feat: two-phase CVM deploy support (prepareOnly + commitCvmUpdate)#217
Merged
feat: two-phase CVM deploy support (prepareOnly + commitCvmUpdate)#217
Conversation
…e action
- patchCvm: add prepareOnly option that sends X-Prepare-Only header,
and include commitToken/commitUrl/apiCommitUrl in hash-required response
- New commitCvmUpdate action: POST /cvms/{id}/commit-update with token-based
auth for completing multisig CVM updates
…ates - --prepare-only: run Phase 1 only, output compose_hash + commit token info - --commit: complete a prepared update using --token, --compose-hash, and --transaction-hash (skips compose file reading) - Add usage examples for multisig workflows
Contributor
📋 Check Results✨ JS SDK - Code FormattingShow format check results🔍 JS SDK - TypeScript Type CheckShow type check output🧪 JS SDK - Test ResultsShow test output📝 JS SDK - Lint CheckShow lint results🌐 JS SDK - Browser CompatibilityShow browser test results🌐 Browser Compatibility ReportBrowser compatibility tests completed across:
The SDK has been verified to work in modern browser environments. Check run: https://github.com/Phala-Network/phala-cloud/actions/runs/23404685997 |
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
Also add webhook integration guide to docs covering: - Payload format and supported events - HMAC-SHA256 signature verification (Python + Node.js examples) - Delivery behavior: 2xx success, no redirect following, 10s timeout - Retry policy: 4 attempts (1min, 10min, 1h intervals) - Best practices for idempotency, replay protection, and HTTPS
…hain CVM Without the return, execution fell through to the generic success output, producing double JSON output that breaks consuming scripts.
The commit-update endpoint is token-based (no auth needed). Previously getApiClient threw if no API key was configured, blocking signers who only have a commit token.
dedent template literal was mangling backslash continuations. Build the commit command separately with explicit join.
Display chain name, chain ID, and contract explorer link when using --prepare-only. Also note that API Commit URL uses POST method.
Compose hash is now displayed as 0x-prefixed hex in both human-readable and JSON output for direct copy-paste compatibility.
…tting fix: CLI --prepare-only output formatting
…-info feat: CLI --prepare-only shows chain ID and block explorer
fix: CLI compose hash 0x prefix in --prepare-only
- Contract explorer URL: 0x prefix on contract address - Expired/invalid token error: suggest running --prepare-only again
Show compose hash and device ID registration status from on-chain check. When all prerequisites are met, suggest using --transaction-hash already-registered. Also add expired token hint suggesting --prepare-only re-run.
…ash optional - Replace dedent template literal with line-by-line array join for consistent output formatting without indentation artifacts - --transaction-hash is now optional in --commit mode; defaults to 'already-registered' (state-only check) with info message - --compose-hash also optional (server reads from token)
pacoyang
approved these changes
Mar 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add multisig-friendly two-phase CVM deploy support to the JS SDK and CLI.
JS SDK
patchCvm: newprepareOnlyoption sendsX-Prepare-Only: trueheader; 465 response now includescommitToken,commitUrl,apiCommitUrlcommitCvmUpdate: new action callingPOST /cvms/{id}/commit-updatewith token-based auth (no API key required)CLI
--prepare-only: run Phase 1 only, output compose hash + commit token info (JSON or human-readable)--commit --token <t> --compose-hash <h> --transaction-hash <tx>: complete a previously prepared update (skips compose file reading)Test Plan
cd js && bun run fmt && bun run lint && bun run type-check && bun run test— 666 passedcd cli && bun run fmt && bun run lint && bun run type-check && bun run test— 403 passedManual Testing