@le-space/ui 0.1.60 → 0.1.62

package/shared/index.js

@@ -34,6 +34,7 @@ var INSTANCE_RUNTIME_PENDING_REFRESH_MS = 45e3;
 var INSTANCE_RUNTIME_STALE_REFRESH_MS = 5 * 6e4;
 var STALE_INSTANCE_ALLOCATION_COOLDOWN_MS = 5 * 60 * 1e3;
 var RECENT_INSTANCE_RUNTIME_GRACE_MS = 10 * 60 * 1e3;
+var DEPLOYMENT_PENDING_WARNING_MS = 3 * 60 * 1e3;
 
 // src/shared/format.ts
 function shortHash(value, head = 8, tail = 6) {
@@ -64,6 +65,16 @@ function joinMappedPorts(mappedPorts2) {
   if (mappedPorts2.length === 0) return "-";
   return mappedPorts2.map((entry) => `${entry.label}->${entry.hostPort ?? "?"}`).join(" \xB7 ");
 }
+function joinRequiredPortForwards(portForwards) {
+  if (!portForwards || portForwards.length === 0) return "-";
+  return portForwards.map((entry) => {
+    const protocols = [
+      entry.tcp === true ? "tcp" : null,
+      entry.udp === true ? "udp" : null
+    ].filter((value) => Boolean(value)).join("/");
+    return `${entry.port}/${protocols}`;
+  }).join(" \xB7 ");
+}
 
 // ../browser/src/http.ts
 async function fetchWithTimeout(input, init = {}, timeoutMs = 15e3) {
@@ -850,6 +861,7 @@ var DEFAULT_ALEPH_CHANNEL = "TEST";
 var DEFAULT_ALEPH_API_HOST2 = "https://api2.aleph.im";
 
 // ../core/src/crns.ts
+var DEFAULT_CRN_LIST_URL2 = "https://crns-list.aleph.sh/crns.json";
 function compatibleCrns(crns, excludedHashes = []) {
   const excluded = new Set(excludedHashes.filter(Boolean));
   return [...crns].filter((crn) => {
@@ -883,8 +895,113 @@ function filterDeployableCrns(crns, options = {}) {
     compatibleCrns(crns, options.excludedHashes).filter((crn) => hasCrnCapacity(crn, options.spec))
   );
 }
+async function fetchCrns2(options) {
+  const requestUrl = new URL(options.url ?? DEFAULT_CRN_LIST_URL2);
+  requestUrl.searchParams.set("filter_inactive", "true");
+  const response = await options.fetch(requestUrl.toString(), {
+    cache: "no-cache"
+  });
+  if (!response.ok) {
+    throw new Error(`CRN list request failed: ${response.status}`);
+  }
+  const payload = await response.json();
+  return Array.isArray(payload?.crns) ? payload.crns : [];
+}
+
+// ../core/src/port-forwarding.ts
+var DEFAULT_INSTANCE_PORT_FORWARDS = [
+  { port: 22, tcp: true, udp: false, purpose: "SSH" }
+];
+function normalizeRequestedPort(entry) {
+  return {
+    port: entry.port,
+    tcp: entry.tcp === true,
+    udp: entry.udp === true,
+    purpose: entry.purpose?.trim() || void 0
+  };
+}
+function normalizePortFlags(value) {
+  if (!value || typeof value !== "object") return null;
+  const candidate = value;
+  return {
+    tcp: candidate.tcp === true,
+    udp: candidate.udp === true
+  };
+}
+function normalizeExistingPortForwardEntry(entry) {
+  if (!entry?.ports || typeof entry.ports !== "object") return {};
+  return Object.fromEntries(
+    Object.entries(entry.ports).map(([port, flags]) => [port, normalizePortFlags(flags)]).filter((item) => item[1] != null)
+  );
+}
+function requestedPortFlags(portForwards) {
+  return Object.fromEntries(
+    portForwards.map((entry) => [
+      String(entry.port),
+      {
+        tcp: entry.tcp === true,
+        udp: entry.udp === true
+      }
+    ])
+  );
+}
+function mergePortFlagMaps(existing, requested) {
+  const merged = /* @__PURE__ */ new Map();
+  for (const [port, flags] of Object.entries(existing)) {
+    merged.set(port, {
+      tcp: flags.tcp === true,
+      udp: flags.udp === true
+    });
+  }
+  for (const [port, flags] of Object.entries(requested)) {
+    const current = merged.get(port);
+    merged.set(port, {
+      tcp: current?.tcp === true || flags.tcp === true,
+      udp: current?.udp === true || flags.udp === true
+    });
+  }
+  return Object.fromEntries([...merged.entries()].sort((left, right) => Number(left[0]) - Number(right[0])));
+}
+function mergeRequiredPortForwards(...groups) {
+  const merged = /* @__PURE__ */ new Map();
+  for (const group of groups) {
+    for (const entry of group ?? []) {
+      const normalized = normalizeRequestedPort(entry);
