@thirdfy/agent-cli 0.4.1 → 0.4.3

package/src/runtime/execution/runners/thirdfyLane.mjs

@@ -0,0 +1,97 @@
+import { apiPost, responseHeadersFor } from '../../../core/http.mjs';
+import { idempotentReplayFields } from '../../../core/execution/hostedRuntimeIdempotency.mjs';
+import { withActionTimeout } from '../../../core/execution/actionTimeouts.mjs';
+import { actionNameForApi } from '../../actions/selection.mjs';
+import { isReadOnlyAction } from './managedResponse.mjs';
+import { createRequire } from 'module';
+
+const require = createRequire(import.meta.url);
+const { normalizeIntentResponse } = require('../../../utils/cli/intentNormalization.cjs');
+
+/** The thirdfy lane (execute intent), also the rail read-only actions use from the other lanes. */
+export function createThirdfyLane(deps) {
+  const {
+    buildIntentPayload,
+    resolveEffectiveUserDid,
+  } = deps;
+
+async function executeThirdfyRun(ctx, flags, resolved, options, runMode = 'thirdfy') {
+  const skipPreflight = Boolean(options?.skipPreflight);
+  const actionCtx = withActionTimeout(ctx, resolved);
+  if (!skipPreflight) {
+    const preflightPayload = buildIntentPayload(flags, {
+      validationOnly: true,
+      forceIdempotency: false,
+      resolvedAction: resolved.resolvedAction,
+      apiAction: actionNameForApi(resolved),
+      runMode,
+      mirrorOnly: false,
+      hybridWalletMode: options?.hybridWalletMode,
+    });
+    // validationOnly never writes, so a timed-out preflight is safe to resend.
+    const preflight = await apiPost(
+      { ...actionCtx, writeAction: false },
+      '/api/v1/agent/execute-intent',
+      preflightPayload,
+    );
+    const preflightNormalized = normalizeIntentResponse(preflight);
+    const blockedCount = preflightNormalized.blocked || 0;
+    if (!preflightNormalized.success || blockedCount > 0) {
+      preflightNormalized.success = false;
+      preflightNormalized.error = preflightNormalized.error || 'Preflight blocked execution';
+      preflightNormalized.preflightBlocked = true;
+      return preflightNormalized;
+    }
+  }
+  const payload = buildIntentPayload(flags, {
+    validationOnly: false,
+    forceIdempotency: true,
+    resolvedAction: resolved.resolvedAction,
+    apiAction: actionNameForApi(resolved),
+    runMode,
+    mirrorOnly: false,
+    hybridWalletMode: options?.hybridWalletMode,
+  });
+  const response = await apiPost(actionCtx, '/api/v1/agent/execute-intent', payload);
+  const normalized = normalizeIntentResponse(response);
+  normalized.idempotencyKey = payload.idempotencyKey;
+  if (!isReadOnlyAction(resolved)) {
+    Object.assign(normalized, idempotentReplayFields(response, responseHeadersFor(response), 'idempotencyKey'));
+  }
+  return normalized;
+}
+
+async function runReadOnlyActionViaIntentRail(ctx, flags, resolved, options, preflight, reportedMode = 'agent_wallet') {
+  const userDid = resolveEffectiveUserDid(flags, {
+    runMode: 'agent_wallet',
+    hybridWalletMode: options?.hybridWalletMode,
+    preferDelegationIdentity: options?.preferDelegationIdentity,
+  });
+  const intentResult = await executeThirdfyRun(
+    ctx,
+    {
+      ...flags,
+      chainId: Number(flags.chainId || 8453),
+      runMode: 'thirdfy',
+      userDid: userDid || flags.userDid,
+      executionScope: flags.executionScope || 'solo_owner_mirror',
+    },
+    resolved,
+    { ...options, skipPreflight: true },
+    'thirdfy'
+  );
+  intentResult.mode = reportedMode;
+  intentResult.routeFallback = 'execute_intent_read_only';
+  if (preflight) {
+    intentResult.executionWalletPreflight = preflight;
+    intentResult.executionWalletAddress = preflight.executionWalletAddress || intentResult.executionWalletAddress || null;
+  }
+  intentResult.signerMethod = 'managed_wallet_server';
+  return intentResult;
+}
+
+  return {
+    executeThirdfyRun,
+    runReadOnlyActionViaIntentRail,
+  };
+}

