@catalyst-cloud/cli 0.14.4 → 0.14.5

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.14.5
+
+- Onboarding checks the server's advertised support before provider and repository setup. An unavailable route waits with a public web link instead of reporting declined consent.
+- GitHub App installation can open a verified browser handoff and checks every installation with fresh live probes. It remains separate from your personal GitHub connection and repository selection.
+- A route removed during browser approval stops with a waiting result. Signed provider approval links remain out of logs and receipts.
+
 ## 0.14.4
 
 - Personal Linear and GitHub approval links stay out of logs and receipts. Setup validates the signed browser destination and its expiry before opening it.

package/dist/onboard-capabilities.js

@@ -0,0 +1,177 @@
+import { loadConfig, normalizeBaseUrl, readManifest, } from "./config.js";
+import { contractVersionInRange } from "./contract.js";
+const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value
+    : null;
+const safePages = {
+    connections: "/a/account/connections",
+    personalConnections: "/settings/connected-accounts",
+};
+const routeKey = (route) => `${route.method} ${route.path}`;
+const waiting = (reason, path) => ({
+    state: "waiting",
+    reason,
+    ...(path ? { evidence: { path } } : {}),
+});
+/** Fresh contract advertisement proves route availability, never consent or resource readiness.
+ * No cache, token refresh or local write may create a stale positive capability. */
+async function read(ctx, journal, timeoutMs, external) {
+    if (external?.aborted)
+        return { reason: "interrupted" };
+    const cfg = loadConfig(ctx.home);
+    if (!cfg?.user)
+        return { reason: "personal_login_required" };
+    const personId = cfg.user.id;
+    if ((journal.account ?? journal.tenant) !== cfg.account ||
+        journal.membershipId !== cfg.user.id ||
+        !journal.baseUrl ||
+        normalizeBaseUrl(journal.baseUrl) !== normalizeBaseUrl(cfg.baseUrl))
+        return { reason: "onboarding_capability_identity_unverified" };
+    let origin;
+    try {
+        const url = new URL(cfg.baseUrl);
+        if (url.protocol !== "https:" ||
+            url.username ||
+            url.password ||
+            url.search ||
+            url.hash ||
+            url.pathname !== "/")
+            throw new Error();
+        origin = url.origin;
+    }
+    catch {
+        return { reason: "onboarding_capability_identity_unverified" };
+    }
+    const expiry = cfg.auth
+        ? Date.parse(cfg.auth.expiresAt) - ctx.now().getTime()
+        : 0;
+    const bearer = cfg.key ||
+        (cfg.auth && Number.isFinite(expiry) && expiry > 30_000
+            ? cfg.auth.accessToken
+            : undefined);
+    if (!bearer)
+        return { reason: "onboarding_capability_login_refresh_required", origin };
+    const owned = new AbortController();
+    const signal = external
+        ? AbortSignal.any([external, owned.signal])
+        : owned.signal;
+    const timer = setTimeout(() => owned.abort(), timeoutMs);
+    let remove = () => { };
+    try {
+        return await new Promise((resolve) => {
+            const stopped = () => resolve({
+                reason: external?.aborted
+                    ? "interrupted"
+                    : "onboarding_capability_unavailable",
+                origin,
+            });
+            if (signal.aborted) {
+                stopped();
+                return;
+            }
+            signal.addEventListener("abort", stopped, { once: true });
+            remove = () => signal.removeEventListener("abort", stopped);
+            Promise.resolve()
+                .then(async () => {
+                if (signal.aborted)
+                    return { reason: "interrupted", origin };
+                const response = await ctx.fetch(`${origin}/api/v1/agent/contract`, {
+                    method: "GET",
+                    redirect: "error",
+                    signal,
+                    headers: {
+                        authorization: `Bearer ${bearer}`,
+                        accept: "application/json",
+                        "cache-control": "no-cache",
+                    },
+                });
+                if (response.status !== 200)
+                    return { reason: "onboarding_capability_unavailable", origin };
