@layr-labs/ecloud-sdk 1.0.0-devep8 → 1.0.0

package/dist/index.js

@@ -152,7 +152,6 @@ var ENV_SOURCE_SCRIPT_NAME = "compute-source-env.sh";
 var KMS_CLIENT_BINARY_NAME = "kms-client";
 var KMS_SIGNING_KEY_NAME = "kms-signing-public-key.pem";
 var TLS_KEYGEN_BINARY_NAME = "tls-keygen";
-var DRAIN_WATCHER_BINARY_NAME = "ecloud-drain-watcher";
 var CADDYFILE_NAME = "Caddyfile";
 var LAYERED_BUILD_DIR_PREFIX = "ecloud-layered-build";
 
@@ -439,12 +438,14 @@ USER root
 {{/if}}
 
 # Copy core TEE components
+# CA bundle for kms-client / tls-keygen to validate HTTPS calls to
+# eigencloud.xyz endpoints. Bundled at a non-standard path and consumed
+# only via SSL_CERT_FILE in compute-source-env.sh, so the user's
+# /etc/ssl/ is never touched.
+COPY --from=alpine:3.20.10 /etc/ssl/certs/ca-certificates.crt /usr/local/share/eigenx-ca-certs.crt
 COPY compute-source-env.sh /usr/local/bin/
 COPY kms-client /usr/local/bin/
 COPY kms-signing-public-key.pem /usr/local/bin/
-{{#if includeDrainWatcher}}
-COPY ecloud-drain-watcher /usr/local/bin/
-{{/if}}
 
 {{#if includeTLS}}
 # Copy Caddy from official image
@@ -458,8 +459,7 @@ COPY Caddyfile /etc/caddy/
 {{#if originalUser}}
 # Make binaries executable (755 for executables, 644 for keys)
 RUN chmod 755 /usr/local/bin/compute-source-env.sh \\
-    && chmod 755 /usr/local/bin/kms-client{{#if includeDrainWatcher}} \\
-    && chmod 755 /usr/local/bin/ecloud-drain-watcher{{/if}}{{#if includeTLS}} \\
+    && chmod 755 /usr/local/bin/kms-client{{#if includeTLS}} \\
     && chmod 755 /usr/local/bin/tls-keygen \\
     && chmod 755 /usr/local/bin/caddy{{/if}} \\
     && chmod 644 /usr/local/bin/kms-signing-public-key.pem
@@ -469,8 +469,7 @@ ENV __ECLOUD_ORIGINAL_USER={{originalUser}}
 {{else}}
 # Make binaries executable (preserve existing permissions, just add execute)
 RUN chmod +x /usr/local/bin/compute-source-env.sh \\
-    && chmod +x /usr/local/bin/kms-client{{#if includeDrainWatcher}} \\
-    && chmod +x /usr/local/bin/ecloud-drain-watcher{{/if}}{{#if includeTLS}} \\
+    && chmod +x /usr/local/bin/kms-client{{#if includeTLS}} \\
     && chmod +x /usr/local/bin/tls-keygen{{/if}}
 {{/if}}
 
@@ -483,36 +482,8 @@ LABEL tee.launch_policy.log_redirect={{logRedirect}}
 LABEL tee.launch_policy.monitoring_memory_allow={{resourceUsageAllow}}
 {{/if}}
 
-# Allow-list the envvars the ecloud-platform sets via GCE \`tee-env-*\`
-# metadata. Without this label, Confidential Space's launcher rejects
-# any \`tee-env-*\` override at container-start with
-# "env var {...} is not allowed to be overridden on this image" and
-# exits with code 1 \u2014 which terminates the VM before the entrypoint
-# ever runs. User-supplied env vars flow through KMS (not tee-env-*)
-# and don't need to be listed here.
-#
-# Entries:
-#   - ECLOUD_PD_EXPECTED   set on PD-backed apps so the entrypoint
-#                          (compute-source-env.sh) knows to wait for
-#                          the persistent disk before exec'ing the
-#                          user workload.
-#   - ECLOUD_PLATFORM_HOST the platform-routed hostname
-#                          (<addr>.<env>.eigencloud.xyz) so the
-#                          entrypoint's setup_tls can issue an ACME
-#                          cert for it. Injected by the CLI into
-#                          publicEnv at deploy/upgrade time and
-#                          propagated by ecloud-platform's
-#                          compute.go as a tee-env-* metadata key.
-#
-# The CS launcher parses this label as a comma-separated list
-# (go-tpm-tools/launcher/spec/launch_policy.go:185 \u2014 strings.Split
-# on ","). Quotes are not required; keep the value bare for
-# consistency with compute-tee's and eigenx-kms's existing labels.
-LABEL tee.launch_policy.allow_env_override=ECLOUD_PD_EXPECTED,ECLOUD_PLATFORM_HOST
-
 LABEL eigenx_cli_version={{ecloudCLIVersion}}
 LABEL eigenx_vm_image=eigen
-LABEL eigenx_container_contract=v1
 
 {{#if includeTLS}}
 # Expose both HTTP and HTTPS ports for Caddy
@@ -534,54 +505,11 @@ import Handlebars2 from "handlebars";
 
 // src/client/common/templates/compute-source-env.sh.tmpl
 var compute_source_env_sh_default = `#!/bin/sh
-# EigenCompute container entrypoint script
-# This script handles KMS secret fetching, TLS setup, and privilege dropping
-# before executing the user's application.
-#
-# Handlebars template variables (replaced at build time by the CLI):
-#   kmsServerURL - URL of the KMS server
-#   userAPIURL   - URL of the user API (ecloud-platform)
-# The KMS signing public key is copied into the image as
-#   /usr/local/bin/kms-signing-public-key.pem at layer-build time by the CLI.
-#
-# ecloud-platform divergence from compute-tee:
-#   This script emits ECLOUD_READY / ECLOUD_FAIL / ECLOUD_AWAITING_USERDATA /
-#   ECLOUD_DETACHED markers to stdout at key lifecycle points. The GCP
-#   provisioner's serial-console watcher in ecloud-platform
-#   (pkg/services/infraService/providers/gcp/compute.go) parses those
-#   markers to gate "VM ready" and to coordinate the prewarm-detach
-#   upgrade flow. Without the markers, the platform's waitForStartupReady
-#   times out at ~10 minutes per deploy, rollback fires, and the VM is
-#   deleted \u2014 seen in dev on 2026-05-04 with an older copy of this
-#   template that lacked the markers.
-#
-#   Prewarm-detach contract:
-#     - If ECLOUD_PD_EXPECTED=1 and /mnt/disks/userdata is not present at boot,
-#       emit ECLOUD_AWAITING_USERDATA and wait until the disk is attached.
-#     - On SIGTERM (drain-requested), forward to child, wait for exit, sync
-#       + unmount /mnt/disks/userdata, emit ECLOUD_DETACHED, exit.
-#     - ECLOUD_READY is emitted once runtime is bootstrapped (same as before).
-#     - ECLOUD_FAIL is emitted on any unrecoverable setup error.
-#   Keep the markers on any line that resolves a lifecycle outcome.
-#
-#   This file is kept in lockstep with
-#   ecloud-platform/pkg/services/buildService/assets/compute-source-env.sh.tmpl
-#   \u2014 if you change one, change the other. Differences vs the platform copy
-#   are intentionally minimal:
-#     - Handlebars placeholders use the CLI's naming (kmsServerURL,
-#       userAPIURL) rather than the platform's (KMS_SERVER_URL,
-#       USER_API_URL). (See top of file for real placeholder syntax \u2014
-#       not repeated here so Handlebars doesn't expand it in this comment.)
-#     - KMS signing key is read from a file the CLI copies into the image,
-#       not heredoc-embedded in the script, because the CLI's image
-#       layering writes it as a separate file (kms-signing-public-key.pem).
-#     - TLS binary is \`tls-keygen\` (CLI-bundled) not \`tls-client\`.
-
 echo "compute-source-env.sh: Running setup script..."
 
 # Fetch and source environment variables from KMS
 echo "Fetching secrets from KMS..."
-if /usr/local/bin/kms-client \\
+if SSL_CERT_FILE=/usr/local/share/eigenx-ca-certs.crt /usr/local/bin/kms-client \\
   --kms-server-url "{{kmsServerURL}}" \\
   --kms-signing-key-file /usr/local/bin/kms-signing-public-key.pem \\
   --userapi-url "{{userAPIURL}}" \\
@@ -592,187 +520,93 @@ if /usr/local/bin/kms-client \\
 else
     echo "compute-source-env.sh: ERROR - Failed to fetch environment variables from KMS"
     echo "compute-source-env.sh: Exiting - cannot start user workload without KMS secrets"
-    echo "ECLOUD_FAIL kms_bootstrap"
     exit 1
 fi
 
