@catalyst-cloud/cli 0.14.4 → 0.14.6

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.14.6
+
+- A current Catalyst data folder no longer triggers a legacy-runtime cleanup warning. Legacy checks and removal keep current shared data and report it separately.
+
+## 0.14.5
+
+- Onboarding checks the server's advertised support before provider and repository setup. An unavailable route waits with a public web link instead of reporting declined consent.
+- GitHub App installation can open a verified browser handoff and checks every installation with fresh live probes. It remains separate from your personal GitHub connection and repository selection.
+- A route removed during browser approval stops with a waiting result. Signed provider approval links remain out of logs and receipts.
+
 ## 0.14.4
 
 - Personal Linear and GitHub approval links stay out of logs and receipts. Setup validates the signed browser destination and its expiry before opening it.

package/dist/legacy.js

@@ -7,7 +7,7 @@
 // The list is fixed on purpose. A prefix match would one day catch a current job (the housekeeping
 // job, the sandbox credit guard, jobs a person made); this matches names the old runtime installed,
 // read at the source commit below, and nothing else. Shared data folders are always kept. The historical --data flag cannot remove them.
-import { existsSync, lstatSync, readFileSync, readdirSync, unlinkSync } from "node:fs";
+import { existsSync, lstatSync, readFileSync, readdirSync, unlinkSync, } from "node:fs";
 import { spawnSync } from "node:child_process";
 import { join } from "node:path";
 import { flagBool, positionals } from "./args.js";
@@ -44,17 +44,34 @@ export const OLD_LAUNCHD_LABELS = [
 const OLD_ROLE_PREFIX = "com.catalyst.role.";
 /** systemd user units (~/.config/systemd/user) the old runtime's workstation pieces used on Linux. System
  *  units under /etc/systemd/system are a host's, current, and never looked at. */
-export const OLD_USER_UNITS = ["catalyst.service", "catalyst-monitor.service"];
+export const OLD_USER_UNITS = [
+    "catalyst.service",
+    "catalyst-monitor.service",
+];
 /** Command files the old runtime put on the person's PATH. `~/.local/bin/catalyst` is NOT one: that
  *  name belongs to the current CLI wherever npm put it. */
-export const OLD_BINS = [".local/bin/catalyst-events", ".local/bin/catalyst-filter", ".local/bin/catalyst-hud", ".local/bin/catalyst-monitor", ".local/bin/catalyst-myown"];
+export const OLD_BINS = [
+    ".local/bin/catalyst-events",
+    ".local/bin/catalyst-filter",
+    ".local/bin/catalyst-hud",
+    ".local/bin/catalyst-monitor",
+    ".local/bin/catalyst-myown",
+];
 /** Shared roots also hold current skills, logs, hosts and seats. Never remove these directories. */
-export const OLD_DATA_DIRS = [".catalyst", ".config/catalyst", ".local/state/catalyst", ".local/state/catalyst-fleet-runner", ".local/state/catalyst-ledger"];
+export const OLD_DATA_DIRS = [
+    ".catalyst",
+    ".config/catalyst",
+    ".local/state/catalyst",
+    ".local/state/catalyst-fleet-runner",
+    ".local/state/catalyst-ledger",
+];
 const RECOMMEND = "Remove them: the cloud runtime replaced them, and left in place they can start old jobs or shadow current commands.";
 function readJson(path) {
     try {
         const v = JSON.parse(readFileSync(path, "utf8"));
-        return v !== null && typeof v === "object" ? v : null;
+        return v !== null && typeof v === "object"
+            ? v
+            : null;
     }
     catch {
         return null;
@@ -67,7 +84,8 @@ function findPlugins(home) {
     const old = Object.entries(marketplaces)
         .filter(([, v]) => {
         const src = v?.source;
-        return typeof src?.repo === "string" && src.repo.toLowerCase() === OLD_MARKETPLACE_REPO;
+        return (typeof src?.repo === "string" &&
+            src.repo.toLowerCase() === OLD_MARKETPLACE_REPO);
     })
         .map(([name]) => name);
     if (old.length === 0)
@@ -77,10 +95,18 @@ function findPlugins(home) {
     for (const key of Object.keys(installed)) {
         const at = key.lastIndexOf("@");
         if (at > 0 && old.includes(key.slice(at + 1)))
-            items.push({ kind: "plugin", name: key, path: join(dir, "installed_plugins.json") });
+            items.push({
+                kind: "plugin",
+                name: key,
+                path: join(dir, "installed_plugins.json"),
+            });
     }
     for (const name of old)
-        items.push({ kind: "marketplace", name, path: join(dir, "known_marketplaces.json") });