package/src/runtime/execution/svmLane.mjs

@@ -4,7 +4,7 @@ import { chainRegistrySource, configuredSvmChainIds, getChainInfo, isSvmChainId,
 import {
   inferChainIdFromCatalogRow,
   resolveWalletExecuteChainId,
-} from '../../core/walletExecuteChainId.mjs';
+} from '../../core/execution/walletExecuteChainId.mjs';
 
 /**
  * Solana (svm) lane rules. Solana actions run only with run mode `agent_wallet` on the managed

package/src/runtime/handlers.mjs

@@ -1,27 +1,27 @@
 import { negotiateCapabilities } from '../core/http.mjs';
-import { createPolymarketCommands } from '../commands/polymarket.mjs';
-import { createHummingbotCommands } from '../commands/hummingbot.mjs';
-import { createCondorCommands } from '../commands/condor.mjs';
-import { createHyperliquidHelpers } from '../commands/hyperliquid.mjs';
-import { createLighterHelpers } from '../commands/lighter.mjs';
-import { createAvantisHelpers } from '../commands/avantis.mjs';
+import { createPolymarketCommands } from '../commands/venues/polymarket.mjs';
+import { createHummingbotCommands } from '../commands/venues/hummingbot.mjs';
+import { createCondorCommands } from '../commands/venues/condor.mjs';
+import { createHyperliquidHelpers } from '../commands/venues/hyperliquid.mjs';
+import { createLighterHelpers } from '../commands/venues/lighter.mjs';
+import { createAvantisHelpers } from '../commands/venues/avantis.mjs';
 import { createExecuteCommands } from '../commands/execute.mjs';
-import { createWalletCommands } from '../commands/wallet.mjs';
-import { createDelegationCommands } from '../commands/delegation.mjs';
-import { createConsoleMandateCommands } from '../commands/consoleMandate.mjs';
-import { createBootstrapCommands } from '../commands/bootstrap.mjs';
+import { createWalletCommands } from '../commands/account/wallet.mjs';
+import { createDelegationCommands } from '../commands/onboarding/delegation.mjs';
+import { createConsoleMandateCommands } from '../commands/onboarding/consoleMandate.mjs';
+import { createBootstrapCommands } from '../commands/onboarding/bootstrap.mjs';
 import { createDiscoveryCommands } from '../commands/discovery.mjs';
 import { createSignalsCommands } from '../commands/signals/command.mjs';
-import { createCreditsCommands } from '../commands/credits.mjs';
+import { createCreditsCommands } from '../commands/account/credits.mjs';
 import { createChatCommands } from '../commands/chat.mjs';
 import { createBrainCommands } from '../commands/brain.mjs';
 import { createTelemetryCommands } from '../commands/telemetry.mjs';
-import { createCredentialsCommands } from '../commands/credentials.mjs';
-import { createAgentCommands } from '../commands/agent.mjs';
-import { createWalletControlCommands } from '../commands/walletControl.mjs';
+import { createCredentialsCommands } from '../commands/onboarding/credentials.mjs';
+import { createAgentCommands } from '../commands/account/agent.mjs';
+import { createWalletControlCommands } from '../commands/account/walletControl.mjs';
 import { createDoctorCommands } from '../commands/doctor.mjs';
 import { createPromptCommands } from '../commands/prompt.mjs';
-import { createVenueCommands } from '../commands/venue.mjs';
+import { createVenueCommands } from '../commands/venues/venue.mjs';
 
