@le-space/ui 0.4.1 → 0.4.3

package/shared/index.js

@@ -27,7 +27,7 @@ var RECENT_INSTANCE_RUNTIME_GRACE_MS = 10 * 60 * 1e3;
 var DEPLOYMENT_PENDING_WARNING_MS = 3 * 60 * 1e3;
 
 // src/shared/package-version.ts
-var UI_PACKAGE_VERSION = "0.4.1";
+var UI_PACKAGE_VERSION = "0.4.3";
 
 // src/shared/format.ts
 function shortHash(value, head = 8, tail = 6) {
@@ -1236,16 +1236,6 @@ function normalizeBroadcastStatus(httpStatus, responseStatus) {
   if (httpStatus === 202) return "pending";
   return normalizeMessageStatus2(responseStatus);
 }
-function isInvalidMessageFormatResponse2(response, payload) {
-  if (response.status !== 422) return false;
-  const details = payload?.details;
-  if (typeof details === "string" && details.includes("InvalidMessageFormat")) return true;
-  if (details && typeof details === "object") {
-    const detailMessage = details.message;
-    if (typeof detailMessage === "string" && detailMessage.includes("InvalidMessageFormat")) return true;
-  }
-  return false;
-}
 function isRetryableBroadcastFailure(response, payload) {
   if (response.status >= 500) return true;
   const publicationStatus = payload?.publication_status?.status;
@@ -1267,25 +1257,22 @@ async function postBroadcastPayload2(body, options) {
   };
 }
 async function broadcastAlephMessage2(message, options) {
-  const attempts = [
-    { sync: options.sync ?? false, message },
-    { ...message, sync: options.sync ?? false },
-    { ...message }
-  ];
-  for (let index = 0; index < attempts.length; index += 1) {
-    const result = await postBroadcastPayload2(attempts[index], {
+  const requestBody = { sync: options.sync ?? false, message };
+  const maxAttempts = 3;
+  for (let index = 0; index < maxAttempts; index += 1) {
+    const result = await postBroadcastPayload2(requestBody, {
       apiHost: options.apiHost,
       fetch: options.fetch
     });
     if (result.httpStatus === 202 || normalizeBroadcastStatus(result.httpStatus, result.response?.message_status) !== "unknown" || result.httpStatus >= 200 && result.httpStatus < 300) {
       return result;
     }
-    const canRetry = index < attempts.length - 1 && (isInvalidMessageFormatResponse2({ status: result.httpStatus }, result.response) || isRetryableBroadcastFailure({ status: result.httpStatus }, result.response));
+    const canRetry = index < maxAttempts - 1 && isRetryableBroadcastFailure({ status: result.httpStatus }, result.response);
     if (!canRetry) {
       throw new Error(`Broadcast failed: ${result.httpStatus} ${JSON.stringify(result.response ?? {})}`);
     }
   }
-  throw new Error("Broadcast failed: no compatible request format was accepted");
+  throw new Error("Broadcast failed: retry budget exhausted");
 }
 
 // ../core/src/forget.ts
@@ -1652,6 +1639,26 @@ function asString3(value) {
 function asNumber3(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : null;
 }
+function normalizeIpv6(value) {
+  if (typeof value !== "string") return null;
+  const normalized = value.trim().toLowerCase();
+  if (!normalized) return null;
+  const zoneIndex = normalized.indexOf("%");
+  return zoneIndex >= 0 ? normalized.slice(0, zoneIndex) : normalized;
+}
+function isLikelyGlobalIpv6(value) {
+  const normalized = normalizeIpv6(value);
+  if (!normalized || normalized === "::" || normalized === "::1") return false;
+  const firstHextetText = normalized.split(":", 1)[0];
+  if (!firstHextetText) return false;
+  const firstHextet = Number.parseInt(firstHextetText, 16);
+  if (!Number.isFinite(firstHextet)) return false;
+  if ((firstHextet & 65024) === 64512) return false;
+  if ((firstHextet & 65472) === 65152) return false;
+  if ((firstHextet & 65280) === 65280) return false;
+  if ((firstHextet & 65472) === 65216) return false;
+  return true;
+}
 function findCrnByHash(crns, crnHash) {
   return crns.find((crn) => crn.hash === crnHash) ?? null;
 }
@@ -1732,10 +1739,23 @@ function describeRuntimeAvailability(runtime) {
   const execution = runtime.execution ?? null;
   const mappedPorts2 = runtime.mappedPorts ?? {};
   const hostIpv4 = runtime.hostIpv4 ?? null;
+  const ipv6 = runtime.ipv6 ?? null;
+  const executionGuestIpv6 = execution?.networking?.ipv6_ip ?? null;
   const proxyUrl = runtime.proxyUrl ?? null;
   const schedulerSource = runtime.allocation?.source ?? null;
   const webAccessActive = runtime.webAccess?.active ?? null;
   const mappedPortCount = Object.keys(mappedPorts2).length;
+  if (hostIpv4 && mappedPortCount > 0 && runtime.requirePublicGuestIpv6ForProxy === true && proxyUrl && executionGuestIpv6 && !isLikelyGlobalIpv6(executionGuestIpv6)) {
+    return {
+      state: "execution-invalid-public-ipv6",
+      reason: `The CRN exposed runtime networking, but the guest IPv6 (${executionGuestIpv6}) is not globally routable. Proxy-backed HTTPS activation cannot succeed until the CRN reports a public guest IPv6.`,
+      schedulerSource,
+      executionSeen: Boolean(execution),
+      webAccessActive,
+      mappedPortCount,
+      proxyUrl
+    };
+  }
   if (hostIpv4 && mappedPortCount > 0) {
     return {
       state: "ready",
@@ -1852,7 +1872,8 @@ async function fetchVmRuntime(args) {
     hostIpv4,
     ipv6,
     proxyUrl,
-    mappedPorts: mappedPorts2
+    mappedPorts: mappedPorts2,
+    requirePublicGuestIpv6ForProxy: args.requirePublicGuestIpv6ForProxy
   });
   return {
     allocation,
@@ -1876,7 +1897,7 @@ async function waitForVmRuntime(args) {
   let lastRuntime = await fetchVmRuntime(args);
   args.onAttempt?.(lastRuntime, 1, attempts);
   for (let attempt = 0; attempt < attempts - 1; attempt += 1) {
