@bnbagent/studio-cli 0.0.12-alpha.5 → 0.0.12

package/dist/{chunk-OKUPRH64.js → chunk-RNWAADXU.js}

@@ -21,15 +21,8 @@ import { stringify as tomlStringify } from "smol-toml";
 import { createHash } from "crypto";
 import * as fs from "fs";
 import * as path from "path";
-import {
-  TURNKEY_SDK_SERVER_PACKAGE,
-  TURNKEY_VIEM_PACKAGE
-} from "@bnbagent/sdk/wallets";
 import { loadStudioToml } from "@bnbagent/studio-runtime/config";
-import {
-  resolveProjectAltanaSdkEntry,
-  resolveProjectTurnkeySdkEntry
-} from "@bnbagent/studio-runtime/wallet";
+import { resolveProjectAltanaSdkEntry } from "@bnbagent/studio-runtime/wallet";
 import { build as esbuildBuild } from "esbuild";
 
 // src/cli/utils/protocol.ts
@@ -148,7 +141,6 @@ async function buildZip(agentDir, outZip, opts = {}) {
     stageManifest(agentDir, buildRoot, entrypoint);
     stageStudioToml(agentDir, buildRoot);
     await stageAltanaSdk(agentDir, buildRoot, opts.bundle ?? bundleEntry);
-    await stageTurnkeySdk(agentDir, buildRoot, opts.bundle ?? bundleEntry);
     assertWithinUncompressedCap(
       buildRoot,
       opts.maxUncompressedBytes ?? MAX_UNCOMPRESSED_BYTES
@@ -285,7 +277,7 @@ async function stageAltanaSdk(agentDir, buildRoot, bundle) {
   }
   if (entry === null) {
     throw new Error(
-      "wallet.kind='altana' but @altananetwork/sdk is not resolvable from the agent project \u2014 the zip runtime could never load the Altana session wallet. Run `pnpm add @altananetwork/sdk@0.7.1` in app/agent, or deploy as a container."
+      "wallet.kind='altana' but @altananetwork/sdk is not resolvable from the agent project \u2014 the zip runtime could never load the Altana session wallet. Run `pnpm add @altananetwork/sdk@0.5.1` in app/agent, or deploy as a container."
     );
   }
   const pkgDir = path.join(buildRoot, "node_modules", "@altananetwork", "sdk");
@@ -296,7 +288,7 @@ async function stageAltanaSdk(agentDir, buildRoot, bundle) {
     `${JSON.stringify(
       {
         name: "@altananetwork/sdk",
-        version: packageVersionOf(entry, "@altananetwork/sdk"),
+        version: altanaSdkVersionOf(entry),
         private: true,
         type: "module",
         main: "index.js"
@@ -307,76 +299,14 @@ async function stageAltanaSdk(agentDir, buildRoot, bundle) {
 `
   );
 }
-async function stageTurnkeySdk(agentDir, buildRoot, bundle) {
-  let kind = "evm-local";
-  try {
-    const cfg = loadStudioToml(path.join(agentDir, "studio.toml"));
-    const wallet = cfg.wallet;
-    if (wallet !== null && typeof wallet === "object" && !Array.isArray(wallet)) {
-      kind = String(wallet.kind ?? "evm-local");
-    }
-  } catch {
-  }
-  if (kind !== "turnkey") {
-    return;
-  }
-  const packageNames = [
-    TURNKEY_SDK_SERVER_PACKAGE,
-    TURNKEY_VIEM_PACKAGE
-  ];
-  const entries = /* @__PURE__ */ new Map();
-  try {
-    for (const packageName of packageNames) {
-      const entry = resolveProjectTurnkeySdkEntry(agentDir, packageName);
-      if (entry !== null) {
-        entries.set(packageName, entry);
-      }
-    }
-  } catch (exc) {
-    throw new Error(
-      `wallet.kind='turnkey' zip build: ${exc instanceof Error ? exc.message : exc}`
-    );
-  }
-  if (entries.size !== packageNames.length) {
-    const missing = packageNames.filter((name) => !entries.has(name));
-    throw new Error(
-      `wallet.kind='turnkey' zip build: missing ${missing.join(", ")}; install both Turnkey packages in app/agent: pnpm add ${TURNKEY_SDK_SERVER_PACKAGE} ${TURNKEY_VIEM_PACKAGE}, or deploy as a container.`
-    );
-  }
-  for (const packageName of packageNames) {
-    const entry = entries.get(packageName);
-    const packageDir = path.join(
-      buildRoot,
-      "node_modules",
-      ...packageName.split("/")
-    );
-    fs.mkdirSync(packageDir, { recursive: true });
-    await bundle(entry, path.join(packageDir, "index.js"));
-    fs.writeFileSync(
-      path.join(packageDir, "package.json"),
-      `${JSON.stringify(
-        {
-          name: packageName,
-          version: packageVersionOf(entry, packageName),
-          private: true,
-          type: "module",
-          main: "index.js"
-        },
-        null,
-        2
-      )}
-`
-    );
-  }
-}
-function packageVersionOf(entry, packageName) {
+function altanaSdkVersionOf(entry) {
   let cursor = path.dirname(entry);
   for (let i = 0; i < 4; i += 1) {
     const manifest = path.join(cursor, "package.json");
     if (isFile(manifest)) {
       try {
         const pkg = JSON.parse(fs.readFileSync(manifest, "utf-8"));
-        if (pkg.name === packageName) {
+        if (pkg.name === "@altananetwork/sdk") {
           return typeof pkg.version === "string" ? pkg.version : "0.0.0";
         }
       } catch {
@@ -756,8 +686,8 @@ function packageRoot() {
   }
 }
 function studioCliVersion() {
-  if ("0.0.12-alpha.5") {
-    return "0.0.12-alpha.5";
+  if ("0.0.12") {
+    return "0.0.12";
   }
   const file = path3.join(packageRoot(), "package.json");
   const pkg = JSON.parse(fs3.readFileSync(file, "utf-8"));

