@le-space/rootfs 0.6.3 → 0.6.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@le-space/rootfs",
-  "version": "0.6.3",
+  "version": "0.6.5",
   "description": "Shared rootfs contract parsing, reference profile assets, and build helpers.",
   "license": "MIT",
   "type": "module",

package/reference/orbitdb-relay/rootfs/orbitdb-relay-bootstrap-refresh.py

@@ -27,10 +27,16 @@ DESCRIBE_SCRIPT = os.environ.get(
 DEFAULT_API_HOST = os.environ.get("ALEPH_BOOTSTRAP_API_HOST", "https://api.aleph.im")
 DEFAULT_CHANNEL = os.environ.get("ALEPH_BOOTSTRAP_CHANNEL", "simple-todo")
 DEFAULT_REF = os.environ.get("ALEPH_BOOTSTRAP_REF", "simple-todo-bootstrap")
-DEFAULT_POST_TYPE = os.environ.get("ALEPH_BOOTSTRAP_POST_TYPE", "relay-bootstrap")
+COMPACT_POST_TYPE = "relay-bootstrap-v2"
+LEGACY_POST_TYPE = "relay-bootstrap"
+DEFAULT_POST_TYPE = os.environ.get("ALEPH_BOOTSTRAP_POST_TYPE", COMPACT_POST_TYPE)
 DEFAULT_PROFILE = os.environ.get("ALEPH_BOOTSTRAP_PROFILE", "orbitdb-relay")
 MAX_PREVIOUS_PAGES = int(os.environ.get("ALEPH_BOOTSTRAP_MAX_PREVIOUS_PAGES", "5"))
 PAGINATION = int(os.environ.get("ALEPH_BOOTSTRAP_PAGINATION", "50"))
+COMPACT_MULTIADDR_LIMIT = int(os.environ.get("ALEPH_BOOTSTRAP_COMPACT_MULTIADDR_LIMIT", "3"))
+STALE_RECORD_MAX_AGE_SECONDS = int(
+    os.environ.get("ALEPH_BOOTSTRAP_STALE_RECORD_MAX_AGE_SECONDS", str(6 * 60 * 60))
+)
 
 
 def parse_env_file(path: str) -> dict[str, str]:
@@ -112,6 +118,28 @@ def filter_public_multiaddrs(values: list[str], browser_only: bool = False) -> l
     return dedupe(filtered)
 
 
+def browser_multiaddr_preference(addr: str) -> int:
+    normalized = addr.lower()
+    if "/tcp/443/tls/ws/" in normalized:
+        return 0
+    if "/tls/ws/" in normalized:
+        return 1
+    if "/webtransport/" in normalized:
+        return 2
+    if "/webrtc-direct/" in normalized:
+        return 3
+    if "/ws" in normalized:
+        return 4
+    return 5
+
+
+def select_compact_multiaddrs(values: list[str]) -> list[str]:
+    public_browser_addrs = filter_public_multiaddrs(values, browser_only=True)
+    return sorted(public_browser_addrs, key=browser_multiaddr_preference)[
+        : max(1, COMPACT_MULTIADDR_LIMIT)
+    ]
+
+
 def json_dumps(payload: object) -> str:
     return json.dumps(payload, separators=(",", ":"))
 
@@ -339,60 +367,82 @@ def parse_post_record(entry: object) -> dict[str, object] | None:
         except json.JSONDecodeError:
             item_content = None
 
-    if not isinstance(item_content, dict):
-        return None
-
-    content = item_content.get("content")
+    content_source = item_content if isinstance(item_content, dict) else entry
+    content = content_source.get("content")
     if not isinstance(content, dict):
         return None
 
     return {
         "item_hash": item_hash,
         "sender": sender,
+        "publisher_address": content.get("publisherAddress"),
         "registration_id": content.get("registrationId"),
+        "peer_id": content.get("peerId"),
+        "profile": content.get("profile"),
+        "updated_at": content.get("updatedAt"),
     }
 