-    if (lastRuntime.hostIpv4 && Object.keys(lastRuntime.mappedPorts ?? {}).length > 0) {
+    if (lastRuntime.diagnostics?.state === "ready" || lastRuntime.diagnostics?.state === "execution-invalid-public-ipv6") {
       return lastRuntime;
     }
     await sleep2(delayMs);
@@ -2675,6 +2696,55 @@ async function publishRelayBootstrapRegistration(args) {
 
 // ../core/src/bootstrap-config.ts
 var VM_BOOTSTRAP_CONFIG_AGGREGATE_KEY = "vm-bootstrap-config";
+var VM_BOOTSTRAP_CONFIG_SIGNAL_REF = "vm-bootstrap-config";
+var VM_BOOTSTRAP_CONFIG_SIGNAL_POST_TYPE = "vm-bootstrap-config-status";
+var VM_BOOTSTRAP_CONFIG_HISTORY_RETENTION_MS = 6 * 60 * 60 * 1e3;
+function parseJsonObject(value) {
+  try {
+    const parsed = JSON.parse(value);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function parseTimestampMs(value) {
+  if (typeof value === "number" && Number.isFinite(value)) {
+    return value > 1e12 ? value : value * 1e3;
+  }
+  if (typeof value === "string" && value.trim()) {
+    const numeric = Number(value);
+    if (Number.isFinite(numeric)) {
+      return numeric > 1e12 ? numeric : numeric * 1e3;
+    }
+    const parsed = Date.parse(value);
+    return Number.isFinite(parsed) ? parsed : null;
+  }
+  return null;
+}
+function normalizeVmBootstrapConfigRecord(deploymentTokenKey, value, options = {}) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const candidate = value;
+  const deploymentToken = typeof candidate.deploymentToken === "string" ? candidate.deploymentToken.trim() : "";
+  const profile = typeof candidate.profile === "string" ? candidate.profile.trim() : "";
+  const ownerAddress = typeof candidate.ownerAddress === "string" ? candidate.ownerAddress.trim() : "";
+  const instanceItemHash = typeof candidate.instanceItemHash === "string" ? candidate.instanceItemHash.trim() : "";
+  const createdAt = typeof candidate.createdAt === "string" ? candidate.createdAt.trim() : "";
+  const expiresAt = typeof candidate.expiresAt === "string" ? candidate.expiresAt.trim() : "";
+  if (!deploymentTokenKey.trim() || !deploymentToken || deploymentToken !== deploymentTokenKey.trim() || !profile || !ownerAddress || !instanceItemHash || !createdAt || !expiresAt) {
+    return null;
+  }
+  const nowMs = Math.max(0, Number(options.nowMs ?? Date.now()));
+  const maxRecordAgeMs = Math.max(
+    6e4,
+    Number(options.maxRecordAgeMs ?? VM_BOOTSTRAP_CONFIG_HISTORY_RETENTION_MS)
+  );
+  const createdAtMs = parseTimestampMs(createdAt);
+  const expiresAtMs = parseTimestampMs(expiresAt);
+  if (createdAtMs == null || expiresAtMs == null) return null;
+  if (expiresAtMs <= nowMs) return null;
+  if (createdAtMs < nowMs - maxRecordAgeMs) return null;
+  return candidate;
+}
 async function fetchVmBootstrapConfigAggregate(address, options) {
   const requestUrl = new URL(`/api/v0/aggregates/${address}.json`, options.apiHost ?? DEFAULT_ALEPH_API_HOST2);
   requestUrl.searchParams.set("keys", VM_BOOTSTRAP_CONFIG_AGGREGATE_KEY);
@@ -2688,16 +2758,21 @@ async function fetchVmBootstrapConfigAggregate(address, options) {
   if (!aggregate || typeof aggregate !== "object" || Array.isArray(aggregate)) return {};
   return aggregate;
 }
-function normalizeVmBootstrapConfigAggregate(aggregate) {
+function normalizeVmBootstrapConfigAggregate(aggregate, options = {}) {
   if (!aggregate || typeof aggregate !== "object") return {};
   return Object.fromEntries(
-    Object.entries(aggregate).filter(
-      (entry) => Boolean(entry[1] && typeof entry[1] === "object" && !Array.isArray(entry[1]))
-    )
+    Object.entries(aggregate).map(([deploymentToken, record]) => [
+      deploymentToken,
+      normalizeVmBootstrapConfigRecord(deploymentToken, record, options)
+    ]).filter((entry) => entry[1] != null)
   );
 }
 function createVmBootstrapConfigAggregateContent(args) {
-  const content = normalizeVmBootstrapConfigAggregate(args.existingAggregate);
+  const nowMs = Math.max(0, Number(args.now ?? Date.now() / 1e3) * 1e3);
+  const content = normalizeVmBootstrapConfigAggregate(args.existingAggregate, {
+    nowMs,
+    maxRecordAgeMs: args.maxRecordAgeMs
+  });
   content[args.record.deploymentToken] = args.record;
   return {
     address: args.sender,
@@ -2742,6 +2817,55 @@ async function publishVmBootstrapConfigAggregate(args) {
     aggregateStatus
   };
 }
+function normalizeAggregateMessageHashRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const candidate = value;
+  const itemHash = typeof candidate.item_hash === "string" ? candidate.item_hash.trim() : "";
+  if (!itemHash) return null;
+  const content = candidate.content && typeof candidate.content === "object" && !Array.isArray(candidate.content) ? candidate.content : typeof candidate.item_content === "string" ? parseJsonObject(candidate.item_content) : null;
+  if (!content || content.key !== VM_BOOTSTRAP_CONFIG_AGGREGATE_KEY) return null;
+  const timeMs = parseTimestampMs(candidate.time);
+  if (timeMs == null) return null;
+  return { itemHash, timeMs };
+}
+async function listStaleVmBootstrapConfigAggregateMessageHashes(args) {
+  const address = args.address.trim();
+  if (!address) return [];
+  const currentAggregateItemHash = args.currentAggregateItemHash?.trim() ?? "";
+  const olderThanMs = Math.max(
+    6e4,
+    Number(args.olderThanMs ?? VM_BOOTSTRAP_CONFIG_HISTORY_RETENTION_MS)
+  );
+  const cutoffMs = Math.max(0, Number(args.nowMs ?? Date.now()) - olderThanMs);
+  const pagination = Math.max(1, Number(args.pagination ?? 100));
+  const maxPages = Math.max(1, Number(args.maxPages ?? 10));
+  const hashes = /* @__PURE__ */ new Set();
+  for (let page = 1; page <= maxPages; page += 1) {
