@rehearsal-db/core 0.1.0-beta.16 → 0.1.0-beta.17

package/CHANGELOG.md

@@ -5,6 +5,19 @@ a Changelog, and versions will follow Semantic Versioning after the package exis
 
 ## Unreleased
 
+## [0.1.0-beta.17] - 2026-10-08
+
+### Added
+
+- `rehearsal identity connect` and the guided home screen now keep the sandbox app
+  available during ordinary provider sign-in, detect exactly one approved verified local
+  identity, show a redacted copied-account preview, and apply the existing exact claim
+  after one deliberate confirmation. The app is reopened automatically with an honest
+  fresh-session instruction; explicit `identity plan` and `identity claim` commands remain
+  available for scripts.
+
+## [0.1.0-beta.16] - 2026-10-08
+
 ### Changed
 
 - The CLI now routes guided and scripted requests through focused typed command

package/dist/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@rehearsal-db/core",
-    "version": "0.1.0-beta.16",
+    "version": "0.1.0-beta.17",
     "private": false,
     "description": "Safely rehearse PostgreSQL and Supabase migrations against sanitized, production-shaped data.",
     "repository": {

package/dist/src/application/interactive_task.d.mts

@@ -0,0 +1,30 @@
+/** Run identity discovery while an owned local application remains available. */
+import type { EventEmitter } from "node:events";
+import { type ApplicationDiagnostics, type ApplicationSession, type ApplicationSessionSignal } from "./session.mjs";
+type SignalTarget = Pick<EventEmitter, "prependListener" | "removeListener">;
+interface SessionInput {
+    readonly isTTY?: boolean;
+    prependListener(event: "data", listener: (chunk: Buffer | string) => void): unknown;
+    removeListener(event: "data", listener: (chunk: Buffer | string) => void): unknown;
+}
+/**
+ * A terminal interruption aborts the task and retires the owned process group.
+ * A completed task leaves the session running so its caller can deliberately
+ * stop, reuse, or hand it back to the persistent application holder.
+ */
+export declare const runApplicationSessionTask: <Value>({ session, task, signalTarget, input, onReady, }: {
+    session: ApplicationSession;
+    task: (signal: AbortSignal) => Promise<Value>;
+    signalTarget?: SignalTarget;
+    input?: SessionInput;
+    onReady?: (ready: ApplicationSession["ready"]) => void;
+}) => Promise<Readonly<{
+    completed: true;
+    value: Value;
+    diagnostics: ApplicationDiagnostics;
+}> | Readonly<{
+    completed: false;
+    signal: ApplicationSessionSignal;
+    diagnostics: ApplicationDiagnostics;
+}>>;
+export {};

package/dist/src/application/interactive_task.mjs

@@ -0,0 +1,83 @@
+/** Run identity discovery while an owned local application remains available. */
+import { summarizeProjectCommandFailure, } from "./session.mjs";
+const SESSION_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP", "SIGTSTP"];
+/**
+ * A terminal interruption aborts the task and retires the owned process group.
+ * A completed task leaves the session running so its caller can deliberately
+ * stop, reuse, or hand it back to the persistent application holder.
+ */
+export const runApplicationSessionTask = async ({ session, task, signalTarget = process, input = process.stdin, onReady = () => undefined, }) => {
+    if (!session ||
+        typeof session.wait !== "function" ||
+        typeof session.stop !== "function") {
+        throw new Error("A started application session is required.");
+    }
+    let finishInterruption = () => undefined;
+    const interruption = new Promise((resolve) => {
+        finishInterruption = resolve;
+    });
+    const handlers = new Map(SESSION_SIGNALS.map((signal) => [
+        signal,
+        () => finishInterruption({ kind: "interrupted", signal }),
+    ]));
+    for (const [signal, handler] of handlers) {
+        signalTarget.prependListener(signal, handler);
+    }
+    const onInput = (chunk) => {
+        const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        if (bytes.includes(0x03)) {
+            finishInterruption({ kind: "interrupted", signal: "SIGINT" });
+        }
+        else if (bytes.includes(0x1a)) {
+            finishInterruption({ kind: "interrupted", signal: "SIGTSTP" });
+        }
+    };
+    if (input?.isTTY)
+        input.prependListener("data", onInput);
+    const abortController = new AbortController();
+    try {
+        onReady(session.ready);
+        const outcome = await Promise.race([
+            interruption,
+            task(abortController.signal).then((value) => ({
+                kind: "completed",
+                value,
+            })),
+            session.wait().then((exit) => ({ kind: "exited", ...exit })),
+        ]);
+        if (outcome.kind === "exited") {
+            throw new Error(`Application exited before identity connection finished (${summarizeProjectCommandFailure({
+                status: outcome.status,
+                signal: outcome.signal,
+                stdoutByteCount: session.diagnostics().stdoutBytes,
+                stderrByteCount: session.diagnostics().stderrBytes,
+            })}).`);
+        }
+        if (outcome.kind === "interrupted") {
+            abortController.abort(new Error(`Identity connection was interrupted by ${outcome.signal}.`));
+            await session.stop();
+            return Object.freeze({
+                completed: false,
+                signal: outcome.signal,
+                diagnostics: session.diagnostics(),
+            });
+        }
+        return Object.freeze({
+            completed: true,
+            value: outcome.value,
+            diagnostics: session.diagnostics(),
+        });
+    }
+    catch (error) {
+        abortController.abort(error);
+        await session.stop();
+        throw error;
+    }
+    finally {
+        for (const [signal, handler] of handlers) {
+            signalTarget.removeListener(signal, handler);
+        }
+        if (input?.isTTY)
+            input.removeListener("data", onInput);
+    }
+};

package/dist/src/application/session.d.mts

@@ -3,6 +3,7 @@ import { spawn } from "node:child_process";
 import type { EventEmitter } from "node:events";
 declare const SESSION_SIGNALS: string[];
 type SessionSignal = (typeof SESSION_SIGNALS)[number];
+export type ApplicationSessionSignal = SessionSignal;
 export interface ApplicationReadiness {
     readonly url: string;
     readonly expectedStatus?: number;

package/dist/src/cli/arguments.mjs

@@ -113,6 +113,8 @@ export const commandMutatesProject = ({ command, flags, guided, }) => {
         return Boolean(flags.refreshConfirmation);
     if (command === "identity claim")
         return Boolean(flags.identityConfirmation);
+    if (command === "identity connect")
+        return true;
     if (command === "run")
         return !flags.dryRun;
     return [

