@ethernity-cloud/sdk-js 1.5.4 → 1.5.8

package/nodenithy/build/securelock/src/ecld_state.js

@@ -54,13 +54,143 @@ let _provider = null;
  * Wire the registry to the enclave's identity, storage and chain access.
  * Called by securelock at task start; payload code never calls this.
  */
-function configure({ identityPriv, swiftStreamService, bucket, contractAddress, provider }) {
+function configure({ identityPriv, swiftStreamService, bucket, contractAddress, provider, caller = null }) {
   _identityPriv = identityPriv;
   _swift = swiftStreamService;
   _bucket = bucket;
   _contractAddress = contractAddress;
   _provider = provider;
   _esrLedger = [];
+  _taskLedger = {};
+  _taskCaller = normAddr(caller);
+}
+
+// The authenticated task caller: the wallet that placed the DO request, read
+// from the PoX contract by the TRUSTEDZONE and forwarded over its signed
+// handoff (caller.securelock + .sig, verified by securelock before configure).
+// null when the trustedzone did not supply one -- anonymity is never a
+// privilege: null cannot claim ownership or touch owned state.
+let _taskCaller = null;
+
+function taskCaller() {
+  return _taskCaller;
+}
+
+function normAddr(addr) {
+  return typeof addr === 'string' && addr ? addr.toLowerCase() : null;
+}
+
+/**
+ * State container + ACL. Stored blobs are either legacy (raw state --
+ * "unowned") or an owned container:
+ *   { _ecld_state: 1, acl: {...}, data: <state> }
+ * acl = { owner, read: [], write: [], public_read: false }. Enforcement
+ * happens HERE, inside the enclave, against the trustedzone-attested caller.
+ */
+const CONTAINER_MARK = '_ecld_state';
+
+class StatePermissionError extends Error {}
+
+function unwrapStored(stored) {
+  if (stored && typeof stored === 'object' && stored[CONTAINER_MARK] === 1) {
+    return [stored.acl || null, stored.data];
+  }
+  return [null, stored];
+}
+
+function wrapStored(acl, data, committedBy = null) {
+  // For owned state, bind the authoring caller (committedBy) INTO the blob, so
+  // it lands in the CID -- the field the securelock signs -- making the caller
+  // cryptographically bound to the commit, not merely a re-stampable sidecar.
+  if (!acl) return data;                 // unowned keeps the legacy shape
+  const container = { [CONTAINER_MARK]: 1, acl, data };
+  if (committedBy) container.committedBy = committedBy;
+  return container;
+}
+
+/**
+ * Post-payload: re-assert the trusted caller across the ESR ledger. Called by
+ * the securelock after the payload returns, with the attested caller captured
+ * before execution (outside the payload's reach). Overwrites callerUsed (and
+ * re-fixes enclave to the real signer) in every owned entry and RE-STAGES the
+ * ledger, so a forged callerUsed cannot reach the trustedzone. Returns true if
+ * any entry's callerUsed differed from the trusted value (tamper detected).
+ * Defence in depth -- the trustedzone and the CID-bound caller are the sound
+ * layers; this runs in the same process the payload subverted.
+ */
+async function restampLedgerCaller(trustedCaller) {
+  const trusted = normAddr(trustedCaller);
+  if (!_esrLedger.length) return false;
+  let tampered = false;
+  let signerAddr = null;
+  try {
+    signerAddr = await new StateRegistry()._signer().getAddress();
+  } catch (e) { signerAddr = null; }
+  for (const entry of _esrLedger) {
+    if (!entry.owned) continue;
+    if (normAddr(entry.callerUsed) !== trusted) tampered = true;
+    entry.callerUsed = trusted || '';
+    if (signerAddr) entry.enclave = signerAddr;
+  }
+  try {
+    await _swift.putFileContent(
+      _bucket, 'esr.authorizations.json', '',
+      Buffer.from(JSON.stringify(_esrLedger), 'utf8'));
+  } catch (e) { /* best-effort restage; trustedzone still adjudicates */ }
+  return tampered;
+}
+
+function aclMembers(acl, field) {
+  return new Set((acl[field] || []).map(normAddr).filter(Boolean));
+}
+
+function canRead(acl) {
+  if (!acl || acl.public_read) return true;
+  const c = _taskCaller;
+  if (!c) return false;
+  return c === normAddr(acl.owner) || aclMembers(acl, 'read').has(c) || aclMembers(acl, 'write').has(c);
+}
+
+function canWrite(acl) {
+  if (!acl) return true;                 // unowned: writable; claimed when a caller exists
+  const c = _taskCaller;
+  if (!c) return false;
+  return c === normAddr(acl.owner) || aclMembers(acl, 'write').has(c);
+}
+
+function newAcl(owner) {
+  return { owner, read: [], write: [], public_read: false };
+}
+
+// Task-scoped ledger of every state key this execution touched, recorded by
+// get()/commit(). ecldResult() snapshots it to attach fresh state to the task
+// result, so callers (and the runner's state cache) get current state in the
+// same result -- no separate read task needed. Reset per task in configure().
+let _taskLedger = {};
+
+function ledgerRecord(key, version, cid, state) {
+  _taskLedger[key] = { key, version: Number(version), cid, state };
+}
+
+/**
+ * The `esr` attachment for ecldResult: wallet + entries. Synchronous by
+ * design (the securelock consumes results synchronously): entries come from
+ * the in-memory ledger of keys this task already touched. To attach a key the
+ * task did not touch, use the async esrFetch() helper, which awaits the reads
+ * (populating the ledger) before building the result.
+ */
+function ledgerSnapshot(includeState = true, keys = null) {
+  const reg = new StateRegistry();
+  const wanted = keys ? keys : Object.keys(_taskLedger);
+  const entries = [];
+  for (const k of wanted) {
+    const e = _taskLedger[k];
+    if (!e) continue;
+    const entry = { ...e };
+    if (!includeState) delete entry.state;
+    entries.push(entry);
+  }
+  return { wallet: reg.walletAddress, entries };
 }
 
