@phala/cloud 0.2.1-beta.2 → 0.2.1-beta.4

package/dist/index.js

@@ -94,6 +94,7 @@ __export(index_exports, {
   RequestError: () => RequestError,
   ResourceError: () => ResourceError,
   RestartCvmRequestSchema: () => RestartCvmRequestSchema,
+  SUPPORTED_API_VERSIONS: () => SUPPORTED_API_VERSIONS,
   SUPPORTED_CHAINS: () => SUPPORTED_CHAINS,
   ServerError: () => ServerError,
   ShutdownCvmRequestSchema: () => ShutdownCvmRequestSchema,
@@ -101,6 +102,8 @@ __export(index_exports, {
   StopCvmRequestSchema: () => StopCvmRequestSchema,
   TransactionError: () => TransactionError,
   UnknownError: () => UnknownError,
+  UpdateCvmEnvsRequestSchema: () => UpdateCvmEnvsRequestSchema,
+  UpdateCvmEnvsResultSchema: () => UpdateCvmEnvsResultSchema,
   UpdateCvmResourcesRequestSchema: () => UpdateCvmResourcesRequestSchema,
   UpdateCvmVisibilityRequestSchema: () => UpdateCvmVisibilityRequestSchema,
   UpdateOsImageRequestSchema: () => UpdateOsImageRequestSchema,
@@ -201,6 +204,7 @@ __export(index_exports, {
   safeShutdownCvm: () => safeShutdownCvm,
   safeStartCvm: () => safeStartCvm,
   safeStopCvm: () => safeStopCvm,
+  safeUpdateCvmEnvs: () => safeUpdateCvmEnvs,
   safeUpdateCvmResources: () => safeUpdateCvmResources,
   safeUpdateCvmVisibility: () => safeUpdateCvmVisibility,
   safeUpdateOsImage: () => safeUpdateOsImage,
@@ -210,6 +214,7 @@ __export(index_exports, {
   startCvm: () => startCvm,
   stopCvm: () => stopCvm,
   switchToNetwork: () => switchToNetwork,
+  updateCvmEnvs: () => updateCvmEnvs,
   updateCvmResources: () => updateCvmResources,
   updateCvmVisibility: () => updateCvmVisibility,
   updateOsImage: () => updateOsImage,
@@ -1315,18 +1320,28 @@ var refineCvmId = (schema) => schema.refine(
 );
 var CvmIdBaseSchema = refineCvmId(CvmIdObjectSchema);
 var CvmIdSchema = CvmIdBaseSchema.transform((data) => {
-  let cvmId;
+  let rawValue;
   if (data.id) {
-    cvmId = data.id;
+    rawValue = data.id;
   } else if (data.uuid) {
-    cvmId = data.uuid.replace(/-/g, "");
+    rawValue = data.uuid;
   } else if (data.app_id) {
-    cvmId = data.app_id.startsWith("app_") ? data.app_id : `app_${data.app_id}`;
+    rawValue = data.app_id;
   } else if (data.instance_id) {
-    cvmId = data.instance_id.startsWith("instance_") ? data.instance_id : `instance_${data.instance_id}`;
+    rawValue = data.instance_id;
   } else {
     throw new Error("No valid identifier provided");
   }
+  const uuidRegex = /^[0-9a-f]{8}[-]?[0-9a-f]{4}[-]?4[0-9a-f]{3}[-]?[89ab][0-9a-f]{3}[-]?[0-9a-f]{12}$/i;
+  const appIdRegex = /^[0-9a-f]{40}$/i;
+  let cvmId;
+  if (uuidRegex.test(rawValue)) {
+    cvmId = rawValue.replace(/-/g, "");
+  } else if (appIdRegex.test(rawValue)) {
+    cvmId = `app_${rawValue}`;
+  } else {
+    cvmId = rawValue;
+  }
   return { cvmId };
 });
 
@@ -1413,7 +1428,12 @@ var ProvisionCvmRequestSchema = import_zod10.z.object({
   // KMS type selection (defaults to PHALA)
   kms_contract: import_zod10.z.string().optional(),
   // KMS contract address for on-chain KMS
-  env_keys: import_zod10.z.array(import_zod10.z.string()).optional()
+  env_keys: import_zod10.z.array(import_zod10.z.string()).optional(),
+  // Manual nonce specification (Advanced - PHALA KMS only)
+  nonce: import_zod10.z.number().optional(),
+  // User-specified nonce for deterministic app_id generation
+  app_id: import_zod10.z.string().optional()
+  // Expected app_id (must match calculated app_id from nonce)
 }).passthrough();
 function handleGatewayCompatibility(appCompose) {
   if (!appCompose.compose_file) {
@@ -1648,10 +1668,89 @@ var { action: commitCvmComposeFileUpdate, safeAction: safeCommitCvmComposeFileUp
   }
 );
 
