@le-space/ui 0.3.26 → 0.3.28

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@le-space/ui",
-  "version": "0.3.26",
+  "version": "0.3.28",
   "description": "Floating Aleph sponsor relay UI components for Svelte and React.",
   "license": "MIT",
   "type": "module",
@@ -36,8 +36,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@le-space/browser": "0.3.26",
-    "@le-space/core": "0.3.26",
+    "@le-space/browser": "0.3.28",
+    "@le-space/core": "0.3.28",
     "viem": "^2.38.5"
   },
   "peerDependencies": {

package/react/index.js

@@ -28,7 +28,7 @@ var RECENT_INSTANCE_RUNTIME_GRACE_MS = 10 * 60 * 1e3;
 var DEPLOYMENT_PENDING_WARNING_MS = 3 * 60 * 1e3;
 
 // src/shared/package-version.ts
-var UI_PACKAGE_VERSION = "0.3.26";
+var UI_PACKAGE_VERSION = "0.3.28";
 
 // src/shared/format.ts
 function shortHash(value, head = 8, tail = 6) {
@@ -1237,16 +1237,6 @@ function normalizeBroadcastStatus(httpStatus, responseStatus) {
   if (httpStatus === 202) return "pending";
   return normalizeMessageStatus2(responseStatus);
 }
-function isInvalidMessageFormatResponse2(response, payload) {
-  if (response.status !== 422) return false;
-  const details = payload?.details;
-  if (typeof details === "string" && details.includes("InvalidMessageFormat")) return true;
-  if (details && typeof details === "object") {
-    const detailMessage = details.message;
-    if (typeof detailMessage === "string" && detailMessage.includes("InvalidMessageFormat")) return true;
-  }
-  return false;
-}
 function isRetryableBroadcastFailure(response, payload) {
   if (response.status >= 500) return true;
   const publicationStatus = payload?.publication_status?.status;
@@ -1268,25 +1258,22 @@ async function postBroadcastPayload2(body, options) {
   };
 }
 async function broadcastAlephMessage2(message, options) {
-  const attempts = [
-    { sync: options.sync ?? false, message },
-    { ...message, sync: options.sync ?? false },
-    { ...message }
-  ];
-  for (let index = 0; index < attempts.length; index += 1) {
-    const result = await postBroadcastPayload2(attempts[index], {
+  const requestBody = { sync: options.sync ?? false, message };
+  const maxAttempts = 3;
+  for (let index = 0; index < maxAttempts; index += 1) {
+    const result = await postBroadcastPayload2(requestBody, {
       apiHost: options.apiHost,
       fetch: options.fetch
     });
     if (result.httpStatus === 202 || normalizeBroadcastStatus(result.httpStatus, result.response?.message_status) !== "unknown" || result.httpStatus >= 200 && result.httpStatus < 300) {
       return result;
     }
-    const canRetry = index < attempts.length - 1 && (isInvalidMessageFormatResponse2({ status: result.httpStatus }, result.response) || isRetryableBroadcastFailure({ status: result.httpStatus }, result.response));
+    const canRetry = index < maxAttempts - 1 && isRetryableBroadcastFailure({ status: result.httpStatus }, result.response);
     if (!canRetry) {
       throw new Error(`Broadcast failed: ${result.httpStatus} ${JSON.stringify(result.response ?? {})}`);
     }
   }
-  throw new Error("Broadcast failed: no compatible request format was accepted");
+  throw new Error("Broadcast failed: retry budget exhausted");
 }
 
 // ../core/src/forget.ts
@@ -1891,6 +1878,13 @@ async function waitForVmRuntime(args) {
 }
 
