@bnbagent/studio-cli 0.0.13-alpha.2 → 0.0.13-alpha.3

package/dist/bag.js

@@ -5,12 +5,13 @@ import {
   B402_RUNTIME_KEYS,
   CliExit,
   DEFAULT_B402_PRICE_USD,
-  DEFAULT_B402_TESTNET_BASE_URL,
   LEGACY_ENTRY_STEMS,
+  MPP_RUNTIME_KEYS,
   X402_CAPABLE_RUNTIMES,
   act,
   agentcoreFlavor,
   b402Credentials,
+  b402PaymentProtocol,
   bnbEnv,
   bnbPlatformApiUrl,
   checkBunx,
@@ -24,7 +25,9 @@ import {
   entryStemOf,
   getEnvVar,
   hasA2aFace,
+  hasB402PaymentFace,
   hasMcpFace,
+  hasMppFace,
   hasX402Face,
   isB402TestnetBaseUrl,
   nativeProtocolOf,
@@ -52,7 +55,7 @@ import {
   x402SellerIsFree,
   x402SellerPricingState,
   x402SellerUsesB402
-} from "./chunk-XCKI45TP.js";
+} from "./chunk-E4C75NSV.js";
 import {
   TWAK_CLI_MIN_VERSION,
   TWAK_CLI_VERSION,
@@ -230,7 +233,7 @@ import {
 var CAMPAIGN_DOC_URL = "https://www.bnbchain.org/en/blog/bnb-agent-studio-is-live-on-bnb-chain-ai-agents-from-one-prompt";
 var CAMPAIGN_CHECK_TIMEOUT_MS = 6e3;
 async function fetchCampaignActive() {
-  const { bnbPlatformApiUrl: bnbPlatformApiUrl2 } = await import("./deployCli-HZNZU3CN.js");
+  const { bnbPlatformApiUrl: bnbPlatformApiUrl2 } = await import("./deployCli-UOUCOIW5.js");
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), CAMPAIGN_CHECK_TIMEOUT_MS);
   try {
@@ -1862,11 +1865,15 @@ ${result.stderr.trim()}` : ""}`;
   }
   return vendored;
 }
-async function provisionInstall(workspaceRoot) {
+async function provisionInstall(workspaceRoot, opts = {}) {
   process.stdout.write(
     "  \xB7 installing dependencies with `pnpm install` (may take a minute)\u2026\n"
   );
-  const result = await runCapture("pnpm", ["install"], {
+  const args = [
+    "install",
+    ...opts.force ? ["--force", "--no-frozen-lockfile"] : []
+  ];
+  const result = await runCapture("pnpm", args, {
     cwd: workspaceRoot,
     timeoutMs: 6e5
   });
@@ -2856,8 +2863,11 @@ async function readUBalanceRaw(address, networkName) {
   if (uToken === void 0) {
     return null;
   }
+  return readTokenBalanceRaw(address, uToken.address, networkName);
+}
+async function readTokenBalanceRaw(address, tokenAddress, networkName) {
   const raw = await client(networkName).readContract({
-    address: getAddress(uToken.address),
+    address: getAddress(tokenAddress),
     abi: ERC20_BALANCE_ABI,
     functionName: "balanceOf",
     args: [getAddress(address)]
@@ -3086,7 +3096,7 @@ function storageLocalNotDeployableCheck(root) {
   return {
     level: Level.CRITICAL,
     name: "storage_kind_not_deployable",
-    message: "[storage].kind = 'local' is not deployable \u2014 a deployed seller needs durable public storage. Switch to 'ipfs' and set STORAGE_API_URL (+ STORAGE_API_KEY) in .studio/.env.local before deploying.",
+    message: "[storage].kind = 'local' is not deployable \u2014 a deployed seller needs durable public storage. Switch to 'ipfs', 's3', or 'azure-blob' and configure its user-owned write credentials before deploying.",
     fixCmd: "bag config set storage.kind ipfs",
     details: { storage_kind: "local" }
   };
@@ -3106,10 +3116,86 @@ function storageIpfsEndpointRequiredCheck(root, opts = {}) {
     details: { storage_kind: "ipfs", missing: ["STORAGE_API_URL"] }
   };
 }
+function publicBaseIssue(value) {
+  const text2 = String(value ?? "").trim();
+  if (!text2) return null;
+  try {
+    const url = new URL(text2);
+    if (url.protocol !== "https:") return "must use https";
+    if (url.username || url.password) return "must not contain credentials";
+    if (url.search || url.hash) return "must not contain a query or fragment";
+    return null;
+  } catch {
+    return "is not a valid URL";
+  }
+}
+function storageObjectProviderRequiredCheck(root) {
+  const cfg = loadAgentToml(root);
+  const storage = tableOf2(cfg, "storage");
+  const kind = String(storage.kind ?? "").trim().toLowerCase();
+  if (kind !== "s3" && kind !== "azure-blob") return null;
+  const credentialMode = String(storage.credential_mode ?? "env").trim().toLowerCase();
+  const missing = [];
+  const invalid = [];
+  if (credentialMode !== "env" && credentialMode !== "ambient") {
+    invalid.push("[storage].credential_mode (expected 'env' or 'ambient')");
+  }
+  const baseIssue = publicBaseIssue(storage.public_base_url);
+  if (baseIssue) invalid.push(`[storage].public_base_url ${baseIssue}`);
+  if (kind === "s3") {
+    for (const key of ["bucket", "region"]) {
+      if (!String(storage[key] ?? "").trim()) missing.push(`[storage].${key}`);
+    }
+    if (credentialMode === "env") {
+      for (const key of [
+        "DELIVERABLE_S3_ACCESS_KEY_ID",
+        "DELIVERABLE_S3_SECRET_ACCESS_KEY"
+      ]) {
+        if (!runtimeEnvResolvable(root, key)) missing.push(key);
+      }
+    }
+  } else {
+    for (const key of ["account_url", "container"]) {
+      if (!String(storage[key] ?? "").trim()) missing.push(`[storage].${key}`);
+    }
+    if (credentialMode === "env") {
+      const hasSas = runtimeEnvResolvable(root, "DELIVERABLE_AZURE_SAS_TOKEN");
+      const spKeys = [
+        "DELIVERABLE_AZURE_TENANT_ID",
+        "DELIVERABLE_AZURE_CLIENT_ID",
+        "DELIVERABLE_AZURE_CLIENT_SECRET"
+      ];
+      const presentSpKeys = spKeys.filter(
+        (key) => runtimeEnvResolvable(root, key)
+      );
+      if (!hasSas && presentSpKeys.length === 0) {
+        missing.push(
+          "DELIVERABLE_AZURE_SAS_TOKEN (or a complete service-principal set)"
+        );
+      } else if (!hasSas) {
+        missing.push(
+          ...spKeys.filter((key) => !runtimeEnvResolvable(root, key))
+        );
+      }
+    }
+  }
+  if (missing.length === 0 && invalid.length === 0) return null;
+  return {
+    level: Level.CRITICAL,
+    name: `storage_${kind.replace("-", "_")}_required`,
+    message: `[storage].kind = '${kind}' is not deploy-ready. ${[
+      missing.length > 0 ? `Missing: ${missing.join(", ")}.` : "",
+      invalid.length > 0 ? `Invalid: ${invalid.join(", ")}.` : ""
+    ].filter(Boolean).join(" ")}`,
+    fixCmd: "# update app/agent/studio.toml and .studio/.env.local",
+    details: { storage_kind: kind, missing, invalid }
+  };
+}
 function fatalStorageDeployChecks(root) {
   return [
     storageLocalNotDeployableCheck(root),
-    storageIpfsEndpointRequiredCheck(root)
+    storageIpfsEndpointRequiredCheck(root),
+    storageObjectProviderRequiredCheck(root)
   ].filter((c2) => c2 !== null);
 }
 function hasIpfsEndpointFinding(result) {
@@ -3466,17 +3552,27 @@ function discoverRecordedDeployments(root) {
     });
   }
   const azureEndpoint = text(azure.agent_endpoint);
+  const azureHttpEndpoint = text(azure.http_endpoint);
+  const azureInvocationsEndpoint = text(azure.invocations_endpoint);
+  const azureA2aEndpoint = text(azure.a2a_endpoint);
+  const azureAgentCardEndpoint = text(azure.agent_card_endpoint);
   const azureDeploymentId = text(azure.deployment_id);
   const azureFaces = protocolFaces(azure.deployed_faces);
   const azureX402 = recordedX402Snapshot(azure);
   const azureX402Carrier = recordedX402Carrier(azure);
-  if (azureEndpoint || azureDeploymentId || text(azure.last_deploy_at)) {
+  if (azureEndpoint || azureHttpEndpoint || azureInvocationsEndpoint || azureA2aEndpoint || azureDeploymentId || text(azure.last_deploy_at)) {
     found.push({
       provider: "azure",
       target: PROVIDER_TARGETS.azure,
       name: text(azure.agent_name) ?? projectName2,
       deploymentId: azureDeploymentId,
-      endpoint: azureEndpoint,
+      endpoint: azureEndpoint ?? azureA2aEndpoint ?? azureHttpEndpoint,
+      endpoints: {
+        http: azureHttpEndpoint,
+        invocations: azureInvocationsEndpoint,
+        a2a: azureA2aEndpoint,
+        agentCard: azureAgentCardEndpoint
+      },
       ...azureFaces ? { faces: azureFaces } : {},
       ...azureX402 ? { x402: azureX402 } : {},
       ...azureX402Carrier ? { x402Carrier: azureX402Carrier } : {},
@@ -3495,7 +3591,7 @@ function unavailableProvidersForProject(root) {
     const cfg = loadStudioToml6(path12.join(agentRoot2, "studio.toml"));
     runtime = text(tableOf3(cfg, "stack").runtime) ?? "agentcore";
     const faces = stackFaces(tableOf3(cfg, "stack"), tableOf3(cfg, "payments"));
-    azureProtocolUnsupported = hasMcpFace(faces) || !hasA2aFace(faces) && !hasX402Face(faces);
+    azureProtocolUnsupported = hasMcpFace(faces) || !hasA2aFace(faces) && !hasB402PaymentFace(faces);
   } catch {
     return {};
   }
@@ -4227,12 +4323,12 @@ function inspectAzureX402Carrier(agentRoot2) {
     };
   }
   const source = fs17.readFileSync(entryFile, "utf8").replace(/\/\*[\s\S]*?\*\//g, "").replace(/^\s*\/\/.*$/gm, "");
-  const hasSeller = /\bX402Seller\s*\.\s*create\s*\(/m.test(source);
+  const hasSeller = /\b(?:B402|X402)Seller\s*\.\s*create\s*\(/m.test(source);
   const hasCarrier = /\bcreateEnvelopeMiddleware\s*\(/m.test(source);
   if (!hasSeller || !hasCarrier) {
     const missing = [
       ...hasCarrier ? [] : ["createEnvelopeMiddleware"],
-      ...hasSeller ? [] : ["X402Seller.create"]
+      ...hasSeller ? [] : ["B402Seller.create"]
     ];
     return {
       status: "incompatible-scaffold",
@@ -4243,7 +4339,7 @@ function inspectAzureX402Carrier(agentRoot2) {
   return {
     status: "http-envelope-v1",
     entrypoint,
-    detail: `${entrypoint} mounts the X402 seller and envelope carrier`
+    detail: `${entrypoint} mounts the B402 seller and envelope carrier`
   };
 }
 function tableOf4(cfg, key) {
@@ -4268,6 +4364,26 @@ function loadStudioCfg(workspaceRoot) {
     return {};
   }
 }
+function foundryA2aSiblingEndpoints(value) {
+  if (!value) return null;
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return null;
+  }
+  const suffix = "/endpoint/protocols/a2a";
+  const path49 = url.pathname.replace(/\/+$/, "");
+  if (!path49.endsWith(suffix)) return null;
+  const root = `${url.origin}${path49.slice(0, -suffix.length)}`;
+  const a2a = `${root}${suffix}`;
+  return {
+    http: `${root}/endpoint/protocols/openai/responses?api-version=v1`,
+    invocations: `${root}/endpoint/protocols/invocations?api-version=v1`,
+    a2a,
+    agentCard: `${a2a}/agentCard/v1.0`
+  };
+}
 function recordAzureDeployment(root, data, endpoint) {
   const agentRoot2 = findSubProjectRoot7("agent", deployWorkspaceRoot(root));
   if (agentRoot2 === null) return;
@@ -4278,7 +4394,7 @@ function recordAzureDeployment(root, data, endpoint) {
   try {
     const cfg = loadStudioCfg(deployWorkspaceRoot(root));
     deployedFaces = stackFaces(tableOf4(cfg, "stack"), tableOf4(cfg, "payments"));
-    if (hasX402Face(deployedFaces)) {
+    if (hasB402PaymentFace(deployedFaces)) {
       deployedX402 = x402DeploymentSnapshot(agentRoot2, "self");
       deployedX402Carrier = inspectAzureX402Carrier(agentRoot2).status;
     }
@@ -4290,9 +4406,87 @@ function recordAzureDeployment(root, data, endpoint) {
       patchTomlKv(tomlPath, "azure", "agent_name", name);
       patchTomlKv(tomlPath, "azure", "deployment_id", name);
     }
-    if (endpoint) {
-      patchTomlKv(tomlPath, "azure", "agent_endpoint", endpoint);
-      patchTomlKv(tomlPath, "identity", "endpoint", endpoint);
+    const endpoints = tableOf4(data, "endpoints");
+    const recordEndpoints = tableOf4(tableOf4(data, "record"), "endpoints");
+    const reportedHttpEndpoint = deployEndpointValue(
+      endpoints.http,
+      recordEndpoints.http,
+      tableOf4(data, "record").invokeUrl,
+      data.invokeUrl
+    );
+    const reportedInvocationsEndpoint = deployEndpointValue(
+      endpoints.invocations,
+      recordEndpoints.invocations
+    );
+    const reportedA2aEndpoint = deployEndpointValue(
+      endpoints.a2a,
+      recordEndpoints.a2a
+    );
+    const reportedAgentCardEndpoint = deployEndpointValue(
+      endpoints.agentCard,
+      recordEndpoints.agentCard
+    );
+    const siblings = foundryA2aSiblingEndpoints(
+      reportedA2aEndpoint ?? endpoint
+    );
+    const httpEndpoint = reportedHttpEndpoint ?? siblings?.http ?? null;
+    const config = loadStudioToml7(tomlPath);
+    const faces = stackFaces(
+      tableOf4(config, "stack"),
+      tableOf4(config, "payments")
+    );
+    const invocationsEndpoint = reportedInvocationsEndpoint ?? (hasB402PaymentFace(faces) ? siblings?.invocations ?? null : null);
+    const a2aEndpoint = reportedA2aEndpoint ?? siblings?.a2a ?? null;
+    const agentCardEndpoint = reportedAgentCardEndpoint ?? siblings?.agentCard ?? null;
+    const primaryEndpoint = a2aEndpoint ?? endpoint ?? httpEndpoint;
+    if (primaryEndpoint) {
+      patchTomlKv(tomlPath, "azure", "agent_endpoint", primaryEndpoint);
+      patchTomlKv(
+        tomlPath,
+        "identity",
+        "endpoint",
+        agentCardEndpoint ?? primaryEndpoint
+      );
+    }
+    if (httpEndpoint)
+      patchTomlKv(tomlPath, "azure", "http_endpoint", httpEndpoint);
+    if (invocationsEndpoint)
+      patchTomlKv(
+        tomlPath,
+        "azure",
+        "invocations_endpoint",
+        invocationsEndpoint
+      );
+    if (a2aEndpoint)
+      patchTomlKv(tomlPath, "azure", "a2a_endpoint", a2aEndpoint);
+    if (agentCardEndpoint)
+      patchTomlKv(tomlPath, "azure", "agent_card_endpoint", agentCardEndpoint);
+    if (deployedFaces) {
+      patchTomlKv(tomlPath, "azure", "deployed_faces", deployedFaces);
+      patchTomlKv(
+        tomlPath,
+        "azure",
+        "deployed_x402_status",
+        deployedX402?.status ?? ""
+      );
+      patchTomlKv(
+        tomlPath,
+        "azure",
+        "deployed_x402_price_mode",
+        deployedX402?.priceMode ?? ""
+      );
+      patchTomlKv(
+        tomlPath,
+        "azure",
+        "deployed_x402_credentials_complete",
+        deployedX402?.credentialsComplete ?? false
+      );
+      patchTomlKv(
+        tomlPath,
+        "azure",
+        "deployed_x402_carrier",
+        deployedX402Carrier ?? ""
+      );
     }
     if (deployedFaces) {
       patchTomlKv(tomlPath, "azure", "deployed_faces", deployedFaces);
@@ -4332,6 +4526,10 @@ function clearAzureEndpoint(root) {
   try {
     for (const key of [
       "agent_endpoint",
+      "http_endpoint",
+      "invocations_endpoint",
+      "a2a_endpoint",
+      "agent_card_endpoint",
       "agent_name",
       "deployment_id",
       "last_deploy_at"
@@ -4419,10 +4617,17 @@ async function deployAzureFoundry(opts) {
     }
   );
   const record = recordOf(data);
+  const endpoints = tableOf4(data, "endpoints");
+  const recordEndpoints = tableOf4(record, "endpoints");
   const endpoint = deployEndpointValue(
-    record.invokeUrl,
+    endpoints.a2a,
+    recordEndpoints.a2a,
     record.endpoint,
-    data.endpoint
+    data.endpoint,
+    endpoints.http,
+    recordEndpoints.http,
+    record.invokeUrl,
+    data.invokeUrl
   );
   if (code !== 0) {
     if (endpoint) {
@@ -4635,12 +4840,12 @@ var checkEntrypointAndDockerfile = async (root, _target) => {
   const findings = [];
   const cfg = loadStudioCfg(deployWorkspaceRoot(root));
   const faces = stackFaces(tableOf4(cfg, "stack"), tableOf4(cfg, "payments"));
-  if (hasMcpFace(faces) || !hasA2aFace(faces) && !hasX402Face(faces)) {
+  if (hasMcpFace(faces) || !hasA2aFace(faces) && !hasB402PaymentFace(faces)) {
     return [
       {
         level: "CRITICAL",
         name: "azure_protocol_supported",
-        message: "azure-foundry deploy supports the A2A carrier, including X402-only seller configs. The delegated Foundry version declares the invocations contract (:8088, /readiness, /invocations), not native MCP /mcp. Re-scaffold with --protocols A2A, X402, or A2A,X402; or use AgentCore for MCP.",
+        message: "azure-foundry deploy supports the A2A carrier, including payment-only X402 or MPP seller configs. The delegated Foundry version declares the invocations contract (:8088, /readiness, /invocations), not native MCP /mcp. Re-scaffold with A2A and at most one B402 payment face; or use AgentCore for MCP.",
         details: { faces }
       }
     ];
@@ -4655,13 +4860,13 @@ var checkEntrypointAndDockerfile = async (root, _target) => {
       details: { entrypoint: entry }
     });
   }
-  if (hasX402Face(faces)) {
+  if (hasB402PaymentFace(faces)) {
     const carrier = inspectAzureX402Carrier(agentRoot2);
     if (carrier.status !== "http-envelope-v1") {
       findings.push({
         level: "CRITICAL",
         name: "azure_x402_entrypoint_compatible",
-        message: `${carrier.detail}. This scaffold cannot serve X402 even though studio.toml enables it. In a clean parent directory, run \`bag init azurex402migration --runtime azure-foundry --protocols ${faces.join(",")} --no-install --no-onboard\`, then review and merge its src/unifiedMain.ts, Dockerfile, and package scripts before redeploying. Studio will not overwrite user-owned agent code.`,
+        message: `${carrier.detail}. This scaffold cannot serve the selected B402 payment protocol even though studio.toml enables it. In a clean parent directory, run \`bag init azureb402migration --runtime azure-foundry --protocols ${faces.join(",")} --no-install --no-onboard\`, then review and merge its src/unifiedMain.ts, Dockerfile, and package scripts before redeploying. Studio will not overwrite user-owned agent code.`,
         details: {
           entrypoint: carrier.entrypoint,
           carrier: carrier.status
@@ -4854,9 +5059,9 @@ function writeEnvLocal(key, value, envPath = ".env.local") {
   return setEnvVar(envPath, key, value);
 }
 function ensureSiweCapable(wallet) {
-  const probe = wallet.supports;
-  if (typeof probe !== "function") return;
-  if (probe.call(wallet, "sign.message")) return;
+  const probe2 = wallet.supports;
+  if (typeof probe2 !== "function") return;
+  if (probe2.call(wallet, "sign.message")) return;
   const kind = wallet.kind;
   throw new PieverseCliError(
     `the ${kind ? `'${kind}' ` : ""}wallet cannot log in to Pieverse: SIWE requires an EIP-191 personal-sign ('sign.message'), which this wallet kind never supports. Pieverse LLM is not usable with this wallet \u2014 set [llm].provider in studio.toml to 'openrouter', 'openai', or 'anthropic' (with the matching API key in .studio/.env.local), or use an 'evm-local' or 'twak' wallet.`
@@ -6650,6 +6855,7 @@ import {
 import { auditedOp as auditedOp2 } from "@bnbagent/studio-runtime/audit";
 import { loadStudioToml as loadStudioToml9 } from "@bnbagent/studio-runtime/config";
 import {
+  fromRaw as fromRaw3,
   getNetwork as getNetwork5,
   tbnbFaucetHint,
   toRaw as toRaw2
@@ -6735,6 +6941,48 @@ function requirePassword() {
   }
   return password;
 }
+var RELAY_GAS_FLOOR_WEI = 10n ** 16n;
+function isBareRelayExecutionError(error) {
+  return error instanceof Error && error.message.includes("An error occurred while executing calls") && /Reason: 0x(?![0-9a-fA-F])/.test(error.message);
+}
+async function diagnoseRelayError(ctx, error) {
+  if (!isBareRelayExecutionError(error)) return error;
+  let balance;
+  try {
+    balance = await readNativeBalanceRaw(ctx.address, ctx.networkName);
+  } catch {
+    return error;
+  }
+  if (balance >= RELAY_GAS_FLOOR_WEI) return error;
+  const symbol = ctx.networkName === "bsc-testnet" ? "tBNB" : "BNB";
+  const funding = ctx.networkName === "bsc-testnet" ? ` ${tbnbFaucetHint(ctx.address)}` : "";
+  return new Error(
+    `${error.message}
+Likely cause: admin wallet ${ctx.address} holds ${fromRaw3(balance, 18)} ${symbol} on ${ctx.networkName} \u2014 not enough to repay the relay-fronted gas (the relay recovers its fee from the wallet in the same transaction; an unpayable fee reverts with empty revert data). Fund it to at least 0.01 ${symbol} and retry.${funding}`,
+    { cause: error }
+  );
+}
+function withRelayGasDiagnosis(ctx, admin) {
+  const guard = (fn) => async (...args) => {
+    try {
+      return await fn(...args);
+    } catch (error) {
+      throw await diagnoseRelayError(ctx, error);
+    }
+  };
+  return {
+    address: admin.address,
+    grantSession: guard(admin.grantSession.bind(admin)),
+    revokeSession: guard(admin.revokeSession.bind(admin)),
+    approveQuoteSignatureChecker: guard(
+      admin.approveQuoteSignatureChecker.bind(admin)
+    ),
+    approveX402SignatureChecker: guard(
+      admin.approveX402SignatureChecker.bind(admin)
+    ),
+    setPermit2Allowance: guard(admin.setPermit2Allowance.bind(admin))
+  };
+}
 function buildAdmin(ctx) {
   const admin = adminFactory({
     password: requirePassword(),
@@ -6747,7 +6995,7 @@ function buildAdmin(ctx) {
       `Altana admin address ${admin.address} does not match [wallet].address ${ctx.address}.`
     );
   }
-  return admin;
+  return withRelayGasDiagnosis(ctx, admin);
 }
 function parseSessionEnvelope(serialized) {
   let parsed;
@@ -7874,7 +8122,12 @@ var SUPPORTED_PROVIDERS = [
   "pieverse-llm"
 ];
 var SUPPORTED_NETWORKS = ["bsc-testnet", "bsc-mainnet"];
-var SUPPORTED_STORAGE_PROVIDERS = ["ipfs", "local"];
+var SUPPORTED_STORAGE_PROVIDERS = [
+  "ipfs",
+  "s3",
+  "azure-blob",
+  "local"
+];
 var SUPPORTED_DESTINATIONS = ["self", "platform"];
 var RUNTIMES = {
   agentcore: { label: "AWS Bedrock AgentCore", hidden: false },
@@ -8112,7 +8365,7 @@ function registerInit(program) {
     acceptChoices(
       new Option2(
         "--runtime <name>",
-        `Runtime / deploy target to scaffold for (choices: ${visibleRuntimes.join(", ")}); recorded in studio.toml [stack].runtime. Use azure-foundry before \`bag deploy --provider azure\`.`
+        `Runtime scaffold (${visibleRuntimes.join(", ")}); Azure: bag deploy --provider azure.`
       ).default("agentcore"),
       SUPPORTED_RUNTIMES,
       visibleRuntimes
@@ -8140,8 +8393,13 @@ function registerInit(program) {
   ).addOption(
     new Option2(
       "--protocols <faces>",
-      "Comma-separated public faces to expose; recorded in studio.toml [stack].protocols. Any non-empty combination of A2A, MCP, X402 (case-insensitive; default: A2A,X402)."