-# issue_cert_for runs tls-keygen for a single hostname and copies the
-# produced fullchain/privkey into $1's output directory ($2). Returns
-# 0 on success, non-zero on any failure (caller decides whether that's
-# fatal). tls-keygen writes to /run/tls/{fullchain,privkey}.pem by
-# default; we move those to a per-host subdirectory so the two-site
-# Caddyfile can select the right cert by path.
-issue_cert_for() {
-    local host="$1"
-    local cert_dir="$2"
-    local mnemonic="$3"
-    local challenge="$4"
-    local staging_flag="$5"
-
-    echo "compute-source-env.sh: Obtaining TLS certificate for $host (challenge=$challenge)..."
-    # Remove any stale default outputs from a prior tls-keygen run
-    rm -f /run/tls/fullchain.pem /run/tls/privkey.pem
-    if ! MNEMONIC="$mnemonic" DOMAIN="$host" API_URL="{{userAPIURL}}" /usr/local/bin/tls-keygen \\
-        -challenge "$challenge" \\
-        $staging_flag; then
-        return 1
-    fi
-    mkdir -p "$cert_dir"
-    mv /run/tls/fullchain.pem "$cert_dir/fullchain.pem"
-    mv /run/tls/privkey.pem "$cert_dir/privkey.pem"
-    echo "compute-source-env.sh: Cert for $host written to $cert_dir"
-}
-
-# Setup TLS: issues certs for
-#   - ECLOUD_PLATFORM_HOST (platform-routed <addr>.<env>.eigencloud.xyz),
-#     when the CLI/platform has set it
-#   - DOMAIN (user-supplied custom domain), when set and non-localhost
-#
-# No client-side DNS precheck. Earlier versions tried to gate ACME on
-# "does this hostname resolve to my external IP" but that's wrong for
-# the platform-routing model (DNS points at the shared nginx NLB, not
-# the VM) and was preventing cert issuance on the production path.
-# tls-client (eigencompute-containers/tls-client) does its own DNS
-# poll before calling ACME and surfaces a clear error when challenges
-# can't reach the VM, which is the right place for that check \u2014
-# attempting it here from inside the VM cannot tell platform-routed
-# from compute-tee-routed apps.
+# Setup TLS if tls-keygen is present (which means TLS was configured at build time)
 setup_tls() {
     # If tls-keygen isn't present, TLS wasn't configured during build
     if [ ! -x /usr/local/bin/tls-keygen ]; then
         echo "compute-source-env.sh: TLS not configured (no tls-keygen binary)"
         return 0
     fi
-
-    local platform_host="\${ECLOUD_PLATFORM_HOST:-}"
-    local user_domain="\${DOMAIN:-}"
+    
+    local domain="\${DOMAIN:-}"
     local mnemonic="\${MNEMONIC:-}"
-
-    # Normalize "localhost" DOMAIN to unset \u2014 compute-tee apps often
-    # set DOMAIN=localhost as a sentinel for "no custom domain".
-    if [ "$user_domain" = "localhost" ]; then
-        user_domain=""
-    fi
-
-    # If the user set DOMAIN to the same value as the platform
-    # hostname, collapse them. Without this we'd burn a second ACME
-    # issuance for the exact same name (each VM boot counts against
-    # Let's Encrypt's 5-certs-per-domain-per-week limit), and Caddy
-    # would then refuse to start because two site blocks bound to
-    # the same address is a config error. Also unset DOMAIN so the
-    # DOMAIN site block in the Caddyfile falls back to its
-    # "localhost.user.invalid" placeholder and stays dormant.
-    if [ -n "$platform_host" ] && [ "$user_domain" = "$platform_host" ]; then
-        echo "compute-source-env.sh: DOMAIN matches ECLOUD_PLATFORM_HOST; skipping duplicate cert"
-        user_domain=""
-        unset DOMAIN
-    fi
-
-    if [ -z "$platform_host" ] && [ -z "$user_domain" ]; then
-        echo "compute-source-env.sh: TLS skipped (neither ECLOUD_PLATFORM_HOST nor DOMAIN set)"
-        return 0
+    
+    # Since tls-keygen is present, TLS is expected - validate requirements
+    if [ -z "$domain" ] || [ "$domain" = "localhost" ]; then
+        echo "compute-source-env.sh: ERROR - TLS binary present but DOMAIN not configured or is localhost"
+        echo "compute-source-env.sh: Set DOMAIN environment variable to a valid domain"
+        exit 1
     fi
-
+    
     if [ -z "$mnemonic" ]; then
-        echo "compute-source-env.sh: ERROR - TLS requested but MNEMONIC not available"
-        echo "ECLOUD_FAIL tls_mnemonic_missing"
+        echo "compute-source-env.sh: ERROR - TLS binary present but MNEMONIC not available"
+        echo "compute-source-env.sh: Cannot obtain TLS certificate without mnemonic"
         exit 1
     fi
-
+    
     if [ ! -x /usr/local/bin/caddy ]; then
-        echo "compute-source-env.sh: ERROR - TLS requested but Caddy not found"
-        echo "ECLOUD_FAIL tls_caddy_missing"
+        echo "compute-source-env.sh: ERROR - TLS binary present but Caddy not found"
         exit 1
     fi
-
+    
+    echo "compute-source-env.sh: Setting up TLS for domain: $domain"
+    
+    # Obtain TLS certificate using ACME
+    # Default to http-01, but allow override via ACME_CHALLENGE env var
     local challenge="\${ACME_CHALLENGE:-http-01}"
+    
+    # Check if we should use staging (for testing)
     local staging_flag=""
     if [ "\${ACME_STAGING:-false}" = "true" ]; then
         staging_flag="-staging"
-        echo "compute-source-env.sh: Using Let's Encrypt STAGING environment"
-    fi
-
-    local certs_issued=0
-
-    if [ -n "$platform_host" ]; then
-        if issue_cert_for "$platform_host" "/run/tls/platform" "$mnemonic" "$challenge" "$staging_flag"; then
-            certs_issued=$((certs_issued + 1))
-        else
-            echo "compute-source-env.sh: ERROR - failed to issue cert for platform host $platform_host"
-            echo "ECLOUD_FAIL tls_setup"
-            exit 1
-        fi
-    fi
-
-    if [ -n "$user_domain" ]; then
-        if issue_cert_for "$user_domain" "/run/tls/domain" "$mnemonic" "$challenge" "$staging_flag"; then
-            certs_issued=$((certs_issued + 1))
-        else
-            echo "compute-source-env.sh: ERROR - failed to issue cert for user domain $user_domain"
-            echo "ECLOUD_FAIL tls_setup"
-            exit 1
-        fi
+        echo "compute-source-env.sh: Using Let's Encrypt STAGING environment (certificates won't be trusted)"
     fi
-
-    if [ "$certs_issued" -eq 0 ]; then
-        echo "compute-source-env.sh: no certs issued, skipping Caddy (app will serve plaintext until DNS is wired)"
-        return 0
+    
+    echo "compute-source-env.sh: Obtaining TLS certificate using $challenge challenge..."
+    # Pass the API URL for certificate persistence
+    if ! SSL_CERT_FILE=/usr/local/share/eigenx-ca-certs.crt \\
+       MNEMONIC="$mnemonic" DOMAIN="$domain" API_URL="{{userAPIURL}}" /usr/local/bin/tls-keygen \\
+        -challenge "$challenge" \\
+        $staging_flag; then
+        echo "compute-source-env.sh: ERROR - Failed to obtain TLS certificate"
+        echo "compute-source-env.sh: Certificate issuance failed for $domain"
+        exit 1
     fi
-
-    # Caddy's validate step checks that every \`tls <cert> <key>\` file
-    # exists, even on site blocks bound to dormant placeholder
-    # hostnames. The default Caddyfile declares both a platform site
-    # and a user-domain site; when only one is configured, the other
-    # block's cert paths are never populated and validate fails with
-    # "Invalid Caddyfile". Point the unused block at the issued
-    # block's cert files so validate passes \u2014 the dormant block can't
-    # receive real traffic (its hostname falls back to
-    # localhost.{platform,user}.invalid, which Caddy routes by SNI and
-    # never matches public traffic), so the symlink is never actually
-    # presented. Skipped when a user-supplied Caddyfile is in use,
-    # since we don't know what cert paths it references.
-    if [ -d /run/tls/platform ] && [ ! -e /run/tls/domain/fullchain.pem ]; then
-        mkdir -p /run/tls/domain
-        ln -sf /run/tls/platform/fullchain.pem /run/tls/domain/fullchain.pem
-        ln -sf /run/tls/platform/privkey.pem /run/tls/domain/privkey.pem
-    elif [ -d /run/tls/domain ] && [ ! -e /run/tls/platform/fullchain.pem ]; then
-        mkdir -p /run/tls/platform
-        ln -sf /run/tls/domain/fullchain.pem /run/tls/platform/fullchain.pem
-        ln -sf /run/tls/domain/privkey.pem /run/tls/platform/privkey.pem
+    
+    echo "compute-source-env.sh: TLS certificate obtained successfully"
+    
+    # Validate Caddyfile before starting
+    if ! /usr/local/bin/caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile 2>/dev/null; then
+        echo "compute-source-env.sh: ERROR - Invalid Caddyfile"
+        echo "compute-source-env.sh: TLS was requested (DOMAIN=$domain) but setup failed"
+        exit 1
     fi
-
-    # Validate Caddyfile before starting. Don't redirect stderr \u2014 when
-    # validate fails, Caddy's diagnostic is the only signal that lands
-    # in ReadinessError.SerialTail, so silencing it leaves operators
-    # staring at a bare "tls_invalid_caddyfile" with no detail.
-    if [ -f /etc/caddy/Caddyfile ]; then
-        if ! /usr/local/bin/caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile; then
-            echo "compute-source-env.sh: ERROR - Invalid Caddyfile"
-            echo "ECLOUD_FAIL tls_invalid_caddyfile"
+    
+    # Start Caddy in background
+    echo "compute-source-env.sh: Starting Caddy reverse proxy..."
+    
+    # Check if Caddy logs should be enabled
+    if [ "\${ENABLE_CADDY_LOGS:-false}" = "true" ]; then
+        if ! /usr/local/bin/caddy start --config /etc/caddy/Caddyfile --adapter caddyfile 2>&1; then
+            echo "compute-source-env.sh: ERROR - Failed to start Caddy"
+            echo "compute-source-env.sh: TLS was requested (DOMAIN=$domain) but setup failed"
             exit 1
         fi
-
-        echo "compute-source-env.sh: Starting Caddy reverse proxy..."
-        if [ "\${ENABLE_CADDY_LOGS:-false}" = "true" ]; then
-            if ! /usr/local/bin/caddy start --config /etc/caddy/Caddyfile --adapter caddyfile 2>&1; then
-                echo "compute-source-env.sh: ERROR - Failed to start Caddy"
-                echo "ECLOUD_FAIL tls_caddy_start"
-                exit 1
-            fi
-        else
-            if ! /usr/local/bin/caddy start --config /etc/caddy/Caddyfile --adapter caddyfile >/dev/null 2>&1; then
-                echo "compute-source-env.sh: ERROR - Failed to start Caddy"
-                echo "ECLOUD_FAIL tls_caddy_start"
-                exit 1
-            fi
-        fi
-
-        sleep 2
-        echo "compute-source-env.sh: Caddy started successfully"
     else
-        echo "compute-source-env.sh: No Caddyfile found, skipping Caddy"
+        # Redirect Caddy output to /dev/null to silence logs
+        if ! /usr/local/bin/caddy start --config /etc/caddy/Caddyfile --adapter caddyfile >/dev/null 2>&1; then
+            echo "compute-source-env.sh: ERROR - Failed to start Caddy"
+            echo "compute-source-env.sh: TLS was requested (DOMAIN=$domain) but setup failed"
+            exit 1
+        fi
     fi
-
+    
+    # Give Caddy a moment to fully initialize
+    sleep 2
+    echo "compute-source-env.sh: Caddy started successfully"
     return 0
 }
 
@@ -783,309 +617,15 @@ setup_tls
 export KMS_SERVER_URL="{{kmsServerURL}}"
 export KMS_PUBLIC_KEY="$(cat /usr/local/bin/kms-signing-public-key.pem)"
 
-# \u2500\u2500 Prewarm-detach: wait for PD if expected \u2500\u2500
-# Orchestrator sets ECLOUD_PD_EXPECTED=1 on apps using StorageBackend=pd.
-# When the prewarm path is used, the new VM boots WITHOUT the disk; we
-# signal awaiting-userdata and poll until the disk is attached.
-USERDATA_MOUNT="/mnt/disks/userdata"
-USERDATA_DEV="/dev/disk/by-id/google-persistent_storage_1"
-
-# userdata_mount_backing_dev resolves the kernel device that currently
-# backs $USERDATA_MOUNT (or empty string if not mounted). The output is
-# canonicalized via readlink so we can compare against $USERDATA_DEV
-# without caring whether the mount table records the symlinked
-# /dev/disk/by-id/... path or the underlying /dev/sdb-style path.
-#
-# Tries findmnt first (clean structured output), falls back to parsing
-# /proc/self/mountinfo so we don't add a hard dependency on util-linux
-# being present in the image.
-userdata_mount_backing_dev() {
-    if command -v findmnt >/dev/null 2>&1; then
-        local src
-        src=$(findmnt -n -o SOURCE -- "$USERDATA_MOUNT" 2>/dev/null) || return 0
-        [ -n "$src" ] || return 0
-        readlink -f "$src" 2>/dev/null || echo "$src"
-        return 0
-    fi
-    # /proc/self/mountinfo line shape (kernel docs): mount-id parent-id
-    # major:minor root mount-point ... So column 5 is the mount point and
-    # the device path lives in the optional fields after the "-" separator.
-    # We just need the major:minor \u2192 device mapping; awk + a /sys lookup
-    # is cleaner than parsing the mountinfo's optional-field section.
-    local maj_min dev_basename
-    maj_min=$(awk -v mp="$USERDATA_MOUNT" '$5 == mp { print $3 }' /proc/self/mountinfo 2>/dev/null | head -1)
-    [ -n "$maj_min" ] || return 0
-    dev_basename=$(readlink "/sys/dev/block/\${maj_min}" 2>/dev/null | awk -F/ '{print $NF}')
-    [ -n "$dev_basename" ] || return 0
-    readlink -f "/dev/\${dev_basename}" 2>/dev/null || echo "/dev/\${dev_basename}"
-}
-
-# expected_userdata_dev resolves $USERDATA_DEV through any symlinks so
-# string-compare against userdata_mount_backing_dev is meaningful even
-# when the kernel hands us a /dev/nvme0n1-style path while
-# /dev/disk/by-id/google-persistent_storage_1 is the symlink GCE
-# publishes.
-expected_userdata_dev() {
-    if [ -e "$USERDATA_DEV" ]; then
-        readlink -f "$USERDATA_DEV" 2>/dev/null || echo "$USERDATA_DEV"
-    else
-        echo "$USERDATA_DEV"
-    fi
-}
-
-wait_for_userdata() {
-    if [ "\${ECLOUD_PD_EXPECTED:-0}" != "1" ]; then
-        return 0
-    fi
-    if mountpoint -q "$USERDATA_MOUNT" 2>/dev/null; then
-        # The mount slot is taken \u2014 but is it taken by the PD we're
-        # about to attach, or by something else? The Confidential Space
-        # TEE runtime's SetupSecondaryEncryptedVolume step probes for a
-        # secondary GCE disk once at boot, doesn't see it (because the
-        # orchestrator hasn't called AttachPD yet \u2014 the contract says
-        # the new VM signals awaiting-userdata FIRST), and falls back
-        # to mounting an encrypted folder on the BOOT disk at this same
-        # path. If we accept that mount as-is, the user app boots on a
-        # fresh empty filesystem and the orchestrator's late AttachPD
-        # silently lands on a VM that's already serving from boot disk.
-        # See docs/solutions/2026-05-15-prewarm-detach-pd-preservation-boot-race.md
-        # in ecloud-platform.
-        local backing expected
-        backing=$(userdata_mount_backing_dev)
-        expected=$(expected_userdata_dev)
-        if [ -n "$backing" ] && [ "$backing" = "$expected" ]; then
-            echo "compute-source-env.sh: userdata already mounted at $USERDATA_MOUNT (backed by $backing)"
-            return 0
-        fi
-        # Mount slot taken, but NOT by our PD. This is the runtime
-        # premount on boot disk. Try to recover by lazy-unmounting (the
-        # filesystem is fresh and unused \u2014 no app has written to it
-        # yet), then fall through to the normal wait-for-PD loop.
-        echo "compute-source-env.sh: WARNING - $USERDATA_MOUNT premounted by TEE runtime fallback (backing=\${backing:-unknown}, expected=$expected); attempting recovery"
-        if ! umount -l "$USERDATA_MOUNT" 2>/dev/null; then
-            # Lazy unmount should never fail under normal circumstances \u2014
-            # it doesn't wait for open files, just detaches the namespace.
-            # If it did fail, we have no path forward: the orchestrator's
-            # strict-mode WaitAwaitingUserdata gate (ecloud-platform PR
-            # #174) catches our ECLOUD_FAIL within one poll tick and
-            # rolls back, leaving the user's data safe on the old VM.
-            echo "ECLOUD_FAIL pd_runtime_premount_unrecoverable"
-            exit 1
-        fi
-        echo "compute-source-env.sh: unmounted runtime fallback at $USERDATA_MOUNT, waiting for real PD"
-    fi
-    # Refuse to proceed if the tools we need for safe first-attach
-    # detection are missing. Without blkid we cannot tell an empty new
-    # disk from an already-formatted one \u2014 running mkfs.ext4 on the
-    # latter would destroy data.
-    if ! command -v blkid >/dev/null 2>&1; then
-        echo "ECLOUD_FAIL pd_tools_missing"
-        exit 1
-    fi
-    echo "ECLOUD_AWAITING_USERDATA"
-    echo "compute-source-env.sh: waiting for PD at $USERDATA_DEV..."
-    # Poll for up to 10 minutes (120 * 5s). The orchestrator's overall
-    # attach timeout is shorter; the ceiling here just bounds the wait
-    # for manual / diagnostic scenarios.
-    local i=0
-    local mount_failures=0
-    while [ "$i" -lt 120 ]; do
-        if [ -e "$USERDATA_DEV" ]; then
-            mkdir -p "$USERDATA_MOUNT"
-            if mount -o noatime "$USERDATA_DEV" "$USERDATA_MOUNT" 2>/dev/null; then
-                echo "compute-source-env.sh: PD mounted at $USERDATA_MOUNT"
-                return 0
-            fi
-            # Disk present but mount failed. Check whether it has a
-            # recognized filesystem. \`blkid -s TYPE -o value\` prints the
-            # FS type (empty if none). We only mkfs when there is
-            # demonstrably NO filesystem \u2014 never on the basis of blkid
-            # returning non-zero alone, which could mean "blkid missing"
-            # or "device busy".
-            local fstype
-            fstype=$(blkid -s TYPE -o value "$USERDATA_DEV" 2>/dev/null)
-            if [ -z "$fstype" ]; then
-                echo "compute-source-env.sh: formatting $USERDATA_DEV (first attach)"
-                mkfs.ext4 -F -L eclouddata "$USERDATA_DEV" >/dev/null 2>&1 || {
-                    echo "ECLOUD_FAIL pd_mkfs_failed"
-                    exit 1
-                }
-                mount -o noatime "$USERDATA_DEV" "$USERDATA_MOUNT" || {
-                    echo "ECLOUD_FAIL pd_mount_after_format_failed"
-                    exit 1
-                }
-                return 0
-            fi
-            # Disk has a filesystem but mount still failed. Give it a
-            # few retries to cover transient cases (device busy, udev
-            # still settling), but don't pretend this is an attach
-            # timeout if it persists.
-            mount_failures=$((mount_failures + 1))
-            if [ "$mount_failures" -ge 6 ]; then
-                echo "ECLOUD_FAIL pd_mount_failed"
-                exit 1
-            fi
-        else
-            # Device disappeared (e.g. udev re-enumeration between
-            # attach and mount). Reset the consecutive-failure counter
-            # so only true back-to-back mount failures trip
-            # pd_mount_failed; a device blip should not steal retries.
-            mount_failures=0
-        fi
-        i=$((i + 1))
-        sleep 5
-    done
-    echo "ECLOUD_FAIL pd_attach_timeout"
-    exit 1
-}
-
-wait_for_userdata
-
-# \u2500\u2500 Prewarm-detach: install SIGTERM handler for graceful drain \u2500\u2500
-# Orchestrator signals drain by setting the instance metadata key
-# ECLOUD_DRAIN_REQUESTED=1, which a host-level agent translates into
-# SIGTERM on PID 1. On SIGTERM we:
-#   1. Forward to the child (wakes the user's app for graceful exit)
-#   2. Wait for child exit
-#   3. Sync + unmount the PD
-#   4. Emit ECLOUD_DETACHED so the orchestrator can proceed to detach
-CHILD_PID=""
-_DRAIN_IN_PROGRESS=0
-
-drain_handler() {
-    # Guard against re-entry if SIGTERM arrives twice (e.g. both the
-    # drain_watcher and an external signal fire in quick succession).
-    if [ "$_DRAIN_IN_PROGRESS" = "1" ]; then
-        return 0
-    fi
-    _DRAIN_IN_PROGRESS=1
-    echo "compute-source-env.sh: received drain signal, forwarding to child pgid=$CHILD_PID"
-    if [ -n "$CHILD_PID" ]; then
-        # Send to the process group so intermediate wrappers (su, sh -c,
-        # etc.) don't swallow the signal. The leading \`-\` targets the
-        # pgid, which equals the direct child's pid for a shell-backgrounded
-        # process. Fall back to the pid alone if pgid signaling fails
-        # (e.g. kernel older than 3.9 or PID namespace edge cases).
-        kill -TERM -"$CHILD_PID" 2>/dev/null || kill -TERM "$CHILD_PID" 2>/dev/null || true
-        # Give the app up to 30s to exit cleanly.
-        local i=0
-        while [ "$i" -lt 30 ] && kill -0 "$CHILD_PID" 2>/dev/null; do
-            i=$((i + 1))
-            sleep 1
-        done
-        if kill -0 "$CHILD_PID" 2>/dev/null; then
-            echo "compute-source-env.sh: child did not exit in 30s, sending SIGKILL"
-            kill -KILL -"$CHILD_PID" 2>/dev/null || kill -KILL "$CHILD_PID" 2>/dev/null || true
-            # Reap the process so its in-flight I/O is flushed to the
-            # filesystem before we sync + unmount. SIGKILL schedules
-            # death; wait guarantees it's complete.
-            wait "$CHILD_PID" 2>/dev/null || true
-        fi
-    fi
-    if [ "\${ECLOUD_PD_EXPECTED:-0}" = "1" ] && mountpoint -q "$USERDATA_MOUNT" 2>/dev/null; then
-        sync
-        if umount "$USERDATA_MOUNT" 2>/dev/null; then
-            echo "compute-source-env.sh: unmounted $USERDATA_MOUNT cleanly"
-        else
-            # Force lazy unmount as last resort \u2014 orchestrator still needs
-            # the DETACHED signal to proceed.
-            umount -l "$USERDATA_MOUNT" 2>/dev/null || true
-            echo "compute-source-env.sh: WARNING - used lazy unmount on $USERDATA_MOUNT"
-        fi
-        # ECLOUD_DETACHED is strictly a PD-lifecycle signal. Only emit
-        # it when we actually had a PD mount in play, so serial-log
-        # parsers and alerting for non-PD apps don't see spurious
-        # lifecycle markers on routine container SIGTERM.
-        echo "ECLOUD_DETACHED"
-    fi
-    # Always exit 0: drain is a managed shutdown and the orchestrator
-    # waits on ECLOUD_DETACHED, not the container exit code. Forwarding
-    # the child's exit status here would make a crash-during-drain look
-    # like a drain failure to whatever reads the container exit code.
-    exit 0
-}
-trap drain_handler TERM
-
-# \u2500\u2500 Prewarm-detach: background drain watcher \u2500\u2500
-# Container metadata delivery in Confidential Space is limited, so we
-# poll the instance metadata server for ECLOUD_DRAIN_REQUESTED and
-# raise SIGTERM on ourselves when it flips to "1".
-#
-# Try wget first (present in most Alpine bases), fall back to curl.
-# If neither is present, drain watcher is disabled \u2014 the orchestrator
-# will hit its drain timeout and fail the upgrade explicitly, which is
-# the correct behavior (we cannot silently ignore a drain request).
-_fetch_drain_flag() {
-    local url="http://metadata.google.internal/computeMetadata/v1/instance/attributes/ECLOUD_DRAIN_REQUESTED"
-    if command -v wget >/dev/null 2>&1; then
-        wget -q --tries=1 --timeout=2 --header='Metadata-Flavor: Google' -O - "$url" 2>/dev/null
-    elif command -v curl >/dev/null 2>&1; then
-        curl -sf --max-time 2 -H 'Metadata-Flavor: Google' "$url" 2>/dev/null
-    else
-        return 2
-    fi
-}
-
-drain_watcher() {
-    # Preflight: confirm we have an HTTP client
-    if ! _fetch_drain_flag >/dev/null 2>&1; then
-        # Either no http client available OR metadata server not
-        # responding yet. If no client, give up and log; otherwise the
-        # loop below will retry.
-        if ! command -v wget >/dev/null 2>&1 && ! command -v curl >/dev/null 2>&1; then
-            echo "compute-source-env.sh: WARNING - no wget/curl; drain_watcher disabled"
-            return 0
-        fi
-    fi
-    while true; do
-        local v
-        v=$(_fetch_drain_flag || true)
-        if [ "$v" = "1" ]; then
-            echo "compute-source-env.sh: drain_watcher saw ECLOUD_DRAIN_REQUESTED=1, signaling PID 1"
-            # The CS launcher runs this script directly as PID 1, so
-            # kill -TERM 1 delivers SIGTERM to the shell that installed
-            # the drain_handler trap. If the launch mechanism ever
-            # wraps this script in another process, this assumption
-            # breaks and drain will silently no-op \u2014 audit here.
-            kill -TERM 1 2>/dev/null || true
-            return 0
-        fi
-        sleep 2
-    done
-}
-
-if [ "\${ECLOUD_PD_EXPECTED:-0}" = "1" ]; then
-    # Assumption: the orchestrator only flips ECLOUD_DRAIN_REQUESTED=1
-    # after observing ECLOUD_AWAITING_USERDATA (old VM) or
-    # ECLOUD_READY (new VM), so CHILD_PID is always set by the time
-    # drain_handler fires. If drain somehow arrived in the tiny window
-    # between this watcher spawn and CHILD_PID assignment below,
-    # drain_handler would skip the child-kill branch and still emit
-    # ECLOUD_DETACHED \u2014 harmless because there's nothing to drain yet.
-    if [ -x /usr/local/bin/ecloud-drain-watcher ]; then
-        /usr/local/bin/ecloud-drain-watcher &
-    else
-        drain_watcher &
-    fi
-fi
-
 echo "compute-source-env.sh: Environment sourced."
-echo "ECLOUD_READY runtime_bootstrapped"
 
