@bnbagent/studio-cli 0.0.6-alpha.1

package/dist/chunk-M3ODFCA7.js

@@ -0,0 +1,1053 @@
+#!/usr/bin/env node
+import {
+  TWAK_CLI_VERSION,
+  runCapture,
+  runCaptureOut,
+  runStream,
+  whichTwak
+} from "./chunk-7RAKL4AS.js";
+
+// src/cli/_deploy/deployCli.ts
+import * as fs4 from "fs";
+import * as os from "os";
+import * as path5 from "path";
+import {
+  findSubProjectRoot as findSubProjectRoot2,
+  loadStudioToml as loadStudioToml2
+} from "@bnbagent/studio-runtime/config";
+import { stringify as tomlStringify } from "smol-toml";
+
+// src/cli/_hosted/zipBuilder.ts
+import { createHash } from "crypto";
+import * as fs from "fs";
+import * as path from "path";
+import { build as esbuildBuild } from "esbuild";
+
+// src/cli/utils/protocol.ts
+var SUPPORTED_FACES = ["A2A", "MCP", "X402"];
+function table(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function normalizeProtocolFaces(value) {
+  const raw = typeof value === "string" ? value.split(",") : value;
+  if (!Array.isArray(raw) || raw.length === 0) {
+    throw new Error(
+      "protocol faces must be a non-empty comma list or TOML array"
+    );
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const item of raw) {
+    if (typeof item !== "string" || item.trim().length === 0) {
+      throw new Error("protocol faces must contain non-empty strings");
+    }
+    const face = item.trim().toUpperCase();
+    if (!SUPPORTED_FACES.includes(face)) {
+      throw new Error(
+        `unsupported protocol face '${item}'; expected A2A, MCP, or X402`
+      );
+    }
+    if (seen.has(face)) {
+      throw new Error(`duplicate protocol face '${face}'`);
+    }
+    seen.add(face);
+  }
+  return SUPPORTED_FACES.filter((face) => seen.has(face));
+}
+function stackFaces(stack, payments = {}) {
+  if (Object.hasOwn(stack, "protocols")) {
+    if (!Array.isArray(stack.protocols)) {
+      throw new Error("[stack].protocols must be a non-empty array");
+    }
+    return normalizeProtocolFaces(stack.protocols);
+  }
+  const rawProtocol = typeof stack.protocol === "string" ? stack.protocol.trim().toUpperCase() : "A2A";
+  const protocol = rawProtocol === "MCP" || rawProtocol === "A2A" ? rawProtocol : "A2A";
+  const faces = [protocol];
+  if (table(payments.x402_seller).enabled === true) {
+    faces.push("X402");
+  }
+  return SUPPORTED_FACES.filter((face) => faces.includes(face));
+}
+function hasA2aFace(faces) {
+  return faces.includes("A2A");
+}
+function hasMcpFace(faces) {
+  return faces.includes("MCP");
+}
+function hasX402Face(faces) {
+  return faces.includes("X402");
+}
+function nativeProtocolOf(faces) {
+  if (hasA2aFace(faces)) {
+    return "A2A";
+  }
+  if (hasMcpFace(faces)) {
+    return "MCP";
+  }
+  if (hasX402Face(faces)) {
+    return "A2A";
+  }
+  throw new Error("at least one protocol face is required");
+}
+function entryStemOf(faces) {
+  if (hasA2aFace(faces) && hasMcpFace(faces)) {
+    return "dualMain";
+  }
+  return nativeProtocolOf(faces) === "MCP" ? "mcpMain" : "main";
+}
+function devPortOf(faces) {
+  return nativeProtocolOf(faces) === "MCP" ? 8e3 : 9e3;
+}
+function recipeModeOf(faces) {
+  if (hasA2aFace(faces) && hasMcpFace(faces)) {
+    return "both";
+  }
+  return nativeProtocolOf(faces) === "MCP" ? "mcp" : "a2a";
+}
+
+// src/cli/_hosted/zipBuilder.ts
+async function loadZipArchive() {
+  const moduleName = "archiver";
+  const mod = await import(moduleName);
+  return mod.ZipArchive;
+}
+var MAX_COMPRESSED_BYTES = 250 * 1024 * 1024;
+var MAX_UNCOMPRESSED_BYTES = 750 * 1024 * 1024;
+var TARGET_NODE = "node22";
+async function buildZip(agentDir, outZip, opts = {}) {
+  if (!isDir(agentDir)) {
+    throw new Error(`agent code dir not found for zip build: ${agentDir}`);
+  }
+  const faces = opts.protocols ?? normalizeProtocolFaces(opts.protocol ?? "A2A");
+  const stem = entryStemOf(faces);
+  const entrypoint = `${stem}.js`;
+  const entry = resolveEntry(agentDir, stem);
+  const buildRoot = path.join(
+    path.dirname(outZip),
+    `${path.basename(outZip, ".zip")}.build`