+        items.push({
+            kind: "marketplace",
+            name,
+            path: join(dir, "known_marketplaces.json"),
+        });
     return items;
 }
 function findJobs(home, platform) {
@@ -96,35 +122,63 @@ function findJobs(home, platform) {
         return files
             .filter((f) => f.endsWith(".plist"))
             .map((f) => f.slice(0, -".plist".length))
-            .filter((label) => OLD_LAUNCHD_LABELS.includes(label) || label.startsWith(OLD_ROLE_PREFIX))
+            .filter((label) => OLD_LAUNCHD_LABELS.includes(label) ||
+            label.startsWith(OLD_ROLE_PREFIX))
             .sort()
-            .map((label) => ({ kind: "job", name: label, path: join(dir, `${label}.plist`) }));
+            .map((label) => ({
+            kind: "job",
+            name: label,
+            path: join(dir, `${label}.plist`),
+        }));
     }
     if (platform === "linux") {
         const dir = join(home, ".config", "systemd", "user");
-        return OLD_USER_UNITS.filter((u) => existsSync(join(dir, u))).map((u) => ({ kind: "job", name: u, path: join(dir, u) }));
+        return OLD_USER_UNITS.filter((u) => existsSync(join(dir, u))).map((u) => ({
+            kind: "job",
+            name: u,
+            path: join(dir, u),
+        }));
     }
     return [];
 }
 const tilde = (rel) => `~/${rel}`;
 function findFiles(home) {
-    const bins = OLD_BINS.filter((rel) => existsSync(join(home, rel))).map((rel) => ({ kind: "bin", name: tilde(rel), path: join(home, rel) }));
-    const data = OLD_DATA_DIRS.filter((rel) => existsSync(join(home, rel))).map((rel) => ({ kind: "data", name: tilde(rel), path: join(home, rel), data: true }));
+    const bins = OLD_BINS.filter((rel) => existsSync(join(home, rel))).map((rel) => ({
+        kind: "bin",
+        name: tilde(rel),
+        path: join(home, rel),
+    }));
+    const data = OLD_DATA_DIRS.filter((rel) => existsSync(join(home, rel))).map((rel) => ({
+        kind: "data",
+        name: tilde(rel),
+        path: join(home, rel),
+        data: true,
+    }));
     return [...bins, ...data];
 }
 /** Every old piece on this machine, in removal order: plugins, their marketplace, jobs, bins, data. Never writes. */
 export function findLegacy(home, platform) {
-    return [...findPlugins(home), ...findJobs(home, platform), ...findFiles(home)];
+    return [
+        ...findPlugins(home),
+        ...findJobs(home, platform),
+        ...findFiles(home),
+    ];
 }
 const defaultRun = (cmd, args) => {
     const r = spawnSync(cmd, args, { encoding: "utf8", timeout: 60_000 });
-    return { status: r.status ?? 1, stdout: r.stdout ?? "", stderr: r.error ? r.error.message : (r.stderr ?? "") };
+    return {
+        status: r.status ?? 1,
+        stdout: r.stdout ?? "",
+        stderr: r.error ? r.error.message : (r.stderr ?? ""),
+    };
 };
 /** Remove one item through the tool that owns it. Returns null on success, else the reason it is still there. */
 function remove(item, run, platform, uid) {
     const tool = (cmd, args, what) => {
         const r = run(cmd, args);
-        return r.status === 0 ? null : `${what} failed: ${(r.stderr || r.stdout).trim().split("\n")[0] || `exit ${r.status}`}`;
+        return r.status === 0
+            ? null
+            : `${what} failed: ${(r.stderr || r.stdout).trim().split("\n")[0] || `exit ${r.status}`}`;
     };
     try {
         if (item.kind === "plugin")
@@ -132,7 +186,9 @@ function remove(item, run, platform, uid) {
         if (item.kind === "marketplace")
             return tool("claude", ["plugin", "marketplace", "remove", item.name], "claude plugin marketplace remove");
         if (item.kind === "job") {
-            const why = platform === "darwin" ? tool("launchctl", ["bootout", `gui/${uid}/${item.name}`], "launchctl bootout") : tool("systemctl", ["--user", "disable", "--now", item.name], "systemctl --user disable --now");
+            const why = platform === "darwin"
+                ? tool("launchctl", ["bootout", `gui/${uid}/${item.name}`], "launchctl bootout")
+                : tool("systemctl", ["--user", "disable", "--now", item.name], "systemctl --user disable --now");
             if (why !== null)
                 return why;
             unlinkSync(item.path);
@@ -159,21 +215,51 @@ export async function cmdLegacy(args, ctx, deps = {}) {
     const uid = deps.uid ?? (typeof process.getuid === "function" ? process.getuid() : 0);
     const run = deps.run ?? defaultRun;
