@devlab.group/agent-commerce 2.1.0 → 2.2.0

package/dist/cli/chunk-RWVPYAKC.js

@@ -0,0 +1,1742 @@
+import { ACP_WELL_KNOWN_PATH, DEFAULT_CONFIG_FILENAME, ACP_CHECKOUT_OPERATIONS, isObjectSchemaNode, extractPathParameterNames, findUnparsedBraceToken, ACP_OPERATION_INPUT_KEYS, ACP_OPERATION_OPTIONAL_INPUT_KEYS, ACP_SESSION_ID_INPUT_KEY } from './chunk-2ZZOGI5I.js';
+import { MPP_DEFAULT_NETWORK, isMppNetwork, MPP_NETWORKS, MPP_DEFAULT_PAYMENT_FLOW, MPP_MIN_CHALLENGE_SECRET_LENGTH, MPP_PROFILE } from './chunk-AA3FIEAR.js';
+import { resolveX402Deployment, resolveX402Option } from './chunk-NSPPEF5M.js';
+import { X402_PAYMENT_FLOWS, validateCustomNetworks, findX402Network, X402_DEFAULT_PAYMENT_FLOW, isEvmAddress, isEvmZeroAddress } from './chunk-7JNYFUT3.js';
+import { AP2_SPEC_VERSION, AP2_MODES, AP2_DEFAULT_CLOCK_SKEW_SECONDS, AP2_JWK_MEMBERS, AP2_KEY_TYPE, AP2_SIGNING_ALGORITHM, AP2_JWK_CURVE, AP2_JWK_COORDINATE_BYTES, AP2_MAX_CLOCK_SKEW_SECONDS } from './chunk-FHCFR2GS.js';
+import { MCP_TOOL_NAME_PATTERN } from './chunk-TPC4EJLT.js';
+import { PROTOCOL_NAMES, PAYMENT_METHOD_NAMES, CommerceError, RESERVED_INPUT_FIELDS } from './chunk-QQ3WY5L3.js';
+import { isRecord } from './chunk-3M6U7ILB.js';
+import { promises } from 'fs';
+import * as path from 'path';
+import { parse, YAMLError } from 'yaml';
+import { z } from 'zod';
+
+// src/config/env.ts
+var PLACEHOLDER_PATTERN = /\$\{([A-Za-z_][A-Za-z0-9_]*)(:-([^}]*))?\}/g;
+var BRACE_TOKEN = /\$\{[^{}]*\}/g;
+var SUPPORTED_TOKEN = /^\$\{[A-Za-z_][A-Za-z0-9_]*(:-[^}]*)?\}$/;
+var NESTED_PLACEHOLDER = /\$\{[^{}]*\$\{/;
+function substituteEnv(value, env, path2 = "$") {
+  if (typeof value === "string") {
+    return substituteString(value, env, path2);
+  }
+  if (Array.isArray(value)) {
+    return value.map((entry, index) => substituteEnv(entry, env, `${path2}[${index}]`));
+  }
+  if (isRecord(value)) {
+    const result = {};
+    for (const [key, entry] of Object.entries(value)) {
+      result[key] = substituteEnv(entry, env, `${path2}.${key}`);
+    }
+    return result;
+  }
+  return value;
+}
+function substituteString(value, env, path2) {
+  assertTemplateIsSupported(value, path2);
+  return substituteOnce(value, env, path2);
+}
+function assertTemplateIsSupported(value, path2) {
+  if (NESTED_PLACEHOLDER.test(value)) {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      `Configuration value at "${path2}" nests placeholders (e.g. "\${A:-\${B}}"), which is not supported: the inner one is not resolved and its closing brace ends up in the value. Use a plain default, or set the variable.`,
+      { details: { path: path2 } }
+    );
+  }
+  for (const [token] of value.matchAll(BRACE_TOKEN)) {
+    if (SUPPORTED_TOKEN.test(token)) continue;
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      `Configuration value at "${path2}" contains "${token}", which is not a supported placeholder. Only "\${VAR}" and "\${VAR:-default}" are recognized; shell forms such as "\${VAR-default}", "\${VAR:=default}" and "\${VAR:?message}" would load as literal text.`,
+      { details: { path: path2, token } }
+    );
+  }
+}
+function substituteOnce(value, env, path2) {
+  return value.replace(
+    PLACEHOLDER_PATTERN,
+    (_match, name, hasDefault, def) => {
+      const envValue = env[name];
+      if (hasDefault !== void 0) {
+        if (envValue === void 0 || envValue === "") return def ?? "";
+        return envValue;
+      }
+      if (envValue === void 0) {
+        throw new CommerceError(
+          "CONFIG_INVALID",
+          `Unresolved environment variable "\${${name}}" referenced at config path "${path2}"`,
+          { details: { variable: name, path: path2 } }
+        );
+      }
+      return envValue;
+    }
+  );
+}
+
+// src/config/schema/values.ts
+function toNumber(value, path2, bounds = {}) {
+  if (typeof value === "string" && !/^\s*\d+\s*$/.test(value)) {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      `Configuration value at "${path2}" must be an integer written in decimal digits (got ${value === "" ? "an empty string" : `"${value}"`})`,
+      { details: { path: path2 } }
+    );
+  }
+  const n = typeof value === "number" ? value : Number(value);
+  if (!Number.isFinite(n) || !Number.isInteger(n)) {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      `Configuration value at "${path2}" must be an integer`,
+      {
+        details: { path: path2 }
+      }
+    );
+  }
+  if (bounds.min !== void 0 && n < bounds.min) {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      `Configuration value at "${path2}" must be >= ${bounds.min}`,
+      {
+        details: { path: path2 }
+      }
+    );
+  }
+  if (bounds.max !== void 0 && n > bounds.max) {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      `Configuration value at "${path2}" must be <= ${bounds.max}`,
+      {
+        details: { path: path2 }
+      }
+    );
+  }
+  return n;
+}
+function toBoolean(value, path2) {
+  if (typeof value === "boolean") return value;
+  const normalized = value.trim().toLowerCase();
+  if (normalized === "true") return true;
+  if (normalized === "false") return false;
+  throw new CommerceError(
+    "CONFIG_INVALID",
+    `Configuration value at "${path2}" must be a boolean ("true" or "false")`,
+    { details: { path: path2 } }
+  );
+}
+function validateAddress(path2, value) {
+  if (!isEvmAddress(value)) {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      `Configuration value at "${path2}" is not a plausible address (expected "0x" followed by 40 hex characters)`,
+      { details: { path: path2 } }
+    );
+  }
+  if (isEvmZeroAddress(value)) {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      `Configuration value at "${path2}" must not be the zero address`,
+      {
+        details: { path: path2 }
+      }
+    );
+  }
+}
+
+// src/config/schema/acp.ts
+var DEFAULT_ACP_MOUNT_PATH = "/acp";
+var ACP_RETENTION_HOURS = 24;
+function acpInvalid(path2, message, extra = {}) {
+  return new CommerceError("CONFIG_INVALID", message, { details: { path: path2, ...extra } });
+}
+function normalizeAcp(raw) {
+  const mountPath = raw?.mountPath ?? DEFAULT_ACP_MOUNT_PATH;
+  if (raw === void 0 || !toBoolean(raw.enabled, "protocols.acp.enabled")) {
+    return { enabled: false, mountPath };
+  }
+  if (raw.auth === void 0) {
+    throw acpInvalid(
+      "protocols.acp.auth",
+      'protocols.acp.auth is required when ACP is enabled - every ACP checkout endpoint is authenticated, and "bearer" is the only scheme supported in this release'
+    );
+  }
+  if (raw.idempotency === void 0) {
+    throw acpInvalid(
+      "protocols.acp.idempotency",
+      "protocols.acp.idempotency is required when ACP is enabled - it names the SQLite file holding checkout idempotency records, and ACP makes the Idempotency-Key mandatory on every checkout POST"
+    );
+  }
+  const discovery = raw.discovery;
+  return {
+    enabled: true,
+    mountPath,
+    auth: raw.auth,
+    idempotency: {
+      path: raw.idempotency.path,
+      retentionHours: toNumber(
+        raw.idempotency.retentionHours ?? ACP_RETENTION_HOURS,
+        "protocols.acp.idempotency.retentionHours",
+        { min: ACP_RETENTION_HOURS }
+      ),
+      merchantIdempotent: raw.idempotency.merchantIdempotent ?? false
+    },
+    checkout: { operations: normalizeAcpOperations(raw.checkout) },
+    // Built key by key so absent metadata stays absent rather than `undefined`
+    ...discovery !== void 0 ? {
+      discovery: {
+        ...discovery.documentationUrl !== void 0 ? { documentationUrl: discovery.documentationUrl } : {},
+        ...discovery.supportedCurrencies !== void 0 ? { supportedCurrencies: discovery.supportedCurrencies } : {},
+        ...discovery.supportedLocales !== void 0 ? { supportedLocales: discovery.supportedLocales } : {},
+        ...discovery.interventionTypes !== void 0 ? { interventionTypes: discovery.interventionTypes } : {}
+      }
+    } : {}
+  };
+}
+function normalizeAcpOperations(checkout) {
+  const configured = checkout?.operations ?? {};
+  for (const key of Object.keys(configured)) {
+    if (!ACP_CHECKOUT_OPERATIONS.includes(key)) {
+      throw acpInvalid(
+        `protocols.acp.checkout.operations.${key}`,
+        `protocols.acp.checkout.operations names unknown ACP checkout operation "${key}". Supported: ${ACP_CHECKOUT_OPERATIONS.join(", ")}.`
+      );
+    }
+  }
+  const operations = {};
+  const claimedBy = /* @__PURE__ */ new Map();
+  for (const operation of ACP_CHECKOUT_OPERATIONS) {
+    const path2 = `protocols.acp.checkout.operations.${operation}`;
+    const resourceId = configured[operation];
+    if (resourceId === void 0) {
+      throw acpInvalid(
+        path2,
+        `${path2} is required when ACP is enabled - all five checkout operations must be mapped, since ACP discovery advertises the checkout service as a whole`
+      );
+    }
+    const claimed = claimedBy.get(resourceId);
+    if (claimed !== void 0) {
+      throw acpInvalid(
+        path2,