 // ../core/src/guest.ts
+function proxyHostnameFromUrl(value) {
+  try {
+    return value ? new URL(value).hostname : null;
+  } catch {
+    return null;
+  }
+}
 async function defaultHttpProbe(fetch2, url, timeoutMs = 1e4) {
   try {
     const controller = new AbortController();
@@ -2132,6 +2126,59 @@ async function fetchUcGoPeerMetadata(args) {
     `Relay metadata did not become ready after ${attempts} attempts: ${lastError ? lastError : typeof lastPayload === "string" ? lastPayload : JSON.stringify(lastPayload ?? {})}`
   );
 }
+async function verifyUcGoPeerReachability(args) {
+  const checks = {};
+  const mappedPorts2 = args.mappedPorts ?? {};
+  const hostIpv4 = args.hostIpv4;
+  const skippedInternalPorts = new Set(
+    (args.skipInternalPorts ?? ["80"]).map((value) => String(value))
+  );
+  const httpProbe = args.httpProbe ?? ((url, timeoutMs) => defaultHttpProbe(args.fetch, url, timeoutMs));
+  if (hostIpv4) {
+    for (const [internalPort, mapping] of Object.entries(mappedPorts2)) {
+      if (skippedInternalPorts.has(String(internalPort))) continue;
+      if (mapping?.tcp === true && mapping?.host) {
+        checks[`tcp:${internalPort}`] = {
+          host: hostIpv4,
+          port: mapping.host,
+          ...await args.tcpProbe(
+            hostIpv4,
+            mapping.host,
+            Number(args.tcpTimeoutMs ?? 5e3)
+          )
+        };
+      } else if (mapping?.udp === true && mapping?.host) {
+        checks[`udp:${internalPort}`] = {
+          host: hostIpv4,
+          port: mapping.host,
+          ok: null,
+          note: "UDP mapping published; CI does not perform an application-level UDP handshake probe."
+        };
+      }
+    }
+  }
+  if (args.proxyUrl && args.verifyProxyHttp !== false) {
+    checks["https:proxy"] = await httpProbe(
+      args.proxyUrl,
+      Number(args.httpTimeoutMs ?? 1e4)
+    );
+  }
+  const proxyHostname = proxyHostnameFromUrl(args.proxyUrl);
+  if (proxyHostname) {
+    checks["tcp:proxy-443"] = await args.tcpProbe(
+      proxyHostname,
+      443,
+      Number(args.tcpTimeoutMs ?? 5e3)
+    );
+  }
+  const failedChecks = Object.entries(checks).filter(
+    ([, value]) => value?.ok === false
+  );
+  return {
+    ok: failedChecks.length === 0,
+    checks
+  };
+}
 
