@ethernity-cloud/sdk-js 1.7.17 → 1.7.28

package/README.md

@@ -98,7 +98,12 @@ The Pynithy securelock is built exactly as `ethernity-cloud-sdk-py` builds it
 your backend is frozen into. `src/serverless/requirements.txt` lists the
 Python packages your backend imports, and `src/serverless/Dockerfile.serverless`
 adds system packages to the securelock base image. `ECLD_MEMORY_TO_ALLOCATE`
-sets the enclave heap (default `1024M`).
+sets the enclave heap (default `1024M`). A Nodenithy securelock built with a
+heap under `1024M` (`ECLD_MEMORY_TO_ALLOCATE=256M`, for nodes with little
+memory) runs node with `--jitless`, since V8's JIT reserves a 512 MB code
+range that fits no smaller heap; the backend's JavaScript then runs
+interpreted, about ten times slower in its crypto. The default `1024M` keeps
+the JIT. `ECLD_NODE_JITLESS=0` or `1` overrides the choice.
 
 ### Scripts
 

package/cas/config.js

@@ -21,6 +21,9 @@ const VALIDATOR_REGISTRY = {
   'ecld-nodenithy-litvm-testnet': '0xbE3759f327e8643fC5A1717fb2072A0dAcBAD29E',
   'ecld-pynithy-ethereum-sepolia': '0x8ad24b3F406A41a0F8D3440021792EB203957F43',
   'ecld-nodenithy-ethereum-sepolia': '0x8ad24b3F406A41a0F8D3440021792EB203957F43',
+  // Amoy's ValidatorRegistry of 2026-10-28 (ethernity-cas CAS-SETUP.md).
+  'ecld-pynithy-amoy': '0x70bfdf41D4061592DF509b9b46F91a8457F88483',
+  'ecld-nodenithy-amoy': '0x70bfdf41D4061592DF509b9b46F91a8457F88483',
 };
 
 const SESSION_REGISTRY = {
@@ -33,6 +36,9 @@ const SESSION_REGISTRY = {
   // Bound to Sepolia's ECImageRegistryV3 of 2026-10-14.
   'ecld-pynithy-ethereum-sepolia': '0xDbB249E108d19fC1691483Bf897bA8BA0dA99c06',
   'ecld-nodenithy-ethereum-sepolia': '0xDbB249E108d19fC1691483Bf897bA8BA0dA99c06',
+  // Bound to Amoy's ECImageRegistryV3 of 2026-10-28.
+  'ecld-pynithy-amoy': '0x059662030fEeB4Ea8Fc7b05951A578d527a827e5',
+  'ecld-nodenithy-amoy': '0x059662030fEeB4Ea8Fc7b05951A578d527a827e5',
 };
 
 // The chain the registries above live on. Sepolia's RPC is Tenderly's gateway:
@@ -44,6 +50,8 @@ const CHAIN = {
   'ecld-nodenithy-litvm-testnet': { rpcUrl: 'https://liteforge.rpc.caldera.xyz/infra-partner-http', chainId: 4441 },
   'ecld-pynithy-ethereum-sepolia': { rpcUrl: 'https://sepolia.gateway.tenderly.co', chainId: 11155111 },
   'ecld-nodenithy-ethereum-sepolia': { rpcUrl: 'https://sepolia.gateway.tenderly.co', chainId: 11155111 },
+  'ecld-pynithy-amoy': { rpcUrl: 'https://polygon-amoy-bor-rpc.publicnode.com', chainId: 80002 },
+  'ecld-nodenithy-amoy': { rpcUrl: 'https://polygon-amoy-bor-rpc.publicnode.com', chainId: 80002 },
 };
 
 // Whether the securelock takes its certificate from a CAS session: mainnet
@@ -67,6 +75,7 @@ const UNSAFE_NETWORKS = {
   Bloxberg_Testnet_Unsafe: 'Bloxberg_Testnet',
   LitVM_LiteForge_Unsafe: 'LitVM_LiteForge',
   Ethereum_Sepolia_Unsafe: 'Ethereum_Sepolia',
+  Polygon_Amoy_Testnet_Unsafe: 'Polygon_Amoy_Testnet',
 };
 
 // Case-insensitive: ecld-init writes Bloxberg_Testnet_Unsafe, a --network

package/cas/session_registry.js

@@ -98,12 +98,23 @@ async function latestRecord(reg, name) {
   return { id, hash: rec.sessionHash.toLowerCase(), creator: rec.creator };
 }
 
+// The legacy gas price a registry write is sent with: the chain's eth_gasPrice
+// plus 10 %, and 1 mwei at the least. The bloxberg testnet reports 1 mwei;
+// Amoy's Bor reports about 30 gwei and refuses a price under its 25 gwei
+// minimum tip; LitVM refuses a price under its base fee.
+const MIN_GAS_PRICE = ethers.utils.parseUnits('1', 'mwei');
+async function gasPrice(provider) {
+  const price = (await provider.getGasPrice()).mul(110).div(100);
+  return price.gt(MIN_GAS_PRICE) ? price : MIN_GAS_PRICE;
+}
+
 // Send `method(...args)` to the registry. It is simulated first, so a call
 // the registry refuses stops with the registry's reason (`refused` names the
-// call), then sent with its gas estimate plus 30%: a registration's cost
-// grows with the length of the name. The wallet signs for the chain its RPC
-// serves (ethers takes no chainId override on a contract call), so an RPC
-// serving another chain than `chainId` is refused before anything is sent.
+// call), then sent with its gas estimate plus 30% (a registration's cost
+// grows with the length of the name) at the chain's gas price. The wallet
+// signs for the chain its RPC serves (ethers takes no chainId override on a
+// contract call), so an RPC serving another chain than `chainId` is refused
+// before anything is sent.
 async function send(reg, chainId, refused, method, ...args) {
   const { chainId: served } = await reg.provider.getNetwork();
   if (served !== chainId) {
@@ -116,7 +127,7 @@ async function send(reg, chainId, refused, method, ...args) {
   }
   const gas = await reg.estimateGas[method](...args);
   const tx = await reg[method](...args, {
-    gasLimit: gas.mul(13).div(10), gasPrice: ethers.utils.parseUnits('1', 'mwei'),
+    gasLimit: gas.mul(13).div(10), gasPrice: await gasPrice(reg.provider),
   });
   const rcpt = await tx.wait();
   if (rcpt.status !== 1) throw new Error(`SessionRegistry.${method} reverted for ${refused} (tx ${tx.hash})`);

