@njeybe/nativ 2.4.1 → 2.5.0

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 2.5.0
+
+### Added
+
+- **Adaptive Ceremony Profiles.** Introduced `nativ profile [prototype | solo | enterprise]` to adapt framework rigor across all development stages:
+  - **`prototype`**: Zero-friction exploration for hackathons and day 1 greenfield projects. Relaxes scope enforcement, enables contract auto-adoption without escalation halts, and disables test integrity blocking.
+  - **`solo`**: Lightweight agility for solo microservices and utilities with advisory warnings and auto-evolving contracts.
+  - **`enterprise`**: Full production rigor with strict role boundaries, formal contract governor review, test integrity protection, and circuit breakers.
+- **Native CI/CD Headless Automation.** `refuseHeadless` now detects CI environments (`CI`, `GITHUB_ACTIONS`, `GITLAB_CI`, `NATIV_CI_OVERRIDE`) to permit headless test verification and automated pipeline gates without TTY failures.
+
+### Improved & Refactored
+
+- **Modular Architecture.** Decomposed large monolithic modules into focused, single-responsibility submodules adhering to the ~300-line standard:
+  - `src/commands/task/`: Split into `task-query`, `task-lifecycle`, `task-add`, `task-escalate`, and `task-common`.
+  - `src/core/verifier/`: Split into `executor`, `phases`, and `task-verifier`.
+  - `src/core/setup/`: Split into `types`, `config-merger`, `template-planner`, `setup-planner`, and `session-context`.
+  - `src/commands/db/`: Decoupled database introspection (`db-introspect`) and ANSI terminal presentation (`db-formatter`).
+  - `src/commands/triage/`: Decoupled triage persistence (`triage-store`) and interactive card UI (`triage-ui`).
+- **ESM Type Re-exports.** Fixed TypeScript interface re-exports in barrel files using explicit `export type` syntax.
+
 ## 2.4.1
 
 ### Fixed & Improved

package/README.md

@@ -34,6 +34,7 @@ cd your-project && nativ init    # scaffold .ai/ and the Claude Code configurati
 - **Contracts, not chat.** `.ai/db_schema.json`, `.ai/api_contracts.json` and `.ai/ui_specs.md` are the source of truth. Workers build against them and escalate gaps instead of improvising.
 - **Boundaries enforced by code.** A Claude Code hook checks every file write against the active task, the protected contracts and your secret files. It does not rely on the model remembering a rule.
 - **Independent verification.** A gatekeeper re-runs each task's checks before it can complete, and a separate verifier agent reviews the result.
+- **Adaptive ceremony.** Shift seamlessly between `prototype` velocity, balanced `solo` defaults, and strict `enterprise` compliance (`nativ profile`).
 - **A project that remembers.** Settled escalations and human-approved lessons travel with later tasks, so the same gap is not raised twice.
 - **Zero-credential air-gap.** Agents see database structure, never passwords, connection strings or rows.
 
@@ -141,6 +142,7 @@ Every command takes an optional `[targetDir]` (default: the current directory) a
 | :--- | :--- | :--- |
 | [`init`](#nativ-init) | Scaffold `.ai/` and the Claude Code configuration | You |
 | [`setup`](#nativ-setup) | Write or merge the Claude Code configuration | You |
+| [`profile`](#nativ-profile) | Inspect or switch ceremony profile (`prototype`, `solo`, `enterprise`) | You, Agent |
 | [`doctor`](#nativ-doctor) | Check the integration and the harness; `--fix` repairs | You, Agent (read-only) |
 | [`update`](#nativ-update) | Refresh directives, role guides and agents to the latest templates | You |
 | [`validate`](#nativ-validate) | Check the contracts and role guides are well formed | You, Agent |
@@ -203,6 +205,28 @@ nativ setup [targetDir] [options]
 | `-f, --force` | Also replace agent and directive files you edited |
 | `--json` | Output the result as JSON |
 
+#### `nativ profile`
+
+Inspect or switch the active ceremony profile. Profiles adapt the rigor of the gatekeeper, governor, and enforcement hooks to the stage of your project:
+
+- `prototype`: Maximum velocity for hackathons and spikes. Auto-adopts additive contract patches, relaxes test-integrity guards, and warns on style/scope violations.
+- `solo`: Balanced defaults for solo developers and small teams (default). Enforces task file scope, requires verification commands, but uses lightweight reviews.
+- `enterprise`: Maximum governance for high-stakes production code. Strict blocking enforcement, mandatory verification phases, required test integrity, and strict human review.
+
+```bash
+nativ profile [profile] [targetDir] [options]
+```
+
+```bash
+nativ profile                         # Show current profile and resolved settings
+nativ profile solo                    # Switch to the solo profile
+nativ profile enterprise --json       # Switch and return config as JSON
+```
+
+| Option | Description |
+| :--- | :--- |
+| `--json` | Output current or updated profile configuration as JSON |
+
 #### `nativ doctor`
 
 Check the integration for drift (MCP server, hooks, permissions, agents, providers) and the harness itself: settings that switch the guardrails off (`disableAllHooks`, `bypassPermissions`), credentials in files agents read (file and line only), roles with no guide, and lessons waiting for approval.
