@devlab.group/agent-commerce 1.2.0 → 1.4.0

package/dist/cli/index.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { ZodError, z } from 'zod';
-import { existsSync, mkdirSync, accessSync, constants, closeSync, openSync, readFileSync, chmodSync, promises } from 'fs';
+import { existsSync, mkdirSync, readFileSync, accessSync, constants, closeSync, openSync, chmodSync, promises } from 'fs';
 import * as path from 'path';
 import { resolve, dirname, basename as basename$1, extname, join } from 'path';
 import { stringify, parse, Document, YAMLError } from 'yaml';
 import { CommanderError, Command } from 'commander';
 import picocolors from 'picocolors';
 import { randomUUID } from 'crypto';
-import Database from 'better-sqlite3';
 import { createRequire } from 'module';
+import Database from 'better-sqlite3';
 import { writeFile, stat, readFile, rename, rm } from 'fs/promises';
 import { validate } from '@scalar/openapi-parser';
 import * as clack from '@clack/prompts';
@@ -35,7 +35,7 @@ var init_filename = __esm({
 var PROTOCOL_NAMES;
 var init_common = __esm({
   "src/core/domain/common.ts"() {
-    PROTOCOL_NAMES = ["http", "mcp", "a2a"];
+    PROTOCOL_NAMES = ["http", "mcp", "a2a", "acp"];
   }
 });
 
@@ -51,14 +51,6 @@ var init_resource = __esm({
   }
 });
 
-// src/core/domain/wire.ts
-var PAYMENT_INPUT_FIELD;
-var init_wire = __esm({
-  "src/core/domain/wire.ts"() {
-    PAYMENT_INPUT_FIELD = "_payment";
-  }
-});
-
 // src/core/errors/codes.ts
 var COMMERCE_ERROR_HTTP_STATUS, RETRYABLE_ERROR_CODES;
 var init_codes = __esm({
@@ -72,6 +64,14 @@ var init_codes = __esm({
       PAYMENT_REPLAYED: 409,
       PAYMENT_PROVIDER_UNAVAILABLE: 503,
       PAYMENT_SETTLEMENT_FAILED: 502,
+      // 403, not 402: the buyer's money is not the problem. A 402 tells a client
+      // "pay and retry", which cannot fix a missing or rejected mandate, and a
+      // client that auto-pays on 402 would be charged for a request that was
+      // never going to be delivered.
+      AUTHORIZATION_REQUIRED: 403,
+      AUTHORIZATION_INVALID: 403,
+      AUTHORIZATION_REPLAYED: 409,
+      AUTHORIZATION_PROVIDER_UNAVAILABLE: 503,
       BACKEND_TIMEOUT: 504,
       BACKEND_ERROR: 502,
       PROTOCOL_UNSUPPORTED: 501,
@@ -81,6 +81,10 @@ var init_codes = __esm({
     };
     RETRYABLE_ERROR_CODES = /* @__PURE__ */ new Set([
       "PAYMENT_PROVIDER_UNAVAILABLE",
+      // Our verifier or our replay store was unreachable, so no verdict on the
+      // mandate was ever reached. That is an outage on our side, and the same
+      // proof will verify once it clears.
+      "AUTHORIZATION_PROVIDER_UNAVAILABLE",
       "BACKEND_TIMEOUT",
       // Load shedding is transient by definition: the caller should back off and
       // try again. Before this code existed the MCP adapter's queue-full path threw
@@ -147,6 +151,20 @@ var init_errors = __esm({
   }
 });
 
+// src/core/domain/wire.ts
+var PAYMENT_INPUT_FIELD, AUTHORIZATION_INPUT_FIELD, RESERVED_INPUT_FIELDS;
+var init_wire = __esm({
+  "src/core/domain/wire.ts"() {
+    init_errors();
+    PAYMENT_INPUT_FIELD = "_payment";
+    AUTHORIZATION_INPUT_FIELD = "_authorization";
+    RESERVED_INPUT_FIELDS = [
+      PAYMENT_INPUT_FIELD,
+      AUTHORIZATION_INPUT_FIELD
+    ];
+  }
+});
+
 // src/core/interfaces/logger.ts
 var NOOP_LOGGER;
 var init_logger = __esm({
@@ -204,6 +222,24 @@ var init_core = __esm({
   }
 });
 
+// src/authorization/ap2/constants.ts
+var AP2_SPEC_VERSION, AP2_MODES, AP2_SIGNING_ALGORITHM, AP2_KEY_TYPE, AP2_JWK_CURVE, AP2_JWK_COORDINATE_BYTES, AP2_JWK_MEMBERS, AP2_CHECKOUT_MANDATE_VCT, AP2_CHECKOUT_PROFILE, AP2_DEFAULT_CLOCK_SKEW_SECONDS, AP2_MAX_CLOCK_SKEW_SECONDS;
+var init_constants = __esm({
+  "src/authorization/ap2/constants.ts"() {
+    AP2_SPEC_VERSION = "0.2.0";
+    AP2_MODES = ["direct"];
+    AP2_SIGNING_ALGORITHM = "ES256";
+    AP2_KEY_TYPE = "EC";
+    AP2_JWK_CURVE = "P-256";
+    AP2_JWK_COORDINATE_BYTES = 32;
+    AP2_JWK_MEMBERS = ["kty", "crv", "x", "y", "kid", "alg", "use"];
+    AP2_CHECKOUT_MANDATE_VCT = "mandate.checkout.1";
+    AP2_CHECKOUT_PROFILE = "agent-commerce/ap2/checkout/v1";
+    AP2_DEFAULT_CLOCK_SKEW_SECONDS = 60;
+    AP2_MAX_CLOCK_SKEW_SECONDS = 300;
+  }
+});
+
 // src/core/execution/backend-http.ts
 function extractPathParameterNames(url) {
   return [...url.matchAll(PATH_PARAM_PATTERN)].map((match) => match[1]);
@@ -248,14 +284,13 @@ var init_validation = __esm({
   "src/core/execution/validation.ts"() {
   }
 });
-
-// src/core/execution/pipeline.ts
 var init_pipeline = __esm({
   "src/core/execution/pipeline.ts"() {
     init_wire();
     init_errors();
     init_backend_http();
     init_validation();
+    /* @__PURE__ */ new Set([...RESERVED_INPUT_FIELDS, "__proto__"]);
   }
 });
 
@@ -335,6 +370,30 @@ var init_networks = __esm({
   }
 });
 
+// src/protocols/acp/constants.ts
+var ACP_SPEC_VERSION, ACP_API_VERSION, ACP_WELL_KNOWN_PATH, ACP_CHECKOUT_OPERATIONS, ACP_OPERATION_INPUT_KEYS;
+var init_constants2 = __esm({
+  "src/protocols/acp/constants.ts"() {
+    ACP_SPEC_VERSION = "2026-04-17";
+    ACP_API_VERSION = "2026-04-17";
+    ACP_WELL_KNOWN_PATH = "/.well-known/acp.json";
+    ACP_CHECKOUT_OPERATIONS = [
+      "createCheckoutSession",
+      "updateCheckoutSession",
+      "getCheckoutSession",
+      "completeCheckoutSession",
+      "cancelCheckoutSession"
+    ];
+    ACP_OPERATION_INPUT_KEYS = {
+      createCheckoutSession: ["body"],
+      updateCheckoutSession: ["path", "body"],
+      getCheckoutSession: ["path"],
+      completeCheckoutSession: ["path", "body"],
+      cancelCheckoutSession: ["path"]
+    };
+  }
+});
+
 // src/config/env.ts
