@ethernity-cloud/sdk-js 1.5.2 → 1.5.5

package/nodenithy/build/securelock/src/ecld_state.js

@@ -61,6 +61,38 @@ function configure({ identityPriv, swiftStreamService, bucket, contractAddress,
   _contractAddress = contractAddress;
   _provider = provider;
   _esrLedger = [];
+  _taskLedger = {};
+}
+
+// Task-scoped ledger of every state key this execution touched, recorded by
+// get()/commit(). ecldResult() snapshots it to attach fresh state to the task
+// result, so callers (and the runner's state cache) get current state in the
+// same result -- no separate read task needed. Reset per task in configure().
+let _taskLedger = {};
+
+function ledgerRecord(key, version, cid, state) {
+  _taskLedger[key] = { key, version: Number(version), cid, state };
+}
+
+/**
+ * The `esr` attachment for ecldResult: wallet + entries. Synchronous by
+ * design (the securelock consumes results synchronously): entries come from
+ * the in-memory ledger of keys this task already touched. To attach a key the
+ * task did not touch, use the async esrFetch() helper, which awaits the reads
+ * (populating the ledger) before building the result.
+ */
+function ledgerSnapshot(includeState = true, keys = null) {
+  const reg = new StateRegistry();
+  const wanted = keys ? keys : Object.keys(_taskLedger);
+  const entries = [];
+  for (const k of wanted) {
+    const e = _taskLedger[k];
+    if (!e) continue;
+    const entry = { ...e };
+    if (!includeState) delete entry.state;
+    entries.push(entry);
+  }
+  return { wallet: reg.walletAddress, entries };
 }
 
 function keccak256(buf) {
@@ -216,7 +248,10 @@ class StateRegistry {
    */
   async get(key, fallback = {}) {
     const [cid, version] = await this._contract().getState(this.walletAddress, keyHash(key));
-    if (!version || !cid) return fallback;
+    if (!version || !cid) {
+      ledgerRecord(key, 0, null, fallback);
+      return fallback;
+    }
     if (!looksLikeCID(cid)) {
       throw new Error(
         `ESR entry for '${key}' holds a pointer that is not a CID (${cid.slice(0, 32)}…). ` +
@@ -224,7 +259,9 @@ class StateRegistry {
       );
     }
     const blob = await this._fetch(key, cid);
-    return JSON.parse(decrypt(blob).toString('utf8'));
+    const state = JSON.parse(decrypt(blob).toString('utf8'));
+    ledgerRecord(key, version, cid, state);
+    return state;
   }
 
   /**
@@ -255,6 +292,9 @@ class StateRegistry {
       try {
         // eslint-disable-next-line no-await-in-loop
         await this._sendCommit(keyHash(key), cid, currentVersion);
+        // Record the POST-commit values: this is what the chain will show
+        // once the node's relay lands (version increments by one).
+        ledgerRecord(key, currentVersion + 1, cid, newState);
         return newState;
       } catch (e) {
         const msg = String(e && e.message ? e.message : e);
@@ -340,5 +380,6 @@ module.exports = {
   StateRegistry,
   configure,
   cidv1Raw,
-  looksLikeCID
+  looksLikeCID,
+  ledgerSnapshot
 };

package/nodenithy/build/securelock/src/etny_crypto.js

@@ -1,211 +1,211 @@
-const fs = require("fs");
-const elliptic = require('elliptic');
-const crypto = require('crypto');
-const rs = require('jsrsasign');
-const ECKey = require('ec-key');
-const curve = new elliptic.ec('p384');
-const ascii85 = require('ascii85');
-const ethSigUtil = require('@metamask/eth-sig-util');
-const {createHash} = require('crypto');
-
-function sha256(content) {
-    return createHash('sha256').update(content).digest('hex');
-}
-
-function fileChecksum(file) {
-    const fileContent = fs.readFileSync(file, 'utf8');
-    return sha256(fileContent);
-}
-
-async function fileChecksumFromSwiftStream(swiftStreamClient, bucketName, fileName) {
-    const fileContent = await swiftStreamClient.getFileContent(bucketName, fileName);
-    //console.log(fileContent);
-    return sha256(fileContent);
-}
-
-const getPEMFromPublicFile = (publicKeyPath) => {
-    const publicKey = fs.readFileSync(publicKeyPath, 'utf8');
-    return crypto.createPublicKey(publicKey).export({type: 'spki', format: 'pem'});
-}
-
-const getPEMFromPublic = (publicKey) => {
-    return crypto.createPublicKey(publicKey).export({type: 'spki', format: 'pem'});
-}
-
-const loadCertificate = (certificate) => {
-    //console.log(certificate)
-    const publicKeyPEM = getPEMFromPublic(certificate);
-    const key = new ECKey(publicKeyPEM, 'pem');
-    //console.log(key);
-    return key;
-}
-
-// Accepts EITHER a path to a PEM file or the PEM text itself.