+        `${path2} maps resource "${resourceId}", which is already mapped to "${claimed}" - each ACP checkout operation needs its own resource`,
+        { resourceId }
+      );
+    }
+    claimedBy.set(resourceId, operation);
+    operations[operation] = resourceId;
+  }
+  return operations;
+}
+function validateAcpCheckoutMapping(acp, resources) {
+  const byId = new Map(resources.map((resource) => [resource.id, resource]));
+  for (const operation of ACP_CHECKOUT_OPERATIONS) {
+    const resourceId = acp.checkout.operations[operation];
+    const path2 = `protocols.acp.checkout.operations.${operation}`;
+    const resource = byId.get(resourceId);
+    if (resource === void 0) {
+      throw acpInvalid(
+        path2,
+        `${path2} maps resource "${resourceId}", which is not defined under "resources"`,
+        { resourceId }
+      );
+    }
+    if (!resource.exposedVia.includes("acp")) {
+      throw acpInvalid(
+        path2,
+        `Resource "${resourceId}" implements ACP operation "${operation}" but does not list "acp" in its expose - the mapping says which resource serves the operation, expose says ACP may invoke it, and both are required`,
+        { resourceId }
+      );
+    }
+    if (resource.pricing.type !== "free" || resource.paymentMethods.length > 0) {
+      throw acpInvalid(
+        path2,
+        `Resource "${resourceId}" implements ACP operation "${operation}" and must use pricing.type "free" with no "payments" - ACP checkout carries the merchant's own purchase payment, so the gateway does not also charge for the invocation`,
+        { resourceId }
+      );
+    }
+    validateAcpOperationInput(path2, operation, resource);
+  }
+}
+function validateAcpOperationInput(path2, operation, resource) {
+  const schema = resource.inputSchema;
+  if (schema === void 0) return;
+  const keys = ACP_OPERATION_INPUT_KEYS[operation];
+  const optionalKeys = ACP_OPERATION_OPTIONAL_INPUT_KEYS[operation] ?? [];
+  const sent = [...keys, ...optionalKeys];
+  const topLevel = closedObjectProperties(schema);
+  if (topLevel !== void 0) {
+    for (const key of sent) {
+      if (!Object.hasOwn(topLevel, key)) {
+        const when = keys.includes(key) ? "always sends" : "sends when the caller supplies it";
+        throw acpInvalid(
+          path2,
+          `Resource "${resource.id}" implements ACP operation "${operation}" but its input schema sets additionalProperties: false without declaring "${key}", which the adapter ${when} for this operation`,
+          { resourceId: resource.id }
+        );
+      }
+    }
+  }
+  const declared = isRecord(schema["properties"]) ? schema["properties"] : {};
+  const pathKeys = closedObjectProperties(declared["path"]);
+  if (sent.includes("path") && pathKeys !== void 0 && !Object.hasOwn(pathKeys, ACP_SESSION_ID_INPUT_KEY)) {
+    throw acpInvalid(
+      path2,
+      `Resource "${resource.id}" implements ACP operation "${operation}" but its "path" schema sets additionalProperties: false without declaring "${ACP_SESSION_ID_INPUT_KEY}", which the adapter always sends inside "path"`,
+      { resourceId: resource.id }
+    );
+  }
+  const bodyKeys = closedObjectProperties(declared["body"]);
+  if (sent.includes("body") && bodyKeys !== void 0 && Object.keys(bodyKeys).length === 0) {
+    throw acpInvalid(
+      path2,
+      `Resource "${resource.id}" implements ACP operation "${operation}" but its "body" schema accepts no keys, so it refuses every ACP document. Config load closes an object schema that omits additionalProperties: declare body as { type: object, additionalProperties: true }`,
+      { resourceId: resource.id }
+    );
+  }
+  const required = schema["required"];
+  if (Array.isArray(required)) {
+    for (const entry of required) {
+      if (typeof entry === "string" && !keys.includes(entry)) {
+        throw acpInvalid(
+          path2,
+          `Resource "${resource.id}" implements ACP operation "${operation}" but its input schema requires "${entry}", which that operation does not always supply (it always sends: ${keys.join(", ")})`,
+          { resourceId: resource.id }
+        );
+      }
+    }
+  }
+}
+function closedObjectProperties(schema) {
+  if (!isRecord(schema) || schema["additionalProperties"] !== false) return void 0;
+  return isRecord(schema["properties"]) ? schema["properties"] : {};
+}
+
+// src/config/schema/ap2.ts
+var SUPPORTED_AUTHORIZATION_METHODS = /* @__PURE__ */ new Set(["ap2"]);
+function ap2Invalid(path2, message, extra = {}) {
+  return new CommerceError("CONFIG_INVALID", message, { details: { path: path2, ...extra } });
+}
+function normalizeAp2(raw) {
+  if (raw === void 0) return void 0;
+  if (!toBoolean(raw.enabled, "authorization.ap2.enabled")) return { enabled: false };
+  const specVersion = raw.specVersion ?? AP2_SPEC_VERSION;
+  if (specVersion !== AP2_SPEC_VERSION) {
+    throw ap2Invalid(
+      "authorization.ap2.specVersion",
+      `authorization.ap2.specVersion "${specVersion}" is not supported - this gateway verifies against the tagged AP2 release ${AP2_SPEC_VERSION} only`
+    );
+  }
+  const mode = raw.mode ?? AP2_MODES[0];
+  if (!AP2_MODES.includes(mode)) {
+    throw ap2Invalid(
+      "authorization.ap2.mode",
+      `authorization.ap2.mode "${mode}" is not supported. Supported: ${AP2_MODES.join(", ")}. Autonomous mode needs open mandates, agent key binding and constraint evaluation, none of which this release implements.`
+    );
+  }
+  if (raw.replay === void 0) {
+    throw ap2Invalid(
+      "authorization.ap2.replay",
+      "authorization.ap2.replay is required when AP2 is enabled - it names the SQLite file recording which mandates have been spent, and without it a verified mandate could authorize a second settlement"
+    );
+  }
+  const mandateIssuers = normalizeIssuers(
+    raw.trust?.mandateIssuers,
+    "authorization.ap2.trust.mandateIssuers"
+  );
+  const checkoutIssuers = normalizeIssuers(
+    raw.trust?.checkoutIssuers,
+    "authorization.ap2.trust.checkoutIssuers"
+  );
+  return {
+    enabled: true,
+    specVersion: AP2_SPEC_VERSION,
+    mode,
+    trust: { mandateIssuers, checkoutIssuers },
+    clockSkewSeconds: toNumber(
+      raw.clockSkewSeconds ?? AP2_DEFAULT_CLOCK_SKEW_SECONDS,
+      "authorization.ap2.clockSkewSeconds",
+      { min: 0, max: AP2_MAX_CLOCK_SKEW_SECONDS }
+    ),
+    requireMandateAudience: toBoolean(
+      raw.requireMandateAudience ?? false,
+      "authorization.ap2.requireMandateAudience"
+    ),
+    requireMandateExpiry: toBoolean(
+      raw.requireMandateExpiry ?? false,
+      "authorization.ap2.requireMandateExpiry"
+    ),
+    replay: { path: raw.replay.path }
+  };
+}
+function normalizeIssuers(raw, path2) {
+  if (raw === void 0 || raw.length === 0) {
+    throw ap2Invalid(
+      path2,
+      `${path2} is required when AP2 is enabled and must name at least one issuer - trust is operator-configured and static, so an empty list means no mandate can ever verify`
+    );
+  }
+  const seen = /* @__PURE__ */ new Set();
+  return raw.map((entry, index) => {
+    const entryPath = `${path2}.${index}`;
+    if (seen.has(entry.issuer)) {
+      throw ap2Invalid(
+        `${entryPath}.issuer`,
+        `${entryPath}.issuer "${entry.issuer}" is listed twice - key lookup resolves by issuer, so a second entry for the same one is silently unreachable. Merge the keys into one entry instead (which is also how a rotation overlaps an old and a new key).`,
+        { issuer: entry.issuer }
+      );
+    }
+    seen.add(entry.issuer);
+    const kids = /* @__PURE__ */ new Set();
+    const keys = entry.keys.map((key, keyIndex) => {
+      const keyPath = `${entryPath}.keys.${keyIndex}`;
+      if (kids.has(key.kid)) {
+        throw ap2Invalid(
+          `${keyPath}.kid`,
+          `${keyPath}.kid "${key.kid}" is listed twice for issuer "${entry.issuer}" - a kid selects exactly one key, so which of the two verifies a signature would be undefined`,
+          { issuer: entry.issuer, kid: key.kid }
+        );
+      }
+      kids.add(key.kid);
+      return { kid: key.kid, jwk: validateJwk(key.jwk, key.kid, keyPath) };
+    });
+    return { issuer: entry.issuer, audience: entry.audience, keys };
+  });
+}
+function validateJwk(jwk, kid, path2) {
+  const fail = (detail) => {
+    throw ap2Invalid(`${path2}.jwk`, `${path2}.jwk (kid "${kid}") ${detail}`, { kid });
+  };
+  for (const member of Object.keys(jwk)) {
+    if (AP2_JWK_MEMBERS.includes(member)) continue;
+    if (member === "d" || member === "k") {
+      fail(
+        `carries private key material ("${member}"). The gateway verifies signatures and never produces them; publish only the public half. Treat the pasted key as compromised and rotate it.`
+      );
+    }
+    fail(
+      `has unsupported member "${member}". Allowed: ${AP2_JWK_MEMBERS.join(", ")}. Members naming a URL are refused on purpose - keys are configured inline and never fetched.`
+    );
+  }
+  const value = (member) => {
+    const raw = jwk[member];
+    if (typeof raw !== "string" || raw.length === 0) {