+    const requestUrl = new URL("/api/v0/messages.json", args.apiHost ?? DEFAULT_ALEPH_API_HOST2);
+    requestUrl.searchParams.set("msgType", "AGGREGATE");
+    requestUrl.searchParams.set("addresses", address);
+    requestUrl.searchParams.set("message_statuses", "processed,pending,rejected,removing");
+    requestUrl.searchParams.set("pagination", String(pagination));
+    requestUrl.searchParams.set("page", String(page));
+    requestUrl.searchParams.set("sortOrder", "-1");
+    const response = await args.fetch(requestUrl.toString(), { cache: "no-cache" });
+    if (!response.ok) {
+      throw new Error(`VM bootstrap config aggregate history request failed: ${response.status}`);
+    }
+    const payload = await response.json();
+    const messages = Array.isArray(payload.messages) ? payload.messages : [];
+    if (messages.length === 0) break;
+    for (const message of messages) {
+      const normalized = normalizeAggregateMessageHashRecord(message);
+      if (!normalized) continue;
+      if (normalized.itemHash === currentAggregateItemHash) continue;
+      if (normalized.timeMs > cutoffMs) continue;
+      hashes.add(normalized.itemHash);
+    }
+    if (messages.length < pagination) break;
+  }
+  return [...hashes];
+}
 async function publishVmBootstrapConfig(args) {
   const aggregate = await fetchVmBootstrapConfigAggregate(args.sender, {
     apiHost: args.apiHost,
@@ -2750,7 +2874,8 @@ async function publishVmBootstrapConfig(args) {
   const content = createVmBootstrapConfigAggregateContent({
     sender: args.sender,
     record: args.record,
-    existingAggregate: aggregate
+    existingAggregate: aggregate,
+    maxRecordAgeMs: VM_BOOTSTRAP_CONFIG_HISTORY_RETENTION_MS
   });
   const result = await publishVmBootstrapConfigAggregate({
     sender: args.sender,
@@ -2772,7 +2897,9 @@ async function deleteVmBootstrapConfig(args) {
     apiHost: args.apiHost,
     fetch: args.fetch
   });
-  const content = normalizeVmBootstrapConfigAggregate(aggregate);
+  const content = normalizeVmBootstrapConfigAggregate(aggregate, {
+    maxRecordAgeMs: VM_BOOTSTRAP_CONFIG_HISTORY_RETENTION_MS
+  });
   delete content[args.deploymentToken];
   const publishResult = await publishVmBootstrapConfigAggregate({
     sender: args.sender,
@@ -2794,6 +2921,89 @@ async function deleteVmBootstrapConfig(args) {
     aggregate: content
   };
 }
+function normalizeVmBootstrapConfigSignalRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const candidate = value;
+  const deploymentToken = typeof candidate.deploymentToken === "string" ? candidate.deploymentToken.trim() : "";
+  const status = typeof candidate.status === "string" ? candidate.status.trim() : "";
+  const profile = typeof candidate.profile === "string" ? candidate.profile.trim() : "";
+  const ownerAddress = typeof candidate.ownerAddress === "string" ? candidate.ownerAddress.trim() : "";
+  const instanceItemHash = typeof candidate.instanceItemHash === "string" ? candidate.instanceItemHash.trim() : "";
+  const updatedAt = typeof candidate.updatedAt === "string" ? candidate.updatedAt.trim() : "";
+  if (!deploymentToken || !status || !profile || !ownerAddress || !instanceItemHash || !updatedAt) {
+    return null;
+  }
+  return {
+    deploymentToken,
+    status,
+    profile,
+    ownerAddress,
+    instanceItemHash,
+    updatedAt,
+    publisherAddress: typeof candidate.publisherAddress === "string" && candidate.publisherAddress.trim() ? candidate.publisherAddress.trim() : null,
+    authorization: candidate.authorization,
+    peerId: typeof candidate.peerId === "string" && candidate.peerId.trim() ? candidate.peerId.trim() : null,
+    probeMultiaddrs: Array.isArray(candidate.probeMultiaddrs) ? candidate.probeMultiaddrs.filter(
+      (entry) => typeof entry === "string" && entry.trim().length > 0
+    ) : [],
+    browserBootstrapMultiaddrs: Array.isArray(candidate.browserBootstrapMultiaddrs) ? candidate.browserBootstrapMultiaddrs.filter(
+      (entry) => typeof entry === "string" && entry.trim().length > 0
+    ) : []
+  };
+}
+async function fetchVmBootstrapConfigSignals(args) {
+  const requestUrl = new URL("/api/v0/posts.json", args.apiHost ?? DEFAULT_ALEPH_API_HOST2);
+  requestUrl.searchParams.set("refs", args.ref ?? VM_BOOTSTRAP_CONFIG_SIGNAL_REF);
+  requestUrl.searchParams.set("types", args.postType ?? VM_BOOTSTRAP_CONFIG_SIGNAL_POST_TYPE);
+  requestUrl.searchParams.set("pagination", String(Math.max(1, Number(args.pagination ?? 100))));
+  requestUrl.searchParams.set("page", String(Math.max(1, Number(args.page ?? 1))));
+  requestUrl.searchParams.set("sortOrder", "-1");
+  const response = await args.fetch(requestUrl.toString(), { cache: "no-cache" });
+  if (!response.ok) {
+    throw new Error(`VM bootstrap config signal request failed: ${response.status}`);
+  }
+  const payload = await response.json();
+  const expectedDeploymentToken = args.deploymentToken?.trim() ?? "";
+  const expectedOwnerAddress = args.ownerAddress?.trim().toLowerCase() ?? "";
+  const expectedInstanceItemHash = args.instanceItemHash?.trim() ?? "";
+  return (payload.posts ?? []).map((entry) => {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) return null;
+    const parsed = "content" in entry && entry.content && typeof entry.content === "object" && !Array.isArray(entry.content) ? entry.content : "item_content" in entry && typeof entry.item_content === "string" ? parseJsonObject(entry.item_content) : null;
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+    const content = "deploymentToken" in parsed ? parsed : "content" in parsed && parsed.content && typeof parsed.content === "object" && !Array.isArray(parsed.content) ? parsed.content : null;