-//
-// mainnet keeps passing a path: CAS injects the key into key_file after
-// attestation, and that flow is unchanged. On testnet the enclave self-derives
-// its key and now holds it only in memory (never writes it), so it passes the
-// PEM straight through -- nothing about the key ever reaches the filesystem.
-// Detection is on the PEM header, not on file existence, so a path that does
-// not exist still fails loudly instead of being mistaken for key material.
-function getPrivatePointFromPrivateKey(privateKeyOrFile) {
-    const value = String(privateKeyOrFile || '');
-    const privateKey = value.includes('-----BEGIN')
-        ? value
-        : fs.readFileSync(value, 'utf8');
-    let privateKeyHex = rs.KEYUTIL.getKey(privateKey).prvKeyHex;
-    const privateKeyObject = curve.keyFromPrivate(privateKeyHex, 'hex');
-    return privateKeyObject.getPrivate();
-}
-
-const generatePublicKey = (x, y) => {
-    const pub = {x: x, y};
-    return curve.keyFromPublic(pub, 'hex');
-}
-
-function getPublicPointFromCoords(x, y) {
-    const publicKey = generatePublicKey(x, y);
-    return publicKey.getPublic();
-}
-
-function ecc_point_to_256_bit_key(point) {
-    const value = point.getX().toString() + point.getY().toString();
-    const hash = crypto.createHash('sha256');
-    hash.update(value);
-    return hash.digest();
-}
-
-function encryptedDataToBase64Json(encryptedMsg) {
-    const key = curve.keyFromPublic(encryptedMsg.cipherTextPublicKey, 'hex');
-    const jsonObj = {
-        ciphertext: encryptedMsg.ciphertext.toString('hex'),
-        nonce: encryptedMsg.nonce.toString('hex'),
-        authTag: encryptedMsg.authTag.toString('hex'),
-        x: key.getPublic().getX(),
-        y: key.getPublic().getY()
-    };
-    const jsonString = JSON.stringify(jsonObj);
-    const binaryData = Buffer.from(jsonString, 'utf8');
-    return binaryData.toString('base64');
-}
-
-function encryptedDataFromBase64Json(base64Data) {
-    // decode the base64-encoded string back to a JSON string
-    const decodedJsonData = Buffer.from(base64Data, 'base64').toString('utf8');
-    return JSON.parse(decodedJsonData);
-}
-
-
-function encrypt(certificate, message) {
-    const key = loadCertificate(certificate);
-    return encrypt_ecc(message, generatePublicKey(key.x, key.y));
-}
-
-function encrypt_ecc(msg, publicKey) {
-    const cipherTextPrivateKey = crypto.randomBytes(32);
-    const sharedEccKey = publicKey.getPublic().mul(cipherTextPrivateKey);
-    const secretKey = ecc_point_to_256_bit_key(sharedEccKey);
-    const iv = crypto.randomBytes(16);
-    const cipher = crypto.createCipheriv('aes-256-gcm', secretKey, iv);
-    let encrypted = cipher.update(msg, 'utf8', 'hex');
-    encrypted += cipher.final('hex');
-    const cipherTextPublicKey = curve.g.mul(cipherTextPrivateKey);
-    return {
-        ciphertext: encrypted,
-        secretKey: secretKey,
-        nonce: iv,
-        authTag: cipher.getAuthTag().toString("hex"),
-        cipherTextPublicKey: cipherTextPublicKey.encode('hex')
-    };
-}
-
-function decrypt(privateKeyFile, encryptedMsg) {
-    //console.log(privateKeyFile);
-    const privatePoint = getPrivatePointFromPrivateKey(privateKeyFile);
-    return decrypt_ecc(encryptedMsg, privatePoint);
-}
-
-function decrypt_ecc(encryptedMsg, privatePoint) {
-    try {
-        const {ciphertext, nonce, authTag, x, y} = encryptedMsg;
-        const publicPoint = getPublicPointFromCoords(`${x}`, `${y}`);
-        const sharedEccKey = publicPoint.mul(privatePoint);
-        const secretKey = ecc_point_to_256_bit_key(sharedEccKey);
-