 
+def normalize_address(value: object) -> str:
+    return str(value or "").strip().lower()
+
+
+def timestamp_ms(value: object) -> int | None:
+    if isinstance(value, bool):
+        return None
+    if isinstance(value, (int, float)):
+        return int(value)
+    if isinstance(value, str):
+        stripped = value.strip()
+        if stripped.isdigit():
+            return int(stripped)
+    return None
+
+
 def fetch_previous_hashes(
     api_host: str,
     channel: str,
     ref: str,
-    post_type: str,
+    post_types: list[str],
     sender: str,
-    registration_id: str | None,
     current_item_hash: str,
+    now_ms: int,
 ) -> list[str]:
-    if not registration_id:
-        return []
-
+    stale_cutoff_ms = now_ms - (STALE_RECORD_MAX_AGE_SECONDS * 1000)
+    normalized_sender = normalize_address(sender)
     found: list[str] = []
-    for page in range(1, MAX_PREVIOUS_PAGES + 1):
-        url = (
-            f"{api_host.rstrip('/')}/api/v0/posts.json?"
-            f"channels={urllib.parse.quote(channel)}&"
-            f"refs={urllib.parse.quote(ref)}&"
-            f"types={urllib.parse.quote(post_type)}&"
-            f"pagination={PAGINATION}&page={page}"
-        )
-        payload = get_json(url)
-        posts = payload.get("posts")
-        if not isinstance(posts, list):
-            break
-
-        for entry in posts:
-            parsed = parse_post_record(entry)
-            if parsed is None:
-                continue
-            if str(parsed["sender"]).lower() != sender.lower():
-                continue
-            if parsed["registration_id"] != registration_id:
-                continue
-            if parsed["item_hash"] == current_item_hash:
-                continue
-            found.append(str(parsed["item_hash"]))
-
-        if len(posts) < PAGINATION:
-            break
+    for post_type in post_types:
+        for page in range(1, MAX_PREVIOUS_PAGES + 1):
+            url = (
+                f"{api_host.rstrip('/')}/api/v0/posts.json?"
+                f"channels={urllib.parse.quote(channel)}&"
+                f"refs={urllib.parse.quote(ref)}&"
+                f"types={urllib.parse.quote(post_type)}&"
+                f"pagination={PAGINATION}&page={page}"
+            )
+            payload = get_json(url)
+            posts = payload.get("posts")
+            if not isinstance(posts, list):
+                break
+
+            for entry in posts:
+                parsed = parse_post_record(entry)
+                if parsed is None:
+                    continue
+                same_publisher = normalized_sender in {
+                    normalize_address(parsed["sender"]),
+                    normalize_address(parsed["publisher_address"]),
+                }
+                if not same_publisher:
+                    continue
+                if parsed["item_hash"] == current_item_hash:
+                    continue
+                updated_at = timestamp_ms(parsed["updated_at"])
+                if updated_at is not None and updated_at < stale_cutoff_ms:
+                    found.append(str(parsed["item_hash"]))
+
+            if len(posts) < PAGINATION:
+                break
 
     return dedupe(found)
 
@@ -448,9 +498,6 @@ def main() -> None:
     browser_multiaddrs = filter_public_multiaddrs(
         metadata.get("browser_bootstrap_multiaddrs") or [], browser_only=True
     )
-    if not multiaddrs:
-        print(json_dumps({"status": "skipped", "reason": "no public multiaddrs"}))
-        return
 
     publisher_address = address_from_private_key(publisher_private_key)
     now_ms = int(time.time() * 1000)
@@ -461,6 +508,17 @@ def main() -> None:
     ref = env_values.get("ALEPH_BOOTSTRAP_REF", DEFAULT_REF).strip() or DEFAULT_REF
     post_type = env_values.get("ALEPH_BOOTSTRAP_POST_TYPE", DEFAULT_POST_TYPE).strip() or DEFAULT_POST_TYPE
     api_host = env_values.get("ALEPH_BOOTSTRAP_API_HOST", DEFAULT_API_HOST).strip() or DEFAULT_API_HOST
+    compact = post_type == COMPACT_POST_TYPE
+    published_multiaddrs = (
+        select_compact_multiaddrs(browser_multiaddrs or multiaddrs)
+        if compact
+        else multiaddrs
+    )
+    published_browser_multiaddrs = [] if compact else browser_multiaddrs
+    if not published_multiaddrs:
+        reason = "no public browser multiaddrs" if compact else "no public multiaddrs"
+        print(json_dumps({"status": "skipped", "reason": reason}))
+        return
 
     owner_authorization = load_owner_authorization(
         env_values,
@@ -477,8 +535,8 @@ def main() -> None:
 