 /**
  * Wire command-module factories and local handlers for Commander manifest registration.
@@ -35,7 +35,6 @@ export function createRuntimeHandlers(deps) {
     maskSecret,
     getAuthToken,
     buildOwnerAuthHeaders,
-    probeBitfinexPermissions,
     applyActionFilters,
     getProviderHintForActions,
     resolveChainSupport,
@@ -51,7 +50,6 @@ export function createRuntimeHandlers(deps) {
     submitSignedTx,
     runPreflightByMode,
     runExecutionByMode,
-    applyExecutionFallbackHints,
     performSelfBroadcast,
     resolveManagedExecutionPreflight,
     resolveEffectiveUserDid,
@@ -66,7 +64,6 @@ export function createRuntimeHandlers(deps) {
     applyActionFilters,
     getProviderHintForActions,
     resolveChainSupport,
-    getAuthToken,
     buildOwnerAuthHeaders,
     resolveAgentApiKey,
   });
@@ -98,7 +95,6 @@ export function createRuntimeHandlers(deps) {
     printEnvelope,
     getAuthToken,
     buildOwnerAuthHeaders,
-    probeBitfinexPermissions,
   });
 
   const __walletControl = createWalletControlCommands({ printEnvelope, buildOwnerAuthHeaders });
@@ -174,7 +170,6 @@ export function createRuntimeHandlers(deps) {
     runPreflightByMode,
     runExecutionByMode,
     resolveManagedExecutionPreflight,
-    applyExecutionFallbackHints,
     performSelfBroadcast,
     executeManagedWalletRun,
     executeSelfRun,

package/src/runtime/main.mjs

@@ -16,16 +16,14 @@ import { createInitialRuntimeContext, applyFlagsToRuntimeContext } from './conte
 import { createProviderHints } from './providerHints/dispatch.mjs';
 import { createRuntimeHandlers } from './handlers.mjs';
 import { isCommanderCliError } from './errors.mjs';
-import { createOnboardingHints } from './onboardingHints.mjs';
 import { walletControlErrorFields } from './execution/walletControl.mjs';
 import { createAgentExtract } from './agentExtract.mjs';
 import { createAuthHelpers } from './authHelpers.mjs';
 import { createExecutionAmounts } from './execution/amounts.mjs';
 import { createExecutionLanes } from './execution/lanes.mjs';
 import { createExecutionPayloads } from './execution/payloads.mjs';
-import { createExecutionRunners } from './execution/runners.mjs';
+import { createExecutionRunners } from './execution/runners/createExecutionRunners.mjs';
 import { createActionSelection } from './actions/selection.mjs';
-import { createBitfinexProbe } from './bitfinexProbe.mjs';
 import { createOwsSigning } from './owsSigning.mjs';
 import { enforceCatalogActionParams } from './validation/actionParamsGate.mjs';
 
@@ -66,7 +64,6 @@ export function createThirdfyAgentRuntime() {
     providerHints;
 
