Add delegated agent checkout and USDC payments

docs/README.md

@@ -36,6 +36,7 @@ then follow [Installation](getting-started/installation.md).
 - [Quotes & estimates](guides/quotes.md) — priced proposals customers accept online
 - [Contacts & sub-accounts](guides/contacts.md) — scoped additional contacts
 - [Usage-metered billing](guides/metered-billing.md) — bill by consumption
+- [Agent commerce](guides/agent-commerce.md) — delegated checkout, ACP, and x402 USDC payments
 - [Mass mail](guides/mass-mail.md) — bulk email to segments
 - [Announcements](guides/announcements.md) — the news/blog module
 - [Themes](guides/themes.md) — built-in themes and custom ones
@@ -44,8 +45,9 @@ then follow [Installation](getting-started/installation.md).
 ## Extensions
 
 - [Extensions overview](extensions/overview.md) — how the driver system works
-- [Payment gateways](extensions/payment-gateways.md) — all 19 gateways and their setup
+- [Payment gateways](extensions/payment-gateways.md) — all 20 gateways and their setup
 - [Server modules](extensions/server-modules.md) — all 27 provisioning integrations
+- [Server driver certification](extensions/server-certification.md) — disposable live lifecycle harness
 - [Resale modules](extensions/resale-modules.md) — domains, SSL, licenses, M365 seats
 - [Writing an extension](extensions/writing-extensions.md) — build your own driver
 

docs/extensions/overview.md

@@ -42,7 +42,7 @@ The system follows a few deliberate principles:
 
 ## Reference pages
 
-- [Payment gateways](payment-gateways.md) — all 19, with setup
+- [Payment gateways](payment-gateways.md) — all 20, with setup
 - [Server modules](server-modules.md) — all 27, with setup
 - [Resale modules](resale-modules.md) — domains, SSL, licenses, seats
 - [Writing an extension](writing-extensions.md) — build your own

docs/extensions/payment-gateways.md

@@ -1,6 +1,6 @@
 # Payment gateways
 
-OpenHosting includes 19 payment gateways. Enable and configure the ones you use
+OpenHosting includes 20 payment gateways. Enable and configure the ones you use
 under **Admin → Extensions**; enabled gateways appear as payment options at
 checkout. Gateways that confirm payment asynchronously call back at
 `/api/webhooks/<slug>` — set that URL in the gateway's dashboard.
@@ -35,6 +35,15 @@ tokenization key.
 
 ## Crypto
 
+### x402 (`x402`) — USDC machine payments
+
+x402 v2 exact settlement for USDC invoices. Configure a facilitator URL,
+CAIP-2 network, official USDC asset identifier, receiving wallet, and optional
+facilitator credential. This driver is only offered for `USDC` invoices; the
+other gateways are only offered for conventional three-letter currencies.
+See [Agent commerce](../guides/agent-commerce.md#usdc-and-x402-v2) for the HTTP
+flow and mainnet safety checklist.
+
 ### Coinbase Commerce (`coinbase-commerce`)
 Hosted crypto checkout. Set the **API key** and webhook shared secret.
 

docs/getting-started/introduction.md

@@ -16,7 +16,7 @@ no PHP runtime, and no per-client license fee — it's MIT licensed.
 |---|---|
 | **Storefront** | Categories, products, six billing cycles, configurable options, cart, coupons, taxes, multi-currency |
 | **Billing** | Orders → invoices → services, automated renewals, suspension and termination, account credit, auto-charge with saved cards |
-| **Payments** | 19 gateways: cards, crypto, SEPA, merchant-of-record and regional |
+| **Payments** | 20 gateways: cards, USDC/x402, crypto, SEPA, merchant-of-record and regional |
 | **Provisioning** | 27 server integrations (game panels, VPS/cloud, enterprise virt, web panels) |
 | **Resale** | Domains, SSL certificates, software licenses, Microsoft 365 / Google Workspace seats |
 | **Support** | Tickets with departments, priorities and attachments; notification center |