+      const current = merged.get(normalized.port);
+      merged.set(normalized.port, {
+        port: normalized.port,
+        tcp: current?.tcp === true || normalized.tcp === true,
+        udp: current?.udp === true || normalized.udp === true,
+        purpose: current?.purpose ?? normalized.purpose
+      });
+    }
+  }
+  return [...merged.values()].sort((left, right) => left.port - right.port);
+}
+function requiredInstancePortForwards(manifest) {
+  return mergeRequiredPortForwards(DEFAULT_INSTANCE_PORT_FORWARDS, manifest?.requiredPortForwards);
+}
+async function fetchPortForwardAggregate(address, options) {
+  const requestUrl = new URL(`/api/v0/aggregates/${address}.json`, options.apiHost ?? DEFAULT_ALEPH_API_HOST2);
+  requestUrl.searchParams.set("keys", "port-forwarding");
+  const response = await options.fetch(requestUrl.toString(), { cache: "no-cache" });
+  if (response.status === 404) return {};
+  if (!response.ok) {
+    throw new Error(`Port-forward aggregate request failed: ${response.status}`);
+  }
+  const payload = await response.json();
+  const aggregate = payload.data?.["port-forwarding"];
+  if (!aggregate || typeof aggregate !== "object" || Array.isArray(aggregate)) return {};
+  return aggregate;
+}
 
 // ../core/src/aleph-normalizers.ts
+function asString2(value) {
+  return typeof value === "string" && value.trim() ? value : null;
+}
+function asNumber2(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
 function normalizeMessageStatus2(status) {
   if (typeof status !== "string") return "unknown";
   const normalized = status.toLowerCase();
@@ -893,6 +1010,183 @@ function normalizeMessageStatus2(status) {
   }
   return "unknown";
 }
+function normalizeProxyUrl2(value) {
+  const stringValue = asString2(value);
+  if (!stringValue) return null;
+  if (/^https?:\/\//i.test(stringValue)) return stringValue;
+  return `https://${stringValue}`;
+}
+function messageTypeFromEnvelope2(payload) {
+  if (!payload) return null;
+  const type = payload.type ?? payload.message?.type ?? (Array.isArray(payload.messages) ? payload.messages[0]?.type : void 0);
+  return typeof type === "string" ? type.toUpperCase() : null;
+}
+function extractReferenceHashes2(details) {
+  if (!details || typeof details !== "object" || !("errors" in details)) return [];
+  const errors = details.errors;
+  if (!Array.isArray(errors)) return [];
+  return errors.filter((value) => typeof value === "string");
+}
+function describeRejectedDeployment2(payload, references, rootfsRef) {
+  const errorCode = typeof payload.error_code === "number" ? payload.error_code : null;
+  const pendingReferences = references.filter((reference) => reference.status === "pending");
+  const missingReferences = references.filter((reference) => reference.status === "missing");
+  const rootfsReference = references.find((reference) => reference.itemHash === rootfsRef);
+  if (rootfsReference?.status === "pending") {
+    return `Aleph rejected this deployment because the referenced rootfs STORE message ${rootfsReference.itemHash} is still pending and cannot yet be used by an instance. Wait for that STORE message to process, then deploy again.`;
+  }
+  if (pendingReferences.length > 0) {
+    return `Aleph rejected this deployment because referenced message(s) are still pending: ${pendingReferences.map((reference) => reference.itemHash).join(", ")}.`;
+  }
+  if (missingReferences.length > 0) {
+    return `Aleph rejected this deployment because referenced message(s) were not found on Aleph: ${missingReferences.map((reference) => reference.itemHash).join(", ")}.`;
+  }
+  const referencedHashes = extractReferenceHashes2(payload.details);
+  if (referencedHashes.length > 0) {
+    return `Aleph rejected this deployment${errorCode ? ` (error ${errorCode})` : ""}. Referenced message(s): ${referencedHashes.join(", ")}.`;
+  }
+  return `Aleph rejected this deployment${errorCode ? ` (error ${errorCode})` : ""}.`;
+}
+function extractProxyUrl2(item, networking) {
+  const networkingCandidates = [
