@bnbagent/studio-cli 0.0.6-alpha.3 → 0.0.6-alpha.5

package/dist/bag.js

@@ -1,5 +1,7 @@
 #!/usr/bin/env node
 import {
+  B402_DEVELOPER_ACCOUNT_URL,
+  B402_PAID_ONBOARDING_GUIDANCE,
   B402_RUNTIME_KEYS,
   CliExit,
   DEFAULT_B402_PRICE_USD,
@@ -42,7 +44,7 @@ import {
   x402SellerIsFree,
   x402SellerPricingState,
   x402SellerUsesB402
-} from "./chunk-A7NAGZHR.js";
+} from "./chunk-VEOOFDSF.js";
 import {
   TWAK_CLI_MIN_VERSION,
   TWAK_CLI_VERSION,
@@ -55,7 +57,7 @@ import {
   twakVersionBelowFloor,
   twakWalletFile,
   whichTwak
-} from "./chunk-7RAKL4AS.js";
+} from "./chunk-RO726HJG.js";
 import {
   validateAgentcoreName
 } from "./chunk-U7IDQ3K5.js";
@@ -104,7 +106,7 @@ import {
 var CAMPAIGN_DOC_URL = "https://www.bnbchain.org/en/blog/bnb-agent-studio-is-live-on-bnb-chain-ai-agents-from-one-prompt";
 var CAMPAIGN_CHECK_TIMEOUT_MS = 6e3;
 async function fetchCampaignActive() {
-  const { bnbPlatformApiUrl: bnbPlatformApiUrl2 } = await import("./deployCli-264UE6KB.js");
+  const { bnbPlatformApiUrl: bnbPlatformApiUrl2 } = await import("./deployCli-EEK75T67.js");
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), CAMPAIGN_CHECK_TIMEOUT_MS);
   try {
@@ -2552,7 +2554,7 @@ function cmdListKeys(projectRoot) {
 import * as fs37 from "fs";
 import * as path37 from "path";
 import {
-  envLocalPath as envLocalPath15,
+  envLocalPath as envLocalPath16,
   findStudioWorkspaceRoot as findStudioWorkspaceRoot3,
   findSubProjectRoot as findSubProjectRoot16,
   loadStudioToml as loadStudioToml20
@@ -2987,24 +2989,24 @@ function hasIpfsEndpointFinding(result) {
 }
 
 // src/cli/_deploy/cognitoCdk.ts
-import * as fs26 from "fs";
-import * as path25 from "path";
-import { envLocalPath as envLocalPath12 } from "@bnbagent/studio-runtime/config";
+import * as fs27 from "fs";
+import * as path26 from "path";
+import { envLocalPath as envLocalPath13 } from "@bnbagent/studio-runtime/config";
 
 // src/cli/_deploy/secrets.ts
-import * as fs25 from "fs";
-import * as path24 from "path";
+import * as fs26 from "fs";
+import * as path25 from "path";
 import {
-  envLocalPath as envLocalPath11,
-  findSubProjectRoot as findSubProjectRoot7,
-  loadStudioToml as loadStudioToml12
+  envLocalPath as envLocalPath12,
+  findSubProjectRoot as findSubProjectRoot8,
+  loadStudioToml as loadStudioToml13
 } from "@bnbagent/studio-runtime/config";
 
 // src/cli/dev.ts
-import * as fs23 from "fs";
-import * as os4 from "os";
-import * as path22 from "path";
-import { loadStudioToml as loadStudioToml10 } from "@bnbagent/studio-runtime/config";
+import * as fs24 from "fs";
+import * as os5 from "os";
+import * as path23 from "path";
+import { loadStudioToml as loadStudioToml11 } from "@bnbagent/studio-runtime/config";
 import { getNetwork as getNetwork7 } from "@bnbagent/studio-runtime/networks";
 import { writePrivate as writePrivate2 } from "@bnbagent/studio-runtime/secretWrite";
 import { Option as Option3 } from "commander";
@@ -3078,6 +3080,20 @@ function migrateEnvLocal(start) {
   } catch {
   }
 }
+var KEYSTORE_WALLET_KINDS = /* @__PURE__ */ new Set(["evm-local", "altana"]);
+function readWalletKind(agentRoot2) {
+  try {
+    const wallet = loadStudioToml5(path11.join(agentRoot2, "studio.toml")).wallet;
+    if (wallet !== null && typeof wallet === "object") {
+      const kind = wallet.kind;
+      if (typeof kind === "string" && kind.trim()) {
+        return kind.trim();
+      }
+    }
+  } catch {
+  }
+  return "evm-local";
+}
 function resolveKeystoreDir(agentRoot2) {
   let rel = ".studio/wallets";
   try {
@@ -3110,6 +3126,9 @@ function migrateKeystoreOutOfCodelocation(start) {
     }
     fs12.rmSync(stash, { recursive: true, force: true });
   }
+  if (!KEYSTORE_WALLET_KINDS.has(readWalletKind(agentRoot2))) {
+    return;
+  }
   const src = resolveKeystoreDir(agentRoot2);
   const srcReal = realpathOr(src);
   const agentReal = realpathOr(agentRoot2);
@@ -3173,25 +3192,274 @@ function relocateKeys(src, target, label) {
   return true;
 }
 
+// src/cli/_twakContractTargets.ts
+import { resolveNetwork } from "@bnbagent/sdk";
+var CONTRACT_OVERRIDES = [
+  ["ERC8004_REGISTRY_ADDRESS", "registryContract"],
+  ["ERC8183_COMMERCE_ADDRESS", "commerceContract"],
+  ["ERC8183_ROUTER_ADDRESS", "routerContract"],
+  ["ERC8183_POLICY_ADDRESS", "policyContract"]
+];
+function twakCustomContractOverrides(networkName, env = process.env) {
+  let network;
+  try {
+    network = resolveNetwork(networkName);
+  } catch {
+    return [];
+  }
+  const erc8183 = erc8183ContractOverrideState(env);
+  const out = [];
+  for (const [envKey, field] of CONTRACT_OVERRIDES) {
+    if (envKey.startsWith("ERC8183_") && erc8183.mode !== "custom") {
+      continue;
+    }
+    const configured = env[envKey]?.trim() ?? "";
+    if (!/^0x[0-9a-fA-F]{40}$/u.test(configured)) {
+      continue;
+    }
+    const canonical = network[field];
+    if (configured.toLowerCase() !== canonical.toLowerCase()) {
+      out.push({ envKey, configured, canonical });
+    }
+  }
+  return out;
+}
+function twakUnsupportedContractOverrides(networkName, env = process.env) {
+  return twakCustomContractOverrides(networkName, env).filter(
+    (item) => item.envKey.startsWith("ERC8183_")
+  );
+}
+
 // src/cli/init.ts
-import * as fs22 from "fs";
-import * as os3 from "os";
-import * as path21 from "path";
+import * as fs23 from "fs";
+import * as os4 from "os";
+import * as path22 from "path";
 import { getNetwork as getNetwork6 } from "@bnbagent/studio-runtime/networks";
 import { ensureTwakKeychain } from "@bnbagent/studio-runtime/wallet";
 import { Option as Option2 } from "commander";
 import { parse as parseToml } from "smol-toml";
 
-// src/cli/_packageMetadata.ts
+// src/cli/_deploy/providers.ts
 import * as fs13 from "fs";
 import * as path12 from "path";
+import {
+  findSubProjectRoot as findSubProjectRoot6,
+  findWorkspaceRoot as findWorkspaceRoot4,
+  loadStudioToml as loadStudioToml6
+} from "@bnbagent/studio-runtime/config";
+var PROVIDER_TARGETS = {
+  bnb: "bnb/trial",
+  aws: "aws/agentcore",
+  azure: "azure/foundry"
+};
+var PROVIDER_LABELS = {
+  bnb: "BNB Chain Trial",
+  aws: "AWS AgentCore",
+  azure: "Azure Foundry"
+};
+var PROVIDER_MENU_ORDER = [
+  "bnb",
+  "aws",
+  "azure"
+];
+var PROVIDER_SHORT_LABELS = {
+  bnb: "BNB",
+  aws: "AWS",
+  azure: "Azure"
+};
+function providerDigit(provider) {
+  return PROVIDER_MENU_ORDER.indexOf(provider) + 1;
+}
+var ADVERTISED_PROVIDERS = ["bnb", "aws"];
+var ADVERTISED_PROVIDERS_HELP = ADVERTISED_PROVIDERS.join("|");
+function tableOf3(data, key) {
+  const value = data[key];
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function text(value) {
+  if (typeof value !== "string") return null;
+  const clean = value.trim();
+  return clean || null;
+}
+function descriptorName(workspaceRoot) {
+  try {
+    const data = JSON.parse(
+      fs13.readFileSync(
+        path12.join(workspaceRoot, "agentcore", "agentcore.json"),
+        "utf-8"
+      )
+    );
+    return text(data.name);
+  } catch {
+    return null;
+  }
+}
+function discoverRecordedDeployments(root) {
+  const workspaceRoot = findWorkspaceRoot4(root) ?? path12.resolve(root);
+  const agentRoot2 = findSubProjectRoot6("agent", workspaceRoot);
+  if (agentRoot2 === null) return [];
+  let config;
+  try {
+    config = loadStudioToml6(path12.join(agentRoot2, "studio.toml"));
+  } catch {
+    return [];
+  }
+  const projectName2 = descriptorName(workspaceRoot) ?? text(tableOf3(config, "project").name) ?? path12.basename(workspaceRoot);
+  const deploy = tableOf3(config, "deploy");
+  const platform = tableOf3(deploy, "platform");
+  const azure = tableOf3(config, "azure");
+  const runtime = text(tableOf3(config, "stack").runtime) ?? "agentcore";
+  const found = [];
+  const bnbId = text(platform.deployment_id);
+  const bnbEndpoint = text(platform.invoke_url);
+  if (bnbId || bnbEndpoint || text(platform.last_deploy_at)) {
+    found.push({
+      provider: "bnb",
+      target: PROVIDER_TARGETS.bnb,
+      name: text(platform.slug) ?? projectName2,
+      deploymentId: bnbId,
+      endpoint: bnbEndpoint,
+      status: "active"
+    });
+  }
+  const awsArn = text(deploy.runtime_arn);
+  const awsEndpoint = text(deploy.invoke_url);
+  const legacyAwsTimestamp = Boolean(text(deploy.last_deploy_at)) && runtime !== "azure-foundry" && text(deploy.destination) !== "platform";
+  if (awsArn || awsEndpoint || text(deploy.provider) === "aws" || legacyAwsTimestamp) {
+    found.push({
+      provider: "aws",
+      target: PROVIDER_TARGETS.aws,
+      name: projectName2,
+      deploymentId: awsArn,
+      endpoint: awsEndpoint,
+      status: "active"
+    });
+  }
+  const azureEndpoint = text(azure.agent_endpoint);
+  const azureDeploymentId = text(azure.deployment_id);
+  if (azureEndpoint || azureDeploymentId || text(azure.last_deploy_at)) {
+    found.push({
+      provider: "azure",
+      target: PROVIDER_TARGETS.azure,
+      name: text(azure.agent_name) ?? projectName2,
+      deploymentId: azureDeploymentId,
+      endpoint: azureEndpoint,
+      status: "active"
+    });
+  }
+  return found;
+}
+function unavailableProvidersForProject(root) {
+  const workspaceRoot = findWorkspaceRoot4(root) ?? path12.resolve(root);
+  const agentRoot2 = findSubProjectRoot6("agent", workspaceRoot);
+  if (agentRoot2 === null) return {};
+  let runtime = "agentcore";
+  let azureProtocolUnsupported = false;
+  try {
+    const cfg = loadStudioToml6(path12.join(agentRoot2, "studio.toml"));
+    runtime = text(tableOf3(cfg, "stack").runtime) ?? "agentcore";
+    const faces = stackFaces(tableOf3(cfg, "stack"), tableOf3(cfg, "payments"));
+    azureProtocolUnsupported = !hasA2aFace(faces) || hasMcpFace(faces);
+  } catch {
+    return {};
+  }
+  if (runtime === "azure-foundry") {
+    const reason = "this project uses a different container adapter; scaffold an agentcore project before selecting this provider";
+    return {
+      bnb: reason,
+      aws: reason,
+      ...azureProtocolUnsupported ? {
+        azure: "Azure Foundry deploy currently supports A2A projects only; use an A2A azure-foundry scaffold or AgentCore for MCP"
+      } : {}
+    };
+  }
+  return {
+    azure: "this project uses the agentcore adapter; scaffold with --runtime azure-foundry before selecting Azure"
+  };
+}
+function selected(provider, deployments) {
+  const active = deployments.filter((d) => d.status === "active");
+  return {
+    kind: "selected",
+    provider,
+    operation: active.some((d) => d.provider === provider) ? "update" : "create",
+    hasOtherActive: active.some((d) => d.provider !== provider)
+  };
+}
+function trialExpired(trial) {
+  return trial.state.toLowerCase() === "expired";
+}
+function unavailableReason(opts, provider) {
+  if (provider === "bnb" && trialExpired(opts.trial)) {
+    return "the 48h trial has expired";
+  }
+  return opts.unavailable?.[provider] ?? null;
+}
+function providerPromptHint() {
+  return PROVIDER_MENU_ORDER.filter((p) => ADVERTISED_PROVIDERS.includes(p)).map((p) => `${providerDigit(p)}=${PROVIDER_SHORT_LABELS[p]}`).join(", ");
+}
+async function promptProvider(opts) {
+  for (; ; ) {
+    const answer = (await opts.prompt(`Provider [${providerPromptHint()}]: `)).trim().toLowerCase();
+    const provider = answer === "1" || answer === "bnb" ? "bnb" : answer === "2" || answer === "aws" ? "aws" : answer === "3" || answer === "azure" ? "azure" : null;
+    if (provider === null) {
+      if (answer === "" || answer === "q" || answer === "cancel") {
+        return { kind: "cancelled", exitCode: 1 };
+      }
+      continue;
+    }
+    if (unavailableReason(opts, provider)) {
+      continue;
+    }
+    return selected(provider, opts.deployments);
+  }
+}
+async function selectDeployProvider(opts) {
+  if (opts.requested) {
+    const reason = unavailableReason(opts, opts.requested);
+    if (reason) {
+      return {
+        kind: "unavailable",
+        provider: opts.requested,
+        reason,
+        exitCode: 2
+      };
+    }
+    return selected(opts.requested, opts.deployments);
+  }
+  if (!opts.interactive) {
+    return { kind: "selection_required", exitCode: 2 };
+  }
+  const active = opts.deployments.filter((d) => d.status === "active");
+  const activeDeployment = active[0];
+  if (active.length === 1 && activeDeployment) {
+    if (unavailableReason(opts, activeDeployment.provider)) {
+      return promptProvider(opts);
+    }
+    const answer = (await opts.prompt(
+      `Update the existing ${PROVIDER_LABELS[activeDeployment.provider]} deployment? [1=update, 2=another provider, 3=cancel]: `
+    )).trim().toLowerCase();
+    if (answer === "1" || answer === "update" || answer === "yes") {
+      return selected(activeDeployment.provider, opts.deployments);
+    }
+    if (answer === "2" || answer === "another") {
+      return promptProvider(opts);
+    }
+    return { kind: "cancelled", exitCode: 1 };
+  }
+  return promptProvider(opts);
+}
+
+// src/cli/_packageMetadata.ts
+import * as fs14 from "fs";
+import * as path13 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function packageRoot() {
-  let dir = path12.dirname(fileURLToPath2(import.meta.url));
+  let dir = path13.dirname(fileURLToPath2(import.meta.url));
   for (; ; ) {
-    const packageJson = path12.join(dir, "package.json");
-    if (fs13.existsSync(packageJson)) return dir;
-    const parent = path12.dirname(dir);
+    const packageJson = path13.join(dir, "package.json");
+    if (fs14.existsSync(packageJson)) return dir;
+    const parent = path13.dirname(dir);
     if (parent === dir) {
       throw new Error("cannot locate the studio-cli package root");
     }
@@ -3202,8 +3470,8 @@ function pnpmVersion() {
   if ("10.24.0") {
     return "10.24.0";
   }
-  const file = path12.join(packageRoot(), "package.json");
-  const pkg = JSON.parse(fs13.readFileSync(file, "utf-8"));
+  const file = path13.join(packageRoot(), "package.json");
+  const pkg = JSON.parse(fs14.readFileSync(file, "utf-8"));
   const value = String(pkg.packageManager ?? "");
   const match = /^pnpm@(.+)$/u.exec(value);
   if (!match?.[1]) {
@@ -3216,67 +3484,27 @@ function pnpmVersion() {
 
 // src/cli/_runtime/azureFoundry.ts
 import * as crypto2 from "crypto";
-import * as fs16 from "fs";
-import * as path15 from "path";
+import * as fs17 from "fs";
+import * as path16 from "path";
 import {
   findStudioWorkspaceRoot,
-  findSubProjectRoot as findSubProjectRoot6,
-  loadStudioToml as loadStudioToml6
+  findSubProjectRoot as findSubProjectRoot7,
+  loadStudioToml as loadStudioToml7
 } from "@bnbagent/studio-runtime/config";
 import { resolveProviderConfig } from "@bnbagent/studio-runtime/llm";
 
 // src/cli/_deploy/checks/twak.ts
-import * as fs14 from "fs";
-import * as path13 from "path";
+import * as fs15 from "fs";
+import * as path14 from "path";
 import { envLocalPath as envLocalPath7 } from "@bnbagent/studio-runtime/config";
 import { resolveTwakHome } from "@bnbagent/studio-runtime/wallet";
-
-// src/cli/_twakContractTargets.ts
-import { resolveNetwork } from "@bnbagent/sdk";
-var CONTRACT_OVERRIDES = [
-  ["ERC8004_REGISTRY_ADDRESS", "registryContract"],
-  ["ERC8183_COMMERCE_ADDRESS", "commerceContract"],
-  ["ERC8183_ROUTER_ADDRESS", "routerContract"],
-  ["ERC8183_POLICY_ADDRESS", "policyContract"]
-];
-function twakCustomContractOverrides(networkName, env = process.env) {
-  let network;
-  try {
-    network = resolveNetwork(networkName);
-  } catch {
-    return [];
-  }
-  const erc8183 = erc8183ContractOverrideState(env);
-  const out = [];
-  for (const [envKey, field] of CONTRACT_OVERRIDES) {
-    if (envKey.startsWith("ERC8183_") && erc8183.mode !== "custom") {
-      continue;
-    }
-    const configured = env[envKey]?.trim() ?? "";
-    if (!/^0x[0-9a-fA-F]{40}$/u.test(configured)) {
-      continue;
-    }
-    const canonical = network[field];
-    if (configured.toLowerCase() !== canonical.toLowerCase()) {
-      out.push({ envKey, configured, canonical });
-    }
-  }
-  return out;
-}
-function twakUnsupportedContractOverrides(networkName, env = process.env) {
-  return twakCustomContractOverrides(networkName, env).filter(
-    (item) => item.envKey.startsWith("ERC8183_")
-  );
-}
-
-// src/cli/_deploy/checks/twak.ts
-var AGENTCORE_DESCRIPTOR = path13.join("agentcore", "agentcore.json");
+var AGENTCORE_DESCRIPTOR = path14.join("agentcore", "agentcore.json");
 function isTwak(data) {
   return tableOf2(data, "wallet").kind === "twak";
 }
 function isFile4(p) {
   try {
-    return fs14.statSync(p).isFile();
+    return fs15.statSync(p).isFile();
   } catch {
     return false;
   }
@@ -3289,13 +3517,13 @@ async function checkTwakRequiresContainer(root, target) {
   if (!isTwak(data)) {
     return [];
   }
-  const descriptor = path13.join(root, AGENTCORE_DESCRIPTOR);
+  const descriptor = path14.join(root, AGENTCORE_DESCRIPTOR);
   if (!isFile4(descriptor)) {
     return [];
   }
   let cfg;
   try {
-    cfg = JSON.parse(fs14.readFileSync(descriptor, "utf-8"));
+    cfg = JSON.parse(fs15.readFileSync(descriptor, "utf-8"));
   } catch {
     return [];
   }
@@ -3318,7 +3546,7 @@ async function checkTwakRequiresContainer(root, target) {
       }
     ];
   }
-  const dockerfile = path13.join(agentRootOf(root), "Dockerfile");
+  const dockerfile = path14.join(agentRootOf(root), "Dockerfile");
   if (!isFile4(dockerfile)) {
     return [
       {
@@ -3405,7 +3633,7 @@ async function checkTwakWalletExists(root, _target) {
   if (!isFile4(walletFile)) {
     let createCmd = "twak wallet create --password <pw> --no-keychain";
     if (walletCfg.twak_home) {
-      createCmd = `HOME=${path13.dirname(path13.dirname(walletFile))} ${createCmd}`;
+      createCmd = `HOME=${path14.dirname(path14.dirname(walletFile))} ${createCmd}`;
     }
     return [
       {
@@ -3527,8 +3755,8 @@ async function checkTwakCredentialsAvailable(root, _target) {
   }
   const agentRoot2 = agentRootOf(root);
   const walletCfg = tableOf2(data, "wallet");
-  const credentialsFile = path13.join(
-    path13.dirname(twakWalletFile(walletCfg, agentRoot2)),
+  const credentialsFile = path14.join(
+    path14.dirname(twakWalletFile(walletCfg, agentRoot2)),
     "credentials.json"
   );
   const envLocal = envLocalPath7(agentRoot2);
@@ -3550,21 +3778,21 @@ async function checkTwakCredentialsAvailable(root, _target) {
 }
 
 // src/cli/_deploy/fixes.ts
-import * as fs15 from "fs";
-import * as path14 from "path";
+import * as fs16 from "fs";
+import * as path15 from "path";
 import { envLocalPath as envLocalPath8 } from "@bnbagent/studio-runtime/config";
 function fixGitignore(root) {
-  const ws = path14.dirname(path14.dirname(envLocalPath8(root)));
-  const gi = path14.join(ws, ".gitignore");
+  const ws = path15.dirname(path15.dirname(envLocalPath8(root)));
+  const gi = path15.join(ws, ".gitignore");
   const required = [".studio/"];
   let exists = false;
   try {
-    exists = fs15.statSync(gi).isFile();
+    exists = fs16.statSync(gi).isFile();
   } catch {
     exists = false;
   }
   if (!exists) {
-    fs15.writeFileSync(gi, `${required.join("\n")}
+    fs16.writeFileSync(gi, `${required.join("\n")}
 `, "utf-8");
     return {
       name: "fix-gitignore",
@@ -3572,7 +3800,7 @@ function fixGitignore(root) {
       message: `created .gitignore with ${required.length} entries`
     };
   }
-  let text2 = fs15.readFileSync(gi, "utf-8");
+  let text2 = fs16.readFileSync(gi, "utf-8");
   const existing = new Set(text2.split(/\r?\n/).map((l) => l.trim()));
   const appended = required.filter((r) => !existing.has(r));
   if (appended.length === 0) {
@@ -3587,7 +3815,7 @@ function fixGitignore(root) {
   }
   text2 += `${appended.join("\n")}
 `;
-  fs15.writeFileSync(gi, text2, "utf-8");
+  fs16.writeFileSync(gi, text2, "utf-8");
   return {
     name: "fix-gitignore",
     changed: true,
@@ -3595,10 +3823,10 @@ function fixGitignore(root) {
   };
 }
 function patchTomlKv(tomlPath, section, key, value) {
-  const text2 = fs15.readFileSync(tomlPath, "utf-8");
+  const text2 = fs16.readFileSync(tomlPath, "utf-8");
   const updated = updateSection(text2, section, { [key]: value });
   if (updated !== text2) {
-    fs15.writeFileSync(tomlPath, updated, "utf-8");
+    fs16.writeFileSync(tomlPath, updated, "utf-8");
   }
 }
 
