@bnbagent/studio-cli 0.0.8 → 0.0.10

package/dist/bag.js

@@ -44,7 +44,7 @@ import {
   x402SellerIsFree,
   x402SellerPricingState,
   x402SellerUsesB402
-} from "./chunk-ODCZKKZJ.js";
+} from "./chunk-YFEM4564.js";
 import {
   TWAK_CLI_MIN_VERSION,
   TWAK_CLI_VERSION,
@@ -222,7 +222,7 @@ import {
 var CAMPAIGN_DOC_URL = "https://www.bnbchain.org/en/blog/bnb-agent-studio-is-live-on-bnb-chain-ai-agents-from-one-prompt";
 var CAMPAIGN_CHECK_TIMEOUT_MS = 6e3;
 async function fetchCampaignActive() {
-  const { bnbPlatformApiUrl: bnbPlatformApiUrl2 } = await import("./deployCli-VM5TYKQX.js");
+  const { bnbPlatformApiUrl: bnbPlatformApiUrl2 } = await import("./deployCli-NJFCWBSF.js");
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), CAMPAIGN_CHECK_TIMEOUT_MS);
   try {
@@ -437,10 +437,56 @@ function findAgentRoot(start) {
 // src/cli/program.ts
 import { Command } from "commander";
 
-// src/cli/agents.ts
+// src/cli/_packageMetadata.ts
 import * as fs3 from "fs";
-import * as os from "os";
 import * as path2 from "path";
+import { fileURLToPath } from "url";
+function packageRoot() {
+  let dir = path2.dirname(fileURLToPath(import.meta.url));
+  for (; ; ) {
+    const packageJson = path2.join(dir, "package.json");
+    if (fs3.existsSync(packageJson)) return dir;
+    const parent = path2.dirname(dir);
+    if (parent === dir) {
+      throw new Error("cannot locate the studio-cli package root");
+    }
+    dir = parent;
+  }
+}
+function studioCliVersion() {
+  if ("0.0.10") {
+    return "0.0.10";
+  }
+  const file = path2.join(packageRoot(), "package.json");
+  const pkg = JSON.parse(fs3.readFileSync(file, "utf-8"));
+  const value = String(pkg.version ?? "");
+  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u.test(value)) {
+    throw new Error(
+      `studio-cli package.json must contain a valid version in ${file}`
+    );
+  }
+  return value;
+}
+function pnpmVersion() {
+  if ("10.24.0") {
+    return "10.24.0";
+  }
+  const file = path2.join(packageRoot(), "package.json");
+  const pkg = JSON.parse(fs3.readFileSync(file, "utf-8"));
+  const value = String(pkg.packageManager ?? "");
+  const match = /^pnpm@(.+)$/u.exec(value);
+  if (!match?.[1]) {
+    throw new Error(
+      `studio-cli packageManager must pin pnpm (expected "pnpm@<version>" in ${file})`
+    );
+  }
+  return match[1];
+}
+
+// src/cli/agents.ts
+import * as fs4 from "fs";
+import * as os from "os";
+import * as path3 from "path";
 import { parse, stringify } from "smol-toml";
 
 // src/cli/utils/prompt.ts
@@ -506,18 +552,18 @@ function stdinIsTty() {
 // src/cli/agents.ts
 var SCHEMA_VERSION = "1";
 function registryPath() {
-  return path2.join(os.homedir(), ".bnbagent-studio", "projects.toml");
+  return path3.join(os.homedir(), ".bnbagent-studio", "projects.toml");
 }
 var RegistryCorruptError = class extends Error {
 };
 function loadDoc() {
   const file = registryPath();
-  if (!fs3.existsSync(file)) {
+  if (!fs4.existsSync(file)) {
     return { schema_version: SCHEMA_VERSION, projects: [] };
   }
   let text2;
   try {
-    text2 = fs3.readFileSync(file, "utf-8");
+    text2 = fs4.readFileSync(file, "utf-8");
   } catch (exc) {
     throw new RegistryCorruptError(`cannot read ${file}: ${exc}`);
   }
@@ -538,7 +584,7 @@ function loadDoc() {
 }
 function saveDoc(doc) {
   const file = registryPath();
-  fs3.mkdirSync(path2.dirname(file), { recursive: true });
+  fs4.mkdirSync(path3.dirname(file), { recursive: true });
   const projects = doc.projects.map((entry) => {
     const out = {};
     for (const [k, v] of Object.entries(entry)) {
@@ -548,7 +594,7 @@ function saveDoc(doc) {
     }
     return out;
   });
-  fs3.writeFileSync(
+  fs4.writeFileSync(
     file,
     `${stringify({ schema_version: doc.schema_version, projects })}
 `,
@@ -557,24 +603,24 @@ function saveDoc(doc) {
 }
 function isFile(p) {
   try {
-    return fs3.statSync(p).isFile();
+    return fs4.statSync(p).isFile();
   } catch {
     return false;
   }
 }
 function isDir(p) {
   try {
-    return fs3.statSync(p).isDirectory();
+    return fs4.statSync(p).isDirectory();
   } catch {
     return false;
   }
 }
 function agentSubprojectRoot(projectRoot) {
   for (const candidate of [
-    path2.join(projectRoot, "app", "agent"),
-    path2.join(projectRoot, "agent")
+    path3.join(projectRoot, "app", "agent"),
+    path3.join(projectRoot, "agent")
   ]) {
-    if (isFile(path2.join(candidate, "studio.toml"))) {
+    if (isFile(path3.join(candidate, "studio.toml"))) {
       return candidate;
     }
   }
@@ -582,9 +628,9 @@ function agentSubprojectRoot(projectRoot) {
 }
 function projectStudioToml(projectRoot) {
   const candidates = [
-    path2.join(projectRoot, "studio.toml"),
-    path2.join(projectRoot, "app", "agent", "studio.toml"),
-    path2.join(projectRoot, "agent", "studio.toml")
+    path3.join(projectRoot, "studio.toml"),
+    path3.join(projectRoot, "app", "agent", "studio.toml"),
+    path3.join(projectRoot, "agent", "studio.toml")
   ];
   return candidates.find(isFile) ?? null;
 }
@@ -595,14 +641,14 @@ function readStudioToml(projectRoot) {
       `no studio.toml at ${projectRoot}, ${projectRoot}/app/agent, or ${projectRoot}/agent`
     );
   }
-  return parse(fs3.readFileSync(studioToml, "utf-8"));
+  return parse(fs4.readFileSync(studioToml, "utf-8"));
 }
 function scanWalletAddress(projectRoot) {
-  const walletsDir = path2.join(projectRoot, ".studio", "wallets");
+  const walletsDir = path3.join(projectRoot, ".studio", "wallets");
   if (!isDir(walletsDir)) {
     return null;
   }
-  for (const child of fs3.readdirSync(walletsDir).sort()) {
+  for (const child of fs4.readdirSync(walletsDir).sort()) {
     if (!child.endsWith(".json")) {
       continue;
     }
@@ -617,13 +663,13 @@ function expandUser(p) {
   if (p === "~") {
     return os.homedir();
   }
-  if (p.startsWith(`~${path2.sep}`) || p.startsWith("~/")) {
-    return path2.join(os.homedir(), p.slice(2));
+  if (p.startsWith(`~${path3.sep}`) || p.startsWith("~/")) {
+    return path3.join(os.homedir(), p.slice(2));
   }
   return p;
 }
 function normalizePath(p) {
-  return path2.resolve(expandUser(p));
+  return path3.resolve(expandUser(p));
 }
 function nowIso() {
   const d = /* @__PURE__ */ new Date();
@@ -644,13 +690,13 @@ function registerProject(projectRootArg2, opts = {}) {
   }
   const cfg = readStudioToml(projectRoot);
   const agentRoot2 = agentSubprojectRoot(projectRoot);
-  const resolvedName = opts.name ?? (tableOf(cfg, "project").name || path2.basename(projectRoot));
+  const resolvedName = opts.name ?? (tableOf(cfg, "project").name || path3.basename(projectRoot));
   const network = tableOf(cfg, "network").default || "bsc-testnet";
   const walletAddress = scanWalletAddress(agentRoot2);
   const llmProvider = tableOf(cfg, "llm").provider || null;
   const workspaceRoot = findWorkspaceRoot(projectRoot) ?? projectRoot;
-  const cloud = fs3.existsSync(
-    path2.join(workspaceRoot, "agentcore", "agentcore.json")
+  const cloud = fs4.existsSync(
+    path3.join(workspaceRoot, "agentcore", "agentcore.json")
   ) ? "agentcore" : null;
   const entryData = {
     name: resolvedName,
@@ -731,7 +777,7 @@ function listProjects() {
       }
     }
     if (e.cloud === null) {
-      if (fs3.existsSync(path2.join(p, "agentcore", "agentcore.json"))) {
+      if (fs4.existsSync(path3.join(p, "agentcore", "agentcore.json"))) {
         e.cloud = "agentcore";
         changed = true;
       }
@@ -1036,8 +1082,8 @@ function cmdRegister(pathArg, name, agentId) {
 }
 
 // src/cli/audit.ts
-import * as fs4 from "fs";
-import * as path3 from "path";
+import * as fs5 from "fs";
+import * as path4 from "path";
 
 // src/cli/_auditRead.ts
 import {
@@ -1114,17 +1160,17 @@ function parseSince(s) {
   return `${d.getUTCFullYear()}-${pad(d.getUTCMonth() + 1)}-${pad(d.getUTCDate())}T${pad(d.getUTCHours())}:${pad(d.getUTCMinutes())}:${pad(d.getUTCSeconds())}.000Z`;
 }
 function resolveProjectRoot(argRoot) {
-  const root = argRoot !== void 0 ? path3.resolve(argRoot) : process.cwd();
-  if (fs4.existsSync(path3.join(root, "studio.toml"))) {
+  const root = argRoot !== void 0 ? path4.resolve(argRoot) : process.cwd();
+  if (fs5.existsSync(path4.join(root, "studio.toml"))) {
     return root;
   }
   let current = root;
   for (; ; ) {
-    const parent = path3.dirname(current);
+    const parent = path4.dirname(current);
     if (parent === current) {
       return null;
     }
-    if (fs4.existsSync(path3.join(parent, "studio.toml"))) {
+    if (fs5.existsSync(path4.join(parent, "studio.toml"))) {
       return parent;
     }
     current = parent;
@@ -1200,18 +1246,18 @@ function cmdShow2(txHash, opts) {
 }
 
