@bnbagent/studio-cli 0.0.9 → 0.0.11-alpha.1

package/dist/{chunk-YFEM4564.js → chunk-TTPOH453.js}

@@ -27,6 +27,11 @@ import { build as esbuildBuild } from "esbuild";
 
 // src/cli/utils/protocol.ts
 var SUPPORTED_FACES = ["A2A", "MCP", "X402"];
+var LEGACY_ENTRY_STEMS = {
+  unifiedMain: ["main", "foundryMain"],
+  mcpMain: [],
+  dualMain: []
+};
 function table(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
@@ -95,7 +100,7 @@ function entryStemOf(faces) {
   if (hasA2aFace(faces) && hasMcpFace(faces)) {
     return "dualMain";
   }
-  return nativeProtocolOf(faces) === "MCP" ? "mcpMain" : "main";
+  return nativeProtocolOf(faces) === "MCP" ? "mcpMain" : "unifiedMain";
 }
 function devPortOf(faces) {
   return nativeProtocolOf(faces) === "MCP" ? 8e3 : 9e3;
@@ -151,12 +156,16 @@ async function buildZip(agentDir, outZip, opts = {}) {
   return { checksum: sha256File(outZip), entrypoint };
 }
 function resolveEntry(agentDir, stem) {
-  const candidates = [
-    path.join(agentDir, "src", `${stem}.ts`),
-    path.join(agentDir, "dist", `${stem}.js`),
-    path.join(agentDir, `${stem}.ts`),
-    path.join(agentDir, `${stem}.js`)
+  const stems = [
+    stem,
+    ...LEGACY_ENTRY_STEMS[stem] ?? []
   ];
+  const candidates = stems.flatMap((s) => [
+    path.join(agentDir, "src", `${s}.ts`),
+    path.join(agentDir, "dist", `${s}.js`),
+    path.join(agentDir, `${s}.ts`),
+    path.join(agentDir, `${s}.js`)
+  ]);
   for (const candidate of candidates) {
     if (isFile(candidate)) {
       return candidate;
@@ -166,29 +175,49 @@ function resolveEntry(agentDir, stem) {
     `no ${stem}.ts/${stem}.js entry found under ${agentDir} (looked in src/, dist/, and the project root) \u2014 the zip channel bundles the protocol entry the scaffold emitted. Re-scaffold with \`bag init\`, or switch [deploy].platform_artifact to "container".`
   );
 }
+var BUNDLE_OPTIONS = {
+  bundle: true,
+  platform: "node",
+  target: TARGET_NODE,
+  format: "esm",
+  legalComments: "none",
+  sourcemap: false,
+  logLevel: "silent",
+  banner: {
+    js: 'import { createRequire as __bagCreateRequire } from "node:module";const require = __bagCreateRequire(import.meta.url);'
+  }
+};
+function bundleFailure(exc) {
+  const msg = exc instanceof Error ? exc.message : String(exc);
+  return new Error(
+    `bundling the agent for the zip runtime failed \u2014 a dependency likely cannot be bundled (native addon / dynamic import esbuild cannot resolve). Fix the import, or set [deploy].platform_artifact = "container". esbuild said:
+${msg.slice(0, 1e3)}`
+  );
+}
 async function bundleEntry(entry, outfile) {
   try {
     await esbuildBuild({
+      ...BUNDLE_OPTIONS,
       entryPoints: [entry],
       outfile,
-      bundle: true,
-      platform: "node",
-      target: TARGET_NODE,
-      format: "esm",
-      minify: true,
-      legalComments: "none",
-      sourcemap: false,
-      logLevel: "silent",
-      banner: {
-        js: 'import { createRequire as __bagCreateRequire } from "node:module";const require = __bagCreateRequire(import.meta.url);'
-      }
+      minify: true
     });
   } catch (exc) {
-    const msg = exc instanceof Error ? exc.message : String(exc);
-    throw new Error(
-      `bundling the agent for the zip runtime failed \u2014 a dependency likely cannot be bundled (native addon / dynamic import esbuild cannot resolve). Fix the import, or set [deploy].platform_artifact = "container". esbuild said:
-${msg.slice(0, 1e3)}`
-    );
+    throw bundleFailure(exc);
+  }
+}
+async function dryRunBundle(agentDir, opts = {}) {
+  const faces = opts.protocols ?? normalizeProtocolFaces(opts.protocol ?? "A2A");
+  const entry = resolveEntry(agentDir, entryStemOf(faces));
+  try {
+    await esbuildBuild({
+      ...BUNDLE_OPTIONS,
+      entryPoints: [entry],
+      write: false,
+      minify: false
+    });
+  } catch (exc) {
+    throw bundleFailure(exc);
   }
 }
 function stageManifest(agentDir, buildRoot, entrypoint) {
@@ -714,6 +743,10 @@ var B402_RUNTIME_KEYS = [
   "B402_PRIVATE_KEY",
   "B402_PRIVATE_KEY_B64"
 ];
+var X402_CAPABLE_RUNTIMES = /* @__PURE__ */ new Set([
+  "agentcore",
+  "azure-foundry"
+]);
 function commerceRails(cfg) {
   const payments = table3(cfg.payments);
   return {
@@ -760,21 +793,25 @@ function x402DeploySummary(root, destination, publicUrl) {
   const credentials = b402Credentials(agentRoot);
   const activation = `${B402_PAID_ONBOARDING_GUIDANCE} Then run the bnbagent-studio-selling-via-b402 skill, fill the four B402_* variables in .studio/.env.local, and redeploy.`;
   const runtime = String(table3(cfg.stack).runtime ?? "agentcore");
-  if (destination !== "platform" && runtime !== "agentcore") {
-    return `x402 rail is FORCED DORMANT: the ${runtime} runtime has no x402 path. Deploy to AgentCore (managed platform or self-hosted) to activate the rail.`;
+  if (destination !== "platform" && !X402_CAPABLE_RUNTIMES.has(runtime)) {
+    return `x402 rail is FORCED DORMANT: the ${runtime} runtime has no x402 path. Deploy to AgentCore or Azure Foundry (managed platform or self-hosted) to activate the rail.`;
   }
+  const azure = runtime === "azure-foundry";
+  const runtimeLabel = azure ? "Azure Foundry" : "AgentCore";
