feat: Make Aptos transaction sponsorship optional

Add optional gas sponsorship for Aptos transactions, allowing facilitators to choose between sponsored mode (facilitator pays gas) and non-sponsored mode (client pays own gas).

Changes:
- Make AptosChainConfig.signer optional, add sponsor_gas boolean flag
- Update AptosChainProvider to handle optional fee payer configuration
- Update /supported endpoint to include extra.sponsored when enabled
- Update settle flow to conditionally sponsor based on configuration
- Add validation: signer required when sponsor_gas is true

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: jtang17

src/chain/aptos.rs

@@ -137,15 +137,17 @@ impl From<AptosChainProviderError> for X402SchemeFacilitatorError {
 
 pub struct AptosChainProvider {
     chain: AptosChainReference,
-    account_address: AccountAddress,
-    private_key: Ed25519PrivateKey,
+    sponsor_gas: bool,
+    fee_payer_address: Option<AccountAddress>,
+    fee_payer_private_key: Option<Ed25519PrivateKey>,
     rest_client: Arc<AptosClient>,
 }
 
 impl Debug for AptosChainProvider {
     fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
         f.debug_struct("AptosChainProvider")
             .field("chain", &self.chain)
+            .field("sponsor_gas", &self.sponsor_gas)
             .field("rpc_url", &"<rest_client>")
             .finish()
     }
@@ -157,44 +159,68 @@ impl AptosChainProvider {
     ) -> Result<Self, Box<dyn std::error::Error>> {
         let chain = config.chain_reference();
         let rpc_url = config.rpc();
+        let sponsor_gas = config.sponsor_gas();
 
-        // Parse private key (hex with or without 0x prefix)
-        let private_key_hex = config.signer().to_string();
-        let private_key_hex = private_key_hex.trim_start_matches("0x");
-        let private_key_bytes = hex::decode(private_key_hex)?;
-        let private_key = Ed25519PrivateKey::try_from(private_key_bytes.as_slice())?;
+        // Validate: if sponsoring, signer must be provided
+        if sponsor_gas && config.signer().is_none() {
+            return Err("signer configuration required when sponsor_gas is true".into());
+        }
+
+        // Parse private key if signer is provided
+        let (fee_payer_address, fee_payer_private_key) = if let Some(signer) = config.signer() {
+            let private_key_hex = signer.to_string();
+            let private_key_hex = private_key_hex.trim_start_matches("0x");
+            let private_key_bytes = hex::decode(private_key_hex)?;
+            let private_key = Ed25519PrivateKey::try_from(private_key_bytes.as_slice())?;
+
+            // Derive account address from public key
+            use aptos_crypto::ed25519::Ed25519PublicKey;
+            use aptos_types::transaction::authenticator::AuthenticationKey;
+
+            let public_key: Ed25519PublicKey = (&private_key).into();
+            let auth_key = AuthenticationKey::ed25519(&public_key);
+            let account_address = auth_key.account_address();
+
+            (Some(account_address), Some(private_key))
+        } else {
+            (None, None)
+        };
 
         let rest_client = AptosClient::new(rpc_url.clone());
 
-        let provider = Self::new(chain, private_key, rest_client);
+        let provider = Self::new(chain, sponsor_gas, fee_payer_address, fee_payer_private_key, rest_client);
         Ok(provider)
     }
 
