[Revinand]

Changes

• Solana: an undecodable transaction no longer reaches stderr through the SDK's console.error, which let an unauthenticated request forge log lines.
• HTTP invoke: pipeline errors are now logged with their cause chain, like the MCP, A2A and ACP adapters (5xx at warn, 4xx at debug).
• Facilitator URL: a facilitator.url with a query string or fragment is refused at config load. The client appends its routes to the URL, so every payment failed with such a URL.
• CDP auth: an unusable apiKeySecret now stops start instead of failing every paid request with 503. A PEM secret with JSON-escaped \n is accepted. Tokens are signed only for the route the SDK reads.
• Config warnings: validate and start warn when merchant.publicBaseUrl is not an http(s) URL, and when redelivery.required has no effect because the resource is served on MPP.
• Readiness: a failing health check logs its detail at warn when it starts failing, which shows why /ready turned 503.
• Docs: stale JSDoc and comments, the plugin's minimum version (now 2.7.0), and the security matrix.

Behavior changes

validate and start now refuse two configs that 2.7.0 accepted: a facilitator URL with a query string or fragment, and an unusable CDP secret. Neither config could complete a payment. The publicBaseUrl and redelivery.required checks only warn, and those configs still load.