-// src/actions/kms/get_kms_info.ts
+// src/actions/cvms/update_cvm_envs.ts
 var import_zod15 = require("zod");
-var GetKmsInfoRequestSchema = import_zod15.z.object({
-  kms_id: import_zod15.z.string().min(1, "KMS ID is required")
+var UpdateCvmEnvsRequestSchema = import_zod15.z.object({
+  id: import_zod15.z.string().optional(),
+  uuid: import_zod15.z.string().regex(/^[0-9a-f]{8}[-]?[0-9a-f]{4}[-]?4[0-9a-f]{3}[-]?[89ab][0-9a-f]{3}[-]?[0-9a-f]{12}$/i).optional(),
+  app_id: import_zod15.z.string().refine(
+    (val) => !val.startsWith("app_") && val.length === 40,
+    "app_id should be 40 characters without prefix"
+  ).transform((val) => val.startsWith("app_") ? val : `app_${val}`).optional(),
+  instance_id: import_zod15.z.string().refine(
+    (val) => !val.startsWith("instance_") && val.length === 40,
+    "instance_id should be 40 characters without prefix"
+  ).transform((val) => val.startsWith("instance_") ? val : `instance_${val}`).optional(),
+  encrypted_env: import_zod15.z.string().describe("Encrypted environment variables (hex string)"),
+  env_keys: import_zod15.z.array(import_zod15.z.string()).optional().describe("List of allowed environment variable keys"),
+  compose_hash: import_zod15.z.string().optional().describe("Compose hash for verification (Phase 2, required when env_keys changes)"),
+  transaction_hash: import_zod15.z.string().optional().describe(
+    "On-chain transaction hash for verification (Phase 2, required when env_keys changes)"
+  )
+}).refine(
+  (data) => !!(data.id || data.uuid || data.app_id || data.instance_id),
+  "One of id, uuid, app_id, or instance_id must be provided"
+).transform((data) => {
+  return {
+    cvmId: data.id || data.uuid || data.app_id || data.instance_id,
+    request: {
+      encrypted_env: data.encrypted_env,
+      env_keys: data.env_keys,
+      compose_hash: data.compose_hash,
+      transaction_hash: data.transaction_hash
+    },
+    _raw: data
+  };
+});
+var UpdateCvmEnvsInProgressSchema = import_zod15.z.object({
+  status: import_zod15.z.literal("in_progress"),
+  message: import_zod15.z.string(),
+  correlation_id: import_zod15.z.string(),
+  allowed_envs_changed: import_zod15.z.boolean()
+});
+var UpdateCvmEnvsPreconditionRequiredSchema = import_zod15.z.object({
+  status: import_zod15.z.literal("precondition_required"),
+  message: import_zod15.z.string(),
+  compose_hash: import_zod15.z.string(),
+  app_id: import_zod15.z.string(),
+  device_id: import_zod15.z.string(),
+  kms_info: KmsInfoSchema
+});
+var UpdateCvmEnvsResultSchema = import_zod15.z.union([
+  UpdateCvmEnvsInProgressSchema,
+  UpdateCvmEnvsPreconditionRequiredSchema
+]);
+var { action: updateCvmEnvs, safeAction: safeUpdateCvmEnvs } = defineAction(UpdateCvmEnvsResultSchema, async (client, request) => {
+  const validatedRequest = UpdateCvmEnvsRequestSchema.parse(request);
+  try {
+    const response = await client.patch(
+      `/cvms/${validatedRequest.cvmId}/envs`,
+      validatedRequest.request
+    );
+    return response;
+  } catch (error) {
+    if (error instanceof PhalaCloudError && error.status === 428) {
+      const detail = error.detail;
+      if (detail && typeof detail === "object") {
+        const detailObj = detail;
+        return {
+          status: "precondition_required",
+          message: detailObj.message || "Compose hash verification required",
+          compose_hash: detailObj.compose_hash,
+          app_id: detailObj.app_id,
+          device_id: detailObj.device_id,
+          kms_info: detailObj.kms_info
+        };
+      }
+    }
+    throw error;
+  }
+});
+
+// src/actions/kms/get_kms_info.ts
+var import_zod16 = require("zod");
+var GetKmsInfoRequestSchema = import_zod16.z.object({
+  kms_id: import_zod16.z.string().min(1, "KMS ID is required")
 });
 var { action: getKmsInfo, safeAction: safeGetKmsInfo } = defineAction(KmsInfoSchema, async (client, request) => {
   const validatedRequest = GetKmsInfoRequestSchema.parse(request);
@@ -1659,18 +1758,18 @@ var { action: getKmsInfo, safeAction: safeGetKmsInfo } = defineAction(KmsInfoSch
 });
 
 // src/actions/kms/get_kms_list.ts
-var import_zod16 = require("zod");
-var GetKmsListRequestSchema = import_zod16.z.object({
-  page: import_zod16.z.number().int().min(1).optional(),
-  page_size: import_zod16.z.number().int().min(1).optional(),
-  is_onchain: import_zod16.z.boolean().optional()
+var import_zod17 = require("zod");
+var GetKmsListRequestSchema = import_zod17.z.object({
+  page: import_zod17.z.number().int().min(1).optional(),
+  page_size: import_zod17.z.number().int().min(1).optional(),
+  is_onchain: import_zod17.z.boolean().optional()
 }).strict();
-var GetKmsListSchema = import_zod16.z.object({
-  items: import_zod16.z.array(KmsInfoSchema),
-  total: import_zod16.z.number(),
-  page: import_zod16.z.number(),
-  page_size: import_zod16.z.number(),
-  pages: import_zod16.z.number()
+var GetKmsListSchema = import_zod17.z.object({
+  items: import_zod17.z.array(KmsInfoSchema),
+  total: import_zod17.z.number(),
+  page: import_zod17.z.number(),
+  page_size: import_zod17.z.number(),
+  pages: import_zod17.z.number()
 }).strict();
 var { action: getKmsList, safeAction: safeGetKmsList } = defineAction(GetKmsListSchema, async (client, request) => {
   const validatedRequest = GetKmsListRequestSchema.parse(request ?? {});
@@ -1678,17 +1777,17 @@ var { action: getKmsList, safeAction: safeGetKmsList } = defineAction(GetKmsList
 });
 
