@le-space/ui 0.3.27 → 0.3.30

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@le-space/ui",
-  "version": "0.3.27",
+  "version": "0.3.30",
   "description": "Floating Aleph sponsor relay UI components for Svelte and React.",
   "license": "MIT",
   "type": "module",
@@ -36,8 +36,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@le-space/browser": "0.3.27",
-    "@le-space/core": "0.3.27",
+    "@le-space/browser": "0.3.30",
+    "@le-space/core": "0.3.30",
     "viem": "^2.38.5"
   },
   "peerDependencies": {

package/react/index.js

@@ -28,7 +28,7 @@ var RECENT_INSTANCE_RUNTIME_GRACE_MS = 10 * 60 * 1e3;
 var DEPLOYMENT_PENDING_WARNING_MS = 3 * 60 * 1e3;
 
 // src/shared/package-version.ts
-var UI_PACKAGE_VERSION = "0.3.27";
+var UI_PACKAGE_VERSION = "0.3.30";
 
 // src/shared/format.ts
 function shortHash(value, head = 8, tail = 6) {
@@ -1878,6 +1878,13 @@ async function waitForVmRuntime(args) {
 }
 
 // ../core/src/guest.ts
+function proxyHostnameFromUrl(value) {
+  try {
+    return value ? new URL(value).hostname : null;
+  } catch {
+    return null;
+  }
+}
 async function defaultHttpProbe(fetch2, url, timeoutMs = 1e4) {
   try {
     const controller = new AbortController();
@@ -2119,6 +2126,59 @@ async function fetchUcGoPeerMetadata(args) {
     `Relay metadata did not become ready after ${attempts} attempts: ${lastError ? lastError : typeof lastPayload === "string" ? lastPayload : JSON.stringify(lastPayload ?? {})}`
   );
 }
+async function verifyUcGoPeerReachability(args) {
+  const checks = {};
+  const mappedPorts2 = args.mappedPorts ?? {};
+  const hostIpv4 = args.hostIpv4;
+  const skippedInternalPorts = new Set(
+    (args.skipInternalPorts ?? ["80"]).map((value) => String(value))
+  );
+  const httpProbe = args.httpProbe ?? ((url, timeoutMs) => defaultHttpProbe(args.fetch, url, timeoutMs));
+  if (hostIpv4) {
+    for (const [internalPort, mapping] of Object.entries(mappedPorts2)) {
+      if (skippedInternalPorts.has(String(internalPort))) continue;
+      if (mapping?.tcp === true && mapping?.host) {
+        checks[`tcp:${internalPort}`] = {
+          host: hostIpv4,
+          port: mapping.host,
+          ...await args.tcpProbe(
+            hostIpv4,
+            mapping.host,
+            Number(args.tcpTimeoutMs ?? 5e3)
+          )
+        };
+      } else if (mapping?.udp === true && mapping?.host) {
+        checks[`udp:${internalPort}`] = {
+          host: hostIpv4,
+          port: mapping.host,
+          ok: null,
+          note: "UDP mapping published; CI does not perform an application-level UDP handshake probe."
+        };
+      }
+    }
+  }
+  if (args.proxyUrl && args.verifyProxyHttp !== false) {
+    checks["https:proxy"] = await httpProbe(
+      args.proxyUrl,
+      Number(args.httpTimeoutMs ?? 1e4)
+    );
+  }
+  const proxyHostname = proxyHostnameFromUrl(args.proxyUrl);
+  if (proxyHostname) {
+    checks["tcp:proxy-443"] = await args.tcpProbe(
+      proxyHostname,
+      443,
+      Number(args.tcpTimeoutMs ?? 5e3)
+    );
+  }
+  const failedChecks = Object.entries(checks).filter(
+    ([, value]) => value?.ok === false
+  );
+  return {
+    ok: failedChecks.length === 0,
+    checks
+  };
+}
 
