@layr-labs/ecloud-sdk 0.2.0-dev.2 → 0.2.0-dev.3

package/dist/{chunk-4SKRNFKQ.js → chunk-R44OVMCY.js}

@@ -17,17 +17,10 @@ import {
   getLogger,
   stripHexPrefix,
   withSDKTelemetry
-} from "./chunk-ZEZS5CNB.js";
+} from "./chunk-QN7KAUOB.js";
 
 // src/client/common/contract/eip7702.ts
-import {
-  encodeFunctionData as encodeFunctionData2,
-  encodeAbiParameters,
-  decodeErrorResult as decodeErrorResult2,
-  keccak256,
-  toBytes,
-  concat
-} from "viem";
+import { encodeFunctionData as encodeFunctionData2, encodeAbiParameters, decodeErrorResult as decodeErrorResult2 } from "viem";
 
 // src/client/common/abis/ERC7702Delegator.json
 var ERC7702Delegator_default = [
@@ -2756,20 +2749,20 @@ async function prepareDeployBatch(options, logger) {
     environmentConfig
   };
 }
-async function executeDeployBatch(prepared, gas, logger) {
+async function executeDeployBatch(data, context, gas, logger) {
   const pendingMessage = "Deploying new app...";
   const txHash = await executeBatch(
     {
-      walletClient: prepared.walletClient,
-      publicClient: prepared.publicClient,
-      environmentConfig: prepared.environmentConfig,
-      executions: prepared.executions,
+      walletClient: context.walletClient,
+      publicClient: context.publicClient,
+      environmentConfig: context.environmentConfig,
+      executions: data.executions,
       pendingMessage,
       gas
     },
     logger
   );
-  return { appId: prepared.appId, txHash };
+  return { appId: data.appId, txHash };
 }
 async function deployApp(options, logger) {
   const prepared = await prepareDeployBatch(
@@ -2783,7 +2776,17 @@ async function deployApp(options, logger) {
     },
     logger
   );
-  return executeDeployBatch(prepared, options.gas, logger);
+  const data = {
+    appId: prepared.appId,
+    salt: prepared.salt,
+    executions: prepared.executions
+  };
+  const context = {
+    walletClient: prepared.walletClient,
+    publicClient: prepared.publicClient,
+    environmentConfig: prepared.environmentConfig
+  };
+  return executeDeployBatch(data, context, options.gas, logger);
 }
 async function prepareUpgradeBatch(options) {
   const {
@@ -2879,14 +2882,14 @@ async function prepareUpgradeBatch(options) {
     environmentConfig
   };
 }
-async function executeUpgradeBatch(prepared, gas, logger) {
-  const pendingMessage = `Upgrading app ${prepared.appId}...`;
+async function executeUpgradeBatch(data, context, gas, logger) {
+  const pendingMessage = `Upgrading app ${data.appId}...`;
   const txHash = await executeBatch(
     {
-      walletClient: prepared.walletClient,
-      publicClient: prepared.publicClient,
-      environmentConfig: prepared.environmentConfig,
-      executions: prepared.executions,
+      walletClient: context.walletClient,
+      publicClient: context.publicClient,
+      environmentConfig: context.environmentConfig,
+      executions: data.executions,
       pendingMessage,
       gas
     },
@@ -2904,7 +2907,16 @@ async function upgradeApp(options, logger) {
     publicLogs: options.publicLogs,
     needsPermissionChange: options.needsPermissionChange
   });
-  return executeUpgradeBatch(prepared, options.gas, logger);
+  const data = {
+    appId: prepared.appId,
+    executions: prepared.executions
+  };
+  const context = {
+    walletClient: prepared.walletClient,
+    publicClient: prepared.publicClient,
+    environmentConfig: prepared.environmentConfig
+  };
+  return executeUpgradeBatch(data, context, options.gas, logger);
 }
 async function sendAndWaitForTransaction(options, logger) {
   const {
@@ -3195,27 +3207,55 @@ async function undelegate(options, logger) {
 }
 
 // src/client/common/contract/eip7702.ts
+var EXECUTE_BATCH_MODE = "0x0100000000000000000000000000000000000000000000000000000000000000";
+var GAS_LIMIT_BUFFER_PERCENTAGE = 20n;
+var GAS_PRICE_BUFFER_PERCENTAGE = 100n;