     const found = findLegacy(ctx.home, platform);
-    const emit = (body, lines) => { if (args.json)
-        ctx.stdout(JSON.stringify(body));
-    else
-        for (const l of lines)
-            ctx.stdout(l); };
-    if (found.length === 0) {
-        emit({ sourceCommit: LEGACY_SOURCE_COMMIT, found: [], removed: [], remaining: [] }, ["no leftovers of the old local Catalyst runtime on this machine"]);
+    const legacy = found.filter((item) => !item.data);
+    const shared = found.filter((item) => item.data);
+    const emit = (body, lines) => {
+        if (args.json)
+            ctx.stdout(JSON.stringify(body));
+        else
+            for (const l of lines)
+                ctx.stdout(l);
+    };
+    if (legacy.length === 0) {
+        emit({
+            sourceCommit: LEGACY_SOURCE_COMMIT,
+            found: [],
+            removed: [],
+            remaining: [],
+            kept: shared,
+        }, [
+            "no leftovers of the old local Catalyst runtime on this machine",
+            ...(shared.length
+                ? ["shared current Catalyst data folders are present and kept"]
+                : []),
+        ]);
         return 0;
     }
     const listLines = [
-        `Leftovers of the old local Catalyst runtime on this machine (${found.length}):`,
-        ...found.map((f) => `  ${f.kind}: ${f.name}${f.kind === "job" ? ` — ${f.path}` : f.data ? " (kept: shared current state)" : ""}`),
+        `Leftovers of the old local Catalyst runtime on this machine (${legacy.length}):`,
+        ...legacy.map((f) => `  ${f.kind}: ${f.name}${f.kind === "job" ? ` — ${f.path}` : ""}`),
+        ...(shared.length
+            ? [
+                "Shared current data folders (kept):",
+                ...shared.map((f) => `  ${f.kind}: ${f.name} (kept: shared current state)`),
+            ]
+            : []),
     ];
     if (!wantRemove) {
-        emit({ sourceCommit: LEGACY_SOURCE_COMMIT, found, removed: [], remaining: found }, [...listLines, RECOMMEND, "Run: catalyst legacy --remove (all data folders are kept)"]);
+        emit({
+            sourceCommit: LEGACY_SOURCE_COMMIT,
+            found,
+            removed: [],
+            remaining: found,
+        }, [
+            ...listLines,
+            RECOMMEND,
+            "Run: catalyst legacy --remove (all data folders are kept)",
+        ]);
         return 1;
     }
     // the one question, only on a terminal; --yes answers it without asking
@@ -181,16 +267,34 @@ export async function cmdLegacy(args, ctx, deps = {}) {
     if (!go) {
         const tty = (deps.isTty ?? stdinIsTty)();
         if (!tty) {
-            emit({ sourceCommit: LEGACY_SOURCE_COMMIT, found, removed: [], remaining: found, asked: false }, [...listLines, RECOMMEND, "nothing removed: no terminal to ask on; run catalyst legacy --remove --yes to remove these without a question (all data folders are kept)"]);
+            emit({
+                sourceCommit: LEGACY_SOURCE_COMMIT,
+                found,
+                removed: [],
+                remaining: found,
+                asked: false,
+            }, [
+                ...listLines,
+                RECOMMEND,
+                "nothing removed: no terminal to ask on; run catalyst legacy --remove --yes to remove these without a question (all data folders are kept)",
+            ]);
             return 1;
         }
         for (const l of listLines)
             ctx.stdout(l);
         ctx.stdout(RECOMMEND);
-        const answer = (await (deps.prompt ?? ((q) => promptSecret(q)))(`Remove ${found.length} item${found.length === 1 ? "" : "s"}, keeping all data folders? [y/N] `)).trim().toLowerCase();
+        const answer = (await (deps.prompt ?? ((q) => promptSecret(q)))(`Remove ${legacy.length} item${legacy.length === 1 ? "" : "s"}, keeping all data folders? [y/N] `))
+            .trim()
+            .toLowerCase();
         go = answer === "y" || answer === "yes";
         if (!go) {
-            emit({ sourceCommit: LEGACY_SOURCE_COMMIT, found, removed: [], remaining: found, asked: true }, ["nothing removed; run catalyst legacy --remove again when ready"]);
+            emit({
+                sourceCommit: LEGACY_SOURCE_COMMIT,
+                found,
+                removed: [],
+                remaining: found,
+                asked: true,
+            }, ["nothing removed; run catalyst legacy --remove again when ready"]);
             return 1;
         }
     }
@@ -217,7 +321,16 @@ export async function cmdLegacy(args, ctx, deps = {}) {
