@devlab.group/agent-commerce 1.4.0 → 1.5.0

package/dist/cli/index.js

@@ -9,7 +9,7 @@ import picocolors from 'picocolors';
 import { randomUUID } from 'crypto';
 import { createRequire } from 'module';
 import Database from 'better-sqlite3';
-import { writeFile, stat, readFile, rename, rm } from 'fs/promises';
+import { writeFile, stat, rename, rm, open } from 'fs/promises';
 import { validate } from '@scalar/openapi-parser';
 import * as clack from '@clack/prompts';
 
@@ -32,10 +32,11 @@ var init_filename = __esm({
 });
 
 // src/core/domain/common.ts
-var PROTOCOL_NAMES;
+var PROTOCOL_NAMES, PAYMENT_METHOD_NAMES;
 var init_common = __esm({
   "src/core/domain/common.ts"() {
     PROTOCOL_NAMES = ["http", "mcp", "a2a", "acp"];
+    PAYMENT_METHOD_NAMES = ["x402", "mpp"];
   }
 });
 
@@ -312,6 +313,34 @@ var init_execution = __esm({
   }
 });
 
+// src/payments/mpp/constants.ts
+function isMppNetwork(value) {
+  return MPP_NETWORKS.includes(value);
+}
+var MPP_SPEC_COMMIT, MPP_SPEC_DRAFTS, MPP_MIN_CHALLENGE_SECRET_LENGTH, MPPX_VERSION, MPP_PROFILE, MPP_NETWORKS, MPP_DEFAULT_NETWORK;
+var init_constants2 = __esm({
+  "src/payments/mpp/constants.ts"() {
+    MPP_SPEC_COMMIT = "806fdb8b8c92cda5c84b8660558921b6bbeef7e0";
+    MPP_SPEC_DRAFTS = {
+      core: "draft-httpauth-payment-00",
+      intent: "draft-payment-intent-charge-00",
+      method: "draft-evm-charge-00"
+    };
+    MPP_MIN_CHALLENGE_SECRET_LENGTH = 32;
+    MPPX_VERSION = "0.10.1";
+    MPP_PROFILE = {
+      intent: "charge",
+      method: "evm",
+      credentialType: "authorization",
+      assetSymbol: "USDC",
+      assetDecimals: 6
+    };
+    MPP_NETWORKS = ["eip155:84532", "eip155:8453"];
+    MPP_DEFAULT_NETWORK = "eip155:84532";
+    `mpp/${MPP_SPEC_DRAFTS.core} intent=${MPP_PROFILE.intent} method=${MPP_PROFILE.method}`;
+  }
+});
+
 // src/payments/x402/networks.ts
 function findNetworkProfile(id) {
   return BY_ID.get(id);
@@ -372,7 +401,7 @@ var init_networks = __esm({
 
 // src/protocols/acp/constants.ts
 var ACP_SPEC_VERSION, ACP_API_VERSION, ACP_WELL_KNOWN_PATH, ACP_CHECKOUT_OPERATIONS, ACP_OPERATION_INPUT_KEYS;
-var init_constants2 = __esm({
+var init_constants3 = __esm({
   "src/protocols/acp/constants.ts"() {
     ACP_SPEC_VERSION = "2026-04-17";
     ACP_API_VERSION = "2026-04-17";
@@ -524,93 +553,95 @@ function invalid(message, path2) {
   return new CommerceError("CONFIG_INVALID", message, { details: { path: path2 } });
 }
 function resolveX402Deployment(input) {
-  const profile = requireNetworkProfile(input.network, "payments.x402.network");
+  const at = input.configPath ?? "payments.x402";
+  const payTo = input.payToField ?? "payTo";
+  const profile = requireNetworkProfile(input.network, `${at}.network`);
   const mode = resolveDeploymentMode(profile, input.facilitator.mode);
   if (profile.kind === "mainnet" && input.facilitator.mode === "local") {
     throw invalid(
-      `payments.x402: network "${profile.id}" (${profile.displayName}) is a mainnet and cannot be served by facilitator.mode "local". A mainnet deployment must settle through a remote facilitator.`,
-      "payments.x402.facilitator.mode"
+      `${at}: network "${profile.id}" (${profile.displayName}) is a mainnet and cannot be served by facilitator.mode "local". A mainnet deployment must settle through a remote facilitator.`,
+      `${at}.facilitator.mode`
     );
   }
   if (mode === "mainnet" && input.allowMainnet !== true) {
     throw invalid(
-      `payments.x402: network "${profile.id}" (${profile.displayName}) settles real funds. Set payments.x402.allowMainnet: true to acknowledge this explicitly \u2014 it is never the default.`,
-      "payments.x402.allowMainnet"
+      `${at}: network "${profile.id}" (${profile.displayName}) settles real funds. Set ${at}.allowMainnet: true to acknowledge this explicitly - it is never the default.`,
+      `${at}.allowMainnet`
     );
   }
   if (input.facilitator.mode === "remote") {
-    assertFacilitatorUrlIsSafe(input.facilitator.url, mode);
+    assertFacilitatorUrlIsSafe(input.facilitator.url, mode, at);
     if (mode === "mainnet" && input.facilitator.auth.type === "none" && input.allowUnauthenticatedFacilitator !== true) {
       throw invalid(
-        `payments.x402: facilitator ${describeOrigin(input.facilitator.url)} takes no credential, and this is a mainnet deployment. It will see every payment authorisation you handle, with no account, terms or support behind it. Set payments.x402.allowUnauthenticatedFacilitator: true to accept that, or configure facilitator.auth.`,
-        "payments.x402.allowUnauthenticatedFacilitator"
+        `${at}: facilitator ${describeOrigin(input.facilitator.url)} takes no credential, and this is a mainnet deployment. It will see every payment authorisation you handle, with no account, terms or support behind it. Set ${at}.allowUnauthenticatedFacilitator: true to accept that, or configure facilitator.auth.`,
+        `${at}.allowUnauthenticatedFacilitator`
       );
     }
     for (const [field, value] of credentialFields(input.facilitator.auth)) {
       if (value.trim() === "") {
         throw invalid(
-          `payments.x402: facilitator.auth.type is "${input.facilitator.auth.type}" but ${field} is empty. An empty credential is refused rather than sent.`,
-          `payments.x402.facilitator.auth.${field}`
