@bnbagent/studio-cli 0.0.11 → 0.0.12-alpha.1

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of tracking or otherwise improving the Work,
+      but excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for describing the origin of the Work and
+      reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Support. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or support.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of "Purpose" be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 BNB Chain Studio
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied. See the License for the specific language governing
+   permissions and limitations under the License.

package/dist/bag.js

@@ -52,7 +52,7 @@ import {
   x402SellerIsFree,
   x402SellerPricingState,
   x402SellerUsesB402
-} from "./chunk-VGSWNATS.js";
+} from "./chunk-AT2UYK5U.js";
 import {
   TWAK_CLI_MIN_VERSION,
   TWAK_CLI_VERSION,
@@ -230,7 +230,7 @@ import {
 var CAMPAIGN_DOC_URL = "https://www.bnbchain.org/en/blog/bnb-agent-studio-is-live-on-bnb-chain-ai-agents-from-one-prompt";
 var CAMPAIGN_CHECK_TIMEOUT_MS = 6e3;
 async function fetchCampaignActive() {
-  const { bnbPlatformApiUrl: bnbPlatformApiUrl2 } = await import("./deployCli-4ATY3SUP.js");
+  const { bnbPlatformApiUrl: bnbPlatformApiUrl2 } = await import("./deployCli-LBDK2B4U.js");
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), CAMPAIGN_CHECK_TIMEOUT_MS);
   try {
@@ -2937,7 +2937,7 @@ function canBuildWallet(root, data) {
   const cfg = data ?? loadAgentToml(root);
   const walletCfg = tableOf2(cfg, "wallet");
   const kind = walletCfg.kind;
-  if (kind === "twak" || kind === "altana") {
+  if (kind === "twak" || kind === "altana" || kind === "turnkey") {
     return false;
   }
   if (!process.env.WALLET_PASSWORD) {
@@ -2955,7 +2955,7 @@ function canBuildWallet(root, data) {
 function walletAddressForChecks(root, data) {
   const cfg = data ?? loadAgentToml(root);
   const walletCfg = tableOf2(cfg, "wallet");
-  if (walletCfg.kind === "twak" || walletCfg.kind === "altana") {
+  if (walletCfg.kind === "twak" || walletCfg.kind === "altana" || walletCfg.kind === "turnkey") {
     const addr = String(walletCfg.address ?? "").trim();
     return addr || null;
   }
@@ -6587,6 +6587,7 @@ import {
 } from "@bnbagent/studio-runtime/config";
 import { tbnbFaucetHint as tbnbFaucetHint2 } from "@bnbagent/studio-runtime/networks";
 import { buildPolicy, buildWallet } from "@bnbagent/studio-runtime/wallet";
+import { getAddress as toChecksumAddress } from "viem";
 
