@le-space/ui 0.6.1 → 0.6.3

package/shared/index.js

@@ -2,6 +2,21 @@
 var DEFAULT_INSTANCE_NAME = "sponsor-relay";
 var DEFAULT_MANIFEST_URL = "./rootfs-manifest.json";
 var DEFAULT_TIER_ID = "tier-1";
+var DEFAULT_UCAN_STORE_PWA_ORIGIN = "https://ucan.nicokrause.com";
+var DEFAULT_UCAN_STORE_SERVICE_ORIGIN = "https://ucan-api.nicokrause.com";
+var DEFAULT_UCAN_STORE_SERVICE_DID = "did:web:ucan-api.nicokrause.com";
+var DEFAULT_UCAN_STORE_ALLOWED_CAPABILITIES = [
+  "space/blob/add",
+  "space/blob/list",
+  "space/index/add",
+  "space/index/list",
+  "filecoin/offer",
+  "upload/add",
+  "upload/list",
+  "store/add"
+];
+var DEFAULT_UCAN_STORE_USER_DELEGATION_EXPIRATION_SECONDS = "31536000";
+var DEFAULT_UCAN_STORE_MAX_DELEGATION_EXPIRATION_SECONDS = "315360000";
 var ROOTFS_MISSING_STATE = {
   tone: "idle",
   label: "manifest missing",
@@ -27,7 +42,7 @@ var RECENT_INSTANCE_RUNTIME_GRACE_MS = 10 * 60 * 1e3;
 var DEPLOYMENT_PENDING_WARNING_MS = 3 * 60 * 1e3;
 
 // src/shared/package-version.ts
-var UI_PACKAGE_VERSION = "0.6.1";
+var UI_PACKAGE_VERSION = "0.6.3";
 
 // src/shared/format.ts
 function shortHash(value, head = 8, tail = 6) {
@@ -870,7 +885,7 @@ async function fetchInstancePricing(apiHost = DEFAULT_ALEPH_API_HOST, aggregateA
 }
 
 // ../core/src/constants.ts
-var DEFAULT_ALEPH_CHANNEL = "TEST";
+var DEFAULT_ALEPH_CHANNEL = "ALEPH-CLOUDSOLUTIONS";
 
 // ../core/src/manifests.ts
 var DEFAULT_ALEPH_API_HOST2 = "https://api.aleph.im";
@@ -1152,6 +1167,13 @@ function normalizeExecution2(item, crnUrl) {
 }
 
 // ../core/src/deployment-inspection.ts
+var TRANSIENT_MESSAGE_LOOKUP_STATUSES = /* @__PURE__ */ new Set([408, 425, 429, 500, 502, 503, 504]);
+function isTransientMessageLookupError(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  const match = message.match(/Message lookup failed: (\d{3})/);
+  if (!match) return false;
+  return TRANSIENT_MESSAGE_LOOKUP_STATUSES.has(Number(match[1]));
+}
 async function fetchMessageEnvelope2(itemHash, options) {
   const response = await options.fetch(`${options.apiHost ?? DEFAULT_ALEPH_API_HOST2}/api/v0/messages/${itemHash}`, {
     cache: "no-cache"
@@ -1208,15 +1230,32 @@ async function waitForDeploymentResult2(itemHash, options) {
   const attempts = Math.max(1, Number(options.attempts ?? 15));
   const delayMs = Math.max(0, Number(options.delayMs ?? 2e3));
   const sleep2 = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
-  let lastResult = await inspectDeploymentResult2(itemHash, options);
-  options.onAttempt?.(lastResult, 1, attempts);
-  for (let attempt = 1; attempt < attempts; attempt += 1) {
+  let lastResult = {
+    status: "unknown",
+    errorCode: null,
+    details: null,
+    rejectionReason: null,
+    references: []
+  };
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    try {
+      lastResult = await inspectDeploymentResult2(itemHash, options);
+    } catch (error) {
+      if (!isTransientMessageLookupError(error)) {
+        throw error;
+      }
+      lastResult = {
+        ...lastResult,
+        rejectionReason: error instanceof Error ? error.message : String(error)
+      };
+    }
+    options.onAttempt?.(lastResult, attempt, attempts);
     if (lastResult.status === "processed" || lastResult.status === "rejected") {
       return lastResult;
     }
-    await sleep2(delayMs);
-    lastResult = await inspectDeploymentResult2(itemHash, options);
-    options.onAttempt?.(lastResult, attempt + 1, attempts);
+    if (attempt < attempts) {
+      await sleep2(delayMs);
+    }
   }
   return lastResult;
 }
@@ -2273,6 +2312,45 @@ async function configureOrbitdbRelaySetup2(args) {
     clearTimeout(timeout);
   }
 }
+async function configureUcanStore(args) {
+  const controller = new AbortController();
+  const timeout = setTimeout(
+    () => controller.abort(),
+    Number(args.timeoutMs ?? 18e4)
+  );
+  const payload = {
+    public_ipv4: args.hostIpv4,
+    public_ipv6: args.publicIpv6 ?? void 0,
+    proxy_url: args.proxyUrl ?? void 0,
+    webauthn_origin: args.webauthnOrigin ?? void 0,
+    webauthn_origin_fallbacks: args.webauthnOriginFallbacks ?? void 0,
+    admin_did: args.adminDid ?? void 0,
+    bootstrap_package: args.bootstrapPackage ?? void 0,
+    no_start: args.noStart === true ? true : void 0
+  };
+  try {
+    const response = await args.fetch(
+      `http://${args.hostIpv4}:${args.setupPort}/configure`,
+      {
+        method: "POST",
+        headers: {