+                const body = object(await response.json());
+                const current = loadConfig(ctx.home);
+                if (!current?.user ||
+                    current.account !== cfg.account ||
+                    current.user.id !== personId ||
+                    normalizeBaseUrl(current.baseUrl) !== origin ||
+                    object(body?.account)?.id !== cfg.account)
+                    return {
+                        reason: "onboarding_capability_identity_unverified",
+                        origin,
+                    };
+                if (!body ||
+                    typeof body.contractVersion !== "string" ||
+                    contractVersionInRange(body.contractVersion, readManifest().tenantContractRange) !== true)
+                    return { reason: "onboarding_capability_unavailable", origin };
+                const advertised = object(body.onboarding), web = object(advertised?.web);
+                if (!advertised)
+                    return { reason: "cloud_capability_unavailable", origin };
+                if (advertised.schema !== 1 ||
+                    !Array.isArray(advertised.routes) ||
+                    advertised.routes.length > 100 ||
+                    !web ||
+                    web.connections !== safePages.connections ||
+                    web.personalConnections !== safePages.personalConnections)
+                    return { reason: "onboarding_capability_unavailable", origin };
+                const routes = new Set();
+                for (const value of advertised.routes) {
+                    const row = object(value);
+                    if (!row ||
+                        !["GET", "POST"].includes(row.method) ||
+                        typeof row.path !== "string" ||
+                        row.path.length > 240 ||
+                        !/^\/(?:api\/v1\/|connect\/|me\/)[A-Za-z0-9_/-]+$/.test(row.path) ||
+                        row.personalBearer !== true)
+                        return { reason: "onboarding_capability_unavailable", origin };
+                    const key = `${row.method} ${row.path}`;
+                    if (routes.has(key))
+                        return { reason: "onboarding_capability_unavailable", origin };
+                    routes.add(key);
+                }
+                return { capabilities: { routes, web: { ...safePages } }, origin };
+            })
+                .then((result) => (signal.aborted ? stopped() : resolve(result)), () => signal.aborted
+                ? stopped()
+                : resolve({
+                    reason: "onboarding_capability_unavailable",
+                    origin,
+                }));
+        });
+    }
+    finally {
+        clearTimeout(timer);
+        remove();
+    }
+}
+/** Guard both the observation and action before their first endpoint request. A route's real
+ * refusal is preserved only after the same-account cloud advertised personal bearer support. */
+export function guardOnboardCapabilities(adapter, options) {
+    const timeoutMs = options.requestTimeoutMs ?? 30_000;
+    if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 30_000)
+        throw new Error("onboarding_capability_timeout_invalid");
+    const run = async (ctx, journal, signal, requirements, work) => {
+        const advertised = await read(ctx, journal, timeoutMs, signal);
+        if ("reason" in advertised ||
+            requirements.some((route) => !advertised.capabilities.routes.has(routeKey(route)))) {
+            const reason = "reason" in advertised
+                ? advertised.reason
+                : "cloud_capability_unavailable";
+            const url = advertised.origin
+                ? `${advertised.origin}${safePages[options.fallback]}`
+                : undefined;
+            if (reason === "cloud_capability_unavailable" && url)
+                options.message?.(`This setup step is not available on this server yet. Continue in the web app: ${url}`);
+            return waiting(reason, reason === "cloud_capability_unavailable" ? url : undefined);
+        }
+        if (signal?.aborted)
+            return waiting("interrupted");
+        return work();
+    };
+    return {
+        check: (ctx, journal, signal) => run(ctx, journal, signal, options.check, () => adapter.check(ctx, journal, signal)),
+        ...(adapter.act
+            ? {
