@le-space/ui 0.3.10 → 0.3.12

package/shared/index.js

@@ -38,7 +38,7 @@ var RECENT_INSTANCE_RUNTIME_GRACE_MS = 10 * 60 * 1e3;
 var DEPLOYMENT_PENDING_WARNING_MS = 3 * 60 * 1e3;
 
 // src/shared/package-version.ts
-var UI_PACKAGE_VERSION = "0.3.10";
+var UI_PACKAGE_VERSION = "0.3.12";
 
 // src/shared/format.ts
 function shortHash(value, head = 8, tail = 6) {
@@ -1470,6 +1470,24 @@ function normalizeSshPublicKey(value) {
 function isValidSshPublicKey(value) {
   return SSH_PUBLIC_KEY_PATTERN.test(normalizeSshPublicKey(value));
 }
+function createDeploymentToken() {
+  const randomUuid = globalThis.crypto?.randomUUID?.();
+  if (typeof randomUuid === "string" && randomUuid.trim()) {
+    return randomUuid;
+  }
+  return `deploy-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 12)}`;
+}
+function appendDeploymentTokenToSshPublicKey(sshPublicKey, ownerAddress, deploymentToken) {
+  const normalized = normalizeSshPublicKey(sshPublicKey);
+  if (!normalized) return normalized;
+  const [algorithm = "", key = ""] = normalized.split(/\s+/, 3);
+  const owner = ownerAddress.trim().toLowerCase();
+  const token = deploymentToken.trim();
+  if (!algorithm || !key || !owner || !token) {
+    return normalized;
+  }
+  return `${algorithm} ${key} aleph-bootstrap-config:${owner}:${token}`;
+}
 function createReleaseMetadata(name, rootfsVersion, deployer = "shared-aleph-tooling") {
   return {
     name,
@@ -2008,51 +2026,6 @@ async function waitForSetupEndpoint(args) {
   }
   return result;
 }
-async function configureUcGoPeer(args) {
-  const controller = new AbortController();
-  const timeout = setTimeout(
-    () => controller.abort(),
-    Number(args.timeoutMs ?? 18e4)
-  );
-  const payload = {
-    public_ipv4: args.hostIpv4,
-    public_ipv6: args.publicIpv6 ?? void 0,
-    proxy_url: args.proxyUrl ?? void 0,
-    tcp_port: args.tcpPort ?? void 0,
-    ws_port: args.wsPort ?? void 0,
-    udp_port: args.udpPort ?? void 0,
-    quic_port: args.quicPort ?? void 0,
-    webrtc_port: args.webrtcPort ?? void 0,
-    bootstrap_publisher_private_key: args.bootstrapPublisherPrivateKey ?? void 0,
-    bootstrap_publisher_libp2p_identity_b64: args.bootstrapPublisherLibp2pIdentityBase64 ?? void 0,
-    bootstrap_owner_private_key: args.bootstrapOwnerPrivateKey ?? void 0,
-    bootstrap_owner_authorization_b64: args.bootstrapOwnerAuthorizationBase64 ?? void 0,
-    bootstrap_registration_id: args.bootstrapRegistrationId ?? void 0,
-    no_start: args.noStart === true ? true : void 0
-  };
-  try {
-    const response = await args.fetch(
-      `http://${args.hostIpv4}:${args.setupPort}/configure`,
-      {
-        method: "POST",
-        headers: {
-          "content-type": "application/json"
-        },
-        body: JSON.stringify(payload),
-        signal: controller.signal
-      }
-    );
-    const responsePayload = await response.json().catch(() => null);
-    if (!response.ok) {
-      throw new Error(
-        `Relay setup request failed: ${response.status} ${typeof responsePayload === "string" ? responsePayload : JSON.stringify(responsePayload ?? {})}`
-      );
-    }
-    return responsePayload;
-  } finally {
-    clearTimeout(timeout);
-  }
-}
 async function configureOrbitdbRelaySetup2(args) {
   const controller = new AbortController();
   const timeout = setTimeout(
@@ -2111,8 +2084,9 @@ async function fetchUcGoPeerMetadata(args) {
       Number(args.timeoutMs ?? 18e4)
     );
     try {
+      const requestUrl = args.metadataUrl && args.metadataUrl.trim() ? args.metadataUrl : `http://${args.hostIpv4}:${args.setupPort}/metadata`;
       const response = await args.fetch(