@@ -3631,12 +3859,12 @@ var HOSTED_AGENT_REGIONS = /* @__PURE__ */ new Set([
 ]);
 function isFile5(p) {
   try {
-    return fs16.statSync(p).isFile();
+    return fs17.statSync(p).isFile();
   } catch {
     return false;
   }
 }
-function tableOf3(cfg, key) {
+function tableOf4(cfg, key) {
   const v = cfg[key];
   return v !== null && typeof v === "object" && !Array.isArray(v) ? v : {};
 }
@@ -3644,26 +3872,26 @@ function deployWorkspaceRoot(root) {
   return findStudioWorkspaceRoot(root) ?? root;
 }
 function loadStudioCfg(workspaceRoot) {
-  const agentRoot2 = findSubProjectRoot6("agent", workspaceRoot);
+  const agentRoot2 = findSubProjectRoot7("agent", workspaceRoot);
   if (agentRoot2 === null) {
     return {};
   }
-  const tomlPath = path15.join(agentRoot2, "studio.toml");
+  const tomlPath = path16.join(agentRoot2, "studio.toml");
   if (!isFile5(tomlPath)) {
     return {};
   }
   try {
-    return loadStudioToml6(tomlPath);
+    return loadStudioToml7(tomlPath);
   } catch {
     return {};
   }
 }
 function recordAzureDeployment(root, data, endpoint) {
-  const agentRoot2 = findSubProjectRoot6("agent", deployWorkspaceRoot(root));
+  const agentRoot2 = findSubProjectRoot7("agent", deployWorkspaceRoot(root));
   if (agentRoot2 === null) return;
-  const tomlPath = path15.join(agentRoot2, "studio.toml");
+  const tomlPath = path16.join(agentRoot2, "studio.toml");
   try {
-    const name = String(data.id ?? tableOf3(data, "record").id ?? "").trim();
+    const name = String(data.id ?? tableOf4(data, "record").id ?? "").trim();
     if (name) {
       patchTomlKv(tomlPath, "azure", "agent_name", name);
       patchTomlKv(tomlPath, "azure", "deployment_id", name);
@@ -3677,9 +3905,9 @@ function recordAzureDeployment(root, data, endpoint) {
   }
 }
 function clearAzureEndpoint(root) {
-  const agentRoot2 = findSubProjectRoot6("agent", deployWorkspaceRoot(root));
+  const agentRoot2 = findSubProjectRoot7("agent", deployWorkspaceRoot(root));
   if (agentRoot2 === null) return;
-  const tomlPath = path15.join(agentRoot2, "studio.toml");
+  const tomlPath = path16.join(agentRoot2, "studio.toml");
   try {
     for (const key of [
       "agent_endpoint",
@@ -3706,7 +3934,7 @@ function collectAzureSecretPayload(root) {
   const payload = collectRuntimeSecrets(root);
   try {
     const providerCfg = resolveProviderConfig(
-      tableOf3(loadStudioCfg(root), "llm")
+      tableOf4(loadStudioCfg(root), "llm")
     );
     if (providerCfg.baseUrl) {
       payload[LLM_BASE_URL_ENV] = providerCfg.baseUrl;
@@ -3723,7 +3951,7 @@ function stripLeadingDdash(args) {
   return args[0] === "--" ? [...args.slice(1)] : [...args];
 }
 function recordOf(data) {
-  return tableOf3(data, "record");
+  return tableOf4(data, "record");
 }
 async function deployAzureFoundry(opts) {
   const root = opts.projectRoot;
@@ -3798,7 +4026,7 @@ async function destroyAzureFoundry(opts) {
     const extra = opts.purge ? " --purge" : "";
     printOut("=== bag deploy destroy \u2014 teardown plan (dry-run) ===\n");
     printOut(
-      `project: ${path15.basename(workspaceRoot)}  (runtime: azure-foundry)
+      `project: ${path16.basename(workspaceRoot)}  (runtime: azure-foundry)
 `
     );
     printOut("--- Agent (Foundry Hosted Agent) ---");
@@ -3837,11 +4065,11 @@ async function destroyAzureFoundry(opts) {
 }
 var OPENAI_COMPATIBLE_PROVIDERS = ["openai", "openrouter", "pieverse-llm"];
 function agentTomlPath(root) {
-  const agentRoot2 = findSubProjectRoot6("agent", root);
+  const agentRoot2 = findSubProjectRoot7("agent", root);
   if (agentRoot2 === null) {
     return null;
   }
-  const tomlPath = path15.join(agentRoot2, "studio.toml");
+  const tomlPath = path16.join(agentRoot2, "studio.toml");
   return isFile5(tomlPath) ? tomlPath : null;
 }
 function checkAzureBlock(root) {
@@ -3851,7 +4079,7 @@ function checkAzureBlock(root) {
   }
   let cfg;
   try {
-    cfg = loadStudioToml6(tomlPath);
+    cfg = loadStudioToml7(tomlPath);
   } catch {
     return null;
   }
@@ -3865,7 +4093,7 @@ var checkStackRuntimeAzure = async (root, _target) => {
   }
   let cfg;
   try {
-    cfg = loadStudioToml6(tomlPath);
+    cfg = loadStudioToml7(tomlPath);
   } catch (exc) {
     return [
       {
@@ -3875,7 +4103,7 @@ var checkStackRuntimeAzure = async (root, _target) => {
       }
     ];
   }
-  const runtime = String(tableOf3(cfg, "stack").runtime ?? "").trim();
+  const runtime = String(tableOf4(cfg, "stack").runtime ?? "").trim();
   if (runtime !== "azure-foundry") {
     return [
       {
@@ -3957,13 +4185,13 @@ var checkAccountEqualsSubdomain = async (root, _target) => {
   return [];
 };
 var checkEntrypointAndDockerfile = async (root, _target) => {
-  const agentRoot2 = findSubProjectRoot6("agent", root);
+  const agentRoot2 = findSubProjectRoot7("agent", root);
   if (agentRoot2 === null) {
     return [];
   }
   const findings = [];
   const cfg = loadStudioCfg(deployWorkspaceRoot(root));
-  const faces = stackFaces(tableOf3(cfg, "stack"), tableOf3(cfg, "payments"));
+  const faces = stackFaces(tableOf4(cfg, "stack"), tableOf4(cfg, "payments"));
   if (!hasA2aFace(faces) || hasMcpFace(faces)) {
     return [
       {
@@ -3975,7 +4203,7 @@ var checkEntrypointAndDockerfile = async (root, _target) => {
     ];
   }
   const entry = "src/foundryMain.ts";
-  if (!isFile5(path15.join(agentRoot2, entry))) {
+  if (!isFile5(path16.join(agentRoot2, entry))) {
     findings.push({
       level: "CRITICAL",
       name: "azure_agent_entrypoint",
@@ -3983,7 +4211,7 @@ var checkEntrypointAndDockerfile = async (root, _target) => {
       details: { entrypoint: entry }
     });
   }
-  if (!isFile5(path15.join(agentRoot2, "Dockerfile"))) {
+  if (!isFile5(path16.join(agentRoot2, "Dockerfile"))) {
     findings.push({
       level: "CRITICAL",
       name: "azure_dockerfile_present",
@@ -3999,7 +4227,7 @@ var checkLlmExternalProviderReady = async (root, _target) => {
   }
   let cfg;
   try {
-    cfg = loadStudioToml6(tomlPath);
+    cfg = loadStudioToml7(tomlPath);
   } catch {
     return [];
   }
@@ -4033,13 +4261,13 @@ var azureFoundryChecks = [
 ];
 
 // src/cli/llm.ts
-import * as fs17 from "fs";
-import * as path16 from "path";
+import * as fs18 from "fs";
+import * as path17 from "path";
 import { query as auditQuery, auditedOp } from "@bnbagent/studio-runtime/audit";
 import {
   envLocalPath as envLocalPath9,
   findProjectRoot as findProjectRoot2,
-  loadStudioToml as loadStudioToml7
+  loadStudioToml as loadStudioToml8
 } from "@bnbagent/studio-runtime/config";
 import {
   pieverseKeyHash,
@@ -4076,12 +4304,12 @@ function isErrorNamed(exc, name) {
 function errMessage(exc) {
   return exc instanceof Error ? exc.message : String(exc);
 }
-function tableOf4(cfg, key) {
+function tableOf5(cfg, key) {
   const v = cfg[key];
   return v !== null && typeof v === "object" && !Array.isArray(v) ? v : {};
 }
 function ensurePieverseProvider(cfg) {
-  const provider = tableOf4(cfg, "llm").provider;
+  const provider = tableOf5(cfg, "llm").provider;
   if (provider !== "pieverse-llm") {
     const shown = provider === void 0 || provider === null ? "None" : `'${String(provider)}'`;
     throw new PieverseCliError(
@@ -4090,7 +4318,7 @@ function ensurePieverseProvider(cfg) {
   }
 }
 function loadPieverseConfig(cfg) {
-  return { ...tableOf4(tableOf4(cfg, "llm"), "pieverse") };
+  return { ...tableOf5(tableOf5(cfg, "llm"), "pieverse") };
 }
 function resolvePieverseNetwork(cfg, networkOverride) {
   if (networkOverride) {
@@ -4100,7 +4328,7 @@ function resolvePieverseNetwork(cfg, networkOverride) {
   if (pvCfg.network) {
     return String(pvCfg.network);
   }
-  const projectDefault = tableOf4(cfg, "network").default;
+  const projectDefault = tableOf5(cfg, "network").default;
   return projectDefault ? String(projectDefault) : "bsc-mainnet";
 }
 function printUBalanceShortfall(walletAddress, currentRaw, neededRaw, neededUsd, networkName) {
@@ -4149,7 +4377,7 @@ var API_KEY_ENV = {
   // uses AWS credentials chain, no single env var
 };
 var PIEVERSE_ENV_KEY = "PIEVERSE_LLM_API_KEY";
-function tableOf5(cfg, key) {
+function tableOf6(cfg, key) {
   const v = cfg[key];
   return v !== null && typeof v === "object" && !Array.isArray(v) ? v : {};
 }
@@ -4238,8 +4466,8 @@ function registerLlm(program) {
   );
 }
 function loadLlmCfg(providerOverride) {
-  const cfg = loadStudioToml7();
-  const llmCfg = { ...tableOf5(cfg, "llm") };
+  const cfg = loadStudioToml8();
+  const llmCfg = { ...tableOf6(cfg, "llm") };
   if (providerOverride) {
     llmCfg.provider = providerOverride;
   }
@@ -4309,7 +4537,7 @@ function loadFullCfg() {
   }
   let cfg;
   try {
-    cfg = loadStudioToml7(path16.join(root, "studio.toml"));
+    cfg = loadStudioToml8(path17.join(root, "studio.toml"));
   } catch (exc) {
     printErr(`error: failed to parse studio.toml: ${errMessage(exc)}`);
     return null;
@@ -4350,7 +4578,7 @@ function requirePieverse(cfg) {
 }
 function expectedRecipientOf(cfg) {
   return String(
-    tableOf5(tableOf5(cfg, "payments"), "x402").expected_recipient ?? ""
+    tableOf6(tableOf6(cfg, "payments"), "x402").expected_recipient ?? ""
   ).trim();
 }
 function printAllocateDeferred(amountUsd, keyHash, exc) {
@@ -4392,7 +4620,8 @@ async function cmdActivate(opts) {
   }
   const pvCfg = loadPieverseConfig(cfg);
   let existingHash = pvCfg.key_hash ? String(pvCfg.key_hash) : null;
-  const existingEnv = getEnvVar(envLocalPath9(root), PIEVERSE_ENV_KEY) || process.env[PIEVERSE_ENV_KEY];
+  const envFileValue = getEnvVar(envLocalPath9(root), PIEVERSE_ENV_KEY);
+  const existingEnv = envFileValue || process.env[PIEVERSE_ENV_KEY];
   if (!existingHash && existingEnv) {
     const derivedHash = pieverseKeyHash(existingEnv);
     printOut(
@@ -4401,11 +4630,15 @@ async function cmdActivate(opts) {
     try {
       await withSiweRetry(wallet, (token) => inspectKey(token, derivedHash));
     } catch (exc) {
+      const sources = [
+        envFileValue ? `.studio/.env.local (a ${PIEVERSE_ENV_KEY}= line)` : "",
+        process.env[PIEVERSE_ENV_KEY] ? "the shell environment" : ""
+      ].filter(Boolean).join(" and ");
       printErr(
         `error: ${PIEVERSE_ENV_KEY} already exists but its derived key_hash could not be verified: ${errMessage(
           exc
         )}
-The existing key was kept and no new key was created. Restore its key_hash or run \`bag llm rotate\` for an explicit replacement.`
+The existing key was kept and no new key was created. The key comes from ${sources}; \`bag\` reads both, so clear every source \u2014 remove the ${PIEVERSE_ENV_KEY}= line from .studio/.env.local AND \`unset ${PIEVERSE_ENV_KEY}\` in the shell \u2014 then re-run \`bag llm activate\` to mint a fresh key. (\`bag llm rotate\` replaces a key that is still valid in Pieverse; it cannot recover this one.)`
       );
       return 2;
     }
@@ -4646,9 +4879,9 @@ Retry: re-run \`bag llm activate\` \u2014 key_hash is saved so it will pick up w
   return 0;
 }
 function updateStudioTomlSection(root, section, updates) {
-  const tomlPath = path16.join(root, "studio.toml");
-  const text2 = fs17.readFileSync(tomlPath, "utf-8");
-  fs17.writeFileSync(tomlPath, updateSection(text2, section, updates), "utf-8");
+  const tomlPath = path17.join(root, "studio.toml");
+  const text2 = fs18.readFileSync(tomlPath, "utf-8");
+  fs18.writeFileSync(tomlPath, updateSection(text2, section, updates), "utf-8");
 }
 function cumulativeTopupsUsd() {
   let total = 0;
@@ -4739,8 +4972,8 @@ async function cmdStatus(full) {
   const remainingRaw = info.remaining_usd;
   const remaining = remainingRaw === void 0 || remainingRaw === null ? null : Number(remainingRaw);
   const balanceStr = remaining === null ? "unknown (Pieverse inspect endpoint did not return balance field)" : `$${remaining.toFixed(4)}`;
-  const llmCfg = tableOf5(cfg, "llm");
-  const policy = pieversePolicyFromToml(tableOf5(llmCfg, "auto_renew"));
+  const llmCfg = tableOf6(cfg, "llm");
+  const policy = pieversePolicyFromToml(tableOf6(llmCfg, "auto_renew"));
   printOut("provider:        pieverse-llm");
   const model = llmCfg.model ? String(llmCfg.model) : null;
   printOut(`model:           ${model ?? "(unset \u2014 provider default)"}`);
@@ -4844,9 +5077,9 @@ function autoRenewStatus() {
   }
   const [cfg] = loaded;
   const llmPolicy = pieversePolicyFromToml(
-    tableOf5(tableOf5(cfg, "llm"), "auto_renew")
+    tableOf6(tableOf6(cfg, "llm"), "auto_renew")
   );
-  const budgetPolicy = policyFromToml(tableOf5(cfg, "budget"));
+  const budgetPolicy = policyFromToml(tableOf6(cfg, "budget"));
   printOut("auto-renew status (two independent tiers):");
   printOut("");
   printOut(
@@ -5197,8 +5430,8 @@ function normalizeNodeDeps(deps) {
 }
 
 // src/cli/recipes/loader.ts
-import * as fs18 from "fs";
-import * as path17 from "path";
+import * as fs19 from "fs";
+import * as path18 from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { parse as parse5 } from "smol-toml";
 var PLACEHOLDER_RE = /\{\{\s*([A-Za-z_][A-Za-z0-9_]*)\s*\}\}/g;
@@ -5207,12 +5440,12 @@ function bundledRecipesRoot() {
   if (override) {
     return override;
   }
-  let dir = path17.dirname(fileURLToPath3(import.meta.url));
+  let dir = path18.dirname(fileURLToPath3(import.meta.url));
   for (; ; ) {
-    if (fs18.existsSync(path17.join(dir, "package.json"))) {
-      return path17.join(dir, "recipes");
+    if (fs19.existsSync(path18.join(dir, "package.json"))) {
+      return path18.join(dir, "recipes");
     }
-    const parent = path17.dirname(dir);
+    const parent = path18.dirname(dir);
     if (parent === dir) {
       throw new Error("cannot locate the studio-cli package root");
     }
@@ -5236,24 +5469,24 @@ function defaultMode(recipe) {
 }
 function listRecipes(root) {
   const base = root ?? bundledRecipesRoot();
-  if (!fs18.existsSync(base)) {
+  if (!fs19.existsSync(base)) {
     return [];
   }
-  return fs18.readdirSync(base).filter(
-    (name) => !name.startsWith("_") && fs18.existsSync(path17.join(base, name, "recipe.toml")) && fs18.statSync(path17.join(base, name)).isDirectory()
+  return fs19.readdirSync(base).filter(
+    (name) => !name.startsWith("_") && fs19.existsSync(path18.join(base, name, "recipe.toml")) && fs19.statSync(path18.join(base, name)).isDirectory()
   ).sort();
 }
 var RecipeModeError = class extends Error {
 };
 function loadRecipe(name, opts = {}) {
   const base = opts.root ?? bundledRecipesRoot();
-  const recipeDir = path17.join(base, name);
-  const tomlPath = path17.join(recipeDir, "recipe.toml");
-  if (!fs18.existsSync(tomlPath) || !fs18.statSync(tomlPath).isFile()) {
+  const recipeDir = path18.join(base, name);
+  const tomlPath = path18.join(recipeDir, "recipe.toml");
+  if (!fs19.existsSync(tomlPath) || !fs19.statSync(tomlPath).isFile()) {
     throw new Error(`Recipe '${name}' not found at ${tomlPath}`);
   }
-  const metadata = parse5(fs18.readFileSync(tomlPath, "utf-8"));
-  const allFiles = collectTemplateFiles(path17.join(recipeDir, "code"));
+  const metadata = parse5(fs19.readFileSync(tomlPath, "utf-8"));
+  const allFiles = collectTemplateFiles(path18.join(recipeDir, "code"));
   const modesMeta = metaTable(metadata, "modes");
   const mode = opts.mode ?? null;
   if (Object.keys(modesMeta).length === 0) {
@@ -5300,22 +5533,22 @@ function modeFiles(modesMeta, modeName) {
   return Array.isArray(files) ? files.filter((f) => typeof f === "string") : [];
 }
 function collectTemplateFiles(codeDir) {
-  if (!fs18.existsSync(codeDir) || !fs18.statSync(codeDir).isDirectory()) {
+  if (!fs19.existsSync(codeDir) || !fs19.statSync(codeDir).isDirectory()) {
     return [];
   }
   const out = [];
   const walk = (dir) => {
-    for (const name of fs18.readdirSync(dir).sort()) {
-      const full = path17.join(dir, name);
-      if (fs18.statSync(full).isDirectory()) {
+    for (const name of fs19.readdirSync(dir).sort()) {
+      const full = path18.join(dir, name);
+      if (fs19.statSync(full).isDirectory()) {
         walk(full);
       } else {
-        const rel = path17.relative(codeDir, full);
+        const rel = path18.relative(codeDir, full);
         const target = rel.endsWith(".tmpl") ? rel.slice(0, -".tmpl".length) : rel;
         out.push({
           // Recipes use forward slashes regardless of host OS.
-          targetPath: target.split(path17.sep).join("/"),
-          content: fs18.readFileSync(full, "utf-8")
+          targetPath: target.split(path18.sep).join("/"),
+          content: fs19.readFileSync(full, "utf-8")
         });
       }
     }
@@ -5382,9 +5615,9 @@ function renderRecipe(recipe, opts = {}) {
 