+      "Comma-separated public faces to expose; recorded in studio.toml [stack].protocols. Any non-empty combination of A2A, MCP and one B402 payment face (X402 or MPP; default: A2A,X402)."
     )
+  ).addOption(
+    new Option2(
+      "--payment-protocol <protocol>",
+      "B402 HTTP protocol adapter: x402 or mpp (default: x402). The two are alternatives."
+    ).choices(["x402", "mpp"])
   ).addOption(
     new Option2(
       "--protocol <protocol>",
@@ -8157,7 +8415,7 @@ function registerInit(program) {
     "ERC-8183 list price as a non-negative integer string in token base units. Use 0 for FREE. Default: 100000000000000000 (0.1 U)."
   ).option(
     "--b402-price <usd>",
-    "B402/x402 per-request price as a non-negative decimal USD string. Use 0 for FREE passthrough (no B402 verify/settle). Default: 0.01."
+    "B402 per-request price for x402 or MPP as a non-negative decimal USD string. Use 0 for FREE passthrough (no B402 verify/settle). Default: 0.01."
   ).addOption(
     new Option2(
       "--llm-provider <provider>",
@@ -8182,7 +8440,7 @@ function registerInit(program) {
   ).addOption(
     new Option2(
       "--storage-provider <kind>",
-      "Where job deliverables are stored: 'local' (default; offline dev) or 'ipfs' (durable, public, deploy-ready \u2014 needs STORAGE_API_URL + STORAGE_API_KEY). Written to studio.toml [storage].kind."
+      "Where job deliverables are stored: 'local' (default; offline dev) or durable self-hosted BYOS via 'ipfs', 's3', or 'azure-blob'. Self-hosted S3/Blob need the user's storage config and namespaced runtime credentials; Platform ignores this deploy-time choice and injects scoped access to managed S3 or Azure Blob. Written to studio.toml [storage].kind."
     ).default("local").choices([...SUPPORTED_STORAGE_PROVIDERS])
   ).option(
     "--ipfs-key <key>",
@@ -8303,10 +8561,11 @@ async function cmdInitFlow(nameArg, opts) {
     return 2;
   }
   const facesExplicit = opts.protocols !== void 0 || opts.protocol !== void 0;
+  const paymentFace = opts.paymentProtocol === "mpp" ? "MPP" : "X402";
   let faces;
   try {
     faces = normalizeProtocolFaces(
-      opts.protocols ?? opts.protocol ?? "A2A,X402"
+      opts.protocols ?? opts.protocol ?? `A2A,${paymentFace}`
     );
     if (opts.protocol !== void 0 && faces.length !== 1) {
       throw new Error("--protocol is a single-face alias; use --protocols");
@@ -8317,6 +8576,12 @@ async function cmdInitFlow(nameArg, opts) {
     );
     return 2;
   }
+  if (opts.paymentProtocol !== void 0 && facesExplicit && (opts.paymentProtocol === "mpp" && !hasMppFace(faces) || opts.paymentProtocol === "x402" && !hasX402Face(faces))) {
+    printErr(
+      "error: --payment-protocol must match the X402 or MPP face selected by --protocols."
+    );
+    return 2;
+  }
   if (opts.twakHome && opts.walletKind !== "twak") {
     printErr("error: --twak-home is only valid with --wallet-kind twak.");
     return 2;
@@ -8343,20 +8608,20 @@ async function cmdInitFlow(nameArg, opts) {
   if (llmProvider === null) {
     return 2;
   }
-  const inferredRails = opts.rails ?? (facesExplicit ? hasX402Face(faces) ? "both" : "8183" : void 0);
+  const inferredRails = opts.rails ?? (facesExplicit ? hasB402PaymentFace(faces) ? "both" : "8183" : void 0);
   let rails = await resolveRails(inferredRails, isTty);
   if (!facesExplicit) {
     faces = normalizeProtocolFaces(
-      rails === "8183" ? ["A2A"] : ["A2A", "X402"]
+      rails === "8183" ? ["A2A"] : ["A2A", paymentFace]
     );
   }
-  if (hasX402Face(faces) && rails === "8183") {
+  if (hasB402PaymentFace(faces) && rails === "8183") {
     rails = "both";
-  } else if (hasX402Face(faces) && rails !== "both") {
+  } else if (hasB402PaymentFace(faces) && rails !== "both") {
     rails = "b402";
   }
-  if ((rails === "b402" || rails === "both") && !hasX402Face(faces)) {
-    faces = normalizeProtocolFaces([...faces, "X402"]);
+  if ((rails === "b402" || rails === "both") && !hasB402PaymentFace(faces)) {
+    faces = normalizeProtocolFaces([...faces, paymentFace]);
   }
   if (opts.erc8183Price !== void 0 && rails === "b402") {
     printErr(
@@ -8423,9 +8688,9 @@ async function cmdInitFlow(nameArg, opts) {
     destination = "self";
     runtime = "agentcore";
   }
-  if (destination === "self" && runtime === "azure-foundry" && (hasMcpFace(faces) || !hasA2aFace(faces) && !hasX402Face(faces))) {
+  if (destination === "self" && runtime === "azure-foundry" && (hasMcpFace(faces) || !hasA2aFace(faces) && !hasB402PaymentFace(faces))) {
     printErr(
-      "error: azure-foundry supports the A2A carrier (including X402-only seller configs) and does not support an MCP face. Foundry is delegated through its invocations container contract (:8088, /readiness, /invocations), not the native MCP /mcp transport. Use --protocols A2A, X402, or A2A,X402; or use --runtime agentcore for MCP."
+      "error: azure-foundry supports the A2A carrier (including payment-only seller configs) and does not support an MCP face. Foundry is delegated through its invocations container contract (:8088, /readiness, /invocations), not the native MCP /mcp transport. Use A2A with one X402/MPP payment face, or use --runtime agentcore for MCP."
     );
     return 2;
   }
@@ -8595,24 +8860,27 @@ async function cmdInitFlow(nameArg, opts) {
     );
   }
   if (opts.storageProvider === "local") {
-    printLocalStorageWarning();
+    printLocalStorageWarning(destination, runtime);
   }
   if (hasMcpFace(faces) && destination === "platform") {
     printPlatformMcpSyncWarning(faces);
   }
-  if (faces.length === 1 && hasX402Face(faces) && destination === "platform") {
+  if (faces.length === 1 && hasB402PaymentFace(faces) && destination === "platform") {
+    const paymentPath = hasMppFace(faces) ? "/mpp" : "/x402";
     printErr(
-      "info: X402-only publishes only the /x402 gateway face; the native AgentCore A2A protocol declaration is suppressed from discovery."
+      `info: payment-only publishes only the ${paymentPath} gateway face; the native AgentCore A2A protocol declaration is suppressed from discovery.`
     );
-  } else if (faces.length === 1 && hasX402Face(faces) && destination === "self") {
+  } else if (faces.length === 1 && hasB402PaymentFace(faces) && destination === "self") {
+    const paymentName = hasMppFace(faces) ? "MPP" : "X402";
+    const paymentPath = hasMppFace(faces) ? "/mpp" : "/x402";
     const free = x402SellerPricingState({ price_usd: b402Price }).kind === "free";
     if (runtime === "azure-foundry") {
       printErr(
-        free ? "warning: X402-only FREE mode on Azure Foundry exposes no public A2A face or anonymous /x402 URL; run an external HTTPS gateway that carries http-envelope-v1 over the Entra-authenticated Invocations endpoint." : "warning: X402-only on Azure Foundry exposes no public A2A face or anonymous /x402 URL; the seller stays dormant until the B402 credentials are filled, then an external HTTPS gateway must carry http-envelope-v1 over the Entra-authenticated Invocations endpoint."
+        free ? `warning: ${paymentName}-only FREE mode on Azure Foundry exposes no public A2A face or anonymous ${paymentPath} URL; run an external HTTPS gateway that carries http-envelope-v1 over the Entra-authenticated Invocations endpoint.` : `warning: ${paymentName}-only on Azure Foundry exposes no public A2A face or anonymous ${paymentPath} URL; the seller stays dormant until its credentials are filled, then an external HTTPS gateway must carry http-envelope-v1 over the Entra-authenticated Invocations endpoint.`
       );
     } else {
       printErr(
-        free ? "warning: X402-only FREE mode uses an A2A-native AgentCore process internally, but exposes no public A2A face; a self-hosted AgentCore target still needs your own HTTP front to reach the anonymous /x402 passthrough." : "warning: X402-only uses an A2A-native AgentCore process internally, but exposes no public A2A face; the seller stays dormant until the B402 credentials are filled, and a self-hosted AgentCore target needs your own HTTP front to reach /x402."
+        free ? `warning: ${paymentName}-only FREE mode uses an A2A-native AgentCore process internally, but exposes no public A2A face; a self-hosted target still needs your own HTTP front for ${paymentPath}.` : `warning: ${paymentName}-only uses an A2A-native AgentCore process internally, but exposes no public A2A face; the seller stays dormant until its credentials are filled, and a self-hosted target needs your own HTTP front for ${paymentPath}.`
       );
     }
   }
@@ -8739,7 +9007,7 @@ function scaffold(target, name, o) {
       o.walletKind,
       o.rails,
       o.b402Price,
-      o.network
+      hasMppFace(o.faces) ? "mpp" : "x402"
     )
   );
   fs23.writeFileSync(path22.join(agentRoot2, ".gitignore"), renderAgentGitignore());
@@ -8974,6 +9242,12 @@ function renderAgentStorageSection(storageProvider) {
   if (storageProvider === "local") {
     return '[storage]\n# Deliverables written to local disk (file://). Offline-dev only \u2014\n# does NOT survive deploy. Path from STORAGE_LOCAL_PATH.\nkind = "local"\n';
   }
+  if (storageProvider === "s3") {
+    return '[storage]\n# User-owned S3 deliverable storage. Objects are immutable and keyed\n# as deliverables/sha256/<content-hash>.json. Set credentials in\n# .studio/.env.local, never here. For an IAM role, set\n# credential_mode = "ambient". public_base_url is optional.\nkind = "s3"\nbucket = ""\nregion = ""\nkey_prefix = "deliverables"\ncredential_mode = "env"\n# public_base_url = "https://artifacts.customer.com"\n';
+  }
+  if (storageProvider === "azure-blob") {
+    return '[storage]\n# User-owned Azure Blob deliverable storage. Objects are immutable and\n# keyed as deliverables/sha256/<content-hash>.json. Set a write SAS or\n# service-principal credentials in .studio/.env.local, never here. For\n# Managed Identity, set credential_mode = "ambient".\nkind = "azure-blob"\naccount_url = ""\ncontainer = ""\nkey_prefix = "deliverables"\ncredential_mode = "env"\n# public_base_url = "https://artifacts.customer.com"\n';
+  }
   return '[storage]\n# Deliverables pinned to IPFS. upload() returns ipfs://CID, published\n# on-chain verbatim \u2014 durable, public, deploy-ready. Works with any\n# pinning service or self-hosted node: the upload endpoint is\n# STORAGE_API_URL and the write key/JWT is STORAGE_API_KEY, both in\n# .studio/.env.local.\nkind = "ipfs"\n';
 }
 function renderWalletSection(walletKind2, twakHome) {
@@ -9074,10 +9348,11 @@ expected_recipient = ""
 allowed_hosts = ["llm.pieverse.io"]
 `;
 }
-function renderX402SellerSection(priceUsd) {
+function renderB402SellerSection(priceUsd, protocol) {
+  const path49 = protocol === "mpp" ? "/mpp" : "/x402";
   return `
-[payments.x402_seller]
-# Public seller rail mounted at /x402. Credentials stay in
+[payments.b402_seller]
+# Public ${protocol.toUpperCase()} seller rail mounted at ${path49}. Credentials stay in
 # <workspace>/.studio/.env.local and are issued per B402 environment.
 enabled = true
 # Decimal USD string; "0" is explicit FREE passthrough and bypasses B402.
@@ -9089,7 +9364,7 @@ pay_to = ""
 # Payment settles before work; this bounds only the post-settlement work.
 work_timeout_seconds = 60
 # Optional Bazaar metadata can be added later as scalar JSON fields under
-# [payments.x402_seller.bazaar]: info_json, schema_json, description,
+# [payments.b402_seller.bazaar]: info_json, schema_json, description,
 # and route_template.
 `;
 }
@@ -9133,13 +9408,20 @@ project_name = "${projectName2}"
 # captured at \`bag deploy --provider azure\` (deploys are delegated to bnbagent-deploy:
 # explicit saved browser sign-in or ambient CI credentials; runtime secrets ride as Foundry CustomKeys).
 agent_endpoint = ""
+http_endpoint = ""
+invocations_endpoint = ""
+a2a_endpoint = ""
+agent_card_endpoint = ""
 `;
 }
 function renderAgentStudioToml(name, o) {
   const model = o.model ?? PROVIDER_DEFAULT_MODEL[o.provider] ?? "";
   const pieverseSection = o.provider === "pieverse-llm" ? renderPieverseSections() : "";
   const x402Section = o.provider === "pieverse-llm" && o.budgetChoice === "enable" ? renderX402Section() : "";
-  const x402SellerSection = o.rails === "b402" || o.rails === "both" || hasX402Face(o.faces) ? renderX402SellerSection(o.b402Price) : "";
+  const x402SellerSection = o.rails === "b402" || o.rails === "both" || hasB402PaymentFace(o.faces) ? renderB402SellerSection(
+    o.b402Price,
+    hasMppFace(o.faces) ? "mpp" : "x402"
+  ) : "";
   const budgetSection = renderBudgetSection(o.budgetChoice);
   const storageSection = renderAgentStorageSection(o.storageProvider);
   const azureSection = o.runtime === "azure-foundry" ? renderAzureSection(name, o.azureAccount, o.azureProject) : "";
@@ -9174,9 +9456,9 @@ runtime = "${o.runtime}"
 #   MCP \u2014 streamable-HTTP /mcp: negotiate (signed quote) + notify_funded
 #         (verify \u2192 deliver \u2192 submit, synchronously within the tool call) +
 #         read-only chain tools.
-#   X402 \u2014 publish the sibling /x402 seller route. X402-only still declares
-#          A2A natively to AgentCore but suppresses that protocol face at the
-#          platform gateway.
+#   X402 or MPP \u2014 publish exactly one sibling B402 seller route (/x402 or
+#          /mpp). Payment-only still uses A2A as the cloud carrier but hides
+#          that native face at the public gateway.
 protocols = ${JSON.stringify(o.faces)}
 
 [network]
@@ -9191,7 +9473,7 @@ ${pieverseSection}${erc8183Section}
 ${storageSection}
 ${x402Section}${x402SellerSection}${budgetSection}${azureSection}`;
 }
-function renderAgentEnvLocal(provider, storageProvider, walletKind2, rails, b402Price, network) {
+function renderAgentEnvLocal(provider, storageProvider, walletKind2, rails, b402Price, paymentProtocol) {
   const keyEnv = PROVIDER_KEY_ENV[provider];
   const lines = [
     "# \u26A0\uFE0F  SECRETS \u2014 do NOT paste this file into issue trackers, logs, or AI chats.",
@@ -9255,7 +9537,7 @@ function renderAgentEnvLocal(provider, storageProvider, walletKind2, rails, b402
       "# bedrock uses AWS credentials chain \u2014 no API key env var needed."
     );
   }
-  if (storageProvider !== "local") {
+  if (storageProvider === "ipfs") {
     lines.push(
       "",
       "# IPFS upload endpoint \u2014 the Agent pins deliverables at submit. Any",
@@ -9269,10 +9551,29 @@ function renderAgentEnvLocal(provider, storageProvider, walletKind2, rails, b402
       "# Public read gateway (default: https://ipfs.io/ipfs/):",
       "# STORAGE_GATEWAY_URL=https://ipfs.io/ipfs/"
     );
+  } else if (storageProvider === "s3") {
+    lines.push(
+      "",
+      "# User-owned S3 upload credentials. Prefer credential_mode='ambient'",
+      "# on a self-deployed runtime with a scoped IAM role.",
+      "DELIVERABLE_S3_ACCESS_KEY_ID=",
+      "DELIVERABLE_S3_SECRET_ACCESS_KEY=",
+      "# DELIVERABLE_S3_SESSION_TOKEN="
+    );
+  } else if (storageProvider === "azure-blob") {
+    lines.push(
+      "",
+      "# User-owned Blob upload credential. A write SAS is the simplest path.",
+      "# It is never included in the public deliverable URL.",
+      "DELIVERABLE_AZURE_SAS_TOKEN=",
+      "# Or use a complete service-principal set:",
+      "# DELIVERABLE_AZURE_TENANT_ID=",
+      "# DELIVERABLE_AZURE_CLIENT_ID=",
+      "# DELIVERABLE_AZURE_CLIENT_SECRET="
+    );
   }
   if (rails === "b402" || rails === "both") {
     const free = x402SellerPricingState({ price_usd: b402Price }).kind === "free";
-    const baseUrl = !free && network === "bsc-testnet" ? DEFAULT_B402_TESTNET_BASE_URL : "";
     lines.push(
       "",
       "# B402 merchant credentials (issued per environment after manual approval).",
@@ -9281,14 +9582,25 @@ function renderAgentEnvLocal(provider, storageProvider, walletKind2, rails, b402
         "# for that exact wallet and environment. Never reuse merchant credentials",
         "# across wallets.",
         `# Apply: ${B402_DEVELOPER_ACCOUNT_URL}`,
-        "# PAID requires all four; all absent = dormant, partial = boot error."
+        "# PAID requires all four; all absent or partial = dormant."
       ],
-      `B402_BASE_URL=${baseUrl}`,
+      "B402_BASE_URL=",
       "B402_CLIENT_ID=",
       "B402_ACCESS_TOKEN=",
       "B402_PRIVATE_KEY=",
       "# (alternative one-line PKCS#8 DER: B402_PRIVATE_KEY_B64=)"
     );
+    if (paymentProtocol === "mpp") {
+      lines.push(
+        "",
+        "# MPP challenge authenticity. Generate at least 32 random bytes.",
+        "MPP_SECRET_KEY=",
+        "# Stable public realm/hostname used in MPP challenges.",
+        "MPP_REALM=",
+        "# Production must inject a durable atomic replayStore in runtime code.",
+        "# Managed single-process test sandboxes may set B402_REPLAY_STORE_MODE=memory."
+      );
+    }
   }
   if (rails === "8183" || rails === "both") {
     lines.push(
@@ -9308,8 +9620,9 @@ function renderAgentReadme(name, faces, destination, walletKind2) {
   const mode = recipeModeOf(faces);
   const entry = `src/${entryStemOf(faces)}.ts`;
   const port = String(devPortOf(faces));
-  const x402Only = faces.length === 1 && hasX402Face(faces);
-  const surface = mode === "both" ? "A2A natively on `0.0.0.0:9000` (agent card + JSON-RPC `message/send`) and buffered streamable-HTTP MCP on `/mcp` through the platform envelope tunnel" : mode === "mcp" ? "streamable-HTTP MCP on `0.0.0.0:8000/mcp` (negotiate + notify_funded sync-delivery + read-only chain tools)" : x402Only ? "only the public `/x402` seller face; AgentCore uses an internal A2A-native process on port 9000 but the gateway suppresses A2A discovery" : "`serveA2a`: the agent card at `/.well-known/agent-card.json` + JSON-RPC `message/send` on `0.0.0.0:9000`";
+  const paymentOnly = faces.length === 1 && hasB402PaymentFace(faces);
+  const paymentPath = hasMppFace(faces) ? "/mpp" : "/x402";
+  const surface = mode === "both" ? "A2A natively on `0.0.0.0:9000` (agent card + JSON-RPC `message/send`) and buffered streamable-HTTP MCP on `/mcp` through the platform envelope tunnel" : mode === "mcp" ? "streamable-HTTP MCP on `0.0.0.0:8000/mcp` (negotiate + notify_funded sync-delivery + read-only chain tools)" : paymentOnly ? `only the public \`${paymentPath}\` seller face; AgentCore uses an internal A2A-native process on port 9000 but the gateway suppresses A2A discovery` : "`serveA2a`: the agent card at `/.well-known/agent-card.json` + JSON-RPC `message/send` on `0.0.0.0:9000`";
   const filesA2a = `- \`src/unifiedMain.ts\` \u2014 unified serving entrypoint (A2A on port 9000 + Foundry invocations on 8088).