 function substituteEnv(value, env, path2 = "$") {
   if (typeof value === "string") {
@@ -691,7 +750,8 @@ function normalise(raw) {
     a2a: {
       enabled: toBoolean(raw.protocols.a2a?.enabled ?? false, "protocols.a2a.enabled"),
       mountPath: raw.protocols.a2a?.mountPath ?? DEFAULT_A2A_MOUNT_PATH
-    }
+    },
+    acp: normaliseAcp(raw.protocols.acp)
   };
   validateMountPaths(protocols);
   const x402Raw = raw.payments.x402;
@@ -742,9 +802,14 @@ function normalise(raw) {
       ...x402.allowUnauthenticatedFacilitator !== void 0 ? { allowUnauthenticatedFacilitator: x402.allowUnauthenticatedFacilitator } : {}
     });
   }
+  const ap2 = normaliseAp2(raw.authorization?.ap2);
+  if (ap2?.enabled) {
+    validateReplayStoreIsolated(ap2.replay.path, raw.storage.receipts.path, protocols.acp);
+  }
   const resources = Object.entries(raw.resources).map(
-    ([id, entry]) => normaliseResource(id, entry, protocols, x402)
+    ([id, entry]) => normaliseResource(id, entry, protocols, x402, ap2)
   );
+  if (protocols.acp.enabled) validateAcpCheckoutMapping(protocols.acp, resources);
   return {
     version: SUPPORTED_CONFIG_VERSION,
     merchant: {
@@ -765,13 +830,15 @@ function normalise(raw) {
     resources,
     payments: {
       ...x402 !== void 0 ? { x402 } : {}
-    }
+    },
+    ...ap2 !== void 0 ? { authorization: { ap2 } } : {}
   };
 }
 function validateMountPaths(protocols) {
   const mounts = [
     ["mcp", protocols.mcp],
-    ["a2a", protocols.a2a]
+    ["a2a", protocols.a2a],
+    ["acp", protocols.acp]
   ].filter(([, p]) => p.enabled);
   for (const [index, [nameA, a]] of mounts.entries()) {
     for (const [nameB, b] of mounts.slice(index + 1)) {
@@ -787,27 +854,357 @@ function validateMountPaths(protocols) {
     }
   }
 }
-function normaliseResource(id, entry, protocols, x402) {
+function ap2Invalid(path2, message, extra = {}) {
+  return new CommerceError("CONFIG_INVALID", message, { details: { path: path2, ...extra } });
+}
+function normaliseAp2(raw) {
+  if (raw === void 0) return void 0;
+  if (!toBoolean(raw.enabled, "authorization.ap2.enabled")) return { enabled: false };
+  const specVersion = raw.specVersion ?? AP2_SPEC_VERSION;
+  if (specVersion !== AP2_SPEC_VERSION) {
+    throw ap2Invalid(
+      "authorization.ap2.specVersion",
+      `authorization.ap2.specVersion "${specVersion}" is not supported - this gateway verifies against the tagged AP2 release ${AP2_SPEC_VERSION} only`
+    );
+  }
+  const mode = raw.mode ?? AP2_MODES[0];
+  if (!AP2_MODES.includes(mode)) {
+    throw ap2Invalid(
+      "authorization.ap2.mode",
+      `authorization.ap2.mode "${mode}" is not supported. Supported: ${AP2_MODES.join(", ")}. Autonomous mode needs open mandates, agent key binding and constraint evaluation, none of which this release implements.`
+    );
+  }
+  if (raw.replay === void 0) {
+    throw ap2Invalid(
+      "authorization.ap2.replay",
+      "authorization.ap2.replay is required when AP2 is enabled - it names the SQLite file recording which mandates have been spent, and without it a verified mandate could authorise a second settlement"
+    );
+  }
+  const mandateIssuers = normaliseIssuers(
+    raw.trust?.mandateIssuers,
+    "authorization.ap2.trust.mandateIssuers"
+  );
+  const checkoutIssuers = normaliseIssuers(
+    raw.trust?.checkoutIssuers,
+    "authorization.ap2.trust.checkoutIssuers"
+  );
+  return {
+    enabled: true,
+    specVersion: AP2_SPEC_VERSION,
+    mode,
+    trust: { mandateIssuers, checkoutIssuers },
+    clockSkewSeconds: toNumber(
+      raw.clockSkewSeconds ?? AP2_DEFAULT_CLOCK_SKEW_SECONDS,
+      "authorization.ap2.clockSkewSeconds",
+      { min: 0, max: AP2_MAX_CLOCK_SKEW_SECONDS }
+    ),
+    replay: { path: raw.replay.path }
+  };
+}
+function normaliseIssuers(raw, path2) {
+  if (raw === void 0 || raw.length === 0) {
+    throw ap2Invalid(
+      path2,
+      `${path2} is required when AP2 is enabled and must name at least one issuer - trust is operator-configured and static, so an empty list means no mandate can ever verify`
+    );
+  }
+  const seen = /* @__PURE__ */ new Set();
+  return raw.map((entry, index) => {
+    const entryPath = `${path2}.${index}`;
+    if (seen.has(entry.issuer)) {
+      throw ap2Invalid(
+        `${entryPath}.issuer`,
+        `${entryPath}.issuer "${entry.issuer}" is listed twice - key lookup resolves by issuer, so a second entry for the same one is silently unreachable. Merge the keys into one entry instead (which is also how a rotation overlaps an old and a new key).`,
+        { issuer: entry.issuer }
+      );
+    }
+    seen.add(entry.issuer);
+    const kids = /* @__PURE__ */ new Set();
+    const keys = entry.keys.map((key, keyIndex) => {
+      const keyPath = `${entryPath}.keys.${keyIndex}`;
+      if (kids.has(key.kid)) {
+        throw ap2Invalid(
+          `${keyPath}.kid`,
+          `${keyPath}.kid "${key.kid}" is listed twice for issuer "${entry.issuer}" - a kid selects exactly one key, so which of the two verifies a signature would be undefined`,
+          { issuer: entry.issuer, kid: key.kid }
+        );
+      }
+      kids.add(key.kid);
+      return { kid: key.kid, jwk: validateJwk(key.jwk, key.kid, keyPath) };
+    });
+    return { issuer: entry.issuer, audience: entry.audience, keys };
+  });
+}
+function validateJwk(jwk, kid, path2) {
+  const fail = (detail) => {
+    throw ap2Invalid(`${path2}.jwk`, `${path2}.jwk (kid "${kid}") ${detail}`, { kid });
+  };
+  for (const member of Object.keys(jwk)) {
+    if (AP2_JWK_MEMBERS.includes(member)) continue;
+    if (member === "d" || member === "k") {
+      fail(
