@rehearsal-db/core 0.1.0-beta.16 → 0.1.0-beta.18

package/CHANGELOG.md

@@ -5,6 +5,38 @@ a Changelog, and versions will follow Semantic Versioning after the package exis
 
 ## Unreleased
 
+## [0.1.0-beta.18] - 2026-10-08
+
+### Added
+
+- A concise stability contract now defines the supported public surface, defects that
+  block the first stable release, and the exact beta-to-RC-to-stable promotion gate.
+- Automated release-policy tests cover beta, release-candidate, stable, malformed, and
+  mismatched GitHub release metadata.
+
+### Changed
+
+- Protected OIDC publication now supports both prerelease and stable versions. Beta and
+  release-candidate versions update `beta`; once a stable version exists they cannot
+  replace `latest`. Stable publication updates `latest` without rewriting `beta`.
+- npm channel selection lives only in the protected release workflow instead of static
+  package metadata, and missing beta.16 and beta.17 changelog comparisons are restored.
+- Vitest's locked patch release is updated from 5.0.2 to 5.0.3 after the complete CI
+  matrix passed.
+
+## [0.1.0-beta.17] - 2026-10-08
+
+### Added
+
+- `rehearsal identity connect` and the guided home screen now keep the sandbox app
+  available during ordinary provider sign-in, detect exactly one approved verified local
+  identity, show a redacted copied-account preview, and apply the existing exact claim
+  after one deliberate confirmation. The app is reopened automatically with an honest
+  fresh-session instruction; explicit `identity plan` and `identity claim` commands remain
+  available for scripts.
+
+## [0.1.0-beta.16] - 2026-10-08
+
 ### Changed
 
 - The CLI now routes guided and scripted requests through focused typed command
@@ -512,7 +544,10 @@ a Changelog, and versions will follow Semantic Versioning after the package exis
   publication uses short-lived trusted OIDC, and every release tag must already exist on
   protected `main`.
 
-[Unreleased]: https://github.com/Ddupasquier/rehearsal-db/compare/v0.1.0-beta.15...HEAD
+[Unreleased]: https://github.com/Ddupasquier/rehearsal-db/compare/v0.1.0-beta.18...HEAD
+[0.1.0-beta.18]: https://github.com/Ddupasquier/rehearsal-db/compare/v0.1.0-beta.17...v0.1.0-beta.18
+[0.1.0-beta.17]: https://github.com/Ddupasquier/rehearsal-db/compare/v0.1.0-beta.16...v0.1.0-beta.17
+[0.1.0-beta.16]: https://github.com/Ddupasquier/rehearsal-db/compare/v0.1.0-beta.15...v0.1.0-beta.16
 [0.1.0-beta.15]: https://github.com/Ddupasquier/rehearsal-db/compare/v0.1.0-beta.14...v0.1.0-beta.15
 [0.1.0-beta.14]: https://github.com/Ddupasquier/rehearsal-db/compare/v0.1.0-beta.13...v0.1.0-beta.14
 [0.1.0-beta.13]: https://github.com/Ddupasquier/rehearsal-db/compare/v0.1.0-beta.12...v0.1.0-beta.13

package/README.md

@@ -155,6 +155,7 @@ Reference:
 - [Runtime and local identity policies](docs/runtime-policies.md)
 - [Glossary](docs/glossary.md)
 - [Repository architecture](docs/architecture.md)
+- [Stability and the first stable release](docs/stability.md)
 - [Release process](docs/releasing.md)
 
 ## Getting support

package/dist/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@rehearsal-db/core",
-    "version": "0.1.0-beta.16",
+    "version": "0.1.0-beta.18",
     "private": false,
     "description": "Safely rehearse PostgreSQL and Supabase migrations against sanitized, production-shaped data.",
     "repository": {
@@ -13,7 +13,6 @@
     "homepage": "https://ddupasquier.github.io/rehearsal-db/",
     "publishConfig": {
         "access": "public",
-        "tag": "beta",
         "provenance": true
     },
     "type": "module",