@@ -620,6 +644,7 @@ Written by `setup`; every key is optional.
 
 ```json
 {
+  "profile": "solo",
   "enforcement": "warn",
   "workerModels": { "simple": "haiku", "standard": "sonnet", "complex": "opus" },
   "verifyPhases": [{ "name": "types", "run": "npx tsc --noEmit" }],
@@ -631,6 +656,7 @@ Written by `setup`; every key is optional.
 
 | Key | Default | Meaning |
 | :--- | :--- | :--- |
+| `profile` | `solo` | Active ceremony profile: `prototype`, `solo` or `enterprise`. See [`nativ profile`](#nativ-profile) |
 | `enforcement` | `warn` | Role enforcement mode: `warn`, `block` or `off`. See [Guardrails](#guardrails) |
 | `workerModels` | as above | Model per task `complexity`, returned as `recommendedModel` |
 | `verifyPhases` | none | Checks run before every task's own command. See [Verification](#verification) |

package/dist/commands/db/db-formatter.d.ts

@@ -0,0 +1,5 @@
+import type { DatabaseEnv, DatabaseStatus, SchemaDiff, TableSchema } from '../../db/types.js';
+export declare function printStatusLine(env: DatabaseEnv, s: DatabaseStatus): void;
+export declare function describeColumn(c: TableSchema['columns'][number]): string;
+export declare function printDiff(diff: SchemaDiff, targetLabel: string): void;
+export declare function printInspectTables(env: DatabaseEnv, maskedUrl: string, tables: TableSchema[], entityWord: string, isCollection: boolean): void;

package/dist/commands/db/db-formatter.js

@@ -0,0 +1,116 @@
+import pc from 'picocolors';
+import { ENGINE_LABEL, keyFamily } from './db-introspect.js';
+export function printStatusLine(env, s) {
+    const label = pc.bold(env.toUpperCase().padEnd(4));
+    const synthBadge = s.synthesized && s.sourceKey ? ` ${pc.magenta(`[synthesized from ${keyFamily(s.sourceKey)}]`)}` : '';
+    if (!s.connected) {
+        console.log(`  ${pc.red('●')} ${label} ${pc.red('[OFFLINE]')}${synthBadge} ${pc.dim(s.error ?? 'Unknown error')}`);
+        if (s.suggestion) {
+            const isDiagnostic = /Ensure (MySQL|the MySQL|the PostgreSQL)/.test(s.suggestion);
+            console.log(`         ${pc.yellow(isDiagnostic ? `[DIAGNOSTIC] ${s.suggestion}` : `Tip: ${s.suggestion}`)}`);
+        }
+        if (s.maskedUrl)
+            console.log(pc.dim(`         ${s.maskedUrl}`));
+        return;
+    }
+    const count = s.entityCount ?? s.tableCount;
+    const isCollection = s.entityType === 'collection';
+    const entityWord = isCollection ? (count === 1 ? 'collection' : 'collections') : (count === 1 ? 'table' : 'tables');
+    const sourceInfo = synthBadge
+        ? synthBadge
+        : s.detectedFromExample && s.sourceKey
+            ? pc.cyan(` (via ${s.sourceKey} from ${s.exampleFile ?? '.env.example'})`)
+            : s.sourceKey
+                ? pc.dim(` (via ${s.sourceKey})`)
+                : '';
+    console.log(`  ${pc.green('●')} ${label} ${pc.green('[ONLINE]')} ${ENGINE_LABEL[s.engine] ?? s.engine}` +
+        `${s.database ? ` · ${s.database}` : ''} ${pc.dim(`(${s.pingMs}ms)`)} – ${count} ${entityWord}${sourceInfo}`);
+    console.log(pc.dim(`         ${s.maskedUrl}`));
+}
+export function describeColumn(c) {
+    const flags = [];
+    if (c.primaryKey)
+        flags.push('PK');
+    if (c.isMedia)
+        flags.push('[IMAGE]');
+    if (c.isSubcollection)
+        flags.push('[SUBCOLLECTION]');
+    const flagStr = flags.length ? ` ${pc.magenta(flags.join(' '))}` : '';
+    return `${c.type}${c.nullable ? '' : ' NOT NULL'}${c.default != null ? ` DEFAULT ${c.default}` : ''}${flagStr}`;
+}
+export function printDiff(diff, targetLabel) {
+    const s = diff.summary;
+    console.log(pc.bold(pc.cyan(`\nSchema Drift: Dev → ${targetLabel}`)));
+    console.log(`  ${pc.green(`+${s.addedTablesCount} added`)}  ${pc.yellow(`~${s.alteredTablesCount} altered`)}  ` +
+        `${pc.red(`-${s.droppedTablesCount} dropped`)}  ${pc.dim(`${s.unchangedTablesCount} unchanged`)}`);
+    if (!s.addedTablesCount && !s.alteredTablesCount && !s.droppedTablesCount) {
+        console.log(pc.green(`\n✔ In sync: Dev matches ${targetLabel}.\n`));
+        return;
+    }
+    for (const t of diff.addedTables) {
+        const isCol = t.entityType === 'collection';
+        const tag = isCol ? '[NEW COLLECTION]' : '[NEW TABLE]';