 // ../aleph-bootstrap/src/index.ts
 import { recoverMessageAddress } from "viem";
@@ -3232,6 +3279,8 @@ var UI_DEPLOY_WAIT_ATTEMPTS = 60;
 var UI_DEPLOY_WAIT_DELAY_MS = 5e3;
 var UI_RUNTIME_WAIT_ATTEMPTS = 40;
 var UI_RUNTIME_WAIT_DELAY_MS = 5e3;
+var UI_REACHABILITY_VERIFY_ATTEMPTS = 25;
+var UI_REACHABILITY_VERIFY_DELAY_MS = 3e3;
 function hasUsableRuntime(details) {
   return Boolean(details.hostIpv4) || Boolean(details.vmIpv4) || details.mappedPorts.length > 0 || Boolean(details.webUrl) || Boolean(details.execution);
 }
@@ -3338,15 +3387,16 @@ var SponsorRelayController = class {
     this.progressEmitter.emit(nextEvent);
   }
   async configureRelayBootstrapRegistration(args) {
+    let runtime = args.runtime;
     const profile = relayProfileForManifest(this.state.manifest);
     if (!profile) return;
     if (!this.state.wallet.address) {
       throw new Error("A connected wallet is required to register relay bootstrap addresses.");
     }
-    if (!args.runtime.hostIpv4) {
+    if (!runtime.hostIpv4) {
       throw new Error("Relay runtime did not expose a host IPv4 address.");
     }
-    const mappedPorts2 = args.runtime.mappedPorts ?? {};
+    let mappedPorts2 = runtime.mappedPorts ?? {};
     const setupPort = mappedPorts2["80"]?.host ?? null;
     if (!setupPort) {
       throw new Error("Relay runtime did not expose the temporary setup endpoint.");
@@ -3361,7 +3411,7 @@ var SponsorRelayController = class {
         detail: "Waiting for the guest setup endpoint before collecting relay metadata."
       });
       const setupHealth = await waitForSetupEndpoint({
-        hostIpv4: args.runtime.hostIpv4,
+        hostIpv4: runtime.hostIpv4,
         setupPort,
         fetch: (url, init) => fetch(url, init),
         attempts: 15,
@@ -3387,12 +3437,12 @@ var SponsorRelayController = class {
         throw new Error("OrbitDB relay runtime is missing required mapped TCP/WS ports.");
       }
       const configureResult = await configureOrbitdbRelaySetup2({
-        hostIpv4: args.runtime.hostIpv4,
-        publicIpv6: args.runtime.ipv6,
+        hostIpv4: runtime.hostIpv4,
+        publicIpv6: runtime.ipv6,
         setupPort,
         tcpPort,
         wsPort,
-        proxyUrl: args.runtime.proxyUrl ?? void 0,
+        proxyUrl: runtime.proxyUrl ?? void 0,
         metricsPort: mappedPorts2["9090"]?.host ?? null,
         metricsHttpsPort: mappedPorts2["443"]?.host ?? null,
         webrtcPort: mappedPorts2["9093"]?.host ?? null,
@@ -3409,6 +3459,51 @@ var SponsorRelayController = class {
       if (!args.deploymentToken) {
         throw new Error("Missing deployment token for Aleph bootstrap config handoff.");
       }
+      if (runtime.proxyUrl && runtime.webAccess?.active !== true) {
+        this.emitProgress({
+          stage: "deployment-confirmed",
+          label: "Waiting for HTTPS route",
+          progress: 93,
+          status: "warning",
+          itemHash: args.itemHash,
+          detail: "The relay received a 2n6 hostname, but it is not active yet. Waiting before handing HTTPS config to the guest."
+        });
+        let latestRuntime = runtime;
+        for (let attempt = 0; attempt < UI_RUNTIME_WAIT_ATTEMPTS; attempt += 1) {
+          if (latestRuntime.webAccess?.active === true) {
+            break;
+          }
+          await new Promise(
+            (resolve) => globalThis.setTimeout(resolve, UI_RUNTIME_WAIT_DELAY_MS)
+          );
+          latestRuntime = await fetchVmRuntime({
+            itemHash: args.itemHash,
+            fetch: (url, init) => fetch(url, init),
+            crnHash: runtime.selectedCrn?.hash ?? runtime.allocation?.crnHash ?? void 0,
+            crns: this.state.crns,
+            crnListUrl: this.props.crnListUrl
+          }).catch(() => latestRuntime);
+          this.trace("deploy:bootstrap-proxy-activation", {
+            itemHash: args.itemHash,
+            attempt: attempt + 1,
+            attempts: UI_RUNTIME_WAIT_ATTEMPTS,
+            active: latestRuntime.webAccess?.active === true,
+            proxyUrl: latestRuntime.proxyUrl ?? null