+    networking?.proxy_url,
+    networking?.proxyUrl,
+    networking?.web_access_url,
+    networking?.webAccessUrl,
+    networking?.proxy_hostname,
+    networking?.proxyHostname,
+    networking?.domain,
+    networking?.hostname
+  ];
+  for (const candidate of networkingCandidates) {
+    const normalized = normalizeProxyUrl2(candidate);
+    if (normalized) return normalized;
+  }
+  const webAccessCandidates = [item.web_access, item.webAccess];
+  for (const entry of webAccessCandidates) {
+    const normalized = normalizeProxyUrl2(entry?.url) ?? normalizeProxyUrl2(entry?.proxy_url) ?? normalizeProxyUrl2(entry?.hostname) ?? normalizeProxyUrl2(entry?.domain);
+    if (normalized) return normalized;
+  }
+  return null;
+}
+function normalizeExecution2(item, crnUrl) {
+  const networking = item.networking ?? null;
+  const mappedPorts2 = networking && "mapped_ports" in networking && networking.mapped_ports && typeof networking.mapped_ports === "object" ? Object.fromEntries(
+    Object.entries(networking.mapped_ports).map(([port, mapping]) => [
+      port,
+      {
+        host: asNumber2(mapping?.host) ?? void 0,
+        tcp: typeof mapping?.tcp === "boolean" ? mapping.tcp : void 0,
+        udp: typeof mapping?.udp === "boolean" ? mapping.udp : void 0
+      }
+    ])
+  ) : void 0;
+  if (networking && ("host_ipv4" in networking || "ipv6_ip" in networking || "ipv4_network" in networking)) {
+    const v2Item = item;
+    return {
+      crnUrl,
+      version: "v2",
+      running: typeof v2Item.running === "boolean" ? v2Item.running : void 0,
+      networking: {
+        ipv4_network: asString2(networking.ipv4_network),
+        host_ipv4: asString2(networking.host_ipv4),
+        ipv6_network: asString2(networking.ipv6_network),
+        ipv6_ip: asString2(networking.ipv6_ip),
+        ipv4_ip: asString2(networking.ipv4_ip),
+        proxy_url: extractProxyUrl2(v2Item, networking),
+        mapped_ports: mappedPorts2
+      },
+      status: v2Item.status ? {
+        defined_at: asString2(v2Item.status.defined_at),
+        preparing_at: asString2(v2Item.status.preparing_at),
+        prepared_at: asString2(v2Item.status.prepared_at),
+        starting_at: asString2(v2Item.status.starting_at),
+        started_at: asString2(v2Item.status.started_at),
+        stopping_at: asString2(v2Item.status.stopping_at),
+        stopped_at: asString2(v2Item.status.stopped_at)
+      } : null
+    };
+  }
+  return {
+    crnUrl,
+    version: "v1",
+    networking: {
+      ipv4: networking && "ipv4" in networking ? asString2(networking.ipv4) : null,
+      ipv6: networking && "ipv6" in networking ? asString2(networking.ipv6) : null
+    },
+    status: null
+  };
+}
+
+// ../core/src/deployment-inspection.ts
+async function fetchMessageEnvelope2(itemHash, options) {
+  const response = await options.fetch(`${options.apiHost ?? DEFAULT_ALEPH_API_HOST2}/api/v0/messages/${itemHash}`, {
+    cache: "no-cache"
+  });
+  if (response.status === 404) return null;
+  if (!response.ok) throw new Error(`Message lookup failed: ${response.status}`);
+  return await response.json();
+}
+async function fetchReference2(itemHash, options) {
+  const payload = await fetchMessageEnvelope2(itemHash, options);
+  if (!payload) {
+    return {
+      itemHash,
+      status: "missing",
+      type: null
+    };
+  }
+  return {
+    itemHash,
+    status: normalizeMessageStatus2(payload.status),
+    type: messageTypeFromEnvelope2(payload)
+  };
+}
+async function inspectDeploymentResult2(itemHash, options) {
+  const payload = await fetchMessageEnvelope2(itemHash, options);
+  if (!payload) {
+    return {
+      status: "unknown",
+      errorCode: null,
+      details: null,
+      rejectionReason: `Deployment message ${itemHash} was not found on Aleph.`,
+      references: []
+    };
+  }
+  const relatedHashes = new Set(options.rootfsRef ? [options.rootfsRef] : []);
+  for (const referenceHash of extractReferenceHashes2(payload.details)) {
+    relatedHashes.add(referenceHash);