package/dist/{deployCli-QKNLGGGI.js → deployCli-RWRR6XWO.js}

@@ -18,7 +18,7 @@ import {
   runPlatformAccountCommand,
   trialFromDeployCliJson,
   withDeployFiles
-} from "./chunk-OKUPRH64.js";
+} from "./chunk-RNWAADXU.js";
 import "./chunk-RO726HJG.js";
 export {
   BNB_PLATFORM_API_URL,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bnbagent/studio-cli",
-  "version": "0.0.12-alpha.5",
+  "version": "0.0.12",
   "description": "Skills-first toolkit and bag CLI for BNB Chain seller agents: ERC-8004 identity, ERC-8183 escrowed commerce, and x402 payments.",
   "keywords": [
     "bnb-chain",
@@ -25,6 +25,7 @@
     "directory": "packages/studio-cli"
   },
   "type": "module",
+  "packageManager": "pnpm@10.24.0",
   "engines": {
     "node": ">=22"
   },
@@ -41,8 +42,16 @@
   "bin": {
     "bag": "./dist/bag.js"
   },
+  "scripts": {
+    "build": "tsup",
+    "test": "vitest run",
+    "lint": "biome check src tests",
+    "typecheck": "tsc --noEmit",
+    "check": "pnpm typecheck && pnpm lint && pnpm test && pnpm build"
+  },
   "dependencies": {
-    "@bnbagent/sdk": "0.5.1-alpha.3",
+    "@bnbagent/sdk": "0.5.0",
+    "@bnbagent/studio-runtime": "0.0.12",
     "ai": "^7.0.29",
     "archiver": "^8.0.0",
     "commander": "^15.0.0",
@@ -53,8 +62,7 @@
     "smol-toml": "^1.3.0",
     "tar": "^7.4.0",
     "viem": "^2.54.0",
-    "yaml": "^2.9.0",
-    "@bnbagent/studio-runtime": "0.0.12-alpha.5"
+    "yaml": "^2.9.0"
   },
   "devDependencies": {
     "@a2a-js/sdk": "^0.3.14",
@@ -70,12 +78,5 @@
     "typescript": "^5.5.0",
     "vitest": "^2.0.0",
     "zod": "^3.25.76"
-  },
-  "scripts": {
-    "build": "tsup",
-    "test": "vitest run",
-    "lint": "biome check src tests",
-    "typecheck": "tsc --noEmit",
-    "check": "pnpm typecheck && pnpm lint && pnpm test && pnpm build"
   }
-}
+}

package/recipes/agent/recipe.toml

@@ -11,7 +11,7 @@ node = [
     # neutral. The agent project's serving deps (@a2a-js/sdk / MCP SDK / ai)
     # come from the runtimes/<R>/ recipe selected at `bag init` time.
     "@bnbagent/studio-runtime",
-    "@bnbagent/sdk@0.5.1-alpha.3",
+    "@bnbagent/sdk@0.5.0",
 ]
 
