@le-space/ui 0.4.4 → 0.4.5

package/shared/index.js

@@ -27,7 +27,7 @@ var RECENT_INSTANCE_RUNTIME_GRACE_MS = 10 * 60 * 1e3;
 var DEPLOYMENT_PENDING_WARNING_MS = 3 * 60 * 1e3;
 
 // src/shared/package-version.ts
-var UI_PACKAGE_VERSION = "0.4.4";
+var UI_PACKAGE_VERSION = "0.4.5";
 
 // src/shared/format.ts
 function shortHash(value, head = 8, tail = 6) {
@@ -119,7 +119,7 @@ async function fetchWithTimeout(input, init = {}, timeoutMs = 15e3) {
 }
 
 // ../browser/src/aleph-api.ts
-var DEFAULT_ALEPH_API_HOST = "https://api2.aleph.im";
+var DEFAULT_ALEPH_API_HOST = "https://api.aleph.im";
 var DEFAULT_CRN_LIST_URL = "https://crns-list.aleph.sh/crns.json";
 var DEFAULT_ALEPH_SCHEDULER_API_HOST = "https://scheduler.api.aleph.cloud";
 var DEFAULT_2N6_API_HOST = "https://api.2n6.me";
@@ -187,7 +187,7 @@ async function fetchInstances(address, apiHost = DEFAULT_ALEPH_API_HOST) {
   const url = new URL("/api/v0/messages.json", apiHost);
   url.searchParams.set("msgTypes", "INSTANCE");
   url.searchParams.set("addresses", address);
-  url.searchParams.set("message_statuses", "processed,pending,rejected,removing");
+  url.searchParams.set("message_statuses", "processed,pending,rejected");
   url.searchParams.set("pagination", "100");
   url.searchParams.set("page", "1");
   url.searchParams.set("sortOrder", "-1");
@@ -873,7 +873,7 @@ async function fetchInstancePricing(apiHost = DEFAULT_ALEPH_API_HOST, aggregateA
 var DEFAULT_ALEPH_CHANNEL = "TEST";
 
 // ../core/src/manifests.ts
-var DEFAULT_ALEPH_API_HOST2 = "https://api2.aleph.im";
+var DEFAULT_ALEPH_API_HOST2 = "https://api.aleph.im";
 
 // ../core/src/crns.ts
 var DEFAULT_CRN_LIST_URL2 = "https://crns-list.aleph.sh/crns.json";
@@ -1275,6 +1275,477 @@ async function broadcastAlephMessage2(message, options) {
   throw new Error("Broadcast failed: retry budget exhausted");
 }
 
+// ../core/src/runtime.ts
+var DEFAULT_SCHEDULER_ALLOCATION_URL = "https://scheduler.api.aleph.cloud/api/v0/allocation";
+var DEFAULT_TWO_N_SIX_HASH_URL = "https://api.2n6.me/api/hash";
+function asString3(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+function asNumber3(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+function normalizeIpv6(value) {
+  if (typeof value !== "string") return null;
+  const normalized = value.trim().toLowerCase();
+  if (!normalized) return null;
+  const zoneIndex = normalized.indexOf("%");
+  return zoneIndex >= 0 ? normalized.slice(0, zoneIndex) : normalized;
+}
+function isLikelyGlobalIpv6(value) {
+  const normalized = normalizeIpv6(value);
+  if (!normalized || normalized === "::" || normalized === "::1") return false;
+  const firstHextetText = normalized.split(":", 1)[0];
+  if (!firstHextetText) return false;
+  const firstHextet = Number.parseInt(firstHextetText, 16);
+  if (!Number.isFinite(firstHextet)) return false;
+  if ((firstHextet & 65024) === 64512) return false;
+  if ((firstHextet & 65472) === 65152) return false;
+  if ((firstHextet & 65280) === 65280) return false;
+  if ((firstHextet & 65472) === 65216) return false;
+  return true;
+}
+function findCrnByHash(crns, crnHash) {
+  return crns.find((crn) => crn.hash === crnHash) ?? null;
+}
+async function fetchSchedulerAllocation2(itemHash, options) {
+  const response = await options.fetch(
+    `${options.schedulerAllocationUrl ?? DEFAULT_SCHEDULER_ALLOCATION_URL}/${itemHash}`,
+    { cache: "no-cache" }
+  );
+  if (response.status === 404) return null;
+  if (!response.ok) {
+    throw new Error(`Scheduler allocation request failed: ${response.status}`);
+  }
+  const payload = await response.json();
+  const node = payload?.node;
+  return {
+    source: "scheduler",
+    crnHash: asString3(node?.node_id),
+    crnUrl: asString3(node?.url),
+    node: node ? {
+      node_id: asString3(node.node_id) ?? void 0,
+      url: asString3(node.url) ?? void 0,
+      ipv6: asString3(node.ipv6),
+      supports_ipv6: typeof node.supports_ipv6 === "boolean" ? node.supports_ipv6 : void 0
+    } : null,
+    vmIpv6: asString3(payload?.vm_ipv6),
+    period: payload?.period ? {
+      start_timestamp: asString3(payload.period.start_timestamp) ?? void 0,
+      duration_seconds: asNumber3(payload.period.duration_seconds) ?? void 0
+    } : null
+  };
+}
+async function fetch2n6WebAccessUrl2(itemHash, options) {
+  const response = await options.fetch(
+    `${options.twoN6HashUrl ?? DEFAULT_TWO_N_SIX_HASH_URL}/${itemHash}`,
+    { cache: "no-cache" }
+  );
+  if (!response.ok) return null;
+  const payload = await response.json();
+  return {
+    url: normalizeProxyUrl2(payload?.url ?? payload?.subdomain),
+    active: typeof payload?.active === "boolean" ? payload.active : null,
+    subdomain: asString3(payload?.subdomain)
+  };
+}
+async function fetchCrnExecutionMap2(crnUrl, options) {
+  const normalizedCrnUrl = String(crnUrl).replace(/\/+$/, "");
+  for (const [version, suffix] of [
+    ["v2", "/v2/about/executions/list"],
+    ["v1", "/about/executions/list"]
+  ]) {
+    const requestUrl = `${normalizedCrnUrl}${suffix}`;
+    const response = await options.fetch(requestUrl, {
+      cache: "no-cache"
+    });
+    if (response.ok) {
+      const payload = await response.json();
+      return {
+        version,
+        payload: payload && typeof payload === "object" ? payload : null,
+        requestUrl
+      };
+    }
+    if (response.status !== 404) {
+      return {
+        version,
+        payload: null,
+        requestUrl
+      };
+    }
+  }
+  return {
+    version: "v2",
+    payload: null,
+    requestUrl: `${normalizedCrnUrl}/v2/about/executions/list`
+  };
+}
+function describeRuntimeAvailability(runtime) {
+  const execution = runtime.execution ?? null;
+  const mappedPorts2 = runtime.mappedPorts ?? {};
+  const hostIpv4 = runtime.hostIpv4 ?? null;
+  const ipv6 = runtime.ipv6 ?? null;
+  const executionGuestIpv6 = execution?.networking?.ipv6_ip ?? null;
+  const proxyUrl = runtime.proxyUrl ?? null;
+  const schedulerSource = runtime.allocation?.source ?? null;
+  const webAccessActive = runtime.webAccess?.active ?? null;
+  const mappedPortCount = Object.keys(mappedPorts2).length;