package/info.js

@@ -55,6 +55,15 @@ const NETWORKS = {
     imageRegistry: '0xAf8Ce29103E1f59feDD49688ff070Ffc2346AF1D',
     esr: '0x709052Fe77Af543d3d9FE2Ac06a15c635c8D4Be5',
   },
+  // The separate-ERC20 implementation 1.1 of 2026-10-28 on the storage and
+  // token of the previous implementation 0x1579b37C...; the V3 registry and
+  // the ESR of the same day.
+  POLYGON_AMOY_TESTNET: {
+    type: 'testnet', chainId: 80002, rpc: 'https://polygon-amoy-bor-rpc.publicnode.com',
+    protocol: '0xB8f46D2B943fFbe2A061Ae8be087ef5055AD96A3',
+    imageRegistry: '0x0C0f52ebd72cd2d2cBe94F385c9e23cec528b706',
+    esr: '0x1DC58496ed1cA66FD1E0b51fA28A9E7451970843',
+  },
   // The family of 2026-10-14, owned by 0xA247...; the previous PoX 0x29D3eC87...
   // and V1 registry 0x55e0ad45... are abandoned.
   ETHEREUM_SEPOLIA: {

package/init.js

@@ -215,6 +215,7 @@ const main = async () => {
     "Bloxberg Testnet Unsafe",
     "LitVM LiteForge Unsafe",
     "Ethereum Sepolia Unsafe",
+    "Polygon Amoy Testnet Unsafe",
   ];
   const blockchainNetwork = await promptOptions(
     "On which Blockchain network do you want to have the app set up, as a starting point? (default is Bloxberg Testnet): ",
@@ -392,6 +393,7 @@ const main = async () => {
     "Bloxberg Testnet Unsafe": `etny-${svc}-testnet-unsafe`,
     "LitVM LiteForge Unsafe": `ecld-${svc}-litvm-testnet-unsafe`,
     "Ethereum Sepolia Unsafe": `ecld-${svc}-ethereum-sepolia-unsafe`,
+    "Polygon Amoy Testnet Unsafe": `ecld-${svc}-amoy-unsafe`,
   };
   const trustedZoneImage = imageByNetwork[blockchainNetwork] || `etny-${svc}-testnet`;
   writeEnv("TRUSTED_ZONE_IMAGE", trustedZoneImage);

package/network.js

@@ -29,6 +29,8 @@ function networkFor({ ECAddress, ECNetworkByChainId }, raw) {
     POLYGON_MAINNET: { address: ECAddress.POLYGON.MAINNET_ADDRESS },
     POLYGON_AMOY: amoy,
     POLYGON_AMOY_TESTNET: amoy,
+    POLYGON_AMOY_UNSAFE: { ...amoy, unsafe: ['POLYGON', 'TESTNET_UNSAFE'] },
+    POLYGON_AMOY_TESTNET_UNSAFE: { ...amoy, unsafe: ['POLYGON', 'TESTNET_UNSAFE'] },
     IOTEX_TESTNET: { address: ECAddress.IOTEX.TESTNET_ADDRESS, chainId: ECNetworkByChainId.IOTEX.TESTNET, rpcUrl: 'https://babel-api.testnet.iotex.io' },
     ETHEREUM_SEPOLIA: sepolia,
     SEPOLIA: sepolia,

package/nodenithy/build/securelock/Dockerfile.tmpl

@@ -63,8 +63,9 @@ RUN openssl genrsa -3 -out /enclave-key.pem 3072
 # scone-signer below (SCONE embeds defaults for anything not signed explicitly;
 # any drift makes SCONE recompute + debug re-sign the enclave at load, which CAS
 # rejects on mainnet). Values mirror the publish/run docker-compose securelock
-# service (SCONE_HEAP=1024M, SCONE_STACK=4M, dlopen=1, extensions=libbinary-fs).
-ENV SCONE_HEAP=1024M
+# service (SCONE_HEAP as build.mjs's MEMORY_TO_ALLOCATE, SCONE_STACK=4M,
+# dlopen=1, extensions=libbinary-fs).
+ENV SCONE_HEAP=__MEMORY_TO_ALLOCATE__
 ENV SCONE_STACK=4M
 ENV SCONE_ALLOW_DLOPEN=1
 ENV SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so
@@ -86,4 +87,6 @@ __SIGNED_MRENCLAVE__
 
 RUN rm -rf /enclave-key.pem
 
-ENTRYPOINT ["/usr/local/bin/node", "/etny-securelock/securelock.js"]
+# The node flags (build.mjs NODE_FLAGS) are also the CAS session's command and
+# the published .env's SECURELOCK_NODE_FLAGS; the composes run this ENTRYPOINT.
+ENTRYPOINT ["/usr/local/bin/node"__NODE_FLAGS__, "/etny-securelock/securelock.js"]

package/nodenithy/build/securelock/src/securelock.js.tmpl

@@ -21,6 +21,18 @@ const {executeTask} = require("./etny_exec");
 const {TaskStatus} = require("./task_status");
 const SwiftStreamService = require("./swift_stream_service");
 