+          `${at}: facilitator.auth.type is "${input.facilitator.auth.type}" but ${field} is empty. An empty credential is refused rather than sent.`,
+          `${at}.facilitator.auth.${field}`
         );
       }
     }
   }
   if (/^0x0{40}$/i.test(input.payTo)) {
     throw invalid(
-      'payments.x402: "payTo" is the zero address. Every payment settled there is destroyed.',
-      "payments.x402.payTo"
+      `${at}: "${payTo}" is the zero address. Every payment settled there is destroyed.`,
+      `${at}.${payTo}`
     );
   }
   if (mode !== "local" && isWellKnownDevAddress(input.payTo)) {
     throw invalid(
-      `payments.x402: "payTo" (${input.payTo}) is a well-known Anvil development address and this is a ${mode} deployment. Anyone can spend what settles there. Set payTo to your own merchant wallet.`,
-      "payments.x402.payTo"
+      `${at}: "${payTo}" (${input.payTo}) is a well-known Anvil development address and this is a ${mode} deployment. Anyone can spend what settles there. Set ${payTo} to your own merchant wallet.`,
+      `${at}.${payTo}`
     );
   }
   const canonical = profile.canonicalAsset;
   if (mode === "mainnet" && canonical) {
     if (!sameAddress(input.asset, canonical.address)) {
       throw invalid(
-        `payments.x402: asset ${input.asset} is not ${canonical.symbol} on ${profile.displayName} (expected ${canonical.address}). Settling a mainnet payment in an unintended token is refused.`,
-        "payments.x402.asset"
+        `${at}: asset ${input.asset} is not ${canonical.symbol} on ${profile.displayName} (expected ${canonical.address}). Settling a mainnet payment in an unintended token is refused.`,
+        `${at}.asset`
       );
     }
     if (input.assetName !== void 0 && input.assetName !== canonical.name) {
       throw invalid(
-        `payments.x402: assetName "${input.assetName}" is not the EIP-712 domain name ${canonical.symbol} reports on ${profile.displayName} (expected "${canonical.name}"). Every payment would be refused after the buyer signed.`,
-        "payments.x402.assetName"
+        `${at}: assetName "${input.assetName}" is not the EIP-712 domain name ${canonical.symbol} reports on ${profile.displayName} (expected "${canonical.name}"). Every payment would be refused after the buyer signed.`,
+        `${at}.assetName`
       );
     }
     if (input.assetVersion !== void 0 && input.assetVersion !== canonical.version) {
       throw invalid(
-        `payments.x402: assetVersion "${input.assetVersion}" is not the EIP-712 domain version ${canonical.symbol} reports on ${profile.displayName} (expected "${canonical.version}").`,
-        "payments.x402.assetVersion"
+        `${at}: assetVersion "${input.assetVersion}" is not the EIP-712 domain version ${canonical.symbol} reports on ${profile.displayName} (expected "${canonical.version}").`,
+        `${at}.assetVersion`
       );
     }
   }
   return { profile, mode };
 }
-function assertFacilitatorUrlIsSafe(url, mode) {
+function assertFacilitatorUrlIsSafe(url, mode, at) {
   let parsed;
   try {
     parsed = new URL(url);
   } catch (cause) {
-    throw new CommerceError("CONFIG_INVALID", `payments.x402: facilitator.url is not a valid URL`, {
+    throw new CommerceError("CONFIG_INVALID", `${at}: facilitator.url is not a valid URL`, {
       cause,
-      details: { path: "payments.x402.facilitator.url" }
+      details: { path: `${at}.facilitator.url` }
     });
   }
   if (parsed.protocol === "https:") return;
   if (parsed.protocol !== "http:") {
     throw invalid(
-      `payments.x402: facilitator ${describeOrigin(url)} must be reached over https (or http on a local/private host); got "${parsed.protocol}//"`,
-      "payments.x402.facilitator.url"
+      `${at}: facilitator ${describeOrigin(url)} must be reached over https (or http on a local/private host); got "${parsed.protocol}//"`,
+      `${at}.facilitator.url`
     );
   }
   if (mode !== "mainnet" && isLikelyLocalOrPrivateHost(parsed.hostname)) return;
   throw invalid(
-    `payments.x402: facilitator ${describeOrigin(url)} is reached over plain HTTP. Payment authorisations and settlement results would travel unencrypted. Use https, or point at a local/private host on a non-mainnet deployment.`,
-    "payments.x402.facilitator.url"
+    `${at}: facilitator ${describeOrigin(url)} is reached over plain HTTP. Payment authorisations and settlement results would travel unencrypted. Use https, or point at a local/private host on a non-mainnet deployment.`,
+    `${at}.facilitator.url`
   );
 }
 function describeOrigin(url) {
@@ -755,12 +786,7 @@ function normalise(raw) {
   };
   validateMountPaths(protocols);
   const x402Raw = raw.payments.x402;
-  const facilitator = x402Raw === void 0 ? void 0 : x402Raw.facilitator.mode === "local" ? { mode: "local", signerPrivateKey: x402Raw.facilitator.signerPrivateKey } : {
-    mode: "remote",
-    url: x402Raw.facilitator.url,
-    auth: x402Raw.facilitator.auth ?? { type: "none" }
-  };
-  const x402 = x402Raw && facilitator ? {
+  const x402 = x402Raw !== void 0 ? {
     enabled: toBoolean(x402Raw.enabled, "payments.x402.enabled"),
     network: x402Raw.network,
     rpcUrl: x402Raw.rpcUrl,
@@ -779,7 +805,7 @@ function normalise(raw) {
         min: 1
       }
     ),
-    facilitator,