   const { extractAgentApiKey, extractAgentKey, maskSecret } = createAgentExtract();
-  const onboarding = createOnboardingHints();
   const amounts = createExecutionAmounts();
   const lanes = createExecutionLanes();
   const auth = createAuthHelpers();
@@ -82,7 +79,6 @@ export function createThirdfyAgentRuntime() {
   const catalogActionParamsGate = (resolved, flags) =>
     enforceCatalogActionParams(resolved, flags, amounts.getPreparedParams);
   const ows = createOwsSigning();
-  const bitfinex = createBitfinexProbe();
   const runners = createExecutionRunners({
     buildIntentPayload: payloads.buildIntentPayload,
     buildBuildTxPayload: payloads.buildBuildTxPayload,
@@ -92,8 +88,6 @@ export function createThirdfyAgentRuntime() {
     resolveTokenInForFunding: payloads.resolveTokenInForFunding,
     shouldUseBuildTxPreflight: lanes.shouldUseBuildTxPreflight,
     shouldUseBuildTxExecution: lanes.shouldUseBuildTxExecution,
-    buildBitfinexOnboardingCommand: onboarding.buildBitfinexOnboardingCommand,
-    inferBitfinexPermissionProfileFromAction: onboarding.inferBitfinexPermissionProfileFromAction,
     resolveAgentApiKey: payloads.resolveAgentApiKey,
     resolveAgentKey: payloads.resolveAgentKey,
     loadEthers: ows.loadEthers,
@@ -111,7 +105,6 @@ export function createThirdfyAgentRuntime() {
     maskSecret,
     getAuthToken: auth.getAuthToken,
     buildOwnerAuthHeaders: auth.buildOwnerAuthHeaders,
-    probeBitfinexPermissions: bitfinex.probeBitfinexPermissions,
     applyActionFilters: actions.applyActionFilters,
     getProviderHintForActions,
     resolveChainSupport: lanes.resolveChainSupport,
@@ -127,7 +120,6 @@ export function createThirdfyAgentRuntime() {
     submitSignedTx: runners.submitSignedTx,
     runPreflightByMode: runners.runPreflightByMode,
     runExecutionByMode: runners.runExecutionByMode,
-    applyExecutionFallbackHints: runners.applyExecutionFallbackHints,
     performSelfBroadcast: runners.performSelfBroadcast,
     resolveManagedExecutionPreflight: runners.resolveManagedExecutionPreflight,
     resolveEffectiveUserDid: payloads.resolveEffectiveUserDid,
@@ -195,7 +187,6 @@ export function createThirdfyAgentRuntime() {
     const blockedReason = String(payload.blockedReason || payload.error || '').trim() || undefined;
     const blockedStage = String(payload.blockedStage || '').trim() || undefined;
     const clientCode = String(payload.error || payload.blockedReason || '').trim() || undefined;
-    const onboardingHint = onboarding.buildTopLevelOnboardingHint(payload);
     printEnvelope({
       success: false,
       // A missing or malformed flag is INVALID_ARGUMENTS at the top too, not an unhandled error.
@@ -209,7 +200,6 @@ export function createThirdfyAgentRuntime() {
         field: payload.field || null,
         resolvedAction: payload.resolvedAction || null,
         requestedAction: payload.requestedAction || null,
-        onboardingHint,
         // errorCode, retryable, retryAfterSeconds, nextAction, hint: as thirdfy-mcp's error envelope.
         ...describeCliError(error),
         // API 4.0 wallet-control refusals: walletControl, nextAction, userMessage, retryable, hint.

package/src/runtime/owsSigning.mjs

@@ -1,19 +1,20 @@
 import { spawnSync } from 'child_process';
 import fs from 'fs';
+import { createRequire } from 'module';
 import os from 'os';
 import path from 'path';
+import { pinnedRpcProvider } from '../core/chainRegistry.mjs';
 import { createCliError } from '../core/envelope.mjs';
+
+const require = createRequire(import.meta.url);
 export function createOwsSigning() {
+// ethers is a dependency of this package; resolve it from here, never from the caller's directory.
 async function loadEthers() {
-  const candidates = ['ethers', path.join(process.cwd(), 'node_modules', 'ethers')];
-  for (const candidate of candidates) {
-    try {
-      return require(candidate);
-    } catch {
-      // continue
-    }
+  try {
+    return require('ethers');
+  } catch {
+    throw new Error('Could not load the ethers dependency of @thirdfy/agent-cli; reinstall the package');
   }
-  throw new Error('Could not load ethers dependency for self-exec');
 }
 
 function resolveOwsBinary() {
@@ -62,8 +63,8 @@ function signUnsignedTxWithOws(unsignedHex, walletName, chainId) {
 
 async function signAndBroadcastWithOws({ txd, chainId, walletAddress, owsWalletName, rpcUrl }) {
   const ethers = await loadEthers();
-  const { JsonRpcProvider, Transaction, Signature } = ethers;
-  const provider = new JsonRpcProvider(rpcUrl, chainId);
+  const { Transaction, Signature } = ethers;
+  const provider = pinnedRpcProvider(ethers, { rpcUrl, chainId });
   const nonce = await provider.getTransactionCount(walletAddress, 'pending');
   const fee = await provider.getFeeData();
   const txFields = {
@@ -86,10 +87,10 @@ async function signAndBroadcastWithOws({ txd, chainId, walletAddress, owsWalletN
   return { sent };
 }
 
