@bnbagent/studio-cli 0.0.11-alpha.4 → 0.0.11-alpha.6

package/dist/bag.js

@@ -47,10 +47,12 @@ import {
   whichBin,
   withDeployFiles,
   x402DeploySummary,
+  x402DeploySummaryFromSnapshot,
+  x402DeploymentSnapshot,
   x402SellerIsFree,
   x402SellerPricingState,
   x402SellerUsesB402
-} from "./chunk-GKFTJDDJ.js";
+} from "./chunk-VVHPUKLV.js";
 import {
   TWAK_CLI_MIN_VERSION,
   TWAK_CLI_VERSION,
@@ -228,7 +230,7 @@ import {
 var CAMPAIGN_DOC_URL = "https://www.bnbchain.org/en/blog/bnb-agent-studio-is-live-on-bnb-chain-ai-agents-from-one-prompt";
 var CAMPAIGN_CHECK_TIMEOUT_MS = 6e3;
 async function fetchCampaignActive() {
-  const { bnbPlatformApiUrl: bnbPlatformApiUrl2 } = await import("./deployCli-YYV7FFFG.js");
+  const { bnbPlatformApiUrl: bnbPlatformApiUrl2 } = await import("./deployCli-5DZVAKMZ.js");
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), CAMPAIGN_CHECK_TIMEOUT_MS);
   try {
@@ -3363,6 +3365,25 @@ function protocolFaces(value) {
     return null;
   }
 }
+function recordedX402Snapshot(azure) {
+  const status = text(azure.deployed_x402_status);
+  const priceMode = text(azure.deployed_x402_price_mode);
+  const credentialsComplete = azure.deployed_x402_credentials_complete;
+  if (!["active", "free", "dormant"].includes(status ?? "") || !["paid", "free", "invalid"].includes(priceMode ?? "") || typeof credentialsComplete !== "boolean") {
+    return null;
+  }
+  const expectedStatus = priceMode === "free" ? "free" : priceMode === "paid" && credentialsComplete ? "active" : "dormant";
+  if (status !== expectedStatus) return null;
+  return {
+    status,
+    priceMode,
+    credentialsComplete
+  };
+}
+function recordedX402Carrier(azure) {
+  const carrier = text(azure.deployed_x402_carrier);
+  return carrier === "http-envelope-v1" || carrier === "incompatible-scaffold" ? carrier : void 0;
+}
 function descriptorName(workspaceRoot) {
   try {
     const data = JSON.parse(
@@ -3420,6 +3441,8 @@ function discoverRecordedDeployments(root) {
   const azureEndpoint = text(azure.agent_endpoint);
   const azureDeploymentId = text(azure.deployment_id);
   const azureFaces = protocolFaces(azure.deployed_faces);
+  const azureX402 = recordedX402Snapshot(azure);
+  const azureX402Carrier = recordedX402Carrier(azure);
   if (azureEndpoint || azureDeploymentId || text(azure.last_deploy_at)) {
     found.push({
       provider: "azure",
@@ -3428,6 +3451,8 @@ function discoverRecordedDeployments(root) {
       deploymentId: azureDeploymentId,
       endpoint: azureEndpoint,
       ...azureFaces ? { faces: azureFaces } : {},
+      ...azureX402 ? { x402: azureX402 } : {},
+      ...azureX402Carrier ? { x402Carrier: azureX402Carrier } : {},
       status: "active"
     });
   }
@@ -4148,6 +4173,52 @@ function isFile6(p) {
     return false;
   }
 }
+function inspectAzureX402Carrier(agentRoot2) {
+  const dockerfile = path16.join(agentRoot2, "Dockerfile");
+  let entryStem = null;
+  if (isFile6(dockerfile)) {
+    const docker = fs17.readFileSync(dockerfile, "utf8");
+    const match = docker.match(
+      /(?:CMD|ENTRYPOINT)\s*\[\s*["']node["']\s*,\s*["'](?:\.\/)?dist\/([^"'/]+)\.js["']\s*\]/m
+    );
+    entryStem = match?.[1] ?? null;
+  }
+  if (entryStem === null) {
+    return {
+      status: "incompatible-scaffold",
+      entrypoint: null,
+      detail: "Dockerfile does not identify the built Azure entrypoint as CMD/ENTRYPOINT node dist/<name>.js"
+    };
+  }
+  const entrypoint = `src/${entryStem}.ts`;
+  const entryFile = path16.join(agentRoot2, entrypoint);
+  if (!isFile6(entryFile)) {
+    return {
+      status: "incompatible-scaffold",
+      entrypoint,
+      detail: `${entrypoint} is selected by Dockerfile but its source is missing`
+    };
+  }
+  const source = fs17.readFileSync(entryFile, "utf8").replace(/\/\*[\s\S]*?\*\//g, "").replace(/^\s*\/\/.*$/gm, "");
+  const hasSeller = /\bX402Seller\s*\.\s*create\s*\(/m.test(source);
+  const hasCarrier = /\bcreateEnvelopeMiddleware\s*\(/m.test(source);
+  if (!hasSeller || !hasCarrier) {
+    const missing = [
+      ...hasCarrier ? [] : ["createEnvelopeMiddleware"],
+      ...hasSeller ? [] : ["X402Seller.create"]
+    ];
+    return {
+      status: "incompatible-scaffold",
+      entrypoint,
+      detail: `${entrypoint} does not mount ${missing.join(" and ")}`
+    };
+  }
+  return {
+    status: "http-envelope-v1",
+    entrypoint,
+    detail: `${entrypoint} mounts the X402 seller and envelope carrier`
+  };
+}
 function tableOf4(cfg, key) {
   const v = cfg[key];
   return v !== null && typeof v === "object" && !Array.isArray(v) ? v : {};
@@ -4175,9 +4246,15 @@ function recordAzureDeployment(root, data, endpoint) {
   if (agentRoot2 === null) return;
   const tomlPath = path16.join(agentRoot2, "studio.toml");
   let deployedFaces = null;
+  let deployedX402 = null;
+  let deployedX402Carrier = null;
   try {
     const cfg = loadStudioCfg(deployWorkspaceRoot(root));
     deployedFaces = stackFaces(tableOf4(cfg, "stack"), tableOf4(cfg, "payments"));
+    if (hasX402Face(deployedFaces)) {
+      deployedX402 = x402DeploymentSnapshot(agentRoot2, "self");
+      deployedX402Carrier = inspectAzureX402Carrier(agentRoot2).status;
+    }
   } catch {
   }
   try {
@@ -4192,6 +4269,30 @@ function recordAzureDeployment(root, data, endpoint) {
     }
     if (deployedFaces) {
       patchTomlKv(tomlPath, "azure", "deployed_faces", deployedFaces);
+      patchTomlKv(
+        tomlPath,
+        "azure",
+        "deployed_x402_status",
+        deployedX402?.status ?? ""
+      );
+      patchTomlKv(
+        tomlPath,
+        "azure",
+        "deployed_x402_price_mode",
+        deployedX402?.priceMode ?? ""
+      );
+      patchTomlKv(
+        tomlPath,
+        "azure",
+        "deployed_x402_credentials_complete",
+        deployedX402?.credentialsComplete ?? false
+      );
+      patchTomlKv(
+        tomlPath,
+        "azure",
+        "deployed_x402_carrier",
