@ethernity-cloud/sdk-js 1.7.9 → 1.7.11

package/README.md

@@ -56,23 +56,29 @@ The sdk has been tested on the following operating systems:
     - Mainnet - to be provided during the following updates
 - LitVM:
     - LiteForge - CAS-attested the same way, by LitVM's own ethernity-cas
-      validator set (SessionRegistry `0x8ad24b3F...`, ValidatorRegistry
+      validator set (SessionRegistry `0xfA70B5Df...`, ValidatorRegistry
       `0xbE3759f3...`).
     - LiteForge Unsafe - the unsafe network beside LiteForge (see below).
+- Ethereum:
+    - Sepolia - CAS-attested the same way, by Sepolia's own ethernity-cas
+      validator set (SessionRegistry `0xDbB249E1...`, ValidatorRegistry
+      `0x8ad24b3F...`), on the PoX family of 2026-10-14.
+    - Sepolia Unsafe - the unsafe network beside Sepolia (see below).
 - Polyhon:
     - Amoy Testnet - to be provided during the following updates
     - Mainnet - to be provided during the following updates
 
-The remaining testnets (Amoy, IoTeX, Sepolia) have no ethernity-cas
+The remaining testnets (Amoy, IoTeX) have no ethernity-cas
 deployment: their enclaves are debug-signed and sign their own certificates
 from their measurement, and `ecld-publish` registers no CAS session for them.
 
 ### The testnets and their unsafe networks
-`Bloxberg Testnet` and `LitVM LiteForge` run your securelock in an enclave
+`Bloxberg Testnet`, `LitVM LiteForge` and `Ethereum Sepolia` run your securelock in an enclave
 attested through that chain's ethernity-cas validator set, on nodes whose
 platform the CAS can attest (DCAP). Each has an unsafe network beside it,
-`Bloxberg Testnet Unsafe` (`Bloxberg_Testnet_Unsafe`) and `LitVM LiteForge
-Unsafe` (`LitVM_LiteForge_Unsafe`): the same chain and contracts, for hardware
+`Bloxberg Testnet Unsafe` (`Bloxberg_Testnet_Unsafe`), `LitVM LiteForge
+Unsafe` (`LitVM_LiteForge_Unsafe`) and `Ethereum Sepolia Unsafe`
+(`Ethereum_Sepolia_Unsafe`): the same chain and contracts, for hardware
 SGX platforms the CAS cannot attest (EPID-only, SGX1). No CAS and no LAS: the
 enclaves are debug-signed and sign their own certificates from their
 measurement, so a result proves which image ran but not that an enclave ran
@@ -82,7 +88,8 @@ always says so in the network it names. A dApp publishes one securelock per
 network from two project directories with the same project name: the unsafe
 one is registered as `<project>-unsafe` and runs on the
 `etny-<nodenithy|pynithy>-testnet-unsafe`
-(`ecld-<nodenithy|pynithy>-litvm-testnet-unsafe`) trustedzone. Both dApp types
+(`ecld-<nodenithy|pynithy>-litvm-testnet-unsafe`,
+`ecld-<nodenithy|pynithy>-ethereum-sepolia-unsafe`) trustedzone. Both dApp types
 build for both networks. Mainnet has no unsafe network.
 
 ### Pynithy dApps
@@ -120,11 +127,14 @@ sets the enclave heap (default `1024M`).
   unless `REWARD_ADDRESS` names another one; the image's owner can change it
   later with the registry's `changeImageRewardAddress`.
 
-  How the image reaches the network: unless `.env` names an IPFS API of your
-  own (`IPFS_ENDPOINT` other than the public `ipfs.ethernity.cloud`), the
-  publish runs its own IPFS node in docker (`ipfs/kubo`), adds the image and
-  its compose there and peers it with the network's bootnode, which pins
-  every registered image. On a network whose image registry records images
+  How the image reaches the network: leave `IPFS_ENDPOINT` in `.env` empty
+  unless it names an IPFS API of your own (`IPFS_TOKEN` is the Authorization
+  header value that API takes, when it takes one); the public API
+  `ipfs.ethernity.cloud` takes no adds or pins without a writer token. With
+  no API of your own the publish runs its own IPFS node in docker
+  (`ipfs/kubo`), adds the image and its compose there and peers it with the
+  network's bootnode, which pins every registered image. On a network whose
+  image registry records images
   before their certificate (the bloxberg testnet), the publish registers the
   image from your wallet first (`registerImage`, with your node's address),
   has the certificate extracted (on your SGX host, or by
@@ -160,13 +170,22 @@ sets the enclave heap (default `1024M`).