+          "content-type": "application/json"
+        },
+        body: JSON.stringify(payload),
+        signal: controller.signal
+      }
+    );
+    const responsePayload = await response.json().catch(() => null);
+    if (!response.ok) {
+      throw new Error(
+        `Service setup request failed: ${response.status} ${typeof responsePayload === "string" ? responsePayload : JSON.stringify(responsePayload ?? {})}`
+      );
+    }
+    return responsePayload;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
 async function fetchUcGoPeerMetadata(args) {
   const attempts = Math.max(1, Number(args.attempts ?? 60));
   const delayMs = Math.max(0, Number(args.delayMs ?? 3e3));
@@ -2340,7 +2418,7 @@ async function fetchUcGoPeerMetadata(args) {
     }
   }
   throw new Error(
-    `Relay metadata did not become ready after ${attempts} attempts: ${lastError ? lastError : typeof lastPayload === "string" ? lastPayload : JSON.stringify(lastPayload ?? {})}`
+    `Guest metadata did not become ready after ${attempts} attempts: ${lastError ? lastError : typeof lastPayload === "string" ? lastPayload : JSON.stringify(lastPayload ?? {})}`
   );
 }
 
@@ -3272,7 +3350,130 @@ function createDeploymentProgressEmitter() {
   };
 }
 
+// ../shared-types/src/ucan-store-bootstrap.ts
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function normalizeNonEmptyString(value) {
+  if (typeof value !== "string") return null;
+  const normalized = value.trim();
+  return normalized ? normalized : null;
+}
+function normalizeDid(value) {
+  const did = normalizeNonEmptyString(value);
+  return did && did.startsWith("did:") ? did : null;
+}
+function normalizeOrigin(value) {
+  const raw = normalizeNonEmptyString(value);
+  if (!raw) return null;
+  try {
+    const parsed = new URL(raw);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || !parsed.hostname || parsed.pathname && parsed.pathname !== "/" || parsed.search || parsed.hash) {
+      return null;
+    }
+    return parsed.origin;
+  } catch {
+    return null;
+  }
+}
+function normalizeExpiration(value) {
+  if (value == null) return void 0;
+  if (value === null) return null;
+  if (!Number.isInteger(value) || Number(value) < 0) return void 0;
+  return Number(value);
+}
+function validateUcanStoreBootstrapPackage(value) {
+  if (!isRecord(value)) {
+    return {
+      valid: false,
+      errors: ["Bootstrap package must be a JSON object."],
+      bootstrapPackage: null
+    };
+  }
+  const errors = [];
+  const operatorAddress = normalizeNonEmptyString(value.operatorAddress);
+  if (!operatorAddress || !/^0x[a-fA-F0-9]{40}$/.test(operatorAddress)) {
+    errors.push("operatorAddress must be a 0x-prefixed 20-byte Ethereum address.");
+  }
+  const adminDid = normalizeDid(value.adminDid);
+  if (!adminDid) {
+    errors.push("adminDid must be a non-empty DID string.");
+  }
+  const serviceDidRaw = value.serviceDid;
+  const serviceDid = serviceDidRaw == null || serviceDidRaw === "" ? null : normalizeDid(serviceDidRaw);
+  if (serviceDidRaw != null && serviceDidRaw !== "" && !serviceDid) {
+    errors.push("serviceDid must be empty or a non-empty DID string.");
+  }
+  const spaceDid = normalizeDid(value.spaceDid);
+  if (!spaceDid) {
+    errors.push("spaceDid must be a non-empty DID string.");
+  }
+  const rootDelegationProof = normalizeNonEmptyString(value.rootDelegationProof);
+  if (!rootDelegationProof) {
+    errors.push("rootDelegationProof must be a non-empty proof string.");
+  }
+  const allowedCapabilities = Array.isArray(value.allowedCapabilities) ? value.allowedCapabilities.map((entry) => normalizeNonEmptyString(entry)).filter((entry) => Boolean(entry)) : [];
+  if (allowedCapabilities.length === 0) {
+    errors.push("allowedCapabilities must contain at least one capability string.");
+  }
+  const defaultUserDelegationExpiration = normalizeExpiration(
+    value.defaultUserDelegationExpiration
+  );
+  if (value.defaultUserDelegationExpiration != null && defaultUserDelegationExpiration === void 0) {
+    errors.push(
+      "defaultUserDelegationExpiration must be null or a non-negative integer number of seconds."
+    );
+  }
+  const maxUserDelegationExpiration = normalizeExpiration(
+    value.maxUserDelegationExpiration
+  );
+  if (value.maxUserDelegationExpiration != null && maxUserDelegationExpiration === void 0) {
+    errors.push(
+      "maxUserDelegationExpiration must be null or a non-negative integer number of seconds."