 // src/cli/skillsInstaller.ts
 import * as crypto3 from "crypto";
-import * as fs19 from "fs";
+import * as fs20 from "fs";
 import * as os2 from "os";
-import * as path18 from "path";
+import * as path19 from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 var SUPPORTED_TARGETS = ["claude-code", "cursor"];
 var SUPPORTED_SCOPES = ["user", "project"];
@@ -5431,14 +5664,14 @@ var HIDDEN_SKILL_NAMES = /* @__PURE__ */ new Set([
 ]);
 function isDir3(p) {
   try {
-    return fs19.statSync(p).isDirectory();
+    return fs20.statSync(p).isDirectory();
   } catch {
     return false;
   }
 }
 function isFile6(p) {
   try {
-    return fs19.statSync(p).isFile();
+    return fs20.statSync(p).isFile();
   } catch {
     return false;
   }
@@ -5448,15 +5681,15 @@ function sha256(text2) {
 }
 function resolveSkillsSource() {
   const pkgRoot = packageRoot2();
-  return pkgRoot !== null ? path18.join(pkgRoot, "skills") : path18.join(path18.dirname(fileURLToPath4(import.meta.url)), "skills");
+  return pkgRoot !== null ? path19.join(pkgRoot, "skills") : path19.join(path19.dirname(fileURLToPath4(import.meta.url)), "skills");
 }
 function packageRoot2() {
-  let dir = path18.dirname(fileURLToPath4(import.meta.url));
+  let dir = path19.dirname(fileURLToPath4(import.meta.url));
   for (; ; ) {
-    if (fs19.existsSync(path18.join(dir, "package.json"))) {
+    if (fs20.existsSync(path19.join(dir, "package.json"))) {
       return dir;
     }
-    const parent = path18.dirname(dir);
+    const parent = path19.dirname(dir);
     if (parent === dir) {
       return null;
     }
@@ -5468,18 +5701,18 @@ function listSourceSkills(source) {
   if (!isDir3(source)) {
     return [];
   }
-  return fs19.readdirSync(source).filter(
-    (name) => name.endsWith(".md") && !name.startsWith("_") && !HIDDEN_SKILL_NAMES.has(stem(name)) && isFile6(path18.join(source, name))
-  ).sort().map((name) => path18.join(source, name));
+  return fs20.readdirSync(source).filter(
+    (name) => name.endsWith(".md") && !name.startsWith("_") && !HIDDEN_SKILL_NAMES.has(stem(name)) && isFile6(path19.join(source, name))
+  ).sort().map((name) => path19.join(source, name));
 }
 function listSourceReferences(source) {
-  const refs = path18.join(source, "references");
+  const refs = path19.join(source, "references");
   if (!isDir3(refs)) {
     return [];
   }
-  return fs19.readdirSync(refs).filter(
-    (name) => name.endsWith(".md") && !name.startsWith("_") && !HIDDEN_SKILL_NAMES.has(stem(name)) && isFile6(path18.join(refs, name))
-  ).sort().map((name) => path18.join(refs, name));
+  return fs20.readdirSync(refs).filter(
+    (name) => name.endsWith(".md") && !name.startsWith("_") && !HIDDEN_SKILL_NAMES.has(stem(name)) && isFile6(path19.join(refs, name))
+  ).sort().map((name) => path19.join(refs, name));
 }
 function stem(fileName) {
   return fileName.replace(/\.[^.]+$/, "");
@@ -5487,15 +5720,15 @@ function stem(fileName) {
 function whichSync(name) {
   const pathEnv = process.env.PATH ?? "";
   const exts = process.platform === "win32" ? ["", ".cmd", ".exe", ".bat"] : [""];
-  for (const dir of pathEnv.split(path18.delimiter)) {
+  for (const dir of pathEnv.split(path19.delimiter)) {
     if (!dir) {
       continue;
     }
     for (const ext of exts) {
-      const candidate = path18.join(dir, name + ext);
+      const candidate = path19.join(dir, name + ext);
       try {
-        fs19.accessSync(candidate, fs19.constants.X_OK);
-        if (fs19.statSync(candidate).isFile()) {
+        fs20.accessSync(candidate, fs20.constants.X_OK);
+        if (fs20.statSync(candidate).isFile()) {
           return candidate;
         }
       } catch {
@@ -5506,14 +5739,14 @@ function whichSync(name) {
 }
 function claudeCodeInstalled(opts = {}) {
   const home = opts.home ?? os2.homedir();
-  if (isDir3(path18.join(home, ".claude"))) {
+  if (isDir3(path19.join(home, ".claude"))) {
     return true;
   }
   return (opts.which ?? whichSync)("claude") !== null;
 }
 function cursorInstalled(opts = {}) {
   const home = opts.home ?? os2.homedir();
-  if (isDir3(path18.join(home, ".cursor"))) {
+  if (isDir3(path19.join(home, ".cursor"))) {
     return true;
   }
   return (opts.which ?? whichSync)("cursor") !== null;
@@ -5536,9 +5769,9 @@ function anySkillsInstalled(opts = {}) {
   for (const target of detectTargets(opts)) {
     const tdir = resolveTargetDir({ target, scope: "user", home: opts.home });
     for (const skill of sources) {
-      const name = stem(path18.basename(skill));
-      const rel = target === "claude-code" ? path18.join(name, "SKILL.md") : `${name}.mdc`;
-      if (isFile6(path18.join(tdir, rel))) {
+      const name = stem(path19.basename(skill));
+      const rel = target === "claude-code" ? path19.join(name, "SKILL.md") : `${name}.mdc`;
+      if (isFile6(path19.join(tdir, rel))) {
         return true;
       }
     }
@@ -5563,7 +5796,7 @@ function resolveTargetDir(opts) {
   }
   const base = scope === "user" ? opts.home ?? os2.homedir() : opts.projectRoot ?? process.cwd();
   const [d1, d2] = TARGET_SUBDIR[target];
-  return path18.join(base, d1, d2);
+  return path19.join(base, d1, d2);
 }
 function splitFrontmatter(text2) {
   const lines = text2.split("\n");
@@ -5621,16 +5854,16 @@ function iterRenderedPayloads(src, target) {
   for (const skill of listSourceSkills(src)) {
     payloads.push(
       renderSkillPayload(
-        fs19.readFileSync(skill, "utf-8"),
-        stem(path18.basename(skill)),
+        fs20.readFileSync(skill, "utf-8"),
+        stem(path19.basename(skill)),
         target
       )
     );
   }
   for (const ref of listSourceReferences(src)) {
     payloads.push([
-      `${ROUTER_SKILL_NAME}/references/${path18.basename(ref)}`,
-      fs19.readFileSync(ref, "utf-8")
+      `${ROUTER_SKILL_NAME}/references/${path19.basename(ref)}`,
+      fs20.readFileSync(ref, "utf-8")
     ]);
   }
   return payloads;
@@ -5642,7 +5875,7 @@ function packageVersion() {
       return "unknown";
     }
     const pkg = JSON.parse(
-      fs19.readFileSync(path18.join(root, "package.json"), "utf-8")
+      fs20.readFileSync(path19.join(root, "package.json"), "utf-8")
     );
     return typeof pkg.version === "string" ? pkg.version : "unknown";
   } catch {
@@ -5661,11 +5894,11 @@ function contentKey(payloads) {
   return h.digest("hex");
 }
 function metaPath(tdir) {
-  return path18.join(tdir, ROUTER_SKILL_NAME, META_FILENAME);
+  return path19.join(tdir, ROUTER_SKILL_NAME, META_FILENAME);
 }
 function loadMeta(tdir) {
   try {
-    const data = JSON.parse(fs19.readFileSync(metaPath(tdir), "utf-8"));
+    const data = JSON.parse(fs20.readFileSync(metaPath(tdir), "utf-8"));
     return data !== null && typeof data === "object" && !Array.isArray(data) ? data : null;
   } catch {
     return null;
@@ -5682,15 +5915,15 @@ function writeMeta(tdir, payloads) {
     package_version: packageVersion()
   };
   const p = metaPath(tdir);
-  fs19.mkdirSync(path18.dirname(p), { recursive: true });
-  fs19.writeFileSync(p, `${JSON.stringify(meta, null, 2)}
+  fs20.mkdirSync(path19.dirname(p), { recursive: true });
+  fs20.writeFileSync(p, `${JSON.stringify(meta, null, 2)}
 `);
 }
 function installedMarker(tdir, target) {
   if (target === "cursor") {
-    return path18.join(tdir, `${ROUTER_SKILL_NAME}.mdc`);
+    return path19.join(tdir, `${ROUTER_SKILL_NAME}.mdc`);
   }
-  return path18.join(tdir, ROUTER_SKILL_NAME, "SKILL.md");
+  return path19.join(tdir, ROUTER_SKILL_NAME, "SKILL.md");
 }
 function syncInstalledSkills(opts = {}) {
   const src = opts.source ?? SKILLS_SOURCE;
@@ -5727,15 +5960,15 @@ function syncOneDir(tdir, payloads) {
   const wrote = [];
   const keptEdited = [];
   for (const [rel, content] of payloads) {
-    const dest = path18.join(tdir, rel);
+    const dest = path19.join(tdir, rel);
     const newHash = sha256(content);
-    const cur = isFile6(dest) ? sha256(fs19.readFileSync(dest, "utf-8")) : null;
+    const cur = isFile6(dest) ? sha256(fs20.readFileSync(dest, "utf-8")) : null;
     if (cur === newHash) {
       continue;
     }
     if (cur === null || cur === recordedFiles[rel]) {
-      fs19.mkdirSync(path18.dirname(dest), { recursive: true });
-      fs19.writeFileSync(dest, content);
+      fs20.mkdirSync(path19.dirname(dest), { recursive: true });
+      fs20.writeFileSync(dest, content);
       wrote.push(rel);
     } else {
       keptEdited.push(rel);
@@ -5746,15 +5979,15 @@ function syncOneDir(tdir, payloads) {
     if (shipped.has(rel)) {
       continue;
     }
-    const dest = path18.join(tdir, rel);
+    const dest = path19.join(tdir, rel);
     try {
-      if (isFile6(dest) && sha256(fs19.readFileSync(dest, "utf-8")) === recorded) {
-        fs19.unlinkSync(dest);
+      if (isFile6(dest) && sha256(fs20.readFileSync(dest, "utf-8")) === recorded) {
+        fs20.unlinkSync(dest);
         wrote.push(`removed ${rel}`);
-        let parent = path18.dirname(dest);
-        while (parent !== tdir && isDir3(parent) && fs19.readdirSync(parent).length === 0) {
-          fs19.rmdirSync(parent);
-          parent = path18.dirname(parent);
+        let parent = path19.dirname(dest);
+        while (parent !== tdir && isDir3(parent) && fs20.readdirSync(parent).length === 0) {
+          fs20.rmdirSync(parent);
+          parent = path19.dirname(parent);
         }
       }
     } catch {
@@ -5784,45 +6017,45 @@ function installSkills(opts) {
     projectRoot: opts.projectRoot,
     home: opts.home
   });
-  fs19.mkdirSync(tdir, { recursive: true });
+  fs20.mkdirSync(tdir, { recursive: true });
   const installed = [];
   const skipped = [];
   for (const skill of skillFiles) {
-    const skillName = stem(path18.basename(skill));
-    const srcText = fs19.readFileSync(skill, "utf-8");
+    const skillName = stem(path19.basename(skill));
+    const srcText = fs20.readFileSync(skill, "utf-8");
     const [relPath, content] = renderSkillPayload(srcText, skillName, target);
-    const dest = path18.join(tdir, relPath);
-    fs19.mkdirSync(path18.dirname(dest), { recursive: true });
-    if (isFile6(dest) && sha256(fs19.readFileSync(dest, "utf-8")) === sha256(content)) {
+    const dest = path19.join(tdir, relPath);
+    fs20.mkdirSync(path19.dirname(dest), { recursive: true });
+    if (isFile6(dest) && sha256(fs20.readFileSync(dest, "utf-8")) === sha256(content)) {
       skipped.push(skillName);
     } else {
-      fs19.writeFileSync(dest, content);
+      fs20.writeFileSync(dest, content);
       installed.push(skillName);
     }
     if (target === "claude-code") {
-      const legacyFlat = path18.join(tdir, path18.basename(skill));
+      const legacyFlat = path19.join(tdir, path19.basename(skill));
       if (isFile6(legacyFlat)) {
-        fs19.unlinkSync(legacyFlat);
+        fs20.unlinkSync(legacyFlat);
       }
     }
   }
   for (const ref of listSourceReferences(src)) {
-    const rel = `${ROUTER_SKILL_NAME}/references/${path18.basename(ref)}`;
-    const dest = path18.join(tdir, rel);
-    fs19.mkdirSync(path18.dirname(dest), { recursive: true });
-    const content = fs19.readFileSync(ref, "utf-8");
-    if (isFile6(dest) && sha256(fs19.readFileSync(dest, "utf-8")) === sha256(content)) {
+    const rel = `${ROUTER_SKILL_NAME}/references/${path19.basename(ref)}`;
+    const dest = path19.join(tdir, rel);
+    fs20.mkdirSync(path19.dirname(dest), { recursive: true });
+    const content = fs20.readFileSync(ref, "utf-8");
+    if (isFile6(dest) && sha256(fs20.readFileSync(dest, "utf-8")) === sha256(content)) {
       skipped.push(rel);
     } else {
-      fs19.writeFileSync(dest, content);
+      fs20.writeFileSync(dest, content);
       installed.push(rel);
     }
   }
-  if (isDir3(path18.join(tdir, ROUTER_SKILL_NAME))) {
+  if (isDir3(path19.join(tdir, ROUTER_SKILL_NAME))) {
     writeMeta(tdir, iterRenderedPayloads(src, target));
   }
-  const legacy = target === "claude-code" ? LEGACY_SKILL_NAMES.filter((name) => isDir3(path18.join(tdir, name))) : LEGACY_SKILL_NAMES.filter(
-    (name) => isFile6(path18.join(tdir, `${name}.mdc`))
+  const legacy = target === "claude-code" ? LEGACY_SKILL_NAMES.filter((name) => isDir3(path19.join(tdir, name))) : LEGACY_SKILL_NAMES.filter(
+    (name) => isFile6(path19.join(tdir, `${name}.mdc`))
   );
   return {
     target,
@@ -5848,18 +6081,20 @@ function acceptChoices(option, accepted, advertised) {
 }
 
 // src/cli/wallet.ts
-import * as fs21 from "fs";
-import * as path20 from "path";
+import * as fs22 from "fs";
+import * as os3 from "os";
+import * as path21 from "path";
 import { EVMWalletProvider, SigningPolicy } from "@bnbagent/sdk";
 import {
+  envLocalPath as envLocalPath10,
   findProjectRoot as findProjectRoot3,
-  loadStudioToml as loadStudioToml9
+  loadStudioToml as loadStudioToml10
 } from "@bnbagent/studio-runtime/config";
 import { buildPolicy, buildWallet } from "@bnbagent/studio-runtime/wallet";
 
