OVERRIDE != null &&
-    Object.keys(ENV.EXPERIMENT_CONFIG_OVERRIDE).length > 0
+    CONFIG.EXPERIMENT_CONFIG_OVERRIDE != null &&
+    Object.keys(CONFIG.EXPERIMENT_CONFIG_OVERRIDE).length > 0
   ) {
     try {
-      console.log('ENV.EXPERIMENT_CONFIG_OVERRIDE set')
-      return asExperimentConfig(ENV.EXPERIMENT_CONFIG_OVERRIDE)
+      console.log('CONFIG.EXPERIMENT_CONFIG_OVERRIDE set')
+      return asExperimentConfig(CONFIG.EXPERIMENT_CONFIG_OVERRIDE)
     } catch (err) {
       console.error(
-        'Error applying ENV.EXPERIMENT_CONFIG_OVERRIDE: ',
+        'Error applying CONFIG.EXPERIMENT_CONFIG_OVERRIDE: ',
         String(err)
       )
       console.warn('Reverting to default experiment config.')
diff --git a/src/hooks/useRampPlugins.ts b/src/hooks/useRampPlugins.ts
index 1480266c14b..00f6ddc436c 100644
--- a/src/hooks/useRampPlugins.ts
+++ b/src/hooks/useRampPlugins.ts
@@ -4,7 +4,7 @@ import * as React from 'react'
 import { useDispatch } from 'react-redux'
 
 import { updateFiatPurchaseCount } from '../actions/RequestReviewActions'
-import { ENV } from '../env'
+import { pluginMaps } from '../pluginMaps'
 import { pluginFactories } from '../plugins/ramps/allRampPlugins'
 import type {
   RampPlugin,
@@ -51,7 +51,7 @@ export function useRampPlugins({ account }: UseRampPluginsOptions): {
             const store = createStore(storeId, account.dataStore)
 
             // Create a minimal config for the plugin
-            const initOptions = ENV.RAMP_PLUGIN_INITS[pluginId]
+            const initOptions = pluginMaps.rampPlugins[pluginId]
 
             // If there is no init option defined for the plugin, simply skip over it
             if (initOptions == null) {
diff --git a/src/hooks/useRampPreferredProviders.ts b/src/hooks/useRampPreferredProviders.ts
index 33459927e12..aaafe80fb21 100644
--- a/src/hooks/useRampPreferredProviders.ts
+++ b/src/hooks/useRampPreferredProviders.ts
@@ -5,7 +5,7 @@ import { getBuildNumber, getVersion } from 'react-native-device-info'
 import { useSelector } from '../types/reactRedux'
 import { filterInfoCards } from '../util/infoUtils'
 import { infoServerData } from '../util/network'
-import { getOsVersion } from '../util/utils'
+import { getOsVersion } from '../util/rnUtils'
 
 /**
  * Ramp provider ids that the account's affiliation prefers for this direction,
diff --git a/src/keys.ts b/src/keys.ts
new file mode 100644
index 00000000000..4ed20e7b47c
--- /dev/null
+++ b/src/keys.ts
@@ -0,0 +1,54 @@
+import KEYS_JSON from '../keys.json'
+import { nestGlobalKeys } from './configKeysMerge'
+import { asKeysJson, type RuntimeKeys } from './configKeysSchema'
+
+/**
+ * Baked-in keys.json after nesting partner secrets under `globalKeys`. Used as
+ * the merge base when a remote/cache overlay arrives — never mutated.
+ */
+export const bakedKeys: RuntimeKeys = nestGlobalKeys(
+  asKeysJson.withRest(KEYS_JSON) as unknown as Record<string, unknown>
+)
+
+/**
+ * Mutable runtime keys. Remote/cache overlays update this object in place via
+ * `applyRuntimeKeys`. Partner secrets live only under `KEYS.globalKeys`.
+ */
+export const KEYS: RuntimeKeys = {
+  ...bakedKeys,
+  globalKeys: { ...bakedKeys.globalKeys }
+}
+
+/**
+ * Live alias of `KEYS.globalKeys`. Same object reference — overlays mutate this
+ * map in place so `import { globalKeys }` stays current after initializeKeys.
+ */
+export const globalKeys = KEYS.globalKeys
+
+/**
+ * Replace KEYS contents from a merged RuntimeKeys value while preserving the
+ * exported `globalKeys` object identity.
+ */
+export function applyRuntimeKeys(next: RuntimeKeys): void {
+  const keysRecord = KEYS as unknown as Record<string, unknown>
+  const nextRecord = next as unknown as Record<string, unknown>
+  const nextTop = new Set(
+    Object.keys(nextRecord).filter(key => key !== 'globalKeys')
+  )
+
+  for (const key of Object.keys(keysRecord)) {
+    if (key === 'globalKeys') continue
+    if (!nextTop.has(key)) keysRecord[key] = undefined
+  }
+  for (const key of nextTop) {
+    keysRecord[key] = nextRecord[key]
+  }
+
+  const nextGk = (next.globalKeys ?? {}) as Record<string, unknown>
+  const gkRecord = globalKeys as unknown as Record<string, unknown>
+  for (const key of Object.keys(gkRecord)) {
+    if (!(key in nextGk)) gkRecord[key] = undefined
+  }
+  Object.assign(globalKeys, nextGk)
+  KEYS.globalKeys = globalKeys
+}
diff --git a/src/localOnlyKeys.ts b/src/localOnlyKeys.ts
new file mode 100644
index 00000000000..56176a081d4
--- /dev/null
+++ b/src/localOnlyKeys.ts
@@ -0,0 +1,15 @@
+/**
+ * Secrets that must stay in the on-device `keys.json` and must never be taken
+ * from a remote appKeys overlay. Kept in a React-Native-free module so build
+ * scripts (`slimKeysJson`) and the runtime store share one inventory.
+ */
+export const LOCAL_ONLY_TOP_LEVEL = [
+  'EDGE_API_KEY',
+  'EDGE_API_SECRET',
+  'BUGSNAG_API_KEY',
+  // Telemetry credential read at module scope; the server never serves it and
+  // an overlay must never rotate it. It lives top-level on KEYS.
+  'POSTHOG_API_KEY'
+] as const
+
+export const LOCAL_ONLY_PREFIXES = ['SENTRY_'] as const
diff --git a/src/locales/bootLocale.ts b/src/locales/bootLocale.ts
new file mode 100644
index 00000000000..f1c2cf6a547
--- /dev/null
+++ b/src/locales/bootLocale.ts
@@ -0,0 +1,58 @@
+/**
+ * Node-safe locale boot. Mutates `lstrings` and `intl.locale`.
+ * GUI and CLI inject detection; this file must not import react-native.
+ */
+import { setIntlLocale } from './intl'
+import { selectLocale } from './strings'
+
+export interface LocaleSource {
+  languageTag: string
+  decimalSeparator: string
+  groupingSeparator: string
+}
+
+export interface AppliedLocale extends LocaleSource {
+  matched: boolean
+}
+
+const DEFAULT_LANGUAGE_TAG = 'en-US'
+
+let applied: AppliedLocale = {
+  languageTag: DEFAULT_LANGUAGE_TAG,
+  decimalSeparator: '.',
+  groupingSeparator: ',',
+  matched: true
+}
+
+function isDefaultEnglish(tag: string): boolean {
+  const compact = tag.replace(/[-_]/g, '').toLowerCase()
+  return compact === 'enus' || compact === 'en'
+}
+
+/**
+ * Apply language tables and number format. Call once at process start.
+ */
+export function applyLocale(source: LocaleSource): AppliedLocale {
+  const languageTag =
+    source.languageTag === '' ? DEFAULT_LANGUAGE_TAG : source.languageTag
+  let matched = true
+  if (!isDefaultEnglish(languageTag)) {
+    matched = selectLocale(languageTag)
+  }
+  setIntlLocale({
+    localeIdentifier: languageTag,
+    decimalSeparator: source.decimalSeparator,
+    groupingSeparator: source.groupingSeparator
+  })
+  applied = {
+    languageTag,
+    decimalSeparator: source.decimalSeparator,
+    groupingSeparator: source.groupingSeparator,
+    matched
+  }
+  return applied
+}
+
+export function getAppliedLocale(): AppliedLocale {
+  return applied
+}
diff --git a/src/locales/en_US.ts b/src/locales/en_US.ts
index 54ab6b83562..7dd6bf12552 100644
--- a/src/locales/en_US.ts
+++ b/src/locales/en_US.ts
@@ -1465,6 +1465,8 @@ const strings = {
   price_change_notification: 'Price Notification',
   price_change_buy_sell_trade: 'Would you like to buy, sell, or exchange %1$s?',
   // Update notices
+  plugins_unavailable_message_s:
+    'Some assets and exchanges are unavailable in this session: %s',
   update_notice_deprecate_electrum_servers_title: 'Blockbook Upgrade',
   update_notice_deprecate_electrum_servers_message: `%s no longer uses Electrum Servers. If you would like to continue to use CUSTOM NODES, please input Blockbook compatible addresses.\n\nNOTE: If you had custom nodes enabled, those wallets will not sync until corrected.`,
 
diff --git a/src/locales/initLocale.ts b/src/locales/initLocale.ts
new file mode 100644
index 00000000000..9c5d8c66392
--- /dev/null
+++ b/src/locales/initLocale.ts
@@ -0,0 +1,16 @@
+/**
+ * GUI-only locale boot. Call once at app startup so locales/strings and
+ * locales/intl stay free of react-native-localize module-load side effects.
+ */
+import { getLocales, getNumberFormatSettings } from 'react-native-localize'
+
+import { applyLocale } from './bootLocale'
+
+const [firstLocale = { languageTag: 'en-US' }] = getLocales()
+const { languageTag = 'en-US' } = firstLocale
+const numberFormat = getNumberFormatSettings()
+applyLocale({
+  languageTag,
+  decimalSeparator: numberFormat.decimalSeparator,
+  groupingSeparator: numberFormat.groupingSeparator
+})
diff --git a/src/locales/intl.ts b/src/locales/intl.ts
index 4056a1f3e19..abf57700781 100644
--- a/src/locales/intl.ts
+++ b/src/locales/intl.ts
@@ -1,7 +1,6 @@
 import { gt, mul, toBns, toFixed } from 'biggystring'
 import { asMaybe } from 'cleaners'
 import { format } from 'date-fns'
-import { getLocales, getNumberFormatSettings } from 'react-native-localize'
 import { sprintf } from 'sprintf-js'
 
 import { asBiggystring } from '../util/cleaners'
@@ -36,11 +35,6 @@ const NATIVE_DECIMAL_SEPARATOR = '.'
 const NUMBER_GROUP_SIZE = 3
 export const locale: IntlLocaleType = { ...EN_US_LOCALE }
 
-// Set the locale at boot:
-const [firstLocale = { languageTag: 'en_US' }] = getLocales()
-const numberFormat = getNumberFormatSettings()
-setIntlLocale({ localeIdentifier: firstLocale.languageTag, ...numberFormat })
-
 /**
  * Formats number input according to user locale
  * Allows decimalSeparator at the end of string
@@ -402,8 +396,7 @@ export const pickLanguage = (
 export const getLocaleOrDefaultString = (
   localizedStrings: Record<string, string>
 ): string | undefined => {
-  const [firstLocale = { languageTag: DEFAULT_LOCALE_ID }] = getLocales()
-  const { languageTag } = firstLocale
+  const languageTag = locale.localeIdentifier
   const localizedStringKeys = Object.keys(localizedStrings)
 
   let localeId = pickLanguage(languageTag, localizedStringKeys)
diff --git a/src/locales/nodeLocale.ts b/src/locales/nodeLocale.ts
new file mode 100644
index 00000000000..64ac943996e
--- /dev/null
+++ b/src/locales/nodeLocale.ts
@@ -0,0 +1,123 @@
+/**
+ * CLI locale detection. No react-native.
+ */
+import type { LocaleSource } from './bootLocale'
+
+/**
+ * The environment variables this reads, and nothing else.
+ *
+ * `process.env` satisfies it, but so does `{ LANG: 'es_MX.UTF-8' }`. Typing
+ * this as `NodeJS.ProcessEnv` demanded `NODE_ENV` from every caller, which no
+ * locale test has any reason to set.
+ */
+export type LocaleEnv = Readonly<Record<string, string | undefined>>
+
+export interface DetectNodeLocaleOpts {
+  argv?: string[]
+  env?: LocaleEnv
+  configLocale?: string
+}
+
+/**
+ * POSIX / BCP-47 tag → hyphenated language tag for Intl and selectLocale.
+ * `es_MX.UTF-8@euro` → `es-MX`; `C` / `POSIX` / empty → `en-US`.
+ */
+export function normalizePosixLocale(raw: string): string {
+  const trimmed = raw.trim()
+  if (trimmed === '' || trimmed === 'C' || trimmed === 'POSIX') return 'en-US'
+  const noModifier = trimmed.split('@')[0] ?? trimmed
+  const noEncoding = noModifier.split('.')[0] ?? noModifier
+  const hyphenated = noEncoding.replace(/_/g, '-')
+  return hyphenated === '' ? 'en-US' : hyphenated
+}
+
+export function parseLocaleFlag(argv: string[]): string | undefined {
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i]
+    if (a === '--locale') {
+      const next = argv[i + 1]
+      if (next == null || next.startsWith('-')) return undefined
+      return next
+    }
+    if (a.startsWith('--locale=')) {
+      const value = a.slice('--locale='.length)
+      return value === '' ? undefined : value
+    }
+  }
+  return undefined
+}
+
+export function parseConfigPathFlag(argv: string[]): string | undefined {
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i]
+    if (a === '-c' || a === '--config') {
+      const next = argv[i + 1]
+      if (next == null || next.startsWith('-')) return undefined
+      return next
+    }
+    if (a.startsWith('--config=')) {
+      const value = a.slice('--config='.length)
+      return value === '' ? undefined : value
+    }
+  }
+  return undefined
+}
+
+function nonempty(value: string | undefined): string | undefined {
+  if (value == null) return undefined
+  const trimmed = value.trim()
+  return trimmed === '' ? undefined : trimmed
+}
+
+function posixLanguageTag(env: LocaleEnv): string | undefined {
+  return nonempty(env.LC_ALL) ?? nonempty(env.LC_MESSAGES) ?? nonempty(env.LANG)
+}
+
+export function numberSeparators(languageTag: string): {
+  decimalSeparator: string
+  groupingSeparator: string
+} {
+  try {
+    const parts = new Intl.NumberFormat(languageTag, {
+      useGrouping: true
+    }).formatToParts(1234567.89)
+    const decimal = parts.find(part => part.type === 'decimal')?.value ?? '.'
+    const grouping = parts.find(part => part.type === 'group')?.value ?? ','
+    if (decimal === '' || grouping === '') {
+      return { decimalSeparator: '.', groupingSeparator: ',' }
+    }
+    return { decimalSeparator: decimal, groupingSeparator: grouping }
+  } catch {
+    return { decimalSeparator: '.', groupingSeparator: ',' }
+  }
+}
+
+/**
+ * Precedence: --locale, config locale, EDGE_CLI_LOCALE, LC_ALL / LC_MESSAGES /
+ * LANG, Intl, en-US. One tag drives language and number format.
+ */
+export function detectNodeLocale(
+  opts: DetectNodeLocaleOpts = {}
+): LocaleSource {
+  const env = opts.env ?? process.env
+  const argv = opts.argv ?? []
+  const raw =
+    nonempty(parseLocaleFlag(argv)) ??
+    nonempty(opts.configLocale) ??
+    nonempty(env.EDGE_CLI_LOCALE) ??
+    posixLanguageTag(env) ??
+    nonempty(Intl.DateTimeFormat().resolvedOptions().locale) ??
+    'en-US'
+  const languageTag = normalizePosixLocale(raw)
+  return {
+    languageTag,
+    ...numberSeparators(languageTag)
+  }
+}
+
+export function localeTagsMatch(a: string, b: string): boolean {
+  return (
+    a.replace(/[-_]/g, '').toLowerCase() ===
+    b.replace(/[-_]/g, '').toLowerCase()
+  )
+}
diff --git a/src/locales/strings.ts b/src/locales/strings.ts
index a743f741101..cdbe4cd1094 100644
--- a/src/locales/strings.ts
+++ b/src/locales/strings.ts
@@ -1,5 +1,3 @@
-import { getLocales } from 'react-native-localize'
-
 import en from './en_US'
 import de from './strings/de.json'
 import es from './strings/es.json'
@@ -20,11 +18,6 @@ export type LStrings = typeof lstrings
 export type LStringsKey = keyof LStrings
 export type LStringsValues = LStrings[LStringsKey]
 
-// Set the language at boot:
-const [firstLocale] = getLocales()
-const { languageTag = 'en-US' } = firstLocale ?? {}
-if (languageTag !== 'en-US') selectLocale(languageTag)
-
 function mergeStrings(
   primary: Record<string, string>,
   secondary: Record<string, string>
diff --git a/src/locales/strings/enUS.json b/src/locales/strings/enUS.json
index 2f05699d6e4..3d6cb74b1ac 100644
--- a/src/locales/strings/enUS.json
+++ b/src/locales/strings/enUS.json
@@ -1151,6 +1151,7 @@
   "notification_daily_price_change_down": "%1$s %2$s (%3$s) is down %4$s to %5$s in the last 24 hours.",
   "price_change_notification": "Price Notification",
   "price_change_buy_sell_trade": "Would you like to buy, sell, or exchange %1$s?",
+  "plugins_unavailable_message_s": "Some assets and exchanges are unavailable in this session: %s",
   "update_notice_deprecate_electrum_servers_title": "Blockbook Upgrade",
   "update_notice_deprecate_electrum_servers_message": "%s no longer uses Electrum Servers. If you would like to continue to use CUSTOM NODES, please input Blockbook compatible addresses.\n\nNOTE: If you had custom nodes enabled, those wallets will not sync until corrected.",
   "error_boundary_title": "Oops!",
diff --git a/src/pluginMaps.ts b/src/pluginMaps.ts
new file mode 100644
index 00000000000..8e838da5c9e
--- /dev/null
+++ b/src/pluginMaps.ts
@@ -0,0 +1,18 @@
+import { CONFIG } from './config'
+import { type PluginMaps, resolvePluginMaps } from './configKeysMerge'
+import { KEYS } from './keys'
+
+/**
+ * Resolved plugin init maps (config enablement flags merged with keys secrets).
+ * Rebuilt in place whenever remote/cache keys are applied.
+ */
+export const pluginMaps: PluginMaps = resolvePluginMaps(CONFIG, KEYS)
+
+/** Rebuild `pluginMaps` from the current CONFIG + KEYS (mutates in place). */
+export function rebuildPluginMaps(): void {
+  const next = resolvePluginMaps(CONFIG, KEYS)
+  pluginMaps.corePlugins = next.corePlugins
+  pluginMaps.swapPlugins = next.swapPlugins
+  pluginMaps.guiApiKeys = next.guiApiKeys
+  pluginMaps.rampPlugins = next.rampPlugins
+}
diff --git a/src/plugins/gui/providers/kadoOtcProvider.ts b/src/plugins/gui/providers/kadoOtcProvider.ts
index f4fd1c12a74..ff8460a7196 100644
--- a/src/plugins/gui/providers/kadoOtcProvider.ts
+++ b/src/plugins/gui/providers/kadoOtcProvider.ts
@@ -10,7 +10,7 @@ import {
 } from 'cleaners'
 import URL from 'url-parse'
 
-import { ENV } from '../../../env'
+import { CONFIG } from '../../../config'
 import { lstrings } from '../../../locales/strings'
 import type { FiatDirection, FiatPaymentType } from '../fiatPluginTypes'
 import {
@@ -48,7 +48,7 @@ const urls = {
   }
 }
 
-const MODE = ENV.ENABLE_FIAT_SANDBOX ? 'test' : 'prod'
+const MODE = CONFIG.ENABLE_FIAT_SANDBOX ? 'test' : 'prod'
 
 // https://api.kado.money/v1/ramp/blockchains
 
diff --git a/src/plugins/gui/providers/kadoProvider.ts b/src/plugins/gui/providers/kadoProvider.ts
index 538c477fc8c..1d217f29a3c 100644
--- a/src/plugins/gui/providers/kadoProvider.ts
+++ b/src/plugins/gui/providers/kadoProvider.ts
@@ -19,7 +19,7 @@ import URL from 'url-parse'
 
 import type { SendScene2Params } from '../../../components/scenes/SendScene2'
 import { showError } from '../../../components/services/AirshipInstance'
-import { ENV } from '../../../env'
+import { CONFIG } from '../../../config'
 import { lstrings } from '../../../locales/strings'
 import { getExchangeDenom } from '../../../selectors/DenominationSelectors'
 import { CryptoAmount } from '../../../util/CryptoAmount'
@@ -60,7 +60,7 @@ const urls = {
   }
 }
 
-const MODE = ENV.ENABLE_FIAT_SANDBOX ? 'test' : 'prod'
+const MODE = CONFIG.ENABLE_FIAT_SANDBOX ? 'test' : 'prod'
 
 // https://api.kado.money/v1/ramp/blockchains
 
diff --git a/src/plugins/gui/providers/mtpelerinProvider.ts b/src/plugins/gui/providers/mtpelerinProvider.ts
index 907f5276630..9e093ab6483 100644
--- a/src/plugins/gui/providers/mtpelerinProvider.ts
+++ b/src/plugins/gui/providers/mtpelerinProvider.ts
@@ -16,7 +16,7 @@ import { toUtf8Bytes } from 'ethers/lib/utils'
 
 import type { SendScene2Params } from '../../../components/scenes/SendScene2'
 import { showError } from '../../../components/services/AirshipInstance'
-import { ENV } from '../../../env'
+import { CONFIG } from '../../../config'
 import { getExchangeDenom } from '../../../selectors/DenominationSelectors'
 import { CryptoAmount } from '../../../util/CryptoAmount'
 import { hexToDecimal, removeIsoPrefix } from '../../../util/utils'
@@ -58,7 +58,7 @@ const urls = {
   }
 }
 
-const MODE = ENV.ENABLE_FIAT_SANDBOX ? 'test' : 'prod'
+const MODE = CONFIG.ENABLE_FIAT_SANDBOX ? 'test' : 'prod'
 
 const PLUGIN_TO_CHAIN_ID_MAP: Record<string, string> = {
   arbitrum: 'arbitrum_mainnet',
@@ -581,7 +581,7 @@ export const mtpelerinProvider: FiatProviderFactory = {
                       .then(address => {
                         sendResponse('onaddresses', [address], injectJs)
                       })
-                      .catch(e => {
+                      .catch((e: unknown) => {
                         throw e
                       })
                     break
diff --git a/src/plugins/gui/providers/paybisProvider.ts b/src/plugins/gui/providers/paybisProvider.ts
index 47aac9f80b8..4420806a486 100644
--- a/src/plugins/gui/providers/paybisProvider.ts
+++ b/src/plugins/gui/providers/paybisProvider.ts
@@ -92,7 +92,11 @@ const allowedPaymentTypes: AllowedPaymentTypes = {
 
 const asApiKeys = asObject({
   apiKey: asString,
-  partnerUrl: asString,
+  // Defaulted here because the config/keys split retired the per-provider
+  // cleaners in `configKeysSchema.ts`, and this was the one field whose default those
+  // cleaners supplied that no consumer replaces. A config omitting it used to
+  // work; without this the provider would fail to initialize.
+  partnerUrl: asOptional(asString, 'https://widget-api.paybis.com'),
   privateKeyB64: asString
 })
 
diff --git a/src/plugins/gui/util/fetchRevolut.ts b/src/plugins/gui/util/fetchRevolut.ts
index 70e55dd9a51..0b7452fbc03 100644
--- a/src/plugins/gui/util/fetchRevolut.ts
+++ b/src/plugins/gui/util/fetchRevolut.ts
@@ -7,14 +7,20 @@ import {
   asValue
 } from 'cleaners'
 
-import { ENV } from '../../../env'
+import { pluginMaps } from '../../../pluginMaps'
 
 const baseUrl = 'https://ramp-partners.revolut.com'
 // const baseUrl = 'https://ramp-partners.revolut.codes' // For testing
 
-async function fetchRevolut(endpoint: string, init?: RequestInit) {
-  const apiKey = ENV.PLUGIN_API_KEYS.revolut?.apiKey
-  if (!apiKey) {
+async function fetchRevolut(
+  endpoint: string,
+  init?: RequestInit
+): Promise<unknown> {
+  const revolut = pluginMaps.guiApiKeys.revolut as
+    | { apiKey?: string }
+    | undefined
+  const apiKey = revolut?.apiKey
+  if (apiKey == null || apiKey === '') {
     throw new Error('No Revolut API key found')
   }
   const url = `${baseUrl}${endpoint}`
@@ -128,10 +134,10 @@ export async function fetchRevolutQuote(
   urlParams.set('crypto', params.crypto)
   urlParams.set('payment', params.payment)
   urlParams.set('region', params.region)
-  if (params.feePercentage) {
+  if (params.feePercentage != null && params.feePercentage !== 0) {
     urlParams.set('feePercentage', params.feePercentage.toString())
   }
-  if (params.walletAddress) {
+  if (params.walletAddress != null && params.walletAddress !== '') {
     urlParams.set('walletAddress', params.walletAddress)
   }
   const data = await fetchRevolut(
diff --git a/src/plugins/gui/util/initializeProviders.ts b/src/plugins/gui/util/initializeProviders.ts
index 6b9eec0a465..d1b5d74fb6f 100644
--- a/src/plugins/gui/util/initializeProviders.ts
+++ b/src/plugins/gui/util/initializeProviders.ts
@@ -1,4 +1,4 @@
-import { ENV } from '../../../env'
+import { pluginMaps } from '../../../pluginMaps'
 import {
   findTokenIdByNetworkLocation,
   getTokenId
@@ -19,12 +19,15 @@ export async function initializeProviders<T>(
   const { account, deviceId, disablePlugins } = params
   const providerPromises: Array<Promise<FiatProvider<T>>> = []
 
