@bnbagent/studio-cli 0.0.6-alpha.6 → 0.0.6-alpha.8

package/dist/bag.js

@@ -44,7 +44,7 @@ import {
   x402SellerIsFree,
   x402SellerPricingState,
   x402SellerUsesB402
-} from "./chunk-VEOOFDSF.js";
+} from "./chunk-JZAW6HMV.js";
 import {
   TWAK_CLI_MIN_VERSION,
   TWAK_CLI_VERSION,
@@ -106,7 +106,7 @@ import {
 var CAMPAIGN_DOC_URL = "https://www.bnbchain.org/en/blog/bnb-agent-studio-is-live-on-bnb-chain-ai-agents-from-one-prompt";
 var CAMPAIGN_CHECK_TIMEOUT_MS = 6e3;
 async function fetchCampaignActive() {
-  const { bnbPlatformApiUrl: bnbPlatformApiUrl2 } = await import("./deployCli-EEK75T67.js");
+  const { bnbPlatformApiUrl: bnbPlatformApiUrl2 } = await import("./deployCli-AJ25A4VK.js");
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), CAMPAIGN_CHECK_TIMEOUT_MS);
   try {
@@ -2090,11 +2090,11 @@ async function devAgentResponding(port = 9e3, timeoutMs = 500) {
   }
 }
 function devPortInUse(port = 9e3, timeoutMs = 250) {
-  return new Promise((resolve23) => {
+  return new Promise((resolve24) => {
     const socket = new net.Socket();
     const done = (result) => {
       socket.destroy();
-      resolve23(result);
+      resolve24(result);
     };
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => done(true));
@@ -2551,8 +2551,8 @@ function cmdListKeys(projectRoot) {
 }
 
 // src/cli/deploy.ts
-import * as fs37 from "fs";
-import * as path37 from "path";
+import * as fs38 from "fs";
+import * as path38 from "path";
 import {
   envLocalPath as envLocalPath16,
   findStudioWorkspaceRoot as findStudioWorkspaceRoot3,
@@ -2994,23 +2994,24 @@ function hasIpfsEndpointFinding(result) {
 }
 
 // src/cli/_deploy/cognitoCdk.ts
-import * as fs27 from "fs";
-import * as path26 from "path";
+import * as fs28 from "fs";
+import * as path27 from "path";
 import { envLocalPath as envLocalPath13 } from "@bnbagent/studio-runtime/config";
 
 // src/cli/_deploy/secrets.ts
-import * as fs26 from "fs";
-import * as path25 from "path";
+import * as fs27 from "fs";
+import * as path26 from "path";
 import {
   envLocalPath as envLocalPath12,
   findSubProjectRoot as findSubProjectRoot8,
   loadStudioToml as loadStudioToml13
 } from "@bnbagent/studio-runtime/config";
+import { ALTANA_SESSION_ENV } from "@bnbagent/studio-runtime/wallet";
 
 // src/cli/dev.ts
-import * as fs24 from "fs";
+import * as fs25 from "fs";
 import * as os5 from "os";
-import * as path23 from "path";
+import * as path24 from "path";
 import { loadStudioToml as loadStudioToml11 } from "@bnbagent/studio-runtime/config";
 import { getNetwork as getNetwork7 } from "@bnbagent/studio-runtime/networks";
 import { writePrivate as writePrivate2 } from "@bnbagent/studio-runtime/secretWrite";
@@ -3198,9 +3199,9 @@ function relocateKeys(src, target, label) {
 }
 
 // src/cli/init.ts
-import * as fs23 from "fs";
+import * as fs24 from "fs";
 import * as os4 from "os";
-import * as path22 from "path";
+import * as path23 from "path";
 import { getNetwork as getNetwork6 } from "@bnbagent/studio-runtime/networks";
 import { ensureTwakKeychain } from "@bnbagent/studio-runtime/wallet";
 import { Option as Option2 } from "commander";
@@ -3451,8 +3452,8 @@ function pnpmVersion() {
 
 // src/cli/_runtime/azureFoundry.ts
 import * as crypto2 from "crypto";
-import * as fs17 from "fs";
-import * as path16 from "path";
+import * as fs18 from "fs";
+import * as path17 from "path";
 import {
   findStudioWorkspaceRoot,
   findSubProjectRoot as findSubProjectRoot7,
@@ -3460,9 +3461,177 @@ import {
 } from "@bnbagent/studio-runtime/config";
 import { resolveProviderConfig } from "@bnbagent/studio-runtime/llm";
 
-// src/cli/_deploy/checks/twak.ts
+// src/cli/_deploy/checks/altana.ts
 import * as fs15 from "fs";
 import * as path14 from "path";
+import { resolveProjectAltanaSdkEntry } from "@bnbagent/studio-runtime/wallet";
+var EXPIRY_WARN_SECONDS = 7 * 24 * 60 * 60;
+function isAltana(data) {
+  return tableOf2(data, "wallet").kind === "altana";
+}
+function isFile4(p) {
+  try {
+    return fs15.statSync(p).isFile();
+  } catch {
+    return false;
+  }
+}
+function sessionFileOf(root, walletCfg) {
+  const configured = String(
+    walletCfg.session_file ?? ".studio/wallets/altana-session.json"
+  );
+  return path14.isAbsolute(configured) ? configured : path14.join(agentRootOf(root), configured);
+}
+function checkAltanaSessionReady(root, _target) {
+  const data = loadAgentToml(root);
+  if (!isAltana(data)) {
+    return [];
+  }
+  const walletCfg = tableOf2(data, "wallet");
+  const sessionFile = sessionFileOf(root, walletCfg);
+  if (!isFile4(sessionFile)) {
+    return [
+      {
+        level: Level.CRITICAL,
+        name: "altana_session_exists",
+        message: `no Altana session at ${sessionFile} (wallet.kind='altana') \u2014 the deployed runtime receives ONLY the bounded session (never the admin keystore) and cannot sign without one.`,
+        fixCmd: "bag wallet session grant",
+        details: { session_file: sessionFile }
+      }
+    ];
+  }
+  let envelope;
+  try {
+    envelope = JSON.parse(fs15.readFileSync(sessionFile, "utf8"));
+  } catch {
+    return [
+      {
+        level: Level.CRITICAL,
+        name: "altana_session_valid",
+        message: `invalid Altana session JSON at ${sessionFile} \u2014 revoke and grant a fresh session.`,
+        fixCmd: "bag wallet session grant --force",
+        details: { session_file: sessionFile }
+      }
+    ];
+  }
+  const anchored = String(walletCfg.address ?? "").trim();
+  if (!anchored) {
+    return [
+      {
+        level: Level.CRITICAL,
+        name: "altana_session_valid",
+        message: "no [wallet].address anchored in app/agent/studio.toml \u2014 the session cannot be verified against the project identity; deploy refuses identity drift.",
+        details: { session_file: sessionFile }
+      }
+    ];
+  }
+  const sessionAddress = String(envelope.walletAddress ?? "");
+  if (envelope.version !== 1 || typeof envelope.publicKey !== "string" || !envelope.publicKey.startsWith("0x") || typeof envelope.expiry !== "number") {
+    return [
+      {
+        level: Level.CRITICAL,
+        name: "altana_session_valid",
+        message: `invalid Altana session envelope at ${sessionFile} \u2014 revoke and grant a fresh session.`,
+        fixCmd: "bag wallet session grant --force",
+        details: { session_file: sessionFile }
+      }
+    ];
+  }
+  if (sessionAddress.toLowerCase() !== anchored.toLowerCase()) {
+    return [
+      {
+        level: Level.CRITICAL,
+        name: "altana_session_valid",
+        message: `the Altana session at ${sessionFile} was granted for ${sessionAddress}, but studio.toml anchors [wallet].address = ${anchored} \u2014 deploying would ship a DIFFERENT identity than the one registered on-chain. Restore the right session or re-anchor, then re-grant.`,
+        details: { anchored, session_address: sessionAddress }
+      }
+    ];
+  }
+  const out = [];
+  const remaining = envelope.expiry - Math.floor(Date.now() / 1e3);
+  if (remaining <= 0) {
+    out.push({
+      level: Level.CRITICAL,
+      name: "altana_session_expiry",
+      message: `the Altana session expired at ${new Date(envelope.expiry * 1e3).toISOString()} \u2014 the deployed runtime would refuse to load it at cold start. Re-grant with \`bag wallet session grant --force\`, then redeploy.`,
+      fixCmd: "bag wallet session grant --force",
+      details: { expiry: envelope.expiry }
+    });
+  } else if (remaining < EXPIRY_WARN_SECONDS) {
+    out.push({
+      level: Level.WARNING,
+      name: "altana_session_expiry",
+      message: `the Altana session expires ${new Date(envelope.expiry * 1e3).toISOString()} (< 7 days). When it lapses the DEPLOYED agent dies at cold start and recovery needs a re-grant AND a redeploy (\`bag wallet session grant --force\`, then \`bag deploy\`). Consider re-granting now.`,
+      details: { expiry: envelope.expiry, remaining_seconds: remaining }
+    });
+  }
+  try {
+    if (process.platform !== "win32" && (fs15.statSync(sessionFile).mode & 63) !== 0) {
+      out.push({
+        level: Level.WARNING,
+        name: "altana_session_permissions",
+        message: `${sessionFile} is readable by group/others and contains the raw session private key; run chmod 600.`,
+        details: { session_file: sessionFile }
+      });
+    }
+  } catch {
+  }
+  return out;
+}
+function checkAltanaSdkResolvable(root, _target) {
+  const data = loadAgentToml(root);
+  if (!isAltana(data)) {
+    return [];
+  }
+  const agentRoot2 = agentRootOf(root);
+  let entry = null;
+  let failure = null;
+  try {
+    entry = resolveProjectAltanaSdkEntry(agentRoot2);
+  } catch (error) {
+    failure = error instanceof Error ? error.message : String(error);
+  }
+  if (entry !== null) {
+    return [];
+  }
+  return [
+    {
+      level: Level.CRITICAL,
+      name: "altana_sdk_resolvable",
+      message: `@altananetwork/sdk is not resolvable from the agent project${failure ? ` (${failure})` : ""} \u2014 the deployed runtime cannot build the Altana session wallet at cold start.`,
+      fixCmd: "pnpm add @altananetwork/sdk@0.5.1",
+      details: failure ? { error: failure } : {}
+    }
+  ];
+}
+function checkAltanaSessionNotInsideAgent(root, _target) {
+  const data = loadAgentToml(root);
+  if (!isAltana(data)) {
+    return [];
+  }
+  const sessionFile = path14.resolve(
+    sessionFileOf(root, tableOf2(data, "wallet"))
+  );
+  if (!isFile4(sessionFile)) {
+    return [];
+  }
+  const agentDir = path14.resolve(agentRootOf(root));
+  if (!sessionFile.startsWith(agentDir + path14.sep)) {
+    return [];
+  }
+  return [
+    {
+      level: Level.CRITICAL,
+      name: "altana_session_not_inside_agent",
+      message: `the Altana session file ${sessionFile} is INSIDE the deploy artifact root (${agentDir}) \u2014 it contains the raw session private key and would ship in the artifact. Move it to <workspace>/.studio/wallets and set [wallet].session_file = "../../.studio/wallets/altana-session.json" (deploy injects it as the ALTANA_SESSION secret instead).`,
+      details: { session_file: sessionFile, agent_dir: agentDir }
+    }
+  ];
+}
+
+// src/cli/_deploy/checks/twak.ts
+import * as fs16 from "fs";
+import * as path15 from "path";
 import { envLocalPath as envLocalPath7 } from "@bnbagent/studio-runtime/config";
 import { resolveTwakHome } from "@bnbagent/studio-runtime/wallet";
 
@@ -3505,13 +3674,13 @@ function twakUnsupportedContractOverrides(networkName, env = process.env) {
 }
 
 // src/cli/_deploy/checks/twak.ts
-var AGENTCORE_DESCRIPTOR = path14.join("agentcore", "agentcore.json");
+var AGENTCORE_DESCRIPTOR = path15.join("agentcore", "agentcore.json");
 function isTwak(data) {
   return tableOf2(data, "wallet").kind === "twak";
 }
-function isFile4(p) {
+function isFile5(p) {
   try {
-    return fs15.statSync(p).isFile();
+    return fs16.statSync(p).isFile();
   } catch {
     return false;
   }
@@ -3524,13 +3693,13 @@ async function checkTwakRequiresContainer(root, target) {
   if (!isTwak(data)) {
     return [];
   }
-  const descriptor = path14.join(root, AGENTCORE_DESCRIPTOR);
-  if (!isFile4(descriptor)) {
+  const descriptor = path15.join(root, AGENTCORE_DESCRIPTOR);
+  if (!isFile5(descriptor)) {
     return [];
   }
   let cfg;
   try {
-    cfg = JSON.parse(fs15.readFileSync(descriptor, "utf-8"));
+    cfg = JSON.parse(fs16.readFileSync(descriptor, "utf-8"));
   } catch {
     return [];
   }
@@ -3553,8 +3722,8 @@ async function checkTwakRequiresContainer(root, target) {
       }
     ];
   }
-  const dockerfile = path14.join(agentRootOf(root), "Dockerfile");
-  if (!isFile4(dockerfile)) {
+  const dockerfile = path15.join(agentRootOf(root), "Dockerfile");
+  if (!isFile5(dockerfile)) {
     return [
       {
         level: Level.BLOCKED,
@@ -3637,10 +3806,10 @@ async function checkTwakWalletExists(root, _target) {
   const agentRoot2 = agentRootOf(root);
   const walletCfg = tableOf2(data, "wallet");
   const walletFile = twakWalletFile(walletCfg, agentRoot2);
-  if (!isFile4(walletFile)) {
+  if (!isFile5(walletFile)) {
     let createCmd = "twak wallet create --password <pw> --no-keychain";
     if (walletCfg.twak_home) {
-      createCmd = `HOME=${path14.dirname(path14.dirname(walletFile))} ${createCmd}`;
+      createCmd = `HOME=${path15.dirname(path15.dirname(walletFile))} ${createCmd}`;
     }
     return [
       {
@@ -3762,13 +3931,13 @@ async function checkTwakCredentialsAvailable(root, _target) {
   }
   const agentRoot2 = agentRootOf(root);
   const walletCfg = tableOf2(data, "wallet");
-  const credentialsFile = path14.join(
-    path14.dirname(twakWalletFile(walletCfg, agentRoot2)),
+  const credentialsFile = path15.join(
+    path15.dirname(twakWalletFile(walletCfg, agentRoot2)),
     "credentials.json"
   );
   const envLocal = envLocalPath7(agentRoot2);
   const resolvable = (key) => Boolean(process.env[key] || getEnvVar(envLocal, key));
-  if (isFile4(credentialsFile)) {
+  if (isFile5(credentialsFile)) {
     return [];
   }
   if (resolvable("TWAK_ACCESS_ID") && resolvable("TWAK_HMAC_SECRET")) {
@@ -3785,21 +3954,21 @@ async function checkTwakCredentialsAvailable(root, _target) {
 }
 
 // src/cli/_deploy/fixes.ts
-import * as fs16 from "fs";
-import * as path15 from "path";
+import * as fs17 from "fs";
+import * as path16 from "path";
 import { envLocalPath as envLocalPath8 } from "@bnbagent/studio-runtime/config";
 function fixGitignore(root) {
-  const ws = path15.dirname(path15.dirname(envLocalPath8(root)));
-  const gi = path15.join(ws, ".gitignore");
+  const ws = path16.dirname(path16.dirname(envLocalPath8(root)));
+  const gi = path16.join(ws, ".gitignore");
   const required = [".studio/"];
   let exists = false;
   try {
-    exists = fs16.statSync(gi).isFile();
+    exists = fs17.statSync(gi).isFile();
   } catch {
     exists = false;
   }
   if (!exists) {
-    fs16.writeFileSync(gi, `${required.join("\n")}
+    fs17.writeFileSync(gi, `${required.join("\n")}
 `, "utf-8");
     return {
       name: "fix-gitignore",
@@ -3807,7 +3976,7 @@ function fixGitignore(root) {
       message: `created .gitignore with ${required.length} entries`
     };
   }
-  let text2 = fs16.readFileSync(gi, "utf-8");
+  let text2 = fs17.readFileSync(gi, "utf-8");
   const existing = new Set(text2.split(/\r?\n/).map((l) => l.trim()));
   const appended = required.filter((r) => !existing.has(r));
   if (appended.length === 0) {
@@ -3822,7 +3991,7 @@ function fixGitignore(root) {
   }
   text2 += `${appended.join("\n")}
 `;
-  fs16.writeFileSync(gi, text2, "utf-8");
+  fs17.writeFileSync(gi, text2, "utf-8");
   return {
     name: "fix-gitignore",
     changed: true,
@@ -3830,10 +3999,10 @@ function fixGitignore(root) {
   };
 }
 function patchTomlKv(tomlPath, section, key, value) {
-  const text2 = fs16.readFileSync(tomlPath, "utf-8");
+  const text2 = fs17.readFileSync(tomlPath, "utf-8");
   const updated = updateSection(text2, section, { [key]: value });
   if (updated !== text2) {
-    fs16.writeFileSync(tomlPath, updated, "utf-8");
+    fs17.writeFileSync(tomlPath, updated, "utf-8");
   }
 }
 
@@ -3864,9 +4033,9 @@ var HOSTED_AGENT_REGIONS = /* @__PURE__ */ new Set([
   "spaincentral",
   "australiaeast"
 ]);
-function isFile5(p) {
+function isFile6(p) {
   try {
-    return fs17.statSync(p).isFile();
+    return fs18.statSync(p).isFile();
   } catch {
     return false;
   }
@@ -3883,8 +4052,8 @@ function loadStudioCfg(workspaceRoot) {
   if (agentRoot2 === null) {
     return {};
   }
-  const tomlPath = path16.join(agentRoot2, "studio.toml");
-  if (!isFile5(tomlPath)) {
+  const tomlPath = path17.join(agentRoot2, "studio.toml");
+  if (!isFile6(tomlPath)) {
     return {};
   }
   try {
@@ -3896,7 +4065,7 @@ function loadStudioCfg(workspaceRoot) {
 function recordAzureDeployment(root, data, endpoint) {
   const agentRoot2 = findSubProjectRoot7("agent", deployWorkspaceRoot(root));
   if (agentRoot2 === null) return;
-  const tomlPath = path16.join(agentRoot2, "studio.toml");
+  const tomlPath = path17.join(agentRoot2, "studio.toml");
   try {
     const name = String(data.id ?? tableOf4(data, "record").id ?? "").trim();
     if (name) {
@@ -3914,7 +4083,7 @@ function recordAzureDeployment(root, data, endpoint) {
 function clearAzureEndpoint(root) {
   const agentRoot2 = findSubProjectRoot7("agent", deployWorkspaceRoot(root));
   if (agentRoot2 === null) return;
-  const tomlPath = path16.join(agentRoot2, "studio.toml");
+  const tomlPath = path17.join(agentRoot2, "studio.toml");
   try {
     for (const key of [
       "agent_endpoint",
@@ -4033,7 +4202,7 @@ async function destroyAzureFoundry(opts) {
     const extra = opts.purge ? " --purge" : "";
     printOut("=== bag deploy destroy \u2014 teardown plan (dry-run) ===\n");
     printOut(
-      `project: ${path16.basename(workspaceRoot)}  (runtime: azure-foundry)
+      `project: ${path17.basename(workspaceRoot)}  (runtime: azure-foundry)
 `
     );
     printOut("--- Agent (Foundry Hosted Agent) ---");
@@ -4076,8 +4245,8 @@ function agentTomlPath(root) {
   if (agentRoot2 === null) {
     return null;
   }
-  const tomlPath = path16.join(agentRoot2, "studio.toml");
-  return isFile5(tomlPath) ? tomlPath : null;
+  const tomlPath = path17.join(agentRoot2, "studio.toml");
+  return isFile6(tomlPath) ? tomlPath : null;
 }
 function checkAzureBlock(root) {
   const tomlPath = agentTomlPath(root);
@@ -4210,7 +4379,7 @@ var checkEntrypointAndDockerfile = async (root, _target) => {
     ];
   }
   const entry = "src/foundryMain.ts";
-  if (!isFile5(path16.join(agentRoot2, entry))) {
+  if (!isFile6(path17.join(agentRoot2, entry))) {
     findings.push({
       level: "CRITICAL",
       name: "azure_agent_entrypoint",
@@ -4218,7 +4387,7 @@ var checkEntrypointAndDockerfile = async (root, _target) => {
       details: { entrypoint: entry }
     });
   }
-  if (!isFile5(path16.join(agentRoot2, "Dockerfile"))) {
+  if (!isFile6(path17.join(agentRoot2, "Dockerfile"))) {
     findings.push({
       level: "CRITICAL",
       name: "azure_dockerfile_present",
@@ -4264,12 +4433,15 @@ var azureFoundryChecks = [
   checkEntrypointAndDockerfile,
   checkLlmExternalProviderReady,
   checkTwakPasswordEnvSet,
-  checkTwakCredentialsAvailable
+  checkTwakCredentialsAvailable,
+  checkAltanaSessionReady,
+  checkAltanaSdkResolvable,
+  checkAltanaSessionNotInsideAgent
 ];
 
 // src/cli/llm.ts
-import * as fs18 from "fs";
-import * as path17 from "path";
+import * as fs19 from "fs";
+import * as path18 from "path";
 import { query as auditQuery, auditedOp } from "@bnbagent/studio-runtime/audit";
 import {
   envLocalPath as envLocalPath9,
@@ -4284,6 +4456,7 @@ import {
 import { getNetwork as getNetwork4 } from "@bnbagent/studio-runtime/networks";
 import * as pieverseRt from "@bnbagent/studio-runtime/pieverse";
 import {
+  PieverseKeyNotFoundError,
   PieversePolicy,
   RetryPolicy,
   allocateWithSettleRetry,
@@ -4417,7 +4590,10 @@ function registerLlm(program) {
   ).option(
     "--network <name>",
     "Override [llm.pieverse].network (e.g. bsc-mainnet, bsc-testnet)."
-  ).option("--name <name>", "Key name (default: bnbagent-studio-default).").action(
+  ).option("--name <name>", "Key name (default: bnbagent-studio-default).").option(
+    "--replace",
+    "Ignore any existing key and mint a fresh one, overwriting PIEVERSE_LLM_API_KEY in .studio/.env.local. Use when the key you inherited (e.g. from a shared env file) no longer exists in Pieverse. The old key is left untouched on the Pieverse side."
+  ).action(
     act(
       (opts) => cmdActivate(opts)
     )
@@ -4544,7 +4720,7 @@ function loadFullCfg() {
   }
   let cfg;
   try {
-    cfg = loadStudioToml8(path17.join(root, "studio.toml"));
+    cfg = loadStudioToml8(path18.join(root, "studio.toml"));
   } catch (exc) {
     printErr(`error: failed to parse studio.toml: ${errMessage(exc)}`);
     return null;
@@ -4626,9 +4802,20 @@ async function cmdActivate(opts) {
     return 2;
   }
   const pvCfg = loadPieverseConfig(cfg);
-  let existingHash = pvCfg.key_hash ? String(pvCfg.key_hash) : null;
-  const envFileValue = getEnvVar(envLocalPath9(root), PIEVERSE_ENV_KEY);
-  const existingEnv = envFileValue || process.env[PIEVERSE_ENV_KEY];
+  const replace = opts.replace === true;
+  let existingHash = !replace && pvCfg.key_hash ? String(pvCfg.key_hash) : null;
+  const envFileValue = replace ? null : getEnvVar(envLocalPath9(root), PIEVERSE_ENV_KEY);
+  const existingEnv = replace ? null : envFileValue || process.env[PIEVERSE_ENV_KEY];
+  if (replace) {
+    printOut(
+      `\u2192 --replace: ignoring any existing ${PIEVERSE_ENV_KEY} and minting a fresh key\u2026`
+    );
+    if (process.env[PIEVERSE_ENV_KEY]) {
+      printErr(
+        `warning: ${PIEVERSE_ENV_KEY} is also exported in this shell. The new key goes to .studio/.env.local, which \`bag\` prefers, but \`unset ${PIEVERSE_ENV_KEY}\` to keep the two from diverging.`
+      );
+    }
+  }
   if (!existingHash && existingEnv) {
     const derivedHash = pieverseKeyHash(existingEnv);
     printOut(
@@ -4637,15 +4824,24 @@ async function cmdActivate(opts) {
     try {
       await withSiweRetry(wallet, (token) => inspectKey(token, derivedHash));
     } catch (exc) {
+      if (!(exc instanceof PieverseKeyNotFoundError)) {
+        printErr(
+          `error: could not verify the existing ${PIEVERSE_ENV_KEY} against Pieverse: ${errMessage(
+            exc
+          )}
+The existing key was kept and no new key was created. This looks like a transport or login failure rather than a missing key \u2014 retry \`bag llm activate\` once Pieverse is reachable.`
+        );
+        return 2;
+      }
       const sources = [
         envFileValue ? `.studio/.env.local (a ${PIEVERSE_ENV_KEY}= line)` : "",
         process.env[PIEVERSE_ENV_KEY] ? "the shell environment" : ""
       ].filter(Boolean).join(" and ");
       printErr(
-        `error: ${PIEVERSE_ENV_KEY} already exists but its derived key_hash could not be verified: ${errMessage(
+        `error: ${PIEVERSE_ENV_KEY} already exists but Pieverse does not know its key_hash: ${errMessage(
           exc
         )}
-The existing key was kept and no new key was created. The key comes from ${sources}; \`bag\` reads both, so clear every source \u2014 remove the ${PIEVERSE_ENV_KEY}= line from .studio/.env.local AND \`unset ${PIEVERSE_ENV_KEY}\` in the shell \u2014 then re-run \`bag llm activate\` to mint a fresh key. (\`bag llm rotate\` replaces a key that is still valid in Pieverse; it cannot recover this one.)`
+The existing key was kept and no new key was created. The key comes from ${sources}. Re-run \`bag llm activate --replace\` to mint a fresh key and overwrite .studio/.env.local (then \`unset ${PIEVERSE_ENV_KEY}\` if you also exported it in this shell). (\`bag llm rotate\` replaces a key that is still valid in Pieverse; it cannot recover this one.)`
       );
       return 2;
     }
@@ -4886,9 +5082,9 @@ Retry: re-run \`bag llm activate\` \u2014 key_hash is saved so it will pick up w
   return 0;
 }
 function updateStudioTomlSection(root, section, updates) {
-  const tomlPath = path17.join(root, "studio.toml");
-  const text2 = fs18.readFileSync(tomlPath, "utf-8");
-  fs18.writeFileSync(tomlPath, updateSection(text2, section, updates), "utf-8");
+  const tomlPath = path18.join(root, "studio.toml");
+  const text2 = fs19.readFileSync(tomlPath, "utf-8");
+  fs19.writeFileSync(tomlPath, updateSection(text2, section, updates), "utf-8");
 }
 function cumulativeTopupsUsd() {
   let total = 0;
@@ -5437,8 +5633,8 @@ function normalizeNodeDeps(deps) {
 }
 