+  );
+  fs.rmSync(buildRoot, { recursive: true, force: true });
+  fs.mkdirSync(buildRoot, { recursive: true });
+  try {
+    const outfile = path.join(buildRoot, entrypoint);
+    await (opts.bundle ?? bundleEntry)(entry, outfile);
+    stageManifest(agentDir, buildRoot, entrypoint);
+    stageStudioToml(agentDir, buildRoot);
+    assertWithinUncompressedCap(
+      buildRoot,
+      opts.maxUncompressedBytes ?? MAX_UNCOMPRESSED_BYTES
+    );
+    await pack(buildRoot, outZip);
+  } finally {
+    fs.rmSync(buildRoot, { recursive: true, force: true });
+  }
+  assertWithinCompressedCap(
+    outZip,
+    opts.maxCompressedBytes ?? MAX_COMPRESSED_BYTES
+  );
+  return { checksum: sha256File(outZip), entrypoint };
+}
+function resolveEntry(agentDir, stem) {
+  const candidates = [
+    path.join(agentDir, "src", `${stem}.ts`),
+    path.join(agentDir, "dist", `${stem}.js`),
+    path.join(agentDir, `${stem}.ts`),
+    path.join(agentDir, `${stem}.js`)
+  ];
+  for (const candidate of candidates) {
+    if (isFile(candidate)) {
+      return candidate;
+    }
+  }
+  throw new Error(
+    `no ${stem}.ts/${stem}.js entry found under ${agentDir} (looked in src/, dist/, and the project root) \u2014 the zip channel bundles the protocol entry the scaffold emitted. Re-scaffold with \`bag init\`, or switch [deploy].platform_artifact to "container".`
+  );
+}
+async function bundleEntry(entry, outfile) {
+  try {
+    await esbuildBuild({
+      entryPoints: [entry],
+      outfile,
+      bundle: true,
+      platform: "node",
+      target: TARGET_NODE,
+      format: "esm",
+      minify: true,
+      legalComments: "none",
+      sourcemap: false,
+      logLevel: "silent",
+      banner: {
+        js: 'import { createRequire as __bagCreateRequire } from "node:module";const require = __bagCreateRequire(import.meta.url);'
+      }
+    });
+  } catch (exc) {
+    const msg = exc instanceof Error ? exc.message : String(exc);
+    throw new Error(
+      `bundling the agent for the zip runtime failed \u2014 a dependency likely cannot be bundled (native addon / dynamic import esbuild cannot resolve). Fix the import, or set [deploy].platform_artifact = "container". esbuild said:
+${msg.slice(0, 1e3)}`
+    );
+  }
+}
+function stageManifest(agentDir, buildRoot, entrypoint) {
+  let name = "bnbagent-seller";
+  let version = "0.0.0";
+  try {
+    const pkg = JSON.parse(
+      fs.readFileSync(path.join(agentDir, "package.json"), "utf-8")
+    );
+    if (pkg !== null && typeof pkg === "object" && !Array.isArray(pkg)) {
+      const p = pkg;
+      if (typeof p.name === "string" && p.name) {
+        name = p.name;
+      }
+      if (typeof p.version === "string" && p.version) {
+        version = p.version;
+      }
+    }
+  } catch {
+  }
+  fs.writeFileSync(
+    path.join(buildRoot, "package.json"),
+    `${JSON.stringify(
+      { name, version, private: true, type: "module", main: entrypoint },
+      null,
+      2
+    )}
+`
+  );
+}
+function stageStudioToml(agentDir, buildRoot) {
+  const src = path.join(agentDir, "studio.toml");
+  if (isFile(src)) {
+    fs.copyFileSync(src, path.join(buildRoot, "studio.toml"));
+  }
+}
+async function pack(buildRoot, outZip) {
+  fs.rmSync(outZip, { force: true });
+  const ZipArchive = await loadZipArchive();
+  await new Promise((resolve, reject) => {
+    const output = fs.createWriteStream(outZip);
+    const archive = new ZipArchive({ zlib: { level: 9 } });
+    output.on("close", () => resolve());
+    archive.on("error", (err) => reject(err));
+    archive.pipe(output);
+    for (const file of listFiles(buildRoot).sort()) {
+      archive.file(path.join(buildRoot, file), { name: file });
+    }
+    void archive.finalize();
+  });
+}
+function assertWithinUncompressedCap(buildRoot, cap) {
+  let total = 0;
+  for (const file of listFiles(buildRoot)) {
+    total += fs.statSync(path.join(buildRoot, file)).size;
+  }
+  if (total > cap) {
+    throw new Error(