+        deployedX402Carrier ?? ""
+      );
     }
     patchTomlKv(tomlPath, "azure", "last_deploy_at", (/* @__PURE__ */ new Date()).toISOString());
   } catch {
@@ -4211,6 +4312,10 @@ function clearAzureEndpoint(root) {
       patchTomlKv(tomlPath, "azure", key, "");
     }
     patchTomlKv(tomlPath, "azure", "deployed_faces", []);
+    patchTomlKv(tomlPath, "azure", "deployed_x402_status", "");
+    patchTomlKv(tomlPath, "azure", "deployed_x402_price_mode", "");
+    patchTomlKv(tomlPath, "azure", "deployed_x402_credentials_complete", false);
+    patchTomlKv(tomlPath, "azure", "deployed_x402_carrier", "");
   } catch {
   }
 }
@@ -4507,6 +4612,20 @@ var checkEntrypointAndDockerfile = async (root, _target) => {
       details: { entrypoint: entry }
     });
   }
+  if (hasX402Face(faces)) {
+    const carrier = inspectAzureX402Carrier(agentRoot2);
+    if (carrier.status !== "http-envelope-v1") {
+      findings.push({
+        level: "CRITICAL",
+        name: "azure_x402_entrypoint_compatible",
+        message: `${carrier.detail}. This scaffold cannot serve X402 even though studio.toml enables it. In a clean parent directory, run \`bag init azurex402migration --runtime azure-foundry --protocols ${faces.join(",")} --no-install --no-onboard\`, then review and merge its src/unifiedMain.ts, Dockerfile, and package scripts before redeploying. Studio will not overwrite user-owned agent code.`,
+        details: {
+          entrypoint: carrier.entrypoint,
+          carrier: carrier.status
+        }
+      });
+    }
+  }
   if (!isFile6(path16.join(agentRoot2, "Dockerfile"))) {
     findings.push({
       level: "CRITICAL",
@@ -7901,7 +8020,7 @@ function registerInit(program) {
   ).addOption(
     new Option2(
       "--protocols <faces>",
-      "Comma-separated public faces to expose; recorded in studio.toml [stack].protocols. Any non-empty combination of A2A, MCP, X402 (case-insensitive; default: A2A)."
+      "Comma-separated public faces to expose; recorded in studio.toml [stack].protocols. Any non-empty combination of A2A, MCP, X402 (case-insensitive; default: A2A,X402)."
     )
   ).addOption(
     new Option2(
@@ -7911,7 +8030,7 @@ function registerInit(program) {
   ).addOption(
     new Option2(
       "--rails <rails>",
-      "Commerce rail(s) to scaffold: 8183 (default), b402, or both."
+      "Commerce rail(s) to scaffold: 8183, b402, or both (default; Altana defaults to 8183)."
     ).choices(["8183", "b402", "both"])
   ).option(
     "--erc8183-price <base-units>",
@@ -8063,9 +8182,12 @@ async function cmdInitFlow(nameArg, opts) {
     printErr("error: pass either --protocols or --protocol, not both.");
     return 2;
   }
+  const facesExplicit = opts.protocols !== void 0 || opts.protocol !== void 0;
   let faces;
   try {
-    faces = normalizeProtocolFaces(opts.protocols ?? opts.protocol ?? "A2A");
+    faces = normalizeProtocolFaces(
+      opts.protocols ?? opts.protocol ?? "A2A,X402"
+    );
     if (opts.protocol !== void 0 && faces.length !== 1) {
       throw new Error("--protocol is a single-face alias; use --protocols");
     }
@@ -8101,7 +8223,13 @@ async function cmdInitFlow(nameArg, opts) {
   if (llmProvider === null) {
     return 2;
   }
-  let rails = await resolveRails(opts.rails, isTty);
+  const inferredRails = opts.rails ?? (facesExplicit ? hasX402Face(faces) ? "both" : "8183" : walletKind2 === "altana" ? "8183" : void 0);
+  let rails = await resolveRails(inferredRails, isTty);
+  if (!facesExplicit) {
+    faces = normalizeProtocolFaces(
+      rails === "8183" ? ["A2A"] : ["A2A", "X402"]
+    );
+  }
   if (hasX402Face(faces) && rails === "8183") {
     rails = "both";
   } else if (hasX402Face(faces) && rails !== "both") {
@@ -8855,6 +8983,9 @@ function renderAzureSection(name, account, project) {
 [azure]
 # Hosted-Agents-supported region (eastus does NOT support Hosted Agents).
 location = "${DEFAULT_LOCATION}"
+# Optional Azure subscription id. Set it when the signed-in identity can access
+# more than one subscription so non-interactive deploy never guesses.
+subscription_id = ""
 # account_name MUST equal subdomain \u2014 the runtime derives the storage host
 # (https://{account_name}.services.ai.azure.com) from it; a mismatch is NXDOMAIN.
 account_name = "${azureName}"
@@ -9261,13 +9392,15 @@ async function resolveRails(flagValue, isTty) {
   if (flagValue === "8183" || flagValue === "b402" || flagValue === "both") {
     return flagValue;
   }
-  if (!isTty) return "8183";
-  const answer = (await promptUser("Commerce rails [8183/b402/both, Enter = 8183]: ")).trim().toLowerCase();
-  if (answer === "b402" || answer === "both") return answer;
-  if (answer !== "" && answer !== "8183") {
-    printErr(`hint: unknown commerce rail '${answer}' \u2014 using 8183.`);
+  if (!isTty) return "both";
+  const answer = (await promptUser("Commerce rails [8183/b402/both, Enter = both]: ")).trim().toLowerCase();
+  if (answer === "8183" || answer === "b402" || answer === "both") {
+    return answer;
   }
-  return "8183";
+  if (answer !== "") {
+    printErr(`hint: unknown commerce rail '${answer}' \u2014 using both.`);
+  }
+  return "both";
 }
 var DEFAULT_ERC8183_PRICE = "100000000000000000";
 async function resolveErc8183Price(flagValue, isTty) {
@@ -16760,6 +16893,12 @@ function azureX402CarrierBody() {
 function sameFaces(a, b) {
   return a.length === b.length && a.every((face, index) => face === b[index]);
 }
+function sameX402Snapshot(a, b) {
+  if (a === null || a === void 0 || b === null || b === void 0) {
+    return a === b;
+  }
+  return a.status === b.status && a.priceMode === b.priceMode && a.credentialsComplete === b.credentialsComplete;
+}
 function printAzureInfo(root, deployment, opts) {
   const endpoint = deployment.endpoint;
   if (!endpoint) {
@@ -16788,20 +16927,34 @@ function printAzureInfo(root, deployment, opts) {
   const currentFaces = agentFacesOf(agentRoot2);
   const faces = deployment.faces ?? currentFaces;