+  }
+  const references = await Promise.all(
+    Array.from(relatedHashes).map((hash) => fetchReference2(hash, options))
+  );
+  const status = normalizeMessageStatus2(payload.status);
+  const errorCode = typeof payload.error_code === "number" ? payload.error_code : null;
+  const details = payload.details && typeof payload.details === "object" ? payload.details : null;
+  return {
+    status,
+    errorCode,
+    details,
+    rejectionReason: status === "rejected" ? describeRejectedDeployment2(payload, references, options.rootfsRef) : null,
+    references
+  };
+}
+async function waitForDeploymentResult2(itemHash, options) {
+  const attempts = Math.max(1, Number(options.attempts ?? 15));
+  const delayMs = Math.max(0, Number(options.delayMs ?? 2e3));
+  const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  let lastResult = await inspectDeploymentResult2(itemHash, options);
+  options.onAttempt?.(lastResult, 1, attempts);
+  for (let attempt = 1; attempt < attempts; attempt += 1) {
+    if (lastResult.status === "processed" || lastResult.status === "rejected") {
+      return lastResult;
+    }
+    await sleep(delayMs);
+    lastResult = await inspectDeploymentResult2(itemHash, options);
+    options.onAttempt?.(lastResult, attempt + 1, attempts);
+  }
+  return lastResult;
+}
 
 // ../core/src/broadcast.ts
 function signaturePayload(message) {
@@ -1055,6 +1349,70 @@ async function forgetAlephMessages(args) {
   };
 }
 
+// ../core/src/aggregate-publication.ts
+function createPortForwardAggregateContent(args) {
+  const existingPorts = normalizeExistingPortForwardEntry(args.existingAggregate?.[args.instanceItemHash]);
+  const mergedPorts = mergePortFlagMaps(existingPorts, requestedPortFlags(args.requestedPorts));
+  return {
+    address: args.sender,
+    key: "port-forwarding",
+    content: {
+      [args.instanceItemHash]: {
+        ports: mergedPorts
+      }
+    },
+    time: args.now ?? Date.now() / 1e3
+  };
+}
+async function createUnsignedAggregateMessage(args) {
+  const itemContent = JSON.stringify(args.content);
+  const itemHash = await args.hasher(itemContent);
+  return {
+    sender: args.sender,
+    chain: "ETH",
+    type: "AGGREGATE",
+    item_hash: itemHash,
+    item_type: "inline",
+    item_content: itemContent,
+    time: args.now ?? Date.now() / 1e3,
+    channel: args.channel ?? DEFAULT_ALEPH_CHANNEL
+  };
+}
+async function ensureInstancePortForwards(args) {
+  const requestedPorts = requiredInstancePortForwards(args.manifest);
+  const aggregate = await fetchPortForwardAggregate(args.sender, {
+    apiHost: args.apiHost,
+    fetch: args.fetch
+  });
+  const content = createPortForwardAggregateContent({
+    sender: args.sender,
+    instanceItemHash: args.instanceItemHash,
+    requestedPorts,
+    existingAggregate: aggregate
+  });
+  const unsignedMessage = await createUnsignedAggregateMessage({
+    sender: args.sender,
+    content,
+    hasher: args.hasher,
+    channel: args.channel
+  });
+  const message = await signAlephMessage(unsignedMessage, args.signer);
+  const { response, httpStatus } = await broadcastAlephMessage2(message, {
+    apiHost: args.apiHost,
+    sync: args.sync,
+    fetch: args.fetch
+  });
+  const aggregateStatus = normalizeBroadcastStatus(httpStatus, response.message_status);
+  if (aggregateStatus === "rejected") {
+    throw new Error(`Port-forward aggregate was rejected by Aleph: ${JSON.stringify(response.details ?? response)}`);
+  }
+  return {
+    aggregateItemHash: message.item_hash,
+    aggregateStatus,
+    requestedPorts
+  };
+}
+
 // ../core/src/instance-deployment.ts
 var SSH_PUBLIC_KEY_PATTERN = /^(ssh-rsa|ssh-ed25519|ecdsa-sha2-nistp256|ecdsa-sha2-nistp384|ecdsa-sha2-nistp521|sk-ssh-ed25519@openssh\.com|sk-ecdsa-sha2-nistp256@openssh\.com)\s+[A-Za-z0-9+/]+={0,3}(?:\s+.+)?$/;
 function toFiniteNumber(value) {
@@ -1226,6 +1584,252 @@ async function deployInstance(args) {
   };
 }
 
+// ../core/src/runtime.ts
