@layr-labs/ecloud-sdk 1.0.0-dev.6 → 1.0.0-dev.8

package/dist/index.cjs

@@ -171,8 +171,10 @@ __export(index_exports, {
   BuildError: () => BuildError,
   BuildFailedError: () => BuildFailedError,
   ConflictError: () => ConflictError,
+  EMPTY_CONTAINER_POLICY: () => EMPTY_CONTAINER_POLICY,
   ERC20ABI: () => ERC20_default,
   ForbiddenError: () => ForbiddenError,
+  InsufficientGasError: () => InsufficientGasError,
   JwtProvider: () => JwtProvider,
   NoopClient: () => NoopClient,
   NotFoundError: () => NotFoundError,
@@ -182,9 +184,12 @@ __export(index_exports, {
   TimeoutError: () => TimeoutError,
   USDCCreditsABI: () => USDCCredits_default,
   UserApiClient: () => UserApiClient,
+  WATCH_DEFAULT_TIMEOUT_SECONDS: () => WATCH_DEFAULT_TIMEOUT_SECONDS,
+  WatchTimeoutError: () => WatchTimeoutError,
   addHexPrefix: () => addHexPrefix,
   addMetric: () => addMetric,
   addMetricWithDimensions: () => addMetricWithDimensions,
+  assertSufficientGas: () => assertSufficientGas,
   assertValidFilePath: () => assertValidFilePath,
   assertValidImageReference: () => assertValidImageReference,
   assertValidPrivateKey: () => assertValidPrivateKey,
@@ -286,7 +291,7 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 
 // src/client/modules/compute/app/index.ts
-var import_viem6 = require("viem");
+var import_viem7 = require("viem");
 
 // src/client/common/docker/build.ts
 var child_process = __toESM(require("child_process"), 1);
@@ -575,7 +580,74 @@ var PushPermissionError = class extends Error {
 var import_handlebars = __toESM(require("handlebars"), 1);
 
 // src/client/common/templates/Dockerfile.layered.tmpl
-var Dockerfile_layered_default = '{{#if includeTLS}}\n# Get Caddy from official image\nFROM caddy:2.10.2-alpine AS caddy\n{{/if}}\n\nFROM {{baseImage}}\n\n{{#if originalUser}}\n# Switch to root to perform setup (base image has non-root USER: {{originalUser}})\nUSER root\n{{/if}}\n\n# Copy core TEE components\nCOPY compute-source-env.sh /usr/local/bin/\nCOPY kms-client /usr/local/bin/\nCOPY kms-signing-public-key.pem /usr/local/bin/\n\n{{#if includeTLS}}\n# Copy Caddy from official image\nCOPY --from=caddy /usr/bin/caddy /usr/local/bin/caddy\n\n# Copy TLS components\nCOPY tls-keygen /usr/local/bin/\nCOPY Caddyfile /etc/caddy/\n{{/if}}\n\n{{#if originalUser}}\n# Make binaries executable (755 for executables, 644 for keys)\nRUN chmod 755 /usr/local/bin/compute-source-env.sh \\\n    && chmod 755 /usr/local/bin/kms-client{{#if includeTLS}} \\\n    && chmod 755 /usr/local/bin/tls-keygen \\\n    && chmod 755 /usr/local/bin/caddy{{/if}} \\\n    && chmod 644 /usr/local/bin/kms-signing-public-key.pem\n\n# Store original user - entrypoint will drop privileges to this user after TEE setup\nENV __ECLOUD_ORIGINAL_USER={{originalUser}}\n{{else}}\n# Make binaries executable (preserve existing permissions, just add execute)\nRUN chmod +x /usr/local/bin/compute-source-env.sh \\\n    && chmod +x /usr/local/bin/kms-client{{#if includeTLS}} \\\n    && chmod +x /usr/local/bin/tls-keygen{{/if}}\n{{/if}}\n\n{{#if logRedirect}}\n\nLABEL tee.launch_policy.log_redirect={{logRedirect}}\n{{/if}}\n{{#if resourceUsageAllow}}\n\nLABEL tee.launch_policy.monitoring_memory_allow={{resourceUsageAllow}}\n{{/if}}\n\nLABEL eigenx_cli_version={{ecloudCLIVersion}}\nLABEL eigenx_vm_image=eigen\n\n{{#if includeTLS}}\n# Expose both HTTP and HTTPS ports for Caddy\nEXPOSE 80 443\n{{/if}}\n\nENTRYPOINT ["/usr/local/bin/compute-source-env.sh"]\nCMD {{{originalCmd}}}\n';
+var Dockerfile_layered_default = `{{#if includeTLS}}
+# Get Caddy from official image
+FROM caddy:2.10.2-alpine AS caddy
+{{/if}}
+
+FROM {{baseImage}}
+
+{{#if originalUser}}
+# Switch to root to perform setup (base image has non-root USER: {{originalUser}})
+USER root
+{{/if}}
+
+# Copy core TEE components
+# CA bundle for kms-client / tls-keygen to validate HTTPS calls to
+# eigencloud.xyz endpoints. Bundled at a non-standard path and consumed
+# only via SSL_CERT_FILE in compute-source-env.sh, so the user's
+# /etc/ssl/ is never touched.
+COPY --from=alpine:3.20.10 /etc/ssl/certs/ca-certificates.crt /usr/local/share/eigenx-ca-certs.crt
+COPY compute-source-env.sh /usr/local/bin/
+COPY kms-client /usr/local/bin/
+COPY kms-signing-public-key.pem /usr/local/bin/
+
+{{#if includeTLS}}
+# Copy Caddy from official image
+COPY --from=caddy /usr/bin/caddy /usr/local/bin/caddy
+
+# Copy TLS components
+COPY tls-keygen /usr/local/bin/
+COPY Caddyfile /etc/caddy/
+{{/if}}
+
+{{#if originalUser}}
+# Make binaries executable (755 for executables, 644 for keys)
+RUN chmod 755 /usr/local/bin/compute-source-env.sh \\
+    && chmod 755 /usr/local/bin/kms-client{{#if includeTLS}} \\
+    && chmod 755 /usr/local/bin/tls-keygen \\
+    && chmod 755 /usr/local/bin/caddy{{/if}} \\
+    && chmod 644 /usr/local/bin/kms-signing-public-key.pem
+
+# Store original user - entrypoint will drop privileges to this user after TEE setup
+ENV __ECLOUD_ORIGINAL_USER={{originalUser}}
+{{else}}
+# Make binaries executable (preserve existing permissions, just add execute)
+RUN chmod +x /usr/local/bin/compute-source-env.sh \\
+    && chmod +x /usr/local/bin/kms-client{{#if includeTLS}} \\
+    && chmod +x /usr/local/bin/tls-keygen{{/if}}
+{{/if}}
+
+{{#if logRedirect}}
+
+LABEL tee.launch_policy.log_redirect={{logRedirect}}
+{{/if}}
+{{#if resourceUsageAllow}}
+
+LABEL tee.launch_policy.monitoring_memory_allow={{resourceUsageAllow}}
+{{/if}}
+
+LABEL eigenx_cli_version={{ecloudCLIVersion}}
+LABEL eigenx_vm_image=eigen
+
+{{#if includeTLS}}
+# Expose both HTTP and HTTPS ports for Caddy
+EXPOSE 80 443
+{{/if}}
+
+ENTRYPOINT ["/usr/local/bin/compute-source-env.sh"]
+CMD {{{originalCmd}}}
+`;
 
 // src/client/common/templates/dockerfileTemplate.ts
 function processDockerfileTemplate(data) {
@@ -592,7 +664,7 @@ echo "compute-source-env.sh: Running setup script..."
 