+    if (!content || typeof content !== "object" || Array.isArray(content)) return null;
+    return normalizeVmBootstrapConfigSignalRecord(content);
+  }).filter((entry) => {
+    if (!entry) return false;
+    if (expectedDeploymentToken && entry.deploymentToken !== expectedDeploymentToken) return false;
+    if (expectedOwnerAddress && entry.ownerAddress.toLowerCase() !== expectedOwnerAddress) return false;
+    if (expectedInstanceItemHash && entry.instanceItemHash !== expectedInstanceItemHash) return false;
+    return true;
+  });
+}
+async function waitForVmBootstrapConfigSignal(args) {
+  const attempts = Math.max(1, Number(args.attempts ?? 24));
+  const delayMs = Math.max(0, Number(args.delayMs ?? 2500));
+  const sleep2 = args.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const expectedStatus = args.expectedStatus ?? "applied";
+  for (let attempt = 0; attempt < attempts; attempt += 1) {
+    const signals = await fetchVmBootstrapConfigSignals({
+      deploymentToken: args.deploymentToken,
+      ownerAddress: args.ownerAddress,
+      instanceItemHash: args.instanceItemHash,
+      fetch: args.fetch,
+      apiHost: args.apiHost,
+      ref: args.ref,
+      postType: args.postType
+    }).catch(() => []);
+    const match = signals.find((entry) => entry.status === expectedStatus) ?? null;
+    if (match) return match;
+    if (attempt < attempts - 1) {
+      await sleep2(delayMs);
+    }
+  }
+  return null;
+}
 
 // ../core/src/bootstrap-reconcile.ts
 function createRelayBootstrapRegistrationId(profile, instanceName, itemHash) {
@@ -3053,6 +3263,22 @@ function relayBootstrapInstanceItemHash(entry) {
   }
   return registrationIdInstanceItemHash(entry?.content?.registrationId);
 }
+function relayBootstrapMatchesCurrentWallet(entry, normalizedWalletAddress, activeInstanceHashes) {
+  const instanceItemHash = relayBootstrapInstanceItemHash(entry);
+  if (instanceItemHash && activeInstanceHashes.has(instanceItemHash)) {
+    return true;
+  }
+  const candidateAddresses = [
+    entry?.address,
+    entry?.content?.ownerAddress,
+    entry?.content?.authorization?.payload?.ownerAddress,
+    entry?.content?.publisherAddress,
+    entry?.content?.authorization?.payload?.publisherAddress
+  ];
+  return candidateAddresses.some(
+    (value) => typeof value === "string" && value.trim().toLowerCase() === normalizedWalletAddress
+  );
+}
 async function inspectInstanceRuntime(args) {
   const details = {
     messageStatus: String(
@@ -3279,11 +3505,13 @@ var SponsorRelayController = class {
     if (!args.runtime.hostIpv4) {
       throw new Error("Relay runtime did not expose a host IPv4 address.");
     }
-    const mappedPorts2 = args.runtime.mappedPorts ?? {};
+    let runtime = args.runtime;
+    let mappedPorts2 = runtime.mappedPorts ?? {};
     const setupPort = mappedPorts2["80"]?.host ?? null;
     if (!setupPort) {
       throw new Error("Relay runtime did not expose the temporary setup endpoint.");
     }
+    let bootstrapSignalRelayMetadata = null;
     if (profile === "orbitdb-relay-pinner") {
       this.emitProgress({
         stage: "deployment-confirmed",
@@ -3352,6 +3580,57 @@ var SponsorRelayController = class {
       if (!args.deploymentToken) {
         throw new Error("Missing deployment token for Aleph bootstrap config handoff.");
       }
+      if (runtime.proxyUrl && runtime.webAccess?.active !== true) {
+        this.emitProgress({
+          stage: "deployment-confirmed",
+          label: "Waiting for HTTPS route",
+          progress: 93,
+          status: "warning",
+          itemHash: args.itemHash,
+          detail: "The relay received a 2n6 hostname, but it is not active yet. Waiting before handing HTTPS config to the guest."
+        });
+        let latestRuntime = runtime;
+        for (let attempt = 0; attempt < UI_RUNTIME_WAIT_ATTEMPTS; attempt += 1) {
+          if (latestRuntime.webAccess?.active === true) {
+            break;
+          }
+          await new Promise(
+            (resolve) => globalThis.setTimeout(resolve, UI_RUNTIME_WAIT_DELAY_MS)
+          );
+          latestRuntime = await fetchVmRuntime({
+            itemHash: args.itemHash,
+            fetch: (url, init) => fetch(url, init),
+            crnHash: runtime.selectedCrn?.hash ?? runtime.allocation?.crnHash ?? void 0,
+            crns: this.state.crns,
+            crnListUrl: this.props.crnListUrl,
+            requirePublicGuestIpv6ForProxy: true
+          }).catch(() => latestRuntime);
+          this.emitProgress({
+            stage: "deployment-confirmed",
+            label: "Waiting for HTTPS route",
+            progress: 93,
+            status: latestRuntime.webAccess?.active === true ? "info" : "warning",
+            itemHash: args.itemHash,
+            detail: `2n6 activation ${attempt + 1}/${UI_RUNTIME_WAIT_ATTEMPTS}: ${latestRuntime.webAccess?.active === true ? "active" : "still pending"} for ${latestRuntime.proxyUrl ?? runtime.proxyUrl ?? "reserved proxy URL"}.`
+          });
+          this.trace("deploy:bootstrap-proxy-activation", {
+            itemHash: args.itemHash,
+            attempt: attempt + 1,
+            attempts: UI_RUNTIME_WAIT_ATTEMPTS,
+            active: latestRuntime.webAccess?.active === true,
+            proxyUrl: latestRuntime.proxyUrl ?? null
+          });
+        }
+        runtime = latestRuntime;
+        mappedPorts2 = runtime.mappedPorts ?? mappedPorts2;
+      }
+      if (!runtime.hostIpv4) {
+        throw new Error(
+          "Relay runtime lost its host IPv4 address while waiting for HTTPS activation."
