backend-skeleton 1.1.1 → 1.3.0

package/bin/bskel.mjs

@@ -10,6 +10,7 @@ import { forceNamedGate, revokeNamedGate, requireNamedGate, passNamedGate, await
 import { REPO_GATE_ID, GATE_NAMES, gateScopeId, requireGateDefinition } from '../lib/gate-definitions.mjs';
 import { getGate, loadState, historyPath } from '../lib/state.mjs';
 import { writeFileAtomic, sha256File, readJsonIfExists } from '../lib/fsutil.mjs';
+import { hydrateScanReportFilePaths, dehydrateScanReportFilePaths } from '../lib/scan-report-paths.mjs';
 import { validateAgainstSchema, formatSchemaErrors } from '../lib/schema-validate.mjs';
 import { withLockSync } from '../lib/lock.mjs';
 import { specDir, specPath, sbfPath } from '../lib/paths.mjs';
@@ -43,7 +44,8 @@ import {
 	findCollisions, evaluateCrossFeatureFindings, waiverKey,
 	crossFeatureReportPath, loadCrossFeatureReport, loadCrossFeatureResolution, saveCrossFeatureResolution,
 } from '../lib/cross-feature-collisions.mjs';
-import { STACKS as NEW_STACKS, ALL_STACK_PARAMS, stacksAccepting } from '../new/index.mjs';
+import { STACKS as NEW_STACKS, ALL_STACK_PARAMS, stacksAccepting, reusableParamsFor } from '../new/index.mjs';
+import { recordPattern, listPatterns, getPattern, isMissingPatternTable, summarizePatternFrequency } from '../patterns/store.mjs';
 import {
 	requireSingleLineText, requireValidJavaPackageName, requireValidArtifactId,
 	requireValidPythonVersion, requireValidLicense, requireValidDatabase, requireSupportedJavaVersion,
@@ -52,6 +54,8 @@ import {
 import { DEFAULT_GROUP_ID, DEFAULT_JAVA_VERSION, resolveSpringDependencies } from '../new/spring.mjs';
 import { buildReconciliation, snapshotFromReconciliation, describeSourceFile } from '../contracts/openapi.mjs';
 import { buildOpenApiDocument, pathPrefixCandidates, unreflectedPathPrefixes, STATUS_CODE_MODES } from '../contracts/export.mjs';
+import { buildContractCsv } from '../contracts/csv.mjs';
+import { buildErdDiagram } from '../scanners/db/erd.mjs';
 import { loadCatalogEntry, listCatalogChoices, planApply, applyPlan } from '../stack/apply.mjs';
 import { PROVIDERS, PROVIDER_LOAD_ERRORS, providerById } from '../handles/registry.mjs';
 import { detectAstHelperAvailable, runAstClassify } from '../handles/providers/java-spring/ast-bridge.mjs';
@@ -64,7 +68,7 @@ import { plan as planTypeScriptExpress } from '../handles/providers/typescript-e
 import { emitObserveTypeScriptExpress } from '../handles/providers/typescript-express/observe.mjs';
 import { collectGateStatuses, runBuildCheck, checkArtifacts, checkResolverConflicts } from '../lib/verify.mjs';
 import { computeWorkflowState } from '../lib/workflow.mjs';
-import { computeDoctorChecks, WORKFLOWS as DOCTOR_WORKFLOWS } from '../lib/doctor.mjs';
+import { computeDoctorChecks, WORKFLOWS as DOCTOR_WORKFLOWS, binaryAvailable } from '../lib/doctor.mjs';
 import { parseCommand, renderCommandHelp, diagnostic } from '../lib/cli.mjs';
 import { EXIT_CODES } from '../lib/exit-codes.mjs';
 import { RESIDUAL_TEMPLATE_VAR_RE } from '../lib/template.mjs';
@@ -75,11 +79,15 @@ const SKILL_ROOT = path.resolve(__dirname, '..');
 function usage() {
 	console.error(`bskel -- backend-skeleton CLI
 
