@bnbagent/studio-cli 0.0.14-alpha.6 → 0.0.14-alpha.7

package/README.md

@@ -316,7 +316,7 @@ This package is licensed under Apache-2.0 and provided **as is**, without warran
 
 ### CreateOS (NodeOps)
 
-Studio pins deploy 0.6.4 and loads its published Node.js SDK. Configure the agent:
+Studio pins deploy 0.6.6 and loads its published Node.js SDK. Configure the agent:
 
 ```toml
 [deploy.nodeops]
@@ -339,6 +339,6 @@ bag deploy destroy --provider nodeops                 # preview
 bag deploy destroy --provider nodeops --execute --yes # delete project
 ```
 
-Account mode supports ZIP/container deployment, runtime secrets and updates. An unhealthy endpoint makes deploy exit nonzero while preserving `.studio/deployments/nodeops.json`; inspect logs and retry verification. Wallet runtime variables use `settings.runEnvs` through the pinned deploy 0.6.4; the pinned SDK 0.5.7-alpha.2 supports BSC nested Permit2 signing with explicit policy opt-in. The Studio bridge now supports bounded approval transactions with an explicit gas budget during authorized payments. Hosting renewal is not yet integrated. `bag deploy wallet --json` reads Gateway chains and USDC balances without signing or paying. CreateOS uses NodeOps infrastructure; AWS and Azure providers deploy into your own cloud account.
+Account mode supports ZIP/container deployment, runtime secrets and updates. An unhealthy endpoint makes deploy exit nonzero while preserving `.studio/deployments/nodeops.json`; inspect logs and retry verification. Wallet runtime variables use `settings.runEnvs` through the pinned deploy 0.6.6; the pinned SDK 0.5.7-alpha.2 supports BSC nested Permit2 signing with explicit policy opt-in. The Studio bridge now supports bounded approval transactions with an explicit gas budget during authorized payments. Hosting renewal is not yet integrated. `bag deploy wallet --json` reads Gateway chains and USDC balances without signing or paying. CreateOS uses NodeOps infrastructure; AWS and Azure providers deploy into your own cloud account.
 
 The installed skill includes `references/bnbagent-studio-use-createos.md` with configuration, capability limits and recovery steps.

package/dist/bag.js

@@ -72,7 +72,7 @@ import {
   x402SellerIsFree,
   x402SellerPricingState,
   x402SellerUsesB402
-} from "./chunk-P4YB7JBD.js";
+} from "./chunk-DGGXWAGI.js";
 import {
   validateAgentcoreName
 } from "./chunk-U7IDQ3K5.js";
@@ -771,7 +771,7 @@ import {
 var CAMPAIGN_DOC_URL = "https://www.bnbchain.org/en/blog/bnb-agent-studio-is-live-on-bnb-chain-ai-agents-from-one-prompt";
 var CAMPAIGN_CHECK_TIMEOUT_MS = 6e3;
 async function fetchCampaignActive() {
-  const { bnbPlatformApiUrl: bnbPlatformApiUrl2 } = await import("./deployCli-3E2EMAEW.js");
+  const { bnbPlatformApiUrl: bnbPlatformApiUrl2 } = await import("./deployCli-FDDZXKMO.js");
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), CAMPAIGN_CHECK_TIMEOUT_MS);
   try {
@@ -15200,7 +15200,7 @@ async function loadNodeOpsSdk() {
       ).resolve("@bnbagent/deploy-provider-nodeops/sdk");
     } catch {
       throw new Error(
-        "Installed deploy package lacks the NodeOps Node.js SDK. Reinstall Studio with its pinned @bnbagent/deploy-cli 0.6.4 dependency."
+        "Installed deploy package lacks the NodeOps Node.js SDK. Reinstall Studio with its pinned @bnbagent/deploy-cli 0.6.6 dependency."
       );
     }
   }
@@ -15651,7 +15651,7 @@ async function inspectNodeOpsWallet(root, deps = {}) {
   const sdk = await (deps.sdk ?? loadNodeOpsSdk)();
   if (!sdk.createGatewayWalletClient)
     throw new Error(
-      "The installed deploy SDK lacks Gateway wallet queries. Reinstall Studio with its pinned deploy 0.6.4 dependency."
+      "The installed deploy SDK lacks Gateway wallet queries. Reinstall Studio with its pinned deploy 0.6.6 dependency."
     );
   const address = cfg.options.walletAddress ?? (deps.wallet ?? getWallet3)().address;
   if (typeof address !== "string" || !address)