 function keccak256(buf) {
@@ -215,8 +345,23 @@ class StateRegistry {
    * state" would let the next commit overwrite data that is still recoverable.
    */
   async get(key, fallback = {}) {
+    const [acl, data, version, cid] = await this._readContainer(key, fallback);
+    if (!canRead(acl)) {
+      throw new StatePermissionError(
+        `caller ${_taskCaller || '<anonymous>'} has no read permission on ` +
+          `state key '${key}' (owner: ${acl.owner})`
+      );
+    }
+    ledgerRecord(key, version || 0, cid, data);
+    return data;
+  }
+
+  /** [acl, data, version, cid] for `key`; NO permission check here. */
+  async _readContainer(key, fallback = {}) {
     const [cid, version] = await this._contract().getState(this.walletAddress, keyHash(key));
-    if (!version || !cid) return fallback;
+    if (!version || !cid) {
+      return [null, fallback, 0, null];
+    }
     if (!looksLikeCID(cid)) {
       throw new Error(
         `ESR entry for '${key}' holds a pointer that is not a CID (${cid.slice(0, 32)}…). ` +
@@ -224,7 +369,9 @@ class StateRegistry {
       );
     }
     const blob = await this._fetch(key, cid);
-    return JSON.parse(decrypt(blob).toString('utf8'));
+    const stored = JSON.parse(decrypt(blob).toString('utf8'));
+    const [acl, data] = unwrapStored(stored);
+    return [acl, data, Number(version), cid];
   }
 
   /**
@@ -235,15 +382,39 @@ class StateRegistry {
    * retry, so concurrent tasks cannot silently lose updates.
    */
   async commit(key, mutate, attempts = 3) {
+    const transform = async (acl, data) => {
+      if (!canWrite(acl)) {
+        throw new StatePermissionError(
+          `caller ${_taskCaller || '<anonymous>'} has no write permission on ` +
+            `state key '${key}' (owner: ${acl.owner})`
+        );
+      }
+      let nextAcl = acl;
+      if (!nextAcl && _taskCaller) nextAcl = newAcl(_taskCaller); // first-writer-owns
+      return [nextAcl, await mutate(data)];
+    };
+    const [, newData] = await this._commitTransform(key, transform, attempts);
+    return newData;
+  }
+
+  /**
+   * Optimistic-concurrency commit of transform(acl, data, version) ->
+   * [newAcl, newData]. The stored blob is the wrapped container (or the bare
+   * data while unowned). On a version race we re-read and retry, so
+   * concurrent tasks cannot silently lose updates.
+   */
+  async _commitTransform(key, transform, attempts = 3) {
     let lastError = null;
     for (let attempt = 0; attempt < attempts; attempt += 1) {
       // eslint-disable-next-line no-await-in-loop
-      const currentVersion = await this.getVersion(key);
+      const [acl, data, currentVersion] = await this._readContainer(key);
       // eslint-disable-next-line no-await-in-loop
-      const current = currentVersion ? await this.get(key) : {};
-      const newState = await mutate(current);
+      const [nextAcl, newData] = await transform(acl, data, currentVersion);
+      // Bind the authoring caller into the blob (hence the CID/signature) for
+      // owned state.
+      const stored = wrapStored(nextAcl, newData, nextAcl ? _taskCaller : null);
 