     proof_payload = relay_proof_payload(
         peer_id,
-        multiaddrs,
-        browser_multiaddrs,
+        published_multiaddrs,
+        published_browser_multiaddrs,
         registration_id,
         profile,
         version,
@@ -492,8 +550,8 @@ def main() -> None:
     post_content = build_post_content(
         publisher_address,
         peer_id,
-        multiaddrs,
-        browser_multiaddrs,
+        published_multiaddrs,
+        published_browser_multiaddrs,
         registration_id,
         profile,
         version,
@@ -514,10 +572,10 @@ def main() -> None:
         api_host,
         channel,
         ref,
-        post_type,
+        [post_type, LEGACY_POST_TYPE] if compact else [post_type],
         publisher_address,
-        registration_id,
         str(unsigned_message["item_hash"]),
+        now_ms,
     )
     forget_response = broadcast_forget(
         api_host, publisher_address, publisher_private_key, previous_hashes, channel
@@ -531,9 +589,10 @@ def main() -> None:
                 "itemHash": unsigned_message["item_hash"],
                 "sender": publisher_address,
                 "peerId": peer_id,
-                "publishedMultiaddrs": multiaddrs,
-                "publishedBrowserMultiaddrs": browser_multiaddrs,
+                "publishedMultiaddrs": published_multiaddrs,
+                "publishedBrowserMultiaddrs": published_browser_multiaddrs or published_multiaddrs,
                 "forgottenHashes": previous_hashes,
+                "forgetStaleOlderThanSeconds": STALE_RECORD_MAX_AGE_SECONDS,
                 "forgetResponse": forget_response[1] if forget_response else None,
                 "response": response,
             }

package/reference/uc-go-peer/rootfs/uc-go-peer-bootstrap-refresh.py

@@ -25,10 +25,16 @@ DESCRIBE_SCRIPT = os.environ.get("DESCRIBE_SCRIPT", "/usr/local/sbin/uc-go-peer-
 DEFAULT_API_HOST = os.environ.get("ALEPH_BOOTSTRAP_API_HOST", "https://api.aleph.im")
 DEFAULT_CHANNEL = os.environ.get("ALEPH_BOOTSTRAP_CHANNEL", "simple-todo")
 DEFAULT_REF = os.environ.get("ALEPH_BOOTSTRAP_REF", "simple-todo-bootstrap")
-DEFAULT_POST_TYPE = os.environ.get("ALEPH_BOOTSTRAP_POST_TYPE", "relay-bootstrap")
+COMPACT_POST_TYPE = "relay-bootstrap-v2"
+LEGACY_POST_TYPE = "relay-bootstrap"
+DEFAULT_POST_TYPE = os.environ.get("ALEPH_BOOTSTRAP_POST_TYPE", COMPACT_POST_TYPE)
 DEFAULT_PROFILE = os.environ.get("ALEPH_BOOTSTRAP_PROFILE", "uc-go-peer")
 MAX_PREVIOUS_PAGES = int(os.environ.get("ALEPH_BOOTSTRAP_MAX_PREVIOUS_PAGES", "5"))
 PAGINATION = int(os.environ.get("ALEPH_BOOTSTRAP_PAGINATION", "50"))
+COMPACT_MULTIADDR_LIMIT = int(os.environ.get("ALEPH_BOOTSTRAP_COMPACT_MULTIADDR_LIMIT", "3"))
+STALE_RECORD_MAX_AGE_SECONDS = int(
+    os.environ.get("ALEPH_BOOTSTRAP_STALE_RECORD_MAX_AGE_SECONDS", str(6 * 60 * 60))
+)
 
 
 def parse_env_file(path: str) -> dict[str, str]:
@@ -110,6 +116,28 @@ def filter_public_multiaddrs(values: list[str], browser_only: bool = False) -> l
     return dedupe(filtered)
 
 
+def browser_multiaddr_preference(addr: str) -> int:
+    normalized = addr.lower()
+    if "/tcp/443/tls/ws/" in normalized:
+        return 0
+    if "/tls/ws/" in normalized:
+        return 1
+    if "/webtransport/" in normalized:
+        return 2
+    if "/webrtc-direct/" in normalized:
+        return 3
+    if "/ws" in normalized:
+        return 4
+    return 5
+
+
+def select_compact_multiaddrs(values: list[str]) -> list[str]:
+    public_browser_addrs = filter_public_multiaddrs(values, browser_only=True)
+    return sorted(public_browser_addrs, key=browser_multiaddr_preference)[
+        : max(1, COMPACT_MULTIADDR_LIMIT)
+    ]
+
+
 def json_dumps(payload: object) -> str:
     return json.dumps(payload, separators=(",", ":"))
 
@@ -413,60 +441,82 @@ def parse_post_record(entry: object) -> dict[str, object] | None:
         except json.JSONDecodeError:
             item_content = None
 
