@le-space/ui 0.1.61 → 0.2.0

package/shared/index.js

@@ -65,6 +65,16 @@ function joinMappedPorts(mappedPorts2) {
   if (mappedPorts2.length === 0) return "-";
   return mappedPorts2.map((entry) => `${entry.label}->${entry.hostPort ?? "?"}`).join(" \xB7 ");
 }
+function joinRequiredPortForwards(portForwards) {
+  if (!portForwards || portForwards.length === 0) return "-";
+  return portForwards.map((entry) => {
+    const protocols = [
+      entry.tcp === true ? "tcp" : null,
+      entry.udp === true ? "udp" : null
+    ].filter((value) => Boolean(value)).join("/");
+    return `${entry.port}/${protocols}`;
+  }).join(" \xB7 ");
+}
 
 // ../browser/src/http.ts
 async function fetchWithTimeout(input, init = {}, timeoutMs = 15e3) {
@@ -851,6 +861,7 @@ var DEFAULT_ALEPH_CHANNEL = "TEST";
 var DEFAULT_ALEPH_API_HOST2 = "https://api2.aleph.im";
 
 // ../core/src/crns.ts
+var DEFAULT_CRN_LIST_URL2 = "https://crns-list.aleph.sh/crns.json";
 function compatibleCrns(crns, excludedHashes = []) {
   const excluded = new Set(excludedHashes.filter(Boolean));
   return [...crns].filter((crn) => {
@@ -884,8 +895,113 @@ function filterDeployableCrns(crns, options = {}) {
     compatibleCrns(crns, options.excludedHashes).filter((crn) => hasCrnCapacity(crn, options.spec))
   );
 }
+async function fetchCrns2(options) {
+  const requestUrl = new URL(options.url ?? DEFAULT_CRN_LIST_URL2);
+  requestUrl.searchParams.set("filter_inactive", "true");
+  const response = await options.fetch(requestUrl.toString(), {
+    cache: "no-cache"
+  });
+  if (!response.ok) {
+    throw new Error(`CRN list request failed: ${response.status}`);
+  }
+  const payload = await response.json();
+  return Array.isArray(payload?.crns) ? payload.crns : [];
+}
+
+// ../core/src/port-forwarding.ts
+var DEFAULT_INSTANCE_PORT_FORWARDS = [
+  { port: 22, tcp: true, udp: false, purpose: "SSH" }
+];
+function normalizeRequestedPort(entry) {
+  return {
+    port: entry.port,
+    tcp: entry.tcp === true,
+    udp: entry.udp === true,
+    purpose: entry.purpose?.trim() || void 0
+  };
+}
+function normalizePortFlags(value) {
+  if (!value || typeof value !== "object") return null;
+  const candidate = value;
+  return {
+    tcp: candidate.tcp === true,
+    udp: candidate.udp === true
+  };
+}
+function normalizeExistingPortForwardEntry(entry) {
+  if (!entry?.ports || typeof entry.ports !== "object") return {};
+  return Object.fromEntries(
+    Object.entries(entry.ports).map(([port, flags]) => [port, normalizePortFlags(flags)]).filter((item) => item[1] != null)
+  );
+}
+function requestedPortFlags(portForwards) {
+  return Object.fromEntries(
+    portForwards.map((entry) => [
+      String(entry.port),
+      {
+        tcp: entry.tcp === true,
+        udp: entry.udp === true
+      }
+    ])
+  );
+}
+function mergePortFlagMaps(existing, requested) {
+  const merged = /* @__PURE__ */ new Map();
+  for (const [port, flags] of Object.entries(existing)) {
+    merged.set(port, {
+      tcp: flags.tcp === true,
+      udp: flags.udp === true
+    });
+  }
+  for (const [port, flags] of Object.entries(requested)) {
+    const current = merged.get(port);
+    merged.set(port, {
+      tcp: current?.tcp === true || flags.tcp === true,
+      udp: current?.udp === true || flags.udp === true
+    });
+  }
+  return Object.fromEntries([...merged.entries()].sort((left, right) => Number(left[0]) - Number(right[0])));
+}
+function mergeRequiredPortForwards(...groups) {
+  const merged = /* @__PURE__ */ new Map();
+  for (const group of groups) {
+    for (const entry of group ?? []) {
+      const normalized = normalizeRequestedPort(entry);
+      const current = merged.get(normalized.port);
+      merged.set(normalized.port, {
+        port: normalized.port,
+        tcp: current?.tcp === true || normalized.tcp === true,
+        udp: current?.udp === true || normalized.udp === true,
+        purpose: current?.purpose ?? normalized.purpose
+      });
+    }
+  }
+  return [...merged.values()].sort((left, right) => left.port - right.port);
+}
+function requiredInstancePortForwards(manifest) {
+  return mergeRequiredPortForwards(DEFAULT_INSTANCE_PORT_FORWARDS, manifest?.requiredPortForwards);
+}
+async function fetchPortForwardAggregate(address, options) {
+  const requestUrl = new URL(`/api/v0/aggregates/${address}.json`, options.apiHost ?? DEFAULT_ALEPH_API_HOST2);
+  requestUrl.searchParams.set("keys", "port-forwarding");
+  const response = await options.fetch(requestUrl.toString(), { cache: "no-cache" });
+  if (response.status === 404) return {};
+  if (!response.ok) {
+    throw new Error(`Port-forward aggregate request failed: ${response.status}`);
+  }
+  const payload = await response.json();
+  const aggregate = payload.data?.["port-forwarding"];
+  if (!aggregate || typeof aggregate !== "object" || Array.isArray(aggregate)) return {};
+  return aggregate;
+}
 
 // ../core/src/aleph-normalizers.ts
+function asString2(value) {
+  return typeof value === "string" && value.trim() ? value : null;
+}
+function asNumber2(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
 function normalizeMessageStatus2(status) {
   if (typeof status !== "string") return "unknown";
   const normalized = status.toLowerCase();
@@ -894,6 +1010,183 @@ function normalizeMessageStatus2(status) {
   }
   return "unknown";
 }
+function normalizeProxyUrl2(value) {
+  const stringValue = asString2(value);
+  if (!stringValue) return null;
+  if (/^https?:\/\//i.test(stringValue)) return stringValue;
+  return `https://${stringValue}`;
+}
+function messageTypeFromEnvelope2(payload) {
+  if (!payload) return null;
+  const type = payload.type ?? payload.message?.type ?? (Array.isArray(payload.messages) ? payload.messages[0]?.type : void 0);