+        `carries private key material ("${member}"). The gateway verifies signatures and never produces them; publish only the public half. Treat the pasted key as compromised and rotate it.`
+      );
+    }
+    fail(
+      `has unsupported member "${member}". Allowed: ${AP2_JWK_MEMBERS.join(", ")}. Members naming a URL are refused on purpose - keys are configured inline and never fetched.`
+    );
+  }
+  const value = (member) => {
+    const raw = jwk[member];
+    if (typeof raw !== "string" || raw.length === 0) {
+      fail(`must give "${member}" as a non-empty string`);
+    }
+    return raw;
+  };
+  if (value("kty") !== AP2_KEY_TYPE) {
+    fail(
+      `must have kty "${AP2_KEY_TYPE}" (got "${value("kty")}") - ${AP2_SIGNING_ALGORITHM} is the only accepted algorithm`
+    );
+  }
+  if (value("crv") !== AP2_JWK_CURVE) {
+    fail(
+      `must be on curve "${AP2_JWK_CURVE}" (got "${value("crv")}") - ${AP2_SIGNING_ALGORITHM} is the only accepted algorithm`
+    );
+  }
+  for (const coordinate of ["x", "y"]) {
+    const encoded = value(coordinate);
+    if (!/^[A-Za-z0-9_-]+$/.test(encoded)) {
+      fail(`coordinate "${coordinate}" is not base64url (no padding, no "+" or "/")`);
+    }
+    if (Buffer.from(encoded, "base64url").length !== AP2_JWK_COORDINATE_BYTES) {
+      fail(
+        `coordinate "${coordinate}" decodes to ${Buffer.from(encoded, "base64url").length} bytes; a ${AP2_JWK_CURVE} coordinate is ${AP2_JWK_COORDINATE_BYTES}`
+      );
+    }
+  }
+  if (jwk["alg"] !== void 0 && value("alg") !== AP2_SIGNING_ALGORITHM) {
+    fail(`declares alg "${value("alg")}"; only ${AP2_SIGNING_ALGORITHM} is accepted`);
+  }
+  if (jwk["use"] !== void 0 && value("use") !== "sig") {
+    fail(`declares use "${value("use")}"; a verification key must be "sig"`);
+  }
+  if (jwk["kid"] !== void 0 && value("kid") !== kid) {
+    fail(`declares kid "${value("kid")}", which disagrees with the configured kid "${kid}"`);
+  }
+  const normalised = {};
+  for (const member of AP2_JWK_MEMBERS) {
+    if (jwk[member] !== void 0) normalised[member] = value(member);
+  }
+  return normalised;
+}
+function validateReplayStoreIsolated(replayPath, receiptsPath, acp) {
+  if (replayPath === ":memory:") return;
+  const others = [["storage.receipts.path", receiptsPath]];
+  if (acp.enabled) others.push(["protocols.acp.idempotency.path", acp.idempotency.path]);
+  for (const [otherPath, other] of others) {
+    if (replayPath !== other) continue;
+    throw ap2Invalid(
+      "authorization.ap2.replay.path",
+      `authorization.ap2.replay.path is the same file as ${otherPath} ("${replayPath}") - the AP2 replay store keeps its own schema and must not share a database with another store`
+    );
+  }
+}
+function normaliseResourceAuthorization(id, entry, pricing, ap2) {
+  const required = entry.authorization?.required;
+  if (required === void 0) return void 0;
+  const path2 = `resources.${id}.authorization.required`;
+  const methods = [];
+  for (const method of required) {
+    if (!SUPPORTED_AUTHORIZATION_METHODS.has(method)) {
+      throw ap2Invalid(
+        path2,
+        `Resource "${id}" requires unsupported authorization method "${method}". Supported: ${[...SUPPORTED_AUTHORIZATION_METHODS].join(", ")}.`,
+        { resourceId: id, method }
+      );
+    }
+    if (methods.includes(method)) {
+      throw ap2Invalid(path2, `Resource "${id}" lists authorization method "${method}" twice`, {
+        resourceId: id,
+        method
+      });
+    }
+    if (method === "ap2" && (ap2 === void 0 || !ap2.enabled)) {
+      throw ap2Invalid(
+        path2,
+        `Resource "${id}" requires authorization method "ap2", which is not configured or not enabled under authorization.ap2`,
+        { resourceId: id, method }
+      );
+    }
+    methods.push(method);
+  }
+  if (pricing.type !== "fixed") {
+    throw ap2Invalid(
+      path2,
+      `Resource "${id}" requires authorization but its pricing is "${pricing.type}" - authorization proves a purchase was approved and never replaces payment, so it applies to fixed-price paid resources only in this release`,
+      { resourceId: id }
+    );
+  }
+  return { required: methods };
+}
+function acpInvalid(path2, message, extra = {}) {
+  return new CommerceError("CONFIG_INVALID", message, { details: { path: path2, ...extra } });
+}
+function normaliseAcp(raw) {
+  const mountPath = raw?.mountPath ?? DEFAULT_ACP_MOUNT_PATH;
+  if (raw === void 0 || !toBoolean(raw.enabled, "protocols.acp.enabled")) {
+    return { enabled: false, mountPath };
+  }
+  if (raw.auth === void 0) {
+    throw acpInvalid(
+      "protocols.acp.auth",
+      'protocols.acp.auth is required when ACP is enabled - every ACP checkout endpoint is authenticated, and "bearer" is the only scheme supported in this release'
+    );
+  }
+  if (raw.idempotency === void 0) {
+    throw acpInvalid(
+      "protocols.acp.idempotency",
+      "protocols.acp.idempotency is required when ACP is enabled - it names the SQLite file holding checkout idempotency records, and ACP makes the Idempotency-Key mandatory on every checkout POST"
+    );
+  }
+  const discovery = raw.discovery;
+  return {
+    enabled: true,
+    mountPath,
+    auth: raw.auth,
+    idempotency: {
+      path: raw.idempotency.path,
+      retentionHours: toNumber(
+        raw.idempotency.retentionHours ?? ACP_RETENTION_HOURS,
+        "protocols.acp.idempotency.retentionHours",
+        { min: ACP_RETENTION_HOURS }
+      )
+    },
+    checkout: { operations: normaliseAcpOperations(raw.checkout) },
+    // Built key by key rather than passed through: absent metadata must stay
+    // absent from the discovery document, not appear there as `undefined`.
