@thirdfy/agent-cli 0.4.1 → 0.4.3

package/src/runtime/execution/runners.mjs

@@ -1,1134 +0,0 @@
-import { randomUUID } from 'crypto';
-import { pickNativeGasFields } from './nativeGas.mjs';
-import {
-  ACTION_PREFLIGHT_VENUE_FIELDS,
-  appendActionPreflightQuery,
-  blockedActionPreflight,
-  blockedActionPreflightFromError,
-  describeExecutionVenue,
-  isApiActionBlock,
-  pickActionPreflightFields,
-} from './actionPreflight.mjs';
-import { requireFlag } from '../../core/args.mjs';
-import { createCliError } from '../../core/envelope.mjs';
-import {
-  normalizeRunMode,
-  normalizeManagedRunMode,
-  normalizeHybridWalletMode,
-  normalizeEffectCheckMode,
-  getEffectiveRunMode,
-  parseBooleanFlag,
-} from '../../core/runMode.mjs';
-import { apiGet, apiPost, responseHeadersFor } from '../../core/http.mjs';
-import { idempotentReplayFields } from '../../core/hostedRuntimeIdempotency.mjs';
-import { withActionTimeout } from '../../core/actionTimeouts.mjs';
-import { isReadOnlyResolvedAction } from '../../core/readOnlyActions.mjs';
-import { resolveWalletExecuteChainId } from '../../core/walletExecuteChainId.mjs';
-import { describeInsufficientNativeGas, isSvmChainId, resolveChainRpcUrl, sameWalletAddress } from '../../core/chainRegistry.mjs';
-import { readWalletControl } from './walletControl.mjs';
-import { actionNameForApi } from '../actions/selection.mjs';
-import { blockedResultFields } from '../../core/errorEnvelope.mjs';
-import { riskRefusalFields } from '../risk/riskRefusal.mjs';
-import { isEmptyQueuedExecuteIntent, shouldFallbackManagedReadToExecuteIntent } from './managedReadExecuteRail.mjs';
-import { createRequire } from 'module';
-
-const require = createRequire(import.meta.url);
-const { normalizeIntentResponse } = require('../../utils/cli/intentNormalization.cjs');
-
-export function createExecutionRunners(deps) {
-  const {
-    buildIntentPayload,
-    buildBuildTxPayload,
-    buildManagedExecutePayload,
-    getPreparedParams,
-    resolveEffectiveUserDid,
-    resolveTokenInForFunding,
-    shouldUseBuildTxPreflight,
-    shouldUseBuildTxExecution,
-    buildBitfinexOnboardingCommand,
-    inferBitfinexPermissionProfileFromAction,
-    resolveAgentApiKey,
-    resolveAgentKey,
-    loadEthers,
-    signAndBroadcastWithOws,
-    readEffectBalances,
-    resolveUnsignedTx,
-    sleepMs,
-  } = deps;
-
-function applyExecutionFallbackHints(normalized, { flags, runMode, resolvedAction }) {
-  if (!normalized || typeof normalized !== 'object') return normalized;
-  const next = { ...normalized };
-  const reasons = new Set();
-  const topBlockedReason = String(next.blockedReason || '').trim();
-  if (topBlockedReason) reasons.add(topBlockedReason);
-  const blockedByReason = next.blockedByReason && typeof next.blockedByReason === 'object' ? next.blockedByReason : {};
-  for (const key of Object.keys(blockedByReason)) {
-    if (String(key || '').trim()) reasons.add(String(key).trim());
-  }
-  const resolvedActionLower = String(resolvedAction || '').trim().toLowerCase();
-  const looksBitfinexAction = resolvedActionLower.includes('bitfinex');
-  const permissionProfile = inferBitfinexPermissionProfileFromAction(resolvedActionLower);
-  const cexCredentialMissingSignals = new Set([
-    'CEX_CREDENTIAL_NOT_FOUND',
-    'BITFINEX_CREDENTIALS_NOT_IN_CONTEXT',
-    'BITFINEX_CREDENTIALS_NOT_IN_THIRDFY_DELEGATION_CONTEXT',
-    'BITFINEX_ENV_CREDENTIALS_NOT_CONFIGURED',
-  ]);
-  const hasMissingCredentialSignal = Array.from(reasons).some((code) => cexCredentialMissingSignals.has(code));
-  if (looksBitfinexAction && hasMissingCredentialSignal) {
-    next.onboardingHint = {
-      type: 'bitfinex_credentials',
-      message:
-        'Bitfinex credentials are missing for this delegated account. Onboard credentials first, then retry the same command.',
-      command: buildBitfinexOnboardingCommand(permissionProfile),
-    };
-  }
-  if (
-    looksBitfinexAction &&
-    runMode !== 'thirdfy' &&
-    runMode !== 'agent_wallet' &&
-    (topBlockedReason === 'SELF_MODE_REQUIRES_BUILD_TX' || topBlockedReason === 'HYBRID_MODE_REQUIRES_BUILD_TX')
-  ) {
-    next.onboardingHint = {
-      ...(next.onboardingHint || {}),
-      runMode: 'thirdfy',
-      runModeMessage: 'Bitfinex actions require delegated execute-intent rail. Re-run with --run-mode thirdfy.',
-    };
-  }
-  return next;
-}
-
-function isReadOnlyAction(resolved) {
-  return isReadOnlyResolvedAction(resolved);
-}
-
-function shouldFallbackAgentWalletToExecuteIntent(resolved, response) {
-  return shouldFallbackManagedReadToExecuteIntent({
-    isReadOnly: isReadOnlyAction(resolved),
-    errorText: String(response?.error || response?.message || response?.code || response?.blockedReason || ''),
-  });
-}
-
-// Managed /execute often returns provider payloads as JSON strings under data.result. Pack parsers
-// (and find_value_by_key) need a real object tree, so coerce strings that look like JSON.