+                act: (ctx, journal, signal) => run(ctx, journal, signal, options.act ?? options.check, () => adapter.act(ctx, journal, signal)),
+            }
+            : {}),
+    };
+}

package/dist/onboard-consent.js

@@ -9,7 +9,9 @@ function bounded(work, signal) {
             return;
         }
         signal.addEventListener("abort", abort, { once: true });
-        work.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+        work
+            .then(resolve, reject)
+            .finally(() => signal.removeEventListener("abort", abort));
     });
 }
 function safeReason(reason, fallback) {
@@ -19,17 +21,27 @@ function safeReason(reason, fallback) {
 export async function pollConsent(options) {
     const timeoutMs = options.timeoutMs ?? 600_000;
     const intervalMs = options.intervalMs ?? 2_000;
-    if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > 600_000 ||
-        !Number.isSafeInteger(intervalMs) || intervalMs <= 0)
+    if (!Number.isSafeInteger(timeoutMs) ||
+        timeoutMs <= 0 ||
+        timeoutMs > 600_000 ||
+        !Number.isSafeInteger(intervalMs) ||
+        intervalMs <= 0)
         throw new UsageError("consent timeout must be 1 to 600000 milliseconds, with a positive poll interval");
     const now = options.now ?? (() => performance.now());
     const started = now();
     const deadline = new AbortController();
     const timer = setTimeout(() => deadline.abort(), timeoutMs);
-    const signal = options.signal ? AbortSignal.any([options.signal, deadline.signal]) : deadline.signal;
+    const signal = options.signal
+        ? AbortSignal.any([options.signal, deadline.signal])
+        : deadline.signal;
     const elapsedMs = () => Math.max(0, Math.round(now() - started));
-    const waiting = () => ({ state: "waiting", reason: options.signal?.aborted ? "interrupted" : "consent_timeout", elapsedMs: elapsedMs() });
-    const sleep = options.sleep ?? ((ms) => new Promise(resolve => setTimeout(resolve, ms)));
+    const waiting = () => ({
+        state: "waiting",
+        reason: options.signal?.aborted ? "interrupted" : "consent_timeout",
+        elapsedMs: elapsedMs(),
+    });
+    const sleep = options.sleep ??
+        ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
     try {
         while (!signal.aborted && elapsedMs() < timeoutMs) {
             let status;
@@ -39,16 +51,31 @@ export async function pollConsent(options) {
             catch (error) {
                 if (signal.aborted)
                     return waiting();
-                if (error instanceof CliError && (error.status === 401 || error.status === 403))
-                    return { state: "refused", reason: "consent_identity_refused", elapsedMs: elapsedMs() };
-                return { state: "failed", reason: "consent_status_failed", elapsedMs: elapsedMs() };
+                if (error instanceof CliError &&
+                    (error.status === 401 || error.status === 403))
+                    return {
+                        state: "refused",
+                        reason: "consent_identity_refused",
+                        elapsedMs: elapsedMs(),
+                    };
+                return {
+                    state: "failed",
+                    reason: "consent_status_failed",
+                    elapsedMs: elapsedMs(),
+                };
             }
             if (elapsedMs() >= timeoutMs || signal.aborted)
                 return waiting();
             if (status.outcome === "connected")
                 return { state: "done", elapsedMs: elapsedMs() };
-            if (status.outcome === "refused" || status.outcome === "failed")
-                return { state: status.outcome, reason: safeReason(status.reason, `consent_${status.outcome}`), elapsedMs: elapsedMs() };
+            if (status.outcome === "waiting" ||
+                status.outcome === "refused" ||
+                status.outcome === "failed")
+                return {
+                    state: status.outcome,
+                    reason: safeReason(status.reason, `consent_${status.outcome}`),
+                    elapsedMs: elapsedMs(),
+                };
             const remaining = timeoutMs - elapsedMs();
             try {
                 await bounded(sleep(Math.min(intervalMs, remaining)), signal);

package/dist/onboard-github.js

@@ -0,0 +1,329 @@
+import { loadConfig, normalizeBaseUrl } from "./config.js";
+import { pollConsent } from "./onboard-consent.js";
+const STATUS = "/api/v1/me/connections/github/workspace";
