@ethernity-cloud/sdk-js 1.7.0 → 1.7.7

package/pynithy/run.js

@@ -8,6 +8,7 @@ const https = require('https');
 const casConfig = require('../cas/config.js');
 const casResolver = require('../cas/resolver.js');
 const sessionRegistry = require('../cas/session_registry.js');
+const { LocalKubo, ownEndpoint } = require('../localKubo.js');
 
 if (!fs.existsSync('.env')) {
     console.error("Error: .env file not found");
@@ -82,7 +83,7 @@ process.env.REGISTRY_PATH = `${currentDir}/registry`;
 const registryPath = process.env.REGISTRY_PATH;
 
 const runDockerCommand = (service) => {
-    const command = `docker-compose run -e SCONE_LOG=INFO -e SCONE_HASH=1 ${service}`;
+    const command = `docker-compose run --rm -e SCONE_LOG=INFO -e SCONE_HASH=1 ${service}`;
     const output = execSync(command).toString().trim();
     console.log(`Output of ${command}: ${output}`);
     return output.split('\n').filter(line => !/Creating|Pulling|latest|Digest/.test(line)).join('');
@@ -102,7 +103,7 @@ const extractSconeHash = (service) => {
 // Returns '' if the file is absent (testnet builds).
 const extractSignedMrenclave = (service) => {
     try {
-        const command = `docker-compose -f docker-compose.yml run --no-deps --entrypoint cat ${service} /signed_mrenclave.txt`;
+        const command = `docker-compose -f docker-compose.yml run --rm --no-deps --entrypoint cat ${service} /signed_mrenclave.txt`;
         const output = execSync(command, { stdio: ['pipe', 'pipe', 'pipe'] }).toString().trim();
         const m = output.match(/\b[a-fA-F0-9]{64}\b/);
         return m ? m[0] : '';
@@ -119,6 +120,79 @@ const main = async () => {
         console.error("Error: MEMORY_TO_ALLOCATE is not set in .env; run ecld-build first.");
         process.exit(1);
     }
+
+    // Where the image goes. An IPFS API of the application's own
+    // (IPFS_ENDPOINT, when it is not the public one) takes precedence.
+    // Otherwise the publish runs its own Kubo: the public write API of
+    // ipfs.ethernity.cloud is closing, and the image is held by this Kubo,
+    // peered with the bootnode, until its certificate is on chain.
+    let localKubo = null;
+    let ipfsApi = process.env.IPFS_ENDPOINT || '';
+    if (!ownEndpoint(ipfsApi)) {
+        localKubo = new LocalKubo(process.env.PROJECT_NAME);
+        try {
+            await localKubo.start();
+        } catch (e) {
+            console.error(`Error: ${e.message}`);
+            process.exit(1);
+        }
+        ipfsApi = localKubo.apiUrl;
+        console.log(`\t✔  IPFS node for this publish: ${ipfsApi}`);
+        process.on('exit', () => localKubo.stop());
+    }
+
+    // The CIDs uploadToIpfs gives, from the same add calls with only-hash: the
+    // IPFS node stores and announces nothing. Set by hashForIpfs, after which
+    // uploadToIpfs refuses an upload that gives other CIDs.
+    let expectedCids = null;
+    const hashForIpfs = () => {
+        const hashOf = (target) => {
+            try {
+                const out = execSync(`node ../ipfs.mjs --host "${ipfsApi}" --action hash ${target}`, { stdio: ['ignore', 'pipe', 'inherit'] });
+                return out.toString().trim().split('\n').pop().trim();
+            } catch (e) {
+                console.error(`Error: could not hash ${target} for IPFS: ${e.message}`);
+                process.exit(1);
+            }
+        };
+        process.env.IPFS_DOCKER_COMPOSE_HASH = hashOf('--filePath docker-compose-final.yml');
+        process.env.IPFS_HASH = hashOf(`--folderPath ${registryPath}`);
+        console.log("IPFS_DOCKER_COMPOSE_HASH (before upload): ", process.env.IPFS_DOCKER_COMPOSE_HASH);
+        console.log("IPFS_HASH (before upload): ", process.env.IPFS_HASH);
+        expectedCids = { image: process.env.IPFS_HASH, compose: process.env.IPFS_DOCKER_COMPOSE_HASH };
+    };
+
+    // The compose and the image tree, added through ipfsApi; their CIDs land
+    // in IPFS_DOCKER_COMPOSE_HASH / IPFS_HASH (files and environment).
+    const uploadToIpfs = () => {
+        for (const file of ['IPFS_HASH.ipfs', 'IPFS_DOCKER_COMPOSE_HASH.ipfs']) {
+            if (fs.existsSync(file)) fs.unlinkSync(file);
+        }
+        console.log('Upload docker-compose-final.yml to IPFS');
+        execSync(`node ../ipfs.mjs --host "${ipfsApi}" --action upload --filePath docker-compose-final.yml`, { stdio: "inherit" });