   npx ecld-run --unsafe 'hello("World")'
   ```
   This is the network-side sibling of `ecld-test`: instead of executing locally
-  it drives the runner end to end — encrypt → IPFS → on-chain request → wait for
-  a node → download and decrypt the result. It **costs gas and needs a funded
-  key**. Network and enclaves come from `.env` (`BLOCKCHAIN_NETWORK`,
-  `PROJECT_NAME`, `TRUSTED_ZONE_IMAGE`), overridable with
+  it drives the runner end to end — encrypt → on-chain request → payload intake
+  (or the IPFS API named with `--ipfs <url>`) → wait for a node → download and
+  decrypt the result. It **costs gas and needs a funded key**. Network and
+  enclaves come from `.env` (`BLOCKCHAIN_NETWORK`, `PROJECT_NAME`,
+  `TRUSTED_ZONE_IMAGE`), overridable with
   `--network`/`--securelock`/`--trustedzone`; the signing key is `PRIVATE_KEY`
   (or `ECLD_PRIVATE_KEY`) — a funded `0x` key that pays for the order. Resources
   are tunable with `--task-price`/`--cpu`/`--memory`/`--storage`/`--bandwidth`/`--duration`/`--validators`.
+  `--ipfs intake` (the default) delivers the payload to the bootnode's payload
+  intake once the request is on chain; `--ipfs <url>` writes and reads through
+  that IPFS RPC API instead, with `ECLD_IPFS_TOKEN` (or `IPFS_TOKEN`) as its
+  Authorization header, and a URL naming the public API is refused without one.
+  The intake serves the networks the bootnode's agent runs, today the bloxberg
+  testnet, LitVM LiteForge and Ethereum Sepolia, each with its unsafe twin: a dApp on any other
+  network (Bloxberg mainnet, Polygon, IoTeX) needs an IPFS API of its
+  own (`IPFS_ENDPOINT` for the Hello World template, `--ipfs <url>` for `ecld-run`).
   Exit code 0 on a `SUCCESS` task result, 1 otherwise. `--unsafe` runs the
   network's unsafe variant; on an unsafe network the securelock and
   trustedzone default to their `-unsafe` names.
@@ -214,13 +233,17 @@ function hello(msg='World') {
 
 module.exports = { hello };
 ```
-From your frontend application, using the ethernity cloud runner library (`@ethernity-cloud/runner`, installed by `ecld-init` at the version this SDK depends on), you will be calling the function as seen in the below example, where we pass `hello("World");` to be executed on the backend which will run in the Blockchain. `npm start` runs `src/preStart.mjs` first, which fills the constants at the top from the project's `.env`: the securelock name the dApp is published as, the trustedzone it was built against, the network's token address and chain id, the `-unsafe` network when the dApp runs without a CAS, and the IPFS endpoint.
+From your frontend application, using the ethernity cloud runner library (`@ethernity-cloud/runner`, installed by `ecld-init` at the version this SDK depends on), you will be calling the function as seen in the below example, where we pass `hello("World");` to be executed on the backend which will run in the Blockchain. `npm start` runs `src/preStart.mjs` first, which fills the constants at the top from the project's `.env`: the securelock name the dApp is published as, the trustedzone it was built against, the network's token address and chain id, the `-unsafe` network when the dApp runs without a CAS, and the IPFS API of the dApp's own (empty when the task's artefacts go through the bootnode's payload intake).
 ```js
 import './App.css';
 import EthernityCloudRunner from "@ethernity-cloud/runner";
 import { ECStatus } from "@ethernity-cloud/runner/enums";
 
-// Filled in from the project's .env by src/preStart.mjs on `npm start`.
+// Filled in from the project's .env by src/preStart.mjs on `npm start`: the
+// securelock this dApp is published as, the trustedzone it was built against,
+// the network's token address and chain id, the -unsafe network when the dApp
+// runs without a CAS (null otherwise), and the IPFS API of the dApp's own ('' when
+// the task's artefacts go through the bootnode's payload intake).
 const PROJECT_NAME = "";
 const TRUSTED_ZONE_IMAGE = "";
 const NETWORK_ADDRESS = "";
@@ -238,7 +261,10 @@ function App() {
         if (UNSAFE_NETWORK) {
             await runner.setNetwork(...UNSAFE_NETWORK);
         }
-        runner.initializeStorage(IPFS_ENDPOINT);
+        // An IPFS API of the dApp's own (IPFS_ENDPOINT) carries the task's
+        // artefacts; without one they go through the bootnode's payload intake.