+function encodeExecuteBatchData(executions) {
+  const encodedExecutions = encodeAbiParameters(
+    [
+      {
+        type: "tuple[]",
+        components: [
+          { name: "target", type: "address" },
+          { name: "value", type: "uint256" },
+          { name: "callData", type: "bytes" }
+        ]
+      }
+    ],
+    [executions]
+  );
+  return encodeFunctionData2({
+    abi: ERC7702Delegator_default,
+    functionName: "execute",
+    args: [EXECUTE_BATCH_MODE, encodedExecutions]
+  });
+}
 async function estimateBatchGas(options) {
-  const { publicClient, executions } = options;
-  const fees = await publicClient.estimateFeesPerGas();
-  const baseGas = 100000n;
-  const perExecutionGas = 50000n;
-  const estimatedGas = baseGas + BigInt(executions.length) * perExecutionGas;
-  const gasLimit = estimatedGas * 120n / 100n;
-  const maxFeePerGas = fees.maxFeePerGas;
-  const maxPriorityFeePerGas = fees.maxPriorityFeePerGas;
+  const { publicClient, account, executions } = options;
+  const executeBatchData = encodeExecuteBatchData(executions);
+  const [gasTipCap, block, estimatedGas] = await Promise.all([
+    publicClient.estimateMaxPriorityFeePerGas(),
+    publicClient.getBlock(),
+    publicClient.estimateGas({
+      account,
+      to: account,
+      data: executeBatchData
+    })
+  ]);
+  const baseFee = block.baseFeePerGas ?? 0n;
+  const maxFeePerGas = (baseFee + gasTipCap) * (100n + GAS_PRICE_BUFFER_PERCENTAGE) / 100n;
+  const gasLimit = estimatedGas * (100n + GAS_LIMIT_BUFFER_PERCENTAGE) / 100n;
   const maxCostWei = gasLimit * maxFeePerGas;
-  const maxCostEth = formatETH(maxCostWei);
   return {
     gasLimit,
     maxFeePerGas,
-    maxPriorityFeePerGas,
+    maxPriorityFeePerGas: gasTipCap,
     maxCostWei,
-    maxCostEth
+    maxCostEth: formatETH(maxCostWei)
   };
 }
 async function checkERC7702Delegation(publicClient, account, delegatorAddress) {
-  const code = await publicClient.getBytecode({ address: account });
+  const code = await publicClient.getCode({ address: account });
   if (!code) {
     return false;
   }
@@ -3232,36 +3272,7 @@ async function executeBatch(options, logger) {
   if (!chain) {
     throw new Error("Wallet client must have a chain");
   }
-  const encodedExecutions = encodeAbiParameters(
-    [
-      {
-        type: "tuple[]",
-        components: [
-          { name: "target", type: "address" },
-          { name: "value", type: "uint256" },
-          { name: "callData", type: "bytes" }
-        ]
-      }
-    ],
-    [executions]
-  );
-  const executeBatchMode = "0x0100000000000000000000000000000000000000000000000000000000000000";
-  let executeBatchData;
-  try {
-    executeBatchData = encodeFunctionData2({
-      abi: ERC7702Delegator_default,
-      functionName: "execute",
-      args: [executeBatchMode, encodedExecutions]
-    });
-  } catch {
-    const functionSignature = "execute(bytes32,bytes)";
-    const selector = keccak256(toBytes(functionSignature)).slice(0, 10);
-    const encodedParams = encodeAbiParameters(
-      [{ type: "bytes32" }, { type: "bytes" }],
-      [executeBatchMode, encodedExecutions]
-    );
-    executeBatchData = concat([selector, encodedParams]);
-  }
+  const executeBatchData = encodeExecuteBatchData(executions);
   const isDelegated2 = await checkERC7702Delegation(
     publicClient,
     account.address,
@@ -3643,6 +3654,7 @@ async function buildDockerImage(buildContext, dockerfilePath, tag, logger) {
     tag,
     "-f",
     dockerfilePath,
+    "--load",
     "--progress=plain",
     buildContext
   ];
@@ -3766,9 +3778,9 @@ async function pullDockerImage(docker, imageTag, platform = "linux/amd64", logge
 
 // src/client/common/docker/push.ts
 import * as child_process2 from "child_process";
-import { exec as exec3 } from "child_process";
+import { execFile } from "child_process";
