@bnbagent/studio-cli 0.0.8 → 0.0.10

package/dist/{chunk-ODCZKKZJ.js → chunk-YFEM4564.js}

@@ -820,7 +820,7 @@ function isTable(value) {
 }
 
 // src/cli/_deploy/deployCli.ts
-var DEPLOY_CLI_VERSION = "0.4.14";
+var DEPLOY_CLI_VERSION = "0.5.4";
 var DEPLOY_CLI_PACKAGE = `@bnbagent/deploy-cli@${DEPLOY_CLI_VERSION}`;
 var BNB_PLATFORM_API_URL = "https://bnbagent-api.bnbchain.world";
 var BNB_PLATFORM_API_URL_ENV = "BNBAGENT_API_URL";
@@ -992,7 +992,12 @@ function buildDeploySpec(root, opts) {
       }
     }
     deploy.protocol = protocol;
-    doc.bnb = { apiUrl: bnbPlatformApiUrl() };
+    const stackRuntime = String(stack.runtime ?? "agentcore");
+    doc.bnb = stackRuntime === "azure-foundry" ? {
+      apiUrl: bnbPlatformApiUrl(),
+      backend: "azure",
+      runtimeProfile: protocol === "A2A" ? "foundry-responses-v1" : "foundry-invocations-v1"
+    } : { apiUrl: bnbPlatformApiUrl() };
   }
   if (opts.inlineSecrets) {
     Object.assign(env, opts.inlineSecrets);

package/dist/{deployCli-VM5TYKQX.js → deployCli-NJFCWBSF.js}

@@ -18,7 +18,7 @@ import {
   runPlatformAccountCommand,
   trialFromDeployCliJson,
   withDeployFiles
-} from "./chunk-ODCZKKZJ.js";
+} from "./chunk-YFEM4564.js";
 import "./chunk-RO726HJG.js";
 export {
   BNB_PLATFORM_API_URL,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bnbagent/studio-cli",
-  "version": "0.0.8",
+  "version": "0.0.10",
   "description": "Skills-first toolkit and bag CLI for BNB Chain seller agents: ERC-8004 identity, ERC-8183 escrowed commerce, and x402 payments.",
   "keywords": [
     "bnb-chain",
@@ -51,7 +51,7 @@
   },
   "dependencies": {
     "@bnbagent/sdk": "0.5.0",
-    "@bnbagent/studio-runtime": "0.0.8",
+    "@bnbagent/studio-runtime": "0.0.10",
     "ai": "^7.0.29",
     "archiver": "^8.0.0",
     "commander": "^15.0.0",

package/recipes/runtimes/azure-foundry/code/{{PKG}}/foundryMain.ts.tmpl

@@ -4,8 +4,9 @@
  * Generated by `bag init --runtime azure-foundry`. This is the
  * Foundry-hosted counterpart of the cloud-neutral A2A entrypoint
  * (`main.ts`). The deploy spec declares Foundry's minimal pass-through
- * `invocations` protocol, so this host implements its documented container
- * contract: plain HTTP on :8088, GET /readiness, and POST /invocations.
+ * `invocations` protocol for user-owned Azure and the `responses` protocol
+ * for managed incoming A2A. This host implements both documented container
+ * endpoints on :8088 plus GET /readiness.
  *
  * ## How A2A reaches the seller skills on Foundry
  *
@@ -31,6 +32,7 @@
  * arrive as environment variables before the process starts.
  */
 
+import { randomUUID } from "node:crypto";
 import { pathToFileURL } from "node:url";
 import { createOpenAI } from "@ai-sdk/openai";
 import { loadStudioToml } from "@bnbagent/studio-runtime/config";
@@ -234,6 +236,112 @@ export function extractEnvelope(
     : null;
 }
 