+        );
+      }
+      const runtimeHostIpv4 = runtime.hostIpv4;
+      const activeProxyUrl = runtime.webAccess?.active === true ? runtime.proxyUrl ?? null : null;
       this.emitProgress({
         stage: "deployment-confirmed",
         label: "Publishing relay config",
@@ -3369,9 +3648,9 @@ var SponsorRelayController = class {
         expiresAt: new Date(Date.now() + 30 * 6e4).toISOString(),
         status: "pending",
         runtime: {
-          publicIpv4: args.runtime.hostIpv4,
-          publicIpv6: args.runtime.ipv6 ?? null,
-          proxyUrl: args.runtime.proxyUrl ?? null,
+          publicIpv4: runtimeHostIpv4,
+          publicIpv6: runtime.ipv6 ?? null,
+          proxyUrl: activeProxyUrl,
           mappedPorts: mappedPorts2
         },
         bootstrap: {
@@ -3400,54 +3679,120 @@ var SponsorRelayController = class {
         aggregateItemHash: bootstrapConfigPublication.aggregateItemHash,
         aggregateStatus: bootstrapConfigPublication.aggregateStatus
       });
-    }
-    this.emitProgress({
-      stage: "publishing-bootstrap",
-      label: "Reading relay multiaddrs",
-      progress: 95,
-      status: "info",
-      itemHash: args.itemHash,
-      detail: "Waiting for the relay to report its final public multiaddrs."
-    });
-    const relayMetadata = await fetchRelayMetadataForRuntime({
-      runtime: args.runtime,
-      fetch: (url, init) => fetch(url, init),
-      preferSecureMetadata: profile === "uc-go-peer",
-      attempts: 80,
-      delayMs: 3e3,
-      timeoutMs: 24e4,
-      onAttempt: (result) => {
-        const payload = result.payload && typeof result.payload === "object" ? result.payload : null;
-        const metadata = payload?.metadata && typeof payload.metadata === "object" ? payload.metadata : null;
-        this.trace("deploy:relay-metadata-attempt", {
+      this.emitProgress({
+        stage: "deployment-confirmed",
+        label: "Waiting for guest config",
+        progress: 94,
+        status: "info",
+        itemHash: args.itemHash,
+        detail: "Waiting for the relay VM to acknowledge that it consumed the Aleph bootstrap config."
+      });
+      const bootstrapConfigSignal = await waitForVmBootstrapConfigSignal({
+        deploymentToken: args.deploymentToken,
+        ownerAddress: this.state.wallet.address,
+        instanceItemHash: args.itemHash,
+        fetch: asJsonFetch,
+        apiHost: this.client.apiHost,
+        attempts: 40,
+        delayMs: 3e3
+      });
+      this.trace("deploy:bootstrap-config-signal-visible", {
+        itemHash: args.itemHash,
+        deploymentToken: args.deploymentToken,
+        bootstrapConfigSignal
+      });
+      if (!bootstrapConfigSignal) {
+        throw new Error(
+          "The relay VM did not confirm that it applied the Aleph bootstrap config in time."
+        );
+      }
+      bootstrapSignalRelayMetadata = typeof bootstrapConfigSignal.peerId === "string" && bootstrapConfigSignal.peerId.length > 0 && Array.isArray(bootstrapConfigSignal.probeMultiaddrs) && bootstrapConfigSignal.probeMultiaddrs.length > 0 ? {
+        peerId: bootstrapConfigSignal.peerId,
+        probeMultiaddrs: bootstrapConfigSignal.probeMultiaddrs,
+        browserBootstrapMultiaddrs: bootstrapConfigSignal.browserBootstrapMultiaddrs ?? []
+      } : null;
+      if (runtime.proxyUrl && runtime.webAccess?.active !== true) {
+        this.trace("deploy:bootstrap-proxy-fallback", {
           itemHash: args.itemHash,
-          attempt: result.attempt,
-          attempts: result.attempts,
-          requestUrl: result.requestUrl,
-          metadataUrl: result.metadataUrl,
-          hostIpv4: result.hostIpv4,
-          setupPort: result.setupPort,
-          ok: result.ok,
-          status: result.status,
-          ready: result.ready,
-          error: result.error ?? null,
-          payloadStatus: payload && typeof payload.status === "string" ? payload.status : null,
-          peerId: metadata && typeof metadata.peer_id === "string" ? metadata.peer_id : null,
-          probeMultiaddrCount: Array.isArray(metadata?.probe_multiaddrs) ? metadata.probe_multiaddrs.length : 0,
-          browserBootstrapMultiaddrCount: Array.isArray(
-            metadata?.browser_bootstrap_multiaddrs
-          ) ? metadata.browser_bootstrap_multiaddrs.length : 0
+          deploymentToken: args.deploymentToken,
+          proxyUrl: runtime.proxyUrl,
+          bootstrapSignalRelayMetadata
         });
         this.emitProgress({
-          stage: "publishing-bootstrap",
-          label: "Reading relay multiaddrs",
-          progress: 95,
-          status: result.ready ? "success" : "info",
+          stage: "deployment-confirmed",
+          label: "Continuing without HTTPS route",
+          progress: 94,
+          status: "warning",
           itemHash: args.itemHash,
-          detail: result.ready ? `Relay metadata ${result.attempt}/${result.attempts}: public multiaddrs available.` : `Relay metadata ${result.attempt}/${result.attempts}: waiting for the relay to report public multiaddrs.`
+          detail: "The 2n6 HTTPS route stayed inactive, so guest setup continued without Caddy. Secure browser routing can be enabled later when the proxy becomes available."