 - \`src/executor.ts\` \u2014 the SellerAgentExecutor: the negotiate + notify_funded A2A skills.
 - \`src/agentCard.ts\` \u2014 the discoverable AgentCard (+ OAuth2/Cognito scheme).`;
@@ -9808,7 +10121,7 @@ async function runOnboarding(o) {
       process.env.WALLET_PASSWORD = savedPw;
     }
   }
-  if (o.storageProvider !== "local") {
+  if (o.storageProvider === "ipfs") {
     await onboardIpfsKey(envLocalPath20(agentRoot2), o.ipfsKey);
   }
   if (address) {
@@ -9942,7 +10255,7 @@ Guide: the bnbagent-studio-using-twak-wallet.md reference (installed by \`bag sk
   } finally {
     process.chdir(savedCwd);
   }
-  if (o.storageProvider !== "local") {
+  if (o.storageProvider === "ipfs") {
     const { envLocalPath: envLocalPath20 } = await import("@bnbagent/studio-runtime/config");
     await onboardIpfsKey(envLocalPath20(agentRoot2), o.ipfsKey);
   }
@@ -10187,15 +10500,46 @@ NOTE \u2014 destination = "platform" (48h TESTNET TRIAL on the BNB Chain managed
    address on mainnet is later soft-warned.`
   );
 }
-function printLocalStorageWarning() {
+function printLocalStorageWarning(destination, runtime) {
+  if (destination === "platform") {
+    const managedStorage = runtime === "azure-foundry" ? "Azure Blob" : "S3";
+    printErr(
+      `
+\u26A0 WARNING \u2014 storage.kind = "local" (DEV-ONLY):
+ \xB7 Local runs write deliverables to disk (file://).
+ \xB7 Platform deploy does not use this local path and does not require BYOS:
+   the API injects an agent-scoped upload token and stores deliverables in
+   managed ${managedStorage} behind the bnbagent-api URL.
+ \xB7 Deliverables share the Agent lifecycle; after the Agent is deleted,
+   their API URLs return 404.`
+    );
+    return;
+  }
+  if (runtime === "azure-foundry") {
+    printErr(
+      `
+\u26A0 WARNING \u2014 storage.kind = "local" (DEV-ONLY):
+ \xB7 Local runs write deliverables to disk (file://).
+ \xB7 Managed Platform deploy (\`bag deploy --provider bnb --backend azure\`)
+   does not use this local path and does not require BYOS: the API injects an
+   agent-scoped upload token and stores deliverables in managed Azure Blob.
+   Deliverables share the Agent lifecycle and their API URLs return 404 after
+   Agent deletion.
+ \xB7 Self-hosted Azure deploy (\`bag deploy --provider azure\`) does require
+   durable BYOS via IPFS, S3, or Azure Blob; its credentials, public URL,
+   cost, and retention remain your responsibility.`
+    );
+    return;
+  }
   printErr(
     `
 \u26A0 WARNING \u2014 storage.kind = "local" (DEV-ONLY):
  \xB7 Deliverables are written to local disk (file://) and served from this
    machine \u2014 works for \`bag dev\`, but does NOT survive \`bag deploy\` (the file
    isn't in the deployed runtime \u2192 the buyer gets a 404).
- \xB7 Before \`bag deploy\`: run  bag config set storage.kind ipfs  then set
-   STORAGE_API_URL + STORAGE_API_KEY in .studio/.env.local.
+ \xB7 Before \`bag deploy\`: configure durable BYOS with IPFS, S3, or Azure Blob.
+   The storage account, public URL/CDN, credentials, cost, and retention remain
+   your responsibility for self-hosted deployment.
    (\`bag deploy prepare\` will re-flag this as CRITICAL until you do.)`
   );
 }
@@ -10223,8 +10567,8 @@ function entrypointHint(faces) {
   if (hasMcpFace(faces)) {
     return "app/agent/src/mcpMain.ts  = MCP entrypoint (build your value here)";
   }
-  if (faces.length === 1 && hasX402Face(faces)) {
-    return "app/agent/src/unifiedMain.ts  = X402-only runtime entrypoint (build your value here)";
+  if (faces.length === 1 && hasB402PaymentFace(faces)) {
+    return `app/agent/src/unifiedMain.ts  = ${hasMppFace(faces) ? "MPP" : "X402"}-only runtime entrypoint (build your value here)`;
   }
   return "app/agent/src/unifiedMain.ts + executor.ts  = A2A entrypoint (build your value here)";
 }
@@ -10523,11 +10867,14 @@ function printConfigSummary(agentRoot2) {
     return cur;
   };
   const shown = (v, unset = "<unset \u2014 fill before going live>") => v === void 0 || v === null || v === "" ? unset : String(v);
-  const table = (v) => v !== null && typeof v === "object" && !Array.isArray(v) ? v : {};
-  const faces = stackFaces(table(agent.stack), table(agent.payments));
-  const payments = table(agent.payments);
-  const erc8183 = table(payments.erc8183);
-  const x402Seller = table(payments.x402_seller);
+  const table2 = (v) => v !== null && typeof v === "object" && !Array.isArray(v) ? v : {};
+  const faces = stackFaces(table2(agent.stack), table2(agent.payments));
+  const payments = table2(agent.payments);
+  const erc8183 = table2(payments.erc8183);
+  const canonicalSeller = table2(payments.b402_seller);
+  const x402Seller = Object.keys(canonicalSeller).length > 0 ? canonicalSeller : table2(payments.x402_seller);
+  const paymentProtocol = hasMppFace(faces) ? "MPP+B402" : "x402";
+  const paymentPath = hasMppFace(faces) ? "/mpp" : "/x402";
   const hasErc8183 = Object.keys(erc8183).length > 0;
   const hasX402Seller = x402Seller.enabled === true;
   const x402Pricing = x402SellerPricingState(x402Seller);
@@ -10547,8 +10894,10 @@ function printConfigSummary(agentRoot2) {
   const contractOverrides = erc8183ContractOverrideState(
     erc8183ContractEnvForProject(agentRoot2)
   );
+  const destination = shown(g(agent, "deploy", "destination"), "self");
+  const runtime = shown(g(agent, "stack", "runtime"), "?");
   const storageKind2 = shown(g(agent, "storage", "kind"), "?");
-  const storageDesc = storageKind2 === "ipfs" ? "IPFS (durable, public)" : "local disk (offline dev only)";
+  const storageDesc = storageKind2 === "ipfs" ? "IPFS (durable, public)" : storageKind2 === "s3" ? "user-owned S3 (durable BYOS)" : storageKind2 === "azure-blob" ? "user-owned Azure Blob (durable BYOS)" : destination === "platform" ? "local disk for dev; Platform injects managed object storage" : runtime === "azure-foundry" ? "local disk for dev; Platform injects Azure Blob; self-hosted needs BYOS" : "local disk (offline dev only)";
   const walletKind2 = shown(g(agent, "wallet", "kind"), "evm-local");
   const walletAddr = g(agent, "wallet", "address");
   const budgetOn = g(agent, "budget", "enabled");
@@ -10560,11 +10909,11 @@ function printConfigSummary(agentRoot2) {
   printOut(bar);
   printOut("");
   printOut(
-    onlyX402 && isFreeX402 ? "Per request \u2014 how this FREE x402 seller delivers work:" : onlyX402 ? "Per request \u2014 how this x402 seller earns $U:" : isFreePrice ? "Per task \u2014 how this FREE seller delivers work:" : "Per task \u2014 how this seller earns $U:"
+    onlyX402 && isFreeX402 ? `Per request \u2014 how this FREE ${paymentProtocol} seller delivers work:` : onlyX402 ? `Per request \u2014 how this ${paymentProtocol} seller earns $U:` : isFreePrice ? "Per task \u2014 how this FREE seller delivers work:" : "Per task \u2014 how this seller earns $U:"
   );
   if (onlyX402 && isFreeX402) {
     printOut(
-      "  anonymous request reaches /x402 \u2192 B402 verify/settle is bypassed \u2192"
+      `  anonymous request reaches ${paymentPath} \u2192 B402 verify/settle is bypassed \u2192`
     );
     printOut(
       "  the Agent runs the work and returns the result with no payment."
@@ -10670,11 +11019,11 @@ function printConfigSummary(agentRoot2) {
   }
   if (hasX402Seller) {
     printOut(
-      isFreeX402 ? "  x402      : FREE \u2014 anonymous passthrough; B402 verify/settle is bypassed" : `  x402      : PAID \u2014 $${shown(x402Seller.price_usd, DEFAULT_B402_PRICE_USD)} per request through B402`
+      isFreeX402 ? `  ${paymentProtocol.padEnd(10)}: FREE \u2014 anonymous passthrough; B402 verify/settle is bypassed` : `  ${paymentProtocol.padEnd(10)}: PAID \u2014 $${shown(x402Seller.price_usd, DEFAULT_B402_PRICE_USD)} per request through B402`
     );
   }
   printOut(
-    `  storage   : ${storageDesc}  (options: local | ipfs \u2014 ipfs required to deploy)`
+    `  storage   : ${storageDesc}  (options: local | ipfs | s3 | azure-blob)`
   );
   if (budgetOn !== void 0) {
     const bt = budgetOn ? "ENABLED \u2014 wallet may auto-refill within your caps" : "disabled \u2014 wallet is NEVER auto-charged (opt in: `bag budget enable`)";
@@ -10694,14 +11043,21 @@ function printConfigSummary(agentRoot2) {
     );
   }
   if (hasX402Seller && !isFreeX402) {
-    todo.push(`PAID /x402 onboarding \u2014 ${B402_PAID_ONBOARDING_GUIDANCE}`);
+    todo.push(
+      `PAID ${paymentPath} onboarding \u2014 ${B402_PAID_ONBOARDING_GUIDANCE}`
+    );
+    if (hasMppFace(faces)) {
+      todo.push(
+        "set MPP_SECRET_KEY / MPP_REALM and inject a durable production replayStore"
+      );
+    }
     todo.push(
       "then set B402_BASE_URL / CLIENT_ID / ACCESS_TOKEN / private key"
     );
   }
-  if (storageKind2 === "local") {
+  if (storageKind2 === "local" && destination !== "platform" && runtime !== "azure-foundry") {
     todo.push(
-      "[storage].kind \u2014 switch to 'ipfs' + set STORAGE_API_URL/STORAGE_API_KEY before deploy (local disk is NOT deployable)"
+      "[storage].kind \u2014 switch to durable BYOS (ipfs, s3, or azure-blob) before deploy; local disk is NOT deployable"
     );
   }
   if (todo.length > 0) {
@@ -10774,6 +11130,34 @@ function runtimeEnvKeysCore(cfg, resolvable) {
     if (resolvable("STORAGE_API_KEY")) {
       keys.push("STORAGE_API_KEY");
     }
+  } else if (storageKind2 === "s3") {
+    const storage = tableOf8(cfg, "storage");
+    const credentialMode = String(storage.credential_mode ?? "env");
+    if (credentialMode !== "ambient") {
+      keys.push(
+        "DELIVERABLE_S3_ACCESS_KEY_ID",
+        "DELIVERABLE_S3_SECRET_ACCESS_KEY"
+      );
+      if (resolvable("DELIVERABLE_S3_SESSION_TOKEN")) {
+        keys.push("DELIVERABLE_S3_SESSION_TOKEN");
+      }
+    }
+  } else if (storageKind2 === "azure-blob") {
+    const storage = tableOf8(cfg, "storage");
+    const credentialMode = String(storage.credential_mode ?? "env");
+    if (credentialMode !== "ambient") {
+      const servicePrincipalKeys = [
+        "DELIVERABLE_AZURE_TENANT_ID",
+        "DELIVERABLE_AZURE_CLIENT_ID",
+        "DELIVERABLE_AZURE_CLIENT_SECRET"
+      ];
+      const usesServicePrincipal = servicePrincipalKeys.some(resolvable);
+      if (resolvable("DELIVERABLE_AZURE_SAS_TOKEN") || !usesServicePrincipal) {
+        keys.push("DELIVERABLE_AZURE_SAS_TOKEN");
+      } else {
+        keys.push(...servicePrincipalKeys);
+      }
+    }
   }
   if (resolvable("RPC_URL")) {
     keys.push("RPC_URL");
@@ -10792,8 +11176,16 @@ function runtimeEnvKeysCore(cfg, resolvable) {
     }
   }
   if (X402_CAPABLE_RUNTIMES.has(runtimeName) && x402SellerUsesB402(cfg)) {
-    for (const key of B402_RUNTIME_KEYS) {
-      if (resolvable(key)) keys.push(key);
+    const b402Complete = resolvable("B402_BASE_URL") && resolvable("B402_CLIENT_ID") && resolvable("B402_ACCESS_TOKEN") && (resolvable("B402_PRIVATE_KEY") || resolvable("B402_PRIVATE_KEY_B64"));
+    if (b402Complete) {
+      for (const key of B402_RUNTIME_KEYS) {
+        if (resolvable(key)) keys.push(key);
+      }
+      if (b402PaymentProtocol(cfg) === "mpp") {
+        for (const key of MPP_RUNTIME_KEYS) {
+          if (resolvable(key)) keys.push(key);
+        }
+      }
     }
   }
   return keys;
@@ -11451,12 +11843,12 @@ Switch to Node \u226522 so it wins on PATH, then reopen the shell and retry. Ver
       `bag dev: test with curl / an A2A client sending a {"skill":...} DataPart \u2014 NOT the :8081 chat box (it can't build a seller's structured skills).`
     );
   }
-  if (hasX402Face(faces)) {
-    const free = x402SellerIsFree(
-      loadStudioToml11(path23.join(agentDir, "studio.toml"))
-    );
+  if (hasB402PaymentFace(faces)) {
+    const cfg = loadStudioToml11(path23.join(agentDir, "studio.toml"));
+    const free = x402SellerIsFree(cfg);
+    const paymentProtocol = b402PaymentProtocol(cfg);
     printOut(
-      free ? `bag dev: x402 seller at http://localhost:${agentPort}/x402 (FREE \u2014 anonymous passthrough; B402 bypassed)` : `bag dev: x402 seller at http://localhost:${agentPort}/x402 (PAID \u2014 active when B402 credentials are configured)`
+      free ? `bag dev: ${paymentProtocol} seller at http://localhost:${agentPort}/${paymentProtocol} (FREE \u2014 anonymous passthrough; B402 bypassed)` : `bag dev: ${paymentProtocol} seller at http://localhost:${agentPort}/${paymentProtocol} (PAID \u2014 active when B402${paymentProtocol === "mpp" ? " and MPP" : ""} credentials are configured)`
     );
   }
   await launch();
@@ -12001,9 +12393,11 @@ function dockerUsesNode22OrNewer(source) {
 }
 function x402SellerRailChecks(agentRoot2, cfg, target) {
   const payments = tableOf2(cfg, "payments");
-  const rawSeller = payments.x402_seller;
+  const rawSeller = payments.b402_seller !== void 0 ? payments.b402_seller : payments.x402_seller;
   const sellerPresent = rawSeller !== null && typeof rawSeller === "object" && !Array.isArray(rawSeller);
   const seller = sellerPresent ? rawSeller : {};
+  const paymentProtocol = b402PaymentProtocol(cfg);
+  const configSection = payments.b402_seller !== void 0 ? "payments.b402_seller" : "payments.x402_seller";
   const rails = commerceRails(cfg);
   const credentials = b402Credentials(agentRoot2);
   const out = [];
@@ -12015,14 +12409,14 @@ function x402SellerRailChecks(agentRoot2, cfg, target) {
       out.push({
         level: Level.CRITICAL,
         name: "x402_price_invalid",
-        message: '[payments.x402_seller].price_usd must be a non-negative decimal string; "0" is valid and enables the free passthrough.',
+        message: `[${configSection}].price_usd must be a non-negative decimal string; "0" is valid and enables the free passthrough.`,
         details: {}
       });
     } else if (free) {
       out.push({
         level: Level.INFO,
         name: "x402_zero_price_enabled",
-        message: "The x402 seller is explicitly FREE. /x402 is anonymous, and B402 verify/settle, token payment, and settlement audit are bypassed.",
+        message: `The ${paymentProtocol.toUpperCase()} seller is explicitly FREE. /${paymentProtocol} is anonymous, and B402 verify/settle, token payment, and settlement audit are bypassed.`,
         details: { price_usd: pricing.priceUsd, facilitator_bypassed: true }
       });
     }
@@ -12031,7 +12425,7 @@ function x402SellerRailChecks(agentRoot2, cfg, target) {
       out.push({
         level: Level.CRITICAL,
         name: "x402_assets_unsupported",
-        message: '[payments.x402_seller].assets must be exactly ["U"] in v1.',
+        message: `[${configSection}].assets must be exactly ["U"] in v1.`,
         details: {}
       });
     }
@@ -12040,7 +12434,7 @@ function x402SellerRailChecks(agentRoot2, cfg, target) {
       out.push({
         level: Level.CRITICAL,
         name: "x402_work_timeout_invalid",
-        message: "[payments.x402_seller].work_timeout_seconds must be a positive integer.",
+        message: `[${configSection}].work_timeout_seconds must be a positive integer.`,
         details: {}
       });
     }
@@ -12078,6 +12472,35 @@ function x402SellerRailChecks(agentRoot2, cfg, target) {
       details: {}
     });
   }
+  if (paid && paymentProtocol === "mpp") {
+    const envPath = envLocalPath12(agentRoot2);
+    const secretKey = process.env.MPP_SECRET_KEY || getEnvVar(envPath, "MPP_SECRET_KEY");
+    const realm = process.env.MPP_REALM || getEnvVar(envPath, "MPP_REALM");
+    if (!secretKey || Buffer.byteLength(secretKey, "utf8") < 32) {
+      out.push({
+        level: Level.CRITICAL,
+        name: "mpp_secret_key_missing",
+        message: "MPP+B402 paid mode requires MPP_SECRET_KEY with at least 32 UTF-8 bytes.",
+        details: {}
+      });
+    }
+    if (!realm) {
+      out.push({
+        level: Level.CRITICAL,
+        name: "mpp_realm_missing",
+        message: "MPP+B402 paid mode requires a stable MPP_REALM hostname.",
+        details: {}
+      });
+    }
+    if (!target.startsWith("platform")) {
+      out.push({
+        level: Level.WARNING,
+        name: "mpp_replay_store_external",
+        message: "Production MPP+B402 must inject a durable atomic replayStore shared by every runtime instance; Store.memory is development/single-process only.",
+        details: {}
+      });
+    }
+  }
   if ((!rails.x402 || free) && credentials.any) {
     out.push({
       level: Level.WARNING,
@@ -12152,7 +12575,7 @@ async function checkCommerceReady(root, target) {
     out.push({
       level: Level.CRITICAL,
       name: "commerce_no_rail",
-      message: "No commerce rail is configured. Enable [payments.erc8183] or [payments.x402_seller] before deploy.",
+      message: "No commerce rail is configured. Enable [payments.erc8183] or [payments.b402_seller] before deploy.",
       details: {}
     });
   }
@@ -13237,8 +13660,8 @@ function agentTable(agentRoot2, key) {
   } catch {
     return {};
   }
-  const table = cfg[key];
-  return table !== null && typeof table === "object" && !Array.isArray(table) ? table : {};
+  const table2 = cfg[key];
+  return table2 !== null && typeof table2 === "object" && !Array.isArray(table2) ? table2 : {};
 }
 function deployTable(agentRoot2) {
   return agentTable(agentRoot2, "deploy");
@@ -13281,16 +13704,22 @@ function checkPackagingDrift(root, destination, walletKind2, force) {
     return null;
   }
   if (packagingChannel(persisted) !== packagingChannel(derived)) {
-    if (force) {
+    const historicalManagedAzureZipLock = stackRuntime(agentRoot2) === "azure-foundry" && packagingChannel(persisted) === "zip" && packagingChannel(derived) === "container";
+    if (historicalManagedAzureZipLock) {
+      printErr(
+        "note: repairing the historical managed-Azure packaging lock from 'zip' to 'container' after this successful deploy."
+      );
+    } else if (force) {
       printErr(
         `warning: packaging lock '${persisted}' differs from the derived '${derived}' (wallet.kind/destination changed); proceeding under --force without re-stamping the lock.`
       );
       return null;
+    } else {
+      printErr(
+        `error: packaging is locked to '${persisted}' but this deploy derives '${derived}' (wallet.kind/destination changed). In-place packaging switch is provisionally disallowed pending live-verify; run 'bag deploy destroy' then redeploy, or pass --force to override.`
+      );
+      return 1;
     }
-    printErr(
-      `error: packaging is locked to '${persisted}' but this deploy derives '${derived}' (wallet.kind/destination changed). In-place packaging switch is provisionally disallowed pending live-verify; run 'bag deploy destroy' then redeploy, or pass --force to override.`
-    );
-    return 1;
   }
   const dockerfile = path29.join(agentRoot2, "Dockerfile");
   let dockerfilePresent = false;
@@ -14028,13 +14457,13 @@ var checkPlatformDockerAvailable = async (root, target) => {
     }
   ];
 };
-var checkPlatformStorageEndpoint = async (root, _target) => {
-  const check = storageIpfsEndpointRequiredCheck(root, {
-    name: "platform_storage_endpoint",
-    message: "[storage].kind = 'ipfs' but STORAGE_API_URL is unset \u2014 the deployed seller cannot pin deliverables and funded jobs may get stuck."
-  });
-  return check ? [check] : [];
-};
+var checkPlatformStorageEndpoint = async (_root, _target) => [
+  {
+    level: Level.INFO,
+    name: "platform_managed_deliverable_storage",
+    message: "the managed platform injects an agent-scoped deliverable upload token; self-hosted IPFS/S3/Blob credentials are not sent to the platform."
