@ethernity-cloud/sdk-js 1.7.20 → 1.7.28

package/README.md

@@ -98,7 +98,12 @@ The Pynithy securelock is built exactly as `ethernity-cloud-sdk-py` builds it
 your backend is frozen into. `src/serverless/requirements.txt` lists the
 Python packages your backend imports, and `src/serverless/Dockerfile.serverless`
 adds system packages to the securelock base image. `ECLD_MEMORY_TO_ALLOCATE`
-sets the enclave heap (default `1024M`).
+sets the enclave heap (default `1024M`). A Nodenithy securelock built with a
+heap under `1024M` (`ECLD_MEMORY_TO_ALLOCATE=256M`, for nodes with little
+memory) runs node with `--jitless`, since V8's JIT reserves a 512 MB code
+range that fits no smaller heap; the backend's JavaScript then runs
+interpreted, about ten times slower in its crypto. The default `1024M` keeps
+the JIT. `ECLD_NODE_JITLESS=0` or `1` overrides the choice.
 
 ### Scripts
 

package/cas/config.js

@@ -21,6 +21,9 @@ const VALIDATOR_REGISTRY = {
   'ecld-nodenithy-litvm-testnet': '0xbE3759f327e8643fC5A1717fb2072A0dAcBAD29E',
   'ecld-pynithy-ethereum-sepolia': '0x8ad24b3F406A41a0F8D3440021792EB203957F43',
   'ecld-nodenithy-ethereum-sepolia': '0x8ad24b3F406A41a0F8D3440021792EB203957F43',
+  // Amoy's ValidatorRegistry of 2026-10-28 (ethernity-cas CAS-SETUP.md).
+  'ecld-pynithy-amoy': '0x70bfdf41D4061592DF509b9b46F91a8457F88483',
+  'ecld-nodenithy-amoy': '0x70bfdf41D4061592DF509b9b46F91a8457F88483',
 };
 
 const SESSION_REGISTRY = {
@@ -33,6 +36,9 @@ const SESSION_REGISTRY = {
   // Bound to Sepolia's ECImageRegistryV3 of 2026-10-14.
   'ecld-pynithy-ethereum-sepolia': '0xDbB249E108d19fC1691483Bf897bA8BA0dA99c06',
   'ecld-nodenithy-ethereum-sepolia': '0xDbB249E108d19fC1691483Bf897bA8BA0dA99c06',
+  // Bound to Amoy's ECImageRegistryV3 of 2026-10-28.
+  'ecld-pynithy-amoy': '0x059662030fEeB4Ea8Fc7b05951A578d527a827e5',
+  'ecld-nodenithy-amoy': '0x059662030fEeB4Ea8Fc7b05951A578d527a827e5',
 };
 
 // The chain the registries above live on. Sepolia's RPC is Tenderly's gateway:
@@ -44,6 +50,8 @@ const CHAIN = {
   'ecld-nodenithy-litvm-testnet': { rpcUrl: 'https://liteforge.rpc.caldera.xyz/infra-partner-http', chainId: 4441 },
   'ecld-pynithy-ethereum-sepolia': { rpcUrl: 'https://sepolia.gateway.tenderly.co', chainId: 11155111 },
   'ecld-nodenithy-ethereum-sepolia': { rpcUrl: 'https://sepolia.gateway.tenderly.co', chainId: 11155111 },
+  'ecld-pynithy-amoy': { rpcUrl: 'https://polygon-amoy-bor-rpc.publicnode.com', chainId: 80002 },
+  'ecld-nodenithy-amoy': { rpcUrl: 'https://polygon-amoy-bor-rpc.publicnode.com', chainId: 80002 },
 };
 
 // Whether the securelock takes its certificate from a CAS session: mainnet
@@ -67,6 +75,7 @@ const UNSAFE_NETWORKS = {
   Bloxberg_Testnet_Unsafe: 'Bloxberg_Testnet',
   LitVM_LiteForge_Unsafe: 'LitVM_LiteForge',
   Ethereum_Sepolia_Unsafe: 'Ethereum_Sepolia',
+  Polygon_Amoy_Testnet_Unsafe: 'Polygon_Amoy_Testnet',
 };
 
