@layr-labs/ecloud-sdk 1.0.0-dev.7 → 1.0.0-dev.8

package/dist/index.js

@@ -425,7 +425,74 @@ var PushPermissionError = class extends Error {
 import Handlebars from "handlebars";
 
 // src/client/common/templates/Dockerfile.layered.tmpl
-var Dockerfile_layered_default = '{{#if includeTLS}}\n# Get Caddy from official image\nFROM caddy:2.10.2-alpine AS caddy\n{{/if}}\n\nFROM {{baseImage}}\n\n{{#if originalUser}}\n# Switch to root to perform setup (base image has non-root USER: {{originalUser}})\nUSER root\n{{/if}}\n\n# Copy core TEE components\nCOPY compute-source-env.sh /usr/local/bin/\nCOPY kms-client /usr/local/bin/\nCOPY kms-signing-public-key.pem /usr/local/bin/\n\n{{#if includeTLS}}\n# Copy Caddy from official image\nCOPY --from=caddy /usr/bin/caddy /usr/local/bin/caddy\n\n# Copy TLS components\nCOPY tls-keygen /usr/local/bin/\nCOPY Caddyfile /etc/caddy/\n{{/if}}\n\n{{#if originalUser}}\n# Make binaries executable (755 for executables, 644 for keys)\nRUN chmod 755 /usr/local/bin/compute-source-env.sh \\\n    && chmod 755 /usr/local/bin/kms-client{{#if includeTLS}} \\\n    && chmod 755 /usr/local/bin/tls-keygen \\\n    && chmod 755 /usr/local/bin/caddy{{/if}} \\\n    && chmod 644 /usr/local/bin/kms-signing-public-key.pem\n\n# Store original user - entrypoint will drop privileges to this user after TEE setup\nENV __ECLOUD_ORIGINAL_USER={{originalUser}}\n{{else}}\n# Make binaries executable (preserve existing permissions, just add execute)\nRUN chmod +x /usr/local/bin/compute-source-env.sh \\\n    && chmod +x /usr/local/bin/kms-client{{#if includeTLS}} \\\n    && chmod +x /usr/local/bin/tls-keygen{{/if}}\n{{/if}}\n\n{{#if logRedirect}}\n\nLABEL tee.launch_policy.log_redirect={{logRedirect}}\n{{/if}}\n{{#if resourceUsageAllow}}\n\nLABEL tee.launch_policy.monitoring_memory_allow={{resourceUsageAllow}}\n{{/if}}\n\nLABEL eigenx_cli_version={{ecloudCLIVersion}}\nLABEL eigenx_vm_image=eigen\n\n{{#if includeTLS}}\n# Expose both HTTP and HTTPS ports for Caddy\nEXPOSE 80 443\n{{/if}}\n\nENTRYPOINT ["/usr/local/bin/compute-source-env.sh"]\nCMD {{{originalCmd}}}\n';
+var Dockerfile_layered_default = `{{#if includeTLS}}
+# Get Caddy from official image
+FROM caddy:2.10.2-alpine AS caddy
+{{/if}}
+
+FROM {{baseImage}}
+
+{{#if originalUser}}
+# Switch to root to perform setup (base image has non-root USER: {{originalUser}})
+USER root
+{{/if}}
+
+# Copy core TEE components
+# CA bundle for kms-client / tls-keygen to validate HTTPS calls to
+# eigencloud.xyz endpoints. Bundled at a non-standard path and consumed
+# only via SSL_CERT_FILE in compute-source-env.sh, so the user's
+# /etc/ssl/ is never touched.
+COPY --from=alpine:3.20.10 /etc/ssl/certs/ca-certificates.crt /usr/local/share/eigenx-ca-certs.crt
+COPY compute-source-env.sh /usr/local/bin/
+COPY kms-client /usr/local/bin/
+COPY kms-signing-public-key.pem /usr/local/bin/
+
+{{#if includeTLS}}
+# Copy Caddy from official image
+COPY --from=caddy /usr/bin/caddy /usr/local/bin/caddy
+
+# Copy TLS components
+COPY tls-keygen /usr/local/bin/
+COPY Caddyfile /etc/caddy/
+{{/if}}
+
+{{#if originalUser}}
+# Make binaries executable (755 for executables, 644 for keys)
+RUN chmod 755 /usr/local/bin/compute-source-env.sh \\
+    && chmod 755 /usr/local/bin/kms-client{{#if includeTLS}} \\
+    && chmod 755 /usr/local/bin/tls-keygen \\
+    && chmod 755 /usr/local/bin/caddy{{/if}} \\
+    && chmod 644 /usr/local/bin/kms-signing-public-key.pem
+
+# Store original user - entrypoint will drop privileges to this user after TEE setup
+ENV __ECLOUD_ORIGINAL_USER={{originalUser}}
+{{else}}
+# Make binaries executable (preserve existing permissions, just add execute)
+RUN chmod +x /usr/local/bin/compute-source-env.sh \\
+    && chmod +x /usr/local/bin/kms-client{{#if includeTLS}} \\
+    && chmod +x /usr/local/bin/tls-keygen{{/if}}
+{{/if}}
+
+{{#if logRedirect}}
+
+LABEL tee.launch_policy.log_redirect={{logRedirect}}
+{{/if}}
+{{#if resourceUsageAllow}}
+
+LABEL tee.launch_policy.monitoring_memory_allow={{resourceUsageAllow}}
+{{/if}}
+
+LABEL eigenx_cli_version={{ecloudCLIVersion}}
+LABEL eigenx_vm_image=eigen
+
+{{#if includeTLS}}
+# Expose both HTTP and HTTPS ports for Caddy
+EXPOSE 80 443
+{{/if}}
+
+ENTRYPOINT ["/usr/local/bin/compute-source-env.sh"]
+CMD {{{originalCmd}}}
+`;
 