+var DEFAULT_SCHEDULER_ALLOCATION_URL = "https://scheduler.api.aleph.cloud/api/v0/allocation";
+var DEFAULT_TWO_N_SIX_HASH_URL = "https://api.2n6.me/api/hash";
+function asString3(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+function asNumber3(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+function findCrnByHash(crns, crnHash) {
+  return crns.find((crn) => crn.hash === crnHash) ?? null;
+}
+async function fetchSchedulerAllocation2(itemHash, options) {
+  const response = await options.fetch(
+    `${options.schedulerAllocationUrl ?? DEFAULT_SCHEDULER_ALLOCATION_URL}/${itemHash}`,
+    { cache: "no-cache" }
+  );
+  if (response.status === 404) return null;
+  if (!response.ok) {
+    throw new Error(`Scheduler allocation request failed: ${response.status}`);
+  }
+  const payload = await response.json();
+  const node = payload?.node;
+  return {
+    source: "scheduler",
+    crnHash: asString3(node?.node_id),
+    crnUrl: asString3(node?.url),
+    node: node ? {
+      node_id: asString3(node.node_id) ?? void 0,
+      url: asString3(node.url) ?? void 0,
+      ipv6: asString3(node.ipv6),
+      supports_ipv6: typeof node.supports_ipv6 === "boolean" ? node.supports_ipv6 : void 0
+    } : null,
+    vmIpv6: asString3(payload?.vm_ipv6),
+    period: payload?.period ? {
+      start_timestamp: asString3(payload.period.start_timestamp) ?? void 0,
+      duration_seconds: asNumber3(payload.period.duration_seconds) ?? void 0
+    } : null
+  };
+}
+async function fetch2n6WebAccessUrl2(itemHash, options) {
+  const response = await options.fetch(
+    `${options.twoN6HashUrl ?? DEFAULT_TWO_N_SIX_HASH_URL}/${itemHash}`,
+    { cache: "no-cache" }
+  );
+  if (!response.ok) return null;
+  const payload = await response.json();
+  return {
+    url: normalizeProxyUrl2(payload?.url ?? payload?.subdomain),
+    active: typeof payload?.active === "boolean" ? payload.active : null,
+    subdomain: asString3(payload?.subdomain)
+  };
+}
+async function fetchCrnExecutionMap2(crnUrl, options) {
+  const normalizedCrnUrl = String(crnUrl).replace(/\/+$/, "");
+  for (const [version, suffix] of [
+    ["v2", "/v2/about/executions/list"],
+    ["v1", "/about/executions/list"]
+  ]) {
+    const requestUrl = `${normalizedCrnUrl}${suffix}`;
+    const response = await options.fetch(requestUrl, {
+      cache: "no-cache"
+    });
+    if (response.ok) {
+      const payload = await response.json();
+      return {
+        version,
+        payload: payload && typeof payload === "object" ? payload : null,
+        requestUrl
+      };
+    }
+    if (response.status !== 404) {
+      return {
+        version,
+        payload: null,
+        requestUrl
+      };
+    }
+  }
+  return {
+    version: "v2",
+    payload: null,
+    requestUrl: `${normalizedCrnUrl}/v2/about/executions/list`
+  };
+}
+function describeRuntimeAvailability(runtime) {
+  const execution = runtime.execution ?? null;
+  const mappedPorts2 = runtime.mappedPorts ?? {};
+  const hostIpv4 = runtime.hostIpv4 ?? null;
+  const proxyUrl = runtime.proxyUrl ?? null;
+  const schedulerSource = runtime.allocation?.source ?? null;
+  const webAccessActive = runtime.webAccess?.active ?? null;
+  const mappedPortCount = Object.keys(mappedPorts2).length;
+  if (hostIpv4 && mappedPortCount > 0) {
+    return {
+      state: "ready",
+      reason: null,
+      schedulerSource,
+      executionSeen: Boolean(execution),
+      webAccessActive,
+      mappedPortCount,
+      proxyUrl
+    };
+  }
+  if (!execution && proxyUrl && webAccessActive === false) {
+    return {
+      state: "proxy-reserved-inactive",
+      reason: "Aleph reserved a proxy URL for the VM, but it is still inactive and the selected CRN has not exposed execution networking yet.",
+      schedulerSource,
+      executionSeen: false,
+      webAccessActive,
+      mappedPortCount,
+      proxyUrl
+    };
+  }
+  if (!execution && schedulerSource === "manual") {
+    return {
+      state: "crn-execution-missing",
+      reason: "The deployment is pinned to a specific CRN, but that CRN is not exposing this VM in its execution list yet.",