-        const decipher = crypto.createDecipheriv('aes-256-gcm', secretKey, Buffer.from(nonce, 'hex'));
-        decipher.setAuthTag(Buffer.from(authTag, 'hex'));
-        let decrypted = decipher.update(ciphertext, 'hex', 'utf8');
-        decrypted += decipher.final('utf8');
-        return decrypted;
-    } catch (e) {
-        console.log(`Error while decrypting ECC:`, e.message);
-        return false;
-    }
-}
-
-function hexToBytes(hexStr) {
-    if (hexStr.startsWith("0x")) {
-        hexStr = hexStr.slice(2);
-    }
-    return Buffer.from(hexStr, "hex");
-}
-
-function encryptWithPublicKey(publicKey, data) {
-    // Returned object contains 4 properties: version, ephemPublicKey, nonce, ciphertext
-    // Each contains data encoded using base64, version is always the same string
-    const enc = ethSigUtil.encrypt({
-        publicKey: hexToBytes(publicKey).toString('base64'),
-        data: ascii85.encode(Buffer.from(data)).toString(),
-        version: 'x25519-xsalsa20-poly1305',
-    });
-
-    // We want to store the data in smart contract, therefore we concatenate them
-    // into single Buffer
-    const buf = Buffer.concat([
-        Buffer.from(enc.ephemPublicKey, 'base64'),
-        Buffer.from(enc.nonce, 'base64'),
-        Buffer.from(enc.ciphertext, 'base64'),
-    ]);
-
-    // In smart contract we are using `bytes[112]` variable (fixed size byte array)
-    // you might need to use `bytes` type for dynamic sized array
-    // We are also using ethers.js which requires type `number[]` when passing data
-    // for argument of type `bytes` to the smart contract function
-    // Next line just converts the buffer to `number[]` required by contract function
-    // THIS LINE IS USED IN OUR ORIGINAL CODE:
-    // return buf.toJSON().data;
-
-    // Return just the Buffer to make the function directly compatible with decryptData function
-    return buf;
-}
-
-// (async () => {
-//     try {
-//         const message = 'testabc1';
-//         console.log('initial message:', message);
-//         const publicKeyPEM = getPEMFromPublic('./app/cert1-ca1-clean.crt');
-//         const ECKey = require('ec-key');
-//         const key = new ECKey(publicKeyPEM, 'pem');
-//         const encrypted_message = encrypt(key.x, key.y, message);
-//         console.log(encrypted_message);
-//         console.log(encryptedDataToBase64Json(encrypted_message));
-//         //
-//         // const encrypted_message = 'eyJjaXBoZXJ0ZXh0IjoiZTYzZTcyNDY0MWY4YWRmN2QyNjNmMTI0ZGYxZTdlYzZmNGM5NGU1NCIsIm5vbmNlIjoiYmE0YWU5YjMyOWFhZWRiM2ViZTM5MGU4YTY3YWFiNmMiLCJhdXRoVGFnIjoiOGU2NmI4NTVmNTE3N2E0NzZlMjkwNTE3Y2Q2ZDE3ZmUiLCJ4IjoiN2E1MjhhNGI5YzAzODM4Mjc0ZmFiYzVlM2RiOWQ2ZWFiNzBiZTFiMDA3YWJiOTcyYzI0YmFhNGE1ZmI4OGJjNTVmNDVlNGNkMjZjY2NhNTFhOTk3OGZkNDRhZmE1YjQ0IiwieSI6IjE5M2NjMWYwMzVmOGMxZjEzNGU4MTEzOGIyOTRiODBiZWQyYjkyMzdkZmIyOTMyOGRjOTg1MzlmMjhkNjIzMTJiYTQ2OTU2NDFkYjIyNjk0ZWUyNGFjZjQ4MjBiZDlhMSJ9';
-//         // const messageDecrypted = decrypt('./app/cert1-ca1-clean.key', encryptedDataToBase64Json(encrypted_message));
-//         // console.log('decrypted message:', messageDecrypted);
-//     } catch (e) {
-//         console.log(e);
-//     }
-//
-// })();
-
-module.exports = {
-    encryptedDataFromBase64Json,
-    encryptedDataToBase64Json,
-    encryptWithPublicKey,
-    decrypt,
-    encrypt,
-    sha256,
-    fileChecksum,
-    fileChecksumFromSwiftStream
-};
+const fs = require("fs");
+const elliptic = require('elliptic');
+const crypto = require('crypto');
+const rs = require('jsrsasign');
+const ECKey = require('ec-key');
+const curve = new elliptic.ec('p384');
+const ascii85 = require('ascii85');