+    facilitator: normaliseFacilitator(x402Raw.facilitator),
     ...x402Raw.allowMainnet !== void 0 ? { allowMainnet: toBoolean(x402Raw.allowMainnet, "payments.x402.allowMainnet") } : {},
     ...x402Raw.allowUnauthenticatedFacilitator !== void 0 ? {
       allowUnauthenticatedFacilitator: toBoolean(
@@ -802,12 +828,13 @@ function normalise(raw) {
       ...x402.allowUnauthenticatedFacilitator !== void 0 ? { allowUnauthenticatedFacilitator: x402.allowUnauthenticatedFacilitator } : {}
     });
   }
+  const mpp = normaliseMpp(raw.payments.mpp);
   const ap2 = normaliseAp2(raw.authorization?.ap2);
   if (ap2?.enabled) {
     validateReplayStoreIsolated(ap2.replay.path, raw.storage.receipts.path, protocols.acp);
   }
   const resources = Object.entries(raw.resources).map(
-    ([id, entry]) => normaliseResource(id, entry, protocols, x402, ap2)
+    ([id, entry]) => normaliseResource(id, entry, protocols, x402, mpp, ap2)
   );
   if (protocols.acp.enabled) validateAcpCheckoutMapping(protocols.acp, resources);
   return {
@@ -829,7 +856,8 @@ function normalise(raw) {
     protocols,
     resources,
     payments: {
-      ...x402 !== void 0 ? { x402 } : {}
+      ...x402 !== void 0 ? { x402 } : {},
+      ...mpp !== void 0 ? { mpp } : {}
     },
     ...ap2 !== void 0 ? { authorization: { ap2 } } : {}
   };
@@ -1181,7 +1209,74 @@ function validateAcpOperationInput(path2, operation, resource) {
     }
   }
 }
-function normaliseResource(id, entry, protocols, x402, ap2) {
+function normaliseFacilitator(raw) {
+  return raw.mode === "local" ? { mode: "local", signerPrivateKey: raw.signerPrivateKey } : { mode: "remote", url: raw.url, auth: raw.auth ?? { type: "none" } };
+}
+function normaliseMpp(raw) {
+  if (raw === void 0) return void 0;
+  const network = raw.network ?? MPP_DEFAULT_NETWORK;
+  if (!isMppNetwork(network)) {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      `payments.mpp.network must be one of ${MPP_NETWORKS.join(", ")}`,
+      { details: { path: "payments.mpp.network" } }
+    );
+  }
+  const mpp = {
+    enabled: toBoolean(raw.enabled, "payments.mpp.enabled"),
+    network,
+    rpcUrl: raw.rpcUrl,
+    asset: raw.asset,
+    assetName: raw.assetName,
+    assetVersion: raw.assetVersion,
+    recipient: raw.recipient,
+    realm: raw.realm,
+    challengeSecret: raw.challengeSecret,
+    ...raw.challengeTtlSeconds !== void 0 ? {
+      challengeTtlSeconds: toNumber(
+        raw.challengeTtlSeconds,
+        "payments.mpp.challengeTtlSeconds",
+        { min: 1 }
+      )
+    } : {},
+    facilitator: normaliseFacilitator(raw.facilitator),
+    ...raw.allowMainnet !== void 0 ? { allowMainnet: toBoolean(raw.allowMainnet, "payments.mpp.allowMainnet") } : {},
+    ...raw.allowUnauthenticatedFacilitator !== void 0 ? {
+      allowUnauthenticatedFacilitator: toBoolean(
+        raw.allowUnauthenticatedFacilitator,
+        "payments.mpp.allowUnauthenticatedFacilitator"
+      )
+    } : {}
+  };
+  validateAddress("payments.mpp.recipient", mpp.recipient);
+  validateAddress("payments.mpp.asset", mpp.asset);
+  if (/[\r\n]/.test(mpp.realm)) {
+    throw new CommerceError("CONFIG_INVALID", "payments.mpp.realm must be a single line", {
+      details: { path: "payments.mpp.realm" }
+    });
+  }
+  if (mpp.challengeSecret.length < MPP_MIN_CHALLENGE_SECRET_LENGTH) {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      `payments.mpp.challengeSecret must have length at least ${MPP_MIN_CHALLENGE_SECRET_LENGTH}`,
+      { details: { path: "payments.mpp.challengeSecret" } }
+    );
+  }
+  resolveX402Deployment({
+    network: mpp.network,
+    payTo: mpp.recipient,
+    asset: mpp.asset,
+    assetName: mpp.assetName,
+    assetVersion: mpp.assetVersion,
+    facilitator: mpp.facilitator,
+    ...mpp.allowMainnet !== void 0 ? { allowMainnet: mpp.allowMainnet } : {},
+    ...mpp.allowUnauthenticatedFacilitator !== void 0 ? { allowUnauthenticatedFacilitator: mpp.allowUnauthenticatedFacilitator } : {},
+    configPath: "payments.mpp",
+    payToField: "recipient"
+  });
+  return mpp;
+}
+function normaliseResource(id, entry, protocols, x402, mpp, ap2) {
   if (entry.input !== void 0) validateResourceSchemaKeywords(id, "input", entry.input);
   const inputProperties = entry.input?.["properties"];
   if (inputProperties && typeof inputProperties === "object") {
@@ -1257,7 +1352,7 @@ function normaliseResource(id, entry, protocols, x402, ap2) {
     );
   }
   if (entry.pricing.type === "fixed") {
-    validatePricingAmount(id, entry.pricing.amount, x402);
+    validatePricingAmount(id, entry.pricing.amount, x402?.assetDecimals);
   }
   const paymentMethods = entry.payments ?? [];
   if (entry.pricing.type === "fixed") {
@@ -1272,17 +1367,28 @@ function normaliseResource(id, entry, protocols, x402, ap2) {
       if (!SUPPORTED_PAYMENT_METHODS.has(method)) {
         throw new CommerceError(
           "CONFIG_INVALID",
-          `Resource "${id}" names unsupported payment method "${method}". Supported: x402.`,
+          `Resource "${id}" names unsupported payment method "${method}". Supported: ${PAYMENT_METHOD_NAMES.join(", ")}.`,
           { details: { path: `resources.${id}.payments`, resourceId: id, method } }
         );
       }
-      if (method === "x402" && (!x402 || !x402.enabled)) {
+    }