 // Case-insensitive: ecld-init writes Bloxberg_Testnet_Unsafe, a --network

package/cas/session_registry.js

@@ -98,12 +98,23 @@ async function latestRecord(reg, name) {
   return { id, hash: rec.sessionHash.toLowerCase(), creator: rec.creator };
 }
 
+// The legacy gas price a registry write is sent with: the chain's eth_gasPrice
+// plus 10 %, and 1 mwei at the least. The bloxberg testnet reports 1 mwei;
+// Amoy's Bor reports about 30 gwei and refuses a price under its 25 gwei
+// minimum tip; LitVM refuses a price under its base fee.
+const MIN_GAS_PRICE = ethers.utils.parseUnits('1', 'mwei');
+async function gasPrice(provider) {
+  const price = (await provider.getGasPrice()).mul(110).div(100);
+  return price.gt(MIN_GAS_PRICE) ? price : MIN_GAS_PRICE;
+}
+
 // Send `method(...args)` to the registry. It is simulated first, so a call
 // the registry refuses stops with the registry's reason (`refused` names the
-// call), then sent with its gas estimate plus 30%: a registration's cost
-// grows with the length of the name. The wallet signs for the chain its RPC
-// serves (ethers takes no chainId override on a contract call), so an RPC
-// serving another chain than `chainId` is refused before anything is sent.
+// call), then sent with its gas estimate plus 30% (a registration's cost
+// grows with the length of the name) at the chain's gas price. The wallet
+// signs for the chain its RPC serves (ethers takes no chainId override on a
+// contract call), so an RPC serving another chain than `chainId` is refused
+// before anything is sent.
 async function send(reg, chainId, refused, method, ...args) {
   const { chainId: served } = await reg.provider.getNetwork();
   if (served !== chainId) {
@@ -116,7 +127,7 @@ async function send(reg, chainId, refused, method, ...args) {
   }
   const gas = await reg.estimateGas[method](...args);
   const tx = await reg[method](...args, {
-    gasLimit: gas.mul(13).div(10), gasPrice: ethers.utils.parseUnits('1', 'mwei'),
+    gasLimit: gas.mul(13).div(10), gasPrice: await gasPrice(reg.provider),
   });
   const rcpt = await tx.wait();
   if (rcpt.status !== 1) throw new Error(`SessionRegistry.${method} reverted for ${refused} (tx ${tx.hash})`);

package/info.js

@@ -55,6 +55,15 @@ const NETWORKS = {
     imageRegistry: '0xAf8Ce29103E1f59feDD49688ff070Ffc2346AF1D',
     esr: '0x709052Fe77Af543d3d9FE2Ac06a15c635c8D4Be5',
   },
+  // The separate-ERC20 implementation 1.1 of 2026-10-28 on the storage and
+  // token of the previous implementation 0x1579b37C...; the V3 registry and
+  // the ESR of the same day.
+  POLYGON_AMOY_TESTNET: {
+    type: 'testnet', chainId: 80002, rpc: 'https://polygon-amoy-bor-rpc.publicnode.com',
+    protocol: '0xB8f46D2B943fFbe2A061Ae8be087ef5055AD96A3',
+    imageRegistry: '0x0C0f52ebd72cd2d2cBe94F385c9e23cec528b706',
+    esr: '0x1DC58496ed1cA66FD1E0b51fA28A9E7451970843',
+  },
   // The family of 2026-10-14, owned by 0xA247...; the previous PoX 0x29D3eC87...
   // and V1 registry 0x55e0ad45... are abandoned.
   ETHEREUM_SEPOLIA: {