-  bskel new --stack spring|fastapi --slug <name> [--dir <path>] [--offline] [--json] [--name <text>] [--description <text>] [--project-version <v>] [--group-id <pkg>] [--artifact-id <id>] [--package-name <pkg>] [--java-version <n>] [--packaging jar|war] [--dependencies a,b,c] [--add-dependencies a,b,c] [--python-version <spec>] [--port N] [--license <spdx>] [--database postgres|sqlite|none]
+  bskel new --stack spring|fastapi --slug <name> [--dir <path>] [--offline] [--json] [--name <text>] [--description <text>] [--project-version <v>] [--group-id <pkg>] [--artifact-id <id>] [--package-name <pkg>] [--java-version <n>] [--packaging jar|war] [--dependencies a,b,c] [--add-dependencies a,b,c] [--python-version <spec>] [--port N] [--license <spdx>] [--database postgres|sqlite|none] [--record-pattern --pattern-database-url-env <NAME>]
+  bskel pattern list --pattern-database-url-env <NAME> [--stack spring|fastapi] [--json]
+  bskel pattern show <pattern_id> --pattern-database-url-env <NAME> [--json]
+  bskel pattern suggest --stack spring|fastapi --pattern-database-url-env <NAME> [--json]
   bskel preflight [--max-behind N] [--offline|--no-fetch] [--allow-dirty] [--max-age-minutes N] [--fetch-timeout-seconds N] [--json]
   bskel scan [--feature <id>] [--terms a,b,c] [--json] [--accept-low-confidence] [--db [--database-url-env <NAME>] [--schema public]]
   bskel scan disposition --feature <id> --mode reuse|extend|replace|parallel [--module <name>] [--note "..."] [--breaking-approved]
   bskel scan explain <module> --feature <id> [--json]
+  bskel scan repair --feature <id> [--json]
   bskel scan cross-feature-check --feature <id> [--db [--database-url-env <NAME>] [--schema public]] [--json]
   bskel scan cross-feature-waive --feature <id> --signal resource_type|table|operation_id|db_foreign_key --identifier <name> --other-feature <id> --reason "..."
   bskel feature init --slug <name>
@@ -90,6 +98,8 @@ function usage() {
   bskel feature archive <id> --reason "..." [--json]
   bskel contract emit --feature <id> [--module <name>] [--json] [--openapi-file <path>] [--path-prefix /api/v0] [--descriptions]
   bskel contract export --feature <id> [--out <path>] [--json] [--allow-unprefixed] [--status-codes range|literal]
+  bskel contract export-csv --feature <id> [--out <path>] [--bom] [--json]
+  bskel db erd [--database-url-env <NAME>] [--schema public] [--out <path>] [--json]
   bskel contract history --feature <id> [--json]
   bskel contract validate --feature <id> --file <envelope.json>
   bskel contract tool-schema --feature <id> --operation <operationId>
@@ -109,7 +119,7 @@ function usage() {
   bskel patch rollback --feature <id> --transaction <id> --reason "..." [--force] [--json]
   bskel patch list --feature <id> [--json]
   bskel observe emit --feature <id> [--module <name>] [--force --reason "..."] [--check] [--diff] [--json]
-  bskel observe import --feature <id> --receipts <path> [--fail-on-violation] [--json]
+  bskel observe import --feature <id> --receipts <path> [--fail-on-violation] [--pubkey <path> [--require-signature]] [--json]
   bskel verify --feature <id> [--build [--allow-skip-build]] [--json]
   bskel status [--feature <id>] [--json]
   bskel next [--feature <id>] [--json]
@@ -603,8 +613,16 @@ async function cmdScan(args) {
 	setContext('scan', flags);
 	const root = requireRepoRoot();
 	const terms = deriveTerms(flags);
-	if (terms.length === 0) {
-		fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', 'usage: bskel scan [--feature <id>] --terms a,b,c   (need at least one search term, from --terms or a --feature slug)');
+	// D-zero-config-scan: only refuse when the user EXPLICITLY tried to supply terms (or a
+	// --feature) and it resolved to nothing -- a real usage mistake worth catching (a `--terms ""`/
+	// `--terms ,,` typo, or a --feature slug that pathologically derives zero words), same as
+	// before this item. Neither flag given at all is no longer an error -- it's the new zero-flag
+	// "inventory" mode (every module this adapter finds, unscored -- see scanners/index.mjs's
+	// runScan()), reachable only because the block below still gates it on `!flags.feature` before
+	// any gate/file write happens, exactly like today's ad-hoc mode already does.
+	const termsFlagGiven = args.some((a) => a === '--terms' || a.startsWith('--terms='));
+	if (terms.length === 0 && (termsFlagGiven || flags.feature)) {
+		fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', 'usage: bskel scan [--feature <id>] [--terms a,b,c]   (--terms was given but resolved to no real search term -- pass at least one, e.g. --terms organization, or drop --terms entirely for a full unscored inventory of every module this repo\'s adapter finds)');
 	}
 	if (flags.feature) {
 		requireValidFeatureId(flags.feature);
@@ -612,6 +630,11 @@ async function cmdScan(args) {
 	}
 
 	const dbSchema = await resolveDbSchemaOrExit(root, flags);
+	// D-zero-config-scan: the same CLI-boundary-resolved-input pattern `dbSchema` above already
+	// establishes, applied to a second external dependency -- computed once, used on BOTH the
+	// inventory and the --feature-scoped path (a real Spring repo scanned with --feature+--terms is
+	// exactly as vulnerable to the silent detect()-time degradation as the zero-flag case).
+	const rgAvailable = binaryAvailable('rg');
 