-      const blob = encrypt(Buffer.from(JSON.stringify(newState), 'utf8'));
+      const blob = encrypt(Buffer.from(JSON.stringify(stored), 'utf8'));
       // Compute the CID from OUR bytes — never accept one from the node.
       const cid = cidv1Raw(blob);
 
@@ -254,8 +425,12 @@ class StateRegistry {
 
       try {
         // eslint-disable-next-line no-await-in-loop
-        await this._sendCommit(keyHash(key), cid, currentVersion);
-        return newState;
+        await this._sendCommit(keyHash(key), cid, currentVersion,
+          nextAcl ? normAddr(nextAcl.owner) : null);
+        // Record the POST-commit values (the DATA -- the ACL never leaves in
+        // results): this is what the chain shows once the relay lands.
+        ledgerRecord(key, currentVersion + 1, cid, newData);
+        return [nextAcl, newData];
       } catch (e) {
         const msg = String(e && e.message ? e.message : e);
         if (/VersionMismatch/i.test(msg) || /version/i.test(msg)) {
@@ -299,7 +474,7 @@ class StateRegistry {
     throw new Error(`Could not read state object for '${key}' (${cid})`);
   }
 
-  async _sendCommit(keyHashHex, cid, expectedVersion) {
+  async _sendCommit(keyHashHex, cid, expectedVersion, ownerAddr = null) {
     // The enclave never pays gas and does NO gas math: it SIGNS the commit
     // (commitFor) and stages the signed authorization for the node, which
     // relays it and pays. The trustedzone independently re-prices the whole
@@ -322,7 +497,15 @@ class StateRegistry {
       cid,
       expectedVersion: Number(expectedVersion),
       relayNonce: Number(relayNonce),
-      signature
+      signature,
+      // IMPERSONATION GUARD: the trustedzone requires callerUsed to equal the
+      // DO owner it reads from the PoX contract, so a payload that forged the
+      // in-enclave caller to impersonate another user is rejected outside the
+      // payload's process. It does NOT verify the caller was a permitted
+      // writer (it cannot read the encrypted ACL). Unowned commits carry no
+      // constraint.
+      callerUsed: _taskCaller || '',
+      owned: Boolean(ownerAddr)
     };
 
