@layr-labs/ecloud-sdk 1.0.0-dev.7 → 1.0.0-dev.8

package/dist/index.cjs

@@ -174,6 +174,7 @@ __export(index_exports, {
   EMPTY_CONTAINER_POLICY: () => EMPTY_CONTAINER_POLICY,
   ERC20ABI: () => ERC20_default,
   ForbiddenError: () => ForbiddenError,
+  InsufficientGasError: () => InsufficientGasError,
   JwtProvider: () => JwtProvider,
   NoopClient: () => NoopClient,
   NotFoundError: () => NotFoundError,
@@ -183,9 +184,12 @@ __export(index_exports, {
   TimeoutError: () => TimeoutError,
   USDCCreditsABI: () => USDCCredits_default,
   UserApiClient: () => UserApiClient,
+  WATCH_DEFAULT_TIMEOUT_SECONDS: () => WATCH_DEFAULT_TIMEOUT_SECONDS,
+  WatchTimeoutError: () => WatchTimeoutError,
   addHexPrefix: () => addHexPrefix,
   addMetric: () => addMetric,
   addMetricWithDimensions: () => addMetricWithDimensions,
+  assertSufficientGas: () => assertSufficientGas,
   assertValidFilePath: () => assertValidFilePath,
   assertValidImageReference: () => assertValidImageReference,
   assertValidPrivateKey: () => assertValidPrivateKey,
@@ -287,7 +291,7 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 
 // src/client/modules/compute/app/index.ts
-var import_viem6 = require("viem");
+var import_viem7 = require("viem");
 
 // src/client/common/docker/build.ts
 var child_process = __toESM(require("child_process"), 1);
@@ -576,7 +580,74 @@ var PushPermissionError = class extends Error {
 var import_handlebars = __toESM(require("handlebars"), 1);
 
