@devlab.group/agent-commerce 2.0.0 → 2.2.0

package/dist/cli/index.js

@@ -1,2191 +1,25 @@
 #!/usr/bin/env node
-import { isDeepStrictEqual } from 'util';
-import { z } from 'zod';
-import { existsSync, mkdirSync, readFileSync, accessSync, constants, closeSync, openSync, chmodSync, promises } from 'fs';
-import * as path from 'path';
-import { dirname, resolve, basename, extname, win32, join } from 'path';
-import { stringify, parse, Document, YAMLError } from 'yaml';
-import { CommanderError, Command } from 'commander';
-import picocolors from 'picocolors';
-import { randomUUID } from 'crypto';
-import 'module';
-import Database from 'better-sqlite3';
-import { writeFile, stat, mkdir, rename, rm, open } from 'fs/promises';
-import { validate } from '@scalar/openapi-parser';
-import * as clack from '@clack/prompts';
-
-var __defProp = Object.defineProperty;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
-};
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-
-// src/config/filename.ts
-var DEFAULT_CONFIG_FILENAME;
-var init_filename = __esm({
-  "src/config/filename.ts"() {
-    DEFAULT_CONFIG_FILENAME = "config.yaml";
-  }
-});
-
-// src/core/domain/common.ts
-var PROTOCOL_NAME_KEYS, PROTOCOL_NAMES, PAYMENT_METHOD_NAME_KEYS, PAYMENT_METHOD_NAMES;
-var init_common = __esm({
-  "src/core/domain/common.ts"() {
-    PROTOCOL_NAME_KEYS = {
-      http: true,
-      mcp: true,
-      a2a: true,
-      acp: true
-    };
-    PROTOCOL_NAMES = Object.keys(
-      PROTOCOL_NAME_KEYS
-    );
-    PAYMENT_METHOD_NAME_KEYS = { x402: true, mpp: true };
-    PAYMENT_METHOD_NAMES = Object.keys(
-      PAYMENT_METHOD_NAME_KEYS
-    );
-  }
-});
-
-// src/core/domain/event.ts
-var init_event = __esm({
-  "src/core/domain/event.ts"() {
-  }
-});
-
-// src/core/domain/resource.ts
-var init_resource = __esm({
-  "src/core/domain/resource.ts"() {
-  }
-});
-
-// src/core/errors/codes.ts
-var COMMERCE_ERROR_HTTP_STATUS, RETRYABLE_ERROR_CODES;
-var init_codes = __esm({
-  "src/core/errors/codes.ts"() {
-    COMMERCE_ERROR_HTTP_STATUS = {
-      CONFIG_INVALID: 500,
-      RESOURCE_NOT_FOUND: 404,
-      INPUT_INVALID: 400,
-      PAYMENT_REQUIRED: 402,
-      PAYMENT_INVALID: 402,
-      PAYMENT_REPLAYED: 409,
-      PAYMENT_PROVIDER_UNAVAILABLE: 503,
-      PAYMENT_SETTLEMENT_FAILED: 502,
-      // 403, not 402: a 402 tells a client to pay and retry, which cannot fix a
-      // missing or rejected mandate, and a client that auto-pays on 402 would be
-      // charged for a request that was never going to be delivered
-      AUTHORIZATION_REQUIRED: 403,
-      AUTHORIZATION_INVALID: 403,
-      AUTHORIZATION_REPLAYED: 409,
-      AUTHORIZATION_PROVIDER_UNAVAILABLE: 503,
-      BACKEND_TIMEOUT: 504,
-      BACKEND_ERROR: 502,
-      PROTOCOL_UNSUPPORTED: 501,
-      GATEWAY_BUSY: 503,
-      STORAGE_ERROR: 500,
-      INTERNAL_ERROR: 500
-    };
-    RETRYABLE_ERROR_CODES = /* @__PURE__ */ new Set([
-      "PAYMENT_PROVIDER_UNAVAILABLE",
-      // The verifier or replay store was unreachable, so the mandate got no
-      // verdict. The same proof can verify once the outage clears.
-      "AUTHORIZATION_PROVIDER_UNAVAILABLE",
-      "BACKEND_TIMEOUT",
-      // Load shedding is transient: the caller should back off and try again.
-      // Clients act on this flag, and leaving it out would make a momentary
-      // throttle look like a permanent failure.
-      "GATEWAY_BUSY"
-    ]);
-  }
-});
-
-// src/core/errors/commerce-error.ts
-function isCommerceError(value) {
-  return value instanceof CommerceError;
-}
-function toCommerceError(value, fallbackCode = "INTERNAL_ERROR", fallbackMessage = "Unexpected internal error") {
-  if (isCommerceError(value)) return value;
-  return new CommerceError(fallbackCode, fallbackMessage, { cause: value });
-}
-var CommerceError;
-var init_commerce_error = __esm({
-  "src/core/errors/commerce-error.ts"() {
-    init_codes();
-    CommerceError = class _CommerceError extends Error {
-      code;
-      httpStatus;
-      retryable;
-      details;
-      requestId;
-      resourceId;
-      constructor(code, message, options = {}) {
-        super(message, options.cause !== void 0 ? { cause: options.cause } : void 0);
-        this.name = "CommerceError";
-        this.code = code;
-        this.httpStatus = options.httpStatus ?? COMMERCE_ERROR_HTTP_STATUS[code];
-        this.retryable = RETRYABLE_ERROR_CODES.has(code);
-        if (options.details !== void 0) this.details = options.details;
-        if (options.requestId !== void 0) this.requestId = options.requestId;
-        if (options.resourceId !== void 0) this.resourceId = options.resourceId;
-        Error.captureStackTrace?.(this, _CommerceError);
-      }
-      /** Non-secret, client-safe representation. `cause` is never included */
-      toInfo() {
-        return {
-          code: this.code,
-          message: this.message,
-          httpStatus: this.httpStatus,
-          retryable: this.retryable,
-          ...this.requestId !== void 0 ? { requestId: this.requestId } : {},
-          ...this.resourceId !== void 0 ? { resourceId: this.resourceId } : {},
-          ...this.details !== void 0 ? { details: this.details } : {}
-        };
-      }
-    };
-  }
-});
-
-// src/core/errors/index.ts
-var init_errors = __esm({
-  "src/core/errors/index.ts"() {
-    init_codes();
-    init_commerce_error();
-  }
-});
-
-// src/core/is-record.ts
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-var init_is_record = __esm({
-  "src/core/is-record.ts"() {
-  }
-});
-
-// src/core/domain/wire.ts
-var PAYMENT_INPUT_FIELD, AUTHORIZATION_INPUT_FIELD, RESERVED_INPUT_FIELDS;
-var init_wire = __esm({
-  "src/core/domain/wire.ts"() {
-    init_errors();
-    init_is_record();
-    PAYMENT_INPUT_FIELD = "_payment";
-    AUTHORIZATION_INPUT_FIELD = "_authorization";
-    RESERVED_INPUT_FIELDS = [
-      PAYMENT_INPUT_FIELD,
-      AUTHORIZATION_INPUT_FIELD
-    ];
-  }
-});
-
-// src/core/interfaces/logger.ts
-var NOOP_LOGGER;
-var init_logger = __esm({
-  "src/core/interfaces/logger.ts"() {
-    NOOP_LOGGER = {
-      debug: () => {
-      },
-      info: () => {
-      },
-      warn: () => {
-      },
-      error: () => {
-      },
-      child: () => NOOP_LOGGER
-    };
-  }
-});
-
-// src/core/interfaces/protocol-adapter.ts
-var init_protocol_adapter = __esm({
-  "src/core/interfaces/protocol-adapter.ts"() {
-  }
-});
-
-// src/core/interfaces/runtime.ts
-var systemClock;
-var init_runtime = __esm({
-  "src/core/interfaces/runtime.ts"() {
-    systemClock = {
-      now: () => /* @__PURE__ */ new Date(),
-      nowIso: () => (/* @__PURE__ */ new Date()).toISOString(),
-      monotonicMs: () => performance.now()
-    };
-  }
-});
-
-// src/core/public-types.ts
-var init_public_types = __esm({
-  "src/core/public-types.ts"() {
-    init_common();
-    init_event();
-    init_resource();
-    init_wire();
-    init_errors();
-    init_logger();
-    init_protocol_adapter();
-    init_runtime();
-  }
-});
-
-// src/core/index.ts
-var init_core = __esm({
-  "src/core/index.ts"() {
-    init_public_types();
-  }
-});
-
-// src/authorization/ap2/constants.ts
-var AP2_SPEC_VERSION, AP2_MODES, AP2_SIGNING_ALGORITHM, AP2_KEY_TYPE, AP2_JWK_CURVE, AP2_JWK_COORDINATE_BYTES, AP2_JWK_MEMBERS, AP2_CHECKOUT_MANDATE_VCT, AP2_CHECKOUT_PROFILE, AP2_DEFAULT_CLOCK_SKEW_SECONDS, AP2_MAX_CLOCK_SKEW_SECONDS;
-var init_constants = __esm({
-  "src/authorization/ap2/constants.ts"() {
-    AP2_SPEC_VERSION = "0.2.0";
-    AP2_MODES = ["direct"];
-    AP2_SIGNING_ALGORITHM = "ES256";
-    AP2_KEY_TYPE = "EC";
-    AP2_JWK_CURVE = "P-256";
-    AP2_JWK_COORDINATE_BYTES = 32;
-    AP2_JWK_MEMBERS = ["kty", "crv", "x", "y", "kid", "alg", "use"];
-    AP2_CHECKOUT_MANDATE_VCT = "mandate.checkout.1";
-    AP2_CHECKOUT_PROFILE = "agent-commerce/ap2/checkout/v1";
-    AP2_DEFAULT_CLOCK_SKEW_SECONDS = 60;
-    AP2_MAX_CLOCK_SKEW_SECONDS = 300;
-  }
-});
-
-// src/core/execution/backend-http.ts
-function extractPathParameterNames(url) {
-  return [...url.matchAll(PATH_PARAM_PATTERN)].map((match) => match[1]);
-}
-function findUnparsedBraceToken(url) {
-  const residue = url.replace(PATH_PARAM_PATTERN, "");
-  const index = residue.search(/[{}]/);
-  if (index === -1) return void 0;
-  const token = /\{[^{}]*\}?|\}/.exec(residue.slice(index));
-  return token?.[0] ?? residue[index];
-}
-var PATH_PARAM_PATTERN;
-var init_backend_http = __esm({
-  "src/core/execution/backend-http.ts"() {
-    init_resource();
-    init_errors();
-    init_logger();
-    init_is_record();
-    PATH_PARAM_PATTERN = /\{([a-zA-Z0-9_.-]+)\}/g;
-  }
-});
-
-// src/core/execution/settlement-order.ts
-var init_settlement_order = __esm({
-  "src/core/execution/settlement-order.ts"() {
-  }
-});
-function typeList(raw) {
-  if (typeof raw === "string") return [raw];
-  if (Array.isArray(raw) && raw.every((entry) => typeof entry === "string")) {
-    return raw;
-  }
-  return void 0;
-}
-function isObjectSchemaNode(schema) {
-  const types = typeList(schema["type"]);
-  if (types !== void 0) return types.includes("object");
-  return Object.hasOwn(schema, "properties") || Object.hasOwn(schema, "required");
-}
-var init_validation = __esm({
-  "src/core/execution/validation.ts"() {
-    init_is_record();
-  }
-});
-var init_pipeline = __esm({
-  "src/core/execution/pipeline.ts"() {
-    init_wire();
-    init_errors();
-    init_is_record();
-    init_backend_http();
-    init_settlement_order();
-    init_validation();
-    [...RESERVED_INPUT_FIELDS, "__proto__"];
-  }
-});
-
-// src/core/execution/registry.ts
-var init_registry = __esm({
-  "src/core/execution/registry.ts"() {
-    init_errors();
-  }
-});
-
-// src/core/execution/store-event-sink.ts
-var init_store_event_sink = __esm({
-  "src/core/execution/store-event-sink.ts"() {
-    init_errors();
-  }
-});
-
-// src/core/execution/index.ts
-var init_execution = __esm({
-  "src/core/execution/index.ts"() {
-    init_backend_http();
-    init_pipeline();
-    init_registry();
-    init_store_event_sink();
-    init_validation();
-  }
-});
-
-// src/payments/mpp/constants.ts
-function isMppNetwork(value) {
-  return MPP_NETWORKS.includes(value);
-}
-var MPP_SPEC_COMMIT, MPP_SPEC_DRAFTS, MPP_MIN_CHALLENGE_SECRET_LENGTH, MPPX_VERSION, MPP_PROFILE, MPP_NETWORKS, MPP_DEFAULT_NETWORK;
-var init_constants2 = __esm({
-  "src/payments/mpp/constants.ts"() {
-    MPP_SPEC_COMMIT = "806fdb8b8c92cda5c84b8660558921b6bbeef7e0";
-    MPP_SPEC_DRAFTS = {
-      core: "draft-httpauth-payment-01",
-      intent: "draft-payment-intent-charge-00",
-      method: "draft-evm-charge-00"
-    };
-    MPP_MIN_CHALLENGE_SECRET_LENGTH = 32;
-    MPPX_VERSION = "0.13.1";
-    MPP_PROFILE = {
-      intent: "charge",
-      method: "evm",
-      credentialType: "authorization",
-      assetSymbol: "USDC",
-      assetDecimals: 6
-    };
-    MPP_NETWORKS = ["eip155:84532", "eip155:8453"];
-    MPP_DEFAULT_NETWORK = "eip155:84532";
-    `mpp/${MPP_SPEC_DRAFTS.core} intent=${MPP_PROFILE.intent} method=${MPP_PROFILE.method}`;
-  }
-});
-
-// src/payments/x402/networks.ts
-function findNetworkProfile(id) {
-  return BY_ID.get(id);
-}
-function requireNetworkProfile(id, path2) {
-  const profile = BY_ID.get(id);
-  if (!profile) {
-    throw new CommerceError(
-      "CONFIG_INVALID",
-      `${path2}: "${id}" is not a supported network. Supported CAIP-2 identifiers: ${SUPPORTED_NETWORK_IDS.join(", ")}`,
-      { details: { path: path2, network: id } }
-    );
-  }
-  return profile;
-}
-function resolveDeploymentMode(profile, facilitatorMode) {
-  if (facilitatorMode === "local") return "local";
-  return profile.kind;
-}
-function describeDeploymentMode(mode) {
-  return mode === "mainnet" ? LIVE_MAINNET_BANNER : mode.toUpperCase();
-}
-var PROFILES, BY_ID, SUPPORTED_NETWORK_IDS, LIVE_MAINNET_BANNER;
-var init_networks = __esm({
-  "src/payments/x402/networks.ts"() {
-    init_core();
-    PROFILES = [
-      {
-        id: "eip155:84532",
-        chainId: 84532,
-        displayName: "Base Sepolia",
-        kind: "testnet",
-        canonicalAsset: {
-          symbol: "USDC",
-          address: "0x036CbD53842c5426634e7929541eC2318f3dCF7e",
-          name: "USDC",
-          version: "2"
-        }
-      },
-      {
-        id: "eip155:8453",
-        chainId: 8453,
-        displayName: "Base",
-        kind: "mainnet",
-        canonicalAsset: {
-          symbol: "USDC",
-          address: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
-          name: "USD Coin",
-          version: "2"
-        }
-      }
-    ];
-    BY_ID = new Map(PROFILES.map((profile) => [profile.id, profile]));
-    SUPPORTED_NETWORK_IDS = PROFILES.map((p) => p.id);
-    LIVE_MAINNET_BANNER = "LIVE MAINNET MODE - REAL FUNDS";
-  }
-});
-
-// src/protocols/acp/constants.ts
-var ACP_SPEC_VERSION, ACP_API_VERSION, ACP_WELL_KNOWN_PATH, ACP_CHECKOUT_OPERATIONS, ACP_OPERATION_INPUT_KEYS, ACP_OPERATION_OPTIONAL_INPUT_KEYS, ACP_SESSION_ID_INPUT_KEY;
-var init_constants3 = __esm({
-  "src/protocols/acp/constants.ts"() {
-    ACP_SPEC_VERSION = "2026-04-17";
-    ACP_API_VERSION = "2026-04-17";
-    ACP_WELL_KNOWN_PATH = "/.well-known/acp.json";
-    ACP_CHECKOUT_OPERATIONS = [
-      "createCheckoutSession",
-      "updateCheckoutSession",
-      "getCheckoutSession",
-      "completeCheckoutSession",
-      "cancelCheckoutSession"
-    ];
-    ACP_OPERATION_INPUT_KEYS = {
-      createCheckoutSession: ["body"],
-      updateCheckoutSession: ["path", "body"],
-      getCheckoutSession: ["path"],
-      completeCheckoutSession: ["path", "body"],
-      cancelCheckoutSession: ["path"]
-    };
-    ACP_OPERATION_OPTIONAL_INPUT_KEYS = {
-      cancelCheckoutSession: ["body"]
-    };
-    ACP_SESSION_ID_INPUT_KEY = "checkout_session_id";
-  }
-});
-
-// src/config/env.ts
-function substituteEnv(value, env, path2 = "$") {
-  if (typeof value === "string") {
-    return substituteString(value, env, path2);
-  }
-  if (Array.isArray(value)) {
-    return value.map((entry, index) => substituteEnv(entry, env, `${path2}[${index}]`));
-  }
-  if (isRecord(value)) {
-    const result = {};
-    for (const [key, entry] of Object.entries(value)) {
-      result[key] = substituteEnv(entry, env, `${path2}.${key}`);
-    }
-    return result;
-  }
-  return value;
-}
-function substituteString(value, env, path2) {
-  assertTemplateIsSupported(value, path2);
-  return substituteOnce(value, env, path2);
-}
-function assertTemplateIsSupported(value, path2) {
-  if (NESTED_PLACEHOLDER.test(value)) {
-    throw new CommerceError(
-      "CONFIG_INVALID",
-      `Configuration value at "${path2}" nests placeholders (e.g. "\${A:-\${B}}"), which is not supported: the inner one is not resolved and its closing brace ends up in the value. Use a plain default, or set the variable.`,
-      { details: { path: path2 } }
-    );
-  }
-  for (const [token] of value.matchAll(BRACE_TOKEN)) {
-    if (SUPPORTED_TOKEN.test(token)) continue;
-    throw new CommerceError(
-      "CONFIG_INVALID",
-      `Configuration value at "${path2}" contains "${token}", which is not a supported placeholder. Only "\${VAR}" and "\${VAR:-default}" are recognized; shell forms such as "\${VAR-default}", "\${VAR:=default}" and "\${VAR:?message}" would load as literal text.`,
-      { details: { path: path2, token } }
-    );
-  }
-}
-function substituteOnce(value, env, path2) {
-  return value.replace(
-    PLACEHOLDER_PATTERN,
-    (_match, name, hasDefault, def) => {
-      const envValue = env[name];
-      if (hasDefault !== void 0) {
-        if (envValue === void 0 || envValue === "") return def ?? "";
-        return envValue;
-      }
-      if (envValue === void 0) {
-        throw new CommerceError(
-          "CONFIG_INVALID",
-          `Unresolved environment variable "\${${name}}" referenced at config path "${path2}"`,
-          { details: { variable: name, path: path2 } }
-        );
-      }
-      return envValue;
-    }
-  );
-}
-var PLACEHOLDER_PATTERN, BRACE_TOKEN, SUPPORTED_TOKEN, NESTED_PLACEHOLDER;
-var init_env = __esm({
-  "src/config/env.ts"() {
-    init_core();
-    init_is_record();
-    PLACEHOLDER_PATTERN = /\$\{([A-Za-z_][A-Za-z0-9_]*)(:-([^}]*))?\}/g;
-    BRACE_TOKEN = /\$\{[^{}]*\}/g;
-    SUPPORTED_TOKEN = /^\$\{[A-Za-z_][A-Za-z0-9_]*(:-[^}]*)?\}$/;
-    NESTED_PLACEHOLDER = /\$\{[^{}]*\$\{/;
-  }
-});
-
-// src/payments/x402/local-chain/accounts.ts
-var ANVIL_WELL_KNOWN_ACCOUNTS;
-var init_accounts = __esm({
-  "src/payments/x402/local-chain/accounts.ts"() {
-    ANVIL_WELL_KNOWN_ACCOUNTS = [
-      {
-        address: "0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266",
-        privateKey: "0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80"
-      },
-      {
-        address: "0x70997970C51812dc3A010C7d01b50e0d17dc79C8",
-        privateKey: "0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d"
-      },
-      {
-        address: "0x3C44CdDdB6a900fa2b585dd299e03d12FA4293BC",
-        privateKey: "0x5de4111afa1a4b94908f83103eb1f1706367c2e68ca870fc3fb9a804cdab365a"
-      }
-    ];
-    ANVIL_WELL_KNOWN_ACCOUNTS[0];
-    ANVIL_WELL_KNOWN_ACCOUNTS[1];
-    ANVIL_WELL_KNOWN_ACCOUNTS[2];
-  }
-});
-
-// src/payments/x402/dev-key-guard.ts
-function isWellKnownDevAddress(address) {
-  return WELL_KNOWN_DEV_ADDRESSES.has(address.toLowerCase());
-}
-function isLikelyLocalOrPrivateHost(hostname) {
-  const h = hostname.toLowerCase().replace(/^\[|\]$/g, "");
-  if (h === "localhost" || h === "::1") return true;
-  if (/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(h)) return true;
-  if (/^10\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(h)) return true;
-  if (/^192\.168\.\d{1,3}\.\d{1,3}$/.test(h)) return true;
-  if (/^172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}$/.test(h)) return true;
-  if (!h.includes(".") && !h.includes(":")) return true;
-  return false;
-}
-var WELL_KNOWN_DEV_ADDRESSES;
-var init_dev_key_guard = __esm({
-  "src/payments/x402/dev-key-guard.ts"() {
-    init_core();
-    init_accounts();
-    new Set(
-      ANVIL_WELL_KNOWN_ACCOUNTS.map((a) => a.privateKey.toLowerCase())
-    );
-    WELL_KNOWN_DEV_ADDRESSES = new Set(
-      ANVIL_WELL_KNOWN_ACCOUNTS.map((a) => a.address.toLowerCase())
-    );
-  }
-});
-
-// src/payments/x402/guardrails.ts
-function invalid(message, path2) {
-  return new CommerceError("CONFIG_INVALID", message, { details: { path: path2 } });
-}
-function resolveX402Deployment(input) {
-  const at = input.configPath ?? "payments.x402";
-  const payTo = input.payToField ?? "payTo";
-  const profile = requireNetworkProfile(input.network, `${at}.network`);
-  const mode = resolveDeploymentMode(profile, input.facilitator.mode);
-  if (profile.kind === "mainnet" && input.facilitator.mode === "local") {
-    throw invalid(
-      `${at}: network "${profile.id}" (${profile.displayName}) is a mainnet and cannot be served by facilitator.mode "local". A mainnet deployment must settle through a remote facilitator.`,
-      `${at}.facilitator.mode`
-    );
-  }
-  if (mode === "mainnet" && input.allowMainnet !== true) {
-    throw invalid(
-      `${at}: network "${profile.id}" (${profile.displayName}) settles real funds. Set ${at}.allowMainnet: true to acknowledge this explicitly - it is never the default.`,
-      `${at}.allowMainnet`
-    );
-  }
-  if (input.facilitator.mode === "remote") {
-    assertFacilitatorUrlIsSafe(input.facilitator.url, mode, at);
-    if (mode === "mainnet" && input.facilitator.auth.type === "none" && input.allowUnauthenticatedFacilitator !== true) {
-      throw invalid(
-        `${at}: no credential is configured for facilitator ${describeOrigin(input.facilitator.url)} on mainnet. Set ${at}.allowUnauthenticatedFacilitator: true to accept anonymous access and the facilitator's limits, or configure facilitator.auth.`,
-        `${at}.allowUnauthenticatedFacilitator`
-      );
-    }
-    for (const [field, value] of credentialFields(input.facilitator.auth)) {
-      if (value.trim() === "") {
-        throw invalid(
-          `${at}: facilitator.auth.type is "${input.facilitator.auth.type}" but ${field} is empty. An empty credential is refused rather than sent.`,
-          `${at}.facilitator.auth.${field}`
-        );
-      }
-    }
-  }
-  if (/^0x0{40}$/i.test(input.payTo)) {
-    throw invalid(
-      `${at}: "${payTo}" is the zero address. Every payment settled there is destroyed.`,
-      `${at}.${payTo}`
-    );
-  }
-  if (mode !== "local" && isWellKnownDevAddress(input.payTo)) {
-    throw invalid(
-      `${at}: "${payTo}" (${input.payTo}) is a well-known Anvil development address and this is a ${mode} deployment. Anyone can spend what settles there. Set ${payTo} to your own merchant wallet.`,
-      `${at}.${payTo}`
-    );
-  }
-  const canonical = profile.canonicalAsset;
-  if (mode === "mainnet" && canonical) {
-    if (!sameAddress(input.asset, canonical.address)) {
-      throw invalid(
-        `${at}: asset ${input.asset} is not ${canonical.symbol} on ${profile.displayName} (expected ${canonical.address}). Settling a mainnet payment in an unintended token is refused.`,
-        `${at}.asset`
-      );
-    }
-    if (input.assetName !== void 0 && input.assetName !== canonical.name) {
-      throw invalid(
-        `${at}: assetName "${input.assetName}" is not the EIP-712 domain name ${canonical.symbol} reports on ${profile.displayName} (expected "${canonical.name}"). Every payment would be refused after the buyer signed.`,
-        `${at}.assetName`
-      );
-    }
-    if (input.assetVersion !== void 0 && input.assetVersion !== canonical.version) {
-      throw invalid(
-        `${at}: assetVersion "${input.assetVersion}" is not the EIP-712 domain version ${canonical.symbol} reports on ${profile.displayName} (expected "${canonical.version}").`,
-        `${at}.assetVersion`
-      );
-    }
-  }
-  return { profile, mode };
-}
-function assertFacilitatorUrlIsSafe(url, mode, at) {
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch (cause) {
-    throw new CommerceError("CONFIG_INVALID", `${at}: facilitator.url is not a valid URL`, {
-      cause,
-      details: { path: `${at}.facilitator.url` }
-    });
-  }
-  if (parsed.protocol === "https:") return;
-  if (parsed.protocol !== "http:") {
-    throw invalid(
-      `${at}: facilitator ${describeOrigin(url)} must be reached over https (or http on a local/private host); got "${parsed.protocol}//"`,
-      `${at}.facilitator.url`
-    );
-  }
-  if (mode !== "mainnet" && isLikelyLocalOrPrivateHost(parsed.hostname)) return;
-  throw invalid(
-    `${at}: facilitator ${describeOrigin(url)} is reached over plain HTTP. Payment authorizations and settlement results would travel unencrypted. Use https, or point at a local/private host on a non-mainnet deployment.`,
-    `${at}.facilitator.url`
-  );
-}
-function describeOrigin(url) {
-  try {
-    return new URL(url).origin;
-  } catch {
-    return "[unparseable facilitator.url]";
-  }
-}
-function credentialFields(auth) {
-  switch (auth.type) {
-    case "bearer":
-      return [["token", auth.token]];
-    case "cdp":
-      return [
-        ["apiKeyId", auth.apiKeyId],
-        ["apiKeySecret", auth.apiKeySecret]
-      ];
-    default:
-      return [];
-  }
-}
-function sameAddress(a, b) {
-  return a.toLowerCase() === b.toLowerCase();
-}
-var init_guardrails = __esm({
-  "src/payments/x402/guardrails.ts"() {
-    init_core();
-    init_dev_key_guard();
-    init_networks();
-  }
-});
-
-// src/payments/x402/payment-flow.ts
-var X402_PAYMENT_FLOWS, X402_DEFAULT_PAYMENT_FLOW;
-var init_payment_flow = __esm({
-  "src/payments/x402/payment-flow.ts"() {
-    X402_PAYMENT_FLOWS = ["authorization", "upfront"];
-    X402_DEFAULT_PAYMENT_FLOW = "authorization";
-  }
-});
-
-// src/protocols/mcp/constants.ts
-var MCP_TOOL_NAME_CHARS, MCP_TOOL_NAME_MAX_LENGTH, MCP_TOOL_NAME_PATTERN;
-var init_constants4 = __esm({
-  "src/protocols/mcp/constants.ts"() {
-    MCP_TOOL_NAME_CHARS = "A-Za-z0-9._-";
-    MCP_TOOL_NAME_MAX_LENGTH = 128;
-    MCP_TOOL_NAME_PATTERN = new RegExp(
-      `^[${MCP_TOOL_NAME_CHARS}]{1,${MCP_TOOL_NAME_MAX_LENGTH}}$`