-async function readTokenBalanceRaw(rpcUrl, walletAddress, tokenAddress) {
+async function readTokenBalanceRaw(rpcUrl, walletAddress, tokenAddress, chainId) {
   const ethers = await loadEthers();
-  const { JsonRpcProvider, Interface } = ethers;
-  const provider = new JsonRpcProvider(rpcUrl);
+  const { Interface } = ethers;
+  const provider = pinnedRpcProvider(ethers, { rpcUrl, chainId });
   const erc20 = new Interface(['function balanceOf(address owner) view returns (uint256)']);
   const response = await provider.call({
     to: tokenAddress,
@@ -99,10 +100,10 @@ async function readTokenBalanceRaw(rpcUrl, walletAddress, tokenAddress) {
   return BigInt(decoded[0].toString()).toString();
 }
 
-async function readEffectBalances(rpcUrl, walletAddress, tokenIn, tokenOut) {
+async function readEffectBalances(rpcUrl, walletAddress, tokenIn, tokenOut, chainId) {
   const [inBal, outBal] = await Promise.all([
-    readTokenBalanceRaw(rpcUrl, walletAddress, tokenIn),
-    readTokenBalanceRaw(rpcUrl, walletAddress, tokenOut),
+    readTokenBalanceRaw(rpcUrl, walletAddress, tokenIn, chainId),
+    readTokenBalanceRaw(rpcUrl, walletAddress, tokenOut, chainId),
   ]);
   return { tokenIn: inBal, tokenOut: outBal };
 }

package/src/runtime/providerHints/cex.mjs

@@ -1,59 +1,8 @@
 /**
- * Static provider hints. Centralized exchanges and their executors: Bitfinex, Hummingbot and Condor.
+ * Static provider hints. Centralized exchange executors: Hummingbot and Condor.
  * Each entry builds the hint for one provider id; `dispatch.mjs` picks the entry.
  */
 export const CEX_PROVIDER_HINTS = Object.freeze({
-  bitfinex: ({ provider }) => ({
-    provider,
-    category: 'cex_funding_and_spot',
-    canonicalReadAction: 'get_bitfinex_funding_ticker',
-    canonicalWriteAction: 'submit_bitfinex_funding_offer',
-    readActions: [
-      'get_bitfinex_funding_stats_hist',
-      'get_bitfinex_funding_ticker',
-      'get_bitfinex_funding_book',
-      'get_bitfinex_wallets',
-      'list_bitfinex_funding_offers',
-      'list_bitfinex_funding_offers_hist',
-      'list_bitfinex_funding_credits',
-      'list_bitfinex_funding_loans',
-      'get_bitfinex_funding_info',
-      'get_bitfinex_ledgers_hist',
-      'get_bitfinex_orders',
-    ],
-    orderManagementActions: [
-      'submit_bitfinex_funding_offer',
-      'cancel_bitfinex_funding_offer',
-      'transfer_bitfinex_between_wallets',
-      'get_bitfinex_orders',
-      'submit_bitfinex_order',
-      'update_bitfinex_order',
-      'cancel_bitfinex_order',
-    ],
-    credentialType: 'api_key',
-    credentialRef: 'bitfinex:funding-primary',
-    credentialUx: 'Bitfinex credentials are owned by Thirdfy API encrypted delegation storage. CLI commands pass credentialRef only; never apiKey/apiSecret.',
-    laneCompatibility: 'Use `thirdfy-agent actions --provider bitfinex` for discovery, then `thirdfy-agent run --run-mode thirdfy` with credentialRef in params. The CLI does not store, log, or sign raw exchange credentials.',
-    example: 'thirdfy-agent actions --provider bitfinex && thirdfy-agent run --run-mode thirdfy --action submit_bitfinex_funding_offer --params \'{"symbol":"fUSD","amount":"100","rate":"0.0002","period":2,"credentialRef":"bitfinex:funding-primary"}\'',
-    credentialProfiles: [
-      {
-        id: 'bitfinex_funding_v1',
-        credentialRef: 'bitfinex:funding-primary',
-        required: ['funding.read', 'funding.write', 'wallets.read'],
-      },
-      {
-        id: 'bitfinex_spot_v1',
-        credentialRef: 'bitfinex:spot-primary',
-        required: ['orders.read', 'orders.write', 'wallets.read'],
-      },
-    ],
-    setupBlockers: [
-      'CEX_CREDENTIAL_NOT_FOUND',
-      'BITFINEX_CREDENTIALS_NOT_IN_THIRDFY_DELEGATION_CONTEXT',
-      'BITFINEX_PERMISSION_SCOPE_MISSING',
-      'CEX_POLICY_ACTION_NOT_ALLOWED',
-    ],
-  }),
   hummingbot: ({ provider }) => ({
     provider,
     category: 'cex_executor',