+        if (!fs.existsSync('IPFS_DOCKER_COMPOSE_HASH.ipfs')) {
+            console.error("Error: Could not upload docker-compose-final.yml to IPFS, please try again!");
+            process.exit(1);
+        }
+        process.env.IPFS_DOCKER_COMPOSE_HASH = fs.readFileSync('IPFS_DOCKER_COMPOSE_HASH.ipfs', 'utf8').trim();
+        console.log("IPFS_DOCKER_COMPOSE_HASH: ", process.env.IPFS_DOCKER_COMPOSE_HASH);
+        writeEnv('IPFS_DOCKER_COMPOSE_HASH', process.env.IPFS_DOCKER_COMPOSE_HASH);
+        console.log('Upload docker registry to IPFS');
+        execSync(`node ../ipfs.mjs --host "${ipfsApi}" --action upload --folderPath ${registryPath}`, { stdio: "inherit" });
+        if (!fs.existsSync('IPFS_HASH.ipfs')) {
+            console.error("Error: Could not upload registry to IPFS, please try again!");
+            process.exit(1);
+        }
+        process.env.IPFS_HASH = fs.readFileSync('IPFS_HASH.ipfs', 'utf8').trim();
+        console.log("IPFS_HASH: ", process.env.IPFS_HASH);
+        writeEnv('IPFS_HASH', process.env.IPFS_HASH);
+        if (expectedCids && (process.env.IPFS_HASH !== expectedCids.image
+            || process.env.IPFS_DOCKER_COMPOSE_HASH !== expectedCids.compose)) {
+            console.error(`Error: the upload gave ${process.env.IPFS_HASH} (compose ${process.env.IPFS_DOCKER_COMPOSE_HASH}), not the registered ${expectedCids.image} (compose ${expectedCids.compose}).`);
+            process.exit(1);
+        }
+    };
+
     ['docker-compose.yml', 'docker-compose-final.yml'].forEach(file => {
         const template = `${file}.tmpl`;
         if (!fs.existsSync(template)) {
@@ -238,17 +312,19 @@ const main = async () => {
     // Where the session goes depends on who provisions the securelock. On a
     // CAS-attested testnet it is registered ON-CHAIN in the ethernity-cas
     // SessionRegistry, which the validator set reads and which accepts no
-    // POST; the publish then waits until the validators serve it, because the
-    // public-key harvest below provisions the enclave from them. On mainnet it
-    // is registered with the Scontain CAS. A self-signing testnet has none: a
-    // CAS-issued certificate would not match the key the enclave derives.
-    if (!cas) {
-        console.log(`\t✔  ${process.env.BLOCKCHAIN_NETWORK}: no CAS session; the securelock self-signs from MR_ENCLAVE`);
-    } else if (casTestnet) {
+    // POST. That happens once the image is registered, below: the
+    // SessionRegistry takes a securelock session only from the wallet that
+    // owns the image name. The publish then waits until the validators serve
+    // it, because the public-key harvest provisions the enclave from them. On
+    // mainnet it is registered with the Scontain CAS. A self-signing testnet
+    // has none: a CAS-issued certificate would not match the key the enclave
+    // derives.
+    const registerSessionOnChain = async () => {
         const registered = await sessionRegistry.register(
             casChain.rpcUrl, casChain.chainId, casConfig.SESSION_REGISTRY[templateName],
             process.env.PRIVATE_KEY, fs.readFileSync('etny-securelock-test.yaml'),
-            process.env.IPFS_ENDPOINT, '');
+            ipfsApi, '');
+        if (localKubo) await localKubo.provide(registered.cid);
         if (registered.registered) {
             console.log(`\t✔  Session ${registered.name} registered on-chain (body ${registered.cid})`);
             await sessionRegistry.waitVisible(
@@ -256,7 +332,10 @@ const main = async () => {
         } else {
             console.log(`\t✔  Session ${registered.name} already registered on-chain with this body (${registered.hash})`);
         }
-    } else {
+    };
+    if (!cas) {
+        console.log(`\t✔  ${process.env.BLOCKCHAIN_NETWORK}: no CAS session; the securelock self-signs from MR_ENCLAVE`);
+    } else if (!casTestnet) {
     // don't generate new keys if PREDECESSOR_HASH_SECURELOCK is not empty and the key.pem and cert.pem files exist
     if (PREDECESSOR_HASH_SECURELOCK !== 'EMPTY' && fs.existsSync('key.pem') && fs.existsSync('cert.pem')) {
         console.log("Skipping key pair generation and certificate creation.");
@@ -406,15 +485,20 @@ const main = async () => {
     console.log("# Update docker-compose files");
 
