diff --git a/changelog/index.md b/changelog/index.md
index b03016b..4498614 100644
--- a/changelog/index.md
+++ b/changelog/index.md
@@ -7,6 +7,33 @@ description: 'Product updates and announcements for BANK OF AI — all products,
Product updates and announcements for BANK OF AI.
+
+
Aug 25, 2026
+
+
+### x402 SDK v1.1.0 · Docs
+
+
New Releasex402Docs
+
+- **x402 SDK 1.1.0** — explicit payment flows (`upfront` / `escrow` on the wire as `extra.paymentFlow`, `authorization` by default), client spend controls on by default (`$1` per-payment cap, default-asset allowlist), payment-selection policies and lifecycle hooks, EVM smart-account support (ERC-7702, allowlisted ERC-6492), and a 90-second `HTTPFacilitatorClient` timeout. Upgrade all 11 packages together; Node.js 22+. [SDK Feature Matrix](../x402/sdk-features/)
+- **Docs corrections** — removed the obsolete facilitator-fee material (`base_fee`, `extra.fee`, `/fee/quote`); the anonymous `/settle` limit is 1 request/minute on the official deployment; GasFree is no longer described as auto-preferred — the CLI takes the first advertised requirement matching your filters, so pass `--scheme exact_gasfree` to force it; TRON Shasta is now documented as signed by the SDK/CLI but **not** settled by the official facilitator (use Nile or self-host); the CLI page now states its **pinned** dependencies — CLI 1.0.2 still bundles the `@bankofai/x402-*` SDK packages at 1.0.1 (`@bankofai/x402-gateway` at 1.0.2), so it does not yet carry the 1.1.0 client spend controls; and the Skills pages now install with `npx skills add … -g`. [x402 docs](../x402/)
+
+
+
+
+
+
Aug 20, 2026
+
+
+### Facilitator — BSC receipt reliability
+
+
FixFacilitator
+
+- Settlement receipt lookups on **BSC Mainnet** (`eip155:56`) fall back to a secondary RPC endpoint, so one unresponsive node no longer turns a settled payment into a failed one. [Official Facilitator](../x402/core-concepts/OfficialFacilitator/)
+
+
+
+
Jul 30, 2026
@@ -22,13 +49,29 @@ Product updates and announcements for BANK OF AI.
+
+
Jul 29, 2026
+
+
+### Official Facilitator — Base settlement
+
+
UpdateFacilitatorBase
+
+- The official facilitator now settles **Base USDC** — `eip155:8453` (Mainnet) and `eip155:84532` (Sepolia) are enabled alongside TRON Mainnet/Nile and BSC Mainnet/Testnet. The bundled example facilitator still registers only `eip155:97` and `eip155:56` on the EVM side, so self-hosting Base sellers must add the Base ids themselves. [Official Facilitator](../x402/core-concepts/OfficialFacilitator/)
+- **Breaking for self-hosters** — the facilitator config now takes canonical CAIP-2 ids only; friendly aliases such as `bsc:mainnet` and `tron:nile` are no longer resolved and are rejected at startup.
+
+
+
+
Jul 21, 2026
### Docs
-
Product UpdatesDocsx402
+
Product UpdatesDocsx402SKILLS
+
+- **SKILLS — `x402-payment` now pays through `x402-cli`** (1.0.1 or newer) instead of bundled local scripts, with a `--dry-run` preview, `--max-amount` caps, a required GasFree fee cap, and canonical CAIP-2 TRON ids. [Details](./skills/)
- **TRON network IDs now use CAIP-2 format** across the x402 docs — `tron:0x2b6653dc` (Mainnet), `tron:0xcd8690dc` (Nile), `tron:0x94a9059e` (Shasta). In application code, prefer the SDK constants `TRON_MAINNET` / `TRON_NILE` / `TRON_SHASTA` over hard-coded hex strings. [Network & Token Support](../x402/core-concepts/network-and-token-support/)
- **`auth-capture` scheme removed** — x402 now documents four payment schemes: `exact`, `upto`, `batch-settlement`, and `exact_gasfree` (TRON). [SDK Features](../x402/sdk-features/)
diff --git a/changelog/skills.md b/changelog/skills.md
index a97e5f5..483e6d8 100644
--- a/changelog/skills.md
+++ b/changelog/skills.md
@@ -7,6 +7,24 @@ description: 'Release notes for SKILLS.'
Release notes for SKILLS.
+
+
Jul 21, 2026
+
+
+### x402-payment now runs on the x402 CLI
+
+
Updatex402
+
+- **Payments go through `x402-cli`** (1.0.1 or newer) instead of bundled local TypeScript scripts. The skill checks your installed version and tells you how to install the CLI when it is missing.
+- **Every payment is previewed and capped** — a `--dry-run --json` preview before the first payment to an unfamiliar endpoint, and `--max-amount` on the real request. GasFree payments must also cap the relayer fee with `--max-gasfree-fee`, which the payment cap does not cover.
+- **Canonical CAIP-2 TRON identifiers only** — `tron:0x2b6653dc`, `tron:0xcd8690dc`, `tron:0x94a9059e`. Shorthand aliases such as `tron:mainnet` are rejected. The `agent-wallet` skill uses the same identifiers.
+- The retired `--gasfree-info` / `--gasfree-activate` script flags are gone, and uninstall now handles custom skill directories.
+
+👉 [Skill Catalog](/McpServer-Skills/SKILLS/BANKOFAISkill/)
+
+
+
+
Jul 10, 2026
diff --git a/changelog/x402.md b/changelog/x402.md
index 976e016..72ee9e8 100644
--- a/changelog/x402.md
+++ b/changelog/x402.md
@@ -7,6 +7,39 @@ description: 'Release notes for the x402 payment protocol, SDK, and CLI.'
Release notes for the x402 protocol, SDK, and [CLI](/x402/cli/).
+
+
+- **Payment flows are now explicit** — a scheme/network server declares the flows it supports per asset-transfer method. `upfront` and `escrow` travel on the wire as `extra.paymentFlow`; `authorization` stays the default and is omitted from `extra`. Legacy v1.0 servers that declare nothing keep using the authorization flow.
+- **Client spend controls are on by default** — a client pays only assets it recognizes from the default-asset registry, capped at `DEFAULT_MAX_AMOUNT_PER_PAYMENT` (`$1` worth) per payment. Raise the cap with `spendControls.maxAmountPerPayment`, allow a custom token with `spendControls.allowedAssets`, or switch the guard off with `spendControls: false`.
+- **Payment-selection policies and lifecycle hooks** — `PaymentPolicy` plus `onBeforePaymentCreation` / `onAfterPaymentCreation` / `onPaymentCreationFailure` / `onPaymentResponse`.
+- **EVM wallet compatibility** — deployed smart accounts, ERC-7702 delegation, and allowlisted ERC-6492 counterfactual wallets. ERC-6492 requires an explicit `eip6492AllowedFactories` allowlist on the facilitator.
+- **`HTTPFacilitatorClient`** gains typed timeout errors, rate-limit retries, stricter response validation, and a 90-second default timeout.
+- Upgrade all **11 `@bankofai/x402-*` packages together** — internal dependencies resolve to `~1.1.0`. The SDK requires **Node.js 22+**. Custom money parsers now receive decimal strings.
+
+👉 [SDK Feature Matrix](/x402/sdk-features/)
+
+
+
+
+
+
Aug 20, 2026
+
+
+### Facilitator — BSC receipt reliability
+
+
FixFacilitator
+
+- Settlement receipt lookups on **BSC Mainnet** (`eip155:56`) now fall back to a secondary RPC endpoint, so a single unresponsive node no longer turns a settled payment into a failed one.
+
+
+
+
Jul 30, 2026
@@ -43,6 +76,23 @@ Release notes for the x402 protocol, SDK, and [CLI](/x402/cli/).
+
+
Jul 29, 2026
+
+
+### Official Facilitator — Base settlement
+
+
UpdateFacilitatorBase
+
+- The official facilitator now settles **Base USDC**: `eip155:8453` (Mainnet) and `eip155:84532` (Sepolia) are enabled alongside TRON Mainnet/Nile and BSC Mainnet/Testnet.
+- Every enabled network registers `exact`, `upto`, and `batch-settlement`; TRON additionally registers `exact_gasfree` where the service holds GasFree relayer credentials. Query `/supported` for the authoritative list. The bundled example facilitator (`facilitator/basic`) still registers only `eip155:97` and `eip155:56` on the EVM side (its `TRON_NETWORKS` already covers Nile/Shasta/Mainnet), so self-hosting Base sellers must add the Base ids to `EVM_NETWORKS` themselves.
+- **Breaking for self-hosters** — the facilitator config now takes canonical CAIP-2 ids only. Friendly aliases such as `bsc:mainnet` and `tron:nile` are no longer resolved and are rejected at startup. [Network & Token Support](/x402/core-concepts/network-and-token-support/)
+
+👉 [Official Facilitator](/x402/core-concepts/OfficialFacilitator/)
+
+
+
+
Jul 20, 2026
diff --git a/devnotes/x402-stablecoin-payments-for-agents.md b/devnotes/x402-stablecoin-payments-for-agents.md
index 9b0a6f8..b98f6c6 100644
--- a/devnotes/x402-stablecoin-payments-for-agents.md
+++ b/devnotes/x402-stablecoin-payments-for-agents.md
@@ -81,7 +81,7 @@ Its limits are equally clear: when the real cost is only known after execution,
`exact_gasfree` is a TRON-only fixed-amount scheme. The payer can pay in USDT or USDD without holding TRX in their ordinary wallet; the official GasFree Proxy/relayer path submits the transaction and pays the corresponding on-chain resource cost.
-This is not universally "free" payment. The scheme requires the wallet, token, GasFree service, and Facilitator to all support the flow, and the fee may surface through service rules, asset balances, or the quote structure. Production deployments should explicitly check available assets, GasFree account status, fee configuration, and the failure fallback path — you cannot decide whether payment is possible from the main wallet's TRX balance alone.
+This is not universally "free" payment. The scheme requires the wallet, token, GasFree service, and Facilitator to all support the flow, and the cost surfaces as the GasFree **relayer fee**, which the client estimates and which is deducted from the payment token on top of the payment amount — the payment requirement itself carries no fee object. Production deployments should explicitly check available assets, GasFree account status, fee configuration, and the failure fallback path — you cannot decide whether payment is possible from the main wallet's TRX balance alone.
### 4.3 Upto: paying for actual usage
diff --git a/docs/BANK-OF-AI/QuickStart.md b/docs/BANK-OF-AI/QuickStart.md
index 80475ec..3621371 100644
--- a/docs/BANK-OF-AI/QuickStart.md
+++ b/docs/BANK-OF-AI/QuickStart.md
@@ -19,7 +19,7 @@ Want your AI client to gain BANK OF AI's on-chain capabilities? Just **two steps
Open whichever AI client you use (OpenClaw / Claude Code / Cursor / Codex / etc.) and paste this command in:
```
-Run npx skills add BofAI/skills to install every BANK OF AI Skill. After the install completes, run bankofai-guide to walk me through the next steps.
+Run npx skills add BofAI/skills -g to install every BANK OF AI Skill. After the install completes, run bankofai-guide to walk me through the next steps.
Note: please install into this Agent's own skills directory.
```
diff --git a/docs/McpServer-Skills/SKILLS/BANKOFAISkill.md b/docs/McpServer-Skills/SKILLS/BANKOFAISkill.md
index e939d15..a7caa39 100644
--- a/docs/McpServer-Skills/SKILLS/BANKOFAISkill.md
+++ b/docs/McpServer-Skills/SKILLS/BANKOFAISkill.md
@@ -93,7 +93,7 @@ Your AI's secure signing engine. This skill creates and manages encrypted wallet
> Setting up for the first time? Try: "Create a new agent wallet" — the AI walks you through choosing a wallet type (`local_secure` for an encrypted local key, or `privy` for a hosted wallet via API credentials), generating keys, and saving your master password.