 # Fetch and source environment variables from KMS
 echo "Fetching secrets from KMS..."
-if /usr/local/bin/kms-client \\
+if SSL_CERT_FILE=/usr/local/share/eigenx-ca-certs.crt /usr/local/bin/kms-client \\
   --kms-server-url "{{kmsServerURL}}" \\
   --kms-signing-key-file /usr/local/bin/kms-signing-public-key.pem \\
   --userapi-url "{{userAPIURL}}" \\
@@ -650,7 +722,8 @@ setup_tls() {
     
     echo "compute-source-env.sh: Obtaining TLS certificate using $challenge challenge..."
     # Pass the API URL for certificate persistence
-    if ! MNEMONIC="$mnemonic" DOMAIN="$domain" API_URL="{{userAPIURL}}" /usr/local/bin/tls-keygen \\
+    if ! SSL_CERT_FILE=/usr/local/share/eigenx-ca-certs.crt \\
+       MNEMONIC="$mnemonic" DOMAIN="$domain" API_URL="{{userAPIURL}}" /usr/local/bin/tls-keygen \\
         -challenge "$challenge" \\
         $staging_flag; then
         echo "compute-source-env.sh: ERROR - Failed to obtain TLS certificate"
@@ -1043,16 +1116,7 @@ async function extractDigestFromSinglePlatform(manifest, imageRef) {
       architecture: inspectData[0].Architecture
     } : null;
     if (!config) {
-      if (manifest.config?.digest) {
-        const digest = hexStringToBytes32(manifest.config.digest);
-        const registry = extractRegistryName(imageRef);
-        return {
-          digest,
-          registry,
-          platform: DOCKER_PLATFORM
-        };
-      }
-      throw new Error(`Could not determine platform for ${imageRef}`);
+      throw createPlatformErrorMessage(imageRef, ["unknown (could not determine architecture)"]);
     }
     const platform2 = `${config.os}/${config.architecture}`;
     if (platform2 === DOCKER_PLATFORM) {
@@ -1124,14 +1188,11 @@ Image: ${imageRef}
 Found platform(s): ${platforms.join(", ")}
 Required platform: ${DOCKER_PLATFORM}
 
-To fix this issue:
-1. Manual fix:
-   a. Rebuild your image with the correct platform:
-      docker build --platform ${DOCKER_PLATFORM} -t ${imageRef} .
-   b. Push the rebuilt image to your remote registry:
-      docker push ${imageRef}
-
-2. Or use the SDK to build with the correct platform automatically.`;
+To fix, either:
+1. Rebuild the image for ${DOCKER_PLATFORM} and push it:
+     docker buildx build --platform ${DOCKER_PLATFORM} -t ${imageRef} --push .
+2. Or use a verifiable build (--verifiable --repo <repo> --commit <sha>), which
+   builds server-side and needs no local Docker.`;
   return new Error(errorMsg);
 }
 
@@ -1236,6 +1297,8 @@ async function prepareRelease(options, logger) {
     logger.info(`Waiting ${REGISTRY_PROPAGATION_WAIT_SECONDS} seconds for registry propagation...`);
     await new Promise((resolve2) => setTimeout(resolve2, REGISTRY_PROPAGATION_WAIT_SECONDS * 1e3));
   } else {
+    logger.info("Verifying image platform (linux/amd64)...");
+    await getImageDigestAndName(imageRef);
     logger.info("Checking if image needs layering...");
     finalImageRef = await layerRemoteImageIfNeeded(
       {
@@ -1394,6 +1457,13 @@ function extractRegistryNameNoDocker(imageRef) {
 var import_viem = require("viem");
 