-    );
-  }
-});
-function parseConfig(raw, env) {
-  if (!isRecord(raw)) {
-    throw new CommerceError(
-      "CONFIG_INVALID",
-      'Configuration root must be a mapping (object) at "$"',
-      {
-        details: { path: "$" }
-      }
-    );
-  }
-  checkVersion(raw);
-  const substituted = substituteEnv(raw, env);
-  const parsed = parseWithZod(RawConfigSchema, substituted);
-  return normalize(parsed);
-}
-function checkVersion(raw) {
-  if (!("version" in raw)) {
-    throw new CommerceError("CONFIG_INVALID", 'Configuration is missing required field "version"', {
-      details: { path: "version" }
-    });
-  }
-  const version = raw["version"];
-  if (version !== SUPPORTED_CONFIG_VERSION) {
-    const hint = typeof version === "string" ? ", written as a number without quotes" : "";
-    throw new CommerceError(
-      "CONFIG_INVALID",
-      `Unsupported config version "${String(version)}": this gateway only supports version ${SUPPORTED_CONFIG_VERSION}${hint}`,
-      { details: { path: "version", supported: SUPPORTED_CONFIG_VERSION } }
-    );
-  }
-}
-function parseWithZod(schema, value) {
-  const result = schema.safeParse(value);
-  if (!result.success) {
-    throw zodErrorToConfigError(result.error);
-  }
-  return result.data;
-}
-function zodErrorToConfigError(error) {
-  const issues = error.issues.map(describeIssue);
-  const first = issues[0];
-  const message = first ? `Configuration invalid at "${first.path}": ${first.message}` : "Configuration invalid";
-  return new CommerceError("CONFIG_INVALID", message, { details: { issues } });
-}
-function describeIssue(issue) {
-  const path2 = issue.path.length > 0 ? issue.path.join(".") : "$";
-  return { path: path2, message: issue.message, code: issue.code };
-}
-function toNumber(value, path2, bounds = {}) {
-  if (typeof value === "string" && !/^\s*\d+\s*$/.test(value)) {
-    throw new CommerceError(
-      "CONFIG_INVALID",
-      `Configuration value at "${path2}" must be an integer written in decimal digits (got ${value === "" ? "an empty string" : `"${value}"`})`,
-      { details: { path: path2 } }
-    );
-  }
-  const n = typeof value === "number" ? value : Number(value);
-  if (!Number.isFinite(n) || !Number.isInteger(n)) {
-    throw new CommerceError(
-      "CONFIG_INVALID",
-      `Configuration value at "${path2}" must be an integer`,
-      {
-        details: { path: path2 }
-      }
-    );
-  }
-  if (bounds.min !== void 0 && n < bounds.min) {
-    throw new CommerceError(
-      "CONFIG_INVALID",
-      `Configuration value at "${path2}" must be >= ${bounds.min}`,
-      {
-        details: { path: path2 }
-      }
-    );
-  }
-  if (bounds.max !== void 0 && n > bounds.max) {
-    throw new CommerceError(
-      "CONFIG_INVALID",
-      `Configuration value at "${path2}" must be <= ${bounds.max}`,
-      {
-        details: { path: path2 }
-      }
-    );
-  }
-  return n;
-}
-function toBoolean(value, path2) {
-  if (typeof value === "boolean") return value;
-  const normalized = value.trim().toLowerCase();
-  if (normalized === "true") return true;
-  if (normalized === "false") return false;
-  throw new CommerceError(
-    "CONFIG_INVALID",
-    `Configuration value at "${path2}" must be a boolean ("true" or "false")`,
-    { details: { path: path2 } }
-  );
-}
-function normalize(raw) {
-  const protocols = {
-    http: { enabled: toBoolean(raw.protocols.http.enabled, "protocols.http.enabled") },
-    mcp: {
-      enabled: toBoolean(raw.protocols.mcp.enabled, "protocols.mcp.enabled"),
-      mountPath: raw.protocols.mcp.mountPath
-    },
-    a2a: {
-      enabled: toBoolean(raw.protocols.a2a?.enabled ?? false, "protocols.a2a.enabled"),
-      mountPath: raw.protocols.a2a?.mountPath ?? DEFAULT_A2A_MOUNT_PATH
-    },
-    acp: normalizeAcp(raw.protocols.acp)
-  };
-  validateMountPaths(protocols);
-  const x402Raw = raw.payments.x402;
-  const x402 = x402Raw !== void 0 ? {
-    enabled: toBoolean(x402Raw.enabled, "payments.x402.enabled"),
-    network: x402Raw.network,
-    rpcUrl: x402Raw.rpcUrl,
-    asset: x402Raw.asset,
-    assetName: x402Raw.assetName,
-    assetVersion: x402Raw.assetVersion,
-    assetDecimals: toNumber(x402Raw.assetDecimals, "payments.x402.assetDecimals", {
-      min: 0,
-      max: 36
-    }),
-    payTo: x402Raw.payTo,
-    maxTimeoutSeconds: toNumber(
-      x402Raw.maxTimeoutSeconds,
-      "payments.x402.maxTimeoutSeconds",
-      {
-        min: 1
-      }
-    ),
-    paymentFlow: x402Raw.paymentFlow ?? X402_DEFAULT_PAYMENT_FLOW,
-    facilitator: normalizeFacilitator(x402Raw.facilitator),
-    ...x402Raw.allowMainnet !== void 0 ? { allowMainnet: toBoolean(x402Raw.allowMainnet, "payments.x402.allowMainnet") } : {},
-    ...x402Raw.allowUnauthenticatedFacilitator !== void 0 ? {
-      allowUnauthenticatedFacilitator: toBoolean(
-        x402Raw.allowUnauthenticatedFacilitator,
-        "payments.x402.allowUnauthenticatedFacilitator"
-      )
-    } : {}
-  } : void 0;
-  if (x402) {
-    validateAddress("payments.x402.payTo", x402.payTo);
-    validateAddress("payments.x402.asset", x402.asset);
-    resolveX402Deployment({
-      network: x402.network,
-      payTo: x402.payTo,
-      asset: x402.asset,
-      assetName: x402.assetName,
-      assetVersion: x402.assetVersion,
-      facilitator: x402.facilitator,
-      ...x402.allowMainnet !== void 0 ? { allowMainnet: x402.allowMainnet } : {},
-      ...x402.allowUnauthenticatedFacilitator !== void 0 ? { allowUnauthenticatedFacilitator: x402.allowUnauthenticatedFacilitator } : {}
-    });
-  }
-  const mpp = normalizeMpp(raw.payments.mpp);
-  const ap2 = normalizeAp2(raw.authorization?.ap2);
-  if (ap2?.enabled) {
-    validateReplayStoreIsolated(ap2.replay.path, raw.storage.receipts.path, protocols.acp);
-  }
-  const resources = Object.entries(raw.resources).map(
-    ([id, entry]) => normalizeResource(id, entry, protocols, x402, mpp, ap2)
-  );
-  const resourcePaymentFlows = Object.fromEntries(
-    Object.entries(raw.resources).flatMap(
-      ([id, entry]) => entry.paymentFlow !== void 0 ? [[id, entry.paymentFlow]] : []
-    )
-  );
-  const hasFlowOverrides = Object.keys(resourcePaymentFlows).length > 0;
-  const x402WithFlows = x402 !== void 0 && hasFlowOverrides ? { ...x402, resourcePaymentFlows } : x402;
-  const mppWithFlows = mpp !== void 0 && hasFlowOverrides ? { ...mpp, resourcePaymentFlows } : mpp;
-  if (protocols.acp.enabled) validateAcpCheckoutMapping(protocols.acp, resources);
-  if (protocols.a2a.enabled && !resources.some((r) => r.exposedVia.includes("a2a"))) {
-    throw new CommerceError(
-      "CONFIG_INVALID",
-      'protocols.a2a.enabled is true but no resource lists "a2a" in its expose',
-      { details: { path: "protocols.a2a.enabled" } }
-    );
-  }
-  return {
-    version: SUPPORTED_CONFIG_VERSION,
-    merchant: {
-      id: raw.merchant.id,
-      name: raw.merchant.name,
-      publicBaseUrl: raw.merchant.publicBaseUrl
-    },
-    // Port 0 lets the OS pick a free port, for tests and throwaway instances
-    server: {
-      port: toNumber(raw.server.port, "server.port", { min: 0, max: 65535 }),
-      host: raw.server.host,
-      ...raw.server.adminToken !== void 0 ? { adminToken: raw.server.adminToken } : {},
-      allowedOrigins: raw.server.allowedOrigins ?? []
-    },
-    storage: { receipts: { driver: "sqlite", path: raw.storage.receipts.path } },
-    protocols,
-    resources,
-    payments: {
-      ...x402WithFlows !== void 0 ? { x402: x402WithFlows } : {},
-      ...mppWithFlows !== void 0 ? { mpp: mppWithFlows } : {}
-    },
-    ...ap2 !== void 0 ? { authorization: { ap2 } } : {}
-  };
-}
-function validateMountPaths(protocols) {
-  const mounts = [
-    ["mcp", protocols.mcp],
-    ["a2a", protocols.a2a],
-    ["acp", protocols.acp]
-  ].filter(([, p]) => p.enabled);
-  for (const [index, [nameA, a]] of mounts.entries()) {
-    for (const [nameB, b] of mounts.slice(index + 1)) {
-      const baseA = a.mountPath.replace(/\/+$/, "");
-      const baseB = b.mountPath.replace(/\/+$/, "");
-      if (baseA === baseB || baseA.startsWith(`${baseB}/`) || baseB.startsWith(`${baseA}/`)) {
-        throw new CommerceError(
-          "CONFIG_INVALID",
-          `protocols.${nameA}.mountPath ("${a.mountPath}") collides with protocols.${nameB}.mountPath ("${b.mountPath}") - each mount registers a wildcard, so overlapping prefixes cannot both be served`,
-          { details: { path: `protocols.${nameA}.mountPath` } }
-        );
-      }
-    }
-  }
-}
-function ap2Invalid(path2, message, extra = {}) {
-  return new CommerceError("CONFIG_INVALID", message, { details: { path: path2, ...extra } });
-}
-function normalizeAp2(raw) {
-  if (raw === void 0) return void 0;
-  if (!toBoolean(raw.enabled, "authorization.ap2.enabled")) return { enabled: false };
-  const specVersion = raw.specVersion ?? AP2_SPEC_VERSION;
-  if (specVersion !== AP2_SPEC_VERSION) {
-    throw ap2Invalid(
-      "authorization.ap2.specVersion",
-      `authorization.ap2.specVersion "${specVersion}" is not supported - this gateway verifies against the tagged AP2 release ${AP2_SPEC_VERSION} only`
-    );
-  }
-  const mode = raw.mode ?? AP2_MODES[0];
-  if (!AP2_MODES.includes(mode)) {
-    throw ap2Invalid(
-      "authorization.ap2.mode",
-      `authorization.ap2.mode "${mode}" is not supported. Supported: ${AP2_MODES.join(", ")}. Autonomous mode needs open mandates, agent key binding and constraint evaluation, none of which this release implements.`
-    );
-  }
-  if (raw.replay === void 0) {
-    throw ap2Invalid(
-      "authorization.ap2.replay",
-      "authorization.ap2.replay is required when AP2 is enabled - it names the SQLite file recording which mandates have been spent, and without it a verified mandate could authorize a second settlement"
-    );
-  }
-  const mandateIssuers = normalizeIssuers(
-    raw.trust?.mandateIssuers,
-    "authorization.ap2.trust.mandateIssuers"
-  );
-  const checkoutIssuers = normalizeIssuers(
-    raw.trust?.checkoutIssuers,
-    "authorization.ap2.trust.checkoutIssuers"
-  );
-  return {
-    enabled: true,
-    specVersion: AP2_SPEC_VERSION,
-    mode,
-    trust: { mandateIssuers, checkoutIssuers },
-    clockSkewSeconds: toNumber(
-      raw.clockSkewSeconds ?? AP2_DEFAULT_CLOCK_SKEW_SECONDS,
-      "authorization.ap2.clockSkewSeconds",
-      { min: 0, max: AP2_MAX_CLOCK_SKEW_SECONDS }
-    ),
-    requireMandateAudience: toBoolean(
-      raw.requireMandateAudience ?? false,
-      "authorization.ap2.requireMandateAudience"
-    ),
-    requireMandateExpiry: toBoolean(
-      raw.requireMandateExpiry ?? false,
-      "authorization.ap2.requireMandateExpiry"
-    ),
-    replay: { path: raw.replay.path }
-  };
-}
-function normalizeIssuers(raw, path2) {
-  if (raw === void 0 || raw.length === 0) {
-    throw ap2Invalid(
-      path2,
-      `${path2} is required when AP2 is enabled and must name at least one issuer - trust is operator-configured and static, so an empty list means no mandate can ever verify`
-    );
-  }
-  const seen = /* @__PURE__ */ new Set();
-  return raw.map((entry, index) => {
-    const entryPath = `${path2}.${index}`;
-    if (seen.has(entry.issuer)) {
-      throw ap2Invalid(
-        `${entryPath}.issuer`,
-        `${entryPath}.issuer "${entry.issuer}" is listed twice - key lookup resolves by issuer, so a second entry for the same one is silently unreachable. Merge the keys into one entry instead (which is also how a rotation overlaps an old and a new key).`,
-        { issuer: entry.issuer }
-      );
-    }
-    seen.add(entry.issuer);
-    const kids = /* @__PURE__ */ new Set();
-    const keys = entry.keys.map((key, keyIndex) => {
-      const keyPath = `${entryPath}.keys.${keyIndex}`;
-      if (kids.has(key.kid)) {
-        throw ap2Invalid(
-          `${keyPath}.kid`,
-          `${keyPath}.kid "${key.kid}" is listed twice for issuer "${entry.issuer}" - a kid selects exactly one key, so which of the two verifies a signature would be undefined`,
-          { issuer: entry.issuer, kid: key.kid }
-        );
-      }
-      kids.add(key.kid);
-      return { kid: key.kid, jwk: validateJwk(key.jwk, key.kid, keyPath) };
-    });
-    return { issuer: entry.issuer, audience: entry.audience, keys };
-  });
-}
-function validateJwk(jwk, kid, path2) {
-  const fail = (detail) => {
-    throw ap2Invalid(`${path2}.jwk`, `${path2}.jwk (kid "${kid}") ${detail}`, { kid });
-  };
-  for (const member of Object.keys(jwk)) {
-    if (AP2_JWK_MEMBERS.includes(member)) continue;
-    if (member === "d" || member === "k") {
-      fail(
-        `carries private key material ("${member}"). The gateway verifies signatures and never produces them; publish only the public half. Treat the pasted key as compromised and rotate it.`
-      );
-    }
-    fail(
-      `has unsupported member "${member}". Allowed: ${AP2_JWK_MEMBERS.join(", ")}. Members naming a URL are refused on purpose - keys are configured inline and never fetched.`
-    );
-  }
-  const value = (member) => {
-    const raw = jwk[member];
-    if (typeof raw !== "string" || raw.length === 0) {
-      fail(`must give "${member}" as a non-empty string`);
-    }
-    return raw;
-  };
-  if (value("kty") !== AP2_KEY_TYPE) {
-    fail(
-      `must have kty "${AP2_KEY_TYPE}" (got "${value("kty")}") - ${AP2_SIGNING_ALGORITHM} is the only accepted algorithm`
-    );
-  }
-  if (value("crv") !== AP2_JWK_CURVE) {
-    fail(
-      `must be on curve "${AP2_JWK_CURVE}" (got "${value("crv")}") - ${AP2_SIGNING_ALGORITHM} is the only accepted algorithm`
-    );
-  }
-  for (const coordinate of ["x", "y"]) {
-    const encoded = value(coordinate);
-    if (!/^[A-Za-z0-9_-]+$/.test(encoded)) {
-      fail(`coordinate "${coordinate}" is not base64url (no padding, no "+" or "/")`);
-    }
-    if (Buffer.from(encoded, "base64url").length !== AP2_JWK_COORDINATE_BYTES) {
-      fail(
-        `coordinate "${coordinate}" decodes to ${Buffer.from(encoded, "base64url").length} bytes; a ${AP2_JWK_CURVE} coordinate is ${AP2_JWK_COORDINATE_BYTES}`
-      );
-    }
-  }
-  if (jwk["alg"] !== void 0 && value("alg") !== AP2_SIGNING_ALGORITHM) {
-    fail(`declares alg "${value("alg")}"; only ${AP2_SIGNING_ALGORITHM} is accepted`);
-  }
-  if (jwk["use"] !== void 0 && value("use") !== "sig") {
-    fail(`declares use "${value("use")}"; a verification key must be "sig"`);
-  }
-  if (jwk["kid"] !== void 0 && value("kid") !== kid) {
-    fail(`declares kid "${value("kid")}", which disagrees with the configured kid "${kid}"`);
-  }
-  const normalized = {};
-  for (const member of AP2_JWK_MEMBERS) {
-    if (jwk[member] !== void 0) normalized[member] = value(member);
-  }
-  return normalized;
-}
-function validateReplayStoreIsolated(replayPath, receiptsPath, acp) {
-  if (replayPath === ":memory:") return;
-  const others = [["storage.receipts.path", receiptsPath]];
-  if (acp.enabled) others.push(["protocols.acp.idempotency.path", acp.idempotency.path]);
-  for (const [otherPath, other] of others) {
-    if (replayPath !== other) continue;
-    throw ap2Invalid(
-      "authorization.ap2.replay.path",
-      `authorization.ap2.replay.path is the same file as ${otherPath} ("${replayPath}") - the AP2 replay store keeps its own schema and must not share a database with another store`
-    );
-  }
-}
-function normalizeResourceAuthorization(id, entry, pricing, ap2) {
-  const required = entry.authorization?.required;
-  if (required === void 0) return void 0;
-  const path2 = `resources.${id}.authorization.required`;
-  const methods = [];
-  for (const method of required) {
-    if (!SUPPORTED_AUTHORIZATION_METHODS.has(method)) {
-      throw ap2Invalid(
-        path2,
-        `Resource "${id}" requires unsupported authorization method "${method}". Supported: ${[...SUPPORTED_AUTHORIZATION_METHODS].join(", ")}.`,
-        { resourceId: id, method }
-      );
-    }
-    if (methods.includes(method)) {
-      throw ap2Invalid(path2, `Resource "${id}" lists authorization method "${method}" twice`, {
-        resourceId: id,
-        method
-      });
-    }
-    if (method === "ap2" && (ap2 === void 0 || !ap2.enabled)) {
-      throw ap2Invalid(
-        path2,
-        `Resource "${id}" requires authorization method "ap2", which is not configured or not enabled under authorization.ap2`,
-        { resourceId: id, method }
-      );
-    }
-    methods.push(method);
-  }
-  if (pricing.type !== "fixed") {
-    throw ap2Invalid(
-      path2,
-      `Resource "${id}" requires authorization but its pricing is "${pricing.type}" - authorization proves a purchase was approved and never replaces payment, so it applies to fixed-price paid resources only in this release`,
-      { resourceId: id }
-    );
-  }
-  return { required: methods };
-}
-function acpInvalid(path2, message, extra = {}) {
-  return new CommerceError("CONFIG_INVALID", message, { details: { path: path2, ...extra } });
-}
-function normalizeAcp(raw) {
-  const mountPath = raw?.mountPath ?? DEFAULT_ACP_MOUNT_PATH;
-  if (raw === void 0 || !toBoolean(raw.enabled, "protocols.acp.enabled")) {
-    return { enabled: false, mountPath };
-  }
-  if (raw.auth === void 0) {
-    throw acpInvalid(
-      "protocols.acp.auth",
-      'protocols.acp.auth is required when ACP is enabled - every ACP checkout endpoint is authenticated, and "bearer" is the only scheme supported in this release'
-    );
-  }
-  if (raw.idempotency === void 0) {
-    throw acpInvalid(
-      "protocols.acp.idempotency",
-      "protocols.acp.idempotency is required when ACP is enabled - it names the SQLite file holding checkout idempotency records, and ACP makes the Idempotency-Key mandatory on every checkout POST"
-    );
-  }
-  const discovery = raw.discovery;
-  return {
-    enabled: true,
-    mountPath,
-    auth: raw.auth,
-    idempotency: {
-      path: raw.idempotency.path,
-      retentionHours: toNumber(
-        raw.idempotency.retentionHours ?? ACP_RETENTION_HOURS,
-        "protocols.acp.idempotency.retentionHours",
-        { min: ACP_RETENTION_HOURS }
-      ),
-      merchantIdempotent: raw.idempotency.merchantIdempotent ?? false
-    },
-    checkout: { operations: normalizeAcpOperations(raw.checkout) },
-    // Built key by key so absent metadata stays absent rather than `undefined`
-    ...discovery !== void 0 ? {
-      discovery: {
-        ...discovery.documentationUrl !== void 0 ? { documentationUrl: discovery.documentationUrl } : {},
-        ...discovery.supportedCurrencies !== void 0 ? { supportedCurrencies: discovery.supportedCurrencies } : {},
-        ...discovery.supportedLocales !== void 0 ? { supportedLocales: discovery.supportedLocales } : {},
-        ...discovery.interventionTypes !== void 0 ? { interventionTypes: discovery.interventionTypes } : {}
-      }
-    } : {}
-  };
-}
-function normalizeAcpOperations(checkout) {
-  const configured = checkout?.operations ?? {};
-  for (const key of Object.keys(configured)) {
-    if (!ACP_CHECKOUT_OPERATIONS.includes(key)) {
-      throw acpInvalid(
-        `protocols.acp.checkout.operations.${key}`,
-        `protocols.acp.checkout.operations names unknown ACP checkout operation "${key}". Supported: ${ACP_CHECKOUT_OPERATIONS.join(", ")}.`
-      );
-    }
-  }
-  const operations = {};
-  const claimedBy = /* @__PURE__ */ new Map();
-  for (const operation of ACP_CHECKOUT_OPERATIONS) {
-    const path2 = `protocols.acp.checkout.operations.${operation}`;
-    const resourceId = configured[operation];
-    if (resourceId === void 0) {
-      throw acpInvalid(
-        path2,
-        `${path2} is required when ACP is enabled - all five checkout operations must be mapped, since ACP discovery advertises the checkout service as a whole`
-      );
-    }
-    const claimed = claimedBy.get(resourceId);
-    if (claimed !== void 0) {
-      throw acpInvalid(
-        path2,
-        `${path2} maps resource "${resourceId}", which is already mapped to "${claimed}" - each ACP checkout operation needs its own resource`,
-        { resourceId }
-      );
-    }
-    claimedBy.set(resourceId, operation);
-    operations[operation] = resourceId;
-  }
-  return operations;
-}
-function validateAcpCheckoutMapping(acp, resources) {
-  const byId = new Map(resources.map((resource) => [resource.id, resource]));
-  for (const operation of ACP_CHECKOUT_OPERATIONS) {
-    const resourceId = acp.checkout.operations[operation];
-    const path2 = `protocols.acp.checkout.operations.${operation}`;
-    const resource = byId.get(resourceId);
-    if (resource === void 0) {
-      throw acpInvalid(
-        path2,
-        `${path2} maps resource "${resourceId}", which is not defined under "resources"`,
-        { resourceId }
-      );
-    }
-    if (!resource.exposedVia.includes("acp")) {
-      throw acpInvalid(
-        path2,
-        `Resource "${resourceId}" implements ACP operation "${operation}" but does not list "acp" in its expose - the mapping says which resource serves the operation, expose says ACP may invoke it, and both are required`,
-        { resourceId }
-      );
-    }
-    if (resource.pricing.type !== "free" || resource.paymentMethods.length > 0) {
-      throw acpInvalid(
-        path2,
-        `Resource "${resourceId}" implements ACP operation "${operation}" and must use pricing.type "free" with no "payments" - ACP checkout carries the merchant's own purchase payment, so the gateway does not also charge for the invocation`,
-        { resourceId }
-      );
-    }
-    validateAcpOperationInput(path2, operation, resource);
-  }
-}
-function validateAcpOperationInput(path2, operation, resource) {
-  const schema = resource.inputSchema;
-  if (schema === void 0) return;
-  const keys = ACP_OPERATION_INPUT_KEYS[operation];
-  const optionalKeys = ACP_OPERATION_OPTIONAL_INPUT_KEYS[operation] ?? [];
-  const sent = [...keys, ...optionalKeys];
-  const topLevel = closedObjectProperties(schema);
-  if (topLevel !== void 0) {
-    for (const key of sent) {
-      if (!Object.hasOwn(topLevel, key)) {
-        const when = keys.includes(key) ? "always sends" : "sends when the caller supplies it";
-        throw acpInvalid(
-          path2,
-          `Resource "${resource.id}" implements ACP operation "${operation}" but its input schema sets additionalProperties: false without declaring "${key}", which the adapter ${when} for this operation`,
-          { resourceId: resource.id }
-        );
-      }
-    }
-  }
-  const declared = isRecord(schema["properties"]) ? schema["properties"] : {};
-  const pathKeys = closedObjectProperties(declared["path"]);
-  if (sent.includes("path") && pathKeys !== void 0 && !Object.hasOwn(pathKeys, ACP_SESSION_ID_INPUT_KEY)) {
-    throw acpInvalid(
-      path2,
-      `Resource "${resource.id}" implements ACP operation "${operation}" but its "path" schema sets additionalProperties: false without declaring "${ACP_SESSION_ID_INPUT_KEY}", which the adapter always sends inside "path"`,
-      { resourceId: resource.id }
-    );
-  }
-  const bodyKeys = closedObjectProperties(declared["body"]);
-  if (sent.includes("body") && bodyKeys !== void 0 && Object.keys(bodyKeys).length === 0) {
-    throw acpInvalid(
-      path2,
-      `Resource "${resource.id}" implements ACP operation "${operation}" but its "body" schema accepts no keys, so it refuses every ACP document. Config load closes an object schema that omits additionalProperties: declare body as { type: object, additionalProperties: true }`,
-      { resourceId: resource.id }
-    );
-  }
-  const required = schema["required"];
-  if (Array.isArray(required)) {
-    for (const entry of required) {
-      if (typeof entry === "string" && !keys.includes(entry)) {
-        throw acpInvalid(
-          path2,
-          `Resource "${resource.id}" implements ACP operation "${operation}" but its input schema requires "${entry}", which that operation does not always supply (it always sends: ${keys.join(", ")})`,
-          { resourceId: resource.id }
-        );
-      }
-    }
-  }
-}
-function closedObjectProperties(schema) {