+          });
+        }
+        runtime = latestRuntime;
+        mappedPorts2 = runtime.mappedPorts ?? mappedPorts2;
+        if (runtime.proxyUrl && runtime.webAccess?.active !== true) {
+          throw new Error(
+            "Aleph reserved a 2n6 proxy URL, but it never became active in time. Aborting guest HTTPS configuration to avoid a broken Caddy setup."
+          );
+        }
+      }
+      if (!runtime.hostIpv4) {
+        throw new Error("Relay runtime lost its host IPv4 address while waiting for HTTPS activation.");
+      }
+      const runtimeHostIpv4 = runtime.hostIpv4;
+      const activeProxyUrl = runtime.webAccess?.active === true ? runtime.proxyUrl ?? null : null;
       this.emitProgress({
         stage: "deployment-confirmed",
         label: "Publishing relay config",
@@ -3426,9 +3521,9 @@ var SponsorRelayController = class {
         expiresAt: new Date(Date.now() + 30 * 6e4).toISOString(),
         status: "pending",
         runtime: {
-          publicIpv4: args.runtime.hostIpv4,
-          publicIpv6: args.runtime.ipv6 ?? null,
-          proxyUrl: args.runtime.proxyUrl ?? null,
+          publicIpv4: runtimeHostIpv4,
+          publicIpv6: runtime.ipv6 ?? null,
+          proxyUrl: activeProxyUrl,
           mappedPorts: mappedPorts2
         },
         bootstrap: {
@@ -3494,7 +3589,7 @@ var SponsorRelayController = class {
       detail: "Waiting for the relay to report its final public multiaddrs."
     });
     const relayMetadata = await fetchRelayMetadataForRuntime({
-      runtime: args.runtime,
+      runtime,
       fetch: (url, init) => fetch(url, init),
       preferSecureMetadata: profile === "uc-go-peer",
       attempts: 80,
@@ -3527,6 +3622,55 @@ var SponsorRelayController = class {
     if (!relayMetadata) {
       throw new Error("Relay metadata did not include a peer ID and public multiaddrs.");
     }
+    if (profile === "uc-go-peer" && runtime.proxyUrl) {
+      this.emitProgress({
+        stage: "publishing-bootstrap",
+        label: "Verifying reachability",
+        progress: 96,
+        status: "info",
+        itemHash: args.itemHash,
+        detail: "Checking that the secure relay endpoint is reachable before trusting the deployment as ready."
+      });
+      const verificationUrl = (() => {
+        try {
+          return new URL("/bootstrap/metadata", runtime.proxyUrl).toString();
+        } catch {
+          return runtime.proxyUrl ?? "";
+        }
+      })();
+      let verificationResult = null;
+      for (let attempt = 0; attempt < UI_REACHABILITY_VERIFY_ATTEMPTS; attempt += 1) {
+        verificationResult = await verifyUcGoPeerReachability({
+          proxyUrl: verificationUrl,
+          verifyProxyHttp: true,
+          fetch: (url, init) => fetch(url, init),
+          tcpProbe: async () => ({ ok: null })
+        });
+        this.trace("deploy:reachability-verification-attempt", {
+          itemHash: args.itemHash,
+          attempt: attempt + 1,
+          attempts: UI_REACHABILITY_VERIFY_ATTEMPTS,
+          verificationUrl,
+          ok: verificationResult.ok,
+          checks: verificationResult.checks
+        });
+        const proxyHttpCheck2 = verificationResult.checks["https:proxy"];
+        if (verificationResult.ok && proxyHttpCheck2?.ok === true) {
+          break;
+        }
+        if (attempt < UI_REACHABILITY_VERIFY_ATTEMPTS - 1) {
+          await new Promise(
+            (resolve) => globalThis.setTimeout(resolve, UI_REACHABILITY_VERIFY_DELAY_MS)
+          );
+        }
+      }
+      const proxyHttpCheck = verificationResult?.checks["https:proxy"];
+      if (!verificationResult?.ok || proxyHttpCheck?.ok !== true) {
+        throw new Error(
+          proxyHttpCheck?.error ? `Secure relay endpoint did not become reachable in time: ${proxyHttpCheck.error}` : "Secure relay endpoint did not become reachable in time."
+        );
+      }
+    }
     const { peerId } = relayMetadata;
     const registrationId = createRelayBootstrapRegistrationId(
       profile,