 [env]

package/recipes/runtimes/agentcore/recipe.toml

@@ -32,7 +32,7 @@ node = [
     # BNBAGENT_RUNTIME_SECRET_ID is set (default secretsmanager mode + platform).
     "@aws-sdk/client-secrets-manager@^3.600.0",
     "@bnbagent/studio-runtime",
-    "@bnbagent/sdk@0.5.1-alpha.3",
+    "@bnbagent/sdk@0.5.0",
     # The LLM work hook (generateText + tools) and the model factory.
     "ai@^7.0.29",
     # Tool input schemas (AI SDK tools + MCP registerTool).

package/recipes/runtimes/azure-foundry/recipe.toml

@@ -29,7 +29,7 @@ node = [
     # on either cloud.
     "@aws-sdk/client-secrets-manager@^3.600.0",
     "@bnbagent/studio-runtime",
-    "@bnbagent/sdk@0.5.1-alpha.3",
+    "@bnbagent/sdk@0.5.0",
     # The LLM work hook (generateText + tools) and the model factory
     # (model.ts buildModel — studio.toml [llm] + the provider key env).
     "ai@^7.0.29",

package/recipes/wallet/recipe.toml

@@ -1,22 +1,17 @@
 [recipe]
 name = "wallet"
-description = "Configures the agent's wallet: 'evm-local' (default encrypted keystore), 'twak' (Trust Wallet Agent Kit CLI), 'altana' (encrypted admin keystore plus one bounded runtime session), or 'turnkey' (remote signer; the key lives in Turnkey's AWS Nitro enclave)."
+description = "Configures the agent's wallet: 'evm-local' (default encrypted keystore), 'twak' (Trust Wallet Agent Kit CLI), or 'altana' (encrypted admin keystore plus one bounded runtime session)."
 
 [dependencies]
 node = ["@bnbagent/studio-runtime"]
 
 [dependencies.altana]
-node = ["@altananetwork/sdk@0.7.1"]
-
-[dependencies.turnkey]
-node = ["@turnkey/sdk-server@8.1.0", "@turnkey/viem@0.14.34"]
+node = ["@altananetwork/sdk@0.5.1"]
 
 [env]
 # kind='twak': the twak CLI reads the unlock password from the environment —
 # it never goes on a command line.
 TWAK_WALLET_PASSWORD = "unlocks ~/.twak/wallet.json (twak kind); set in .studio/.env.local"
-# kind='turnkey': P-256 API credential; the signing key never leaves Turnkey's enclave.
-TURNKEY_API_PRIVATE_KEY = "Turnkey P-256 API private key (turnkey kind); set in .studio/.env.local"
 # kind='evm-local' (the `bag init` default) or kind='altana' admin operations:
 WALLET_PASSWORD = "set to a strong password (>= 12 chars); encrypts .studio/wallets/<addr>.json (runtime never receives it for altana)"
 

package/recipes/x402-buyer/recipe.toml

@@ -6,7 +6,7 @@ status = "v0.0.x"
 [dependencies]
 node = [
     "@bnbagent/studio-runtime",
-    "@bnbagent/sdk@0.5.1-alpha.3",
+    "@bnbagent/sdk@0.5.0",
     "ai@^7.0.29",   # AI SDK `tool` wrappers around the buyer functions
     "zod@^3.25.0",  # tool input schemas
 ]

package/skills/bnbagent-studio.md

@@ -5,7 +5,7 @@ description: The single entry point for bnbagent-studio - a TypeScript CLI (`bag
 