 // src/cli/budget.ts
-import * as fs6 from "fs";
-import * as path5 from "path";
+import * as fs7 from "fs";
+import * as path6 from "path";
 import { BudgetPolicy } from "@bnbagent/studio-runtime/pieverse";
 import { parse as parse3 } from "smol-toml";
 
 // src/cli/_projectRoot.ts
-import * as fs5 from "fs";
-import * as path4 from "path";
+import * as fs6 from "fs";
+import * as path5 from "path";
 function resolveProjectRootArg(argRoot) {
   if (argRoot !== void 0) {
-    const root2 = path4.resolve(argRoot);
-    if (!fs5.existsSync(path4.join(root2, "studio.toml"))) {
+    const root2 = path5.resolve(argRoot);
+    if (!fs6.existsSync(path5.join(root2, "studio.toml"))) {
       printErr(`error: no studio.toml under --project-root ${root2}`);
       return null;
     }
@@ -1486,7 +1532,7 @@ function registerBudget(program) {
 }
 function loadPolicy(root) {
   const cfg = parse3(
-    fs6.readFileSync(path5.join(root, "studio.toml"), "utf-8")
+    fs7.readFileSync(path6.join(root, "studio.toml"), "utf-8")
   );
   const budget = cfg.budget;
   return policyFromToml(
@@ -1494,9 +1540,9 @@ function loadPolicy(root) {
   );
 }
 function writeSection(root, updates) {
-  const tomlPath = path5.join(root, "studio.toml");
-  const text2 = fs6.readFileSync(tomlPath, "utf-8");
-  fs6.writeFileSync(tomlPath, updateSection(text2, "budget", updates), "utf-8");
+  const tomlPath = path6.join(root, "studio.toml");
+  const text2 = fs7.readFileSync(tomlPath, "utf-8");
+  fs7.writeFileSync(tomlPath, updateSection(text2, "budget", updates), "utf-8");
 }
 function setBudgetEnabled(on) {
   return on ? cmdEnable({}) : cmdDisable(void 0);
@@ -1543,16 +1589,16 @@ function cmdShow3(projectRoot) {
   return 0;
 }
 function printSpendLedger(root) {
-  const ledgerPath = path5.join(root, ".studio", "spend-ledger.json");
+  const ledgerPath = path6.join(root, ".studio", "spend-ledger.json");
   printOut("");
   printOut("spend ledger (.studio/spend-ledger.json):");
-  if (!fs6.existsSync(ledgerPath)) {
+  if (!fs7.existsSync(ledgerPath)) {
     printOut("  (no ledger yet)");
     return;
   }
   let entries;
   try {
-    const raw = JSON.parse(fs6.readFileSync(ledgerPath, "utf-8"));
+    const raw = JSON.parse(fs7.readFileSync(ledgerPath, "utf-8"));
     entries = Array.isArray(raw.entries) ? raw.entries : [];
   } catch (exc) {
     printOut(
@@ -1643,8 +1689,8 @@ function cmdDisable(projectRoot) {
 }
 
 // src/cli/bundle.ts
-import * as fs8 from "fs";
-import * as path7 from "path";
+import * as fs9 from "fs";
+import * as path8 from "path";
 import {
   envLocalPath as envLocalPath4,
   findSubProjectRoot as findSubProjectRoot2,
@@ -1655,29 +1701,29 @@ import * as tar from "tar";
 
 // src/cli/_vendorTarball.ts
 import * as crypto from "crypto";
-import * as fs7 from "fs";
-import * as path6 from "path";
-import { fileURLToPath } from "url";
+import * as fs8 from "fs";
+import * as path7 from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
 import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
 var VENDORED_PACKAGES = [
   "@bnbagent/sdk",
   "@bnbagent/studio-runtime"
 ];
 function installedSourceRoot(pkgName) {
-  let dir = path6.dirname(fileURLToPath(import.meta.url));
+  let dir = path7.dirname(fileURLToPath2(import.meta.url));
   for (; ; ) {
-    const candidate = path6.join(dir, "node_modules", ...pkgName.split("/"));
-    const packageJson = path6.join(candidate, "package.json");
-    if (fs7.existsSync(packageJson)) {
+    const candidate = path7.join(dir, "node_modules", ...pkgName.split("/"));
+    const packageJson = path7.join(candidate, "package.json");
+    if (fs8.existsSync(packageJson)) {
       try {
-        const real = fs7.realpathSync(packageJson);
-        const pkg = JSON.parse(fs7.readFileSync(real, "utf-8"));
-        return typeof pkg.version === "string" ? { root: path6.dirname(real), version: pkg.version } : null;
+        const real = fs8.realpathSync(packageJson);
+        const pkg = JSON.parse(fs8.readFileSync(real, "utf-8"));
+        return typeof pkg.version === "string" ? { root: path7.dirname(real), version: pkg.version } : null;
       } catch {
         return null;
       }
     }
-    const parent = path6.dirname(dir);
+    const parent = path7.dirname(dir);
     if (parent === dir) {
       return null;
     }
@@ -1690,7 +1736,7 @@ function localSourceRoot(pkgName) {
   if (installed === null) {
     return null;
   }
-  if (installed.root.split(path6.sep).includes("node_modules")) {
+  if (installed.root.split(path7.sep).includes("node_modules")) {
     return null;
   }
   return installed;
@@ -1706,17 +1752,17 @@ async function publishedOnRegistry(name, version) {
 function contentTag(sourceRoot) {
   const h = crypto.createHash("sha256");
   const files = [];
-  const srcDir = path6.join(sourceRoot, "src");
+  const srcDir = path7.join(sourceRoot, "src");
   const walk = (dir) => {
     let names;
     try {
-      names = fs7.readdirSync(dir).sort();
+      names = fs8.readdirSync(dir).sort();
     } catch {
       return;
     }
     for (const name of names) {
-      const full = path6.join(dir, name);
-      const st = fs7.statSync(full);
+      const full = path7.join(dir, name);
+      const st = fs8.statSync(full);
       if (st.isDirectory()) {
         walk(full);
       } else if (st.isFile()) {
@@ -1725,20 +1771,20 @@ function contentTag(sourceRoot) {
     }
   };
   walk(srcDir);
-  const pkgJson = path6.join(sourceRoot, "package.json");
-  if (fs7.existsSync(pkgJson)) {
+  const pkgJson = path7.join(sourceRoot, "package.json");
+  if (fs8.existsSync(pkgJson)) {
     files.push(pkgJson);
   }
   for (const f of files) {
-    h.update(path6.relative(sourceRoot, f));
-    h.update(fs7.readFileSync(f));
+    h.update(path7.relative(sourceRoot, f));
+    h.update(fs8.readFileSync(f));
   }
   return h.digest("hex").slice(0, 8);
 }
 function readManifest(vendorDir) {
   try {
     const data = JSON.parse(
-      fs7.readFileSync(path6.join(vendorDir, MANIFEST_NAME), "utf-8")
+      fs8.readFileSync(path7.join(vendorDir, MANIFEST_NAME), "utf-8")
     );
     return data !== null && typeof data === "object" ? data : {};
   } catch {
@@ -1746,8 +1792,8 @@ function readManifest(vendorDir) {
   }
 }
 function writeManifest(vendorDir, manifest) {
-  fs7.writeFileSync(
-    path6.join(vendorDir, MANIFEST_NAME),
+  fs8.writeFileSync(
+    path7.join(vendorDir, MANIFEST_NAME),
     `${JSON.stringify(manifest, null, 2)}
 `
   );
@@ -1756,26 +1802,26 @@ function tarballPrefix(pkgName) {
   return `${pkgName.replace(/^@/, "").replace(/\//g, "-")}-`;
 }
 function sha256File(p) {
-  return crypto.createHash("sha256").update(fs7.readFileSync(p)).digest("hex");
+  return crypto.createHash("sha256").update(fs8.readFileSync(p)).digest("hex");
 }
 function rewriteDepToTarball(agentDir, pkgName, tarballName) {
-  const pkgJsonPath = path6.join(agentDir, "package.json");
-  if (!fs7.existsSync(pkgJsonPath)) {
+  const pkgJsonPath = path7.join(agentDir, "package.json");
+  if (!fs8.existsSync(pkgJsonPath)) {
     return;
   }
-  const pkg = JSON.parse(fs7.readFileSync(pkgJsonPath, "utf-8"));
+  const pkg = JSON.parse(fs8.readFileSync(pkgJsonPath, "utf-8"));
   if (!pkg.dependencies || !(pkgName in pkg.dependencies)) {
     return;
   }
   pkg.dependencies[pkgName] = `file:vendor/${tarballName}`;
-  fs7.writeFileSync(pkgJsonPath, `${JSON.stringify(pkg, null, 2)}
+  fs8.writeFileSync(pkgJsonPath, `${JSON.stringify(pkg, null, 2)}
 `);
 }
 async function vendorLocalTarballs(agentDir, opts = {}) {
   const packages = opts.packages ?? VENDORED_PACKAGES;
   const resolveLocal = opts.resolveLocal ?? localSourceRoot;
   const required = new Set(opts.requiredPackages ?? []);
-  const vendorDir = path6.join(agentDir, "vendor");
+  const vendorDir = path7.join(agentDir, "vendor");
   const vendored = [];
   for (const pkgName of packages) {
     const local = resolveLocal(pkgName);
@@ -1785,19 +1831,19 @@ async function vendorLocalTarballs(agentDir, opts = {}) {
     if (!opts.force && await publishedOnRegistry(pkgName, local.version)) {
       continue;
     }
-    fs7.mkdirSync(vendorDir, { recursive: true });
+    fs8.mkdirSync(vendorDir, { recursive: true });
     const manifest = readManifest(vendorDir);
     const tag = contentTag(local.root);
     const prior = manifest[pkgName];
-    if (prior !== void 0 && prior.sourceTag === tag && fs7.existsSync(path6.join(vendorDir, prior.tarball))) {
+    if (prior !== void 0 && prior.sourceTag === tag && fs8.existsSync(path7.join(vendorDir, prior.tarball))) {
       rewriteDepToTarball(agentDir, pkgName, prior.tarball);
       vendored.push(pkgName);
       continue;
     }
     const prefix = tarballPrefix(pkgName);
-    for (const name of fs7.readdirSync(vendorDir)) {
+    for (const name of fs8.readdirSync(vendorDir)) {
       if (name.startsWith(prefix) && name.endsWith(".tgz")) {
-        fs7.rmSync(path6.join(vendorDir, name), { force: true });
+        fs8.rmSync(path7.join(vendorDir, name), { force: true });
       }
     }
     const result = await runCapture(
@@ -1816,8 +1862,8 @@ ${result.stderr.trim()}` : ""}`;
     }
     const lines = result.stdout.split("\n").filter((l) => l.trim());
     const packed = lines[lines.length - 1]?.trim();
-    const tarballPath = packed && fs7.existsSync(packed) ? packed : packed ? path6.join(vendorDir, path6.basename(packed)) : null;
-    if (!tarballPath || !fs7.existsSync(tarballPath)) {
+    const tarballPath = packed && fs8.existsSync(packed) ? packed : packed ? path7.join(vendorDir, path7.basename(packed)) : null;
+    if (!tarballPath || !fs8.existsSync(tarballPath)) {
       const message = `pnpm pack for ${pkgName} reported no tarball`;
       if (required.has(pkgName)) {
         throw new Error(message);
@@ -1825,7 +1871,7 @@ ${result.stderr.trim()}` : ""}`;
       printErr(`warning: ${message}; skipping.`);
       continue;
     }
-    const tarballName = path6.basename(tarballPath);
+    const tarballName = path7.basename(tarballPath);
     manifest[pkgName] = {
       version: local.version,
       sha256: sha256File(tarballPath),
@@ -1860,20 +1906,20 @@ async function provisionInstall(workspaceRoot) {
   return true;
 }
 function applyWorkspaceVendorOverrides(workspaceRoot, agentDir) {
-  const manifest = readManifest(path6.join(agentDir, "vendor"));
+  const manifest = readManifest(path7.join(agentDir, "vendor"));
   const entries = Object.entries(manifest);
   if (entries.length === 0) {
     return;
   }
-  const workspacePath = path6.join(workspaceRoot, "pnpm-workspace.yaml");
+  const workspacePath = path7.join(workspaceRoot, "pnpm-workspace.yaml");
   const workspaceDoc = parseYaml(
-    fs7.existsSync(workspacePath) ? fs7.readFileSync(workspacePath, "utf-8") : "packages:\n  - app/agent\n"
+    fs8.existsSync(workspacePath) ? fs8.readFileSync(workspacePath, "utf-8") : "packages:\n  - app/agent\n"
   );
   const workspace = workspaceDoc ?? {};
   const existingOverrides = workspace.overrides !== null && typeof workspace.overrides === "object" && !Array.isArray(workspace.overrides) ? workspace.overrides : {};
-  const pkgPath = path6.join(workspaceRoot, "package.json");
-  const pkg = JSON.parse(fs7.readFileSync(pkgPath, "utf-8"));
-  const relVendor = path6.relative(workspaceRoot, path6.join(agentDir, "vendor")).split(path6.sep).join("/");
+  const pkgPath = path7.join(workspaceRoot, "package.json");
+  const pkg = JSON.parse(fs8.readFileSync(pkgPath, "utf-8"));
+  const relVendor = path7.relative(workspaceRoot, path7.join(agentDir, "vendor")).split(path7.sep).join("/");
   const overrides = {
     ...existingOverrides,
     ...pkg.pnpm?.overrides ?? {}
@@ -1882,10 +1928,10 @@ function applyWorkspaceVendorOverrides(workspaceRoot, agentDir) {
     overrides[name] = `file:${relVendor}/${entry.tarball}`;
   }
   workspace.overrides = overrides;
-  fs7.writeFileSync(workspacePath, stringifyYaml(workspace));
-  const agentWorkspacePath = path6.join(agentDir, "pnpm-workspace.yaml");
+  fs8.writeFileSync(workspacePath, stringifyYaml(workspace));
+  const agentWorkspacePath = path7.join(agentDir, "pnpm-workspace.yaml");
   const agentWorkspaceDoc = parseYaml(
-    fs7.existsSync(agentWorkspacePath) ? fs7.readFileSync(agentWorkspacePath, "utf-8") : "packages:\n  - .\nallowBuilds:\n  esbuild: true\n"
+    fs8.existsSync(agentWorkspacePath) ? fs8.readFileSync(agentWorkspacePath, "utf-8") : "packages:\n  - .\nallowBuilds:\n  esbuild: true\n"
   );
   const agentWorkspace = agentWorkspaceDoc ?? {};
   const agentOverrides = agentWorkspace.overrides !== null && typeof agentWorkspace.overrides === "object" && !Array.isArray(agentWorkspace.overrides) ? agentWorkspace.overrides : {};
@@ -1893,9 +1939,9 @@ function applyWorkspaceVendorOverrides(workspaceRoot, agentDir) {
     agentOverrides[name] = `file:vendor/${entry.tarball}`;
   }
   agentWorkspace.overrides = agentOverrides;
-  fs7.writeFileSync(agentWorkspacePath, stringifyYaml(agentWorkspace));
+  fs8.writeFileSync(agentWorkspacePath, stringifyYaml(agentWorkspace));
   pkg.pnpm = { ...pkg.pnpm ?? {}, overrides };
-  fs7.writeFileSync(pkgPath, `${JSON.stringify(pkg, null, 2)}
+  fs8.writeFileSync(pkgPath, `${JSON.stringify(pkg, null, 2)}
 `);
 }
 