 // src/client/common/templates/Dockerfile.layered.tmpl
-var Dockerfile_layered_default = '{{#if includeTLS}}\n# Get Caddy from official image\nFROM caddy:2.10.2-alpine AS caddy\n{{/if}}\n\nFROM {{baseImage}}\n\n{{#if originalUser}}\n# Switch to root to perform setup (base image has non-root USER: {{originalUser}})\nUSER root\n{{/if}}\n\n# Copy core TEE components\nCOPY compute-source-env.sh /usr/local/bin/\nCOPY kms-client /usr/local/bin/\nCOPY kms-signing-public-key.pem /usr/local/bin/\n\n{{#if includeTLS}}\n# Copy Caddy from official image\nCOPY --from=caddy /usr/bin/caddy /usr/local/bin/caddy\n\n# Copy TLS components\nCOPY tls-keygen /usr/local/bin/\nCOPY Caddyfile /etc/caddy/\n{{/if}}\n\n{{#if originalUser}}\n# Make binaries executable (755 for executables, 644 for keys)\nRUN chmod 755 /usr/local/bin/compute-source-env.sh \\\n    && chmod 755 /usr/local/bin/kms-client{{#if includeTLS}} \\\n    && chmod 755 /usr/local/bin/tls-keygen \\\n    && chmod 755 /usr/local/bin/caddy{{/if}} \\\n    && chmod 644 /usr/local/bin/kms-signing-public-key.pem\n\n# Store original user - entrypoint will drop privileges to this user after TEE setup\nENV __ECLOUD_ORIGINAL_USER={{originalUser}}\n{{else}}\n# Make binaries executable (preserve existing permissions, just add execute)\nRUN chmod +x /usr/local/bin/compute-source-env.sh \\\n    && chmod +x /usr/local/bin/kms-client{{#if includeTLS}} \\\n    && chmod +x /usr/local/bin/tls-keygen{{/if}}\n{{/if}}\n\n{{#if logRedirect}}\n\nLABEL tee.launch_policy.log_redirect={{logRedirect}}\n{{/if}}\n{{#if resourceUsageAllow}}\n\nLABEL tee.launch_policy.monitoring_memory_allow={{resourceUsageAllow}}\n{{/if}}\n\nLABEL eigenx_cli_version={{ecloudCLIVersion}}\nLABEL eigenx_vm_image=eigen\n\n{{#if includeTLS}}\n# Expose both HTTP and HTTPS ports for Caddy\nEXPOSE 80 443\n{{/if}}\n\nENTRYPOINT ["/usr/local/bin/compute-source-env.sh"]\nCMD {{{originalCmd}}}\n';
+var Dockerfile_layered_default = `{{#if includeTLS}}
+# Get Caddy from official image
+FROM caddy:2.10.2-alpine AS caddy
+{{/if}}
+
+FROM {{baseImage}}
+
+{{#if originalUser}}
+# Switch to root to perform setup (base image has non-root USER: {{originalUser}})
+USER root
+{{/if}}
+
+# Copy core TEE components
+# CA bundle for kms-client / tls-keygen to validate HTTPS calls to
+# eigencloud.xyz endpoints. Bundled at a non-standard path and consumed
+# only via SSL_CERT_FILE in compute-source-env.sh, so the user's
+# /etc/ssl/ is never touched.
+COPY --from=alpine:3.20.10 /etc/ssl/certs/ca-certificates.crt /usr/local/share/eigenx-ca-certs.crt
+COPY compute-source-env.sh /usr/local/bin/
+COPY kms-client /usr/local/bin/
+COPY kms-signing-public-key.pem /usr/local/bin/
+
+{{#if includeTLS}}
+# Copy Caddy from official image
+COPY --from=caddy /usr/bin/caddy /usr/local/bin/caddy
+
+# Copy TLS components
+COPY tls-keygen /usr/local/bin/
+COPY Caddyfile /etc/caddy/
+{{/if}}
+
+{{#if originalUser}}
+# Make binaries executable (755 for executables, 644 for keys)
+RUN chmod 755 /usr/local/bin/compute-source-env.sh \\
+    && chmod 755 /usr/local/bin/kms-client{{#if includeTLS}} \\
+    && chmod 755 /usr/local/bin/tls-keygen \\
+    && chmod 755 /usr/local/bin/caddy{{/if}} \\
+    && chmod 644 /usr/local/bin/kms-signing-public-key.pem
+
+# Store original user - entrypoint will drop privileges to this user after TEE setup
+ENV __ECLOUD_ORIGINAL_USER={{originalUser}}
+{{else}}
+# Make binaries executable (preserve existing permissions, just add execute)
+RUN chmod +x /usr/local/bin/compute-source-env.sh \\
+    && chmod +x /usr/local/bin/kms-client{{#if includeTLS}} \\
+    && chmod +x /usr/local/bin/tls-keygen{{/if}}
+{{/if}}
+
+{{#if logRedirect}}
+
+LABEL tee.launch_policy.log_redirect={{logRedirect}}
+{{/if}}
+{{#if resourceUsageAllow}}
+
+LABEL tee.launch_policy.monitoring_memory_allow={{resourceUsageAllow}}
+{{/if}}
+
+LABEL eigenx_cli_version={{ecloudCLIVersion}}
+LABEL eigenx_vm_image=eigen
+
+{{#if includeTLS}}
+# Expose both HTTP and HTTPS ports for Caddy
+EXPOSE 80 443
+{{/if}}
+
+ENTRYPOINT ["/usr/local/bin/compute-source-env.sh"]
+CMD {{{originalCmd}}}
+`;
 
 // src/client/common/templates/dockerfileTemplate.ts
 function processDockerfileTemplate(data) {
@@ -593,7 +664,7 @@ echo "compute-source-env.sh: Running setup script..."
 
 # Fetch and source environment variables from KMS
 echo "Fetching secrets from KMS..."
-if /usr/local/bin/kms-client \\
+if SSL_CERT_FILE=/usr/local/share/eigenx-ca-certs.crt /usr/local/bin/kms-client \\
   --kms-server-url "{{kmsServerURL}}" \\
   --kms-signing-key-file /usr/local/bin/kms-signing-public-key.pem \\
   --userapi-url "{{userAPIURL}}" \\
@@ -651,7 +722,8 @@ setup_tls() {
     