 # bnbagent-studio (the single entry point)
 
-`bnbagent-studio` (CLI: `bag`) wires the `@bnbagent/sdk` protocol layer (wallet / ERC-8004 / ERC-8183 / Pieverse LLM) into a TypeScript agent project, then deploys it as a **single blockchain seller runtime**. A2A, MCP, and X402 are composable public faces selected with `--protocols`; every wallet kind scaffolds A2A + X402 with both ERC-8183 and B402 rails by default (for altana the paid B402 payout lands at the admin address). `bag deploy` uses **scheme C**: every new deploy or redeploy explicitly selects BNB, AWS, or Azure; a recorded deployment is used only to offer an explicit update action, never as a silent default. BNB is a 48h testnet trial and is disabled after expiry. AWS and Azure self-deploy into the user's own account. All cloud lifecycle mutations go through the pinned `@bnbagent/deploy-cli`; the optional AWS CLI is used only by the fail-open, read-only AgentCore quota check in `bag deploy prepare`. AgentCore and Azure Foundry share the unified A2A/X402 entrypoint; Azure rejects MCP. Treat an incompatible provider row as unavailable-do not force through it or mutate the scaffold during deploy.
+`bnbagent-studio` (CLI: `bag`) wires the `@bnbagent/sdk` protocol layer (wallet / ERC-8004 / ERC-8183 / Pieverse LLM) into a TypeScript agent project, then deploys it as a **single blockchain seller runtime**. A2A, MCP, and X402 are composable public faces selected with `--protocols`; the default evm-local/twak scaffold serves A2A + X402 with both ERC-8183 and B402 rails, while Altana defaults to A2A + ERC-8183 because paid B402 is unsupported. `bag deploy` uses **scheme C**: every new deploy or redeploy explicitly selects BNB, AWS, or Azure; a recorded deployment is used only to offer an explicit update action, never as a silent default. BNB is a 48h testnet trial and is disabled after expiry. AWS and Azure self-deploy into the user's own account. All cloud lifecycle mutations go through the pinned `@bnbagent/deploy-cli`; the optional AWS CLI is used only by the fail-open, read-only AgentCore quota check in `bag deploy prepare`. AgentCore and Azure Foundry share the unified A2A/X402 entrypoint; Azure rejects MCP. Treat an incompatible provider row as unavailable-do not force through it or mutate the scaffold during deploy.
 
 Invoked as `/bnbagent-studio <ask>`? Treat `<ask>` as the user's intent and route it through the decision tree below, exactly like a natural-language ask.
 

package/skills/references/bnbagent-studio-buying-from-bazaar.md

@@ -51,8 +51,6 @@ verified = true                                         # studio-reviewed shelf
 
 Hard-stop cases: a reviewed merchant whose live payTo drifts from the studio pin (address rotation or tampering - upgrade studio or verify out-of-band and pass `--pay-to`), and `--cap` below the live per-call price.
 
