fix(miniapps): 修复 PR #142/#143 review 发现的问题

P0 高风险修复:
- Teleport: signTransData 改用 signedTx.data（RLP encoded rawTx）而非 signature
- Forge: 添加 bio_getPublicKey API 框架（含回退机制）

P1 中风险修复:
- Forge E2E mock: 使用正确的 endpoint 路径 /cot/recharge/support 和 /cot/recharge/V2
- Forge API config: 改为 fail-fast 策略，未配置 VITE_COT_API_BASE_URL 时报错

P2 改进:
- Teleport types.ts: 添加 @bnqkl 包使用说明注释

详细变更:
- packages/bio-sdk: 添加 bio_getPublicKey 方法定义
- src/services/ecosystem: 添加 handleGetPublicKey handler（待完整实现）
- miniapps/forge: useForge 调用 bio_getPublicKey，失败时回退到 address
- miniapps/forge: 更新测试以包含新的 API 调用
- miniapps/teleport: 修正 signTransData 数据源并添加说明注释

Author: Gaubee

miniapps/forge/e2e/ui.spec.ts

@@ -3,9 +3,13 @@ import { UI_TEXT } from './helpers/i18n'
 
 const mockApiResponses = `
   // Mock fetch for API calls
+  // Real endpoints: /cot/recharge/support, /cot/recharge/V2
   const originalFetch = window.fetch
   window.fetch = async (url, options) => {
-    if (url.includes('getSupport')) {
+    const urlStr = typeof url === 'string' ? url : url.toString()
+    
+    // Match real endpoint: /cot/recharge/support
+    if (urlStr.includes('/cot/recharge/support') || urlStr.includes('/recharge/support')) {
       return {
         ok: true,
         json: () => Promise.resolve({
@@ -24,7 +28,8 @@ const mockApiResponses = `
         }),
       }
     }
-    if (url.includes('rechargeV2')) {
+    // Match real endpoint: /cot/recharge/V2
+    if (urlStr.includes('/cot/recharge/V2') || urlStr.includes('/recharge/V2')) {
       return {
         ok: true,
         json: () => Promise.resolve({ orderId: 'order-123456' }),

miniapps/forge/src/api/config.ts

@@ -1,10 +1,28 @@
 /**
  * API Configuration
- * TODO: Base URL needs to be confirmed with backend team
+ * 
+ * IMPORTANT: Base URL must be configured via VITE_COT_API_BASE_URL environment variable.
+ * The COT Recharge API host has not been confirmed - do not use a hardcoded default.
  */
 
-/** API Base URL - to be configured via environment or runtime */
-export const API_BASE_URL = import.meta.env.VITE_COT_API_BASE_URL || 'https://api.eth-metaverse.com'
+/** API Base URL - must be configured via environment variable */
+function getApiBaseUrl(): string {
+  const url = import.meta.env.VITE_COT_API_BASE_URL
+  if (!url) {
+    // Fail-fast in development to catch missing configuration early
+    if (import.meta.env.DEV) {
+      console.error(
+        '[Forge API] VITE_COT_API_BASE_URL is not configured. ' +
+        'Please set this environment variable to the COT Recharge API base URL.'
+      )
+    }
+    // Return empty string - API calls will fail with clear error
+    return ''
+  }
+  return url
+}
+
+export const API_BASE_URL = getApiBaseUrl()
 
 /** API Endpoints */
 export const API_ENDPOINTS = {

miniapps/forge/src/hooks/useForge.test.ts

@@ -49,6 +49,7 @@ describe('useForge', () => {
       .mockResolvedValueOnce({ txHash: 'unsigned123' }) // bio_createTransaction
       .mockResolvedValueOnce({ data: '0xsigned123' }) // bio_signTransaction
       .mockResolvedValueOnce('signature123') // bio_signMessage
+      .mockRejectedValueOnce(new Error('UNSUPPORTED_METHOD')) // bio_getPublicKey (not implemented yet)
 
     vi.mocked(rechargeApi.submitRecharge).mockResolvedValue({ orderId: 'order123' })
 