package/shared/index.d.ts

@@ -290,7 +290,7 @@ declare const STALE_INSTANCE_ALLOCATION_COOLDOWN_MS: number;
 declare const RECENT_INSTANCE_RUNTIME_GRACE_MS: number;
 declare const DEPLOYMENT_PENDING_WARNING_MS: number;
 
-declare const UI_PACKAGE_VERSION = "0.3.26";
+declare const UI_PACKAGE_VERSION = "0.3.28";
 
 interface RootfsRequiredPortForward {
     port: number;

package/shared/index.js

@@ -27,7 +27,7 @@ var RECENT_INSTANCE_RUNTIME_GRACE_MS = 10 * 60 * 1e3;
 var DEPLOYMENT_PENDING_WARNING_MS = 3 * 60 * 1e3;
 
 // src/shared/package-version.ts
-var UI_PACKAGE_VERSION = "0.3.26";
+var UI_PACKAGE_VERSION = "0.3.28";
 
 // src/shared/format.ts
 function shortHash(value, head = 8, tail = 6) {
@@ -1236,16 +1236,6 @@ function normalizeBroadcastStatus(httpStatus, responseStatus) {
   if (httpStatus === 202) return "pending";
   return normalizeMessageStatus2(responseStatus);
 }
-function isInvalidMessageFormatResponse2(response, payload) {
-  if (response.status !== 422) return false;
-  const details = payload?.details;
-  if (typeof details === "string" && details.includes("InvalidMessageFormat")) return true;
-  if (details && typeof details === "object") {
-    const detailMessage = details.message;
-    if (typeof detailMessage === "string" && detailMessage.includes("InvalidMessageFormat")) return true;
-  }
-  return false;
-}
 function isRetryableBroadcastFailure(response, payload) {
   if (response.status >= 500) return true;
   const publicationStatus = payload?.publication_status?.status;
@@ -1267,25 +1257,22 @@ async function postBroadcastPayload2(body, options) {
   };
 }
 async function broadcastAlephMessage2(message, options) {
-  const attempts = [
-    { sync: options.sync ?? false, message },
-    { ...message, sync: options.sync ?? false },
-    { ...message }
-  ];
-  for (let index = 0; index < attempts.length; index += 1) {
-    const result = await postBroadcastPayload2(attempts[index], {
+  const requestBody = { sync: options.sync ?? false, message };
+  const maxAttempts = 3;
+  for (let index = 0; index < maxAttempts; index += 1) {
+    const result = await postBroadcastPayload2(requestBody, {
       apiHost: options.apiHost,
       fetch: options.fetch
     });
     if (result.httpStatus === 202 || normalizeBroadcastStatus(result.httpStatus, result.response?.message_status) !== "unknown" || result.httpStatus >= 200 && result.httpStatus < 300) {
       return result;
     }
-    const canRetry = index < attempts.length - 1 && (isInvalidMessageFormatResponse2({ status: result.httpStatus }, result.response) || isRetryableBroadcastFailure({ status: result.httpStatus }, result.response));
+    const canRetry = index < maxAttempts - 1 && isRetryableBroadcastFailure({ status: result.httpStatus }, result.response);
     if (!canRetry) {
       throw new Error(`Broadcast failed: ${result.httpStatus} ${JSON.stringify(result.response ?? {})}`);
     }
   }
-  throw new Error("Broadcast failed: no compatible request format was accepted");
+  throw new Error("Broadcast failed: retry budget exhausted");
 }
 
 // ../core/src/forget.ts
@@ -1890,6 +1877,13 @@ async function waitForVmRuntime(args) {
 }
 
 // ../core/src/guest.ts
+function proxyHostnameFromUrl(value) {
+  try {
+    return value ? new URL(value).hostname : null;
+  } catch {
+    return null;
+  }
+}
 async function defaultHttpProbe(fetch2, url, timeoutMs = 1e4) {
   try {
     const controller = new AbortController();
@@ -2131,6 +2125,59 @@ async function fetchUcGoPeerMetadata(args) {
     `Relay metadata did not become ready after ${attempts} attempts: ${lastError ? lastError : typeof lastPayload === "string" ? lastPayload : JSON.stringify(lastPayload ?? {})}`
   );
 }
+async function verifyUcGoPeerReachability(args) {
+  const checks = {};
+  const mappedPorts2 = args.mappedPorts ?? {};
+  const hostIpv4 = args.hostIpv4;
+  const skippedInternalPorts = new Set(
+    (args.skipInternalPorts ?? ["80"]).map((value) => String(value))
+  );
+  const httpProbe = args.httpProbe ?? ((url, timeoutMs) => defaultHttpProbe(args.fetch, url, timeoutMs));
+  if (hostIpv4) {
+    for (const [internalPort, mapping] of Object.entries(mappedPorts2)) {
+      if (skippedInternalPorts.has(String(internalPort))) continue;
+      if (mapping?.tcp === true && mapping?.host) {
+        checks[`tcp:${internalPort}`] = {
+          host: hostIpv4,
+          port: mapping.host,
+          ...await args.tcpProbe(
+            hostIpv4,
+            mapping.host,
+            Number(args.tcpTimeoutMs ?? 5e3)
+          )
+        };
+      } else if (mapping?.udp === true && mapping?.host) {
+        checks[`udp:${internalPort}`] = {
+          host: hostIpv4,
+          port: mapping.host,
+          ok: null,
+          note: "UDP mapping published; CI does not perform an application-level UDP handshake probe."
+        };
+      }
+    }
+  }
+  if (args.proxyUrl && args.verifyProxyHttp !== false) {
+    checks["https:proxy"] = await httpProbe(
+      args.proxyUrl,
+      Number(args.httpTimeoutMs ?? 1e4)
+    );
+  }
+  const proxyHostname = proxyHostnameFromUrl(args.proxyUrl);
+  if (proxyHostname) {
+    checks["tcp:proxy-443"] = await args.tcpProbe(
+      proxyHostname,
+      443,
+      Number(args.tcpTimeoutMs ?? 5e3)
+    );
+  }
+  const failedChecks = Object.entries(checks).filter(
+    ([, value]) => value?.ok === false
+  );
+  return {
+    ok: failedChecks.length === 0,
+    checks
+  };
+}
 
