@ethernity-cloud/sdk-js 1.7.13 → 1.7.15

package/README.md

@@ -182,6 +182,11 @@ sets the enclave heap (default `1024M`).
   `--network`/`--securelock`/`--trustedzone`; the signing key is `PRIVATE_KEY`
   (or `ECLD_PRIVATE_KEY`) — a funded `0x` key that pays for the order. Resources
   are tunable with `--task-price`/`--cpu`/`--memory`/`--storage`/`--bandwidth`/`--duration`/`--validators`.
+  `--input <file>` / `--input-text <string>` send the task's input dataset, read
+  as `___etny_data_set___`; it travels encrypted, and the trustedzone checks it
+  against the sha256 the request carries. Exit code 0 on a `SUCCESS` task result,
+  1 otherwise; a task that raised in the enclave prints its task code (e.g.
+  `4 (BASE_EXCEPTION)`) and the enclave's error report as its result.
   `--ipfs intake` (the default) delivers the payload to the bootnode's payload
   intake once the request is on chain; `--ipfs <url>` writes and reads through
   that IPFS RPC API instead, with `ECLD_IPFS_TOKEN` (or `IPFS_TOKEN`) as its

package/cas/config.js

@@ -14,8 +14,9 @@
 // Kept in sync with etny-{pynithy,nodenithy}/v3/networks.yaml
 // (cas_session_registry_address, validator_registry_address).
 const VALIDATOR_REGISTRY = {
-  'etny-pynithy-testnet': '0x0014aB102FEa6b02e3D793FF4b9a0Af309fB4E14',
-  'etny-nodenithy-testnet': '0x0014aB102FEa6b02e3D793FF4b9a0Af309fB4E14',
+  // The Phase 2 ValidatorRegistry of 2026-10-21 (ethernity-cas CAS-SETUP.md).
+  'etny-pynithy-testnet': '0x8CC8B1dc22f0E06193161CeC79d75987b0640e02',
+  'etny-nodenithy-testnet': '0x8CC8B1dc22f0E06193161CeC79d75987b0640e02',
   'ecld-pynithy-litvm-testnet': '0xbE3759f327e8643fC5A1717fb2072A0dAcBAD29E',
   'ecld-nodenithy-litvm-testnet': '0xbE3759f327e8643fC5A1717fb2072A0dAcBAD29E',
   'ecld-pynithy-ethereum-sepolia': '0x8ad24b3F406A41a0F8D3440021792EB203957F43',
@@ -23,8 +24,10 @@ const VALIDATOR_REGISTRY = {
 };
 
 const SESSION_REGISTRY = {
-  'etny-pynithy-testnet': '0x444429681fCb26470Cb12B5436E48402cF7478A3',
-  'etny-nodenithy-testnet': '0x444429681fCb26470Cb12B5436E48402cF7478A3',
+  // The SessionRegistry with image binding of 2026-10-22; it links an image
+  // only once the Image Registry records it under the session's name.
+  'etny-pynithy-testnet': '0x78f0c5E92E7A9Ec2f2A36A4509ED4a75D0f9463B',
+  'etny-nodenithy-testnet': '0x78f0c5E92E7A9Ec2f2A36A4509ED4a75D0f9463B',
   'ecld-pynithy-litvm-testnet': '0xfA70B5Df7C773A21164cAc5413704117e4dEaB76',
   'ecld-nodenithy-litvm-testnet': '0xfA70B5Df7C773A21164cAc5413704117e4dEaB76',
   // Bound to Sepolia's ECImageRegistryV3 of 2026-10-14.
@@ -117,8 +120,19 @@ const renderCompose = (content, cas, unsafe) => content
   .map((line) => line.replace(/\s*# __(?:CAS|NO_CAS|SAFE)_ONLY__$/, ''))
   .join('\n');
 
+// The securelock session's ESR environment entry. A CAS-provisioned enclave
+// takes its environment from the session, not from the image's ENV, so the
+// registry address the build baked must also be set here; without ESR (or
+// without an address) the entry is a YAML comment.
+const esrSessionEnvironment = (env) => {
+  const enabled = /^(1|true|yes)$/i.test(String(env.ESR_ENABLED || '').trim());
+  const address = String(env.ESR_CONTRACT_ADDRESS || '').trim();
+  if (!enabled || !/^0x[0-9a-fA-F]{40}$/.test(address)) return '# ESR not enabled';
+  return `ESR_CONTRACT_ADDRESS: "${address}"`;
+};
+
 module.exports = {
   VALIDATOR_REGISTRY, SESSION_REGISTRY, CHAIN, casProvisioned, isMainnetNetwork,
   UNSAFE_NETWORKS, isUnsafeNetwork, TESTNETS, isTestnetNetwork, sessionAttestation,
-  nameOnNetwork, sessionTag, renderCompose,
+  nameOnNetwork, sessionTag, renderCompose, esrSessionEnvironment,
 };