     // On a CAS-attested testnet the compose names the CAS both enclaves are
-    // provisioned from (a validator resolved from the registry, or
-    // ECLD_CAS_ADDR; the node re-resolves it before each task) and the
-    // trustedzone session the ImageRegistry records for this template.
+    // provisioned from and the trustedzone session the ImageRegistry records
+    // for this template. docker-compose.yml, which harvests the certificate
+    // here, names a validator that answered (or ECLD_CAS_ADDR); the published
+    // docker-compose-final.yml names the first validator in registry order,
+    // so that a rerun of this publish renders the same compose. The node and
+    // the extraction service resolve a CAS again before they run it.
     let casAddr = null;
+    let publishedCasAddr = null;
     let trustedZoneSession = null;
     if (casTestnet) {
         casAddr = await casResolver.casAddressFor(casChain.rpcUrl, casConfig.VALIDATOR_REGISTRY[templateName]);
-        console.log(`\t✔  CAS for this network: ${casAddr}`);
-        trustedZoneSession = execSync(`node ./image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" ${templateName} "v3" "" "getTrustedZoneSession"`).toString().trim();
+        publishedCasAddr = await casResolver.publishedCasAddress(casChain.rpcUrl, casConfig.VALIDATOR_REGISTRY[templateName]);
+        console.log(`\t✔  CAS for this network: ${casAddr} (the published compose names ${publishedCasAddr})`);
+        trustedZoneSession = execSync(`node ./image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" ${templateName} "v3" "getTrustedZoneSession"`).toString().trim();
         if (!trustedZoneSession) {
             console.error(`ERROR! The ImageRegistry records no trustedzone session for ${templateName}.`);
             process.exit(1);
@@ -454,7 +538,8 @@ const main = async () => {
             .replace(/__ENCLAVE_NAME_SECURELOCK__/g, ENCLAVE_NAME_SECURELOCK)
             .replace(/__ENCLAVE_NAME_TRUSTEDZONE__/g, ENCLAVE_NAME_TRUSTEDZONE);
         if (casTestnet) {
-            updatedContent = updatedContent.replace(/SCONE_CAS_ADDR=scone-cas\.cf/g, `SCONE_CAS_ADDR=${casAddr}`);
+            const fileCasAddr = file === 'docker-compose-final.yml' ? publishedCasAddr : casAddr;
+            updatedContent = updatedContent.replace(/SCONE_CAS_ADDR=scone-cas\.cf/g, `SCONE_CAS_ADDR=${fileCasAddr}`);
         }
 
         fs.writeFileSync(file, updatedContent, 'utf8');
@@ -478,7 +563,30 @@ const main = async () => {
     // let PUBLIC_KEY_SECURELOCK_RES = execSync(`docker-compose run etny-securelock 2>/dev/null | grep -v Creating | grep -v Pulling | grep -v latest | grep -v Digest | sed 's/.*PUBLIC_KEY:\\s*//' | tr -d '\\r'`).toString().trim();
 
 
-    // TODO: calculate hash of the files localy, and query the public key service, if the hash is already there it means we dont have to do the below.
+    // The image and its compose go out before the certificate is extracted,
+    // whichever way it is: the extraction service fetches them by these CIDs.
+    // On a two-step registry (ECImageRegistryV2 and later) the wallet records
+    // the image first (registerImage, with the publish's node), under the
+    // CIDs the upload gives, hashed before anything is stored. On
+    // ECImageRegistryV3 that binds the image name to this wallet before the
+    // upload, the session registration or anything else discloses it. The
+    // bootnode's mirror then pins the image and the extraction service queues
+    // it from the chain; the certificate is written below by the same wallet
+    // (setImageCert). A V1 registry takes both in one addImage call.
+    const registryV2 = execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "${securelock}" "v3" "isV2"`, { env: { ...process.env, PROJECT_NAME: securelock } }).toString().trim() === 'true';
+    let ipfsPeer = '';
+    if (registryV2) {
+        hashForIpfs();
+        if (localKubo) ipfsPeer = await localKubo.peerMultiaddr();
+        execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "${securelock}" "v3" "registerImage"`, { stdio: "inherit", env: { ...process.env, PROJECT_NAME: securelock, IPFS_PEER: ipfsPeer } });
+    }
+    uploadToIpfs();
+    const registryEnv = { ...process.env, PROJECT_NAME: securelock, IPFS_PEER: ipfsPeer };
+    if (registryV2 && localKubo) {
+        await localKubo.provide(process.env.IPFS_HASH);
+        await localKubo.provide(process.env.IPFS_DOCKER_COMPOSE_HASH);
+    }
+    if (casTestnet) await registerSessionOnChain();
 