 	// G1: a broken adapter file doesn't stop the adapters that DID load, but every `scan` run
 	// says so loudly (also see `bskel doctor`, which exits 1 while any of these remain).
@@ -620,7 +643,7 @@ async function cmdScan(args) {
 	}
 	let report;
 	try {
-		report = runScan({ repoRoot: root, terms, includeDb: flags.db, dbSchema });
+		report = runScan({ repoRoot: root, terms, includeDb: flags.db, dbSchema, rgAvailable });
 	} catch (err) {
 		// Unreachable with the two shipped adapters (generic-grep's specificity-0 detect() is
 		// unconditional) -- becomes reachable the moment a future adapter's detect() is
@@ -668,7 +691,12 @@ async function cmdScan(args) {
 
 	const dir = specDir(root, flags.feature);
 	fs.mkdirSync(dir, { recursive: true });
-	writeScanReportOrExit(specPath(root, flags.feature, 'brownfield-scan.json'), report);
+	// D-scan-report-portable-paths: `report`'s `.file` fields stay absolute in memory (every
+	// consumer's expected shape, including this same function's OWN JSON stdout print below) --
+	// only the ON-DISK copy is converted to repo-relative, so the committed artifact survives
+	// being checked out somewhere else (a second worktree, a different clone, CI) without
+	// requiring any change to how `.file` is read back in memory once re-hydrated.
+	writeScanReportOrExit(specPath(root, flags.feature, 'brownfield-scan.json'), dehydrateScanReportFilePaths(report, root));
 	writeFileAtomic(specPath(root, flags.feature, 'brownfield-scan.md'), renderScanMarkdown(report));
 
 	let gateState;
@@ -748,7 +776,7 @@ function cmdScanExplain(args) {
 	if (!moduleName) {
 		fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', 'usage: bskel scan explain <module> --feature <id> [--json]');
 	}
-	const report = loadScanReportOrExit(root, flags.feature);
+	const report = loadHydratedScanReportOrExit(root, flags.feature);
 	const mod = report.related_modules.find((m) => m.module === moduleName);
 	if (!mod) {
 		const known = report.related_modules.map((m) => m.module).join(', ') || '(none)';
@@ -762,6 +790,60 @@ function cmdScanExplain(args) {
 	process.exit(0);
 }
 