 # Drop privileges to original user for the application command
 if [ -n "$__ECLOUD_ORIGINAL_USER" ] && [ "$(id -u)" = "0" ]; then
     echo "compute-source-env.sh: Dropping privileges to user: $__ECLOUD_ORIGINAL_USER"
-    # Must background the child so our trap can fire; exec replaces PID 1.
-    su -s /bin/sh "$__ECLOUD_ORIGINAL_USER" -c 'exec "$@"' -- sh "$@" &
-    CHILD_PID=$!
-    wait "$CHILD_PID"
-    exit $?
+    exec su -s /bin/sh "$__ECLOUD_ORIGINAL_USER" -c 'exec "$@"' -- sh "$@"
 fi
 
-"$@" &
-CHILD_PID=$!
-wait "$CHILD_PID"
-exit $?
+exec "$@"
 `;
 
 // src/client/common/templates/scriptTemplate.ts
@@ -1094,14 +634,6 @@ function processScriptTemplate(data) {
   return template(data);
 }
 
-// src/client/common/templates/Caddyfile.default.tmpl
-var Caddyfile_default_default = '# Caddy configuration for automatic HTTPS\n#\n# Two sites can be configured at runtime via env vars that\n# ecloud-platform / the CLI inject into tee-env metadata:\n#\n#   ECLOUD_PLATFORM_HOST \u2014 the platform-derived hostname\n#                          (<addr>.<env>.eigencloud.xyz). Always set\n#                          for platform-routed apps. Cert at\n#                          /run/tls/platform/fullchain.pem.\n#   DOMAIN               \u2014 optional user-supplied custom domain.\n#                          Cert at /run/tls/domain/fullchain.pem.\n#\n# When a variable is unset, Caddy substitutes the default listed\n# after the colon. We use distinct defaults per site so each block\n# binds to a unique name at bootstrap \u2014 both blocks overlapping\n# on "localhost" would cause Caddy to reject the config.\n{$ECLOUD_PLATFORM_HOST:localhost.platform.invalid} {\n    tls /run/tls/platform/fullchain.pem /run/tls/platform/privkey.pem\n\n    reverse_proxy localhost:{$APP_PORT:3000} {\n        health_uri /health\n        health_interval 30s\n        health_timeout 5s\n        health_status 200\n    }\n\n    header {\n        X-Content-Type-Options "nosniff"\n        X-Frame-Options "DENY"\n        X-XSS-Protection "1; mode=block"\n        Referrer-Policy "strict-origin-when-cross-origin"\n        -Server\n    }\n\n    log {\n        output stdout\n        format console\n        level INFO\n    }\n\n    request_body {\n        max_size 10MB\n    }\n}\n\n{$DOMAIN:localhost.user.invalid} {\n    tls /run/tls/domain/fullchain.pem /run/tls/domain/privkey.pem\n\n    reverse_proxy localhost:{$APP_PORT:3000} {\n        health_uri /health\n        health_interval 30s\n        health_timeout 5s\n        health_status 200\n    }\n\n    header {\n        X-Content-Type-Options "nosniff"\n        X-Frame-Options "DENY"\n        X-XSS-Protection "1; mode=block"\n        Referrer-Policy "strict-origin-when-cross-origin"\n        -Server\n    }\n\n    log {\n        output stdout\n        format console\n        level INFO\n    }\n\n    request_body {\n        max_size 10MB\n    }\n}\n\n# HTTP endpoint (optional, for health checks or redirects)\n:80 {\n    # Redirect to HTTPS for any real (non-placeholder) host\n    @for_domain expression {host} != "localhost.platform.invalid" && {host} != "localhost.user.invalid" && {host} != "localhost"\n    redir @for_domain https://{host}{uri} permanent\n\n    # Health check endpoint (always available via HTTP)\n    handle /health {\n        respond "OK" 200\n    }\n}\n';
-
-// src/client/common/templates/caddyfileTemplate.ts
-function getDefaultCaddyfile() {
-  return Caddyfile_default_default;
-}
-
 // keys/mainnet-alpha/prod/kms-encryption-public-key.pem
 var kms_encryption_public_key_default = "-----BEGIN PUBLIC KEY-----\nMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0kHU86k17ofCIGcJKDcf\nAFurFhSLeWmOL0bwWLCeVnTPG0MMHtJOq+woE0XXSWw6lzm+jzavBBTwKde1dgal\nAp91vULAZFMUpiUdd2dNUVtvU89qW0Pgf1Eu5FDj7BkY/SnyECbWJM4ga0BmpiGy\nnQwLNN9mMGhjVoVLn2zwEGZ7JzS9Nz11EZKO/k/9DcO6LaoIFmKuvVf3jl6lvZg8\naeA0LoZXjkycHlRUt/kfKwZnhakUaYHP1ksV7ZNmolS5GYDTSKGB2KPPNR1s4/Xu\nu8zeEFC8HuGRU8XuuBeaAunitnGhbNVREUNJGff6HZOGB6CIFNXjbQETeZ3p5uro\n0v+hd1QqQYBv7+DEaMCmGnJNGAyIMr2mn4vr7wGsIj0HonlSHmQ8rmdUhL2ocNTc\nLhKgZiZmBuDpSbFW/r53R2G7CHcqaqGeUBnT54QCH4zsYKw0/4dOtwFxQpTyBf9/\n+k+KaWEJYKkx9d9OzKGyAvzrTDVOFoajddiJ6LPvRlMdOUQr3hl4IAC0/nh9lhHq\nD0R+i5WAU96TkdAe7B7iTGH2D22k0KUPR6Q9W3aF353SLxQAMPNrgG4QQufAdRJn\nAF+8ntun5TkTqjTWRSwAsUJZ1z4wb96DympWJbDi0OciJRZ3Fz3j9+amC43yCHGg\naaEMjdt35ewbztUSc04F10MCAwEAAQ==\n-----END PUBLIC KEY-----";
 