+        const fieldWord = isCol ? 'fields' : 'columns';
+        console.log(`\n  ${pc.green(tag)} ${pc.bold(t.name)} ${pc.dim(`(${t.columns.length} ${fieldWord})`)}`);
+    }
+    for (const t of diff.alteredTables) {
+        console.log(`\n  ${pc.yellow('[ALTERED]')} ${pc.bold(t.name)}${t.isDestructive ? ` ${pc.red('[DESTRUCTIVE]')}` : ''}`);
+        for (const c of t.addedColumns)
+            console.log(pc.green(`    + ${c.name}: ${describeColumn(c)}`));
+        for (const ch of t.alteredColumns) {
+            console.log(pc.yellow(`    ~ ${ch.name} (${ch.changedFields.join(', ')}): ${describeColumn(ch.before)} → ${describeColumn(ch.after)}`));
+        }
+        for (const c of t.droppedColumns)
+            console.log(pc.red(`    - ${c.name}: ${describeColumn(c)}`));
+        for (const i of t.addedIndexes)
+            console.log(pc.green(`    + index ${i.name} (${i.columns.join(', ')})${i.unique ? ' unique' : ''}`));
+        for (const i of t.droppedIndexes)
+            console.log(pc.red(`    - index ${i.name} (${i.columns.join(', ')})`));
+        for (const f of t.addedForeignKeys)
+            console.log(pc.green(`    + FK ${f.column} → ${f.referencedTable}.${f.referencedColumn}`));
+        for (const f of t.droppedForeignKeys)
+            console.log(pc.red(`    - FK ${f.column} → ${f.referencedTable}.${f.referencedColumn}`));
+    }
+    for (const t of diff.droppedTables) {
+        const isCol = t.entityType === 'collection';
+        const tag = isCol ? '[DROPPED COLLECTION]' : '[DROPPED]';
+        const fieldWord = isCol ? 'fields' : 'columns';
+        console.log(`\n  ${pc.red(tag)} ${pc.bold(t.name)} ${pc.dim(`(${t.columns.length} ${fieldWord})`)}`);
+    }
+    if (s.hasDestructiveChanges) {
+        console.log(pc.bgRed(pc.white(pc.bold(' HIGH SEVERITY '))) +
+            pc.red(` Destructive changes detected against ${targetLabel}. Applying them would drop data or fail on existing rows.`));
+    }
+    console.log('');
+}
+export function printInspectTables(env, maskedUrl, tables, entityWord, isCollection) {
+    console.log(pc.bold(pc.cyan(`\n${env.toUpperCase()} Schema (${entityWord})`)) + pc.dim(` · ${maskedUrl}`));
+    for (const t of tables) {
+        const isCol = t.entityType === 'collection' || isCollection;
+        const fieldWord = isCol ? 'fields' : 'columns';
+        const tag = isCol ? pc.green('[COLLECTION] ') : '';
+        console.log(`\n  ${tag}${pc.bold(t.name)} ${pc.dim(`(${t.columns.length} ${fieldWord})`)}`);
+        if (t.description)
+            console.log(pc.dim(`    ${t.description}`));
+        const fkByColumn = new Map(t.foreignKeys.map((f) => [f.column.toLowerCase(), f]));
+        const nameWidth = Math.max(...t.columns.map((c) => c.name.length), 4);
+        for (const c of t.columns) {
+            const fk = fkByColumn.get(c.name.toLowerCase());
+            const flags = [];
+            if (c.primaryKey)
+                flags.push(pc.magenta('PK'));
+            if (c.isMedia)
+                flags.push(pc.magenta('[IMAGE]'));
+            if (c.isSubcollection)
+                flags.push(pc.cyan('[SUBCOLLECTION]'));
+            if (fk)
+                flags.push(pc.cyan(`FK→${fk.referencedTable}.${fk.referencedColumn}`));
+            const tags = flags.join(' ');
+            console.log(`    ${c.name.padEnd(nameWidth)}  ${c.type}${c.nullable ? '' : pc.dim(' NOT NULL')}` +
+                `${c.default != null ? pc.dim(` DEFAULT ${c.default}`) : ''}${tags ? `  ${tags}` : ''}`);
+        }
+        for (const i of t.indexes)
+            console.log(pc.dim(`    index ${i.name} (${i.columns.join(', ')})${i.unique ? ' unique' : ''}`));
+    }
+    console.log('');
+}

package/dist/commands/db/db-introspect.d.ts

@@ -0,0 +1,11 @@
+import type { DatabaseEnv, DatabaseStatus } from '../../db/types.js';
+import { type IntrospectionResult } from '../../db/introspector.js';
+export declare const ENGINE_LABEL: Record<string, string>;
+/**
+ * Actionable hint when a local MySQL/PostgreSQL server refuses the connection, e.g. MySQL not started in
+ * the XAMPP Control Panel. Only host/port are read from the URL; credentials are never touched.