 // src/actions/kms/get_app_env_encrypt_pubkey.ts
-var import_zod17 = require("zod");
-var GetAppEnvEncryptPubKeyRequestSchema = import_zod17.z.object({
-  kms: import_zod17.z.string().min(1, "KMS ID or slug is required"),
-  app_id: import_zod17.z.string().refine(
+var import_zod18 = require("zod");
+var GetAppEnvEncryptPubKeyRequestSchema = import_zod18.z.object({
+  kms: import_zod18.z.string().min(1, "KMS ID or slug is required"),
+  app_id: import_zod18.z.string().refine(
     (val) => val.length === 40 || val.startsWith("0x") && val.length === 42,
     "App ID must be exactly 40 characters or 42 characters with 0x prefix"
   )
 }).strict();
-var GetAppEnvEncryptPubKeySchema = import_zod17.z.object({
-  public_key: import_zod17.z.string(),
-  signature: import_zod17.z.string()
+var GetAppEnvEncryptPubKeySchema = import_zod18.z.object({
+  public_key: import_zod18.z.string(),
+  signature: import_zod18.z.string()
 }).strict();
 var { action: getAppEnvEncryptPubKey, safeAction: safeGetAppEnvEncryptPubKey } = defineAction(GetAppEnvEncryptPubKeySchema, async (client, payload) => {
   const validatedRequest = GetAppEnvEncryptPubKeyRequestSchema.parse(payload);
@@ -1696,15 +1795,15 @@ var { action: getAppEnvEncryptPubKey, safeAction: safeGetAppEnvEncryptPubKey } =
 });
 
 // src/actions/kms/next_app_ids.ts
-var import_zod18 = require("zod");
-var NextAppIdsRequestSchema = import_zod18.z.object({
-  counts: import_zod18.z.number().int().min(1).max(20).optional().default(1)
+var import_zod19 = require("zod");
+var NextAppIdsRequestSchema = import_zod19.z.object({
+  counts: import_zod19.z.number().int().min(1).max(20).optional().default(1)
 }).strict();
-var NextAppIdsSchema = import_zod18.z.object({
-  app_ids: import_zod18.z.array(
-    import_zod18.z.object({
-      app_id: import_zod18.z.string(),
-      nonce: import_zod18.z.number().int().min(0)
+var NextAppIdsSchema = import_zod19.z.object({
+  app_ids: import_zod19.z.array(
+    import_zod19.z.object({
+      app_id: import_zod19.z.string(),
+      nonce: import_zod19.z.number().int().min(0)
     })
   )
 }).strict();
@@ -1740,10 +1839,10 @@ var { action: shutdownCvm, safeAction: safeShutdownCvm } = defineAction(VMSchema
 });
 
 // src/actions/cvms/restart_cvm.ts
-var import_zod19 = require("zod");
+var import_zod20 = require("zod");
 var RestartCvmRequestSchema = refineCvmId(
   CvmIdObjectSchema.extend({
-    force: import_zod19.z.boolean().optional()
+    force: import_zod20.z.boolean().optional()
   })
 );
 var { action: restartCvm, safeAction: safeRestartCvm } = defineAction(VMSchema, async (client, request) => {
@@ -1754,10 +1853,10 @@ var { action: restartCvm, safeAction: safeRestartCvm } = defineAction(VMSchema,
 });
 
 // src/actions/cvms/delete_cvm.ts
-var import_zod20 = require("zod");
+var import_zod21 = require("zod");
 var DeleteCvmRequestSchema = CvmIdSchema;
 var { action: deleteCvm, safeAction: safeDeleteCvm } = defineAction(
-  import_zod20.z.void(),
+  import_zod21.z.void(),
   async (client, request) => {
     const { cvmId } = DeleteCvmRequestSchema.parse(request);
     await client.delete(`/cvms/${cvmId}`);
@@ -1766,41 +1865,41 @@ var { action: deleteCvm, safeAction: safeDeleteCvm } = defineAction(
 );
 
 // src/actions/cvms/get_cvm_stats.ts
-var import_zod21 = require("zod");
-var DiskInfoSchema = import_zod21.z.object({
-  name: import_zod21.z.string(),
-  mount_point: import_zod21.z.string(),
-  total_size: import_zod21.z.number(),
-  free_size: import_zod21.z.number()
+var import_zod22 = require("zod");
+var DiskInfoSchema = import_zod22.z.object({
+  name: import_zod22.z.string(),
+  mount_point: import_zod22.z.string(),
+  total_size: import_zod22.z.number(),
+  free_size: import_zod22.z.number()
 });
-var SystemInfoSchema = import_zod21.z.object({
-  os_name: import_zod21.z.string(),
-  os_version: import_zod21.z.string(),
-  kernel_version: import_zod21.z.string(),
-  cpu_model: import_zod21.z.string(),
-  num_cpus: import_zod21.z.number(),
-  total_memory: import_zod21.z.number(),
-  available_memory: import_zod21.z.number(),
-  used_memory: import_zod21.z.number(),
-  free_memory: import_zod21.z.number(),
-  total_swap: import_zod21.z.number(),
-  used_swap: import_zod21.z.number(),
-  free_swap: import_zod21.z.number(),
-  uptime: import_zod21.z.number(),
-  loadavg_one: import_zod21.z.number(),
-  loadavg_five: import_zod21.z.number(),
-  loadavg_fifteen: import_zod21.z.number(),
-  disks: import_zod21.z.array(DiskInfoSchema)
+var SystemInfoSchema = import_zod22.z.object({
+  os_name: import_zod22.z.string(),
+  os_version: import_zod22.z.string(),
+  kernel_version: import_zod22.z.string(),
+  cpu_model: import_zod22.z.string(),
+  num_cpus: import_zod22.z.number(),
+  total_memory: import_zod22.z.number(),
+  available_memory: import_zod22.z.number(),
+  used_memory: import_zod22.z.number(),
+  free_memory: import_zod22.z.number(),
+  total_swap: import_zod22.z.number(),
+  used_swap: import_zod22.z.number(),
+  free_swap: import_zod22.z.number(),
+  uptime: import_zod22.z.number(),
+  loadavg_one: import_zod22.z.number(),
+  loadavg_five: import_zod22.z.number(),
+  loadavg_fifteen: import_zod22.z.number(),
+  disks: import_zod22.z.array(DiskInfoSchema)
 });
-var CvmSystemInfoSchema = import_zod21.z.object({
-  is_online: import_zod21.z.boolean(),
-  is_public: import_zod21.z.boolean().default(false),
-  error: import_zod21.z.string().nullable(),
+var CvmSystemInfoSchema = import_zod22.z.object({
+  is_online: import_zod22.z.boolean(),
+  is_public: import_zod22.z.boolean().default(false),
+  error: import_zod22.z.string().nullable(),
   sysinfo: SystemInfoSchema.nullable(),
-  status: import_zod21.z.string().nullable(),
-  in_progress: import_zod21.z.boolean().default(false),
-  boot_progress: import_zod21.z.string().nullable(),
-  boot_error: import_zod21.z.string().nullable()
+  status: import_zod22.z.string().nullable(),
+  in_progress: import_zod22.z.boolean().default(false),
+  boot_progress: import_zod22.z.string().nullable(),
+  boot_error: import_zod22.z.string().nullable()
 });
 var GetCvmStatsRequestSchema = CvmIdSchema;
 var { action: getCvmStats, safeAction: safeGetCvmStats } = defineAction(CvmSystemInfoSchema, async (client, request) => {
@@ -1809,18 +1908,18 @@ var { action: getCvmStats, safeAction: safeGetCvmStats } = defineAction(CvmSyste
 });
 