+  const tunnelLine = azure ? 'The front wraps each request as envelope-v1 JSON, {"v":1,"method":"POST","path":"/x402","headers":{...},"body":"<base64>"}, inside an Entra-authenticated Foundry invocation (POST \u2026/agents/<name>/endpoint/protocols/invocations with an https://ai.azure.com bearer). Limits: 1 MiB request, 5 MiB response, no streaming.' : 'The front wraps each request as envelope-v1 JSON, {"v":1,"method":"POST","path":"/x402","headers":{...},"body":"<base64>"}, inside an authenticated AgentCore invocation. The default Bag self-deploy uses Cognito OAuth over HTTPS; IAM runtimes may use SDK/SigV4. Limits: 1 MiB request, 5 MiB response, no streaming.';
+  const gatewayDocLine = azure ? "Gateway example: https://github.com/bnb-chain/bnbagent-studio/blob/main/docs/guides/self-hosted-x402-gateway-azure.md" : "Gateway example: https://github.com/bnb-chain/bnbagent-studio/blob/main/docs/guides/self-hosted-x402-gateway.md";
   if (pricing.kind === "invalid") {
     return "x402 rail is DORMANT: price_usd is invalid; run `bag doctor`.";
   }
   if (pricing.kind === "free") {
     if (destination !== "platform") {
       return [
-        "x402 rail is ACTIVE in FREE mode (self-hosted AgentCore).",
+        `x402 rail is ACTIVE in FREE mode (self-hosted ${runtimeLabel}).`,
         "B402 verify/settle is bypassed; no credentials, token payment, or settlement audit is used.",
         "This target has no anonymous public URL; expose /x402 with your own HTTP front.",
-        'The front wraps each request as envelope-v1 JSON, {"v":1,"method":"POST","path":"/x402","headers":{...},"body":"<base64>"}, inside an authenticated AgentCore invocation. The default Bag self-deploy uses Cognito OAuth over HTTPS; IAM runtimes may use SDK/SigV4. Limits: 1 MiB request, 5 MiB response, no streaming.',
-        "You may invoke AgentCore with envelope-v1 directly, but that is not a standard public x402 HTTP endpoint.",
-        "Gateway example: https://github.com/bnb-chain/bnbagent-studio/blob/main/docs/guides/self-hosted-x402-gateway.md"
+        tunnelLine,
+        `You may invoke ${runtimeLabel} with envelope-v1 directly, but that is not a standard public x402 HTTP endpoint.`,
+        gatewayDocLine
       ].join("\n");
     }
     const url2 = publicUrl ?? "<available after the platform agentId is assigned>";
@@ -793,13 +830,14 @@ function x402DeploySummary(root, destination, publicUrl) {
     "Compatibility note: current @bnb-chain/b402@0.1.0 makes one settle call and classifies an asynchronous pending response as outcome unknown; reconcile it and do not replay the paid request."
   ];
   if (destination !== "platform") {
+    const egressLine = azure ? "PAID also needs fixed facilitator egress. Host the gateway on Azure Container Apps in a workload-profiles environment with a VNet + NAT Gateway static IP and allowlist that IP with B402 \u2014 no relay needed." : "PAID also needs fixed facilitator egress. Operate a restricted B402 Relay on a fixed-IP host such as a user-managed VPS, or use AgentCore VPC mode with a private subnet, NAT Gateway, and Elastic IP.";
     return [
-      "x402 rail is ACTIVE (self-hosted AgentCore).",
+      `x402 rail is ACTIVE (self-hosted ${runtimeLabel}).`,
       "This target has no anonymous public URL; expose /x402 with your own HTTP front.",
-      'The front wraps each request as envelope-v1 JSON, {"v":1,"method":"POST","path":"/x402","headers":{...},"body":"<base64>"}, inside an authenticated AgentCore invocation. The default Bag self-deploy uses Cognito OAuth over HTTPS; IAM runtimes may use SDK/SigV4. Limits: 1 MiB request, 5 MiB response, no streaming.',
-      "You may invoke AgentCore with envelope-v1 directly, but the caller must unpack the inner HTTP response and the result is not a standard public x402 endpoint.",
-      "PAID also needs fixed facilitator egress. Operate a restricted B402 Relay on a fixed-IP host such as a user-managed VPS, or use AgentCore VPC mode with a private subnet, NAT Gateway, and Elastic IP.",
-      "Gateway and Relay examples: https://github.com/bnb-chain/bnbagent-studio/blob/main/docs/guides/self-hosted-x402-gateway.md",
+      tunnelLine,
+      `You may invoke ${runtimeLabel} with envelope-v1 directly, but the caller must unpack the inner HTTP response and the result is not a standard public x402 endpoint.`,
+      egressLine,
+      gatewayDocLine.replace("Gateway example:", "Gateway and Relay examples:"),
       ...settlement
     ].join("\n");
   }
@@ -808,7 +846,7 @@ function x402DeploySummary(root, destination, publicUrl) {
     "x402 rail is ACTIVE.",
     `Anonymous paid URL: ${url}`,
     "The managed platform supplies the x402 HTTP Gateway and the fixed-egress B402 Relay; no user-managed gateway, proxy, or VPC is required.",
-    "Payment policy and RSA signing remain inside the AgentCore seller. The B402 Relay only forwards the signed request to its fixed facilitator upstream.",
+    `Payment policy and RSA signing remain inside the ${runtimeLabel} seller. The B402 Relay only forwards the signed request to its fixed facilitator upstream.`,
     ...settlement
   ].join("\n");
 }
@@ -820,7 +858,7 @@ function isTable(value) {
 }
 