+// An error a network socket emits after its request's caller has moved on
+// (a connection the server closed, ECONNRESET) reaches no handler of the
+// request; without these the node runtime exits on it, and the task is lost.
+// Logged and the run goes on: every step awaits its own result and treats a
+// failed one.
+process.on('uncaughtException', (e) => {
+    console.log('uncaught exception:', e && (e.stack || e.message) ? (e.stack || e.message) : e);
+});
+process.on('unhandledRejection', (e) => {
+    console.log('unhandled rejection:', e && (e.stack || e.message) ? (e.stack || e.message) : e);
+});
+
 const contract_abi = require('./pox_abi');
 const image_registry_abi = require('./image_registry_abi');
 const {sha256} = require("./etny_crypto");

package/nodenithy/build/securelock/src/swift_stream_service.js

@@ -1,13 +1,19 @@
 const Minio = require('minio');
+const http = require('http');
 const fs = require("fs");
 class SwiftStreamService {
     constructor(endpoint, port, accessKey, secretKey) {
+        // One connection per request: the minio client otherwise uses node's
+        // global agent, which keeps connections alive, and a connection the
+        // server has closed while this process computed between two requests
+        // fails the next request with ECONNRESET ("socket hang up").
         this.client = new Minio.Client({
             endPoint: endpoint,
             port: port,
             accessKey: accessKey,
             secretKey: secretKey,
             useSSL: false,
+            transportAgent: new http.Agent({ keepAlive: false }),
         });
     }
 

package/nodenithy/build.mjs

@@ -39,9 +39,11 @@ export const ECRunner = {
   // --- polygon mainnet ---
   'ecld-pynithy': ['0x439945BE73fD86fcC172179021991E96Beff3Cc4', '0x689f3806874d3c8A973f419a4eB24e6fBA7E830F', 'https://polygon-bor-rpc.publicnode.com', 137],
   'ecld-nodenithy': ['0x439945BE73fD86fcC172179021991E96Beff3Cc4', '0x689f3806874d3c8A973f419a4eB24e6fBA7E830F', 'https://polygon-bor-rpc.publicnode.com', 137],
-  // --- polygon amoy testnet (replaces deprecated mumbai) ---
-  'ecld-pynithy-amoy': ['0x1579b37C5a69ae02dDd23263A2b1318DE66a27C3', '0xeFA33c3976f31961285Ae4f5D10188616C912728', 'https://rpc-amoy.polygon.technology', 80002],
-  'ecld-nodenithy-amoy': ['0x1579b37C5a69ae02dDd23263A2b1318DE66a27C3', '0xeFA33c3976f31961285Ae4f5D10188616C912728', 'https://rpc-amoy.polygon.technology', 80002],
+  // --- polygon amoy testnet: the separate-ERC20 PoX EthernityImplementationV2 1.1 and the ECImageRegistryV3 of 2026-10-28 ---
+  'ecld-pynithy-amoy': ['0xB8f46D2B943fFbe2A061Ae8be087ef5055AD96A3', '0x0C0f52ebd72cd2d2cBe94F385c9e23cec528b706', 'https://polygon-amoy-bor-rpc.publicnode.com', 80002],
+  'ecld-nodenithy-amoy': ['0xB8f46D2B943fFbe2A061Ae8be087ef5055AD96A3', '0x0C0f52ebd72cd2d2cBe94F385c9e23cec528b706', 'https://polygon-amoy-bor-rpc.publicnode.com', 80002],
+  'ecld-pynithy-amoy-unsafe': ['0xB8f46D2B943fFbe2A061Ae8be087ef5055AD96A3', '0x0C0f52ebd72cd2d2cBe94F385c9e23cec528b706', 'https://polygon-amoy-bor-rpc.publicnode.com', 80002],
+  'ecld-nodenithy-amoy-unsafe': ['0xB8f46D2B943fFbe2A061Ae8be087ef5055AD96A3', '0x0C0f52ebd72cd2d2cBe94F385c9e23cec528b706', 'https://polygon-amoy-bor-rpc.publicnode.com', 80002],
   // --- iotex testnet ---
   'ecld-pynithy-iotex-testnet': ['0xD56385A97413Ed80E28B1b54A193b98F2C49c975', '0xa7467A6391816be9367a1cC52E0ef0c15FfE3cCC', 'https://babel-api.testnet.iotex.io', 4690],
   'ecld-nodenithy-iotex-testnet': ['0xD56385A97413Ed80E28B1b54A193b98F2C49c975', '0xa7467A6391816be9367a1cC52E0ef0c15FfE3cCC', 'https://babel-api.testnet.iotex.io', 4690],
@@ -68,6 +70,7 @@ export const ECRunner = {
 // matching SessionRegistry.
 const require = createRequire(import.meta.url);
 const casConfig = require('../cas/config.js');
+const nodeFlags = require('./nodeFlags.js');
 export const VALIDATOR_REGISTRY = casConfig.VALIDATOR_REGISTRY;
 
 // An -unsafe network runs an -unsafe trustedzone and nothing else, and an
@@ -215,6 +218,8 @@ const trustedZoneNetByBlockchain = {
   LitVM_LiteForge: 'litvm_liteforge',
   Bloxberg_Testnet_Unsafe: 'bloxberg_testnet_unsafe',
   LitVM_LiteForge_Unsafe: 'litvm_liteforge_unsafe',
+  Ethereum_Sepolia_Unsafe: 'ethereum_sepolia_unsafe',
+  Polygon_Amoy_Testnet_Unsafe: 'amoy_unsafe',
 };
 const trustedZoneNet = trustedZoneNetByBlockchain[process.env.BLOCKCHAIN_NETWORK];
 if (!trustedZoneNet) {
@@ -263,9 +268,17 @@ const esrEnvBlock = ESR_ENABLED ? `ENV ESR_CONTRACT_ADDRESS=${ESR_CONTRACT_ADDRE
 const dockerfileSecureTemplate = fs.readFileSync('Dockerfile.tmpl', 'utf8');
 let dockerfileSecureContent = dockerfileSecureTemplate.replace(/__ENCLAVE_NAME_SECURELOCK__/g, ENCLAVE_NAME_SECURELOCK).replace(/__NETWORK_TYPE__/g, isMainnet ? 'mainnet' : 'testnet').replace(/__BUCKET_NAME__/g, templateName + "-v3").replace(/__SMART_CONTRACT_ADDRESS__/g, ECRunner[templateName][0]).replace(/__IMAGE_REGISTRY_ADDRESS__/g, ECRunner[templateName][1]).replace(/__RPC_URL__/g, ECRunner[templateName][2]).replace(/__CHAIN_ID__/g, ECRunner[templateName][3]).replace(/__ETNY_VALIDATOR_REGISTRY_ADDRESS__/g, VALIDATOR_REGISTRY[templateName] || '').replace(/^__ESR_ENV__\r?\n/m, esrEnvBlock ? `${esrEnvBlock}\n` : '');
 