     echo "compute-source-env.sh: Obtaining TLS certificate using $challenge challenge..."
     # Pass the API URL for certificate persistence
-    if ! MNEMONIC="$mnemonic" DOMAIN="$domain" API_URL="{{userAPIURL}}" /usr/local/bin/tls-keygen \\
+    if ! SSL_CERT_FILE=/usr/local/share/eigenx-ca-certs.crt \\
+       MNEMONIC="$mnemonic" DOMAIN="$domain" API_URL="{{userAPIURL}}" /usr/local/bin/tls-keygen \\
         -challenge "$challenge" \\
         $staging_flag; then
         echo "compute-source-env.sh: ERROR - Failed to obtain TLS certificate"
@@ -1044,16 +1116,7 @@ async function extractDigestFromSinglePlatform(manifest, imageRef) {
       architecture: inspectData[0].Architecture
     } : null;
     if (!config) {
-      if (manifest.config?.digest) {
-        const digest = hexStringToBytes32(manifest.config.digest);
-        const registry = extractRegistryName(imageRef);
-        return {
-          digest,
-          registry,
-          platform: DOCKER_PLATFORM
-        };
-      }
-      throw new Error(`Could not determine platform for ${imageRef}`);
+      throw createPlatformErrorMessage(imageRef, ["unknown (could not determine architecture)"]);
     }
     const platform2 = `${config.os}/${config.architecture}`;
     if (platform2 === DOCKER_PLATFORM) {
@@ -1125,14 +1188,11 @@ Image: ${imageRef}
 Found platform(s): ${platforms.join(", ")}
 Required platform: ${DOCKER_PLATFORM}
 
-To fix this issue:
-1. Manual fix:
-   a. Rebuild your image with the correct platform:
-      docker build --platform ${DOCKER_PLATFORM} -t ${imageRef} .
-   b. Push the rebuilt image to your remote registry:
-      docker push ${imageRef}
-
-2. Or use the SDK to build with the correct platform automatically.`;
+To fix, either:
+1. Rebuild the image for ${DOCKER_PLATFORM} and push it:
+     docker buildx build --platform ${DOCKER_PLATFORM} -t ${imageRef} --push .
+2. Or use a verifiable build (--verifiable --repo <repo> --commit <sha>), which
+   builds server-side and needs no local Docker.`;
   return new Error(errorMsg);
 }
 
@@ -1237,6 +1297,8 @@ async function prepareRelease(options, logger) {
     logger.info(`Waiting ${REGISTRY_PROPAGATION_WAIT_SECONDS} seconds for registry propagation...`);
     await new Promise((resolve2) => setTimeout(resolve2, REGISTRY_PROPAGATION_WAIT_SECONDS * 1e3));
   } else {
+    logger.info("Verifying image platform (linux/amd64)...");
+    await getImageDigestAndName(imageRef);
     logger.info("Checking if image needs layering...");
     finalImageRef = await layerRemoteImageIfNeeded(
       {
@@ -6442,12 +6504,41 @@ async function undelegate(options, logger = noopLogger) {
   return hash;
 }
 
+// src/client/common/gas/insufficientGas.ts
+var import_viem4 = require("viem");
+var InsufficientGasError = class extends Error {
+  constructor(args) {
+    const requiredEth = (0, import_viem4.formatEther)(args.requiredWei);
+    const availableEth = (0, import_viem4.formatEther)(args.availableWei);
+    super(
+      `Insufficient ETH for gas: wallet ${args.address} has ${availableEth} ETH but this transaction needs ~${requiredEth} ETH.
+Compute credits do not pay on-chain gas \u2014 fund the wallet with ETH and retry.`
+    );
+    this.name = "InsufficientGasError";
+    this.address = args.address;
+    this.requiredWei = args.requiredWei;
+    this.availableWei = args.availableWei;
+    this.requiredEth = requiredEth;
+    this.availableEth = availableEth;
+  }
+};
+async function assertSufficientGas(args) {
+  const availableWei = await args.publicClient.getBalance({ address: args.address });
+  if (availableWei < args.gasEstimate.maxCostWei) {
+    throw new InsufficientGasError({
+      address: args.address,
+      requiredWei: args.gasEstimate.maxCostWei,
+      availableWei
+    });
+  }
+}
+
 // src/client/common/utils/userapi.ts
 var import_axios2 = __toESM(require("axios"), 1);
 