 // src/cli/recipes/loader.ts
-import * as fs19 from "fs";
-import * as path18 from "path";
+import * as fs20 from "fs";
+import * as path19 from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { parse as parse5 } from "smol-toml";
 var PLACEHOLDER_RE = /\{\{\s*([A-Za-z_][A-Za-z0-9_]*)\s*\}\}/g;
@@ -5447,12 +5643,12 @@ function bundledRecipesRoot() {
   if (override) {
     return override;
   }
-  let dir = path18.dirname(fileURLToPath3(import.meta.url));
+  let dir = path19.dirname(fileURLToPath3(import.meta.url));
   for (; ; ) {
-    if (fs19.existsSync(path18.join(dir, "package.json"))) {
-      return path18.join(dir, "recipes");
+    if (fs20.existsSync(path19.join(dir, "package.json"))) {
+      return path19.join(dir, "recipes");
     }
-    const parent = path18.dirname(dir);
+    const parent = path19.dirname(dir);
     if (parent === dir) {
       throw new Error("cannot locate the studio-cli package root");
     }
@@ -5476,24 +5672,24 @@ function defaultMode(recipe) {
 }
 function listRecipes(root) {
   const base = root ?? bundledRecipesRoot();
-  if (!fs19.existsSync(base)) {
+  if (!fs20.existsSync(base)) {
     return [];
   }
-  return fs19.readdirSync(base).filter(
-    (name) => !name.startsWith("_") && fs19.existsSync(path18.join(base, name, "recipe.toml")) && fs19.statSync(path18.join(base, name)).isDirectory()
+  return fs20.readdirSync(base).filter(
+    (name) => !name.startsWith("_") && fs20.existsSync(path19.join(base, name, "recipe.toml")) && fs20.statSync(path19.join(base, name)).isDirectory()
   ).sort();
 }
 var RecipeModeError = class extends Error {
 };
 function loadRecipe(name, opts = {}) {
   const base = opts.root ?? bundledRecipesRoot();
-  const recipeDir = path18.join(base, name);
-  const tomlPath = path18.join(recipeDir, "recipe.toml");
-  if (!fs19.existsSync(tomlPath) || !fs19.statSync(tomlPath).isFile()) {
+  const recipeDir = path19.join(base, name);
+  const tomlPath = path19.join(recipeDir, "recipe.toml");
+  if (!fs20.existsSync(tomlPath) || !fs20.statSync(tomlPath).isFile()) {
     throw new Error(`Recipe '${name}' not found at ${tomlPath}`);
   }
-  const metadata = parse5(fs19.readFileSync(tomlPath, "utf-8"));
-  const allFiles = collectTemplateFiles(path18.join(recipeDir, "code"));
+  const metadata = parse5(fs20.readFileSync(tomlPath, "utf-8"));
+  const allFiles = collectTemplateFiles(path19.join(recipeDir, "code"));
   const modesMeta = metaTable(metadata, "modes");
   const mode = opts.mode ?? null;
   if (Object.keys(modesMeta).length === 0) {
@@ -5540,22 +5736,22 @@ function modeFiles(modesMeta, modeName) {
   return Array.isArray(files) ? files.filter((f) => typeof f === "string") : [];
 }
 function collectTemplateFiles(codeDir) {
-  if (!fs19.existsSync(codeDir) || !fs19.statSync(codeDir).isDirectory()) {
+  if (!fs20.existsSync(codeDir) || !fs20.statSync(codeDir).isDirectory()) {
     return [];
   }
   const out = [];
   const walk = (dir) => {
-    for (const name of fs19.readdirSync(dir).sort()) {
-      const full = path18.join(dir, name);
-      if (fs19.statSync(full).isDirectory()) {
+    for (const name of fs20.readdirSync(dir).sort()) {
+      const full = path19.join(dir, name);
+      if (fs20.statSync(full).isDirectory()) {
         walk(full);
       } else {
-        const rel = path18.relative(codeDir, full);
+        const rel = path19.relative(codeDir, full);
         const target = rel.endsWith(".tmpl") ? rel.slice(0, -".tmpl".length) : rel;
         out.push({
           // Recipes use forward slashes regardless of host OS.
-          targetPath: target.split(path18.sep).join("/"),
-          content: fs19.readFileSync(full, "utf-8")
+          targetPath: target.split(path19.sep).join("/"),
+          content: fs20.readFileSync(full, "utf-8")
         });
       }
     }
@@ -5622,9 +5818,9 @@ function renderRecipe(recipe, opts = {}) {
 
 // src/cli/skillsInstaller.ts
 import * as crypto3 from "crypto";
-import * as fs20 from "fs";
+import * as fs21 from "fs";
 import * as os2 from "os";
-import * as path19 from "path";
+import * as path20 from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 var SUPPORTED_TARGETS = ["claude-code", "cursor"];
 var SUPPORTED_SCOPES = ["user", "project"];
@@ -5671,14 +5867,14 @@ var HIDDEN_SKILL_NAMES = /* @__PURE__ */ new Set([
 ]);
 function isDir3(p) {
   try {
-    return fs20.statSync(p).isDirectory();
+    return fs21.statSync(p).isDirectory();
   } catch {
     return false;
   }
 }
-function isFile6(p) {
+function isFile7(p) {
   try {
-    return fs20.statSync(p).isFile();
+    return fs21.statSync(p).isFile();
   } catch {
     return false;
   }
@@ -5688,15 +5884,15 @@ function sha256(text2) {
 }
 function resolveSkillsSource() {
   const pkgRoot = packageRoot2();
-  return pkgRoot !== null ? path19.join(pkgRoot, "skills") : path19.join(path19.dirname(fileURLToPath4(import.meta.url)), "skills");
+  return pkgRoot !== null ? path20.join(pkgRoot, "skills") : path20.join(path20.dirname(fileURLToPath4(import.meta.url)), "skills");
 }
 function packageRoot2() {
-  let dir = path19.dirname(fileURLToPath4(import.meta.url));
+  let dir = path20.dirname(fileURLToPath4(import.meta.url));
   for (; ; ) {
-    if (fs20.existsSync(path19.join(dir, "package.json"))) {
+    if (fs21.existsSync(path20.join(dir, "package.json"))) {
       return dir;
     }
-    const parent = path19.dirname(dir);
+    const parent = path20.dirname(dir);
     if (parent === dir) {
       return null;
     }
@@ -5708,18 +5904,18 @@ function listSourceSkills(source) {
   if (!isDir3(source)) {
     return [];
   }
-  return fs20.readdirSync(source).filter(
-    (name) => name.endsWith(".md") && !name.startsWith("_") && !HIDDEN_SKILL_NAMES.has(stem(name)) && isFile6(path19.join(source, name))
-  ).sort().map((name) => path19.join(source, name));
+  return fs21.readdirSync(source).filter(
+    (name) => name.endsWith(".md") && !name.startsWith("_") && !HIDDEN_SKILL_NAMES.has(stem(name)) && isFile7(path20.join(source, name))
+  ).sort().map((name) => path20.join(source, name));
 }
 function listSourceReferences(source) {
-  const refs = path19.join(source, "references");
+  const refs = path20.join(source, "references");
   if (!isDir3(refs)) {
     return [];
   }
-  return fs20.readdirSync(refs).filter(
-    (name) => name.endsWith(".md") && !name.startsWith("_") && !HIDDEN_SKILL_NAMES.has(stem(name)) && isFile6(path19.join(refs, name))
-  ).sort().map((name) => path19.join(refs, name));
+  return fs21.readdirSync(refs).filter(
+    (name) => name.endsWith(".md") && !name.startsWith("_") && !HIDDEN_SKILL_NAMES.has(stem(name)) && isFile7(path20.join(refs, name))
+  ).sort().map((name) => path20.join(refs, name));
 }
 function stem(fileName) {
   return fileName.replace(/\.[^.]+$/, "");
@@ -5727,15 +5923,15 @@ function stem(fileName) {
 function whichSync(name) {
   const pathEnv = process.env.PATH ?? "";
   const exts = process.platform === "win32" ? ["", ".cmd", ".exe", ".bat"] : [""];
-  for (const dir of pathEnv.split(path19.delimiter)) {
+  for (const dir of pathEnv.split(path20.delimiter)) {
     if (!dir) {
       continue;
     }
     for (const ext of exts) {
-      const candidate = path19.join(dir, name + ext);
+      const candidate = path20.join(dir, name + ext);
       try {
-        fs20.accessSync(candidate, fs20.constants.X_OK);
-        if (fs20.statSync(candidate).isFile()) {
+        fs21.accessSync(candidate, fs21.constants.X_OK);
+        if (fs21.statSync(candidate).isFile()) {
           return candidate;
         }
       } catch {
@@ -5746,14 +5942,14 @@ function whichSync(name) {
 }
 function claudeCodeInstalled(opts = {}) {
   const home = opts.home ?? os2.homedir();
-  if (isDir3(path19.join(home, ".claude"))) {
+  if (isDir3(path20.join(home, ".claude"))) {
     return true;
   }
   return (opts.which ?? whichSync)("claude") !== null;
 }
 function cursorInstalled(opts = {}) {
   const home = opts.home ?? os2.homedir();
-  if (isDir3(path19.join(home, ".cursor"))) {
+  if (isDir3(path20.join(home, ".cursor"))) {
     return true;
   }
   return (opts.which ?? whichSync)("cursor") !== null;
@@ -5776,9 +5972,9 @@ function anySkillsInstalled(opts = {}) {
   for (const target of detectTargets(opts)) {
     const tdir = resolveTargetDir({ target, scope: "user", home: opts.home });
     for (const skill of sources) {
-      const name = stem(path19.basename(skill));
-      const rel = target === "claude-code" ? path19.join(name, "SKILL.md") : `${name}.mdc`;
-      if (isFile6(path19.join(tdir, rel))) {
+      const name = stem(path20.basename(skill));
+      const rel = target === "claude-code" ? path20.join(name, "SKILL.md") : `${name}.mdc`;
+      if (isFile7(path20.join(tdir, rel))) {
         return true;
       }
     }
@@ -5803,7 +5999,7 @@ function resolveTargetDir(opts) {
   }
   const base = scope === "user" ? opts.home ?? os2.homedir() : opts.projectRoot ?? process.cwd();
   const [d1, d2] = TARGET_SUBDIR[target];
-  return path19.join(base, d1, d2);
+  return path20.join(base, d1, d2);
 }
 function splitFrontmatter(text2) {
   const lines = text2.split("\n");
@@ -5861,16 +6057,16 @@ function iterRenderedPayloads(src, target) {
   for (const skill of listSourceSkills(src)) {
     payloads.push(
       renderSkillPayload(
-        fs20.readFileSync(skill, "utf-8"),
-        stem(path19.basename(skill)),
+        fs21.readFileSync(skill, "utf-8"),
+        stem(path20.basename(skill)),
         target
       )
     );
   }
   for (const ref of listSourceReferences(src)) {
     payloads.push([
-      `${ROUTER_SKILL_NAME}/references/${path19.basename(ref)}`,
-      fs20.readFileSync(ref, "utf-8")
+      `${ROUTER_SKILL_NAME}/references/${path20.basename(ref)}`,
+      fs21.readFileSync(ref, "utf-8")
     ]);
   }
   return payloads;
@@ -5882,7 +6078,7 @@ function packageVersion() {
       return "unknown";
     }
     const pkg = JSON.parse(
-      fs20.readFileSync(path19.join(root, "package.json"), "utf-8")
+      fs21.readFileSync(path20.join(root, "package.json"), "utf-8")
     );
     return typeof pkg.version === "string" ? pkg.version : "unknown";
   } catch {
@@ -5901,11 +6097,11 @@ function contentKey(payloads) {
   return h.digest("hex");
 }
 function metaPath(tdir) {
-  return path19.join(tdir, ROUTER_SKILL_NAME, META_FILENAME);
+  return path20.join(tdir, ROUTER_SKILL_NAME, META_FILENAME);
 }
 function loadMeta(tdir) {
   try {
-    const data = JSON.parse(fs20.readFileSync(metaPath(tdir), "utf-8"));
+    const data = JSON.parse(fs21.readFileSync(metaPath(tdir), "utf-8"));
     return data !== null && typeof data === "object" && !Array.isArray(data) ? data : null;
   } catch {
     return null;
@@ -5922,15 +6118,15 @@ function writeMeta(tdir, payloads) {
     package_version: packageVersion()
   };
   const p = metaPath(tdir);
-  fs20.mkdirSync(path19.dirname(p), { recursive: true });
-  fs20.writeFileSync(p, `${JSON.stringify(meta, null, 2)}
+  fs21.mkdirSync(path20.dirname(p), { recursive: true });
+  fs21.writeFileSync(p, `${JSON.stringify(meta, null, 2)}
 `);
 }
 function installedMarker(tdir, target) {
   if (target === "cursor") {
-    return path19.join(tdir, `${ROUTER_SKILL_NAME}.mdc`);
+    return path20.join(tdir, `${ROUTER_SKILL_NAME}.mdc`);
   }
-  return path19.join(tdir, ROUTER_SKILL_NAME, "SKILL.md");
+  return path20.join(tdir, ROUTER_SKILL_NAME, "SKILL.md");
 }
 function syncInstalledSkills(opts = {}) {
   const src = opts.source ?? SKILLS_SOURCE;
@@ -5944,7 +6140,7 @@ function syncInstalledSkills(opts = {}) {
         home: opts.home,
         projectRoot: opts.projectRoot
       });
-      if (!isFile6(installedMarker(tdir, target))) {
+      if (!isFile7(installedMarker(tdir, target))) {
         continue;
       }
       if (payloads === null) {
@@ -5967,15 +6163,15 @@ function syncOneDir(tdir, payloads) {
   const wrote = [];
   const keptEdited = [];
   for (const [rel, content] of payloads) {
-    const dest = path19.join(tdir, rel);
+    const dest = path20.join(tdir, rel);
     const newHash = sha256(content);
-    const cur = isFile6(dest) ? sha256(fs20.readFileSync(dest, "utf-8")) : null;
+    const cur = isFile7(dest) ? sha256(fs21.readFileSync(dest, "utf-8")) : null;
     if (cur === newHash) {
       continue;
     }
     if (cur === null || cur === recordedFiles[rel]) {
-      fs20.mkdirSync(path19.dirname(dest), { recursive: true });
-      fs20.writeFileSync(dest, content);
+      fs21.mkdirSync(path20.dirname(dest), { recursive: true });
+      fs21.writeFileSync(dest, content);
       wrote.push(rel);
     } else {
       keptEdited.push(rel);
@@ -5986,15 +6182,15 @@ function syncOneDir(tdir, payloads) {
     if (shipped.has(rel)) {
       continue;
     }
-    const dest = path19.join(tdir, rel);
+    const dest = path20.join(tdir, rel);
     try {
-      if (isFile6(dest) && sha256(fs20.readFileSync(dest, "utf-8")) === recorded) {
-        fs20.unlinkSync(dest);
+      if (isFile7(dest) && sha256(fs21.readFileSync(dest, "utf-8")) === recorded) {
+        fs21.unlinkSync(dest);
         wrote.push(`removed ${rel}`);
-        let parent = path19.dirname(dest);
-        while (parent !== tdir && isDir3(parent) && fs20.readdirSync(parent).length === 0) {
-          fs20.rmdirSync(parent);
-          parent = path19.dirname(parent);
+        let parent = path20.dirname(dest);
+        while (parent !== tdir && isDir3(parent) && fs21.readdirSync(parent).length === 0) {
+          fs21.rmdirSync(parent);
+          parent = path20.dirname(parent);
         }
       }
     } catch {
@@ -6024,45 +6220,45 @@ function installSkills(opts) {
     projectRoot: opts.projectRoot,
     home: opts.home
   });
-  fs20.mkdirSync(tdir, { recursive: true });
+  fs21.mkdirSync(tdir, { recursive: true });
   const installed = [];
   const skipped = [];
   for (const skill of skillFiles) {
-    const skillName = stem(path19.basename(skill));
-    const srcText = fs20.readFileSync(skill, "utf-8");
+    const skillName = stem(path20.basename(skill));
+    const srcText = fs21.readFileSync(skill, "utf-8");
     const [relPath, content] = renderSkillPayload(srcText, skillName, target);
-    const dest = path19.join(tdir, relPath);
-    fs20.mkdirSync(path19.dirname(dest), { recursive: true });
-    if (isFile6(dest) && sha256(fs20.readFileSync(dest, "utf-8")) === sha256(content)) {
+    const dest = path20.join(tdir, relPath);
+    fs21.mkdirSync(path20.dirname(dest), { recursive: true });
+    if (isFile7(dest) && sha256(fs21.readFileSync(dest, "utf-8")) === sha256(content)) {
       skipped.push(skillName);
     } else {
-      fs20.writeFileSync(dest, content);
+      fs21.writeFileSync(dest, content);
       installed.push(skillName);
     }
     if (target === "claude-code") {
-      const legacyFlat = path19.join(tdir, path19.basename(skill));
-      if (isFile6(legacyFlat)) {
-        fs20.unlinkSync(legacyFlat);
+      const legacyFlat = path20.join(tdir, path20.basename(skill));
+      if (isFile7(legacyFlat)) {
+        fs21.unlinkSync(legacyFlat);
       }
     }
   }
   for (const ref of listSourceReferences(src)) {
-    const rel = `${ROUTER_SKILL_NAME}/references/${path19.basename(ref)}`;
-    const dest = path19.join(tdir, rel);
-    fs20.mkdirSync(path19.dirname(dest), { recursive: true });
-    const content = fs20.readFileSync(ref, "utf-8");
-    if (isFile6(dest) && sha256(fs20.readFileSync(dest, "utf-8")) === sha256(content)) {
+    const rel = `${ROUTER_SKILL_NAME}/references/${path20.basename(ref)}`;
+    const dest = path20.join(tdir, rel);
+    fs21.mkdirSync(path20.dirname(dest), { recursive: true });
+    const content = fs21.readFileSync(ref, "utf-8");
+    if (isFile7(dest) && sha256(fs21.readFileSync(dest, "utf-8")) === sha256(content)) {
       skipped.push(rel);
     } else {
-      fs20.writeFileSync(dest, content);
+      fs21.writeFileSync(dest, content);
       installed.push(rel);
     }
   }
-  if (isDir3(path19.join(tdir, ROUTER_SKILL_NAME))) {
+  if (isDir3(path20.join(tdir, ROUTER_SKILL_NAME))) {
     writeMeta(tdir, iterRenderedPayloads(src, target));
   }
-  const legacy = target === "claude-code" ? LEGACY_SKILL_NAMES.filter((name) => isDir3(path19.join(tdir, name))) : LEGACY_SKILL_NAMES.filter(
-    (name) => isFile6(path19.join(tdir, `${name}.mdc`))
+  const legacy = target === "claude-code" ? LEGACY_SKILL_NAMES.filter((name) => isDir3(path20.join(tdir, name))) : LEGACY_SKILL_NAMES.filter(
+    (name) => isFile7(path20.join(tdir, `${name}.mdc`))
   );
   return {
     target,
@@ -6088,9 +6284,9 @@ function acceptChoices(option, accepted, advertised) {
 }
 
 // src/cli/wallet.ts
-import * as fs22 from "fs";
+import * as fs23 from "fs";
 import * as os3 from "os";
-import * as path21 from "path";
+import * as path22 from "path";
 import { EVMWalletProvider, SigningPolicy } from "@bnbagent/sdk";
 import {
   envLocalPath as envLocalPath10,
@@ -6100,14 +6296,16 @@ import {
 import { buildPolicy, buildWallet } from "@bnbagent/studio-runtime/wallet";
 
