@ethernity-cloud/sdk-js 1.6.2 → 1.7.1

package/pynithy/run.js

@@ -60,13 +60,19 @@ const writeEnv = (key, value) => {
 
 let templateName = process.env.TRUSTED_ZONE_IMAGE || 'etny-pynithy-testnet';
 
-const isMainnet = !templateName.includes('testnet');
-// A testnet template with a SessionRegistry is CAS-attested by the
-// ethernity-cas validator set: the session is registered on-chain, the
-// enclave is provisioned from a validator, and the certificate comes out of
-// the CAS session. Other testnets self-sign and register nothing.
-const casTestnet = !isMainnet && casConfig.casProvisioned(templateName, isMainnet);
+const isMainnet = casConfig.isMainnetNetwork(process.env.BLOCKCHAIN_NETWORK);
+// Mainnet enclaves are provisioned by the Scontain CAS. A testnet template
+// with a SessionRegistry is CAS-attested by the ethernity-cas validator set:
+// the session is registered on-chain, the enclave is provisioned from a
+// validator, and the certificate comes out of the CAS session. Every other
+// testnet's enclaves self-sign from MR_ENCLAVE and register no session.
+const cas = casConfig.casProvisioned(templateName, isMainnet);
+const casTestnet = !isMainnet && cas;
 const casChain = casConfig.CHAIN[templateName] || {};
+// An -unsafe network is a self-signing testnet whose compose carries no LAS;
+// its securelock is registered as <project>-unsafe.
+const unsafe = casConfig.isUnsafeNetwork(process.env.BLOCKCHAIN_NETWORK);
+const securelock = casConfig.nameOnNetwork(process.env.PROJECT_NAME, process.env.BLOCKCHAIN_NETWORK);
 
 const currentDir = process.cwd();
 console.log(`currentDir: ${currentDir}`);
@@ -107,14 +113,21 @@ const extractSignedMrenclave = (service) => {
 
 const main = async () => {
     process.env.NODE_NO_WARNINGS = 1
-    const backupFiles = ['docker-compose.yml.tmpl', 'docker-compose-final.yml.tmpl'];
-    backupFiles.forEach(file => {
-        if (!fs.existsSync(file)) {
-            console.error(`Error: ${file} not found!`);
+    // The securelock heap ecld-build signed it with (part of MRENCLAVE).
+    const memory = (process.env.MEMORY_TO_ALLOCATE || '').trim();
+    if (!memory) {
+        console.error("Error: MEMORY_TO_ALLOCATE is not set in .env; run ecld-build first.");
+        process.exit(1);
+    }
+    ['docker-compose.yml', 'docker-compose-final.yml'].forEach(file => {
+        const template = `${file}.tmpl`;
+        if (!fs.existsSync(template)) {
+            console.error(`Error: ${template} not found!`);
             return;
         }
-        const backupContent = fs.readFileSync(file, 'utf8');
-        fs.writeFileSync(file.replace('.tmpl', ''), backupContent, 'utf8');
+        const content = casConfig.renderCompose(fs.readFileSync(template, 'utf8'), cas, unsafe)
+            .replace(/__MEMORY_TO_ALLOCATE__/g, memory);
+        fs.writeFileSync(file, content, 'utf8');
     });
 
 
@@ -130,7 +143,7 @@ const main = async () => {
     // MRENCLAVE signed --production at build time (/signed_mrenclave.txt). A
     // mismatch means SCONE recomputed the measurement at load (params drift) and
     // re-signed as DEBUG, which CAS rejects on mainnet. Refuse to publish.
-    if (isMainnet || casTestnet) {
+    if (cas) {
         const signedMrenclave = extractSignedMrenclave('etny-securelock');
         if (!signedMrenclave || signedMrenclave !== process.env.MRENCLAVE_SECURELOCK) {
             console.error(`Error: securelock runtime MRENCLAVE (${process.env.MRENCLAVE_SECURELOCK}) != signed MRENCLAVE (${signedMrenclave}).`);
@@ -218,15 +231,20 @@ const main = async () => {
         MRENCLAVE: process.env.MRENCLAVE_SECURELOCK,
         ENCLAVE_NAME: ENCLAVE_NAME_SECURELOCK
     };
-    processYamlTemplate('etny-securelock-test.yaml.tpl', 'etny-securelock-test.yaml', replacementsSecurelock);
+    if (cas) {
+        processYamlTemplate('etny-securelock-test.yaml.tpl', 'etny-securelock-test.yaml', replacementsSecurelock);
+    }
 