+    ...discovery !== void 0 ? {
+      discovery: {
+        ...discovery.documentationUrl !== void 0 ? { documentationUrl: discovery.documentationUrl } : {},
+        ...discovery.supportedCurrencies !== void 0 ? { supportedCurrencies: discovery.supportedCurrencies } : {},
+        ...discovery.supportedLocales !== void 0 ? { supportedLocales: discovery.supportedLocales } : {},
+        ...discovery.interventionTypes !== void 0 ? { interventionTypes: discovery.interventionTypes } : {}
+      }
+    } : {}
+  };
+}
+function normaliseAcpOperations(checkout) {
+  const configured = checkout?.operations ?? {};
+  for (const key of Object.keys(configured)) {
+    if (!ACP_CHECKOUT_OPERATIONS.includes(key)) {
+      throw acpInvalid(
+        `protocols.acp.checkout.operations.${key}`,
+        `protocols.acp.checkout.operations names unknown ACP checkout operation "${key}". Supported: ${ACP_CHECKOUT_OPERATIONS.join(", ")}.`
+      );
+    }
+  }
+  const operations = {};
+  const claimedBy = /* @__PURE__ */ new Map();
+  for (const operation of ACP_CHECKOUT_OPERATIONS) {
+    const path2 = `protocols.acp.checkout.operations.${operation}`;
+    const resourceId = configured[operation];
+    if (resourceId === void 0) {
+      throw acpInvalid(
+        path2,
+        `${path2} is required when ACP is enabled - all five checkout operations must be mapped, since ACP discovery advertises the checkout service as a whole`
+      );
+    }
+    const claimed = claimedBy.get(resourceId);
+    if (claimed !== void 0) {
+      throw acpInvalid(
+        path2,
+        `${path2} maps resource "${resourceId}", which is already mapped to "${claimed}" - each ACP checkout operation needs its own resource`,
+        { resourceId }
+      );
+    }
+    claimedBy.set(resourceId, operation);
+    operations[operation] = resourceId;
+  }
+  return operations;
+}
+function validateAcpCheckoutMapping(acp, resources) {
+  const byId = new Map(resources.map((resource) => [resource.id, resource]));
+  for (const operation of ACP_CHECKOUT_OPERATIONS) {
+    const resourceId = acp.checkout.operations[operation];
+    const path2 = `protocols.acp.checkout.operations.${operation}`;
+    const resource = byId.get(resourceId);
+    if (resource === void 0) {
+      throw acpInvalid(
+        path2,
+        `${path2} maps resource "${resourceId}", which is not defined under "resources"`,
+        { resourceId }
+      );
+    }
+    if (!resource.exposedVia.includes("acp")) {
+      throw acpInvalid(
+        path2,
+        `Resource "${resourceId}" implements ACP operation "${operation}" but does not list "acp" in its expose - the mapping says which resource serves the operation, expose says ACP may invoke it, and both are required`,
+        { resourceId }
+      );
+    }
+    if (resource.pricing.type !== "free" || resource.paymentMethods.length > 0) {
+      throw acpInvalid(
+        path2,
+        `Resource "${resourceId}" implements ACP operation "${operation}" and must use pricing.type "free" with no "payments" - ACP checkout carries the merchant's own purchase payment, so the gateway does not also charge for the invocation`,
+        { resourceId }
+      );
+    }
+    validateAcpOperationInput(path2, operation, resource);
+  }
+}
+function validateAcpOperationInput(path2, operation, resource) {
+  const schema = resource.inputSchema;
+  if (schema === void 0) return;
+  const keys = ACP_OPERATION_INPUT_KEYS[operation];
+  const properties = schema["properties"];
+  if (schema["additionalProperties"] === false && isPlainObject2(properties)) {
+    for (const key of keys) {
+      if (!Object.hasOwn(properties, key)) {
+        throw acpInvalid(
+          path2,
+          `Resource "${resource.id}" implements ACP operation "${operation}" but its input schema sets additionalProperties: false without declaring "${key}", which the adapter always sends for this operation`,
+          { resourceId: resource.id }
+        );
+      }
+    }
+  }
+  const required = schema["required"];
+  if (Array.isArray(required)) {
+    for (const entry of required) {
+      if (typeof entry === "string" && !keys.includes(entry)) {
+        throw acpInvalid(
+          path2,
+          `Resource "${resource.id}" implements ACP operation "${operation}" but its input schema requires "${entry}", which that operation never supplies (it sends: ${keys.join(", ")})`,
+          { resourceId: resource.id }
+        );
+      }
+    }
+  }
+}
+function normaliseResource(id, entry, protocols, x402, ap2) {
   if (entry.input !== void 0) validateResourceSchemaKeywords(id, "input", entry.input);
   const inputProperties = entry.input?.["properties"];
-  if (inputProperties && typeof inputProperties === "object" && PAYMENT_INPUT_FIELD in inputProperties) {
-    throw new CommerceError(
-      "CONFIG_INVALID",
-      `Resource "${id}" declares an input property "${PAYMENT_INPUT_FIELD}", which is reserved for payment proofs`,
-      {
-        details: {
-          path: `resources.${id}.input.properties.${PAYMENT_INPUT_FIELD}`,
-          resourceId: id
+  if (inputProperties && typeof inputProperties === "object") {
+    for (const reserved of RESERVED_INPUT_FIELDS) {
+      if (!(reserved in inputProperties)) continue;
+      throw new CommerceError(
+        "CONFIG_INVALID",
+        `Resource "${id}" declares an input property "${reserved}", which is reserved by the gateway`,
+        {
+          details: {
+            path: `resources.${id}.input.properties.${reserved}`,
+            resourceId: id
+          }
         }
-      }
-    );
+      );
+    }
   }
   for (const protocol of entry.expose) {
     if (!SUPPORTED_PROTOCOLS.has(protocol)) {
       const hint = protocol === "ucp" ? " (UCP is planned, not supported in this release)" : "";
       throw new CommerceError(
         "CONFIG_INVALID",
-        `Resource "${id}" exposes unsupported protocol "${protocol}"${hint}. Supported: http, mcp, a2a.`,
+        `Resource "${id}" exposes unsupported protocol "${protocol}"${hint}. Supported: ${PROTOCOL_NAMES.join(", ")}.`,
         { details: { path: `resources.${id}.expose`, resourceId: id, protocol } }
       );
     }
@@ -835,6 +1232,13 @@ function normaliseResource(id, entry, protocols, x402) {
       { details: { path: `resources.${id}.expose`, resourceId: id } }
     );
   }
+  if (entry.expose.includes("acp") && !protocols.acp.enabled) {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      `Resource "${id}" is exposed via "acp" but protocols.acp.enabled is false`,
+      { details: { path: `resources.${id}.expose`, resourceId: id } }
+    );
+  }
   if (entry.expose.includes("http") && !protocols.http.enabled) {