 // src/cli/walletSession.ts
-import * as fs21 from "fs";
-import * as path20 from "path";
+import * as fs22 from "fs";
+import * as path21 from "path";
+import { pathToFileURL } from "url";
 import { AltanaWalletProvider } from "@bnbagent/sdk";
 import { getAddress as deployedAddresses } from "@bnbagent/sdk/networks";
 import {
   defaultAgentPermissions,
   deserializeSession,
-  serializeSession
+  serializeSession,
+  setAltanaSdkImporter
 } from "@bnbagent/sdk/wallets";
 import { auditedOp as auditedOp2 } from "@bnbagent/studio-runtime/audit";
 import { loadStudioToml as loadStudioToml9 } from "@bnbagent/studio-runtime/config";
@@ -6115,7 +6313,8 @@ import { getNetwork as getNetwork5, toRaw as toRaw2 } from "@bnbagent/studio-run
 import { writePrivate } from "@bnbagent/studio-runtime/secretWrite";
 import {
   ALTANA_NETWORK_BY_STUDIO,
-  PASSWORD_ENV
+  PASSWORD_ENV,
+  resolveProjectAltanaSdkEntry as resolveProjectAltanaSdkEntry2
 } from "@bnbagent/studio-runtime/wallet";
 var defaultAdminFactory = (opts) => AltanaWalletProvider.adminFromKeystore(opts);
 var adminFactory = defaultAdminFactory;
@@ -6124,13 +6323,17 @@ function tableOf7(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
 function loadContext(projectRoot) {
-  const cfg = loadStudioToml9(path20.join(projectRoot, "studio.toml"));
+  const cfg = loadStudioToml9(path21.join(projectRoot, "studio.toml"));
   const walletCfg = tableOf7(cfg.wallet);
   if (String(walletCfg.kind ?? "evm-local") !== "altana") {
     throw new Error(
       `wallet session commands require [wallet].kind='altana' (got ${JSON.stringify(walletCfg.kind ?? "evm-local")}).`
     );
   }
+  const sdkEntry = resolveProjectAltanaSdkEntry2(projectRoot);
+  setAltanaSdkImporter(
+    sdkEntry === null ? null : () => import(pathToFileURL(sdkEntry).href)
+  );
   const networkName = String(tableOf7(cfg.network).default ?? "bsc-testnet");
   const altanaNetwork = ALTANA_NETWORK_BY_STUDIO[networkName];
   if (altanaNetwork === void 0) {
@@ -6146,7 +6349,7 @@ function loadContext(projectRoot) {
   }
   const resolvePath = (value, fallback) => {
     const configured = String(value ?? fallback);
-    return path20.isAbsolute(configured) ? configured : path20.join(projectRoot, configured);
+    return path21.isAbsolute(configured) ? configured : path21.join(projectRoot, configured);
   };
   return {
     projectRoot,
@@ -6210,7 +6413,7 @@ function parseSessionEnvelope(serialized) {
 function readSession(ctx) {
   let serialized;
   try {
-    serialized = fs21.readFileSync(ctx.sessionFile, "utf8");
+    serialized = fs22.readFileSync(ctx.sessionFile, "utf8");
   } catch {
     throw new Error(
       `no Altana session file at ${ctx.sessionFile} \u2014 run \`bag wallet session grant\`.`
@@ -6219,8 +6422,8 @@ function readSession(ctx) {
   return { serialized, envelope: parseSessionEnvelope(serialized) };
 }
 function writeSession(ctx, session) {
-  fs21.mkdirSync(path20.dirname(ctx.sessionFile), { recursive: true, mode: 448 });
-  fs21.chmodSync(path20.dirname(ctx.sessionFile), 448);
+  fs22.mkdirSync(path21.dirname(ctx.sessionFile), { recursive: true, mode: 448 });
+  fs22.chmodSync(path21.dirname(ctx.sessionFile), 448);
   writePrivate(ctx.sessionFile, serializeSession(session));
 }
 function sessionKeyFingerprint(publicKey) {
@@ -6331,7 +6534,7 @@ async function cmdSessionGrant(opts) {
     "--budget-u"
   );
   let existing = null;
-  if (fs21.existsSync(ctx.sessionFile)) {
+  if (fs22.existsSync(ctx.sessionFile)) {
     existing = readSession(ctx).envelope;
     if (!opts.force) {
       throw new Error(
@@ -6449,7 +6652,7 @@ async function cmdSessionRevoke(opts) {
       await admin.revokeSession(envelope.publicKey);
     }
   );
-  fs21.unlinkSync(ctx.sessionFile);
+  fs22.unlinkSync(ctx.sessionFile);
   printErr(`\u2713 Altana session revoked and removed: ${ctx.sessionFile}`);
   return 0;
 }
@@ -6573,8 +6776,8 @@ var ProjectRootNotFound = class extends Error {
 };
 function resolveWalletProjectRoot(argRoot) {
   if (argRoot != null) {
-    const root2 = path21.resolve(argRoot);
-    if (!isFile7(path21.join(root2, "studio.toml"))) {
+    const root2 = path22.resolve(argRoot);
+    if (!isFile8(path22.join(root2, "studio.toml"))) {
       throw new ProjectRootNotFound(
         `No studio.toml found under --project-root ${root2}`
       );
@@ -6589,15 +6792,15 @@ function resolveWalletProjectRoot(argRoot) {
   }
   return root;
 }
-function isFile7(p) {
+function isFile8(p) {
   try {
-    return fs22.statSync(p).isFile();
+    return fs23.statSync(p).isFile();
   } catch {
     return false;
   }
 }
 function loadWalletCfg(projectRoot) {
-  const data = loadStudioToml10(path21.join(projectRoot, "studio.toml"));
+  const data = loadStudioToml10(path22.join(projectRoot, "studio.toml"));
   const wallet = data.wallet;
   return wallet !== null && typeof wallet === "object" && !Array.isArray(wallet) ? wallet : {};
 }
@@ -6607,7 +6810,7 @@ function walletKind(walletCfg) {
 function projectNetwork(projectRoot) {
   let data;
   try {
-    data = loadStudioToml10(path21.join(projectRoot, "studio.toml"));
+    data = loadStudioToml10(path22.join(projectRoot, "studio.toml"));
   } catch {
     return "bsc-testnet";
   }
@@ -6646,12 +6849,12 @@ function requireDurablePassword(projectRoot) {
   return password;
 }
 function persistAddress(projectRoot, address) {
-  const tomlPath = path21.join(projectRoot, "studio.toml");
-  if (!isFile7(tomlPath)) {
+  const tomlPath = path22.join(projectRoot, "studio.toml");
+  if (!isFile8(tomlPath)) {
     return;
   }
-  const text2 = fs22.readFileSync(tomlPath, "utf-8");
-  fs22.writeFileSync(
+  const text2 = fs23.readFileSync(tomlPath, "utf-8");
+  fs23.writeFileSync(
     tomlPath,
     updateSection(text2, "wallet", { address }),
     "utf-8"
@@ -6667,7 +6870,7 @@ function resolveKeystoreDir2(projectRoot, cliOverride, walletCfg) {
   } else {
     d = ".studio/wallets";
   }
-  return path21.isAbsolute(d) ? d : path21.join(projectRoot, d);
+  return path22.isAbsolute(d) ? d : path22.join(projectRoot, d);
 }
 async function resolvePrivateKeyArg(raw) {
   if (raw === void 0 || raw === false) {
@@ -6782,7 +6985,7 @@ async function cmdNew(opts) {
     projectRoot = process.cwd();
   }
   let walletCfg = {};
-  if (isFile7(path21.join(projectRoot, "studio.toml"))) {
+  if (isFile8(path22.join(projectRoot, "studio.toml"))) {
     walletCfg = loadWalletCfg(projectRoot);
   }
   const kind = walletKind(walletCfg);
@@ -6796,7 +6999,7 @@ async function cmdNew(opts) {
     opts.keystoreDir,
     walletCfg
   );
-  fs22.mkdirSync(keystoreDir, { recursive: true });
+  fs23.mkdirSync(keystoreDir, { recursive: true });
   const provider = new EVMWalletProvider({
     password,
     ...privateKey !== null ? { privateKey } : {},
@@ -6806,7 +7009,7 @@ async function cmdNew(opts) {
   persistAddress(projectRoot, provider.address);
   if (kind === "altana") {
     printErr(
-      "Altana admin keystore created. Fund this address with about 0.6 tBNB for testnet bootstrap/registration, then run `bag wallet session grant` to create the bounded runtime session."
+      "Altana admin keystore created. Fund this address with about 0.05 tBNB for testnet bootstrap/registration, then run `bag wallet session grant` to create the bounded runtime session."
     );
   }
   return 0;
@@ -6820,11 +7023,11 @@ Install it (Node >=22):  npm install -g @trustwallet/cli@${TWAK_CLI_VERSION}`
     return 1;
   }
   const walletFile = twakWalletFile(walletCfg, projectRoot);
-  if (!isFile7(walletFile)) {
+  if (!isFile8(walletFile)) {
     let createCmd = "twak wallet create --password <your-password> --no-keychain";
     let setupCmd = "twak setup";
     if (walletCfg.twak_home) {
-      const home = path21.dirname(path21.dirname(walletFile));
+      const home = path22.dirname(path22.dirname(walletFile));
       createCmd = `HOME=${home} ${createCmd}`;
       setupCmd = `HOME=${home} ${setupCmd}`;
     }
@@ -6850,23 +7053,23 @@ Install it (Node >=22):  npm install -g @trustwallet/cli@${TWAK_CLI_VERSION}`
   return 0;
 }
 function ensureTwakCredentials(walletFile, homeDir) {
-  const twakDir = path21.dirname(walletFile);
-  const target = path21.join(twakDir, "credentials.json");
-  if (isFile7(target)) {
+  const twakDir = path22.dirname(walletFile);
+  const target = path22.join(twakDir, "credentials.json");
+  if (isFile8(target)) {
     return true;
   }
-  const machine = path21.join(os3.homedir(), ".twak", "credentials.json");
-  if (path21.resolve(machine) === path21.resolve(target) || !isFile7(machine)) {
+  const machine = path22.join(os3.homedir(), ".twak", "credentials.json");
+  if (path22.resolve(machine) === path22.resolve(target) || !isFile8(machine)) {
     printErr(
       `error: no Trust Wallet NaaS credentials for this wallet home \u2014 ${target} is missing. Get an Access ID + HMAC secret from https://portal.trustwallet.com/dashboard/apps, run \`HOME=${homeDir} twak setup\` once, then re-run this command.`
     );
     return false;
   }
-  fs22.mkdirSync(twakDir, { recursive: true });
-  fs22.writeFileSync(target, fs22.readFileSync(machine, "utf-8"), { mode: 384 });
+  fs23.mkdirSync(twakDir, { recursive: true });
+  fs23.writeFileSync(target, fs23.readFileSync(machine, "utf-8"), { mode: 384 });
   try {
-    fs22.chmodSync(twakDir, 448);
-    fs22.chmodSync(target, 384);
+    fs23.chmodSync(twakDir, 448);
+    fs23.chmodSync(target, 384);
   } catch {
   }
   printErr(`note: copied NaaS credentials from ${machine} into ${twakDir}.`);
@@ -6878,10 +7081,10 @@ async function resolveTwakInitPassword(opts) {
     throw new CliExit(2);
   }
   if (opts.passwordFile) {
-    const file = path21.resolve(opts.passwordFile);
+    const file = path22.resolve(opts.passwordFile);
     let mode;
     try {
-      mode = fs22.statSync(file).mode;
+      mode = fs23.statSync(file).mode;
     } catch {
       printErr(`error: cannot read --password-file ${file}.`);
       throw new CliExit(2);
@@ -6892,7 +7095,7 @@ async function resolveTwakInitPassword(opts) {
       );
       throw new CliExit(2);
     }
-    const password = (fs22.readFileSync(file, "utf-8").split(/\r?\n/)[0] ?? "").trim();
+    const password = (fs23.readFileSync(file, "utf-8").split(/\r?\n/)[0] ?? "").trim();
     if (!password) {
       printErr(`error: --password-file ${file} is empty.`);
       throw new CliExit(2);
@@ -6945,15 +7148,15 @@ Install it (Node >=22):  npm install -g @trustwallet/cli@${TWAK_CLI_VERSION}`
     return 1;
   }
   const walletFile = twakWalletFile(walletCfg, projectRoot);
-  if (isFile7(walletFile)) {
+  if (isFile8(walletFile)) {
     printErr(
       `error: a twak wallet already exists at ${walletFile} \u2014 nothing to create. Run \`bag wallet new\` to adopt its address into studio.toml.`
     );
     return 1;
   }
   const password = await resolveTwakInitPassword(opts);
-  const homeDir = path21.dirname(path21.dirname(walletFile));
-  fs22.mkdirSync(homeDir, { recursive: true });
+  const homeDir = path22.dirname(path22.dirname(walletFile));
+  fs23.mkdirSync(homeDir, { recursive: true });
   if (!ensureTwakCredentials(walletFile, homeDir)) {
     return 1;
   }
@@ -6975,7 +7178,7 @@ ${password}
       timeoutMs: 12e4
     }
   );
-  if (create.code !== 0 || !isFile7(walletFile)) {
+  if (create.code !== 0 || !isFile8(walletFile)) {
     const detail = `${create.stderr}
 ${create.stdout}`.trim();
     printErr(
@@ -6990,14 +7193,14 @@ ${detail}` : `error: \`twak wallet create --no-keychain\` did not produce ${wall
     return 1;
   }
   try {
-    fs22.chmodSync(walletFile, 384);
+    fs23.chmodSync(walletFile, 384);
   } catch {
   }
   if (!process.env.TWAK_WALLET_PASSWORD) {
     process.env.TWAK_WALLET_PASSWORD = password;
   }
   printErr(
-    `\u2713 twak wallet created under ${path21.dirname(walletFile)} (no keychain)`
+    `\u2713 twak wallet created under ${path22.dirname(walletFile)} (no keychain)`
   );
   printErr(
     "next: persist TWAK_WALLET_PASSWORD in .studio/.env.local so deploys and non-interactive signing can unlock it."
@@ -7034,7 +7237,7 @@ function cmdShow5(projectRootArg) {
     ...walletCfg.address ? { address: String(walletCfg.address) } : {}
   });
   const address = provider.address;
-  const keystorePath = path21.join(keystoreDir, `${address}.json`);
+  const keystorePath = path22.join(keystoreDir, `${address}.json`);
   printOut(`address:       ${address}`);
   printOut(`source:        ${kind}`);
   printOut(`keystore_dir:  ${keystoreDir}`);
@@ -7043,14 +7246,14 @@ function cmdShow5(projectRootArg) {
     const configured = String(
       walletCfg.session_file ?? ".studio/wallets/altana-session.json"
     );
-    const sessionFile = path21.isAbsolute(configured) ? configured : path21.join(projectRoot, configured);
+    const sessionFile = path22.isAbsolute(configured) ? configured : path22.join(projectRoot, configured);
     printOut(`session_file:  ${sessionFile}`);
-    if (!isFile7(sessionFile)) {
+    if (!isFile8(sessionFile)) {
       printOut("session_status: missing (run `bag wallet session grant`)");
     } else {
       let envelope;
       try {
-        envelope = JSON.parse(fs22.readFileSync(sessionFile, "utf8"));
+        envelope = JSON.parse(fs23.readFileSync(sessionFile, "utf8"));
       } catch {
         throw new Error(`invalid Altana session JSON at ${sessionFile}`);
       }
@@ -7076,7 +7279,7 @@ function cmdList2(projectRootArg) {
   const keystoreDir = resolveKeystoreDir2(projectRoot, null, walletCfg);
   let entries;
   try {
-    entries = fs22.readdirSync(keystoreDir).sort();
+    entries = fs23.readdirSync(keystoreDir).sort();
   } catch {
     return 0;
   }
@@ -7088,7 +7291,7 @@ function cmdList2(projectRootArg) {
     let data;
     try {
       data = JSON.parse(
-        fs22.readFileSync(path21.join(keystoreDir, child), "utf-8")
+        fs23.readFileSync(path22.join(keystoreDir, child), "utf-8")
       );
     } catch {
       continue;
@@ -7139,7 +7342,7 @@ async function cmdSign(msg, projectRootArg) {
 }
 async function cmdBalance(opts) {
   const projectRoot = resolveWalletProjectRoot(opts.projectRoot);
-  const data = loadStudioToml10(path21.join(projectRoot, "studio.toml"));
+  const data = loadStudioToml10(path22.join(projectRoot, "studio.toml"));
   const walletCfg = data.wallet !== null && typeof data.wallet === "object" ? data.wallet : {};
   let address;
   const kind = walletKind(walletCfg);
@@ -7266,10 +7469,10 @@ var PROVIDER_KEY_ENV = {
   "pieverse-llm": "PIEVERSE_LLM_API_KEY"
 };
 function renderAgentcoreProject(target, name) {
-  const acDir = path22.join(target, "agentcore");
-  fs23.mkdirSync(acDir, { recursive: true });
-  fs23.writeFileSync(
-    path22.join(acDir, "agentcore.json"),
+  const acDir = path23.join(target, "agentcore");
+  fs24.mkdirSync(acDir, { recursive: true });
+  fs24.writeFileSync(
+    path23.join(acDir, "agentcore.json"),
     `${JSON.stringify(
       {
         $schema: "https://schema.agentcore.aws.dev/v1/agentcore.json",
@@ -7283,7 +7486,7 @@ function renderAgentcoreProject(target, name) {
     )}
 `
   );
-  fs23.writeFileSync(path22.join(acDir, "aws-targets.json"), "[]\n");
+  fs24.writeFileSync(path23.join(acDir, "aws-targets.json"), "[]\n");
 }
 var AGENTS_MD_MARKER = "# bnbagent-studio additions (ERC-8183 seller)";
 var AGENTS_MD_STUDIO_SECTION = `
@@ -7327,30 +7530,30 @@ every intent to the right playbook via its references.
    and state the tradeoff.
 `;
 function appendAgentsMdStudioSection(target) {
-  const agentsMd = path22.join(target, "AGENTS.md");
+  const agentsMd = path23.join(target, "AGENTS.md");
   let existing = "";
   try {
-    existing = fs23.readFileSync(agentsMd, "utf-8");
+    existing = fs24.readFileSync(agentsMd, "utf-8");
   } catch {
     existing = "";
   }
   if (existing.includes(AGENTS_MD_MARKER)) {
     return;
   }
-  fs23.writeFileSync(
+  fs24.writeFileSync(
     agentsMd,
     `${existing.replace(/\n+$/, "")}
 ${AGENTS_MD_STUDIO_SECTION}`
   );
 }
 function seedAwsTargets(target) {
-  const p = path22.join(target, "agentcore", "aws-targets.json");
-  if (!isFile8(p)) {
+  const p = path23.join(target, "agentcore", "aws-targets.json");
+  if (!isFile9(p)) {
     return;
   }
   let data;
   try {
-    data = JSON.parse(fs23.readFileSync(p, "utf-8"));
+    data = JSON.parse(fs24.readFileSync(p, "utf-8"));
   } catch {
     return;
   }
@@ -7361,7 +7564,7 @@ function seedAwsTargets(target) {
     { name: "default", account: AWS_ACCOUNT_PLACEHOLDER, region: "us-east-1" }
   ];
   try {
-    fs23.writeFileSync(p, `${JSON.stringify(skeleton, null, 2)}
+    fs24.writeFileSync(p, `${JSON.stringify(skeleton, null, 2)}
 `);
   } catch {
     return;
@@ -7384,13 +7587,13 @@ function registerAgentcoreRuntime(target, name, opts = {}) {
   const protocol = nativeProtocolOf(faces);
   const stem2 = entryStemOf(faces);
   const isContainer = opts.packaging === "container" || walletKind2 === "twak";
-  const cfgPath = path22.join(target, "agentcore", "agentcore.json");
-  if (!isFile8(cfgPath)) {
+  const cfgPath = path23.join(target, "agentcore", "agentcore.json");
+  if (!isFile9(cfgPath)) {
     return;
   }
   let cfg;
   try {
-    const parsed = JSON.parse(fs23.readFileSync(cfgPath, "utf-8"));
+    const parsed = JSON.parse(fs24.readFileSync(cfgPath, "utf-8"));
     if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
       return;
     }
@@ -7429,7 +7632,7 @@ function registerAgentcoreRuntime(target, name, opts = {}) {
   runtimes.push(runtime);
   cfg.runtimes = runtimes;
   try {
-    fs23.writeFileSync(cfgPath, `${JSON.stringify(cfg, null, 2)}
+    fs24.writeFileSync(cfgPath, `${JSON.stringify(cfg, null, 2)}
 `);
   } catch {
     return;
@@ -7566,12 +7769,12 @@ function registerInit(program) {
   );
 }
 function enclosingProjectRoot(start) {
-  let current = path22.resolve(start);
+  let current = path23.resolve(start);
   for (; ; ) {
-    if (isFile8(path22.join(current, APP_DIR, AGENT_PKG, "studio.toml"))) {
+    if (isFile9(path23.join(current, APP_DIR, AGENT_PKG, "studio.toml"))) {
       return current;
     }
-    const parent = path22.dirname(current);
+    const parent = path23.dirname(current);
     if (parent === current) {
       return null;
     }
@@ -7579,8 +7782,8 @@ function enclosingProjectRoot(start) {
   }
 }
 async function cmdInit(nameArg, opts) {
-  const target = path22.resolve(process.cwd(), nameArg);
-  let projectName2 = path22.basename(target);
+  const target = path23.resolve(process.cwd(), nameArg);
+  let projectName2 = path23.basename(target);
   if (!projectName2) {
     printErr(
       `error: cannot derive a project name from '${nameArg}' (path has no basename).`
@@ -7665,15 +7868,15 @@ async function cmdInit(nameArg, opts) {
       return 2;
     }
   }
-  const enclosing = enclosingProjectRoot(path22.dirname(target));
+  const enclosing = enclosingProjectRoot(path23.dirname(target));
   if (enclosing !== null) {
     printErr(
-      `error: ${path22.dirname(target)} is inside an existing bag project (${enclosing}).
-\`bag init\` resolves the new project relative to the current directory, so running it here would nest a second scaffold inside ${path22.basename(enclosing)}/. cd to a directory OUTSIDE any project and retry.`
+      `error: ${path23.dirname(target)} is inside an existing bag project (${enclosing}).
+\`bag init\` resolves the new project relative to the current directory, so running it here would nest a second scaffold inside ${path23.basename(enclosing)}/. cd to a directory OUTSIDE any project and retry.`
     );
     return 2;
   }
-  if (fs23.existsSync(target) && !opts.force) {
+  if (fs24.existsSync(target) && !opts.force) {
     printErr(`error: ${target} already exists. Use --force to overwrite.`);
     return 2;
   }
@@ -7692,20 +7895,14 @@ async function cmdInit(nameArg, opts) {
     destination = "self";
     runtime = "agentcore";
   }
-  if (destination === "platform" && walletKind2 === "altana") {
-    printErr(
-      "error: Altana (wallet.kind='altana') is not supported by the managed platform; the runtime needs a bounded local session, never the admin key. Use --destination self."
-    );
-    return 2;
-  }
   if (destination === "self" && runtime === "azure-foundry" && (!hasA2aFace(faces) || hasMcpFace(faces))) {
     printErr(
       "error: azure-foundry supports protocol A2A only as its native face (X402 is optional) and does not support an MCP face. Foundry is delegated through its invocations container contract (:8088, /readiness, /invocations), not the native MCP /mcp transport. Use --protocols A2A (optionally with X402), or use --runtime agentcore for MCP."
     );
     return 2;
   }
-  if (fs23.existsSync(target)) {
-    fs23.rmSync(target, { recursive: true, force: true });
+  if (fs24.existsSync(target)) {
+    fs24.rmSync(target, { recursive: true, force: true });
   }
   if (destination === "platform") {
     printCampaignIntro();
@@ -7750,7 +7947,7 @@ async function cmdInit(nameArg, opts) {
     }
   }
   try {
-    fs23.mkdirSync(target, { recursive: true });
+    fs24.mkdirSync(target, { recursive: true });
     if (runtime === "agentcore") {
       renderAgentcoreProject(target, projectName2);
     }
@@ -7766,7 +7963,7 @@ async function cmdInit(nameArg, opts) {
     printErr(
       `error: the b402 seller rail supports wallet.kind evm-local or twak only; '${walletKind2}' cannot act as the b402 payout wallet. Re-run with --rails 8183 or a supported --wallet-kind.`
     );
-    fs23.rmSync(target, { recursive: true, force: true });
+    fs24.rmSync(target, { recursive: true, force: true });
     return 2;
   }
   const ides = resolveEmitIdes(opts.ide);
@@ -7809,9 +8006,9 @@ async function cmdInit(nameArg, opts) {
     });
     seedAwsTargets(target);
   }
-  const agentDir = path22.join(target, APP_DIR, AGENT_PKG);
-  fs23.mkdirSync(path22.join(agentDir, "vendor"), { recursive: true });
-  fs23.writeFileSync(path22.join(agentDir, "vendor", ".gitkeep"), "");
+  const agentDir = path23.join(target, APP_DIR, AGENT_PKG);
+  fs24.mkdirSync(path23.join(agentDir, "vendor"), { recursive: true });
+  fs24.writeFileSync(path23.join(agentDir, "vendor", ".gitkeep"), "");
   const skipInstall = opts.install === false || opts.venv === false;
   let provisioned = false;
   let installFailed = false;
@@ -7940,64 +8137,64 @@ function derivePackaging(walletKind2, destination, platformArtifact2 = "zip", ru
 }
 function scaffold(target, name, o) {
   const packageManagerVersion = pnpmVersion();
-  fs23.writeFileSync(
-    path22.join(target, "package.json"),
+  fs24.writeFileSync(
+    path23.join(target, "package.json"),
     renderWorkspacePackageJson(name, packageManagerVersion)
   );
-  fs23.writeFileSync(
-    path22.join(target, "pnpm-workspace.yaml"),
+  fs24.writeFileSync(
+    path23.join(target, "pnpm-workspace.yaml"),
     renderPnpmWorkspaceYaml()
   );
-  fs23.writeFileSync(path22.join(target, ".gitignore"), renderWorkspaceGitignore());
-  if (!isFile8(path22.join(target, "README.md"))) {
-    fs23.writeFileSync(
-      path22.join(target, "README.md"),
+  fs24.writeFileSync(path23.join(target, ".gitignore"), renderWorkspaceGitignore());
+  if (!isFile9(path23.join(target, "README.md"))) {
+    fs24.writeFileSync(
+      path23.join(target, "README.md"),
       renderWorkspaceReadme(name, o.destination)
     );
   }
   appendAgentsMdStudioSection(target);
-  const appRoot = path22.join(target, APP_DIR);
-  fs23.mkdirSync(appRoot, { recursive: true });
-  const agentRoot2 = path22.join(appRoot, AGENT_PKG);
-  fs23.mkdirSync(agentRoot2, { recursive: true });
-  fs23.writeFileSync(
-    path22.join(agentRoot2, "pnpm-workspace.yaml"),
+  const appRoot = path23.join(target, APP_DIR);
+  fs24.mkdirSync(appRoot, { recursive: true });
+  const agentRoot2 = path23.join(appRoot, AGENT_PKG);
+  fs24.mkdirSync(agentRoot2, { recursive: true });
+  fs24.writeFileSync(
+    path23.join(agentRoot2, "pnpm-workspace.yaml"),
     renderAgentPnpmWorkspaceYaml()
   );
   if (o.walletKind === "evm-local" || o.walletKind === "altana") {
-    fs23.mkdirSync(path22.join(target, ".studio", "wallets"), { recursive: true });
+    fs24.mkdirSync(path23.join(target, ".studio", "wallets"), { recursive: true });
   } else if (o.walletKind === "twak") {
     let homeDir;
     let label;
     if (o.twakHome === void 0 || o.twakHome === DEDICATED_TWAK_HOME_REL) {
-      homeDir = path22.join(target, ".studio", "twak");
+      homeDir = path23.join(target, ".studio", "twak");
       label = ".studio/twak";
     } else {
-      homeDir = path22.isAbsolute(o.twakHome) ? o.twakHome : path22.resolve(agentRoot2, o.twakHome);
+      homeDir = path23.isAbsolute(o.twakHome) ? o.twakHome : path23.resolve(agentRoot2, o.twakHome);
       label = o.twakHome;
     }
-    fs23.mkdirSync(homeDir, { recursive: true });
+    fs24.mkdirSync(homeDir, { recursive: true });
     if (ensureTwakKeychain(homeDir)) {
       printOut(
         `\u2713 isolated twak keychain ready under ${label} (macOS) \u2014 no manual \`security\` setup needed`
       );
     }
   }
-  fs23.writeFileSync(
-    path22.join(agentRoot2, "package.json"),
+  fs24.writeFileSync(
+    path23.join(agentRoot2, "package.json"),
     renderAgentPackageJson(name, o.runtime, o.provider, o.faces, o.walletKind)
   );
-  fs23.writeFileSync(
-    path22.join(agentRoot2, "tsconfig.json"),
+  fs24.writeFileSync(
+    path23.join(agentRoot2, "tsconfig.json"),
     renderAgentTsconfig()
   );
-  fs23.writeFileSync(
-    path22.join(agentRoot2, "studio.toml"),
+  fs24.writeFileSync(
+    path23.join(agentRoot2, "studio.toml"),
     renderAgentStudioToml(name, o)
   );
-  const envLocal = path22.join(target, ".studio", ".env.local");
-  fs23.mkdirSync(path22.dirname(envLocal), { recursive: true });
-  fs23.writeFileSync(
+  const envLocal = path23.join(target, ".studio", ".env.local");
+  fs24.mkdirSync(path23.dirname(envLocal), { recursive: true });
+  fs24.writeFileSync(
     envLocal,
     renderAgentEnvLocal(
       o.provider,
@@ -8008,9 +8205,9 @@ function scaffold(target, name, o) {
       o.network
     )
   );
-  fs23.writeFileSync(path22.join(agentRoot2, ".gitignore"), renderAgentGitignore());
-  fs23.writeFileSync(
-    path22.join(agentRoot2, "README.md"),
+  fs24.writeFileSync(path23.join(agentRoot2, ".gitignore"), renderAgentGitignore());
+  fs24.writeFileSync(
+    path23.join(agentRoot2, "README.md"),
     renderAgentReadme(name, o.faces, o.destination)
   );
   const packaging = derivePackaging(
@@ -8046,18 +8243,18 @@ function emitRecipe(base, name, opts = {}) {
   const recipe = loadRecipe(name, { mode: opts.mode ?? null });
   for (const rf of recipe.files) {
     const targetPath = substitutePlaceholders(rf.targetPath, opts.context);
-    const basename16 = path22.posix.basename(targetPath);
-    const dst = basename16 === "Dockerfile" || basename16 === ".dockerignore" ? path22.join(base, basename16) : path22.join(base, targetPath);
-    fs23.mkdirSync(path22.dirname(dst), { recursive: true });
-    fs23.writeFileSync(dst, substitutePlaceholders(rf.content, opts.context));
+    const basename16 = path23.posix.basename(targetPath);
+    const dst = basename16 === "Dockerfile" || basename16 === ".dockerignore" ? path23.join(base, basename16) : path23.join(base, targetPath);
+    fs24.mkdirSync(path23.dirname(dst), { recursive: true });
+    fs24.writeFileSync(dst, substitutePlaceholders(rf.content, opts.context));
   }
 }
 function readRecipeNodeDeps(recipeName, group) {
-  const tomlPath = path22.join(bundledRecipesRoot(), recipeName, "recipe.toml");
-  if (!isFile8(tomlPath)) {
+  const tomlPath = path23.join(bundledRecipesRoot(), recipeName, "recipe.toml");
+  if (!isFile9(tomlPath)) {
     return [];
   }
-  const meta = parseToml(fs23.readFileSync(tomlPath, "utf-8"));
+  const meta = parseToml(fs24.readFileSync(tomlPath, "utf-8"));
   const depsSection = meta.dependencies !== null && typeof meta.dependencies === "object" ? meta.dependencies : {};
   const collect = (v) => Array.isArray(v) ? v.filter((d) => typeof d === "string") : [];
   const deps = collect(depsSection.node);
@@ -8642,7 +8839,7 @@ bag deploy --provider aws
 `;
 }
 function emitProviderSkills(target, provider, ides) {
-  const skillDir = path22.join(
+  const skillDir = path23.join(
     bundledRecipesRoot(),
     "providers",
     provider,
@@ -8652,34 +8849,34 @@ function emitProviderSkills(target, provider, ides) {
     return;
   }
   let emittedCursor = false;
-  for (const md of fs23.readdirSync(skillDir).filter((n) => n.endsWith(".md")).sort()) {
-    const srcText = fs23.readFileSync(path22.join(skillDir, md), "utf-8");
+  for (const md of fs24.readdirSync(skillDir).filter((n) => n.endsWith(".md")).sort()) {
+    const srcText = fs24.readFileSync(path23.join(skillDir, md), "utf-8");
     const stem2 = md.replace(/\.md$/, "");
     for (const ide of ides) {
       const [relPath, content] = renderSkillPayload(srcText, stem2, ide);
-      const base = ide === "claude-code" ? path22.join(target, ".claude", "skills") : path22.join(target, ".cursor", "rules");
-      const dst = path22.join(base, relPath);
-      fs23.mkdirSync(path22.dirname(dst), { recursive: true });
-      fs23.writeFileSync(dst, content);
+      const base = ide === "claude-code" ? path23.join(target, ".claude", "skills") : path23.join(target, ".cursor", "rules");
+      const dst = path23.join(base, relPath);
+      fs24.mkdirSync(path23.dirname(dst), { recursive: true });
+      fs24.writeFileSync(dst, content);
       if (ide === "cursor") {
         emittedCursor = true;
       }
     }
   }
   if (emittedCursor) {
-    ensureCursorGitignore(path22.join(target, ".gitignore"));
+    ensureCursorGitignore(path23.join(target, ".gitignore"));
   }
 }
 function ensureCursorGitignore(gitignore) {
-  if (!isFile8(gitignore)) {
+  if (!isFile9(gitignore)) {
     return;
   }
-  const text2 = fs23.readFileSync(gitignore, "utf-8");
+  const text2 = fs24.readFileSync(gitignore, "utf-8");
   if (text2.includes(".cursor/rules/")) {
     return;
   }
   const addition = "\n# Cursor rules emitted at init (regeneratable via `bag skills install --target cursor`).\n.cursor/rules/\n";
-  fs23.writeFileSync(gitignore, `${text2.replace(/\n+$/, "")}
+  fs24.writeFileSync(gitignore, `${text2.replace(/\n+$/, "")}
 ${addition}`);
 }
 async function resolveWalletKind(flagValue, isTty) {
@@ -8857,11 +9054,11 @@ async function promptPassword() {
   return first;
 }
 function readWalletAddress(studioToml) {
-  if (!isFile8(studioToml)) {
+  if (!isFile9(studioToml)) {
     return null;
   }
   try {
-    const data = parseToml(fs23.readFileSync(studioToml, "utf-8"));
+    const data = parseToml(fs24.readFileSync(studioToml, "utf-8"));
     const wallet = data.wallet;
     if (wallet !== null && typeof wallet === "object") {
       const addr = wallet.address;
@@ -8964,7 +9161,7 @@ async function runOnboarding(o) {
   if (password === null) {
     return false;
   }
-  const agentRoot2 = path22.join(o.workspaceRoot, APP_DIR, AGENT_PKG);
+  const agentRoot2 = path23.join(o.workspaceRoot, APP_DIR, AGENT_PKG);
   const { envLocalPath: envLocalPath19 } = await import("@bnbagent/studio-runtime/config");
   setEnvVar(envLocalPath19(agentRoot2), "WALLET_PASSWORD", password);
   const savedCwd = process.cwd();
@@ -8992,7 +9189,7 @@ async function runOnboarding(o) {
       );
       return false;
     }
-    address = readWalletAddress(path22.join(agentRoot2, "studio.toml"));
+    address = readWalletAddress(path23.join(agentRoot2, "studio.toml"));
     if (o.walletKind !== "altana" || o.provider !== "pieverse-llm") {
       await onboardProviderActivation(agentRoot2, o.provider, o.model);
     }
@@ -9011,7 +9208,7 @@ async function runOnboarding(o) {
     await printFaucetHint(o.network, address);
     if (o.walletKind === "altana") {
       printOut(
-        "Altana next step: fund about 0.6 tBNB for bootstrap/registration, then run `bag wallet session grant`."
+        "Altana next step: fund about 0.05 tBNB for bootstrap/registration, then run `bag wallet session grant`."
       );
     }
   }
@@ -9021,9 +9218,9 @@ async function onboardProviderActivation(agentRoot2, provider, model) {
   if (provider === "pieverse-llm") {
     const chosenModel = model ?? await promptPieverseModel();
     if (model === void 0) {
-      const tomlPath = path22.join(agentRoot2, "studio.toml");
-      const text2 = fs23.readFileSync(tomlPath, "utf-8");
-      fs23.writeFileSync(
+      const tomlPath = path23.join(agentRoot2, "studio.toml");
+      const text2 = fs24.readFileSync(tomlPath, "utf-8");
+      fs24.writeFileSync(
         tomlPath,
         updateSection(text2, "llm", { model: chosenModel })
       );
@@ -9059,8 +9256,8 @@ set ${keyEnv}= in .studio/.env.local before running \`bag dev\`.`
   }
 }
 async function runOnboardingTwak(o) {
-  const agentRoot2 = path22.join(o.workspaceRoot, APP_DIR, AGENT_PKG);
-  const studioToml = path22.join(agentRoot2, "studio.toml");
+  const agentRoot2 = path23.join(o.workspaceRoot, APP_DIR, AGENT_PKG);
+  const studioToml = path23.join(agentRoot2, "studio.toml");
   if (await whichTwak() === null) {
     printErr(
       `
@@ -9076,7 +9273,7 @@ you, so you never type the password on a command line, and adopts the address):
   }
   let walletCfg = {};
   try {
-    const data = parseToml(fs23.readFileSync(studioToml, "utf-8"));
+    const data = parseToml(fs24.readFileSync(studioToml, "utf-8"));
     if (data.wallet !== null && typeof data.wallet === "object") {
       walletCfg = data.wallet;
     }
@@ -9085,16 +9282,16 @@ you, so you never type the password on a command line, and adopts the address):
   }
   const { twakWalletFile: twakWalletFile2 } = await import("./_twak-4XF4H5PL.js");
   let projectWallet = twakWalletFile2(walletCfg, agentRoot2);
-  const machineWallet = path22.join(os4.homedir(), ".twak", "wallet.json");
-  if (!o.twakHomePinned && isFile8(machineWallet) && realpathIfExists(projectWallet) !== realpathIfExists(machineWallet)) {
+  const machineWallet = path23.join(os4.homedir(), ".twak", "wallet.json");
+  if (!o.twakHomePinned && isFile9(machineWallet) && realpathIfExists(projectWallet) !== realpathIfExists(machineWallet)) {
     if (await promptUseMachineTwakWallet(machineWallet)) {
       projectWallet = adoptMachineTwakWallet(machineWallet, o.workspaceRoot);
     }
   }
-  if (!isFile8(projectWallet)) {
-    const homeDir = path22.dirname(path22.dirname(projectWallet));
+  if (!isFile9(projectWallet)) {
+    const homeDir = path23.dirname(path23.dirname(projectWallet));
     try {
-      fs23.mkdirSync(homeDir, { recursive: true });
+      fs24.mkdirSync(homeDir, { recursive: true });
     } catch {
     }
     printErr(
@@ -9149,9 +9346,9 @@ Guide: the bnbagent-studio-using-twak-wallet.md reference (installed by \`bag sk
 }
 function realpathIfExists(p) {
   try {
-    return fs23.realpathSync(p);
+    return fs24.realpathSync(p);
   } catch {
-    return path22.resolve(p);
+    return path23.resolve(p);
   }
 }
 async function promptUseMachineTwakWallet(machineWallet) {
@@ -9164,39 +9361,39 @@ Found an existing twak wallet: ${machineWallet}`);
   return answer === "y" || answer === "yes";
 }
 function adoptMachineTwakWallet(machineWallet, workspaceRoot) {
-  const homeDir = path22.join(workspaceRoot, ".studio", "twak");
-  const twakDir = path22.join(homeDir, ".twak");
-  fs23.mkdirSync(twakDir, { recursive: true });
+  const homeDir = path23.join(workspaceRoot, ".studio", "twak");
+  const twakDir = path23.join(homeDir, ".twak");
+  fs24.mkdirSync(twakDir, { recursive: true });
   try {
-    fs23.chmodSync(homeDir, 448);
-    fs23.chmodSync(twakDir, 448);
+    fs24.chmodSync(homeDir, 448);
+    fs24.chmodSync(twakDir, 448);
   } catch {
   }
   for (const name of ["wallet.json", "credentials.json"]) {
-    const src = path22.join(path22.dirname(machineWallet), name);
-    if (isFile8(src)) {
-      const dst = path22.join(twakDir, name);
-      fs23.writeFileSync(dst, fs23.readFileSync(src, "utf-8"), { mode: 384 });
-      fs23.chmodSync(dst, 384);
+    const src = path23.join(path23.dirname(machineWallet), name);
+    if (isFile9(src)) {
+      const dst = path23.join(twakDir, name);
+      fs24.writeFileSync(dst, fs24.readFileSync(src, "utf-8"), { mode: 384 });
+      fs24.chmodSync(dst, 384);
     }
   }
-  return path22.join(twakDir, "wallet.json");
+  return path23.join(twakDir, "wallet.json");
 }
 function normalizeTwakHome(raw) {
-  const expanded = raw.startsWith("~") ? path22.join(os4.homedir(), raw.slice(1)) : raw;
-  if (!path22.isAbsolute(expanded)) {
+  const expanded = raw.startsWith("~") ? path23.join(os4.homedir(), raw.slice(1)) : raw;
+  if (!path23.isAbsolute(expanded)) {
     return { home: raw };
   }
-  const isFile19 = (p) => {
+  const isFile20 = (p) => {
     try {
-      return fs23.statSync(p).isFile();
+      return fs24.statSync(p).isFile();
     } catch {
       return false;
     }
   };
-  if (path22.basename(expanded) === ".twak") {
-    const parent = path22.dirname(expanded);
-    if (isFile19(path22.join(expanded, "wallet.json"))) {
+  if (path23.basename(expanded) === ".twak") {
+    const parent = path23.dirname(expanded);
+    if (isFile20(path23.join(expanded, "wallet.json"))) {
       return {
         home: parent,
         note: `note: --twak-home points at the .twak wallet directory itself; using its parent '${parent}' as the wallet home (the runtime resolves <twak_home>/.twak/wallet.json).`
@@ -9206,15 +9403,15 @@ function normalizeTwakHome(raw) {
       error: `error: --twak-home must name the HOME-STYLE PARENT directory (the one that contains .twak/wallet.json), not a .twak directory itself. '${raw}' holds no wallet.json, so it cannot be auto-corrected \u2014 pass '${parent}' to adopt an existing wallet, or omit --twak-home to use the project-dedicated .studio/twak.`
     };
   }
-  if (isFile19(path22.join(expanded, "wallet.json")) && !isFile19(path22.join(expanded, ".twak", "wallet.json"))) {
+  if (isFile20(path23.join(expanded, "wallet.json")) && !isFile20(path23.join(expanded, ".twak", "wallet.json"))) {
     return {
-      error: `error: --twak-home '${raw}' looks like a twak WALLET directory (it contains wallet.json directly). Pass its parent '${path22.dirname(expanded)}' instead \u2014 the runtime resolves <twak_home>/.twak/wallet.json.`
+      error: `error: --twak-home '${raw}' looks like a twak WALLET directory (it contains wallet.json directly). Pass its parent '${path23.dirname(expanded)}' instead \u2014 the runtime resolves <twak_home>/.twak/wallet.json.`
     };
   }
-  if (!isFile19(path22.join(expanded, ".twak", "wallet.json"))) {
+  if (!isFile20(path23.join(expanded, ".twak", "wallet.json"))) {
     return {
       home: raw,
-      note: `note: no wallet found at ${path22.join(raw, ".twak", "wallet.json")} \u2014 treating --twak-home as a NEW project wallet home; \`bag wallet new\` will guide wallet creation.`
+      note: `note: no wallet found at ${path23.join(raw, ".twak", "wallet.json")} \u2014 treating --twak-home as a NEW project wallet home; \`bag wallet new\` will guide wallet creation.`
     };
   }
   return { home: raw };
@@ -9224,7 +9421,7 @@ function twakHomeIsMainHome(twakHome) {
     return false;
   }
   try {
-    const expanded = twakHome.startsWith("~") ? path22.join(os4.homedir(), twakHome.slice(1)) : twakHome;
+    const expanded = twakHome.startsWith("~") ? path23.join(os4.homedir(), twakHome.slice(1)) : twakHome;
     return realpathIfExists(expanded) === realpathIfExists(os4.homedir());
   } catch {
     return false;
@@ -9315,8 +9512,10 @@ NOTE \u2014 wallet.kind = "altana" (bounded runtime session):
    .studio/wallets/. WALLET_PASSWORD is used only by wallet/session commands.
  \xB7 RUNTIME: fund the admin address, then run \`bag wallet session grant\`.
    The Agent receives only .studio/wallets/altana-session.json.
- \xB7 DEPLOY: deployment is deferred in this release. \`bag deploy --provider <provider>\` is
-   rejected before packaging or external calls; local \`bag dev\` is supported.`
+ \xB7 DEPLOY: \`bag deploy\` ships ONLY the bounded session (as the
+   ALTANA_SESSION runtime secret) \u2014 the admin keystore and WALLET_PASSWORD
+   never leave this machine. When the session expires, re-grant with
+   \`bag wallet session grant --force\` and redeploy.`
   );
 }
 function printPlatformWalletSuggestion() {
@@ -9374,11 +9573,11 @@ function entrypointHint(faces) {
   return "app/agent/src/main.ts + executor.ts  = A2A entrypoint (build your value here)";
 }
 function hasVendoredTarballs(agentDir) {
-  const vendor = path22.join(agentDir, "vendor");
+  const vendor = path23.join(agentDir, "vendor");
   if (!isDir4(vendor)) {
     return false;
   }
-  return fs23.readdirSync(vendor).some((n) => n.endsWith(".tgz"));
+  return fs24.readdirSync(vendor).some((n) => n.endsWith(".tgz"));
 }
 function printCompactNextSteps(name, o = {}) {
   const faces = o.faces ?? normalizeProtocolFaces(o.protocol ?? "A2A");
@@ -9406,7 +9605,7 @@ function printCompactNextSteps(name, o = {}) {
   }
   if (walletKind2 === "altana") {
     printOut(
-      "  bag wallet session grant   # after funding ~0.6 tBNB: create the bounded runtime session"
+      "  bag wallet session grant   # after funding ~0.05 tBNB: create the bounded runtime session"
     );
     if (o.provider === "pieverse-llm") {
       printOut(
@@ -9530,7 +9729,7 @@ function printNextSteps(name, provider, o = {}) {
     printOut("  #    bag auto-loads it; never pass it on argv");
     printOut("  (cd app/agent && bag wallet new)");
     printOut(
-      "  # 2. fund the printed address with ~0.6 tBNB for bootstrap/registration + U, then grant one bounded runtime session"
+      "  # 2. fund the printed address with ~0.05 tBNB for bootstrap/registration + U, then grant one bounded runtime session"
     );
     printOut("  (cd app/agent && bag wallet session grant)");
     printOut(
@@ -9628,11 +9827,11 @@ function printNextSteps(name, provider, o = {}) {
   );
 }
 function loadTomlSafe(p) {
-  if (!isFile8(p)) {
+  if (!isFile9(p)) {
     return {};
   }
   try {
-    return parseToml(fs23.readFileSync(p, "utf-8"));
+    return parseToml(fs24.readFileSync(p, "utf-8"));
   } catch {
     return {};
   }
@@ -9652,7 +9851,7 @@ function weiToU(raw) {
   }
 }
 function printConfigSummary(agentRoot2) {
-  const agent = loadTomlSafe(path22.join(agentRoot2, "studio.toml"));
+  const agent = loadTomlSafe(path23.join(agentRoot2, "studio.toml"));
   if (Object.keys(agent).length === 0) {
     return;
   }
@@ -9850,16 +10049,16 @@ function printConfigSummary(agentRoot2) {
     printOut("");
   }
 }
-function isFile8(p) {
+function isFile9(p) {
   try {
-    return fs23.statSync(p).isFile();
+    return fs24.statSync(p).isFile();
   } catch {
     return false;
   }
 }
 function isDir4(p) {
   try {
-    return fs23.statSync(p).isDirectory();
+    return fs24.statSync(p).isDirectory();
   } catch {
     return false;
   }
@@ -9923,9 +10122,9 @@ var RUNTIME_AGENTCORE = "agentcore";
 var RUNTIME_AZURE_FOUNDRY = "azure-foundry";
 var MIN_NODE_MAJOR = 22;
 var CONTAINER_RUNTIMES = ["docker", "podman", "finch"];
-function isFile9(p) {
+function isFile10(p) {
   try {
-    return fs24.statSync(p).isFile();
+    return fs25.statSync(p).isFile();
   } catch {
     return false;
   }
@@ -9957,8 +10156,8 @@ async function nodeMajor() {
   return /^\d+$/.test(head) ? Number.parseInt(head, 10) : null;
 }
 function workspaceBase(root) {
-  for (const base of [path23.join(root, "app"), root]) {
-    if (isFile9(path23.join(base, "agent", "studio.toml"))) {
+  for (const base of [path24.join(root, "app"), root]) {
+    if (isFile10(path24.join(base, "agent", "studio.toml"))) {
       return base;
     }
   }
@@ -9966,7 +10165,7 @@ function workspaceBase(root) {
 }
 function resolveWorkspaceRoot(argRoot) {
   if (argRoot !== null) {
-    const root = path23.resolve(argRoot);
+    const root = path24.resolve(argRoot);
     const base = workspaceBase(root);
     if (base === null) {
       printErr(
@@ -9976,13 +10175,13 @@ function resolveWorkspaceRoot(argRoot) {
     }
     return base;
   }
-  let current = path23.resolve(process.cwd());
+  let current = path24.resolve(process.cwd());
   for (; ; ) {
     const base = workspaceBase(current);
     if (base !== null) {
       return base;
     }
-    const parent = path23.dirname(current);
+    const parent = path24.dirname(current);
     if (parent === current) {
       break;
     }
@@ -9996,7 +10195,7 @@ function resolveWorkspaceRoot(argRoot) {
 function loadAgentToml2(workspaceRoot) {
   try {
     return loadStudioToml11(
-      path23.join(workspaceRoot, "agent", "studio.toml")
+      path24.join(workspaceRoot, "agent", "studio.toml")
     );
   } catch {
     return {};
@@ -10023,7 +10222,7 @@ function defaultAgentPort(faces) {
 function storageKind(agentDir) {
   let data;
   try {
-    data = loadStudioToml11(path23.join(agentDir, "studio.toml"));
+    data = loadStudioToml11(path24.join(agentDir, "studio.toml"));
   } catch {
     return "local";
   }
@@ -10033,7 +10232,7 @@ function storageKind(agentDir) {
 function networkNameOf(agentDir) {
   let data;
   try {
-    data = loadStudioToml11(path23.join(agentDir, "studio.toml"));
+    data = loadStudioToml11(path24.join(agentDir, "studio.toml"));
   } catch {
     return "bsc-testnet";
   }
@@ -10043,7 +10242,7 @@ function networkNameOf(agentDir) {
 function walletKindOf(agentDir) {
   let data;
   try {
-    data = loadStudioToml11(path23.join(agentDir, "studio.toml"));
+    data = loadStudioToml11(path24.join(agentDir, "studio.toml"));
   } catch {
     return "evm-local";
   }
@@ -10051,18 +10250,18 @@ function walletKindOf(agentDir) {
   return typeof kind === "string" && kind.trim() ? kind.trim() : "evm-local";
 }
 function altanaSessionForRuntime(agentDir) {
-  const cfg = loadStudioToml11(path23.join(agentDir, "studio.toml"));
+  const cfg = loadStudioToml11(path24.join(agentDir, "studio.toml"));
   const wallet = tableOf9(cfg, "wallet");
   const configured = String(
     wallet.session_file ?? ".studio/wallets/altana-session.json"
   );
-  const sessionFile = path23.isAbsolute(configured) ? configured : path23.join(agentDir, configured);
-  if (!isFile9(sessionFile)) {
+  const sessionFile = path24.isAbsolute(configured) ? configured : path24.join(agentDir, configured);
+  if (!isFile10(sessionFile)) {
     throw new Error(
       `no Altana session at ${sessionFile} \u2014 run \`bag wallet session grant\` first.`
     );
   }
-  const serialized = fs24.readFileSync(sessionFile, "utf8");
+  const serialized = fs25.readFileSync(sessionFile, "utf8");
   let envelope;
   try {
     envelope = JSON.parse(serialized);
@@ -10091,10 +10290,10 @@ function altanaSessionForRuntime(agentDir) {
 }
 var KEY_LINE_RE = /^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=/;
 function loadEnvFileForDev(p) {
-  if (!isFile9(p)) {
+  if (!isFile10(p)) {
     return;
   }
-  for (const line of fs24.readFileSync(p, "utf-8").split(/\r?\n/)) {
+  for (const line of fs25.readFileSync(p, "utf-8").split(/\r?\n/)) {
     if (!line || line.trimStart().startsWith("#")) {
       continue;
     }
@@ -10115,20 +10314,20 @@ function ensureStoragePath(projectRoot) {
   const raw = process.env.STORAGE_LOCAL_PATH;
   let resolved;
   if (raw) {
-    resolved = path23.resolve(
-      raw.startsWith("~") ? path23.join(os5.homedir(), raw.slice(1)) : raw
+    resolved = path24.resolve(
+      raw.startsWith("~") ? path24.join(os5.homedir(), raw.slice(1)) : raw
     );
   } else {
-    resolved = path23.resolve(
-      path23.join(
+    resolved = path24.resolve(
+      path24.join(
         os5.homedir(),
         ".bag",
         "deliverables",
-        path23.basename(projectRoot)
+        path24.basename(projectRoot)
       )
     );
   }
-  fs24.mkdirSync(resolved, { recursive: true });
+  fs25.mkdirSync(resolved, { recursive: true });
   process.env.STORAGE_LOCAL_PATH = resolved;
 }
 function ipfsPreflight(agentDir) {
@@ -10143,7 +10342,7 @@ function ipfsPreflight(agentDir) {
 function runtimeEnvKeys(agentDir) {
   let cfg = {};
   try {
-    cfg = loadStudioToml11(path23.join(agentDir, "studio.toml"));
+    cfg = loadStudioToml11(path24.join(agentDir, "studio.toml"));
   } catch {
     cfg = {};
   }
@@ -10160,7 +10359,7 @@ function readTwakFiles(agentDir) {
   let walletCfg = {};
   try {
     walletCfg = tableOf9(
-      loadStudioToml11(path23.join(agentDir, "studio.toml")),
+      loadStudioToml11(path24.join(agentDir, "studio.toml")),
       "wallet"
     );
   } catch {
@@ -10168,9 +10367,9 @@ function readTwakFiles(agentDir) {
   }
   const twakDir = twakHomeDir(walletCfg, agentDir);
   const read = (name) => {
-    const p = path23.join(twakDir, name);
+    const p = path24.join(twakDir, name);
     try {
-      return fs24.readFileSync(p, "utf-8");
+      return fs25.readFileSync(p, "utf-8");
     } catch {
       return null;
     }
@@ -10178,19 +10377,19 @@ function readTwakFiles(agentDir) {
   return [read("wallet.json"), read("credentials.json")];
 }
 function ensureAgentcoreEnvGitignored(agentcoreDir) {
-  const gi = path23.join(agentcoreDir, ".gitignore");
+  const gi = path24.join(agentcoreDir, ".gitignore");
   const entry = ".env.local";
-  if (isFile9(gi)) {
-    const text2 = fs24.readFileSync(gi, "utf-8");
+  if (isFile10(gi)) {
+    const text2 = fs25.readFileSync(gi, "utf-8");
     const lines = new Set(text2.split("\n").map((l) => l.trim()));
     if (lines.has(entry)) {
       return;
     }
-    const sep6 = text2.endsWith("\n") || text2 === "" ? "" : "\n";
-    fs24.writeFileSync(gi, `${text2}${sep6}${entry}
+    const sep7 = text2.endsWith("\n") || text2 === "" ? "" : "\n";
+    fs25.writeFileSync(gi, `${text2}${sep7}${entry}
 `);
   } else {
-    fs24.writeFileSync(gi, `${entry}
+    fs25.writeFileSync(gi, `${entry}
 `);
   }
 }
@@ -10213,8 +10412,8 @@ function writeAgentcoreEnvLocal(agentcoreRoot, agentDir) {
   } else if (walletKindOf(agentDir) === "altana") {
     bundle.ALTANA_SESSION = altanaSessionForRuntime(agentDir);
   }
-  const envPath = path23.join(agentcoreRoot, "agentcore", ".env.local");
-  const prior = isFile9(envPath) ? fs24.readFileSync(envPath, "utf-8") : "";
+  const envPath = path24.join(agentcoreRoot, "agentcore", ".env.local");
+  const prior = isFile10(envPath) ? fs25.readFileSync(envPath, "utf-8") : "";
   const merged = {};
   for (const line of prior.split("\n")) {
     if (!line || line.trimStart().startsWith("#")) {
@@ -10229,14 +10428,14 @@ function writeAgentcoreEnvLocal(agentcoreRoot, agentDir) {
   Object.assign(merged, bundle);
   const content = Object.entries(merged).map(([k, v]) => `${k}=${v}
 `).join("");
-  fs24.mkdirSync(path23.dirname(envPath), { recursive: true });
-  ensureAgentcoreEnvGitignored(path23.dirname(envPath));
+  fs25.mkdirSync(path24.dirname(envPath), { recursive: true });
+  ensureAgentcoreEnvGitignored(path24.dirname(envPath));
   writePrivate2(envPath, content);
   return [envPath, content !== prior];
 }
 function agentcoreProjectRoot2(workspaceRoot) {
-  for (const candidate of [path23.dirname(workspaceRoot), workspaceRoot]) {
-    if (isFile9(path23.join(candidate, "agentcore", "agentcore.json"))) {
+  for (const candidate of [path24.dirname(workspaceRoot), workspaceRoot]) {
+    if (isFile10(path24.join(candidate, "agentcore", "agentcore.json"))) {
       return candidate;
     }
   }
@@ -10245,8 +10444,8 @@ function agentcoreProjectRoot2(workspaceRoot) {
 function loadAgentcoreConfig(projectRoot) {
   try {
     const cfg = JSON.parse(
-      fs24.readFileSync(
-        path23.join(projectRoot, "agentcore", "agentcore.json"),
+      fs25.readFileSync(
+        path24.join(projectRoot, "agentcore", "agentcore.json"),
         "utf-8"
       )
     );
@@ -10336,7 +10535,7 @@ async function cmdDev(opts) {
   if (workspaceRoot === null) {
     return 2;
   }
-  const agentDir = path23.join(workspaceRoot, "agent");
+  const agentDir = path24.join(workspaceRoot, "agent");
   migrateEnvLocal(agentDir);
   migrateKeystoreOutOfCodelocation(agentDir);
   const { envLocalPath: envLocalPath19 } = await import("@bnbagent/studio-runtime/config");
@@ -10372,8 +10571,8 @@ async function cmdDev(opts) {
   const runtime = agentRuntime(workspaceRoot);
   const container = Boolean(opts.container);
   const entryFile = localEntryFile(faces);
-  const agentFile = path23.join(agentDir, entryFile);
-  if (!isFile9(agentFile)) {
+  const agentFile = path24.join(agentDir, entryFile);
+  if (!isFile10(agentFile)) {
     printErr(
       `error: Agent entrypoint file ${agentFile} does not exist. [stack] faces = [${faces.join(", ")}], so the entrypoint is ${entryFile} (A2A/X402-only \u2192 src/main.ts, MCP \u2192 src/mcpMain.ts, A2A+MCP \u2192 src/dualMain.ts). Run \`bag init\` to scaffold the workspace.`
     );
@@ -10451,7 +10650,7 @@ Switch to Node \u226522 so it wins on PATH, then reopen the shell and retry. Ver
   }
   let launch;
   if (runtime === RUNTIME_AGENTCORE && container) {
-    const root = path23.resolve(agentcoreRoot);
+    const root = path24.resolve(agentcoreRoot);
     try {
       const vendored = await vendorLocalTarballs(agentDir);
       if (vendored.length > 0) {
@@ -10466,7 +10665,7 @@ Switch to Node \u226522 so it wins on PATH, then reopen the shell and retry. Ver
     }
     const [envPath, changed] = writeAgentcoreEnvLocal(root, agentDir);
     printOut(
-      `bag dev: wrote ${path23.relative(root, envPath)} (runtime secrets + materialized wallet for the container).`
+      `bag dev: wrote ${path24.relative(root, envPath)} (runtime secrets + materialized wallet for the container).`
     );
     if (changed && process.env.BAG_DEV_ENV_WARNED !== "1") {
       printErr(
@@ -10543,7 +10742,7 @@ Switch to Node \u226522 so it wins on PATH, then reopen the shell and retry. Ver
   }
   if (hasX402Face(faces)) {
     const free = x402SellerIsFree(
-      loadStudioToml11(path23.join(agentDir, "studio.toml"))
+      loadStudioToml11(path24.join(agentDir, "studio.toml"))
     );
     printOut(
       free ? `bag dev: x402 seller at http://localhost:${agentPort}/x402 (FREE \u2014 anonymous passthrough; B402 bypassed)` : `bag dev: x402 seller at http://localhost:${agentPort}/x402 (PAID \u2014 active when B402 credentials are configured)`
@@ -10554,9 +10753,9 @@ Switch to Node \u226522 so it wins on PATH, then reopen the shell and retry. Ver
 }
 function tsxRunner(agentDir, workspaceBaseDir) {
   const bin = process.platform === "win32" ? "tsx.cmd" : "tsx";
-  for (const dir of [agentDir, path23.dirname(workspaceBaseDir)]) {
-    const candidate = path23.join(dir, "node_modules", ".bin", bin);
-    if (isFile9(candidate)) {
+  for (const dir of [agentDir, path24.dirname(workspaceBaseDir)]) {
+    const candidate = path24.join(dir, "node_modules", ".bin", bin);
+    if (isFile10(candidate)) {
       return candidate;
     }
   }
@@ -10565,7 +10764,7 @@ function tsxRunner(agentDir, workspaceBaseDir) {
 function networkBanner(agentDir) {
   let data;
   try {
-    data = loadStudioToml11(path23.join(agentDir, "studio.toml"));
+    data = loadStudioToml11(path24.join(agentDir, "studio.toml"));
   } catch {
     return null;
   }
@@ -10582,34 +10781,34 @@ function networkBanner(agentDir) {
 }
 