+  return typeof type === "string" ? type.toUpperCase() : null;
+}
+function extractReferenceHashes2(details) {
+  if (!details || typeof details !== "object" || !("errors" in details)) return [];
+  const errors = details.errors;
+  if (!Array.isArray(errors)) return [];
+  return errors.filter((value) => typeof value === "string");
+}
+function describeRejectedDeployment2(payload, references, rootfsRef) {
+  const errorCode = typeof payload.error_code === "number" ? payload.error_code : null;
+  const pendingReferences = references.filter((reference) => reference.status === "pending");
+  const missingReferences = references.filter((reference) => reference.status === "missing");
+  const rootfsReference = references.find((reference) => reference.itemHash === rootfsRef);
+  if (rootfsReference?.status === "pending") {
+    return `Aleph rejected this deployment because the referenced rootfs STORE message ${rootfsReference.itemHash} is still pending and cannot yet be used by an instance. Wait for that STORE message to process, then deploy again.`;
+  }
+  if (pendingReferences.length > 0) {
+    return `Aleph rejected this deployment because referenced message(s) are still pending: ${pendingReferences.map((reference) => reference.itemHash).join(", ")}.`;
+  }
+  if (missingReferences.length > 0) {
+    return `Aleph rejected this deployment because referenced message(s) were not found on Aleph: ${missingReferences.map((reference) => reference.itemHash).join(", ")}.`;
+  }
+  const referencedHashes = extractReferenceHashes2(payload.details);
+  if (referencedHashes.length > 0) {
+    return `Aleph rejected this deployment${errorCode ? ` (error ${errorCode})` : ""}. Referenced message(s): ${referencedHashes.join(", ")}.`;
+  }
+  return `Aleph rejected this deployment${errorCode ? ` (error ${errorCode})` : ""}.`;
+}
+function extractProxyUrl2(item, networking) {
+  const networkingCandidates = [
+    networking?.proxy_url,
+    networking?.proxyUrl,
+    networking?.web_access_url,
+    networking?.webAccessUrl,
+    networking?.proxy_hostname,
+    networking?.proxyHostname,
+    networking?.domain,
+    networking?.hostname
+  ];
+  for (const candidate of networkingCandidates) {
+    const normalized = normalizeProxyUrl2(candidate);
+    if (normalized) return normalized;
+  }
+  const webAccessCandidates = [item.web_access, item.webAccess];
+  for (const entry of webAccessCandidates) {
+    const normalized = normalizeProxyUrl2(entry?.url) ?? normalizeProxyUrl2(entry?.proxy_url) ?? normalizeProxyUrl2(entry?.hostname) ?? normalizeProxyUrl2(entry?.domain);
+    if (normalized) return normalized;
+  }
+  return null;
+}
+function normalizeExecution2(item, crnUrl) {
+  const networking = item.networking ?? null;
+  const mappedPorts2 = networking && "mapped_ports" in networking && networking.mapped_ports && typeof networking.mapped_ports === "object" ? Object.fromEntries(
+    Object.entries(networking.mapped_ports).map(([port, mapping]) => [
+      port,
+      {
+        host: asNumber2(mapping?.host) ?? void 0,
+        tcp: typeof mapping?.tcp === "boolean" ? mapping.tcp : void 0,
+        udp: typeof mapping?.udp === "boolean" ? mapping.udp : void 0
+      }
+    ])
+  ) : void 0;
+  if (networking && ("host_ipv4" in networking || "ipv6_ip" in networking || "ipv4_network" in networking)) {
+    const v2Item = item;
+    return {
+      crnUrl,
+      version: "v2",
+      running: typeof v2Item.running === "boolean" ? v2Item.running : void 0,
+      networking: {
+        ipv4_network: asString2(networking.ipv4_network),
+        host_ipv4: asString2(networking.host_ipv4),
+        ipv6_network: asString2(networking.ipv6_network),
+        ipv6_ip: asString2(networking.ipv6_ip),
+        ipv4_ip: asString2(networking.ipv4_ip),
+        proxy_url: extractProxyUrl2(v2Item, networking),
+        mapped_ports: mappedPorts2
+      },
+      status: v2Item.status ? {
+        defined_at: asString2(v2Item.status.defined_at),
+        preparing_at: asString2(v2Item.status.preparing_at),
+        prepared_at: asString2(v2Item.status.prepared_at),
+        starting_at: asString2(v2Item.status.starting_at),
+        started_at: asString2(v2Item.status.started_at),
+        stopping_at: asString2(v2Item.status.stopping_at),
+        stopped_at: asString2(v2Item.status.stopped_at)
+      } : null
+    };
+  }
+  return {
+    crnUrl,
+    version: "v1",
+    networking: {
+      ipv4: networking && "ipv4" in networking ? asString2(networking.ipv4) : null,
+      ipv6: networking && "ipv6" in networking ? asString2(networking.ipv6) : null
+    },
+    status: null
+  };
+}
+
+// ../core/src/deployment-inspection.ts
+async function fetchMessageEnvelope2(itemHash, options) {
+  const response = await options.fetch(`${options.apiHost ?? DEFAULT_ALEPH_API_HOST2}/api/v0/messages/${itemHash}`, {
+    cache: "no-cache"
+  });
+  if (response.status === 404) return null;
+  if (!response.ok) throw new Error(`Message lookup failed: ${response.status}`);
+  return await response.json();
+}
+async function fetchReference2(itemHash, options) {
+  const payload = await fetchMessageEnvelope2(itemHash, options);
+  if (!payload) {
+    return {
+      itemHash,
+      status: "missing",
+      type: null
+    };
+  }
+  return {
+    itemHash,
+    status: normalizeMessageStatus2(payload.status),
+    type: messageTypeFromEnvelope2(payload)
+  };
+}
+async function inspectDeploymentResult2(itemHash, options) {
+  const payload = await fetchMessageEnvelope2(itemHash, options);
+  if (!payload) {
+    return {
+      status: "unknown",
+      errorCode: null,
+      details: null,
+      rejectionReason: `Deployment message ${itemHash} was not found on Aleph.`,
+      references: []
+    };
+  }