@@ -1276,9 +808,15 @@ async function layerLocalImage(options, logger) {
   const imageConfig = await extractImageConfig(docker, sourceImageRef);
   const originalCmd = imageConfig.cmd.length > 0 ? imageConfig.cmd : imageConfig.entrypoint;
   const originalUser = imageConfig.user;
-  const includeTLS = true;
-  const drainWatcherSource = findBinary("ecloud-drain-watcher-linux-amd64");
-  const includeDrainWatcher = fs.existsSync(drainWatcherSource);
+  let includeTLS = false;
+  if (envFilePath && fs.existsSync(envFilePath)) {
+    const envContent = fs.readFileSync(envFilePath, "utf-8");
+    const domainMatch = envContent.match(/^DOMAIN=(.+)$/m);
+    if (domainMatch && domainMatch[1] && domainMatch[1] !== "localhost") {
+      includeTLS = true;
+      logger.debug(`Found DOMAIN=${domainMatch[1]} in ${envFilePath}, including TLS components`);
+    }
+  }
   const layeredDockerfileContent = processDockerfileTemplate({
     baseImage: sourceImageRef,
     originalCmd: JSON.stringify(originalCmd),
@@ -1286,9 +824,8 @@ async function layerLocalImage(options, logger) {
     logRedirect,
     resourceUsageAllow,
     includeTLS,
-    ecloudCLIVersion: "0.1.0",
+    ecloudCLIVersion: "0.1.0"
     // TODO: Get from package.json
-    includeDrainWatcher
   });
   const scriptContent = processScriptTemplate({
     kmsServerURL: environmentConfig.kmsServerURL,
@@ -1298,8 +835,7 @@ async function layerLocalImage(options, logger) {
     environmentConfig,
     layeredDockerfileContent,
     scriptContent,
-    includeTLS,
-    includeDrainWatcher ? drainWatcherSource : void 0
+    includeTLS
     // logger
   );
   try {
@@ -1314,7 +850,7 @@ async function layerLocalImage(options, logger) {
     fs.rmSync(tempDir, { recursive: true, force: true });
   }
 }
-async function setupLayeredBuildDirectory(environmentConfig, layeredDockerfileContent, scriptContent, includeTLS, drainWatcherSource) {
+async function setupLayeredBuildDirectory(environmentConfig, layeredDockerfileContent, scriptContent, includeTLS) {
   const tempDir = fs.mkdtempSync(path2.join(os.tmpdir(), LAYERED_BUILD_DIR_PREFIX));
   try {
     const layeredDockerfilePath = path2.join(tempDir, LAYERED_DOCKERFILE_NAME);
@@ -1338,11 +874,6 @@ async function setupLayeredBuildDirectory(environmentConfig, layeredDockerfileCo
     }
     fs.copyFileSync(kmsClientSource, kmsClientPath);
     fs.chmodSync(kmsClientPath, 493);
-    if (drainWatcherSource && fs.existsSync(drainWatcherSource)) {
-      const drainWatcherPath = path2.join(tempDir, DRAIN_WATCHER_BINARY_NAME);
-      fs.copyFileSync(drainWatcherSource, drainWatcherPath);
-      fs.chmodSync(drainWatcherPath, 493);
-    }
     if (includeTLS) {
       const tlsKeygenPath = path2.join(tempDir, TLS_KEYGEN_BINARY_NAME);
       const tlsKeygenSource = findBinary("tls-keygen-linux-amd64");
@@ -1353,13 +884,15 @@ async function setupLayeredBuildDirectory(environmentConfig, layeredDockerfileCo
       }
       fs.copyFileSync(tlsKeygenSource, tlsKeygenPath);
       fs.chmodSync(tlsKeygenPath, 493);
-      const userCaddyfilePath = path2.join(process.cwd(), CADDYFILE_NAME);
-      const destCaddyfilePath = path2.join(tempDir, CADDYFILE_NAME);
-      if (fs.existsSync(userCaddyfilePath)) {
-        fs.copyFileSync(userCaddyfilePath, destCaddyfilePath);
-        fs.chmodSync(destCaddyfilePath, 420);
+      const caddyfilePath = path2.join(process.cwd(), CADDYFILE_NAME);
+      if (fs.existsSync(caddyfilePath)) {
+        const caddyfileContent = fs.readFileSync(caddyfilePath);
+        const destCaddyfilePath = path2.join(tempDir, CADDYFILE_NAME);
+        fs.writeFileSync(destCaddyfilePath, caddyfileContent, { mode: 420 });
       } else {
-        fs.writeFileSync(destCaddyfilePath, getDefaultCaddyfile(), { mode: 420 });
+        throw new Error(
+          "TLS is enabled (DOMAIN is set) but Caddyfile not found. Run configure TLS to set up TLS configuration"
+        );
       }
     }
     return tempDir;
@@ -1427,16 +960,7 @@ async function extractDigestFromSinglePlatform(manifest, imageRef) {
       architecture: inspectData[0].Architecture
     } : null;
     if (!config) {
-      if (manifest.config?.digest) {
-        const digest = hexStringToBytes32(manifest.config.digest);
-        const registry = extractRegistryName(imageRef);
-        return {
-          digest,
-          registry,
-          platform: DOCKER_PLATFORM
-        };
-      }
-      throw new Error(`Could not determine platform for ${imageRef}`);
+      throw createPlatformErrorMessage(imageRef, ["unknown (could not determine architecture)"]);
     }
     const platform2 = `${config.os}/${config.architecture}`;
     if (platform2 === DOCKER_PLATFORM) {
@@ -1508,14 +1032,11 @@ Image: ${imageRef}
 Found platform(s): ${platforms.join(", ")}
 Required platform: ${DOCKER_PLATFORM}
 
-To fix this issue:
-1. Manual fix:
-   a. Rebuild your image with the correct platform:
-      docker build --platform ${DOCKER_PLATFORM} -t ${imageRef} .
-   b. Push the rebuilt image to your remote registry:
-      docker push ${imageRef}
-
-2. Or use the SDK to build with the correct platform automatically.`;
+To fix, either:
+1. Rebuild the image for ${DOCKER_PLATFORM} and push it:
+     docker buildx build --platform ${DOCKER_PLATFORM} -t ${imageRef} --push .
+2. Or use a verifiable build (--verifiable --repo <repo> --commit <sha>), which
+   builds server-side and needs no local Docker.`;
   return new Error(errorMsg);
 }
 
@@ -1620,6 +1141,8 @@ async function prepareRelease(options, logger) {
     logger.info(`Waiting ${REGISTRY_PROPAGATION_WAIT_SECONDS} seconds for registry propagation...`);
     await new Promise((resolve2) => setTimeout(resolve2, REGISTRY_PROPAGATION_WAIT_SECONDS * 1e3));
   } else {
+    logger.info("Verifying image platform (linux/amd64)...");
+    await getImageDigestAndName(imageRef);
     logger.info("Checking if image needs layering...");
     finalImageRef = await layerRemoteImageIfNeeded(
       {
@@ -1778,6 +1301,13 @@ function extractRegistryNameNoDocker(imageRef) {
 import { encodeFunctionData, encodeAbiParameters, decodeErrorResult } from "viem";
 