 // src/client/common/types/index.ts
+var EMPTY_CONTAINER_POLICY = {
+  args: [],
+  cmdOverride: [],
+  env: [],
+  envOverride: [],
+  restartPolicy: ""
+};
 var noopLogger = {
   debug: () => {
   },
@@ -2634,49 +2704,1594 @@ async function executeBatch(options, logger = noopLogger) {
       } else {
         revertReason = callError.message || "Unknown reason";
       }
-    }
-    throw new Error(`Transaction reverted: ${hash}. Reason: ${revertReason}`);
+    }
+    throw new Error(`Transaction reverted: ${hash}. Reason: ${revertReason}`);
+  }
+  return hash;
+}
+
+// src/client/common/contract/caller.ts
+var import_viem3 = require("viem");
+
+// src/client/common/utils/helpers.ts
+var import_viem2 = require("viem");
+var import_chains2 = require("viem/chains");
+var import_accounts = require("viem/accounts");
+function getChainFromID(chainID, fallback2 = import_chains2.sepolia) {
+  const id = Number(chainID);
+  return (0, import_viem2.extractChain)({ chains: SUPPORTED_CHAINS, id }) || fallback2;
+}
+function createClients(options) {
+  const { privateKey, rpcUrl, chainId } = options;
+  const privateKeyHex = addHexPrefix(privateKey);
+  const account = (0, import_accounts.privateKeyToAccount)(privateKeyHex);
+  const chain = getChainFromID(chainId);
+  const transport = typeof rpcUrl === "string" ? (0, import_viem2.http)(rpcUrl) : (0, import_viem2.fallback)(rpcUrl.map((url) => (0, import_viem2.http)(url)));
+  const publicClient = (0, import_viem2.createPublicClient)({
+    chain,
+    transport
+  });
+  const walletClient = (0, import_viem2.createWalletClient)({
+    account,
+    chain,
+    transport
+  });
+  return { walletClient, publicClient };
+}
+function addHexPrefix(value) {
+  return value.startsWith("0x") ? value : `0x${value}`;
+}
+function stripHexPrefix(value) {
+  return value.startsWith("0x") ? value.slice(2) : value;
+}
+
+// src/client/common/abis/AppController.json
+var AppController_default = [
+  {
+    type: "constructor",
+    inputs: [
+      {
+        name: "_version",
+        type: "string",
+        internalType: "string"
+      },
+      {
+        name: "_permissionController",
+        type: "address",
+        internalType: "contractIPermissionController"
+      },
+      {
+        name: "_releaseManager",
+        type: "address",
+        internalType: "contractIReleaseManager"
+      },
+      {
+        name: "_computeAVSRegistrar",
+        type: "address",
+        internalType: "contractIComputeAVSRegistrar"
+      },
+      {
+        name: "_computeOperator",
+        type: "address",
+        internalType: "contractIComputeOperator"
+      },
+      {
+        name: "_appBeacon",
+        type: "address",
+        internalType: "contractIBeacon"
+      }
+    ],
+    stateMutability: "nonpayable"
+  },
+  {
+    type: "function",
+    name: "API_PERMISSION_TYPEHASH",
+    inputs: [],
+    outputs: [
+      {
+        name: "",
+        type: "bytes32",
+        internalType: "bytes32"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "appBeacon",
+    inputs: [],
+    outputs: [
+      {
+        name: "",
+        type: "address",
+        internalType: "contractIBeacon"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "calculateApiPermissionDigestHash",
+    inputs: [
+      {
+        name: "permission",
+        type: "bytes4",
+        internalType: "bytes4"
+      },
+      {
+        name: "expiry",
+        type: "uint256",
+        internalType: "uint256"
+      }
+    ],
+    outputs: [
+      {
+        name: "",
+        type: "bytes32",
+        internalType: "bytes32"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "calculateAppId",
+    inputs: [
+      {
+        name: "deployer",
+        type: "address",
+        internalType: "address"
+      },
+      {
+        name: "salt",
+        type: "bytes32",
+        internalType: "bytes32"
+      }
+    ],
+    outputs: [
+      {
+        name: "",
+        type: "address",
+        internalType: "contractIApp"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "computeAVSRegistrar",
+    inputs: [],
+    outputs: [
+      {
+        name: "",
+        type: "address",
+        internalType: "contractIComputeAVSRegistrar"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "computeOperator",
+    inputs: [],
+    outputs: [
+      {
+        name: "",
+        type: "address",
+        internalType: "contractIComputeOperator"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "confirmUpgrade",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      }
+    ],
+    outputs: [],
+    stateMutability: "nonpayable"
+  },
+  {
+    type: "function",
+    name: "createApp",
+    inputs: [
+      {
+        name: "salt",
+        type: "bytes32",
+        internalType: "bytes32"
+      },
+      {
+        name: "release",
+        type: "tuple",
+        internalType: "structIAppController.Release",
+        components: [
+          {
+            name: "rmsRelease",
+            type: "tuple",
+            internalType: "structIReleaseManagerTypes.Release",
+            components: [
+              {
+                name: "artifacts",
+                type: "tuple[]",
+                internalType: "structIReleaseManagerTypes.Artifact[]",
+                components: [
+                  {
+                    name: "digest",
+                    type: "bytes32",
+                    internalType: "bytes32"
+                  },
+                  {
+                    name: "registry",
+                    type: "string",
+                    internalType: "string"
+                  }
+                ]
+              },
+              {
+                name: "upgradeByTime",
+                type: "uint32",
+                internalType: "uint32"
+              }
+            ]
+          },
+          {
+            name: "publicEnv",
+            type: "bytes",
+            internalType: "bytes"
+          },
+          {
+            name: "encryptedEnv",
+            type: "bytes",
+            internalType: "bytes"
+          },
+          {
+            name: "containerPolicy",
+            type: "tuple",
+            internalType: "structIAppController.ContainerPolicy",
+            components: [
+              {
+                name: "args",
+                type: "string[]",
+                internalType: "string[]"
+              },
+              {
+                name: "cmdOverride",
+                type: "string[]",
+                internalType: "string[]"
+              },
+              {
+                name: "env",
+                type: "tuple[]",
+                internalType: "structIAppController.EnvVar[]",
+                components: [
+                  {
+                    name: "key",
+                    type: "string",
+                    internalType: "string"
+                  },
+                  {
+                    name: "value",
+                    type: "string",
+                    internalType: "string"
+                  }
+                ]
+              },
+              {
+                name: "envOverride",
+                type: "tuple[]",
+                internalType: "structIAppController.EnvVar[]",
+                components: [
+                  {
+                    name: "key",
+                    type: "string",
+                    internalType: "string"
+                  },
+                  {
+                    name: "value",
+                    type: "string",
+                    internalType: "string"
+                  }
+                ]
+              },
+              {
+                name: "restartPolicy",
+                type: "string",
+                internalType: "string"
+              }
+            ]
+          }
+        ]
+      }
+    ],
+    outputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      }
+    ],
+    stateMutability: "nonpayable"
+  },
+  {
+    type: "function",
+    name: "createAppWithIsolatedBilling",
+    inputs: [
+      {
+        name: "salt",
+        type: "bytes32",
+        internalType: "bytes32"
+      },
+      {
+        name: "release",
+        type: "tuple",
+        internalType: "structIAppController.Release",
+        components: [
+          {
+            name: "rmsRelease",
+            type: "tuple",
+            internalType: "structIReleaseManagerTypes.Release",
+            components: [
+              {
+                name: "artifacts",
+                type: "tuple[]",
+                internalType: "structIReleaseManagerTypes.Artifact[]",
+                components: [
+                  {
+                    name: "digest",
+                    type: "bytes32",
+                    internalType: "bytes32"
+                  },
+                  {
+                    name: "registry",
+                    type: "string",
+                    internalType: "string"
+                  }
+                ]
+              },
+              {
+                name: "upgradeByTime",
+                type: "uint32",
+                internalType: "uint32"
+              }
+            ]
+          },
+          {
+            name: "publicEnv",
+            type: "bytes",
+            internalType: "bytes"
+          },
+          {
+            name: "encryptedEnv",
+            type: "bytes",
+            internalType: "bytes"
+          },
+          {
+            name: "containerPolicy",
+            type: "tuple",
+            internalType: "structIAppController.ContainerPolicy",
+            components: [
+              {
+                name: "args",
+                type: "string[]",
+                internalType: "string[]"
+              },
+              {
+                name: "cmdOverride",
+                type: "string[]",
+                internalType: "string[]"
+              },
+              {
+                name: "env",
+                type: "tuple[]",
+                internalType: "structIAppController.EnvVar[]",
+                components: [
+                  {
+                    name: "key",
+                    type: "string",
+                    internalType: "string"
+                  },
+                  {
+                    name: "value",
+                    type: "string",
+                    internalType: "string"
+                  }
+                ]
+              },
+              {
+                name: "envOverride",
+                type: "tuple[]",
+                internalType: "structIAppController.EnvVar[]",
+                components: [
+                  {
+                    name: "key",
+                    type: "string",
+                    internalType: "string"
+                  },
+                  {
+                    name: "value",
+                    type: "string",
+                    internalType: "string"
+                  }
+                ]
+              },
+              {
+                name: "restartPolicy",
+                type: "string",
+                internalType: "string"
+              }
+            ]
+          }
+        ]
+      }
+    ],
+    outputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      }
+    ],
+    stateMutability: "nonpayable"
+  },
+  {
+    type: "function",
+    name: "createEmptyApp",
+    inputs: [
+      {
+        name: "salt",
+        type: "bytes32",
+        internalType: "bytes32"
+      }
+    ],
+    outputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      }
+    ],
+    stateMutability: "nonpayable"
+  },
+  {
+    type: "function",
+    name: "createEmptyAppWithIsolatedBilling",
+    inputs: [
+      {
+        name: "salt",
+        type: "bytes32",
+        internalType: "bytes32"
+      }
+    ],
+    outputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      }
+    ],
+    stateMutability: "nonpayable"
+  },
+  {
+    type: "function",
+    name: "domainSeparator",
+    inputs: [],
+    outputs: [
+      {
+        name: "",
+        type: "bytes32",
+        internalType: "bytes32"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "getActiveAppCount",
+    inputs: [
+      {
+        name: "user",
+        type: "address",
+        internalType: "address"
+      }
+    ],
+    outputs: [
+      {
+        name: "",
+        type: "uint32",
+        internalType: "uint32"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "getAppCreator",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      }
+    ],
+    outputs: [
+      {
+        name: "",
+        type: "address",
+        internalType: "address"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "getAppLatestReleaseBlockNumber",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      }
+    ],
+    outputs: [
+      {
+        name: "",
+        type: "uint32",
+        internalType: "uint32"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "getAppOperatorSetId",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      }
+    ],
+    outputs: [
+      {
+        name: "",
+        type: "uint32",
+        internalType: "uint32"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "getAppPendingReleaseBlockNumber",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      }
+    ],
+    outputs: [
+      {
+        name: "",
+        type: "uint32",
+        internalType: "uint32"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "getAppStatus",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      }
+    ],
+    outputs: [
+      {
+        name: "",
+        type: "uint8",
+        internalType: "enumIAppController.AppStatus"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "getApps",
+    inputs: [
+      {
+        name: "offset",
+        type: "uint256",
+        internalType: "uint256"
+      },
+      {
+        name: "limit",
+        type: "uint256",
+        internalType: "uint256"
+      }
+    ],
+    outputs: [
+      {
+        name: "apps",
+        type: "address[]",
+        internalType: "contractIApp[]"
+      },
+      {
+        name: "appConfigsMem",
+        type: "tuple[]",
+        internalType: "structIAppController.AppConfig[]",
+        components: [
+          {
+            name: "creator",
+            type: "address",
+            internalType: "address"
+          },
+          {
+            name: "operatorSetId",
+            type: "uint32",
+            internalType: "uint32"
+          },
+          {
+            name: "latestReleaseBlockNumber",
+            type: "uint32",
+            internalType: "uint32"
+          },
+          {
+            name: "pendingReleaseBlockNumber",
+            type: "uint32",
+            internalType: "uint32"
+          },
+          {
+            name: "status",
+            type: "uint8",
+            internalType: "enumIAppController.AppStatus"
+          }
+        ]
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "getAppsByBillingAccount",
+    inputs: [
+      {
+        name: "account",
+        type: "address",
+        internalType: "address"
+      },
+      {
+        name: "offset",
+        type: "uint256",
+        internalType: "uint256"
+      },
+      {
+        name: "limit",
+        type: "uint256",
+        internalType: "uint256"
+      }
+    ],
+    outputs: [
+      {
+        name: "apps",
+        type: "address[]",
+        internalType: "contractIApp[]"
+      },
+      {
+        name: "appConfigsMem",
+        type: "tuple[]",
+        internalType: "structIAppController.AppConfig[]",
+        components: [
+          {
+            name: "creator",
+            type: "address",
+            internalType: "address"
+          },
+          {
+            name: "operatorSetId",
+            type: "uint32",
+            internalType: "uint32"
+          },
+          {
+            name: "latestReleaseBlockNumber",
+            type: "uint32",
+            internalType: "uint32"
+          },
+          {
+            name: "pendingReleaseBlockNumber",
+            type: "uint32",
+            internalType: "uint32"
+          },
+          {
+            name: "status",
+            type: "uint8",
+            internalType: "enumIAppController.AppStatus"
+          }
+        ]
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "getAppsByCreator",
+    inputs: [
+      {
+        name: "creator",
+        type: "address",
+        internalType: "address"
+      },
+      {
+        name: "offset",
+        type: "uint256",
+        internalType: "uint256"
+      },
+      {
+        name: "limit",
+        type: "uint256",
+        internalType: "uint256"
+      }
+    ],
+    outputs: [
+      {
+        name: "apps",
+        type: "address[]",
+        internalType: "contractIApp[]"
+      },
+      {
+        name: "appConfigsMem",
+        type: "tuple[]",
+        internalType: "structIAppController.AppConfig[]",
+        components: [
+          {
+            name: "creator",
+            type: "address",
+            internalType: "address"
+          },
+          {
+            name: "operatorSetId",
+            type: "uint32",
+            internalType: "uint32"
+          },
+          {
+            name: "latestReleaseBlockNumber",
+            type: "uint32",
+            internalType: "uint32"
+          },
+          {
+            name: "pendingReleaseBlockNumber",
+            type: "uint32",
+            internalType: "uint32"
+          },
+          {
+            name: "status",
+            type: "uint8",
+            internalType: "enumIAppController.AppStatus"
+          }
+        ]
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "getAppsByDeveloper",
