@agentlayer.tech/wallet 0.1.67 → 0.1.68

package/.openclaw/extensions/agent-wallet/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "agent-wallet",
   "name": "Agent Wallet",
   "description": "Official OpenClaw plugin bridge for the agent-wallet backends, including Solana, local BTC, and local EVM.",
-  "version": "0.1.67",
+  "version": "0.1.68",
   "contracts": {
     "tools": [
       "agentlayer_autonomous_approve",

package/.openclaw/extensions/agent-wallet/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentlayertech/agent-wallet-plugin",
-  "version": "0.1.67",
+  "version": "0.1.68",
   "description": "OpenClaw plugin bridge for the AgentLayer wallet runtime.",
   "type": "module",
   "license": "SEE LICENSE IN ../../../LICENSE",

package/VERSION

@@ -1 +1 @@
-0.1.67
+0.1.68

package/agent-wallet/agent_wallet/__init__.py

@@ -2,7 +2,7 @@
 
 # Keep in sync with package.json, pyproject.toml, and the npm installer version.
 # scripts/check_release_version.mjs enforces this on release.
-__version__ = "0.1.67"
+__version__ = "0.1.68"
 
 __all__ = [
     "config",

package/agent-wallet/agent_wallet/providers/x402.py

@@ -7,6 +7,7 @@ import hashlib
 import json
 import logging
 import time
+from types import SimpleNamespace
 from typing import Any
 from urllib.parse import parse_qsl, urlencode, urlsplit, urlunsplit
 
@@ -428,11 +429,16 @@ def _evm_exact_execution_supported(backend: AgentWalletBackend) -> bool:
 
 
 def _evm_payment_requirement_supported(requirement: dict[str, Any]) -> bool:
-    if _trim(requirement.get("scheme")).lower() != "exact":
-        return False
+    scheme = _trim(requirement.get("scheme")).lower()
     extra = _extract_requirement_extra(requirement)
-    transfer_method = _trim(extra.get("assetTransferMethod")).lower()
-    return transfer_method in {"", "eip3009", "transferwithauthorization"}
+    if scheme == "exact":
+        transfer_method = _trim(extra.get("assetTransferMethod")).lower()
+        return transfer_method in {"", "eip3009", "transferwithauthorization"}
+    if scheme == "upto":
+        # The upto Permit2 payload needs the facilitator's address up front;
+        # without it the SDK signer raises instead of falling back cleanly.
+        return bool(_trim(extra.get("facilitatorAddress")))
+    return False
 
 
 def _wallet_x402_support_summary(backend: AgentWalletBackend) -> dict[str, Any]:
@@ -478,7 +484,7 @@ def _requirement_compatibility(requirement: dict[str, Any], backend: AgentWallet
         )
     elif chain == "evm":
         planned_execution_supported = (
-            scheme == "exact"
+            scheme in {"exact", "upto"}
             and network in set(wallet_summary["planned_execution_networks"])
             and _evm_payment_requirement_supported(requirement)
         )
@@ -491,10 +497,12 @@ def _requirement_compatibility(requirement: dict[str, Any], backend: AgentWallet
         reason = (
             "Executable now through the local Solana exact buyer flow."
             if chain == "solana"
-            else "Executable now through the local EVM exact buyer flow."
+            else f"Executable now through the local EVM {scheme or 'exact'} buyer flow."
         )
     elif chain == "evm" and scheme == "exact" and not _evm_payment_requirement_supported(requirement):
         reason = "This EVM exact payment requires a transfer method that is not enabled in the current wallet runtime."
+    elif chain == "evm" and scheme == "upto" and not _evm_payment_requirement_supported(requirement):
+        reason = "This EVM upto payment is missing a facilitatorAddress in its extra data, so it cannot be signed."
     elif planned_execution_supported and wallet_network_matches:
         reason = "Wallet network matches, but this backend does not yet expose a supported x402 signer path."
     elif planned_execution_supported:
@@ -527,11 +535,16 @@ def _select_preferred_requirement(
     if not candidates:
         return None
 