-    if not isinstance(item_content, dict):
-        return None
-
-    content = item_content.get("content")
+    content_source = item_content if isinstance(item_content, dict) else entry
+    content = content_source.get("content")
     if not isinstance(content, dict):
         return None
 
     return {
         "item_hash": item_hash,
         "sender": sender,
+        "publisher_address": content.get("publisherAddress"),
         "registration_id": content.get("registrationId"),
+        "peer_id": content.get("peerId"),
+        "profile": content.get("profile"),
+        "updated_at": content.get("updatedAt"),
     }
 
 
+def normalize_address(value: object) -> str:
+    return str(value or "").strip().lower()
+
+
+def timestamp_ms(value: object) -> int | None:
+    if isinstance(value, bool):
+        return None
+    if isinstance(value, (int, float)):
+        return int(value)
+    if isinstance(value, str):
+        stripped = value.strip()
+        if stripped.isdigit():
+            return int(stripped)
+    return None
+
+
 def fetch_previous_hashes(
     api_host: str,
     channel: str,
     ref: str,
-    post_type: str,
+    post_types: list[str],
     sender: str,
-    registration_id: str | None,
     current_item_hash: str,
+    now_ms: int,
 ) -> list[str]:
-    if not registration_id:
-        return []
-
+    stale_cutoff_ms = now_ms - (STALE_RECORD_MAX_AGE_SECONDS * 1000)
+    normalized_sender = normalize_address(sender)
     found: list[str] = []
-    for page in range(1, MAX_PREVIOUS_PAGES + 1):
-        url = (
-            f"{api_host.rstrip('/')}/api/v0/posts.json?"
-            f"channels={urllib.parse.quote(channel)}&"
-            f"refs={urllib.parse.quote(ref)}&"
-            f"types={urllib.parse.quote(post_type)}&"
-            f"pagination={PAGINATION}&page={page}"
-        )
-        payload = get_json(url)
-        posts = payload.get("posts")
-        if not isinstance(posts, list):
-            break
-
-        for entry in posts:
-            parsed = parse_post_record(entry)
-            if parsed is None:
-                continue
-            if str(parsed["sender"]).lower() != sender.lower():
-                continue
-            if parsed["registration_id"] != registration_id:
-                continue
-            if parsed["item_hash"] == current_item_hash:
-                continue
-            found.append(str(parsed["item_hash"]))
-
-        if len(posts) < PAGINATION:
-            break
+    for post_type in post_types:
+        for page in range(1, MAX_PREVIOUS_PAGES + 1):
+            url = (
+                f"{api_host.rstrip('/')}/api/v0/posts.json?"
+                f"channels={urllib.parse.quote(channel)}&"
+                f"refs={urllib.parse.quote(ref)}&"
+                f"types={urllib.parse.quote(post_type)}&"
+                f"pagination={PAGINATION}&page={page}"
+            )
+            payload = get_json(url)
+            posts = payload.get("posts")
+            if not isinstance(posts, list):
+                break
+
+            for entry in posts:
+                parsed = parse_post_record(entry)
+                if parsed is None:
+                    continue
+                same_publisher = normalized_sender in {
+                    normalize_address(parsed["sender"]),
+                    normalize_address(parsed["publisher_address"]),
+                }
+                if not same_publisher:
+                    continue
+                if parsed["item_hash"] == current_item_hash:
+                    continue
+                updated_at = timestamp_ms(parsed["updated_at"])
+                if updated_at is not None and updated_at < stale_cutoff_ms:
+                    found.append(str(parsed["item_hash"]))
+
+            if len(posts) < PAGINATION:
+                break
 
     return dedupe(found)
 
@@ -522,9 +572,6 @@ def main() -> None:
     browser_multiaddrs = filter_public_multiaddrs(
         metadata.get("browser_bootstrap_multiaddrs") or [], browser_only=True
     )
-    if not multiaddrs:
-        print(json_dumps({"status": "skipped", "reason": "no public multiaddrs"}))
-        return
 
     publisher_address = address_from_private_key(publisher_private_key)
     now_ms = int(time.time() * 1000)
@@ -535,6 +582,17 @@ def main() -> None:
     ref = env_values.get("ALEPH_BOOTSTRAP_REF", DEFAULT_REF).strip() or DEFAULT_REF
     post_type = env_values.get("ALEPH_BOOTSTRAP_POST_TYPE", DEFAULT_POST_TYPE).strip() or DEFAULT_POST_TYPE
     api_host = env_values.get("ALEPH_BOOTSTRAP_API_HOST", DEFAULT_API_HOST).strip() or DEFAULT_API_HOST
+    compact = post_type == COMPACT_POST_TYPE
+    published_multiaddrs = (
+        select_compact_multiaddrs(browser_multiaddrs or multiaddrs)
+        if compact
+        else multiaddrs
+    )
+    published_browser_multiaddrs = [] if compact else browser_multiaddrs
+    if not published_multiaddrs:
+        reason = "no public browser multiaddrs" if compact else "no public multiaddrs"
+        print(json_dumps({"status": "skipped", "reason": reason}))
+        return
 