package/dist/{chunk-P4YB7JBD.js → chunk-DGGXWAGI.js}

@@ -947,8 +947,8 @@ function packageRoot() {
   }
 }
 function studioCliVersion() {
-  if ("0.0.14-alpha.6") {
-    return "0.0.14-alpha.6";
+  if ("0.0.14-alpha.7") {
+    return "0.0.14-alpha.7";
   }
   const file = path4.join(packageRoot(), "package.json");
   const pkg = JSON.parse(fs4.readFileSync(file, "utf-8"));
@@ -1230,7 +1230,7 @@ function isTable(value) {
 }
 
 // src/cli/_deploy/deployCli.ts
-var DEPLOY_CLI_VERSION = "0.6.4";
+var DEPLOY_CLI_VERSION = "0.6.6";
 var DEPLOY_CLI_PACKAGE = `@bnbagent/deploy-cli@${DEPLOY_CLI_VERSION}`;
 var require2 = createRequire(import.meta.url);
 function resolveLocalDeployCli() {

package/dist/{deployCli-3E2EMAEW.js → deployCli-FDDZXKMO.js}

@@ -21,7 +21,7 @@ import {
   runPlatformAccountCommand,
   trialFromDeployCliJson,
   withDeployFiles
-} from "./chunk-P4YB7JBD.js";
+} from "./chunk-DGGXWAGI.js";
 export {
   BNB_PLATFORM_API_URL,
   BNB_PLATFORM_API_URL_ENV,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bnbagent/studio-cli",
-  "version": "0.0.14-alpha.6",
+  "version": "0.0.14-alpha.7",
   "description": "Skills-first toolkit and bag CLI for BNB Chain seller agents: ERC-8004 identity, ERC-8183 escrowed commerce, and x402 payments.",
   "keywords": [
     "bnb-chain",
@@ -42,7 +42,7 @@
     "bag": "./dist/bag.js"
   },
   "dependencies": {
-    "@bnbagent/deploy-cli": "0.6.4",
+    "@bnbagent/deploy-cli": "0.6.6",
     "@bnbagent/sdk": "0.5.7-alpha.2",
     "ai": "^7.0.29",
     "archiver": "^8.0.0",
@@ -55,7 +55,7 @@
     "tar": "^7.4.0",
     "viem": "^2.56.3",
     "yaml": "^2.9.0",
-    "@bnbagent/studio-runtime": "0.0.14-alpha.6"
+    "@bnbagent/studio-runtime": "0.0.14-alpha.7"
   },
   "devDependencies": {
     "@a2a-js/sdk": "^0.3.14",

package/skills/bnbagent-studio.md

@@ -67,7 +67,7 @@ Treat ERC-8183 amounts as decimal strings at CLI/config boundaries and `bigint`
 
 ## CLI groups at a glance
 
-`init`, `scan`, `recipe`, `skills`, `wallet`, `erc8004`, `erc8183`, `x402`, `mpp`, `agents`, `config`, `env`, `dev`, `doctor`, `feedback`, `audit`, `deploy`, `platform`, `llm`, `bundle`, `budget` - see `bag --help` for details. `bag deploy [--provider bnb\|aws\|azure\|nodeops] [--backend aws\|azure]` is the primary deploy command; `--backend` is valid only for provider `bnb` and confirms the recipe-derived managed backend. `prepare`, `list`, `verify`, `status`, `info`, `destroy`, `logs`, and `fix-gitignore` remain lifecycle subcommands (`deploy agent` is a deprecated compatibility alias). Provider deploy/status/logs/destroy and deploy-time credential validation are delegated to pinned `@bnbagent/deploy-cli@0.6.4`.
+`init`, `scan`, `recipe`, `skills`, `wallet`, `erc8004`, `erc8183`, `x402`, `mpp`, `agents`, `config`, `env`, `dev`, `doctor`, `feedback`, `audit`, `deploy`, `platform`, `llm`, `bundle`, `budget` - see `bag --help` for details. `bag deploy [--provider bnb\|aws\|azure\|nodeops] [--backend aws\|azure]` is the primary deploy command; `--backend` is valid only for provider `bnb` and confirms the recipe-derived managed backend. `prepare`, `list`, `verify`, `status`, `info`, `destroy`, `logs`, and `fix-gitignore` remain lifecycle subcommands (`deploy agent` is a deprecated compatibility alias). Provider deploy/status/logs/destroy and deploy-time credential validation are delegated to pinned `@bnbagent/deploy-cli@0.6.6`.
 