-// Amount of enclave heap to allocate (SCONE_HEAP). Kept in sync with the
-// run/docker-compose securelock service; overridable via ECLD_MEMORY_TO_ALLOCATE.
+// The securelock's protected heap (SCONE_HEAP), signed into the enclave and
+// set on the run/docker-compose securelock service; ECLD_MEMORY_TO_ALLOCATE
+// overrides the default. The default 1024M keeps V8's JIT, whose code range
+// (512 MB, reserved at start) fits no smaller heap; a heap under 1024M runs
+// node --jitless (nodeFlags.js), the backend's JavaScript interpreted.
 const MEMORY_TO_ALLOCATE = (process.env.ECLD_MEMORY_TO_ALLOCATE || '1024M').trim();
+const NODE_FLAGS = nodeFlags.securelockNodeFlags(MEMORY_TO_ALLOCATE);
+// Read back by ecld-publish (run.js), which renders them into the composes'
+// securelock service and the CAS session's command.
+writeEnv('MEMORY_TO_ALLOCATE', MEMORY_TO_ALLOCATE);
+writeEnv('SECURELOCK_NODE_FLAGS', NODE_FLAGS.join(' '));
 
 // CRITICAL (mainnet DCAP): sign /usr/local/bin/node -- the binary the enclave
 // actually EXECUTES (ENTRYPOINT + the run/publish compose command both run
@@ -297,6 +310,8 @@ const signedMrenclaveStep =
 // securelock is signed debug with the same explicit params.
 const cas = casConfig.casProvisioned(templateName, isMainnet);
 dockerfileSecureContent = dockerfileSecureContent
+  .replace(/__MEMORY_TO_ALLOCATE__/g, MEMORY_TO_ALLOCATE)
+  .replace(/__NODE_FLAGS__/g, NODE_FLAGS.map((flag) => `, "${flag}"`).join(''))
   .replace('__SCONE_SIGN__', `RUN scone-signer sign ${signFlags}${cas ? ' --production' : ''} /usr/local/bin/node`)
   .replace('__SIGNED_MRENCLAVE__', signedMrenclaveStep);
 

package/nodenithy/nodeFlags.js

@@ -0,0 +1,24 @@
+// The node flags the securelock is built and run with, derived from its
+// protected heap (SCONE_HEAP). V8 reserves a 512 MB code range for its JIT at
+// start, which fits a 1024M heap and not a smaller one; a smaller heap runs
+// node --jitless, which reserves no code range and runs JavaScript
+// interpreted. ECLD_NODE_JITLESS=1 or 0 overrides the derivation.
+const MEBIBYTE = 1024 * 1024;
+const JIT_HEAP_BYTES = 1024 * MEBIBYTE;
+
+// Bytes of a SCONE_HEAP value: a whole number with an optional K, M or G.
+const heapBytes = (heap) => {
+    const m = /^(\d+)([KMG])?$/i.exec(String(heap).trim());
+    if (!m) throw new Error(`heap ${JSON.stringify(heap)}: expected <n>, <n>K, <n>M or <n>G`);
+    const unit = { K: 1024, M: MEBIBYTE, G: 1024 * MEBIBYTE }[(m[2] || '').toUpperCase()] || 1;
+    return Number(m[1]) * unit;
+};
+
+const securelockNodeFlags = (heap, override = process.env.ECLD_NODE_JITLESS) => {
+    const jitless = override === undefined || String(override).trim() === ''
+        ? heapBytes(heap) < JIT_HEAP_BYTES
+        : /^(1|true|yes)$/i.test(String(override).trim());
+    return jitless ? ['--jitless'] : [];
+};
+
+module.exports = { securelockNodeFlags, heapBytes, JIT_HEAP_BYTES };

package/nodenithy/run/docker-compose-final.yml.tmpl

@@ -30,15 +30,16 @@ services:
     container_name: etny-securelock
     privileged: true
     image: localhost:5000/etny-securelock
-    entrypoint: ""
-    command: [ "/usr/local/bin/node", "/etny-securelock/securelock.js" ]
+    # No command: the image's ENTRYPOINT runs node with the flags the
+    # securelock was built and measured with (build.mjs NODE_FLAGS).
     environment:
       - SCONE_CAS_ADDR=scone-cas.cf  # __CAS_ONLY__
       - SCONE_LAS_ADDR=las  # __CAS_ONLY__
       - SCONE_CONFIG_ID=__ENCLAVE_NAME_SECURELOCK__/application  # __CAS_ONLY__
-      - SCONE_HEAP=1024M
-      # Must match the --stack the securelock binary was signed with (build.mjs),
-      # otherwise SCONE recomputes MRENCLAVE at load and re-signs as debug.
+      # Must match the --heap and --stack the securelock binary was signed with
+      # (build.mjs), otherwise SCONE recomputes MRENCLAVE at load and re-signs
+      # as debug. The heap is the build's MEMORY_TO_ALLOCATE (.env).
+      - SCONE_HEAP=__MEMORY_TO_ALLOCATE__
       - SCONE_STACK=4M
       - SCONE_LOG=DEBUG
       - SCONE_ALLOW_DLOPEN=1
@@ -55,8 +56,8 @@ services:
     container_name: etny-trustedzone
     privileged: true
     image: localhost:5000/etny-trustedzone
-    entrypoint: ""
-    command: [ "/usr/local/bin/node", "/etny-trustedzone/trustedzone.js" ]
+    # No command: the image's ENTRYPOINT runs node with the flags the
+    # trustedzone was built and measured with (etny-nodenithy Dockerfile.tmpl).
     environment:
       - SCONE_CAS_ADDR=scone-cas.cf  # __CAS_ONLY__
       - SCONE_LAS_ADDR=las  # __CAS_ONLY__

