@ethernity-cloud/sdk-js 1.6.2 → 1.7.1

package/README.md

@@ -43,17 +43,52 @@ The sdk has been tested on the following operating systems:
       provisioned by the ethernity-cas validator set exactly as on mainnet.
       `ecld-publish` registers the securelock session on-chain in the
       SessionRegistry (`0xcb1F389b...`, see `cas/config.js`), resolves a CAS
-      from the ValidatorRegistry (`0xa821b36F...`, or `ECLD_CAS_ADDR=host:port`)
+      from the ValidatorRegistry (`0x0014aB10...`, or `ECLD_CAS_ADDR=host:port`)
       for the compose and the certificate harvest, takes the trustedzone
       session name from the ImageRegistry (ECImageRegistryV2,
       `0x99A84C62...`), and links the session to the published image. `ecld-build` signs the securelock `--production`.
-      Harvesting the certificate needs SGX. The other testnets have no CAS
-      deployment and self-sign from MR_ENCLAVE as before.
+      Harvesting the certificate needs SGX.
+    - Testnet Unsafe - the unsafe network beside the testnet (see below).
     - Mainnet - to be provided during the following updates
+- LitVM:
+    - LiteForge - CAS-attested the same way, by LitVM's own ethernity-cas
+      validator set (SessionRegistry `0x8ad24b3F...`, ValidatorRegistry
+      `0xbE3759f3...`).
+    - LiteForge Unsafe - the unsafe network beside LiteForge (see below).
 - Polyhon:
     - Amoy Testnet - to be provided during the following updates
     - Mainnet - to be provided during the following updates
 
+The remaining testnets (Amoy, IoTeX, Sepolia) have no ethernity-cas
+deployment: their enclaves are debug-signed and sign their own certificates
+from their measurement, and `ecld-publish` registers no CAS session for them.
+
+### The testnets and their unsafe networks
+`Bloxberg Testnet` and `LitVM LiteForge` run your securelock in an enclave
+attested through that chain's ethernity-cas validator set, on nodes whose
+platform the CAS can attest (DCAP). Each has an unsafe network beside it,
+`Bloxberg Testnet Unsafe` (`Bloxberg_Testnet_Unsafe`) and `LitVM LiteForge
+Unsafe` (`LitVM_LiteForge_Unsafe`): the same chain and contracts, for hardware
+SGX platforms the CAS cannot attest (EPID-only, SGX1). No CAS and no LAS: the
+enclaves are debug-signed and sign their own certificates from their
+measurement, so a result proves which image ran but not that an enclave ran
+it. You choose an unsafe network by name in `ecld-init`, and the runner runs an
+`-unsafe` trustedzone on nothing else, so a dApp that runs without a CAS
+always says so in the network it names. A dApp publishes one securelock per
+network from two project directories with the same project name: the unsafe
+one is registered as `<project>-unsafe` and runs on the
+`etny-<nodenithy|pynithy>-testnet-unsafe`
+(`ecld-<nodenithy|pynithy>-litvm-testnet-unsafe`) trustedzone. Both dApp types
+build for both networks. Mainnet has no unsafe network.
+
+### Pynithy dApps
+The Pynithy securelock is built exactly as `ethernity-cloud-sdk-py` builds it
+(`pynithy/build/securelock` is its copy): a SCONE 6.0.7 Python 3.14 enclave
+your backend is frozen into. `src/serverless/requirements.txt` lists the
+Python packages your backend imports, and `src/serverless/Dockerfile.serverless`
+adds system packages to the securelock base image. `ECLD_MEMORY_TO_ALLOCATE`
+sets the enclave heap (default `1024M`).
+
 ### Scripts
 
 - **Initialize**: To initialize the project, run:
@@ -97,6 +132,7 @@ The sdk has been tested on the following operating systems:
   npx ecld-run --file payload.js
   npx ecld-run --input data.json 'processData(___etny_data_set___)'
   npx ecld-run --json 'esrIncrement()'
+  npx ecld-run --unsafe 'hello("World")'
   ```
   This is the network-side sibling of `ecld-test`: instead of executing locally
   it drives the runner end to end — encrypt → IPFS → on-chain request → wait for
@@ -106,7 +142,9 @@ The sdk has been tested on the following operating systems:
   `--network`/`--securelock`/`--trustedzone`; the signing key is `PRIVATE_KEY`
   (or `ECLD_PRIVATE_KEY`) — a funded `0x` key that pays for the order. Resources
   are tunable with `--task-price`/`--cpu`/`--memory`/`--storage`/`--bandwidth`/`--duration`/`--validators`.