 ## Tool surface
 

package/skills/references/bnbagent-studio-use-aws-agentcore.md

@@ -1,6 +1,6 @@
 ---
 name: bnbagent-studio-use-aws-agentcore
-description: When the user wants to deploy or operate a bnbagent-studio project on AWS Bedrock AgentCore - deploy with `bag deploy --provider aws` (all cloud lifecycle mutations are delegated to pinned `@bnbagent/deploy-cli@0.6.4`), inspect with `bag deploy status` / `logs --provider aws` / `verify --provider aws`, and tear down with `bag deploy destroy --provider aws --execute [--purge]`. Also covers AWS credential prerequisites, the optional read-only quota probe, and the runtime-secret channel.
+description: When the user wants to deploy or operate a bnbagent-studio project on AWS Bedrock AgentCore - deploy with `bag deploy --provider aws` (all cloud lifecycle mutations are delegated to pinned `@bnbagent/deploy-cli@0.6.6`), inspect with `bag deploy status` / `logs --provider aws` / `verify --provider aws`, and tear down with `bag deploy destroy --provider aws --execute [--purge]`. Also covers AWS credential prerequisites, the optional read-only quota probe, and the runtime-secret channel.
 ---
 
 > **Reference file** of the `bnbagent-studio` router skill - installed at `bnbagent-studio/references/` and loaded on demand (not a standalone skill). Route here via the router's decision tree.

package/skills/references/bnbagent-studio-use-azure-foundry.md

@@ -1,6 +1,6 @@
 ---
 name: bnbagent-studio-use-azure-foundry
-description: When the user wants to deploy or operate a bnbagent-studio project on Azure AI Foundry Hosted Agents - scaffold with `bag init --runtime azure-foundry`, deploy either to the managed platform with `bag deploy --provider bnb --backend azure` or directly with `bag deploy --provider azure`; all cloud lifecycle execution is delegated to pinned `@bnbagent/deploy-cli@0.6.4`. Native MCP is not supported on Azure; use AgentCore for MCP.
+description: When the user wants to deploy or operate a bnbagent-studio project on Azure AI Foundry Hosted Agents - scaffold with `bag init --runtime azure-foundry`, deploy either to the managed platform with `bag deploy --provider bnb --backend azure` or directly with `bag deploy --provider azure`; all cloud lifecycle execution is delegated to pinned `@bnbagent/deploy-cli@0.6.6`. Native MCP is not supported on Azure; use AgentCore for MCP.
 ---
 
 > **Reference file** of the `bnbagent-studio` router skill - installed at `bnbagent-studio/references/` and loaded on demand (not a standalone skill). Route here via the router's decision tree.
@@ -31,7 +31,7 @@ Procedure for deploying and operating the seller Agent on **Azure AI Foundry Hos
 
 1. **Bun 1.3+ (`bunx`) on PATH** - the pinned `@bnbagent/deploy-cli` runs through it.
 2. **Docker running** - the image is built locally (linux/amd64) before push.
-3. **An Azure subscription** the operator may provision in (Foundry account/project, container registry, hosted agent). Before a local self-deploy, run `bunx --bun @bnbagent/deploy-cli@0.6.4 login --provider azure`; use OIDC/service-principal credentials in CI.
+3. **An Azure subscription** the operator may provision in (Foundry account/project, container registry, hosted agent). Before a local self-deploy, run `bunx --bun @bnbagent/deploy-cli@0.6.6 login --provider azure`; use OIDC/service-principal credentials in CI.
 
 ## ⚠️ Foundry gotchas (read before deploying)
 

package/skills/references/bnbagent-studio-use-bnb-trial.md

@@ -9,7 +9,7 @@ description: Use when deploying or operating a bnbagent-studio seller on the BNB
 
 Treat this provider as a temporary testnet sandbox. Require a throwaway wallet, keep `bsc-testnet`, and explain that the runtime signing material is transmitted to the operator's managed secret store for the trial. Never use a mainnet key. Exception: `wallet.kind='altana'` ships only the bounded, budget-limited, revocable session - the throwaway-wallet advice does not apply; tighten the session instead (`bag wallet session grant --force --budget-u <small> --expiry-days <short>`) and never run `bag wallet new` on an altana project (it breaks the session's `[wallet].address` anchor).
 