 // src/cli/walletSession.ts
 import * as fs21 from "fs";
@@ -7318,6 +7319,9 @@ async function cmdNew(opts) {
   if (kind === "twak") {
     return cmdNewTwak(projectRoot, walletCfg);
   }
+  if (kind === "turnkey") {
+    return cmdNewTurnkey(projectRoot);
+  }
   const privateKey = await resolvePrivateKeyArg(opts.privateKey);
   const password = requireDurablePassword(projectRoot);
   const keystoreDir = resolveKeystoreDir2(
@@ -7381,6 +7385,27 @@ Install it (Node >=22):  npm install -g @trustwallet/cli@${TWAK_CLI_VERSION}`
   printNextAfterNew(projectRoot, address);
   return 0;
 }
+function cmdNewTurnkey(projectRoot) {
+  const signWith = String(process.env.TURNKEY_SIGN_WITH ?? "").trim();
+  if (signWith === "") {
+    printErr(
+      "error: TURNKEY_SIGN_WITH is not set (wallet.kind = 'turnkey').\nCreate a wallet account in the Turnkey dashboard, set the TURNKEY_* credentials in .studio/.env.local (bag auto-loads it), then re-run `bag wallet new` to adopt + anchor the address."
+    );
+    return 1;
+  }
+  let address;
+  try {
+    address = toChecksumAddress(signWith);
+  } catch {
+    printErr(
+      `error: TURNKEY_SIGN_WITH must be the wallet account's Ethereum address (0x + 40 hex chars), not a Turnkey wallet id \u2014 copy it from the dashboard wallet-account view. Got: '${signWith}'`
+    );
+    return 1;
+  }
+  printOut(address);
+  persistAddress(projectRoot, address);
+  return 0;
+}
 function ensureTwakCredentials(walletFile, homeDir) {
   const twakDir = path21.dirname(walletFile);
   const target = path21.join(twakDir, "credentials.json");
@@ -7558,6 +7583,33 @@ function cmdShow5(projectRootArg2) {
     );
     return 0;
   }
+  if (kind === "turnkey") {
+    const anchored = String(walletCfg.address ?? "").trim();
+    const signWith = String(process.env.TURNKEY_SIGN_WITH ?? "").trim();
+    const address2 = anchored || signWith;
+    if (!address2) {
+      throw new Error(
+        "cannot resolve the Turnkey wallet address: no [wallet].address is anchored in studio.toml and TURNKEY_SIGN_WITH is not set \u2014 fill .studio/.env.local, then run `bag wallet new`."
+      );
+    }
+    const requiredEnv = [
+      "TURNKEY_API_PUBLIC_KEY",
+      "TURNKEY_API_PRIVATE_KEY",
+      "TURNKEY_ORG_ID",
+      "TURNKEY_SIGN_WITH"
+    ];
+    const present = requiredEnv.filter((key) => process.env[key]).length;
+    const baseUrl = process.env.TURNKEY_API_BASE_URL || "https://api.turnkey.com";
+    printOut(`address:       ${address2}`);
+    printOut("source:        turnkey");
+    printOut(
+      `key_location:  remote:turnkey (${baseUrl}; key held in AWS Nitro enclave, never leaves)`
+    );
+    printOut(
+      `credentials:   ${present}/${requiredEnv.length} TURNKEY_* env vars set`
+    );
+    return 0;
+  }
   const password = requirePassword2();
   const keystoreDir = resolveKeystoreDir2(projectRoot, null, walletCfg);
   const provider = new EVMWalletProvider({
@@ -7650,7 +7702,14 @@ async function cmdSign(msg, projectRootArg2) {
     );
   }
   let provider;
-  if (kind === "twak") {
+  if (kind === "turnkey") {
+    printErr(
+      "note: Turnkey signatures are billed (free tier 25/month at 1 req/s; pay-as-you-go $0.10 each)."
+    );
+    provider = buildWallet(walletCfg, projectRoot, {
+      network: projectNetwork(projectRoot)
+    });
+  } else if (kind === "twak") {
     provider = twakProvider(projectRoot, walletCfg);
   } else {
     const password = requirePassword2();
@@ -7675,10 +7734,10 @@ async function cmdBalance(opts) {
   const walletCfg = data.wallet !== null && typeof data.wallet === "object" ? data.wallet : {};
   let address;
   const kind = walletKind(walletCfg);
-  if (kind === "twak" || kind === "altana") {
+  if (kind === "twak" || kind === "altana" || kind === "turnkey") {
     address = String(walletCfg.address ?? "").trim();
     if (!address) {
-      const nextStep = kind === "twak" ? "(adopts the twak wallet's address) first." : "to create the Altana admin keystore first.";
+      const nextStep = kind === "twak" ? "(adopts the twak wallet's address) first." : kind === "turnkey" ? "(set TURNKEY_SIGN_WITH in .studio/.env.local first \u2014 `bag wallet new` adopts it)." : "to create the Altana admin keystore first.";
       throw new Error(
         `no [wallet].address anchored in studio.toml \u2014 run bag wallet new ${nextStep}`
       );
@@ -8068,8 +8127,8 @@ function registerInit(program) {
   ).addOption(
     new Option2(
       "--wallet-kind <kind>",
-      "Wallet backend for the Agent (default: evm-local = encrypted local keystore at the workspace root .studio/wallets/; CodeZip deploy). altana \u2014 encrypted local admin keystore plus a bounded runtime session; deploys ship ONLY the session (ALTANA_SESSION secret). twak \u2014 FULLY SUPPORTED, opt in: Trust Wallet Agent Kit CLI, self-custody encrypted mnemonic in a PROJECT-DEDICATED home (.studio/twak); deploys as a container image."
-    ).choices(["twak", "evm-local", "altana"])
+      "Wallet backend for the Agent (default: evm-local = encrypted local keystore at the workspace root .studio/wallets/; CodeZip deploy). altana \u2014 encrypted local admin keystore plus a bounded runtime session; deploys ship ONLY the session (ALTANA_SESSION secret). twak \u2014 FULLY SUPPORTED, opt in: Trust Wallet Agent Kit CLI, self-custody encrypted mnemonic in a PROJECT-DEDICATED home (.studio/twak); deploys as a container image. turnkey \u2014 remote signer: the key lives in Turnkey's AWS Nitro enclave and the Agent signs via TURNKEY_* API credentials; CodeZip deploy; every successful signature is billed."