     // Where the session goes depends on who provisions the securelock. On a
     // CAS-attested testnet it is registered ON-CHAIN in the ethernity-cas
     // SessionRegistry, which the validator set reads and which accepts no
     // POST; the publish then waits until the validators serve it, because the
-    // public-key harvest below provisions the enclave from them. Every other
-    // network keeps the Scontain CAS registration that follows.
-    if (casTestnet) {
+    // public-key harvest below provisions the enclave from them. On mainnet it
+    // is registered with the Scontain CAS. A self-signing testnet has none: a
+    // CAS-issued certificate would not match the key the enclave derives.
+    if (!cas) {
+        console.log(`\t✔  ${process.env.BLOCKCHAIN_NETWORK}: no CAS session; the securelock self-signs from MR_ENCLAVE`);
+    } else if (casTestnet) {
         const registered = await sessionRegistry.register(
             casChain.rpcUrl, casChain.chainId, casConfig.SESSION_REGISTRY[templateName],
             process.env.PRIVATE_KEY, fs.readFileSync('etny-securelock-test.yaml'),
@@ -429,13 +447,9 @@ const main = async () => {
             console.log(`No __ENCLAVE_NAME_TRUSTEDZONE__ found in ${file}`);
         }
 
-        let ENCLAVE_NAME_TRUSTEDZONE = 'etny-pynithy-trustedzone-v3-testnet-0.1.12'
-        if (isMainnet) {
-            ENCLAVE_NAME_TRUSTEDZONE = 'ecld-pynithy-trustedzone-v3-3.0.0'
-        }
-        if (casTestnet) {
-            ENCLAVE_NAME_TRUSTEDZONE = trustedZoneSession;
-        }
+        // Named only in a CAS-provisioned compose; a self-signing one has no
+        // __CAS_ONLY__ lines left.
+        const ENCLAVE_NAME_TRUSTEDZONE = casTestnet ? trustedZoneSession : 'ecld-pynithy-trustedzone-v3-3.0.0';
         let updatedContent = fileContentBefore
             .replace(/__ENCLAVE_NAME_SECURELOCK__/g, ENCLAVE_NAME_SECURELOCK)
             .replace(/__ENCLAVE_NAME_TRUSTEDZONE__/g, ENCLAVE_NAME_TRUSTEDZONE);
@@ -544,7 +558,7 @@ const main = async () => {
             console.log()
 
             console.log(`ENCLAVE_NAME_SECURELOCK: ${ENCLAVE_NAME_SECURELOCK}`);
-            execSync(`node ./public_key_service.js --enclave_name "${process.env.PROJECT_NAME}" --protocol_version "v3" --network "${process.env.BLOCKCHAIN_NETWORK}" --template_version "${process.env.VERSION}"`, { stdio: 'inherit' });
+            execSync(`node ./public_key_service.js --enclave_name "${securelock}" --protocol_version "v3" --network "${process.env.BLOCKCHAIN_NETWORK}" --template_version "${process.env.VERSION}"`, { stdio: 'inherit' });
             PUBLIC_KEY_SECURELOCK_RES = fs.readFileSync('PUBLIC_KEY.txt', 'utf8').trim();
             console.log(`PUBLIC_KEY_SECURELOCK_RES: ${PUBLIC_KEY_SECURELOCK_RES}`);
             if (!PUBLIC_KEY_SECURELOCK_RES || PUBLIC_KEY_SECURELOCK_RES === '-1') {
@@ -611,10 +625,12 @@ const main = async () => {
     console.log("IPFS_HASH: ", process.env.IPFS_HASH);
     writeEnv('IPFS_HASH', process.env.IPFS_HASH);
     process.chdir(currentDir);
-    console.log("Adding certificates for SECURELOCK into IMAGE REGISTRY smart contract...");
+    console.log(`Adding certificates for SECURELOCK ${securelock} into IMAGE REGISTRY smart contract...`);
+    // image_registry.js registers the image under PROJECT_NAME.
+    const registryEnv = { ...process.env, PROJECT_NAME: securelock };
     let existing = false;
     try {
-        const existingImages = execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "${process.env.PROJECT_NAME}" "${process.env.VERSION}" "${process.env.PRIVATE_KEY}" "registerSecureLockImage"`, { stdio: "inherit" });
+        const existingImages = execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "${securelock}" "${process.env.VERSION}" "${process.env.PRIVATE_KEY}" "registerSecureLockImage"`, { stdio: "inherit", env: registryEnv });
         if (existingImages.toString().trim().replace('Image hash: ', '') === process.env.IPFS_HASH) {
             console.log("Certificates for SECURELOCK already added to IMAGE REGISTRY smart contract");
         }
@@ -626,7 +642,7 @@ const main = async () => {
     }
 
     if (!existing) {
-        const res = execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "" "" "" "registerSecureLockImage"`, { stdio: "inherit" });
+        const res = execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "" "" "" "registerSecureLockImage"`, { stdio: "inherit", env: registryEnv });
     }
     // The on-chain session points at the image it admits, so a validator can
     // pin the image beside the body it serves.