-Wallet kinds and rails: `evm-local` signs EIP-3009 locally; `twak` and `altana` route through a delegated payer that prefers the merchant's permit2 route. Altana smart-account payments are verified by the B402 facilitator on its permit2 rails (live since 2026-08, CMC field-verified) and need the one-time `bag wallet session x402-setup` arming (checker approval + bounded U→Permit2 allowance) - `bag doctor` shows the arming state as `[wallet] Altana x402 buying`.
-
 ## Step 2 - wire the buyer tools into the agent
 
 ```bash
@@ -101,8 +99,7 @@ bag dev        # then ask the agent something that needs the paid data
 | `X402RecipientRequiredError` | No pinned recipient for that host → same fix |
 | `X402RecipientMismatchError` | Live payTo drifted from the pin - do NOT override casually; re-verify the merchant |
 | `X402BudgetExhaustedError` | Per-call cap or daily budget hit - raise `per_call_cap_usd` / `[budget].max_per_day_usd` deliberately |
-| `x402 402 has no EIP-3009-payable option` | Merchant offers only permit2/other methods for $U on this network - a local-signing (`evm-local`) buyer cannot sign those. Delegated wallets pay permit2 routes through their own client: `twak` (mainnet), or `altana` sessions (ERC-1271; B402 verifies them on the permit2 rails - arm once with `bag wallet session x402-setup`) |
-| `U→Permit2 allowance … cannot cover max_usd` | Altana only: the bounded Permit2 allowance is spent/too small - re-run `bag wallet session x402-setup --allowance-u <amount>` (admin key) |
+| `x402 402 has no EIP-3009-payable option` | Merchant offers only permit2/other methods for $U on this network - not payable by this buyer today |
 | `X402PolicyError` / `PolicyViolation` | Signing allowlist - see `bnbagent-studio-extending-signing.md` |
 
 **Different from**:

package/skills/references/bnbagent-studio-extending-signing.md

@@ -61,7 +61,7 @@ The user wants the agent to pay e.g. `api.example.com` via x402.
 2. The service uses **EIP-3009 `TransferWithAuthorization`** (or `ReceiveWithAuthorization`). If it uses Permit2 or a custom primary type → goes to Section B.
 3. The token contract address on BSC is known and the user can confirm it. Don't guess from a token symbol - look up the deployed address.
 
-If any of (1)-(3) fail, **stop and tell the user**. The current release cannot integrate cross-chain services or non-EIP-3009 payment rails into the LOCAL signer. Do not work around it; the SigningPolicy will refuse the request. (Merchants that only offer permit2 are still payable without touching SigningPolicy - through a delegated wallet kind: `twak`, or `altana` sessions, whose ERC-1271 signatures B402 verifies on its permit2 rails. That is a wallet-kind choice, not a signing extension.)
+If any of (1)-(3) fail, **stop and tell the user**. The current release cannot integrate cross-chain services or non-EIP-3009 payment rails. Do not work around it; the SigningPolicy will refuse the request.
 
 **Steps when (1)-(3) all pass:**
 

package/skills/references/bnbagent-studio-operating.md

@@ -136,7 +136,7 @@ The `--all` form is the right move when `app/agent/studio.toml`'s `[network].def
 
 `bag doctor` prints ERC-8183 pricing as `PAID` or `FREE`. FREE works on the canonical contract stack. If a custom deployment is selected, set `ERC8183_COMMERCE_ADDRESS`, `ERC8183_ROUTER_ADDRESS`, and `ERC8183_POLICY_ADDRESS` together; a partial set fails because it can mix incompatible commerce, router, and policy deployments.
 
-For the inbound x402 seller rail, `bag doctor` also prints `PAID` or `FREE`. PAID requires the complete B402 merchant credential set; any supported wallet kind can be the payout wallet (for altana the payout lands at the admin address anchored as `[wallet].address`). Explicit zero is anonymous FREE passthrough: it does not read B402 credentials, call the facilitator, settle a payment, or apply the paid-mode payout-wallet allowlist. Confirm the same state with `bag x402 sell status`.
+For the inbound x402 seller rail, `bag doctor` also prints `PAID` or `FREE`. PAID requires the complete B402 merchant credential set and an `evm-local` or `twak` payout wallet. Explicit zero is anonymous FREE passthrough: it does not read B402 credentials, call the facilitator, settle a payment, or apply the paid-mode payout-wallet allowlist. Confirm the same state with `bag x402 sell status`.
 
 > The current CLI has no `bag wallet transfer`, `bag erc20 approve/allowance` group, or `bag wallet balance --address` / `--token` flag. Running them returns an invalid-command or unknown-option error. Use an external wallet to move funds or set allowances; ERC-8183 funding auto-approves U as part of the buy flow.
 