package/init.js

@@ -215,6 +215,7 @@ const main = async () => {
     "Bloxberg Testnet Unsafe",
     "LitVM LiteForge Unsafe",
     "Ethereum Sepolia Unsafe",
+    "Polygon Amoy Testnet Unsafe",
   ];
   const blockchainNetwork = await promptOptions(
     "On which Blockchain network do you want to have the app set up, as a starting point? (default is Bloxberg Testnet): ",
@@ -392,6 +393,7 @@ const main = async () => {
     "Bloxberg Testnet Unsafe": `etny-${svc}-testnet-unsafe`,
     "LitVM LiteForge Unsafe": `ecld-${svc}-litvm-testnet-unsafe`,
     "Ethereum Sepolia Unsafe": `ecld-${svc}-ethereum-sepolia-unsafe`,
+    "Polygon Amoy Testnet Unsafe": `ecld-${svc}-amoy-unsafe`,
   };
   const trustedZoneImage = imageByNetwork[blockchainNetwork] || `etny-${svc}-testnet`;
   writeEnv("TRUSTED_ZONE_IMAGE", trustedZoneImage);

package/network.js

@@ -29,6 +29,8 @@ function networkFor({ ECAddress, ECNetworkByChainId }, raw) {
     POLYGON_MAINNET: { address: ECAddress.POLYGON.MAINNET_ADDRESS },
     POLYGON_AMOY: amoy,
     POLYGON_AMOY_TESTNET: amoy,
+    POLYGON_AMOY_UNSAFE: { ...amoy, unsafe: ['POLYGON', 'TESTNET_UNSAFE'] },
+    POLYGON_AMOY_TESTNET_UNSAFE: { ...amoy, unsafe: ['POLYGON', 'TESTNET_UNSAFE'] },
     IOTEX_TESTNET: { address: ECAddress.IOTEX.TESTNET_ADDRESS, chainId: ECNetworkByChainId.IOTEX.TESTNET, rpcUrl: 'https://babel-api.testnet.iotex.io' },
     ETHEREUM_SEPOLIA: sepolia,
     SEPOLIA: sepolia,

package/nodenithy/build/securelock/Dockerfile.tmpl

@@ -87,4 +87,6 @@ __SIGNED_MRENCLAVE__
 
 RUN rm -rf /enclave-key.pem
 
-ENTRYPOINT ["/usr/local/bin/node", "/etny-securelock/securelock.js"]
+# The node flags (build.mjs NODE_FLAGS) are also the CAS session's command and
+# the published .env's SECURELOCK_NODE_FLAGS; the composes run this ENTRYPOINT.
+ENTRYPOINT ["/usr/local/bin/node"__NODE_FLAGS__, "/etny-securelock/securelock.js"]

package/nodenithy/build/securelock/src/securelock.js.tmpl

@@ -21,6 +21,18 @@ const {executeTask} = require("./etny_exec");
 const {TaskStatus} = require("./task_status");
 const SwiftStreamService = require("./swift_stream_service");
 
+// An error a network socket emits after its request's caller has moved on
+// (a connection the server closed, ECONNRESET) reaches no handler of the
+// request; without these the node runtime exits on it, and the task is lost.
+// Logged and the run goes on: every step awaits its own result and treats a
+// failed one.
+process.on('uncaughtException', (e) => {
+    console.log('uncaught exception:', e && (e.stack || e.message) ? (e.stack || e.message) : e);
+});
+process.on('unhandledRejection', (e) => {
+    console.log('unhandled rejection:', e && (e.stack || e.message) ? (e.stack || e.message) : e);
+});
+
 const contract_abi = require('./pox_abi');
 const image_registry_abi = require('./image_registry_abi');
 const {sha256} = require("./etny_crypto");