-        `http://${args.hostIpv4}:${args.setupPort}/metadata`,
+        requestUrl,
         {
           signal: controller.signal
         }
@@ -2194,6 +2168,9 @@ function asNumber4(value) {
 function normalizeHost(host) {
   return host.trim().toLowerCase();
 }
+function normalizeAddress(address) {
+  return address.trim().toLowerCase();
+}
 function normalizeSignature(signature) {
   const trimmed = signature.trim();
   return trimmed.startsWith("0x") ? trimmed : `0x${trimmed}`;
@@ -2495,6 +2472,40 @@ async function fetchAlephBootstrapPosts(options = {}) {
   const payload = await response.json();
   return (payload.posts ?? []).map((entry) => normalizeRelayBootstrapPostRecord(entry)).filter((entry) => entry != null);
 }
+function compareRelayBootstrapPostRecency(left, right) {
+  const leftUpdatedAt = left.content?.updatedAt ?? 0;
+  const rightUpdatedAt = right.content?.updatedAt ?? 0;
+  if (leftUpdatedAt !== rightUpdatedAt) return leftUpdatedAt - rightUpdatedAt;
+  const leftTime = left.time ?? 0;
+  const rightTime = right.time ?? 0;
+  return leftTime - rightTime;
+}
+function relayBootstrapRecordIdentity(post) {
+  const content = post.content;
+  if (!content) return null;
+  if (content.registrationId) return `registration:${content.registrationId}`;
+  if (post.address) return `sender:${normalizeAddress(post.address)}`;
+  return content.peerId ? `peer:${content.peerId}` : null;
+}
+function selectCurrentRelayBootstrapPosts(posts, options = {}) {
+  const maxAgeMs = options.maxAgeMs ?? DEFAULT_BOOTSTRAP_MAX_AGE_MS;
+  const now = options.now ?? Date.now();
+  const selected = /* @__PURE__ */ new Map();
+  for (const post of posts) {
+    const content = post.content;
+    if (!content) continue;
+    if (now - content.updatedAt > maxAgeMs) continue;
+    const identity = relayBootstrapRecordIdentity(post);
+    if (!identity) continue;
+    const previous = selected.get(identity);
+    if (!previous || compareRelayBootstrapPostRecency(post, previous) > 0) {
+      selected.set(identity, post);
+    }
+  }
+  return [...selected.values()].sort(
+    (left, right) => compareRelayBootstrapPostRecency(right, left)
+  );
+}
 
 // ../core/src/bootstrap-registration.ts
 async function publishRelayBootstrapRegistration(args) {
@@ -2601,6 +2612,311 @@ async function publishRelayBootstrapRegistration(args) {
   };
 }
 
+// ../core/src/bootstrap-config.ts
+var VM_BOOTSTRAP_CONFIG_AGGREGATE_KEY = "vm-bootstrap-config";
+async function fetchVmBootstrapConfigAggregate(address, options) {
+  const requestUrl = new URL(`/api/v0/aggregates/${address}.json`, options.apiHost ?? DEFAULT_ALEPH_API_HOST2);
+  requestUrl.searchParams.set("keys", VM_BOOTSTRAP_CONFIG_AGGREGATE_KEY);
+  const response = await options.fetch(requestUrl.toString(), { cache: "no-cache" });
+  if (response.status === 404) return {};
+  if (!response.ok) {
+    throw new Error(`VM bootstrap config aggregate request failed: ${response.status}`);
+  }
+  const payload = await response.json();
+  const aggregate = payload.data?.[VM_BOOTSTRAP_CONFIG_AGGREGATE_KEY];
+  if (!aggregate || typeof aggregate !== "object" || Array.isArray(aggregate)) return {};
+  return aggregate;
+}
+function normalizeVmBootstrapConfigAggregate(aggregate) {
+  if (!aggregate || typeof aggregate !== "object") return {};
+  return Object.fromEntries(
+    Object.entries(aggregate).filter(
+      (entry) => Boolean(entry[1] && typeof entry[1] === "object" && !Array.isArray(entry[1]))
+    )
+  );
+}
+function createVmBootstrapConfigAggregateContent(args) {
+  const content = normalizeVmBootstrapConfigAggregate(args.existingAggregate);
+  content[args.record.deploymentToken] = args.record;
+  return {