+    const enabledRails = [...x402?.enabled ? ["x402"] : [], ...mpp?.enabled ? ["mpp"] : []];
+    if (!paymentMethods.some((method) => enabledRails.includes(method))) {
+      throw new CommerceError(
+        "CONFIG_INVALID",
+        `Resource "${id}" names payment method(s) "${paymentMethods.join(", ")}", none of which is configured and enabled under "payments"`,
+        { details: { path: `resources.${id}.payments`, resourceId: id, paymentMethods } }
+      );
+    }
+    if (mpp?.enabled && paymentMethods.includes("mpp")) {
+      if (entry.pricing.currency !== MPP_PROFILE.assetSymbol) {
         throw new CommerceError(
           "CONFIG_INVALID",
-          `Resource "${id}" names payment method "x402" which is not configured or not enabled under payments.x402`,
-          { details: { path: `resources.${id}.payments`, resourceId: id, method } }
+          `Resource "${id}" is priced in ${entry.pricing.currency}, but MPP charges ${MPP_PROFILE.assetSymbol}`,
+          { details: { path: `resources.${id}.pricing.currency`, resourceId: id } }
         );
       }
+      validatePricingAmount(id, entry.pricing.amount, MPP_PROFILE.assetDecimals);
     }
   }
   const pricing = entry.pricing.type === "free" ? { type: "free" } : { type: "fixed", amount: entry.pricing.amount, currency: entry.pricing.currency };
@@ -1396,7 +1502,7 @@ function validateResourceSchemaKeywords(id, path2, schema) {
     );
   }
 }
-function validatePricingAmount(id, amount, x402) {
+function validatePricingAmount(id, amount, decimals) {
   const path2 = `resources.${id}.pricing.amount`;
   if (!PRICING_AMOUNT_PATTERN.test(amount)) {
     throw new CommerceError(
@@ -1412,12 +1518,12 @@ function validatePricingAmount(id, amount, x402) {
       { details: { path: path2, resourceId: id } }
     );
   }
-  if (x402 !== void 0) {
+  if (decimals !== void 0) {
     const fractionalDigits = amount.includes(".") ? amount.split(".")[1]?.length ?? 0 : 0;
-    if (fractionalDigits > x402.assetDecimals) {
+    if (fractionalDigits > decimals) {
       throw new CommerceError(
         "CONFIG_INVALID",
-        `Resource "${id}" has pricing.amount "${amount}" with more precision (${fractionalDigits} fractional digits) than the configured asset supports (${x402.assetDecimals} decimals)`,
+        `Resource "${id}" has pricing.amount "${amount}" with more precision (${fractionalDigits} fractional digits) than the configured asset supports (${decimals} decimals)`,
         { details: { path: path2, resourceId: id } }
       );
     }
@@ -1588,14 +1694,15 @@ function validateAddress(path2, value) {
     );
   }
 }
-var SUPPORTED_CONFIG_VERSION, ADDRESS_PATTERN, ZERO_ADDRESS_PATTERN, MCP_TOOL_NAME_PATTERN, NumberOrString, BooleanOrString, MerchantSchema, ServerSchema, StorageSchema, RESERVED_GATEWAY_PATHS, MountPathSchema, AcpAuthSchema, AcpIdempotencySchema, AcpCheckoutSchema, AcpDiscoverySchema, ProtocolsSchema, DEFAULT_A2A_MOUNT_PATH, DEFAULT_ACP_MOUNT_PATH, ACP_RETENTION_HOURS, BackendMethodSchema, BackendInputBindingsSchema, BackendHandlerSchema, PricingSchema, JsonSchemaValueSchema, ResourceEntrySchema, ResourcesMapSchema, FacilitatorAuthSchema, FacilitatorSchema, X402Schema, PaymentsSchema, Ap2KeySchema, Ap2IssuerSchema, Ap2Schema, AuthorizationSchema, RawConfigSchema, SUPPORTED_PROTOCOLS, SUPPORTED_PAYMENT_METHODS, SUPPORTED_AUTHORIZATION_METHODS, EMPTY_CLOSED_OBJECT_SCHEMA, UNSUPPORTED_SCHEMA_KEYWORDS, PRICING_AMOUNT_PATTERN, ZERO_AMOUNT_PATTERN;
+var SUPPORTED_CONFIG_VERSION, ADDRESS_PATTERN, ZERO_ADDRESS_PATTERN, MCP_TOOL_NAME_PATTERN, NumberOrString, BooleanOrString, MerchantSchema, ServerSchema, StorageSchema, RESERVED_GATEWAY_PATHS, MountPathSchema, AcpAuthSchema, AcpIdempotencySchema, AcpCheckoutSchema, AcpDiscoverySchema, ProtocolsSchema, DEFAULT_A2A_MOUNT_PATH, DEFAULT_ACP_MOUNT_PATH, ACP_RETENTION_HOURS, BackendMethodSchema, BackendInputBindingsSchema, BackendHandlerSchema, PricingSchema, JsonSchemaValueSchema, ResourceEntrySchema, ResourcesMapSchema, FacilitatorAuthSchema, FacilitatorSchema, X402Schema, MppSchema, PaymentsSchema, Ap2KeySchema, Ap2IssuerSchema, Ap2Schema, AuthorizationSchema, RawConfigSchema, SUPPORTED_PROTOCOLS, SUPPORTED_PAYMENT_METHODS, SUPPORTED_AUTHORIZATION_METHODS, EMPTY_CLOSED_OBJECT_SCHEMA, UNSUPPORTED_SCHEMA_KEYWORDS, PRICING_AMOUNT_PATTERN, ZERO_AMOUNT_PATTERN;
 var init_schema = __esm({
   "src/config/schema.ts"() {
     init_constants();
     init_execution();
     init_core();
-    init_guardrails();
     init_constants2();
+    init_guardrails();
+    init_constants3();
     init_env();
     SUPPORTED_CONFIG_VERSION = 1;
     ADDRESS_PATTERN = /^0x[0-9a-fA-F]{40}$/;
@@ -1781,8 +1888,26 @@ var init_schema = __esm({
       /** Accepts a mainnet facilitator that takes no credential. Never defaulted. */
       allowUnauthenticatedFacilitator: BooleanOrString.optional()
     }).strict();
+    MppSchema = z.object({
+      enabled: BooleanOrString,
+      network: z.string().min(1).optional(),
+      rpcUrl: z.string().min(1),
+      asset: z.string().min(1),
+      assetName: z.string().min(1),
+      assetVersion: z.string().min(1),
+      recipient: z.string().min(1),
+      realm: z.string().min(1),
+      challengeSecret: z.string().min(1),
+      challengeTtlSeconds: NumberOrString.optional(),
+      facilitator: FacilitatorSchema,