     _esrLedger.push(auth);
@@ -336,9 +519,100 @@ class StateRegistry {
   }
 }
 
+/** Owner-only ACL mutation; an unowned key is claimed first (owner = caller). */
+async function ownerOp(key, mutator) {
+  if (!_taskCaller) {
+    throw new StatePermissionError(
+      'state management requires an authenticated caller (the trustedzone supplied none)'
+    );
+  }
+  const reg = new StateRegistry();
+  const transform = async (acl, data) => {
+    let nextAcl = acl || newAcl(_taskCaller);
+    if (normAddr(nextAcl.owner) !== _taskCaller) {
+      throw new StatePermissionError(
+        `caller ${_taskCaller} is not the owner of state key '${key}' (owner: ${nextAcl.owner})`
+      );
+    }
+    nextAcl = mutator({ ...nextAcl });
+    return [nextAcl, data];
+  };
+  const [acl] = await reg._commitTransform(key, transform);
+  return { ...acl };
+}
+
+function assertLevel(level) {
+  if (level !== 'read' && level !== 'write') throw new Error("level must be 'read' or 'write'");
+}
+
+async function esrGrant(key, address, level = 'read') {
+  assertLevel(level);
+  const addr = normAddr(address);
+  if (!addr) throw new Error('a grantee address is required');
+  return ownerOp(key, (acl) => {
+    const members = new Set((acl[level] || []).map(normAddr).filter(Boolean));
+    members.add(addr);
+    acl[level] = [...members].sort();
+    return acl;
+  });
+}
+
+async function esrRevoke(key, address, level = 'read') {
+  assertLevel(level);
+  const addr = normAddr(address);
+  return ownerOp(key, (acl) => {
+    acl[level] = (acl[level] || []).map(normAddr).filter((a) => a && a !== addr).sort();
+    return acl;
+  });
+}
+
+async function esrSetPublicRead(key, enabled = true) {
+  return ownerOp(key, (acl) => {
+    acl.public_read = Boolean(enabled);
+    return acl;
+  });
+}
+
+async function esrTransfer(key, newOwner) {
+  const addr = normAddr(newOwner);
+  if (!addr) throw new Error('a new owner address is required');
+  return ownerOp(key, (acl) => {
+    acl.owner = addr;
+    return acl;
+  });
+}
+
+/** Owner address of `key`, or null while unowned. Exposes nothing else. */
+async function esrOwner(key) {
+  const [acl] = await new StateRegistry()._readContainer(key);
+  return acl ? acl.owner : null;
+}
+
+/** Owner-only: the full ACL of `key`. */
+async function esrAcl(key) {
+  const [acl] = await new StateRegistry()._readContainer(key);
+  if (!acl) return null;
+  if (!_taskCaller || normAddr(acl.owner) !== _taskCaller) {
+    throw new StatePermissionError(
+      `caller ${_taskCaller || '<anonymous>'} is not the owner of state key '${key}'`
+    );
+  }
+  return { ...acl };
+}
+
 module.exports = {
   StateRegistry,
   configure,
   cidv1Raw,
-  looksLikeCID
+  looksLikeCID,
+  ledgerSnapshot,
+  taskCaller,
+  restampLedgerCaller,
+  StatePermissionError,
+  esrGrant,
+  esrRevoke,
+  esrSetPublicRead,
+  esrTransfer,
+  esrOwner,
+  esrAcl
 };

package/nodenithy/build/securelock/src/etny_exec.js

@@ -30,8 +30,84 @@ try {
     }
 }
 
+/**
+ * Automatic encoding for task results (single code path for all results):
+ * JSON-serializable values ride as JSON, strings as text, bytes-like as
+ * base64. Anything else is JSON-stringified with a String() fallback -- a
+ * task result never fails on encoding.
+ */
+function encodeResultData(data) {
+    if (Buffer.isBuffer(data) || data instanceof Uint8Array) {
+        return ['base64', Buffer.from(data).toString('base64')];
+    }
+    if (typeof data === 'string') {
+        return ['text', data];
+    }
+    try {
+        JSON.stringify(data);
+        return ['json', data === undefined ? null : data];
+    } catch (e) {
+        try {
+            return ['json', JSON.parse(JSON.stringify(data, (k, v) =>
+                typeof v === 'bigint' || typeof v === 'function' ? String(v) : v))];
+        } catch (e2) {
+            return ['text', String(data)];
+        }
+    }
+}
+
+/**
+ * Return a task result (THE way to end a task).
+ *
+ * Builds the structured result envelope:
+ *   { ecld: 1, type: 'json'|'text'|'base64', data: ..., esr: ... }
+ *
+ * - `data` is encoded automatically (see encodeResultData).
+ * - `state: true` (default) attaches the ESR state of every key this task
+ *   touched; `state: 'meta'` attaches {key, version, cid} without the state
+ *   payload; `state: false` attaches nothing.
+ * - `keys: [...]` restricts the attachment to those keys (already-touched
+ *   only -- to attach an untouched key, use the async esrFetch helper).
+ *
+ * ESR attachment is best-effort: an ESR-disabled build (or any attachment
+ * error) yields esr: null, never a failed task.
+ */
+function ecldResult(data = null, { state = true, keys = null } = {}) {
+    const [type, encoded] = encodeResultData(data);
+    const envelope = { ecld: 1, type, data: encoded, esr: null };
+    if (state || keys) {
+        try {
+            // eslint-disable-next-line global-require
+            const ecldState = require('./ecld_state');
+            envelope.esr = ecldState.ledgerSnapshot(state === true, keys);
+        } catch (e) {
+            envelope.esr = null;
+        }
+    }
+    return [0, JSON.stringify(envelope)];
+}
+
+/** Legacy alias: same builder, ESR attachment off -- today's behavior. */
 function ___etny_result___(data) {
-    return [0, data];
+    return ecldResult(data, { state: false });
+}
+
+/**
+ * Standard state-fetch task body: awaits the reads (populating the task
+ * ledger), then attaches them. The runner's cache-gated read submits this on
+ * a cache miss: `await esrFetch('profile-7')`.
+ */
+async function esrFetch(...keys) {
+    try {
+        // eslint-disable-next-line global-require
+        const { StateRegistry } = require('./ecld_state');
+        const reg = new StateRegistry();
+        for (const k of keys) {
+            // eslint-disable-next-line no-await-in-loop
+            await reg.get(k);
+        }
+    } catch (e) { /* ESR-disabled build: esr stays null */ }
+    return ecldResult(null, { keys: keys.length ? keys : null });
 }
 