package/pynithy/src/ec_helloworld_example.js

@@ -1,58 +1,62 @@
-const AppCss = require('./App.css');
+import './App.css';
 import EthernityCloudRunner from "@ethernity-cloud/runner";
-import {ECEvent, ECRunner, ECStatus} from "@ethernity-cloud/runner/enums";
-import Web3 from 'web3';
+import { ECStatus } from "@ethernity-cloud/runner/enums";
 
+// Filled in from the project's .env by src/preStart.mjs on `npm start`: the
+// securelock this dApp is published as, the trustedzone it was built against,
+// the network's token address and chain id, the -unsafe network when the dApp
+// runs without a CAS (null otherwise), and the IPFS endpoint.
 const PROJECT_NAME = "";
+const TRUSTED_ZONE_IMAGE = "";
+const NETWORK_ADDRESS = "";
+const CHAIN_ID = null;
+const UNSAFE_NETWORK = null;
 const IPFS_ENDPOINT = "";
 
+// A call into src/serverless/backend.py; its return value is the task result.
 const code = `hello("World")`;
 
 function App() {
     const executeTask = async () => {
-        const runner = new EthernityCloudRunner();
-        // this is a server provided by Ethernity CLOUD, please bear in mind that you can use your own Decentralized Storage server
-        const ipfsAddress = IPFS_ENDPOINT;
-        runner.initializeStorage(ipfsAddress);
-        console.log(PROJECT_NAME)
-        const onTaskProgress = (e) => {
-            if (e.detail.status === ECStatus.ERROR) {
-                console.error(e.detail.message);
-            } else {
-                console.log(e.detail.message);
-            }
-        };
-
-        const onTaskCompleted = (e) => {
-            console.log(`Task Result: ${e.detail.message.result}`);
-            // display the result in page below the buttons
-            const result = document.createElement("p");
-            result.innerHTML = `Task Result: ${e.detail.message.result}`;
-            document.body.appendChild(result);
+        // The browser wallet (MetaMask) signs and pays for the order.
+        const runner = new EthernityCloudRunner(NETWORK_ADDRESS, {}, CHAIN_ID || undefined);
+        if (UNSAFE_NETWORK) {
+            await runner.setNetwork(...UNSAFE_NETWORK);
         }
+        runner.initializeStorage(IPFS_ENDPOINT);
 
-        runner.addEventListener(ECEvent.TASK_PROGRESS, onTaskProgress);
-        runner.addEventListener(ECEvent.TASK_COMPLETED, onTaskCompleted);
+        // Events are named by task status; detail is { message, status, progress }.
+        runner.addEventListener(ECStatus.DEFAULT, (e) => {
+            console.log(`[${e.detail.progress}] ${e.detail.message}`);
+        });
+        runner.addEventListener(ECStatus.ERROR, (e) => {
+            console.error(e.detail.message);
+        });
+        runner.addEventListener(ECStatus.SUCCESS, async () => {
+            const result = await runner.getResult();
+            console.log(`Task Result: ${result}`);
+            // display the result in page below the buttons
+            const line = document.createElement("p");
+            line.textContent = `Task Result: ${result}`;
+            document.body.appendChild(line);
+        });
 
-        await runner.run(PROJECT_NAME,
-                        code,
-                         '0xd58f5C1834279ABD601df85b3E4b2323aDD4E75e',
-                         { taskPrice: 6, cpu: 1, memory: 1, storage: 10, bandwidth: 1, duration: 1, validators: 1 });
+        const resources = { taskPrice: 10, cpu: 1, memory: 1, storage: 10, bandwidth: 1, duration: 1, validators: 1 };
+        await runner.run(resources, PROJECT_NAME, code, '', TRUSTED_ZONE_IMAGE);
     };
+
     const connectWallet = async () => {
-      if (window.ethereum) {
-          window.web3 = new Web3(window.ethereum);
-          try {
-              // Request account access
-              await window.ethereum.request({ method: 'eth_requestAccounts' });
-              console.log("Wallet connected");
-          } catch (error) {
-              console.error("User denied account access");
-          }
-      } else {
-          console.log('Please install MetaMask!');
-      }
-  };
+        if (!window.ethereum) {
+            console.log('Please install MetaMask!');
+            return;
+        }
+        try {
+            await window.ethereum.request({ method: 'eth_requestAccounts' });
+            console.log("Wallet connected");
+        } catch (error) {
+            console.error("User denied account access");
+        }
+    };
 