 // src/client/common/templates/dockerfileTemplate.ts
 function processDockerfileTemplate(data) {
@@ -442,7 +509,7 @@ echo "compute-source-env.sh: Running setup script..."
 
 # Fetch and source environment variables from KMS
 echo "Fetching secrets from KMS..."
-if /usr/local/bin/kms-client \\
+if SSL_CERT_FILE=/usr/local/share/eigenx-ca-certs.crt /usr/local/bin/kms-client \\
   --kms-server-url "{{kmsServerURL}}" \\
   --kms-signing-key-file /usr/local/bin/kms-signing-public-key.pem \\
   --userapi-url "{{userAPIURL}}" \\
@@ -500,7 +567,8 @@ setup_tls() {
     
     echo "compute-source-env.sh: Obtaining TLS certificate using $challenge challenge..."
     # Pass the API URL for certificate persistence
-    if ! MNEMONIC="$mnemonic" DOMAIN="$domain" API_URL="{{userAPIURL}}" /usr/local/bin/tls-keygen \\
+    if ! SSL_CERT_FILE=/usr/local/share/eigenx-ca-certs.crt \\
+       MNEMONIC="$mnemonic" DOMAIN="$domain" API_URL="{{userAPIURL}}" /usr/local/bin/tls-keygen \\
         -challenge "$challenge" \\
         $staging_flag; then
         echo "compute-source-env.sh: ERROR - Failed to obtain TLS certificate"
@@ -892,16 +960,7 @@ async function extractDigestFromSinglePlatform(manifest, imageRef) {
       architecture: inspectData[0].Architecture
     } : null;
     if (!config) {
-      if (manifest.config?.digest) {
-        const digest = hexStringToBytes32(manifest.config.digest);
-        const registry = extractRegistryName(imageRef);
-        return {
-          digest,
-          registry,
-          platform: DOCKER_PLATFORM
-        };
-      }
-      throw new Error(`Could not determine platform for ${imageRef}`);
+      throw createPlatformErrorMessage(imageRef, ["unknown (could not determine architecture)"]);
     }
     const platform2 = `${config.os}/${config.architecture}`;
     if (platform2 === DOCKER_PLATFORM) {
@@ -973,14 +1032,11 @@ Image: ${imageRef}
 Found platform(s): ${platforms.join(", ")}
 Required platform: ${DOCKER_PLATFORM}
 