+    ).choices(["twak", "evm-local", "altana", "turnkey"])
   ).option(
     "--twak-home <path>",
     "twak only: point this project at an EXISTING twak wallet home (the HOME-STYLE PARENT dir that contains .twak/wallet.json \u2014 NOT the .twak dir itself; a .twak path holding a wallet is auto-corrected to its parent) instead of the dedicated .studio/twak. Written to [wallet].twak_home."
@@ -8382,9 +8441,9 @@ async function cmdInitFlow(nameArg, opts) {
   }
   const budgetFlag = opts.enableAutoTopup ? "enable" : opts.autoTopup === false ? "disable" : null;
   const budgetChoice = walletKind2 === "altana" && llmProvider !== "pieverse-llm" && budgetFlag === null ? null : await resolveBudgetChoice(budgetFlag);
-  if ((rails === "b402" || rails === "both") && x402SellerPricingState({ price_usd: b402Price }).kind === "paid" && !["evm-local", "twak"].includes(walletKind2)) {
+  if ((rails === "b402" || rails === "both") && x402SellerPricingState({ price_usd: b402Price }).kind === "paid" && !["evm-local", "twak", "turnkey"].includes(walletKind2)) {
     printErr(
-      `error: the b402 seller rail supports wallet.kind evm-local or twak only; '${walletKind2}' cannot act as the b402 payout wallet. Re-run with --rails 8183 or a supported --wallet-kind.`
+      `error: the b402 seller rail supports wallet.kind evm-local, twak or turnkey only; '${walletKind2}' cannot act as the b402 payout wallet. Re-run with --rails 8183 or a supported --wallet-kind.`
     );
     fs23.rmSync(target, { recursive: true, force: true });
     return 2;
@@ -8481,6 +8540,8 @@ async function cmdInitFlow(nameArg, opts) {
     }
   } else if (walletKind2 === "altana") {
     printAltanaNotice();
+  } else if (walletKind2 === "turnkey") {
+    printTurnkeyNotice();
   } else {
     printEvmLocalNotice(
       derivePackaging(walletKind2, destination, platformArtifact2, runtime)
@@ -8717,6 +8778,9 @@ function computeAgentNodeDeps(runtime, provider, protocols = "A2A", walletKind2
   if (walletKind2 === "altana") {
     raw.push(...readRecipeNodeDeps("wallet", "altana"));
   }
+  if (walletKind2 === "turnkey") {
+    raw.push(...readRecipeNodeDeps("wallet", "turnkey"));
+  }
   const out = {};
   const core = splitDep(coreRequirement());
   for (const dep of raw) {
@@ -8890,6 +8954,18 @@ kind = "altana"
 keystore_dir = "../../.studio/wallets"
 session_file = "../../.studio/wallets/altana-session.json"
 # address = "0x..."   # filled by \`bag wallet new\`; session must match it`;
+  }
+  if (walletKind2 === "turnkey") {
+    return `[wallet]
+# Turnkey remote signer. The key is generated and held in Turnkey's AWS Nitro
+# enclave \u2014 no key material ever exists in this project or its deploys. The
+# Agent signs via the Turnkey API using the TURNKEY_* credentials in
+# .studio/.env.local. Billing: every successful signature is billed (free
+# tier: 25 signatures/month at 1 request/second; pay-as-you-go $0.10 each).
+# PRODUCTION: use a NON-ROOT API user restricted by an explicit ALLOW
+# policy \u2014 a root user's API key bypasses ALL Turnkey server-side policies.
+kind = "turnkey"
+# address = "0x..."   # filled by \`bag wallet new\` (adopts TURNKEY_SIGN_WITH)`;
   }
   return `[wallet]
 # Local keystore signer. The Agent is the SOLE key-holder/signer.
@@ -9088,6 +9164,23 @@ function renderAgentEnvLocal(provider, storageProvider, walletKind2, rails, b402
       "# TWAK_ACCESS_ID=",
       "# TWAK_HMAC_SECRET="
     );
+  } else if (walletKind2 === "turnkey") {
+    lines.push(
+      "",
+      "# Turnkey API credentials (dashboard \u2192 API keys). The P-256 API key",
+      "# pair authenticates this Agent to the enclave; the wallet's signing",
+      "# key never leaves Turnkey. Use a NON-ROOT API user + explicit ALLOW",
+      "# policy in production (root keys bypass all Turnkey policies).",
+      "TURNKEY_API_PUBLIC_KEY=",
+      "TURNKEY_API_PRIVATE_KEY=",
+      "# Organization id (dashboard \u2192 settings):",
+      "TURNKEY_ORG_ID=",
+      "# Account to sign with \u2014 MUST be the 0x Ethereum ADDRESS itself, not",
+      "# a Turnkey wallet id. `bag wallet new` anchors it into studio.toml.",
+      "TURNKEY_SIGN_WITH=",
+      "# Optional API host override (default https://api.turnkey.com):",
+      "# TURNKEY_API_BASE_URL="
+    );
   } else if (walletKind2 === "evm-local" || walletKind2 === "altana") {
     lines.push(
       "",
@@ -9202,7 +9295,7 @@ entrypoint code in \`src/signing.ts\` \u2014 never an LLM-callable tool.
 ${mode === "both" ? filesBoth : mode === "mcp" ? filesMcp : filesA2a}
 ${shared}
 - \`.env.local\` \u2014 Agent secrets; on deploy they are sent to the **operator's**
-  Secrets Manager (the scoped, consented commitment-#2 exception). ${walletKind2 === "altana" ? "Only the\n  bounded session ships (as `ALTANA_SESSION`); tighten it with\n  `bag wallet session grant --force` \u2014 do not create a new wallet." : "Use a\n  THROWAWAY testnet wallet \u2014 `(cd app/agent && bag wallet new)`."}
+  Secrets Manager (the scoped, consented commitment-#2 exception). ${walletKind2 === "altana" ? "Only the\n  bounded session ships (as `ALTANA_SESSION`); tighten it with\n  `bag wallet session grant --force` \u2014 do not create a new wallet." : walletKind2 === "turnkey" ? "No key\n  material exists locally \u2014 only the TURNKEY_* API credentials ship; the\n  signing key stays in Turnkey's enclave. Fund the TURNKEY_SIGN_WITH\n  address with a little tBNB; every successful signature is billed." : "Use a\n  THROWAWAY testnet wallet \u2014 `(cd app/agent && bag wallet new)`."}
 