-  Exit code 0 on a `SUCCESS` task result, 1 otherwise.
+  Exit code 0 on a `SUCCESS` task result, 1 otherwise. `--unsafe` runs the
+  network's unsafe variant; on an unsafe network the securelock and
+  trustedzone default to their `-unsafe` names.
 
 - **Inspect (read-only)**: To read enclave and on-chain diagnostics — network,
   trustedzone/securelock registration, and ESR state — without spending gas, run:
@@ -151,63 +189,63 @@ function hello(msg='World') {
 
 module.exports = { hello };
 ```
-From your frontend application, using the ethernity cloud runner library, you will be calling the function as seen in the below example, where we pass `hello("World");` to be executed on the backend which will run in the Blockchain:
+From your frontend application, using the ethernity cloud runner library (`@ethernity-cloud/runner`, installed by `ecld-init` at the version this SDK depends on), you will be calling the function as seen in the below example, where we pass `hello("World");` to be executed on the backend which will run in the Blockchain. `npm start` runs `src/preStart.mjs` first, which fills the constants at the top from the project's `.env`: the securelock name the dApp is published as, the trustedzone it was built against, the network's token address and chain id, the `-unsafe` network when the dApp runs without a CAS, and the IPFS endpoint.
 ```js
-const AppCss = require('./App.css');
+import './App.css';
 import EthernityCloudRunner from "@ethernity-cloud/runner";
-import {ECEvent, ECRunner, ECStatus} from "@ethernity-cloud/runner/enums";
-import Web3 from 'web3';
+import { ECStatus } from "@ethernity-cloud/runner/enums";
 
+// Filled in from the project's .env by src/preStart.mjs on `npm start`.
 const PROJECT_NAME = "";
+const TRUSTED_ZONE_IMAGE = "";
+const NETWORK_ADDRESS = "";
+const CHAIN_ID = null;
+const UNSAFE_NETWORK = null;
 const IPFS_ENDPOINT = "";
 
+// A call into src/serverless/backend.js; its return value is the task result.
 const code = `hello("World");`;
 
 function App() {
     const executeTask = async () => {
-        const runner = new EthernityCloudRunner();
-        // this is a server provided by Ethernity CLOUD, please bear in mind that you can use your own Decentralized Storage server
-        const ipfsAddress = IPFS_ENDPOINT;
-        runner.initializeStorage(ipfsAddress);
-        console.log(PROJECT_NAME)
-        const onTaskProgress = (e) => {
-            if (e.detail.status === ECStatus.ERROR) {
-                console.error(e.detail.message);
-            } else {
-                console.log(e.detail.message);
-            }
-        };
-
-        const onTaskCompleted = (e) => {
-            console.log(`Task Result: ${e.detail.message.result}`);
-            // display the result in page below the buttons
-            const result = document.createElement("p");
-            result.innerHTML = `Task Result: ${e.detail.message.result}`;
-            document.body.appendChild(result);
+        // The browser wallet (MetaMask) signs and pays for the order.
+        const runner = new EthernityCloudRunner(NETWORK_ADDRESS, {}, CHAIN_ID || undefined);
+        if (UNSAFE_NETWORK) {
+            await runner.setNetwork(...UNSAFE_NETWORK);
         }
-
-        runner.addEventListener(ECEvent.TASK_PROGRESS, onTaskProgress);
-        runner.addEventListener(ECEvent.TASK_COMPLETED, onTaskCompleted);
-
-        await runner.run(PROJECT_NAME,
-                        code,
-                         '',
-                         { taskPrice: 10, cpu: 1, memory: 1, storage: 10, bandwidth: 1, duration: 1, validators: 1 });
+        runner.initializeStorage(IPFS_ENDPOINT);
+
+        // Events are named by task status; detail is { message, status, progress }.