 // ../aleph-bootstrap/src/index.ts
 import { recoverMessageAddress } from "viem";
@@ -3219,6 +3279,8 @@ var UI_DEPLOY_WAIT_ATTEMPTS = 60;
 var UI_DEPLOY_WAIT_DELAY_MS = 5e3;
 var UI_RUNTIME_WAIT_ATTEMPTS = 40;
 var UI_RUNTIME_WAIT_DELAY_MS = 5e3;
+var UI_REACHABILITY_VERIFY_ATTEMPTS = 25;
+var UI_REACHABILITY_VERIFY_DELAY_MS = 3e3;
 function hasUsableRuntime(details) {
   return Boolean(details.hostIpv4) || Boolean(details.vmIpv4) || details.mappedPorts.length > 0 || Boolean(details.webUrl) || Boolean(details.execution);
 }
@@ -3325,15 +3387,16 @@ var SponsorRelayController = class {
     this.progressEmitter.emit(nextEvent);
   }
   async configureRelayBootstrapRegistration(args) {
+    let runtime = args.runtime;
     const profile = relayProfileForManifest(this.state.manifest);
     if (!profile) return;
     if (!this.state.wallet.address) {
       throw new Error("A connected wallet is required to register relay bootstrap addresses.");
     }
-    if (!args.runtime.hostIpv4) {
+    if (!runtime.hostIpv4) {
       throw new Error("Relay runtime did not expose a host IPv4 address.");
     }
-    const mappedPorts2 = args.runtime.mappedPorts ?? {};
+    let mappedPorts2 = runtime.mappedPorts ?? {};
     const setupPort = mappedPorts2["80"]?.host ?? null;
     if (!setupPort) {
       throw new Error("Relay runtime did not expose the temporary setup endpoint.");
@@ -3348,7 +3411,7 @@ var SponsorRelayController = class {
         detail: "Waiting for the guest setup endpoint before collecting relay metadata."
       });
       const setupHealth = await waitForSetupEndpoint({
-        hostIpv4: args.runtime.hostIpv4,
+        hostIpv4: runtime.hostIpv4,
         setupPort,
         fetch: (url, init) => fetch(url, init),
         attempts: 15,
@@ -3374,12 +3437,12 @@ var SponsorRelayController = class {
         throw new Error("OrbitDB relay runtime is missing required mapped TCP/WS ports.");
       }
       const configureResult = await configureOrbitdbRelaySetup2({
-        hostIpv4: args.runtime.hostIpv4,
-        publicIpv6: args.runtime.ipv6,
+        hostIpv4: runtime.hostIpv4,
+        publicIpv6: runtime.ipv6,
         setupPort,
         tcpPort,
         wsPort,
-        proxyUrl: args.runtime.proxyUrl ?? void 0,
+        proxyUrl: runtime.proxyUrl ?? void 0,
         metricsPort: mappedPorts2["9090"]?.host ?? null,
         metricsHttpsPort: mappedPorts2["443"]?.host ?? null,
         webrtcPort: mappedPorts2["9093"]?.host ?? null,
@@ -3396,6 +3459,59 @@ var SponsorRelayController = class {
       if (!args.deploymentToken) {
         throw new Error("Missing deployment token for Aleph bootstrap config handoff.");
       }
+      if (runtime.proxyUrl && runtime.webAccess?.active !== true) {
+        this.emitProgress({
+          stage: "deployment-confirmed",
+          label: "Waiting for HTTPS route",
+          progress: 93,
+          status: "warning",
+          itemHash: args.itemHash,
+          detail: "The relay received a 2n6 hostname, but it is not active yet. Waiting before handing HTTPS config to the guest."
+        });
+        let latestRuntime = runtime;
+        for (let attempt = 0; attempt < UI_RUNTIME_WAIT_ATTEMPTS; attempt += 1) {
+          if (latestRuntime.webAccess?.active === true) {
+            break;
+          }
+          await new Promise(
+            (resolve) => globalThis.setTimeout(resolve, UI_RUNTIME_WAIT_DELAY_MS)
+          );
+          latestRuntime = await fetchVmRuntime({
+            itemHash: args.itemHash,
+            fetch: (url, init) => fetch(url, init),
+            crnHash: runtime.selectedCrn?.hash ?? runtime.allocation?.crnHash ?? void 0,
+            crns: this.state.crns,
+            crnListUrl: this.props.crnListUrl
+          }).catch(() => latestRuntime);
+          this.emitProgress({
+            stage: "deployment-confirmed",
+            label: "Waiting for HTTPS route",
+            progress: 93,
+            status: latestRuntime.webAccess?.active === true ? "info" : "warning",
+            itemHash: args.itemHash,
+            detail: `2n6 activation ${attempt + 1}/${UI_RUNTIME_WAIT_ATTEMPTS}: ${latestRuntime.webAccess?.active === true ? "active" : "still pending"} for ${latestRuntime.proxyUrl ?? runtime.proxyUrl ?? "reserved proxy URL"}.`
+          });
+          this.trace("deploy:bootstrap-proxy-activation", {
+            itemHash: args.itemHash,
+            attempt: attempt + 1,
+            attempts: UI_RUNTIME_WAIT_ATTEMPTS,
+            active: latestRuntime.webAccess?.active === true,
+            proxyUrl: latestRuntime.proxyUrl ?? null
+          });
+        }
+        runtime = latestRuntime;