 ## Run locally
 
@@ -9311,12 +9404,12 @@ function ensureCursorGitignore(gitignore) {
 ${addition}`);
 }
 async function resolveWalletKind(flagValue, isTty) {
-  if (flagValue === "evm-local" || flagValue === "twak" || flagValue === "altana") {
+  if (flagValue === "evm-local" || flagValue === "twak" || flagValue === "altana" || flagValue === "turnkey") {
     return flagValue;
   }
   if (!isTty) {
     printErr(
-      "info: wallet backend defaulting to 'evm-local' (non-interactive). To choose explicitly, re-run with --wallet-kind evm-local or --wallet-kind twak or --wallet-kind altana."
+      "info: wallet backend defaulting to 'evm-local' (non-interactive). To choose explicitly, re-run with --wallet-kind evm-local or --wallet-kind twak, --wallet-kind altana or --wallet-kind turnkey."
     );
     return "evm-local";
   }
@@ -9330,9 +9423,13 @@ async function resolveWalletKind(flagValue, isTty) {
   printOut(
     "  3. altana  \u2014 bounded session signer; incompatible with pieverse-llm and paid b402 selling"
   );
-  const answer = (await promptUser("Wallet backend [1-3, Enter = evm-local]: ")).trim().toLowerCase();
+  printOut(
+    "  4. turnkey \u2014 remote signer; key held in Turnkey's AWS Nitro enclave; billable signatures"
+  );
+  const answer = (await promptUser("Wallet backend [1-4, Enter = evm-local]: ")).trim().toLowerCase();
   if (answer === "2" || answer === "twak") return "twak";
   if (answer === "3" || answer === "altana") return "altana";
+  if (answer === "4" || answer === "turnkey") return "turnkey";
   if (answer !== "" && answer !== "1" && answer !== "evm-local") {
     printErr(`hint: unknown wallet backend '${answer}' \u2014 using evm-local.`);
   }
@@ -9614,6 +9711,12 @@ async function runOnboarding(o) {
   if (o.walletKind === "twak") {
     return runOnboardingTwak(o);
   }
+  if (o.walletKind === "turnkey") {
+    printOut(
+      "turnkey onboarding: no local key is created. Fill the TURNKEY_* credentials in .studio/.env.local (Turnkey dashboard \u2192 API keys / settings / wallet account), then run `(cd app/agent && bag wallet new)` to adopt + anchor the signing address."
+    );
+    return false;
+  }
   const password = await promptPassword();
   if (password === null) {
     return false;
@@ -9983,7 +10086,33 @@ NOTE \u2014 wallet.kind = "altana" (bounded runtime session):
    \`bag wallet session grant --force\` and redeploy.`
   );
 }
+function printTurnkeyNotice() {
+  printOut(
+    `
+NOTE \u2014 wallet.kind = "turnkey" (remote signer, keys in Turnkey's AWS Nitro enclave):
+ \xB7 WALLET: no key material exists locally \u2014 the Agent signs via the TURNKEY_*
+   API credentials in .studio/.env.local (dashboard \u2192 API keys). Set them,
+   then run \`(cd app/agent && bag wallet new)\` to adopt + anchor the address.
+ \xB7 BILLING: every successful signature is billed (free tier: 25/month at
+   1 request/second; pay-as-you-go $0.10 each) \u2014 budget accordingly.
+ \xB7 PRODUCTION: use a NON-ROOT API user restricted by an explicit ALLOW policy;
+   a root user's API key bypasses ALL Turnkey server-side policies.`
+  );
+}
 function printPlatformWalletSuggestion(walletKind2) {
+  if (walletKind2 === "turnkey") {
+    printOut(
+      `
+NOTE \u2014 destination = "platform" (48h TESTNET TRIAL on the BNB Chain managed platform):
+ \xB7 This is a sandbox, not a production seller \u2014 the runtime is auto-reclaimed at 48h.
+ \xB7 To sign, ONLY the TURNKEY_* API credentials are transmitted to the operator's
+   Secrets Manager on deploy \u2014 the signing key never leaves Turnkey's enclave.
+ \xB7 Want a smaller blast radius? Use a NON-ROOT API user whose ALLOW policy
+   covers only this Agent's operations, and revoke it from the Turnkey
+   dashboard when the trial ends.`
+    );
+    return;
+  }
   if (walletKind2 === "altana") {
     printOut(
       `
@@ -10214,6 +10343,17 @@ function printNextSteps(name, provider, o = {}) {
     printOut(