package/dist/src/application/interactive_task.d.mts

@@ -0,0 +1,30 @@
+/** Run identity discovery while an owned local application remains available. */
+import type { EventEmitter } from "node:events";
+import { type ApplicationDiagnostics, type ApplicationSession, type ApplicationSessionSignal } from "./session.mjs";
+type SignalTarget = Pick<EventEmitter, "prependListener" | "removeListener">;
+interface SessionInput {
+    readonly isTTY?: boolean;
+    prependListener(event: "data", listener: (chunk: Buffer | string) => void): unknown;
+    removeListener(event: "data", listener: (chunk: Buffer | string) => void): unknown;
+}
+/**
+ * A terminal interruption aborts the task and retires the owned process group.
+ * A completed task leaves the session running so its caller can deliberately
+ * stop, reuse, or hand it back to the persistent application holder.
+ */
+export declare const runApplicationSessionTask: <Value>({ session, task, signalTarget, input, onReady, }: {
+    session: ApplicationSession;
+    task: (signal: AbortSignal) => Promise<Value>;
+    signalTarget?: SignalTarget;
+    input?: SessionInput;
+    onReady?: (ready: ApplicationSession["ready"]) => void;
+}) => Promise<Readonly<{
+    completed: true;
+    value: Value;
+    diagnostics: ApplicationDiagnostics;
+}> | Readonly<{
+    completed: false;
+    signal: ApplicationSessionSignal;
+    diagnostics: ApplicationDiagnostics;
+}>>;
+export {};

package/dist/src/application/interactive_task.mjs

@@ -0,0 +1,83 @@
+/** Run identity discovery while an owned local application remains available. */
+import { summarizeProjectCommandFailure, } from "./session.mjs";
+const SESSION_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP", "SIGTSTP"];
+/**
+ * A terminal interruption aborts the task and retires the owned process group.
+ * A completed task leaves the session running so its caller can deliberately
+ * stop, reuse, or hand it back to the persistent application holder.
+ */
+export const runApplicationSessionTask = async ({ session, task, signalTarget = process, input = process.stdin, onReady = () => undefined, }) => {
+    if (!session ||
+        typeof session.wait !== "function" ||
+        typeof session.stop !== "function") {
+        throw new Error("A started application session is required.");
+    }
+    let finishInterruption = () => undefined;
+    const interruption = new Promise((resolve) => {
+        finishInterruption = resolve;
+    });
+    const handlers = new Map(SESSION_SIGNALS.map((signal) => [
+        signal,
+        () => finishInterruption({ kind: "interrupted", signal }),
+    ]));
+    for (const [signal, handler] of handlers) {
+        signalTarget.prependListener(signal, handler);
+    }
+    const onInput = (chunk) => {
+        const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        if (bytes.includes(0x03)) {
+            finishInterruption({ kind: "interrupted", signal: "SIGINT" });
+        }
+        else if (bytes.includes(0x1a)) {
+            finishInterruption({ kind: "interrupted", signal: "SIGTSTP" });
+        }
+    };
+    if (input?.isTTY)
+        input.prependListener("data", onInput);
+    const abortController = new AbortController();
+    try {
+        onReady(session.ready);
+        const outcome = await Promise.race([
+            interruption,
+            task(abortController.signal).then((value) => ({
+                kind: "completed",
+                value,
+            })),
+            session.wait().then((exit) => ({ kind: "exited", ...exit })),
+        ]);
+        if (outcome.kind === "exited") {
+            throw new Error(`Application exited before identity connection finished (${summarizeProjectCommandFailure({
+                status: outcome.status,
+                signal: outcome.signal,
+                stdoutByteCount: session.diagnostics().stdoutBytes,
+                stderrByteCount: session.diagnostics().stderrBytes,
+            })}).`);
+        }
+        if (outcome.kind === "interrupted") {
+            abortController.abort(new Error(`Identity connection was interrupted by ${outcome.signal}.`));
+            await session.stop();
+            return Object.freeze({
+                completed: false,
+                signal: outcome.signal,
+                diagnostics: session.diagnostics(),
+            });
+        }
+        return Object.freeze({
+            completed: true,
+            value: outcome.value,
+            diagnostics: session.diagnostics(),
+        });
+    }
+    catch (error) {
+        abortController.abort(error);
+        await session.stop();
+        throw error;
+    }
+    finally {
+        for (const [signal, handler] of handlers) {
+            signalTarget.removeListener(signal, handler);
+        }
+        if (input?.isTTY)
+            input.removeListener("data", onInput);
+    }
+};