 // src/cli/walletSession.ts
-import * as fs20 from "fs";
-import * as path19 from "path";
+import * as fs21 from "fs";
+import * as path20 from "path";
 import { AltanaWalletProvider } from "@bnbagent/sdk";
 import { getAddress as deployedAddresses } from "@bnbagent/sdk/networks";
 import {
@@ -5868,7 +6103,7 @@ import {
   serializeSession
 } from "@bnbagent/sdk/wallets";
 import { auditedOp as auditedOp2 } from "@bnbagent/studio-runtime/audit";
-import { loadStudioToml as loadStudioToml8 } from "@bnbagent/studio-runtime/config";
+import { loadStudioToml as loadStudioToml9 } from "@bnbagent/studio-runtime/config";
 import { getNetwork as getNetwork5, toRaw as toRaw2 } from "@bnbagent/studio-runtime/networks";
 import { writePrivate } from "@bnbagent/studio-runtime/secretWrite";
 import {
@@ -5878,18 +6113,18 @@ import {
 var defaultAdminFactory = (opts) => AltanaWalletProvider.adminFromKeystore(opts);
 var adminFactory = defaultAdminFactory;
 var sessionDeserializer = deserializeSession;
-function tableOf6(value) {
+function tableOf7(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
 function loadContext(projectRoot) {
-  const cfg = loadStudioToml8(path19.join(projectRoot, "studio.toml"));
-  const walletCfg = tableOf6(cfg.wallet);
+  const cfg = loadStudioToml9(path20.join(projectRoot, "studio.toml"));
+  const walletCfg = tableOf7(cfg.wallet);
   if (String(walletCfg.kind ?? "evm-local") !== "altana") {
     throw new Error(
       `wallet session commands require [wallet].kind='altana' (got ${JSON.stringify(walletCfg.kind ?? "evm-local")}).`
     );
   }
-  const networkName = String(tableOf6(cfg.network).default ?? "bsc-testnet");
+  const networkName = String(tableOf7(cfg.network).default ?? "bsc-testnet");
   const altanaNetwork = ALTANA_NETWORK_BY_STUDIO[networkName];
   if (altanaNetwork === void 0) {
     throw new Error(
@@ -5904,7 +6139,7 @@ function loadContext(projectRoot) {
   }
   const resolvePath = (value, fallback) => {
     const configured = String(value ?? fallback);
-    return path19.isAbsolute(configured) ? configured : path19.join(projectRoot, configured);
+    return path20.isAbsolute(configured) ? configured : path20.join(projectRoot, configured);
   };
   return {
     projectRoot,
@@ -5952,8 +6187,8 @@ function parseSessionEnvelope(serialized) {
       `invalid Altana session JSON: ${error instanceof Error ? error.message : String(error)}`
     );
   }
-  const record = tableOf6(parsed);
-  if (record.version !== 1 || typeof record.walletAddress !== "string" || typeof record.publicKey !== "string" || !record.publicKey.startsWith("0x") || typeof record.expiry !== "number" || Object.keys(tableOf6(record.permissions)).length === 0) {
+  const record = tableOf7(parsed);
+  if (record.version !== 1 || typeof record.walletAddress !== "string" || typeof record.publicKey !== "string" || !record.publicKey.startsWith("0x") || typeof record.expiry !== "number" || Object.keys(tableOf7(record.permissions)).length === 0) {
     throw new Error(
       "invalid Altana session envelope (expected version/walletAddress/publicKey/expiry/permissions)."
     );
@@ -5962,13 +6197,13 @@ function parseSessionEnvelope(serialized) {
     walletAddress: record.walletAddress,
     publicKey: record.publicKey,
     expiry: record.expiry,
-    permissions: tableOf6(record.permissions)
+    permissions: tableOf7(record.permissions)
   };
 }
 function readSession(ctx) {
   let serialized;
   try {
-    serialized = fs20.readFileSync(ctx.sessionFile, "utf8");
+    serialized = fs21.readFileSync(ctx.sessionFile, "utf8");
   } catch {
     throw new Error(
       `no Altana session file at ${ctx.sessionFile} \u2014 run \`bag wallet session grant\`.`
@@ -5977,8 +6212,8 @@ function readSession(ctx) {
   return { serialized, envelope: parseSessionEnvelope(serialized) };
 }
 function writeSession(ctx, session) {
-  fs20.mkdirSync(path19.dirname(ctx.sessionFile), { recursive: true, mode: 448 });
-  fs20.chmodSync(path19.dirname(ctx.sessionFile), 448);
+  fs21.mkdirSync(path20.dirname(ctx.sessionFile), { recursive: true, mode: 448 });
+  fs21.chmodSync(path20.dirname(ctx.sessionFile), 448);
   writePrivate(ctx.sessionFile, serializeSession(session));
 }
 function sessionKeyFingerprint(publicKey) {
@@ -6089,7 +6324,7 @@ async function cmdSessionGrant(opts) {
     "--budget-u"
   );
   let existing = null;
-  if (fs20.existsSync(ctx.sessionFile)) {
+  if (fs21.existsSync(ctx.sessionFile)) {
     existing = readSession(ctx).envelope;
     if (!opts.force) {
       throw new Error(
@@ -6171,8 +6406,8 @@ function cmdSessionStatus(projectRootArg) {
   const spend = envelope.permissions.spend;
   if (Array.isArray(spend)) {
     for (const [index, cap] of spend.entries()) {
-      const record = tableOf6(cap);
-      const encoded = tableOf6(record.limit).$bigint;
+      const record = tableOf7(cap);
+      const encoded = tableOf7(record.limit).$bigint;
       const limit = typeof encoded === "string" ? encoded : String(record.limit);
       printOut(
         `spend[${index}]:     limit=${limit} period=${String(record.period ?? "day")} token=${String(record.token ?? "native")}`
@@ -6207,7 +6442,7 @@ async function cmdSessionRevoke(opts) {
       await admin.revokeSession(envelope.publicKey);
     }
   );
-  fs20.unlinkSync(ctx.sessionFile);
+  fs21.unlinkSync(ctx.sessionFile);
   printErr(`\u2713 Altana session revoked and removed: ${ctx.sessionFile}`);
   return 0;
 }
@@ -6331,8 +6566,8 @@ var ProjectRootNotFound = class extends Error {
 };
 function resolveWalletProjectRoot(argRoot) {
   if (argRoot != null) {
-    const root2 = path20.resolve(argRoot);
-    if (!isFile7(path20.join(root2, "studio.toml"))) {
+    const root2 = path21.resolve(argRoot);
+    if (!isFile7(path21.join(root2, "studio.toml"))) {
       throw new ProjectRootNotFound(
         `No studio.toml found under --project-root ${root2}`
       );
@@ -6349,13 +6584,13 @@ function resolveWalletProjectRoot(argRoot) {
 }
 function isFile7(p) {
   try {
-    return fs21.statSync(p).isFile();
+    return fs22.statSync(p).isFile();
   } catch {
     return false;
   }
 }
 function loadWalletCfg(projectRoot) {
-  const data = loadStudioToml9(path20.join(projectRoot, "studio.toml"));
+  const data = loadStudioToml10(path21.join(projectRoot, "studio.toml"));
   const wallet = data.wallet;
   return wallet !== null && typeof wallet === "object" && !Array.isArray(wallet) ? wallet : {};
 }
@@ -6365,7 +6600,7 @@ function walletKind(walletCfg) {
 function projectNetwork(projectRoot) {
   let data;
   try {
-    data = loadStudioToml9(path20.join(projectRoot, "studio.toml"));
+    data = loadStudioToml10(path21.join(projectRoot, "studio.toml"));
   } catch {
     return "bsc-testnet";
   }
@@ -6387,13 +6622,29 @@ function requirePassword2() {
   }
   return pw;
 }
+function requireDurablePassword(projectRoot) {
+  const password = requirePassword2();
+  const envPath = envLocalPath10(projectRoot);
+  const persisted = getEnvVar(envPath, PASSWORD_ENV2);
+  if (!persisted) {
+    throw new Error(
+      `refusing to create a keystore with an unpersisted ${PASSWORD_ENV2}. Edit ${envPath}, set ${PASSWORD_ENV2} there, and retry; do not pass wallet passwords on the command line.`
+    );
+  }
+  if (persisted !== password) {
+    throw new Error(
+      `refusing to create a keystore because the active ${PASSWORD_ENV2} does not match ${envPath}. Make the durable file value authoritative before retrying.`
+    );
+  }
+  return password;
+}
 function persistAddress(projectRoot, address) {
-  const tomlPath = path20.join(projectRoot, "studio.toml");
+  const tomlPath = path21.join(projectRoot, "studio.toml");
   if (!isFile7(tomlPath)) {
     return;
   }
-  const text2 = fs21.readFileSync(tomlPath, "utf-8");
-  fs21.writeFileSync(
+  const text2 = fs22.readFileSync(tomlPath, "utf-8");
+  fs22.writeFileSync(
     tomlPath,
     updateSection(text2, "wallet", { address }),
     "utf-8"
@@ -6409,7 +6660,7 @@ function resolveKeystoreDir2(projectRoot, cliOverride, walletCfg) {
   } else {
     d = ".studio/wallets";
   }
-  return path20.isAbsolute(d) ? d : path20.join(projectRoot, d);
+  return path21.isAbsolute(d) ? d : path21.join(projectRoot, d);
 }
 async function resolvePrivateKeyArg(raw) {
   if (raw === void 0 || raw === false) {
@@ -6442,7 +6693,7 @@ function registerWallet(program) {
     )
   );
   p.command("twak-init").description(
-    "Create the project's twak wallet WITHOUT putting the password on argv (wallet.kind=twak): wraps `twak wallet create --no-keychain` reading the password from stdin / a 0600 file / a hidden prompt, then adopts the address like `bag wallet new`."
+    "Create the project's twak wallet without YOU typing the password on a command line (wallet.kind=twak): wraps `twak wallet create --no-keychain` reading the password from stdin / a 0600 file / a hidden prompt, seeds the NaaS credentials, then adopts the address like `bag wallet new`. twak requires --password on its own argv, so the value does reach that short-lived child process."
   ).option(
     "--password-stdin",
     'Read the wallet password from stdin (CI: `printf %s "$PW" | bag wallet twak-init --password-stdin`).'
@@ -6524,7 +6775,7 @@ async function cmdNew(opts) {
     projectRoot = process.cwd();
   }
   let walletCfg = {};
-  if (isFile7(path20.join(projectRoot, "studio.toml"))) {
+  if (isFile7(path21.join(projectRoot, "studio.toml"))) {
     walletCfg = loadWalletCfg(projectRoot);
   }
   const kind = walletKind(walletCfg);
@@ -6532,13 +6783,13 @@ async function cmdNew(opts) {
     return cmdNewTwak(projectRoot, walletCfg);
   }
   const privateKey = await resolvePrivateKeyArg(opts.privateKey);
-  const password = requirePassword2();
+  const password = requireDurablePassword(projectRoot);
   const keystoreDir = resolveKeystoreDir2(
     projectRoot,
     opts.keystoreDir,
     walletCfg
   );
-  fs21.mkdirSync(keystoreDir, { recursive: true });
+  fs22.mkdirSync(keystoreDir, { recursive: true });
   const provider = new EVMWalletProvider({
     password,
     ...privateKey !== null ? { privateKey } : {},
@@ -6566,7 +6817,7 @@ Install it (Node >=22):  npm install -g @trustwallet/cli@${TWAK_CLI_VERSION}`
     let createCmd = "twak wallet create --password <your-password> --no-keychain";
     let setupCmd = "twak setup";
     if (walletCfg.twak_home) {
-      const home = path20.dirname(path20.dirname(walletFile));
+      const home = path21.dirname(path21.dirname(walletFile));
       createCmd = `HOME=${home} ${createCmd}`;
       setupCmd = `HOME=${home} ${setupCmd}`;
     }
@@ -6591,16 +6842,39 @@ Install it (Node >=22):  npm install -g @trustwallet/cli@${TWAK_CLI_VERSION}`
   persistAddress(projectRoot, address);
   return 0;
 }
+function ensureTwakCredentials(walletFile, homeDir) {
+  const twakDir = path21.dirname(walletFile);
+  const target = path21.join(twakDir, "credentials.json");
+  if (isFile7(target)) {
+    return true;
+  }
+  const machine = path21.join(os3.homedir(), ".twak", "credentials.json");
+  if (path21.resolve(machine) === path21.resolve(target) || !isFile7(machine)) {
+    printErr(
+      `error: no Trust Wallet NaaS credentials for this wallet home \u2014 ${target} is missing. Get an Access ID + HMAC secret from https://portal.trustwallet.com/dashboard/apps, run \`HOME=${homeDir} twak setup\` once, then re-run this command.`
+    );
+    return false;
+  }
+  fs22.mkdirSync(twakDir, { recursive: true });
+  fs22.writeFileSync(target, fs22.readFileSync(machine, "utf-8"), { mode: 384 });
+  try {
+    fs22.chmodSync(twakDir, 448);
+    fs22.chmodSync(target, 384);
+  } catch {
+  }
+  printErr(`note: copied NaaS credentials from ${machine} into ${twakDir}.`);
+  return true;
+}
 async function resolveTwakInitPassword(opts) {
   if (opts.passwordStdin && opts.passwordFile) {
     printErr("error: pass exactly one of --password-stdin or --password-file.");
     throw new CliExit(2);
   }
   if (opts.passwordFile) {
-    const file = path20.resolve(opts.passwordFile);
+    const file = path21.resolve(opts.passwordFile);
     let mode;
     try {
-      mode = fs21.statSync(file).mode;
+      mode = fs22.statSync(file).mode;
     } catch {
       printErr(`error: cannot read --password-file ${file}.`);
       throw new CliExit(2);
@@ -6611,7 +6885,7 @@ async function resolveTwakInitPassword(opts) {
       );
       throw new CliExit(2);
     }
-    const password = (fs21.readFileSync(file, "utf-8").split(/\r?\n/)[0] ?? "").trim();
+    const password = (fs22.readFileSync(file, "utf-8").split(/\r?\n/)[0] ?? "").trim();
     if (!password) {
       printErr(`error: --password-file ${file} is empty.`);
       throw new CliExit(2);
@@ -6671,11 +6945,14 @@ Install it (Node >=22):  npm install -g @trustwallet/cli@${TWAK_CLI_VERSION}`
     return 1;
   }
   const password = await resolveTwakInitPassword(opts);
-  const homeDir = path20.dirname(path20.dirname(walletFile));
-  fs21.mkdirSync(homeDir, { recursive: true });
+  const homeDir = path21.dirname(path21.dirname(walletFile));
+  fs22.mkdirSync(homeDir, { recursive: true });
+  if (!ensureTwakCredentials(walletFile, homeDir)) {
+    return 1;
+  }
   const create = await runCapture(
     "twak",
-    ["wallet", "create", "--no-keychain"],
+    ["wallet", "create", "--password", password, "--no-keychain"],
     {
       env: {
         ...process.env,
@@ -6683,8 +6960,8 @@ Install it (Node >=22):  npm install -g @trustwallet/cli@${TWAK_CLI_VERSION}`
         TWAK_WALLET_PASSWORD: password,
         TWAK_NONINTERACTIVE: "1"
       },
-      // A prompting twak build reads these lines; an env-reading one
-      // ignores them. Either way the password never touches argv.
+      // A prompting twak build reads these lines; an env-reading one ignores
+      // them. Both channels are kept alongside the required argv flag.
       input: `${password}
 ${password}
 `,
@@ -6695,8 +6972,8 @@ ${password}
     const detail = `${create.stderr}
 ${create.stdout}`.trim();
     printErr(
-      `error: \`twak wallet create --no-keychain\` did not produce ${walletFile}${detail ? `:
-${detail}` : "."}`
+      detail ? `error: \`twak wallet create --no-keychain\` failed:
+${detail}` : `error: \`twak wallet create --no-keychain\` did not produce ${walletFile}.`
     );
     if (/no api credentials/i.test(detail)) {
       printErr(
@@ -6706,14 +6983,14 @@ ${detail}` : "."}`
     return 1;
   }
   try {
-    fs21.chmodSync(walletFile, 384);
+    fs22.chmodSync(walletFile, 384);
   } catch {
   }
   if (!process.env.TWAK_WALLET_PASSWORD) {
     process.env.TWAK_WALLET_PASSWORD = password;
   }
   printErr(
-    `\u2713 twak wallet created under ${path20.dirname(walletFile)} (no keychain)`
+    `\u2713 twak wallet created under ${path21.dirname(walletFile)} (no keychain)`
   );
   printErr(
     "next: persist TWAK_WALLET_PASSWORD in .studio/.env.local so deploys and non-interactive signing can unlock it."
@@ -6750,7 +7027,7 @@ function cmdShow5(projectRootArg) {
     ...walletCfg.address ? { address: String(walletCfg.address) } : {}
   });
   const address = provider.address;
-  const keystorePath = path20.join(keystoreDir, `${address}.json`);
+  const keystorePath = path21.join(keystoreDir, `${address}.json`);
   printOut(`address:       ${address}`);
   printOut(`source:        ${kind}`);
   printOut(`keystore_dir:  ${keystoreDir}`);
@@ -6759,14 +7036,14 @@ function cmdShow5(projectRootArg) {
     const configured = String(
       walletCfg.session_file ?? ".studio/wallets/altana-session.json"
     );
-    const sessionFile = path20.isAbsolute(configured) ? configured : path20.join(projectRoot, configured);
+    const sessionFile = path21.isAbsolute(configured) ? configured : path21.join(projectRoot, configured);
     printOut(`session_file:  ${sessionFile}`);
     if (!isFile7(sessionFile)) {
       printOut("session_status: missing (run `bag wallet session grant`)");
     } else {
       let envelope;
       try {
-        envelope = JSON.parse(fs21.readFileSync(sessionFile, "utf8"));
+        envelope = JSON.parse(fs22.readFileSync(sessionFile, "utf8"));
       } catch {
         throw new Error(`invalid Altana session JSON at ${sessionFile}`);
       }
@@ -6792,7 +7069,7 @@ function cmdList2(projectRootArg) {
   const keystoreDir = resolveKeystoreDir2(projectRoot, null, walletCfg);
   let entries;
   try {
-    entries = fs21.readdirSync(keystoreDir).sort();
+    entries = fs22.readdirSync(keystoreDir).sort();
   } catch {
     return 0;
   }
@@ -6804,7 +7081,7 @@ function cmdList2(projectRootArg) {
     let data;
     try {
       data = JSON.parse(
-        fs21.readFileSync(path20.join(keystoreDir, child), "utf-8")
+        fs22.readFileSync(path21.join(keystoreDir, child), "utf-8")
       );
     } catch {
       continue;
@@ -6855,7 +7132,7 @@ async function cmdSign(msg, projectRootArg) {
 }
 async function cmdBalance(opts) {
   const projectRoot = resolveWalletProjectRoot(opts.projectRoot);
-  const data = loadStudioToml9(path20.join(projectRoot, "studio.toml"));
+  const data = loadStudioToml10(path21.join(projectRoot, "studio.toml"));
   const walletCfg = data.wallet !== null && typeof data.wallet === "object" ? data.wallet : {};
   let address;
   const kind = walletKind(walletCfg);
@@ -6982,10 +7259,10 @@ var PROVIDER_KEY_ENV = {
   "pieverse-llm": "PIEVERSE_LLM_API_KEY"
 };
 function renderAgentcoreProject(target, name) {
-  const acDir = path21.join(target, "agentcore");
-  fs22.mkdirSync(acDir, { recursive: true });
-  fs22.writeFileSync(
-    path21.join(acDir, "agentcore.json"),
+  const acDir = path22.join(target, "agentcore");
+  fs23.mkdirSync(acDir, { recursive: true });
+  fs23.writeFileSync(
+    path22.join(acDir, "agentcore.json"),
     `${JSON.stringify(
       {
         $schema: "https://schema.agentcore.aws.dev/v1/agentcore.json",
@@ -6999,7 +7276,7 @@ function renderAgentcoreProject(target, name) {
     )}
 `
   );
-  fs22.writeFileSync(path21.join(acDir, "aws-targets.json"), "[]\n");
+  fs23.writeFileSync(path22.join(acDir, "aws-targets.json"), "[]\n");
 }
 var AGENTS_MD_MARKER = "# bnbagent-studio additions (ERC-8183 seller)";
 var AGENTS_MD_STUDIO_SECTION = `
@@ -7023,17 +7300,16 @@ every intent to the right playbook via its references.
    under a deploy codeLocation). It lives at the workspace root precisely so
    that no packaging path can bundle it into an artifact. Never print, log,
    or export private key material.
-2. **Never commit secrets.** The \`.env.local\` file (API keys, plus
-   TWAK_WALLET_PASSWORD for twak projects) is gitignored \u2014 keep it that way;
-   never echo its values into code, logs, or chat. For evm-local projects,
-   WALLET_PASSWORD is read from the shell environment and is never written to
-   disk.
+2. **Never commit secrets.** The \`.env.local\` file (API keys and wallet
+   unlock passwords) is gitignored \u2014 keep it that way; never echo its values
+   into code, logs, argv, or chat. For evm-local and Altana projects, set
+   WALLET_PASSWORD in that owner-only file before creating the keystore.
 3. **Signing is fixed entrypoint code.** Never expose wallet signing as an
    LLM-callable tool, and keep MCP tools read-only. All on-chain signing
    lives in \`src/signing.ts\`.
 4. **The quote path is deterministic** (fixed list price, clamp + sign).
    Never put an LLM in the quote path.
-5. **Deploy with \`bag deploy --provider bnb|aws\`.** Every deploy or
+5. **Deploy with \`bag deploy --provider ${ADVERTISED_PROVIDERS_HELP}\`.** Every deploy or
    redeploy requires a visible provider choice. Studio runs its local business
    gates, then delegates cloud credentials, secrets, packaging and lifecycle
    calls to the pinned bnbagent-deploy CLI. Do not bypass this boundary with
@@ -7044,30 +7320,30 @@ every intent to the right playbook via its references.
    and state the tradeoff.
 `;
 function appendAgentsMdStudioSection(target) {
-  const agentsMd = path21.join(target, "AGENTS.md");
+  const agentsMd = path22.join(target, "AGENTS.md");
   let existing = "";
   try {
-    existing = fs22.readFileSync(agentsMd, "utf-8");
+    existing = fs23.readFileSync(agentsMd, "utf-8");
   } catch {
     existing = "";
   }
   if (existing.includes(AGENTS_MD_MARKER)) {
     return;
   }
-  fs22.writeFileSync(
+  fs23.writeFileSync(
     agentsMd,
     `${existing.replace(/\n+$/, "")}
 ${AGENTS_MD_STUDIO_SECTION}`
   );
 }
 function seedAwsTargets(target) {
-  const p = path21.join(target, "agentcore", "aws-targets.json");
+  const p = path22.join(target, "agentcore", "aws-targets.json");
   if (!isFile8(p)) {
     return;
   }
   let data;
   try {
-    data = JSON.parse(fs22.readFileSync(p, "utf-8"));
+    data = JSON.parse(fs23.readFileSync(p, "utf-8"));
   } catch {
     return;
   }
@@ -7078,7 +7354,7 @@ function seedAwsTargets(target) {
     { name: "default", account: AWS_ACCOUNT_PLACEHOLDER, region: "us-east-1" }
   ];
   try {
-    fs22.writeFileSync(p, `${JSON.stringify(skeleton, null, 2)}
+    fs23.writeFileSync(p, `${JSON.stringify(skeleton, null, 2)}
 `);
   } catch {
     return;
@@ -7101,13 +7377,13 @@ function registerAgentcoreRuntime(target, name, opts = {}) {
   const protocol = nativeProtocolOf(faces);
   const stem2 = entryStemOf(faces);
   const isContainer = opts.packaging === "container" || walletKind2 === "twak";
-  const cfgPath = path21.join(target, "agentcore", "agentcore.json");
+  const cfgPath = path22.join(target, "agentcore", "agentcore.json");
   if (!isFile8(cfgPath)) {
     return;
   }
   let cfg;
   try {
-    const parsed = JSON.parse(fs22.readFileSync(cfgPath, "utf-8"));
+    const parsed = JSON.parse(fs23.readFileSync(cfgPath, "utf-8"));
     if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
       return;
     }
@@ -7146,7 +7422,7 @@ function registerAgentcoreRuntime(target, name, opts = {}) {
   runtimes.push(runtime);
   cfg.runtimes = runtimes;
   try {
-    fs22.writeFileSync(cfgPath, `${JSON.stringify(cfg, null, 2)}
+    fs23.writeFileSync(cfgPath, `${JSON.stringify(cfg, null, 2)}
 `);
   } catch {
     return;
@@ -7283,12 +7559,12 @@ function registerInit(program) {
   );
 }
 function enclosingProjectRoot(start) {
-  let current = path21.resolve(start);
+  let current = path22.resolve(start);
   for (; ; ) {
-    if (isFile8(path21.join(current, APP_DIR, AGENT_PKG, "studio.toml"))) {
+    if (isFile8(path22.join(current, APP_DIR, AGENT_PKG, "studio.toml"))) {
       return current;
     }
-    const parent = path21.dirname(current);
+    const parent = path22.dirname(current);
     if (parent === current) {
       return null;
     }
@@ -7296,8 +7572,8 @@ function enclosingProjectRoot(start) {
   }
 }
 async function cmdInit(nameArg, opts) {
-  const target = path21.resolve(process.cwd(), nameArg);
-  let projectName2 = path21.basename(target);
+  const target = path22.resolve(process.cwd(), nameArg);
+  let projectName2 = path22.basename(target);
   if (!projectName2) {
     printErr(
       `error: cannot derive a project name from '${nameArg}' (path has no basename).`
@@ -7382,15 +7658,15 @@ async function cmdInit(nameArg, opts) {
       return 2;
     }
   }
-  const enclosing = enclosingProjectRoot(path21.dirname(target));
+  const enclosing = enclosingProjectRoot(path22.dirname(target));
   if (enclosing !== null) {
     printErr(
-      `error: ${path21.dirname(target)} is inside an existing bag project (${enclosing}).
-\`bag init\` resolves the new project relative to the current directory, so running it here would nest a second scaffold inside ${path21.basename(enclosing)}/. cd to a directory OUTSIDE any project and retry.`
+      `error: ${path22.dirname(target)} is inside an existing bag project (${enclosing}).
+\`bag init\` resolves the new project relative to the current directory, so running it here would nest a second scaffold inside ${path22.basename(enclosing)}/. cd to a directory OUTSIDE any project and retry.`
     );
     return 2;
   }
-  if (fs22.existsSync(target) && !opts.force) {
+  if (fs23.existsSync(target) && !opts.force) {
     printErr(`error: ${target} already exists. Use --force to overwrite.`);
     return 2;
   }
@@ -7421,8 +7697,8 @@ async function cmdInit(nameArg, opts) {
     );
     return 2;
   }
-  if (fs22.existsSync(target)) {
-    fs22.rmSync(target, { recursive: true, force: true });
+  if (fs23.existsSync(target)) {
+    fs23.rmSync(target, { recursive: true, force: true });
   }
   if (destination === "platform") {
     printCampaignIntro();
@@ -7467,7 +7743,7 @@ async function cmdInit(nameArg, opts) {
     }
   }
   try {
-    fs22.mkdirSync(target, { recursive: true });
+    fs23.mkdirSync(target, { recursive: true });
     if (runtime === "agentcore") {
       renderAgentcoreProject(target, projectName2);
     }
@@ -7483,7 +7759,7 @@ async function cmdInit(nameArg, opts) {
     printErr(
       `error: the b402 seller rail supports wallet.kind evm-local or twak only; '${walletKind2}' cannot act as the b402 payout wallet. Re-run with --rails 8183 or a supported --wallet-kind.`
     );
-    fs22.rmSync(target, { recursive: true, force: true });
+    fs23.rmSync(target, { recursive: true, force: true });
     return 2;
   }
   const ides = resolveEmitIdes(opts.ide);
@@ -7526,9 +7802,9 @@ async function cmdInit(nameArg, opts) {
     });
     seedAwsTargets(target);
   }
-  const agentDir = path21.join(target, APP_DIR, AGENT_PKG);
-  fs22.mkdirSync(path21.join(agentDir, "vendor"), { recursive: true });
-  fs22.writeFileSync(path21.join(agentDir, "vendor", ".gitkeep"), "");
+  const agentDir = path22.join(target, APP_DIR, AGENT_PKG);
+  fs23.mkdirSync(path22.join(agentDir, "vendor"), { recursive: true });
+  fs23.writeFileSync(path22.join(agentDir, "vendor", ".gitkeep"), "");
   const skipInstall = opts.install === false || opts.venv === false;
   let provisioned = false;
   let installFailed = false;
@@ -7657,64 +7933,64 @@ function derivePackaging(walletKind2, destination, platformArtifact2 = "zip", ru
 }
 function scaffold(target, name, o) {
   const packageManagerVersion = pnpmVersion();
-  fs22.writeFileSync(
-    path21.join(target, "package.json"),
+  fs23.writeFileSync(
+    path22.join(target, "package.json"),
     renderWorkspacePackageJson(name, packageManagerVersion)
   );
-  fs22.writeFileSync(
-    path21.join(target, "pnpm-workspace.yaml"),
+  fs23.writeFileSync(
+    path22.join(target, "pnpm-workspace.yaml"),
     renderPnpmWorkspaceYaml()
   );
-  fs22.writeFileSync(path21.join(target, ".gitignore"), renderWorkspaceGitignore());
-  if (!isFile8(path21.join(target, "README.md"))) {
-    fs22.writeFileSync(
-      path21.join(target, "README.md"),
+  fs23.writeFileSync(path22.join(target, ".gitignore"), renderWorkspaceGitignore());
+  if (!isFile8(path22.join(target, "README.md"))) {
+    fs23.writeFileSync(
+      path22.join(target, "README.md"),
       renderWorkspaceReadme(name, o.destination)
     );
   }
   appendAgentsMdStudioSection(target);
-  const appRoot = path21.join(target, APP_DIR);
-  fs22.mkdirSync(appRoot, { recursive: true });
-  const agentRoot2 = path21.join(appRoot, AGENT_PKG);
-  fs22.mkdirSync(agentRoot2, { recursive: true });
-  fs22.writeFileSync(
-    path21.join(agentRoot2, "pnpm-workspace.yaml"),
+  const appRoot = path22.join(target, APP_DIR);
+  fs23.mkdirSync(appRoot, { recursive: true });
+  const agentRoot2 = path22.join(appRoot, AGENT_PKG);
+  fs23.mkdirSync(agentRoot2, { recursive: true });
+  fs23.writeFileSync(
+    path22.join(agentRoot2, "pnpm-workspace.yaml"),
     renderAgentPnpmWorkspaceYaml()
   );
   if (o.walletKind === "evm-local" || o.walletKind === "altana") {
-    fs22.mkdirSync(path21.join(target, ".studio", "wallets"), { recursive: true });
+    fs23.mkdirSync(path22.join(target, ".studio", "wallets"), { recursive: true });
   } else if (o.walletKind === "twak") {
     let homeDir;
     let label;
     if (o.twakHome === void 0 || o.twakHome === DEDICATED_TWAK_HOME_REL) {
-      homeDir = path21.join(target, ".studio", "twak");
+      homeDir = path22.join(target, ".studio", "twak");
       label = ".studio/twak";
     } else {
-      homeDir = path21.isAbsolute(o.twakHome) ? o.twakHome : path21.resolve(agentRoot2, o.twakHome);
+      homeDir = path22.isAbsolute(o.twakHome) ? o.twakHome : path22.resolve(agentRoot2, o.twakHome);
       label = o.twakHome;
     }
-    fs22.mkdirSync(homeDir, { recursive: true });
+    fs23.mkdirSync(homeDir, { recursive: true });
     if (ensureTwakKeychain(homeDir)) {
       printOut(
         `\u2713 isolated twak keychain ready under ${label} (macOS) \u2014 no manual \`security\` setup needed`
       );
     }
   }
-  fs22.writeFileSync(
-    path21.join(agentRoot2, "package.json"),
+  fs23.writeFileSync(
+    path22.join(agentRoot2, "package.json"),
     renderAgentPackageJson(name, o.runtime, o.provider, o.faces, o.walletKind)
   );
-  fs22.writeFileSync(
-    path21.join(agentRoot2, "tsconfig.json"),
+  fs23.writeFileSync(
+    path22.join(agentRoot2, "tsconfig.json"),
     renderAgentTsconfig()
   );
-  fs22.writeFileSync(
-    path21.join(agentRoot2, "studio.toml"),
+  fs23.writeFileSync(
+    path22.join(agentRoot2, "studio.toml"),
     renderAgentStudioToml(name, o)
   );
-  const envLocal = path21.join(target, ".studio", ".env.local");
-  fs22.mkdirSync(path21.dirname(envLocal), { recursive: true });
-  fs22.writeFileSync(
+  const envLocal = path22.join(target, ".studio", ".env.local");
+  fs23.mkdirSync(path22.dirname(envLocal), { recursive: true });
+  fs23.writeFileSync(
     envLocal,
     renderAgentEnvLocal(
       o.provider,
@@ -7725,9 +8001,9 @@ function scaffold(target, name, o) {
       o.network
     )
   );
-  fs22.writeFileSync(path21.join(agentRoot2, ".gitignore"), renderAgentGitignore());
-  fs22.writeFileSync(
-    path21.join(agentRoot2, "README.md"),
+  fs23.writeFileSync(path22.join(agentRoot2, ".gitignore"), renderAgentGitignore());
+  fs23.writeFileSync(
+    path22.join(agentRoot2, "README.md"),
     renderAgentReadme(name, o.faces, o.destination)
   );
   const packaging = derivePackaging(
@@ -7763,18 +8039,18 @@ function emitRecipe(base, name, opts = {}) {
   const recipe = loadRecipe(name, { mode: opts.mode ?? null });
   for (const rf of recipe.files) {
     const targetPath = substitutePlaceholders(rf.targetPath, opts.context);
-    const basename16 = path21.posix.basename(targetPath);
-    const dst = basename16 === "Dockerfile" || basename16 === ".dockerignore" ? path21.join(base, basename16) : path21.join(base, targetPath);
-    fs22.mkdirSync(path21.dirname(dst), { recursive: true });
-    fs22.writeFileSync(dst, substitutePlaceholders(rf.content, opts.context));
+    const basename16 = path22.posix.basename(targetPath);
+    const dst = basename16 === "Dockerfile" || basename16 === ".dockerignore" ? path22.join(base, basename16) : path22.join(base, targetPath);
+    fs23.mkdirSync(path22.dirname(dst), { recursive: true });
+    fs23.writeFileSync(dst, substitutePlaceholders(rf.content, opts.context));
   }
 }
 function readRecipeNodeDeps(recipeName, group) {
-  const tomlPath = path21.join(bundledRecipesRoot(), recipeName, "recipe.toml");
+  const tomlPath = path22.join(bundledRecipesRoot(), recipeName, "recipe.toml");
   if (!isFile8(tomlPath)) {
     return [];
   }
-  const meta = parseToml(fs22.readFileSync(tomlPath, "utf-8"));
+  const meta = parseToml(fs23.readFileSync(tomlPath, "utf-8"));
   const depsSection = meta.dependencies !== null && typeof meta.dependencies === "object" ? meta.dependencies : {};
   const collect = (v) => Array.isArray(v) ? v.filter((d) => typeof d === "string") : [];
   const deps = collect(depsSection.node);
@@ -8223,7 +8499,13 @@ function renderAgentEnvLocal(provider, storageProvider, walletKind2, rails, b402
     lines.push(
       "",
       "# B402 merchant credentials (issued per environment after manual approval).",
-      free ? "# FREE price 0 does not use these credentials; leave them empty until switching to PAID." : "# PAID requires all four; all absent = dormant, partial = boot error.",
+      free ? "# FREE price 0 does not use these credentials; leave them empty until switching to PAID." : "# PAID: create the agent wallet first, then apply for a separate merchant",
+      ...free ? [] : [
+        "# for that exact wallet and environment. Never reuse merchant credentials",
+        "# across wallets.",
+        `# Apply: ${B402_DEVELOPER_ACCOUNT_URL}`,
+        "# PAID requires all four; all absent = dormant, partial = boot error."
+      ],
       `B402_BASE_URL=${baseUrl}`,
       "B402_CLIENT_ID=",
       "B402_ACCESS_TOKEN=",
@@ -8301,7 +8583,7 @@ It auto-loads \`.studio/.env.local\` \u2014 no need to \`source\` it.
 ## Deploy (managed platform \u2014 48h testnet trial)
 