package/skills/references/bnbagent-studio-scaffolding-agent.md

@@ -138,7 +138,7 @@ Build a TodoWrite list. The shape depends on the `wallet kind`. The canonical 8-
 
 > **Onboarding note.** On a human TTY, `bag init` runs steps 3, 4 and 6 automatically (it prompts once for the wallet password, runs `bag wallet new`, zero-deposit-activates Pieverse, and prints faucet URLs). **You (Claude Code) drive `bag init` non-interactively**, so that auto-flow does NOT fire - keep steps 3/4/6 below. Pass `--no-onboard` to `bag init` to make this explicit and deterministic regardless of how the shell wires stdin.
 
-1. `bag init <name> --llm-provider <p> --network <n> --storage-provider <s> --wallet-kind <k> [--protocols <comma-list>] [--rails <8183|b402|both>] [--erc8183-price <base-units>] [--b402-price <usd>] --no-onboard` - scaffold the current workspace. **`<name>` must start with a letter, use ASCII letters and digits only, and be at most 23 characters.** `bag init` rejects `-`, `_`, `.`, and overlong names instead of renaming them. Pass `--wallet-kind evm-local` (default) or `--wallet-kind twak` (twak is fully supported - pass the flag to opt in), and `--storage-provider local` (default) or `ipfs`, per the Stage-1 choices; for twak, add `--twak-home <path>` ONLY if the user wants to reuse an existing wallet (otherwise omit - a project-dedicated `.studio/twak` is the safe default). Omit `--protocols` and `--rails` for the default A2A + X402 faces with both ERC-8183 and B402 rails (all wallet kinds, altana included — its paid B402 payout lands at the admin address). Pass either flag when the user chose another face/rail combination (`--protocol <one>` is only a legacy alias), add `--model <m>` only if the user overrode the provider default, and `--enable-auto-topup` / `--no-auto-topup` only if they made an explicit choice (otherwise omit - consent stays deferred). Pass `--erc8183-price 0` only when the user explicitly chose FREE; omitting the flag preserves the paid 0.1 U default. The canonical stack supports FREE; if a custom deployment is selected, set all three `ERC8183_COMMERCE_ADDRESS`, `ERC8183_ROUTER_ADDRESS`, and `ERC8183_POLICY_ADDRESS` values from that same stack. For B402, pass `--b402-price 0` only after the user explicitly accepts an unrestricted anonymous FREE `/x402` endpoint. FREE bypasses B402 verify/settle and needs no merchant credentials; a positive price keeps the `$0.01` default and requires the paid onboarding playbook. **Destination:** while the trial campaign runs, bare `bag init` (no `--destination`) defaults to `platform` - so pass `--destination self` **explicitly** whenever the user chose their own AWS, otherwise studio.toml silently records `platform` and the confirmation block you echoed no longer matches what was written. Omit `--destination` only when the user actually wants the `platform` 48h testnet trial (the campaign default) - do NOT treat that default as a mistake or re-confirm it; it is the intended behavior while the campaign is open. (Bare init also resolves to `self` once the campaign ends, or when `--network bsc-mainnet` / a non-agentcore `--runtime` is passed.) On the `platform` path `bag init` hard-forces `bsc-testnet`, pins `--runtime agentcore` + packages an artifact (a zip for the default evm-local and altana wallets, a container for twak). For evm-local a wallet key will later leave your machine, so pair it with a throwaway `bag wallet new`; for altana only the bounded session ships - do NOT create a new wallet (full flow: `docs/guides/platform-deploy.md`). Defaults `--runtime agentcore` (the only advertised runtime; the Preview `azure-foundry` runtime remains explicitly selectable but is outside this playbook; there is no `--framework` flag because the AI SDK model/tools story is part of the runtime templates). Creates `<name>/` workspace root + `<name>/app/agent/` (the single sub-project: A2A emits `src/unifiedMain.ts` (the express + A2A entrypoint, one code set for both deploy clouds) + `src/sellerCore.ts` (the protocol-neutral core; executor inherits it) + `src/executor.ts` + `src/agentCard.ts`; MCP emits `src/mcpMain.ts`; both include `src/signing.ts` + `src/tools.ts` + `src/model.ts` + their own `studio.toml` + `package.json` + `tsconfig.json`) + `<name>/agentcore/` (`agentcore.json` + `aws-targets.json`, self-rendered - no agentcore CLI needed at init). The workspace root holds the `agentcore/` deploy descriptor, the `.studio/wallets/` keystore, a thin `package.json` + `pnpm-workspace.yaml`, README, and `.gitignore`. (v1 is seller-only - no `--role`.)