package/nodenithy/run/docker-compose.yml.tmpl

@@ -33,15 +33,16 @@ services:
     container_name: etny-securelock
     privileged: true
     image: localhost:5000/etny-securelock
-    entrypoint: ""
-    command: [ "/usr/local/bin/node", "/etny-securelock/securelock.js" ]
+    # No command: the image's ENTRYPOINT runs node with the flags the
+    # securelock was built and measured with (build.mjs NODE_FLAGS).
     environment:
       - SCONE_CAS_ADDR=scone-cas.cf  # __CAS_ONLY__
       - SCONE_LAS_ADDR=las  # __CAS_ONLY__
       - SCONE_CONFIG_ID=__ENCLAVE_NAME_SECURELOCK__/application  # __CAS_ONLY__
-      - SCONE_HEAP=1024M
-      # Must match the --stack the securelock binary was signed with (build.mjs),
-      # otherwise SCONE recomputes MRENCLAVE at load and re-signs as debug.
+      # Must match the --heap and --stack the securelock binary was signed with
+      # (build.mjs), otherwise SCONE recomputes MRENCLAVE at load and re-signs
+      # as debug. The heap is the build's MEMORY_TO_ALLOCATE (.env).
+      - SCONE_HEAP=__MEMORY_TO_ALLOCATE__
       - SCONE_STACK=4M
       - SCONE_LOG=DEBUG
       - SCONE_ALLOW_DLOPEN=1
@@ -54,14 +55,14 @@ services:
     container_name: etny-trustedzone
     privileged: true
     image: localhost:5000/etny-trustedzone
-    entrypoint: ""
-    command: [ "/usr/local/bin/node", "/etny-trustedzone/trustedzone.js" ]
+    # No command: the image's ENTRYPOINT runs node with the flags the
+    # trustedzone was built and measured with (etny-nodenithy Dockerfile.tmpl).
     environment:
       - SCONE_CAS_ADDR=scone-cas.cf  # __CAS_ONLY__
       - SCONE_LAS_ADDR=las  # __CAS_ONLY__
       - SCONE_CONFIG_ID=__ENCLAVE_NAME_TRUSTEDZONE__/application  # __CAS_ONLY__
-      # The heap the trustedzone was measured and registered with: 1024M for
-      # every testnet trustedzone (etny-nodenithy v3/run/docker-compose.yml).
+      # The heap the trustedzone was signed with: the SCONE_HEAP of the
+      # bundled trustedzone image (run.js reads it from the image).
       - SCONE_HEAP=__TRUSTEDZONE_HEAP__
       - SCONE_LOG=DEBUG
       - SCONE_ALLOW_DLOPEN=1

package/nodenithy/run/etny-securelock-test.yaml.tpl

@@ -16,7 +16,9 @@ services:
    - name: application
      image_name: application_image
      mrenclaves: [ "__MRENCLAVE__" ]
-     command: /usr/local/bin/node /etny-securelock/securelock.js
+     # The command the enclave runs, applied from the session at attestation:
+     # the image ENTRYPOINT's, with the build's node flags (run.js NODE_FLAGS).
+     command: /usr/local/bin/node __NODE_FLAGS__/etny-securelock/securelock.js
      pwd: /
      environment:
         GREETING: hello from ETNY SECURELOCK!!!!

package/nodenithy/run/image_registry.js

@@ -25,17 +25,19 @@ function setVars(network = "") {
             : "0x15D73a742529C3fb11f3FA32EF7f0CC3870ACA31";
     } else if (BLOCKCHAIN_NETWORK.includes("Polygon")) {
         if (BLOCKCHAIN_NETWORK.includes("Mainnet")) {
-            NETWORK_RPC = "https://polygon-rpc.com";
+            NETWORK_RPC = "https://polygon-bor-rpc.publicnode.com";
             IMAGE_REGISTRY_ADDRESS = "0x689f3806874d3c8A973f419a4eB24e6fBA7E830F";
             CHAIN_ID = 137;
             GAS = 20000000;
             GAS_PRICE = 40500500010;
         } else {
+            // Amoy's ECImageRegistryV3 of 2026-10-28; the chain's base fee is
+            // about 30 gwei.
             NETWORK_RPC = "https://polygon-amoy-bor-rpc.publicnode.com";
-            IMAGE_REGISTRY_ADDRESS = "0xF7F4eEb3d9a64387F4AcEb6d521b948E6E2fB049";
+            IMAGE_REGISTRY_ADDRESS = "0x0C0f52ebd72cd2d2cBe94F385c9e23cec528b706";
             CHAIN_ID = 80002;
             GAS = 20000000;
-            GAS_PRICE = 1300000010;
+            GAS_PRICE = 40000000010;
         }
     } else if (BLOCKCHAIN_NETWORK.includes("LitVM")) {
         NETWORK_RPC = "https://liteforge.rpc.caldera.xyz/infra-partner-http";

package/nodenithy/run/public_key_service.js

@@ -5,7 +5,8 @@
 // registries) is queued by the service's registry watcher from the
 // ImageRegistered event, with this publish's IPFS peer; the hash is posted to
 // /api/addHash only when that row has not appeared within
-// CHAIN_ROW_GRACE_SECONDS. Other images are posted at once.
+// CHAIN_ROW_GRACE_SECONDS, or when the service holds a failed extraction of
+// the image. Other images are posted at once.
 const axios = require('axios');
 const fs = require('fs');
 const { Command } = require('commander');
@@ -14,6 +15,14 @@ const BASE_URL = "https://publickey.ethernity.cloud";
 // The watcher polls the registries every 30 s.
 const CHAIN_ROW_GRACE_SECONDS = 180;
 const POLL_SECONDS = 10;
+// A failed extraction is recorded against the hash with publicKey -1 and a
+// reason, and a new submission of the hash runs it again. The service answers
+// the old record for a moment after a submission, so a failed answer is taken
+// as the outcome only once this long has passed since this publish submitted.
+const RESUBMIT_GRACE_SECONDS = 60;
+
+// The service's record of an extraction that failed.
+const failed = (answer) => answer !== null && answer.publicKey === -1;
 
 async function submitIpfsHash(hash, enclaveName, protocolVersion, network, templateVersion, dockerComposerHash) {
     const url = `${BASE_URL}/api/addHash`;
@@ -48,9 +57,10 @@ async function checkIpfsHashStatus(hash) {
     }
 }
 