-  if (!isRecord(schema) || schema["additionalProperties"] !== false) return void 0;
-  return isRecord(schema["properties"]) ? schema["properties"] : {};
-}
-function normalizeFacilitator(raw) {
-  return raw.mode === "local" ? { mode: "local", signerPrivateKey: raw.signerPrivateKey } : { mode: "remote", url: raw.url, auth: raw.auth ?? { type: "none" } };
-}
-function normalizeMpp(raw) {
-  if (raw === void 0) return void 0;
-  const network = raw.network ?? MPP_DEFAULT_NETWORK;
-  if (!isMppNetwork(network)) {
-    throw new CommerceError(
-      "CONFIG_INVALID",
-      `payments.mpp.network must be one of ${MPP_NETWORKS.join(", ")}`,
-      { details: { path: "payments.mpp.network" } }
-    );
-  }
-  const mpp = {
-    enabled: toBoolean(raw.enabled, "payments.mpp.enabled"),
-    network,
-    rpcUrl: raw.rpcUrl,
-    asset: raw.asset,
-    assetName: raw.assetName,
-    assetVersion: raw.assetVersion,
-    recipient: raw.recipient,
-    realm: raw.realm,
-    challengeSecret: raw.challengeSecret,
-    ...raw.challengeTtlSeconds !== void 0 ? {
-      challengeTtlSeconds: toNumber(
-        raw.challengeTtlSeconds,
-        "payments.mpp.challengeTtlSeconds",
-        { min: 1 }
-      )
-    } : {},
-    paymentFlow: raw.paymentFlow ?? X402_DEFAULT_PAYMENT_FLOW,
-    facilitator: normalizeFacilitator(raw.facilitator),
-    ...raw.allowMainnet !== void 0 ? { allowMainnet: toBoolean(raw.allowMainnet, "payments.mpp.allowMainnet") } : {},
-    ...raw.allowUnauthenticatedFacilitator !== void 0 ? {
-      allowUnauthenticatedFacilitator: toBoolean(
-        raw.allowUnauthenticatedFacilitator,
-        "payments.mpp.allowUnauthenticatedFacilitator"
-      )
-    } : {}
-  };
-  validateAddress("payments.mpp.recipient", mpp.recipient);
-  validateAddress("payments.mpp.asset", mpp.asset);
-  if (/[\r\n]/.test(mpp.realm)) {
-    throw new CommerceError("CONFIG_INVALID", "payments.mpp.realm must be a single line", {
-      details: { path: "payments.mpp.realm" }
-    });
-  }
-  if (mpp.challengeSecret.length < MPP_MIN_CHALLENGE_SECRET_LENGTH) {
-    throw new CommerceError(
-      "CONFIG_INVALID",
-      `payments.mpp.challengeSecret must have length at least ${MPP_MIN_CHALLENGE_SECRET_LENGTH}`,
-      { details: { path: "payments.mpp.challengeSecret" } }
-    );
-  }
-  resolveX402Deployment({
-    network: mpp.network,
-    payTo: mpp.recipient,
-    asset: mpp.asset,
-    assetName: mpp.assetName,
-    assetVersion: mpp.assetVersion,
-    facilitator: mpp.facilitator,
-    ...mpp.allowMainnet !== void 0 ? { allowMainnet: mpp.allowMainnet } : {},
-    ...mpp.allowUnauthenticatedFacilitator !== void 0 ? { allowUnauthenticatedFacilitator: mpp.allowUnauthenticatedFacilitator } : {},
-    configPath: "payments.mpp",
-    payToField: "recipient"
-  });
-  return mpp;
-}
-function normalizeResource(id, entry, protocols, x402, mpp, ap2) {
-  if (entry.input !== void 0) validateResourceSchemaKeywords(id, "input", entry.input);
-  const inputProperties = entry.input?.["properties"];
-  if (inputProperties && typeof inputProperties === "object") {
-    for (const reserved of RESERVED_INPUT_FIELDS) {
-      if (!(reserved in inputProperties)) continue;
-      throw new CommerceError(
-        "CONFIG_INVALID",
-        `Resource "${id}" declares an input property "${reserved}", which is reserved by the gateway`,
-        {
-          details: {
-            path: `resources.${id}.input.properties.${reserved}`,
-            resourceId: id
-          }
-        }
-      );
-    }
-  }
-  for (const protocol of entry.expose) {
-    if (!SUPPORTED_PROTOCOLS.has(protocol)) {
-      const hint = protocol === "ucp" ? " (UCP is planned, not supported in this release)" : "";
-      throw new CommerceError(
-        "CONFIG_INVALID",
-        `Resource "${id}" exposes unsupported protocol "${protocol}"${hint}. Supported: ${PROTOCOL_NAMES.join(", ")}.`,
-        { details: { path: `resources.${id}.expose`, resourceId: id, protocol } }
-      );
-    }
-  }
-  if (entry.expose.includes("mcp")) {
-    if (!protocols.mcp.enabled) {
-      throw new CommerceError(
-        "CONFIG_INVALID",
-        `Resource "${id}" is exposed via "mcp" but protocols.mcp.enabled is false`,
-        { details: { path: `resources.${id}.expose`, resourceId: id } }
-      );
-    }
-    if (!MCP_TOOL_NAME_PATTERN.test(id)) {
-      throw new CommerceError(
-        "CONFIG_INVALID",
-        `Resource "${id}" is exposed via "mcp" but its id is not a legal MCP tool name (allowed: A-Z, a-z, 0-9, "_", "-", ".", 1-128 chars)`,
-        { details: { path: `resources.${id}`, resourceId: id } }
-      );
-    }
-  }
-  if (entry.expose.includes("a2a") && !protocols.a2a.enabled) {
-    throw new CommerceError(
-      "CONFIG_INVALID",
-      `Resource "${id}" is exposed via "a2a" but protocols.a2a.enabled is false`,
-      { details: { path: `resources.${id}.expose`, resourceId: id } }
-    );
-  }
-  if (entry.expose.includes("acp") && !protocols.acp.enabled) {
-    throw new CommerceError(
-      "CONFIG_INVALID",
-      `Resource "${id}" is exposed via "acp" but protocols.acp.enabled is false`,
-      { details: { path: `resources.${id}.expose`, resourceId: id } }
-    );
-  }
-  if (entry.expose.includes("http") && !protocols.http.enabled) {
-    throw new CommerceError(
-      "CONFIG_INVALID",
-      `Resource "${id}" is exposed via "http" but protocols.http.enabled is false`,
-      { details: { path: `resources.${id}.expose`, resourceId: id } }
-    );
-  }
-  validateBackendUrl(id, entry.backend.url);
-  validateBackendHeaders(id, entry.backend.headers);
-  const pathScope = validateInputBindings(id, entry.backend, entry.input);
-  validatePathParametersDeclared(id, entry.backend.url, pathScope.schema, pathScope.where);
-  if (entry.pricing.type === "dynamic") {
-    throw new CommerceError(
-      "CONFIG_INVALID",
-      `Resource "${id}" uses pricing.type "dynamic", which is not supported in this release`,
-      { details: { path: `resources.${id}.pricing.type`, resourceId: id } }
-    );
-  }
-  if (entry.pricing.type === "fixed") {
-    validatePricingAmount(id, entry.pricing.amount, x402?.assetDecimals);
-  }
-  const paymentMethods = entry.payments ?? [];
-  if (entry.pricing.type === "fixed") {
-    if (paymentMethods.length === 0) {
-      throw new CommerceError(
-        "CONFIG_INVALID",
-        `Resource "${id}" has fixed pricing but declares no "payments" (a paid resource must name at least one payment method)`,
-        { details: { path: `resources.${id}.payments`, resourceId: id } }
-      );
-    }
-    for (const method of paymentMethods) {
-      if (!SUPPORTED_PAYMENT_METHODS.has(method)) {
-        throw new CommerceError(
-          "CONFIG_INVALID",
-          `Resource "${id}" names unsupported payment method "${method}". Supported: ${PAYMENT_METHOD_NAMES.join(", ")}.`,
-          { details: { path: `resources.${id}.payments`, resourceId: id, method } }
-        );
-      }
-    }
-    const enabledRails = [...x402?.enabled ? ["x402"] : [], ...mpp?.enabled ? ["mpp"] : []];
-    if (!paymentMethods.some((method) => enabledRails.includes(method))) {
-      throw new CommerceError(
-        "CONFIG_INVALID",
-        `Resource "${id}" names payment method(s) "${paymentMethods.join(", ")}", none of which is configured and enabled under "payments"`,
-        { details: { path: `resources.${id}.payments`, resourceId: id, paymentMethods } }
-      );
-    }
-    if (mpp?.enabled && paymentMethods.includes("mpp")) {
-      if (entry.pricing.currency !== MPP_PROFILE.assetSymbol) {
-        throw new CommerceError(
-          "CONFIG_INVALID",
-          `Resource "${id}" is priced in ${entry.pricing.currency}, but MPP charges ${MPP_PROFILE.assetSymbol}`,
-          { details: { path: `resources.${id}.pricing.currency`, resourceId: id } }
-        );
-      }
-      validatePricingAmount(id, entry.pricing.amount, MPP_PROFILE.assetDecimals);
-    }
-  }
-  if (entry.paymentFlow !== void 0 && (entry.pricing.type !== "fixed" || !paymentMethods.some((method) => method === "x402" || method === "mpp"))) {
-    throw new CommerceError(
-      "CONFIG_INVALID",
-      `Resource "${id}" sets paymentFlow, which requires fixed pricing and "x402" or "mpp" in payments`,
-      { details: { path: `resources.${id}.paymentFlow`, resourceId: id } }
-    );
-  }
-  const pricing = entry.pricing.type === "free" ? { type: "free" } : { type: "fixed", amount: entry.pricing.amount, currency: entry.pricing.currency };
-  const authorization = normalizeResourceAuthorization(id, entry, pricing, ap2);
-  return {
-    id,
-    name: entry.name,
-    ...entry.description !== void 0 ? { description: entry.description } : {},
-    inputSchema: entry.input !== void 0 ? defaultClosedObjectSchema(entry.input) : EMPTY_CLOSED_OBJECT_SCHEMA,
-    ...entry.output !== void 0 ? { outputSchema: entry.output } : {},
-    handler: {
-      type: "http",
-      method: entry.backend.method,
-      url: entry.backend.url,
-      ...entry.backend.headers !== void 0 ? { headers: entry.backend.headers } : {},
-      ...entry.backend.timeoutMs !== void 0 ? {
-        timeoutMs: toNumber(entry.backend.timeoutMs, `resources.${id}.backend.timeoutMs`, {
-          min: 1
-        })
-      } : {},
-      ...entry.backend.inputBindings !== void 0 ? { inputBindings: pickDefined(entry.backend.inputBindings) } : {}
-    },
-    pricing,
-    exposedVia: entry.expose,
-    paymentMethods,
-    ...authorization !== void 0 ? { authorization } : {}
-  };
-}
-function defaultClosedObjectSchema(schema) {
-  const isObjectSchema = isObjectSchemaNode(schema);
-  const result = { ...schema };
-  if (isObjectSchema) {
-    const properties = schema["properties"];
-    if (isRecord(properties)) {
-      result["properties"] = Object.fromEntries(
-        Object.entries(properties).map(([key, sub]) => [
-          key,
-          isRecord(sub) ? defaultClosedObjectSchema(sub) : sub
-        ])
-      );
-    }
-    if (!Object.hasOwn(schema, "additionalProperties")) {
-      result["additionalProperties"] = false;
-    }
-  }
-  const items = schema["items"];
-  if (isRecord(items)) {
-    result["items"] = defaultClosedObjectSchema(items);
-  }
-  const additional = schema["additionalProperties"];
-  if (isRecord(additional)) {
-    result["additionalProperties"] = defaultClosedObjectSchema(additional);
-  }
-  return result;
-}
-function excludesObjectType(schema) {
-  const type = schema["type"];
-  if (type === void 0 || type === "object") return false;
-  if (Array.isArray(type)) return !type.includes("object");
-  return true;
-}
-function validateResourceSchemaKeywords(id, path2, schema) {
-  for (const keyword of UNSUPPORTED_SCHEMA_KEYWORDS) {
-    if (Object.hasOwn(schema, keyword)) {
-      console.warn(
-        `[agent-commerce] resource "${id}" ${path2} uses JSON Schema keyword "${keyword}", which this gateway does not enforce (see src/core/execution/validation.ts for the supported subset). Remove it or treat it as documentation only.`
-      );
-    }
-  }
-  if ((Object.hasOwn(schema, "properties") || Object.hasOwn(schema, "required")) && excludesObjectType(schema)) {
-    throw new CommerceError(
-      "CONFIG_INVALID",
-      `Resource "${id}" ${path2} declares "properties" and/or "required" but its "type" (${JSON.stringify(schema["type"])}) does not include "object" - the validator will never route a value through either check under that type, so this schema claims to constrain input it does not actually enforce. Remove "properties"/"required", or include "object" in "type".`,
-      { details: { path: `resources.${id}.${path2}`, resourceId: id } }
-    );
-  }
-  const requiredRaw = schema["required"];
-  const closed = !Object.hasOwn(schema, "additionalProperties") ? true : schema["additionalProperties"] === false;
-  if (Array.isArray(requiredRaw) && closed && isObjectSchemaNode(schema)) {
-    const declared = isRecord(schema["properties"]) ? schema["properties"] : {};
-    const undeclared = requiredRaw.filter(
-      (name) => typeof name === "string" && !Object.hasOwn(declared, name)
-    );
-    if (undeclared.length > 0) {
-      throw new CommerceError(
-        "CONFIG_INVALID",
-        `Resource "${id}" ${path2} lists ${undeclared.map((n) => `"${n}"`).join(", ")} in "required" but does not declare ${undeclared.length === 1 ? "it" : "them"} in "properties". The schema is closed (additionalProperties: false), so ${undeclared.length === 1 ? "that name is" : "those names are"} rejected as an unknown key and no input can ever satisfy this schema. Declare ${undeclared.length === 1 ? "it" : "them"} in "properties".`,
-        { details: { path: `resources.${id}.${path2}`, resourceId: id, undeclared } }
-      );
-    }
-  }
-  const properties = schema["properties"];
-  if (isRecord(properties)) {
-    for (const [key, sub] of Object.entries(properties)) {
-      if (isRecord(sub)) validateResourceSchemaKeywords(id, `${path2}.properties.${key}`, sub);
-    }
-  }
-  const additional = schema["additionalProperties"];
-  if (isRecord(additional)) {
-    validateResourceSchemaKeywords(id, `${path2}.additionalProperties`, additional);
-  }
-  const items = schema["items"];
-  if (isRecord(items)) {
-    validateResourceSchemaKeywords(id, `${path2}.items`, items);
-  } else if (Array.isArray(items)) {
-    console.warn(
-      `[agent-commerce] resource "${id}" ${path2}.items is a tuple (an array of schemas), which this gateway does not enforce - only a single schema applied to every array element is supported (see src/core/execution/validation.ts). Each position's schema is unenforced; treat it as documentation only.`
-    );
-  }
-}
-function validatePricingAmount(id, amount, decimals) {
-  const path2 = `resources.${id}.pricing.amount`;
-  if (!PRICING_AMOUNT_PATTERN.test(amount)) {
-    throw new CommerceError(
-      "CONFIG_INVALID",
-      `Resource "${id}" has pricing.amount "${amount}", which is not a plain positive decimal (no currency symbol, no thousands separator, no exponent - e.g. "0.01")`,
-      { details: { path: path2, resourceId: id } }
-    );
-  }
-  if (ZERO_AMOUNT_PATTERN.test(amount)) {
-    throw new CommerceError(
-      "CONFIG_INVALID",
-      `Resource "${id}" has pricing.amount "0" - a paid resource cannot cost zero; use "pricing: { type: free }" instead`,
-      { details: { path: path2, resourceId: id } }
-    );
-  }
-  if (decimals !== void 0) {
-    const fractionalDigits = amount.includes(".") ? amount.split(".")[1]?.length ?? 0 : 0;
-    if (fractionalDigits > decimals) {
-      throw new CommerceError(
-        "CONFIG_INVALID",
-        `Resource "${id}" has pricing.amount "${amount}" with more precision (${fractionalDigits} fractional digits) than the configured asset supports (${decimals} decimals)`,
-        { details: { path: path2, resourceId: id } }
-      );
-    }
-  }
-}
-function validateInputBindings(id, backend, input) {
-  const legacy = { schema: input, where: "its input schema" };
-  const bindings = backend.inputBindings;
-  const templated = extractPathParameterNames(backend.url).length > 0;
-  if (bindings === void 0) return legacy;
-  const path2 = `resources.${id}.backend.inputBindings`;
-  const fail = (message, details = {}) => {
-    throw new CommerceError("CONFIG_INVALID", `Resource "${id}" ${message}`, {
-      details: { path: path2, resourceId: id, ...details }
-    });
-  };
-  const entries = Object.entries(bindings).filter(
-    (entry) => entry[1] !== void 0
-  );
-  if (entries.length === 0) {
-    fail("has an empty backend.inputBindings - remove the block to use the default mapping");
-  }
-  if (backend.method === "GET" || backend.method === "DELETE") {
-    if (bindings.body !== void 0) {
-      fail(
-        `binds a request body on a ${backend.method}, which sends none - the value would be silently dropped`
-      );
-    }
-  }
-  if (templated && bindings.path === void 0) {
-    fail(
-      'has backend.url path parameters but no "path" binding - in explicit binding mode nothing else supplies them, so every call would fail to reach the backend'
-    );
-  }
-  const seen = /* @__PURE__ */ new Map();
-  const properties = isRecord(input?.["properties"]) ? input["properties"] : {};
-  const required = new Set(
-    Array.isArray(input?.["required"]) ? input["required"].filter((value) => typeof value === "string") : []
-  );
-  for (const [location, property] of entries) {
-    if (RESERVED_INPUT_FIELDS.includes(property)) {
-      fail(`binds "${location}" to "${property}", which is reserved by the gateway`, { location });
-    }
-    const other = seen.get(property);
-    if (other !== void 0) {
-      fail(`binds both "${other}" and "${location}" to the input property "${property}"`, {
-        location,
-        property
-      });
-    }
-    seen.set(property, location);
-    if (!Object.hasOwn(properties, property)) {
-      fail(
-        `binds "${location}" to input property "${property}", which the input schema does not declare - the schema is closed, so a caller could never supply it`,
-        { location, property }
-      );
-    }
-    const declared = properties[property];
-    if (location !== "body" && isRecord(declared) && !isObjectSchemaNode(declared)) {
-      fail(
-        `binds "${location}" to input property "${property}", which is not an object schema - ${location} parameters are read as an object of name/value pairs`,
-        { location, property }
-      );
-    }
-  }
-  if (templated && bindings.path !== void 0 && !required.has(bindings.path)) {
-    fail(
-      `binds path parameters to input property "${bindings.path}" without listing it in the input schema's "required" - a caller that omits it cannot supply any path parameter, so the request could never be built`,
-      { property: bindings.path }
-    );
-  }
-  if (bindings.path === void 0) return { schema: void 0, where: "its input schema" };
-  const group = properties[bindings.path];
-  return {
-    schema: isRecord(group) ? group : void 0,
-    where: `input.properties.${bindings.path}`
-  };
-}
-function pickDefined(value) {
-  return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== void 0));
-}
-function validatePathParametersDeclared(id, url, input, where) {
-  const stray = findUnparsedBraceToken(url);
-  if (stray !== void 0) {
-    throw new CommerceError(
-      "CONFIG_INVALID",
-      `Resource "${id}" has backend.url containing "${stray}", which is not a valid path parameter (allowed characters: A-Z a-z 0-9 _ . -). It would reach the backend as literal text, so a paid resource would take payment for a request the backend cannot serve`,
-      { details: { path: `resources.${id}.backend.url`, resourceId: id, token: stray } }
-    );
-  }
-  const params = extractPathParameterNames(url);
-  if (params.length === 0) return;
-  const firstBrace = url.indexOf("{");
-  if (firstBrace !== -1) {
-    const prefix = url.slice(0, firstBrace);
-    let origin;
-    try {
-      const parsedPrefix = new URL(prefix);
-      origin = parsedPrefix.hostname === "" ? void 0 : parsedPrefix.origin;
-    } catch {
-    }
-    if (origin === void 0 || !prefix.startsWith(`${origin}/`)) {
-      throw new CommerceError(
-        "CONFIG_INVALID",
-        `Resource "${id}" has a backend.url parameter before the end of the host. A caller-supplied value would choose which host the gateway calls, which is request forgery with the gateway's own network position. Parameters are supported inside the path and query only`,
-        { details: { path: `resources.${id}.backend.url`, resourceId: id } }
-      );
-    }
-  }
-  const propertiesRaw = input?.["properties"];
-  const properties = isRecord(propertiesRaw) ? propertiesRaw : {};
-  const requiredRaw = input?.["required"];
-  const required = new Set(
-    Array.isArray(requiredRaw) ? requiredRaw.filter((entry) => typeof entry === "string") : []
-  );
-  for (const param of params) {
-    const path2 = `resources.${id}.backend.url`;
-    if (!Object.hasOwn(properties, param)) {
-      throw new CommerceError(
-        "CONFIG_INVALID",
-        `Resource "${id}" has backend.url path parameter "{${param}}" which is not declared in ${where} - the caller has no way to supply it, so every call would be refused`,
-        { details: { path: path2, resourceId: id, param } }
-      );
-    }
-    if (!required.has(param)) {
-      throw new CommerceError(
-        "CONFIG_INVALID",
-        `Resource "${id}" has backend.url path parameter "{${param}}" declared in ${where} but not listed in its "required" - a call that omits it would be refused`,
-        { details: { path: path2, resourceId: id, param } }
-      );
-    }
-  }
-}
-function validateBackendUrl(id, url) {
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    throw new CommerceError(
-      "CONFIG_INVALID",
-      `Resource "${id}" has an invalid backend.url: must be an absolute http:// or https:// URL`,
-      { details: { path: `resources.${id}.backend.url`, resourceId: id } }
-    );
-  }
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    throw new CommerceError(
-      "CONFIG_INVALID",
-      `Resource "${id}" has a backend.url with scheme "${parsed.protocol}": must be http:// or https://`,
-      { details: { path: `resources.${id}.backend.url`, resourceId: id } }
-    );
-  }
-}
-function validateBackendHeaders(id, headers) {
-  for (const [name, value] of Object.entries(headers ?? {})) {
-    try {
-      new Headers([[name, value]]);
-    } catch {
-      throw new CommerceError(
-        "CONFIG_INVALID",
-        `Resource "${id}" has backend header "${name}" with an illegal name or value (a name must be an HTTP token; a value must not contain NUL, a character above U+00FF, or a line break except at either end, which fetch trims)`,
-        { details: { path: `resources.${id}.backend.headers.${name}`, resourceId: id } }
-      );
-    }
-  }
-}
-function validateAddress(path2, value) {
-  if (!ADDRESS_PATTERN.test(value)) {
-    throw new CommerceError(
-      "CONFIG_INVALID",
-      `Configuration value at "${path2}" is not a plausible address (expected "0x" followed by 40 hex characters)`,
-      { details: { path: path2 } }
-    );
-  }
-  if (ZERO_ADDRESS_PATTERN.test(value)) {
-    throw new CommerceError(
-      "CONFIG_INVALID",
-      `Configuration value at "${path2}" must not be the zero address`,
-      {
-        details: { path: path2 }
-      }
-    );
-  }
-}
-var SUPPORTED_CONFIG_VERSION, ADDRESS_PATTERN, ZERO_ADDRESS_PATTERN, NumberOrString, BooleanOrString, MerchantSchema, ServerSchema, StorageSchema, RESERVED_GATEWAY_PATHS, MountPathSchema, AcpAuthSchema, AcpIdempotencySchema, AcpCheckoutSchema, AcpDiscoverySchema, ProtocolsSchema, DEFAULT_A2A_MOUNT_PATH, DEFAULT_ACP_MOUNT_PATH, ACP_RETENTION_HOURS, BackendMethodSchema, BackendInputBindingsSchema, BackendHandlerSchema, PricingSchema, JsonSchemaValueSchema, ResourceEntrySchema, ResourcesMapSchema, FacilitatorAuthSchema, FacilitatorSchema, X402Schema, MppSchema, PaymentsSchema, Ap2KeySchema, Ap2IssuerSchema, Ap2Schema, AuthorizationSchema, RawConfigSchema, SUPPORTED_PROTOCOLS, SUPPORTED_PAYMENT_METHODS, SUPPORTED_AUTHORIZATION_METHODS, EMPTY_CLOSED_OBJECT_SCHEMA, UNSUPPORTED_SCHEMA_KEYWORDS, PRICING_AMOUNT_PATTERN, ZERO_AMOUNT_PATTERN;
-var init_schema = __esm({
-  "src/config/schema.ts"() {
-    init_constants();
-    init_core();
-    init_execution();
-    init_is_record();
-    init_constants2();
-    init_guardrails();
-    init_payment_flow();
-    init_constants3();
-    init_constants4();
-    init_env();
-    SUPPORTED_CONFIG_VERSION = 1;
-    ADDRESS_PATTERN = /^0x[0-9a-fA-F]{40}$/;
-    ZERO_ADDRESS_PATTERN = /^0x0{40}$/i;
-    NumberOrString = z.union([z.number(), z.string()]);
-    BooleanOrString = z.union([z.boolean(), z.string()]);
-    MerchantSchema = z.object({
-      id: z.string().min(1),
-      name: z.string().min(1),
-      publicBaseUrl: z.string().min(1)
-    }).strict();
-    ServerSchema = z.object({
-      port: NumberOrString,
-      host: z.string().min(1),
-      // Shared secret gating /api/receipts and /api/events. Without it both
-      // routes 404.