         });
+        runtime = {
+          ...runtime,
+          proxyUrl: null,
+          webAccess: runtime.webAccess ? {
+            ...runtime.webAccess,
+            active: false
+          } : runtime.webAccess
+        };
       }
-    });
+    }
+    let relayMetadata = bootstrapSignalRelayMetadata;
+    if (relayMetadata) {
+      this.trace("deploy:relay-metadata-from-bootstrap-signal", {
+        itemHash: args.itemHash,
+        peerId: relayMetadata.peerId,
+        probeMultiaddrCount: relayMetadata.probeMultiaddrs.length,
+        browserBootstrapMultiaddrCount: relayMetadata.browserBootstrapMultiaddrs.length
+      });
+    } else {
+      this.emitProgress({
+        stage: "publishing-bootstrap",
+        label: "Waiting for secure relay metadata",
+        progress: 95,
+        status: "warning",
+        itemHash: args.itemHash,
+        detail: "Runtime networking is available. Waiting for the secure relay metadata endpoint to report final public multiaddrs."
+      });
+      relayMetadata = await fetchRelayMetadataForRuntime({
+        runtime,
+        fetch: (url, init) => fetch(url, init),
+        preferSecureMetadata: profile === "uc-go-peer" && Boolean(runtime.proxyUrl),
+        attempts: 80,
+        delayMs: 3e3,
+        timeoutMs: 24e4,
+        onAttempt: (result) => {
+          const payload = result.payload && typeof result.payload === "object" ? result.payload : null;
+          const metadata = payload?.metadata && typeof payload.metadata === "object" ? payload.metadata : null;
+          this.trace("deploy:relay-metadata-attempt", {
+            itemHash: args.itemHash,
+            attempt: result.attempt,
+            attempts: result.attempts,
+            requestUrl: result.requestUrl,
+            metadataUrl: result.metadataUrl,
+            hostIpv4: result.hostIpv4,
+            setupPort: result.setupPort,
+            ok: result.ok,
+            status: result.status,
+            ready: result.ready,
+            error: result.error ?? null,
+            payloadStatus: payload && typeof payload.status === "string" ? payload.status : null,
+            peerId: metadata && typeof metadata.peer_id === "string" ? metadata.peer_id : null,
+            probeMultiaddrCount: Array.isArray(metadata?.probe_multiaddrs) ? metadata.probe_multiaddrs.length : 0,
+            browserBootstrapMultiaddrCount: Array.isArray(
+              metadata?.browser_bootstrap_multiaddrs
+            ) ? metadata.browser_bootstrap_multiaddrs.length : 0
+          });
+          this.emitProgress({
+            stage: "publishing-bootstrap",
+            label: result.ready ? "Secure relay metadata ready" : "Waiting for secure relay metadata",
+            progress: 95,
+            status: result.ready ? "success" : "warning",
+            itemHash: args.itemHash,
+            detail: result.ready ? `Relay metadata ${result.attempt}/${result.attempts}: secure endpoint responded and public multiaddrs are available.` : `Relay metadata ${result.attempt}/${result.attempts}: waiting for ${result.metadataUrl}.`
+          });
+        }
+      });
+    }
     if (!relayMetadata) {
       throw new Error("Relay metadata did not include a peer ID and public multiaddrs.");
     }
@@ -3557,6 +3902,7 @@ var SponsorRelayController = class {
       }
     }
     if (profile === "uc-go-peer" && args.deploymentToken) {
+      let cleanupAggregateItemHash = null;
       await deleteVmBootstrapConfig({
         sender: this.state.wallet.address,
         deploymentToken: args.deploymentToken,
@@ -3565,6 +3911,14 @@ var SponsorRelayController = class {
         fetch: asJsonFetch,
         apiHost: this.client.apiHost,
         sync: true
+      }).then((cleanupResult) => {
+        cleanupAggregateItemHash = cleanupResult.aggregateItemHash;
+        this.trace("deploy:bootstrap-config-cleanup-complete", {
+          itemHash: args.itemHash,
+          deploymentToken: args.deploymentToken,
+          aggregateItemHash: cleanupResult.aggregateItemHash,
+          aggregateStatus: cleanupResult.aggregateStatus
+        });
       }).catch((error) => {
         this.trace("deploy:bootstrap-config-cleanup-error", {
           itemHash: args.itemHash,
@@ -3572,7 +3926,74 @@ var SponsorRelayController = class {
           error: error instanceof Error ? error.message : String(error)
         });
       });
+      await this.cleanupStaleVmBootstrapConfigHistory({
+        itemHash: args.itemHash,
+        currentAggregateItemHash: cleanupAggregateItemHash,
+        stage: "publishing-bootstrap",
+        progress: 99
+      });
+    }
+  }
+  async cleanupStaleVmBootstrapConfigHistory(args) {
+    if (!this.state.wallet.address || !args.currentAggregateItemHash) {
+      return;
+    }
+    const staleHashes = await listStaleVmBootstrapConfigAggregateMessageHashes({
+      address: this.state.wallet.address,
+      currentAggregateItemHash: args.currentAggregateItemHash,
+      olderThanMs: VM_BOOTSTRAP_CONFIG_HISTORY_RETENTION_MS,
+      fetch: asJsonFetch,
+      apiHost: this.client.apiHost
+    }).catch((error) => {
+      this.trace("deploy:bootstrap-config-history-scan-error", {
+        itemHash: args.itemHash,
+        currentAggregateItemHash: args.currentAggregateItemHash,
+        error: error instanceof Error ? error.message : String(error)
+      });
+      return [];
+    });
+    if (staleHashes.length === 0) {
+      return;
     }
+    const staleCount = staleHashes.length;
+    this.emitProgress({
+      stage: args.stage,
+      label: "Cleaning up stale handoff history",
+      progress: args.progress,
+      status: "warning",
+      itemHash: args.itemHash,
