@bolloon/bolloon-agent 0.5.2 → 0.5.4

package/dist/cli/x402-seller-command.js

@@ -0,0 +1,289 @@
+/**
+ * x402-seller-command.ts — `bolloon x402 pending list|show|sign|auth-init|key`
+ *
+ * 薄包装: 业务逻辑一律在 `agents/x402/seller-signing.ts`, 本文件只做
+ *   ① 参数解析 ② 人类可读输出 ③ 失败时的可操作提示。
+ *
+ * 红线 (与 docs/wiki/x402-seller-signing.md 一致):
+ *   · 私钥**只在本进程内存里**用于签名; 绝不打印、绝不落日志、绝不进命令行、绝不上服务器
+ *   · 共享密钥只出现在 0600 文件与请求头里; 输出里只有 keyId 与指纹
+ *   · 签名只走既有 `buildSignedEnvelope` → `ed25519Sign` (不新写一套签名实现)
+ *   · 卖方不在线 ⇒ 如实报 "已付款待签名", 不假装能交付
+ */
+import { sellerApiPaths, sellerAuthPath, sellerAuthFingerprint, generateSellerAuth, loadSellerAuth, saveSellerAuth, sellerHome, sellerClientRequest, pendingView, signPending, resolveSellerKey, paidInfoRetrievePath, } from '../agents/x402/seller-signing.js';
+import { canonicalize, ed25519Verify } from '../agents/x402/paid-info-protocol.js';
+const USAGE = `
+bolloon x402 pending —— 卖方本机签名交付 (私钥不离开本机)
+
+  bolloon x402 pending list [--endpoint <url>] [--status awaiting_signature] [--json]
+  bolloon x402 pending show <pendingId> [--endpoint <url>] [--json]
+  bolloon x402 pending sign <pendingId> [--endpoint <url>] [--agent <agentId>] [--json]
+  bolloon x402 pending auth-init [--endpoint <url>] [--force]
+  bolloon x402 pending key [--agent <agentId>] [--json]
+
+  auth-init   生成 0600 共享密钥 (~/.bolloon/x402-seller-auth.json), 打印 keyId/指纹/安装提示
+  key         打印本机卖方公钥 (给服务器钉住; **只有公钥**, 私钥永不出机)
+  list/show   带 HMAC 认证拉取待办 (服务器只持公钥, 签不了信封 ⇒ 必须本机签)
+  sign        读本机内容 → 既有 ed25519Sign 签信封 → 回传服务器 → 本机自检验签
+
+选项: --endpoint <url> (也可在 auth 文件里存 endpoint) · --agent <agentId> · --json
+`;
+function flagValue(args, name) {
+    const i = args.indexOf(name);
+    if (i >= 0 && i + 1 < args.length && !args[i + 1].startsWith('--'))
+        return args[i + 1];
+    const eq = args.find((a) => a.startsWith(`${name}=`));
+    return eq ? eq.slice(name.length + 1) : undefined;
+}
+function firstPositional(args) {
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a.startsWith('--')) {
+            if (!a.includes('='))
+                i++;
+            continue;
+        }
+        return a;
+    }
+    return undefined;
+}
+/** endpoint: --endpoint > auth 文件 > env */
+async function resolveEndpoint(args) {
+    const explicit = flagValue(args, '--endpoint') || process.env.BOLLOON_X402_SELLER_ENDPOINT;
+    if (explicit)
+        return explicit;
+    const cfg = await loadSellerAuth();
+    if (cfg?.endpoint)
+        return cfg.endpoint;
+    throw new Error('没有端点: 给 --endpoint <url>, 或先跑 `bolloon x402 pending auth-init --endpoint <url>` 把它存进 auth 文件');
+}
+function short(s, n = 20) {
+    const v = String(s ?? '');
+    return v.length > n ? `${v.slice(0, n)}…` : v;
+}
+// ─────────────────────────────────────────────────────────── 子命令
+async function cmdList(args) {
+    const json = args.includes('--json');
+    const endpoint = await resolveEndpoint(args);
+    const auth = await loadSellerAuth();
+    if (!auth) {
+        console.error('❌ 本机没有共享密钥 (~/.bolloon/x402-seller-auth.json) — 先跑 `bolloon x402 pending auth-init --endpoint <url>`');
+        return 1;
+    }
+    const status = flagValue(args, '--status');
+    const urlPath = status ? `${sellerApiPaths().list}?status=${encodeURIComponent(status)}` : sellerApiPaths().list;
+    // 被签的只有 pathname (查询串不参与)
+    const r = await sellerClientRequest({ endpoint, auth }, { method: 'GET', path: sellerApiPaths().list, urlPath });