+      `zip uncompressed size ${mb(total)} exceeds the platform cap ${mb(cap)}. Trim dependencies or deploy as a container (no uncompressed cap below the 2GB image limit).`
+    );
+  }
+}
+function assertWithinCompressedCap(outZip, cap) {
+  const size = fs.statSync(outZip).size;
+  if (size > cap) {
+    throw new Error(
+      `zip compressed size ${mb(size)} exceeds the platform cap ${mb(cap)}. Trim dependencies or deploy as a container.`
+    );
+  }
+}
+function sha256File(filePath) {
+  const hash = createHash("sha256");
+  hash.update(fs.readFileSync(filePath));
+  return hash.digest("hex");
+}
+function listFiles(root, prefix = "") {
+  const out = [];
+  for (const entry of fs.readdirSync(path.join(root, prefix), {
+    withFileTypes: true
+  })) {
+    const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
+    if (entry.isDirectory()) {
+      out.push(...listFiles(root, rel));
+    } else if (entry.isFile()) {
+      out.push(rel);
+    }
+  }
+  return out;
+}
+function isFile(p) {
+  try {
+    return fs.statSync(p).isFile();
+  } catch {
+    return false;
+  }
+}
+function isDir(p) {
+  try {
+    return fs.statSync(p).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function mb(n) {
+  return `${(n / (1024 * 1024)).toFixed(1)}MB`;
+}
+
+// src/cli/exit.ts
+var CliExit = class extends Error {
+  constructor(code) {
+    super(`exit ${code}`);
+    this.code = code;
+    this.name = "CliExit";
+  }
+  code;
+};
+function act(fn) {
+  return async (...args) => {
+    const code = await fn(...args);
+    if (code !== 0) {
+      throw new CliExit(code);
+    }
+  };
+}
+function printOut(line) {
+  process.stdout.write(`${line}
+`);
+}
+function printErr(line) {
+  process.stderr.write(`${line}
+`);
+}
+
+// src/cli/preflight.ts
+var OK = "ok";
+var WARN = "warn";
+var INFO = "info";
+var MARK = {
+  [OK]: "\u2713",
+  [WARN]: "\u26A0",
+  [INFO]: "\u2022"
+};
+var MIN_NODE_MAJOR = 22;
+async function whichBin(name) {
+  const cmd = process.platform === "win32" ? "where" : "which";
+  const result = await runCapture(cmd, [name]);
+  if (result.code !== 0) {
+    return null;
+  }
+  const line = result.stdout.split("\n")[0]?.trim();
+  return line ? line : null;
+}
+function checkNode() {
+  const ver = process.versions.node;
+  const major = Number.parseInt(ver.split(".")[0] ?? "0", 10);
+  const ok = major >= MIN_NODE_MAJOR;
+  return {
+    name: "Node.js",
+    ok,
+    level: ok ? OK : WARN,
+    detail: `${ver} (>= ${MIN_NODE_MAJOR} required)`,
+    fix: ok ? "" : "upgrade Node.js to >= 22 (https://nodejs.org/en/download)"
+  };
+}
+function agentcoreFlavor(binPath) {
+  const p = binPath.toLowerCase();
+  if (p.includes("node_modules/@aws/agentcore") || p.includes("/.nvm/") || p.includes("/node_modules/")) {
+    return "node";
+  }
+  if (p.includes("bedrock-agentcore") || p.includes("/.venv/") || p.includes("/venv/")) {
+    return "python";
+  }
+  return "unknown";
+}
+async function checkBunx() {
+  const override = (process.env.BNBAGENT_DEPLOY_COMMAND ?? "").trim();
+  if (override) {
+    return {
+      name: "bnbagent-deploy",
+      ok: true,
+      level: OK,
+      detail: `command overridden via BNBAGENT_DEPLOY_COMMAND (${override})`,
+      fix: ""
+    };
+  }
+  const found = await whichBin("bunx");
+  if (found === null) {
+    return {
+      name: "bnbagent-deploy",
+      ok: false,
+      level: WARN,
+      detail: "bunx not found (deploys delegate to the pinned @bnbagent/deploy-cli via bunx)",
+      fix: "install Bun 1.3+ (https://bun.sh) or set BNBAGENT_DEPLOY_COMMAND"
+    };
+  }
+  return {
+    name: "bnbagent-deploy",
+    ok: true,
+    level: OK,
+    detail: `bunx on PATH (${found}); deploys delegate to the pinned @bnbagent/deploy-cli`,
+    fix: ""
+  };
+}
+function checkAws() {
+  const has = Boolean(process.env.AWS_ACCESS_KEY_ID || process.env.AWS_PROFILE);
+  return {
+    name: "AWS credentials",
+    ok: has,
+    level: has ? OK : WARN,
+    detail: has ? "configured" : "not configured (needed to deploy the Agent)",