 // ../aleph-bootstrap/src/index.ts
 import { recoverMessageAddress } from "viem";
@@ -3231,6 +3278,8 @@ var UI_DEPLOY_WAIT_ATTEMPTS = 60;
 var UI_DEPLOY_WAIT_DELAY_MS = 5e3;
 var UI_RUNTIME_WAIT_ATTEMPTS = 40;
 var UI_RUNTIME_WAIT_DELAY_MS = 5e3;
+var UI_REACHABILITY_VERIFY_ATTEMPTS = 25;
+var UI_REACHABILITY_VERIFY_DELAY_MS = 3e3;
 function hasUsableRuntime(details) {
   return Boolean(details.hostIpv4) || Boolean(details.vmIpv4) || details.mappedPorts.length > 0 || Boolean(details.webUrl) || Boolean(details.execution);
 }
@@ -3337,15 +3386,16 @@ var SponsorRelayController = class {
     this.progressEmitter.emit(nextEvent);
   }
   async configureRelayBootstrapRegistration(args) {
+    let runtime = args.runtime;
     const profile = relayProfileForManifest(this.state.manifest);
     if (!profile) return;
     if (!this.state.wallet.address) {
       throw new Error("A connected wallet is required to register relay bootstrap addresses.");
     }
-    if (!args.runtime.hostIpv4) {
+    if (!runtime.hostIpv4) {
       throw new Error("Relay runtime did not expose a host IPv4 address.");
     }
-    const mappedPorts2 = args.runtime.mappedPorts ?? {};
+    let mappedPorts2 = runtime.mappedPorts ?? {};
     const setupPort = mappedPorts2["80"]?.host ?? null;
     if (!setupPort) {
       throw new Error("Relay runtime did not expose the temporary setup endpoint.");
@@ -3360,7 +3410,7 @@ var SponsorRelayController = class {
         detail: "Waiting for the guest setup endpoint before collecting relay metadata."
       });
       const setupHealth = await waitForSetupEndpoint({
-        hostIpv4: args.runtime.hostIpv4,
+        hostIpv4: runtime.hostIpv4,
         setupPort,
         fetch: (url, init) => fetch(url, init),
         attempts: 15,
@@ -3386,12 +3436,12 @@ var SponsorRelayController = class {
         throw new Error("OrbitDB relay runtime is missing required mapped TCP/WS ports.");
       }
       const configureResult = await configureOrbitdbRelaySetup2({
-        hostIpv4: args.runtime.hostIpv4,
-        publicIpv6: args.runtime.ipv6,
+        hostIpv4: runtime.hostIpv4,
+        publicIpv6: runtime.ipv6,
         setupPort,
         tcpPort,
         wsPort,
-        proxyUrl: args.runtime.proxyUrl ?? void 0,
+        proxyUrl: runtime.proxyUrl ?? void 0,
         metricsPort: mappedPorts2["9090"]?.host ?? null,
         metricsHttpsPort: mappedPorts2["443"]?.host ?? null,
         webrtcPort: mappedPorts2["9093"]?.host ?? null,
@@ -3408,6 +3458,51 @@ var SponsorRelayController = class {
       if (!args.deploymentToken) {
         throw new Error("Missing deployment token for Aleph bootstrap config handoff.");
       }
+      if (runtime.proxyUrl && runtime.webAccess?.active !== true) {
+        this.emitProgress({
+          stage: "deployment-confirmed",
+          label: "Waiting for HTTPS route",
+          progress: 93,
+          status: "warning",
+          itemHash: args.itemHash,
+          detail: "The relay received a 2n6 hostname, but it is not active yet. Waiting before handing HTTPS config to the guest."
+        });
+        let latestRuntime = runtime;
+        for (let attempt = 0; attempt < UI_RUNTIME_WAIT_ATTEMPTS; attempt += 1) {
+          if (latestRuntime.webAccess?.active === true) {
+            break;
+          }
+          await new Promise(
+            (resolve) => globalThis.setTimeout(resolve, UI_RUNTIME_WAIT_DELAY_MS)
+          );
+          latestRuntime = await fetchVmRuntime({
+            itemHash: args.itemHash,
+            fetch: (url, init) => fetch(url, init),
+            crnHash: runtime.selectedCrn?.hash ?? runtime.allocation?.crnHash ?? void 0,
+            crns: this.state.crns,
+            crnListUrl: this.props.crnListUrl
+          }).catch(() => latestRuntime);
+          this.trace("deploy:bootstrap-proxy-activation", {
+            itemHash: args.itemHash,
+            attempt: attempt + 1,
+            attempts: UI_RUNTIME_WAIT_ATTEMPTS,
+            active: latestRuntime.webAccess?.active === true,
+            proxyUrl: latestRuntime.proxyUrl ?? null