-> Managing multiple chains? Try: "Show me all my wallets and their addresses" — one wallet derives both EVM and TRON addresses from the same key. Use `eip155:` for EVM networks (e.g. `eip155:1` Ethereum, `eip155:56` BSC, `eip155:137` Polygon, `eip155:42161` Arbitrum, `eip155:8453` Base) and `tron:mainnet` / `tron:nile` for TRON.
+> Managing multiple chains? Try: "Show me all my wallets and their addresses" — one wallet derives both EVM and TRON addresses from the same key. Use `eip155:` for EVM networks (e.g. `eip155:1` Ethereum, `eip155:56` BSC, `eip155:137` Polygon, `eip155:42161` Arbitrum, `eip155:8453` Base) and canonical CAIP-2 IDs for TRON: `tron:0x2b6653dc` (Mainnet), `tron:0xcd8690dc` (Nile), `tron:0x94a9059e` (Shasta).
> Need to sign something? Try: "Sign this transaction on BSC" — the AI handles the signing locally without broadcasting. Supports raw transactions, EIP-191 messages, and EIP-712 typed data (EVM only).
@@ -424,28 +424,36 @@ Changing Owner permissions is **irreversible** without the new keys. The skill v
## x402-payment {#x402-payment}
-Some APIs and AI agents require on-chain payment before use. This skill uses the x402 protocol to automatically complete "pay first, then receive" on-chain settlement — the AI detects the charge, completes the on-chain payment, gets the result, and reports back. It always asks for your confirmation before paying. Supports payments on multiple chains — **TRON (TRC20: USDT, USDD)** and **BSC (ERC20: USDT, USDC)** (each payment settles on its own chain; this is multi-chain support, not a cross-chain bridge), covering both mainnet and testnet (Nile / BSC testnet).
+Some APIs and AI agents require on-chain payment before use. This skill uses the x402 protocol to automatically complete "pay first, then receive" on-chain settlement — the AI detects the charge, previews it, completes the on-chain payment, gets the result, and reports back. It always asks for your confirmation before paying. Payments run through the `x402-cli` command-line tool (version **1.0.1 or newer**). The skill checks your installed version first and, if the CLI is missing, tells you how to install it (`npm install -g @bankofai/x402-cli@1.0.1` — the version the skill pins; the CLI's own latest release is 1.0.2) — no local payment scripts are involved. Payments settle on **TRON (TRC20: USDT, USDD)** or **BSC (ERC20: USDT on mainnet; USDT and USDC on testnet)** — each payment settles on its own chain; this is multi-chain support, not a cross-chain bridge.
**Completely safe — looking only, no spending:**
-> Verify my x402 wallet status (addresses + readiness).
+> Check whether x402-cli is installed and which version I have.
-> Show my GasFree wallet info (address, activation status, balances).
+> Preview what this endpoint would charge before I pay anything: https://api.example.com/protected
-> Fetch the manifest for this x402 agent: https://api.example.com/.well-known/agent.json
+> Show me what this endpoint would charge, without paying: https://api.example.com/protected
**Requires your confirmation:**
-> Use the x402 protocol to call this paid agent endpoint: https://api.example.com (replace with the actual paid endpoint URL you want to call)
+> Use the x402 protocol to call this paid agent endpoint, and don't spend more than 0.01 USDT: https://api.example.com (replace with the actual paid endpoint URL you want to call)
-> Activate my GasFree account on nile with USDT.
+> Pay this endpoint on Nile with USDT via GasFree — cap the payment at 0.01 and the relayer fee at 0.5.
+
+:::tip Always previewed, always capped
+Before the first payment to an unfamiliar endpoint, the skill runs a dry run (`x402-cli pay --dry-run --json`) and shows you the network, scheme, token, and exact amount. Unless you explicitly approve the exact advertised amount, every real payment then carries a spending cap (`--max-amount`), so the payment itself can't exceed what you approved — on GasFree the relayer fee sits on top of it, capped separately (see below).
+:::
:::tip GasFree support (TRON)
-When paying on TRON, the skill prefers `exact_gasfree` and automatically falls back to `exact` if GasFree payment creation fails. GasFree requires sufficient token balance in the GasFree wallet; inactive accounts can be activated on first payment when the advertised fees permit it. Use `--gasfree-info` to check wallet address, activation status, balance, and nonce; use `--gasfree-activate` to activate manually.
+GasFree (`scheme=exact_gasfree`) lets you pay on TRON without holding TRX for energy — a relayer covers the network cost and charges a small fee in the payment token instead (the relayer's service charge: a fixed transfer fee per payment, plus a one-time activation fee on first use, deducted from your GasFree account). The CLI takes the first payment option the endpoint offers that matches your constraints — it does not prefer GasFree — so say "require GasFree" whenever an endpoint also offers a normal TRON payment. Your GasFree account needs enough of the payment token to cover **both** the payment amount and the relayer fee. Because the spending cap doesn't include that fee, every GasFree payment also caps the fee (`--max-gasfree-fee`) unless you explicitly approve the estimate. GasFree is TRON-only — it can't be combined with a BSC (`eip155:*`) network.
+:::
+
+:::info Networks use canonical CAIP-2 IDs
+`tron:0x2b6653dc` (TRON Mainnet — USDT, USDD), `tron:0xcd8690dc` (Nile — USDT, USDD), `tron:0x94a9059e` (Shasta — USDT), `eip155:56` (BSC — USDT), `eip155:97` (BSC testnet — USDT, USDC). Shorthand aliases such as `tron:mainnet` are no longer accepted.
:::
:::caution Wallet credentials come from agent-wallet
-This skill loads signers via `agent-wallet` only — it does **not** read raw private keys from random config files. Set `AGENT_WALLET_PASSWORD` for encrypted local mode, or `AGENT_WALLET_PRIVATE_KEY` / `AGENT_WALLET_MNEMONIC` for static mode. Requires Node.js 20+.
+This skill loads signers via `agent-wallet` only — it does **not** read raw private keys from random config files, and never accepts a private key typed into a chat command. Set `AGENT_WALLET_PASSWORD` for encrypted local mode, or `AGENT_WALLET_PRIVATE_KEY` / `AGENT_WALLET_MNEMONIC` for static mode. Requires Node.js 20+.
:::
---
@@ -502,9 +510,9 @@ Use `twitter-mcp` when you want digests driven by the local `xurl` CLI; use `twi
The onboarding companion that ties the rest of the skill set together. You don't typically invoke this skill directly — it kicks in automatically in three situations:
-1. **Post-install setup.** Right after you run `npx skills add BofAI/skills`, the installer hands off to `bankofai-guide`. It installs the `@bankofai/agent-wallet` CLI globally, checks whether you already have a wallet, and asks whether you want to set one up now or later.
+1. **Post-install setup.** Right after you run `npx skills add BofAI/skills -g`, the installer hands off to `bankofai-guide`. It installs the `@bankofai/agent-wallet` CLI globally, checks whether you already have a wallet, and asks whether you want to set one up now or later.
2. **First-wallet creation.** If you have no wallet yet, it offers two paths: a **quick setup** (strongly recommended — fully automated, takes ~10 seconds, generates an encrypted `local_secure` wallet and a strong random password) and a **detailed setup** (step-by-step walkthrough with custom options). Once your wallet is ready, it shows you both the EVM and TRON addresses and tells you where to deposit USDT.
-3. **Wallet guard.** Signing skills (`sunswap`, `sunperp-skill`, `trc20-toolkit-skill`, `multisig-permissions`, `x402-payment`) run `agent-wallet list` first to check wallet state before any on-chain operation. **Only when no wallet is found** do they hand off to `bankofai-guide`, which pauses the current operation, walks you through creating one in a minute or two, and then returns control to the original flow.
+3. **Wallet guard.** Signing skills (`sunswap`, `sunperp-skill`, `sunpump-agent-skill`, `trc20-toolkit-skill`, `multisig-permissions`) run `agent-wallet list` first to check wallet state before any on-chain operation. **Only when no wallet is found** do they hand off to `bankofai-guide`, which pauses the current operation, walks you through creating one in a minute or two, and then returns control to the original flow.
**Sample prompts that will activate it:**
diff --git a/docs/McpServer-Skills/SKILLS/Faq.md b/docs/McpServer-Skills/SKILLS/Faq.md
index cd64e03..3ddd7e1 100644
--- a/docs/McpServer-Skills/SKILLS/Faq.md
+++ b/docs/McpServer-Skills/SKILLS/Faq.md
@@ -173,10 +173,10 @@ For example, if you think 20x leverage is still too risky for perpetual trading,
rm -rf ~/.agents/skills/sunswap-dex-trading
```
-**Update:** Re-run the install command. It will update all skills to the latest version.
+**Update:** Re-run the install command (keep `-g` so it refreshes the global copy). It will update all skills to the latest version.
```bash
-npx skills add https://github.com/BofAI/skills
+npx skills add https://github.com/BofAI/skills -y -g
```
---
diff --git a/docs/McpServer-Skills/SKILLS/QuickStart.md b/docs/McpServer-Skills/SKILLS/QuickStart.md
index 1ad1dcc..e882f4b 100644
--- a/docs/McpServer-Skills/SKILLS/QuickStart.md
+++ b/docs/McpServer-Skills/SKILLS/QuickStart.md
@@ -22,7 +22,7 @@ If you're already using a Skills-compatible AI Agent (OpenClaw, a Telegram bot,
2. Copy and paste the following prompt:
```
- Run npx skills add BofAI/skills to install all BANK OF AI skills. After installation, use bankofai-guide to guide subsequent operations.
+ Run npx skills add BofAI/skills -g to install all BANK OF AI skills. After installation, use bankofai-guide to guide subsequent operations.
Note: Please install to the skill directory corresponding to the current Agent.
```
@@ -42,19 +42,19 @@ You don't need to know what `npx`, `npm`, or "global install" mean. The AI handl
If you have Node.js installed and prefer the command line, simply tell your AI Agent to execute the following command:
```bash
-npx skills add https://github.com/BofAI/skills -y
+npx skills add https://github.com/BofAI/skills -y -g
```
-The `-y` flag skips all interactive prompts and installs all available Skills by default. Once complete, it will show ✅ Installation complete! along with the full list of installed Skills.
+The `-y` flag skips all interactive prompts and installs all available Skills by default. The `-g` flag installs them **globally** (user-level, under `~/.agents/skills/`) so every project can use them — keep it, otherwise the installer only installs into the directory you happen to be in. Once complete, it will show ✅ Installation complete! along with the full list of installed Skills.
---
### Method 3: Interactive Install (Most Control)
-If you want to choose which Skills to install and the installation scope, remove the `-y` flag:
+If you want to choose which Skills to install and which AI tools to install them to, drop the `-y` flag but keep `-g`:
```bash
-npx skills add https://github.com/BofAI/skills
+npx skills add https://github.com/BofAI/skills -g
```
:::tip
@@ -89,16 +89,16 @@ Unless you're sure you only need specific skills, install them all. Skills use a
The installer auto-detects AI tools on your computer (e.g., Cursor, Claude Code, Cline, etc.). Use Space to select the ones you want:
```
-◇ 71 agents
+◇ 77 agents
◇ Which agents do you want to install to?