-All auth and cloud lifecycle work must cross the pinned `@bnbagent/deploy-cli@0.6.4` boundary. Do not call a cloud CLI or platform REST routes directly. The managed backend is recipe-derived: `agentcore` uses AWS; `azure-foundry` uses Azure. For headless managed Azure, confirm with `bag deploy --provider bnb --backend azure --yes`; never treat `--backend` as a cross-cloud recipe converter.
+All auth and cloud lifecycle work must cross the pinned `@bnbagent/deploy-cli@0.6.6` boundary. Do not call a cloud CLI or platform REST routes directly. The managed backend is recipe-derived: `agentcore` uses AWS; `azure-foundry` uses Azure. For headless managed Azure, confirm with `bag deploy --provider bnb --backend azure --yes`; never treat `--backend` as a cross-cloud recipe converter.
 
 ## Select and authenticate
 

package/skills/references/bnbagent-studio-use-createos.md

@@ -1,17 +1,17 @@
 ---
 name: bnbagent-studio-use-createos
-description: Deploy and operate Studio agents on CreateOS through the nodeops provider and published deploy 0.6.4 SDK. Covers account credentials, ZIP/container packaging, runtime secrets, health recovery, project lifecycle and wallet payment restrictions.
+description: Deploy and operate Studio agents on CreateOS through the nodeops provider and published deploy 0.6.6 SDK. Covers account credentials, ZIP/container packaging, runtime secrets, health recovery, project lifecycle and wallet payment restrictions.
 ---
 
 # Deploy and operate on CreateOS
 
-Use Studio's `nodeops` provider for NodeOps-hosted infrastructure. AWS and Azure providers remain separate choices for infrastructure in the user's own cloud account. Studio pins `@bnbagent/deploy-cli@0.6.4` and resolves the published `@bnbagent/deploy-provider-nodeops/sdk` through that dependency. No local deploy checkout, source override or Bun process is required for NodeOps.
+Use Studio's `nodeops` provider for NodeOps-hosted infrastructure. AWS and Azure providers remain separate choices for infrastructure in the user's own cloud account. Studio pins `@bnbagent/deploy-cli@0.6.6` and resolves the published `@bnbagent/deploy-provider-nodeops/sdk` through that dependency. No local deploy checkout, source override or Bun process is required for NodeOps.
 
 ## Check the installed CLI
 
 Run `bag --version` and `bag deploy --help`. Confirm that `nodeops` is advertised before following this reference; older Studio releases lack the adapter. If absent, use the main skill's approved upgrade workflow. Do not bypass Studio with a raw provider deployment, because it omits Studio packaging, secrets and resource records.
 
-The generic router's minimum version does not establish NodeOps compatibility. Use the release's documented CLI version with deploy 0.6.4; an alpha may be required while npm `latest` lacks this integration. Do not repeatedly install `latest` without checking its capabilities. Reuse existing installation authorization and verify the selected CLI's version and provider after installation.
+The generic router's minimum version does not establish NodeOps compatibility. Use the release's documented CLI version with deploy 0.6.6; an alpha may be required while npm `latest` lacks this integration. Do not repeatedly install `latest` without checking its capabilities. Reuse existing installation authorization and verify the selected CLI's version and provider after installation.
 
 ## Complete a build-and-deploy request
 
@@ -106,7 +106,7 @@ Deletion removes project environments too; registry images and payment history r
 
 Read this section before choosing a wallet for NodeOps. Use `evm-local` for the currently tested Studio signing path. Turnkey implements the required public signing interfaces but still needs provider-specific live acceptance testing. TWAK lacks generic EIP-712 signing; Altana's session `x402.pay` is not wired into Gateway authentication/payment. Do not silently replace an existing wallet to work around these limits.
 
-Studio pins published deploy 0.6.4, which supports runtime credentials through `settings.runEnvs`, independently of the uploaded archive. The 2026-09-10 standalone live probe confirmed Dockerfile deployment, BSC MPP settlement and runtime variable injection; the installed-package integration suite covers the Studio path with injected HTTP responses. These do not establish secret-vault encryption, redaction or variable rotation. If readiness reports an older SDK without runtime variable support, follow the approved CLI upgrade workflow; do not use a source override or embed credentials in the artifact.
+Studio pins published deploy 0.6.6, which supports runtime credentials through `settings.runEnvs`, independently of the uploaded archive. The 2026-09-10 standalone live probe confirmed Dockerfile deployment, BSC MPP settlement and runtime variable injection; the installed-package integration suite covers the Studio path with injected HTTP responses. These do not establish secret-vault encryption, redaction or variable rotation. If readiness reports an older SDK without runtime variable support, follow the approved CLI upgrade workflow; do not use a source override or embed credentials in the artifact.
 