     owner_authorization = load_owner_authorization(
         env_values,
@@ -549,8 +607,8 @@ def main() -> None:
 
     proof_payload = relay_proof_payload(
         peer_id,
-        multiaddrs,
-        browser_multiaddrs,
+        published_multiaddrs,
+        published_browser_multiaddrs,
         registration_id,
         profile,
         version,
@@ -564,8 +622,8 @@ def main() -> None:
     post_content = build_post_content(
         publisher_address,
         peer_id,
-        multiaddrs,
-        browser_multiaddrs,
+        published_multiaddrs,
+        published_browser_multiaddrs,
         registration_id,
         profile,
         version,
@@ -588,10 +646,10 @@ def main() -> None:
         api_host,
         channel,
         ref,
-        post_type,
+        [post_type, LEGACY_POST_TYPE] if compact else [post_type],
         publisher_address,
-        registration_id,
         str(unsigned_message["item_hash"]),
+        now_ms,
     )
     forget_response = broadcast_forget(
         api_host, publisher_address, publisher_private_key, previous_hashes, channel
@@ -605,9 +663,10 @@ def main() -> None:
                 "itemHash": unsigned_message["item_hash"],
                 "sender": publisher_address,
                 "peerId": peer_id,
-                "publishedMultiaddrs": multiaddrs,
-                "publishedBrowserMultiaddrs": browser_multiaddrs,
+                "publishedMultiaddrs": published_multiaddrs,
+                "publishedBrowserMultiaddrs": published_browser_multiaddrs or published_multiaddrs,
                 "forgottenHashes": previous_hashes,
+                "forgetStaleOlderThanSeconds": STALE_RECORD_MAX_AGE_SECONDS,
                 "ownerAuthorizationPresent": owner_authorization is not None,
                 "forgetResponse": forget_response[1] if forget_response else None,
                 "response": response,

package/reference/ucan-store/rootfs/ucan-store-bootstrap.sh

@@ -131,6 +131,9 @@ EOF
   write_env_var "PUBLIC_RECEIPTS_URL" ""
 
   rm -f "${BOOTSTRAP_PACKAGE_FILE}" "${BOOTSTRAP_VERIFICATION_FILE}"
+
+  # Caddy is started explicitly after /configure writes the deployment hostname.
+  systemctl disable caddy.service >/dev/null 2>&1 || true
 }
 
 case "${PHASE}" in

package/reference/ucan-store/rootfs/ucan-store-configure.sh

@@ -12,9 +12,14 @@ CADDY_SERVICE="${CADDY_SERVICE:-caddy.service}"
 CADDYFILE="${CADDYFILE:-/etc/caddy/Caddyfile}"
 SERVICE_PORT="${SERVICE_PORT:-8787}"
 PROXY_PORT="${PROXY_PORT:-8788}"
+SERVICE_GROUP="${SERVICE_GROUP:-ucan-store}"
 PUBLIC_IPV4=""
 PUBLIC_IPV6=""
 PROXY_HOSTNAME=""
+SERVICE_HOSTNAME=""
+SERVICE_DID=""
+SERVICE_ORIGIN=""
+PUBLIC_STORAGE_ORIGIN=""
 WEBAUTHN_ORIGIN=""
 WEBAUTHN_ORIGIN_FALLBACKS=""
 ADMIN_DID=""
@@ -29,6 +34,9 @@ Usage:
     --public-ipv4 <ip> \
     [--public-ipv6 <ipv6>] \
     [--proxy-hostname <hostname>] \
+    [--service-did <did>] \
+    [--service-origin <origin>] \
+    [--public-storage-origin <origin>] \
     [--webauthn-origin <origin>] \
     [--webauthn-origin-fallbacks <csv>] \
     [--admin-did <did>] \
@@ -67,19 +75,67 @@ PY
 }
 