+      schedulerSource,
+      executionSeen: false,
+      webAccessActive,
+      mappedPortCount,
+      proxyUrl
+    };
+  }
+  if (execution && !hostIpv4) {
+    return {
+      state: "execution-missing-host-ipv4",
+      reason: "The CRN exposed an execution record, but it does not include a public host IPv4 yet.",
+      schedulerSource,
+      executionSeen: true,
+      webAccessActive,
+      mappedPortCount,
+      proxyUrl
+    };
+  }
+  if (execution && mappedPortCount === 0) {
+    return {
+      state: "execution-missing-port-mappings",
+      reason: "The CRN exposed an execution record, but mapped ports are still empty.",
+      schedulerSource,
+      executionSeen: true,
+      webAccessActive,
+      mappedPortCount,
+      proxyUrl
+    };
+  }
+  return {
+    state: "runtime-pending",
+    reason: "Aleph has not exposed enough runtime networking details yet.",
+    schedulerSource,
+    executionSeen: Boolean(execution),
+    webAccessActive,
+    mappedPortCount,
+    proxyUrl
+  };
+}
+async function fetchVmRuntime(args) {
+  const crns = args.crns ?? await fetchCrns2({
+    url: args.crnListUrl ?? DEFAULT_CRN_LIST_URL2,
+    fetch: args.fetch
+  });
+  const schedulerAllocation = await fetchSchedulerAllocation2(args.itemHash, {
+    fetch: args.fetch,
+    schedulerAllocationUrl: args.schedulerAllocationUrl
+  }).catch(() => null);
+  const selectedCrn = args.crnHash ? findCrnByHash(crns, args.crnHash) : null;
+  const allocation = schedulerAllocation ?? (selectedCrn ? {
+    source: "manual",
+    crnHash: selectedCrn.hash,
+    crnUrl: selectedCrn.address,
+    node: { url: selectedCrn.address },
+    vmIpv6: null,
+    period: null
+  } : null);
+  const webAccess = await fetch2n6WebAccessUrl2(args.itemHash, {
+    fetch: args.fetch,
+    twoN6HashUrl: args.twoN6HashUrl
+  }).catch(() => null);
+  const webAccessUrl = webAccess?.url ?? null;
+  let execution = null;
+  let executionLookupBlocked = false;
+  if (allocation?.crnUrl) {
+    const executionLookup = await fetchCrnExecutionMap2(allocation.crnUrl, {
+      fetch: args.fetch
+    });
+    const executionPayload = executionLookup.payload?.[args.itemHash];
+    if (executionPayload && typeof executionPayload === "object") {
+      execution = normalizeExecution2(executionPayload, allocation.crnUrl);
+      if (!execution.networking.proxy_url && webAccessUrl) {
+        execution.networking.proxy_url = webAccessUrl;
+      }
+    } else if (executionLookup.payload == null) {
+      executionLookupBlocked = true;
+    }
+  }
+  const hostIpv4 = execution?.networking?.host_ipv4 ?? execution?.networking?.ipv4 ?? null;
+  const ipv6 = execution?.networking?.ipv6_ip ?? execution?.networking?.ipv6 ?? allocation?.vmIpv6 ?? null;
+  const mappedPorts2 = execution?.networking?.mapped_ports ?? {};
+  const sshPort = mappedPorts2?.["22"]?.host ?? null;
+  const proxyUrl = execution?.networking?.proxy_url ?? webAccessUrl ?? null;
+  const diagnostics = describeRuntimeAvailability({
+    allocation,
+    execution,
+    webAccess,
+    hostIpv4,
+    ipv6,
+    proxyUrl,
+    mappedPorts: mappedPorts2
+  });
+  return {
+    allocation,
+    execution,
+    webAccess,
+    webAccessUrl,
+    hostIpv4,
+    ipv6,
+    proxyUrl,
+    mappedPorts: mappedPorts2,
+    diagnostics,
+    sshCommand: hostIpv4 && sshPort ? `ssh root@${hostIpv4} -p ${sshPort}` : ipv6 ? `ssh root@${ipv6}` : null,
+    selectedCrn,
+    executionLookupBlocked
+  };
+}
+async function waitForVmRuntime(args) {
+  const attempts = Math.max(1, Number(args.attempts ?? 20));
+  const delayMs = Math.max(0, Number(args.delayMs ?? 4e3));
+  const sleep = args.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  let lastRuntime = await fetchVmRuntime(args);
+  args.onAttempt?.(lastRuntime, 1, attempts);
+  for (let attempt = 0; attempt < attempts - 1; attempt += 1) {
+    if (lastRuntime.hostIpv4 && Object.keys(lastRuntime.mappedPorts ?? {}).length > 0) {