-      adminToken: z.string().min(1).optional(),
-      // Browser origins allowed to call the gateway; none by default. A request
-      // with any other `Origin` gets 403 on every route. Entries match the
-      // `Origin` header exactly (ignoring case), so `"*"` and a trailing slash
-      // would match nothing: a silent lockout that an operator might "fix" by
-      // disabling the check. Both are refused with a pointer.
-      allowedOrigins: z.array(
-        z.string().min(1).refine((origin) => origin !== "*", {
-          message: `wildcard "*" is not supported - allowedOrigins entries are matched literally against the browser's Origin header, so "*" would match nothing. List each scheme://host[:port] explicitly.`
-        }).refine((origin) => !origin.endsWith("/"), {
-          message: 'must not end with "/" - a browser Origin header never has a trailing slash, so this entry would match nothing. Use e.g. "http://localhost:5173".'
-        })
-      ).optional()
-    }).strict();
-    StorageSchema = z.object({
-      receipts: z.object({
-        driver: z.literal("sqlite"),
-        path: z.string().min(1)
-      }).strict()
-    }).strict();
-    RESERVED_GATEWAY_PATHS = [
-      "/health",
-      "/ready",
-      "/.well-known/agent-commerce",
-      // Fixed by the A2A specification and served by the adapter
-      "/.well-known/agent-card.json",
-      // Fixed by the ACP specification
-      ACP_WELL_KNOWN_PATH,
-      "/api/resources",
-      "/api/resources/:id/invoke",
-      "/api/receipts",
-      "/api/events"
-    ];
-    MountPathSchema = z.string().min(1).refine((value) => value.startsWith("/"), {
-      message: 'must start with "/" - it is an absolute gateway path, e.g. "/mcp".'
-    }).refine((value) => !/[:*?\s]/.test(value), {
-      message: 'must not contain ":", "*", "?" or whitespace - the mount is a literal path prefix, not a Fastify route pattern, and registers its own wildcard.'
-    }).refine(
-      (value) => {
-        const base = value.replace(/\/+$/, "");
-        return !RESERVED_GATEWAY_PATHS.some(
-          (reserved) => reserved === base || reserved.startsWith(`${base}/`)
-        );
-      },
-      {
-        message: `must not collide with a route the gateway already serves (${RESERVED_GATEWAY_PATHS.join(", ")}); pick a dedicated prefix such as "/mcp".`
-      }
-    );
-    AcpAuthSchema = z.object({ type: z.literal("bearer"), token: z.string().min(1) }).strict();
-    AcpIdempotencySchema = z.object({
-      path: z.string().min(1),
-      retentionHours: NumberOrString.optional(),
-      merchantIdempotent: z.boolean().optional()
-    }).strict();
-    AcpCheckoutSchema = z.object({ operations: z.record(z.string().min(1)) }).strict();
-    AcpDiscoverySchema = z.object({
-      documentationUrl: z.string().min(1).optional(),
-      supportedCurrencies: z.array(z.string().min(1)).optional(),
-      supportedLocales: z.array(z.string().min(1)).optional(),
-      interventionTypes: z.array(z.string().min(1)).optional()
-    }).strict();
-    ProtocolsSchema = z.object({
-      http: z.object({ enabled: BooleanOrString }).strict(),
-      mcp: z.object({
-        enabled: BooleanOrString,
-        mountPath: MountPathSchema
-      }).strict(),
-      // Optional; A2A is off unless configured
-      a2a: z.object({
-        enabled: BooleanOrString,
-        mountPath: MountPathSchema.optional()
-      }).strict().optional(),
-      // Optional and off by default. The business pass requires the sub-blocks
-      // only when ACP is enabled, so a disabled placeholder stays valid and an
-      // enabled block gets a message naming what it lacks.
-      acp: z.object({
-        enabled: BooleanOrString,
-        mountPath: MountPathSchema.optional(),
-        auth: AcpAuthSchema.optional(),
-        idempotency: AcpIdempotencySchema.optional(),
-        checkout: AcpCheckoutSchema.optional(),
-        discovery: AcpDiscoverySchema.optional()
-      }).strict().optional()
-    }).strict();
-    DEFAULT_A2A_MOUNT_PATH = "/a2a";
-    DEFAULT_ACP_MOUNT_PATH = "/acp";
-    ACP_RETENTION_HOURS = 24;
-    BackendMethodSchema = z.enum(["GET", "POST", "PUT", "PATCH", "DELETE"]);
-    BackendInputBindingsSchema = z.object({
-      path: z.string().min(1).optional(),
-      query: z.string().min(1).optional(),
-      body: z.string().min(1).optional()
-    }).strict();
-    BackendHandlerSchema = z.object({
-      type: z.literal("http"),
-      method: BackendMethodSchema,
-      url: z.string().min(1),
-      headers: z.record(z.string(), z.string()).optional(),
-      timeoutMs: NumberOrString.optional(),
-      inputBindings: BackendInputBindingsSchema.optional()
-    }).strict();
-    PricingSchema = z.discriminatedUnion("type", [
-      z.object({ type: z.literal("free") }).strict(),
-      z.object({
-        type: z.literal("fixed"),
-        amount: z.string().min(1),
-        currency: z.string().min(1)
-      }).strict(),
-      z.object({
-        type: z.literal("dynamic"),
-        resolver: z.string().min(1)
-      }).strict()
-    ]);
-    JsonSchemaValueSchema = z.record(z.string(), z.unknown());
-    ResourceEntrySchema = z.object({
-      name: z.string().min(1),
-      description: z.string().optional(),
-      input: JsonSchemaValueSchema.optional(),
-      output: JsonSchemaValueSchema.optional(),
-      backend: BackendHandlerSchema,
-      pricing: PricingSchema,
-      expose: z.array(z.string().min(1)).min(1),
-      payments: z.array(z.string().min(1)).optional(),
-      paymentFlow: z.enum(X402_PAYMENT_FLOWS).optional(),
-      authorization: z.object({ required: z.array(z.string().min(1)).min(1) }).strict().optional()
-    }).strict();
-    ResourcesMapSchema = z.record(z.string().min(1), ResourceEntrySchema);
-    FacilitatorAuthSchema = z.discriminatedUnion("type", [
-      z.object({ type: z.literal("none") }).strict(),
-      z.object({ type: z.literal("bearer"), token: z.string().min(1) }).strict(),
-      // Coinbase Developer Platform. Needs the optional peer `@coinbase/x402`,
-      // which signs a fresh JWT per request.
-      z.object({
-        type: z.literal("cdp"),
-        apiKeyId: z.string().min(1),
-        apiKeySecret: z.string().min(1)
-      }).strict()
-    ]);
-    FacilitatorSchema = z.discriminatedUnion("mode", [
-      z.object({
-        mode: z.literal("local"),
-        signerPrivateKey: z.string().min(1)
-      }).strict(),
-      z.object({
-        mode: z.literal("remote"),
-        url: z.string().min(1),
-        // Absent auth sends no credential and normalizes to `{ type: 'none' }`,
-        // which on mainnet requires `allowUnauthenticatedFacilitator`
-        auth: FacilitatorAuthSchema.optional()
-      }).strict()
-    ]);
-    X402Schema = z.object({
-      enabled: BooleanOrString,
-      network: z.string().min(1),
-      rpcUrl: z.string().min(1),
-      asset: z.string().min(1),
-      assetName: z.string().min(1),
-      assetVersion: z.string().min(1),
-      assetDecimals: NumberOrString,
-      payTo: z.string().min(1),
-      maxTimeoutSeconds: NumberOrString,
-      // `authorization` (the x402 default) settles after the backend call
-      paymentFlow: z.enum(X402_PAYMENT_FLOWS).optional(),
-      facilitator: FacilitatorSchema,
-      // Real funds. Never defaulted; see src/payments/x402/guardrails.ts
-      allowMainnet: BooleanOrString.optional(),
-      // Accepts credential-free facilitator access on mainnet. Never defaulted
-      allowUnauthenticatedFacilitator: BooleanOrString.optional()
-    }).strict();
-    MppSchema = z.object({
-      enabled: BooleanOrString,
-      network: z.string().min(1).optional(),
-      rpcUrl: z.string().min(1),
-      asset: z.string().min(1),
-      assetName: z.string().min(1),
-      assetVersion: z.string().min(1),
-      recipient: z.string().min(1),
-      realm: z.string().min(1),
-      challengeSecret: z.string().min(1),
-      challengeTtlSeconds: NumberOrString.optional(),
-      // Same values and default as `payments.x402.paymentFlow`
-      paymentFlow: z.enum(X402_PAYMENT_FLOWS).optional(),
-      facilitator: FacilitatorSchema,
-      // Real funds. Never defaulted; see src/payments/x402/guardrails.ts
-      allowMainnet: BooleanOrString.optional(),
-      // Accepts credential-free facilitator access on mainnet. Never defaulted
-      allowUnauthenticatedFacilitator: BooleanOrString.optional()
-    }).strict();
-    PaymentsSchema = z.object({
-      x402: X402Schema.optional(),
-      mpp: MppSchema.optional()
-    }).strict();
-    Ap2KeySchema = z.object({
-      kid: z.string().min(1),
-      jwk: z.record(z.string(), z.unknown())
-    }).strict();
-    Ap2IssuerSchema = z.object({
-      issuer: z.string().min(1),
-      // Required, not defaulted: without it a mandate minted for another
-      // merchant would verify here
-      audience: z.string().min(1),
-      keys: z.array(Ap2KeySchema).min(1)
-    }).strict();
-    Ap2Schema = z.object({
-      enabled: BooleanOrString,
-      specVersion: z.string().min(1).optional(),
-      mode: z.string().min(1).optional(),
-      trust: z.object({
-        mandateIssuers: z.array(Ap2IssuerSchema).optional(),
-        checkoutIssuers: z.array(Ap2IssuerSchema).optional()
-      }).strict().optional(),
-      clockSkewSeconds: NumberOrString.optional(),
-      requireMandateAudience: BooleanOrString.optional(),
-      requireMandateExpiry: BooleanOrString.optional(),
-      replay: z.object({ path: z.string().min(1) }).strict().optional()
-    }).strict();
-    AuthorizationSchema = z.object({ ap2: Ap2Schema.optional() }).strict();
-    RawConfigSchema = z.object({
-      version: z.literal(SUPPORTED_CONFIG_VERSION),
-      merchant: MerchantSchema,
-      server: ServerSchema,
-      storage: StorageSchema,
-      protocols: ProtocolsSchema,
-      resources: ResourcesMapSchema,
-      payments: PaymentsSchema,
-      authorization: AuthorizationSchema.optional()
-    }).strict();
-    SUPPORTED_PROTOCOLS = new Set(PROTOCOL_NAMES);
-    SUPPORTED_PAYMENT_METHODS = new Set(PAYMENT_METHOD_NAMES);
-    SUPPORTED_AUTHORIZATION_METHODS = /* @__PURE__ */ new Set(["ap2"]);
-    EMPTY_CLOSED_OBJECT_SCHEMA = {
-      type: "object",
-      properties: {},
-      additionalProperties: false
-    };
-    UNSUPPORTED_SCHEMA_KEYWORDS = [
-      "pattern",
-      "minLength",
-      "maxLength",
-      "format",
-      "minimum",
-      "maximum",
-      "exclusiveMinimum",
-      "exclusiveMaximum",
-      "multipleOf",
-      "oneOf",
-      "anyOf",
-      "allOf",
-      "not",
-      "$ref",
-      "const",
-      "patternProperties",
-      "minItems",
-      "maxItems",
-      "uniqueItems"
-    ];
-    PRICING_AMOUNT_PATTERN = /^\d+(?:\.\d+)?$/;
-    ZERO_AMOUNT_PATTERN = /^0(?:\.0+)?$/;
-  }
-});
-async function loadConfig(options = {}) {
-  const env = options.env ?? process.env;
-  const cwd = options.cwd ?? process.cwd();
-  const configPath = resolveConfigPath(options.path, env, cwd);
-  let text2;
-  try {
-    text2 = await promises.readFile(configPath, "utf8");
-  } catch (error) {
-    throw new CommerceError("CONFIG_INVALID", `Could not read configuration file "${configPath}"`, {
-      details: { path: configPath },
-      cause: error
-    });
-  }
-  let raw;
-  try {
-    raw = parse(text2);
-  } catch (error) {
-    const { reason, details } = describeYamlError(error);
-    throw new CommerceError(
-      "CONFIG_INVALID",
-      `Configuration file "${configPath}" is not valid YAML: ${reason}`,
-      {
-        details: { path: configPath, ...details },
-        // Kept for programmatic callers. Never print it: its `.message` quotes
-        // the source line (see describeYamlError).
-        cause: error
-      }
-    );
-  }
-  return parseConfig(raw, env);
-}
-function describeYamlError(error) {
-  if (!(error instanceof YAMLError)) {
-    return { reason: "unknown YAML parse error", details: {} };
-  }
-  const start = error.linePos?.[0];
-  const where = start === void 0 ? "" : ` at line ${String(start.line)}, column ${String(start.col)}`;
-  const explanation = YAML_ERROR_EXPLANATIONS[error.code];
-  const what = explanation === void 0 ? error.code : `${error.code} (${explanation})`;
-  return {
-    reason: `${what}${where}`,
-    details: {
-      yamlErrorCode: error.code,
-      ...start === void 0 ? {} : { line: start.line, column: start.col }
-    }
-  };
-}
-function resolveConfigPath(explicitPath, env, cwd) {
-  if (explicitPath) return path.resolve(cwd, explicitPath);
-  const fromEnv = env[CONFIG_PATH_ENV_VAR];
-  if (fromEnv) return path.resolve(cwd, fromEnv);
-  return path.resolve(cwd, DEFAULT_CONFIG_FILENAME);
-}
-var CONFIG_PATH_ENV_VAR, YAML_ERROR_EXPLANATIONS;
-var init_load = __esm({
-  "src/config/load.ts"() {
-    init_core();
-    init_filename();
-    init_schema();
-    CONFIG_PATH_ENV_VAR = "AGENT_COMMERCE_CONFIG";
-    YAML_ERROR_EXPLANATIONS = {
-      DUPLICATE_KEY: "map keys must be unique",
-      BAD_INDENT: "bad indentation",
-      TAB_AS_INDENT: "tabs cannot be used for indentation",
-      MISSING_CHAR: "a required character is missing",
-      BLOCK_AS_IMPLICIT_KEY: "a block value cannot be used as a key (missing quotes, or a stray colon)",
-      MULTILINE_IMPLICIT_KEY: "a key spans multiple lines (missing quotes, or a stray colon)",
-      UNEXPECTED_TOKEN: "unexpected token"
-    };
-  }
-});
-
-// src/config/index.ts
-var config_exports = {};
-__export(config_exports, {
-  loadConfig: () => loadConfig,
-  parseConfig: () => parseConfig,
-  substituteEnv: () => substituteEnv
-});
-var init_config = __esm({
-  "src/config/index.ts"() {
-    init_env();
-    init_load();
-    init_schema();
-  }
-});
-
-// src/cli/program.ts
-init_filename();
-init_core();
+import { createSqliteReceiptStore, A2A_SPEC_VERSION, A2A_PROTOCOL_VERSION, A2A_PROTOCOL_BINDING, A2A_AGENT_CARD_PATH, A2A_UNSUPPORTED, ACP_UNSUPPORTED } from './chunk-SS3QFF5N.js';
+import { DEFAULT_CONFIG_FILENAME, extractPathParameterNames, ACP_SPEC_VERSION, ACP_API_VERSION, ACP_WELL_KNOWN_PATH, findUnparsedBraceToken } from './chunk-2ZZOGI5I.js';
+import { MPP_PROFILE, MPP_SPEC_DRAFTS, MPPX_VERSION, MPP_SPEC_COMMIT, MPP_DEFAULT_PAYMENT_FLOW } from './chunk-AA3FIEAR.js';
+import { ANVIL_WELL_KNOWN_ACCOUNTS, describeDeploymentMode, X402_DEFAULT_PAYMENT_FLOW, findX402Network, isEvmAddress, LOCAL_CHAIN_ID, resolveDeploymentMode, sameAddress } from './chunk-7JNYFUT3.js';
+import { AP2_UNSUPPORTED } from './chunk-3EQBCFZY.js';
+import './chunk-3MGAJ5FX.js';
+import { AP2_SPEC_VERSION, AP2_CHECKOUT_MANDATE_VCT, AP2_CHECKOUT_PROFILE } from './chunk-FHCFR2GS.js';
+import { MCP_TOOL_NAME_MAX_LENGTH, MCP_TOOL_NAME_CHARS } from './chunk-TPC4EJLT.js';
+import { PACKAGE_VERSION } from './chunk-FRMLWGSS.js';
+import { PROTOCOL_NAMES, isCommerceError, CommerceError } from './chunk-QQ3WY5L3.js';
+import { isRecord } from './chunk-3M6U7ILB.js';
+import { CommanderError, Command } from 'commander';
+import { existsSync, mkdirSync, readFileSync, accessSync, constants } from 'fs';
+import { dirname, resolve, join, basename, extname, win32 } from 'path';
+import { z } from 'zod';
+import { stringify, parse, Document } from 'yaml';
+import picocolors from 'picocolors';
+import { writeFile, stat, mkdir, rename, rm, open } from 'fs/promises';
+import { isDeepStrictEqual } from 'util';
+import { validate } from '@scalar/openapi-parser';
+import * as clack from '@clack/prompts';
 
 // src/cli/commands/demo.ts
 function defaultDemoSteps() {
@@ -2196,659 +30,55 @@ function defaultDemoSteps() {
       args: ["compose", "up", "--build", "--detach", "--wait"]
     },
     { name: "Run the deterministic buyer agent", command: "npm", args: ["run", "demo:agent"] }
-  ];
-}
-async function runDemo(io, deps = {}) {
-  const steps = deps.steps ?? defaultDemoSteps();
-  const run = deps.run ?? execCommand;
-  io.stdout("agent-commerce demo: starting the local stack, then running the buyer agent");
-  for (const step of steps) {
-    io.stdout("");
-    io.stdout(`==> ${step.name}`);
-    io.stdout(`    $ ${step.command} ${step.args.join(" ")}`);
-    const result = await run(step.command, step.args);
-    if (result.code !== 0) {
-      io.stderr(`FAIL  "${step.name}" exited with code ${result.code}.`);
-      if (result.stderrTail !== void 0 && result.stderrTail.length > 0) {
-        io.stderr(result.stderrTail);
-      }
-      io.stderr("");
-      io.stderr("Nothing further was run. To retry manually:");
-      io.stderr(`  ${step.command} ${step.args.join(" ")}`);
-      return 1;
-    }
-    io.stdout(`OK    ${step.name}`);
-  }
-  io.stdout("");
-  io.stdout("PASS  Demo is up. Try: agent-commerce doctor --config config-demo.yaml");
-  return 0;
-}
-async function execCommand(command, args) {
-  const { spawn } = await import('child_process');
-  return new Promise((resolvePromise) => {
-    let stderr = "";
-    const child = spawn(command, args, { stdio: ["ignore", "inherit", "pipe"] });
-    child.stderr?.on("data", (chunk) => {
-      stderr += chunk.toString("utf8");
-    });
-    child.on("error", (err) => {
-      resolvePromise({ code: 1, stderrTail: err.message });
-    });
-    child.on("close", (code) => {
-      const tail = stderr.trim().split("\n").slice(-10).join("\n");
-      resolvePromise({ code: code ?? 1, ...tail.length > 0 ? { stderrTail: tail } : {} });
-    });
-  });
-}
-
-// src/cli/commands/doctor.ts
-init_constants();
-
-// src/authorization/ap2/descriptor.ts
-init_constants();
-var AP2_UNSUPPORTED = [
-  // Mandate kinds. Open mandates are refused: see AP2_CHECKOUT_MANDATE_VCT
-  "autonomous mode",
-  "open checkout mandates (mandate.checkout.open.1)",
-  "payment mandates (mandate.payment.1)",
-  "spending constraint evaluation",
-  "cnf-bound agent keys",
-  // Delegation models other than a trusted agent provider
-  "user credential delegation (OpenID4VP)",
-  "delegation chains and key-binding JWTs",
-  // Key handling. Every key is written into config by an operator
-  "JWKS and any key discovery by URL (jku, x5u)",
-  "issuer metadata fetching",
-  "key rotation without a config change",
-  // Algorithms
-  "signature algorithms other than ES256",
-  "digest algorithms other than sha-256",
-  // Roles this gateway does not play
-  "mandate issuance",
-  "checkout receipts",
-  "AP2 over the ACP checkout adapter"
-];
-
-// src/cli/commands/doctor.ts
-init_core();
-init_execution();
-init_constants2();
-init_networks();
-
-// src/protocols/a2a/constants.ts
-var A2A_SPEC_VERSION = "1.0.1";
-var A2A_PROTOCOL_VERSION = "1.0";
-var A2A_PROTOCOL_BINDING = "JSONRPC";
-var A2A_AGENT_CARD_PATH = "/.well-known/agent-card.json";
-var A2A_PUSH_CONFIG_METHODS = [
-  "CreateTaskPushNotificationConfig",
-  "GetTaskPushNotificationConfig",
-  "ListTaskPushNotificationConfigs",
-  "DeleteTaskPushNotificationConfig"
-];
-var A2A_UNSUPPORTED_METHODS = [
-  "SendStreamingMessage",
-  "GetTask",
-  "ListTasks",
-  "CancelTask",
-  "SubscribeToTask",
-  ...A2A_PUSH_CONFIG_METHODS,
-  "GetExtendedAgentCard"
-];
-
-// src/protocols/a2a/descriptor.ts
-var A2A_UNSUPPORTED = [
-  // Methods, as the protocol names them; the transport refuses the same list
-  ...A2A_UNSUPPORTED_METHODS,
-  // Transports other than the one binding served
-  "HTTP+JSON/REST binding",
-  "gRPC binding",
-  // Behaviors
-  "SSE",
-  "long-running task persistence",
-  "task resumption other than an x402 extension payment",
-  "push notifications",
-  "multi-turn conversational continuation",
-  "authenticated extended agent cards",
-  "A2A authentication schemes",
-  "artifact types beyond Agent Commerce outcome data",
-  // Pending x402 payments live in process memory
-  "x402 extension payments across gateway restarts or instances"
-];
-
-// src/cli/commands/doctor.ts
-init_constants3();
-
-// src/protocols/acp/descriptor.ts
-init_constants3();
-[
-  "rest transport",
-  "well-known discovery",
-  "bearer authentication",
-  "API-Version enforcement",
-  // Forwarded as received: the gateway verifies neither signature header
-  "request header forwarding to the merchant",
-  "checkout service",
-  ...ACP_CHECKOUT_OPERATIONS
-];
-var ACP_UNSUPPORTED = [
-  // Services this seller does not implement, named as ACP names them. The
-  // discovery document advertises `checkout` alone, and these are the reason.