+    );
+  }
+  if (typeof defaultUserDelegationExpiration === "number" && typeof maxUserDelegationExpiration === "number" && defaultUserDelegationExpiration > maxUserDelegationExpiration) {
+    errors.push(
+      "defaultUserDelegationExpiration cannot exceed maxUserDelegationExpiration."
+    );
+  }
+  const pwaOrigin = normalizeOrigin(value.pwaOrigin);
+  if (!pwaOrigin) {
+    errors.push("pwaOrigin must be an http(s) origin without path, query, or hash.");
+  }
+  const serviceOrigin = normalizeOrigin(value.serviceOrigin);
+  if (!serviceOrigin) {
+    errors.push("serviceOrigin must be an http(s) origin without path, query, or hash.");
+  }
+  if (errors.length > 0) {
+    return {
+      valid: false,
+      errors,
+      bootstrapPackage: null
+    };
+  }
+  return {
+    valid: true,
+    errors: [],
+    bootstrapPackage: {
+      operatorAddress,
+      adminDid,
+      serviceDid,
+      spaceDid,
+      rootDelegationProof,
+      allowedCapabilities,
+      defaultUserDelegationExpiration,
+      maxUserDelegationExpiration,
+      pwaOrigin,
+      serviceOrigin
+    }
+  };
+}
+
 // src/shared/controller.ts
+function deploymentNoun(profile) {
+  return profile === "ucan-store" ? "service" : "relay";
+}
 function asJsonFetch(input, init) {
   return fetch(input, init).then(async (response) => ({
     ok: response.ok,
@@ -3280,11 +3481,122 @@ function asJsonFetch(input, init) {
     json: async () => await response.json()
   }));
 }
-function isConfirmedRelaySetupResult(value) {
+function isConfirmedGuestSetupResult(value) {
   return Boolean(
     value && typeof value === "object" && "status" in value && value.status === "configured"
   );
 }
+function defaultUcanStoreBootstrapInput(props) {
+  return {
+    adminDid: props.ucanStoreBootstrap?.adminDid ?? "",
+    serviceDid: props.ucanStoreBootstrap?.serviceDid ?? DEFAULT_UCAN_STORE_SERVICE_DID,
+    spaceDid: props.ucanStoreBootstrap?.spaceDid ?? "",
+    rootDelegationProof: props.ucanStoreBootstrap?.rootDelegationProof ?? "",
+    allowedCapabilities: props.ucanStoreBootstrap?.allowedCapabilities ?? DEFAULT_UCAN_STORE_ALLOWED_CAPABILITIES.join("\n"),
+    defaultUserDelegationExpiration: props.ucanStoreBootstrap?.defaultUserDelegationExpiration ?? DEFAULT_UCAN_STORE_USER_DELEGATION_EXPIRATION_SECONDS,
+    maxUserDelegationExpiration: props.ucanStoreBootstrap?.maxUserDelegationExpiration ?? DEFAULT_UCAN_STORE_MAX_DELEGATION_EXPIRATION_SECONDS,
+    pwaOrigin: props.ucanStoreBootstrap?.pwaOrigin ?? DEFAULT_UCAN_STORE_PWA_ORIGIN,
+    serviceOrigin: props.ucanStoreBootstrap?.serviceOrigin ?? DEFAULT_UCAN_STORE_SERVICE_ORIGIN
+  };
+}
+function currentPageOrigin() {
+  try {
+    const origin = globalThis.location?.origin?.trim();
+    return origin ? origin : null;
+  } catch {
+    return null;
+  }
+}
+function parseOptionalExpiration(value) {
+  const normalized = value.trim();
+  if (!normalized) return void 0;
+  const parsed = Number.parseInt(normalized, 10);
+  if (!Number.isInteger(parsed) || parsed < 0) {
+    return null;
+  }
+  return parsed;
+}
+function parseAllowedCapabilities(value) {
+  return value.split(/[\n,]/).map((entry) => entry.trim()).filter(Boolean);
+}
+function draftUcanStoreBootstrapErrors(args) {
+  const errors = [];
+  const { input } = args;
+  if (!args.operatorAddress) {
+    errors.push("Connect MetaMask before configuring the ucan-store bootstrap package.");
+  }
+  if (!input.adminDid.trim().startsWith("did:")) {
+    errors.push("Admin DID must be a non-empty DID string.");
+  }
+  if (input.serviceDid.trim() && !input.serviceDid.trim().startsWith("did:")) {
+    errors.push("Service DID must be empty or a non-empty DID string.");
+  }
+  if (!input.spaceDid.trim().startsWith("did:")) {
+    errors.push("Space DID must be a non-empty DID string.");
+  }
+  if (!input.rootDelegationProof.trim()) {
+    errors.push("Root delegation proof is required.");
+  }
+  if (parseAllowedCapabilities(input.allowedCapabilities).length === 0) {
+    errors.push("Add at least one allowed capability.");
+  }
+  const defaultExpiration = parseOptionalExpiration(
+    input.defaultUserDelegationExpiration
+  );
+  if (defaultExpiration === null) {
+    errors.push(
+      "Default user delegation expiration must be a non-negative integer number of seconds."