   const facesSource = deployment.faces ? "deployment-record" : "current-scaffold";
-  const configurationDrift = deployment.faces !== void 0 && !sameFaces(deployment.faces, currentFaces);
+  const facesDrift = deployment.faces !== void 0 && !sameFaces(deployment.faces, currentFaces);
   const hasX402 = hasX402Face(faces);
   const hasA2a = hasA2aFace(faces);
-  const x402Summary = hasX402 ? x402DeploySummary(agentRoot2, "self", null) : "";
-  const x402Status = x402Summary.includes("ACTIVE in FREE mode") ? "free" : x402Summary.startsWith("x402 rail is ACTIVE") ? "active" : "dormant";
-  const x402Body = hasX402 ? azureX402CarrierBody() : void 0;
-  const body = hasA2a || x402Body === void 0 ? azureNegotiateQuickVerifyBody() : x402Body;
-  const x402Info = hasX402 ? {
+  const currentX402 = hasX402Face(currentFaces) ? x402DeploymentSnapshot(agentRoot2, "self") : null;
+  const x402State = deployment.x402 ?? currentX402;
+  const x402StateSource = deployment.x402 ? "deployment-record" : "current-scaffold";
+  const x402Drift = deployment.x402 !== void 0 && !sameX402Snapshot(deployment.x402, currentX402);
+  const currentCarrier = hasX402Face(currentFaces) ? inspectAzureX402Carrier(agentRoot2).status : null;
+  const carrierDrift = deployment.x402Carrier !== void 0 && deployment.x402Carrier !== currentCarrier;
+  const configurationDrift = facesDrift || x402Drift || carrierDrift;
+  const carrierVerified = deployment.x402Carrier === "http-envelope-v1";
+  const x402Summary = hasX402 ? carrierVerified ? deployment.x402 ? x402DeploySummaryFromSnapshot(
+    deployment.x402,
+    "azure-foundry",
+    "self",
+    null
+  ) : x402DeploySummary(agentRoot2, "self", null) : deployment.x402Carrier === "incompatible-scaffold" ? "The deployed Azure entrypoint did not mount createEnvelopeMiddleware and X402Seller. Re-scaffold the unified entrypoint, review the diff, and redeploy." : "This deployment record predates X402 carrier verification, so the deployed artifact cannot be treated as X402-capable. Verify or migrate the unified entrypoint and redeploy." : "";
+  const x402Status = carrierVerified ? x402State?.status ?? (x402Summary.includes("ACTIVE in FREE mode") ? "free" : x402Summary.startsWith("x402 rail is ACTIVE") ? "active" : "dormant") : "incompatible-scaffold";
+  const x402Body = hasX402 && carrierVerified ? azureX402CarrierBody() : void 0;
+  const body = hasA2a ? azureNegotiateQuickVerifyBody() : x402Body;
+  const x402Info = hasX402 ? carrierVerified ? {
     status: x402Status,
     access: x402Status === "dormant" ? "dormant" : "requires-external-gateway",
     public_url: null,
     carrier: "http-envelope-v1",
     gateway_guide: foundryX402GatewayGuideUrl(),
     summary: x402Summary || "x402 seller state is not available locally.",
+    state_source: x402StateSource,
     ...x402Status === "dormant" ? {} : {
       request: {
         method: "POST",
@@ -16810,6 +16963,12 @@ function printAzureInfo(root, deployment, opts) {
         executes_seller_work: false
       }
     }
+  } : {
+    status: "incompatible-scaffold",
+    access: "incompatible-scaffold",
+    public_url: null,
+    summary: x402Summary,
+    state_source: deployment.x402Carrier ? "deployment-record" : "unverified-deployment"
   } : void 0;
   if (opts.json) {
     printOut(
@@ -16828,11 +16987,11 @@ function printAzureInfo(root, deployment, opts) {
             resource: AZURE_FOUNDRY_TOKEN_RESOURCE,
             scope: AZURE_FOUNDRY_TOKEN_SCOPE
           },
-          request: {
+          request: body ? {
             method: "POST",
             content_type: "application/json",
             body
-          },
+          } : null,
           ...x402Info ? { x402: x402Info } : {}
         },
         null,
@@ -16846,16 +17005,24 @@ function printAzureInfo(root, deployment, opts) {
   printOut(`  deployed faces: ${faces.join(", ")} (${facesSource})`);
   if (configurationDrift) {
     printErr(
-      `warning: current scaffold faces (${currentFaces.join(", ")}) differ from the recorded deployment; redeploy before treating local config as live.`
+      "warning: current scaffold/payment configuration differs from the recorded deployment; redeploy before treating local config as live."
     );
   }
   printOut(
     `  authentication: Microsoft Entra bearer token (resource ${AZURE_FOUNDRY_TOKEN_RESOURCE}; SDK scope ${AZURE_FOUNDRY_TOKEN_SCOPE})`
   );
-  printOut("  request: POST application/json");
-  printOut(`  body: ${JSON.stringify(body)}`);
+  if (body) {
+    printOut("  request: POST application/json");
+    printOut(`  body: ${JSON.stringify(body)}`);
+  } else {
+    printOut(
+      "  request: unavailable until the X402 scaffold is migrated and redeployed"
+    );
+  }
   if (x402Info) {
-    if (x402Info.access === "dormant") {
+    if (x402Info.access === "incompatible-scaffold") {
+      printOut(`  x402 access: incompatible-scaffold \u2014 ${x402Info.summary}`);
+    } else if (x402Info.access === "dormant") {
       printOut(`  x402 access: dormant \u2014 ${x402Info.summary}`);
     } else {
       printOut(
@@ -16872,7 +17039,7 @@ function printAzureInfo(root, deployment, opts) {
       printOut(`  x402 gateway guide: ${foundryX402GatewayGuideUrl()}`);
     }
   }
-  if (opts.withCurl) {
+  if (opts.withCurl && body) {
     printOut(
       hasA2a ? "\nQuick-verify curl:" : "\nX402 no-work route-probe curl:"
     );
@@ -16889,6 +17056,10 @@ function printAzureInfo(root, deployment, opts) {
     printOut(
       "\n  The Azure CLI command is only a convenient way to mint a token for this curl. Deployment itself does not require az/azd; DefaultAzureCredential or ClientSecretCredential can mint the same scope in an application."
     );
+  } else if (opts.withCurl) {
+    printErr(
+      "warning: no X402 curl was emitted because the recorded Azure deployment does not prove http-envelope-v1 support; migrate and redeploy first."
+    );
   }
   return 0;
 }