 // src/client/common/utils/auth.ts
-var import_viem4 = require("viem");
-var APP_CONTROLLER_ABI = (0, import_viem4.parseAbi)([
+var import_viem5 = require("viem");
+var APP_CONTROLLER_ABI = (0, import_viem5.parseAbi)([
   "function calculateApiPermissionDigestHash(bytes4 permission, uint256 expiry) view returns (bytes32)"
 ]);
 async function calculatePermissionSignature(options) {
@@ -6505,6 +6596,7 @@ var import_axios = __toESM(require("axios"), 1);
 var MAX_RETRIES = 5;
 var INITIAL_BACKOFF_MS = 1e3;
 var MAX_BACKOFF_MS = 3e4;
+var RETRYABLE_STATUSES = /* @__PURE__ */ new Set([429, 502, 503, 504]);
 function sleep(ms) {
   return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
@@ -6524,7 +6616,7 @@ async function requestWithRetry(config) {
   for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
     const res = await (0, import_axios.default)({ ...config, validateStatus: () => true });
     lastResponse = res;
-    if (res.status !== 429) {
+    if (!RETRYABLE_STATUSES.has(res.status)) {
       return res;
     }
     if (attempt < MAX_RETRIES) {
@@ -6553,7 +6645,7 @@ var CanViewAppLogsPermission = "0x2fd3f2fe";
 var CanViewSensitiveAppInfoPermission = "0x0e67b22f";
 var CanUpdateAppProfilePermission = "0x036fef61";
 function getDefaultClientId() {
-  const version = true ? "1.0.0-dev.7" : "0.0.0";
+  const version = true ? "1.0.0-dev.8" : "0.0.0";
   return `ecloud-sdk/v${version}`;
 }
 var UserApiClient = class {
@@ -6891,8 +6983,36 @@ function transformAppRelease(raw) {
 