 // src/cli/_deploy/deployCli.ts
-var DEPLOY_CLI_VERSION = "0.5.4";
+var DEPLOY_CLI_VERSION = "0.5.10";
 var DEPLOY_CLI_PACKAGE = `@bnbagent/deploy-cli@${DEPLOY_CLI_VERSION}`;
 var BNB_PLATFORM_API_URL = "https://bnbagent-api.bnbchain.world";
 var BNB_PLATFORM_API_URL_ENV = "BNBAGENT_API_URL";
@@ -1002,7 +1040,7 @@ function buildDeploySpec(root, opts) {
   if (opts.inlineSecrets) {
     Object.assign(env, opts.inlineSecrets);
   }
-  if (opts.target === "bnb/trial" && tableOf(studio, "deploy").destination === "platform" && (!hasProtocolsArray || hasX402Face(faces)) && commerceRails(studio).x402 && (x402SellerIsFree(studio) || b402Credentials(agentRoot).complete)) {
+  if (opts.target === "bnb/trial" && (!hasProtocolsArray || hasX402Face(faces)) && commerceRails(studio).x402 && (x402SellerIsFree(studio) || b402Credentials(agentRoot).complete)) {
     doc.x402 = {
       publicPaths: ["/x402"],
       tunnel: "http-envelope-v1"
@@ -1014,7 +1052,7 @@ function buildDeploySpec(root, opts) {
       tunnel: "http-envelope-v1"
     };
   }
-  if (opts.target === "bnb/trial" && tableOf(studio, "deploy").destination === "platform" && hasProtocolsArray && faces.length === 1 && hasX402Face(faces)) {
+  if (opts.target === "bnb/trial" && hasProtocolsArray && faces.length === 1 && hasX402Face(faces)) {
     doc.suppressProtocolFace = true;
   }
   doc.env = env;
@@ -1214,6 +1252,7 @@ export {
   act,
   printOut,
   printErr,
+  LEGACY_ENTRY_STEMS,
   normalizeProtocolFaces,
   stackFaces,
   hasA2aFace,
@@ -1223,6 +1262,7 @@ export {
   entryStemOf,
   devPortOf,
   recipeModeOf,
+  dryRunBundle,
   DEFAULT_B402_PRICE_USD,
   DEFAULT_B402_TESTNET_BASE_URL,
   B402_DEVELOPER_ACCOUNT_URL,
@@ -1234,6 +1274,7 @@ export {
   x402SellerIsFree,
   whichBin,
   agentcoreFlavor,
+  checkBunx,
   checkDocker,
   checkTwak,
   requiredChecks,
@@ -1241,6 +1282,7 @@ export {
   render,
   readAwsTarget,
   B402_RUNTIME_KEYS,
+  X402_CAPABLE_RUNTIMES,
   commerceRails,
   b402Credentials,
   x402DeploySummary,