+const ethSigUtil = require('@metamask/eth-sig-util');
+const {createHash} = require('crypto');
+
+function sha256(content) {
+    return createHash('sha256').update(content).digest('hex');
+}
+
+function fileChecksum(file) {
+    const fileContent = fs.readFileSync(file, 'utf8');
+    return sha256(fileContent);
+}
+
+async function fileChecksumFromSwiftStream(swiftStreamClient, bucketName, fileName) {
+    const fileContent = await swiftStreamClient.getFileContent(bucketName, fileName);
+    //console.log(fileContent);
+    return sha256(fileContent);
+}
+
+const getPEMFromPublicFile = (publicKeyPath) => {
+    const publicKey = fs.readFileSync(publicKeyPath, 'utf8');
+    return crypto.createPublicKey(publicKey).export({type: 'spki', format: 'pem'});
+}
+
+const getPEMFromPublic = (publicKey) => {
+    return crypto.createPublicKey(publicKey).export({type: 'spki', format: 'pem'});
+}
+
+const loadCertificate = (certificate) => {
+    //console.log(certificate)
+    const publicKeyPEM = getPEMFromPublic(certificate);
+    const key = new ECKey(publicKeyPEM, 'pem');
+    //console.log(key);
+    return key;
+}
+
+// Accepts EITHER a path to a PEM file or the PEM text itself.
+//
+// mainnet keeps passing a path: CAS injects the key into key_file after
+// attestation, and that flow is unchanged. On testnet the enclave self-derives
+// its key and now holds it only in memory (never writes it), so it passes the
+// PEM straight through -- nothing about the key ever reaches the filesystem.
+// Detection is on the PEM header, not on file existence, so a path that does
+// not exist still fails loudly instead of being mistaken for key material.
+function getPrivatePointFromPrivateKey(privateKeyOrFile) {
+    const value = String(privateKeyOrFile || '');
+    const privateKey = value.includes('-----BEGIN')
+        ? value
+        : fs.readFileSync(value, 'utf8');
+    let privateKeyHex = rs.KEYUTIL.getKey(privateKey).prvKeyHex;
+    const privateKeyObject = curve.keyFromPrivate(privateKeyHex, 'hex');
+    return privateKeyObject.getPrivate();
+}
+
+const generatePublicKey = (x, y) => {
+    const pub = {x: x, y};
+    return curve.keyFromPublic(pub, 'hex');
+}
+
+function getPublicPointFromCoords(x, y) {
+    const publicKey = generatePublicKey(x, y);
+    return publicKey.getPublic();
+}
+
+function ecc_point_to_256_bit_key(point) {
+    const value = point.getX().toString() + point.getY().toString();
+    const hash = crypto.createHash('sha256');
+    hash.update(value);
+    return hash.digest();
+}
+
+function encryptedDataToBase64Json(encryptedMsg) {
+    const key = curve.keyFromPublic(encryptedMsg.cipherTextPublicKey, 'hex');
+    const jsonObj = {
+        ciphertext: encryptedMsg.ciphertext.toString('hex'),
+        nonce: encryptedMsg.nonce.toString('hex'),
+        authTag: encryptedMsg.authTag.toString('hex'),
+        x: key.getPublic().getX(),
+        y: key.getPublic().getY()
+    };
+    const jsonString = JSON.stringify(jsonObj);
+    const binaryData = Buffer.from(jsonString, 'utf8');
+    return binaryData.toString('base64');
+}
+
+function encryptedDataFromBase64Json(base64Data) {
+    // decode the base64-encoded string back to a JSON string
+    const decodedJsonData = Buffer.from(base64Data, 'base64').toString('utf8');
+    return JSON.parse(decodedJsonData);
+}
+
+
+function encrypt(certificate, message) {
+    const key = loadCertificate(certificate);
+    return encrypt_ecc(message, generatePublicKey(key.x, key.y));
+}
+
+function encrypt_ecc(msg, publicKey) {
+    const cipherTextPrivateKey = crypto.randomBytes(32);