-  const getTokenIdProvider = (pluginId: string, currencyCode: string) =>
+  const getTokenIdProvider = (
+    pluginId: string,
+    currencyCode: string
+  ): ReturnType<typeof getTokenId> =>
     getTokenId(account.currencyConfig[pluginId], currencyCode)
   const getTokenIdFromContract = (params: {
     pluginId: string
     contractAddress: string
-  }) => {
+  }): ReturnType<typeof findTokenIdByNetworkLocation> => {
     const { pluginId, contractAddress } = params
     return findTokenIdByNetworkLocation({
       account,
@@ -36,11 +39,17 @@ export async function initializeProviders<T>(
   for (const providerFactory of providerFactories) {
     if (disablePlugins[providerFactory.providerId]) continue
 
-    const apiKeys =
-      ENV.PLUGIN_API_KEYS[
-        providerFactory.providerId as keyof typeof ENV.PLUGIN_API_KEYS
-      ]
-    if (apiKeys == null) continue
+    const apiKeys = pluginMaps.guiApiKeys[providerFactory.providerId]
+    // A bare boolean means "enabled in config.json, but no credentials on the
+    // keys side yet" — the shipped state whenever slimKeysJson has stripped
+    // the plugin maps and the signed appKeys fetch has not landed. Passing it
+    // through reaches the provider's `asApiKeys` cleaner and throws.
+    //
+    // Only the boolean sentinels are rejected: a provider's apiKeys may
+    // legitimately be a bare string (moonpay and Bitrefill both are, and
+    // moonpayProvider's `asApiKeys` is `asString`), so a `typeof !== 'object'`
+    // test would silently drop them from the quote list.
+    if (apiKeys == null || typeof apiKeys === 'boolean') continue
 
     const store = createStore(providerFactory.storeId, account.dataStore)
     providerPromises.push(
@@ -54,5 +63,13 @@ export async function initializeProviders<T>(
     )
   }
 
-  return await Promise.all(providerPromises)
+  // One provider with a malformed key entry must not take down the whole
+  // buy/sell scene, so failures are dropped rather than rejecting the batch.
+  const results = await Promise.allSettled(providerPromises)
+  const providers: Array<FiatProvider<T>> = []
+  for (const result of results) {
+    if (result.status === 'fulfilled') providers.push(result.value)
+    else console.warn('initializeProviders: provider failed', result.reason)
+  }
+  return providers
 }
diff --git a/src/plugins/ramps/infinite/infiniteApi.ts b/src/plugins/ramps/infinite/infiniteApi.ts
index 3e53d9d4fb1..0df164355d3 100644
--- a/src/plugins/ramps/infinite/infiniteApi.ts
+++ b/src/plugins/ramps/infinite/infiniteApi.ts
@@ -3,7 +3,7 @@ import { keccak_256 as keccak256 } from '@noble/hashes/sha3'
 import { asMaybe } from 'cleaners'
 import { base16 } from 'rfc4648'
 
-import { ENV } from '../../../env'
+import { CONFIG } from '../../../config'
 import {
   asInfiniteAuthResponse,
   asInfiniteBankAccountResponse,
@@ -132,7 +132,7 @@ export const makeInfiniteApi = (config: InfiniteApiConfig): InfiniteApi => {
             .join('')
         : ''
 
-    if (ENV.DEBUG_VERBOSE_LOGGING) {
+    if (CONFIG.DEBUG_VERBOSE_LOGGING) {
       console.log(
         `curl -X ${init?.method ?? 'GET'}${headersStr} '${urlStr}'${
           init?.body != null ? ` -d ${JSON.stringify(init?.body)}` : ''
diff --git a/src/plugins/stake-plugins/generic/pluginInfo/cardanoKilnPool.ts b/src/plugins/stake-plugins/generic/pluginInfo/cardanoKilnPool.ts
index acf39c49299..1b384236f36 100644
--- a/src/plugins/stake-plugins/generic/pluginInfo/cardanoKilnPool.ts
+++ b/src/plugins/stake-plugins/generic/pluginInfo/cardanoKilnPool.ts
@@ -1,7 +1,11 @@
-import { ENV } from '../../../../env'
+import { globalKeys } from '../../../../keys'
 import type { CardanoPooledKilnAdapterConfig } from '../policyAdapters/CardanoKilnAdaptor'
 import type { StakePluginInfo, StakePolicyConfig } from '../types'
 
+// Secrets are exposed as getters, not values. This module is evaluated during
+// the initial bundle load, which is strictly before the keys store finishes
+// resolving remote secrets into `globalKeys`, so an eager read would pin the baked-in
+// fallback and silently defeat server-side rotation.
 const kilnPolicyConfig: Array<
   StakePolicyConfig<CardanoPooledKilnAdapterConfig>
 > = [
@@ -18,8 +22,12 @@ const kilnPolicyConfig: Array<
       type: 'cardano-pooled-kiln',
       pluginId: 'cardano',
 
-      accountId: ENV.KILN_MAINNET_ACCOUNT_ID,
-      apiKey: ENV.KILN_MAINNET_API_KEY,
+      get accountId() {
+        return globalKeys.KILN_MAINNET_ACCOUNT_ID
+      },
+      get apiKey() {
+        return globalKeys.KILN_MAINNET_API_KEY
+      },
       baseUrl: 'https://api.kiln.fi',
       poolId: 'pool10rdglgh4pzvkf936p2m669qzarr9dusrhmmz9nultm3uvq4eh5k'
     },
@@ -41,8 +49,12 @@ const kilnPolicyConfig: Array<
       type: 'cardano-pooled-kiln',
       pluginId: 'cardano',
 
-      accountId: ENV.KILN_MAINNET_ACCOUNT_ID,
-      apiKey: ENV.KILN_MAINNET_API_KEY,
+      get accountId() {
+        return globalKeys.KILN_MAINNET_ACCOUNT_ID
+      },
+      get apiKey() {
+        return globalKeys.KILN_MAINNET_API_KEY
+      },
       baseUrl: 'https://api.kiln.fi',
       poolId: 'pool1fcp4d2pxh0e7q5ju63sjqcdpxpr3pvxg6ykl23t6c97d7dnvjvw'
     },
@@ -64,8 +76,12 @@ const kilnPolicyConfig: Array<
       type: 'cardano-pooled-kiln',
       pluginId: 'cardano',
 
-      accountId: ENV.KILN_MAINNET_ACCOUNT_ID,
-      apiKey: ENV.KILN_MAINNET_API_KEY,
+      get accountId() {
+        return globalKeys.KILN_MAINNET_ACCOUNT_ID
+      },
+      get apiKey() {
+        return globalKeys.KILN_MAINNET_API_KEY
+      },
       baseUrl: 'https://api.kiln.fi',
       poolId: 'pool1v62c7d92xv6gyh4x9rhfpkwzlpw2ypxk92xvzavakg3xypatklv'
     },
@@ -87,8 +103,12 @@ const kilnPolicyConfig: Array<
       type: 'cardano-pooled-kiln',
       pluginId: 'cardano',
 
-      accountId: ENV.KILN_MAINNET_ACCOUNT_ID,
-      apiKey: ENV.KILN_MAINNET_API_KEY,
+      get accountId() {
+        return globalKeys.KILN_MAINNET_ACCOUNT_ID
+      },
+      get apiKey() {
+        return globalKeys.KILN_MAINNET_API_KEY
+      },
       baseUrl: 'https://api.kiln.fi',
       poolId: 'pool1mtxmk0skqkr5y0wxnxps4n35j6wn9q8dfr82y423vvlp53vccux'
     },
@@ -110,8 +130,12 @@ const kilnPolicyConfig: Array<
       type: 'cardano-pooled-kiln',
       pluginId: 'cardano',
 
-      accountId: ENV.KILN_MAINNET_ACCOUNT_ID,
-      apiKey: ENV.KILN_MAINNET_API_KEY,
+      get accountId() {
+        return globalKeys.KILN_MAINNET_ACCOUNT_ID
+      },
+      get apiKey() {
+        return globalKeys.KILN_MAINNET_API_KEY
+      },
       baseUrl: 'https://api.kiln.fi',
       poolId: 'pool10d6mmw3mn9ku3r7uqqye672dz3sv76lh5kvh5rdpr9l5ug5yknr'
     },
@@ -133,8 +157,12 @@ const kilnPolicyConfig: Array<
       type: 'cardano-pooled-kiln',
       pluginId: 'cardano',
 
-      accountId: ENV.KILN_MAINNET_ACCOUNT_ID,
-      apiKey: ENV.KILN_MAINNET_API_KEY,
+      get accountId() {
+        return globalKeys.KILN_MAINNET_ACCOUNT_ID
+      },
+      get apiKey() {
+        return globalKeys.KILN_MAINNET_API_KEY
+      },
       baseUrl: 'https://api.kiln.fi',
       poolId: 'pool1mtuhuh8hkf8am0qzx45y58kll8q83sjh6pwljrflcmw970d82f3'
     },
@@ -156,8 +184,12 @@ const kilnPolicyConfig: Array<
       type: 'cardano-pooled-kiln',
       pluginId: 'cardano',
 
-      accountId: ENV.KILN_MAINNET_ACCOUNT_ID,
-      apiKey: ENV.KILN_MAINNET_API_KEY,
+      get accountId() {
+        return globalKeys.KILN_MAINNET_ACCOUNT_ID
+      },
+      get apiKey() {
+        return globalKeys.KILN_MAINNET_API_KEY
+      },
       baseUrl: 'https://api.kiln.fi',
       poolId: 'pool1aqg8vxzv75zhjzjjd9s20fu6r0xz70yl8lk3teacwy7qyc2p2j7'
     },
@@ -179,8 +211,12 @@ const kilnPolicyConfig: Array<
       type: 'cardano-pooled-kiln',
       pluginId: 'cardano',
 
-      accountId: ENV.KILN_MAINNET_ACCOUNT_ID,
-      apiKey: ENV.KILN_MAINNET_API_KEY,
+      get accountId() {
+        return globalKeys.KILN_MAINNET_ACCOUNT_ID
+      },
+      get apiKey() {
+        return globalKeys.KILN_MAINNET_API_KEY
+      },
       baseUrl: 'https://api.kiln.fi',
       poolId: 'pool19kfm6lz5uw7nylq27swr367mqdycmug7tve94l6h3xsz64seqtc'
     },
diff --git a/src/plugins/stake-plugins/generic/pluginInfo/ethereumKilnPool.ts b/src/plugins/stake-plugins/generic/pluginInfo/ethereumKilnPool.ts
index 9e3bd675d16..455ada063f0 100644
--- a/src/plugins/stake-plugins/generic/pluginInfo/ethereumKilnPool.ts
+++ b/src/plugins/stake-plugins/generic/pluginInfo/ethereumKilnPool.ts
@@ -1,7 +1,11 @@
-import { ENV } from '../../../../env'
+import { globalKeys } from '../../../../keys'
 import type { EthereumPooledKilnAdapterConfig } from '../policyAdapters/EthereumKilnAdaptor'
 import type { StakePluginInfo, StakePolicyConfig } from '../types'
 
+// Secrets are exposed as getters, not values. This module is evaluated during
+// the initial bundle load, which is strictly before the keys store finishes
+// resolving remote secrets into `globalKeys`, so an eager read would pin the baked-in
+// fallback and silently defeat server-side rotation.
 const kilnPolicyConfig: Array<
   StakePolicyConfig<EthereumPooledKilnAdapterConfig>
 > = [
@@ -17,7 +21,9 @@ const kilnPolicyConfig: Array<
     adapterConfig: {
       exitQueueAddress: '0x8979117a69DfA7F4D4E3c7B59197ff03f4A2CeAF',
       type: 'ethereum-pooled-kiln',
-      apiKey: ENV.KILN_TESTNET_API_KEY,
+      get apiKey() {
+        return globalKeys.KILN_TESTNET_API_KEY
+      },
       baseUrl: 'https://api.testnet.kiln.fi',
       contractAddress: '0xb9b3b83daaaadd3866de311ffefec80dbcb048b1',
       pluginId: 'holesky',
@@ -43,7 +49,9 @@ const kilnPolicyConfig: Array<
     adapterConfig: {
       exitQueueAddress: '0x8d6Fd650500f82c7D978a440348e5a9b886943bF',
       type: 'ethereum-pooled-kiln',
-      apiKey: ENV.KILN_MAINNET_API_KEY,
+      get apiKey() {
+        return globalKeys.KILN_MAINNET_API_KEY
+      },
       baseUrl: 'https://api.kiln.fi',
       contractAddress: '0xEb4d67DBa18b3bE04484dFC7B7c2780E8D32A79d',
       pluginId: 'ethereum',
diff --git a/src/plugins/stake-plugins/generic/pluginInfo/thorchainYield.ts b/src/plugins/stake-plugins/generic/pluginInfo/thorchainYield.ts
index 1071d7306aa..09223134d45 100644
--- a/src/plugins/stake-plugins/generic/pluginInfo/thorchainYield.ts
+++ b/src/plugins/stake-plugins/generic/pluginInfo/thorchainYield.ts
@@ -1,7 +1,18 @@
-import { ENV } from '../../../../env'
+import { pluginMaps } from '../../../../pluginMaps'
 import type { ThorchainYieldAdapterConfig } from '../policyAdapters/ThorchainYieldAdaptor'
 import type { StakePluginInfo, StakePolicyConfig } from '../types'
 
+/**
+ * Read as a getter, not a value. This module is evaluated during the initial
+ * bundle load, which is strictly before the keys store finishes resolving
+ * remote secrets into `pluginMaps`, so an eager read would pin the baked-in fallback.
+ */
+const getNinerealmsClientId = (): string | undefined => {
+  const thorchain = pluginMaps.swapPlugins.thorchain
+  if (typeof thorchain !== 'object' || thorchain == null) return undefined
+  return (thorchain as { ninerealmsClientId?: string }).ninerealmsClientId
+}
+
 const thorchainYieldPolicyConfig: Array<
   StakePolicyConfig<ThorchainYieldAdapterConfig>
 > = [
@@ -17,10 +28,9 @@ const thorchainYieldPolicyConfig: Array<
     adapterConfig: {
       type: 'thorchain-yield',
       pluginId: 'thorchainrune',
-      ninerealmsClientId:
-        ENV.THORCHAIN_INIT !== false
-          ? ENV.THORCHAIN_INIT.ninerealmsClientId
-          : undefined,
+      get ninerealmsClientId() {
+        return getNinerealmsClientId()
+      },
       thornodeServers: ['https://gateway.liquify.com/chain/thorchain_api']
     },
 
diff --git a/src/plugins/stake-plugins/generic/util/stakeKitUtils.ts b/src/plugins/stake-plugins/generic/util/stakeKitUtils.ts
index 6393950cd1e..5b96a9c0b19 100644
--- a/src/plugins/stake-plugins/generic/util/stakeKitUtils.ts
+++ b/src/plugins/stake-plugins/generic/util/stakeKitUtils.ts
@@ -12,15 +12,19 @@ import type {
 import { asMaybe, asNumber, asObject, asString, asValue } from 'cleaners'
 import { InsufficientFundsError } from 'edge-core-js'
 
-import { ENV } from '../../../../env'
+import { globalKeys } from '../../../../keys'
 import { lstrings } from '../../../../locales/strings'
 import { HumanFriendlyError } from '../../../../types/HumanFriendlyError'
 
 const baseUrl = 'https://api.stakek.it'
-const headers = {
+
+// Built per request rather than once at module scope: the keys store resolves
+// remote secrets asynchronously and mutates `globalKeys` in place, so anything read
+// while this module is first evaluated is the baked-in fallback forever.
+const makeHeaders = (): Record<string, string> => ({
   'Content-Type': 'application/json',
-  'X-API-KEY': ENV.STAKEKIT_API_KEY ?? ''
-}
+  'X-API-KEY': globalKeys.STAKEKIT_API_KEY ?? ''
+})
 
 const fetchPatch = async <Body, Res>(
   path: string,
@@ -28,7 +32,7 @@ const fetchPatch = async <Body, Res>(
 ): Promise<Res> => {
   const response = await fetch(baseUrl + path, {
     method: 'PATCH',
-    headers,
+    headers: makeHeaders(),
     body: JSON.stringify(body)
   })
   const out = await response.json()
@@ -38,7 +42,7 @@ const fetchPatch = async <Body, Res>(
 const fetchPost = async <Body, Res>(path: string, body: Body): Promise<Res> => {
   const response = await fetch(baseUrl + path, {
     method: 'POST',
-    headers,
+    headers: makeHeaders(),
     body: JSON.stringify(body)
   })
   const out = await response.json()
@@ -107,7 +111,7 @@ export const transactionSubmitHash = async (
 ): Promise<void> => {
   await fetch(baseUrl + `/v1/transactions/${transactionId}/submit_hash`, {
     method: 'POST',
-    headers,
+    headers: makeHeaders(),
     body: JSON.stringify(submitHashRequestDto)
   })
 }
diff --git a/src/plugins/stake-plugins/stakePlugins.ts b/src/plugins/stake-plugins/stakePlugins.ts
index 24d85fe9155..e81e45c52cc 100644
--- a/src/plugins/stake-plugins/stakePlugins.ts
+++ b/src/plugins/stake-plugins/stakePlugins.ts
@@ -1,4 +1,6 @@
-import { ENV } from '../../env'
+import type { JsonObject } from 'edge-core-js'
+
+import { pluginMaps } from '../../pluginMaps'
 import { makeTronStakePlugin } from './currency/tronStakePlugin'
 import { makeGenericStakePlugin } from './generic/GenericStakePlugin'
 import { genericPlugins } from './generic/pluginInfo'
@@ -16,30 +18,35 @@ export const getStakePlugins = async (
   let loadedPlugins = loadedPluginsMap.get(pluginId)
   if (loadedPlugins != null) return loadedPlugins
 
-  const tcInitOptions =
-    typeof ENV.THORCHAIN_INIT === 'object' ? ENV.THORCHAIN_INIT : {}
+  const thorchainInit = pluginMaps.swapPlugins.thorchain
+  const tcInitOptions: JsonObject =
+    typeof thorchainInit === 'object' && thorchainInit != null
+      ? (thorchainInit as JsonObject)
+      : {}
 
   const promises = [
-    makeUniV2StakePlugin(pluginId).catch(e => {
-      console.warn(e.message)
-    }),
-    makeTcSaversPlugin(pluginId, { initOptions: tcInitOptions }).catch(e => {
-      console.warn(e.message)
+    makeUniV2StakePlugin(pluginId).catch((e: unknown) => {
+      console.warn(e instanceof Error ? e.message : String(e))
     }),
+    makeTcSaversPlugin(pluginId, { initOptions: tcInitOptions }).catch(
+      (e: unknown) => {
+        console.warn(e instanceof Error ? e.message : String(e))
+      }
+    ),
     makeTcSaversPluginSegwit(pluginId, { initOptions: tcInitOptions }).catch(
-      e => {
-        console.warn(e.message)
+      (e: unknown) => {
+        console.warn(e instanceof Error ? e.message : String(e))
       }
     ),
-    makeTronStakePlugin(pluginId).catch(e => {
-      console.warn(e.message)
+    makeTronStakePlugin(pluginId).catch((e: unknown) => {
+      console.warn(e instanceof Error ? e.message : String(e))
     }),
     ...genericPlugins.map(async genericPlugin => {
       for (const config of genericPlugin.policyConfigs) {
         if (config.parentPluginId === pluginId) {
           return await makeGenericStakePlugin(
             genericPlugin
-          )(/* INIT OPTIONS */).catch(e => {
+          )(/* INIT OPTIONS */).catch((e: unknown) => {
             console.error(String(e))
           })
         }
diff --git a/src/plugins/stake-plugins/uniswapV2/Ecosystem.ts b/src/plugins/stake-plugins/uniswapV2/Ecosystem.ts
index 52d6866a316..f6d8b475e1b 100644
--- a/src/plugins/stake-plugins/uniswapV2/Ecosystem.ts
+++ b/src/plugins/stake-plugins/uniswapV2/Ecosystem.ts
@@ -6,13 +6,38 @@ interface ContractInfo {
   address: string
 }
 
+export interface Ecosystem {
+  getContractInfo: (key: string) => ContractInfo
+  makeContract: (key: string) => ethers.Contract
+  multipass: (
+    fn: (provider: ethers.providers.BaseProvider) => Promise<any>
+  ) => Promise<any>
+  makeSigner: (
+    seed: string,
+    provider?: ethers.providers.BaseProvider
+  ) => ethers.Wallet
+}
+
 export const makeEcosystem = (
   contractInfoMap: ContractInfoMap,
-  rpcProviderUrls: string[]
-) => {
-  const providers = rpcProviderUrls.map(
-    url => new ethers.providers.JsonRpcProvider(url)
-  )
+  // A thunk defers reading URLs that embed API keys. Those keys can arrive from
+  // the info server after this module is evaluated, so an eager read would pin
+  // the baked-in fallback (see `src/util/keysStore.ts`).
+  rpcProviderUrls: string[] | (() => string[])
+): Ecosystem => {
+  let cachedProviders: ethers.providers.JsonRpcProvider[] | undefined
+  const getProviders = (): ethers.providers.JsonRpcProvider[] => {
+    if (cachedProviders == null) {
+      const urls =
+        typeof rpcProviderUrls === 'function'
+          ? rpcProviderUrls()
+          : rpcProviderUrls
+      cachedProviders = urls.map(
+        url => new ethers.providers.JsonRpcProvider(url)
+      )
+    }
+    return cachedProviders
+  }
 
   const getContractInfo = (key: string): ContractInfo => {
     const contractInfo = contractInfoMap[key]
@@ -21,20 +46,21 @@ export const makeEcosystem = (
     return contractInfo
   }
 
-  const makeContract = (key: string) => {
+  const makeContract = (key: string): ethers.Contract => {
     const contractInfo = getContractInfo(key)
     const { abi, address } = contractInfo
-    return new ethers.Contract(address, abi, providers[0])
+    return new ethers.Contract(address, abi, getProviders()[0])
   }
 
   let lastServerIndex = 0
   const multipass = async (
     fn: (provider: ethers.providers.BaseProvider) => Promise<any>
-  ) => {
+  ): Promise<any> => {
+    const providers = getProviders()
     const provider = providers[lastServerIndex % providers.length]
     try {
       return await fn(provider)
-    } catch (error: any) {
+    } catch (error: unknown) {
       // Move index forward if an error is thrown
       ++lastServerIndex
       throw error
@@ -43,8 +69,8 @@ export const makeEcosystem = (
 
   const makeSigner = (
     seed: string,
-    provider: ethers.providers.BaseProvider = providers[0]
-  ) => new ethers.Wallet(seed, provider)
+    provider?: ethers.providers.BaseProvider
+  ): ethers.Wallet => new ethers.Wallet(seed, provider ?? getProviders()[0])
 
   return {
     getContractInfo,
diff --git a/src/plugins/stake-plugins/uniswapV2/policyInfo/fantomEcosystem.ts b/src/plugins/stake-plugins/uniswapV2/policyInfo/fantomEcosystem.ts
index cef1cef7cdc..7c28ff0deaf 100644
--- a/src/plugins/stake-plugins/uniswapV2/policyInfo/fantomEcosystem.ts
+++ b/src/plugins/stake-plugins/uniswapV2/policyInfo/fantomEcosystem.ts
@@ -1,4 +1,4 @@
-import { ENV } from '../../../../env'
+import { pluginMaps } from '../../../../pluginMaps'
 import ANYSWAP_V5_ERC20_ABI from '../../../abi/ANYSWAP_V5_ERC20_ABI.json'
 import MASONRY_ABI from '../../../abi/MASONRY_ABI.json'
 import TOMB_TREASURY_ABI from '../../../abi/TOMB_TREASURY_ABI.json'
@@ -268,20 +268,27 @@ export const fantomContractInfoMap = {
 // Ecosystem
 // -----------------------------------------------------------------------------
 
-const { quiknodeApiKey = '', poktPortalApiKey = '' } =
-  typeof ENV.FANTOM_INIT === 'object' ? ENV.FANTOM_INIT : {}
-const rpcProviderUrls = [
-  `https://fantom-mainnet.gateway.pokt.network/v1/lb/${poktPortalApiKey}`,
-  `https://polished-empty-cloud.fantom.quiknode.pro/${quiknodeApiKey}/`,
-  'https://rpc.ftm.tools'
-  // 'https://rpc.fantom.network',
-  // 'https://rpc2.fantom.network',
-  // 'https://rpc3.fantom.network',
-  // 'https://rpcapi.fantom.network',
-  // 'https://rpc.ankr.com/fantom'
-]
+// Built on first use rather than at module scope: these URLs embed secrets that
+// the keys store may still be fetching when this module is evaluated.
+const getRpcProviderUrls = (): string[] => {
+  const fantomInit = pluginMaps.corePlugins.fantom
+  const { quiknodeApiKey = '', poktPortalApiKey = '' } =
+    typeof fantomInit === 'object' && fantomInit != null
+      ? (fantomInit as { quiknodeApiKey?: string; poktPortalApiKey?: string })
+      : {}
+  return [
+    `https://fantom-mainnet.gateway.pokt.network/v1/lb/${poktPortalApiKey}`,
+    `https://polished-empty-cloud.fantom.quiknode.pro/${quiknodeApiKey}/`,
+    'https://rpc.ftm.tools'
+    // 'https://rpc.fantom.network',
+    // 'https://rpc2.fantom.network',
+    // 'https://rpc3.fantom.network',
+    // 'https://rpcapi.fantom.network',
+    // 'https://rpc.ankr.com/fantom'
+  ]
+}
 
 export const fantomEcosystem = makeEcosystem(
   fantomContractInfoMap,
-  rpcProviderUrls
+  getRpcProviderUrls
 )
diff --git a/src/selectors/DenominationSelectors.ts b/src/selectors/DenominationSelectors.ts
index 53fa7dd6ab0..1003c4ce71a 100644
--- a/src/selectors/DenominationSelectors.ts
+++ b/src/selectors/DenominationSelectors.ts
@@ -5,12 +5,9 @@ import type {
 } from 'edge-core-js'
 
 import type { RootState } from '../types/reduxTypes'
+import { emptyEdgeDenomination, getExchangeDenom } from '../util/exchangeDenom'
 