+ */
+export declare function localStackDiagnostic(url: string, engine: string, status: DatabaseStatus, fragmentedKeys?: string[]): string | null;
+export declare function introspectEnv(targetDir: string, env: DatabaseEnv): Promise<IntrospectionResult>;
+/** DB_HOST -> DB_*, PROD_DB_HOST -> PROD_DB_*, PGHOST -> PG*. */
+export declare function keyFamily(key: string): string;

package/dist/commands/db/db-introspect.js

@@ -0,0 +1,84 @@
+import { resolveConnections } from '../../db/env-parser.js';
+import { disconnectedStatus, introspectDatabase } from '../../db/introspector.js';
+export const ENGINE_LABEL = {
+    postgresql: 'PostgreSQL',
+    mysql: 'MySQL',
+    sqlite: 'SQLite',
+    mongodb: 'MongoDB',
+    firestore: 'Firebase Firestore',
+};
+const LOCAL_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '[::1]', '0.0.0.0']);
+/**
+ * Actionable hint when a local MySQL/PostgreSQL server refuses the connection, e.g. MySQL not started in
+ * the XAMPP Control Panel. Only host/port are read from the URL; credentials are never touched.
+ */
+export function localStackDiagnostic(url, engine, status, fragmentedKeys) {
+    if (engine !== 'mysql' && engine !== 'postgresql')
+        return null;
+    if (!/ECONNREFUSED|ETIMEDOUT|EHOSTUNREACH|connection refused/i.test(status.error ?? ''))
+        return null;
+    let host = '';
+    let port = engine === 'mysql' ? 3306 : 5432;
+    try {
+        const parsed = new URL(url);
+        host = parsed.hostname;
+        if (parsed.port)
+            port = Number(parsed.port);
+    }
+    catch {
+        return null;
+    }
+    const label = ENGINE_LABEL[engine];
+    const isLocal = LOCAL_HOSTS.has(host);
+    const action = engine === 'mysql'
+        ? isLocal
+            ? 'Ensure MySQL is started in XAMPP Control Panel.'
+            : `Ensure the MySQL server at ${host}:${port} is running and reachable.`
+        : `Ensure the PostgreSQL service is running on ${host}:${port}.`;
+    if (fragmentedKeys?.length) {
+        const shown = fragmentedKeys.filter((k) => /HOST|DATABASE|_DB$|DB_NAME$/.test(k));
+        return `Detected fragmented ${label} config (${(shown.length ? shown : fragmentedKeys).join(', ')}). ${action}`;
+    }
+    return isLocal ? `${label} refused connections on ${host}:${port}. ${action}` : null;
+}
+export async function introspectEnv(targetDir, env) {
+    const conns = resolveConnections(targetDir);
+    const conn = conns[env];
+    if (!conn) {
+        const missingKey = conns.templateInfo?.missingKeys.find((k) => k.targetEnv === env);
+        if (missingKey) {
+            const engineLabel = missingKey.engine ? ` (${ENGINE_LABEL[missingKey.engine] ?? missingKey.engine})` : '';
+            const templateName = conns.templateInfo?.templateFile ?? '.env.example';
+            const suggestion = `Found "${missingKey.key}"${engineLabel} in ${templateName}, but it is not set in your .env`;
+            return {
+                status: disconnectedStatus(`No ${env} database configured. ${suggestion}`, missingKey.engine ?? 'postgresql', '', {
+                    sourceKey: missingKey.key,
+                    detectedFromExample: true,
+                    exampleFile: templateName,
+                    suggestion,
+                }),
+                tables: [],
+            };
+        }
+        const key = env === 'dev' ? 'DEV_DATABASE_URL (or DATABASE_URL)' : 'PROD_DATABASE_URL';
+        return { status: disconnectedStatus(`No ${env} database configured. Set ${key} in .env`), tables: [] };
+    }
+    const result = await introspectDatabase(conn.url);
+    result.status.sourceKey = conn.sourceKey;
+    result.status.detectedFromExample = conn.detectedFromExample;
+    result.status.exampleFile = conn.exampleFile;
+    if (conn.synthesized)
+        result.status.synthesized = true;
+    if (!result.status.connected) {
+        const fragmentedKeys = env === 'dev' && conn.synthesized ? conns.templateInfo.fragmentedConfig?.sourceKeys : undefined;
+        const diagnostic = localStackDiagnostic(conn.url, conn.engine, result.status, fragmentedKeys ?? (conn.synthesized ? [conn.sourceKey] : undefined));
+        if (diagnostic)
+            result.status.suggestion = diagnostic;
+    }
+    return result;
+}
+/** DB_HOST -> DB_*, PROD_DB_HOST -> PROD_DB_*, PGHOST -> PG*. */
+export function keyFamily(key) {
+    const m = /^(.*_)[^_]*$/.exec(key);
+    return m ? `${m[1]}*` : `${key.slice(0, 2)}*`;
+}

package/dist/commands/db.js

@@ -2,24 +2,13 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { spawn } from 'node:child_process';
 import pc from 'picocolors';
-import { resolveConnections } from '../db/env-parser.js';
-import { disconnectedStatus, introspectDatabase } from '../db/introspector.js';
 import { diffSchemas, loadContractTables } from '../db/diff.js';
 import { DEFAULT_STUDIO_PORT, startStudioServer, writeContractSchema } from '../server/studio-server.js';
 import { renderStudioHtml } from '../server/studio-ui.js';
 import { refuseHeadless } from '../core/human-gate.js';
-/**
- * `nativ db` command handlers.
