@ethernity-cloud/sdk-js 1.6.1 → 1.7.0

package/README.md

@@ -43,17 +43,52 @@ The sdk has been tested on the following operating systems:
       provisioned by the ethernity-cas validator set exactly as on mainnet.
       `ecld-publish` registers the securelock session on-chain in the
       SessionRegistry (`0xcb1F389b...`, see `cas/config.js`), resolves a CAS
-      from the ValidatorRegistry (`0xC40102c0...`, or `ECLD_CAS_ADDR=host:port`)
+      from the ValidatorRegistry (`0xa821b36F...`, or `ECLD_CAS_ADDR=host:port`)
       for the compose and the certificate harvest, takes the trustedzone
-      session name from the ImageRegistry, and links the session to the
-      published image. `ecld-build` signs the securelock `--production`.
-      Harvesting the certificate needs SGX. The other testnets have no CAS
-      deployment and self-sign from MR_ENCLAVE as before.
+      session name from the ImageRegistry (ECImageRegistryV2,
+      `0x99A84C62...`), and links the session to the published image. `ecld-build` signs the securelock `--production`.
+      Harvesting the certificate needs SGX.
+    - Testnet Unsafe - the unsafe network beside the testnet (see below).
     - Mainnet - to be provided during the following updates
+- LitVM:
+    - LiteForge - CAS-attested the same way, by LitVM's own ethernity-cas
+      validator set (SessionRegistry `0x8ad24b3F...`, ValidatorRegistry
+      `0x2E27677f...`).
+    - LiteForge Unsafe - the unsafe network beside LiteForge (see below).
 - Polyhon:
     - Amoy Testnet - to be provided during the following updates
     - Mainnet - to be provided during the following updates
 
+The remaining testnets (Amoy, IoTeX, Sepolia) have no ethernity-cas
+deployment: their enclaves are debug-signed and sign their own certificates
+from their measurement, and `ecld-publish` registers no CAS session for them.
+
+### The testnets and their unsafe networks
+`Bloxberg Testnet` and `LitVM LiteForge` run your securelock in an enclave
+attested through that chain's ethernity-cas validator set, on nodes whose
+platform the CAS can attest (DCAP). Each has an unsafe network beside it,
+`Bloxberg Testnet Unsafe` (`Bloxberg_Testnet_Unsafe`) and `LitVM LiteForge
+Unsafe` (`LitVM_LiteForge_Unsafe`): the same chain and contracts, for hardware
+SGX platforms the CAS cannot attest (EPID-only, SGX1). No CAS and no LAS: the
+enclaves are debug-signed and sign their own certificates from their
+measurement, so a result proves which image ran but not that an enclave ran
+it. You choose an unsafe network by name in `ecld-init`, and the runner runs an
+`-unsafe` trustedzone on nothing else, so a dApp that runs without a CAS
+always says so in the network it names. A dApp publishes one securelock per
+network from two project directories with the same project name: the unsafe
+one is registered as `<project>-unsafe` and runs on the
+`etny-<nodenithy|pynithy>-testnet-unsafe`
+(`ecld-<nodenithy|pynithy>-litvm-testnet-unsafe`) trustedzone. Both dApp types
+build for both networks. Mainnet has no unsafe network.
+
+### Pynithy dApps
+The Pynithy securelock is built exactly as `ethernity-cloud-sdk-py` builds it
+(`pynithy/build/securelock` is its copy): a SCONE 6.0.7 Python 3.14 enclave
+your backend is frozen into. `src/serverless/requirements.txt` lists the
+Python packages your backend imports, and `src/serverless/Dockerfile.serverless`
+adds system packages to the securelock base image. `ECLD_MEMORY_TO_ALLOCATE`
+sets the enclave heap (default `1024M`).
+
 ### Scripts
 