│ Amp, Antigravity, Antigravity CLI, Cline, Codex, Cursor, Deep Agents,
│ Gemini CLI, GitHub Copilot, Kimi Code CLI, OpenCode, Warp, Zed,
-│ Claude Code, OpenClaw … (71 in total — tick the ones you actually use)
+│ Claude Code, OpenClaw … (77 in total — tick the ones you actually use)
```
-**3️⃣ Choose installation scope**
+**3️⃣ Installation scope**
-Select `Project` (current project only) or `User` (globally available across all projects):
+Because you passed `-g`, the installer skips this question and installs at user level, under `~/.agents/skills/`. Without `-g` it asks you to choose between `Project` (current project only) and `User` (globally available across all projects):
```
◇ Installation scope
@@ -274,6 +274,10 @@ When you see output like this, all Skills have been successfully installed to yo
└ Done! Review skills before use; they run with full agent permissions.
```
+:::info A "Failed to install" list at the end is normal
+A global install sometimes ends with `■ Failed to install 14` and one line per skill saying `PromptScript: PromptScript does not support global skill installation`. That is a single client — PromptScript — which has no global install location. It does not affect anything else: the `✓ Installed 14 skills` list printed just above it is the real result, and Claude Code, OpenClaw, Codex and the rest are installed.
+:::
+
### Verify Installation
Open your AI chat and type:
diff --git a/docs/x402/api-catalog/get-started.md b/docs/x402/api-catalog/get-started.md
index 01129f4..01ce324 100644
--- a/docs/x402/api-catalog/get-started.md
+++ b/docs/x402/api-catalog/get-started.md
@@ -87,7 +87,7 @@ A service that settles on multiple chains exposes one route per network (`x402Ro
## What happens during a paid call
-Every call clears on-chain via x402 — the quoted price is exactly what you pay, always:
+Every call clears on-chain via x402. On `exact` routes the quoted price is exactly what you pay; on TRON `exact_gasfree` routes the relayer additionally deducts its energy fee from the payment token, so cap it with `--max-gasfree-fee`:
1. **Agent calls** — requests the target endpoint.
2. **Gateway quotes** — returns the price (HTTP `402`).
diff --git a/docs/x402/api-catalog/reference.md b/docs/x402/api-catalog/reference.md
index 8b33231..696005b 100644
--- a/docs/x402/api-catalog/reference.md
+++ b/docs/x402/api-catalog/reference.md
@@ -63,13 +63,13 @@ An endpoint may serve the same capability across several chains, each settling t
| `network` | string | Canonical CAIP-2 chain ID this route settles on (e.g. `tron:0x2b6653dc`, `eip155:56`, `eip155:8453`). Legacy TRON aliases such as `tron:nile` are rejected by schema validation. |
| `provider` | string | The gateway provider `fqn` that handles this network |
| `scheme` | string | x402 payment scheme for this route: `exact` or, on TRON, `exact_gasfree` — each route declares its own |
-| `assetTransferMethod` | string | Authorization used by an `exact` route: `permit2` on TRON and BSC, `eip3009` on Base USDC. **Omit** it on `exact_gasfree` routes. |
+| `assetTransferMethod` | string | Authorization used by an `exact` route — only `permit2` (TRON and BSC) is meaningful. **Omit** it on Base USDC routes and on `exact_gasfree` routes: the gateway emits the EIP-3009 `name` / `version` pair for Base itself, and `x402-cli` rejects any other `assetTransferMethod` value with `INVALID_PAYMENT_REQUIREMENT`. |
| `url` | string | Full gateway URL for this network's route |
The build passes this through to outputs as `x402_routes`. When present, callers/agents pick the route matching their intended payment chain; the top-level `url` remains the default route.
:::note GasFree routes
-On TRON you can add an `exact_gasfree` route alongside the `exact` one for the same endpoint: a relayer pays the network energy and deducts its fee from the payment token, so the payer needs no TRX. GasFree routes are TRON-only and must not carry `assetTransferMethod`. With x402 SDK 1.0.1 the relayer cost is estimated client-side, so catalog routes must **not** publish the legacy `fee` or `feeConfig` fields.
+On TRON you can add an `exact_gasfree` route alongside the `exact` one for the same endpoint: a relayer pays the network energy and deducts its fee from the payment token, so the payer needs no TRX. GasFree routes are TRON-only and must not carry `assetTransferMethod`. Since x402 SDK 1.0.1 (current release 1.1.0) the relayer cost is estimated client-side, so catalog routes must **not** publish the legacy `fee` or `feeConfig` fields.
:::
For example, an endpoint may expose one route per supported chain — TRON Mainnet, BSC Mainnet, and Base Mainnet — each with its own `provider` and `scheme`. To call one, point `x402-cli pay` at the chosen route's `url` and pass the matching `--network` / `--scheme`:
@@ -118,12 +118,13 @@ security shopping storage translation
|---|---|
| TRON mainnet | `tron:0x2b6653dc` |
| TRON Nile testnet | `tron:0xcd8690dc` |
-| TRON Shasta testnet | `tron:0x94a9059e` |
+| TRON Shasta testnet | `tron:0x94a9059e` — schema-level only: the gateway has no Shasta token registry and the official facilitator does not settle it, so it cannot back a live route |
| BNB Chain (BSC) | `eip155:56` |
| BNB Smart Chain testnet | `eip155:97` |
| Base mainnet | `eip155:8453` |
+| Base Sepolia testnet | `eip155:84532` |
-The build resolves each chain ID into display metadata (`kind` / `label` / `label_zh`) so the frontend doesn't have to parse CAIP-2 itself — see [Frontend display fields](#frontend-display-fields).
+Check the published `catalog.json` for which routes are actually live on each chain. The build resolves each chain ID into display metadata (`kind` / `label` / `label_zh`) so the frontend doesn't have to parse CAIP-2 itself — see [Frontend display fields](#frontend-display-fields).
## Validation and secret scanning
diff --git a/docs/x402/cli/command-reference.md b/docs/x402/cli/command-reference.md
index 8417edb..b16adb2 100644
--- a/docs/x402/cli/command-reference.md
+++ b/docs/x402/cli/command-reference.md
@@ -43,9 +43,9 @@ x402-cli pay [options]
| Option | Description |
| :--- | :--- |
-| `--method ` | HTTP method (default: `GET`) |
+| `--method ` | HTTP method — uppercase, one of `DELETE`, `GET`, `HEAD`, `OPTIONS`, `PATCH`, `POST`, `PUT` (default: `GET`); anything else fails with `INVALID_ARGUMENT` (exit 2) |
| `--header "Name: Value"` | Request header; repeatable |
-| `--body ` | Request body for non-`GET`/`HEAD` methods |
+| `--body ` | Request body; ignored for `GET` and `HEAD` |
| `--network ` | Require a specific network (e.g. `tron:0xcd8690dc`, `base-mainnet`) |
| `--token ` | Require a specific token (e.g. `USDT`, `USDC`) |
| `--asset ` | Require a specific asset address |
@@ -99,9 +99,9 @@ If the endpoint does not return `402`, the CLI reports the actual status and res
### GasFree payments (TRON) {#gasfree-payments-tron}
-On TRON, `scheme=exact_gasfree` lets a relayer pay the network energy and deduct its fee from the payment token, so the payer doesn't need to hold TRX. The CLI normally selects this scheme automatically when the server's `402` challenge advertises it; pass `--scheme exact_gasfree` to require it explicitly.
+On TRON, `scheme=exact_gasfree` lets a relayer pay the network energy and deduct its fee from the payment token, so the payer doesn't need to hold TRX. The CLI does **not** prefer GasFree: it takes the first requirement in the server's `accepts` list that passes your `--network` / `--scheme` / `--token` filters. If the endpoint also advertises plain `exact`, pass `--scheme exact_gasfree` to guarantee the gasless route.
-GasFree fees are **separate** from the advertised payment amount. Set a fee limit so the CLI estimates the relayer fee and rejects the payment before signing if the estimate is too high:
+GasFree fees are **separate** from the advertised payment amount — they are the relayer's service charge (a fixed per-payment transfer fee, plus a one-time activation fee if the GasFree account is not yet activated), deducted from your GasFree account in the payment token. The CLI always estimates the relayer fee for an `exact_gasfree` requirement and reports it as `gasfreeEstimate` (`fee` and `total`) in the result; adding a fee limit makes it abort before signing when either the estimate or the final signed `maxFee` exceeds your cap:
```bash
x402-cli pay https://api.example.com/pay \
@@ -112,9 +112,9 @@ x402-cli pay https://api.example.com/pay \
--json
```
-`--max-gasfree-fee` and `--max-gasfree-fee-raw` are mutually exclusive, and only apply to an `exact_gasfree` requirement. Override the relayer endpoint with `--gasfree-api-url ` or `X402_GASFREE_API_URL`.
+`--max-gasfree-fee` and `--max-gasfree-fee-raw` are mutually exclusive, and are rejected with `INVALID_ARGUMENT` (exit 2) if the requirement the CLI selects is not `exact_gasfree`. Override the relayer endpoint with `--gasfree-api-url ` or `X402_GASFREE_API_URL`.
-A paid response distinguishes `settled` (the payment cleared on-chain) from `delivered` (the upstream HTTP business response succeeded). A settled upstream failure reports `paid=true`, `settled=true`, `delivered=false` and still includes its transaction information — inspect the transaction and provider behavior before retrying.
+A paid response distinguishes `settled` (the payment cleared on-chain) from `delivered` (the upstream HTTP business response succeeded). A settled-but-undelivered request exits with code 1 and an error envelope (`ok: false`, `error.code: HTTP_ERROR`, or `RATE_LIMITED` on 429); the `paid` / `settled` / `delivered` flags and `paymentResponse` are carried under `error.details`. Read them from there for reconciliation, and do not retry blindly.
### Paying on Base {#paying-on-base}
@@ -146,10 +146,13 @@ Some settings have no flag and are configured through the environment only:
| `TRON_GRID_API_KEY` | TronGrid API key — set this to avoid public rate limits |
| `X402_TRON_ALLOWANCE_MODE` | TRON allowance handling; defaults to `auto` |
| `EVM_RPC_URL` | Default EVM RPC endpoint |
-| `EVM_RPC_URL_8453` / `EVM_RPC_URL_84532` | Per-network RPC for Base Mainnet / Base Sepolia |
+| `EVM_RPC_URL_` | Per-network RPC, e.g. `EVM_RPC_URL_8453`, `EVM_RPC_URL_84532`, `EVM_RPC_URL_56`, `EVM_RPC_URL_97` |
+| `RPC_URL` | Generic EVM RPC fallback |
| `X402_GASFREE_API_URL` | Override the TRON GasFree relayer API |
| `EVM_PRIVATE_KEY` / `TRON_PRIVATE_KEY` / `PRIVATE_KEY` | Override Agent Wallet — development and CI only |
+> EVM RPC precedence: `--rpc-url` → `EVM_RPC_URL_` → `RPC_URL` → `EVM_RPC_URL` → a built-in public endpoint. The built-in endpoints (BSC as well as Base) are for development only.