-To fix this issue:
-1. Manual fix:
-   a. Rebuild your image with the correct platform:
-      docker build --platform ${DOCKER_PLATFORM} -t ${imageRef} .
-   b. Push the rebuilt image to your remote registry:
-      docker push ${imageRef}
-
-2. Or use the SDK to build with the correct platform automatically.`;
+To fix, either:
+1. Rebuild the image for ${DOCKER_PLATFORM} and push it:
+     docker buildx build --platform ${DOCKER_PLATFORM} -t ${imageRef} --push .
+2. Or use a verifiable build (--verifiable --repo <repo> --commit <sha>), which
+   builds server-side and needs no local Docker.`;
   return new Error(errorMsg);
 }
 
@@ -1085,6 +1141,8 @@ async function prepareRelease(options, logger) {
     logger.info(`Waiting ${REGISTRY_PROPAGATION_WAIT_SECONDS} seconds for registry propagation...`);
     await new Promise((resolve2) => setTimeout(resolve2, REGISTRY_PROPAGATION_WAIT_SECONDS * 1e3));
   } else {
+    logger.info("Verifying image platform (linux/amd64)...");
+    await getImageDigestAndName(imageRef);
     logger.info("Checking if image needs layering...");
     finalImageRef = await layerRemoteImageIfNeeded(
       {
@@ -6290,6 +6348,35 @@ async function undelegate(options, logger = noopLogger) {
   return hash;
 }
 
+// src/client/common/gas/insufficientGas.ts
+import { formatEther } from "viem";
+var InsufficientGasError = class extends Error {
+  constructor(args) {
+    const requiredEth = formatEther(args.requiredWei);
+    const availableEth = formatEther(args.availableWei);
+    super(
+      `Insufficient ETH for gas: wallet ${args.address} has ${availableEth} ETH but this transaction needs ~${requiredEth} ETH.
+Compute credits do not pay on-chain gas \u2014 fund the wallet with ETH and retry.`
+    );
+    this.name = "InsufficientGasError";
+    this.address = args.address;
+    this.requiredWei = args.requiredWei;
+    this.availableWei = args.availableWei;
+    this.requiredEth = requiredEth;
+    this.availableEth = availableEth;
+  }
+};
+async function assertSufficientGas(args) {
+  const availableWei = await args.publicClient.getBalance({ address: args.address });
+  if (availableWei < args.gasEstimate.maxCostWei) {
+    throw new InsufficientGasError({
+      address: args.address,
+      requiredWei: args.gasEstimate.maxCostWei,
+      availableWei
+    });
+  }
+}
+
 // src/client/common/utils/userapi.ts
 import axios2 from "axios";
 
@@ -6353,6 +6440,7 @@ import axios from "axios";
 var MAX_RETRIES = 5;
 var INITIAL_BACKOFF_MS = 1e3;
 var MAX_BACKOFF_MS = 3e4;
+var RETRYABLE_STATUSES = /* @__PURE__ */ new Set([429, 502, 503, 504]);
 function sleep(ms) {
   return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
@@ -6372,7 +6460,7 @@ async function requestWithRetry(config) {
   for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
     const res = await axios({ ...config, validateStatus: () => true });
     lastResponse = res;
-    if (res.status !== 429) {
+    if (!RETRYABLE_STATUSES.has(res.status)) {
       return res;
     }
     if (attempt < MAX_RETRIES) {
@@ -6401,7 +6489,7 @@ var CanViewAppLogsPermission = "0x2fd3f2fe";
 var CanViewSensitiveAppInfoPermission = "0x0e67b22f";
 var CanUpdateAppProfilePermission = "0x036fef61";
 function getDefaultClientId() {
-  const version = true ? "1.0.0-dev.7" : "0.0.0";
+  const version = true ? "1.0.0-dev.8" : "0.0.0";
   return `ecloud-sdk/v${version}`;
 }
 var UserApiClient = class {
@@ -6739,8 +6827,36 @@ function transformAppRelease(raw) {
 