-export const emptyEdgeDenomination: EdgeDenomination = Object.freeze({
-  name: '',
-  multiplier: '1',
-  symbol: ''
-})
+export { emptyEdgeDenomination, getExchangeDenom } from '../util/exchangeDenom'
 
 export const selectDisplayDenom = (
   state: RootState,
@@ -33,20 +30,3 @@ export const selectDisplayDenom = (
   }
   return exchangeDenomination
 }
-
-/**
- * Looks up the denomination for a tokenId.
- * Pass either `account.currencyConfig[pluginId]` or `wallet.currencyConfig`,
- * whichever you have.
- */
-export function getExchangeDenom(
-  currencyConfig: EdgeCurrencyConfig,
-  tokenId: EdgeTokenId
-): EdgeDenomination {
-  if (tokenId == null) return currencyConfig.currencyInfo.denominations[0]
-
-  const token = currencyConfig.allTokens[tokenId]
-  if (token != null) return token.denominations[0]
-
-  return emptyEdgeDenomination
-}
diff --git a/src/theme/appConfig.ts b/src/theme/appConfig.ts
index e8237c85716..736271a0052 100644
--- a/src/theme/appConfig.ts
+++ b/src/theme/appConfig.ts
@@ -1,11 +1,11 @@
-import { ENV } from '../env'
+import { CONFIG } from '../config'
 import type { AppConfig } from '../types/types'
 import { edgeConfig } from './edgeConfig'
 import { testConfig } from './testConfig'
 
 const configs = [edgeConfig, testConfig]
-console.log(`ENV.APP_CONFIG:${ENV.APP_CONFIG}`)
-const configName = ENV.APP_CONFIG ?? 'edge'
+console.log(`CONFIG.APP_CONFIG:${CONFIG.APP_CONFIG}`)
+const configName = CONFIG.APP_CONFIG ?? 'edge'
 let exportConfig: AppConfig = edgeConfig
 
 for (const c of configs) {
diff --git a/src/types/types.ts b/src/types/types.ts
index 2ec12aa32be..22c068ed310 100644
--- a/src/types/types.ts
+++ b/src/types/types.ts
@@ -9,6 +9,7 @@ import {
   asObject,
   asOptional,
   asString,
+  asUnknown,
   asValue
 } from 'cleaners'
 import type {
@@ -230,7 +231,16 @@ const asDeviceSettingsInner = asObject({
   disableAnimations: asMaybe(asBoolean, false),
   forceLightAccountCreate: asMaybe(asBoolean, false),
   themeMode: asMaybe(asThemeMode, 'dark'),
-  isSurveyDiscoverShown: asMaybe(asBoolean, false)
+  isSurveyDiscoverShown: asMaybe(asBoolean, false),
+  keysCache: asMaybe(
+    asObject({
+      keys: asUnknown,
+      // When the cache was last written. Diagnostic only — the warm path does
+      // not expire; a new signed infoRollup refresh replaces the blob for the next launch.
+      fetchedAt: asMaybe(asNumber, 0),
+      assuranceLevel: asMaybe(asString)
+    })
+  )
 })
 
 export const asLocalAccountSettings = asMaybe(asLocalAccountSettingsInner, () =>
diff --git a/src/util/CleanStore.ts b/src/util/CleanStore.ts
index 9b8412cfd77..e6d13accdb6 100644
--- a/src/util/CleanStore.ts
+++ b/src/util/CleanStore.ts
@@ -2,7 +2,7 @@ import { type Cleaner, uncleaner } from 'cleaners'
 import { navigateDisklet } from 'disklet'
 import type { EdgeAccount } from 'edge-core-js'
 
-import { ENV } from '../env'
+import { CONFIG } from '../config'
 
 interface CleanStoreRecord<T> {
   update: (data: T) => Promise<void>
@@ -21,7 +21,7 @@ interface CleanStore {
   setRecord: <T>(key: string, data: T, cleaner: Cleaner<T>) => Promise<void>
 }
 
-const { debugStore } = ENV.ACTION_QUEUE
+const { debugStore } = CONFIG.ACTION_QUEUE
 
 export const makeCleanStore = (
   account: EdgeAccount,
diff --git a/src/util/CurrencyInfoHelpers.ts b/src/util/CurrencyInfoHelpers.ts
index 24e8eb13d9b..347caf60612 100644
--- a/src/util/CurrencyInfoHelpers.ts
+++ b/src/util/CurrencyInfoHelpers.ts
@@ -10,8 +10,8 @@ import type {
 } from 'edge-core-js'
 
 import { showError } from '../components/services/AirshipInstance'
+import { CONFIG } from '../config'
 import { SPECIAL_CURRENCY_INFO } from '../constants/WalletAndCurrencyConstants'
-import { ENV } from '../env'
 import type { EdgeAsset } from '../types/types'
 import { asMaybeContractLocation } from './cleaners'
 
@@ -21,7 +21,7 @@ import { asMaybeContractLocation } from './cleaners'
  */
 export function isKeysOnlyPlugin(pluginId: string): boolean {
   const { keysOnlyMode = false } = SPECIAL_CURRENCY_INFO[pluginId] ?? {}
-  return keysOnlyMode || ENV.KEYS_ONLY_PLUGINS[pluginId]
+  return keysOnlyMode || CONFIG.KEYS_ONLY_PLUGINS[pluginId]
 }
 
 export type FindTokenParams =
diff --git a/src/util/DeepLinkParser.ts b/src/util/DeepLinkParser.ts
index c7096166735..762548c2a93 100644
--- a/src/util/DeepLinkParser.ts
+++ b/src/util/DeepLinkParser.ts
@@ -3,7 +3,7 @@ import type { EdgeTokenId } from 'edge-core-js'
 import URL from 'url-parse'
 
 import { guiPlugins } from '../constants/plugins/GuiPlugins'
-import { ENV } from '../env'
+import { globalKeys } from '../keys'
 import {
   asFiatDirection,
   asFiatPaymentType,
@@ -26,7 +26,7 @@ export function parseDeepLink(
   uri: string,
   opts: { aztecoApiKey?: string } = {}
 ): DeepLink {
-  const { aztecoApiKey = ENV.AZTECO_API_KEY } = opts
+  const { aztecoApiKey = globalKeys.AZTECO_API_KEY } = opts
 
   // Extract an `af` affiliate installer id from `deep.edge.app` URLs before
   // the prefix normalization below strips the host. Matches the `dl.edge.app`
diff --git a/src/util/FioAddressUtils.ts b/src/util/FioAddressUtils.ts
index a7b8009ff90..2d407e9cfbc 100644
--- a/src/util/FioAddressUtils.ts
+++ b/src/util/FioAddressUtils.ts
@@ -13,8 +13,8 @@ import { sprintf } from 'sprintf-js'
 
 import { PAYMENT_PROTOCOL_MAP } from '../actions/PaymentProtoActions'
 import { FIO_STR } from '../constants/WalletAndCurrencyConstants'
-import { ENV } from '../env'
 import { lstrings } from '../locales/strings'
+import { pluginMaps } from '../pluginMaps'
 import type { CcWalletMap } from '../reducers/FioReducer'
 import type {
   EdgeAsset,
@@ -195,7 +195,7 @@ const getConnectedWalletsForFioAddress = async (
   fioAddress: string
 ): Promise<DiskletConnectedWallets> => {
   const savedConnectedWallets = await getConnectedWalletsFromFile(fioWallet)
-  return savedConnectedWallets[fioAddress] || {}
+  return savedConnectedWallets[fioAddress] ?? {}
 }
 
 /**
@@ -319,7 +319,7 @@ const isWalletConnected = async (
     const { public_address: connectedAddress } = connectedAddressObj
 
     const fullCurrencyCode = `${chainCode}:${tokenCode}`
-    if (connectedWalletsFromDisklet[fullCurrencyCode]) {
+    if (connectedWalletsFromDisklet[fullCurrencyCode] != null) {
       const { walletId, publicAddress: pubAddressFromDisklet } =
         connectedWalletsFromDisklet[fullCurrencyCode]
       if (
@@ -418,7 +418,7 @@ export const updatePubAddressesForFioAddress = async (
   updatedCcWallets: Array<{ fullCurrencyCode: string; walletId: string }>
   error?: Error | FioError | null
 }> => {
-  if (!fioWallet) throw new Error(lstrings.fio_connect_wallets_err)
+  if (fioWallet == null) throw new Error(lstrings.fio_connect_wallets_err)
   let connectedWalletsFromDisklet = await getConnectedWalletsForFioAddress(
     fioWallet,
     fioAddress
@@ -482,7 +482,7 @@ export const updatePubAddressesForFioAddress = async (
     }
   }
 
-  if (iteration.publicAddresses.length) {
+  if (iteration.publicAddresses.length > 0) {
     try {
       await updatePublicAddresses(
         account,
@@ -524,7 +524,7 @@ const updatePublicAddresses = async (
     public_address: string
   }>,
   action: 'addPublicAddresses' | 'removePublicAddresses'
-) => {
+): Promise<void> => {
   let fee: string
   let edgeTx: EdgeTransaction
   try {
@@ -553,7 +553,7 @@ export const findWalletByFioAddress = async (
   fioWallets: EdgeCurrencyWallet[],
   fioAddress: string
 ): Promise<EdgeCurrencyWallet | null> => {
-  if (fioWallets) {
+  if (fioWallets != null) {
     for (const wallet of fioWallets) {
       const fioAddresses: string[] =
         await wallet.otherMethods.getFioAddressNames()
@@ -584,7 +584,7 @@ export const checkPubAddress = async (
     return publicAddress
   } catch (e: any) {
     if (
-      e.labelCode &&
+      e.labelCode != null &&
       e.labelCode ===
         fioPlugin.currencyInfo.defaultSettings?.errorCodes.INVALID_FIO_ADDRESS
     ) {
@@ -594,7 +594,7 @@ export const checkPubAddress = async (
       )
     }
     if (
-      e.labelCode &&
+      e.labelCode != null &&
       e.labelCode ===
         fioPlugin.currencyInfo.defaultSettings?.errorCodes
           .FIO_ADDRESS_IS_NOT_EXIST
@@ -605,7 +605,7 @@ export const checkPubAddress = async (
       )
     }
     if (
-      e.labelCode &&
+      e.labelCode != null &&
       e.labelCode ===
         fioPlugin.currencyInfo.defaultSettings?.errorCodes
           .FIO_ADDRESS_IS_NOT_LINKED
@@ -656,8 +656,9 @@ export const getFioAddressCache = async (
 export const checkRecordSendFee = async (
   fioWallet: EdgeCurrencyWallet | null,
   fioAddress: string
-) => {
-  if (!fioWallet) throw new Error(lstrings.fio_wallet_missing_for_fio_address)
+): Promise<void> => {
+  if (fioWallet == null)
+    throw new Error(lstrings.fio_wallet_missing_for_fio_address)
   let getFeeResult: string
   try {
     const edgeTx = await fioMakeSpend(fioWallet, 'recordObtData', {
@@ -706,7 +707,7 @@ export const recordSend = async (
     memo: string
     fioRequestId?: number
   }
-) => {
+): Promise<void> => {
   const {
     payeeFioAddress,
     payerPublicAddress,
@@ -732,7 +733,7 @@ export const recordSend = async (
     memo,
     status: 'sent_to_blockchain'
   }
-  if (fioRequestId) {
+  if (fioRequestId != null && fioRequestId !== 0) {
     actionParams = { ...actionParams, fioRequestId }
   }
   const edgeTx = await fioMakeSpend(senderWallet, 'recordObtData', actionParams)
@@ -768,14 +769,14 @@ export const getFioDomains = async (
     fioAddress
   )
   try {
-    if (isFioAddress) {
+    if (isFioAddress === true) {
       const { public_address: publicAddress } =
         await fioPlugin.otherMethods.getConnectedPublicAddress(
           fioAddress.toLowerCase(),
           chainCode,
           tokenCode
         )
-      if (publicAddress && publicAddress.length > 1) {
+      if (publicAddress != null && publicAddress.length > 1) {
         return publicAddress
       }
     }
@@ -792,12 +793,13 @@ export const checkIsDomainPublic = async (
 ): Promise<string | true> => {
   let isDomainPublic = false
   try {
-    isDomainPublic = fioPlugin.otherMethods
-      ? await fioPlugin.otherMethods.isDomainPublic(domain)
-      : false
+    isDomainPublic =
+      fioPlugin.otherMethods != null
+        ? await fioPlugin.otherMethods.isDomainPublic(domain)
+        : false
   } catch (e: any) {
     if (
-      e.labelCode &&
+      e.labelCode != null &&
       e.labelCode ===
         fioPlugin.currencyInfo.defaultSettings?.errorCodes
           .FIO_DOMAIN_IS_NOT_EXIST
@@ -815,6 +817,20 @@ export const checkIsDomainPublic = async (
   return true
 }
 
+/**
+ * Reads the FIO registration token out of `pluginMaps.corePlugins.fio`, which may also
+ * be a bare boolean enablement flag carrying no token at all.
+ *
+ * Absent and empty deliberately collapse to `''`. The retired `FIO_INIT`
+ * cleaner defaulted this field to `''`, so an unconfigured token always arrived
+ * as an empty string; nothing supplies that default now, and treating
+ * `undefined` as a configured token would skip the FIO-only payment fallback
+ * and call the registration API with no credential.
+ */
+const asFioInit = asMaybe(asObject({ fioRegApiToken: asMaybe(asString, '') }), {
+  fioRegApiToken: ''
+})
+
 /**
  *
  * @param fioPlugin
@@ -857,9 +873,9 @@ export const getRegInfo = async (
   }
 
   if (
-    selectedDomain.walletId ||
+    selectedDomain.walletId !== '' ||
     // Fall back to only allowing FIO payments if no fioRegApiToken is configured
-    (typeof ENV.FIO_INIT === 'object' && ENV.FIO_INIT.fioRegApiToken === '')
+    asFioInit(pluginMaps.corePlugins.fio).fioRegApiToken === ''
   ) {
     return {
       activationCost,
@@ -1023,7 +1039,7 @@ const buyAddressRequest = async (
       [fioPlugin.currencyInfo.defaultSettings?.errorCodes.ALREADY_REGISTERED]:
         lstrings.fio_address_register_screen_not_available
     }
-    if (e.labelCode && errorMessages[e.labelCode]) {
+    if (e.labelCode != null && errorMessages[e.labelCode] != null) {
       throw new Error(errorMessages[e.labelCode])
     }
   }
@@ -1052,7 +1068,7 @@ export const getRemainingBundles = async (
 export const getAddBundledTxsFee = async (
   fioWallet: EdgeCurrencyWallet | null
 ): Promise<number> => {
-  if (fioWallet) {
+  if (fioWallet != null) {
     try {
       const edgeTx = await fioMakeSpend(fioWallet, 'addBundledTransactions', {
         fioAddress: '',
@@ -1071,7 +1087,7 @@ export const addBundledTxs = async (
   fioAddress: string,
   fee: number
 ): Promise<void> => {
-  if (fioWallet) {
+  if (fioWallet != null) {
     try {
       let edgeTx = await fioMakeSpend(fioWallet, 'addBundledTransactions', {
         fioAddress,
@@ -1092,7 +1108,7 @@ export const addBundledTxs = async (
 export const getRenewalFee = async (
   fioWallet: EdgeCurrencyWallet | null
 ): Promise<number> => {
-  if (fioWallet) {
+  if (fioWallet != null) {
     try {
       const edgeTx = await fioMakeSpend(fioWallet, 'renewFioDomain', {
         fioDomain: ''
@@ -1114,7 +1130,7 @@ export const renewFioDomain = async (
     lstrings.fio_renew_err_msg,
     lstrings.fio_domain_label
   )
-  if (fioWallet) {
+  if (fioWallet != null) {
     try {
       let edgeTx = await fioMakeSpend(fioWallet, 'renewFioDomain', {
         fioDomain
@@ -1132,7 +1148,7 @@ export const renewFioDomain = async (
 export const getDomainSetVisibilityFee = async (
   fioWallet: EdgeCurrencyWallet | null
 ): Promise<number> => {
-  if (fioWallet) {
+  if (fioWallet != null) {
     try {
       const edgeTx = await fioMakeSpend(fioWallet, 'setFioDomainVisibility', {
         fioDomain: '',
@@ -1152,7 +1168,7 @@ export const setDomainVisibility = async (
   isPublic: boolean,
   fee: number
 ): Promise<{ expiration: string }> => {
-  if (fioWallet) {
+  if (fioWallet != null) {
     try {
       let edgeTx = await fioMakeSpend(fioWallet, 'setFioDomainVisibility', {
         fioDomain,
@@ -1172,7 +1188,7 @@ export const getTransferFee = async (
   fioWallet: EdgeCurrencyWallet | null,
   forDomain: boolean = false
 ): Promise<number> => {
-  if (fioWallet) {
+  if (fioWallet != null) {
     try {
       if (forDomain) {
         const edgeTx = await fioMakeSpend(fioWallet, 'transferFioDomain', {
@@ -1196,8 +1212,9 @@ export const cancelFioRequest = async (
   fioWallet: EdgeCurrencyWallet | null,
   fioRequestId: number,
   fioAddress: string
-) => {
-  if (!fioWallet) throw new Error(lstrings.fio_wallet_missing_for_fio_address)
+): Promise<void> => {
+  if (fioWallet == null)
+    throw new Error(lstrings.fio_wallet_missing_for_fio_address)
   let getFeeResult: string
   let edgeTx: EdgeTransaction
   try {
@@ -1233,7 +1250,7 @@ export const needToCheckExpired = (
 ): boolean => {
   try {
     let lastCheck = lastChecks[fioName]
-    if (!lastCheck) {
+    if (lastCheck == null) {
       lastCheck = new Date()
       lastCheck.setMonth(new Date().getMonth() - 1)
     }
diff --git a/src/util/PushClient/PushClient.ts b/src/util/PushClient/PushClient.ts
index a505e2e9d49..54667b537f1 100644
--- a/src/util/PushClient/PushClient.ts
+++ b/src/util/PushClient/PushClient.ts
@@ -1,6 +1,7 @@
 import { asMaybe } from 'cleaners'
 import type { EdgeAccount } from 'edge-core-js'
 
+import { CONFIG } from '../../config'
 import {
   asErrorResponse,
   asLoginPayload,
@@ -10,11 +11,10 @@ import {
   wasLoginUpdatePayload,
   wasPushRequestBody
 } from '../../controllers/action-queue/types/pushApiTypes'
-import { ENV } from '../../env'
+import { resolveApiKey, resolveApiKeyAsync } from '../edgeApiSigner'
 import { base58 } from '../encoding'
 
-const { ACTION_QUEUE, EDGE_API_KEY } = ENV
-const { pushServerUri } = ACTION_QUEUE
+const { pushServerUri } = CONFIG.ACTION_QUEUE
 
 export interface PushClient {
   getPushEvents: () => Promise<LoginPayload>
@@ -28,7 +28,12 @@ export const makePushClient = (
 ): PushClient => {
   const instance: PushClient = {
     async getPushEvents(): Promise<LoginPayload> {
+      // Warm the native key before building a sync request body.
+      await resolveApiKeyAsync()
       const requestBody = this.getPushRequestBody()
+      if (requestBody.apiKey === '') {
+        throw new Error('PushClient: missing Edge API key')
+      }
 
       const response = await fetch(`${pushServerUri}/v2/login`, {
         method: 'POST',
@@ -49,7 +54,7 @@ export const makePushClient = (
     getPushRequestBody(payload?: LoginUpdatePayload): PushRequestBody {
       const data = payload != null ? wasLoginUpdatePayload(payload) : undefined
       return {
-        apiKey: EDGE_API_KEY,
+        apiKey: resolveApiKey(),
         deviceId: clientId,
         loginId: base58.parse(account.rootLoginId),
         data
@@ -57,7 +62,11 @@ export const makePushClient = (
     },
 
     async uploadPushEvents(payload: LoginUpdatePayload): Promise<void> {
+      await resolveApiKeyAsync()
       const requestBody = instance.getPushRequestBody(payload)
+      if (requestBody.apiKey === '') {
+        throw new Error('PushClient: missing Edge API key')
+      }
       const response = await fetch(`${pushServerUri}/v2/login/update`, {
         method: 'POST',
         headers: {
diff --git a/src/util/WebUtils.ts b/src/util/WebUtils.ts
index f7c7249a8e5..c4712baa177 100644
--- a/src/util/WebUtils.ts
+++ b/src/util/WebUtils.ts
@@ -35,7 +35,8 @@ export const parseQuery = (query?: string): UriQueryMap => {
   if (query == null) return {}
   const dummyUrl = new URL('https://dummyurl.com?' + query, true)
   const test = dummyUrl.query
-  // @ts-expect-error
+  // @ts-expect-error url-parse types `query` as string | Record<string, string>
+  // depending on its `parseQuery` flag, which it cannot narrow from `true` here.
   return test
 }
 
diff --git a/src/util/attestation.ts b/src/util/attestation.ts
index d11654eac7a..3b4e5efe828 100644
--- a/src/util/attestation.ts
+++ b/src/util/attestation.ts
@@ -740,9 +740,10 @@ const runHandshake = (): void => {
  * (unless a live token is already cached) without blocking; the engine then
  * self-reschedules to refresh the token ahead of each expiry.
  *
- * Called from `initInfoServer`, which runs on every network reconnect and not
- * just at boot, so this has to be idempotent: it returns immediately while a
- * token is live, and `runHandshake` single-flights and rate-limits the rest.
+ * Called from the network-reconnect path in `app.ts` (alongside
+ * `initInfoServer`), so this has to be idempotent: it returns immediately
+ * while a token is live, and `runHandshake` single-flights and rate-limits
+ * the rest.
  */
 export const initAttestation = (): void => {
   if (canServeToken()) return
@@ -752,21 +753,27 @@ export const initAttestation = (): void => {
 /**
  * Return the most recent attestation token for an attestation-gated caller.
  * Resolves immediately with the cached token when one is live. Otherwise it
- * ensures a handshake is running and waits at most `GET_TOKEN_TIMEOUT_MS`,
- * returning `undefined` on timeout. Callers treat `undefined` as "no token" and
- * let the info server decide (it may still serve a fallback response).
+ * ensures a handshake is running and waits at most `timeoutMs` (default
+ * `GET_TOKEN_TIMEOUT_MS`), returning `undefined` on timeout. Callers treat
+ * `undefined` as "no token" and let the info server decide (it may still serve
+ * a fallback response).
  *
  * A caller that arrives while the engine is backing off returns `undefined`
  * without waiting at all: `runHandshake` declines to start one, so there is
  * nothing to await. That is what keeps a persistently-failing device from adding
- * `GET_TOKEN_TIMEOUT_MS` to every gated request.
+ * the wait budget to every gated request.
+ *
+ * Pass a longer `timeoutMs` for cold-start paths that intentionally budget more
+ * time for a first attestation (e.g. keysStore's five-second budget).
  */
-export const getAttestationToken = async (): Promise<string | undefined> => {
+export const getAttestationToken = async (
+  timeoutMs: number = GET_TOKEN_TIMEOUT_MS
+): Promise<string | undefined> => {
   const cached = getServableToken()
   if (cached != null) return cached
   runHandshake()
   if (inFlight != null) {
-    await Promise.race([inFlight, delay(GET_TOKEN_TIMEOUT_MS)])
+    await Promise.race([inFlight, delay(timeoutMs)])
   }
   return getServableToken()
 }
diff --git a/src/util/cleaners/asObfuscatedString.ts b/src/util/cleaners/asObfuscatedString.ts
deleted file mode 100644
index 784eaab18b7..00000000000
--- a/src/util/cleaners/asObfuscatedString.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-import { asArray, asCodec, asNumber, uncleaner } from 'cleaners'
-
-// XOR mask applied to each char code. Not a secret.
-const MASK = 0x5a
-
-/**
- * Decodes a string stored as an array of XOR-masked char codes,
- * e.g. "hi" <-> [0x32, 0x33]. Use `wasObfuscatedString` or
- * scripts/obfuscateString.ts to generate the array.
- */
-export const asObfuscatedString = asCodec<string>(
-  raw =>
-    asArray(asNumber)(raw)
-      .map(code => String.fromCharCode(code ^ MASK))
-      .join(''),
-  clean => clean.split('').map(ch => ch.charCodeAt(0) ^ MASK)
-)
-
-export const wasObfuscatedString = uncleaner(asObfuscatedString)
diff --git a/src/util/corePlugins.ts b/src/util/corePlugins.ts
index 7d0c9b06fdb..2457273db5e 100644
--- a/src/util/corePlugins.ts
+++ b/src/util/corePlugins.ts
@@ -1,129 +1,175 @@
-import type { EdgeCorePluginsInit } from 'edge-core-js'
+import type { EdgeCorePluginsInit, JsonObject } from 'edge-core-js'
 
-import { ENV } from '../env'
+import { pluginMaps } from '../pluginMaps'
 