+    fix: has ? "" : "set AWS_ACCESS_KEY_ID / AWS_PROFILE (or fill ~/.aws/credentials \u2014 see the AWS Console's access-key page)"
+  };
+}
+async function checkDocker() {
+  const docker = await whichBin("docker");
+  if (docker === null) {
+    return {
+      name: "docker",
+      ok: false,
+      level: WARN,
+      detail: "not found (needed to build the twak Agent container image)",
+      fix: "install Docker (https://docs.docker.com/get-docker)"
+    };
+  }
+  let daemonOk = true;
+  try {
+    const proc = await runCapture(docker, ["info"], { timeoutMs: 1e4 });
+    daemonOk = proc.code === 0;
+  } catch {
+    daemonOk = false;
+  }
+  if (daemonOk) {
+    return {
+      name: "docker",
+      ok: true,
+      level: OK,
+      detail: "on PATH; daemon responding",
+      fix: ""
+    };
+  }
+  return {
+    name: "docker",
+    ok: false,
+    level: WARN,
+    detail: "on PATH but the daemon isn't responding (`docker info` failed) \u2014 a deploy build will fail until Docker is started",
+    fix: "start Docker Desktop (or `open -a Docker` on macOS)"
+  };
+}
+async function checkTwak() {
+  const found = await whichTwak() !== null;
+  return {
+    name: "twak CLI",
+    ok: found,
+    level: found ? OK : WARN,
+    detail: found ? "on PATH" : "not found (needed only for wallet.kind='twak' projects)",
+    fix: found ? "" : `npm install -g @trustwallet/cli@${TWAK_CLI_VERSION}`
+  };
+}
+function requiredChecks() {
+  return [checkNode()];
+}
+async function deployChecks() {
+  return [
+    await checkBunx(),
+    checkAws(),
+    await checkDocker(),
+    await checkTwak()
+  ];
+}
+function render(checks) {
+  const lines = [];
+  for (const c of checks) {
+    lines.push(`  ${MARK[c.level] ?? "-"} ${c.name}: ${c.detail}`);
+    if (c.fix) {
+      lines.push(`      -> ${c.fix}`);
+    }
+  }
+  return lines.join("\n");
+}
+
+// src/cli/_deploy/awsTargets.ts
+import * as fs2 from "fs";
+import * as path2 from "path";
+var DEFAULT_TARGET_NAME = "default";
+function isDict(v) {
+  return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+function pickAccount(entry) {
+  return entry.account || entry.accountId;
+}
+function readAwsTarget(root, targetName = DEFAULT_TARGET_NAME) {
+  const p = path2.join(root, "agentcore", "aws-targets.json");
+  let data;
+  try {
+    data = JSON.parse(fs2.readFileSync(p, "utf-8"));
+  } catch {
+    return [null, null];
+  }
+  let account = null;
+  let region = null;
+  if (Array.isArray(data)) {
+    const entries = data.filter(isDict);
+    const chosen = entries.find((e) => e.name === targetName) ?? entries[0] ?? null;
+    if (chosen !== null) {
+      account = pickAccount(chosen);
+      region = chosen.region;
+    }
+  } else if (isDict(data)) {
+    account = pickAccount(data);
+    region = data.region;
+    const targets = data.targets;
+    if ((!account || !region) && isDict(targets)) {
+      const dflt = targets.default;
+      if (isDict(dflt)) {
+        account = account || pickAccount(dflt);
+        region = region || dflt.region;
+      }
+    }
+  }
+  if (account !== null && account !== void 0) {
+    const s = String(account).trim();
+    if (!/^\d+$/.test(s)) {
+      account = null;
+    }
+  }
+  return [account ? String(account) : null, region ? String(region) : null];
+}
+
+// src/cli/_deploy/x402.ts
+import * as path4 from "path";
+import {
+  envLocalPath,
+  findSubProjectRoot,
+  loadStudioToml
+} from "@bnbagent/studio-runtime/config";
+
+// src/cli/utils/envFile.ts
+import * as fs3 from "fs";
+import * as path3 from "path";
+var KEY_LINE_RE = /^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=/;
+function isValidKey(key) {
+  return /^[A-Za-z_][A-Za-z0-9_]*$/.test(key);
+}
+function writePrivate(filePath, text) {
+  fs3.writeFileSync(filePath, text, { encoding: "utf-8", mode: 384 });
+  fs3.chmodSync(filePath, 384);
+}
+function setEnvVar(filePath, key, value) {
+  if (!isValidKey(key)) {
+    throw new Error(`invalid env var name: '${key}'`);
+  }
+  const newLine = `${key}=${value}`;