+1. `bag init <name> --llm-provider <p> --network <n> --storage-provider <s> --wallet-kind <k> [--protocols <comma-list>] [--rails <8183|b402|both>] [--erc8183-price <base-units>] [--b402-price <usd>] --no-onboard` - scaffold the current workspace. **`<name>` must start with a letter, use ASCII letters and digits only, and be at most 23 characters.** `bag init` rejects `-`, `_`, `.`, and overlong names instead of renaming them. Pass `--wallet-kind evm-local` (default) or `--wallet-kind twak` (twak is fully supported - pass the flag to opt in), and `--storage-provider local` (default) or `ipfs`, per the Stage-1 choices; for twak, add `--twak-home <path>` ONLY if the user wants to reuse an existing wallet (otherwise omit - a project-dedicated `.studio/twak` is the safe default). Omit `--protocols` and `--rails` for the default A2A + X402 faces with both ERC-8183 and B402 rails; Altana instead defaults to A2A + ERC-8183 because paid B402 is unsupported. Pass either flag when the user chose another face/rail combination (`--protocol <one>` is only a legacy alias), add `--model <m>` only if the user overrode the provider default, and `--enable-auto-topup` / `--no-auto-topup` only if they made an explicit choice (otherwise omit - consent stays deferred). Pass `--erc8183-price 0` only when the user explicitly chose FREE; omitting the flag preserves the paid 0.1 U default. The canonical stack supports FREE; if a custom deployment is selected, set all three `ERC8183_COMMERCE_ADDRESS`, `ERC8183_ROUTER_ADDRESS`, and `ERC8183_POLICY_ADDRESS` values from that same stack. For B402, pass `--b402-price 0` only after the user explicitly accepts an unrestricted anonymous FREE `/x402` endpoint. FREE bypasses B402 verify/settle and needs no merchant credentials; a positive price keeps the `$0.01` default and requires the paid onboarding playbook. **Destination:** while the trial campaign runs, bare `bag init` (no `--destination`) defaults to `platform` - so pass `--destination self` **explicitly** whenever the user chose their own AWS, otherwise studio.toml silently records `platform` and the confirmation block you echoed no longer matches what was written. Omit `--destination` only when the user actually wants the `platform` 48h testnet trial (the campaign default) - do NOT treat that default as a mistake or re-confirm it; it is the intended behavior while the campaign is open. (Bare init also resolves to `self` once the campaign ends, or when `--network bsc-mainnet` / a non-agentcore `--runtime` is passed.) On the `platform` path `bag init` hard-forces `bsc-testnet`, pins `--runtime agentcore` + packages an artifact (a zip for the default evm-local and altana wallets, a container for twak). For evm-local a wallet key will later leave your machine, so pair it with a throwaway `bag wallet new`; for altana only the bounded session ships - do NOT create a new wallet (full flow: `docs/guides/platform-deploy.md`). Defaults `--runtime agentcore` (the only advertised runtime; the Preview `azure-foundry` runtime remains explicitly selectable but is outside this playbook; there is no `--framework` flag because the AI SDK model/tools story is part of the runtime templates). Creates `<name>/` workspace root + `<name>/app/agent/` (the single sub-project: A2A emits `src/unifiedMain.ts` (the express + A2A entrypoint, one code set for both deploy clouds) + `src/sellerCore.ts` (the protocol-neutral core; executor inherits it) + `src/executor.ts` + `src/agentCard.ts`; MCP emits `src/mcpMain.ts`; both include `src/signing.ts` + `src/tools.ts` + `src/model.ts` + their own `studio.toml` + `package.json` + `tsconfig.json`) + `<name>/agentcore/` (`agentcore.json` + `aws-targets.json`, self-rendered - no agentcore CLI needed at init). The workspace root holds the `agentcore/` deploy descriptor, the `.studio/wallets/` keystore, a thin `package.json` + `pnpm-workspace.yaml`, README, and `.gitignore`. (v1 is seller-only - no `--role`.)
 > **Altana + custom contracts:** Altana sessions remain bound to the canonical ERC-8183 targets. Use `evm-local` for a custom Commerce/Router/Policy stack; doctor and deploy readiness reject this unsupported combination when the ERC-8183 rail is active.
 
 2. `cd <name>`, then make sure the dependencies are installed. `bag init` already runs the install by default (skip only if it was scaffolded with `--no-install`); the manual equivalent from the workspace root is:

package/skills/references/bnbagent-studio-selling-via-b402.md

@@ -144,7 +144,7 @@ When the credentials, IP allowlist, and facilitator environment are ready, run t
 bag x402 sell status
 ```
 