     throw new CommerceError(
       "CONFIG_INVALID",
@@ -882,6 +1286,7 @@ function normaliseResource(id, entry, protocols, x402) {
     }
   }
   const pricing = entry.pricing.type === "free" ? { type: "free" } : { type: "fixed", amount: entry.pricing.amount, currency: entry.pricing.currency };
+  const authorization = normaliseResourceAuthorization(id, entry, pricing, ap2);
   return {
     id,
     name: entry.name,
@@ -902,7 +1307,8 @@ function normaliseResource(id, entry, protocols, x402) {
     },
     pricing,
     exposedVia: entry.expose,
-    paymentMethods
+    paymentMethods,
+    ...authorization !== void 0 ? { authorization } : {}
   };
 }
 function defaultClosedObjectSchema(schema) {
@@ -1052,11 +1458,8 @@ function validateInputBindings(id, backend, input) {
     Array.isArray(input?.["required"]) ? input["required"].filter((value) => typeof value === "string") : []
   );
   for (const [location, property] of entries) {
-    if (property === PAYMENT_INPUT_FIELD) {
-      fail(
-        `binds "${location}" to "${PAYMENT_INPUT_FIELD}", which is reserved for payment proofs`,
-        { location }
-      );
+    if (RESERVED_INPUT_FIELDS.includes(property)) {
+      fail(`binds "${location}" to "${property}", which is reserved by the gateway`, { location });
     }
     const other = seen.get(property);
     if (other !== void 0) {
@@ -1185,12 +1588,14 @@ function validateAddress(path2, value) {
     );
   }
 }
-var SUPPORTED_CONFIG_VERSION, ADDRESS_PATTERN, ZERO_ADDRESS_PATTERN, MCP_TOOL_NAME_PATTERN, NumberOrString, BooleanOrString, MerchantSchema, ServerSchema, StorageSchema, RESERVED_GATEWAY_PATHS, MountPathSchema, ProtocolsSchema, DEFAULT_A2A_MOUNT_PATH, BackendMethodSchema, BackendInputBindingsSchema, BackendHandlerSchema, PricingSchema, JsonSchemaValueSchema, ResourceEntrySchema, ResourcesMapSchema, FacilitatorAuthSchema, FacilitatorSchema, X402Schema, PaymentsSchema, RawConfigSchema, SUPPORTED_PROTOCOLS, SUPPORTED_PAYMENT_METHODS, EMPTY_CLOSED_OBJECT_SCHEMA, UNSUPPORTED_SCHEMA_KEYWORDS, PRICING_AMOUNT_PATTERN, ZERO_AMOUNT_PATTERN;
+var SUPPORTED_CONFIG_VERSION, ADDRESS_PATTERN, ZERO_ADDRESS_PATTERN, MCP_TOOL_NAME_PATTERN, NumberOrString, BooleanOrString, MerchantSchema, ServerSchema, StorageSchema, RESERVED_GATEWAY_PATHS, MountPathSchema, AcpAuthSchema, AcpIdempotencySchema, AcpCheckoutSchema, AcpDiscoverySchema, ProtocolsSchema, DEFAULT_A2A_MOUNT_PATH, DEFAULT_ACP_MOUNT_PATH, ACP_RETENTION_HOURS, BackendMethodSchema, BackendInputBindingsSchema, BackendHandlerSchema, PricingSchema, JsonSchemaValueSchema, ResourceEntrySchema, ResourcesMapSchema, FacilitatorAuthSchema, FacilitatorSchema, X402Schema, PaymentsSchema, Ap2KeySchema, Ap2IssuerSchema, Ap2Schema, AuthorizationSchema, RawConfigSchema, SUPPORTED_PROTOCOLS, SUPPORTED_PAYMENT_METHODS, SUPPORTED_AUTHORIZATION_METHODS, EMPTY_CLOSED_OBJECT_SCHEMA, UNSUPPORTED_SCHEMA_KEYWORDS, PRICING_AMOUNT_PATTERN, ZERO_AMOUNT_PATTERN;
 var init_schema = __esm({
   "src/config/schema.ts"() {
+    init_constants();
     init_execution();
     init_core();
     init_guardrails();
+    init_constants2();
     init_env();
     SUPPORTED_CONFIG_VERSION = 1;
     ADDRESS_PATTERN = /^0x[0-9a-fA-F]{40}$/;
@@ -1235,6 +1640,8 @@ var init_schema = __esm({
       // Fixed by the A2A specification, so it is the adapter's to serve and never
       // a configurable mount's to claim.
       "/.well-known/agent-card.json",
+      // Likewise fixed by the ACP specification.
+      ACP_WELL_KNOWN_PATH,
       "/api/resources",
       "/api/resources/:id/invoke",
       "/api/receipts",
@@ -1256,6 +1663,15 @@ var init_schema = __esm({
         message: `must not collide with a route the gateway already serves (${RESERVED_GATEWAY_PATHS.join(", ")}); pick a dedicated prefix such as "/mcp".`
       }
     );
+    AcpAuthSchema = z.object({ type: z.literal("bearer"), token: z.string().min(1) }).strict();
+    AcpIdempotencySchema = z.object({ path: z.string().min(1), retentionHours: NumberOrString.optional() }).strict();
+    AcpCheckoutSchema = z.object({ operations: z.record(z.string().min(1)) }).strict();
+    AcpDiscoverySchema = z.object({
+      documentationUrl: z.string().min(1).optional(),
+      supportedCurrencies: z.array(z.string().min(1)).optional(),
+      supportedLocales: z.array(z.string().min(1)).optional(),
+      interventionTypes: z.array(z.string().min(1)).optional()
+    }).strict();
     ProtocolsSchema = z.object({
       http: z.object({ enabled: BooleanOrString }).strict(),
       mcp: z.object({
@@ -1267,9 +1683,23 @@ var init_schema = __esm({
       a2a: z.object({
         enabled: BooleanOrString,
         mountPath: MountPathSchema.optional()
+      }).strict().optional(),
+      // Likewise optional and off by default. The sub-blocks are optional here
+      // and required by the business pass only when ACP is enabled, so a
+      // disabled placeholder block stays writable and an enabled one gets a
+      // message naming the piece it is missing.
+      acp: z.object({
+        enabled: BooleanOrString,
+        mountPath: MountPathSchema.optional(),
+        auth: AcpAuthSchema.optional(),
+        idempotency: AcpIdempotencySchema.optional(),
+        checkout: AcpCheckoutSchema.optional(),
+        discovery: AcpDiscoverySchema.optional()
       }).strict().optional()
     }).strict();
     DEFAULT_A2A_MOUNT_PATH = "/a2a";
+    DEFAULT_ACP_MOUNT_PATH = "/acp";
+    ACP_RETENTION_HOURS = 24;
     BackendMethodSchema = z.enum(["GET", "POST", "PUT", "PATCH", "DELETE"]);
     BackendInputBindingsSchema = z.object({
       path: z.string().min(1).optional(),
@@ -1305,7 +1735,8 @@ var init_schema = __esm({
       backend: BackendHandlerSchema,
       pricing: PricingSchema,
       expose: z.array(z.string().min(1)).min(1),
-      payments: z.array(z.string().min(1)).optional()
+      payments: z.array(z.string().min(1)).optional(),
+      authorization: z.object({ required: z.array(z.string().min(1)).min(1) }).strict().optional()
     }).strict();
     ResourcesMapSchema = z.record(z.string().min(1), ResourceEntrySchema);
     FacilitatorAuthSchema = z.discriminatedUnion("type", [
@@ -1353,6 +1784,32 @@ var init_schema = __esm({
     PaymentsSchema = z.object({
       x402: X402Schema.optional()
     }).strict();
+    Ap2KeySchema = z.object({
+      kid: z.string().min(1),
+      jwk: z.record(z.string(), z.unknown())
+    }).strict();
+    Ap2IssuerSchema = z.object({
+      issuer: z.string().min(1),
+      /**
+       * Required, not defaulted. Without it, a mandate minted for another
+       * merchant would verify here, and there is no value worth guessing for
+       * something that decides that.