+    inputs: [
+      {
+        name: "developer",
+        type: "address",
+        internalType: "address"
+      },
+      {
+        name: "offset",
+        type: "uint256",
+        internalType: "uint256"
+      },
+      {
+        name: "limit",
+        type: "uint256",
+        internalType: "uint256"
+      }
+    ],
+    outputs: [
+      {
+        name: "apps",
+        type: "address[]",
+        internalType: "contractIApp[]"
+      },
+      {
+        name: "appConfigsMem",
+        type: "tuple[]",
+        internalType: "structIAppController.AppConfig[]",
+        components: [
+          {
+            name: "creator",
+            type: "address",
+            internalType: "address"
+          },
+          {
+            name: "operatorSetId",
+            type: "uint32",
+            internalType: "uint32"
+          },
+          {
+            name: "latestReleaseBlockNumber",
+            type: "uint32",
+            internalType: "uint32"
+          },
+          {
+            name: "pendingReleaseBlockNumber",
+            type: "uint32",
+            internalType: "uint32"
+          },
+          {
+            name: "status",
+            type: "uint8",
+            internalType: "enumIAppController.AppStatus"
+          }
+        ]
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "getBillingAccount",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      }
+    ],
+    outputs: [
+      {
+        name: "",
+        type: "address",
+        internalType: "address"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "getBillingType",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      }
+    ],
+    outputs: [
+      {
+        name: "",
+        type: "uint8",
+        internalType: "enumIAppController.BillingType"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "getMaxActiveAppsPerUser",
+    inputs: [
+      {
+        name: "user",
+        type: "address",
+        internalType: "address"
+      }
+    ],
+    outputs: [
+      {
+        name: "",
+        type: "uint32",
+        internalType: "uint32"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "globalActiveAppCount",
+    inputs: [],
+    outputs: [
+      {
+        name: "",
+        type: "uint32",
+        internalType: "uint32"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "initialize",
+    inputs: [
+      {
+        name: "admin",
+        type: "address",
+        internalType: "address"
+      }
+    ],
+    outputs: [],
+    stateMutability: "nonpayable"
+  },
+  {
+    type: "function",
+    name: "maxGlobalActiveApps",
+    inputs: [],
+    outputs: [
+      {
+        name: "",
+        type: "uint32",
+        internalType: "uint32"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "permissionController",
+    inputs: [],
+    outputs: [
+      {
+        name: "",
+        type: "address",
+        internalType: "contractIPermissionController"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "releaseManager",
+    inputs: [],
+    outputs: [
+      {
+        name: "",
+        type: "address",
+        internalType: "contractIReleaseManager"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "setMaxActiveAppsPerUser",
+    inputs: [
+      {
+        name: "user",
+        type: "address",
+        internalType: "address"
+      },
+      {
+        name: "limit",
+        type: "uint32",
+        internalType: "uint32"
+      }
+    ],
+    outputs: [],
+    stateMutability: "nonpayable"
+  },
+  {
+    type: "function",
+    name: "setMaxGlobalActiveApps",
+    inputs: [
+      {
+        name: "limit",
+        type: "uint32",
+        internalType: "uint32"
+      }
+    ],
+    outputs: [],
+    stateMutability: "nonpayable"
+  },
+  {
+    type: "function",
+    name: "startApp",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      }
+    ],
+    outputs: [],
+    stateMutability: "nonpayable"
+  },
+  {
+    type: "function",
+    name: "stopApp",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      }
+    ],
+    outputs: [],
+    stateMutability: "nonpayable"
+  },
+  {
+    type: "function",
+    name: "suspend",
+    inputs: [
+      {
+        name: "account",
+        type: "address",
+        internalType: "address"
+      },
+      {
+        name: "apps",
+        type: "address[]",
+        internalType: "contractIApp[]"
+      }
+    ],
+    outputs: [],
+    stateMutability: "nonpayable"
+  },
+  {
+    type: "function",
+    name: "terminateApp",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      }
+    ],
+    outputs: [],
+    stateMutability: "nonpayable"
+  },
+  {
+    type: "function",
+    name: "terminateAppByAdmin",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      }
+    ],
+    outputs: [],
+    stateMutability: "nonpayable"
+  },
+  {
+    type: "function",
+    name: "updateAppMetadataURI",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      },
+      {
+        name: "metadataURI",
+        type: "string",
+        internalType: "string"
+      }
+    ],
+    outputs: [],
+    stateMutability: "nonpayable"
+  },
+  {
+    type: "function",
+    name: "upgradeApp",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      },
+      {
+        name: "release",
+        type: "tuple",
+        internalType: "structIAppController.Release",
+        components: [
+          {
+            name: "rmsRelease",
+            type: "tuple",
+            internalType: "structIReleaseManagerTypes.Release",
+            components: [
+              {
+                name: "artifacts",
+                type: "tuple[]",
+                internalType: "structIReleaseManagerTypes.Artifact[]",
+                components: [
+                  {
+                    name: "digest",
+                    type: "bytes32",
+                    internalType: "bytes32"
+                  },
+                  {
+                    name: "registry",
+                    type: "string",
+                    internalType: "string"
+                  }
+                ]
+              },
+              {
+                name: "upgradeByTime",
+                type: "uint32",
+                internalType: "uint32"
+              }
+            ]
+          },
+          {
+            name: "publicEnv",
+            type: "bytes",
+            internalType: "bytes"
+          },
+          {
+            name: "encryptedEnv",
+            type: "bytes",
+            internalType: "bytes"
+          },
+          {
+            name: "containerPolicy",
+            type: "tuple",
+            internalType: "structIAppController.ContainerPolicy",
+            components: [
+              {
+                name: "args",
+                type: "string[]",
+                internalType: "string[]"
+              },
+              {
+                name: "cmdOverride",
+                type: "string[]",
+                internalType: "string[]"
+              },
+              {
+                name: "env",
+                type: "tuple[]",
+                internalType: "structIAppController.EnvVar[]",
+                components: [
+                  {
+                    name: "key",
+                    type: "string",
+                    internalType: "string"
+                  },
+                  {
+                    name: "value",
+                    type: "string",
+                    internalType: "string"
+                  }
+                ]
+              },
+              {
+                name: "envOverride",
+                type: "tuple[]",
+                internalType: "structIAppController.EnvVar[]",
+                components: [
+                  {
+                    name: "key",
+                    type: "string",
+                    internalType: "string"
+                  },
+                  {
+                    name: "value",
+                    type: "string",
+                    internalType: "string"
+                  }
+                ]
+              },
+              {
+                name: "restartPolicy",
+                type: "string",
+                internalType: "string"
+              }
+            ]
+          }
+        ]
+      }
+    ],
+    outputs: [
+      {
+        name: "",
+        type: "uint256",
+        internalType: "uint256"
+      }
+    ],
+    stateMutability: "nonpayable"
+  },
+  {
+    type: "function",
+    name: "version",
+    inputs: [],
+    outputs: [
+      {
+        name: "",
+        type: "string",
+        internalType: "string"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "event",
+    name: "AppCreated",
+    inputs: [
+      {
+        name: "creator",
+        type: "address",
+        indexed: true,
+        internalType: "address"
+      },
+      {
+        name: "app",
+        type: "address",
+        indexed: true,
+        internalType: "contractIApp"
+      },
+      {
+        name: "operatorSetId",
+        type: "uint32",
+        indexed: false,
+        internalType: "uint32"
+      }
+    ],
+    anonymous: false
+  },
+  {
+    type: "event",
+    name: "AppMetadataURIUpdated",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        indexed: true,
+        internalType: "contractIApp"
+      },
+      {
+        name: "metadataURI",
+        type: "string",
+        indexed: false,
+        internalType: "string"
+      }
+    ],
+    anonymous: false
+  },
+  {
+    type: "event",
+    name: "AppStarted",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        indexed: true,
+        internalType: "contractIApp"
+      }
+    ],
+    anonymous: false
+  },
+  {
+    type: "event",
+    name: "AppStopped",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        indexed: true,
+        internalType: "contractIApp"
+      }
+    ],
+    anonymous: false
+  },
+  {
+    type: "event",
+    name: "AppSuspended",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        indexed: true,
+        internalType: "contractIApp"
+      }
+    ],
+    anonymous: false
+  },
+  {
+    type: "event",
+    name: "AppTerminated",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        indexed: true,
+        internalType: "contractIApp"
+      }
+    ],
+    anonymous: false
+  },
+  {
+    type: "event",
+    name: "AppTerminatedByAdmin",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        indexed: true,
+        internalType: "contractIApp"
+      }
+    ],
+    anonymous: false
+  },
+  {
+    type: "event",
+    name: "AppUpgraded",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        indexed: true,
+        internalType: "contractIApp"
+      },
+      {
+        name: "rmsReleaseId",
+        type: "uint256",
+        indexed: false,
+        internalType: "uint256"
+      },
+      {
+        name: "release",
+        type: "tuple",
+        indexed: false,
+        internalType: "structIAppController.Release",
+        components: [
+          {
+            name: "rmsRelease",
+            type: "tuple",
+            internalType: "structIReleaseManagerTypes.Release",
+            components: [
+              {
+                name: "artifacts",
+                type: "tuple[]",
+                internalType: "structIReleaseManagerTypes.Artifact[]",
+                components: [
+                  {
+                    name: "digest",
+                    type: "bytes32",
+                    internalType: "bytes32"
+                  },
+                  {
+                    name: "registry",
+                    type: "string",
+                    internalType: "string"
+                  }
+                ]
+              },
+              {
+                name: "upgradeByTime",
+                type: "uint32",
+                internalType: "uint32"
+              }
+            ]
+          },
+          {
+            name: "publicEnv",
+            type: "bytes",
+            internalType: "bytes"
+          },
+          {
+            name: "encryptedEnv",
+            type: "bytes",
+            internalType: "bytes"
+          },
+          {
+            name: "containerPolicy",
+            type: "tuple",
+            internalType: "structIAppController.ContainerPolicy",
+            components: [
+              {
+                name: "args",
+                type: "string[]",
+                internalType: "string[]"
+              },
+              {
+                name: "cmdOverride",
+                type: "string[]",
+                internalType: "string[]"
+              },
+              {
+                name: "env",
+                type: "tuple[]",
+                internalType: "structIAppController.EnvVar[]",
+                components: [
+                  {
+                    name: "key",
+                    type: "string",
+                    internalType: "string"
+                  },
+                  {
+                    name: "value",
+                    type: "string",
+                    internalType: "string"
+                  }
+                ]
+              },
+              {
+                name: "envOverride",
+                type: "tuple[]",
+                internalType: "structIAppController.EnvVar[]",
+                components: [
+                  {
+                    name: "key",
+                    type: "string",
+                    internalType: "string"
+                  },
+                  {
+                    name: "value",
+                    type: "string",
+                    internalType: "string"
+                  }
+                ]
+              },
+              {
+                name: "restartPolicy",
+                type: "string",
+                internalType: "string"
+              }
+            ]
+          }
+        ]
+      }
+    ],
+    anonymous: false
+  },
+  {
+    type: "event",
+    name: "GlobalMaxActiveAppsSet",
+    inputs: [
+      {
+        name: "limit",
+        type: "uint32",
+        indexed: false,
+        internalType: "uint32"
+      }
+    ],
+    anonymous: false
+  },
+  {
+    type: "event",
+    name: "Initialized",
+    inputs: [
+      {
+        name: "version",
+        type: "uint8",
+        indexed: false,
+        internalType: "uint8"
+      }
+    ],
+    anonymous: false
+  },
+  {
+    type: "event",
+    name: "MaxActiveAppsSet",
+    inputs: [
+      {
+        name: "user",
+        type: "address",
+        indexed: true,
+        internalType: "address"
+      },
+      {
+        name: "limit",
+        type: "uint32",
+        indexed: false,
+        internalType: "uint32"
+      }
+    ],
+    anonymous: false
+  },
+  {
+    type: "event",
+    name: "UpgradeConfirmed",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        indexed: true,
+        internalType: "contractIApp"
+      },
+      {
+        name: "pendingReleaseBlockNumber",
+        type: "uint32",
+        indexed: false,
+        internalType: "uint32"
+      }
+    ],
+    anonymous: false
+  },
+  {
+    type: "error",
+    name: "AccountHasActiveApps",
+    inputs: []
+  },
+  {
+    type: "error",
+    name: "AppAlreadyExists",
+    inputs: []
+  },
+  {
+    type: "error",
+    name: "AppDoesNotExist",
+    inputs: []
+  },
+  {
+    type: "error",
+    name: "GlobalMaxActiveAppsExceeded",
+    inputs: []
+  },
+  {
+    type: "error",
+    name: "InvalidAppStatus",
+    inputs: []
+  },
+  {
+    type: "error",
+    name: "InvalidPermissions",
+    inputs: []
+  },
+  {
+    type: "error",
+    name: "InvalidReleaseMetadataURI",
+    inputs: []
+  },
+  {
+    type: "error",
+    name: "InvalidShortString",
+    inputs: []
+  },
+  {
+    type: "error",
+    name: "InvalidSignature",
+    inputs: []
+  },
+  {
+    type: "error",
+    name: "MaxActiveAppsExceeded",
+    inputs: []
+  },
+  {
+    type: "error",
+    name: "MoreThanOneArtifact",
+    inputs: []
+  },
+  {
+    type: "error",
+    name: "NoPendingUpgrade",
+    inputs: []
+  },
+  {
+    type: "error",
+    name: "SignatureExpired",
+    inputs: []
+  },
+  {
+    type: "error",
+    name: "StringTooLong",
+    inputs: [
+      {
+        name: "str",
+        type: "string",
+        internalType: "string"
+      }
+    ]
   }
-  return hash;
-}
-
-// src/client/common/contract/caller.ts
-var import_viem3 = require("viem");
-
-// src/client/common/utils/helpers.ts
-var import_viem2 = require("viem");
-var import_chains2 = require("viem/chains");
-var import_accounts = require("viem/accounts");
-function getChainFromID(chainID, fallback2 = import_chains2.sepolia) {
-  const id = Number(chainID);
-  return (0, import_viem2.extractChain)({ chains: SUPPORTED_CHAINS, id }) || fallback2;
-}
-function createClients(options) {
-  const { privateKey, rpcUrl, chainId } = options;
-  const privateKeyHex = addHexPrefix(privateKey);
-  const account = (0, import_accounts.privateKeyToAccount)(privateKeyHex);
-  const chain = getChainFromID(chainId);
-  const transport = typeof rpcUrl === "string" ? (0, import_viem2.http)(rpcUrl) : (0, import_viem2.fallback)(rpcUrl.map((url) => (0, import_viem2.http)(url)));
-  const publicClient = (0, import_viem2.createPublicClient)({
-    chain,
-    transport
-  });
-  const walletClient = (0, import_viem2.createWalletClient)({
-    account,
-    chain,
-    transport
-  });
-  return { walletClient, publicClient };
-}
-function addHexPrefix(value) {
-  return value.startsWith("0x") ? value : `0x${value}`;
-}
-function stripHexPrefix(value) {
-  return value.startsWith("0x") ? value.slice(2) : value;
-}
+];
 