-  "carts service",
-  "feed service",
-  "standalone orders service",
-  "delegate_payment",
-  "delegate_authentication",
-  // Bindings and delivery directions
-  "ACP MCP transport binding",
-  "webhooks",
-  "outbound merchant-to-agent delivery",
-  "ACP client role",
-  // Request authentication beyond the bearer token
-  "Signature header verification",
-  "Timestamp replay-window verification",
-  // Extensions, versioning and payment handlers
-  "discount extension",
-  "general ACP extension framework",
-  "multiple ACP API versions",
-  "seller-backed payment handler integration"
-];
-
-// src/storage/receipts/store.ts
-init_core();
-var PACKAGE_VERSION = "2.0.0" ;
-
-// src/storage/sqlite.ts
-init_core();
-function openSqliteDatabase(options) {
-  const { path: path2, label, logger } = options;
-  const isFileBacked = path2 !== ":memory:";
-  if (isFileBacked) {
-    mkdirSync(dirname(path2), { recursive: true, mode: 448 });
-  }
-  if (isFileBacked && existsSync(path2)) {
-    try {
-      accessSync(path2, constants.W_OK);
-    } catch {
-      throw new CommerceError(
-        "STORAGE_ERROR",
-        `${label} "${path2}" exists but is not writable by this process (uid ${typeof process.getuid === "function" ? process.getuid() : "unknown"}). If this is a container that recently changed user, an existing volume may still be owned by the previous one - recreate it (docker compose down -v) or fix its ownership.`,
-        { details: { path: path2 } }
-      );
-    }
-  }
-  if (isFileBacked) {
-    try {
-      closeSync(openSync(path2, "a", 384));
-    } catch {
-    }
-  }
-  const db = new Database(path2);
-  db.pragma("journal_mode = WAL");
-  db.pragma("foreign_keys = ON");
-  if (isFileBacked) restrictDatabasePermissions(path2, label, logger);
-  return db;
-}
-function restrictDatabasePermissions(path2, label, logger) {
-  for (const file of [path2, `${path2}-wal`, `${path2}-shm`]) {
-    try {
-      chmodSync(file, 384);
-    } catch (error) {
-      const code = error.code;
-      if (code === "ENOENT") continue;
-      logger.warn(
-        { file, label, error: code ?? "unknown" },
-        "could not restrict database permissions to owner-only"
-      );
-    }
-  }
-}
-
-// src/storage/receipts/redact.ts
-var SECRET_KEY_PATTERN = /private[-_ ]?key|secret|password|mnemonic|seed[-_ ]?phrase|api[-_ ]?key|authoriz(e|ation)|^auth$|auth[-_]?header|payment[-_ ]?proof|^proof$|x-payment|signature|signed[-_ ]?message|token|bearer|credential|cookie|session|jwt/i;
-var REDACTED = "[REDACTED]";
-function isSecretKey(key) {
-  return SECRET_KEY_PATTERN.test(key);
-}
-function redact(value) {
-  return redactValue(value);
+  ];
 }
-function redactValue(value) {
-  if (Array.isArray(value)) {
-    return value.map(redactValue);
-  }
-  if (value !== null && typeof value === "object") {
-    const out = {};
-    for (const [key, inner] of Object.entries(value)) {
-      out[key] = isSecretKey(key) ? REDACTED : redactValue(inner);
+async function runDemo(io, deps = {}) {
+  const steps = deps.steps ?? defaultDemoSteps();
+  const run = deps.run ?? execCommand;
+  io.stdout("agent-commerce demo: starting the local stack, then running the buyer agent");
+  for (const step of steps) {
+    io.stdout("");
+    io.stdout(`==> ${step.name}`);
+    io.stdout(`    $ ${step.command} ${step.args.join(" ")}`);
+    const result = await run(step.command, step.args);
+    if (result.code !== 0) {
+      io.stderr(`FAIL  "${step.name}" exited with code ${result.code}.`);
+      if (result.stderrTail !== void 0 && result.stderrTail.length > 0) {
+        io.stderr(result.stderrTail);
+      }
+      io.stderr("");
+      io.stderr("Nothing further was run. To retry manually:");
+      io.stderr(`  ${step.command} ${step.args.join(" ")}`);
+      return 1;
     }
-    return out;
+    io.stdout(`OK    ${step.name}`);
   }
-  return value;
-}
-
-// src/storage/receipts/rows.ts
-function receiptToRow(receipt) {
-  return {
-    id: receipt.id,
-    request_id: receipt.requestId,
-    resource_id: receipt.resourceId,
-    payment_json: receipt.payment !== void 0 ? JSON.stringify(redact(receipt.payment)) : null,
-    delivered_at: receipt.deliveredAt,
-    backend_status: receipt.backendStatus,
-    duration_ms: receipt.durationMs ?? null,
-    protocol: receipt.protocol ?? null,
-    metadata_json: receipt.metadata !== void 0 ? JSON.stringify(redact(receipt.metadata)) : null,
-    authorization_json: receipt.authorization !== void 0 ? JSON.stringify(redact(receipt.authorization)) : null
-  };
-}
-function rowToReceipt(row) {
-  const payment = row.payment_json !== null ? JSON.parse(row.payment_json) : void 0;
-  const metadata = row.metadata_json !== null ? JSON.parse(row.metadata_json) : void 0;
-  const authorization = row.authorization_json !== null ? JSON.parse(row.authorization_json) : void 0;
-  return {
-    id: row.id,
-    requestId: row.request_id,
-    resourceId: row.resource_id,
-    deliveredAt: row.delivered_at,
-    backendStatus: row.backend_status,
-    ...payment !== void 0 ? { payment } : {},
-    ...row.duration_ms !== null ? { durationMs: row.duration_ms } : {},
-    ...row.protocol !== null ? { protocol: row.protocol } : {},
-    ...metadata !== void 0 ? { metadata } : {},
-    ...authorization !== void 0 ? { authorization } : {}
-  };
-}
-function eventToRow(event) {
-  return {
-    id: event.id,
-    type: event.type,
-    request_id: event.requestId,
-    resource_id: event.resourceId ?? null,
-    at: event.at,
-    adapter: event.adapter ?? null,
-    payment_provider: event.paymentProvider ?? null,
-    duration_ms: event.durationMs ?? null,
-    status: event.status ?? null,
-    data_json: event.data !== void 0 ? JSON.stringify(redact(event.data)) : null
-  };
-}
-function rowToEvent(row) {
-  const data = row.data_json !== null ? JSON.parse(row.data_json) : void 0;
-  return {
-    id: row.id,
-    type: row.type,
-    requestId: row.request_id,
-    at: row.at,
-    ...row.resource_id !== null ? { resourceId: row.resource_id } : {},
-    ...row.adapter !== null ? { adapter: row.adapter } : {},
-    ...row.payment_provider !== null ? { paymentProvider: row.payment_provider } : {},
-    ...row.duration_ms !== null ? { durationMs: row.duration_ms } : {},
-    ...row.status !== null ? { status: row.status } : {},
-    ...data !== void 0 ? { data } : {}
-  };
-}
-function rowToPaymentAttempt(row) {
-  return {
-    id: row.id,
-    requestId: row.request_id,
-    resourceId: row.resource_id,
-    provider: row.provider,
-    replayKey: row.replay_key,
-    status: row.status,
-    amount: row.amount,
-    currency: row.currency,
-    ...row.payer !== null ? { payer: row.payer } : {},
-    ...row.payee !== null ? { payee: row.payee } : {},
-    ...row.external_reference !== null ? { externalReference: row.external_reference } : {},
-    ...row.rejection_reason !== null ? { rejectionReason: row.rejection_reason } : {},
-    createdAt: row.created_at,
-    updatedAt: row.updated_at
-  };
+  io.stdout("");
+  io.stdout("PASS  Demo is up. Try: agent-commerce doctor --config config-demo.yaml");
+  return 0;
 }
-
-// src/storage/receipts/schema.ts
-var MIGRATIONS = [
-  {
-    version: 1,
-    up(db) {
-      db.exec(`
-        CREATE TABLE IF NOT EXISTS receipts (
-          seq             INTEGER PRIMARY KEY AUTOINCREMENT,
-          id              TEXT NOT NULL UNIQUE,
-          request_id      TEXT NOT NULL,
-          resource_id     TEXT NOT NULL,
-          payment_json    TEXT,
-          delivered_at    TEXT NOT NULL,
-          backend_status  INTEGER NOT NULL,
-          duration_ms     INTEGER,
-          protocol        TEXT,
-          metadata_json   TEXT
-        );
-        CREATE INDEX IF NOT EXISTS idx_receipts_request_id ON receipts(request_id);
-        CREATE INDEX IF NOT EXISTS idx_receipts_delivered_at ON receipts(delivered_at);
-
-        CREATE TABLE IF NOT EXISTS events (
-          seq               INTEGER PRIMARY KEY AUTOINCREMENT,
-          id                TEXT NOT NULL UNIQUE,
-          type              TEXT NOT NULL,
-          request_id        TEXT NOT NULL,
-          resource_id       TEXT,
-          at                TEXT NOT NULL,
-          adapter           TEXT,
-          payment_provider  TEXT,
-          duration_ms       INTEGER,
-          status            TEXT,
-          data_json         TEXT
-        );
-        CREATE INDEX IF NOT EXISTS idx_events_request_id ON events(request_id);
-        CREATE INDEX IF NOT EXISTS idx_events_at ON events(at);
-
-        CREATE TABLE IF NOT EXISTS payment_attempts (
-          seq                 INTEGER PRIMARY KEY AUTOINCREMENT,
-          id                  TEXT NOT NULL UNIQUE,
-          request_id          TEXT NOT NULL,
-          resource_id         TEXT NOT NULL,
-          provider             TEXT NOT NULL,
-          replay_key          TEXT NOT NULL UNIQUE,
-          status              TEXT NOT NULL,
-          amount              TEXT NOT NULL,
-          currency            TEXT NOT NULL,
-          payer               TEXT,
-          payee               TEXT,
-          external_reference  TEXT,
-          rejection_reason    TEXT,
-          created_at          TEXT NOT NULL,
-          updated_at          TEXT NOT NULL
-        );
-        CREATE INDEX IF NOT EXISTS idx_payment_attempts_request_id ON payment_attempts(request_id);
-        CREATE INDEX IF NOT EXISTS idx_payment_attempts_created_at ON payment_attempts(created_at);
-      `);
-    }
-  },
-  {
-    version: 2,
-    up(db) {
-      db.exec(`ALTER TABLE receipts ADD COLUMN authorization_json TEXT;`);
-    }
-  }
-];
-var SCHEMA_VERSION = MIGRATIONS.at(-1)?.version ?? 0;
-function migrate(db) {
-  const current = db.pragma("user_version", { simple: true });
-  for (const migration of MIGRATIONS) {
-    if (migration.version <= current) continue;
-    const apply = db.transaction(() => {
-      migration.up(db);
-      db.pragma(`user_version = ${migration.version}`);
+async function execCommand(command, args) {
+  const { spawn } = await import('child_process');
+  return new Promise((resolvePromise) => {
+    let stderr = "";
+    const child = spawn(command, args, { stdio: ["ignore", "inherit", "pipe"] });
+    child.stderr?.on("data", (chunk) => {
+      stderr += chunk.toString("utf8");
     });
-    apply();
-  }
-}
-
-// src/storage/receipts/store.ts
-var DEFAULT_LIST_LIMIT = 50;
-var MAX_LIST_LIMIT = 500;
-function clampListLimit(limit) {
-  const base = limit !== void 0 && Number.isFinite(limit) ? limit : DEFAULT_LIST_LIMIT;
-  return Math.min(Math.max(Math.trunc(base), 1), MAX_LIST_LIMIT);
-}
-var defaultIds = {
-  next: (prefix) => prefix !== void 0 ? `${prefix}_${randomUUID()}` : randomUUID()
-};
-function isUniqueConstraintOn(err, column) {
-  return err instanceof Error && "code" in err && err.code === "SQLITE_CONSTRAINT_UNIQUE" && err.message.includes(column);
-}
-function createSqliteReceiptStore(options) {
-  const logger = options.logger ?? NOOP_LOGGER;
-  const clock = options.clock ?? systemClock;
-  const ids = options.ids ?? defaultIds;
-  const path2 = options.path;
-  const isFileBacked = path2 !== ":memory:";
-  const db = openSqliteDatabase({ path: path2, label: "Receipt database", logger });
-  migrate(db);
-  const insertReceiptStmt = db.prepare(
-    `INSERT INTO receipts (id, request_id, resource_id, payment_json, delivered_at, backend_status, duration_ms, protocol, metadata_json, authorization_json)
-     VALUES (@id, @request_id, @resource_id, @payment_json, @delivered_at, @backend_status, @duration_ms, @protocol, @metadata_json, @authorization_json)`
-  );
-  const getReceiptStmt = db.prepare("SELECT * FROM receipts WHERE id = ?");
-  const listReceiptsStmt = db.prepare(
-    "SELECT * FROM receipts ORDER BY delivered_at DESC, seq DESC LIMIT ?"
-  );
-  const listReceiptsByRequestStmt = db.prepare(
-    "SELECT * FROM receipts WHERE request_id = ? ORDER BY delivered_at DESC, seq DESC LIMIT ?"
-  );
-  const countReceiptsStmt = db.prepare(
-    "SELECT COUNT(*) AS count FROM receipts"
-  );
-  const countUndeliveredReceiptsStmt = db.prepare(
-    "SELECT COUNT(*) AS count FROM receipts WHERE backend_status NOT BETWEEN 200 AND 299"
-  );
-  const insertEventStmt = db.prepare(
-    `INSERT INTO events (id, type, request_id, resource_id, at, adapter, payment_provider, duration_ms, status, data_json)
-     VALUES (@id, @type, @request_id, @resource_id, @at, @adapter, @payment_provider, @duration_ms, @status, @data_json)`
-  );
-  const listEventsStmt = db.prepare(
-    "SELECT * FROM events ORDER BY at DESC, seq DESC LIMIT ?"
-  );
-  const listEventsByRequestStmt = db.prepare(
-    "SELECT * FROM events WHERE request_id = ? ORDER BY at DESC, seq DESC LIMIT ?"
-  );
-  const insertPaymentAttemptStmt = db.prepare(
-    `INSERT INTO payment_attempts (id, request_id, resource_id, provider, replay_key, status, amount, currency, payer, payee, external_reference, rejection_reason, created_at, updated_at)
-     VALUES (@id, @request_id, @resource_id, @provider, @replay_key, @status, @amount, @currency, @payer, @payee, @external_reference, @rejection_reason, @created_at, @updated_at)
-     RETURNING *`
-  );
-  const updatePaymentAttemptStmt = db.prepare(
-    `UPDATE payment_attempts SET status = @status,
-       external_reference = COALESCE(@external_reference, external_reference),
-       rejection_reason = COALESCE(@rejection_reason, rejection_reason),
-       updated_at = @updated_at
-     WHERE replay_key = @replay_key`
-  );
-  const listPaymentAttemptsStmt = db.prepare(
-    "SELECT * FROM payment_attempts ORDER BY created_at DESC, seq DESC LIMIT ?"
-  );
-  const listPaymentAttemptsByRequestStmt = db.prepare(
-    "SELECT * FROM payment_attempts WHERE request_id = ? ORDER BY created_at DESC, seq DESC LIMIT ?"
-  );
-  const paymentAttemptStatusStmt = db.prepare(
-    "SELECT status FROM payment_attempts WHERE replay_key = ?"
-  );
-  let closed = false;
-  const descriptor = {
-    name: "sqlite-receipt-store",
-    kind: "storage",
-    implementationVersion: PACKAGE_VERSION,
-    supportedSpec: `sqlite-schema-v${SCHEMA_VERSION}`,
-    capabilities: ["receipts", "events", "payment-attempts"],
-    status: "stable"
-  };
-  const store = {
-    async init() {
-      const version = db.pragma("user_version", { simple: true });
-      if (version !== SCHEMA_VERSION) {
-        throw new CommerceError(
-          "STORAGE_ERROR",
-          `Receipt store schema version mismatch (found ${version}, expected ${SCHEMA_VERSION})`
-        );
-      }
-    },
-    async appendEvent(event) {
-      try {
-        insertEventStmt.run(eventToRow(event));
-      } catch (err) {
-        logger.warn(
-          {
-            err: err instanceof Error ? err.message : String(err),
-            eventId: event.id,
-            requestId: event.requestId
-          },
-          "receipt-store: failed to persist commerce event"
-        );
-      }
-    },
-    async reservePaymentAttempt(reservation) {
-      const now = clock.nowIso();
-      const id = ids.next("attempt");
-      let row;
-      try {
-        row = insertPaymentAttemptStmt.get({
-          id,
-          request_id: reservation.requestId,
-          resource_id: reservation.resourceId,
-          provider: reservation.provider,
-          replay_key: reservation.replayKey,
-          status: "reserved",
-          amount: reservation.amount,
-          currency: reservation.currency,
-          payer: reservation.payer ?? null,
-          payee: reservation.payee ?? null,
-          external_reference: null,
-          rejection_reason: null,
-          created_at: now,
-          updated_at: now
-        });
-      } catch (err) {
-        if (isUniqueConstraintOn(err, "payment_attempts.replay_key")) {
-          const existing = paymentAttemptStatusStmt.get(reservation.replayKey);
-          throw new CommerceError(
-            "PAYMENT_REPLAYED",
-            `Payment authorization has already been used (replayKey=${reservation.replayKey})`,
-            {
-              requestId: reservation.requestId,
-              resourceId: reservation.resourceId,
-              ...existing !== void 0 ? { details: { attemptStatus: existing.status } } : {}
-            }
-          );
-        }
-        throw toCommerceError(err, "STORAGE_ERROR", "Failed to reserve payment attempt");
-      }
-      return rowToPaymentAttempt(row);
-    },
-    async updatePaymentAttempt(update) {
-      try {
-        const result = updatePaymentAttemptStmt.run({
-          replay_key: update.replayKey,
-          status: update.status,
-          external_reference: update.externalReference ?? null,
-          rejection_reason: update.rejectionReason ?? null,
-          updated_at: clock.nowIso()
-        });
-        if (result.changes === 0) {
-          throw new CommerceError(
-            "STORAGE_ERROR",
-            `No payment attempt found for replayKey=${update.replayKey}`
-          );
-        }
-      } catch (err) {
-        throw toCommerceError(err, "STORAGE_ERROR", "Failed to update payment attempt");
-      }
-    },
-    async saveReceipt(receipt) {
-      try {
-        insertReceiptStmt.run(receiptToRow(receipt));
-      } catch (err) {
-        throw toCommerceError(err, "STORAGE_ERROR", "Failed to save receipt");
-      }
-    },
-    async getReceipt(id) {
-      const row = getReceiptStmt.get(id);
-      return row !== void 0 ? rowToReceipt(row) : void 0;
-    },
-    async listReceipts(listOptions = {}) {
-      const limit = clampListLimit(listOptions.limit);
-      const rows = listOptions.requestId !== void 0 ? listReceiptsByRequestStmt.all(listOptions.requestId, limit) : listReceiptsStmt.all(limit);
-      return rows.map(rowToReceipt);
-    },
-    // Exact total, not bounded by the listReceipts clamp (see ReceiptStore.countReceipts)
-    async countReceipts() {
-      return countReceiptsStmt.get()?.count ?? 0;
-    },
-    // Exact count of non-2xx receipts (see ReceiptStore.countUndeliveredReceipts)
-    async countUndeliveredReceipts() {
-      return countUndeliveredReceiptsStmt.get()?.count ?? 0;
-    },
-    async listEvents(listOptions = {}) {
-      const limit = clampListLimit(listOptions.limit);
-      const rows = listOptions.requestId !== void 0 ? listEventsByRequestStmt.all(listOptions.requestId, limit) : listEventsStmt.all(limit);
-      return rows.map(rowToEvent);
-    },
-    async listPaymentAttempts(listOptions = {}) {
-      const limit = clampListLimit(listOptions.limit);
-      const rows = listOptions.requestId !== void 0 ? listPaymentAttemptsByRequestStmt.all(listOptions.requestId, limit) : listPaymentAttemptsStmt.all(limit);
-      return rows.map(rowToPaymentAttempt);
-    },
-    descriptor,
-    async health() {
-      const startedAt = clock.monotonicMs();
-      if (closed) {
-        return { status: "fail", detail: "store-unavailable", checkedAt: clock.nowIso() };
-      }
-      if (isFileBacked) {
-        try {
-          accessSync(path2, constants.W_OK);
-        } catch (err) {
-          logger.warn(
-            { err: err instanceof Error ? err.message : String(err) },
-            "receipt-store: health check failed (store not writable)"
-          );
-          return {
-            status: "fail",
-            detail: "store-unwritable",
-            checkedAt: clock.nowIso(),
-            durationMs: clock.monotonicMs() - startedAt
-          };
-        }
-      }
-      try {
-        const version = db.pragma("user_version", { simple: true });
-        if (version !== SCHEMA_VERSION) {
-          logger.warn(
-            { found: version, expected: SCHEMA_VERSION },
-            "receipt-store: health check failed (schema version mismatch)"
-          );
-          return {
-            status: "fail",
-            detail: "store-schema-mismatch",
-            checkedAt: clock.nowIso(),
-            durationMs: clock.monotonicMs() - startedAt
-          };
-        }
-        return {
-          status: "pass",
-          detail: `sqlite schema v${SCHEMA_VERSION} writable`,
-          checkedAt: clock.nowIso(),
-          durationMs: clock.monotonicMs() - startedAt
-        };
-      } catch (err) {
-        logger.warn(
-          { err: err instanceof Error ? err.message : String(err) },
-          "receipt-store: health check failed (store unavailable)"
-        );
-        return {
-          status: "fail",
-          detail: "store-unavailable",
-          checkedAt: clock.nowIso(),
-          durationMs: clock.monotonicMs() - startedAt
-        };
-      }
-    },
-    async close() {
-      if (!closed) {
-        closed = true;
-        db.close();
-      }
-    }
-  };
-  return store;
+    child.on("error", (err) => {
+      resolvePromise({ code: 1, stderrTail: err.message });
+    });
+    child.on("close", (code) => {
+      const tail = stderr.trim().split("\n").slice(-10).join("\n");
+      resolvePromise({ code: code ?? 1, ...tail.length > 0 ? { stderrTail: tail } : {} });
+    });
+  });
 }
 
 // src/cli/lib/config-client.ts
-init_core();
 async function importConfig() {
   try {
-    return await Promise.resolve().then(() => (init_config(), config_exports));
+    return await import('./config-4IBGVFSP.js');
   } catch (err) {
     throw new CommerceError(
       "INTERNAL_ERROR",
@@ -2871,141 +101,17 @@ async function fetchJson(fetchImpl, url, timeoutMs = 1500) {
     try {
       body = await res.json();
     } catch {
-      body = void 0;
-    }
-    return { ok: res.ok, status: res.status, ...body !== void 0 ? { body } : {} };
-  } catch (err) {
-    return {
-      ok: false,
-      status: 0,
-      error: err instanceof Error ? err.message : "unknown fetch error"
-    };
-  }
-}
-
-// src/cli/lib/init-config.ts
-init_accounts();
-var LOCAL_DEV_MERCHANT_ADDRESS = ANVIL_WELL_KNOWN_ACCOUNTS[1].address;
-var LOCAL_DEV_FACILITATOR_PRIVATE_KEY = ANVIL_WELL_KNOWN_ACCOUNTS[0].privateKey;
-var PLACEHOLDER_ASSET_ADDRESS = "0x000000000000000000000000000000000000dEaD";
-function defaultInitAnswers() {
-  return {
-    backendBaseUrl: "http://localhost:3000",
-    resources: ["weather", "report"],
-    protocols: ["http", "mcp"],
-    x402Enabled: true,
-    merchantPayTo: LOCAL_DEV_MERCHANT_ADDRESS
-  };
-}
-function buildResourcesMap(answers) {
-  const resources = {};
-  const expose = [...answers.protocols];
-  if (answers.resources.includes("weather")) {
-    resources.weather = {
-      name: "Get weather",
-      description: "Deterministic demo weather lookup (free resource).",
-      input: {
-        type: "object",
-        properties: { city: { type: "string" } },
-        required: ["city"],
-        additionalProperties: false
-      },
-      backend: {
-        type: "http",
-        method: "GET",
-        url: `${answers.backendBaseUrl}/api/weather/{city}`
-      },
-      pricing: { type: "free" },
-      expose
-    };
-  }
-  if (answers.resources.includes("report")) {
-    const paid = answers.x402Enabled;
-    resources.report = {
-      name: "Get market report",
-      description: "Deterministic demo premium market report.",
-      // No caller-supplied fields. Config loads a missing `input` as this same
-      // closed schema; writing it out shows that in the generated file
-      input: {
-        type: "object",
-        properties: {},
-        additionalProperties: false
-      },
-      backend: {
-        type: "http",
-        method: "GET",
-        url: `${answers.backendBaseUrl}/api/report`
-      },
-      pricing: paid ? { type: "fixed", amount: "0.01", currency: "USDC" } : { type: "free" },
-      expose,
-      ...paid ? { payments: ["x402"] } : {}
-    };
-  }
-  return resources;
-}
-function buildInitConfigObject(answers) {
-  return {
-    version: 1,
-    merchant: {
-      id: "demo-merchant",
-      name: "Demo Merchant",
-      publicBaseUrl: "http://localhost:8080"
-    },
-    server: { port: 8080, host: "127.0.0.1" },
-    storage: { receipts: { driver: "sqlite", path: "./data/receipts.db" } },
-    protocols: {
-      http: { enabled: answers.protocols.includes("http") },
-      mcp: { enabled: answers.protocols.includes("mcp"), mountPath: "/mcp" }
-    },
-    resources: buildResourcesMap(answers),
-    payments: answers.x402Enabled ? {
-      x402: {
-        enabled: true,
-        network: "eip155:84532",
-        rpcUrl: "http://127.0.0.1:8545",
-        asset: PLACEHOLDER_ASSET_ADDRESS,
-        assetName: "MockUSDC",
-        assetVersion: "2",
-        assetDecimals: 6,
-        payTo: answers.merchantPayTo,
-        maxTimeoutSeconds: 60,
-        facilitator: { mode: "local", signerPrivateKey: LOCAL_DEV_FACILITATOR_PRIVATE_KEY }
-      }
-    } : {}
-  };
-}
-var HEADER = `# Generated by \`agent-commerce init\`.
-#
-# With x402 enabled, the facilitator signerPrivateKey is Anvil's public dev
-# account #0 and the default payTo is account #1.
-# LOCAL DEVELOPMENT ONLY - DO NOT FUND: never use them outside a local chain.
-# payments.x402.asset is a placeholder, not a real contract. Before running
-# against the local chain, run \`npm run chain:deploy\` and set it to the
-# MockUSDC address in \`.deploy/local.json\`. Before pointing this at a funded
-# network, set \`payments.x402.payTo\` to your own settlement address.