package/nodenithy/build/securelock/src/swift_stream_service.js

@@ -1,13 +1,19 @@
 const Minio = require('minio');
+const http = require('http');
 const fs = require("fs");
 class SwiftStreamService {
     constructor(endpoint, port, accessKey, secretKey) {
+        // One connection per request: the minio client otherwise uses node's
+        // global agent, which keeps connections alive, and a connection the
+        // server has closed while this process computed between two requests
+        // fails the next request with ECONNRESET ("socket hang up").
         this.client = new Minio.Client({
             endPoint: endpoint,
             port: port,
             accessKey: accessKey,
             secretKey: secretKey,
             useSSL: false,
+            transportAgent: new http.Agent({ keepAlive: false }),
         });
     }
 

package/nodenithy/build.mjs

@@ -39,9 +39,11 @@ export const ECRunner = {
   // --- polygon mainnet ---
   'ecld-pynithy': ['0x439945BE73fD86fcC172179021991E96Beff3Cc4', '0x689f3806874d3c8A973f419a4eB24e6fBA7E830F', 'https://polygon-bor-rpc.publicnode.com', 137],
   'ecld-nodenithy': ['0x439945BE73fD86fcC172179021991E96Beff3Cc4', '0x689f3806874d3c8A973f419a4eB24e6fBA7E830F', 'https://polygon-bor-rpc.publicnode.com', 137],
-  // --- polygon amoy testnet (replaces deprecated mumbai) ---
-  'ecld-pynithy-amoy': ['0x1579b37C5a69ae02dDd23263A2b1318DE66a27C3', '0xeFA33c3976f31961285Ae4f5D10188616C912728', 'https://rpc-amoy.polygon.technology', 80002],
-  'ecld-nodenithy-amoy': ['0x1579b37C5a69ae02dDd23263A2b1318DE66a27C3', '0xeFA33c3976f31961285Ae4f5D10188616C912728', 'https://rpc-amoy.polygon.technology', 80002],
+  // --- polygon amoy testnet: the separate-ERC20 PoX EthernityImplementationV2 1.1 and the ECImageRegistryV3 of 2026-10-28 ---
+  'ecld-pynithy-amoy': ['0xB8f46D2B943fFbe2A061Ae8be087ef5055AD96A3', '0x0C0f52ebd72cd2d2cBe94F385c9e23cec528b706', 'https://polygon-amoy-bor-rpc.publicnode.com', 80002],
+  'ecld-nodenithy-amoy': ['0xB8f46D2B943fFbe2A061Ae8be087ef5055AD96A3', '0x0C0f52ebd72cd2d2cBe94F385c9e23cec528b706', 'https://polygon-amoy-bor-rpc.publicnode.com', 80002],
+  'ecld-pynithy-amoy-unsafe': ['0xB8f46D2B943fFbe2A061Ae8be087ef5055AD96A3', '0x0C0f52ebd72cd2d2cBe94F385c9e23cec528b706', 'https://polygon-amoy-bor-rpc.publicnode.com', 80002],
+  'ecld-nodenithy-amoy-unsafe': ['0xB8f46D2B943fFbe2A061Ae8be087ef5055AD96A3', '0x0C0f52ebd72cd2d2cBe94F385c9e23cec528b706', 'https://polygon-amoy-bor-rpc.publicnode.com', 80002],
   // --- iotex testnet ---
   'ecld-pynithy-iotex-testnet': ['0xD56385A97413Ed80E28B1b54A193b98F2C49c975', '0xa7467A6391816be9367a1cC52E0ef0c15FfE3cCC', 'https://babel-api.testnet.iotex.io', 4690],
   'ecld-nodenithy-iotex-testnet': ['0xD56385A97413Ed80E28B1b54A193b98F2C49c975', '0xa7467A6391816be9367a1cC52E0ef0c15FfE3cCC', 'https://babel-api.testnet.iotex.io', 4690],
@@ -68,6 +70,7 @@ export const ECRunner = {
 // matching SessionRegistry.
 const require = createRequire(import.meta.url);
 const casConfig = require('../cas/config.js');
+const nodeFlags = require('./nodeFlags.js');
 export const VALIDATOR_REGISTRY = casConfig.VALIDATOR_REGISTRY;
 