+  fs3.mkdirSync(path3.dirname(filePath), { recursive: true });
+  if (!fs3.existsSync(filePath)) {
+    writePrivate(filePath, `${newLine}
+`);
+    return true;
+  }
+  const original = fs3.readFileSync(filePath, "utf-8");
+  const lines = original.split(/\r?\n/);
+  if (lines.length > 0 && lines[lines.length - 1] === "") {
+    lines.pop();
+  }
+  const out = [];
+  let replaced = false;
+  for (const line of lines) {
+    const m = KEY_LINE_RE.exec(line);
+    if (m && m[1] === key) {
+      if (replaced) {
+        continue;
+      }
+      out.push(newLine);
+      replaced = true;
+    } else {
+      out.push(line);
+    }
+  }
+  if (!replaced) {
+    out.push(newLine);
+  }
+  const newText = `${out.join("\n")}
+`;
+  if (newText === original) {
+    return false;
+  }
+  writePrivate(filePath, newText);
+  return true;
+}
+function getEnvVar(filePath, key) {
+  if (!fs3.existsSync(filePath)) {
+    return null;
+  }
+  for (const line of fs3.readFileSync(filePath, "utf-8").split(/\r?\n/)) {
+    const m = KEY_LINE_RE.exec(line);
+    if (m && m[1] === key) {
+      const eq = line.indexOf("=");
+      return eq >= 0 ? line.slice(eq + 1) : "";
+    }
+  }
+  return null;
+}
+
+// src/cli/_deploy/x402.ts
+var B402_RUNTIME_KEYS = [
+  "B402_BASE_URL",
+  "B402_CLIENT_ID",
+  "B402_ACCESS_TOKEN",
+  "B402_PRIVATE_KEY",
+  "B402_PRIVATE_KEY_B64"
+];
+function commerceRails(cfg) {
+  const payments = table2(cfg.payments);
+  return {
+    erc8183: isTable(payments.erc8183),
+    x402: table2(payments.x402_seller).enabled === true
+  };
+}
+function b402Credentials(agentRoot) {
+  const values = /* @__PURE__ */ new Map();
+  const envPath = envLocalPath(agentRoot);
+  for (const key of B402_RUNTIME_KEYS) {
+    const value = process.env[key] || getEnvVar(envPath, key);
+    if (value) values.set(key, value);
+  }
+  const privateKey = values.has("B402_PRIVATE_KEY") || values.has("B402_PRIVATE_KEY_B64");
+  return {
+    presentKeys: [...values.keys()],
+    complete: values.has("B402_BASE_URL") && values.has("B402_CLIENT_ID") && values.has("B402_ACCESS_TOKEN") && privateKey,
+    any: values.size > 0,
+    bothPrivateKeyFormats: values.has("B402_PRIVATE_KEY") && values.has("B402_PRIVATE_KEY_B64"),
+    baseUrl: values.get("B402_BASE_URL") ?? null
+  };
+}
+function loadDeployConfig(root) {
+  const agentRoot = findSubProjectRoot("agent", root) ?? root;
+  try {
+    return {
+      agentRoot,
+      cfg: loadStudioToml(path4.join(agentRoot, "studio.toml"))
+    };
+  } catch {
+    return { agentRoot, cfg: {} };
+  }
+}
+function x402DeploySummary(root, destination, publicUrl) {
+  const { agentRoot, cfg } = loadDeployConfig(root);
+  if (!commerceRails(cfg).x402) return "";
+  const credentials = b402Credentials(agentRoot);
+  const activation = "run the bnbagent-studio-selling-via-b402 skill, fill the four B402_* variables in .studio/.env.local, then redeploy.";
+  if (!credentials.complete) {
+    return `x402 rail is DORMANT. To activate: ${activation}`;
+  }
+  const runtime = String(table2(cfg.stack).runtime ?? "agentcore");
+  if (destination !== "platform" && runtime !== "agentcore") {
+    return `x402 rail is FORCED DORMANT: the ${runtime} runtime has no x402 path. Deploy to AgentCore (managed platform or self-hosted) to activate the rail.`;
+  }
+  const settlement = [
+    "B402 settlement runs inside every paid request and normally adds 10\u201345 s; buyer timeout must be at least 120 s.",
+    "Settlement happens before work. If work later fails, the payment is retained and is not refunded automatically."
+  ];
+  if (destination !== "platform") {
+    return [
+      "x402 rail is ACTIVE (self-hosted AgentCore).",
+      "This target has no anonymous public URL; expose /x402 with your own HTTP front.",
+      'The front reaches the agent by wrapping each request as envelope-v1 JSON \u2014 {"v":1,"method":"POST","path":"/x402","headers":{...},"body":"<base64>"} \u2014 inside a SigV4-signed (or JWT bearer) InvokeAgentRuntime call. Limits: 1 MiB request, 5 MiB response, no streaming.',