 // src/actions/cvms/get_cvm_network.ts
-var import_zod22 = require("zod");
-var CvmNetworkUrlsSchema2 = import_zod22.z.object({
-  app: import_zod22.z.string(),
-  instance: import_zod22.z.string()
+var import_zod23 = require("zod");
+var CvmNetworkUrlsSchema2 = import_zod23.z.object({
+  app: import_zod23.z.string(),
+  instance: import_zod23.z.string()
 });
-var CvmNetworkSchema = import_zod22.z.object({
-  is_online: import_zod22.z.boolean(),
-  is_public: import_zod22.z.boolean().default(true),
-  error: import_zod22.z.string().nullable(),
-  internal_ip: import_zod22.z.string().nullable(),
-  latest_handshake: import_zod22.z.string().nullable(),
-  public_urls: import_zod22.z.array(CvmNetworkUrlsSchema2).nullable()
+var CvmNetworkSchema = import_zod23.z.object({
+  is_online: import_zod23.z.boolean(),
+  is_public: import_zod23.z.boolean().default(true),
+  error: import_zod23.z.string().nullable(),
+  internal_ip: import_zod23.z.string().nullable(),
+  latest_handshake: import_zod23.z.string().nullable(),
+  public_urls: import_zod23.z.array(CvmNetworkUrlsSchema2).nullable()
 });
 var GetCvmNetworkRequestSchema = CvmIdSchema;
 var { action: getCvmNetwork, safeAction: safeGetCvmNetwork } = defineAction(CvmNetworkSchema, async (client, request) => {
@@ -1829,36 +1928,36 @@ var { action: getCvmNetwork, safeAction: safeGetCvmNetwork } = defineAction(CvmN
 });
 
 // src/actions/cvms/get_cvm_docker_compose.ts
-var import_zod23 = require("zod");
+var import_zod24 = require("zod");
 var GetCvmDockerComposeRequestSchema = CvmIdSchema;
-var { action: getCvmDockerCompose, safeAction: safeGetCvmDockerCompose } = defineAction(import_zod23.z.string(), async (client, request) => {
+var { action: getCvmDockerCompose, safeAction: safeGetCvmDockerCompose } = defineAction(import_zod24.z.string(), async (client, request) => {
   const { cvmId } = GetCvmDockerComposeRequestSchema.parse(request);
   return await client.get(`/cvms/${cvmId}/docker-compose.yml`);
 });
 
 // src/actions/cvms/get_cvm_containers_stats.ts
-var import_zod24 = require("zod");
-var ContainerInfoSchema = import_zod24.z.object({
-  id: import_zod24.z.string(),
-  names: import_zod24.z.array(import_zod24.z.string()),
-  image: import_zod24.z.string(),
-  image_id: import_zod24.z.string(),
-  command: import_zod24.z.string().nullable().optional(),
-  created: import_zod24.z.number(),
-  state: import_zod24.z.string(),
-  status: import_zod24.z.string(),
-  log_endpoint: import_zod24.z.string().nullable()
+var import_zod25 = require("zod");
+var ContainerInfoSchema = import_zod25.z.object({
+  id: import_zod25.z.string(),
+  names: import_zod25.z.array(import_zod25.z.string()),
+  image: import_zod25.z.string(),
+  image_id: import_zod25.z.string(),
+  command: import_zod25.z.string().nullable().optional(),
+  created: import_zod25.z.number(),
+  state: import_zod25.z.string(),
+  status: import_zod25.z.string(),
+  log_endpoint: import_zod25.z.string().nullable()
 });
-var CvmContainersStatsSchema = import_zod24.z.object({
-  is_online: import_zod24.z.boolean(),
-  is_public: import_zod24.z.boolean().default(true),
-  error: import_zod24.z.string().nullable(),
-  docker_compose_file: import_zod24.z.string().nullable(),
-  manifest_version: import_zod24.z.number().nullable(),
-  version: import_zod24.z.string().nullable(),
-  runner: import_zod24.z.string().nullable(),
-  features: import_zod24.z.array(import_zod24.z.string()).nullable(),
-  containers: import_zod24.z.array(ContainerInfoSchema).nullable()
+var CvmContainersStatsSchema = import_zod25.z.object({
+  is_online: import_zod25.z.boolean(),
+  is_public: import_zod25.z.boolean().default(true),
+  error: import_zod25.z.string().nullable(),
+  docker_compose_file: import_zod25.z.string().nullable(),
+  manifest_version: import_zod25.z.number().nullable(),
+  version: import_zod25.z.string().nullable(),
+  runner: import_zod25.z.string().nullable(),
+  features: import_zod25.z.array(import_zod25.z.string()).nullable(),
+  containers: import_zod25.z.array(ContainerInfoSchema).nullable()
 });
 var GetCvmContainersStatsRequestSchema = CvmIdSchema;
 var { action: getCvmContainersStats, safeAction: safeGetCvmContainersStats } = defineAction(CvmContainersStatsSchema, async (client, request) => {
@@ -1867,62 +1966,62 @@ var { action: getCvmContainersStats, safeAction: safeGetCvmContainersStats } = d
 });
 