+       */
+      audience: z.string().min(1),
+      keys: z.array(Ap2KeySchema).min(1)
+    }).strict();
+    Ap2Schema = z.object({
+      enabled: BooleanOrString,
+      specVersion: z.string().min(1).optional(),
+      mode: z.string().min(1).optional(),
+      trust: z.object({
+        mandateIssuers: z.array(Ap2IssuerSchema).optional(),
+        checkoutIssuers: z.array(Ap2IssuerSchema).optional()
+      }).strict().optional(),
+      clockSkewSeconds: NumberOrString.optional(),
+      replay: z.object({ path: z.string().min(1) }).strict().optional()
+    }).strict();
+    AuthorizationSchema = z.object({ ap2: Ap2Schema.optional() }).strict();
     RawConfigSchema = z.object({
       version: z.literal(SUPPORTED_CONFIG_VERSION),
       merchant: MerchantSchema,
@@ -1360,10 +1817,12 @@ var init_schema = __esm({
       storage: StorageSchema,
       protocols: ProtocolsSchema,
       resources: ResourcesMapSchema,
-      payments: PaymentsSchema
+      payments: PaymentsSchema,
+      authorization: AuthorizationSchema.optional()
     }).strict();
     SUPPORTED_PROTOCOLS = new Set(PROTOCOL_NAMES);
     SUPPORTED_PAYMENT_METHODS = /* @__PURE__ */ new Set(["x402"]);
+    SUPPORTED_AUTHORIZATION_METHODS = /* @__PURE__ */ new Set(["ap2"]);
     EMPTY_CLOSED_OBJECT_SCHEMA = {
       type: "object",
       properties: {},
@@ -1547,6 +2006,33 @@ async function execCommand(command, args) {
   });
 }
 
+// src/cli/commands/doctor.ts
+init_constants();
+
+// src/authorization/ap2/descriptor.ts
+init_constants();
+var AP2_UNSUPPORTED = [
+  // Mandate kinds. Open mandates carry spending constraints nothing here
+  // evaluates, so accepting one would tell a buyer their limits were checked.
+  "autonomous mode",
+  "open checkout mandates (mandate.checkout.open.1)",
+  "intent mandates",
+  "cart mandates",
+  "spending constraint evaluation",
+  "cnf-bound agent keys",
+  // Key handling. Every key is written into config by an operator
+  "JWKS and any key discovery by URL (jku, x5u)",
+  "issuer metadata fetching",
+  "key rotation without a config change",
+  // Algorithms
+  "signature algorithms other than ES256",
+  "digest algorithms other than sha-256",
+  // Roles this gateway does not play
+  "mandate issuance",
+  "merchant checkout JWT issuance",
+  "AP2 over the ACP checkout adapter"
+];
+
 // src/cli/commands/doctor.ts
 init_execution();
 init_core();
@@ -1589,9 +2075,94 @@ var A2A_UNSUPPORTED = [
   "artifact types beyond Agent Commerce outcome data"
 ];
 
+// src/cli/commands/doctor.ts
+init_constants2();
+
+// src/protocols/acp/descriptor.ts
+init_constants2();
+[
+  "rest transport",
+  "well-known discovery",
+  "bearer authentication",
+  "API-Version negotiation",
+  "checkout service",
+  ...ACP_CHECKOUT_OPERATIONS
+];
+var ACP_UNSUPPORTED = [
+  // Services this seller does not implement, named as ACP names them. The
+  // discovery document advertises `checkout` alone, and these are the reason.
+  "carts service",
+  "feed service",
+  "standalone orders service",
+  "delegate_payment",
+  "delegate_authentication",
+  // Bindings and delivery directions.
+  "ACP MCP transport binding",
+  "webhooks",
+  "outbound merchant-to-agent delivery",
+  "ACP client role",
+  // Request authentication beyond the bearer token.
+  "Signature header verification",
+  "Timestamp replay-window verification",
+  // Extensions and versioning.
+  "discount extension",
+  "general ACP extension framework",
+  "multiple ACP API versions",
+  "seller-backed payment handler integration"
+];
+
 // src/storage/receipts/store.ts
 init_core();
-var PACKAGE_VERSION = "1.2.0" ;
+var PACKAGE_VERSION = "1.4.0" ;
+
+// src/storage/sqlite.ts
+init_core();
+function openSqliteDatabase(options) {
+  const { path: path2, label, logger } = options;
+  const isFileBacked = path2 !== ":memory:";
+  if (isFileBacked) {
+    const dir = dirname(path2);
+    if (dir !== "" && dir !== "." && !existsSync(dir)) {
+      mkdirSync(dir, { recursive: true, mode: 448 });
+    }
+  }
+  if (isFileBacked && existsSync(path2)) {
+    try {
+      accessSync(path2, constants.W_OK);
+    } catch {
+      throw new CommerceError(
+        "STORAGE_ERROR",
+        `${label} "${path2}" exists but is not writable by this process (uid ${typeof process.getuid === "function" ? process.getuid() : "unknown"}). If this is a container that recently changed user, an existing volume may still be owned by the previous one - recreate it (docker compose down -v) or fix its ownership.`,
+        { details: { path: path2 } }
+      );
+    }
+  }
+  if (isFileBacked) {
+    try {
+      closeSync(openSync(path2, "a", 384));
+    } catch {
+    }
+  }
+  const db = new Database(path2);
+  db.pragma("journal_mode = WAL");
+  db.pragma("foreign_keys = ON");
+  if (isFileBacked) restrictDatabasePermissions(path2, label, logger);
+  return db;
+}
+function restrictDatabasePermissions(path2, label, logger) {
+  for (const file of [path2, `${path2}-wal`, `${path2}-shm`]) {
+    try {
+      chmodSync(file, 384);
+    } catch (error) {
+      const code = error.code;
+      if (code === "ENOENT") continue;
+      logger.warn(
+        { file, label, error: code ?? "unknown" },
+        "could not restrict database permissions to owner-only"
+      );
+    }
+  }
+}
 
 // src/storage/receipts/redact.ts
 var SECRET_KEY_PATTERN = /private[-_ ]?key|secret|password|mnemonic|seed[-_ ]?phrase|api[-_ ]?key|authoriz(e|ation)|^auth$|auth[-_]?header|payment[-_ ]?proof|^proof$|x-payment|signature|signed[-_ ]?message|token|bearer|credential|cookie|session|jwt/i;
@@ -1627,12 +2198,14 @@ function receiptToRow(receipt) {
     backend_status: receipt.backendStatus,
     duration_ms: receipt.durationMs !== void 0 ? receipt.durationMs : null,
     protocol: receipt.protocol !== void 0 ? receipt.protocol : null,
-    metadata_json: receipt.metadata !== void 0 ? JSON.stringify(redact(receipt.metadata)) : null
+    metadata_json: receipt.metadata !== void 0 ? JSON.stringify(redact(receipt.metadata)) : null,
+    authorization_json: receipt.authorization !== void 0 ? JSON.stringify(redact(receipt.authorization)) : null
   };
 }
 function rowToReceipt(row) {
   const payment = row.payment_json !== null ? JSON.parse(row.payment_json) : void 0;
   const metadata = row.metadata_json !== null ? JSON.parse(row.metadata_json) : void 0;
+  const authorization = row.authorization_json !== null ? JSON.parse(row.authorization_json) : void 0;
   return {
     id: row.id,
     requestId: row.request_id,
@@ -1642,7 +2215,8 @@ function rowToReceipt(row) {
     ...payment !== void 0 ? { payment } : {},
     ...row.duration_ms !== null ? { durationMs: row.duration_ms } : {},
     ...row.protocol !== null ? { protocol: row.protocol } : {},