-export const currencyPlugins: EdgeCorePluginsInit = {
-  // edge-currency-accountbased:
-  abstract: ENV.ABSTRACT_INIT,
-  algorand: ENV.ALGORAND_INIT,
-  amoy: ENV.AMOY_INIT,
-  arbitrum: ENV.ARBITRUM_INIT,
-  avalanche: ENV.AVALANCHE_INIT,
-  axelar: ENV.AXELAR_INIT,
-  base: ENV.BASE_INIT,
-  binance: true,
-  binancesmartchain: ENV.BINANCE_SMART_CHAIN_INIT,
-  bobevm: true,
-  botanix: ENV.BOTANIX_INIT,
-  cardano: ENV.CARDANO_INIT,
-  cardanotestnet: ENV.CARDANO_TESTNET_INIT,
-  mayachain: ENV.MAYACHAIN_INIT,
-  celo: ENV.CELO_INIT,
-  coreum: ENV.COREUM_INIT,
-  cosmoshub: ENV.COSMOSHUB_INIT,
-  ecash: ENV.ECASH_INIT,
-  eos: true,
-  ethereum: ENV.ETHEREUM_INIT,
-  ethereumclassic: true,
-  ethereumpow: ENV.ETHEREUM_POW_INIT,
-  fantom: ENV.FANTOM_INIT,
-  filecoin: ENV.FILECOIN_INIT,
-  filecoinfevm: ENV.FILECOINFEVM_INIT,
-  filecoinfevmcalibration: ENV.FILECOINFEVM_CALIBRATION_INIT,
-  fio: ENV.FIO_INIT,
-  hedera: ENV.HEDERA_INIT,
-  holesky: ENV.HOLESKY_INIT,
-  hyperevm: ENV.HYPEREVM_INIT,
-  liberland: ENV.LIBERLAND_INIT,
-  liberlandtestnet: false,
-  opbnb: ENV.OPBNB_INIT,
-  monad: ENV.MONAD_INIT,
-  monero: ENV.MONERO_INIT,
-  nym: ENV.NYM_INIT,
-  optimism: ENV.OPTIMISM_INIT,
-  osmosis: ENV.OSMOSIS_INIT,
-  piratechain: true,
-  polkadot: ENV.POLKADOT_INIT,
-  polygon: ENV.POLYGON_INIT,
-  pulsechain: ENV.PULSECHAIN_INIT,
-  ripple: true,
-  rsk: ENV.RSK_INIT,
-  sepolia: ENV.SEPOLIA_INIT,
-  solana: ENV.SOLANA_INIT,
-  sonic: ENV.SONIC_INIT,
-  stellar: true,
-  sui: true,
-  telos: true,
-  tezos: true,
-  thorchainrune: ENV.THORCHAIN_INIT,
-  thorchainrunestagenet: ENV.THORCHAIN_INIT,
-  ton: ENV.TON_INIT,
-  tron: true,
-  wax: true,
-  zano: true,
-  zcash: true,
-  zksync: ENV.ZKSYNC_INIT,
-  // edge-currency-bitcoin:
-  bitcoin: ENV.BITCOIN_INIT,
-  bitcoincash: ENV.BITCOINCASH_INIT,
-  bitcoincashtestnet: false,
-  bitcoingold: true,
-  bitcoingoldtestnet: false,
-  bitcoinsv: true,
-  bitcointestnet: true,
-  bitcointestnet4: true,
-  dash: ENV.DASH_INIT,
-  digibyte: ENV.DIGIBYTE_INIT,
-  dogecoin: ENV.DOGE_INIT,
-  eboost: true,
-  feathercoin: true,
-  groestlcoin: ENV.GROESTLCOIN_INIT,
-  litecoin: ENV.LITECOIN_INIT,
-  pivx: ENV.PIVX_INIT,
-  qtum: true,
-  ravencoin: true,
-  smartcash: true,
-  ufo: true,
-  vertcoin: true,
-  zcoin: ENV.ZCOIN_INIT
+function buildCurrencyPlugins(): EdgeCorePluginsInit {
+  const core = pluginMaps.corePlugins as EdgeCorePluginsInit
+
+  // Read a plugin init from the pluginMaps map, falling back to a default enablement
+  // value when the plugin is absent from the config/keys files.
+  const coreInit = (
+    id: string,
+    fallback: boolean | JsonObject = false
+  ): boolean | JsonObject => core[id] ?? fallback
+
+  return {
+    // edge-currency-accountbased:
+    abstract: coreInit('abstract'),
+    algorand: coreInit('algorand', true),
+    amoy: coreInit('amoy'),
+    arbitrum: coreInit('arbitrum'),
+    avalanche: coreInit('avalanche'),
+    axelar: coreInit('axelar', true),
+    base: coreInit('base'),
+    binance: true,
+    binancesmartchain: coreInit('binancesmartchain'),
+    bobevm: true,
+    botanix: coreInit('botanix'),
+    cardano: coreInit('cardano'),
+    cardanotestnet: coreInit('cardanotestnet'),
+    mayachain: coreInit('mayachain'),
+    celo: coreInit('celo'),
+    coreum: coreInit('coreum'),
+    cosmoshub: coreInit('cosmoshub'),
+    ecash: coreInit('ecash'),
+    eos: true,
+    ethereum: coreInit('ethereum'),
+    ethereumclassic: true,
+    ethereumpow: coreInit('ethereumpow'),
+    fantom: coreInit('fantom'),
+    filecoin: coreInit('filecoin'),
+    filecoinfevm: coreInit('filecoinfevm'),
+    filecoinfevmcalibration: coreInit('filecoinfevmcalibration'),
+    fio: coreInit('fio', true),
+    hedera: coreInit('hedera', true),
+    holesky: coreInit('holesky'),
+    hyperevm: coreInit('hyperevm'),
+    liberland: coreInit('liberland', true),
+    liberlandtestnet: false,
+    opbnb: coreInit('opbnb'),
+    monad: coreInit('monad'),
+    monero: coreInit('monero'),
+    nym: coreInit('nym'),
+    optimism: coreInit('optimism'),
+    osmosis: coreInit('osmosis'),
+    piratechain: true,
+    polkadot: coreInit('polkadot', true),
+    polygon: coreInit('polygon'),
+    pulsechain: coreInit('pulsechain'),
+    ripple: true,
+    rsk: coreInit('rsk'),
+    sepolia: coreInit('sepolia'),
+    solana: coreInit('solana'),
+    sonic: coreInit('sonic'),
+    stellar: true,
+    sui: true,
+    telos: true,
+    tezos: true,
+    thorchainrune: coreInit('thorchainrune'),
+    thorchainrunestagenet: coreInit('thorchainrune'),
+    ton: coreInit('ton'),
+    tron: true,
+    wax: true,
+    zano: true,
+    zcash: true,
+    zksync: coreInit('zksync'),
+    // edge-currency-bitcoin:
+    bitcoin: coreInit('bitcoin'),
+    bitcoincash: coreInit('bitcoincash'),
+    bitcoincashtestnet: false,
+    bitcoingold: true,
+    bitcoingoldtestnet: false,
+    bitcoinsv: true,
+    bitcointestnet: true,
+    bitcointestnet4: true,
+    dash: coreInit('dash'),
+    digibyte: coreInit('digibyte'),
+    dogecoin: coreInit('dogecoin'),
+    eboost: true,
+    feathercoin: true,
+    groestlcoin: coreInit('groestlcoin'),
+    litecoin: coreInit('litecoin'),
+    pivx: coreInit('pivx'),
+    qtum: true,
+    ravencoin: true,
+    smartcash: true,
+    ufo: true,
+    vertcoin: true,
+    zcoin: coreInit('zcoin')
+  }
 }
 
-export const swapPlugins = {
-  // Centralized Swaps
-  changehero: ENV.CHANGEHERO_INIT,
-  changenow: ENV.CHANGE_NOW_INIT,
-  changelly: ENV.CHANGELLY_INIT,
-  exolix: ENV.EXOLIX_INIT,
-  godex: ENV.GODEX_INIT,
-  lifi: ENV.LIFI_INIT,
-  letsexchange: ENV.LETSEXCHANGE_INIT,
-  nexchange: ENV.NEXCHANGE_INIT,
-  sideshift: ENV.SIDESHIFT_INIT,
-  swapter: ENV.SWAPTER_INIT,
-  swapuz: ENV.SWAPUZ_INIT,
-  xgram: ENV.XGRAM_INIT,
-  nymswap: ENV.NYM_SWAP_INIT,
+function buildSwapPlugins(): EdgeCorePluginsInit {
+  const swap = pluginMaps.swapPlugins as EdgeCorePluginsInit
+
+  const swapInit = (
+    id: string,
+    fallback: boolean | JsonObject = false
+  ): boolean | JsonObject => swap[id] ?? fallback
+
+  return {
+    // Centralized Swaps
+    changehero: swapInit('changehero'),
+    changenow: swapInit('changenow'),
+    changelly: swapInit('changelly'),
+    exolix: swapInit('exolix'),
+    godex: swapInit('godex'),
+    lifi: swapInit('lifi'),
+    letsexchange: swapInit('letsexchange'),
+    nexchange: swapInit('nexchange'),
+    sideshift: swapInit('sideshift'),
+    swapter: swapInit('swapter'),
+    swapuz: swapInit('swapuz'),
+    xgram: swapInit('xgram'),
+    nymswap: swapInit('nymswap'),
+
+    // Defi Swaps
+    bridgeless: swapInit('bridgeless', { referralId: undefined }),
+    rango: swapInit('rango'),
+    spookySwap: false,
+    mayaprotocol: swapInit('mayaprotocol'),
+    thorchain: swapInit('thorchain'),
+    swapkit: swapInit('swapkit'),
+    swapkitv3: swapInit('swapkitv3'),
+    tombSwap: swapInit('tombSwap'),
+    unizen: false,
+    velodrome: true,
+    xrpdex: swapInit('xrpdex'),
+    '0xgasless': swapInit('0xgasless'),
+
+    cosmosibc: true,
+    fantomsonicupgrade: true,
+    transfer: true
+  }
+}
+
+export function buildAllPlugins(): EdgeCorePluginsInit {
+  return {
+    ...buildCurrencyPlugins(),
+    ...buildSwapPlugins()
+  }
+}
 
-  // Defi Swaps
-  bridgeless: ENV.BRIDGELESS_INIT,
-  rango: ENV.RANGO_INIT,
-  spookySwap: false,
-  mayaprotocol: ENV.MAYA_PROTOCOL_INIT,
-  thorchain: ENV.THORCHAIN_INIT,
-  swapkit: ENV.SWAPKIT_INIT,
-  swapkitv3: ENV.SWAPKITV3_INIT,
-  tombSwap: ENV.TOMB_SWAP_INIT,
-  unizen: false,
-  velodrome: true,
-  xrpdex: ENV.XRPDEX_INIT,
-  '0xgasless': ENV['0XGASLESS_INIT'],
+export let currencyPlugins: EdgeCorePluginsInit = buildCurrencyPlugins()
+export let swapPlugins: EdgeCorePluginsInit = buildSwapPlugins()
+export let allPlugins: EdgeCorePluginsInit = buildAllPlugins()
 
-  cosmosibc: true,
-  fantomsonicupgrade: true,
-  transfer: true
+export function rebuildAllPlugins(): void {
+  currencyPlugins = buildCurrencyPlugins()
+  swapPlugins = buildSwapPlugins()
+  allPlugins = buildAllPlugins()
 }
 
-export const allPlugins = {
-  ...currencyPlugins,
-  ...swapPlugins
+/**
+ * Whether a currency plugin is enabled for this build.
+ *
+ * UI that shows a currency's features has to ask this rather than testing
+ * `pluginMaps.corePlugins[id]` itself: several plugins default to enabled when the
+ * config file omits them (`fio` among them), so an absent entry means "on"
+ * here and would read as "off" there - hiding the feature while the plugin
+ * runs.
+ */
+export function isCurrencyPluginEnabled(pluginId: string): boolean {
+  const init = currencyPlugins[pluginId]
+  return init != null && init !== false
 }
diff --git a/src/util/edgeApiSigner.ts b/src/util/edgeApiSigner.ts
new file mode 100644
index 00000000000..4ec24030429
--- /dev/null
+++ b/src/util/edgeApiSigner.ts
@@ -0,0 +1,155 @@
+import { asObject, asString } from 'cleaners'
+import type { EdgeApiSigner } from 'edge-core-js'
+import { NativeModules } from 'react-native'
+
+import { KEYS } from '../keys'
+
+interface EdgeApiSignerNative {
+  signMessage: (message: string) => Promise<unknown>
+  getApiKey: () => Promise<string>
+}
+
+const asSignedMessage = asObject({
+  apiKey: asString,
+  signature: asString
+})
+
+/**
+ * Returns the native module only when it exposes the whole surface this file
+ * uses. A build that ships a partial module (mismatched JS/native versions)
+ * then degrades to the JS fallback instead of throwing a TypeError.
+ */
+function getNativeModule(): EdgeApiSignerNative | undefined {
+  const module = NativeModules.EdgeApiSigner
+  if (
+    module == null ||
+    typeof module.signMessage !== 'function' ||
+    typeof module.getApiKey !== 'function'
+  ) {
+    return undefined
+  }
+  return module
+}
+
+/**
+ * `makeApiSigner.ts` embeds this sentinel when it generates a stub, so a build
+ * with no `edgeKey.json` reports a key that is present but unusable. Treat it,
+ * and anything else that cannot be an API key, as "no key": splicing it into
+ * `Authorization` or `X-Api-Key` yields a malformed header rather than a 401.
+ */
+export function isUsableApiKey(apiKey: unknown): apiKey is string {
+  return typeof apiKey === 'string' && apiKey !== '' && !/\s/.test(apiKey)
+}
+
+/**
+ * True when the native HMAC signer is linked into this build.
+ */
+export function hasNativeApiSigner(): boolean {
+  return getNativeModule() != null
+}
+
+/**
+ * True when this build can HMAC-sign an infoRollup request: native signer
+ * linked, or a usable JS apiKey/secret pair in KEYS.
+ */
+export function willSignInfoRollup(): boolean {
+  if (hasNativeApiSigner()) return true
+  const { EDGE_API_KEY: apiKey, EDGE_API_SECRET: secret } = KEYS
+  return isUsableApiKey(apiKey) && secret != null && secret.byteLength > 0
+}
+
+/**
+ * EdgeContextOptions.apiSigner backed by the native module.
+ */
+export function makeNativeApiSigner(): EdgeApiSigner {
+  const module = getNativeModule()
+  if (module == null) {
+    throw new Error('EdgeApiSigner native module is not available')
+  }
+  return {
+    async signMessage(message: string) {
+      const signed = asSignedMessage(await module.signMessage(message))
+      // Stub builds embed a placeholder that is not a valid Authorization value.
+      if (!isUsableApiKey(signed.apiKey) || signed.signature === '') {
+        throw new Error(
+          'EdgeApiSigner returned an unusable apiKey or signature'
+        )
+      }
+      return signed
+    }
+  }
+}
+
+/**
+ * Public API key from native (falls back to empty string if unavailable).
+ */
+export async function getNativeApiKey(): Promise<string> {
+  const module = getNativeModule()
+  if (module == null) return ''
+  const apiKey = await module.getApiKey()
+  return isUsableApiKey(apiKey) ? apiKey : ''
+}
+
+/** Cache filled on first successful native read (usable keys only). */
+let cachedApiKey: string | null = null
+let warmPromise: Promise<string> | undefined
+let missingKeyWarned = false
+
+export function getCachedNativeApiKey(): string | null {
+  return cachedApiKey
+}
+
+/**
+ * Read the public key from native once and cache it. Never rejects: callers
+ * warm this during startup, where a rejection would surface as an error toast
+ * for what is only a cache miss.
+ */
+export async function warmNativeApiKey(): Promise<string> {
+  const pending =
+    warmPromise ??
+    getNativeApiKey().catch((error: unknown) => {
+      console.warn('warmNativeApiKey failed', String(error))
+      return ''
+    })
+  warmPromise = pending
+  const apiKey = await pending
+  // Only clear the slot we just awaited — a later warm must not be orphaned.
+  if (warmPromise === pending && apiKey === '') warmPromise = undefined
+  // Do not cache empty — that would block the KEYS.EDGE_API_KEY fallback forever.
+  if (apiKey !== '') cachedApiKey = apiKey
+  return apiKey
+}
+
+function keysApiKeyFallback(): string {
+  const apiKey = KEYS.EDGE_API_KEY ?? ''
+  return isUsableApiKey(apiKey) ? apiKey : ''
+}
+
+/**
+ * The public API key for Edge-authenticated services (push, notifications).
+ *
+ * Synchronous: only the cache / KEYS. Prefer `resolveApiKeyAsync` from async
+ * callers so a native build can wait out the one-shot warm first.
+ */
+export function resolveApiKey(): string {
+  const apiKey = cachedApiKey ?? keysApiKeyFallback()
+  if (apiKey === '' && !missingKeyWarned) {
+    missingKeyWarned = true
+    console.warn(
+      'resolveApiKey: no native EdgeApiSigner key and no KEYS.EDGE_API_KEY'
+    )
+  }
+  return apiKey
+}
+
+/**
+ * Await the native warm-up, then return a usable public API key (or '').
+ */
+export async function resolveApiKeyAsync(): Promise<string> {
+  if (cachedApiKey != null) return cachedApiKey
+  if (hasNativeApiSigner()) {
+    const nativeKey = await warmNativeApiKey()
+    if (nativeKey !== '') return nativeKey
+  }
+  return resolveApiKey()
+}
diff --git a/src/util/exchangeDenom.ts b/src/util/exchangeDenom.ts
new file mode 100644
index 00000000000..9069fa38314
--- /dev/null
+++ b/src/util/exchangeDenom.ts
@@ -0,0 +1,28 @@
+import type {
+  EdgeCurrencyConfig,
+  EdgeDenomination,
+  EdgeTokenId
+} from 'edge-core-js'
+
+export const emptyEdgeDenomination: EdgeDenomination = Object.freeze({
+  name: '',
+  multiplier: '1',
+  symbol: ''
+})
+
+/**
+ * Looks up the denomination for a tokenId.
+ * Pass either `account.currencyConfig[pluginId]` or `wallet.currencyConfig`,
+ * whichever you have.
+ */
+export function getExchangeDenom(
+  currencyConfig: EdgeCurrencyConfig,
+  tokenId: EdgeTokenId
+): EdgeDenomination {
+  if (tokenId == null) return currencyConfig.currencyInfo.denominations[0]
+
+  const token = currencyConfig.allTokens[tokenId]
+  if (token != null) return token.denominations[0]
+
+  return emptyEdgeDenomination
+}
diff --git a/src/util/exchangeRates.ts b/src/util/exchangeRates.ts
index 7a3fbe99bd1..5cc602d43d1 100644
--- a/src/util/exchangeRates.ts
+++ b/src/util/exchangeRates.ts
@@ -1,3 +1,9 @@
+/**
+ * Core historical / batched rates against rates3/4 `v3/rates`.
+ *
+ * Uses Node-safe `network.fetchRates` and `utils.removeIsoPrefix`.
+ * The GUI wires Airship `showError` via `exchangeRatesGui.ts`.
+ */
 import {
   asArray,
   asDate,
@@ -10,7 +16,6 @@ import {
 } from 'cleaners'
 import type { EdgeFetchFunction, EdgeTokenId } from 'edge-core-js'
 
-import { showError } from '../components/services/AirshipInstance'
 import { fetchRates } from './network'
 import { removeIsoPrefix } from './utils'
 
@@ -20,6 +25,17 @@ const SHOW_LOGS = false
 
 const clog = SHOW_LOGS ? console.log : (...args: any) => undefined
 
+let onQueryError: (error: unknown) => void = error => {
+  console.warn(error)
+}
+
+/** GUI calls this from `exchangeRatesGui.ts` to show Airship errors. */
+export function configureExchangeRates(opts: {
+  onError?: (error: unknown) => void
+}): void {
+  if (opts.onError != null) onQueryError = opts.onError
+}
+
 // From rates server:
 export const asCryptoAsset = asObject({
   pluginId: asString,
@@ -127,7 +143,7 @@ const doQuery = async (doFetch?: EdgeFetchFunction): Promise<void> => {
 
               clog(`${n} deleting ${key}`)
               resolverMap.delete(key)
-              if (resolvers.length) {
+              if (resolvers.length > 0) {
                 resolvers.forEach((r, i) => {
                   r(rate)
                 })
@@ -163,7 +179,7 @@ const doQuery = async (doFetch?: EdgeFetchFunction): Promise<void> => {
 