+      "B402 allowlists merchant egress IPs and this deploy has no fixed egress IP: route facilitator egress through a fixed-IP forward proxy you control and submit that IP with the merchant application (see the bnbagent-studio-selling-via-b402 reference).",
+      'See docs/guides/x402-selling.md, section "Self-hosted AgentCore access".',
+      ...settlement
+    ].join("\n");
+  }
+  const url = publicUrl ?? "<available after the platform agentId is assigned>";
+  return [
+    "x402 rail is ACTIVE.",
+    `Anonymous paid URL: ${url}`,
+    ...settlement
+  ].join("\n");
+}
+function table2(value) {
+  return isTable(value) ? value : {};
+}
+function isTable(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/cli/_deploy/deployCli.ts
+var DEPLOY_CLI_VERSION = "0.4.14";
+var DEPLOY_CLI_PACKAGE = `@bnbagent/deploy-cli@${DEPLOY_CLI_VERSION}`;
+var BNB_PLATFORM_API_URL = "https://bnbagent-api.bnbchain.world";
+var BNB_PLATFORM_API_URL_ENV = "BNBAGENT_API_URL";
+var LEGACY_BNB_PLATFORM_API_URL_ENV = "BAG_PLATFORM_API_BASE";
+function deployEndpointValue(...candidates) {
+  for (const candidate of candidates) {
+    if (typeof candidate === "string") {
+      const value = candidate.trim();
+      if (value) {
+        return value;
+      }
+      continue;
+    }
+    if (candidate !== null && typeof candidate === "object" && !Array.isArray(candidate)) {
+      const value = candidate.value;
+      if (typeof value === "string" && value.trim()) {
+        return value.trim();
+      }
+    }
+  }
+  return null;
+}
+var RESERVED_AGENTCORE_KEYS = ["environmentVariables", "secretName"];
+var FOUNDRY_PASSTHROUGH_KEYS = /* @__PURE__ */ new Set([
+  "account",
+  "cpu",
+  "location",
+  "memory",
+  "project",
+  "projectEndpoint",
+  "protocol",
+  "registry"
+]);
+function tableOf(data, key) {
+  const v = data[key];
+  return v !== null && typeof v === "object" && !Array.isArray(v) ? v : {};
+}
+function descriptorName(root) {
+  try {
+    const raw = JSON.parse(
+      fs4.readFileSync(path5.join(root, "agentcore", "agentcore.json"), "utf-8")
+    );
+    if (raw !== null && typeof raw === "object" && !Array.isArray(raw)) {
+      const name = raw.name;
+      if (name) {
+        return String(name);
+      }
+    }
+  } catch {
+  }
+  return null;
+}
+function bnbPlatformApiUrl(environment = process.env) {
+  const configured = environment[BNB_PLATFORM_API_URL_ENV]?.trim() || environment[LEGACY_BNB_PLATFORM_API_URL_ENV]?.trim() || BNB_PLATFORM_API_URL;
+  return configured.replace(/\/+$/u, "");
+}
+function deployCommand(environment = process.env) {
+  const override = (environment.BNBAGENT_DEPLOY_COMMAND ?? "").trim();
+  if (override) {
+    return override.split(/\s+/u);
+  }
+  return ["bunx", "--bun", DEPLOY_CLI_PACKAGE];
+}
+function providerPassthrough(studio, table3) {
+  const raw = tableOf(studio, "deploy")[table3];
+  if (raw === void 0 || raw === null) {
+    return {};
+  }
+  if (typeof raw !== "object" || Array.isArray(raw)) {
+    throw new Error(
+      `studio.toml [deploy.${table3}] must be a TOML table of deploy-spec keys`
+    );
+  }
+  return { ...raw };
+}
+function buildDeploySpec(root, opts) {
+  const agentRoot = findSubProjectRoot2("agent", root) ?? root;
+  const studio = loadStudioToml2(path5.join(agentRoot, "studio.toml"));
+  const name = String(
+    opts.nameOverride || descriptorName(root) || tableOf(studio, "project").name || path5.basename(root)
+  );
+  const stack = tableOf(studio, "stack");
+  const payments = tableOf(studio, "payments");
+  const faces = stackFaces(stack, payments);
+  const hasProtocolsArray = Array.isArray(stack.protocols);
+  const protocol = nativeProtocolOf(faces);
+  const isContainer = opts.packaging === "container";
+  const deploy = {
+    target: opts.target,
+    type: opts.packaging,
+    // The spec lives in a tempdir OUTSIDE the workspace, so every path
+    // field must be absolute — deploy-core resolves them against the
+    // config file's directory.