+      fail(`must give "${member}" as a non-empty string`);
+    }
+    return raw;
+  };
+  if (value("kty") !== AP2_KEY_TYPE) {
+    fail(
+      `must have kty "${AP2_KEY_TYPE}" (got "${value("kty")}") - ${AP2_SIGNING_ALGORITHM} is the only accepted algorithm`
+    );
+  }
+  if (value("crv") !== AP2_JWK_CURVE) {
+    fail(
+      `must be on curve "${AP2_JWK_CURVE}" (got "${value("crv")}") - ${AP2_SIGNING_ALGORITHM} is the only accepted algorithm`
+    );
+  }
+  for (const coordinate of ["x", "y"]) {
+    const encoded = value(coordinate);
+    if (!/^[A-Za-z0-9_-]+$/.test(encoded)) {
+      fail(`coordinate "${coordinate}" is not base64url (no padding, no "+" or "/")`);
+    }
+    if (Buffer.from(encoded, "base64url").length !== AP2_JWK_COORDINATE_BYTES) {
+      fail(
+        `coordinate "${coordinate}" decodes to ${Buffer.from(encoded, "base64url").length} bytes; a ${AP2_JWK_CURVE} coordinate is ${AP2_JWK_COORDINATE_BYTES}`
+      );
+    }
+  }
+  if (jwk["alg"] !== void 0 && value("alg") !== AP2_SIGNING_ALGORITHM) {
+    fail(`declares alg "${value("alg")}"; only ${AP2_SIGNING_ALGORITHM} is accepted`);
+  }
+  if (jwk["use"] !== void 0 && value("use") !== "sig") {
+    fail(`declares use "${value("use")}"; a verification key must be "sig"`);
+  }
+  if (jwk["kid"] !== void 0 && value("kid") !== kid) {
+    fail(`declares kid "${value("kid")}", which disagrees with the configured kid "${kid}"`);
+  }
+  const normalized = {};
+  for (const member of AP2_JWK_MEMBERS) {
+    if (jwk[member] !== void 0) normalized[member] = value(member);
+  }
+  return normalized;
+}
+function validateReplayStoreIsolated(replayPath, receiptsPath, acp) {
+  if (replayPath === ":memory:") return;
+  const others = [["storage.receipts.path", receiptsPath]];
+  if (acp.enabled) others.push(["protocols.acp.idempotency.path", acp.idempotency.path]);
+  for (const [otherPath, other] of others) {
+    if (replayPath !== other) continue;
+    throw ap2Invalid(
+      "authorization.ap2.replay.path",
+      `authorization.ap2.replay.path is the same file as ${otherPath} ("${replayPath}") - the AP2 replay store keeps its own schema and must not share a database with another store`
+    );
+  }
+}
+function normalizeResourceAuthorization(id, entry, pricing, ap2) {
+  const required = entry.authorization?.required;
+  if (required === void 0) return void 0;
+  const path2 = `resources.${id}.authorization.required`;
+  const methods = [];
+  for (const method of required) {
+    if (!SUPPORTED_AUTHORIZATION_METHODS.has(method)) {
+      throw ap2Invalid(
+        path2,
+        `Resource "${id}" requires unsupported authorization method "${method}". Supported: ${[...SUPPORTED_AUTHORIZATION_METHODS].join(", ")}.`,
+        { resourceId: id, method }
+      );
+    }
+    if (methods.includes(method)) {
+      throw ap2Invalid(path2, `Resource "${id}" lists authorization method "${method}" twice`, {
+        resourceId: id,
+        method
+      });
+    }
+    if (method === "ap2" && (ap2 === void 0 || !ap2.enabled)) {
+      throw ap2Invalid(
+        path2,
+        `Resource "${id}" requires authorization method "ap2", which is not configured or not enabled under authorization.ap2`,
+        { resourceId: id, method }
+      );
+    }
+    methods.push(method);
+  }
+  if (pricing.type !== "fixed") {
+    throw ap2Invalid(
+      path2,
+      `Resource "${id}" requires authorization but its pricing is "${pricing.type}" - authorization proves a purchase was approved and never replaces payment, so it applies to fixed-price paid resources only in this release`,
+      { resourceId: id }
+    );
+  }
+  return { required: methods };
+}
+
+// src/config/schema/x402.ts
+function x402Invalid(message, path2) {
+  return new CommerceError("CONFIG_INVALID", message, { details: { path: path2 } });
+}
+var DIRECT_OPTION_FIELDS = [
+  "network",
+  "payTo",
+  "asset",
+  "assetName",
+  "assetVersion",
+  "assetDecimals",
+  "assetTransferMethod"
+];
+function x402OptionInput(raw, path2) {
+  return {
+    ...raw.scheme !== void 0 ? { scheme: raw.scheme } : {},
+    network: raw.network,
+    payTo: raw.payTo,
+    ...raw.asset !== void 0 ? { asset: raw.asset } : {},
+    ...raw.assetName !== void 0 ? { assetName: raw.assetName } : {},
+    ...raw.assetVersion !== void 0 ? { assetVersion: raw.assetVersion } : {},
+    ...raw.assetTransferMethod !== void 0 ? { assetTransferMethod: raw.assetTransferMethod } : {},
+    ...raw.assetDecimals !== void 0 ? {
+      assetDecimals: toNumber(raw.assetDecimals, `${path2}.assetDecimals`, { min: 0, max: 36 })
+    } : {}
+  };
+}
+function normalizeX402(raw, resources) {
+  const at = "payments.x402";
+  const direct = DIRECT_OPTION_FIELDS.filter((field) => raw[field] !== void 0);
+  if (raw.options !== void 0 && direct.length > 0) {
+    throw x402Invalid(
+      `${at}: give the option either under ${at}.options or directly (${direct.join(", ")}), not both`,
+      `${at}.options`
+    );
+  }
+  if (raw.options?.length === 0) {
+    throw x402Invalid(`${at}.options is empty; list at least one option`, `${at}.options`);
+  }
+  if (raw.options === void 0) {
+    for (const field of ["network", "payTo"]) {
+      if (raw[field] === void 0) {
+        throw x402Invalid(
+          `${at}.${field} is required, unless the options are listed under ${at}.options`,
+          `${at}.${field}`
+        );
+      }
+    }
+  }
+  const settings = raw.networks ?? {};
+  const declared = {};
+  for (const [id, entry] of Object.entries(settings)) {
+    if (entry.kind === void 0 && entry.displayName === void 0) continue;
+    if (entry.kind === void 0 || entry.displayName === void 0) {
+      const path2 = `${at}.networks.${id}`;
+      throw x402Invalid(`${path2}: declaring a network needs both kind and displayName`, path2);
+    }
+    declared[id] = { kind: entry.kind, displayName: entry.displayName };
+  }
+  const networks = Object.keys(declared).length > 0 ? declared : void 0;
+  if (networks !== void 0) validateCustomNetworks(networks, `${at}.networks`);
+  for (const id of Object.keys(settings)) {
+    if (!findX402Network(id, networks)) {
+      const path2 = `${at}.networks.${id}`;
+      throw x402Invalid(
+        `${path2}: "${id}" is not a known network; declare it with kind and displayName`,
+        path2
+      );
+    }
+  }
+  const facilitator = normalizeFacilitator(raw.facilitator);
+  const allowMainnet = raw.allowMainnet !== void 0 ? toBoolean(raw.allowMainnet, `${at}.allowMainnet`) : void 0;
+  const allowUnauthenticatedFacilitator = raw.allowUnauthenticatedFacilitator !== void 0 ? toBoolean(raw.allowUnauthenticatedFacilitator, `${at}.allowUnauthenticatedFacilitator`) : void 0;
+  const rpcOwners = /* @__PURE__ */ new Map();
+  let firstMode;
+  const resolveList = (entries) => {
+    const resolved = entries.map(
+      ([path2, entry]) => resolveX402Option(x402OptionInput(entry, path2), path2, networks)
+    );
+    const seen = /* @__PURE__ */ new Set();
+    const options2 = resolved.map((option, i) => {
+      const path2 = entries[i]?.[0];
+      const network = option.network.id;
+      const rpcUrl = settings[network]?.rpcUrl ?? raw.rpcUrl;
+      if (rpcUrl === void 0) {
+        throw x402Invalid(
+          `${path2}.network: no RPC endpoint for ${network}; set ${at}.rpcUrl or ${at}.networks.${network}.rpcUrl`,
+          `${at}.rpcUrl`
+        );
+      }
+      const endpoint = new URL(rpcUrl).href;
+      const owner = rpcOwners.get(endpoint);
+      if (owner !== void 0 && owner !== network) {
+        throw x402Invalid(
+          `${at}: ${owner} and ${network} would use the same RPC endpoint; give each network its own ${at}.networks.<id>.rpcUrl`,
+          `${at}.networks`
+        );
+      }
+      rpcOwners.set(endpoint, network);
+      const comparable = (value) => option.network.family === "evm" ? value.toLowerCase() : value;
+      const key = `${network}|${comparable(option.asset)}|${comparable(option.payTo)}`;
+      if (seen.has(key)) {
+        throw x402Invalid(
+          `${path2}: repeats an earlier option, the same asset to the same payTo on ${network}`,
+          path2
+        );
+      }
+      seen.add(key);
+      const { mode } = resolveX402Deployment({
+        network,
+        payTo: option.payTo,
+        asset: option.asset,
+        ...option.assetName !== void 0 ? { assetName: option.assetName } : {},
+        ...option.assetVersion !== void 0 ? { assetVersion: option.assetVersion } : {},
+        facilitator,
+        ...allowMainnet !== void 0 ? { allowMainnet } : {},
+        ...allowUnauthenticatedFacilitator !== void 0 ? { allowUnauthenticatedFacilitator } : {},
+        ...networks !== void 0 ? { customNetworks: networks } : {}
+      });
+      if (firstMode !== void 0 && mode !== firstMode) {
+        throw x402Invalid(
+          `${path2}.network: ${network} is a ${mode} network, but the first option is on a ${firstMode} one; every option must be on the same kind of network`,