+    address: args.sender,
+    key: VM_BOOTSTRAP_CONFIG_AGGREGATE_KEY,
+    content,
+    time: args.now ?? Date.now() / 1e3
+  };
+}
+async function createUnsignedVmBootstrapConfigAggregateMessage(args) {
+  const itemContent = JSON.stringify(args.content);
+  const itemHash = await args.hasher(itemContent);
+  return {
+    sender: args.sender,
+    chain: "ETH",
+    type: "AGGREGATE",
+    item_hash: itemHash,
+    item_type: "inline",
+    item_content: itemContent,
+    time: args.now ?? Date.now() / 1e3,
+    channel: args.channel ?? DEFAULT_ALEPH_CHANNEL
+  };
+}
+async function publishVmBootstrapConfigAggregate(args) {
+  const unsignedMessage = await createUnsignedVmBootstrapConfigAggregateMessage({
+    sender: args.sender,
+    content: args.content,
+    hasher: args.hasher,
+    channel: args.channel
+  });
+  const message = await signAlephMessage(unsignedMessage, args.signer);
+  const { response, httpStatus } = await broadcastAlephMessage2(message, {
+    apiHost: args.apiHost,
+    sync: args.sync,
+    fetch: args.fetch
+  });
+  const aggregateStatus = httpStatus >= 200 && httpStatus < 300 ? response.message_status ?? "processed" : "unknown";
+  if (aggregateStatus === "rejected") {
+    throw new Error(`VM bootstrap config aggregate was rejected by Aleph: ${JSON.stringify(response.details ?? response)}`);
+  }
+  return {
+    aggregateItemHash: message.item_hash,
+    aggregateStatus
+  };
+}
+async function publishVmBootstrapConfig(args) {
+  const aggregate = await fetchVmBootstrapConfigAggregate(args.sender, {
+    apiHost: args.apiHost,
+    fetch: args.fetch
+  });
+  const content = createVmBootstrapConfigAggregateContent({
+    sender: args.sender,
+    record: args.record,
+    existingAggregate: aggregate
+  });
+  const result = await publishVmBootstrapConfigAggregate({
+    sender: args.sender,
+    content,
+    signer: args.signer,
+    hasher: args.hasher,
+    fetch: args.fetch,
+    channel: args.channel,
+    apiHost: args.apiHost,
+    sync: args.sync
+  });
+  return {
+    ...result,
+    aggregate: content.content
+  };
+}
+async function deleteVmBootstrapConfig(args) {
+  const aggregate = await fetchVmBootstrapConfigAggregate(args.sender, {
+    apiHost: args.apiHost,
+    fetch: args.fetch
+  });
+  const content = normalizeVmBootstrapConfigAggregate(aggregate);
+  delete content[args.deploymentToken];
+  const publishResult = await publishVmBootstrapConfigAggregate({
+    sender: args.sender,
+    content: {
+      address: args.sender,
+      key: VM_BOOTSTRAP_CONFIG_AGGREGATE_KEY,
+      content,
+      time: Date.now() / 1e3
+    },
+    signer: args.signer,
+    hasher: args.hasher,
+    fetch: args.fetch,
+    channel: args.channel,
+    apiHost: args.apiHost,
+    sync: args.sync
+  });
+  return {
+    ...publishResult,
+    aggregate: content
+  };
+}
+
+// ../core/src/bootstrap-reconcile.ts
+function createRelayBootstrapRegistrationId(profile, instanceName, itemHash) {
+  const normalizedName = String(instanceName ?? "").trim();
+  const normalizedHash = String(itemHash ?? "").trim();
+  if (!normalizedHash) {
+    return `relay:${profile}:${normalizedName || "instance"}`;
+  }
+  return `relay:${profile}:${normalizedName || normalizedHash}:${normalizedHash}`;
+}
+function secureBootstrapMetadataUrl(proxyUrl) {
+  const normalized = String(proxyUrl ?? "").trim();
+  if (!normalized) return null;
+  try {
+    return new URL("/bootstrap/metadata", normalized).toString();
+  } catch {
+    return null;
+  }
+}
+function extractRelayMetadata(payload) {
+  const metadata = payload && typeof payload === "object" && payload.metadata && typeof payload.metadata === "object" ? payload.metadata : null;