package/dist/src/application/session.d.mts

@@ -3,6 +3,7 @@ import { spawn } from "node:child_process";
 import type { EventEmitter } from "node:events";
 declare const SESSION_SIGNALS: string[];
 type SessionSignal = (typeof SESSION_SIGNALS)[number];
+export type ApplicationSessionSignal = SessionSignal;
 export interface ApplicationReadiness {
     readonly url: string;
     readonly expectedStatus?: number;

package/dist/src/cli/arguments.mjs

@@ -113,6 +113,8 @@ export const commandMutatesProject = ({ command, flags, guided, }) => {
         return Boolean(flags.refreshConfirmation);
     if (command === "identity claim")
         return Boolean(flags.identityConfirmation);
+    if (command === "identity connect")
+        return true;
     if (command === "run")
         return !flags.dryRun;
     return [

package/dist/src/cli/basic_command_handlers.mjs

@@ -18,6 +18,7 @@ Commands:
   refresh [--confirm-refresh=] Replace the database copy, reset locally, and remove old copies
   identity plan --identity=   Preview an approved local identity association
   identity claim --identity= --confirm-identity= Apply the exact local association
+  identity connect [--identity=] Keep the app open, detect sign-in, and connect once
   doctor                     Check whether Rehearsal is safe and ready
   support                    Print a safe, copy-ready support report
   explain                    Show the immutable execution plan

package/dist/src/cli/cli_commands.mjs

@@ -18,6 +18,8 @@ export const createCliCommandRegistry = ({ projectRoot, projectCommands, runtime
     ...createSourceCommandHandlers({ runRefreshWorkflow }),
     ...createIdentityCommandHandlers({
         loadIdentityClaimPlan: projectCommands.loadIdentityClaimPlan,
+        loadIdentityPolicy: projectCommands.loadIdentityPolicy,
+        startRuntimeApplication: runtimeCommands.startRuntimeApplication,
     }),
     ...createInspectionCommandHandlers(),
     ...createApplicationCommandHandlers({

package/dist/src/cli/guided.mjs

@@ -95,6 +95,7 @@ const inspectGuidedProject = async ({ projectRoot, planOptions, topologyCandidat
         policyAbsolutePath: loaded.paths.sanitizationPolicy,
         ...(migrationSummary === undefined ? {} : { migrationSummary }),
         refreshConfigured: Boolean(loaded.config.preparation),
+        identityConfigured: Boolean(loaded.paths.identityPolicy),
         dependentCount: topology?.dependents.length ?? 0,
         runtime: topology
             ? (await Promise.all(topology.targets.map((target) => pathExists(join(target.paths.runtimeWorkdir, "baseline.json"))))).every(Boolean)
@@ -334,6 +335,13 @@ const guidedOptions = (state, hasLastDetails) => {
         options.push({ label: "Check readiness", command: "doctor" });
     }
     if (state.node.supported && state.runtime) {
+        if (state.identityConfigured) {
+            options.push({
+                label: "Connect my copied account",
+                hint: "Sign in normally, review once, then open the copied profile",
+                command: "identity connect",
+            });
+        }
         options.push({
             label: "Open the sandbox app",
             hint: "Keep it running for hands-on testing",

package/dist/src/cli/identity_command_handlers.d.mts

@@ -1,8 +1,12 @@
-/** Provider-neutral copied-account planning and application handlers. */
+/** Provider-neutral copied-account planning, application, and guided connection. */
 import type { CommandDefinition } from "./command_contract.mjs";
 import type { createProjectCommands } from "./project_commands.mjs";
+import type { createRuntimeCommands } from "./runtime_commands.mjs";
 type ProjectCommands = ReturnType<typeof createProjectCommands>;
-export declare const createIdentityCommandHandlers: ({ loadIdentityClaimPlan, }: {
+type RuntimeCommands = ReturnType<typeof createRuntimeCommands>;
+export declare const createIdentityCommandHandlers: ({ loadIdentityClaimPlan, loadIdentityPolicy, startRuntimeApplication, }: {
     loadIdentityClaimPlan: ProjectCommands["loadIdentityClaimPlan"];
+    loadIdentityPolicy: ProjectCommands["loadIdentityPolicy"];
+    startRuntimeApplication: RuntimeCommands["startRuntimeApplication"];
 }) => readonly CommandDefinition[];
 export {};

