feat(ts): add x402 payments, BAI recharge recovery and ERC-8004 - #1002
Open
boboliu-1010 wants to merge 10 commits into
Open
feat(ts): add x402 payments, BAI recharge recovery and ERC-8004#1002boboliu-1010 wants to merge 10 commits into
boboliu-1010 wants to merge 10 commits into
Conversation
x402-cli signs its payments through @bankofai/agent-wallet. Migrating its commands into wallet-cli means re-pointing that signer at a wallet-cli account; this is the seam that makes the rest of that migration mechanical. No x402 SDK is a dependency yet, and no command is wired. - domain/x402/network-id — convert between wallet-cli network ids and the CAIP-2 ids x402 uses. TRON differs only in base (tron:728126428 is tron:0x2b6653dc); eip155 identifiers are identical on both sides. - application/contracts/x402-payer — PayerSigner and PayerPolicy. The contract carries two closures rather than the domain Signer, because an x402 scheme calls the wallet from deep inside a payment flow, where nothing can run a Ledger's precheck / prompt / abort ceremony. - application/services/x402/payer-signer — resolve the active account, refusing a watch-only one before any keystore decrypt, and apply that ceremony once per signature. The TRON allowance path signs an approve transaction before the payment, so each signature needs its own round. - adapters/outbound/x402/signer-bridge — reshape the payer for the x402 SDK, declared structurally so no x402 package is imported. It is the one place every typed-data payload passes through, so it carries all three guards: the payload's payer must be the selected account, a GasFree maxFee must stay within the caller's ceiling, and the returned signature must be for the struct that was requested. The first two refuse before any signature is requested, so a rejected payment never reaches a device prompt. - domain/typed-data — resolvePrimaryType, so those guards work from the payload's real signing root instead of an optional field. Without it, a payload that omitted primaryType skipped all three checks. - three error codes: payer_mismatch, fee_cap_exceeded and signed_payload_mismatch, with their rows in machine-interface.md.
boboliu-1010
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add x402 payments and provider discovery, B.AI account queries and recharge recovery, and eight ERC-8004 identity commands to the TypeScript wallet CLI. All signing stays in the existing wallet software/device flow. The signer groundwork from #1000 retains its original commit authorship.
X402Service.roundtripfor B.AI recharge: validate the token and precision before target resolution or preorder creation, create the order using the personal API key, pay the trusted destination, then report the transaction. Remove the old recharge MCP dependency. Keep the three supported destination addresses in outbound configuration, without user overrides; changing them requires a release.chain: eth, lowercase address) while rejecting unrelated chains or wallets; preserve signed message bytes. Document the required BAI recharge-binding message template and live verification that three distinct TRON/Base/BSC wallets coexist under one personal API key. Credential setup still checks existing bindings; no automatic binding command is added.allowanceMode: auto. Normalize EVM approval-sponsoring transactions fromgastogasLimit, preserving an explicit gas limit. EVM self-funded approval remains an explicit agent decision; GasFree shortfalls do not fall back to the ordinary TRON wallet.retryPayment: falsewhen JSON parsing, response buffering or output writing fails after settlement. B.AI validation failures retain a boundedcandidateTxHash, the failure reason and original recharge context without treating the candidate as confirmed payment.bai recharge-report <txHash> --chain tron|bnb|base [--amount ...]. It reports an existing transaction without a local wallet, preorder, signature, payment or recipient re-resolution. Recipient recovery requires both original--toand--target-id; failed reports retain recovery data.@bankofai/8004-sdkfor registry configuration, ABI and event parsing while identity writes stay in the wallet transaction pipeline. Group write-receipt fields underidentity.*; preserve ERC20/ERC721 approval semantics and bounded metadata loading.The lockfile resolves x402 core
1.1.1-beta.1, TRON2.0.0-beta.1, EVM/fetch1.1.0, and 8004 SDK1.2.0-beta.1. x402 dependencies are bundled into the CLI. Package version remains4.13.0pending the release version update.Validation
Baseline validation at
48918534:npm test -- --maxWorkers=4).npm run verify:package).Latest binding patch
2a6789fb: 4 related test files / 54 tests passed; typecheck, ESLint, dependency-boundary checks, build and diff checks passed. Added regression cases for canonical EVM responses, unchanged signed message bytes, unrelated chains, wrong addresses and case-sensitive TRON addresses. Live binding requests with Wallet CLI signatures returned HTTP 200 for three distinct wallets; all three chain/address checks returned true using the same API key. No funds were transferred.Latest API-diagnostics patch
2e9a5ce2: both B.AI clients decode bounded HTTP/tRPC failures into fixed business explanations (bai_rejectedplus reason/operation/status), keep authentication and rate limits distinct, and redact unknown provider prose. Report failures preserve the transaction context and classified error without repeating payment. Local invalid inputs and binding response mismatches have actionable diagnostics.Validation during this patch: 235 files passed / 3 skipped; 2680 tests passed / 35 skipped. Final targeted regression: 8 files / 78 tests passed; package verification: 7 files / 59 tests passed. Typecheck, ESLint, dependency checks and build passed. Small final error-classification refinements after the full run were covered by targeted regression and the final build.
Integration boundaries
No real funds were transferred and no physical Ledger test was performed. Production B.AI credit attribution, remaining recharge API contracts, duplicate reporting and real facilitator settlement still require integration verification. Recovery results must be retained by the caller; a persistent recovery journal is not included. Removing the CLI dependency does not decommission the old recharge server.
Design and command behavior are documented in Wallet-CLI v4.14.0 技術方案,
ts/docs/development/bai-recharge.md, andts/docs/machine-interface.md.