     if (fs.existsSync('certificate.securelock.crt')) {
         // delete it
@@ -487,7 +595,7 @@ const main = async () => {
 
     let PUBLIC_KEY_SECURELOCK_RES = '';
     try {
-        const output = execSync(`docker-compose run etny-securelock`, { cwd: runDir }).toString();
+        const output = execSync(`docker-compose run --rm etny-securelock`, { cwd: runDir }).toString();
         console.log("Output of docker-compose run etny-securelock:");
         // Extract the WHOLE multi-line PEM certificate block from the enclave
         // output. A previous version grabbed only the single line containing
@@ -520,43 +628,6 @@ const main = async () => {
             process.exit(0);
         } else {
             console.log("\nGenerating certificates using the Ethernity Cloud signing service...\n");
-            console.log("**** Started ipfs initial pining ****");
-            if (fs.existsSync('IPFS_HASH.ipfs')) {
-                fs.unlinkSync('IPFS_HASH.ipfs');
-            }
-            if (fs.existsSync('IPFS_DOCKER_COMPOSE_HASH.ipfs')) {
-                fs.unlinkSync('IPFS_DOCKER_COMPOSE_HASH.ipfs');
-            }
-
-
-            console.log('Upload docker-compose-final.yml to IPFS');
-            const dockerHash = execSync(`node ../ipfs.mjs --host "${process.env.IPFS_ENDPOINT}" --action upload --filePath docker-compose-final.yml`, { stdio: "inherit" });
-            if (!fs.existsSync('IPFS_DOCKER_COMPOSE_HASH.ipfs')) {
-                console.error("Error: Could not upload docker-compose-final.yml to IPFS, please try again!");
-                process.exit(1);
-            }
-            process.env.IPFS_DOCKER_COMPOSE_HASH = fs.readFileSync('IPFS_DOCKER_COMPOSE_HASH.ipfs', 'utf8').trim();
-            console.log("IPFS_DOCKER_COMPOSE_HASH: ", process.env.IPFS_DOCKER_COMPOSE_HASH);
-            writeEnv('IPFS_DOCKER_COMPOSE_HASH', process.env.IPFS_DOCKER_COMPOSE_HASH);
-            console.log()
-            await new Promise(resolve => setTimeout(resolve, 3000));
-
-            console.log('Upload docker registry to IPFS');
-            const repositoryHash = execSync(`node ../ipfs.mjs --host "${process.env.IPFS_ENDPOINT}" --action upload --folderPath ${registryPath}`, { stdio: "inherit" });
-            if (!fs.existsSync(`./IPFS_HASH.ipfs`)) {
-                console.error("Error: Could not upload registry to IPFS, please try again!");
-                process.exit(1);
-            }
-            process.env.IPFS_HASH = fs.readFileSync(`./IPFS_HASH.ipfs`, 'utf8').trim();
-            console.log("IPFS_HASH: ", process.env.IPFS_HASH);
-            writeEnv('IPFS_HASH', process.env.IPFS_HASH);
-
-            console.log()
-
-            console.log("**** Finished ipfs initial pining ****");
-            console.log()
-            console.log()
-
             console.log(`ENCLAVE_NAME_SECURELOCK: ${ENCLAVE_NAME_SECURELOCK}`);
             execSync(`node ./public_key_service.js --enclave_name "${securelock}" --protocol_version "v3" --network "${process.env.BLOCKCHAIN_NETWORK}" --template_version "${process.env.VERSION}"`, { stdio: 'inherit' });
             PUBLIC_KEY_SECURELOCK_RES = fs.readFileSync('PUBLIC_KEY.txt', 'utf8').trim();
@@ -591,7 +662,7 @@ const main = async () => {
     }
 
     // const scriptPath = path.resolve(__dirname, '/image_registry.js');
-    const trustedZoneCert = execSync(`node ./image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" ${templateName} "v3" "" "getTrustedZoneCert"`).toString().trim();
+    const trustedZoneCert = execSync(`node ./image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" ${templateName} "v3" "getTrustedZoneCert"`).toString().trim();
 
     console.log("trustedZoneCert: ", trustedZoneCert);
 
@@ -608,41 +679,42 @@ const main = async () => {
     console.log("Listing certificate PUBLIC_KEY_TRUSTEDZONE:");
     console.log(fs.readFileSync('certificate.trustedzone.crt', 'utf8'));
 
+    // image_registry.js reads the securelock certificate from registry/.
     fs.copyFileSync('certificate.securelock.crt', `${registryPath}/certificate.securelock.crt`);
     fs.copyFileSync('certificate.trustedzone.crt', `${registryPath}/certificate.trustedzone.crt`);
 