 // src/client/common/contract/watcher.ts
 var WATCH_POLL_INTERVAL_SECONDS = 5;
+var WATCH_HEARTBEAT_INTERVAL_SECONDS = 30;
+var WATCH_DEFAULT_TIMEOUT_SECONDS = 10 * 60;
 var APP_STATUS_RUNNING = "Running";
 var APP_STATUS_FAILED = "Failed";
+var WatchTimeoutError = class extends Error {
+  constructor(args) {
+    super(
+      args.message ?? `Timed out after ${args.elapsedSeconds}s waiting for app ${args.appId} (last status: ${args.lastStatus ?? "unknown"})`
+    );
+    this.name = "WatchTimeoutError";
+    this.appId = args.appId;
+    this.elapsedSeconds = args.elapsedSeconds;
+    this.lastStatus = args.lastStatus;
+    this.timeoutSeconds = args.timeoutSeconds;
+  }
+};
+function resolveWatchTimeoutSeconds(explicit) {
+  if (typeof explicit === "number" && Number.isFinite(explicit) && explicit > 0) {
+    return Math.floor(explicit);
+  }
+  const raw = process.env.ECLOUD_WATCH_TIMEOUT_SECONDS;
+  if (raw === void 0 || raw === "") {
+    return WATCH_DEFAULT_TIMEOUT_SECONDS;
+  }
+  const parsed = Number(raw);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    return WATCH_DEFAULT_TIMEOUT_SECONDS;
+  }
+  return Math.floor(parsed);
+}
 async function watchUntilRunning(options, logger) {
   const { walletClient, publicClient, environmentConfig, appId } = options;
   const userApiClient = new UserApiClient(environmentConfig, walletClient, publicClient);
@@ -6771,8 +6887,20 @@ async function watchUntilRunning(options, logger) {
     return false;
   };
   const startTime = Date.now();
+  const timeoutSeconds = resolveWatchTimeoutSeconds(options.timeoutSeconds);
   let lastLoggedStatus;
+  let lastHeartbeatAt = startTime;
   while (true) {
+    const elapsedMs = Date.now() - startTime;
+    const elapsed = Math.round(elapsedMs / 1e3);
+    if (elapsed >= timeoutSeconds) {
+      throw new WatchTimeoutError({
+        appId,
+        elapsedSeconds: elapsed,
+        lastStatus: lastLoggedStatus,
+        timeoutSeconds
+      });
+    }
     try {
       const info = await userApiClient.getInfos([appId], 1);
       if (info.length === 0) {
@@ -6782,16 +6910,22 @@ async function watchUntilRunning(options, logger) {
       const appInfo = info[0];
       const currentStatus = appInfo.status;
       const currentIP = appInfo.ip || "";
-      const elapsed = Math.round((Date.now() - startTime) / 1e3);
       if (currentStatus !== lastLoggedStatus) {
         logger.info(`Status: ${currentStatus} (${elapsed}s)`);
         lastLoggedStatus = currentStatus;
+        lastHeartbeatAt = Date.now();
+      } else if (Date.now() - lastHeartbeatAt >= WATCH_HEARTBEAT_INTERVAL_SECONDS * 1e3) {
+        logger.info(`Status: ${currentStatus} (${elapsed}s)`);
+        lastHeartbeatAt = Date.now();
       }
       if (stopCondition(currentStatus, currentIP)) {
         return currentIP || void 0;
       }
       await sleep2(WATCH_POLL_INTERVAL_SECONDS * 1e3);
     } catch (error) {
+      if (error instanceof WatchTimeoutError) {
+        throw error;
+      }
       logger.warn(`Failed to fetch app info: ${error.message}`);
       await sleep2(WATCH_POLL_INTERVAL_SECONDS * 1e3);
     }
@@ -6800,6 +6934,7 @@ async function watchUntilRunning(options, logger) {
 var APP_STATUS_STOPPED = "Stopped";
 async function watchUntilUpgradeComplete(options, logger) {
   const { walletClient, publicClient, environmentConfig, appId } = options;