+        if (IPFS_ENDPOINT) runner.initializeStorage(IPFS_ENDPOINT);
+        else runner.initializePublicIntake();
 
         // Events are named by task status; detail is { message, status, progress }.
         runner.addEventListener(ECStatus.DEFAULT, (e) => {
@@ -250,6 +276,7 @@ function App() {
         runner.addEventListener(ECStatus.SUCCESS, async () => {
             const result = await runner.getResult();
             console.log(`Task Result: ${result}`);
+            // display the result in page below the buttons
             const line = document.createElement("p");
             line.textContent = `Task Result: ${result}`;
             document.body.appendChild(line);

package/cas/config.js

@@ -18,21 +18,29 @@ const VALIDATOR_REGISTRY = {
   'etny-nodenithy-testnet': '0x0014aB102FEa6b02e3D793FF4b9a0Af309fB4E14',
   'ecld-pynithy-litvm-testnet': '0xbE3759f327e8643fC5A1717fb2072A0dAcBAD29E',
   'ecld-nodenithy-litvm-testnet': '0xbE3759f327e8643fC5A1717fb2072A0dAcBAD29E',
+  'ecld-pynithy-ethereum-sepolia': '0x8ad24b3F406A41a0F8D3440021792EB203957F43',
+  'ecld-nodenithy-ethereum-sepolia': '0x8ad24b3F406A41a0F8D3440021792EB203957F43',
 };
 
 const SESSION_REGISTRY = {
   'etny-pynithy-testnet': '0x444429681fCb26470Cb12B5436E48402cF7478A3',
   'etny-nodenithy-testnet': '0x444429681fCb26470Cb12B5436E48402cF7478A3',
-  'ecld-pynithy-litvm-testnet': '0x8ad24b3F406A41a0F8D3440021792EB203957F43',
-  'ecld-nodenithy-litvm-testnet': '0x8ad24b3F406A41a0F8D3440021792EB203957F43',
+  'ecld-pynithy-litvm-testnet': '0xfA70B5Df7C773A21164cAc5413704117e4dEaB76',
+  'ecld-nodenithy-litvm-testnet': '0xfA70B5Df7C773A21164cAc5413704117e4dEaB76',
+  // Bound to Sepolia's ECImageRegistryV3 of 2026-10-14.
+  'ecld-pynithy-ethereum-sepolia': '0xDbB249E108d19fC1691483Bf897bA8BA0dA99c06',
+  'ecld-nodenithy-ethereum-sepolia': '0xDbB249E108d19fC1691483Bf897bA8BA0dA99c06',
 };
 
-// The chain the registries above live on.
+// The chain the registries above live on. Sepolia's RPC is Tenderly's gateway:
+// publicnode caps eth_getLogs at 50,000 blocks and prunes older ranges.
 const CHAIN = {
   'etny-pynithy-testnet': { rpcUrl: 'https://bloxberg.ethernity.cloud', chainId: 8995 },
   'etny-nodenithy-testnet': { rpcUrl: 'https://bloxberg.ethernity.cloud', chainId: 8995 },
   'ecld-pynithy-litvm-testnet': { rpcUrl: 'https://liteforge.rpc.caldera.xyz/infra-partner-http', chainId: 4441 },
   'ecld-nodenithy-litvm-testnet': { rpcUrl: 'https://liteforge.rpc.caldera.xyz/infra-partner-http', chainId: 4441 },
+  'ecld-pynithy-ethereum-sepolia': { rpcUrl: 'https://sepolia.gateway.tenderly.co', chainId: 11155111 },
+  'ecld-nodenithy-ethereum-sepolia': { rpcUrl: 'https://sepolia.gateway.tenderly.co', chainId: 11155111 },
 };
 
 // Whether the securelock takes its certificate from a CAS session: mainnet
@@ -55,6 +63,7 @@ const isMainnetNetwork = (network) =>
 const UNSAFE_NETWORKS = {
   Bloxberg_Testnet_Unsafe: 'Bloxberg_Testnet',
   LitVM_LiteForge_Unsafe: 'LitVM_LiteForge',
+  Ethereum_Sepolia_Unsafe: 'Ethereum_Sepolia',
 };
 
 // Case-insensitive: ecld-init writes Bloxberg_Testnet_Unsafe, a --network

package/cas/session_registry.js

@@ -74,11 +74,13 @@ function sessionHash(body) {
   return '0x' + crypto.createHash('sha256').update(body).digest('hex');
 }
 
-// Pin the exact bytes as CIDv1/raw/sha2-256 and return the CID.
-async function pinBody(ipfsApiUrl, body) {
+// Pin the exact bytes as CIDv1/raw/sha2-256 and return the CID. `token` is
+// the API's Authorization header value (IPFS_TOKEN), sent when set.