package/nodenithy/run/etny-securelock-test.yaml.tpl

@@ -20,6 +20,9 @@ services:
      pwd: /
      environment:
         GREETING: hello from ETNY SECURELOCK!!!!
+        # A CAS-provisioned enclave takes its environment from this session,
+        # not from the image's ENV; run.js fills in the ESR registry address.
+        __ESR_ENVIRONMENT__
 
 images:
    - name: application_image

package/nodenithy/run.js

@@ -311,7 +311,8 @@ const main = async () => {
     const replacementsSecurelock = {
         PREDECESSOR: PREDECESSOR_HASH_SECURELOCK === 'EMPTY' ? `# predecessor: ${PREDECESSOR_HASH_SECURELOCK}` : `predecessor: ${PREDECESSOR_HASH_SECURELOCK}`,
         MRENCLAVE: process.env.MRENCLAVE_SECURELOCK,
-        ENCLAVE_NAME: ENCLAVE_NAME_SECURELOCK
+        ENCLAVE_NAME: ENCLAVE_NAME_SECURELOCK,
+        ESR_ENVIRONMENT: casConfig.esrSessionEnvironment(process.env)
     };
     if (cas) {
         processYamlTemplate('etny-securelock-test.yaml.tpl', 'etny-securelock-test.yaml', replacementsSecurelock);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ethernity-cloud/sdk-js",
-  "version": "1.7.13",
+  "version": "1.7.15",
   "description": "A package to run ethernity cloud build scripts",
   "scripts": {
     "test": "node --test \"test/**/*.test.js\"",
@@ -32,6 +32,7 @@
     "test.js",
     "info.js",
     "run.js",
+    "runReport.js",
     "network.js",
     "localKubo.js",
     "revert.js",
@@ -39,7 +40,7 @@
     "!**/*.pyc"
   ],
   "dependencies": {
-    "@ethernity-cloud/runner": "^0.6.6",
+    "@ethernity-cloud/runner": "^0.6.11",
     "acorn": "^8.11.0",
     "adm-zip": "^0.5.14",
     "axios": "^1.7.2",

package/pynithy/run/etny-securelock-test.yaml.tpl

@@ -24,6 +24,9 @@ services:
         # libraries call os.path.expanduser('~') at startup and abort with
         # "$HOME is not defined" before the enclave emits its public key.
         HOME: /tmp
+        # A CAS-provisioned enclave takes its environment from this session,
+        # not from the image's ENV; run.js fills in the ESR registry address.
+        __ESR_ENVIRONMENT__
 
 images:
    - name: application_image

package/pynithy/run.js

@@ -309,7 +309,8 @@ const main = async () => {
     const replacementsSecurelock = {
         PREDECESSOR: PREDECESSOR_HASH_SECURELOCK === 'EMPTY' ? `# predecessor: ${PREDECESSOR_HASH_SECURELOCK}` : `predecessor: ${PREDECESSOR_HASH_SECURELOCK}`,
         MRENCLAVE: process.env.MRENCLAVE_SECURELOCK,
-        ENCLAVE_NAME: ENCLAVE_NAME_SECURELOCK
+        ENCLAVE_NAME: ENCLAVE_NAME_SECURELOCK,
+        ESR_ENVIRONMENT: casConfig.esrSessionEnvironment(process.env)
     };
     if (cas) {
         processYamlTemplate('etny-securelock-test.yaml.tpl', 'etny-securelock-test.yaml', replacementsSecurelock);

package/run.js

@@ -44,6 +44,7 @@ try { require('dotenv').config(); } catch (e) { /* dotenv optional */ }
 const casConfig = require('./cas/config.js');
 const { networkFor, unsafeVariant } = require('./network.js');
 const { PUBLIC_IPFS_HOST } = require('./localKubo.js');
+const { reportRun } = require('./runReport.js');
 
 // `--ipfs intake` (the default): the artefacts' CIDs are computed locally and
 // the bytes delivered to the bootnode's payload intake once the DO request is
@@ -116,20 +117,19 @@ async function main() {
   let input = null;
   if (opts.inputFile !== undefined) input = fs.readFileSync(opts.inputFile, 'utf8');
   else if (opts.inputText !== undefined) input = opts.inputText;
-  // The enclave executor exposes the input as ___etny_data_set___; the runner
-  // passes it as part of the code's scope, so a payload references it by name.
-  // ecld-run mirrors ecld-test: input is delivered via the payload call itself.
+  // The input is the task's input dataset (runner option inputData): sent
+  // sealed for the trustedzone and read in the payload as ___etny_data_set___.
 