+  const peerId = typeof metadata?.peer_id === "string" ? metadata.peer_id : null;
+  const probeMultiaddrs = Array.isArray(metadata?.probe_multiaddrs) ? metadata.probe_multiaddrs.filter((entry) => typeof entry === "string") : [];
+  const browserBootstrapMultiaddrs = Array.isArray(metadata?.browser_bootstrap_multiaddrs) ? metadata.browser_bootstrap_multiaddrs.filter((entry) => typeof entry === "string") : [];
+  if (!peerId || probeMultiaddrs.length === 0) return null;
+  return {
+    peerId,
+    probeMultiaddrs,
+    browserBootstrapMultiaddrs
+  };
+}
+async function fetchOwnerInstances(address, options) {
+  const url = new URL("/api/v0/messages.json", options.apiHost ?? DEFAULT_ALEPH_API_HOST2);
+  url.searchParams.set("msgTypes", "INSTANCE");
+  url.searchParams.set("addresses", address);
+  url.searchParams.set("message_statuses", "processed,pending,rejected,removing");
+  url.searchParams.set("pagination", "100");
+  url.searchParams.set("page", "1");
+  url.searchParams.set("sortOrder", "-1");
+  const response = await options.fetch(url.toString(), { cache: "no-cache" });
+  if (!response.ok) {
+    throw new Error(`Instance list request failed: ${response.status}`);
+  }
+  const payload = await response.json();
+  return (payload.messages ?? []).map((message) => ({
+    ...message,
+    status: typeof message.status === "string" && message.status.trim() ? message.status : message.confirmed ? "processed" : "pending"
+  }));
+}
+async function fetchRelayMetadataForRuntime(args) {
+  const setupPort = args.runtime.mappedPorts?.["80"]?.host ?? 80;
+  const metadataUrl = args.preferSecureMetadata ? secureBootstrapMetadataUrl(args.runtime.proxyUrl) : null;
+  if (args.preferSecureMetadata && !metadataUrl) {
+    return null;
+  }
+  const payload = await fetchUcGoPeerMetadata({
+    hostIpv4: args.runtime.hostIpv4 ?? "",
+    setupPort,
+    metadataUrl,
+    fetch: args.fetch,
+    attempts: args.attempts,
+    delayMs: args.delayMs,
+    timeoutMs: args.timeoutMs
+  }).catch(() => null);
+  return extractRelayMetadata(payload);
+}
+async function reconcileOwnerRelayBootstrapRegistrations(args) {
+  const result = {
+    refreshedRegistrations: [],
+    forgottenHashes: [],
+    skippedInstanceHashes: [],
+    errors: []
+  };
+  const liveRegistrationIds = /* @__PURE__ */ new Set();
+  if (args.current?.registrationId) {
+    liveRegistrationIds.add(args.current.registrationId);
+    result.refreshedRegistrations.push(args.current.registrationId);
+  }
+  const instances = await fetchOwnerInstances(args.instanceOwnerAddress, {
+    apiHost: args.apiHost,
+    fetch: args.fetch
+  });
+  const processedInstances = instances.filter((instance) => {
+    const status = String(instance.status ?? "").trim().toLowerCase();
+    return status === "processed";
+  });
+  for (const instance of processedInstances) {
+    if (instance.item_hash === args.current?.itemHash) continue;
+    const registrationId = createRelayBootstrapRegistrationId(
+      args.profile,
+      instance.content?.metadata?.name,
+      instance.item_hash
+    );
+    try {
+      const runtime = await fetchVmRuntime({
+        itemHash: instance.item_hash,
+        fetch: args.fetch,
+        crns: args.crns,
+        crnListUrl: args.crnListUrl
+      });
+      if (!runtime.hostIpv4 || Object.keys(runtime.mappedPorts ?? {}).length === 0) {
+        result.skippedInstanceHashes.push(instance.item_hash);
+        continue;
+      }
+      const relayMetadata = await fetchRelayMetadataForRuntime({
+        runtime,
+        fetch: args.fetch,
+        preferSecureMetadata: args.preferSecureMetadata,