+    const sharedEccKey = publicKey.getPublic().mul(cipherTextPrivateKey);
+    const secretKey = ecc_point_to_256_bit_key(sharedEccKey);
+    const iv = crypto.randomBytes(16);
+    const cipher = crypto.createCipheriv('aes-256-gcm', secretKey, iv);
+    let encrypted = cipher.update(msg, 'utf8', 'hex');
+    encrypted += cipher.final('hex');
+    const cipherTextPublicKey = curve.g.mul(cipherTextPrivateKey);
+    return {
+        ciphertext: encrypted,
+        secretKey: secretKey,
+        nonce: iv,
+        authTag: cipher.getAuthTag().toString("hex"),
+        cipherTextPublicKey: cipherTextPublicKey.encode('hex')
+    };
+}
+
+function decrypt(privateKeyFile, encryptedMsg) {
+    //console.log(privateKeyFile);
+    const privatePoint = getPrivatePointFromPrivateKey(privateKeyFile);
+    return decrypt_ecc(encryptedMsg, privatePoint);
+}
+
+function decrypt_ecc(encryptedMsg, privatePoint) {
+    try {
+        const {ciphertext, nonce, authTag, x, y} = encryptedMsg;
+        const publicPoint = getPublicPointFromCoords(`${x}`, `${y}`);
+        const sharedEccKey = publicPoint.mul(privatePoint);
+        const secretKey = ecc_point_to_256_bit_key(sharedEccKey);
+
+        const decipher = crypto.createDecipheriv('aes-256-gcm', secretKey, Buffer.from(nonce, 'hex'));
+        decipher.setAuthTag(Buffer.from(authTag, 'hex'));
+        let decrypted = decipher.update(ciphertext, 'hex', 'utf8');
+        decrypted += decipher.final('utf8');
+        return decrypted;
+    } catch (e) {
+        console.log(`Error while decrypting ECC:`, e.message);
+        return false;
+    }
+}
+
+function hexToBytes(hexStr) {
+    if (hexStr.startsWith("0x")) {
+        hexStr = hexStr.slice(2);
+    }
+    return Buffer.from(hexStr, "hex");
+}
+
+function encryptWithPublicKey(publicKey, data) {
+    // Returned object contains 4 properties: version, ephemPublicKey, nonce, ciphertext
+    // Each contains data encoded using base64, version is always the same string
+    const enc = ethSigUtil.encrypt({
+        publicKey: hexToBytes(publicKey).toString('base64'),
+        data: ascii85.encode(Buffer.from(data)).toString(),
+        version: 'x25519-xsalsa20-poly1305',
+    });
+
+    // We want to store the data in smart contract, therefore we concatenate them
+    // into single Buffer
+    const buf = Buffer.concat([
+        Buffer.from(enc.ephemPublicKey, 'base64'),
+        Buffer.from(enc.nonce, 'base64'),
+        Buffer.from(enc.ciphertext, 'base64'),
+    ]);
+
+    // In smart contract we are using `bytes[112]` variable (fixed size byte array)
+    // you might need to use `bytes` type for dynamic sized array
+    // We are also using ethers.js which requires type `number[]` when passing data
+    // for argument of type `bytes` to the smart contract function
+    // Next line just converts the buffer to `number[]` required by contract function
+    // THIS LINE IS USED IN OUR ORIGINAL CODE:
+    // return buf.toJSON().data;
+
+    // Return just the Buffer to make the function directly compatible with decryptData function
+    return buf;
+}
+
+// (async () => {
+//     try {
+//         const message = 'testabc1';
+//         console.log('initial message:', message);
+//         const publicKeyPEM = getPEMFromPublic('./app/cert1-ca1-clean.crt');
+//         const ECKey = require('ec-key');
+//         const key = new ECKey(publicKeyPEM, 'pem');
+//         const encrypted_message = encrypt(key.x, key.y, message);
+//         console.log(encrypted_message);
+//         console.log(encryptedDataToBase64Json(encrypted_message));
+//         //