 import { promisify as promisify2 } from "util";
-var execAsync = promisify2(exec3);
+var execFileAsync = promisify2(execFile);
 async function pushDockerImage(docker, imageRef, logger) {
   logger?.info?.(`Pushing image ${imageRef}...`);
   return new Promise((resolve2, reject) => {
@@ -3809,9 +3821,9 @@ async function pushDockerImage(docker, imageRef, logger) {
       if (!output.includes("digest:") && !output.includes("pushed") && !output.includes("Pushed")) {
         logger?.debug?.("No clear success indicator in push output, verifying...");
       }
-      logger?.info?.("Image push completed successfully");
       try {
         await verifyImageExists(imageRef, logger);
+        logger?.info?.("Image push completed successfully");
         resolve2();
       } catch (error) {
         reject(error);
@@ -3835,7 +3847,7 @@ async function verifyImageExists(imageRef, logger) {
   let retries = 5;
   while (retries > 0) {
     try {
-      await execAsync(`docker manifest inspect ${imageRef}`, {
+      await execFileAsync("docker", ["manifest", "inspect", imageRef], {
         maxBuffer: 10 * 1024 * 1024,
         timeout: 1e4
         // 10 second timeout
@@ -4293,10 +4305,10 @@ async function setupLayeredBuildDirectory(environmentConfig, layeredDockerfileCo
 // src/client/common/registry/digest.ts
 import * as child_process3 from "child_process";
 import { promisify as promisify3 } from "util";
-var execFileAsync = promisify3(child_process3.execFile);
+var execFileAsync2 = promisify3(child_process3.execFile);
 async function getImageDigestAndName(imageRef) {
   try {
-    const { stdout } = await execFileAsync(
+    const { stdout } = await execFileAsync2(
       "docker",
       ["manifest", "inspect", imageRef],
       { maxBuffer: 10 * 1024 * 1024 }
@@ -4336,7 +4348,7 @@ function extractDigestFromMultiPlatform(manifest, imageRef) {
 }
 async function extractDigestFromSinglePlatform(manifest, imageRef) {
   try {
-    const { stdout } = await execFileAsync("docker", ["inspect", imageRef], {
+    const { stdout } = await execFileAsync2("docker", ["inspect", imageRef], {
       maxBuffer: 10 * 1024 * 1024
     });
     const inspectData = JSON.parse(stdout);
@@ -4634,6 +4646,67 @@ Please verify the image exists: docker manifest inspect ${finalImageRef}`
   };
 }
 
+// src/client/common/release/prebuilt.ts
+async function createReleaseFromImageDigest(options, logger) {
+  const { imageRef, imageDigest, envFilePath, instanceType, environmentConfig, appId } = options;
+  if (!/^sha256:[0-9a-f]{64}$/i.test(imageDigest)) {
+    throw new Error(`imageDigest must be in format sha256:<64 hex>, got: ${imageDigest}`);
+  }
+  let publicEnv = {};
+  let privateEnv = {};
+  if (envFilePath) {
+    logger.info("Parsing environment file...");
+    const parsed = parseAndValidateEnvFile(envFilePath);
+    publicEnv = parsed.public;
+    privateEnv = parsed.private;
+  } else {
+    logger.info("Continuing without environment file");
+  }
+  publicEnv["EIGEN_MACHINE_TYPE_PUBLIC"] = instanceType;
+  logger.info(`Instance type: ${instanceType}`);
+  logger.info("Encrypting environment variables...");
+  const { encryptionKey } = getKMSKeysForEnvironment(
+    environmentConfig.name,
+    environmentConfig.build
+  );
+  const protectedHeaders = getAppProtectedHeaders(appId);
+  const privateEnvBytes = Buffer.from(JSON.stringify(privateEnv));
+  const encryptedEnvStr = await encryptRSAOAEPAndAES256GCM(
+    encryptionKey,
+    privateEnvBytes,
+    protectedHeaders
+  );
+  const digestHex = imageDigest.split(":")[1];
+  const digestBytes = new Uint8Array(Buffer.from(digestHex, "hex"));
+  if (digestBytes.length !== 32) {
+    throw new Error(`Digest must be exactly 32 bytes, got ${digestBytes.length}`);
+  }
+  const registry = extractRegistryNameNoDocker(imageRef);
+  return {
+    rmsRelease: {