+  }
+];
 var checkPlatformMcpSyncTimeout = async (root, _target) => {
   const data = loadAgent(root);
   const faces = stackFaces(tableOf11(data, "stack"), tableOf11(data, "payments"));
@@ -14105,7 +14534,6 @@ var criticalChecks = [
   checkPlatformLoggedIn,
   checkDeployCliRunnable,
   checkPlatformDockerAvailable,
-  checkPlatformStorageEndpoint,
   checkTwakCustomContractsUnsupported,
   checkAltanaCustomContractsUnsupported,
   checkLocalKeystoreExists,
@@ -14127,6 +14555,7 @@ var warningChecks = [
 var infoChecks = [
   checkPlatformTrialStatus,
   checkWalletBalanceSummary,
+  checkPlatformStorageEndpoint,
   checkPlatformFundingHint
 ];
 
@@ -14407,15 +14836,15 @@ async function runVerify(opts) {
       exitCode: 1
     });
   }
-  const tableOf17 = (key) => {
+  const tableOf18 = (key) => {
     const v = data[key];
     return v !== null && typeof v === "object" && !Array.isArray(v) ? v : {};
   };
-  const network = opts.network || String(tableOf17("network").default ?? "bsc-testnet");
+  const network = opts.network || String(tableOf18("network").default ?? "bsc-testnet");
   const protocol = nativeProtocolOf(
-    stackFaces(tableOf17("stack"), tableOf17("payments"))
+    stackFaces(tableOf18("stack"), tableOf18("payments"))
   );
-  const identity = tableOf17("identity");
+  const identity = tableOf18("identity");
   const existingAgentId = identity.agent_id;
   const accessDescription = accessSummaryForAgentcore(root, { protocol });
   let agentId = null;
@@ -14576,6 +15005,13 @@ var WALLET_MATERIAL_KEYS = [
   TWAK_WALLET_JSON_ENV2,
   ALTANA_SESSION_ENV2
 ];
+function withoutPlatformByosStorageSecrets(secrets) {
+  return Object.fromEntries(
+    Object.entries(secrets).filter(
+      ([key]) => !key.startsWith("STORAGE_") && !key.startsWith("DELIVERABLE_S3_") && !key.startsWith("DELIVERABLE_AZURE_")
+    )
+  );
+}
 var RETIRED_AGENT_STATES = /* @__PURE__ */ new Set([
   "deleted",
   "retired",
@@ -14804,6 +15240,7 @@ function buyerAccess(root) {
   let a2aUrl = null;
   let mcpUrl = null;
   let x402Url = null;
+  let mppUrl = null;
   let scope = null;
   if (agentId) {
     const rt = `${base}/v1/rt/${agentId}`;
@@ -14815,7 +15252,10 @@ function buyerAccess(root) {
       mcpUrl = `${rt}/mcp`;
       buyerUrl ??= mcpUrl;
     }
-    if (hasX402Face(faces)) {
+    if (hasMppFace(faces)) {
+      mppUrl = `${rt}/mpp`;
+      buyerUrl ??= mppUrl;
+    } else if (hasB402PaymentFace(faces)) {
       x402Url = `${rt}/x402`;
       buyerUrl ??= x402Url;
     }
@@ -14832,7 +15272,8 @@ function buyerAccess(root) {
     buyerUrl,
     a2aUrl,
     mcpUrl,
-    x402Url
+    x402Url,
+    mppUrl
   };
 }
 function resolveSlug(root) {
@@ -14874,28 +15315,31 @@ async function platformAgent(opts) {
     `note: deploying to the BNB Chain managed platform (backend=${backend}) \u2014 a 48h TESTNET trial sandbox (network is forced to bsc-testnet; the runtime is auto-reclaimed at 48h). Not a production seller.`
   );
   const platformCmd = opts.runPlatformCommand ?? runPlatformAccountCommand;
-  if (backend === "azure") {
-    const cfg2 = loadAgentCfg(root);
-    const faces2 = stackFaces(tableOf12(cfg2, "stack"), tableOf12(cfg2, "payments"));
-    const protocol2 = nativeProtocolOf(faces2);
+  const cfg = loadAgentCfg(root);
+  const faces = stackFaces(tableOf12(cfg, "stack"), tableOf12(cfg, "payments"));
+  const paymentProtocol = b402PaymentProtocol(cfg);
+  const paymentFace = hasB402PaymentFace(faces);
+  if (backend === "azure" || paymentFace && paymentProtocol === "mpp") {
+    const protocol2 = nativeProtocolOf(faces);
     const runtimeProfile = protocol2 === "A2A" ? "foundry-responses-v1" : "foundry-invocations-v1";
     const capability = await platformCmd(["capabilities"], { json: true });
     const platform = isJsonObject(capability.data.platform) ? capability.data.platform : {};
     const backends = isJsonObject(platform.backends) ? platform.backends : {};
-    const azure = isJsonObject(backends.azure) ? backends.azure : {};
+    const backendCapability = isJsonObject(backends[backend]) ? backends[backend] : {};
+    const azure = backend === "azure" ? backendCapability : {};
     const profiles = Array.isArray(azure.runtimeProfiles) ? azure.runtimeProfiles.map(String) : [];
     const protocols = Array.isArray(azure.protocols) ? azure.protocols.map(String) : [];
-    if (capability.code !== 0 || azure.enabled !== true || !profiles.includes(runtimeProfile) || !protocols.includes(protocol2)) {
+    if (backend === "azure" && (capability.code !== 0 || azure.enabled !== true || !profiles.includes(runtimeProfile) || !protocols.includes(protocol2))) {
       warn(
         `error: the managed platform does not currently accept Azure ${runtimeProfile}/${protocol2}. No build or upload was started.`
       );
       return capability.code || 1;
     }
-    if (hasX402Face(faces2) && azure.x402 !== true) {
+    if (paymentFace && (capability.code !== 0 || backendCapability[paymentProtocol] !== true)) {
       warn(
-        "error: this platform deployment does not accept x402 publication on the managed Azure backend yet. No build or upload was started. Deploy without the X402 face, or self-host the x402 gateway (`bag deploy --provider azure` + docs/guides/self-hosted-x402-gateway-azure.md)."
+        `error: this platform deployment does not accept ${paymentProtocol} publication on the managed ${backend === "azure" ? "Azure" : "AWS"} backend yet. No build or upload was started. Deploy without the ${paymentProtocol.toUpperCase()} face, or self-host the ${paymentProtocol} gateway.`
       );
-      return 1;
+      return capability.code || 1;
     }
   }
   const campaignProbe = opts.campaignActive ?? (async () => null);
@@ -14933,17 +15377,19 @@ async function platformAgent(opts) {
   }
   const packaging = backend === "azure" ? "container" : platformPackaging(root);
   {
-    const confirm = opts.confirmPackaging ?? ((r, p) => confirmPackagingDefault(r, p, {
+    const confirm2 = opts.confirmPackaging ?? ((r, p) => confirmPackagingDefault(r, p, {
       acceptRisk: opts.acceptRisk ?? false,
       isTty,
       promptUser: ask2
     }));
-    const rc = await confirm(root, packaging);
+    const rc = await confirm2(root, packaging);
     if (rc !== null && rc !== 0) {
       return rc;
     }
   }
-  const secrets = await (opts.collectRuntimeSecrets ?? collectRuntimeSecrets)(root);
+  const secrets = withoutPlatformByosStorageSecrets(
+    await (opts.collectRuntimeSecrets ?? collectRuntimeSecrets)(root)
+  );
   walletWarning(root, secrets);
   if (Object.keys(secrets).length > 0) {
     warn(
@@ -14979,8 +15425,6 @@ then re-run the deploy.`
     );
     return 1;
   }
-  const cfg = loadAgentCfg(root);
-  const faces = stackFaces(tableOf12(cfg, "stack"), tableOf12(cfg, "payments"));
   const protocol = nativeProtocolOf(faces);
   const runDeploy = opts.runDelegatedDeploy ?? (async (o) => withDeployFiles(
     o.root,
@@ -15040,13 +15484,14 @@ then re-run the deploy.`
   });
   const clockStarted = startedNow ? `  \u23F1 your 48h trial clock just started${trial.expiresAt ? ` \u2014 expires ${trial.expiresAt}` : ""}.
 ` : "";
+  const managedStorage = backend === "azure" ? "Azure Blob" : "S3";
   emit(
     `
 \u2713 deployed to the platform (backend=${backend}, slug=${slug}).
   deployment: ${dep.deploymentId}
   invoke URL: ${dep.invokeUrl || "<pending \u2014 see `bag deploy status`>"}
   ${trialLine(trial)}
-${clockStarted}  At trial expiry the agent and its data are deleted (NOT recoverable).
+${clockStarted}  At trial expiry the runtime, secrets, and private deployment data are deleted (NOT recoverable). The API injects a scoped upload token; deliverables use managed ${managedStorage} and public URLs stay on bnbagent-api. Deliverables share the Agent lifecycle: after Agent deletion their URLs return 404.
   Activity details: ${CAMPAIGN_DOC_URL}
   Register on-chain so buyers can discover it:  bag deploy verify --endpoint ${dep.invokeUrl || "<your-invoke-url>"}`
   );
@@ -15156,11 +15601,12 @@ function recordDeployState(root, slug, dep, backend = "aws") {
     }
   }
   const agentRoot2 = findSubProjectRoot15("agent", root);
-  if (agentRoot2 !== null && persistedPackaging2(agentRoot2) === null) {
+  const recordedPackaging = backend === "azure" ? "container" : platformPackaging(root);
+  if (agentRoot2 !== null && (persistedPackaging2(agentRoot2) === null || backend === "azure" && persistedPackaging2(agentRoot2) !== "container")) {
     const tomlPath = agentTomlPath2(root);
     if (tomlPath !== null) {
       try {
-        patchTomlKv2(tomlPath, "deploy", "packaging", platformPackaging(root));
+        patchTomlKv2(tomlPath, "deploy", "packaging", recordedPackaging);
       } catch {
       }
     }
@@ -15178,8 +15624,12 @@ function recordShippedWallet(root, secrets) {
 function printAccessNextSteps(root, _invokeUrl) {
   const agentRoot2 = findSubProjectRoot15("agent", root) ?? root;
   const access = buyerAccess(agentRoot2);
-  const x402Only = access.faces.length === 1 && hasX402Face(access.faces);
-  const x402Free = x402SellerIsFree(loadAgentCfg(agentRoot2));
+  const x402Only = access.faces.length === 1 && hasB402PaymentFace(access.faces);
+  const agentCfg = loadAgentCfg(agentRoot2);
+  const paymentProtocol = b402PaymentProtocol(agentCfg);
+  const paymentPath = paymentProtocol === "mpp" ? "/mpp" : "/x402";
+  const paymentUrl = access.mppUrl ?? access.x402Url;
+  const x402Free = x402SellerIsFree(agentCfg);
   const x402RouteLabel = x402Free ? "anonymous FREE route" : "anonymous paid route";
   emit("\nAccess your agent \u2014");
   if (access.agentId) {
@@ -15197,15 +15647,19 @@ function printAccessNextSteps(root, _invokeUrl) {
         "  MCP gateway support is rolling out \u2014 the A2A face is the stable face."
       );
     }
-    if (hasX402Face(access.faces)) {
-      emit(`  x402 endpoint:  ${access.x402Url}  (${x402RouteLabel})`);
+    if (hasB402PaymentFace(access.faces)) {
+      emit(
+        `  ${paymentProtocol} endpoint:  ${paymentUrl}  (${x402RouteLabel})`
+      );
     }
     if (!x402Only) {
       emit(
         "  mint buyer creds: bag platform invoke-client new  (prints client_id + client_secret to POST to the client_credentials token endpoint above \u2014 credentials go in the form BODY; HTTP Basic auth is not accepted)"
       );
     } else {
-      emit("  protocol discovery is suppressed for this X402-only deployment.");
+      emit(
+        "  protocol discovery is suppressed for this payment-only deployment."
+      );
     }
   } else {
     const rtTmpl = `${access.base}/v1/rt/<agentId>`;
@@ -15222,11 +15676,15 @@ function printAccessNextSteps(root, _invokeUrl) {
         "  MCP gateway support is rolling out \u2014 the A2A face is the stable face."
       );
     }
-    if (hasX402Face(access.faces)) {
-      emit(`  x402 endpoint:  ${rtTmpl}/x402  (${x402RouteLabel})`);
+    if (hasB402PaymentFace(access.faces)) {
+      emit(
+        `  ${paymentProtocol} endpoint:  ${rtTmpl}${paymentPath}  (${x402RouteLabel})`
+      );
     }
     if (x402Only) {
-      emit("  protocol discovery is suppressed for this X402-only deployment.");
+      emit(
+        "  protocol discovery is suppressed for this payment-only deployment."
+      );
     } else {
       emit(
         "  run `bag platform invoke-client new` to mint buyer creds and capture your agentId."
@@ -15257,10 +15715,13 @@ function printAgentClientPrompt(root, invokeUrl, status) {
      this endpoint does NOT accept HTTP Basic auth (\`curl -u\` fails with oauth.invalid_request).
   3) send \`Authorization: Bearer <token>\`.`;
   const agentCfg = loadAgentCfg(agentRoot2);
+  const paymentProtocol = b402PaymentProtocol(agentCfg);
+  const paymentPath = paymentProtocol === "mpp" ? "/mpp" : "/x402";
+  const paymentUrl = access.mppUrl ?? access.x402Url;
   const rails = commerceRails(agentCfg);
   const x402Free = x402SellerIsFree(agentCfg);
-  const x402Only = faces.length === 1 && hasX402Face(faces) || rails.x402 && !rails.erc8183;
-  const x402Summary = x402DeploySummary(agentRoot2, "platform", access.x402Url);
+  const x402Only = faces.length === 1 && hasB402PaymentFace(faces) || rails.x402 && !rails.erc8183;
+  const x402Summary = x402DeploySummary(agentRoot2, "platform", paymentUrl);
   const endpoints = [];
   if (hasA2aFace(faces)) {
     endpoints.push(
@@ -15279,7 +15740,7 @@ function printAgentClientPrompt(root, invokeUrl, status) {
   }
   if (x402Only) {
     endpoints.push(
-      `  [X402] Anonymous ${x402Free ? "FREE" : "paid"} endpoint: ${access.x402Url ?? `${rt}/x402`}
+      `  [${paymentProtocol.toUpperCase()}] Anonymous ${x402Free ? "FREE" : "paid"} endpoint: ${paymentUrl ?? `${rt}${paymentPath}`}
          Protocol discovery is suppressed.`
     );
   }
@@ -15299,7 +15760,7 @@ function printAgentClientPrompt(root, invokeUrl, status) {
     "\u{1F4CB} COPY EVERYTHING BELOW THIS LINE INTO CLAUDE CODE OR CURSOR",
     "   \u2014 it will build and run a client that tests your deployed agent",
     CLIENT_PROMPT_RULE,
-    x402Only ? "I deployed a BNB Chain x402 seller agent. Build a small TypeScript (fetch) client that follows the X402 SELLER instructions below." : "I deployed a BNB Chain seller agent. Build a small TypeScript (fetch) client that authenticates, calls the agent, and prints the responses.",
+    x402Only ? `I deployed a BNB Chain ${paymentProtocol.toUpperCase()}+B402 seller agent. Build a small TypeScript (fetch) client that follows the ${paymentProtocol.toUpperCase()} SELLER instructions below.` : "I deployed a BNB Chain seller agent. Build a small TypeScript (fetch) client that authenticates, calls the agent, and prints the responses.",
     "",
     "WHAT WAS DEPLOYED",
     `- Protocol: ${proto}`,
@@ -15314,7 +15775,11 @@ function printAgentClientPrompt(root, invokeUrl, status) {
       ] : [],
       "  4) poll the CHAIN for the job's SUBMITTED state to read the deliverable_url (the agent serves no job-query endpoint)."
     ] : [],
-    ...x402Summary ? ["", "X402 SELLER", ...x402Summary.split("\n")] : [],
+    ...x402Summary ? [
+      "",
+      `${paymentProtocol.toUpperCase()} SELLER`,
+      ...x402Summary.split("\n")
+    ] : [],
     "",
     "ENDPOINT",
     endpointBlock,
@@ -15327,14 +15792,14 @@ function printAgentClientPrompt(root, invokeUrl, status) {
       "",
       ...commerceShapeLines
     ] : [
-      "- The anonymous x402 route does not use the OAuth2 token flow shown for ERC-8183."
+      `- The anonymous ${paymentProtocol} route does not use the OAuth2 token flow shown for ERC-8183.`
     ],
     ...!x402Only && hasA2aFace(faces) ? [
       '- A2A callers: send the payload as a DATA part, NOT text \u2014 parts:[{"kind":"data","data":{ ...payload above... }}]. The managed gateway adapts this canonical buyer contract to the selected backend.'
     ] : [],
     "",
     "YOUR TASK",
-    x402Only ? x402Free ? "Call the anonymous FREE /x402 endpoint directly. Do not create a payment or call the OAuth2 ERC-8183 endpoint." : "Follow the X402 SELLER activation or anonymous paid-request instructions above. Do not call the OAuth2 ERC-8183 endpoint." : "Write and run a client that (1) obtains a token, (2) calls negotiate with a sample task and prints the signed quote, (3) optionally funds a job on-chain (step 2 of the flow above) and calls notify_funded with the resulting job_id. Use the exact endpoint, headers, and message shapes above. If you don't have client_id/client_secret, ask me for them.",
+    x402Only ? x402Free ? `Call the anonymous FREE ${paymentPath} endpoint directly. Do not create a payment or call the OAuth2 ERC-8183 endpoint.` : `Follow the ${paymentProtocol.toUpperCase()} SELLER activation or anonymous paid-request instructions above. Do not call the OAuth2 ERC-8183 endpoint.` : "Write and run a client that (1) obtains a token, (2) calls negotiate with a sample task and prints the signed quote, (3) optionally funds a job on-chain (step 2 of the flow above) and calls notify_funded with the resulting job_id. Use the exact endpoint, headers, and message shapes above. If you don't have client_id/client_secret, ask me for them.",
     CLIENT_PROMPT_RULE
   ];
   const text2 = lines.join("\n");
@@ -15391,6 +15856,7 @@ async function platformInfo(opts) {
           a2a_url: access.a2aUrl,
           mcp_url: access.mcpUrl,
           x402_url: access.x402Url,
+          mpp_url: access.mppUrl,
           token_url: access.tokenUrl,
           scope: access.scope
         },
@@ -15419,10 +15885,13 @@ async function platformInfo(opts) {
       "  MCP gateway support is rolling out \u2014 the A2A face is the stable face."
     );
   }
-  if (hasX402Face(access.faces)) {
-    emit(`  ${"x402 endpoint:".padEnd(15)} ${access.x402Url ?? none}`);
+  if (hasB402PaymentFace(access.faces)) {
+    const paymentProtocol = hasMppFace(access.faces) ? "mpp" : "x402";
+    emit(
+      `  ${`${paymentProtocol} endpoint:`.padEnd(15)} ${access.mppUrl ?? access.x402Url ?? none}`
+    );
   }
-  if (!(access.faces.length === 1 && hasX402Face(access.faces))) {
+  if (!(access.faces.length === 1 && hasB402PaymentFace(access.faces))) {
     emit(
       `  ${"token endpoint:".padEnd(15)} ${access.tokenUrl}  (client_credentials)`
     );
@@ -15450,7 +15919,7 @@ async function platformDestroy(opts) {
     );
     emit(`deployment:  ${recorded.deployment_id || "<none recorded>"}`);
     emit(
-      "\nTeardown deletes the platform agent + its deployment via DELETE /v1/agents/:slug. The operator removes the transmitted runtime secret as part of that delete. The slug is permanently retired; a later redeploy must use a new slug."
+      "\nTeardown deletes the platform agent + its deployment via DELETE /v1/agents/:slug. The operator removes the transmitted runtime secret and managed deliverables as part of that delete. Deliverable URLs eventually return 404. The slug is permanently retired; a later redeploy must use a new slug."
     );
     emit(
       "\n--- always note ---\n  - your local keystore (.studio/wallets/) is left UNTOUCHED.\n  - the on-chain ERC-8004 identity CANNOT be deleted; its endpoint goes stale.\n  - the 48h trial sandbox is auto-reclaimed regardless."
@@ -15490,7 +15959,9 @@ async function platformDestroy(opts) {
     root,
     oldInvokeUrl ? String(oldInvokeUrl) : null
   );
-  emit(`\u2713 deleted platform agent ${slug} (deployment + transmitted secret).`);
+  emit(
+    `\u2713 deleted platform agent ${slug} (deployment + transmitted secret + managed deliverables). Deliverable URLs will return 404 after asynchronous cleanup.`
+  );
   emit(
     `note: the on-chain ERC-8004 identity is unchanged; its endpoint will go stale. Destroyed slugs are permanently retired, so the local slug was advanced to '${nextSlug}' \u2014 the next deploy uses it automatically. Your local keystore (.studio/wallets/) was left untouched.`
   );
@@ -15612,7 +16083,12 @@ function registerDeploy(program) {
     "--allow-multiple",
     "Allow creating a deployment while another provider remains active."
   ).option("--skip-smoke", "Skip the delegated post-deploy smoke check.").action(act((opts) => cmdDeploy(opts, [])));
-  p.command("prepare").description("Run the deploy-readiness sweep on this project.").addOption(runtimeOption()).addOption(targetAlias()).option("--project-root <path>", "Override project root.").option("--json", "Emit JSON instead of a table.").option(
+  p.command("prepare").description("Run the deploy-readiness sweep on this project.").addOption(providerOption()).addOption(
+    new Option4(
+      "--backend <backend>",
+      "Managed backend for --provider bnb (aws or azure). Selects the Platform readiness contract without deploying."
+    ).choices(["aws", "azure"])
+  ).addOption(runtimeOption()).addOption(targetAlias()).option("--project-root <path>", "Override project root.").option("--json", "Emit JSON instead of a table.").option(
     "--ignore-warnings",
     "Exit 0 even if WARNING-level checks fire (still fails on BLOCKED/CRITICAL)."
   ).option("--no-info", "Skip INFO-level checks (CI-friendly).").option(
@@ -15825,7 +16301,7 @@ function resolveTarget(opts, root, destination = agentDeployDestination(root)) {
   return readStackRuntime(root) ?? "agentcore";
 }
 function validateRuntimeAgainstStack(target, force, root) {
-  if (target === "platform") {
+  if (target === "platform" || target === "platform-azure") {
     return null;
   }
   const stackRuntime2 = readStackRuntime(root);
@@ -15857,7 +16333,49 @@ async function cmdPrepare(opts) {
     const cwd = path37.resolve(process.cwd());
     root = findStudioWorkspaceRoot3(cwd) ?? cwd;
   }
-  const target = resolveTarget(opts, root);
+  let target;
+  if (opts.provider !== void 0) {
+    if (opts.runtime !== void 0 || opts.target !== void 0) {
+      printErr(
+        "error: --provider and --runtime select different readiness axes; pass only --provider (and --backend for bnb)."
+      );
+      return 2;
+    }
+    if (opts.provider === "bnb") {
+      const stackRuntime2 = readStackRuntime(root);
+      const expectedBackend = stackRuntime2 === "azure-foundry" ? "azure" : "aws";
+      if (opts.backend !== void 0 && opts.backend !== expectedBackend) {
+        printErr(
+          `error: --backend=${opts.backend} conflicts with [stack].runtime='${stackRuntime2}', which requires backend=${expectedBackend}.`
+        );
+        return 2;
+      }
+      const backend = opts.backend ?? expectedBackend;
+      target = backend === "azure" ? "platform-azure" : "platform";
+    } else {
+      if (opts.backend !== void 0) {
+        printErr(
+          `error: --backend is accepted only with --provider bnb; --provider ${opts.provider} selects a user-owned cloud directly.`
+        );
+        return 2;
+      }
+      target = opts.provider === "azure" ? "azure-foundry" : "agentcore";
+    }
+  } else {
+    if (opts.backend !== void 0) {
+      printErr("error: --backend requires --provider bnb.");
+      return 2;
+    }
+    const destination = agentDeployDestination(root);
+    const implicitAzureTarget = opts.runtime === void 0 && opts.target === void 0 && destination !== "platform" && readStackRuntime(root) === "azure-foundry";
+    if (implicitAzureTarget) {
+      printErr(
+        "error: Azure prepare target is ambiguous. Choose the intended deployment explicitly: `bag deploy prepare --provider azure` for a user-owned Foundry deployment, or `bag deploy prepare --provider bnb --backend azure` for managed Platform Azure."