package/dist/{chunk-GKFTJDDJ.js → chunk-VVHPUKLV.js}

@@ -686,8 +686,8 @@ function packageRoot() {
   }
 }
 function studioCliVersion() {
-  if ("0.0.11-alpha.4") {
-    return "0.0.11-alpha.4";
+  if ("0.0.11-alpha.6") {
+    return "0.0.11-alpha.6";
   }
   const file = path3.join(packageRoot(), "package.json");
   const pkg = JSON.parse(fs3.readFileSync(file, "utf-8"));
@@ -831,14 +831,47 @@ function loadDeployConfig(root) {
     return { agentRoot, cfg: {} };
   }
 }
-function x402DeploySummary(root, destination, publicUrl) {
+function deploymentStatus(priceMode, credentialsComplete, runtime, destination) {
+  if (destination !== "platform" && !X402_CAPABLE_RUNTIMES.has(runtime)) {
+    return "dormant";
+  }
+  if (priceMode === "free") return "free";
+  if (priceMode === "paid" && credentialsComplete) return "active";
+  return "dormant";
+}
+function x402DeploymentSnapshot(root, destination) {
   const { agentRoot, cfg } = loadDeployConfig(root);
-  if (!commerceRails(cfg).x402) return "";
+  if (!commerceRails(cfg).x402) return null;
   const seller = table3(table3(cfg.payments).x402_seller);
   const pricing = x402SellerPricingState(seller);
   const credentials = b402Credentials(agentRoot);
-  const activation = `${B402_PAID_ONBOARDING_GUIDANCE} Then run the bnbagent-studio-selling-via-b402 skill, fill the four B402_* variables in .studio/.env.local, and redeploy.`;
+  const priceMode = pricing.kind;
   const runtime = String(table3(cfg.stack).runtime ?? "agentcore");
+  return {
+    status: deploymentStatus(
+      priceMode,
+      credentials.complete,
+      runtime,
+      destination
+    ),
+    priceMode,
+    credentialsComplete: credentials.complete
+  };
+}
+function x402DeploySummary(root, destination, publicUrl) {
+  const { cfg } = loadDeployConfig(root);
+  const snapshot = x402DeploymentSnapshot(root, destination);
+  if (snapshot === null) return "";
+  const runtime = String(table3(cfg.stack).runtime ?? "agentcore");
+  return x402DeploySummaryFromSnapshot(
+    snapshot,
+    runtime,
+    destination,
+    publicUrl
+  );
+}
+function x402DeploySummaryFromSnapshot(snapshot, runtime, destination, publicUrl) {
+  const activation = `${B402_PAID_ONBOARDING_GUIDANCE} Then run the bnbagent-studio-selling-via-b402 skill, fill the four B402_* variables in .studio/.env.local, and redeploy.`;
   if (destination !== "platform" && !X402_CAPABLE_RUNTIMES.has(runtime)) {
     return `x402 rail is FORCED DORMANT: the ${runtime} runtime has no x402 path. Deploy to AgentCore or Azure Foundry (managed platform or self-hosted) to activate the rail.`;
   }
@@ -846,10 +879,10 @@ function x402DeploySummary(root, destination, publicUrl) {
   const runtimeLabel = azure ? "Azure Foundry" : "AgentCore";
   const tunnelLine = azure ? 'The front wraps each request as envelope-v1 JSON, {"v":1,"method":"POST","path":"/x402","headers":{...},"body":"<base64>"}, inside an Entra-authenticated Foundry invocation (POST \u2026/agents/<name>/endpoint/protocols/invocations with an https://ai.azure.com bearer). Limits: 1 MiB request, 5 MiB response, no streaming.' : 'The front wraps each request as envelope-v1 JSON, {"v":1,"method":"POST","path":"/x402","headers":{...},"body":"<base64>"}, inside an authenticated AgentCore invocation. The default Bag self-deploy uses Cognito OAuth over HTTPS; IAM runtimes may use SDK/SigV4. Limits: 1 MiB request, 5 MiB response, no streaming.';
   const gatewayDocLine = azure ? `Gateway example: https://unpkg.com/@bnbagent/studio-cli@${studioCliVersion()}/skills/references/bnbagent-studio-use-azure-foundry.md#x402-external-gateway` : "Gateway example: https://github.com/bnb-chain/bnbagent-studio/blob/main/docs/guides/self-hosted-x402-gateway.md";
-  if (pricing.kind === "invalid") {
+  if (snapshot.priceMode === "invalid") {
     return "x402 rail is DORMANT: price_usd is invalid; run `bag doctor`.";
   }
-  if (pricing.kind === "free") {
+  if (snapshot.priceMode === "free") {
     if (destination !== "platform") {
       return [
         `x402 rail is ACTIVE in FREE mode (self-hosted ${runtimeLabel}).`,
@@ -867,7 +900,7 @@ function x402DeploySummary(root, destination, publicUrl) {
       "B402 verify/settle is bypassed; no credentials, token payment, or settlement audit is used."
     ].join("\n");
   }
-  if (!credentials.complete) {
+  if (!snapshot.credentialsComplete) {
     return `x402 rail is DORMANT. To activate: ${activation}`;
   }
   const settlement = [
@@ -904,7 +937,7 @@ function isTable(value) {
 }
 
 // src/cli/_deploy/deployCli.ts
-var DEPLOY_CLI_VERSION = "0.5.11";
+var DEPLOY_CLI_VERSION = "0.5.12";
 var DEPLOY_CLI_PACKAGE = `@bnbagent/deploy-cli@${DEPLOY_CLI_VERSION}`;
 var BNB_PLATFORM_API_URL = "https://bnbagent-api.bnbchain.world";
 var BNB_PLATFORM_API_URL_ENV = "BNBAGENT_API_URL";
@@ -936,7 +969,8 @@ var FOUNDRY_PASSTHROUGH_KEYS = /* @__PURE__ */ new Set([
   "project",
   "projectEndpoint",
   "protocol",
-  "registry"
+  "registry",
+  "subscriptionId"
 ]);
 function tableOf(data, key) {
   const v = data[key];
@@ -1054,7 +1088,8 @@ function buildDeploySpec(root, opts) {
       ["account_name", "account"],
       ["project_name", "project"],
       ["project_endpoint", "projectEndpoint"],
-      ["location", "location"]
+      ["location", "location"],
+      ["subscription_id", "subscriptionId"]
     ]) {
       const value = String(azure[source] ?? "").trim();
       if (value) {
@@ -1336,7 +1371,9 @@ export {
   X402_CAPABLE_RUNTIMES,
   commerceRails,
   b402Credentials,
+  x402DeploymentSnapshot,
   x402DeploySummary,
+  x402DeploySummaryFromSnapshot,
   DEPLOY_CLI_VERSION,
   DEPLOY_CLI_PACKAGE,
   BNB_PLATFORM_API_URL,

package/dist/{deployCli-YYV7FFFG.js → deployCli-5DZVAKMZ.js}

@@ -18,7 +18,7 @@ import {
   runPlatformAccountCommand,
   trialFromDeployCliJson,
   withDeployFiles
-} from "./chunk-GKFTJDDJ.js";
+} from "./chunk-VVHPUKLV.js";
 import "./chunk-RO726HJG.js";
 export {
   BNB_PLATFORM_API_URL,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bnbagent/studio-cli",
-  "version": "0.0.11-alpha.4",
+  "version": "0.0.11-alpha.6",
   "description": "Skills-first toolkit and bag CLI for BNB Chain seller agents: ERC-8004 identity, ERC-8183 escrowed commerce, and x402 payments.",
   "keywords": [
     "bnb-chain",
@@ -54,7 +54,7 @@
     "tar": "^7.4.0",
     "viem": "^2.54.0",
     "yaml": "^2.9.0",
-    "@bnbagent/studio-runtime": "0.0.11-alpha.4"
+    "@bnbagent/studio-runtime": "0.0.11-alpha.6"
   },
   "devDependencies": {
     "@a2a-js/sdk": "^0.3.14",

package/skills/bnbagent-studio.md

@@ -1,11 +1,11 @@
 ---
 name: bnbagent-studio
-description: The single entry point for bnbagent-studio - a TypeScript CLI (`bag`) for building a blockchain SELLER agent that earns $U on BNB Chain via ERC-8004 + ERC-8183 + x402 (Pieverse LLM inside). Load this skill whenever the user works in a bnbagent-studio / `bag` project, or wants to create/scaffold, deploy, run, debug, operate, or monetize such a seller agent (composable A2A, MCP, and X402 faces; BNB Chain trial or AWS AgentCore). All detailed playbooks ship as references/ files inside this skill - route via the decision tree in the body. When invoked with arguments, treat them as the user's intent and route the same way.
+description: The single entry point for bnbagent-studio - a TypeScript CLI (`bag`) for building a blockchain SELLER agent that earns $U on BNB Chain via ERC-8004 + ERC-8183 + x402 (Pieverse LLM inside). Load this skill whenever the user works in a bnbagent-studio / `bag` project, or wants to create/scaffold, deploy, run, debug, operate, or monetize such a seller agent (composable A2A, MCP, and X402 faces; BNB Chain trial, AWS AgentCore, or Azure Foundry). All detailed playbooks ship as references/ files inside this skill - route via the decision tree in the body. When invoked with arguments, treat them as the user's intent and route the same way.
 ---
 