+
---
## `serve`
@@ -174,19 +177,18 @@ x402-cli serve --pay-to [options]
| `--port ` | Bind port (default: `4020`) |
| `--resource-url ` | URL advertised in the payment requirement |
| `--facilitator-url ` | Facilitator base URL (default: `https://facilitator.bankofai.io`) |
-| `--valid-for-seconds ` | How long the payment requirement stays valid (default: `300`) |
+| `--valid-for-seconds ` | How long the payment requirement stays valid — integer 1–86400 (default: `300`) |
| `--timeout-ms ` | Facilitator timeout in ms (default: `30000`) |
| `-d, --daemon` | Run in the background and print the child pid |
| `--json` | Print the JSON envelope |
-The server exposes four routes:
+The server exposes these routes — the paywall branches on the `PAYMENT-SIGNATURE` header, not on the HTTP method:
| Route | Purpose |
| :--- | :--- |
| `GET /health` | Returns `{ "ok": true }` |
| `GET /.well-known/x402` | Machine-readable payment metadata (network, scheme, asset, amount, `payTo`) |
-| `GET /pay` | Returns `402 Payment Required` with the challenge header |
-| `POST /pay` | Verifies the payment, settles it, and returns the transaction |
+| `/pay` (any method) | Returns `402 Payment Required` with the challenge header when the request carries no `PAYMENT-SIGNATURE`; with that header, verifies and settles the payment through the facilitator and returns the transaction |
**Examples:**
@@ -235,7 +237,9 @@ x402-cli gateway [options]
| `scaffold ` | Write a starter `provider.yml` |
| `catalog ` | Build/check/search gateway catalog assets |
-`start` and `gateway catalog` require the `@bankofai/x402-gateway` runtime. Install it (`npm install -g @bankofai/x402-gateway`), run from a checkout that has `../x402-gateway/dist/cli.js`, or pass `--gateway-bin `.
+`gateway start` spawns a gateway runtime, but the CLI already ships one: the published package bundles `dist/gateway/cli.js` and depends on `@bankofai/x402-gateway`, so a normal `npm install -g @bankofai/x402-cli` needs nothing extra. It resolves the runtime in order — `--gateway-bin`, the `@bankofai/x402-gateway` dependency, the bundled `dist/gateway/cli.js`, `x402-gateway` on `PATH`, then `../x402-gateway/dist/cli.js` in a checkout. `gateway check`, `gateway catalog build`, `gateway catalog pay-assets`, and `catalog build` call the gateway library in-process; `gateway scaffold` only writes a template file, and `gateway search` / `gateway catalog search` read a catalog source.
+
+Defaults: `gateway start` binds `--host 127.0.0.1 --port 4020` and reads `--providers providers`; `gateway check` also defaults to `providers`; `gateway scaffold` writes to `--output-dir providers/` with `--forward-url https://api.example.com`; a bare `x402-cli gateway catalog` runs `build`.
**Validate provider files:**
@@ -300,7 +304,9 @@ x402-cli catalog [o
| :--- | :--- |
| `--catalog ` | `catalog.json` path or URL |
| `--provider ` | Provider FQN (for `export-gateway`) |
-| `--output-dir ` | Output directory for generated files |
+| `--output-dir ` | Output directory for generated files (`export-gateway`) |
+| `--output ` | Write the built catalog JSON to this file (`build`) |
+| `--dist-dir ` | Write the built catalog to `/catalog.json` (`build`) |
| `-n, --limit ` | Search result limit (default: `10`) |
| `--include-blocked` | Include blocked providers in search results |
| `--timeout-ms ` | Network timeout in ms (default: `30000`) |
diff --git a/docs/x402/cli/faq.md b/docs/x402/cli/faq.md
index 0630ff5..c278a6e 100644
--- a/docs/x402/cli/faq.md
+++ b/docs/x402/cli/faq.md
@@ -69,7 +69,7 @@ Base settles USDC with **EIP-3009** (`transferWithAuthorization`) instead of Per
### Can I pay without holding TRX?
-Yes, on TRON, using GasFree. With `scheme=exact_gasfree`, a relayer pays the network energy and deducts its fee from the payment token, so the payer wallet needs only the stablecoin — no TRX. The CLI selects `exact_gasfree` automatically when the endpoint advertises it, or you can require it with `--scheme exact_gasfree`. Because the relayer fee is separate from the payment amount, cap it with `--max-gasfree-fee `. See [GasFree payments](./command-reference.md#gasfree-payments-tron).
+Yes, on TRON, using GasFree. With `scheme=exact_gasfree`, a relayer pays the network energy and deducts its fee from the payment token, so the payer wallet needs only the stablecoin — no TRX. The CLI takes the first advertised requirement matching your filters and does not prefer GasFree, so require it with `--scheme exact_gasfree` whenever the endpoint also offers plain `exact`. Because the relayer fee is separate from the payment amount, cap it with `--max-gasfree-fee `. See [GasFree payments](./command-reference.md#gasfree-payments-tron).
---
@@ -99,7 +99,13 @@ Every failure prints a stable error `code`, a message, and a `hint`. Add `--json
| `DEADLINE_OR_CLOCK_SKEW` | Requirement expired or clock is off | Sync your local clock and retry with a fresh requirement |
| `RATE_LIMITED` | Upstream service or RPC is rate limiting | Wait briefly and retry |
| `NETWORK_ERROR` | Could not reach the URL/RPC | Check the URL, local server, proxy, and connectivity |
-| `SDK_API_DRIFT` | Installed SDK packages don't match the CLI | Reinstall `@bankofai/x402-cli` and its SDK dependencies |
+| `SDK_API_DRIFT` | Installed SDK packages don't match the CLI | Reinstall `@bankofai/x402-cli` (its SDK dependencies are pinned, so don't upgrade them separately) |
+| `INVALID_SETTLEMENT` | The gateway returned a `PAYMENT-RESPONSE` that is not a successful settlement | Do not treat the request as paid; contact the gateway operator |
+| `WALLET_ADDRESS_MISMATCH` | The selected wallet doesn't match the payer in the typed data | Reselect the wallet and retry with a fresh requirement |
+| `INVALID_PAYMENT_REQUIREMENT` | The `402` requirement failed structural validation (scheme, network, amount, address, timeout, resource URL) | The endpoint is misconfigured; contact the provider |
+| `TOKEN_BALANCE_CHECK_FAILED` | The balance check on the payment token failed | Verify the RPC endpoint and the token/network pair |
+| `HTTP_ERROR` | The paid retry returned a non-2xx status | Read `error.details` for `settled` / `paymentResponse` before retrying |
+| `IO_ERROR` | Fallback code for an error the CLI could not classify (local file read/write failures land here too) | Re-run with `--json` and read the raw `message`; check the provider/gateway logs |
### "402 response missing PAYMENT-REQUIRED header"
@@ -115,7 +121,7 @@ The endpoint offered payment options, but none matched your `--network`, `--toke
### `gateway start` says the runtime isn't found
-`gateway start` and `gateway catalog` need the separate `@bankofai/x402-gateway` package. Install it (`npm install -g @bankofai/x402-gateway`), run from a checkout that has `../x402-gateway/dist/cli.js`, or point at a binary with `--gateway-bin `.
+This usually means a broken or partial install: the CLI normally bundles the gateway runtime (`dist/gateway/cli.js`) and depends on `@bankofai/x402-gateway`, so reinstall `@bankofai/x402-cli` first, or point at another runtime with `--gateway-bin `. Only `gateway start` needs that runtime at all: `gateway check`, `gateway catalog build`, `gateway catalog pay-assets`, and `catalog build` call the gateway library in-process, `gateway scaffold` just writes a template file, and the search commands read a catalog source.
### How do I validate my provider files before deploying?
diff --git a/docs/x402/cli/index.md b/docs/x402/cli/index.md
index 5cd5c6e..fe3db6b 100644
--- a/docs/x402/cli/index.md
+++ b/docs/x402/cli/index.md
@@ -8,7 +8,7 @@ description: >-
## What is x402 CLI?
-x402 CLI (`@bankofai/x402-cli`) brings the [x402 payment protocol](../index.md) to your terminal. It is a single, dependency-light command that lets a human operator, a shell script, or an AI agent **pay an x402-protected URL, stand up a local paywall, and browse the provider catalog** — without writing any integration code.
+x402 CLI (`@bankofai/x402-cli`) brings the [x402 payment protocol](../index.md) to your terminal. It is a single command that lets a human operator, a shell script, or an AI agent **pay an x402-protected URL, stand up a local paywall, and browse the provider catalog** — without writing any integration code.
Think of it this way: the [x402 SDK](../sdk-features.md) is what you embed inside an application to charge for or pay for a resource. The CLI is the same capability wrapped as a command you can run right now:
@@ -17,7 +17,7 @@ Think of it this way: the [x402 SDK](../sdk-features.md) is what you embed insid
x402-cli pay https://api.example.com/paid --network tron:0xcd8690dc --token USDT
```
-It is built entirely on the published TypeScript SDK packages — `@bankofai/x402-core`, `@bankofai/x402-evm`, `@bankofai/x402-fetch`, and `@bankofai/x402-tron`. Stablecoin payments use `scheme=exact`: Permit2 authorization on TRON and BSC, EIP-3009 on Base USDC. TRON also supports `scheme=exact_gasfree`, where a relayer pays the network energy and deducts its fee from the payment token — so the payer doesn't need to hold TRX. See [GasFree payments](./command-reference.md#gasfree-payments-tron).
+It is built entirely on the published TypeScript SDK packages, bundled at pinned versions rather than tracking the newest SDK release — CLI 1.0.2 ships `@bankofai/x402-core`, `-evm`, `-fetch`, and `-tron` at 1.0.1, plus `@bankofai/x402-gateway` 1.0.2 and `@bankofai/agent-wallet` 2.4.0. Stablecoin payments use `scheme=exact`: Permit2 authorization on TRON and BSC, EIP-3009 on Base USDC. TRON also supports `scheme=exact_gasfree`, where a relayer pays the network energy and deducts its fee from the payment token — so the payer doesn't need to hold TRX. See [GasFree payments](./command-reference.md#gasfree-payments-tron).
By default, `pay` signs with your active [Agent Wallet](../../Agent-Wallet/Intro.md) — no private key in an environment variable. See [Paying with Agent Wallet](./command-reference.md#paying-with-agent-wallet).
@@ -41,7 +41,7 @@ Read-only commands (`pay --dry-run`, `catalog search`, `gateway check`) need no
## Human-readable by default, JSON when you need it
-Output is human-friendly text by default. Add `--json` to any command for a stable, machine-readable envelope — ideal for scripts and AI agents:
+Output is human-friendly text by default. Add `--json` to any command that returns a result for a stable, machine-readable envelope — ideal for scripts and AI agents. (`gateway start` streams the gateway's own output and emits no envelope; `catalog pay-json --raw` prints the bare payload.)
```bash
x402-cli pay 'https://x402-gateway.bankofai.io/providers/defillama-tvl-tron/protocols' \
@@ -89,7 +89,7 @@ The CLI ships a built-in token registry. Pass a network with `--network` and a t
| :--- | :--- | :--- |
| **TRON Mainnet** | `tron:0x2b6653dc` | USDT, USDD |
| **TRON Nile Testnet** | `tron:0xcd8690dc` | USDT, USDD |
-| **TRON Shasta Testnet** | `tron:0x94a9059e` | USDT |
+| **TRON Shasta Testnet** | `tron:0x94a9059e` | USDT (signing only — see note) |
| **BSC Mainnet** | `eip155:56` | USDT |
| **BSC Testnet** | `eip155:97` | USDT, USDC |
| **Base Mainnet** | `eip155:8453` | USDC |
@@ -104,6 +104,10 @@ Always pass TRON networks as their canonical CAIP-2 identifiers (`tron:0x…`).
| `base-mainnet` | `eip155:8453` |
| `base-sepolia` | `eip155:84532` |
+:::caution Shasta is not settled by the official facilitator
+The CLI accepts `tron:0x94a9059e`, but the official facilitator (`https://facilitator.bankofai.io`) enables only TRON Mainnet/Nile, BSC Mainnet/Testnet, and Base Mainnet/Sepolia. A Shasta payment therefore cannot be verified or settled there — use `tron:0xcd8690dc` (Nile) for TRON testing, or run your own facilitator with Shasta registered.