-    def sort_key(item: dict[str, Any]) -> tuple[int, int]:
+    def sort_key(item: dict[str, Any]) -> tuple[int, int, int]:
+        # Prefer upto over exact: upto settles for actual usage against a
+        # signed cap, which fits metered/usage-priced endpoints better than
+        # exact's fixed charge. Ties within a scheme still favor the cheapest
+        # declared amount.
+        scheme_rank = 0 if _trim(item.get("scheme")).lower() == "upto" else 1
         amount = _trim(item.get("amount"))
         if amount.isdigit():
-            return (0, int(amount))
-        return (1, 0)
+            return (scheme_rank, 0, int(amount))
+        return (scheme_rank, 1, 0)
 
     return sorted(candidates, key=sort_key)[0]
 
@@ -728,10 +741,10 @@ def _validate_payment_requirement(
         )
 
     scheme = _trim(selected.get("scheme")).lower()
-    if scheme != "exact":
+    if scheme not in {"exact", "upto"}:
         raise ProviderError(
             "x402-validate",
-            f"Unsupported x402 payment scheme '{scheme or 'unknown'}'. Only 'exact' is supported.",
+            f"Unsupported x402 payment scheme '{scheme or 'unknown'}'. Only 'exact' and 'upto' are supported.",
             details={"request_url": request_url, "selected_payment": selected},
         )
 
@@ -846,6 +859,24 @@ def _select_sdk_payment_requirement(
     )
 
 
+# The `upto` Permit2 signature authorizes the (merchant + facilitator) pair to
+# settle any amount in [0, cap] until `max_timeout_seconds` elapses, with no
+# on-chain check beyond the deadline itself. A merchant-declared timeout with
+# no upper bound would extend that facilitator-discretion window indefinitely,
+# so cap it defensively before signing. `exact` amounts are fixed in the
+# signature, so this cap only applies to `upto`.
+MAX_UPTO_DEADLINE_SECONDS = 7 * 24 * 60 * 60  # 7 days
+
+
+def _cap_upto_deadline(requirement: Any) -> Any:
+    if _trim(getattr(requirement, "scheme", "")).lower() != "upto":
+        return requirement
+    timeout = getattr(requirement, "max_timeout_seconds", None)
+    if not isinstance(timeout, int) or timeout <= MAX_UPTO_DEADLINE_SECONDS:
+        return requirement
+    return requirement.model_copy(update={"max_timeout_seconds": MAX_UPTO_DEADLINE_SECONDS})
+
+
 def _build_selected_payment_required_payload(
     payment_required: Any,
     *,
@@ -855,6 +886,7 @@ def _build_selected_payment_required_payload(
         payment_required,
         selected_payment=selected_payment,
     )
+    selected_requirement = _cap_upto_deadline(selected_requirement)
     return payment_required.model_copy(update={"accepts": [selected_requirement]})
 
 
@@ -904,9 +936,18 @@ def _load_x402_evm_sdk() -> dict[str, Any]:
             "x402 EVM execution requires EVM support.",
             details={"hint": 'Install dependencies so `x402[httpx,evm]` is available in the wallet runtime.'},
         ) from exc
+    try:
+        from x402.mechanisms.evm.upto import UptoEvmScheme
+    except ImportError as exc:
+        raise ProviderError(
+            "x402-sdk",
+            "x402 EVM upto-scheme execution requires the upto mechanism module.",
+            details={"hint": 'Install dependencies so `x402[httpx,evm]` is available in the wallet runtime.'},
+        ) from exc
     sdk.update(
         {
             "register_exact_evm_client": register_exact_evm_client,
+            "UptoEvmScheme": UptoEvmScheme,
         }
     )
     return sdk
@@ -916,6 +957,67 @@ def _load_x402_sdk() -> dict[str, Any]:
     return _load_x402_common_sdk()
 