     pub fn new(
         chain: AptosChainReference,
-        private_key: Ed25519PrivateKey,
+        sponsor_gas: bool,
+        fee_payer_address: Option<AccountAddress>,
+        fee_payer_private_key: Option<Ed25519PrivateKey>,
         rest_client: AptosClient,
     ) -> Self {
-        // Derive account address from public key
-        use aptos_crypto::ed25519::Ed25519PublicKey;
-        use aptos_types::transaction::authenticator::AuthenticationKey;
-
-        let public_key: Ed25519PublicKey = (&private_key).into();
-        let auth_key = AuthenticationKey::ed25519(&public_key);
-        let account_address = auth_key.account_address();
-
         {
             let chain_id: ChainId = chain.into();
-            tracing::info!(
-                chain = %chain_id,
-                address = %account_address,
-                "Initialized Aptos provider"
-            );
+            if let Some(address) = fee_payer_address {
+                tracing::info!(
+                    chain = %chain_id,
+                    address = %address,
+                    sponsor_gas = sponsor_gas,
+                    "Initialized Aptos provider with fee payer"
+                );
+            } else {
+                tracing::info!(
+                    chain = %chain_id,
+                    sponsor_gas = sponsor_gas,
+                    "Initialized Aptos provider without fee payer"
+                );
+            }
         }
         Self {
             chain,
-            account_address,
-            private_key,
+            sponsor_gas,
+            fee_payer_address,
+            fee_payer_private_key,
             rest_client: Arc::new(rest_client),
         }
     }
@@ -203,18 +229,26 @@ impl AptosChainProvider {
         &self.rest_client
     }
 
-    pub fn account_address(&self) -> AccountAddress {
-        self.account_address
+    pub fn sponsor_gas(&self) -> bool {
+        self.sponsor_gas
     }
 
-    pub fn private_key(&self) -> &Ed25519PrivateKey {
-        &self.private_key
+    pub fn account_address(&self) -> Option<AccountAddress> {
+        self.fee_payer_address
+    }
+
+    pub fn private_key(&self) -> Option<&Ed25519PrivateKey> {
+        self.fee_payer_private_key.as_ref()
     }
 }
 
 impl ChainProviderOps for AptosChainProvider {
     fn signer_addresses(&self) -> Vec<String> {
-        vec![Address::new(self.account_address).to_string()]
+        if let Some(address) = self.fee_payer_address {
+            vec![Address::new(address).to_string()]
+        } else {
+            vec![]
+        }
     }
 
     fn chain_id(&self) -> ChainId {

src/config.rs

@@ -563,12 +563,15 @@ pub struct AptosChainConfig {
 }
 
 impl AptosChainConfig {
-    pub fn signer(&self) -> &AptosSignerConfig {
-        &self.inner.signer
+    pub fn signer(&self) -> Option<&AptosSignerConfig> {
+        self.inner.signer.as_ref()
     }
     pub fn rpc(&self) -> &Url {
         &self.inner.rpc
     }
+    pub fn sponsor_gas(&self) -> bool {
+        self.inner.sponsor_gas
+    }
     pub fn chain_reference(&self) -> aptos::AptosChainReference {
         self.chain_reference
     }
@@ -580,11 +583,16 @@ impl AptosChainConfig {
 /// Configuration specific to Aptos chains.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct AptosChainConfigInner {
-    /// Signer configuration for this chain (required).
-    /// A hex-encoded private key (32 or 64 bytes) or env var reference.
-    pub signer: AptosSignerConfig,
     /// RPC provider URL for this chain (required).
     pub rpc: Url,
+    /// Signer configuration for this chain (optional, required only if sponsor_gas is true).
+    /// A hex-encoded private key (32 or 64 bytes) or env var reference.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub signer: Option<AptosSignerConfig>,
+    /// Whether the facilitator should sponsor gas fees for transactions (default: false).
+    /// If true, facilitator signs as fee payer and pays gas. If false, users pay their own gas.
+    #[serde(default)]
+    pub sponsor_gas: bool,
 }
 
 /// Configuration for chains.

src/scheme/v2_aptos_exact/mod.rs

@@ -108,11 +108,19 @@ impl X402SchemeFacilitator for V2AptosExactFacilitator {
 
     async fn supported(&self) -> Result<proto::SupportedResponse, X402SchemeFacilitatorError> {
         let chain_id = self.provider.chain_id();
+
+        // Include extra.sponsored if the facilitator is configured to sponsor gas
+        let extra = if self.provider.sponsor_gas() {
+            Some(serde_json::json!({ "sponsored": true }))
+        } else {
+            None
+        };
+
         let kinds: Vec<proto::SupportedPaymentKind> = vec![proto::SupportedPaymentKind {
             x402_version: proto::v2::X402Version2.into(),
             scheme: ExactScheme.to_string(),
             network: chain_id.to_string(),
-            extra: None,
+            extra,
         }];
         let signers = {
             let mut signers = HashMap::with_capacity(1);
@@ -217,41 +225,63 @@ pub async fn settle_transaction(
             ))
         })?;
 