+:::
+
Registered token decimals are authoritative and can't be overridden. For an unregistered, non-Base asset, pass `--asset ` together with `--decimals `.
:::note Authorization differs by chain
diff --git a/docs/x402/cli/quickstart.md b/docs/x402/cli/quickstart.md
index e478a82..9256ad9 100644
--- a/docs/x402/cli/quickstart.md
+++ b/docs/x402/cli/quickstart.md
@@ -97,7 +97,7 @@ x402-cli pay '' \
`--max-amount` caps what you're willing to pay: if the endpoint's price exceeds it, the CLI aborts before signing. The same command works on EVM networks — just point `--network` at one, such as `eip155:97` (BSC Testnet) or `base-sepolia` (Base Sepolia, USDC).
:::tip No TRX? Use GasFree
-On TRON, if the endpoint advertises `exact_gasfree`, the CLI can pay without any TRX in your wallet — a relayer covers the network energy and takes its fee from the payment token. The CLI selects it automatically, or you can require it with `--scheme exact_gasfree` and cap the relayer fee with `--max-gasfree-fee`. See [GasFree payments](./command-reference.md#gasfree-payments-tron).
+On TRON, if the endpoint advertises `exact_gasfree`, the CLI can pay without any TRX in your wallet — a relayer covers the network energy and takes its fee from the payment token. The CLI picks the first advertised requirement that matches your filters — it does not prefer GasFree — so require it with `--scheme exact_gasfree` when the endpoint also offers plain `exact`, and cap the relayer fee with `--max-gasfree-fee`. See [GasFree payments](./command-reference.md#gasfree-payments-tron).
:::
---
@@ -119,8 +119,7 @@ It exposes:
- `GET /health` — liveness check
- `GET /.well-known/x402` — machine-readable payment metadata
-- `GET /pay` — returns `402 Payment Required`
-- `POST /pay` — verifies and settles a submitted payment through the facilitator
+- `/pay` — returns `402 Payment Required` when the request has no `PAYMENT-SIGNATURE` header; with that header it verifies and settles the payment through the facilitator (any HTTP method)
In another terminal, pay it:
diff --git a/docs/x402/core-concepts/OfficialFacilitator.md b/docs/x402/core-concepts/OfficialFacilitator.md
index bb03435..0b46cc8 100644
--- a/docs/x402/core-concepts/OfficialFacilitator.md
+++ b/docs/x402/core-concepts/OfficialFacilitator.md
@@ -56,7 +56,7 @@ Official Facilitator supports **two calling modes**.
| Mode | Rate Limit | Description |
|-----|-----|-----|
-| **Anonymous Mode** | 10 times / minute (default, configurable) | No API Key required, suitable for local development and functional testing |
+| **Anonymous Mode** | 1 time / minute on the official deployment (configurable; the code default is 10/minute when unset) | No API Key required, suitable for local development and functional testing |
| **API Key Mode** | 1000 times / minute | API Key required, suitable for production environments and high-frequency payment requests |
The calling methods for both modes are exactly the same, but they differ in **identity recognition and interface rate limiting strategies**.
@@ -70,7 +70,7 @@ If the request **does not carry an API Key**, the Facilitator will treat the req
In anonymous mode:
- The `/settle` interface is **rate-limited**
-- **Maximum 10 calls per minute** (default, configurable)
+- **1 call per minute** on the official deployment (configurable; the code default is 10/minute when unset)
This mode is mainly used for:
@@ -252,7 +252,17 @@ After clicking **"Confirm"**, you will return to the Dashboard page, and the API
| GET | `/payments?network=&nonce=[&asset=&payer=]` | Query payment records by the on-chain authorization identity |
| GET | `/payments` | Authenticated seller's settlement feed (`?limit=&offset=`) |
-> There is **no** `/fee/quote` endpoint — fee terms travel inside the payment requirements' `extra` field. Rate limiting only applies to the `/settle` interface; other interfaces are not affected by rate limiting.
+> There is **no** `/fee/quote` endpoint, and the schemes carry no facilitator fee. Rate limiting only applies to the `/settle` interface; other interfaces are not affected by rate limiting.
+
+### Networks and schemes the official service settles
+
+| Network | Environment |
+|---|---|
+| `tron:0x2b6653dc` (TRON Mainnet) · `tron:0xcd8690dc` (Nile) | mainnet · testnet |
+| `eip155:56` (BSC) · `eip155:97` (BSC testnet) | mainnet · testnet |
+| `eip155:8453` (Base) · `eip155:84532` (Base Sepolia) | mainnet · testnet |
+
+Each of these networks registers `exact`, `upto`, and `batch-settlement`; TRON additionally registers `exact_gasfree` where the service holds GasFree relayer credentials (TRON Mainnet and Nile). Query `/supported` for the authoritative list of the deployment you are pointing at.
### Payment Record Query
@@ -277,7 +287,7 @@ The `/payments/tx/{tx_hash}` and `/payments?network=&nonce=[&asset=&payer=]` int
**Q: Can it run normally without configuring an API Key?**
-Yes, it can run, but the `/settle` interface is limited to 10 calls per IP per minute by default. This is only suitable for testing; any real traffic must be configured with an API Key.
+Yes, it can run, but on the official deployment the `/settle` interface is limited to 1 call per IP per minute (the facilitator service's built-in default is 10/minute when the deployment does not configure it). This is only suitable for testing; any real traffic must be configured with an API Key.
**Q: Does the API Key expire?**
diff --git a/docs/x402/core-concepts/facilitator.md b/docs/x402/core-concepts/facilitator.md
index 79133be..bd1265f 100644
--- a/docs/x402/core-concepts/facilitator.md
+++ b/docs/x402/core-concepts/facilitator.md
@@ -19,7 +19,7 @@ By introducing a Facilitator, servers no longer need to maintain direct connecti
- **Payment Verification**: Ensures that the signed payload strictly complies with the server's declared payment requirements.
- **Payment Settlement**: Submits validated transactions to the blockchain and monitors their confirmation status.
-- **Fee Management**: Supports configurable service fees (optional) for facilitating payments.
+- **Settlement Records**: Persists one record per settlement, keyed on the on-chain authorization identity, and answers seller-scoped record queries.
- **Result Feedback**: Returns verification and settlement results to the server, enabling it to decide whether to deliver the requested resource.
> **Note**: The Facilitator **does not custody funds** and does not act as an escrow. It only executes verification and on-chain operations according to the client's signed authorization.
@@ -43,12 +43,12 @@ To use x402, you need access to a Facilitator service. There are currently two o
| | Official Facilitator | Self-Hosted Facilitator |
|---|---|---|
-| **Best for** | Most sellers, especially those new to x402 | Advanced users who need full control over fee policies and energy management |
+| **Best for** | Most sellers, especially those new to x402 | Advanced users who need full control over the settlement wallet, RPC endpoints, and which networks/schemes are registered |
| **Requires server maintenance** | No | Yes |
-| **Requires wallet private key** | No | Yes (for paying transaction fees) |
+| **Requires a settlement wallet** | No | Yes — a funded wallet resolved through `@bankofai/agent-wallet` (pays network fees) |
| **Setup difficulty** | Low (just obtain an API Key) | Medium (requires deployment and configuration) |
-| **Fee control** | Fixed policy | Fully customizable |
-| **Recommended for** | Testing, quick launch, small to medium-scale apps | Large-scale production, custom fee structures |
+| **Network & scheme control** | Fixed set | Fully customizable |
+| **Recommended for** | Testing, quick launch, small to medium-scale apps | Large-scale production, private or compliance-bound deployments |
---
@@ -71,13 +71,13 @@ Quick usage examples can be found in [OfficialFacilitator](./OfficialFacilitator
## Option 2: Self-Hosted Facilitator
-If you need full control over fee policies and energy management, or have specific privacy or compliance requirements, you can deploy your own Facilitator service.
+If you need full control over the settlement wallet, RPC endpoints, energy management, or which networks and schemes are registered — or you have specific privacy or compliance requirements — you can deploy your own Facilitator service.
> ⚠️ **Self-hosting security notes:**
-> - A self-hosted Facilitator requires a **dedicated wallet** private key to pay blockchain transaction fees
+> - A self-hosted Facilitator needs a **dedicated funded wallet** to pay blockchain transaction fees. It is resolved through `@bankofai/agent-wallet` and unlocked out-of-band (for example `AGENT_WALLET_PASSWORD`) — the raw private key never enters the service process
> - **This Facilitator wallet should be separate from your payment recipient wallet** — create a new wallet specifically for this purpose
> - Only deposit a small amount of tokens into the Facilitator wallet (enough for fees); do not store large amounts
-> - Keep the private key only in your `.env` file — **never upload it to GitHub or share it with anyone**
+> - Never place a raw private key in `.env`, a config file, or a shell command — **and never upload wallet material to GitHub or share it with anyone**
Quick usage examples can be found in [Quickstart for Sellers](../getting-started/quickstart-for-sellers.md)
@@ -99,7 +99,7 @@ Whether using the official service or a self-hosted instance, the Facilitator pr
| GET | `/metrics` | Prometheus metrics (operational; exposed on the main port only when monitoring shares it) |
| ALL | `/mainnet/*` · `/nile/*` | GasFree Open API transparent proxy (HMAC-signed) — used internally by the TRON `exact_gasfree` scheme |
-> There is **no** `/fee/quote` endpoint. Fee terms travel inside the payment requirements' `extra` field, and payment records are keyed on the on-chain authorization identity (`network` + `scheme` + `asset` + `payer` + `nonce`), not a client-supplied payment ID.
+> There is **no** `/fee/quote` endpoint, and the schemes carry no facilitator fee at all. Payment records are keyed on the on-chain authorization identity (`network` + `scheme` + `asset` + `payer` + `nonce`), not a client-supplied payment ID.
---
@@ -110,7 +110,7 @@ The `/settle` endpoint enforces dynamic rate limits based on the caller's authen
| Mode | Rate Limit | How to Authenticate |
|------|------------|---------------------|
| **Authenticated** | 1000 requests / minute | Include `X-API-KEY: ` header |
-| **Anonymous** | 10 requests / minute (default, configurable) | No API Key provided |
+| **Anonymous** | 1 request / minute on the official deployment (configurable; the code default is 10/minute when unset) | No API Key provided |
Other endpoints (`/verify`, `/supported`, `/payments/*`) are not individually rate-limited.
@@ -126,14 +126,14 @@ When the request includes a valid `X-API-KEY` header, the results are **automati
---
-## Fee Structure
+## Fees
-The Facilitator supports flexible service fee configurations:
+The current schemes carry **no facilitator fee**: there is no `base_fee` configuration, no fee object in the payment requirements, and no `/fee/quote` endpoint — all removed in SDK 1.0.1. A settlement transfers the signed amount to the seller — never less than the advertised amount, and exactly that amount when paying with the official SDK or CLI clients.
-- **Base Fee**: A fixed service fee per transaction, configured per network and asset (e.g., `1 USDT`).
-- **No Fee Mode**: Supports zero-fee operation (e.g. EVM `exact` takes no facilitator fee).
+The costs that do exist:
-Fee terms are included in the Payment Requirements' `extra` field sent from the server to the client; there is no separate `/fee/quote` endpoint.
+- **Network fees** (TRX energy/bandwidth, BNB or ETH gas) are paid by the Facilitator's settlement wallet.
+- **The GasFree relayer fee** on TRON `exact_gasfree` — the relayer's service charge for fronting the network energy (a per-payment transfer fee, plus a one-time activation fee for a new GasFree account) — is set by the relayer and deducted from the payment token on top of the payment amount. Clients should cap it explicitly.