+/** Extract the latest text turn from an OpenAI Responses request. Foundry's
+ * incoming A2A adapter is text-only and projects the caller message here. */
+export function responsesInputText(input: unknown): string | null {
+  if (typeof input === "string") {
+    return input;
+  }
+  if (!Array.isArray(input)) {
+    return null;
+  }
+  const texts: string[] = [];
+  for (const item of input) {
+    if (typeof item === "string") {
+      texts.push(item);
+      continue;
+    }
+    if (!item || typeof item !== "object") {
+      continue;
+    }
+    const content = (item as Record<string, unknown>).content;
+    if (typeof content === "string") {
+      texts.push(content);
+      continue;
+    }
+    if (!Array.isArray(content)) {
+      continue;
+    }
+    for (const part of content) {
+      if (part && typeof part === "object") {
+        const text = (part as Record<string, unknown>).text;
+        if (typeof text === "string") texts.push(text);
+      }
+    }
+  }
+  return texts.at(-1) ?? null;
+}
+
+function responseId(prefix: string): string {
+  return `${prefix}_${randomUUID().replaceAll("-", "")}`;
+}
+
+function responseEnvelope(text: string, model: string) {
+  const responseIdValue = responseId("resp");
+  const messageId = responseId("msg");
+  const part = { type: "output_text", annotations: [], logprobs: [], text };
+  const item = {
+    id: messageId,
+    type: "message",
+    status: "completed",
+    role: "assistant",
+    content: [part],
+  };
+  return {
+    id: responseIdValue,
+    object: "response",
+    created_at: Math.floor(Date.now() / 1000),
+    status: "completed",
+    error: null,
+    incomplete_details: null,
+    instructions: null,
+    max_output_tokens: null,
+    model,
+    output: [item],
+    output_text: text,
+    parallel_tool_calls: true,
+    previous_response_id: null,
+    reasoning: { effort: null, summary: null },
+    store: true,
+    temperature: 1,
+    text: { format: { type: "text" } },
+    tool_choice: "auto",
+    tools: [],
+    top_p: 1,
+    truncation: "disabled",
+    usage: {
+      input_tokens: 0,
+      input_tokens_details: { cached_tokens: 0 },
+      output_tokens: 0,
+      output_tokens_details: { reasoning_tokens: 0 },
+      total_tokens: 0,
+    },
+    metadata: {},
+  };
+}
+
+function sendStreamingResponse(res: express.Response, response: ReturnType<typeof responseEnvelope>): void {
+  const item = response.output[0];
+  const part = item.content[0];
+  const events = [
+    { type: "response.created", sequence_number: 0, response: { ...response, status: "in_progress", output: [] } },
+    { type: "response.output_item.added", sequence_number: 1, output_index: 0, item: { ...item, status: "in_progress", content: [] } },
+    { type: "response.content_part.added", sequence_number: 2, output_index: 0, item_id: item.id, content_index: 0, part: { ...part, text: "" } },
+    { type: "response.output_text.delta", sequence_number: 3, output_index: 0, item_id: item.id, content_index: 0, delta: part.text },
+    { type: "response.output_text.done", sequence_number: 4, output_index: 0, item_id: item.id, content_index: 0, text: part.text },
+    { type: "response.content_part.done", sequence_number: 5, output_index: 0, item_id: item.id, content_index: 0, part },
+    { type: "response.output_item.done", sequence_number: 6, output_index: 0, item },
+    { type: "response.completed", sequence_number: 7, response },
+  ];
+  res.status(200);
+  res.setHeader("content-type", "text/event-stream");
+  res.setHeader("cache-control", "no-cache");
+  for (const event of events) {
+    res.write(`event: ${event.type}\ndata: ${JSON.stringify(event)}\n\n`);
+  }
+  res.end("data: [DONE]\n\n");
+}
+
 async function main(): Promise<void> {
   scrubBlankAppInsights();
 