+          `${path2}.network`
+        );
+      }
+      firstMode = mode;
+      return {
+        network,
+        rpcUrl,
+        asset: option.asset,
+        ...option.assetName !== void 0 ? { assetName: option.assetName } : {},
+        ...option.assetVersion !== void 0 ? { assetVersion: option.assetVersion } : {},
+        assetDecimals: option.assetDecimals,
+        payTo: option.payTo,
+        ...option.assetTransferMethod === "permit2" ? { assetTransferMethod: "permit2" } : {}
+      };
+    });
+    return {
+      options: options2,
+      defaultAssetSymbols: [
+        ...new Set(resolved.flatMap((option) => option.defaultAssetSymbol ?? []))
+      ]
+    };
+  };
+  const rail = resolveList(
+    raw.options !== void 0 ? raw.options.map((option, i) => [`${at}.options[${i}]`, option]) : [[at, raw]]
+  );
+  const resourceTerms = {};
+  for (const [id, entry] of Object.entries(resources)) {
+    const accepts = entry.x402?.accepts;
+    if (accepts === void 0) continue;
+    const path2 = `resources.${id}.x402.accepts`;
+    if (accepts.length === 0) {
+      throw x402Invalid(`${path2} is empty; list at least one option`, path2);
+    }
+    resourceTerms[id] = resolveList(accepts.map((option, i) => [`${path2}[${i}]`, option]));
+  }
+  const options = rail.options;
+  const first = options[0];
+  const resourceOptions = Object.fromEntries(
+    Object.entries(resourceTerms).map(([id, terms]) => [id, terms.options])
+  );
+  const config = {
+    enabled: toBoolean(raw.enabled, `${at}.enabled`),
+    ...first,
+    maxTimeoutSeconds: toNumber(raw.maxTimeoutSeconds, `${at}.maxTimeoutSeconds`, { min: 1 }),
+    paymentFlow: raw.paymentFlow ?? X402_DEFAULT_PAYMENT_FLOW,
+    facilitator,
+    ...allowMainnet !== void 0 ? { allowMainnet } : {},
+    ...allowUnauthenticatedFacilitator !== void 0 ? { allowUnauthenticatedFacilitator } : {},
+    ...networks !== void 0 ? { networks } : {},
+    options,
+    ...Object.keys(resourceOptions).length > 0 ? { resourceOptions } : {}
+  };
+  return { config, ...rail, resources: resourceTerms };
+}
+function normalizeFacilitator(raw) {
+  return raw.mode === "local" ? { mode: "local", signerPrivateKey: raw.signerPrivateKey } : { mode: "remote", url: raw.url, auth: raw.auth ?? { type: "none" } };
+}
+
+// src/config/schema/mpp.ts
+function normalizeMpp(raw) {
+  if (raw === void 0) return void 0;
+  const network = raw.network ?? MPP_DEFAULT_NETWORK;
+  if (!isMppNetwork(network)) {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      `payments.mpp.network must be one of ${MPP_NETWORKS.join(", ")}`,
+      { details: { path: "payments.mpp.network" } }
+    );
+  }
+  const mpp = {
+    enabled: toBoolean(raw.enabled, "payments.mpp.enabled"),
+    network,
+    rpcUrl: raw.rpcUrl,
+    asset: raw.asset,
+    assetName: raw.assetName,
+    assetVersion: raw.assetVersion,
+    recipient: raw.recipient,
+    realm: raw.realm,
+    challengeSecret: raw.challengeSecret,
+    ...raw.challengeTtlSeconds !== void 0 ? {
+      challengeTtlSeconds: toNumber(
+        raw.challengeTtlSeconds,
+        "payments.mpp.challengeTtlSeconds",
+        { min: 1 }
+      )
+    } : {},
+    paymentFlow: raw.paymentFlow ?? MPP_DEFAULT_PAYMENT_FLOW,
+    facilitator: normalizeFacilitator(raw.facilitator),
+    ...raw.allowMainnet !== void 0 ? { allowMainnet: toBoolean(raw.allowMainnet, "payments.mpp.allowMainnet") } : {},
+    ...raw.allowUnauthenticatedFacilitator !== void 0 ? {
+      allowUnauthenticatedFacilitator: toBoolean(
+        raw.allowUnauthenticatedFacilitator,
+        "payments.mpp.allowUnauthenticatedFacilitator"
+      )
+    } : {}
+  };
+  validateAddress("payments.mpp.recipient", mpp.recipient);
+  validateAddress("payments.mpp.asset", mpp.asset);
+  if (/[\r\n]/.test(mpp.realm)) {
+    throw new CommerceError("CONFIG_INVALID", "payments.mpp.realm must be a single line", {
+      details: { path: "payments.mpp.realm" }
+    });
+  }
+  if (mpp.challengeSecret.length < MPP_MIN_CHALLENGE_SECRET_LENGTH) {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      `payments.mpp.challengeSecret must have length at least ${MPP_MIN_CHALLENGE_SECRET_LENGTH}`,
+      { details: { path: "payments.mpp.challengeSecret" } }
+    );
+  }
+  resolveX402Deployment({
+    network: mpp.network,
+    payTo: mpp.recipient,
+    asset: mpp.asset,
+    assetName: mpp.assetName,
+    assetVersion: mpp.assetVersion,
+    facilitator: mpp.facilitator,
+    ...mpp.allowMainnet !== void 0 ? { allowMainnet: mpp.allowMainnet } : {},
+    ...mpp.allowUnauthenticatedFacilitator !== void 0 ? { allowUnauthenticatedFacilitator: mpp.allowUnauthenticatedFacilitator } : {},
+    configPath: "payments.mpp",
+    payToField: "recipient"
+  });
+  return mpp;
+}
+var SUPPORTED_CONFIG_VERSION = 1;
+var NumberOrString = z.union([z.number(), z.string()]);
+var BooleanOrString = z.union([z.boolean(), z.string()]);
+var MediaType = z.string().regex(/^[A-Za-z0-9][\w!#$&^.+-]*\/[A-Za-z0-9][\w!#$&^.+-]*(?:[ \t]*;.*)?$/, {
+  message: "must be a media type such as application/json"
+});
+var RpcUrl = z.string().min(1).refine(isHttpUrl, { message: "must be an http:// or https:// URL" });
+function isHttpUrl(value) {
+  try {
+    const { protocol } = new URL(value);
+    return protocol === "http:" || protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+var MerchantSchema = z.object({
+  id: z.string().min(1),
+  name: z.string().min(1),
+  publicBaseUrl: z.string().min(1)
+}).strict();
+var ServerSchema = z.object({
+  port: NumberOrString,
+  host: z.string().min(1),
+  // Shared secret gating /api/receipts and /api/events. Without it both
+  // routes 404.
+  adminToken: z.string().min(1).optional(),
+  // Browser origins allowed to call the gateway; none by default. A request
+  // with any other `Origin` gets 403 on every route. Entries match the
+  // `Origin` header exactly (ignoring case), so `"*"` and a trailing slash
+  // would match nothing: a silent lockout that an operator might "fix" by
+  // disabling the check. Both are refused with a pointer.
+  allowedOrigins: z.array(
+    z.string().min(1).refine((origin) => origin !== "*", {
+      message: `wildcard "*" is not supported - allowedOrigins entries are matched literally against the browser's Origin header, so "*" would match nothing. List each scheme://host[:port] explicitly.`
+    }).refine((origin) => !origin.endsWith("/"), {
+      message: 'must not end with "/" - a browser Origin header never has a trailing slash, so this entry would match nothing. Use e.g. "http://localhost:5173".'
+    })
+  ).optional()
+}).strict();
+var StorageSchema = z.object({
+  receipts: z.object({
+    driver: z.literal("sqlite"),
+    path: z.string().min(1)
+  }).strict()
+}).strict();
+var RESERVED_GATEWAY_PATHS = [
+  "/health",
+  "/ready",
+  "/.well-known/agent-commerce",
+  // Fixed by the A2A specification and served by the adapter
+  "/.well-known/agent-card.json",
+  // Fixed by the ACP specification
+  ACP_WELL_KNOWN_PATH,
+  "/api/resources",
+  "/api/resources/:id/invoke",
+  "/api/receipts",
+  "/api/events"
+];
+var MountPathSchema = z.string().min(1).refine((value) => value.startsWith("/"), {
+  message: 'must start with "/" - it is an absolute gateway path, e.g. "/mcp".'
+}).refine((value) => !/[:*?\s]/.test(value), {
+  message: 'must not contain ":", "*", "?" or whitespace - the mount is a literal path prefix, not a Fastify route pattern, and registers its own wildcard.'
+}).refine(
+  (value) => {
+    const base = value.replace(/\/+$/, "");
+    return !RESERVED_GATEWAY_PATHS.some(
+      (reserved) => reserved === base || reserved.startsWith(`${base}/`)
+    );
+  },
+  {
+    message: `must not collide with a route the gateway already serves (${RESERVED_GATEWAY_PATHS.join(", ")}); pick a dedicated prefix such as "/mcp".`
+  }
+);
+var AcpAuthSchema = z.object({ type: z.literal("bearer"), token: z.string().min(1) }).strict();
+var AcpIdempotencySchema = z.object({
+  path: z.string().min(1),
+  retentionHours: NumberOrString.optional(),
+  merchantIdempotent: z.boolean().optional()
+}).strict();
+var AcpCheckoutSchema = z.object({ operations: z.record(z.string().min(1)) }).strict();
+var AcpDiscoverySchema = z.object({
+  documentationUrl: z.string().min(1).optional(),
+  supportedCurrencies: z.array(z.string().min(1)).optional(),
+  supportedLocales: z.array(z.string().min(1)).optional(),
+  interventionTypes: z.array(z.string().min(1)).optional()
+}).strict();
+var ProtocolsSchema = z.object({
+  http: z.object({ enabled: BooleanOrString }).strict(),
+  mcp: z.object({
+    enabled: BooleanOrString,
+    mountPath: MountPathSchema
+  }).strict(),
+  // Optional; A2A is off unless configured
+  a2a: z.object({
+    enabled: BooleanOrString,
+    mountPath: MountPathSchema.optional()
+  }).strict().optional(),
+  // Optional and off by default. The business pass requires the sub-blocks
+  // only when ACP is enabled, so a disabled placeholder stays valid and an
+  // enabled block gets a message naming what it lacks.