 // Names of *_ADDRESS-style enclave config vars that are set but EMPTY.
@@ -66,7 +142,23 @@ function executeTask(payload, input) {
             ' image dependencies, or a bad require() inside backend.js.'
         ];
     }
-    return exec(payload, input, { '___etny_result___': ___etny_result___, ...backendFunctions });
+    const scope = {
+        '___etny_result___': ___etny_result___,   // legacy alias (no ESR)
+        'ecldResult': ecldResult,                 // the result API
+        'esrFetch': esrFetch,                     // standard state-fetch task
+        ...backendFunctions,
+    };
+    // State ownership / ACL API (present only in ESR-enabled builds). Enforced
+    // inside ecld_state against the trustedzone-attested caller.
+    try {
+        // eslint-disable-next-line global-require
+        const ecldState = require('./ecld_state');
+        for (const name of ['taskCaller', 'esrGrant', 'esrRevoke',
+            'esrSetPublicRead', 'esrTransfer', 'esrOwner', 'esrAcl']) {
+            if (!(name in scope)) scope[name] = ecldState[name];
+        }
+    } catch (e) { /* non-ESR build */ }
+    return exec(payload, input, scope);
 }
 
 function exec(payload, input, globals = null) {
@@ -80,7 +172,15 @@ function exec(payload, input, globals = null) {
             // the payload by bare name — matching how payloads are written
             // (e.g. `processData(___etny_data_set___)`).
             with (scope) {
-                return ___etny_result___(eval(payload));
+                const value = eval(payload);
+                // A payload that called ecldResult/___etny_result___ itself
+                // already holds the finished [0, envelopeJson] tuple -- pass
+                // it through instead of wrapping the result a second time.
+                if (Array.isArray(value) && value.length === 2 &&
+                    value[0] === 0 && typeof value[1] === 'string') {
+                    return value;
+                }
+                return ___etny_result___(value);
             }
         } else {
             return [TaskStatus.PAYLOAD_NOT_DEFINED, 'Could not find the source file to execute'];

package/nodenithy/build/securelock/src/securelock.js.tmpl

@@ -436,6 +436,7 @@ class EtnySecureLock {
                 bucket: this.etny_bucket,
                 contractAddress: contractAddress,
                 provider: this.w3,
+                caller: this.task_caller || null,
             });
             console.log(`StateRegistry ready (ESR ${contractAddress})`);
         } catch (e) {
@@ -456,13 +457,58 @@ class EtnySecureLock {
             return false;
         }
 
+        // Attested task caller: the DO-request owner, forwarded by the
+        // trustedzone as caller.securelock + .sig. Accepted ONLY with a valid
+        // trustedzone signature -- this build's crypto module has no verify
+        // helper yet, so until one lands the caller stays unset (anonymous)
+        // rather than trusting an unverifiable value.
+        this.task_caller = null;
+        try {
+            const callerValue = await this.getFileContentAndDecrypt(this.etny_bucket, 'caller.securelock');
+            const callerSig = await this.getFileContentAndDecrypt(this.etny_bucket, 'caller.securelock.sig');
+            if (typeof etny_crypto.verifySignature === 'function') {
+                await this.getTrustedZonePublicKey();
+                if (etny_crypto.verifySignature(this.trustedZonePublicKey, callerValue, callerSig)) {
+                    this.task_caller = String(callerValue).trim();
+                    console.log(`Task caller attested by trustedzone: ${this.task_caller}`);
+                } else {
+                    console.error('caller.securelock signature validation FAILED; treating task as anonymous');
+                }
+            } else {
+                console.log('No signature-verify support in this build; ignoring caller.securelock (anonymous)');
+            }
+        } catch (e) {
+            console.log('No attested task caller supplied; treating task as anonymous');
+        }
+
         this.configureStateRegistry();
 