package/dist/src/cli/basic_command_handlers.mjs

@@ -18,6 +18,7 @@ Commands:
   refresh [--confirm-refresh=] Replace the database copy, reset locally, and remove old copies
   identity plan --identity=   Preview an approved local identity association
   identity claim --identity= --confirm-identity= Apply the exact local association
+  identity connect [--identity=] Keep the app open, detect sign-in, and connect once
   doctor                     Check whether Rehearsal is safe and ready
   support                    Print a safe, copy-ready support report
   explain                    Show the immutable execution plan

package/dist/src/cli/cli_commands.mjs

@@ -18,6 +18,8 @@ export const createCliCommandRegistry = ({ projectRoot, projectCommands, runtime
     ...createSourceCommandHandlers({ runRefreshWorkflow }),
     ...createIdentityCommandHandlers({
         loadIdentityClaimPlan: projectCommands.loadIdentityClaimPlan,
+        loadIdentityPolicy: projectCommands.loadIdentityPolicy,
+        startRuntimeApplication: runtimeCommands.startRuntimeApplication,
     }),
     ...createInspectionCommandHandlers(),
     ...createApplicationCommandHandlers({

package/dist/src/cli/guided.mjs

@@ -95,6 +95,7 @@ const inspectGuidedProject = async ({ projectRoot, planOptions, topologyCandidat
         policyAbsolutePath: loaded.paths.sanitizationPolicy,
         ...(migrationSummary === undefined ? {} : { migrationSummary }),
         refreshConfigured: Boolean(loaded.config.preparation),
+        identityConfigured: Boolean(loaded.paths.identityPolicy),
         dependentCount: topology?.dependents.length ?? 0,
         runtime: topology
             ? (await Promise.all(topology.targets.map((target) => pathExists(join(target.paths.runtimeWorkdir, "baseline.json"))))).every(Boolean)
@@ -334,6 +335,13 @@ const guidedOptions = (state, hasLastDetails) => {
         options.push({ label: "Check readiness", command: "doctor" });
     }
     if (state.node.supported && state.runtime) {
+        if (state.identityConfigured) {
+            options.push({
+                label: "Connect my copied account",
+                hint: "Sign in normally, review once, then open the copied profile",
+                command: "identity connect",
+            });
+        }
         options.push({
             label: "Open the sandbox app",
             hint: "Keep it running for hands-on testing",

package/dist/src/cli/identity_command_handlers.d.mts

@@ -1,8 +1,12 @@
-/** Provider-neutral copied-account planning and application handlers. */
+/** Provider-neutral copied-account planning, application, and guided connection. */
 import type { CommandDefinition } from "./command_contract.mjs";
 import type { createProjectCommands } from "./project_commands.mjs";
+import type { createRuntimeCommands } from "./runtime_commands.mjs";
 type ProjectCommands = ReturnType<typeof createProjectCommands>;
-export declare const createIdentityCommandHandlers: ({ loadIdentityClaimPlan, }: {
+type RuntimeCommands = ReturnType<typeof createRuntimeCommands>;
+export declare const createIdentityCommandHandlers: ({ loadIdentityClaimPlan, loadIdentityPolicy, startRuntimeApplication, }: {
     loadIdentityClaimPlan: ProjectCommands["loadIdentityClaimPlan"];
+    loadIdentityPolicy: ProjectCommands["loadIdentityPolicy"];
+    startRuntimeApplication: RuntimeCommands["startRuntimeApplication"];
 }) => readonly CommandDefinition[];
 export {};