+  if (hostIpv4 && mappedPortCount > 0 && runtime.requirePublicGuestIpv6ForProxy === true && proxyUrl && executionGuestIpv6 && !isLikelyGlobalIpv6(executionGuestIpv6)) {
+    return {
+      state: "execution-invalid-public-ipv6",
+      reason: `The CRN exposed runtime networking, but the guest IPv6 (${executionGuestIpv6}) is not globally routable. Proxy-backed HTTPS activation cannot succeed until the CRN reports a public guest IPv6.`,
+      schedulerSource,
+      executionSeen: Boolean(execution),
+      webAccessActive,
+      mappedPortCount,
+      proxyUrl
+    };
+  }
+  if (hostIpv4 && mappedPortCount > 0) {
+    return {
+      state: "ready",
+      reason: null,
+      schedulerSource,
+      executionSeen: Boolean(execution),
+      webAccessActive,
+      mappedPortCount,
+      proxyUrl
+    };
+  }
+  if (!execution && proxyUrl && webAccessActive === false) {
+    return {
+      state: "proxy-reserved-inactive",
+      reason: "Aleph reserved a proxy URL for the VM, but it is still inactive and the selected CRN has not exposed execution networking yet.",
+      schedulerSource,
+      executionSeen: false,
+      webAccessActive,
+      mappedPortCount,
+      proxyUrl
+    };
+  }
+  if (!execution && schedulerSource === "manual") {
+    return {
+      state: "crn-execution-missing",
+      reason: "The deployment is pinned to a specific CRN, but that CRN is not exposing this VM in its execution list yet.",
+      schedulerSource,
+      executionSeen: false,
+      webAccessActive,
+      mappedPortCount,
+      proxyUrl
+    };
+  }
+  if (execution && !hostIpv4) {
+    return {
+      state: "execution-missing-host-ipv4",
+      reason: "The CRN exposed an execution record, but it does not include a public host IPv4 yet.",
+      schedulerSource,
+      executionSeen: true,
+      webAccessActive,
+      mappedPortCount,
+      proxyUrl
+    };
+  }
+  if (execution && mappedPortCount === 0) {
+    return {
+      state: "execution-missing-port-mappings",
+      reason: "The CRN exposed an execution record, but mapped ports are still empty.",
+      schedulerSource,
+      executionSeen: true,
+      webAccessActive,
+      mappedPortCount,
+      proxyUrl
+    };
+  }
+  return {
+    state: "runtime-pending",
+    reason: "Aleph has not exposed enough runtime networking details yet.",
+    schedulerSource,
+    executionSeen: Boolean(execution),
+    webAccessActive,
+    mappedPortCount,
+    proxyUrl
+  };
+}
+async function fetchVmRuntime(args) {
+  const crns = args.crns ?? await fetchCrns2({
+    url: args.crnListUrl ?? DEFAULT_CRN_LIST_URL2,
+    fetch: args.fetch
+  });
+  const schedulerAllocation = await fetchSchedulerAllocation2(args.itemHash, {
+    fetch: args.fetch,
+    schedulerAllocationUrl: args.schedulerAllocationUrl
+  }).catch(() => null);
+  const selectedCrn = args.crnHash ? findCrnByHash(crns, args.crnHash) : null;
+  const allocation = schedulerAllocation ?? (selectedCrn ? {
+    source: "manual",
+    crnHash: selectedCrn.hash,
+    crnUrl: selectedCrn.address,
+    node: { url: selectedCrn.address },
+    vmIpv6: null,
+    period: null
+  } : null);
+  const webAccess = await fetch2n6WebAccessUrl2(args.itemHash, {
+    fetch: args.fetch,
+    twoN6HashUrl: args.twoN6HashUrl
+  }).catch(() => null);
+  const webAccessUrl = webAccess?.url ?? null;
+  let execution = null;
+  let executionLookupBlocked = false;
+  if (allocation?.crnUrl) {
+    const executionLookup = await fetchCrnExecutionMap2(allocation.crnUrl, {
+      fetch: args.fetch
+    });
+    const executionPayload = executionLookup.payload?.[args.itemHash];
+    if (executionPayload && typeof executionPayload === "object") {
+      execution = normalizeExecution2(executionPayload, allocation.crnUrl);
+      if (!execution.networking.proxy_url && webAccessUrl) {
+        execution.networking.proxy_url = webAccessUrl;
+      }
+    } else if (executionLookup.payload == null) {
+      executionLookupBlocked = true;
+    }
+  }
+  const hostIpv4 = execution?.networking?.host_ipv4 ?? execution?.networking?.ipv4 ?? null;
+  const ipv6 = execution?.networking?.ipv6_ip ?? execution?.networking?.ipv6 ?? allocation?.vmIpv6 ?? null;
+  const mappedPorts2 = execution?.networking?.mapped_ports ?? {};
+  const sshPort = mappedPorts2?.["22"]?.host ?? null;
+  const proxyUrl = execution?.networking?.proxy_url ?? webAccessUrl ?? null;
+  const diagnostics = describeRuntimeAvailability({
+    allocation,
+    execution,
+    webAccess,
+    hostIpv4,
+    ipv6,
+    proxyUrl,
+    mappedPorts: mappedPorts2,
+    requirePublicGuestIpv6ForProxy: args.requirePublicGuestIpv6ForProxy
+  });
+  return {
+    allocation,
+    execution,
+    webAccess,
+    webAccessUrl,
+    hostIpv4,
+    ipv6,
+    proxyUrl,
+    mappedPorts: mappedPorts2,
+    diagnostics,
+    sshCommand: hostIpv4 && sshPort ? `ssh root@${hostIpv4} -p ${sshPort}` : ipv6 ? `ssh root@${ipv6}` : null,
+    selectedCrn,
+    executionLookupBlocked
+  };
+}
+async function waitForVmRuntime(args) {
+  const attempts = Math.max(1, Number(args.attempts ?? 20));
+  const delayMs = Math.max(0, Number(args.delayMs ?? 4e3));
+  const sleep2 = args.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  let lastRuntime = await fetchVmRuntime(args);
+  args.onAttempt?.(lastRuntime, 1, attempts);
+  for (let attempt = 0; attempt < attempts - 1; attempt += 1) {
+    if (lastRuntime.diagnostics?.state === "ready" || lastRuntime.diagnostics?.state === "execution-invalid-public-ipv6") {
+      return lastRuntime;
+    }
+    await sleep2(delayMs);
+    lastRuntime = await fetchVmRuntime(args);
+    args.onAttempt?.(lastRuntime, attempt + 2, attempts);
+  }
+  if (lastRuntime.diagnostics) {
+    lastRuntime.diagnostics.timedOut = true;
+  }
+  return lastRuntime;
+}
+
+// ../core/src/crn-control.ts
+function bytesToHex(bytes) {
+  return Array.from(bytes).map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function utf8Hex(value) {
+  return bytesToHex(new TextEncoder().encode(value));
+}
+function normalizeHexSignature(signature) {
+  return signature.startsWith("0x") ? signature : `0x${signature}`;