+  acp: z.object({
+    enabled: BooleanOrString,
+    mountPath: MountPathSchema.optional(),
+    auth: AcpAuthSchema.optional(),
+    idempotency: AcpIdempotencySchema.optional(),
+    checkout: AcpCheckoutSchema.optional(),
+    discovery: AcpDiscoverySchema.optional()
+  }).strict().optional()
+}).strict();
+var BackendMethodSchema = z.enum(["GET", "POST", "PUT", "PATCH", "DELETE"]);
+var BackendInputBindingsSchema = z.object({
+  path: z.string().min(1).optional(),
+  query: z.string().min(1).optional(),
+  body: z.string().min(1).optional()
+}).strict();
+var BackendHandlerSchema = z.object({
+  type: z.literal("http"),
+  method: BackendMethodSchema,
+  url: z.string().min(1),
+  headers: z.record(z.string(), z.string()).optional(),
+  timeoutMs: NumberOrString.optional(),
+  inputBindings: BackendInputBindingsSchema.optional()
+}).strict();
+var PricingSchema = z.discriminatedUnion("type", [
+  z.object({ type: z.literal("free") }).strict(),
+  z.object({
+    type: z.literal("fixed"),
+    amount: z.string().min(1),
+    currency: z.string().min(1)
+  }).strict(),
+  z.object({
+    type: z.literal("dynamic"),
+    resolver: z.string().min(1)
+  }).strict()
+]);
+var JsonSchemaValueSchema = z.record(z.string(), z.unknown());
+var X402OptionSchema = z.object({
+  scheme: z.string().min(1).optional(),
+  network: z.string().min(1),
+  payTo: z.string().min(1),
+  asset: z.string().min(1).optional(),
+  assetName: z.string().min(1).optional(),
+  assetVersion: z.string().min(1).optional(),
+  assetDecimals: NumberOrString.optional(),
+  assetTransferMethod: z.string().min(1).optional()
+}).strict();
+var ResourceEntrySchema = z.object({
+  name: z.string().min(1),
+  description: z.string().optional(),
+  input: JsonSchemaValueSchema.optional(),
+  output: JsonSchemaValueSchema.optional(),
+  // What the backend returns; x402 challenges declare it, `application/json` by default
+  mimeType: MediaType.optional(),
+  backend: BackendHandlerSchema,
+  pricing: PricingSchema,
+  expose: z.array(z.string().min(1)).min(1),
+  payments: z.array(z.string().min(1)).optional(),
+  paymentFlow: z.enum(X402_PAYMENT_FLOWS).optional(),
+  // This resource's own x402 offers, in place of `payments.x402` options
+  x402: z.object({ accepts: z.array(X402OptionSchema) }).strict().optional(),
+  authorization: z.object({ required: z.array(z.string().min(1)).min(1) }).strict().optional()
+}).strict();
+var ResourcesMapSchema = z.record(z.string().min(1), ResourceEntrySchema);
+var FacilitatorAuthSchema = z.discriminatedUnion("type", [
+  z.object({ type: z.literal("none") }).strict(),
+  z.object({ type: z.literal("bearer"), token: z.string().min(1) }).strict(),
+  // Coinbase Developer Platform. Needs the optional peer `@coinbase/x402`,
+  // which signs a fresh JWT per request.
+  z.object({
+    type: z.literal("cdp"),
+    apiKeyId: z.string().min(1),
+    apiKeySecret: z.string().min(1)
+  }).strict()
+]);
+var FacilitatorSchema = z.discriminatedUnion("mode", [
+  z.object({
+    mode: z.literal("local"),
+    signerPrivateKey: z.string().min(1)
+  }).strict(),
+  z.object({
+    mode: z.literal("remote"),
+    url: z.string().min(1),
+    // Absent auth sends no credential and normalizes to `{ type: 'none' }`,
+    // which on mainnet requires `allowUnauthenticatedFacilitator`
+    auth: FacilitatorAuthSchema.optional()
+  }).strict()
+]);
+var X402NetworkSettingsSchema = z.object({
+  kind: z.enum(["testnet", "mainnet"]).optional(),
+  displayName: z.string().min(1).optional(),
+  rpcUrl: RpcUrl.optional()
+}).strict();
+var X402Schema = z.object({
+  enabled: BooleanOrString,
+  // Accept direct fields or an `options` array, never both
+  network: z.string().min(1).optional(),
+  payTo: z.string().min(1).optional(),
+  asset: z.string().min(1).optional(),
+  assetName: z.string().min(1).optional(),
+  assetVersion: z.string().min(1).optional(),
+  assetDecimals: NumberOrString.optional(),
+  assetTransferMethod: z.string().min(1).optional(),
+  options: z.array(X402OptionSchema).optional(),
+  networks: z.record(z.string().min(1), X402NetworkSettingsSchema).optional(),
+  // The RPC for every network without its own `networks.<id>.rpcUrl`
+  rpcUrl: RpcUrl.optional(),
+  maxTimeoutSeconds: NumberOrString,
+  // `authorization` (the x402 default) settles after the backend call
+  paymentFlow: z.enum(X402_PAYMENT_FLOWS).optional(),
+  facilitator: FacilitatorSchema,
+  // Real funds. Never defaulted; see src/payments/x402/guardrails.ts
+  allowMainnet: BooleanOrString.optional(),
+  // Accepts credential-free facilitator access on mainnet. Never defaulted
+  allowUnauthenticatedFacilitator: BooleanOrString.optional()
+}).strict();
+var MppSchema = z.object({
+  enabled: BooleanOrString,
+  network: z.string().min(1).optional(),
+  rpcUrl: RpcUrl,
+  asset: z.string().min(1),
+  assetName: z.string().min(1),
+  assetVersion: z.string().min(1),
+  recipient: z.string().min(1),
+  realm: z.string().min(1),
+  challengeSecret: z.string().min(1),
+  challengeTtlSeconds: NumberOrString.optional(),
+  // Same values as `payments.x402.paymentFlow`; the default is `upfront`
+  paymentFlow: z.enum(X402_PAYMENT_FLOWS).optional(),
+  facilitator: FacilitatorSchema,
+  // Real funds. Never defaulted; see src/payments/x402/guardrails.ts
+  allowMainnet: BooleanOrString.optional(),
+  // Accepts credential-free facilitator access on mainnet. Never defaulted
+  allowUnauthenticatedFacilitator: BooleanOrString.optional()
+}).strict();
+var PaymentsSchema = z.object({
+  x402: X402Schema.optional(),
+  mpp: MppSchema.optional()
+}).strict();
+var Ap2KeySchema = z.object({
+  kid: z.string().min(1),
+  jwk: z.record(z.string(), z.unknown())
+}).strict();
+var Ap2IssuerSchema = z.object({
+  issuer: z.string().min(1),
+  // Required, not defaulted: without it a mandate minted for another
+  // merchant would verify here
+  audience: z.string().min(1),
+  keys: z.array(Ap2KeySchema).min(1)
+}).strict();
+var Ap2Schema = z.object({
+  enabled: BooleanOrString,
+  specVersion: z.string().min(1).optional(),
+  mode: z.string().min(1).optional(),
+  trust: z.object({
+    mandateIssuers: z.array(Ap2IssuerSchema).optional(),
+    checkoutIssuers: z.array(Ap2IssuerSchema).optional()
+  }).strict().optional(),
+  clockSkewSeconds: NumberOrString.optional(),
+  requireMandateAudience: BooleanOrString.optional(),
+  requireMandateExpiry: BooleanOrString.optional(),
+  replay: z.object({ path: z.string().min(1) }).strict().optional()
+}).strict();
+var AuthorizationSchema = z.object({ ap2: Ap2Schema.optional() }).strict();
+var RawConfigSchema = z.object({
+  version: z.literal(SUPPORTED_CONFIG_VERSION),
+  merchant: MerchantSchema,
+  server: ServerSchema,
+  storage: StorageSchema,
+  protocols: ProtocolsSchema,
+  resources: ResourcesMapSchema,
+  payments: PaymentsSchema,
+  authorization: AuthorizationSchema.optional()
+}).strict();
+
+// src/config/schema/backend.ts
+function validateInputBindings(id, backend, input) {
+  const legacy = { schema: input, where: "its input schema" };
+  const bindings = backend.inputBindings;
+  const templated = extractPathParameterNames(backend.url).length > 0;
+  if (bindings === void 0) return legacy;
+  const path2 = `resources.${id}.backend.inputBindings`;
+  const fail = (message, details = {}) => {
+    throw new CommerceError("CONFIG_INVALID", `Resource "${id}" ${message}`, {
+      details: { path: path2, resourceId: id, ...details }
+    });
+  };
+  const entries = Object.entries(bindings).filter(
+    (entry) => entry[1] !== void 0
+  );
+  if (entries.length === 0) {
+    fail("has an empty backend.inputBindings - remove the block to use the default mapping");
+  }
+  if (backend.method === "GET" || backend.method === "DELETE") {
+    if (bindings.body !== void 0) {
+      fail(
+        `binds a request body on a ${backend.method}, which sends none - the value would be silently dropped`
+      );
+    }
+  }
+  if (templated && bindings.path === void 0) {
+    fail(
+      'has backend.url path parameters but no "path" binding - in explicit binding mode nothing else supplies them, so every call would fail to reach the backend'
+    );
+  }
+  const seen = /* @__PURE__ */ new Map();
+  const properties = isRecord(input?.["properties"]) ? input["properties"] : {};
+  const required = new Set(
+    Array.isArray(input?.["required"]) ? input["required"].filter((value) => typeof value === "string") : []
+  );
+  for (const [location, property] of entries) {
+    if (RESERVED_INPUT_FIELDS.includes(property)) {
+      fail(`binds "${location}" to "${property}", which is reserved by the gateway`, { location });
+    }
+    const other = seen.get(property);
+    if (other !== void 0) {
+      fail(`binds both "${other}" and "${location}" to the input property "${property}"`, {
+        location,
+        property
+      });
+    }
+    seen.set(property, location);
+    if (!Object.hasOwn(properties, property)) {
+      fail(
+        `binds "${location}" to input property "${property}", which the input schema does not declare - the schema is closed, so a caller could never supply it`,
+        { location, property }
+      );
+    }
+    const declared = properties[property];