 # bnbagent-studio (the single entry point)
 
-`bnbagent-studio` (CLI: `bag`) wires the `@bnbagent/sdk` protocol layer (wallet / ERC-8004 / ERC-8183 / Pieverse LLM) into a TypeScript agent project, then deploys it as a **single blockchain seller runtime**. A2A, MCP, and X402 are composable public faces selected with `--protocols`; A2A is the default. `bag deploy` uses **scheme C**: every new deploy or redeploy explicitly selects BNB or AWS; a recorded deployment is used only to offer an explicit update action, never as a silent default. BNB is a 48h testnet trial and is disabled after expiry. AWS deploys into the user's own account. All cloud lifecycle mutations go through the pinned `@bnbagent/deploy-cli`; the optional AWS CLI is used only by the fail-open, read-only AgentCore quota check in `bag deploy prepare`. BNB/AWS share the agentcore scaffold. Treat an incompatible provider row as unavailable-do not force through it or mutate the scaffold during deploy.
+`bnbagent-studio` (CLI: `bag`) wires the `@bnbagent/sdk` protocol layer (wallet / ERC-8004 / ERC-8183 / Pieverse LLM) into a TypeScript agent project, then deploys it as a **single blockchain seller runtime**. A2A, MCP, and X402 are composable public faces selected with `--protocols`; the default evm-local/twak scaffold serves A2A + X402 with both ERC-8183 and B402 rails, while Altana defaults to A2A + ERC-8183 because paid B402 is unsupported. `bag deploy` uses **scheme C**: every new deploy or redeploy explicitly selects BNB, AWS, or Azure; a recorded deployment is used only to offer an explicit update action, never as a silent default. BNB is a 48h testnet trial and is disabled after expiry. AWS and Azure self-deploy into the user's own account. All cloud lifecycle mutations go through the pinned `@bnbagent/deploy-cli`; the optional AWS CLI is used only by the fail-open, read-only AgentCore quota check in `bag deploy prepare`. AgentCore and Azure Foundry share the unified A2A/X402 entrypoint; Azure rejects MCP. Treat an incompatible provider row as unavailable-do not force through it or mutate the scaffold during deploy.
 
 Invoked as `/bnbagent-studio <ask>`? Treat `<ask>` as the user's intent and route it through the decision tree below, exactly like a natural-language ask.
 
@@ -24,7 +24,7 @@ One deployed runtime, one signer: a single valuable Agent serves the selected fa
 | Run / debug / dev / doctor / RPC / balance / incident triage | `references/bnbagent-studio-operating.md` |
 | Implement what the Agent sells, tune pricing, publish over A2A and/or MCP, defend disputes (seller flow) | `references/bnbagent-studio-selling-via-8183.md` |
 | Sell one paid or FREE HTTP request through the B402-backed x402 rail (pricing choice; paid merchant application, RSA key, credentials, IP allowlist, activation) | `references/bnbagent-studio-selling-via-b402.md` |
-| Deploy / redeploy / status / logs / destroy | Run `bag deploy` and explicitly choose a provider. Non-interactive deploy requires `--provider bnb\|aws --yes` (and `--allow-multiple` when keeping another provider active). Read `references/bnbagent-studio-use-bnb-trial.md` or `references/bnbagent-studio-use-aws-agentcore.md` for the selected provider. `bag deploy status` lists every recorded provider; multi-deployment logs/verify/destroy require `--provider`. |
+| Deploy / redeploy / status / logs / destroy | Run `bag deploy` and explicitly choose a provider. Non-interactive deploy requires `--provider bnb\|aws\|azure --yes` (and `--allow-multiple` when keeping another provider active). Read `references/bnbagent-studio-use-bnb-trial.md`, `references/bnbagent-studio-use-aws-agentcore.md`, or `references/bnbagent-studio-use-azure-foundry.md` for the selected provider. `bag deploy status` lists every recorded provider; multi-deployment logs/verify/destroy require `--provider`. |
 | Wire chain-read tools into the Agent's LLM (AI SDK `tool()` wrappers, or any TS agent framework) | `references/bnbagent-studio-wiring-llm-tools.md` |
 | Buy a service from another ERC-8183 seller via CLI - incl. testing your own seller from the buyer side (v2/internal - NOT the v1 seller product flow) | `references/bnbagent-studio-buying-via-8183.md` |
 | Give the agent a PAID x402 capability - CMC market data / Binance Bazaar (B402) merchants / any pay-per-call API (`bag x402 trust`, x402-buyer recipe, 402 buyer errors) | `references/bnbagent-studio-buying-from-bazaar.md` |
@@ -53,7 +53,7 @@ Treat ERC-8183 amounts as decimal strings at CLI/config boundaries and `bigint`
 
 ## CLI groups at a glance
 
-`init`, `scan`, `recipe`, `skills`, `wallet`, `erc8004`, `erc8183`, `x402`, `agents`, `config`, `env`, `dev`, `doctor`, `audit`, `deploy`, `platform`, `llm`, `bundle`, `budget` - see `bag --help` for details. `bag deploy [--provider bnb\|aws] [--backend aws\|azure]` is the primary deploy command; `--backend` is valid only for provider `bnb` and confirms the recipe-derived managed backend. `prepare`, `verify`, `status`, `info`, `destroy`, `logs`, and `fix-gitignore` remain lifecycle subcommands (`deploy agent` is a deprecated compatibility alias). Provider deploy/status/logs/destroy and deploy-time credential validation are delegated to pinned `@bnbagent/deploy-cli@0.5.11`.
+`init`, `scan`, `recipe`, `skills`, `wallet`, `erc8004`, `erc8183`, `x402`, `agents`, `config`, `env`, `dev`, `doctor`, `audit`, `deploy`, `platform`, `llm`, `bundle`, `budget` - see `bag --help` for details. `bag deploy [--provider bnb\|aws\|azure] [--backend aws\|azure]` is the primary deploy command; `--backend` is valid only for provider `bnb` and confirms the recipe-derived managed backend. `prepare`, `verify`, `status`, `info`, `destroy`, `logs`, and `fix-gitignore` remain lifecycle subcommands (`deploy agent` is a deprecated compatibility alias). Provider deploy/status/logs/destroy and deploy-time credential validation are delegated to pinned `@bnbagent/deploy-cli@0.5.12`.
 
 ## Tool surface
 

package/skills/references/bnbagent-studio-adding-to-project.md

@@ -1,6 +1,6 @@
 ---
 name: bnbagent-studio-adding-to-project
-description: When the user wants to add bnbagent-studio's single ERC-8183 seller runtime (one valuable Agent on AWS Bedrock AgentCore that serves A2A by default or MCP optionally, holds the key, and signs in-process) to an existing TypeScript agent project.
+description: When the user wants to add bnbagent-studio's single seller runtime (one valuable Agent on AWS Bedrock AgentCore that serves A2A + X402 with ERC-8183 + B402 by default, or another selected face/rail combination, holds the key, and signs in-process) to an existing TypeScript agent project.
 ---
 
 > **Reference file** of the `bnbagent-studio` router skill - installed at `bnbagent-studio/references/` and loaded on demand (not a standalone skill). Route here via the router's decision tree.

package/skills/references/bnbagent-studio-scaffolding-agent.md

@@ -1,6 +1,6 @@
 ---
 name: bnbagent-studio-scaffolding-agent
-description: When the user wants to create a brand-new blockchain SELLER from zero - a single valuable Agent on AWS Bedrock AgentCore that serves A2A by default or MCP optionally, holds the key, and signs in-process - earning $U on BNB Chain via ERC-8004 + ERC-8183 + x402. Drives the full intake → todo-list → execute flow.
+description: When the user wants to create a brand-new blockchain SELLER from zero - a single valuable Agent on AWS Bedrock AgentCore that serves A2A + X402 with ERC-8183 + B402 by default (or another selected face/rail combination), holds the key, and signs in-process. Drives the full intake → todo-list → execute flow.
 ---
 