+  const relatedHashes = new Set(options.rootfsRef ? [options.rootfsRef] : []);
+  for (const referenceHash of extractReferenceHashes2(payload.details)) {
+    relatedHashes.add(referenceHash);
+  }
+  const references = await Promise.all(
+    Array.from(relatedHashes).map((hash) => fetchReference2(hash, options))
+  );
+  const status = normalizeMessageStatus2(payload.status);
+  const errorCode = typeof payload.error_code === "number" ? payload.error_code : null;
+  const details = payload.details && typeof payload.details === "object" ? payload.details : null;
+  return {
+    status,
+    errorCode,
+    details,
+    rejectionReason: status === "rejected" ? describeRejectedDeployment2(payload, references, options.rootfsRef) : null,
+    references
+  };
+}
+async function waitForDeploymentResult2(itemHash, options) {
+  const attempts = Math.max(1, Number(options.attempts ?? 15));
+  const delayMs = Math.max(0, Number(options.delayMs ?? 2e3));
+  const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  let lastResult = await inspectDeploymentResult2(itemHash, options);
+  options.onAttempt?.(lastResult, 1, attempts);
+  for (let attempt = 1; attempt < attempts; attempt += 1) {
+    if (lastResult.status === "processed" || lastResult.status === "rejected") {
+      return lastResult;
+    }
+    await sleep(delayMs);
+    lastResult = await inspectDeploymentResult2(itemHash, options);
+    options.onAttempt?.(lastResult, attempt + 1, attempts);
+  }
+  return lastResult;
+}
 
 // ../core/src/broadcast.ts
 function signaturePayload(message) {
@@ -1056,6 +1349,70 @@ async function forgetAlephMessages(args) {
   };
 }
 
+// ../core/src/aggregate-publication.ts
+function createPortForwardAggregateContent(args) {
+  const existingPorts = normalizeExistingPortForwardEntry(args.existingAggregate?.[args.instanceItemHash]);
+  const mergedPorts = mergePortFlagMaps(existingPorts, requestedPortFlags(args.requestedPorts));
+  return {
+    address: args.sender,
+    key: "port-forwarding",
+    content: {
+      [args.instanceItemHash]: {
+        ports: mergedPorts
+      }
+    },
+    time: args.now ?? Date.now() / 1e3
+  };
+}
+async function createUnsignedAggregateMessage(args) {
+  const itemContent = JSON.stringify(args.content);
+  const itemHash = await args.hasher(itemContent);
+  return {
+    sender: args.sender,
+    chain: "ETH",
+    type: "AGGREGATE",
+    item_hash: itemHash,
+    item_type: "inline",
+    item_content: itemContent,
+    time: args.now ?? Date.now() / 1e3,
+    channel: args.channel ?? DEFAULT_ALEPH_CHANNEL
+  };
+}
+async function ensureInstancePortForwards(args) {
+  const requestedPorts = requiredInstancePortForwards(args.manifest);
+  const aggregate = await fetchPortForwardAggregate(args.sender, {
+    apiHost: args.apiHost,
+    fetch: args.fetch
+  });
+  const content = createPortForwardAggregateContent({
+    sender: args.sender,
+    instanceItemHash: args.instanceItemHash,
+    requestedPorts,
+    existingAggregate: aggregate
+  });
+  const unsignedMessage = await createUnsignedAggregateMessage({
+    sender: args.sender,
+    content,
+    hasher: args.hasher,
+    channel: args.channel
+  });
+  const message = await signAlephMessage(unsignedMessage, args.signer);
+  const { response, httpStatus } = await broadcastAlephMessage2(message, {
+    apiHost: args.apiHost,
+    sync: args.sync,
+    fetch: args.fetch
+  });
+  const aggregateStatus = normalizeBroadcastStatus(httpStatus, response.message_status);
+  if (aggregateStatus === "rejected") {
+    throw new Error(`Port-forward aggregate was rejected by Aleph: ${JSON.stringify(response.details ?? response)}`);
+  }
+  return {
+    aggregateItemHash: message.item_hash,
+    aggregateStatus,
+    requestedPorts
+  };
+}
+
 // ../core/src/instance-deployment.ts
 var SSH_PUBLIC_KEY_PATTERN = /^(ssh-rsa|ssh-ed25519|ecdsa-sha2-nistp256|ecdsa-sha2-nistp384|ecdsa-sha2-nistp521|sk-ssh-ed25519@openssh\.com|sk-ecdsa-sha2-nistp256@openssh\.com)\s+[A-Za-z0-9+/]+={0,3}(?:\s+.+)?$/;
 function toFiniteNumber(value) {
@@ -1227,6 +1584,252 @@ async function deployInstance(args) {
   };
 }
 
+// ../core/src/runtime.ts
+var DEFAULT_SCHEDULER_ALLOCATION_URL = "https://scheduler.api.aleph.cloud/api/v0/allocation";
+var DEFAULT_TWO_N_SIX_HASH_URL = "https://api.2n6.me/api/hash";
+function asString3(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+function asNumber3(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+function findCrnByHash(crns, crnHash) {
+  return crns.find((crn) => crn.hash === crnHash) ?? null;
+}
+async function fetchSchedulerAllocation2(itemHash, options) {
+  const response = await options.fetch(
+    `${options.schedulerAllocationUrl ?? DEFAULT_SCHEDULER_ALLOCATION_URL}/${itemHash}`,
+    { cache: "no-cache" }
+  );
+  if (response.status === 404) return null;
+  if (!response.ok) {
+    throw new Error(`Scheduler allocation request failed: ${response.status}`);
+  }
+  const payload = await response.json();
+  const node = payload?.node;
+  return {
+    source: "scheduler",
+    crnHash: asString3(node?.node_id),
+    crnUrl: asString3(node?.url),
+    node: node ? {
+      node_id: asString3(node.node_id) ?? void 0,
+      url: asString3(node.url) ?? void 0,
+      ipv6: asString3(node.ipv6),
+      supports_ipv6: typeof node.supports_ipv6 === "boolean" ? node.supports_ipv6 : void 0
+    } : null,
+    vmIpv6: asString3(payload?.vm_ipv6),
+    period: payload?.period ? {
+      start_timestamp: asString3(payload.period.start_timestamp) ?? void 0,
+      duration_seconds: asNumber3(payload.period.duration_seconds) ?? void 0
+    } : null
+  };
+}
+async function fetch2n6WebAccessUrl2(itemHash, options) {
+  const response = await options.fetch(
+    `${options.twoN6HashUrl ?? DEFAULT_TWO_N_SIX_HASH_URL}/${itemHash}`,