 
+def _load_x402_siwx_sdk() -> dict[str, Any]:
+    try:
+        from x402.extensions.sign_in_with_x import (
+            SIGN_IN_WITH_X,
+            CreateSIWxClientExtensionOptions,
+            create_siwx_client_extension,
+        )
+    except ImportError as exc:
+        raise ProviderError(
+            "x402-sdk",
+            "x402 sign-in-with-x execution requires the SIWx extension module.",
+            details={"hint": 'Install dependencies so `x402[httpx,evm,svm]` is available in the wallet runtime.'},
+        ) from exc
+    return {
+        "SIGN_IN_WITH_X": SIGN_IN_WITH_X,
+        "CreateSIWxClientExtensionOptions": CreateSIWxClientExtensionOptions,
+        "create_siwx_client_extension": create_siwx_client_extension,
+    }
+
+
+async def _maybe_attach_siwx_header(
+    *,
+    payment_required: Any,
+    signer: Any,
+    headers: dict[str, str],
+) -> dict[str, str]:
+    """Attach a Sign-In-With-X header when the merchant declares that extension.
+
+    Some x402 gateways require proving wallet ownership via SIWx alongside the
+    payment signature; without it those requests are rejected even with a
+    valid payment. Best-effort: any failure to build the SIWx credential falls
+    back to paying without it, matching the upstream SDK's own
+    on_payment_required hook contract (which swallows exceptions the same way).
+    """
+    extensions = getattr(payment_required, "extensions", None) or {}
+    if not extensions:
+        return headers
+    try:
+        sdk = _load_x402_siwx_sdk()
+    except ProviderError:
+        return headers
+    if sdk["SIGN_IN_WITH_X"] not in extensions:
+        return headers
+    extension = sdk["create_siwx_client_extension"](
+        sdk["CreateSIWxClientExtensionOptions"](signers=[signer])
+    )
+    context = SimpleNamespace(payment_required=payment_required)
+    try:
+        result = await extension.transport_hooks.http.on_payment_required(None, context)
+    except Exception as exc:
+        log.warning(
+            "x402 SIWx header build failed; continuing without it",
+            extra={"error_type": type(exc).__name__, "error": str(exc) or None},
+        )
+        return headers
+    siwx_headers = getattr(result, "headers", None) if result is not None else None
+    if not siwx_headers:
+        return headers
+    return {**headers, **siwx_headers}
+
+
 def _build_solana_sdk_signer(backend: AgentWalletBackend) -> Any:
     signer = getattr(backend, "signer", None)
     if signer is None or not hasattr(signer, "export_keypair_bytes"):
@@ -959,15 +1061,30 @@ def _build_evm_sdk_signer(backend: AgentWalletBackend, address: str) -> Any:
             "The active EVM backend does not expose an x402 exact typed-data signer.",
         )
 
+    class _NoEthAccountSentinel:
+        """Truthy placeholder with neither `.sign_message` nor `.address`.
+
+        x402's SIWx sign_evm_message() treats a signer with `.account` unset
+        but both `.sign_message` and `.address` present as an eth_account-style
+        wallet, and calls `.sign_message(SignableMessage)` positionally instead
+        of our keyword-based `sign_message(message=..., account=...)`. Exposing
+        a benign `.account` here short-circuits that fallback so the SDK
+        reaches our intended call path.
+        """
+
     class _OpenClawEvmX402Signer:
         def __init__(self, wallet_backend: AgentWalletBackend, wallet_address: str):
             self._wallet_backend = wallet_backend
             self._address = wallet_address
+            self.account = _NoEthAccountSentinel()
 