   // ---- runner (ESM) ----
-  let EthernityCloudRunner, ECStatus, ECEvent, ECOrderTaskStatus, enums;
+  let EthernityCloudRunner, ECStatus, ECEvent, enums;
   try {
     const runnerMod = await import('@ethernity-cloud/runner');
     EthernityCloudRunner = runnerMod.default || runnerMod.EthernityCloudRunner;
     enums = await import('@ethernity-cloud/runner/enums.js');
-    ({ ECStatus, ECEvent, ECOrderTaskStatus } = enums);
+    ({ ECStatus, ECEvent } = enums);
   } catch (e) {
     console.error('ecld-run: the runner package is not installed or is too old '
-      + '(need @ethernity-cloud/runner >= 0.6.0): ' + e.message);
+      + '(need @ethernity-cloud/runner >= 0.6.11): ' + e.message);
     process.exit(1);
   }
 
@@ -228,10 +228,9 @@ async function main() {
   const timeout = new Promise((resolve) => { timer = setTimeout(() => resolve('TIMEOUT'), timeoutMs); });
 
   try {
-    const runArgs = [resources, securelock, code, opts.node];
-    if (trustedzone) runArgs.push(trustedzone);
     // Fire the run; its own promise also settles on completion.
-    const runPromise = runner.run(...runArgs).catch((e) => ({ error: e.message }));
+    const runPromise = runner.run(resources, securelock, code, opts.node, trustedzone || null, { inputData: input })
+      .catch((e) => ({ error: e.message }));
     const outcome = await Promise.race([done, timeout, runPromise]);
     clearTimeout(timer);
 
@@ -239,28 +238,7 @@ async function main() {
       console.error(`\necld-run: no result after ${opts.timeout}s; the order may still process on-chain.`);
       process.exit(1);
     }
-    if (outcome && outcome.error) {
-      console.error(`\nstatus     : ERROR`);
-      console.error(`error      : ${outcome.error}`);
-      process.exit(1);
-    }
-
-    // SUCCESS
-    const result = await runner.getResult();
-    const typed = (runner.getStructuredResult && runner.getStructuredResult()) || null;
-    const taskCode = runner.resultTaskCode;
-    const taskName = runner.resultTaskCodeName
-      || (ECOrderTaskStatus && taskCode !== undefined ? ECOrderTaskStatus[taskCode] : undefined);
-
-    if (opts.json) {
-      console.log(JSON.stringify({ task_code: taskCode, task_code_name: taskName, value: result, structured: typed }, null, 2));
-    } else {
-      if (taskName && taskName !== 'SUCCESS') console.log(`task code  : ${taskCode} (${taskName})`);
-      console.log('result     :');
-      console.log(result);
-    }
-    // A non-zero enclave task code is a failed run even though the order landed.
-    process.exit(taskCode === undefined || taskCode === 0 ? 0 : 1);
+    process.exit(await reportRun(runner, outcome, { json: opts.json }));
   } catch (e) {
     clearTimeout(timer);
     console.error('ecld-run: run failed: ' + (e && e.stack ? e.stack : e));

package/runReport.js

@@ -0,0 +1,45 @@
+'use strict';
+
+/* ecld-run's report of a finished run.
+ *
+ * A run that delivered a result prints it; a task the enclave reported with a
+ * non-zero task code (an exception in the dApp, a checksum mismatch, ...)
+ * prints that code and its result, which is the enclave's error report. The
+ * runner signals such a task with its ERROR event, carrying getLastError().
+ */
+
+/**
+ * Print the outcome of a run and return the exit code.
+ * outcome: 'SUCCESS', or { error } from the ERROR event or a rejected run().
+ */
+async function reportRun(runner, outcome, { json = false, out = console.log, err = console.error } = {}) {
+  // { code, name } of the enclave's task code, or null when no result came.
+  const taskCode = runner.getResultTaskCode();
+  const error = outcome && outcome.error;
+  if (!taskCode && error) {
+    err('\nstatus     : ERROR');
+    err(`error      : ${error}`);
+    return 1;
+  }
+  const result = await runner.getResult();
+  const typed = (runner.getStructuredResult && runner.getStructuredResult()) || null;
+  if (json) {
+    out(JSON.stringify({
+      task_code: taskCode ? taskCode.code : undefined,
+      task_code_name: taskCode ? taskCode.name : undefined,
+      value: result,
+      structured: typed,
+    }, null, 2));
+  } else {
+    if (taskCode && taskCode.code !== 0) out(`task code  : ${taskCode.code} (${taskCode.name})`);
+    out('result     :');
+    out(result);
+  }
+  if (taskCode && taskCode.code !== 0) {
+    err(`error      : ${runner.getLastError() || error || taskCode.name}`);
+    return 1;
+  }
+  return error ? 1 : 0;
+}
+
+module.exports = { reportRun };