-function coerceJsonTreeValue(value) {
-  if (typeof value !== 'string') return value;
-  const trimmed = value.trim();
-  if (!trimmed || (trimmed[0] !== '{' && trimmed[0] !== '[')) return value;
-  try {
-    return JSON.parse(trimmed);
-  } catch {
-    return value;
-  }
-}
-
-function shapeManagedExecuteReadResponse(response) {
-  if (!response || typeof response !== 'object') return response;
-  const data =
-    response.data && typeof response.data === 'object' ? { ...response.data } : response.data;
-  if (data && typeof data === 'object' && Object.prototype.hasOwnProperty.call(data, 'result')) {
-    data.result = coerceJsonTreeValue(data.result);
-  }
-  return { ...response, data };
-}
-
-function normalizeManagedExecuteResponse(response, { preflight, payload, isRead }) {
-  const shaped = isRead ? shapeManagedExecuteReadResponse(response) : response;
-  const normalized = normalizeIntentResponse({
-    success: Boolean(shaped?.success),
-    status: shaped?.success ? 'completed' : 'failed',
-    mode: 'agent_wallet',
-    txHash: shaped?.txHash || null,
-    blockedReason: shaped?.blockedReason || shaped?.data?.blockedReason || null,
-    blockedStage: shaped?.blockedStage || shaped?.data?.blockedStage || null,
-    error: shaped?.error || null,
-    executionWalletAddress:
-      shaped?.executionWalletAddress || shaped?.data?.executionWalletAddress || null,
-    signerMethod: 'managed_wallet_server',
-    idempotencyKey: payload.executionIdempotencyKey || null,
-    executionWalletPreflight: preflight,
-    amountNormalization:
-      shaped?.amountNormalization || shaped?.data?.amountNormalization || null,
-    // Reads must keep provider payload on the envelope. EarnClaw packs parse
-    // data.raw.data.result (see parse_thirdfy_action_result).
-    ...(isRead && shaped?.data !== undefined ? { data: shaped.data } : {}),
-    raw: shaped,
-  });
-  normalized.executionWalletAddress =
-    shaped?.executionWalletAddress || shaped?.data?.executionWalletAddress || null;
-  normalized.signerMethod = 'managed_wallet_server';
-  normalized.executionWalletPreflight = preflight;
-  normalized.amountNormalization =
-    shaped?.amountNormalization || shaped?.data?.amountNormalization || null;
-  normalized.raw = shaped;
-  normalized.idempotencyKey = payload.executionIdempotencyKey || null;
-  // A risk-policy refusal nests riskRefusal under data; lift it as thirdfy-mcp walletExecute does.
-  const refusal = shaped?.success ? undefined : riskRefusalFields(shaped || {});
-  if (refusal) Object.assign(normalized, refusal);
-  // A replay means nothing new ran; say so, or the caller reads it as a fresh fill.
-  if (!isRead) {
-    Object.assign(
-      normalized,
-      idempotentReplayFields(response, responseHeadersFor(response), 'executionIdempotencyKey'),
-    );
-  }
-  return normalized;
-}
-
-const ROBINHOOD_MAINNET_CHAIN_ID = 4663;
-
-/** Marker a read on the fast path carries instead of an execution-wallet preflight. */
-const READ_FAST_PATH_PREFLIGHT = Object.freeze({ success: true, skipped: 'read_fast_path' });
-
-/**
- * agent_wallet reads skip the /execution-wallet preflight: the API resolves the agent's execution
- * wallet itself, so the extra round trip only matters when a read uses its answer: a strict wallet
- * match, a funding check, or the Robinhood delegated lane. An expected wallet equal to the agent key
- * is not a separate wallet to match first; the wallet the API reports is checked after the read.
- * Mirrors thirdfy-mcp `walletExecute` readFastPath.
- */
-function shouldUseManagedReadFastPath(flags, resolved, options = {}) {
-  if (!isReadOnlyAction(resolved)) return false;
-  if (options.requireFundingCheck === true) return false;
-  const runMode = String(flags.runMode || 'agent_wallet').trim().toLowerCase();
-  if (runMode !== 'agent_wallet') return false;
-  const expectedWallet = String(flags.walletAddress || flags.executionWalletAddress || '').trim();
-  const agentKey = String(typeof resolveAgentKey === 'function' ? resolveAgentKey(flags) : flags.agentKey || '').trim();
-  if (expectedWallet && !sameWalletAddress(expectedWallet, agentKey)) return false;
-  let chainId;
-  try {
-    chainId = resolveWalletExecuteChainId({
-      action: String(resolved?.resolvedAction || flags.action || '').trim(),
-      chainId: flags.chainId,
-      params: getPreparedParams(flags),
-    });
-  } catch {
-    // Unresolvable chain (e.g. a CCTP quote without sourceChainId): the preflight path reports it.
-    return false;
-  }
-  return Number(chainId) !== ROBINHOOD_MAINNET_CHAIN_ID;
-}
-
-async function runPreflightByMode(runMode, ctx, flags, resolved, options = {}) {
-  const resolvedAction = resolved.resolvedAction;
-  if (runMode === 'agent_wallet') {
-    const preflight = await resolveManagedExecutionPreflight(ctx, flags, resolved, {
-      runMode,
-      // Reads carry no transaction; keep funding optional so preflight matches run.
-      requireFundingCheck: !isReadOnlyAction(resolved),
-      preflightSeed: options.managedPreflight,
-      // Ask the API to check policy and venue readiness for this action, not just the wallet.
-      evaluateAction: true,
-    });
-    const normalized = normalizeIntentResponse({
-      success: preflight.success,
-      status: preflight.success ? 'ready' : 'failed',
-      mode: 'agent_wallet',
-      executionWalletAddress: preflight.executionWalletAddress || null,
-      signerMethod: preflight.signerMethod || 'managed_wallet_server',
-      blockedReason: preflight.blockedReason || null,
-      blockedStage: preflight.blockedStage || null,
-      error: preflight.success ? null : preflight.error || 'Managed wallet preflight failed',
-      preflightBlocked: !preflight.success,
-      fundingTokenBalance: preflight.fundingTokenBalance || null,
-      executionWalletPreflight: preflight,
-    });
-    normalized.executionWalletAddress = preflight.executionWalletAddress || null;
-    normalized.signerMethod = preflight.signerMethod || 'managed_wallet_server';
-    normalized.executionWalletPreflight = preflight;
-    normalized.fundingTokenBalance = preflight.fundingTokenBalance || null;
-    normalized.policyEvaluated = preflight.policyEvaluated === true;
-    for (const key of [...ACTION_PREFLIGHT_VENUE_FIELDS, 'executionVenue']) {
-      if (preflight[key] != null) normalized[key] = preflight[key];
-    }
-    // Only an API refusal of the action is `blocked`; CLI-local checks keep `failed`.
-    const apiBlocked = isApiActionBlock(preflight);
-    if (apiBlocked) normalized.status = 'blocked';
-    return {
-      message: preflight.success
-        ? 'Managed wallet preflight completed'
-        : preflight.blockedStage === 'venue_readiness'
-          ? 'Managed wallet preflight blocked: venue not ready'
-          : apiBlocked
-            ? 'Managed wallet preflight blocked by policy'
-            : 'Managed wallet preflight failed',
-      route: 'execution_wallet_preflight',
-      normalized,
-    };
-  }
-  if (runMode === 'self') {
-    // Reads have no unsigned tx to prepare. Keep preflight on validation-only execute-intent so
-    // operators dry-running self mode do not trigger a real catalog read (run still uses the read rail).
