Layr-Labs
diff --git a/‎.github/workflows/main.yaml‎
Lines changed: 1 addition & 1 deletion b/‎.github/workflows/main.yaml‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎cmd/kmsClient/README.md‎
Lines changed: 83 additions & 4 deletions b/‎cmd/kmsClient/README.md‎
Lines changed: 83 additions & 4 deletions
diff --git a/‎cmd/kmsClient/environments.go‎
Lines changed: 81 additions & 0 deletions b/‎cmd/kmsClient/environments.go‎
Lines changed: 81 additions & 0 deletions
diff --git a/‎cmd/kmsClient/environments_test.go‎
Lines changed: 65 additions & 0 deletions b/‎cmd/kmsClient/environments_test.go‎
Lines changed: 65 additions & 0 deletions
@@ -68,7 +68,7 @@ jobs:
       - name: Install Foundry
         uses: foundry-rs/foundry-toolchain@c7450ba673e133f5ee30098b3b54f444d3a2ca2d # v1.8
         with:
-          version: v1.5.1
+          version: v1.7.1
       - name: Run tests
         run: |
           make deps
 
@@ -52,17 +52,69 @@ A CLI tool for interacting with EigenX KMS operators to encrypt and decrypt appl
   --threshold 2
 ```
 
+#### Decrypt Data with ECDSA Attestation
+
+Some operator deployments require attestation before serving an application's
+key material. The `decrypt` command can authenticate with an ECDSA
+challenge-response attestation against the operators' `/secrets` endpoint:
+
+```bash
+# ECDSA key passed directly (hex, 0x prefix optional)
+./bin/kms-client --avs-address "0x1234..." --operator-set-id 0 \
+  decrypt --app-id "my-application" --encrypted-data encrypted-data.hex \
+  --attestation ecdsa --ecdsa-private-key 0xabc123...
+
+# ECDSA key read from a file
+./bin/kms-client --avs-address "0x1234..." --operator-set-id 0 \
+  decrypt --app-id "my-application" --encrypted-data encrypted-data.hex \
+  --attestation ecdsa --ecdsa-private-key-file ./app-key.hex
+```
+
+Decrypt flags:
+
+- `--attestation`: attestation method. Empty (default) uses the
+  unauthenticated `/app/sign` endpoint; `ecdsa` uses ECDSA challenge-response
+  attestation against `/secrets`.
+- `--ecdsa-private-key`: hex-encoded secp256k1 private key (an optional `0x`
+  prefix is accepted). Takes priority over `--ecdsa-private-key-file`.
+- `--ecdsa-private-key-file`: path to a file containing the hex-encoded key.
+  Used when `--ecdsa-private-key` is not set.
+
+When `--attestation ecdsa` is set, at least one of `--ecdsa-private-key` or
+`--ecdsa-private-key-file` is required.
+
+**Prerequisites for the attested path** (stricter than the default
+`/app/sign` flow):
+
+- Operators must run with ECDSA attestation enabled
+  (`--enable-ecdsa-attestation=true`).
+- The app must exist on-chain so the operator can look up its creator. For ECDSA
+  specifically, a published release is **not** required (env is returned only if
+  a release exists); the signing key must belong to the app's creator.
+
+**Security caveat:** ECDSA attestation proves only ownership of the ECDSA
+private key and the freshness of the challenge. It does **not** prove a TEE
+execution environment. The operator binds the ECDSA signer to the app's on-chain
+**creator**: the `--ecdsa-private-key` / `--ecdsa-private-key-file` you supply
+MUST be the key of the EOA that deployed/created the app, or the request is
+rejected with `ecdsa signer is not the app creator`. The attested ECDSA path
+does not require an on-chain release; it returns the app's environment only if a
+release exists, and otherwise returns empty env alongside the recovered key.
+Use ECDSA attestation for development and for operators configured to require
+it — not as a production confidentiality guarantee. For production, use a TEE
+attestation method (GCP Confidential Space / Intel Trust Authority).