+    path: agentRoot
+  };
+  const doc = { name, deploy };
+  const env = {
+    STUDIO_AUDIT_LOG_PATH: "/tmp/.studio/audit-log.jsonl",
+    OTEL_TRACES_EXPORTER: "none"
+  };
+  if (isContainer) {
+    deploy.dockerfile = path5.join(agentRoot, "Dockerfile");
+  } else {
+    if (!opts.zip) {
+      throw new Error("zip packaging requires a prebuilt zip artifact");
+    }
+    deploy.dist = opts.zip.path;
+    deploy.entrypoint = opts.zip.entrypoint;
+    deploy.runtimeVersion = "NODE_22";
+  }
+  if (opts.target === "aws/agentcore") {
+    const [account, region] = readAwsTarget(root);
+    if (account) {
+      deploy.account = account;
+    }
+    if (region) {
+      deploy.region = region;
+    }
+    deploy.protocol = protocol;
+    const agentcore = {};
+    const passthrough = providerPassthrough(studio, "agentcore");
+    const reserved = RESERVED_AGENTCORE_KEYS.filter((k) => k in passthrough);
+    if (reserved.length > 0) {
+      throw new Error(
+        `studio.toml [deploy.agentcore] must not set ${reserved.join(", ")}: secretName is studio-managed, and environmentVariables would replace deploy's merged runtime env (secret pointer included)`
+      );
+    }
+    Object.assign(agentcore, passthrough);
+    agentcore.secretName = `bnbagent/${name}/runtime`;
+    doc.agentcore = agentcore;
+  } else if (opts.target === "azure/foundry") {
+    deploy.protocol = "HTTP";
+    const foundry = {};
+    const passthrough = providerPassthrough(studio, "foundry");
+    const unsupported = Object.keys(passthrough).filter((k) => !FOUNDRY_PASSTHROUGH_KEYS.has(k)).sort();
+    if (unsupported.length > 0) {
+      printErr(
+        `note: deploy-cli ${DEPLOY_CLI_VERSION} ignores [deploy.foundry] ${unsupported.join(", ")}; forwarded anyway for newer deploy versions`
+      );
+    }
+    Object.assign(foundry, passthrough);
+    if (!("protocol" in foundry)) {
+      foundry.protocol = "invocations";
+    }
+    const azure = tableOf(studio, "azure");
+    for (const [source, dest] of [
+      ["account_name", "account"],
+      ["project_name", "project"],
+      ["project_endpoint", "projectEndpoint"],
+      ["location", "location"]
+    ]) {
+      const value = String(azure[source] ?? "").trim();
+      if (value) {
+        if (dest in passthrough && String(passthrough[dest]) !== value) {
+          printErr(
+            `note: studio.toml [azure].${source} wins over [deploy.foundry].${dest}`
+          );
+        }
+        foundry[dest] = value;
+      }
+    }
+    doc.foundry = foundry;
+  } else {
+    for (const table3 of ["agentcore", "foundry"]) {
+      if (Object.keys(providerPassthrough(studio, table3)).length > 0) {
+        printErr(
+          `note: the bnb/trial platform does not allow custom provider configuration; [deploy.${table3}] ignored`
+        );
+      }
+    }
+    deploy.protocol = protocol;
+    doc.bnb = { apiUrl: bnbPlatformApiUrl() };
+  }
+  if (opts.inlineSecrets) {
+    Object.assign(env, opts.inlineSecrets);
+  }
+  if (opts.target === "bnb/trial" && tableOf(studio, "deploy").destination === "platform" && (!hasProtocolsArray || hasX402Face(faces)) && commerceRails(studio).x402 && b402Credentials(agentRoot).complete) {
+    doc.x402 = {
+      publicPaths: ["/x402"],
+      tunnel: "http-envelope-v1"
+    };
+  }
+  if (opts.target === "bnb/trial" && tableOf(studio, "deploy").destination === "platform" && hasA2aFace(faces) && hasMcpFace(faces)) {
+    doc.mcp = {
+      publicPaths: ["/mcp"],
+      tunnel: "http-envelope-v1"
+    };
+  }
+  if (opts.target === "bnb/trial" && tableOf(studio, "deploy").destination === "platform" && hasProtocolsArray && faces.length === 1 && hasX402Face(faces)) {
+    doc.suppressProtocolFace = true;
+  }
+  doc.env = env;
+  if (opts.secretFile && !opts.inlineSecrets) {
+    doc.secrets = { envFile: opts.secretFile };
+  }
+  return { doc, name, agentRoot };
+}
+function renderSecretEnvFile(payload) {
+  return Object.keys(payload).sort().map((key) => `${key}=${JSON.stringify(payload[key])}
+`).join("");
+}
+function writePrivateSync(filePath, content) {
+  fs4.writeFileSync(filePath, content, { mode: 384 });
+  fs4.chmodSync(filePath, 384);
+}
+async function withDeployFiles(root, opts, fn) {
+  const scratch = fs4.mkdtempSync(path5.join(os.tmpdir(), "bag-deploy-"));
+  try {
+    let zip;
+    if (opts.packaging === "zip") {
+      const agentRoot = findSubProjectRoot2("agent", root) ?? root;
+      const studio = loadStudioToml2(
+        path5.join(agentRoot, "studio.toml")
+      );
+      const stack = tableOf(studio, "stack");
+      const faces = stackFaces(stack, tableOf(studio, "payments"));
+      const outZip = path5.join(scratch, "code.zip");