+//         // const encrypted_message = 'eyJjaXBoZXJ0ZXh0IjoiZTYzZTcyNDY0MWY4YWRmN2QyNjNmMTI0ZGYxZTdlYzZmNGM5NGU1NCIsIm5vbmNlIjoiYmE0YWU5YjMyOWFhZWRiM2ViZTM5MGU4YTY3YWFiNmMiLCJhdXRoVGFnIjoiOGU2NmI4NTVmNTE3N2E0NzZlMjkwNTE3Y2Q2ZDE3ZmUiLCJ4IjoiN2E1MjhhNGI5YzAzODM4Mjc0ZmFiYzVlM2RiOWQ2ZWFiNzBiZTFiMDA3YWJiOTcyYzI0YmFhNGE1ZmI4OGJjNTVmNDVlNGNkMjZjY2NhNTFhOTk3OGZkNDRhZmE1YjQ0IiwieSI6IjE5M2NjMWYwMzVmOGMxZjEzNGU4MTEzOGIyOTRiODBiZWQyYjkyMzdkZmIyOTMyOGRjOTg1MzlmMjhkNjIzMTJiYTQ2OTU2NDFkYjIyNjk0ZWUyNGFjZjQ4MjBiZDlhMSJ9';
+//         // const messageDecrypted = decrypt('./app/cert1-ca1-clean.key', encryptedDataToBase64Json(encrypted_message));
+//         // console.log('decrypted message:', messageDecrypted);
+//     } catch (e) {
+//         console.log(e);
+//     }
+//
+// })();
+
+module.exports = {
+    encryptedDataFromBase64Json,
+    encryptedDataToBase64Json,
+    encryptWithPublicKey,
+    decrypt,
+    encrypt,
+    sha256,
+    fileChecksum,
+    fileChecksumFromSwiftStream
+};

package/nodenithy/build/securelock/src/etny_exec.js

@@ -30,8 +30,84 @@ try {
     }
 }
 
+/**
+ * Automatic encoding for task results (single code path for all results):
+ * JSON-serializable values ride as JSON, strings as text, bytes-like as
+ * base64. Anything else is JSON-stringified with a String() fallback -- a
+ * task result never fails on encoding.
+ */
+function encodeResultData(data) {
+    if (Buffer.isBuffer(data) || data instanceof Uint8Array) {
+        return ['base64', Buffer.from(data).toString('base64')];
+    }
+    if (typeof data === 'string') {
+        return ['text', data];
+    }
+    try {
+        JSON.stringify(data);
+        return ['json', data === undefined ? null : data];
+    } catch (e) {
+        try {
+            return ['json', JSON.parse(JSON.stringify(data, (k, v) =>
+                typeof v === 'bigint' || typeof v === 'function' ? String(v) : v))];
+        } catch (e2) {
+            return ['text', String(data)];
+        }
+    }
+}
+
+/**
+ * Return a task result (THE way to end a task).
+ *
+ * Builds the structured result envelope:
+ *   { ecld: 1, type: 'json'|'text'|'base64', data: ..., esr: ... }
+ *
+ * - `data` is encoded automatically (see encodeResultData).
+ * - `state: true` (default) attaches the ESR state of every key this task
+ *   touched; `state: 'meta'` attaches {key, version, cid} without the state
+ *   payload; `state: false` attaches nothing.
+ * - `keys: [...]` restricts the attachment to those keys (already-touched
+ *   only -- to attach an untouched key, use the async esrFetch helper).
+ *
+ * ESR attachment is best-effort: an ESR-disabled build (or any attachment
+ * error) yields esr: null, never a failed task.
+ */
+function ecldResult(data = null, { state = true, keys = null } = {}) {
+    const [type, encoded] = encodeResultData(data);
+    const envelope = { ecld: 1, type, data: encoded, esr: null };
+    if (state || keys) {
+        try {
+            // eslint-disable-next-line global-require
+            const ecldState = require('./ecld_state');
+            envelope.esr = ecldState.ledgerSnapshot(state === true, keys);
+        } catch (e) {
+            envelope.esr = null;
+        }
+    }
+    return [0, JSON.stringify(envelope)];
+}
+
+/** Legacy alias: same builder, ESR attachment off -- today's behavior. */
 function ___etny_result___(data) {
-    return [0, data];
+    return ecldResult(data, { state: false });
+}
+
+/**
+ * Standard state-fetch task body: awaits the reads (populating the task
+ * ledger), then attaches them. The runner's cache-gated read submits this on
+ * a cache miss: `await esrFetch('profile-7')`.