- * Air-gap: raw connection URLs are resolved in-process and never printed; all output
- * (text and --json) uses masked URLs and structural metadata only.
- */
-const ENGINE_LABEL = {
-    postgresql: 'PostgreSQL',
-    mysql: 'MySQL',
-    sqlite: 'SQLite',
-    mongodb: 'MongoDB',
-    firestore: 'Firebase Firestore',
-};
+import { resolveConnections } from '../db/env-parser.js';
+import { introspectEnv, keyFamily } from './db/db-introspect.js';
+import { printStatusLine, printDiff, printInspectTables } from './db/db-formatter.js';
 function resolveDir(targetDirArg) {
     return path.resolve(targetDirArg || process.cwd());
 }
@@ -42,165 +31,6 @@ function parseEnvOption(value, fallback) {
     process.exitCode = 1;
     return null;
 }
-async function introspectEnv(targetDir, env) {
-    const conns = resolveConnections(targetDir);
-    const conn = conns[env];
-    if (!conn) {
-        const missingKey = conns.templateInfo?.missingKeys.find((k) => k.targetEnv === env);
-        if (missingKey) {
-            const engineLabel = missingKey.engine ? ` (${ENGINE_LABEL[missingKey.engine] ?? missingKey.engine})` : '';
-            const templateName = conns.templateInfo?.templateFile ?? '.env.example';
-            const suggestion = `Found "${missingKey.key}"${engineLabel} in ${templateName}, but it is not set in your .env`;
-            return {
-                status: disconnectedStatus(`No ${env} database configured. ${suggestion}`, missingKey.engine ?? 'postgresql', '', {
-                    sourceKey: missingKey.key,
-                    detectedFromExample: true,
-                    exampleFile: templateName,
-                    suggestion,
-                }),
-                tables: [],
-            };
-        }
-        const key = env === 'dev' ? 'DEV_DATABASE_URL (or DATABASE_URL)' : 'PROD_DATABASE_URL';
-        return { status: disconnectedStatus(`No ${env} database configured. Set ${key} in .env`), tables: [] };
-    }
-    const result = await introspectDatabase(conn.url);
-    result.status.sourceKey = conn.sourceKey;
-    result.status.detectedFromExample = conn.detectedFromExample;
-    result.status.exampleFile = conn.exampleFile;
-    if (conn.synthesized)
-        result.status.synthesized = true;
-    if (!result.status.connected) {
-        const fragmentedKeys = env === 'dev' && conn.synthesized ? conns.templateInfo.fragmentedConfig?.sourceKeys : undefined;
-        const diagnostic = localStackDiagnostic(conn.url, conn.engine, result.status, fragmentedKeys ?? (conn.synthesized ? [conn.sourceKey] : undefined));
-        if (diagnostic)
-            result.status.suggestion = diagnostic;
-    }
-    return result;
-}
-const LOCAL_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '[::1]', '0.0.0.0']);
-/**
- * Actionable hint when a local MySQL/PostgreSQL server refuses the connection, e.g. MySQL not started in
- * the XAMPP Control Panel. Only host/port are read from the URL; credentials are never touched.
- */
-function localStackDiagnostic(url, engine, status, fragmentedKeys) {
-    if (engine !== 'mysql' && engine !== 'postgresql')
-        return null;
-    if (!/ECONNREFUSED|ETIMEDOUT|EHOSTUNREACH|connection refused/i.test(status.error ?? ''))
-        return null;
-    let host = '';
-    let port = engine === 'mysql' ? 3306 : 5432;
-    try {
-        const parsed = new URL(url);
-        host = parsed.hostname;
-        if (parsed.port)
-            port = Number(parsed.port);
-    }
-    catch {
-        return null;
-    }
-    const label = ENGINE_LABEL[engine];
-    const isLocal = LOCAL_HOSTS.has(host);
-    const action = engine === 'mysql'
-        ? isLocal
-            ? 'Ensure MySQL is started in XAMPP Control Panel.'