+        mappedPorts2 = runtime.mappedPorts ?? mappedPorts2;
+        if (runtime.proxyUrl && runtime.webAccess?.active !== true) {
+          throw new Error(
+            "Aleph reserved a 2n6 proxy URL, but it never became active in time. Aborting guest HTTPS configuration to avoid a broken Caddy setup."
+          );
+        }
+      }
+      if (!runtime.hostIpv4) {
+        throw new Error("Relay runtime lost its host IPv4 address while waiting for HTTPS activation.");
+      }
+      const runtimeHostIpv4 = runtime.hostIpv4;
+      const activeProxyUrl = runtime.webAccess?.active === true ? runtime.proxyUrl ?? null : null;
       this.emitProgress({
         stage: "deployment-confirmed",
         label: "Publishing relay config",
@@ -3413,9 +3529,9 @@ var SponsorRelayController = class {
         expiresAt: new Date(Date.now() + 30 * 6e4).toISOString(),
         status: "pending",
         runtime: {
-          publicIpv4: args.runtime.hostIpv4,
-          publicIpv6: args.runtime.ipv6 ?? null,
-          proxyUrl: args.runtime.proxyUrl ?? null,
+          publicIpv4: runtimeHostIpv4,
+          publicIpv6: runtime.ipv6 ?? null,
+          proxyUrl: activeProxyUrl,
           mappedPorts: mappedPorts2
         },
         bootstrap: {
@@ -3481,7 +3597,7 @@ var SponsorRelayController = class {
       detail: "Waiting for the relay to report its final public multiaddrs."
     });
     const relayMetadata = await fetchRelayMetadataForRuntime({
-      runtime: args.runtime,
+      runtime,
       fetch: (url, init) => fetch(url, init),
       preferSecureMetadata: profile === "uc-go-peer",
       attempts: 80,
@@ -3514,6 +3630,55 @@ var SponsorRelayController = class {
     if (!relayMetadata) {
       throw new Error("Relay metadata did not include a peer ID and public multiaddrs.");
     }
+    if (profile === "uc-go-peer" && runtime.proxyUrl) {
+      this.emitProgress({
+        stage: "publishing-bootstrap",
+        label: "Verifying reachability",
+        progress: 96,
+        status: "info",
+        itemHash: args.itemHash,
+        detail: "Checking that the secure relay endpoint is reachable before trusting the deployment as ready."
+      });
+      const verificationUrl = (() => {
+        try {
+          return new URL("/bootstrap/metadata", runtime.proxyUrl).toString();
+        } catch {
+          return runtime.proxyUrl ?? "";
+        }
+      })();
+      let verificationResult = null;
+      for (let attempt = 0; attempt < UI_REACHABILITY_VERIFY_ATTEMPTS; attempt += 1) {
+        verificationResult = await verifyUcGoPeerReachability({
+          proxyUrl: verificationUrl,
+          verifyProxyHttp: true,
+          fetch: (url, init) => fetch(url, init),
+          tcpProbe: async () => ({ ok: null })
+        });
+        this.trace("deploy:reachability-verification-attempt", {
+          itemHash: args.itemHash,
+          attempt: attempt + 1,
+          attempts: UI_REACHABILITY_VERIFY_ATTEMPTS,
+          verificationUrl,
+          ok: verificationResult.ok,
+          checks: verificationResult.checks
+        });
+        const proxyHttpCheck2 = verificationResult.checks["https:proxy"];
+        if (verificationResult.ok && proxyHttpCheck2?.ok === true) {
+          break;
+        }
+        if (attempt < UI_REACHABILITY_VERIFY_ATTEMPTS - 1) {
+          await new Promise(
+            (resolve) => globalThis.setTimeout(resolve, UI_REACHABILITY_VERIFY_DELAY_MS)
+          );
+        }
+      }
+      const proxyHttpCheck = verificationResult?.checks["https:proxy"];
+      if (!verificationResult?.ok || proxyHttpCheck?.ok !== true) {
+        throw new Error(
+          proxyHttpCheck?.error ? `Secure relay endpoint did not become reachable in time: ${proxyHttpCheck.error}` : "Secure relay endpoint did not become reachable in time."
+        );
+      }
+    }
     const { peerId } = relayMetadata;
     const registrationId = createRelayBootstrapRegistrationId(
       profile,
@@ -3631,6 +3796,7 @@ var SponsorRelayController = class {
     const currentProgress = this.state.deploymentProgress;
     const currentProgressIsForLatestHash = currentProgress.itemHash === itemHash || currentProgress.itemHash == null && currentProgress.stage !== "idle" && currentProgress.stage !== "error";
     const keepTerminalSuccess = this.lastCompletedDeploymentHash === itemHash || currentProgressIsForLatestHash && currentProgress.stage === "completed" && currentProgress.status === "success";
+    const keepSpecificInFlightProgress = currentProgressIsForLatestHash && currentProgress.stage !== "completed" && currentProgress.stage !== "error" && currentProgress.progress >= 93;