+    if (!r.ok) {
+        console.error(`❌ 拉取失败 (HTTP ${r.status}): ${r.json?.code || ''} ${r.json?.error || r.text.slice(0, 200)}`);
+        if (r.json?.hint)
+            console.error(`   ${r.json.hint}`);
+        return 1;
+    }
+    if (json) {
+        console.log(JSON.stringify(r.json, null, 2));
+        return 0;
+    }
+    const items = r.json.pending || [];
+    console.log(`卖方待办 (${endpoint}) — 共 ${r.json.total ?? items.length} 条, 待签名 ${r.json.awaitingSignature ?? '?'} 条`);
+    if (!items.length) {
+        console.log('  (空) 没有待签名的付款 —— 卖方不在线时买方只会拿到「已付款待签名」');
+        return 0;
+    }
+    for (const p of items) {
+        const v = pendingView(p);
+        console.log(`  ${v.pendingId}  [${v.status}]  ${v.itemId}  ${v.payment.amount} ${v.payment.currency}@${v.payment.network}  ${v.createdAt}`);
+        console.log(`      内容哈希 ${v.contentHash} · 付款凭据哈希 ${v.payment.receiptHash} · mode=${v.payment.mode}`);
+    }
+    console.log('  下一步: bolloon x402 pending show <pendingId> → sign <pendingId>');
+    return 0;
+}
+async function cmdShow(args) {
+    const json = args.includes('--json');
+    const id = firstPositional(args);
+    if (!id) {
+        console.error('用法: bolloon x402 pending show <pendingId>');
+        return 1;
+    }
+    const endpoint = await resolveEndpoint(args);
+    const auth = await loadSellerAuth();
+    if (!auth) {
+        console.error('❌ 本机没有共享密钥 — 先跑 auth-init');
+        return 1;
+    }
+    const r = await sellerClientRequest({ endpoint, auth }, { method: 'GET', path: sellerApiPaths().show(id) });
+    if (!r.ok) {
+        console.error(`❌ 取不到 (HTTP ${r.status}): ${r.json?.code || ''} ${r.json?.error || r.text.slice(0, 200)}`);
+        return 1;
+    }
+    if (json) {
+        console.log(JSON.stringify(r.json, null, 2));
+        return 0;
+    }
+    const p = r.json.pending;
+    console.log(`待办 ${p.pendingId}  [${p.status}]`);
+    console.log(`  item          ${p.itemId}  (${p.title})`);
+    console.log(`  卖方 DID      ${p.providerDid}`);
+    console.log(`  内容哈希      ${p.contentHash}${p.contentCid ? `  cid=${p.contentCid}` : ''}`);
+    console.log(`  来源声明      kind=${p.source?.kind} refs=${(p.source?.refs || []).length}`);
+    console.log(`  价格          ${p.price.amount} ${p.price.currency}@${p.price.network} → ${p.price.payTo}`);
+    console.log(`  付款          mode=${p.payment.mode}  ${p.payment.amount} ${p.payment.currency}@${p.payment.network}`);
+    console.log(`  付款凭据哈希  ${p.payment.receiptHash}   ← 签名会绑定它`);
+    console.log(`  付款凭据原文  ${short(p.payment.receipt, 48)}   (回执原文, 本机要用它重建哈希)`);
+    if (p.payment.txHash)
+        console.log(`  链上 txHash   ${p.payment.txHash}`);
+    if (p.payment.payer)
+        console.log(`  付款方        ${p.payment.payer}`);
+    console.log(`  创建/过期     ${p.createdAt} → ${p.expiresAt}`);
+    if (p.envelopeHash)
+        console.log(`  已签信封哈希  ${p.envelopeHash}`);
+    console.log(`  下一步: bolloon x402 pending sign ${p.pendingId}`);
+    return 0;
+}
+async function cmdSign(args) {
+    const json = args.includes('--json');
+    const id = firstPositional(args);
+    if (!id) {
+        console.error('用法: bolloon x402 pending sign <pendingId> [--agent <agentId>]');
+        return 1;
+    }
+    const endpoint = await resolveEndpoint(args);
+    const auth = await loadSellerAuth();
+    if (!auth) {
+        console.error('❌ 本机没有共享密钥 — 先跑 auth-init');