 // An -unsafe network runs an -unsafe trustedzone and nothing else, and an
@@ -215,6 +218,8 @@ const trustedZoneNetByBlockchain = {
   LitVM_LiteForge: 'litvm_liteforge',
   Bloxberg_Testnet_Unsafe: 'bloxberg_testnet_unsafe',
   LitVM_LiteForge_Unsafe: 'litvm_liteforge_unsafe',
+  Ethereum_Sepolia_Unsafe: 'ethereum_sepolia_unsafe',
+  Polygon_Amoy_Testnet_Unsafe: 'amoy_unsafe',
 };
 const trustedZoneNet = trustedZoneNetByBlockchain[process.env.BLOCKCHAIN_NETWORK];
 if (!trustedZoneNet) {
@@ -263,14 +268,17 @@ const esrEnvBlock = ESR_ENABLED ? `ENV ESR_CONTRACT_ADDRESS=${ESR_CONTRACT_ADDRE
 const dockerfileSecureTemplate = fs.readFileSync('Dockerfile.tmpl', 'utf8');
 let dockerfileSecureContent = dockerfileSecureTemplate.replace(/__ENCLAVE_NAME_SECURELOCK__/g, ENCLAVE_NAME_SECURELOCK).replace(/__NETWORK_TYPE__/g, isMainnet ? 'mainnet' : 'testnet').replace(/__BUCKET_NAME__/g, templateName + "-v3").replace(/__SMART_CONTRACT_ADDRESS__/g, ECRunner[templateName][0]).replace(/__IMAGE_REGISTRY_ADDRESS__/g, ECRunner[templateName][1]).replace(/__RPC_URL__/g, ECRunner[templateName][2]).replace(/__CHAIN_ID__/g, ECRunner[templateName][3]).replace(/__ETNY_VALIDATOR_REGISTRY_ADDRESS__/g, VALIDATOR_REGISTRY[templateName] || '').replace(/^__ESR_ENV__\r?\n/m, esrEnvBlock ? `${esrEnvBlock}\n` : '');
 
-// Amount of enclave heap to allocate (SCONE_HEAP). Kept in sync with the
-// run/docker-compose securelock service; overridable via ECLD_MEMORY_TO_ALLOCATE.
-// 1024M: with 256M or 512M the node runtime exhausts the protected heap
-// reserving its V8 code range at start, before the securelock runs.
+// The securelock's protected heap (SCONE_HEAP), signed into the enclave and
+// set on the run/docker-compose securelock service; ECLD_MEMORY_TO_ALLOCATE
+// overrides the default. The default 1024M keeps V8's JIT, whose code range
+// (512 MB, reserved at start) fits no smaller heap; a heap under 1024M runs
+// node --jitless (nodeFlags.js), the backend's JavaScript interpreted.
 const MEMORY_TO_ALLOCATE = (process.env.ECLD_MEMORY_TO_ALLOCATE || '1024M').trim();
-// Read back by ecld-publish (run.js), which renders it into the composes'
-// securelock service.
+const NODE_FLAGS = nodeFlags.securelockNodeFlags(MEMORY_TO_ALLOCATE);
+// Read back by ecld-publish (run.js), which renders them into the composes'
+// securelock service and the CAS session's command.
 writeEnv('MEMORY_TO_ALLOCATE', MEMORY_TO_ALLOCATE);
+writeEnv('SECURELOCK_NODE_FLAGS', NODE_FLAGS.join(' '));
 
