Repository navigation
Conversation
x402-cli signs its payments through @bankofai/agent-wallet. Migrating its commands into wallet-cli means re-pointing that signer at a wallet-cli account; this is the seam that makes the rest of that migration mechanical. No x402 SDK is a dependency yet, and no command is wired. - domain/x402/network-id — convert between wallet-cli network ids and the CAIP-2 ids x402 uses. TRON differs only in base (tron:728126428 is tron:0x2b6653dc); eip155 identifiers are identical on both sides. - application/contracts/x402-payer — PayerSigner and PayerPolicy. The contract carries two closures rather than the domain Signer, because an x402 scheme calls the wallet from deep inside a payment flow, where nothing can run a Ledger's precheck / prompt / abort ceremony. - application/services/x402/payer-signer — resolve the active account, refusing a watch-only one before any keystore decrypt, and apply that ceremony once per signature. The TRON allowance path signs an approve transaction before the payment, so each signature needs its own round. - adapters/outbound/x402/signer-bridge — reshape the payer for the x402 SDK, declared structurally so no x402 package is imported. It is the one place every typed-data payload passes through, so it carries all three guards: the payload's payer must be the selected account, a GasFree maxFee must stay within the caller's ceiling, and the returned signature must be for the struct that was requested. The first two refuse before any signature is requested, so a rejected payment never reaches a device prompt. - domain/typed-data — resolvePrimaryType, so those guards work from the payload's real signing root instead of an optional field. Without it, a payload that omitted primaryType skipped all three checks. - three error codes: payer_mismatch, fee_cap_exceeded and signed_payload_mismatch, with their rows in machine-interface.md.
boboliu-1010
changed the title
Retain the release branch's legacy derivation fixes and 4.13.1 package metadata. Resolve version handling through package.json and preserve both x402 and derivation error documentation.
Bound report-only recovery for transaction indexing delays without replaying payments. Retain safe x402 failure phases and settlement evidence, and pass TRON callValue through resource estimation.
gummy789j
approved these changes
Sep 11, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add x402 payments and provider discovery, B.AI account queries and recharge, and eight ERC-8004 identity commands to the TypeScript wallet CLI. B.AI supports personal API keys and recharge on TRON/USDT, BSC/USDT and Base/USDC, including crediting another user. Signing stays in the existing wallet software/device flow.
Implementation
Mixed command-group help lists chain-bound and neutral commands together, so
bai --helpincludes both recharge and account/report commands. A regular registry-backed test prevents this discovery regression.CLI commands route through application use cases and ports to outbound adapters. B.AI recharge and ERC-8004 use chain/family bindings; account queries and report-only recovery do not require a signing wallet. ERC-8004 writes use the common transaction pipeline. x402 retains its SDK/facilitator lifecycle while reusing the wallet signer resolver and signature flow.
B.AI credential setup validates an existing wallet binding. Each wallet signs its own prescribed binding message; the adapter preserves message bytes and accepts canonical EVM binding responses while rejecting unrelated wallets/chains. No automatic binding command is added. The local confirmation cache is specific to the API key, chain and wallet.
Recharge validates the network, token, precision, minimum amount and binding, resolves the recipient, creates an order with the personal API key, pays through local
X402Service.roundtrip, then reports the transaction. Amounts remain strings across application ports; numeric conversion is checked at the B.AI HTTP boundary. Three trusted destinations live in outbound configuration, cannot be overridden, and require a release to change. The old recharge MCP is no longer a CLI dependency; the remote facilitator still verifies and settles payments.Settlement validation checks success, network, hash and payer. Equivalent valid TRON Base58Check and SDK hexadecimal payer representations compare as the same address. Failed validation retains safe candidate evidence and the original recharge context without declaring payment confirmed.
Recharge and
bai recharge-reportretry onlyTX_NOT_FOUND_OR_INVALIDandTX_TIMESTAMP_UNAVAILABLE: up to three retries after 15/20/25 seconds, at most four reports within a 90-second reporting budget including HTTP time. They never repeat payment. Other business, authentication and transport failures stop automatic reporting. Recovery preserves the hash, original recipient andretryPayment: false; recipient recovery requires original--toand--target-id. There is no persistent recovery queue.TRON exact uses SDK
allowanceMode: auto. EVM sponsored approval convertsgastogasLimit, preserving an explicit limit. EVM self-funded approval remains an explicit agent decision; Base USDC's EIP-3009 path does not require ERC20 allowance. The local B.AI paywall does not advertise sponsorship extensions. GasFree shortfalls do not fall back to the ordinary TRON wallet.Payment errors preserve the failure stage, safe HTTP status, recognized connection codes and candidate settlement hashes. Native facilitator connection exceptions are classified on the server and retained by the client. Unknown upstream prose and request contents are filtered. Post-settlement response failures retain settlement evidence; uncertain outcomes never trigger automatic repayment.
ERC-8004 SDK supplies registry configuration, ABI, address conversion and event parsing; no
ExternalSigneror separate SDK transaction sender is used. Receipt metadata is nested underidentity, ERC20/ERC721 approval semantics stay distinct, and URI loading is bounded. TRON payable resource estimation receives the samecallValueSunas transaction construction.Lockfile versions: x402 core
1.1.1-beta.1, TRON2.0.0-beta.1, EVM/fetch1.1.0, and 8004 SDK1.2.0-beta.1. x402 dependencies are bundled. Package version is currently 4.13.1, pending the release version update. This branch includes the v4.13.1 merge intorelease_v4.14.0; signer groundwork from #1000 retains its original authorship.Validation
59f7f5aa: 240 files passed / 3 skipped; 2787 tests passed / 35 skipped. Typecheck, dependency-boundary checks, ESLint, formatting and build passed.040ea1e5: 4 help test files / 39 tests passed; tarball creation, independent install and installed CLI verification: 7 files / 59 tests passed. Typecheck, ESLint, build and diff checks passed locally. This fixes the missingrechargerow that failed the Node 22/24 package check on88fa30b1; the new remote CI run remains to be confirmed.creditStatus: credited, approximately 67 seconds. Trace records one order, one verify, one settle and three reports; the wallet balance changed from 1 USDT to 0. Transaction. This validates automatic report recovery without a second payment; network-failure diagnostics are covered by simulated failures, not an induced mainnet outage.QA and release scope
Ready for QA with the latest commit included in the test build. Remaining acceptance coverage includes report idempotency, physical hardware wallets, deployed facilitator sponsorship extensions, and ERC-8004 transactions across supported networks. Successful B.AI mainnet tests do not establish coverage of those paths. Test funds must be replenished before more paid cases; the TRON USDT balance is now zero and remaining Base/BSC funds were returned earlier.
Update the package version and verify the final installable artifact before release. Removing the CLI's old recharge-server dependency does not decommission that remote service.
Repository behavior is documented in
ts/docs/development/architecture.md,ts/docs/development/bai-recharge.md,ts/docs/development/erc8004-sdk-integration.md, andts/docs/machine-interface.md.