               clog(`${n} deleting ${key}`)
               resolverMap.delete(key)
-              if (resolvers.length) {
+              if (resolvers.length > 0) {
                 resolvers.forEach((r, i) => {
                   r(rate)
                 })
@@ -205,7 +221,7 @@ const addToQueue = (
   resolve: Function,
   maxQuerySize: number,
   doFetch?: EdgeFetchFunction
-) => {
+): void => {
   const rateKeyResolver = resolverMap.get(rateKey)
   if (rateKeyResolver == null) {
     // Create a new entry in the map for this pair/date
@@ -223,7 +239,7 @@ const addToQueue = (
     inQuery = true
     setTimeout(() => {
       doQuery(doFetch).catch((error: unknown) => {
-        showError(error)
+        onQueryError(error)
       })
     }, FETCH_FREQUENCY)
   }
diff --git a/src/util/exchangeRatesGui.ts b/src/util/exchangeRatesGui.ts
new file mode 100644
index 00000000000..44d063ba7a1
--- /dev/null
+++ b/src/util/exchangeRatesGui.ts
@@ -0,0 +1,12 @@
+/**
+ * GUI wiring for historical rates. Import once at app startup so
+ * `exchangeRates.ts` reports queue errors via Airship.
+ *
+ * Call sites keep importing helpers from `./exchangeRates`.
+ */
+import { showError } from '../components/services/AirshipInstance'
+import { configureExchangeRates } from './exchangeRates'
+
+configureExchangeRates({
+  onError: showError
+})
diff --git a/src/util/exportTxInfo.ts b/src/util/exportTxInfo.ts
new file mode 100644
index 00000000000..01f7a937456
--- /dev/null
+++ b/src/util/exportTxInfo.ts
@@ -0,0 +1,70 @@
+import { asBoolean, asObject, asString } from 'cleaners'
+import type { EdgeCurrencyWallet, EdgeTokenId } from 'edge-core-js'
+
+/** Per-wallet, per-asset export prefs on `wallet.disklet`. */
+export const EXPORT_TX_INFO_FILE = 'exportTxInfo.json'
+
+export const asExportTxInfo = asObject({
+  bitwaveAccountId: asString,
+  isExportQbo: asBoolean,
+  isExportCsv: asBoolean,
+  isExportBitwave: asBoolean
+})
+
+export const asExportTxInfoMap = asObject(asExportTxInfo)
+
+export type ExportTxInfo = ReturnType<typeof asExportTxInfo>
+export type ExportTxInfoMap = ReturnType<typeof asExportTxInfoMap>
+
+/**
+ * Map key is `tokenId ?? currencyCode` (native = currency code; token =
+ * contract tokenId). Matches the GUI export scene.
+ */
+export function exportTxInfoKey(
+  wallet: Pick<EdgeCurrencyWallet, 'currencyInfo'>,
+  tokenId: EdgeTokenId
+): string {
+  return tokenId ?? wallet.currencyInfo.currencyCode
+}
+
+export async function readExportTxInfoMap(
+  wallet: Pick<EdgeCurrencyWallet, 'disklet'>
+): Promise<ExportTxInfoMap> {
+  const text = await wallet.disklet.getText(EXPORT_TX_INFO_FILE)
+  return asExportTxInfoMap(JSON.parse(text))
+}
+
+export async function writeExportTxInfoMap(
+  wallet: Pick<EdgeCurrencyWallet, 'disklet'>,
+  map: ExportTxInfoMap
+): Promise<void> {
+  await wallet.disklet.setText(EXPORT_TX_INFO_FILE, JSON.stringify(map))
+}
+
+/**
+ * Merge one asset key. Omitted patch fields keep the previous value, or
+ * `false` / `''` when creating the key.
+ */
+export async function mergeExportTxInfo(
+  wallet: EdgeCurrencyWallet,
+  tokenId: EdgeTokenId,
+  patch: Partial<ExportTxInfo>
+): Promise<ExportTxInfo> {
+  let map: ExportTxInfoMap = {}
+  try {
+    map = await readExportTxInfoMap(wallet)
+  } catch {
+    map = {}
+  }
+  const key = exportTxInfoKey(wallet, tokenId)
+  const prev = map[key]
+  const next: ExportTxInfo = {
+    bitwaveAccountId: patch.bitwaveAccountId ?? prev?.bitwaveAccountId ?? '',
+    isExportBitwave: patch.isExportBitwave ?? prev?.isExportBitwave ?? false,
+    isExportCsv: patch.isExportCsv ?? prev?.isExportCsv ?? false,
+    isExportQbo: patch.isExportQbo ?? prev?.isExportQbo ?? false
+  }
+  map[key] = next
+  await writeExportTxInfoMap(wallet, map)
+  return next
+}
diff --git a/src/util/fiatConstants.ts b/src/util/fiatConstants.ts
new file mode 100644
index 00000000000..f3bf59a2db6
--- /dev/null
+++ b/src/util/fiatConstants.ts
@@ -0,0 +1,184 @@
+/**
+ * Node-safe fiat display constants. Split out of WalletAndCurrencyConstants
+ * so util/utils.ts can import them without pulling in react-native Platform.
+ */
+
+export const FEE_COLOR_THRESHOLD = 2.0 // this is denominated in dollars
+export const FEE_ALERT_THRESHOLD = 5.0 // this is denominated in dollars
+export const FIAT_PRECISION = 2
+
+export const removeIsoPrefix = (currencyCode: string): string => {
+  return currencyCode.replace('iso:', '')
+}
+
+export const FIAT_CODES_SYMBOLS: Record<string, string> = {
+  AED: 'د.إ',
+  AFN: '؋',
+  ALL: 'L',
+  AMD: '֏',
+  ANG: 'ƒ',
+  AOA: 'Kz',
+  ARS: '$',
+  AUD: '$',
+  AWG: 'ƒ',
+  AZN: '₼',
+  BAM: 'KM',
+  BBD: '$',
+  BDT: '৳',
+  BGN: 'лв',
+  BIF: 'Fr',
+  BMD: '$',
+  BND: '$',
+  BOB: 'Bs.',
+  BRL: 'R$',
+  BSD: '$',
+  BTN: 'Nu.',
+  BWP: 'P',
+  BYN: 'Br',
+  BZD: '$',
+  CAD: '$',
+  CDF: 'Fr',
+  CHF: 'Fr',
+  CLP: '$',
+  CNY: '¥',
+  COP: '$',
+  CRC: '₡',
+  CUC: '$',
+  CUP: '$',
+  CVE: '$',
+  CZK: 'Kč',
+  DJF: 'Fr',
+  DKK: 'kr',
+  DOP: '$',
+  DZD: 'د.ج',
+  EGP: 'ج.م',
+  ERN: 'Nfk',
+  ETB: 'Br',
+  EUR: '€',
+  FJD: '$',
+  FKP: '£',
+  GBP: '£',
+  GEL: '₾',
+  GGP: '£',
+  GHS: '₵',
+  GIP: '£',
+  GMD: 'D',
+  GNF: 'Fr',
+  GTQ: 'Q',
+  GYD: '$',
+  HKD: '$',
+  HNL: 'L',
+  HRK: 'kn',
+  HTG: 'G',
+  HUF: 'Ft',
+  IDR: 'Rp',
+  ILS: '₪',
+  IMP: '£',
+  INR: '₹',
+  IQD: 'ع.د',
+  IRR: '﷼',
+  ISK: 'kr',
+  JEP: '£',
+  JMD: '$',
+  JOD: 'د.ا',
+  JPY: '¥',
+  KES: 'Sh',
+  KGS: 'с',
+  KHR: '៛',
+  KMF: 'Fr',
+  KPW: '₩',
+  KRW: '₩',
+  KWD: 'د.ك',
+  KYD: '$',
+  KZT: '₸',
+  LAK: '₭',
+  LBP: 'ل.ل',
+  LKR: 'Rs',
+  LRD: '$',
+  LSL: 'L',
+  LYD: 'ل.د',
+  MAD: 'د. م.',
+  MDL: 'L',
+  MGA: 'Ar',
+  MKD: 'ден',
+  MMK: 'Ks',
+  MNT: '₮',
+  MOP: 'P',
+  MRO: 'UM',
+  MRU: 'UM',
+  MUR: '₨',
+  MWK: 'MK',
+  MXN: '$',
+  MYR: 'RM',
+  MZN: 'MT',
+  NAD: '$',
+  NGN: '₦',
+  NIO: 'C$',
+  NOK: 'kr',
+  NPR: '₨',
+  NZD: '$',
+  OMR: 'ر.ع.',
+  PAB: 'B/.',
+  PEN: 'S/.',
+  PGK: 'K',
+  PHP: '₱',
+  PKR: '₨',
+  PLN: 'zł',
+  PRB: 'р.',
+  PYG: '₲',
+  QAR: 'ر.ق',
+  RON: 'lei',
+  RSD: 'дин',
+  RUB: '₽',
+  RWF: 'Fr',
+  SAR: 'ر.س',
+  SBD: '$',
+  SCR: '₨',
+  SDG: 'ج.س.',
+  SEK: 'kr',
+  SGD: '$',
+  SHP: '£',
+  SLL: 'Le',
+  SOS: 'Sh',
+  SRD: '$',
+  SSP: '£',
+  STD: 'Db',
+  SYP: 'ل.س',
+  SZL: 'L',
+  THB: '฿',
+  TJS: 'ЅМ',
+  TMT: 'm',
+  TND: 'د.ت',
+  TOP: 'T$',
+  TRY: '₺',
+  TTD: '$',
+  TVD: '$',
+  TWD: '$',
+  TZS: 'Sh',
+  UAH: '₴',
+  UGX: 'Sh',
+  USD: '$',
+  UYU: '$',
+  UZS: '',
+  VEF: 'Bs',
+  VND: '₫',
+  VUV: 'Vt',
+  WST: 'T',
+  XAF: 'Fr',
+  XCD: '$',
+  XOF: 'Fr',
+  XPF: 'Fr',
+  YER: '﷼',
+  ZAR: 'R',
+  ZMW: 'ZK'
+}
+
+/**
+ * Get the fiat symbol from an iso:[fiat] OR fiat currency code
+ */
+export const getFiatSymbol = (isoOrFiatCurrencyCode: string): string => {
+  if (typeof isoOrFiatCurrencyCode !== 'string') return ''
+  const codeWithoutIso = removeIsoPrefix(isoOrFiatCurrencyCode)
+  const out = FIAT_CODES_SYMBOLS[codeWithoutIso.toUpperCase()]
+  return out ?? ''
+}
diff --git a/src/util/fillTxsFiat.ts b/src/util/fillTxsFiat.ts
new file mode 100644
index 00000000000..cec81de878e
--- /dev/null
+++ b/src/util/fillTxsFiat.ts
@@ -0,0 +1,82 @@
+import { div } from 'biggystring'
+import type {
+  EdgeCurrencyWallet,
+  EdgeTokenId,
+  EdgeTransaction
+} from 'edge-core-js'
+
+import { getExchangeDenom } from './exchangeDenom'
+import { getHistoricalCryptoRate } from './exchangeRates'
+import { DECIMAL_PRECISION } from './utils'
+
+const UPDATE_TXS_MAX_PROMISES = 10
+
+/**
+ * Accept a 3-letter ISO 4217 code (`USD`, `eur`) or `iso:USD`.
+ * Returns `iso:USD` or undefined when the input is not a fiat code.
+ */
+export function toIsoFiatCode(raw: string): string | undefined {
+  let code = raw.trim().toUpperCase()
+  if (code.startsWith('ISO:')) code = code.slice(4)
+  if (!/^[A-Z]{3}$/.test(code)) return undefined
+  return `iso:${code}`
+}
+
+/**
+ * Fill missing `metadata.exchangeAmount[isoFiat]` from the rates server,
+ * using each transaction's date. Same loop as GUI `updateTxsFiat`: skip
+ * when that fiat amount is already non-zero; do not persist.
+ */
+export async function fillTxsFiat(opts: {
+  wallet: EdgeCurrencyWallet
+  tokenId: EdgeTokenId
+  isoFiat: string
+  txs: EdgeTransaction[]
+}): Promise<void> {
+  const { wallet, tokenId, isoFiat, txs } = opts
+  const exchangeDenom = getExchangeDenom(wallet.currencyConfig, tokenId)
+
+  let promises: Array<Promise<void>> = []
+  for (const tx of txs) {
+    const amountFiat = tx.metadata?.exchangeAmount?.[isoFiat] ?? 0
+
+    if (amountFiat === 0) {
+      const date = new Date(tx.date * 1000).toISOString()
+      promises.push(
+        getHistoricalCryptoRate(
+          wallet.currencyInfo.pluginId,
+          tokenId,
+          isoFiat,
+          date
+        )
+          .then(rate => {
+            tx.metadata = {
+              ...tx.metadata,
+              exchangeAmount: {
+                ...tx.metadata?.exchangeAmount,
+                [isoFiat]:
+                  rate *
+                  Number(
+                    div(
+                      tx.nativeAmount,
+                      exchangeDenom.multiplier,
+                      DECIMAL_PRECISION
+                    )
+                  )
+              }
+            }
+          })
+          .catch((e: unknown) => {
+            console.warn(e instanceof Error ? e.message : String(e))
+          })
+      )
+      if (promises.length >= UPDATE_TXS_MAX_PROMISES) {
+        await Promise.all(promises)
+        promises = []
+      }
+    }
+  }
+  if (promises.length > 0) {
+    await Promise.all(promises)
+  }
+}
diff --git a/src/util/hmacAuth.ts b/src/util/hmacAuth.ts
new file mode 100644
index 00000000000..9f3eecd7b32
--- /dev/null
+++ b/src/util/hmacAuth.ts
@@ -0,0 +1,33 @@
+import hashjs from 'hash.js'
+import { base64 } from 'rfc4648'
+
+export function hmacSha256(data: string, key: Uint8Array): Uint8Array {
+  // hash.js HMAC typings reject Sha256Constructor; runtime accepts it.
+  const hmac = (hashjs as any).hmac(hashjs.sha256, key) as {
+    update: (s: string) => { digest: () => number[] }
+  }
+  const digest = hmac.update(data).digest()
+  return new Uint8Array(digest)
+}
+
+export function buildSignedRequestText(
+  method: string,
+  url: string,
+  body: string,
+  timestamp: string
+): string {
+  return `${method}\n${url}\n${body}\n${timestamp}`
+}
+
+export function signHmacAuthorization(
+  method: string,
+  url: string,
+  body: string,
+  timestamp: string,
+  apiKey: string,
+  secret: Uint8Array
+): string {
+  const signedText = buildSignedRequestText(method, url, body, timestamp)
+  const signature = base64.stringify(hmacSha256(signedText, secret))
+  return `HMAC ${apiKey} ${signature}`
+}
diff --git a/src/util/infoUtils.ts b/src/util/infoUtils.ts
index db9c6a788e2..efeaefda8a2 100644
--- a/src/util/infoUtils.ts
+++ b/src/util/infoUtils.ts
@@ -5,7 +5,7 @@ import { getBuildNumber, getVersion } from 'react-native-device-info'
 
 import { infoServerData } from './network'
 import { getPromoCardMessageId } from './promoCardUtils'
-import { getOsVersion } from './utils'
+import { getOsVersion } from './rnUtils'
 
 export interface DisplayInfoCard {
   background: InfoCard['background']
diff --git a/src/util/ipApi.ts b/src/util/ipApi.ts
index 19ccf3aa267..a07f7de8a1e 100644
--- a/src/util/ipApi.ts
+++ b/src/util/ipApi.ts
@@ -1,13 +1,13 @@
 import { asObject, asOptional, asString } from 'cleaners'
 
-import { ENV } from '../env'
+import { globalKeys } from '../keys'
 
 const asIpApi = asObject({
   countryCode: asOptional(asString)
 })
 
 export const getCountryCodeByIp = async (): Promise<string | undefined> => {
-  const apiKey = ENV.IP_API_KEY ?? ''
+  const apiKey = globalKeys.IP_API_KEY ?? ''
 
   try {
     const reply = await fetch(`https://pro.ip-api.com/json/?key=${apiKey}`)
diff --git a/src/util/keysServer.ts b/src/util/keysServer.ts
new file mode 100644
index 00000000000..70903e07d6b
--- /dev/null
+++ b/src/util/keysServer.ts
@@ -0,0 +1,114 @@
+import { asJSON, asObject, asOptional, asString } from 'cleaners'
+import type { EdgeApiSigner, EdgeFetchFunction } from 'edge-core-js'
+
+import { asMergeableKeys } from '../configKeysMerge'
+import { buildSignedRequestText, signHmacAuthorization } from './hmacAuth'
+import { fetchInfo } from './network'
+
+const asSignedInfoRollupKeys = asObject({
+  // Shared with the cache tier so both are held to one definition of mergeable,
+  // and a malformed overlay fails the fetch rather than reaching KEYS or disk.
+  appKeys: asMergeableKeys,
+  // Added by the info server so the client can record which layer it was
+  // actually served, rather than inferring it from whether it sent a token.
+  assuranceLevel: asOptional(asString)
+}).withRest
+
+const asSignedInfoRollupKeysFile = asJSON(asSignedInfoRollupKeys)
+
+export interface RemoteKeysResult {
+  keys: Record<string, unknown>
+  assuranceLevel: string | undefined
+  /** Raw rollup object (public fields plus appKeys). */
+  rollup: Record<string, unknown>
+}
+
+/**
+ * Per-server stagger passed to `fetchInfo` / `asyncWaterfall` (same as its
+ * default). Not a hard ceiling on the whole signed infoRollup call: with
+ * multiple info servers the waterfall can outlast this value. The cold-start
+ * gate in `keysStore` is what bounds how long boot waits.
+ */
+const FETCH_TIMEOUT_MS = 5000
+
+/**
+ * Either signer works, but one of them is required, so the choice is a union
+ * rather than two optional fields: a caller cannot pass neither.
+ */
+export type FetchCredentials =
+  | { apiSigner: EdgeApiSigner }
+  | { apiKey: string; secret: Uint8Array }
+
+export async function fetchRemoteKeys(
+  opts: FetchCredentials & {
+    appId: string
+    os: string
+    osVersion: string
+    appVersion: string
+    infoFetch?: EdgeFetchFunction
+    attestationToken?: string
+    timeoutMs?: number
+  }
+): Promise<RemoteKeysResult> {
+  const { appId, os, osVersion, appVersion, infoFetch, attestationToken } = opts
+  const encodedAppId = encodeURIComponent(appId)
+  const query = `os=${encodeURIComponent(os)}&osVersion=${encodeURIComponent(
+    osVersion
+  )}&appVersion=${encodeURIComponent(appVersion)}`
+  const fetchPath = `v1/infoRollup/${encodedAppId}?${query}`
+  // The server signs `req.originalUrl`, which includes the `/v1` mount point.
+  // `fetchPath` already carries that prefix; `fetchInfo` only joins the server
+  // origin, so the leading slash here reproduces the request target exactly.
+  const signPath = `/${fetchPath}`
+  const method = 'GET'
+  const body = ''
+  const timestamp = Math.floor(Date.now() / 1000).toString()
+  const signedText = buildSignedRequestText(method, signPath, body, timestamp)
+
+  // Narrowing needs the bare union: `in` cannot discriminate the intersection
+  // that carries the request options.
+  const credentials: FetchCredentials = opts
+
+  let authorization: string
+  if ('apiSigner' in credentials) {
+    const signed = await credentials.apiSigner.signMessage(signedText)
+    authorization = `HMAC ${signed.apiKey} ${signed.signature}`
+  } else {
+    authorization = signHmacAuthorization(
+      method,
+      signPath,
+      body,
+      timestamp,
+      credentials.apiKey,
+      credentials.secret
+    )
+  }
+
+  const headers: Record<string, string> = {
+    Authorization: authorization,
+    'X-Timestamp': timestamp
+  }
+  if (attestationToken != null && attestationToken !== '') {
+    headers['x-attestation-token'] = attestationToken
+  }
+
+  const response = await fetchInfo(
+    fetchPath,
+    { method, headers },
+    opts.timeoutMs ?? FETCH_TIMEOUT_MS,
+    infoFetch
+  )
+  if (!response.ok) {
+    const text = await response.text()
+    throw new Error(`fetchRemoteKeys ${response.status}: ${text.slice(0, 200)}`)
+  }
+
+  const parsed = asSignedInfoRollupKeysFile(await response.text())
+  const { appKeys, assuranceLevel, ...rest } = parsed
+  const rollup: Record<string, unknown> = { appKeys, assuranceLevel, ...rest }
+  return {
+    keys: appKeys,
+    assuranceLevel,
+    rollup
+  }
+}
diff --git a/src/util/keysStore.ts b/src/util/keysStore.ts
new file mode 100644
index 00000000000..cafff72d0b1
--- /dev/null
+++ b/src/util/keysStore.ts
@@ -0,0 +1,493 @@
+import { asMaybe } from 'cleaners'
+import { asInfoRollup } from 'edge-info-server'
+import { Platform } from 'react-native'
+import { getVersion } from 'react-native-device-info'
+
+import {
+  awaitDeviceSettingsDisk,
+  getKeysCache,
+  writeKeysCache
+} from '../actions/DeviceSettingsActions'
+import {
+  asMergeableKeys,
+  deepMerge,
+  isPlainObject,
+  nestGlobalKeys
+} from '../configKeysMerge'
+import { asKeysJson, type RuntimeKeys } from '../configKeysSchema'
+import { applyRuntimeKeys, bakedKeys, globalKeys, KEYS } from '../keys'
+import { LOCAL_ONLY_PREFIXES, LOCAL_ONLY_TOP_LEVEL } from '../localOnlyKeys'
+import { rebuildPluginMaps } from '../pluginMaps'
+import { config } from '../theme/appConfig'
+import { getAttestationToken } from './attestation'
+import { rebuildAllPlugins } from './corePlugins'
+import {
+  hasNativeApiSigner,
+  isUsableApiKey,
+  makeNativeApiSigner,
+  warmNativeApiKey
+} from './edgeApiSigner'
+import { type FetchCredentials, fetchRemoteKeys } from './keysServer'
+import { fetchPublicRollup, infoServerData } from './network'
+import { getOsVersion } from './rnUtils'
+import { runOnce } from './runOnce'
+import { checkAppVersion } from './versionCheck'
+
+export type KeysTier = 'remote' | 'cache' | 'baked-in'
+
+/** Wait up to this long for an attestation token before fetching unattested. */
+const ATTESTATION_BUDGET_MS = 5000
+/**
+ * The fetch's share of the cold-start budget. Not a timer of its own: it only
+ * sizes the combined deadline below. The network call's per-server stagger is
+ * `FETCH_TIMEOUT_MS` in `keysServer.ts` (asyncWaterfall delay, not a ceiling),
+ * and the whole gate is bounded by `COLD_TOTAL_TIMEOUT_MS`.
+ */
+const COLD_FETCH_TIMEOUT_MS = 8000
+/**
+ * Deadline for the whole cold-start gate, which is what the app actually waits
+ * on. It is the sum of attestation budget and fetch share. The DeviceSettings
+ * read is timed separately (see `SETTINGS_READ_TIMEOUT_MS`).
+ */
+const COLD_TOTAL_TIMEOUT_MS = ATTESTATION_BUDGET_MS + COLD_FETCH_TIMEOUT_MS
+/** Cap on waiting for `DeviceSettings.json` before continuing without cache. */
+const SETTINGS_READ_TIMEOUT_MS = 2000
+/**
+ * Extra wait when salvaging cache after a failed or slow-overlapping fetch.
+ * Must stay bounded so a hung disk cannot wedge the boot gate, but must be
+ * long enough that a DeviceSettings read slightly past the initial timeout can
+ * still win over baked-in / remote for this launch.
+ */
+const SETTINGS_SALVAGE_TIMEOUT_MS = SETTINGS_READ_TIMEOUT_MS
+/** Cap on a hung background refresh so it does not linger forever. */
+const BACKGROUND_CACHE_TIMEOUT_MS = COLD_TOTAL_TIMEOUT_MS
+
+/**
+ * Secrets the info server must never serve, so a remote payload can never
+ * replace them. Shared with `scripts/slimKeysJson.ts` via `localOnlyKeys.ts`.
+ * The server strips these too; stripping again here means a misconfigured or
+ * hostile server cannot rotate the credentials used to authenticate the fetch,
+ * nor the telemetry keys that are read at module scope before any of this runs
+ * (see `docs/CONFIG_KEYS_ARCHITECTURE.md`).
+ */
+const LOCAL_ONLY_TOP_LEVEL_SET = new Set<string>(LOCAL_ONLY_TOP_LEVEL)
+
+/** Fields that belong in keys.json; config-only names are dropped from overlays. */
+const KEYS_JSON_FIELDS = new Set(Object.keys(asKeysJson.shape))
+
+let keysTier: KeysTier = 'baked-in'
+let initPromise: Promise<void> | undefined
+
+function isLocalOnlyTopLevel(key: string): boolean {
+  return (
+    LOCAL_ONLY_TOP_LEVEL_SET.has(key) ||
+    LOCAL_ONLY_PREFIXES.some(prefix => key.startsWith(prefix))
+  )
+}
+
+/**
+ * Drop config-only fields from a remote/cache overlay so a hostile payload
+ * cannot flip non-secret settings (e.g. `USE_FAKE_CORE`) via appKeys.
+ */
+function keepKeysFields(
+  keys: Record<string, unknown>
+): Record<string, unknown> {
+  const out: Record<string, unknown> = {}
+  for (const [key, value] of Object.entries(keys)) {
+    if (!KEYS_JSON_FIELDS.has(key)) continue
+    out[key] = value
+  }
+  return out
+}
+
+function stripLocalOnlyFields(
+  keys: Record<string, unknown>
+): Record<string, unknown> {
+  const out: Record<string, unknown> = {}
+  for (const [key, value] of Object.entries(keys)) {
+    if (isLocalOnlyTopLevel(key)) continue
+    if (key === 'globalKeys' && isPlainObject(value)) {
+      const nested: Record<string, unknown> = {}
+      for (const [gk, gv] of Object.entries(value)) {
+        if (isLocalOnlyTopLevel(gk)) continue
+        nested[gk] = gv
+      }
+      out.globalKeys = nested
+      continue
+    }
+    out[key] = value
+  }
+  return out
+}
+
+/** Test-only access to overlay filters used before merging into KEYS. */
+export const keysStoreInternalsForTests = {
+  keepKeysFields,
+  stripLocalOnlyFields,
+  nestGlobalKeys
+}
+
+export function getKeysTier(): KeysTier {
+  return keysTier
+}
+
+/**
+ * Fold a remote payload into the live KEYS object, keeping the baked-in
+ * `keys.json` as the merge base so a partial payload degrades to the shipped
+ * value rather than blanking the field.
+ *
+ * KEYS / globalKeys are mutated in place because consumers hold those objects.
+ * Readers that copy a secret out at module-evaluation time therefore never see
+ * this update; see the "Consumers must read lazily" note in the architecture
+ * doc.
+ *
+ * Returns false when the payload is not mergeable.
+ */
+function applyKeys(keys: unknown): boolean {
+  let mergeable: Record<string, unknown>
+  try {
+    mergeable = asMergeableKeys(keys)
+  } catch (error: unknown) {
+    console.warn('initializeKeys: unusable keys payload', String(error))
+    return false
+  }
+
+  const nestedOverlay = nestGlobalKeys(
+    stripLocalOnlyFields(keepKeysFields(mergeable))
+  )
+  const mergedKeys = deepMerge(bakedKeys, nestedOverlay) as RuntimeKeys
+  applyRuntimeKeys(
+    nestGlobalKeys(mergedKeys as unknown as Record<string, unknown>)
+  )
+  rebuildPluginMaps()
+  rebuildAllPlugins()
+  return true
+}
+
+interface FetchedKeys {
+  keys: unknown
+  assuranceLevel: string
+}
+
+function applyPublicRollup(raw: unknown): void {
+  if (infoServerData.rollup != null) return
+  const cleaned = asMaybe(asInfoRollup)(raw)
+  if (cleaned == null) {
+    console.warn('initializeKeys: signed infoRollup failed to clean')
+    return
+  }
+  infoServerData.rollup = cleaned
+  // `queryInfo` runs this on the unsigned path. Without it here, builds that
+  // take the signed path would defer the force-upgrade check by up to one
+  // INFO_FETCH_INTERVAL on every launch.
+  runOnce('checkAppVersion', checkAppVersion).catch(() => {
+    // checkAppVersion reports its own failures.
+  })
+}
+
+/**
+ * Wraps `fetchKeysInner` so every signed attempt — cold-start gate or the warm
+ * `cacheForNextLaunch` refresh — falls back to the unsigned public rollup when
+ * nothing populated `infoServerData`.
+ *
+ * `initInfoServer` cannot make this call itself: at the point it runs, the
+ * signed fetch is normally still in flight rather than failed, so it cannot
+ * distinguish the two. Attaching only to the cold-start path would miss the
+ * warm launch, which is the common case on every launch after the first.
+ */
+async function fetchKeys(): Promise<FetchedKeys | null> {
+  const result = await fetchKeysInner()
+  // Deliberately not awaited: the cold-start gate races this promise against
+  // COLD_TOTAL_TIMEOUT_MS, so blocking on a second network call here would
+  // spend the keys budget on the public rollup and push boot past the gate.
+  if (infoServerData.rollup == null) {
+    fetchPublicRollup().catch(() => {
+      // fetchPublicRollup reports its own failures.
+    })
+  }
+  return result
+}
+
+/**
+ * Wait up to the attestation budget, then fetch. Resolves `null` instead of
+ * rejecting on any failure: the caller races this promise, so a rejection that
+ * lands after the race would surface as an unhandled rejection, and every
+ * failure mode here simply means falling through to the next tier.
+ */
+async function fetchKeysInner(): Promise<FetchedKeys | null> {
+  let credentials: FetchCredentials | null = null
+  if (hasNativeApiSigner()) {
+    const nativeKey = await warmNativeApiKey()
+    if (nativeKey !== '') {
+      credentials = { apiSigner: makeNativeApiSigner() }
+    }
+  }
+  if (credentials == null) {
+    const { EDGE_API_KEY: apiKey, EDGE_API_SECRET: secret } = KEYS
+    if (isUsableApiKey(apiKey) && secret != null && secret.byteLength > 0) {
+      credentials = { apiKey, secret }
+    }
+  }
+  if (credentials == null) {
+    console.warn(
+      'initializeKeys: no usable native EdgeApiSigner and no JS apiKey/apiSecret in KEYS'
+    )
+    return null
+  }
+
+  try {
+    const attestationToken = await getAttestationToken(ATTESTATION_BUDGET_MS)
+    const attested = attestationToken != null && attestationToken !== ''
+    const result = await fetchRemoteKeys({
+      ...credentials,
+      appId: config.appId ?? 'edge',
+      os: Platform.OS === 'android' ? 'android' : 'ios',
+      osVersion: getOsVersion(),
+      appVersion: getVersion(),
+      attestationToken
+    })
+    if (result.rollup != null) applyPublicRollup(result.rollup)
+    return {
+      keys: result.keys,
+      // The server reports the layer it actually served; fall back to what we
+      // asked for when talking to an older server that omits the field.
+      assuranceLevel:
+        result.assuranceLevel ?? (attested ? 'attested' : 'unattested')
+    }
+  } catch (error: unknown) {
+    console.warn('initializeKeys: remote keys fetch failed', String(error))
+    return null
+  }
+}
+
+async function cacheKeys(result: FetchedKeys): Promise<void> {
+  let overlay: Record<string, unknown>
+  try {
+    overlay = nestGlobalKeys(
+      stripLocalOnlyFields(keepKeysFields(asMergeableKeys(result.keys)))
+    )
+  } catch (error: unknown) {
+    console.warn(
+      'initializeKeys: refusing to cache unusable keys payload',
+      String(error)
+    )
+    return
+  }
+  await writeKeysCache({
+    keys: overlay,
+    fetchedAt: Date.now(),
+    assuranceLevel: result.assuranceLevel
+  })
+}
+
+/**
+ * Resolve KEYS secrets from the highest tier available, and record which one
+ * won so a runtime check can prove the remote path was exercised.
+ *
+ * Warm start (any mergeable cache) unblocks on the cache and refreshes in the
+ * background for the *next* launch, so keys are never hot-swapped underneath a
+ * running core and later launches do not stall on the network. The cache does
+ * not expire. Cold start (first launch / no usable cache) blocks for at most
+ * `COLD_TOTAL_TIMEOUT_MS`, then falls through to the baked-in file.
+ */
+async function doInitializeKeys(): Promise<void> {
+  let settingsTimer: ReturnType<typeof setTimeout> | undefined
+  const settingsTimeout = new Promise<'timeout'>(resolve => {
+    settingsTimer = setTimeout(() => {
+      resolve('timeout')
+    }, SETTINGS_READ_TIMEOUT_MS)
+  })
+  const settingsLoad = awaitDeviceSettingsDisk().catch((error: unknown) => {
+    console.warn(
+      'initializeKeys: awaitDeviceSettingsDisk failed',
+      String(error)
+    )
+  })
+  const settingsResult = await Promise.race([
+    // Writers-only init settles on timeout; warm-cache / salvage still need the
+    // disk apply, so race the full disk wait against the boot budget.
+    settingsLoad.then(() => 'ok' as const),
+    settingsTimeout
+  ])
+  if (settingsTimer != null) clearTimeout(settingsTimer)
+  if (settingsResult === 'timeout') {
+    console.warn(
+      `initializeKeys: DeviceSettings disk timed out after ${SETTINGS_READ_TIMEOUT_MS}ms`
+    )
+  }
+
+  // An unmergeable cache is treated as no warm cache, so the fetch below still
+  // runs. Reporting `cache` for a payload that never reached KEYS would claim a
+  // tier the app is not actually on. After a settings timeout the in-memory
+  // copy may still be empty even though a valid cache is on disk — we still
+  // race the network, then await `settingsLoad` before accepting baked-in so a
+  // late disk read can still win.
+  let cache = getKeysCache()
+  if (cache?.keys != null && applyKeys(cache.keys)) {
+    keysTier = 'cache'
+    logTier(cache.assuranceLevel)
+    cacheForNextLaunch()
+    return
+  }
+
+  let timer: ReturnType<typeof setTimeout> | undefined
+  const timeout = new Promise<null>(resolve => {
+    timer = setTimeout(() => {
+      resolve(null)
+    }, COLD_TOTAL_TIMEOUT_MS)
+  })
+  // Held outside the race so a fetch that answers after the gate closes can
+  // still be observed and cached, rather than being ignored once boot proceeds.
+  const pendingFetch = fetchKeys()
+  let result: FetchedKeys | null
+  try {
+    // Only the fetch is raced. Folding the cache write in would let a slow disk
+    // discard keys we already hold, and the write is not worth blocking boot
+    // for: losing it costs one refetch on the next launch.
+    result = await Promise.race([pendingFetch, timeout])
+  } finally {
+    // The race can settle long before the timer does, and a pending timer keeps
+    // the runtime awake for the rest of the window.
+    if (timer != null) clearTimeout(timer)
+  }
+
+  const applyCacheFallback = async (
+    pending?: Promise<FetchedKeys | null>
+  ): Promise<boolean> => {
+    // Always allow a bounded salvage wait after the fetch settles. Measuring
+    // from boot start left zero budget when the network failed quickly after
+    // the initial settings timeout, so a slightly slower disk never got a
+    // chance to deliver keysCache.
+    let salvageTimer: ReturnType<typeof setTimeout> | undefined
+    const salvageTimeout = new Promise<'timeout'>(resolve => {
+      salvageTimer = setTimeout(() => {
+        resolve('timeout')
+      }, SETTINGS_SALVAGE_TIMEOUT_MS)
+    })
+    try {
+      await Promise.race([
+        settingsLoad.then(() => 'ok' as const),
+        salvageTimeout
+      ])
+    } finally {
+      if (salvageTimer != null) clearTimeout(salvageTimer)
+    }
+    cache = getKeysCache()
+    if (cache?.keys == null) return false
+    if (!applyKeys(cache.keys)) return false
+    keysTier = 'cache'
+    logTier(cache.assuranceLevel)
+    if (pending != null) cacheForNextLaunch(pending)
+    return true
+  }
+
+  if (result == null) {
+    // Fetch failed or the gate closed. Prefer any cache the settings read can
+    // still deliver over baked-in, then keep waiting on the in-flight fetch so
+    // a late answer still warms the next launch.
+    if (await applyCacheFallback(pendingFetch)) return
+    keysTier = 'baked-in'
+    logTier()
+    cacheForNextLaunch(pendingFetch)
+    return
+  }
+
+  // Late disk may have delivered a warm cache while we were fetching. Prefer
+  // it for this launch (documented warm-start rule); still cache the remote
+  // payload for the next launch.
+  if (await applyCacheFallback()) {
+    cacheKeys(result).catch((error: unknown) => {
+      console.warn('initializeKeys: caching keys failed', String(error))
+    })
+    return
+  }
+
+  if (!applyKeys(result.keys)) {
+    // Caching a payload KEYS just rejected would only make the next launch fall
+    // through the cache tier as well.
+    keysTier = 'baked-in'
+    logTier()
+    return
+  }
+  keysTier = 'remote'
+  logTier(result.assuranceLevel)
+  cacheKeys(result).catch((error: unknown) => {
+    console.warn('initializeKeys: caching keys failed', String(error))
+  })
+}
+
+/**
+ * Announce which tier won. LAYER-* sentinel values from the local info_keys
+ * seed are printed so a device run can tell which overlays matched. Any other
+ * key material is shown as (none).
+ */
+function logTier(assuranceLevel?: string): void {
+  const marker = (value: unknown): string =>
+    typeof value === 'string' && value.startsWith('LAYER-') ? value : '(none)'
+  console.log(
+    `[keys] tier=${keysTier} assurance=${assuranceLevel ?? 'none'} ` +
+      `markers=COINGECKO:${marker(globalKeys.COINGECKO_API_KEY)},` +
+      `UNSTOPPABLE:${marker(globalKeys.UNSTOPPABLE_DOMAINS_API_KEY)},` +
+      `IP:${marker(globalKeys.IP_API_KEY)},` +
+      `STAKEKIT:${marker(globalKeys.STAKEKIT_API_KEY)},` +
+      `KILN:${marker(globalKeys.KILN_MAINNET_API_KEY)}`
+  )
+}
+
+/**
+ * Populate the cache for the *next* launch. Never folds the payload into KEYS,
+ * so keys are not hot-swapped underneath a running core.
+ *
+ * Pass an in-flight fetch to reuse it; omit it to start a new one. A fetch that
+ * already failed resolves `null` here and does nothing. Raced against a timeout
+ * so a hung network call cannot linger forever.
+ */
+function cacheForNextLaunch(pending?: Promise<FetchedKeys | null>): void {
+  const promise = pending ?? fetchKeys()
+  let timer: ReturnType<typeof setTimeout> | undefined
+  const TIMED_OUT = 'timedOut' as const
+  const timeout = new Promise<typeof TIMED_OUT>(resolve => {
+    timer = setTimeout(() => {
+      resolve(TIMED_OUT)
+    }, BACKGROUND_CACHE_TIMEOUT_MS)
+  })
+  Promise.race([promise, timeout])
+    .then(async result => {
+      if (result === TIMED_OUT) {
+        console.warn(
+          `initializeKeys: background refresh timed out after ${BACKGROUND_CACHE_TIMEOUT_MS}ms`
+        )
+        // Timeout only stops waiting — still cache a late success for next launch.
+        promise
+          .then(async late => {
+            if (late != null) await cacheKeys(late)
+          })
+          .catch((error: unknown) => {
+            console.warn(
+              'initializeKeys: late background refresh failed',
+              String(error)
+            )
+          })
+        return
+      }
+      if (result != null) await cacheKeys(result)
+    })
+    .catch((error: unknown) => {
+      console.warn('initializeKeys: background refresh failed', String(error))
+    })
+    .finally(() => {
+      if (timer != null) clearTimeout(timer)
+    })
+}
+
+/**
+ * Populate KEYS secrets. Idempotent, and never rejects: every tier below the
+ * one that failed is still usable, and the caller is the boot gate, which would
+ * otherwise leave the app on the splash screen with no way to recover.
+ */
+export async function initializeKeys(): Promise<void> {
+  initPromise ??= doInitializeKeys().catch((error: unknown) => {
+    console.warn('initializeKeys: falling back to baked-in keys', String(error))
+  })
+  await initPromise
+}
diff --git a/src/util/localAccountSettings.ts b/src/util/localAccountSettings.ts
new file mode 100644
index 00000000000..3ce27bc9836
--- /dev/null
+++ b/src/util/localAccountSettings.ts
@@ -0,0 +1,33 @@
+import type { EdgeAccount } from 'edge-core-js'
+
+import {
+  asLocalAccountSettings,
+  type LocalAccountSettings
+} from '../types/types'
+
+export const LOCAL_SETTINGS_FILENAME = 'Settings.json'
+
+/**
+ * Read account.localDisklet Settings.json. Missing or invalid files yield
+ * cleaner defaults (spamFilterOn: true). No process-wide cache — the GUI
+ * wrapper in LocalSettingsActions.ts keeps that.
+ */
+export async function readLocalAccountSettingsFromDisk(
+  account: EdgeAccount
+): Promise<LocalAccountSettings> {
+  try {
+    const text = await account.localDisklet.getText(LOCAL_SETTINGS_FILENAME)
+    return asLocalAccountSettings(JSON.parse(text))
+  } catch {
+    return asLocalAccountSettings({})
+  }
+}
+
+export async function writeLocalAccountSettingsToDisk(
+  account: EdgeAccount,
+  settings: LocalAccountSettings
+): Promise<LocalAccountSettings> {
+  const text = JSON.stringify(settings)
+  await account.localDisklet.setText(LOCAL_SETTINGS_FILENAME, text)
+  return settings
+}
diff --git a/src/util/logger.ts b/src/util/logger.ts
index d5877cab352..21beca19e68 100644
--- a/src/util/logger.ts
+++ b/src/util/logger.ts
@@ -3,7 +3,7 @@ import dateFormat from 'dateformat'
 import RNFS from 'react-native-fs'
 import { sprintf } from 'sprintf-js'
 