-    if (isReadOnlyAction(resolved)) {
-      const payload = buildIntentPayload(flags, {
-        validationOnly: true,
-        forceIdempotency: false,
-        resolvedAction,
-        apiAction: actionNameForApi(resolved),
-        runMode: 'self',
-        mirrorOnly: false,
-      });
-      const response = await apiPost({ ...ctx, writeAction: false }, '/api/v1/agent/execute-intent', payload);
-      const normalized = normalizeIntentResponse(response);
-      const blockedCount = normalized.blocked || 0;
-      if (!normalized.success || blockedCount > 0) {
-        normalized.success = false;
-        normalized.error = normalized.error || 'Preflight blocked self execution';
-        normalized.preflightBlocked = true;
-      }
-      return {
-        message: normalized.success
-          ? 'Self preflight completed'
-          : normalized.preflightBlocked
-            ? 'Self preflight blocked by governance'
-            : 'Self preflight failed',
-        route: 'execute_intent_validation',
-        normalized,
-      };
-    }
-    const route = shouldUseBuildTxPreflight(runMode, resolved) ? 'build_tx' : 'execute_intent_validation';
-    const normalized = await executeSelfRun(
-      ctx,
-      flags,
-      resolved,
-      { skipPreflight: route === 'build_tx' }
-    );
-    const blockedByGovernance = !normalized.success && Boolean(normalized.preflightBlocked);
-    return {
-      message: blockedByGovernance
-        ? 'Self preflight blocked by governance'
-        : normalized.success
-          ? 'Self preflight completed (unsigned transaction ready)'
-          : 'Self preflight failed',
-      route,
-      normalized,
-    };
-  }
-  if (runMode === 'hybrid') {
-    // Reads have nothing to mirror and need no wallet. Keep preflight on validation-only
-    // execute-intent so dry-runs do not trigger a real catalog read (run still uses the read rail).
-    if (isReadOnlyAction(resolved)) {
-      const payload = buildIntentPayload(flags, {
-        validationOnly: true,
-        forceIdempotency: false,
-        resolvedAction,
-        apiAction: actionNameForApi(resolved),
-        runMode: 'hybrid',
-        mirrorOnly: false,
-        hybridWalletMode: options.hybridWalletMode,
-      });
-      const response = await apiPost({ ...ctx, writeAction: false }, '/api/v1/agent/execute-intent', payload);
-      const normalized = normalizeIntentResponse(response);
-      const blockedCount = normalized.blocked || 0;
-      if (!normalized.success || blockedCount > 0) {
-        normalized.success = false;
-        normalized.error = normalized.error || 'Preflight blocked hybrid execution';
-        normalized.preflightBlocked = true;
-      }
-      return {
-        message: normalized.success
-          ? 'Hybrid preflight completed'
-          : normalized.preflightBlocked
-            ? 'Hybrid preflight blocked by governance'
-            : 'Hybrid preflight failed',
-        route: 'execute_intent_validation',
-        normalized,
-      };
-    }
-    if (options.hybridWalletMode === 'agent_wallet') {
-      const managedPayload = buildIntentPayload(flags, {
-        validationOnly: true,
-        forceIdempotency: false,
-        resolvedAction,
-        apiAction: actionNameForApi(resolved),
-        runMode: 'agent_wallet',
-        mirrorOnly: false,
-        hybridWalletMode: 'agent_wallet',
-      });
-      const managedResponse = await apiPost({ ...ctx, writeAction: false }, '/api/v1/agent/execute-intent', managedPayload);
-      const managedNormalized = normalizeIntentResponse(managedResponse);
-      const mirrorPayload = buildIntentPayload(flags, {
-        validationOnly: true,
-        forceIdempotency: false,
-        resolvedAction,
-        apiAction: actionNameForApi(resolved),
-        runMode: 'hybrid',
-        mirrorOnly: true,
-        hybridWalletMode: 'agent_wallet',
-      });
-      const mirrorResponse = await apiPost({ ...ctx, writeAction: false }, '/api/v1/agent/execute-intent', mirrorPayload);
-      const mirrorNormalized = normalizeIntentResponse(mirrorResponse);
-      return {
-        message:
-          managedNormalized.success && mirrorNormalized.success
-            ? 'Hybrid preflight completed (agent_wallet + thirdfy mirror)'
-            : 'Hybrid preflight failed (agent_wallet + thirdfy mirror)',
-        route: 'execute_intent_validation_dual',
-        normalized: normalizeIntentResponse({
-          success: Boolean(managedNormalized.success && mirrorNormalized.success),
-          status: mirrorNormalized.status || managedNormalized.status || 'failed',
-          mode: 'hybrid',
-          hybridWalletMode: 'agent_wallet',
-          managed: managedNormalized,
-          mirror: mirrorNormalized,
-          error: managedNormalized.error || mirrorNormalized.error || null,
-        }),
-      };
-    }
-  }
-  const payload = buildIntentPayload(flags, {
-    validationOnly: true,
-    forceIdempotency: false,
-    resolvedAction,
-    apiAction: actionNameForApi(resolved),
-    runMode,
-    mirrorOnly: runMode === 'hybrid',
-  });
-  const response = await apiPost({ ...ctx, writeAction: false }, '/api/v1/agent/execute-intent', payload);
-  const normalized = normalizeIntentResponse(response);
-  return {
-    message: normalized.success
-      ? runMode === 'hybrid'
-        ? 'Hybrid mirror preflight completed'
-        : 'Preflight completed'
-      : runMode === 'hybrid'
-        ? 'Hybrid mirror preflight failed'
-        : 'Preflight failed',
-    route: 'execute_intent_validation',
-    normalized,
-  };
-}
-
-async function runExecutionByMode(runMode, ctx, flags, resolved, options) {
-  if (runMode === 'thirdfy') {
-    const normalized = await executeThirdfyRun(ctx, flags, resolved, options, runMode);
-    const preflightBlocked = !normalized.success && Boolean(normalized.preflightBlocked);
-    return {
-      code: normalized.success ? 'RUN_QUEUED' : preflightBlocked ? 'PREFLIGHT_BLOCKED' : 'RUN_FAILED',
-      message: normalized.success
-        ? 'Execution intent queued'
-        : preflightBlocked
-          ? 'Preflight blocked execution'
-          : 'Execution failed',
-      idempotencyKey: normalized.idempotencyKey || null,
-      normalized,
-    };