+        return 1;
+    }
+    // ① 拉这条待办 (服务器是待办的事实来源)
+    const r = await sellerClientRequest({ endpoint, auth }, { method: 'GET', path: sellerApiPaths().show(id) });
+    if (!r.ok) {
+        console.error(`❌ 取不到待办 (HTTP ${r.status}): ${r.json?.code || ''} ${r.json?.error || r.text.slice(0, 200)}`);
+        return 1;
+    }
+    const pending = r.json.pending;
+    if (pending.status !== 'awaiting_signature') {
+        console.error(`❌ 这条待办状态是 ${pending.status} — 不能签 (已签过/已过期都不许重签)`);
+        return 1;
+    }
+    // ② 本机内容 (签名要绑内容哈希 ⇒ 没有内容就签不出来, 如实报错)
+    const { getStoredInfo } = await import('../agents/x402/paid-info-store.js');
+    const stored = await getStoredInfo(pending.itemId, sellerHome());
+    if (!stored) {
+        console.error(`❌ 本机没有 item ${pending.itemId} 的内容 (~/.bolloon/x402-info/) — 没法签 (签一个对不上的信封等于假交付)`);
+        return 1;
+    }
+    // ③ 本机钥匙: 必须是这条 item 的卖方 DID (**不新建钥匙**)
+    const agentId = flagValue(args, '--agent');
+    const key = await resolveSellerKey(pending.providerDid, { agentId });
+    if (!key) {
+        console.error(`❌ 本机找不到能给 ${pending.providerDid} 签名的私钥 (查过 ~/.bolloon/agent-keys/*.json 与 ~/.bolloon/identity.json)`);
+        return 1;
+    }
+    // ④ 签 (既有 ed25519Sign), ⑤ 本机自检验签 —— 不信"我签好了", 用公钥验一遍
+    const envelope = await signPending({ pending, item: stored.item, content: stored.content, keypair: { did: key.did, publicKey: key.publicKeyHex, privateKey: Buffer.from(key.privateKeyHex, 'hex') } });
+    const selfCheck = await ed25519Verify(envelope.proof.publicKeyHex, canonicalize(envelope.proof.payload), envelope.proof.signature);
+    // ⑥ 回传 (服务器会用钉住的公钥再验一次)
+    const post = await sellerClientRequest({ endpoint, auth }, { method: 'POST', path: sellerApiPaths().envelope(pending.pendingId), body: JSON.stringify({ envelope }) });
+    if (json) {
+        console.log(JSON.stringify({
+            ok: post.ok && selfCheck,
+            pendingId: pending.pendingId,
+            itemId: pending.itemId,
+            contentHash: envelope.proof.payload.contentHash,
+            receiptHash: envelope.proof.payload.receiptHash,
+            publicKeyHex: envelope.proof.publicKeyHex,
+            did: envelope.proof.did,
+            keySource: key.source,
+            selfCheckSignature: selfCheck,
+            server: { status: post.status, ok: post.ok, code: post.json?.code, envelopeHash: post.json?.envelopeHash },
+            envelope: post.ok ? undefined : envelope,
+        }, null, 2));
+        return post.ok && selfCheck ? 0 : 1;
+    }
+    console.log(`签名自检: ${selfCheck ? '✅ ed25519Verify 通过' : '❌ 验签不通过 (绝不回传这种信封)'}`);
+    console.log(`  签名        ${short(envelope.proof.signature, 28)}  (base64, 完整值用 --json)`);
+    console.log(`  签名公钥    ${envelope.proof.publicKeyHex}`);
+    console.log(`  钥匙来源    ${key.source} (DID ${envelope.proof.did})`);
+    console.log(`  载荷绑定    itemId=${envelope.proof.payload.itemId} · contentHash=${short(envelope.proof.payload.contentHash, 24)} · receiptHash=${short(envelope.proof.payload.receiptHash, 24)}`);
+    if (!post.ok) {
+        console.error(`❌ 回传失败 (HTTP ${post.status}): ${post.json?.code || ''} ${post.json?.error || post.text.slice(0, 200)}`);
+        return 1;
+    }
+    if (!selfCheck)
+        return 1;
+    console.log(`✅ 已回传并收下 — pendingId=${pending.pendingId} envelopeHash=${post.json?.envelopeHash}`);
+    console.log(`   买方下一步: 用取件 token 取 (不要重放付款凭据 —— 会再跑一遍结算):`);