+const HANDOFF = "/connect/github/workspace/handoff";
+const idPattern = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
+const states = new Set([
+    "connected",
+    "missing-scope",
+    "expired-or-revoked",
+    "unreachable",
+    "not-connected",
+]);
+const object = (v) => v !== null && typeof v === "object" && !Array.isArray(v)
+    ? v
+    : null;
+const waiting = (reason) => ({
+    state: "waiting",
+    reason,
+});
+const nullableText = (v) => v === null || typeof v === "string";
+/** A bounded read never rotates credentials or writes a token after the receipt lock is released. */
+async function read(ctx, journal, path, timeoutMs, external) {
+    const cfg = loadConfig(ctx.home);
+    if (!cfg?.user)
+        return { reason: "personal_login_required" };
+    const personId = cfg.user.id;
+    if ((journal.account ?? journal.tenant) !== cfg.account ||
+        journal.membershipId !== cfg.user.id ||
+        !journal.baseUrl ||
+        normalizeBaseUrl(journal.baseUrl) !== normalizeBaseUrl(cfg.baseUrl))
+        return { reason: "github_installation_identity_refused" };
+    const expiry = cfg.auth
+        ? Date.parse(cfg.auth.expiresAt) - ctx.now().getTime()
+        : 0;
+    const bearer = cfg.key ||
+        (cfg.auth && Number.isFinite(expiry) && expiry > 30_000
+            ? cfg.auth.accessToken
+            : undefined);
+    if (!bearer)
+        return { reason: "github_installation_login_refresh_required" };
+    const deadline = new AbortController();
+    const timer = setTimeout(() => deadline.abort(), timeoutMs);
+    const signal = external
+        ? AbortSignal.any([external, deadline.signal])
+        : deadline.signal;
+    let remove = () => { };
+    try {
+        return await new Promise((resolve) => {
+            const stopped = () => resolve({
+                reason: external?.aborted
+                    ? "interrupted"
+                    : "github_installation_status_unavailable",
+            });
+            if (signal.aborted) {
+                stopped();
+                return;
+            }
+            signal.addEventListener("abort", stopped, { once: true });
+            remove = () => signal.removeEventListener("abort", stopped);
+            Promise.resolve()
+                .then(async () => {
+                if (signal.aborted)
+                    return { reason: "interrupted" };
+                const response = await ctx.fetch(`${normalizeBaseUrl(cfg.baseUrl)}${path}`, {
+                    method: "GET",
+                    redirect: "error",
+                    headers: {
+                        authorization: `Bearer ${bearer}`,
+                        accept: "application/json",
+                    },
+                    signal,
+                });
+                // Refusal bodies and provider diagnostics are never parsed, returned or printed.
+                if (response.status !== 200)
+                    return { status: response.status };
+                const body = await response.json();
+                const current = loadConfig(ctx.home);
+                if (!current?.user ||
+                    current.account !== cfg.account ||
+                    current.user.id !== personId ||
+                    normalizeBaseUrl(current.baseUrl) !== normalizeBaseUrl(cfg.baseUrl))
+                    return { reason: "github_installation_identity_refused" };
+                return { status: 200, body };
+            })
+                .then((value) => (signal.aborted ? stopped() : resolve(value)), () => signal.aborted
+                ? stopped()
+                : resolve({ reason: "github_installation_status_unavailable" }));
+        });
+    }
+    finally {
+        clearTimeout(timer);
+        remove();
+    }
+}
+function readFailure(value) {
+    if ("reason" in value)
+        return value.reason === "github_installation_identity_refused" ||
+            value.reason === "personal_login_required"
+            ? { state: "refused", reason: value.reason }
+            : waiting(value.reason);
+    if (value.status === 401 || value.status === 403)
+        return { state: "refused", reason: "github_installation_consent_refused" };
+    return value.status === 200
+        ? null
+        : waiting("github_installation_status_unavailable");
+}
+/** Every reported installation must have a fresh live installation/App-permission probe.