+ */
+async function esrFetch(...keys) {
+    try {
+        // eslint-disable-next-line global-require
+        const { StateRegistry } = require('./ecld_state');
+        const reg = new StateRegistry();
+        for (const k of keys) {
+            // eslint-disable-next-line no-await-in-loop
+            await reg.get(k);
+        }
+    } catch (e) { /* ESR-disabled build: esr stays null */ }
+    return ecldResult(null, { keys: keys.length ? keys : null });
 }
 
 // Names of *_ADDRESS-style enclave config vars that are set but EMPTY.
@@ -66,7 +142,12 @@ function executeTask(payload, input) {
             ' image dependencies, or a bad require() inside backend.js.'
         ];
     }
-    return exec(payload, input, { '___etny_result___': ___etny_result___, ...backendFunctions });
+    return exec(payload, input, {
+        '___etny_result___': ___etny_result___,   // legacy alias (no ESR)
+        'ecldResult': ecldResult,                 // the result API
+        'esrFetch': esrFetch,                     // standard state-fetch task
+        ...backendFunctions,
+    });
 }
 
 function exec(payload, input, globals = null) {
@@ -80,7 +161,15 @@ function exec(payload, input, globals = null) {
             // the payload by bare name — matching how payloads are written
             // (e.g. `processData(___etny_data_set___)`).
             with (scope) {
-                return ___etny_result___(eval(payload));
+                const value = eval(payload);
+                // A payload that called ecldResult/___etny_result___ itself
+                // already holds the finished [0, envelopeJson] tuple -- pass
+                // it through instead of wrapping the result a second time.
+                if (Array.isArray(value) && value.length === 2 &&
+                    value[0] === 0 && typeof value[1] === 'string') {
+                    return value;
+                }
+                return ___etny_result___(value);
             }
         } else {
             return [TaskStatus.PAYLOAD_NOT_DEFINED, 'Could not find the source file to execute'];
@@ -88,24 +177,29 @@ function exec(payload, input, globals = null) {
 
         // return [TaskStatus.SUCCESS, 'TASK EXECUTED SUCCESSFULLY'];
     } catch (error) {
+        // A task returns its result by RETURNING (via ___etny_result___), not by
+        // throwing, so anything caught here is a genuine failure. In every branch
+        // deliver the FULL stack trace to the data owner AS THE RESULT (visible in
+        // their runner output) and never crash the enclave -- always return a
+        // normal [code, data] tuple so the trustedzone stops waiting. Honor the
+        // embedded-result SUCCESS (code 0) case first.
+        try {
+            if (error && error.args && error.args[0] && error.args[0][0] === 0) {
+                return [TaskStatus.SUCCESS, error.args[0][1]];
+            }
+        } catch (e) { /* fall through to failure reporting */ }
+
+        const detail = (error && (error.stack || error.message)) || String(error);
+        console.error('Error in payload execution -- full stack follows:\n' + detail);
+
         if (error instanceof ReferenceError) {
-            return [TaskStatus.SYSTEM_ERROR, error.message];
+            return [TaskStatus.SYSTEM_ERROR, 'SYSTEM_ERROR (ReferenceError): ' + detail];
         } else if (error instanceof EvalError) {
-            return [TaskStatus.KEY_ERROR, error.message];
+            return [TaskStatus.KEY_ERROR, 'KEY_ERROR (EvalError): ' + detail];
         } else if (error instanceof SyntaxError) {
-            return [TaskStatus.SYNTAX_WARNING, error.message];
-        } else if (error instanceof Error) {
-            try {
-                if (error.args[0][0] === 0) {
-                    return [TaskStatus.SUCCESS, error.args[0][1]];
-                } else {
-                    return [TaskStatus.BASE_EXCEPTION, error.args[0]];
-                }
-            } catch (e) {
-                return [TaskStatus.BASE_EXCEPTION, error.message];
-            }
+            return [TaskStatus.SYNTAX_WARNING, 'SYNTAX_WARNING (SyntaxError): ' + detail];
         } else {
-            return [TaskStatus.BASE_EXCEPTION, error.message];
+            return [TaskStatus.BASE_EXCEPTION, 'BASE_EXCEPTION: ' + detail];
         }
     }
 }