---
diff --git a/docs/x402/core-concepts/http-402.md b/docs/x402/core-concepts/http-402.md
index cc5c2ea..a644370 100644
--- a/docs/x402/core-concepts/http-402.md
+++ b/docs/x402/core-concepts/http-402.md
@@ -61,12 +61,7 @@ When the server returns a `402 Payment Required` response, the decoded `PAYMENT-
"payTo": "",
"maxTimeoutSeconds": 3600,
"extra": {
- "assetTransferMethod": "permit2",
- "fee": {
- "feeTo": "",
- "feeAmount": "100",
- "caller": ""
- }
+ "assetTransferMethod": "permit2"
}
}
]
@@ -129,12 +124,12 @@ When the server returns a `402 Payment Required` response, the decoded `PAYMENT-
| `resource` | Information about the requested resource |
| `accepts` | Array of accepted payment options |
| `scheme` | Payment scheme (`exact`, `upto`, `batch-settlement`, or `exact_gasfree`) |
-| `network` | Network identifier (`tron:0xcd8690dc`, `tron:0x2b6653dc`, `eip155:56`, `eip155:97`) |
+| `network` | Network identifier (`tron:0xcd8690dc`, `tron:0x2b6653dc`, `eip155:56`, `eip155:97`, `eip155:8453`, `eip155:84532`) |
| `amount` | Payment amount in the smallest unit (e.g., 100 = 0.0001 USDT) |
| `asset` | TRC-20/BEP-20 token contract address |
| `payTo` | Seller's wallet address |
| `maxTimeoutSeconds` | Maximum validity duration of the payment |
-| `extra.fee` | Facilitator fee information (includes `feeTo`, `feeAmount`, `caller`) |
+| `extra` | Scheme-specific data — `assetTransferMethod` (`eip3009` / `permit2`), the token `name`/`version` for EIP-3009 assets, and, for a scheme that declares a non-default payment flow, `paymentFlow` (`upfront` or `escrow`) — every built-in scheme uses the default `authorization` flow, which is omitted from `extra`. It carries no fee object: the schemes take no facilitator fee. |
| `extensions` | Additional context for the payment scheme (e.g., gas-sponsoring, payment-identifier) |
## Payment Signature Structure
diff --git a/docs/x402/core-concepts/network-and-token-support.md b/docs/x402/core-concepts/network-and-token-support.md
index 7cf489a..a673690 100644
--- a/docs/x402/core-concepts/network-and-token-support.md
+++ b/docs/x402/core-concepts/network-and-token-support.md
@@ -29,7 +29,7 @@ In the x402 protocol (on-the-wire), BSC uses the EIP-155 chain ID format:
| **BSC Mainnet** | `eip155:56` | BSC Mainnet (Production) |
| **BSC Testnet** | `eip155:97` | BSC Testnet (Chapel) |
-> **Note**: When configuring a self-hosted Facilitator, the YAML config file uses a human-readable format: `bsc:mainnet` and `bsc:testnet`. The Facilitator automatically maps these to the corresponding EIP-155 chain IDs used in the protocol.
+> **Note**: A self-hosted Facilitator's YAML config takes **canonical CAIP-2 identifiers only** — `eip155:56`, `eip155:97`, `eip155:8453`, `eip155:84532`, `tron:0x2b6653dc`, `tron:0xcd8690dc`, `tron:0x94a9059e`. Friendly aliases such as `bsc:mainnet` or `tron:nile` are not resolved and are rejected at startup.
---
@@ -57,7 +57,7 @@ The protocol uses secure signing mechanisms to ensure tamper-resistant message a
| :------------------ | :--------- | :---- |
| **TRON Mainnet** | **Mainnet** | **Production network** for real-value assets |
| **TRON Nile** | **Testnet** | **Recommended testnet** for development and debugging |
-| **TRON Shasta** | **Testnet** | Long-running alternative testnet |
+| **TRON Shasta** | **Testnet** | Alternative testnet — SDK/CLI only; the official facilitator does not settle Shasta, so use Nile or self-host |
| **BSC Mainnet** | **Mainnet** | **Production network** for real-value assets |
| **BSC Testnet** | **Testnet** | **Recommended testnet** for BSC development |
| **Base Mainnet** | **Mainnet** | **Production network** using official USDC |
@@ -75,20 +75,22 @@ x402 supports **TRC-20, BEP-20, and ERC-20** tokens. TRON/BSC routes use their c
| :------ | :------------- | :--------------- |
| **USDT** | `tron:0x2b6653dc` | `TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t` |
| **USDT** | `tron:0xcd8690dc` | `TXYZopYRdj2D9XRtbG411XZZ3kM5VkAeBf` |
+| **USDT** | `tron:0x94a9059e` | `TG3XXyExBkPp9nzdajDZsozEu4BkaSJozs` |
| **USDD** | `tron:0x2b6653dc` | `TXDk8mbtRbXeYuMNS83CfKPaYYT8XWv9Hz` |
| **USDD** | `tron:0xcd8690dc` | `TGjgvdTWWrybVLaVeFqSyVqJQWjxqRYbaK` |
| **USDT** | `eip155:56` | `0x55d398326f99059fF775485246999027B3197955` |
| **USDC** | `eip155:56` | `0x8AC76a51cc950d9822D68b83fE1Ad97B32Cd580d` |
-| **EPS** | `eip155:56` | `0xA7f552078dcC247C2684336020c03648500C6d9F` |
| **USDT** | `eip155:97` | `0x337610d27c682E347C9cD60BD4b3b107C9d34dDd` |
| **USDC** | `eip155:97` | `0x64544969ed7EBf5f083679233325356EbE738930` |
| **DHLU** | `eip155:97` | `0x375cADdd2cB68cE82e3D9B075D551067a7b4B816` |
| **USDC** | `eip155:8453` | `0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913` |
| **USDC** | `eip155:84532` | `0x036CbD53842c5426634e7929541eC2318f3dCF7e` |
+> **Default assets vs. opt-in assets (SDK 1.1.0+)**: the default-asset registry resolves **USDT** on TRON (`tron:0x2b6653dc`, `tron:0xcd8690dc`, `tron:0x94a9059e`) and BSC Mainnet (`eip155:56`), and **USDC** on BSC Testnet (`eip155:97`) and Base (`eip155:8453`, `eip155:84532`). Everything else in the table above — TRON USDD, BSC Mainnet USDC, BSC Testnet USDT, DHLU, and any custom token — is server-advertised only: with the 1.1.0 client spend controls on by default, a client refuses to pay it unless you allowlist it via `spendControls.allowedAssets`, and `x402-cli` pays registry tokens by default — an unregistered asset requires explicit `--asset` plus `--decimals`, and is rejected outright on Base.
+
> **Extensibility**: The protocol is highly extensible. By registering tokens in the `TokenRegistry`, you can easily support any custom TRC-20 or BEP-20 token.
-> **Token selection for the `exact` scheme**: EIP-3009 tokens (for example official Base USDC and BSC testnet DHLU) settle gaslessly via `transferWithAuthorization`. Plain ERC-20 tokens (for example BSC USDC/USDT and TRON USDT/USDD) settle via the Permit2 path — the client auto-broadcasts a one-time `approve(Permit2)` on first payment. The per-token method is data in the server's `accepts[].price.extra`: EIP-3009 → `{ name, version }`; plain ERC-20 → `{ assetTransferMethod: "permit2" }`.
+> **Token selection for the `exact` scheme**: EIP-3009 tokens (for example official Base USDC and BSC testnet DHLU) settle gaslessly via `transferWithAuthorization`. Plain ERC-20 tokens (for example BSC USDC/USDT and TRON USDT/USDD) settle via the Permit2 path — the client auto-broadcasts a one-time `approve(Permit2)` on first payment. You set the per-token method on the server under `accepts[].price.extra`; the SDK surfaces it on the wire as `accepts[].extra`: EIP-3009 → `{ name, version }`; plain ERC-20 → `{ assetTransferMethod: "permit2" }`.
---
@@ -147,26 +149,26 @@ A payment-channel scheme for high-frequency micro-payments (e.g. AI agent per-to
### `exact_gasfree` Scheme
-TRON-specific. Allows buyers to pay with USDT/USDD **without holding TRX for gas fees**. The payer signs a TIP-712 GasFree permit and a relayer pays the on-chain energy via the official GasFree Proxy — no TRX for the payer, no one-time `approve`. Funds come from the payer's GasFree custodial wallet (not the main wallet). Available on `tron:0x2b6653dc` and `tron:0xcd8690dc`.
+TRON-specific. Allows buyers to pay with USDT/USDD **without holding TRX for gas fees**. The payer signs a TIP-712 GasFree permit and a relayer pays the on-chain energy via the official GasFree Proxy — no TRX for the payer, no one-time `approve`. Funds come from the payer's GasFree custodial wallet (not the main wallet). The SDK registers GasFree on `tron:0x2b6653dc`, `tron:0xcd8690dc`, and `tron:0x94a9059e`, but the official facilitator only proxies the relayer for TRON Mainnet and Nile — the built-in Shasta relayer URL has no upstream behind it, so Shasta GasFree needs your own relayer.
-#### GasFree Account Management (via x402-payment skill)
+The relayer charges its own fee in the payment token, **on top of** the payment amount, so the GasFree account must hold enough to cover both.
-When using the `x402-payment` skill, you can manage GasFree accounts directly from the CLI:
+:::info What the relayer fee is
+**The relayer fee is the service charge of the GasFree relayer**: instead of burning your own TRX, the relayer fronts the on-chain energy/bandwidth, and in exchange deducts a fee from your GasFree account, denominated in the payment token (e.g. USDT). It is composed of a fixed **transfer fee** per payment, plus a one-time **activation fee** on the first payment if the GasFree account is not yet activated. The rates are quoted per token by the relayer's API; the client queries and estimates them before signing (when the relayer reports no rate for the token, the client signs a default ceiling of one whole token instead), and the signed permit carries a `maxFee` ceiling the relayer cannot exceed. It is counted **separately** from the payment amount (the money the seller receives) — `--max-amount` does not cover it, so cap it with `--max-gasfree-fee`.
+:::
-**Query GasFree wallet info** (address, activation status, balance, nonce):
-```bash
-npx tsx x402-payment/src/x402_invoke.ts --gasfree-info
-npx tsx x402-payment/src/x402_invoke.ts --gasfree-info --network nile
-npx tsx x402-payment/src/x402_invoke.ts --gasfree-info --wallet
-```
+#### Paying with GasFree from the CLI
-**Activate a GasFree account** (required before first use):
```bash
-npx tsx x402-payment/src/x402_invoke.ts --gasfree-activate
-npx tsx x402-payment/src/x402_invoke.ts --gasfree-activate --network mainnet
-npx tsx x402-payment/src/x402_invoke.ts --gasfree-activate --network nile --token USDT
+x402-cli pay \
+ --scheme exact_gasfree \
+ --max-amount 0.01 \
+ --max-gasfree-fee 0.5 \
+ --json
```
+The CLI takes the first requirement in the server's `accepts` list that matches your filters — it does not prefer GasFree — so pass `--scheme exact_gasfree` whenever the endpoint also advertises plain `exact`. `--max-amount` does not cover the relayer fee — cap that separately with `--max-gasfree-fee` (or `--max-gasfree-fee-raw`). See the [CLI command reference](../cli/command-reference.md#gasfree-payments-tron).