 // src/client/common/contract/watcher.ts
 var WATCH_POLL_INTERVAL_SECONDS = 5;
+var WATCH_HEARTBEAT_INTERVAL_SECONDS = 30;
+var WATCH_DEFAULT_TIMEOUT_SECONDS = 10 * 60;
 var APP_STATUS_RUNNING = "Running";
 var APP_STATUS_FAILED = "Failed";
+var WatchTimeoutError = class extends Error {
+  constructor(args) {
+    super(
+      args.message ?? `Timed out after ${args.elapsedSeconds}s waiting for app ${args.appId} (last status: ${args.lastStatus ?? "unknown"})`
+    );
+    this.name = "WatchTimeoutError";
+    this.appId = args.appId;
+    this.elapsedSeconds = args.elapsedSeconds;
+    this.lastStatus = args.lastStatus;
+    this.timeoutSeconds = args.timeoutSeconds;
+  }
+};
+function resolveWatchTimeoutSeconds(explicit) {
+  if (typeof explicit === "number" && Number.isFinite(explicit) && explicit > 0) {
+    return Math.floor(explicit);
+  }
+  const raw = process.env.ECLOUD_WATCH_TIMEOUT_SECONDS;
+  if (raw === void 0 || raw === "") {
+    return WATCH_DEFAULT_TIMEOUT_SECONDS;
+  }
+  const parsed = Number(raw);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    return WATCH_DEFAULT_TIMEOUT_SECONDS;
+  }
+  return Math.floor(parsed);
+}
 async function watchUntilRunning(options, logger) {
   const { walletClient, publicClient, environmentConfig, appId } = options;
   const userApiClient = new UserApiClient(environmentConfig, walletClient, publicClient);
@@ -6923,8 +7043,20 @@ async function watchUntilRunning(options, logger) {
     return false;
   };
   const startTime = Date.now();
+  const timeoutSeconds = resolveWatchTimeoutSeconds(options.timeoutSeconds);
   let lastLoggedStatus;
+  let lastHeartbeatAt = startTime;
   while (true) {
+    const elapsedMs = Date.now() - startTime;
+    const elapsed = Math.round(elapsedMs / 1e3);
+    if (elapsed >= timeoutSeconds) {
+      throw new WatchTimeoutError({
+        appId,
+        elapsedSeconds: elapsed,
+        lastStatus: lastLoggedStatus,
+        timeoutSeconds
+      });
+    }
     try {
       const info = await userApiClient.getInfos([appId], 1);
       if (info.length === 0) {
@@ -6934,16 +7066,22 @@ async function watchUntilRunning(options, logger) {
       const appInfo = info[0];
       const currentStatus = appInfo.status;
       const currentIP = appInfo.ip || "";
-      const elapsed = Math.round((Date.now() - startTime) / 1e3);
       if (currentStatus !== lastLoggedStatus) {
         logger.info(`Status: ${currentStatus} (${elapsed}s)`);
         lastLoggedStatus = currentStatus;
+        lastHeartbeatAt = Date.now();
+      } else if (Date.now() - lastHeartbeatAt >= WATCH_HEARTBEAT_INTERVAL_SECONDS * 1e3) {
+        logger.info(`Status: ${currentStatus} (${elapsed}s)`);
+        lastHeartbeatAt = Date.now();
       }
       if (stopCondition(currentStatus, currentIP)) {
         return currentIP || void 0;
       }
       await sleep2(WATCH_POLL_INTERVAL_SECONDS * 1e3);
     } catch (error) {
+      if (error instanceof WatchTimeoutError) {
+        throw error;
+      }
       logger.warn(`Failed to fetch app info: ${error.message}`);
       await sleep2(WATCH_POLL_INTERVAL_SECONDS * 1e3);
     }
@@ -6952,6 +7090,7 @@ async function watchUntilRunning(options, logger) {
 var APP_STATUS_STOPPED = "Stopped";
 async function watchUntilUpgradeComplete(options, logger) {
   const { walletClient, publicClient, environmentConfig, appId } = options;
+  const timeoutSeconds = resolveWatchTimeoutSeconds(options.timeoutSeconds);
   const userApiClient = new UserApiClient(environmentConfig, walletClient, publicClient);
   let initialStatus;
   let initialIP;
@@ -6989,7 +7128,20 @@ async function watchUntilUpgradeComplete(options, logger) {
     }
     return false;
   };
+  const startTime = Date.now();
+  const deadline = startTime + timeoutSeconds * 1e3;
+  let lastLoggedStatus;
+  let lastObservedStatus;
   while (true) {
+    if (Date.now() >= deadline) {
+      const elapsedSeconds = Math.round((Date.now() - startTime) / 1e3);
+      throw new WatchTimeoutError({
+        appId,
+        lastStatus: lastObservedStatus,
+        elapsedSeconds,
+        timeoutSeconds
+      });
+    }
     try {
       const info = await userApiClient.getInfos([appId], 1);
       if (info.length === 0) {
@@ -6999,11 +7151,23 @@ async function watchUntilUpgradeComplete(options, logger) {
       const appInfo = info[0];
       const currentStatus = appInfo.status;
       const currentIP = appInfo.ip || "";
+      lastObservedStatus = currentStatus;
+      const elapsed = Math.round((Date.now() - startTime) / 1e3);
+      if (currentStatus !== lastLoggedStatus) {
+        logger.info(`Status: ${currentStatus} (${elapsed}s)`);
+        lastLoggedStatus = currentStatus;
+      }
       if (stopCondition(currentStatus, currentIP)) {
         return;
       }
       await sleep2(WATCH_POLL_INTERVAL_SECONDS * 1e3);
     } catch (error) {
+      if (error instanceof WatchTimeoutError) {
+        throw error;
+      }
+      if (typeof error?.message === "string" && error.message.includes("Failed")) {
+        throw error;
+      }
       logger.warn(`Failed to fetch app info: ${error.message}`);
       await sleep2(WATCH_POLL_INTERVAL_SECONDS * 1e3);
     }
@@ -7016,7 +7180,7 @@ function sleep2(ms) {
 // src/client/common/utils/validation.ts
 var import_fs = __toESM(require("fs"), 1);
 var import_path = __toESM(require("path"), 1);
-var import_viem5 = require("viem");
+var import_viem6 = require("viem");
 function validateAppName(name) {
   if (!name) {
     throw new Error("App name cannot be empty");
@@ -7168,7 +7332,7 @@ function validateAppID(appID) {
     throw new Error("App ID is required");
   }
   const normalized = typeof appID === "string" ? addHexPrefix(appID) : appID;
-  if ((0, import_viem5.isAddress)(normalized)) {
+  if ((0, import_viem6.isAddress)(normalized)) {
     return normalized;
   }
   throw new Error(`Invalid app ID: '${appID}' is not a valid address`);
@@ -8224,6 +8388,11 @@ async function prepareDeployFromVerifiableBuild(options, logger = defaultLogger)
         executions: batch.executions,
         authorizationList
       });
+      await assertSufficientGas({
+        publicClient: batch.publicClient,
+        address: batch.walletClient.account.address,
+        gasEstimate
+      });
       const data = {
         appId: batch.appId,
         salt: batch.salt,
@@ -8482,6 +8651,11 @@ async function prepareDeploy(options, logger = defaultLogger) {
         executions: batch.executions,
         authorizationList
       });
+      await assertSufficientGas({
+        publicClient: batch.publicClient,
+        address: batch.walletClient.account.address,
+        gasEstimate
+      });
       const data = {
         appId: batch.appId,
         salt: batch.salt,
@@ -8518,7 +8692,7 @@ async function executeDeploy(options) {
     }
   );
 }
-async function watchDeployment(appId, walletClient, publicClient, environmentConfig, logger = defaultLogger, skipTelemetry) {
+async function watchDeployment(appId, walletClient, publicClient, environmentConfig, logger = defaultLogger, skipTelemetry, opts) {
   return withSDKTelemetry(
     {
       functionName: "watchDeployment",
@@ -8534,7 +8708,8 @@ async function watchDeployment(appId, walletClient, publicClient, environmentCon
           walletClient,
           publicClient,
           environmentConfig,
-          appId
+          appId,
+          timeoutSeconds: opts?.timeoutSeconds
         },
         logger
       );
@@ -8630,6 +8805,11 @@ async function prepareUpgradeFromVerifiableBuild(options, logger = defaultLogger
         executions: batch.executions,
         authorizationList
       });
+      await assertSufficientGas({
+        publicClient: batch.publicClient,
+        address: batch.walletClient.account.address,
+        gasEstimate
+      });
       const data = {
         appId: batch.appId,
         executions: batch.executions,
@@ -8819,6 +8999,11 @@ async function prepareUpgrade(options, logger = defaultLogger) {
         executions: batch.executions,
         authorizationList
       });
+      await assertSufficientGas({
+        publicClient: batch.publicClient,
+        address: batch.walletClient.account.address,
+        gasEstimate
+      });
       const data = {
         appId: batch.appId,
         executions: batch.executions,
@@ -8853,7 +9038,7 @@ async function executeUpgrade(options) {
     }
   );
 }
-async function watchUpgrade(appId, walletClient, publicClient, environmentConfig, logger = defaultLogger, skipTelemetry) {
+async function watchUpgrade(appId, walletClient, publicClient, environmentConfig, logger = defaultLogger, skipTelemetry, opts) {
   return withSDKTelemetry(
     {
       functionName: "watchUpgrade",
@@ -8869,7 +9054,8 @@ async function watchUpgrade(appId, walletClient, publicClient, environmentConfig
           walletClient,
           publicClient,
           environmentConfig,
-          appId
+          appId,
+          timeoutSeconds: opts?.timeoutSeconds
         },
         logger
       );
@@ -9527,27 +9713,27 @@ async function logs(options, walletClient, publicClient, environmentConfig, logg
 }
 