+        attempts: 3,
+        delayMs: 1e3,
+        timeoutMs: 1e4
+      });
+      if (!relayMetadata) {
+        result.skippedInstanceHashes.push(instance.item_hash);
+        continue;
+      }
+      liveRegistrationIds.add(registrationId);
+      await publishRelayBootstrapRegistration({
+        sender: args.sender,
+        signer: args.signer,
+        hasher: args.hasher,
+        fetch: args.fetch,
+        apiHost: args.apiHost,
+        channel: args.channel,
+        ref: args.ref,
+        postType: args.postType,
+        peerId: relayMetadata.peerId,
+        multiaddrs: relayMetadata.probeMultiaddrs,
+        browserMultiaddrs: relayMetadata.browserBootstrapMultiaddrs,
+        registrationId,
+        ownerAddress: args.ownerAddress,
+        publisherAddress: args.publisherAddress,
+        ownerSigner: args.ownerSigner,
+        publisherSigner: args.publisherSigner,
+        forgetPrevious: true,
+        profile: args.profile,
+        version: args.version,
+        instanceItemHash: instance.item_hash,
+        sync: true
+      });
+      result.refreshedRegistrations.push(registrationId);
+    } catch (error) {
+      result.errors.push({
+        phase: "publish",
+        itemHash: instance.item_hash,
+        registrationId,
+        message: error instanceof Error ? error.message : String(error)
+      });
+    }
+  }
+  try {
+    const bootstrapPosts = await fetchAlephBootstrapPosts({
+      apiHost: args.apiHost ?? DEFAULT_ALEPH_API_HOST2,
+      channel: args.channel,
+      ref: args.ref,
+      postType: args.postType,
+      fetch: args.fetch
+    });
+    const currentPosts = selectCurrentRelayBootstrapPosts(bootstrapPosts);
+    const staleHashes = currentPosts.filter(
+      (post) => post.address?.toLowerCase() === args.sender.toLowerCase() && post.content?.profile === args.profile && post.content?.registrationId && !liveRegistrationIds.has(post.content.registrationId)
+    ).map((post) => post.itemHash ?? post.hash ?? "").filter(Boolean);
+    if (staleHashes.length > 0) {
+      await forgetAlephMessages({
+        sender: args.sender,
+        hashes: staleHashes,
+        reason: `Forget stale ${args.profile} relay bootstrap registrations after owner reconcile`,
+        signer: args.signer,
+        hasher: args.hasher,
+        fetch: args.fetch,
+        apiHost: args.apiHost ?? DEFAULT_ALEPH_API_HOST2,
+        sync: true
+      });
+      result.forgottenHashes.push(...staleHashes);
+    }
+  } catch (error) {
+    result.errors.push({
+      phase: "forget",
+      message: error instanceof Error ? error.message : String(error)
+    });
+  }
+  return result;
+}
+
 // src/shared/events.ts
 function createDeploymentProgressEmitter() {
   const listeners = /* @__PURE__ */ new Set();
@@ -2621,6 +2937,13 @@ function createDeploymentProgressEmitter() {
 }
 
 // src/shared/controller.ts
+function asJsonFetch(input, init) {
+  return fetch(input, init).then(async (response) => ({
+    ok: response.ok,
+    status: response.status,
+    json: async () => await response.json()
+  }));
+}
 function isConfirmedRelaySetupResult(value) {
   return Boolean(
     value && typeof value === "object" && "status" in value && value.status === "configured"
@@ -3063,36 +3386,36 @@ var SponsorRelayController = class {
     if (!setupPort) {
       throw new Error("Relay runtime did not expose the temporary setup endpoint.");
     }
-    this.emitProgress({
-      stage: "deployment-confirmed",
-      label: "Configuring relay",
-      progress: 93,
-      status: "info",
-      itemHash: args.itemHash,
-      detail: "Waiting for the guest setup endpoint before collecting relay metadata."