 // src/actions/cvms/get_cvm_attestation.ts
-var import_zod25 = require("zod");
-var CertificateSubjectSchema = import_zod25.z.object({
-  common_name: import_zod25.z.string().nullable(),
-  organization: import_zod25.z.string().nullable(),
-  country: import_zod25.z.string().nullable(),
-  state: import_zod25.z.string().nullable(),
-  locality: import_zod25.z.string().nullable()
+var import_zod26 = require("zod");
+var CertificateSubjectSchema = import_zod26.z.object({
+  common_name: import_zod26.z.string().nullable(),
+  organization: import_zod26.z.string().nullable(),
+  country: import_zod26.z.string().nullable(),
+  state: import_zod26.z.string().nullable(),
+  locality: import_zod26.z.string().nullable()
 });
-var CertificateIssuerSchema = import_zod25.z.object({
-  common_name: import_zod25.z.string().nullable(),
-  organization: import_zod25.z.string().nullable(),
-  country: import_zod25.z.string().nullable()
+var CertificateIssuerSchema = import_zod26.z.object({
+  common_name: import_zod26.z.string().nullable(),
+  organization: import_zod26.z.string().nullable(),
+  country: import_zod26.z.string().nullable()
 });
-var CertificateSchema = import_zod25.z.object({
+var CertificateSchema = import_zod26.z.object({
   subject: CertificateSubjectSchema,
   issuer: CertificateIssuerSchema,
-  serial_number: import_zod25.z.string(),
-  not_before: import_zod25.z.string(),
+  serial_number: import_zod26.z.string(),
+  not_before: import_zod26.z.string(),
   // datetime serialized as ISO string
-  not_after: import_zod25.z.string(),
+  not_after: import_zod26.z.string(),
   // datetime serialized as ISO string
-  version: import_zod25.z.string(),
-  fingerprint: import_zod25.z.string(),
-  signature_algorithm: import_zod25.z.string(),
-  sans: import_zod25.z.array(import_zod25.z.string()).nullable(),
-  is_ca: import_zod25.z.boolean(),
-  position_in_chain: import_zod25.z.number().nullable(),
-  quote: import_zod25.z.string().nullable(),
-  app_id: import_zod25.z.string().nullable().optional(),
-  cert_usage: import_zod25.z.string().nullable().optional()
+  version: import_zod26.z.string(),
+  fingerprint: import_zod26.z.string(),
+  signature_algorithm: import_zod26.z.string(),
+  sans: import_zod26.z.array(import_zod26.z.string()).nullable(),
+  is_ca: import_zod26.z.boolean(),
+  position_in_chain: import_zod26.z.number().nullable(),
+  quote: import_zod26.z.string().nullable(),
+  app_id: import_zod26.z.string().nullable().optional(),
+  cert_usage: import_zod26.z.string().nullable().optional()
 });
-var EventLogSchema = import_zod25.z.object({
-  imr: import_zod25.z.number(),
-  event_type: import_zod25.z.number(),
-  digest: import_zod25.z.string(),
-  event: import_zod25.z.string(),
-  event_payload: import_zod25.z.string()
+var EventLogSchema = import_zod26.z.object({
+  imr: import_zod26.z.number(),
+  event_type: import_zod26.z.number(),
+  digest: import_zod26.z.string(),
+  event: import_zod26.z.string(),
+  event_payload: import_zod26.z.string()
 });
-var TcbInfoSchema = import_zod25.z.object({
-  mrtd: import_zod25.z.string(),
-  rootfs_hash: import_zod25.z.string().nullable().optional(),
-  rtmr0: import_zod25.z.string(),
-  rtmr1: import_zod25.z.string(),
-  rtmr2: import_zod25.z.string(),
-  rtmr3: import_zod25.z.string(),
-  event_log: import_zod25.z.array(EventLogSchema),
-  app_compose: import_zod25.z.string()
+var TcbInfoSchema = import_zod26.z.object({
+  mrtd: import_zod26.z.string(),
+  rootfs_hash: import_zod26.z.string().nullable().optional(),
+  rtmr0: import_zod26.z.string(),
+  rtmr1: import_zod26.z.string(),
+  rtmr2: import_zod26.z.string(),
+  rtmr3: import_zod26.z.string(),
+  event_log: import_zod26.z.array(EventLogSchema),
+  app_compose: import_zod26.z.string()
 });
-var CvmAttestationSchema = import_zod25.z.object({
-  name: import_zod25.z.string().nullable(),
-  is_online: import_zod25.z.boolean(),
-  is_public: import_zod25.z.boolean().default(true),
-  error: import_zod25.z.string().nullable(),
-  app_certificates: import_zod25.z.array(CertificateSchema).nullable(),
+var CvmAttestationSchema = import_zod26.z.object({
+  name: import_zod26.z.string().nullable(),
+  is_online: import_zod26.z.boolean(),
+  is_public: import_zod26.z.boolean().default(true),
+  error: import_zod26.z.string().nullable(),
+  app_certificates: import_zod26.z.array(CertificateSchema).nullable(),
   tcb_info: TcbInfoSchema.nullable(),
-  compose_file: import_zod25.z.string().nullable()
+  compose_file: import_zod26.z.string().nullable()
 });
 var GetCvmAttestationRequestSchema = CvmIdSchema;
 var { action: getCvmAttestation, safeAction: safeGetCvmAttestation } = defineAction(CvmAttestationSchema, async (client, request) => {
@@ -1931,17 +2030,17 @@ var { action: getCvmAttestation, safeAction: safeGetCvmAttestation } = defineAct
 });
 