+async function pinBody(ipfsApiUrl, body, token = '') {
   const form = new FormData();
   form.append('file', new Blob([body]), 'session');
-  const r = await axios.post(`${ipfsApiUrl}/api/v0/add?cid-version=1&raw-leaves=true&pin=true`, form, { timeout: 60000 });
+  const headers = token ? { Authorization: token } : {};
+  const r = await axios.post(`${ipfsApiUrl}/api/v0/add?cid-version=1&raw-leaves=true&pin=true`, form, { headers, timeout: 60000 });
   return r.data.Hash;
 }
 
@@ -120,16 +122,17 @@ async function send(reg, chainId, refused, method, ...args) {
   if (rcpt.status !== 1) throw new Error(`SessionRegistry.${method} reverted for ${refused} (tx ${tx.hash})`);
 }
 
-// Pin `body` and register it under its own `name:`. Returns
+// Pin `body` through `ipfsApiUrl` (with `ipfsToken` as its Authorization
+// header when set) and register it under its own `name:`. Returns
 // {name, hash, cid, registered}: `registered` is false when the chain already
 // held these exact bytes as the name's latest version, registered by this
 // wallet.
-async function register(rpcUrl, chainId, registryAddress, key, body, ipfsApiUrl, imageCid = '') {
+async function register(rpcUrl, chainId, registryAddress, key, body, ipfsApiUrl, imageCid = '', ipfsToken = '') {
   const { name, rules } = parseNameAndRules(body.toString('utf8'));
   if (!name) throw new Error('the session body has no `name:`');
   const hash = sessionHash(body);
   const reg = contract(rpcUrl, registryAddress, key);
-  const cid = await pinBody(ipfsApiUrl, body);
+  const cid = await pinBody(ipfsApiUrl, body, ipfsToken);
   const latest = await latestRecord(reg, name);
   if (latest && latest.hash === hash && latest.creator.toLowerCase() === (await reg.signer.getAddress()).toLowerCase()) {
     return { name, hash, cid, registered: false };

package/info.js

@@ -51,10 +51,18 @@ const NETWORKS = {
   },
   LITVM_LITEFORGE: {
     type: 'testnet', chainId: 4441, rpc: 'https://liteforge.rpc.caldera.xyz/infra-partner-http',
-    protocol: '0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2',
-    imageRegistry: '0x55e0ad455Be85162b71a790f00Fc305680E3CE53',
+    protocol: '0xE35991de1f2A435e29E70406FA2781b1AffCb168',
+    imageRegistry: '0xAf8Ce29103E1f59feDD49688ff070Ffc2346AF1D',
     esr: '0x709052Fe77Af543d3d9FE2Ac06a15c635c8D4Be5',
   },
+  // The family of 2026-10-14, owned by 0xA247...; the previous PoX 0x29D3eC87...
+  // and V1 registry 0x55e0ad45... are abandoned.
+  ETHEREUM_SEPOLIA: {
+    type: 'testnet', chainId: 11155111, rpc: 'https://sepolia.gateway.tenderly.co',
+    protocol: '0x798975F9FdD90A21Cb11Ac26F1377e1542c58f9c',
+    imageRegistry: '0xa7E43a269E3307cf9d246b07df2B89CAA1b4C42F',
+    esr: '0x9927809B61122B2af3f3b3A3303875e0687b8eE3',
+  },
 };
 // The -unsafe networks: the chain and contracts of the network each is the
 // unsafe variant of, without a CAS.

package/init.js

@@ -4,10 +4,8 @@ const { spawn, execSync } = require("child_process");
 const path = require("path");
 const casConfig = require("./cas/config.js");
 
-const rl = readline.createInterface({
-  input: process.stdin,
-  output: process.stdout,
-});
+// The prompt, opened by main.
+let rl = null;
 
 const writeEnv = (key, value) => {
   const envFile = ".env";
@@ -36,6 +34,23 @@ const writeEnv = (key, value) => {
 // name does not contain "SECURELOCK".
 const PROJECT_NAME_RULE = /^(?!.*SECURELOCK)[0-9A-Za-z._-]{1,121}$/;
 
+// Where the publish adds the image and the dApp delivers its task artefacts.
+// The first choice has the publish run its own IPFS node and the dApp use the
+// bootnode's payload intake (IPFS_ENDPOINT empty); the second names an IPFS
+// (Kubo) RPC API of the dApp's own, with the Authorization header value it
+// takes. The public API, ipfs.ethernity.cloud, takes no adds or pins without
+// a writer token.
+const IPFS_OPTIONS = [
+  "the publish's own IPFS node in docker (default)",
+  "an IPFS (Kubo) RPC API of your own (URL, optional Authorization token)",
+];
+
+// The .env values (IPFS_ENDPOINT, IPFS_TOKEN) of an IPFS_OPTIONS choice.