+      detail: `Forgetting ${staleCount} superseded Aleph handoff aggregate message${staleCount === 1 ? "" : "s"} older than 6 hours. MetaMask may request another cleanup signature.`
+    });
+    this.trace("deploy:bootstrap-config-history-cleanup-start", {
+      itemHash: args.itemHash,
+      currentAggregateItemHash: args.currentAggregateItemHash,
+      staleHashes
+    });
+    await forgetAlephMessages({
+      sender: this.state.wallet.address,
+      hashes: staleHashes,
+      reason: "Prune stale vm-bootstrap-config aggregate history older than 6 hours",
+      signer: personalSign,
+      hasher: sha256Hex,
+      fetch: asJsonFetch,
+      apiHost: this.client.apiHost,
+      sync: true
+    }).then((cleanupResult) => {
+      this.trace("deploy:bootstrap-config-history-cleanup-complete", {
+        itemHash: args.itemHash,
+        currentAggregateItemHash: args.currentAggregateItemHash,
+        staleHashes,
+        forgetItemHash: cleanupResult.itemHash,
+        forgetStatus: cleanupResult.status
+      });
+    }).catch((error) => {
+      this.trace("deploy:bootstrap-config-history-cleanup-error", {
+        itemHash: args.itemHash,
+        currentAggregateItemHash: args.currentAggregateItemHash,
+        staleHashes,
+        error: error instanceof Error ? error.message : String(error)
+      });
+    });
   }
   syncLatestDeploymentProgress(instances) {
     const itemHash = this.state.lastDeploymentHash;
@@ -3588,6 +4009,15 @@ var SponsorRelayController = class {
     const currentProgress = this.state.deploymentProgress;
     const currentProgressIsForLatestHash = currentProgress.itemHash === itemHash || currentProgress.itemHash == null && currentProgress.stage !== "idle" && currentProgress.stage !== "error";
     const keepTerminalSuccess = this.lastCompletedDeploymentHash === itemHash || currentProgressIsForLatestHash && currentProgress.stage === "completed" && currentProgress.status === "success";
+    if (currentProgressIsForLatestHash && currentProgress.stage === "publishing-bootstrap") {
+      this.trace("progress:retain-active-phase", {
+        reason: "latest refresh would overwrite active relay metadata/bootstrap progress",
+        itemHash,
+        label: currentProgress.label,
+        progress: currentProgress.progress
+      });
+      return;
+    }
     const status = latest.details.messageStatus;
     if (status === "rejected") {
       this.emitProgress({
@@ -3940,7 +4370,11 @@ var SponsorRelayController = class {
           instances.map((entry) => entry.instance.item_hash)
         );
         bootstrapRegistrations = selectCurrentRelayBootstrapPosts(rawBootstrapPosts).filter(
-          (entry) => entry.address?.toLowerCase() === normalizedWalletAddress
+          (entry) => relayBootstrapMatchesCurrentWallet(
+            entry,
+            normalizedWalletAddress,
+            activeInstanceHashes
+          )
         ).map((entry) => {
           const instanceItemHash = relayBootstrapInstanceItemHash(entry);
           const messageHash = entry.itemHash ?? entry.hash ?? null;
@@ -3959,6 +4393,8 @@ var SponsorRelayController = class {
               registrationId: entry.content.registrationId,
               multiaddrs: Array.isArray(entry.content.multiaddrs) ? entry.content.multiaddrs : [],
               browserMultiaddrs: Array.isArray(entry.content.browserMultiaddrs) ? entry.content.browserMultiaddrs : [],
+              ownerAddress: typeof entry.content.ownerAddress === "string" ? entry.content.ownerAddress : void 0,
+              publisherAddress: typeof entry.content.publisherAddress === "string" ? entry.content.publisherAddress : void 0,
               updatedAt: entry.content.updatedAt
             } : null
           };
@@ -4227,10 +4663,11 @@ var SponsorRelayController = class {
             crnHash: candidateCrn.hash,
             crns: this.state.crns,
             crnListUrl: this.props.crnListUrl,
+            requirePublicGuestIpv6ForProxy: true,
             attempts: UI_RUNTIME_WAIT_ATTEMPTS,
             delayMs: UI_RUNTIME_WAIT_DELAY_MS,
             onAttempt: (runtime2, attempt, attempts) => {
-              if (runtime2.hostIpv4 && Object.keys(runtime2.mappedPorts ?? {}).length > 0) {
+              if (runtime2.diagnostics?.state === "ready") {
                 this.emitProgress({
                   stage: "deployment-confirmed",
                   label: "Runtime ready",
@@ -4241,6 +4678,17 @@ var SponsorRelayController = class {
                 });
                 return;
               }
+              if (runtime2.diagnostics?.state === "execution-invalid-public-ipv6") {
+                this.emitProgress({
+                  stage: "deployment-confirmed",
+                  label: "Rejecting unusable runtime",
+                  progress: 91,
+                  status: "warning",
+                  itemHash: result.itemHash,
+                  detail: runtime2.diagnostics?.reason ? `Runtime ${attempt}/${attempts}: ${runtime2.diagnostics.reason} Cleaning up this CRN attempt before retrying another relay host.` : `Runtime ${attempt}/${attempts}: the CRN exposed unusable guest networking. Cleaning up this CRN attempt before retrying another relay host.`
+                });
+                return;
+              }
               this.emitProgress({
                 stage: "deployment-confirmed",
                 label: "Waiting for runtime",
@@ -4251,7 +4699,7 @@ var SponsorRelayController = class {
               });
             }
           });
-          if (!runtime.hostIpv4 || Object.keys(runtime.mappedPorts ?? {}).length === 0) {
+          if (runtime.diagnostics?.state !== "ready") {
             throw new Error(
               runtime.diagnostics?.reason ?? "Deployment was processed, but runtime networking never exposed mapped ports."