+    { cache: "no-cache" }
+  );
+  if (!response.ok) return null;
+  const payload = await response.json();
+  return {
+    url: normalizeProxyUrl2(payload?.url ?? payload?.subdomain),
+    active: typeof payload?.active === "boolean" ? payload.active : null,
+    subdomain: asString3(payload?.subdomain)
+  };
+}
+async function fetchCrnExecutionMap2(crnUrl, options) {
+  const normalizedCrnUrl = String(crnUrl).replace(/\/+$/, "");
+  for (const [version, suffix] of [
+    ["v2", "/v2/about/executions/list"],
+    ["v1", "/about/executions/list"]
+  ]) {
+    const requestUrl = `${normalizedCrnUrl}${suffix}`;
+    const response = await options.fetch(requestUrl, {
+      cache: "no-cache"
+    });
+    if (response.ok) {
+      const payload = await response.json();
+      return {
+        version,
+        payload: payload && typeof payload === "object" ? payload : null,
+        requestUrl
+      };
+    }
+    if (response.status !== 404) {
+      return {
+        version,
+        payload: null,
+        requestUrl
+      };
+    }
+  }
+  return {
+    version: "v2",
+    payload: null,
+    requestUrl: `${normalizedCrnUrl}/v2/about/executions/list`
+  };
+}
+function describeRuntimeAvailability(runtime) {
+  const execution = runtime.execution ?? null;
+  const mappedPorts2 = runtime.mappedPorts ?? {};
+  const hostIpv4 = runtime.hostIpv4 ?? null;
+  const proxyUrl = runtime.proxyUrl ?? null;
+  const schedulerSource = runtime.allocation?.source ?? null;
+  const webAccessActive = runtime.webAccess?.active ?? null;
+  const mappedPortCount = Object.keys(mappedPorts2).length;
+  if (hostIpv4 && mappedPortCount > 0) {
+    return {
+      state: "ready",
+      reason: null,
+      schedulerSource,
+      executionSeen: Boolean(execution),
+      webAccessActive,
+      mappedPortCount,
+      proxyUrl
+    };
+  }
+  if (!execution && proxyUrl && webAccessActive === false) {
+    return {
+      state: "proxy-reserved-inactive",
+      reason: "Aleph reserved a proxy URL for the VM, but it is still inactive and the selected CRN has not exposed execution networking yet.",
+      schedulerSource,
+      executionSeen: false,
+      webAccessActive,
+      mappedPortCount,
+      proxyUrl
+    };
+  }
+  if (!execution && schedulerSource === "manual") {
+    return {
+      state: "crn-execution-missing",
+      reason: "The deployment is pinned to a specific CRN, but that CRN is not exposing this VM in its execution list yet.",
+      schedulerSource,
+      executionSeen: false,
+      webAccessActive,
+      mappedPortCount,
+      proxyUrl
+    };
+  }
+  if (execution && !hostIpv4) {
+    return {
+      state: "execution-missing-host-ipv4",
+      reason: "The CRN exposed an execution record, but it does not include a public host IPv4 yet.",
+      schedulerSource,
+      executionSeen: true,
+      webAccessActive,
+      mappedPortCount,
+      proxyUrl
+    };
+  }
+  if (execution && mappedPortCount === 0) {
+    return {
+      state: "execution-missing-port-mappings",
+      reason: "The CRN exposed an execution record, but mapped ports are still empty.",
+      schedulerSource,
+      executionSeen: true,
+      webAccessActive,
+      mappedPortCount,
+      proxyUrl
+    };
+  }
+  return {
+    state: "runtime-pending",
+    reason: "Aleph has not exposed enough runtime networking details yet.",
+    schedulerSource,
+    executionSeen: Boolean(execution),
+    webAccessActive,
+    mappedPortCount,
+    proxyUrl
+  };
+}
+async function fetchVmRuntime(args) {
+  const crns = args.crns ?? await fetchCrns2({
+    url: args.crnListUrl ?? DEFAULT_CRN_LIST_URL2,
+    fetch: args.fetch
+  });
+  const schedulerAllocation = await fetchSchedulerAllocation2(args.itemHash, {
+    fetch: args.fetch,
+    schedulerAllocationUrl: args.schedulerAllocationUrl
+  }).catch(() => null);
+  const selectedCrn = args.crnHash ? findCrnByHash(crns, args.crnHash) : null;
+  const allocation = schedulerAllocation ?? (selectedCrn ? {
+    source: "manual",
+    crnHash: selectedCrn.hash,
+    crnUrl: selectedCrn.address,
+    node: { url: selectedCrn.address },
+    vmIpv6: null,
+    period: null
+  } : null);
+  const webAccess = await fetch2n6WebAccessUrl2(args.itemHash, {
+    fetch: args.fetch,
+    twoN6HashUrl: args.twoN6HashUrl
+  }).catch(() => null);
+  const webAccessUrl = webAccess?.url ?? null;
+  let execution = null;
+  let executionLookupBlocked = false;
+  if (allocation?.crnUrl) {
+    const executionLookup = await fetchCrnExecutionMap2(allocation.crnUrl, {
+      fetch: args.fetch
+    });
+    const executionPayload = executionLookup.payload?.[args.itemHash];
+    if (executionPayload && typeof executionPayload === "object") {
+      execution = normalizeExecution2(executionPayload, allocation.crnUrl);
+      if (!execution.networking.proxy_url && webAccessUrl) {
+        execution.networking.proxy_url = webAccessUrl;
+      }
+    } else if (executionLookup.payload == null) {
+      executionLookupBlocked = true;
+    }
+  }
+  const hostIpv4 = execution?.networking?.host_ipv4 ?? execution?.networking?.ipv4 ?? null;
+  const ipv6 = execution?.networking?.ipv6_ip ?? execution?.networking?.ipv6 ?? allocation?.vmIpv6 ?? null;
+  const mappedPorts2 = execution?.networking?.mapped_ports ?? {};
+  const sshPort = mappedPorts2?.["22"]?.host ?? null;
+  const proxyUrl = execution?.networking?.proxy_url ?? webAccessUrl ?? null;
+  const diagnostics = describeRuntimeAvailability({
+    allocation,
+    execution,
+    webAccess,
+    hostIpv4,
+    ipv6,
+    proxyUrl,
+    mappedPorts: mappedPorts2
+  });
+  return {
+    allocation,
+    execution,
+    webAccess,
+    webAccessUrl,
+    hostIpv4,
+    ipv6,
+    proxyUrl,
+    mappedPorts: mappedPorts2,
+    diagnostics,