package/dist/src/cli/identity_command_handlers.mjs

@@ -1,36 +1,232 @@
-/** Provider-neutral copied-account planning and application handlers. */
+/** Provider-neutral copied-account planning, application, and guided connection. */
 import { readFile } from "node:fs/promises";
 import { parseEnv } from "node:util";
+import * as prompts from "@clack/prompts";
+import { holdApplicationSession } from "../application/session.mjs";
+import { runApplicationSessionTask } from "../application/interactive_task.mjs";
 import { applyIdentityClaim } from "../identity/claim.mjs";
+import { waitForIdentityConnection } from "../identity/connect.mjs";
 import { createSupabaseStorageTransfer } from "../identity/storage.mjs";
-import { exactCommands, renderedCommand } from "./command_contract.mjs";
+import { exactCommands, renderedCommand, textCommand, } from "./command_contract.mjs";
+import { renderIdentityConnection } from "./identity_renderer.mjs";
 import { renderIdentityPlan } from "./renderers.mjs";
-export const createIdentityCommandHandlers = ({ loadIdentityClaimPlan, }) => [
-    exactCommands("identity", ["identity plan", "identity claim"], async ({ command, flags, planOptions }) => {
+import { isHumanTerminal, promptForConfirmation, promptForSelection, useStyledPrompts, } from "./terminal.mjs";
+const loadIdentityRuntime = async (loaded) => {
+    const environment = parseEnv(await readFile(loaded.paths.applicationEnvironment, "utf8"));
+    if (!environment.DATABASE_URL) {
+        throw new Error("The local runtime environment has no DATABASE_URL.");
+    }
+    return environment;
+};
+const storageTransferFor = ({ plan, environment, }) => {
+    const needsStorageTransfer = plan.identity.assets.some((asset) => asset.rewritePath);
+    if (!needsStorageTransfer)
+        return undefined;
+    if (!environment.SUPABASE_URL || !environment.SUPABASE_SERVICE_ROLE_KEY) {
+        throw new Error("Identity asset transfer requires local Supabase URL and service-role credentials.");
+    }
+    return createSupabaseStorageTransfer({
+        url: environment.SUPABASE_URL,
+        serviceRoleKey: environment.SUPABASE_SERVICE_ROLE_KEY,
+    });
+};
+export const createIdentityCommandHandlers = ({ loadIdentityClaimPlan, loadIdentityPolicy, startRuntimeApplication, }) => [
+    exactCommands("identity", ["identity plan", "identity claim", "identity connect"], async ({ command, flags, planOptions, guided, state }) => {
+        if (command === "identity connect") {
+            if (!isHumanTerminal(flags)) {
+                throw new Error("identity connect requires an interactive terminal. Scripts should keep using identity plan and identity claim.");
+            }
+            if (!flags.identityName) {
+                const { policy } = await loadIdentityPolicy({
+                    flags,
+                    planOptions,
+                    session: state,
+                });
+                if (policy.identities.length === 1) {
+                    flags.identityName = policy.identities[0].name;
+                }
+                else {
+                    const selected = await promptForSelection({
+                        message: "Which copied account would you like to connect?",
+                        flags,
+                        options: policy.identities.map((identity) => ({
+                            label: identity.name,
+                            value: identity.name,
+                        })),
+                    });
+                    if (!selected) {
+                        return textCommand("COPIED ACCOUNT CONNECTION CANCELLED\nNothing was changed.");
+                    }
+                    flags.identityName = selected;
+                }
+            }
+            const initial = await loadIdentityClaimPlan({
+                flags,
+                planOptions,
+                session: state,
+            });
+            const initialEnvironment = await loadIdentityRuntime(initial.loaded);
+            let active;
+            let reopened;
+            try {
+                active = await startRuntimeApplication({
+                    flags,
+                    planOptions,
+                    session: state,
+                });
+                const observed = await runApplicationSessionTask({
+                    session: active.session,
+                    onReady: (ready) => {
+                        const lines = [
+                            `Application: ${ready.url}`,
+                            "Sign in normally with the provider allowed by your reviewed identity policy.",
+                            "Rehearsal will continue when exactly one approved, verified local identity appears.",
+                            "It never reads your provider password, passkey, MFA secret, browser cookies, or session tokens.",
+                            "Press Ctrl+C to cancel or Ctrl+Z to exit Rehearsal.",
+                        ];
+                        if (useStyledPrompts(flags)) {
+                            prompts.note(lines.join("\n"), "SIGN IN TO THE SANDBOX");
+                        }
+                        else {
+                            console.log(["", "SIGN IN TO THE SANDBOX", ...lines, ""].join("\n"));
+                        }
+                    },
+                    task: (signal) => waitForIdentityConnection({
+                        plan: initial.plan,
+                        connectionString: initialEnvironment.DATABASE_URL,
+                        signal,
+                    }),
+                });
+                if (!observed.completed) {
+                    if (guided && observed.signal === "SIGTSTP") {
+                        flags.exitGuidedSession = true;
+                    }
+                    return textCommand([
+                        "COPIED ACCOUNT CONNECTION CANCELLED",
+                        `Application stopped after ${observed.signal}.`,
+                        "Nothing was changed. The database runtime was preserved.",
+                    ].join("\n"));
+                }
+                const preview = observed.value;
+                if (preview.associated) {
+                    const closed = await holdApplicationSession({
+                        session: active.session,
+                        onReady: () => {
+                            const message = renderIdentityConnection({
+                                mode: "already-connected",
+                                preview,
+                            });
+                            if (useStyledPrompts(flags)) {
+                                prompts.note(message, "SANDBOX READY");
+                            }
+                            else {
+                                console.log(`\n${message}\n`);
+                            }
+                        },
+                    });
+                    if (guided && closed.signal === "SIGTSTP") {
+                        flags.exitGuidedSession = true;
+                    }
+                    return renderedCommand({
+                        data: {
+                            mode: "already-connected",
+                            preview,
+                            application: { stoppedBy: closed.signal },
+                        },
+                        render: ({ mode, preview: renderedPreview }) => renderIdentityConnection({ mode, preview: renderedPreview }),
+                    });
+                }
+                await active.session.stop();
+                console.log(`\n${renderIdentityConnection({ mode: "preview", preview })}\n`);
+                const accepted = await promptForConfirmation("Connect my copied account using exactly this plan?", flags);
+                if (!accepted) {
+                    return renderedCommand({
+                        data: { mode: "cancelled", preview },
+                        render: ({ mode, preview: renderedPreview }) => renderIdentityConnection({ mode, preview: renderedPreview }),
+                    });
+                }
+                const refreshed = await loadIdentityClaimPlan({
+                    flags,
+                    planOptions,
+                    session: state,
+                });
+                if (refreshed.plan.digest !== preview.planDigest) {
+                    throw new Error("The reviewed identity plan changed after sign-in. Nothing was changed; start the connection again.");
+                }
+                const refreshedEnvironment = await loadIdentityRuntime(refreshed.loaded);
+                const storageTransfer = storageTransferFor({
+                    plan: refreshed.plan,
+                    environment: refreshedEnvironment,
+                });
+                const result = await applyIdentityClaim({
+                    plan: refreshed.plan,
+                    confirmation: preview.planDigest,
+                    connectionString: refreshedEnvironment.DATABASE_URL,
+                    ...(storageTransfer === undefined ? {} : { storageTransfer }),
+                });
+                reopened = await startRuntimeApplication({
+                    flags,
+                    planOptions,
+                    session: state,
+                });
+                const closed = await holdApplicationSession({
+                    session: reopened.session,
+                    onReady: (ready) => {
+                        const lines = [
+                            renderIdentityConnection({
+                                mode: "connected",
+                                preview,
+                                result,
+                            }),
+                            "",
+                            `Application: ${ready.url}`,
+                            "The app is running again. Sign out and sign in once for fresh claims.",
+                            "Press Ctrl+C to close the app or Ctrl+Z to exit Rehearsal.",
+                        ];
+                        if (useStyledPrompts(flags)) {
+                            prompts.note(lines.join("\n"), "ACCOUNT CONNECTED");
+                        }
+                        else {
+                            console.log(["", ...lines, ""].join("\n"));
+                        }
+                    },
+                });
+                if (guided && closed.signal === "SIGTSTP") {
+                    flags.exitGuidedSession = true;
+                }
+                return renderedCommand({
+                    data: {
+                        mode: "connected",
+                        preview,
+                        result,
+                        application: { stoppedBy: closed.signal },
+                    },
+                    render: ({ mode, preview: renderedPreview, result: claimResult }) => renderIdentityConnection({
+                        mode,
+                        preview: renderedPreview,
+                        result: claimResult,
+                    }),
+                });
+            }
+            finally {
+                await active?.session.stop();
+                await reopened?.session.stop();
+            }
+        }
         const { loaded, plan } = await loadIdentityClaimPlan({
             flags,
             planOptions,
+            session: state,
         });
         if (command === "identity plan" || !flags.identityConfirmation) {
             const data = { mode: "preview", plan };
             return renderedCommand({ data, render: renderIdentityPlan });
         }
-        const runtimeEnvironment = parseEnv(await readFile(loaded.paths.applicationEnvironment, "utf8"));
-        if (!runtimeEnvironment.DATABASE_URL) {
-            throw new Error("The local runtime environment has no DATABASE_URL.");
-        }
-        const needsStorageTransfer = plan.identity.assets.some((asset) => asset.rewritePath);
-        if (needsStorageTransfer &&
-            (!runtimeEnvironment.SUPABASE_URL ||
-                !runtimeEnvironment.SUPABASE_SERVICE_ROLE_KEY)) {
-            throw new Error("Identity asset transfer requires local Supabase URL and service-role credentials.");
-        }
-        const storageTransfer = needsStorageTransfer
-            ? createSupabaseStorageTransfer({
-                url: runtimeEnvironment.SUPABASE_URL,
-                serviceRoleKey: runtimeEnvironment.SUPABASE_SERVICE_ROLE_KEY,
-            })
-            : undefined;
+        const runtimeEnvironment = await loadIdentityRuntime(loaded);
+        const storageTransfer = storageTransferFor({
+            plan,
+            environment: runtimeEnvironment,
+        });
         const result = await applyIdentityClaim({
             plan,
             confirmation: flags.identityConfirmation,