-        const task_result = executeTask(payload_data, input_data);
+        const task_result = await executeTask(payload_data, input_data);
         console.log('TASK RESULT (code, data):', task_result);
         this.task_code = task_result[0];
         this.task_result = task_result[1];
 
+        // Post-payload: re-assert the attested caller across the ESR ledger from
+        // THIS securelock's private copy (this.task_caller), captured before the
+        // payload ran and never handed to the payload. Corrects any callerUsed
+        // the payload may have forged (so the trustedzone reads the truth) and
+        // fails the task locally if a forgery is detected. Defence in depth;
+        // the trustedzone (separate enclave) and the CID-bound caller remain the
+        // authoritative layers.
+        try {
+            const ecld_state = require("./ecld_state");
+            if (typeof ecld_state.restampLedgerCaller === 'function') {
+                const tampered = await ecld_state.restampLedgerCaller(this.task_caller || null);
+                if (tampered) {
+                    console.error('ESR ledger caller was tampered with by the payload -- failing the task (SECURITY_VIOLATION).');
+                    this.task_code = TaskStatus.SECURITY_VIOLATION;
+                    this.task_result = 'SECURITY_VIOLATION: the task attempted to forge the state commit caller. The attested submitter was re-asserted and the task was terminated.';
+                }
+            }
+        } catch (e) {
+            console.error('ESR ledger re-stamp skipped:', e && e.message ? e.message : e);
+        }
+
         return true;
     }
 

package/nodenithy/build/securelock/src/task_status.js

@@ -17,6 +17,10 @@ class TaskStatus {
     static CONFIG_ERROR = 32;
     static EXECUTION_TIMEOUT = 33;      // Started but produced no result within the order duration.
     static ESR_GAS_LIMIT_EXCEEDED = 34; // ESR commits would exceed the per-order relayed-gas budget.
+    static SECURITY_VIOLATION = 35;     // A state commit was authorized under a caller other than
+                                        // the task's submitter (the in-enclave ownership check was
+                                        // bypassed). Set by the securelock on a detected forged
+                                        // caller, and by the trustedzone re-adjudication.
 }
 
 module.exports = {

package/nodenithy/build.mjs

@@ -115,6 +115,36 @@ try {
   process.exit(1);
 }
 
+// Safety lint: flag dynamic code execution -- especially of task input --
+// before the image is sealed. A hard error only for the case that actually
+// opens the enclave to a submitter (eval / Function of ___etny_data_set___);
+// everything else is a warning. See payloadLint.mjs for scope + opt-out.
+try {
+  const { analyze } = await import('../payloadLint.mjs');
+  const src = fs.readFileSync(backendFile, 'utf8');
+  const { findings, optedOut } = analyze(src, 'src/serverless/backend.js');
+  if (!optedOut) {
+    const warnings = findings.filter((f) => f.severity === 'warning');
+    const errors = findings.filter((f) => f.severity === 'error');
+    for (const f of warnings) {
+      console.warn(`WARNING: src/serverless/backend.js:${f.line}: ${f.message}`);
+    }
+    if (errors.length) {
+      console.error('');
+      console.error('ERROR: unsafe dynamic execution of task input in src/serverless/backend.js:');
+      for (const f of errors) console.error(`       line ${f.line}: ${f.message}`);
+      console.error('');
+      console.error('       This would let a task submitter run arbitrary code inside your enclave');
+      console.error('       and reach other users\' state. Fix it, or if the input is genuinely');
+      console.error('       trusted, add `// ecld: allow-eval` on that line to acknowledge the risk.');
+      process.exit(1);
+    }
+  }
+} catch (e) {
+  // The lint is best-effort; never block a build on the linter itself failing.
+  console.warn(`WARNING: payload safety lint skipped (${e && e.message ? e.message : e})`);
+}
+
 console.log(`Creating destination directory: ${destDir}`);
 fs.mkdirSync(destDir, { recursive: true });
 