 // CRITICAL (mainnet DCAP): sign /usr/local/bin/node -- the binary the enclave
 // actually EXECUTES (ENTRYPOINT + the run/publish compose command both run
@@ -303,6 +311,7 @@ const signedMrenclaveStep =
 const cas = casConfig.casProvisioned(templateName, isMainnet);
 dockerfileSecureContent = dockerfileSecureContent
   .replace(/__MEMORY_TO_ALLOCATE__/g, MEMORY_TO_ALLOCATE)
+  .replace(/__NODE_FLAGS__/g, NODE_FLAGS.map((flag) => `, "${flag}"`).join(''))
   .replace('__SCONE_SIGN__', `RUN scone-signer sign ${signFlags}${cas ? ' --production' : ''} /usr/local/bin/node`)
   .replace('__SIGNED_MRENCLAVE__', signedMrenclaveStep);
 

package/nodenithy/nodeFlags.js

@@ -0,0 +1,24 @@
+// The node flags the securelock is built and run with, derived from its
+// protected heap (SCONE_HEAP). V8 reserves a 512 MB code range for its JIT at
+// start, which fits a 1024M heap and not a smaller one; a smaller heap runs
+// node --jitless, which reserves no code range and runs JavaScript
+// interpreted. ECLD_NODE_JITLESS=1 or 0 overrides the derivation.
+const MEBIBYTE = 1024 * 1024;
+const JIT_HEAP_BYTES = 1024 * MEBIBYTE;
+
+// Bytes of a SCONE_HEAP value: a whole number with an optional K, M or G.
+const heapBytes = (heap) => {
+    const m = /^(\d+)([KMG])?$/i.exec(String(heap).trim());
+    if (!m) throw new Error(`heap ${JSON.stringify(heap)}: expected <n>, <n>K, <n>M or <n>G`);
+    const unit = { K: 1024, M: MEBIBYTE, G: 1024 * MEBIBYTE }[(m[2] || '').toUpperCase()] || 1;
+    return Number(m[1]) * unit;
+};
+
+const securelockNodeFlags = (heap, override = process.env.ECLD_NODE_JITLESS) => {
+    const jitless = override === undefined || String(override).trim() === ''
+        ? heapBytes(heap) < JIT_HEAP_BYTES
+        : /^(1|true|yes)$/i.test(String(override).trim());
+    return jitless ? ['--jitless'] : [];
+};
+
+module.exports = { securelockNodeFlags, heapBytes, JIT_HEAP_BYTES };

package/nodenithy/run/docker-compose-final.yml.tmpl

@@ -30,8 +30,8 @@ services:
     container_name: etny-securelock
     privileged: true
     image: localhost:5000/etny-securelock
-    entrypoint: ""
-    command: [ "/usr/local/bin/node", "/etny-securelock/securelock.js" ]
+    # No command: the image's ENTRYPOINT runs node with the flags the
+    # securelock was built and measured with (build.mjs NODE_FLAGS).
     environment:
       - SCONE_CAS_ADDR=scone-cas.cf  # __CAS_ONLY__
       - SCONE_LAS_ADDR=las  # __CAS_ONLY__

package/nodenithy/run/docker-compose.yml.tmpl

@@ -33,8 +33,8 @@ services:
     container_name: etny-securelock
     privileged: true
     image: localhost:5000/etny-securelock
-    entrypoint: ""
-    command: [ "/usr/local/bin/node", "/etny-securelock/securelock.js" ]
+    # No command: the image's ENTRYPOINT runs node with the flags the
+    # securelock was built and measured with (build.mjs NODE_FLAGS).
     environment:
       - SCONE_CAS_ADDR=scone-cas.cf  # __CAS_ONLY__
       - SCONE_LAS_ADDR=las  # __CAS_ONLY__

package/nodenithy/run/etny-securelock-test.yaml.tpl

@@ -16,7 +16,9 @@ services:
    - name: application
      image_name: application_image
      mrenclaves: [ "__MRENCLAVE__" ]
-     command: /usr/local/bin/node /etny-securelock/securelock.js
+     # The command the enclave runs, applied from the session at attestation:
+     # the image ENTRYPOINT's, with the build's node flags (run.js NODE_FLAGS).
+     command: /usr/local/bin/node __NODE_FLAGS__/etny-securelock/securelock.js
      pwd: /
      environment:
         GREETING: hello from ETNY SECURELOCK!!!!