-            : `Ensure the MySQL server at ${host}:${port} is running and reachable.`
-        : `Ensure the PostgreSQL service is running on ${host}:${port}.`;
-    if (fragmentedKeys?.length) {
-        const shown = fragmentedKeys.filter((k) => /HOST|DATABASE|_DB$|DB_NAME$/.test(k));
-        return `Detected fragmented ${label} config (${(shown.length ? shown : fragmentedKeys).join(', ')}). ${action}`;
-    }
-    return isLocal ? `${label} refused connections on ${host}:${port}. ${action}` : null;
-}
-/** DB_HOST -> DB_*, PROD_DB_HOST -> PROD_DB_*, PGHOST -> PG*. */
-function keyFamily(key) {
-    const m = /^(.*_)[^_]*$/.exec(key);
-    return m ? `${m[1]}*` : `${key.slice(0, 2)}*`;
-}
-function printStatusLine(env, s) {
-    const label = pc.bold(env.toUpperCase().padEnd(4));
-    const synthBadge = s.synthesized && s.sourceKey ? ` ${pc.magenta(`[synthesized from ${keyFamily(s.sourceKey)}]`)}` : '';
-    if (!s.connected) {
-        console.log(`  ${pc.red('●')} ${label} ${pc.red('[OFFLINE]')}${synthBadge} ${pc.dim(s.error ?? 'Unknown error')}`);
-        if (s.suggestion) {
-            const isDiagnostic = /Ensure (MySQL|the MySQL|the PostgreSQL)/.test(s.suggestion);
-            console.log(`         ${pc.yellow(isDiagnostic ? `[DIAGNOSTIC] ${s.suggestion}` : `Tip: ${s.suggestion}`)}`);
-        }
-        if (s.maskedUrl)
-            console.log(pc.dim(`         ${s.maskedUrl}`));
-        return;
-    }
-    const count = s.entityCount ?? s.tableCount;
-    const isCollection = s.entityType === 'collection';
-    const entityWord = isCollection ? (count === 1 ? 'collection' : 'collections') : (count === 1 ? 'table' : 'tables');
-    const sourceInfo = synthBadge
-        ? synthBadge
-        : s.detectedFromExample && s.sourceKey
-            ? pc.cyan(` (via ${s.sourceKey} from ${s.exampleFile ?? '.env.example'})`)
-            : s.sourceKey
-                ? pc.dim(` (via ${s.sourceKey})`)
-                : '';
-    console.log(`  ${pc.green('●')} ${label} ${pc.green('[ONLINE]')} ${ENGINE_LABEL[s.engine] ?? s.engine}` +
-        `${s.database ? ` · ${s.database}` : ''} ${pc.dim(`(${s.pingMs}ms)`)} – ${count} ${entityWord}${sourceInfo}`);
-    console.log(pc.dim(`         ${s.maskedUrl}`));
-}
-function describeColumn(c) {
-    const flags = [];
-    if (c.primaryKey)
-        flags.push('PK');
-    if (c.isMedia)
-        flags.push('[IMAGE]');
-    if (c.isSubcollection)
-        flags.push('[SUBCOLLECTION]');
-    const flagStr = flags.length ? ` ${pc.magenta(flags.join(' '))}` : '';
-    return `${c.type}${c.nullable ? '' : ' NOT NULL'}${c.default != null ? ` DEFAULT ${c.default}` : ''}${flagStr}`;
-}
-function printDiff(diff, targetLabel) {
-    const s = diff.summary;
-    console.log(pc.bold(pc.cyan(`\nSchema Drift: Dev → ${targetLabel}`)));
-    console.log(`  ${pc.green(`+${s.addedTablesCount} added`)}  ${pc.yellow(`~${s.alteredTablesCount} altered`)}  ` +
-        `${pc.red(`-${s.droppedTablesCount} dropped`)}  ${pc.dim(`${s.unchangedTablesCount} unchanged`)}`);
-    if (!s.addedTablesCount && !s.alteredTablesCount && !s.droppedTablesCount) {
-        console.log(pc.green(`\n✔ In sync: Dev matches ${targetLabel}.\n`));
-        return;
-    }
-    for (const t of diff.addedTables) {
-        const isCol = t.entityType === 'collection';
-        const tag = isCol ? '[NEW COLLECTION]' : '[NEW TABLE]';
-        const fieldWord = isCol ? 'fields' : 'columns';
-        console.log(`\n  ${pc.green(tag)} ${pc.bold(t.name)} ${pc.dim(`(${t.columns.length} ${fieldWord})`)}`);
-    }
-    for (const t of diff.alteredTables) {
-        console.log(`\n  ${pc.yellow('[ALTERED]')} ${pc.bold(t.name)}${t.isDestructive ? ` ${pc.red('[DESTRUCTIVE]')}` : ''}`);
-        for (const c of t.addedColumns)
-            console.log(pc.green(`    + ${c.name}: ${describeColumn(c)}`));
-        for (const ch of t.alteredColumns) {
-            console.log(pc.yellow(`    ~ ${ch.name} (${ch.changedFields.join(', ')}): ${describeColumn(ch.before)} → ${describeColumn(ch.after)}`));
-        }
-        for (const c of t.droppedColumns)
-            console.log(pc.red(`    - ${c.name}: ${describeColumn(c)}`));