 // src/cli/_deploy/checks/critical.ts
-import * as fs25 from "fs";
+import * as fs26 from "fs";
 import { createRequire } from "module";
-import * as path24 from "path";
+import * as path25 from "path";
 import { envLocalPath as envLocalPath11, loadStudioToml as loadStudioToml12 } from "@bnbagent/studio-runtime/config";
 import { pieverseKeyHash as pieverseKeyHash2 } from "@bnbagent/studio-runtime/llm";
 var AGENTCORE_DESCRIPTOR2 = "agentcore/agentcore.json";
-function isFile10(p) {
+function isFile11(p) {
   try {
-    return fs25.statSync(p).isFile();
+    return fs26.statSync(p).isFile();
   } catch {
     return false;
   }
 }
 function isDir5(p) {
   try {
-    return fs25.statSync(p).isDirectory();
+    return fs26.statSync(p).isDirectory();
   } catch {
     return false;
   }
 }
 function keystoreDirOf(root, data) {
   const rel = String(tableOf2(data, "wallet").keystore_dir ?? ".studio/wallets");
-  const dir = path24.isAbsolute(rel) ? rel : path24.join(agentRootOf(root), rel);
-  return path24.resolve(dir);
+  const dir = path25.isAbsolute(rel) ? rel : path25.join(agentRootOf(root), rel);
+  return path25.resolve(dir);
 }
 function keystoreJsonFiles2(dir) {
   try {
-    return fs25.readdirSync(dir).filter((n) => n.endsWith(".json")).sort();
+    return fs26.readdirSync(dir).filter((n) => n.endsWith(".json")).sort();
   } catch {
     return [];
   }
@@ -10617,7 +10816,7 @@ function keystoreJsonFiles2(dir) {
 function runtimeEnvKeys2(agentRoot2) {
   let cfg = {};
   try {
-    cfg = loadStudioToml12(path24.join(agentRoot2, "studio.toml"));
+    cfg = loadStudioToml12(path25.join(agentRoot2, "studio.toml"));
   } catch {
     cfg = {};
   }
@@ -10629,8 +10828,8 @@ async function checkAgentcoreJsonPresent(root, target) {
   if (target !== "agentcore") {
     return [];
   }
-  const descriptor = path24.join(root, AGENTCORE_DESCRIPTOR2);
-  if (isFile10(descriptor)) {
+  const descriptor = path25.join(root, AGENTCORE_DESCRIPTOR2);
+  if (isFile11(descriptor)) {
     return [];
   }
   return [
@@ -10646,10 +10845,10 @@ async function checkAgentcoreAuthorizerKeyLegacy(root, target) {
   if (target !== "agentcore") {
     return [];
   }
-  const descriptor = path24.join(root, AGENTCORE_DESCRIPTOR2);
+  const descriptor = path25.join(root, AGENTCORE_DESCRIPTOR2);
   let data;
   try {
-    data = JSON.parse(fs25.readFileSync(descriptor, "utf-8"));
+    data = JSON.parse(fs26.readFileSync(descriptor, "utf-8"));
   } catch {
     return [];
   }
@@ -10689,10 +10888,10 @@ async function checkAgentPackagePresent(root, target) {
     sourceEntries.push("src/mcpMain.ts");
   }
   const missingSource = sourceEntries.find(
-    (entry) => !isFile10(path24.join(agentRoot2, entry))
+    (entry) => !isFile11(path25.join(agentRoot2, entry))
   );
   if (missingSource !== void 0) {
-    const epPath = path24.join(agentRoot2, missingSource);
+    const epPath = path25.join(agentRoot2, missingSource);
     return [
       {
         level: Level.CRITICAL,
@@ -10707,10 +10906,10 @@ async function checkAgentPackagePresent(root, target) {
     distEntries.push("dist/mcpMain.js");
   }
   const missingDist = distEntries.find(
-    (entry) => !isFile10(path24.join(agentRoot2, entry))
+    (entry) => !isFile11(path25.join(agentRoot2, entry))
   );
   if (missingDist !== void 0) {
-    const distPath = path24.join(agentRoot2, missingDist);
+    const distPath = path25.join(agentRoot2, missingDist);
     return [
       {
         level: Level.WARNING,
@@ -10735,8 +10934,8 @@ async function checkKeystoreNotInsideAgent(root, target) {
   if (!isDir5(keystoreDir) || keystoreJsonFiles2(keystoreDir).length === 0) {
     return [];
   }
-  const agentDir = path24.resolve(agentRootOf(root));
-  const inside2 = keystoreDir === agentDir || keystoreDir.startsWith(agentDir + path24.sep);
+  const agentDir = path25.resolve(agentRootOf(root));
+  const inside2 = keystoreDir === agentDir || keystoreDir.startsWith(agentDir + path25.sep);
   if (!inside2) {
     return [];
   }
@@ -10755,6 +10954,9 @@ async function checkLocalKeystoreExists(root, _target) {
   if (walletCfg.kind === "twak") {
     return [];
   }
+  if (walletCfg.kind === "altana") {
+    return [];
+  }
   const signer = walletCfg.signer ?? "local";
   if (signer !== "local") {
     return [];
@@ -10773,7 +10975,11 @@ async function checkLocalKeystoreExists(root, _target) {
   ];
 }
 async function checkWalletPasswordEnvSet(root, _target) {
-  if (tableOf2(loadAgentToml(root), "wallet").kind === "twak") {
+  const kind = tableOf2(loadAgentToml(root), "wallet").kind;
+  if (kind === "twak") {
+    return [];
+  }
+  if (kind === "altana") {
     return [];
   }
   if (process.env.WALLET_PASSWORD) {
@@ -10812,18 +11018,18 @@ async function checkLlmProviderKeySet(root, _target) {
 function gitignoreLines(p) {
   try {
     return new Set(
-      fs25.readFileSync(p, "utf-8").split(/\r?\n/).map((l) => l.trim())
+      fs26.readFileSync(p, "utf-8").split(/\r?\n/).map((l) => l.trim())
     );
   } catch {
     return null;
   }
 }
 function agentcoreEnvLocalIgnored(ws) {
-  const wsLines = gitignoreLines(path24.join(ws, ".gitignore"));
+  const wsLines = gitignoreLines(path25.join(ws, ".gitignore"));
   if (wsLines?.has("agentcore/.env.local")) {
     return true;
   }
-  const acLines = gitignoreLines(path24.join(ws, "agentcore", ".gitignore"));
+  const acLines = gitignoreLines(path25.join(ws, "agentcore", ".gitignore"));
   return acLines?.has(".env.local") ?? false;
 }
 function studioIgnored(lines) {
@@ -10834,8 +11040,8 @@ function studioIgnored(lines) {
 }
 async function checkGitignoreExcludesSecrets(root, _target) {
   const out = [];
-  const ws = path24.dirname(path24.dirname(envLocalPath11(root)));
-  const gi = path24.join(ws, ".gitignore");
+  const ws = path25.dirname(path25.dirname(envLocalPath11(root)));
+  const gi = path25.join(ws, ".gitignore");
   const lines = gitignoreLines(gi);
   if (lines === null) {
     return [
@@ -10857,7 +11063,7 @@ async function checkGitignoreExcludesSecrets(root, _target) {
       details: { missing: [".studio/"] }
     });
   }
-  if (isDir5(path24.join(ws, "agentcore")) && !agentcoreEnvLocalIgnored(ws)) {
+  if (isDir5(path25.join(ws, "agentcore")) && !agentcoreEnvLocalIgnored(ws)) {
     out.push({
       level: Level.CRITICAL,
       name: "gitignore_excludes_secrets",
@@ -10874,16 +11080,16 @@ function installedRuntimeVersion() {
   }
   try {
     const entry = require2.resolve("@bnbagent/studio-runtime");
-    let dir = path24.dirname(entry);
+    let dir = path25.dirname(entry);
     for (let i = 0; i < 10; i++) {
-      const pkgPath = path24.join(dir, "package.json");
-      if (isFile10(pkgPath)) {
-        const pkg = JSON.parse(fs25.readFileSync(pkgPath, "utf-8"));
+      const pkgPath = path25.join(dir, "package.json");
+      if (isFile11(pkgPath)) {
+        const pkg = JSON.parse(fs26.readFileSync(pkgPath, "utf-8"));
         if (pkg.name === "@bnbagent/studio-runtime") {
           return typeof pkg.version === "string" ? pkg.version : null;
         }
       }
-      const parent = path24.dirname(dir);
+      const parent = path25.dirname(dir);
       if (parent === dir) {
         break;
       }
@@ -11167,9 +11373,9 @@ function x402SellerRailChecks(agentRoot2, cfg, target) {
       details: { destination, target, stackRuntime: stackRuntime2 }
     });
   }
-  const dockerfile = path24.join(agentRoot2, "Dockerfile");
-  if (rails.x402 && isFile10(dockerfile)) {
-    const source = fs25.readFileSync(dockerfile, "utf8");
+  const dockerfile = path25.join(agentRoot2, "Dockerfile");
+  if (rails.x402 && isFile11(dockerfile)) {
+    const source = fs26.readFileSync(dockerfile, "utf8");
     if (!/^\s*FROM\s+node:22(?:[.-]|\s|$)/im.test(source)) {
       out.push({
         level: Level.WARNING,
@@ -11242,10 +11448,10 @@ async function checkDeployCliRunnable(_root, target) {
   ];
 }
 function agentcoreEnvVars(root) {
-  const descriptor = path24.join(root, AGENTCORE_DESCRIPTOR2);
+  const descriptor = path25.join(root, AGENTCORE_DESCRIPTOR2);
   let data;
   try {
-    data = JSON.parse(fs25.readFileSync(descriptor, "utf-8"));
+    data = JSON.parse(fs26.readFileSync(descriptor, "utf-8"));
   } catch {
     return [];
   }
@@ -11327,7 +11533,7 @@ async function checkRuntimeSecretsInjected(root, target) {
       }
     ];
   }
-  const lines = gitignoreLines(path24.join(root, ".gitignore"));
+  const lines = gitignoreLines(path25.join(root, ".gitignore"));
   let tracked = true;
   if (lines !== null) {
     for (const p of ["agentcore/agentcore.json", "agentcore/", "/agentcore/"]) {
@@ -11352,7 +11558,7 @@ async function checkAwsTargetsPopulated(root, target) {
   if (target !== "agentcore") {
     return [];
   }
-  const p = path24.join(root, "agentcore", "aws-targets.json");
+  const p = path25.join(root, "agentcore", "aws-targets.json");
   const [account, region] = readAwsTarget(root);
   if (account && region) {
     return [];
@@ -11366,6 +11572,84 @@ async function checkAwsTargetsPopulated(root, target) {
     }
   ];
 }
+var AGENTCORE_AGENT_QUOTA_CODE = "L-F4575653";
+function awsJson(stdout) {
+  try {
+    const parsed = JSON.parse(stdout);
+    return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+async function checkAgentcoreQuotaHeadroom(root, target) {
+  if (target !== "agentcore") {
+    return [];
+  }
+  const [, region] = readAwsTarget(root);
+  if (!region || !await whichBin("aws")) {
+    return [];
+  }
+  const quotaRes = await runCapture("aws", [
+    "service-quotas",
+    "get-service-quota",
+    "--service-code",
+    "bedrock-agentcore",
+    "--quota-code",
+    AGENTCORE_AGENT_QUOTA_CODE,
+    "--region",
+    region,
+    "--output",
+    "json"
+  ]);
+  if (quotaRes.code !== 0) {
+    return [];
+  }
+  const quota = awsJson(quotaRes.stdout)?.Quota;
+  const limit = typeof quota?.Value === "number" ? quota.Value : null;
+  if (limit === null) {
+    return [];
+  }
+  const listRes = await runCapture("aws", [
+    "bedrock-agentcore-control",
+    "list-agent-runtimes",
+    "--region",
+    region,
+    "--output",
+    "json"
+  ]);
+  if (listRes.code !== 0) {
+    return [];
+  }
+  const runtimes = awsJson(listRes.stdout)?.agentRuntimes;
+  if (!Array.isArray(runtimes)) {
+    return [];
+  }
+  const used = runtimes.length;
+  const details = {
+    used,
+    limit,
+    region,
+    quota_code: AGENTCORE_AGENT_QUOTA_CODE
+  };
+  if (used < limit) {
+    return [
+      {
+        level: Level.INFO,
+        name: "agentcore_quota_headroom",
+        message: `AgentCore runtimes: ${used}/${limit} used in ${region}.`,
+        details
+      }
+    ];
+  }
+  return [
+    {
+      level: Level.CRITICAL,
+      name: "agentcore_quota_headroom",
+      message: `AgentCore runtimes: ${used}/${limit} used in ${region} \u2014 no slots left, so the deploy would fail with \`maxAgents limit exceeded\` AFTER pushing the image and creating the secret, M2M client, and execution role (all orphans). Delete a runtime you no longer need (\`bag deploy destroy\` in its workspace) or request a quota increase for ${AGENTCORE_AGENT_QUOTA_CODE} ("Total Agents per Account") in the Service Quotas console.`,
+      details
+    }
+  ];
+}
 var allChecks = [
   checkAgentcoreJsonPresent,
   checkAgentcoreAuthorizerKeyLegacy,
@@ -11383,6 +11667,10 @@ var allChecks = [
   checkTwakPasswordEnvSet,
   checkTwakCredentialsAvailable,
   checkTwakDockerAvailable,
+  // altana-kind checks (every one early-returns for other kinds).
+  checkAltanaSessionReady,
+  checkAltanaSdkResolvable,
+  checkAltanaSessionNotInsideAgent,
   checkLlmProviderKeySet,
   checkGitignoreExcludesSecrets,
   checkInstalledBnbagentStudioMatches,
@@ -11390,23 +11678,24 @@ var allChecks = [
   checkCommerceReady,
   checkDeployCliRunnable,
   checkRuntimeSecretsInjected,
-  checkAwsTargetsPopulated
+  checkAwsTargetsPopulated,
+  checkAgentcoreQuotaHeadroom
 ];
 