 > **Reference file** of the `bnbagent-studio` router skill - installed at `bnbagent-studio/references/` and loaded on demand (not a standalone skill). Route here via the router's decision tree.
@@ -71,7 +71,7 @@ The fields (give the user all of them at once):
 | 3 | **LLM provider** | `pieverse-llm` / `openrouter` / `openai` / `anthropic` / `bedrock` | `pieverse-llm` |
 | 4 | **Wallet kind** (`--wallet-kind`) | `evm-local` (encrypted local keystore at the workspace root; `bag wallet new` creates it, `--private-key` imports an existing key; CodeZip deploy) / `twak` (**fully supported, opt in with `--wallet-kind twak`** - Trust Wallet Agent Kit CLI ≥0.20.0, self-custody encrypted mnemonic in a **project-dedicated** home `.studio/twak`, isolated from your main `~/.twak`; created manually with `HOME=<ws>/.studio/twak twak wallet create`, then `bag wallet new` adopts; container deploy. Reuse an existing wallet across agents with `--twak-home <path>`) / `altana` (bounded-session custody - admin keystore stays local, deploys ship ONLY the `ALTANA_SESSION` secret; zip deploy; not compatible with `pieverse-llm` or a paid b402 rail; flow: `references/bnbagent-studio-using-altana-wallet.md`) | `evm-local` |
 | 5 | **Storage** | `local` (file:// on disk, offline dev only, does **NOT** survive deploy) / `ipfs` (durable, public, deploy-ready; needs your pinning service's upload endpoint + write key as `STORAGE_API_URL` / `STORAGE_API_KEY` in `.studio/.env.local` **before the first real delivery** - see Step 6b) | `local` |
-| 6 | **Protocol faces** (`--protocols`) | any non-empty subset of `A2A`, `MCP`, `X402` | `A2A` |
+| 6 | **Protocol faces** (`--protocols`) | any non-empty subset of `A2A`, `MCP`, `X402` | `A2A,X402` (`A2A` for Altana) |
 | 7 | **LLM model** | provider catalogue; for `pieverse-llm` the default `auto/free` runs at $0/token | `auto/free` |
 | 8 | **Auto-topup** | `enable` / `disable` - lets the Agent auto-pay $U from the wallet when LLM credits run low | deferred (non-interactive `bag init` records no `[budget]`; enable later with `bag budget enable`) |
 | 9 | **Scaffold destination** (`--destination`) | `self` (prepare the AgentCore scaffold for **your own** AWS account; runtime material stays under your cloud-account control) / `platform` (prepare for a 48h **testnet-only** trial on the BNB Chain managed platform - runs the _same_ agent in the **operator's** AWS, so a wallet key **leaves your control**; it hard-forces `[network].default = bsc-testnet`, pins runtime=`agentcore`, packages an artifact, and auth is GitHub device flow. Use a **throwaway** `bag wallet new`, never your main wallet). This is scaffold intent only; deploy still explicitly selects `--provider`. | `platform` while the trial campaign runs (bare init falls back to `self` once it ends, or when `--network bsc-mainnet` / a non-agentcore `--runtime` is passed) |
@@ -86,7 +86,7 @@ v1 is **seller-only** - there is no role to choose. `bag init` scaffolds the sin
 | --- | --- | --- |
 | **Agent stack** | AI SDK (`ai`) | The library the agent's brain is built with - the emitted `src/model.ts` factory returns an AI SDK `LanguageModel`, and `src/tools.ts` wraps the chain reads as AI SDK `tool()`s. (There is no `--framework` flag: the old framework axis folded into the runtime templates.) |
 | **Runtime** | `agentcore` | AWS Bedrock AgentCore - where the agent is hosted and served (`--runtime agentcore`). |
-| **Protocol faces** | selected above (`A2A` default; MCP/X402 composable) | A2A hosts agent card + JSON-RPC on `:9000`; MCP-only hosts `/mcp` on `:8000`; A2A+MCP uses A2A-native `dualMain.ts` on `:9000` and tunnels buffered MCP through the platform; X402 adds `/x402`, and X402-only suppresses protocol discovery. |
+| **Protocol faces** | selected above (`A2A,X402` default for evm-local/twak; `A2A` for Altana; MCP composable) | A2A hosts agent card + JSON-RPC on `:9000`; MCP-only hosts `/mcp` on `:8000`; A2A+MCP uses A2A-native `dualMain.ts` on `:9000` and tunnels buffered MCP through the platform; X402 adds `/x402`, and X402-only suppresses protocol discovery. |
 
 **Not surfaced** (handled automatically, no need to show or ask):
 
@@ -138,7 +138,7 @@ Build a TodoWrite list. The shape depends on the `wallet kind`. The canonical 8-
 
 > **Onboarding note.** On a human TTY, `bag init` runs steps 3, 4 and 6 automatically (it prompts once for the wallet password, runs `bag wallet new`, zero-deposit-activates Pieverse, and prints faucet URLs). **You (Claude Code) drive `bag init` non-interactively**, so that auto-flow does NOT fire - keep steps 3/4/6 below. Pass `--no-onboard` to `bag init` to make this explicit and deterministic regardless of how the shell wires stdin.
 