+const ipfsSettings = (choice, url, token) =>
+  choice === IPFS_OPTIONS[1]
+    ? { IPFS_ENDPOINT: String(url || "").trim(), IPFS_TOKEN: String(token || "").trim() }
+    : { IPFS_ENDPOINT: "", IPFS_TOKEN: "" };
+
 const getProjectName = () => {
   return new Promise((resolve) => {
     const askProjectName = () => {
@@ -159,6 +174,10 @@ const printIntro = () => {
 };
 
 const main = async () => {
+  rl = readline.createInterface({
+    input: process.stdin,
+    output: process.stdout,
+  });
   printIntro();
   const projectName = await getProjectName();
   console.log();
@@ -195,6 +214,7 @@ const main = async () => {
     "LitVM LiteForge",
     "Bloxberg Testnet Unsafe",
     "LitVM LiteForge Unsafe",
+    "Ethereum Sepolia Unsafe",
   ];
   const blockchainNetwork = await promptOptions(
     "On which Blockchain network do you want to have the app set up, as a starting point? (default is Bloxberg Testnet): ",
@@ -256,30 +276,28 @@ const main = async () => {
   // });
 
   console.log();
-  const ipfsServiceOptions = ["Ethernity (best effort)", "Custom IPFS"];
   const ipfsService = await promptOptions(
-    "Select the IPFS pinning service you want to use (default is Ethernity): ",
-    ipfsServiceOptions,
-    "Ethernity (best effort)",
+    "Which IPFS API do the publish and the dApp write through? (default is 1): ",
+    IPFS_OPTIONS,
+    IPFS_OPTIONS[0],
   );
 
-  let customUrl, ipfsToken;
-  if (ipfsService === "Custom IPFS") {
-    customUrl = await new Promise((resolve) =>
+  let ipfsUrl, ipfsToken;
+  if (ipfsService === IPFS_OPTIONS[1]) {
+    ipfsUrl = await new Promise((resolve) =>
       rl.question(
-        "Enter the endpoint URL for the IPFS pinning service you want to use: ",
+        "Enter the URL of the IPFS RPC API (e.g. http://127.0.0.1:5001): ",
         resolve,
       ),
     );
     ipfsToken = await new Promise((resolve) =>
       rl.question(
-        "Enter the access token to be used when calling the IPFS pinning service: ",
+        "Enter its Authorization header value (empty for none): ",
         resolve,
       ),
     );
-  } else {
-    customUrl = "https://ipfs.ethernity.cloud";
   }
+  const ipfs = ipfsSettings(ipfsService, ipfsUrl, ipfsToken);
 
   fs.mkdirSync("src/serverless", { recursive: true });
 
@@ -373,16 +391,17 @@ const main = async () => {
     "LitVM LiteForge": `ecld-${svc}-litvm-testnet`,
     "Bloxberg Testnet Unsafe": `etny-${svc}-testnet-unsafe`,
     "LitVM LiteForge Unsafe": `ecld-${svc}-litvm-testnet-unsafe`,
+    "Ethereum Sepolia Unsafe": `ecld-${svc}-ethereum-sepolia-unsafe`,
   };
   const trustedZoneImage = imageByNetwork[blockchainNetwork] || `etny-${svc}-testnet`;
   writeEnv("TRUSTED_ZONE_IMAGE", trustedZoneImage);
 
 
   writeEnv("BLOCKCHAIN_NETWORK", network);
-  writeEnv("IPFS_ENDPOINT", customUrl);
+  writeEnv("IPFS_ENDPOINT", ipfs.IPFS_ENDPOINT);
+  writeEnv("IPFS_TOKEN", ipfs.IPFS_TOKEN);
   console.log();
   await configureEsr();
-  writeEnv("IPFS_TOKEN", ipfsToken || "");
   writeEnv("VERSION", "v1");
   console.log();
   console.log(
@@ -391,4 +410,6 @@ const main = async () => {
   rl.close();
 };
 
-main();
+if (require.main === module) main();
+
+module.exports = { IPFS_OPTIONS, ipfsSettings, writeEnv };

package/localKubo.js

@@ -1,15 +1,15 @@
 // The Kubo a publish runs for its own upload.
 //
 // An image is published by adding it to IPFS and registering its CID. The
-// public write API of ipfs.ethernity.cloud is closing, so a publish without an
-// IPFS endpoint of its own runs a Kubo in docker (the SDK already requires
-// docker), adds the image through that Kubo's HTTP API with the same call the
-// public API received (so a build gives the same CIDs as before), peers the
-// Kubo with the bootnode, whose mirror pins every registered image and from
-// which the certificate extraction service fetches, and stops it once the
-// certificate is on chain. The Kubo listens for the API on the loopback
-// interface only; its swarm port is published when free, so a publisher with
-// a reachable address is also dialed directly.