@@ -66,8 +67,8 @@ describe('useForge', () => {
     expect(result.current.orderId).toBe('order123')
     expect(result.current.error).toBeNull()
 
-    // Verify API calls
-    expect(mockBio.request).toHaveBeenCalledTimes(3)
+    // Verify API calls (4 calls: createTx, signTx, signMessage, getPublicKey)
+    expect(mockBio.request).toHaveBeenCalledTimes(4)
     expect(rechargeApi.submitRecharge).toHaveBeenCalledTimes(1)
   })
 
@@ -127,6 +128,7 @@ describe('useForge', () => {
       .mockResolvedValueOnce({ txHash: 'unsigned123' })
       .mockResolvedValueOnce({ data: '0xsigned123' })
       .mockResolvedValueOnce('signature123')
+      .mockRejectedValueOnce(new Error('UNSUPPORTED_METHOD')) // bio_getPublicKey
 
     vi.mocked(rechargeApi.submitRecharge).mockRejectedValue(new Error('Server error'))
 
@@ -170,6 +172,7 @@ describe('useForge', () => {
       .mockResolvedValueOnce({ txHash: 'unsigned' })
       .mockResolvedValueOnce({ data: '0xsignedEthTx' })
       .mockResolvedValueOnce('sig')
+      .mockRejectedValueOnce(new Error('UNSUPPORTED_METHOD')) // bio_getPublicKey
 
     vi.mocked(rechargeApi.submitRecharge).mockResolvedValue({ orderId: 'order' })
 
@@ -193,6 +196,7 @@ describe('useForge', () => {
       .mockResolvedValueOnce({ txHash: 'unsigned' })
       .mockResolvedValueOnce({ data: '0xsignedBscTx' })
       .mockResolvedValueOnce('sig')
+      .mockRejectedValueOnce(new Error('UNSUPPORTED_METHOD')) // bio_getPublicKey
 
     vi.mocked(rechargeApi.submitRecharge).mockResolvedValue({ orderId: 'order' })
 

miniapps/forge/src/hooks/useForge.ts

@@ -135,12 +135,27 @@ export function useForge() {
         }],
       })
 
-      // Build signature info
-      // Note: publicKey format needs to be confirmed with backend
+      // Get public key for signature verification
+      // Note: publicKey format (hex/base58) needs to be confirmed with backend
+      let publicKey: string
+      try {
+        publicKey = await window.bio.request<string>({
+          method: 'bio_getPublicKey',
+          params: [{ address: internalAccount.address }],
+        })
+      } catch (err) {
+        // bio_getPublicKey not yet implemented - this is a known limitation
+        // Backend integration will fail until this is resolved
+        console.warn('[useForge] bio_getPublicKey failed, using address as fallback:', err)
+        // Fallback: use address (will likely fail backend verification)
+        // TODO: Remove this fallback once bio_getPublicKey is fully implemented
+        publicKey = internalAccount.address
+      }
+
       const signatureInfo: SignatureInfo = {
         timestamp: rechargeMessage.timestamp,
         signature,
-        publicKey: internalAccount.address, // TODO: Get actual public key
+        publicKey,
       }
 
       // Step 3: Submit recharge request

miniapps/teleport/src/App.tsx

@@ -179,13 +179,18 @@ export default function App() {
       })
 
       // 3. 构造 fromTrJson（根据链类型）
+      // 注意：signTransData 需要使用 signedTx.data（RLP encoded raw signed tx），
+      // 而非 signedTx.signature（仅包含 r+s，不是可广播的 rawTx）
       const fromTrJson: FromTrJson = {}
       const chainLower = sourceAccount.chain.toLowerCase()
+      const signTransData = typeof signedTx.data === 'string' 
+        ? signedTx.data 
+        : JSON.stringify(signedTx.data)
 
       if (chainLower === 'eth') {
-        fromTrJson.eth = { signTransData: signedTx.signature }
+        fromTrJson.eth = { signTransData }
       } else if (chainLower === 'bsc') {
-        fromTrJson.bsc = { signTransData: signedTx.signature }
+        fromTrJson.bsc = { signTransData }
       } else {
         // 内链交易
         fromTrJson.bcf = {