-1. `bag init <name> --llm-provider <p> --network <n> --storage-provider <s> --wallet-kind <k> --rails <8183|b402|both> [--erc8183-price <base-units>] [--b402-price <usd>] --no-onboard` - scaffold the current workspace. **`<name>` must start with a letter, use ASCII letters and digits only, and be at most 23 characters.** `bag init` rejects `-`, `_`, `.`, and overlong names instead of renaming them. Pass `--wallet-kind evm-local` (default) or `--wallet-kind twak` (twak is fully supported - pass the flag to opt in), and `--storage-provider local` (default) or `ipfs`, per the Stage-1 choices; for twak, add `--twak-home <path>` ONLY if the user wants to reuse an existing wallet (otherwise omit - a project-dedicated `.studio/twak` is the safe default). add `--protocols <comma-list>` when the user chose non-default or multiple faces (omit for A2A default; `--protocol <one>` is only a legacy alias), add `--model <m>` only if the user overrode the provider default, and `--enable-auto-topup` / `--no-auto-topup` only if they made an explicit choice (otherwise omit - consent stays deferred). Pass `--erc8183-price 0` only when the user explicitly chose FREE; omitting the flag preserves the paid 0.1 U default. The canonical stack supports FREE; if a custom deployment is selected, set all three `ERC8183_COMMERCE_ADDRESS`, `ERC8183_ROUTER_ADDRESS`, and `ERC8183_POLICY_ADDRESS` values from that same stack. For B402, pass `--b402-price 0` only after the user explicitly accepts an unrestricted anonymous FREE `/x402` endpoint. FREE bypasses B402 verify/settle and needs no merchant credentials; a positive price keeps the `$0.01` default and requires the paid onboarding playbook. **Destination:** while the trial campaign runs, bare `bag init` (no `--destination`) defaults to `platform` - so pass `--destination self` **explicitly** whenever the user chose their own AWS, otherwise studio.toml silently records `platform` and the confirmation block you echoed no longer matches what was written. Omit `--destination` only when the user actually wants the `platform` 48h testnet trial (the campaign default) - do NOT treat that default as a mistake or re-confirm it; it is the intended behavior while the campaign is open. (Bare init also resolves to `self` once the campaign ends, or when `--network bsc-mainnet` / a non-agentcore `--runtime` is passed.) On the `platform` path `bag init` hard-forces `bsc-testnet`, pins `--runtime agentcore` + packages an artifact (a zip for the default evm-local and altana wallets, a container for twak). For evm-local a wallet key will later leave your machine, so pair it with a throwaway `bag wallet new`; for altana only the bounded session ships - do NOT create a new wallet (full flow: `docs/guides/platform-deploy.md`). Defaults `--runtime agentcore` (the only advertised runtime; the Preview `azure-foundry` runtime remains explicitly selectable but is outside this playbook; there is no `--framework` flag because the AI SDK model/tools story is part of the runtime templates). Creates `<name>/` workspace root + `<name>/app/agent/` (the single sub-project: A2A emits `src/unifiedMain.ts` (the express + A2A entrypoint, one code set for both deploy clouds) + `src/sellerCore.ts` (the protocol-neutral core; executor inherits it) + `src/executor.ts` + `src/agentCard.ts`; MCP emits `src/mcpMain.ts`; both include `src/signing.ts` + `src/tools.ts` + `src/model.ts` + their own `studio.toml` + `package.json` + `tsconfig.json`) + `<name>/agentcore/` (`agentcore.json` + `aws-targets.json`, self-rendered - no agentcore CLI needed at init). The workspace root holds the `agentcore/` deploy descriptor, the `.studio/wallets/` keystore, a thin `package.json` + `pnpm-workspace.yaml`, README, and `.gitignore`. (v1 is seller-only - no `--role`.)
+1. `bag init <name> --llm-provider <p> --network <n> --storage-provider <s> --wallet-kind <k> [--protocols <comma-list>] [--rails <8183|b402|both>] [--erc8183-price <base-units>] [--b402-price <usd>] --no-onboard` - scaffold the current workspace. **`<name>` must start with a letter, use ASCII letters and digits only, and be at most 23 characters.** `bag init` rejects `-`, `_`, `.`, and overlong names instead of renaming them. Pass `--wallet-kind evm-local` (default) or `--wallet-kind twak` (twak is fully supported - pass the flag to opt in), and `--storage-provider local` (default) or `ipfs`, per the Stage-1 choices; for twak, add `--twak-home <path>` ONLY if the user wants to reuse an existing wallet (otherwise omit - a project-dedicated `.studio/twak` is the safe default). Omit `--protocols` and `--rails` for the default A2A + X402 faces with both ERC-8183 and B402 rails; Altana instead defaults to A2A + ERC-8183 because paid B402 is unsupported. Pass either flag when the user chose another face/rail combination (`--protocol <one>` is only a legacy alias), add `--model <m>` only if the user overrode the provider default, and `--enable-auto-topup` / `--no-auto-topup` only if they made an explicit choice (otherwise omit - consent stays deferred). Pass `--erc8183-price 0` only when the user explicitly chose FREE; omitting the flag preserves the paid 0.1 U default. The canonical stack supports FREE; if a custom deployment is selected, set all three `ERC8183_COMMERCE_ADDRESS`, `ERC8183_ROUTER_ADDRESS`, and `ERC8183_POLICY_ADDRESS` values from that same stack. For B402, pass `--b402-price 0` only after the user explicitly accepts an unrestricted anonymous FREE `/x402` endpoint. FREE bypasses B402 verify/settle and needs no merchant credentials; a positive price keeps the `$0.01` default and requires the paid onboarding playbook. **Destination:** while the trial campaign runs, bare `bag init` (no `--destination`) defaults to `platform` - so pass `--destination self` **explicitly** whenever the user chose their own AWS, otherwise studio.toml silently records `platform` and the confirmation block you echoed no longer matches what was written. Omit `--destination` only when the user actually wants the `platform` 48h testnet trial (the campaign default) - do NOT treat that default as a mistake or re-confirm it; it is the intended behavior while the campaign is open. (Bare init also resolves to `self` once the campaign ends, or when `--network bsc-mainnet` / a non-agentcore `--runtime` is passed.) On the `platform` path `bag init` hard-forces `bsc-testnet`, pins `--runtime agentcore` + packages an artifact (a zip for the default evm-local and altana wallets, a container for twak). For evm-local a wallet key will later leave your machine, so pair it with a throwaway `bag wallet new`; for altana only the bounded session ships - do NOT create a new wallet (full flow: `docs/guides/platform-deploy.md`). Defaults `--runtime agentcore` (the only advertised runtime; the Preview `azure-foundry` runtime remains explicitly selectable but is outside this playbook; there is no `--framework` flag because the AI SDK model/tools story is part of the runtime templates). Creates `<name>/` workspace root + `<name>/app/agent/` (the single sub-project: A2A emits `src/unifiedMain.ts` (the express + A2A entrypoint, one code set for both deploy clouds) + `src/sellerCore.ts` (the protocol-neutral core; executor inherits it) + `src/executor.ts` + `src/agentCard.ts`; MCP emits `src/mcpMain.ts`; both include `src/signing.ts` + `src/tools.ts` + `src/model.ts` + their own `studio.toml` + `package.json` + `tsconfig.json`) + `<name>/agentcore/` (`agentcore.json` + `aws-targets.json`, self-rendered - no agentcore CLI needed at init). The workspace root holds the `agentcore/` deploy descriptor, the `.studio/wallets/` keystore, a thin `package.json` + `pnpm-workspace.yaml`, README, and `.gitignore`. (v1 is seller-only - no `--role`.)
 > **Altana + custom contracts:** Altana sessions remain bound to the canonical ERC-8183 targets. Use `evm-local` for a custom Commerce/Router/Policy stack; doctor and deploy readiness reject this unsupported combination when the ERC-8183 rail is active.
 
 2. `cd <name>`, then make sure the dependencies are installed. `bag init` already runs the install by default (skip only if it was scaffolded with `--no-install`); the manual equivalent from the workspace root is:

package/skills/references/bnbagent-studio-selling-via-8183.md

@@ -7,7 +7,7 @@ description: When the user is acting as an ERC-8183 seller on the single selecte
 
 # bnbagent-studio-selling-via-8183
 
-Procedure for the **single seller flow**: implement the value your Agent produces, deploy it to AgentCore (where it serves A2A by default or MCP optionally and signs in-process), and handle the job lifecycle (Agent quotes → buyer funds → buyer calls `notify_funded` → Agent delivers → buyer reads the result from the chain → buyer settles or disputes).
+Procedure for the **single seller flow**: implement the value your Agent produces, deploy it to AgentCore (where the default scaffold serves A2A + X402, while ERC-8183 remains available through A2A or an explicitly selected MCP face), and handle the job lifecycle (Agent quotes → buyer funds → buyer calls `notify_funded` → Agent delivers → buyer reads the result from the chain → buyer settles or disputes).
 