     const status = latest.details.messageStatus;
     if (status === "rejected") {
       this.emitProgress({
@@ -3673,6 +3839,16 @@ var SponsorRelayController = class {
         });
         return;
       }
+      if (keepSpecificInFlightProgress) {
+        this.trace("progress:retain-inflight", {
+          reason: "latest refresh would overwrite a more specific in-flight deployment phase",
+          itemHash,
+          currentStage: currentProgress.stage,
+          currentLabel: currentProgress.label,
+          currentProgress: currentProgress.progress
+        });
+        return;
+      }
       this.emitProgress({
         stage: "deployment-confirmed",
         label: "Waiting for runtime",
@@ -3683,6 +3859,16 @@ var SponsorRelayController = class {
       });
       return;
     }
+    if (keepSpecificInFlightProgress) {
+      this.trace("progress:retain-inflight", {
+        reason: "latest refresh would overwrite a more specific in-flight deployment phase",
+        itemHash,
+        currentStage: currentProgress.stage,
+        currentLabel: currentProgress.label,
+        currentProgress: currentProgress.progress
+      });
+      return;
+    }
     this.emitProgress({
       stage: "deployment-confirmed",
       label: "Runtime ready",
@@ -4313,6 +4499,15 @@ var SponsorRelayController = class {
           });
           if (attemptItemHash) {
             if (attemptDeploymentToken) {
+              this.emitProgress({
+                stage: "refreshing-instances",
+                label: "Cleaning up failed attempt",
+                progress: 16,
+                status: "warning",
+                itemHash: attemptItemHash,
+                detail: `Removing bootstrap handoff state for failed deployment on ${attemptLabel}.`,
+                error: lastError.message
+              });
               this.trace("deploy:bootstrap-config-cleanup-start", {
                 itemHash: attemptItemHash,
                 deploymentToken: attemptDeploymentToken
@@ -4338,8 +4533,26 @@ var SponsorRelayController = class {
                   deploymentToken: attemptDeploymentToken,
                   error: cleanupError instanceof Error ? cleanupError.message : String(cleanupError)
                 });
+                this.emitProgress({
+                  stage: "refreshing-instances",
+                  label: "Cleanup warning",
+                  progress: 16,
+                  status: "warning",
+                  itemHash: attemptItemHash,
+                  detail: `Bootstrap cleanup reported an issue for ${attemptLabel}, but retry cleanup will continue.`,
+                  error: cleanupError instanceof Error ? cleanupError.message : String(cleanupError)
+                });
               });
             }
+            this.emitProgress({
+              stage: "refreshing-instances",
+              label: "Discarding failed deployment",
+              progress: 17,
+              status: "warning",
+              itemHash: attemptItemHash,
+              detail: `Forgetting failed deployment ${attemptItemHash.slice(0, 12)} on ${attemptLabel} before retrying.`,
+              error: lastError.message
+            });
             this.trace("deploy:forget-failed-attempt-start", {
               itemHash: attemptItemHash,
               crnHash: candidateCrn.hash,
@@ -4362,12 +4575,30 @@ var SponsorRelayController = class {
                 itemHash: attemptItemHash,
                 error: cleanupError instanceof Error ? cleanupError.message : String(cleanupError)
               });
+              this.emitProgress({
+                stage: "refreshing-instances",
+                label: "Cleanup warning",
+                progress: 17,
+                status: "warning",
+                itemHash: attemptItemHash,
+                detail: `Failed deployment cleanup reported an issue for ${attemptLabel}.`,
+                error: cleanupError instanceof Error ? cleanupError.message : String(cleanupError)
+              });
             });
             this.trace("deploy:forget-failed-attempt-complete", {
               itemHash: attemptItemHash,
               crnHash: candidateCrn.hash,
               crnName: candidateCrn.name
             });
+            this.emitProgress({
+              stage: "refreshing-instances",
+              label: "Cleanup complete",
+              progress: 18,
+              status: "info",
+              itemHash: attemptItemHash,
+              detail: `Finished cleaning up failed deployment on ${attemptLabel}.`,
+              error: null
+            });
           }
           if (candidateIndex < orderedCrns.length - 1) {
             this.emitProgress({