-// Queues the image as described above and returns the service's first
-// answer for it. `submit`, `check`, `sleep` and `now` are the functions
-// above and the clock, replaceable for tests.
+// Queues the image as described above and returns the service's first answer
+// for it (`answer`, null right after a submission) and whether this publish
+// posted the hash (`submitted`). `submit`, `check`, `sleep` and `now` are the
+// functions above and the clock, replaceable for tests.
 async function queueImage({ hash, chainRegistered, submitArgs, submit = submitIpfsHash, check = checkIpfsHashStatus,
     sleep = (s) => new Promise((resolve) => setTimeout(resolve, s * 1000)), now = () => Date.now() / 1000,
     log = console.log, graceSeconds = CHAIN_ROW_GRACE_SECONDS, pollSeconds = POLL_SECONDS }) {
@@ -58,7 +68,11 @@ async function queueImage({ hash, chainRegistered, submitArgs, submit = submitIp
         const deadline = now() + graceSeconds;
         while (true) {
             const answer = await check(hash);
-            if (answer !== null) return answer;
+            if (failed(answer)) {
+                log(`The service's previous extraction of this image failed (${answer.reason || "no reason reported"}); submitting the hash again`);
+                break;
+            }
+            if (answer !== null) return { answer, submitted: false };
             if (now() >= deadline) {
                 log(`The certificate service has not picked the registration up from the chain in ${graceSeconds} s; submitting the hash`);
                 break;
@@ -69,7 +83,7 @@ async function queueImage({ hash, chainRegistered, submitArgs, submit = submitIp
     }
     const submitResponse = await submit(hash, ...submitArgs);
     log("Submit IPFS Hash Response:", submitResponse);
-    return null;
+    return { answer: null, submitted: true };
 }
 
 async function main() {
@@ -98,10 +112,12 @@ async function main() {
     console.log("Template Version:", templateVersion);
     console.log("Docker Composer Hash:", dockerComposerHash);
 
-    let checkResponse = await queueImage({
+    const queued = await queueImage({
         hash: hhash, chainRegistered: Boolean(options.chainRegistered),
         submitArgs: [enclaveName, protocolVersion, network, templateVersion, dockerComposerHash],
     });
+    let checkResponse = queued.answer;
+    const submittedAt = queued.submitted ? Date.now() / 1000 : null;
 
     // The service answers publicKey 0 while the image is queued or running
     // (with status, percent and queuePosition), -1 when the extraction failed
@@ -119,10 +135,15 @@ async function main() {
                 } else {
                     console.log(`Public key not available yet. Queue position: ${checkResponse.queuePosition ?? 'Unknown'}`);
                 }
-            } else if (checkResponse.publicKey === -1) {
-                console.log(`Public key extraction failed: ${checkResponse.reason || "reason not reported by the service"}`);
-                console.log("Fix the cause (keep the image pinned, build with the current SDK) and publish again: a new submission of the same hash runs the extraction again.");
-                process.exit(1);
+            } else if (failed(checkResponse)) {
+                if (submittedAt !== null && Date.now() / 1000 - submittedAt < RESUBMIT_GRACE_SECONDS) {
+                    // The record of the run before this publish's submission.
+                    console.log("The service still answers its previous record; waiting for the new run");
+                } else {
+                    console.log(`Public key extraction failed: ${checkResponse.reason || "reason not reported by the service"}`);
+                    console.log("Fix the cause (keep the image pinned, build with the current SDK) and publish again: a new submission of the same hash runs the extraction again.");
+                    process.exit(1);
+                }
             } else {
                 console.log("Public Key:", checkResponse.publicKey);
                 // Save public key to file
@@ -152,4 +173,4 @@ async function main() {
 
 if (require.main === module) main();
 
-module.exports = { queueImage, CHAIN_ROW_GRACE_SECONDS, POLL_SECONDS };
+module.exports = { queueImage, CHAIN_ROW_GRACE_SECONDS, POLL_SECONDS, RESUBMIT_GRACE_SECONDS };

package/nodenithy/run.js

@@ -113,12 +113,28 @@ const extractSignedMrenclave = (service) => {
     }
 };
 
+// The heap the trustedzone was signed with: the SCONE_HEAP of the image the
+// build bundled (etny-nodenithy's Dockerfile sets it to the --heap it signs
+// with). The compose must name the same value, or SCONE recomputes the
+// measurement at load and the CAS refuses the enclave.
+const trustedZoneHeapOfImage = (image) => {
+    const env = execSync(`docker image inspect ${image} --format "{{range .Config.Env}}{{println .}}{{end}}"`,
+        { stdio: ['pipe', 'pipe', 'pipe'] }).toString();
+    const m = env.match(/^SCONE_HEAP=(\S+)$/m);
+    if (!m) throw new Error(`${image} carries no SCONE_HEAP in its environment`);
+    return m[1];
+};
+
 const main = async () => {
     process.env.NODE_NO_WARNINGS = 1
-    // Every testnet trustedzone was measured and registered with a 1024M heap
-    // (etny-nodenithy v3/run/docker-compose.yml). The mainnet session named
-    // below comes from the features/v3 branches, which ran it with 256M.
-    const trustedZoneHeap = isMainnet ? '256M' : '1024M';
+    const trustedZoneHeap = trustedZoneHeapOfImage('localhost:5000/etny-trustedzone');
+    console.log(`Trustedzone heap: ${trustedZoneHeap}`);
+    // The securelock heap ecld-build signed it with (part of MRENCLAVE).
+    const memory = (process.env.MEMORY_TO_ALLOCATE || '').trim();
+    if (!memory) {
+        console.error("Error: MEMORY_TO_ALLOCATE is not set in .env; run ecld-build first.");
+        process.exit(1);
+    }
 
     // Where the image goes. An IPFS API of the application's own
     // (IPFS_ENDPOINT, with IPFS_TOKEN as its Authorization header when set)
@@ -208,7 +224,8 @@ const main = async () => {
             return;
         }
         const content = casConfig.renderCompose(fs.readFileSync(template, 'utf8'), cas, unsafe)
-            .replace(/__TRUSTEDZONE_HEAP__/g, trustedZoneHeap);
+            .replace(/__TRUSTEDZONE_HEAP__/g, trustedZoneHeap)
+            .replace(/__MEMORY_TO_ALLOCATE__/g, memory);
         fs.writeFileSync(file, content, 'utf8');
     });
 