-#
-# server.host is loopback (127.0.0.1): binding every interface should be a
-# deliberate edit.
-#
-# server.adminToken and server.allowedOrigins are left unset, so no secret
-# lands in a file you might commit. Without a token the operator routes
-# (/api/receipts, /api/events) return 404. They serve the merchant's commerce
-# ledger: payer addresses, amounts and settlement hashes. To enable them, add
-# these keys to the server block below:
-#   server:
-#     adminToken: \${ADMIN_TOKEN}
-#     allowedOrigins:
-#       - http://localhost:5173
-# See SECURITY.md before exposing this gateway beyond localhost.
-`;
-function renderInitConfigYaml(answers) {
-  const body = stringify(buildInitConfigObject(answers), { indent: 2 });
-  return `${HEADER}
-${body}`;
+      body = void 0;
+    }
+    return { ok: res.ok, status: res.status, ...body !== void 0 ? { body } : {} };
+  } catch (err) {
+    return {
+      ok: false,
+      status: 0,
+      error: err instanceof Error ? err.message : "unknown fetch error"
+    };
+  }
 }
-
-// src/payments/x402/local-chain/manifest.ts
-init_core();
 var LOCAL_CHAIN_MANIFEST_PATH = ".deploy/local.json";
 var nonEmpty = z.string().min(1, "must be a non-empty string");
 var keyedAccount = z.object({ address: z.string(), privateKey: z.string(), note: z.string() });
@@ -3023,18 +129,18 @@ var MANIFEST_SCHEMA = z.object({
   buyerInitialBalance: nonEmpty
 });
 function readLocalChainManifest(cwd = process.cwd()) {
-  const path2 = join(cwd, LOCAL_CHAIN_MANIFEST_PATH);
-  if (!existsSync(path2)) {
+  const path = join(cwd, LOCAL_CHAIN_MANIFEST_PATH);
+  if (!existsSync(path)) {
     throw new CommerceError(
       "CONFIG_INVALID",
-      `Local chain manifest not found at "${path2}". Run "npm run chain:start" then "npm run chain:deploy" first.`
+      `Local chain manifest not found at "${path}". Run "npm run chain:start" then "npm run chain:deploy" first.`
     );
   }
   let raw;
   try {
-    raw = readFileSync(path2, "utf8");
+    raw = readFileSync(path, "utf8");
   } catch (cause) {
-    throw new CommerceError("CONFIG_INVALID", `Could not read local chain manifest at "${path2}".`, {
+    throw new CommerceError("CONFIG_INVALID", `Could not read local chain manifest at "${path}".`, {
       cause
     });
   }
@@ -3044,7 +150,7 @@ function readLocalChainManifest(cwd = process.cwd()) {
   } catch (cause) {
     throw new CommerceError(
       "CONFIG_INVALID",
-      `Local chain manifest at "${path2}" is not valid JSON. Re-run "npm run chain:deploy" to regenerate it.`,
+      `Local chain manifest at "${path}" is not valid JSON. Re-run "npm run chain:deploy" to regenerate it.`,
       { cause }
     );
   }
@@ -3054,7 +160,7 @@ function readLocalChainManifest(cwd = process.cwd()) {
     const where = issue?.path.length ? `${issue.path.join(".")}: ` : "";
     throw new CommerceError(
       "CONFIG_INVALID",
-      `Local chain manifest at "${path2}" is invalid: ${where}${issue?.message ?? "unexpected shape"}. Re-run "npm run chain:deploy".`
+      `Local chain manifest at "${path}" is invalid: ${where}${issue?.message ?? "unexpected shape"}. Re-run "npm run chain:deploy".`
     );
   }
   return result.data;
@@ -3089,11 +195,19 @@ function fillEnvFromLocalChainManifest(baseEnv, cwd = process.cwd()) {
   }
   return { env, filled, manifestFound: true };
 }
-
-// src/cli/lib/mask.ts
-function maskMiddle(value, keep = 6) {
-  if (value.length <= keep * 2) return value.length === 0 ? value : "\u2026";
-  return `${value.slice(0, keep)}\u2026${value.slice(-4)}`;
+function hasChainDeployScript(cwd = process.cwd()) {
+  try {
+    const pkg = JSON.parse(readFileSync(join(cwd, "package.json"), "utf8"));
+    return pkg.name === "@devlab.group/agent-commerce" && typeof pkg.scripts?.["chain:deploy"] === "string";
+  } catch {
+    return false;
+  }
+}
+function unresolvedVariableHint(variable, manifestFound, chainDeploy) {
+  if (chainDeploy && !manifestFound && MANIFEST_FILLABLE_ENV_VAR_NAMES.has(variable)) {
+    return `"npm run chain:deploy" writes ${LOCAL_CHAIN_MANIFEST_PATH}, which validate and doctor read to fill local X402_* and MERCHANT_WALLET placeholders`;
+  }
+  return `set ${variable} in the environment, or in a file passed with --env-file`;
 }
 
 // package.json
@@ -3115,8 +229,11 @@ var package_default = {
     "@coinbase/x402": "2.1.0",
     "@modelcontextprotocol/server": "2.3.0",
     "@sd-jwt/core": "0.20.1",
+    "@solana/kit": "5.5.1",
     "@x402/core": "2.25.0",
     "@x402/evm": "2.25.0",
+    "@x402/near": "2.25.0",
+    "@x402/svm": "2.25.0",
     canonicalize: "5.0.0",
     jose: "6.2.12",
     mppx: "0.13.1",
@@ -3130,6 +247,9 @@ var PINS = [
   ["ajv-formats", "protocols/acp"],
   ["@x402/core", "payments/x402"],
   ["@x402/evm", "payments/x402"],
+  ["@x402/svm", "payments/x402"],
+  ["@solana/kit", "payments/x402"],
+  ["@x402/near", "payments/x402"],
   ["@coinbase/x402", "payments/x402"],
   ["viem", "payments/x402"],
   ["mppx", "payments/mpp"],
@@ -3153,278 +273,99 @@ function readVersionReport() {
   });
   return { cliVersion: PACKAGE_VERSION, pinned };
 }
-
-// src/cli/commands/doctor.ts
-var CHECK_TIMEOUT_MS = 1500;
-function deriveGatewayUrl(explicit, config) {
-  if (explicit !== void 0) return explicit.replace(/\/$/, "");
-  if (config !== void 0) {
-    const raw = config.server.host;
-    const host = raw === "0.0.0.0" ? "127.0.0.1" : raw === "::" ? "::1" : raw;
-    const authority = host.includes(":") ? `[${host}]` : host;
-    return `http://${authority}:${config.server.port}`;
-  }
-  return "http://localhost:8080";
-}
-function substitutePathParams(url) {
-  let filled = url;
-  for (const name of extractPathParameterNames(url)) {
-    filled = filled.replaceAll(`{${name}}`, "demo-check");
-  }
-  return filled;
-}
-function describePaymentFlow(rail) {
-  const overrides = Object.keys(rail.resourcePaymentFlows ?? {}).length;
-  const overrideCount = overrides > 0 ? ` (${overrides} resource ${overrides === 1 ? "override" : "overrides"})` : "";
-  return `paymentFlow=${rail.paymentFlow ?? "authorization"}${overrideCount}`;
-}
-function extractWellKnownX402(body, rail = "x402") {
-  const payments = body?.["payments"];
-  if (typeof payments !== "object" || payments === null) return void 0;
-  const block = payments[rail];
-  if (typeof block !== "object" || block === null) return void 0;
-  const rec = block;
-  if (rec["enabled"] === false) return "disabled";
-  if (rec["enabled"] !== true) return void 0;
-  const { asset, network } = rec;
-  const payTo = rec[rail === "mpp" ? "recipient" : "payTo"];
-  if (typeof asset !== "string" || typeof network !== "string" || typeof payTo !== "string") {
-    return void 0;
-  }
-  return { asset, network, payTo };
-}
-function sameAddress2(a, b) {
-  return a.toLowerCase() === b.toLowerCase();
-}
-function findX402Mismatch(configured, live, payToField = "payTo") {
-  const diffs = [];
-  if (!sameAddress2(configured.asset, live.asset)) {
-    diffs.push(
-      `asset: gateway is using ${live.asset} but local config resolves to ${configured.asset}`
-    );
-  }
-  if (configured.network !== live.network) {
-    diffs.push(
-      `network: gateway is using "${live.network}" but local config resolves to "${configured.network}"`
-    );
-  }
-  if (!sameAddress2(configured.payTo, live.payTo)) {
-    diffs.push(
-      `${payToField}: gateway is using ${live.payTo} but local config resolves to ${configured.payTo}`
-    );
-  }
-  if (diffs.length === 0) return void 0;
-  return `${diffs.join("; ")}; the gateway may be running against an older deployment - restart it or re-run chain:deploy`;
-}
-function describeSettlement(network, facilitator) {
-  const profile = findNetworkProfile(network);
-  const mode = profile ? resolveDeploymentMode(profile, facilitator.mode) : void 0;
-  const where = profile === void 0 || mode === void 0 ? `unknown network ${network}` : mode === "local" ? `LOCAL dev chain (${network}, chain id shared with ${profile.displayName})` : `${describeDeploymentMode(mode)} on ${profile.displayName} (${network})`;
-  const via = facilitator.mode === "local" ? "local (in-process)" : `remote (auth=${facilitator.auth.type})`;
-  return { mode, where, via };
-}
-function mainnetSafetyCheck(name, payToField, facilitator) {
-  const unauthenticated = facilitator.mode === "remote" && facilitator.auth.type === "none";
-  return {
-    name,
-    status: unauthenticated ? "WARN" : "INFO",
-    detail: unauthenticated ? `${describeDeploymentMode("mainnet")}: no credential is sent to the remote facilitator (accepted via allowUnauthenticatedFacilitator); its anonymous-access limits apply. Config load also requires allowMainnet, HTTPS, a non-development ${payToField} and the canonical asset. Payments fail closed.` : `${describeDeploymentMode("mainnet")}. Enforced at config load: explicit allowMainnet opt-in, remote facilitator over HTTPS with a credential, non-development ${payToField}, and the canonical asset for this network. Payments fail closed.`
-  };
-}
-function describeIssuers(label, issuers) {
-  const described = issuers.map(
-    (entry) => `${entry.issuer} (${entry.keys.length} key${entry.keys.length === 1 ? "" : "s"})`
-  ).join(", ");
-  return `${label} issuers: ${described}`;
-}
-function isWritableFile(path2) {
+function isWritableFile(path) {
   try {
-    accessSync(path2, constants.W_OK);
+    accessSync(path, constants.W_OK);
     return true;
   } catch {
     return false;
   }
 }
-function storeFileCheck(name, path2, risk, suffix = "") {
-  if (path2 === ":memory:") {
+function storeFileCheck(name, path, risk, suffix = "") {
+  if (path === ":memory:") {
     return {
       name,
       status: "WARN",
       detail: `in-memory store: ${risk.inMemory}; use a file path in production${suffix}`
     };
   }
-  if (existsSync(path2)) {
-    return isWritableFile(path2) ? { name, status: "PASS", detail: `writable at "${path2}"${suffix}` } : {
+  if (existsSync(path)) {
+    return isWritableFile(path) ? { name, status: "PASS", detail: `writable at "${path}"${suffix}` } : {
       name,
       status: "FAIL",
-      detail: `"${path2}" exists but is not writable by this user, so ${risk.unwritable}${suffix}`
+      detail: `"${path}" exists but is not writable by this user, so ${risk.unwritable}${suffix}`
     };
   }
-  return { name, status: "WARN", detail: `${missingStoreDetail(path2)}${suffix}` };
-}
-function missingStoreDetail(path2) {
-  const directory = dirname(path2);
-  return directory !== "." && !existsSync(directory) ? `no store at "${path2}" and its directory does not exist. Both are created when the gateway starts, provided the path is writable` : `no store at "${path2}" yet. It is created the first time the gateway starts`;
+  return { name, status: "WARN", detail: `${missingStoreDetail(path)}${suffix}` };
 }
-function acpMappingCheck(config, operations) {
-  const byId = new Map(config.resources.map((resource) => [resource.id, resource]));
-  const problems = [];
-  for (const [operation, resourceId] of Object.entries(operations)) {
-    const resource = byId.get(resourceId);
-    if (resource === void 0) {
-      problems.push(`${operation} -> "${resourceId}" does not exist`);
-      continue;
-    }
-    if (!resource.exposedVia.includes("acp")) {
-      problems.push(`${operation} -> "${resourceId}" is not exposed via acp`);
-    }
-    if (resource.pricing.type !== "free" || resource.paymentMethods.length > 0) {
-      problems.push(`${operation} -> "${resourceId}" is not free to invoke`);
-    }
-  }
-  if (problems.length > 0) {
-    return { name: "ACP checkout mapping", status: "FAIL", detail: problems.join("; ") };
-  }
-  return {
-    name: "ACP checkout mapping",
-    status: "PASS",
-    detail: `5 operations mapped to free acp-exposed resources (${Object.values(operations).join(", ")})`
-  };
+function missingStoreDetail(path) {
+  const directory = dirname(path);
+  return directory !== "." && !existsSync(directory) ? `no store at "${path}" and its directory does not exist. Both are created when the gateway starts, provided the path is writable` : `no store at "${path}" yet. It is created the first time the gateway starts`;
 }
-async function runDoctor(options, deps = {}) {
-  const fetchImpl = deps.fetchImpl ?? globalThis.fetch;
-  const loadConfig2 = deps.loadConfig ?? loadConfigDynamic;
-  const createStore = deps.createStore ?? ((path2) => createSqliteReceiptStore({ path: path2 }));
-  const fillEnvFromManifest = deps.fillEnvFromManifest ?? fillEnvFromLocalChainManifest;
+async function storageChecks(config, createStore) {
   const checks = [];
-  let config;
-  const { env, filled, manifestFound } = fillEnvFromManifest(process.env);
-  const filledSuffix = filled.length > 0 ? ` (using local chain manifest ${LOCAL_CHAIN_MANIFEST_PATH} for ${filled.join(", ")})` : "";
-  try {
-    config = await loadConfig2({
-      ...options.configPath !== void 0 ? { path: options.configPath } : {},
-      env
-    });
-    checks.push({
-      name: "Config",
-      status: "PASS",
-      detail: `valid: ${config.resources.length} resource(s), merchant "${config.merchant.name}"${filledSuffix}`
-    });
-  } catch (err) {
-    const variable = isCommerceError(err) ? err.details?.["variable"] : void 0;
-    const hint = !manifestFound && typeof variable === "string" && MANIFEST_FILLABLE_ENV_VAR_NAMES.has(variable) ? `. Run "npm run chain:deploy": it writes ${LOCAL_CHAIN_MANIFEST_PATH}, which fills local X402_*/MERCHANT_WALLET placeholders automatically` : "";
-    checks.push({
-      name: "Config",
-      status: "FAIL",
-      detail: `${err instanceof Error ? err.message : String(err)}${hint}`
-    });
-  }
-  const gatewayUrl = deriveGatewayUrl(options.gatewayUrl, config);
-  const health = await fetchJson(fetchImpl, `${gatewayUrl}/health`, CHECK_TIMEOUT_MS);
-  let gatewayUp = false;
-  if (!health.ok) {
-    checks.push({
-      name: "Gateway",
-      status: "FAIL",
-      detail: `unreachable at ${gatewayUrl} (${health.error ?? `HTTP ${health.status}`})`
-    });
-  } else {
-    gatewayUp = true;
-    const ready = await fetchJson(fetchImpl, `${gatewayUrl}/ready`, CHECK_TIMEOUT_MS);
-    checks.push(
-      ready.ok ? { name: "Gateway", status: "PASS", detail: `healthy and ready at ${gatewayUrl}` } : {
-        name: "Gateway",
-        status: "WARN",
-        detail: `healthy but not ready at ${gatewayUrl} (${ready.error ?? `HTTP ${ready.status}`})`
-      }
-    );
-  }
-  if (config === void 0) {
-    checks.push({ name: "Backend", status: "WARN", detail: "skipped: config invalid" });
-  } else if (config.resources.length === 0) {
-    checks.push({ name: "Backend", status: "INFO", detail: "no resources configured" });
-  } else {
-    const resources = config.resources;
-    const urls = [...new Set(resources.map((r) => substitutePathParams(r.handler.url)))];
-    const results = await Promise.all(
-      urls.map((url) => fetchJson(fetchImpl, url, CHECK_TIMEOUT_MS))
-    );
-    const reachable = results.filter((r) => r.status !== 0).length;
-    const status = reachable === urls.length ? "PASS" : reachable === 0 ? "FAIL" : "WARN";
-    checks.push({
-      name: "Backend",
-      status,
-      detail: `${reachable}/${urls.length} backend host(s) reachable`
-    });
-  }
-  const wellKnown = gatewayUp ? await fetchJson(
-    fetchImpl,
-    `${gatewayUrl}/.well-known/agent-commerce`,
-    CHECK_TIMEOUT_MS
-  ) : void 0;
-  if (config === void 0) {
-    checks.push({ name: "Protocols", status: "WARN", detail: "skipped: config invalid" });
-  } else if (wellKnown === void 0 || !wellKnown.ok) {
-    checks.push({ name: "Protocols", status: "FAIL", detail: "well-known document unreachable" });
-  } else {
-    const mcpMountPath = config.protocols.mcp.enabled ? config.protocols.mcp.mountPath : void 0;
-    const a2aMountPath = config.protocols.a2a.enabled ? config.protocols.a2a.mountPath : void 0;
-    checks.push({
-      name: "Protocols",
-      status: "PASS",
-      detail: `http=${config.protocols.http.enabled ? "on" : "off"} mcp=${config.protocols.mcp.enabled ? `on (${mcpMountPath})` : "off"} a2a=${config.protocols.a2a.enabled ? `on (${a2aMountPath})` : "off"} acp=${config.protocols.acp.enabled ? `on (${config.protocols.acp.mountPath})` : "off"}`
-    });
-  }
   if (config === void 0) {
-    checks.push({ name: "A2A", status: "WARN", detail: "skipped: config invalid" });
-  } else if (!config.protocols.a2a.enabled) {
-    checks.push({ name: "A2A", status: "INFO", detail: "disabled" });
-  } else {
-    checks.push({
-      name: "A2A",
-      status: "PASS",
-      detail: `experimental \xB7 spec ${A2A_SPEC_VERSION} \xB7 protocol ${A2A_PROTOCOL_VERSION} \xB7 binding ${A2A_PROTOCOL_BINDING} \xB7 mount ${config.protocols.a2a.mountPath} \xB7 card ${A2A_AGENT_CARD_PATH}`
-    });
+    checks.push({ name: "Storage", status: "WARN", detail: "skipped: config invalid" });
+  } else if (
+    // Diagnose without creating: createSqliteReceiptStore creates the file,
+    // so opening a wrong path (a typo, or a container path read from the
+    // host) would leave an empty database and report it healthy, hiding the
+    // real one. `:memory:` never exists on disk, so it takes the open branch
+    // below.
+    config.storage.receipts.path !== ":memory:" && !existsSync(config.storage.receipts.path)
+  ) {
     checks.push({
-      name: "A2A unsupported",
-      status: "INFO",
-      detail: A2A_UNSUPPORTED.join(", ")
+      name: "Storage",
+      status: "WARN",
+      detail: `${missingStoreDetail(config.storage.receipts.path)}. If the gateway is already running, this path does not match the one it uses.`
     });
-  }
-  if (config === void 0) {
-    checks.push({ name: "ACP", status: "WARN", detail: "skipped: config invalid" });
-  } else if (!config.protocols.acp.enabled) {
-    checks.push({ name: "ACP", status: "INFO", detail: "disabled" });
   } else {
-    const acp = config.protocols.acp;
-    checks.push({
-      name: "ACP",
-      status: "PASS",
-      detail: `experimental \xB7 spec ${ACP_SPEC_VERSION} \xB7 API-Version ${ACP_API_VERSION} \xB7 service checkout \xB7 mount ${acp.mountPath} \xB7 discovery ${ACP_WELL_KNOWN_PATH}`
-    });
-    checks.push({
-      name: "ACP auth",
-      status: "PASS",
-      detail: `bearer token configured (${acp.auth.token.length} characters, not shown)`
-    });
-    checks.push(
-      storeFileCheck(
-        "ACP idempotency",
-        acp.idempotency.path,
-        {
-          inMemory: "replay protection is lost on every restart",
-          unwritable: "the adapter cannot claim idempotency keys"
-        },
-        ` (retention ${acp.idempotency.retentionHours}h)`
-      )
-    );
-    checks.push(acpMappingCheck(config, acp.checkout.operations));
-    checks.push({
-      name: "ACP unsupported",
-      status: "INFO",
-      detail: ACP_UNSUPPORTED.join(", ")
-    });
+    let store;
+    try {
+      store = createStore(config.storage.receipts.path);
+      await store.init();
+      const storeHealth = await store.health();
+      let receiptCount;
+      try {
+        receiptCount = await store.countReceipts();
+      } catch {
+        receiptCount = void 0;
+      }
+      let undeliveredCount;
+      try {
+        undeliveredCount = await store.countUndeliveredReceipts();
+      } catch {
+        undeliveredCount = void 0;
+      }
+      const status = storeHealth.status === "pass" ? "PASS" : storeHealth.status === "warn" ? "WARN" : "FAIL";
+      const receiptsSuffix = receiptCount !== void 0 ? `; receipts=${receiptCount}${undeliveredCount !== void 0 && undeliveredCount > 0 ? ` (${undeliveredCount} undelivered)` : ""}` : "";
+      checks.push({
+        name: "Storage",
+        status,
+        detail: `${storeHealth.detail ?? "sqlite"}${receiptsSuffix}`
+      });
+    } catch (err) {
+      checks.push({
+        name: "Storage",
+        status: "FAIL",
+        detail: err instanceof Error ? err.message : String(err)
+      });
+    } finally {
+      await store?.close();
+    }
   }
+  return checks;
+}
+
+// src/cli/commands/doctor/ap2.ts
+function describeIssuers(label, issuers) {
+  const described = issuers.map(
+    (entry) => `${entry.issuer} (${entry.keys.length} key${entry.keys.length === 1 ? "" : "s"})`
+  ).join(", ");
+  return `${label} issuers: ${described}`;
+}
+function ap2Checks(config) {
+  const checks = [];
   const ap2 = config?.authorization?.ap2;
   if (config === void 0) {
     checks.push({ name: "AP2", status: "WARN", detail: "skipped: config invalid" });
@@ -3461,19 +402,331 @@ async function runDoctor(options, deps = {}) {
       detail: AP2_UNSUPPORTED.join(", ")
     });
   }
+  return checks;
+}
+var LOCAL_DEV_MERCHANT_ADDRESS = ANVIL_WELL_KNOWN_ACCOUNTS[1].address;
+var LOCAL_DEV_FACILITATOR_PRIVATE_KEY = ANVIL_WELL_KNOWN_ACCOUNTS[0].privateKey;
+var PLACEHOLDER_ASSET_ADDRESS = "0x000000000000000000000000000000000000dEaD";
+function defaultInitAnswers() {
+  return {
+    backendBaseUrl: "http://localhost:3000",
+    resources: ["weather", "report"],
+    protocols: ["http", "mcp"],
+    x402Enabled: true,
+    merchantPayTo: LOCAL_DEV_MERCHANT_ADDRESS
+  };
+}
+function buildResourcesMap(answers) {
+  const resources = {};
+  const expose = [...answers.protocols];
+  if (answers.resources.includes("weather")) {
+    resources.weather = {
+      name: "Get weather",
+      description: "Deterministic demo weather lookup (free resource).",
+      input: {
+        type: "object",
+        properties: { city: { type: "string" } },
+        required: ["city"],
+        additionalProperties: false
+      },
+      backend: {
+        type: "http",
+        method: "GET",
+        url: `${answers.backendBaseUrl}/api/weather/{city}`
+      },
+      pricing: { type: "free" },
+      expose
+    };
+  }
+  if (answers.resources.includes("report")) {
+    const paid = answers.x402Enabled;
+    resources.report = {
+      name: "Get market report",
+      description: "Deterministic demo premium market report.",
+      // No caller-supplied fields. Config loads a missing `input` as this same
+      // closed schema; writing it out shows that in the generated file
+      input: {
+        type: "object",
+        properties: {},
+        additionalProperties: false
+      },
+      backend: {
+        type: "http",
+        method: "GET",
+        url: `${answers.backendBaseUrl}/api/report`
+      },
+      pricing: paid ? { type: "fixed", amount: "0.01", currency: "USDC" } : { type: "free" },
+      expose,
+      ...paid ? { payments: ["x402"] } : {}
+    };
+  }
+  return resources;
+}
+function buildInitConfigObject(answers) {
+  return {
+    version: 1,
+    merchant: {
+      id: "demo-merchant",
+      name: "Demo Merchant",
+      publicBaseUrl: "http://localhost:8080"
+    },
+    server: { port: 8080, host: "127.0.0.1" },
+    storage: { receipts: { driver: "sqlite", path: "./data/receipts.db" } },
+    protocols: {
+      http: { enabled: answers.protocols.includes("http") },
+      mcp: { enabled: answers.protocols.includes("mcp"), mountPath: "/mcp" }
+    },
+    resources: buildResourcesMap(answers),
+    payments: answers.x402Enabled ? {
+      x402: {
+        enabled: true,
+        network: `eip155:${LOCAL_CHAIN_ID}`,
+        rpcUrl: "http://127.0.0.1:8545",
+        asset: PLACEHOLDER_ASSET_ADDRESS,
+        assetName: "MockUSDC",
+        assetVersion: "2",
+        assetDecimals: 6,
+        payTo: answers.merchantPayTo,
+        maxTimeoutSeconds: 60,
+        facilitator: { mode: "local", signerPrivateKey: LOCAL_DEV_FACILITATOR_PRIVATE_KEY }
+      }
+    } : {}
+  };
+}
+var HEADER = `# Generated by \`agent-commerce init\`.
+#
+# With x402 enabled, the facilitator signerPrivateKey is Anvil's public dev
+# account #0 and the default payTo is account #1.