+// D-scan-report-portable-paths: a one-time, non-destructive migration for a committed
+// brownfield-scan.json written BEFORE this fix (schema "sbf.scan-report/1", `.file` absolute) --
+// `bskel scan`'s own re-run is NOT a substitute here: runScan() never carries `disposition`
+// forward, so re-scanning would silently wipe an already-disposed feature's disposition and
+// cascade `scan`/`contract`/`handles` gates back to stale/awaiting_disposition. This command
+// touches ONLY `.file` strings and `schema` -- `disposition` and everything else stay
+// byte-identical. Must run from the SAME location the original `bskel scan` ran from (a fresh
+// worktree's absolute paths won't resolve to anything real) -- fails closed, naming the exact
+// file, rather than guessing at a mapping.
+function cmdScanRepair(args) {
+	const flags = parseCommand('scan repair', args);
+	if (flags.help) { console.log(renderCommandHelp('scan repair')); process.exit(0); }
+	setContext('scan repair', flags);
+	const root = requireRepoRoot();
+	requireValidFeatureId(flags.feature);
+
+	// Deliberately NOT loadScanReportOrExit() -- that validates against the CURRENT schema const
+	// ("sbf.scan-report/2"), which a genuinely old ("/1") report can never match by definition.
+	// This command's whole job is repairing exactly that mismatch, so it reads raw here.
+	const reportPath = specPath(root, flags.feature, 'brownfield-scan.json');
+	if (!fs.existsSync(reportPath)) {
+		fail(EXIT_CODES.NOT_PASSED, 'MISSING_ARTIFACT', `no scan report at ${reportPath} -- run \`bskel scan --feature ${flags.feature}\` first`);
+	}
+	const report = JSON.parse(fs.readFileSync(reportPath, 'utf8'));
+	if (report.schema !== 'sbf.scan-report/1') {
+		fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', `${flags.feature}'s scan report is already schema "${report.schema}" -- nothing to repair (this command only migrates a "sbf.scan-report/1" report's absolute \`.file\` paths to repo-relative).`);
+	}
+
+	const unresolvable = [];
+	for (const mod of report.related_modules ?? []) {
+		for (const key of ['controllers', 'entities', 'enums', 'dtos']) {
+			for (const item of mod[key] ?? []) {
+				if (item.file && !fs.existsSync(item.file)) unresolvable.push(item.file);
+			}
+		}
+	}
+	if (unresolvable.length > 0) {
+		fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', `refusing to guess: ${unresolvable.length} file(s) referenced in this scan report do not exist under the CURRENT root -- re-run this command from the exact location \`bskel scan\` originally ran from:\n${unresolvable.map((f) => `  ${f}`).join('\n')}`);
+	}
+
+	// D-scan-report-portable-paths: same transform `cmdScan` applies at every real write -- a
+	// legacy report is, by definition, exactly the "still absolute" case that needs converting.
+	const repaired = dehydrateScanReportFilePaths(report, root);
+	repaired.schema = 'sbf.scan-report/2';
+	writeScanReportOrExit(reportPath, repaired);
+
+	if (flags.json) {
+		console.log(JSON.stringify({ feature_id: flags.feature, schema: repaired.schema, repaired: true }, null, 2));
+	} else {
+		console.log(`repaired: ${flags.feature}'s scan report is now schema "${repaired.schema}" (disposition and every other field untouched)`);
+	}
+	process.exit(0);
+}
+
 // D-cross-feature-collision: mirrors cmdContractEmit's own "always write the artifact, gate
 // blocks only if unresolved issues remain" shape exactly, for a different data source (NAME-
 // identity collisions against every OTHER feature, not this feature's own contract completeness).
@@ -1194,11 +1276,11 @@ function cmdContractEmit(args) {
 		});
 	}
 
+	// D-scan-report-portable-paths: was its own inline fs.existsSync/JSON.parse here, duplicating
+	// (and bypassing) loadScanReportOrExit()'s schema validation -- consolidated onto the shared,
+	// hydrated loader, closing both that gap and the portability bug the hydration itself fixes.
 	const scanReportPath = specPath(root, flags.feature, 'brownfield-scan.json');
-	if (!fs.existsSync(scanReportPath)) {
-		fail(EXIT_CODES.NOT_PASSED, 'MISSING_ARTIFACT', `no scan report at ${scanReportPath} -- run \`bskel scan --feature ${flags.feature}\` first`);
-	}
-	const scanReport = JSON.parse(fs.readFileSync(scanReportPath, 'utf8'));
+	const scanReport = loadHydratedScanReportOrExit(root, flags.feature);
 	requireCapabilitiesOrExit(scanReport, 'contract emit', {
 		featureId: flags.feature,
 		scanReportPath,
@@ -1528,6 +1610,181 @@ function cmdContractExport(args) {
 	process.exitCode = EXIT.PASS;
 }
 