 - **Initialize**: To initialize the project, run:
@@ -97,6 +132,7 @@ The sdk has been tested on the following operating systems:
   npx ecld-run --file payload.js
   npx ecld-run --input data.json 'processData(___etny_data_set___)'
   npx ecld-run --json 'esrIncrement()'
+  npx ecld-run --unsafe 'hello("World")'
   ```
   This is the network-side sibling of `ecld-test`: instead of executing locally
   it drives the runner end to end — encrypt → IPFS → on-chain request → wait for
@@ -106,7 +142,9 @@ The sdk has been tested on the following operating systems:
   `--network`/`--securelock`/`--trustedzone`; the signing key is `PRIVATE_KEY`
   (or `ECLD_PRIVATE_KEY`) — a funded `0x` key that pays for the order. Resources
   are tunable with `--task-price`/`--cpu`/`--memory`/`--storage`/`--bandwidth`/`--duration`/`--validators`.
-  Exit code 0 on a `SUCCESS` task result, 1 otherwise.
+  Exit code 0 on a `SUCCESS` task result, 1 otherwise. `--unsafe` runs the
+  network's unsafe variant; on an unsafe network the securelock and
+  trustedzone default to their `-unsafe` names.
 
 - **Inspect (read-only)**: To read enclave and on-chain diagnostics — network,
   trustedzone/securelock registration, and ESR state — without spending gas, run:

package/cas/config.js

@@ -14,23 +14,81 @@
 // Kept in sync with etny-{pynithy,nodenithy}/v3/networks.yaml
 // (cas_session_registry_address, validator_registry_address).
 const VALIDATOR_REGISTRY = {
-  'etny-pynithy-testnet': '0xC40102c0b3f87663C925083861F38e2498C2038F',
-  'etny-nodenithy-testnet': '0xC40102c0b3f87663C925083861F38e2498C2038F',
+  'etny-pynithy-testnet': '0xa821b36F378F76c793c436F5f9c9CC36c684eBE5',
+  'etny-nodenithy-testnet': '0xa821b36F378F76c793c436F5f9c9CC36c684eBE5',
+  'ecld-pynithy-litvm-testnet': '0x2E27677fb67531eb09134fE331C27899f87ADe10',
+  'ecld-nodenithy-litvm-testnet': '0x2E27677fb67531eb09134fE331C27899f87ADe10',
 };
 
 const SESSION_REGISTRY = {
   'etny-pynithy-testnet': '0xcb1F389bF4524d1D61EDcbC24eC1F1F9C3FF4Fa6',
   'etny-nodenithy-testnet': '0xcb1F389bF4524d1D61EDcbC24eC1F1F9C3FF4Fa6',
+  'ecld-pynithy-litvm-testnet': '0x8ad24b3F406A41a0F8D3440021792EB203957F43',
+  'ecld-nodenithy-litvm-testnet': '0x8ad24b3F406A41a0F8D3440021792EB203957F43',
 };
 
 // The chain the registries above live on.
 const CHAIN = {
   'etny-pynithy-testnet': { rpcUrl: 'https://bloxberg.ethernity.cloud', chainId: 8995 },
   'etny-nodenithy-testnet': { rpcUrl: 'https://bloxberg.ethernity.cloud', chainId: 8995 },
+  'ecld-pynithy-litvm-testnet': { rpcUrl: 'https://liteforge.rpc.caldera.xyz/infra-partner-http', chainId: 4441 },
+  'ecld-nodenithy-litvm-testnet': { rpcUrl: 'https://liteforge.rpc.caldera.xyz/infra-partner-http', chainId: 4441 },
 };
 
 // Whether the securelock takes its certificate from a CAS session: mainnet
 // (Scontain CAS), or a testnet template with a SessionRegistry (ethernity-cas).
 const casProvisioned = (templateName, isMainnet) => isMainnet || Boolean(SESSION_REGISTRY[templateName]);
 
-module.exports = { VALIDATOR_REGISTRY, SESSION_REGISTRY, CHAIN, casProvisioned };
+// The mainnets, by BLOCKCHAIN_NETWORK. A template name does not tell: the Amoy
+// templates (ecld-*-amoy) do not contain "testnet".
+const MAINNETS = ['Bloxberg_Mainnet', 'Polygon_Mainnet'];
+const isMainnetNetwork = (network) =>
+  MAINNETS.some((name) => name.toUpperCase() === String(network || '').toUpperCase());
+
+// The -unsafe networks, by BLOCKCHAIN_NETWORK, each with the network it is the
+// unsafe variant of: the same chain and contracts, for SGX platforms the CAS
+// cannot attest (EPID-only, SGX1). No CAS and no LAS: the securelock is
+// debug-signed and self-signs from MR_ENCLAVE, is registered as
+// <project>-unsafe, and runs only against an -unsafe trustedzone. Mainnet has
+// none. Kept in sync with the *_unsafe entries of
+// etny-{pynithy,nodenithy}/v3/networks.yaml.
+const UNSAFE_NETWORKS = {
+  Bloxberg_Testnet_Unsafe: 'Bloxberg_Testnet',
+  LitVM_LiteForge_Unsafe: 'LitVM_LiteForge',
+};
+
+// Case-insensitive: ecld-init writes Bloxberg_Testnet_Unsafe, a --network
+// flag may say BLOXBERG_TESTNET_UNSAFE.
+const isUnsafeNetwork = (network) =>
+  Object.keys(UNSAFE_NETWORKS).some((name) => name.toUpperCase() === String(network || '').toUpperCase());
+
+// The name an image is registered and run under on `network`: <name>-unsafe
+// on an -unsafe network. A dApp's securelock is <project>-unsafe there, so its
+// two variants never share an image name, and an -unsafe network's
+// trustedzone is the -unsafe variant of its sibling's.
+const nameOnNetwork = (name, network) =>
+  !name || !isUnsafeNetwork(network) || name.endsWith('-unsafe') ? name : `${name}-unsafe`;
+
+// The network part of ENCLAVE_NAME_SECURELOCK: the second word of
+// BLOCKCHAIN_NETWORK, with _unsafe on an -unsafe network so the two variants
+// never share a session name.
+const sessionTag = (network) =>
+  `${network.split('_')[1].toLowerCase()}${isUnsafeNetwork(network) ? '_unsafe' : ''}`;
+
+// A compose template rendered for its network. A line tagged `# __CAS_ONLY__`
+// serves CAS attestation and is kept where a CAS provisions the enclaves, one
+// tagged `# __NO_CAS_ONLY__` where they self-sign, and one tagged
+// `# __SAFE_ONLY__` (the LAS) on every network but an -unsafe one. Kept lines
+// lose their tag.
+const renderCompose = (content, cas, unsafe) => content
+  .split('\n')
+  .filter((line) => !(/# __CAS_ONLY__$/.test(line) && !cas))
+  .filter((line) => !(/# __NO_CAS_ONLY__$/.test(line) && cas))
+  .filter((line) => !(/# __SAFE_ONLY__$/.test(line) && unsafe))
+  .map((line) => line.replace(/\s*# __(?:CAS|NO_CAS|SAFE)_ONLY__$/, ''))
+  .join('\n');
+
+module.exports = {
+  VALIDATOR_REGISTRY, SESSION_REGISTRY, CHAIN, casProvisioned, isMainnetNetwork,
+  UNSAFE_NETWORKS, isUnsafeNetwork, nameOnNetwork, sessionTag, renderCompose,
+};