@@ -308,10 +325,15 @@ const main = async () => {
         PREDECESSOR_HASH_SECURELOCK = 'EMPTY';
     }
 
+    // The node flags the build gave the securelock (.env SECURELOCK_NODE_FLAGS,
+    // build.mjs): the session's command runs node with the same flags as the
+    // image ENTRYPOINT. A .env without the key is a build without flags.
+    const nodeFlags = (process.env.SECURELOCK_NODE_FLAGS || '').trim();
     const replacementsSecurelock = {
         PREDECESSOR: PREDECESSOR_HASH_SECURELOCK === 'EMPTY' ? `# predecessor: ${PREDECESSOR_HASH_SECURELOCK}` : `predecessor: ${PREDECESSOR_HASH_SECURELOCK}`,
         MRENCLAVE: process.env.MRENCLAVE_SECURELOCK,
         ENCLAVE_NAME: ENCLAVE_NAME_SECURELOCK,
+        NODE_FLAGS: nodeFlags ? `${nodeFlags} ` : '',
         ESR_ENVIRONMENT: casConfig.esrSessionEnvironment(process.env)
     };
     if (cas) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ethernity-cloud/sdk-js",
-  "version": "1.7.17",
+  "version": "1.7.28",
   "description": "A package to run ethernity cloud build scripts",
   "scripts": {
     "test": "node --test \"test/**/*.test.js\"",

package/pynithy/build.mjs

@@ -39,9 +39,11 @@ export const ECRunner = {
   // --- polygon mainnet ---
   'ecld-pynithy': ['0x439945BE73fD86fcC172179021991E96Beff3Cc4', '0x689f3806874d3c8A973f419a4eB24e6fBA7E830F', 'https://polygon-bor-rpc.publicnode.com', 137],
   'ecld-nodenithy': ['0x439945BE73fD86fcC172179021991E96Beff3Cc4', '0x689f3806874d3c8A973f419a4eB24e6fBA7E830F', 'https://polygon-bor-rpc.publicnode.com', 137],
-  // --- polygon amoy testnet (replaces deprecated mumbai) ---
-  'ecld-pynithy-amoy': ['0x1579b37C5a69ae02dDd23263A2b1318DE66a27C3', '0xeFA33c3976f31961285Ae4f5D10188616C912728', 'https://rpc-amoy.polygon.technology', 80002],
-  'ecld-nodenithy-amoy': ['0x1579b37C5a69ae02dDd23263A2b1318DE66a27C3', '0xeFA33c3976f31961285Ae4f5D10188616C912728', 'https://rpc-amoy.polygon.technology', 80002],
+  // --- polygon amoy testnet: the separate-ERC20 PoX EthernityImplementationV2 1.1 and the ECImageRegistryV3 of 2026-10-28 ---
+  'ecld-pynithy-amoy': ['0xB8f46D2B943fFbe2A061Ae8be087ef5055AD96A3', '0x0C0f52ebd72cd2d2cBe94F385c9e23cec528b706', 'https://polygon-amoy-bor-rpc.publicnode.com', 80002],
+  'ecld-nodenithy-amoy': ['0xB8f46D2B943fFbe2A061Ae8be087ef5055AD96A3', '0x0C0f52ebd72cd2d2cBe94F385c9e23cec528b706', 'https://polygon-amoy-bor-rpc.publicnode.com', 80002],
+  'ecld-pynithy-amoy-unsafe': ['0xB8f46D2B943fFbe2A061Ae8be087ef5055AD96A3', '0x0C0f52ebd72cd2d2cBe94F385c9e23cec528b706', 'https://polygon-amoy-bor-rpc.publicnode.com', 80002],
+  'ecld-nodenithy-amoy-unsafe': ['0xB8f46D2B943fFbe2A061Ae8be087ef5055AD96A3', '0x0C0f52ebd72cd2d2cBe94F385c9e23cec528b706', 'https://polygon-amoy-bor-rpc.publicnode.com', 80002],
   // --- iotex testnet ---
   'ecld-pynithy-iotex-testnet': ['0xD56385A97413Ed80E28B1b54A193b98F2C49c975', '0xa7467A6391816be9367a1cC52E0ef0c15FfE3cCC', 'https://babel-api.testnet.iotex.io', 4690],
   'ecld-nodenithy-iotex-testnet': ['0xD56385A97413Ed80E28B1b54A193b98F2C49c975', '0xa7467A6391816be9367a1cC52E0ef0c15FfE3cCC', 'https://babel-api.testnet.iotex.io', 4690],
@@ -156,7 +158,7 @@ const casProvisioned = casConfig.casProvisioned(templateName, isMainnet);
 
 // Enclave heap (SCONE_HEAP). Part of the measurement: publish runs the
 // securelock with the value recorded here.
-const MEMORY_TO_ALLOCATE = (process.env.ECLD_MEMORY_TO_ALLOCATE || process.env.MEMORY_TO_ALLOCATE || '1024M').trim();
+const MEMORY_TO_ALLOCATE = (process.env.ECLD_MEMORY_TO_ALLOCATE || process.env.MEMORY_TO_ALLOCATE || '256M').trim();
 writeEnv('MEMORY_TO_ALLOCATE', MEMORY_TO_ALLOCATE);
 
 runCommand('docker pull registry:2');

package/pynithy/run/image_registry.js

@@ -25,17 +25,19 @@ function setVars(network = "") {
             : "0x15D73a742529C3fb11f3FA32EF7f0CC3870ACA31";
     } else if (BLOCKCHAIN_NETWORK.includes("Polygon")) {
         if (BLOCKCHAIN_NETWORK.includes("Mainnet")) {
-            NETWORK_RPC = "https://polygon-rpc.com";
+            NETWORK_RPC = "https://polygon-bor-rpc.publicnode.com";
             IMAGE_REGISTRY_ADDRESS = "0x689f3806874d3c8A973f419a4eB24e6fBA7E830F";
             CHAIN_ID = 137;
             GAS = 20000000;
             GAS_PRICE = 40500500010;
         } else {
+            // Amoy's ECImageRegistryV3 of 2026-10-28; the chain's base fee is
+            // about 30 gwei.
             NETWORK_RPC = "https://polygon-amoy-bor-rpc.publicnode.com";
-            IMAGE_REGISTRY_ADDRESS = "0xF7F4eEb3d9a64387F4AcEb6d521b948E6E2fB049";
+            IMAGE_REGISTRY_ADDRESS = "0x0C0f52ebd72cd2d2cBe94F385c9e23cec528b706";
             CHAIN_ID = 80002;
             GAS = 20000000;
-            GAS_PRICE = 1300000010;
+            GAS_PRICE = 40000000010;
         }
     } else if (BLOCKCHAIN_NETWORK.includes("LitVM")) {
         NETWORK_RPC = "https://liteforge.rpc.caldera.xyz/infra-partner-http";