-    if (fs.existsSync('IPFS_HASH.ipfs')) {
-        fs.unlinkSync('IPFS_HASH.ipfs');
-    }
-
-    console.log('Upload docker registry to IPFS');
-    execSync(`node ../ipfs.mjs --host "${process.env.IPFS_ENDPOINT}" --action upload --folderPath ${registryPath}`, { stdio: "inherit" });
-    if (!fs.existsSync(`./IPFS_HASH.ipfs`)) {
-        console.error("Error: Could not upload registry to IPFS, please try again!");
-        process.exit(1);
-    }
-    process.env.IPFS_HASH = fs.readFileSync(`./IPFS_HASH.ipfs`, 'utf8').trim();
-    console.log("IPFS_HASH: ", process.env.IPFS_HASH);
-    writeEnv('IPFS_HASH', process.env.IPFS_HASH);
-    process.chdir(currentDir);
-    console.log(`Adding certificates for SECURELOCK ${securelock} into IMAGE REGISTRY smart contract...`);
-    // image_registry.js registers the image under PROJECT_NAME.
-    const registryEnv = { ...process.env, PROJECT_NAME: securelock };
-    let existing = false;
-    try {
-        const existingImages = execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "${securelock}" "${process.env.VERSION}" "${process.env.PRIVATE_KEY}" "registerSecureLockImage"`, { stdio: "inherit", env: registryEnv });
-        if (existingImages.toString().trim().replace('Image hash: ', '') === process.env.IPFS_HASH) {
-            console.log("Certificates for SECURELOCK already added to IMAGE REGISTRY smart contract");
+    if (registryV2) {
+        // The registered hash is the tree uploaded before the extraction.
+        process.chdir(currentDir);
+        console.log(`Registering the certificate of SECURELOCK ${securelock} in the IMAGE REGISTRY smart contract...`);
+        execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "${securelock}" "v3" "setImageCert"`, { stdio: "inherit", env: registryEnv });
+    } else {
+        // A V1 registry gets the tree that carries the certificate files,
+        // uploaded again, with the certificate, in one addImage call.
+        if (fs.existsSync('IPFS_HASH.ipfs')) {
+            fs.unlinkSync('IPFS_HASH.ipfs');
+        }
+        console.log('Upload docker registry to IPFS');
+        execSync(`node ../ipfs.mjs --host "${ipfsApi}" --action upload --folderPath ${registryPath}`, { stdio: "inherit" });
+        if (!fs.existsSync(`./IPFS_HASH.ipfs`)) {
+            console.error("Error: Could not upload registry to IPFS, please try again!");
+            process.exit(1);
+        }
+        process.env.IPFS_HASH = fs.readFileSync(`./IPFS_HASH.ipfs`, 'utf8').trim();
+        console.log("IPFS_HASH: ", process.env.IPFS_HASH);
+        writeEnv('IPFS_HASH', process.env.IPFS_HASH);
+        if (localKubo) await localKubo.provide(process.env.IPFS_HASH);
+        process.chdir(currentDir);
+        console.log(`Adding certificates for SECURELOCK ${securelock} into IMAGE REGISTRY smart contract...`);
+        // image_registry.js registers the image under PROJECT_NAME and prints
+        // why when it cannot.
+        registryEnv.IPFS_HASH = process.env.IPFS_HASH;
+        try {
+            execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "${securelock}" "${process.env.VERSION}" "registerSecureLockImage"`, { stdio: "inherit", env: registryEnv });
+        } catch (error) {
+            console.error("Error: Could not add the certificates of the SECURELOCK to the IMAGE REGISTRY smart contract");
+            process.exit(1);
         }
-        existing = true;
-    } catch (error) {
-        // console.error("Error: Could not add certificates for SECURELOCK into IMAGE REGISTRY smart contract");
-        // console.error(error);
-        // process.exit(1);
-    }
-
-    if (!existing) {
-        const res = execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "" "" "" "registerSecureLockImage"`, { stdio: "inherit", env: registryEnv });
     }
     // The on-chain session points at the image it admits, so a validator can
     // pin the image beside the body it serves.

package/pynithy/src/ec_helloworld_example.js

@@ -1,58 +1,62 @@
-const AppCss = require('./App.css');
+import './App.css';
 import EthernityCloudRunner from "@ethernity-cloud/runner";
-import {ECEvent, ECRunner, ECStatus} from "@ethernity-cloud/runner/enums";
-import Web3 from 'web3';
+import { ECStatus } from "@ethernity-cloud/runner/enums";
 