-  }
-  if (runMode === 'agent_wallet') {
-    const normalized = await executeManagedWalletRun(ctx, flags, resolved, options);
-    const preflightBlocked = !normalized.success && Boolean(normalized.preflightBlocked);
-    return {
-      code: normalized.success ? 'WALLET_EXECUTED' : preflightBlocked ? 'PREFLIGHT_BLOCKED' : 'RUN_FAILED',
-      message: normalized.success
-        ? 'Managed wallet execution completed'
-        : preflightBlocked
-          ? 'Managed wallet preflight blocked execution'
-          : 'Managed wallet execution failed',
-      idempotencyKey: normalized.idempotencyKey || null,
-      normalized,
-    };
-  }
-  if (runMode === 'self') {
-    const normalized = await executeSelfRun(ctx, flags, resolved, options);
-    const preflightBlocked = !normalized.success && Boolean(normalized.preflightBlocked);
-    const readOnlySuccess =
-      normalized.success && normalized.routeFallback === 'execute_intent_read_only';
-    return {
-      code: normalized.success
-        ? readOnlySuccess
-          ? 'SELF_READ_COMPLETED'
-          : 'SELF_UNSIGNED_TX_READY'
-        : preflightBlocked
-          ? 'PREFLIGHT_BLOCKED'
-          : 'SELF_EXECUTION_FAILED',
-      message: normalized.success
-        ? readOnlySuccess
-          ? 'Read-only action completed via delegated execute-intent'
-          : 'Unsigned transaction prepared for self-custody execution'
-        : preflightBlocked
-          ? 'Preflight blocked self execution'
-          : 'Self-custody execution failed',
-      idempotencyKey: null,
-      normalized,
-    };
-  }
-  const normalized = await executeHybridRun(ctx, flags, resolved, options);
-  const preflightBlocked = !normalized.success && Boolean(normalized.preflightBlocked);
-  const hybridWalletMode = normalizeHybridWalletMode(
-    normalized.hybridWalletMode || options?.hybridWalletMode || flags.hybridWalletMode || 'self',
-  );
-  const readOnlySuccess =
-    normalized.success && normalized.routeFallback === 'execute_intent_read_only';
-  return {
-    code: normalized.success
-      ? readOnlySuccess
-        ? 'HYBRID_READ_COMPLETED'
-        : 'HYBRID_READY'
-      : preflightBlocked
-        ? 'PREFLIGHT_BLOCKED'
-        : 'HYBRID_FAILED',
-    message: normalized.success
-      ? readOnlySuccess
-        ? 'Read-only action completed via delegated execute-intent'
-        : hybridWalletMode === 'agent_wallet'
-          ? 'Hybrid execution prepared (agent wallet + mirror preflight)'
-          : 'Hybrid execution prepared (self tx + mirror preflight)'
-      : preflightBlocked
-        ? 'Preflight blocked hybrid execution'
-        : 'Hybrid execution failed',
-    idempotencyKey: normalized.idempotencyKey || null,
-    normalized,
-  };
-}
-
-async function executeThirdfyRun(ctx, flags, resolved, options, runMode = 'thirdfy') {
-  const skipPreflight = Boolean(options?.skipPreflight);
-  const actionCtx = withActionTimeout(ctx, resolved);
-  if (!skipPreflight) {
-    const preflightPayload = buildIntentPayload(flags, {
-      validationOnly: true,
-      forceIdempotency: false,
-      resolvedAction: resolved.resolvedAction,
-      apiAction: actionNameForApi(resolved),
-      runMode,
-      mirrorOnly: false,
-      hybridWalletMode: options?.hybridWalletMode,
-    });
-    // validationOnly never writes, so a timed-out preflight is safe to resend.
-    const preflight = await apiPost(
-      { ...actionCtx, writeAction: false },
-      '/api/v1/agent/execute-intent',
-      preflightPayload,
-    );
-    const preflightNormalized = normalizeIntentResponse(preflight);
-    const blockedCount = preflightNormalized.blocked || 0;
-    if (!preflightNormalized.success || blockedCount > 0) {
-      preflightNormalized.success = false;
-      preflightNormalized.error = preflightNormalized.error || 'Preflight blocked execution';
-      preflightNormalized.preflightBlocked = true;
-      return preflightNormalized;
-    }
-  }
-  const payload = buildIntentPayload(flags, {
-    validationOnly: false,
-    forceIdempotency: true,
-    resolvedAction: resolved.resolvedAction,
-    apiAction: actionNameForApi(resolved),
-    runMode,
-    mirrorOnly: false,
-    hybridWalletMode: options?.hybridWalletMode,
-  });
-  const response = await apiPost(actionCtx, '/api/v1/agent/execute-intent', payload);
-  const normalized = normalizeIntentResponse(response);
-  normalized.idempotencyKey = payload.idempotencyKey;
-  if (!isReadOnlyAction(resolved)) {
-    Object.assign(normalized, idempotentReplayFields(response, responseHeadersFor(response), 'idempotencyKey'));
-  }
-  return normalized;
-}
-
-async function runReadOnlyActionViaIntentRail(ctx, flags, resolved, options, preflight, reportedMode = 'agent_wallet') {
-  const userDid = resolveEffectiveUserDid(flags, {
-    runMode: 'agent_wallet',
-    hybridWalletMode: options?.hybridWalletMode,
-    preferDelegationIdentity: options?.preferDelegationIdentity,
-  });
-  const intentResult = await executeThirdfyRun(
-    ctx,
-    {
-      ...flags,
-      chainId: Number(flags.chainId || 8453),
-      runMode: 'thirdfy',
-      userDid: userDid || flags.userDid,
-      executionScope: flags.executionScope || 'solo_owner_mirror',
-    },
-    resolved,
-    { ...options, skipPreflight: true },
-    'thirdfy'
-  );
-  intentResult.mode = reportedMode;
-  intentResult.routeFallback = 'execute_intent_read_only';
-  if (preflight) {
-    intentResult.executionWalletPreflight = preflight;
-    intentResult.executionWalletAddress = preflight.executionWalletAddress || intentResult.executionWalletAddress || null;
-  }
-  intentResult.signerMethod = 'managed_wallet_server';
-  return intentResult;
-}
-
-async function executeManagedWalletRun(ctx, flags, resolved, options) {
-  // Market-data reads under agent_wallet must use /execute and keep the provider payload on the
-  // envelope (raw + parsed data.result). Routing them only through /execute-intent was the 0.2.34
-  // attempt to avoid a burial bug, but solo Hermes agent_wallet intents come back as an empty
-  // queued envelope with no universe. Live /execute still returns the Hyperliquid meta payload
-  // (often as a JSON string under data.result). Reads skip funding gates; routing still fails closed.