-// src/client/common/abis/AppController.json
-var AppController_default = [
+// src/client/common/abis/AppController.v1_4.json
+var AppController_v1_4_default = [
   {
     type: "constructor",
     inputs: [
@@ -4360,6 +5975,38 @@ var PermissionController_default = [
 ];
 
 // src/client/common/contract/caller.ts
+function appControllerAbiFor(environmentConfig) {
+  return environmentConfig.releaseAbiVersion === "v1.4" ? AppController_v1_4_default : AppController_default;
+}
+function supportsContainerPolicy(environmentConfig) {
+  return environmentConfig.releaseAbiVersion !== "v1.4";
+}
+function containerPolicyForViem(policy = EMPTY_CONTAINER_POLICY) {
+  return {
+    args: policy.args,
+    cmdOverride: policy.cmdOverride,
+    env: policy.env.map((e) => ({ key: e.key, value: e.value })),
+    envOverride: policy.envOverride.map((e) => ({ key: e.key, value: e.value })),
+    restartPolicy: policy.restartPolicy
+  };
+}
+function releaseForViem(release, environmentConfig) {
+  const base = {
+    rmsRelease: {
+      artifacts: release.rmsRelease.artifacts.map((artifact) => ({
+        digest: `0x${(0, import_viem3.bytesToHex)(artifact.digest).slice(2).padStart(64, "0")}`,
+        registry: artifact.registry
+      })),
+      upgradeByTime: release.rmsRelease.upgradeByTime
+    },
+    publicEnv: (0, import_viem3.bytesToHex)(release.publicEnv),
+    encryptedEnv: (0, import_viem3.bytesToHex)(release.encryptedEnv)
+  };
+  if (!supportsContainerPolicy(environmentConfig)) {
+    return base;
+  }
+  return { ...base, containerPolicy: containerPolicyForViem(release.containerPolicy) };
+}
 function formatETH(wei) {
   const eth = Number(wei) / 1e18;
   const costStr = eth.toFixed(6);
@@ -4397,7 +6044,7 @@ async function calculateAppID(options) {
   const saltHex = `0x${paddedSaltHex}`;
   const appID = await publicClient.readContract({
     address: environmentConfig.appControllerAddress,
-    abi: AppController_default,
+    abi: appControllerAbiFor(environmentConfig),
     functionName: "calculateAppId",
     args: [ownerAddress, saltHex]
   });
@@ -4421,22 +6068,12 @@ async function prepareDeployBatch(options, logger = noopLogger) {
   const saltHexString = (0, import_viem3.bytesToHex)(salt).slice(2);
   const paddedSaltHex = saltHexString.padStart(64, "0");
   const saltHex = `0x${paddedSaltHex}`;
-  const releaseForViem = {
-    rmsRelease: {
-      artifacts: release.rmsRelease.artifacts.map((artifact) => ({
-        digest: `0x${(0, import_viem3.bytesToHex)(artifact.digest).slice(2).padStart(64, "0")}`,
-        registry: artifact.registry
-      })),
-      upgradeByTime: release.rmsRelease.upgradeByTime
-    },
-    publicEnv: (0, import_viem3.bytesToHex)(release.publicEnv),
-    encryptedEnv: (0, import_viem3.bytesToHex)(release.encryptedEnv)
-  };
+  const release_ = releaseForViem(release, environmentConfig);
   const functionName = options.billTo === "app" ? "createAppWithIsolatedBilling" : "createApp";
   const createData = (0, import_viem3.encodeFunctionData)({
-    abi: AppController_default,
+    abi: appControllerAbiFor(environmentConfig),
     functionName,
-    args: [saltHex, releaseForViem]
+    args: [saltHex, release_]
   });
   const acceptAdminData = (0, import_viem3.encodeFunctionData)({
     abi: PermissionController_default,
@@ -4524,21 +6161,11 @@ async function prepareUpgradeBatch(options) {
     publicLogs,
     needsPermissionChange
   } = options;
-  const releaseForViem = {
-    rmsRelease: {
-      artifacts: release.rmsRelease.artifacts.map((artifact) => ({
-        digest: `0x${(0, import_viem3.bytesToHex)(artifact.digest).slice(2).padStart(64, "0")}`,
-        registry: artifact.registry
-      })),
-      upgradeByTime: release.rmsRelease.upgradeByTime
-    },
-    publicEnv: (0, import_viem3.bytesToHex)(release.publicEnv),
-    encryptedEnv: (0, import_viem3.bytesToHex)(release.encryptedEnv)
-  };
+  const release_ = releaseForViem(release, environmentConfig);
   const upgradeData = (0, import_viem3.encodeFunctionData)({
-    abi: AppController_default,
+    abi: appControllerAbiFor(environmentConfig),
     functionName: "upgradeApp",
-    args: [appID, releaseForViem]
+    args: [appID, release_]
   });
   const executions = [
     {
@@ -4672,7 +6299,7 @@ ${pendingMessage}`);
       if (callError.data) {
         try {
           const decoded = (0, import_viem3.decodeErrorResult)({
-            abi: AppController_default,
+            abi: appControllerAbiFor(environmentConfig),
             data: callError.data
           });
           const formattedError = formatAppControllerError(decoded);
@@ -4725,7 +6352,7 @@ function formatAppControllerError(decoded) {
 async function getActiveAppCount(publicClient, environmentConfig, user) {
   const count = await publicClient.readContract({
     address: environmentConfig.appControllerAddress,
-    abi: AppController_default,
+    abi: appControllerAbiFor(environmentConfig),
     functionName: "getActiveAppCount",
     args: [user]
   });
@@ -4734,7 +6361,7 @@ async function getActiveAppCount(publicClient, environmentConfig, user) {
 async function getMaxActiveAppsPerUser(publicClient, environmentConfig, user) {
   const quota = await publicClient.readContract({
     address: environmentConfig.appControllerAddress,
-    abi: AppController_default,
+    abi: appControllerAbiFor(environmentConfig),
     functionName: "getMaxActiveAppsPerUser",
     args: [user]
   });
@@ -4743,7 +6370,7 @@ async function getMaxActiveAppsPerUser(publicClient, environmentConfig, user) {
 async function getAppsByDeveloper(publicClient, environmentConfig, developer, offset, limit) {
   const result = await publicClient.readContract({
     address: environmentConfig.appControllerAddress,
-    abi: AppController_default,
+    abi: appControllerAbiFor(environmentConfig),
     functionName: "getAppsByDeveloper",
     args: [developer, offset, limit]
   });
@@ -4755,7 +6382,7 @@ async function getAppsByDeveloper(publicClient, environmentConfig, developer, of
 async function getBillingType(publicClient, environmentConfig, app) {
   const result = await publicClient.readContract({
     address: environmentConfig.appControllerAddress,
-    abi: AppController_default,
+    abi: appControllerAbiFor(environmentConfig),
     functionName: "getBillingType",
     args: [app]
   });
@@ -4764,7 +6391,7 @@ async function getBillingType(publicClient, environmentConfig, app) {
 async function getAppsByBillingAccount(publicClient, environmentConfig, account, offset, limit) {
   const result = await publicClient.readContract({
     address: environmentConfig.appControllerAddress,
-    abi: AppController_default,
+    abi: appControllerAbiFor(environmentConfig),
     functionName: "getAppsByBillingAccount",
     args: [account, offset, limit]
   });
@@ -4798,7 +6425,7 @@ async function getAppLatestReleaseBlockNumbers(publicClient, environmentConfig,
     appIDs.map(
       (appID) => publicClient.readContract({
         address: environmentConfig.appControllerAddress,
-        abi: AppController_default,
+        abi: appControllerAbiFor(environmentConfig),
         functionName: "getAppLatestReleaseBlockNumber",
         args: [appID]
       }).catch(() => null)
@@ -4877,12 +6504,41 @@ async function undelegate(options, logger = noopLogger) {
   return hash;
 }
 