+// Filled in from the project's .env by src/preStart.mjs on `npm start`: the
+// securelock this dApp is published as, the trustedzone it was built against,
+// the network's token address and chain id, the -unsafe network when the dApp
+// runs without a CAS (null otherwise), and the IPFS endpoint.
 const PROJECT_NAME = "";
+const TRUSTED_ZONE_IMAGE = "";
+const NETWORK_ADDRESS = "";
+const CHAIN_ID = null;
+const UNSAFE_NETWORK = null;
 const IPFS_ENDPOINT = "";
 
+// A call into src/serverless/backend.py; its return value is the task result.
 const code = `hello("World")`;
 
 function App() {
     const executeTask = async () => {
-        const runner = new EthernityCloudRunner();
-        // this is a server provided by Ethernity CLOUD, please bear in mind that you can use your own Decentralized Storage server
-        const ipfsAddress = IPFS_ENDPOINT;
-        runner.initializeStorage(ipfsAddress);
-        console.log(PROJECT_NAME)
-        const onTaskProgress = (e) => {
-            if (e.detail.status === ECStatus.ERROR) {
-                console.error(e.detail.message);
-            } else {
-                console.log(e.detail.message);
-            }
-        };
-
-        const onTaskCompleted = (e) => {
-            console.log(`Task Result: ${e.detail.message.result}`);
-            // display the result in page below the buttons
-            const result = document.createElement("p");
-            result.innerHTML = `Task Result: ${e.detail.message.result}`;
-            document.body.appendChild(result);
+        // The browser wallet (MetaMask) signs and pays for the order.
+        const runner = new EthernityCloudRunner(NETWORK_ADDRESS, {}, CHAIN_ID || undefined);
+        if (UNSAFE_NETWORK) {
+            await runner.setNetwork(...UNSAFE_NETWORK);
         }
+        runner.initializeStorage(IPFS_ENDPOINT);
 
-        runner.addEventListener(ECEvent.TASK_PROGRESS, onTaskProgress);
-        runner.addEventListener(ECEvent.TASK_COMPLETED, onTaskCompleted);
+        // Events are named by task status; detail is { message, status, progress }.
+        runner.addEventListener(ECStatus.DEFAULT, (e) => {
+            console.log(`[${e.detail.progress}] ${e.detail.message}`);
+        });
+        runner.addEventListener(ECStatus.ERROR, (e) => {
+            console.error(e.detail.message);
+        });
+        runner.addEventListener(ECStatus.SUCCESS, async () => {
+            const result = await runner.getResult();
+            console.log(`Task Result: ${result}`);
+            // display the result in page below the buttons
+            const line = document.createElement("p");
+            line.textContent = `Task Result: ${result}`;
+            document.body.appendChild(line);
+        });
 
-        await runner.run(PROJECT_NAME,
-                        code,
-                         '0xd58f5C1834279ABD601df85b3E4b2323aDD4E75e',
-                         { taskPrice: 6, cpu: 1, memory: 1, storage: 10, bandwidth: 1, duration: 1, validators: 1 });
+        const resources = { taskPrice: 10, cpu: 1, memory: 1, storage: 10, bandwidth: 1, duration: 1, validators: 1 };
+        await runner.run(resources, PROJECT_NAME, code, '', TRUSTED_ZONE_IMAGE);
     };
+
     const connectWallet = async () => {
-      if (window.ethereum) {
-          window.web3 = new Web3(window.ethereum);
-          try {
-              // Request account access
-              await window.ethereum.request({ method: 'eth_requestAccounts' });
-              console.log("Wallet connected");
-          } catch (error) {
-              console.error("User denied account access");
-          }
-      } else {
-          console.log('Please install MetaMask!');
-      }
-  };
+        if (!window.ethereum) {
+            console.log('Please install MetaMask!');
+            return;
+        }
+        try {
+            await window.ethereum.request({ method: 'eth_requestAccounts' });
+            console.log("Wallet connected");
+        } catch (error) {
+            console.error("User denied account access");
+        }
+    };
 
     return (
         <div className="container">
@@ -61,4 +65,4 @@ function App() {
         </div>
     );
 }
-export default App;
+export default App;

package/pynithy/src/preStart.mjs

@@ -1,57 +1,47 @@
+// Runs before `react-scripts start` (the project's `npm start`): fills the
+// constants at the top of src/ec_helloworld_example.js from the project's
+// .env, the way ecld-run reads the same values. PROJECT_NAME and
+// TRUSTED_ZONE_IMAGE take their -unsafe form on an -unsafe network; the
+// network's token address, chain id and -unsafe (network, type) come from the
+// runner's own enums through the SDK's network table.
 import fs from 'fs';
+import { createRequire } from 'module';
 import dotenv from 'dotenv';
-dotenv.config();
+import * as enums from '@ethernity-cloud/runner/enums.js';
 