 // src/client/common/types/index.ts
+var EMPTY_CONTAINER_POLICY = {
+  args: [],
+  cmdOverride: [],
+  env: [],
+  envOverride: [],
+  restartPolicy: ""
+};
 var noopLogger = {
   debug: () => {
   },
@@ -3018,49 +2548,1594 @@ async function executeBatch(options, logger = noopLogger) {
       } else {
         revertReason = callError.message || "Unknown reason";
       }
-    }
-    throw new Error(`Transaction reverted: ${hash}. Reason: ${revertReason}`);
+    }
+    throw new Error(`Transaction reverted: ${hash}. Reason: ${revertReason}`);
+  }
+  return hash;
+}
+
+// src/client/common/contract/caller.ts
+import { encodeFunctionData as encodeFunctionData2, decodeErrorResult as decodeErrorResult2, bytesToHex } from "viem";
+
+// src/client/common/utils/helpers.ts
+import { extractChain, createPublicClient, createWalletClient, http, fallback } from "viem";
+import { sepolia as sepolia2 } from "viem/chains";
+import { privateKeyToAccount } from "viem/accounts";
+function getChainFromID(chainID, fallback2 = sepolia2) {
+  const id = Number(chainID);
+  return extractChain({ chains: SUPPORTED_CHAINS, id }) || fallback2;
+}
+function createClients(options) {
+  const { privateKey, rpcUrl, chainId } = options;
+  const privateKeyHex = addHexPrefix(privateKey);
+  const account = privateKeyToAccount(privateKeyHex);
+  const chain = getChainFromID(chainId);
+  const transport = typeof rpcUrl === "string" ? http(rpcUrl) : fallback(rpcUrl.map((url) => http(url)));
+  const publicClient = createPublicClient({
+    chain,
+    transport
+  });
+  const walletClient = createWalletClient({
+    account,
+    chain,
+    transport
+  });
+  return { walletClient, publicClient };
+}
+function addHexPrefix(value) {
+  return value.startsWith("0x") ? value : `0x${value}`;
+}
+function stripHexPrefix(value) {
+  return value.startsWith("0x") ? value.slice(2) : value;
+}
+
+// src/client/common/abis/AppController.json
+var AppController_default = [
+  {
+    type: "constructor",
+    inputs: [
+      {
+        name: "_version",
+        type: "string",
+        internalType: "string"
+      },
+      {
+        name: "_permissionController",
+        type: "address",
+        internalType: "contractIPermissionController"
+      },
+      {
+        name: "_releaseManager",
+        type: "address",
+        internalType: "contractIReleaseManager"
+      },
+      {
+        name: "_computeAVSRegistrar",
+        type: "address",
+        internalType: "contractIComputeAVSRegistrar"
+      },
+      {
+        name: "_computeOperator",
+        type: "address",
+        internalType: "contractIComputeOperator"
+      },
+      {
+        name: "_appBeacon",
+        type: "address",
+        internalType: "contractIBeacon"
+      }
+    ],
+    stateMutability: "nonpayable"
+  },
+  {
+    type: "function",
+    name: "API_PERMISSION_TYPEHASH",
+    inputs: [],
+    outputs: [
+      {
+        name: "",
+        type: "bytes32",
+        internalType: "bytes32"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "appBeacon",
+    inputs: [],
+    outputs: [
+      {
+        name: "",
+        type: "address",
+        internalType: "contractIBeacon"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "calculateApiPermissionDigestHash",
+    inputs: [
+      {
+        name: "permission",
+        type: "bytes4",
+        internalType: "bytes4"
+      },
+      {
+        name: "expiry",
+        type: "uint256",
+        internalType: "uint256"
+      }
+    ],
+    outputs: [
+      {
+        name: "",
+        type: "bytes32",
+        internalType: "bytes32"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "calculateAppId",
+    inputs: [
+      {
+        name: "deployer",
+        type: "address",
+        internalType: "address"
+      },
+      {
+        name: "salt",
+        type: "bytes32",
+        internalType: "bytes32"
+      }
+    ],
+    outputs: [
+      {
+        name: "",
+        type: "address",
+        internalType: "contractIApp"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "computeAVSRegistrar",
+    inputs: [],
+    outputs: [
+      {
+        name: "",
+        type: "address",
+        internalType: "contractIComputeAVSRegistrar"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "computeOperator",
+    inputs: [],
+    outputs: [
+      {
+        name: "",
+        type: "address",
+        internalType: "contractIComputeOperator"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "confirmUpgrade",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      }
+    ],
+    outputs: [],
+    stateMutability: "nonpayable"
+  },
+  {
+    type: "function",
+    name: "createApp",
+    inputs: [
+      {
+        name: "salt",
+        type: "bytes32",
+        internalType: "bytes32"
+      },
+      {
+        name: "release",
+        type: "tuple",
+        internalType: "structIAppController.Release",
+        components: [
+          {
+            name: "rmsRelease",
+            type: "tuple",
+            internalType: "structIReleaseManagerTypes.Release",
+            components: [
+              {
+                name: "artifacts",
+                type: "tuple[]",
+                internalType: "structIReleaseManagerTypes.Artifact[]",
+                components: [
+                  {
+                    name: "digest",
+                    type: "bytes32",
+                    internalType: "bytes32"
+                  },
+                  {
+                    name: "registry",
+                    type: "string",
+                    internalType: "string"
+                  }
+                ]
+              },
+              {
+                name: "upgradeByTime",
+                type: "uint32",
+                internalType: "uint32"
+              }
+            ]
+          },
+          {
+            name: "publicEnv",
+            type: "bytes",
+            internalType: "bytes"
+          },
+          {
+            name: "encryptedEnv",
+            type: "bytes",
+            internalType: "bytes"
+          },
+          {
+            name: "containerPolicy",
+            type: "tuple",
+            internalType: "structIAppController.ContainerPolicy",
+            components: [
+              {
+                name: "args",
+                type: "string[]",
+                internalType: "string[]"
+              },
+              {
+                name: "cmdOverride",
+                type: "string[]",
+                internalType: "string[]"
+              },
+              {
+                name: "env",
+                type: "tuple[]",
+                internalType: "structIAppController.EnvVar[]",
+                components: [
+                  {
+                    name: "key",
+                    type: "string",
+                    internalType: "string"
+                  },
+                  {
+                    name: "value",
+                    type: "string",
+                    internalType: "string"
+                  }
+                ]
+              },
+              {
+                name: "envOverride",
+                type: "tuple[]",
+                internalType: "structIAppController.EnvVar[]",
+                components: [
+                  {
+                    name: "key",
+                    type: "string",
+                    internalType: "string"
+                  },
+                  {
+                    name: "value",
+                    type: "string",
+                    internalType: "string"
+                  }
+                ]
+              },
+              {
+                name: "restartPolicy",
+                type: "string",
+                internalType: "string"
+              }
+            ]
+          }
+        ]
+      }
+    ],
+    outputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      }
+    ],
+    stateMutability: "nonpayable"
+  },
+  {
+    type: "function",
+    name: "createAppWithIsolatedBilling",
+    inputs: [
+      {
+        name: "salt",
+        type: "bytes32",
+        internalType: "bytes32"
+      },
+      {
+        name: "release",
+        type: "tuple",
+        internalType: "structIAppController.Release",
+        components: [
+          {
+            name: "rmsRelease",
+            type: "tuple",
+            internalType: "structIReleaseManagerTypes.Release",
+            components: [
+              {
+                name: "artifacts",
+                type: "tuple[]",
+                internalType: "structIReleaseManagerTypes.Artifact[]",
+                components: [
+                  {
+                    name: "digest",
+                    type: "bytes32",
+                    internalType: "bytes32"
+                  },
+                  {
+                    name: "registry",
+                    type: "string",
+                    internalType: "string"
+                  }
+                ]
+              },
+              {
+                name: "upgradeByTime",
+                type: "uint32",
+                internalType: "uint32"
+              }
+            ]
+          },
+          {
+            name: "publicEnv",
+            type: "bytes",
+            internalType: "bytes"
+          },
+          {
+            name: "encryptedEnv",
+            type: "bytes",
+            internalType: "bytes"
+          },
+          {
+            name: "containerPolicy",
+            type: "tuple",
+            internalType: "structIAppController.ContainerPolicy",
+            components: [
+              {
+                name: "args",
+                type: "string[]",
+                internalType: "string[]"
+              },
+              {
+                name: "cmdOverride",
+                type: "string[]",
+                internalType: "string[]"
+              },
+              {
+                name: "env",
+                type: "tuple[]",
+                internalType: "structIAppController.EnvVar[]",
+                components: [
+                  {
+                    name: "key",
+                    type: "string",
+                    internalType: "string"
+                  },
+                  {
+                    name: "value",
+                    type: "string",
+                    internalType: "string"
+                  }
+                ]
+              },
+              {
+                name: "envOverride",
+                type: "tuple[]",
+                internalType: "structIAppController.EnvVar[]",
+                components: [
+                  {
+                    name: "key",
+                    type: "string",
+                    internalType: "string"
+                  },
+                  {
+                    name: "value",
+                    type: "string",
+                    internalType: "string"
+                  }
+                ]
+              },
+              {
+                name: "restartPolicy",
+                type: "string",
+                internalType: "string"
+              }
+            ]
+          }
+        ]
+      }
+    ],
+    outputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      }
+    ],
+    stateMutability: "nonpayable"
+  },
+  {
+    type: "function",
+    name: "createEmptyApp",
+    inputs: [
+      {
+        name: "salt",
+        type: "bytes32",
+        internalType: "bytes32"
+      }
+    ],
+    outputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      }
+    ],
+    stateMutability: "nonpayable"
+  },
+  {
+    type: "function",
+    name: "createEmptyAppWithIsolatedBilling",
+    inputs: [
+      {
+        name: "salt",
+        type: "bytes32",
+        internalType: "bytes32"
+      }
+    ],
+    outputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      }
+    ],
+    stateMutability: "nonpayable"
+  },
+  {
+    type: "function",
+    name: "domainSeparator",
+    inputs: [],
+    outputs: [
+      {
+        name: "",
+        type: "bytes32",
+        internalType: "bytes32"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "getActiveAppCount",
+    inputs: [
+      {
+        name: "user",
+        type: "address",
+        internalType: "address"
+      }
+    ],
+    outputs: [
+      {
+        name: "",
+        type: "uint32",
+        internalType: "uint32"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "getAppCreator",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      }
+    ],
+    outputs: [
+      {
+        name: "",
+        type: "address",
+        internalType: "address"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "getAppLatestReleaseBlockNumber",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      }
+    ],
+    outputs: [
+      {
+        name: "",
+        type: "uint32",
+        internalType: "uint32"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "getAppOperatorSetId",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      }
+    ],
+    outputs: [
+      {
+        name: "",
+        type: "uint32",
+        internalType: "uint32"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "getAppPendingReleaseBlockNumber",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      }
+    ],
+    outputs: [
+      {
+        name: "",
+        type: "uint32",
+        internalType: "uint32"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "getAppStatus",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      }
+    ],
+    outputs: [
+      {
+        name: "",
+        type: "uint8",
+        internalType: "enumIAppController.AppStatus"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "getApps",
+    inputs: [
+      {
+        name: "offset",
+        type: "uint256",
+        internalType: "uint256"
+      },
+      {
+        name: "limit",
+        type: "uint256",
+        internalType: "uint256"
+      }
+    ],
+    outputs: [
+      {
+        name: "apps",
+        type: "address[]",
+        internalType: "contractIApp[]"
+      },
+      {
+        name: "appConfigsMem",
+        type: "tuple[]",
+        internalType: "structIAppController.AppConfig[]",
+        components: [
+          {
+            name: "creator",
+            type: "address",
+            internalType: "address"
+          },
+          {
+            name: "operatorSetId",
+            type: "uint32",
+            internalType: "uint32"
+          },
+          {
+            name: "latestReleaseBlockNumber",
+            type: "uint32",
+            internalType: "uint32"
+          },
+          {
+            name: "pendingReleaseBlockNumber",
+            type: "uint32",
+            internalType: "uint32"
+          },
+          {
+            name: "status",
+            type: "uint8",
+            internalType: "enumIAppController.AppStatus"
+          }
+        ]
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "getAppsByBillingAccount",
+    inputs: [
+      {
+        name: "account",
+        type: "address",
+        internalType: "address"
+      },
+      {
+        name: "offset",
+        type: "uint256",
+        internalType: "uint256"
+      },
+      {
+        name: "limit",
+        type: "uint256",
+        internalType: "uint256"
+      }
+    ],
+    outputs: [
+      {
+        name: "apps",
+        type: "address[]",
+        internalType: "contractIApp[]"
+      },
+      {
+        name: "appConfigsMem",
+        type: "tuple[]",
+        internalType: "structIAppController.AppConfig[]",
+        components: [
+          {
+            name: "creator",
+            type: "address",
+            internalType: "address"
+          },
+          {
+            name: "operatorSetId",
+            type: "uint32",
+            internalType: "uint32"
+          },
+          {
+            name: "latestReleaseBlockNumber",
+            type: "uint32",
+            internalType: "uint32"
+          },
+          {
+            name: "pendingReleaseBlockNumber",
+            type: "uint32",
+            internalType: "uint32"
+          },
+          {
+            name: "status",
+            type: "uint8",
+            internalType: "enumIAppController.AppStatus"
+          }
+        ]
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "getAppsByCreator",
+    inputs: [
+      {
+        name: "creator",
+        type: "address",
+        internalType: "address"
+      },
+      {
+        name: "offset",
+        type: "uint256",
+        internalType: "uint256"
+      },
+      {
+        name: "limit",
+        type: "uint256",
+        internalType: "uint256"
+      }
+    ],
+    outputs: [
+      {
+        name: "apps",
+        type: "address[]",
+        internalType: "contractIApp[]"
+      },
+      {
+        name: "appConfigsMem",
+        type: "tuple[]",
+        internalType: "structIAppController.AppConfig[]",
+        components: [
+          {
+            name: "creator",
+            type: "address",
+            internalType: "address"
+          },
+          {
+            name: "operatorSetId",
+            type: "uint32",
+            internalType: "uint32"
+          },
+          {
+            name: "latestReleaseBlockNumber",
+            type: "uint32",
+            internalType: "uint32"
+          },
+          {
+            name: "pendingReleaseBlockNumber",
+            type: "uint32",
+            internalType: "uint32"
+          },
+          {
+            name: "status",
+            type: "uint8",
+            internalType: "enumIAppController.AppStatus"
+          }
+        ]
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "getAppsByDeveloper",
+    inputs: [
+      {
+        name: "developer",
+        type: "address",
+        internalType: "address"
+      },
+      {
+        name: "offset",
+        type: "uint256",
+        internalType: "uint256"
+      },
+      {
+        name: "limit",
+        type: "uint256",
+        internalType: "uint256"
+      }
+    ],
+    outputs: [
+      {
+        name: "apps",
+        type: "address[]",
+        internalType: "contractIApp[]"
+      },
+      {
+        name: "appConfigsMem",
+        type: "tuple[]",
+        internalType: "structIAppController.AppConfig[]",
+        components: [
+          {
+            name: "creator",
+            type: "address",
+            internalType: "address"
+          },
+          {
+            name: "operatorSetId",
+            type: "uint32",
+            internalType: "uint32"
+          },
+          {
+            name: "latestReleaseBlockNumber",
+            type: "uint32",
+            internalType: "uint32"
+          },
+          {
+            name: "pendingReleaseBlockNumber",
+            type: "uint32",
+            internalType: "uint32"
+          },
+          {
+            name: "status",
+            type: "uint8",
+            internalType: "enumIAppController.AppStatus"
+          }
+        ]
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "getBillingAccount",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      }
+    ],
+    outputs: [
+      {
+        name: "",
+        type: "address",
+        internalType: "address"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "getBillingType",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      }
+    ],
+    outputs: [
+      {
+        name: "",
+        type: "uint8",
+        internalType: "enumIAppController.BillingType"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "getMaxActiveAppsPerUser",
+    inputs: [
+      {
+        name: "user",
+        type: "address",
+        internalType: "address"
+      }
+    ],
+    outputs: [
+      {
+        name: "",
+        type: "uint32",
+        internalType: "uint32"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "globalActiveAppCount",
+    inputs: [],
+    outputs: [
+      {
+        name: "",
+        type: "uint32",
+        internalType: "uint32"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "initialize",
+    inputs: [
+      {
+        name: "admin",
+        type: "address",
+        internalType: "address"
+      }
+    ],
+    outputs: [],
+    stateMutability: "nonpayable"
+  },
+  {
+    type: "function",
+    name: "maxGlobalActiveApps",
+    inputs: [],
+    outputs: [
+      {
+        name: "",
+        type: "uint32",
+        internalType: "uint32"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "permissionController",
+    inputs: [],
+    outputs: [
+      {
+        name: "",
+        type: "address",
+        internalType: "contractIPermissionController"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "releaseManager",
+    inputs: [],
+    outputs: [
+      {
+        name: "",
+        type: "address",
+        internalType: "contractIReleaseManager"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "setMaxActiveAppsPerUser",
+    inputs: [
+      {
+        name: "user",
+        type: "address",
+        internalType: "address"
+      },
+      {
+        name: "limit",
+        type: "uint32",
+        internalType: "uint32"
+      }
+    ],
+    outputs: [],
+    stateMutability: "nonpayable"
+  },
+  {
+    type: "function",
+    name: "setMaxGlobalActiveApps",
+    inputs: [
+      {
+        name: "limit",
+        type: "uint32",
+        internalType: "uint32"
+      }
+    ],
+    outputs: [],
+    stateMutability: "nonpayable"
+  },
+  {
+    type: "function",
+    name: "startApp",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      }
+    ],
+    outputs: [],
+    stateMutability: "nonpayable"
+  },
+  {
+    type: "function",
+    name: "stopApp",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      }
+    ],
+    outputs: [],
+    stateMutability: "nonpayable"
+  },
+  {
+    type: "function",
+    name: "suspend",
+    inputs: [
+      {
+        name: "account",
+        type: "address",
+        internalType: "address"
+      },
+      {
+        name: "apps",
+        type: "address[]",
+        internalType: "contractIApp[]"
+      }
+    ],
+    outputs: [],
+    stateMutability: "nonpayable"
+  },
+  {
+    type: "function",
+    name: "terminateApp",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      }
+    ],
+    outputs: [],
+    stateMutability: "nonpayable"
+  },
+  {
+    type: "function",
+    name: "terminateAppByAdmin",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      }
+    ],
+    outputs: [],
+    stateMutability: "nonpayable"
+  },
+  {
+    type: "function",
+    name: "updateAppMetadataURI",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      },
+      {
+        name: "metadataURI",
+        type: "string",
+        internalType: "string"
+      }
+    ],
+    outputs: [],
+    stateMutability: "nonpayable"
+  },
+  {
+    type: "function",
+    name: "upgradeApp",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        internalType: "contractIApp"
+      },
+      {
+        name: "release",
+        type: "tuple",
+        internalType: "structIAppController.Release",
+        components: [
+          {
+            name: "rmsRelease",
+            type: "tuple",
+            internalType: "structIReleaseManagerTypes.Release",
+            components: [
+              {
+                name: "artifacts",
+                type: "tuple[]",
+                internalType: "structIReleaseManagerTypes.Artifact[]",
+                components: [
+                  {
+                    name: "digest",
+                    type: "bytes32",
+                    internalType: "bytes32"
+                  },
+                  {
+                    name: "registry",
+                    type: "string",
+                    internalType: "string"
+                  }
+                ]
+              },
+              {
+                name: "upgradeByTime",
+                type: "uint32",
+                internalType: "uint32"
+              }
+            ]
+          },
+          {
+            name: "publicEnv",
+            type: "bytes",
+            internalType: "bytes"
+          },
+          {
+            name: "encryptedEnv",
+            type: "bytes",
+            internalType: "bytes"
+          },
+          {
+            name: "containerPolicy",
+            type: "tuple",
+            internalType: "structIAppController.ContainerPolicy",
+            components: [
+              {
+                name: "args",
+                type: "string[]",
+                internalType: "string[]"
+              },
+              {
+                name: "cmdOverride",
+                type: "string[]",
+                internalType: "string[]"
+              },
+              {
+                name: "env",
+                type: "tuple[]",
+                internalType: "structIAppController.EnvVar[]",
+                components: [
+                  {
+                    name: "key",
+                    type: "string",
+                    internalType: "string"
+                  },
+                  {
+                    name: "value",
+                    type: "string",
+                    internalType: "string"
+                  }
+                ]
+              },
+              {
+                name: "envOverride",
+                type: "tuple[]",
+                internalType: "structIAppController.EnvVar[]",
+                components: [
+                  {
+                    name: "key",
+                    type: "string",
+                    internalType: "string"
+                  },
+                  {
+                    name: "value",
+                    type: "string",
+                    internalType: "string"
+                  }
+                ]
+              },
+              {
+                name: "restartPolicy",
+                type: "string",
+                internalType: "string"
+              }
+            ]
+          }
+        ]
+      }
+    ],
+    outputs: [
+      {
+        name: "",
+        type: "uint256",
+        internalType: "uint256"
+      }
+    ],
+    stateMutability: "nonpayable"
+  },
+  {
+    type: "function",
+    name: "version",
+    inputs: [],
+    outputs: [
+      {
+        name: "",
+        type: "string",
+        internalType: "string"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "event",
+    name: "AppCreated",
+    inputs: [
+      {
+        name: "creator",
+        type: "address",
+        indexed: true,
+        internalType: "address"
+      },
+      {
+        name: "app",
+        type: "address",
+        indexed: true,
+        internalType: "contractIApp"
+      },
+      {
+        name: "operatorSetId",
+        type: "uint32",
+        indexed: false,
+        internalType: "uint32"
+      }
+    ],
+    anonymous: false
+  },
+  {
+    type: "event",
+    name: "AppMetadataURIUpdated",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        indexed: true,
+        internalType: "contractIApp"
+      },
+      {
+        name: "metadataURI",
+        type: "string",
+        indexed: false,
+        internalType: "string"
+      }
+    ],
+    anonymous: false
+  },
+  {
+    type: "event",
+    name: "AppStarted",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        indexed: true,
+        internalType: "contractIApp"
+      }
+    ],
+    anonymous: false
+  },
+  {
+    type: "event",
+    name: "AppStopped",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        indexed: true,
+        internalType: "contractIApp"
+      }
+    ],
+    anonymous: false
+  },
+  {
+    type: "event",
+    name: "AppSuspended",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        indexed: true,
+        internalType: "contractIApp"
+      }
+    ],
+    anonymous: false
+  },
+  {
+    type: "event",
+    name: "AppTerminated",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        indexed: true,
+        internalType: "contractIApp"
+      }
+    ],
+    anonymous: false
+  },
+  {
+    type: "event",
+    name: "AppTerminatedByAdmin",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        indexed: true,
+        internalType: "contractIApp"
+      }
+    ],
+    anonymous: false
+  },
+  {
+    type: "event",
+    name: "AppUpgraded",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        indexed: true,
+        internalType: "contractIApp"
+      },
+      {
+        name: "rmsReleaseId",
+        type: "uint256",
+        indexed: false,
+        internalType: "uint256"
+      },
+      {
+        name: "release",
+        type: "tuple",
+        indexed: false,
+        internalType: "structIAppController.Release",
+        components: [
+          {
+            name: "rmsRelease",
+            type: "tuple",
+            internalType: "structIReleaseManagerTypes.Release",
+            components: [
+              {
+                name: "artifacts",
+                type: "tuple[]",
+                internalType: "structIReleaseManagerTypes.Artifact[]",
+                components: [
+                  {
+                    name: "digest",
+                    type: "bytes32",
+                    internalType: "bytes32"
+                  },
+                  {
+                    name: "registry",
+                    type: "string",
+                    internalType: "string"
+                  }
+                ]
+              },
+              {
+                name: "upgradeByTime",
+                type: "uint32",
+                internalType: "uint32"
+              }
+            ]
+          },
+          {
+            name: "publicEnv",
+            type: "bytes",
+            internalType: "bytes"
+          },
+          {
+            name: "encryptedEnv",
+            type: "bytes",
+            internalType: "bytes"
+          },
+          {
+            name: "containerPolicy",
+            type: "tuple",
+            internalType: "structIAppController.ContainerPolicy",
+            components: [
+              {
+                name: "args",
+                type: "string[]",
+                internalType: "string[]"
+              },
+              {
+                name: "cmdOverride",
+                type: "string[]",
+                internalType: "string[]"
+              },
+              {
+                name: "env",
+                type: "tuple[]",
+                internalType: "structIAppController.EnvVar[]",
+                components: [
+                  {
+                    name: "key",
+                    type: "string",
+                    internalType: "string"
+                  },
+                  {
+                    name: "value",
+                    type: "string",
+                    internalType: "string"
+                  }
+                ]
+              },
+              {
+                name: "envOverride",
+                type: "tuple[]",
+                internalType: "structIAppController.EnvVar[]",
+                components: [
+                  {
+                    name: "key",
+                    type: "string",
+                    internalType: "string"
+                  },
+                  {
+                    name: "value",
+                    type: "string",
+                    internalType: "string"
+                  }
+                ]
+              },
+              {
+                name: "restartPolicy",
+                type: "string",
+                internalType: "string"
+              }
+            ]
+          }
+        ]
+      }
+    ],
+    anonymous: false
+  },
+  {
+    type: "event",
+    name: "GlobalMaxActiveAppsSet",
+    inputs: [
+      {
+        name: "limit",
+        type: "uint32",
+        indexed: false,
+        internalType: "uint32"
+      }
+    ],
+    anonymous: false
+  },
+  {
+    type: "event",
+    name: "Initialized",
+    inputs: [
+      {
+        name: "version",
+        type: "uint8",
+        indexed: false,
+        internalType: "uint8"
+      }
+    ],
+    anonymous: false
+  },
+  {
+    type: "event",
+    name: "MaxActiveAppsSet",
+    inputs: [
+      {
+        name: "user",
+        type: "address",
+        indexed: true,
+        internalType: "address"
+      },
+      {
+        name: "limit",
+        type: "uint32",
+        indexed: false,
+        internalType: "uint32"
+      }
+    ],
+    anonymous: false
+  },
+  {
+    type: "event",
+    name: "UpgradeConfirmed",
+    inputs: [
+      {
+        name: "app",
+        type: "address",
+        indexed: true,
+        internalType: "contractIApp"
+      },
+      {
+        name: "pendingReleaseBlockNumber",
+        type: "uint32",
+        indexed: false,
+        internalType: "uint32"
+      }
+    ],
+    anonymous: false
+  },
+  {
+    type: "error",
+    name: "AccountHasActiveApps",
+    inputs: []
+  },
+  {
+    type: "error",
+    name: "AppAlreadyExists",
+    inputs: []
+  },
+  {
+    type: "error",
+    name: "AppDoesNotExist",
+    inputs: []
+  },
+  {
+    type: "error",
+    name: "GlobalMaxActiveAppsExceeded",
+    inputs: []
+  },
+  {
+    type: "error",
+    name: "InvalidAppStatus",
+    inputs: []
+  },
+  {
+    type: "error",
+    name: "InvalidPermissions",
+    inputs: []
+  },
+  {
+    type: "error",
+    name: "InvalidReleaseMetadataURI",
+    inputs: []
+  },
+  {
+    type: "error",
+    name: "InvalidShortString",
+    inputs: []
+  },
+  {
+    type: "error",
+    name: "InvalidSignature",
+    inputs: []
+  },
+  {
+    type: "error",
+    name: "MaxActiveAppsExceeded",
+    inputs: []
+  },
+  {
+    type: "error",
+    name: "MoreThanOneArtifact",
+    inputs: []
+  },
+  {
+    type: "error",
+    name: "NoPendingUpgrade",
+    inputs: []
+  },
+  {
+    type: "error",
+    name: "SignatureExpired",
+    inputs: []
+  },
+  {
+    type: "error",
+    name: "StringTooLong",
+    inputs: [
+      {
+        name: "str",
+        type: "string",
+        internalType: "string"
+      }
+    ]
   }
-  return hash;
-}
-
-// src/client/common/contract/caller.ts
-import { encodeFunctionData as encodeFunctionData2, decodeErrorResult as decodeErrorResult2, bytesToHex } from "viem";
-
-// src/client/common/utils/helpers.ts
-import { extractChain, createPublicClient, createWalletClient, http, fallback } from "viem";
-import { sepolia as sepolia2 } from "viem/chains";
-import { privateKeyToAccount } from "viem/accounts";
-function getChainFromID(chainID, fallback2 = sepolia2) {
-  const id = Number(chainID);
-  return extractChain({ chains: SUPPORTED_CHAINS, id }) || fallback2;
-}
-function createClients(options) {
-  const { privateKey, rpcUrl, chainId } = options;
-  const privateKeyHex = addHexPrefix(privateKey);
-  const account = privateKeyToAccount(privateKeyHex);
-  const chain = getChainFromID(chainId);
-  const transport = typeof rpcUrl === "string" ? http(rpcUrl) : fallback(rpcUrl.map((url) => http(url)));
-  const publicClient = createPublicClient({
-    chain,
-    transport
-  });
-  const walletClient = createWalletClient({
-    account,
-    chain,
-    transport
-  });
-  return { walletClient, publicClient };
-}
-function addHexPrefix(value) {
-  return value.startsWith("0x") ? value : `0x${value}`;
-}
-function stripHexPrefix(value) {
-  return value.startsWith("0x") ? value.slice(2) : value;
-}
+];
 