+          });
+        }
+        runtime = latestRuntime;
+        mappedPorts2 = runtime.mappedPorts ?? mappedPorts2;
+        if (runtime.proxyUrl && runtime.webAccess?.active !== true) {
+          throw new Error(
+            "Aleph reserved a 2n6 proxy URL, but it never became active in time. Aborting guest HTTPS configuration to avoid a broken Caddy setup."
+          );
+        }
+      }
+      if (!runtime.hostIpv4) {
+        throw new Error("Relay runtime lost its host IPv4 address while waiting for HTTPS activation.");
+      }
+      const runtimeHostIpv4 = runtime.hostIpv4;
+      const activeProxyUrl = runtime.webAccess?.active === true ? runtime.proxyUrl ?? null : null;
       this.emitProgress({
         stage: "deployment-confirmed",
         label: "Publishing relay config",
@@ -3425,9 +3520,9 @@ var SponsorRelayController = class {
         expiresAt: new Date(Date.now() + 30 * 6e4).toISOString(),
         status: "pending",
         runtime: {
-          publicIpv4: args.runtime.hostIpv4,
-          publicIpv6: args.runtime.ipv6 ?? null,
-          proxyUrl: args.runtime.proxyUrl ?? null,
+          publicIpv4: runtimeHostIpv4,
+          publicIpv6: runtime.ipv6 ?? null,
+          proxyUrl: activeProxyUrl,
           mappedPorts: mappedPorts2
         },
         bootstrap: {
@@ -3493,7 +3588,7 @@ var SponsorRelayController = class {
       detail: "Waiting for the relay to report its final public multiaddrs."
     });
     const relayMetadata = await fetchRelayMetadataForRuntime({
-      runtime: args.runtime,
+      runtime,
       fetch: (url, init) => fetch(url, init),
       preferSecureMetadata: profile === "uc-go-peer",
       attempts: 80,
@@ -3526,6 +3621,55 @@ var SponsorRelayController = class {
     if (!relayMetadata) {
       throw new Error("Relay metadata did not include a peer ID and public multiaddrs.");
     }
+    if (profile === "uc-go-peer" && runtime.proxyUrl) {
+      this.emitProgress({
+        stage: "publishing-bootstrap",
+        label: "Verifying reachability",
+        progress: 96,
+        status: "info",
+        itemHash: args.itemHash,
+        detail: "Checking that the secure relay endpoint is reachable before trusting the deployment as ready."
+      });
+      const verificationUrl = (() => {
+        try {
+          return new URL("/bootstrap/metadata", runtime.proxyUrl).toString();
+        } catch {
+          return runtime.proxyUrl ?? "";
+        }
+      })();
+      let verificationResult = null;
+      for (let attempt = 0; attempt < UI_REACHABILITY_VERIFY_ATTEMPTS; attempt += 1) {
+        verificationResult = await verifyUcGoPeerReachability({
+          proxyUrl: verificationUrl,
+          verifyProxyHttp: true,
+          fetch: (url, init) => fetch(url, init),
+          tcpProbe: async () => ({ ok: null })
+        });
+        this.trace("deploy:reachability-verification-attempt", {
+          itemHash: args.itemHash,
+          attempt: attempt + 1,
+          attempts: UI_REACHABILITY_VERIFY_ATTEMPTS,
+          verificationUrl,
+          ok: verificationResult.ok,
+          checks: verificationResult.checks
+        });
+        const proxyHttpCheck2 = verificationResult.checks["https:proxy"];
+        if (verificationResult.ok && proxyHttpCheck2?.ok === true) {
+          break;
+        }
+        if (attempt < UI_REACHABILITY_VERIFY_ATTEMPTS - 1) {
+          await new Promise(
+            (resolve) => globalThis.setTimeout(resolve, UI_REACHABILITY_VERIFY_DELAY_MS)
+          );
+        }
+      }
+      const proxyHttpCheck = verificationResult?.checks["https:proxy"];
+      if (!verificationResult?.ok || proxyHttpCheck?.ok !== true) {
+        throw new Error(
+          proxyHttpCheck?.error ? `Secure relay endpoint did not become reachable in time: ${proxyHttpCheck.error}` : "Secure relay endpoint did not become reachable in time."
+        );
+      }
+    }
     const { peerId } = relayMetadata;
     const registrationId = createRelayBootstrapRegistrationId(
       profile,