@rehearsal-db/core 0.1.0-beta.16 → 0.1.0-beta.18

package/docs/runtime-policies.md

@@ -166,9 +166,18 @@ Authentication has three separate parts:
 3. The identity policy matches that verified local identity and transfers only the
    reviewed copied-account graph.
 
-The email stays in an environment variable; only its reviewed hash is committed. Run
-`rehearsal open`, complete the ordinary local sign-in, and stop the app with `Ctrl+C`.
-Then preview and confirm the association:
+The email stays in an environment variable; only its reviewed hash is committed. The
+guided command keeps the app available for ordinary sign-in, detects the reviewed local
+Auth match, presents a redacted preview, and supplies the exact plan fingerprint
+internally after one confirmation:
+
+```bash
+npx rehearsal identity connect
+```
+
+It never intercepts provider credentials or reads browser state. After connection it
+reopens the app; sign out and sign in once to receive fresh claims. Scripts may retain
+the explicit plan and claim sequence:
 
 ```bash
 npx rehearsal identity plan --identity=approved-owner

package/docs/stability.md

@@ -0,0 +1,69 @@
+# Stability and the first stable release
+
+Rehearsal leaves beta when the workflow it already promises is dependable. Stable
+`0.1.0` does not require every planned database, desktop interface, or paid feature.
+
+## What becomes a compatibility promise
+
+Starting with `0.1.0`, Rehearsal treats these documented surfaces as public:
+
+- CLI command names, flags, JSON result fields, and exit categories in
+  [CLI commands](commands.md);
+- `rehearsal.config.mjs` schema version 1 and the policy formats documented in
+  [Configuration](configuration.md), [Sanitization](sanitization.md), and
+  [Runtime and identity policies](runtime-policies.md);
+- package entry points and generated declarations listed in
+  [TypeScript](typescript.md);
+- supported Node.js, operating-system, Docker, Supabase, and PostgreSQL boundaries in
+  [COMPATIBILITY.md](https://github.com/Ddupasquier/rehearsal-db/blob/main/COMPATIBILITY.md);
+- non-destructive ownership, confirmation, credential, and hosted-access guarantees in
+  [Security model](security-model.md).
+
+Patch releases may fix defects and improve messages without changing those contracts.
+A future breaking contract change requires a version that clearly communicates it under
+Semantic Versioning. Internal source files, terminal decoration, exact prose, temporary
+file names, and undocumented package paths are not compatibility promises.
+
+## What blocks a release candidate
+
+An issue blocks `0.1.0-rc.1` when it can cause any of the following within a supported
+configuration:
+
+- data loss, credential exposure, hosted-system access, or mutation outside resources
+  that Rehearsal can prove it owns;
+- an incorrect baseline, migration set, verification result, or successful status;
+- failure of clean installation, supported-version upgrade, restore, reset, cleanup, or
+  interruption recovery;
+- a documented CLI, configuration, policy, or TypeScript contract behaving differently
+  from its reference;
+- a supported Node.js, Supabase, PostgreSQL, macOS, or Linux path failing its maintained
+  automated gate.
+
+Cosmetic improvements, new database families, production-shaped sampling, the VS Code
+extension, desktop work, and commercial capabilities do not block the first stable
+release.
+
+## Promotion sequence
+
+1. Ship beta.18 with only stability, release-safety, upgrade, and documentation work.
+2. Freeze broad feature development on the release branch.
+3. Publish `0.1.0-rc.1` from protected `main` through the reviewed npm environment.
+4. Run the complete Rehearsal Test Lab gate twice from clean isolated workspaces.
+5. Perform one final package-only upgrade in a real consumer. The consumer must use the
+   published package rather than duplicate Rehearsal machinery.
+6. Keep the candidate available for at least seven calendar days. Restart the window if
+   a blocking package change is required.
+7. Publish `0.1.0` only when no blocking issue remains and the accepted registry artifact
+   matches the tested artifact exactly.
+
+Test Lab is the primary verification system. A real consumer is the final compatibility
+check, not a replacement for package-owned coverage. Real Google or GitHub consent does
+not need to run on every build unless authentication behavior changes.
+
+## npm channels
+
+Beta and release-candidate versions publish under the `beta` tag. Before a stable
+release exists, `latest` follows that reviewed prerelease so the ordinary install command
+remains useful. Once stable `0.1.0` exists, `latest` stays on the stable line and `beta`
+continues to identify the newest prerelease. Stable publication never rewrites the
+`beta` tag.

package/docs/troubleshooting.md

@@ -172,6 +172,23 @@ need; skipping nonce validation reduces replay protection. Otherwise keep using
 documented legacy configuration.
 Never paste provider secrets into tracked config or terminal output.
 
+For the shortest supported copied-account flow, run:
+
+```bash
+npx rehearsal identity connect
+```
+
+Leave that terminal open, then sign in through the sandbox application normally. Rehearsal
+waits for one verified match and shows a redacted plan before it changes anything. If it
+keeps waiting, finish the provider callback and confirm the reviewed matcher environment
+value is available in the terminal that started Rehearsal. `Ctrl+C`, `Ctrl+Z`, or choosing
+**Not now** stops only the owned application and leaves the database unchanged.
+
+After a successful connection, sign out and sign in once so the application receives
+fresh role claims. Rehearsal remembers the connection in the current disposable runtime;
+`reset` deliberately removes that receipt, so the next copied-account connection requires
+review again.
+
 If `identity plan` refuses the matcher, read the message literally:
 
 - **Provider or matcher type is unsupported:** use only the combinations documented in

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rehearsal-db/core",
-  "version": "0.1.0-beta.16",
+  "version": "0.1.0-beta.18",
   "private": false,
   "description": "Safely rehearse PostgreSQL and Supabase migrations against sanitized, production-shaped data.",
   "repository": {
@@ -13,7 +13,6 @@
   "homepage": "https://ddupasquier.github.io/rehearsal-db/",
   "publishConfig": {
     "access": "public",
-    "tag": "beta",
     "provenance": true
   },
   "type": "module",