-import { ENV } from '../env'
+import { CONFIG } from '../config'
 
 const NUM_FILES = 20
 export type LogType = 'info' | 'activity'
@@ -194,8 +194,7 @@ export function logActivity(
 }
 
 async function request(data: string): Promise<Response> {
-  // @ts-expect-error - ENV.LOG_SERVER may not be defined in all configs
-  const logServer = ENV.LOG_SERVER as { host: string; port: number } | undefined
+  const logServer = CONFIG.LOG_SERVER
   return await global.fetch(`${logServer?.host}:${logServer?.port}/log`, {
     method: 'POST',
     headers: {
@@ -225,7 +224,7 @@ export function logToServer(...info: unknown[]): void {
 // ---------------------------------------------------------------------------
 // Configurable Debug Logging
 // ---------------------------------------------------------------------------
-// Configure via LOG_CONFIG in env.json:
+// Configure via LOG_CONFIG in config.json:
 // {
 //   "LOG_CONFIG": {
 //     "enabledCategories": ["phaze", "coinrank"],
@@ -241,9 +240,9 @@ interface LogConfig {
   sensitiveHeaders: Set<string>
 }
 
-/** Get log config from ENV with defaults */
+/** Get log config from CONFIG with defaults */
 const getLogConfig = (): LogConfig => {
-  const config = ENV.LOG_CONFIG ?? {}
+  const config = CONFIG.LOG_CONFIG ?? {}
   return {
     enabledCategories: new Set(
       (config.enabledCategories ?? []).map((c: string) => c.toLowerCase())
@@ -262,12 +261,12 @@ const getLogConfig = (): LogConfig => {
   }
 }
 
-// Cache config at module load (ENV is static)
+// Cache config at module load (CONFIG is static)
 const logConfig = getLogConfig()
 
 /**
  * Check if a log category is enabled.
- * Categories are configured via LOG_CONFIG.enabledCategories in env.json.
+ * Categories are configured via LOG_CONFIG.enabledCategories in config.json.
  */
 export const isLogCategoryEnabled = (category: string): boolean => {
   return logConfig.enabledCategories.has(category.toLowerCase())
diff --git a/src/util/maestro.ts b/src/util/maestro.ts
index 07a2bdd3d68..e7ff83842d8 100644
--- a/src/util/maestro.ts
+++ b/src/util/maestro.ts
@@ -1,10 +1,10 @@
-import { ENV } from '../env'
+import { CONFIG } from '../config'
 
 export const LOGIN_TEST_SERVER = 'https://login-tester.edge.app'
 export const INFO_TEST_SERVER = 'https://info-tester.edge.app'
 export const SYNC_TEST_SERVER = 'https://sync-tester-us1.edge.app'
 
-export const isMaestro = (): boolean => ENV.ENABLE_MAESTRO_BUILD
+export const isMaestro = (): boolean => CONFIG.ENABLE_MAESTRO_BUILD
 
 /**
  * Maestro builds default to tester login/info/sync hosts unless
@@ -12,5 +12,5 @@ export const isMaestro = (): boolean => ENV.ENABLE_MAESTRO_BUILD
  * use tester hosts when `ENABLE_TEST_SERVERS` is true.
  */
 export const shouldUseTestServers = (): boolean =>
-  (ENV.ENABLE_TEST_SERVERS == null && isMaestro()) ||
-  ENV.ENABLE_TEST_SERVERS === true
+  (CONFIG.ENABLE_TEST_SERVERS == null && isMaestro()) ||
+  CONFIG.ENABLE_TEST_SERVERS === true
diff --git a/src/util/middleware/perfLogger.ts b/src/util/middleware/perfLogger.ts
index c49b259f9a1..48bf1acddf8 100644
--- a/src/util/middleware/perfLogger.ts
+++ b/src/util/middleware/perfLogger.ts
@@ -1,18 +1,18 @@
 import RNFS from 'react-native-fs'
 import type { Middleware } from 'redux'
 
-import { ENV } from '../../env'
+import { CONFIG } from '../../config'
 import type { Dispatch, RootState } from '../../types/reduxTypes'
 
 const perfLoggerCSV = RNFS.DocumentDirectoryPath + '/perfLogger.csv'
 
-if (ENV.ENABLE_REDUX_PERF_LOGGING) {
+if (CONFIG.ENABLE_REDUX_PERF_LOGGING) {
   RNFS.writeFile(perfLoggerCSV, 'action type,start,end\n', 'utf8')
     .then(success => {
       console.log(`PERF: PerfLogger initialized @ ${perfLoggerCSV}`)
     })
-    .catch(error => {
-      console.log(error.message)
+    .catch((error: unknown) => {
+      console.log(String(error))
     })
 }
 
@@ -22,10 +22,10 @@ export const perfLogger: Middleware<unknown, RootState, Dispatch> =
     const result = next(action)
     const end = Date.now()
 
-    if (ENV.ENABLE_REDUX_PERF_LOGGING) {
+    if (CONFIG.ENABLE_REDUX_PERF_LOGGING) {
       RNFS.appendFile(perfLoggerCSV, `${action.type},${start},${end}\n`)
         // Log to the console instead of showError to not spam the user
-        .catch(err => {
+        .catch((err: unknown) => {
           console.error(err)
         })
     }
diff --git a/src/util/nameServices.ts b/src/util/nameServices.ts
index fde9736de22..bde9a8b3bf9 100644
--- a/src/util/nameServices.ts
+++ b/src/util/nameServices.ts
@@ -2,7 +2,7 @@ import Resolver from '@unstoppabledomains/resolution'
 import { ethers } from 'ethers'
 
 import { getSpecialCurrencyInfo } from '../constants/WalletAndCurrencyConstants'
-import { ENV } from '../env'
+import { globalKeys } from '../keys'
 import { reverseResolveZnsAddress } from './zns'
 
 export type NameService = 'ens' | 'unstoppable' | 'zns'
@@ -58,8 +58,10 @@ const reverseLookupEns = async (address: string): Promise<string | null> => {
 // --- Unstoppable Domains ---
 let udResolver: Resolver | null = null
 const getUdResolver = (): Resolver | null => {
-  if (ENV.UNSTOPPABLE_DOMAINS_API_KEY == null) return null
-  udResolver ??= new Resolver({ apiKey: ENV.UNSTOPPABLE_DOMAINS_API_KEY })
+  if (globalKeys.UNSTOPPABLE_DOMAINS_API_KEY == null) return null
+  udResolver ??= new Resolver({
+    apiKey: globalKeys.UNSTOPPABLE_DOMAINS_API_KEY
+  })
   return udResolver
 }
 
diff --git a/src/util/network.ts b/src/util/network.ts
index ff7144ed17a..649980d6285 100644
--- a/src/util/network.ts
+++ b/src/util/network.ts
@@ -5,29 +5,42 @@ import type {
   EdgeFetchResponse
 } from 'edge-core-js'
 import { asInfoRollup, type InfoRollup } from 'edge-info-server'
-import { Platform } from 'react-native'
-import { getVersion } from 'react-native-device-info'
-
-import { ENV } from '../env'
-import { config } from '../theme/appConfig'
-import { initAttestation } from './attestation'
-import { INFO_TEST_SERVER, shouldUseTestServers } from './maestro'
-import { runOnce } from './runOnce'
-import { asyncWaterfall, getOsVersion, shuffleArray } from './utils'
-import { checkAppVersion } from './versionCheck'
-// `ENV.INFO_SERVER` (from env.json) overrides the production info servers, e.g.
-// to point a debug build at a local info server. Absent in production builds.
-const INFO_SERVERS =
-  ENV.INFO_SERVER != null && ENV.INFO_SERVER.length > 0
-    ? ENV.INFO_SERVER
-    : shouldUseTestServers()
-    ? [INFO_TEST_SERVER]
-    : ['https://info1.edge.app', 'https://info2.edge.app']
+
+import { asyncWaterfall, shuffleArray } from './utils'
+
+const DEFAULT_INFO_SERVERS = [
+  'https://info1.edge.app',
+  'https://info2.edge.app'
+]
 const RATES_SERVERS = ['https://rates3.edge.app', 'https://rates4.edge.app']
 const RATES_SERVER_V2 = ['https://rates1.edge.app', 'https://rates2.edge.app']
 
 const INFO_FETCH_INTERVAL = 5 * 60 * 1000 // 5 minutes
 
+let infoServers: string[] = DEFAULT_INFO_SERVERS
+let referralServers: string[] = []
+let notificationServers: string[] = []
+let infoServerPollStarted = false
+
+/**
+ * GUI wires referral/push/info server lists from appConfig/ENV at startup.
+ * Until configured, referral/push fetches use an empty list; info defaults
+ * to production hosts.
+ */
+export function configureNetwork(opts: {
+  infoServers?: string[]
+  referralServers?: string[]
+  notificationServers?: string[]
+}): void {
+  if (opts.infoServers != null && opts.infoServers.length > 0) {
+    infoServers = opts.infoServers
+  }
+  if (opts.referralServers != null) referralServers = opts.referralServers
+  if (opts.notificationServers != null) {
+    notificationServers = opts.notificationServers
+  }
+}
+
 export async function fetchWaterfall(
   servers: string[],
   path: string,
@@ -94,7 +107,7 @@ export const fetchInfo = async (
   timeout?: number,
   doFetch?: EdgeFetchFunction
 ): Promise<EdgeFetchResponse> => {
-  return await multiFetch(INFO_SERVERS, path, options, timeout, doFetch)
+  return await multiFetch(infoServers, path, options, timeout, doFetch)
 }
 export const fetchRates = async (
   path: string,
@@ -111,13 +124,7 @@ export const fetchReferral = async (
   timeout?: number,
   doFetch?: EdgeFetchFunction
 ): Promise<EdgeFetchResponse> => {
-  return await multiFetch(
-    config.referralServers ?? [],
-    path,
-    options,
-    timeout,
-    doFetch
-  )
+  return await multiFetch(referralServers, path, options, timeout, doFetch)
 }
 export const fetchPush = async (
   path: string,
@@ -125,50 +132,87 @@ export const fetchPush = async (
   timeout?: number,
   doFetch?: EdgeFetchFunction
 ): Promise<EdgeFetchResponse> => {
-  return await multiFetch(
-    config.notificationServers,
-    path,
-    options,
-    timeout,
-    doFetch
-  )
+  return await multiFetch(notificationServers, path, options, timeout, doFetch)
 }
 
 export const infoServerData: { rollup?: InfoRollup } = {}
 
-export const initInfoServer = async (): Promise<void> => {
-  // Start the background attestation engine at boot (best-effort, non-blocking)
-  // so a token is usually cached before any attestation-gated request is made.
-  // This is intentionally not inside fetchInfo: the fetch wrapper carries no
-  // attestation logic; gated plugins attach the token via getAttestationToken().
-  initAttestation()
-
-  const osType = Platform.OS.toLowerCase()
-  const osVersion = getOsVersion()
-  const version = getVersion()
-
-  const queryInfo = async (): Promise<void> => {
-    try {
-      const response = await fetchInfo(
-        `v1/inforollup/${
-          config.appId ?? 'edge'
-        }?os=${osType}&osVersion=${osVersion}&appVersion=${version}`
+export interface InitInfoServerParams {
+  osType: string
+  osVersion: string
+  appVersion: string
+  appId: string
+  /** Called once after a successful rollup fetch (e.g. version check). */
+  onRollup?: () => Promise<void>
+  /**
+   * When true, skip the launch unsigned fetch (HMAC signed fetch will fill
+   * rollup + appKeys). Unsigned is enough when this build has no HMAC
+   * credentials.
+   */
+  skipUnsignedLaunchFetch?: boolean
+}
+
+let infoServerParams: InitInfoServerParams | undefined
+
+/**
+ * Fetch the unsigned public info rollup. Exported so `keysStore` can fall back
+ * to it when the signed infoRollup fetch fails to populate `infoServerData`:
+ * that failure is only observable once the signed fetch settles, which is long
+ * after `initInfoServer` has already run. Uses the parameters captured by
+ * `initInfoServer`, so this module stays Node-safe.
+ */
+export const fetchPublicRollup = async (): Promise<void> => {
+  const params = infoServerParams
+  if (params == null) {
+    console.warn('fetchPublicRollup: initInfoServer has not run yet')
+    return
+  }
+  const { osType, osVersion, appVersion, appId, onRollup } = params
+  try {
+    const response = await fetchInfo(
+      `v1/infoRollup/${appId}?os=${osType}&osVersion=${osVersion}&appVersion=${appVersion}`
+    )
+    if (!response.ok) {
+      console.warn(
+        `initInfoServer error ${response.status}: ${await response.text()}`
       )
-      if (!response.ok) {
-        console.warn(
-          `initInfoServer error ${response.status}: ${await response.text()}`
-        )
-      } else {
-        const infoData = await response.json()
-        infoServerData.rollup = asInfoRollup(infoData)
-        await runOnce('checkAppVersion', checkAppVersion)
-      }
-    } catch (e) {
-      console.warn('initInfoServer: Failed to ping info server')
+    } else {
+      const infoData = await response.json()
+      infoServerData.rollup = asInfoRollup(infoData)
+      if (onRollup != null) await onRollup()
     }
+  } catch (e) {
+    console.warn('initInfoServer: Failed to ping info server')
+  }
+}
+
+export const initInfoServer = async (
+  params: InitInfoServerParams
+): Promise<void> => {
+  infoServerParams = params
+  const { skipUnsignedLaunchFetch } = params
+
+  const queryInfo = fetchPublicRollup
+
+  if (infoServerPollStarted) {
+    // NetInfo reconnect: live-update public rollup fields only (never KEYS).
+    await queryInfo()
+    return
+  }
+  // Claim the poll before the first await. Two NetInfo transitions racing
+  // through the awaits below would otherwise each install an interval.
+  infoServerPollStarted = true
+
+  // Launch: skip a parallel unsigned fetch when keys boot will sign one (that
+  // response fills in-memory rollup + appKeys). Unsigned is enough when this
+  // build has no HMAC credentials. When the signed path is taken but fails to
+  // populate the rollup, `keysStore` calls `fetchPublicRollup` directly — the
+  // decision cannot be made here, because at this point the signed fetch is
+  // usually still in flight rather than failed.
+  if (infoServerData.rollup == null && skipUnsignedLaunchFetch !== true) {
+    await queryInfo()
   }
 
-  await queryInfo()
   setInterval(() => {
     queryInfo().catch(() => {
       // Already caught in `queryInfo`
diff --git a/src/util/phazeConfig.ts b/src/util/phazeConfig.ts
new file mode 100644
index 00000000000..8e87e2d08cd
--- /dev/null
+++ b/src/util/phazeConfig.ts
@@ -0,0 +1,16 @@
+import { asMaybe, asObject, asOptional, asString } from 'cleaners'
+
+import { pluginMaps } from '../pluginMaps'
+
+const asPhazeConfig = asMaybe(
+  asObject({
+    apiKey: asOptional(asString),
+    baseUrl: asOptional(asString)
+  })
+)
+
+export function getPhazeConfig():
+  | { apiKey?: string; baseUrl?: string }
+  | undefined {
+  return asPhazeConfig(pluginMaps.guiApiKeys.phaze) ?? undefined
+}
diff --git a/src/util/promoCardUtils.ts b/src/util/promoCardUtils.ts
index 10d59221378..fc34f096ed6 100644
--- a/src/util/promoCardUtils.ts
+++ b/src/util/promoCardUtils.ts
@@ -11,7 +11,7 @@ import {
 } from '../actions/LocalSettingsActions'
 import { getLocaleOrDefaultString } from '../locales/intl'
 import { type DisplayInfoCard, filterInfoCards } from './infoUtils'
-import { getOsVersion } from './utils'
+import { getOsVersion } from './rnUtils'
 