+    sshCommand: hostIpv4 && sshPort ? `ssh root@${hostIpv4} -p ${sshPort}` : ipv6 ? `ssh root@${ipv6}` : null,
+    selectedCrn,
+    executionLookupBlocked
+  };
+}
+async function waitForVmRuntime(args) {
+  const attempts = Math.max(1, Number(args.attempts ?? 20));
+  const delayMs = Math.max(0, Number(args.delayMs ?? 4e3));
+  const sleep = args.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  let lastRuntime = await fetchVmRuntime(args);
+  args.onAttempt?.(lastRuntime, 1, attempts);
+  for (let attempt = 0; attempt < attempts - 1; attempt += 1) {
+    if (lastRuntime.hostIpv4 && Object.keys(lastRuntime.mappedPorts ?? {}).length > 0) {
+      return lastRuntime;
+    }
+    await sleep(delayMs);
+    lastRuntime = await fetchVmRuntime(args);
+    args.onAttempt?.(lastRuntime, attempt + 2, attempts);
+  }
+  if (lastRuntime.diagnostics) {
+    lastRuntime.diagnostics.timedOut = true;
+  }
+  return lastRuntime;
+}
+
 // ../core/src/guest.ts
 async function notifyCrnAllocation2(args) {
   const normalizedCrnUrl = typeof args.crnUrl === "string" ? args.crnUrl.trim().replace(/\/+$/, "") : "";
@@ -1381,6 +1984,16 @@ function defaultState(props = {}) {
     deploymentProgress: IDLE_DEPLOYMENT_PROGRESS
   };
 }
+function isDebugEnabled(props) {
+  if (props.debug) {
+    return true;
+  }
+  try {
+    return globalThis.localStorage?.getItem("LE_SPACE_UI_DEBUG") === "1";
+  } catch {
+    return false;
+  }
+}
 async function sha256Hex(payload) {
   const digest = await globalThis.crypto.subtle.digest(
     "SHA-256",
@@ -1396,6 +2009,12 @@ function mappedPorts(execution) {
     })
   );
 }
+function runtimeMappedPorts(mappedPortsRecord) {
+  return Object.entries(mappedPortsRecord ?? {}).map(([port, mapping]) => ({
+    label: `${port}/${mapping.udp ? "udp" : "tcp"}`,
+    hostPort: mapping.host ?? null
+  }));
+}
 function rootfsHealth(args) {
   if (!args.manifestState.valid || !args.manifestState.manifest) {
     return {
@@ -1466,8 +2085,18 @@ async function inspectInstanceRuntime(args) {
     execution: null,
     error: null
   };
-  if (details.messageStatus !== "processed") {
-    return details;
+  const lookup = {
+    allocationFound: false,
+    allocationSource: null,
+    crnUrl: null,
+    webUrl: null,
+    executionPayloadFound: false,
+    executionLookupBlocked: false,
+    executionLookupRequestUrl: null,
+    executionLookupVersion: null
+  };
+  if (details.messageStatus === "rejected" || details.messageStatus === "removing") {
+    return { details, lookup };
   }
   try {
     const allocation = await args.client.fetchSchedulerAllocation(args.instance.item_hash) ?? (() => {
@@ -1482,26 +2111,35 @@ async function inspectInstanceRuntime(args) {
         period: null
       } : null;
     })();
+    lookup.allocationFound = Boolean(allocation);
+    lookup.allocationSource = allocation?.source ?? null;
     details.allocationSource = allocation?.source ?? null;
     details.crnUrl = allocation?.crnUrl ?? null;
     details.ipv6 = allocation?.vmIpv6 ?? null;
     details.webUrl = await args.client.fetch2n6WebAccessUrl(
       args.instance.item_hash
     );
+    lookup.crnUrl = details.crnUrl;
+    lookup.webUrl = details.webUrl;
     if (!allocation?.crnUrl) {
-      return details;
+      return { details, lookup };
     }
     const executionLookup = await args.client.fetchCrnExecutionMap(
       allocation.crnUrl
     );
+    lookup.executionLookupBlocked = executionLookup.blocked;
+    lookup.executionLookupRequestUrl = executionLookup.requestUrl ?? null;
+    lookup.executionLookupVersion = executionLookup.version ?? null;
     const executionPayload = executionLookup.payload?.[args.instance.item_hash];
+    lookup.executionPayloadFound = Boolean(executionPayload);
     if (!executionPayload) {
-      return details;
+      return { details, lookup };
     }
     const execution = normalizeExecution(executionPayload, allocation.crnUrl);
     if (!execution.networking.proxy_url && details.webUrl) {
       execution.networking.proxy_url = details.webUrl;
     }
+    details.messageStatus = "processed";
     details.execution = execution;
     details.hostIpv4 = execution.networking.host_ipv4 ?? execution.networking.ipv4 ?? null;
     details.ipv6 = execution.networking.ipv6_ip ?? execution.networking.ipv6 ?? details.ipv6;
@@ -1509,11 +2147,14 @@ async function inspectInstanceRuntime(args) {
     details.webUrl = execution.networking.proxy_url ?? details.webUrl;
     details.mappedPorts = mappedPorts(execution);
     details.sshCommand = buildSshCommand(details.hostIpv4, details.mappedPorts);
-    return details;
+    return { details, lookup };
   } catch (error) {
     return {
-      ...details,
-      error: error instanceof Error ? error.message : String(error)
+      details: {
+        ...details,
+        error: error instanceof Error ? error.message : String(error)
+      },
+      lookup
     };
   }
 }
@@ -1587,9 +2228,31 @@ async function pingPeer(libp2p) {
     };
   }
 }
+var UI_DEPLOY_WAIT_ATTEMPTS = 60;
+var UI_DEPLOY_WAIT_DELAY_MS = 5e3;
+var UI_RUNTIME_WAIT_ATTEMPTS = 40;
+var UI_RUNTIME_WAIT_DELAY_MS = 5e3;
 function hasUsableRuntime(details) {
   return Boolean(details.hostIpv4) || Boolean(details.vmIpv4) || details.mappedPorts.length > 0 || Boolean(details.webUrl) || Boolean(details.execution);
 }
+function toSharedRootfsManifest(manifest) {
+  if (!manifest) {
+    return null;
+  }
+  return {
+    profile: manifest.profile,
+    version: manifest.version,
+    rootfsInstallStrategy: manifest.rootfsInstallStrategy === "thin" || manifest.rootfsInstallStrategy === "prebaked" ? manifest.rootfsInstallStrategy : void 0,
+    requiresBootstrapNetwork: manifest.requiresBootstrapNetwork,
+    bootstrapSummary: manifest.bootstrapSummary,