package/dist/src/cli/identity_renderer.d.mts

@@ -0,0 +1,8 @@
+/** Redacted terminal output for the interactive copied-account connection. */
+import type { IdentityClaimResult } from "../identity/claim_contract.mjs";
+import type { IdentityConnectionPreview } from "../identity/connect.mjs";
+export declare const renderIdentityConnection: ({ mode, preview, result, }: {
+    mode: "preview" | "connected" | "already-connected" | "cancelled";
+    preview: IdentityConnectionPreview;
+    result?: IdentityClaimResult;
+}) => string;

package/dist/src/cli/identity_renderer.mjs

@@ -0,0 +1,33 @@
+/** Redacted terminal output for the interactive copied-account connection. */
+export const renderIdentityConnection = ({ mode, preview, result, }) => [
+    `COPIED ACCOUNT — ${mode.replaceAll("-", " ").toUpperCase()}`,
+    `Account label: ${preview.name}`,
+    `Verified provider: ${preview.provider}`,
+    `Data groups: ${preview.relationalGroups} relational; ${preview.nestedJsonGroups} nested JSON`,
+    `Images: ${preview.assetScopes} reviewed Storage scope${preview.assetScopes === 1 ? "" : "s"}; ${preview.storagePathGroups} path reference group${preview.storagePathGroups === 1 ? "" : "s"}`,
+    `Permissions: ${preview.claimKeys} reviewed claim${preview.claimKeys === 1 ? "" : "s"}; token hook ${preview.tokenHookConfigured ? "verified during connection" : "not configured"}`,
+    `Immutable history: ${preview.preservedAuditGroups} reference group${preview.preservedAuditGroups === 1 ? "" : "s"} stays with the copied audit identity`,
+    `Plan: ${preview.planDigest.slice(0, 12)}`,
+    "",
+    ...(mode === "preview"
+        ? [
+            "This changes only the disposable local sandbox.",
+            "Edited or independent local account data will make the connection stop safely.",
+            "Nothing has changed yet.",
+        ]
+        : mode === "cancelled"
+            ? [
+                "Nothing was changed. Your local database runtime is still available.",
+            ]
+            : mode === "already-connected"
+                ? [
+                    "This copied account is already connected in the current local runtime.",
+                    "No transfer was repeated.",
+                ]
+                : [
+                    `Transferred images: ${result?.storageObjectsTransferred ?? 0}`,
+                    `Removed untouched signup defaults: ${result?.removedSignupDefaults ?? 0}`,
+                    "The copied account is connected and verified.",
+                    "Sign out and sign in once more so the application receives fresh role claims.",
+                ]),
+].join("\n");

package/dist/src/cli/project_commands.d.mts

@@ -27,7 +27,7 @@ export declare const createProjectCommands: ({ projectRoot, runManager, }: {
     projectRoot: string;
     runManager: RunManager;
 }) => Readonly<{
-    loadIdentityClaimPlan: ({ flags, planOptions, }: ProjectCommandInput) => Promise<{
+    loadIdentityClaimPlan: ({ flags, planOptions, session, }: ProjectCommandInput) => Promise<{
         loaded: Readonly<{
             config: Readonly<{
                 schemaVersion: 1;
@@ -151,6 +151,130 @@ export declare const createProjectCommands: ({ projectRoot, runManager, }: {
         }>;
         plan: import("../identity/claim_contract.mjs").IdentityClaimPlan;
     }>;
+    loadIdentityPolicy: ({ planOptions }: ProjectCommandInput) => Promise<{
+        loaded: Readonly<{
+            config: Readonly<{
+                schemaVersion: 1;
+                project: Readonly<{
+                    name: string;
+                }>;
+                supabase: Readonly<{
+                    workdir: string;
+                    migrationDirectory: string;
+                    rehearsalConfig: string;
+                    runtimeWorkdir: string;
+                    authentication: Readonly<{
+                        enableLocalSignup: true;
+                        environmentFile: string;
+                        providers: readonly Readonly<{
+                            name: "github" | "google";
+                            clientIdEnvironmentVariable: string;
+                            clientSecretEnvironmentVariable: string;
+                            skipNonceCheck: boolean;
+                            emailOptional: boolean;
+                        }>[];
+                    }> | null;
+                    serviceEnvironmentFile: string | null;
+                    serviceEnvironmentVariables: readonly string[];
+                }> | null;
+                postgresql: Readonly<{
+                    migrationDirectory: string;
+                    runtimeWorkdir: string;
+                    image: string;
+                    database: string;
+                    user: string;
+                }> | null;
+                baseline: Readonly<{
+                    artifactDirectory: string;
+                    sanitizationPolicy: string;
+                }>;
+                containerRuntime: Readonly<{
+                    autoStartColima: boolean;
+                }>;
+                cleanup: Readonly<{
+                    retainBaselineGenerations: number;
+                }>;
+                preparation: Readonly<{
+                    sourcePolicy: string;
+                    privacyKey: string;
+                    batchRows: number;
+                    maximumRows: number;
+                    maximumBytes: number;
+                    diskHeadroomBytes: number;
+                }> | null;
+                runtimePolicy: string | null;
+                identityPolicy: string | null;
+                dependentTargets: readonly Readonly<{
+                    name: string;
+                    configPath: string;
+                    prepareCommand: string | null;
+                }>[];
+                application: Readonly<{
+                    startCommand: string;
+                    proofCommand: string;
+                    environmentFile: string;
+                    environmentVariables: Readonly<Record<string, string>>;
+                    readiness: Readonly<{
+                        url: string;
+                        expectedStatus: number;
+                        timeoutSeconds: number;
+                    }> | null;
+                    httpProofs: readonly Readonly<{
+                        name: string;
+                        kind: "positive" | "negative";
+                        url: string;
+                        method: string;
+                        expectedStatus: number;
+                        json: Readonly<{
+                            path: readonly string[];
+                            equals?: unknown;
+                            notEquals?: unknown;
+                            minimumItems?: number;
+                        }> | null;
+                    }>[];
+                    runtimeAdapter: string | null;
+                }>;
+                runtime: Readonly<{
+                    target: "postgresql" | "supabase";
+                    applicationUrl: string;
+                    projectId: string;
+                    ports: Readonly<{
+                        api?: number;
+                        database: number;
+                        studio?: number;
+                    }>;
+                }>;
+                safety: Readonly<{
+                    allowedHosts: readonly string[];
+                    blockedEnvironmentVariables: readonly string[];
+                    authenticationProviders: readonly string[];
+                    hostedAccess: "disabled";
+                    outboundNetwork: "deny";
+                }>;
+                verification: Readonly<{
+                    commands: readonly string[];
+                }>;
+            }>;
+            configPath: string;
+            projectRoot: string;
+            paths: Readonly<{
+                artifactDirectory: string;
+                applicationEnvironment: string;
+                migrationDirectory: string;
+                rehearsalConfig: string | null;
+                runtimeWorkdir: string;
+                serviceEnvironment: string | null;
+                sanitizationPolicy: string;
+                sourcePolicy: string | null;
+                privacyKey: string | null;
+                runtimePolicy: string | null;
+                identityPolicy: string | null;
+                supabaseWorkdir: string | null;
+                runtimeAdapter: string | null;
+            }>;
+        }>;
+        policy: import("../identity/claim_contract.mjs").IdentityPolicy;
+    }>;
     planRuntimeStackCleanup: ({ flags, planOptions, }: ProjectCommandInput) => Promise<RehearsalCleanupPlan | CleanupStackPlan>;
     runBaselinePreparation: ({ flags, planOptions, session, }: ProjectCommandInput) => Promise<ReturnType<typeof summarizeBaselinePreparation>>;
     runCleanup: ({ flags, planOptions, session, }: ProjectCommandInput) => Promise<unknown>;