package/package.json

@@ -1,50 +1,51 @@
-{
-  "name": "@ethernity-cloud/sdk-js",
-  "version": "1.5.4",
-  "description": "A package to run ethernity cloud build scripts",
-  "scripts": {
-    "ecld-build": "cross-env node ./node_modules/@ethernity-cloud/sdk-js/build.js",
-    "ecld-publish": "cross-env node ./node_modules/@ethernity-cloud/sdk-js/publish.js",
-    "ecld-init": "cross-env node ./node_modules/@ethernity-cloud/sdk-js/init.js",
-    "ecld-run": "cross-env ecld-run",
-    "postinstall": "node postinstall.js",
-    "ecld-test": "cross-env node ./node_modules/@ethernity-cloud/sdk-js/test.js"
-  },
-  "bin": {
-    "ecld-build": "./build.js",
-    "ecld-publish": "./publish.js",
-    "ecld-init": "./init.js",
-    "postinstall": "./postinstall.js",
-    "ecld-test": "./test.js"
-  },
-  "files": [
-    "nodenithy/*",
-    "pynithy/*",
-    "build.js",
-    "init.js",
-    "publish.js",
-    "postinstall.js"
-  ],
-  "dependencies": {
-    "@ethernity-cloud/runner": "^0.0.26",
-    "axios": "^1.7.2",
-    "commander": "^12.1.0",
-    "dotenv": "^16.4.5",
-    "eth-lib": "^0.1.29",
-    "ethers": "^5.5.4",
-    "kubo-rpc-client": "^4.1.1",
-    "web3": "^4.9.0",
-    "cross-env": "^7.0.3",
-    "shelljs": "^0.8.5",
-    "shx": "^0.3.4",
-    "node-forge": "^1.3.1",
-    "cli-progress": "^3.12.0",
-    "react": "^18.3.1",
-    "react-dom": "^18.3.1",
-    "react-scripts": "^5.0.1",
-    "web-vitals": "^2.1.4",
-    "adm-zip": "^0.5.14"
-  },
-  "author": "Alexandru Luca",
-  "license": "AGPL-3.0"
-}
+{
+  "name": "@ethernity-cloud/sdk-js",
+  "version": "1.5.8",
+  "description": "A package to run ethernity cloud build scripts",
+  "scripts": {
+    "ecld-build": "cross-env node ./node_modules/@ethernity-cloud/sdk-js/build.js",
+    "ecld-publish": "cross-env node ./node_modules/@ethernity-cloud/sdk-js/publish.js",
+    "ecld-init": "cross-env node ./node_modules/@ethernity-cloud/sdk-js/init.js",
+    "ecld-run": "cross-env ecld-run",
+    "postinstall": "node postinstall.js",
+    "ecld-test": "cross-env node ./node_modules/@ethernity-cloud/sdk-js/test.js"
+  },
+  "bin": {
+    "ecld-build": "./build.js",
+    "ecld-publish": "./publish.js",
+    "ecld-init": "./init.js",
+    "postinstall": "./postinstall.js",
+    "ecld-test": "./test.js"
+  },
+  "files": [
+    "nodenithy/*",
+    "pynithy/*",
+    "build.js",
+    "init.js",
+    "publish.js",
+    "postinstall.js"
+  ],
+  "dependencies": {
+    "@ethernity-cloud/runner": "^0.0.26",
+    "axios": "^1.7.2",
+    "commander": "^12.1.0",
+    "dotenv": "^16.4.5",
+    "eth-lib": "^0.1.29",
+    "ethers": "^5.5.4",
+    "kubo-rpc-client": "^4.1.1",
+    "web3": "^4.9.0",
+    "cross-env": "^7.0.3",
+    "shelljs": "^0.8.5",
+    "shx": "^0.3.4",
+    "node-forge": "^1.3.1",
+    "cli-progress": "^3.12.0",
+    "react": "^18.3.1",
+    "react-dom": "^18.3.1",
+    "react-scripts": "^5.0.1",
+    "web-vitals": "^2.1.4",
+    "adm-zip": "^0.5.14",
+    "acorn": "^8.11.0"
+  },
+  "author": "Alexandru Luca",
+  "license": "AGPL-3.0"
+}