+
 ## How It Works
 
 ### CLI Tool (This Binary)
 
 1. **Operator Discovery**: Queries the blockchain using AVS address and operator set ID to get operators
 2. **Master Public Key**: Queries `/pubkey` endpoint from all operators and computes master public key
 3. **Encryption**: Uses IBE where app public key = `H_1(app_id)`
-4. **Decryption**: Collects partial signatures from `/app/sign` endpoint (no attestation required)
+4. **Decryption**: Collects partial signatures from the `/app/sign` endpoint (no attestation) by default, or from the attested `/secrets` endpoint when `--attestation ecdsa` is set
 5. **Fault Tolerance**: Handles operator failures automatically
 
-**Note**: The CLI decrypt command uses `/app/sign` which does NOT require attestation.
+**Note**: By default the CLI decrypt command uses `/app/sign`, which does NOT require attestation. Pass `--attestation ecdsa` to use the attested `/secrets` endpoint instead.
 
 ### Library (pkg/clients/kmsClient)
 
@@ -110,8 +162,35 @@ See `examples/ecdsa_attestation.go` for complete implementation.
 
 ## Global Options
 
+- `--environment`, `-e`: named connection preset that fills `--avs-address` and `--operator-set-id` (e.g. `sepolia`). Explicit flags override the preset. The RPC URL is never part of a preset.
 - `--rpc-url`: Ethereum RPC endpoint (default: http://localhost:8545)
-- `--avs-address`: AVS contract address (required)
+- `--avs-address`: AVS contract address (required unless provided by `--environment`)
 - `--operator-set-id`: Operator set ID to use (default: 0)
 
-All commands automatically discover and interact with the current operator set from the blockchain.
+All commands automatically discover and interact with the current operator set from the blockchain.
+
+### Environments
+
+`--environment` (alias `-e`) selects a named connection preset so you don't have
+to pass `--avs-address`/`--operator-set-id` on every call:
+
+| Environment | avs-address | operator-set-id |
+|-------------|-------------|-----------------|
+| `sepolia`   | `0x47c9806e7DC4e6fE9a0a2399831F32d06DaE5730` | `0` |
+
+The preset supplies only `--avs-address` and `--operator-set-id`. It does **not**
+set `--rpc-url` — production RPC URLs embed API-key credentials, so you must
+still pass your own `--rpc-url`. Any flag you pass explicitly overrides the
+preset value.
+
+```bash
+# Use the sepolia preset; supply your own RPC URL
+./bin/kms-client --environment sepolia \
+  --rpc-url "https://eth-sepolia.example/v2/<key>" \
+  get-pubkey --app-id "my-application"
+
+# Override the preset's operator-set-id
+./bin/kms-client -e sepolia --operator-set-id 1 \
+  --rpc-url "https://eth-sepolia.example/v2/<key>" \
+  get-pubkey --app-id "my-application"
+```
@@ -0,0 +1,81 @@
+package main
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+)
+
+// environment holds the non-secret connection defaults for a named network.
+// The RPC URL is intentionally excluded — production RPC URLs embed API-key
+// credentials and must not be committed. Users still supply --rpc-url.
+type environment struct {
+	AVSAddress    string
+	OperatorSetID uint32
+}
+
+// environments is the registry of known connection presets, selected via
+// --environment. Values are sourced from the operator deployment charts.
+var environments = map[string]environment{
+	"sepolia": {
+		AVSAddress:    "0x47c9806e7DC4e6fE9a0a2399831F32d06DaE5730",
+		OperatorSetID: 0,
+	},
+}
+
+// supportedEnvironmentsString returns the known environment names as a sorted,
+// comma-separated string for error and usage messages.
+func supportedEnvironmentsString() string {
+	names := make([]string, 0, len(environments))
+	for name := range environments {
+		names = append(names, name)
+	}
+	sort.Strings(names)
+	return strings.Join(names, ", ")
+}
+
+// resolveConnection determines the effective AVS address and operator-set id
+// from the --environment preset and any explicitly-set flags. Explicitly-set
+// flags always win over the preset; the preset wins over the built-in default.