+    console.log(`     GET ${paidInfoRetrievePath(pending.itemId, pending.pendingId)}   → 200 + 信封, 然后 ed25519Verify / verifyEnvelope 离线验签`);
+    return 0;
+}
+async function cmdAuthInit(args) {
+    const endpoint = flagValue(args, '--endpoint') || process.env.BOLLOON_X402_SELLER_ENDPOINT;
+    const force = args.includes('--force');
+    const existing = await loadSellerAuth();
+    if (existing && !force) {
+        console.log(`已存在共享密钥 (keyId=${existing.keyId} 指纹 ${sellerAuthFingerprint(existing)}) — 换新密钥要显式 --force`);
+        console.log(`  endpoint: ${existing.endpoint || '(未设置)'} · 文件 ${sellerAuthPath()}`);
+        return 0;
+    }
+    const cfg = generateSellerAuth(endpoint);
+    const file = await saveSellerAuth(cfg);
+    console.log('✅ 已生成共享密钥 (0600 文件, 值不打印)');
+    console.log(`  keyId     ${cfg.keyId}`);
+    console.log(`  指纹      ${sellerAuthFingerprint(cfg)}   ← 核对两端是不是同一把就用它`);
+    console.log(`  endpoint  ${cfg.endpoint || '(未设置, 用 --endpoint 指定)'}`);
+    console.log(`  文件      ${file}`);
+    console.log('');
+    console.log('安装到服务器 (值只走 stdin, 不进命令行/不进日志/不进会话):');
+    console.log(`  ssh <server> 'install -m600 -o bolloonpay -g bolloonpay /dev/stdin /opt/bolloon-pay/.bolloon/${'x402-seller-auth.json'}' < ${file}`);
+    console.log('卖方公钥钉钉子 (只有公钥):');
+    console.log('  bolloon x402 pending key > /tmp/seller-key.json   # 再 scp 到服务器 /opt/bolloon-pay/.bolloon/seller-key.json');
+    return 0;
+}
+async function cmdKey(args) {
+    const json = args.includes('--json');
+    const agentId = flagValue(args, '--agent');
+    // 不指定 agent 时用身份文件 (与 routes-x402-info.ts 的 loadProviderKeypair 同源)
+    const did = process.env.BOLLOON_SELLER_DID || '';
+    const key = await resolveSellerKey(did, { agentId });
+    if (!key) {
+        console.error('❌ 本机找不到卖方身份 (~/.bolloon/identity.json 或 agent-keys/)');
+        return 1;
+    }
+    const out = { protocol: 'bolloon-x402-seller/1', did: key.did, publicKeyHex: key.publicKeyHex, note: '这是公钥 (可放服务器)。私钥不在此输出中。' };
+    if (json) {
+        console.log(JSON.stringify(out, null, 2));
+        return 0;
+    }
+    console.log(`卖方 DID    ${out.did}`);
+    console.log(`公钥 (hex)  ${out.publicKeyHex}`);
+    console.log(`来源        ${key.source}`);
+    console.log(`钉到服务器: /opt/bolloon-pay/.bolloon/seller-key.json`);
+    return 0;
+}
+// ─────────────────────────────────────────────────────────── 入口
+export async function x402PendingCommand(args) {
+    const sub = args[0];
+    const rest = args.slice(1);
+    try {
+        switch (sub) {
+            case 'list': return await cmdList(args);
+            case 'show': return await cmdShow(rest);
+            case 'sign': return await cmdSign(rest);
+            case 'auth-init': return await cmdAuthInit(rest);
+            case 'key': return await cmdKey(rest);
+            case undefined:
+            case '--help':
+            case '-h':
+                console.log(USAGE.trim());
+                return sub === undefined ? 1 : 0;
+            default:
+                console.error(`未知 x402 pending 子命令: ${sub}`);
+                console.log(USAGE.trim());
+                return 1;
+        }
+    }
+    catch (e) {
+        console.error(`❌ ${String(e?.message || e).slice(0, 300)}`);
+        return 1;
+    }
+}
+export { USAGE as X402_PENDING_USAGE };

package/dist/cli-entry.js

@@ -21,6 +21,8 @@ import { printBanner } from './cli/loading-tui.js';