 write_caddyfile() {
-  local hostname="$1"
+  local hostnames=()
+  local hostname
+  local known
+  for hostname in "$@"; do
+    if [ -z "${hostname}" ]; then
+      continue
+    fi
+    known="0"
+    if [ "${#hostnames[@]}" -gt 0 ]; then
+      for existing in "${hostnames[@]}"; do
+        if [ "${existing}" = "${hostname}" ]; then
+          known="1"
+          break
+        fi
+      done
+    fi
+    if [ "${known}" = "0" ]; then
+      hostnames+=("${hostname}")
+    fi
+  done
+
+  if [ "${#hostnames[@]}" -eq 0 ]; then
+    return 0
+  fi
+
+  local site_label
+  local index
+  site_label="${hostnames[0]}"
+  for ((index = 1; index < ${#hostnames[@]}; index++)); do
+    site_label+=", ${hostnames[${index}]}"
+  done
   mkdir -p "$(dirname "${CADDYFILE}")"
   cat > "${CADDYFILE}" <<EOF
 {
   auto_https disable_redirects
 }
 
-${hostname} {
+${site_label} {
   reverse_proxy 127.0.0.1:${PROXY_PORT}
 }
 EOF
 }
 
+derive_hostname_from_origin() {
+  python3 - "${1:-}" <<'PY'
+import sys
+from urllib.parse import urlsplit
+
+raw = (sys.argv[1] or "").strip()
+if not raw:
+    raise SystemExit(0)
+
+parsed = urlsplit(raw)
+host = (parsed.hostname or "").strip().lower()
+if not host:
+    raise SystemExit(0)
+
+print(host)
+PY
+}
+
 derive_service_did_from_hostname() {
   python3 - "${1:-}" <<'PY'
 import sys
@@ -138,8 +194,20 @@ install_bootstrap_package() {
     --admin-did "${ADMIN_DID}" \
     --summary-file "${BOOTSTRAP_VERIFICATION_FILE}" >/dev/null
   cp "${source_file}" "${BOOTSTRAP_PACKAGE_FILE}"
-  chmod 0640 "${BOOTSTRAP_PACKAGE_FILE}"
-  chmod 0644 "${BOOTSTRAP_VERIFICATION_FILE}"
+  if chgrp "${SERVICE_GROUP}" "${BOOTSTRAP_PACKAGE_FILE}" 2>/dev/null; then
+    chmod 0640 "${BOOTSTRAP_PACKAGE_FILE}"
+  else
+    chmod 0644 "${BOOTSTRAP_PACKAGE_FILE}"
+  fi
+  install_bootstrap_verification_permissions
+}
+
+install_bootstrap_verification_permissions() {
+  if chgrp "${SERVICE_GROUP}" "${BOOTSTRAP_VERIFICATION_FILE}" 2>/dev/null; then
+    chmod 0664 "${BOOTSTRAP_VERIFICATION_FILE}"
+  else
+    chmod 0666 "${BOOTSTRAP_VERIFICATION_FILE}"
+  fi
 }
 
 while [ "$#" -gt 0 ]; do
@@ -156,6 +224,18 @@ while [ "$#" -gt 0 ]; do
       PROXY_HOSTNAME="${2:-}"
       shift 2
       ;;
+    --service-did)
+      SERVICE_DID="${2:-}"
+      shift 2
+      ;;
+    --service-origin)
+      SERVICE_ORIGIN="${2:-}"
+      shift 2
+      ;;
+    --public-storage-origin)
+      PUBLIC_STORAGE_ORIGIN="${2:-}"
+      shift 2
+      ;;
     --webauthn-origin)
       WEBAUTHN_ORIGIN="${2:-}"
       shift 2
@@ -196,6 +276,8 @@ if [ -z "${PUBLIC_IPV4}" ]; then
   usage >&2
   exit 1
 fi
+SERVICE_ORIGIN="${SERVICE_ORIGIN%/}"
+PUBLIC_STORAGE_ORIGIN="${PUBLIC_STORAGE_ORIGIN%/}"
 
 touch "${ENV_FILE}"
 
@@ -217,14 +299,31 @@ if [ -n "${WEBAUTHN_ORIGIN}" ]; then
 fi
 write_env_var "WEBAUTHN_ORIGIN_FALLBACKS" "${WEBAUTHN_ORIGIN_FALLBACKS}"
 