 For evm-local workloads, runtime variables include the encrypted `WALLET_KEYSTORE_JSON` and its `WALLET_PASSWORD`. NodeOps therefore receives the material needed by the deployed agent to unlock and use that wallet. The claim "no private-key export" applies to the hosting-payment signer, not to runtime custody. Explain this boundary when choosing the deployment wallet, honor existing custody authorization and prefer a dedicated wallet for new third-party-hosted agents. Do not display or log the secret payload or imply that keystore encryption keeps it inaccessible to a runtime that also receives the password.
 
@@ -166,11 +166,11 @@ bag deploy verify --provider nodeops --skip-register
 
 `--skip-prepare` skips readiness checks only; the fatal storage guard and deploy SDK validation still run. `--force` does not override fatal storage or wallet signing checks. The explicit `--force-deploy-broken-storage` override permits knowingly deploying broken/local storage with a warning; do not add it merely to get a deployment through. `prepare --provider nodeops` selects the cloud provider, not a local runtime named nodeops.
 
-`deploy wallet` is read-only and reports on-chain USDC. `createosCredits: null` means unknown hosting credits, not zero. Funding and hidden credential entry may require the user's terminal/wallet. Base/Arbitrum require their exact USDC domain and validity-window policy instead of the BSC Permit2 configuration. `RPC_URL_BSC` overrides the default `https://bsc-dataseed.bnbchain.org`; RPC requests have bounded timeouts and do not retry broadcasts automatically.
+`deploy wallet` is read-only and reports on-chain USDC. `createosCredits: null` means unknown hosting credits, not zero. Funding and hidden credential entry may require the user's terminal/wallet. Base/Arbitrum require their exact USDC domain instead of the BSC Permit2 configuration. With deploy 0.6.6 and SDK 0.5.7-alpha.2, their MPP/x402 credential windows are rejected by the default 600-second wallet policy; treat this as a compatibility blocker and do not relax that policy or switch chains without authorization. `RPC_URL_BSC` overrides the default `https://bsc-dataseed.bnbchain.org`; RPC requests have bounded timeouts and do not retry broadcasts automatically.
 
 `--yes` confirms deployment; `--pay` additionally authorizes payment within the caps. An initial deploy POST may consume existing credits and create a project even without a payment challenge. `use_existing_credits` is the separate choice for credits shared by active projects. `auto_pay=true` additionally requires the approved `pay_to` recipient pin. It automates payment when deployment is invoked; it does not schedule renewal.
 
-Wallet deployments are create-only. Use `status` and `verify` after an acknowledged build failure, timeout or uncertain response; retain `.studio/deployments/nodeops.json` and deploy's durable journal under `~/.bnbagent-deploy/nodeops/payments/`. With deploy 0.6.4, a verified pre-broadcast failure releases the reservation and a retry can resume the same deployment. An ambiguous approval broadcast, a submitted payment, or an old reservation without preparation evidence must remain blocked for reconciliation; missing resource IDs are not proof that payment failed. All callers of a wallet must share one journal for budget aggregation and locking. Do not change names, clear the journal or submit another payment to recover an unknown outcome. Logs, existing-image deployment, named-environment management and in-place updates are not exposed by the current wallet adapter.
+Wallet deployments are create-only. Use `status` and `verify` after an acknowledged build failure, timeout or uncertain response; retain `.studio/deployments/nodeops.json` and deploy's durable journal under `~/.bnbagent-deploy/nodeops/payments/`. With deploy 0.6.6, a verified pre-broadcast failure releases the reservation and a retry can resume the same deployment. An ambiguous approval broadcast, a submitted payment, or an old reservation without preparation evidence must remain blocked for reconciliation; missing resource IDs are not proof that payment failed. All callers of a wallet must share one journal for budget aggregation and locking. Do not change names, clear the journal or submit another payment to recover an unknown outcome. Logs, existing-image deployment, named-environment management and in-place updates are not exposed by the current wallet adapter.
 
 ## When the user asks to renew