+    rootfsItemHash: manifest.rootfsItemHash,
+    rootfsSizeMiB: manifest.rootfsSizeMiB,
+    rootfsSourceSizeBytes: manifest.rootfsSourceSizeBytes,
+    requiredPortForwards: manifest.requiredPortForwards,
+    createdAt: manifest.createdAt,
+    notes: manifest.notes
+  };
+}
 var SponsorRelayController = class {
   state;
   subscribers = /* @__PURE__ */ new Set();
@@ -1600,9 +2263,13 @@ var SponsorRelayController = class {
   props;
   progressEmitter = createDeploymentProgressEmitter();
   runtimeCooldownByHash = /* @__PURE__ */ new Map();
+  runtimeDetailsByHash = /* @__PURE__ */ new Map();
+  debugEnabled;
+  lastRuntimeReadyHash = null;
   constructor(props = {}) {
     this.props = props;
     this.state = defaultState(props);
+    this.debugEnabled = isDebugEnabled(props);
     this.client = createAlephBrowserClient({
       apiHost: props.apiHost,
       crnListUrl: props.crnListUrl,
@@ -1622,10 +2289,24 @@ var SponsorRelayController = class {
   getState() {
     return this.state;
   }
+  updateProps(props) {
+    this.props = { ...this.props, ...props };
+    this.debugEnabled = isDebugEnabled(this.props);
+  }
   emit() {
     const next = this.state;
     this.subscribers.forEach((subscriber) => subscriber(next));
   }
+  trace(message, data) {
+    if (!this.debugEnabled) {
+      return;
+    }
+    if (data === void 0) {
+      console.debug("[le-space/ui]", message);
+      return;
+    }
+    console.debug("[le-space/ui]", message, data);
+  }
   patch(patch) {
     this.state = {
       ...this.state,
@@ -1642,6 +2323,14 @@ var SponsorRelayController = class {
       ...event,
       timestamp: Date.now()
     };
+    this.trace(`progress:${nextEvent.stage}`, {
+      label: nextEvent.label,
+      progress: nextEvent.progress,
+      status: nextEvent.status,
+      itemHash: nextEvent.itemHash ?? null,
+      detail: nextEvent.detail ?? null,
+      error: nextEvent.error ?? null
+    });
     this.patch({
       deploymentProgress: nextEvent,
       statusText: event.error ?? event.detail ?? event.label,
@@ -1660,6 +2349,9 @@ var SponsorRelayController = class {
     if (!latest) {
       return;
     }
+    const currentProgress = this.state.deploymentProgress;
+    const currentProgressIsForLatestHash = currentProgress.itemHash === itemHash || currentProgress.itemHash == null && currentProgress.stage !== "idle" && currentProgress.stage !== "error";
+    const keepTerminalSuccess = this.lastRuntimeReadyHash === itemHash || currentProgressIsForLatestHash && currentProgress.stage === "completed" && currentProgress.status === "success";
     const status = latest.details.messageStatus;
     if (status === "rejected") {
       this.emitProgress({
@@ -1674,6 +2366,14 @@ var SponsorRelayController = class {
       return;
     }
     if (status !== "processed") {
+      if (keepTerminalSuccess) {
+        this.trace("progress:retain-completed", {
+          reason: "latest refresh still reports non-processed status",
+          itemHash,
+          status
+        });
+        return;
+      }
       const submittedAtMs = instanceTimestampMs(latest.instance);
       const pendingTooLong = submittedAtMs != null && Date.now() - submittedAtMs >= DEPLOYMENT_PENDING_WARNING_MS;
       this.emitProgress({
@@ -1687,6 +2387,13 @@ var SponsorRelayController = class {
       return;
     }
     if (!hasUsableRuntime(latest.details)) {
+      if (keepTerminalSuccess) {
+        this.trace("progress:retain-completed", {
+          reason: "latest refresh lacks runtime details after completed state",
+          itemHash
+        });
+        return;
+      }
       this.emitProgress({
         stage: "deployment-confirmed",
         label: "Waiting for runtime",
@@ -1733,8 +2440,42 @@ var SponsorRelayController = class {
       Date.now() + STALE_INSTANCE_ALLOCATION_COOLDOWN_MS
     );
   }
+  rememberRuntimeDetails(itemHash, details) {
+    if (!hasUsableRuntime(details)) {
+      return;
+    }
+    this.runtimeDetailsByHash.set(itemHash, {
+      ...details,
+      mappedPorts: [...details.mappedPorts]
+    });
+  }
+  mergeRememberedRuntimeDetails(itemHash, details) {
+    const remembered = this.runtimeDetailsByHash.get(itemHash);
+    if (!remembered) {
+      return details;
+    }
+    if (details.messageStatus === "processed" && hasUsableRuntime(details)) {
+      return details;
+    }
+    this.trace("runtime:retain-known-details", {
+      itemHash,
+      currentStatus: details.messageStatus,
+      rememberedStatus: remembered.messageStatus,
+      currentHasRuntime: hasUsableRuntime(details)
+    });
+    return {
+      ...details,
+      ...remembered,
+      error: details.error ?? remembered.error
+    };
+  }
   async init() {
+    this.trace("init:start", {
+      launcherMode: this.props.launcherMode ?? "floating",
+      manifestUrl: this.state.manifestUrl
+    });
     this.stopWalletWatch = watchWallet(() => {
+      this.trace("wallet:changed");
       void this.refreshWalletDerivedState();
     });
     await this.refresh();
@@ -1746,6 +2487,7 @@ var SponsorRelayController = class {
     }, RELAY_PING_INTERVAL_MS);
     await this.refreshRelayPing();
     this.patch({ ready: true });
+    this.trace("init:ready");
   }
   destroy() {
     if (this.refreshTimer) clearInterval(this.refreshTimer);
@@ -1846,6 +2588,11 @@ var SponsorRelayController = class {
     }
   }
   async refresh() {
+    this.trace("refresh:start", {
+      wallet: this.state.wallet.address,
+      manifestUrl: this.state.manifestUrl,
+      showInstances: this.state.showInstances
+    });
     this.patch({
       busy: { refreshing: true },
       errorText: null,
@@ -1871,29 +2618,58 @@ var SponsorRelayController = class {
         balance = nextBalance;
         instances = await Promise.all(