+    );
+  }
+  const maxExpiration = parseOptionalExpiration(
+    input.maxUserDelegationExpiration
+  );
+  if (maxExpiration === null) {
+    errors.push(
+      "Max user delegation expiration must be a non-negative integer number of seconds."
+    );
+  }
+  if (typeof defaultExpiration === "number" && typeof maxExpiration === "number" && defaultExpiration > maxExpiration) {
+    errors.push(
+      "Default user delegation expiration cannot exceed the max user delegation expiration."
+    );
+  }
+  const pwaOrigin = input.pwaOrigin.trim() || currentPageOrigin() || "";
+  if (!pwaOrigin) {
+    errors.push("PWA origin is required for the ucan-store bootstrap package.");
+  }
+  return errors;
+}
+function buildUcanStoreBootstrapPackage(args) {
+  const candidate = {
+    operatorAddress: args.operatorAddress,
+    adminDid: args.input.adminDid.trim(),
+    serviceDid: args.input.serviceDid.trim() || null,
+    spaceDid: args.input.spaceDid.trim(),
+    rootDelegationProof: args.input.rootDelegationProof.trim(),
+    allowedCapabilities: parseAllowedCapabilities(args.input.allowedCapabilities),
+    defaultUserDelegationExpiration: parseOptionalExpiration(
+      args.input.defaultUserDelegationExpiration
+    ),
+    maxUserDelegationExpiration: parseOptionalExpiration(
+      args.input.maxUserDelegationExpiration
+    ),
+    pwaOrigin: args.input.pwaOrigin.trim() || args.pwaOriginFallback?.trim() || currentPageOrigin() || "",
+    serviceOrigin: args.input.serviceOrigin.trim() || args.serviceOriginFallback?.trim() || ""
+  };
+  if (candidate.defaultUserDelegationExpiration === void 0) {
+    delete candidate.defaultUserDelegationExpiration;
+  }
+  if (candidate.maxUserDelegationExpiration === void 0) {
+    delete candidate.maxUserDelegationExpiration;
+  }
+  if (candidate.serviceDid === null) {
+    delete candidate.serviceDid;
+  }
+  return validateUcanStoreBootstrapPackage(
+    candidate
+  );
+}
 function defaultState(props = {}) {
   return {
     ready: false,
@@ -3299,6 +3611,7 @@ function defaultState(props = {}) {
     manifestJson: props.manifestJson ?? "",
     sshPublicKey: props.sshPublicKey ?? "",
     instanceName: props.instanceName ?? DEFAULT_INSTANCE_NAME,
+    ucanStoreBootstrap: defaultUcanStoreBootstrapInput(props),
     tierId: DEFAULT_TIER_ID,
     showAdvanced: Boolean(props.manifestJson?.trim() || props.sshPublicKey?.trim()),
     showInstances: props.showInstances ?? true,
@@ -3433,13 +3746,33 @@ async function resolveManifest(args) {
   if (pasted) return pasted;
   return loadRootfsManifest(args.manifestUrl);
 }
-function relayProfileForManifest(manifest) {
+function deploymentProfileForManifest(manifest) {
   if (manifest?.profile === "uc-go-peer") return "uc-go-peer";
   if (manifest?.profile === "orbitdb-relay") {
     return manifest.profile;
   }
+  if (manifest?.profile === "ucan-store") return "ucan-store";
   return null;
 }
+function bootstrapRelayProfileForManifest(manifest) {
+  const profile = deploymentProfileForManifest(manifest);
+  if (profile === "uc-go-peer" || profile === "orbitdb-relay") {
+    return profile;
+  }
+  return null;
+}
+function supportsBootstrapRegistrationsForManifest(manifest) {
+  return bootstrapRelayProfileForManifest(manifest) != null;
+}
+function deploymentReadyLabel(profile) {
+  return profile === "ucan-store" ? "Service ready" : "Relay ready";
+}
+function deploymentReadyDetail(profile, fallback) {
+  if (profile === "ucan-store") {
+    return "The upload service runtime is available and the deployment finished successfully.";
+  }
+  return fallback;
+}
 function registrationIdInstanceItemHash(registrationId) {
   const normalized = String(registrationId ?? "").trim();
   if (!normalized) return null;
@@ -3688,19 +4021,148 @@ var SponsorRelayController = class {
     this.progressEmitter.emit(nextEvent);
   }
   async configureRelayBootstrapRegistration(args) {
-    const profile = relayProfileForManifest(this.state.manifest);
-    if (!profile) return;
-    if (!this.state.wallet.address) {
+    const deploymentProfile = deploymentProfileForManifest(this.state.manifest);
+    const profile = bootstrapRelayProfileForManifest(this.state.manifest);
+    if (!profile && deploymentProfile !== "ucan-store") return;
+    if (profile && !this.state.wallet.address) {
