provisionCvm

import { createClient, encryptEnvVars, parseEnvVars } from "@phala/cloud";

const client = createClient();

const provision = await client.provisionCvm({
  name: "my-app",
  instance_type: "tdx.small",
  compose_file: {
    docker_compose_file: composeYaml,
    allowed_envs: ["API_KEY", "SECRET"],
  },
});

// PHALA KMS returns app_id and pubkey directly
const encrypted = await encryptEnvVars(envVars, provision.app_env_encrypt_pubkey!);

await client.commitCvmProvision({
  app_id: provision.app_id!,
  compose_hash: provision.compose_hash,
  encrypted_env: encrypted,
  env_keys: ["API_KEY", "SECRET"],
});

import { deployAppAuth } from "@phala/cloud";

// Step 1: Provision — reserves the CVM but does not start it
const provision = await client.provisionCvm({
  name: "my-app",
  compose_file: { docker_compose_file: composeYaml },
  kms: "ETHEREUM",
});

// Step 2: Deploy an AppAuth contract to obtain an app_id
const deployed = await deployAppAuth({
  chain: provision.kms_info!.chain,
  rpcUrl: "https://...",
  kmsContractAddress: provision.kms_info!.kms_contract_address,
  privateKey: "0x...",
  deviceId: provision.device_id,
  composeHash: provision.compose_hash,
});

// Step 3: Commit — finalizes the deployment and starts the CVM
await client.commitCvmProvision({
  app_id: deployed.appId,
  compose_hash: provision.compose_hash,
  kms_id: provision.kms_id!,
  contract_address: deployed.appAuthAddress,
  deployer_address: deployed.deployer,
});

const result = await client.safeProvisionCvm({ ... });
if (result.success) {
  console.log(result.data.compose_hash);
} else {
  console.error(result.error);
}