-    });
-    const setupHealth = await waitForSetupEndpoint({
-      hostIpv4: args.runtime.hostIpv4,
-      setupPort,
-      fetch: (url, init) => fetch(url, init),
-      attempts: 15,
-      delayMs: 4e3,
-      httpTimeoutMs: 1e4
-    });
-    if (!setupHealth.ok) {
-      throw new Error(
-        `Relay setup endpoint did not become reachable at http://${args.runtime.hostIpv4}:${setupPort}/health.`
-      );
-    }
-    this.emitProgress({
-      stage: "deployment-confirmed",
-      label: "Applying relay networking",
-      progress: 94,
-      status: "info",
-      itemHash: args.itemHash,
-      detail: "Publishing the host port mapping into the guest relay configuration."
-    });
     if (profile === "orbitdb-relay-pinner") {
+      this.emitProgress({
+        stage: "deployment-confirmed",
+        label: "Configuring relay",
+        progress: 93,
+        status: "info",
+        itemHash: args.itemHash,
+        detail: "Waiting for the guest setup endpoint before collecting relay metadata."
+      });
+      const setupHealth = await waitForSetupEndpoint({
+        hostIpv4: args.runtime.hostIpv4,
+        setupPort,
+        fetch: (url, init) => fetch(url, init),
+        attempts: 15,
+        delayMs: 4e3,
+        httpTimeoutMs: 1e4
+      });
+      if (!setupHealth.ok) {
+        throw new Error(
+          `Relay setup endpoint did not become reachable at http://${args.runtime.hostIpv4}:${setupPort}/health.`
+        );
+      }
+      this.emitProgress({
+        stage: "deployment-confirmed",
+        label: "Applying relay networking",
+        progress: 94,
+        status: "info",
+        itemHash: args.itemHash,
+        detail: "Publishing the host port mapping into the guest relay configuration."
+      });
       const tcpPort = mappedPorts2["9091"]?.host ?? 0;
       const wsPort = mappedPorts2["9092"]?.host ?? mappedPorts2["443"]?.host ?? 0;
       if (!tcpPort || !wsPort) {
@@ -3118,24 +3441,48 @@ var SponsorRelayController = class {
         );
       }
     } else {
-      const configureResult = await configureUcGoPeer({
-        hostIpv4: args.runtime.hostIpv4,
-        publicIpv6: args.runtime.ipv6,
-        setupPort,
-        tcpPort: mappedPorts2["9095"]?.host ?? null,
-        wsPort: mappedPorts2["9097"]?.host ?? mappedPorts2["9095"]?.host ?? null,
-        udpPort: mappedPorts2["9095"]?.udp === true ? mappedPorts2["9095"]?.host ?? null : null,
-        quicPort: mappedPorts2["9095"]?.udp === true ? mappedPorts2["9095"]?.host ?? null : null,
-        webrtcPort: mappedPorts2["9095"]?.udp === true ? mappedPorts2["9095"]?.host ?? null : null,
-        proxyUrl: args.runtime.proxyUrl ?? void 0,
-        fetch: (url, init) => fetch(url, init),
-        timeoutMs: 18e4
-      });
-      if (!isConfirmedRelaySetupResult(configureResult)) {
-        throw new Error(
-          `Relay guest configuration could not be confirmed at http://${args.runtime.hostIpv4}:${setupPort}/configure.`
-        );
+      if (!args.deploymentToken) {
+        throw new Error("Missing deployment token for Aleph bootstrap config handoff.");
       }
+      this.emitProgress({
+        stage: "deployment-confirmed",
+        label: "Publishing relay config",
+        progress: 94,
+        status: "info",
+        itemHash: args.itemHash,
+        detail: "Publishing runtime networking into the Aleph guest bootstrap config aggregate."
+      });
+      const record = {
+        deploymentToken: args.deploymentToken,
+        profile,
+        ownerAddress: this.state.wallet.address,
+        instanceItemHash: args.itemHash,
+        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+        expiresAt: new Date(Date.now() + 30 * 6e4).toISOString(),
+        status: "pending",
+        runtime: {
+          publicIpv4: args.runtime.hostIpv4,
+          publicIpv6: args.runtime.ipv6 ?? null,
+          proxyUrl: args.runtime.proxyUrl ?? null,
+          mappedPorts: mappedPorts2
+        },
+        bootstrap: {
+          registrationId: createRelayBootstrapRegistrationId(
+            profile,
+            this.state.instanceName.trim(),
+            args.itemHash
+          )
+        }
+      };
+      await publishVmBootstrapConfig({
+        sender: this.state.wallet.address,
+        record,
+        signer: personalSign,
+        hasher: sha256Hex,
+        fetch: asJsonFetch,
+        apiHost: this.client.apiHost,
+        sync: true
+      });
     }
     this.emitProgress({
       stage: "publishing-bootstrap",
@@ -3145,27 +3492,23 @@ var SponsorRelayController = class {
       itemHash: args.itemHash,
       detail: "Waiting for the relay to report its final public multiaddrs."