+// D-contract-csv: the soft-refusal counterpart to loadScanReportOrExit() above -- returns null
+// (skip the path-prefix check entirely) on ANY failure (missing file, unparseable JSON, schema
+// violation) instead of exiting. `contract export-csv` treats this check as advisory (see C5 in
+// D-contract-csv, DECISIONS.md): a scan report that can't be read is not itself a reason to block a
+// human-reviewed artifact, unlike `contract export`'s own hard guard for a machine-consumed one.
+function tryLoadScanReport(root, featureId) {
+	const scanReportPath = specPath(root, featureId, 'brownfield-scan.json');
+	if (!fs.existsSync(scanReportPath)) return null;
+	try {
+		const parsed = JSON.parse(fs.readFileSync(scanReportPath, 'utf8'));
+		const { ok } = validateAgainstSchema('scan-report.schema.json', parsed);
+		return ok ? parsed : null;
+	} catch {
+		return null;
+	}
+}
+
+// D-contract-csv: a spreadsheet-shaped projection of a feature contract. Mirrors
+// cmdContractExport's overall shape (loadContract, zero-operation refusal, --out/stdout via
+// writeFileAtomic) but is deliberately UNGATED -- it never calls requireNamedGate('contract', ...)
+// and never hard-refuses on an unreflected path prefix, only warns. See D-contract-csv in
+// DECISIONS.md for the full risk-model argument (a CSV is read by a human deciding whether to
+// waive a partial contract -- gating it would make it useless exactly when it matters).
+function cmdContractExportCsv(args) {
+	const flags = parseCommand('contract export-csv', args);
+	if (flags.help) { console.log(renderCommandHelp('contract export-csv')); process.exit(0); }
+	setContext('contract export-csv', flags);
+	const root = requireRepoRoot();
+	requireValidFeatureId(flags.feature);
+
+	const contract = loadContract(root, flags.feature);
+
+	// Same positive-false-claim refusal `contract export` itself makes (see that function's own
+	// comment) -- a zero-row CSV handed to a stakeholder reads as "this feature has no API".
+	if (Object.keys(contract.operations).length === 0) {
+		fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', `\`${flags.feature}\`'s contract has zero operations (completeness: ${contract.completeness.status}) -- exporting it would produce a table positively claiming this API has no operations. Fix --module/--terms and re-run \`bskel contract emit --feature ${flags.feature}\`.`);
+	}
+
+	// C5 (D-contract-csv): advisory only. If the scan report cannot be read, the check is skipped
+	// silently rather than refusing (contrast cmdContractExport's loadScanReportOrExit(), which hard-exits).
+	let pathPrefixWarning = null;
+	const scanReport = tryLoadScanReport(root, flags.feature);
+	if (scanReport) {
+		const candidates = pathPrefixCandidates(scanReport.path_prefix_signals);
+		const unreflected = unreflectedPathPrefixes(contract, candidates);
+		if (unreflected.length > 0) {
+			pathPrefixWarning = `this repo's scan found a global path-prefix signal (${unreflected.join(', ')}) that ${flags.feature}'s contract paths do not reflect -- the paths in this CSV may be missing it. Re-run \`bskel contract emit --feature ${flags.feature} --openapi-file <real-generated-doc>\` to correct them, or treat this export as informational only.`;
+			console.error(`note: ${pathPrefixWarning}`);
+		}
+	}
+
+	const built = buildContractCsv({ contract });
+	if (!built.ok) {
+		// Unreachable given the zero-operation refusal above already covers this case -- kept as
+		// a real check rather than assuming buildContractCsv()'s precondition forever.
+		fail(EXIT_CODES.NOT_PASSED, 'INVALID_ARTIFACT', `cannot export ${flags.feature}'s contract to CSV: ${built.error}`);
+	}
+
+	// C2 (D-contract-csv): unconditional -- a reader must not have to guess whether a blank column
+	// means "nothing to show" or "the tool is broken".
+	if (built.emptyColumns.length > 0) {
+		console.error(`note: ${built.emptyColumns.length} of ${built.columns.length} columns are empty for every operation (${built.emptyColumns.join(', ')}) -- this contract was emitted without --openapi-file, so no source document ever stated them. Re-run \`bskel contract emit --feature ${flags.feature} --openapi-file <doc>\` to populate them.`);
+	}
+
+	// C4 (D-contract-csv): BOM is opt-in -- Excel-on-Windows mangles non-ASCII without one, but a
+	// BOM breaks naive parsers/`head`/`diff` for everyone else, so neither default is right for everyone.
+	const csvText = flags.bom ? `\uFEFF${built.csv}` : built.csv;
+
+	if (flags.out) {
+		const outPath = path.resolve(process.cwd(), flags.out);
+		writeFileAtomic(outPath, csvText);
+		if (flags.json) {
+			console.log(JSON.stringify({
+				schema: 'sbf.contract-export-csv/1',
+				feature_id: contract.feature_id,
+				out: flags.out,
+				row_count: built.rowCount,
+				columns: built.columns,
+				completeness: contract.completeness.status,
+				path_prefix_warning: pathPrefixWarning,
+			}, null, 2));
+		} else if (!flags.quiet) {
+			console.log(`wrote ${flags.out} -- ${built.rowCount} operation(s), completeness: ${contract.completeness.status}`);
+		}
+	} else {
+		// process.stdout.write, not console.log -- `csvText` already ends in exactly one `\n`
+		// (contracts/csv.mjs's toCsv()), and console.log would append a SECOND one, making stdout
+		// byte-different from the file --out writes. C7 (D-contract-csv): the artifact is the only
+		// thing on stdout here.
+		process.stdout.write(csvText);
+		if (flags.json) {
+			console.error('note: --json has no effect without --out -- stdout is the CSV itself. Pass --out <path> to get both.');
+		}
+	}
+	// D-process-exit-audit: NOT process.exit() -- same reasoning as cmdContractExport's own
+	// trailing comment; a 300-operation CSV can clear the 64KB pipe buffer just as easily.
+	process.exitCode = EXIT.PASS;
+}
+
+// D-db-erd: a Mermaid `erDiagram` of the database plane -- repo-independent like `bskel new`/
+// `bskel pattern *` (no --feature; the database plane is not feature-scoped, see E6 in D-db-erd,
+// DECISIONS.md). Reuses resolveDbSchemaOrExit() unchanged (via a synthetic `db: true`) so
+// --database-url-env's env-var handling and every error string stay byte-identical to `scan --db`.
+async function cmdDbErd(args) {
+	const flags = parseCommand('db erd', args);
+	if (flags.help) { console.log(renderCommandHelp('db erd')); process.exit(0); }
+	setContext('db erd', flags);
+	const root = requireRepoRoot();
+
+	// E1 (D-db-erd)'s own `--db` flag doesn't exist on this command -- the verb `db erd` implies
+	// it, so a synthetic `db: true` is threaded through to the exact same helper `scan --db` uses,
+	// never a second copy of its env-var-unset/connection-failure handling.
+	const { live, migrations } = await resolveDbSchemaOrExit(root, { ...flags, db: true });
+
+	if (!live && (!migrations || migrations.tables.length === 0)) {
+		if (migrations && migrations.tool === 'liquibase') {
+			fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', `no schema to draw: this repo's Liquibase changelogs were detected (${migrations.files.length} file(s)) but none are plain .sql -- XML/YAML changelog parsing is not supported (see D-db-schema-plane in DECISIONS.md). Pass --database-url-env <NAME> for live introspection instead.`);
+		}
+		fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', 'no schema to draw: no Flyway/Liquibase migration files found in this repo, and no --database-url-env was given. Pass --database-url-env <NAME> (an already-exported environment variable; never read from .env directly -- see D-db-schema-plane in DECISIONS.md) for live introspection.');
+	}
+
+	const version = JSON.parse(fs.readFileSync(path.join(SKILL_ROOT, 'package.json'), 'utf8')).version;
+	const invocation = flags['database-url-env']
+		? `bskel db erd --database-url-env ${flags['database-url-env']} --schema ${flags.schema}`
+		: 'bskel db erd';
+	const built = buildErdDiagram({ live, migrations, generatedBy: `bskel ${version} -- \`${invocation}\`` });
+	if (!built.ok) {
+		// Unreachable given the refusal above already covers both reasons buildErdDiagram() can
+		// report -- kept as a real check rather than assuming its precondition forever.
+		fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', `no schema to draw (${built.reason})`);
+	}
+
+	// E2 (D-db-erd): unconditional when degraded -- a reader must see this before the diagram, not
+	// discover it by noticing every type says `unknown`.
+	if (built.degraded) {
+		console.error(`note: this diagram is DEGRADED -- built from migration files, not a live database. Missing: ${built.missing.join(', ')}. Pass --database-url-env <NAME> for a complete diagram.`);
+	}
+	// E6 (D-db-erd): a readability nudge only, never a refusal -- whole-schema is the only mode
+	// this version supports.
+	if (built.entityCount > 40) {
+		console.error(`note: ${built.entityCount} entities -- this diagram may be dense (whole-schema only in this version; see E6 in D-db-erd, DECISIONS.md).`);
+	}
+
+	if (flags.out) {
+		const outPath = path.resolve(process.cwd(), flags.out);
+		writeFileAtomic(outPath, built.mermaid);
+		if (flags.json) {
+			console.log(JSON.stringify({
+				schema: 'sbf.db-erd/1',
+				out: flags.out,
+				plane: built.plane,
+				entity_count: built.entityCount,
+				relationship_count: built.relationshipCount,
+				unresolved_relationships: built.unresolvedRelationships,
+				external_tables: built.externalTables,
+				renames: built.renames,
+				degraded: built.degraded,
+				missing: built.missing,
+			}, null, 2));
+		} else if (!flags.quiet) {
+			console.log(`wrote ${flags.out} -- ${built.entityCount} entity(ies), ${built.relationshipCount} relationship(s), plane: ${built.plane}${built.degraded ? ' (degraded)' : ''}`);
+		}
+	} else {
+		// process.stdout.write, not console.log -- same E10 (D-db-erd) byte-exactness reasoning as
+		// cmdContractExportCsv's own C7 (built.mermaid already ends in exactly one `\n`).
+		process.stdout.write(built.mermaid);
+		if (flags.json) {
+			console.error('note: --json has no effect without --out -- stdout is the diagram itself. Pass --out <path> to get both.');
+		}
+	}
+	// D-process-exit-audit: NOT process.exit() -- a 200-table diagram can clear the 64KB pipe
+	// buffer just as easily as a schema-rich OpenAPI export.
+	process.exitCode = EXIT.PASS;
+}
+
 // A5: the `scan disposition` of contracts -- lets a human explicitly accept a `partial`
 // contract's outstanding warnings so the `contract` gate can pass. Deliberately no wildcard
 // waiver: `--all` expands to the SPECIFIC code+subject pairs present right now, recorded as
@@ -2101,6 +2358,19 @@ function loadScanReportOrExit(root, featureId) {
 	return parsed;
 }
 