       throw new Error("A connected wallet is required to register relay bootstrap addresses.");
     }
-    if (!args.runtime.hostIpv4) {
-      throw new Error("Relay runtime did not expose a host IPv4 address.");
+    const runtimeHostIpv4 = args.runtime.hostIpv4;
+    if (!runtimeHostIpv4) {
+      throw new Error(
+        `${deploymentProfile === "ucan-store" ? "Service" : "Relay"} runtime did not expose a host IPv4 address.`
+      );
     }
     let runtime = args.runtime;
     let mappedPorts2 = runtime.mappedPorts ?? {};
     const setupPort = mappedPorts2["80"]?.host ?? null;
     if (!setupPort) {
-      throw new Error("Relay runtime did not expose the temporary setup endpoint.");
+      throw new Error(
+        `${deploymentProfile === "ucan-store" ? "Service" : "Relay"} runtime did not expose the temporary setup endpoint.`
+      );
+    }
+    if (deploymentProfile === "ucan-store") {
+      const serviceHostIpv4 = runtimeHostIpv4;
+      const serviceProxyUrl = runtime.proxyUrl;
+      if (!serviceProxyUrl) {
+        throw new Error("Service runtime did not expose a proxy URL.");
+      }
+      const walletAddress2 = this.state.wallet.address;
+      if (!walletAddress2) {
+        throw new Error("A connected wallet is required to configure the ucan-store bootstrap package.");
+      }
+      const bootstrapValidation = buildUcanStoreBootstrapPackage({
+        input: this.state.ucanStoreBootstrap,
+        operatorAddress: walletAddress2,
+        serviceOriginFallback: serviceProxyUrl,
+        pwaOriginFallback: currentPageOrigin()
+      });
+      if (!bootstrapValidation.valid || !bootstrapValidation.bootstrapPackage) {
+        throw new Error(
+          bootstrapValidation.errors[0] ?? "The ucan-store bootstrap package is invalid."
+        );
+      }
+      this.emitProgress({
+        stage: "deployment-confirmed",
+        label: "Configuring service",
+        progress: 93,
+        status: "info",
+        itemHash: args.itemHash,
+        detail: "Waiting for the guest setup endpoint before applying the upload service configuration."
+      });
+      const setupHealth = await waitForSetupEndpoint({
+        hostIpv4: serviceHostIpv4,
+        setupPort,
+        fetch: (url, init) => fetch(url, init),
+        attempts: 15,
+        delayMs: 4e3,
+        httpTimeoutMs: 1e4,
+        onAttempt: (result, attempt, attempts) => {
+          this.emitProgress({
+            stage: "deployment-confirmed",
+            label: "Waiting for guest setup",
+            progress: 93,
+            status: result.ok ? "success" : "info",
+            itemHash: args.itemHash,
+            detail: result.ok ? `Setup endpoint ${attempt}/${attempts}: ready at http://${serviceHostIpv4}:${setupPort}/health.` : `Setup endpoint ${attempt}/${attempts}: waiting for http://${serviceHostIpv4}:${setupPort}/health.`
+          });
+        }
+      });
+      if (!setupHealth.ok) {
+        throw new Error(
+          `Service setup endpoint did not become reachable at http://${serviceHostIpv4}:${setupPort}/health.`
+        );
+      }
+      this.emitProgress({
+        stage: "deployment-confirmed",
+        label: "Applying service config",
+        progress: 94,
+        status: "info",
+        itemHash: args.itemHash,
+        detail: "Publishing the public HTTPS origin into the guest upload service configuration."
+      });
+      const configureResult = await configureUcanStore({
+        hostIpv4: serviceHostIpv4,
+        publicIpv6: runtime.ipv6,
+        setupPort,
+        proxyUrl: serviceProxyUrl,
+        webauthnOrigin: serviceProxyUrl,
+        adminDid: bootstrapValidation.bootstrapPackage.adminDid,
+        bootstrapPackage: bootstrapValidation.bootstrapPackage,
+        fetch: (url, init) => fetch(url, init),
+        timeoutMs: 18e4
+      });
+      if (!isConfirmedGuestSetupResult(configureResult)) {
+        throw new Error(
+          `Service guest configuration could not be confirmed at http://${serviceHostIpv4}:${setupPort}/configure.`
+        );
+      }
+      this.emitProgress({
+        stage: "deployment-confirmed",
+        label: "Waiting for service metadata",
+        progress: 95,
+        status: "info",
+        itemHash: args.itemHash,
+        detail: "Waiting for the upload service metadata endpoint to report the public service DID and PWA environment."