     });
-    const metadataResult = await fetchUcGoPeerMetadata({
-      hostIpv4: args.runtime.hostIpv4,
-      setupPort,
-      fetch: (url, init) => fetch(url, init),
+    const relayMetadata = await fetchRelayMetadataForRuntime({
+      runtime: args.runtime,
+      fetch,
+      preferSecureMetadata: profile === "uc-go-peer",
       attempts: 80,
       delayMs: 3e3,
       timeoutMs: 24e4
     });
-    const metadata = metadataResult && typeof metadataResult === "object" && metadataResult.metadata && typeof metadataResult.metadata === "object" ? metadataResult.metadata : null;
-    const peerId = typeof metadata?.peer_id === "string" ? metadata.peer_id : null;
-    const probeMultiaddrs = Array.isArray(metadata?.probe_multiaddrs) ? metadata.probe_multiaddrs.filter(
-      (entry) => typeof entry === "string"
-    ) : [];
-    const browserBootstrapMultiaddrs = Array.isArray(
-      metadata?.browser_bootstrap_multiaddrs
-    ) ? metadata.browser_bootstrap_multiaddrs.filter(
-      (entry) => typeof entry === "string"
-    ) : [];
-    if (!peerId || probeMultiaddrs.length === 0) {
+    if (!relayMetadata) {
       throw new Error("Relay metadata did not include a peer ID and public multiaddrs.");
     }
+    const { peerId, probeMultiaddrs, browserBootstrapMultiaddrs } = relayMetadata;
+    const registrationId = createRelayBootstrapRegistrationId(
+      profile,
+      this.state.instanceName.trim(),
+      args.itemHash
+    );
     this.emitProgress({
       stage: "publishing-bootstrap",
       label: "Publishing bootstrap registration",
@@ -3178,25 +3521,65 @@ var SponsorRelayController = class {
       sender: this.state.wallet.address,
       signer: personalSign,
       hasher: sha256Hex,
-      fetch: (url, init) => fetch(url, init).then(async (response) => ({
-        ok: response.ok,
-        status: response.status,
-        json: async () => await response.json()
-      })),
+      fetch: asJsonFetch,
       apiHost: this.client.apiHost,
       peerId,
       multiaddrs: probeMultiaddrs,
       browserMultiaddrs: browserBootstrapMultiaddrs,
+      registrationId,
       profile,
       version: this.state.manifest?.version,
+      forgetPrevious: true,
       sync: true
     });
     this.trace("deploy:bootstrap-registration", {
       itemHash: args.itemHash,
       peerId,
-      metadata,
+      metadata: relayMetadata,
       publication
     });
+    const reconcileResult = await reconcileOwnerRelayBootstrapRegistrations({
+      instanceOwnerAddress: this.state.wallet.address,
+      sender: this.state.wallet.address,
+      signer: personalSign,
+      hasher: sha256Hex,
+      fetch: asJsonFetch,
+      profile,
+      apiHost: this.client.apiHost,
+      crns: this.state.crns,
+      crnListUrl: this.props.crnListUrl,
+      preferSecureMetadata: profile === "uc-go-peer",
+      current: {
+        itemHash: args.itemHash,
+        registrationId,
+        peerId,
+        probeMultiaddrs,
+        browserBootstrapMultiaddrs
+      }
+    });
+    if (reconcileResult.errors.length > 0) {
+      this.trace("deploy:owner-bootstrap-reconcile-errors", {
+        itemHash: args.itemHash,
+        errors: reconcileResult.errors
+      });
+    }
+    if (profile === "uc-go-peer" && args.deploymentToken) {
+      await deleteVmBootstrapConfig({
+        sender: this.state.wallet.address,
+        deploymentToken: args.deploymentToken,
+        signer: personalSign,
+        hasher: sha256Hex,
+        fetch: asJsonFetch,
+        apiHost: this.client.apiHost,
+        sync: true
+      }).catch((error) => {
+        this.trace("deploy:bootstrap-config-cleanup-error", {
+          itemHash: args.itemHash,
+          deploymentToken: args.deploymentToken,
+          error: error instanceof Error ? error.message : String(error)
+        });
+      });
+    }
   }
   syncLatestDeploymentProgress(instances) {