+      );
+      return 2;
+    }
+    target = resolveTarget(opts, root);
+  }
   const rc = validateRuntimeAgainstStack(target, Boolean(opts.force), root);
   if (rc !== null) {
     return rc;
@@ -15910,7 +16428,9 @@ function renderPrepareHuman(result, ignoreWarnings) {
   if (result.hasBlockers) {
     printOut("Deploy is BLOCKED. Fix the BLOCKED check(s) above first.");
   } else if (result.hasCriticals) {
-    const fixHint = result.checks.find((c2) => c2.fixCmd)?.fixCmd;
+    const fixHint = result.checks.find(
+      (c2) => c2.level === "CRITICAL" && c2.fixCmd !== void 0 && c2.fixCmd !== null && !c2.fixCmd.trimStart().startsWith("#")
+    )?.fixCmd;
     if (fixHint) {
       printOut(`Run ${fixHint} to auto-fix the first CRITICAL, then re-run.`);
     } else {
@@ -15927,14 +16447,17 @@ function renderPrepareHuman(result, ignoreWarnings) {
   }
 }
 function applyStorageGuard(result, root) {
-  const checks = [...result.checks];
-  const localCheck = storageLocalNotDeployableCheck(root);
-  if (localCheck !== null && !checks.some((c2) => c2.name === localCheck.name)) {
-    checks.push(localCheck);
+  if (result.target.startsWith("platform")) {
+    return result;
   }
-  const ipfsCheck = storageIpfsEndpointRequiredCheck(root);
-  if (ipfsCheck !== null && !hasIpfsEndpointFinding(result)) {
-    checks.push(ipfsCheck);
+  const checks = [...result.checks];
+  for (const check of fatalStorageDeployChecks(root)) {
+    if (check.name === "storage_ipfs_endpoint_required" && hasIpfsEndpointFinding(result)) {
+      continue;
+    }
+    if (!checks.some((existing) => existing.name === check.name)) {
+      checks.push(check);
+    }
   }
   if (checks.length === result.checks.length) {
     return result;
@@ -15950,6 +16473,9 @@ function warnBrokenStorageBypass(checks) {
   }
 }
 function enforceSkipPrepareStorageGate(opts, root, target) {
+  if (target.startsWith("platform")) {
+    return null;
+  }
   if (!opts.skipPrepare) {
     return null;
   }
@@ -16293,10 +16819,16 @@ async function refreshLocalDeployDependencies(root) {
   try {
     const vendored = await vendorLocalTarballs(agentRoot2, {
       force: true,
-      requiredPackages: ["@bnbagent/sdk"]
+      requiredPackages: ["@bnbagent/sdk", "@bnbagent/studio-runtime"]
     });
     if (vendored.length > 0) {
       applyWorkspaceVendorOverrides(workspaceRoot, agentRoot2);
+      if (!await provisionInstall(workspaceRoot, { force: true })) {
+        printErr(
+          "error: refreshed vendored dependencies could not be installed; refusing to package stale node_modules."
+        );
+        return 1;
+      }
       printErr(
         `note: refreshed vendored local tarball(s) in app/agent/vendor/: ${vendored.join(", ")}`
       );
@@ -16681,6 +17213,7 @@ async function printAccessNextSteps2(root, runtime, opts = {}) {
   const proto = nativeProtocolOf(faces);
   printOut("\nAccess your agent \u2014");
   if (runtime === "agentcore") {
+    const paymentProtocol = hasMppFace(faces) ? "mpp" : "x402";
     const summary = accessSummaryForAgentcore(agentRoot2, { protocol: proto });
     if (opts.invokeUrl) {
       printOut(`  endpoint: ${opts.invokeUrl}`);
@@ -16696,9 +17229,9 @@ async function printAccessNextSteps2(root, runtime, opts = {}) {
           "  call: POST a JSON-RPC message/send to .../invocations with an OAuth2 Bearer token and an X-Amzn-Bedrock-AgentCore-Runtime-Session-Id header (>=33 chars)."
         );
       }
-      if (hasA2aFace(faces) && hasMcpFace(faces) || hasX402Face(faces)) {
+      if (hasA2aFace(faces) && hasMcpFace(faces) || hasB402PaymentFace(faces)) {
         printOut(
-          "  note: /mcp and /x402 have no raw URL on self-managed AgentCore; reach them by wrapping the request as envelope-v1 JSON inside the InvokeAgentRuntime payload (see docs/guides/x402-selling.md)."
+          `  note: /mcp and /${paymentProtocol} have no raw URL on self-managed AgentCore; reach them by wrapping the request as envelope-v1 JSON inside the InvokeAgentRuntime payload (see docs/guides/${paymentProtocol === "mpp" ? "mpp-b402-selling.md" : "x402-selling.md"}).`
         );
       }
       printOut(
@@ -16718,16 +17251,19 @@ async function printAccessNextSteps2(root, runtime, opts = {}) {
   printOut(
     `  Azure Foundry access uses a Microsoft Entra bearer token. Run \`bag deploy info --provider azure --with-curl\` for the exact endpoint, token resource, and Invocations request body; see ${FOUNDRY_GUIDE_URL}.`
   );
-  if (hasX402Face(faces)) {
+  if (hasB402PaymentFace(faces)) {
+    const paymentProtocol = hasMppFace(faces) ? "mpp" : "x402";
     const summary = x402DeploySummary(agentRoot2, "self", null);
-    if (summary.startsWith("x402 rail is ACTIVE")) {
+    if (summary.startsWith(`${paymentProtocol} rail is ACTIVE`)) {
+      printOut(
+        `  ${paymentProtocol} access: requires-external-gateway \u2014 Foundry exposes no raw anonymous /${paymentProtocol} URL. An operator-run HTTPS gateway must carry each request as http-envelope-v1 over the Entra-authenticated Invocations endpoint.`
+      );
       printOut(
-        "  x402 access: requires-external-gateway \u2014 Foundry exposes no raw anonymous /x402 URL. An operator-run HTTPS gateway must carry each request as http-envelope-v1 over the Entra-authenticated Invocations endpoint."
+        `  ${paymentProtocol} gateway guide: ${paymentProtocol === "mpp" ? "docs/guides/mpp-b402-selling.md" : foundryX402GatewayGuideUrl()}`
       );
-      printOut(`  x402 gateway guide: ${foundryX402GatewayGuideUrl()}`);
     } else {
       printOut(
-        `  x402 access: dormant \u2014 ${summary || "redeploy after enabling the x402 seller rail."}`
+        `  ${paymentProtocol} access: dormant \u2014 ${summary || `redeploy after enabling the ${paymentProtocol} seller rail.`}`
       );
     }
   }
@@ -16755,6 +17291,9 @@ async function printAgentClientPrompt2(root, destination, opts = {}) {
   2) POST client_credentials -> access_token.
   3) send \`Authorization: Bearer <token>\` AND header \`X-Amzn-Bedrock-AgentCore-Runtime-Session-Id: <stable id >= 33 chars>\`.`;
   const agentCfg = loadAgentCfg2(agentRoot2) ?? {};
+  const paymentProtocol = b402PaymentProtocol(agentCfg);
+  const paymentLabel = paymentProtocol.toUpperCase();
+  const paymentPath = `/${paymentProtocol}`;
   const rails = commerceRails(agentCfg);
   const x402Free = x402SellerIsFree(agentCfg);
   const x402Only = rails.x402 && !rails.erc8183;
@@ -16762,9 +17301,9 @@ async function printAgentClientPrompt2(root, destination, opts = {}) {
   const faces = agentFacesOf(agentRoot2);
   const x402OnlyFace = !hasA2aFace(faces) && !hasMcpFace(faces);
   const a2aPayloadPhrase = x402Only ? "POST JSON-RPC payloads" : "POST the negotiate /\n        notify_funded payloads";
-  const endpointBlock = proto === "MCP" ? `  [MCP] MCP endpoint (streamable HTTP): ${mcpUrl}` : x402OnlyFace ? `  [X402] Invoke URL (POST-only): ${a2aInvokeUrl}
+  const endpointBlock = proto === "MCP" ? `  [MCP] MCP endpoint (streamable HTTP): ${mcpUrl}` : x402OnlyFace ? `  [${paymentLabel}] Invoke URL (POST-only): ${a2aInvokeUrl}
         NOTE: there is NO public A2A face and NO GET-able agent card.
-        Wrap each request as envelope-v1 JSON (see X402 SELLER below)
+        Wrap each request as envelope-v1 JSON (see ${paymentLabel} SELLER below)
         and POST it to the invoke URL above.` : `  [A2A] Invoke (JSON-RPC message/send, POST-only): ${a2aInvokeUrl}
         NOTE: this AgentCore endpoint is POST-only and serves NO
         GET-able agent card. Skip A2A discovery (do NOT fetch
@@ -16800,7 +17339,7 @@ async function printAgentClientPrompt2(root, destination, opts = {}) {
     "\u{1F4CB} COPY EVERYTHING BELOW THIS LINE INTO CLAUDE CODE OR CURSOR",
     "   \u2014 it will build and run a client that tests your deployed agent",
     CLIENT_PROMPT_RULE2,
-    x402Only ? "I deployed a BNB Chain x402 seller agent. Build a small TypeScript (fetch) client that follows the X402 SELLER instructions below." : "I deployed a BNB Chain seller agent. Build a small TypeScript (fetch) client that authenticates, calls the agent, and prints the responses.",
+    x402Only ? `I deployed a BNB Chain ${paymentProtocol} seller agent. Build a small TypeScript (fetch) client that follows the ${paymentLabel} SELLER instructions below.` : "I deployed a BNB Chain seller agent. Build a small TypeScript (fetch) client that authenticates, calls the agent, and prints the responses.",
     "",
     "WHAT WAS DEPLOYED",
     `- Protocol: ${proto}`,
@@ -16812,7 +17351,7 @@ async function printAgentClientPrompt2(root, destination, opts = {}) {
       '  3) notify_funded \u2014 send that funded job_id; the agent verifies the on-chain job, produces the deliverable, and submits it on-chain. Returns {status:"accepted", job_id}. Delivery is ASYNC.',
       "  4) poll the CHAIN for the job's SUBMITTED state to read the deliverable_url (the agent serves no job-query endpoint)."
     ] : [],
-    ...x402Summary ? ["", "X402 SELLER", ...x402Summary.split("\n")] : [],
+    ...x402Summary ? ["", `${paymentLabel} SELLER`, ...x402Summary.split("\n")] : [],
     "",
     "ENDPOINT",
     endpointBlock,
@@ -16826,14 +17365,14 @@ async function printAgentClientPrompt2(root, destination, opts = {}) {
       ...commerceShapeLines,
       ...mcpSessionLines
     ] : [
-      "- The anonymous x402 route does not use the OAuth2 token flow shown for ERC-8183."
+      `- The anonymous ${paymentProtocol} route does not use the OAuth2 token flow shown for ERC-8183.`
     ],
     ...!x402Only && proto !== "MCP" ? [
       '- A2A callers: send the payload as a DATA part, NOT text \u2014 parts:[{"kind":"data","data":{ ...payload above... }}]. A JSON string in a "text" part is rejected (the runtime only reads data parts, so no skill is parsed).'
     ] : [],
     "",
     "YOUR TASK",
-    x402Only ? x402Free ? "Call the anonymous FREE /x402 endpoint directly. Do not create a payment or call the OAuth2 ERC-8183 endpoint." : "Follow the X402 SELLER activation or anonymous paid-request instructions above. Do not call the OAuth2 ERC-8183 endpoint." : "Write and run a client that (1) obtains a token, (2) calls negotiate with a sample task and prints the signed quote, (3) optionally funds a job on-chain (step 2 of the flow above) and calls notify_funded with the resulting job_id. Use the exact endpoint, headers, and message shapes above. If you don't have client_id/client_secret, ask me for them.",
+    x402Only ? x402Free ? `Call the anonymous FREE ${paymentPath} endpoint directly. Do not create a payment or call the OAuth2 ERC-8183 endpoint.` : `Follow the ${paymentLabel} SELLER activation or anonymous paid-request instructions above. Do not call the OAuth2 ERC-8183 endpoint.` : "Write and run a client that (1) obtains a token, (2) calls negotiate with a sample task and prints the signed quote, (3) optionally funds a job on-chain (step 2 of the flow above) and calls notify_funded with the resulting job_id. Use the exact endpoint, headers, and message shapes above. If you don't have client_id/client_secret, ask me for them.",
     CLIENT_PROMPT_RULE2
   ];
   const text2 = lines.join("\n");
@@ -16850,11 +17389,16 @@ async function printAzureAgentClientPrompt(root) {
   const deployment = discoverRecordedDeployments(
     deployWorkspaceRoot2(root)
   ).find((candidate) => candidate.provider === "azure");
-  const endpoint = deployment?.endpoint ?? recordedEndpoint(root) ?? "<run `bag deploy info --provider azure` to recover the endpoint>";
+  const legacyEndpoint = deployment?.endpoint ?? recordedEndpoint(root) ?? "<run `bag deploy info --provider azure` to recover the endpoint>";
   const faces = deployment?.faces ?? agentFacesOf(agentRoot2);
-  const hasX402 = hasX402Face(faces);
+  const hasX402 = hasB402PaymentFace(faces);
+  const paymentProtocol = hasMppFace(faces) ? "mpp" : "x402";
+  const paymentLabel = paymentProtocol.toUpperCase();
   const hasA2a = hasA2aFace(faces);
-  const request = hasA2a ? JSON.stringify(azureNegotiateQuickVerifyBody()) : hasX402 ? JSON.stringify(azureX402CarrierBody()) : JSON.stringify(azureNegotiateQuickVerifyBody());
+  const a2aEndpoint = deployment?.endpoints?.a2a ?? deployment?.endpoints?.http ?? legacyEndpoint;
+  const invocationsEndpoint = deployment?.endpoints?.invocations ?? legacyEndpoint;
+  const endpoint = hasA2a ? a2aEndpoint : invocationsEndpoint;
+  const request = hasA2a ? JSON.stringify(azureA2aQuickVerifyBody()) : hasX402 ? JSON.stringify(azureX402CarrierBody(paymentProtocol)) : JSON.stringify(azureA2aQuickVerifyBody());
   const lines = [
     "",
     CLIENT_PROMPT_RULE2,
@@ -16865,21 +17409,24 @@ async function printAzureAgentClientPrompt(root) {
     "",
     "WHAT WAS DEPLOYED",
     `- Faces: ${faces.join(", ") || "unknown"}`,
-    `- Entra-authenticated Invocations endpoint: ${endpoint}`,
+    `- Entra-authenticated ${hasA2a ? "A2A" : "Invocations"} endpoint: ${endpoint}`,
+    ...hasA2a && hasX402 ? [
+      `- Entra-authenticated ${paymentLabel} Invocations endpoint: ${invocationsEndpoint}`
+    ] : [],
     `- Token scope: ${AZURE_FOUNDRY_TOKEN_SCOPE}`,
-    "- This is not an anonymous buyer URL. A public x402 buyer requires an external HTTPS gateway in front of Foundry.",
+    `- This is not an anonymous buyer URL. A public ${paymentProtocol} buyer requires an external HTTPS gateway in front of Foundry.`,
     "",
     "REQUEST",
     `- POST application/json: ${request}`,
-    ...hasA2a ? ["- The input field contains the JSON-stringified negotiate payload."] : [],
+    ...hasA2a ? ["- Send `A2A-Version: 1.0` with the native JSON-RPC A2A request."] : [],
     ...hasX402 ? [
       ...hasA2a ? [
-        `- X402 carrier alternative: ${JSON.stringify(azureX402CarrierBody())}`
+        `- ${paymentLabel} carrier alternative: ${JSON.stringify(azureX402CarrierBody(paymentProtocol))}`
       ] : [],
       "- The outer object is http-envelope-v1. Build it with:",
       '  const inner = { prompt: "Say hi in one short sentence." };',
       '  const body = Buffer.from(JSON.stringify(inner)).toString("base64");',
-      "- The outer response is another HTTP envelope. Decode response.body from base64 before parsing the inner x402 JSON."
+      `- The outer response is another HTTP envelope. Decode response.body from base64 before parsing the inner ${paymentProtocol} response.`
     ] : [],
     "",
     "AUTHENTICATION AND LOGS",
@@ -17154,11 +17701,12 @@ function printVerifyCurl(access) {
   const scope = access.scope;
   const tokenUrl = access.tokenUrl;
   const invokeUrl = `${access.base}/v1/rt/${agentId}`;
-  if (access.faces.length === 1 && hasX402Face(access.faces)) {
+  if (access.faces.length === 1 && hasB402PaymentFace(access.faces)) {
+    const paymentProtocol = hasMppFace(access.faces) ? "mpp" : "x402";
     printOut(
       `
-Quick-verify x402 endpoint:
-  curl -i ${invokeUrl}/x402  # expect payment requirements until an x402 client pays`
+Quick-verify ${paymentProtocol} endpoint:
+  curl -i ${invokeUrl}/${paymentProtocol}  # expect payment requirements until an ${paymentProtocol} client pays`
     );
     return;
   }
@@ -17234,11 +17782,32 @@ function azureNegotiateQuickVerifyBody() {
     })
   };
 }
-function azureX402CarrierBody() {
+function azureA2aQuickVerifyBody() {
+  return {
+    jsonrpc: "2.0",
+    id: "bag-quick-verify",
+    method: "message/send",
+    params: {
+      message: {
+        messageId: "bag-quick-verify",
+        role: "user",
+        parts: [
+          {
+            kind: "text",
+            text: JSON.stringify(
+              JSON.parse(azureNegotiateQuickVerifyBody().input)
+            )
+          }
+        ]
+      }
+    }
+  };
+}
+function azureX402CarrierBody(protocol = "x402") {
   return {
     v: 1,
     method: "POST",
-    path: "/x402",
+    path: protocol === "mpp" ? "/mpp" : "/x402",
     query: {},
     headers: { "content-type": "application/json" },
     body: Buffer.from(
@@ -17257,8 +17826,12 @@ function sameX402Snapshot(a, b) {
   return a.status === b.status && a.priceMode === b.priceMode && a.credentialsComplete === b.credentialsComplete;
 }
 function printAzureInfo(root, deployment, opts) {
-  const endpoint = deployment.endpoint;
-  if (!endpoint) {
+  const legacyEndpoint = deployment.endpoint;
+  const httpEndpoint = deployment.endpoints?.http ?? legacyEndpoint;
+  const invocationsEndpoint = deployment.endpoints?.invocations ?? null;
+  const a2aEndpoint = deployment.endpoints?.a2a ?? null;
+  const agentCardEndpoint = deployment.endpoints?.agentCard ?? null;
+  if (!legacyEndpoint && !httpEndpoint && !invocationsEndpoint && !a2aEndpoint) {
     if (opts.json) {
       printOut(
         JSON.stringify(
@@ -17266,7 +17839,12 @@ function printAzureInfo(root, deployment, opts) {
             provider: "azure",
             target: deployment.target,
             name: deployment.name,
-            endpoint: null,
+            endpoints: {
+              http: null,
+              invocations: null,
+              a2a: null,
+              agent_card: null
+            },
             error: "No Azure invocation endpoint is recorded."