@@ -1930,7 +1976,7 @@ function registerBundle(program) {
     act(async (opts) => {
       try {
         const result = await createBundle(opts);
-        const sizeKb = fs8.statSync(result.archivePath).size / 1024;
+        const sizeKb = fs9.statSync(result.archivePath).size / 1024;
         printOut("");
         printOut(
           `\u2713 bundle ready: ${result.archivePath}  (${sizeKb.toFixed(1)} KB)`
@@ -1952,7 +1998,7 @@ function registerBundle(program) {
   );
 }
 async function createBundle(opts = {}) {
-  const start = path7.resolve(opts.projectRoot ?? process.cwd());
+  const start = path8.resolve(opts.projectRoot ?? process.cwd());
   const agentRoot2 = resolveAgentRoot(start);
   if (agentRoot2 === null) {
     throw new Error(
@@ -1962,24 +2008,24 @@ async function createBundle(opts = {}) {
   const workspaceRoot = trueWorkspaceRoot(agentRoot2);
   const projectName2 = readProjectName(agentRoot2);
   const safeName = projectName2.replace(/[^A-Za-z0-9._-]+/g, "-");
-  const outputDir = path7.resolve(
-    opts.output ?? path7.join(workspaceRoot, "dist")
+  const outputDir = path8.resolve(
+    opts.output ?? path8.join(workspaceRoot, "dist")
   );
-  fs8.mkdirSync(outputDir, { recursive: true });
+  fs9.mkdirSync(outputDir, { recursive: true });
   const stamp = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   const archiveBase = `${safeName}-bundle-${stamp}`;
-  const stagingRoot = path7.join(outputDir, `.${archiveBase}.staging`);
-  const stagedWorkspace = path7.join(stagingRoot, safeName);
+  const stagingRoot = path8.join(outputDir, `.${archiveBase}.staging`);
+  const stagedWorkspace = path8.join(stagingRoot, safeName);
   if (stagedWorkspace === stagingRoot || !inside(stagedWorkspace, stagingRoot)) {
     throw new Error(
       `unsafe project name ${JSON.stringify(projectName2)} escapes the bundle staging directory`
     );
   }
-  const agentRel = path7.relative(workspaceRoot, agentRoot2);
-  const stagedAgent = path7.join(stagedWorkspace, agentRel);
-  const archivePath = path7.join(outputDir, `${archiveBase}.tar.gz`);
-  fs8.rmSync(stagingRoot, { recursive: true, force: true });
-  fs8.mkdirSync(stagingRoot, { recursive: true });
+  const agentRel = path8.relative(workspaceRoot, agentRoot2);
+  const stagedAgent = path8.join(stagedWorkspace, agentRel);
+  const archivePath = path8.join(outputDir, `${archiveBase}.tar.gz`);
+  fs9.rmSync(stagingRoot, { recursive: true, force: true });
+  fs9.mkdirSync(stagingRoot, { recursive: true });
   try {
     printOut(`\u2192 Staging seller workspace at ${stagedWorkspace}\u2026`);
     copyWorkspace(workspaceRoot, stagedWorkspace, outputDir);
@@ -2018,26 +2064,26 @@ async function createBundle(opts = {}) {
       [safeName]
     );
   } finally {
-    fs8.rmSync(stagingRoot, { recursive: true, force: true });
+    fs9.rmSync(stagingRoot, { recursive: true, force: true });
   }
   return { archivePath, projectName: projectName2 };
 }
 function resolveAgentRoot(start) {
   const found = findSubProjectRoot2("agent", start);
-  if (found !== null && fs8.existsSync(path7.join(found, "studio.toml"))) {
+  if (found !== null && fs9.existsSync(path8.join(found, "studio.toml"))) {
     return found;
   }
-  return fs8.existsSync(path7.join(start, "studio.toml")) ? start : null;
+  return fs9.existsSync(path8.join(start, "studio.toml")) ? start : null;
 }
 function trueWorkspaceRoot(agentRoot2) {
   const found = findWorkspaceRoot2(agentRoot2);
   if (found === null) {
     return agentRoot2;
   }
-  return path7.basename(found) === "app" ? path7.dirname(found) : found;
+  return path8.basename(found) === "app" ? path8.dirname(found) : found;
 }
 function readProjectName(agentRoot2) {
-  const cfg = loadStudioToml2(path7.join(agentRoot2, "studio.toml"));
+  const cfg = loadStudioToml2(path8.join(agentRoot2, "studio.toml"));
   const project = cfg.project;
   const name = project !== null && typeof project === "object" && !Array.isArray(project) ? project.name : null;
   if (!name) {
@@ -2050,58 +2096,58 @@ function excludedName(name) {
   return EXCLUDED_NAMES.has(lowerName) || CREDENTIAL_FILE_NAMES.has(lowerName) || lowerName.startsWith(".env") || lowerName.endsWith(".egg-info") || lowerName.startsWith(".venv-");
 }
 function inside(child, parent) {
-  const rel = path7.relative(parent, child);
-  return rel === "" || !rel.startsWith("..") && !path7.isAbsolute(rel);
+  const rel = path8.relative(parent, child);
+  return rel === "" || !rel.startsWith("..") && !path8.isAbsolute(rel);
 }
 function copyWorkspace(sourceRoot, destinationRoot, outputDir) {
-  const source = path7.resolve(sourceRoot);
-  const excludedOutput = outputDir ? path7.resolve(outputDir) : null;
+  const source = path8.resolve(sourceRoot);
+  const excludedOutput = outputDir ? path8.resolve(outputDir) : null;
   const copy = (src, dst) => {
     if (excludedOutput !== null && inside(src, excludedOutput)) {
       return;
     }
-    const name = path7.basename(src);
+    const name = path8.basename(src);
     if (src !== source && excludedName(name)) {
       return;
     }
-    const stat = fs8.lstatSync(src);
+    const stat = fs9.lstatSync(src);
     if (stat.isSymbolicLink()) {
-      const link = fs8.readlinkSync(src);
-      const lexicalTarget = path7.resolve(path7.dirname(src), link);
+      const link = fs9.readlinkSync(src);
+      const lexicalTarget = path8.resolve(path8.dirname(src), link);
       let resolvedTarget = lexicalTarget;
       try {
-        resolvedTarget = fs8.realpathSync(lexicalTarget);
+        resolvedTarget = fs9.realpathSync(lexicalTarget);
       } catch {
       }
       if (!inside(resolvedTarget, source)) {
         throw new Error(
-          `refusing to bundle symlink ${path7.relative(source, src)} \u2192 ${link}: its target escapes the project tree (possible secret leak).`
+          `refusing to bundle symlink ${path8.relative(source, src)} \u2192 ${link}: its target escapes the project tree (possible secret leak).`
         );
       }
-      fs8.mkdirSync(path7.dirname(dst), { recursive: true });
-      fs8.symlinkSync(link, dst);
+      fs9.mkdirSync(path8.dirname(dst), { recursive: true });
+      fs9.symlinkSync(link, dst);
       return;
     }
     if (stat.isDirectory()) {
-      fs8.mkdirSync(dst, { recursive: true, mode: stat.mode & 511 });
-      for (const child of fs8.readdirSync(src).sort()) {
-        copy(path7.join(src, child), path7.join(dst, child));
+      fs9.mkdirSync(dst, { recursive: true, mode: stat.mode & 511 });
+      for (const child of fs9.readdirSync(src).sort()) {
+        copy(path8.join(src, child), path8.join(dst, child));
       }
       return;
     }
     if (stat.isFile()) {
-      fs8.mkdirSync(path7.dirname(dst), { recursive: true });
-      fs8.copyFileSync(src, dst);
-      fs8.chmodSync(dst, stat.mode & 511);
+      fs9.mkdirSync(path8.dirname(dst), { recursive: true });
+      fs9.copyFileSync(src, dst);
+      fs9.chmodSync(dst, stat.mode & 511);
     }
   };
   copy(source, destinationRoot);
 }
 function writeEnvExample(agentRoot2, stagedWorkspace) {
   const sourceEnv = envLocalPath4(agentRoot2);
-  const targetDir = path7.join(stagedWorkspace, ".studio");
-  const target = path7.join(targetDir, ".env.local.example");
-  fs8.mkdirSync(targetDir, { recursive: true, mode: 448 });
+  const targetDir = path8.join(stagedWorkspace, ".studio");
+  const target = path8.join(targetDir, ".env.local.example");
+  fs9.mkdirSync(targetDir, { recursive: true, mode: 448 });
   const header = [
     "# Copy to .studio/.env.local and fill in values.",
     "# Generated by `bag bundle`; secret values were stripped.",
@@ -2109,7 +2155,7 @@ function writeEnvExample(agentRoot2, stagedWorkspace) {
   ];
   let lines;
   try {
-    lines = fs8.readFileSync(sourceEnv, "utf-8").split(/\r?\n/);
+    lines = fs9.readFileSync(sourceEnv, "utf-8").split(/\r?\n/);
   } catch {
     lines = [
       "WALLET_PASSWORD=",
@@ -2127,29 +2173,29 @@ function writeEnvExample(agentRoot2, stagedWorkspace) {
     const match = /^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=/.exec(line);
     return match ? `${match[1]}=` : "# omitted unrecognized dotenv entry";
   });
-  fs8.writeFileSync(target, `${[...header, ...stripped].join("\n")}
+  fs9.writeFileSync(target, `${[...header, ...stripped].join("\n")}
 `, {
     mode: 384
   });
 }
 function findStagedLeak(stagedWorkspace) {
-  const root = path7.resolve(stagedWorkspace);
+  const root = path8.resolve(stagedWorkspace);
   const walk = (dir) => {
-    for (const name of fs8.readdirSync(dir).sort()) {
-      const full = path7.join(dir, name);
-      const rel = path7.relative(root, full);
-      const stat = fs8.lstatSync(full);
+    for (const name of fs9.readdirSync(dir).sort()) {
+      const full = path8.join(dir, name);
+      const rel = path8.relative(root, full);
+      const stat = fs9.lstatSync(full);
       const lowerName = name.toLowerCase();
       if (stat.isSymbolicLink()) {
-        const link = fs8.readlinkSync(full);
-        const target = path7.resolve(path7.dirname(full), link);
+        const link = fs9.readlinkSync(full);
+        const target = path8.resolve(path8.dirname(full), link);
         if (!inside(target, root)) {
           return `escaping symlink ${rel} \u2192 ${link}`;
         }
         continue;
       }
       if (stat.isDirectory()) {
-        if (lowerName === "wallets" && path7.basename(path7.dirname(full)).toLowerCase() === ".studio") {
+        if (lowerName === "wallets" && path8.basename(path8.dirname(full)).toLowerCase() === ".studio") {
           return `wallet directory ${rel}`;
         }
         const nested = walk(full);
@@ -2167,7 +2213,7 @@ function findStagedLeak(stagedWorkspace) {
           "# omitted source comment",
           "# omitted unrecognized dotenv entry"
         ]);
-        const unsafeExample = fs8.readFileSync(full, "utf-8").split(/\r?\n/u).some((line) => {
+        const unsafeExample = fs9.readFileSync(full, "utf-8").split(/\r?\n/u).some((line) => {
           if (!line.trim() || safeFixedLines.has(line)) return false;
           return !/^#?\s*[A-Za-z_][A-Za-z0-9_]*=$/u.test(line);
         });
@@ -2218,12 +2264,12 @@ function writeInstallMd(stagedWorkspace, projectName2) {
     "- `node_modules/`, build outputs, caches, and repository history",
     ""
   ];
-  fs8.writeFileSync(path7.join(stagedWorkspace, "INSTALL.md"), lines.join("\n"));
+  fs9.writeFileSync(path8.join(stagedWorkspace, "INSTALL.md"), lines.join("\n"));
 }
 