+# LOCAL DEVELOPMENT ONLY - DO NOT FUND: never use them outside a local chain.
+# payments.x402.asset is a placeholder, not a real contract. Before running
+# against the local chain, run \`npm run chain:deploy\` and set it to the
+# MockUSDC address in \`.deploy/local.json\`. Before pointing this at a funded
+# network, set \`payments.x402.payTo\` to your own settlement address.
+#
+# server.host is loopback (127.0.0.1): binding every interface should be a
+# deliberate edit.
+#
+# server.adminToken and server.allowedOrigins are left unset, so no secret
+# lands in a file you might commit. Without a token the operator routes
+# (/api/receipts, /api/events) return 404. They serve the merchant's commerce
+# ledger: payer addresses, amounts and settlement hashes. To enable them, add
+# these keys to the server block below:
+#   server:
+#     adminToken: \${ADMIN_TOKEN}
+#     allowedOrigins:
+#       - http://localhost:5173
+# See SECURITY.md before exposing this gateway beyond localhost.
+`;
+function renderInitConfigYaml(answers) {
+  const body = stringify(buildInitConfigObject(answers), { indent: 2 });
+  return `${HEADER}
+${body}`;
+}
+
+// src/cli/lib/mask.ts
+function maskMiddle(value, keep = 6) {
+  if (value.length <= keep * 2) return value.length === 0 ? value : "\u2026";
+  return `${value.slice(0, keep)}\u2026${value.slice(-4)}`;
+}
+
+// src/cli/commands/doctor/payments.ts
+function describePaymentFlow(rail, defaultFlow) {
+  const overrides = Object.keys(rail.resourcePaymentFlows ?? {}).length;
+  const overrideCount = overrides > 0 ? ` (${overrides} resource ${overrides === 1 ? "override" : "overrides"})` : "";
+  return `paymentFlow=${rail.paymentFlow ?? defaultFlow}${overrideCount}`;
+}
+function readOffer(rec, rail) {
+  const { asset, network, assetDecimals, assetTransferMethod, status } = rec;
+  const payTo = rec[rail === "mpp" ? "recipient" : "payTo"];
+  if (typeof asset !== "string" || typeof network !== "string" || typeof payTo !== "string") {
+    return void 0;
+  }
+  return {
+    network,
+    asset,
+    payTo,
+    ...typeof assetDecimals === "number" ? { assetDecimals } : {},
+    ...typeof assetTransferMethod === "string" ? { assetTransferMethod } : {},
+    ...typeof status === "string" ? { status } : {}
+  };
+}
+function readOffers(value, rail) {
+  if (!Array.isArray(value)) return void 0;
+  const read = value.map((entry) => isRecord(entry) ? readOffer(entry, rail) : void 0);
+  return read.some((offer) => offer === void 0) ? void 0 : read;
+}
+function extractLiveRail(body, rail = "x402") {
+  const block = isRecord(body?.["payments"]) ? body["payments"][rail] : void 0;
+  if (!isRecord(block)) return void 0;
+  if (block["enabled"] === false) return "disabled";
+  if (block["enabled"] !== true) return void 0;
+  const first = readOffer(block, rail);
+  if (first === void 0) return void 0;
+  let offers = [first];
+  if (block["options"] !== void 0) {
+    const listed = readOffers(block["options"], rail);
+    if (listed === void 0) return void 0;
+    offers = listed;
+  }
+  let resourceOffers;
+  const ownLists = block["resourceOptions"];
+  if (ownLists !== void 0) {
+    if (!isRecord(ownLists)) return void 0;
+    resourceOffers = {};
+    for (const [id, list] of Object.entries(ownLists)) {
+      const read = readOffers(list, rail);
+      if (read === void 0) return void 0;
+      resourceOffers[id] = read;
+    }
+  }
+  const { paymentFlow, resourcePaymentFlows } = block;
+  return {
+    offers,
+    ...resourceOffers !== void 0 ? { resourceOffers } : {},
+    ...typeof paymentFlow === "string" ? { paymentFlow } : {},
+    ...isRecord(resourcePaymentFlows) ? {
+      resourcePaymentFlows: Object.fromEntries(
+        Object.entries(resourcePaymentFlows).map(([id, flow]) => [id, String(flow)])
+      )
+    } : {}
+  };
+}
+function describeOverrides(flows) {
+  const entries = Object.entries(flows ?? {}).sort(([a], [b]) => a.localeCompare(b));
+  return entries.length > 0 ? entries.map(([id, flow]) => `${id}=${flow}`).join(", ") : "none";
+}
+function findRailMismatch(configured, live, payToField = "payTo", customNetworks) {
+  const diffs = [];
+  const differ = (field, liveValue, localValue) => diffs.push(
+    `${field}: gateway is using ${liveValue} but local config resolves to ${localValue}`
+  );
+  const compareOffers = (label, localOffers, liveOffers) => {
+    if (liveOffers.length !== localOffers.length) {
+      differ(label, `${liveOffers.length} offer(s)`, localOffers.length);
+      return;
+    }
+    localOffers.forEach((local, index) => {
+      const remote = liveOffers[index];
+      const prefix = label !== "options" ? `${label}[${index}] ` : localOffers.length > 1 ? `option ${index} ` : "";
+      const profile = findX402Network(local.network, customNetworks);
+      const same = (a, b) => profile ? sameAddress(profile, a, b) : a === b;
+      if (local.network !== remote.network) {
+        differ(`${prefix}network`, `"${remote.network}"`, `"${local.network}"`);
+      }
+      if (!same(local.asset, remote.asset)) differ(`${prefix}asset`, remote.asset, local.asset);
+      if (!same(local.payTo, remote.payTo)) {
+        differ(`${prefix}${payToField}`, remote.payTo, local.payTo);
+      }
+      if (local.assetDecimals !== void 0 && remote.assetDecimals !== void 0 && local.assetDecimals !== remote.assetDecimals) {
+        differ(`${prefix}assetDecimals`, remote.assetDecimals, local.assetDecimals);
+      }
+      if (local.assetTransferMethod !== remote.assetTransferMethod) {
+        differ(
+          `${prefix}assetTransferMethod`,
+          remote.assetTransferMethod ?? "eip3009",
+          local.assetTransferMethod ?? "eip3009"
+        );
+      }
+    });
+  };
+  compareOffers("options", configured.offers, live.offers);
+  const localLists = configured.resourceOffers ?? {};
+  const liveLists = live.resourceOffers ?? {};
+  for (const id of [.../* @__PURE__ */ new Set([...Object.keys(localLists), ...Object.keys(liveLists)])].sort()) {
+    compareOffers(`resources.${id}.x402.accepts`, localLists[id] ?? [], liveLists[id] ?? []);
+  }
+  if (live.paymentFlow !== void 0) {
+    if (live.paymentFlow !== configured.paymentFlow) {
+      differ("paymentFlow", live.paymentFlow, configured.paymentFlow);
+    }
+    const liveOverrides = describeOverrides(live.resourcePaymentFlows);
+    const localOverrides = describeOverrides(configured.resourcePaymentFlows);
+    if (liveOverrides !== localOverrides)
+      differ("resourcePaymentFlows", liveOverrides, localOverrides);
+  }
+  return diffs.length === 0 ? void 0 : diffs.join("; ");
+}
+function describeSettlement(network, facilitator, customNetworks) {
+  const profile = findX402Network(network, customNetworks);
+  const mode = profile ? resolveDeploymentMode(profile) : void 0;
+  const where = profile === void 0 || mode === void 0 ? `unknown network ${network}` : mode === "local" ? `LOCAL dev chain (${network})` : `${describeDeploymentMode(mode)} on ${profile.displayName} (${network})`;
+  const via = facilitator.mode === "local" ? "local (in-process)" : `remote (auth=${facilitator.auth.type})`;
+  return { mode, where, via };
+}
+function mainnetSafetyCheck(name, payToField, facilitator, networks) {
+  const unauthenticated = facilitator.mode === "remote" && facilitator.auth.type === "none";
+  const where = `${describeDeploymentMode("mainnet")} on ${networks.join(", ")}`;
+  return {
+    name,
+    status: unauthenticated ? "WARN" : "INFO",
+    detail: unauthenticated ? `${where}: no credential is sent to the remote facilitator (accepted via allowUnauthenticatedFacilitator); its anonymous-access limits apply. Config load also requires allowMainnet, HTTPS, a non-development ${payToField} and the canonical asset. Payments fail closed.` : `${where}. Enforced at config load: explicit allowMainnet opt-in, remote facilitator over HTTPS with a credential, non-development ${payToField}, and the canonical asset of each network. Payments fail closed.`
+  };
+}
+function railOffer(option) {
+  const { network, asset, payTo, assetDecimals, assetTransferMethod } = option;
+  return {
+    network,
+    asset,
+    payTo,
+    assetDecimals,
+    ...assetTransferMethod !== void 0 ? { assetTransferMethod } : {}
+  };
+}
+function offerHealthCheck(live, named) {
+  const all = [...live.offers, ...Object.values(live.resourceOffers ?? {}).flat()];
+  const offers = [
+    ...new Map(
+      all.map((offer) => [`${offer.network} ${offer.asset} ${offer.payTo}`, offer])
+    ).values()
+  ];
+  const reported = offers.filter((offer) => offer.status !== void 0);
+  if (reported.length === 0) return void 0;
+  const failing = reported.filter((offer) => offer.status === "fail");
+  const degraded = reported.filter((offer) => offer.status === "warn");
+  const describe2 = (list) => list.map(
+    (offer) => `${named(offer.network)} ${maskMiddle(offer.asset)} to ${maskMiddle(offer.payTo)}`
+  ).join("; ");
+  if (failing.length === 0 && degraded.length === 0) {
+    return {
+      name: "Payments (offers)",
+      status: "PASS",
+      detail: `${reported.length} offer(s) pass their health checks`
+    };
+  }
+  const problems = [
+    ...failing.length > 0 ? [`failing: ${describe2(failing)}`] : [],
+    ...degraded.length > 0 ? [`degraded: ${describe2(degraded)}`] : []
+  ];
+  return {
+    name: "Payments (offers)",
+    status: failing.length > 0 ? "FAIL" : "WARN",
+    detail: `${problems.join("; ")}. The gateway logs each reason at debug level`
+  };
+}
+function paymentChecks(config, wellKnown, gatewayUrl, chainDeploy = false) {
+  const checks = [];
+  const stale = `; the gateway may be running against an older deployment - restart it${chainDeploy ? " or re-run chain:deploy" : ""}`;
   const x402 = config?.payments.x402;
   if (x402 === void 0 || !x402.enabled) {
     checks.push({ name: "Payments", status: "INFO", detail: "x402 not configured" });
   } else {
-    const { mode, where, via } = describeSettlement(x402.network, x402.facilitator);
-    const flow = describePaymentFlow(x402);
-    const summary = `x402 v2 (scheme=exact) enabled - ${where}, destination=${maskMiddle(x402.payTo)}, facilitator=${via}, ${flow}`;
-    const live = wellKnown?.ok ? extractWellKnownX402(wellKnown.body) : void 0;
-    if (sameAddress2(x402.asset, PLACEHOLDER_ASSET_ADDRESS)) {
+    const options = x402.options ?? [x402];
+    const resourceOptions = x402.resourceOptions ?? {};
+    const everyOption = [...options, ...Object.values(resourceOptions).flat()];
+    const { mode, where, via } = describeSettlement(x402.network, x402.facilitator, x402.networks);
+    const flow = describePaymentFlow(x402, X402_DEFAULT_PAYMENT_FLOW);
+    const named = (network) => `${findX402Network(network, x402.networks)?.displayName ?? "unknown network"} (${network})`;
+    const terms = options.length === 1 ? `${where}, destination=${maskMiddle(x402.payTo)}` : `${mode !== void 0 ? describeDeploymentMode(mode) : "unknown mode"}, ${options.length} options: ` + options.map((option) => `${named(option.network)} to ${maskMiddle(option.payTo)}`).join("; ");
+    const ownCount = Object.keys(resourceOptions).length;
+    const own = ownCount > 0 ? `, ${ownCount} resource${ownCount === 1 ? "" : "s"} with ${ownCount === 1 ? "its" : "their"} own offers` : "";
+    const summary = `x402 v2 (scheme=exact) enabled - ${terms}${own}, facilitator=${via}, ${flow}`;
+    const live = wellKnown?.ok ? extractLiveRail(wellKnown.body) : void 0;
+    const placeholder = PLACEHOLDER_ASSET_ADDRESS.toLowerCase();
+    if (everyOption.some((option) => option.asset.toLowerCase() === placeholder)) {
       checks.push({
         name: "Payments",
         status: "WARN",
-        detail: `${summary}, but the asset is still the init placeholder ${maskMiddle(PLACEHOLDER_ASSET_ADDRESS)}. No token contract exists there, so every paid call will fail. Set payments.x402.asset (\${X402_ASSET} is filled from .deploy/local.json, which "npm run chain:deploy" writes)`
+        detail: `${summary}, but at least one offer uses the init placeholder ${maskMiddle(PLACEHOLDER_ASSET_ADDRESS)}. Set that offer's asset to its token contract address${chainDeploy ? ' (${X402_ASSET} is filled from .deploy/local.json, which "npm run chain:deploy" writes)' : ""}`
       });
     } else if (live === "disabled") {
       checks.push({
@@ -3488,13 +741,29 @@ async function runDoctor(options, deps = {}) {
         detail: `${summary} (gateway's live settlement config could not be verified)`
       });
     } else {
-      const mismatch = findX402Mismatch(x402, live);
+      const configured = {
+        offers: options.map(railOffer),
+        ...ownCount > 0 ? {
+          resourceOffers: Object.fromEntries(
+            Object.entries(resourceOptions).map(([id, list]) => [id, list.map(railOffer)])
+          )
+        } : {},
+        paymentFlow: x402.paymentFlow ?? X402_DEFAULT_PAYMENT_FLOW,
+        ...x402.resourcePaymentFlows !== void 0 ? { resourcePaymentFlows: x402.resourcePaymentFlows } : {}
+      };
+      const mismatch = findRailMismatch(configured, live, "payTo", x402.networks);
       checks.push(
-        mismatch === void 0 ? { name: "Payments", status: "PASS", detail: summary } : { name: "Payments", status: "FAIL", detail: mismatch }
+        mismatch === void 0 ? { name: "Payments", status: "PASS", detail: summary } : { name: "Payments", status: "FAIL", detail: `${mismatch}${stale}` }
       );
+      const offerHealth = offerHealthCheck(live, named);
+      if (offerHealth !== void 0) checks.push(offerHealth);
     }
     if (mode === "mainnet") {
-      checks.push(mainnetSafetyCheck("Mainnet safety", "payTo", x402.facilitator));
+      checks.push(
+        mainnetSafetyCheck("Mainnet safety", "payTo", x402.facilitator, [
+          ...new Set(everyOption.map((option) => named(option.network)))
+        ])
+      );
     }
   }
   const mpp = config?.payments.mpp;
@@ -3502,99 +771,141 @@ async function runDoctor(options, deps = {}) {
     checks.push({ name: "Payments (MPP)", status: "INFO", detail: "MPP not configured" });
   } else {
     const { mode, where, via } = describeSettlement(mpp.network, mpp.facilitator);
-    const summary = `MPP ${MPP_PROFILE.intent}/${MPP_PROFILE.method}/${MPP_PROFILE.credentialType} enabled - ${where}, asset=${MPP_PROFILE.assetSymbol} ${maskMiddle(mpp.asset)}, recipient=${maskMiddle(mpp.recipient)}, facilitator=${via}, ${describePaymentFlow(mpp)}, spec ${MPP_SPEC_DRAFTS.core}@${MPP_SPEC_COMMIT.slice(0, 7)}, mppx ${MPPX_VERSION}`;
-    const configured = { asset: mpp.asset, network: mpp.network, payTo: mpp.recipient };
-    const live = wellKnown?.ok ? extractWellKnownX402(wellKnown.body, "mpp") : void 0;
-    if (live === "disabled") {
-      checks.push({
-        name: "Payments (MPP)",
-        status: "FAIL",
-        detail: `Local config enables MPP, but ${gatewayUrl} reports it disabled`
-      });
-    } else if (live === void 0) {
-      checks.push({
-        name: "Payments (MPP)",
-        status: "INFO",
-        detail: `${summary} (live MPP settlement config unavailable for comparison)`
-      });
-    } else {
-      const mismatch = findX402Mismatch(configured, live, "recipient");
-      checks.push(
-        mismatch === void 0 ? { name: "Payments (MPP)", status: "PASS", detail: summary } : { name: "Payments (MPP)", status: "FAIL", detail: mismatch }
-      );
-    }
-    if (mode === "mainnet") {
-      checks.push(mainnetSafetyCheck("Mainnet safety (MPP)", "recipient", mpp.facilitator));
-    }
-  }
-  if (config === void 0) {
-    checks.push({ name: "Storage", status: "WARN", detail: "skipped: config invalid" });
-  } else if (
-    // Diagnose without creating: createSqliteReceiptStore creates the file,
-    // so opening a wrong path (a typo, or a container path read from the
-    // host) would leave an empty database and report it healthy, hiding the
-    // real one. `:memory:` never exists on disk, so it takes the open branch
-    // below.
-    config.storage.receipts.path !== ":memory:" && !existsSync(config.storage.receipts.path)
-  ) {
-    checks.push({
-      name: "Storage",
-      status: "WARN",
-      detail: `${missingStoreDetail(config.storage.receipts.path)}. If the gateway is already running, this path does not match the one it uses.`
-    });
-  } else {
-    let store;
-    try {
-      store = createStore(config.storage.receipts.path);
-      await store.init();
-      const storeHealth = await store.health();
-      let receiptCount;
-      try {
-        receiptCount = await store.countReceipts();
-      } catch {
-        receiptCount = void 0;
-      }
-      let undeliveredCount;
-      try {
-        undeliveredCount = await store.countUndeliveredReceipts();
-      } catch {
-        undeliveredCount = void 0;
-      }
-      const status = storeHealth.status === "pass" ? "PASS" : storeHealth.status === "warn" ? "WARN" : "FAIL";
-      const receiptsSuffix = receiptCount !== void 0 ? `; receipts=${receiptCount}${undeliveredCount !== void 0 && undeliveredCount > 0 ? ` (${undeliveredCount} undelivered)` : ""}` : "";
+    const summary = `MPP ${MPP_PROFILE.intent}/${MPP_PROFILE.method}/${MPP_PROFILE.credentialType} enabled - ${where}, asset=${MPP_PROFILE.assetSymbol} ${maskMiddle(mpp.asset)}, recipient=${maskMiddle(mpp.recipient)}, facilitator=${via}, ${describePaymentFlow(mpp, MPP_DEFAULT_PAYMENT_FLOW)}, spec ${MPP_SPEC_DRAFTS.core}@${MPP_SPEC_COMMIT.slice(0, 7)}, mppx ${MPPX_VERSION}`;
+    const configured = {
+      offers: [
+        {
+          network: mpp.network,
+          asset: mpp.asset,
+          payTo: mpp.recipient,
+          assetDecimals: MPP_PROFILE.assetDecimals
+        }
+      ],
+      paymentFlow: mpp.paymentFlow ?? MPP_DEFAULT_PAYMENT_FLOW,
+      ...mpp.resourcePaymentFlows !== void 0 ? { resourcePaymentFlows: mpp.resourcePaymentFlows } : {}
+    };
+    const live = wellKnown?.ok ? extractLiveRail(wellKnown.body, "mpp") : void 0;
+    if (live === "disabled") {
       checks.push({
-        name: "Storage",
-        status,
-        detail: `${storeHealth.detail ?? "sqlite"}${receiptsSuffix}`
+        name: "Payments (MPP)",
+        status: "FAIL",
+        detail: `Local config enables MPP, but ${gatewayUrl} reports it disabled`
       });
-    } catch (err) {
+    } else if (live === void 0) {
       checks.push({
-        name: "Storage",
-        status: "FAIL",
-        detail: err instanceof Error ? err.message : String(err)
+        name: "Payments (MPP)",
+        status: "INFO",
+        detail: `${summary} (live MPP settlement config unavailable for comparison)`
       });
-    } finally {
-      await store?.close();
+    } else {
+      const mismatch = findRailMismatch(configured, live, "recipient");
+      checks.push(
+        mismatch === void 0 ? { name: "Payments (MPP)", status: "PASS", detail: summary } : { name: "Payments (MPP)", status: "FAIL", detail: `${mismatch}${stale}` }
+      );
+    }
+    if (mode === "mainnet") {
+      checks.push(
+        mainnetSafetyCheck("Mainnet safety (MPP)", "recipient", mpp.facilitator, [
+          `${findX402Network(mpp.network)?.displayName ?? "unknown network"} (${mpp.network})`
+        ])
+      );
     }
   }
-  if (wellKnown?.ok) {
+  return checks;
+}
+
+// src/cli/commands/doctor/protocols.ts
+function acpMappingCheck(config, operations) {
+  const byId = new Map(config.resources.map((resource) => [resource.id, resource]));
+  const problems = [];
+  for (const [operation, resourceId] of Object.entries(operations)) {
+    const resource = byId.get(resourceId);
+    if (resource === void 0) {
+      problems.push(`${operation} -> "${resourceId}" does not exist`);
+      continue;
+    }
+    if (!resource.exposedVia.includes("acp")) {
+      problems.push(`${operation} -> "${resourceId}" is not exposed via acp`);
+    }
+    if (resource.pricing.type !== "free" || resource.paymentMethods.length > 0) {
+      problems.push(`${operation} -> "${resourceId}" is not free to invoke`);
+    }
+  }
+  if (problems.length > 0) {
+    return { name: "ACP checkout mapping", status: "FAIL", detail: problems.join("; ") };
+  }
+  return {
+    name: "ACP checkout mapping",
+    status: "PASS",
+    detail: `5 operations mapped to free acp-exposed resources (${Object.values(operations).join(", ")})`
+  };
+}
+function protocolChecks(config, wellKnown) {
+  const checks = [];
+  if (config === void 0) {
+    checks.push({ name: "Protocols", status: "WARN", detail: "skipped: config invalid" });
+  } else if (wellKnown === void 0 || !wellKnown.ok) {
+    checks.push({ name: "Protocols", status: "FAIL", detail: "well-known document unreachable" });
+  } else {
+    const mcpMountPath = config.protocols.mcp.enabled ? config.protocols.mcp.mountPath : void 0;
+    const a2aMountPath = config.protocols.a2a.enabled ? config.protocols.a2a.mountPath : void 0;
     checks.push({
-      name: "Protocol versions",
+      name: "Protocols",
       status: "PASS",
-      detail: "reported by gateway /.well-known/agent-commerce"
+      detail: `http=${config.protocols.http.enabled ? "on" : "off"} mcp=${config.protocols.mcp.enabled ? `on (${mcpMountPath})` : "off"} a2a=${config.protocols.a2a.enabled ? `on (${a2aMountPath})` : "off"} acp=${config.protocols.acp.enabled ? `on (${config.protocols.acp.mountPath})` : "off"}`
     });
+  }
+  if (config === void 0) {
+    checks.push({ name: "A2A", status: "WARN", detail: "skipped: config invalid" });
+  } else if (!config.protocols.a2a.enabled) {
+    checks.push({ name: "A2A", status: "INFO", detail: "disabled" });
   } else {
-    const local = readVersionReport();
     checks.push({
-      name: "Protocol versions",
+      name: "A2A",
+      status: "PASS",
+      detail: `experimental \xB7 spec ${A2A_SPEC_VERSION} \xB7 protocol ${A2A_PROTOCOL_VERSION} \xB7 binding ${A2A_PROTOCOL_BINDING} \xB7 mount ${config.protocols.a2a.mountPath} \xB7 card ${A2A_AGENT_CARD_PATH}`
+    });
+    checks.push({
+      name: "A2A unsupported",
       status: "INFO",
-      detail: `gateway unreachable; local pins: ${local.pinned.map((p) => `${p.name}@${p.version}`).join(", ")}`
+      detail: A2A_UNSUPPORTED.join(", ")
     });
   }
-  const scored = checks.filter((c) => c.status !== "INFO");
-  const passed = scored.filter((c) => c.status === "PASS").length;
-  const exitCode = checks.some((c) => c.status === "FAIL") ? 1 : 0;
-  return { checks, score: { passed, total: scored.length }, exitCode };
+  if (config === void 0) {
+    checks.push({ name: "ACP", status: "WARN", detail: "skipped: config invalid" });
+  } else if (!config.protocols.acp.enabled) {
+    checks.push({ name: "ACP", status: "INFO", detail: "disabled" });
+  } else {
+    const acp = config.protocols.acp;
+    checks.push({
+      name: "ACP",
+      status: "PASS",
+      detail: `experimental \xB7 spec ${ACP_SPEC_VERSION} \xB7 API-Version ${ACP_API_VERSION} \xB7 service checkout \xB7 mount ${acp.mountPath} \xB7 discovery ${ACP_WELL_KNOWN_PATH}`
+    });
+    checks.push({
+      name: "ACP auth",
+      status: "PASS",
+      detail: `bearer token configured (${acp.auth.token.length} characters, not shown)`
+    });
+    checks.push(
+      storeFileCheck(
+        "ACP idempotency",
+        acp.idempotency.path,
+        {
+          inMemory: "replay protection is lost on every restart",
+          unwritable: "the adapter cannot claim idempotency keys"
+        },
+        ` (retention ${acp.idempotency.retentionHours}h)`
+      )
+    );
+    checks.push(acpMappingCheck(config, acp.checkout.operations));
+    checks.push({
+      name: "ACP unsupported",
+      status: "INFO",
+      detail: ACP_UNSUPPORTED.join(", ")
+    });
+  }
+  return checks;
 }
 function statusColor(status, text2) {
   switch (status) {
@@ -3621,17 +932,122 @@ function printDoctorReport(report, io, json) {
   io.stdout(`Score: ${report.score.passed}/${report.score.total} checks passed`);
 }
 
-// src/cli/commands/import-openapi.ts
-init_core();
-
-// src/openapi/discover.ts
-init_errors();
-init_execution();
-init_is_record();
-init_constants4();
+// src/cli/commands/doctor/index.ts
+var CHECK_TIMEOUT_MS = 1500;
+function deriveGatewayUrl(explicit, config) {
+  if (explicit !== void 0) return explicit.replace(/\/$/, "");