+      // Real funds. Never defaulted - see src/payments/x402/guardrails.ts
+      allowMainnet: BooleanOrString.optional(),
+      // Accepts a mainnet facilitator that takes no credential. Never defaulted
+      allowUnauthenticatedFacilitator: BooleanOrString.optional()
+    }).strict();
     PaymentsSchema = z.object({
-      x402: X402Schema.optional()
+      x402: X402Schema.optional(),
+      mpp: MppSchema.optional()
     }).strict();
     Ap2KeySchema = z.object({
       kid: z.string().min(1),
@@ -1821,7 +1946,7 @@ var init_schema = __esm({
       authorization: AuthorizationSchema.optional()
     }).strict();
     SUPPORTED_PROTOCOLS = new Set(PROTOCOL_NAMES);
-    SUPPORTED_PAYMENT_METHODS = /* @__PURE__ */ new Set(["x402"]);
+    SUPPORTED_PAYMENT_METHODS = new Set(PAYMENT_METHOD_NAMES);
     SUPPORTED_AUTHORIZATION_METHODS = /* @__PURE__ */ new Set(["ap2"]);
     EMPTY_CLOSED_OBJECT_SCHEMA = {
       type: "object",
@@ -2029,13 +2154,13 @@ var AP2_UNSUPPORTED = [
   "digest algorithms other than sha-256",
   // Roles this gateway does not play
   "mandate issuance",
-  "merchant checkout JWT issuance",
   "AP2 over the ACP checkout adapter"
 ];
 
 // src/cli/commands/doctor.ts
 init_execution();
 init_core();
+init_constants2();
 init_networks();
 
 // src/protocols/a2a/constants.ts
@@ -2076,10 +2201,10 @@ var A2A_UNSUPPORTED = [
 ];
 
 // src/cli/commands/doctor.ts
-init_constants2();
+init_constants3();
 
 // src/protocols/acp/descriptor.ts
-init_constants2();
+init_constants3();
 [
   "rest transport",
   "well-known discovery",
@@ -2113,7 +2238,7 @@ var ACP_UNSUPPORTED = [
 
 // src/storage/receipts/store.ts
 init_core();
-var PACKAGE_VERSION = "1.4.0" ;
+var PACKAGE_VERSION = "1.5.0" ;
 
 // src/storage/sqlite.ts
 init_core();
@@ -2884,7 +3009,7 @@ function maskMiddle(value, keep = 6) {
 }
 createRequire(import.meta.url);
 function readVersionReport() {
-  const injected = '{"cliVersion":"1.4.0","pinned":[{"name":"@coinbase/x402","version":"2.1.0","via":"@devlab.group/agent-commerce"},{"name":"@modelcontextprotocol/sdk","version":"1.30.0","via":"@devlab.group/agent-commerce"},{"name":"@x402/core","version":"2.23.0","via":"@devlab.group/agent-commerce"},{"name":"@x402/evm","version":"2.23.0","via":"@devlab.group/agent-commerce"},{"name":"viem","version":"2.55.18","via":"@devlab.group/agent-commerce"},{"name":"better-sqlite3","version":"13.0.3","via":"@devlab.group/agent-commerce"},{"name":"fastify","version":"5.12.0","via":"@devlab.group/agent-commerce"},{"name":"pino","version":"10.3.1","via":"@devlab.group/agent-commerce"},{"name":"zod","version":"3.25.76","via":"@devlab.group/agent-commerce"}]}' ;
+  const injected = '{"cliVersion":"1.5.0","pinned":[{"name":"@coinbase/x402","version":"2.1.0","via":"@devlab.group/agent-commerce"},{"name":"@modelcontextprotocol/sdk","version":"1.30.0","via":"@devlab.group/agent-commerce"},{"name":"@x402/core","version":"2.23.0","via":"@devlab.group/agent-commerce"},{"name":"@x402/evm","version":"2.23.0","via":"@devlab.group/agent-commerce"},{"name":"viem","version":"2.55.18","via":"@devlab.group/agent-commerce"},{"name":"better-sqlite3","version":"13.0.3","via":"@devlab.group/agent-commerce"},{"name":"fastify","version":"5.12.0","via":"@devlab.group/agent-commerce"},{"name":"pino","version":"10.3.1","via":"@devlab.group/agent-commerce"},{"name":"zod","version":"3.25.76","via":"@devlab.group/agent-commerce"}]}' ;
   {
     return JSON.parse(injected);
   }
@@ -2909,15 +3034,16 @@ function substitutePathParams(url) {
   }
   return filled;
 }
-function extractWellKnownX402(body) {
+function extractWellKnownX402(body, rail = "x402") {
   const payments = body?.["payments"];
   if (typeof payments !== "object" || payments === null) return void 0;
-  const x402 = payments["x402"];
-  if (typeof x402 !== "object" || x402 === null) return void 0;
-  const rec = x402;
+  const block = payments[rail];
+  if (typeof block !== "object" || block === null) return void 0;
+  const rec = block;
   if (rec["enabled"] === false) return "disabled";
   if (rec["enabled"] !== true) return void 0;
-  const { asset, network, payTo } = rec;
+  const { asset, network } = rec;
+  const payTo = rec[rail === "mpp" ? "recipient" : "payTo"];
   if (typeof asset !== "string" || typeof network !== "string" || typeof payTo !== "string") {
     return void 0;
   }
@@ -2926,7 +3052,7 @@ function extractWellKnownX402(body) {
 function sameAddress2(a, b) {
   return a.toLowerCase() === b.toLowerCase();
 }
-function findX402Mismatch(configured, live) {
+function findX402Mismatch(configured, live, payToField = "payTo") {
   const diffs = [];
   if (!sameAddress2(configured.asset, live.asset)) {
     diffs.push(
@@ -2940,11 +3066,11 @@ function findX402Mismatch(configured, live) {
   }
   if (!sameAddress2(configured.payTo, live.payTo)) {
     diffs.push(
-      `payTo: gateway is using ${live.payTo} but local config resolves to ${configured.payTo}`
+      `${payToField}: gateway is using ${live.payTo} but local config resolves to ${configured.payTo}`
     );
   }
   if (diffs.length === 0) return void 0;
-  return `${diffs.join("; ")} \u2014 the gateway may be running against an older deployment; restart it or re-run chain:deploy`;
+  return `${diffs.join("; ")}; the gateway may be running against an older deployment - restart it or re-run chain:deploy`;