 // src/cli/config.ts
-import * as fs9 from "fs";
-import * as path8 from "path";
+import * as fs10 from "fs";
+import * as path9 from "path";
 import { NegotiationHandler } from "@bnbagent/sdk/erc8183";
 import { Option } from "commander";
 import { parse as parse4 } from "smol-toml";
@@ -2489,8 +2535,8 @@ function cmdShow4(asJson, projectRoot) {
   if (root === null) {
     return 2;
   }
-  const tomlPath = path8.join(root, "studio.toml");
-  const text2 = fs9.readFileSync(tomlPath, "utf-8");
+  const tomlPath = path9.join(root, "studio.toml");
+  const text2 = fs10.readFileSync(tomlPath, "utf-8");
   if (asJson) {
     printOut(sortedJson(parse4(text2)));
   } else {
@@ -2506,7 +2552,7 @@ function cmdGet(key, projectRoot) {
   if (root === null) {
     return 2;
   }
-  const doc = parse4(fs9.readFileSync(path8.join(root, "studio.toml"), "utf-8"));
+  const doc = parse4(fs10.readFileSync(path9.join(root, "studio.toml"), "utf-8"));
   let val;
   try {
     val = navigate(doc, splitKey(key));
@@ -2528,8 +2574,8 @@ async function cmdSet(key, rawValue, typeFlag, projectRoot) {
   if (root === null) {
     return 2;
   }
-  const tomlPath = path8.join(root, "studio.toml");
-  const text2 = fs9.readFileSync(tomlPath, "utf-8");
+  const tomlPath = path9.join(root, "studio.toml");
+  const text2 = fs10.readFileSync(tomlPath, "utf-8");
   let parts;
   try {
     parts = splitKey(key);
@@ -2550,7 +2596,7 @@ async function cmdSet(key, rawValue, typeFlag, projectRoot) {
     return 2;
   }
   const updatedText = setDottedKey(text2, parts, value);
-  fs9.writeFileSync(tomlPath, updatedText, "utf-8");
+  fs10.writeFileSync(tomlPath, updatedText, "utf-8");
   printOut(`set ${key} = ${JSON.stringify(plainValue(value))}`);
   if (parts.length === 3 && parts[0] === "payments" && parts[1] === "erc8183" && parts[2] === "price") {
     const updated = parse4(updatedText);
@@ -2623,7 +2669,7 @@ function cmdListKeys(projectRoot) {
   if (root === null) {
     return 2;
   }
-  const doc = parse4(fs9.readFileSync(path8.join(root, "studio.toml"), "utf-8"));
+  const doc = parse4(fs10.readFileSync(path9.join(root, "studio.toml"), "utf-8"));
   const leaves = iterLeaves(doc, []);
   leaves.sort((a, b) => a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0);
   for (const [k, v] of leaves) {
@@ -2645,8 +2691,8 @@ import { pieverseKeyHash as pieverseKeyHash3 } from "@bnbagent/studio-runtime/ll
 import { Option as Option4 } from "commander";
 