+        runner.addEventListener(ECStatus.DEFAULT, (e) => {
+            console.log(`[${e.detail.progress}] ${e.detail.message}`);
+        });
+        runner.addEventListener(ECStatus.ERROR, (e) => {
+            console.error(e.detail.message);
+        });
+        runner.addEventListener(ECStatus.SUCCESS, async () => {
+            const result = await runner.getResult();
+            console.log(`Task Result: ${result}`);
+            const line = document.createElement("p");
+            line.textContent = `Task Result: ${result}`;
+            document.body.appendChild(line);
+        });
+
+        const resources = { taskPrice: 10, cpu: 1, memory: 1, storage: 10, bandwidth: 1, duration: 1, validators: 1 };
+        await runner.run(resources, PROJECT_NAME, code, '', TRUSTED_ZONE_IMAGE);
     };
+
     const connectWallet = async () => {
-      if (window.ethereum) {
-          window.web3 = new Web3(window.ethereum);
-          try {
-              // Request account access
-              await window.ethereum.request({ method: 'eth_requestAccounts' });
-              console.log("Wallet connected");
-          } catch (error) {
-              console.error("User denied account access");
-          }
-      } else {
-          console.log('Please install MetaMask!');
-      }
-  };
+        if (!window.ethereum) {
+            console.log('Please install MetaMask!');
+            return;
+        }
+        try {
+            await window.ethereum.request({ method: 'eth_requestAccounts' });
+            console.log("Wallet connected");
+        } catch (error) {
+            console.error("User denied account access");
+        }
+    };
 
     return (
         <div className="container">

package/cas/config.js

@@ -14,23 +14,81 @@
 // Kept in sync with etny-{pynithy,nodenithy}/v3/networks.yaml
 // (cas_session_registry_address, validator_registry_address).
 const VALIDATOR_REGISTRY = {
-  'etny-pynithy-testnet': '0xa821b36F378F76c793c436F5f9c9CC36c684eBE5',
-  'etny-nodenithy-testnet': '0xa821b36F378F76c793c436F5f9c9CC36c684eBE5',
+  'etny-pynithy-testnet': '0x0014aB102FEa6b02e3D793FF4b9a0Af309fB4E14',
+  'etny-nodenithy-testnet': '0x0014aB102FEa6b02e3D793FF4b9a0Af309fB4E14',
+  'ecld-pynithy-litvm-testnet': '0xbE3759f327e8643fC5A1717fb2072A0dAcBAD29E',
+  'ecld-nodenithy-litvm-testnet': '0xbE3759f327e8643fC5A1717fb2072A0dAcBAD29E',
 };
 
 const SESSION_REGISTRY = {
   'etny-pynithy-testnet': '0xcb1F389bF4524d1D61EDcbC24eC1F1F9C3FF4Fa6',
   'etny-nodenithy-testnet': '0xcb1F389bF4524d1D61EDcbC24eC1F1F9C3FF4Fa6',
+  'ecld-pynithy-litvm-testnet': '0x8ad24b3F406A41a0F8D3440021792EB203957F43',
+  'ecld-nodenithy-litvm-testnet': '0x8ad24b3F406A41a0F8D3440021792EB203957F43',
 };
 
 // The chain the registries above live on.
 const CHAIN = {
   'etny-pynithy-testnet': { rpcUrl: 'https://bloxberg.ethernity.cloud', chainId: 8995 },
   'etny-nodenithy-testnet': { rpcUrl: 'https://bloxberg.ethernity.cloud', chainId: 8995 },
+  'ecld-pynithy-litvm-testnet': { rpcUrl: 'https://liteforge.rpc.caldera.xyz/infra-partner-http', chainId: 4441 },
+  'ecld-nodenithy-litvm-testnet': { rpcUrl: 'https://liteforge.rpc.caldera.xyz/infra-partner-http', chainId: 4441 },
 };
 
 // Whether the securelock takes its certificate from a CAS session: mainnet
 // (Scontain CAS), or a testnet template with a SessionRegistry (ethernity-cas).
 const casProvisioned = (templateName, isMainnet) => isMainnet || Boolean(SESSION_REGISTRY[templateName]);
 
-module.exports = { VALIDATOR_REGISTRY, SESSION_REGISTRY, CHAIN, casProvisioned };
+// The mainnets, by BLOCKCHAIN_NETWORK. A template name does not tell: the Amoy
+// templates (ecld-*-amoy) do not contain "testnet".
+const MAINNETS = ['Bloxberg_Mainnet', 'Polygon_Mainnet'];
+const isMainnetNetwork = (network) =>
+  MAINNETS.some((name) => name.toUpperCase() === String(network || '').toUpperCase());
+
+// The -unsafe networks, by BLOCKCHAIN_NETWORK, each with the network it is the
+// unsafe variant of: the same chain and contracts, for SGX platforms the CAS
+// cannot attest (EPID-only, SGX1). No CAS and no LAS: the securelock is
+// debug-signed and self-signs from MR_ENCLAVE, is registered as
+// <project>-unsafe, and runs only against an -unsafe trustedzone. Mainnet has
+// none. Kept in sync with the *_unsafe entries of
+// etny-{pynithy,nodenithy}/v3/networks.yaml.