+ * This proves installation connectivity, not access to repositories selected later in Q3. */
+function observation(body, now) {
+    const row = object(body);
+    if (!row ||
+        typeof row.connected !== "boolean" ||
+        !Array.isArray(row.installations) ||
+        !Array.isArray(row.pending) ||
+        row.installations.length + row.pending.length > 100)
+        return waiting("github_installation_status_shape");
+    const ids = [];
+    let unknown = false;
+    let allConnected = row.installations.length > 0;
+    let checkedAt = now + 30_000;
+    for (const value of row.installations) {
+        const item = object(value);
+        const verification = object(item?.verification);
+        if (!item ||
+            typeof item.installationId !== "string" ||
+            !idPattern.test(item.installationId) ||
+            ids.includes(item.installationId) ||
+            !nullableText(item.githubOrg) ||
+            (typeof item.githubOrg === "string" &&
+                !/^[A-Za-z0-9][A-Za-z0-9-]{0,127}$/.test(item.githubOrg)) ||
+            !verification)
+            return waiting("github_installation_status_shape");
+        ids.push(item.installationId);
+        if (verification.source === "none" &&
+            verification.state === "not-run" &&
+            verification.checkedAt === null) {
+            unknown = true;
+            allConnected = false;
+            continue;
+        }
+        if (verification.source !== "live-probe" ||
+            typeof verification.state !== "string" ||
+            !states.has(verification.state) ||
+            typeof verification.checkedAt !== "number" ||
+            !Number.isFinite(verification.checkedAt) ||
+            verification.checkedAt < now - 120_000 ||
+            verification.checkedAt > now + 30_000)
+            return waiting("github_installation_status_shape");
+        if (verification.missing !== undefined &&
+            (!Array.isArray(verification.missing) ||
+                verification.missing.length > 128 ||
+                !verification.missing.every((name) => typeof name === "string" &&
+                    (/^[A-Za-z0-9_-]{1,128}$/.test(name) ||
+                        /^[A-Za-z0-9_-]{1,80} \((?:read|write|admin)\)$/.test(name)))))
+            return waiting("github_installation_status_shape");
+        checkedAt = Math.min(checkedAt, verification.checkedAt);
+        if (verification.state === "unreachable")
+            unknown = true;
+        if (verification.state !== "connected")
+            allConnected = false;
+    }
+    for (const value of row.pending) {
+        const pending = object(value);
+        if (!pending ||
+            !nullableText(pending.githubOrg) ||
+            (typeof pending.githubOrg === "string" &&
+                !/^[A-Za-z0-9][A-Za-z0-9-]{0,127}$/.test(pending.githubOrg)) ||
+            typeof pending.requestedAt !== "number" ||
+            !Number.isFinite(pending.requestedAt) ||
+            pending.requestedAt < 0)
+            return waiting("github_installation_status_shape");
+    }
+    if (row.connected !== allConnected)
+        return waiting("github_installation_status_shape");
+    if (unknown)
+        return waiting("github_installation_status_unavailable");
+    if (!allConnected)
+        return { state: "pending" };
+    return {
+        state: "done",
+        evidence: {
+            provider: "github",
+            installation: JSON.stringify(ids),
+            checkedAt,
+        },
+    };
+}
+function safeHandoff(body, ctx) {
+    const row = object(body);
+    const cfg = loadConfig(ctx.home);
+    if (!cfg ||
+        !row ||
+        typeof row.authorizationUrl !== "string" ||
+        row.authorizationUrl.length > 8192 ||
+        /[\u0000-\u0020\u007f]/.test(row.authorizationUrl) ||
+        typeof row.expiresAt !== "number" ||
+        !Number.isFinite(row.expiresAt))
+        return null;
+    const remaining = row.expiresAt - ctx.now().getTime();
+    // Thirty seconds accommodates clock skew; an expired link is never launched.
+    if (remaining <= 0 || remaining > 630_000)
+        return null;
+    try {
+        const url = new URL(row.authorizationUrl);
+        const keys = [...url.searchParams.keys()];
+        const handoff = url.searchParams.get("handoff");
+        if (url.protocol !== "https:" ||
+            url.origin !== new URL(normalizeBaseUrl(cfg.baseUrl)).origin ||
+            url.username ||
+            url.password ||
+            url.pathname !== HANDOFF ||
+            url.hash ||
+            keys.length !== 1 ||
+            keys[0] !== "handoff" ||
+            !handoff ||
+            handoff.length > 4096 ||
+            /[\s\u0000-\u001f\u007f]/.test(handoff))
+            return null;
+        return url.toString();
+    }
+    catch {
+        return null;
+    }
+}
+/** Uses personal bearer App-install routes. Older clouds wait without a browser/session fallback. */
+export function githubInstallationAdapter(options) {
+    const timeoutMs = options.requestTimeoutMs ?? 30_000;
+    const consentTimeoutMs = options.consentTimeoutMs ?? 600_000;
+    if (!Number.isSafeInteger(timeoutMs) ||
+        timeoutMs < 1 ||
+        timeoutMs > 30_000 ||
+        !Number.isSafeInteger(consentTimeoutMs) ||
+        consentTimeoutMs < 1 ||
+        consentTimeoutMs > 600_000)
+        throw new Error("github_installation_timeout_invalid");
+    const inspect = async (ctx, journal, signal) => {
+        const result = await read(ctx, journal, STATUS, timeoutMs, signal);
+        if ("status" in result && [404, 405].includes(result.status))
+            return {
+                result: waiting("cloud_capability_unavailable"),
+                unsupported: true,
+            };
+        const failure = readFailure(result);
+        return {
+            result: failure ??