+  if (config !== void 0) {
+    const raw = config.server.host;
+    const host = raw === "0.0.0.0" ? "127.0.0.1" : raw === "::" ? "::1" : raw;
+    const authority = host.includes(":") ? `[${host}]` : host;
+    return `http://${authority}:${config.server.port}`;
+  }
+  return "http://localhost:8080";
+}
+function substitutePathParams(url) {
+  let filled = url;
+  for (const name of extractPathParameterNames(url)) {
+    filled = filled.replaceAll(`{${name}}`, "demo-check");
+  }
+  return filled;
+}
+async function runDoctor(options, deps = {}) {
+  const fetchImpl = deps.fetchImpl ?? globalThis.fetch;
+  const loadConfig = deps.loadConfig ?? loadConfigDynamic;
+  const createStore = deps.createStore ?? ((path) => createSqliteReceiptStore({ path }));
+  const fillEnvFromManifest = deps.fillEnvFromManifest ?? fillEnvFromLocalChainManifest;
+  const chainDeploy = (deps.hasChainDeployScript ?? hasChainDeployScript)();
+  const checks = [];
+  let config;
+  const { env, filled, manifestFound } = fillEnvFromManifest(process.env);
+  const filledSuffix = filled.length > 0 ? ` (using local chain manifest ${LOCAL_CHAIN_MANIFEST_PATH} for ${filled.join(", ")})` : "";
+  try {
+    config = await loadConfig({
+      ...options.configPath !== void 0 ? { path: options.configPath } : {},
+      env
+    });
+    checks.push({
+      name: "Config",
+      status: "PASS",
+      detail: `valid: ${config.resources.length} resource(s), merchant "${config.merchant.name}"${filledSuffix}`
+    });
+  } catch (err) {
+    const variable = isCommerceError(err) ? err.details?.["variable"] : void 0;
+    const hint = typeof variable === "string" ? `. Hint: ${unresolvedVariableHint(variable, manifestFound, chainDeploy)}` : "";
+    checks.push({
+      name: "Config",
+      status: "FAIL",
+      detail: `${err instanceof Error ? err.message : String(err)}${hint}`
+    });
+  }
+  const gatewayUrl = deriveGatewayUrl(options.gatewayUrl, config);
+  const health = await fetchJson(fetchImpl, `${gatewayUrl}/health`, CHECK_TIMEOUT_MS);
+  let gatewayUp = false;
+  if (!health.ok) {
+    checks.push({
+      name: "Gateway",
+      status: "FAIL",
+      detail: `unreachable at ${gatewayUrl} (${health.error ?? `HTTP ${health.status}`})`
+    });
+  } else {
+    gatewayUp = true;
+    const ready = await fetchJson(fetchImpl, `${gatewayUrl}/ready`, CHECK_TIMEOUT_MS);
+    checks.push(
+      ready.ok ? { name: "Gateway", status: "PASS", detail: `healthy and ready at ${gatewayUrl}` } : {
+        name: "Gateway",
+        status: "WARN",
+        detail: `healthy but not ready at ${gatewayUrl} (${ready.error ?? `HTTP ${ready.status}`})`
+      }
+    );
+  }
+  if (config === void 0) {
+    checks.push({ name: "Backend", status: "WARN", detail: "skipped: config invalid" });
+  } else if (config.resources.length === 0) {
+    checks.push({ name: "Backend", status: "INFO", detail: "no resources configured" });
+  } else {
+    const resources = config.resources;
+    const urls = [...new Set(resources.map((r) => substitutePathParams(r.handler.url)))];
+    const results = await Promise.all(
+      urls.map((url) => fetchJson(fetchImpl, url, CHECK_TIMEOUT_MS))
+    );
+    const reachable = results.filter((r) => r.status !== 0).length;
+    const status = reachable === urls.length ? "PASS" : reachable === 0 ? "FAIL" : "WARN";
+    checks.push({
+      name: "Backend",
+      status,
+      detail: `${reachable}/${urls.length} backend host(s) reachable`
+    });
+  }
+  const wellKnown = gatewayUp ? await fetchJson(
+    fetchImpl,
+    `${gatewayUrl}/.well-known/agent-commerce`,
+    CHECK_TIMEOUT_MS
+  ) : void 0;
+  checks.push(...protocolChecks(config, wellKnown));
+  checks.push(...ap2Checks(config));
+  checks.push(...paymentChecks(config, wellKnown, gatewayUrl, chainDeploy));
+  checks.push(...await storageChecks(config, createStore));
+  if (wellKnown?.ok) {
+    checks.push({
+      name: "Protocol versions",
+      status: "PASS",
+      detail: "reported by gateway /.well-known/agent-commerce"
+    });
+  } else {
+    const local = readVersionReport();
+    checks.push({
+      name: "Protocol versions",
+      status: "INFO",
+      detail: `gateway unreachable; local pins: ${local.pinned.map((p) => `${p.name}@${p.version}`).join(", ")}`
+    });
+  }
+  const scored = checks.filter((c) => c.status !== "INFO");
+  const passed = scored.filter((c) => c.status === "PASS").length;
+  const exitCode = checks.some((c) => c.status === "FAIL") ? 1 : 0;
+  return { checks, score: { passed, total: scored.length }, exitCode };
+}
 
 // src/openapi/refs.ts
-init_errors();
 var MAX_REF_DEPTH = 100;
 function isRefNode(value) {
   return typeof value === "object" && value !== null && typeof value.$ref === "string";
@@ -3731,14 +1147,14 @@ function discoverOperations(loaded, options = {}) {
   }
   const rootServers = document["servers"];
   const rootSecurity = document["security"];
-  for (const [path2, rawPathItem] of Object.entries(paths)) {
-    if (path2.startsWith("x-")) continue;
-    if (!path2.startsWith("/")) {
+  for (const [path, rawPathItem] of Object.entries(paths)) {
+    if (path.startsWith("x-")) continue;
+    if (!path.startsWith("/")) {
       diagnostics.push({
         severity: "warning",
         code: "invalid-path-key",
-        operation: path2,
-        message: `Skipped "${path2}": a Paths key must start with "/"`
+        operation: path,
+        message: `Skipped "${path}": a Paths key must start with "/"`
       });
       continue;
     }
@@ -3748,8 +1164,8 @@ function discoverOperations(loaded, options = {}) {
       diagnostics.push({
         severity: "warning",
         code: "unsupported-method",
-        operation: `${name.toUpperCase()} ${path2}`,
-        message: `Skipped ${name.toUpperCase()} ${path2}: only GET, POST, PUT, PATCH and DELETE are supported`
+        operation: `${name.toUpperCase()} ${path}`,
+        message: `Skipped ${name.toUpperCase()} ${path}: only GET, POST, PUT, PATCH and DELETE are supported`
       });
     };
     for (const [key, rawOperation] of Object.entries(pathItem)) {
@@ -3766,9 +1182,9 @@ function discoverOperations(loaded, options = {}) {
       }
       const operation = dereference(document, rawOperation).value;
       if (!isRecord(operation)) continue;
-      const where = `${method} ${path2}`;
+      const where = `${method} ${path}`;
       const operationId = typeof operation["operationId"] === "string" ? operation["operationId"] : void 0;
-      const resourceId = toResourceId(operationId, method, path2);
+      const resourceId = toResourceId(operationId, method, path);
       const previous = claimed.get(resourceId);
       if (previous !== void 0) {
         throw new CommerceError(
@@ -3786,7 +1202,7 @@ function discoverOperations(loaded, options = {}) {
         diagnostics
       );
       if (server === void 0) continue;
-      const backendUrl = `${server.replace(/\/+$/, "")}${path2}`;
+      const backendUrl = `${server.replace(/\/+$/, "")}${path}`;
       const stray = findUnparsedBraceToken(backendUrl);
       if (stray !== void 0) {
         diagnostics.push({
@@ -3803,7 +1219,7 @@ function discoverOperations(loaded, options = {}) {
       operations.push({
         resourceId,
         method,
-        path: path2,
+        path,
         backendUrl,
         ...operationId !== void 0 ? { operationId } : {},
         tags: toArray(operation["tags"]).filter((tag) => typeof tag === "string"),
@@ -3823,10 +1239,10 @@ function discoverOperations(loaded, options = {}) {
   }
   return { operations, diagnostics };
 }
-function toResourceId(operationId, method, path2) {
+function toResourceId(operationId, method, path) {
   const fromOperationId = operationId === void 0 ? "" : normalizeId(operationId);
   if (fromOperationId !== "") return fromOperationId;
-  return normalizeId(`${method.toLowerCase()}_${path2}`);
+  return normalizeId(`${method.toLowerCase()}_${path}`);
 }
 function normalizeId(value) {
   return value.replace(ID_DISALLOWED, "_").replace(/_+/g, "_").replace(/^[_.-]+|[_.-]+$/g, "").slice(0, MCP_TOOL_NAME_MAX_LENGTH);
@@ -3930,17 +1346,6 @@ function assertAbsoluteHttpUrl(value, label) {
 function toArray(value) {
   return Array.isArray(value) ? value : [];
 }
-
-// src/openapi/draft.ts
-init_is_record();
-
-// src/openapi/request.ts
-init_execution();
-init_is_record();
-
-// src/openapi/schema.ts
-init_errors();
-init_is_record();
 var SUPPORTED_TYPES = /* @__PURE__ */ new Set([
   "object",
   "string",
@@ -3963,7 +1368,7 @@ var ANNOTATION_KEYWORDS = /* @__PURE__ */ new Set([
   "definitions"
 ]);
 function isPrimitiveSchema(schema) {
-  const types = typeList2(schema["type"]);
+  const types = typeList(schema["type"]);
   if (types === void 0) return false;
   return types.every((type) => type !== "object" && type !== "array" && SUPPORTED_TYPES.has(type));
 }
@@ -4047,7 +1452,7 @@ function isCarriedKeyword(keyword) {
   return keyword === "type" || keyword === "properties" || keyword === "required" || keyword === "additionalProperties" || keyword === "enum" || keyword === "items" || keyword === "nullable" || keyword === "$ref" || METADATA_KEYWORDS.includes(keyword);
 }
 function resolveTypes(schema) {
-  const declared = typeList2(schema["type"]);
+  const declared = typeList(schema["type"]);
   if (declared === void 0) return void 0;
   const known = declared.filter((type) => SUPPORTED_TYPES.has(type));
   if (known.length === 0) {
@@ -4056,7 +1461,7 @@ function resolveTypes(schema) {
   if (schema["nullable"] === true && !known.includes("null")) known.push("null");
   return known;
 }
-function typeList2(raw) {
+function typeList(raw) {
   if (typeof raw === "string") return [raw];
   if (Array.isArray(raw) && raw.every((entry) => typeof entry === "string")) {
     return raw;
@@ -4074,7 +1479,7 @@ function mergeAllOf(document, schema, stack, dropped) {
   const parts = [...branches, ...Object.keys(siblings).length > 0 ? [siblings] : []];
   for (const branch of parts) {
     const converted = convertNode(document, branch, stack, dropped);
-    const types = typeList2(converted["type"]);
+    const types = typeList(converted["type"]);
     if (types !== void 0 && !types.includes("object")) {
       throw new UnsupportedSchema("allOf mixes object and non-object schemas");
     }
@@ -4507,13 +1912,10 @@ function renderResourcesYaml(result) {
   });
   return doc.toString({ lineWidth: 0 });
 }
-
-// src/openapi/load.ts
-init_errors();
 var MAX_SOURCE_BYTES = 10 * 1024 * 1024;
 var SUPPORTED_EXTENSIONS = /* @__PURE__ */ new Set([".yaml", ".yml", ".json"]);
 var SUPPORTED_VERSIONS = /* @__PURE__ */ new Set(["3.0", "3.1", "3.2"]);
-function invalid2(message, details, cause) {
+function invalid(message, details, cause) {
   return new CommerceError("CONFIG_INVALID", message, {
     details,
     ...cause !== void 0 ? { cause } : {}
@@ -4534,10 +1936,10 @@ async function readCapped(sourcePath, details) {
       await handle.close();
     }
   } catch (error) {
-    throw invalid2(`OpenAPI document "${sourcePath}" could not be read`, details, error);
+    throw invalid(`OpenAPI document "${sourcePath}" could not be read`, details, error);
   }
   if (length > MAX_SOURCE_BYTES) {
-    throw invalid2(`OpenAPI document "${sourcePath}" is over the ${MAX_SOURCE_BYTES}-byte limit`, {
+    throw invalid(`OpenAPI document "${sourcePath}" is over the ${MAX_SOURCE_BYTES}-byte limit`, {
       ...details,
       maxBytes: MAX_SOURCE_BYTES
     });
@@ -4550,40 +1952,40 @@ async function loadOpenApiDocument(sourcePath) {
   try {
     stats = await stat(sourcePath);
   } catch (error) {
-    throw invalid2(`OpenAPI document "${sourcePath}" could not be read`, details, error);
+    throw invalid(`OpenAPI document "${sourcePath}" could not be read`, details, error);
   }
   if (stats.isDirectory()) {
-    throw invalid2(`"${sourcePath}" is a directory, not an OpenAPI document`, details);
+    throw invalid(`"${sourcePath}" is a directory, not an OpenAPI document`, details);
   }
   if (stats.size > MAX_SOURCE_BYTES) {
-    throw invalid2(
+    throw invalid(
       `OpenAPI document "${sourcePath}" is ${stats.size} bytes, over the ${MAX_SOURCE_BYTES}-byte limit`,
       { ...details, size: stats.size, maxBytes: MAX_SOURCE_BYTES }
     );
   }
   const extension = extname(sourcePath).toLowerCase();
   if (!SUPPORTED_EXTENSIONS.has(extension)) {
-    throw invalid2(
+    throw invalid(
       `OpenAPI document "${sourcePath}" has an unsupported extension "${extension || "(none)"}". Supported: .yaml, .yml, .json`,
       details
     );
   }
   const source = await readCapped(sourcePath, details);
   if (source.trim() === "") {
-    throw invalid2(`OpenAPI document "${sourcePath}" is empty`, details);
+    throw invalid(`OpenAPI document "${sourcePath}" is empty`, details);
   }
   let parsed;
   try {
     parsed = extension === ".json" ? JSON.parse(source) : parse(source);
   } catch (error) {
-    throw invalid2(
+    throw invalid(
       `OpenAPI document "${sourcePath}" is not valid ${extension === ".json" ? "JSON" : "YAML"}: ${error instanceof Error ? error.message : String(error)}`,
       details,
       error
     );
   }
   if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-    throw invalid2(`OpenAPI document "${sourcePath}" is not an object`, details);
+    throw invalid(`OpenAPI document "${sourcePath}" is not an object`, details);
   }
   const document = parsed;
   const version = readVersion(document, sourcePath);
@@ -4591,7 +1993,7 @@ async function loadOpenApiDocument(sourcePath) {
   const result = await validate(document);
   if (!result.valid) {
     const first = result.errors?.[0];
-    throw invalid2(
+    throw invalid(
       `OpenAPI document "${sourcePath}" is not a valid OpenAPI ${version} description: ${first ? `${first.message}${first.path ? ` (at ${first.path})` : ""}` : "unknown validation error"}`,
       { ...details, errors: result.errors?.slice(0, 10) ?? [] }
     );
@@ -4601,18 +2003,18 @@ async function loadOpenApiDocument(sourcePath) {
 function readVersion(document, sourcePath) {
   const details = { sourcePath };
   if (typeof document["swagger"] === "string") {
-    throw invalid2(
+    throw invalid(
       `"${sourcePath}" is a Swagger ${document["swagger"]} document. Only OpenAPI 3.0, 3.1 and 3.2 are supported - convert it first`,
       details
     );
   }
   const declared = document["openapi"];
   if (typeof declared !== "string") {
-    throw invalid2(`"${sourcePath}" has no "openapi" version field`, details);
+    throw invalid(`"${sourcePath}" has no "openapi" version field`, details);
   }
   const featureVersion = /^(\d+\.\d+)(?:\.|$)/.exec(declared)?.[1];
   if (featureVersion === void 0 || !SUPPORTED_VERSIONS.has(featureVersion)) {
-    throw invalid2(
+    throw invalid(
       `OpenAPI version "${declared}" is not supported. Supported: 3.0.x, 3.1.x, 3.2.x`,
       { ...details, version: declared }
     );
@@ -4634,13 +2036,13 @@ function rejectUnsupportedReferences(document, sourcePath) {
     for (const [key, value] of Object.entries(node)) {
       if (key === "$ref" && typeof value === "string") {
         if (!value.startsWith("#")) {
-          throw invalid2(
+          throw invalid(
             `OpenAPI document "${sourcePath}" contains an external reference "${value}". Only internal references (#/...) are supported; the importer performs no network or filesystem lookups`,
             { sourcePath, ref: value }
           );
         }
         if (!isPercentDecodable(value)) {
-          throw invalid2(
+          throw invalid(
             `OpenAPI document "${sourcePath}" contains a reference "${value}" with a malformed percent-escape`,
             { sourcePath, ref: value }
           );
@@ -4811,22 +2213,16 @@ function describe(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
-// src/cli/commands/init.ts
-init_filename();
-
 // src/cli/commands/validate.ts
-init_core();
-function formatConfigError(err, manifestFound = false) {
+function formatConfigError(err, manifestFound = false, chainDeploy = hasChainDeployScript()) {
   if (isCommerceError(err)) {
     const lines = [`FAIL  ${err.code}: ${err.message}`];
     if (err.details !== void 0) {
       lines.push(`      details: ${JSON.stringify(err.details)}`);
     }
     const variable = err.details?.["variable"];
-    if (!manifestFound && typeof variable === "string" && MANIFEST_FILLABLE_ENV_VAR_NAMES.has(variable)) {
-      lines.push(
-        `      hint: "npm run chain:deploy" writes ${LOCAL_CHAIN_MANIFEST_PATH}, which validate/doctor read automatically to fill local X402_*/MERCHANT_WALLET placeholders.`
-      );
+    if (typeof variable === "string") {
+      lines.push(`      hint: ${unresolvedVariableHint(variable, manifestFound, chainDeploy)}`);
     }
     return lines.join("\n");
   }
@@ -4836,14 +2232,14 @@ function formatConfigError(err, manifestFound = false) {
   return `FAIL  ${String(err)}`;
 }
 async function runValidate(options, io, deps = {}) {
-  const loadConfig2 = deps.loadConfig ?? loadConfigDynamic;
+  const loadConfig = deps.loadConfig ?? loadConfigDynamic;
   const fillEnvFromManifest = deps.fillEnvFromManifest ?? fillEnvFromLocalChainManifest;
   const { env, filled, manifestFound } = fillEnvFromManifest(process.env);
   if (filled.length > 0) {
     io.stdout(`using local chain manifest ${LOCAL_CHAIN_MANIFEST_PATH} for ${filled.join(", ")}`);
   }
   try {
-    const config = await loadConfig2({
+    const config = await loadConfig({
       ...options.configPath !== void 0 ? { path: options.configPath } : {},
       env
     });
@@ -4860,7 +2256,9 @@ async function runValidate(options, io, deps = {}) {
     io.stdout(`      authorization: ap2=${onOff(config.authorization?.ap2.enabled)}`);
     return 0;
   } catch (err) {
-    io.stderr(formatConfigError(err, manifestFound));
+    io.stderr(
+      formatConfigError(err, manifestFound, (deps.hasChainDeployScript ?? hasChainDeployScript)())
+    );
     return 1;
   }
 }
@@ -4928,7 +2326,7 @@ async function collectAnswersInteractive() {
       validate: (value) => {
         const trimmed = (value ?? "").trim();
         if (trimmed.length === 0) return "Required";
-        return /^0x[0-9a-fA-F]{40}$/.test(trimmed) ? void 0 : "Must be a 0x-prefixed 20-byte EVM address (42 characters)";
+        return isEvmAddress(trimmed) ? void 0 : "Must be a 0x-prefixed 20-byte EVM address (42 characters)";
       }
     });
     if (clack.isCancel(answer)) {
@@ -4942,11 +2340,11 @@ async function collectAnswersInteractive() {
 }
 async function runInit(options, io, deps = {}) {
   const outputPath = options.outputPath ?? DEFAULT_CONFIG_FILENAME;
-  const loadConfig2 = deps.loadConfig ?? loadConfigDynamic;
+  const loadConfig = deps.loadConfig ?? loadConfigDynamic;
   const parseConfigInMemory = deps.parseConfig ?? parseConfigDynamic;
   const fileExists = deps.fileExists ?? existsSync;
-  const writeFileImpl = deps.writeFile ?? (async (path2, content) => {
-    await writeFile(path2, content, "utf8");
+  const writeFileImpl = deps.writeFile ?? (async (path, content) => {
+    await writeFile(path, content, "utf8");
   });
   if (fileExists(outputPath) && options.force !== true) {
     io.stderr(`FAIL  ${outputPath} already exists. Re-run with --force to overwrite.`);
@@ -4971,7 +2369,7 @@ async function runInit(options, io, deps = {}) {
   io.stdout(`PASS  Wrote ${outputPath}`);
   io.stdout(`PASS  ${outputPath} is valid: ${config.resources.length} resource(s)`);
   try {
-    await loadConfig2({ path: outputPath });
+    await loadConfig({ path: outputPath });
   } catch (err) {
     io.stderr(formatConfigError(err));
     io.stderr(
@@ -4979,11 +2377,17 @@ async function runInit(options, io, deps = {}) {
     );
     return 1;
   }
+  const peers = [
+    ...config.payments.x402?.enabled === true ? ["x402"] : [],
+    ...config.protocols.mcp.enabled ? ["MCP"] : []
+  ];
+  const startNote = peers.length > 0 ? `needs the ${peers.join(" and ")} peers` : "needs no optional peers";
   io.stdout("");
   io.stdout("Next steps:");
   io.stdout(`  agent-commerce validate --config ${outputPath}`);
-  io.stdout("  docker compose up     # start the local demo stack (from a repo clone)");
-  io.stdout(`  agent-commerce doctor --config ${outputPath}`);
+  io.stdout(`  agent-commerce start --config ${outputPath}    # ${startNote}`);
+  io.stdout(`  agent-commerce doctor --config ${outputPath}   # from a second terminal`);
+  io.stdout("  docker compose up     # or the whole local demo stack, from a repo clone");
   return 0;
 }
 
@@ -5015,23 +2419,45 @@ var processIo = {
 };
 
 // src/cli/program.ts
+var ENV_FILE_HELP = "load environment variables from this file; variables already set win";
 function buildProgram(io = processIo) {
   const program = new Command();
-  program.name("agent-commerce").description("CLI for the Agent Commerce Gateway: init, import, validate, doctor, demo.").version(readVersionReport().cliVersion, "-v, --version", "Print the CLI version.").exitOverride().configureOutput({
+  program.name("agent-commerce").description("CLI for the Agent Commerce Gateway: init, import, validate, start, doctor, demo.").version(readVersionReport().cliVersion, "-v, --version", "Print the CLI version.").exitOverride().configureOutput({
     writeOut: (str) => io.stdout(str.replace(/\n+$/, "")),
     writeErr: (str) => io.stderr(str.replace(/\n+$/, ""))
+  }).hook("preAction", (_program, command) => {
+    const { envFile } = command.opts();
+    if (envFile === void 0) return;
+    try {
+      process.loadEnvFile(envFile);
+    } catch (error) {
+      command.error(
+        `error: cannot read --env-file "${envFile}": ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
   });
   program.command("version").description("Print the CLI version and pinned protocol/SDK versions.").action(() => {
     process.exitCode = runVersion(io);
   });
-  program.command("validate").description(`Validate ${DEFAULT_CONFIG_FILENAME} and exit non-zero if it is invalid.`).option("--config <path>", `path to ${DEFAULT_CONFIG_FILENAME}`).action(async (opts) => {
+  program.command("validate").description(`Validate ${DEFAULT_CONFIG_FILENAME} and exit non-zero if it is invalid.`).option("--config <path>", `path to ${DEFAULT_CONFIG_FILENAME}`).option("--env-file <path>", ENV_FILE_HELP).action(async (opts) => {
     const code = await runValidate(
       opts.config !== void 0 ? { configPath: opts.config } : {},
       io
     );
     process.exitCode = code;
   });
-  program.command("doctor").description("Diagnose config, gateway, backend, protocol and payment health.").option("--config <path>", `path to ${DEFAULT_CONFIG_FILENAME}`).option(
+  program.command("start").description(
+    `Start the gateway from ${DEFAULT_CONFIG_FILENAME} and serve until SIGTERM or SIGINT.`
+  ).option("--config <path>", `path to ${DEFAULT_CONFIG_FILENAME}`).option("--env-file <path>", ENV_FILE_HELP).action(async (opts) => {
+    try {
+      const { runGateway } = await import('./run-5MB2D45X.js');
+      await runGateway(opts.config !== void 0 ? { configPath: opts.config } : {});
+    } catch (error) {
+      io.stderr(formatConfigError(error, false, false));
+      process.exit(1);
+    }
+  });
+  program.command("doctor").description("Diagnose config, gateway, backend, protocol and payment health.").option("--config <path>", `path to ${DEFAULT_CONFIG_FILENAME}`).option("--env-file <path>", ENV_FILE_HELP).option(
     "--gateway <url>",
     "gateway base URL (default: derived from config, else http://localhost:8080)"
   ).option("--json", "emit machine-readable JSON instead of a formatted report", false).action(async (opts) => {
@@ -5086,14 +2512,18 @@ function collect(value, previous) {
 }
 
 // src/cli/index.ts
+var serving = false;
 for (const stream of [process.stdout, process.stderr]) {
   stream.on("error", (err) => {
-    if (err.code === "EPIPE") process.exit(0);
-    throw err;
+    if (err.code !== "EPIPE") throw err;
+    if (!serving) process.exit(0);
   });
 }
 async function main() {
   const program = buildProgram();
+  program.hook("preAction", (_program, command) => {
+    serving = command.name() === "start";
+  });
   try {
     await program.parseAsync(process.argv);
   } catch (err) {