 \`\`\`bash
-bag platform login                         # GitHub device flow (~/.bag/session.json)
+bag platform login                         # GitHub device flow (~/.bnbagent-deploy/bnb/session.json)
 # From the workspace root:
 bag deploy --provider bnb                  # explicit 48h trial provider
 \`\`\`
@@ -8353,7 +8635,7 @@ bag deploy --provider aws
 `;
 }
 function emitProviderSkills(target, provider, ides) {
-  const skillDir = path21.join(
+  const skillDir = path22.join(
     bundledRecipesRoot(),
     "providers",
     provider,
@@ -8363,34 +8645,34 @@ function emitProviderSkills(target, provider, ides) {
     return;
   }
   let emittedCursor = false;
-  for (const md of fs22.readdirSync(skillDir).filter((n) => n.endsWith(".md")).sort()) {
-    const srcText = fs22.readFileSync(path21.join(skillDir, md), "utf-8");
+  for (const md of fs23.readdirSync(skillDir).filter((n) => n.endsWith(".md")).sort()) {
+    const srcText = fs23.readFileSync(path22.join(skillDir, md), "utf-8");
     const stem2 = md.replace(/\.md$/, "");
     for (const ide of ides) {
       const [relPath, content] = renderSkillPayload(srcText, stem2, ide);
-      const base = ide === "claude-code" ? path21.join(target, ".claude", "skills") : path21.join(target, ".cursor", "rules");
-      const dst = path21.join(base, relPath);
-      fs22.mkdirSync(path21.dirname(dst), { recursive: true });
-      fs22.writeFileSync(dst, content);
+      const base = ide === "claude-code" ? path22.join(target, ".claude", "skills") : path22.join(target, ".cursor", "rules");
+      const dst = path22.join(base, relPath);
+      fs23.mkdirSync(path22.dirname(dst), { recursive: true });
+      fs23.writeFileSync(dst, content);
       if (ide === "cursor") {
         emittedCursor = true;
       }
     }
   }
   if (emittedCursor) {
-    ensureCursorGitignore(path21.join(target, ".gitignore"));
+    ensureCursorGitignore(path22.join(target, ".gitignore"));
   }
 }
 function ensureCursorGitignore(gitignore) {
   if (!isFile8(gitignore)) {
     return;
   }
-  const text2 = fs22.readFileSync(gitignore, "utf-8");
+  const text2 = fs23.readFileSync(gitignore, "utf-8");
   if (text2.includes(".cursor/rules/")) {
     return;
   }
   const addition = "\n# Cursor rules emitted at init (regeneratable via `bag skills install --target cursor`).\n.cursor/rules/\n";
-  fs22.writeFileSync(gitignore, `${text2.replace(/\n+$/, "")}
+  fs23.writeFileSync(gitignore, `${text2.replace(/\n+$/, "")}
 ${addition}`);
 }
 async function resolveWalletKind(flagValue, isTty) {
@@ -8572,7 +8854,7 @@ function readWalletAddress(studioToml) {
     return null;
   }
   try {
-    const data = parseToml(fs22.readFileSync(studioToml, "utf-8"));
+    const data = parseToml(fs23.readFileSync(studioToml, "utf-8"));
     const wallet = data.wallet;
     if (wallet !== null && typeof wallet === "object") {
       const addr = wallet.address;
@@ -8675,7 +8957,9 @@ async function runOnboarding(o) {
   if (password === null) {
     return false;
   }
-  const agentRoot2 = path21.join(o.workspaceRoot, APP_DIR, AGENT_PKG);
+  const agentRoot2 = path22.join(o.workspaceRoot, APP_DIR, AGENT_PKG);
+  const { envLocalPath: envLocalPath19 } = await import("@bnbagent/studio-runtime/config");
+  setEnvVar(envLocalPath19(agentRoot2), "WALLET_PASSWORD", password);
   const savedCwd = process.cwd();
   const savedPw = process.env.WALLET_PASSWORD;
   let address = null;
@@ -8701,7 +8985,7 @@ async function runOnboarding(o) {
       );
       return false;
     }
-    address = readWalletAddress(path21.join(agentRoot2, "studio.toml"));
+    address = readWalletAddress(path22.join(agentRoot2, "studio.toml"));
     if (o.walletKind !== "altana" || o.provider !== "pieverse-llm") {
       await onboardProviderActivation(agentRoot2, o.provider, o.model);
     }
@@ -8714,8 +8998,7 @@ async function runOnboarding(o) {
     }
   }
   if (o.storageProvider !== "local") {
-    const { envLocalPath: envLocalPath18 } = await import("@bnbagent/studio-runtime/config");
-    await onboardIpfsKey(envLocalPath18(agentRoot2), o.ipfsKey);
+    await onboardIpfsKey(envLocalPath19(agentRoot2), o.ipfsKey);
   }
   if (address) {
     await printFaucetHint(o.network, address);
@@ -8731,9 +9014,9 @@ async function onboardProviderActivation(agentRoot2, provider, model) {
   if (provider === "pieverse-llm") {
     const chosenModel = model ?? await promptPieverseModel();
     if (model === void 0) {
-      const tomlPath = path21.join(agentRoot2, "studio.toml");
-      const text2 = fs22.readFileSync(tomlPath, "utf-8");
-      fs22.writeFileSync(
+      const tomlPath = path22.join(agentRoot2, "studio.toml");
+      const text2 = fs23.readFileSync(tomlPath, "utf-8");
+      fs23.writeFileSync(
         tomlPath,
         updateSection(text2, "llm", { model: chosenModel })
       );
@@ -8769,45 +9052,50 @@ set ${keyEnv}= in .studio/.env.local before running \`bag dev\`.`
   }
 }
 async function runOnboardingTwak(o) {
-  const agentRoot2 = path21.join(o.workspaceRoot, APP_DIR, AGENT_PKG);
-  const studioToml = path21.join(agentRoot2, "studio.toml");
+  const agentRoot2 = path22.join(o.workspaceRoot, APP_DIR, AGENT_PKG);
+  const studioToml = path22.join(agentRoot2, "studio.toml");
   if (await whichTwak() === null) {
     printErr(
       `
 wallet.kind = 'twak' but the \`twak\` CLI is not on PATH. Install it (Node >=22):
     npm install -g @trustwallet/cli@${TWAK_CLI_VERSION}
-then create the project-dedicated wallet and finish onboarding:
-    HOME=$PWD/.studio/twak twak wallet create --password <your-password> --no-keychain
-    cd app/agent && bag wallet new && bag llm activate`
+then set up NaaS credentials once and create the project-dedicated wallet
+(\`bag wallet twak-init\` runs \`twak wallet create --password \u2026 --no-keychain\` for
+you, so you never type the password on a command line, and adopts the address):
+    HOME=$PWD/.studio/twak twak setup
+    cd app/agent && bag wallet twak-init && bag llm activate`
     );
     return false;
   }
   let walletCfg = {};
   try {
-    const data = parseToml(fs22.readFileSync(studioToml, "utf-8"));
+    const data = parseToml(fs23.readFileSync(studioToml, "utf-8"));
     if (data.wallet !== null && typeof data.wallet === "object") {
       walletCfg = data.wallet;
     }
   } catch {
     walletCfg = {};
   }
-  const { twakWalletFile: twakWalletFile2 } = await import("./_twak-5XQMOFUC.js");
+  const { twakWalletFile: twakWalletFile2 } = await import("./_twak-4XF4H5PL.js");
   let projectWallet = twakWalletFile2(walletCfg, agentRoot2);
-  const machineWallet = path21.join(os3.homedir(), ".twak", "wallet.json");
+  const machineWallet = path22.join(os4.homedir(), ".twak", "wallet.json");
   if (!o.twakHomePinned && isFile8(machineWallet) && realpathIfExists(projectWallet) !== realpathIfExists(machineWallet)) {
     if (await promptUseMachineTwakWallet(machineWallet)) {
       projectWallet = adoptMachineTwakWallet(machineWallet, o.workspaceRoot);
     }
   }
   if (!isFile8(projectWallet)) {
-    const homeDir = path21.dirname(path21.dirname(projectWallet));
+    const homeDir = path22.dirname(path22.dirname(projectWallet));
     try {
-      fs22.mkdirSync(homeDir, { recursive: true });
+      fs23.mkdirSync(homeDir, { recursive: true });
     } catch {
     }
     printErr(
       `
-No twak wallet at this project's dedicated home yet. Create it ONCE yourself (you type the password \u2014 studio never puts it on a command line; upstream S-8):
+No twak wallet at this project's dedicated home yet. Create it ONCE \u2014 let studio source the password so you never type it on a command line:
+    cd app/agent && bag wallet twak-init            # hidden prompt (CI: --password-stdin / --password-file)
+or do it yourself:
+    HOME=${homeDir} twak setup
     HOME=${homeDir} twak wallet create --password <your-password> --no-keychain
 then finish onboarding:
     cd app/agent && bag wallet new && bag llm activate
@@ -8844,8 +9132,8 @@ Guide: the bnbagent-studio-using-twak-wallet.md reference (installed by \`bag sk
     process.chdir(savedCwd);
   }
   if (o.storageProvider !== "local") {
-    const { envLocalPath: envLocalPath18 } = await import("@bnbagent/studio-runtime/config");
-    await onboardIpfsKey(envLocalPath18(agentRoot2), o.ipfsKey);
+    const { envLocalPath: envLocalPath19 } = await import("@bnbagent/studio-runtime/config");
+    await onboardIpfsKey(envLocalPath19(agentRoot2), o.ipfsKey);
   }
   if (address) {
     await printFaucetHint(o.network, address);
@@ -8854,9 +9142,9 @@ Guide: the bnbagent-studio-using-twak-wallet.md reference (installed by \`bag sk
 }
 function realpathIfExists(p) {
   try {
-    return fs22.realpathSync(p);
+    return fs23.realpathSync(p);
   } catch {
-    return path21.resolve(p);
+    return path22.resolve(p);
   }
 }
 async function promptUseMachineTwakWallet(machineWallet) {
@@ -8869,39 +9157,39 @@ Found an existing twak wallet: ${machineWallet}`);
   return answer === "y" || answer === "yes";
 }
 function adoptMachineTwakWallet(machineWallet, workspaceRoot) {
-  const homeDir = path21.join(workspaceRoot, ".studio", "twak");
-  const twakDir = path21.join(homeDir, ".twak");
-  fs22.mkdirSync(twakDir, { recursive: true });
+  const homeDir = path22.join(workspaceRoot, ".studio", "twak");
+  const twakDir = path22.join(homeDir, ".twak");
+  fs23.mkdirSync(twakDir, { recursive: true });
   try {
-    fs22.chmodSync(homeDir, 448);
-    fs22.chmodSync(twakDir, 448);
+    fs23.chmodSync(homeDir, 448);
+    fs23.chmodSync(twakDir, 448);
   } catch {
   }
   for (const name of ["wallet.json", "credentials.json"]) {
-    const src = path21.join(path21.dirname(machineWallet), name);
+    const src = path22.join(path22.dirname(machineWallet), name);
     if (isFile8(src)) {
-      const dst = path21.join(twakDir, name);
-      fs22.writeFileSync(dst, fs22.readFileSync(src, "utf-8"), { mode: 384 });
-      fs22.chmodSync(dst, 384);
+      const dst = path22.join(twakDir, name);
+      fs23.writeFileSync(dst, fs23.readFileSync(src, "utf-8"), { mode: 384 });
+      fs23.chmodSync(dst, 384);
     }
   }
-  return path21.join(twakDir, "wallet.json");
+  return path22.join(twakDir, "wallet.json");
 }
 function normalizeTwakHome(raw) {
-  const expanded = raw.startsWith("~") ? path21.join(os3.homedir(), raw.slice(1)) : raw;
-  if (!path21.isAbsolute(expanded)) {
+  const expanded = raw.startsWith("~") ? path22.join(os4.homedir(), raw.slice(1)) : raw;
+  if (!path22.isAbsolute(expanded)) {
     return { home: raw };
   }
   const isFile19 = (p) => {
     try {
-      return fs22.statSync(p).isFile();
+      return fs23.statSync(p).isFile();
     } catch {
       return false;
     }
   };
-  if (path21.basename(expanded) === ".twak") {
-    const parent = path21.dirname(expanded);
-    if (isFile19(path21.join(expanded, "wallet.json"))) {
+  if (path22.basename(expanded) === ".twak") {
+    const parent = path22.dirname(expanded);
+    if (isFile19(path22.join(expanded, "wallet.json"))) {
       return {
         home: parent,
         note: `note: --twak-home points at the .twak wallet directory itself; using its parent '${parent}' as the wallet home (the runtime resolves <twak_home>/.twak/wallet.json).`
@@ -8911,15 +9199,15 @@ function normalizeTwakHome(raw) {
       error: `error: --twak-home must name the HOME-STYLE PARENT directory (the one that contains .twak/wallet.json), not a .twak directory itself. '${raw}' holds no wallet.json, so it cannot be auto-corrected \u2014 pass '${parent}' to adopt an existing wallet, or omit --twak-home to use the project-dedicated .studio/twak.`
     };
   }
-  if (isFile19(path21.join(expanded, "wallet.json")) && !isFile19(path21.join(expanded, ".twak", "wallet.json"))) {
+  if (isFile19(path22.join(expanded, "wallet.json")) && !isFile19(path22.join(expanded, ".twak", "wallet.json"))) {
     return {
-      error: `error: --twak-home '${raw}' looks like a twak WALLET directory (it contains wallet.json directly). Pass its parent '${path21.dirname(expanded)}' instead \u2014 the runtime resolves <twak_home>/.twak/wallet.json.`
+      error: `error: --twak-home '${raw}' looks like a twak WALLET directory (it contains wallet.json directly). Pass its parent '${path22.dirname(expanded)}' instead \u2014 the runtime resolves <twak_home>/.twak/wallet.json.`
     };
   }
-  if (!isFile19(path21.join(expanded, ".twak", "wallet.json"))) {
+  if (!isFile19(path22.join(expanded, ".twak", "wallet.json"))) {
     return {
       home: raw,
-      note: `note: no wallet found at ${path21.join(raw, ".twak", "wallet.json")} \u2014 treating --twak-home as a NEW project wallet home; \`bag wallet new\` will guide wallet creation.`
+      note: `note: no wallet found at ${path22.join(raw, ".twak", "wallet.json")} \u2014 treating --twak-home as a NEW project wallet home; \`bag wallet new\` will guide wallet creation.`
     };
   }
   return { home: raw };
@@ -8929,8 +9217,8 @@ function twakHomeIsMainHome(twakHome) {
     return false;
   }
   try {
-    const expanded = twakHome.startsWith("~") ? path21.join(os3.homedir(), twakHome.slice(1)) : twakHome;
-    return realpathIfExists(expanded) === realpathIfExists(os3.homedir());
+    const expanded = twakHome.startsWith("~") ? path22.join(os4.homedir(), twakHome.slice(1)) : twakHome;
+    return realpathIfExists(expanded) === realpathIfExists(os4.homedir());
   } catch {
     return false;
   }
@@ -8990,9 +9278,10 @@ function printTwakNotice(destination = "self") {
 NOTE \u2014 wallet.kind = "twak" (Trust Wallet Agent Kit, CLI >= ${TWAK_CLI_VERSION}):
  \xB7 GAS: x402 payments (e.g. Pieverse topup) are GASLESS on both networks, and
    ERC-8004 registry writes (register / update) are gas-sponsored on both.
-   ERC-8183 fund / settle are gas-sponsored on TESTNET (zero tBNB needed) but
-   SELF-PAY on MAINNET \u2014 keep a little BNB there. Fund only a few days of U
-   spend: hot wallet.
+   ERC-8183 fund / settle are gas-sponsored on TESTNET for the canonical
+   contracts (custom contract sponsorship depends on the paymaster policy \u2014
+   keep fallback tBNB) but SELF-PAY on MAINNET \u2014 keep a little BNB there.
+   Fund only a few days of U spend: hot wallet.
 ${deployLine}
 Prefer the default local keystore instead? re-run with --wallet-kind evm-local.`
   );
@@ -9078,11 +9367,11 @@ function entrypointHint(faces) {
   return "app/agent/src/main.ts + executor.ts  = A2A entrypoint (build your value here)";
 }
 function hasVendoredTarballs(agentDir) {
-  const vendor = path21.join(agentDir, "vendor");
+  const vendor = path22.join(agentDir, "vendor");
   if (!isDir4(vendor)) {
     return false;
   }
-  return fs22.readdirSync(vendor).some((n) => n.endsWith(".tgz"));
+  return fs23.readdirSync(vendor).some((n) => n.endsWith(".tgz"));
 }
 function printCompactNextSteps(name, o = {}) {
   const faces = o.faces ?? normalizeProtocolFaces(o.protocol ?? "A2A");
@@ -9105,7 +9394,7 @@ function printCompactNextSteps(name, o = {}) {
     );
   } else {
     printOut(
-      "  export WALLET_PASSWORD=\u2026   # your wallet password lives only in the shell \u2014 studio never writes it to disk"
+      "  # WALLET_PASSWORD is stored in .studio/.env.local (0600); never pass it on argv"
     );
   }
   if (walletKind2 === "altana") {
@@ -9229,9 +9518,9 @@ function printNextSteps(name, provider, o = {}) {
     );
   } else if (walletKind2 === "altana") {
     printOut(
-      "  # 1. create the encrypted Altana admin keystore (password stays in your shell)"
+      "  # 1. set WALLET_PASSWORD in .studio/.env.local (0600), then create the encrypted Altana admin keystore"
     );
-    printOut("  export WALLET_PASSWORD=<your-password>");
+    printOut("  #    bag auto-loads it; never pass it on argv");
     printOut("  (cd app/agent && bag wallet new)");
     printOut(
       "  # 2. fund the printed address with ~0.6 tBNB for bootstrap/registration + U, then grant one bounded runtime session"
@@ -9242,11 +9531,10 @@ function printNextSteps(name, provider, o = {}) {
     );
   } else {
     printOut(
-      "  # 1. set a wallet password (encrypts the keystore + signs all on-chain ops)"
+      "  # 1. edit .studio/.env.local and set WALLET_PASSWORD (encrypts the keystore + signs all on-chain ops)"
     );
-    printOut("  export WALLET_PASSWORD=<your-password>");
     printOut(
-      "  #    bag reads WALLET_PASSWORD from your shell; studio never writes it to disk"
+      "  #    bag auto-loads it from the owner-only file; never pass it on argv"
     );
     printOut("");
     printOut("  # 2. generate the agent's EOA wallet (the SOLE signer key)");
@@ -9337,7 +9625,7 @@ function loadTomlSafe(p) {
     return {};
   }
   try {
-    return parseToml(fs22.readFileSync(p, "utf-8"));
+    return parseToml(fs23.readFileSync(p, "utf-8"));
   } catch {
     return {};
   }
@@ -9357,7 +9645,7 @@ function weiToU(raw) {
   }
 }
 function printConfigSummary(agentRoot2) {
-  const agent = loadTomlSafe(path21.join(agentRoot2, "studio.toml"));
+  const agent = loadTomlSafe(path22.join(agentRoot2, "studio.toml"));
   if (Object.keys(agent).length === 0) {
     return;
   }
@@ -9537,8 +9825,9 @@ function printConfigSummary(agentRoot2) {
     );
   }
   if (hasX402Seller && !isFreeX402) {
+    todo.push(`PAID /x402 onboarding \u2014 ${B402_PAID_ONBOARDING_GUIDANCE}`);
     todo.push(
-      "B402_BASE_URL / CLIENT_ID / ACCESS_TOKEN / private key \u2014 required for PAID /x402"
+      "then set B402_BASE_URL / CLIENT_ID / ACCESS_TOKEN / private key"
     );
   }
   if (storageKind2 === "local") {
@@ -9556,14 +9845,14 @@ function printConfigSummary(agentRoot2) {
 }
 function isFile8(p) {
   try {
-    return fs22.statSync(p).isFile();
+    return fs23.statSync(p).isFile();
   } catch {
     return false;
   }
 }
 function isDir4(p) {
   try {
-    return fs22.statSync(p).isDirectory();
+    return fs23.statSync(p).isDirectory();
   } catch {
     return false;
   }
@@ -9573,11 +9862,12 @@ function isDir4(p) {
 var DEFAULT_AGENT_HOST = "127.0.0.1";
 var AGENTCORE_BIN = "agentcore";
 var RUNTIME_AGENTCORE = "agentcore";
+var RUNTIME_AZURE_FOUNDRY = "azure-foundry";
 var MIN_NODE_MAJOR = 22;
 var CONTAINER_RUNTIMES = ["docker", "podman", "finch"];
 function isFile9(p) {
   try {
-    return fs23.statSync(p).isFile();
+    return fs24.statSync(p).isFile();
   } catch {
     return false;
   }
@@ -9609,8 +9899,8 @@ async function nodeMajor() {
   return /^\d+$/.test(head) ? Number.parseInt(head, 10) : null;
 }
 function workspaceBase(root) {
-  for (const base of [path22.join(root, "app"), root]) {
-    if (isFile9(path22.join(base, "agent", "studio.toml"))) {
+  for (const base of [path23.join(root, "app"), root]) {
+    if (isFile9(path23.join(base, "agent", "studio.toml"))) {
       return base;
     }
   }
@@ -9618,7 +9908,7 @@ function workspaceBase(root) {
 }
 function resolveWorkspaceRoot(argRoot) {
   if (argRoot !== null) {
-    const root = path22.resolve(argRoot);
+    const root = path23.resolve(argRoot);
     const base = workspaceBase(root);
     if (base === null) {
       printErr(
@@ -9628,13 +9918,13 @@ function resolveWorkspaceRoot(argRoot) {
     }
     return base;
   }
-  let current = path22.resolve(process.cwd());
+  let current = path23.resolve(process.cwd());
   for (; ; ) {
     const base = workspaceBase(current);
     if (base !== null) {
       return base;
     }
-    const parent = path22.dirname(current);
+    const parent = path23.dirname(current);
     if (parent === current) {
       break;
     }
@@ -9647,24 +9937,24 @@ function resolveWorkspaceRoot(argRoot) {
 }
 function loadAgentToml2(workspaceRoot) {
   try {
-    return loadStudioToml10(
-      path22.join(workspaceRoot, "agent", "studio.toml")
+    return loadStudioToml11(
+      path23.join(workspaceRoot, "agent", "studio.toml")
     );
   } catch {
     return {};
   }
 }
-function tableOf7(data, key) {
+function tableOf8(data, key) {
   const v = data[key];
   return v !== null && typeof v === "object" && !Array.isArray(v) ? v : {};
 }
 function agentRuntime(workspaceRoot) {
-  const runtime = tableOf7(loadAgentToml2(workspaceRoot), "stack").runtime;
+  const runtime = tableOf8(loadAgentToml2(workspaceRoot), "stack").runtime;
   return typeof runtime === "string" && runtime.trim() ? runtime.trim() : RUNTIME_AGENTCORE;
 }
 function agentFaces(workspaceRoot) {
   const cfg = loadAgentToml2(workspaceRoot);
-  return stackFaces(tableOf7(cfg, "stack"), tableOf7(cfg, "payments"));
+  return stackFaces(tableOf8(cfg, "stack"), tableOf8(cfg, "payments"));
 }
 function localEntryFile(faces) {
   return `src/${entryStemOf(faces)}.ts`;
@@ -9675,36 +9965,46 @@ function defaultAgentPort(faces) {
 function storageKind(agentDir) {
   let data;
   try {
-    data = loadStudioToml10(path22.join(agentDir, "studio.toml"));
+    data = loadStudioToml11(path23.join(agentDir, "studio.toml"));
   } catch {
     return "local";
   }
-  const kind = tableOf7(data, "storage").kind;
+  const kind = tableOf8(data, "storage").kind;
   return typeof kind === "string" && kind.trim() ? kind.trim() : "local";
 }
+function networkNameOf(agentDir) {
+  let data;
+  try {
+    data = loadStudioToml11(path23.join(agentDir, "studio.toml"));
+  } catch {
+    return "bsc-testnet";
+  }
+  const name = tableOf8(data, "network").default;
+  return typeof name === "string" && name.trim() ? name.trim() : "bsc-testnet";
+}
 function walletKindOf(agentDir) {
   let data;
   try {
-    data = loadStudioToml10(path22.join(agentDir, "studio.toml"));
+    data = loadStudioToml11(path23.join(agentDir, "studio.toml"));
   } catch {
     return "evm-local";
   }
-  const kind = tableOf7(data, "wallet").kind;
+  const kind = tableOf8(data, "wallet").kind;
   return typeof kind === "string" && kind.trim() ? kind.trim() : "evm-local";
 }
 function altanaSessionForRuntime(agentDir) {
-  const cfg = loadStudioToml10(path22.join(agentDir, "studio.toml"));
-  const wallet = tableOf7(cfg, "wallet");
+  const cfg = loadStudioToml11(path23.join(agentDir, "studio.toml"));
+  const wallet = tableOf8(cfg, "wallet");
   const configured = String(
     wallet.session_file ?? ".studio/wallets/altana-session.json"
   );
-  const sessionFile = path22.isAbsolute(configured) ? configured : path22.join(agentDir, configured);
+  const sessionFile = path23.isAbsolute(configured) ? configured : path23.join(agentDir, configured);
   if (!isFile9(sessionFile)) {
     throw new Error(
       `no Altana session at ${sessionFile} \u2014 run \`bag wallet session grant\` first.`
     );
   }
-  const serialized = fs23.readFileSync(sessionFile, "utf8");
+  const serialized = fs24.readFileSync(sessionFile, "utf8");
   let envelope;
   try {
     envelope = JSON.parse(serialized);
@@ -9736,7 +10036,7 @@ function loadEnvFileForDev(p) {
   if (!isFile9(p)) {
     return;
   }
-  for (const line of fs23.readFileSync(p, "utf-8").split(/\r?\n/)) {
+  for (const line of fs24.readFileSync(p, "utf-8").split(/\r?\n/)) {
     if (!line || line.trimStart().startsWith("#")) {
       continue;
     }
@@ -9757,20 +10057,20 @@ function ensureStoragePath(projectRoot) {
   const raw = process.env.STORAGE_LOCAL_PATH;
   let resolved;
   if (raw) {
-    resolved = path22.resolve(
-      raw.startsWith("~") ? path22.join(os4.homedir(), raw.slice(1)) : raw
+    resolved = path23.resolve(
+      raw.startsWith("~") ? path23.join(os5.homedir(), raw.slice(1)) : raw
     );
   } else {
-    resolved = path22.resolve(
-      path22.join(
-        os4.homedir(),
+    resolved = path23.resolve(
+      path23.join(
+        os5.homedir(),
         ".bag",
         "deliverables",
-        path22.basename(projectRoot)
+        path23.basename(projectRoot)
       )
     );
   }
-  fs23.mkdirSync(resolved, { recursive: true });
+  fs24.mkdirSync(resolved, { recursive: true });
   process.env.STORAGE_LOCAL_PATH = resolved;
 }
 function ipfsPreflight(agentDir) {
@@ -9785,12 +10085,12 @@ function ipfsPreflight(agentDir) {
 function runtimeEnvKeys(agentDir) {
   let cfg = {};
   try {
-    cfg = loadStudioToml10(path22.join(agentDir, "studio.toml"));
+    cfg = loadStudioToml11(path23.join(agentDir, "studio.toml"));
   } catch {
     cfg = {};
   }
   const resolvable = (key) => Boolean(process.env[key]);
-  const kind = tableOf7(cfg, "wallet").kind;
+  const kind = tableOf8(cfg, "wallet").kind;
   let keys;
   if (kind === "twak") {
     keys = ["TWAK_WALLET_PASSWORD"];
@@ -9804,12 +10104,12 @@ function runtimeEnvKeys(agentDir) {
   } else {
     keys = ["WALLET_PASSWORD"];
   }
-  const provider = tableOf7(cfg, "llm").provider;
+  const provider = tableOf8(cfg, "llm").provider;
   const providerKey = typeof provider === "string" ? PROVIDER_KEY_ENV[provider] : null;
   if (providerKey) {
     keys.push(providerKey);
   }
-  const sk = String(tableOf7(cfg, "storage").kind ?? "local").toLowerCase();
+  const sk = String(tableOf8(cfg, "storage").kind ?? "local").toLowerCase();
   if (sk === "ipfs") {
     keys.push("STORAGE_API_URL");
     if (resolvable("STORAGE_API_KEY")) {
@@ -9824,7 +10124,7 @@ function runtimeEnvKeys(agentDir) {
       if (resolvable(key)) keys.push(key);
     }
   }
-  const runtime = String(tableOf7(cfg, "stack").runtime ?? "agentcore");
+  const runtime = String(tableOf8(cfg, "stack").runtime ?? "agentcore");
   if (runtime === "agentcore" && x402SellerUsesB402(cfg)) {
     for (const key of B402_RUNTIME_KEYS) {
       if (resolvable(key)) keys.push(key);
@@ -9842,8 +10142,8 @@ function compactJson(text2) {
 function readTwakFiles(agentDir) {
   let walletCfg = {};
   try {
-    walletCfg = tableOf7(
-      loadStudioToml10(path22.join(agentDir, "studio.toml")),
+    walletCfg = tableOf8(
+      loadStudioToml11(path23.join(agentDir, "studio.toml")),
       "wallet"
     );
   } catch {
@@ -9851,9 +10151,9 @@ function readTwakFiles(agentDir) {
   }
   const twakDir = twakHomeDir(walletCfg, agentDir);
   const read = (name) => {
-    const p = path22.join(twakDir, name);
+    const p = path23.join(twakDir, name);
     try {
-      return fs23.readFileSync(p, "utf-8");
+      return fs24.readFileSync(p, "utf-8");
     } catch {
       return null;
     }
@@ -9861,19 +10161,19 @@ function readTwakFiles(agentDir) {
   return [read("wallet.json"), read("credentials.json")];
 }
 function ensureAgentcoreEnvGitignored(agentcoreDir) {
-  const gi = path22.join(agentcoreDir, ".gitignore");
+  const gi = path23.join(agentcoreDir, ".gitignore");
   const entry = ".env.local";
   if (isFile9(gi)) {
-    const text2 = fs23.readFileSync(gi, "utf-8");
+    const text2 = fs24.readFileSync(gi, "utf-8");
     const lines = new Set(text2.split("\n").map((l) => l.trim()));
     if (lines.has(entry)) {
       return;
     }
     const sep6 = text2.endsWith("\n") || text2 === "" ? "" : "\n";
-    fs23.writeFileSync(gi, `${text2}${sep6}${entry}
+    fs24.writeFileSync(gi, `${text2}${sep6}${entry}
 `);
   } else {
-    fs23.writeFileSync(gi, `${entry}
+    fs24.writeFileSync(gi, `${entry}
 `);
   }
 }
@@ -9896,8 +10196,8 @@ function writeAgentcoreEnvLocal(agentcoreRoot, agentDir) {
   } else if (walletKindOf(agentDir) === "altana") {
     bundle.ALTANA_SESSION = altanaSessionForRuntime(agentDir);
   }
-  const envPath = path22.join(agentcoreRoot, "agentcore", ".env.local");
-  const prior = isFile9(envPath) ? fs23.readFileSync(envPath, "utf-8") : "";
+  const envPath = path23.join(agentcoreRoot, "agentcore", ".env.local");
+  const prior = isFile9(envPath) ? fs24.readFileSync(envPath, "utf-8") : "";
   const merged = {};
   for (const line of prior.split("\n")) {
     if (!line || line.trimStart().startsWith("#")) {
@@ -9912,14 +10212,14 @@ function writeAgentcoreEnvLocal(agentcoreRoot, agentDir) {
   Object.assign(merged, bundle);
   const content = Object.entries(merged).map(([k, v]) => `${k}=${v}
 `).join("");
-  fs23.mkdirSync(path22.dirname(envPath), { recursive: true });
-  ensureAgentcoreEnvGitignored(path22.dirname(envPath));
+  fs24.mkdirSync(path23.dirname(envPath), { recursive: true });
+  ensureAgentcoreEnvGitignored(path23.dirname(envPath));
   writePrivate2(envPath, content);
   return [envPath, content !== prior];
 }
 function agentcoreProjectRoot2(workspaceRoot) {
-  for (const candidate of [path22.dirname(workspaceRoot), workspaceRoot]) {
-    if (isFile9(path22.join(candidate, "agentcore", "agentcore.json"))) {
+  for (const candidate of [path23.dirname(workspaceRoot), workspaceRoot]) {
+    if (isFile9(path23.join(candidate, "agentcore", "agentcore.json"))) {
       return candidate;
     }
   }
@@ -9928,8 +10228,8 @@ function agentcoreProjectRoot2(workspaceRoot) {
 function loadAgentcoreConfig(projectRoot) {
   try {
     const cfg = JSON.parse(
-      fs23.readFileSync(
-        path22.join(projectRoot, "agentcore", "agentcore.json"),
+      fs24.readFileSync(
+        path23.join(projectRoot, "agentcore", "agentcore.json"),
         "utf-8"
       )
     );
@@ -10019,11 +10319,11 @@ async function cmdDev(opts) {
   if (workspaceRoot === null) {
     return 2;
   }
-  const agentDir = path22.join(workspaceRoot, "agent");
+  const agentDir = path23.join(workspaceRoot, "agent");
   migrateEnvLocal(agentDir);
   migrateKeystoreOutOfCodelocation(agentDir);
-  const { envLocalPath: envLocalPath18 } = await import("@bnbagent/studio-runtime/config");
-  loadEnvFileForDev(envLocalPath18(agentDir));
+  const { envLocalPath: envLocalPath19 } = await import("@bnbagent/studio-runtime/config");
+  loadEnvFileForDev(envLocalPath19(agentDir));
   ensureStoragePath(workspaceRoot);
   const ipfsErr = ipfsPreflight(agentDir);
   if (ipfsErr !== null) {
@@ -10055,7 +10355,7 @@ async function cmdDev(opts) {
   const runtime = agentRuntime(workspaceRoot);
   const container = Boolean(opts.container);
   const entryFile = localEntryFile(faces);
-  const agentFile = path22.join(agentDir, entryFile);
+  const agentFile = path23.join(agentDir, entryFile);
   if (!isFile9(agentFile)) {
     printErr(
       `error: Agent entrypoint file ${agentFile} does not exist. [stack] faces = [${faces.join(", ")}], so the entrypoint is ${entryFile} (A2A/X402-only \u2192 src/main.ts, MCP \u2192 src/mcpMain.ts, A2A+MCP \u2192 src/dualMain.ts). Run \`bag init\` to scaffold the workspace.`
@@ -10069,6 +10369,17 @@ async function cmdDev(opts) {
     );
     return 2;
   }
+  if (walletKind2 === "twak") {
+    const unsupported = twakUnsupportedContractOverrides(
+      networkNameOf(agentDir)
+    );
+    if (unsupported.length > 0) {
+      const keys = unsupported.map((item) => item.envKey).join(", ");
+      printErr(
+        `warning: wallet.kind='twak' cannot use the selected custom ERC-8183 targets (${keys}): twak v0.20.0 has no Commerce/Router/Policy address option, so on-chain 8183 writes (submit/fund/settle) will fail against this stack. Use wallet.kind='evm-local' for custom ERC-8183 contracts, or remove the overrides and use the canonical stack. ERC8004_REGISTRY_ADDRESS is supported.`
+      );
+    }
+  }
   if (await devPortInUse(agentPort)) {
     printErr(
       `error: port ${agentPort} is already in use on 127.0.0.1 (another \`bag dev\`?). Stop it or pass --port <other>.`
@@ -10123,7 +10434,7 @@ Switch to Node \u226522 so it wins on PATH, then reopen the shell and retry. Ver
   }
   let launch;
   if (runtime === RUNTIME_AGENTCORE && container) {
-    const root = path22.resolve(agentcoreRoot);
+    const root = path23.resolve(agentcoreRoot);
     try {
       const vendored = await vendorLocalTarballs(agentDir);
       if (vendored.length > 0) {
@@ -10138,7 +10449,7 @@ Switch to Node \u226522 so it wins on PATH, then reopen the shell and retry. Ver
     }
     const [envPath, changed] = writeAgentcoreEnvLocal(root, agentDir);
     printOut(
-      `bag dev: wrote ${path22.relative(root, envPath)} (runtime secrets + materialized wallet for the container).`
+      `bag dev: wrote ${path23.relative(root, envPath)} (runtime secrets + materialized wallet for the container).`
     );
     if (changed && process.env.BAG_DEV_ENV_WARNED !== "1") {
       printErr(
@@ -10186,6 +10497,11 @@ Switch to Node \u226522 so it wins on PATH, then reopen the shell and retry. Ver
     printOut(
       `bag dev: starting Agent in-process (\`tsx ${args.join(" ")}\` on :${agentPort}, no Docker \u2014 the entrypoint self-serves; cwd=${agentDir}, runner=${runner2})`
     );
+    if (runtime === RUNTIME_AZURE_FOUNDRY) {
+      printOut(
+        "bag dev: azure-foundry serves this local A2A/MCP entrypoint in-process; src/foundryMain.ts is the deploy-only Foundry host (the entrypoint `bag doctor` reports) and never runs here."
+      );
+    }
     launch = () => runStream(runner2, args, { cwd: agentDir, env });
   }
   const banner = networkBanner(agentDir);
@@ -10210,7 +10526,7 @@ Switch to Node \u226522 so it wins on PATH, then reopen the shell and retry. Ver
   }
   if (hasX402Face(faces)) {
     const free = x402SellerIsFree(
-      loadStudioToml10(path22.join(agentDir, "studio.toml"))
+      loadStudioToml11(path23.join(agentDir, "studio.toml"))
     );
     printOut(
       free ? `bag dev: x402 seller at http://localhost:${agentPort}/x402 (FREE \u2014 anonymous passthrough; B402 bypassed)` : `bag dev: x402 seller at http://localhost:${agentPort}/x402 (PAID \u2014 active when B402 credentials are configured)`
@@ -10221,8 +10537,8 @@ Switch to Node \u226522 so it wins on PATH, then reopen the shell and retry. Ver
 }
 function tsxRunner(agentDir, workspaceBaseDir) {
   const bin = process.platform === "win32" ? "tsx.cmd" : "tsx";
-  for (const dir of [agentDir, path22.dirname(workspaceBaseDir)]) {
-    const candidate = path22.join(dir, "node_modules", ".bin", bin);
+  for (const dir of [agentDir, path23.dirname(workspaceBaseDir)]) {
+    const candidate = path23.join(dir, "node_modules", ".bin", bin);
     if (isFile9(candidate)) {
       return candidate;
     }
@@ -10232,11 +10548,11 @@ function tsxRunner(agentDir, workspaceBaseDir) {
 function networkBanner(agentDir) {
   let data;
   try {
-    data = loadStudioToml10(path22.join(agentDir, "studio.toml"));
+    data = loadStudioToml11(path23.join(agentDir, "studio.toml"));
   } catch {
     return null;
   }
-  const name = tableOf7(data, "network").default;
+  const name = tableOf8(data, "network").default;
   if (typeof name !== "string" || !name.trim()) {
     return null;
   }
@@ -10249,34 +10565,34 @@ function networkBanner(agentDir) {
 }
 