       "  (cd app/agent && bag wallet session status)   # local, secret-free summary"
     );
+  } else if (walletKind2 === "turnkey") {
+    printOut(
+      "  # 1. edit .studio/.env.local and set the TURNKEY_* credentials (Turnkey dashboard \u2192 API keys / settings / wallet account)"
+    );
+    printOut(
+      "  #    use a NON-ROOT API user + explicit ALLOW policy; TURNKEY_SIGN_WITH is the 0x ADDRESS, not a wallet id"
+    );
+    printOut(
+      "  # 2. adopt + anchor the Turnkey address (no local key is created):"
+    );
+    printOut("  (cd app/agent && bag wallet new)");
   } else {
     printOut(
       "  # 1. edit .studio/.env.local and set WALLET_PASSWORD (encrypts the keystore + signs all on-chain ops)"
@@ -10437,6 +10577,10 @@ function printConfigSummary(agentRoot2) {
         ".studio/wallets/altana-session.json"
       )}`
     );
+  } else if (walletKind2 === "turnkey") {
+    printOut(
+      "  wallet    : Turnkey remote signer (key in AWS Nitro enclave; TURNKEY_* credentials in .studio/.env.local) \u2014 the sole signer; receives your $U"
+    );
   } else {
     printOut(
       `  wallet    : local keystore (${shown(
@@ -10557,6 +10701,16 @@ function runtimeEnvKeysCore(cfg, resolvable) {
     }
   } else if (walletKind2 === "altana") {
     keys = [];
+  } else if (walletKind2 === "turnkey") {
+    keys = [
+      "TURNKEY_API_PUBLIC_KEY",
+      "TURNKEY_API_PRIVATE_KEY",
+      "TURNKEY_ORG_ID",
+      "TURNKEY_SIGN_WITH"
+    ];
+    if (resolvable("TURNKEY_API_BASE_URL")) {
+      keys.push("TURNKEY_API_BASE_URL");
+    }
   } else {
     keys = ["WALLET_PASSWORD"];
   }
@@ -11081,10 +11235,17 @@ async function cmdDev(opts) {
     );
     return 2;
   }
-  const pwEnv = walletKind2 === "twak" ? "TWAK_WALLET_PASSWORD" : "WALLET_PASSWORD";
-  if (walletKind2 !== "altana" && !process.env[pwEnv]) {
+  const requiredWalletEnv = walletKind2 === "twak" ? ["TWAK_WALLET_PASSWORD"] : walletKind2 === "altana" ? [] : walletKind2 === "turnkey" ? [
+    "TURNKEY_API_PUBLIC_KEY",
+    "TURNKEY_API_PRIVATE_KEY",
+    "TURNKEY_ORG_ID",
+    "TURNKEY_SIGN_WITH"
+  ] : ["WALLET_PASSWORD"];
+  const missingWalletEnv = requiredWalletEnv.filter((key) => !process.env[key]);
+  if (missingWalletEnv.length > 0) {
+    const plural = missingWalletEnv.length > 1 ? "vars are" : "var is";
     printErr(
-      `error: ${pwEnv} env var is required to run \`bag dev\` (the Agent is the sole signer). Set it in .studio/.env.local or your shell.`
+      `error: ${missingWalletEnv.join(", ")} env ${plural} required to run \`bag dev\` with wallet.kind='${walletKind2}' (the Agent is the sole signer). Set ${missingWalletEnv.length > 1 ? "them" : "it"} in .studio/.env.local or your shell.`
     );
     return 2;
   }
@@ -12353,7 +12514,7 @@ function collectRuntimeSecretsDetailed(root) {
       sources[KEYSTORE_JSON_ENV] = "wallet-file";
     }
   }
-  if (walletKind2 !== "altana" && !(KEYSTORE_JSON_ENV in payload) && !(TWAK_WALLET_JSON_ENV in payload)) {
+  if (walletKind2 !== "altana" && walletKind2 !== "turnkey" && !(KEYSTORE_JSON_ENV in payload) && !(TWAK_WALLET_JSON_ENV in payload)) {
     printErr(
       `WARNING: no wallet signing material found (${KEYSTORE_JSON_ENV} for evm-local / ${TWAK_WALLET_JSON_ENV} for twak). The deployed runtime won't be able to sign quotes or deliveries. Create/adopt a wallet first (e.g. \`bag wallet new\`) and redeploy.`
     );
@@ -17438,7 +17599,8 @@ var SECRET_ENV_KEYS = [
   "PIEVERSE_LLM_API_KEY",
   "STORAGE_API_KEY",
   "TWAK_ACCESS_ID",
-  "TWAK_HMAC_SECRET"
+  "TWAK_HMAC_SECRET",
+  "TURNKEY_API_PRIVATE_KEY"
 ];
 function tableOf14(cfg, key) {
   const v = cfg[key];
@@ -17685,6 +17847,9 @@ async function checkWallet(projectRoot, data) {
   if (walletCfg.kind === "altana") {
     return checkWalletAltana(walletCfg, projectRoot, data);
   }
+  if (walletCfg.kind === "turnkey") {
+    return checkWalletTurnkey(walletCfg);
+  }
   if (!isLocalEvmWallet(walletCfg)) {
     return [
       {
@@ -17738,6 +17903,58 @@ async function checkWallet(projectRoot, data) {