     return (
         <div className="container">
@@ -61,4 +65,4 @@ function App() {
         </div>
     );
 }
-export default App;
+export default App;

package/pynithy/src/preStart.mjs

@@ -1,57 +1,47 @@
+// Runs before `react-scripts start` (the project's `npm start`): fills the
+// constants at the top of src/ec_helloworld_example.js from the project's
+// .env, the way ecld-run reads the same values. PROJECT_NAME and
+// TRUSTED_ZONE_IMAGE take their -unsafe form on an -unsafe network; the
+// network's token address, chain id and -unsafe (network, type) come from the
+// runner's own enums through the SDK's network table.
 import fs from 'fs';
+import { createRequire } from 'module';
 import dotenv from 'dotenv';
-dotenv.config();
+import * as enums from '@ethernity-cloud/runner/enums.js';
 
-export const ECRunner = {
-  'etny-pynithy-testnet': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c'],
-  'etny-nodenithy-testnet': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c'],
-  'etny-pynithy': ['0x549A6E06BB2084100148D50F51CF77a3436C3Ae7'],
-  'etny-nodenithy': ['0x549A6E06BB2084100148D50F51CF77a3436C3Ae7'],
-  'ecld-nodenithy-testnet': ['0xfb450e40f590F1B5A119a4B82E6F3579D6742a00'],
-  'ecld-pynithy': ['0xc6920888988cAcEeA7ACCA0c96f2D65b05eE22Ba'],
-  'ecld-nodenithy': ['0xc6920888988cAcEeA7ACCA0c96f2D65b05eE22Ba']
+dotenv.config();
+const require = createRequire(import.meta.url);
+const casConfig = require('@ethernity-cloud/sdk-js/cas/config.js');
+const { networkFor } = require('@ethernity-cloud/sdk-js/network.js');
+
+const { PROJECT_NAME, TRUSTED_ZONE_IMAGE, BLOCKCHAIN_NETWORK, IPFS_ENDPOINT } = process.env;
+if (!PROJECT_NAME || !BLOCKCHAIN_NETWORK) {
+  console.error('preStart: PROJECT_NAME and BLOCKCHAIN_NETWORK are not set in .env; run `npm run ecld-init` first.');
+  process.exit(1);
+}
+const { network, known } = networkFor(enums, BLOCKCHAIN_NETWORK);
+if (!network) {
+  console.error(`preStart: unknown BLOCKCHAIN_NETWORK '${BLOCKCHAIN_NETWORK}' in .env. Known: ${known.join(', ')}`);
+  process.exit(1);
+}
+
+const constants = {
+  PROJECT_NAME: casConfig.nameOnNetwork(PROJECT_NAME, BLOCKCHAIN_NETWORK),
+  TRUSTED_ZONE_IMAGE: casConfig.nameOnNetwork(TRUSTED_ZONE_IMAGE, BLOCKCHAIN_NETWORK) || '',
+  NETWORK_ADDRESS: network.address,
+  CHAIN_ID: network.chainId || null,
+  UNSAFE_NETWORK: network.unsafe || null,
+  IPFS_ENDPOINT: IPFS_ENDPOINT || 'https://ipfs.ethernity.cloud',
 };
 