docs/guides/agent-commerce.md

@@ -0,0 +1,141 @@
+# Agent commerce
+
+OpenHosting can let a signed-in customer delegate narrowly bounded purchases to
+an autonomous client. The same checkout core powers a native JSON API, an
+Agentic Commerce Protocol (ACP) adapter for Stripe delegated payments, and an
+x402 v2 settlement endpoint for USDC.
+
+Anonymous autonomous account creation is not part of this release. It remains
+on the [future roadmap](../roadmap.md): an agent grant always belongs to an
+existing customer account whose normal identity, fraud, and recovery controls
+already apply.
+
+## Safety model
+
+Customers create grants under **Dashboard → Account → Agent access**. The raw
+`ag_…` bearer token is displayed once; only its SHA-256 hash is stored. Each
+grant has all of these boundaries:
+
+- an expiry of at most 90 days;
+- an exact product allowlist;
+- an exact currency/asset allowlist;
+- a maximum amount per order; and
+- a cumulative committed-spend limit.
+
+Spend limits are denominated in the installation's base currency. Reservation
+uses a serializable database transaction, so simultaneous agents cannot both
+consume the same remaining allowance. Creating an unpaid order commits its
+amount against the grant; this is deliberately conservative and prevents an
+agent from evading the cap by opening many unpaid invoices.
+
+Revoke a grant immediately from the same page. Never put an agent token in a
+URL, browser bundle, repository, log, or model prompt.
+
+## Machine-readable catalog
+
+`GET /api/agent/catalog` is public and returns visible products, billing-cycle
+SKUs, configuration choices, metered-unit pricing, enabled currencies, asset
+precision, settlement networks, and protocol endpoints. The discovery document
+at `GET /.well-known/agent-commerce` points clients to that catalog.
+
+Amounts in the catalog are advisory presentment values. Checkout always reloads
+the product, stock, coupon, tax, currency rate, and grant policy and returns the
+authoritative total.
+
+## Native agent checkout
+
+Send the grant as a bearer credential and a unique idempotency key:
+
+```bash
+curl -X POST https://billing.example.com/api/agent/checkout \
+  -H 'Authorization: Bearer ag_…' \
+  -H 'Idempotency-Key: deployment-2026-08-27-001' \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "currency": "USDC",
+    "lines": [{
+      "product_id": "PRODUCT_ID",
+      "cycle": "MONTHLY",
+      "quantity": 1,
+      "option_value_ids": []
+    }]
+  }'
+```
+
+Repeating an identical request with the same key returns the original checkout.
+Reusing the key with a different body is rejected. The response contains the
+order, invoice, current status, and compatible payment options. Poll
+`GET /api/agent/checkout/:id` with the same bearer token when needed.
+
+## ACP 2026-04-17
+
+The ACP adapter implements the versioned checkout-session lifecycle under
+`/api/acp/checkout_sessions`:
+
+| Method | Endpoint | Purpose |
+|---|---|---|
+| `POST` | `/api/acp/checkout_sessions` | Create an authoritative cart |
+| `GET` | `/api/acp/checkout_sessions/:id` | Retrieve current state |
+| `POST` | `/api/acp/checkout_sessions/:id` | Update items, buyer data, or discounts |
+| `POST` | `/api/acp/checkout_sessions/:id/complete` | Pay and create the order |
+| `POST` | `/api/acp/checkout_sessions/:id/cancel` | Cancel a draft session |
+
+Every request needs `Authorization: Bearer ag_…` and
+`API-Version: 2026-04-17`; every mutating request also needs
+`Idempotency-Key`. ACP item IDs are the `sku` values from the agent catalog.
+The adapter supports enabled, two-decimal ISO fiat currencies. USDC uses the
+x402 path instead because ACP amounts and Stripe PaymentIntents are expressed
+in fiat minor units.
+
+Completion currently accepts the `stripe_spt` handler with a Stripe Shared
+Payment Token credential. The server binds the PaymentIntent to OpenHosting's
+recalculated invoice total and uses a processor idempotency key before marking
+the invoice paid. Stripe describes agentic-commerce and Shared Payment Token
+features as private preview, so confirm account eligibility and test-mode
+behavior before enabling this surface.
+
+## USDC and x402 v2
+
+The seed includes USDC, disabled by default, with six-decimal precision and Base
+and Solana mainnet CAIP-2 identifiers. See [Currencies](currencies.md) before
+enabling it.
+
+Enable **x402 (USDC)** under **Admin → Extensions** and configure:
+
+- an x402 v2 facilitator base URL;
+- an optional facilitator bearer credential;
+- one CAIP-2 network that is also allowed on the USDC currency record;
+- the official USDC contract/mint identifier for that exact network;
+- the merchant receiving wallet; and
+- a short authorization timeout.
+
+For an authorized customer's pending USDC invoice, POST to
+`/api/x402/invoices/:invoice_id`. With no `PAYMENT-SIGNATURE`, OpenHosting
+returns `402 Payment Required` and a base64-encoded `PAYMENT-REQUIRED` header.
+The client signs those exact terms and retries with `PAYMENT-SIGNATURE`.
+OpenHosting binds the payload to the invoice URL, amount, asset, network, and
+recipient; asks the configured facilitator to verify and settle it; persists
+the network transaction before applying billing side effects; and returns the
+settlement in `PAYMENT-RESPONSE`.
+
+Settlement records make retries idempotent and prevent one proof from being
+attached to multiple invoices. OpenHosting never receives or stores a payer
+private key or seed phrase.
+
+Use testnet first. Confirm the facilitator's current network support and the
+official USDC identifier directly with the facilitator and Circle before moving
+to mainnet. A wrong asset or receiving address can make funds unrecoverable.
+
+## Metered services
+
+x402 works for any pending USDC invoice, including renewal invoices containing
+metered usage. Usage accumulates at eight-decimal internal precision, then
+converts once to the service's locked charge asset and rounds at the invoice
+boundary—six decimals for USDC and normally two for fiat.
+
+## Protocol references
+
+- [ACP specification](https://github.com/agentic-commerce-protocol/agentic-commerce-protocol)
+- [Stripe ACP integration](https://docs.stripe.com/agentic-commerce/protocol)
+- [x402 v2 specification](https://github.com/x402-foundation/x402/blob/main/specs/x402-specification-v2.md)
+- [Circle USDC documentation](https://developers.circle.com/stablecoins/usdc-contract-addresses)