+  const timeoutSeconds = resolveWatchTimeoutSeconds(options.timeoutSeconds);
   const userApiClient = new UserApiClient(environmentConfig, walletClient, publicClient);
   let initialStatus;
   let initialIP;
@@ -6837,7 +6972,20 @@ async function watchUntilUpgradeComplete(options, logger) {
     }
     return false;
   };
+  const startTime = Date.now();
+  const deadline = startTime + timeoutSeconds * 1e3;
+  let lastLoggedStatus;
+  let lastObservedStatus;
   while (true) {
+    if (Date.now() >= deadline) {
+      const elapsedSeconds = Math.round((Date.now() - startTime) / 1e3);
+      throw new WatchTimeoutError({
+        appId,
+        lastStatus: lastObservedStatus,
+        elapsedSeconds,
+        timeoutSeconds
+      });
+    }
     try {
       const info = await userApiClient.getInfos([appId], 1);
       if (info.length === 0) {
@@ -6847,11 +6995,23 @@ async function watchUntilUpgradeComplete(options, logger) {
       const appInfo = info[0];
       const currentStatus = appInfo.status;
       const currentIP = appInfo.ip || "";
+      lastObservedStatus = currentStatus;
+      const elapsed = Math.round((Date.now() - startTime) / 1e3);
+      if (currentStatus !== lastLoggedStatus) {
+        logger.info(`Status: ${currentStatus} (${elapsed}s)`);
+        lastLoggedStatus = currentStatus;
+      }
       if (stopCondition(currentStatus, currentIP)) {
         return;
       }
       await sleep2(WATCH_POLL_INTERVAL_SECONDS * 1e3);
     } catch (error) {
+      if (error instanceof WatchTimeoutError) {
+        throw error;
+      }
+      if (typeof error?.message === "string" && error.message.includes("Failed")) {
+        throw error;
+      }
       logger.warn(`Failed to fetch app info: ${error.message}`);
       await sleep2(WATCH_POLL_INTERVAL_SECONDS * 1e3);
     }
@@ -8072,6 +8232,11 @@ async function prepareDeployFromVerifiableBuild(options, logger = defaultLogger)
         executions: batch.executions,
         authorizationList
       });
+      await assertSufficientGas({
+        publicClient: batch.publicClient,
+        address: batch.walletClient.account.address,
+        gasEstimate
+      });
       const data = {
         appId: batch.appId,
         salt: batch.salt,
@@ -8330,6 +8495,11 @@ async function prepareDeploy(options, logger = defaultLogger) {
         executions: batch.executions,
         authorizationList
       });
+      await assertSufficientGas({
+        publicClient: batch.publicClient,
+        address: batch.walletClient.account.address,
+        gasEstimate
+      });
       const data = {
         appId: batch.appId,
         salt: batch.salt,
@@ -8366,7 +8536,7 @@ async function executeDeploy(options) {
     }
   );
 }
-async function watchDeployment(appId, walletClient, publicClient, environmentConfig, logger = defaultLogger, skipTelemetry) {
+async function watchDeployment(appId, walletClient, publicClient, environmentConfig, logger = defaultLogger, skipTelemetry, opts) {
   return withSDKTelemetry(
     {
       functionName: "watchDeployment",
@@ -8382,7 +8552,8 @@ async function watchDeployment(appId, walletClient, publicClient, environmentCon
           walletClient,
           publicClient,
           environmentConfig,
-          appId
+          appId,
+          timeoutSeconds: opts?.timeoutSeconds
         },
         logger
       );