+// public API of ipfs.ethernity.cloud takes no adds or pins without a writer
+// token, so a publish without an IPFS endpoint of its own runs a Kubo in
+// docker (the SDK already requires docker), adds the image through that Kubo's
+// HTTP API with the same add call (so a build gives the same CIDs on every
+// node), peers the Kubo with the bootnode, whose mirror pins every registered
+// image and from which the certificate extraction service fetches, and stops
+// it once the certificate is on chain. The Kubo listens for the API on the
+// loopback interface only; its swarm port is published when free, so a
+// publisher with a reachable address is also dialed directly.
 const { execFileSync } = require('child_process');
 const net = require('net');
 const axios = require('axios');
@@ -65,6 +65,14 @@ function ownEndpoint(endpoint) {
     }
 }
 
+// The IPFS_ENDPOINT a dApp's template is built with (src/preStart.mjs): the
+// setting when it is an endpoint of the application's own, '' otherwise, on
+// which the dApp delivers its task artefacts through the bootnode's payload
+// intake.
+function dappEndpoint(endpoint) {
+    return ownEndpoint(endpoint) ? endpoint : '';
+}
+
 class LocalKubo {
     constructor(name) {
         this.container = `ecld-kubo-${String(name || 'publish').replace(/[^A-Za-z0-9_.-]/g, '-')}`;
@@ -202,4 +210,4 @@ class LocalKubo {
     }
 }
 
-module.exports = { LocalKubo, ownEndpoint, apiPortIn, PUBLIC_IPFS_HOST };
+module.exports = { LocalKubo, ownEndpoint, dappEndpoint, apiPortIn, PUBLIC_IPFS_HOST };

package/network.js

@@ -31,6 +31,7 @@ function networkFor({ ECAddress, ECNetworkByChainId }, raw) {
     IOTEX_TESTNET: { address: ECAddress.IOTEX.TESTNET_ADDRESS, chainId: ECNetworkByChainId.IOTEX.TESTNET },
     ETHEREUM_SEPOLIA: sepolia,
     SEPOLIA: sepolia,
+    ETHEREUM_SEPOLIA_UNSAFE: { ...sepolia, unsafe: ['SEPOLIA', 'TESTNET_UNSAFE'] },
     LITVM_LITEFORGE: litvm,
     LITVM: litvm,
     LITVM_LITEFORGE_UNSAFE: { ...litvm, unsafe: ['LITVM', 'TESTNET_UNSAFE'] },

package/nodenithy/build.mjs

@@ -48,14 +48,14 @@ export const ECRunner = {
   // --- ethereum sepolia ---
   'ecld-pynithy-ethereum-sepolia': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://ethereum-sepolia-rpc.publicnode.com', 11155111],
   'ecld-nodenithy-ethereum-sepolia': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://ethereum-sepolia-rpc.publicnode.com', 11155111],
-  // --- litvm liteforge testnet (shares sepolia contracts; distinct chain/RPC) ---
-  'ecld-pynithy-litvm-testnet': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
-  'ecld-nodenithy-litvm-testnet': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
+  // --- litvm liteforge testnet: the PoX is the EthernityImplementationV2 1.1 of 2026-10-11; the image registry is the ECImageRegistryV3 of 2026-10-12 ---
+  'ecld-pynithy-litvm-testnet': ['0xE35991de1f2A435e29E70406FA2781b1AffCb168', '0xAf8Ce29103E1f59feDD49688ff070Ffc2346AF1D', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
+  'ecld-nodenithy-litvm-testnet': ['0xE35991de1f2A435e29E70406FA2781b1AffCb168', '0xAf8Ce29103E1f59feDD49688ff070Ffc2346AF1D', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
   // --- the -unsafe networks: the contracts of the network each is named after ---
   'etny-pynithy-testnet-unsafe': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0xa372a6e1Eb7Fcf343AF6b91E809b900C55001CD1', 'https://bloxberg.ethernity.cloud', 8995],
   'etny-nodenithy-testnet-unsafe': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0xa372a6e1Eb7Fcf343AF6b91E809b900C55001CD1', 'https://bloxberg.ethernity.cloud', 8995],
-  'ecld-pynithy-litvm-testnet-unsafe': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
-  'ecld-nodenithy-litvm-testnet-unsafe': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441]
+  'ecld-pynithy-litvm-testnet-unsafe': ['0xE35991de1f2A435e29E70406FA2781b1AffCb168', '0xAf8Ce29103E1f59feDD49688ff070Ffc2346AF1D', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
+  'ecld-nodenithy-litvm-testnet-unsafe': ['0xE35991de1f2A435e29E70406FA2781b1AffCb168', '0xAf8Ce29103E1f59feDD49688ff070Ffc2346AF1D', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441]
 };
 
 // ethernity-cas ValidatorRegistry per template, baked into the enclave so it

package/nodenithy/ipfs.mjs

@@ -1,6 +1,10 @@
 // ipfs.mjs
 //
-// IPFS client for the Ethernity Cloud JS SDK.