-        for (const i of t.addedIndexes)
-            console.log(pc.green(`    + index ${i.name} (${i.columns.join(', ')})${i.unique ? ' unique' : ''}`));
-        for (const i of t.droppedIndexes)
-            console.log(pc.red(`    - index ${i.name} (${i.columns.join(', ')})`));
-        for (const f of t.addedForeignKeys)
-            console.log(pc.green(`    + FK ${f.column} → ${f.referencedTable}.${f.referencedColumn}`));
-        for (const f of t.droppedForeignKeys)
-            console.log(pc.red(`    - FK ${f.column} → ${f.referencedTable}.${f.referencedColumn}`));
-    }
-    for (const t of diff.droppedTables) {
-        const isCol = t.entityType === 'collection';
-        const tag = isCol ? '[DROPPED COLLECTION]' : '[DROPPED]';
-        const fieldWord = isCol ? 'fields' : 'columns';
-        console.log(`\n  ${pc.red(tag)} ${pc.bold(t.name)} ${pc.dim(`(${t.columns.length} ${fieldWord})`)}`);
-    }
-    if (s.hasDestructiveChanges) {
-        console.log(pc.bgRed(pc.white(pc.bold(' HIGH SEVERITY '))) +
-            pc.red(` Destructive changes detected against ${targetLabel}. Applying them would drop data or fail on existing rows.`));
-    }
-    console.log('');
-}
-// ─── nativ db status ─────────────────────────────────────────────────────────
 export async function runDbStatus(targetDirArg, options = {}) {
     const targetDir = resolveDir(targetDirArg);
     const [dev, prod] = await Promise.all([introspectEnv(targetDir, 'dev'), introspectEnv(targetDir, 'prod')]);
@@ -215,7 +45,6 @@ export async function runDbStatus(targetDirArg, options = {}) {
     if (!dev.status.connected && !prod.status.connected)
         process.exitCode = 1;
 }
-// ─── nativ db inspect ────────────────────────────────────────────────────────
 export async function runDbInspect(targetDirArg, options = {}) {
     const env = parseEnvOption(options.env, 'dev');
     if (!env)
@@ -247,37 +76,8 @@ export async function runDbInspect(targetDirArg, options = {}) {
         console.log(JSON.stringify({ status: result.status, tables }, null, 2));
         return;
     }
-    console.log(pc.bold(pc.cyan(`\n${env.toUpperCase()} Schema (${entityWord})`)) + pc.dim(` · ${result.status.maskedUrl}`));
-    for (const t of tables) {
-        const isCol = t.entityType === 'collection' || isCollection;
-        const fieldWord = isCol ? 'fields' : 'columns';
-        const tag = isCol ? pc.green('[COLLECTION] ') : '';
-        console.log(`\n  ${tag}${pc.bold(t.name)} ${pc.dim(`(${t.columns.length} ${fieldWord})`)}`);
-        if (t.description)
-            console.log(pc.dim(`    ${t.description}`));
-        const fkByColumn = new Map(t.foreignKeys.map((f) => [f.column.toLowerCase(), f]));
-        const nameWidth = Math.max(...t.columns.map((c) => c.name.length), 4);
-        for (const c of t.columns) {
-            const fk = fkByColumn.get(c.name.toLowerCase());
-            const flags = [];
-            if (c.primaryKey)
-                flags.push(pc.magenta('PK'));
-            if (c.isMedia)
-                flags.push(pc.magenta('[IMAGE]'));
-            if (c.isSubcollection)
-                flags.push(pc.cyan('[SUBCOLLECTION]'));
-            if (fk)
-                flags.push(pc.cyan(`FK→${fk.referencedTable}.${fk.referencedColumn}`));
-            const tags = flags.join(' ');
-            console.log(`    ${c.name.padEnd(nameWidth)}  ${c.type}${c.nullable ? '' : pc.dim(' NOT NULL')}` +
-                `${c.default != null ? pc.dim(` DEFAULT ${c.default}`) : ''}${tags ? `  ${tags}` : ''}`);
-        }
-        for (const i of t.indexes)
-            console.log(pc.dim(`    index ${i.name} (${i.columns.join(', ')})${i.unique ? ' unique' : ''}`));
-    }
-    console.log('');
+    printInspectTables(env, result.status.maskedUrl, tables, entityWord, isCollection);
 }
-// ─── nativ db diff ───────────────────────────────────────────────────────────
 export async function runDbDiff(targetDirArg, options = {}) {
     const target = (options.target ?? 'prod').toLowerCase();
     if (target !== 'prod' && target !== 'contract') {