-// src/client/common/abis/AppController.json
-var AppController_default = [
+// src/client/common/abis/AppController.v1_4.json
+var AppController_v1_4_default = [
   {
     type: "constructor",
     inputs: [
@@ -4744,6 +5819,38 @@ var PermissionController_default = [
 ];
 
 // src/client/common/contract/caller.ts
+function appControllerAbiFor(environmentConfig) {
+  return environmentConfig.releaseAbiVersion === "v1.4" ? AppController_v1_4_default : AppController_default;
+}
+function supportsContainerPolicy(environmentConfig) {
+  return environmentConfig.releaseAbiVersion !== "v1.4";
+}
+function containerPolicyForViem(policy = EMPTY_CONTAINER_POLICY) {
+  return {
+    args: policy.args,
+    cmdOverride: policy.cmdOverride,
+    env: policy.env.map((e) => ({ key: e.key, value: e.value })),
+    envOverride: policy.envOverride.map((e) => ({ key: e.key, value: e.value })),
+    restartPolicy: policy.restartPolicy
+  };
+}
+function releaseForViem(release, environmentConfig) {
+  const base = {
+    rmsRelease: {
+      artifacts: release.rmsRelease.artifacts.map((artifact) => ({
+        digest: `0x${bytesToHex(artifact.digest).slice(2).padStart(64, "0")}`,
+        registry: artifact.registry
+      })),
+      upgradeByTime: release.rmsRelease.upgradeByTime
+    },
+    publicEnv: bytesToHex(release.publicEnv),
+    encryptedEnv: bytesToHex(release.encryptedEnv)
+  };
+  if (!supportsContainerPolicy(environmentConfig)) {
+    return base;
+  }
+  return { ...base, containerPolicy: containerPolicyForViem(release.containerPolicy) };
+}
 function formatETH(wei) {
   const eth = Number(wei) / 1e18;
   const costStr = eth.toFixed(6);
@@ -4781,7 +5888,7 @@ async function calculateAppID(options) {
   const saltHex = `0x${paddedSaltHex}`;
   const appID = await publicClient.readContract({
     address: environmentConfig.appControllerAddress,
-    abi: AppController_default,
+    abi: appControllerAbiFor(environmentConfig),
     functionName: "calculateAppId",
     args: [ownerAddress, saltHex]
   });
@@ -4805,22 +5912,12 @@ async function prepareDeployBatch(options, logger = noopLogger) {
   const saltHexString = bytesToHex(salt).slice(2);
   const paddedSaltHex = saltHexString.padStart(64, "0");
   const saltHex = `0x${paddedSaltHex}`;
-  const releaseForViem = {
-    rmsRelease: {
-      artifacts: release.rmsRelease.artifacts.map((artifact) => ({
-        digest: `0x${bytesToHex(artifact.digest).slice(2).padStart(64, "0")}`,
-        registry: artifact.registry
-      })),
-      upgradeByTime: release.rmsRelease.upgradeByTime
-    },
-    publicEnv: bytesToHex(release.publicEnv),
-    encryptedEnv: bytesToHex(release.encryptedEnv)
-  };
+  const release_ = releaseForViem(release, environmentConfig);
   const functionName = options.billTo === "app" ? "createAppWithIsolatedBilling" : "createApp";
   const createData = encodeFunctionData2({
-    abi: AppController_default,
+    abi: appControllerAbiFor(environmentConfig),
     functionName,
-    args: [saltHex, releaseForViem]
+    args: [saltHex, release_]
   });
   const acceptAdminData = encodeFunctionData2({
     abi: PermissionController_default,
@@ -4908,21 +6005,11 @@ async function prepareUpgradeBatch(options) {
     publicLogs,
     needsPermissionChange
   } = options;
-  const releaseForViem = {
-    rmsRelease: {
-      artifacts: release.rmsRelease.artifacts.map((artifact) => ({
-        digest: `0x${bytesToHex(artifact.digest).slice(2).padStart(64, "0")}`,
-        registry: artifact.registry
-      })),
-      upgradeByTime: release.rmsRelease.upgradeByTime
-    },
-    publicEnv: bytesToHex(release.publicEnv),
-    encryptedEnv: bytesToHex(release.encryptedEnv)
-  };
+  const release_ = releaseForViem(release, environmentConfig);
   const upgradeData = encodeFunctionData2({
-    abi: AppController_default,
+    abi: appControllerAbiFor(environmentConfig),
     functionName: "upgradeApp",
-    args: [appID, releaseForViem]
+    args: [appID, release_]
   });
   const executions = [
     {
@@ -5056,7 +6143,7 @@ ${pendingMessage}`);
       if (callError.data) {
         try {
           const decoded = decodeErrorResult2({
-            abi: AppController_default,
+            abi: appControllerAbiFor(environmentConfig),
             data: callError.data
           });
           const formattedError = formatAppControllerError(decoded);
@@ -5109,7 +6196,7 @@ function formatAppControllerError(decoded) {
 async function getActiveAppCount(publicClient, environmentConfig, user) {
   const count = await publicClient.readContract({
     address: environmentConfig.appControllerAddress,
-    abi: AppController_default,
+    abi: appControllerAbiFor(environmentConfig),
     functionName: "getActiveAppCount",
     args: [user]
   });
@@ -5118,7 +6205,7 @@ async function getActiveAppCount(publicClient, environmentConfig, user) {
 async function getMaxActiveAppsPerUser(publicClient, environmentConfig, user) {
   const quota = await publicClient.readContract({
     address: environmentConfig.appControllerAddress,
-    abi: AppController_default,
+    abi: appControllerAbiFor(environmentConfig),
     functionName: "getMaxActiveAppsPerUser",
     args: [user]
   });
@@ -5127,7 +6214,7 @@ async function getMaxActiveAppsPerUser(publicClient, environmentConfig, user) {
 async function getAppsByDeveloper(publicClient, environmentConfig, developer, offset, limit) {
   const result = await publicClient.readContract({
     address: environmentConfig.appControllerAddress,
-    abi: AppController_default,
+    abi: appControllerAbiFor(environmentConfig),
     functionName: "getAppsByDeveloper",
     args: [developer, offset, limit]
   });
@@ -5139,7 +6226,7 @@ async function getAppsByDeveloper(publicClient, environmentConfig, developer, of
 async function getBillingType(publicClient, environmentConfig, app) {
   const result = await publicClient.readContract({
     address: environmentConfig.appControllerAddress,
-    abi: AppController_default,
+    abi: appControllerAbiFor(environmentConfig),
     functionName: "getBillingType",
     args: [app]
   });
@@ -5148,7 +6235,7 @@ async function getBillingType(publicClient, environmentConfig, app) {
 async function getAppsByBillingAccount(publicClient, environmentConfig, account, offset, limit) {
   const result = await publicClient.readContract({
     address: environmentConfig.appControllerAddress,
-    abi: AppController_default,
+    abi: appControllerAbiFor(environmentConfig),
     functionName: "getAppsByBillingAccount",
     args: [account, offset, limit]
   });
@@ -5182,7 +6269,7 @@ async function getAppLatestReleaseBlockNumbers(publicClient, environmentConfig,
     appIDs.map(
       (appID) => publicClient.readContract({
         address: environmentConfig.appControllerAddress,
-        abi: AppController_default,
+        abi: appControllerAbiFor(environmentConfig),
         functionName: "getAppLatestReleaseBlockNumber",
         args: [appID]
       }).catch(() => null)
@@ -5261,6 +6348,35 @@ async function undelegate(options, logger = noopLogger) {
   return hash;
 }
 