-    ...metadata !== void 0 ? { metadata } : {}
+    ...metadata !== void 0 ? { metadata } : {},
+    ...authorization !== void 0 ? { authorization } : {}
   };
 }
 function eventToRow(event) {
@@ -1751,6 +2325,12 @@ var MIGRATIONS = [
         CREATE INDEX IF NOT EXISTS idx_payment_attempts_created_at ON payment_attempts(created_at);
       `);
     }
+  },
+  {
+    version: 2,
+    up(db) {
+      db.exec(`ALTER TABLE receipts ADD COLUMN authorization_json TEXT;`);
+    }
   }
 ];
 var SCHEMA_VERSION = MIGRATIONS[MIGRATIONS.length - 1]?.version ?? 0;
@@ -1779,57 +2359,17 @@ var defaultIds = {
 function isUniqueConstraintOn(err, column) {
   return err instanceof Error && "code" in err && err.code === "SQLITE_CONSTRAINT_UNIQUE" && err.message.includes(column);
 }
-function restrictDatabasePermissions(path2, logger) {
-  for (const file of [path2, `${path2}-wal`, `${path2}-shm`]) {
-    try {
-      chmodSync(file, 384);
-    } catch (error) {
-      const code = error.code;
-      if (code === "ENOENT") continue;
-      logger.warn(
-        { file, error: code ?? "unknown" },
-        "could not restrict receipt database permissions to owner-only"
-      );
-    }
-  }
-}
 function createSqliteReceiptStore(options) {
   const logger = options.logger ?? NOOP_LOGGER;
   const clock = options.clock ?? systemClock;
   const ids = options.ids ?? defaultIds;
   const path2 = options.path;
   const isFileBacked = path2 !== ":memory:";
-  if (isFileBacked) {
-    const dir = dirname(path2);
-    if (dir !== "" && dir !== "." && !existsSync(dir)) {
-      mkdirSync(dir, { recursive: true, mode: 448 });
-    }
-  }
-  if (isFileBacked && existsSync(path2)) {
-    try {
-      accessSync(path2, constants.W_OK);
-    } catch {
-      throw new CommerceError(
-        "STORAGE_ERROR",
-        `Receipt database "${path2}" exists but is not writable by this process (uid ${typeof process.getuid === "function" ? process.getuid() : "unknown"}). If this is a container that recently changed user, an existing volume may still be owned by the previous one \u2014 recreate it (docker compose down -v) or fix its ownership.`,
-        { details: { path: path2 } }
-      );
-    }
-  }
-  if (isFileBacked) {
-    try {
-      closeSync(openSync(path2, "a", 384));
-    } catch {
-    }
-  }
-  const db = new Database(path2);
-  db.pragma("journal_mode = WAL");
-  db.pragma("foreign_keys = ON");
+  const db = openSqliteDatabase({ path: path2, label: "Receipt database", logger });
   migrate(db);
-  if (isFileBacked) restrictDatabasePermissions(path2, logger);
   const insertReceiptStmt = db.prepare(
-    `INSERT INTO receipts (id, request_id, resource_id, payment_json, delivered_at, backend_status, duration_ms, protocol, metadata_json)
-     VALUES (@id, @request_id, @resource_id, @payment_json, @delivered_at, @backend_status, @duration_ms, @protocol, @metadata_json)`
+    `INSERT INTO receipts (id, request_id, resource_id, payment_json, delivered_at, backend_status, duration_ms, protocol, metadata_json, authorization_json)
+     VALUES (@id, @request_id, @resource_id, @payment_json, @delivered_at, @backend_status, @duration_ms, @protocol, @metadata_json, @authorization_json)`
   );
   const getReceiptStmt = db.prepare("SELECT * FROM receipts WHERE id = ?");
   const listReceiptsStmt = db.prepare(
@@ -2344,7 +2884,7 @@ function maskMiddle(value, keep = 6) {
 }
 createRequire(import.meta.url);
 function readVersionReport() {
-  const injected = '{"cliVersion":"1.2.0","pinned":[{"name":"@coinbase/x402","version":"2.1.0","via":"@devlab.group/agent-commerce"},{"name":"@modelcontextprotocol/sdk","version":"1.30.0","via":"@devlab.group/agent-commerce"},{"name":"@x402/core","version":"2.23.0","via":"@devlab.group/agent-commerce"},{"name":"@x402/evm","version":"2.23.0","via":"@devlab.group/agent-commerce"},{"name":"viem","version":"2.55.18","via":"@devlab.group/agent-commerce"},{"name":"better-sqlite3","version":"13.0.3","via":"@devlab.group/agent-commerce"},{"name":"fastify","version":"5.12.0","via":"@devlab.group/agent-commerce"},{"name":"pino","version":"10.3.1","via":"@devlab.group/agent-commerce"},{"name":"zod","version":"3.25.76","via":"@devlab.group/agent-commerce"}]}' ;
+  const injected = '{"cliVersion":"1.4.0","pinned":[{"name":"@coinbase/x402","version":"2.1.0","via":"@devlab.group/agent-commerce"},{"name":"@modelcontextprotocol/sdk","version":"1.30.0","via":"@devlab.group/agent-commerce"},{"name":"@x402/core","version":"2.23.0","via":"@devlab.group/agent-commerce"},{"name":"@x402/evm","version":"2.23.0","via":"@devlab.group/agent-commerce"},{"name":"viem","version":"2.55.18","via":"@devlab.group/agent-commerce"},{"name":"better-sqlite3","version":"13.0.3","via":"@devlab.group/agent-commerce"},{"name":"fastify","version":"5.12.0","via":"@devlab.group/agent-commerce"},{"name":"pino","version":"10.3.1","via":"@devlab.group/agent-commerce"},{"name":"zod","version":"3.25.76","via":"@devlab.group/agent-commerce"}]}' ;
   {
     return JSON.parse(injected);
   }
@@ -2406,6 +2946,112 @@ function findX402Mismatch(configured, live) {
   if (diffs.length === 0) return void 0;
   return `${diffs.join("; ")} \u2014 the gateway may be running against an older deployment; restart it or re-run chain:deploy`;
 }
+function describeIssuers(label, issuers) {
+  const described = issuers.map(
+    (entry) => `${entry.issuer} (${entry.keys.length} key${entry.keys.length === 1 ? "" : "s"})`
+  ).join(", ");
+  return `${label} issuers: ${described}`;
+}
+function isWritableFile(path2) {
+  try {
+    accessSync(path2, constants.W_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function ap2ReplayCheck(path2) {
+  const name = "AP2 replay store";
+  if (path2 === ":memory:") {
+    return {
+      name,
+      status: "WARN",
+      detail: "in-memory store - every spent mandate is forgotten on restart, so one could authorize a second purchase; use a file path in production"
+    };
+  }
+  if (existsSync(path2)) {
+    return isWritableFile(path2) ? { name, status: "PASS", detail: `writable at "${path2}"` } : {
+      name,
+      status: "FAIL",
+      detail: `"${path2}" exists but is not writable by this user - no mandate could be recorded as spent`
+    };
+  }
+  const directory = dirname(path2);
+  if (directory !== "" && directory !== "." && !existsSync(directory)) {
+    return {
+      name,
+      status: "WARN",
+      detail: `no store yet at "${path2}" and its directory does not exist - it is created when the gateway starts, provided that path is writable`
+    };
+  }
+  return {
+    name,
+    status: "WARN",
+    detail: `no store yet at "${path2}" - it is created the first time the gateway starts`
+  };
+}
+function acpIdempotencyCheck(idempotency) {