 // src/cli/_deploy/checks/critical.ts
-import * as fs24 from "fs";
+import * as fs25 from "fs";
 import { createRequire } from "module";
-import * as path23 from "path";
-import { envLocalPath as envLocalPath10, loadStudioToml as loadStudioToml11 } from "@bnbagent/studio-runtime/config";
+import * as path24 from "path";
+import { envLocalPath as envLocalPath11, loadStudioToml as loadStudioToml12 } from "@bnbagent/studio-runtime/config";
 import { pieverseKeyHash as pieverseKeyHash2 } from "@bnbagent/studio-runtime/llm";
 var AGENTCORE_DESCRIPTOR2 = "agentcore/agentcore.json";
 function isFile10(p) {
   try {
-    return fs24.statSync(p).isFile();
+    return fs25.statSync(p).isFile();
   } catch {
     return false;
   }
 }
 function isDir5(p) {
   try {
-    return fs24.statSync(p).isDirectory();
+    return fs25.statSync(p).isDirectory();
   } catch {
     return false;
   }
 }
 function keystoreDirOf(root, data) {
   const rel = String(tableOf2(data, "wallet").keystore_dir ?? ".studio/wallets");
-  const dir = path23.isAbsolute(rel) ? rel : path23.join(agentRootOf(root), rel);
-  return path23.resolve(dir);
+  const dir = path24.isAbsolute(rel) ? rel : path24.join(agentRootOf(root), rel);
+  return path24.resolve(dir);
 }
 function keystoreJsonFiles2(dir) {
   try {
-    return fs24.readdirSync(dir).filter((n) => n.endsWith(".json")).sort();
+    return fs25.readdirSync(dir).filter((n) => n.endsWith(".json")).sort();
   } catch {
     return [];
   }
@@ -10284,11 +10600,11 @@ function keystoreJsonFiles2(dir) {
 function runtimeEnvKeys2(agentRoot2) {
   let cfg = {};
   try {
-    cfg = loadStudioToml11(path23.join(agentRoot2, "studio.toml"));
+    cfg = loadStudioToml12(path24.join(agentRoot2, "studio.toml"));
   } catch {
     cfg = {};
   }
-  const resolvable = (key) => Boolean(process.env[key] || getEnvVar(envLocalPath10(agentRoot2), key));
+  const resolvable = (key) => Boolean(process.env[key] || getEnvVar(envLocalPath11(agentRoot2), key));
   const walletKind2 = tableOf2(cfg, "wallet").kind ?? "evm-local";
   let keys;
   if (walletKind2 === "twak") {
@@ -10338,7 +10654,7 @@ async function checkAgentcoreJsonPresent(root, target) {
   if (target !== "agentcore") {
     return [];
   }
-  const descriptor = path23.join(root, AGENTCORE_DESCRIPTOR2);
+  const descriptor = path24.join(root, AGENTCORE_DESCRIPTOR2);
   if (isFile10(descriptor)) {
     return [];
   }
@@ -10355,10 +10671,10 @@ async function checkAgentcoreAuthorizerKeyLegacy(root, target) {
   if (target !== "agentcore") {
     return [];
   }
-  const descriptor = path23.join(root, AGENTCORE_DESCRIPTOR2);
+  const descriptor = path24.join(root, AGENTCORE_DESCRIPTOR2);
   let data;
   try {
-    data = JSON.parse(fs24.readFileSync(descriptor, "utf-8"));
+    data = JSON.parse(fs25.readFileSync(descriptor, "utf-8"));
   } catch {
     return [];
   }
@@ -10398,10 +10714,10 @@ async function checkAgentPackagePresent(root, target) {
     sourceEntries.push("src/mcpMain.ts");
   }
   const missingSource = sourceEntries.find(
-    (entry) => !isFile10(path23.join(agentRoot2, entry))
+    (entry) => !isFile10(path24.join(agentRoot2, entry))
   );
   if (missingSource !== void 0) {
-    const epPath = path23.join(agentRoot2, missingSource);
+    const epPath = path24.join(agentRoot2, missingSource);
     return [
       {
         level: Level.CRITICAL,
@@ -10416,10 +10732,10 @@ async function checkAgentPackagePresent(root, target) {
     distEntries.push("dist/mcpMain.js");
   }
   const missingDist = distEntries.find(
-    (entry) => !isFile10(path23.join(agentRoot2, entry))
+    (entry) => !isFile10(path24.join(agentRoot2, entry))
   );
   if (missingDist !== void 0) {
-    const distPath = path23.join(agentRoot2, missingDist);
+    const distPath = path24.join(agentRoot2, missingDist);
     return [
       {
         level: Level.WARNING,
@@ -10444,8 +10760,8 @@ async function checkKeystoreNotInsideAgent(root, target) {
   if (!isDir5(keystoreDir) || keystoreJsonFiles2(keystoreDir).length === 0) {
     return [];
   }
-  const agentDir = path23.resolve(agentRootOf(root));
-  const inside2 = keystoreDir === agentDir || keystoreDir.startsWith(agentDir + path23.sep);
+  const agentDir = path24.resolve(agentRootOf(root));
+  const inside2 = keystoreDir === agentDir || keystoreDir.startsWith(agentDir + path24.sep);
   if (!inside2) {
     return [];
   }
@@ -10453,7 +10769,7 @@ async function checkKeystoreNotInsideAgent(root, target) {
     {
       level: Level.WARNING,
       name: "keystore_not_inside_agent",
-      message: `keystore dir ${keystoreDir} is INSIDE the deploy codeLocation (${agentDir}) \u2014 a legacy layout. \`bag deploy --provider aws\` and \`bag doctor\` auto-migrate it to <workspace>/.studio/wallets (and repoint [wallet].keystore_dir). Fix: run \`bag doctor\` or move it manually and set [wallet].keystore_dir = "../../.studio/wallets".`,
+      message: `keystore dir ${keystoreDir} is INSIDE the deploy codeLocation (${agentDir}) \u2014 a legacy layout. \`bag dev\` and \`bag deploy\` auto-migrate it to <workspace>/.studio/wallets (and repoint [wallet].keystore_dir). Fix: run \`bag dev\` once, or move it manually and set [wallet].keystore_dir = "../../.studio/wallets".`,
       details: { keystore_dir: keystoreDir, agent_dir: agentDir }
     }
   ];
@@ -10521,18 +10837,18 @@ async function checkLlmProviderKeySet(root, _target) {
 function gitignoreLines(p) {
   try {
     return new Set(
-      fs24.readFileSync(p, "utf-8").split(/\r?\n/).map((l) => l.trim())
+      fs25.readFileSync(p, "utf-8").split(/\r?\n/).map((l) => l.trim())
     );
   } catch {
     return null;
   }
 }
 function agentcoreEnvLocalIgnored(ws) {
-  const wsLines = gitignoreLines(path23.join(ws, ".gitignore"));
+  const wsLines = gitignoreLines(path24.join(ws, ".gitignore"));
   if (wsLines?.has("agentcore/.env.local")) {
     return true;
   }
-  const acLines = gitignoreLines(path23.join(ws, "agentcore", ".gitignore"));
+  const acLines = gitignoreLines(path24.join(ws, "agentcore", ".gitignore"));
   return acLines?.has(".env.local") ?? false;
 }
 function studioIgnored(lines) {
@@ -10543,8 +10859,8 @@ function studioIgnored(lines) {
 }
 async function checkGitignoreExcludesSecrets(root, _target) {
   const out = [];
-  const ws = path23.dirname(path23.dirname(envLocalPath10(root)));
-  const gi = path23.join(ws, ".gitignore");
+  const ws = path24.dirname(path24.dirname(envLocalPath11(root)));
+  const gi = path24.join(ws, ".gitignore");
   const lines = gitignoreLines(gi);
   if (lines === null) {
     return [
@@ -10566,7 +10882,7 @@ async function checkGitignoreExcludesSecrets(root, _target) {
       details: { missing: [".studio/"] }
     });
   }
-  if (isDir5(path23.join(ws, "agentcore")) && !agentcoreEnvLocalIgnored(ws)) {
+  if (isDir5(path24.join(ws, "agentcore")) && !agentcoreEnvLocalIgnored(ws)) {
     out.push({
       level: Level.CRITICAL,
       name: "gitignore_excludes_secrets",
@@ -10583,16 +10899,16 @@ function installedRuntimeVersion() {
   }
   try {
     const entry = require2.resolve("@bnbagent/studio-runtime");
-    let dir = path23.dirname(entry);
+    let dir = path24.dirname(entry);
     for (let i = 0; i < 10; i++) {
-      const pkgPath = path23.join(dir, "package.json");
+      const pkgPath = path24.join(dir, "package.json");
       if (isFile10(pkgPath)) {
-        const pkg = JSON.parse(fs24.readFileSync(pkgPath, "utf-8"));
+        const pkg = JSON.parse(fs25.readFileSync(pkgPath, "utf-8"));
         if (pkg.name === "@bnbagent/studio-runtime") {
           return typeof pkg.version === "string" ? pkg.version : null;
         }
       }
-      const parent = path23.dirname(dir);
+      const parent = path24.dirname(dir);
       if (parent === dir) {
         break;
       }
@@ -10649,7 +10965,7 @@ async function checkPieverseKeyHash(root, _target) {
     ];
   }
   const agentRoot2 = agentRootOf(root);
-  const apiKey = getEnvVar(envLocalPath10(agentRoot2), "PIEVERSE_LLM_API_KEY") || process.env.PIEVERSE_LLM_API_KEY;
+  const apiKey = getEnvVar(envLocalPath11(agentRoot2), "PIEVERSE_LLM_API_KEY") || process.env.PIEVERSE_LLM_API_KEY;
   if (!apiKey) return [];
   const configured = String(pvCfg.key_hash).trim().toLowerCase().replace(/^0x/u, "");
   const actual = pieverseKeyHash2(apiKey);
@@ -10822,7 +11138,7 @@ function x402SellerRailChecks(agentRoot2, cfg, target) {
     out.push({
       level: Level.CRITICAL,
       name: "x402_credentials_partial",
-      message: "B402 credentials are only partially configured. Set BASE_URL, CLIENT_ID, ACCESS_TOKEN, and exactly one private-key form before deploy.",
+      message: `B402 credentials are only partially configured. Set BASE_URL, CLIENT_ID, ACCESS_TOKEN, and exactly one private-key form before deploy. Confirm they were issued for this exact agent wallet and environment; never reuse them across wallets. Apply: ${B402_DEVELOPER_ACCOUNT_URL}`,
       details: { present: credentials.presentKeys }
     });
   }
@@ -10838,7 +11154,7 @@ function x402SellerRailChecks(agentRoot2, cfg, target) {
     out.push({
       level: rails.erc8183 ? Level.WARNING : Level.CRITICAL,
       name: "x402_credentials_missing",
-      message: "The x402 seller rail is enabled but all B402 credentials are absent, so it will start dormant.",
+      message: `The x402 seller rail is enabled but all B402 credentials are absent, so it will start dormant. ${B402_PAID_ONBOARDING_GUIDANCE}`,
       details: {}
     });
   }
@@ -10876,9 +11192,9 @@ function x402SellerRailChecks(agentRoot2, cfg, target) {
       details: { destination, target, stackRuntime: stackRuntime2 }
     });
   }
-  const dockerfile = path23.join(agentRoot2, "Dockerfile");
+  const dockerfile = path24.join(agentRoot2, "Dockerfile");
   if (rails.x402 && isFile10(dockerfile)) {
-    const source = fs24.readFileSync(dockerfile, "utf8");
+    const source = fs25.readFileSync(dockerfile, "utf8");
     if (!/^\s*FROM\s+node:22(?:[.-]|\s|$)/im.test(source)) {
       out.push({
         level: Level.WARNING,
@@ -10951,10 +11267,10 @@ async function checkDeployCliRunnable(_root, target) {
   ];
 }
 function agentcoreEnvVars(root) {
-  const descriptor = path23.join(root, AGENTCORE_DESCRIPTOR2);
+  const descriptor = path24.join(root, AGENTCORE_DESCRIPTOR2);
   let data;
   try {
-    data = JSON.parse(fs24.readFileSync(descriptor, "utf-8"));
+    data = JSON.parse(fs25.readFileSync(descriptor, "utf-8"));
   } catch {
     return [];
   }
@@ -10999,7 +11315,7 @@ async function checkRuntimeSecretsInjected(root, target) {
   }
   const missing = needed.filter((k) => !present[k]);
   if (missing.length > 0) {
-    const envLocal = envLocalPath10(root);
+    const envLocal = envLocalPath11(root);
     const recoverable = missing.filter(
       (k) => Boolean(process.env[k] || getEnvVar(envLocal, k))
     );
@@ -11036,7 +11352,7 @@ async function checkRuntimeSecretsInjected(root, target) {
       }
     ];
   }
-  const lines = gitignoreLines(path23.join(root, ".gitignore"));
+  const lines = gitignoreLines(path24.join(root, ".gitignore"));
   let tracked = true;
   if (lines !== null) {
     for (const p of ["agentcore/agentcore.json", "agentcore/", "/agentcore/"]) {
@@ -11061,7 +11377,7 @@ async function checkAwsTargetsPopulated(root, target) {
   if (target !== "agentcore") {
     return [];
   }
-  const p = path23.join(root, "agentcore", "aws-targets.json");
+  const p = path24.join(root, "agentcore", "aws-targets.json");
   const [account, region] = readAwsTarget(root);
   if (account && region) {
     return [];
@@ -11108,44 +11424,44 @@ var TWAK_WALLET_JSON_ENV = "TWAK_WALLET_JSON";
 var TWAK_CREDENTIALS_JSON_ENV = "TWAK_CREDENTIALS_JSON";
 function isFile11(p) {
   try {
-    return fs25.statSync(p).isFile();
+    return fs26.statSync(p).isFile();
   } catch {
     return false;
   }
 }
 function loadTomlOr(agentRoot2) {
   try {
-    return loadStudioToml12(path24.join(agentRoot2, "studio.toml"));
+    return loadStudioToml13(path25.join(agentRoot2, "studio.toml"));
   } catch {
     return {};
   }
 }
-function tableOf8(cfg, key) {
+function tableOf9(cfg, key) {
   const v = cfg[key];
   return v !== null && typeof v === "object" && !Array.isArray(v) ? v : {};
 }
 function deployWalletKind(agentRoot2) {
-  const kind = tableOf8(loadTomlOr(agentRoot2), "wallet").kind;
+  const kind = tableOf9(loadTomlOr(agentRoot2), "wallet").kind;
   return kind ? String(kind) : "evm-local";
 }
 function resolveKeystoreDir3(agentRoot2) {
   const rel = String(
-    tableOf8(loadTomlOr(agentRoot2), "wallet").keystore_dir ?? ".studio/wallets"
+    tableOf9(loadTomlOr(agentRoot2), "wallet").keystore_dir ?? ".studio/wallets"
   );
-  return path24.resolve(path24.isAbsolute(rel) ? rel : path24.join(agentRoot2, rel));
+  return path25.resolve(path25.isAbsolute(rel) ? rel : path25.join(agentRoot2, rel));
 }
 function readKeystoreJson(agentRoot2) {
   const keystoreDir = resolveKeystoreDir3(agentRoot2);
   let names;
   try {
-    names = fs25.readdirSync(keystoreDir).filter((n) => n.endsWith(".json")).sort();
+    names = fs26.readdirSync(keystoreDir).filter((n) => n.endsWith(".json")).sort();
   } catch {
     return null;
   }
   if (names.length === 0) {
     return null;
   }
-  const address = tableOf8(loadTomlOr(agentRoot2), "wallet").address;
+  const address = tableOf9(loadTomlOr(agentRoot2), "wallet").address;
   let chosen = null;
   if (typeof address === "string" && address) {
     for (const n of names) {
@@ -11160,9 +11476,9 @@ function readKeystoreJson(agentRoot2) {
       );
     }
   }
-  const file = path24.join(keystoreDir, chosen ?? names[0]);
+  const file = path25.join(keystoreDir, chosen ?? names[0]);
   try {
-    return fs25.readFileSync(file, "utf-8");
+    return fs26.readFileSync(file, "utf-8");
   } catch {
     return null;
   }
@@ -11170,11 +11486,11 @@ function readKeystoreJson(agentRoot2) {
 function readEnvLocal(agentRoot2) {
   const values = {};
   try {
-    const file = envLocalPath11(agentRoot2);
+    const file = envLocalPath12(agentRoot2);
     if (!isFile11(file)) {
       return values;
     }
-    for (const rawLine of fs25.readFileSync(file, "utf-8").split(/\r?\n/)) {
+    for (const rawLine of fs26.readFileSync(file, "utf-8").split(/\r?\n/)) {
       const line = rawLine.trim();
       if (!line || line.startsWith("#")) {
         continue;
@@ -11195,7 +11511,7 @@ function readEnvLocal(agentRoot2) {
   return values;
 }
 function collectRuntimeSecretsDetailed(root) {
-  const agentRoot2 = findSubProjectRoot7("agent", root) ?? root;
+  const agentRoot2 = findSubProjectRoot8("agent", root) ?? root;
   if (deployWalletKind(agentRoot2) === "altana") {
     throw new Error(
       "Altana deployment is deferred: refusing to collect either the admin keystore or runtime session for a deploy target."
@@ -11262,12 +11578,12 @@ var SCOPE_NAME = "invoke";
 var SCOPE = `${RESOURCE_SERVER_ID}/${SCOPE_NAME}`;
 var COGNITO_OUTPUTS_FILE = "agentcore/cognito/cdk-outputs.json";
 function emitNextSteps(result) {
-  return `\u2713 wrote Cognito CDK app to ${path25.dirname(result.appPath)}
-  - ${path25.basename(result.appPath)}  (CognitoStack: user pool + resource server + M2M client)
-  - ${path25.basename(result.readmePath)}  (deploy + wiring instructions)
+  return `\u2713 wrote Cognito CDK app to ${path26.dirname(result.appPath)}
+  - ${path26.basename(result.appPath)}  (CognitoStack: user pool + resource server + M2M client)
+  - ${path26.basename(result.readmePath)}  (deploy + wiring instructions)
 