           },
           null,
@@ -17283,15 +17861,19 @@ function printAzureInfo(root, deployment, opts) {
   const agentRoot2 = findSubProjectRoot16("agent", root) ?? root;
   const currentFaces = agentFacesOf(agentRoot2);
   const faces = deployment.faces ?? currentFaces;
+  const paymentProtocol = hasMppFace(faces) ? "mpp" : "x402";
+  const paymentLabel = paymentProtocol.toUpperCase();
   const facesSource = deployment.faces ? "deployment-record" : "current-scaffold";
   const facesDrift = deployment.faces !== void 0 && !sameFaces(deployment.faces, currentFaces);
-  const hasX402 = hasX402Face(faces);
+  const hasX402 = hasB402PaymentFace(faces);
   const hasA2a = hasA2aFace(faces);
-  const currentX402 = hasX402Face(currentFaces) ? x402DeploymentSnapshot(agentRoot2, "self") : null;
+  const endpoint = hasA2a ? a2aEndpoint ?? httpEndpoint ?? legacyEndpoint ?? invocationsEndpoint : hasX402 ? invocationsEndpoint ?? legacyEndpoint ?? httpEndpoint ?? a2aEndpoint : legacyEndpoint ?? httpEndpoint ?? a2aEndpoint ?? invocationsEndpoint;
+  const x402Endpoint = invocationsEndpoint ?? legacyEndpoint;
+  const currentX402 = hasB402PaymentFace(currentFaces) ? x402DeploymentSnapshot(agentRoot2, "self") : null;
   const x402State = deployment.x402 ?? currentX402;
   const x402StateSource = deployment.x402 ? "deployment-record" : "current-scaffold";
   const x402Drift = deployment.x402 !== void 0 && !sameX402Snapshot(deployment.x402, currentX402);
-  const currentCarrier = hasX402Face(currentFaces) ? inspectAzureX402Carrier(agentRoot2).status : null;
+  const currentCarrier = hasB402PaymentFace(currentFaces) ? inspectAzureX402Carrier(agentRoot2).status : null;
   const carrierDrift = deployment.x402Carrier !== void 0 && deployment.x402Carrier !== currentCarrier;
   const configurationDrift = facesDrift || x402Drift || carrierDrift;
   const carrierVerified = deployment.x402Carrier === "http-envelope-v1";
@@ -17299,11 +17881,12 @@ function printAzureInfo(root, deployment, opts) {
     deployment.x402,
     "azure-foundry",
     "self",
-    null
-  ) : x402DeploySummary(agentRoot2, "self", null) : deployment.x402Carrier === "incompatible-scaffold" ? "The deployed Azure entrypoint did not mount createEnvelopeMiddleware and X402Seller. Re-scaffold the unified entrypoint, review the diff, and redeploy." : "This deployment record predates X402 carrier verification, so the deployed artifact cannot be treated as X402-capable. Verify or migrate the unified entrypoint and redeploy." : "";
-  const x402Status = carrierVerified ? x402State?.status ?? (x402Summary.includes("ACTIVE in FREE mode") ? "free" : x402Summary.startsWith("x402 rail is ACTIVE") ? "active" : "dormant") : "incompatible-scaffold";
-  const x402Body = hasX402 && carrierVerified ? azureX402CarrierBody() : void 0;
-  const body = hasA2a ? azureNegotiateQuickVerifyBody() : x402Body;
+    null,
+    paymentProtocol
+  ) : x402DeploySummary(agentRoot2, "self", null) : deployment.x402Carrier === "incompatible-scaffold" ? "The deployed Azure entrypoint did not mount createEnvelopeMiddleware and B402Seller. Re-scaffold the unified entrypoint, review the diff, and redeploy." : `This deployment record predates ${paymentLabel} carrier verification, so the deployed artifact cannot be treated as ${paymentLabel}-capable. Verify or migrate the unified entrypoint and redeploy.` : "";
+  const x402Status = carrierVerified ? x402State?.status ?? (x402Summary.includes("ACTIVE in FREE mode") ? "free" : x402Summary.startsWith(`${paymentProtocol} rail is ACTIVE`) ? "active" : "dormant") : "incompatible-scaffold";
+  const x402Body = hasX402 && carrierVerified ? azureX402CarrierBody(paymentProtocol) : void 0;
+  const body = hasA2a ? azureA2aQuickVerifyBody() : x402Body;
   const x402Info = hasX402 ? carrierVerified ? {
     status: x402Status,
     access: x402Status === "dormant" ? "dormant" : "requires-external-gateway",
@@ -17314,6 +17897,7 @@ function printAzureInfo(root, deployment, opts) {
     state_source: x402StateSource,
     ...x402Status === "dormant" ? {} : {
       request: {
+        endpoint: x402Endpoint,
         method: "POST",
         content_type: "application/json",
         body: x402Body,
@@ -17336,6 +17920,12 @@ function printAzureInfo(root, deployment, opts) {
           name: deployment.name,
           deployment_id: deployment.deploymentId,
           endpoint,
+          endpoints: {
+            http: httpEndpoint,
+            invocations: invocationsEndpoint,
+            a2a: a2aEndpoint,
+            agent_card: agentCardEndpoint
+          },
           faces,
           faces_source: facesSource,
           configuration_drift: configurationDrift,
@@ -17349,7 +17939,7 @@ function printAzureInfo(root, deployment, opts) {
             content_type: "application/json",
             body
           } : null,
-          ...x402Info ? { x402: x402Info } : {}
+          ...x402Info ? { [paymentProtocol]: x402Info } : {}
         },
         null,
         2
@@ -17358,7 +17948,17 @@ function printAzureInfo(root, deployment, opts) {
     return 0;
   }
   printOut("bag deploy info \u2014 Azure Foundry self-deploy");
-  printOut(`  endpoint: ${endpoint}`);
+  if (httpEndpoint) printOut(`  HTTP endpoint: ${httpEndpoint}`);
+  if (invocationsEndpoint) {
+    printOut(`  Invocations tunnel endpoint: ${invocationsEndpoint}`);
+  }
+  if (a2aEndpoint) printOut(`  A2A endpoint: ${a2aEndpoint}`);
+  if (agentCardEndpoint) {
+    printOut(`  Agent Card endpoint: ${agentCardEndpoint}`);
+  }
+  if (!httpEndpoint && !invocationsEndpoint && !a2aEndpoint && endpoint) {
+    printOut(`  endpoint: ${endpoint}`);
+  }
   printOut(`  deployed faces: ${faces.join(", ")} (${facesSource})`);
   if (configurationDrift) {
     printErr(
@@ -17373,31 +17973,38 @@ function printAzureInfo(root, deployment, opts) {
     printOut(`  body: ${JSON.stringify(body)}`);
   } else {
     printOut(
-      "  request: unavailable until the X402 scaffold is migrated and redeployed"
+      `  request: unavailable until the ${paymentLabel} scaffold is migrated and redeployed`
     );
   }
   if (x402Info) {
     if (x402Info.access === "incompatible-scaffold") {
-      printOut(`  x402 access: incompatible-scaffold \u2014 ${x402Info.summary}`);
+      printOut(
+        `  ${paymentProtocol} access: incompatible-scaffold \u2014 ${x402Info.summary}`
+      );
     } else if (x402Info.access === "dormant") {
-      printOut(`  x402 access: dormant \u2014 ${x402Info.summary}`);
+      printOut(`  ${paymentProtocol} access: dormant \u2014 ${x402Info.summary}`);
     } else {
       printOut(
-        "  x402 access: requires-external-gateway (the Foundry endpoint has no raw anonymous /x402 URL)"
+        `  ${paymentProtocol} access: requires-external-gateway (the Foundry endpoint has no raw anonymous /${paymentProtocol} URL)`
       );
       printOut(
-        "  x402 carrier: http-envelope-v1 over this Entra-authenticated Invocations endpoint"
+        `  ${paymentProtocol} carrier: http-envelope-v1 over this Entra-authenticated Invocations endpoint`
       );
       if (hasA2a && x402Body) {
         printOut(
-          `  x402 request example: ${JSON.stringify(x402Body)} (expect work in FREE mode or 402 before payment in PAID mode)`
+          `  ${paymentProtocol} request example: ${JSON.stringify(x402Body)} (expect work in FREE mode or 402 before payment in PAID mode)`
         );
       }
-      printOut(`  x402 gateway guide: ${foundryX402GatewayGuideUrl()}`);
+      printOut(
+        `  ${paymentProtocol} gateway guide: ${paymentProtocol === "mpp" ? "docs/guides/mpp-b402-selling.md" : foundryX402GatewayGuideUrl()}`
+      );
     }
   }
   if (opts.withCurl && body) {
-    printOut(hasA2a ? "\nQuick-verify curl:" : "\nX402 request curl:");
+    printOut(
+      hasA2a ? "\nQuick-verify curl:" : `
+${paymentLabel} request curl:`
+    );
     printOut(
       `  AZURE_TOKEN=$(az account get-access-token --resource ${AZURE_FOUNDRY_TOKEN_RESOURCE} --query accessToken -o tsv)`
     );
@@ -17406,7 +18013,7 @@ function printAzureInfo(root, deployment, opts) {
     printOut(
       `  AZURE_RESPONSE=$(curl -sS -D "$AZURE_HEADERS" -X POST "$AZURE_ENDPOINT" \\
     -H "Authorization: Bearer $AZURE_TOKEN" \\
-    -H "Content-Type: application/json" \\
+    -H "Content-Type: application/json"${hasA2a ? ' \\\n    -H "A2A-Version: 1.0"' : ""} \\
     -d '${JSON.stringify(body)}')`
     );
     printOut('  printf "%s\\n" "$AZURE_RESPONSE"');
@@ -17417,7 +18024,8 @@ function printAzureInfo(root, deployment, opts) {
     printOut('  bag deploy logs --provider azure --session "$AZURE_SESSION"');
     if (!hasA2a && x402Body) {
       printOut(
-        "\n  Decode response.body from base64 to read the inner x402 JSON."
+        `
+  Decode response.body from base64 to read the inner ${paymentProtocol} response.`
       );
       printOut(
         `  node -e 'const outer=JSON.parse(process.argv[1]); console.log(Buffer.from(outer.body,"base64").toString("utf8"))' "$AZURE_RESPONSE"`
@@ -17428,7 +18036,7 @@ function printAzureInfo(root, deployment, opts) {
     );
   } else if (opts.withCurl) {
     printErr(
-      "warning: no X402 curl was emitted because the recorded Azure deployment does not prove http-envelope-v1 support; migrate and redeploy first."
+      `warning: no ${paymentLabel} curl was emitted because the recorded Azure deployment does not prove http-envelope-v1 support; migrate and redeploy first.`
     );
   }
   return 0;
@@ -17697,7 +18305,7 @@ import {
   BSC_TESTNET_MIN_U,
   BSC_TESTNET_U_FAUCET_URL as BSC_TESTNET_U_FAUCET_URL3,
   ERC8183_SUBMIT_GAS_RESERVE_BNB,
-  fromRaw as fromRaw3,
+  fromRaw as fromRaw4,
   getNetwork as getNetwork9,
   tbnbFaucetHint as tbnbFaucetHint3
 } from "@bnbagent/studio-runtime/networks";
@@ -17720,6 +18328,13 @@ var SECRET_ENV_KEYS = [
   "WALLET_PASSWORD",
   "PIEVERSE_LLM_API_KEY",
   "STORAGE_API_KEY",
+  "DELIVERABLE_S3_ACCESS_KEY_ID",
+  "DELIVERABLE_S3_SECRET_ACCESS_KEY",
+  "DELIVERABLE_S3_SESSION_TOKEN",
+  "DELIVERABLE_AZURE_SAS_TOKEN",
+  "DELIVERABLE_AZURE_TENANT_ID",
+  "DELIVERABLE_AZURE_CLIENT_ID",
+  "DELIVERABLE_AZURE_CLIENT_SECRET",
   "TWAK_ACCESS_ID",
   "TWAK_HMAC_SECRET",
   "TURNKEY_API_PRIVATE_KEY"
@@ -17799,11 +18414,11 @@ async function cmdDoctor(opts) {
   );
   checks.push(...checkPriceBounds(data));
   checks.push(...checkX402Seller(data, projectRoot));
-  checks.push(...checkStorage(data));
+  const destination = String(tableOf14(data, "deploy").destination ?? "self").trim().toLowerCase();
+  checks.push(...checkStorage(data, destination));
   checks.push(...await checkBalances(projectRoot, data, opts.network));
   checks.push(...await checkPieverseMainnetU(projectRoot, data));
   checks.push(...await check8004(projectRoot, data, opts.network));
-  const destination = String(tableOf14(data, "deploy").destination ?? "self").trim().toLowerCase();
   checks.push(...await checkDeployTools(data, destination));
   checks.push(
     ...await checkPlatformZipBundle(data, destination, projectRoot)
@@ -18185,7 +18800,7 @@ async function checkWalletAltana(walletCfg, projectRoot, data) {
         allowanceRaw > 0n ? {
           name: "[wallet] Altana x402 buying",
           status: PASS,
-          detail: `U\u2192Permit2 allowance ${fromRaw3(allowanceRaw, uToken.decimals)} U on ${networkName} (b402 permit2 rail armed)`
+          detail: `U\u2192Permit2 allowance ${fromRaw4(allowanceRaw, uToken.decimals)} U on ${networkName} (b402 permit2 rail armed)`
         } : {
           name: "[wallet] Altana x402 buying",
           status: WARN,
@@ -18621,19 +19236,21 @@ function checkPriceBounds(data) {
 }
 function checkX402Seller(data, agentRoot2) {
   const payments = tableOf14(data, "payments");
-  const sellerValue = payments.x402_seller;
+  const sellerValue = payments.b402_seller !== void 0 ? payments.b402_seller : payments.x402_seller;
   if (sellerValue === null || typeof sellerValue !== "object" || Array.isArray(sellerValue)) {
     return [];
   }
   const seller = sellerValue;
   if (seller.enabled !== true) return [];
+  const paymentProtocol = b402PaymentProtocol(data);
+  const paymentPath = paymentProtocol === "mpp" ? "/mpp" : "/x402";
   const pricing = x402SellerPricingState(seller);
   if (pricing.kind === "invalid") {
     return [
       {
         name: "x402 pricing",
         status: FAIL,
-        detail: "[payments.x402_seller].price_usd must be a non-negative decimal string."
+        detail: "[payments.b402_seller].price_usd must be a non-negative decimal string."
       }
     ];
   }
@@ -18645,7 +19262,7 @@ function checkX402Seller(data, agentRoot2) {
       {
         name: "x402 pricing",
         status: PASS,
-        detail: "FREE \u2014 /x402 is anonymous; B402 verify/settle, token payment, and settlement audit are bypassed."
+        detail: `FREE \u2014 ${paymentPath} is anonymous; B402 verify/settle, token payment, and settlement audit are bypassed.`
       }
     ];
     const credentials2 = b402Credentials(agentRoot2);
@@ -18660,7 +19277,13 @@ function checkX402Seller(data, agentRoot2) {
       out2.push({
         name: "x402 runtime",
         status: fallbackStatus,
-        detail: `${runtime} has no /x402 route; FREE pricing does not remove that runtime limitation.`
+        detail: `${runtime} has no ${paymentPath} route; FREE pricing does not remove that runtime limitation.`
+      });
+    } else if (runtime === "azure-foundry") {
+      out2.push({
+        name: "x402 ingress",
+        status: INFO,
+        detail: `Azure Foundry runs ${paymentPath} through http-envelope-v1; anonymous access requires an operator-run external gateway.`
       });
     } else if (runtime === "azure-foundry") {
       out2.push({
@@ -18694,11 +19317,32 @@ function checkX402Seller(data, agentRoot2) {
       detail: credentials.any ? `B402 credentials are partial; set BASE_URL, CLIENT_ID, ACCESS_TOKEN, and exactly one private-key form. Confirm they were issued for this exact agent wallet and environment; never reuse them across wallets. Apply: ${B402_DEVELOPER_ACCOUNT_URL}` : `PAID mode needs the four B402 merchant credentials; without them the rail starts dormant. ${B402_PAID_ONBOARDING_GUIDANCE}`
     });
   }
+  if (paymentProtocol === "mpp") {
+    const envPath = envLocalPath18(agentRoot2);
+    const secretKey = process.env.MPP_SECRET_KEY || getEnvVar(envPath, "MPP_SECRET_KEY");
+    const realm = process.env.MPP_REALM || getEnvVar(envPath, "MPP_REALM");
+    out.push({
+      name: "MPP challenge key",
+      status: secretKey && Buffer.byteLength(secretKey, "utf8") >= 32 ? PASS : fallbackStatus,
+      detail: secretKey && Buffer.byteLength(secretKey, "utf8") >= 32 ? "MPP_SECRET_KEY has at least 32 bytes." : "PAID MPP+B402 requires MPP_SECRET_KEY with at least 32 UTF-8 bytes."
+    });
+    out.push({
+      name: "MPP realm",
+      status: realm ? PASS : fallbackStatus,
+      detail: realm ? `MPP_REALM=${realm}` : "PAID MPP+B402 requires a stable MPP_REALM hostname."
+    });
+  }
   if (!X402_CAPABLE_RUNTIMES.has(runtime)) {
     out.push({
       name: "x402 runtime",
       status: fallbackStatus,
-      detail: `${runtime} has no /x402 route; deploy this rail to AgentCore.`
+      detail: `${runtime} has no ${paymentPath} route; deploy this rail to AgentCore.`
+    });
+  } else if (runtime === "azure-foundry") {
+    out.push({
+      name: "x402 ingress",
+      status: INFO,
+      detail: `Azure Foundry runs ${paymentPath} through http-envelope-v1; anonymous access requires an operator-run external gateway.`
     });
   } else if (runtime === "azure-foundry") {
     out.push({
@@ -18709,8 +19353,18 @@ function checkX402Seller(data, agentRoot2) {
   }
   return out;
 }
-function checkStorage(data) {
-  const kind = String(tableOf14(data, "storage").kind ?? "local").toLowerCase();
+function checkStorage(data, destination = "self") {
+  const storage = tableOf14(data, "storage");
+  const kind = String(storage.kind ?? "local").toLowerCase();
+  if (destination === "platform") {
+    return [
+      {
+        name: "storage (managed platform)",
+        status: INFO,
+        detail: "deliverable storage is managed by the Platform; user-owned S3/Azure configuration and credentials are not required."
+      }
+    ];
+  }
   if (kind === "ipfs") {
     if (!process.env.STORAGE_API_URL) {
       return [
@@ -18738,6 +19392,68 @@ function checkStorage(data) {
       }
     ];
   }
+  if (kind === "s3") {
+    const missingConfig = ["bucket", "region"].filter(
+      (key) => !String(storage[key] ?? "").trim()
+    );
+    const ambient = String(storage.credential_mode ?? "env") === "ambient";
+    const missingSecrets = ambient ? [] : [
+      "DELIVERABLE_S3_ACCESS_KEY_ID",
+      "DELIVERABLE_S3_SECRET_ACCESS_KEY"
+    ].filter((key) => !process.env[key]);
+    if (missingConfig.length > 0 || missingSecrets.length > 0) {
+      return [
+        {
+          name: "storage (s3)",
+          status: WARN,
+          detail: `kind=s3 is incomplete; missing ${[
+            ...missingConfig.map((key) => `[storage].${key}`),
+            ...missingSecrets
+          ].join(
+            ", "
+          )}. Use namespaced credentials or set credential_mode='ambient' for a user-owned runtime identity.`
+        }
+      ];
+    }
+    return [
+      {
+        name: "storage (s3)",
+        status: PASS,
+        detail: `kind=s3; bucket/region configured; credentials=${ambient ? "ambient identity" : "injected secret"}; public URL=${storage.public_base_url ? "custom base" : "native S3"}`
+      }
+    ];
+  }
+  if (kind === "azure-blob") {
+    const missingConfig = ["account_url", "container"].filter(
+      (key) => !String(storage[key] ?? "").trim()
+    );
+    const ambient = String(storage.credential_mode ?? "env") === "ambient";
+    const hasSas = Boolean(process.env.DELIVERABLE_AZURE_SAS_TOKEN);
+    const servicePrincipalKeys = [
+      "DELIVERABLE_AZURE_TENANT_ID",
+      "DELIVERABLE_AZURE_CLIENT_ID",
+      "DELIVERABLE_AZURE_CLIENT_SECRET"
+    ];
+    const hasServicePrincipal = servicePrincipalKeys.every(
+      (key) => process.env[key]
+    );
+    if (missingConfig.length > 0 || !ambient && !hasSas && !hasServicePrincipal) {
+      return [
+        {
+          name: "storage (azure-blob)",
+          status: WARN,
+          detail: `kind=azure-blob is incomplete${missingConfig.length > 0 ? `; missing ${missingConfig.map((key) => `[storage].${key}`).join(", ")}` : ""}. Configure DELIVERABLE_AZURE_SAS_TOKEN, a complete namespaced service-principal credential set, or credential_mode='ambient'.`
+        }
+      ];
+    }
+    return [
+      {
+        name: "storage (azure-blob)",
+        status: PASS,
+        detail: `kind=azure-blob; account/container configured; credentials=${ambient ? "ambient identity" : hasSas ? "SAS secret" : "service principal"}; public URL=${storage.public_base_url ? "custom base" : "native Blob"}`
+      }
+    ];
+  }
   if (kind === "local") {
     return [
       {
@@ -18751,7 +19467,7 @@ function checkStorage(data) {
     {
       name: "storage",
       status: WARN,
-      detail: `unknown [storage].kind "${kind}" \u2014 falls back to local storage. Set kind = "ipfs" (any pinning service / self-hosted node) or "local".`
+      detail: `unknown [storage].kind "${kind}" \u2014 falls back to local storage. Set kind = "ipfs", "s3", "azure-blob", or "local".`
     }
   ];
 }
@@ -18897,7 +19613,7 @@ async function checkPieverseMainnetU(projectRoot, data) {
       return [];
     }
     const raw = await readUBalanceRaw(addr, pvNetwork) ?? 0n;
-    const human = Number.parseFloat(fromRaw3(raw, uToken.decimals));
+    const human = Number.parseFloat(fromRaw4(raw, uToken.decimals));
     if (human < threshold) {
       return [
         {
@@ -19274,7 +19990,7 @@ import {
   updateServiceEndpoint as updateServiceEndpoint2
 } from "@bnbagent/studio-runtime/erc8004";
 import {
-  fromRaw as fromRaw4,
+  fromRaw as fromRaw5,
   getNetwork as getNetwork10,
   tbnbFaucetHint as tbnbFaucetHint4
 } from "@bnbagent/studio-runtime/networks";
@@ -19401,9 +20117,9 @@ function resolveProtocol(override) {
     return "A2A";
   }
   const faces = stackFaces(tableOf15(cfg, "stack"), tableOf15(cfg, "payments"));
-  if (faces.length === 1 && hasX402Face(faces)) {
+  if (faces.length === 1 && hasB402PaymentFace(faces)) {
     printErr(
-      "warning: this X402-only project has no public ERC-8004 protocol face; A2A is only the internal AgentCore protocol declaration."
+      `warning: this ${faces[0]}-only project has no public ERC-8004 protocol face; A2A is only the internal AgentCore protocol declaration.`
     );
   }
   return nativeProtocolOf(faces);
@@ -19428,7 +20144,7 @@ async function precheckRegisterGas(wallet, network) {
   let balance;
   try {
     const raw = await readNativeBalanceRaw(wallet.address, network);
-    balance = Number.parseFloat(fromRaw4(raw, 18));
+    balance = Number.parseFloat(fromRaw5(raw, 18));
   } catch (exc) {
     printErr(
       `warning: could not read ${wallet.address} balance to pre-check gas (${errMsg4(exc)}); proceeding.`
@@ -20592,12 +21308,517 @@ function registerUninstall(program) {
   );
 }
 
-// src/cli/platform.ts
+// src/cli/mpp.ts
+import * as fs42 from "fs";
 import * as path43 from "path";
+import { maskUrlSecrets, recordChainOp } from "@bnbagent/studio-runtime/audit";
+import {
+  findProjectRoot as findProjectRoot6,
+  loadStudioToml as loadStudioToml23
+} from "@bnbagent/studio-runtime/config";
+import {
+  MppBuyerPolicy,
+  fetchMppWithPayment,
+  quoteMppUrl
+} from "@bnbagent/studio-runtime/mpp";
+import { getNetwork as getNetwork11 } from "@bnbagent/studio-runtime/networks";
+import * as walletRt8 from "@bnbagent/studio-runtime/wallet";
+import {
+  SELLER_TOKENS,
+  caip2,
+  usdToAtomic
+} from "@bnbagent/studio-runtime/x402";
+import { getAddress as getAddress3, isAddress } from "viem";
+
+// src/cli/_signingTrust.ts
+import { getAddress as getAddress2 } from "viem";
+function table(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function trustEip712Domain(text2, cfg, network, asset) {
+  const wallet = table(cfg.wallet);
+  const walletKind2 = String(wallet.kind ?? "evm-local");
+  if (walletKind2 !== "evm-local") return text2;
+  const match = /^eip155:(\d+)$/.exec(network);
+  if (match === null) {
+    throw new Error(`cannot trust a non-EVM signing domain: ${network}`);
+  }
+  const chainId = Number(match[1]);
+  if (!Number.isSafeInteger(chainId) || chainId <= 0) {
+    throw new Error(`cannot trust invalid EIP-155 chain id: ${network}`);
+  }
+  const address = getAddress2(asset);
+  const signing = table(wallet.signing);
+  const rawDomains = signing.extra_domains ?? [];
+  if (!Array.isArray(rawDomains)) {
+    throw new Error("[wallet.signing].extra_domains must be an array");
+  }
+  const domains = rawDomains.map((entry, index) => {
+    if (!Array.isArray(entry) || entry.length !== 2) {
+      throw new Error(
+        `[wallet.signing].extra_domains[${index}] must be a [chain_id, address] pair`
+      );
+    }
+    const existingChainId = Number(entry[0]);
+    const existingAddress = getAddress2(String(entry[1]));
+    return [existingChainId, existingAddress];
+  });
+  const alreadyTrusted = domains.some(
+    (entry) => Array.isArray(entry) && Number(entry[0]) === chainId && String(entry[1]).toLowerCase() === address.toLowerCase()
+  );
+  if (alreadyTrusted) return text2;
+  return updateSection(text2, "wallet.signing", {
+    extra_domains: [...domains, [chainId, address]]
+  });
+}
+
+// src/cli/mpp.ts
+function registerMpp(program) {
+  const mpp = program.command("mpp").description("Native MPP+B402 payment client helpers.");
+  mpp.action(
+    act(() => {
+      printOut(
+        "bag mpp: pick a sub-command. Try `bag mpp quote --help`, `bag mpp buy --help`, or `bag mpp trust --help`."