+      artifacts: [{ digest: digestBytes, registry }],
+      upgradeByTime: Math.floor(Date.now() / 1e3) + 3600
+    },
+    publicEnv: new Uint8Array(Buffer.from(JSON.stringify(publicEnv))),
+    encryptedEnv: new Uint8Array(Buffer.from(encryptedEnvStr))
+  };
+}
+function extractRegistryNameNoDocker(imageRef) {
+  let name = imageRef;
+  const tagIndex = name.lastIndexOf(":");
+  if (tagIndex !== -1 && !name.substring(tagIndex + 1).includes("/")) {
+    name = name.substring(0, tagIndex);
+  }
+  const digestIndex = name.indexOf("@");
+  if (digestIndex !== -1) {
+    name = name.substring(0, digestIndex);
+  }
+  if ([...name].filter((c) => c === "/").length === 1) {
+    name = `docker.io/${name}`;
+  }
+  return name;
+}
+
 // src/client/common/contract/watcher.ts
 var WATCH_POLL_INTERVAL_SECONDS = 5;
 var APP_STATUS_RUNNING = "Running";
@@ -4815,6 +4888,97 @@ function validatePrivateKey(key) {
 }
 
 // src/client/modules/compute/app/deploy.ts
+async function prepareDeployFromVerifiableBuild(options, logger = defaultLogger) {
+  return withSDKTelemetry(
+    {
+      functionName: "prepareDeployFromVerifiableBuild",
+      skipTelemetry: options.skipTelemetry,
+      properties: {
+        environment: options.environment || "sepolia"
+      }
+    },
+    async () => {
+      if (!options.privateKey) throw new Error("privateKey is required for deployment");
+      if (!options.imageRef) throw new Error("imageRef is required for deployment");
+      if (!options.imageDigest) throw new Error("imageDigest is required for deployment");
+      assertValidImageReference(options.imageRef);
+      validateAppName(options.appName);
+      validateLogVisibility(options.logVisibility);
+      if (!/^sha256:[0-9a-f]{64}$/i.test(options.imageDigest)) {
+        throw new Error(
+          `imageDigest must be in format sha256:<64 hex>, got: ${options.imageDigest}`
+        );
+      }
+      const { publicLogs } = validateLogVisibility(options.logVisibility);
+      validateResourceUsageMonitoring(options.resourceUsageMonitoring);
+      logger.debug("Performing preflight checks...");
+      const preflightCtx = await doPreflightChecks(
+        {
+          privateKey: options.privateKey,
+          rpcUrl: options.rpcUrl,
+          environment: options.environment
+        },
+        logger
+      );
+      logger.debug("Checking quota availability...");
+      await checkQuotaAvailable(preflightCtx);
+      const salt = generateRandomSalt();
+      logger.debug(`Generated salt: ${Buffer.from(salt).toString("hex")}`);
+      logger.debug("Calculating app ID...");
+      const appIDToBeDeployed = await calculateAppID(
+        preflightCtx.privateKey,
+        options.rpcUrl || preflightCtx.rpcUrl,
+        preflightCtx.environmentConfig,
+        salt
+      );
+      logger.info(``);
+      logger.info(`App ID: ${appIDToBeDeployed}`);
+      logger.info(``);
+      const release = await createReleaseFromImageDigest(
+        {
+          imageRef: options.imageRef,
+          imageDigest: options.imageDigest,
+          envFilePath: options.envFilePath,
+          instanceType: options.instanceType,
+          environmentConfig: preflightCtx.environmentConfig,
+          appId: appIDToBeDeployed
+        },
+        logger
+      );
+      logger.debug("Preparing deploy batch...");
+      const batch = await prepareDeployBatch(
+        {
+          privateKey: preflightCtx.privateKey,
+          rpcUrl: options.rpcUrl || preflightCtx.rpcUrl,
+          environmentConfig: preflightCtx.environmentConfig,
+          salt,
+          release,
+          publicLogs
+        },
+        logger
+      );
+      logger.debug("Estimating gas...");
+      const gasEstimate = await estimateBatchGas({
+        publicClient: batch.publicClient,
+        account: batch.walletClient.account.address,
+        executions: batch.executions