+// src/client/common/gas/insufficientGas.ts
+import { formatEther } from "viem";
+var InsufficientGasError = class extends Error {
+  constructor(args) {
+    const requiredEth = formatEther(args.requiredWei);
+    const availableEth = formatEther(args.availableWei);
+    super(
+      `Insufficient ETH for gas: wallet ${args.address} has ${availableEth} ETH but this transaction needs ~${requiredEth} ETH.
+Compute credits do not pay on-chain gas \u2014 fund the wallet with ETH and retry.`
+    );
+    this.name = "InsufficientGasError";
+    this.address = args.address;
+    this.requiredWei = args.requiredWei;
+    this.availableWei = args.availableWei;
+    this.requiredEth = requiredEth;
+    this.availableEth = availableEth;
+  }
+};
+async function assertSufficientGas(args) {
+  const availableWei = await args.publicClient.getBalance({ address: args.address });
+  if (availableWei < args.gasEstimate.maxCostWei) {
+    throw new InsufficientGasError({
+      address: args.address,
+      requiredWei: args.gasEstimate.maxCostWei,
+      availableWei
+    });
+  }
+}
+
 // src/client/common/utils/userapi.ts
 import axios2 from "axios";
 
@@ -5324,6 +6440,7 @@ import axios from "axios";
 var MAX_RETRIES = 5;
 var INITIAL_BACKOFF_MS = 1e3;
 var MAX_BACKOFF_MS = 3e4;
+var RETRYABLE_STATUSES = /* @__PURE__ */ new Set([429, 502, 503, 504]);
 function sleep(ms) {
   return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
@@ -5343,7 +6460,7 @@ async function requestWithRetry(config) {
   for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
     const res = await axios({ ...config, validateStatus: () => true });
     lastResponse = res;
-    if (res.status !== 429) {
+    if (!RETRYABLE_STATUSES.has(res.status)) {
       return res;
     }
     if (attempt < MAX_RETRIES) {
@@ -5372,7 +6489,7 @@ var CanViewAppLogsPermission = "0x2fd3f2fe";
 var CanViewSensitiveAppInfoPermission = "0x0e67b22f";
 var CanUpdateAppProfilePermission = "0x036fef61";
 function getDefaultClientId() {
-  const version = true ? "1.0.0-devep8" : "0.0.0";
+  const version = true ? "1.0.0" : "0.0.0";
   return `ecloud-sdk/v${version}`;
 }
 var UserApiClient = class {
@@ -5407,7 +6524,6 @@ var UserApiClient = class {
         status: app.app_status,
         ip: app.ip,
         machineType: app.machine_type,
-        hostname: app.hostname,
         profile: app.profile,
         metrics: app.metrics,
         evmAddresses,
@@ -5473,28 +6589,6 @@ var UserApiClient = class {
       status: app.app_status || app.App_Status || ""
     }));
   }
-  /**
-   * Get deployments for an app from the gRPC-gateway endpoint.
-   * Returns deployment records including upgrade_phase for tracking upgrade progress.
-   *
-   * Endpoint: GET /v1/apps/:appAddress/deployments
-   */
-  async getDeployments(appAddress) {
-    const endpoint = `${this.config.userApiServerURL}/v1/apps/${appAddress}/deployments`;
-    const response = await this.makeEIP712AuthenticatedRequest(endpoint);
-    const result = await response.json();
-    const deployments = result.deployments || [];
-    return deployments.map((dep) => ({
-      id: dep.id || "",
-      externalId: dep.external_id || dep.externalId || "",
-      endpoint: dep.endpoint || "",
-      releaseId: dep.release_id || dep.releaseId || "",
-      upgradePhase: dep.upgrade_phase || dep.upgradePhase || "",
-      replacesDeploymentId: dep.replaces_deployment_id || dep.replacesDeploymentId || "",
-      createdAt: dep.created_at || dep.createdAt || "",
-      updatedAt: dep.updated_at || dep.updatedAt || ""
-    }));
-  }
   /**
    * Upload app profile information with optional image
    *
@@ -5628,48 +6722,6 @@ Please check:
       "X-eigenx-expiry": expiry.toString()
     };
   }
-  /**
-   * Make an EIP-712 authenticated request to the gRPC-gateway endpoints.
-   * Uses the billing/compute auth pattern: Authorization + X-Account + X-Expiry headers.
-   */
-  async makeEIP712AuthenticatedRequest(url) {
-    const expiry = BigInt(Math.floor(Date.now() / 1e3) + 5 * 60);
-    const { signature } = await calculateBillingAuthSignature({
-      walletClient: this.walletClient,
-      product: "compute",
-      expiry
-    });
-    const headers = {
-      Authorization: `Bearer ${signature}`,
-      "X-Account": this.address,
-      "X-Expiry": expiry.toString(),
-      "x-client-id": this.clientId
-    };
-    try {
-      const response = await requestWithRetry({
-        method: "GET",
-        url,
-        headers,
-        maxRedirects: 0,
-        withCredentials: true
-      });
-      const status = response.status;
-      if (status < 200 || status >= 300) {
-        const body = typeof response.data === "string" ? response.data : JSON.stringify(response.data);
-        throw new Error(`gRPC-gateway request failed: ${status} - ${body}`);
-      }
-      return {
-        json: async () => response.data,
-        text: async () => typeof response.data === "string" ? response.data : JSON.stringify(response.data)
-      };
-    } catch (error) {
-      if (error.message?.includes("fetch failed") || error.message?.includes("ECONNREFUSED") || error.message?.includes("ENOTFOUND") || error.cause) {
-        const cause = error.cause?.message || error.cause || error.message;
-        throw new Error(`Failed to connect to API at ${url}: ${cause}`);
-      }
-      throw error;
-    }
-  }
   // ==========================================================================
   // SIWE Session Management
   // ==========================================================================
@@ -5775,8 +6827,36 @@ function transformAppRelease(raw) {
 