package/dist/{deployCli-NJFCWBSF.js → deployCli-K55GXDVO.js}

@@ -18,7 +18,7 @@ import {
   runPlatformAccountCommand,
   trialFromDeployCliJson,
   withDeployFiles
-} from "./chunk-YFEM4564.js";
+} from "./chunk-TTPOH453.js";
 import "./chunk-RO726HJG.js";
 export {
   BNB_PLATFORM_API_URL,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bnbagent/studio-cli",
-  "version": "0.0.9",
+  "version": "0.0.11-alpha.1",
   "description": "Skills-first toolkit and bag CLI for BNB Chain seller agents: ERC-8004 identity, ERC-8183 escrowed commerce, and x402 payments.",
   "keywords": [
     "bnb-chain",
@@ -25,7 +25,6 @@
     "directory": "packages/studio-cli"
   },
   "type": "module",
-  "packageManager": "pnpm@10.24.0",
   "engines": {
     "node": ">=22"
   },
@@ -42,16 +41,8 @@
   "bin": {
     "bag": "./dist/bag.js"
   },
-  "scripts": {
-    "build": "tsup",
-    "test": "vitest run",
-    "lint": "biome check src tests",
-    "typecheck": "tsc --noEmit",
-    "check": "pnpm typecheck && pnpm lint && pnpm test && pnpm build"
-  },
   "dependencies": {
     "@bnbagent/sdk": "0.5.0",
-    "@bnbagent/studio-runtime": "0.0.9",
     "ai": "^7.0.29",
     "archiver": "^8.0.0",
     "commander": "^15.0.0",
@@ -62,7 +53,8 @@
     "smol-toml": "^1.3.0",
     "tar": "^7.4.0",
     "viem": "^2.54.0",
-    "yaml": "^2.9.0"
+    "yaml": "^2.9.0",
+    "@bnbagent/studio-runtime": "0.0.11-alpha.1"
   },
   "devDependencies": {
     "@a2a-js/sdk": "^0.3.14",
@@ -78,5 +70,12 @@
     "typescript": "^5.5.0",
     "vitest": "^2.0.0",
     "zod": "^3.25.76"
+  },
+  "scripts": {
+    "build": "tsup",
+    "test": "vitest run",
+    "lint": "biome check src tests",
+    "typecheck": "tsc --noEmit",
+    "check": "pnpm typecheck && pnpm lint && pnpm test && pnpm build"
   }
-}
+}

package/recipes/runtimes/agentcore/code/{{PKG}}/Dockerfile.tmpl

@@ -1,18 +1,19 @@
-# syntax=docker/dockerfile:1
-# Agent image for wallet.kind = "twak" — SHIPPED BY `bag init`.
+# Agent image — SHIPPED BY `bag init`, ONE Dockerfile for BOTH deploy clouds.
 #
-# Why a custom image: the managed AgentCore Node runtime (CodeZip) ships only
-# the project's own bundle, and every signing / on-chain intent for a twak
-# wallet shells out to the `twak` CLI (npm @trustwallet/cli), which must be
-# installed globally in the image. agentcore.json points at this file via
-# runtimes[].build = "Container" + dockerfile = "Dockerfile"; `bag deploy
-# --provider aws` hands it to the pinned bnbagent-deploy, which builds the image
-# locally with Docker and pushes it to ECR.
+# Why a custom image: the managed Node runtimes ship only the project's own
+# bundle, and every signing / on-chain intent for a twak wallet shells out to
+# the `twak` CLI (npm @trustwallet/cli), which must be installed globally in
+# the image. `bag deploy` hands this file to the pinned bnbagent-deploy,
+# which builds the image locally with Docker and pushes it to the target
+# cloud's registry (ECR for AgentCore, ACR for Azure Foundry).
 #
-# AgentCore runtimes execute on linux/arm64 — pin the platform so an x86
-# deploy machine cross-builds the right arch (needs docker buildx/containerd).
-# buildkit may warn "FromPlatformFlagConstDisallowed" — expected; arm64 is pinned intentionally (see above).
-FROM --platform=linux/arm64 public.ecr.aws/docker/library/node:22-slim
+# Arch is NOT pinned here: each deploy provider pins it on the build command
+# (`--platform linux/arm64` for AgentCore, `--platform linux/amd64` for
+# Foundry), so the same Dockerfile cross-builds for either cloud. Keep this
+# file classic-builder compatible: no `# syntax=` directive and no
+# BuildKit-only instructions (`RUN --mount=...`), so a plain `docker build`
+# works everywhere.
+FROM public.ecr.aws/docker/library/node:22-slim
 
