fix(ts): resolve R7 QA issues and negotiate facilitator compatibility - #1010

Changes

Fix the remaining v4.14 QA failures in credential output, payment validation, order pagination and registration metadata loading. B.AI retains Base support, recipient recharge and initial wallet binding.

• Redact GasFree and TronLink credentials in config reads and write receipts; reject ERC-8004 zero-address transfers before RPC.
• Classify x402 HTTP 429 as provider_rate_limited, retain safe numeric Retry-After hints, and preserve the no-automatic-repayment rule.
• Cap B.AI order requests at the backend's 100-row limit, preserve offsets across page boundaries, and report the effective limit with a warning.
• Restrict registration metadata reads to HTTP/HTTPS without redirects, with a maximum JSON depth of 20 and a 10-second timeout cap. Register/update URI validation remains separate.
• Remove search internals and inline endpoints from provider listings; add sanitized server access logs.
• Add raw amounts, explicit asset precision, authorization validity and advertised resource URLs to the applicable server commands. Add daemon readiness/PID/log output and signal cleanup for Node and Bun standalone runtimes.
• Add B.AI recharge dry-run and GasFree controls. Resolve account ambiguity and validate relay configuration before creating an order. Preview never creates an order, unlocks, signs, pays or reports a transaction; unavailable final fee estimates remain explicit.
• Build fresh dist before package verification and include daemon lifecycle coverage in installed-package tests.

Facilitator compatibility and README

TRON local serve/roundtrip/recharge now reads the configured facilitator's /supported
before advertising a challenge. It matches x402 v2, the scheme and chain identity,
uses decimal IDs when advertised, and otherwise uses the supported hexadecimal ID.
When both formats are supported, decimal is preferred. Missing/invalid capabilities
stop before signing. Signed payloads are never rewritten and settlement is not retried
with another format after failure. EVM IDs remain unchanged.

README now explains capability negotiation, server/daemon options, B.AI setup,
preview and report-only recovery, and ERC-8004 metadata limits. No docs/ changes
are included.

Validation

• R7 full suite before the compatibility follow-up: 2,886 passed, 46 skipped, 0 failed. Of the skipped tests, 44 require an installed entrypoint and ran in the package suite; two opt-in live deployment tests were not enabled.
• Compatibility follow-up: 183 passed across 17 test files, including decimal-only, hex-only and dual-format facilitators, matching by scheme/version, invalid capability responses and no settlement retry.
• Fresh package installation after the compatibility change: 71 passed across eight test files.
• Read-only check against the default live facilitator: /supported advertised hexadecimal TRON IDs; the local server selected Nile tron:0xcd8690dc while retaining CLI network tron:3448148188. No payment was sent.
• Typecheck, lint, format check and dependency-cruiser passed.
• Node and macOS arm64 standalone: all 20 new command helps, input exclusions, credential redaction, daemon readiness/discovery/log permissions and SIGTERM cleanup passed.
• Standalone daemon regression and native-addon smoke checks passed.
• Live provider list/show/endpoint-list succeeded.
• Current build successfully read an existing Agent on Nile and completed a software-wallet sign-only transaction using real RPC, without broadcasting.

No npm publication. Real B.AI crediting, live x402 settlement, mainnet payments, physical hardware signing and Windows/Linux standalone execution were not performed in this validation run. Suite totals overlap and should not be added together.

R8 follow-up

BAI recharge now rejects non-positive, malformed, out-of-range and below-minimum amounts with invalid_amount (exit 2) before wallet/credential gates. Within the recharge use case, token precision validation runs before account resolution, binding checks, recipient lookup or preorder creation. Recharge recovery uses the same amount error contract. Existing token-specific minimums, Base support and recipient recharge remain unchanged.

Installed-CLI regressions exercise both x402 pay and roundtrip with the real GasFree SDK and a random software signer against mocked RPC/HTTP services. The tests assert that a 1,300,000-raw fee ceiling on a 10,000-raw payment appears as 13000.00% in the final JSON warnings, with successful settlement/delivery and no duplicate payment requests. Empty-wallet CLI cases assert that invalid BAI amounts fail with invalid_amount before asking for credentials.

• Final full suite at the R8 follow-up: 2,919 passed, 52 skipped, 0 failed across 246 passing files. Installed-entry tests execute separately below; live deployment tests remain opt-in.
• Fresh build, package installation and installed CLI regression: 77 passed across eight files.
• Typecheck, lint, changed-file formatting and dependency checks passed.
• No live payment, publication or documentation changes in this follow-up.

Facilitator path and Nile GasFree USDD follow-up

Facilitator /supported, /verify and /settle now share URL joining that retains deployment path prefixes (for example https://host/x402/). Integration tests verify the complete negotiation and settlement sequence under a prefix.

Nile USDD is selected by payment scheme: exact retains TGjgvdTWWrybVLaVeFqSyVqJQWjxqRYbaK, while exact_gasfree uses the relay-supported TYQF9cAeJ3Faq8QXpHxTcFco72DRCQbgFt (18 decimals). Explicit requirements are never rewritten to another asset. The SDK receives GasFree metadata under an internal alias so its exact USDD entry stays intact, including when the SDK falls back to a one-token fee ceiling.

Missing GasFree assets during payload creation now produce gasfree_asset_unsupported, paymentStatus=not_sent, and retryPayment=false, without exposing raw upstream error text.

Validation: 171 targeted tests passed; 84 freshly installed-package tests passed, including real SDK signing for both USDD schemes, GasFree fee precision/fallback and missing-asset cases without payment submission. Typecheck, lint, formatting and dependency checks passed. No live payment, npm publication or docs changes in this follow-up.

The full-suite run passed 2,923 tests and found one missing error-code index entry. The entry was added, and the 171-test follow-up reran the index guard and all x402 adapter tests successfully. The full suite was not rerun after that index-only correction.