           rawInstances.map(async (instance) => {
-            const details = this.canSkipRuntimeRefresh(instance) ? {
-              messageStatus: String(
-                instance.status ?? (instance.confirmed ? "processed" : "pending")
-              ).toLowerCase(),
-              allocationSource: null,
-              crnUrl: null,
-              hostIpv4: null,
-              ipv6: null,
-              vmIpv4: null,
-              webUrl: null,
-              sshCommand: null,
-              mappedPorts: [],
-              execution: null,
-              error: null
+            const inspected = this.canSkipRuntimeRefresh(instance) ? {
+              details: {
+                messageStatus: String(
+                  instance.status ?? (instance.confirmed ? "processed" : "pending")
+                ).toLowerCase(),
+                allocationSource: null,
+                crnUrl: null,
+                hostIpv4: null,
+                ipv6: null,
+                vmIpv4: null,
+                webUrl: null,
+                sshCommand: null,
+                mappedPorts: [],
+                execution: null,
+                error: null
+              },
+              lookup: {
+                allocationFound: false,
+                allocationSource: null,
+                crnUrl: null,
+                webUrl: null,
+                executionPayloadFound: false,
+                executionLookupBlocked: false,
+                executionLookupRequestUrl: null,
+                executionLookupVersion: null
+              }
             } : await inspectInstanceRuntime({
               client: this.client,
               instance,
               crns
             });
-            this.noteRuntimeRefreshResult(instance, details);
+            const details = inspected.details;
+            const mergedDetails = this.mergeRememberedRuntimeDetails(
+              instance.item_hash,
+              details
+            );
+            if (this.debugEnabled && instance.item_hash === this.state.lastDeploymentHash) {
+              this.trace("runtime:inspect-result", {
+                itemHash: instance.item_hash,
+                messageStatus: details.messageStatus,
+                hostIpv4: details.hostIpv4,
+                vmIpv4: details.vmIpv4,
+                mappedPorts: details.mappedPorts,
+                error: details.error,
+                lookup: inspected.lookup
+              });
+            }
+            this.rememberRuntimeDetails(instance.item_hash, mergedDetails);
+            this.noteRuntimeRefreshResult(instance, mergedDetails);
             return {
               instance,
-              details
+              details: mergedDetails
             };
           })
         );
@@ -1930,9 +2706,15 @@ var SponsorRelayController = class {
         busy: { refreshing: false },
         statusText: "Relay sponsor data ready"
       });
+      this.trace("refresh:success", {
+        manifestValid: manifestState.valid,
+        rootfsVerified,
+        instances: instances.length
+      });
       this.recomputePricingSummary();
       this.syncLatestDeploymentProgress(instances);
     } catch (error) {
+      this.trace("refresh:error", error);
       this.patch({
         busy: { refreshing: false },
         errorText: error instanceof Error ? error.message : String(error),
@@ -1943,8 +2725,17 @@ var SponsorRelayController = class {
   async refreshRelayPing() {
     const relayPing = await pingPeer(this.props.libp2p);
     this.patch({ relayPing });
+    this.trace("libp2p:relay-ping", relayPing);
   }
   async deploy() {
+    this.trace("deploy:start", {
+      wallet: this.state.wallet.address,
+      instanceName: this.state.instanceName,
+      tierId: this.state.tierId,
+      selectedCrn: this.state.selectedCrn?.name ?? null,
+      manifestRootfsItemHash: this.state.manifest?.rootfsItemHash ?? null,
+      requiredPortForwards: this.state.manifest?.requiredPortForwards ?? []
+    });
     if (!this.state.wallet.address) {
       this.patch({ errorText: "Connect MetaMask before deploying." });
       return;
@@ -2006,11 +2797,88 @@ var SponsorRelayController = class {
         }
       });
       this.patch({
-        busy: { deploying: false },
         statusText: `Deployment submitted: ${result.itemHash}`,
         lastDeploymentHash: result.itemHash
       });
-      if (result.status === "processed" && this.state.selectedCrn?.address) {
+      this.trace("deploy:broadcasted", result);
+      this.lastRuntimeReadyHash = null;
+      const inspection = await waitForDeploymentResult2(result.itemHash, {
+        rootfsRef: this.state.manifest.rootfsItemHash,
+        apiHost: this.client.apiHost,
+        fetch: (url, init) => fetch(url, init),
+        attempts: UI_DEPLOY_WAIT_ATTEMPTS,
+        delayMs: UI_DEPLOY_WAIT_DELAY_MS,
+        onAttempt: (inspectionResult) => {
+          if (inspectionResult.status === "processed") {
+            this.emitProgress({
+              stage: "deployment-confirmed",
+              label: "Deployment accepted by Aleph",
+              progress: 82,
+              status: "success",
+              itemHash: result.itemHash,
+              detail: "Aleph processed the instance message."
+            });
+            return;
+          }
+          if (inspectionResult.status === "rejected") {
+            this.emitProgress({
+              stage: "deployment-rejected",
+              label: "Deployment rejected",
+              progress: 100,
+              status: "error",
+              itemHash: result.itemHash,
+              detail: inspectionResult.rejectionReason ?? "Aleph rejected the deployment.",
+              error: inspectionResult.rejectionReason ?? "Aleph rejected the deployment."