package/dist/src/cli/identity_command_handlers.mjs

@@ -1,36 +1,232 @@
-/** Provider-neutral copied-account planning and application handlers. */
+/** Provider-neutral copied-account planning, application, and guided connection. */
 import { readFile } from "node:fs/promises";
 import { parseEnv } from "node:util";
+import * as prompts from "@clack/prompts";
+import { holdApplicationSession } from "../application/session.mjs";
+import { runApplicationSessionTask } from "../application/interactive_task.mjs";
 import { applyIdentityClaim } from "../identity/claim.mjs";
+import { waitForIdentityConnection } from "../identity/connect.mjs";
 import { createSupabaseStorageTransfer } from "../identity/storage.mjs";
-import { exactCommands, renderedCommand } from "./command_contract.mjs";
+import { exactCommands, renderedCommand, textCommand, } from "./command_contract.mjs";
+import { renderIdentityConnection } from "./identity_renderer.mjs";
 import { renderIdentityPlan } from "./renderers.mjs";
-export const createIdentityCommandHandlers = ({ loadIdentityClaimPlan, }) => [
-    exactCommands("identity", ["identity plan", "identity claim"], async ({ command, flags, planOptions }) => {
+import { isHumanTerminal, promptForConfirmation, promptForSelection, useStyledPrompts, } from "./terminal.mjs";
+const loadIdentityRuntime = async (loaded) => {
+    const environment = parseEnv(await readFile(loaded.paths.applicationEnvironment, "utf8"));
+    if (!environment.DATABASE_URL) {
+        throw new Error("The local runtime environment has no DATABASE_URL.");
+    }
+    return environment;
+};
+const storageTransferFor = ({ plan, environment, }) => {
+    const needsStorageTransfer = plan.identity.assets.some((asset) => asset.rewritePath);
+    if (!needsStorageTransfer)
+        return undefined;
+    if (!environment.SUPABASE_URL || !environment.SUPABASE_SERVICE_ROLE_KEY) {
+        throw new Error("Identity asset transfer requires local Supabase URL and service-role credentials.");
+    }
+    return createSupabaseStorageTransfer({
+        url: environment.SUPABASE_URL,
+        serviceRoleKey: environment.SUPABASE_SERVICE_ROLE_KEY,
+    });
+};
+export const createIdentityCommandHandlers = ({ loadIdentityClaimPlan, loadIdentityPolicy, startRuntimeApplication, }) => [
+    exactCommands("identity", ["identity plan", "identity claim", "identity connect"], async ({ command, flags, planOptions, guided, state }) => {
+        if (command === "identity connect") {
+            if (!isHumanTerminal(flags)) {
+                throw new Error("identity connect requires an interactive terminal. Scripts should keep using identity plan and identity claim.");
+            }
+            if (!flags.identityName) {
+                const { policy } = await loadIdentityPolicy({
+                    flags,
+                    planOptions,
+                    session: state,
+                });
+                if (policy.identities.length === 1) {
+                    flags.identityName = policy.identities[0].name;
+                }
+                else {
+                    const selected = await promptForSelection({
+                        message: "Which copied account would you like to connect?",
+                        flags,
+                        options: policy.identities.map((identity) => ({
+                            label: identity.name,
+                            value: identity.name,
+                        })),
+                    });
+                    if (!selected) {
+                        return textCommand("COPIED ACCOUNT CONNECTION CANCELLED\nNothing was changed.");
+                    }
+                    flags.identityName = selected;
+                }
+            }
+            const initial = await loadIdentityClaimPlan({
+                flags,
+                planOptions,
+                session: state,
+            });
+            const initialEnvironment = await loadIdentityRuntime(initial.loaded);
+            let active;
+            let reopened;
+            try {
+                active = await startRuntimeApplication({
+                    flags,
+                    planOptions,
+                    session: state,
+                });
+                const observed = await runApplicationSessionTask({
+                    session: active.session,
+                    onReady: (ready) => {
+                        const lines = [
+                            `Application: ${ready.url}`,
+                            "Sign in normally with the provider allowed by your reviewed identity policy.",
+                            "Rehearsal will continue when exactly one approved, verified local identity appears.",
+                            "It never reads your provider password, passkey, MFA secret, browser cookies, or session tokens.",
+                            "Press Ctrl+C to cancel or Ctrl+Z to exit Rehearsal.",
+                        ];
+                        if (useStyledPrompts(flags)) {
+                            prompts.note(lines.join("\n"), "SIGN IN TO THE SANDBOX");
+                        }
+                        else {
+                            console.log(["", "SIGN IN TO THE SANDBOX", ...lines, ""].join("\n"));
+                        }
+                    },
+                    task: (signal) => waitForIdentityConnection({
+                        plan: initial.plan,
+                        connectionString: initialEnvironment.DATABASE_URL,
+                        signal,
+                    }),
+                });
+                if (!observed.completed) {
+                    if (guided && observed.signal === "SIGTSTP") {
+                        flags.exitGuidedSession = true;
+                    }
+                    return textCommand([
+                        "COPIED ACCOUNT CONNECTION CANCELLED",
+                        `Application stopped after ${observed.signal}.`,
+                        "Nothing was changed. The database runtime was preserved.",
+                    ].join("\n"));
+                }
+                const preview = observed.value;
+                if (preview.associated) {
+                    const closed = await holdApplicationSession({
+                        session: active.session,
+                        onReady: () => {
+                            const message = renderIdentityConnection({