package/dist/src/cli/project_commands.mjs

@@ -156,15 +156,23 @@ export const createProjectCommands = ({ projectRoot, runManager, }) => {
         });
         return { mode: "written", plan, applied };
     };
-    const loadIdentityClaimPlan = async ({ flags, planOptions, }) => {
+    const loadIdentityPolicy = async ({ planOptions }) => {
         const loaded = await loadRehearsalConfig(planOptions);
         if (!loaded.paths.identityPolicy) {
             throw new Error("No config.identityPolicy is configured.");
         }
+        const policy = validateIdentityPolicy(JSON.parse(await readFile(loaded.paths.identityPolicy, "utf8")));
+        return { loaded, policy };
+    };
+    const loadIdentityClaimPlan = async ({ flags, planOptions, session, }) => {
+        const { loaded, policy } = await loadIdentityPolicy({
+            flags,
+            planOptions,
+            ...(session === undefined ? {} : { session }),
+        });
         if (!flags.identityName) {
             throw new Error("Choose a declared identity with --identity=<name>.");
         }
-        const policy = validateIdentityPolicy(JSON.parse(await readFile(loaded.paths.identityPolicy, "utf8")));
         return {
             loaded,
             plan: createIdentityClaimPlan({
@@ -175,6 +183,7 @@ export const createProjectCommands = ({ projectRoot, runManager, }) => {
     };
     return Object.freeze({
         loadIdentityClaimPlan,
+        loadIdentityPolicy,
         planRuntimeStackCleanup,
         runBaselinePreparation,
         runCleanup,

package/dist/src/cli/runtime_commands.d.mts

@@ -223,6 +223,31 @@ export declare const createRuntimeCommands: ({ packageRoot, projectRoot, manager
             diagnostics: import("../application/session.mjs").ApplicationDiagnostics;
         };
     }>;
+    startRuntimeApplication: ({ flags, planOptions, session: commandSession, }: {
+        flags: RehearsalCliFlags;
+        planOptions: RehearsalConfigPathOptions;
+        session: CliSessionState;
+    }) => Promise<{
+        started: ManagerReceipt | Readonly<{
+            action: RuntimeAction;
+            durationMs: number;
+            output: string;
+            targets: readonly ManagerReceipt[];
+        }>;
+        verified: ManagerReceipt | Readonly<{
+            action: RuntimeAction;
+            durationMs: number;
+            output: string;
+            targets: readonly ManagerReceipt[];
+        }>;
+        preparations: {
+            command: string;
+            output: string;
+            target: string;
+        }[];
+        command: string;
+        session: import("../application/session.mjs").ApplicationSession;
+    }>;
     prepareCandidateConfirmation: ({ command, flags, planOptions, session, }: {
         command: RuntimeAction;
         flags: RehearsalCliFlags;

package/dist/src/cli/runtime_commands.mjs

@@ -479,7 +479,7 @@ export const createRuntimeCommands = ({ packageRoot, projectRoot, managerPath, g
         });
         return { applicationProof, dependentProofs };
     };
-    const openRuntimeApplication = async ({ flags, planOptions, session: commandSession, onReady = () => undefined, }) => {
+    const startRuntimeApplication = async ({ flags, planOptions, session: commandSession, }) => {
         const topology = await loadRuntimeTopology(planOptions);
         const application = topology.primary.config.application;
         if (!application.readiness) {
@@ -515,22 +515,39 @@ export const createRuntimeCommands = ({ packageRoot, projectRoot, managerPath, g
             topology,
             environment: topologyCommandEnvironment(topology),
         });
-        const session = await startApplicationSession({
+        const applicationSession = await startApplicationSession({
             command: application.startCommand,
             cwd: topology.projectRoot,
             files: topologyEnvironmentFiles(topology),
             mappings: application.environmentVariables,
             readiness: application.readiness,
         });
-        const closed = await holdApplicationSession({ session, onReady });
         return {
-            action: "open",
             started: started.runtime,
             verified: verified.runtime,
             preparations,
+            command: application.startCommand,
+            session: applicationSession,
+        };
+    };
+    const openRuntimeApplication = async ({ flags, planOptions, session: commandSession, onReady = () => undefined, }) => {
+        const active = await startRuntimeApplication({
+            flags,
+            planOptions,
+            session: commandSession,
+        });
+        const closed = await holdApplicationSession({
+            session: active.session,
+            onReady,
+        });
+        return {
+            action: "open",
+            started: active.started,
+            verified: active.verified,
+            preparations: active.preparations,
             application: {
-                command: application.startCommand,
-                readiness: session.ready,
+                command: active.command,
+                readiness: active.session.ready,
                 stoppedBy: closed.signal,
                 diagnostics: closed.diagnostics,
             },
@@ -592,6 +609,7 @@ export const createRuntimeCommands = ({ packageRoot, projectRoot, managerPath, g
     };
     return {
         openRuntimeApplication,
+        startRuntimeApplication,
         prepareCandidateConfirmation,
         prepareDependentTargets,
         proveRuntimeStack,

package/dist/src/identity/claim_identity_lookup.d.mts

@@ -10,8 +10,14 @@ export interface VerifiedLocalIdentity {
     readonly id: string;
     readonly provider: IdentityProvider;
 }
-export declare const findVerifiedLocalIdentity: ({ client, plan, matchValue, }: {
+export declare class IdentityLookupError extends Error {
+    readonly reason: "none" | "ambiguous" | "conflict" | "invalid";
+    constructor(reason: "none" | "ambiguous" | "conflict" | "invalid", message: string);
+}
+export declare const isIdentityNotFoundError: (error: unknown) => error is IdentityLookupError;
+export declare const findVerifiedLocalIdentity: ({ client, plan, matchValue, lock, }: {
     client: IdentityDatabaseClient;
     plan: IdentityClaimPlan;
     matchValue: string;
+    lock?: boolean;
 }) => Promise<VerifiedLocalIdentity>;

package/dist/src/identity/claim_identity_lookup.mjs

@@ -48,7 +48,16 @@ export const countIdentityRows = async ({ client, reference, userId, }) => {
     }
     return count;
 };
-export const findVerifiedLocalIdentity = async ({ client, plan, matchValue, }) => {
+export class IdentityLookupError extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.name = "IdentityLookupError";
+        this.reason = reason;
+    }
+}
+export const isIdentityNotFoundError = (error) => error instanceof IdentityLookupError && error.reason === "none";
+export const findVerifiedLocalIdentity = async ({ client, plan, matchValue, lock = true, }) => {
     const matcher = plan.identity.matcher;
     if (matcher.type === "verified-email") {
         const match = await client.query(`select u.id::text, i.provider
@@ -60,23 +69,23 @@ export const findVerifiedLocalIdentity = async ({ client, plan, matchValue, }) =
            coalesce((i.identity_data->>'email_verified')::boolean, false)
            or u.email_confirmed_at is not null
          )
-       for update of u`, [matchValue, matcher.providers]);
+         ${lock ? "for update of u" : ""}`, [matchValue, matcher.providers]);
         if (match.rows.length !== 1) {
-            throw new Error(match.rows.length === 0
+            throw new IdentityLookupError(match.rows.length === 0 ? "none" : "ambiguous", match.rows.length === 0
                 ? "No verified local identity matches the reviewed email and provider allowlist."
                 : "More than one verified local identity matches the reviewed email and provider allowlist.");
         }
         const matchedRow = match.rows[0];
         if (!matchedRow)
-            throw new Error("Matched local identity is invalid.");
+            throw new IdentityLookupError("invalid", "Matched local identity is invalid.");
         const matchedProvider = matchedRow.provider ??
             (matcher.providers.length === 1 ? matcher.providers[0] : null);
         if (typeof matchedProvider !== "string" ||
             !matcher.providers.includes(matchedProvider)) {
-            throw new Error("Matched local identity provider is invalid.");
+            throw new IdentityLookupError("invalid", "Matched local identity provider is invalid.");
         }
         if (typeof matchedRow.id !== "string") {
-            throw new Error("Matched local identity is invalid.");
+            throw new IdentityLookupError("invalid", "Matched local identity is invalid.");
         }
         return {
             id: matchedRow.id,
@@ -94,7 +103,7 @@ export const findVerifiedLocalIdentity = async ({ client, plan, matchValue, }) =
          coalesce((i.identity_data->>'email_verified')::boolean, false)
          or u.email_confirmed_at is not null
        )
-     for update of u`, [matcher.provider]);
+     ${lock ? "for update of u" : ""}`, [matcher.provider]);
     const matches = [];
     for (const candidate of candidates.rows) {
         const subjects = [candidate.provider_id, candidate.subject]
@@ -103,23 +112,23 @@ export const findVerifiedLocalIdentity = async ({ client, plan, matchValue, }) =
         const uniqueSubjects = [...new Set(subjects)];
         if (uniqueSubjects.some((subject) => hash(subject) === matcher.approvedSubjectSha256)) {
             if (uniqueSubjects.length !== 1) {
-                throw new Error("The matched local provider identity has conflicting stable subjects.");
+                throw new IdentityLookupError("conflict", "The matched local provider identity has conflicting stable subjects.");
             }
             if (typeof candidate.id !== "string" ||
                 candidate.provider !== matcher.provider) {
-                throw new Error("Matched local identity provider is invalid.");
+                throw new IdentityLookupError("invalid", "Matched local identity provider is invalid.");
             }
             matches.push({ id: candidate.id, provider: matcher.provider });
         }
     }
     if (matches.length !== 1) {
-        throw new Error(matches.length === 0
+        throw new IdentityLookupError(matches.length === 0 ? "none" : "ambiguous", matches.length === 0
             ? "No verified local identity matches the reviewed provider subject."
             : "More than one verified local identity matches the reviewed provider subject.");
     }
     const match = matches[0];
     if (!match || match.provider !== matcher.provider) {
-        throw new Error("Matched local identity provider is invalid.");
+        throw new IdentityLookupError("invalid", "Matched local identity provider is invalid.");
     }
     return match;
 };

package/dist/src/identity/connect.d.mts

@@ -0,0 +1,30 @@
+/** Read-only discovery and redacted review for the guided account connection. */
+import type { IdentityClaimPlan, IdentityClientFactory, IdentityProvider } from "./claim_contract.mjs";
+export interface IdentityConnectionPreview {
+    readonly name: string;
+    readonly provider: IdentityProvider;
+    readonly planDigest: string;
+    readonly relationalGroups: number;
+    readonly preservedAuditGroups: number;
+    readonly nestedJsonGroups: number;
+    readonly signupDefaults: number;
+    readonly storagePathGroups: number;
+    readonly assetScopes: number;
+    readonly claimKeys: number;
+    readonly tokenHookConfigured: boolean;
+    readonly associated: boolean;
+}
+export declare const inspectIdentityConnection: ({ plan, connectionString, clientFactory, }: {
+    plan: IdentityClaimPlan;
+    connectionString: string;
+    clientFactory?: IdentityClientFactory;
+}) => Promise<IdentityConnectionPreview>;
+export declare const waitForIdentityConnection: ({ plan, connectionString, clientFactory, inspect, signal, pollIntervalMs, timeoutMs, }: {
+    plan: IdentityClaimPlan;
+    connectionString: string;
+    clientFactory?: IdentityClientFactory;
+    inspect?: typeof inspectIdentityConnection;
+    signal?: AbortSignal;
+    pollIntervalMs?: number;
+    timeoutMs?: number;
+}) => Promise<IdentityConnectionPreview>;

package/dist/src/identity/connect.mjs

@@ -0,0 +1,111 @@
+/** Read-only discovery and redacted review for the guided account connection. */
+import pg from "pg";
+import { findVerifiedLocalIdentity, isIdentityNotFoundError, } from "./claim_identity_lookup.mjs";
+import { getIdentityPlanMatchValue } from "./claim_plan.mjs";
+const { Client } = pg;
+const UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[1-5][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/iu;
+const assertLocalDatabase = (connectionString) => {
+    let target;
+    try {
+        target = new URL(connectionString);
+    }
+    catch {
+        throw new Error("Identity connection requires a valid local database URL.");
+    }
+    if (!["postgres:", "postgresql:"].includes(target.protocol) ||
+        !["127.0.0.1", "::1", "localhost"].includes(target.hostname)) {
+        throw new Error("Identity connection may inspect only the local Rehearsal database.");
+    }
+};
+const hasAssociationReceipt = async ({ client, name, placeholderUserId, localUserId, }) => {
+    const relation = await client.query("select to_regclass('rehearsal_internal.identity_claims')::text as relation");
+    if (relation.rows[0]?.relation !== "rehearsal_internal.identity_claims") {
+        return false;
+    }
+    const receipt = await client.query(`select 1
+     from rehearsal_internal.identity_claims
+     where identity_name = $1
+       and placeholder_user_id = $2::uuid
+       and local_user_id = $3::uuid
+     limit 1`, [name, placeholderUserId, localUserId]);
+    return receipt.rows.length === 1;
+};
+export const inspectIdentityConnection = async ({ plan, connectionString, clientFactory, }) => {
+    assertLocalDatabase(connectionString);
+    const matchValue = getIdentityPlanMatchValue(plan);
+    if (!matchValue) {
+        throw new Error("Identity connection plans must use the reviewed local matcher environment.");
+    }
+    const client = clientFactory
+        ? await clientFactory(connectionString)
+        : new Client({
+            connectionString,
+            application_name: "rehearsal-identity-connect",
+        });
+    await client.connect?.();
+    try {
+        const localIdentity = await findVerifiedLocalIdentity({
+            client,
+            plan,
+            matchValue,
+            lock: false,
+        });
+        if (!UUID.test(localIdentity.id)) {
+            throw new Error("Matched local identity is invalid.");
+        }
+        return Object.freeze({
+            name: plan.review.name,
+            provider: localIdentity.provider,
+            planDigest: plan.digest,
+            relationalGroups: plan.review.references.filter((reference) => reference.strategy === "transfer").length,
+            preservedAuditGroups: plan.review.references.filter((reference) => reference.strategy === "preserve-audit").length,
+            nestedJsonGroups: plan.review.jsonReferences.length,
+            signupDefaults: plan.review.signupDefaults.length,
+            storagePathGroups: plan.review.pathReferences.length,
+            assetScopes: plan.review.assets.length,
+            claimKeys: plan.review.claimKeys.length,
+            tokenHookConfigured: plan.review.tokenHook !== null,
+            associated: await hasAssociationReceipt({
+                client,
+                name: plan.identity.name,
+                placeholderUserId: plan.identity.placeholderUserId,
+                localUserId: localIdentity.id,
+            }),
+        });
+    }
+    finally {
+        await client.end?.();
+    }
+};
+const abortableDelay = (milliseconds, signal) => new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+        reject(signal.reason ?? new Error("Identity connection was cancelled."));
+        return;
+    }
+    const timeout = setTimeout(resolve, milliseconds);
+    signal?.addEventListener("abort", () => {
+        clearTimeout(timeout);
+        reject(signal.reason ?? new Error("Identity connection was cancelled."));
+    }, { once: true });
+});
+export const waitForIdentityConnection = async ({ plan, connectionString, clientFactory, inspect = inspectIdentityConnection, signal, pollIntervalMs = 750, timeoutMs = 15 * 60 * 1_000, }) => {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        if (signal?.aborted) {
+            throw signal.reason ?? new Error("Identity connection was cancelled.");
+        }
+        try {
+            return await inspect({
+                plan,
+                connectionString,
+                ...(clientFactory === undefined ? {} : { clientFactory }),
+            });
+        }
+        catch (error) {
+            if (!isIdentityNotFoundError(error))
+                throw error;
+        }
+        await abortableDelay(pollIntervalMs, signal);
+    }
+    throw new Error("Timed out waiting for the approved verified local identity. Nothing was changed.");
+};

package/dist/src/project/configuration_rendering.mjs

@@ -58,6 +58,7 @@ export default defineRehearsalConfig({
 	// runtimePolicy: "infrastructure/rehearsal/runtime-policy.json",
 	// Optional copied-account association. The JSON stores only reviewed matcher hashes;
 	// raw emails/subjects and provider credentials stay in ignored environment files.
+	// After setup, run: npx rehearsal identity connect
 	// identityPolicy: "infrastructure/rehearsal/identity-policy.json",
 
 	// Reuse any running Docker-compatible engine; start Colima only when needed.
@@ -162,6 +163,7 @@ export default defineRehearsalConfig({
 	// runtimePolicy: "infrastructure/rehearsal/runtime-policy.json",
 	// Optional copied-account association. The JSON stores only reviewed matcher hashes;
 	// raw emails/subjects and provider credentials stay in ignored environment files.
+	// After setup, run: npx rehearsal identity connect
 	// identityPolicy: "infrastructure/rehearsal/identity-policy.json",
 
 	// Reuse any running Docker-compatible engine; start Colima only when needed.

package/docs/architecture.md

@@ -142,6 +142,8 @@ and confirmed execution while keeping those responsibilities separate:
 6. `claim_verification.mts` checks signup defaults and token-hook claim shapes.
 7. `claim_executor.mts` alone owns the database transaction, Storage staging, rollback,
    commit, old-object cleanup, and final receipt.
+8. `connect.mts` performs read-only, provider-neutral sign-in discovery and produces the
+   redacted preview used by the interactive copied-account connection.
 