+      });
+      const serviceMetadata = await fetchUcGoPeerMetadata({
+        hostIpv4: serviceHostIpv4,
+        setupPort,
+        fetch: (url, init) => fetch(url, init),
+        attempts: 80,
+        delayMs: 3e3,
+        timeoutMs: 24e4,
+        isReady: ({ payload, ok }) => {
+          if (!ok || !payload || typeof payload !== "object") return false;
+          const metadata2 = payload.metadata && typeof payload.metadata === "object" ? payload.metadata : null;
+          const pwaEnv = metadata2?.pwa_env && typeof metadata2.pwa_env === "object" ? metadata2.pwa_env : null;
+          return Boolean(
+            typeof metadata2?.upload_service_did === "string" && metadata2.upload_service_did.length > 0 && typeof pwaEnv?.VITE_UPLOAD_SERVICE_URL === "string" && pwaEnv.VITE_UPLOAD_SERVICE_URL.length > 0
+          );
+        },
+        onAttempt: ({ ready, attempt, attempts, requestUrl }) => {
+          this.emitProgress({
+            stage: "deployment-confirmed",
+            label: ready ? "Service metadata ready" : "Waiting for service metadata",
+            progress: 95,
+            status: ready ? "success" : "info",
+            itemHash: args.itemHash,
+            detail: ready ? `Service metadata ${attempt}/${attempts}: public upload service wiring is ready.` : `Service metadata ${attempt}/${attempts}: waiting for ${requestUrl}.`
+          });
+        }
+      });
+      const metadata = serviceMetadata && typeof serviceMetadata === "object" ? serviceMetadata.metadata ?? null : null;
+      if (!metadata || typeof metadata !== "object" || typeof metadata.upload_service_did !== "string") {
+        throw new Error(
+          "Service metadata did not include the public upload service DID."
+        );
+      }
+      return;
+    }
+    if (!profile) return;
+    const walletAddress = this.state.wallet.address;
+    if (!walletAddress) {
+      throw new Error("A connected wallet is required to register relay bootstrap addresses.");
     }
     let bootstrapSignalRelayMetadata = null;
     if (profile === "orbitdb-relay") {
@@ -3713,7 +4175,7 @@ var SponsorRelayController = class {
         detail: "Waiting for the guest setup endpoint before collecting relay metadata."
       });
       const setupHealth = await waitForSetupEndpoint({
-        hostIpv4: args.runtime.hostIpv4,
+        hostIpv4: runtimeHostIpv4,
         setupPort,
         fetch: (url, init) => fetch(url, init),
         attempts: 15,
@@ -3726,13 +4188,13 @@ var SponsorRelayController = class {
             progress: 93,
             status: result.ok ? "success" : "info",
             itemHash: args.itemHash,
-            detail: result.ok ? `Setup endpoint ${attempt}/${attempts}: ready at http://${args.runtime.hostIpv4}:${setupPort}/health.` : `Setup endpoint ${attempt}/${attempts}: waiting for http://${args.runtime.hostIpv4}:${setupPort}/health.`
+            detail: result.ok ? `Setup endpoint ${attempt}/${attempts}: ready at http://${runtimeHostIpv4}:${setupPort}/health.` : `Setup endpoint ${attempt}/${attempts}: waiting for http://${runtimeHostIpv4}:${setupPort}/health.`
           });
         }
       });
       if (!setupHealth.ok) {
         throw new Error(
-          `Relay setup endpoint did not become reachable at http://${args.runtime.hostIpv4}:${setupPort}/health.`
+          `Relay setup endpoint did not become reachable at http://${runtimeHostIpv4}:${setupPort}/health.`
         );
       }
       this.emitProgress({
@@ -3749,7 +4211,7 @@ var SponsorRelayController = class {
         throw new Error("OrbitDB relay runtime is missing required mapped TCP/WS ports.");
       }
       const configureResult = await configureOrbitdbRelaySetup2({
-        hostIpv4: args.runtime.hostIpv4,
+        hostIpv4: runtimeHostIpv4,
         publicIpv6: args.runtime.ipv6,
         setupPort,
         tcpPort,
@@ -3762,7 +4224,7 @@ var SponsorRelayController = class {
         fetch: (url, init) => fetch(url, init),
         timeoutMs: 18e4
       });
-      if (!isConfirmedRelaySetupResult(configureResult)) {
+      if (!isConfirmedGuestSetupResult(configureResult)) {
         throw new Error(
           `Relay guest configuration could not be confirmed at http://${args.runtime.hostIpv4}:${setupPort}/configure.`
         );
@@ -3820,7 +4282,7 @@ var SponsorRelayController = class {
           "Relay runtime lost its host IPv4 address while waiting for HTTPS activation."
         );
       }
-      const runtimeHostIpv4 = runtime.hostIpv4;
+      const runtimeHostIpv42 = runtime.hostIpv4;
       const activeProxyUrl = runtime.webAccess?.active === true ? runtime.proxyUrl ?? null : null;
       this.emitProgress({
         stage: "deployment-confirmed",
@@ -3833,13 +4295,13 @@ var SponsorRelayController = class {
       const record = {
         deploymentToken: args.deploymentToken,
         profile,
-        ownerAddress: this.state.wallet.address,
+        ownerAddress: walletAddress,
         instanceItemHash: args.itemHash,
         createdAt: (/* @__PURE__ */ new Date()).toISOString(),
         expiresAt: new Date(Date.now() + 30 * 6e4).toISOString(),
         status: "pending",
         runtime: {
-          publicIpv4: runtimeHostIpv4,
+          publicIpv4: runtimeHostIpv42,
           publicIpv6: runtime.ipv6 ?? null,
           proxyUrl: activeProxyUrl,
           mappedPorts: mappedPorts2
@@ -3853,7 +4315,7 @@ var SponsorRelayController = class {
         }
       };
       const bootstrapConfigPublication = await publishVmBootstrapConfig({
-        sender: this.state.wallet.address,
+        sender: walletAddress,
         record,
         signer: personalSign,
         hasher: sha256Hex,
@@ -3880,7 +4342,7 @@ var SponsorRelayController = class {
       });
       const bootstrapConfigSignal = await waitForVmBootstrapConfigSignal({
         deploymentToken: args.deploymentToken,
-        ownerAddress: this.state.wallet.address,
+        ownerAddress: walletAddress,
         instanceItemHash: args.itemHash,
         fetch: asJsonFetch,
         apiHost: this.client.apiHost,
@@ -4052,7 +4514,7 @@ var SponsorRelayController = class {
         detail: "Guest bootstrap registration was delayed. Publishing the relay bootstrap record from the browser."