 Audience: Claude Code in a working repo with a funded wallet (tBNB + U) and an Agent that produces some valuable output (text, classification, image - whatever).
 

package/skills/references/bnbagent-studio-use-aws-agentcore.md

@@ -1,6 +1,6 @@
 ---
 name: bnbagent-studio-use-aws-agentcore
-description: When the user wants to deploy or operate a bnbagent-studio project on AWS Bedrock AgentCore - deploy with `bag deploy --provider aws` (all cloud lifecycle mutations are delegated to pinned `@bnbagent/deploy-cli@0.5.11`), inspect with `bag deploy status` / `logs --provider aws` / `verify --provider aws`, and tear down with `bag deploy destroy --provider aws --execute [--purge]`. Also covers AWS credential prerequisites, the optional read-only quota probe, and the runtime-secret channel.
+description: When the user wants to deploy or operate a bnbagent-studio project on AWS Bedrock AgentCore - deploy with `bag deploy --provider aws` (all cloud lifecycle mutations are delegated to pinned `@bnbagent/deploy-cli@0.5.12`), inspect with `bag deploy status` / `logs --provider aws` / `verify --provider aws`, and tear down with `bag deploy destroy --provider aws --execute [--purge]`. Also covers AWS credential prerequisites, the optional read-only quota probe, and the runtime-secret channel.
 ---
 
 > **Reference file** of the `bnbagent-studio` router skill - installed at `bnbagent-studio/references/` and loaded on demand (not a standalone skill). Route here via the router's decision tree.

package/skills/references/bnbagent-studio-use-azure-foundry.md

@@ -1,6 +1,6 @@
 ---
 name: bnbagent-studio-use-azure-foundry
-description: When the user wants to deploy or operate a bnbagent-studio project on Azure AI Foundry Hosted Agents - scaffold with `bag init --runtime azure-foundry`, deploy either to the managed platform with `bag deploy --provider bnb --backend azure` or directly with `bag deploy --provider azure`; all cloud lifecycle execution is delegated to pinned `@bnbagent/deploy-cli@0.5.11`. Native MCP is not supported on Azure; use AgentCore for MCP.
+description: When the user wants to deploy or operate a bnbagent-studio project on Azure AI Foundry Hosted Agents - scaffold with `bag init --runtime azure-foundry`, deploy either to the managed platform with `bag deploy --provider bnb --backend azure` or directly with `bag deploy --provider azure`; all cloud lifecycle execution is delegated to pinned `@bnbagent/deploy-cli@0.5.12`. Native MCP is not supported on Azure; use AgentCore for MCP.
 ---
 
 > **Reference file** of the `bnbagent-studio` router skill - installed at `bnbagent-studio/references/` and loaded on demand (not a standalone skill). Route here via the router's decision tree.
@@ -16,7 +16,7 @@ Procedure for deploying and operating the seller Agent on **Azure AI Foundry Hos
 ```
 <workspace>/
 ├── app/agent/             # the deployed code (src/unifiedMain.ts host + Dockerfile here)
-│   ├── studio.toml        # [azure] block: location / account_name / subdomain / project_name / agent_endpoint
+│   ├── studio.toml        # [azure] block: location / subscription_id / account_name / subdomain / project_name / agent_endpoint
 │   └── Dockerfile         # the container image bnbagent-deploy builds + pushes
 └── .studio/               # secrets + wallets (workspace root - never in the image)
 ```
@@ -31,7 +31,7 @@ Procedure for deploying and operating the seller Agent on **Azure AI Foundry Hos
 
 1. **Bun 1.3+ (`bunx`) on PATH** - the pinned `@bnbagent/deploy-cli` runs through it.
 2. **Docker running** - the image is built locally (linux/amd64) before push.
-3. **An Azure subscription** the operator may provision in (Foundry account/project, container registry, hosted agent). Before a local self-deploy, run `bunx --bun @bnbagent/deploy-cli@0.5.11 login --provider azure`; use OIDC/service-principal credentials in CI.
+3. **An Azure subscription** the operator may provision in (Foundry account/project, container registry, hosted agent). Before a local self-deploy, run `bunx --bun @bnbagent/deploy-cli@0.5.12 login --provider azure`; use OIDC/service-principal credentials in CI.
 
 ## ⚠️ Foundry gotchas (read before deploying)
 
@@ -49,7 +49,7 @@ Procedure for deploying and operating the seller Agent on **Azure AI Foundry Hos
 
 > The encrypted keystore (`.studio/wallets/`) stays at the workspace root and rides only that secret channel - never baked into the image.
 
-Provider-native overrides go in the optional `studio.toml [deploy.foundry]` table (verbatim deploy-spec keys; deploy-cli 0.5.11 consumes `account`, `cpu`, `location`, `memory`, `project`, `projectEndpoint`, `protocol`, `registry` and warns about anything else). The `[azure]` block's `account_name` / `project_name` / `project_endpoint` / `location` win over conflicting `[deploy.foundry]` keys.
+Provider-native overrides go in the optional `studio.toml [deploy.foundry]` table (verbatim deploy-spec keys; deploy-cli 0.5.12 consumes `account`, `cpu`, `location`, `memory`, `project`, `projectEndpoint`, `protocol`, `registry`, `subscriptionId` and warns about anything else). The `[azure]` block's `subscription_id` / `account_name` / `project_name` / `project_endpoint` / `location` win over conflicting `[deploy.foundry]` keys.
 
 ## Typical workflow
 
@@ -76,8 +76,9 @@ bag deploy --provider azure                  # delegated: onboard → build+push
 
 For a first deploy in non-interactive automation, pass `--yes`. Studio treats
 that as confirmation of the full deployment plan and delegates explicit
-Foundry project onboarding. Configure `[azure]` account/subscription selection
-when several candidates are accessible so no prompt or guess is required.
+Foundry project onboarding. Configure `[azure].subscription_id` and
+`account_name` when several candidates are accessible so no prompt or guess is
+required.
 
 ### C. Validate / operate
 
@@ -138,6 +139,6 @@ Azure Foundry is an alternate runtime for the whole seller agent. There is no se
 ## Reference
 
 - `bag deploy --help` / `bag deploy <command> --help` (authoritative for commands + flags)
-- `app/agent/studio.toml [azure]` - location / account_name / subdomain / project_name / agent_endpoint
+- `app/agent/studio.toml [azure]` - location / subscription_id / account_name / subdomain / project_name / agent_endpoint
 - `app/agent/studio.toml [deploy.foundry]` - provider-native deploy-spec passthrough
 - `BNBAGENT_DEPLOY_COMMAND` - override the pinned `bunx --bun @bnbagent/deploy-cli@<pin>` invocation (E2E/dev)

package/skills/references/bnbagent-studio-use-bnb-trial.md

@@ -9,7 +9,7 @@ description: Use when deploying or operating a bnbagent-studio seller on the BNB
 
 Treat this provider as a temporary testnet sandbox. Require a throwaway wallet, keep `bsc-testnet`, and explain that the runtime signing material is transmitted to the operator's managed secret store for the trial. Never use a mainnet key. Exception: `wallet.kind='altana'` ships only the bounded, budget-limited, revocable session - the throwaway-wallet advice does not apply; tighten the session instead (`bag wallet session grant --force --budget-u <small> --expiry-days <short>`) and never run `bag wallet new` on an altana project (it breaks the session's `[wallet].address` anchor).
 
-All auth and cloud lifecycle work must cross the pinned `@bnbagent/deploy-cli@0.5.11` boundary. Do not call a cloud CLI or platform REST routes directly. The managed backend is recipe-derived: `agentcore` uses AWS; `azure-foundry` uses Azure. For headless managed Azure, confirm with `bag deploy --provider bnb --backend azure --yes`; never treat `--backend` as a cross-cloud recipe converter.
+All auth and cloud lifecycle work must cross the pinned `@bnbagent/deploy-cli@0.5.12` boundary. Do not call a cloud CLI or platform REST routes directly. The managed backend is recipe-derived: `agentcore` uses AWS; `azure-foundry` uses Azure. For headless managed Azure, confirm with `bag deploy --provider bnb --backend azure --yes`; never treat `--backend` as a cross-cloud recipe converter.
 
 ## Select and authenticate