-  const isRead = isReadOnlyAction(resolved);
-  const skipPreflight = Boolean(options?.skipPreflight);
-  // A seeded preflight (Hyperliquid/Lighter/Veranta address defaults) already ran; reuse it.
-  const readFastPath =
-    !skipPreflight && !options?.managedPreflight && shouldUseManagedReadFastPath(flags, resolved, options);
-  let preflight = readFastPath ? READ_FAST_PATH_PREFLIGHT : null;
-  if (!skipPreflight && !readFastPath) {
-    preflight = await resolveManagedExecutionPreflight(ctx, flags, resolved, {
-      runMode: 'agent_wallet',
-      requireFundingCheck: !isRead,
-      preflightSeed: options?.managedPreflight,
-    });
-    if (!preflight.success) {
-      const normalized = normalizeIntentResponse({
-        success: false,
-        status: 'failed',
-        mode: 'agent_wallet',
-        blockedReason: preflight.blockedReason || 'PRECHECK_FAILED',
-        blockedStage: preflight.blockedStage || 'routing',
-        error: preflight.error || 'Managed wallet preflight failed',
-        preflightBlocked: true,
-        executionWalletAddress: preflight.executionWalletAddress || null,
-        executionWalletPreflight: preflight,
-      });
-      normalized.executionWalletAddress = preflight.executionWalletAddress || null;
-      normalized.executionWalletPreflight = preflight;
-      return normalized;
-    }
-  }
-  const payload = buildManagedExecutePayload(flags, {
-    resolvedAction: resolved.resolvedAction,
-    apiAction: actionNameForApi(resolved),
-    runMode: 'agent_wallet',
-    forceIdempotency: true,
-  });
-  const actionCtx = withActionTimeout(ctx, resolved);
-  const response = await apiPost(actionCtx, '/api/v1/agent/execute', payload);
-  if (readFastPath) {
-    const mismatch = fastPathWalletMismatch(flags, response);
-    if (mismatch) return mismatch;
-  }
-  if (shouldFallbackAgentWalletToExecuteIntent(resolved, response)) {
-    // On the fast path the wallet comes from the /execute answer, not a preflight.
-    const fallbackPreflight = readFastPath
-      ? {
-          ...READ_FAST_PATH_PREFLIGHT,
-          executionWalletAddress: response?.executionWalletAddress || response?.data?.executionWalletAddress || null,
-        }
-      : preflight;
-    const intentResult = await runReadOnlyActionViaIntentRail(ctx, flags, resolved, options, fallbackPreflight);
-    if (isEmptyQueuedExecuteIntent(intentResult.raw || intentResult)) {
-      // A read that did not answer in time (often a cold provider cache): nothing changed, and the
-      // same read usually answers on the next try. Same fields as thirdfy-mcp walletExecute.
-      intentResult.success = false;
-      intentResult.status = 'failed';
-      intentResult.error = intentResult.error || 'MANAGED_READ_EMPTY_EXECUTE_INTENT';
-      Object.assign(intentResult, {
-        errorCode: 'MANAGED_READ_EMPTY_EXECUTE_INTENT',
-        retryable: true,
-        retryAfterSeconds: 3,
-        nextAction: 'retry_later',
-        hint:
-          intentResult.hint ||
-          'The read did not answer in time; nothing was changed. Repeat the same read in a few seconds. Do not treat the empty queued result as data.',
-      });
-    }
-    intentResult.executionWalletAddress =
-      preflight?.executionWalletAddress ||
-      response?.executionWalletAddress ||
-      response?.data?.executionWalletAddress ||
-      null;
-    return intentResult;
-  }
-  return normalizeManagedExecuteResponse(response, { preflight, payload, isRead });
-}
-
-/**
- * The fast path only runs when the expected wallet is empty or equals the agent key. The preflight
- * path refuses a wallet that differs from the execution wallet, so apply the same rule to the wallet
- * the API reports for the read.
- */
-function fastPathWalletMismatch(flags, response) {
-  // 0x addresses compare case-insensitively; Solana base58 is case-sensitive and kept as sent.
-  const expectedWallet = String(flags.walletAddress || flags.executionWalletAddress || '').trim();
-  if (!expectedWallet || parseBooleanFlag(flags.allowWalletMismatch, false)) return null;
-  const apiWallet = String(response?.executionWalletAddress || response?.data?.executionWalletAddress || '').trim();
-  if (!apiWallet || sameWalletAddress(apiWallet, expectedWallet)) return null;
-  const normalized = normalizeIntentResponse({
-    success: false,
-    status: 'failed',
-    mode: 'agent_wallet',
-    blockedReason: 'EXECUTION_WALLET_MISMATCH',
-    blockedStage: 'routing',
-    error: `Funded wallet (${expectedWallet}) does not match execution wallet (${apiWallet}). Use --allow-wallet-mismatch to override.`,
-    preflightBlocked: true,
-    executionWalletAddress: apiWallet,
-  });
-  normalized.executionWalletAddress = apiWallet;
-  normalized.executionWalletPreflight = READ_FAST_PATH_PREFLIGHT;
-  return normalized;
-}
-
-async function executeSelfRun(ctx, flags, resolved, options) {
-  const skipPreflight = Boolean(options?.skipPreflight);
-  const blockedReasonCode = String(options?.blockedReasonCode || 'SELF_MODE_REQUIRES_BUILD_TX');
-  // A read has no transaction to build or sign, so the self lane has nothing to do with it. Without
-  // this it either fails with SELF_MODE_REQUIRES_BUILD_TX or, when catalog metadata is missing, asks
-  // /build-tx to produce a transaction for a market-data query.