+}
+function asString4(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+function trimTrailingSlashes(value) {
+  return value.replace(/\/+$/u, "");
+}
+function isoTimestampWithMicros(date = /* @__PURE__ */ new Date()) {
+  return date.toISOString().replace(/\.(\d{3})Z$/u, ".$1000Z");
+}
+async function generateEphemeralKeyPair() {
+  return globalThis.crypto.subtle.generateKey(
+    {
+      name: "ECDSA",
+      namedCurve: "P-256"
+    },
+    true,
+    ["sign", "verify"]
+  );
+}
+async function exportP256PublicJwk(publicKey) {
+  const jwk = await globalThis.crypto.subtle.exportKey("jwk", publicKey);
+  return {
+    kty: String(jwk.kty ?? "EC"),
+    crv: String(jwk.crv ?? "P-256"),
+    x: String(jwk.x ?? ""),
+    y: String(jwk.y ?? "")
+  };
+}
+async function buildSignedPubKeyHeader(args) {
+  const payload = {
+    pubkey: await exportP256PublicJwk(args.publicKey),
+    alg: "ECDSA",
+    domain: args.domain,
+    address: args.sender,
+    expires: isoTimestampWithMicros(new Date(Date.now() + 24 * 60 * 60 * 1e3)),
+    chain: "ETH"
+  };
+  const payloadJson = JSON.stringify(payload);
+  const signature = normalizeHexSignature(await args.signer(args.sender, payloadJson));
+  return JSON.stringify({
+    sender: args.sender,
+    payload: utf8Hex(payloadJson),
+    signature,
+    content: {
+      domain: args.domain
+    }
+  });
+}
+async function buildSignedOperationHeader(args) {
+  const payload = {
+    time: isoTimestampWithMicros(),
+    method: args.method,
+    path: args.path,
+    domain: args.domain
+  };
+  const payloadJson = JSON.stringify(payload);
+  const signature = new Uint8Array(
+    await globalThis.crypto.subtle.sign(
+      {
+        name: "ECDSA",
+        hash: "SHA-256"
+      },
+      args.privateKey,
+      new TextEncoder().encode(payloadJson)
+    )
+  );
+  return JSON.stringify({
+    payload: utf8Hex(payloadJson),
+    signature: bytesToHex(signature)
+  });
+}
+async function fetchInstanceNodeHash(args) {
+  const envelope = await fetchMessageEnvelope2(args.instanceHash, {
+    fetch: args.fetch,
+    apiHost: args.apiHost
+  });
+  const payload = envelope;
+  return asString4(payload?.content?.requirements?.node?.node_hash) ?? asString4(payload?.message?.content?.requirements?.node?.node_hash) ?? null;
+}
+async function resolveInstanceCrn(args) {
+  const providedCrnUrl = asString4(args.crnUrl);
+  if (providedCrnUrl) {
+    return {
+      crnUrl: trimTrailingSlashes(providedCrnUrl),
+      crnHash: asString4(args.crnHash),
+      source: "provided"
+    };
+  }
+  const allocation = await fetchSchedulerAllocation2(args.instanceHash, {
+    fetch: args.fetch,
+    schedulerAllocationUrl: args.schedulerAllocationUrl ?? DEFAULT_SCHEDULER_ALLOCATION_URL
+  }).catch(() => null);
+  if (allocation?.crnUrl) {
+    return {
+      crnUrl: trimTrailingSlashes(allocation.crnUrl),
+      crnHash: asString4(allocation.crnHash),
+      source: "scheduler"
+    };
+  }
+  const manualCrnHash = asString4(args.crnHash) ?? await fetchInstanceNodeHash({
+    instanceHash: args.instanceHash,
+    fetch: args.fetch,
+    apiHost: args.apiHost ?? DEFAULT_ALEPH_API_HOST2
+  }).catch(() => null);
+  if (manualCrnHash) {
+    const crns = await fetchCrns2({
+      url: args.crnListUrl ?? DEFAULT_CRN_LIST_URL2,
+      fetch: args.fetch
+    }).catch(() => []);
+    const matchingCrn = crns.find((candidate) => candidate.hash === manualCrnHash);
+    if (matchingCrn?.address) {
+      return {
+        crnUrl: trimTrailingSlashes(matchingCrn.address),
+        crnHash: manualCrnHash,
+        source: "manual"
+      };
+    }
+  }
+  return {
+    crnUrl: null,
+    crnHash: manualCrnHash,
+    source: "missing"
+  };
+}
+async function eraseInstanceOnCrn(args) {
+  const resolution = await resolveInstanceCrn({
+    instanceHash: args.instanceHash,
+    fetch: args.fetch,
+    apiHost: args.apiHost,
+    crnUrl: args.crnUrl,
+    crnHash: args.crnHash,
+    crnListUrl: args.crnListUrl,
+    schedulerAllocationUrl: args.schedulerAllocationUrl
+  });
+  if (!resolution.crnUrl) {
+    return {
+      ...resolution,
+      status: "skipped"
+    };
+  }
+  const crnUrl = new URL(resolution.crnUrl);
+  const domain = crnUrl.host;
+  const path = `/control/machine/${args.instanceHash}/erase`;
+  const { privateKey, publicKey } = await generateEphemeralKeyPair();
+  const signedPubKeyHeader = await buildSignedPubKeyHeader({
+    sender: args.sender,
+    signer: args.signer,
+    domain,
+    publicKey
+  });
+  const signedOperationHeader = await buildSignedOperationHeader({
+    privateKey,
+    domain,
+    method: "POST",
+    path
+  });
+  const response = await args.fetch(`${trimTrailingSlashes(resolution.crnUrl)}${path}`, {
+    method: "POST",
+    headers: {
+      "X-SignedPubKey": signedPubKeyHeader,
+      "X-SignedOperation": signedOperationHeader
+    }
+  });
+  if (response.status === 404) {
+    return {
+      ...resolution,
+      status: "missing"
+    };
+  }
+  if (response.ok) {
+    return {
+      ...resolution,
+      status: "erased"
+    };
+  }
+  const errorBody = await response.json().then((payload) => JSON.stringify(payload)).catch(() => "");
+  throw new Error(
+    `CRN erase failed for ${args.instanceHash} on ${resolution.crnUrl}: ${response.status}${errorBody ? ` ${errorBody}` : ""}`
+  );
+}
+
 // ../core/src/forget.ts
 function asOptionalReason(value) {
   return typeof value === "string" && value.trim() ? value.trim() : void 0;
@@ -1387,528 +1858,248 @@ function createPortForwardAggregateContent(args) {
 async function createUnsignedAggregateMessage(args) {
   const itemContent = JSON.stringify(args.content);
   const itemHash = await args.hasher(itemContent);
-  return {
-    sender: args.sender,
-    chain: "ETH",
-    type: "AGGREGATE",
-    item_hash: itemHash,
-    item_type: "inline",
-    item_content: itemContent,
-    time: args.now ?? Date.now() / 1e3,
-    channel: args.channel ?? DEFAULT_ALEPH_CHANNEL
-  };
-}
-async function ensureInstancePortForwards(args) {
-  const requestedPorts = requiredInstancePortForwards(args.manifest);