+if [ -z "${SERVICE_DID}" ] && [ -n "${PROXY_HOSTNAME}" ]; then
+  SERVICE_DID="$(derive_service_did_from_hostname "${PROXY_HOSTNAME}")"
+fi
+
+if [ -z "${SERVICE_ORIGIN}" ] && [ -n "${PROXY_HOSTNAME}" ]; then
+  SERVICE_ORIGIN="https://${PROXY_HOSTNAME}"
+fi
+SERVICE_HOSTNAME="$(derive_hostname_from_origin "${SERVICE_ORIGIN}")"
+
+write_env_var "UCAN_STORE_SERVICE_DID" "${SERVICE_DID}"
+write_env_var "UCAN_STORE_SERVICE_HOSTNAME" "${SERVICE_HOSTNAME}"
+
+if [ -n "${SERVICE_ORIGIN}" ]; then
+  if [ -z "${PUBLIC_STORAGE_ORIGIN}" ]; then
+    PUBLIC_STORAGE_ORIGIN="${SERVICE_ORIGIN}"
+  fi
+  write_env_var "UCAN_STORE_SERVICE_ORIGIN" "${SERVICE_ORIGIN}"
+  write_env_var "UCAN_STORE_PUBLIC_STORAGE_ORIGIN" "${PUBLIC_STORAGE_ORIGIN}"
+  write_env_var "PUBLIC_UPLOAD_SERVICE_URL" "${SERVICE_ORIGIN}"
+  write_env_var "PUBLIC_REVOCATION_URL" "${SERVICE_ORIGIN}"
+  write_env_var "PUBLIC_RECEIPTS_URL" "${SERVICE_ORIGIN}/receipt/"
+fi
+
 if [ -n "${PROXY_HOSTNAME}" ]; then
-  write_env_var "UCAN_STORE_SERVICE_DID" "$(derive_service_did_from_hostname "${PROXY_HOSTNAME}")"
-  write_caddyfile "${PROXY_HOSTNAME}"
-  write_env_var "PUBLIC_UPLOAD_SERVICE_URL" "https://${PROXY_HOSTNAME}"
-  write_env_var "PUBLIC_REVOCATION_URL" "https://${PROXY_HOSTNAME}"
-  write_env_var "PUBLIC_RECEIPTS_URL" "https://${PROXY_HOSTNAME}/receipt/"
-else
-  write_env_var "UCAN_STORE_SERVICE_DID" ""
+  write_caddyfile "${PROXY_HOSTNAME}" "${SERVICE_HOSTNAME}"
 fi
 
 touch "${READY_FILE}"
@@ -236,26 +335,26 @@ if [ "${START_SERVICE}" = "1" ]; then
     systemctl restart "${CADDY_SERVICE}"
   fi
 
-  SERVICE_DID="$(probe_service_did)"
-  write_env_var "UCAN_STORE_SERVICE_DID" "${SERVICE_DID}"
+  PROBED_SERVICE_DID="$(probe_service_did)"
+  if [ -z "${SERVICE_DID}" ]; then
+    SERVICE_DID="${PROBED_SERVICE_DID}"
+    write_env_var "UCAN_STORE_SERVICE_DID" "${SERVICE_DID}"
+  fi
   write_env_var "PUBLIC_UPLOAD_SERVICE_DID" "${SERVICE_DID}"
   write_env_var "PUBLIC_REVOCATION_DID" "${SERVICE_DID}"
 
   if [ -f "${BOOTSTRAP_PACKAGE_FILE}" ]; then
-    RUNTIME_SERVICE_ORIGIN=""
-    if [ -n "${PROXY_HOSTNAME}" ]; then
-      RUNTIME_SERVICE_ORIGIN="https://${PROXY_HOSTNAME}"
-    fi
     python3 "${BOOTSTRAP_VALIDATOR}" \
       --package-file "${BOOTSTRAP_PACKAGE_FILE}" \
       --runtime-service-did "${SERVICE_DID}" \
-      --runtime-service-origin "${RUNTIME_SERVICE_ORIGIN}" \
+      --runtime-service-origin "${SERVICE_ORIGIN}" \
       --admin-did "${ADMIN_DID}" >/dev/null
     node "${BOOTSTRAP_CRYPTO_VERIFIER}" \
       --package-file "${BOOTSTRAP_PACKAGE_FILE}" \
       --runtime-service-did "${SERVICE_DID}" \
-      --runtime-service-origin "${RUNTIME_SERVICE_ORIGIN}" \
+      --runtime-service-origin "${SERVICE_ORIGIN}" \
       --admin-did "${ADMIN_DID}" \
       --summary-file "${BOOTSTRAP_VERIFICATION_FILE}" >/dev/null
+    install_bootstrap_verification_permissions
   fi
 fi

package/reference/ucan-store/rootfs/ucan-store-request-guard.mjs

@@ -23,6 +23,7 @@ const DEFAULT_REVOCATION_URL =
   process.env.PUBLIC_REVOCATION_URL || '';
 const DEFAULT_RECEIPTS_URL =
   process.env.PUBLIC_RECEIPTS_URL || '';
+const PROTOCOL_CAPABILITIES = new Set(['ucan/conclude', 'filecoin/offer']);
 
 function printHelp() {
   console.log(`Usage:
@@ -144,6 +145,10 @@ function capabilityCovers(provided, required) {
   return false;
 }
 