+                                mode: "already-connected",
+                                preview,
+                            });
+                            if (useStyledPrompts(flags)) {
+                                prompts.note(message, "SANDBOX READY");
+                            }
+                            else {
+                                console.log(`\n${message}\n`);
+                            }
+                        },
+                    });
+                    if (guided && closed.signal === "SIGTSTP") {
+                        flags.exitGuidedSession = true;
+                    }
+                    return renderedCommand({
+                        data: {
+                            mode: "already-connected",
+                            preview,
+                            application: { stoppedBy: closed.signal },
+                        },
+                        render: ({ mode, preview: renderedPreview }) => renderIdentityConnection({ mode, preview: renderedPreview }),
+                    });
+                }
+                await active.session.stop();
+                console.log(`\n${renderIdentityConnection({ mode: "preview", preview })}\n`);
+                const accepted = await promptForConfirmation("Connect my copied account using exactly this plan?", flags);
+                if (!accepted) {
+                    return renderedCommand({
+                        data: { mode: "cancelled", preview },
+                        render: ({ mode, preview: renderedPreview }) => renderIdentityConnection({ mode, preview: renderedPreview }),
+                    });
+                }
+                const refreshed = await loadIdentityClaimPlan({
+                    flags,
+                    planOptions,
+                    session: state,
+                });
+                if (refreshed.plan.digest !== preview.planDigest) {
+                    throw new Error("The reviewed identity plan changed after sign-in. Nothing was changed; start the connection again.");
+                }
+                const refreshedEnvironment = await loadIdentityRuntime(refreshed.loaded);
+                const storageTransfer = storageTransferFor({
+                    plan: refreshed.plan,
+                    environment: refreshedEnvironment,
+                });
+                const result = await applyIdentityClaim({
+                    plan: refreshed.plan,
+                    confirmation: preview.planDigest,
+                    connectionString: refreshedEnvironment.DATABASE_URL,
+                    ...(storageTransfer === undefined ? {} : { storageTransfer }),
+                });
+                reopened = await startRuntimeApplication({
+                    flags,
+                    planOptions,
+                    session: state,
+                });
+                const closed = await holdApplicationSession({
+                    session: reopened.session,
+                    onReady: (ready) => {
+                        const lines = [
+                            renderIdentityConnection({
+                                mode: "connected",
+                                preview,
+                                result,
+                            }),
+                            "",
+                            `Application: ${ready.url}`,
+                            "The app is running again. Sign out and sign in once for fresh claims.",
+                            "Press Ctrl+C to close the app or Ctrl+Z to exit Rehearsal.",
+                        ];
+                        if (useStyledPrompts(flags)) {
+                            prompts.note(lines.join("\n"), "ACCOUNT CONNECTED");
+                        }
+                        else {
+                            console.log(["", ...lines, ""].join("\n"));
+                        }
+                    },
+                });
+                if (guided && closed.signal === "SIGTSTP") {
+                    flags.exitGuidedSession = true;
+                }
+                return renderedCommand({
+                    data: {
+                        mode: "connected",
+                        preview,
+                        result,
+                        application: { stoppedBy: closed.signal },
+                    },
+                    render: ({ mode, preview: renderedPreview, result: claimResult }) => renderIdentityConnection({
+                        mode,
+                        preview: renderedPreview,
+                        result: claimResult,
+                    }),
+                });
+            }
+            finally {
+                await active?.session.stop();
+                await reopened?.session.stop();
+            }
+        }
         const { loaded, plan } = await loadIdentityClaimPlan({
             flags,
             planOptions,
+            session: state,
         });
         if (command === "identity plan" || !flags.identityConfirmation) {
             const data = { mode: "preview", plan };
             return renderedCommand({ data, render: renderIdentityPlan });
         }
-        const runtimeEnvironment = parseEnv(await readFile(loaded.paths.applicationEnvironment, "utf8"));
-        if (!runtimeEnvironment.DATABASE_URL) {
-            throw new Error("The local runtime environment has no DATABASE_URL.");
-        }
-        const needsStorageTransfer = plan.identity.assets.some((asset) => asset.rewritePath);
-        if (needsStorageTransfer &&
-            (!runtimeEnvironment.SUPABASE_URL ||
-                !runtimeEnvironment.SUPABASE_SERVICE_ROLE_KEY)) {
-            throw new Error("Identity asset transfer requires local Supabase URL and service-role credentials.");
-        }
-        const storageTransfer = needsStorageTransfer
-            ? createSupabaseStorageTransfer({
-                url: runtimeEnvironment.SUPABASE_URL,
-                serviceRoleKey: runtimeEnvironment.SUPABASE_SERVICE_ROLE_KEY,
-            })
-            : undefined;
+        const runtimeEnvironment = await loadIdentityRuntime(loaded);
+        const storageTransfer = storageTransferFor({
+            plan,
+            environment: runtimeEnvironment,
+        });
         const result = await applyIdentityClaim({
             plan,
             confirmation: flags.identityConfirmation,