+      );
+      return 0;
+    })
+  );
+  mpp.command("quote").description("Probe a native MPP+B402 URL without paying.").argument("<url>", "Absolute URL of the MPP-protected resource.").option("--network <name>", "Override [network].default.").option("--method <verb>", "HTTP verb (default: GET).", "GET").option("--json <body>", "JSON object body.").option("--local-dev", "DEV ONLY: permit an untrusted loopback target.").action(
+    act(
+      (url, opts) => cmdQuote(url, opts)
+    )
+  );
+  mpp.command("buy").description("Pay a native MPP+B402 charge with $U via EIP-3009.").argument("<url>", "Absolute URL of the MPP-protected resource.").requiredOption(
+    "--max-usd <n>",
+    "Hard per-request USD cap.",
+    Number.parseFloat
+  ).option("--network <name>", "Override [network].default.").option("--method <verb>", "HTTP verb (default: GET).", "GET").option("--json <body>", "JSON object body.").option(
+    "--local-dev",
+    "DEV ONLY: permit loopback and pin recipient/realm from its live challenge."
+  ).action(
+    act(
+      (url, opts) => cmdBuy2(url, opts)
+    )
+  );
+  mpp.command("trust").description(
+    "Probe and pin an MPP merchant's domain, realm, recipient, asset, and per-call cap."
+  ).argument("<url>", "Full https:// MPP-protected URL.").option(
+    "--cap <usd>",
+    "Per-call cap (default: live price).",
+    Number.parseFloat
+  ).option("--name <key>", "Merchant config key (default: derived from host).").option(
+    "--pay-to <addr>",
+    "Expected recipient; must match the live challenge."
+  ).option(
+    "--realm <realm>",
+    "Expected MPP realm; must match the live challenge."
+  ).option(
+    "--network <name>",
+    "Settlement network (default: project network)."
+  ).option("--method <verb>", "Probe this HTTP verb first.").option("--yes", "Write without interactive confirmation.").action(
+    act(
+      (url, opts) => cmdTrust(url, opts)
+    )
+  );
+}
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function printMppError(error) {
+  const name = error instanceof Error ? error.name : "";
+  printErr(
+    name.startsWith("Mpp") ? `error: ${name}: ${errorMessage(error)}` : `error: ${errorMessage(error)}`
+  );
+}
+function tableOf16(cfg, key) {
+  const value = cfg[key];
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : {};
+}
+function loadPolicy2() {
+  const root = findProjectRoot6();
+  if (root === null) {
+    printErr("error: no studio.toml found in cwd or any parent.");
+    return null;
+  }
+  try {
+    const cfg = loadStudioToml23(path43.join(root, "studio.toml"));
+    return { root, cfg, policy: MppBuyerPolicy.fromToml(cfg) };
+  } catch (error) {
+    printErr(`error: failed to load studio.toml: ${errorMessage(error)}`);
+    return null;
+  }
+}
+function resolveNetwork3(cfg, override) {
+  return override ?? String(tableOf16(cfg, "network").default ?? "bsc-mainnet");
+}
+function hostOf(url) {
+  try {
+    return new URL(url).hostname.toLowerCase();
+  } catch {
+    return "";
+  }
+}
+function loopback(host) {
+  return ["localhost", "127.0.0.1", "::1"].includes(
+    host.replace(/^\[|\]$/g, "").toLowerCase()
+  );
+}
+function hostAllowed(url, policy) {
+  const host = hostOf(url);
+  return policy.effectiveAllowedHosts.some(
+    (allowed) => allowed.toLowerCase() === host
+  );
+}
+function parseJson(raw) {
+  if (raw === void 0) return null;
+  const value = JSON.parse(raw);
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new Error("--json must decode to a JSON object");
+  }
+  return value;
+}
+function assertLocalDev(url, enabled) {
+  if (enabled && !loopback(hostOf(url))) {
+    printErr("error: --local-dev applies to loopback targets only.");
+    return false;
+  }
+  return true;
+}
+async function cmdQuote(url, opts) {
+  const loaded = loadPolicy2();
+  if (loaded === null) return 1;
+  const localDev = opts.localDev ?? false;
+  if (!assertLocalDev(url, localDev)) return 2;
+  if (!localDev && !hostAllowed(url, loaded.policy)) {
+    printErr(
+      `error: MPP host '${hostOf(url) || url}' is not trusted; run \`bag mpp trust <url>\` first.`
+    );
+    return 1;
+  }
+  try {
+    const quote = await quoteMppUrl(url, {
+      method: opts.method,
+      jsonBody: parseJson(opts.json),
+      networkName: resolveNetwork3(loaded.cfg, opts.network),
+      policy: loaded.policy,
+      allowedHosts: localDev ? null : void 0,
+      allowInsecureLoopback: localDev
+    });
+    printOut(JSON.stringify(quote, jsonReplacer, 2));
+    return quote.challenge === null && quote.statusCode === 402 ? 1 : 0;
+  } catch (error) {
+    printMppError(error);
+    return error instanceof SyntaxError ? 2 : 1;
+  }
+}
+async function cmdBuy2(url, opts) {
+  const loaded = loadPolicy2();
+  if (loaded === null) return 1;
+  if (!Number.isFinite(opts.maxUsd) || opts.maxUsd <= 0) {
+    printErr("error: --max-usd must be a positive number.");
+    return 2;
+  }
+  const localDev = opts.localDev ?? false;
+  if (!assertLocalDev(url, localDev)) return 2;
+  if (!localDev && !hostAllowed(url, loaded.policy)) {
+    printErr(
+      `error: MPP host '${hostOf(url) || url}' is not trusted; run \`bag mpp trust <url>\` first.`
+    );
+    return 1;
+  }
+  let jsonBody;
+  try {
+    jsonBody = parseJson(opts.json);
+  } catch (error) {
+    printErr(`error: ${errorMessage(error)}`);
+    return 2;
+  }
+  const networkName = resolveNetwork3(loaded.cfg, opts.network);
+  let expectedRecipient = null;
+  let expectedRealm = null;
+  if (localDev) {
+    try {
+      const quote = await quoteMppUrl(url, {
+        method: opts.method,
+        jsonBody,
+        networkName,
+        policy: loaded.policy,
+        allowedHosts: null,
+        allowInsecureLoopback: true
+      });
+      if (quote.challenge === null) {
+        printErr(
+          "error: loopback target returned no payable MPP+B402 challenge."
+        );
+        return 1;
+      }
+      expectedRecipient = quote.challenge.recipient;
+      expectedRealm = quote.challenge.realm;
+      printOut(
+        `\u26A0 DEV-ONLY: accepting live recipient ${expectedRecipient} and realm '${expectedRealm}'. Never use this outside your own machine.`
+      );
+    } catch (error) {
+      printMppError(error);
+      return 1;
+    }
+  }
+  let wallet;
+  try {
+    wallet = walletRt8.getWallet();
+  } catch (error) {
+    printErr(`error: wallet unavailable: ${errorMessage(error)}`);
+    return 1;
+  }
+  if (typeof wallet.supports === "function" && !wallet.supports("sign.typed_data")) {
+    printErr(
+      "error: MPP+B402 buying requires wallet capability sign.typed_data; use wallet.kind = 'evm-local'."
+    );
+    return 1;
+  }
+  const network = getNetwork11(networkName);
+  const token = SELLER_TOKENS[caip2(network.chainId)];
+  if (!token) {
+    printErr(`error: MPP+B402 has no trusted buyer token on ${networkName}.`);
+    return 1;
+  }
+  try {
+    const current = await readTokenBalanceRaw(
+      wallet.address,
+      token.address,
+      networkName
+    );
+    const needed = BigInt(
+      usdToAtomic(decimalText(opts.maxUsd, token.decimals), token.decimals)
+    );
+    if (current < needed) {
+      printErr(
+        `error: insufficient B402 $U on ${networkName}; current=${current} atomic, needed=${needed} atomic.`
+      );
+      return 1;
+    }
+  } catch (error) {
+    printErr(`error: B402 $U balance check failed: ${errorMessage(error)}`);
+    return 1;
+  }
+  const commonAudit = {
+    chainId: network.chainId,
+    asset: "U",
+    agentAddr: wallet.address,
+    projectRoot: loaded.root
+  };
+  const auditUrl = maskUrlSecrets(url);
+  recordChainOp("mpp_buy", {
+    ...commonAudit,
+    amount: String(opts.maxUsd),
+    txHash: null,
+    status: "submitted",
+    context: { url: auditUrl, method: opts.method }
+  });
+  let result;
+  try {
+    result = await fetchMppWithPayment(url, {
+      wallet,
+      maxUsd: opts.maxUsd,
+      networkName,
+      method: opts.method,
+      jsonBody,
+      policy: loaded.policy,
+      allowedHosts: localDev ? null : void 0,
+      allowInsecureLoopback: localDev,
+      expectedRecipient,
+      expectedRealm
+    });
+  } catch (error) {
+    const unknown = error instanceof Error && error.name === "MppPaymentOutcomeUnknownError";
+    const amount = unknown && typeof error.amountUsd === "number" ? String(error.amountUsd) : String(opts.maxUsd);
+    recordChainOp("mpp_buy", {
+      ...commonAudit,
+      amount,
+      txHash: null,
+      status: unknown ? "unknown" : "failed",
+      context: {
+        url: auditUrl,
+        method: opts.method,
+        payment_outcome: unknown ? "unknown" : "not-dispatched",
+        error: errorMessage(error).slice(0, 200)
+      }
+    });
+    printMppError(error);
+    if (unknown) printErr("Do not retry blindly; reconcile the payment first.");
+    return 1;
+  }
+  const txHash = transactionReference(result.receipt?.reference);
+  recordChainOp("mpp_buy", {
+    ...commonAudit,
+    amount: String(result.paidUsd ?? 0),
+    txHash,
+    status: result.paymentOutcome === "unknown" ? "unknown" : "confirmed",
+    counterparty: result.challenge?.recipient ?? null,
+    context: {
+      url: auditUrl,
+      method: opts.method,
+      payment_outcome: result.paymentOutcome,
+      ...result.receipt?.reference ? { payment_reference: result.receipt.reference } : {}
+    }
+  });
+  printResult(result);
+  const ok = result.statusCode >= 200 && result.statusCode < 300;
+  return ok && result.paymentOutcome !== "unknown" ? 0 : 1;
+}
+async function cmdTrust(url, opts) {
+  const loaded = loadPolicy2();
+  if (loaded === null) return 1;
+  const host = hostOf(url);
+  const localHttp = url.startsWith("http://") && loopback(host);
+  if (!url.startsWith("https://") && !localHttp || !host) {
+    printErr(
+      "error: trust requires an absolute https:// URL; http:// is allowed only for loopback development."
+    );
+    return 1;
+  }
+  const networkName = resolveNetwork3(loaded.cfg, opts.network);
+  const probed = await probe(url, networkName, opts.method, localHttp);
+  if (probed === null) return 1;
+  const { offer, method } = probed;
+  if (opts.payTo && (!isAddress(opts.payTo) || getAddress3(opts.payTo) !== offer.recipient)) {
+    printErr(
+      `error: live recipient ${offer.recipient} does not match --pay-to ${opts.payTo}.`
+    );
+    return 1;
+  }
+  if (opts.realm && opts.realm.trim().toLowerCase() !== offer.realm) {
+    printErr(
+      `error: live realm '${offer.realm}' does not match --realm '${opts.realm}'.`
+    );
+    return 1;
+  }
+  const cap = opts.cap ?? offer.amountUsd;
+  if (!Number.isFinite(cap) || cap < offer.amountUsd) {
+    printErr(
+      `error: cap must be at least the live price $${offer.amountUsd.toFixed(6)}.`
+    );
+    return 1;
+  }
+  const key = opts.name ?? host.replaceAll(".", "-");
+  printOut(`Merchant:  ${host} (UNREVIEWED)`);
+  printOut(`  Realm:   ${offer.realm}`);
+  printOut(`  payTo:   ${offer.recipient}`);
+  printOut(`  Asset:   ${offer.asset} on ${offer.network}`);
+  printOut(`  Method:  b402.charge / ${offer.transferMethod}`);
+  printOut(`  Price:   $${offer.amountUsd.toFixed(6)}`);
+  printOut(`  Cap:     $${cap.toFixed(6)}`);
+  printOut(
+    "  \u26A0 The endpoint is not Studio-reviewed. Verify realm and recipient out-of-band before trusting."
+  );
+  if (!await confirm(opts.yes ?? false)) {
+    printOut("aborted \u2014 nothing written.");
+    return 1;
+  }
+  try {
+    const tomlPath = path43.join(loaded.root, "studio.toml");
+    const text2 = fs42.readFileSync(tomlPath, "utf8");
+    const fields = {
+      domain: host,
+      realm: offer.realm,
+      pay_to: offer.recipient,
+      network: offer.network,
+      asset: offer.asset,
+      per_call_cap_usd: cap,
+      verified: false
+    };
+    const withMerchant = updateSection(
+      text2,
+      `payments.mpp.merchants.${key}`,
+      fields
+    );
+    fs42.writeFileSync(
+      tomlPath,
+      trustEip712Domain(withMerchant, loaded.cfg, offer.network, offer.asset),
+      "utf8"
+    );
+    printOut(`\u2713 Wrote [payments.mpp.merchants.${key}] to ${tomlPath}`);
+    const methodFlag = method === "GET" ? "" : ` --method ${method}`;
+    printOut(`  bag mpp quote ${url}${methodFlag}`);
+    printOut(`  bag mpp buy ${url} --max-usd ${cap}${methodFlag}`);
+    printOut("  bag recipe code mpp-buyer");
+    return 0;
+  } catch (error) {
+    printErr(`error: failed to write studio.toml: ${errorMessage(error)}`);
+    return 1;
+  }
+}
+async function probe(url, networkName, methodHint, allowInsecureLoopback = false) {
+  const methods = [
+    ...new Set([methodHint, "GET", "POST"].filter(Boolean))
+  ];
+  let lastError = null;
+  for (const method of methods) {
+    try {
+      const quote = await quoteMppUrl(url, {
+        method,
+        networkName,
+        policy: null,
+        allowedHosts: null,
+        allowInsecureLoopback
+      });
+      if (quote.challenge) return { offer: quote.challenge, method };
+      lastError = new Error(
+        `HTTP ${quote.statusCode} returned no b402.charge challenge`
+      );
+    } catch (error) {
+      lastError = error;
+    }
+  }
+  printErr(
+    `error: could not obtain an MPP+B402 challenge: ${errorMessage(lastError)}`
+  );
+  return null;
+}
+async function confirm(yes) {
+  if (yes) return true;
+  if (!stdinIsTty()) {
+    printErr("error: non-interactive shell; re-run with --yes after review.");
+    return false;
+  }
+  const answer = (await promptUser("Trust this MPP merchant? [y/N] ")).trim().toLowerCase();
+  return answer === "y" || answer === "yes";
+}
+function printResult(result) {
+  if (result.paymentOutcome === "confirmed") {
+    printOut(`\u2713 Paid: $${(result.paidUsd ?? 0).toFixed(6)} via MPP+B402`);
+  } else if (result.paymentOutcome === "unknown") {
+    printErr(
+      "error: payment credential was dispatched but no successful B402 receipt was returned; outcome unknown. Do not retry blindly."
+    );
+  } else {
+    printOut(`\u2713 No payment required (HTTP ${result.statusCode}).`);
+  }
+  printOut(`  URL:       ${result.url}`);
+  printOut(`  Status:    ${result.statusCode}`);
+  if (result.receipt?.reference) {
+    printOut(`  Reference: ${result.receipt.reference}`);
+  }
+  const body = result.json ? JSON.stringify(result.json, null, 2) : result.content.toString("utf8");
+  printOut(
+    `  Response:  ${body.slice(0, 200).replaceAll("\n", "\n             ")}`
+  );
+}
+function transactionReference(value) {
+  return value && /^0x[0-9a-fA-F]{64}$/.test(value) ? value : null;
+}
+function decimalText(value, decimals) {
+  return value.toFixed(decimals).replace(/(?:\.0+|(?:(\.\d*?)0+))$/, "$1");
+}
+function jsonReplacer(_key, value) {
+  return Buffer.isBuffer(value) ? value.toString("utf8") : value;
+}
+
+// src/cli/platform.ts
+import * as path44 from "path";
 import {
   STUDIO_TOML as STUDIO_TOML2,
   findSubProjectRoot as findSubProjectRoot18,
-  loadStudioToml as loadStudioToml23
+  loadStudioToml as loadStudioToml24
 } from "@bnbagent/studio-runtime/config";
 var ACCOUNT_SLUG = "studio-platform";
 var PlatformUsageError = class extends Error {
@@ -20796,10 +22017,10 @@ function localPlatformCfg() {
   if (agentRoot2 === null) {
     return [null, {}];
   }
-  const tomlPath = path43.join(agentRoot2, STUDIO_TOML2);
+  const tomlPath = path44.join(agentRoot2, STUDIO_TOML2);
   let cfg;
   try {
-    cfg = loadStudioToml23(tomlPath);
+    cfg = loadStudioToml24(tomlPath);
   } catch {
     return [null, {}];
   }
@@ -20830,14 +22051,14 @@ function findAgentId(data) {
       tables.push(nested);
     }
   }
-  for (const table of tables) {
+  for (const table2 of tables) {
     for (const key of ["agent_id", "agentId"]) {
-      const value = table[key];
+      const value = table2[key];
       if (typeof value === "string" && value) {
         return value;
       }
     }
-    const scope = table.scope;
+    const scope = table2.scope;
     if (typeof scope === "string" && scope.includes("invoke:")) {
       const id = scope.split("invoke:").pop() ?? "";
       if (id) {
@@ -20869,8 +22090,8 @@ function formatRemaining(seconds) {
 }
 
 // src/cli/recipe.ts
-import * as fs42 from "fs";
-import * as path44 from "path";
+import * as fs43 from "fs";
+import * as path45 from "path";
 import { parse as parse6 } from "smol-toml";
 function registerRecipe(program) {
   const p = program.command("recipe").description("Print recipe code/files (agent / wallet / 8004).");
@@ -21000,7 +22221,7 @@ function resolvePkgContext(explicit) {
   let data;
   try {
     data = parse6(
-      fs42.readFileSync(path44.join(projectRoot, "studio.toml"), "utf-8")
+      fs43.readFileSync(path45.join(projectRoot, "studio.toml"), "utf-8")
     );
   } catch {
     return [null, null];
@@ -21018,8 +22239,8 @@ function resolvePkgContext(explicit) {
 }
 
 // src/cli/scan.ts
-import * as fs43 from "fs";
-import * as path45 from "path";
+import * as fs44 from "fs";
+import * as path46 from "path";
 import { Option as Option8 } from "commander";
 import { parse as parse7 } from "smol-toml";
 function registerScan(program) {
@@ -21036,7 +22257,7 @@ function registerScan(program) {
           "note: `--json` is deprecated (JSON is the default output); ignoring."
         );
       }
-      const root = path45.resolve(opts.path ?? process.cwd());
+      const root = path46.resolve(opts.path ?? process.cwd());
       const report = scanProject(root);
       if (opts.text) {
         process.stdout.write(formatText(report));
@@ -21050,24 +22271,24 @@ function registerScan(program) {
 }
 function isFile19(p) {
   try {
-    return fs43.statSync(p).isFile();
+    return fs44.statSync(p).isFile();
   } catch {
     return false;
   }
 }
 function isDir10(p) {
   try {
-    return fs43.statSync(p).isDirectory();
+    return fs44.statSync(p).isDirectory();
   } catch {
     return false;
   }
 }
 function layerBase(root) {
-  return isDir10(path45.join(root, "app", "agent")) ? path45.join(root, "app") : root;
+  return isDir10(path46.join(root, "app", "agent")) ? path46.join(root, "app") : root;
 }
 function safeReadJson(p) {
   try {
-    const data = JSON.parse(fs43.readFileSync(p, "utf-8"));
+    const data = JSON.parse(fs44.readFileSync(p, "utf-8"));
     return data !== null && typeof data === "object" && !Array.isArray(data) ? data : null;
   } catch {
     return null;
@@ -21075,7 +22296,7 @@ function safeReadJson(p) {
 }
 function safeReadToml(p) {
   try {
-    return parse7(fs43.readFileSync(p, "utf-8"));
+    return parse7(fs44.readFileSync(p, "utf-8"));
   } catch {
     return null;
   }
@@ -21105,33 +22326,33 @@ function resolvePackageName(projectName2, root) {
   if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(candidate)) {
     return null;
   }
-  if (!isDir10(path45.join(root, candidate))) {
+  if (!isDir10(path46.join(root, candidate))) {
     return null;
   }
   return candidate;
 }
 function inferLayout(root) {
-  const agentDir = path45.join(layerBase(root), "agent");
-  const hasAgent = isFile19(path45.join(agentDir, "main.ts")) || isFile19(path45.join(agentDir, "main.py"));
+  const agentDir = path46.join(layerBase(root), "agent");
+  const hasAgent = isFile19(path46.join(agentDir, "main.ts")) || isFile19(path46.join(agentDir, "main.py"));
   return {
     has_agent: hasAgent,
     has_agent_descriptor: isFile19(
-      path45.join(root, "agentcore", "agentcore.json")
+      path46.join(root, "agentcore", "agentcore.json")
     ),
     role: hasAgent ? "agent" : "none"
   };
 }
 function inferPackageManager(root, hasPackageJson) {
-  if (isFile19(path45.join(root, "pnpm-lock.yaml"))) {
+  if (isFile19(path46.join(root, "pnpm-lock.yaml"))) {
     return "pnpm";
   }
-  if (isFile19(path45.join(root, "yarn.lock"))) {
+  if (isFile19(path46.join(root, "yarn.lock"))) {
     return "yarn";
   }
-  if (isFile19(path45.join(root, "bun.lockb"))) {
+  if (isFile19(path46.join(root, "bun.lockb"))) {
     return "bun";
   }
-  if (isFile19(path45.join(root, "package-lock.json"))) {
+  if (isFile19(path46.join(root, "package-lock.json"))) {
     return "npm";
   }
   if (hasPackageJson) {
@@ -21144,7 +22365,7 @@ function inferRecipes(root, studioData, layout) {
   if (layout.has_agent) {
     recipes.push("agent");
   }
-  const walletsDir = path45.join(root, ".studio", "wallets");
+  const walletsDir = path46.join(root, ".studio", "wallets");
   const walletSection = studioData?.wallet;
   const hasWalletSection = walletSection !== null && typeof walletSection === "object" && !Array.isArray(walletSection);
   if (isDir10(walletsDir) && hasWalletSection) {
@@ -21153,13 +22374,13 @@ function inferRecipes(root, studioData, layout) {
   return recipes;
 }
 function scanProject(root) {
-  const studioToml = path45.join(root, "studio.toml");
-  const packageJson = path45.join(root, "package.json");
-  const agentcoreJson = path45.join(root, "agentcore", "agentcore.json");
+  const studioToml = path46.join(root, "studio.toml");
+  const packageJson = path46.join(root, "package.json");
+  const agentcoreJson = path46.join(root, "agentcore", "agentcore.json");
   const hasStudioToml = isFile19(studioToml);
   const hasPackageJson = isFile19(packageJson);
   const hasAgentcoreJson = isFile19(agentcoreJson);
-  const hasDotStudioDir = isDir10(path45.join(root, ".studio"));
+  const hasDotStudioDir = isDir10(path46.join(root, ".studio"));
   const pkgData = hasPackageJson ? safeReadJson(packageJson) : null;
   const studioData = hasStudioToml ? safeReadToml(studioToml) : null;
   const rawName = pkgData?.name;
@@ -21216,23 +22437,23 @@ function formatText(report) {
 }
 
 // src/cli/x402.ts
-import * as fs44 from "fs";
-import * as path46 from "path";
+import * as fs45 from "fs";
+import * as path47 from "path";
 import { auditedOp as auditedOp4 } from "@bnbagent/studio-runtime/audit";
 import {
   envLocalPath as envLocalPath19,
-  findProjectRoot as findProjectRoot6,
-  loadStudioToml as loadStudioToml24
+  findProjectRoot as findProjectRoot7,
+  loadStudioToml as loadStudioToml25
 } from "@bnbagent/studio-runtime/config";
-import { fromRaw as fromRaw5, getNetwork as getNetwork11 } from "@bnbagent/studio-runtime/networks";
-import * as walletRt8 from "@bnbagent/studio-runtime/wallet";
+import { fromRaw as fromRaw6, getNetwork as getNetwork12 } from "@bnbagent/studio-runtime/networks";
+import * as walletRt9 from "@bnbagent/studio-runtime/wallet";
 import {
-  SELLER_TOKENS,
+  SELLER_TOKENS as SELLER_TOKENS2,
   X402BuyerPolicy,
   X402SellerPolicy,
   _parseAccepted,
   _probeB402Supported,
-  caip2,
+  caip2 as caip22,
   fetchWithPayment,
   quoteUrl
 } from "@bnbagent/studio-runtime/x402";
@@ -21305,7 +22526,7 @@ function registerX402(program) {
     "DEV ONLY: skip the host allowlist for a localhost/127.0.0.1 target."