+    if (location !== "body" && isRecord(declared) && !isObjectSchemaNode(declared)) {
+      fail(
+        `binds "${location}" to input property "${property}", which is not an object schema - ${location} parameters are read as an object of name/value pairs`,
+        { location, property }
+      );
+    }
+  }
+  if (templated && bindings.path !== void 0 && !required.has(bindings.path)) {
+    fail(
+      `binds path parameters to input property "${bindings.path}" without listing it in the input schema's "required" - a caller that omits it cannot supply any path parameter, so the request could never be built`,
+      { property: bindings.path }
+    );
+  }
+  if (bindings.path === void 0) return { schema: void 0, where: "its input schema" };
+  const group = properties[bindings.path];
+  return {
+    schema: isRecord(group) ? group : void 0,
+    where: `input.properties.${bindings.path}`
+  };
+}
+function validatePathParametersDeclared(id, url, input, where) {
+  const stray = findUnparsedBraceToken(url);
+  if (stray !== void 0) {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      `Resource "${id}" has backend.url containing "${stray}", which is not a valid path parameter (allowed characters: A-Z a-z 0-9 _ . -). It would reach the backend as literal text, so a paid resource would take payment for a request the backend cannot serve`,
+      { details: { path: `resources.${id}.backend.url`, resourceId: id, token: stray } }
+    );
+  }
+  const params = extractPathParameterNames(url);
+  if (params.length === 0) return;
+  const firstBrace = url.indexOf("{");
+  if (firstBrace !== -1) {
+    const prefix = url.slice(0, firstBrace);
+    let origin;
+    try {
+      const parsedPrefix = new URL(prefix);
+      origin = parsedPrefix.hostname === "" ? void 0 : parsedPrefix.origin;
+    } catch {
+    }
+    if (origin === void 0 || !prefix.startsWith(`${origin}/`)) {
+      throw new CommerceError(
+        "CONFIG_INVALID",
+        `Resource "${id}" has a backend.url parameter before the end of the host. A caller-supplied value would choose which host the gateway calls, which is request forgery with the gateway's own network position. Parameters are supported inside the path and query only`,
+        { details: { path: `resources.${id}.backend.url`, resourceId: id } }
+      );
+    }
+  }
+  const propertiesRaw = input?.["properties"];
+  const properties = isRecord(propertiesRaw) ? propertiesRaw : {};
+  const requiredRaw = input?.["required"];
+  const required = new Set(
+    Array.isArray(requiredRaw) ? requiredRaw.filter((entry) => typeof entry === "string") : []
+  );
+  for (const param of params) {
+    const path2 = `resources.${id}.backend.url`;
+    if (!Object.hasOwn(properties, param)) {
+      throw new CommerceError(
+        "CONFIG_INVALID",
+        `Resource "${id}" has backend.url path parameter "{${param}}" which is not declared in ${where} - the caller has no way to supply it, so every call would be refused`,
+        { details: { path: path2, resourceId: id, param } }
+      );
+    }
+    if (!required.has(param)) {
+      throw new CommerceError(
+        "CONFIG_INVALID",
+        `Resource "${id}" has backend.url path parameter "{${param}}" declared in ${where} but not listed in its "required" - a call that omits it would be refused`,
+        { details: { path: path2, resourceId: id, param } }
+      );
+    }
+  }
+}
+function validateBackendUrl(id, url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      `Resource "${id}" has an invalid backend.url: must be an absolute http:// or https:// URL`,
+      { details: { path: `resources.${id}.backend.url`, resourceId: id } }
+    );
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      `Resource "${id}" has a backend.url with scheme "${parsed.protocol}": must be http:// or https://`,
+      { details: { path: `resources.${id}.backend.url`, resourceId: id } }
+    );
+  }
+}
+function validateBackendHeaders(id, headers) {
+  for (const [name, value] of Object.entries(headers ?? {})) {
+    try {
+      new Headers([[name, value]]);
+    } catch {
+      throw new CommerceError(
+        "CONFIG_INVALID",
+        `Resource "${id}" has backend header "${name}" with an illegal name or value (a name must be an HTTP token; a value must not contain NUL, a character above U+00FF, or a line break except at either end, which fetch trims)`,
+        { details: { path: `resources.${id}.backend.headers.${name}`, resourceId: id } }
+      );
+    }
+  }
+}
+
+// src/config/schema/resource-schema.ts
+function defaultClosedObjectSchema(schema) {
+  const isObjectSchema = isObjectSchemaNode(schema);
+  const result = { ...schema };
+  if (isObjectSchema) {
+    const properties = schema["properties"];
+    if (isRecord(properties)) {
+      result["properties"] = Object.fromEntries(
+        Object.entries(properties).map(([key, sub]) => [
+          key,
+          isRecord(sub) ? defaultClosedObjectSchema(sub) : sub
+        ])
+      );
+    }
+    if (!Object.hasOwn(schema, "additionalProperties")) {
+      result["additionalProperties"] = false;
+    }
+  }
+  const items = schema["items"];
+  if (isRecord(items)) {
+    result["items"] = defaultClosedObjectSchema(items);
+  }
+  const additional = schema["additionalProperties"];
+  if (isRecord(additional)) {
+    result["additionalProperties"] = defaultClosedObjectSchema(additional);
+  }
+  return result;
+}
+var EMPTY_CLOSED_OBJECT_SCHEMA = {
+  type: "object",
+  properties: {},
+  additionalProperties: false
+};
+var UNSUPPORTED_SCHEMA_KEYWORDS = [
+  "pattern",
+  "minLength",
+  "maxLength",
+  "format",
+  "minimum",
+  "maximum",
+  "exclusiveMinimum",
+  "exclusiveMaximum",
+  "multipleOf",
+  "oneOf",
+  "anyOf",
+  "allOf",
+  "not",
+  "$ref",
+  "const",
+  "patternProperties",
+  "minItems",
+  "maxItems",
+  "uniqueItems"
+];
+function excludesObjectType(schema) {
+  const type = schema["type"];
+  if (type === void 0 || type === "object") return false;
+  if (Array.isArray(type)) return !type.includes("object");
+  return true;
+}
+function validateResourceSchemaKeywords(id, path2, schema) {
+  for (const keyword of UNSUPPORTED_SCHEMA_KEYWORDS) {
+    if (Object.hasOwn(schema, keyword)) {
+      console.warn(
+        `[agent-commerce] resource "${id}" ${path2} uses JSON Schema keyword "${keyword}", which this gateway does not enforce (see src/core/execution/validation.ts for the supported subset). Remove it or treat it as documentation only.`
+      );
+    }
+  }
+  if ((Object.hasOwn(schema, "properties") || Object.hasOwn(schema, "required")) && excludesObjectType(schema)) {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      `Resource "${id}" ${path2} declares "properties" and/or "required" but its "type" (${JSON.stringify(schema["type"])}) does not include "object" - the validator will never route a value through either check under that type, so this schema claims to constrain input it does not actually enforce. Remove "properties"/"required", or include "object" in "type".`,
+      { details: { path: `resources.${id}.${path2}`, resourceId: id } }
+    );
+  }
+  const requiredRaw = schema["required"];
+  const closed = !Object.hasOwn(schema, "additionalProperties") ? true : schema["additionalProperties"] === false;
+  if (Array.isArray(requiredRaw) && closed && isObjectSchemaNode(schema)) {
+    const declared = isRecord(schema["properties"]) ? schema["properties"] : {};
+    const undeclared = requiredRaw.filter(
+      (name) => typeof name === "string" && !Object.hasOwn(declared, name)
+    );
+    if (undeclared.length > 0) {
+      throw new CommerceError(
+        "CONFIG_INVALID",
+        `Resource "${id}" ${path2} lists ${undeclared.map((n) => `"${n}"`).join(", ")} in "required" but does not declare ${undeclared.length === 1 ? "it" : "them"} in "properties". The schema is closed (additionalProperties: false), so ${undeclared.length === 1 ? "that name is" : "those names are"} rejected as an unknown key and no input can ever satisfy this schema. Declare ${undeclared.length === 1 ? "it" : "them"} in "properties".`,
+        { details: { path: `resources.${id}.${path2}`, resourceId: id, undeclared } }
+      );
+    }
+  }
+  const properties = schema["properties"];
+  if (isRecord(properties)) {
+    for (const [key, sub] of Object.entries(properties)) {
+      if (isRecord(sub)) validateResourceSchemaKeywords(id, `${path2}.properties.${key}`, sub);
+    }
+  }
+  const additional = schema["additionalProperties"];
+  if (isRecord(additional)) {
+    validateResourceSchemaKeywords(id, `${path2}.additionalProperties`, additional);
+  }
+  const items = schema["items"];
+  if (isRecord(items)) {
+    validateResourceSchemaKeywords(id, `${path2}.items`, items);
+  } else if (Array.isArray(items)) {
+    console.warn(
+      `[agent-commerce] resource "${id}" ${path2}.items is a tuple (an array of schemas), which this gateway does not enforce - only a single schema applied to every array element is supported (see src/core/execution/validation.ts). Each position's schema is unenforced; treat it as documentation only.`
+    );
+  }
+}
+
+// src/config/schema/resources.ts
+var SUPPORTED_PROTOCOLS = new Set(PROTOCOL_NAMES);