             );
@@ -4300,6 +4748,7 @@ var SponsorRelayController = class {
         } catch (error) {
           lastError = error instanceof Error ? error : new Error(String(error));
           const attemptLabel = crnDisplayName;
+          const failedDueToInvalidIpv6 = /not globally routable|public guest IPv6/i.test(lastError.message);
           attemptErrors.push(`${attemptLabel}: ${lastError.message}`);
           this.trace("deploy:crn-attempt-error", {
             crnHash: candidateCrn.hash,
@@ -4308,7 +4757,24 @@ var SponsorRelayController = class {
             error: lastError.message
           });
           if (attemptItemHash) {
+            this.emitProgress({
+              stage: "deployment-confirmed",
+              label: failedDueToInvalidIpv6 ? "Rejecting unusable runtime" : "Cleaning up failed attempt",
+              progress: failedDueToInvalidIpv6 ? 91 : 16,
+              status: "warning",
+              itemHash: attemptItemHash,
+              detail: failedDueToInvalidIpv6 ? `${attemptLabel} exposed runtime networking that cannot support proxy-backed HTTPS. Cleaning up this attempt before retrying another CRN.` : `${attemptLabel} failed: ${lastError.message} Cleaning up this attempt before retrying another CRN.`
+            });
             if (attemptDeploymentToken) {
+              let cleanupAggregateItemHash = null;
+              this.emitProgress({
+                stage: "deployment-confirmed",
+                label: "Cleaning up failed attempt",
+                progress: 17,
+                status: "warning",
+                itemHash: attemptItemHash,
+                detail: "Removing bootstrap configuration for the failed attempt. MetaMask may request a cleanup signature."
+              });
               this.trace("deploy:bootstrap-config-cleanup-start", {
                 itemHash: attemptItemHash,
                 deploymentToken: attemptDeploymentToken
@@ -4322,6 +4788,7 @@ var SponsorRelayController = class {
                 apiHost: this.client.apiHost,
                 sync: true
               }).then((cleanupResult) => {
+                cleanupAggregateItemHash = cleanupResult.aggregateItemHash;
                 this.trace("deploy:bootstrap-config-cleanup-complete", {
                   itemHash: attemptItemHash,
                   deploymentToken: attemptDeploymentToken,
@@ -4335,7 +4802,21 @@ var SponsorRelayController = class {
                   error: cleanupError instanceof Error ? cleanupError.message : String(cleanupError)
                 });
               });
+              await this.cleanupStaleVmBootstrapConfigHistory({
+                itemHash: attemptItemHash,
+                currentAggregateItemHash: cleanupAggregateItemHash,
+                stage: "deployment-confirmed",
+                progress: 18
+              });
             }
+            this.emitProgress({
+              stage: "deployment-confirmed",
+              label: "Cleaning up failed attempt",
+              progress: 18,
+              status: "warning",
+              itemHash: attemptItemHash,
+              detail: "Forgetting the failed deployment attempt on Aleph. MetaMask may request another cleanup signature."
+            });
             this.trace("deploy:forget-failed-attempt-start", {
               itemHash: attemptItemHash,
               crnHash: candidateCrn.hash,
@@ -4368,11 +4849,11 @@ var SponsorRelayController = class {
           if (candidateIndex < orderedCrns.length - 1) {
             this.emitProgress({
               stage: "selecting-crn",
-              label: `Retrying after ${crnAttemptLabel}`,
+              label: "Retrying on next CRN",
               progress: 20,
               status: "warning",
               itemHash: attemptItemHash,
-              detail: `${attemptLabel} failed: ${lastError.message}`,
+              detail: `${attemptLabel} was discarded: ${lastError.message}`,
               error: lastError.message
             });
             continue;
@@ -4404,6 +4885,17 @@ var SponsorRelayController = class {
       this.patch({ errorText: "Connect MetaMask before deleting instances." });
       return;
     }
+    const linkedRegistrationHashes = Array.from(
+      new Set(
+        this.state.bootstrapRegistrations.filter((entry) => entry.instanceItemHash === instanceHash).map(
+          (entry) => entry.messageHash?.trim() ?? entry.itemHash?.trim() ?? entry.hash?.trim() ?? null
+        ).filter((value) => Boolean(value))
+      )
+    );
+    const hashesToForget = Array.from(
+      /* @__PURE__ */ new Set([instanceHash, ...linkedRegistrationHashes])
+    );
+    const linkedRegistrationCount = linkedRegistrationHashes.length;
     this.patch({
       busy: { deletingInstanceHash: instanceHash },
       errorText: null,
@@ -4416,12 +4908,12 @@ var SponsorRelayController = class {
         progress: 6,
         status: "warning",
         itemHash: instanceHash,
-        detail: "Preparing Aleph FORGET message."
+        detail: linkedRegistrationCount > 0 ? `Preparing Aleph FORGET message for the instance and ${linkedRegistrationCount} linked bootstrap registration${linkedRegistrationCount === 1 ? "" : "s"}.` : "Preparing Aleph FORGET message."
       });
       await forgetAlephMessages({
         sender: this.state.wallet.address,
-        hashes: [instanceHash],
-        reason: "Deleted from Sponsor Relay panel",
+        hashes: hashesToForget,
+        reason: linkedRegistrationCount > 0 ? `Deleted instance and ${linkedRegistrationCount} linked relay bootstrap registration${linkedRegistrationCount === 1 ? "" : "s"} from Sponsor Relay panel` : "Deleted from Sponsor Relay panel",
         signer: personalSign,
         hasher: sha256Hex,
         fetch: asJsonFetch,
@@ -4440,17 +4932,20 @@ var SponsorRelayController = class {
         progress: 92,
         status: "info",
         itemHash: instanceHash,
-        detail: "Reloading current deployments."
+        detail: linkedRegistrationCount > 0 ? "Reloading current deployments and relay bootstrap registrations." : "Reloading current deployments."
       });
       await this.refresh();
-      this.trace("delete:submitted", { instanceHash });
+      this.trace("delete:submitted", {
+        instanceHash,
+        linkedRegistrationHashes
+      });
       this.emitProgress({
         stage: "completed",
         label: "Delete completed",
         progress: 100,
         status: "success",
         itemHash: instanceHash,
-        detail: "Delete request submitted and deployments refreshed.",
+        detail: linkedRegistrationCount > 0 ? `Delete request submitted, including ${linkedRegistrationCount} linked bootstrap registration${linkedRegistrationCount === 1 ? "" : "s"}, and state refreshed.` : "Delete request submitted and deployments refreshed.",
         error: null
       });
     } catch (error) {