miniapps/teleport/src/api/types.ts

@@ -1,6 +1,9 @@
 /**
  * Teleport API Types
- * 基于 @bnqkl/metabox-core@0.5.2 类型定义
+ * 
+ * 类型定义参考 @bnqkl/metabox-core@0.5.2 和 @bnqkl/wallet-typings@0.23.8
+ * 注意：这些包在 package.json 中作为依赖存在，但当前未被直接 import 使用。
+ * 如果不需要运行时依赖，可以考虑移至 devDependencies 或移除。
  */
 
 // 链名类型

packages/bio-sdk/src/types.ts

@@ -80,6 +80,9 @@ export interface BioMethods {
   /** Pick another wallet address (shows wallet picker UI) */
   bio_pickWallet: (opts?: { chain?: string; exclude?: string }) => Promise<BioAccount>
 
+  /** Get public key for an address (hex encoded) */
+  bio_getPublicKey: (params: { address: string }) => Promise<string>
+
   /** Sign a message */
   bio_signMessage: (params: { message: string; address: string }) => Promise<string>
 

src/services/ecosystem/handlers/index.ts

@@ -12,6 +12,7 @@ export {
   handlePickWallet,
   handleChainId,
   handleGetBalance,
+  handleGetPublicKey,
   setWalletPicker,
   setGetAccounts,
 } from './wallet'

src/services/ecosystem/handlers/wallet.ts

@@ -109,3 +109,31 @@ export const handleGetBalance: MethodHandler = async (params, _context) => {
   // TODO: Query actual balance from chain adapter
   return '0'
 }
+
+/** bio_getPublicKey - Get public key for an address */
+export const handleGetPublicKey: MethodHandler = async (params, context) => {
+  const opts = params as { address?: string } | undefined
+  if (!opts?.address) {
+    throw Object.assign(new Error('Missing address'), { code: BioErrorCodes.INVALID_PARAMS })
+  }
+
+  const getConnectedAccounts = getAccountsGetter(context.appId)
+  if (!getConnectedAccounts) {
+    throw Object.assign(new Error('Not connected'), { code: BioErrorCodes.UNAUTHORIZED })
+  }
+
+  const accounts = getConnectedAccounts()
+  const account = accounts.find(a => a.address.toLowerCase() === opts.address!.toLowerCase())
+  if (!account) {
+    throw Object.assign(new Error('Address not found in connected accounts'), { code: BioErrorCodes.UNAUTHORIZED })
+  }
+
+  // TODO: Retrieve actual public key from wallet store
+  // For BioForest chains, the public key can be derived from the mnemonic
+  // For now, this returns a placeholder - needs to be implemented with wallet integration
+  // The public key format should be confirmed with the backend (hex, base58, etc.)
+  throw Object.assign(
+    new Error('bio_getPublicKey not yet implemented - requires wallet store integration'),
+    { code: BioErrorCodes.UNSUPPORTED_METHOD }
+  )
+}

src/services/ecosystem/provider.ts

@@ -13,6 +13,7 @@ import {
   handlePickWallet,
   handleChainId,
   handleGetBalance,
+  handleGetPublicKey,
   handleSignMessage,
   handleSignTypedData,
   handleCreateTransaction,
@@ -30,6 +31,7 @@ export function initBioProvider(): void {
   bridge.registerHandler('bio_pickWallet', handlePickWallet)
   bridge.registerHandler('bio_chainId', handleChainId)
   bridge.registerHandler('bio_getBalance', handleGetBalance)
+  bridge.registerHandler('bio_getPublicKey', handleGetPublicKey)
 
   // Signing methods
   bridge.registerHandler('bio_signMessage', handleSignMessage)
@@ -50,6 +52,7 @@ export function initBioProvider(): void {
     'bio_pickWallet',
     'bio_chainId',
     'bio_getBalance',
+    'bio_getPublicKey',
     'bio_signMessage',
     'bio_signTypedData',
     'bio_createTransaction',