 // src/actions/cvms/update_cvm_resources.ts
-var import_zod26 = require("zod");
+var import_zod27 = require("zod");
 var UpdateCvmResourcesRequestSchema = refineCvmId(
   CvmIdObjectSchema.extend({
-    vcpu: import_zod26.z.number().optional(),
-    memory: import_zod26.z.number().optional(),
-    disk_size: import_zod26.z.number().optional(),
-    instance_type: import_zod26.z.string().optional(),
-    allow_restart: import_zod26.z.boolean().optional()
+    vcpu: import_zod27.z.number().optional(),
+    memory: import_zod27.z.number().optional(),
+    disk_size: import_zod27.z.number().optional(),
+    instance_type: import_zod27.z.string().optional(),
+    allow_restart: import_zod27.z.boolean().optional()
   })
 );
-var { action: updateCvmResources, safeAction: safeUpdateCvmResources } = defineAction(import_zod26.z.void(), async (client, request) => {
+var { action: updateCvmResources, safeAction: safeUpdateCvmResources } = defineAction(import_zod27.z.void(), async (client, request) => {
   const parsed = UpdateCvmResourcesRequestSchema.parse(request);
   const { cvmId } = CvmIdSchema.parse(parsed);
   const { ...body } = parsed;
@@ -1950,11 +2049,11 @@ var { action: updateCvmResources, safeAction: safeUpdateCvmResources } = defineA
 });
 
 // src/actions/cvms/update_cvm_visibility.ts
-var import_zod27 = require("zod");
+var import_zod28 = require("zod");
 var UpdateCvmVisibilityRequestSchema = refineCvmId(
   CvmIdObjectSchema.extend({
-    public_sysinfo: import_zod27.z.boolean(),
-    public_logs: import_zod27.z.boolean()
+    public_sysinfo: import_zod28.z.boolean(),
+    public_logs: import_zod28.z.boolean()
   })
 );
 var { action: updateCvmVisibility, safeAction: safeUpdateCvmVisibility } = defineAction(CvmLegacyDetailSchema, async (client, request) => {
@@ -1965,21 +2064,21 @@ var { action: updateCvmVisibility, safeAction: safeUpdateCvmVisibility } = defin
 });
 
 // src/actions/cvms/get_available_os_images.ts
-var import_zod28 = require("zod");
-var OSImageVariantSchema = import_zod28.z.object({
-  name: import_zod28.z.string(),
-  os_image_hash: import_zod28.z.string().nullable(),
-  is_current: import_zod28.z.boolean()
+var import_zod29 = require("zod");
+var OSImageVariantSchema = import_zod29.z.object({
+  name: import_zod29.z.string(),
+  os_image_hash: import_zod29.z.string().nullable(),
+  is_current: import_zod29.z.boolean()
 });
-var AvailableOSImageSchema2 = import_zod28.z.object({
-  version: import_zod28.z.union([
-    import_zod28.z.tuple([import_zod28.z.number(), import_zod28.z.number(), import_zod28.z.number(), import_zod28.z.number()]),
-    import_zod28.z.tuple([import_zod28.z.number(), import_zod28.z.number(), import_zod28.z.number()])
+var AvailableOSImageSchema2 = import_zod29.z.object({
+  version: import_zod29.z.union([
+    import_zod29.z.tuple([import_zod29.z.number(), import_zod29.z.number(), import_zod29.z.number(), import_zod29.z.number()]),
+    import_zod29.z.tuple([import_zod29.z.number(), import_zod29.z.number(), import_zod29.z.number()])
   ]),
   prod: OSImageVariantSchema.nullable(),
   dev: OSImageVariantSchema.nullable()
 });
-var GetAvailableOSImagesResponseSchema = import_zod28.z.array(AvailableOSImageSchema2);
+var GetAvailableOSImagesResponseSchema = import_zod29.z.array(AvailableOSImageSchema2);
 var GetAvailableOSImagesRequestSchema = CvmIdSchema;
 var { action: getAvailableOsImages, safeAction: safeGetAvailableOsImages } = defineAction(GetAvailableOSImagesResponseSchema, async (client, request) => {
   const { cvmId } = GetAvailableOSImagesRequestSchema.parse(request);
@@ -1987,13 +2086,13 @@ var { action: getAvailableOsImages, safeAction: safeGetAvailableOsImages } = def
 });
 
 // src/actions/cvms/update_os_image.ts
-var import_zod29 = require("zod");
+var import_zod30 = require("zod");
 var UpdateOsImageRequestSchema = refineCvmId(
   CvmIdObjectSchema.extend({
-    os_image_name: import_zod29.z.string().min(1, "OS image name is required")
+    os_image_name: import_zod30.z.string().min(1, "OS image name is required")
   })
 );
-var { action: updateOsImage, safeAction: safeUpdateOsImage } = defineAction(import_zod29.z.void(), async (client, request) => {
+var { action: updateOsImage, safeAction: safeUpdateOsImage } = defineAction(import_zod30.z.void(), async (client, request) => {
   const parsed = UpdateOsImageRequestSchema.parse(request);
   const { cvmId } = CvmIdSchema.parse(parsed);
   const { os_image_name } = parsed;
@@ -2002,17 +2101,17 @@ var { action: updateOsImage, safeAction: safeUpdateOsImage } = defineAction(impo
 });
 