 }
 function describeIssuers(label, issuers) {
   const described = issuers.map(
@@ -3250,11 +3376,36 @@ async function runDoctor(options, deps = {}) {
       });
     }
   }
-  checks.push({
-    name: "Payments (MPP)",
-    status: "INFO",
-    detail: "planned \u2014 not implemented in this release"
-  });
+  const mpp = config?.payments.mpp;
+  if (mpp === void 0 || !mpp.enabled) {
+    checks.push({ name: "Payments (MPP)", status: "INFO", detail: "MPP not configured" });
+  } else {
+    const profile = findNetworkProfile(mpp.network);
+    const mode = profile ? resolveDeploymentMode(profile, mpp.facilitator.mode) : void 0;
+    const where = profile === void 0 || mode === void 0 ? `unknown network ${mpp.network}` : mode === "local" ? `LOCAL dev chain (${mpp.network}, chain id shared with ${profile.displayName})` : `${describeDeploymentMode(mode)} on ${profile.displayName} (${mpp.network})`;
+    const facilitatorDetail = mpp.facilitator.mode === "local" ? "local" : `remote (auth=${mpp.facilitator.auth.type})`;
+    const summary = `MPP ${MPP_PROFILE.intent}/${MPP_PROFILE.method}/${MPP_PROFILE.credentialType} enabled - ${where}, asset=${MPP_PROFILE.assetSymbol} ${maskMiddle(mpp.asset)}, recipient=${maskMiddle(mpp.recipient)}, facilitator=${facilitatorDetail}, spec ${MPP_SPEC_DRAFTS.core}@${MPP_SPEC_COMMIT.slice(0, 7)}, mppx ${MPPX_VERSION}`;
+    const configured = { asset: mpp.asset, network: mpp.network, payTo: mpp.recipient };
+    const live = wellKnown?.ok ? extractWellKnownX402(wellKnown.body, "mpp") : void 0;
+    if (live === "disabled") {
+      checks.push({
+        name: "Payments (MPP)",
+        status: "FAIL",
+        detail: `Local config enables MPP, but ${gatewayUrl} reports it disabled`
+      });
+    } else if (live === void 0) {
+      checks.push({
+        name: "Payments (MPP)",
+        status: "INFO",
+        detail: `${summary} (live MPP settlement config unavailable for comparison)`
+      });
+    } else {
+      const mismatch = findX402Mismatch(configured, live, "recipient");
+      checks.push(
+        mismatch === void 0 ? { name: "Payments (MPP)", status: "PASS", detail: summary } : { name: "Payments (MPP)", status: "FAIL", detail: mismatch }
+      );
+    }
+  }
   if (config === void 0) {
     checks.push({ name: "Storage", status: "WARN", detail: "skipped \u2014 config invalid" });
   } else if (
@@ -3463,16 +3614,24 @@ function discoverOperations(loaded, options = {}) {
     }
     const pathItem = dereference(document, rawPathItem).value;
     if (!isRecord(pathItem)) continue;
+    const unsupportedMethod = (name) => {
+      diagnostics.push({
+        severity: "warning",
+        code: "unsupported-method",
+        operation: `${name.toUpperCase()} ${path2}`,
+        message: `Skipped ${name.toUpperCase()} ${path2}: only GET, POST, PUT, PATCH and DELETE are supported`
+      });
+    };
     for (const [key, rawOperation] of Object.entries(pathItem)) {
       if (NON_OPERATION_KEYS.has(key) || key.startsWith("x-")) continue;
+      if (key === "additionalOperations") {
+        if (isRecord(rawOperation))
+          for (const name of Object.keys(rawOperation)) unsupportedMethod(name);
+        continue;
+      }
       const method = SUPPORTED_METHODS[key.toLowerCase()];
       if (method === void 0) {
-        diagnostics.push({
-          severity: "warning",
-          code: "unsupported-method",
-          operation: `${key.toUpperCase()} ${path2}`,
-          message: `Skipped ${key.toUpperCase()} ${path2}: only GET, POST, PUT, PATCH and DELETE are supported`
-        });
+        unsupportedMethod(key);
         continue;
       }
       const operation = dereference(document, rawOperation).value;
@@ -3552,12 +3711,13 @@ function selectServer(document, candidates, context, options, diagnostics) {
     if (typeof url !== "string" || url === "") continue;
     const substituted = substituteServerVariables(url, first["variables"], context, diagnostics);
     if (substituted === void 0) return void 0;
-    if (!isAbsoluteHttpUrl(substituted)) {
+    const issue = describeServerUrlIssue(substituted);
+    if (issue !== void 0) {
       diagnostics.push({
         severity: "error",
-        code: "relative-server-url",
+        code: issue.code,
         operation: context.resourceId,
-        message: `Skipped ${context.where}: server URL "${substituted}" is relative, so no backend host is known. Pass --base-url`
+        message: `Skipped ${context.where}: server URL "${substituted}" ${issue.reason}. Pass --base-url`
       });
       return void 0;
     }
@@ -3606,12 +3766,26 @@ function substituteServerVariables(url, variables, context, diagnostics) {
   return substituted;
 }
 function isAbsoluteHttpUrl(value) {
+  return describeServerUrlIssue(value) === void 0;
+}
+function describeServerUrlIssue(value) {
   try {
     const parsed = new URL(value);
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return false;
-    return parsed.search === "" && parsed.hash === "";
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      return { code: "invalid-server-url", reason: "must use http:// or https://" };
+    }
+    if (parsed.search !== "" || parsed.hash !== "") {
+      return {
+        code: "invalid-server-url",
+        reason: "must not contain a query string or fragment"