 # The pinned twak CLI.
 #
@@ -29,8 +30,7 @@ WORKDIR /app
 # present; a project without one falls back to a plain install.
 COPY package.json pnpm-lock.yaml* pnpm-workspace.yaml ./
 COPY vendor ./vendor
-RUN --mount=type=cache,target=/root/.local/share/pnpm/store \
-    pnpm install
+RUN pnpm install
 
 COPY . .
 RUN pnpm build
@@ -38,13 +38,12 @@ RUN pnpm build
 # Runtime deps only in the final tree (drops typescript etc.).
 RUN pnpm prune --prod
 
-# AgentCore protocol contract:
-#   A2A → 0.0.0.0:9000 at /
-#   MCP → 0.0.0.0:8000/mcp
-#   BOTH → A2A-native 0.0.0.0:9000 at / + tunneled MCP at /mcp
+# Hosted-runtime port contracts (the unified entrypoint binds BOTH 9000 and
+# 8088 itself; AGENT_PORT only prepends a primary override):
+#   AgentCore A2A → 0.0.0.0:9000 at /        MCP → 0.0.0.0:8000/mcp
+#   Foundry invocations/responses → 0.0.0.0:8088
 # `bag init` renders {{CONTAINER_PORT}} / {{ENTRYPOINT}} from the selected
-# protocol so the image build never falls back to the HTTP-only 8080 contract.
-# ({{ENTRYPOINT}} is the BUILT entrypoint, e.g. dist/main.js.)
+# protocol. ({{ENTRYPOINT}} is the BUILT entrypoint, e.g. dist/unifiedMain.js.)
 ENV AGENT_PORT={{CONTAINER_PORT}}
 EXPOSE {{CONTAINER_PORT}}
 CMD ["node", "{{ENTRYPOINT}}"]

package/recipes/runtimes/agentcore/code/{{PKG}}/executor.ts.tmpl

@@ -64,6 +64,42 @@ const log = {
  * so prose never triggers an LLM call or a paid action.
  */
 export class SellerAgentExecutor extends SellerCore implements AgentExecutor {
+  /**
+   * Text-carrier entrypoint (Foundry invocations / responses SkillRouter).
+   *
+   * Same skill switch as {@link execute}, but NEVER throws: on a text
+   * carrier there is no JSON-RPC error channel, so a fault is returned as an
+   * `{"error": ...}` dict and the caller can always reply. The A2A path
+   * keeps its own switch below because its fault semantics differ (faults
+   * become JSON-RPC -32603 via A2AError).
+   */
+  async dispatch(
+    data: Record<string, unknown>,
+  ): Promise<Record<string, unknown>> {
+    const skill = data.skill;
+    try {
+      if (skill === "negotiate") {
+        return await this.negotiate(data);
+      }
+      if (skill === "notify_funded") {
+        return await this.notifyFunded(data);
+      }
+      // Includes a plain text message (no skill envelope → skill is
+      // undefined): the seller has no free-form skill, so prose is rejected
+      // here.
+      return {
+        error: `unknown skill: ${JSON.stringify(skill)}`,
+        skills: this.skills(),
+      };
+    } catch (e) {
+      // a skill failure must still ACK the buyer
+      log.error(`skill ${JSON.stringify(skill)} failed`, e);
+      const name = e instanceof Error ? e.constructor.name : "Error";
+      const msg = e instanceof Error ? e.message : String(e);
+      return { error: `${name}: ${msg}`, skill };
+    }
+  }
+
   // ── A2A entrypoints ───────────────────────────────────────────────────────
   execute = async (
     context: RequestContext,