 /**
  * Generate a unique notification key for a promo card
diff --git a/src/util/rnUtils.ts b/src/util/rnUtils.ts
index 1b9b7e47e89..af56b73f053 100644
--- a/src/util/rnUtils.ts
+++ b/src/util/rnUtils.ts
@@ -1,3 +1,4 @@
+import DeviceInfo from 'react-native-device-info'
 import { generateSecureRandom } from 'react-native-securerandom'
 import { v4 } from 'uuid'
 
@@ -15,3 +16,14 @@ export const makeUuid = async (): Promise<string> => {
   const uuid = v4({ random: bytes })
   return uuid
 }
+
+/**
+ * Reads and normalizes the OS version.
+ */
+export function getOsVersion(): string {
+  const osVersionRaw = DeviceInfo.getSystemVersion()
+  return Array.from({ length: 3 }, (_, i) => {
+    const part = osVersionRaw.split('.')[i]
+    return part != null && part !== '' ? part : '0'
+  }).join('.')
+}
diff --git a/src/util/spamThreshold.ts b/src/util/spamThreshold.ts
new file mode 100644
index 00000000000..9fa16d4320a
--- /dev/null
+++ b/src/util/spamThreshold.ts
@@ -0,0 +1,64 @@
+import type { EdgeAccount, EdgeCurrencyWallet, EdgeTokenId } from 'edge-core-js'
+
+import { getExchangeDenom } from './exchangeDenom'
+import { getHistoricalCryptoRate } from './exchangeRates'
+import { readLocalAccountSettingsFromDisk } from './localAccountSettings'
+import { calculateSpamThreshold } from './utils'
+
+const SYNCED_SETTINGS_FILENAME = 'Settings.json'
+const DEFAULT_ISO_FIAT = 'iso:USD'
+
+/**
+ * Synced account Settings.json on account.disklet (not localDisklet).
+ * defaultIsoFiat defaults to iso:USD, matching asSyncedAccountSettings.
+ */
+export async function readDefaultIsoFiat(
+  account: EdgeAccount
+): Promise<string> {
+  try {
+    const text = await account.disklet.getText(SYNCED_SETTINGS_FILENAME)
+    const json = JSON.parse(text) as { defaultIsoFiat?: unknown }
+    if (typeof json.defaultIsoFiat === 'string' && json.defaultIsoFiat !== '') {
+      return json.defaultIsoFiat
+    }
+  } catch {
+    // missing or invalid — use default
+  }
+  return DEFAULT_ISO_FIAT
+}
+
+/**
+ * Same visibility rule as the GUI transaction list.
+ * An explicit query override wins. Otherwise honor spamFilterOn (default
+ * true) and calculateSpamThreshold from defaultIsoFiat + current rate.
+ * Missing rates yield `'0'`, matching calculateSpamThreshold.
+ */
+export async function resolveListSpamThreshold(opts: {
+  account: EdgeAccount
+  wallet: EdgeCurrencyWallet
+  tokenId: EdgeTokenId
+  queryOverride?: string
+}): Promise<string | undefined> {
+  if (opts.queryOverride !== undefined) {
+    return opts.queryOverride === '' ? '0' : opts.queryOverride
+  }
+
+  const settings = await readLocalAccountSettingsFromDisk(opts.account)
+  if (!settings.spamFilterOn) return undefined
+
+  const defaultIsoFiat = await readDefaultIsoFiat(opts.account)
+  const denom = getExchangeDenom(opts.wallet.currencyConfig, opts.tokenId)
+  let rate = 0
+  try {
+    rate = await getHistoricalCryptoRate(
+      opts.wallet.currencyInfo.pluginId,
+      opts.tokenId,
+      defaultIsoFiat,
+      new Date().toISOString()
+    )
+  } catch {
+    rate = 0
+  }
+  if (!Number.isFinite(rate)) rate = 0
+  return calculateSpamThreshold(rate, denom)
+}
diff --git a/src/util/tracking.ts b/src/util/tracking.ts
index eeb5a9b703e..c77de9fe2de 100644
--- a/src/util/tracking.ts
+++ b/src/util/tracking.ts
@@ -8,8 +8,9 @@ import { getBuildNumber, getVersion } from 'react-native-device-info'
 import { checkNotifications } from 'react-native-permissions'
 
 import { getFirstOpenInfo } from '../actions/FirstOpenActions'
-import { ENV } from '../env'
+import { CONFIG } from '../config'
 import { type ExperimentConfig, getExperimentConfig } from '../experimentConfig'
+import { KEYS } from '../keys'
 import type { ThunkAction } from '../types/reduxTypes'
 import { addMetadataToContext } from './addMetadataToContext'
 import type { CryptoAmount } from './CryptoAmount'
@@ -170,12 +171,22 @@ export interface TrackingValues extends LoginTrackingValues {
   _apiCryptoAmount?: string
 }
 
-// Set up the global Posthog analytics instance at boot
-if (ENV.POSTHOG_INIT != null) {
-  const { apiKey, apiHost } = ENV.POSTHOG_INIT
-
-  const posthogAsync: Promise<PostHog> = PostHog.initAsync(apiKey, {
-    host: apiHost
+// Set up the global Posthog analytics instance at boot.
+//
+// Host lives in config.json (`POSTHOG_API_HOST`); the api key lives in
+// keys.json as top-level `POSTHOG_API_KEY` (KEYS.POSTHOG_API_KEY). Either half
+// missing skips PostHog entirely — a realistic misconfiguration after the split.
+const posthogApiKey =
+  typeof KEYS.POSTHOG_API_KEY === 'string' && KEYS.POSTHOG_API_KEY !== ''
+    ? KEYS.POSTHOG_API_KEY
+    : undefined
+const posthogApiHost =
+  typeof CONFIG.POSTHOG_API_HOST === 'string' && CONFIG.POSTHOG_API_HOST !== ''
+    ? CONFIG.POSTHOG_API_HOST
+    : undefined
+if (posthogApiKey != null && posthogApiHost != null) {
+  const posthogAsync: Promise<PostHog> = PostHog.initAsync(posthogApiKey, {
+    host: posthogApiHost
   })
 
   posthogAsync
diff --git a/src/util/translateError.ts b/src/util/translateError.ts
index ed9f1378e14..31bc964fd43 100644
--- a/src/util/translateError.ts
+++ b/src/util/translateError.ts
@@ -1,6 +1,6 @@
 import { asEither, asObject, asString } from 'cleaners'
 