+      };
+    }
+    return void 0;
   } catch {
-    return false;
+    return {
+      code: "relative-server-url",
+      reason: "is relative or malformed, so no backend host is known"
+    };
   }
 }
 function assertAbsoluteHttpUrl(value, label) {
@@ -3765,6 +3939,7 @@ function mergeAllOf(document, schema, stack, dropped) {
   const merged = { type: "object", properties: {}, required: [] };
   const properties = merged["properties"];
   const required = /* @__PURE__ */ new Set();
+  let open2 = false;
   const parts = [...branches, ...Object.keys(siblings).length > 0 ? [siblings] : []];
   for (const branch of parts) {
     const converted = convertNode(document, branch, stack, dropped);
@@ -3793,13 +3968,22 @@ function mergeAllOf(document, schema, stack, dropped) {
         throw new UnsupportedSchema(`allOf branch uses "${keyword}", which cannot be merged`);
       }
     }
-    if (typeof converted["description"] === "string" && merged["description"] === void 0) {
-      merged["description"] = converted["description"];
+    for (const keyword of METADATA_KEYWORDS) {
+      if (Object.hasOwn(converted, keyword) && !Object.hasOwn(merged, keyword)) {
+        merged[keyword] = converted[keyword];
+      }
+    }
+    const additional = converted["additionalProperties"];
+    if (additional === true) open2 = true;
+    else if (isRecord2(additional)) {
+      throw new UnsupportedSchema(
+        "allOf branch constrains additionalProperties, which cannot be merged"
+      );
     }
   }
   if (required.size > 0) merged["required"] = [...required];
   else delete merged["required"];
-  merged["additionalProperties"] = false;
+  merged["additionalProperties"] = open2;
   return merged;
 }
 function isRecord2(value) {
@@ -3963,11 +4147,11 @@ function describeUnsupportedParameter(document, parameter, location) {
 }
 function resolveBody(document, candidate) {
   if (candidate.requestBody === void 0) return { kind: "none" };
-  const resolved = dereference(document, candidate.requestBody).value;
-  if (typeof resolved !== "object" || resolved === null || Array.isArray(resolved)) {
+  const resolvedBody = dereference(document, candidate.requestBody);
+  if (typeof resolvedBody.value !== "object" || resolvedBody.value === null || Array.isArray(resolvedBody.value)) {
     return { kind: "none" };
   }
-  const requestBody = resolved;
+  const requestBody = resolvedBody.value;
   const required = requestBody["required"] === true;
   if (candidate.method === "GET" || candidate.method === "DELETE") {
     return {
@@ -3986,7 +4170,7 @@ function resolveBody(document, candidate) {
       reason: `no JSON request body content type (found: ${Object.keys(content).join(", ") || "none"}). Only application/json and application/*+json are supported - multipart and form data are never serialized as JSON`
     };
   }
-  const media = content[mediaType];
+  const media = dereference(document, content[mediaType], resolvedBody.stack).value;
   const schemaNode = isRecord3(media) ? media["schema"] : void 0;
   if (schemaNode === void 0) {
     return {
@@ -4031,11 +4215,12 @@ function buildResourceDrafts(loaded, options = {}) {
     loaded,
     options.baseUrl !== void 0 ? { baseUrl: options.baseUrl } : {}
   );
-  const diagnostics = [...discovery.diagnostics];
+  const diagnostics = [];
   const drafts = [];
   const wanted = options.include?.operationIds;
   const wantedTags = options.include?.tags;
   const matched = /* @__PURE__ */ new Set();
+  const selected = /* @__PURE__ */ new Set();
   for (const candidate of discovery.operations) {
     if (wanted !== void 0 && !selects(wanted, candidate)) continue;
     if (wantedTags !== void 0 && !candidate.tags.some((tag) => wantedTags.includes(tag))) {
@@ -4044,6 +4229,7 @@ function buildResourceDrafts(loaded, options = {}) {
     if (wanted !== void 0) {
       for (const id of wanted) if (selects([id], candidate)) matched.add(id);
     }
+    selected.add(candidate.resourceId);
     const mapping = mapRequest(loaded, candidate);
     diagnostics.push(...mapping.diagnostics);
     if (!mapping.supported) continue;
@@ -4073,8 +4259,8 @@ function buildResourceDrafts(loaded, options = {}) {
     if (options.policy?.pricing === void 0 || options.policy.expose === void 0) {
       review.push(
         "REVIEW: pricing and exposure are not inferred from OpenAPI. Add e.g.",
-        '  pricing: { type: free }   # or { type: fixed, amount: "0.01", currency: USDC }',
-        "  expose: [http]           # http | mcp | a2a"
+        '  pricing: { type: free }   # or { type: fixed, amount: "0.01", currency: USDC } with payments: [x402]',
+        "  expose: [http]           # http | mcp | a2a | acp"
       );
     }
     drafts.push({
@@ -4108,10 +4294,19 @@ function buildResourceDrafts(loaded, options = {}) {
     version: loaded.version,
     sourcePath: loaded.sourcePath,
     drafts,
-    diagnostics,
+    diagnostics: [
+      ...selectDiscoveryDiagnostics(discovery.diagnostics, options.include, selected),
+      ...diagnostics
+    ],
     unmatchedOperationIds: (wanted ?? []).filter((id) => !matched.has(id))
   };
 }
+function selectDiscoveryDiagnostics(found, include, selected) {
+  if (include?.operationIds === void 0 && include?.tags === void 0) return found;
+  return found.filter(