       });
       const fallbackPublication = await publishRelayBootstrapRegistration({
-        sender: this.state.wallet.address,
+        sender: walletAddress,
         signer: personalSign,
         hasher: sha256Hex,
         fetch: asJsonFetch,
@@ -4072,7 +4534,7 @@ var SponsorRelayController = class {
         fallbackPublication
       });
       const fallbackVisibleRegistration = await waitForRelayBootstrapRegistration({
-        sender: this.state.wallet.address,
+        sender: walletAddress,
         registrationId,
         peerId,
         fetch: asJsonFetch,
@@ -4105,7 +4567,7 @@ var SponsorRelayController = class {
     if (profile === "uc-go-peer" && args.deploymentToken) {
       let cleanupAggregateItemHash = null;
       await deleteVmBootstrapConfig({
-        sender: this.state.wallet.address,
+        sender: walletAddress,
         deploymentToken: args.deploymentToken,
         signer: personalSign,
         hasher: sha256Hex,
@@ -4271,17 +4733,35 @@ var SponsorRelayController = class {
       });
       return;
     }
+    const currentProfile = deploymentProfileForManifest(this.state.manifest);
     const hasConfirmedBootstrapRegistration = this.state.bootstrapRegistrations.some(
       (entry) => entry.instanceItemHash === itemHash && entry.confirmed
     );
+    if (currentProfile === "ucan-store") {
+      this.emitProgress({
+        stage: "completed",
+        label: deploymentReadyLabel(currentProfile),
+        progress: 100,
+        status: "success",
+        itemHash,
+        detail: deploymentReadyDetail(
+          currentProfile,
+          "Runtime networking is available and the deployment finished successfully."
+        )
+      });
+      return;
+    }
     if (hasConfirmedBootstrapRegistration) {
       this.emitProgress({
         stage: "completed",
-        label: "Relay ready",
+        label: deploymentReadyLabel(currentProfile),
         progress: 100,
         status: "success",
         itemHash,
-        detail: "Runtime networking is available and the relay bootstrap registration is confirmed on Aleph."
+        detail: deploymentReadyDetail(
+          currentProfile,
+          "Runtime networking is available and the relay bootstrap registration is confirmed on Aleph."
+        )
       });
       return;
     }
@@ -4291,7 +4771,7 @@ var SponsorRelayController = class {
       progress: 92,
       status: "info",
       itemHash,
-      detail: "Deployment processed and runtime networking is available. Finishing relay setup and bootstrap verification."
+      detail: `Deployment processed and runtime networking is available. Finishing ${deploymentNoun(currentProfile)} setup and verification.`
     });
   }
   canSkipRuntimeRefresh(instance) {
@@ -4404,6 +4884,15 @@ var SponsorRelayController = class {
   setInstanceName(instanceName) {
     this.patch({ instanceName });
   }
+  setUcanStoreBootstrapField(field, value) {
+    this.patch({
+      ucanStoreBootstrap: {
+        ...this.state.ucanStoreBootstrap,
+        [field]: value
+      },
+      showAdvanced: this.state.showAdvanced || Boolean(value.trim())
+    });
+  }
   setTierId(tierId) {
     this.patch({ tierId });
     this.recomputePricingSummary();
@@ -4489,6 +4978,7 @@ var SponsorRelayController = class {
     }
   }
   async refresh() {
+    const currentProfile = deploymentProfileForManifest(this.state.manifest);
     this.trace("refresh:start", {
       wallet: this.state.wallet.address,
       manifestUrl: this.state.manifestUrl,
@@ -4497,7 +4987,7 @@ var SponsorRelayController = class {
     this.patch({
       busy: { refreshing: true },
       errorText: null,
-      statusText: "Refreshing relay sponsor data"
+      statusText: currentProfile === "ucan-store" ? "Refreshing service deployment data" : "Refreshing relay deployment data"
     });
     try {
       const [pricingSummary, crns] = await Promise.all([
@@ -4509,6 +4999,8 @@ var SponsorRelayController = class {
         manifestJson: this.state.manifestJson
       }).catch((error) => manifestLoadErrorState(error));
       const manifest = manifestState.manifest;
+      const resolvedProfile = deploymentProfileForManifest(manifest);
+      const bootstrapEnabled = supportsBootstrapRegistrationsForManifest(manifest);
       let balance = this.state.balance;
       let instances = [];
       let bootstrapRegistrations = [];
@@ -4517,10 +5009,10 @@ var SponsorRelayController = class {
         const [nextBalance, rawInstances, rawBootstrapPosts] = await Promise.all([
           this.client.fetchBalance(this.state.wallet.address),
           this.state.showInstances ? this.client.fetchInstances(this.state.wallet.address) : Promise.resolve([]),
-          fetchAlephBootstrapPosts({