+// D-scan-report-portable-paths: the read-only sibling of loadScanReportOrExit() -- every consumer
+// that only READS the report (never writes it back) should go through this instead, so its
+// `related_modules[].{controllers,entities,enums,dtos}[].file` values are correctly re-anchored to
+// THIS root before anything downstream (handles codegen, contract emission, gate recomputation)
+// touches them. Deliberately NOT folded into loadScanReportOrExit() itself: cmdScanDisposition()
+// does load -> mutate `.disposition` -> write back the WHOLE object -- if hydration lived in the
+// base loader, that round trip would silently re-persist re-absolutized paths to disk, resurrecting
+// the exact portability bug this closes. Any future read-modify-write command must stay on the raw
+// loader for the same reason.
+function loadHydratedScanReportOrExit(root, featureId) {
+	return hydrateScanReportFilePaths(loadScanReportOrExit(root, featureId), root);
+}
+
 // S5 (D-persistence-integrity): the write-side sibling of loadScanReportOrExit() above -- validated
 // before it ever touches disk, same "fail loud here, not as a confusing error somewhere later"
 // reasoning as lib/state.mjs's saveState(). Used by both cmdScan()'s own write and
@@ -2225,7 +2495,7 @@ async function cmdHandlesPlan(args) {
 	if (flags.help) { console.log(renderCommandHelp('handles plan')); process.exit(0); }
 	setContext('handles plan', flags);
 	const root = requireRepoRoot();
-	const scanReport = loadScanReportOrExit(root, flags.feature);
+	const scanReport = loadHydratedScanReportOrExit(root, flags.feature);
 	const scanReportPath = specPath(root, flags.feature, 'brownfield-scan.json');
 	requireCapabilitiesOrExit(scanReport, 'handles plan', { featureId: flags.feature, scanReportPath });
 	const provider = selectProviderOrExit(scanReport);
@@ -2360,7 +2630,7 @@ function cmdHandlesEmit(args) {
 		});
 	}
 