-export const ECRunner = {
-  'etny-pynithy-testnet': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c'],
-  'etny-nodenithy-testnet': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c'],
-  'etny-pynithy': ['0x549A6E06BB2084100148D50F51CF77a3436C3Ae7'],
-  'etny-nodenithy': ['0x549A6E06BB2084100148D50F51CF77a3436C3Ae7'],
-  'ecld-nodenithy-testnet': ['0xfb450e40f590F1B5A119a4B82E6F3579D6742a00'],
-  'ecld-pynithy': ['0xc6920888988cAcEeA7ACCA0c96f2D65b05eE22Ba'],
-  'ecld-nodenithy': ['0xc6920888988cAcEeA7ACCA0c96f2D65b05eE22Ba']
+dotenv.config();
+const require = createRequire(import.meta.url);
+const casConfig = require('@ethernity-cloud/sdk-js/cas/config.js');
+const { networkFor } = require('@ethernity-cloud/sdk-js/network.js');
+
+const { PROJECT_NAME, TRUSTED_ZONE_IMAGE, BLOCKCHAIN_NETWORK, IPFS_ENDPOINT } = process.env;
+if (!PROJECT_NAME || !BLOCKCHAIN_NETWORK) {
+  console.error('preStart: PROJECT_NAME and BLOCKCHAIN_NETWORK are not set in .env; run `npm run ecld-init` first.');
+  process.exit(1);
+}
+const { network, known } = networkFor(enums, BLOCKCHAIN_NETWORK);
+if (!network) {
+  console.error(`preStart: unknown BLOCKCHAIN_NETWORK '${BLOCKCHAIN_NETWORK}' in .env. Known: ${known.join(', ')}`);
+  process.exit(1);
+}
+
+const constants = {
+  PROJECT_NAME: casConfig.nameOnNetwork(PROJECT_NAME, BLOCKCHAIN_NETWORK),
+  TRUSTED_ZONE_IMAGE: casConfig.nameOnNetwork(TRUSTED_ZONE_IMAGE, BLOCKCHAIN_NETWORK) || '',
+  NETWORK_ADDRESS: network.address,
+  CHAIN_ID: network.chainId || null,
+  UNSAFE_NETWORK: network.unsafe || null,
+  IPFS_ENDPOINT: IPFS_ENDPOINT || 'https://ipfs.ethernity.cloud',
 };
 
 const filePath = 'src/ec_helloworld_example.js';
-const fileContent = fs.readFileSync(filePath, 'utf8');
-
-const updatedContent = fileContent
-    .replace(/const PROJECT_NAME = ".*?";/, `const PROJECT_NAME = "${process.env.PROJECT_NAME}";`)
-    .replace(/const IPFS_ENDPOINT = ".*?";/, `const IPFS_ENDPOINT = "${process.env.IPFS_ENDPOINT}";`)
-    .replace(/new EthernityCloudRunner\(.*?\);/, `new EthernityCloudRunner('${ECRunner[process.env.ENCLAVE_NAME_TRUSTEDZONE]}');`);
-
-fs.writeFileSync(filePath, updatedContent, 'utf8');
-
-// const code = updatedContent.match(/const code = `hello\("(.*?)"\);/)[1];
-
-const imageRegistryPath = 'node_modules/@ethernity-cloud/runner/contract/operation/imageRegistryContract.js';
-const imageRegistryContent = fs.readFileSync(imageRegistryPath, 'utf8');
-
-// Log the original content for debugging
-// console.log('Original imageRegistryContent:', imageRegistryContent);
-
-// Replace the content in imageRegistryContract.js
-// const updatedImageRegistryContent = imageRegistryContent.replace(/getLatestTrustedZoneImageCertPublicKey\([^)]*\);/, "getLatestTrustedZoneImageCertPublicKey('" + process.env.ENCLAVE_NAME_TRUSTEDZONE + "', 'v3')").replace(/getLatestImageVersionPublicKey\([^)]*\)/, "getLatestImageVersionPublicKey(imageName, '" + process.env.VERSION + "')");
-const updatedImageRegistryContent = imageRegistryContent.replace(
-    /async getEnclaveDetailsV3\(.*?\{[\s\S]*?\}\s*\}/,
-    `async getEnclaveDetailsV3(imageName, version) {
-      try {
-        const trustedZonePublicKey = (await this.contract.getLatestTrustedZoneImageCertPublicKey('${process.env.ENCLAVE_NAME_TRUSTEDZONE}', 'v3'));
-        const imageDetails = await this.contract.getLatestImageVersionPublicKey(imageName, '${process.env.VERSION}');
-        return [imageDetails[0], trustedZonePublicKey[1], imageDetails[2]];
-      } catch (e) {
-        console.log(e);
-        return null;
-      }
-    }`
-  );
-
-
-fs.writeFileSync(imageRegistryPath, updatedImageRegistryContent, 'utf8');
-
-const runnerPath = 'node_modules/@ethernity-cloud/runner/runner.js';
-const runnerContent = fs.readFileSync(runnerPath, 'utf8');
-
-const updatedRunnerContent = runnerContent.replace(/this.#enclaveImageIPFSHash}:.*?:/, "this.#enclaveImageIPFSHash}:"+process.env.ENCLAVE_NAME_TRUSTEDZONE+":").replace(/new ImageRegistryContract\([^)]*\);/, "new ImageRegistryContract(this.#networkAddress, '"+process.env.ENCLAVE_NAME_TRUSTEDZONE+"');");
-
-fs.writeFileSync(runnerPath, updatedRunnerContent, 'utf8');
+let content = fs.readFileSync(filePath, 'utf8');
+for (const [name, value] of Object.entries(constants)) {
+  const line = new RegExp(`^const ${name} = .*;$`, 'm');
+  if (!line.test(content)) {
+    console.error(`preStart: ${filePath} has no 'const ${name} = ...;' line to fill.`);
+    process.exit(1);
+  }
+  content = content.replace(line, `const ${name} = ${JSON.stringify(value)};`);
+}
+fs.writeFileSync(filePath, content, 'utf8');