-  if (isReadOnlyAction(resolved)) {
-    return runReadOnlyActionViaIntentRail(ctx, flags, resolved, options, null, options?.runMode || 'self');
-  }
-  if (!skipPreflight) {
-    const preflightPayload = buildIntentPayload(flags, {
-      validationOnly: true,
-      forceIdempotency: false,
-      resolvedAction: resolved.resolvedAction,
-      apiAction: actionNameForApi(resolved),
-      runMode: 'self',
-      mirrorOnly: false,
-    });
-    const preflight = await apiPost({ ...ctx, writeAction: false }, '/api/v1/agent/execute-intent', preflightPayload);
-    const preflightNormalized = normalizeIntentResponse(preflight);
-    const blockedCount = preflightNormalized.blocked || 0;
-    if (!preflightNormalized.success || blockedCount > 0) {
-      preflightNormalized.success = false;
-      preflightNormalized.error = preflightNormalized.error || 'Preflight blocked self execution';
-      preflightNormalized.preflightBlocked = true;
-      return preflightNormalized;
-    }
-  }
-  if (!shouldUseBuildTxExecution(options?.runMode || 'self', resolved)) {
-    const normalized = normalizeIntentResponse({
-      success: false,
-      status: 'failed',
-      blockedReason: blockedReasonCode,
-      blockedStage: 'routing',
-      error: 'Selected action does not support build-tx self lane. Use --run-mode thirdfy for delegated CEX execution.',
-    });
-    normalized.preflightBlocked = true;
-    return normalized;
-  }
-  const buildTxPayload = buildBuildTxPayload(flags, resolved.resolvedAction, actionNameForApi(resolved));
-  // build-tx returns an unsigned transaction; nothing is broadcast, so a timeout may be resent.
-  const buildTx = await apiPost({ ...ctx, writeAction: false }, '/api/v1/agent/build-tx', buildTxPayload);
-  return normalizeIntentResponse({
-    ...buildTx,
-    status: buildTx?.status || 'ready',
-    mode: buildTx?.mode || 'self',
-    unsignedTx: buildTx?.unsignedTx || null,
-    estimatedGas: buildTx?.estimatedGas || null,
-  });
-}
-
-async function executeHybridRun(ctx, flags, resolved, options) {
-  const hybridWalletMode = normalizeHybridWalletMode(options?.hybridWalletMode || flags.hybridWalletMode || 'self');
-  // Reads have nothing to mirror and need no wallet, whichever hybrid wallet mode is selected.
-  // Answering from the read rail also keeps the payload at the top level, instead of nesting it under
-  // `managed` where callers that read `results` cannot find it.
-  if (isReadOnlyAction(resolved)) {
-    const readResult = await runReadOnlyActionViaIntentRail(ctx, flags, resolved, options, null, 'hybrid');
-    readResult.hybridWalletMode = hybridWalletMode;
-    return readResult;
-  }
-  if (hybridWalletMode === 'agent_wallet') {
-    const managedResult = await executeManagedWalletRun(ctx, { ...flags, runMode: 'agent_wallet' }, resolved, options);
-    if (!managedResult.success) {
-      return normalizeIntentResponse({
-        ...managedResult,
-        mode: 'hybrid',
-        hybridWalletMode,
-      });
-    }
-    const mirrorPayload = buildIntentPayload(flags, {
-      validationOnly: true,
-      forceIdempotency: true,
-      resolvedAction: resolved.resolvedAction,
-      apiAction: actionNameForApi(resolved),
-      runMode: 'hybrid',
-      mirrorOnly: true,
-      hybridWalletMode,
-    });
-    const mirrorResponse = await apiPost({ ...ctx, writeAction: false }, '/api/v1/agent/execute-intent', mirrorPayload);
-    const mirrorNormalized = normalizeIntentResponse(mirrorResponse);
-    return normalizeIntentResponse({
-      success: Boolean(managedResult.success && mirrorNormalized.success),
-      status: managedResult.status || mirrorNormalized.status || 'queued',
-      mode: 'hybrid',
-      hybridWalletMode,
-      idempotencyKey: managedResult.idempotencyKey || mirrorPayload.idempotencyKey,
-      managed: managedResult,
-      mirror: mirrorNormalized,
-    });
-  }
-  const selfResult = await executeSelfRun(ctx, flags, resolved, {
-    ...(options || {}),
-    runMode: 'hybrid',
-    blockedReasonCode: 'HYBRID_MODE_REQUIRES_BUILD_TX',
-  });
-  if (!selfResult.success) return selfResult;
-
-  const mirrorPayload = buildIntentPayload(flags, {
-    validationOnly: true,
-    forceIdempotency: true,
-    resolvedAction: resolved.resolvedAction,
-    apiAction: actionNameForApi(resolved),
-    runMode: 'hybrid',
-    mirrorOnly: true,
-  });
-  const mirrorResponse = await apiPost({ ...ctx, writeAction: false }, '/api/v1/agent/execute-intent', mirrorPayload);
-  const mirrorNormalized = normalizeIntentResponse(mirrorResponse);
-  return normalizeIntentResponse({
-    success: Boolean(selfResult.success && mirrorNormalized.success),
-    status: mirrorNormalized.status || 'ready',
-    mode: 'hybrid',
-    hybridWalletMode,
-    idempotencyKey: mirrorPayload.idempotencyKey,
-    self: selfResult,
-    mirror: mirrorNormalized,
-  });
-}
-
-async function resolveManagedExecutionPreflight(ctx, flags, resolved, options = {}) {
-  const action = String(resolved?.resolvedAction || flags.action || '').trim();
-  const params = getPreparedParams(flags);
-  const chainId = resolveWalletExecuteChainId({
-    action,
-    chainId: flags.chainId,
-    params,
-  });
-  const runMode = String(options.runMode || 'agent_wallet').trim().toLowerCase();
-  const agentApiKey = resolveAgentApiKey(flags, runMode);
-  const userDid = resolveEffectiveUserDid(flags, {
-    runMode,
-    hybridWalletMode: options.hybridWalletMode,
-    preferDelegationIdentity: options.preferDelegationIdentity,
-  });
-  if (!userDid) {
-    return {
-      success: false,
-      blockedReason: 'MISSING_USER_DID',
-      blockedStage: 'routing',
-      error:
-        runMode === 'agent_wallet'
-          ? 'Solo agent_wallet requires --agent-key, THIRDFY_AGENT_KEY, config.agent.agentKey, or --user-did did:wallet:<agentKey>. Subscriber Privy DIDs require delegation; use did:wallet for direct agent execution.'
-          : 'Managed wallet execution requires --user-did, THIRDFY_USER_DID, or a saved userDid from `thirdfy-agent login email`.',
-      signerMethod: 'managed_wallet_server',
-    };
-  }
-  const tokenIn = resolveTokenInForFunding(params, action, resolved?.resolvedActionMeta?.behavior?.spend);
-  const query = new URLSearchParams({
-    userDid,
-    chainId: String(chainId),
-    runMode,
-  });
-  if (tokenIn) query.set('tokenIn', tokenIn);
-  const evaluateAction = options.evaluateAction === true;
-  if (evaluateAction) appendActionPreflightQuery(query, { action, apiAction: actionNameForApi(resolved), params, flags });
-  const executionVenue = describeExecutionVenue(action, chainId);
-  const preflightSeed = options.preflightSeed && typeof options.preflightSeed === 'object'
-    ? options.preflightSeed
-    : null;
-  if (preflightSeed && preflightSeed.success === false) {
-    return preflightSeed;
-  }
-  // A seed (address default lookup) carries no policy answer; an action preflight asks the API again.