+      return lastRuntime;
+    }
+    await sleep(delayMs);
+    lastRuntime = await fetchVmRuntime(args);
+    args.onAttempt?.(lastRuntime, attempt + 2, attempts);
+  }
+  if (lastRuntime.diagnostics) {
+    lastRuntime.diagnostics.timedOut = true;
+  }
+  return lastRuntime;
+}
+
 // ../core/src/guest.ts
 async function notifyCrnAllocation2(args) {
   const normalizedCrnUrl = typeof args.crnUrl === "string" ? args.crnUrl.trim().replace(/\/+$/, "") : "";
@@ -1586,9 +2190,31 @@ async function pingPeer(libp2p) {
     };
   }
 }
+var UI_DEPLOY_WAIT_ATTEMPTS = 60;
+var UI_DEPLOY_WAIT_DELAY_MS = 5e3;
+var UI_RUNTIME_WAIT_ATTEMPTS = 40;
+var UI_RUNTIME_WAIT_DELAY_MS = 5e3;
 function hasUsableRuntime(details) {
   return Boolean(details.hostIpv4) || Boolean(details.vmIpv4) || details.mappedPorts.length > 0 || Boolean(details.webUrl) || Boolean(details.execution);
 }
+function toSharedRootfsManifest(manifest) {
+  if (!manifest) {
+    return null;
+  }
+  return {
+    profile: manifest.profile,
+    version: manifest.version,
+    rootfsInstallStrategy: manifest.rootfsInstallStrategy === "thin" || manifest.rootfsInstallStrategy === "prebaked" ? manifest.rootfsInstallStrategy : void 0,
+    requiresBootstrapNetwork: manifest.requiresBootstrapNetwork,
+    bootstrapSummary: manifest.bootstrapSummary,
+    rootfsItemHash: manifest.rootfsItemHash,
+    rootfsSizeMiB: manifest.rootfsSizeMiB,
+    rootfsSourceSizeBytes: manifest.rootfsSourceSizeBytes,
+    requiredPortForwards: manifest.requiredPortForwards,
+    createdAt: manifest.createdAt,
+    notes: manifest.notes
+  };
+}
 var SponsorRelayController = class {
   state;
   subscribers = /* @__PURE__ */ new Set();
@@ -1653,7 +2279,9 @@ var SponsorRelayController = class {
     if (!itemHash) {
       return;
     }
-    const latest = instances.find((entry) => entry.instance.item_hash === itemHash);
+    const latest = instances.find(
+      (entry) => entry.instance.item_hash === itemHash
+    );
     if (!latest) {
       return;
     }
@@ -1671,13 +2299,15 @@ var SponsorRelayController = class {
       return;
     }
     if (status !== "processed") {
+      const submittedAtMs = instanceTimestampMs(latest.instance);
+      const pendingTooLong = submittedAtMs != null && Date.now() - submittedAtMs >= DEPLOYMENT_PENDING_WARNING_MS;
       this.emitProgress({
         stage: "waiting-for-aleph",
-        label: "Waiting for Aleph",
+        label: pendingTooLong ? "Aleph processing delayed" : "Waiting for Aleph",
         progress: 76,
-        status: "info",
+        status: pendingTooLong ? "warning" : "info",
         itemHash,
-        detail: "Deployment submitted. Waiting for Aleph to process the instance message."
+        detail: pendingTooLong ? "The instance is still pending on Aleph after several minutes. Retry, inspect the Aleph message, or delete and redeploy." : "Deployment submitted. Waiting for Aleph to process the instance message."
       });
       return;
     }
@@ -2001,11 +2631,75 @@ var SponsorRelayController = class {
         }
       });
       this.patch({
-        busy: { deploying: false },
         statusText: `Deployment submitted: ${result.itemHash}`,
         lastDeploymentHash: result.itemHash
       });
-      if (result.status === "processed" && this.state.selectedCrn?.address) {
+      const inspection = await waitForDeploymentResult2(result.itemHash, {
+        rootfsRef: this.state.manifest.rootfsItemHash,
+        apiHost: this.client.apiHost,
+        fetch: (url, init) => fetch(url, init),
+        attempts: UI_DEPLOY_WAIT_ATTEMPTS,
+        delayMs: UI_DEPLOY_WAIT_DELAY_MS,
+        onAttempt: (inspectionResult) => {
+          if (inspectionResult.status === "processed") {
+            this.emitProgress({
+              stage: "deployment-confirmed",
+              label: "Deployment accepted by Aleph",
+              progress: 82,
+              status: "success",
+              itemHash: result.itemHash,
+              detail: "Aleph processed the instance message."