docs/guides/currencies.md

@@ -5,22 +5,39 @@ priced in a single **base currency**.
 
 ## Base currency
 
-Set your base currency under **Admin → Settings → Currency** (an ISO code like
-`USD` or `EUR`). All product prices, coupons, tax amounts and account credit are
-stored in this currency.
+Set your base currency under **Admin → Settings → Currency** (normally an ISO
+code like `USD` or `EUR`). All product prices, coupons, tax amounts and account
+credit are stored in this currency.
 
 ## Additional currencies
 
 Add more under **Admin → Currencies**. Each has:
 
-- **ISO code** (e.g. `EUR`)
+- **Currency or asset code** (e.g. `EUR` or `USDC`)
 - **Symbol** (optional, e.g. `€`)
+- **Kind** — fiat or stablecoin
+- **Decimals** — `2` for most fiat currencies and `6` for USDC
 - **Rate** — how many units of this currency equal 1 unit of the base currency
+- **Settlement networks** — CAIP-2 network identifiers accepted by the payment rail
 - **Enabled** — whether customers can pick it
 
 For example, with a `USD` base and `EUR` at rate `0.92`, a `$5.99` product shows
 as `€5.51`.
 
+## USDC
+
+The seed data includes USDC as a disabled stablecoin with six-decimal precision.
+Its initial settlement networks are Base (`eip155:8453`) and Solana mainnet
+(`solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp`). The `rate` is still relative to
+your configured base currency; a value of `1` is only appropriate when that base
+is USD and your pricing policy treats one USDC as one USD.
+
+Enabling the asset makes it available for pricing and invoice locking. It does
+not, by itself, activate on-chain collection. Configure and test the x402
+gateway's facilitator, receiving address, network, and asset identifier before
+accepting live payments. OpenHosting never stores a payer seed phrase or private
+key.
+
 ## How customers use it
 
 When more than one currency is enabled, a **currency picker** appears in the

docs/roadmap.md

@@ -42,15 +42,15 @@ contributions and design feedback shape the ordering.
 
 ## Phase 2 — "AI agents as customers" (v0.7+)
 
-5. **Agent checkout API** — a first-class machine purchase flow:
+5. **Agent checkout API — shipped** — a first-class machine purchase flow:
    machine-readable catalog feed, idempotent order placement, delegated
    purchase tokens with spend caps and product allow-lists, full audit trail.
    The fraud pipeline gains an "agent buyer" lane instead of treating all
    automation as abuse.
-6. **Agentic Commerce Protocol (ACP)** — expose catalog + checkout in ACP
-   shape through the Stripe gateway, so purchases can complete natively
-   inside AI surfaces (ChatGPT, Gemini) as that channel opens to services.
-7. **x402 machine payments** — a gateway driver accepting stablecoin
+6. **Agentic Commerce Protocol (ACP) — beta shipped** — a versioned
+   2026-04-17 checkout-session surface through Stripe Shared Payment Tokens,
+   backed by the same delegated limits and order engine.
+7. **x402 machine payments — shipped** — an x402 v2 gateway accepting USDC
    per-use payments (HTTP 402 flow); pairs with metered billing for true
    pay-per-request / pay-per-hour infrastructure resale.
 8. **Admin copilot** — a chat panel inside the admin that uses OpenHosting's
@@ -72,6 +72,12 @@ contributions and design feedback shape the ordering.
 12. **GPU / AI-infra reseller pack** — hourly and GPU-metered billing
     presets plus token-usage metering, targeting the fastest-growing hosting
     segment: AI compute resale.
+13. **Anonymous autonomous account creation** — let an agent establish and
+    operate a pseudonymous account without a pre-existing human login. This is
+    intentionally a future capability, after delegated checkout is proven: it
+    requires durable agent identity, recovery and ownership rules, abuse and
+    fraud controls, jurisdiction-aware compliance, and tightly bounded payment
+    authority before an account can provision infrastructure safely.
 