package/shared/index.d.ts

@@ -290,7 +290,7 @@ declare const STALE_INSTANCE_ALLOCATION_COOLDOWN_MS: number;
 declare const RECENT_INSTANCE_RUNTIME_GRACE_MS: number;
 declare const DEPLOYMENT_PENDING_WARNING_MS: number;
 
-declare const UI_PACKAGE_VERSION = "0.3.27";
+declare const UI_PACKAGE_VERSION = "0.3.30";
 
 interface RootfsRequiredPortForward {
     port: number;

package/shared/index.js

@@ -27,7 +27,7 @@ var RECENT_INSTANCE_RUNTIME_GRACE_MS = 10 * 60 * 1e3;
 var DEPLOYMENT_PENDING_WARNING_MS = 3 * 60 * 1e3;
 
 // src/shared/package-version.ts
-var UI_PACKAGE_VERSION = "0.3.27";
+var UI_PACKAGE_VERSION = "0.3.30";
 
 // src/shared/format.ts
 function shortHash(value, head = 8, tail = 6) {
@@ -1877,6 +1877,13 @@ async function waitForVmRuntime(args) {
 }
 
 // ../core/src/guest.ts
+function proxyHostnameFromUrl(value) {
+  try {
+    return value ? new URL(value).hostname : null;
+  } catch {
+    return null;
+  }
+}
 async function defaultHttpProbe(fetch2, url, timeoutMs = 1e4) {
   try {
     const controller = new AbortController();
@@ -2118,6 +2125,59 @@ async function fetchUcGoPeerMetadata(args) {
     `Relay metadata did not become ready after ${attempts} attempts: ${lastError ? lastError : typeof lastPayload === "string" ? lastPayload : JSON.stringify(lastPayload ?? {})}`
   );
 }
+async function verifyUcGoPeerReachability(args) {
+  const checks = {};
+  const mappedPorts2 = args.mappedPorts ?? {};
+  const hostIpv4 = args.hostIpv4;
+  const skippedInternalPorts = new Set(
+    (args.skipInternalPorts ?? ["80"]).map((value) => String(value))
+  );
+  const httpProbe = args.httpProbe ?? ((url, timeoutMs) => defaultHttpProbe(args.fetch, url, timeoutMs));
+  if (hostIpv4) {
+    for (const [internalPort, mapping] of Object.entries(mappedPorts2)) {
+      if (skippedInternalPorts.has(String(internalPort))) continue;
+      if (mapping?.tcp === true && mapping?.host) {
+        checks[`tcp:${internalPort}`] = {
+          host: hostIpv4,
+          port: mapping.host,
+          ...await args.tcpProbe(
+            hostIpv4,
+            mapping.host,
+            Number(args.tcpTimeoutMs ?? 5e3)
+          )
+        };
+      } else if (mapping?.udp === true && mapping?.host) {
+        checks[`udp:${internalPort}`] = {
+          host: hostIpv4,
+          port: mapping.host,
+          ok: null,
+          note: "UDP mapping published; CI does not perform an application-level UDP handshake probe."
+        };
+      }
+    }
+  }
+  if (args.proxyUrl && args.verifyProxyHttp !== false) {
+    checks["https:proxy"] = await httpProbe(
+      args.proxyUrl,
+      Number(args.httpTimeoutMs ?? 1e4)
+    );
+  }
+  const proxyHostname = proxyHostnameFromUrl(args.proxyUrl);
+  if (proxyHostname) {
+    checks["tcp:proxy-443"] = await args.tcpProbe(
+      proxyHostname,
+      443,
+      Number(args.tcpTimeoutMs ?? 5e3)
+    );
+  }
+  const failedChecks = Object.entries(checks).filter(
+    ([, value]) => value?.ok === false
+  );
+  return {
+    ok: failedChecks.length === 0,
+    checks
+  };
+}
 