+            });
+            return;
+          }
+          if (inspectionResult.status === "rejected") {
+            this.emitProgress({
+              stage: "deployment-rejected",
+              label: "Deployment rejected",
+              progress: 100,
+              status: "error",
+              itemHash: result.itemHash,
+              detail: inspectionResult.rejectionReason ?? "Aleph rejected the deployment.",
+              error: inspectionResult.rejectionReason ?? "Aleph rejected the deployment."
+            });
+            return;
+          }
+          this.emitProgress({
+            stage: "waiting-for-aleph",
+            label: "Waiting for Aleph",
+            progress: 76,
+            status: "info",
+            itemHash: result.itemHash,
+            detail: "Deployment submitted. Waiting for Aleph to process the instance message."
+          });
+        }
+      });
+      if (inspection.status !== "processed") {
+        throw new Error(
+          inspection.rejectionReason ?? `Deployment ${result.itemHash} stayed ${inspection.status} on Aleph.`
+        );
+      }
+      if ((this.state.manifest.requiredPortForwards?.length ?? 0) > 0) {
+        this.emitProgress({
+          stage: "refreshing-instances",
+          label: "Publishing port forwards",
+          progress: 86,
+          status: "info",
+          itemHash: result.itemHash,
+          detail: "Publishing the required Aleph port-forward aggregate from the manifest."
+        });
+        await ensureInstancePortForwards({
+          sender: this.state.wallet.address,
+          instanceItemHash: result.itemHash,
+          manifest: toSharedRootfsManifest(this.state.manifest),
+          signer: personalSign,
+          hasher: sha256Hex,
+          fetch: (url, init) => fetch(url, init),
+          apiHost: this.client.apiHost,
+          sync: true
+        });
+      }
+      if (this.state.selectedCrn?.address) {
         await notifyCrnAllocationWithRetry({
           crnUrl: this.state.selectedCrn.address,
           itemHash: result.itemHash,
@@ -2015,10 +2709,56 @@ var SponsorRelayController = class {
           }
         });
       }
+      this.emitProgress({
+        stage: "deployment-confirmed",
+        label: "Waiting for runtime",
+        progress: 90,
+        status: "warning",
+        itemHash: result.itemHash,
+        detail: "Aleph accepted the deployment. Waiting for runtime networking and mapped ports."
+      });
+      const runtime = await waitForVmRuntime({
+        itemHash: result.itemHash,
+        fetch: (url, init) => fetch(url, init),
+        crnHash: this.state.selectedCrn?.hash,
+        crns: this.state.crns,
+        crnListUrl: this.props.crnListUrl,
+        attempts: UI_RUNTIME_WAIT_ATTEMPTS,
+        delayMs: UI_RUNTIME_WAIT_DELAY_MS,
+        onAttempt: (runtime2) => {
+          if (runtime2.hostIpv4 && Object.keys(runtime2.mappedPorts ?? {}).length > 0) {
+            this.emitProgress({
+              stage: "completed",
+              label: "Runtime ready",
+              progress: 100,
+              status: "success",
+              itemHash: result.itemHash,
+              detail: "Runtime networking and mapped ports are now available."
+            });
+            return;
+          }
+          this.emitProgress({
+            stage: "deployment-confirmed",
+            label: "Waiting for runtime",
+            progress: 90,
+            status: "warning",
+            itemHash: result.itemHash,
+            detail: runtime2.diagnostics?.reason ?? "Waiting for CRN runtime networking and mapped ports."
+          });
+        }
+      });
+      if (!runtime.hostIpv4 || Object.keys(runtime.mappedPorts ?? {}).length === 0) {
+        throw new Error(
+          runtime.diagnostics?.reason ?? "Deployment was processed, but runtime networking never exposed mapped ports."
+        );
+      }
+      this.patch({
+        busy: { deploying: false }
+      });
       this.emitProgress({
         stage: "refreshing-instances",
         label: "Refreshing instances",
-        progress: 92,
+        progress: 96,
         status: "info",
         itemHash: result.itemHash,
         detail: "Reloading deployments and runtime state."
@@ -2112,6 +2852,7 @@ export {
   DEFAULT_INSTANCE_NAME,
   DEFAULT_MANIFEST_URL,
   DEFAULT_TIER_ID,
+  DEPLOYMENT_PENDING_WARNING_MS,
   IDLE_DEPLOYMENT_PROGRESS,
   INSTANCE_RUNTIME_PENDING_REFRESH_MS,
   INSTANCE_RUNTIME_READY_REFRESH_MS,
@@ -2131,6 +2872,7 @@ export {
   formatNumber,
   getEthereumProvider,
   joinMappedPorts,
+  joinRequiredPortForwards,
   personalSign,
   resolveManifestSource,
   shortHash,