+const UNSAFE_NETWORKS = {
+  Bloxberg_Testnet_Unsafe: 'Bloxberg_Testnet',
+  LitVM_LiteForge_Unsafe: 'LitVM_LiteForge',
+};
+
+// Case-insensitive: ecld-init writes Bloxberg_Testnet_Unsafe, a --network
+// flag may say BLOXBERG_TESTNET_UNSAFE.
+const isUnsafeNetwork = (network) =>
+  Object.keys(UNSAFE_NETWORKS).some((name) => name.toUpperCase() === String(network || '').toUpperCase());
+
+// The name an image is registered and run under on `network`: <name>-unsafe
+// on an -unsafe network. A dApp's securelock is <project>-unsafe there, so its
+// two variants never share an image name, and an -unsafe network's
+// trustedzone is the -unsafe variant of its sibling's.
+const nameOnNetwork = (name, network) =>
+  !name || !isUnsafeNetwork(network) || name.endsWith('-unsafe') ? name : `${name}-unsafe`;
+
+// The network part of ENCLAVE_NAME_SECURELOCK: the second word of
+// BLOCKCHAIN_NETWORK, with _unsafe on an -unsafe network so the two variants
+// never share a session name.
+const sessionTag = (network) =>
+  `${network.split('_')[1].toLowerCase()}${isUnsafeNetwork(network) ? '_unsafe' : ''}`;
+
+// A compose template rendered for its network. A line tagged `# __CAS_ONLY__`
+// serves CAS attestation and is kept where a CAS provisions the enclaves, one
+// tagged `# __NO_CAS_ONLY__` where they self-sign, and one tagged
+// `# __SAFE_ONLY__` (the LAS) on every network but an -unsafe one. Kept lines
+// lose their tag.
+const renderCompose = (content, cas, unsafe) => content
+  .split('\n')
+  .filter((line) => !(/# __CAS_ONLY__$/.test(line) && !cas))
+  .filter((line) => !(/# __NO_CAS_ONLY__$/.test(line) && cas))
+  .filter((line) => !(/# __SAFE_ONLY__$/.test(line) && unsafe))
+  .map((line) => line.replace(/\s*# __(?:CAS|NO_CAS|SAFE)_ONLY__$/, ''))
+  .join('\n');
+
+module.exports = {
+  VALIDATOR_REGISTRY, SESSION_REGISTRY, CHAIN, casProvisioned, isMainnetNetwork,
+  UNSAFE_NETWORKS, isUnsafeNetwork, nameOnNetwork, sessionTag, renderCompose,
+};

package/info.js

@@ -33,26 +33,34 @@ const fs = require('fs');
 const path = require('path');
 const { ethers } = require('ethers');
 try { require('dotenv').config(); } catch (e) { /* dotenv optional */ }
+const casConfig = require('./cas/config.js');
 
 // Authoritative per-network values (mirror of the Python SDK's network table).
 const NETWORKS = {
   BLOXBERG_MAINNET: {
-    type: 'mainnet', chainId: 8995, rpc: 'https://core.bloxberg.org',
+    type: 'mainnet', chainId: 8995, rpc: 'https://bloxberg.ethernity.cloud',
     protocol: '0x549A6E06BB2084100148D50F51CF77a3436C3Ae7',
     imageRegistry: '0x15D73a742529C3fb11f3FA32EF7f0CC3870ACA31',
     esr: '0x4Bf5cDE3BFD73dd10B707f8B123Ba631D2EBEAD2',
   },
   BLOXBERG_TESTNET: {
-    type: 'testnet', chainId: 8995, rpc: 'https://core.bloxberg.org',
+    type: 'testnet', chainId: 8995, rpc: 'https://bloxberg.ethernity.cloud',
     protocol: '0x02882F03097fE8cD31afbdFbB5D72a498B41112c',
     imageRegistry: '0x99A84C624C028bdf0a855A1E9E3f2fcf7275B3D8',
     esr: '0x0Ea1728EAE108FD3B9340ae91451348E2Cc6b4E4',
   },
   LITVM_LITEFORGE: {
-    type: 'testnet', chainId: 0, rpc: 'https://liteforge.rpc.caldera.xyz/infra-partner-http',
-    protocol: '', imageRegistry: '', esr: '0x709052Fe77Af543d3d9FE2Ac06a15c635c8D4Be5',
+    type: 'testnet', chainId: 4441, rpc: 'https://liteforge.rpc.caldera.xyz/infra-partner-http',
+    protocol: '0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2',
+    imageRegistry: '0x55e0ad455Be85162b71a790f00Fc305680E3CE53',
+    esr: '0x709052Fe77Af543d3d9FE2Ac06a15c635c8D4Be5',
   },
 };
+// The -unsafe networks: the chain and contracts of the network each is the
+// unsafe variant of, without a CAS.