-	const scanReport = loadScanReportOrExit(root, flags.feature);
+	const scanReport = loadHydratedScanReportOrExit(root, flags.feature);
 	const scanReportPath = specPath(root, flags.feature, 'brownfield-scan.json');
 	requireCapabilitiesOrExit(scanReport, 'handles emit', { featureId: flags.feature, scanReportPath });
 	const provider = selectProviderOrExit(scanReport);
@@ -2524,7 +2794,7 @@ function cmdHandlesPatchApprove(args) {
 		fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', 'bskel handles patch approve requires --reason "..." -- every approval must be auditable');
 	}
 
-	const scanReport = loadScanReportOrExit(root, flags.feature);
+	const scanReport = loadHydratedScanReportOrExit(root, flags.feature);
 	const scanReportPath = specPath(root, flags.feature, 'brownfield-scan.json');
 	requireCapabilitiesOrExit(scanReport, 'handles patch approve', { featureId: flags.feature, scanReportPath });
 	const provider = selectProviderOrExit(scanReport);
@@ -2800,7 +3070,7 @@ async function cmdHandlesAudit(args) {
 	// live database rather than a static regex proxy.
 	let registryCoverage = null;
 	if (flags['check-registry-coverage']) {
-		const scanReport = loadScanReportOrExit(root, flags.feature);
+		const scanReport = loadHydratedScanReportOrExit(root, flags.feature);
 		const scanReportPath = specPath(root, flags.feature, 'brownfield-scan.json');
 		requireCapabilitiesOrExit(scanReport, 'handles audit --check-registry-coverage', { featureId: flags.feature, scanReportPath });
 		const provider = selectProviderOrExit(scanReport);
@@ -2875,7 +3145,7 @@ function cmdObserveEmit(args) {
 		});
 	}
 