+
### How Payment Schemes Work
1. **Authorize**
diff --git a/docs/x402/core-concepts/wallet.md b/docs/x402/core-concepts/wallet.md
index 0a65385..32e547e 100644
--- a/docs/x402/core-concepts/wallet.md
+++ b/docs/x402/core-concepts/wallet.md
@@ -15,7 +15,7 @@ Buyers use their wallet as the primary interaction anchor, responsible for:
- **Asset Custody**: Securely storing USDT or other TRC-20/BEP-20 tokens.
- **Signature Authorization**: Cryptographically signing payment payloads using their private key.
- **Programmatic Payments**: Authorizing on-chain fund transfers via code (especially suitable for autonomous AI agents).
-- **Allowance Management**: Managing token allowances granted to the Facilitator contract.
+- **Allowance Management**: Managing the one-time `approve(Permit2, max)` allowance granted to the Permit2 contract — the facilitator then pulls the funds through the x402 Permit2 proxy.
> **Stateless Authentication**: With wallet-based identity, buyers can initiate transactions without account registration, API keys, or login sessions.
diff --git a/docs/x402/faq.md b/docs/x402/faq.md
index 52ae0e1..c76da13 100644
--- a/docs/x402/faq.md
+++ b/docs/x402/faq.md
@@ -41,7 +41,7 @@ The previous Python SDK lives under `legacy/` for reference.
#### Who runs the Facilitator?
-Typically, you run your own Facilitator service. x402 is designed for self-hosting, and the built-in Facilitator in the repository is production-ready.
+Typically, you run your own Facilitator service. x402 is designed for self-hosting: the repository ships a runnable reference implementation at `examples/typescript/facilitator/basic` that you harden for your own production use.
An [officially hosted Facilitator](https://github.com/BofAI/x402-facilitator) service is also available, allowing you to use x402 without deploying infrastructure yourself.
@@ -73,7 +73,7 @@ x402 supports four payment schemes:
- **`exact`**: Pay the exact advertised amount. EIP-3009 tokens (e.g. official Base USDC and BSC testnet DHLU) settle gaslessly via `transferWithAuthorization`; plain ERC-20/TRC-20 tokens (e.g. BSC USDC/USDT, TRON USDT/USDD) settle via the Permit2 path with a one-time `approve(Permit2)`. The `exact` wire payload conforms to the **x402 Foundation** v2 spec.
- **`upto`**: Usage-based billing — the client signs a Permit2 authorization for up to a **maximum**; the server settles only the **real usage** (≤ max). Ideal for **metered billing**, **LLM token usage**.
- **`batch-settlement`**: Payment-channel for high-frequency micro-payments — deposit once, pay many requests with off-chain vouchers, settle in one batch tx. Includes a refund path.
-- **`exact_gasfree`** (TRON only): Allows buyers to pay with USDT/USDD without holding TRX for gas. A relayer pays the on-chain energy via the GasFree API — no API keys required on the client side.
+- **`exact_gasfree`** (TRON only): Allows buyers to pay with USDT/USDD without holding TRX for gas. A relayer pays the on-chain energy via the GasFree API — no API keys required on the client side. The relayer deducts its own fee from the payment token, on top of the payment amount.
#### Can this SDK interoperate with the x402 Foundation (formerly Coinbase) v2 reference implementation?
@@ -81,10 +81,10 @@ x402 supports four payment schemes:
- A stock v2 client can directly access this SDK's `exact` protected endpoints with no project-specific adapter layer.
- This SDK's client can pay v2-compatible servers directly.
-- In the V2 structure, transfer authorization data is carried in the `payload.authorization` field (a structured object). As a migration fallback, the client also populates `extensions.transferAuthorization` so that servers still running older versions can parse the payload.
+- In the V2 structure, transfer authorization data is carried in the `payload.authorization` field (a structured object).
- BSC USDT/USDC are plain ERC-20s (no ERC-3009). They settle via the Permit2 path under the `exact` scheme — the client auto-broadcasts a one-time `approve(Permit2)` on first payment. ERC-3009 tokens like BSC testnet **DHLU** settle gaslessly with no approve.
- Base Mainnet official USDC uses EIP-3009 under `exact`: the payer signs `transferWithAuthorization`, so no Permit2 approval is required.
-- The `examples/bsc-testnet-smoke/` directory contains smoke tests for bidirectional interoperability (Coinbase official client → BANK OF AI server, BANK OF AI client → Coinbase official server) that you can use as a debugging and integration reference.
+- The `legacy/examples/bsc-testnet-smoke/` directory (part of the `legacy/` tree, kept for reference) contains smoke tests for bidirectional interoperability (Coinbase official client → BANK OF AI server, BANK OF AI client → Coinbase official server) that you can use as a debugging and integration reference.
---
@@ -107,6 +107,8 @@ x402 supports four payment schemes:
| Base Mainnet (`eip155:8453`) | Official USDC (ERC-20, EIP-3009) | **Mainnet** |
| Base Sepolia (`eip155:84532`) | USDC (ERC-20, EIP-3009) | **Testnet** |
+Only some of these are **default assets** (USDT on TRON and BSC Mainnet, USDC on BSC Testnet and Base). Since SDK 1.1.0 a client's spend controls reject any other asset — including TRON USDD, BSC Mainnet USDC and BSC Testnet USDT — unless it is allowlisted via `spendControls.allowedAssets`.
+
Custom TRC-20 tokens can be added via the TRON token registry (`registerToken` from `@bankofai/x402-tron`); custom BEP-20 tokens are advertised by adding an entry to the server's `EVM_TOKENS` config table.
#### What fees are involved?
@@ -115,7 +117,7 @@ Custom TRC-20 tokens can be added via the TRON token registry (`registerToken` f
- TRON: TRX for Energy and Bandwidth (paid by the Facilitator)
- BSC: BNB for gas (paid by the Facilitator)
- Base: ETH for gas (paid by the Facilitator)
-- **Facilitator Service Fee**: Configurable by each Facilitator (can be set to zero)
+- **Facilitator service fee**: none. The current schemes carry no fee field — `base_fee` config and the `/fee/quote` endpoint were removed in SDK 1.0.1. On TRON `exact_gasfree`, the GasFree relayer charges its own fee in the payment token; cap it with the client's GasFree fee limit.
---
@@ -127,7 +129,7 @@ Custom TRC-20 tokens can be added via the TRON token registry (`registerToken` f
1. **Buyer (client/agent)** signs locally (browser, serverless function, or agent VM).
2. **Seller** verifies signatures without accessing private keys.
-3. **Facilitator** uses its own key to submit transactions on-chain.
+3. **Facilitator** submits transactions with its own settlement wallet, resolved through `@bankofai/agent-wallet` — the raw key never enters the facilitator process.
#### How does refunds work?
diff --git a/docs/x402/getting-started/quickstart-for-agent.md b/docs/x402/getting-started/quickstart-for-agent.md
index f193098..2e73308 100644
--- a/docs/x402/getting-started/quickstart-for-agent.md
+++ b/docs/x402/getting-started/quickstart-for-agent.md
@@ -113,19 +113,19 @@ export EVM_RPC_URL="https://bsc-testnet-rpc.publicnode.com"
Run the following command to install all BANK OF AI Skills (including x402-payment) at once:
```bash
-npx skills add https://github.com/BofAI/skills -y
+npx skills add https://github.com/BofAI/skills -y -g
```
-The `-y` flag skips all interactive prompts and installs all available Skills by default. The installer auto-detects AI tools on your computer (Cursor, Claude Code, Cline, OpenCode, etc.) and copies the skills into the correct directories.
+The `-y` flag skips all interactive prompts and installs all available Skills by default; `-g` installs them globally (user-level, under `~/.agents/skills/`) instead of into the current directory. The installer auto-detects AI tools on your computer (Cursor, Claude Code, Cline, OpenCode, etc.) and copies the skills into the correct directories.
> ✅ **Success indicator:** Terminal shows `✓ x402-payment (copied)` along with other installed skills
### Interactive Installation
-If you prefer to select specific skills or choose the installation scope:
+If you prefer to select specific skills or the AI tools to install them to:
```bash
-npx skills add https://github.com/BofAI/skills
+npx skills add https://github.com/BofAI/skills -g
```
For a detailed walkthrough of the interactive installation process, see the [Skills Quick Start](../../McpServer-Skills/SKILLS/QuickStart.md).
@@ -194,7 +194,7 @@ Go to the [BSC Testnet Explorer](https://testnet.bscscan.com/), search for your
-> ✅ **Success indicator:** The agent returns content in `{"data": "..."}` format, and the corresponding transaction appears on the block explorer
+> ✅ **Success indicator:** The agent returns the endpoint's JSON payload — the bundled Express example answers `{"report":{"weather":"sunny","temperature":70}}` — and the corresponding transaction appears on the block explorer
---
diff --git a/docs/x402/getting-started/quickstart-for-sellers.md b/docs/x402/getting-started/quickstart-for-sellers.md
index 29f1785..b2dabe4 100644
--- a/docs/x402/getting-started/quickstart-for-sellers.md
+++ b/docs/x402/getting-started/quickstart-for-sellers.md
@@ -125,7 +125,7 @@ Deposit a small amount of official USDC on Base Mainnet. The resource server onl
**Testnet vs. Mainnet:**
-- **Testnet**: Uses free test tokens, no real funds involved, suitable for development and debugging. Network identifiers: `tron:0xcd8690dc` / `eip155:97`
+- **Testnet**: Uses free test tokens, no real funds involved, suitable for development and debugging. Network identifiers: `tron:0xcd8690dc` / `eip155:97` / `eip155:84532` (Base Sepolia, USDC — test here before going to Base Mainnet)
- **Mainnet**: Involves real payments, used when going live. Network identifiers: `tron:0x2b6653dc` / `eip155:56` / Base `eip155:8453`
---
@@ -208,7 +208,7 @@ express()
credit: 1000000,
})
)
- .listen(4021);
+ .listen(4021, () => console.log("Resource server on http://localhost:4021"));
```
@@ -255,7 +255,7 @@ express()
credit: 1000000,
})
)
- .listen(4021);
+ .listen(4021, () => console.log("Resource server on http://localhost:4021"));
```
@@ -290,7 +290,7 @@ A Facilitator is an **automated settlement service**: when someone pays your API
| **Maintenance required** | No — officially hosted | Yes — you run it yourself |
| **Wallet private key required** | No | Yes (to settle on-chain) |
| **Difficulty** | Low (just apply for an API Key) | Medium (run the example facilitator) |
-| **Best for** | Fast deployment, most users | Full control over fee strategy |
+| **Best for** | Fast deployment, most users | Full control over the settlement wallet, RPC endpoints, and registered networks/schemes |
@@ -336,7 +336,9 @@ FACILITATOR_API_KEY=paste_your_api_key_here
-The self-hosted option gives you full control over fee strategy. It runs the example facilitator (`examples/typescript/facilitator/basic`), which exposes `/verify`, `/settle`, `/supported` over HTTP and dispatches by the payment's `network` field.
+The self-hosted option gives you full control over the settlement wallet, RPC endpoints, and which networks and schemes you register — neither the SDK nor the facilitator charges a fee of its own. It runs the example facilitator (`examples/typescript/facilitator/basic`), which exposes `/verify`, `/settle`, `/supported` over HTTP and dispatches by the payment's `network` field.
+
+> **Base sellers:** the bundled example facilitator registers only `eip155:97` and `eip155:56` (`EVM_NETWORKS` in `facilitator/basic/src/chains/evm.ts`). To settle on Base, either use the official facilitator — which enables `eip155:8453` and `eip155:84532` — or add those ids to `EVM_NETWORKS` yourself.