@@ -268,6 +376,20 @@ async function main(): Promise<void> {
     const text = typeof input.input === "string" ? input.input : null;
     res.json({ output: await router.run(text) });
   });
+  // The managed platform selects Foundry's Responses protocol so the agent
+  // can be exposed through incoming A2A. Keep this adapter small and
+  // deterministic: Foundry converts A2A text to Responses input, and the
+  // seller result becomes one assistant output_text item.
+  app.post("/responses", async (req, res) => {
+    const input = (req.body ?? {}) as Record<string, unknown>;
+    const output = await router.run(responsesInputText(input.input));
+    const response = responseEnvelope(output, typeof input.model === "string" ? input.model : APP_NAME);
+    if (input.stream === true) {
+      sendStreamingResponse(res, response);
+    } else {
+      res.json(response);
+    }
+  });
   // Required Foundry Hosted Agent health contract. The platform will not
   // create a session or forward invocations until this returns HTTP 200.
   app.get("/readiness", (_req, res) => {
@@ -280,7 +402,7 @@ async function main(): Promise<void> {
   // Foundry's documented default is 8088; PORT remains the platform override.
   const port = Number(process.env.PORT || process.env.AGENT_PORT || "8088");
   const server = app.listen(port, "0.0.0.0", () => {
-    log.info(`Invocations host serving on 0.0.0.0:${port}`);
+    log.info(`Invocations + Responses host serving on 0.0.0.0:${port}`);
   });
   process.once("SIGTERM", () => {
     server.close(() => process.exit(0));

package/recipes/runtimes/azure-foundry/recipe.toml

@@ -1,6 +1,6 @@
 [recipe]
 name = "runtimes/azure-foundry"
-description = "Runtime adapter recipe for Azure AI Foundry Hosted Agents — the second deploy target. Selected via `bag init --runtime azure-foundry`. Declares the runtime's required node deps and contributes the cloud-neutral @a2a-js/sdk server for local/dev plus the Foundry deploy host: a pass-through Invocations skill router over the SHARED SellerAgentExecutor.dispatch, serving the documented :8088 + /readiness + /invocations contract. Azure deployment currently supports A2A scaffolds only; the MCP entrypoint remains local/AgentCore-oriented and is rejected before Foundry deploy. The chain tools (tools.ts) + model factory (model.ts) are shared by both protocols (decision D9). Deploys are container-only and fully delegated to the pinned @bnbagent/deploy-cli (SDK/REST + browser login; CustomKeys secret injection; no azd/az CLIs, no azure.yaml/infra in the scaffold)."
+description = "Runtime adapter recipe for Azure AI Foundry Hosted Agents — the second deploy target. Selected via `bag init --runtime azure-foundry`. Declares the runtime's required node deps and contributes the cloud-neutral @a2a-js/sdk server for local/dev plus a dual-protocol Foundry deploy host: pass-through Invocations for user-owned Azure and OpenAI Responses for managed incoming A2A, both routed over the SHARED SellerAgentExecutor.dispatch. Azure deployment currently supports A2A scaffolds only; the MCP entrypoint remains local/AgentCore-oriented and is rejected before Foundry deploy. The chain tools (tools.ts) + model factory (model.ts) are shared by both protocols (decision D9). Deploys are container-only and fully delegated to the pinned @bnbagent/deploy-cli (SDK/REST + browser login; CustomKeys secret injection; no azd/az CLIs, no azure.yaml/infra in the scaffold)."
 status = "v1"
 
 # The recipe contributes the entrypoints plus the deps below; the deploy
@@ -9,8 +9,8 @@ status = "v1"
 # azd bootstrap and no azure.yaml / infra/ in the scaffold).
 #
 # foundryMain.ts implements the documented framework-neutral container
-# contract directly: plain HTTP on :8088, GET /readiness, and the declared
-# POST /invocations pass-through route. This path was live E2E verified on
+# contract directly: plain HTTP on :8088, GET /readiness, POST /invocations,
+# and POST /responses (required for managed incoming A2A). The invocations path was live E2E verified on
 # 2026-07-20 through deploy, cold-start smoke, invoke, logs, and destroy.
 