+var SUPPORTED_PAYMENT_METHODS = new Set(PAYMENT_METHOD_NAMES);
+function normalizeResource(id, entry, protocols, x402, mpp, ap2) {
+  if (entry.input !== void 0) validateResourceSchemaKeywords(id, "input", entry.input);
+  const inputProperties = entry.input?.["properties"];
+  if (inputProperties && typeof inputProperties === "object") {
+    for (const reserved of RESERVED_INPUT_FIELDS) {
+      if (!(reserved in inputProperties)) continue;
+      throw new CommerceError(
+        "CONFIG_INVALID",
+        `Resource "${id}" declares an input property "${reserved}", which is reserved by the gateway`,
+        {
+          details: {
+            path: `resources.${id}.input.properties.${reserved}`,
+            resourceId: id
+          }
+        }
+      );
+    }
+  }
+  for (const protocol of entry.expose) {
+    if (!SUPPORTED_PROTOCOLS.has(protocol)) {
+      const hint = protocol === "ucp" ? " (UCP is planned, not supported in this release)" : "";
+      throw new CommerceError(
+        "CONFIG_INVALID",
+        `Resource "${id}" exposes unsupported protocol "${protocol}"${hint}. Supported: ${PROTOCOL_NAMES.join(", ")}.`,
+        { details: { path: `resources.${id}.expose`, resourceId: id, protocol } }
+      );
+    }
+  }
+  if (entry.expose.includes("mcp")) {
+    if (!protocols.mcp.enabled) {
+      throw new CommerceError(
+        "CONFIG_INVALID",
+        `Resource "${id}" is exposed via "mcp" but protocols.mcp.enabled is false`,
+        { details: { path: `resources.${id}.expose`, resourceId: id } }
+      );
+    }
+    if (!MCP_TOOL_NAME_PATTERN.test(id)) {
+      throw new CommerceError(
+        "CONFIG_INVALID",
+        `Resource "${id}" is exposed via "mcp" but its id is not a legal MCP tool name (allowed: A-Z, a-z, 0-9, "_", "-", ".", 1-128 chars)`,
+        { details: { path: `resources.${id}`, resourceId: id } }
+      );
+    }
+  }
+  if (entry.expose.includes("a2a") && !protocols.a2a.enabled) {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      `Resource "${id}" is exposed via "a2a" but protocols.a2a.enabled is false`,
+      { details: { path: `resources.${id}.expose`, resourceId: id } }
+    );
+  }
+  if (entry.expose.includes("acp") && !protocols.acp.enabled) {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      `Resource "${id}" is exposed via "acp" but protocols.acp.enabled is false`,
+      { details: { path: `resources.${id}.expose`, resourceId: id } }
+    );
+  }
+  if (entry.expose.includes("http") && !protocols.http.enabled) {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      `Resource "${id}" is exposed via "http" but protocols.http.enabled is false`,
+      { details: { path: `resources.${id}.expose`, resourceId: id } }
+    );
+  }
+  validateBackendUrl(id, entry.backend.url);
+  validateBackendHeaders(id, entry.backend.headers);
+  const pathScope = validateInputBindings(id, entry.backend, entry.input);
+  validatePathParametersDeclared(id, entry.backend.url, pathScope.schema, pathScope.where);
+  if (entry.pricing.type === "dynamic") {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      `Resource "${id}" uses pricing.type "dynamic", which is not supported in this release`,
+      { details: { path: `resources.${id}.pricing.type`, resourceId: id } }
+    );
+  }
+  const paymentMethods = entry.payments ?? [];
+  if (entry.x402 !== void 0) {
+    const at = `resources.${id}.x402`;
+    if (x402 === void 0) {
+      throw new CommerceError(
+        "CONFIG_INVALID",
+        `Resource "${id}" sets x402.accepts, but payments.x402 is not configured`,
+        { details: { path: at, resourceId: id } }
+      );
+    }
+    if (entry.pricing.type !== "fixed" || !paymentMethods.includes("x402")) {
+      throw new CommerceError(
+        "CONFIG_INVALID",
+        `Resource "${id}" sets x402.accepts, which requires fixed pricing and "x402" in payments`,
+        { details: { path: at, resourceId: id } }
+      );
+    }
+  }
+  const offers = x402 !== void 0 ? x402.resources[id] ?? x402 : void 0;
+  if (entry.pricing.type === "fixed") {
+    const decimals = paymentMethods.includes("x402") ? offers?.options.map((option) => option.assetDecimals) : void 0;
+    validatePricingAmount(id, entry.pricing.amount, decimals && Math.min(...decimals));
+  }
+  if (entry.pricing.type === "fixed") {
+    if (paymentMethods.length === 0) {
+      throw new CommerceError(
+        "CONFIG_INVALID",
+        `Resource "${id}" has fixed pricing but declares no "payments" (a paid resource must name at least one payment method)`,
+        { details: { path: `resources.${id}.payments`, resourceId: id } }
+      );
+    }
+    for (const method of paymentMethods) {
+      if (!SUPPORTED_PAYMENT_METHODS.has(method)) {
+        throw new CommerceError(
+          "CONFIG_INVALID",
+          `Resource "${id}" names unsupported payment method "${method}". Supported: ${PAYMENT_METHOD_NAMES.join(", ")}.`,
+          { details: { path: `resources.${id}.payments`, resourceId: id, method } }
+        );
+      }
+    }
+    const enabledRails = [
+      ...x402?.config.enabled ? ["x402"] : [],
+      ...mpp?.enabled ? ["mpp"] : []
+    ];
+    if (!paymentMethods.some((method) => enabledRails.includes(method))) {
+      throw new CommerceError(
+        "CONFIG_INVALID",
+        `Resource "${id}" names payment method(s) "${paymentMethods.join(", ")}", none of which is configured and enabled under "payments"`,
+        { details: { path: `resources.${id}.payments`, resourceId: id, paymentMethods } }
+      );
+    }
+    const symbols = offers?.defaultAssetSymbols ?? [];
+    const currency = entry.pricing.currency;
+    if (x402?.config.enabled && symbols.length > 0 && paymentMethods.includes("x402") && currency !== "USD" && !(symbols.length === 1 && currency === symbols[0])) {
+      const tokens = symbols.join(" and ");
+      throw new CommerceError(
+        "CONFIG_INVALID",
+        `Resource "${id}" is priced in ${currency}, but x402 settles in ${tokens}, the default asset of its network. Price it in ${symbols.length === 1 ? `${tokens} or ` : ""}USD.`,
+        { details: { path: `resources.${id}.pricing.currency`, resourceId: id } }
+      );
+    }
+    if (mpp?.enabled && paymentMethods.includes("mpp")) {
+      if (entry.pricing.currency !== MPP_PROFILE.assetSymbol) {
+        throw new CommerceError(
+          "CONFIG_INVALID",
+          `Resource "${id}" is priced in ${entry.pricing.currency}, but MPP charges ${MPP_PROFILE.assetSymbol}`,
+          { details: { path: `resources.${id}.pricing.currency`, resourceId: id } }
+        );
+      }
+      validatePricingAmount(id, entry.pricing.amount, MPP_PROFILE.assetDecimals);
+    }
+  }
+  if (entry.paymentFlow !== void 0 && (entry.pricing.type !== "fixed" || !paymentMethods.some((method) => method === "x402" || method === "mpp"))) {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      `Resource "${id}" sets paymentFlow, which requires fixed pricing and "x402" or "mpp" in payments`,
+      { details: { path: `resources.${id}.paymentFlow`, resourceId: id } }
+    );
+  }
+  if (entry.mimeType !== void 0 && (entry.pricing.type !== "fixed" || !paymentMethods.includes("x402"))) {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      `Resource "${id}" sets mimeType, which requires fixed pricing and "x402" in payments`,
+      { details: { path: `resources.${id}.mimeType`, resourceId: id } }
+    );
+  }
+  const pricing = entry.pricing.type === "free" ? { type: "free" } : { type: "fixed", amount: entry.pricing.amount, currency: entry.pricing.currency };
+  const authorization = normalizeResourceAuthorization(id, entry, pricing, ap2);
+  return {
+    id,
+    name: entry.name,
+    ...entry.description !== void 0 ? { description: entry.description } : {},
+    inputSchema: entry.input !== void 0 ? defaultClosedObjectSchema(entry.input) : EMPTY_CLOSED_OBJECT_SCHEMA,
+    ...entry.output !== void 0 ? { outputSchema: entry.output } : {},
+    handler: {
+      type: "http",
+      method: entry.backend.method,
+      url: entry.backend.url,
+      ...entry.backend.headers !== void 0 ? { headers: entry.backend.headers } : {},
+      ...entry.backend.timeoutMs !== void 0 ? {
+        timeoutMs: toNumber(entry.backend.timeoutMs, `resources.${id}.backend.timeoutMs`, {
+          min: 1
+        })
+      } : {},
+      ...entry.backend.inputBindings !== void 0 ? { inputBindings: pickDefined(entry.backend.inputBindings) } : {}
+    },
+    pricing,
+    exposedVia: entry.expose,
+    paymentMethods,
+    ...authorization !== void 0 ? { authorization } : {}
+  };
+}
+var PRICING_AMOUNT_PATTERN = /^\d+(?:\.\d+)?$/;
+var ZERO_AMOUNT_PATTERN = /^0(?:\.0+)?$/;
+function validatePricingAmount(id, amount, decimals) {
+  const path2 = `resources.${id}.pricing.amount`;
+  if (!PRICING_AMOUNT_PATTERN.test(amount)) {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      `Resource "${id}" has pricing.amount "${amount}", which is not a plain positive decimal (no currency symbol, no thousands separator, no exponent - e.g. "0.01")`,
+      { details: { path: path2, resourceId: id } }
+    );
+  }