+      });
+      const data = {
+        appId: batch.appId,
+        salt: batch.salt,
+        executions: batch.executions
+      };
+      return {
+        prepared: {
+          data,
+          appName: options.appName,
+          imageRef: options.imageRef
+        },
+        gasEstimate
+      };
+    }
+  );
+}
 function validateDeployOptions(options) {
   if (!options.privateKey) {
     throw new Error("privateKey is required for deployment");
@@ -5035,26 +5199,27 @@ async function prepareDeploy(options, logger = defaultLogger) {
       logger.debug("Estimating gas...");
       const gasEstimate = await estimateBatchGas({
         publicClient: batch.publicClient,
-        environmentConfig: batch.environmentConfig,
+        account: batch.walletClient.account.address,
         executions: batch.executions
       });
+      const data = {
+        appId: batch.appId,
+        salt: batch.salt,
+        executions: batch.executions
+      };
       return {
         prepared: {
-          batch,
+          data,
           appName,
-          imageRef: finalImageRef,
-          preflightCtx: {
-            privateKey: preflightCtx.privateKey,
-            rpcUrl: preflightCtx.rpcUrl,
-            environmentConfig: preflightCtx.environmentConfig
-          }
+          imageRef: finalImageRef
         },
         gasEstimate
       };
     }
   );
 }
-async function executeDeploy(prepared, gas, logger = defaultLogger, skipTelemetry) {
+async function executeDeploy(options) {
+  const { prepared, context, gas, logger = defaultLogger, skipTelemetry } = options;
   return withSDKTelemetry(
     {
       functionName: "executeDeploy",
@@ -5062,7 +5227,7 @@ async function executeDeploy(prepared, gas, logger = defaultLogger, skipTelemetr
     },
     async () => {
       logger.info("Deploying on-chain...");
-      const { appId, txHash } = await executeDeployBatch(prepared.batch, gas, logger);
+      const { appId, txHash } = await executeDeployBatch(prepared.data, context, gas, logger);
       return {
         appId,
         txHash,
@@ -5124,6 +5289,81 @@ async function checkAppLogPermission(preflightCtx, appAddress, logger) {
 }
 
 // src/client/modules/compute/app/upgrade.ts
+async function prepareUpgradeFromVerifiableBuild(options, logger = defaultLogger) {
+  return withSDKTelemetry(
+    {
+      functionName: "prepareUpgradeFromVerifiableBuild",
+      skipTelemetry: options.skipTelemetry,
+      properties: {
+        environment: options.environment || "sepolia"
+      }
+    },
+    async () => {
+      logger.debug("Performing preflight checks...");
+      const preflightCtx = await doPreflightChecks(
+        {
+          privateKey: options.privateKey,
+          rpcUrl: options.rpcUrl,
+          environment: options.environment
+        },
+        logger
+      );
+      const appID = validateUpgradeOptions(options);
+      assertValidImageReference(options.imageRef);
+      if (!/^sha256:[0-9a-f]{64}$/i.test(options.imageDigest)) {
+        throw new Error(
+          `imageDigest must be in format sha256:<64 hex>, got: ${options.imageDigest}`
+        );
+      }
+      const { publicLogs } = validateLogVisibility(options.logVisibility);
+      validateResourceUsageMonitoring(options.resourceUsageMonitoring);
+      const envFilePath = options.envFilePath || "";
+      logger.info("Preparing release (verifiable build, no local layering)...");
+      const release = await createReleaseFromImageDigest(
+        {
+          imageRef: options.imageRef,
+          imageDigest: options.imageDigest,
+          envFilePath,
+          instanceType: options.instanceType,
+          environmentConfig: preflightCtx.environmentConfig,
+          appId: appID
+        },
+        logger
+      );
+      logger.debug("Checking current log permission state...");