+                observation("body" in result ? result.body : undefined, ctx.now().getTime()),
+        };
+    };
+    return {
+        check: async (ctx, journal, signal) => (await inspect(ctx, journal, signal)).result,
+        act: async (ctx, journal, signal) => {
+            const cfg = loadConfig(ctx.home);
+            if (!cfg?.user || !["owner", "admin"].includes(cfg.user.role))
+                return {
+                    state: "refused",
+                    reason: "github_installation_admin_required",
+                };
+            if (signal?.aborted)
+                return waiting("interrupted");
+            const before = await inspect(ctx, journal, signal);
+            if (before.result.state !== "pending")
+                return before.result;
+            if (before.unsupported)
+                return waiting("cloud_capability_unavailable");
+            const start = await read(ctx, journal, `${STATUS}/start`, timeoutMs, signal);
+            if ("status" in start && [404, 405].includes(start.status))
+                return waiting("cloud_capability_unavailable");
+            const failure = readFailure(start);
+            if (failure)
+                return failure;
+            const url = safeHandoff("body" in start ? start.body : undefined, ctx);
+            if (!url)
+                return {
+                    state: "refused",
+                    reason: "github_installation_consent_handoff",
+                };
+            if (signal?.aborted)
+                return waiting("interrupted");
+            const current = loadConfig(ctx.home);
+            if (!current?.user ||
+                current.account !== cfg.account ||
+                current.user.id !== cfg.user.id ||
+                normalizeBaseUrl(current.baseUrl) !== normalizeBaseUrl(cfg.baseUrl))
+                return {
+                    state: "refused",
+                    reason: "github_installation_identity_refused",
+                };
+            if (!["owner", "admin"].includes(current.user.role))
+                return {
+                    state: "refused",
+                    reason: "github_installation_admin_required",
+                };
+            ctx.stderr("Approve the GitHub App installation in your browser. Your personal GitHub connection is checked separately.");
+            // The signed URL is transient credential material: only the browser receives it.
+            try {
+                options.openBrowser(url);
+            }
+            catch {
+                return waiting("github_installation_browser_unavailable");
+            }
+            let latest = waiting("github_installation_status_unavailable");
+            const run = () => pollConsent({
+                timeoutMs: consentTimeoutMs,
+                signal,
+                sleep: options.sleep,
+                readStatus: async (pollSignal) => {
+                    const value = await inspect(ctx, journal, pollSignal);
+                    latest = value.result;
+                    if (value.unsupported)
+                        return {
+                            outcome: "waiting",
+                            reason: "cloud_capability_unavailable",
+                        };
+                    if (latest.state === "done")
+                        return { outcome: "connected" };
+                    if (latest.state === "refused" || latest.state === "failed")
+                        return { outcome: latest.state, reason: latest.reason };
+                    return {
+                        outcome: latest.state === "pending" ? "absent" : "unavailable",
+                    };
+                },
+            });
+            const result = options.wait
+                ? await options.wait("Waiting for GitHub App approval", run)
+                : await run();
+            return result.state === "done" ? latest : result;
+        },
+    };
+}

package/dist/onboard-personal.js

@@ -90,7 +90,7 @@ function failure(value, start = false) {
         return { state: "refused", reason: "personal_consent_refused" };
     if (value.status === 503)
         return waiting("personal_status_unavailable");
-    if (value.status === 404)
+    if ([404, 405].includes(value.status))
         return waiting("cloud_capability_unavailable");
     return value.status === 200
         ? null
@@ -211,6 +211,8 @@ export function personalConsentAdapter(options) {
                 sleep: options.sleep,
                 readStatus: async (pollSignal) => {
                     latest = await inspect(ctx, journal, pollSignal);
+                    if (latest.reason === "cloud_capability_unavailable")
+                        return { outcome: "waiting", reason: latest.reason };
                     if (latest.state === "done")
                         return { outcome: "connected" };
                     if (latest.state === "refused" || latest.state === "failed")