     // re-check from the same list, so the report says what the machine holds now, not what was attempted
     const remaining = findLegacy(ctx.home, platform).filter((f) => !f.data);
     const keptNote = kept.length > 0 ? "; all shared data folders were kept" : "";
-    lines.push(remaining.length === 0 ? `re-checked: nothing of the old runtime remains${keptNote}` : `re-checked: ${remaining.length} item${remaining.length === 1 ? "" : "s"} of the old runtime remain${remaining.length === 1 ? "s" : ""}${keptNote}: ${remaining.map((r) => `${r.kind} ${r.name}`).join(", ")}`);
-    emit({ sourceCommit: LEGACY_SOURCE_COMMIT, found, removed, remaining: [...remaining, ...kept], kept, failed }, lines);
+    lines.push(remaining.length === 0
+        ? `re-checked: nothing of the old runtime remains${keptNote}`
+        : `re-checked: ${remaining.length} item${remaining.length === 1 ? "" : "s"} of the old runtime remain${remaining.length === 1 ? "s" : ""}${keptNote}: ${remaining.map((r) => `${r.kind} ${r.name}`).join(", ")}`);
+    emit({
+        sourceCommit: LEGACY_SOURCE_COMMIT,
+        found,
+        removed,
+        remaining: [...remaining, ...kept],
+        kept,
+        failed,
+    }, lines);
     return remaining.length === 0 ? 0 : 1;
 }

package/dist/onboard-capabilities.js

@@ -0,0 +1,177 @@
+import { loadConfig, normalizeBaseUrl, readManifest, } from "./config.js";
+import { contractVersionInRange } from "./contract.js";
+const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value
+    : null;
+const safePages = {
+    connections: "/a/account/connections",
+    personalConnections: "/settings/connected-accounts",
+};
+const routeKey = (route) => `${route.method} ${route.path}`;
+const waiting = (reason, path) => ({
+    state: "waiting",
+    reason,
+    ...(path ? { evidence: { path } } : {}),
+});
+/** Fresh contract advertisement proves route availability, never consent or resource readiness.
+ * No cache, token refresh or local write may create a stale positive capability. */
+async function read(ctx, journal, timeoutMs, external) {
+    if (external?.aborted)
+        return { reason: "interrupted" };
+    const cfg = loadConfig(ctx.home);
+    if (!cfg?.user)
+        return { reason: "personal_login_required" };
+    const personId = cfg.user.id;
+    if ((journal.account ?? journal.tenant) !== cfg.account ||
+        journal.membershipId !== cfg.user.id ||
+        !journal.baseUrl ||
+        normalizeBaseUrl(journal.baseUrl) !== normalizeBaseUrl(cfg.baseUrl))
+        return { reason: "onboarding_capability_identity_unverified" };
+    let origin;
+    try {
+        const url = new URL(cfg.baseUrl);
+        if (url.protocol !== "https:" ||
+            url.username ||
+            url.password ||
+            url.search ||
+            url.hash ||
+            url.pathname !== "/")
+            throw new Error();
+        origin = url.origin;
+    }
+    catch {
+        return { reason: "onboarding_capability_identity_unverified" };
+    }
+    const expiry = cfg.auth
+        ? Date.parse(cfg.auth.expiresAt) - ctx.now().getTime()
+        : 0;
+    const bearer = cfg.key ||
+        (cfg.auth && Number.isFinite(expiry) && expiry > 30_000
+            ? cfg.auth.accessToken
+            : undefined);
+    if (!bearer)
+        return { reason: "onboarding_capability_login_refresh_required", origin };
+    const owned = new AbortController();
+    const signal = external
+        ? AbortSignal.any([external, owned.signal])
+        : owned.signal;
+    const timer = setTimeout(() => owned.abort(), timeoutMs);
+    let remove = () => { };
+    try {
+        return await new Promise((resolve) => {
+            const stopped = () => resolve({
+                reason: external?.aborted
+                    ? "interrupted"
+                    : "onboarding_capability_unavailable",
+                origin,
+            });
+            if (signal.aborted) {
+                stopped();
+                return;
+            }
+            signal.addEventListener("abort", stopped, { once: true });
+            remove = () => signal.removeEventListener("abort", stopped);
+            Promise.resolve()
+                .then(async () => {
+                if (signal.aborted)
+                    return { reason: "interrupted", origin };
+                const response = await ctx.fetch(`${origin}/api/v1/agent/contract`, {
+                    method: "GET",
+                    redirect: "error",
+                    signal,