 // ../aleph-bootstrap/src/index.ts
 import { recoverMessageAddress } from "viem";
@@ -3218,6 +3278,8 @@ var UI_DEPLOY_WAIT_ATTEMPTS = 60;
 var UI_DEPLOY_WAIT_DELAY_MS = 5e3;
 var UI_RUNTIME_WAIT_ATTEMPTS = 40;
 var UI_RUNTIME_WAIT_DELAY_MS = 5e3;
+var UI_REACHABILITY_VERIFY_ATTEMPTS = 25;
+var UI_REACHABILITY_VERIFY_DELAY_MS = 3e3;
 function hasUsableRuntime(details) {
   return Boolean(details.hostIpv4) || Boolean(details.vmIpv4) || details.mappedPorts.length > 0 || Boolean(details.webUrl) || Boolean(details.execution);
 }
@@ -3324,15 +3386,16 @@ var SponsorRelayController = class {
     this.progressEmitter.emit(nextEvent);
   }
   async configureRelayBootstrapRegistration(args) {
+    let runtime = args.runtime;
     const profile = relayProfileForManifest(this.state.manifest);
     if (!profile) return;
     if (!this.state.wallet.address) {
       throw new Error("A connected wallet is required to register relay bootstrap addresses.");
     }
-    if (!args.runtime.hostIpv4) {
+    if (!runtime.hostIpv4) {
       throw new Error("Relay runtime did not expose a host IPv4 address.");
     }
-    const mappedPorts2 = args.runtime.mappedPorts ?? {};
+    let mappedPorts2 = runtime.mappedPorts ?? {};
     const setupPort = mappedPorts2["80"]?.host ?? null;
     if (!setupPort) {
       throw new Error("Relay runtime did not expose the temporary setup endpoint.");
@@ -3347,7 +3410,7 @@ var SponsorRelayController = class {
         detail: "Waiting for the guest setup endpoint before collecting relay metadata."
       });
       const setupHealth = await waitForSetupEndpoint({
-        hostIpv4: args.runtime.hostIpv4,
+        hostIpv4: runtime.hostIpv4,
         setupPort,
         fetch: (url, init) => fetch(url, init),
         attempts: 15,
@@ -3373,12 +3436,12 @@ var SponsorRelayController = class {
         throw new Error("OrbitDB relay runtime is missing required mapped TCP/WS ports.");
       }
       const configureResult = await configureOrbitdbRelaySetup2({
-        hostIpv4: args.runtime.hostIpv4,
-        publicIpv6: args.runtime.ipv6,
+        hostIpv4: runtime.hostIpv4,
+        publicIpv6: runtime.ipv6,
         setupPort,
         tcpPort,
         wsPort,
-        proxyUrl: args.runtime.proxyUrl ?? void 0,
+        proxyUrl: runtime.proxyUrl ?? void 0,
         metricsPort: mappedPorts2["9090"]?.host ?? null,
         metricsHttpsPort: mappedPorts2["443"]?.host ?? null,
         webrtcPort: mappedPorts2["9093"]?.host ?? null,
@@ -3395,6 +3458,59 @@ var SponsorRelayController = class {
       if (!args.deploymentToken) {
         throw new Error("Missing deployment token for Aleph bootstrap config handoff.");
       }
+      if (runtime.proxyUrl && runtime.webAccess?.active !== true) {
+        this.emitProgress({
+          stage: "deployment-confirmed",
+          label: "Waiting for HTTPS route",
+          progress: 93,
+          status: "warning",
+          itemHash: args.itemHash,
+          detail: "The relay received a 2n6 hostname, but it is not active yet. Waiting before handing HTTPS config to the guest."
+        });
+        let latestRuntime = runtime;
+        for (let attempt = 0; attempt < UI_RUNTIME_WAIT_ATTEMPTS; attempt += 1) {
+          if (latestRuntime.webAccess?.active === true) {
+            break;
+          }
+          await new Promise(
+            (resolve) => globalThis.setTimeout(resolve, UI_RUNTIME_WAIT_DELAY_MS)
+          );
+          latestRuntime = await fetchVmRuntime({
+            itemHash: args.itemHash,
+            fetch: (url, init) => fetch(url, init),
+            crnHash: runtime.selectedCrn?.hash ?? runtime.allocation?.crnHash ?? void 0,
+            crns: this.state.crns,
+            crnListUrl: this.props.crnListUrl
+          }).catch(() => latestRuntime);
+          this.emitProgress({
+            stage: "deployment-confirmed",
+            label: "Waiting for HTTPS route",
+            progress: 93,
+            status: latestRuntime.webAccess?.active === true ? "info" : "warning",
+            itemHash: args.itemHash,
+            detail: `2n6 activation ${attempt + 1}/${UI_RUNTIME_WAIT_ATTEMPTS}: ${latestRuntime.webAccess?.active === true ? "active" : "still pending"} for ${latestRuntime.proxyUrl ?? runtime.proxyUrl ?? "reserved proxy URL"}.`
+          });
+          this.trace("deploy:bootstrap-proxy-activation", {
+            itemHash: args.itemHash,
+            attempt: attempt + 1,
+            attempts: UI_RUNTIME_WAIT_ATTEMPTS,
+            active: latestRuntime.webAccess?.active === true,
+            proxyUrl: latestRuntime.proxyUrl ?? null
+          });
+        }
+        runtime = latestRuntime;