 Repository contracts keep the facade at 50 lines or fewer and every identity-claim
 stage at 600 lines or fewer. Provider callbacks and consumer application behavior stay

package/docs/commands.md

@@ -73,20 +73,26 @@ In short: `refresh` gets a new source copy; `reset` restores the copy you alread
 
 ## Local identity association
 
-For a reviewed Google, GitHub, or email identity, use this sequence:
+For a reviewed Google, GitHub, or email identity, use the guided connection:
 
-1. Run a successful rehearsal, then start the persistent app:
+```bash
+npx rehearsal identity connect
+```
 
-   ```bash
-   npx rehearsal open
-   ```
+Rehearsal starts and checks the local runtime, keeps the configured application open,
+and waits for an ordinary provider sign-in. It reads only the local Auth database—not
+browser cookies, passwords, passkeys, MFA secrets, or session tokens. When exactly one
+approved verified identity matches, it stops the owned app, shows a redacted preview,
+and offers **Connect my copied account**. One confirmation binds the exact current plan.
+After the verified transfer, Rehearsal reopens the app and asks for one sign-out/sign-in
+so the application receives fresh role claims.
 
-2. Open the printed local URL and complete the normal provider sign-in. Press `Ctrl+C`
-   after the callback returns. This closes only the app; the databases and Storage stay
-   running with their current data. Provider setup and credentials belong to the local
-   Supabase runtime, not the identity policy.
+If the policy declares more than one copied identity, choose one with
+`--identity=<reviewed-name>`. The interactive guide presents the reviewed names. A
+completed connection is recognized from its local runtime receipt and is not repeated.
+Resetting the runtime removes that receipt and requires a fresh review and connection.
 
-3. Preview and confirm the reviewed association:
+For automation or detailed inspection, keep using the explicit commands:
 
 ```bash
 npx rehearsal identity plan --identity=approved-owner
@@ -94,14 +100,11 @@ npx rehearsal identity claim --identity=approved-owner \
   --confirm-identity=<sha256>
 ```
 
-4. Run `npx rehearsal open` again. Sign out and sign in again so the browser receives a
-   fresh session, then check the copied account. Rehearsal does not bypass application
-   role checks, account blocks, RLS, or MFA.
-
 The first command shows only hashes and declared reference counts. The second updates
 only the reviewed local relational, JSON, Storage-owner, and claim locations in one
 transaction. It rejects hosted database URLs, wrong or unverified people, ambiguity, and
-stale confirmation digests.
+stale confirmation digests. Reopen the application and sign in again afterward to obtain
+fresh claims. Neither flow bypasses application roles, account blocks, RLS, or MFA.
 
 If a runtime-policy seed moves with that identity, declare its `identityAssociation` in
 the runtime policy. Later `verify` calls then require the transferred row instead of the

package/docs/configuration.md

@@ -79,6 +79,7 @@ export default defineRehearsalConfig({
   // runtimePolicy: "infrastructure/rehearsal/runtime-policy.json",
   // Optional copied-account association. The JSON stores reviewed matcher hashes only;
   // raw emails/subjects and provider credentials stay in ignored environment files.
+  // After setup, run: npx rehearsal identity connect
   // identityPolicy: "infrastructure/rehearsal/identity-policy.json",
   containerRuntime: {
     autoStartColima: true,

package/docs/runtime-policies.md

@@ -166,9 +166,18 @@ Authentication has three separate parts:
 3. The identity policy matches that verified local identity and transfers only the
    reviewed copied-account graph.
 
-The email stays in an environment variable; only its reviewed hash is committed. Run
-`rehearsal open`, complete the ordinary local sign-in, and stop the app with `Ctrl+C`.
-Then preview and confirm the association:
+The email stays in an environment variable; only its reviewed hash is committed. The
+guided command keeps the app available for ordinary sign-in, detects the reviewed local
+Auth match, presents a redacted preview, and supplies the exact plan fingerprint
+internally after one confirmation:
+
+```bash
+npx rehearsal identity connect
+```
+
+It never intercepts provider credentials or reads browser state. After connection it
+reopens the app; sign out and sign in once to receive fresh claims. Scripts may retain
+the explicit plan and claim sequence:
 
 ```bash
 npx rehearsal identity plan --identity=approved-owner

package/docs/troubleshooting.md

@@ -172,6 +172,23 @@ need; skipping nonce validation reduces replay protection. Otherwise keep using
 documented legacy configuration.
 Never paste provider secrets into tracked config or terminal output.
 
+For the shortest supported copied-account flow, run:
+
+```bash
+npx rehearsal identity connect
+```
+
+Leave that terminal open, then sign in through the sandbox application normally. Rehearsal
+waits for one verified match and shows a redacted plan before it changes anything. If it
+keeps waiting, finish the provider callback and confirm the reviewed matcher environment
+value is available in the terminal that started Rehearsal. `Ctrl+C`, `Ctrl+Z`, or choosing
+**Not now** stops only the owned application and leaves the database unchanged.
+
+After a successful connection, sign out and sign in once so the application receives
+fresh role claims. Rehearsal remembers the connection in the current disposable runtime;
+`reset` deliberately removes that receipt, so the next copied-account connection requires
+review again.
+
 If `identity plan` refuses the matcher, read the message literally:
 
 - **Provider or matcher type is unsupported:** use only the combinations documented in

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rehearsal-db/core",
-  "version": "0.1.0-beta.16",
+  "version": "0.1.0-beta.17",
   "private": false,
   "description": "Safely rehearse PostgreSQL and Supabase migrations against sanitized, production-shaped data.",
   "repository": {