 import { discoverEngines, delegateToEngine } from './external-engines/index.js';
 import { x402CheckBalance, x402Fetch } from './agents/x402/x402Pay.js';
 import { runVersionCommand, runUpdateCommand, runDoctorCommand, runRuntimeCommand, UPDATE_HELP } from './cli/update-commands.js';
+import { installStartupLogGate } from './cli/log-gate.js';
+import { waitForTermSize } from './cli/loading-tui.js';
 import { collectVersionInfo } from './utils/version-info.js';
 // 2026-09-27: 启动前言的默认静默 + 显式查询命令 (与 `src/index.ts` 同一套判断)
 import { startupPreambleVisible } from './cli/startup-notice.js';
@@ -68,7 +70,9 @@ ${BOLD}命令:${RESET}
   bolloon setup                     初始化向导 (你的称呼 + 模型供应商 + API key + 连通性测试)
   bolloon identity init             非交互建本机身份 (~/.bolloon/identity.json, 0600, 幂等; 新机器/第二实例用)
   bolloon identity show             看本机身份 (只出 DID/指纹, 绝不打印私钥)
-  bolloon update [plan|status|history|now]   检查更新 / 计划 / 状态 / 历史 / 执行 (默认只检查)
+  bolloon identity bind-address     登记「地址 ↔ DID」绑定 (链下登记·双侧签名·可离线验签)
+  bolloon identity bindings         绑定库: list | show <file> | verify <file> | publish --out <path>
+  bolloon update [wait|force|--dry-run|status|history]   直接执行更新 (先打印计划与风险检查; 只看计划用 --dry-run)
   bolloon doctor                    安装入口 + 版本事实 + 更新状态自洽性诊断
   bolloon runtime [plan|install]    运行时 (Node/npm/Git/Python) 检查与安装
   bolloon model [name] [model]      列出 / 切换模型供应商 (如: bolloon model deepseek deepseek-v4-flash)
@@ -84,6 +88,7 @@ ${BOLD}命令:${RESET}
   bolloon engine run <prompt>       委派任务给智能体
   bolloon x402 fetch <url>          x402 自动支付 HTTP 请求
   bolloon x402 balance <address>    查询 x402 钱包余额
+  bolloon x402 pay <endpoint>       买方自己发 EIP-3009 授权转账 (--with-memo 带订单标识)
   bolloon mcp serve                 MCP server (stdio) —— 给 MCP 客户端接本机 Agent 能力
   bolloon mcp tools                 列出 MCP 暴露的 tools/resources (只读清单)
 
@@ -94,9 +99,8 @@ ${BOLD}示例:${RESET}
   bolloon --web              # 启动 Web UI
   bolloon --cli              # 命令行模式
   bolloon model              # 查看当前模型供应商
-  bolloon update             # 检查更新 (只读, 不改任何东西)
-  bolloon update plan        # 看更新计划与风险检查
-  bolloon update now         # 真正执行更新
+  bolloon update             # 直接执行更新 (先打印计划与风险检查)
+  bolloon update --dry-run   # 只看计划, 不动任何东西
   bolloon doctor             # 我这台机器的 Bolloon 是否自洽
   bolloon network join --json         # 入网 (失败也结构化: ok:false + code + next_action)
   bolloon task --request-id <id> "…"  # 用给定幂等键跑 M1 任务 (同一 requestId 不会付两次)
@@ -247,12 +251,14 @@ function firstPositional(args) {
     }
     return undefined;
 }
-/** x402 子命令: fetch / balance */
+/** x402 子命令: fetch / balance / pending (卖方本机签名交付) */
 async function handleX402Command(x402Args) {
     if (x402Args.length === 0) {
         console.log(`${BOLD}用法:${RESET}`);
         console.log('  bolloon x402 fetch <url> [options]        # 自动处理 402 Payment Required');
         console.log('  bolloon x402 balance <address> [options]  # 查询钱包余额');
+        console.log('  bolloon x402 pay <endpoint> [--with-memo] # 买方自己发 EIP-3009 授权转账 (nonce 带订单标识 BOL1)');
+        console.log('  bolloon x402 pending list|show|sign       # 卖方本机签名交付 (私钥不离开本机)');
         console.log('');
         console.log(`${BOLD}选项:${RESET}`);
         console.log('  --private-key <0x...>  自动支付钱包私钥，也可用 X402_PRIVATE_KEY');
@@ -266,6 +272,18 @@ async function handleX402Command(x402Args) {
     }
     const sub = x402Args[0];
     const rest = x402Args.slice(1);