+        mappedPorts2 = runtime.mappedPorts ?? mappedPorts2;
+        if (runtime.proxyUrl && runtime.webAccess?.active !== true) {
+          throw new Error(
+            "Aleph reserved a 2n6 proxy URL, but it never became active in time. Aborting guest HTTPS configuration to avoid a broken Caddy setup."
+          );
+        }
+      }
+      if (!runtime.hostIpv4) {
+        throw new Error("Relay runtime lost its host IPv4 address while waiting for HTTPS activation.");
+      }
+      const runtimeHostIpv4 = runtime.hostIpv4;
+      const activeProxyUrl = runtime.webAccess?.active === true ? runtime.proxyUrl ?? null : null;
       this.emitProgress({
         stage: "deployment-confirmed",
         label: "Publishing relay config",
@@ -3412,9 +3528,9 @@ var SponsorRelayController = class {
         expiresAt: new Date(Date.now() + 30 * 6e4).toISOString(),
         status: "pending",
         runtime: {
-          publicIpv4: args.runtime.hostIpv4,
-          publicIpv6: args.runtime.ipv6 ?? null,
-          proxyUrl: args.runtime.proxyUrl ?? null,
+          publicIpv4: runtimeHostIpv4,
+          publicIpv6: runtime.ipv6 ?? null,
+          proxyUrl: activeProxyUrl,
           mappedPorts: mappedPorts2
         },
         bootstrap: {
@@ -3480,7 +3596,7 @@ var SponsorRelayController = class {
       detail: "Waiting for the relay to report its final public multiaddrs."
     });
     const relayMetadata = await fetchRelayMetadataForRuntime({
-      runtime: args.runtime,
+      runtime,
       fetch: (url, init) => fetch(url, init),
       preferSecureMetadata: profile === "uc-go-peer",
       attempts: 80,
@@ -3513,6 +3629,55 @@ var SponsorRelayController = class {
     if (!relayMetadata) {
       throw new Error("Relay metadata did not include a peer ID and public multiaddrs.");
     }
+    if (profile === "uc-go-peer" && runtime.proxyUrl) {
+      this.emitProgress({
+        stage: "publishing-bootstrap",
+        label: "Verifying reachability",
+        progress: 96,
+        status: "info",
+        itemHash: args.itemHash,
+        detail: "Checking that the secure relay endpoint is reachable before trusting the deployment as ready."
+      });
+      const verificationUrl = (() => {
+        try {
+          return new URL("/bootstrap/metadata", runtime.proxyUrl).toString();
+        } catch {
+          return runtime.proxyUrl ?? "";
+        }
+      })();
+      let verificationResult = null;
+      for (let attempt = 0; attempt < UI_REACHABILITY_VERIFY_ATTEMPTS; attempt += 1) {
+        verificationResult = await verifyUcGoPeerReachability({
+          proxyUrl: verificationUrl,
+          verifyProxyHttp: true,
+          fetch: (url, init) => fetch(url, init),
+          tcpProbe: async () => ({ ok: null })
+        });
+        this.trace("deploy:reachability-verification-attempt", {
+          itemHash: args.itemHash,
+          attempt: attempt + 1,
+          attempts: UI_REACHABILITY_VERIFY_ATTEMPTS,
+          verificationUrl,
+          ok: verificationResult.ok,
+          checks: verificationResult.checks
+        });
+        const proxyHttpCheck2 = verificationResult.checks["https:proxy"];
+        if (verificationResult.ok && proxyHttpCheck2?.ok === true) {
+          break;
+        }
+        if (attempt < UI_REACHABILITY_VERIFY_ATTEMPTS - 1) {
+          await new Promise(
+            (resolve) => globalThis.setTimeout(resolve, UI_REACHABILITY_VERIFY_DELAY_MS)
+          );
+        }
+      }
+      const proxyHttpCheck = verificationResult?.checks["https:proxy"];
+      if (!verificationResult?.ok || proxyHttpCheck?.ok !== true) {
+        throw new Error(
+          proxyHttpCheck?.error ? `Secure relay endpoint did not become reachable in time: ${proxyHttpCheck.error}` : "Secure relay endpoint did not become reachable in time."
+        );
+      }
+    }
     const { peerId } = relayMetadata;
     const registrationId = createRelayBootstrapRegistrationId(
       profile,
@@ -3630,6 +3795,7 @@ var SponsorRelayController = class {
     const currentProgress = this.state.deploymentProgress;
     const currentProgressIsForLatestHash = currentProgress.itemHash === itemHash || currentProgress.itemHash == null && currentProgress.stage !== "idle" && currentProgress.stage !== "error";
     const keepTerminalSuccess = this.lastCompletedDeploymentHash === itemHash || currentProgressIsForLatestHash && currentProgress.stage === "completed" && currentProgress.status === "success";
+    const keepSpecificInFlightProgress = currentProgressIsForLatestHash && currentProgress.stage !== "completed" && currentProgress.stage !== "error" && currentProgress.progress >= 93;