 // src/client/modules/compute/app/index.ts
-var CONTROLLER_ABI = (0, import_viem6.parseAbi)([
+var CONTROLLER_ABI = (0, import_viem7.parseAbi)([
   "function startApp(address appId)",
   "function stopApp(address appId)",
   "function terminateApp(address appId)"
 ]);
 function encodeStartAppData(appId) {
-  return (0, import_viem6.encodeFunctionData)({
+  return (0, import_viem7.encodeFunctionData)({
     abi: CONTROLLER_ABI,
     functionName: "startApp",
     args: [appId]
   });
 }
 function encodeStopAppData(appId) {
-  return (0, import_viem6.encodeFunctionData)({
+  return (0, import_viem7.encodeFunctionData)({
     abi: CONTROLLER_ABI,
     functionName: "stopApp",
     args: [appId]
   });
 }
 function encodeTerminateAppData(appId) {
-  return (0, import_viem6.encodeFunctionData)({
+  return (0, import_viem7.encodeFunctionData)({
     abi: CONTROLLER_ABI,
     functionName: "terminateApp",
     args: [appId]
@@ -9561,7 +9747,7 @@ function createAppModule(ctx) {
   }
   const account = walletClient.account;
   const environment = getEnvironmentConfig(ctx.environment);
-  const logger = getLogger(ctx.verbose);
+  const logger = ctx.logger ?? getLogger(ctx.verbose);
   return {
     async create(opts) {
       return createApp(opts, logger);
@@ -9673,14 +9859,15 @@ function createAppModule(ctx) {
         imageRef: result.imageRef
       };
     },
-    async watchDeployment(appId) {
+    async watchDeployment(appId, opts) {
       return watchDeployment(
         appId,
         walletClient,
         publicClient,
         environment,
         logger,
-        skipTelemetry
+        skipTelemetry,
+        opts
       );
     },
     // Granular upgrade control
@@ -9738,8 +9925,16 @@ function createAppModule(ctx) {
         imageRef: result.imageRef
       };
     },
-    async watchUpgrade(appId) {
-      return watchUpgrade(appId, walletClient, publicClient, environment, logger, skipTelemetry);
+    async watchUpgrade(appId, opts) {
+      return watchUpgrade(
+        appId,
+        walletClient,
+        publicClient,
+        environment,
+        logger,
+        skipTelemetry,
+        opts
+      );
     },
     // Profile management
     async setProfile(appId, profile) {
@@ -9790,7 +9985,7 @@ function createAppModule(ctx) {
         },
         async () => {
           const pendingMessage = `Starting app ${appId}...`;
-          const data = (0, import_viem6.encodeFunctionData)({
+          const data = (0, import_viem7.encodeFunctionData)({
             abi: CONTROLLER_ABI,
             functionName: "startApp",
             args: [appId]
@@ -9822,7 +10017,7 @@ function createAppModule(ctx) {
         },
         async () => {
           const pendingMessage = `Stopping app ${appId}...`;
-          const data = (0, import_viem6.encodeFunctionData)({
+          const data = (0, import_viem7.encodeFunctionData)({
             abi: CONTROLLER_ABI,
             functionName: "stopApp",
             args: [appId]
@@ -9854,7 +10049,7 @@ function createAppModule(ctx) {
         },
         async () => {
           const pendingMessage = `Terminating app ${appId}...`;
-          const data = (0, import_viem6.encodeFunctionData)({
+          const data = (0, import_viem7.encodeFunctionData)({
             abi: CONTROLLER_ABI,
             functionName: "terminateApp",
             args: [appId]
@@ -9921,7 +10116,7 @@ function createComputeModule(config) {
 }
 