 # Base deps are shared by every mode. bnbagent-deploy injects provider/storage

package/skills/bnbagent-studio.md

@@ -53,7 +53,7 @@ Treat ERC-8183 amounts as decimal strings at CLI/config boundaries and `bigint`
 
 ## CLI groups at a glance
 
-`init`, `scan`, `recipe`, `skills`, `wallet`, `erc8004`, `erc8183`, `x402`, `agents`, `config`, `env`, `dev`, `doctor`, `audit`, `deploy`, `platform`, `llm`, `bundle`, `budget` - see `bag --help` for details. `bag deploy [--provider bnb\|aws]` is the primary deploy command; `prepare`, `verify`, `status`, `info`, `destroy`, `logs`, and `fix-gitignore` remain lifecycle subcommands (`deploy agent` is a deprecated compatibility alias). Provider deploy/status/logs/destroy and deploy-time credential validation are delegated to pinned `@bnbagent/deploy-cli@0.4.14`.
+`init`, `scan`, `recipe`, `skills`, `wallet`, `erc8004`, `erc8183`, `x402`, `agents`, `config`, `env`, `dev`, `doctor`, `audit`, `deploy`, `platform`, `llm`, `bundle`, `budget` - see `bag --help` for details. `bag deploy [--provider bnb\|aws] [--backend aws\|azure]` is the primary deploy command; `--backend` is valid only for provider `bnb` and confirms the recipe-derived managed backend. `prepare`, `verify`, `status`, `info`, `destroy`, `logs`, and `fix-gitignore` remain lifecycle subcommands (`deploy agent` is a deprecated compatibility alias). Provider deploy/status/logs/destroy and deploy-time credential validation are delegated to pinned `@bnbagent/deploy-cli@0.5.4`.
 
 ## Tool surface
 

package/skills/references/bnbagent-studio-use-aws-agentcore.md

@@ -1,6 +1,6 @@
 ---
 name: bnbagent-studio-use-aws-agentcore
-description: When the user wants to deploy or operate a bnbagent-studio project on AWS Bedrock AgentCore - deploy with `bag deploy --provider aws` (all cloud lifecycle mutations are delegated to pinned `@bnbagent/deploy-cli@0.4.14`), inspect with `bag deploy status` / `logs --provider aws` / `verify --provider aws`, and tear down with `bag deploy destroy --provider aws --execute [--purge]`. Also covers AWS credential prerequisites, the optional read-only quota probe, and the runtime-secret channel.
+description: When the user wants to deploy or operate a bnbagent-studio project on AWS Bedrock AgentCore - deploy with `bag deploy --provider aws` (all cloud lifecycle mutations are delegated to pinned `@bnbagent/deploy-cli@0.5.4`), inspect with `bag deploy status` / `logs --provider aws` / `verify --provider aws`, and tear down with `bag deploy destroy --provider aws --execute [--purge]`. Also covers AWS credential prerequisites, the optional read-only quota probe, and the runtime-secret channel.
 ---
 
 > **Reference file** of the `bnbagent-studio` router skill - installed at `bnbagent-studio/references/` and loaded on demand (not a standalone skill). Route here via the router's decision tree.

package/skills/references/bnbagent-studio-use-azure-foundry.md

@@ -1,6 +1,6 @@
 ---
 name: bnbagent-studio-use-azure-foundry
-description: When the user wants to deploy or operate an A2A bnbagent-studio project on Azure AI Foundry Hosted Agents - scaffold with `bag init --runtime azure-foundry --protocols A2A`, deploy with `bag deploy --provider azure` (container-only Invocations contract; all cloud lifecycle execution is delegated to pinned `@bnbagent/deploy-cli@0.4.14`, SDK/REST with browser login - no `az`/`azd` CLIs), and run lifecycle commands with `--provider azure` when multiple deployments exist. Native MCP deploy is not supported on Azure yet; use AgentCore for MCP.
+description: When the user wants to deploy or operate a bnbagent-studio project on Azure AI Foundry Hosted Agents - scaffold with `bag init --runtime azure-foundry`, deploy either to the managed platform with `bag deploy --provider bnb --backend azure` or directly with `bag deploy --provider azure`; all cloud lifecycle execution is delegated to pinned `@bnbagent/deploy-cli@0.5.4`. Native MCP is not supported on Azure; use AgentCore for MCP.
 ---
 
 > **Reference file** of the `bnbagent-studio` router skill - installed at `bnbagent-studio/references/` and loaded on demand (not a standalone skill). Route here via the router's decision tree.
@@ -9,7 +9,7 @@ description: When the user wants to deploy or operate an A2A bnbagent-studio pro
 
 > **Preview - not advertised in this release.** Azure Foundry support is fully wired but hidden from the `--runtime` menu and the deploy provider menu; these steps still work if you select `azure-foundry` / `--provider azure` explicitly. The most recent end-to-end live verification predates the TypeScript rewrite - treat your first deploy as a verification run.
 