 ## Principles (constant across all phases)
 

prisma/migrations/z_14_usdc_money/migration.sql

@@ -0,0 +1,35 @@
+CREATE TYPE "CurrencyKind" AS ENUM ('FIAT', 'STABLECOIN');
+
+ALTER TABLE "Currency"
+ADD COLUMN "kind" "CurrencyKind" NOT NULL DEFAULT 'FIAT',
+ADD COLUMN "decimals" INTEGER NOT NULL DEFAULT 2,
+ADD COLUMN "settlementNetworks" JSONB NOT NULL DEFAULT '[]',
+ALTER COLUMN "rate" TYPE DECIMAL(20,8);
+
+ALTER TABLE "User" ALTER COLUMN "credits" TYPE DECIMAL(20,8);
+ALTER TABLE "Product" ALTER COLUMN "affiliateCommissionValue" TYPE DECIMAL(20,8);
+ALTER TABLE "Product" ALTER COLUMN "meteredUnitPrice" TYPE DECIMAL(20,8);
+ALTER TABLE "ProductPrice" ALTER COLUMN "price" TYPE DECIMAL(20,8);
+ALTER TABLE "ProductPrice" ALTER COLUMN "setupFee" TYPE DECIMAL(20,8);
+ALTER TABLE "ConfigOptionValue" ALTER COLUMN "price" TYPE DECIMAL(20,8);
+ALTER TABLE "Order" ALTER COLUMN "subtotal" TYPE DECIMAL(20,8);
+ALTER TABLE "Order" ALTER COLUMN "discount" TYPE DECIMAL(20,8);
+ALTER TABLE "Order" ALTER COLUMN "tax" TYPE DECIMAL(20,8);
+ALTER TABLE "Order" ALTER COLUMN "total" TYPE DECIMAL(20,8);
+ALTER TABLE "OrderItem" ALTER COLUMN "unitPrice" TYPE DECIMAL(20,8);
+ALTER TABLE "OrderItem" ALTER COLUMN "setupFee" TYPE DECIMAL(20,8);
+ALTER TABLE "Service" ALTER COLUMN "price" TYPE DECIMAL(20,8);
+ALTER TABLE "Invoice" ALTER COLUMN "subtotal" TYPE DECIMAL(20,8);
+ALTER TABLE "Invoice" ALTER COLUMN "discount" TYPE DECIMAL(20,8);
+ALTER TABLE "Invoice" ALTER COLUMN "tax" TYPE DECIMAL(20,8);
+ALTER TABLE "Invoice" ALTER COLUMN "total" TYPE DECIMAL(20,8);
+ALTER TABLE "InvoiceItem" ALTER COLUMN "unitPrice" TYPE DECIMAL(20,8);
+ALTER TABLE "Payment" ALTER COLUMN "amount" TYPE DECIMAL(20,8);
+ALTER TABLE "Coupon" ALTER COLUMN "value" TYPE DECIMAL(20,8);
+ALTER TABLE "Quote" ALTER COLUMN "subtotal" TYPE DECIMAL(20,8);
+ALTER TABLE "Quote" ALTER COLUMN "tax" TYPE DECIMAL(20,8);
+ALTER TABLE "Quote" ALTER COLUMN "total" TYPE DECIMAL(20,8);
+ALTER TABLE "QuoteItem" ALTER COLUMN "unitPrice" TYPE DECIMAL(20,8);
+ALTER TABLE "Affiliate" ALTER COLUMN "balance" TYPE DECIMAL(20,8);
+ALTER TABLE "Affiliate" ALTER COLUMN "totalEarned" TYPE DECIMAL(20,8);
+ALTER TABLE "AffiliateCommission" ALTER COLUMN "amount" TYPE DECIMAL(20,8);