-  const aggregate = await fetchPortForwardAggregate(args.sender, {
-    apiHost: args.apiHost,
-    fetch: args.fetch
-  });
-  const content = createPortForwardAggregateContent({
-    sender: args.sender,
-    instanceItemHash: args.instanceItemHash,
-    requestedPorts,
-    existingAggregate: aggregate
-  });
-  const unsignedMessage = await createUnsignedAggregateMessage({
-    sender: args.sender,
-    content,
-    hasher: args.hasher,
-    channel: args.channel
-  });
-  const message = await signAlephMessage(unsignedMessage, args.signer);
-  const { response, httpStatus } = await broadcastAlephMessage2(message, {
-    apiHost: args.apiHost,
-    sync: args.sync,
-    fetch: args.fetch
-  });
-  const aggregateStatus = normalizeBroadcastStatus(httpStatus, response.message_status);
-  if (aggregateStatus === "rejected") {
-    throw new Error(`Port-forward aggregate was rejected by Aleph: ${JSON.stringify(response.details ?? response)}`);
-  }
-  return {
-    aggregateItemHash: message.item_hash,
-    aggregateStatus,
-    requestedPorts
-  };
-}
-
-// ../core/src/instance-deployment.ts
-var SSH_PUBLIC_KEY_PATTERN = /^(ssh-rsa|ssh-ed25519|ecdsa-sha2-nistp256|ecdsa-sha2-nistp384|ecdsa-sha2-nistp521|sk-ssh-ed25519@openssh\.com|sk-ecdsa-sha2-nistp256@openssh\.com)\s+[A-Za-z0-9+/]+={0,3}(?:\s+.+)?$/;
-function toFiniteNumber(value) {
-  if (typeof value === "number") return value;
-  if (typeof value === "string" && value.trim()) return Number(value);
-  return Number.NaN;
-}
-function normalizeSshPublicKey(value) {
-  return value.split(/\r?\n/g).map((line) => line.trim()).filter(Boolean).join(" ").replace(/\s+/g, " ").trim();
-}
-function isValidSshPublicKey(value) {
-  return SSH_PUBLIC_KEY_PATTERN.test(normalizeSshPublicKey(value));
-}
-function createDeploymentToken() {
-  const randomUuid = globalThis.crypto?.randomUUID?.();
-  if (typeof randomUuid === "string" && randomUuid.trim()) {
-    return randomUuid;
-  }
-  return `deploy-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 12)}`;
-}
-function appendDeploymentTokenToSshPublicKey(sshPublicKey, ownerAddress, deploymentToken) {
-  const normalized = normalizeSshPublicKey(sshPublicKey);
-  if (!normalized) return normalized;
-  const [algorithm = "", key = ""] = normalized.split(/\s+/, 3);
-  const owner = ownerAddress.trim();
-  const token = deploymentToken.trim();
-  if (!algorithm || !key || !owner || !token) {
-    return normalized;
-  }
-  return `${algorithm} ${key} aleph-bootstrap-config:${owner}:${token}`;
-}
-function createReleaseMetadata(name, rootfsVersion, deployer = "shared-aleph-tooling") {
-  return {
-    name,
-    rootfs_version: rootfsVersion,
-    deployer
-  };
-}
-function tierSpec(pricing, tier) {
-  return {
-    vcpus: pricing.compute_unit.vcpus * tier.compute_units,
-    memoryMiB: pricing.compute_unit.memory_mib * tier.compute_units,
-    diskMiB: pricing.compute_unit.disk_mib * tier.compute_units
-  };
-}
-function buildPaymentQuote(tier, pricing, balance) {
-  const computeUnitPrice = pricing.price.compute_unit;
-  if (!computeUnitPrice) return null;
-  const unitPrice = toFiniteNumber(computeUnitPrice.credit);
-  if (!Number.isFinite(unitPrice)) return null;
-  return {
-    required: unitPrice * tier.compute_units,
-    available: Number(balance.credit_balance ?? 0),
-    computeUnits: tier.compute_units,
-    unitPrice,
-    label: "credits"
-  };
-}
-function describeRejectedInstanceBroadcast(response) {
-  const balanceMessage = extractInsufficientBalanceMessage2(response.details);
-  if (balanceMessage) {
-    return `Aleph rejected this deployment due to ${balanceMessage}.`;
-  }
-  const errorCode = typeof response.error_code === "number" ? response.error_code : null;
-  return `Aleph rejected this deployment${errorCode ? ` (error ${errorCode})` : ""}.`;
-}
-function createInstanceContent(args) {
-  const sshKey = normalizeSshPublicKey(args.sshPublicKey);
-  if (!sshKey) {
-    throw new Error("An SSH public key is required.");
-  }
-  if (!isValidSshPublicKey(sshKey)) {
-    throw new Error("SSH public key must be a single valid .pub line.");
-  }
-  if (!args.rootfsItemHash || !/^[a-fA-F0-9]{64}$/.test(args.rootfsItemHash)) {
-    throw new Error("rootfsItemHash must be a 64-character Aleph item hash.");
-  }
-  return {
-    address: args.address,
-    time: args.now ?? Date.now() / 1e3,
-    allow_amend: false,
-    metadata: createReleaseMetadata(args.name.trim(), args.rootfsVersion ?? "custom-rootfs", args.deployer),
-    authorized_keys: [sshKey],
-    environment: {
-      internet: true,
-      aleph_api: true,
-      hypervisor: "qemu",
-      reproducible: false,
-      shared_cache: false
-    },
-    resources: {
-      vcpus: Number(args.vcpus),
-      memory: Number(args.memoryMiB),
-      seconds: Number(args.seconds ?? 30)
-    },
-    payment: {
-      type: "credit"
-    },
-    requirements: args.crnHash ? {
-      node: {
-        node_hash: args.crnHash
-      }
-    } : void 0,
-    volumes: [],
-    rootfs: {
-      parent: {
-        ref: args.rootfsItemHash,
-        use_latest: true
-      },
-      persistence: "host",
-      size_mib: Number(args.rootfsSizeMiB)
-    }
-  };
-}
-async function createUnsignedInstanceMessage(args) {
-  const itemContent = JSON.stringify(args.content);
-  const itemHash = await args.hasher(itemContent);
-  return {
-    sender: args.sender,
-    chain: "ETH",
-    type: "INSTANCE",
-    item_hash: itemHash,
-    item_type: "inline",
-    item_content: itemContent,
-    time: args.now ?? Date.now() / 1e3,
-    channel: args.channel ?? DEFAULT_ALEPH_CHANNEL
-  };
-}
-async function deployInstance(args) {
-  args.onProgress?.({
-    stage: "building-message",
-    label: "Building deployment message",
-    progress: 32,
-    status: "info",
-    detail: args.content.metadata?.name ?? null,
-    itemHash: null,
-    error: null,
-    timestamp: Date.now()
-  });
-  const unsignedMessage = await createUnsignedInstanceMessage({
+  return {
     sender: args.sender,
-    content: args.content,
-    hasher: args.hasher,
-    channel: args.channel,
-    now: args.now