package/src/runtime/risk/notional.mjs

@@ -1,5 +1,5 @@
 import { createCliError } from '../../core/envelope.mjs';
-import { isReadOnlyResolvedAction } from '../../core/readOnlyActions.mjs';
+import { isReadOnlyResolvedAction } from '../../core/execution/readOnlyActions.mjs';
 import { resolveExecuteEstimatedAmountUsd } from '../execution/payloads.mjs';
 
 /**

package/src/runtime/validation/actionParamsGate.mjs

@@ -1,5 +1,5 @@
 import { createCliError } from '../../core/envelope.mjs';
-import { isReadOnlyResolvedAction } from '../../core/readOnlyActions.mjs';
+import { isReadOnlyResolvedAction } from '../../core/execution/readOnlyActions.mjs';
 import {
   sanitizeParamsForSchemaValidation,
   validateParamsSchema,

package/src/cli/options/credentials.mjs

@@ -1,15 +0,0 @@
-export function attachCredentialsOptions(cmd) {
-  return cmd
-    .option('--venue <id>', 'credential venue')
-    .option('--api-key <key>', 'exchange API key')
-    .option('--api-secret <secret>', 'exchange API secret')
-    .option('--permission-profile <profile>', 'funding|spot')
-    .option('--credential-ref <ref>', 'credential reference')
-    .option('--credential-type <type>', 'credential type')
-    .option('--verify-permissions', 'verify exchange permissions')
-    .option('--skip-permissions-probe', 'skip permissions probe')
-    .option('--bitfinex-base-url <url>', 'Bitfinex API base URL')
-    .option('--passphrase <value>', 'exchange passphrase')
-    .option('--metadata <json>', 'credential metadata JSON')
-    .option('--policy <json>', 'credential policy JSON');
-}