package/pynithy/run/public_key_service.js

@@ -5,7 +5,8 @@
 // registries) is queued by the service's registry watcher from the
 // ImageRegistered event, with this publish's IPFS peer; the hash is posted to
 // /api/addHash only when that row has not appeared within
-// CHAIN_ROW_GRACE_SECONDS. Other images are posted at once.
+// CHAIN_ROW_GRACE_SECONDS, or when the service holds a failed extraction of
+// the image. Other images are posted at once.
 const axios = require('axios');
 const fs = require('fs');
 const { Command } = require('commander');
@@ -14,6 +15,14 @@ const BASE_URL = "https://publickey.ethernity.cloud";
 // The watcher polls the registries every 30 s.
 const CHAIN_ROW_GRACE_SECONDS = 180;
 const POLL_SECONDS = 10;
+// A failed extraction is recorded against the hash with publicKey -1 and a
+// reason, and a new submission of the hash runs it again. The service answers
+// the old record for a moment after a submission, so a failed answer is taken
+// as the outcome only once this long has passed since this publish submitted.
+const RESUBMIT_GRACE_SECONDS = 60;
+
+// The service's record of an extraction that failed.
+const failed = (answer) => answer !== null && answer.publicKey === -1;
 
 async function submitIpfsHash(hash, enclaveName, protocolVersion, network, templateVersion, dockerComposerHash) {
     const url = `${BASE_URL}/api/addHash`;
@@ -48,9 +57,10 @@ async function checkIpfsHashStatus(hash) {
     }
 }
 
-// Queues the image as described above and returns the service's first
-// answer for it. `submit`, `check`, `sleep` and `now` are the functions
-// above and the clock, replaceable for tests.
+// Queues the image as described above and returns the service's first answer
+// for it (`answer`, null right after a submission) and whether this publish
+// posted the hash (`submitted`). `submit`, `check`, `sleep` and `now` are the
+// functions above and the clock, replaceable for tests.
 async function queueImage({ hash, chainRegistered, submitArgs, submit = submitIpfsHash, check = checkIpfsHashStatus,
     sleep = (s) => new Promise((resolve) => setTimeout(resolve, s * 1000)), now = () => Date.now() / 1000,
     log = console.log, graceSeconds = CHAIN_ROW_GRACE_SECONDS, pollSeconds = POLL_SECONDS }) {
@@ -58,7 +68,11 @@ async function queueImage({ hash, chainRegistered, submitArgs, submit = submitIp
         const deadline = now() + graceSeconds;
         while (true) {
             const answer = await check(hash);
-            if (answer !== null) return answer;
+            if (failed(answer)) {
+                log(`The service's previous extraction of this image failed (${answer.reason || "no reason reported"}); submitting the hash again`);
+                break;
+            }
+            if (answer !== null) return { answer, submitted: false };
             if (now() >= deadline) {
                 log(`The certificate service has not picked the registration up from the chain in ${graceSeconds} s; submitting the hash`);
                 break;
@@ -69,7 +83,7 @@ async function queueImage({ hash, chainRegistered, submitArgs, submit = submitIp
     }
     const submitResponse = await submit(hash, ...submitArgs);
     log("Submit IPFS Hash Response:", submitResponse);
-    return null;
+    return { answer: null, submitted: true };
 }
 
 async function main() {
@@ -98,10 +112,12 @@ async function main() {
     console.log("Template Version:", templateVersion);
     console.log("Docker Composer Hash:", dockerComposerHash);
 
-    let checkResponse = await queueImage({
+    const queued = await queueImage({
         hash: hhash, chainRegistered: Boolean(options.chainRegistered),
         submitArgs: [enclaveName, protocolVersion, network, templateVersion, dockerComposerHash],
     });
+    let checkResponse = queued.answer;
+    const submittedAt = queued.submitted ? Date.now() / 1000 : null;
 
     // The service answers publicKey 0 while the image is queued or running
     // (with status, percent and queuePosition), -1 when the extraction failed
@@ -119,10 +135,15 @@ async function main() {
                 } else {
                     console.log(`Public key not available yet. Queue position: ${checkResponse.queuePosition ?? 'Unknown'}`);
                 }
-            } else if (checkResponse.publicKey === -1) {
-                console.log(`Public key extraction failed: ${checkResponse.reason || "reason not reported by the service"}`);
-                console.log("Fix the cause (keep the image pinned, build with the current SDK) and publish again: a new submission of the same hash runs the extraction again.");
-                process.exit(1);
+            } else if (failed(checkResponse)) {
+                if (submittedAt !== null && Date.now() / 1000 - submittedAt < RESUBMIT_GRACE_SECONDS) {
+                    // The record of the run before this publish's submission.
+                    console.log("The service still answers its previous record; waiting for the new run");
+                } else {
+                    console.log(`Public key extraction failed: ${checkResponse.reason || "reason not reported by the service"}`);
+                    console.log("Fix the cause (keep the image pinned, build with the current SDK) and publish again: a new submission of the same hash runs the extraction again.");
+                    process.exit(1);
+                }
             } else {
                 console.log("Public Key:", checkResponse.publicKey);
                 // Save public key to file
@@ -152,4 +173,4 @@ async function main() {
 
 if (require.main === module) main();
 
-module.exports = { queueImage, CHAIN_ROW_GRACE_SECONDS, POLL_SECONDS };
+module.exports = { queueImage, CHAIN_ROW_GRACE_SECONDS, POLL_SECONDS, RESUBMIT_GRACE_SECONDS };