+function isProtocolCapability(capability) {
+  return PROTOCOL_CAPABILITIES.has(capability);
+}
+
 function isTruthy(value) {
   return ['1', 'true', 'yes', 'on'].includes(String(value || '').trim().toLowerCase());
 }
@@ -511,8 +516,8 @@ async function proxyRequest(req, res, config, bodyBuffer = null) {
     res.setHeader(key, value);
   }
   res.setHeader('Access-Control-Allow-Origin', '*');
-  res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
-  res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
+  res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, OPTIONS');
+  res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-Amz-Checksum-Sha256');
   const arrayBuffer = await response.arrayBuffer();
   res.end(Buffer.from(arrayBuffer));
 }
@@ -523,8 +528,8 @@ function sendJson(res, status, payload) {
   res.setHeader('Content-Type', 'application/json');
   res.setHeader('Content-Length', String(body.length));
   res.setHeader('Access-Control-Allow-Origin', '*');
-  res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
-  res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
+  res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, OPTIONS');
+  res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-Amz-Checksum-Sha256');
   res.end(body);
 }
 
@@ -549,6 +554,14 @@ async function enforceRequestPolicy(bodyBuffer, req, config) {
     });
 
     for (const invocation of message.invocations ?? []) {
+      const capabilities = invocation.capabilities ?? [];
+      const isProtocolInvocation =
+        capabilities.length > 0 &&
+        capabilities.every((capability) => isProtocolCapability(normalizeString(capability?.can)));
+      if (isProtocolInvocation) {
+        continue;
+      }
+
       const proofCids = collectProofCids(invocation.proofs ?? []);
       if (config.policy.rootDelegationCid && !proofCids.has(config.policy.rootDelegationCid)) {
         return {
@@ -558,9 +571,12 @@ async function enforceRequestPolicy(bodyBuffer, req, config) {
         };
       }
 
-      for (const capability of invocation.capabilities ?? []) {
+      for (const capability of capabilities) {
         const withValue = normalizeString(capability?.with);
         const canValue = normalizeString(capability?.can);
+        if (isProtocolCapability(canValue)) {
+          continue;
+        }
         if (!withValue || !canValue) {
           return {
             ok: false,
@@ -639,8 +655,8 @@ async function main() {
     if (req.method === 'OPTIONS') {
       res.statusCode = 204;
       res.setHeader('Access-Control-Allow-Origin', '*');
-      res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
-      res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
+      res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, OPTIONS');
+      res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-Amz-Checksum-Sha256');
       res.end();
       return;
     }

package/reference/ucan-store/rootfs/ucan-store-setup-server.py

@@ -137,7 +137,11 @@ class Handler(BaseHTTPRequestHandler):
             proxy_candidate if "://" in proxy_candidate else f"https://{proxy_candidate}"
         ) if proxy_candidate else None
         proxy_hostname = parsed_proxy.hostname if parsed_proxy and parsed_proxy.hostname else proxy_candidate
+        service_did = str(payload.get("service_did") or "").strip()
+        service_origin = str(payload.get("service_origin") or "").strip()
+        public_storage_origin = str(payload.get("public_storage_origin") or "").strip()
         admin_did = str(payload.get("admin_did") or "").strip()
+        admin_api_token = str(payload.get("admin_api_token") or "").strip()
         webauthn_origin = str(payload.get("webauthn_origin") or "").strip()
         webauthn_origin_fallbacks = str(payload.get("webauthn_origin_fallbacks") or "").strip()
         no_start = bool(payload.get("no_start"))
@@ -163,8 +167,16 @@ class Handler(BaseHTTPRequestHandler):
             args.extend(["--public-ipv6", public_ipv6])
         if proxy_hostname:
             args.extend(["--proxy-hostname", proxy_hostname])
+        if service_did:
+            args.extend(["--service-did", service_did])
+        if service_origin:
+            args.extend(["--service-origin", service_origin])
+        if public_storage_origin:
+            args.extend(["--public-storage-origin", public_storage_origin])
         if admin_did:
             args.extend(["--admin-did", admin_did])
+        if admin_api_token:
+            args.extend(["--admin-api-token", admin_api_token])
         if webauthn_origin:
             args.extend(["--webauthn-origin", webauthn_origin])
         if webauthn_origin_fallbacks: