@matuto-ai/claude-psst-connector 0.6.0 → 0.7.0

package/.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
       "name": "psst",
       "source": "./",
       "description": "Psst messaging for Claude Code",
-      "version": "0.6.0"
+      "version": "0.7.0"
     }
   ],
   "metadata": {

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "psst",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Session-bound Psst agent messaging with explicit receive and acknowledgment. Bounded opt-in native notices; no permission relay.",
   "author": {
     "name": "Bruno Orsolon"

package/README.md

@@ -1,6 +1,6 @@
 # Psst for Claude Code
 
-> **Unreleased 0.6.0 migration candidate.** This version moves to `@matuto-ai/claude-psst-connector`. The previous package remains available; no existing installation changes automatically. Use the versioned commands only after the new publication is verified. See [migration checklist](docs/migration-0.6.0.md).
+> **Unreleased 0.7.0 release candidate.** This version moves to `@matuto-ai/claude-psst-connector`. The previous package remains available; no existing installation changes automatically. Use the versioned commands only after the new publication is verified. See [migration checklist](docs/migration-0.6.0.md).
 
 Native Claude Code plugin for discovery, send, receive, explicit read acknowledgment,
 and delivery status through [Psst](https://github.com/matuto-ai/psst).
@@ -22,10 +22,10 @@ supported upgrade workflow and the later owner-machine integration checks.
 
 ## Install from GitHub
 
-After release `v0.6.0` is published, install the pinned release:
+After release `v0.7.0` is published, install the pinned release:
 
 ```sh
-claude plugin marketplace add matuto-ai/claude-psst-connector#v0.6.0
+claude plugin marketplace add matuto-ai/claude-psst-connector#v0.7.0
 claude plugin install psst@psst-connectors
 ```
 
@@ -137,7 +137,7 @@ After npm publication is verified, install the released package into a private
 local tools directory (reuse your existing prefix when updating):
 
 ```sh
-npm install --prefix "$HOME/.local/share/psst-claude" --ignore-scripts --no-audit --no-fund @matuto-ai/claude-psst-connector@0.6.0
+npm install --prefix "$HOME/.local/share/psst-claude" --ignore-scripts --no-audit --no-fund @matuto-ai/claude-psst-connector@0.7.0
 "$HOME/.local/share/psst-claude/node_modules/.bin/psst-claude" doctor
 ```
 
@@ -255,3 +255,34 @@ exact event IDs you read with `broker_acknowledge_presence_event`. Notices conta
 only transport metadata, never message bodies or a reply deadline. They do not
 resend, cancel, close, or acknowledge any message automatically. See the
 [durable bounds, recovery and validation limits](docs/presence-notices.md).
+
+
+## Explicit reauthorization
+
+Use **/psst:reauthorize** to request replacement installation authorization:
+command → confirm the displayed configured HTTPS broker → new public request ID
+→ administrator approves that ID at `/admin` → native attachment and selection.
+`/psst:connect` reconnects saved access; it does not request replacement.
+
+Pending, approved-but-not-connected, and connected are distinct outcomes.
+Existing working access and old journals/unread messages are retained until the
+candidate attaches and is safely selected. Revoked access is not working access.
+A new credential-bound address never replays the old inbox. Replacement does
+**not** revoke the old credential: manual revocation in Psst admin is a separate
+human action, not a prerequisite. This command never accesses admin automatically.
+
+Repeat the command to resume the same pending candidate after cancellation,
+restart or uncertain response. For an approved candidate that failed attachment,
+choose retry attachment or explicitly request a new approval if necessary. Cancellation stops this native
+session's intent only. Preserve state and locks; use the public request ID for
+admin diagnosis. Do not run a separate MCP server or fabricate session binding.
+Missing native tools require `/psst:connect`'s bounded native MCP diagnostics.
+
+**Execution cost:** `/psst:reauthorize` is a user-invoked native plugin skill.
+Claude executes its fixed instructions and tool calls in a model turn; it is not
+token-free. Host-owned approval polling does not consume repeated model turns.
+The owner accepted this trade-off for discoverability. The newer Claude Mods
+command API offers deterministic dispatch, but its compatibility with the owner's
+installed host has not been verified and this change does not require it.
+
+See [command contract and verification](docs/reauthorization.md).

package/distribution/npm-marketplace.json

@@ -9,7 +9,7 @@
       "source": {
         "source": "npm",
         "package": "@matuto-ai/claude-psst-connector",
-        "version": "0.6.0"
+        "version": "0.7.0"
       },
       "description": "Psst messaging for Claude Code"
     }

package/docs/migration-0.6.0.md

@@ -1,4 +1,9 @@
-# 0.6.0 package and repository migration
+# Package and repository migration for 0.7.0
+
+This checklist targets the unreleased **0.7.0** candidate. The historical
+`migration-0.6.0.md` filename is retained so existing links continue to work.
+Older 0.6.0 registry receipts do not establish publication of 0.7.0. Publication
+requires separate owner authorization; a version-bump PR does not publish.
 
 This is a prepared, unpublished migration. Old package `@matuto-ai/claude-code-broker-connector` remains available. No release, deprecation, repository rename, account permission or user installation is performed by this change.
 
@@ -6,12 +11,12 @@ This is a prepared, unpublished migration. Old package `@matuto-ai/claude-code-b
 
 1. Review/test this exact candidate and merge it in the existing repository. Regular `verify.yaml` runs syntax checks and focused unit tests in the current repository, without an external fixture checkout.
 2. The existing GitHub repository is now `matuto-ai/claude-psst-connector`. Confirm checkout and the required `verify` check work under this final URL before publication. Do not rename it again or delete/recreate it. Update local remotes and external references you control.
-3. Create/bootstrap the new public npm package through the owner's supported authenticated npm flow and configure its trusted publisher for owner `matuto-ai`, repository `claude-psst-connector`, workflow `npm-publish.yml`, allowing direct `npm publish`. The old package's trust does not transfer. Follow current npm requirements; never copy a token into source or chat. A first publish used for bootstrap consumes that version: do not attempt to publish `0.6.0` twice. If bootstrap already published the final artifact at `0.6.0`, reconcile that receipt instead of triggering a duplicate publish.
-4. Only after the repository rename and publisher setup, publish GitHub release `v0.6.0` from the reviewed commit, when `0.6.0` has not already been published. This triggers publication of the **new** scoped package. Verify the workflow, package name/version and downloaded artifact before announcing availability.
+3. Create/bootstrap the new public npm package through the owner's supported authenticated npm flow and configure its trusted publisher for owner `matuto-ai`, repository `claude-psst-connector`, workflow `npm-publish.yml`, allowing direct `npm publish`. The old package's trust does not transfer. Follow current npm requirements; never copy a token into source or chat. A first publish used for bootstrap consumes that version: do not attempt to publish `0.7.0` twice. If bootstrap already published the final artifact at `0.7.0`, reconcile that receipt instead of triggering a duplicate publish.
+4. Only after the repository rename and publisher setup, publish GitHub release `v0.7.0` from the reviewed commit, when `0.7.0` has not already been published. This triggers publication of the **new** scoped package. Verify the workflow, package name/version and downloaded artifact before announcing availability.
 5. Test clean installation and explicit upgrade from the old package using the native plugin manager. Keep exactly one active connector and retain all private Psst state. Do not delete credentials, pending sends, unread journals or native conversation bindings to make migration pass.
 6. Once the replacement is verified, the owner may deprecate the old npm package with a message naming the replacement. Do **not** unpublish old versions or reuse the previous package's deleted versions. Deprecation warns; it neither migrates nor disables installed copies.
 
-Repository and package metadata intentionally point to the final name. Version `0.6.0` under the new npm name is independent of versions under the old name. This is not 1.0 acceptance or a claim that live native installation/reconnection is already verified.
+Repository and package metadata intentionally point to the final name. Version `0.7.0` under the new npm name is independent of versions under the old name. This is not 1.0 acceptance or a claim that live native installation/reconnection is already verified.
 
 ## Compatibility boundary
 

package/docs/publishing.md

@@ -1,12 +1,12 @@
 # Distribution and npm publishing
 
-For 0.6.0, follow the [package/repository migration checklist](migration-0.6.0.md) first: verify the final repository URL before releasing and configure the new package's trusted publisher. Do not publish the same name/version twice during bootstrap.
+For installations still on the pre-migration package, follow the [package/repository migration checklist](migration-0.6.0.md) first: verify the final repository URL before releasing and configure the new package's trusted publisher. Do not publish the same name/version twice during bootstrap.
 
 The supported native Claude marketplace install works directly from the reviewed
 GitHub branch/tag. npm is optional; it distributes the same self-contained plugin
 files and helper CLI, not a separate model client.
 
-The npm package is prepared as `@matuto-ai/claude-psst-connector` version `0.6.0`.
+The npm package is prepared as `@matuto-ai/claude-psst-connector` version `0.7.0`.
 The version-bump PR itself does not publish. The separately authorized GitHub
 release triggers the configured trusted publisher; verify its result before
 announcing availability.
@@ -30,7 +30,7 @@ configured, complete that one-time bootstrap in your authenticated npm environme
 Do not paste a token into chat or into a committed workflow. The workflow cannot
 magically create publisher permissions.
 
-After reviewing and merging the PR, create release `v0.6.0` from the reviewed
+After reviewing and merging the PR, create release `v0.7.0` from the reviewed
 commit. The tag must match package.json. Tests run first, then npm publication
 uses short-lived OIDC and provenance. Verify the Actions run and npm package
 version before giving users npm install instructions. Native GitHub installation

package/docs/reauthorization.md

@@ -0,0 +1,59 @@
+# Explicit reauthorization
+
+`/psst:reauthorize` appears as a user-invoked native plugin skill. It previews the
+configured `broker_url`, asks for target-specific owner confirmation, and calls
+`broker_setup({replace:true,expected_broker_url:origin})`. The expected HTTPS origin
+is checked before any mutation. The primary workflow never reads or passes a
+credential. Normal native MCP tool admission, PreToolUse and session guards remain
+unchanged. Missing native tools are not bypassed by another server or fake binding.
+
+Workflow: command → confirm displayed broker → public request ID → administrator
+approves that ID at `/admin` → attachment and safe installation selection.
+`outcome` distinguishes `pending`, `approved_not_connected` and `connected`.
+`connected` may describe old active access; `candidate_connected` describes the
+replacement. Working old access is retained while possible; revoked access is not
+claimed to work. Replacement does not revoke old credentials, and prior revocation
+is not required. Only the human administrator performs revocation in Psst admin.
+
+Repeating the command resumes pending candidates after cancellation, restart or
+uncertain POST responses. For approved-but-not-connected candidates, the owner chooses retry attachment
+(without replace) or a new approval (replace:true), including when that candidate
+was revoked before attachment. Errors alone never prove revocation.
+An explicit retry may resend POST with the same durable request ID/key when
+the initial POST never reached the broker; automatic resume/polling stays GET-only.
+`broker_setup_cancel` stops this session's intent only; the durable candidate stays.
+`broker_setup_status` reads state without enrollment. Host polling, not a model
+loop, watches approval. Selection races retain the previous selection and old
+journals/unread messages. New credential-bound addresses never replay old messages.
+Preserve files and locks; do not delete state to recover. Changed target requires
+new confirmation. No startup, reconnect, network-failure or peer-driven enrollment.
+
+## Host dispatch and tokens
+
+This release uses the same supported plugin-skill mechanism as `/psst:connect`.
+A skill is a fixed instruction prompt executed by Claude: invocation and tool
+calls consume a model turn. `disable-model-invocation: true` makes it user-only,
+not token-free. The owner accepted this trade-off for command discoverability.
+
+Claude's newer [Mods API](https://code.claude.com/docs/en/plugins/mods/api#add-a-command)
+provides native `command.run` and `tool.call` dispatch. Its installed-host
+compatibility has not been verified here. We therefore do not install Mods,
+require new host configuration or claim deterministic/token-free dispatch.
+[Skill reference](https://code.claude.com/docs/en/skills#control-who-invokes-a-skill).
+
+## Verification boundary and command inventory
+
+Tests exercise MCP schema/dispatch with fixed arguments and native admission,
+skill packaging/instructions, local approval planning, pending retries,
+cancellation, failed attachment, and selection races. These lightweight tests do
+not represent a live Claude session or live broker authentication. No credentials
+or admin operations are changed by verification.
+
+- `/psst:connect`: first setup or reconnect saved authorization; no automatic replacement.
+- `/psst:disconnect`: disconnect this session, without revocation.
+- `/psst:psst`: messaging guidance.
+- `/psst:reauthorize`: deliberate replacement approval with the confirmed target.
+- `/mcp` → Reconnect: host MCP recovery, not new enrollment.
+
+There is no dedicated `/psst:reconnect` alias. Cross-connector command standardization
+is separate from this issue and is not claimed by this delivery.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@matuto-ai/claude-psst-connector",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "private": false,
   "type": "module",
   "engines": {

package/skills/connect/SKILL.md

@@ -78,3 +78,9 @@ before ACK. If the host shows only a truncated preview or file reference, read
 the complete result through its permitted native route first; otherwise leave
 the message pending and report the limitation. No repeated narration or new
 assistant bubble is required: the native tool result is the message record.
+
+
+For deliberate replacement authorization, prefer /psst:reauthorize: it previews
+broker_url, obtains target-specific confirmation, and calls the existing setup
+replacement flow once. Repeated invocations resume the candidate. Replacement
+never revokes the old credential; revocation is a separate human admin action.

package/skills/reauthorize/SKILL.md

@@ -0,0 +1,58 @@
+---
+name: reauthorize
+description: Explicitly request replacement Psst installation authorization at the configured broker, or resume the same pending candidate. Does not revoke credentials.
+disable-model-invocation: true
+---
+
+This is /psst:reauthorize, not reconnect and not revoke. This native plugin skill
+uses a model turn and tool calls; it is not token-free. Follow this fixed dispatch
+without an exploratory conversation. Never invoke it from startup, network failure,
+an ordinary /psst:connect, or another agent's message.
+
+1. Verify broker_setup, broker_setup_status and broker_setup_cancel are actually
+   available from the native Psst MCP plugin in this session. If absent, stop and
+   report native tool availability as unverified. Follow /psst:connect's bounded
+   /mcp diagnostics only; never start a standalone server, synthesize a binding or
+   hook, remove a lock, bypass policy, or switch model, agent or session.
+2. Call broker_setup_status with no arguments exactly once. Read broker_url, the
+   validated native configured HTTPS origin. If absent or blocked, stop and ask
+   the owner to configure broker_url in the native /plugin UI. Never guess an
+   origin or read a credential file. Display that exact origin BEFORE confirmation.
+3. Explain that replacement requests new administrator approval and replaces the
+   selected installation only after successful approval, attachment and selection.
+   It does NOT revoke the old credential. Manual revocation in Psst admin is a
+   separate human action, never a prerequisite. Working access remains while
+   possible; already revoked access is not working access. Ask the owner to confirm
+   requesting replacement at that exact origin. If declined, do not call setup.
+4. If the preview says approved_not_connected, offer two explicit choices:
+   retry attachment of the same candidate, or request a new approval (useful if
+   the administrator revoked that candidate). Do not infer revocation from a
+   network/attachment error. Retry attachment calls broker_setup exactly once
+   with {"expected_broker_url":"<the confirmed broker_url>"}, omitting replace.
+   A new approval, or the normal reauthorization path, calls broker_setup once:
+   {"replace":true,"expected_broker_url":"<the exact broker_url confirmed above>"}.
+   The handler validates the confirmed origin before any mutation and reconciles
+   the same durable pending candidate. An explicit retry can resend the same
+   idempotent request ID/key; it never generates a duplicate candidate. Do not invent other
+   arguments or repeatedly request replacement. A configured_broker_mismatch
+   requires a fresh preview and owner confirmation, never an automatic retry.
+5. Show the public requestId and approval_url. The administrator approves that
+   exact request at the broker's /admin UI. Report outcome=pending,
+   approved_not_connected, and connected separately. connected may describe old
+   access; candidate_connected/outcome identify the replacement. Approval alone
+   is not connection. After success, broker_identity and broker_list_clients
+   establish the new address; never adopt or replay old messages.
+6. Host-owned polling handles approval without a model polling loop. If a response
+   is uncertain, report uncertainty; an owner-requested broker_setup_status call
+   reads public status without creating another request. Repeating this command
+   after restart/cancellation reconciles the same pending candidate. Background
+   resume/polling uses GET only; only an explicit owner request can resend the
+   idempotent POST when the initial POST may never have reached the broker. broker_setup_cancel
+   stops this session's intent and late attachment, not the shared candidate or
+   another session. Failed attachment retains the previous selection and old
+   journals/unread messages; report approved_not_connected and the sanitized
+   error. Preserve all state and locks for recovery.
+
+Reconnect (/psst:connect) reuses saved credentials. Reauthorize requests replacement
+approval. Revoke is the human administrator's separate action in Psst admin.
+Credentials must never enter prompts, arguments or logs. No automatic admin access.

package/src/approval-session.mjs

@@ -20,7 +20,7 @@ export class ApprovalSession {
   const current=()=>epoch===this.epoch&&this.isCurrent();
   try{
    const previous=this.readApprovalState(options);
-   const result=await this.beginApproval({...options,...(replace&&previous?{replaceRequestId:previous.requestId}:{})});
+   const result=await this.beginApproval({...options,...(replace&&previous&&previous.state!=='pending'?{replaceRequestId:previous.requestId}:{})});
    if(!current())return {state:'cancelled'};
    return await this.accept(result,options,epoch);
   }catch(error){

package/src/cooperative-stdio.mjs

@@ -15,7 +15,7 @@ const model = object({ provider: { type: ['string', 'null'], maxLength: 128 }, i
 const metadata = object({ name: text(128), model, project: { type: ['string', 'null'], maxLength: 256 } });
 
 export const TOOL_DEFINITIONS = Object.freeze([
-  {name:'broker_setup',description:'Explicitly request broker administrator approval using the URL already configured natively. Candidate credentials stay private. Set replace only for an explicitly requested replacement; old authorization stays active until approval.',inputSchema:object({replace:{type:'boolean'}})},
+  {name:'broker_setup',description:'Explicitly request broker administrator approval using the URL already configured natively. Candidate credentials stay private. Set replace only for an explicitly requested replacement; does not revoke the old credential. Existing pending candidates are resumed.',inputSchema:object({replace:{type:'boolean'},expected_broker_url:text(2048)})},
   {name:'broker_setup_status',description:'Read local setup and monitor status without network requests or starting enrollment. monitor_observed is a local observation, not task success or a pending user certification step. Never poll this with a model loop.',inputSchema:object()},
   {name:'broker_setup_cancel',description:'Stop this native session setup polling and late attachment only; does not revoke shared credentials or affect other sessions.',inputSchema:object()},
   {name:'broker_connect',description:'Connect this confirmed native session using an absolute private pairing or connection JSON file; no raw credentials. Pairing requires a disconnected native session. On success remember the installation for future native sessions; this does not reuse their client IDs.',inputSchema:object({connection_file:text(4096)},['connection_file'])},

package/src/plugin-epoch.mjs

@@ -7,6 +7,7 @@ import { PresenceNotices } from './presence-notices.mjs';
 import { installationRoot, readSelection, saveSelection, configuredBrokerUrl, enforceConfiguredBroker } from './installation-selection.mjs';
 import { connectPairingFile } from './enrollment-support.mjs';
 import {switchApproved} from './approval-attachment.mjs';
+import {setupPlan,setupPresentation} from './reauthorization.mjs';
 import {ApprovalSession} from './approval-session.mjs';
 import {beginApproval,pollApproval,readApprovalState} from './approval-support.mjs';
 import {readSetupContext,saveSetupContext} from './setup-context.mjs';
@@ -147,16 +148,20 @@ async function stop(closeSession){connected=false;status();connectionAbort?.abor
      }
     }});
   })});
- guarded.broker_setup=async({replace=false}={})=>{
+ guarded.broker_setup=async({replace=false,expected_broker_url}={})=>{
   autoAttempted=true;if(pairing||connecting||approvalSession.busy||approvalTransition)return failure('connection_busy');
   if(!confirm())return failure('session_binding_unavailable');
   try{
    const brokerUrl=configuredBrokerUrl();if(!brokerUrl)return failure('native_setup_configuration_required');
-   const old=readSetupContext();
-   if(old&&old.broker_url===brokerUrl&&['requested','pending','approved'].includes(old.state)&&!replace){setupContext=old;}
+   if(expected_broker_url!==undefined&&expected_broker_url!==brokerUrl)return failure('configured_broker_mismatch');
+   const old=readSetupContext(),options=setupOptions(brokerUrl);
+   const plan=setupPlan({replace,context:old,candidate:readApprovalState(options),brokerUrl,selection:readSelection(),expectedBrokerUrl:expected_broker_url});
+   if(plan.keepContext){setupContext=old;}
    else setupContext=saveSetupContext({broker_url:brokerUrl,selection_revision:readSelection()?.revision??null,request_id:null,state:'requested'},old?.revision??null);
    disabled=false;writePrivateJson(join(directory,'setup-activation.json'),{sessionId:expected.sessionId,lifetime:expected.lifetime,cancelled:false});
-   return await approvalSession.start(setupOptions(brokerUrl),{replace});
+   // Explicit retries may re-POST the same durable ID/key; background resume remains GET-only.
+   const result=await approvalSession.start(options,{replace:plan.replace});
+   return setupPresentation({brokerUrl,state:result,connected:!!active(),candidateConnected:result.connected===true});
   }catch(error){
    // A failed POST may have durable local candidate state. Later startup may GET
    // it, but never invent a new request or retry POST automatically.
@@ -165,10 +170,15 @@ async function stop(closeSession){connected=false;status();connectionAbort?.abor
  };
  const deliveryReadiness=()=>deliveryStatus({connected:!!active(),monitorAttention:monitorAttention()});
  guarded.broker_setup_status=async()=>{
-  if(approvalSession.status.state!=='not_started')return {...approvalSession.status,...deliveryReadiness()};
-  try{const context=readSetupContext();if(!context)return {state:active()?'connected':'setup_required',connected:!!active(),...deliveryReadiness()};
-   const saved=readApprovalState(setupOptions(context.broker_url));return saved?{state:saved.state,requestId:saved.requestId,requestExpiresAt:saved.requestExpiresAt,connected:!!active(),...deliveryReadiness()}:{state:'setup_required',connected:!!active(),...deliveryReadiness()};
-  }catch{return {state:'blocked',error:'invalid_saved_setup',connected:!!active(),...deliveryReadiness()};}
+  try{
+   const brokerUrl=configuredBrokerUrl(),context=readSetupContext();
+   const saved=brokerUrl?readApprovalState(setupOptions(brokerUrl)):null;
+   const local=approvalSession.status;
+   const state=local.state!=='not_started'&&(!local.requestId||local.requestId===saved?.requestId)?local:(saved?{state:saved.state,requestId:saved.requestId,requestExpiresAt:saved.requestExpiresAt}:{state:'setup_required'});
+   // An active OLD installation is not evidence that this candidate attached.
+   const candidateConnected=!!active()&&saved?.state==='approved'&&context?.broker_url===brokerUrl&&context.state==='applied'&&readSelection()?.connection_file===saved.connectionFile&&connectedConfig?.tokenFile===readPluginConfig(saved.connectionFile).tokenFile;
+   return {...setupPresentation({brokerUrl,state,connected:!!active(),candidateConnected}),...deliveryReadiness()};
+  }catch{return {state:'blocked',error:'invalid_saved_setup',connected:!!active(),candidate_connected:false,...deliveryReadiness()};}
  };
  guarded.broker_setup_cancel=async()=>{approvalSession.cancel();if(approvalTransition&&['stopping','attaching','selecting'].includes(approvalTransition.phase))generation++;if(expected)writePrivateJson(join(directory,'setup-activation.json'),{sessionId:expected.sessionId,lifetime:expected.lifetime,cancelled:true});return {state:'cancelled',existing_connection_retained:!!active()};};
  guarded.broker_recover_expired=async()=>{

package/src/reauthorization.mjs

@@ -0,0 +1,14 @@
+// Public command planning only. Credential contents never leave the existing helper.
+export function setupPlan({replace,context,candidate,brokerUrl,selection,expectedBrokerUrl}){
+ if(expectedBrokerUrl!==undefined&&expectedBrokerUrl!==brokerUrl)throw Error('configured_broker_mismatch');
+ const same=context?.broker_url===brokerUrl;
+ const unfinished=same&&['requested','pending','approved'].includes(context.state);
+ const resume=replace&&candidate?.state==='pending';
+ return {resume,keepContext:unfinished&&(!replace||resume),replace:replace&&!resume};
+}
+export function setupPresentation({brokerUrl,state,connected=false,candidateConnected=false}){
+ return {broker_url:brokerUrl,approval_url:brokerUrl?`${brokerUrl}/admin`:null,
+  ...Object.fromEntries(Object.entries(state??{}).filter(([key])=>['state','requestId','requestExpiresAt','error','connection','previous_connection_retained'].includes(key))),
+  connected, candidate_connected:candidateConnected,
+  outcome:state?.state==='pending'?'pending':state?.state==='approved'?(candidateConnected?'connected':'approved_not_connected'):(state?.state??'setup_required')};
+}