 const filePath = 'src/ec_helloworld_example.js';
-const fileContent = fs.readFileSync(filePath, 'utf8');
-
-const updatedContent = fileContent
-    .replace(/const PROJECT_NAME = ".*?";/, `const PROJECT_NAME = "${process.env.PROJECT_NAME}";`)
-    .replace(/const IPFS_ENDPOINT = ".*?";/, `const IPFS_ENDPOINT = "${process.env.IPFS_ENDPOINT}";`)
-    .replace(/new EthernityCloudRunner\(.*?\);/, `new EthernityCloudRunner('${ECRunner[process.env.ENCLAVE_NAME_TRUSTEDZONE]}');`);
-
-fs.writeFileSync(filePath, updatedContent, 'utf8');
-
-// const code = updatedContent.match(/const code = `hello\("(.*?)"\);/)[1];
-
-const imageRegistryPath = 'node_modules/@ethernity-cloud/runner/contract/operation/imageRegistryContract.js';
-const imageRegistryContent = fs.readFileSync(imageRegistryPath, 'utf8');
-
-// Log the original content for debugging
-// console.log('Original imageRegistryContent:', imageRegistryContent);
-
-// Replace the content in imageRegistryContract.js
-// const updatedImageRegistryContent = imageRegistryContent.replace(/getLatestTrustedZoneImageCertPublicKey\([^)]*\);/, "getLatestTrustedZoneImageCertPublicKey('" + process.env.ENCLAVE_NAME_TRUSTEDZONE + "', 'v3')").replace(/getLatestImageVersionPublicKey\([^)]*\)/, "getLatestImageVersionPublicKey(imageName, '" + process.env.VERSION + "')");
-const updatedImageRegistryContent = imageRegistryContent.replace(
-    /async getEnclaveDetailsV3\(.*?\{[\s\S]*?\}\s*\}/,
-    `async getEnclaveDetailsV3(imageName, version) {
-      try {
-        const trustedZonePublicKey = (await this.contract.getLatestTrustedZoneImageCertPublicKey('${process.env.ENCLAVE_NAME_TRUSTEDZONE}', 'v3'));
-        const imageDetails = await this.contract.getLatestImageVersionPublicKey(imageName, '${process.env.VERSION}');
-        return [imageDetails[0], trustedZonePublicKey[1], imageDetails[2]];
-      } catch (e) {
-        console.log(e);
-        return null;
-      }
-    }`
-  );
-
-
-fs.writeFileSync(imageRegistryPath, updatedImageRegistryContent, 'utf8');
-
-const runnerPath = 'node_modules/@ethernity-cloud/runner/runner.js';
-const runnerContent = fs.readFileSync(runnerPath, 'utf8');
-
-const updatedRunnerContent = runnerContent.replace(/this.#enclaveImageIPFSHash}:.*?:/, "this.#enclaveImageIPFSHash}:"+process.env.ENCLAVE_NAME_TRUSTEDZONE+":").replace(/new ImageRegistryContract\([^)]*\);/, "new ImageRegistryContract(this.#networkAddress, '"+process.env.ENCLAVE_NAME_TRUSTEDZONE+"');");
-
-fs.writeFileSync(runnerPath, updatedRunnerContent, 'utf8');
+let content = fs.readFileSync(filePath, 'utf8');
+for (const [name, value] of Object.entries(constants)) {
+  const line = new RegExp(`^const ${name} = .*;$`, 'm');
+  if (!line.test(content)) {
+    console.error(`preStart: ${filePath} has no 'const ${name} = ...;' line to fill.`);
+    process.exit(1);
+  }
+  content = content.replace(line, `const ${name} = ${JSON.stringify(value)};`);
+}
+fs.writeFileSync(filePath, content, 'utf8');

package/pynithy/src/serverless/Dockerfile.serverless

@@ -0,0 +1,8 @@
+FROM etny-securelock-base
+
+# System packages your backend needs, added to the securelock base image by
+# ecld-build.
+#
+# Example:
+# RUN apk update
+# RUN apk add gcc g++ git openblas-dev

package/pynithy/src/serverless/requirements.txt

@@ -0,0 +1,6 @@
+# Python packages your backend imports, one per line; ecld-build installs them
+# into the securelock enclave.
+# Example:
+#
+# scipy
+# numpy

package/run.js

@@ -15,8 +15,10 @@
  * ecld-publish), matching how ethernity_task drives a run:
  *
  *   BLOCKCHAIN_NETWORK   e.g. "Bloxberg_Testnet" -> the network token address
- *   PROJECT_NAME         the securelock enclave to run
- *   TRUSTED_ZONE_IMAGE   the trustedzone enclave
+ *   PROJECT_NAME         the securelock enclave to run (<PROJECT_NAME>-unsafe
+ *                        on an -unsafe network)
+ *   TRUSTED_ZONE_IMAGE   the trustedzone enclave (its -unsafe variant on an
+ *                        -unsafe network)
  *   PRIVATE_KEY          a funded 0x key — it pays for the order
  *
  * Usage, from the project root:
@@ -25,6 +27,7 @@
  *   npx ecld-run --file payload.js
  *   npx ecld-run --input data.json 'processData(___etny_data_set___)'
  *   npx ecld-run --network BLOXBERG_TESTNET --task-price 3 'esrIncrement()'
+ *   npx ecld-run --unsafe 'hello("World")'    # the network's -unsafe variant
  *   npx ecld-run --json 'hello("World")'      # machine-readable result
  *
  * The runner is ESM; this CJS entry loads it with dynamic import().
@@ -36,29 +39,11 @@
 
 const fs = require('fs');
 try { require('dotenv').config(); } catch (e) { /* dotenv optional */ }
+const casConfig = require('./cas/config.js');
+const { networkFor, unsafeVariant } = require('./network.js');
 
 const DEFAULT_IPFS = 'https://ipfs.ethernity.cloud/api/v0';
 