package/nodenithy/run/image_registry.js

@@ -25,17 +25,19 @@ function setVars(network = "") {
             : "0x15D73a742529C3fb11f3FA32EF7f0CC3870ACA31";
     } else if (BLOCKCHAIN_NETWORK.includes("Polygon")) {
         if (BLOCKCHAIN_NETWORK.includes("Mainnet")) {
-            NETWORK_RPC = "https://polygon-rpc.com";
+            NETWORK_RPC = "https://polygon-bor-rpc.publicnode.com";
             IMAGE_REGISTRY_ADDRESS = "0x689f3806874d3c8A973f419a4eB24e6fBA7E830F";
             CHAIN_ID = 137;
             GAS = 20000000;
             GAS_PRICE = 40500500010;
         } else {
+            // Amoy's ECImageRegistryV3 of 2026-10-28; the chain's base fee is
+            // about 30 gwei.
             NETWORK_RPC = "https://polygon-amoy-bor-rpc.publicnode.com";
-            IMAGE_REGISTRY_ADDRESS = "0xF7F4eEb3d9a64387F4AcEb6d521b948E6E2fB049";
+            IMAGE_REGISTRY_ADDRESS = "0x0C0f52ebd72cd2d2cBe94F385c9e23cec528b706";
             CHAIN_ID = 80002;
             GAS = 20000000;
-            GAS_PRICE = 1300000010;
+            GAS_PRICE = 40000000010;
         }
     } else if (BLOCKCHAIN_NETWORK.includes("LitVM")) {
         NETWORK_RPC = "https://liteforge.rpc.caldera.xyz/infra-partner-http";

package/nodenithy/run.js

@@ -325,10 +325,15 @@ const main = async () => {
         PREDECESSOR_HASH_SECURELOCK = 'EMPTY';
     }
 
+    // The node flags the build gave the securelock (.env SECURELOCK_NODE_FLAGS,
+    // build.mjs): the session's command runs node with the same flags as the
+    // image ENTRYPOINT. A .env without the key is a build without flags.
+    const nodeFlags = (process.env.SECURELOCK_NODE_FLAGS || '').trim();
     const replacementsSecurelock = {
         PREDECESSOR: PREDECESSOR_HASH_SECURELOCK === 'EMPTY' ? `# predecessor: ${PREDECESSOR_HASH_SECURELOCK}` : `predecessor: ${PREDECESSOR_HASH_SECURELOCK}`,
         MRENCLAVE: process.env.MRENCLAVE_SECURELOCK,
         ENCLAVE_NAME: ENCLAVE_NAME_SECURELOCK,
+        NODE_FLAGS: nodeFlags ? `${nodeFlags} ` : '',
         ESR_ENVIRONMENT: casConfig.esrSessionEnvironment(process.env)
     };
     if (cas) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ethernity-cloud/sdk-js",
-  "version": "1.7.20",
+  "version": "1.7.28",
   "description": "A package to run ethernity cloud build scripts",
   "scripts": {
     "test": "node --test \"test/**/*.test.js\"",