+// avsSet/setIDSet report whether the corresponding flag was passed on the
+// command line (cli.Context.IsSet).
+//
+// Resolution:
+//   - avs-address: explicit flag → preset → else error.
+//   - operator-set-id: explicit flag → preset → else 0.
+func resolveConnection(envName, avsFlag string, avsSet bool, setIDFlag uint32, setIDSet bool) (string, uint32, error) {
+	var preset environment
+	havePreset := false
+	if envName != "" {
+		p, ok := environments[envName]
+		if !ok {
+			return "", 0, fmt.Errorf("unknown environment %q: supported environments are: %s", envName, supportedEnvironmentsString())
+		}
+		preset = p
+		havePreset = true
+	}
+
+	// Resolve AVS address: explicit flag wins, then preset, else error.
+	avsAddress := ""
+	switch {
+	case avsSet:
+		avsAddress = avsFlag
+	case havePreset:
+		avsAddress = preset.AVSAddress
+	default:
+		return "", 0, fmt.Errorf("avs-address is required (provide --avs-address or --environment)")
+	}
+
+	// Resolve operator-set id: explicit flag wins, then preset, else 0.
+	var operatorSetID uint32
+	switch {
+	case setIDSet:
+		operatorSetID = setIDFlag
+	case havePreset:
+		operatorSetID = preset.OperatorSetID
+	default:
+		operatorSetID = 0
+	}
+
+	return avsAddress, operatorSetID, nil
+}
@@ -0,0 +1,65 @@
+package main
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestResolveConnection(t *testing.T) {
+	const sepoliaAVS = "0x47c9806e7DC4e6fE9a0a2399831F32d06DaE5730"
+
+	t.Run("environment preset fills avs and operator-set-id", func(t *testing.T) {
+		avs, setID, err := resolveConnection("sepolia", "", false, 0, false)
+		require.NoError(t, err)
+		require.Equal(t, sepoliaAVS, avs)
+		require.Equal(t, uint32(0), setID)
+	})
+
+	t.Run("explicit avs-address overrides preset", func(t *testing.T) {
+		avs, setID, err := resolveConnection("sepolia", "0xABC", true, 0, false)
+		require.NoError(t, err)
+		require.Equal(t, "0xABC", avs)
+		require.Equal(t, uint32(0), setID)
+	})
+
+	t.Run("explicit operator-set-id overrides preset", func(t *testing.T) {
+		avs, setID, err := resolveConnection("sepolia", "", false, 2, true)
+		require.NoError(t, err)
+		require.Equal(t, sepoliaAVS, avs)
+		require.Equal(t, uint32(2), setID)
+	})
+
+	t.Run("no environment, explicit avs is used", func(t *testing.T) {
+		avs, setID, err := resolveConnection("", "0xABC", true, 0, false)
+		require.NoError(t, err)
+		require.Equal(t, "0xABC", avs)
+		require.Equal(t, uint32(0), setID)
+	})
+
+	t.Run("no environment, explicit operator-set-id is used", func(t *testing.T) {
+		avs, setID, err := resolveConnection("", "0xABC", true, 5, true)
+		require.NoError(t, err)
+		require.Equal(t, "0xABC", avs)
+		require.Equal(t, uint32(5), setID)
+	})
+
+	t.Run("no environment and no avs is an error", func(t *testing.T) {
+		_, _, err := resolveConnection("", "", false, 0, false)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "avs-address is required")
+	})
+
+	t.Run("unknown environment is an error listing supported names", func(t *testing.T) {
+		_, _, err := resolveConnection("mainnet", "", false, 0, false)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "unknown environment")
+		require.Contains(t, err.Error(), "sepolia")
+	})
+}
+
+func TestSupportedEnvironmentsString(t *testing.T) {
+	got := supportedEnvironmentsString()
+	require.True(t, strings.Contains(got, "sepolia"), "should list sepolia, got %q", got)
+}