-Procedure for deploying and operating the seller Agent on **Azure AI Foundry Hosted Agents** (`[stack].runtime = "azure-foundry"`). ALL cloud execution - browser login, Foundry onboarding, the container registry image build/push, secret provisioning, and the RBAC self-grant - is **delegated to the pinned `@bnbagent/deploy-cli`** (run via `bunx --bun`; override with `BNBAGENT_DEPLOY_COMMAND`), whose Azure provider is **SDK/REST-only**. Studio never shells out to (or requires) the `az` / `azd` CLIs.
+Procedure for deploying and operating the seller Agent on **Azure AI Foundry Hosted Agents** (`[stack].runtime = "azure-foundry"`). ALL cloud execution is **delegated to the pinned `@bnbagent/deploy-cli`** (run via `bunx --bun`; override with `BNBAGENT_DEPLOY_COMMAND`), whose Azure provider is **SDK/REST-only**. Studio never shells out to (or requires) the `az` / `azd` CLIs. Direct user-owned deployment uses browser/local credentials and may self-heal RBAC; the managed platform uses environment credentials in `ambient-only` mode and only probes RBAC.
 
 ```
 <workspace>/
@@ -21,7 +21,7 @@ Procedure for deploying and operating the seller Agent on **Azure AI Foundry Hos
 
 > **Deploy model: CONTAINER-ONLY.** The deploy-cli Azure provider rejects Node zip artifacts, so every azure-foundry deploy builds the scaffolded `app/agent/Dockerfile` **locally with Docker** (linux/amd64) and pushes it to the auto-provisioned Azure Container Registry; Foundry Agent Service pulls and runs the image. A running Docker daemon is required.
 
-> **Protocol: A2A projects only for now.** The deployed Node host speaks Foundry's pass-through Invocations container contract on `:8088` (`GET /readiness`, `POST /invocations`). That endpoint is not native MCP streamable HTTP; `bag init` and provider selection reject azure-foundry + MCP instead of deploying a container that can never become ready.
+> **Protocol: A2A projects only for now.** The deployed Node host speaks both Foundry container contracts on `:8088`: `GET /readiness`, pass-through `POST /invocations` for user-owned Azure, and OpenAI-compatible `POST /responses` for managed incoming A2A. Neither endpoint is native MCP streamable HTTP; `bag init` and provider selection reject azure-foundry + MCP instead of deploying a container that can never become ready.
 
 > **Auth is a browser login.** The first delegated run opens a browser to sign in to the right tenant/subscription - there is no `az login` / `azd auth login` step and no CLI to install.
 
@@ -38,7 +38,7 @@ Procedure for deploying and operating the seller Agent on **Azure AI Foundry Hos
 - **Region must support Hosted Agents.** Default `eastus2`. `eastus` does NOT. Prepare refuses an unsupported `[azure].location` (else deploy fails with `Unsupported region for Foundry Hosted Agents`).
 - **Account name MUST equal the custom subdomain.** The runtime derives `https://{account_name}.services.ai.azure.com`; a mismatch resolves to NXDOMAIN and the agent returns HTTP 500. `bag init` sets them equal - keep them equal in `[azure]`.
 - **Empty `APPLICATIONINSIGHTS_CONNECTION_STRING` crashes the exporter.** The emitted entrypoint drops it when blank - don't remove that guard.
-- **The hosted container contract is fixed.** Keep `AGENT_PORT=8088`, `GET /readiness` returning HTTP 200, and `POST /invocations`. Local A2A still runs on `:9000`; do not copy that local port into the Foundry Dockerfile.
+- **The hosted container contract is fixed.** Keep `AGENT_PORT=8088`, `GET /readiness` returning HTTP 200, and both `POST /invocations` and `POST /responses`. Local A2A still runs on `:9000`; do not copy that local port into the Foundry Dockerfile.
 - **Prepare checks are local-only.** They validate the scaffold (region, subdomain, entrypoint + Dockerfile, an OpenAI-compatible `[llm]` provider, twak readiness) without any cloud call; Azure auth happens at deploy time.
 
 ## Runtime secrets - the delegated hand-off
@@ -47,7 +47,7 @@ Procedure for deploying and operating the seller Agent on **Azure AI Foundry Hos
 
 > The encrypted keystore (`.studio/wallets/`) stays at the workspace root and rides only that secret channel - never baked into the image.
 
-Provider-native overrides go in the optional `studio.toml [deploy.foundry]` table (verbatim deploy-spec keys; deploy-cli 0.4.14 consumes `account`, `cpu`, `location`, `memory`, `project`, `projectEndpoint`, `protocol`, `registry` and warns about anything else). The `[azure]` block's `account_name` / `project_name` / `project_endpoint` / `location` win over conflicting `[deploy.foundry]` keys.
+Provider-native overrides go in the optional `studio.toml [deploy.foundry]` table (verbatim deploy-spec keys; deploy-cli 0.5.4 consumes `account`, `cpu`, `location`, `memory`, `project`, `projectEndpoint`, `protocol`, `registry` and warns about anything else). The `[azure]` block's `account_name` / `project_name` / `project_endpoint` / `location` win over conflicting `[deploy.foundry]` keys.
 
 ## Typical workflow
 
@@ -76,9 +76,17 @@ bag deploy --provider azure                  # delegated: login → onboard →
 