+      const currentlyPublic = await checkAppLogPermission(preflightCtx, appID, logger);
+      const needsPermissionChange = currentlyPublic !== publicLogs;
+      logger.debug("Preparing upgrade batch...");
+      const batch = await prepareUpgradeBatch({
+        privateKey: preflightCtx.privateKey,
+        rpcUrl: options.rpcUrl || preflightCtx.rpcUrl,
+        environmentConfig: preflightCtx.environmentConfig,
+        appId: appID,
+        release,
+        publicLogs,
+        needsPermissionChange
+      });
+      logger.debug("Estimating gas...");
+      const gasEstimate = await estimateBatchGas({
+        publicClient: batch.publicClient,
+        account: batch.walletClient.account.address,
+        executions: batch.executions
+      });
+      const data = {
+        appId: batch.appId,
+        executions: batch.executions
+      };
+      return {
+        prepared: {
+          data,
+          appId: appID,
+          imageRef: options.imageRef
+        },
+        gasEstimate
+      };
+    }
+  );
+}
 function validateUpgradeOptions(options) {
   if (!options.privateKey) {
     throw new Error("privateKey is required for upgrade");
@@ -5286,26 +5526,26 @@ async function prepareUpgrade(options, logger = defaultLogger) {
       logger.debug("Estimating gas...");
       const gasEstimate = await estimateBatchGas({
         publicClient: batch.publicClient,
-        environmentConfig: batch.environmentConfig,
+        account: batch.walletClient.account.address,
         executions: batch.executions
       });
+      const data = {
+        appId: batch.appId,
+        executions: batch.executions
+      };
       return {
         prepared: {
-          batch,
+          data,
           appId: appID,
-          imageRef: finalImageRef,
-          preflightCtx: {
-            privateKey: preflightCtx.privateKey,
-            rpcUrl: preflightCtx.rpcUrl,
-            environmentConfig: preflightCtx.environmentConfig
-          }
+          imageRef: finalImageRef
         },
         gasEstimate
       };
     }
   );
 }
-async function executeUpgrade(prepared, gas, logger = defaultLogger, skipTelemetry) {
+async function executeUpgrade(options) {
+  const { prepared, context, gas, logger = defaultLogger, skipTelemetry } = options;
   return withSDKTelemetry(
     {
       functionName: "executeUpgrade",
@@ -5313,7 +5553,7 @@ async function executeUpgrade(prepared, gas, logger = defaultLogger, skipTelemet
     },
     async () => {
       logger.info("Upgrading on-chain...");
-      const txHash = await executeUpgradeBatch(prepared.batch, gas, logger);
+      const txHash = await executeUpgradeBatch(prepared.data, context, gas, logger);
       return {
         appId: prepared.appId,
         imageRef: prepared.imageRef,
@@ -5442,10 +5682,10 @@ import * as path6 from "path";
 import * as fs5 from "fs";
 import * as path4 from "path";
 import * as os2 from "os";
-import { exec as exec4, execFile as execFile2 } from "child_process";
+import { exec as exec3, execFile as execFile3 } from "child_process";
 import { promisify as promisify4 } from "util";
-var execAsync2 = promisify4(exec4);
-var execFileAsync2 = promisify4(execFile2);
+var execAsync = promisify4(exec3);
+var execFileAsync3 = promisify4(execFile3);
 async function fetchTemplate(repoURL, ref, targetDir, config, logger) {
   if (!repoURL) {
     throw new Error("repoURL is required");
@@ -5454,13 +5694,13 @@ async function fetchTemplate(repoURL, ref, targetDir, config, logger) {
 Cloning repo: ${repoURL} \u2192 ${targetDir}
 `);
   try {
-    await execAsync2(`git clone --no-checkout --progress ${repoURL} ${targetDir}`, {
+    await execAsync(`git clone --no-checkout --progress ${repoURL} ${targetDir}`, {
       maxBuffer: 10 * 1024 * 1024
     });
-    await execFileAsync2("git", ["-C", targetDir, "checkout", "--quiet", ref], {