+for (const [unsafe, sibling] of Object.entries(casConfig.UNSAFE_NETWORKS)) {
+  NETWORKS[unsafe.toUpperCase()] = { ...NETWORKS[sibling.toUpperCase()], type: 'unsafe testnet, no CAS' };
+}
 
 const IMAGE_REGISTRY_ABI = [
   'function imageDetails(string) view returns (address owner, string ipfsHash, string version, string session, uint256 fee, address rewardAddress, bool validated, bool published, string certPublicKey, string dockerComposeHash, string name)',
@@ -296,7 +304,8 @@ async function main() {
   const prov = provider(net.rpc);
 
   const ipfs = args.ipfs || process.env.IPFS_HASH || null;
-  const projName = args.name || process.env.PROJECT_NAME || null;
+  // <PROJECT_NAME>-unsafe on an -unsafe network, which is how publish registers it.
+  const projName = args.name || casConfig.nameOnNetwork(process.env.PROJECT_NAME, netName) || null;
 
   if (section === 'esr') {
     args.esrCmd = args._[1];

package/init.js

@@ -2,6 +2,7 @@ const fs = require("fs");
 const readline = require("readline");
 const { spawn, execSync } = require("child_process");
 const path = require("path");
+const casConfig = require("./cas/config.js");
 
 const rl = readline.createInterface({
   input: process.stdin,
@@ -179,6 +180,8 @@ const main = async () => {
     "IoTeX Testnet",
     "Ethereum Sepolia",
     "LitVM LiteForge",
+    "Bloxberg Testnet Unsafe",
+    "LitVM LiteForge Unsafe",
   ];
   const blockchainNetwork = await promptOptions(
     "On which Blockchain network do you want to have the app set up, as a starting point? (default is Bloxberg Testnet): ",
@@ -186,9 +189,20 @@ const main = async () => {
     "Bloxberg Testnet",
   );
   console.log();
+  const network = blockchainNetwork.replace(/ /g, "_");
+  if (casConfig.isUnsafeNetwork(network)) {
+    const sibling = casConfig.UNSAFE_NETWORKS[network].replace(/_/g, " ");
+    console.log(`${blockchainNetwork} runs your dApp WITHOUT a CAS, on the chain and contracts of ${sibling},`);
+    console.log("for SGX platforms the CAS cannot attest (EPID-only, SGX1). Its enclaves are debug-signed and");
+    console.log("sign their own certificates from their measurement: a result proves which image ran, not that");
+    console.log(`an enclave ran it. The securelock is registered as <project>-unsafe; choose ${sibling} for`);
+    console.log("a CAS-attested run.");
+    console.log();
+  }
+  const imageName = casConfig.nameOnNetwork(projectName.replace(/ /g, "-"), network);
 
   console.log(
-    `Checking if the project name (image name) is available on the ${blockchainNetwork.replace(/ /g, "_")} network and ownership...`,
+    `Checking if the project name (image name ${imageName}) is available on the ${network} network and ownership...`,
   );
   // const { execSync } = require('child_process');
   // execSync(`python $(pwd)/node_modules/@ethernity-cloud/sdk-js/nodenithy/run/image_registry.py "${blockchainNetwork.replace(/ /g, "_")}" "${projectName.replace(/ /g, "-")}" v3`);
@@ -198,8 +212,8 @@ const main = async () => {
     new Promise((resolve, reject) => {
       const child = spawn("node", [
         scriptPath,
-        blockchainNetwork.replace(/ /g, "_"),
-        projectName.replace(/ /g, "-"),
+        network,
+        imageName,
         "v3",
       ]);
       // Handle stdout data
@@ -296,9 +310,11 @@ const main = async () => {
       );
     }
     console.log("Installing required packages...");
-    // Simulate npm install
+    // The app runs on the runner at the range this SDK depends on; the spec is
+    // quoted because cmd.exe treats a bare ^ as its escape character.