 // src/client/common/contract/watcher.ts
 var WATCH_POLL_INTERVAL_SECONDS = 5;
+var WATCH_HEARTBEAT_INTERVAL_SECONDS = 30;
+var WATCH_DEFAULT_TIMEOUT_SECONDS = 10 * 60;
 var APP_STATUS_RUNNING = "Running";
 var APP_STATUS_FAILED = "Failed";
+var WatchTimeoutError = class extends Error {
+  constructor(args) {
+    super(
+      args.message ?? `Timed out after ${args.elapsedSeconds}s waiting for app ${args.appId} (last status: ${args.lastStatus ?? "unknown"})`
+    );
+    this.name = "WatchTimeoutError";
+    this.appId = args.appId;
+    this.elapsedSeconds = args.elapsedSeconds;
+    this.lastStatus = args.lastStatus;
+    this.timeoutSeconds = args.timeoutSeconds;
+  }
+};
+function resolveWatchTimeoutSeconds(explicit) {
+  if (typeof explicit === "number" && Number.isFinite(explicit) && explicit > 0) {
+    return Math.floor(explicit);
+  }
+  const raw = process.env.ECLOUD_WATCH_TIMEOUT_SECONDS;
+  if (raw === void 0 || raw === "") {
+    return WATCH_DEFAULT_TIMEOUT_SECONDS;
+  }
+  const parsed = Number(raw);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    return WATCH_DEFAULT_TIMEOUT_SECONDS;
+  }
+  return Math.floor(parsed);
+}
 async function watchUntilRunning(options, logger) {
   const { walletClient, publicClient, environmentConfig, appId } = options;
   const userApiClient = new UserApiClient(environmentConfig, walletClient, publicClient);
@@ -5807,8 +6887,20 @@ async function watchUntilRunning(options, logger) {
     return false;
   };
   const startTime = Date.now();
+  const timeoutSeconds = resolveWatchTimeoutSeconds(options.timeoutSeconds);
   let lastLoggedStatus;
+  let lastHeartbeatAt = startTime;
   while (true) {
+    const elapsedMs = Date.now() - startTime;
+    const elapsed = Math.round(elapsedMs / 1e3);
+    if (elapsed >= timeoutSeconds) {
+      throw new WatchTimeoutError({
+        appId,
+        elapsedSeconds: elapsed,
+        lastStatus: lastLoggedStatus,
+        timeoutSeconds
+      });
+    }
     try {
       const info = await userApiClient.getInfos([appId], 1);
       if (info.length === 0) {
@@ -5818,62 +6910,35 @@ async function watchUntilRunning(options, logger) {
       const appInfo = info[0];
       const currentStatus = appInfo.status;
       const currentIP = appInfo.ip || "";
-      const elapsed = Math.round((Date.now() - startTime) / 1e3);
       if (currentStatus !== lastLoggedStatus) {
         logger.info(`Status: ${currentStatus} (${elapsed}s)`);
         lastLoggedStatus = currentStatus;
+        lastHeartbeatAt = Date.now();
+      } else if (Date.now() - lastHeartbeatAt >= WATCH_HEARTBEAT_INTERVAL_SECONDS * 1e3) {
+        logger.info(`Status: ${currentStatus} (${elapsed}s)`);
+        lastHeartbeatAt = Date.now();
       }
       if (stopCondition(currentStatus, currentIP)) {
         return currentIP || void 0;
       }
       await sleep2(WATCH_POLL_INTERVAL_SECONDS * 1e3);
     } catch (error) {
+      if (error instanceof WatchTimeoutError) {
+        throw error;
+      }
       logger.warn(`Failed to fetch app info: ${error.message}`);
       await sleep2(WATCH_POLL_INTERVAL_SECONDS * 1e3);
     }
   }
 }
 var APP_STATUS_STOPPED = "Stopped";
-var UPGRADE_PHASE_LABELS = {
-  provisioning: "Provisioning new instance",
-  health_check: "Running health checks",
-  draining: "Switching traffic & draining old instance",
-  complete: "Complete",
-  rolling_back: "Rolling back",
-  rollback_done: "Rollback complete",
-  db_handoff: "Database handoff",
-  // Prewarm-detach phases
-  awaiting_userdata: "Waiting for instance readiness",
-  draining_old: "Draining old instance",
-  detached: "Detaching storage",
-  attached_to_new: "Attaching storage to new instance",
-  finalizing: "Finalizing new instance",
-  flipping: "Switching traffic",
-  teardown_old: "Cleaning up old instance"
-};
-async function fetchUpgradePhase(userApiClient, appId) {
-  try {
-    const deployments = await userApiClient.getDeployments(appId);
-    if (deployments.length === 0) return void 0;
-    const sorted = [...deployments].sort((a, b) => {
-      const ta = a.createdAt ? new Date(a.createdAt).getTime() : 0;
-      const tb = b.createdAt ? new Date(b.createdAt).getTime() : 0;
-      return tb - ta;
-    });
-    return sorted[0].upgradePhase || void 0;
-  } catch {
-    return void 0;
-  }
-}
 async function watchUntilUpgradeComplete(options, logger) {
   const { walletClient, publicClient, environmentConfig, appId } = options;
+  const timeoutSeconds = resolveWatchTimeoutSeconds(options.timeoutSeconds);
   const userApiClient = new UserApiClient(environmentConfig, walletClient, publicClient);
   let initialStatus;
   let initialIP;
   let hasChanged = false;
-  const startTime = Date.now();
-  let lastLoggedStatus;
-  let lastLoggedPhase;
   const stopCondition = (status, ip) => {
     if (!initialStatus) {
       initialStatus = status;
@@ -5907,37 +6972,44 @@ async function watchUntilUpgradeComplete(options, logger) {
     }
     return false;
   };
+  const startTime = Date.now();
+  const deadline = startTime + timeoutSeconds * 1e3;
+  let lastLoggedStatus;
+  let lastObservedStatus;
   while (true) {
+    if (Date.now() >= deadline) {
+      const elapsedSeconds = Math.round((Date.now() - startTime) / 1e3);
+      throw new WatchTimeoutError({
+        appId,
+        lastStatus: lastObservedStatus,
+        elapsedSeconds,
+        timeoutSeconds
+      });
+    }
     try {
-      const [infoResult, upgradePhase] = await Promise.all([
-        userApiClient.getInfos([appId], 1),
-        fetchUpgradePhase(userApiClient, appId)
-      ]);
-      if (infoResult.length === 0) {
+      const info = await userApiClient.getInfos([appId], 1);
+      if (info.length === 0) {
         await sleep2(WATCH_POLL_INTERVAL_SECONDS * 1e3);
         continue;
       }
-      const appInfo = infoResult[0];
+      const appInfo = info[0];
       const currentStatus = appInfo.status;
       const currentIP = appInfo.ip || "";
+      lastObservedStatus = currentStatus;
       const elapsed = Math.round((Date.now() - startTime) / 1e3);
-      if (upgradePhase && upgradePhase !== lastLoggedPhase) {
-        const label = UPGRADE_PHASE_LABELS[upgradePhase] || upgradePhase;
-        logger.info(`Phase: ${label} (${elapsed}s)`);
-        lastLoggedPhase = upgradePhase;
-      }
-      if (!upgradePhase && currentStatus !== lastLoggedStatus) {
+      if (currentStatus !== lastLoggedStatus) {
         logger.info(`Status: ${currentStatus} (${elapsed}s)`);
         lastLoggedStatus = currentStatus;
       }
       if (stopCondition(currentStatus, currentIP)) {
-        const totalElapsed = Math.round((Date.now() - startTime) / 1e3);
-        logger.info(`Upgrade completed in ${totalElapsed}s`);
         return;
       }
       await sleep2(WATCH_POLL_INTERVAL_SECONDS * 1e3);
     } catch (error) {
-      if (error.message?.includes("entered")) {
+      if (error instanceof WatchTimeoutError) {
+        throw error;
+      }
+      if (typeof error?.message === "string" && error.message.includes("Failed")) {
         throw error;
       }
       logger.warn(`Failed to fetch app info: ${error.message}`);
@@ -6268,14 +7340,13 @@ var BILLING_ENVIRONMENTS = {
     billingApiServerURL: "https://billingapi.eigencloud.xyz"
   }
 };
-var PLATFORM_ENV_TESTNET_SEPOLIA = "testnet-sepolia";
-var PLATFORM_ENV_MAINNET_ETHEREUM = "mainnet-ethereum";
-var DEFAULT_APP_BASE_DOMAIN = "eigencloud.xyz";
 var ENVIRONMENTS = {
   "sepolia-dev": {
     name: "sepolia",
     build: "dev",
     appControllerAddress: "0xa86DC1C47cb2518327fB4f9A1627F51966c83B92",
+    releaseAbiVersion: "v1.5",
+    // AppController upgraded to v1.5.x (containerPolicy)
     permissionControllerAddress: ChainAddresses[SEPOLIA_CHAIN_ID].PermissionController,
     erc7702DelegatorAddress: CommonAddresses.ERC7702Delegator,
     kmsServerURL: "http://10.128.0.57:8080",
@@ -6283,14 +7354,14 @@ var ENVIRONMENTS = {
     defaultRPCURL: "https://ethereum-sepolia-rpc.publicnode.com",
     usdcCreditsAddress: "0xbdA3897c3A428763B59015C64AB766c288C97376",
     baseUsdcCreditsAddress: "0x7673a47463F80c6a3553Db9E54c8cDcd5313d0ac",
-    baseRPCURL: "https://base-sepolia-rpc.publicnode.com",
-    platformEnv: PLATFORM_ENV_TESTNET_SEPOLIA,
-    appBaseDomain: DEFAULT_APP_BASE_DOMAIN
+    baseRPCURL: "https://base-sepolia-rpc.publicnode.com"
   },
   sepolia: {
     name: "sepolia",
     build: "prod",
     appControllerAddress: "0x0dd810a6ffba6a9820a10d97b659f07d8d23d4E2",
+    releaseAbiVersion: "v1.4",
+    // prod still on AppController v1.4.0 (3-field Release)
     permissionControllerAddress: ChainAddresses[SEPOLIA_CHAIN_ID].PermissionController,
     erc7702DelegatorAddress: CommonAddresses.ERC7702Delegator,
     kmsServerURL: "http://10.128.15.203:8080",
@@ -6299,22 +7370,20 @@ var ENVIRONMENTS = {
     billingRPCURL: "https://ethereum-rpc.publicnode.com",
     usdcCreditsAddress: "0xed9c88640ca9149Bd9f7ee6620074af10F2E145d",
     baseUsdcCreditsAddress: "0x7673a47463F80c6a3553Db9E54c8cDcd5313d0ac",
-    baseRPCURL: "https://base-sepolia-rpc.publicnode.com",
-    platformEnv: PLATFORM_ENV_TESTNET_SEPOLIA,
-    appBaseDomain: DEFAULT_APP_BASE_DOMAIN
+    baseRPCURL: "https://base-sepolia-rpc.publicnode.com"
   },
   "mainnet-alpha": {
     name: "mainnet-alpha",
     build: "prod",
     appControllerAddress: "0xc38d35Fc995e75342A21CBd6D770305b142Fbe67",
+    releaseAbiVersion: "v1.4",
+    // prod still on AppController v1.4.0 (3-field Release)
     permissionControllerAddress: ChainAddresses[MAINNET_CHAIN_ID].PermissionController,
     erc7702DelegatorAddress: CommonAddresses.ERC7702Delegator,
     kmsServerURL: "http://10.128.0.2:8080",
     userApiServerURL: "https://userapi-compute.eigencloud.xyz",
     defaultRPCURL: "https://ethereum-rpc.publicnode.com",
-    usdcCreditsAddress: "0xed9c88640ca9149Bd9f7ee6620074af10F2E145d",
-    platformEnv: PLATFORM_ENV_MAINNET_ETHEREUM,
-    appBaseDomain: DEFAULT_APP_BASE_DOMAIN
+    usdcCreditsAddress: "0xed9c88640ca9149Bd9f7ee6620074af10F2E145d"
   }
 };
 var CHAIN_ID_TO_ENVIRONMENT = {
@@ -6374,7 +7443,7 @@ function getBillingEnvironmentConfig(build) {
   };
 }
 function getBuildType() {
-  const buildTimeType = true ? "dev"?.toLowerCase() : void 0;
+  const buildTimeType = true ? "prod"?.toLowerCase() : void 0;
   const runtimeType = process.env.BUILD_TYPE?.toLowerCase();
   const buildType = buildTimeType || runtimeType;
   if (buildType === "dev") {
@@ -6691,6 +7760,63 @@ var BillingApiClient = class {
     return resp.json();
   }
   // ==========================================================================
+  // Admin - Coupon Methods
+  // ==========================================================================
+  async createCoupon(amountCents) {
+    const endpoint = `${this.config.billingApiServerURL}/admin/coupons`;
+    const resp = await this.makeAuthenticatedRequest(endpoint, "POST", "compute", { amountCents });
+    return resp.json();
+  }
+  async listCoupons(opts) {
+    const params = new URLSearchParams();
+    if (opts?.offset !== void 0) params.set("offset", opts.offset.toString());
+    if (opts?.limit !== void 0) params.set("limit", opts.limit.toString());
+    if (opts?.active !== void 0) params.set("active", opts.active.toString());
+    if (opts?.redeemed !== void 0) params.set("redeemed", opts.redeemed.toString());
+    const qs = params.toString();
+    const endpoint = `${this.config.billingApiServerURL}/admin/coupons${qs ? `?${qs}` : ""}`;
+    const resp = await this.makeAuthenticatedRequest(endpoint, "GET", "compute");
+    return resp.json();
+  }
+  async getCoupon(id) {
+    const endpoint = `${this.config.billingApiServerURL}/admin/coupons/${id}`;
+    const resp = await this.makeAuthenticatedRequest(endpoint, "GET", "compute");
+    return resp.json();
+  }
+  async deactivateCoupon(id) {
+    const endpoint = `${this.config.billingApiServerURL}/admin/coupons/${id}/deactivate`;
+    await this.makeAuthenticatedRequest(endpoint, "POST", "compute");
+  }
+  async redeemCouponForUser(id, address) {
+    const endpoint = `${this.config.billingApiServerURL}/admin/coupons/${id}/redeem`;
+    await this.makeAuthenticatedRequest(endpoint, "POST", "compute", { address });
+  }
+  // ==========================================================================
+  // Admin - Admin Management Methods
+  // ==========================================================================
+  async addAdmin(address) {
+    const endpoint = `${this.config.billingApiServerURL}/admin/admins`;
+    const resp = await this.makeAuthenticatedRequest(endpoint, "POST", "compute", { address });
+    return resp.json();
+  }
+  async removeAdmin(address) {
+    const endpoint = `${this.config.billingApiServerURL}/admin/admins/${address}`;
+    await this.makeAuthenticatedRequest(endpoint, "DELETE", "compute");
+  }
+  async listAdmins() {
+    const endpoint = `${this.config.billingApiServerURL}/admin/admins`;
+    const resp = await this.makeAuthenticatedRequest(endpoint, "GET", "compute");
+    return resp.json();
+  }
+  // ==========================================================================
+  // User - Coupon Redemption
+  // ==========================================================================
+  async redeemCoupon(code) {
+    const endpoint = `${this.config.billingApiServerURL}/v1/coupons/redeem`;
+    const resp = await this.makeAuthenticatedRequest(endpoint, "POST", "compute", { code });
+    return resp.json();
+  }
+  // ==========================================================================
   // Internal Methods
   // ==========================================================================
   /**
@@ -7106,6 +8232,11 @@ async function prepareDeployFromVerifiableBuild(options, logger = defaultLogger)
         executions: batch.executions,
         authorizationList
       });
+      await assertSufficientGas({
+        publicClient: batch.publicClient,
+        address: batch.walletClient.account.address,
+        gasEstimate
+      });
       const data = {
         appId: batch.appId,
         salt: batch.salt,
@@ -7364,6 +8495,11 @@ async function prepareDeploy(options, logger = defaultLogger) {
         executions: batch.executions,
         authorizationList
       });
+      await assertSufficientGas({
+        publicClient: batch.publicClient,
+        address: batch.walletClient.account.address,
+        gasEstimate
+      });
       const data = {
         appId: batch.appId,
         salt: batch.salt,
@@ -7400,7 +8536,7 @@ async function executeDeploy(options) {
     }
   );
 }
-async function watchDeployment(appId, walletClient, publicClient, environmentConfig, logger = defaultLogger, skipTelemetry) {
+async function watchDeployment(appId, walletClient, publicClient, environmentConfig, logger = defaultLogger, skipTelemetry, opts) {
   return withSDKTelemetry(
     {
       functionName: "watchDeployment",
@@ -7416,7 +8552,8 @@ async function watchDeployment(appId, walletClient, publicClient, environmentCon
           walletClient,
           publicClient,
           environmentConfig,
-          appId
+          appId,
+          timeoutSeconds: opts?.timeoutSeconds
         },
         logger
       );
@@ -7512,6 +8649,11 @@ async function prepareUpgradeFromVerifiableBuild(options, logger = defaultLogger
         executions: batch.executions,
         authorizationList
       });
+      await assertSufficientGas({
+        publicClient: batch.publicClient,
+        address: batch.walletClient.account.address,
+        gasEstimate
+      });
       const data = {
         appId: batch.appId,
         executions: batch.executions,
@@ -7701,6 +8843,11 @@ async function prepareUpgrade(options, logger = defaultLogger) {
         executions: batch.executions,
         authorizationList
       });
+      await assertSufficientGas({
+        publicClient: batch.publicClient,
+        address: batch.walletClient.account.address,
+        gasEstimate
+      });
       const data = {
         appId: batch.appId,
         executions: batch.executions,
@@ -7735,7 +8882,7 @@ async function executeUpgrade(options) {
     }
   );
 }
-async function watchUpgrade(appId, walletClient, publicClient, environmentConfig, logger = defaultLogger, skipTelemetry) {
+async function watchUpgrade(appId, walletClient, publicClient, environmentConfig, logger = defaultLogger, skipTelemetry, opts) {
   return withSDKTelemetry(
     {
       functionName: "watchUpgrade",
@@ -7751,7 +8898,8 @@ async function watchUpgrade(appId, walletClient, publicClient, environmentConfig
           walletClient,
           publicClient,
           environmentConfig,
-          appId
+          appId,
+          timeoutSeconds: opts?.timeoutSeconds
         },
         logger
       );
@@ -8443,7 +9591,7 @@ function createAppModule(ctx) {
   }
   const account = walletClient.account;
   const environment = getEnvironmentConfig(ctx.environment);
-  const logger = getLogger(ctx.verbose);
+  const logger = ctx.logger ?? getLogger(ctx.verbose);
   return {
     async create(opts) {
       return createApp(opts, logger);
@@ -8555,14 +9703,15 @@ function createAppModule(ctx) {
         imageRef: result.imageRef
       };
     },
-    async watchDeployment(appId) {
+    async watchDeployment(appId, opts) {
       return watchDeployment(
         appId,
         walletClient,
         publicClient,
         environment,
         logger,
-        skipTelemetry
+        skipTelemetry,
+        opts
       );
     },
     // Granular upgrade control
@@ -8620,8 +9769,16 @@ function createAppModule(ctx) {
         imageRef: result.imageRef
       };
     },
-    async watchUpgrade(appId) {
-      return watchUpgrade(appId, walletClient, publicClient, environment, logger, skipTelemetry);
+    async watchUpgrade(appId, opts) {
+      return watchUpgrade(
+        appId,
+        walletClient,
+        publicClient,
+        environment,
+        logger,
+        skipTelemetry,
+        opts
+      );
     },
     // Profile management
     async setProfile(appId, profile) {
@@ -9111,6 +10268,9 @@ function createBillingModule(config) {
     },
     hasBaseSupport() {
       return !!baseUsdcCreditsAddress && !!baseRPCURL;
+    },
+    async redeemCoupon(code) {
+      return billingApi.redeemCoupon(code);
     }
   };
   return module;
@@ -9546,6 +10706,44 @@ function transformVerifyResult(raw) {
   };
 }
 
+// src/client/modules/admin/index.ts
+function createAdminModule(config) {
+  const { verbose = false, walletClient } = config;
+  if (!walletClient.account) {
+    throw new Error("WalletClient must have an account attached");
+  }
+  const address = walletClient.account.address;
+  const billingEnvConfig = getBillingEnvironmentConfig(getBuildType());
+  const billingApi = new BillingApiClient(billingEnvConfig, walletClient, { verbose });
+  return {
+    address,
+    async createCoupon(amountCents) {
+      return billingApi.createCoupon(amountCents);
+    },
+    async listCoupons(opts) {
+      return billingApi.listCoupons(opts);
+    },
+    async getCoupon(id) {
+      return billingApi.getCoupon(id);
+    },
+    async deactivateCoupon(id) {
+      return billingApi.deactivateCoupon(id);
+    },
+    async redeemCouponForUser(id, userAddress) {
+      return billingApi.redeemCouponForUser(id, userAddress);
+    },
+    async addAdmin(adminAddress) {
+      return billingApi.addAdmin(adminAddress);
+    },
+    async removeAdmin(adminAddress) {
+      return billingApi.removeAdmin(adminAddress);
+    },
+    async listAdmins() {
+      return billingApi.listAdmins();
+    }
+  };
+}
+
 // src/client/common/auth/keyring.ts
 import { AsyncEntry, findCredentials } from "@napi-rs/keyring";
 import { privateKeyToAddress } from "viem/accounts";
@@ -10090,8 +11288,10 @@ export {
   BuildError,
   BuildFailedError,
   ConflictError,
+  EMPTY_CONTAINER_POLICY,
   ERC20_default as ERC20ABI,
   ForbiddenError,
+  InsufficientGasError,
   JwtProvider,
   NoopClient,
   NotFoundError,
@@ -10101,14 +11301,18 @@ export {
   TimeoutError,
   USDCCredits_default as USDCCreditsABI,
   UserApiClient,
+  WATCH_DEFAULT_TIMEOUT_SECONDS,
+  WatchTimeoutError,
   addHexPrefix,
   addMetric,
   addMetricWithDimensions,
+  assertSufficientGas,
   assertValidFilePath,
   assertValidImageReference,
   assertValidPrivateKey,
   calculateAppID,
   checkERC7702Delegation,
+  createAdminModule,
   createApp,
   createAppEnvironment,
   createBillingModule,