         @property
         def address(self) -> str:
             return self._address
 
+        async def sign_message(self, *, message: str, account: Any = None) -> str:
+            return await self._wallet_backend.sign_message(message)
+
         def sign_typed_data(
             self,
             domain: Any,
@@ -1022,9 +1139,10 @@ async def _create_payment_headers(
                 "No direct Solana RPC URL is available for the x402 SDK signer path.",
                 details={"network": _backend_network(backend)},
             )
+        solana_signer = _build_solana_sdk_signer(backend)
         sdk["register_exact_svm_client"](
             client,
-            _build_solana_sdk_signer(backend),
+            solana_signer,
             networks=str(selected_payment["network"]),
             rpc_url=sdk_rpc_url,
         )
@@ -1041,7 +1159,10 @@ async def _create_payment_headers(
                     "error": str(exc) or None,
                 },
             ) from exc
-        return sdk["x402HTTPClientBase"]().encode_payment_signature_header(payment_payload)
+        headers = sdk["x402HTTPClientBase"]().encode_payment_signature_header(payment_payload)
+        return await _maybe_attach_siwx_header(
+            payment_required=payment_required, signer=solana_signer, headers=headers
+        )
 
     if chain == "evm":
         sdk = _load_x402_evm_sdk()
@@ -1054,13 +1175,18 @@ async def _create_payment_headers(
         address = await backend.get_address()
         if not isinstance(address, str) or not address.strip():
             raise ProviderError("x402-evm", "The active EVM backend did not resolve a payer address.")
-        sdk["register_exact_evm_client"](
-            client,
-            _build_evm_sdk_signer(backend, address.strip()),
-            networks=str(selected_payment["network"]),
-        )
+        evm_signer = _build_evm_sdk_signer(backend, address.strip())
+        network = str(selected_payment["network"])
+        sdk["register_exact_evm_client"](client, evm_signer, networks=network)
+        # `upto` reuses the same typed-data signer as `exact`; registering both
+        # lets the SDK settle whichever scheme the merchant's accepted
+        # requirement (already narrowed to one entry above) turns out to use.
+        client.register(network, sdk["UptoEvmScheme"](evm_signer))
         payment_payload = await client.create_payment_payload(selected_payload)
-        return sdk["x402HTTPClientBase"]().encode_payment_signature_header(payment_payload)
+        headers = sdk["x402HTTPClientBase"]().encode_payment_signature_header(payment_payload)
+        return await _maybe_attach_siwx_header(
+            payment_required=payment_required, signer=evm_signer, headers=headers
+        )
 
     raise ProviderError(
         "x402-http",

package/agent-wallet/agent_wallet/wallet_layer/wdk_evm.py

@@ -568,6 +568,24 @@ class WdkEvmLocalWalletBackend(AgentWalletBackend):
         except ValueError as exc:
             raise WalletBackendError("wdk-evm-wallet returned an invalid x402 EVM signature.") from exc
 
+    async def sign_message(self, message: bytes | str) -> str:
+        text = message.decode("utf-8") if isinstance(message, bytes) else str(message)
+        if not text:
+            raise WalletBackendError("message must be a non-empty string.")
+        data = await self.client.post(
+            "/v1/evm/message/sign",
+            {
+                "walletId": self.wallet_id,
+                "accountIndex": self.account_index,
+                "network": self.network,
+                "message": text,
+            },
+        )
+        signature = str(data.get("signature") or "").strip()
+        if not signature:
+            raise WalletBackendError("wdk-evm-wallet did not return a message signature.")
+        return signature
+
     async def get_balance(self, address: str | None = None) -> dict[str, Any]:
         resolved_address = await self.get_address()
         if address is not None and address.strip() and address.strip() != resolved_address:

package/agent-wallet/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "agent-wallet",
   "name": "Agent Wallet",
   "description": "Plugin-friendly wallet backend for OpenClaw agents with safe wallet tools and runtime instructions across Solana, local BTC, and local EVM.",
-  "version": "0.1.67",
+  "version": "0.1.68",
   "skills": ["skills/wallet-operator"],
   "configSchema": {
     "type": "object",

package/agent-wallet/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "openclaw-agent-wallet"
-version = "0.1.67"
+version = "0.1.68"
 description = "Plugin-friendly wallet backend for OpenClaw agents"
 requires-python = ">=3.10"
 dependencies = [
@@ -16,7 +16,7 @@ dependencies = [
     "python-dotenv>=1.0.0",
     "solana>=0.36.0",
     "solders>=0.27.0",
-    "x402[httpx,svm,evm]>=2.10.0",
+    "x402[httpx,svm,evm,extensions]>=2.10.0",
 ]
 