     const status = latest.details.messageStatus;
     if (status === "rejected") {
       this.emitProgress({
@@ -3672,6 +3838,16 @@ var SponsorRelayController = class {
         });
         return;
       }
+      if (keepSpecificInFlightProgress) {
+        this.trace("progress:retain-inflight", {
+          reason: "latest refresh would overwrite a more specific in-flight deployment phase",
+          itemHash,
+          currentStage: currentProgress.stage,
+          currentLabel: currentProgress.label,
+          currentProgress: currentProgress.progress
+        });
+        return;
+      }
       this.emitProgress({
         stage: "deployment-confirmed",
         label: "Waiting for runtime",
@@ -3682,6 +3858,16 @@ var SponsorRelayController = class {
       });
       return;
     }
+    if (keepSpecificInFlightProgress) {
+      this.trace("progress:retain-inflight", {
+        reason: "latest refresh would overwrite a more specific in-flight deployment phase",
+        itemHash,
+        currentStage: currentProgress.stage,
+        currentLabel: currentProgress.label,
+        currentProgress: currentProgress.progress
+      });
+      return;
+    }
     this.emitProgress({
       stage: "deployment-confirmed",
       label: "Runtime ready",
@@ -4312,6 +4498,15 @@ var SponsorRelayController = class {
           });
           if (attemptItemHash) {
             if (attemptDeploymentToken) {
+              this.emitProgress({
+                stage: "refreshing-instances",
+                label: "Cleaning up failed attempt",
+                progress: 16,
+                status: "warning",
+                itemHash: attemptItemHash,
+                detail: `Removing bootstrap handoff state for failed deployment on ${attemptLabel}.`,
+                error: lastError.message
+              });
               this.trace("deploy:bootstrap-config-cleanup-start", {
                 itemHash: attemptItemHash,
                 deploymentToken: attemptDeploymentToken
@@ -4337,8 +4532,26 @@ var SponsorRelayController = class {
                   deploymentToken: attemptDeploymentToken,
                   error: cleanupError instanceof Error ? cleanupError.message : String(cleanupError)
                 });
+                this.emitProgress({
+                  stage: "refreshing-instances",
+                  label: "Cleanup warning",
+                  progress: 16,
+                  status: "warning",
+                  itemHash: attemptItemHash,
+                  detail: `Bootstrap cleanup reported an issue for ${attemptLabel}, but retry cleanup will continue.`,
+                  error: cleanupError instanceof Error ? cleanupError.message : String(cleanupError)
+                });
               });
             }
+            this.emitProgress({
+              stage: "refreshing-instances",
+              label: "Discarding failed deployment",
+              progress: 17,
+              status: "warning",
+              itemHash: attemptItemHash,
+              detail: `Forgetting failed deployment ${attemptItemHash.slice(0, 12)} on ${attemptLabel} before retrying.`,
+              error: lastError.message
+            });
             this.trace("deploy:forget-failed-attempt-start", {
               itemHash: attemptItemHash,
               crnHash: candidateCrn.hash,
@@ -4361,12 +4574,30 @@ var SponsorRelayController = class {
                 itemHash: attemptItemHash,
                 error: cleanupError instanceof Error ? cleanupError.message : String(cleanupError)
               });
+              this.emitProgress({
+                stage: "refreshing-instances",
+                label: "Cleanup warning",
+                progress: 17,
+                status: "warning",
+                itemHash: attemptItemHash,
+                detail: `Failed deployment cleanup reported an issue for ${attemptLabel}.`,
+                error: cleanupError instanceof Error ? cleanupError.message : String(cleanupError)
+              });
             });
             this.trace("deploy:forget-failed-attempt-complete", {
               itemHash: attemptItemHash,
               crnHash: candidateCrn.hash,
               crnName: candidateCrn.name
             });
+            this.emitProgress({
+              stage: "refreshing-instances",
+              label: "Cleanup complete",
+              progress: 18,
+              status: "info",
+              itemHash: attemptItemHash,
+              detail: `Finished cleaning up failed deployment on ${attemptLabel}.`,
+              error: null
+            });
           }
           if (candidateIndex < orderedCrns.length - 1) {
             this.emitProgress({