+                    headers: {
+                        authorization: `Bearer ${bearer}`,
+                        accept: "application/json",
+                        "cache-control": "no-cache",
+                    },
+                });
+                if (response.status !== 200)
+                    return { reason: "onboarding_capability_unavailable", origin };
+                const body = object(await response.json());
+                const current = loadConfig(ctx.home);
+                if (!current?.user ||
+                    current.account !== cfg.account ||
+                    current.user.id !== personId ||
+                    normalizeBaseUrl(current.baseUrl) !== origin ||
+                    object(body?.account)?.id !== cfg.account)
+                    return {
+                        reason: "onboarding_capability_identity_unverified",
+                        origin,
+                    };
+                if (!body ||
+                    typeof body.contractVersion !== "string" ||
+                    contractVersionInRange(body.contractVersion, readManifest().tenantContractRange) !== true)
+                    return { reason: "onboarding_capability_unavailable", origin };
+                const advertised = object(body.onboarding), web = object(advertised?.web);
+                if (!advertised)
+                    return { reason: "cloud_capability_unavailable", origin };
+                if (advertised.schema !== 1 ||
+                    !Array.isArray(advertised.routes) ||
+                    advertised.routes.length > 100 ||
+                    !web ||
+                    web.connections !== safePages.connections ||
+                    web.personalConnections !== safePages.personalConnections)
+                    return { reason: "onboarding_capability_unavailable", origin };
+                const routes = new Set();
+                for (const value of advertised.routes) {
+                    const row = object(value);
+                    if (!row ||
+                        !["GET", "POST"].includes(row.method) ||
+                        typeof row.path !== "string" ||
+                        row.path.length > 240 ||
+                        !/^\/(?:api\/v1\/|connect\/|me\/)[A-Za-z0-9_/-]+$/.test(row.path) ||
+                        row.personalBearer !== true)
+                        return { reason: "onboarding_capability_unavailable", origin };
+                    const key = `${row.method} ${row.path}`;
+                    if (routes.has(key))
+                        return { reason: "onboarding_capability_unavailable", origin };
+                    routes.add(key);
+                }
+                return { capabilities: { routes, web: { ...safePages } }, origin };
+            })
+                .then((result) => (signal.aborted ? stopped() : resolve(result)), () => signal.aborted
+                ? stopped()
+                : resolve({
+                    reason: "onboarding_capability_unavailable",
+                    origin,
+                }));
+        });
+    }
+    finally {
+        clearTimeout(timer);
+        remove();
+    }
+}
+/** Guard both the observation and action before their first endpoint request. A route's real
+ * refusal is preserved only after the same-account cloud advertised personal bearer support. */
+export function guardOnboardCapabilities(adapter, options) {
+    const timeoutMs = options.requestTimeoutMs ?? 30_000;
+    if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 30_000)
+        throw new Error("onboarding_capability_timeout_invalid");
+    const run = async (ctx, journal, signal, requirements, work) => {
+        const advertised = await read(ctx, journal, timeoutMs, signal);
+        if ("reason" in advertised ||
+            requirements.some((route) => !advertised.capabilities.routes.has(routeKey(route)))) {
+            const reason = "reason" in advertised
+                ? advertised.reason
+                : "cloud_capability_unavailable";
+            const url = advertised.origin
+                ? `${advertised.origin}${safePages[options.fallback]}`
+                : undefined;
+            if (reason === "cloud_capability_unavailable" && url)
+                options.message?.(`This setup step is not available on this server yet. Continue in the web app: ${url}`);
+            return waiting(reason, reason === "cloud_capability_unavailable" ? url : undefined);
+        }
+        if (signal?.aborted)
+            return waiting("interrupted");