-  const useSeed = Boolean(preflightSeed) && !evaluateAction;
-  let response;
-  if (useSeed) {
-    response = {
-      executionWalletAddress: preflightSeed.executionWalletAddress || null,
-      signerMethod: preflightSeed.signerMethod || null,
-      fundingTokenBalance: preflightSeed.fundingTokenBalance || null,
-      ...pickNativeGasFields(preflightSeed),
-    };
-  } else {
-    try {
-      response = await apiGet(ctx, `/api/v1/agent/execution-wallet?${query.toString()}`, {
-        'x-agent-api-key': agentApiKey,
-      });
-    } catch (error) {
-      const blocked = evaluateAction ? blockedActionPreflightFromError(error) : null;
-      if (!blocked) throw error;
-      return {
-        ...blocked,
-        userDid,
-        chainId,
-        ...(executionVenue ? { executionVenue } : {}),
-      };
-    }
-  }
-  // An action preflight the API answered 2xx but refused is a block too (thirdfy-mcp previewOrder).
-  if (evaluateAction && response?.success === false) {
-    return {
-      ...blockedActionPreflight(response, {
-        errorFields: blockedResultFields(String(response.blockedReason || 'PREFLIGHT_BLOCKED')),
-      }),
-      userDid,
-      chainId,
-      ...(executionVenue ? { executionVenue } : {}),
-    };
-  }
-  const actionFields = evaluateAction ? pickActionPreflightFields(response) : {};
-  // API 4.0 wallet control, as thirdfy-mcp reports it: the API refuses writes itself (before
-  // signing), so preflight only reports it. Solana is exempt from the API's gate.
-  const walletControlFields = readWalletControl(response, { svm: isSvmChainId(chainId) });
-  // Keep the API's case: Solana base58 addresses are case-sensitive (lowercasing corrupts them).
-  const executionWalletAddress = String(response?.executionWalletAddress || '').trim();
-  const signerMethod = String(response?.signerMethod || 'managed_wallet_server').trim();
-  const rawBalance = String(response?.fundingTokenBalance?.raw || '').trim();
-  let parsedRawBalance = null;
-  if (rawBalance) {
-    try {
-      parsedRawBalance = BigInt(rawBalance);
-    } catch {
-      // Reads pass requireFundingCheck: false; a malformed balance must not block them.
-      // Writes still fail closed on unparseable fundingTokenBalance.raw.
-      if (options.requireFundingCheck) {
-        return {
-          success: false,
-          blockedReason: 'INVALID_FUNDING_BALANCE',
-          blockedStage: 'sizing',
-          error: `Execution wallet ${executionWalletAddress || 'unknown'} returned invalid funding token balance.`,
-          executionWalletAddress,
-          signerMethod,
-          fundingTokenBalance: response?.fundingTokenBalance || null,
-          ...actionFields,
-          ...(executionVenue ? { executionVenue } : {}),
-      ...walletControlFields,
-        };
-      }
-    }
-  }
-  const expectedWallet = String(flags.walletAddress || flags.executionWalletAddress || '').trim();
-  const allowWalletMismatch = parseBooleanFlag(flags.allowWalletMismatch, false);
-
-  if (
-    expectedWallet
-    && executionWalletAddress
-    && !sameWalletAddress(expectedWallet, executionWalletAddress)
-    && !allowWalletMismatch
-  ) {
-    return {
-      success: false,
-      blockedReason: 'EXECUTION_WALLET_MISMATCH',
-      ...blockedResultFields('EXECUTION_WALLET_MISMATCH'),
-      blockedStage: 'routing',
-      error: `Funded wallet (${expectedWallet}) does not match execution wallet (${executionWalletAddress}). Use --allow-wallet-mismatch to override.`,
-      executionWalletAddress,
-      signerMethod,
-      fundingTokenBalance: response?.fundingTokenBalance || null,
-      ...actionFields,
-      ...(executionVenue ? { executionVenue } : {}),
-      ...walletControlFields,
-    };
-  }
-
-  if (options.requireFundingCheck && parsedRawBalance !== null && parsedRawBalance <= 0n) {
-    return {
-      success: false,
-      blockedReason: 'INSUFFICIENT_FUNDS',
-      ...blockedResultFields('INSUFFICIENT_FUNDS'),
-      blockedStage: 'sizing',
-      error: `Execution wallet ${executionWalletAddress || 'unknown'} has insufficient tokenIn balance.`,
-      executionWalletAddress,
-      signerMethod,
-      fundingTokenBalance: response?.fundingTokenBalance || null,
-      ...actionFields,
-      ...(executionVenue ? { executionVenue } : {}),
-      ...walletControlFields,
-    };
-  }
-
-  // User-pays-gas chains (DogeOS, Solana): the API reports native gas readiness (API 3.18.2+). Keep
-  // it, and stop a write before /execute when the API says the wallet cannot pay gas (gasReady false).