+// src/client/common/gas/insufficientGas.ts
+var import_viem4 = require("viem");
+var InsufficientGasError = class extends Error {
+  constructor(args) {
+    const requiredEth = (0, import_viem4.formatEther)(args.requiredWei);
+    const availableEth = (0, import_viem4.formatEther)(args.availableWei);
+    super(
+      `Insufficient ETH for gas: wallet ${args.address} has ${availableEth} ETH but this transaction needs ~${requiredEth} ETH.
+Compute credits do not pay on-chain gas \u2014 fund the wallet with ETH and retry.`
+    );
+    this.name = "InsufficientGasError";
+    this.address = args.address;
+    this.requiredWei = args.requiredWei;
+    this.availableWei = args.availableWei;
+    this.requiredEth = requiredEth;
+    this.availableEth = availableEth;
+  }
+};
+async function assertSufficientGas(args) {
+  const availableWei = await args.publicClient.getBalance({ address: args.address });
+  if (availableWei < args.gasEstimate.maxCostWei) {
+    throw new InsufficientGasError({
+      address: args.address,
+      requiredWei: args.gasEstimate.maxCostWei,
+      availableWei
+    });
+  }
+}
+
 // src/client/common/utils/userapi.ts
 var import_axios2 = __toESM(require("axios"), 1);
 
 // src/client/common/utils/auth.ts
-var import_viem4 = require("viem");
-var APP_CONTROLLER_ABI = (0, import_viem4.parseAbi)([
+var import_viem5 = require("viem");
+var APP_CONTROLLER_ABI = (0, import_viem5.parseAbi)([
   "function calculateApiPermissionDigestHash(bytes4 permission, uint256 expiry) view returns (bytes32)"
 ]);
 async function calculatePermissionSignature(options) {
@@ -4940,6 +6596,7 @@ var import_axios = __toESM(require("axios"), 1);
 var MAX_RETRIES = 5;
 var INITIAL_BACKOFF_MS = 1e3;
 var MAX_BACKOFF_MS = 3e4;
+var RETRYABLE_STATUSES = /* @__PURE__ */ new Set([429, 502, 503, 504]);
 function sleep(ms) {
   return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
@@ -4959,7 +6616,7 @@ async function requestWithRetry(config) {
   for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
     const res = await (0, import_axios.default)({ ...config, validateStatus: () => true });
     lastResponse = res;
-    if (res.status !== 429) {
+    if (!RETRYABLE_STATUSES.has(res.status)) {
       return res;
     }
     if (attempt < MAX_RETRIES) {
@@ -4988,7 +6645,7 @@ var CanViewAppLogsPermission = "0x2fd3f2fe";
 var CanViewSensitiveAppInfoPermission = "0x0e67b22f";
 var CanUpdateAppProfilePermission = "0x036fef61";
 function getDefaultClientId() {
-  const version = true ? "1.0.0-dev.6" : "0.0.0";
+  const version = true ? "1.0.0-dev.8" : "0.0.0";
   return `ecloud-sdk/v${version}`;
 }
 var UserApiClient = class {
@@ -5326,8 +6983,36 @@ function transformAppRelease(raw) {
 