+    await execFileAsync3("git", ["-C", targetDir, "checkout", "--quiet", ref], {
       maxBuffer: 10 * 1024 * 1024
     });
-    await execFileAsync2(
+    await execFileAsync3(
       "git",
       ["-C", targetDir, "submodule", "update", "--init", "--recursive", "--progress"],
       { maxBuffer: 10 * 1024 * 1024 }
@@ -5505,14 +5745,14 @@ Cloning template: ${repoURL} \u2192 extracting ${subPath}
 }
 async function cloneSparse(repoURL, ref, subPath, tempDir) {
   try {
-    await execFileAsync2("git", ["init", tempDir]);
-    await execFileAsync2("git", ["-C", tempDir, "remote", "add", "origin", repoURL]);
-    await execFileAsync2("git", ["-C", tempDir, "config", "core.sparseCheckout", "true"]);
+    await execFileAsync3("git", ["init", tempDir]);
+    await execFileAsync3("git", ["-C", tempDir, "remote", "add", "origin", repoURL]);
+    await execFileAsync3("git", ["-C", tempDir, "config", "core.sparseCheckout", "true"]);
     const sparseCheckoutPath = path4.join(tempDir, ".git/info/sparse-checkout");
     fs5.writeFileSync(sparseCheckoutPath, `${subPath}
 `);
-    await execFileAsync2("git", ["-C", tempDir, "fetch", "origin", ref]);
-    await execFileAsync2("git", ["-C", tempDir, "checkout", ref]);
+    await execFileAsync3("git", ["-C", tempDir, "fetch", "origin", ref]);
+    await execFileAsync3("git", ["-C", tempDir, "checkout", ref]);
   } catch (error) {
     throw new Error(`Failed to clone sparse repository: ${error.message}`);
   }
@@ -6005,7 +6245,14 @@ async function logs(options, logger = defaultLogger, skipTelemetry = false) {
 }
 
 // src/client/modules/compute/app/index.ts
-import { parseAbi, encodeFunctionData as encodeFunctionData3 } from "viem";
+import {
+  parseAbi,
+  encodeFunctionData as encodeFunctionData3,
+  createWalletClient as createWalletClient2,
+  createPublicClient as createPublicClient4,
+  http as http4
+} from "viem";
+import { privateKeyToAccount as privateKeyToAccount3 } from "viem/accounts";
 var CONTROLLER_ABI = parseAbi([
   "function startApp(address appId)",
   "function stopApp(address appId)",
@@ -6088,6 +6335,187 @@ function createAppModule(ctx) {
         imageRef: result.imageRef
       };
     },
+    // Granular deploy control
+    async prepareDeploy(opts) {
+      return prepareDeploy(
+        {
+          privateKey,
+          rpcUrl: ctx.rpcUrl,
+          environment: ctx.environment,
+          appName: opts.name,
+          instanceType: opts.instanceType,
+          dockerfilePath: opts.dockerfile,
+          envFilePath: opts.envFile,
+          imageRef: opts.imageRef,
+          logVisibility: opts.logVisibility,
+          resourceUsageMonitoring: opts.resourceUsageMonitoring,
+          skipTelemetry
+        },
+        logger
+      );
+    },
+    async prepareDeployFromVerifiableBuild(opts) {
+      return prepareDeployFromVerifiableBuild(
+        {
+          privateKey,
+          rpcUrl: ctx.rpcUrl,
+          environment: ctx.environment,
+          appName: opts.name,
+          instanceType: opts.instanceType,
+          envFilePath: opts.envFile,
+          imageRef: opts.imageRef,
+          imageDigest: opts.imageDigest,
+          logVisibility: opts.logVisibility,
+          resourceUsageMonitoring: opts.resourceUsageMonitoring,
+          skipTelemetry
+        },
+        logger
+      );
+    },
+    async executeDeploy(prepared, gas) {
+      const account = privateKeyToAccount3(privateKey);
+      const chain = getChainFromID(environment.chainID);
+      const publicClient = createPublicClient4({
+        chain,
+        transport: http4(ctx.rpcUrl)
+      });
+      const walletClient = createWalletClient2({
+        account,
+        chain,
+        transport: http4(ctx.rpcUrl)
+      });
+      const result = await executeDeploy({
+        prepared,
+        context: {
+          walletClient,
+          publicClient,