 Next steps:
-  1. cd ${path25.dirname(result.appPath)}
+  1. cd ${path26.dirname(result.appPath)}
   2. npm install   # aws-cdk-lib + constructs + the cdk CLI (local)
   3. npx cdk deploy --outputs-file cdk-outputs.json   # YOU run this (the only AWS step)
   4. bag deploy provision-cognito --wire   # studio reads cdk-outputs.json \u2192
@@ -11458,26 +11774,26 @@ function emitCognitoCdk(workspaceRoot, opts = {}) {
       regionHint = null;
     }
   }
-  const outDir = path25.join(workspaceRoot, COGNITO_DIR);
-  fs26.mkdirSync(outDir, { recursive: true });
-  const appPath = path25.join(outDir, "app.ts");
-  const readmePath = path25.join(outDir, "README.md");
-  fs26.writeFileSync(appPath, appTs(regionHint), "utf-8");
-  fs26.writeFileSync(path25.join(outDir, "cdk.json"), cdkJson(), "utf-8");
-  fs26.writeFileSync(
-    path25.join(outDir, "package.json"),
+  const outDir = path26.join(workspaceRoot, COGNITO_DIR);
+  fs27.mkdirSync(outDir, { recursive: true });
+  const appPath = path26.join(outDir, "app.ts");
+  const readmePath = path26.join(outDir, "README.md");
+  fs27.writeFileSync(appPath, appTs(regionHint), "utf-8");
+  fs27.writeFileSync(path26.join(outDir, "cdk.json"), cdkJson(), "utf-8");
+  fs27.writeFileSync(
+    path26.join(outDir, "package.json"),
     cognitoPackageJson(),
     "utf-8"
   );
-  fs26.writeFileSync(readmePath, readme(), "utf-8");
+  fs27.writeFileSync(readmePath, readme(), "utf-8");
   return { appPath, readmePath };
 }
 function wireSummary(r) {
   return `\u2713 wired Cognito authorizer from the CDK outputs (no AWS call \u2014 read a local file):
-  - ${path25.basename(r.agentcoreJson)}: authorizerConfiguration.customJwtAuthorizer
+  - ${path26.basename(r.agentcoreJson)}: authorizerConfiguration.customJwtAuthorizer
       discoveryUrl = ${r.discoveryUrl}
       allowedClients = [${r.clientId}]
-  - ${path25.basename(r.agentcoreJson)}: envVars[] OAUTH_TOKEN_URL + OAUTH_SCOPE (reach the runtime so the agent card advertises oauth2)
+  - ${path26.basename(r.agentcoreJson)}: envVars[] OAUTH_TOKEN_URL + OAUTH_SCOPE (reach the runtime so the agent card advertises oauth2)
   - ${r.envLocal}: same pair, for local \`bag dev\`
   \u2192 \`bag deploy prepare\` W9 will now pass; deploy when ready.`;
 }
@@ -11510,8 +11826,8 @@ function upsertDescriptorEnvvars(cfg, values) {
 function upsertEnv(envLocal, values) {
   let lines = [];
   try {
-    if (fs26.statSync(envLocal).isFile()) {
-      lines = fs26.readFileSync(envLocal, "utf-8").split(/\r?\n/);
+    if (fs27.statSync(envLocal).isFile()) {
+      lines = fs27.readFileSync(envLocal, "utf-8").split(/\r?\n/);
       if (lines.length > 0 && lines[lines.length - 1] === "") {
         lines.pop();
       }
@@ -11530,19 +11846,19 @@ function upsertEnv(envLocal, values) {
       lines.push(repl);
     }
   }
-  fs26.mkdirSync(path25.dirname(envLocal), { recursive: true });
-  fs26.writeFileSync(envLocal, `${lines.join("\n")}
+  fs27.mkdirSync(path26.dirname(envLocal), { recursive: true });
+  fs27.writeFileSync(envLocal, `${lines.join("\n")}
 `, {
     encoding: "utf-8",
     mode: 384
   });
-  fs26.chmodSync(envLocal, 384);
+  fs27.chmodSync(envLocal, 384);
 }
 function wireCognitoOutputs(workspaceRoot, outputsFile = null) {
-  const outPath = outputsFile ?? path25.join(workspaceRoot, COGNITO_OUTPUTS_FILE);
+  const outPath = outputsFile ?? path26.join(workspaceRoot, COGNITO_OUTPUTS_FILE);
   let exists = false;
   try {
-    exists = fs26.statSync(outPath).isFile();
+    exists = fs27.statSync(outPath).isFile();
   } catch {
     exists = false;
   }
@@ -11552,7 +11868,7 @@ function wireCognitoOutputs(workspaceRoot, outputsFile = null) {
     );
   }
   const outs = flattenCdkOutputs(
-    JSON.parse(fs26.readFileSync(outPath, "utf-8"))
+    JSON.parse(fs27.readFileSync(outPath, "utf-8"))
   );
   for (const key of ["DiscoveryUrl", "AppClientId", "TokenUrl", "Scope"]) {
     if (outs[key] === void 0) {
@@ -11565,8 +11881,8 @@ function wireCognitoOutputs(workspaceRoot, outputsFile = null) {
   const clientId = String(outs.AppClientId);
   const tokenUrl = String(outs.TokenUrl);
   const scope = String(outs.Scope);
-  const acj = path25.join(workspaceRoot, "agentcore", "agentcore.json");
-  const cfg = JSON.parse(fs26.readFileSync(acj, "utf-8"));
+  const acj = path26.join(workspaceRoot, "agentcore", "agentcore.json");
+  const cfg = JSON.parse(fs27.readFileSync(acj, "utf-8"));
   const runtimes = cfg.runtimes;
   if (!Array.isArray(runtimes) || runtimes.length === 0) {
     throw new Error(
@@ -11589,9 +11905,9 @@ function wireCognitoOutputs(workspaceRoot, outputsFile = null) {
     OAUTH_TOKEN_URL: tokenUrl,
     OAUTH_SCOPE: scope
   });
-  fs26.writeFileSync(acj, `${JSON.stringify(cfg, null, 2)}
+  fs27.writeFileSync(acj, `${JSON.stringify(cfg, null, 2)}
 `, "utf-8");
-  const envLocal = envLocalPath12(workspaceRoot);
+  const envLocal = envLocalPath13(workspaceRoot);
   upsertEnv(envLocal, { OAUTH_TOKEN_URL: tokenUrl, OAUTH_SCOPE: scope });
   return {
     discoveryUrl: discovery,
@@ -11604,41 +11920,41 @@ function wireCognitoOutputs(workspaceRoot, outputsFile = null) {
 }
 
 // src/cli/_deploy/destroy.ts
-import * as fs28 from "fs";
-import * as path27 from "path";
-import { findSubProjectRoot as findSubProjectRoot9 } from "@bnbagent/studio-runtime/config";
+import * as fs29 from "fs";
+import * as path28 from "path";
+import { findSubProjectRoot as findSubProjectRoot10 } from "@bnbagent/studio-runtime/config";
 
 // src/cli/_deploy/status.ts
-import * as fs27 from "fs";
-import * as path26 from "path";
+import * as fs28 from "fs";
+import * as path27 from "path";
 import {
   APP_DIR as APP_DIR2,
-  findSubProjectRoot as findSubProjectRoot8,
-  findWorkspaceRoot as findWorkspaceRoot4,
-  loadStudioToml as loadStudioToml13
+  findSubProjectRoot as findSubProjectRoot9,
+  findWorkspaceRoot as findWorkspaceRoot5,
+  loadStudioToml as loadStudioToml14
 } from "@bnbagent/studio-runtime/config";
 function loadToml(p) {
   try {
-    return loadStudioToml13(p);
+    return loadStudioToml14(p);
   } catch {
     return {};
   }
 }
 function projectName(workspaceRoot) {
-  const descriptor = path26.join(workspaceRoot, "agentcore", "agentcore.json");
+  const descriptor = path27.join(workspaceRoot, "agentcore", "agentcore.json");
   try {
-    const data = JSON.parse(fs27.readFileSync(descriptor, "utf-8"));
+    const data = JSON.parse(fs28.readFileSync(descriptor, "utf-8"));
     if (data !== null && typeof data === "object" && data.name) {
       return String(data.name);
     }
   } catch {
   }
-  return path26.basename(workspaceRoot);
+  return path27.basename(workspaceRoot);
 }
 async function runStatus(opts = {}) {
-  const start = opts.projectRoot ? path26.resolve(opts.projectRoot) : void 0;
-  const agentRoot2 = findSubProjectRoot8("agent", start);
-  const agentData = agentRoot2 !== null ? loadToml(path26.join(agentRoot2, "studio.toml")) : {};
+  const start = opts.projectRoot ? path27.resolve(opts.projectRoot) : void 0;
+  const agentRoot2 = findSubProjectRoot9("agent", start);
+  const agentData = agentRoot2 !== null ? loadToml(path27.join(agentRoot2, "studio.toml")) : {};
   const deployRaw = agentData.deploy;
   const deploy = deployRaw !== null && typeof deployRaw === "object" && !Array.isArray(deployRaw) ? { ...deployRaw } : {};
   const runtimeArn = deploy.runtime_arn ? String(deploy.runtime_arn) : null;
@@ -11651,8 +11967,8 @@ async function runStatus(opts = {}) {
   }
   const onchainEndpoint = identity.endpoint ? String(identity.endpoint) : null;
   const agentReachable = null;
-  const workspaceBase2 = findWorkspaceRoot4(start) ?? (agentRoot2 !== null ? path26.dirname(agentRoot2) : null);
-  const workspaceRoot = workspaceBase2 !== null && path26.basename(workspaceBase2) === APP_DIR2 ? path26.dirname(workspaceBase2) : workspaceBase2;
+  const workspaceBase2 = findWorkspaceRoot5(start) ?? (agentRoot2 !== null ? path27.dirname(agentRoot2) : null);
+  const workspaceRoot = workspaceBase2 !== null && path27.basename(workspaceBase2) === APP_DIR2 ? path27.dirname(workspaceBase2) : workspaceBase2;
   let region = null;
   let account = null;
   let secretId = null;
@@ -11716,13 +12032,13 @@ function printInvariants() {
   );
 }
 function nullRecordedState(workspaceRoot) {
-  const agentRoot2 = findSubProjectRoot9("agent", workspaceRoot);
+  const agentRoot2 = findSubProjectRoot10("agent", workspaceRoot);
   if (agentRoot2 === null) {
     return;
   }
-  const ap = path27.join(agentRoot2, "studio.toml");
+  const ap = path28.join(agentRoot2, "studio.toml");
   try {
-    if (!fs28.statSync(ap).isFile()) {
+    if (!fs29.statSync(ap).isFile()) {
       return;
     }
   } catch {
@@ -11786,19 +12102,19 @@ async function runDestroy(opts) {
 }
 
 // src/cli/_deploy/packaging.ts
-import * as fs29 from "fs";
-import * as path28 from "path";
+import * as fs30 from "fs";
+import * as path29 from "path";
 import {
-  findSubProjectRoot as findSubProjectRoot10,
-  loadStudioToml as loadStudioToml14
+  findSubProjectRoot as findSubProjectRoot11,
+  loadStudioToml as loadStudioToml15
 } from "@bnbagent/studio-runtime/config";
 function agentRootOf2(root) {
-  return findSubProjectRoot10("agent", root);
+  return findSubProjectRoot11("agent", root);
 }
 function agentTable(agentRoot2, key) {
-  const tomlPath = path28.join(agentRoot2, "studio.toml");
+  const tomlPath = path29.join(agentRoot2, "studio.toml");
   try {
-    if (!fs29.statSync(tomlPath).isFile()) {
+    if (!fs30.statSync(tomlPath).isFile()) {
       return {};
     }
   } catch {
@@ -11806,7 +12122,7 @@ function agentTable(agentRoot2, key) {
   }
   let cfg;
   try {
-    cfg = loadStudioToml14(tomlPath);
+    cfg = loadStudioToml15(tomlPath);
   } catch {
     return {};
   }
@@ -11865,10 +12181,10 @@ function checkPackagingDrift(root, destination, walletKind2, force) {
     );
     return 1;
   }
-  const dockerfile = path28.join(agentRoot2, "Dockerfile");
+  const dockerfile = path29.join(agentRoot2, "Dockerfile");
   let dockerfilePresent = false;
   try {
-    dockerfilePresent = fs29.statSync(dockerfile).isFile();
+    dockerfilePresent = fs30.statSync(dockerfile).isFile();
   } catch {
     dockerfilePresent = false;
   }
@@ -11909,7 +12225,7 @@ function deployWalletKindSafe(root) {
   }
   let cfg;
   try {
-    cfg = loadStudioToml14(path28.join(agentRoot2, "studio.toml"));
+    cfg = loadStudioToml15(path29.join(agentRoot2, "studio.toml"));
   } catch {
     return "evm-local";
   }
@@ -11922,22 +12238,22 @@ function deployWalletKindSafe(root) {
 import { findStudioWorkspaceRoot as findStudioWorkspaceRoot2 } from "@bnbagent/studio-runtime/config";
 
 // src/cli/_deploy/checks/blocked.ts
-import * as fs30 from "fs";
-import * as path29 from "path";
+import * as fs31 from "fs";
+import * as path30 from "path";
 import {
-  findSubProjectRoot as findSubProjectRoot11,
-  loadStudioToml as loadStudioToml15
+  findSubProjectRoot as findSubProjectRoot12,
+  loadStudioToml as loadStudioToml16
 } from "@bnbagent/studio-runtime/config";
 function isFile12(p) {
   try {
-    return fs30.statSync(p).isFile();
+    return fs31.statSync(p).isFile();
   } catch {
     return false;
   }
 }
 function isDir6(p) {
   try {
-    return fs30.statSync(p).isDirectory();
+    return fs31.statSync(p).isDirectory();
   } catch {
     return false;
   }
@@ -11945,10 +12261,10 @@ function isDir6(p) {
 async function checkStudioTomlPresent(root, _target) {
   const out = [];
   const layers = {
-    agent: findSubProjectRoot11("agent", root)
+    agent: findSubProjectRoot12("agent", root)
   };
   for (const [side, subRoot] of Object.entries(layers)) {
-    const tomlPath = subRoot === null ? null : path29.join(subRoot, "studio.toml");
+    const tomlPath = subRoot === null ? null : path30.join(subRoot, "studio.toml");
     if (tomlPath === null || !isFile12(tomlPath)) {
       out.push({
         level: Level.BLOCKED,
@@ -11959,7 +12275,7 @@ async function checkStudioTomlPresent(root, _target) {
       continue;
     }
     try {
-      loadStudioToml15(tomlPath);
+      loadStudioToml16(tomlPath);
     } catch (exc) {
       const msg = exc instanceof Error ? exc.message : String(exc);
       out.push({
@@ -11973,8 +12289,8 @@ async function checkStudioTomlPresent(root, _target) {
   return out;
 }
 async function checkCwdIsProjectRoot(root, _target) {
-  const cwd = path29.resolve(process.cwd());
-  const rr = path29.resolve(root);
+  const cwd = path30.resolve(process.cwd());
+  const rr = path30.resolve(root);
   if (cwd !== rr) {
     return [
       {
@@ -11988,7 +12304,7 @@ async function checkCwdIsProjectRoot(root, _target) {
   return [];
 }
 async function checkNoSecretInGitHistory(root, _target) {
-  if (!isDir6(path29.join(root, ".git"))) {
+  if (!isDir6(path30.join(root, ".git"))) {
     return [];
   }
   const needles = [".env.local", "WALLET_PASSWORD"];
@@ -12026,8 +12342,8 @@ var allChecks2 = [
 ];
 
 // src/cli/_deploy/checks/info.ts
-import * as fs31 from "fs";
-import * as path30 from "path";
+import * as fs32 from "fs";
+import * as path31 from "path";
 async function checkPreviousDeployStatus(root, _target) {
   const deploy = tableOf2(loadAgentToml(root), "deploy");
   const last = deploy.last_deploy_at;
@@ -12051,10 +12367,10 @@ async function checkPreviousDeployStatus(root, _target) {
   ];
 }
 async function checkInstalledRecipesList(root, _target) {
-  const manifest = path30.join(root, ".studio", "recipes", "manifest.json");
+  const manifest = path31.join(root, ".studio", "recipes", "manifest.json");
   let exists = false;
   try {
-    exists = fs31.statSync(manifest).isFile();
+    exists = fs32.statSync(manifest).isFile();
   } catch {
     exists = false;
   }
@@ -12070,7 +12386,7 @@ async function checkInstalledRecipesList(root, _target) {
   }
   let data;
   try {
-    data = JSON.parse(fs31.readFileSync(manifest, "utf-8"));
+    data = JSON.parse(fs32.readFileSync(manifest, "utf-8"));
   } catch {
     return [
       {
@@ -12173,26 +12489,26 @@ var allChecks3 = [
 ];
 
 // src/cli/_deploy/checks/platform.ts
-import * as fs33 from "fs";
-import * as path32 from "path";
+import * as fs34 from "fs";
+import * as path33 from "path";
 import {
-  findSubProjectRoot as findSubProjectRoot12,
-  loadStudioToml as loadStudioToml16
+  findSubProjectRoot as findSubProjectRoot13,
+  loadStudioToml as loadStudioToml17
 } from "@bnbagent/studio-runtime/config";
 import { BSC_TESTNET_FAUCET_URLS } from "@bnbagent/studio-runtime/networks";
 
 // src/cli/_deploy/checks/warning.ts
 import * as crypto4 from "crypto";
-import * as fs32 from "fs";
-import * as path31 from "path";
-import { envLocalPath as envLocalPath13 } from "@bnbagent/studio-runtime/config";
+import * as fs33 from "fs";
+import * as path32 from "path";
+import { envLocalPath as envLocalPath14 } from "@bnbagent/studio-runtime/config";
 import { show } from "@bnbagent/studio-runtime/erc8004";
 import { getNetwork as getNetwork8 } from "@bnbagent/studio-runtime/networks";
 import * as walletRt3 from "@bnbagent/studio-runtime/wallet";
 var TBNB_MIN_WEI = 7n * 10n ** 15n;
 function isFile13(p) {
   try {
-    return fs32.statSync(p).isFile();
+    return fs33.statSync(p).isFile();
   } catch {
     return false;
   }
@@ -12330,7 +12646,7 @@ async function checkNetworkMatchesChainId(root, _target) {
   return [];
 }
 async function checkRpcUrlSetForRuntime(root, _target) {
-  const envLocal = envLocalPath13(root);
+  const envLocal = envLocalPath14(root);
   if (getEnvVar(envLocal, "RPC_URL")) {
     return [];
   }
@@ -12350,10 +12666,10 @@ async function checkRpcUrlSetForRuntime(root, _target) {
   ];
 }
 async function checkInstalledRecipesUnchanged(root, _target) {
-  const manifest = path31.join(root, ".studio", "recipes", "manifest.json");
+  const manifest = path32.join(root, ".studio", "recipes", "manifest.json");
   let data;
   try {
-    data = JSON.parse(fs32.readFileSync(manifest, "utf-8"));
+    data = JSON.parse(fs33.readFileSync(manifest, "utf-8"));
   } catch {
     return [];
   }
@@ -12368,11 +12684,11 @@ async function checkInstalledRecipesUnchanged(root, _target) {
     if (!rel || !expected || typeof rel !== "string") {
       continue;
     }
-    const p = path31.join(root, rel);
+    const p = path32.join(root, rel);
     if (!isFile13(p)) {
       continue;
     }
-    const actual = crypto4.createHash("sha256").update(fs32.readFileSync(p)).digest("hex");
+    const actual = crypto4.createHash("sha256").update(fs33.readFileSync(p)).digest("hex");
     if (actual !== expected) {
       stale.push(rel);
     }
@@ -12390,10 +12706,10 @@ async function checkInstalledRecipesUnchanged(root, _target) {
   return [];
 }
 function agentcoreAuthorizer(root) {
-  const descriptor = path31.join(root, "agentcore", "agentcore.json");
+  const descriptor = path32.join(root, "agentcore", "agentcore.json");
   let data;
   try {
-    data = JSON.parse(fs32.readFileSync(descriptor, "utf-8"));
+    data = JSON.parse(fs33.readFileSync(descriptor, "utf-8"));
   } catch {
     return null;
   }
@@ -12471,39 +12787,39 @@ var allChecks4 = [
 