   ).action(
     act(
-      (url, opts) => cmdQuote(url, opts)
+      (url, opts) => cmdQuote2(url, opts)
     )
   );
   p.command("buy").description("Pay an x402-protected URL with $U via EIP-3009.").argument("<url>", "Absolute URL of the x402-protected resource.").requiredOption(
@@ -21323,7 +22544,7 @@ function registerX402(program) {
     "DEV ONLY: for a localhost/127.0.0.1 target, skip the host allowlist and accept the challenge's payTo as the recipient (printed loudly)."
   ).action(
     act(
-      (url, opts) => cmdBuy2(url, opts)
+      (url, opts) => cmdBuy3(url, opts)
     )
   );
   p.command("trust").description(
@@ -21349,7 +22570,7 @@ function registerX402(program) {
     "Skip the interactive confirmation (required in non-interactive shells)."
   ).action(
     act(
-      (merchant, opts) => cmdTrust(merchant, opts)
+      (merchant, opts) => cmdTrust2(merchant, opts)
     )
   );
   const sell = p.command("sell").description("Configure and inspect the B402-backed x402 seller rail.");
@@ -21365,7 +22586,7 @@ function registerX402(program) {
   ).action(act((opts) => cmdSellInit(opts.priceUsd)));
   sell.command("status").description("Show x402 seller config and B402 capability status.").option("--no-probe", "Skip the authenticated B402 /supported probe.").action(act((opts) => cmdSellStatus(opts.probe)));
 }
-function hostOf(url) {
+function hostOf2(url) {
   try {
     return (new URL(url).hostname || "").toLowerCase();
   } catch {
@@ -21390,13 +22611,13 @@ function printLocalDevHint(url) {
   );
 }
 function checkHostAllowed(url, allowedHosts) {
-  const host = hostOf(url);
+  const host = hostOf2(url);
   const allowedLower = new Set(
     allowedHosts.map((h) => String(h).toLowerCase())
   );
   return allowedLower.has(host);
 }
-function tableOf16(cfg, key) {
+function tableOf17(cfg, key) {
   const v = cfg[key];
   return v !== null && typeof v === "object" && !Array.isArray(v) ? v : {};
 }
@@ -21404,14 +22625,14 @@ function effectiveAllowedHosts(cfg) {
   return [...X402BuyerPolicy.fromToml(cfg).effectiveAllowedHosts];
 }
 function loadX402Policy() {
-  const root = findProjectRoot6();
+  const root = findProjectRoot7();
   if (root === null) {
     printErr("error: no studio.toml found in cwd or any parent.");
     return null;
   }
   let cfg;
   try {
-    cfg = loadStudioToml24(path46.join(root, "studio.toml"));
+    cfg = loadStudioToml25(path47.join(root, "studio.toml"));
   } catch (exc) {
     printErr(`error: failed to parse studio.toml: ${errMsg6(exc)}`);
     return null;
@@ -21419,23 +22640,23 @@ function loadX402Policy() {
   return [root, cfg, effectiveAllowedHosts(cfg)];
 }
 function loadSellerConfig() {
-  const root = findProjectRoot6();
+  const root = findProjectRoot7();
   if (root === null) {
     printErr("error: no studio.toml found in cwd or any parent.");
     return null;
   }
   try {
-    return [root, loadStudioToml24(path46.join(root, "studio.toml"))];
+    return [root, loadStudioToml25(path47.join(root, "studio.toml"))];
   } catch (exc) {
     printErr(`error: failed to parse studio.toml: ${errMsg6(exc)}`);
     return null;
   }
 }
-function resolveNetwork3(cfg, override) {
+function resolveNetwork4(cfg, override) {
   if (override) {
     return override;
   }
-  const net2 = tableOf16(cfg, "network").default;
+  const net2 = tableOf17(cfg, "network").default;
   return net2 ? String(net2) : "bsc-mainnet";
 }
 function parseJsonBody(raw) {
@@ -21455,7 +22676,7 @@ function parseJsonBody(raw) {
 }
 function resolveWallet2() {
   try {
-    return walletRt8.getWallet();
+    return walletRt9.getWallet();
   } catch (exc) {
     printErr(`error: wallet unavailable: ${errMsg6(exc)}`);
     return null;
@@ -21471,9 +22692,13 @@ async function cmdSellInit(priceFlag) {
   const loaded = loadSellerConfig();
   if (loaded === null) return 1;
   const [root, cfg] = loaded;
-  const tomlPath = path46.join(root, "studio.toml");
-  const original = fs44.readFileSync(tomlPath, "utf8");
-  const sellerExists = hasSection(original, "payments.x402_seller");
+  const tomlPath = path47.join(root, "studio.toml");
+  const original = fs45.readFileSync(tomlPath, "utf8");
+  const canonicalExists = hasSection(original, "payments.b402_seller");
+  const legacyExists = hasSection(original, "payments.x402_seller");
+  const sellerExists = canonicalExists || legacyExists;
+  const sellerSection = legacyExists ? "payments.x402_seller" : "payments.b402_seller";
+  const paymentProtocol = b402PaymentProtocol(cfg);
   let priceUsd;
   try {
     priceUsd = priceFlag !== void 0 ? normalizeB402PriceUsd(priceFlag) : sellerExists ? X402SellerPolicy.fromToml(cfg).priceUsd : await resolveSellInitPrice(stdinIsTty());
@@ -21482,7 +22707,7 @@ async function cmdSellInit(priceFlag) {
     return 2;
   }
   const free = x402SellerPricingState({ price_usd: priceUsd }).kind === "free";
-  const walletKind2 = String(tableOf16(cfg, "wallet").kind ?? "evm-local");
+  const walletKind2 = String(tableOf17(cfg, "wallet").kind ?? "evm-local");
   if (!free && !["evm-local", "twak", "turnkey", "altana"].includes(walletKind2)) {
     printErr(
       `error: the b402 seller rail supports wallet.kind evm-local, twak, turnkey or altana only; '${walletKind2}' cannot act as the b402 payout wallet.`
@@ -21490,9 +22715,9 @@ async function cmdSellInit(priceFlag) {
     return 1;
   }
   if (!sellerExists) {
-    fs44.writeFileSync(
+    fs45.writeFileSync(
       tomlPath,
-      updateSection(original, "payments.x402_seller", {
+      updateSection(original, sellerSection, {
         enabled: true,
         price_usd: priceUsd,
         assets: ["U"],
@@ -21502,9 +22727,9 @@ async function cmdSellInit(priceFlag) {
       "utf8"
     );
   } else if (priceFlag !== void 0) {
-    fs44.writeFileSync(
+    fs45.writeFileSync(
       tomlPath,
-      updateSection(original, "payments.x402_seller", {
+      updateSection(original, sellerSection, {
         price_usd: priceUsd
       }),
       "utf8"
@@ -21513,21 +22738,24 @@ async function cmdSellInit(priceFlag) {
   const envPath = envLocalPath19(root);
   for (const key of B402_ENV_KEYS) {
     const existing = getEnvVar(envPath, key);
-    if (key === "B402_BASE_URL" && !free && resolveNetwork3(cfg).toLowerCase() === "bsc-testnet" && !process.env.B402_BASE_URL && !existing) {
-      setEnvVar(envPath, key, DEFAULT_B402_TESTNET_BASE_URL);
-    } else if (existing === null) {
+    if (existing === null) {
       setEnvVar(envPath, key, "");
     }
   }
+  if (paymentProtocol === "mpp") {
+    for (const key of ["MPP_SECRET_KEY", "MPP_REALM"]) {
+      if (getEnvVar(envPath, key) === null) setEnvVar(envPath, key, "");
+    }
+  }
   printOut(
-    free ? "\u2713 x402 seller config is ready in FREE mode; B402 credentials are not required." : "\u2713 x402 seller config and B402 placeholders are ready for PAID mode."
+    free ? `\u2713 ${paymentProtocol.toUpperCase()} seller config is ready in FREE mode; B402 credentials are not required.` : `\u2713 ${paymentProtocol.toUpperCase()} seller config and credential placeholders are ready for PAID mode.`
   );
   if (!free) {
     printOut(`Next: ${B402_PAID_ONBOARDING_GUIDANCE}`);
   }
   if (free) {
     printErr(
-      "warning: /x402 is an anonymous FREE endpoint; B402 verify/settle and payment audit are bypassed."
+      `warning: /${paymentProtocol} is an anonymous FREE endpoint; B402 verify/settle and payment audit are bypassed.`
     );
   }
   return 0;
@@ -21552,7 +22780,7 @@ async function resolveSellInitPrice(isTty) {
   }
   return DEFAULT_B402_PRICE_USD;
 }
-async function cmdSellStatus(probe) {
+async function cmdSellStatus(probe2) {
   const loaded = loadSellerConfig();
   if (loaded === null) return 1;
   const [, cfg] = loaded;
@@ -21560,7 +22788,7 @@ async function cmdSellStatus(probe) {
   try {
     policy = X402SellerPolicy.fromToml(cfg);
   } catch (exc) {
-    printErr(`error: invalid [payments.x402_seller]: ${errMsg6(exc)}`);
+    printErr(`error: invalid B402 seller config: ${errMsg6(exc)}`);
     return 1;
   }
   const presence = {
@@ -21590,7 +22818,7 @@ async function cmdSellStatus(probe) {
   if (policy.enabled && !free && !credentialsComplete) {
     printOut(`Onboarding: ${B402_PAID_ONBOARDING_GUIDANCE}`);
   }
-  if (!probe) {
+  if (!probe2) {
     printOut("B402 probe: skipped (--no-probe)");
     return 0;
   }
@@ -21602,9 +22830,9 @@ async function cmdSellStatus(probe) {
     printOut("B402 probe: skipped (rail disabled or credentials incomplete)");
     return 0;
   }
-  const networkName = resolveNetwork3(cfg);
-  const network = caip2(getNetwork11(networkName).chainId);
-  const token = SELLER_TOKENS[network];
+  const networkName = resolveNetwork4(cfg);
+  const network = caip22(getNetwork12(networkName).chainId);
+  const token = SELLER_TOKENS2[network];
   if (!token) {
     printOut(`B402 probe: mismatch for ${network}; no pinned U token`);
     return 0;
@@ -21634,7 +22862,7 @@ async function cmdSellStatus(probe) {
   }
   return 0;
 }
-async function cmdQuote(url, opts) {
+async function cmdQuote2(url, opts) {
   const loaded = loadX402Policy();
   if (loaded === null) {
     return 1;
@@ -21647,12 +22875,12 @@ async function cmdQuote(url, opts) {
     printErr(`error: ${errMsg6(exc)}`);
     return 2;
   }
-  if (opts.localDev && !isLoopbackHost(hostOf(url))) {
+  if (opts.localDev && !isLoopbackHost(hostOf2(url))) {
     printErr("error: --local-dev applies to localhost/127.0.0.1 targets only.");
     return 2;
   }
   if (!opts.localDev && !checkHostAllowed(url, hosts)) {
-    printScopeError(hostOf(url) || url, url);
+    printScopeError(hostOf2(url) || url, url);
     return 1;
   }
   let body;
@@ -21688,18 +22916,18 @@ async function cmdQuote(url, opts) {
   }
   return 0;
 }
-async function cmdBuy2(url, opts) {
+async function cmdBuy3(url, opts) {
   const loaded = loadX402Policy();
   if (loaded === null) {
     return 1;
   }
   const [, cfg, hosts] = loaded;
-  if (opts.localDev && !isLoopbackHost(hostOf(url))) {
+  if (opts.localDev && !isLoopbackHost(hostOf2(url))) {
     printErr("error: --local-dev applies to localhost/127.0.0.1 targets only.");
     return 2;
   }
   if (!opts.localDev && !checkHostAllowed(url, hosts)) {
-    printScopeError(hostOf(url) || url, url);
+    printScopeError(hostOf2(url) || url, url);
     return 1;
   }
   let jsonBody;
@@ -21709,7 +22937,7 @@ async function cmdBuy2(url, opts) {
     printErr(`error: ${errMsg6(exc)}`);
     return 2;
   }
-  const networkName = resolveNetwork3(cfg, opts.network);
+  const networkName = resolveNetwork4(cfg, opts.network);
   let localDevExpectedTo = null;
   if (opts.localDev) {
     let challenge;
@@ -21754,7 +22982,7 @@ async function cmdBuy2(url, opts) {
     );
     return 1;
   }
-  const buyWalletKind = String(tableOf16(cfg, "wallet").kind ?? "evm-local");
+  const buyWalletKind = String(tableOf17(cfg, "wallet").kind ?? "evm-local");
   if (buyWalletKind === "altana") {
     let allowanceRaw;
     try {
@@ -21768,9 +22996,9 @@ async function cmdBuy2(url, opts) {
       return 1;
     }
     if (allowanceRaw !== null && allowanceRaw < neededRaw) {
-      const uToken = getNetwork11(networkName).token("U");
+      const uToken = getNetwork12(networkName).token("U");
       printErr(
-        `error: U\u2192Permit2 allowance ${fromRaw5(allowanceRaw, uToken.decimals)} U cannot cover max_usd $${opts.maxUsd.toFixed(2)}: b402 settles Altana payments by pulling through Permit2 (${PERMIT2_ADDRESS}).`
+        `error: U\u2192Permit2 allowance ${fromRaw6(allowanceRaw, uToken.decimals)} U cannot cover max_usd $${opts.maxUsd.toFixed(2)}: b402 settles Altana payments by pulling through Permit2 (${PERMIT2_ADDRESS}).`
       );
       printErr(
         "fix: bag wallet session x402-setup --allowance-u <amount>   (admin key; approves the x402 signature checker and sets the bounded Permit2 allowance)"
@@ -21783,7 +23011,7 @@ async function cmdBuy2(url, opts) {
     result = await auditedOp4(
       "x402_buy",
       {
-        chainId: getNetwork11(networkName).chainId,
+        chainId: getNetwork12(networkName).chainId,
         asset: "U",
         amount: String(opts.maxUsd),
         agentAddr: wallet.address,
@@ -21810,7 +23038,7 @@ async function cmdBuy2(url, opts) {
     );
   } catch (exc) {
     printX402Error(exc);
-    if (errName4(exc) === "X402RecipientRequiredError" && isLoopbackHost(hostOf(url))) {
+    if (errName4(exc) === "X402RecipientRequiredError" && isLoopbackHost(hostOf2(url))) {
       printLocalDevHint(url);
     }
     return 1;
@@ -21880,7 +23108,7 @@ async function probeChallenge(url, methodHint) {
   return null;
 }
 function selectPayable(challenge, networkName) {
-  const network = getNetwork11(networkName);
+  const network = getNetwork12(networkName);
   const uToken = network.token("U");
   let matched;
   try {
@@ -21910,21 +23138,26 @@ async function confirmOrAbort(prompt, assumeYes) {
   const answer = (await promptUser(`${prompt} [y/N] `)).trim().toLowerCase();
   return answer === "y" || answer === "yes";
 }
-function writeMerchantEntry(tomlPath, fields) {
-  const text2 = fs44.readFileSync(tomlPath, "utf-8");
+function writeMerchantEntry(tomlPath, cfg, fields) {
+  const text2 = fs45.readFileSync(tomlPath, "utf-8");
   const entries = {
     domain: fields.domain,
     pay_to: fields.payTo,
     per_call_cap_usd: fields.capUsd,
     verified: fields.verified
   };
-  fs44.writeFileSync(
+  const withMerchant = updateSection(
+    text2,
+    `payments.x402.merchants.${fields.key}`,
+    entries
+  );
+  fs45.writeFileSync(
     tomlPath,
-    updateSection(text2, `payments.x402.merchants.${fields.key}`, entries),
+    trustEip712Domain(withMerchant, cfg, fields.network, fields.asset),
     "utf-8"
   );
 }
-async function cmdTrust(merchant, opts) {
+async function cmdTrust2(merchant, opts) {
   const loaded = loadX402Policy();
   if (loaded === null) {
     return 1;
@@ -21936,7 +23169,7 @@ async function cmdTrust(merchant, opts) {
   let methodHint;
   if (merchant.includes("://")) {
     probeUrl = merchant;
-    host = hostOf(probeUrl);
+    host = hostOf2(probeUrl);
     const plainHttp = probeUrl.toLowerCase().startsWith("http://");
     const localDevHttp = plainHttp && isLoopbackHost(host);
     if (!probeUrl.toLowerCase().startsWith("https://") && !localDevHttp || !host) {
@@ -21964,7 +23197,7 @@ async function cmdTrust(merchant, opts) {
     host = rec.domain;
     methodHint = rec.probeMethod;
   }
-  const networkName = opts.network || (rec ? rec.network : resolveNetwork3(cfg, null));
+  const networkName = opts.network || (rec ? rec.network : resolveNetwork4(cfg, null));
   const probed = await probeChallenge(probeUrl, methodHint);
   if (probed === null) {
     return 1;
@@ -21977,7 +23210,7 @@ async function cmdTrust(merchant, opts) {
   const [accepted, uToken] = selected2;
   const livePayTo = String(accepted.payTo);
   const priceUsd = Number.parseFloat(
-    fromRaw5(BigInt(String(accepted.amount)), uToken.decimals)
+    fromRaw6(BigInt(String(accepted.amount)), uToken.decimals)
   );
   let pinned;
   if (opts.payTo) {
@@ -22029,7 +23262,7 @@ The merchant may have rotated its address (or the response was tampered with). U
       "  \u26A0 MAINNET: calls spend real $U from the agent wallet. The cap above and [budget].max_per_day_usd bound the exposure."
     );
   }
-  const projectDefault = tableOf16(cfg, "network").default;
+  const projectDefault = tableOf17(cfg, "network").default;
   if (projectDefault && String(projectDefault) !== networkName) {
     printOut(
       `  note: your project default is ${projectDefault}; this paid capability settles on ${networkName} independently of it.`
@@ -22047,9 +23280,11 @@ The merchant may have rotated its address (or the response was tampered with). U
     printOut("aborted \u2014 nothing written.");
     return 1;
   }
-  const tomlPath = path46.join(root, "studio.toml");
+  const tomlPath = path47.join(root, "studio.toml");
   try {
-    writeMerchantEntry(tomlPath, {
+    writeMerchantEntry(tomlPath, cfg, {
+      network: String(accepted.network),
+      asset: String(accepted.asset),
       key,
       domain: host,
       payTo: pinned,
@@ -22103,6 +23338,7 @@ function buildProgram() {
   registerErc8004(program);
   registerErc8183(program);
   registerX402(program);
+  registerMpp(program);
   registerLlm(program);
   registerDoctor(program);
   registerPlatform(program);
@@ -22114,19 +23350,19 @@ function cliVersion() {
 }
 
 // src/cli/updateCheck.ts
-import * as fs45 from "fs";
+import * as fs46 from "fs";
 import * as os7 from "os";
-import * as path47 from "path";
+import * as path48 from "path";
 var PACKAGE = "@bnbagent/studio-cli";
 var REGISTRY_LATEST_URL = `https://registry.npmjs.org/${PACKAGE}/latest`;
 var CHECK_INTERVAL_SECONDS = 24 * 3600;
 var TIMEOUT_MS = 2e3;
 function cachePath(home) {
-  return path47.join(home, ".bag", "update-check.json");
+  return path48.join(home, ".bag", "update-check.json");
 }
 function loadCache(home) {
   try {
-    const data = JSON.parse(fs45.readFileSync(cachePath(home), "utf-8"));
+    const data = JSON.parse(fs46.readFileSync(cachePath(home), "utf-8"));
     return data !== null && typeof data === "object" && !Array.isArray(data) ? data : {};
   } catch {
     return {};
@@ -22135,8 +23371,8 @@ function loadCache(home) {
 function saveCache(state, home) {
   try {
     const p = cachePath(home);
-    fs45.mkdirSync(path47.dirname(p), { recursive: true });
-    fs45.writeFileSync(p, `${JSON.stringify(state, null, 2)}
+    fs46.mkdirSync(path48.dirname(p), { recursive: true });
+    fs46.writeFileSync(p, `${JSON.stringify(state, null, 2)}
 `);
   } catch {
   }