+      const built = await (opts.buildZipFn ?? buildZip)(agentRoot, outZip, {
+        protocols: faces
+      });
+      zip = { path: outZip, entrypoint: built.entrypoint };
+    }
+    const secretFile = path5.join(scratch, "secrets.env");
+    const inline = opts.inlineSecrets;
+    const payload = opts.secrets ?? {};
+    const spec = buildDeploySpec(root, {
+      target: opts.target,
+      packaging: opts.packaging,
+      nameOverride: opts.nameOverride,
+      zip,
+      inlineSecrets: inline,
+      secretFile: !inline && Object.keys(payload).length > 0 ? secretFile : void 0
+    });
+    if (!inline && Object.keys(payload).length > 0) {
+      writePrivateSync(secretFile, renderSecretEnvFile(payload));
+    }
+    const configPath = path5.join(scratch, "agent-deploy.toml");
+    writePrivateSync(configPath, tomlStringify(spec.doc));
+    return await fn({ configPath, scratchDir: scratch }, spec);
+  } finally {
+    fs4.rmSync(scratch, { recursive: true, force: true });
+  }
+}
+var BUNX_HINT = "error: could not start bnbagent-deploy (bunx not found); install Bun 1.3+ or set BNBAGENT_DEPLOY_COMMAND.";
+async function ensureRunnable(environment = process.env) {
+  const [bin] = deployCommand(environment);
+  if (bin && await whichBin(bin) === null) {
+    printErr(BUNX_HINT);
+    return false;
+  }
+  return true;
+}
+async function runDeployCliStream(argv, opts = {}) {
+  if (!await ensureRunnable()) {
+    return 127;
+  }
+  const [bin, ...prefix] = deployCommand();
+  return runStream(bin, [...prefix, ...argv], {
+    cwd: opts.cwd,
+    env: opts.env ? { ...process.env, ...opts.env } : void 0
+  });
+}
+async function runDeployCliJson(argv, opts = {}) {
+  if (!await ensureRunnable()) {
+    return { code: 127, data: {} };
+  }
+  const [bin, ...prefix] = deployCommand();
+  const { code, stdout } = await runCaptureOut(
+    bin,
+    [...prefix, ...argv, "--json"],
+    {
+      cwd: opts.cwd,
+      env: opts.env ? { ...process.env, ...opts.env } : void 0
+    }
+  );
+  let data = {};
+  const trimmed = stdout.trim();
+  if (trimmed) {
+    try {
+      const parsed = JSON.parse(trimmed);
+      data = parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+    } catch {
+      printErr("error: bnbagent-deploy returned invalid JSON");
+      return { code: code === 0 ? 1 : code, data: {} };
+    }
+  }
+  if (code !== 0 && !opts.quiet) {
+    const message = String(tableOf(data, "error").message ?? "").trim();
+    if (message) {
+      printErr(`error: ${message}`);
+    }
+  }
+  return { code, data };
+}
+function trialFromDeployCliJson(data) {
+  return {
+    case: String(data.case ?? "unknown"),
+    startedAt: data.started_at ? String(data.started_at) : null,
+    expiresAt: data.expires_at ? String(data.expires_at) : null,
+    remainingSeconds: typeof data.remaining_seconds === "number" ? data.remaining_seconds : null
+  };
+}
+function bnbEnv() {
+  return { [BNB_PLATFORM_API_URL_ENV]: bnbPlatformApiUrl() };
+}
+async function runPlatformAccountCommand(argv, opts = {}) {
+  const run = async (args, cwd) => {
+    if (opts.json) {
+      return runDeployCliJson(args, { cwd, env: bnbEnv(), quiet: opts.quiet });
+    }
+    const code = await runDeployCliStream(args, { cwd, env: bnbEnv() });
+    return { code, data: {} };
+  };
+  if (!opts.slug) {
+    return run([...argv, "--provider", "bnb"]);
+  }
+  const scratch = fs4.mkdtempSync(path5.join(os.tmpdir(), "bag-platform-"));
+  try {
+    const configPath = path5.join(scratch, "agent-deploy.toml");
+    writePrivateSync(
+      configPath,
+      tomlStringify({
+        name: opts.slug,
+        deploy: { target: "bnb/trial", type: "container", path: "." },
+        bnb: { apiUrl: bnbPlatformApiUrl() }
+      })
+    );
+    return await run([...argv, "--provider", "bnb", "-f", configPath], scratch);
+  } finally {
+    fs4.rmSync(scratch, { recursive: true, force: true });
+  }
+}
+
+export {
+  CliExit,
+  act,
+  printOut,
+  printErr,
+  normalizeProtocolFaces,
+  stackFaces,
+  hasA2aFace,
+  hasMcpFace,
+  hasX402Face,
+  nativeProtocolOf,
+  entryStemOf,
+  devPortOf,
+  recipeModeOf,
+  whichBin,
+  agentcoreFlavor,
+  checkDocker,
+  checkTwak,
+  requiredChecks,
+  deployChecks,
+  render,
+  readAwsTarget,
+  setEnvVar,
+  getEnvVar,
+  B402_RUNTIME_KEYS,
+  commerceRails,
+  b402Credentials,
+  x402DeploySummary,
+  DEPLOY_CLI_VERSION,
+  DEPLOY_CLI_PACKAGE,
+  BNB_PLATFORM_API_URL,
+  BNB_PLATFORM_API_URL_ENV,
+  LEGACY_BNB_PLATFORM_API_URL_ENV,
+  deployEndpointValue,
+  bnbPlatformApiUrl,
+  deployCommand,
+  providerPassthrough,
+  buildDeploySpec,
+  renderSecretEnvFile,
+  withDeployFiles,
+  runDeployCliStream,
+  runDeployCliJson,
+  trialFromDeployCliJson,
+  bnbEnv,
+  runPlatformAccountCommand
+};