package/pynithy/build.mjs

@@ -39,9 +39,11 @@ export const ECRunner = {
   // --- polygon mainnet ---
   'ecld-pynithy': ['0x439945BE73fD86fcC172179021991E96Beff3Cc4', '0x689f3806874d3c8A973f419a4eB24e6fBA7E830F', 'https://polygon-bor-rpc.publicnode.com', 137],
   'ecld-nodenithy': ['0x439945BE73fD86fcC172179021991E96Beff3Cc4', '0x689f3806874d3c8A973f419a4eB24e6fBA7E830F', 'https://polygon-bor-rpc.publicnode.com', 137],
-  // --- polygon amoy testnet (replaces deprecated mumbai) ---
-  'ecld-pynithy-amoy': ['0x1579b37C5a69ae02dDd23263A2b1318DE66a27C3', '0xeFA33c3976f31961285Ae4f5D10188616C912728', 'https://rpc-amoy.polygon.technology', 80002],
-  'ecld-nodenithy-amoy': ['0x1579b37C5a69ae02dDd23263A2b1318DE66a27C3', '0xeFA33c3976f31961285Ae4f5D10188616C912728', 'https://rpc-amoy.polygon.technology', 80002],
+  // --- polygon amoy testnet: the separate-ERC20 PoX EthernityImplementationV2 1.1 and the ECImageRegistryV3 of 2026-10-28 ---
+  'ecld-pynithy-amoy': ['0xB8f46D2B943fFbe2A061Ae8be087ef5055AD96A3', '0x0C0f52ebd72cd2d2cBe94F385c9e23cec528b706', 'https://polygon-amoy-bor-rpc.publicnode.com', 80002],
+  'ecld-nodenithy-amoy': ['0xB8f46D2B943fFbe2A061Ae8be087ef5055AD96A3', '0x0C0f52ebd72cd2d2cBe94F385c9e23cec528b706', 'https://polygon-amoy-bor-rpc.publicnode.com', 80002],
+  'ecld-pynithy-amoy-unsafe': ['0xB8f46D2B943fFbe2A061Ae8be087ef5055AD96A3', '0x0C0f52ebd72cd2d2cBe94F385c9e23cec528b706', 'https://polygon-amoy-bor-rpc.publicnode.com', 80002],
+  'ecld-nodenithy-amoy-unsafe': ['0xB8f46D2B943fFbe2A061Ae8be087ef5055AD96A3', '0x0C0f52ebd72cd2d2cBe94F385c9e23cec528b706', 'https://polygon-amoy-bor-rpc.publicnode.com', 80002],
   // --- iotex testnet ---
   'ecld-pynithy-iotex-testnet': ['0xD56385A97413Ed80E28B1b54A193b98F2C49c975', '0xa7467A6391816be9367a1cC52E0ef0c15FfE3cCC', 'https://babel-api.testnet.iotex.io', 4690],
   'ecld-nodenithy-iotex-testnet': ['0xD56385A97413Ed80E28B1b54A193b98F2C49c975', '0xa7467A6391816be9367a1cC52E0ef0c15FfE3cCC', 'https://babel-api.testnet.iotex.io', 4690],

package/pynithy/run/image_registry.js

@@ -25,17 +25,19 @@ function setVars(network = "") {
             : "0x15D73a742529C3fb11f3FA32EF7f0CC3870ACA31";
     } else if (BLOCKCHAIN_NETWORK.includes("Polygon")) {
         if (BLOCKCHAIN_NETWORK.includes("Mainnet")) {
-            NETWORK_RPC = "https://polygon-rpc.com";
+            NETWORK_RPC = "https://polygon-bor-rpc.publicnode.com";
             IMAGE_REGISTRY_ADDRESS = "0x689f3806874d3c8A973f419a4eB24e6fBA7E830F";
             CHAIN_ID = 137;
             GAS = 20000000;
             GAS_PRICE = 40500500010;
         } else {
+            // Amoy's ECImageRegistryV3 of 2026-10-28; the chain's base fee is
+            // about 30 gwei.
             NETWORK_RPC = "https://polygon-amoy-bor-rpc.publicnode.com";
-            IMAGE_REGISTRY_ADDRESS = "0xF7F4eEb3d9a64387F4AcEb6d521b948E6E2fB049";
+            IMAGE_REGISTRY_ADDRESS = "0x0C0f52ebd72cd2d2cBe94F385c9e23cec528b706";
             CHAIN_ID = 80002;
             GAS = 20000000;
-            GAS_PRICE = 1300000010;
+            GAS_PRICE = 40000000010;
         }
     } else if (BLOCKCHAIN_NETWORK.includes("LitVM")) {
         NETWORK_RPC = "https://liteforge.rpc.caldera.xyz/infra-partner-http";