+          bootstrapEnabled ? fetchAlephBootstrapPosts({
             apiHost: this.client.apiHost,
             fetch
-          }).catch(() => [])
+          }).catch(() => []) : Promise.resolve([])
         ]);
         balance = nextBalance;
         instances = await Promise.all(
@@ -4650,7 +5142,7 @@ var SponsorRelayController = class {
         bootstrapRegistrations,
         orphanBootstrapRegistrations,
         busy: { refreshing: false },
-        statusText: "Relay sponsor data ready"
+        statusText: resolvedProfile === "ucan-store" ? "Service deployment data ready" : "Relay deployment data ready"
       });
       this.trace("refresh:success", {
         manifestValid: manifestState.valid,
@@ -4687,6 +5179,16 @@ var SponsorRelayController = class {
       });
       return;
     }
+    if (deploymentProfileForManifest(this.state.manifest) === "ucan-store") {
+      const draftErrors = draftUcanStoreBootstrapErrors({
+        input: this.state.ucanStoreBootstrap,
+        operatorAddress: this.state.wallet.address
+      });
+      if (draftErrors.length > 0) {
+        this.patch({ errorText: draftErrors[0] });
+        return;
+      }
+    }
     this.patch({
       busy: { deploying: true },
       errorText: null,
@@ -4736,7 +5238,7 @@ var SponsorRelayController = class {
           detail: `Trying ${crnDisplayName}`
         });
         try {
-          const profile = relayProfileForManifest(this.state.manifest);
+          const profile = deploymentProfileForManifest(this.state.manifest);
           attemptProfile = profile;
           const sshPublicKey = profile === "uc-go-peer" ? appendDeploymentTokenToSshPublicKey(
             this.state.sshPublicKey.trim(),
@@ -4955,11 +5457,14 @@ var SponsorRelayController = class {
           this.lastCompletedDeploymentHash = result.itemHash;
           this.emitProgress({
             stage: "completed",
-            label: "Relay ready",
+            label: deploymentReadyLabel(attemptProfile),
             progress: 100,
             status: "success",
             itemHash: result.itemHash,
-            detail: "Relay runtime, setup, metadata, and bootstrap registration are confirmed."
+            detail: deploymentReadyDetail(
+              attemptProfile,
+              "Relay runtime, setup, metadata, and bootstrap registration are confirmed."
+            )
           });
           return;
         } catch (error) {
@@ -5033,11 +5538,14 @@ var SponsorRelayController = class {
                     this.lastCompletedDeploymentHash = attemptItemHash;
                     this.emitProgress({
                       stage: "completed",
-                      label: "Relay ready",
+                      label: deploymentReadyLabel(attemptProfile),
                       progress: 100,
                       status: "success",
                       itemHash: attemptItemHash,
-                      detail: "The relay completed startup after a transient UI polling error. Runtime and bootstrap registration are confirmed."
+                      detail: deploymentReadyDetail(
+                        attemptProfile,
+                        "The relay completed startup after a transient UI polling error. Runtime and bootstrap registration are confirmed."
+                      )
                     });
                     return;
                   }
@@ -5064,11 +5572,14 @@ var SponsorRelayController = class {
               this.lastCompletedDeploymentHash = attemptItemHash;
               this.emitProgress({
                 stage: "completed",
-                label: "Relay ready",
+                label: deploymentReadyLabel(attemptProfile),
                 progress: 100,
                 status: "success",
                 itemHash: attemptItemHash,
-                detail: "The relay completed startup after a transient browser-side polling error. Runtime and bootstrap registration are confirmed."
+                detail: deploymentReadyDetail(
+                  attemptProfile,
+                  "The relay completed startup after a transient browser-side polling error. Runtime and bootstrap registration are confirmed."
+                )
               });
               return;
             }
@@ -5370,6 +5881,12 @@ export {
   DEFAULT_INSTANCE_NAME,
   DEFAULT_MANIFEST_URL,
   DEFAULT_TIER_ID,
+  DEFAULT_UCAN_STORE_ALLOWED_CAPABILITIES,
+  DEFAULT_UCAN_STORE_MAX_DELEGATION_EXPIRATION_SECONDS,
+  DEFAULT_UCAN_STORE_PWA_ORIGIN,
+  DEFAULT_UCAN_STORE_SERVICE_DID,
+  DEFAULT_UCAN_STORE_SERVICE_ORIGIN,
+  DEFAULT_UCAN_STORE_USER_DELEGATION_EXPIRATION_SECONDS,
   DEPLOYMENT_PENDING_WARNING_MS,
   IDLE_DEPLOYMENT_PROGRESS,
   INSTANCE_RUNTIME_PENDING_REFRESH_MS,