-/* Map a BLOCKCHAIN_NETWORK token (as ecld-init writes it, spaces -> underscores)
- * to the runner's network token ADDRESS. Built from the runner's own ECAddress
- * so it can't drift. Accepts a few spellings per network. */
-function networkAddress(ECAddress, raw) {
-  const key = String(raw || '').trim().toUpperCase().replace(/\s+/g, '_');
-  const table = {
-    BLOXBERG_TESTNET: ECAddress.BLOXBERG.TESTNET_ADDRESS,
-    BLOXBERG_MAINNET: ECAddress.BLOXBERG.MAINNET_ADDRESS,
-    POLYGON_MAINNET: ECAddress.POLYGON.MAINNET_ADDRESS,
-    POLYGON_AMOY: ECAddress.POLYGON.TESTNET_ADDRESS,
-    POLYGON_AMOY_TESTNET: ECAddress.POLYGON.TESTNET_ADDRESS,
-    IOTEX_TESTNET: ECAddress.IOTEX && ECAddress.IOTEX.TESTNET_ADDRESS,
-    ETHEREUM_SEPOLIA: ECAddress.SEPOLIA && ECAddress.SEPOLIA.TESTNET_ADDRESS,
-    SEPOLIA: ECAddress.SEPOLIA && ECAddress.SEPOLIA.TESTNET_ADDRESS,
-    LITVM_LITEFORGE: ECAddress.LITVM && ECAddress.LITVM.TESTNET_ADDRESS,
-    LITVM: ECAddress.LITVM && ECAddress.LITVM.TESTNET_ADDRESS,
-  };
-  return { key, address: table[key] || null, known: Object.keys(table) };
-}
-
 function parseArgs(argv) {
   const opts = { ipfs: DEFAULT_IPFS, timeout: 600, taskPrice: 3, cpu: 1, memory: 1, storage: 10, bandwidth: 1, duration: 1, validators: 1, node: '' };
   const positional = [];
@@ -68,6 +53,7 @@ function parseArgs(argv) {
     else if (a === '--input' || a === '-i') opts.inputFile = argv[++i];
     else if (a === '--input-text') opts.inputText = argv[++i];
     else if (a === '--network') opts.network = argv[++i];
+    else if (a === '--unsafe') opts.unsafe = true;
     else if (a === '--securelock') opts.securelock = argv[++i];
     else if (a === '--trustedzone') opts.trustedzone = argv[++i];
     else if (a === '--node') opts.node = argv[++i];
@@ -94,7 +80,10 @@ usage: ecld-run 'hello("World")' | ecld-run --file payload.js | ecld-run --input
 
 payload:   a code string, or --file <path>; input via --input <file> / --input-text <str>
 network:   --network BLOXBERG_TESTNET (default: BLOCKCHAIN_NETWORK from .env)
-enclaves:  --securelock <name> (default PROJECT_NAME), --trustedzone <name> (default TRUSTED_ZONE_IMAGE)
+           --unsafe: the network's -unsafe variant, which runs without a CAS
+           (BLOXBERG_TESTNET_UNSAFE, LITVM_LITEFORGE_UNSAFE)
+enclaves:  --securelock <name> (default PROJECT_NAME), --trustedzone <name> (default TRUSTED_ZONE_IMAGE);
+           on an -unsafe network the default is each one's -unsafe variant
 key:       PRIVATE_KEY (a funded 0x key) from .env / env, or ECLD_PRIVATE_KEY
 resources: --task-price 3 --cpu 1 --memory 1 --storage 10 --bandwidth 1 --duration 1 --validators 1
 other:     --node <addr>  --ipfs <url>  --timeout <sec>  --json`;
@@ -121,27 +110,37 @@ async function main() {
   // ecld-run mirrors ecld-test: input is delivered via the payload call itself.
 
   // ---- runner (ESM) ----
-  let EthernityCloudRunner, ECStatus, ECEvent, ECAddress, ECOrderTaskStatus;
+  let EthernityCloudRunner, ECStatus, ECEvent, ECOrderTaskStatus, enums;
   try {
     const runnerMod = await import('@ethernity-cloud/runner');
     EthernityCloudRunner = runnerMod.default || runnerMod.EthernityCloudRunner;
-    const enums = await import('@ethernity-cloud/runner/enums.js');
-    ({ ECStatus, ECEvent, ECAddress, ECOrderTaskStatus } = enums);
+    enums = await import('@ethernity-cloud/runner/enums.js');
+    ({ ECStatus, ECEvent, ECOrderTaskStatus } = enums);
   } catch (e) {
     console.error('ecld-run: the runner package is not installed or is too old '
-      + '(need @ethernity-cloud/runner >= 0.4.4): ' + e.message);
+      + '(need @ethernity-cloud/runner >= 0.6.0): ' + e.message);
     process.exit(1);
   }
 