 // src/client/modules/billing/index.ts
-var import_viem7 = require("viem");
+var import_viem8 = require("viem");
 
 // src/client/common/abis/USDCCredits.json
 var USDCCredits_default = [
@@ -10106,7 +10301,7 @@ function createBillingModule(config) {
             executions.push({
               target: usdcAddress,
               value: 0n,
-              callData: (0, import_viem7.encodeFunctionData)({
+              callData: (0, import_viem8.encodeFunctionData)({
                 abi: ERC20_default,
                 functionName: "approve",
                 args: [creditsAddress, opts.amount]
@@ -10116,7 +10311,7 @@ function createBillingModule(config) {
           executions.push({
             target: creditsAddress,
             value: 0n,
-            callData: (0, import_viem7.encodeFunctionData)({
+            callData: (0, import_viem8.encodeFunctionData)({
               abi: USDCCredits_default,
               functionName: "purchaseCreditsFor",
               args: [opts.amount, targetAccount]
@@ -11253,6 +11448,7 @@ var JwtProvider = class {
   EMPTY_CONTAINER_POLICY,
   ERC20ABI,
   ForbiddenError,
+  InsufficientGasError,
   JwtProvider,
   NoopClient,
   NotFoundError,
@@ -11262,9 +11458,12 @@ var JwtProvider = class {
   TimeoutError,
   USDCCreditsABI,
   UserApiClient,
+  WATCH_DEFAULT_TIMEOUT_SECONDS,
+  WatchTimeoutError,
   addHexPrefix,
   addMetric,
   addMetricWithDimensions,
+  assertSufficientGas,
   assertValidFilePath,
   assertValidImageReference,
   assertValidPrivateKey,