-import { ENV } from '../env'
+import { CONFIG } from '../config'
 import {
   PaymentProtoError,
   translatePaymentProtoError
@@ -23,7 +23,11 @@ const asErrorMessage = asEither(
  */
 export function makeErrorLog(error: unknown): string {
   let message = asErrorMessage(error)
-  if (ENV.DEBUG_CORE || ENV.DEBUG_PLUGINS || ENV.DEBUG_VERBOSE_LOGGING) {
+  if (
+    CONFIG.DEBUG_CORE ||
+    CONFIG.DEBUG_PLUGINS ||
+    CONFIG.DEBUG_VERBOSE_LOGGING
+  ) {
     if (error instanceof Error) message += `\n${error.stack}`
     message += `\n${JSON.stringify(error, null, 2)}`
   }
diff --git a/src/util/txDisplay/category.ts b/src/util/txDisplay/category.ts
new file mode 100644
index 00000000000..8366a4dac62
--- /dev/null
+++ b/src/util/txDisplay/category.ts
@@ -0,0 +1,57 @@
+export type Category = 'transfer' | 'exchange' | 'expense' | 'income'
+
+export interface EdgeCategory {
+  category: Category
+  subcategory: string
+}
+
+const prefixes: Record<Category, string> = {
+  transfer: 'Transfer:',
+  exchange: 'Exchange:',
+  expense: 'Expense:',
+  income: 'Income:'
+}
+
+const tests: Array<[Category, RegExp, number]> = [
+  ['transfer', /^Transfer:/i, 9],
+  ['exchange', /^Exchange:/i, 9],
+  ['expense', /^Expense:/i, 8],
+  ['income', /^Income:/i, 7]
+]
+
+/**
+ * Splits a string into its category and subcategory strings.
+ * The category must fit our enum type, or we will use a fallback.
+ * The subcategory can be localized and freely edited.
+ */
+export function splitCategory(
+  fullCategory: string = '',
+  defaultCategory: Category = 'income'
+): EdgeCategory {
+  if (fullCategory.length > 0 && !fullCategory.includes(':')) {
+    fullCategory += ':'
+  }
+  for (const [category, test, n] of tests) {
+    if (test.test(fullCategory)) {
+      return {
+        category,
+        subcategory: fullCategory.slice(n)
+      }
+    }
+  }
+
+  // We can't guarantee that data on disk is correct,
+  // but this should usually never happen:
+  return {
+    category: defaultCategory,
+    subcategory: fullCategory.replace(/^[^:]:/, '')
+  }
+}
+
+/**
+ * Combine the category and subcategory into a single string,
+ * with the correct capitalization.
+ */
+export function joinCategory(split: EdgeCategory): string {
+  return prefixes[split.category] + split.subcategory
+}
diff --git a/src/util/txDisplay/currencyCodes.ts b/src/util/txDisplay/currencyCodes.ts
new file mode 100644
index 00000000000..3df46ca2f5d
--- /dev/null
+++ b/src/util/txDisplay/currencyCodes.ts
@@ -0,0 +1,22 @@
+import type { EdgeAccount, EdgeTokenId } from 'edge-core-js'
+
+export const getCurrencyCodeWithAccount = (
+  account: EdgeAccount,
+  pluginId: string,
+  tokenId: EdgeTokenId
+): string | undefined => {
+  if (account.currencyConfig[pluginId] == null) {
+    return
+  }
+
+  if (tokenId == null) {
+    return account.currencyConfig[pluginId].currencyInfo.currencyCode
+  }
+  if (account.currencyConfig[pluginId].allTokens[tokenId] == null) {
+    console.warn(
+      `getCurrencyCodeWithAccount: tokenId: '${tokenId}' not found for pluginId: '${pluginId}'`
+    )
+    return ''
+  }
+  return account.currencyConfig[pluginId].allTokens[tokenId].currencyCode
+}
diff --git a/src/util/txDisplay/displayInfo.ts b/src/util/txDisplay/displayInfo.ts
new file mode 100644
index 00000000000..7d5dbf3bd31
--- /dev/null
+++ b/src/util/txDisplay/displayInfo.ts
@@ -0,0 +1,473 @@
+import { eq } from 'biggystring'
+import type {
+  EdgeAccount,
+  EdgeAssetAction,
+  EdgeAssetAmount,
+  EdgeCurrencyWallet,
+  EdgeMetadata,
+  EdgeTransaction,
+  EdgeTxAction
+} from 'edge-core-js'
+import { sprintf } from 'sprintf-js'
+
+import { lstrings } from '../../locales/strings'
+import { removeIsoPrefix } from '../fiatConstants'
+import { type EdgeCategory, joinCategory } from './category'
+import { getCurrencyCodeWithAccount } from './currencyCodes'
+import { TX_ACTION_LABEL_MAP } from './txActionLabels'
+
+/**
+ * Given an EdgeTxAction, returns the display value for pre-filling the
+ * 'Category' and 'Notes' tiles, if they are not already user-modified.
+ */
+export interface ActionDisplayInfo {
+  direction: 'send' | 'receive'
+  iconPluginId?: string
+  userData: EdgeMetadata
+  savedData: EdgeMetadata
+  mergedData: EdgeMetadata
+  action?: EdgeTxAction
+  assetAction?: EdgeAssetAction
+}
+
+/**
+ * Takes any form of fiat currency code and returns a version with and without
+ * the "iso:" prefix. Local copy so displayInfo stays off CurrencyWalletHelpers
+ * (Airship / react-native).
+ */
+function cleanFiatCurrencyCode(fiatCurrencyCode: string): {
+  fiatCurrencyCode: string
+  isoFiatCurrencyCode: string
+} {
+  if (fiatCurrencyCode.startsWith('iso:')) {
+    return {
+      fiatCurrencyCode: removeIsoPrefix(fiatCurrencyCode),
+      isoFiatCurrencyCode: fiatCurrencyCode
+    }
+  }
+  return { fiatCurrencyCode, isoFiatCurrencyCode: `iso:${fiatCurrencyCode}` }
+}
+
+/**
+ * Overlay GUI-computed display name/category/notes onto `tx.metadata` for
+ * API responses. Does not persist. Keeps existing exchangeAmount and other
+ * fields that `getTxActionDisplayInfo` does not own.
+ */
+export const fillTxMetadataForDisplay = (
+  tx: EdgeTransaction,
+  mergedData: EdgeMetadata
+): EdgeTransaction => ({
+  ...tx,
+  metadata: {
+    ...tx.metadata,
+    name: mergedData.name,
+    category: mergedData.category,
+    notes: mergedData.notes
+  }
+})
+
+export const getTxActionDisplayInfo = (
+  tx: EdgeTransaction,
+  account: EdgeAccount,
+  wallet: EdgeCurrencyWallet
+): ActionDisplayInfo => {
+  const {
+    assetAction,
+    chainAction,
+    chainAssetAction,
+    metadata,
+    savedAction,
+    swapData,
+    tokenId
+  } = tx
+  const { currencyConfig, currencyInfo } = wallet
+
+  const displayName =
+    tokenId == null
+      ? currencyInfo.assetDisplayName
+      : currencyConfig.allTokens[tokenId]?.displayName ?? ''
+
+  const action = savedAction ?? chainAction
+  const assetAct = assetAction ?? chainAssetAction
+
+  const getCurrencyCodes = (assets: EdgeAssetAmount[]): string[] =>
+    assets
+      .map(asset =>
+        getCurrencyCodeWithAccount(account, asset.pluginId, asset.tokenId)
+      )
+      .filter((currencyCode): currencyCode is string => currencyCode != null)
+
+  const isSentTransaction =
+    tx.nativeAmount.startsWith('-') || (eq(tx.nativeAmount, '0') && tx.isSend)
+
+  let payeeText: string | undefined
+  let edgeCategory: EdgeCategory
+  let direction: 'send' | 'receive'
+  let notes: string | undefined
+  let iconPluginId: string | undefined
+
+  // Default text for send or receive
+  if (isSentTransaction) {
+    payeeText = sprintf(lstrings.transaction_sent_1s, displayName)
+    direction = 'send'
+    edgeCategory = {
+      category: 'expense',
+      subcategory: ''
+    }
+  } else {
+    payeeText = sprintf(lstrings.transaction_received_1s, displayName)
+    direction = 'receive'
+    edgeCategory = {
+      category: 'income',
+      subcategory: ''
+    }
+  }
+
+  // Override with swapData
+  if (swapData != null) {
+    const { payoutCurrencyCode } = swapData
+    payeeText = sprintf(
+      lstrings.transaction_details_swap_to_subcat_1s,
+      payoutCurrencyCode
+    )
+  }
+
+  if (action != null && assetAct != null) {
+    const { actionType } = action
+    const { assetActionType } = assetAct
+    payeeText = TX_ACTION_LABEL_MAP[assetActionType]
+
+    let unsupported = false
+
+    switch (actionType) {
+      case 'swap': {
+        iconPluginId = action.swapInfo.pluginId
+        switch (assetActionType) {
+          case 'transfer': {
+            const txSrc = action.payoutWalletId !== wallet.id
+            const toFromStr = txSrc
+              ? lstrings.transaction_details_swap_to_subcat_1s
+              : lstrings.transaction_details_swap_from_subcat_1s
+            const walletName =
+              account.currencyWallets[action.payoutWalletId]?.name ??
+              displayName
+            edgeCategory = {
+              category: 'transfer',
+              subcategory: sprintf(toFromStr, walletName)
+            }
+            break
+          }
+          case 'transferNetworkFee':
+          case 'swapNetworkFee': {
+            edgeCategory = {
+              category: 'expense',
+              subcategory: lstrings.wc_smartcontract_network_fee
+            }
+            break
+          }
+          case 'swap':
+          case 'swapOrderFill': {
+            // Determine if the swap destination was to a different asset or if the
+            // swap source was from a different asset.
+            const txSrcSameAsset =
+              action.fromAsset.tokenId === tokenId &&
+              action.fromAsset.pluginId === wallet.currencyInfo.pluginId
+            const toFromStr = txSrcSameAsset
+              ? lstrings.transaction_details_swap_to_subcat_1s
+              : lstrings.transaction_details_swap_from_subcat_1s
+            const otherAsset = txSrcSameAsset
+              ? action.toAsset
+              : action.fromAsset
+
+            edgeCategory = {
+              category: 'exchange',
+              subcategory: sprintf(
+                toFromStr,
+                getCurrencyCodeWithAccount(
+                  account,
+                  otherAsset.pluginId,
+                  otherAsset.tokenId
+                )
+              )
+            }
+            direction = txSrcSameAsset ? 'send' : 'receive'
+            break
+          }
+
+          case 'swapOrderPost': {
+            edgeCategory = {
+              category: 'expense',
+              subcategory: sprintf(lstrings.transaction_details_swap_order_post)
+            }
+            direction = 'send'
+            break
+          }
+          case 'swapOrderCancel': {
+            edgeCategory = {
+              category: 'expense',
+              subcategory: sprintf(
+                lstrings.transaction_details_swap_order_cancel
+              )
+            }
+            direction = 'send'
+            break
+          }
+          default:
+            unsupported = true
+        }
+        break
+      }
+      case 'stake': {
+        iconPluginId = action.pluginId
+        switch (assetActionType) {
+          case 'stake': {
+            let subcategory
+            if (action.stakeAssets.length === 1)
+              subcategory = sprintf(
+                lstrings.transaction_details_stake_subcat_1s,
+                ...getCurrencyCodes(action.stakeAssets)
+              )
+            else if (action.stakeAssets.length === 2)
+              subcategory = sprintf(
+                lstrings.transaction_details_stake_subcat_2s,
+                ...getCurrencyCodes(action.stakeAssets)
+              )
+            else {
+              console.warn(
+                `Unsupported number of assets for '${assetActionType}' EdgeTxActionSwapType`
+              )
+              break
+            }
+            edgeCategory = { category: 'transfer', subcategory }
+            direction = 'send'
+            break
+          }
+          case 'stakeOrder': {
+            if (action.stakeAssets.length === 1)
+              notes = sprintf(
+                lstrings.transaction_details_unstake_order_notes_1s,
+                ...getCurrencyCodes(action.stakeAssets)
+              )
+            else if (action.stakeAssets.length === 2)
+              notes = sprintf(
+                lstrings.transaction_details_unstake_order_notes_2s,
+                ...getCurrencyCodes(action.stakeAssets)
+              )
+            else {
+              console.error(
+                `Unsupported number of assets for '${assetActionType}' EdgeTxActionSwapType`
+              )
+              break
+            }
+
+            edgeCategory = {
+              category: 'expense',
+              subcategory: lstrings.transaction_details_stake_order_subcat
+            }
+            direction = 'send'
+            break
+          }
+          case 'claim': {
+            let subcategory
+            if (action.stakeAssets.length === 1)
+              subcategory = sprintf(
+                lstrings.transaction_details_unstake_subcat_1s,
+                ...getCurrencyCodes(action.stakeAssets)
+              )
+            else if (action.stakeAssets.length === 2)
+              subcategory = sprintf(
+                lstrings.transaction_details_unstake_subcat_2s,
+                ...getCurrencyCodes(action.stakeAssets)
+              )
+            else {
+              console.error(
+                `Unsupported number of assets for '${assetActionType}' EdgeTxActionSwapType`
+              )
+              break
+            }
+            edgeCategory = { category: 'transfer', subcategory }
+            if (
+              action.stakeAssets.every(
+                asset => asset.pluginId === currencyInfo.pluginId
+              )
+            ) {
+              direction = 'receive'
+            } else {
+              direction = 'send'
+            }
+            break
+          }
+          case 'unstake': {
+            let subcategory
+            if (action.stakeAssets.length === 1)
+              subcategory = sprintf(
+                lstrings.transaction_details_unstake_subcat_1s,
+                ...getCurrencyCodes(action.stakeAssets)
+              )
+            else if (action.stakeAssets.length === 2)
+              subcategory = sprintf(
+                lstrings.transaction_details_unstake_subcat_2s,
+                ...getCurrencyCodes(action.stakeAssets)
+              )
+            else {
+              console.error(
+                `Unsupported number of assets for '${assetActionType}' EdgeTxActionSwapType`
+              )
+              break
+            }
+            edgeCategory = { category: 'transfer', subcategory }
+            direction = 'receive'
+            break
+          }
+          case 'claimOrder':
+          case 'unstakeOrder': {
+            if (action.stakeAssets.length === 1)
+              notes = sprintf(
+                lstrings.transaction_details_unstake_order_notes_1s,
+                ...getCurrencyCodes(action.stakeAssets)
+              )
+            else if (action.stakeAssets.length === 2)
+              notes = sprintf(
+                lstrings.transaction_details_unstake_order_notes_2s,
+                ...getCurrencyCodes(action.stakeAssets)
+              )
+            else {
+              console.error(
+                `Unsupported number of assets for '${assetActionType}' EdgeTxActionSwapType`
+              )
+              break
+            }
+
+            edgeCategory = {
+              category: 'expense',
+              subcategory: lstrings.transaction_details_unstake_order
+            }
+            direction = 'send'
+            break
+          }
+          case 'unstakeNetworkFee':
+          case 'stakeNetworkFee': {
+            edgeCategory = {
+              category: 'expense',
+              subcategory: lstrings.wc_smartcontract_network_fee
+            }
+            break
+          }
+
+          default:
+            unsupported = true
+        }
+        break
+      }
+      case 'fiat': {
+        iconPluginId = action.fiatPlugin.providerId
+        switch (assetActionType) {
+          case 'buy': {
+            payeeText = sprintf(payeeText, displayName)
+            const { fiatAsset } = action
+            const { fiatCurrencyCode } = cleanFiatCurrencyCode(
+              fiatAsset.fiatCurrencyCode
+            )
+            edgeCategory = {
+              category: 'exchange',
+              subcategory: sprintf(
+                lstrings.transaction_details_swap_from_subcat_1s,
+                fiatCurrencyCode
+              )
+            }
+            direction = 'receive'
+            break
+          }
+          case 'sell': {
+            payeeText = sprintf(payeeText, displayName)
+            const { fiatAsset } = action
+            const { fiatCurrencyCode } = cleanFiatCurrencyCode(
+              fiatAsset.fiatCurrencyCode
+            )
+            edgeCategory = {
+              category: 'exchange',
+              subcategory: sprintf(
+                lstrings.transaction_details_swap_to_subcat_1s,
+                fiatCurrencyCode
+              )
+            }
+            direction = 'send'
+            break
+          }
+          case 'sellNetworkFee': {
+            edgeCategory = {
+              category: 'expense',
+              subcategory: lstrings.wc_smartcontract_network_fee
+            }
+            direction = 'send'
+            break
+          }
+          default:
+            unsupported = true
+        }
+        break
+      }
+      case 'tokenApproval': {
+        switch (assetActionType) {
+          case 'tokenApproval': {
+            edgeCategory = {
+              category: 'expense',
+              subcategory: lstrings.wc_smartcontract_network_fee
+            }
+            break
+          }
+          default:
+            unsupported = true
+        }
+        break
+      }
+      case 'giftCard': {
+        iconPluginId = action.provider.providerId
+        payeeText = lstrings.gift_card_recipient_name
+        edgeCategory = {
+          category: 'expense',
+          subcategory: action.card.name
+        }
+        direction = 'send'
+        break
+      }
+      default:
+        unsupported = true
+    }
+
+    if (unsupported)
+      console.error(
+        `Unsupported EdgeTxAction assetAction:assetActionType '${assetActionType}'`
+      )
+  }
+  const savedData: EdgeMetadata = {
+    name: payeeText,
+    category: joinCategory(edgeCategory),
+    notes
+  }
+
+  const mergedData: EdgeMetadata = {
+    name:
+      metadata?.name != null && metadata.name.length > 0
+        ? metadata.name
+        : savedData.name,
+    category:
+      metadata?.category != null && metadata.category.length > 0
+        ? metadata.category
+        : savedData.category,
+    notes:
+      metadata?.notes != null && metadata.notes.length > 0
+        ? metadata.notes
+        : savedData.notes
+  }
+
+  return {
+    action,
+    assetAction,
+    direction,
+    iconPluginId,
+    savedData,
+    userData: metadata ?? {},
+    mergedData
+  }
+}
diff --git a/src/util/txDisplay/index.ts b/src/util/txDisplay/index.ts
new file mode 100644
index 00000000000..a045dc22cdc
--- /dev/null
+++ b/src/util/txDisplay/index.ts
@@ -0,0 +1,6 @@
+export type { Category, EdgeCategory } from './category'
+export { joinCategory, splitCategory } from './category'
+export { getCurrencyCodeWithAccount } from './currencyCodes'
+export type { ActionDisplayInfo } from './displayInfo'
+export { fillTxMetadataForDisplay, getTxActionDisplayInfo } from './displayInfo'
+export { TX_ACTION_LABEL_MAP } from './txActionLabels'
diff --git a/src/util/txDisplay/txActionLabels.ts b/src/util/txDisplay/txActionLabels.ts
new file mode 100644
index 00000000000..f4fa311fa0a
--- /dev/null
+++ b/src/util/txDisplay/txActionLabels.ts
@@ -0,0 +1,26 @@
+import type { EdgeAssetActionType } from 'edge-core-js'
+
+import { lstrings } from '../../locales/strings'
+
+export const TX_ACTION_LABEL_MAP: Record<EdgeAssetActionType, string> = {
+  buy: lstrings.transaction_details_bought_1s,
+  claim: lstrings.transaction_details_claim,
+  claimOrder: lstrings.transaction_details_claim_order,
+  giftCard: lstrings.transaction_details_gift_card,
+  sell: lstrings.transaction_details_sold_1s,
+  sellNetworkFee: lstrings.fiat_plugin_sell_network_fee,
+  swap: lstrings.transaction_details_swap,
+  swapNetworkFee: lstrings.transaction_details_swap_network_fee,
+  swapOrderPost: lstrings.transaction_details_swap_order_post,
+  swapOrderFill: lstrings.transaction_details_swap_order_fill,
+  swapOrderCancel: lstrings.transaction_details_swap_order_cancel,
+  stake: lstrings.transaction_details_stake,
+  stakeNetworkFee: lstrings.transaction_details_stake_network_fee,
+  stakeOrder: lstrings.transaction_details_stake_order,
+  tokenApproval: lstrings.transaction_details_token_approval,
+  transfer: lstrings.transaction_details_transfer_funds,
+  transferNetworkFee: lstrings.transaction_details_transfer_network_fee,
+  unstake: lstrings.transaction_details_unstake,
+  unstakeNetworkFee: lstrings.transaction_details_unstake_network_fee,
+  unstakeOrder: lstrings.transaction_details_unstake_order
+}
diff --git a/src/util/txExport/format.ts b/src/util/txExport/format.ts
new file mode 100644
index 00000000000..c7958e45834
--- /dev/null
+++ b/src/util/txExport/format.ts
@@ -0,0 +1,462 @@
+import { abs, add, div, gt, lt, mul } from 'biggystring'
+import csvStringify from 'csv-stringify/lib/browser/sync'
+import type { EdgeCurrencyWallet, EdgeTransaction } from 'edge-core-js'
+import shajs from 'sha.js'
+
+import { DECIMAL_PRECISION } from '../utils'
+
+export async function exportTransactionsToCSV(
+  wallet: EdgeCurrencyWallet,
+  defaultIsoFiat: string,
+  txs: EdgeTransaction[],
+  currencyCode: string,
+  denomination?: string
+): Promise<string> {
+  let denomName = ''
+  if (denomination != null) {
+    const denomObj = wallet.currencyInfo.denominations.find(
+      edgeDenom => edgeDenom.multiplier === denomination
+    )
+    if (denomObj != null) denomName = denomObj.name
+  }
+  return exportTransactionsToCSVInner(
+    txs,
+    currencyCode,
+    defaultIsoFiat,
+    denomination,
+    denomName
+  )
+}
+
+function padZero(val: string): string {
+  if (val.length === 1) {
+    return '0' + val
+  }
+  return val
+}
+
+function escapeOFXString(str: string): string {
+  str = str.replace(/&/g, '&amp;')
+  str = str.replace(/>/g, '&gt;')
+  return str.replace(/</g, '&lt;')
+}
+
+function exportOfxHeader(inputObj: any): string {
+  let out = ''
+  for (const key of Object.keys(inputObj)) {
+    let element = inputObj[key]
+    if (typeof element === 'string') {
+      element = escapeOFXString(element)
+      out += `${key}:${element}\n`
+    } else {
+      throw new Error('Invalid OFX header')
+    }
+  }
+  return out
+}
+
+function exportOfxBody(inputObj: any): string {
+  let out = ''
+  for (const key of Object.keys(inputObj)) {
+    let element = inputObj[key]
+    if (typeof element === 'string') {
+      element = escapeOFXString(element)
+      out += `<${key}>${element}\n`
+    } else if (element instanceof Array) {
+      for (const a of element) {
+        out += `<${key}>\n`
+        out += exportOfxBody(a)
+        out += `</${key}>\n`
+      }
+    } else if (typeof element === 'object') {
+      out += `<${key}>\n`
+      out += exportOfxBody(element)
+      out += `</${key}>\n`
+    } else {
+      throw new Error('Invalid OFX body')
+    }
+  }
+  return out
+}
+
+function exportOfx(header: any, body: any): string {
+  let out = exportOfxHeader(header) + '\n'
+  out += '<OFX>\n'
+  out += exportOfxBody(body)
+  out += '</OFX>\n'
+  return out
+}
+
+function makeOfxDate(date: number): string {
+  const d = new Date(date * 1000)
+  const yyyy = d.getUTCFullYear().toString()
+  const mm = padZero((d.getUTCMonth() + 1).toString())
+  const dd = padZero(d.getUTCDate().toString())
+  const hh = padZero(d.getUTCHours().toString())
+  const min = padZero(d.getUTCMinutes().toString())
+  const ss = padZero(d.getUTCSeconds().toString())
+  return `${yyyy}${mm}${dd}${hh}${min}${ss}.000`
+}
+
+function makeCsvDateTime(date: number): { date: string; time: string } {
+  const d = new Date(date * 1000)
+  const yyyy = d.getUTCFullYear().toString()
+  const mm = padZero((d.getUTCMonth() + 1).toString())
+  const dd = padZero(d.getUTCDate().toString())
+  const hh = padZero(d.getUTCHours().toString())
+  const min = padZero(d.getUTCMinutes().toString())
+
+  return {
+    date: `${yyyy}-${mm}-${dd}`,
+    time: `${hh}:${min}`
+  }
+}
+
+/** ISO 8601 UTC, the timestamp format Bitwave requires for imports. */
+function makeBitwaveDateTime(date: number): string {
+  const d = new Date(date * 1000)
+  const yyyy = d.getUTCFullYear().toString()
+  const mm = padZero((d.getUTCMonth() + 1).toString())
+  const dd = padZero(d.getUTCDate().toString())
+  const hh = padZero(d.getUTCHours().toString())
+  const min = padZero(d.getUTCMinutes().toString())
+  const ss = padZero(d.getUTCSeconds().toString())
+
+  return `${yyyy}-${mm}-${dd}T${hh}:${min}:${ss}Z`
+}
+
+//
+// Check if tx is
+// 1. A transfer
+// 2. Outgoing spend
+// 3. Has a network fee
+// If so:
+//  1. Modify transaction to reduce the nativeAmount by the networkFee
+//  2. Set networkFee to 0
+//  3. Return a new transaction that has:
+//      1. nativeAmount and networkFee set to original tx fee
+//      2. category set to 'Expense:Network Fee'
+//      3. txid set to old txid + '-TRANSFER_TX'
+
+export function getTransferTx(
+  oldEdgeTransaction: EdgeTransaction,
+  fiatCurrencyCode: string
+): EdgeTransaction[] | null {
+  const edgeTransaction = { ...oldEdgeTransaction }
+  edgeTransaction.metadata = { ...oldEdgeTransaction.metadata }
+
+  const category = edgeTransaction.metadata?.category ?? ''
+  if (!category.toLowerCase().startsWith('transfer:')) return null
+  if (!lt(edgeTransaction.nativeAmount, '0')) return null
+  if (!gt(edgeTransaction.networkFee, '0')) return null
+
+  const nativeAmountNoFee = add(
+    edgeTransaction.nativeAmount,
+    edgeTransaction.networkFee
+  )
+  let newTxFiatFee = 0
+  let amountFiat =
+    edgeTransaction.metadata?.exchangeAmount?.[fiatCurrencyCode] ?? 0
+
+  if (amountFiat > 0) {
+    const exchangeRate: string = div(
+      amountFiat.toString(),
+      edgeTransaction.nativeAmount,
+      16
+    )
+    const newTxFiatFeeString: string = mul(
+      exchangeRate,
+      edgeTransaction.networkFee
+    )
+    newTxFiatFee = Math.abs(Number(newTxFiatFeeString))
+    amountFiat = Number(mul(exchangeRate, nativeAmountNoFee))
+  }
+
+  const newEdgeTransaction: EdgeTransaction = { ...edgeTransaction }
+  newEdgeTransaction.nativeAmount = `-${edgeTransaction.networkFee}`
+  newEdgeTransaction.metadata = {
+    ...edgeTransaction.metadata,
+    category: `Expense:Network Fee`,
+    exchangeAmount: {
+      ...edgeTransaction.metadata?.exchangeAmount,
+      [fiatCurrencyCode]: newTxFiatFee
+    }
+  }
+  newEdgeTransaction.txid += '-TRANSFER_TX'
+  edgeTransaction.nativeAmount = nativeAmountNoFee
+  edgeTransaction.networkFee = '0'
+  edgeTransaction.metadata = {
+    ...edgeTransaction.metadata,
+    exchangeAmount: {
+      ...edgeTransaction.metadata?.exchangeAmount,
+      [fiatCurrencyCode]: amountFiat
+    }
+  }
+  return [edgeTransaction, newEdgeTransaction]
+}
+
+export function exportTransactionsToQBO(
+  edgeTransactions: EdgeTransaction[],
+  fiatCurrencyCode: string,
+  denom: string | undefined,
+  /** For unit testing */
+  testDateNow?: number
+): string {
+  const STMTTRN: any[] = []
+  const now = makeOfxDate((testDateNow ?? Date.now()) / 1000)
+  const hasDenom = denom != null
+
+  for (const tx of edgeTransactions) {
+    const newTxs = getTransferTx(tx, fiatCurrencyCode)
+    if (newTxs != null) {
+      edgeTxToQbo(newTxs[0])
+      edgeTxToQbo(newTxs[1])
+    } else {
+      edgeTxToQbo(tx)
+    }
+  }
+
+  function edgeTxToQbo(edgeTx: EdgeTransaction): void {
+    const TRNAMT: string = hasDenom
+      ? div(edgeTx.nativeAmount, denom, DECIMAL_PRECISION)
+      : edgeTx.nativeAmount
+    const TRNTYPE = lt(edgeTx.nativeAmount, '0') ? 'DEBIT' : 'CREDIT'
+    const DTPOSTED = makeOfxDate(edgeTx.date)
+    const NAME: string = edgeTx.metadata?.name ?? ''
+    const amountFiat: number =
+      edgeTx.metadata?.exchangeAmount?.[fiatCurrencyCode] ?? 0
+    const category: string = edgeTx.metadata?.category ?? ''
+    const notes: string = edgeTx.metadata?.notes ?? ''
+
+    const absFiat = abs(amountFiat.toString())
+    const absAmount = abs(TRNAMT)
+    const CURRATE = absAmount !== '0' ? div(absFiat, absAmount, 8) : '0'
+    let memo = `// Rate=${CURRATE} ${fiatCurrencyCode}=${amountFiat} category="${category}" memo="${notes}"`
+    if (memo.length > 250) {
+      memo = memo.substring(0, 250) + '...'
+    }
+    const qboTxNamed = {
+      TRNTYPE,
+      DTPOSTED,
+      TRNAMT,
+      FITID: edgeTx.txid,
+      NAME,
+      MEMO: memo,
+      CURRENCY: {
+        CURRATE,
+        CURSYM: fiatCurrencyCode
+      }
+    }
+    const qboTx = {
+      TRNTYPE,
+      DTPOSTED,
+      TRNAMT,
+      FITID: edgeTx.txid,
+      MEMO: memo,
+      CURRENCY: {
+        CURRATE,
+        CURSYM: fiatCurrencyCode
+      }
+    }
+    const use = NAME === '' ? qboTx : qboTxNamed
+    STMTTRN.push(use)
+  }
+
+  const header = {
+    OFXHEADER: '100',
+    DATA: 'OFXSGML',
+    VERSION: '102',
+    SECURITY: 'NONE',
+    ENCODING: 'USASCII',
+    CHARSET: '1252',
+    COMPRESSION: 'NONE',
+    OLDFILEUID: 'NONE',
+    NEWFILEUID: 'NONE'
+  }
+
+  const body = {
+    SIGNONMSGSRSV1: {
+      SONRS: {
+        STATUS: {
+          CODE: '0',
+          SEVERITY: 'INFO'
+        },
+        DTSERVER: now,
+        LANGUAGE: 'ENG',
+        'INTU.BID': '3000'
+      }
+    },
+    BANKMSGSRSV1: {
+      STMTTRNRS: {
+        TRNUID: now,
+        STATUS: {
+          CODE: '0',
+          SEVERITY: 'INFO',
+          MESSAGE: 'OK'
+        },
+        STMTRS: {
+          CURDEF: 'USD',
+          BANKACCTFROM: {
+            BANKID: '999999999',
+            ACCTID: '999999999999',
+            ACCTTYPE: 'CHECKING'
+          },
+          BANKTRANLIST: {
+            DTSTART: now,
+            DTEND: now,
+            STMTTRN
+          },
+          LEDGERBAL: {
+            BALAMT: '0.00',
+            DTASOF: now
+          },
+          AVAILBAL: {
+            BALAMT: '0.00',
+            DTASOF: now
+          }
+        }
+      }
+    }
+  }
+
+  return exportOfx(header, body)
+}
+
+export function exportTransactionsToCSVInner(
+  edgeTransactions: EdgeTransaction[],
+  currencyCode: string,
+  fiatCurrencyCode: string,
+  denom?: string,
+  denomName: string = ''
+): string {
+  const items: any[] = []
+  const hasDenom = denom != null
+
+  for (const tx of edgeTransactions) {
+    const newTxs = getTransferTx(tx, fiatCurrencyCode)
+    if (newTxs != null) {
+      edgeTxToCsv(newTxs[0])
+      edgeTxToCsv(newTxs[1])
+    } else {
+      edgeTxToCsv(tx)
+    }
+  }
+
+  function edgeTxToCsv(edgeTx: EdgeTransaction): void {
+    const amount: string = hasDenom
+      ? div(edgeTx.nativeAmount, denom, DECIMAL_PRECISION)
+      : edgeTx.nativeAmount
+    const networkFeeField: string = hasDenom
+      ? div(edgeTx.networkFee, denom, DECIMAL_PRECISION)
+      : edgeTx.networkFee
+    const { date, time } = makeCsvDateTime(edgeTx.date)
+    const name: string = edgeTx.metadata?.name ?? ''
+    const amountFiat: number =
+      edgeTx.metadata?.exchangeAmount?.[fiatCurrencyCode] ?? 0
+    const category: string = edgeTx.metadata?.category ?? ''
+    const notes: string = edgeTx.metadata?.notes ?? ''
+
+    items.push({
+      CURRENCY_CODE: currencyCode,
+      DATE: date,
+      TIME: time,
+      PAYEE_PAYER_NAME: name,
+      AMT_ASSET: amount,
+      DENOMINATION: denomName,
+      [fiatCurrencyCode]: String(amountFiat),
+      CATEGORY: category,
+      NOTES: notes,
+      AMT_NETWORK_FEES_ASSET: networkFeeField,
+      TXID: edgeTx.txid,
+      OUR_RECEIVE_ADDRESSES: edgeTx.ourReceiveAddresses.join(','),
+      VER: 1,
+      DEVICE_DESCRIPTION: edgeTx.deviceDescription ?? ''
+    })
+  }
+
+  return csvStringify(items, {
+    header: true,
+    quoted_string: true,
+    record_delimiter: '\n'
+  })
+}
+
+export async function exportTransactionsToBitwave(
+  accountId: string,
+  edgeTransactions: EdgeTransaction[],
+  currencyCode: string,
+  multiplier: string
+): Promise<string> {
+  const items: any[] = []
+
+  for (const tx of edgeTransactions) {
+    edgeTxToCsv(tx)
+  }
+
+  function edgeTxToCsv(edgeTx: EdgeTransaction): void {
+    const {
+      date,
+      isSend,
+      metadata,
+      nativeAmount,
+      networkFee,
+      ourReceiveAddresses,
+      spendTargets,
+      txid
+    } = edgeTx
+    const amount: string = abs(div(nativeAmount, multiplier, DECIMAL_PRECISION))
+    const time = makeBitwaveDateTime(date)
+    const { name = '', category = '', notes = '' } = metadata ?? {}
+
+    let toAddress = ''
+    if (isSend) {
+      if (spendTargets != null && spendTargets.length > 0) {
+        // We can only choose 1 `toAddress` so pick the first spendTarget
+        toAddress = spendTargets[0].publicAddress
+      }
+    } else {
+      // We can only choose 1 `toAddress` so pick the first receive address
+      toAddress = ourReceiveAddresses != null ? ourReceiveAddresses[0] : ''
+    }
+
+    const id = shajs('sha256')
+      .update(`${txid}_${nativeAmount}_${networkFee}_${toAddress}`)
+      .digest('hex')
+      .slice(0, 16)
+
+    items.push({
+      id,
+      remoteContactId: '',
+      amount,
+      amountTicker: currencyCode,
+      cost: '',
+      costTicker: '',
+      // Bitwave calculates transaction fees on its own side. Exporting them
+      // here duplicates the fees after import, so both columns stay blank:
+      fee: '',
+      feeTicker: '',
+      time,
+      blockchainId: txid,
+      memo: notes,
+      transactionType: isSend ? 'withdrawal' : 'deposit',
+      accountId,
+      contactId: '',
+      categoryId: '',
+      taxExempt: 'FALSE',
+      tradeId: '',
+      description: name,
+      fromAddress: '',
+      toAddress,
+      groupId: '',
+      'metadata:myCustomMetadata1': category,
+      // Bitwave expects this to mirror the description column:
+      'metadata:myCustomMetadata2': name
+    })
+  }
+
+  return csvStringify(items, {
+    header: true,
+    quoted_string: true,
+    record_delimiter: '\n'
+  })
+}
diff --git a/src/util/txExport/index.ts b/src/util/txExport/index.ts
new file mode 100644
index 00000000000..e8852bd9bec
--- /dev/null
+++ b/src/util/txExport/index.ts
@@ -0,0 +1,32 @@
+export {
+  exportTransactionsToBitwave,
+  exportTransactionsToCSV,
+  exportTransactionsToCSVInner,
+  exportTransactionsToQBO,
+  getTransferTx
+} from './format'
+
+export const TX_EXPORT_FORMATS = ['csv', 'qbo', 'bitwave'] as const
+export type TxExportFormat = (typeof TX_EXPORT_FORMATS)[number]
+
+/**
+ * Parse a comma-separated exportFormat query/flag.
+ * Empty / omitted → `[]`. Unknown tokens throw.
+ */
+export function parseExportFormats(raw: string | undefined): TxExportFormat[] {
+  if (raw == null) return []
+  const parts = raw
+    .split(',')
+    .map(part => part.trim().toLowerCase())
+    .filter(part => part !== '')
+  const formats: TxExportFormat[] = []
+  for (const part of parts) {
+    if (!TX_EXPORT_FORMATS.includes(part as TxExportFormat)) {
+      throw new Error(`Unknown exportFormat "${part}"`)
+    }
+    if (!formats.includes(part as TxExportFormat)) {
+      formats.push(part as TxExportFormat)
+    }
+  }
+  return formats
+}
diff --git a/src/util/txTagging/apply.ts b/src/util/txTagging/apply.ts
new file mode 100644
index 00000000000..c010d3878f1
--- /dev/null
+++ b/src/util/txTagging/apply.ts
@@ -0,0 +1,58 @@
+import type {
+  EdgeCurrencyWallet,
+  EdgeMetadata,
+  EdgeTransaction
+} from 'edge-core-js'
+
+/**
+ * True when we actually know a payee or notes (BIP21, resolved name, or
+ * explicit body). Do not treat computed Expense/Income as persistable.
+ */
+export function hasPersistableTxMetadata(
+  metadata: EdgeMetadata | undefined
+): boolean {
+  if (metadata == null) return false
+  return (
+    (metadata.name != null && metadata.name !== '') ||
+    (metadata.notes != null && metadata.notes !== '') ||
+    (metadata.category != null && metadata.category !== '')
+  )
+}
+
+/**
+ * saveTx plus the saveTxMetadata race workaround used by SendScene2 and
+ * the CLI. Re-applies name/notes/category when those fields are non-empty
+ * so a concurrent engine callback cannot drop them.
+ *
+ * saveTx errors always throw. saveTxMetadata errors throw unless
+ * `onMetadataError` is provided (the GUI uses that so a tagging failure
+ * cannot look like a failed send after broadcast).
+ */
+export async function saveTxAndMetadata(
+  wallet: EdgeCurrencyWallet,
+  tx: EdgeTransaction,
+  opts?: {
+    onMetadataError?: (error: unknown) => void
+  }
+): Promise<void> {
+  await wallet.saveTx(tx)
+  const metadata = tx.metadata
+  if (!hasPersistableTxMetadata(metadata)) return
+  try {
+    await wallet.saveTxMetadata({
+      txid: tx.txid,
+      tokenId: tx.tokenId,
+      metadata: {
+        name: metadata?.name,
+        notes: metadata?.notes,
+        category: metadata?.category
+      }
+    })
+  } catch (error: unknown) {
+    if (opts?.onMetadataError != null) {
+      opts.onMetadataError(error)
+      return
+    }
+    throw error
+  }
+}
diff --git a/src/util/txTagging/index.ts b/src/util/txTagging/index.ts
new file mode 100644
index 00000000000..8899a7e6a5e
--- /dev/null
+++ b/src/util/txTagging/index.ts
@@ -0,0 +1 @@
+export { hasPersistableTxMetadata, saveTxAndMetadata } from './apply'
diff --git a/src/util/utils.ts b/src/util/utils.ts
index ef2d80ac633..f1f6976c455 100644
--- a/src/util/utils.ts
+++ b/src/util/utils.ts
@@ -9,20 +9,10 @@ import type {
   EdgeTokenMap,
   EdgeTransaction
 } from 'edge-core-js'
-import { Linking, Platform } from 'react-native'
-import DeviceInfo from 'react-native-device-info'
-import SafariView from 'react-native-safari-view'
 import { sprintf } from 'sprintf-js'
 import { v4 } from 'uuid'
 
 import type { GuiExchangeRates } from '../actions/ExchangeRateActions'
-import {
-  FEE_ALERT_THRESHOLD,
-  FEE_COLOR_THRESHOLD,
-  FIAT_CODES_SYMBOLS,
-  FIAT_PRECISION,
-  getFiatSymbol
-} from '../constants/WalletAndCurrencyConstants'
 import {
   toLocaleDate,
   toLocaleDateTime,
@@ -33,8 +23,37 @@ import { lstrings } from '../locales/strings'
 import { convertCurrency, getExchangeRate } from '../selectors/WalletSelectors'
 import type { RootState } from '../types/reduxTypes'
 import type { GuiFiatType } from '../types/types'
-import { getCurrencyCode } from './CurrencyInfoHelpers'
 import { base58 } from './encoding'
+import {
+  FEE_ALERT_THRESHOLD,
+  FEE_COLOR_THRESHOLD,
+  FIAT_CODES_SYMBOLS,
+  FIAT_PRECISION,
+  getFiatSymbol,
+  removeIsoPrefix
+} from './fiatConstants'
+
+// Re-export so existing importers of removeIsoPrefix from utils stay unchanged
+export { removeIsoPrefix }
+
+/** Local copy — avoids importing CurrencyInfoHelpers (RN via SPECIAL_CURRENCY_INFO). */
+const currencyCodeForToken = (
+  wallet: {
+    currencyInfo: { currencyCode: string; pluginId: string }
+    currencyConfig: { allTokens: Record<string, { currencyCode: string }> }
+  },
+  tokenId: EdgeTokenId
+): string => {
+  if (tokenId == null) return wallet.currencyInfo.currencyCode
+  const token = wallet.currencyConfig.allTokens[tokenId]
+  if (token == null) {
+    console.warn(
+      `getCurrencyCode: tokenId: '${tokenId}' not found for wallet pluginId: '${wallet.currencyInfo.pluginId}'`
+    )
+    return ''
+  }
+  return token.currencyCode
+}
 
 export const DECIMAL_PRECISION = 18
 export const DEFAULT_TRUNCATE_PRECISION = 6
@@ -362,7 +381,7 @@ export const getTotalFiatAmountFromExchangeRates = (
     )
     for (const tokenId of wallet.balanceMap.keys()) {
       const nativeBalance = wallet.balanceMap.get(tokenId) ?? '0'
-      const currencyCode = getCurrencyCode(wallet, tokenId)
+      const currencyCode = currencyCodeForToken(wallet, tokenId)
       const rate = getExchangeRate(
         exchangeRates,
         wallet.currencyInfo.pluginId,
@@ -468,24 +487,6 @@ export async function asyncWaterfall(
   }
 }
 
-export async function openLink(url: string): Promise<void> {
-  if (Platform.OS === 'ios') {
-    try {
-      await SafariView.isAvailable()
-      await SafariView.show({ url })
-      return
-    } catch (e: any) {
-      console.log(e)
-    }
-  }
-  const supported = await Linking.canOpenURL(url)
-  if (supported) {
-    await Linking.openURL(url)
-  } else {
-    throw new Error(`Don't know how to open URI: ${url}`)
-  }
-}
-
 export function maxPrimaryCurrencyConversionDecimals(
   primaryPrecision: number,
   precisionAdjustValue: number
@@ -782,21 +783,6 @@ export const darkenHexColor = (
   return scaledHexColor
 }
 
-/**
- * Reads and normalizes the OS version.
- */
-export function getOsVersion(): string {
-  const osVersionRaw = DeviceInfo.getSystemVersion()
-  return Array.from({ length: 3 }, (_, i) => {
-    const part = osVersionRaw.split('.')[i]
-    return part != null && part !== '' ? part : '0'
-  }).join('.')
-}
-
-export const removeIsoPrefix = (currencyCode: string): string => {
-  return currencyCode.replace('iso:', '')
-}
-
 export const getDisplayUsername = (
   loginId: string,
   username?: string