   // ---- network / enclaves / key ----
-  const rawNetwork = opts.network || process.env.BLOCKCHAIN_NETWORK || 'BLOXBERG_TESTNET';
-  const { key: netKey, address, known } = networkAddress(ECAddress, rawNetwork);
-  if (!address) {
+  let rawNetwork = opts.network || process.env.BLOCKCHAIN_NETWORK || 'BLOXBERG_TESTNET';
+  if (opts.unsafe) {
+    const variant = unsafeVariant(rawNetwork);
+    if (!variant) {
+      console.error(`ecld-run: ${rawNetwork} has no -unsafe variant. -unsafe networks: `
+        + Object.keys(casConfig.UNSAFE_NETWORKS).join(', '));
+      process.exit(1);
+    }
+    rawNetwork = variant;
+  }
+  const { key: netKey, network, known } = networkFor(enums, rawNetwork);
+  if (!network) {
     console.error(`ecld-run: unknown network '${rawNetwork}'. Known: ${known.join(', ')}`);
     process.exit(1);
   }
-  const securelock = opts.securelock || process.env.PROJECT_NAME;
-  const trustedzone = opts.trustedzone || process.env.TRUSTED_ZONE_IMAGE;  // may be undefined -> run() default
+  const securelock = opts.securelock || casConfig.nameOnNetwork(process.env.PROJECT_NAME, rawNetwork);
+  // May be undefined -> run() default.
+  const trustedzone = opts.trustedzone || casConfig.nameOnNetwork(process.env.TRUSTED_ZONE_IMAGE, rawNetwork);
   if (!securelock) {
     console.error('ecld-run: no securelock enclave: set PROJECT_NAME in .env '
       + '(run ecld-init/ecld-publish) or pass --securelock.');
@@ -156,7 +155,10 @@ async function main() {
   }
   if (!privateKey.startsWith('0x')) privateKey = '0x' + privateKey;
 
-  console.log(`network    : ${netKey} (${address})`);
+  console.log(`network    : ${netKey} (${network.address})`);
+  if (network.unsafe) {
+    console.log('             UNSAFE: no CAS; the enclaves are debug-signed and sign their own certificates');
+  }
   console.log(`securelock : ${securelock}`);
   console.log(`trustedzone: ${trustedzone || '(runner default)'}`);
   console.log(`payload    : ${JSON.stringify(code)}`);
@@ -165,7 +167,8 @@ async function main() {
   // ---- drive the runner ----
   let runner;
   try {
-    runner = new EthernityCloudRunner(address, { privateKey });
+    runner = new EthernityCloudRunner(network.address, { privateKey }, network.chainId);
+    if (network.unsafe) await runner.setNetwork(...network.unsafe);
   } catch (e) {
     console.error('ecld-run: could not initialise the runner: ' + e.message);
     process.exit(1);

package/nodenithy/build/las/Dockerfile

@@ -1,5 +0,0 @@
-FROM registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/sconecuratedimages/services:las as initial
-
-FROM scratch
-
-COPY --from=initial / /