 ```bash
 bag deploy status                            # all recorded providers + live state
+bag deploy info --with-curl                  # endpoint + Entra token shortcut + request body
 bag deploy logs --provider azure --limit 50 # delegated Hosted Agent logs
 ```
 
+`bag deploy info` reads the recorded Azure endpoint without recreating the
+temporary deploy spec. `--with-curl` adds an optional `az account
+get-access-token --resource https://ai.azure.com` shortcut and a complete
+Invocations request. This does not make the Azure CLI a deploy prerequisite;
+application clients may mint the same `https://ai.azure.com/.default` scope
+with `DefaultAzureCredential` or `ClientSecretCredential`.
+
 The built-in smoke proves the container contract, not the seller signature. For a release E2E, invoke with a complete `negotiate` envelope and require `response.accepted=true`, a non-empty `negotiation_hash`, and `provider_sig`. The Invocations body is `{"input":"<serialized skill JSON>"}`.
 
 ### D. Tear down

package/skills/references/bnbagent-studio-use-bnb-trial.md

@@ -9,7 +9,7 @@ description: Use when deploying or operating a bnbagent-studio seller on the BNB
 
 Treat this provider as a temporary testnet sandbox. Require a throwaway wallet, keep `bsc-testnet`, and explain that the runtime signing material is transmitted to the operator's managed secret store for the trial. Never use a mainnet key. Exception: `wallet.kind='altana'` ships only the bounded, budget-limited, revocable session - the throwaway-wallet advice does not apply; tighten the session instead (`bag wallet session grant --force --budget-u <small> --expiry-days <short>`) and never run `bag wallet new` on an altana project (it breaks the session's `[wallet].address` anchor).
 
-All auth and cloud lifecycle work must cross the pinned `@bnbagent/deploy-cli@0.4.14` boundary. Do not call the AWS CLI or platform REST routes directly.
+All auth and cloud lifecycle work must cross the pinned `@bnbagent/deploy-cli@0.5.4` boundary. Do not call a cloud CLI or platform REST routes directly. The managed backend is recipe-derived: `agentcore` uses AWS; `azure-foundry` uses Azure. For headless managed Azure, confirm with `bag deploy --provider bnb --backend azure --yes`; never treat `--backend` as a cross-cloud recipe converter.
 
 ## Select and authenticate