+    // 2026-09-28: 卖方本机签名交付 —— 待办队列 (list/show/sign/auth-init/key)
+    if (sub === 'pending') {
+        const { x402PendingCommand } = await import('./cli/x402-seller-command.js');
+        process.exit(await x402PendingCommand(rest));
+        return;
+    }
+    // 2026-09-29: 买方自己发 EIP-3009 transferWithAuthorization (nonce 带订单标识 BOL1)
+    if (sub === 'pay') {
+        const { x402PayCommand } = await import('./cli/x402-buyer-command.js');
+        process.exit(await x402PayCommand(rest));
+        return;
+    }
     if (sub === 'fetch') {
         const url = firstPositional(rest);
         if (!url) {
@@ -949,6 +967,26 @@ async function main() {
             await startWebServer(args);
             break;
         case 'cli':
+            /**
+             * 2026-09-30 修复 (leo 报「开启过程的日志没去掉」): 启动日志门原先在 `index.ts` 很靠后的位置才装,
+             *   于是**早于它**发生的第三方输出会直接落到 tty, 出现在启动面板之前 (实测 SDK 的 ipfs 装配会打
+             *   `[warn]: ipfs init 失败…` 两行 + 它自己的子进程输出, 共 4 行泄漏).
+             *   门覆盖 `process.stdout.write` / `process.stderr.write` / `console.*` 三层, 且**是单例**
+             *   (index.ts 里那次 `installStartupLogGate` 会直接复用它) ⇒ 在这里提前装, 行为不变、只是更早生效.
+             *   与 index 侧同一套跳过条件: `--json` (stdout 是机器数据本体) / 一次性工具 / 命令式诊断 不装门.
+             */
+            {
+                const a = args;
+                const isOneShotTool = !!(a.tool || a.prompt);
+                const isCommandLike = !!(a.supervise || a.setupStatus || a.setupResume || a.setupRepair
+                    || a.setupReconfigure || a.setupTest);
+                if (!a.json && !isOneShotTool && !isCommandLike) {
+                    installStartupLogGate({ mode: 'cli-interactive', args: process.argv.slice(2) });
+                }
+            }
+            // 2026-09-30: 先等真实终端尺寸就位再出第一帧 —— 否则面板会先按兜底 80 列渲染一次,
+            //   拿到真尺寸后再渲染一次, 而静态输出覆盖不掉旧内容 ⇒ 顶框被重复打印 + 宽度乱变.
+            await waitForTermSize();
             await startCLI(args);
             break;
         case 'engine':

package/dist/electron-build/agents/chain/transfer-classify.js

@@ -0,0 +1,106 @@
+"use strict";
+/**
+ * transfer-classify.ts — 转账索引的**纯**部分 (类型 + 分类 + 折算 + 汇总)
+ * =========================================================================
+ * 为什么单独一个文件: 这两半的**加载代价**完全不同 ——
+ *   · 本文件: 零依赖 (不 import ethers / 不发 RPC / 不读盘) ⇒ 公开页/快照构建可以**静态**引入;
+ *   · `transfer-index.ts`: 要 JSON-RPC provider (ethers) 与文件系统 ⇒ 只在**同步**路径上加载。
+ * 把纯函数放在这里, network-pulse 才不必为了 `formatUnits` 把 ethers 拖进网页进程。
+ *
+ * 分类口径 (leo 2026-09-29 实测拍板; **不许**只按"USDC 转到该地址"计数):
+ *   · `escrow_settlement`  from == escrow 合约 → 「escrow 退款/释放」(实测块 51685757 / 51686009
+ *                          两笔 +0.001 与那两笔 Disputed→Refunded **逐块对应**) —— 钱退回, **不是收入**;
+ *   · `self_transfer`      from ∈ 自己地址集 (可配 ownAddresses) → 「转入(非销售)」;
+ *   · `external_payment`   其余 → 「外部付款」(与卖方端点台账对上的加标「经 x402 流程」);
+ *   · `outbound`           关注地址**付出** → 不进「链上转入」计数。
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TRANSFER_ADDRESS_RE = exports.USDC_BY_CHAIN = exports.ERC20_TRANSFER_TOPIC = exports.TRANSFER_INDEX_SCHEMA_VERSION = void 0;
+exports.formatUnits = formatUnits;
+exports.classifyTransfer = classifyTransfer;
+exports.summarizeTransfers = summarizeTransfers;
+exports.TRANSFER_INDEX_SCHEMA_VERSION = 1;
+/** Transfer(address indexed from, address indexed to, uint256 value) 的 topic0 */
+exports.ERC20_TRANSFER_TOPIC = '0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef';