 // src/cli/_deploy/secrets.ts
 var KEYSTORE_JSON_ENV = "WALLET_KEYSTORE_JSON";
 var TWAK_WALLET_JSON_ENV = "TWAK_WALLET_JSON";
 var TWAK_CREDENTIALS_JSON_ENV = "TWAK_CREDENTIALS_JSON";
-function isFile11(p) {
+function isFile12(p) {
   try {
-    return fs26.statSync(p).isFile();
+    return fs27.statSync(p).isFile();
   } catch {
     return false;
   }
 }
 function loadTomlOr(agentRoot2) {
   try {
-    return loadStudioToml13(path25.join(agentRoot2, "studio.toml"));
+    return loadStudioToml13(path26.join(agentRoot2, "studio.toml"));
   } catch {
     return {};
   }
@@ -11423,13 +11712,13 @@ function resolveKeystoreDir3(agentRoot2) {
   const rel = String(
     tableOf10(loadTomlOr(agentRoot2), "wallet").keystore_dir ?? ".studio/wallets"
   );
-  return path25.resolve(path25.isAbsolute(rel) ? rel : path25.join(agentRoot2, rel));
+  return path26.resolve(path26.isAbsolute(rel) ? rel : path26.join(agentRoot2, rel));
 }
 function readKeystoreJson(agentRoot2) {
   const keystoreDir = resolveKeystoreDir3(agentRoot2);
   let names;
   try {
-    names = fs26.readdirSync(keystoreDir).filter((n) => n.endsWith(".json")).sort();
+    names = fs27.readdirSync(keystoreDir).filter((n) => n.endsWith(".json")).sort();
   } catch {
     return null;
   }
@@ -11451,9 +11740,9 @@ function readKeystoreJson(agentRoot2) {
       );
     }
   }
-  const file = path25.join(keystoreDir, chosen ?? names[0]);
+  const file = path26.join(keystoreDir, chosen ?? names[0]);
   try {
-    return fs26.readFileSync(file, "utf-8");
+    return fs27.readFileSync(file, "utf-8");
   } catch {
     return null;
   }
@@ -11462,10 +11751,10 @@ function readEnvLocal(agentRoot2) {
   const values = {};
   try {
     const file = envLocalPath12(agentRoot2);
-    if (!isFile11(file)) {
+    if (!isFile12(file)) {
       return values;
     }
-    for (const rawLine of fs26.readFileSync(file, "utf-8").split(/\r?\n/)) {
+    for (const rawLine of fs27.readFileSync(file, "utf-8").split(/\r?\n/)) {
       const line = rawLine.trim();
       if (!line || line.startsWith("#")) {
         continue;
@@ -11487,11 +11776,6 @@ function readEnvLocal(agentRoot2) {
 }
 function collectRuntimeSecretsDetailed(root) {
   const agentRoot2 = findSubProjectRoot8("agent", root) ?? root;
-  if (deployWalletKind(agentRoot2) === "altana") {
-    throw new Error(
-      "Altana deployment is deferred: refusing to collect either the admin keystore or runtime session for a deploy target."
-    );
-  }
   const secretKeys = runtimeEnvKeys2(agentRoot2);
   const fileValues = readEnvLocal(agentRoot2);
   const payload = {};
@@ -11504,7 +11788,8 @@ function collectRuntimeSecretsDetailed(root) {
       sources[k] = fromFile ? ".studio/.env.local" : "process.env";
     }
   }
-  if (deployWalletKind(agentRoot2) === "twak") {
+  const walletKind2 = deployWalletKind(agentRoot2);
+  if (walletKind2 === "twak") {
     const [walletJson, credentialsJson] = readTwakFiles(agentRoot2);
     if (walletJson) {
       payload[TWAK_WALLET_JSON_ENV] = walletJson;
@@ -11514,6 +11799,9 @@ function collectRuntimeSecretsDetailed(root) {
       payload[TWAK_CREDENTIALS_JSON_ENV] = credentialsJson;
       sources[TWAK_CREDENTIALS_JSON_ENV] = "wallet-file";
     }
+  } else if (walletKind2 === "altana") {
+    payload[ALTANA_SESSION_ENV] = altanaSessionForRuntime(agentRoot2);
+    sources[ALTANA_SESSION_ENV] = "wallet-file";
   } else {
     const keystoreJson = readKeystoreJson(agentRoot2);
     if (keystoreJson) {
@@ -11521,7 +11809,7 @@ function collectRuntimeSecretsDetailed(root) {
       sources[KEYSTORE_JSON_ENV] = "wallet-file";
     }
   }
-  if (!(KEYSTORE_JSON_ENV in payload) && !(TWAK_WALLET_JSON_ENV in payload)) {
+  if (walletKind2 !== "altana" && !(KEYSTORE_JSON_ENV in payload) && !(TWAK_WALLET_JSON_ENV in payload)) {
     printErr(
       `WARNING: no wallet signing material found (${KEYSTORE_JSON_ENV} for evm-local / ${TWAK_WALLET_JSON_ENV} for twak). The deployed runtime won't be able to sign quotes or deliveries. Create/adopt a wallet first (e.g. \`bag wallet new\`) and redeploy.`
     );
@@ -11553,12 +11841,12 @@ var SCOPE_NAME = "invoke";
 var SCOPE = `${RESOURCE_SERVER_ID}/${SCOPE_NAME}`;
 var COGNITO_OUTPUTS_FILE = "agentcore/cognito/cdk-outputs.json";
 function emitNextSteps(result) {
-  return `\u2713 wrote Cognito CDK app to ${path26.dirname(result.appPath)}
-  - ${path26.basename(result.appPath)}  (CognitoStack: user pool + resource server + M2M client)
-  - ${path26.basename(result.readmePath)}  (deploy + wiring instructions)
+  return `\u2713 wrote Cognito CDK app to ${path27.dirname(result.appPath)}
+  - ${path27.basename(result.appPath)}  (CognitoStack: user pool + resource server + M2M client)
+  - ${path27.basename(result.readmePath)}  (deploy + wiring instructions)
 
 Next steps:
-  1. cd ${path26.dirname(result.appPath)}
+  1. cd ${path27.dirname(result.appPath)}
   2. npm install   # aws-cdk-lib + constructs + the cdk CLI (local)
   3. npx cdk deploy --outputs-file cdk-outputs.json   # YOU run this (the only AWS step)
   4. bag deploy provision-cognito --wire   # studio reads cdk-outputs.json \u2192
@@ -11674,6 +11962,12 @@ function cognitoPackageJson() {
 function readme() {
   return `# Cognito M2M client for the AgentCore A2A inbound OAuth2 authorizer
 
+> **DEPRECATED.** \`bag deploy --provider aws\` now provisions its own user pool
+> and M2M client, and overwrites the values wired from this stack. Deploying
+> this app leaves a second, unused pool behind that you have to clean up
+> yourself. Keep it only if you need to own the pool out of band; otherwise run
+> \`bag deploy --provider aws\` and hand buyers the credentials it prints.
+
 AgentCore A2A endpoints REQUIRE inbound auth (there is no anonymous mode). This
 seller uses **OAuth2 via Cognito** \u2014 NOT SigV4, because external buyers cannot
 obtain your AWS IAM credentials. Cognito has no public machine-to-machine
@@ -11714,12 +12008,11 @@ This reads the local \`cdk-outputs.json\` and patches:
 | \`Scope\`        | \`agentcore.json\` \u2192 \`envVars[] OAUTH_SCOPE\` (+ \`.studio/.env.local\` for local dev) |
 
 \`OAUTH_TOKEN_URL\` / \`OAUTH_SCOPE\` are read by the emitted agent card from
-the environment, so the published A2A agent card advertises the OAuth2 security
-scheme buyers must use. They go into \`agentcore.json\` \`envVars[]\` (non-secret)
-because \`.studio/.env.local\` lives outside the deploy CodeZip \u2014 so envVars[]
-is the channel that actually reaches the runtime; the \`.env.local\` copy only
-serves local \`bag dev\`. (\`bag deploy provision-cognito --wire <file>\` accepts a
-custom outputs path.)
+the environment, so the agent card advertises the OAuth2 security scheme buyers
+must use. **A \`bag deploy\` run replaces both values (and the authorizer) with
+the pool it provisions itself**, so this wiring only takes effect for local
+\`bag dev\`. (\`bag deploy provision-cognito --wire <file>\` accepts a custom
+outputs path.)
 