 // src/actions/cvms/get_cvm_state.ts
-var import_zod30 = require("zod");
-var CvmStateSchema = import_zod30.z.object({
-  id: import_zod30.z.string().optional(),
-  instance_id: import_zod30.z.string().optional(),
-  name: import_zod30.z.string(),
-  status: import_zod30.z.string(),
-  uptime: import_zod30.z.string().optional(),
-  exited_at: import_zod30.z.string().optional(),
-  boot_progress: import_zod30.z.string().optional(),
-  boot_error: import_zod30.z.string().optional(),
-  shutdown_progress: import_zod30.z.string().optional()
+var import_zod31 = require("zod");
+var CvmStateSchema = import_zod31.z.object({
+  id: import_zod31.z.string().optional(),
+  instance_id: import_zod31.z.string().optional(),
+  name: import_zod31.z.string(),
+  status: import_zod31.z.string(),
+  uptime: import_zod31.z.string().optional(),
+  exited_at: import_zod31.z.string().optional(),
+  boot_progress: import_zod31.z.string().optional(),
+  boot_error: import_zod31.z.string().optional(),
+  shutdown_progress: import_zod31.z.string().optional()
 });
 var GetCvmStateRequestSchema = CvmIdSchema;
 var { action: getCvmState, safeAction: safeGetCvmState } = defineAction(CvmStateSchema, async (client, request) => {
@@ -2050,6 +2149,8 @@ function createClient2(config = {}) {
     safeProvisionCvmComposeFileUpdate,
     commitCvmComposeFileUpdate,
     safeCommitCvmComposeFileUpdate,
+    updateCvmEnvs,
+    safeUpdateCvmEnvs,
     startCvm,
     safeStartCvm,
     stopCvm,
@@ -2093,7 +2194,7 @@ function createClient2(config = {}) {
 }
 
 // src/actions/blockchains/deploy_app_auth.ts
-var import_zod31 = require("zod");
+var import_zod32 = require("zod");
 var import_viem3 = require("viem");
 var import_accounts2 = require("viem/accounts");
 
@@ -2743,25 +2844,25 @@ var kmsAuthAbi = [
     anonymous: false
   }
 ];
-var DeployAppAuthRequestBaseSchema = import_zod31.z.object({
+var DeployAppAuthRequestBaseSchema = import_zod32.z.object({
   // Chain configuration (conditionally required)
-  chain: import_zod31.z.unknown().optional(),
-  rpcUrl: import_zod31.z.string().optional(),
+  chain: import_zod32.z.unknown().optional(),
+  rpcUrl: import_zod32.z.string().optional(),
   // Contract configuration (required)
-  kmsContractAddress: import_zod31.z.string(),
+  kmsContractAddress: import_zod32.z.string(),
   // Authentication mode: either privateKey OR walletClient (required, mutually exclusive)
-  privateKey: import_zod31.z.string().optional(),
-  walletClient: import_zod31.z.unknown().optional(),
+  privateKey: import_zod32.z.string().optional(),
+  walletClient: import_zod32.z.unknown().optional(),
   // Public client (optional, will create default if not provided)
-  publicClient: import_zod31.z.unknown().optional(),
+  publicClient: import_zod32.z.unknown().optional(),
   // App configuration (optional)
-  allowAnyDevice: import_zod31.z.boolean().optional().default(false),
-  deviceId: import_zod31.z.string().optional().default("0000000000000000000000000000000000000000000000000000000000000000"),
-  composeHash: import_zod31.z.string().optional().default("0000000000000000000000000000000000000000000000000000000000000000"),
-  disableUpgrades: import_zod31.z.boolean().optional().default(false),
+  allowAnyDevice: import_zod32.z.boolean().optional().default(false),
+  deviceId: import_zod32.z.string().optional().default("0000000000000000000000000000000000000000000000000000000000000000"),
+  composeHash: import_zod32.z.string().optional().default("0000000000000000000000000000000000000000000000000000000000000000"),
+  disableUpgrades: import_zod32.z.boolean().optional().default(false),
   // Validation configuration (optional)
-  skipPrerequisiteChecks: import_zod31.z.boolean().optional().default(false),
-  minBalance: import_zod31.z.string().optional()
+  skipPrerequisiteChecks: import_zod32.z.boolean().optional().default(false),
+  minBalance: import_zod32.z.string().optional()
   // ETH amount as string, e.g., "0.01"
 }).passthrough();
 var DeployAppAuthRequestSchema = DeployAppAuthRequestBaseSchema.refine(
@@ -2789,13 +2890,13 @@ var DeployAppAuthRequestSchema = DeployAppAuthRequestBaseSchema.refine(
     path: ["chain"]
   }
 );
-var DeployAppAuthSchema = import_zod31.z.object({
-  appId: import_zod31.z.string(),
-  appAuthAddress: import_zod31.z.string(),
-  deployer: import_zod31.z.string(),
-  transactionHash: import_zod31.z.string(),
-  blockNumber: import_zod31.z.bigint().optional(),
-  gasUsed: import_zod31.z.bigint().optional()
+var DeployAppAuthSchema = import_zod32.z.object({
+  appId: import_zod32.z.string(),
+  appAuthAddress: import_zod32.z.string(),
+  deployer: import_zod32.z.string(),
+  transactionHash: import_zod32.z.string(),
+  blockNumber: import_zod32.z.bigint().optional(),
+  gasUsed: import_zod32.z.bigint().optional()
 }).passthrough();
 function parseDeploymentResult(receipt, deployer, kmsContractAddress) {
   try {
@@ -3041,7 +3142,7 @@ async function safeDeployAppAuth(request, parameters) {
 }
 