+    chain: "ETH",
+    type: "AGGREGATE",
+    item_hash: itemHash,
+    item_type: "inline",
+    item_content: itemContent,
+    time: args.now ?? Date.now() / 1e3,
+    channel: args.channel ?? DEFAULT_ALEPH_CHANNEL
+  };
+}
+async function ensureInstancePortForwards(args) {
+  const requestedPorts = requiredInstancePortForwards(args.manifest);
+  const aggregate = await fetchPortForwardAggregate(args.sender, {
+    apiHost: args.apiHost,
+    fetch: args.fetch
   });
-  args.onProgress?.({
-    stage: "signing-message",
-    label: "Waiting for MetaMask signature",
-    progress: 48,
-    status: "info",
-    detail: unsignedMessage.item_hash,
-    itemHash: unsignedMessage.item_hash,
-    error: null,
-    timestamp: Date.now()
+  const content = createPortForwardAggregateContent({
+    sender: args.sender,
+    instanceItemHash: args.instanceItemHash,
+    requestedPorts,
+    existingAggregate: aggregate
   });
-  const signature = await args.signer(unsignedMessage.sender, [unsignedMessage.chain, unsignedMessage.sender, unsignedMessage.type, unsignedMessage.item_hash].join("\n"));
-  const message = {
-    ...unsignedMessage,
-    signature: signature.startsWith("0x") ? signature : `0x${signature}`
-  };
-  args.onProgress?.({
-    stage: "broadcasting",
-    label: "Broadcasting to Aleph",
-    progress: 64,
-    status: "info",
-    detail: message.item_hash,
-    itemHash: message.item_hash,
-    error: null,
-    timestamp: Date.now()
+  const unsignedMessage = await createUnsignedAggregateMessage({
+    sender: args.sender,
+    content,
+    hasher: args.hasher,
+    channel: args.channel
   });
+  const message = await signAlephMessage(unsignedMessage, args.signer);
   const { response, httpStatus } = await broadcastAlephMessage2(message, {
     apiHost: args.apiHost,
     sync: args.sync,
     fetch: args.fetch
   });
-  const status = httpStatus === 202 ? "pending" : typeof response.message_status === "string" ? response.message_status : "unknown";
-  args.onProgress?.({
-    stage: status === "processed" ? "deployment-confirmed" : status === "rejected" ? "deployment-rejected" : "waiting-for-aleph",
-    label: status === "processed" ? "Deployment accepted by Aleph" : status === "rejected" ? "Deployment rejected by Aleph" : "Deployment submitted to Aleph",
-    progress: status === "processed" ? 88 : status === "rejected" ? 100 : 78,
-    status: status === "processed" ? "success" : status === "rejected" ? "error" : "warning",
-    detail: status === "rejected" ? describeRejectedInstanceBroadcast(response) : null,
-    itemHash: message.item_hash,
-    error: status === "rejected" ? describeRejectedInstanceBroadcast(response) : null,
-    timestamp: Date.now()
-  });
+  const aggregateStatus = normalizeBroadcastStatus(httpStatus, response.message_status);
+  if (aggregateStatus === "rejected") {
+    throw new Error(`Port-forward aggregate was rejected by Aleph: ${JSON.stringify(response.details ?? response)}`);
+  }
   return {
-    itemHash: message.item_hash,
-    httpStatus,
-    status,
-    message,
-    response,
-    rejectionReason: status === "rejected" ? describeRejectedInstanceBroadcast(response) : null
+    aggregateItemHash: message.item_hash,
+    aggregateStatus,
+    requestedPorts
   };
 }
 
-// ../core/src/runtime.ts
-var DEFAULT_SCHEDULER_ALLOCATION_URL = "https://scheduler.api.aleph.cloud/api/v0/allocation";
-var DEFAULT_TWO_N_SIX_HASH_URL = "https://api.2n6.me/api/hash";
-function asString3(value) {
-  return typeof value === "string" && value.trim() ? value.trim() : null;
-}
-function asNumber3(value) {
-  return typeof value === "number" && Number.isFinite(value) ? value : null;
+// ../core/src/instance-deployment.ts
+var SSH_PUBLIC_KEY_PATTERN = /^(ssh-rsa|ssh-ed25519|ecdsa-sha2-nistp256|ecdsa-sha2-nistp384|ecdsa-sha2-nistp521|sk-ssh-ed25519@openssh\.com|sk-ecdsa-sha2-nistp256@openssh\.com)\s+[A-Za-z0-9+/]+={0,3}(?:\s+.+)?$/;
+function toFiniteNumber(value) {
+  if (typeof value === "number") return value;
+  if (typeof value === "string" && value.trim()) return Number(value);
+  return Number.NaN;
 }
-function normalizeIpv6(value) {
-  if (typeof value !== "string") return null;
-  const normalized = value.trim().toLowerCase();
-  if (!normalized) return null;
-  const zoneIndex = normalized.indexOf("%");
-  return zoneIndex >= 0 ? normalized.slice(0, zoneIndex) : normalized;
+function normalizeSshPublicKey(value) {
+  return value.split(/\r?\n/g).map((line) => line.trim()).filter(Boolean).join(" ").replace(/\s+/g, " ").trim();
 }
-function isLikelyGlobalIpv6(value) {
-  const normalized = normalizeIpv6(value);
-  if (!normalized || normalized === "::" || normalized === "::1") return false;
-  const firstHextetText = normalized.split(":", 1)[0];
-  if (!firstHextetText) return false;
-  const firstHextet = Number.parseInt(firstHextetText, 16);
-  if (!Number.isFinite(firstHextet)) return false;
-  if ((firstHextet & 65024) === 64512) return false;
-  if ((firstHextet & 65472) === 65152) return false;
-  if ((firstHextet & 65280) === 65280) return false;
-  if ((firstHextet & 65472) === 65216) return false;
-  return true;
+function isValidSshPublicKey(value) {
+  return SSH_PUBLIC_KEY_PATTERN.test(normalizeSshPublicKey(value));
 }
-function findCrnByHash(crns, crnHash) {
-  return crns.find((crn) => crn.hash === crnHash) ?? null;
+function createDeploymentToken() {
+  const randomUuid = globalThis.crypto?.randomUUID?.();
+  if (typeof randomUuid === "string" && randomUuid.trim()) {
+    return randomUuid;
+  }
+  return `deploy-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 12)}`;
 }
-async function fetchSchedulerAllocation2(itemHash, options) {
-  const response = await options.fetch(
-    `${options.schedulerAllocationUrl ?? DEFAULT_SCHEDULER_ALLOCATION_URL}/${itemHash}`,
-    { cache: "no-cache" }
-  );
-  if (response.status === 404) return null;
-  if (!response.ok) {
-    throw new Error(`Scheduler allocation request failed: ${response.status}`);
+function appendDeploymentTokenToSshPublicKey(sshPublicKey, ownerAddress, deploymentToken) {
+  const normalized = normalizeSshPublicKey(sshPublicKey);