 // src/cli/_agentcoreAccess.ts
-import * as fs10 from "fs";
-import * as path9 from "path";
+import * as fs11 from "fs";
+import * as path10 from "path";
 import {
   envLocalPath as envLocalPath5,
   findWorkspaceRoot as findWorkspaceRoot3,
@@ -2655,7 +2701,7 @@ import {
 var GUIDE_URL = "https://github.com/bnb-chain/bnbagent-studio/blob/main/docs/guides/agentcore-a2a-access.md";
 function isFile2(p) {
   try {
-    return fs10.statSync(p).isFile();
+    return fs11.statSync(p).isFile();
   } catch {
     return false;
   }
@@ -2670,13 +2716,13 @@ function envValue(entries, key) {
   return null;
 }
 function descriptorEnv(workspaceRoot) {
-  const descriptor = path9.join(workspaceRoot, "agentcore", "agentcore.json");
+  const descriptor = path10.join(workspaceRoot, "agentcore", "agentcore.json");
   if (!isFile2(descriptor)) {
     return [];
   }
   let data;
   try {
-    data = JSON.parse(fs10.readFileSync(descriptor, "utf-8"));
+    data = JSON.parse(fs11.readFileSync(descriptor, "utf-8"));
   } catch {
     return [];
   }
@@ -2695,8 +2741,8 @@ function descriptorEnv(workspaceRoot) {
   return Array.isArray(env) ? env : [];
 }
 function agentcoreProjectRoot(workspaceRoot) {
-  for (const candidate of [path9.dirname(workspaceRoot), workspaceRoot]) {
-    if (isFile2(path9.join(candidate, "agentcore", "agentcore.json"))) {
+  for (const candidate of [path10.dirname(workspaceRoot), workspaceRoot]) {
+    if (isFile2(path10.join(candidate, "agentcore", "agentcore.json"))) {
       return candidate;
     }
   }
@@ -2708,7 +2754,7 @@ function dotenvValue(filePath, key) {
   }
   let lines;
   try {
-    lines = fs10.readFileSync(filePath, "utf-8").split(/\r?\n/);
+    lines = fs11.readFileSync(filePath, "utf-8").split(/\r?\n/);
   } catch {
     return null;
   }
@@ -2741,7 +2787,7 @@ function oauthFacts(workspaceRoot, agentRoot2) {
 function accessSummaryForAgentcore(agentRoot2, opts = {}) {
   let data;
   try {
-    data = loadStudioToml3(path9.join(agentRoot2, "studio.toml"));
+    data = loadStudioToml3(path10.join(agentRoot2, "studio.toml"));
   } catch {
     return null;
   }
@@ -2774,8 +2820,8 @@ import {
 } from "@bnbagent/studio-runtime/config";
 
 // src/cli/_deploy/checks/_wallet.ts
-import * as fs11 from "fs";
-import * as path10 from "path";
+import * as fs12 from "fs";
+import * as path11 from "path";
 import {
   findSubProjectRoot as findSubProjectRoot3,
   loadStudioToml as loadStudioToml4
@@ -2882,16 +2928,16 @@ async function checkUBalance(walletAddress, neededUsd, networkName) {
 
 // src/cli/_deploy/checks/_wallet.ts
 function agentRootOf(root) {
-  return findSubProjectRoot3("agent", root) ?? path10.join(root, "app", "agent");
+  return findSubProjectRoot3("agent", root) ?? path11.join(root, "app", "agent");
 }
 function tableOf2(data, key) {
   const v = data[key];
   return v !== null && typeof v === "object" && !Array.isArray(v) ? v : {};
 }
 function loadAgentToml(root) {
-  const p = path10.join(agentRootOf(root), "studio.toml");
+  const p = path11.join(agentRootOf(root), "studio.toml");
   try {
-    if (!fs11.statSync(p).isFile()) {
+    if (!fs12.statSync(p).isFile()) {
       return {};
     }
   } catch {
@@ -2905,7 +2951,7 @@ function loadAgentToml(root) {
 }
 function keystoreJsonPresent(dir) {
   try {
-    return fs11.statSync(dir).isDirectory() && fs11.readdirSync(dir).some((n) => n.endsWith(".json"));
+    return fs12.statSync(dir).isDirectory() && fs12.readdirSync(dir).some((n) => n.endsWith(".json"));
   } catch {
     return false;
   }
@@ -2926,7 +2972,7 @@ function canBuildWallet(root, data) {
     return false;
   }
   const rel = String(walletCfg.keystore_dir ?? ".studio/wallets");
-  const keystoreDir = path10.isAbsolute(rel) ? rel : path10.join(agentRootOf(root), rel);
+  const keystoreDir = path11.isAbsolute(rel) ? rel : path11.join(agentRootOf(root), rel);
   return keystoreJsonPresent(keystoreDir);
 }
 function walletAddressForChecks(root, data) {
@@ -3100,8 +3146,8 @@ import { writePrivate as writePrivate2 } from "@bnbagent/studio-runtime/secretWr
 import { Option as Option3 } from "commander";
 
 // src/cli/_migrations.ts
-import * as fs12 from "fs";
-import * as path11 from "path";
+import * as fs13 from "fs";
+import * as path12 from "path";
 import {
   envLocalPath as envLocalPath7,
   findSubProjectRoot as findSubProjectRoot5,
@@ -3109,59 +3155,59 @@ import {
 } from "@bnbagent/studio-runtime/config";
 function isFile3(p) {
   try {
-    return fs12.statSync(p).isFile();
+    return fs13.statSync(p).isFile();
   } catch {
     return false;
   }
 }
 function isDir2(p) {
   try {
-    return fs12.statSync(p).isDirectory();
+    return fs13.statSync(p).isDirectory();
   } catch {
     return false;
   }
 }
 function realpathOr(p) {
   try {
-    return fs12.realpathSync(p);
+    return fs13.realpathSync(p);
   } catch {
-    return path11.resolve(p);
+    return path12.resolve(p);
   }
 }
 function keystoreJsonFiles(dir) {
   if (!isDir2(dir)) {
     return [];
   }
-  return fs12.readdirSync(dir).filter((n) => n.endsWith(".json")).sort();
+  return fs13.readdirSync(dir).filter((n) => n.endsWith(".json")).sort();
 }
 function migrateEnvLocal(start) {
   try {
     const target = envLocalPath7(start);
-    const ws = path11.dirname(path11.dirname(target));
+    const ws = path12.dirname(path12.dirname(target));
     const agentRoot2 = findSubProjectRoot5("agent", start);
     const sources = [];
     if (agentRoot2 !== null) {
-      sources.push(path11.join(agentRoot2, ".env.local"));
+      sources.push(path12.join(agentRoot2, ".env.local"));
     }
-    sources.push(path11.join(ws, ".bag-env-stash", ".env.local"));
+    sources.push(path12.join(ws, ".bag-env-stash", ".env.local"));
     for (const src of sources) {
-      if (!isFile3(src) || path11.resolve(src) === path11.resolve(target)) {
+      if (!isFile3(src) || path12.resolve(src) === path12.resolve(target)) {
         continue;
       }
-      if (fs12.existsSync(target)) {
+      if (fs13.existsSync(target)) {
         printErr(
           `note: both ${src} and ${target} exist; left ${src} untouched. Secrets now live in .studio/.env.local \u2014 reconcile and remove the old file.`
         );
         continue;
       }
-      fs12.mkdirSync(path11.dirname(target), { recursive: true });
-      fs12.renameSync(src, target);
-      fs12.chmodSync(target, 384);
+      fs13.mkdirSync(path12.dirname(target), { recursive: true });
+      fs13.renameSync(src, target);
+      fs13.chmodSync(target, 384);
       printErr(
         `note: migrated ${src} -> ${target} (secrets now live outside the deploy codeLocation).`
       );
     }
-    fs12.rmSync(path11.join(ws, ".bag-env-stash"), {
+    fs13.rmSync(path12.join(ws, ".bag-env-stash"), {
       recursive: true,
       force: true
     });
@@ -3171,7 +3217,7 @@ function migrateEnvLocal(start) {
 var KEYSTORE_WALLET_KINDS = /* @__PURE__ */ new Set(["evm-local", "altana"]);
 function readWalletKind(agentRoot2) {
   try {
-    const wallet = loadStudioToml5(path11.join(agentRoot2, "studio.toml")).wallet;
+    const wallet = loadStudioToml5(path12.join(agentRoot2, "studio.toml")).wallet;
     if (wallet !== null && typeof wallet === "object") {
       const kind = wallet.kind;
       if (typeof kind === "string" && kind.trim()) {
@@ -3185,7 +3231,7 @@ function readWalletKind(agentRoot2) {
 function resolveKeystoreDir(agentRoot2) {
   let rel = ".studio/wallets";
   try {
-    const data = loadStudioToml5(path11.join(agentRoot2, "studio.toml"));
+    const data = loadStudioToml5(path12.join(agentRoot2, "studio.toml"));
     const wallet = data.wallet;
     if (wallet !== null && typeof wallet === "object") {
       const v = wallet.keystore_dir;
@@ -3195,24 +3241,24 @@ function resolveKeystoreDir(agentRoot2) {
     }
   } catch {
   }
-  return path11.isAbsolute(rel) ? rel : path11.join(agentRoot2, rel);
+  return path12.isAbsolute(rel) ? rel : path12.join(agentRoot2, rel);
 }
 function migrateKeystoreOutOfCodelocation(start) {
   const agentRoot2 = findSubProjectRoot5("agent", start);
   if (agentRoot2 === null) {
     return;
   }
-  const ws = path11.dirname(path11.dirname(envLocalPath7(start)));
-  const target = path11.join(ws, ".studio", "wallets");
-  const stash = path11.join(ws, ".bag-keystore-stash");
+  const ws = path12.dirname(path12.dirname(envLocalPath7(start)));
+  const target = path12.join(ws, ".studio", "wallets");
+  const stash = path12.join(ws, ".bag-keystore-stash");
   if (isDir2(stash)) {
-    for (const name of fs12.readdirSync(stash).sort()) {
-      const sub = path11.join(stash, name);
+    for (const name of fs13.readdirSync(stash).sort()) {
+      const sub = path12.join(stash, name);
       if (isDir2(sub) && keystoreJsonFiles(sub).length > 0) {
         relocateKeys(sub, target, "stashed keystore");
       }
     }
-    fs12.rmSync(stash, { recursive: true, force: true });
+    fs13.rmSync(stash, { recursive: true, force: true });
   }
   if (!KEYSTORE_WALLET_KINDS.has(readWalletKind(agentRoot2))) {
     return;
@@ -3220,7 +3266,7 @@ function migrateKeystoreOutOfCodelocation(start) {
   const src = resolveKeystoreDir(agentRoot2);
   const srcReal = realpathOr(src);
   const agentReal = realpathOr(agentRoot2);
-  if (srcReal !== agentReal && !srcReal.startsWith(agentReal + path11.sep)) {
+  if (srcReal !== agentReal && !srcReal.startsWith(agentReal + path12.sep)) {
     return;
   }
   if (srcReal === realpathOr(target)) {
@@ -3231,13 +3277,13 @@ function migrateKeystoreOutOfCodelocation(start) {
       return;
     }
   }
-  const rel = path11.relative(agentRoot2, target).split(path11.sep).join("/");
-  const tomlPath = path11.join(agentRoot2, "studio.toml");
+  const rel = path12.relative(agentRoot2, target).split(path12.sep).join("/");
+  const tomlPath = path12.join(agentRoot2, "studio.toml");
   if (isFile3(tomlPath)) {
-    const text2 = fs12.readFileSync(tomlPath, "utf-8");
+    const text2 = fs13.readFileSync(tomlPath, "utf-8");
     const updated = updateSection(text2, "wallet", { keystore_dir: rel });
     if (updated !== text2) {
-      fs12.writeFileSync(tomlPath, updated);
+      fs13.writeFileSync(tomlPath, updated);
       printErr(
         `note: updated [wallet].keystore_dir -> ${rel} in studio.toml (keystore now lives at the workspace root, outside the codeLocation).`
       );
@@ -3245,7 +3291,7 @@ function migrateKeystoreOutOfCodelocation(start) {
   }
 }
 function relocateKeys(src, target, label) {
-  fs12.mkdirSync(target, { recursive: true });
+  fs13.mkdirSync(target, { recursive: true });
   if (keystoreJsonFiles(target).length > 0) {
     printErr(
       `note: both a ${label} at ${src} and keys at ${target} exist; left ${src} untouched for manual review (never overwritten).`
@@ -3253,15 +3299,15 @@ function relocateKeys(src, target, label) {
     return false;
   }
   try {
-    for (const name of fs12.readdirSync(src)) {
-      const f = path11.join(src, name);
-      if (fs12.statSync(f).isFile()) {
-        fs12.copyFileSync(f, path11.join(target, name));
+    for (const name of fs13.readdirSync(src)) {
+      const f = path12.join(src, name);
+      if (fs13.statSync(f).isFile()) {
+        fs13.copyFileSync(f, path12.join(target, name));
       }
     }
     for (const name of keystoreJsonFiles(src)) {
-      const a = fs12.readFileSync(path11.join(src, name));
-      const b = fs12.readFileSync(path11.join(target, name));
+      const a = fs13.readFileSync(path12.join(src, name));
+      const b = fs13.readFileSync(path12.join(target, name));
       if (!a.equals(b)) {
         throw new Error(`verification mismatch for ${name}`);
       }
@@ -3273,7 +3319,7 @@ function relocateKeys(src, target, label) {
     );
     return false;
   }
-  fs12.rmSync(src, { recursive: true, force: true });
+  fs13.rmSync(src, { recursive: true, force: true });
   printErr(
     `note: migrated ${label} ${src} -> ${target} (now outside the deploy codeLocation).`
   );
@@ -3290,8 +3336,8 @@ import { Option as Option2 } from "commander";
 import { parse as parseToml } from "smol-toml";
 