 // src/cli/_deploy/checks/platform.ts
 var SLUG_RE = /^[a-z][a-z0-9-]{1,40}$/;
-function tableOf9(data, key) {
+function tableOf10(data, key) {
   const value = data[key];
   return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
 function agentRoot(root) {
-  return findSubProjectRoot12("agent", root) ?? path32.join(root, "app", "agent");
+  return findSubProjectRoot13("agent", root) ?? path33.join(root, "app", "agent");
 }
 function loadAgent(root) {
   try {
-    return loadStudioToml16(path32.join(agentRoot(root), "studio.toml"));
+    return loadStudioToml17(path33.join(agentRoot(root), "studio.toml"));
   } catch {
     return {};
   }
 }
 function platformArtifact(data) {
-  const walletKind2 = String(tableOf9(data, "wallet").kind ?? "evm-local").trim().toLowerCase();
+  const walletKind2 = String(tableOf10(data, "wallet").kind ?? "evm-local").trim().toLowerCase();
   if (walletKind2 === "twak") return "container";
-  const deploy = tableOf9(data, "deploy");
+  const deploy = tableOf10(data, "deploy");
   const explicit = String(deploy.platform_artifact ?? "").toLowerCase();
   if (explicit) return explicit;
   return String(deploy.packaging ?? "").toLowerCase() === "container" ? "container" : "zip";
 }
 var checkPlatformEntrypointPresent = async (root, _target) => {
   const data = loadAgent(root);
-  const faces = stackFaces(tableOf9(data, "stack"), tableOf9(data, "payments"));
+  const faces = stackFaces(tableOf10(data, "stack"), tableOf10(data, "payments"));
   const stem2 = entryStemOf(faces);
   const filenames = [`${stem2}.ts`];
   if (stem2 === "dualMain") filenames.push("mcpMain.ts");
   const filename = filenames.find(
-    (candidate) => !fs33.existsSync(path32.join(agentRoot(root), "src", candidate))
+    (candidate) => !fs34.existsSync(path33.join(agentRoot(root), "src", candidate))
   );
   if (filename === void 0) return [];
-  const expected = path32.join(agentRoot(root), "src", filename);
+  const expected = path33.join(agentRoot(root), "src", filename);
   return [
     {
       level: Level.CRITICAL,
@@ -12515,20 +12831,20 @@ var checkPlatformEntrypointPresent = async (root, _target) => {
 };
 var checkPlatformKeystoreNotInArtifact = async (root, _target) => {
   const data = loadAgent(root);
-  const wallet = tableOf9(data, "wallet");
+  const wallet = tableOf10(data, "wallet");
   if (String(wallet.kind ?? "evm-local") === "twak") return [];
-  const agent = path32.resolve(agentRoot(root));
+  const agent = path33.resolve(agentRoot(root));
   const configured = String(wallet.keystore_dir ?? ".studio/wallets");
-  const keystore = path32.resolve(agent, configured);
+  const keystore = path33.resolve(agent, configured);
   let jsonFiles;
   try {
-    jsonFiles = fs33.readdirSync(keystore).filter((name) => name.endsWith(".json"));
+    jsonFiles = fs34.readdirSync(keystore).filter((name) => name.endsWith(".json"));
   } catch {
     return [];
   }
   if (jsonFiles.length === 0) return [];
-  const rel = path32.relative(agent, keystore);
-  if (rel.startsWith("..") || path32.isAbsolute(rel)) return [];
+  const rel = path33.relative(agent, keystore);
+  if (rel.startsWith("..") || path33.isAbsolute(rel)) return [];
   return [
     {
       level: Level.CRITICAL,
@@ -12539,7 +12855,7 @@ var checkPlatformKeystoreNotInArtifact = async (root, _target) => {
   ];
 };
 var checkPlatformTestnetOnly = async (root, _target) => {
-  const network = String(tableOf9(loadAgent(root), "network").default ?? "").trim().toLowerCase();
+  const network = String(tableOf10(loadAgent(root), "network").default ?? "").trim().toLowerCase();
   if (!network || network === "bsc-testnet") return [];
   return [
     {
@@ -12552,7 +12868,7 @@ var checkPlatformTestnetOnly = async (root, _target) => {
   ];
 };
 var checkPlatformSlugValid = async (root, _target) => {
-  const platform = tableOf9(tableOf9(loadAgent(root), "deploy"), "platform");
+  const platform = tableOf10(tableOf10(loadAgent(root), "deploy"), "platform");
   const slug = String(platform.slug ?? "").trim();
   if (!slug || SLUG_RE.test(slug)) return [];
   return [
@@ -12610,7 +12926,7 @@ var checkPlatformStorageEndpoint = async (root, _target) => {
 };
 var checkPlatformMcpSyncTimeout = async (root, _target) => {
   const data = loadAgent(root);
-  const faces = stackFaces(tableOf9(data, "stack"), tableOf9(data, "payments"));
+  const faces = stackFaces(tableOf10(data, "stack"), tableOf10(data, "payments"));
   if (!hasMcpFace(faces)) return [];
   const dual = hasA2aFace(faces);
   return [
@@ -12623,8 +12939,8 @@ var checkPlatformMcpSyncTimeout = async (root, _target) => {
   ];
 };
 var checkPlatformX402MerchantsMainnet = async (root, _target) => {
-  const merchants = tableOf9(
-    tableOf9(tableOf9(loadAgent(root), "payments"), "x402"),
+  const merchants = tableOf10(
+    tableOf10(tableOf10(loadAgent(root), "payments"), "x402"),
     "merchants"
   );
   const names = Object.keys(merchants).sort();
@@ -12753,217 +13069,6 @@ async function runProducers(producers, root, target) {
   return out;
 }
 
-// src/cli/_deploy/providers.ts
-import * as fs34 from "fs";
-import * as path33 from "path";
-import {
-  findSubProjectRoot as findSubProjectRoot13,
-  findWorkspaceRoot as findWorkspaceRoot5,
-  loadStudioToml as loadStudioToml17
-} from "@bnbagent/studio-runtime/config";
-var PROVIDER_TARGETS = {
-  bnb: "bnb/trial",
-  aws: "aws/agentcore",
-  azure: "azure/foundry"
-};
-var PROVIDER_LABELS = {
-  bnb: "BNB Chain Trial",
-  aws: "AWS AgentCore",
-  azure: "Azure Foundry"
-};
-var PROVIDER_MENU_ORDER = [
-  "bnb",
-  "aws",
-  "azure"
-];
-var PROVIDER_SHORT_LABELS = {
-  bnb: "BNB",
-  aws: "AWS",
-  azure: "Azure"
-};
-function providerDigit(provider) {
-  return PROVIDER_MENU_ORDER.indexOf(provider) + 1;
-}
-var ADVERTISED_PROVIDERS = ["bnb", "aws"];
-var ADVERTISED_PROVIDERS_HELP = ADVERTISED_PROVIDERS.join("|");
-function tableOf10(data, key) {
-  const value = data[key];
-  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
-}
-function text(value) {
-  if (typeof value !== "string") return null;
-  const clean = value.trim();
-  return clean || null;
-}
-function descriptorName(workspaceRoot) {
-  try {
-    const data = JSON.parse(
-      fs34.readFileSync(
-        path33.join(workspaceRoot, "agentcore", "agentcore.json"),
-        "utf-8"
-      )
-    );
-    return text(data.name);
-  } catch {
-    return null;
-  }
-}
-function discoverRecordedDeployments(root) {
-  const workspaceRoot = findWorkspaceRoot5(root) ?? path33.resolve(root);
-  const agentRoot2 = findSubProjectRoot13("agent", workspaceRoot);
-  if (agentRoot2 === null) return [];
-  let config;
-  try {
-    config = loadStudioToml17(path33.join(agentRoot2, "studio.toml"));
-  } catch {
-    return [];
-  }
-  const projectName2 = descriptorName(workspaceRoot) ?? text(tableOf10(config, "project").name) ?? path33.basename(workspaceRoot);
-  const deploy = tableOf10(config, "deploy");
-  const platform = tableOf10(deploy, "platform");
-  const azure = tableOf10(config, "azure");
-  const runtime = text(tableOf10(config, "stack").runtime) ?? "agentcore";
-  const found = [];
-  const bnbId = text(platform.deployment_id);
-  const bnbEndpoint = text(platform.invoke_url);
-  if (bnbId || bnbEndpoint || text(platform.last_deploy_at)) {
-    found.push({
-      provider: "bnb",
-      target: PROVIDER_TARGETS.bnb,
-      name: text(platform.slug) ?? projectName2,
-      deploymentId: bnbId,
-      endpoint: bnbEndpoint,
-      status: "active"
-    });
-  }
-  const awsArn = text(deploy.runtime_arn);
-  const awsEndpoint = text(deploy.invoke_url);
-  const legacyAwsTimestamp = Boolean(text(deploy.last_deploy_at)) && runtime !== "azure-foundry" && text(deploy.destination) !== "platform";
-  if (awsArn || awsEndpoint || text(deploy.provider) === "aws" || legacyAwsTimestamp) {
-    found.push({
-      provider: "aws",
-      target: PROVIDER_TARGETS.aws,
-      name: projectName2,
-      deploymentId: awsArn,
-      endpoint: awsEndpoint,
-      status: "active"
-    });
-  }
-  const azureEndpoint = text(azure.agent_endpoint);
-  const azureDeploymentId = text(azure.deployment_id);
-  if (azureEndpoint || azureDeploymentId || text(azure.last_deploy_at)) {
-    found.push({
-      provider: "azure",
-      target: PROVIDER_TARGETS.azure,
-      name: text(azure.agent_name) ?? projectName2,
-      deploymentId: azureDeploymentId,
-      endpoint: azureEndpoint,
-      status: "active"
-    });
-  }
-  return found;
-}
-function unavailableProvidersForProject(root) {
-  const workspaceRoot = findWorkspaceRoot5(root) ?? path33.resolve(root);
-  const agentRoot2 = findSubProjectRoot13("agent", workspaceRoot);
-  if (agentRoot2 === null) return {};
-  let runtime = "agentcore";
-  let azureProtocolUnsupported = false;
-  try {
-    const cfg = loadStudioToml17(path33.join(agentRoot2, "studio.toml"));
-    runtime = text(tableOf10(cfg, "stack").runtime) ?? "agentcore";
-    const faces = stackFaces(tableOf10(cfg, "stack"), tableOf10(cfg, "payments"));
-    azureProtocolUnsupported = !hasA2aFace(faces) || hasMcpFace(faces);
-  } catch {
-    return {};
-  }
-  if (runtime === "azure-foundry") {
-    const reason = "this project uses a different container adapter; scaffold an agentcore project before selecting BNB or AWS";
-    return {
-      bnb: reason,
-      aws: reason,
-      ...azureProtocolUnsupported ? {
-        azure: "Azure Foundry deploy currently supports A2A projects only; use an A2A azure-foundry scaffold or AgentCore for MCP"
-      } : {}
-    };
-  }
-  return {
-    azure: "this project uses the agentcore adapter; scaffold with --runtime azure-foundry before selecting Azure"
-  };
-}
-function selected(provider, deployments) {
-  const active = deployments.filter((d) => d.status === "active");
-  return {
-    kind: "selected",
-    provider,
-    operation: active.some((d) => d.provider === provider) ? "update" : "create",
-    hasOtherActive: active.some((d) => d.provider !== provider)
-  };
-}
-function trialExpired(trial) {
-  return trial.state.toLowerCase() === "expired";
-}
-function unavailableReason(opts, provider) {
-  if (provider === "bnb" && trialExpired(opts.trial)) {
-    return "the 48h trial has expired";
-  }
-  return opts.unavailable?.[provider] ?? null;
-}
-function providerPromptHint() {
-  return PROVIDER_MENU_ORDER.filter((p) => ADVERTISED_PROVIDERS.includes(p)).map((p) => `${providerDigit(p)}=${PROVIDER_SHORT_LABELS[p]}`).join(", ");
-}
-async function promptProvider(opts) {
-  for (; ; ) {
-    const answer = (await opts.prompt(`Provider [${providerPromptHint()}]: `)).trim().toLowerCase();
-    const provider = answer === "1" || answer === "bnb" ? "bnb" : answer === "2" || answer === "aws" ? "aws" : answer === "3" || answer === "azure" ? "azure" : null;
-    if (provider === null) {
-      if (answer === "" || answer === "q" || answer === "cancel") {
-        return { kind: "cancelled", exitCode: 1 };
-      }
-      continue;
-    }
-    if (unavailableReason(opts, provider)) {
-      continue;
-    }
-    return selected(provider, opts.deployments);
-  }
-}
-async function selectDeployProvider(opts) {
-  if (opts.requested) {
-    const reason = unavailableReason(opts, opts.requested);
-    if (reason) {
-      return {
-        kind: "unavailable",
-        provider: opts.requested,
-        reason,
-        exitCode: 2
-      };
-    }
-    return selected(opts.requested, opts.deployments);
-  }
-  if (!opts.interactive) {
-    return { kind: "selection_required", exitCode: 2 };
-  }
-  const active = opts.deployments.filter((d) => d.status === "active");
-  const activeDeployment = active[0];
-  if (active.length === 1 && activeDeployment) {
-    if (unavailableReason(opts, activeDeployment.provider)) {
-      return promptProvider(opts);
-    }
-    const answer = (await opts.prompt(
-      `Update the existing ${PROVIDER_LABELS[activeDeployment.provider]} deployment? [1=update, 2=another provider, 3=cancel]: `
-    )).trim().toLowerCase();
-    if (answer === "1" || answer === "update" || answer === "yes") {
-      return selected(activeDeployment.provider, opts.deployments);
-    }
-    if (answer === "2" || answer === "another") {
-      return promptProvider(opts);
-    }
-    return { kind: "cancelled", exitCode: 1 };
-  }
-  return promptProvider(opts);
-}
-
 // src/cli/_deploy/verify.ts
 import * as path35 from "path";
 import {
@@ -13321,7 +13426,7 @@ async function runVerify(opts) {
 import * as fs36 from "fs";
 import * as path36 from "path";
 import {
-  envLocalPath as envLocalPath14,
+  envLocalPath as envLocalPath15,
   findSubProjectRoot as findSubProjectRoot15,
   findWorkspaceRoot as findWorkspaceRoot6,
   loadStudioToml as loadStudioToml19
@@ -13971,7 +14076,7 @@ function persistDeploySummary(root, text2) {
       return null;
     }
     const p = path36.join(
-      path36.dirname(envLocalPath14(root)),
+      path36.dirname(envLocalPath15(root)),
       "last-deploy-summary.txt"
     );
     fs36.mkdirSync(path36.dirname(p), { recursive: true });
@@ -14184,7 +14289,7 @@ function loadAgentCfg2(root) {
 function registerDeploy(program) {
   program.enablePositionalOptions();
   const p = program.command("deploy").description(
-    "Deploy the agent after explicitly selecting BNB or AWS; lifecycle subcommands inspect recorded deployments."
+    `Deploy the agent after explicitly selecting a provider (${ADVERTISED_PROVIDERS_HELP}); lifecycle subcommands inspect recorded deployments.`
   );
   const runtimeOption = () => acceptChoices(
     new Option4(
@@ -14205,7 +14310,7 @@ function registerDeploy(program) {
   const providerOption = () => acceptChoices(
     new Option4(
       "--provider <provider>",
-      "Provider: bnb or aws. Required for non-interactive deploy; lifecycle commands need it only when multiple records exist."
+      `Provider: ${ADVERTISED_PROVIDERS_HELP}. Required for non-interactive deploy; lifecycle commands need it only when multiple records exist.`
     ),
     // Unadvertised providers stay parseable (see ADVERTISED_PROVIDERS).
     PROVIDER_MENU_ORDER,
@@ -14363,7 +14468,8 @@ function applyProjectRoot(projectRoot, requireToml = true) {
   return null;
 }
 function resolveProjectRoot2(_projectRoot) {
-  return path37.resolve(process.cwd());
+  const cwd = path37.resolve(process.cwd());
+  return findStudioWorkspaceRoot3(cwd) ?? cwd;
 }
 function deployWorkspaceRoot2(root) {
   return findStudioWorkspaceRoot3(root) ?? root;
@@ -14600,10 +14706,10 @@ function writeAgentDeployState(workspaceRoot, arn, record = {}, destination = "s
       patchTomlKv(tomlPath, "deploy", "oauth_discovery_url", discoveryUrl);
     }
     if (tokenUrl) {
-      setEnvVar(envLocalPath15(agentRoot2), "OAUTH_TOKEN_URL", tokenUrl);
+      setEnvVar(envLocalPath16(agentRoot2), "OAUTH_TOKEN_URL", tokenUrl);
     }
     if (scope) {
-      setEnvVar(envLocalPath15(agentRoot2), "OAUTH_SCOPE", scope);
+      setEnvVar(envLocalPath16(agentRoot2), "OAUTH_SCOPE", scope);
     }
     if (persistedPackaging(agentRoot2) === null) {
       patchTomlKv(
@@ -15325,7 +15431,7 @@ function persistDeploySummary2(root, text2) {
       return null;
     }
     const p = path37.join(
-      path37.dirname(envLocalPath15(root)),
+      path37.dirname(envLocalPath16(root)),
       "last-deploy-summary.txt"
     );
     fs37.mkdirSync(path37.dirname(p), { recursive: true });
@@ -15842,7 +15948,7 @@ import * as fs38 from "fs";
 import * as path38 from "path";
 import { EVMWalletProvider as EVMWalletProvider2 } from "@bnbagent/sdk";
 import {
-  envLocalPath as envLocalPath16,
+  envLocalPath as envLocalPath17,
   findProjectRoot as findProjectRoot4,
   findStudioWorkspaceRoot as findStudioWorkspaceRoot4,
   loadStudioToml as loadStudioToml21
@@ -15982,7 +16088,7 @@ function resolveProjectRoot3(argRoot) {
 }
 function runCheckEnv(projectRoot) {
   const agentDir = workspaceLayers(projectRoot) ?? path38.join(projectRoot, "agent");
-  const envPath = envLocalPath16(agentDir);
+  const envPath = envLocalPath17(agentDir);
   printOut(`bag doctor --check-env: ${envPath}`);
   if (!isFile16(envPath)) {
     printOut(`  (no ${path38.basename(envPath)} found \u2014 nothing to report)`);
@@ -16062,7 +16168,8 @@ function checkAppMain(projectRootArg) {
       }
     ];
   }
-  return [{ name: "agent entrypoint", status: PASS, detail: entrypoint }];
+  const detail = runtime === "azure-foundry" ? `${entrypoint} (deploy entrypoint; \`bag dev\` serves src/main.ts or src/mcpMain.ts locally)` : entrypoint;
+  return [{ name: "agent entrypoint", status: PASS, detail }];
 }
 function checkAgentcoreName(projectRoot) {
   let cfgPath = null;
@@ -16395,7 +16502,7 @@ async function checkLlm(data, projectRoot) {
       }
     ];
   }
-  const keyValue = getEnvVar(envLocalPath16(projectRoot), keyEnv) || process.env[keyEnv];
+  const keyValue = getEnvVar(envLocalPath17(projectRoot), keyEnv) || process.env[keyEnv];
   const out = [];
   if (keyValue) {
     out.push({
@@ -16734,7 +16841,7 @@ function checkX402Seller(data, agentRoot2) {
     out.push({
       name: "x402 credentials",
       status: credentials.any ? FAIL : fallbackStatus,
-      detail: credentials.any ? "B402 credentials are partial; set BASE_URL, CLIENT_ID, ACCESS_TOKEN, and exactly one private-key form." : "PAID mode needs the four B402 merchant credentials; without them the rail starts dormant."
+      detail: credentials.any ? `B402 credentials are partial; set BASE_URL, CLIENT_ID, ACCESS_TOKEN, and exactly one private-key form. Confirm they were issued for this exact agent wallet and environment; never reuse them across wallets. Apply: ${B402_DEVELOPER_ACCOUNT_URL}` : `PAID mode needs the four B402 merchant credentials; without them the rail starts dormant. ${B402_PAID_ONBOARDING_GUIDANCE}`
     });
   }
   if (runtime !== "agentcore") {
@@ -18101,7 +18208,7 @@ async function cmdSettle(jobId, opts) {
 
 // src/cli/skills.ts
 import * as fs41 from "fs";
-import * as os5 from "os";
+import * as os6 from "os";
 import * as path42 from "path";
 import { Option as Option7 } from "commander";
 function registerSkills(program) {
@@ -18421,7 +18528,7 @@ function isFile17(p) {
 }
 function findInstalledSkills(knownNames) {
   const found = [];
-  const home = os5.homedir();
+  const home = os6.homedir();
   const cwd = process.cwd();
   const roots = [];
   const addRoot = (root) => {
@@ -19141,7 +19248,7 @@ import * as fs44 from "fs";
 import * as path46 from "path";
 import { auditedOp as auditedOp4 } from "@bnbagent/studio-runtime/audit";
 import {
-  envLocalPath as envLocalPath17,
+  envLocalPath as envLocalPath18,
   findProjectRoot as findProjectRoot6,
   loadStudioToml as loadStudioToml24
 } from "@bnbagent/studio-runtime/config";
@@ -19405,7 +19512,7 @@ async function cmdSellInit(priceFlag) {
       "utf8"
     );
   }
-  const envPath = envLocalPath17(root);
+  const envPath = envLocalPath18(root);
   for (const key of B402_ENV_KEYS) {
     const existing = getEnvVar(envPath, key);
     if (key === "B402_BASE_URL" && !free && resolveNetwork3(cfg).toLowerCase() === "bsc-testnet" && !process.env.B402_BASE_URL && !existing) {
@@ -19417,6 +19524,9 @@ async function cmdSellInit(priceFlag) {
   printOut(
     free ? "\u2713 x402 seller config is ready in FREE mode; B402 credentials are not required." : "\u2713 x402 seller config and B402 placeholders are ready for PAID mode."
   );
+  if (!free) {
+    printOut(`Next: ${B402_PAID_ONBOARDING_GUIDANCE}`);
+  }
   if (free) {
     printErr(
       "warning: /x402 is an anonymous FREE endpoint; B402 verify/settle and payment audit are bypassed."
@@ -19479,6 +19589,9 @@ async function cmdSellStatus(probe) {
   for (const [key, isSet] of Object.entries(presence)) {
     printOut(`  ${key}: ${isSet ? "set" : "absent"}`);
   }
+  if (policy.enabled && !free && !credentialsComplete) {
+    printOut(`Onboarding: ${B402_PAID_ONBOARDING_GUIDANCE}`);
+  }
   if (!probe) {
     printOut("B402 probe: skipped (--no-probe)");
     return 0;
@@ -19920,12 +20033,12 @@ function buildProgram() {
   return program;
 }
 function cliVersion() {
-  return "0.0.6-alpha.3";
+  return "0.0.6-alpha.5";
 }
 
 // src/cli/updateCheck.ts
 import * as fs45 from "fs";
-import * as os6 from "os";
+import * as os7 from "os";
 import * as path47 from "path";
 var PACKAGE = "@bnbagent/studio-cli";
 var REGISTRY_LATEST_URL = `https://registry.npmjs.org/${PACKAGE}/latest`;
@@ -19989,7 +20102,7 @@ async function maybePrintUpdateNudge(opts = {}) {
     if (!isTty()) {
       return;
     }
-    const home = opts.home ?? os6.homedir();
+    const home = opts.home ?? os7.homedir();
     const state = loadCache(home);
     const now = Date.now() / 1e3;
     if (now - Number(state.checked_at ?? 0) < CHECK_INTERVAL_SECONDS) {