+/** Base 主网 USDC (缺省 token; 也可由 chain.json 的 tokenAddress / env 覆盖) */
+exports.USDC_BY_CHAIN = {
+    8453: '0x833589fcd6edb6e08f4c7c32d4f71b54bda02913',
+    84532: '0x036cbd53842c5426634e7929541ec2318f3dcf7e',
+};
+/** 0x + 40 位十六进制 (地址形状; 与 explorer.ts 的同一套尺子) */
+exports.TRANSFER_ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;
+/** 原子单位 → 十进制字符串 (纯整数运算, 不经过浮点; 去掉末尾多余的 0) */
+function formatUnits(atomic, decimals) {
+    const v = BigInt(typeof atomic === 'bigint' ? atomic : (String(atomic || '0').trim() || '0'));
+    const neg = v < 0n;
+    const abs = neg ? -v : v;
+    const d = Math.max(0, Math.floor(decimals));
+    const base = 10n ** BigInt(d);
+    const whole = (abs / base).toString();
+    const frac = (abs % base).toString().padStart(d, '0').replace(/0+$/, '');
+    const out = frac ? `${whole}.${frac}` : whole;
+    return neg ? `-${out}` : out;
+}
+/**
+ * 一条转账的**分类** (纯函数: 输入事实 + 配置, 输出分类)。
+ * 为什么在**读**的时候算而不是写索引时算: 分类规则 / 自己地址集是会变的
+ * (把 0xb4cb8009… 认成"自己钱包"之前, 它只是一个外部地址) ⇒ 历史行必须能被重新分类,
+ * 而不是把当时的判断固化进索引。索引里只存**链上事实** (from/to/value/块号)。
+ */
+function classifyTransfer(e, cfg) {
+    const from = String(e.from || '').toLowerCase();
+    const to = String(e.to || '').toLowerCase();
+    const watch = new Set((cfg.watchAddresses || []).map((a) => String(a).toLowerCase()));
+    if (e.direction === 'out' || (watch.has(from) && !watch.has(to)))
+        return 'outbound';
+    const escrow = String(cfg.escrowAddress || '').toLowerCase();
+    if (escrow && from === escrow)
+        return 'escrow_settlement';
+    if ((cfg.ownAddresses || []).map((a) => String(a).toLowerCase()).includes(from))
+        return 'self_transfer';
+    return 'external_payment';
+}
+/** 已落盘转账索引 → 汇总 (纯函数; 不发网络、不读配置以外的东西) */
+function summarizeTransfers(state, cfg) {
+    const live = (state.entries || []).filter((e) => !e.suspect);
+    const by_class = { escrow_settlement: 0, self_transfer: 0, external_payment: 0 };
+    const by_class_atomic = { escrow_settlement: '0', self_transfer: '0', external_payment: '0' };
+    let inbound = 0, inboundAtomic = 0n, outbound = 0, outboundAtomic = 0n, pending = 0;
+    for (const e of live) {
+        if (e.finality === 'observed')
+            pending++;
+        const v = BigInt(e.value || '0');
+        if (e.direction === 'out') {
+            outbound++;
+            outboundAtomic += v;
+            continue;
+        }
+        inbound++;
+        inboundAtomic += v;
+        const c = classifyTransfer(e, cfg);
+        if (c !== 'outbound') {
+            by_class[c]++;
+            by_class_atomic[c] = (BigInt(by_class_atomic[c]) + v).toString();
+        }
+    }
+    const decimals = Number.isInteger(state.tokenDecimals) ? state.tokenDecimals : (cfg.tokenDecimals ?? 6);
+    return {
+        configured: cfg.enabled !== false && !!((state.watchAddresses || cfg.watchAddresses || []).length),
+        reason: cfg.reason || '',
+        entries: live.length,
+        suspects: (state.entries || []).length - live.length,
+        inbound, inbound_atomic: inboundAtomic.toString(), inbound_display: formatUnits(inboundAtomic, decimals),
+        by_class, by_class_atomic,
+        outbound, outbound_atomic: outboundAtomic.toString(),
+        token_symbol: state.tokenSymbol || cfg.tokenSymbol || '',
+        token_decimals: decimals,
+        watch_addresses_count: (state.watchAddresses || cfg.watchAddresses || []).length,