 // src/cli/_deploy/providers.ts
-import * as fs13 from "fs";
-import * as path12 from "path";
+import * as fs14 from "fs";
+import * as path13 from "path";
 import {
   findSubProjectRoot as findSubProjectRoot6,
   findWorkspaceRoot as findWorkspaceRoot4,
@@ -3334,8 +3380,8 @@ function text(value) {
 function descriptorName(workspaceRoot) {
   try {
     const data = JSON.parse(
-      fs13.readFileSync(
-        path12.join(workspaceRoot, "agentcore", "agentcore.json"),
+      fs14.readFileSync(
+        path13.join(workspaceRoot, "agentcore", "agentcore.json"),
         "utf-8"
       )
     );
@@ -3345,16 +3391,16 @@ function descriptorName(workspaceRoot) {
   }
 }
 function discoverRecordedDeployments(root) {
-  const workspaceRoot = findWorkspaceRoot4(root) ?? path12.resolve(root);
+  const workspaceRoot = findWorkspaceRoot4(root) ?? path13.resolve(root);
   const agentRoot2 = findSubProjectRoot6("agent", workspaceRoot);
   if (agentRoot2 === null) return [];
   let config;
   try {
-    config = loadStudioToml6(path12.join(agentRoot2, "studio.toml"));
+    config = loadStudioToml6(path13.join(agentRoot2, "studio.toml"));
   } catch {
     return [];
   }
-  const projectName2 = descriptorName(workspaceRoot) ?? text(tableOf3(config, "project").name) ?? path12.basename(workspaceRoot);
+  const projectName2 = descriptorName(workspaceRoot) ?? text(tableOf3(config, "project").name) ?? path13.basename(workspaceRoot);
   const deploy = tableOf3(config, "deploy");
   const platform = tableOf3(deploy, "platform");
   const azure = tableOf3(config, "azure");
@@ -3400,13 +3446,13 @@ function discoverRecordedDeployments(root) {
   return found;
 }
 function unavailableProvidersForProject(root) {
-  const workspaceRoot = findWorkspaceRoot4(root) ?? path12.resolve(root);
+  const workspaceRoot = findWorkspaceRoot4(root) ?? path13.resolve(root);
   const agentRoot2 = findSubProjectRoot6("agent", workspaceRoot);
   if (agentRoot2 === null) return {};
   let runtime = "agentcore";
   let azureProtocolUnsupported = false;
   try {
-    const cfg = loadStudioToml6(path12.join(agentRoot2, "studio.toml"));
+    const cfg = loadStudioToml6(path13.join(agentRoot2, "studio.toml"));
     runtime = text(tableOf3(cfg, "stack").runtime) ?? "agentcore";
     const faces = stackFaces(tableOf3(cfg, "stack"), tableOf3(cfg, "payments"));
     azureProtocolUnsupported = !hasA2aFace(faces) || hasMcpFace(faces);
@@ -3415,11 +3461,12 @@ function unavailableProvidersForProject(root) {
   }
   if (runtime === "azure-foundry") {
     const reason = "this project uses a different container adapter; scaffold an agentcore project before selecting this provider";
+    const azureProtocolReason = "Azure Foundry deploy currently supports A2A projects only; use an A2A azure-foundry scaffold or AgentCore for MCP";
     return {
-      bnb: reason,
       aws: reason,
       ...azureProtocolUnsupported ? {
-        azure: "Azure Foundry deploy currently supports A2A projects only; use an A2A azure-foundry scaffold or AgentCore for MCP"
+        bnb: azureProtocolReason,
+        azure: azureProtocolReason
       } : {}
     };
   }
@@ -3500,38 +3547,6 @@ async function selectDeployProvider(opts) {
   return promptProvider(opts);
 }
 
-// src/cli/_packageMetadata.ts
-import * as fs14 from "fs";
-import * as path13 from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
-function packageRoot() {
-  let dir = path13.dirname(fileURLToPath2(import.meta.url));
-  for (; ; ) {
-    const packageJson = path13.join(dir, "package.json");
-    if (fs14.existsSync(packageJson)) return dir;
-    const parent = path13.dirname(dir);
-    if (parent === dir) {
-      throw new Error("cannot locate the studio-cli package root");
-    }
-    dir = parent;
-  }
-}
-function pnpmVersion() {
-  if ("10.24.0") {
-    return "10.24.0";
-  }
-  const file = path13.join(packageRoot(), "package.json");
-  const pkg = JSON.parse(fs14.readFileSync(file, "utf-8"));
-  const value = String(pkg.packageManager ?? "");
-  const match = /^pnpm@(.+)$/u.exec(value);
-  if (!match?.[1]) {
-    throw new Error(
-      `studio-cli packageManager must pin pnpm (expected "pnpm@<version>" in ${file})`
-    );
-  }
-  return match[1];
-}
-
 // src/cli/_runtime/azureFoundry.ts
 import * as crypto2 from "crypto";
 import * as fs18 from "fs";
@@ -4545,6 +4560,18 @@ var azureFoundryChecks = [
   checkAltanaSdkResolvable,
   checkAltanaSessionNotInsideAgent
 ];
+var managedAzureFoundryChecks = [
+  checkStackRuntimeAzure,
+  checkEntrypointAndDockerfile,
+  checkLlmExternalProviderReady,
+  checkTwakCustomContractsUnsupported,
+  checkTwakPasswordEnvSet,
+  checkTwakCredentialsAvailable,
+  checkAltanaCustomContractsUnsupported,
+  checkAltanaSessionReady,
+  checkAltanaSdkResolvable,
+  checkAltanaSessionNotInsideAgent
+];
 