-    // For sponsored transactions, sign as fee payer
-    let fee_payer_address = provider.account_address();
-    let fee_payer_private_key = provider.private_key();
-    let fee_payer_public_key: Ed25519PublicKey = fee_payer_private_key.into();
-
-    // Create the message that the fee payer needs to sign
-    // This is the same message the sender signed: RawTransactionWithData::new_fee_payer
-    let fee_payer_message = RawTransactionWithData::new_fee_payer(
-        verification.raw_transaction.clone(),
-        vec![], // No secondary signers
-        fee_payer_address,
-    );
-
-    // Sign as fee payer - sign the message directly (it implements CryptoHash)
-    let fee_payer_signature = fee_payer_private_key
-        .sign(&fee_payer_message)
-        .map_err(|e| {
-            PaymentVerificationError::InvalidSignature(format!(
-                "Failed to sign as fee payer: {}",
-                e
-            ))
+    let signed_txn = if provider.sponsor_gas() {
+        // Sponsored transaction: facilitator signs as fee payer
+        let fee_payer_address = provider.account_address().ok_or_else(|| {
+            PaymentVerificationError::InvalidFormat(
+                "Fee payer address not configured for sponsored transaction".to_string(),
+            )
+        })?;
+        let fee_payer_private_key = provider.private_key().ok_or_else(|| {
+            PaymentVerificationError::InvalidFormat(
+                "Fee payer private key not configured for sponsored transaction".to_string(),
+            )
         })?;
+        let fee_payer_public_key: Ed25519PublicKey = fee_payer_private_key.into();
+
+        // Create the message that the fee payer needs to sign
+        let fee_payer_message = RawTransactionWithData::new_fee_payer(
+            verification.raw_transaction.clone(),
+            vec![], // No secondary signers
+            fee_payer_address,
+        );
+
+        // Sign as fee payer
+        let fee_payer_signature = fee_payer_private_key
+            .sign(&fee_payer_message)
+            .map_err(|e| {
+                PaymentVerificationError::InvalidSignature(format!(
+                    "Failed to sign as fee payer: {}",
+                    e
+                ))
+            })?;
+
+        let fee_payer_authenticator =
+            AccountAuthenticator::ed25519(fee_payer_public_key.clone(), fee_payer_signature);
+
+        // Create fee payer signed transaction
+        SignedTransaction::new_fee_payer(
+            verification.raw_transaction.clone(),
+            sender_authenticator,
+            vec![], // No secondary signer addresses
+            vec![], // No secondary signers
+            fee_payer_address,
+            fee_payer_authenticator,
+        )
+    } else {
+        // Non-sponsored transaction: client pays own gas, just submit their fully-signed transaction
+        // Extract public key and signature from the sender's authenticator
+        let (public_key, signature) = match sender_authenticator {
+            AccountAuthenticator::Ed25519 { public_key, signature } => (public_key, signature),
+            _ => {
+                return Err(PaymentVerificationError::InvalidFormat(
+                    "Only Ed25519 signatures are supported for non-sponsored transactions".to_string(),
+                ));
+            }
+        };
 
-    let fee_payer_authenticator =
-        AccountAuthenticator::ed25519(fee_payer_public_key.clone(), fee_payer_signature);
-
-    // Create fee payer signed transaction
-    let signed_txn = SignedTransaction::new_fee_payer(
-        verification.raw_transaction.clone(),
-        sender_authenticator,
-        vec![], // No secondary signer addresses
-        vec![], // No secondary signers
-        fee_payer_address,
-        fee_payer_authenticator,
-    );
+        SignedTransaction::new(verification.raw_transaction.clone(), public_key, signature)
+    };
 
     // Compute transaction hash after signing
     let tx_hash = signed_txn.committed_hash();