+  const retention = `retention ${idempotency.retentionHours}h`;
+  if (idempotency.retentionHours < 24) {
+    return {
+      name: "ACP idempotency",
+      status: "FAIL",
+      detail: `${retention} is below the 24h ACP minimum \u2014 a replayed key could run a checkout twice`
+    };
+  }
+  if (idempotency.path === ":memory:") {
+    return {
+      name: "ACP idempotency",
+      status: "WARN",
+      detail: `in-memory store, ${retention} \u2014 replay protection is lost on every restart; use a file path in production`
+    };
+  }
+  const directory = dirname(idempotency.path);
+  if (existsSync(idempotency.path)) {
+    return isWritableFile(idempotency.path) ? { name: "ACP idempotency", status: "PASS", detail: `writable, ${retention}` } : {
+      name: "ACP idempotency",
+      status: "FAIL",
+      detail: `"${idempotency.path}" exists but is not writable by this user \u2014 the adapter cannot claim idempotency keys`
+    };
+  }
+  if (directory !== "" && directory !== "." && !existsSync(directory)) {
+    return {
+      name: "ACP idempotency",
+      status: "WARN",
+      detail: `no store yet at "${idempotency.path}" and its directory does not exist \u2014 it is created when the gateway starts, provided that path is writable`
+    };
+  }
+  return {
+    name: "ACP idempotency",
+    status: "WARN",
+    detail: `no store yet at "${idempotency.path}" \u2014 it is created the first time the gateway starts (${retention})`
+  };
+}
+function acpMappingCheck(config, operations) {
+  const byId = new Map(config.resources.map((resource) => [resource.id, resource]));
+  const problems = [];
+  for (const [operation, resourceId] of Object.entries(operations)) {
+    const resource = byId.get(resourceId);
+    if (resource === void 0) {
+      problems.push(`${operation} -> "${resourceId}" does not exist`);
+      continue;
+    }
+    if (!resource.exposedVia.includes("acp")) {
+      problems.push(`${operation} -> "${resourceId}" is not exposed via acp`);
+    }
+    if (resource.pricing.type !== "free" || resource.paymentMethods.length > 0) {
+      problems.push(`${operation} -> "${resourceId}" is not free to invoke`);
+    }
+  }
+  if (problems.length > 0) {
+    return { name: "ACP checkout mapping", status: "FAIL", detail: problems.join("; ") };
+  }
+  return {
+    name: "ACP checkout mapping",
+    status: "PASS",
+    detail: `5 operations mapped to free acp-exposed resources (${Object.values(operations).join(", ")})`
+  };
+}
 async function runDoctor(options, deps = {}) {
   const fetchImpl = deps.fetchImpl ?? globalThis.fetch;
   const loadConfig2 = deps.loadConfig ?? loadConfigDynamic;
@@ -2487,7 +3133,7 @@ async function runDoctor(options, deps = {}) {
     checks.push({
       name: "Protocols",
       status: "PASS",
-      detail: `http=${config.protocols.http.enabled ? "on" : "off"} mcp=${config.protocols.mcp.enabled ? `on (${mcpMountPath})` : "off"} a2a=${config.protocols.a2a.enabled ? `on (${a2aMountPath})` : "off"}`
+      detail: `http=${config.protocols.http.enabled ? "on" : "off"} mcp=${config.protocols.mcp.enabled ? `on (${mcpMountPath})` : "off"} a2a=${config.protocols.a2a.enabled ? `on (${a2aMountPath})` : "off"} acp=${config.protocols.acp.enabled ? `on (${config.protocols.acp.mountPath})` : "off"}`
     });
   }
   if (config === void 0) {
@@ -2506,6 +3152,61 @@ async function runDoctor(options, deps = {}) {
       detail: A2A_UNSUPPORTED.join(", ")
     });
   }
+  if (config === void 0) {
+    checks.push({ name: "ACP", status: "WARN", detail: "skipped \u2014 config invalid" });
+  } else if (!config.protocols.acp.enabled) {
+    checks.push({ name: "ACP", status: "INFO", detail: "disabled" });
+  } else {
+    const acp = config.protocols.acp;
+    checks.push({
+      name: "ACP",
+      status: "PASS",
+      detail: `experimental \xB7 spec ${ACP_SPEC_VERSION} \xB7 API-Version ${ACP_API_VERSION} \xB7 service checkout \xB7 mount ${acp.mountPath} \xB7 discovery ${ACP_WELL_KNOWN_PATH}`
+    });
+    checks.push({
+      name: "ACP auth",
+      status: "PASS",
+      detail: `bearer token configured (${acp.auth.token.length} characters, not shown)`
+    });
+    checks.push(acpIdempotencyCheck(acp.idempotency));
+    checks.push(acpMappingCheck(config, acp.checkout.operations));
+    checks.push({
+      name: "ACP unsupported",
+      status: "INFO",
+      detail: ACP_UNSUPPORTED.join(", ")
+    });
+  }
+  const ap2 = config?.authorization?.ap2;
+  if (config === void 0) {
+    checks.push({ name: "AP2", status: "WARN", detail: "skipped \u2014 config invalid" });
+  } else if (ap2 === void 0 || !ap2.enabled) {
+    checks.push({ name: "AP2", status: "INFO", detail: "disabled" });
+  } else {
+    checks.push({
+      name: "AP2",
+      status: "PASS",
+      detail: `experimental \xB7 spec ${AP2_SPEC_VERSION} \xB7 mode ${ap2.mode} \xB7 ${AP2_CHECKOUT_MANDATE_VCT} \xB7 profile ${AP2_CHECKOUT_PROFILE} \xB7 clock skew ${ap2.clockSkewSeconds}s`
+    });
+    checks.push({
+      name: "AP2 trust",
+      status: "PASS",
+      detail: `${describeIssuers("mandate", ap2.trust.mandateIssuers)} \xB7 ${describeIssuers("checkout", ap2.trust.checkoutIssuers)}`
+    });
+    checks.push(ap2ReplayCheck(ap2.replay.path));
+    const gated = config.resources.filter(
+      (resource) => resource.authorization?.required.includes("ap2")
+    );
+    checks.push({
+      name: "AP2 resources",
+      status: gated.length > 0 ? "PASS" : "WARN",
+      detail: gated.length > 0 ? gated.map((resource) => resource.id).join(", ") : "AP2 is enabled but no resource requires it \u2014 every purchase settles without a mandate"
+    });
+    checks.push({
+      name: "AP2 unsupported",
+      status: "INFO",
+      detail: AP2_UNSUPPORTED.join(", ")
+    });
+  }
   const x402 = config?.payments.x402;
   if (x402 === void 0 || !x402.enabled) {
     checks.push({ name: "Payments", status: "INFO", detail: "x402 not configured" });
@@ -3801,7 +4502,7 @@ async function runValidate(options, io, deps = {}) {
     io.stdout(`      merchant: ${config.merchant.name} (${config.merchant.id})`);
     io.stdout(`      resources: ${config.resources.length}`);
     io.stdout(
-      `      protocols: http=${config.protocols.http.enabled ? "on" : "off"} mcp=${config.protocols.mcp.enabled ? "on" : "off"} a2a=${config.protocols.a2a.enabled ? "on" : "off"}`
+      `      protocols: http=${config.protocols.http.enabled ? "on" : "off"} mcp=${config.protocols.mcp.enabled ? "on" : "off"} a2a=${config.protocols.a2a.enabled ? "on" : "off"} acp=${config.protocols.acp.enabled ? "on" : "off"}`
     );
     io.stdout(`      payments: x402=${config.payments.x402?.enabled === true ? "on" : "off"}`);
     return 0;