 // src/cli/llm.ts
 import * as fs19 from "fs";
@@ -13425,8 +13452,9 @@ var checkPlatformLoggedIn = async (_root, _target) => {
     }
   ];
 };
-var checkPlatformDockerAvailable = async (root, _target) => {
-  if (platformArtifact(loadAgent(root)) !== "container") return [];
+var checkPlatformDockerAvailable = async (root, target) => {
+  if (target !== "platform-azure" && platformArtifact(loadAgent(root)) !== "container")
+    return [];
   const docker = await whichBin("docker");
   if (docker === null) {
     return [
@@ -13563,6 +13591,17 @@ async function runPrepare(opts = {}) {
     }
     return new CheckResult(checks, target);
   }
+  if (target === "platform-azure") {
+    checks.push(...await runProducers(criticalChecks, root, target));
+    checks.push(
+      ...await runProducers(managedAzureFoundryChecks, root, target)
+    );
+    checks.push(...await runProducers(warningChecks, root, target));
+    if (includeInfo) {
+      checks.push(...await runProducers(infoChecks, root, target));
+    }
+    return new CheckResult(checks, target);
+  }
   if (target === "azure-foundry") {
     checks.push(
       ...await runProducers(
@@ -14267,12 +14306,37 @@ function trialLine(trial) {
 }
 async function platformAgent(opts) {
   const root = opts.root;
+  const backend = opts.backend ?? "aws";
   const isTty = opts.isTty ?? stdinIsTty;
   const ask = opts.promptUser ?? promptUser;
   warn(
-    "note: deploying to the BNB Chain managed platform \u2014 a 48h TESTNET trial sandbox (network is forced to bsc-testnet; the runtime is auto-reclaimed at 48h). Not a production seller."
+    `note: deploying to the BNB Chain managed platform (backend=${backend}) \u2014 a 48h TESTNET trial sandbox (network is forced to bsc-testnet; the runtime is auto-reclaimed at 48h). Not a production seller.`
   );
   const platformCmd = opts.runPlatformCommand ?? runPlatformAccountCommand;
+  if (backend === "azure") {
+    const cfg2 = loadAgentCfg(root);
+    const faces2 = stackFaces(tableOf12(cfg2, "stack"), tableOf12(cfg2, "payments"));
+    const protocol2 = nativeProtocolOf(faces2);
+    if (hasX402Face(faces2)) {
+      warn(
+        "error: x402 publication is not supported on the managed Azure backend. No build or upload was started."
+      );
+      return 1;
+    }
+    const runtimeProfile = protocol2 === "A2A" ? "foundry-responses-v1" : "foundry-invocations-v1";
+    const capability = await platformCmd(["capabilities"], { json: true });
+    const platform = isJsonObject(capability.data.platform) ? capability.data.platform : {};
+    const backends = isJsonObject(platform.backends) ? platform.backends : {};
+    const azure = isJsonObject(backends.azure) ? backends.azure : {};
+    const profiles = Array.isArray(azure.runtimeProfiles) ? azure.runtimeProfiles.map(String) : [];
+    const protocols = Array.isArray(azure.protocols) ? azure.protocols.map(String) : [];
+    if (capability.code !== 0 || azure.enabled !== true || !profiles.includes(runtimeProfile) || !protocols.includes(protocol2)) {
+      warn(
+        `error: the managed platform does not currently accept Azure ${runtimeProfile}/${protocol2}. No build or upload was started.`
+      );
+      return capability.code || 1;
+    }
+  }
   const campaignProbe = opts.campaignActive ?? (async () => null);
   const trialRes = await platformCmd(["trial"], { json: true });
   if (trialRes.code !== 0) {
@@ -14306,7 +14370,7 @@ async function platformAgent(opts) {
       return rc;
     }
   }
-  const packaging = platformPackaging(root);
+  const packaging = backend === "azure" ? "container" : platformPackaging(root);
   {
     const confirm = opts.confirmPackaging ?? ((r, p) => confirmPackagingDefault(r, p, {
       acceptRisk: opts.acceptRisk ?? false,
@@ -14376,7 +14440,8 @@ then re-run the deploy.`
     secrets,
     slug,
     cwd: agentDir,
-    extraArgs: opts.extraArgs ?? []
+    extraArgs: opts.extraArgs ?? [],
+    backend
   });
   if (res.code !== 0) {
     warn(
@@ -14405,7 +14470,7 @@ then re-run the deploy.`
       trial = trialFromJson(post.data);
     }
   }
-  recordDeployState(root, slug, dep);
+  recordDeployState(root, slug, dep, backend);
   recordShippedWallet(root, secrets);
   refreshTrialCache(root, {
     expiresAt: trial.expiresAt,
@@ -14416,7 +14481,7 @@ then re-run the deploy.`
 ` : "";
   emit(
     `
-\u2713 deployed to the platform (slug=${slug}).
+\u2713 deployed to the platform (backend=${backend}, slug=${slug}).
   deployment: ${dep.deploymentId}
   invoke URL: ${dep.invokeUrl || "<pending \u2014 see `bag deploy status`>"}
   ${trialLine(trial)}
@@ -14433,7 +14498,7 @@ async function termsConsentGate(root, deps) {
     return null;
   }
   warn(
-    "=== Platform trial terms (first deploy) ===\nThis deploys into the BNB Chain operator's AWS account as a 48h testnet trial. A runtime signing key (your configured or a throwaway wallet) is transmitted to the operator's Secrets Manager for the runtime to sign with \u2014 testnet-scoped, auto-reclaimed at 48h. By proceeding you accept these trial terms."
+    "=== Platform trial terms (first deploy) ===\nThis deploys into a BNB Chain operator-managed cloud account as a 48h testnet trial. A runtime signing key (your configured or a throwaway wallet) is transmitted to the operator's managed secret channel for the runtime to sign with \u2014 testnet-scoped, auto-reclaimed at 48h. By proceeding you accept these trial terms."
   );
   if (deps.acceptRisk) {
     return stampTerms(root) ? null : 1;
@@ -14490,7 +14555,7 @@ function walletWarning(root, secrets) {
     warn(
       `
 [expected \xB7 bounded Altana session]
-  This project's bounded Altana session${who2} will be transmitted to the BNB Chain operator's Secrets Manager so the trial runtime can sign on testnet. The session is budget-limited, expiring, and revocable \u2014 the admin keystore and WALLET_PASSWORD never ship.
+  This project's bounded Altana session${who2} will be transmitted through the BNB Chain operator's managed secret channel so the trial runtime can sign on testnet. The session is budget-limited, expiring, and revocable \u2014 the admin keystore and WALLET_PASSWORD never ship.
   If the current budget or expiry is wider than you want an operator-held key to carry, stop and grant a tighter one first:
       bag wallet session grant --force --budget-u <small> --expiry-days <short>
   You can revoke it on-chain at any time with \`bag wallet session revoke\`.
@@ -14502,16 +14567,17 @@ function walletWarning(root, secrets) {
   warn(
     `
 !!! wallet exposure (platform trial) !!!
-  This project's wallet ${who} will be transmitted to the BNB Chain operator's Secrets Manager so the trial runtime can sign on testnet \u2014 expected for the platform trial, and testnet-scoped.
+  This project's wallet ${who} will be transmitted through the BNB Chain operator's managed secret channel so the trial runtime can sign on testnet \u2014 expected for the platform trial, and testnet-scoped.
   If this address is one you also use elsewhere (especially on mainnet), stop and deploy with a fresh throwaway instead:
       bag wallet new
   Otherwise proceed. Reusing this address on mainnet later is discouraged.
 `
   );
 }
-function recordDeployState(root, slug, dep) {
+function recordDeployState(root, slug, dep, backend = "aws") {
   recordPlatformKv(root, "slug", slug);
   recordPlatformKv(root, "deployment_id", dep.deploymentId);
+  recordPlatformKv(root, "backend", backend);
   if (dep.agentId) {
     recordPlatformKv(root, "agent_id", dep.agentId);
   }
@@ -14617,6 +14683,7 @@ function printAgentClientPrompt(root, invokeUrl, status) {
   const base = access.base;
   const tokenUrl = access.tokenUrl;
   const deploymentId = String(platformCfg(root).deployment_id || "n/a");
+  const managedBackend = platformCfg(root).backend === "azure" ? "azure" : "aws";
   const selftestLine = "- Quick self-test (operator): run `bag deploy info --with-curl`";
   const rt = agentId ? `${base}/v1/rt/${agentId}` : `${base}/v1/rt/<agentId>`;
   const cardUrl = `${rt}/.well-known/agent-card.json`;
@@ -14696,7 +14763,7 @@ function printAgentClientPrompt(root, invokeUrl, status) {
       "- The anonymous x402 route does not use the OAuth2 token flow shown for ERC-8183."
     ],
     ...!x402Only && hasA2aFace(faces) ? [
-      '- A2A callers: send the payload as a DATA part, NOT text \u2014 parts:[{"kind":"data","data":{ ...payload above... }}]. A JSON string in a "text" part is rejected (the runtime only reads data parts, so no skill is parsed).'
+      managedBackend === "azure" ? '- A2A callers: Foundry incoming A2A is text-only. Send the payload as a JSON-string TEXT part \u2014 parts:[{"kind":"text","text":"{\\"skill\\":\\"negotiate\\",...}"}].' : '- A2A callers: send the payload as a DATA part, NOT text \u2014 parts:[{"kind":"data","data":{ ...payload above... }}]. A JSON string in a "text" part is rejected (the runtime only reads data parts, so no skill is parsed).'
     ] : [],
     "",
     "YOUR TASK",
@@ -14892,6 +14959,9 @@ var ADVERTISED_DEPLOY_RUNTIME_TARGETS = ["agentcore"];
 // src/cli/deploy.ts
 var TARGET_CHOICES = [...DEPLOY_RUNTIME_TARGETS];
 var ADVERTISED_TARGET_CHOICES = [...ADVERTISED_DEPLOY_RUNTIME_TARGETS];
+function runtimeSecretsForManagedBackend(backend) {
+  return backend === "azure" ? collectAzureSecretPayload : collectRuntimeSecrets;
+}
 function isFile16(p) {
   try {
     return fs38.statSync(p).isFile();
@@ -14958,7 +15028,12 @@ function registerDeploy(program) {
     PROVIDER_MENU_ORDER,
     ADVERTISED_PROVIDERS
   );
-  p.addOption(providerOption()).option("--project-root <path>", "Override project root.").option("--skip-prepare", "Skip non-storage local readiness checks.").option(
+  p.addOption(providerOption()).addOption(
+    new Option4(
+      "--backend <backend>",
+      "Managed backend confirmation for --provider bnb (aws or azure). It must match [stack].runtime."
+    ).choices(["aws", "azure"])
+  ).option("--project-root <path>", "Override project root.").option("--skip-prepare", "Skip non-storage local readiness checks.").option(
     "--force-deploy-broken-storage",
     "DANGEROUS: bypass fatal deliverable-storage checks."
   ).option("--force", "Bypass explicitly forceable readiness checks.").addOption(
@@ -14976,7 +15051,12 @@ function registerDeploy(program) {
   ).action(act((opts) => cmdPrepare(opts)));
   p.command("agent").description(