-  const nativeGas = pickNativeGasFields(response);
-  if (options.requireFundingCheck && nativeGas.gasReady === false) {
-    return {
-      success: false,
-      blockedReason: 'INSUFFICIENT_NATIVE_GAS',
-      ...blockedResultFields('INSUFFICIENT_NATIVE_GAS'),
-      blockedStage: 'sizing',
-      error: nativeGas.nativeGasWarning?.message || describeInsufficientNativeGas(executionWalletAddress, chainId),
-      executionWalletAddress,
-      signerMethod,
-      fundingTokenBalance: response?.fundingTokenBalance || null,
-      ...actionFields,
-      ...(executionVenue ? { executionVenue } : {}),
-      ...walletControlFields,
-      ...nativeGas,
-    };
-  }
-
-  return {
-    success: true,
-    executionWalletAddress,
-    signerMethod,
-    fundingTokenBalance: response?.fundingTokenBalance || null,
-    userDid,
-    chainId,
-    tokenIn: tokenIn || null,
-    ...nativeGas,
-    ...actionFields,
-    ...(executionVenue ? { executionVenue } : {}),
-      ...walletControlFields,
-  };
-}
-
-async function performSelfBroadcast(ctx, flags, resolvedAction, selfResult) {
-  const txd = resolveUnsignedTx(selfResult);
-  if (!txd?.to || !txd?.data) {
-    throw createCliError('SELF_UNSIGNED_TX_MISSING', 'Self execution did not return a valid unsigned transaction');
-  }
-  const chainId = Number(txd.chainId || flags.chainId || 8453);
-  const walletAddress = String(flags.walletAddress || process.env.MARKET_MAKER_WALLET_ADDRESS || '').trim();
-  const owsWalletName = String(flags.owsWalletName || process.env.OWS_WALLET_NAME || '').trim();
-  const rpcUrl = resolveChainRpcUrl({ chainId, rpcUrl: flags.rpcUrl });
-  if (!rpcUrl) {
-    throw createCliError('RPC_URL_REQUIRED', `self-exec has no known RPC for chain ${chainId}; pass --rpc-url <url> for that chain`);
-  }
-  if (!walletAddress) {
-    throw createCliError('SIGNING_FAILED', 'Missing --wallet-address (or MARKET_MAKER_WALLET_ADDRESS) for self-exec signing.');
-  }
-  if (!owsWalletName) {
-    throw createCliError('SIGNING_FAILED', 'Missing --ows-wallet-name (or OWS_WALLET_NAME) for self-exec signing.');
-  }
-
-  const params = getPreparedParams(flags);
-  const effectTokenIn = String(flags.effectTokenIn || params.tokenIn || '').trim();
-  const effectTokenOut = String(flags.effectTokenOut || params.tokenOut || '').trim();
-  const effectMode = normalizeEffectCheckMode(flags.effectCheck || process.env.THIRDFY_EFFECT_CHECK || 'relaxed');
-  const effectRetries = Number(flags.effectCheckRetries || process.env.THIRDFY_EFFECT_CHECK_RETRIES || 2);
-  const effectWaitMs = Number(flags.effectCheckWaitMs || process.env.THIRDFY_EFFECT_CHECK_WAIT_MS || 1200);
-
-  let balancesBefore = null;
-  if (effectMode !== 'off' && effectTokenIn && effectTokenOut) {
-    balancesBefore = await readEffectBalances(rpcUrl, walletAddress, effectTokenIn, effectTokenOut);
-  }
-
-  let submission;
-  try {
-    submission = await signAndBroadcastWithOws({
-      txd,
-      chainId,
-      walletAddress,
-      owsWalletName,
-      rpcUrl,
-    });
-  } catch (error) {
-    throw createCliError('SIGNING_FAILED', error?.message || 'OWS signing failed');
-  }
-
-  let receipt;
-  try {
-    receipt = await submission.sent.wait();
-  } catch (error) {
-    throw createCliError('BROADCAST_FAILED', error?.message || 'Broadcast wait failed');
-  }
-  const status = Number(receipt?.status ?? 0);
-  if (status !== 1) {
-    throw createCliError('BROADCAST_FAILED', 'Transaction receipt status is not success', {
-      receiptStatus: receipt?.status ?? null,
-      txHash: submission.sent.hash,
-    });
-  }
-
-  const effectCheck = await resolveEffectCheckResult({
-    mode: effectMode,
-    rpcUrl,
-    walletAddress,
-    tokenIn: effectTokenIn,
-    tokenOut: effectTokenOut,
-    balancesBefore,
-    retries: effectRetries,
-    waitMs: effectWaitMs,
-  });
-  if (effectCheck.checked && !effectCheck.hasEffect && effectMode === 'strict') {
-    throw createCliError('EFFECT_CHECK_FAILED', 'Transaction mined but did not produce observable token effect.', {
-      txHash: submission.sent.hash,
-      effectCheck,
-      mode: effectMode,
-    });
-  }
-
-  return {
-    txHash: submission.sent.hash,
-    chainId,
-    blockNumber: receipt?.blockNumber ?? null,
-    status: receipt?.status ?? null,
-    unsignedTx: txd,
-    effectCheck,
-    lane: 'self',
-    signer: 'ows',
-    resolvedAction,
-    apiBase: ctx.apiBase,
-  };
-}
-
-async function resolveEffectCheckResult({
-  mode,
-  rpcUrl,
-  walletAddress,
-  tokenIn,
-  tokenOut,
-  balancesBefore,
-  retries,
-  waitMs,
-}) {
-  const baseResult = {
-    checked: true,
-    mode,
-    hasEffect: false,
-    inDeltaRaw: '0',
-    outDeltaRaw: '0',
-    attempts: 0,
-    retries: Math.max(0, Number(retries || 0)),
-  };
-  if (mode === 'off') {
-    return { checked: false, mode, hasEffect: null, inDeltaRaw: null, outDeltaRaw: null, reason: 'disabled' };
-  }
-  if (!tokenIn || !tokenOut || !balancesBefore) {
-    return { checked: false, mode, hasEffect: null, inDeltaRaw: null, outDeltaRaw: null, reason: 'token_pair_missing' };
-  }
-  const maxAttempts = Math.max(1, Number(retries || 0) + 1);
-  let last = null;
-  for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
-    const balancesAfter = await readEffectBalances(rpcUrl, walletAddress, tokenIn, tokenOut);
-    const inDeltaRaw = (BigInt(balancesBefore.tokenIn) - BigInt(balancesAfter.tokenIn)).toString();
-    const outDeltaRaw = (BigInt(balancesAfter.tokenOut) - BigInt(balancesBefore.tokenOut)).toString();
-    const hasEffect = BigInt(inDeltaRaw) > 0n || BigInt(outDeltaRaw) > 0n;
-    last = {
-      checked: true,
-      mode,
-      hasEffect,
-      inDeltaRaw,
-      outDeltaRaw,
-      attempts: attempt,
-      retries: maxAttempts - 1,
-    };
-    if (hasEffect) return last;
-    if (attempt < maxAttempts) await sleepMs(waitMs);
-  }
-  return {
-    ...(last || baseResult),
-    warning: 'No balance delta observed after retries; treating as non-fatal in relaxed mode.',
-  };
-}
-
-async function submitSignedTx({ rpcUrl, chainId, signedTxHex }) {
-  const ethers = await loadEthers();
-  const { JsonRpcProvider } = ethers;
-  const provider = new JsonRpcProvider(rpcUrl, chainId);
-  const sent = await provider.broadcastTransaction(String(signedTxHex));
-  return sent?.hash || null;
-}
-
-  return {
-    applyExecutionFallbackHints,
-    runPreflightByMode,
-    runExecutionByMode,
-    executeThirdfyRun,
-    executeManagedWalletRun,
-    executeSelfRun,
-    executeHybridRun,
-    resolveManagedExecutionPreflight,
-    performSelfBroadcast,
-    resolveEffectCheckResult,
-    submitSignedTx,
-  };
-}