 // src/actions/blockchains/add_compose_hash.ts
-var import_zod32 = require("zod");
+var import_zod33 = require("zod");
 var import_viem4 = require("viem");
 var import_accounts3 = require("viem/accounts");
 var appAuthAbi = [
@@ -3059,29 +3160,29 @@ var appAuthAbi = [
     anonymous: false
   }
 ];
-var AddComposeHashRequestSchema = import_zod32.z.object({
+var AddComposeHashRequestSchema = import_zod33.z.object({
   // Chain configuration (conditionally required)
-  chain: import_zod32.z.unknown().optional(),
-  rpcUrl: import_zod32.z.string().optional(),
-  appId: import_zod32.z.string(),
-  composeHash: import_zod32.z.string(),
+  chain: import_zod33.z.unknown().optional(),
+  rpcUrl: import_zod33.z.string().optional(),
+  appId: import_zod33.z.string(),
+  composeHash: import_zod33.z.string(),
   // Authentication mode: either privateKey OR walletClient (required, mutually exclusive)
-  privateKey: import_zod32.z.string().optional(),
-  walletClient: import_zod32.z.unknown().optional(),
+  privateKey: import_zod33.z.string().optional(),
+  walletClient: import_zod33.z.unknown().optional(),
   // Public client (optional, will create default if not provided)
-  publicClient: import_zod32.z.unknown().optional(),
+  publicClient: import_zod33.z.unknown().optional(),
   // Validation configuration (optional)
-  skipPrerequisiteChecks: import_zod32.z.boolean().optional().default(false),
-  minBalance: import_zod32.z.string().optional(),
+  skipPrerequisiteChecks: import_zod33.z.boolean().optional().default(false),
+  minBalance: import_zod33.z.string().optional(),
   // ETH amount as string, e.g., "0.01"
   // Transaction control options
-  timeout: import_zod32.z.number().optional().default(12e4),
-  retryOptions: import_zod32.z.unknown().optional(),
-  signal: import_zod32.z.unknown().optional(),
+  timeout: import_zod33.z.number().optional().default(12e4),
+  retryOptions: import_zod33.z.unknown().optional(),
+  signal: import_zod33.z.unknown().optional(),
   // Progress callbacks
-  onTransactionStateChange: import_zod32.z.function().optional(),
-  onTransactionSubmitted: import_zod32.z.function().optional(),
-  onTransactionConfirmed: import_zod32.z.function().optional()
+  onTransactionStateChange: import_zod33.z.function().optional(),
+  onTransactionSubmitted: import_zod33.z.function().optional(),
+  onTransactionConfirmed: import_zod33.z.function().optional()
 }).passthrough().refine(
   (data) => {
     const hasPrivateKey = !!data.privateKey;
@@ -3105,12 +3206,12 @@ var AddComposeHashRequestSchema = import_zod32.z.object({
     path: ["chain"]
   }
 );
-var AddComposeHashSchema = import_zod32.z.object({
-  composeHash: import_zod32.z.string(),
-  appId: import_zod32.z.string(),
-  transactionHash: import_zod32.z.string(),
-  blockNumber: import_zod32.z.bigint().optional(),
-  gasUsed: import_zod32.z.bigint().optional()
+var AddComposeHashSchema = import_zod33.z.object({
+  composeHash: import_zod33.z.string(),
+  appId: import_zod33.z.string(),
+  transactionHash: import_zod33.z.string(),
+  blockNumber: import_zod33.z.bigint().optional(),
+  gasUsed: import_zod33.z.bigint().optional()
 }).passthrough();
 function parseComposeHashResult(receipt, composeHash, appAuthAddress, appId) {
   console.log(receipt.logs);
@@ -3302,13 +3403,13 @@ async function safeAddComposeHash(request, parameters) {
 }
 
 // src/actions/cvms/watch_cvm_state.ts
-var import_zod33 = require("zod");
-var WatchCvmStateParamsSchema = import_zod33.z.object({
-  target: import_zod33.z.string().describe("Target status to wait for (e.g., 'running', 'stopped')"),
-  interval: import_zod33.z.number().min(5).max(30).default(5).describe("Polling interval in seconds"),
-  timeout: import_zod33.z.number().min(10).max(600).default(300).describe("Timeout per attempt in seconds"),
-  maxRetries: import_zod33.z.number().min(0).default(Number.POSITIVE_INFINITY).describe("Maximum number of retry attempts (Infinity for unlimited)"),
-  retryDelay: import_zod33.z.number().min(0).default(5e3).describe("Delay between retries in milliseconds")
+var import_zod34 = require("zod");
+var WatchCvmStateParamsSchema = import_zod34.z.object({
+  target: import_zod34.z.string().describe("Target status to wait for (e.g., 'running', 'stopped')"),
+  interval: import_zod34.z.number().min(5).max(30).default(5).describe("Polling interval in seconds"),
+  timeout: import_zod34.z.number().min(10).max(600).default(300).describe("Timeout per attempt in seconds"),
+  maxRetries: import_zod34.z.number().min(0).default(Number.POSITIVE_INFINITY).describe("Maximum number of retry attempts (Infinity for unlimited)"),
+  retryDelay: import_zod34.z.number().min(0).default(5e3).describe("Delay between retries in milliseconds")
 });
 var WatchCvmStateRequestSchema = WatchCvmStateParamsSchema;
 var WatchAbortedError = class extends Error {
@@ -3596,6 +3697,7 @@ var import_verify_env_encrypt_public_key = require("@phala/dstack-sdk/verify-env
   RequestError,
   ResourceError,
   RestartCvmRequestSchema,
+  SUPPORTED_API_VERSIONS,
   SUPPORTED_CHAINS,
   ServerError,
   ShutdownCvmRequestSchema,
@@ -3603,6 +3705,8 @@ var import_verify_env_encrypt_public_key = require("@phala/dstack-sdk/verify-env
   StopCvmRequestSchema,
   TransactionError,
   UnknownError,
+  UpdateCvmEnvsRequestSchema,
+  UpdateCvmEnvsResultSchema,
   UpdateCvmResourcesRequestSchema,
   UpdateCvmVisibilityRequestSchema,
   UpdateOsImageRequestSchema,
@@ -3703,6 +3807,7 @@ var import_verify_env_encrypt_public_key = require("@phala/dstack-sdk/verify-env
   safeShutdownCvm,
   safeStartCvm,
   safeStopCvm,
+  safeUpdateCvmEnvs,
   safeUpdateCvmResources,
   safeUpdateCvmVisibility,
   safeUpdateOsImage,
@@ -3712,6 +3817,7 @@ var import_verify_env_encrypt_public_key = require("@phala/dstack-sdk/verify-env
   startCvm,
   stopCvm,
   switchToNetwork,
+  updateCvmEnvs,
   updateCvmResources,
   updateCvmVisibility,
   updateOsImage,