 [project.optional-dependencies]

package/claude-code/plugins/agent-wallet/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "agent-wallet",
   "displayName": "Agent Wallet",
-  "version": "0.1.67",
+  "version": "0.1.68",
   "description": "Claude Code bridge for the existing AgentLayer wallet runtime. Connects to Solana, Bitcoin, and EVM wallets without creating a new one.",
   "author": {
     "name": "AgentLayer"

package/codex/plugins/agent-wallet/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-wallet",
-  "version": "0.1.67",
+  "version": "0.1.68",
   "description": "Codex plugin bridge for the AgentLayer wallet runtime.",
   "author": {
     "name": "AgentLayer"

package/hermes/plugins/agent_wallet/plugin.yaml

@@ -1,5 +1,5 @@
 name: agent-wallet
-version: 0.1.67
+version: 0.1.68
 description: Thin Hermes Agent bridge to the existing AgentLayer/OpenClaw wallet backend
 provides_tools:
   - agent_wallet_tools

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentlayer.tech/wallet",
-  "version": "0.1.67",
+  "version": "0.1.68",
   "description": "NPM installer for the OpenClaw Agent Wallet local runtime.",
   "type": "module",
   "repository": {

package/wdk-btc-wallet/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wdk-btc-wallet",
-  "version": "0.1.67",
+  "version": "0.1.68",
   "private": true,
   "type": "module",
   "description": "Separate BTC-only wallet service built on Tether WDK.",

package/wdk-evm-wallet/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wdk-evm-wallet",
-  "version": "0.1.67",
+  "version": "0.1.68",
   "private": true,
   "type": "module",
   "description": "Separate EVM wallet service built on Tether WDK.",

package/wdk-evm-wallet/src/server.js

@@ -649,6 +649,12 @@ async function handleRequest(request, response) {
       return sendJson(response, 200, { ok: true, data });
     }
 
+    if (method === "POST" && url.pathname === "/v1/evm/message/sign") {
+      const body = await withResolvedNetwork(await withResolvedSeed(await readJsonBody(request)));
+      const data = await service.signPersonalMessage(body);
+      return sendJson(response, 200, { ok: true, data });
+    }
+
     return notFound(response);
   } catch (error) {
     const shaped = toErrorResponse(error, new URL(request.url || "/", "http://localhost").pathname, 400);

package/wdk-evm-wallet/src/wdk_evm_wallet.js

@@ -4068,6 +4068,29 @@ export class WdkEvmWalletService {
     });
   }
 
+  async signPersonalMessage({
+    seedPhrase,
+    accountIndex = 0,
+    network,
+    message,
+  }) {
+    return this.#withAccount({ seedPhrase, accountIndex, network }, async (account, runtimeConfig) => {
+      if (typeof message !== "string" || message.length === 0) {
+        throw new Error("message must be a non-empty string.");
+      }
+      const signerAddress = normalizeAddress(await account.getAddress(), "accountAddress");
+      const signature = await account.sign(message);
+      return {
+        network: runtimeConfig.network,
+        chainId: runtimeConfig.chainId,
+        accountIndex,
+        address: signerAddress,
+        signature,
+        source: "wdk-wallet-evm",
+      };
+    });
+  }
+
   #resolveRuntimeConfig(networkOverride) {
     const network = assertValidNetwork(networkOverride) || this.config.network;
     const profile = this.config.networkProfiles?.[network];