+  if (!normalized) return normalized;
+  const [algorithm = "", key = ""] = normalized.split(/\s+/, 3);
+  const owner = ownerAddress.trim();
+  const token = deploymentToken.trim();
+  if (!algorithm || !key || !owner || !token) {
+    return normalized;
   }
-  const payload = await response.json();
-  const node = payload?.node;
-  return {
-    source: "scheduler",
-    crnHash: asString3(node?.node_id),
-    crnUrl: asString3(node?.url),
-    node: node ? {
-      node_id: asString3(node.node_id) ?? void 0,
-      url: asString3(node.url) ?? void 0,
-      ipv6: asString3(node.ipv6),
-      supports_ipv6: typeof node.supports_ipv6 === "boolean" ? node.supports_ipv6 : void 0
-    } : null,
-    vmIpv6: asString3(payload?.vm_ipv6),
-    period: payload?.period ? {
-      start_timestamp: asString3(payload.period.start_timestamp) ?? void 0,
-      duration_seconds: asNumber3(payload.period.duration_seconds) ?? void 0
-    } : null
-  };
+  return `${algorithm} ${key} aleph-bootstrap-config:${owner}:${token}`;
 }
-async function fetch2n6WebAccessUrl2(itemHash, options) {
-  const response = await options.fetch(
-    `${options.twoN6HashUrl ?? DEFAULT_TWO_N_SIX_HASH_URL}/${itemHash}`,
-    { cache: "no-cache" }
-  );
-  if (!response.ok) return null;
-  const payload = await response.json();
+function createReleaseMetadata(name, rootfsVersion, deployer = "shared-aleph-tooling") {
   return {
-    url: normalizeProxyUrl2(payload?.url ?? payload?.subdomain),
-    active: typeof payload?.active === "boolean" ? payload.active : null,
-    subdomain: asString3(payload?.subdomain)
+    name,
+    rootfs_version: rootfsVersion,
+    deployer
   };
 }
-async function fetchCrnExecutionMap2(crnUrl, options) {
-  const normalizedCrnUrl = String(crnUrl).replace(/\/+$/, "");
-  for (const [version, suffix] of [
-    ["v2", "/v2/about/executions/list"],
-    ["v1", "/about/executions/list"]
-  ]) {
-    const requestUrl = `${normalizedCrnUrl}${suffix}`;
-    const response = await options.fetch(requestUrl, {
-      cache: "no-cache"
-    });
-    if (response.ok) {
-      const payload = await response.json();
-      return {
-        version,
-        payload: payload && typeof payload === "object" ? payload : null,
-        requestUrl
-      };
-    }
-    if (response.status !== 404) {
-      return {
-        version,
-        payload: null,
-        requestUrl
-      };
-    }
-  }
+function tierSpec(pricing, tier) {
   return {
-    version: "v2",
-    payload: null,
-    requestUrl: `${normalizedCrnUrl}/v2/about/executions/list`
+    vcpus: pricing.compute_unit.vcpus * tier.compute_units,
+    memoryMiB: pricing.compute_unit.memory_mib * tier.compute_units,
+    diskMiB: pricing.compute_unit.disk_mib * tier.compute_units
   };
 }
-function describeRuntimeAvailability(runtime) {
-  const execution = runtime.execution ?? null;
-  const mappedPorts2 = runtime.mappedPorts ?? {};
-  const hostIpv4 = runtime.hostIpv4 ?? null;
-  const ipv6 = runtime.ipv6 ?? null;
-  const executionGuestIpv6 = execution?.networking?.ipv6_ip ?? null;
-  const proxyUrl = runtime.proxyUrl ?? null;
-  const schedulerSource = runtime.allocation?.source ?? null;
-  const webAccessActive = runtime.webAccess?.active ?? null;
-  const mappedPortCount = Object.keys(mappedPorts2).length;
-  if (hostIpv4 && mappedPortCount > 0 && runtime.requirePublicGuestIpv6ForProxy === true && proxyUrl && executionGuestIpv6 && !isLikelyGlobalIpv6(executionGuestIpv6)) {
-    return {
-      state: "execution-invalid-public-ipv6",
-      reason: `The CRN exposed runtime networking, but the guest IPv6 (${executionGuestIpv6}) is not globally routable. Proxy-backed HTTPS activation cannot succeed until the CRN reports a public guest IPv6.`,
-      schedulerSource,
-      executionSeen: Boolean(execution),
-      webAccessActive,
-      mappedPortCount,
-      proxyUrl
-    };
-  }
-  if (hostIpv4 && mappedPortCount > 0) {
-    return {
-      state: "ready",
-      reason: null,
-      schedulerSource,
-      executionSeen: Boolean(execution),
-      webAccessActive,
-      mappedPortCount,
-      proxyUrl
-    };
-  }
-  if (!execution && proxyUrl && webAccessActive === false) {
-    return {
-      state: "proxy-reserved-inactive",
-      reason: "Aleph reserved a proxy URL for the VM, but it is still inactive and the selected CRN has not exposed execution networking yet.",
-      schedulerSource,
-      executionSeen: false,
-      webAccessActive,
-      mappedPortCount,
-      proxyUrl
-    };
+function buildPaymentQuote(tier, pricing, balance) {
+  const computeUnitPrice = pricing.price.compute_unit;
+  if (!computeUnitPrice) return null;
+  const unitPrice = toFiniteNumber(computeUnitPrice.credit);
+  if (!Number.isFinite(unitPrice)) return null;
+  return {
+    required: unitPrice * tier.compute_units,
+    available: Number(balance.credit_balance ?? 0),
+    computeUnits: tier.compute_units,
+    unitPrice,
+    label: "credits"
+  };
+}
+function describeRejectedInstanceBroadcast(response) {
+  const balanceMessage = extractInsufficientBalanceMessage2(response.details);
+  if (balanceMessage) {
+    return `Aleph rejected this deployment due to ${balanceMessage}.`;
   }
-  if (!execution && schedulerSource === "manual") {
-    return {
-      state: "crn-execution-missing",
-      reason: "The deployment is pinned to a specific CRN, but that CRN is not exposing this VM in its execution list yet.",
-      schedulerSource,
-      executionSeen: false,
-      webAccessActive,
-      mappedPortCount,
-      proxyUrl
-    };
+  const errorCode = typeof response.error_code === "number" ? response.error_code : null;
+  return `Aleph rejected this deployment${errorCode ? ` (error ${errorCode})` : ""}.`;
+}
+function createInstanceContent(args) {
+  const sshKey = normalizeSshPublicKey(args.sshPublicKey);
+  if (!sshKey) {
+    throw new Error("An SSH public key is required.");
   }
-  if (execution && !hostIpv4) {
-    return {
-      state: "execution-missing-host-ipv4",
-      reason: "The CRN exposed an execution record, but it does not include a public host IPv4 yet.",