     const itemHash = this.state.lastDeploymentHash;
@@ -3668,6 +4051,7 @@ var SponsorRelayController = class {
       let lastError = null;
       for (const [candidateIndex, candidateCrn] of orderedCrns.entries()) {
         let attemptItemHash = null;
+        let attemptDeploymentToken = null;
         this.emitProgress({
           stage: "selecting-crn",
           label: "Selecting CRN",
@@ -3676,10 +4060,16 @@ var SponsorRelayController = class {
           detail: `Trying ${candidateCrn.name ?? candidateCrn.hash} (${candidateIndex + 1}/${orderedCrns.length})`
         });
         try {
+          const profile = relayProfileForManifest(this.state.manifest);
+          const sshPublicKey = profile === "uc-go-peer" ? appendDeploymentTokenToSshPublicKey(
+            this.state.sshPublicKey.trim(),
+            this.state.wallet.address,
+            attemptDeploymentToken = createDeploymentToken()
+          ) : this.state.sshPublicKey.trim();
           const content = createInstanceContent({
             address: this.state.wallet.address,
             name: this.state.instanceName.trim(),
-            sshPublicKey: this.state.sshPublicKey.trim(),
+            sshPublicKey,
             rootfsItemHash: this.state.manifest.rootfsItemHash,
             rootfsSizeMiB: Math.max(
               this.state.manifest.rootfsSizeMiB,
@@ -3859,7 +4249,8 @@ var SponsorRelayController = class {
           });
           await this.configureRelayBootstrapRegistration({
             itemHash: result.itemHash,
-            runtime
+            runtime,
+            deploymentToken: attemptDeploymentToken
           });
           this.patch({
             busy: { deploying: false }
@@ -3885,6 +4276,17 @@ var SponsorRelayController = class {
             error: lastError.message
           });
           if (attemptItemHash) {
+            if (attemptDeploymentToken) {
+              await deleteVmBootstrapConfig({
+                sender: this.state.wallet.address,
+                deploymentToken: attemptDeploymentToken,
+                signer: personalSign,
+                hasher: sha256Hex,
+                fetch: asJsonFetch,
+                apiHost: this.client.apiHost,
+                sync: true
+              }).catch(() => void 0);
+            }
             await forgetAlephMessages({
               sender: this.state.wallet.address,
               hashes: [attemptItemHash],
@@ -3963,16 +4365,35 @@ var SponsorRelayController = class {
         reason: "Deleted from Sponsor Relay panel",
         signer: personalSign,
         hasher: sha256Hex,
-        fetch: (url, init) => fetch(url, init).then(async (response) => ({
-          ok: response.ok,
-          status: response.status,
-          json: async () => await response.json()
-        })),
+        fetch: asJsonFetch,
         apiHost: this.client.apiHost,
         onProgress: (event) => {
           this.emitProgress(event);
         }
       });
+      const profile = relayProfileForManifest(this.state.manifest);
+      if (profile) {
+        await reconcileOwnerRelayBootstrapRegistrations({
+          instanceOwnerAddress: this.state.wallet.address,
+          sender: this.state.wallet.address,
+          signer: personalSign,
+          hasher: sha256Hex,
+          fetch: asJsonFetch,
+          profile,
+          apiHost: this.client.apiHost,
+          crns: this.state.crns,
+          crnListUrl: this.props.crnListUrl,
+          preferSecureMetadata: profile === "uc-go-peer"
+        }).catch(
+          (error) => {
+            this.trace("delete:owner-bootstrap-reconcile-error", {
+              instanceHash,
+              profile,
+              error: error instanceof Error ? error.message : String(error)
+            });
+          }
+        );
+      }
       this.patch({
         busy: { deletingInstanceHash: null },
         statusText: `Deletion submitted for ${instanceHash}`