breaking(portfolio): upgrade wallet_holdings to critical auth

Align CLI with server-side breaking change: GET /v1/user/wallet_holdings
was upgraded from authExistMW to authCriticalMW on the openapi-service.

- OpenApiClient: switch getWalletHoldings to authSignedRequest
- SKILL.md: split rate-limit table by auth level; update Notes section
- CLAUDE.md: move portfolio holdings from Normal to Critical auth row

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -93,8 +93,8 @@ EOF
 
 | Mode | Commands | Requirements |
 |------|----------|--------------|
-| Normal | token / market / portfolio / track kol / track smartmoney | `GMGN_API_KEY` only, no signature |
-| Critical | swap / order / track follow-wallet | `GMGN_API_KEY` + `GMGN_PRIVATE_KEY` — CLI handles signing automatically |
+| Normal | token / market / portfolio (except holdings) / track kol / track smartmoney | `GMGN_API_KEY` only, no signature |
+| Critical | swap / order / portfolio holdings / track follow-wallet | `GMGN_API_KEY` + `GMGN_PRIVATE_KEY` — CLI handles signing automatically |
 
 ## SKILL.md Authoring Rules
 

skills/gmgn-portfolio/SKILL.md

@@ -54,10 +54,17 @@ Use the `gmgn-cli` tool to query wallet portfolio data based on the user's reque
 
 All portfolio routes used by this skill go through GMGN's leaky-bucket limiter with `rate=20` and `capacity=20`. Sustained throughput is roughly `20 ÷ weight` requests/second, and the max burst is roughly `floor(20 ÷ weight)` when the bucket is full.
 
+**Critical auth** (`GMGN_API_KEY` + `GMGN_PRIVATE_KEY` required):
+
+| Command | Route | Weight |
+|---------|-------|--------|
+| `portfolio holdings` | `GET /v1/user/wallet_holdings` | 5 |
+
+**Exist auth** (`GMGN_API_KEY` only):
+
 | Command | Route | Weight |
 |---------|-------|--------|
 | `portfolio info` | `GET /v1/user/info` | 1 |
-| `portfolio holdings` | `GET /v1/user/wallet_holdings` | 2 |
 | `portfolio activity` | `GET /v1/user/wallet_activity` | 3 |
 | `portfolio stats` | `GET /v1/user/wallet_stats` | 3 |
 | `portfolio token-balance` | `GET /v1/user/wallet_token_balance` | 1 |
@@ -360,7 +367,7 @@ Show the `[Identity: ...]` line only if `common` is present in the response. For
 
 ## Notes
 
-- All portfolio commands use exist auth (API Key only, no signature required)
+- `portfolio holdings` uses **critical auth** (`GMGN_API_KEY` + `GMGN_PRIVATE_KEY` required — CLI signs the request automatically). All other portfolio commands use exist auth (API Key only, no signature required).
 - `portfolio stats` supports multiple `--wallet` flags for batch queries
 - Use `--raw` to get single-line JSON for further processing
 - **Input validation** — Wallet and token addresses are validated against the expected chain format at runtime (sol: base58 32–44 chars; bsc/base/eth: `0x` + 40 hex digits). The CLI exits with an error on invalid input.

skills/gmgn-token/SKILL.md

@@ -288,7 +288,7 @@ The response has five nested objects: `pool`, `dev`, `link`, `stat`, `wallet_tag
 | `price.swaps_{window}` | Total swap count for the window |
 | `price.hot_level` | Heat level integer |
 
-**`fee_distribution` Object** — Launchpad fee-sharing config (optional; present for `pump` / `bankr` tokens)
+**`fee_distribution` Object** — Launchpad fee-sharing config (optional; present for `pump` / `bankr` tokens). Use `token info` to check fee distribution, creator reward claim status (`has_claimed_fee`), and royalty allocation for pump/bankr tokens.
 
 | Field | Description |
 |-------|-------------|
@@ -724,7 +724,7 @@ Show top rows only. Highlight wallets tagged `kol`, `smart_degen`, or flagged `b
 ## Notes
 
 - **Market cap is not returned directly** — calculate it as `price.price × circulating_supply` (`price` is now a nested object; use `price.price` for the current USD price string, and `circulating_supply` is a top-level field already in human-readable token units). Example: `price.price="3.11"` × `circulating_supply=999999151` ≈ $3.11B market cap.
-- **Trading volume (1h, 24h, etc.) is not included in `token info`** — to get volume or OHLCV data, use the `gmgn-market` skill and query K-line data: `gmgn-cli market kline --chain <chain> --address <token_address> --resolution <1m|5m|15m|1h|4h|1d>`. See the `gmgn-market` SKILL.md for full details.
+- **Trading volume and swap counts by window are available in `token info`** via the `price` object: `volume_{window}`, `buy_volume_{window}`, `sell_volume_{window}`, `buys_{window}`, `sells_{window}`, `swaps_{window}` (windows: `1m`, `5m`, `1h`, `6h`, `24h`). For OHLCV candlestick data, use `gmgn-market kline`.
 - All token commands use exist auth (API Key only, no signature required)
 - Use `--raw` to get single-line JSON for further processing
 - `--tag` applies to both `holders` and `traders` and filters to only wallets with that tag — if few results are returned, try the other tag value

src/client/OpenApiClient.ts

@@ -241,18 +241,18 @@ export class OpenApiClient {
     return this.authExistRequest("GET", "/v1/market/token_kline", query);
   }
 
-  // ---- Portfolio endpoints (exist auth) ----
+  // ---- Portfolio endpoints ----
 
   async getWalletHoldings(
     chain: string,
     walletAddress: string,
     extra: Record<string, string | number> = {}
   ): Promise<unknown> {
-    return this.authExistRequest("GET", "/v1/user/wallet_holdings", {
+    return this.authSignedRequest("GET", "/v1/user/wallet_holdings", {
       chain,
       wallet_address: walletAddress,
       ...extra,
-    });
+    }, null);
   }
 
   async getWalletActivity(
@@ -419,7 +419,7 @@ export class OpenApiClient {
     body: unknown
   ): Promise<unknown> {
     if (!this.privateKeyPem) {
-      throw new Error("GMGN_PRIVATE_KEY is required for critical-auth commands (swap, order, and follow-wallet commands)");
+      throw new Error("GMGN_PRIVATE_KEY is required for critical-auth commands (swap, order, follow-wallet, and portfolio holdings commands)");
     }
 
     return this.executePreparedRequest(() => {