+    ({ operation }) => operation === void 0 || selected.has(operation) || include.operationIds?.includes(operation) === true
+  );
+}
 function selects(ids, candidate) {
   return ids.includes(candidate.resourceId) || candidate.operationId !== void 0 && ids.includes(candidate.operationId);
 }
@@ -4125,19 +4320,28 @@ function selectOutputSchema(document, candidate, diagnostics, dropped) {
   if (!isRecord4(responses)) return void 0;
   const successes = Object.keys(responses).filter((status) => /^2\d\d$/.test(status)).sort((a, b) => rank(a) - rank(b));
   if (successes.length === 0) return void 0;
-  const withBody = successes.filter((status) => {
-    const response2 = responses[status];
-    const content2 = isRecord4(response2) ? response2["content"] : void 0;
-    return isRecord4(content2) && pickJsonMediaType(Object.keys(content2)) !== void 0;
+  const withBody = successes.flatMap((status) => {
+    const response = dereference(document, responses[status]);
+    if (!isRecord4(response.value)) return [];
+    const content = response.value["content"];
+    if (!isRecord4(content)) return [];
+    const mediaType = pickJsonMediaType(Object.keys(content));
+    if (mediaType === void 0) return [];
+    const media = dereference(document, content[mediaType], response.stack).value;
+    return isRecord4(media) ? [{ status, media }] : [];
   });
   const chosen = withBody[0];
   if (chosen === void 0) return void 0;
-  const response = responses[chosen];
-  const content = response["content"];
-  const mediaType = pickJsonMediaType(Object.keys(content));
-  const media = content[mediaType];
-  const schemaNode = isRecord4(media) ? media["schema"] : void 0;
-  if (schemaNode === void 0) return void 0;
+  const schemaNode = chosen.media["schema"];
+  if (schemaNode === void 0) {
+    diagnostics.push({
+      severity: "warning",
+      code: "missing-output-schema",
+      operation: candidate.resourceId,
+      message: `${candidate.resourceId}: response ${chosen.status} has JSON content without a schema; omitted the output schema`
+    });
+    return void 0;
+  }
   const converted = convertSchema(document, schemaNode);
   if (!converted.supported) {
     diagnostics.push({
@@ -4154,7 +4358,7 @@ function selectOutputSchema(document, candidate, diagnostics, dropped) {
       severity: "warning",
       code: "multiple-success-responses",
       operation: candidate.resourceId,
-      message: `${candidate.resourceId}: responses ${withBody.join(", ")} all carry a JSON body; used ${chosen}`
+      message: `${candidate.resourceId}: responses ${withBody.map(({ status }) => status).join(", ")} all carry a JSON body; used ${chosen.status}`
     });
   }
   return converted.schema;
@@ -4200,6 +4404,31 @@ function invalid2(message, details, cause) {
     ...cause !== void 0 ? { cause } : {}
   });
 }
+async function readCapped(sourcePath, details) {
+  const buffer = Buffer.alloc(MAX_SOURCE_BYTES + 1);
+  let length = 0;
+  try {
+    const handle = await open(sourcePath, "r");
+    try {
+      while (length < buffer.length) {
+        const { bytesRead } = await handle.read(buffer, length, buffer.length - length, null);
+        if (bytesRead === 0) break;
+        length += bytesRead;
+      }
+    } finally {
+      await handle.close();
+    }
+  } catch (error) {
+    throw invalid2(`OpenAPI document "${sourcePath}" could not be read`, details, error);
+  }
+  if (length > MAX_SOURCE_BYTES) {
+    throw invalid2(`OpenAPI document "${sourcePath}" is over the ${MAX_SOURCE_BYTES}-byte limit`, {
+      ...details,
+      maxBytes: MAX_SOURCE_BYTES
+    });
+  }
+  return buffer.toString("utf8", 0, length);
+}
 async function loadOpenApiDocument(sourcePath) {
   const details = { sourcePath };
   let stats;
@@ -4224,7 +4453,7 @@ async function loadOpenApiDocument(sourcePath) {
       details
     );
   }
-  const source = await readFile(sourcePath, "utf8");
+  const source = await readCapped(sourcePath, details);
   if (source.trim() === "") {
     throw invalid2(`OpenAPI document "${sourcePath}" is empty`, details);
   }
@@ -4702,7 +4931,10 @@ function buildProgram(io = processIo) {
     process.exitCode = code;
   });
   const importCommand = program.command("import").description("Generate Agent Commerce resource drafts from an API description.");
-  importCommand.command("openapi").description("Convert a local OpenAPI 3.0/3.1/3.2 document into resource drafts.").argument("<source>", "path to a local .yaml, .yml or .json OpenAPI document").option("--output <path>", "output path (default: <source>.agent-commerce.yaml)").option("--force", "overwrite an existing output file", false).option("--base-url <url>", "backend base URL, overriding the document servers").option(
+  importCommand.command("openapi").description("Convert a local OpenAPI 3.0/3.1/3.2 document into resource drafts.").argument("<source>", "path to a local .yaml, .yml or .json OpenAPI document").option(
+    "--output <path>",
+    "output path (default: <source name without extension>.agent-commerce.yaml in the current directory)"
+  ).option("--force", "overwrite an existing output file", false).option("--base-url <url>", "backend base URL, overriding the document servers").option(
     "--operation <operationId>",
     "import only this operation (repeatable)",
     collect,