+        own_addresses_count: (cfg.ownAddresses || []).length,
+        from_block: state.fromBlock,
+        last_synced_block: state.lastSyncedBlock,
+        last_synced_at: state.lastSyncedAt,
+        head_block: state.headBlock,
+        pending_observation: pending,
+    };
+}
+//# sourceMappingURL=transfer-classify.js.map

package/dist/electron-build/agents/chain/transfer-classify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transfer-classify.js","sourceRoot":"","sources":["../../../../src/agents/chain/transfer-classify.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;;;;AAEU,QAAA,6BAA6B,GAAG,CAAC,CAAC;AAE/C,iFAAiF;AACpE,QAAA,oBAAoB,GAAG,oEAAoE,CAAC;AAIzG,sEAAsE;AACzD,QAAA,aAAa,GAA2B;IACnD,IAAI,EAAE,4CAA4C;IAClD,KAAK,EAAE,4CAA4C;CACpD,CAAC;AAEF,iDAAiD;AACpC,QAAA,mBAAmB,GAAG,qBAAqB,CAAC;AAEzD,8CAA8C;AAC9C,qBAA4B,MAAuB,EAAE,QAAgB;IACnE,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;IAC9F,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzE,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9C,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AAC/B,CAAC;AAkED;;;;;GAKG;AACH,0BACE,CAAwD,EACxD,GAA0F;IAE1F,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAChD,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACtF,IAAI,CAAC,CAAC,SAAS,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,UAAU,CAAC;IACpF,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7D,IAAI,MAAM,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,mBAAmB,CAAC;IAC1D,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,eAAe,CAAC;IACxG,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AA6BD,yCAAyC;AACzC,4BACE,KAAwB,EACxB,GAA4K;IAE5K,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,EAAE,iBAAiB,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC;IACjF,MAAM,eAAe,GAAG,EAAE,iBAAiB,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC;IAC9F,IAAI,OAAO,GAAG,CAAC,EAAE,aAAa,GAAG,EAAE,EAAE,QAAQ,GAAG,CAAC,EAAE,cAAc,GAAG,EAAE,EAAE,OAAO,GAAG,CAAC,CAAC;IACpF,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU;YAAE,OAAO,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;YAAC,QAAQ,EAAE,CAAC;YAAC,cAAc,IAAI,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACzE,OAAO,EAAE,CAAC;QACV,aAAa,IAAI,CAAC,CAAC;QACnB,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;YACrB,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACd,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnE,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC;IACxG,OAAO;QACL,UAAU,EAAE,GAAG,CAAC,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,IAAI,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QAClG,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;QACxB,OAAO,EAAE,IAAI,CAAC,MAAM;QACpB,QAAQ,EAAE,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM;QACpD,OAAO,EAAE,cAAc,EAAE,aAAa,CAAC,QAAQ,EAAE,EAAE,eAAe,EAAE,WAAW,CAAC,aAAa,EAAE,QAAQ,CAAC;QACxG,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,eAAe,EAAE,cAAc,CAAC,QAAQ,EAAE;QACpD,YAAY,EAAE,KAAK,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,IAAI,EAAE;QACxD,cAAc,EAAE,QAAQ;QACxB,qBAAqB,EAAE,CAAC,KAAK,CAAC,cAAc,IAAI,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,MAAM;QAChF,mBAAmB,EAAE,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM;QACpD,UAAU,EAAE,KAAK,CAAC,SAAS;QAC3B,iBAAiB,EAAE,KAAK,CAAC,eAAe;QACxC,cAAc,EAAE,KAAK,CAAC,YAAY;QAClC,UAAU,EAAE,KAAK,CAAC,SAAS;QAC3B,mBAAmB,EAAE,OAAO;KAC7B,CAAC;AACJ,CAAC"}