+    const runnerSpec = `@ethernity-cloud/runner@${require("./package.json").dependencies["@ethernity-cloud/runner"]}`;
     execSync(
-      "npm install @ethernity-cloud/runner@0.0.26 @testing-library/jest-dom@5.17.0 @testing-library/react@13.4.0 @testing-library/user-event@13.5.0 react@18.3.1 react-dom@18.3.1 react-scripts@5.0.1 web-vitals@2.1.4 web3@4.9.0 dotenv@16.4.5",
+      `npm install "${runnerSpec}" @testing-library/jest-dom@5.17.0 @testing-library/react@13.4.0 @testing-library/user-event@13.5.0 react@18.3.1 react-dom@18.3.1 react-scripts@5.0.1 web-vitals@2.1.4 dotenv@16.4.5`,
       { stdio: "inherit" },
     );
   } else {
@@ -342,12 +358,14 @@ const main = async () => {
     "IoTeX Testnet": `ecld-${svc}-iotex-testnet`,
     "Ethereum Sepolia": `ecld-${svc}-ethereum-sepolia`,
     "LitVM LiteForge": `ecld-${svc}-litvm-testnet`,
+    "Bloxberg Testnet Unsafe": `etny-${svc}-testnet-unsafe`,
+    "LitVM LiteForge Unsafe": `ecld-${svc}-litvm-testnet-unsafe`,
   };
   const trustedZoneImage = imageByNetwork[blockchainNetwork] || `etny-${svc}-testnet`;
   writeEnv("TRUSTED_ZONE_IMAGE", trustedZoneImage);
 
 
-  writeEnv("BLOCKCHAIN_NETWORK", blockchainNetwork.replace(/ /g, "_"));
+  writeEnv("BLOCKCHAIN_NETWORK", network);
   writeEnv("IPFS_ENDPOINT", customUrl);
   console.log();
   await configureEsr();

package/network.js

@@ -0,0 +1,51 @@
+/* The runner's view of a project's network.
+ *
+ * BLOCKCHAIN_NETWORK, as ecld-init writes it (spaces -> underscores), names a
+ * network; the runner is constructed with that network's token ADDRESS, the
+ * chain id of a testnet whose token address other testnets share, and for an
+ * -unsafe network is set to the (network, type) that runs only -unsafe
+ * trustedzones. The table is built from the runner's own enums so the two
+ * cannot drift; the enums are an argument because the runner is ESM and this
+ * module is loaded from CJS (ecld-run) and ESM (a dApp's preStart) alike.
+ * Shared by ecld-run and the Hello World template's src/preStart.mjs. */
+
+'use strict';
+
+const casConfig = require('./cas/config.js');
+
+/* Accepts a few spellings per network. Returns the normalised key, the
+ * network ({ address, chainId?, unsafe? }) or null, and the known keys. */
+function networkFor({ ECAddress, ECNetworkByChainId }, raw) {
+  const key = String(raw || '').trim().toUpperCase().replace(/\s+/g, '_');
+  const bloxbergTestnet = { address: ECAddress.BLOXBERG.TESTNET_ADDRESS };
+  const amoy = { address: ECAddress.POLYGON.TESTNET_ADDRESS };
+  const sepolia = { address: ECAddress.SEPOLIA.TESTNET_ADDRESS, chainId: ECNetworkByChainId.SEPOLIA.TESTNET };
+  const litvm = { address: ECAddress.LITVM.TESTNET_ADDRESS, chainId: ECNetworkByChainId.LITVM.TESTNET };
+  const table = {
+    BLOXBERG_TESTNET: bloxbergTestnet,
+    BLOXBERG_TESTNET_UNSAFE: { ...bloxbergTestnet, unsafe: ['BLOXBERG', 'TESTNET_UNSAFE'] },
+    BLOXBERG_MAINNET: { address: ECAddress.BLOXBERG.MAINNET_ADDRESS },
+    POLYGON_MAINNET: { address: ECAddress.POLYGON.MAINNET_ADDRESS },
+    POLYGON_AMOY: amoy,
+    POLYGON_AMOY_TESTNET: amoy,
+    IOTEX_TESTNET: { address: ECAddress.IOTEX.TESTNET_ADDRESS, chainId: ECNetworkByChainId.IOTEX.TESTNET },
+    ETHEREUM_SEPOLIA: sepolia,
+    SEPOLIA: sepolia,
+    LITVM_LITEFORGE: litvm,
+    LITVM: litvm,
+    LITVM_LITEFORGE_UNSAFE: { ...litvm, unsafe: ['LITVM', 'TESTNET_UNSAFE'] },
+  };
+  return { key, network: table[key] || null, known: Object.keys(table) };
+}
+
+/* The -unsafe network a network token names, or whose sibling it names; null
+ * when the network has no -unsafe variant. */
+function unsafeVariant(raw) {
+  const key = String(raw || '').trim().replace(/\s+/g, '_');
+  if (casConfig.isUnsafeNetwork(key)) return key;
+  const variant = Object.keys(casConfig.UNSAFE_NETWORKS)
+    .find((name) => casConfig.UNSAFE_NETWORKS[name].toUpperCase() === key.toUpperCase());
+  return variant || null;
+}
+
+module.exports = { networkFor, unsafeVariant };

package/nodenithy/build/securelock/Dockerfile.tmpl

@@ -1,20 +1,35 @@
-FROM registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/ethernity/node:16.13.1-alpine3.15-scone5.8-production as release
+# SCONE_NODE (build.mjs passes it) is the nodenithy trustedzone image this
+# securelock is bundled with: node:22-alpine with the SCONE 6.0.7 runtime and
+# CLI (sconecuratedimages/node:node-22-alpine, the base the etny-nodenithy CI
+# builds the trustedzones on), the release the trustedzones, the LAS and the
+# CAS run. Its own enclave is replaced below: /lib/libbinary-fs.so is
+# overwritten and /usr/local/bin/node re-signed.