package/nodenithy/src/preStart.js

@@ -1,45 +0,0 @@
-const fs = require('fs');
-require('dotenv').config();
-
-const filePath = 'src/ec_helloworld_example.js';
-const fileContent = fs.readFileSync(filePath, 'utf8');
-
-const updatedContent = fileContent
-    .replace(/const PROJECT_NAME = ".*?";/, `const PROJECT_NAME = "${process.env.PROJECT_NAME}";`)
-    .replace(/const IPFS_ENDPOINT = ".*?";/, `const IPFS_ENDPOINT = "${process.env.IPFS_ENDPOINT}";`)
-
-fs.writeFileSync(filePath, updatedContent, 'utf8');
-
-// const code = updatedContent.match(/const code = `hello\("(.*?)"\);/)[1];
-
-const imageRegistryPath = 'node_modules/@ethernity-cloud/runner/contract/operation/imageRegistryContract.js';
-const imageRegistryContent = fs.readFileSync(imageRegistryPath, 'utf8');
-
-// Log the original content for debugging
-// console.log('Original imageRegistryContent:', imageRegistryContent);
-
-// Replace the content in imageRegistryContract.js
-// const updatedImageRegistryContent = imageRegistryContent.replace(/getLatestTrustedZoneImageCertPublicKey\([^)]*\);/, "getLatestTrustedZoneImageCertPublicKey('" + process.env.ENCLAVE_NAME_TRUSTEDZONE + "', 'v3')").replace(/getLatestImageVersionPublicKey\([^)]*\)/, "getLatestImageVersionPublicKey(imageName, '" + process.env.VERSION + "')");
-const updatedImageRegistryContent = imageRegistryContent.replace(
-    /async getEnclaveDetailsV3\(.*?\{[\s\S]*?\}\s*\}/,
-    `async getEnclaveDetailsV3(imageName, version) {
-      try {
-        const trustedZonePublicKey = (await this.contract.getLatestTrustedZoneImageCertPublicKey('${process.env.ENCLAVE_NAME_TRUSTEDZONE}', 'v3'));
-        const imageDetails = await this.contract.getLatestImageVersionPublicKey(imageName, '${process.env.VERSION}');
-        return [imageDetails[0], trustedZonePublicKey[1], imageDetails[2]];
-      } catch (e) {
-        console.log(e);
-        return null;
-      }
-    }`
-  );
-
-
-fs.writeFileSync(imageRegistryPath, updatedImageRegistryContent, 'utf8');
-
-const runnerPath = 'node_modules/@ethernity-cloud/runner/runner.js';
-const runnerContent = fs.readFileSync(runnerPath, 'utf8');
-
-const updatedRunnerContent = runnerContent.replace(/this.#enclaveImageIPFSHash}:.*?:/, "this.#enclaveImageIPFSHash}:"+process.env.ENCLAVE_NAME_TRUSTEDZONE+":").replace(/new ImageRegistryContract\([^)]*\);/, "new ImageRegistryContract(this.#networkAddress, '"+process.env.ENCLAVE_NAME_TRUSTEDZONE+"');");
-
-fs.writeFileSync(runnerPath, updatedRunnerContent, 'utf8');

package/pynithy/build/docker-compose.yml

@@ -1,70 +0,0 @@
-version: '3.2'
-services:
-  las:
-    container_name: las
-    privileged: true
-    image: etny-las
-    entrypoint: "/las_entrypoint.sh"
-    # -a 0.0.0.0: without it the LAS binds dual-stack (:::18766) and cannot
-    # allocate the socket on a host booted with ipv6.disable=1.
-    command: "/usr/local/bin/las -a 0.0.0.0"
-    devices:
-      - "/dev/sgx_enclave:/dev/sgx_enclave"
-    restart: on-failure
-    networks:
-      - ethernity
-    ports:
-      - target: 18766
-        published: 18766
-        protocol: tcp
-        mode: host
-
-  etny-securelock:
-    container_name: etny-securelock
-    privileged: true
-    image: etny-securelock
-    entrypoint: ""
-    command: [ "/usr/local/bin/python", "/etny-securelock/securelock.py" ]
-    environment:
-      - SCONE_CAS_ADDR=scone-cas.cf
-      - SCONE_LAS_ADDR=las
-      - SCONE_CONFIG_ID=etny-pynity-test-0.0.18/application
-      - SCONE_HEAP=128M
-      - SCONE_LOG=DEBUG
-      - SCONE_MODE=SIM
-      - SCONE_ALLOW_DLOPEN=2
-      - SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so
-    restart: on-failure
-    networks:
-      - ethernity
-    devices:
-      - "/dev/sgx_enclave:/dev/sgx_enclave"
-    depends_on:
-      - las
-
-  etny-trustedzone:
-    container_name: etny-trustedzone
-    privileged: true
-    image: etny-trustedzone
-    entrypoint: ""
-    command: [ "/usr/local/bin/python", "/etny-trustedzone/trustedzone.py" ]
-    environment:
-      - SCONE_CAS_ADDR=scone-cas.cf
-      - SCONE_LAS_ADDR=las
-      - SCONE_CONFIG_ID=etny-pynity-trustedzone-0.0.18/application
-      - SCONE_HEAP=128M
-      - SCONE_LOG=DEBUG
-      - SCONE_MODE=SIM
-      - SCONE_ALLOW_DLOPEN=2
-      - SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so
-    restart: on-failure
-    networks:
-      - ethernity
-    devices:
-      - "/dev/sgx_enclave:/dev/sgx_enclave"
-    depends_on:
-      - las
-
-networks:
-  ethernity:
-    external: true

package/pynithy/build/las/Dockerfile

@@ -1,11 +0,0 @@
-FROM registry.scontain.com:5050/sconecuratedimages/services:las as initial
-
-FROM scratch
-
-COPY --from=initial / /
-
-RUN apt-get update
-RUN apt-get install psmisc
-
-COPY src/* /
-