 ## Issue buyer credentials
 
@@ -11749,28 +12042,29 @@ function emitCognitoCdk(workspaceRoot, opts = {}) {
       regionHint = null;
     }
   }
-  const outDir = path26.join(workspaceRoot, COGNITO_DIR);
-  fs27.mkdirSync(outDir, { recursive: true });
-  const appPath = path26.join(outDir, "app.ts");
-  const readmePath = path26.join(outDir, "README.md");
-  fs27.writeFileSync(appPath, appTs(regionHint), "utf-8");
-  fs27.writeFileSync(path26.join(outDir, "cdk.json"), cdkJson(), "utf-8");
-  fs27.writeFileSync(
-    path26.join(outDir, "package.json"),
+  const outDir = path27.join(workspaceRoot, COGNITO_DIR);
+  fs28.mkdirSync(outDir, { recursive: true });
+  const appPath = path27.join(outDir, "app.ts");
+  const readmePath = path27.join(outDir, "README.md");
+  fs28.writeFileSync(appPath, appTs(regionHint), "utf-8");
+  fs28.writeFileSync(path27.join(outDir, "cdk.json"), cdkJson(), "utf-8");
+  fs28.writeFileSync(
+    path27.join(outDir, "package.json"),
     cognitoPackageJson(),
     "utf-8"
   );
-  fs27.writeFileSync(readmePath, readme(), "utf-8");
+  fs28.writeFileSync(readmePath, readme(), "utf-8");
   return { appPath, readmePath };
 }
 function wireSummary(r) {
   return `\u2713 wired Cognito authorizer from the CDK outputs (no AWS call \u2014 read a local file):
-  - ${path26.basename(r.agentcoreJson)}: authorizerConfiguration.customJwtAuthorizer
+  - ${path27.basename(r.agentcoreJson)}: authorizerConfiguration.customJwtAuthorizer
       discoveryUrl = ${r.discoveryUrl}
       allowedClients = [${r.clientId}]
-  - ${path26.basename(r.agentcoreJson)}: envVars[] OAUTH_TOKEN_URL + OAUTH_SCOPE (reach the runtime so the agent card advertises oauth2)
+  - ${path27.basename(r.agentcoreJson)}: envVars[] OAUTH_TOKEN_URL + OAUTH_SCOPE (reach the runtime so the agent card advertises oauth2)
   - ${r.envLocal}: same pair, for local \`bag dev\`
-  \u2192 \`bag deploy prepare\` W9 will now pass; deploy when ready.`;
+  \u2192 NOTE: a \`bag deploy\` run provisions its own pool and overwrites these
+    values with the ones it issued. This wiring only feeds local \`bag dev\`.`;
 }
 function flattenCdkOutputs(raw) {
   const flat = {};
@@ -11798,11 +12092,54 @@ function upsertDescriptorEnvvars(cfg, values) {
     }
   }
 }
+function syncDescriptorOauthFacts(workspaceRoot, facts) {
+  const acj = path27.join(workspaceRoot, "agentcore", "agentcore.json");
+  let cfg;
+  try {
+    cfg = JSON.parse(fs28.readFileSync(acj, "utf-8"));
+  } catch {
+    return;
+  }
+  const envValues = {};
+  if (facts.tokenUrl) {
+    envValues.OAUTH_TOKEN_URL = facts.tokenUrl;
+  }
+  if (facts.scope) {
+    envValues.OAUTH_SCOPE = facts.scope;
+  }
+  const authorizer = facts.discoveryUrl && facts.clientId ? {
+    customJwtAuthorizer: {
+      discoveryUrl: facts.discoveryUrl,
+      allowedClients: [facts.clientId]
+    }
+  } : null;
+  if (Object.keys(envValues).length === 0 && authorizer === null) {
+    return;
+  }
+  if (Object.keys(envValues).length > 0) {
+    upsertDescriptorEnvvars(cfg, envValues);
+  }
+  if (authorizer !== null && Array.isArray(cfg.runtimes)) {
+    for (const rt of cfg.runtimes) {
+      if (rt !== null && typeof rt === "object") {
+        const r = rt;
+        r.authorizerType = "CUSTOM_JWT";
+        r.authorizerConfiguration = authorizer;
+      }
+    }
+  }
+  try {
+    fs28.writeFileSync(acj, `${JSON.stringify(cfg, null, 2)}
+`, "utf-8");
+  } catch {
+    return;
+  }
+}
 function upsertEnv(envLocal, values) {
   let lines = [];
   try {
-    if (fs27.statSync(envLocal).isFile()) {
-      lines = fs27.readFileSync(envLocal, "utf-8").split(/\r?\n/);
+    if (fs28.statSync(envLocal).isFile()) {
+      lines = fs28.readFileSync(envLocal, "utf-8").split(/\r?\n/);
       if (lines.length > 0 && lines[lines.length - 1] === "") {
         lines.pop();
       }
@@ -11821,19 +12158,19 @@ function upsertEnv(envLocal, values) {
       lines.push(repl);
     }
   }
-  fs27.mkdirSync(path26.dirname(envLocal), { recursive: true });
-  fs27.writeFileSync(envLocal, `${lines.join("\n")}
+  fs28.mkdirSync(path27.dirname(envLocal), { recursive: true });
+  fs28.writeFileSync(envLocal, `${lines.join("\n")}
 `, {
     encoding: "utf-8",
     mode: 384
   });
-  fs27.chmodSync(envLocal, 384);
+  fs28.chmodSync(envLocal, 384);
 }
 function wireCognitoOutputs(workspaceRoot, outputsFile = null) {
-  const outPath = outputsFile ?? path26.join(workspaceRoot, COGNITO_OUTPUTS_FILE);
+  const outPath = outputsFile ?? path27.join(workspaceRoot, COGNITO_OUTPUTS_FILE);
   let exists = false;
   try {
-    exists = fs27.statSync(outPath).isFile();
+    exists = fs28.statSync(outPath).isFile();
   } catch {
     exists = false;
   }
@@ -11843,7 +12180,7 @@ function wireCognitoOutputs(workspaceRoot, outputsFile = null) {
     );
   }
   const outs = flattenCdkOutputs(
-    JSON.parse(fs27.readFileSync(outPath, "utf-8"))
+    JSON.parse(fs28.readFileSync(outPath, "utf-8"))
   );
   for (const key of ["DiscoveryUrl", "AppClientId", "TokenUrl", "Scope"]) {
     if (outs[key] === void 0) {
@@ -11856,8 +12193,8 @@ function wireCognitoOutputs(workspaceRoot, outputsFile = null) {
   const clientId = String(outs.AppClientId);
   const tokenUrl = String(outs.TokenUrl);
   const scope = String(outs.Scope);
-  const acj = path26.join(workspaceRoot, "agentcore", "agentcore.json");
-  const cfg = JSON.parse(fs27.readFileSync(acj, "utf-8"));
+  const acj = path27.join(workspaceRoot, "agentcore", "agentcore.json");
+  const cfg = JSON.parse(fs28.readFileSync(acj, "utf-8"));
   const runtimes = cfg.runtimes;
   if (!Array.isArray(runtimes) || runtimes.length === 0) {
     throw new Error(
@@ -11880,7 +12217,7 @@ function wireCognitoOutputs(workspaceRoot, outputsFile = null) {
     OAUTH_TOKEN_URL: tokenUrl,
     OAUTH_SCOPE: scope
   });
-  fs27.writeFileSync(acj, `${JSON.stringify(cfg, null, 2)}
+  fs28.writeFileSync(acj, `${JSON.stringify(cfg, null, 2)}
 `, "utf-8");
   const envLocal = envLocalPath13(workspaceRoot);
   upsertEnv(envLocal, { OAUTH_TOKEN_URL: tokenUrl, OAUTH_SCOPE: scope });
@@ -11895,13 +12232,13 @@ function wireCognitoOutputs(workspaceRoot, outputsFile = null) {
 }
 
 // src/cli/_deploy/destroy.ts
-import * as fs29 from "fs";
-import * as path28 from "path";
+import * as fs30 from "fs";
+import * as path29 from "path";
 import { findSubProjectRoot as findSubProjectRoot10 } from "@bnbagent/studio-runtime/config";
 
 // src/cli/_deploy/status.ts
-import * as fs28 from "fs";
-import * as path27 from "path";
+import * as fs29 from "fs";
+import * as path28 from "path";
 import {
   APP_DIR as APP_DIR2,
   findSubProjectRoot as findSubProjectRoot9,
@@ -11916,20 +12253,20 @@ function loadToml(p) {
   }
 }
 function projectName(workspaceRoot) {
-  const descriptor = path27.join(workspaceRoot, "agentcore", "agentcore.json");
+  const descriptor = path28.join(workspaceRoot, "agentcore", "agentcore.json");
   try {
-    const data = JSON.parse(fs28.readFileSync(descriptor, "utf-8"));
+    const data = JSON.parse(fs29.readFileSync(descriptor, "utf-8"));
     if (data !== null && typeof data === "object" && data.name) {
       return String(data.name);
     }
   } catch {
   }
-  return path27.basename(workspaceRoot);
+  return path28.basename(workspaceRoot);
 }
 async function runStatus(opts = {}) {
-  const start = opts.projectRoot ? path27.resolve(opts.projectRoot) : void 0;
+  const start = opts.projectRoot ? path28.resolve(opts.projectRoot) : void 0;
   const agentRoot2 = findSubProjectRoot9("agent", start);
-  const agentData = agentRoot2 !== null ? loadToml(path27.join(agentRoot2, "studio.toml")) : {};
+  const agentData = agentRoot2 !== null ? loadToml(path28.join(agentRoot2, "studio.toml")) : {};
   const deployRaw = agentData.deploy;
   const deploy = deployRaw !== null && typeof deployRaw === "object" && !Array.isArray(deployRaw) ? { ...deployRaw } : {};
   const runtimeArn = deploy.runtime_arn ? String(deploy.runtime_arn) : null;
@@ -11942,8 +12279,8 @@ async function runStatus(opts = {}) {
   }
   const onchainEndpoint = identity.endpoint ? String(identity.endpoint) : null;
   const agentReachable = null;
-  const workspaceBase2 = findWorkspaceRoot5(start) ?? (agentRoot2 !== null ? path27.dirname(agentRoot2) : null);
-  const workspaceRoot = workspaceBase2 !== null && path27.basename(workspaceBase2) === APP_DIR2 ? path27.dirname(workspaceBase2) : workspaceBase2;
+  const workspaceBase2 = findWorkspaceRoot5(start) ?? (agentRoot2 !== null ? path28.dirname(agentRoot2) : null);
+  const workspaceRoot = workspaceBase2 !== null && path28.basename(workspaceBase2) === APP_DIR2 ? path28.dirname(workspaceBase2) : workspaceBase2;
   let region = null;
   let account = null;
   let secretId = null;
@@ -12011,9 +12348,9 @@ function nullRecordedState(workspaceRoot) {
   if (agentRoot2 === null) {
     return;
   }
-  const ap = path28.join(agentRoot2, "studio.toml");
+  const ap = path29.join(agentRoot2, "studio.toml");
   try {
-    if (!fs29.statSync(ap).isFile()) {
+    if (!fs30.statSync(ap).isFile()) {
       return;
     }
   } catch {
@@ -12077,8 +12414,8 @@ async function runDestroy(opts) {
 }
 
 // src/cli/_deploy/packaging.ts
-import * as fs30 from "fs";
-import * as path29 from "path";
+import * as fs31 from "fs";
+import * as path30 from "path";
 import {
   findSubProjectRoot as findSubProjectRoot11,
   loadStudioToml as loadStudioToml15
@@ -12087,9 +12424,9 @@ function agentRootOf2(root) {
   return findSubProjectRoot11("agent", root);
 }
 function agentTable(agentRoot2, key) {
-  const tomlPath = path29.join(agentRoot2, "studio.toml");
+  const tomlPath = path30.join(agentRoot2, "studio.toml");
   try {
-    if (!fs30.statSync(tomlPath).isFile()) {
+    if (!fs31.statSync(tomlPath).isFile()) {
       return {};
     }
   } catch {
@@ -12156,10 +12493,10 @@ function checkPackagingDrift(root, destination, walletKind2, force) {
     );
     return 1;
   }
-  const dockerfile = path29.join(agentRoot2, "Dockerfile");
+  const dockerfile = path30.join(agentRoot2, "Dockerfile");
   let dockerfilePresent = false;
   try {
-    dockerfilePresent = fs30.statSync(dockerfile).isFile();
+    dockerfilePresent = fs31.statSync(dockerfile).isFile();
   } catch {
     dockerfilePresent = false;
   }
@@ -12200,7 +12537,7 @@ function deployWalletKindSafe(root) {
   }
   let cfg;
   try {
-    cfg = loadStudioToml15(path29.join(agentRoot2, "studio.toml"));
+    cfg = loadStudioToml15(path30.join(agentRoot2, "studio.toml"));
   } catch {
     return "evm-local";
   }
@@ -12213,22 +12550,22 @@ function deployWalletKindSafe(root) {
 import { findStudioWorkspaceRoot as findStudioWorkspaceRoot2 } from "@bnbagent/studio-runtime/config";
 
 // src/cli/_deploy/checks/blocked.ts
-import * as fs31 from "fs";
-import * as path30 from "path";
+import * as fs32 from "fs";
+import * as path31 from "path";
 import {
   findSubProjectRoot as findSubProjectRoot12,
   loadStudioToml as loadStudioToml16
 } from "@bnbagent/studio-runtime/config";
-function isFile12(p) {
+function isFile13(p) {
   try {
-    return fs31.statSync(p).isFile();
+    return fs32.statSync(p).isFile();
   } catch {
     return false;
   }
 }
 function isDir6(p) {
   try {
-    return fs31.statSync(p).isDirectory();
+    return fs32.statSync(p).isDirectory();
   } catch {
     return false;
   }
@@ -12239,8 +12576,8 @@ async function checkStudioTomlPresent(root, _target) {
     agent: findSubProjectRoot12("agent", root)
   };
   for (const [side, subRoot] of Object.entries(layers)) {
-    const tomlPath = subRoot === null ? null : path30.join(subRoot, "studio.toml");
-    if (tomlPath === null || !isFile12(tomlPath)) {
+    const tomlPath = subRoot === null ? null : path31.join(subRoot, "studio.toml");
+    if (tomlPath === null || !isFile13(tomlPath)) {
       out.push({
         level: Level.BLOCKED,
         name: "studio_toml_present",
@@ -12264,8 +12601,8 @@ async function checkStudioTomlPresent(root, _target) {
   return out;
 }
 async function checkCwdIsProjectRoot(root, _target) {
-  const cwd = path30.resolve(process.cwd());
-  const rr = path30.resolve(root);
+  const cwd = path31.resolve(process.cwd());
+  const rr = path31.resolve(root);
   if (cwd !== rr) {
     return [
       {
@@ -12279,7 +12616,7 @@ async function checkCwdIsProjectRoot(root, _target) {
   return [];
 }
 async function checkNoSecretInGitHistory(root, _target) {
-  if (!isDir6(path30.join(root, ".git"))) {
+  if (!isDir6(path31.join(root, ".git"))) {
     return [];
   }
   const needles = [".env.local", "WALLET_PASSWORD"];
@@ -12317,8 +12654,8 @@ var allChecks2 = [
 ];
 
 // src/cli/_deploy/checks/info.ts
-import * as fs32 from "fs";
-import * as path31 from "path";
+import * as fs33 from "fs";
+import * as path32 from "path";
 async function checkPreviousDeployStatus(root, _target) {
   const deploy = tableOf2(loadAgentToml(root), "deploy");
   const last = deploy.last_deploy_at;
@@ -12342,10 +12679,10 @@ async function checkPreviousDeployStatus(root, _target) {
   ];
 }
 async function checkInstalledRecipesList(root, _target) {
-  const manifest = path31.join(root, ".studio", "recipes", "manifest.json");
+  const manifest = path32.join(root, ".studio", "recipes", "manifest.json");
   let exists = false;
   try {
-    exists = fs32.statSync(manifest).isFile();
+    exists = fs33.statSync(manifest).isFile();
   } catch {
     exists = false;
   }
@@ -12361,7 +12698,7 @@ async function checkInstalledRecipesList(root, _target) {
   }
   let data;
   try {
-    data = JSON.parse(fs32.readFileSync(manifest, "utf-8"));
+    data = JSON.parse(fs33.readFileSync(manifest, "utf-8"));
   } catch {
     return [
       {
@@ -12464,8 +12801,8 @@ var allChecks3 = [
 ];
 
 // src/cli/_deploy/checks/platform.ts
-import * as fs34 from "fs";
-import * as path33 from "path";
+import * as fs35 from "fs";
+import * as path34 from "path";
 import {
   findSubProjectRoot as findSubProjectRoot13,
   loadStudioToml as loadStudioToml17
@@ -12474,16 +12811,16 @@ import { BSC_TESTNET_FAUCET_URLS } from "@bnbagent/studio-runtime/networks";
 
 // src/cli/_deploy/checks/warning.ts
 import * as crypto4 from "crypto";
-import * as fs33 from "fs";
-import * as path32 from "path";
+import * as fs34 from "fs";
+import * as path33 from "path";
 import { envLocalPath as envLocalPath14 } from "@bnbagent/studio-runtime/config";
 import { show } from "@bnbagent/studio-runtime/erc8004";
 import { DEFAULT_RPC, getNetwork as getNetwork8 } from "@bnbagent/studio-runtime/networks";
 import * as walletRt3 from "@bnbagent/studio-runtime/wallet";
 var TBNB_MIN_WEI = 7n * 10n ** 15n;
-function isFile13(p) {
+function isFile14(p) {
   try {
-    return fs33.statSync(p).isFile();
+    return fs34.statSync(p).isFile();
   } catch {
     return false;
   }
@@ -12686,10 +13023,10 @@ async function checkRuntimeRpcReachable(root, _target) {
   return [];
 }
 async function checkInstalledRecipesUnchanged(root, _target) {
-  const manifest = path32.join(root, ".studio", "recipes", "manifest.json");
+  const manifest = path33.join(root, ".studio", "recipes", "manifest.json");
   let data;
   try {
-    data = JSON.parse(fs33.readFileSync(manifest, "utf-8"));
+    data = JSON.parse(fs34.readFileSync(manifest, "utf-8"));
   } catch {
     return [];
   }
@@ -12704,11 +13041,11 @@ async function checkInstalledRecipesUnchanged(root, _target) {
     if (!rel || !expected || typeof rel !== "string") {
       continue;
     }
-    const p = path32.join(root, rel);
-    if (!isFile13(p)) {
+    const p = path33.join(root, rel);
+    if (!isFile14(p)) {
       continue;
     }
-    const actual = crypto4.createHash("sha256").update(fs33.readFileSync(p)).digest("hex");
+    const actual = crypto4.createHash("sha256").update(fs34.readFileSync(p)).digest("hex");
     if (actual !== expected) {
       stale.push(rel);
     }
@@ -12725,59 +13062,6 @@ async function checkInstalledRecipesUnchanged(root, _target) {
   }
   return [];
 }
-function agentcoreAuthorizer(root) {
-  const descriptor = path32.join(root, "agentcore", "agentcore.json");
-  let data;
-  try {
-    data = JSON.parse(fs33.readFileSync(descriptor, "utf-8"));
-  } catch {
-    return null;
-  }
-  if (data === null || typeof data !== "object" || Array.isArray(data)) {
-    return null;
-  }
-  const runtimes = data.runtimes;
-  if (!Array.isArray(runtimes)) {
-    return null;
-  }
-  for (const rt of runtimes) {
-    if (rt === null || typeof rt !== "object") {
-      continue;
-    }
-    const auth = rt.authorizerConfiguration;
-    if (auth !== null && typeof auth === "object" && !Array.isArray(auth)) {
-      const jwt = auth.customJwtAuthorizer ?? auth.customJWTAuthorizer;
-      if (jwt !== null && typeof jwt === "object" && !Array.isArray(jwt)) {
-        return jwt;
-      }
-    }
-  }
-  return null;
-}
-async function checkCognitoAuthorizerConfigured(root, target) {
-  if (target !== "agentcore") {
-    return [];
-  }
-  const jwt = agentcoreAuthorizer(root);
-  const discovery = jwt?.discoveryUrl;
-  const clients = jwt?.allowedClients;
-  const configured = Boolean(discovery) && Array.isArray(clients) && clients.length > 0;
-  if (configured) {
-    return [];
-  }
-  return [
-    {
-      level: Level.WARNING,
-      name: "cognito_authorizer_configured",
-      message: "no Cognito authorizer configured in agentcore.json (authorizerConfiguration.customJwtAuthorizer.discoveryUrl/allowedClients) \u2192 the A2A endpoint will require SigV4/AWS creds; external buyers can't reach it. Run `bag deploy provision-cognito`, then paste the CDK outputs into the authorizer.",
-      fixCmd: "bag deploy provision-cognito",
-      details: {
-        discovery_url_set: Boolean(discovery),
-        allowed_clients: Array.isArray(clients) ? clients : []
-      }
-    }
-  ];
-}
 async function checkStorageLocalNotDeployable(root, _target) {
   const storage = loadAgentToml(root).storage;
   if (storage === null || typeof storage !== "object" || Array.isArray(storage) || String(storage.kind ?? "").toLowerCase() !== "local") {
@@ -12802,7 +13086,6 @@ var allChecks4 = [
   checkRpcUrlSetForRuntime,
   checkRuntimeRpcReachable,
   checkInstalledRecipesUnchanged,
-  checkCognitoAuthorizerConfigured,
   checkStorageLocalNotDeployable
 ];
 
@@ -12813,11 +13096,11 @@ function tableOf11(data, key) {
   return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
 function agentRoot(root) {
-  return findSubProjectRoot13("agent", root) ?? path33.join(root, "app", "agent");
+  return findSubProjectRoot13("agent", root) ?? path34.join(root, "app", "agent");
 }
 function loadAgent(root) {
   try {
-    return loadStudioToml17(path33.join(agentRoot(root), "studio.toml"));
+    return loadStudioToml17(path34.join(agentRoot(root), "studio.toml"));
   } catch {
     return {};
   }
@@ -12837,10 +13120,10 @@ var checkPlatformEntrypointPresent = async (root, _target) => {
   const filenames = [`${stem2}.ts`];
   if (stem2 === "dualMain") filenames.push("mcpMain.ts");
   const filename = filenames.find(
-    (candidate) => !fs34.existsSync(path33.join(agentRoot(root), "src", candidate))
+    (candidate) => !fs35.existsSync(path34.join(agentRoot(root), "src", candidate))
   );
   if (filename === void 0) return [];
-  const expected = path33.join(agentRoot(root), "src", filename);
+  const expected = path34.join(agentRoot(root), "src", filename);
   return [
     {
       level: Level.CRITICAL,
@@ -12854,18 +13137,18 @@ var checkPlatformKeystoreNotInArtifact = async (root, _target) => {
   const data = loadAgent(root);
   const wallet = tableOf11(data, "wallet");
   if (String(wallet.kind ?? "evm-local") === "twak") return [];
-  const agent = path33.resolve(agentRoot(root));
+  const agent = path34.resolve(agentRoot(root));
   const configured = String(wallet.keystore_dir ?? ".studio/wallets");
-  const keystore = path33.resolve(agent, configured);
+  const keystore = path34.resolve(agent, configured);
   let jsonFiles;
   try {
-    jsonFiles = fs34.readdirSync(keystore).filter((name) => name.endsWith(".json"));
+    jsonFiles = fs35.readdirSync(keystore).filter((name) => name.endsWith(".json"));
   } catch {
     return [];
   }
   if (jsonFiles.length === 0) return [];
-  const rel = path33.relative(agent, keystore);
-  if (rel.startsWith("..") || path33.isAbsolute(rel)) return [];
+  const rel = path34.relative(agent, keystore);
+  if (rel.startsWith("..") || path34.isAbsolute(rel)) return [];
   return [
     {
       level: Level.CRITICAL,
@@ -13092,7 +13375,7 @@ async function runProducers(producers, root, target) {
 }
 
 // src/cli/_deploy/verify.ts
-import * as path35 from "path";
+import * as path36 from "path";
 import {
   findSubProjectRoot as findSubProjectRoot14,
   loadStudioToml as loadStudioToml18
@@ -13105,11 +13388,11 @@ import {
 import * as walletRt4 from "@bnbagent/studio-runtime/wallet";
 
 // src/cli/_identity.ts
-import * as fs35 from "fs";
-import * as path34 from "path";
+import * as fs36 from "fs";
+import * as path35 from "path";
 function writeIdentityBlock(root, identity) {
-  const p = path34.join(root, "studio.toml");
-  const text2 = fs35.readFileSync(p, "utf-8");
+  const p = path35.join(root, "studio.toml");
+  const text2 = fs36.readFileSync(p, "utf-8");
   const lines = text2.split(/\r?\n/);
   if (lines.length > 0 && lines[lines.length - 1] === "") {
     lines.pop();
@@ -13148,7 +13431,7 @@ function writeIdentityBlock(root, identity) {
     }
   }
   out.push("");
-  fs35.writeFileSync(p, out.join("\n"), "utf-8");
+  fs36.writeFileSync(p, out.join("\n"), "utf-8");
 }
 
 // src/cli/_deploy/verify.ts
@@ -13256,6 +13539,7 @@ function baseResult(endpoint, runtime, overrides) {
     studioTomlUpdated: false,
     runtime,
     note: null,
+    warning: null,
     error: null,
     exitCode: 0,
     ...overrides
@@ -13265,7 +13549,7 @@ async function runVerify(opts) {
   const endpoint = opts.endpoint;
   const runtime = opts.runtime ?? "agentcore";
   const skipRegister = opts.skipRegister ?? false;
-  const start = opts.projectRoot ? path35.resolve(opts.projectRoot) : void 0;
+  const start = opts.projectRoot ? path36.resolve(opts.projectRoot) : void 0;
   const root = findSubProjectRoot14("agent", start);
   if (root === null) {
     return baseResult(endpoint, runtime, {
@@ -13285,7 +13569,7 @@ async function runVerify(opts) {
   }
   let data;
   try {
-    data = loadStudioToml18(path35.join(root, "studio.toml"));
+    data = loadStudioToml18(path36.join(root, "studio.toml"));
   } catch (exc) {
     return baseResult(endpoint, runtime, {
       awsAccount,
@@ -13311,6 +13595,7 @@ async function runVerify(opts) {
   let action = "none";
   let registerError = null;
   let postWriteError = null;
+  let postWriteWarning = null;
   let registerNote = null;
   let identityPendingReason = null;
   let registerExitCode = 0;
@@ -13343,9 +13628,8 @@ async function runVerify(opts) {
             const cause = e.cause !== null && typeof e.cause === "object" ? e.cause : null;
             const relayTxHash = typeof cause?.txHash === "string" ? cause.txHash : e.txHash;
             action = "register_partial";
-            postWriteError = relayTxHash ? `ERC-8004 register created agent_id=${e.agentId}, but setAgentURI relay tx_hash=${relayTxHash} was not observed by the chain RPC. Run \`bag erc8004 clear-pending\` to reconcile, then retry \`bag erc8004 update-endpoint\`.` : `ERC-8004 register created agent_id=${e.agentId}, but the setAgentURI relay submission was not observed by the chain RPC. Run \`bag erc8004 clear-pending\` to reconcile, then retry \`bag erc8004 update-endpoint\`.`;
+            postWriteWarning = relayTxHash ? `ERC-8004 register created agent_id=${e.agentId}, but setAgentURI relay tx_hash=${relayTxHash} was not observed by the chain RPC. Run \`bag erc8004 clear-pending\` to reconcile, then retry \`bag erc8004 update-endpoint\`.` : `ERC-8004 register created agent_id=${e.agentId}, but the setAgentURI relay submission was not observed by the chain RPC. Run \`bag erc8004 clear-pending\` to reconcile, then retry \`bag erc8004 update-endpoint\`.`;
             identityPendingReason = "setAgentURI relay submission unverified; run bag erc8004 clear-pending before retrying";
-            registerExitCode = 1;
           } else if (e.txHash) {
             action = "register_pending";
             registerNote = `ERC-8004 register created agent_id=${e.agentId}; setAgentURI tx pending (${e.txHash}). Check the tx before retrying \`bag erc8004 update-endpoint\`.`;
@@ -13439,14 +13723,15 @@ async function runVerify(opts) {
     action,
     studioTomlUpdated,
     note: notes.length > 0 ? notes.join(" | ") : null,
+    warning: postWriteWarning,
     error: postWriteError,
     exitCode: registerExitCode
   });
 }
 