 // src/client/common/contract/watcher.ts
 var WATCH_POLL_INTERVAL_SECONDS = 5;
+var WATCH_HEARTBEAT_INTERVAL_SECONDS = 30;
+var WATCH_DEFAULT_TIMEOUT_SECONDS = 10 * 60;
 var APP_STATUS_RUNNING = "Running";
 var APP_STATUS_FAILED = "Failed";
+var WatchTimeoutError = class extends Error {
+  constructor(args) {
+    super(
+      args.message ?? `Timed out after ${args.elapsedSeconds}s waiting for app ${args.appId} (last status: ${args.lastStatus ?? "unknown"})`
+    );
+    this.name = "WatchTimeoutError";
+    this.appId = args.appId;
+    this.elapsedSeconds = args.elapsedSeconds;
+    this.lastStatus = args.lastStatus;
+    this.timeoutSeconds = args.timeoutSeconds;
+  }
+};
+function resolveWatchTimeoutSeconds(explicit) {
+  if (typeof explicit === "number" && Number.isFinite(explicit) && explicit > 0) {
+    return Math.floor(explicit);
+  }
+  const raw = process.env.ECLOUD_WATCH_TIMEOUT_SECONDS;
+  if (raw === void 0 || raw === "") {
+    return WATCH_DEFAULT_TIMEOUT_SECONDS;
+  }
+  const parsed = Number(raw);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    return WATCH_DEFAULT_TIMEOUT_SECONDS;
+  }
+  return Math.floor(parsed);
+}
 async function watchUntilRunning(options, logger) {
   const { walletClient, publicClient, environmentConfig, appId } = options;
   const userApiClient = new UserApiClient(environmentConfig, walletClient, publicClient);
@@ -5358,8 +7043,20 @@ async function watchUntilRunning(options, logger) {
     return false;
   };
   const startTime = Date.now();
+  const timeoutSeconds = resolveWatchTimeoutSeconds(options.timeoutSeconds);
   let lastLoggedStatus;
+  let lastHeartbeatAt = startTime;
   while (true) {
+    const elapsedMs = Date.now() - startTime;
+    const elapsed = Math.round(elapsedMs / 1e3);
+    if (elapsed >= timeoutSeconds) {
+      throw new WatchTimeoutError({
+        appId,
+        elapsedSeconds: elapsed,
+        lastStatus: lastLoggedStatus,
+        timeoutSeconds
+      });
+    }
     try {
       const info = await userApiClient.getInfos([appId], 1);
       if (info.length === 0) {
@@ -5369,16 +7066,22 @@ async function watchUntilRunning(options, logger) {
       const appInfo = info[0];
       const currentStatus = appInfo.status;
       const currentIP = appInfo.ip || "";
-      const elapsed = Math.round((Date.now() - startTime) / 1e3);
       if (currentStatus !== lastLoggedStatus) {
         logger.info(`Status: ${currentStatus} (${elapsed}s)`);
         lastLoggedStatus = currentStatus;
+        lastHeartbeatAt = Date.now();
+      } else if (Date.now() - lastHeartbeatAt >= WATCH_HEARTBEAT_INTERVAL_SECONDS * 1e3) {
+        logger.info(`Status: ${currentStatus} (${elapsed}s)`);
+        lastHeartbeatAt = Date.now();
       }
       if (stopCondition(currentStatus, currentIP)) {
         return currentIP || void 0;
       }
       await sleep2(WATCH_POLL_INTERVAL_SECONDS * 1e3);
     } catch (error) {
+      if (error instanceof WatchTimeoutError) {
+        throw error;
+      }
       logger.warn(`Failed to fetch app info: ${error.message}`);
       await sleep2(WATCH_POLL_INTERVAL_SECONDS * 1e3);
     }
@@ -5387,6 +7090,7 @@ async function watchUntilRunning(options, logger) {
 var APP_STATUS_STOPPED = "Stopped";
 async function watchUntilUpgradeComplete(options, logger) {
   const { walletClient, publicClient, environmentConfig, appId } = options;
+  const timeoutSeconds = resolveWatchTimeoutSeconds(options.timeoutSeconds);
   const userApiClient = new UserApiClient(environmentConfig, walletClient, publicClient);
   let initialStatus;
   let initialIP;
@@ -5424,7 +7128,20 @@ async function watchUntilUpgradeComplete(options, logger) {
     }
     return false;
   };
+  const startTime = Date.now();
+  const deadline = startTime + timeoutSeconds * 1e3;
+  let lastLoggedStatus;
+  let lastObservedStatus;
   while (true) {
+    if (Date.now() >= deadline) {
+      const elapsedSeconds = Math.round((Date.now() - startTime) / 1e3);
+      throw new WatchTimeoutError({
+        appId,
+        lastStatus: lastObservedStatus,
+        elapsedSeconds,
+        timeoutSeconds
+      });
+    }
     try {
       const info = await userApiClient.getInfos([appId], 1);
       if (info.length === 0) {
@@ -5434,11 +7151,23 @@ async function watchUntilUpgradeComplete(options, logger) {
       const appInfo = info[0];
       const currentStatus = appInfo.status;
       const currentIP = appInfo.ip || "";
+      lastObservedStatus = currentStatus;
+      const elapsed = Math.round((Date.now() - startTime) / 1e3);
+      if (currentStatus !== lastLoggedStatus) {
+        logger.info(`Status: ${currentStatus} (${elapsed}s)`);
+        lastLoggedStatus = currentStatus;
+      }
       if (stopCondition(currentStatus, currentIP)) {
         return;
       }
       await sleep2(WATCH_POLL_INTERVAL_SECONDS * 1e3);
     } catch (error) {
+      if (error instanceof WatchTimeoutError) {
+        throw error;
+      }
+      if (typeof error?.message === "string" && error.message.includes("Failed")) {
+        throw error;
+      }
       logger.warn(`Failed to fetch app info: ${error.message}`);
       await sleep2(WATCH_POLL_INTERVAL_SECONDS * 1e3);
     }
@@ -5451,7 +7180,7 @@ function sleep2(ms) {
 // src/client/common/utils/validation.ts
 var import_fs = __toESM(require("fs"), 1);
 var import_path = __toESM(require("path"), 1);
-var import_viem5 = require("viem");
+var import_viem6 = require("viem");
 function validateAppName(name) {
   if (!name) {
     throw new Error("App name cannot be empty");
@@ -5603,7 +7332,7 @@ function validateAppID(appID) {
     throw new Error("App ID is required");
   }
   const normalized = typeof appID === "string" ? addHexPrefix(appID) : appID;
-  if ((0, import_viem5.isAddress)(normalized)) {
+  if ((0, import_viem6.isAddress)(normalized)) {
     return normalized;
   }
   throw new Error(`Invalid app ID: '${appID}' is not a valid address`);
@@ -5772,6 +7501,8 @@ var ENVIRONMENTS = {
     name: "sepolia",
     build: "dev",
     appControllerAddress: "0xa86DC1C47cb2518327fB4f9A1627F51966c83B92",
+    releaseAbiVersion: "v1.5",
+    // AppController upgraded to v1.5.x (containerPolicy)
     permissionControllerAddress: ChainAddresses[SEPOLIA_CHAIN_ID].PermissionController,
     erc7702DelegatorAddress: CommonAddresses.ERC7702Delegator,
     kmsServerURL: "http://10.128.0.57:8080",
@@ -5785,6 +7516,8 @@ var ENVIRONMENTS = {
     name: "sepolia",
     build: "prod",
     appControllerAddress: "0x0dd810a6ffba6a9820a10d97b659f07d8d23d4E2",
+    releaseAbiVersion: "v1.4",
+    // prod still on AppController v1.4.0 (3-field Release)
     permissionControllerAddress: ChainAddresses[SEPOLIA_CHAIN_ID].PermissionController,
     erc7702DelegatorAddress: CommonAddresses.ERC7702Delegator,
     kmsServerURL: "http://10.128.15.203:8080",
@@ -5799,6 +7532,8 @@ var ENVIRONMENTS = {
     name: "mainnet-alpha",
     build: "prod",
     appControllerAddress: "0xc38d35Fc995e75342A21CBd6D770305b142Fbe67",
+    releaseAbiVersion: "v1.4",
+    // prod still on AppController v1.4.0 (3-field Release)
     permissionControllerAddress: ChainAddresses[MAINNET_CHAIN_ID].PermissionController,
     erc7702DelegatorAddress: CommonAddresses.ERC7702Delegator,
     kmsServerURL: "http://10.128.0.2:8080",
@@ -6653,6 +8388,11 @@ async function prepareDeployFromVerifiableBuild(options, logger = defaultLogger)
         executions: batch.executions,
         authorizationList
       });
+      await assertSufficientGas({
+        publicClient: batch.publicClient,
+        address: batch.walletClient.account.address,
+        gasEstimate
+      });
       const data = {
         appId: batch.appId,
         salt: batch.salt,
@@ -6911,6 +8651,11 @@ async function prepareDeploy(options, logger = defaultLogger) {
         executions: batch.executions,
         authorizationList
       });
+      await assertSufficientGas({
+        publicClient: batch.publicClient,
+        address: batch.walletClient.account.address,
+        gasEstimate
+      });
       const data = {
         appId: batch.appId,
         salt: batch.salt,
@@ -6947,7 +8692,7 @@ async function executeDeploy(options) {
     }
   );
 }
-async function watchDeployment(appId, walletClient, publicClient, environmentConfig, logger = defaultLogger, skipTelemetry) {
+async function watchDeployment(appId, walletClient, publicClient, environmentConfig, logger = defaultLogger, skipTelemetry, opts) {
   return withSDKTelemetry(
     {
       functionName: "watchDeployment",
@@ -6963,7 +8708,8 @@ async function watchDeployment(appId, walletClient, publicClient, environmentCon
           walletClient,
           publicClient,
           environmentConfig,
-          appId
+          appId,
+          timeoutSeconds: opts?.timeoutSeconds
         },
         logger
       );
@@ -7059,6 +8805,11 @@ async function prepareUpgradeFromVerifiableBuild(options, logger = defaultLogger
         executions: batch.executions,
         authorizationList
       });
+      await assertSufficientGas({
+        publicClient: batch.publicClient,
+        address: batch.walletClient.account.address,
+        gasEstimate
+      });
       const data = {
         appId: batch.appId,
         executions: batch.executions,
@@ -7248,6 +8999,11 @@ async function prepareUpgrade(options, logger = defaultLogger) {
         executions: batch.executions,
         authorizationList
       });
+      await assertSufficientGas({
+        publicClient: batch.publicClient,
+        address: batch.walletClient.account.address,
+        gasEstimate
+      });
       const data = {
         appId: batch.appId,
         executions: batch.executions,
@@ -7282,7 +9038,7 @@ async function executeUpgrade(options) {
     }
   );
 }
-async function watchUpgrade(appId, walletClient, publicClient, environmentConfig, logger = defaultLogger, skipTelemetry) {
+async function watchUpgrade(appId, walletClient, publicClient, environmentConfig, logger = defaultLogger, skipTelemetry, opts) {
   return withSDKTelemetry(
     {
       functionName: "watchUpgrade",
@@ -7298,7 +9054,8 @@ async function watchUpgrade(appId, walletClient, publicClient, environmentConfig
           walletClient,
           publicClient,
           environmentConfig,
-          appId
+          appId,
+          timeoutSeconds: opts?.timeoutSeconds
         },
         logger
       );
@@ -7956,27 +9713,27 @@ async function logs(options, walletClient, publicClient, environmentConfig, logg
 }
 