> ⚠️ **Security reminder — please read first:**
> - A self-hosted Facilitator uses your wallet to submit on-chain settlement transactions — **this wallet should be separate from your receiving wallet**
@@ -404,6 +406,12 @@ Open a **new terminal window** (do not close the facilitator), and run your serv
pnpm tsx src/server.ts
```
+**On success you should see:**
+
+```
+Resource server on http://localhost:4021
+```
+
> ✅ **Success:** The process keeps running and the resource server listens on `http://localhost:4021`
### 5.2 Test Unpaid Access (Should Be Rejected)
@@ -470,7 +478,7 @@ EVM_RPC_URL=https://bsc-rpc.publicnode.com
### 3. (Self-Hosted) Switch the Facilitator to Mainnet
-The facilitator's `TRON_NETWORKS` already includes `TRON_MAINNET` (`tron:0x2b6653dc`), and `EVM_NETWORKS` includes `eip155:56`. Fund the Facilitator wallet with real TRX/BNB to cover settlement gas, then restart:
+The example facilitator's `TRON_NETWORKS` already includes `TRON_MAINNET` (`tron:0x2b6653dc`), and `EVM_NETWORKS` includes `eip155:97` and `eip155:56` — Base (`eip155:8453` / `eip155:84532`) is not registered there, so add it if you settle on Base. Fund the Facilitator wallet with real TRX/BNB to cover settlement gas, then restart:
```bash
pnpm dev:facilitator
diff --git a/docs/x402/index.md b/docs/x402/index.md
index d2b0c21..55bf693 100644
--- a/docs/x402/index.md
+++ b/docs/x402/index.md
@@ -87,11 +87,12 @@ Our goal is to build a low-barrier, permissionless, developer-friendly programma
x402 currently supports the following networks:
- **TRON Mainnet** (`tron:0x2b6653dc`)
-- **TRON Shasta Testnet** (`tron:0x94a9059e`)
+- **TRON Shasta Testnet** (`tron:0x94a9059e`) — SDK/CLI only; not settled by the official facilitator
- **TRON Nile Testnet** (`tron:0xcd8690dc`)
- **BSC Mainnet** (`eip155:56`)
- **BSC Testnet** (`eip155:97`)
- **Base Mainnet** (`eip155:8453`)
+- **Base Sepolia Testnet** (`eip155:84532`)
Base Mainnet payments use official USDC with the `exact` scheme and EIP-3009 authorization.
diff --git a/docs/x402/sdk-features.md b/docs/x402/sdk-features.md
index a3a6ad1..9d8f3f4 100644
--- a/docs/x402/sdk-features.md
+++ b/docs/x402/sdk-features.md
@@ -8,6 +8,8 @@ description: 'Feature support matrix for the x402 TypeScript SDK, published as g
This page tracks the feature support of the x402 SDK.
> **SDK (TypeScript-only)**: x402 is a **TypeScript-only** SDK published as granular `@bankofai/x402-*` npm packages. The source is maintained in a pnpm/turbo monorepo, but applications should depend on the published packages. The previous-generation Python + TypeScript SDK lives under `legacy/` for reference.
+>
+> **Current release: 1.1.0** (2026-08-25). All 11 `@bankofai/x402-*` packages ship together and pin their internal dependencies to `~1.1.0`, so upgrade them as a set. The SDK requires **Node.js 22+**.
---
@@ -58,7 +60,7 @@ This page tracks the feature support of the x402 SDK.
| `eip155:8453` (Base Mainnet) | - | ✅ |
| `eip155:84532` (Base Sepolia) | - | ✅ (CLI/SDK testing) |
-> Other upstream EVM chains (MegaETH, Monad, Hyperliquid) are also wired in the EVM default-asset registry. The public API Catalog publishes Base Mainnet routes only; Base Sepolia remains available for CLI/SDK testing.
+> Around 20 further upstream EVM chains (MegaETH, Monad, Polygon, Arbitrum One/Sepolia, Celo, XDC, Flare, Mezo, Radius, Stable, ADI, HPP, Igra, …) are also wired into the EVM default-asset registry. The public API Catalog publishes Base Mainnet routes only; Base Sepolia remains available for CLI/SDK testing.
---
@@ -73,6 +75,20 @@ x402 supports four payment schemes. Each is implemented as a client + server + f
| `batch-settlement` | ✅ | ✅ | Payment-channel: deposit once on-chain, then pay many requests with off-chain vouchers; the facilitator claims a batch and settles in one tx. Includes a refund path. |
| `exact_gasfree` | ❌ | ✅ | TRON-only. Pay with USDT/USDD **without holding TRX for gas** — a relayer pays the on-chain energy via the GasFree API. |
+### Payment flows (new in 1.1.0)
+
+A scheme/network server now declares which payment flows it supports per asset-transfer method. `upfront` and `escrow` travel on the wire as `extra.paymentFlow`; `authorization` is the default and is omitted from `extra` — its absence is the signal:
+
+| Flow | What it means |
+|------|---------------|
+| `authorization` | The client signs an authorization and the facilitator pulls the funds at settlement — the classic `exact` / `upto` behavior, and the default. |
+| `upfront` | The client moves the funds before the resource is served. |
+| `escrow` | Funds are locked in escrow first, then captured, voided, or refunded later, instead of moving straight to the seller. |
+
+Legacy v1.0 `SchemeNetworkServer` implementations may omit their payment-flow declaration; they continue to use the authorization flow.
+
+`upfront` and `escrow` are orchestration hooks for custom schemes. As of 1.1.0 every built-in server scheme (`exact`, `upto`, `batch-settlement`, `exact_gasfree`) declares `authorization` only, so `extra.paymentFlow` does not appear on the wire with the shipped schemes.
+
> **x402 Foundation v2 compatibility**: The `exact` scheme (EVM and TRON) conforms to the v2 wire format published by the **x402 Foundation**. Stock v2 clients interoperate with this SDK's server and vice versa. See [Network & Token Support → `exact` Scheme](./core-concepts/network-and-token-support.md#exact-scheme) for details.
---
@@ -88,6 +104,7 @@ Key custody is in [`@bankofai/agent-wallet`](https://github.com/BofAI/agent-wall
| `createFacilitatorTronSigner` | Facilitator (TRON) |
| `createFacilitatorEvmSigner` | Facilitator (EVM) |
| `createAuthorizerTronSigner` | Authorizer (TRON, batch-settlement) |
+| `createAuthorizerEvmSigner` | Authorizer (EVM, batch-settlement) |
---
@@ -103,6 +120,14 @@ Key custody is in [`@bankofai/agent-wallet`](https://github.com/BofAI/agent-wall
| Balance-aware payment selection (`filterAffordableRequirements`) | ✅ |
| Cheapest-token selection strategy | ✅ |
| GasFree (zero-gas TRON payments) | ✅ |
+| Spend controls (default-asset allowlist + per-payment cap) | ✅ — **on by default since 1.1.0** |
+| Per-asset atomic caps (`allowedAssets[].maxAmountPerPayment`) | ✅ |
+| Payment-selection policies (`PaymentPolicy`) | ✅ |
+| Lifecycle hooks (`onBeforePaymentCreation`, `onAfterPaymentCreation`, `onPaymentCreationFailure`, `onPaymentResponse`) | ✅ |
+
+:::caution Spend controls are on by default
+Since 1.1.0 a client will only pay assets it recognizes from the default-asset registry, and caps each payment at `DEFAULT_MAX_AMOUNT_PER_PAYMENT` (`$1` worth). To pay more than that, raise the cap with `spendControls.maxAmountPerPayment` (a `Money` value, or `false` to remove it). To pay a custom token, list it under `spendControls.allowedAssets` — optionally with its own `maxAmountPerPayment`, which must be an integer atomic amount rather than a dollar value — or set `allowedAssets: true` to allow any asset. `spendControls: false` turns the guard off entirely.
+:::
---
@@ -115,7 +140,6 @@ Key custody is in [`@bankofai/agent-wallet`](https://github.com/BofAI/agent-wall
| Gas-sponsoring extension (Permit2 approve) | ✅ |
| Payment verification (via facilitator) | ✅ |
| Payment settlement (via facilitator) | ✅ |
-| Fee support | ✅ |
---
@@ -129,8 +153,11 @@ Key custody is in [`@bankofai/agent-wallet`](https://github.com/BofAI/agent-wall
| Submit on-chain transaction | ✅ |
| Confirm transaction (receipt polling) | ✅ |
| Extension hooks (`onBeforeSettle` / `onAfterSettle` / `onSettleFailure`) | ✅ |
+| EVM smart accounts — deployed accounts, ERC-7702 delegation, ERC-6492 counterfactual wallets | ✅ — signature verification is facilitator-side; ERC-6492 requires an explicit `eip6492AllowedFactories` allowlist |
-> The self-hosted example facilitator (`facilitator/basic`) exposes `/verify`, `/settle`, `/supported`. The official hosted facilitator additionally offers `/fee/quote` and `/payments/{id}` query endpoints — see [Official Facilitator](./core-concepts/OfficialFacilitator.md).
+> The self-hosted example facilitator (`facilitator/basic`) exposes `/verify`, `/settle`, `/supported`. The official hosted facilitator additionally offers the settlement-record queries `GET /payments/tx/{tx_hash}` and `GET /payments`, plus `/health` — see [Official Facilitator](./core-concepts/OfficialFacilitator.md). Prometheus metrics are served on a separate monitoring port (`9001` in the shipped configs), not on the public API base. There is no `/fee/quote` endpoint: the SDK schemes carry no facilitator fee.
+>
+> `HTTPFacilitatorClient` uses typed timeout errors, rate-limit retries, and a 90-second default timeout since 1.1.0.
---
@@ -138,7 +165,7 @@ Key custody is in [`@bankofai/agent-wallet`](https://github.com/BofAI/agent-wall
| Token | Network | Status |
|--------|---------|--------|
-| USDT (TRC-20) | `tron:0x2b6653dc`, `tron:0xcd8690dc` | ✅ |
+| USDT (TRC-20) | `tron:0x2b6653dc`, `tron:0xcd8690dc`, `tron:0x94a9059e` | ✅ |
| USDD (TRC-20) | `tron:0x2b6653dc`, `tron:0xcd8690dc` | ✅ |
| USDT (BEP-20) | `eip155:56`, `eip155:97` | ✅ |
| USDC (BEP-20) | `eip155:56`, `eip155:97` | ✅ |
@@ -146,6 +173,8 @@ Key custody is in [`@bankofai/agent-wallet`](https://github.com/BofAI/agent-wall
| Official USDC (ERC-20, EIP-3009) | `eip155:8453`, `eip155:84532` | ✅ |
| Custom TRC-20 / BEP-20 | any | ✅ (via token registry / `EVM_TOKENS` config) |
+> Only some of these are **default assets**: USDT on TRON and BSC Mainnet, USDC on BSC Testnet and Base. Since 1.1.0 a client's spend controls reject every other asset — USDD, BSC Mainnet USDC, BSC Testnet USDT, DHLU, custom tokens — unless it is allowlisted via `spendControls.allowedAssets`. See [Network & Token Support](./core-concepts/network-and-token-support.md#supported-tokens).
+
---
## Observability
diff --git a/i18n/zh-Hans/docusaurus-plugin-content-docs-changelog/current/index.md b/i18n/zh-Hans/docusaurus-plugin-content-docs-changelog/current/index.md
index 3ebc33e..1df9713 100644
--- a/i18n/zh-Hans/docusaurus-plugin-content-docs-changelog/current/index.md
+++ b/i18n/zh-Hans/docusaurus-plugin-content-docs-changelog/current/index.md
@@ -7,6 +7,33 @@ description: 'BANK OF AI 各产品的更新与公告——全部产品,按时
BANK OF AI 各产品的更新与公告。
+