+// IPFS client of the publish (nodenithy/run.js, pynithy/run.js): adds, hashes
+// and reads through the IPFS API named with --host, the publish's own Kubo
+// (http://127.0.0.1:<port>) or an IPFS API of the dApp's own; --token, or
+// IPFS_TOKEN in the environment when the flag is absent, is the Authorization
+// header value that API takes, when it takes one.
 //
 // The UPLOAD path is a faithful port of the Python SDK's IPFSClient
 // (ethernity_cloud_sdk_py/commands/pynithy/ipfs_client.py): it posts directly
@@ -12,7 +16,7 @@
 // the Python pipeline step-for-step so both SDKs upload identically (e.g. for
 // the certex / public-key extraction flow).
 //
-// The DOWNLOAD path keeps the existing kubo-rpc-client based helpers.
+// The DOWNLOAD path uses kubo-rpc-client, with the same Authorization header.
 import http from 'http';
 import https from 'https';
 import { URL } from 'url';
@@ -31,29 +35,33 @@ const getRetryDelay = (retryCount, baseDelay = 1) => baseDelay * 2 ** retryCount
 const RETRY_COUNT = 10; // mirrors Python ipfs_client.RETRY_COUNT
 
 // Endpoint + auth, mirroring the Python IPFSClient constructor.
-//   apiUrl : e.g. "https://ipfs.ethernity.cloud"
-//   addUrl : `${apiUrl}/api/v0/add`
+//   apiUrl     : the API's base URL, e.g. "http://127.0.0.1:5001"; adds go to
+//                `${apiUrl}/api/v0/add`
+//   authHeader : the Authorization header value (--token), or null
 let apiUrl = null;
-let authHeader = null; // Authorization header value, or null
+let authHeader = null;
 
 // kubo-rpc-client instance, used only for the download helpers below.
 let ipfs = null;
 
 const initialize = (host, protocol, port, token) => {
+  authHeader = token && token !== '' ? token : null;
   // Normalise the endpoint to a base URL string, matching how the Python client
   // treats `ipfs_endpoint` (it just prepends it to `/api/v0/add`).
+  let opts;
   if (host && host.search('http') !== -1) {
-    apiUrl = host.replace(/\/+$/, '');
-    ipfs = create(host);
+    // The API's base URL: a trailing /api/v0 is dropped, since addUrl appends it.
+    apiUrl = host.replace(/\/+$/, '').replace(/\/api\/v0$/, '');
+    opts = { url: apiUrl };
   } else {
     const proto = protocol || 'http';
     const p = port ? `:${port}` : '';
     apiUrl = `${proto}://${host}${p}`.replace(/\/+$/, '');
-    const opts = { host, protocol: proto, port };
-    if (token) opts.headers = { authorization: token };
-    ipfs = create(opts);
+    opts = { host, protocol: proto, port };
   }
-  authHeader = token && token !== '' ? token : null;
+  // The reads send the same Authorization header as the adds.
+  if (authHeader) opts.headers = { authorization: authHeader };
+  ipfs = create(opts);
 };
 
 // ---------------------------------------------------------------------------
@@ -336,8 +344,48 @@ const hashForIPFS = async (p) => {
   return null;
 };
 
+// Pin `cid` on the API (`pin/add`), which fetches the blocks it does not hold
+// from the peers that provide them and answers once the pin is complete.
+// Resolves true when the API names the CID among its pins.
+const pinOnIPFS = (cid, timeoutMs = 3600000) =>
+  new Promise((resolve, reject) => {
+    const url = new URL(`${apiUrl}/api/v0/pin/add?arg=${encodeURIComponent(cid)}&recursive=true`);
+    const mod = url.protocol === 'https:' ? https : http;
+    const headers = { 'Content-Length': '0' };
+    if (authHeader) headers.Authorization = authHeader;
+    const req = mod.request(
+      {
+        method: 'POST',
+        hostname: url.hostname,
+        port: url.port || (url.protocol === 'https:' ? 443 : 80),
+        path: `${url.pathname}${url.search}`,
+        headers,
+        timeout: timeoutMs
+      },
+      (res) => {
+        let text = '';
+        res.setEncoding('utf8');
+        res.on('data', (chunk) => {
+          text += chunk;
+        });
+        res.on('end', () => {
+          if (res.statusCode !== 200) {
+            console.log(`Failed to pin ${cid} on ${apiUrl}: status ${res.statusCode}`);
+            console.log(text.slice(0, 300));
+            resolve(false);
+            return;
+          }
+          resolve(text.includes(cid));
+        });
+      }
+    );
+    req.on('timeout', () => req.destroy(new Error(`pin/add of ${cid} took longer than ${timeoutMs} ms`)));
+    req.on('error', reject);
+    req.end();
+  });
+
 // ---------------------------------------------------------------------------