+ARG SCONE_NODE
+
+# The dependencies are plain JavaScript, installed with a stock node of the
+# same major version; no SCONE binary runs at build time.
+FROM node:22-alpine AS deps
 
-RUN apk update
-
-RUN cd /
+COPY ./src /etny-securelock/
+WORKDIR /etny-securelock
+RUN npm install
 
-RUN apk add bash
+FROM ${SCONE_NODE} AS release
 
-ENV SCONE_HEAP=256M
+# As in the runtime release stage: the scone CLI below runs on a build host
+# without SGX.
+ENV SCONE_MODE=SIM
 ENV SCONE_LOG=DEBUG
 ENV ENCLAVE_NAME_SECURELOCK=__ENCLAVE_NAME_SECURELOCK__
+# "mainnet" or "testnet": the securelock self-signs from MR_ENCLAVE on a
+# testnet without a ValidatorRegistry, and takes its certificate from the CAS
+# otherwise.
+ENV NETWORK_TYPE=__NETWORK_TYPE__
 ENV BUCKET_NAME=__BUCKET_NAME__
 ENV SMART_CONTRACT_ADDRESS=__SMART_CONTRACT_ADDRESS__
 ENV IMAGE_REGISTRY_ADDRESS=__IMAGE_REGISTRY_ADDRESS__
 ENV RPC_URL=__RPC_URL__
 ENV CHAIN_ID=__CHAIN_ID__
-ENV TRUSTED_ZONE_IMAGE=__TRUSTED_ZONE_IMAGE__
 ENV VALIDATOR_REGISTRY_ADDRESS=__ETNY_VALIDATOR_REGISTRY_ADDRESS__
 # ESR (RFC §5.4): rendered by build.mjs to `ENV ESR_CONTRACT_ADDRESS=0x...` only
 # when ESR is enabled, and to nothing otherwise -- so non-ESR images keep exactly
@@ -22,36 +37,25 @@ ENV VALIDATOR_REGISTRY_ADDRESS=__ETNY_VALIDATOR_REGISTRY_ADDRESS__
 # gates all ESR behaviour on this variable being non-empty.
 __ESR_ENV__
 
-RUN mkdir binary-fs-dir
+RUN mkdir /binary-fs-dir
 
-COPY ./src /etny-securelock/
+COPY --from=deps /etny-securelock /etny-securelock/
 COPY scripts/* /etny-securelock/
 
-WORKDIR /etny-securelock
-RUN pwd
-RUN npm install
-RUN ls
-
 WORKDIR /
 
 RUN ["chmod", "+x", "etny-securelock/binary-fs-build.sh"]
 RUN etny-securelock/binary-fs-build.sh
 
-FROM registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/sconecuratedimages/crosscompilers as build
+FROM registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/sconecuratedimages/crosscompilers:alpine-scone6.0.7 as build
 
 COPY --from=release /binary-fs-dir /.