+  if (ZERO_AMOUNT_PATTERN.test(amount)) {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      `Resource "${id}" has pricing.amount "0" - a paid resource cannot cost zero; use "pricing: { type: free }" instead`,
+      { details: { path: path2, resourceId: id } }
+    );
+  }
+  if (decimals !== void 0) {
+    const fractionalDigits = amount.includes(".") ? amount.split(".")[1]?.length ?? 0 : 0;
+    if (fractionalDigits > decimals) {
+      throw new CommerceError(
+        "CONFIG_INVALID",
+        `Resource "${id}" has pricing.amount "${amount}" with more precision (${fractionalDigits} fractional digits) than the configured asset supports (${decimals} decimals)`,
+        { details: { path: path2, resourceId: id } }
+      );
+    }
+  }
+}
+function pickDefined(value) {
+  return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== void 0));
+}
+
+// src/config/schema/normalize.ts
+var DEFAULT_A2A_MOUNT_PATH = "/a2a";
+function normalize(raw) {
+  const protocols = {
+    http: { enabled: toBoolean(raw.protocols.http.enabled, "protocols.http.enabled") },
+    mcp: {
+      enabled: toBoolean(raw.protocols.mcp.enabled, "protocols.mcp.enabled"),
+      mountPath: raw.protocols.mcp.mountPath
+    },
+    a2a: {
+      enabled: toBoolean(raw.protocols.a2a?.enabled ?? false, "protocols.a2a.enabled"),
+      mountPath: raw.protocols.a2a?.mountPath ?? DEFAULT_A2A_MOUNT_PATH
+    },
+    acp: normalizeAcp(raw.protocols.acp)
+  };
+  validateMountPaths(protocols);
+  const x402Settings = raw.payments.x402 !== void 0 ? normalizeX402(raw.payments.x402, raw.resources) : void 0;
+  const x402 = x402Settings?.config;
+  const mpp = normalizeMpp(raw.payments.mpp);
+  const ap2 = normalizeAp2(raw.authorization?.ap2);
+  if (ap2?.enabled) {
+    validateReplayStoreIsolated(ap2.replay.path, raw.storage.receipts.path, protocols.acp);
+  }
+  const resources = Object.entries(raw.resources).map(
+    ([id, entry]) => normalizeResource(id, entry, protocols, x402Settings, mpp, ap2)
+  );
+  const flowOverrides = (rail) => {
+    const flows = Object.fromEntries(
+      resources.flatMap((resource) => {
+        const flow = raw.resources[resource.id]?.paymentFlow;
+        return flow !== void 0 && resource.paymentMethods.includes(rail) ? [[resource.id, flow]] : [];
+      })
+    );
+    return Object.keys(flows).length > 0 ? { resourcePaymentFlows: flows } : {};
+  };
+  const mimeTypes = Object.fromEntries(
+    resources.flatMap((resource) => {
+      const mimeType = raw.resources[resource.id]?.mimeType;
+      return mimeType !== void 0 ? [[resource.id, mimeType]] : [];
+    })
+  );
+  const x402WithFlows = x402 !== void 0 ? {
+    ...x402,
+    ...flowOverrides("x402"),
+    ...Object.keys(mimeTypes).length > 0 ? { resourceMimeTypes: mimeTypes } : {}
+  } : x402;
+  const mppWithFlows = mpp !== void 0 ? { ...mpp, ...flowOverrides("mpp") } : mpp;
+  if (protocols.acp.enabled) validateAcpCheckoutMapping(protocols.acp, resources);
+  if (protocols.a2a.enabled && !resources.some((r) => r.exposedVia.includes("a2a"))) {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      'protocols.a2a.enabled is true but no resource lists "a2a" in its expose',
+      { details: { path: "protocols.a2a.enabled" } }
+    );
+  }
+  return {
+    version: SUPPORTED_CONFIG_VERSION,
+    merchant: {
+      id: raw.merchant.id,
+      name: raw.merchant.name,
+      publicBaseUrl: raw.merchant.publicBaseUrl
+    },
+    // Port 0 lets the OS pick a free port, for tests and throwaway instances
+    server: {
+      port: toNumber(raw.server.port, "server.port", { min: 0, max: 65535 }),
+      host: raw.server.host,
+      ...raw.server.adminToken !== void 0 ? { adminToken: raw.server.adminToken } : {},
+      allowedOrigins: raw.server.allowedOrigins ?? []
+    },
+    storage: { receipts: { driver: "sqlite", path: raw.storage.receipts.path } },
+    protocols,
+    resources,
+    payments: {
+      ...x402WithFlows !== void 0 ? { x402: x402WithFlows } : {},
+      ...mppWithFlows !== void 0 ? { mpp: mppWithFlows } : {}
+    },
+    ...ap2 !== void 0 ? { authorization: { ap2 } } : {}
+  };
+}
+function validateMountPaths(protocols) {
+  const mounts = [
+    ["mcp", protocols.mcp],
+    ["a2a", protocols.a2a],
+    ["acp", protocols.acp]
+  ].filter(([, p]) => p.enabled);
+  for (const [index, [nameA, a]] of mounts.entries()) {
+    for (const [nameB, b] of mounts.slice(index + 1)) {
+      const baseA = a.mountPath.replace(/\/+$/, "");
+      const baseB = b.mountPath.replace(/\/+$/, "");
+      if (baseA === baseB || baseA.startsWith(`${baseB}/`) || baseB.startsWith(`${baseA}/`)) {
+        throw new CommerceError(
+          "CONFIG_INVALID",
+          `protocols.${nameA}.mountPath ("${a.mountPath}") collides with protocols.${nameB}.mountPath ("${b.mountPath}") - each mount registers a wildcard, so overlapping prefixes cannot both be served`,
+          { details: { path: `protocols.${nameA}.mountPath` } }
+        );
+      }
+    }
+  }
+}
+
+// src/config/schema/index.ts
+function parseConfig(raw, env) {
+  if (!isRecord(raw)) {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      'Configuration root must be a mapping (object) at "$"',
+      {
+        details: { path: "$" }
+      }
+    );
+  }
+  checkVersion(raw);
+  const substituted = substituteEnv(raw, env);
+  const parsed = parseWithZod(RawConfigSchema, substituted);
+  return normalize(parsed);
+}
+function checkVersion(raw) {
+  if (!("version" in raw)) {
+    throw new CommerceError("CONFIG_INVALID", 'Configuration is missing required field "version"', {
+      details: { path: "version" }
+    });
+  }
+  const version = raw["version"];
+  if (version !== SUPPORTED_CONFIG_VERSION) {
+    const hint = typeof version === "string" ? ", written as a number without quotes" : "";
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      `Unsupported config version "${String(version)}": this gateway only supports version ${SUPPORTED_CONFIG_VERSION}${hint}`,
+      { details: { path: "version", supported: SUPPORTED_CONFIG_VERSION } }
+    );
+  }
+}
+function parseWithZod(schema, value) {
+  const result = schema.safeParse(value);
+  if (!result.success) {
+    throw zodErrorToConfigError(result.error);
+  }
+  return result.data;
+}
+function zodErrorToConfigError(error) {
+  const issues = error.issues.map(describeIssue);
+  const first = issues[0];
+  const message = first ? `Configuration invalid at "${first.path}": ${first.message}` : "Configuration invalid";
+  return new CommerceError("CONFIG_INVALID", message, { details: { issues } });
+}
+function describeIssue(issue) {
+  const path2 = issue.path.length > 0 ? issue.path.join(".") : "$";
+  return { path: path2, message: issue.message, code: issue.code };
+}
+
+// src/config/load.ts
+var CONFIG_PATH_ENV_VAR = "AGENT_COMMERCE_CONFIG";
+async function loadConfig(options = {}) {
+  const env = options.env ?? process.env;
+  const cwd = options.cwd ?? process.cwd();
+  const configPath = resolveConfigPath(options.path, env, cwd);
+  let text;
+  try {
+    text = await promises.readFile(configPath, "utf8");
+  } catch (error) {
+    throw new CommerceError("CONFIG_INVALID", `Could not read configuration file "${configPath}"`, {
+      details: { path: configPath },
+      cause: error
+    });
+  }
+  let raw;
+  try {
+    raw = parse(text);
+  } catch (error) {
+    const { reason, details } = describeYamlError(error);
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      `Configuration file "${configPath}" is not valid YAML: ${reason}`,
+      {
+        details: { path: configPath, ...details },
+        // Kept for programmatic callers. Never print it: its `.message` quotes
+        // the source line (see describeYamlError).
+        cause: error
+      }
+    );
+  }
+  return parseConfig(raw, env);
+}
+var YAML_ERROR_EXPLANATIONS = {
+  DUPLICATE_KEY: "map keys must be unique",
+  BAD_INDENT: "bad indentation",
+  TAB_AS_INDENT: "tabs cannot be used for indentation",
+  MISSING_CHAR: "a required character is missing",
+  BLOCK_AS_IMPLICIT_KEY: "a block value cannot be used as a key (missing quotes, or a stray colon)",
+  MULTILINE_IMPLICIT_KEY: "a key spans multiple lines (missing quotes, or a stray colon)",
+  UNEXPECTED_TOKEN: "unexpected token"
+};
+function describeYamlError(error) {
+  if (!(error instanceof YAMLError)) {
+    return { reason: "unknown YAML parse error", details: {} };
+  }
+  const start = error.linePos?.[0];
+  const where = start === void 0 ? "" : ` at line ${String(start.line)}, column ${String(start.col)}`;
+  const explanation = YAML_ERROR_EXPLANATIONS[error.code];
+  const what = explanation === void 0 ? error.code : `${error.code} (${explanation})`;
+  return {
+    reason: `${what}${where}`,
+    details: {
+      yamlErrorCode: error.code,
+      ...start === void 0 ? {} : { line: start.line, column: start.col }
+    }
+  };
+}
+function resolveConfigPath(explicitPath, env, cwd) {
+  if (explicitPath) return path.resolve(cwd, explicitPath);
+  const fromEnv = env[CONFIG_PATH_ENV_VAR];
+  if (fromEnv) return path.resolve(cwd, fromEnv);
+  return path.resolve(cwd, DEFAULT_CONFIG_FILENAME);
+}
+
+export { loadConfig, parseConfig, substituteEnv };
+//# sourceMappingURL=chunk-RWVPYAKC.js.map
+//# sourceMappingURL=chunk-RWVPYAKC.js.map