+        return work();
+    };
+    return {
+        check: (ctx, journal, signal) => run(ctx, journal, signal, options.check, () => adapter.check(ctx, journal, signal)),
+        ...(adapter.act
+            ? {
+                act: (ctx, journal, signal) => run(ctx, journal, signal, options.act ?? options.check, () => adapter.act(ctx, journal, signal)),
+            }
+            : {}),
+    };
+}

package/dist/onboard-consent.js

@@ -9,7 +9,9 @@ function bounded(work, signal) {
             return;
         }
         signal.addEventListener("abort", abort, { once: true });
-        work.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+        work
+            .then(resolve, reject)
+            .finally(() => signal.removeEventListener("abort", abort));
     });
 }
 function safeReason(reason, fallback) {
@@ -19,17 +21,27 @@ function safeReason(reason, fallback) {
 export async function pollConsent(options) {
     const timeoutMs = options.timeoutMs ?? 600_000;
     const intervalMs = options.intervalMs ?? 2_000;
-    if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > 600_000 ||
-        !Number.isSafeInteger(intervalMs) || intervalMs <= 0)
+    if (!Number.isSafeInteger(timeoutMs) ||
+        timeoutMs <= 0 ||
+        timeoutMs > 600_000 ||
+        !Number.isSafeInteger(intervalMs) ||
+        intervalMs <= 0)
         throw new UsageError("consent timeout must be 1 to 600000 milliseconds, with a positive poll interval");
     const now = options.now ?? (() => performance.now());
     const started = now();
     const deadline = new AbortController();
     const timer = setTimeout(() => deadline.abort(), timeoutMs);
-    const signal = options.signal ? AbortSignal.any([options.signal, deadline.signal]) : deadline.signal;
+    const signal = options.signal
+        ? AbortSignal.any([options.signal, deadline.signal])
+        : deadline.signal;
     const elapsedMs = () => Math.max(0, Math.round(now() - started));
-    const waiting = () => ({ state: "waiting", reason: options.signal?.aborted ? "interrupted" : "consent_timeout", elapsedMs: elapsedMs() });
-    const sleep = options.sleep ?? ((ms) => new Promise(resolve => setTimeout(resolve, ms)));
+    const waiting = () => ({
+        state: "waiting",
+        reason: options.signal?.aborted ? "interrupted" : "consent_timeout",
+        elapsedMs: elapsedMs(),
+    });
+    const sleep = options.sleep ??
+        ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
     try {
         while (!signal.aborted && elapsedMs() < timeoutMs) {
             let status;
@@ -39,16 +51,31 @@ export async function pollConsent(options) {
             catch (error) {
                 if (signal.aborted)
                     return waiting();
-                if (error instanceof CliError && (error.status === 401 || error.status === 403))
-                    return { state: "refused", reason: "consent_identity_refused", elapsedMs: elapsedMs() };
-                return { state: "failed", reason: "consent_status_failed", elapsedMs: elapsedMs() };
+                if (error instanceof CliError &&
+                    (error.status === 401 || error.status === 403))
+                    return {
+                        state: "refused",
+                        reason: "consent_identity_refused",
+                        elapsedMs: elapsedMs(),
+                    };
+                return {
+                    state: "failed",
+                    reason: "consent_status_failed",
+                    elapsedMs: elapsedMs(),
+                };
             }
             if (elapsedMs() >= timeoutMs || signal.aborted)
                 return waiting();
             if (status.outcome === "connected")
                 return { state: "done", elapsedMs: elapsedMs() };
-            if (status.outcome === "refused" || status.outcome === "failed")
-                return { state: status.outcome, reason: safeReason(status.reason, `consent_${status.outcome}`), elapsedMs: elapsedMs() };
+            if (status.outcome === "waiting" ||
+                status.outcome === "refused" ||
+                status.outcome === "failed")
+                return {
+                    state: status.outcome,
+                    reason: safeReason(status.reason, `consent_${status.outcome}`),
+                    elapsedMs: elapsedMs(),
+                };
             const remaining = timeoutMs - elapsedMs();
             try {
                 await bounded(sleep(Math.min(intervalMs, remaining)), signal);