   }
   return out;
 }
+var TURNKEY_ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;
+var TURNKEY_REQUIRED_ENV = [
+  "TURNKEY_API_PUBLIC_KEY",
+  "TURNKEY_API_PRIVATE_KEY",
+  "TURNKEY_ORG_ID",
+  "TURNKEY_SIGN_WITH"
+];
+function checkWalletTurnkey(walletCfg) {
+  const out = [];
+  const missing = TURNKEY_REQUIRED_ENV.filter((key) => !process.env[key]);
+  out.push(
+    missing.length === 0 ? {
+      name: "[wallet] turnkey credentials",
+      status: PASS,
+      detail: "API key pair + org id + sign-with address set; reminder: production should use a non-root API user with an explicit ALLOW policy (root keys bypass all Turnkey policies)"
+    } : {
+      name: "[wallet] turnkey credentials",
+      status: FAIL,
+      detail: `missing: ${missing.join(", ")} \u2014 set them in .studio/.env.local (Turnkey dashboard \u2192 API keys / settings / wallet account)`
+    }
+  );
+  const signWith = String(process.env.TURNKEY_SIGN_WITH ?? "").trim();
+  if (signWith !== "" && !TURNKEY_ADDRESS_RE.test(signWith)) {
+    out.push({
+      name: "TURNKEY_SIGN_WITH format",
+      status: FAIL,
+      detail: "must be the wallet account's Ethereum address (0x + 40 hex chars), not a Turnkey wallet id \u2014 copy it from the dashboard wallet-account view"
+    });
+  }
+  const anchored = String(walletCfg.address ?? "").trim();
+  if (anchored === "") {
+    out.push({
+      name: "[wallet] address anchor",
+      status: WARN,
+      detail: "no [wallet].address \u2014 run `bag wallet new` to adopt TURNKEY_SIGN_WITH"
+    });
+  } else if (signWith !== "" && TURNKEY_ADDRESS_RE.test(signWith)) {
+    const matches = anchored.toLowerCase() === signWith.toLowerCase();
+    out.push(
+      matches ? {
+        name: "[wallet] address anchor",
+        status: PASS,
+        detail: `${anchored} matches TURNKEY_SIGN_WITH`
+      } : {
+        name: "[wallet] address anchor",
+        status: FAIL,
+        detail: `[wallet].address ${anchored} does not match TURNKEY_SIGN_WITH ${signWith} \u2014 stale anchor or different Turnkey credentials; fix .studio/.env.local, then re-run \`bag wallet new\``
+      }
+    );
+  }
+  return out;
+}
 function checkWalletAltana(walletCfg, projectRoot, data) {
   const out = [];
   const contracts = erc8183ContractOverrideState(
@@ -17930,6 +18147,20 @@ function checkPassword(data) {
       }
     ];
   }
+  if (walletKind2 === "turnkey") {
+    const missing = TURNKEY_REQUIRED_ENV.filter((key) => !process.env[key]);
+    return [
+      missing.length === 0 ? {
+        name: "TURNKEY_* env",
+        status: PASS,
+        detail: "all Turnkey credentials set (WALLET_PASSWORD is not used for this kind)"
+      } : {
+        name: "TURNKEY_* env",
+        status: WARN,
+        detail: `missing: ${missing.join(", ")} \u2014 signing will fail (set in .studio/.env.local)`
+      }
+    ];
+  }
   if (process.env.WALLET_PASSWORD) {
     return [{ name: "WALLET_PASSWORD env", status: PASS, detail: "set" }];
   }
@@ -18298,11 +18529,11 @@ function checkX402Seller(data, agentRoot2) {
     }
   ];
   const walletKind2 = String(tableOf14(data, "wallet").kind ?? "evm-local");
-  if (!["evm-local", "twak"].includes(walletKind2)) {
+  if (!["evm-local", "twak", "turnkey"].includes(walletKind2)) {
     out.push({
       name: "x402 payout wallet",
       status: FAIL,
-      detail: `PAID B402 supports evm-local or twak, not ${walletKind2}.`
+      detail: `PAID B402 supports evm-local, twak or turnkey, not ${walletKind2}.`
     });
   }
   const credentials = b402Credentials(agentRoot2);
@@ -18376,7 +18607,7 @@ function checkStorage(data) {
 }
 function balanceAddress(projectRoot, data) {
   const walletCfg = tableOf14(data, "wallet");
-  if (walletCfg.kind === "twak" || walletCfg.kind === "altana") {
+  if (walletCfg.kind === "twak" || walletCfg.kind === "altana" || walletCfg.kind === "turnkey") {
     const addr = String(walletCfg.address ?? "").trim();
     return addr || null;
   }