     "Deprecated compatibility alias for `bag deploy`. Thin wrapper: gates on prepare, syncs runtime secrets, builds the agent (`pnpm build`), delegates to the platform CLI."
-  ).addOption(providerOption()).addOption(runtimeOption()).addOption(targetAlias()).addOption(
+  ).addOption(providerOption()).addOption(
+    new Option4(
+      "--backend <backend>",
+      "Managed backend confirmation for --provider bnb (aws or azure). It must match [stack].runtime."
+    ).choices(["aws", "azure"])
+  ).addOption(runtimeOption()).addOption(targetAlias()).addOption(
     new Option4(
       "--to <destination>",
       "Deploy destination override: self (your own cloud) or platform (the managed BNB Chain trial). Default: studio.toml [deploy].destination, else self."
@@ -15038,10 +15118,10 @@ function registerDeploy(program) {
     )
   );
   p.command("info").description(
-    "Show the buyer-access surface for a platform deploy (URL, token endpoint, scope, agentId)."
+    "Show the buyer-access surface for a platform or Azure self-deploy."
   ).option("--project-root <path>", "Override project root.").option("--json", "Emit JSON instead of a table.").option(
     "--with-curl",
-    "Also print a copy-paste curl chain (client_credentials token + invoke)."
+    "Also print a copy-paste authentication + invoke curl chain."
   ).action(
     act(
       (opts) => cmdInfo(opts)
@@ -15665,6 +15745,37 @@ async function cmdAgent(opts, agentcoreArgs) {
   const root = resolveProjectRoot2(opts.projectRoot);
   const destination = opts.provider ? opts.provider === "bnb" ? "platform" : "self" : opts.to ?? opts.destination ?? agentDeployDestination(root);
   const packagingDestination = opts.to ?? opts.destination ?? agentDeployDestination(root);
+  let managedBackend;
+  if (destination === "platform") {
+    const runtime = readStackRuntime(root) ?? "agentcore";
+    managedBackend = runtime === "azure-foundry" ? "azure" : "aws";
+    if (opts.backend && opts.backend !== managedBackend) {
+      printErr(
+        `error: --backend=${opts.backend} conflicts with [stack].runtime='${runtime}', which requires backend=${managedBackend}. --backend confirms the recipe target; it does not convert recipes across clouds.`
+      );
+      return 2;
+    }
+    if (managedBackend === "azure" && !opts.backend) {
+      if (!stdinIsTty()) {
+        printErr(
+          "error: an azure-foundry project requires explicit --backend azure in a non-interactive terminal."
+        );
+        return 2;
+      }
+      const answer = await promptUser(
+        "This azure-foundry project will use the managed Azure backend. Continue? [y/N] "
+      );
+      if (!["y", "yes"].includes(answer.trim().toLowerCase())) {
+        printErr("cancelled: managed Azure backend was not confirmed.");
+        return 2;
+      }
+    }
+  } else if (opts.backend) {
+    printErr(
+      `error: --backend is accepted only with --provider bnb; --provider ${opts.provider ?? "self"} selects a user-owned cloud directly.`
+    );
+    return 2;
+  }
   if (destination === "platform") {
     const networkGate = rejectPlatformMainnet(root);
     if (networkGate !== null) return networkGate;
@@ -15691,14 +15802,15 @@ async function cmdAgent(opts, agentcoreArgs) {
     }
     return platformAgent({
       root,
+      backend: managedBackend,
       acceptRisk: opts.acceptRisk,
       skipPrepare: opts.skipPrepare,
       force: opts.force,
       // The deploy layer injects the shared secret collector + prepare gate
       // so the self-deploy and platform secret/readiness surfaces never
       // drift (the Python `_collect_runtime_secrets` / `run_prepare` share).
-      collectRuntimeSecrets,
-      runPrepareGate: platformPrepareGate(opts),
+      collectRuntimeSecrets: runtimeSecretsForManagedBackend(managedBackend),
+      runPrepareGate: platformPrepareGate(opts, managedBackend),
       extraArgs: stripLeadingDdash2(agentcoreArgs)
     });
   }
@@ -15901,10 +16013,10 @@ function recordOf2(data) {
 function stripLeadingDdash2(extra) {
   return extra.length > 0 && extra[0] === "--" ? extra.slice(1) : extra;
 }
-function platformPrepareGate(opts) {
+function platformPrepareGate(opts, backend = "aws") {
   return async (root, force) => {
     let result = await runPrepare({
-      target: "platform",
+      target: backend === "azure" ? "platform-azure" : "platform",
       projectRoot: root,
       includeInfo: false,
       force
@@ -15968,6 +16080,7 @@ function agentProtocolOf(agentRoot2) {
   return nativeProtocolOf(agentFacesOf(agentRoot2));
 }
 var GUIDE_URL2 = "https://github.com/bnb-chain/bnbagent-studio/blob/main/docs/guides/agentcore-a2a-access.md";
+var FOUNDRY_GUIDE_URL = "https://github.com/bnb-chain/bnbagent-studio/blob/main/docs/guides/foundry-a2a-access.md";
 function oauthFactsForAgentcore(agentRoot2) {
   const summary = accessSummaryForAgentcore(agentRoot2);
   if (summary === null) {
@@ -16012,8 +16125,12 @@ async function printAccessNextSteps2(root, runtime, opts = {}) {
     }
     return;
   }
+  const invokeUrl = opts.invokeUrl ?? recordedEndpoint(root);
+  if (invokeUrl) {
+    printOut(`  endpoint: ${invokeUrl}`);
+  }
   printOut(
-    "  Azure Foundry buyer access is in Preview \u2014 see docs/guides/foundry-a2a-access.md in the bnbagent-studio repo. The per-agent A2A card URL and OAuth scope are confirmed only after a live deploy."
+    `  Azure Foundry access uses a Microsoft Entra bearer token. Run \`bag deploy info --with-curl\` for the exact endpoint, token resource, and Invocations request body; see ${FOUNDRY_GUIDE_URL}.`
   );
 }
 var CLIENT_PROMPT_RULE2 = "\u2500".repeat(62);
@@ -16417,6 +16534,96 @@ Quick-verify x402 endpoint:
     "\n  Note: this only exercises `negotiate` (a read-only quote). To get a deliverable you must fund a job on-chain (ERC-8183 createJob -> registerJob -> setBudget -> fund), then call `notify_funded` with that job_id and poll the chain for SUBMITTED \u2014 see the emitted client prompt / `bnbagent-studio-buying-via-8183`."
   );
 }
+var AZURE_FOUNDRY_TOKEN_RESOURCE = "https://ai.azure.com";
+var AZURE_FOUNDRY_TOKEN_SCOPE = `${AZURE_FOUNDRY_TOKEN_RESOURCE}/.default`;
+function azureQuickVerifyBody() {
+  return {
+    input: JSON.stringify({
+      skill: "negotiate",
+      task_description: "Create a concise launch checklist",
+      terms: {
+        deliverables: "A 5-item checklist",
+        quality_standards: "Clear and actionable"
+      }
+    })
+  };
+}
+function printAzureInfo(deployment, opts) {
+  const endpoint = deployment.endpoint;
+  if (!endpoint) {
+    if (opts.json) {
+      printOut(
+        JSON.stringify(
+          {
+            provider: "azure",
+            target: deployment.target,
+            name: deployment.name,
+            endpoint: null,
+            error: "No Azure invocation endpoint is recorded."
+          },
+          null,
+          2
+        )
+      );
+    } else {
+      printErr(
+        "Azure deployment is recorded but has no invocation endpoint. Run `bag deploy status --provider azure` and redeploy if the live endpoint cannot be recovered."
+      );
+    }
+    return 1;
+  }
+  const body = azureQuickVerifyBody();
+  if (opts.json) {
+    printOut(
+      JSON.stringify(
+        {
+          provider: "azure",
+          target: deployment.target,
+          name: deployment.name,
+          deployment_id: deployment.deploymentId,
+          endpoint,
+          authentication: {
+            type: "entra_bearer",
+            resource: AZURE_FOUNDRY_TOKEN_RESOURCE,
+            scope: AZURE_FOUNDRY_TOKEN_SCOPE
+          },
+          request: {
+            method: "POST",
+            content_type: "application/json",
+            body
+          }
+        },
+        null,
+        2
+      )
+    );
+    return 0;
+  }
+  printOut("bag deploy info \u2014 Azure Foundry self-deploy");
+  printOut(`  endpoint: ${endpoint}`);
+  printOut(
+    `  authentication: Microsoft Entra bearer token (resource ${AZURE_FOUNDRY_TOKEN_RESOURCE}; SDK scope ${AZURE_FOUNDRY_TOKEN_SCOPE})`
+  );
+  printOut("  request: POST application/json");
+  printOut(`  body: ${JSON.stringify(body)}`);
+  if (opts.withCurl) {
+    printOut("\nQuick-verify curl:");
+    printOut(
+      `  AZURE_TOKEN=$(az account get-access-token --resource ${AZURE_FOUNDRY_TOKEN_RESOURCE} --query accessToken -o tsv)`
+    );
+    printOut(`  AZURE_ENDPOINT=${JSON.stringify(endpoint)}`);
+    printOut(
+      `  curl -sS -X POST "$AZURE_ENDPOINT" \\
+    -H "Authorization: Bearer $AZURE_TOKEN" \\
+    -H "Content-Type: application/json" \\
+    -d '${JSON.stringify(body)}'`
+    );
+    printOut(
+      "\n  The Azure CLI command is only a convenient way to mint a token for this curl. Deployment itself does not require az/azd; DefaultAzureCredential or ClientSecretCredential can mint the same scope in an application."
+    );
+  }
+  return 0;
+}
 async function cmdInfo(opts) {
   const rc = applyProjectRoot(opts.projectRoot, false);
   if (rc !== null) {
@@ -16424,7 +16631,8 @@ async function cmdInfo(opts) {
   }
   const root = resolveProjectRoot2(opts.projectRoot);
   const workspaceRoot = deployWorkspaceRoot2(root);
-  const hasBnbDeployment = discoverRecordedDeployments(workspaceRoot).some(
+  const recorded = discoverRecordedDeployments(workspaceRoot);
+  const hasBnbDeployment = recorded.some(
     (deployment) => deployment.provider === "bnb"
   );
   if (hasBnbDeployment) {
@@ -16434,6 +16642,12 @@ async function cmdInfo(opts) {
     }
     return infoRc;
   }
+  const azureDeployment = recorded.find(
+    (deployment) => deployment.provider === "azure"
+  );
+  if (azureDeployment) {
+    return printAzureInfo(azureDeployment, opts);
+  }
   printErr(
     "`bag deploy info` reports the platform buyer-access surface; this project has no recorded BNB deployment. Use `bag deploy status` to inspect recorded providers."
   );
@@ -16571,10 +16785,10 @@ async function cmdLogs(opts) {
       if (deployment.provider === "aws" && opts.since) {
         argv.push("--since", opts.since);
       }
-      if (deployment.provider === "azure" && opts.limit) {
+      if (opts.limit) {
         argv.push("--limit", opts.limit);
       }
-      if (deployment.provider === "azure" && opts.session) {
+      if (opts.session) {
         argv.push("--session", opts.session);
       }
       return runDeployCliStream(argv, {
@@ -20842,7 +21056,7 @@ function buildProgram() {
   return program;
 }
 function cliVersion() {
-  return "0.0.8";
+  return studioCliVersion();
 }
 
 // src/cli/updateCheck.ts