+          environmentConfig: environment
+        },
+        gas,
+        logger,
+        skipTelemetry
+      });
+      return {
+        appId: result.appId,
+        txHash: result.txHash,
+        appName: result.appName,
+        imageRef: result.imageRef
+      };
+    },
+    async watchDeployment(appId) {
+      return watchDeployment(
+        appId,
+        privateKey,
+        ctx.rpcUrl,
+        ctx.environment,
+        logger,
+        ctx.clientId,
+        skipTelemetry
+      );
+    },
+    // Granular upgrade control
+    async prepareUpgrade(appId, opts) {
+      return prepareUpgrade(
+        {
+          appId,
+          privateKey,
+          rpcUrl: ctx.rpcUrl,
+          environment: ctx.environment,
+          instanceType: opts.instanceType,
+          dockerfilePath: opts.dockerfile,
+          envFilePath: opts.envFile,
+          imageRef: opts.imageRef,
+          logVisibility: opts.logVisibility,
+          resourceUsageMonitoring: opts.resourceUsageMonitoring,
+          skipTelemetry
+        },
+        logger
+      );
+    },
+    async prepareUpgradeFromVerifiableBuild(appId, opts) {
+      return prepareUpgradeFromVerifiableBuild(
+        {
+          appId,
+          privateKey,
+          rpcUrl: ctx.rpcUrl,
+          environment: ctx.environment,
+          instanceType: opts.instanceType,
+          envFilePath: opts.envFile,
+          imageRef: opts.imageRef,
+          imageDigest: opts.imageDigest,
+          logVisibility: opts.logVisibility,
+          resourceUsageMonitoring: opts.resourceUsageMonitoring,
+          skipTelemetry
+        },
+        logger
+      );
+    },
+    async executeUpgrade(prepared, gas) {
+      const account = privateKeyToAccount3(privateKey);
+      const chain = getChainFromID(environment.chainID);
+      const publicClient = createPublicClient4({
+        chain,
+        transport: http4(ctx.rpcUrl)
+      });
+      const walletClient = createWalletClient2({
+        account,
+        chain,
+        transport: http4(ctx.rpcUrl)
+      });
+      const result = await executeUpgrade({
+        prepared,
+        context: {
+          walletClient,
+          publicClient,
+          environmentConfig: environment
+        },
+        gas,
+        logger,
+        skipTelemetry
+      });
+      return {
+        appId: result.appId,
+        txHash: result.txHash,
+        imageRef: result.imageRef
+      };
+    },
+    async watchUpgrade(appId) {
+      return watchUpgrade(
+        appId,
+        privateKey,
+        ctx.rpcUrl,
+        ctx.environment,
+        logger,
+        ctx.clientId,
+        skipTelemetry
+      );
+    },
+    // Profile management
+    async setProfile(appId, profile) {
+      return withSDKTelemetry(
+        {
+          functionName: "setProfile",
+          skipTelemetry,
+          properties: { environment: ctx.environment }
+        },
+        async () => {
+          const userApiClient = new UserApiClient(
+            environment,
+            privateKey,
+            ctx.rpcUrl,
+            ctx.clientId
+          );
+          return userApiClient.uploadAppProfile(
+            appId,
+            profile.name,
+            profile.website,
+            profile.description,
+            profile.xURL,
+            profile.imagePath
+          );
+        }
+      );
+    },
     async logs(opts) {
       return logs(
         {
@@ -6267,9 +6695,11 @@ export {
   validateUpgradeParams,
   validateCreateAppParams,
   validateLogsParams,
+  prepareDeployFromVerifiableBuild,
   prepareDeploy,
   executeDeploy,
   watchDeployment,
+  prepareUpgradeFromVerifiableBuild,
   prepareUpgrade,
   executeUpgrade,
   watchUpgrade,
@@ -6286,4 +6716,4 @@ export {
   createAppModule,
   createComputeModule
 };
-//# sourceMappingURL=chunk-4SKRNFKQ.js.map
+//# sourceMappingURL=chunk-R44OVMCY.js.map