-// Download helpers (kubo-rpc-client based; unchanged behaviour)
+// Download helpers (kubo-rpc-client, with the Authorization header of initialize())
 // ---------------------------------------------------------------------------
 
 const getFromIPFS = async (hhash, filePath, maxRetries = process.env.REACT_APP_IPFS_RETRIES || 5) => {
@@ -412,6 +460,7 @@ export {
   initialize,
   upload,
   hashForIPFS,
+  pinOnIPFS,
   uploadFileToIPFS,
   uploadFolderToIPFS,
   getFromIPFS,
@@ -424,12 +473,12 @@ export {
 // ---------------------------------------------------------------------------
 
 program
-  .option('--host <host>', 'IPFS host')
+  .requiredOption('--host <host>', "IPFS API URL: the publish's own Kubo (http://127.0.0.1:<port>) or an IPFS API of the dApp's own")
   .option('--hhash <hhash>', 'IPFS hash')
   .option('--filePath <path>', 'Path to the file')
   .option('--folderPath <path>', 'Path to the folder')
-  .option('--action <action>', 'Action to perform (upload, hash, download)')
-  .option('--token <token>', 'IPFS authorization token')
+  .option('--action <action>', 'Action to perform (upload, hash, pin, download)')
+  .option('--token <token>', 'Authorization header value for the API (IPFS_TOKEN in the environment when absent)')
   .option('--output <path>', 'Output path for download');
 
 const isMain = process.argv[1] && process.argv[1].endsWith('ipfs.mjs');
@@ -439,8 +488,7 @@ if (isMain) {
   const options = program.opts();
 
   const main = async () => {
-    const host = options.host || 'localhost';
-    initialize(host, undefined, undefined, options.token || '');
+    initialize(options.host, undefined, undefined, options.token || process.env.IPFS_TOKEN || '');
 
     if (options.action === 'upload') {
       if (options.filePath) {
@@ -469,6 +517,14 @@ if (isMain) {
       const hhash = await hashForIPFS(target);
       console.log(`${hhash}`);
       process.exit(hhash ? 0 : 1);
+    } else if (options.action === 'pin') {
+      if (!options.hhash) {
+        console.error('Please provide --hhash, the CID to pin.');
+        process.exit(1);
+      }
+      const pinned = await pinOnIPFS(options.hhash);
+      if (pinned) console.log(`${options.hhash}`);
+      process.exit(pinned ? 0 : 1);
     } else if (options.action === 'download') {
       if (options.filePath) {
         await getFromIPFS(options.hhash, options.filePath);
@@ -480,7 +536,7 @@ if (isMain) {
         console.error('Please provide a filePath or folderPath for download.');
       }
     } else {
-      console.error('Please provide a valid action (upload, hash, download).');
+      console.error('Please provide a valid action (upload, hash, pin, download).');
       process.exit(1);
     }
   };

package/nodenithy/run/docker-compose-swift-stream.yml

@@ -3,7 +3,10 @@ version: '3.2'
 services:
   etny-swift-stream:
     container_name: etny-swift-stream
-    image: quay.io/minio/minio:RELEASE.2023-03-13T19-46-17Z
+    # quay.io/minio/minio:RELEASE.2023-03-13T19-46-17Z, mirrored on 2026-10-13
+    # (image id c69ff79d5831): quay.io answers 401 to an anonymous pull of
+    # that tag, and the mirror is pulled without credentials.
+    image: registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/minio/minio:RELEASE.2023-03-13T19-46-17Z
     command: server /data
     ports:
       - "9000:9000"

package/nodenithy/run/image_registry.js

@@ -39,8 +39,19 @@ function setVars(network = "") {
         }
     } else if (BLOCKCHAIN_NETWORK.includes("LitVM")) {
         NETWORK_RPC = "https://liteforge.rpc.caldera.xyz/infra-partner-http";
-        IMAGE_REGISTRY_ADDRESS = "0x55e0ad455Be85162b71a790f00Fc305680E3CE53";
+        IMAGE_REGISTRY_ADDRESS = "0xAf8Ce29103E1f59feDD49688ff070Ffc2346AF1D";
         CHAIN_ID = 4441;
+    } else if (BLOCKCHAIN_NETWORK.includes("Sepolia")) {
+        // Sepolia's ECImageRegistryV3 of 2026-10-14; Tenderly's gateway serves
+        // the log ranges publicnode prunes.
+        NETWORK_RPC = "https://sepolia.gateway.tenderly.co";
+        IMAGE_REGISTRY_ADDRESS = "0xa7E43a269E3307cf9d246b07df2B89CAA1b4C42F";
+        CHAIN_ID = 11155111;
+        // Sepolia's EVM charges storage-heavy calls several times the local
+        // EVM's gas (a contract creation about seven times); the base fee is
+        // under 0.0001 gwei, so 0.1 gwei is paid in full as the tip.
+        GAS = 20000000;
+        GAS_PRICE = 100000000;
     }
 }