@@ -318,7 +118,6 @@ export async function runDbDiff(targetDirArg, options = {}) {
     if (options.exitCode && s.addedTablesCount + s.alteredTablesCount + s.droppedTablesCount > 0)
         process.exitCode = 1;
 }
-// ─── nativ db sync ───────────────────────────────────────────────────────────
 /** Exports a live schema into .ai/db_schema.json. Previews unless --yes is passed. */
 export async function runDbSync(targetDirArg, options = {}) {
     const source = parseEnvOption(options.source, 'dev');
@@ -352,7 +151,6 @@ export async function runDbSync(targetDirArg, options = {}) {
     const entityWord = isCollection ? (count === 1 ? 'collection' : 'collections') : (count === 1 ? 'table' : 'tables');
     console.log(pc.green(`✔ Wrote ${count} ${entityWord} (structure only, no credentials) to ${path.relative(targetDir, filePath)}\n`));
 }
-// ─── nativ db ui ─────────────────────────────────────────────────────────────
 function openBrowser(url) {
     const [cmd, args] = process.platform === 'win32'
         ? ['cmd', ['/c', 'start', '""', url]]

package/dist/commands/profile.d.ts

@@ -0,0 +1,3 @@
+export declare function runProfileCommand(profileArg?: string, targetDirArg?: string, options?: {
+    json?: boolean;
+}): Promise<void>;

package/dist/commands/profile.js

@@ -0,0 +1,39 @@
+import path from 'node:path';
+import pc from 'picocolors';
+import { loadProfile, setProfile, PROFILE_DEFAULTS } from '../core/profiles.js';
+export async function runProfileCommand(profileArg, targetDirArg, options = {}) {
+    const root = path.resolve(targetDirArg || process.cwd());
+    if (!profileArg) {
+        const current = loadProfile(root);
+        const details = PROFILE_DEFAULTS[current];
+        if (options.json) {
+            console.log(JSON.stringify(details, null, 2));
+            return;
+        }
+        console.log(pc.bold(pc.cyan(`\nCurrent nativ Profile: `)) + pc.yellow(current.toUpperCase()));
+        console.log(pc.dim(`  ${details.description}\n`));
+        console.log(pc.dim('  • Enforcement:      ') + pc.white(details.enforcement));
+        console.log(pc.dim('  • Governor:         ') + pc.white(details.governorMode));
+        console.log(pc.dim('  • Test Integrity:   ') + pc.white(details.testIntegrity));
+        console.log(pc.dim('  • Headless CI/CD:   ') + pc.white(details.allowHeadlessBypass ? 'enabled' : 'restricted'));
+        console.log(pc.dim('\nTo switch profile: ') + pc.white('nativ profile [prototype | solo | enterprise]\n'));
+        return;
+    }
+    const p = profileArg.toLowerCase();
+    if (p !== 'prototype' && p !== 'solo' && p !== 'enterprise') {
+        console.error(pc.red(`\n✖ Invalid profile "${profileArg}". Choose prototype, solo, or enterprise.\n`));
+        process.exitCode = 1;
+        return;
+    }
+    const updated = setProfile(root, p);
+    if (options.json) {
+        console.log(JSON.stringify(updated, null, 2));
+        return;
+    }
+    console.log(pc.green(`\n✔ Switched active profile to `) + pc.bold(pc.cyan(p.toUpperCase())));
+    console.log(pc.dim(`  ${updated.description}\n`));
+    console.log(pc.dim('  • Enforcement:      ') + pc.white(updated.enforcement));
+    console.log(pc.dim('  • Governor:         ') + pc.white(updated.governorMode));
+    console.log(pc.dim('  • Test Integrity:   ') + pc.white(updated.testIntegrity));
+    console.log('');
+}

package/dist/commands/task/task-add.d.ts

@@ -0,0 +1,11 @@
+import { MasterPlan } from '../../scanner/types.js';
+import { TaskAddOptions, TaskAddResult } from './task-common.js';
+export declare const FAST_PATH_MILESTONE_NAME = "Fast-Path Tasks";
+export declare function generateNextTaskId(plan: MasterPlan): string;
+export declare function generateNextMilestoneId(plan: MasterPlan): string;
+/**
+ * Appends a task to .ai/master_plan.json with an auto-incremented ID.
+ * Routing: --milestone wins; otherwise fast-path tasks go to the fast-path milestone (created on
+ * first use) and planned tasks to the active milestone. Completed milestones are reopened.
+ */
+export declare function runTaskAdd(title: string, targetDirArg?: string, options?: TaskAddOptions): Promise<TaskAddResult | null>;