@@ -8478,6 +8649,11 @@ async function prepareUpgradeFromVerifiableBuild(options, logger = defaultLogger
         executions: batch.executions,
         authorizationList
       });
+      await assertSufficientGas({
+        publicClient: batch.publicClient,
+        address: batch.walletClient.account.address,
+        gasEstimate
+      });
       const data = {
         appId: batch.appId,
         executions: batch.executions,
@@ -8667,6 +8843,11 @@ async function prepareUpgrade(options, logger = defaultLogger) {
         executions: batch.executions,
         authorizationList
       });
+      await assertSufficientGas({
+        publicClient: batch.publicClient,
+        address: batch.walletClient.account.address,
+        gasEstimate
+      });
       const data = {
         appId: batch.appId,
         executions: batch.executions,
@@ -8701,7 +8882,7 @@ async function executeUpgrade(options) {
     }
   );
 }
-async function watchUpgrade(appId, walletClient, publicClient, environmentConfig, logger = defaultLogger, skipTelemetry) {
+async function watchUpgrade(appId, walletClient, publicClient, environmentConfig, logger = defaultLogger, skipTelemetry, opts) {
   return withSDKTelemetry(
     {
       functionName: "watchUpgrade",
@@ -8717,7 +8898,8 @@ async function watchUpgrade(appId, walletClient, publicClient, environmentConfig
           walletClient,
           publicClient,
           environmentConfig,
-          appId
+          appId,
+          timeoutSeconds: opts?.timeoutSeconds
         },
         logger
       );
@@ -9409,7 +9591,7 @@ function createAppModule(ctx) {
   }
   const account = walletClient.account;
   const environment = getEnvironmentConfig(ctx.environment);
-  const logger = getLogger(ctx.verbose);
+  const logger = ctx.logger ?? getLogger(ctx.verbose);
   return {
     async create(opts) {
       return createApp(opts, logger);
@@ -9521,14 +9703,15 @@ function createAppModule(ctx) {
         imageRef: result.imageRef
       };
     },
-    async watchDeployment(appId) {
+    async watchDeployment(appId, opts) {
       return watchDeployment(
         appId,
         walletClient,
         publicClient,
         environment,
         logger,
-        skipTelemetry
+        skipTelemetry,
+        opts
       );
     },
     // Granular upgrade control
@@ -9586,8 +9769,16 @@ function createAppModule(ctx) {
         imageRef: result.imageRef
       };
     },
-    async watchUpgrade(appId) {
-      return watchUpgrade(appId, walletClient, publicClient, environment, logger, skipTelemetry);
+    async watchUpgrade(appId, opts) {
+      return watchUpgrade(
+        appId,
+        walletClient,
+        publicClient,
+        environment,
+        logger,
+        skipTelemetry,
+        opts
+      );
     },
     // Profile management
     async setProfile(appId, profile) {
@@ -11100,6 +11291,7 @@ export {
   EMPTY_CONTAINER_POLICY,
   ERC20_default as ERC20ABI,
   ForbiddenError,
+  InsufficientGasError,
   JwtProvider,
   NoopClient,
   NotFoundError,
@@ -11109,9 +11301,12 @@ export {
   TimeoutError,
   USDCCredits_default as USDCCreditsABI,
   UserApiClient,
+  WATCH_DEFAULT_TIMEOUT_SECONDS,
+  WatchTimeoutError,
   addHexPrefix,
   addMetric,
   addMetricWithDimensions,
+  assertSufficientGas,
   assertValidFilePath,
   assertValidImageReference,
   assertValidPrivateKey,