package/revert.js

@@ -0,0 +1,76 @@
+// What the node answered when a contract call failed.
+//
+// ethers 5 reads revert data only from a geth-style JSON-RPC error, which it
+// turns into the call's result and decodes into a CALL_EXCEPTION with no
+// node error nested. The bloxberg node (Parity 2.7) answers eth_call with
+// {"data": "Reverted 0x..."}, which ethers reports as a CALL_EXCEPTION with
+// "missing revert data" and the node's error nested, and its eth_estimateGas
+// error carries no data at all. ethers reports an eth_call that timed out as
+// the same CALL_EXCEPTION, with the timeout nested. A refusal is therefore
+// read from a simulated call (callStatic), out of the node's own error.
+const { ethers } = require('ethers');
+
+const ERROR_STRING = '0x08c379a0'; // Error(string)
+const PANIC = '0x4e487b71'; // Panic(uint256)
+
+function bodyError(body) {
+  try {
+    return JSON.parse(body).error;
+  } catch (e) {
+    return undefined;
+  }
+}
+
+// The JSON-RPC errors the node answered with: the errors nested in an ethers
+// error, and in the response bodies it carries, that hold the node's numeric
+// error code. A call the node never answered has none.
+function nodeErrors(e) {
+  const found = [];
+  for (let err = e, depth = 0; err && depth < 5; err = err.error, depth++) {
+    for (const candidate of [err, bodyError(err.body)]) {
+      if (candidate && typeof candidate.code === 'number') found.push(candidate);
+    }
+  }
+  return found;
+}
+
+// Whether the node answered the call with a revert, rather than failing to
+// answer it (a timeout, an unreachable node, a rate limit).
+function isRevert(e) {
+  if (e.code !== ethers.errors.CALL_EXCEPTION) return false;
+  if (!e.error) return true;
+  return nodeErrors(e).some((err) => (typeof err.data === 'string' && err.data.startsWith('Reverted'))
+    || /revert/i.test(err.message || ''));
+}
+
+// The revert data the node returned, as 0x-prefixed hex with at least a
+// selector, or null.
+function revertData(e) {
+  for (const err of nodeErrors(e)) {
+    if (typeof err.data !== 'string') continue;
+    const m = err.data.match(/^(?:Reverted )?(0x(?:[0-9a-fA-F]{2})*)$/);
+    if (m && m[1].length >= 10) return m[1];
+  }
+  return null;
+}
+
+// The refusal as the contract states it: a require message, or a custom
+// error of `iface` with its arguments. Falls back to the error's own message
+// when the node returned no revert data.
+function revertReason(e, iface) {
+  if (e.errorName === 'Error' && e.reason) return e.reason;
+  if (e.errorName) return `${e.errorName}(${(e.errorArgs || []).map(String).join(', ')})`;
+  const data = revertData(e);
+  if (!data) return e.reason || e.message;
+  const args = `0x${data.slice(10)}`;
+  try {
+    if (data.startsWith(ERROR_STRING)) return ethers.utils.defaultAbiCoder.decode(['string'], args)[0];
+    if (data.startsWith(PANIC)) return `Panic(${ethers.utils.defaultAbiCoder.decode(['uint256'], args)[0]})`;
+    const parsed = iface.parseError(data);
+    return `${parsed.name}(${parsed.args.map(String).join(', ')})`;
+  } catch (err) {
+    return `reverted with data ${data}`;
+  }
+}
+
+module.exports = { isRevert, revertData, revertReason };