package/dist/{chunk-VGSWNATS.js → chunk-AT2UYK5U.js}

@@ -686,8 +686,8 @@ function packageRoot() {
   }
 }
 function studioCliVersion() {
-  if ("0.0.11") {
-    return "0.0.11";
+  if ("0.0.12-alpha.1") {
+    return "0.0.12-alpha.1";
   }
   const file = path3.join(packageRoot(), "package.json");
   const pkg = JSON.parse(fs3.readFileSync(file, "utf-8"));

package/dist/{deployCli-4ATY3SUP.js → deployCli-LBDK2B4U.js}

@@ -18,7 +18,7 @@ import {
   runPlatformAccountCommand,
   trialFromDeployCliJson,
   withDeployFiles
-} from "./chunk-VGSWNATS.js";
+} from "./chunk-AT2UYK5U.js";
 import "./chunk-RO726HJG.js";
 export {
   BNB_PLATFORM_API_URL,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bnbagent/studio-cli",
-  "version": "0.0.11",
+  "version": "0.0.12-alpha.1",
   "description": "Skills-first toolkit and bag CLI for BNB Chain seller agents: ERC-8004 identity, ERC-8183 escrowed commerce, and x402 payments.",
   "keywords": [
     "bnb-chain",
@@ -25,7 +25,6 @@
     "directory": "packages/studio-cli"
   },
   "type": "module",
-  "packageManager": "pnpm@10.24.0",
   "engines": {
     "node": ">=22"
   },
@@ -42,16 +41,8 @@
   "bin": {
     "bag": "./dist/bag.js"
   },
-  "scripts": {
-    "build": "tsup",
-    "test": "vitest run",
-    "lint": "biome check src tests",
-    "typecheck": "tsc --noEmit",
-    "check": "pnpm typecheck && pnpm lint && pnpm test && pnpm build"
-  },
   "dependencies": {
-    "@bnbagent/sdk": "0.5.0",
-    "@bnbagent/studio-runtime": "0.0.11",
+    "@bnbagent/sdk": "0.5.1-alpha.2",
     "ai": "^7.0.29",
     "archiver": "^8.0.0",
     "commander": "^15.0.0",
@@ -62,7 +53,8 @@
     "smol-toml": "^1.3.0",
     "tar": "^7.4.0",
     "viem": "^2.54.0",
-    "yaml": "^2.9.0"
+    "yaml": "^2.9.0",
+    "@bnbagent/studio-runtime": "0.0.12-alpha.1"
   },
   "devDependencies": {
     "@a2a-js/sdk": "^0.3.14",
@@ -78,5 +70,12 @@
     "typescript": "^5.5.0",
     "vitest": "^2.0.0",
     "zod": "^3.25.76"
+  },
+  "scripts": {
+    "build": "tsup",
+    "test": "vitest run",
+    "lint": "biome check src tests",
+    "typecheck": "tsc --noEmit",
+    "check": "pnpm typecheck && pnpm lint && pnpm test && pnpm build"
   }
-}
+}