-For a sandbox/trial agent, it must find an exact U kind on `eip155:97` (the probe lists the offered rails, e.g. `(eip3009, permit2-exact)`). For production it must find the mainnet environment expected by the project. A network mismatch is not safe to ignore.
+For a sandbox/trial agent, it must find exact/eip3009 U on `eip155:97`. For production it must find the mainnet environment expected by the project. A network mismatch is not safe to ignore.
 
 Run the deployment gate, then redeploy to activate the selected mode:
 
@@ -164,6 +164,5 @@ On the managed platform the deploy summary must say `x402 rail is ACTIVE` (or `A
 - Binance `/settle` is asynchronous. A parseable `success: false` response with a transaction is pending and requires an idempotent poll with the same settlement payload. Studio v0.0.6 and the latest `@bnb-chain/b402@0.1.0` do not yet perform that poll; they classify pending as unknown. Do not claim current mainnet readiness until this is updated.
 - Settlement happens before work. A later work failure retains the payment and does not trigger an automatic refund.
 - The rail activates on AgentCore and Azure Foundry targets (managed platform or self-hosted); self-hosted targets have no anonymous URL and need an operator-run envelope-v1 front.
-- Every supported `wallet.kind` can be the PAID B402 payout wallet: `evm-local`, `twak`, `turnkey`, and `altana`. The payout lands at the configured `pay_to` or, by default, `[wallet].address`; for altana that address is the admin EOA (EIP-7702 — the smart account address equals the admin address), so the locally-held admin keystore can always move the revenue. Register the B402 merchant credentials for that exact address. FREE x402 bypasses B402 and has no payout.
-- Buyer compatibility: the 402 challenge advertises both `exact` rails - `eip3009` (EOA buyers, no pre-authorization) and `permit2-exact` (B402 verifies ERC-1271 smart-account signatures on this rail, so Altana sessions and ERC-4337 wallets can pay; the buyer needs a bounded U→Permit2 allowance first - see `bnbagent-studio-using-altana-wallet.md`). Rails are filtered against the facilitator's live `/supported`; `bag x402 sell status` prints which rails it actually offers, e.g. `(eip3009, permit2-exact)`. The seller never verifies signatures locally on either rail.
+- PAID B402 payout wallets must use `wallet.kind` `evm-local` (private-key wallet stored as an encrypted keystore) or `twak`. Altana is unsupported. FREE x402 bypasses B402, has no payout, and must not be described as Altana B402 support.
 - Never describe FREE as a zero-value B402 settlement. It bypasses B402.

package/skills/references/bnbagent-studio-using-altana-wallet.md

@@ -48,8 +48,6 @@ x402 buying remains separate and exact-bounded:
 bag wallet session x402-setup --allowance-u <U> --yes
 ```
 
-Once armed, `bag x402 buy` pays b402-facilitated merchants (e.g. CoinMarketCap) end to end: B402 verifies the session's ERC-1271 signature on its **permit2 rails** (live since 2026-08). Studio's own b402 sellers advertise `permit2-exact` alongside `eip3009`, so Altana wallets can pay studio-hosted merchants too; eip3009-only merchants still need a 65-byte EOA signature and cannot be paid by a smart account. The buy preflight checks the U→Permit2 allowance against the spend cap, and `bag doctor` reports `[wallet] Altana x402 buying`. Use `@altananetwork/sdk` 0.7.1 in the project.
-
-Altana can also be the b402 **seller** payout wallet for a positive price: the payout lands at `[wallet].address`, which for an EIP-7702 altana account is the admin EOA, so the locally-held admin keystore can always move the revenue. Issue the B402 merchant credentials for that exact address. Explicit `price_usd = "0"` stays FREE passthrough (no payout, bypasses B402). The outbound buying authority above remains a separate feature.
+Altana cannot be the b402 **seller** payout wallet for a positive price (paid mode allows `evm-local` and `twak` only); init, `bag x402 sell init`, and deploy readiness reject that paid combination. Explicit `price_usd = "0"` is allowed because FREE passthrough performs no payout and bypasses B402. The outbound buying authority above remains a separate feature.
 
 For troubleshooting, run `bag doctor` and `bag wallet session status`. Do not print, parse, or copy the `signer` portion of the serialized session, and never move `.studio/wallets/` under `app/agent/`.

package/LICENSE

@@ -1,201 +0,0 @@
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of tracking or otherwise improving the Work,
-      but excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for describing the origin of the Work and
-      reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Support. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or support.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of "Purpose" be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 2026 BNB Chain Studio
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-   implied. See the License for the specific language governing
-   permissions and limitations under the License.