+            });
+            return;
+          }
+          this.emitProgress({
+            stage: "waiting-for-aleph",
+            label: "Waiting for Aleph",
+            progress: 76,
+            status: "info",
+            itemHash: result.itemHash,
+            detail: "Deployment submitted. Waiting for Aleph to process the instance message."
+          });
+        }
+      });
+      if (inspection.status !== "processed") {
+        throw new Error(
+          inspection.rejectionReason ?? `Deployment ${result.itemHash} stayed ${inspection.status} on Aleph.`
+        );
+      }
+      this.trace("deploy:aleph-processed", inspection);
+      if ((this.state.manifest.requiredPortForwards?.length ?? 0) > 0) {
+        this.emitProgress({
+          stage: "refreshing-instances",
+          label: "Publishing port forwards",
+          progress: 86,
+          status: "info",
+          itemHash: result.itemHash,
+          detail: "Publishing the required Aleph port-forward aggregate from the manifest."
+        });
+        await ensureInstancePortForwards({
+          sender: this.state.wallet.address,
+          instanceItemHash: result.itemHash,
+          manifest: toSharedRootfsManifest(this.state.manifest),
+          signer: personalSign,
+          hasher: sha256Hex,
+          fetch: (url, init) => fetch(url, init),
+          apiHost: this.client.apiHost,
+          sync: true
+        });
+        this.trace("deploy:port-forwards-published", {
+          itemHash: result.itemHash,
+          requiredPortForwards: this.state.manifest.requiredPortForwards
+        });
+      }
+      if (this.state.selectedCrn?.address) {
+        this.trace("deploy:notifying-crn", {
+          itemHash: result.itemHash,
+          crnName: this.state.selectedCrn.name,
+          crnHash: this.state.selectedCrn.hash,
+          crnUrl: this.state.selectedCrn.address
+        });
         await notifyCrnAllocationWithRetry({
           crnUrl: this.state.selectedCrn.address,
           itemHash: result.itemHash,
@@ -2020,16 +2888,78 @@ var SponsorRelayController = class {
           }
         });
       }
+      this.emitProgress({
+        stage: "deployment-confirmed",
+        label: "Waiting for runtime",
+        progress: 90,
+        status: "warning",
+        itemHash: result.itemHash,
+        detail: "Aleph accepted the deployment. Waiting for runtime networking and mapped ports."
+      });
+      const runtime = await waitForVmRuntime({
+        itemHash: result.itemHash,
+        fetch: (url, init) => fetch(url, init),
+        crnHash: this.state.selectedCrn?.hash,
+        crns: this.state.crns,
+        crnListUrl: this.props.crnListUrl,
+        attempts: UI_RUNTIME_WAIT_ATTEMPTS,
+        delayMs: UI_RUNTIME_WAIT_DELAY_MS,
+        onAttempt: (runtime2) => {
+          if (runtime2.hostIpv4 && Object.keys(runtime2.mappedPorts ?? {}).length > 0) {
+            this.emitProgress({
+              stage: "completed",
+              label: "Runtime ready",
+              progress: 100,
+              status: "success",
+              itemHash: result.itemHash,
+              detail: "Runtime networking and mapped ports are now available."
+            });
+            return;
+          }
+          this.emitProgress({
+            stage: "deployment-confirmed",
+            label: "Waiting for runtime",
+            progress: 90,
+            status: "warning",
+            itemHash: result.itemHash,
+            detail: runtime2.diagnostics?.reason ?? "Waiting for CRN runtime networking and mapped ports."
+          });
+        }
+      });
+      if (!runtime.hostIpv4 || Object.keys(runtime.mappedPorts ?? {}).length === 0) {
+        throw new Error(
+          runtime.diagnostics?.reason ?? "Deployment was processed, but runtime networking never exposed mapped ports."
+        );
+      }
+      this.trace("deploy:runtime-ready", runtime);
+      this.lastRuntimeReadyHash = result.itemHash;
+      this.rememberRuntimeDetails(result.itemHash, {
+        messageStatus: "processed",
+        allocationSource: runtime.allocation?.source ?? null,
+        crnUrl: runtime.allocation?.crnUrl ?? runtime.execution?.crnUrl ?? null,
+        hostIpv4: runtime.hostIpv4 ?? null,
+        ipv6: runtime.ipv6 ?? null,
+        vmIpv4: runtime.execution?.networking?.ipv4_ip ?? null,
+        webUrl: runtime.webAccessUrl ?? runtime.proxyUrl ?? runtime.execution?.networking?.proxy_url ?? null,
+        sshCommand: runtime.sshCommand ?? null,
+        mappedPorts: runtime.execution != null ? mappedPorts(runtime.execution) : runtimeMappedPorts(runtime.mappedPorts),
+        execution: runtime.execution ?? null,
+        error: null
+      });
+      this.patch({
+        busy: { deploying: false }
+      });
       this.emitProgress({
         stage: "refreshing-instances",
         label: "Refreshing instances",
-        progress: 92,
+        progress: 96,
         status: "info",
         itemHash: result.itemHash,
         detail: "Reloading deployments and runtime state."
       });
       await this.refresh();
     } catch (error) {
+      this.trace("deploy:error", error);
       this.patch({
         busy: { deploying: false },
         errorText: error instanceof Error ? error.message : String(error),
@@ -2045,6 +2975,7 @@ var SponsorRelayController = class {
     }
   }
   async deleteInstance(instanceHash) {
+    this.trace("delete:start", { instanceHash });
     if (!this.state.wallet.address) {
       this.patch({ errorText: "Connect MetaMask before deleting instances." });
       return;
@@ -2092,6 +3023,7 @@ var SponsorRelayController = class {
         detail: "Reloading current deployments."
       });
       await this.refresh();
+      this.trace("delete:submitted", { instanceHash });
       this.emitProgress({
         stage: "completed",
         label: "Delete completed",
@@ -2102,6 +3034,7 @@ var SponsorRelayController = class {
         error: null
       });
     } catch (error) {
+      this.trace("delete:error", error);
       this.patch({
         busy: { deletingInstanceHash: null },
         errorText: error instanceof Error ? error.message : String(error),
@@ -2137,6 +3070,7 @@ export {
   formatNumber,
   getEthereumProvider,
   joinMappedPorts,
+  joinRequiredPortForwards,
   personalSign,
   resolveManifestSource,
   shortHash,