-      schedulerSource,
-      executionSeen: true,
-      webAccessActive,
-      mappedPortCount,
-      proxyUrl
-    };
+  if (!isValidSshPublicKey(sshKey)) {
+    throw new Error("SSH public key must be a single valid .pub line.");
   }
-  if (execution && mappedPortCount === 0) {
-    return {
-      state: "execution-missing-port-mappings",
-      reason: "The CRN exposed an execution record, but mapped ports are still empty.",
-      schedulerSource,
-      executionSeen: true,
-      webAccessActive,
-      mappedPortCount,
-      proxyUrl
-    };
+  if (!args.rootfsItemHash || !/^[a-fA-F0-9]{64}$/.test(args.rootfsItemHash)) {
+    throw new Error("rootfsItemHash must be a 64-character Aleph item hash.");
   }
   return {
-    state: "runtime-pending",
-    reason: "Aleph has not exposed enough runtime networking details yet.",
-    schedulerSource,
-    executionSeen: Boolean(execution),
-    webAccessActive,
-    mappedPortCount,
-    proxyUrl
+    address: args.address,
+    time: args.now ?? Date.now() / 1e3,
+    allow_amend: false,
+    metadata: createReleaseMetadata(args.name.trim(), args.rootfsVersion ?? "custom-rootfs", args.deployer),
+    authorized_keys: [sshKey],
+    environment: {
+      internet: true,
+      aleph_api: true,
+      hypervisor: "qemu",
+      reproducible: false,
+      shared_cache: false
+    },
+    resources: {
+      vcpus: Number(args.vcpus),
+      memory: Number(args.memoryMiB),
+      seconds: Number(args.seconds ?? 30)
+    },
+    payment: {
+      type: "credit"
+    },
+    requirements: args.crnHash ? {
+      node: {
+        node_hash: args.crnHash
+      }
+    } : void 0,
+    volumes: [],
+    rootfs: {
+      parent: {
+        ref: args.rootfsItemHash,
+        use_latest: true
+      },
+      persistence: "host",
+      size_mib: Number(args.rootfsSizeMiB)
+    }
   };
 }
-async function fetchVmRuntime(args) {
-  const crns = args.crns ?? await fetchCrns2({
-    url: args.crnListUrl ?? DEFAULT_CRN_LIST_URL2,
+async function createUnsignedInstanceMessage(args) {
+  const itemContent = JSON.stringify(args.content);
+  const itemHash = await args.hasher(itemContent);
+  return {
+    sender: args.sender,
+    chain: "ETH",
+    type: "INSTANCE",
+    item_hash: itemHash,
+    item_type: "inline",
+    item_content: itemContent,
+    time: args.now ?? Date.now() / 1e3,
+    channel: args.channel ?? DEFAULT_ALEPH_CHANNEL
+  };
+}
+async function deployInstance(args) {
+  args.onProgress?.({
+    stage: "building-message",
+    label: "Building deployment message",
+    progress: 32,
+    status: "info",
+    detail: args.content.metadata?.name ?? null,
+    itemHash: null,
+    error: null,
+    timestamp: Date.now()
+  });
+  const unsignedMessage = await createUnsignedInstanceMessage({
+    sender: args.sender,
+    content: args.content,
+    hasher: args.hasher,
+    channel: args.channel,
+    now: args.now
+  });
+  args.onProgress?.({
+    stage: "signing-message",
+    label: "Waiting for MetaMask signature",
+    progress: 48,
+    status: "info",
+    detail: unsignedMessage.item_hash,
+    itemHash: unsignedMessage.item_hash,
+    error: null,
+    timestamp: Date.now()
+  });
+  const signature = await args.signer(unsignedMessage.sender, [unsignedMessage.chain, unsignedMessage.sender, unsignedMessage.type, unsignedMessage.item_hash].join("\n"));
+  const message = {
+    ...unsignedMessage,
+    signature: signature.startsWith("0x") ? signature : `0x${signature}`
+  };
+  args.onProgress?.({
+    stage: "broadcasting",
+    label: "Broadcasting to Aleph",
+    progress: 64,
+    status: "info",
+    detail: message.item_hash,
+    itemHash: message.item_hash,
+    error: null,
+    timestamp: Date.now()
+  });
+  const { response, httpStatus } = await broadcastAlephMessage2(message, {
+    apiHost: args.apiHost,
+    sync: args.sync,
     fetch: args.fetch
   });
-  const schedulerAllocation = await fetchSchedulerAllocation2(args.itemHash, {
-    fetch: args.fetch,
-    schedulerAllocationUrl: args.schedulerAllocationUrl
-  }).catch(() => null);
-  const selectedCrn = args.crnHash ? findCrnByHash(crns, args.crnHash) : null;
-  const allocation = schedulerAllocation ?? (selectedCrn ? {
-    source: "manual",
-    crnHash: selectedCrn.hash,
-    crnUrl: selectedCrn.address,
-    node: { url: selectedCrn.address },
-    vmIpv6: null,
-    period: null
-  } : null);
-  const webAccess = await fetch2n6WebAccessUrl2(args.itemHash, {
-    fetch: args.fetch,
-    twoN6HashUrl: args.twoN6HashUrl
-  }).catch(() => null);
-  const webAccessUrl = webAccess?.url ?? null;
-  let execution = null;
-  let executionLookupBlocked = false;
-  if (allocation?.crnUrl) {
-    const executionLookup = await fetchCrnExecutionMap2(allocation.crnUrl, {
-      fetch: args.fetch
-    });
-    const executionPayload = executionLookup.payload?.[args.itemHash];
-    if (executionPayload && typeof executionPayload === "object") {
-      execution = normalizeExecution2(executionPayload, allocation.crnUrl);
-      if (!execution.networking.proxy_url && webAccessUrl) {
-        execution.networking.proxy_url = webAccessUrl;
-      }
-    } else if (executionLookup.payload == null) {
-      executionLookupBlocked = true;
-    }
-  }
-  const hostIpv4 = execution?.networking?.host_ipv4 ?? execution?.networking?.ipv4 ?? null;
-  const ipv6 = execution?.networking?.ipv6_ip ?? execution?.networking?.ipv6 ?? allocation?.vmIpv6 ?? null;
-  const mappedPorts2 = execution?.networking?.mapped_ports ?? {};
-  const sshPort = mappedPorts2?.["22"]?.host ?? null;
-  const proxyUrl = execution?.networking?.proxy_url ?? webAccessUrl ?? null;
-  const diagnostics = describeRuntimeAvailability({
-    allocation,
-    execution,
-    webAccess,
-    hostIpv4,
-    ipv6,
-    proxyUrl,
-    mappedPorts: mappedPorts2,
-    requirePublicGuestIpv6ForProxy: args.requirePublicGuestIpv6ForProxy
+  const status = httpStatus === 202 ? "pending" : typeof response.message_status === "string" ? response.message_status : "unknown";
+  args.onProgress?.({
+    stage: status === "processed" ? "deployment-confirmed" : status === "rejected" ? "deployment-rejected" : "waiting-for-aleph",