package/dist/src/cli/identity_renderer.d.mts

@@ -0,0 +1,8 @@
+/** Redacted terminal output for the interactive copied-account connection. */
+import type { IdentityClaimResult } from "../identity/claim_contract.mjs";
+import type { IdentityConnectionPreview } from "../identity/connect.mjs";
+export declare const renderIdentityConnection: ({ mode, preview, result, }: {
+    mode: "preview" | "connected" | "already-connected" | "cancelled";
+    preview: IdentityConnectionPreview;
+    result?: IdentityClaimResult;
+}) => string;

package/dist/src/cli/identity_renderer.mjs

@@ -0,0 +1,33 @@
+/** Redacted terminal output for the interactive copied-account connection. */
+export const renderIdentityConnection = ({ mode, preview, result, }) => [
+    `COPIED ACCOUNT — ${mode.replaceAll("-", " ").toUpperCase()}`,
+    `Account label: ${preview.name}`,
+    `Verified provider: ${preview.provider}`,
+    `Data groups: ${preview.relationalGroups} relational; ${preview.nestedJsonGroups} nested JSON`,
+    `Images: ${preview.assetScopes} reviewed Storage scope${preview.assetScopes === 1 ? "" : "s"}; ${preview.storagePathGroups} path reference group${preview.storagePathGroups === 1 ? "" : "s"}`,
+    `Permissions: ${preview.claimKeys} reviewed claim${preview.claimKeys === 1 ? "" : "s"}; token hook ${preview.tokenHookConfigured ? "verified during connection" : "not configured"}`,
+    `Immutable history: ${preview.preservedAuditGroups} reference group${preview.preservedAuditGroups === 1 ? "" : "s"} stays with the copied audit identity`,
+    `Plan: ${preview.planDigest.slice(0, 12)}`,
+    "",
+    ...(mode === "preview"
+        ? [
+            "This changes only the disposable local sandbox.",
+            "Edited or independent local account data will make the connection stop safely.",
+            "Nothing has changed yet.",
+        ]
+        : mode === "cancelled"
+            ? [
+                "Nothing was changed. Your local database runtime is still available.",
+            ]
+            : mode === "already-connected"
+                ? [
+                    "This copied account is already connected in the current local runtime.",
+                    "No transfer was repeated.",
+                ]
+                : [
+                    `Transferred images: ${result?.storageObjectsTransferred ?? 0}`,
+                    `Removed untouched signup defaults: ${result?.removedSignupDefaults ?? 0}`,
+                    "The copied account is connected and verified.",
+                    "Sign out and sign in once more so the application receives fresh role claims.",
+                ]),
+].join("\n");