 // src/client/modules/compute/app/index.ts
-var CONTROLLER_ABI = (0, import_viem6.parseAbi)([
+var CONTROLLER_ABI = (0, import_viem7.parseAbi)([
   "function startApp(address appId)",
   "function stopApp(address appId)",
   "function terminateApp(address appId)"
 ]);
 function encodeStartAppData(appId) {
-  return (0, import_viem6.encodeFunctionData)({
+  return (0, import_viem7.encodeFunctionData)({
     abi: CONTROLLER_ABI,
     functionName: "startApp",
     args: [appId]
   });
 }
 function encodeStopAppData(appId) {
-  return (0, import_viem6.encodeFunctionData)({
+  return (0, import_viem7.encodeFunctionData)({
     abi: CONTROLLER_ABI,
     functionName: "stopApp",
     args: [appId]
   });
 }
 function encodeTerminateAppData(appId) {
-  return (0, import_viem6.encodeFunctionData)({
+  return (0, import_viem7.encodeFunctionData)({
     abi: CONTROLLER_ABI,
     functionName: "terminateApp",
     args: [appId]
@@ -7990,7 +9747,7 @@ function createAppModule(ctx) {
   }
   const account = walletClient.account;
   const environment = getEnvironmentConfig(ctx.environment);
-  const logger = getLogger(ctx.verbose);
+  const logger = ctx.logger ?? getLogger(ctx.verbose);
   return {
     async create(opts) {
       return createApp(opts, logger);
@@ -8102,14 +9859,15 @@ function createAppModule(ctx) {
         imageRef: result.imageRef
       };
     },
-    async watchDeployment(appId) {
+    async watchDeployment(appId, opts) {
       return watchDeployment(
         appId,
         walletClient,
         publicClient,
         environment,
         logger,
-        skipTelemetry
+        skipTelemetry,
+        opts
       );
     },
     // Granular upgrade control
@@ -8167,8 +9925,16 @@ function createAppModule(ctx) {
         imageRef: result.imageRef
       };
     },
-    async watchUpgrade(appId) {
-      return watchUpgrade(appId, walletClient, publicClient, environment, logger, skipTelemetry);
+    async watchUpgrade(appId, opts) {
+      return watchUpgrade(
+        appId,
+        walletClient,
+        publicClient,
+        environment,
+        logger,
+        skipTelemetry,
+        opts
+      );
     },
     // Profile management
     async setProfile(appId, profile) {
@@ -8219,7 +9985,7 @@ function createAppModule(ctx) {
         },
         async () => {
           const pendingMessage = `Starting app ${appId}...`;
-          const data = (0, import_viem6.encodeFunctionData)({
+          const data = (0, import_viem7.encodeFunctionData)({
             abi: CONTROLLER_ABI,
             functionName: "startApp",
             args: [appId]
@@ -8251,7 +10017,7 @@ function createAppModule(ctx) {
         },
         async () => {
           const pendingMessage = `Stopping app ${appId}...`;
-          const data = (0, import_viem6.encodeFunctionData)({
+          const data = (0, import_viem7.encodeFunctionData)({
             abi: CONTROLLER_ABI,
             functionName: "stopApp",
             args: [appId]
@@ -8283,7 +10049,7 @@ function createAppModule(ctx) {
         },
         async () => {
           const pendingMessage = `Terminating app ${appId}...`;
-          const data = (0, import_viem6.encodeFunctionData)({
+          const data = (0, import_viem7.encodeFunctionData)({
             abi: CONTROLLER_ABI,
             functionName: "terminateApp",
             args: [appId]
@@ -8350,7 +10116,7 @@ function createComputeModule(config) {
 }
 
 // src/client/modules/billing/index.ts
-var import_viem7 = require("viem");
+var import_viem8 = require("viem");
 
 // src/client/common/abis/USDCCredits.json
 var USDCCredits_default = [
@@ -8535,7 +10301,7 @@ function createBillingModule(config) {
             executions.push({
               target: usdcAddress,
               value: 0n,
-              callData: (0, import_viem7.encodeFunctionData)({
+              callData: (0, import_viem8.encodeFunctionData)({
                 abi: ERC20_default,
                 functionName: "approve",
                 args: [creditsAddress, opts.amount]
@@ -8545,7 +10311,7 @@ function createBillingModule(config) {
           executions.push({
             target: creditsAddress,
             value: 0n,
-            callData: (0, import_viem7.encodeFunctionData)({
+            callData: (0, import_viem8.encodeFunctionData)({
               abi: USDCCredits_default,
               functionName: "purchaseCreditsFor",
               args: [opts.amount, targetAccount]
@@ -9679,8 +11445,10 @@ var JwtProvider = class {
   BuildError,
   BuildFailedError,
   ConflictError,
+  EMPTY_CONTAINER_POLICY,
   ERC20ABI,
   ForbiddenError,
+  InsufficientGasError,
   JwtProvider,
   NoopClient,
   NotFoundError,
@@ -9690,9 +11458,12 @@ var JwtProvider = class {
   TimeoutError,
   USDCCreditsABI,
   UserApiClient,
+  WATCH_DEFAULT_TIMEOUT_SECONDS,
+  WatchTimeoutError,
   addHexPrefix,
   addMetric,
   addMetricWithDimensions,
+  assertSufficientGas,
   assertValidFilePath,
   assertValidImageReference,
   assertValidPrivateKey,