package/recipes/agent/recipe.toml

@@ -11,7 +11,7 @@ node = [
     # neutral. The agent project's serving deps (@a2a-js/sdk / MCP SDK / ai)
     # come from the runtimes/<R>/ recipe selected at `bag init` time.
     "@bnbagent/studio-runtime",
-    "@bnbagent/sdk@0.5.0",
+    "@bnbagent/sdk@0.5.1-alpha.2",
 ]
 
 [env]

package/recipes/runtimes/agentcore/recipe.toml

@@ -32,7 +32,7 @@ node = [
     # BNBAGENT_RUNTIME_SECRET_ID is set (default secretsmanager mode + platform).
     "@aws-sdk/client-secrets-manager@^3.600.0",
     "@bnbagent/studio-runtime",
-    "@bnbagent/sdk@0.5.0",
+    "@bnbagent/sdk@0.5.1-alpha.2",
     # The LLM work hook (generateText + tools) and the model factory.
     "ai@^7.0.29",
     # Tool input schemas (AI SDK tools + MCP registerTool).

package/recipes/runtimes/azure-foundry/recipe.toml

@@ -29,7 +29,7 @@ node = [
     # on either cloud.
     "@aws-sdk/client-secrets-manager@^3.600.0",
     "@bnbagent/studio-runtime",
-    "@bnbagent/sdk@0.5.0",
+    "@bnbagent/sdk@0.5.1-alpha.2",
     # The LLM work hook (generateText + tools) and the model factory
     # (model.ts buildModel — studio.toml [llm] + the provider key env).
     "ai@^7.0.29",

package/recipes/wallet/recipe.toml

@@ -1,6 +1,6 @@
 [recipe]
 name = "wallet"
-description = "Configures the agent's wallet: 'evm-local' (default encrypted keystore), 'twak' (Trust Wallet Agent Kit CLI), or 'altana' (encrypted admin keystore plus one bounded runtime session)."
+description = "Configures the agent's wallet: 'evm-local' (default encrypted keystore), 'twak' (Trust Wallet Agent Kit CLI), 'altana' (encrypted admin keystore plus one bounded runtime session), or 'turnkey' (remote signer; the key lives in Turnkey's AWS Nitro enclave)."
 
 [dependencies]
 node = ["@bnbagent/studio-runtime"]
@@ -8,10 +8,15 @@ node = ["@bnbagent/studio-runtime"]
 [dependencies.altana]
 node = ["@altananetwork/sdk@0.5.1"]
 
+[dependencies.turnkey]
+node = ["@turnkey/sdk-server@8.1.0", "@turnkey/viem@0.14.34"]
+
 [env]
 # kind='twak': the twak CLI reads the unlock password from the environment —
 # it never goes on a command line.
 TWAK_WALLET_PASSWORD = "unlocks ~/.twak/wallet.json (twak kind); set in .studio/.env.local"
+# kind='turnkey': P-256 API credential; the signing key never leaves Turnkey's enclave.
+TURNKEY_API_PRIVATE_KEY = "Turnkey P-256 API private key (turnkey kind); set in .studio/.env.local"
 # kind='evm-local' (the `bag init` default) or kind='altana' admin operations:
 WALLET_PASSWORD = "set to a strong password (>= 12 chars); encrypts .studio/wallets/<addr>.json (runtime never receives it for altana)"
 

package/recipes/x402-buyer/recipe.toml

@@ -6,7 +6,7 @@ status = "v0.0.x"
 [dependencies]
 node = [
     "@bnbagent/studio-runtime",
-    "@bnbagent/sdk@0.5.0",
+    "@bnbagent/sdk@0.5.1-alpha.2",
     "ai@^7.0.29",   # AI SDK `tool` wrappers around the buyer functions
     "zod@^3.25.0",  # tool input schemas
 ]