 // src/cli/_hosted/deployOps.ts
-import * as fs36 from "fs";
-import * as path36 from "path";
+import * as fs37 from "fs";
+import * as path37 from "path";
 import {
   envLocalPath as envLocalPath15,
   findSubProjectRoot as findSubProjectRoot15,
@@ -13457,7 +13742,12 @@ var PLATFORM_SECTION = "deploy.platform";
 var WALLET_SECTION = "wallet";
 var KEYSTORE_JSON_ENV2 = "WALLET_KEYSTORE_JSON";
 var TWAK_WALLET_JSON_ENV2 = "TWAK_WALLET_JSON";
-var WALLET_MATERIAL_KEYS = [KEYSTORE_JSON_ENV2, TWAK_WALLET_JSON_ENV2];
+var ALTANA_SESSION_ENV2 = "ALTANA_SESSION";
+var WALLET_MATERIAL_KEYS = [
+  KEYSTORE_JSON_ENV2,
+  TWAK_WALLET_JSON_ENV2,
+  ALTANA_SESSION_ENV2
+];
 var RETIRED_AGENT_STATES = /* @__PURE__ */ new Set([
   "deleted",
   "retired",
@@ -13487,8 +13777,8 @@ function agentTomlPath2(root) {
   if (agentRoot2 === null) {
     return null;
   }
-  const tomlPath = path36.join(agentRoot2, "studio.toml");
-  return isFile14(tomlPath) ? tomlPath : null;
+  const tomlPath = path37.join(agentRoot2, "studio.toml");
+  return isFile15(tomlPath) ? tomlPath : null;
 }
 function loadAgentCfg(root) {
   const tomlPath = agentTomlPath2(root);
@@ -13505,12 +13795,12 @@ function platformCfg(root) {
   return tableOf12(tableOf12(loadAgentCfg(root), "deploy"), "platform");
 }
 function patchTomlKv2(tomlPath, section, key, value) {
-  let text2 = fs36.readFileSync(tomlPath, "utf-8");
+  let text2 = fs37.readFileSync(tomlPath, "utf-8");
   if (!hasSection(text2, section)) {
     text2 = addSection(text2, section);
   }
   text2 = hasKey(text2, section, key) ? setExistingKey(text2, section, key, value) : addKeyToSection(text2, section, key, value);
-  fs36.writeFileSync(tomlPath, text2);
+  fs37.writeFileSync(tomlPath, text2);
 }
 function recordPlatformKv(root, key, value) {
   const tomlPath = agentTomlPath2(root);
@@ -13609,8 +13899,8 @@ function clearIdentityEndpointIfMatches(root, oldUrl) {
   }
 }
 function persistedPackaging2(agentRoot2) {
-  const tomlPath = path36.join(agentRoot2, "studio.toml");
-  if (!isFile14(tomlPath)) {
+  const tomlPath = path37.join(agentRoot2, "studio.toml");
+  if (!isFile15(tomlPath)) {
     return null;
   }
   try {
@@ -13622,8 +13912,8 @@ function persistedPackaging2(agentRoot2) {
   }
 }
 function resolvePlatformArtifact2(agentRoot2) {
-  const tomlPath = path36.join(agentRoot2, "studio.toml");
-  if (isFile14(tomlPath)) {
+  const tomlPath = path37.join(agentRoot2, "studio.toml");
+  if (isFile15(tomlPath)) {
     try {
       const cfg = loadStudioToml19(tomlPath);
       const explicit = tableOf12(cfg, "deploy").platform_artifact;
@@ -13646,7 +13936,7 @@ function platformPackaging(root) {
 }
 function loadCfgAt(agentRoot2) {
   try {
-    return loadStudioToml19(path36.join(agentRoot2, "studio.toml"));
+    return loadStudioToml19(path37.join(agentRoot2, "studio.toml"));
   } catch {
     return {};
   }
@@ -13723,7 +14013,7 @@ function resolveSlug(root) {
   let name = String(tableOf12(loadAgentCfg(root), "project").name ?? "");
   name = name.replace(/-(agent|service)$/, "");
   if (!name) {
-    name = path36.basename(findWorkspaceRoot6(root) ?? root);
+    name = path37.basename(findWorkspaceRoot6(root) ?? root);
   }
   let base = name.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
   base = base || "agent";
@@ -13965,6 +14255,19 @@ function walletWarning(root, secrets) {
     return;
   }
   const address = tableOf12(loadAgentCfg(root), "wallet").address;
+  if (ALTANA_SESSION_ENV2 in secrets) {
+    const who2 = typeof address === "string" && address ? ` (wallet ${address})` : "";
+    warn(
+      `
+!!! session exposure (platform trial) !!!
+  This project's bounded Altana session${who2} will be transmitted to the BNB Chain operator's Secrets Manager so the trial runtime can sign on testnet. The session is budget-limited, expiring, and revocable \u2014 the admin keystore and WALLET_PASSWORD never ship.
+  If the current budget or expiry is wider than you want an operator-held key to carry, stop and grant a tighter one first:
+      bag wallet session grant --force --budget-u <small> --expiry-days <short>
+  You can revoke it on-chain at any time with \`bag wallet session revoke\`.
+`
+    );
+    return;
+  }
   const who = typeof address === "string" && address ? `key (address ${address})` : "signing key";
   warn(
     `
@@ -14181,15 +14484,15 @@ function printAgentClientPrompt(root, invokeUrl, status) {
 }
 function persistDeploySummary(root, text2) {
   try {
-    if (!fs36.statSync(path36.resolve(root)).isDirectory()) {
+    if (!fs37.statSync(path37.resolve(root)).isDirectory()) {
       return null;
     }
-    const p = path36.join(
-      path36.dirname(envLocalPath15(root)),
+    const p = path37.join(
+      path37.dirname(envLocalPath15(root)),
       "last-deploy-summary.txt"
     );
-    fs36.mkdirSync(path36.dirname(p), { recursive: true });
-    fs36.writeFileSync(p, `${text2}
+    fs37.mkdirSync(path37.dirname(p), { recursive: true });
+    fs37.writeFileSync(p, `${text2}
 `);
     return p;
   } catch {
@@ -14344,9 +14647,9 @@ async function deletePlatformAgent(slug, deps = {}) {
   }
   return 0;
 }
-function isFile14(p) {
+function isFile15(p) {
   try {
-    return fs36.statSync(p).isFile();
+    return fs37.statSync(p).isFile();
   } catch {
     return false;
   }
@@ -14359,16 +14662,16 @@ var ADVERTISED_DEPLOY_RUNTIME_TARGETS = ["agentcore"];
 // src/cli/deploy.ts
 var TARGET_CHOICES = [...DEPLOY_RUNTIME_TARGETS];
 var ADVERTISED_TARGET_CHOICES = [...ADVERTISED_DEPLOY_RUNTIME_TARGETS];
-function isFile15(p) {
+function isFile16(p) {
   try {
-    return fs37.statSync(p).isFile();
+    return fs38.statSync(p).isFile();
   } catch {
     return false;
   }
 }
 function isDir7(p) {
   try {
-    return fs37.statSync(p).isDirectory();
+    return fs38.statSync(p).isDirectory();
   } catch {
     return false;
   }
@@ -14385,8 +14688,8 @@ function loadAgentCfg2(root) {
   if (agentRoot2 === null) {
     return null;
   }
-  const tomlPath = path37.join(agentRoot2, "studio.toml");
-  if (!isFile15(tomlPath)) {
+  const tomlPath = path38.join(agentRoot2, "studio.toml");
+  if (!isFile16(tomlPath)) {
     return null;
   }
   try {
@@ -14548,8 +14851,8 @@ function registerDeploy(program) {
   p.command("fix-gitignore").description(
     "Ensure the workspace .gitignore excludes .studio/ (the agent's .env.local + keystore)."
   ).option("--project-root <path>", "Override project root.").action(act((opts) => cmdFixGitignore(opts)));
-  p.command("provision-cognito").description(
-    "Emit an AWS CDK app under agentcore/cognito/ that provisions a Cognito M2M client for the AgentCore A2A inbound OAuth2 authorizer (studio writes IaC + prints steps; you run `cdk deploy`)."
+  p.command("provision-cognito", { hidden: true }).description(
+    "DEPRECATED \u2014 `bag deploy` provisions inbound OAuth by itself. Emit an AWS CDK app under agentcore/cognito/ that provisions a Cognito M2M client for the AgentCore inbound OAuth2 authorizer (studio writes IaC + prints steps; you run `cdk deploy`)."
   ).option("--project-root <path>", "Override project root.").option(
     "--wire [outputsFile]",
     "After you `cdk deploy --outputs-file <file>`, wire those outputs into agentcore.json + .studio/.env.local (default file: agentcore/cognito/cdk-outputs.json). Pure local file I/O \u2014 studio never calls AWS."
@@ -14563,9 +14866,9 @@ function applyProjectRoot(projectRoot, requireToml = true) {
   if (projectRoot === void 0) {
     return null;
   }
-  const p = path37.resolve(projectRoot);
+  const p = path38.resolve(projectRoot);
   const agentRoot2 = findSubProjectRoot16("agent", p);
-  if (requireToml && !isFile15(path37.join(p, "studio.toml")) && (agentRoot2 === null || !isFile15(path37.join(agentRoot2, "studio.toml")))) {
+  if (requireToml && !isFile16(path38.join(p, "studio.toml")) && (agentRoot2 === null || !isFile16(path38.join(agentRoot2, "studio.toml")))) {
     printErr(`error: no studio.toml under --project-root ${p}`);
     return 2;
   }
@@ -14577,7 +14880,7 @@ function applyProjectRoot(projectRoot, requireToml = true) {
   return null;
 }
 function resolveProjectRoot2(_projectRoot) {
-  const cwd = path37.resolve(process.cwd());
+  const cwd = path38.resolve(process.cwd());
   return findStudioWorkspaceRoot3(cwd) ?? cwd;
 }
 function deployWorkspaceRoot2(root) {
@@ -14608,12 +14911,17 @@ function agentDeployDestination(root) {
 }
 function resolveTarget(opts, root, destination = agentDeployDestination(root)) {
   const explicit = opts.runtime ?? opts.target;
-  if (explicit) {
-    return explicit;
-  }
   if (destination === "platform") {
+    if (explicit && explicit !== "platform") {
+      printErr(
+        `warning: --runtime=${explicit} ignored \u2014 studio.toml has [deploy].destination = 'platform', which selects the managed deploy path and its own checks. Use --provider bnb|aws to pick where this agent deploys.`
+      );
+    }
     return "platform";
   }
+  if (explicit) {
+    return explicit;
+  }
   return readStackRuntime(root) ?? "agentcore";
 }
 function validateRuntimeAgainstStack(target, force, root) {
@@ -14638,7 +14946,7 @@ function validateRuntimeAgainstStack(target, force, root) {
 async function cmdPrepare(opts) {
   let root;
   if (opts.projectRoot !== void 0) {
-    const p = path37.resolve(opts.projectRoot);
+    const p = path38.resolve(opts.projectRoot);
     if (!isDir7(p)) {
       printErr(`error: --project-root ${p} is not a directory`);
       return 2;
@@ -14646,7 +14954,7 @@ async function cmdPrepare(opts) {
     process.chdir(p);
     root = findStudioWorkspaceRoot3(p) ?? p;
   } else {
-    const cwd = path37.resolve(process.cwd());
+    const cwd = path38.resolve(process.cwd());
     root = findStudioWorkspaceRoot3(cwd) ?? cwd;
   }
   const target = resolveTarget(opts, root);
@@ -14788,8 +15096,8 @@ function writeAgentDeployState(workspaceRoot, arn, record = {}, destination = "s
   if (agentRoot2 === null) {
     return;
   }
-  const tomlPath = path37.join(agentRoot2, "studio.toml");
-  if (!isFile15(tomlPath)) {
+  const tomlPath = path38.join(agentRoot2, "studio.toml");
+  if (!isFile16(tomlPath)) {
     return;
   }
   try {
@@ -14820,6 +15128,12 @@ function writeAgentDeployState(workspaceRoot, arn, record = {}, destination = "s
     if (scope) {
       setEnvVar(envLocalPath16(agentRoot2), "OAUTH_SCOPE", scope);
     }
+    syncDescriptorOauthFacts(workspaceRoot, {
+      tokenUrl,
+      scope,
+      discoveryUrl,
+      clientId
+    });
     if (persistedPackaging(agentRoot2) === null) {
       patchTomlKv(
         tomlPath,
@@ -14861,10 +15175,10 @@ package and at the repo root).
 `;
 function iamNoticeTomlPath(root) {
   const agentRoot2 = findSubProjectRoot16("agent", root) ?? root;
-  return path37.join(agentRoot2, "studio.toml");
+  return path38.join(agentRoot2, "studio.toml");
 }
 function iamNoticeAccepted(tomlPath) {
-  if (!isFile15(tomlPath)) {
+  if (!isFile16(tomlPath)) {
     return false;
   }
   let data;
@@ -14915,7 +15229,7 @@ async function iamNoticeGate(root, acceptRisk) {
   return 1;
 }
 async function buildAgentProject(agentRoot2, packaging) {
-  if (!isFile15(path37.join(agentRoot2, "package.json"))) {
+  if (!isFile16(path38.join(agentRoot2, "package.json"))) {
     printErr(
       `warning: no package.json under ${agentRoot2} \u2014 skipping the agent \`pnpm build\`; bnbagent-deploy will package whatever dist/ holds.`
     );
@@ -15085,6 +15399,17 @@ async function refreshLocalDeployDependencies(root) {
     return 1;
   }
 }
+function partialDeployCleanupNote(workspaceRoot) {
+  const project = projectName(workspaceRoot);
+  return [
+    "note: a deploy that fails partway can leave these behind (they are reused by a successful retry, so clean up only if you are giving up):",
+    `  - ECR image            bnbagent/${project}`,
+    `  - Secrets Manager      bnbagent/${project}/runtime`,
+    `  - Cognito M2M client   bnbagent-${project}`,
+    `  - IAM role             bnbagent-${project}-runtime`,
+    "  `bag deploy destroy --provider aws --execute` removes the runtime, secret, and M2M client; add --purge for the ECR repository and log groups. The IAM role is deleted with the runtime it was created for."
+  ].join("\n");
+}
 async function cmdAgent(opts, agentcoreArgs) {
   let rc = applyProjectRoot(opts.projectRoot);
   if (rc !== null) {
@@ -15095,12 +15420,6 @@ async function cmdAgent(opts, agentcoreArgs) {
   const packagingDestination = opts.to ?? opts.destination ?? agentDeployDestination(root);
   const driftAgentRoot = findSubProjectRoot16("agent", root) ?? root;
   const driftKind = deployWalletKind(driftAgentRoot);
-  if (driftKind === "altana") {
-    printErr(
-      "error: Altana deployment is deferred in this release. `bag dev` uses the bounded session locally, but no deploy adapter may receive the admin key or an unreviewed session transport. No packaging or external deploy calls were started."
-    );
-    return 2;
-  }
   rc = checkPackagingDrift(
     root,
     packagingDestination,
@@ -15243,7 +15562,7 @@ async function cmdAgent(opts, agentcoreArgs) {
     packagingDestination,
     resolvePlatformArtifact(agentRoot2)
   ) === "container" ? "container" : "zip";
-  const walletBlurb = walletKind2 === "twak" ? "the encrypted twak wallet as TWAK_WALLET_JSON" : "the encrypted keystore as WALLET_KEYSTORE_JSON";
+  const walletBlurb = walletKind2 === "twak" ? "the encrypted twak wallet as TWAK_WALLET_JSON" : walletKind2 === "altana" ? "the bounded Altana session as ALTANA_SESSION \u2014 the admin keystore and WALLET_PASSWORD never ship" : "the encrypted keystore as WALLET_KEYSTORE_JSON";
   if (secretsMode === "envvars") {
     printErr(
       `note: --secrets-mode envvars inlines the runtime secrets (incl. ${walletBlurb}) as PLAINTEXT runtime env vars in the deploy spec \u2014 testnet only, refused on mainnet.`
@@ -15296,6 +15615,7 @@ async function cmdAgent(opts, agentcoreArgs) {
     printErr(
       "note: the pinned bnbagent-deploy adapter automatically restores an owned runtime secret that is inside its recovery window. If AWS denies that operation, update the deployer policy to include secretsmanager:RestoreSecret."
     );
+    printErr(partialDeployCleanupNote(workspaceRoot));
     return code;
   }
   const record = recordOf2(data);
@@ -15360,7 +15680,7 @@ function recordedEndpoint(root) {
 }
 function recordedAgentId(agentRoot2) {
   try {
-    const cfg = loadStudioToml20(path37.join(agentRoot2, "studio.toml"));
+    const cfg = loadStudioToml20(path38.join(agentRoot2, "studio.toml"));
     const val = tableOf13(cfg, "identity").agent_id;
     return val !== void 0 && val !== null && val !== "" ? String(val) : null;
   } catch {
@@ -15369,7 +15689,7 @@ function recordedAgentId(agentRoot2) {
 }
 function recordedRuntimeArn(agentRoot2) {
   try {
-    const cfg = loadStudioToml20(path37.join(agentRoot2, "studio.toml"));
+    const cfg = loadStudioToml20(path38.join(agentRoot2, "studio.toml"));
     const val = tableOf13(cfg, "deploy").runtime_arn;
     return val ? String(val) : null;
   } catch {
@@ -15378,7 +15698,7 @@ function recordedRuntimeArn(agentRoot2) {
 }
 function recordedOauthClientId(agentRoot2) {
   try {
-    const cfg = loadStudioToml20(path37.join(agentRoot2, "studio.toml"));
+    const cfg = loadStudioToml20(path38.join(agentRoot2, "studio.toml"));
     const val = tableOf13(cfg, "deploy").oauth_client_id;
     return val ? String(val) : null;
   } catch {
@@ -15387,7 +15707,7 @@ function recordedOauthClientId(agentRoot2) {
 }
 function agentFacesOf(agentRoot2) {
   try {
-    const cfg = loadStudioToml20(path37.join(agentRoot2, "studio.toml"));
+    const cfg = loadStudioToml20(path38.join(agentRoot2, "studio.toml"));
     return stackFaces(tableOf13(cfg, "stack"), tableOf13(cfg, "payments"));
   } catch {
     return ["A2A"];
@@ -15539,15 +15859,15 @@ async function printAgentClientPrompt2(root, destination, opts = {}) {
 }
 function persistDeploySummary2(root, text2) {
   try {
-    if (!fs37.statSync(path37.resolve(root)).isDirectory()) {
+    if (!fs38.statSync(path38.resolve(root)).isDirectory()) {
       return null;
     }
-    const p = path37.join(
-      path37.dirname(envLocalPath16(root)),
+    const p = path38.join(
+      path38.dirname(envLocalPath16(root)),
       "last-deploy-summary.txt"
     );
-    fs37.mkdirSync(path37.dirname(p), { recursive: true });
-    fs37.writeFileSync(p, `${text2}
+    fs38.mkdirSync(path38.dirname(p), { recursive: true });
+    fs38.writeFileSync(p, `${text2}
 `, "utf-8");
     return p;
   } catch {
@@ -15638,6 +15958,7 @@ function verifyToJson(r) {
     studio_toml_updated: r.studioTomlUpdated,
     runtime: r.runtime,
     note: r.note,
+    warning: r.warning,
     error: r.error,
     exit_code: r.exitCode
   };
@@ -15679,6 +16000,9 @@ function renderVerifyHuman(r, deployment, liveStatus) {
   if (r.note) {
     printOut(`note: ${r.note}`);
   }
+  if (r.warning) {
+    printOut(`warning: ${r.warning}`);
+  }
   if (r.error) {
     printOut(`error: ${r.error}`);
   }
@@ -15940,9 +16264,9 @@ async function cmdDestroy(opts) {
         return 2;
       }
       const answer = await promptUser(
-        `This delegates the teardown of "${path37.basename(workspaceRoot)}" (Foundry hosted agent + the resources its deploy record tracks) to bnbagent-deploy. Type the project name to proceed: `
+        `This delegates the teardown of "${path38.basename(workspaceRoot)}" (Foundry hosted agent + the resources its deploy record tracks) to bnbagent-deploy. Type the project name to proceed: `
       );
-      if (answer.trim() !== path37.basename(workspaceRoot)) {
+      if (answer.trim() !== path38.basename(workspaceRoot)) {
         printErr(
           "error: confirmation did not match the project name; aborting."
         );
@@ -16026,6 +16350,7 @@ async function cmdFixGitignore(opts) {
   printOut(`${marker} ${result.name}: ${result.message}`);
   return 0;
 }
+var PROVISION_COGNITO_DEPRECATION = "warning: `bag deploy provision-cognito` is deprecated and will be removed.\n  `bag deploy` provisions the inbound OAuth user pool and M2M client on its\n  own; the pool this CDK app stands up is never used by a deploy, and both\n  the stack and its client are billable orphans you have to clean up.\n  Run `bag deploy --provider aws` directly instead.";
 async function cmdProvisionCognito(opts) {
   const rc = applyProjectRoot(opts.projectRoot, false);
   if (rc !== null) {
@@ -16033,6 +16358,7 @@ async function cmdProvisionCognito(opts) {
   }
   const root = resolveProjectRoot2(opts.projectRoot);
   const workspaceRoot = deployWorkspaceRoot2(root);
+  printOut(PROVISION_COGNITO_DEPRECATION);
   if (opts.wire !== void 0 && opts.wire !== false) {
     const outputsFile = typeof opts.wire === "string" && opts.wire ? opts.wire : null;
     try {
@@ -16056,8 +16382,8 @@ async function cmdProvisionCognito(opts) {
 
 // src/cli/doctor.ts
 import * as crypto5 from "crypto";
-import * as fs38 from "fs";
-import * as path38 from "path";
+import * as fs39 from "fs";
+import * as path39 from "path";
 import { EVMWalletProvider as EVMWalletProvider2 } from "@bnbagent/sdk";
 import {
   envLocalPath as envLocalPath17,
@@ -16103,23 +16429,23 @@ function tableOf14(cfg, key) {
   const v = cfg[key];
   return v !== null && typeof v === "object" && !Array.isArray(v) ? v : {};
 }
-function isFile16(p) {
+function isFile17(p) {
   try {
-    return fs38.statSync(p).isFile();
+    return fs39.statSync(p).isFile();
   } catch {
     return false;
   }
 }
 function isDir8(p) {
   try {
-    return fs38.statSync(p).isDirectory();
+    return fs39.statSync(p).isDirectory();
   } catch {
     return false;
   }
 }
 function keystoreJsons(dir) {
   try {
-    return fs38.readdirSync(dir).filter((f) => f.endsWith(".json")).sort();
+    return fs39.readdirSync(dir).filter((f) => f.endsWith(".json")).sort();
   } catch {
     return [];
   }
@@ -16148,7 +16474,7 @@ async function cmdDoctor(opts) {
   if (opts.checkEnv) {
     return runCheckEnv(projectRoot);
   }
-  const tomlPath = path38.join(projectRoot, "studio.toml");
+  const tomlPath = path39.join(projectRoot, "studio.toml");
   let data;
   try {
     data = loadStudioToml21(tomlPath);
@@ -16184,8 +16510,8 @@ async function cmdDoctor(opts) {
 }
 function resolveProjectRoot3(argRoot) {
   if (argRoot !== void 0) {
-    const root2 = path38.resolve(argRoot);
-    if (!isFile16(path38.join(root2, "studio.toml"))) {
+    const root2 = path39.resolve(argRoot);
+    if (!isFile17(path39.join(root2, "studio.toml"))) {
       printErr(`error: no studio.toml under --project-root ${root2}`);
       return null;
     }
@@ -16199,15 +16525,15 @@ function resolveProjectRoot3(argRoot) {
   return root;
 }
 function runCheckEnv(projectRoot) {
-  const agentDir = workspaceLayers(projectRoot) ?? path38.join(projectRoot, "agent");
+  const agentDir = workspaceLayers(projectRoot) ?? path39.join(projectRoot, "agent");
   const envPath = envLocalPath17(agentDir);
   printOut(`bag doctor --check-env: ${envPath}`);
-  if (!isFile16(envPath)) {
-    printOut(`  (no ${path38.basename(envPath)} found \u2014 nothing to report)`);
+  if (!isFile17(envPath)) {
+    printOut(`  (no ${path39.basename(envPath)} found \u2014 nothing to report)`);
     return 0;
   }
   const values = {};
-  for (const rawLine of fs38.readFileSync(envPath, "utf-8").split(/\r?\n/)) {
+  for (const rawLine of fs39.readFileSync(envPath, "utf-8").split(/\r?\n/)) {
     const line = rawLine.trim();
     if (!line || line.startsWith("#") || !line.includes("=")) {
       continue;
@@ -16234,25 +16560,25 @@ function runCheckEnv(projectRoot) {
   return 0;
 }
 function workspaceLayers(projectRoot) {
-  const parent = path38.dirname(projectRoot);
-  if (isFile16(path38.join(parent, "agent", "studio.toml"))) {
-    return path38.join(parent, "agent");
+  const parent = path39.dirname(projectRoot);
+  if (isFile17(path39.join(parent, "agent", "studio.toml"))) {
+    return path39.join(parent, "agent");
   }
-  if (isFile16(path38.join(projectRoot, "agent", "studio.toml"))) {
-    return path38.join(projectRoot, "agent");
+  if (isFile17(path39.join(projectRoot, "agent", "studio.toml"))) {
+    return path39.join(projectRoot, "agent");
   }
   return null;
 }
 function checkAppMain(projectRootArg) {
   let projectRoot = projectRootArg;
-  const parent = path38.dirname(projectRoot);
-  if (isFile16(path38.join(parent, "agent", "studio.toml"))) {
+  const parent = path39.dirname(projectRoot);
+  if (isFile17(path39.join(parent, "agent", "studio.toml"))) {
     projectRoot = parent;
   }
-  const agentDir = path38.join(projectRoot, "agent");
+  const agentDir = path39.join(projectRoot, "agent");
   let config = {};
-  const tomlPath = path38.join(agentDir, "studio.toml");
-  if (isFile16(tomlPath)) {
+  const tomlPath = path39.join(agentDir, "studio.toml");
+  if (isFile17(tomlPath)) {
     try {
       config = loadStudioToml21(tomlPath);
     } catch {
@@ -16270,8 +16596,8 @@ function checkAppMain(projectRootArg) {
   } else {
     entrypoint = "src/main.ts";
   }
-  const entryFile = path38.join(agentDir, entrypoint);
-  if (!isFile16(entryFile)) {
+  const entryFile = path39.join(agentDir, entrypoint);
+  if (!isFile17(entryFile)) {
     return [
       {
         name: "agent entrypoint",
@@ -16286,12 +16612,12 @@ function checkAppMain(projectRootArg) {
 function checkAgentcoreName(projectRoot) {
   let cfgPath = null;
   for (const candidate of [
-    path38.dirname(path38.dirname(projectRoot)),
-    path38.dirname(projectRoot),
+    path39.dirname(path39.dirname(projectRoot)),
+    path39.dirname(projectRoot),
     projectRoot
   ]) {
-    const p = path38.join(candidate, "agentcore", "agentcore.json");
-    if (isFile16(p)) {
+    const p = path39.join(candidate, "agentcore", "agentcore.json");
+    if (isFile17(p)) {
       cfgPath = p;
       break;
     }
@@ -16301,7 +16627,7 @@ function checkAgentcoreName(projectRoot) {
   }
   let cfg;
   try {
-    cfg = JSON.parse(fs38.readFileSync(cfgPath, "utf-8"));
+    cfg = JSON.parse(fs39.readFileSync(cfgPath, "utf-8"));
   } catch {
     return [];
   }
@@ -16333,7 +16659,7 @@ function isLocalEvmWallet(walletCfg) {
 }
 function anchoredKeystoreDir(projectRoot, walletCfg) {
   const rel = String(walletCfg.keystore_dir ?? ".studio/wallets");
-  return path38.isAbsolute(rel) ? rel : path38.join(projectRoot, rel);
+  return path39.isAbsolute(rel) ? rel : path39.join(projectRoot, rel);
 }
 async function checkWallet(projectRoot, data) {
   const walletCfg = tableOf14(data, "wallet");
@@ -16379,8 +16705,8 @@ async function checkWallet(projectRoot, data) {
   }
   const address = String(walletCfg.address ?? "").trim();
   if (address) {
-    const expected = path38.join(keystoreDir, `${address}.json`);
-    if (!isFile16(expected)) {
+    const expected = path39.join(keystoreDir, `${address}.json`);
+    if (!isFile17(expected)) {
       out.push({
         name: "[wallet] address \u2194 keystore",
         status: FAIL,
@@ -16390,7 +16716,7 @@ async function checkWallet(projectRoot, data) {
       out.push({
         name: "[wallet] address \u2194 keystore",
         status: PASS,
-        detail: `${address} matches ${path38.basename(expected)}`
+        detail: `${address} matches ${path39.basename(expected)}`
       });
     }
   }
@@ -16407,9 +16733,9 @@ function checkWalletAltana(walletCfg, projectRoot) {
       detail: "no [wallet].address \u2014 run `bag wallet new` first"
     });
   } else {
-    const expected = path38.join(keystoreDir, `${address}.json`);
+    const expected = path39.join(keystoreDir, `${address}.json`);
     out.push(
-      isFile16(expected) ? {
+      isFile17(expected) ? {
         name: "[wallet] Altana admin",
         status: PASS,
         detail: `${address} matches ${expected}`
@@ -16423,8 +16749,8 @@ function checkWalletAltana(walletCfg, projectRoot) {
   const configured = String(
     walletCfg.session_file ?? ".studio/wallets/altana-session.json"
   );
-  const sessionFile = path38.isAbsolute(configured) ? configured : path38.join(projectRoot, configured);
-  if (!isFile16(sessionFile)) {
+  const sessionFile = path39.isAbsolute(configured) ? configured : path39.join(projectRoot, configured);
+  if (!isFile17(sessionFile)) {
     out.push({
       name: "[wallet] Altana session",
       status: FAIL,
@@ -16434,7 +16760,7 @@ function checkWalletAltana(walletCfg, projectRoot) {
   }
   let envelope;
   try {
-    envelope = JSON.parse(fs38.readFileSync(sessionFile, "utf8"));
+    envelope = JSON.parse(fs39.readFileSync(sessionFile, "utf8"));
   } catch {
     out.push({
       name: "[wallet] Altana session",
@@ -16460,7 +16786,7 @@ function checkWalletAltana(walletCfg, projectRoot) {
     status: remaining <= 0 ? FAIL : remaining < 3 * 24 * 60 * 60 ? WARN : PASS,
     detail: remaining > 0 ? `${String(envelope.publicKey)} active until ${new Date(expiry * 1e3).toISOString()}` : `expired at ${new Date(expiry * 1e3).toISOString()} \u2014 run \`bag wallet session grant --force\``
   });
-  if ((fs38.statSync(sessionFile).mode & 63) !== 0) {
+  if ((fs39.statSync(sessionFile).mode & 63) !== 0) {
     out.push({
       name: "[wallet] Altana session permissions",
       status: WARN,
@@ -16518,7 +16844,7 @@ async function checkWalletTwak(walletCfg, projectRoot, data = {}) {
     });
   }
   const walletFile = twakWalletFile(walletCfg, projectRoot);
-  if (isFile16(walletFile)) {
+  if (isFile17(walletFile)) {
     out.push({
       name: "[wallet] twak wallet",
       status: PASS,
@@ -16528,7 +16854,7 @@ async function checkWalletTwak(walletCfg, projectRoot, data = {}) {
     let createCmd = "twak wallet create --password <pw> --no-keychain";
     let setupCmd = "twak setup";
     if (walletCfg.twak_home) {
-      const home = path38.dirname(path38.dirname(walletFile));
+      const home = path39.dirname(path39.dirname(walletFile));
       createCmd = `HOME=${home} ${createCmd}`;
       setupCmd = `HOME=${home} ${setupCmd}`;
     }
@@ -17284,11 +17610,11 @@ function checkAgentsMdSkillTrigger(projectRoot) {
   if (ws === null) {
     return [];
   }
-  const agentsMd = path38.join(ws, "AGENTS.md");
+  const agentsMd = path39.join(ws, "AGENTS.md");
   const line = "For any bnbagent-studio task (deploy, sell, operate, debug), load the `/bnbagent-studio` skill first.";
   let text2;
   try {
-    text2 = isFile16(agentsMd) ? fs38.readFileSync(agentsMd, "utf-8") : null;
+    text2 = isFile17(agentsMd) ? fs39.readFileSync(agentsMd, "utf-8") : null;
   } catch {
     return [];
   }
@@ -17325,8 +17651,8 @@ function printChecks(checks) {
 }
 