+    label: status === "processed" ? "Deployment accepted by Aleph" : status === "rejected" ? "Deployment rejected by Aleph" : "Deployment submitted to Aleph",
+    progress: status === "processed" ? 88 : status === "rejected" ? 100 : 78,
+    status: status === "processed" ? "success" : status === "rejected" ? "error" : "warning",
+    detail: status === "rejected" ? describeRejectedInstanceBroadcast(response) : null,
+    itemHash: message.item_hash,
+    error: status === "rejected" ? describeRejectedInstanceBroadcast(response) : null,
+    timestamp: Date.now()
   });
   return {
-    allocation,
-    execution,
-    webAccess,
-    webAccessUrl,
-    hostIpv4,
-    ipv6,
-    proxyUrl,
-    mappedPorts: mappedPorts2,
-    diagnostics,
-    sshCommand: hostIpv4 && sshPort ? `ssh root@${hostIpv4} -p ${sshPort}` : ipv6 ? `ssh root@${ipv6}` : null,
-    selectedCrn,
-    executionLookupBlocked
+    itemHash: message.item_hash,
+    httpStatus,
+    status,
+    message,
+    response,
+    rejectionReason: status === "rejected" ? describeRejectedInstanceBroadcast(response) : null
   };
 }
-async function waitForVmRuntime(args) {
-  const attempts = Math.max(1, Number(args.attempts ?? 20));
-  const delayMs = Math.max(0, Number(args.delayMs ?? 4e3));
-  const sleep2 = args.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
-  let lastRuntime = await fetchVmRuntime(args);
-  args.onAttempt?.(lastRuntime, 1, attempts);
-  for (let attempt = 0; attempt < attempts - 1; attempt += 1) {
-    if (lastRuntime.diagnostics?.state === "ready" || lastRuntime.diagnostics?.state === "execution-invalid-public-ipv6") {
-      return lastRuntime;
-    }
-    await sleep2(delayMs);
-    lastRuntime = await fetchVmRuntime(args);
-    args.onAttempt?.(lastRuntime, attempt + 2, attempts);
-  }
-  if (lastRuntime.diagnostics) {
-    lastRuntime.diagnostics.timedOut = true;
-  }
-  return lastRuntime;
-}
 
 // ../core/src/guest.ts
 async function defaultHttpProbe(fetch2, url, timeoutMs = 1e4) {
@@ -2155,7 +2346,7 @@ async function fetchUcGoPeerMetadata(args) {
 
 // ../aleph-bootstrap/src/index.ts
 import { recoverMessageAddress } from "viem";
-var DEFAULT_ALEPH_API_HOST3 = "https://api2.aleph.im";
+var DEFAULT_ALEPH_API_HOST3 = "https://api.aleph.im";
 var DEFAULT_ALEPH_BOOTSTRAP_CHANNEL = "simple-todo";
 var DEFAULT_ALEPH_BOOTSTRAP_REF = "simple-todo-bootstrap";
 var DEFAULT_ALEPH_BOOTSTRAP_POST_TYPE = "relay-bootstrap";
@@ -2844,7 +3035,7 @@ async function listStaleVmBootstrapConfigAggregateMessageHashes(args) {
     const requestUrl = new URL("/api/v0/messages.json", args.apiHost ?? DEFAULT_ALEPH_API_HOST2);
     requestUrl.searchParams.set("msgType", "AGGREGATE");
     requestUrl.searchParams.set("addresses", address);
-    requestUrl.searchParams.set("message_statuses", "processed,pending,rejected,removing");
+    requestUrl.searchParams.set("message_statuses", "processed,pending,rejected");
     requestUrl.searchParams.set("pagination", String(pagination));
     requestUrl.searchParams.set("page", String(page));
     requestUrl.searchParams.set("sortOrder", "-1");
@@ -3305,7 +3496,7 @@ async function inspectInstanceRuntime(args) {
     executionLookupRequestUrl: null,
     executionLookupVersion: null
   };
-  if (details.messageStatus === "rejected" || details.messageStatus === "removing") {
+  if (details.messageStatus === "rejected") {
     return { details, lookup };
   }
   try {
@@ -5022,6 +5213,9 @@ var SponsorRelayController = class {
       /* @__PURE__ */ new Set([instanceHash, ...linkedRegistrationHashes])
     );
     const linkedRegistrationCount = linkedRegistrationHashes.length;
+    const knownInstance = this.state.instances.find(
+      (entry) => entry.instance.item_hash === instanceHash
+    );
     this.patch({
       busy: { deletingInstanceHash: instanceHash },
       errorText: null,
@@ -5030,11 +5224,30 @@ var SponsorRelayController = class {
     try {
       this.emitProgress({
         stage: "validating",
-        label: "Validating delete request",
+        label: "Resolving CRN for delete",
         progress: 6,
         status: "warning",
         itemHash: instanceHash,
-        detail: linkedRegistrationCount > 0 ? `Preparing Aleph FORGET message for the instance and ${linkedRegistrationCount} linked bootstrap registration${linkedRegistrationCount === 1 ? "" : "s"}.` : "Preparing Aleph FORGET message."
+        detail: linkedRegistrationCount > 0 ? `Preparing CRN erase and Aleph FORGET for the instance and ${linkedRegistrationCount} linked bootstrap registration${linkedRegistrationCount === 1 ? "" : "s"}.` : "Preparing CRN erase and Aleph FORGET."
+      });
+      const eraseResult = await eraseInstanceOnCrn({
+        sender: this.state.wallet.address,
+        signer: personalSign,
+        instanceHash,
+        fetch: asJsonFetch,
+        apiHost: this.client.apiHost,
+        crnUrl: knownInstance?.details.crnUrl,
+        crnHash: knownInstance?.instance.content?.requirements?.node?.node_hash ?? null,
+        crnListUrl: this.props.crnListUrl,
+        schedulerAllocationUrl: this.client.schedulerApiHost ? `${this.client.schedulerApiHost.replace(/\/+$/u, "")}/api/v0/allocation` : void 0
+      });
+      this.emitProgress({
+        stage: "broadcasting-delete",
+        label: eraseResult.status === "erased" ? "Erased VM on CRN" : eraseResult.status === "missing" ? "VM already absent on CRN" : "CRN erase skipped",
+        progress: 34,
+        status: eraseResult.status === "skipped" ? "warning" : "info",
+        itemHash: instanceHash,
+        detail: eraseResult.status === "erased" ? `Erased runtime on ${eraseResult.crnUrl ?? "selected CRN"} before sending FORGET.` : eraseResult.status === "missing" ? `The CRN no longer reports this VM on ${eraseResult.crnUrl ?? "the selected node"}, so the delete flow can continue with FORGET.` : "Could not resolve a CRN endpoint for this instance, so the delete flow is falling back to FORGET-only cleanup."
       });
       await forgetAlephMessages({
         sender: this.state.wallet.address,