package/src/runtime/bitfinexProbe.mjs

@@ -1,121 +0,0 @@
-import { createHmac } from 'crypto';
-import { DEFAULT_BITFINEX_BASE_URL, BITFINEX_PERMISSION_PROFILES } from '../core/constants.mjs';
-import { createCliError } from '../core/envelope.mjs';
-import { requestJson, safeJsonParse } from '../core/http.mjs';
-export function createBitfinexProbe() {
-function parseBitfinexPermissionRows(rawData) {
-  const rows = Array.isArray(rawData) ? rawData : [];
-  const parsed = {};
-  for (const row of rows) {
-    if (!Array.isArray(row) || row.length < 3) continue;
-    const scope = String(row[0] || '').trim().toLowerCase();
-    if (!scope) continue;
-    const read = Number(row[1]) === 1 ? 1 : 0;
-    const write = Number(row[2]) === 1 ? 1 : 0;
-    parsed[scope] = { read, write };
-  }
-  return parsed;
-}
-
-function getMissingBitfinexScopes(scopePermissions, permissionProfile = 'funding') {
-  const profile = BITFINEX_PERMISSION_PROFILES[permissionProfile] || BITFINEX_PERMISSION_PROFILES.funding;
-  const missing = [];
-  for (const [scope, required] of Object.entries(profile.required)) {
-    const actual = scopePermissions[scope] || { read: 0, write: 0 };
-    if (actual.read < required.read || actual.write < required.write) {
-      missing.push({
-        scope,
-        required,
-        actual,
-      });
-    }
-  }
-  return missing;
-}
-
-async function probeBitfinexPermissions({ apiKey, apiSecret, permissionProfile = 'funding', timeoutMs, baseUrl }) {
-  const normalizedBaseUrl = String(baseUrl || DEFAULT_BITFINEX_BASE_URL).trim().replace(/\/+$/, '');
-  const apiPath = '/v2/auth/r/permissions';
-  const nonce = Date.now().toString();
-  const payload = '{}';
-  const signature = createHmac('sha384', String(apiSecret || ''))
-    .update(`/api${apiPath}${nonce}${payload}`)
-    .digest('hex');
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), Number(timeoutMs || DEFAULT_TIMEOUT_MS));
-  try {
-    const response = await fetch(`${normalizedBaseUrl}${apiPath}`, {
-      method: 'POST',
-      headers: {
-        'content-type': 'application/json',
-        'bfx-apikey': String(apiKey || ''),
-        'bfx-nonce': nonce,
-        'bfx-signature': signature,
-      },
-      body: payload,
-      signal: controller.signal,
-    });
-    const text = await response.text();
-    const parsed = text ? safeJsonParse(text) : {};
-    const bitfinexApiError =
-      Array.isArray(parsed) && String(parsed[0] || '').trim().toLowerCase() === 'error'
-        ? {
-            code: Number(parsed[1]) || null,
-            message: String(parsed[2] || 'Unknown Bitfinex API error'),
-          }
-        : parsed && typeof parsed === 'object' && String(parsed.event || '').trim().toLowerCase() === 'error'
-          ? {
-              code: Number(parsed.code) || null,
-              message: String(parsed.msg || parsed.message || 'Unknown Bitfinex API error'),
-            }
-          : null;
-    if (!response.ok) {
-      throw createCliError(
-        'BITFINEX_PERMISSIONS_PROBE_FAILED',
-        `Bitfinex permissions probe failed with HTTP ${response.status}. Verify API key/secret and key validity before onboarding.`,
-        { statusCode: response.status }
-      );
-    }
-    if (bitfinexApiError) {
-      throw createCliError(
-        'BITFINEX_PERMISSIONS_PROBE_FAILED',
-        `Bitfinex permissions probe failed: ${bitfinexApiError.message}. Verify API key/secret and key validity before onboarding.`,
-        { statusCode: response.status, bitfinexApiError }
-      );
-    }
-    const scopePermissions = parseBitfinexPermissionRows(parsed);
-    const missingScopes = getMissingBitfinexScopes(scopePermissions, permissionProfile);
-    if (missingScopes.length > 0) {
-      throw createCliError(
-        'BITFINEX_PERMISSION_SCOPE_MISSING',
-        `Bitfinex key is missing required scopes (${missingScopes
-          .map((entry) => entry.scope)
-          .join(', ')}). Enable the ${permissionProfile} profile scopes and retry onboarding.`,
-        { missingScopes, scopePermissions, permissionProfile }
-      );
-    }
-    return {
-      venue: 'bitfinex',
-      permissionProfile,
-      checked: true,
-      scopes: scopePermissions,
-      missingScopes: [],
-    };
-  } catch (error) {
-    if (error?.payload) throw error;
-    throw createCliError(
-      'BITFINEX_PERMISSIONS_PROBE_FAILED',
-      `Could not verify Bitfinex key permissions. ${String(error?.message || 'Unknown probe error')}`,
-      {}
-    );
-  } finally {
-    clearTimeout(timer);
-  }
-}
-
-  return {
-    parseBitfinexPermissionRows,
-    getMissingBitfinexScopes,
-    probeBitfinexPermissions,
-  };
-}