 
 RUN scone gcc ./binary_fs_blob.s ./libbinary_fs_template.a -shared -o /libbinary-fs.so
 
-#
-FROM registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/ethernity/node:16.13.1-alpine3.15-scone5.8-production
+FROM ${SCONE_NODE}
 
 COPY --from=build /libbinary-fs.so /lib/libbinary-fs.so
-#
-
-RUN apk update
-
-RUN apk add openssl
 
 RUN openssl genrsa -3 -out /enclave-key.pem 3072
 
@@ -64,24 +68,22 @@ ENV SCONE_HEAP=1024M
 ENV SCONE_STACK=4M
 ENV SCONE_ALLOW_DLOPEN=1
 ENV SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so
+ENV SCONE_LOG=DEBUG
 
 # Rendered by build.mjs. Signs the EXECUTED binary (/usr/local/bin/node -- the
 # ENTRYPOINT and the run/publish compose command both run /usr/local/bin/node).
-# Mainnet adds --production (CAS/DCAP attestation); testnet omits it (non-CAS
-# self-sign). On testnet builds this line is a no-op comment.
+# A CAS-provisioned securelock (mainnet, or a testnet with a SessionRegistry) is
+# signed --production; a self-signing testnet one is signed debug.
 __SCONE_SIGN__
 
-# Record the SIGNED MRENCLAVE so publish (run.js) can assert the runtime enclave
-# measurement matches what was signed BEFORE registering the CAS session /
-# publishing. A mismatch means SCONE recomputed the enclave at load (params
-# drift) => debug re-sign => CAS rejects the DCAP quote on mainnet. Only produced
-# for --production (mainnet) signs; on testnet the file is absent and the check
-# is skipped. Capture to a file first: piping scone-signer into `head` kills it
+# Record the SIGNED MRENCLAVE so publish (run.js) can assert, for a
+# CAS-provisioned securelock, that the runtime enclave measurement matches what
+# was signed BEFORE registering the CAS session. A mismatch means SCONE
+# recomputed the enclave at load (params drift) => debug re-sign => the CAS
+# rejects it. Capture to a file first: piping scone-signer into `head` kills it
 # with SIGPIPE (exit 141) under buildkit's pipefail shell.
 __SIGNED_MRENCLAVE__
 
 RUN rm -rf /enclave-key.pem
 
-#RUN scone cas attest scone-cas.cf 3061b9feb7fa67f3815336a085f629a13f04b0a1667c93b14ff35581dc8271e4 -GCS --only_for_testing-debug --only_for_testing-ignore-signer
-RUN ls /usr/local/bin
 ENTRYPOINT ["/usr/local/bin/node", "/etny-securelock/securelock.js"]

package/nodenithy/build/securelock/scripts/binary-fs-build.sh

@@ -7,12 +7,13 @@ cat .env
 echo "####################"
 
 cat securelock.js.tmpl | sed  s/"__ENCLAVE_NAME_SECURELOCK__"/"${ENCLAVE_NAME_SECURELOCK}"/g > securelock.js.tmp
-sed -i "s/__BUCKET_NAME__/${BUCKET_NAME}/g" securelock.js.tmp
-sed -i "s/__SMART_CONTRACT_ADDRESS__/${SMART_CONTRACT_ADDRESS}/g" securelock.js.tmp
-sed -i "s/__IMAGE_REGISTRY_ADDRESS__/${IMAGE_REGISTRY_ADDRESS}/g" securelock.js.tmp
-sed -i "s/__RPC_URL__/${RPC_URL}/g" securelock.js.tmp
-sed -i "s/__CHAIN_ID__/${CHAIN_ID}/g" securelock.js.tmp
-sed -i "s/__TRUSTED_ZONE_IMAGE__/${TRUSTED_ZONE_IMAGE}/g" securelock.js.tmp
+# "|" delimits: the RPC URL contains "/".
+sed -i "s|__ETNY_NETWORK_TYPE__|${NETWORK_TYPE}|g" securelock.js.tmp
+sed -i "s|__ETNY_BUCKET__|${BUCKET_NAME}|g" securelock.js.tmp
+sed -i "s|__ETNY_SMART_CONTRACT_ADDRESS__|${SMART_CONTRACT_ADDRESS}|g" securelock.js.tmp
+sed -i "s|__ETNY_IMAGE_REGISTRY_ADDRESS__|${IMAGE_REGISTRY_ADDRESS}|g" securelock.js.tmp
+sed -i "s|__ETNY_WEB3_PROVIDER__|${RPC_URL}|g" securelock.js.tmp
+sed -i "s|__ETNY_CHAIN_ID__|${CHAIN_ID}|g" securelock.js.tmp
 # ethernity-cas ValidatorRegistry for CAS self-attestation. Deliberately NOT
 # overridable from the runtime environment (unlike the addresses above): the
 # session env comes from the CAS itself, and a rogue CAS must not get to