 // src/cli/env.ts
-import * as fs39 from "fs";
-import * as path39 from "path";
+import * as fs40 from "fs";
+import * as path40 from "path";
 var SECRET_KEY_PARTS = ["PASSWORD", "SECRET", "TOKEN", "API_KEY"];
 var WALLET_PASSWORD_KEYS = /* @__PURE__ */ new Set([
   "WALLET_PASSWORD",
@@ -17372,8 +17698,8 @@ function resolveEnvPath(fileArg, rootArg) {
     return [fileArg, null];
   }
   if (rootArg !== void 0) {
-    const root2 = path39.resolve(rootArg);
-    if (!fs39.existsSync(path39.join(root2, "studio.toml"))) {
+    const root2 = path40.resolve(rootArg);
+    if (!fs40.existsSync(path40.join(root2, "studio.toml"))) {
       return [null, `error: no studio.toml under --project-root ${root2}`];
     }
     return [envLocalPath(root2), null];
@@ -17384,7 +17710,7 @@ function resolveEnvPath(fileArg, rootArg) {
   }
   const target = envLocalPath(root);
   let note = null;
-  if (path39.dirname(path39.dirname(target)) !== path39.resolve(process.cwd())) {
+  if (path40.dirname(path40.dirname(target)) !== path40.resolve(process.cwd())) {
     note = `\u2192 writing to ${target} (workspace .studio/, where \`bag dev\` reads)`;
   }
   return [target, note];
@@ -17441,7 +17767,7 @@ function cmdGet2(key, fileArg, rootArg) {
 }
 
 // src/cli/erc8004.ts
-import * as path40 from "path";
+import * as path41 from "path";
 import { auditedOp as auditedOp3 } from "@bnbagent/studio-runtime/audit";
 import {
   findProjectRoot as findProjectRoot5,
@@ -17451,7 +17777,7 @@ import {
 import {
   getMetadata,
   register as register2,
-  resolve as resolve20,
+  resolve as resolve21,
   setMetadata,
   show as show2,
   updateServiceEndpoint as updateServiceEndpoint2
@@ -17562,7 +17888,7 @@ function loadAgentCfg3() {
     return null;
   }
   try {
-    return loadStudioToml22(path40.join(root, "studio.toml"));
+    return loadStudioToml22(path41.join(root, "studio.toml"));
   } catch {
     return null;
   }
@@ -17640,7 +17966,7 @@ function loadIdentityBlock(agentRoot2) {
   try {
     return {
       ...tableOf15(
-        loadStudioToml22(path40.join(agentRoot2, "studio.toml")),
+        loadStudioToml22(path41.join(agentRoot2, "studio.toml")),
         "identity"
       )
     };
@@ -17979,7 +18305,7 @@ async function cmdResolve(agentId, networkArg) {
   const wallet = walletRt6.getWallet();
   let uri;
   try {
-    uri = await resolve20(agentId, {
+    uri = await resolve21(agentId, {
       wallet,
       network: resolveNetwork2(networkArg)
     });
@@ -17992,8 +18318,8 @@ async function cmdResolve(agentId, networkArg) {
 }
 
 // src/cli/erc8183.ts
-import * as fs40 from "fs";
-import * as path41 from "path";
+import * as fs41 from "fs";
+import * as path42 from "path";
 import { JobStatus } from "@bnbagent/sdk";
 import {
   buyWorkflow,
@@ -18097,8 +18423,8 @@ function applyProjectRoot2(root) {
   if (root === void 0) {
     return null;
   }
-  const p = path41.resolve(root);
-  if (!fs40.existsSync(path41.join(p, "studio.toml"))) {
+  const p = path42.resolve(root);
+  if (!fs41.existsSync(path42.join(p, "studio.toml"))) {
     printErr(`error: no studio.toml under --project-root ${p}`);
     return 2;
   }
@@ -18183,7 +18509,7 @@ function parseQuoteEnvelope(raw) {
   let text2 = trimmed;
   if (!trimmed.startsWith("{")) {
     try {
-      text2 = fs40.readFileSync(trimmed, "utf-8");
+      text2 = fs41.readFileSync(trimmed, "utf-8");
     } catch (exc) {
       throw new Error(
         `--quote-json is neither inline JSON nor a readable file: ${errMsg5(exc)}`
@@ -18363,9 +18689,9 @@ async function cmdSettle(jobId, opts) {
 }
 
 // src/cli/skills.ts
-import * as fs41 from "fs";
+import * as fs42 from "fs";
 import * as os6 from "os";
-import * as path42 from "path";
+import * as path43 from "path";
 import { Option as Option7 } from "commander";
 function registerSkills(program) {
   const skills = program.command("skills").description("Install Claude Code skills into the host IDE.").action(
@@ -18411,7 +18737,7 @@ function cmdList4() {
   for (const p of listSourceSkills(
     SKILLS_SOURCE
   )) {
-    printOut(path42.basename(p));
+    printOut(path43.basename(p));
   }
   const refs = listSourceReferences(
     SKILLS_SOURCE
@@ -18422,7 +18748,7 @@ function cmdList4() {
 references (installed under ${ROUTER_SKILL_NAME}/references/, loaded on demand by the skills above):`
     );
     for (const p of refs) {
-      printOut(`  ${path42.basename(p)}`);
+      printOut(`  ${path43.basename(p)}`);
     }
   }
   return 0;
@@ -18634,7 +18960,7 @@ function installTargets(targets, scope) {
       );
       for (const name of result.legacyPresent) {
         const leaf = result.target === "cursor" ? `${name}.mdc` : name;
-        printErr(`  - ${path42.join(result.targetDir, leaf)}`);
+        printErr(`  - ${path43.join(result.targetDir, leaf)}`);
       }
       printErr(
         "\nThese are NOT auto-deleted (studio never touches user resources).\nRemove with `rm -rf <path>` once you confirm none of them are\ncarrying local edits you want to keep."
@@ -18647,19 +18973,19 @@ function studioSkillNames() {
   for (const p of listSourceSkills(
     SKILLS_SOURCE
   )) {
-    names.add(path42.basename(p).replace(/\.md$/, ""));
+    names.add(path43.basename(p).replace(/\.md$/, ""));
   }
   for (const name of LEGACY_SKILL_NAMES) {
     names.add(name);
   }
-  const providersRoot = path42.join(bundledRecipesRoot(), "providers");
+  const providersRoot = path43.join(bundledRecipesRoot(), "providers");
   if (isDir9(providersRoot)) {
-    for (const provider of fs41.readdirSync(providersRoot)) {
-      const skillDir = path42.join(providersRoot, provider, "skills");
+    for (const provider of fs42.readdirSync(providersRoot)) {
+      const skillDir = path43.join(providersRoot, provider, "skills");
       if (!isDir9(skillDir)) {
         continue;
       }
-      for (const md of fs41.readdirSync(skillDir)) {
+      for (const md of fs42.readdirSync(skillDir)) {
         if (md.endsWith(".md")) {
           names.add(md.replace(/\.md$/, ""));
         }
@@ -18670,14 +18996,14 @@ function studioSkillNames() {
 }
 function isDir9(p) {
   try {
-    return fs41.statSync(p).isDirectory();
+    return fs42.statSync(p).isDirectory();
   } catch {
     return false;
   }
 }
-function isFile17(p) {
+function isFile18(p) {
   try {
-    return fs41.statSync(p).isFile();
+    return fs42.statSync(p).isFile();
   } catch {
     return false;
   }
@@ -18691,26 +19017,26 @@ function findInstalledSkills(knownNames) {
     if (!isDir9(root)) {
       return;
     }
-    const resolved = fs41.realpathSync(root);
-    if (!roots.some((r) => fs41.realpathSync(r) === resolved)) {
+    const resolved = fs42.realpathSync(root);
+    if (!roots.some((r) => fs42.realpathSync(r) === resolved)) {
       roots.push(root);
     }
   };
-  addRoot(path42.join(home, ".claude", "skills"));
-  addRoot(path42.join(home, ".cursor", "rules"));
-  addRoot(path42.join(cwd, ".claude", "skills"));
-  addRoot(path42.join(cwd, ".cursor", "rules"));
+  addRoot(path43.join(home, ".claude", "skills"));
+  addRoot(path43.join(home, ".cursor", "rules"));
+  addRoot(path43.join(cwd, ".claude", "skills"));
+  addRoot(path43.join(cwd, ".cursor", "rules"));
   for (const root of roots) {
-    const isCursor = path42.basename(root) === "rules" && path42.basename(path42.dirname(root)) === ".cursor";
+    const isCursor = path43.basename(root) === "rules" && path43.basename(path43.dirname(root)) === ".cursor";
     for (const name of [...knownNames].sort()) {
-      const target = path42.join(root, isCursor ? `${name}.mdc` : name);
-      if (isCursor && isFile17(target)) {
+      const target = path43.join(root, isCursor ? `${name}.mdc` : name);
+      if (isCursor && isFile18(target)) {
         found.push(target);
       } else if (!isCursor && isDir9(target)) {
         found.push(target);
       }
-      if (isCursor && isDir9(path42.join(root, name))) {
-        found.push(path42.join(root, name));
+      if (isCursor && isDir9(path43.join(root, name))) {
+        found.push(path43.join(root, name));
       }
     }
   }
@@ -18738,7 +19064,7 @@ async function cmdUninstall(flags) {
       }
     }
     for (const p of installed) {
-      fs41.rmSync(p, { recursive: true, force: true });
+      fs42.rmSync(p, { recursive: true, force: true });
       printOut(`  removed: ${p}`);
     }
   }
@@ -18777,7 +19103,7 @@ function registerUninstall(program) {
 }
 
 // src/cli/platform.ts
-import * as path43 from "path";
+import * as path44 from "path";
 import {
   STUDIO_TOML as STUDIO_TOML2,
   findSubProjectRoot as findSubProjectRoot18,
@@ -18980,7 +19306,7 @@ function localPlatformCfg() {
   if (agentRoot2 === null) {
     return [null, {}];
   }
-  const tomlPath = path43.join(agentRoot2, STUDIO_TOML2);
+  const tomlPath = path44.join(agentRoot2, STUDIO_TOML2);
   let cfg;
   try {
     cfg = loadStudioToml23(tomlPath);
@@ -19053,8 +19379,8 @@ function formatRemaining(seconds) {
 }
 
 // src/cli/recipe.ts
-import * as fs42 from "fs";
-import * as path44 from "path";
+import * as fs43 from "fs";
+import * as path45 from "path";
 import { parse as parse6 } from "smol-toml";
 function registerRecipe(program) {
   const p = program.command("recipe").description("Print recipe code/files (agent / wallet / 8004).");
@@ -19184,7 +19510,7 @@ function resolvePkgContext(explicit) {
   let data;
   try {
     data = parse6(
-      fs42.readFileSync(path44.join(projectRoot, "studio.toml"), "utf-8")
+      fs43.readFileSync(path45.join(projectRoot, "studio.toml"), "utf-8")
     );
   } catch {
     return [null, null];
@@ -19202,8 +19528,8 @@ function resolvePkgContext(explicit) {
 }
 
 // src/cli/scan.ts
-import * as fs43 from "fs";
-import * as path45 from "path";
+import * as fs44 from "fs";
+import * as path46 from "path";
 import { Option as Option8 } from "commander";
 import { parse as parse7 } from "smol-toml";
 function registerScan(program) {
@@ -19220,7 +19546,7 @@ function registerScan(program) {
           "note: `--json` is deprecated (JSON is the default output); ignoring."
         );
       }
-      const root = path45.resolve(opts.path ?? process.cwd());
+      const root = path46.resolve(opts.path ?? process.cwd());
       const report = scanProject(root);
       if (opts.text) {
         process.stdout.write(formatText(report));
@@ -19232,26 +19558,26 @@ function registerScan(program) {
     })
   );
 }
-function isFile18(p) {
+function isFile19(p) {
   try {
-    return fs43.statSync(p).isFile();
+    return fs44.statSync(p).isFile();
   } catch {
     return false;
   }
 }
 function isDir10(p) {
   try {
-    return fs43.statSync(p).isDirectory();
+    return fs44.statSync(p).isDirectory();
   } catch {
     return false;
   }
 }
 function layerBase(root) {
-  return isDir10(path45.join(root, "app", "agent")) ? path45.join(root, "app") : root;
+  return isDir10(path46.join(root, "app", "agent")) ? path46.join(root, "app") : root;
 }
 function safeReadJson(p) {
   try {
-    const data = JSON.parse(fs43.readFileSync(p, "utf-8"));
+    const data = JSON.parse(fs44.readFileSync(p, "utf-8"));
     return data !== null && typeof data === "object" && !Array.isArray(data) ? data : null;
   } catch {
     return null;
@@ -19259,7 +19585,7 @@ function safeReadJson(p) {
 }
 function safeReadToml(p) {
   try {
-    return parse7(fs43.readFileSync(p, "utf-8"));
+    return parse7(fs44.readFileSync(p, "utf-8"));
   } catch {
     return null;
   }
@@ -19289,33 +19615,33 @@ function resolvePackageName(projectName2, root) {
   if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(candidate)) {
     return null;
   }
-  if (!isDir10(path45.join(root, candidate))) {
+  if (!isDir10(path46.join(root, candidate))) {
     return null;
   }
   return candidate;
 }
 function inferLayout(root) {
-  const agentDir = path45.join(layerBase(root), "agent");
-  const hasAgent = isFile18(path45.join(agentDir, "main.ts")) || isFile18(path45.join(agentDir, "main.py"));
+  const agentDir = path46.join(layerBase(root), "agent");
+  const hasAgent = isFile19(path46.join(agentDir, "main.ts")) || isFile19(path46.join(agentDir, "main.py"));
   return {
     has_agent: hasAgent,
-    has_agent_descriptor: isFile18(
-      path45.join(root, "agentcore", "agentcore.json")
+    has_agent_descriptor: isFile19(
+      path46.join(root, "agentcore", "agentcore.json")
     ),
     role: hasAgent ? "agent" : "none"
   };
 }
 function inferPackageManager(root, hasPackageJson) {
-  if (isFile18(path45.join(root, "pnpm-lock.yaml"))) {
+  if (isFile19(path46.join(root, "pnpm-lock.yaml"))) {
     return "pnpm";
   }
-  if (isFile18(path45.join(root, "yarn.lock"))) {
+  if (isFile19(path46.join(root, "yarn.lock"))) {
     return "yarn";
   }
-  if (isFile18(path45.join(root, "bun.lockb"))) {
+  if (isFile19(path46.join(root, "bun.lockb"))) {
     return "bun";
   }
-  if (isFile18(path45.join(root, "package-lock.json"))) {
+  if (isFile19(path46.join(root, "package-lock.json"))) {
     return "npm";
   }
   if (hasPackageJson) {
@@ -19328,7 +19654,7 @@ function inferRecipes(root, studioData, layout) {
   if (layout.has_agent) {
     recipes.push("agent");
   }
-  const walletsDir = path45.join(root, ".studio", "wallets");
+  const walletsDir = path46.join(root, ".studio", "wallets");
   const walletSection = studioData?.wallet;
   const hasWalletSection = walletSection !== null && typeof walletSection === "object" && !Array.isArray(walletSection);
   if (isDir10(walletsDir) && hasWalletSection) {
@@ -19337,13 +19663,13 @@ function inferRecipes(root, studioData, layout) {
   return recipes;
 }
 function scanProject(root) {
-  const studioToml = path45.join(root, "studio.toml");
-  const packageJson = path45.join(root, "package.json");
-  const agentcoreJson = path45.join(root, "agentcore", "agentcore.json");
-  const hasStudioToml = isFile18(studioToml);
-  const hasPackageJson = isFile18(packageJson);
-  const hasAgentcoreJson = isFile18(agentcoreJson);
-  const hasDotStudioDir = isDir10(path45.join(root, ".studio"));
+  const studioToml = path46.join(root, "studio.toml");
+  const packageJson = path46.join(root, "package.json");
+  const agentcoreJson = path46.join(root, "agentcore", "agentcore.json");
+  const hasStudioToml = isFile19(studioToml);
+  const hasPackageJson = isFile19(packageJson);
+  const hasAgentcoreJson = isFile19(agentcoreJson);
+  const hasDotStudioDir = isDir10(path46.join(root, ".studio"));
   const pkgData = hasPackageJson ? safeReadJson(packageJson) : null;
   const studioData = hasStudioToml ? safeReadToml(studioToml) : null;
   const rawName = pkgData?.name;
@@ -19400,8 +19726,8 @@ function formatText(report) {
 }
 
 // src/cli/x402.ts
-import * as fs44 from "fs";
-import * as path46 from "path";
+import * as fs45 from "fs";
+import * as path47 from "path";
 import { auditedOp as auditedOp4 } from "@bnbagent/studio-runtime/audit";
 import {
   envLocalPath as envLocalPath18,
@@ -19595,7 +19921,7 @@ function loadX402Policy() {
   }
   let cfg;
   try {
-    cfg = loadStudioToml24(path46.join(root, "studio.toml"));
+    cfg = loadStudioToml24(path47.join(root, "studio.toml"));
   } catch (exc) {
     printErr(`error: failed to parse studio.toml: ${errMsg6(exc)}`);
     return null;
@@ -19609,7 +19935,7 @@ function loadSellerConfig() {
     return null;
   }
   try {
-    return [root, loadStudioToml24(path46.join(root, "studio.toml"))];
+    return [root, loadStudioToml24(path47.join(root, "studio.toml"))];
   } catch (exc) {
     printErr(`error: failed to parse studio.toml: ${errMsg6(exc)}`);
     return null;
@@ -19655,8 +19981,8 @@ async function cmdSellInit(priceFlag) {
   const loaded = loadSellerConfig();
   if (loaded === null) return 1;
   const [root, cfg] = loaded;
-  const tomlPath = path46.join(root, "studio.toml");
-  const original = fs44.readFileSync(tomlPath, "utf8");
+  const tomlPath = path47.join(root, "studio.toml");
+  const original = fs45.readFileSync(tomlPath, "utf8");
   const sellerExists = hasSection(original, "payments.x402_seller");
   let priceUsd;
   try {
@@ -19674,7 +20000,7 @@ async function cmdSellInit(priceFlag) {
     return 1;
   }
   if (!sellerExists) {
-    fs44.writeFileSync(
+    fs45.writeFileSync(
       tomlPath,
       updateSection(original, "payments.x402_seller", {
         enabled: true,
@@ -19686,7 +20012,7 @@ async function cmdSellInit(priceFlag) {
       "utf8"
     );
   } else if (priceFlag !== void 0) {
-    fs44.writeFileSync(
+    fs45.writeFileSync(
       tomlPath,
       updateSection(original, "payments.x402_seller", {
         price_usd: priceUsd
@@ -20055,14 +20381,14 @@ async function confirmOrAbort(prompt, assumeYes) {
   return answer === "y" || answer === "yes";
 }
 function writeMerchantEntry(tomlPath, fields) {
-  const text2 = fs44.readFileSync(tomlPath, "utf-8");
+  const text2 = fs45.readFileSync(tomlPath, "utf-8");
   const entries = {
     domain: fields.domain,
     pay_to: fields.payTo,
     per_call_cap_usd: fields.capUsd,
     verified: fields.verified
   };
-  fs44.writeFileSync(
+  fs45.writeFileSync(
     tomlPath,
     updateSection(text2, `payments.x402.merchants.${fields.key}`, entries),
     "utf-8"
@@ -20191,7 +20517,7 @@ The merchant may have rotated its address (or the response was tampered with). U
     printOut("aborted \u2014 nothing written.");
     return 1;
   }
-  const tomlPath = path46.join(root, "studio.toml");
+  const tomlPath = path47.join(root, "studio.toml");
   try {
     writeMerchantEntry(tomlPath, {
       key,
@@ -20254,23 +20580,23 @@ function buildProgram() {
   return program;
 }
 function cliVersion() {
-  return "0.0.6-alpha.6";
+  return "0.0.6-alpha.8";
 }
 
 // src/cli/updateCheck.ts
-import * as fs45 from "fs";
+import * as fs46 from "fs";
 import * as os7 from "os";
-import * as path47 from "path";
+import * as path48 from "path";
 var PACKAGE = "@bnbagent/studio-cli";
 var REGISTRY_LATEST_URL = `https://registry.npmjs.org/${PACKAGE}/latest`;
 var CHECK_INTERVAL_SECONDS = 24 * 3600;
 var TIMEOUT_MS = 2e3;
 function cachePath(home) {
-  return path47.join(home, ".bag", "update-check.json");
+  return path48.join(home, ".bag", "update-check.json");
 }
 function loadCache(home) {
   try {
-    const data = JSON.parse(fs45.readFileSync(cachePath(home), "utf-8"));
+    const data = JSON.parse(fs46.readFileSync(cachePath(home), "utf-8"));
     return data !== null && typeof data === "object" && !Array.isArray(data) ? data : {};
   } catch {
     return {};
@@ -20279,8 +20605,8 @@ function loadCache(home) {
 function saveCache(state, home) {
   try {
     const p = cachePath(home);
-    fs45.mkdirSync(path47.dirname(p), { recursive: true });
-    fs45.writeFileSync(p, `${JSON.stringify(state, null, 2)}
+    fs46.mkdirSync(path48.dirname(p), { recursive: true });
+    fs46.writeFileSync(p, `${JSON.stringify(state, null, 2)}
 `);
   } catch {
   }