-	const scanReport = loadScanReportOrExit(root, flags.feature);
+	const scanReport = loadHydratedScanReportOrExit(root, flags.feature);
 	const contract = loadContract(root, flags.feature);
 	const dryRun = flags.check || flags.diff;
 
@@ -2993,6 +3263,20 @@ function cmdObserveImport(args) {
 	const flags = parseCommand('observe import', args);
 	if (flags.help) { console.log(renderCommandHelp('observe import')); process.exit(0); }
 	setContext('observe import', flags);
+	if (flags['require-signature'] && !flags.pubkey) {
+		fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', '--require-signature was given but --pubkey was not -- refusing to require a signature this command has no way to check. Pass --pubkey <path>, or drop --require-signature to allow unsigned/unverified receipts (with a warning).');
+	}
+	// Mirrors `cmdAttestVerify`'s own pubkey-read pattern exactly. `null` (not given) means: don't
+	// verify at all -- a signature field, if present on a receipt, is simply ignored, matching
+	// today's behavior byte-for-byte (full backward compatibility with every already-deployed app).
+	let pubkeyPem = null;
+	if (flags.pubkey) {
+		try {
+			pubkeyPem = fs.readFileSync(path.resolve(process.cwd(), flags.pubkey), 'utf8');
+		} catch (err) {
+			fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', `could not read --pubkey "${flags.pubkey}": ${err.message}`);
+		}
+	}
 	const root = requireRepoRoot();
 	requirePreflightPassed(root);
 
@@ -3044,12 +3328,50 @@ function cmdObserveImport(args) {
 	}
 
 	const currentContractHash = sha256File(specPath(root, flags.feature, 'contracts', `${flags.feature}.schema.json`));
+
+	// D-runtime-conformance-receipts (cryptographic receipt attestation): verification always
+	// happens here, in Node, regardless of which language's runtime produced+signed the receipt --
+	// lib/attest.mjs's verifyPayload() is reused completely unmodified (already payload-shape-
+	// agnostic, the same reuse D-ddl-apply's own maybeSignStep() already established for a
+	// different payload shape). `unsigned` is computed regardless of --pubkey (forward visibility);
+	// `signature_invalid` is only ever non-zero when --pubkey was given -- there is no key to judge
+	// a signature against otherwise. Without --pubkey, every receipt is trusted exactly like today
+	// (a signature field, if present, is never even looked at) -- full backward compatibility.
+	let unsignedCount = 0;
+	let signatureInvalidCount = 0;
+	const trustedByIndex = receipts.map((r) => {
+		const hasSignature = Boolean(r.signature);
+		if (!hasSignature) unsignedCount++;
+		if (!pubkeyPem) return true;
+		if (!hasSignature) return false;
+		const { signature, ...unsigned } = r;
+		const valid = verifyPayload(unsigned, signature.value, pubkeyPem);
+		if (!valid) signatureInvalidCount++;
+		return valid;
+	});
+	if (flags['require-signature']) {
+		const badIndex = trustedByIndex.findIndex((trusted) => !trusted);
+		if (badIndex !== -1) {
+			const bad = receipts[badIndex];
+			const reason = bad.signature ? 'its signature does not verify against --pubkey' : 'it has no signature at all';
+			fail(EXIT_CODES.NOT_PASSED, 'INVALID_ARTIFACT', `${flags.receipts}: a receipt for operation "${bad.operation_id}" is untrusted -- ${reason}. Aborting the whole import (--require-signature demands every receipt verify, and a corrupted/untrusted receipts file must not partially land).`);
+		}
+	}
+	if (pubkeyPem && unsignedCount > 0 && !flags.quiet) {
+		console.error(`WARNING: ${unsignedCount} receipt(s) have no signature -- excluded from matched/violation counts now that --pubkey is checking signatures. Pass --require-signature to make this a hard failure instead.`);
+	}
+
+	// Untrusted receipts (unsigned or signature-invalid, only possible when --pubkey was given)
+	// are excluded from EVERY count below -- not "noise" (non-JSON garbage) and not "corruption"
+	// (schema-invalid, aborts the whole import), a genuinely new third tier alongside
+	// stale_contract_ref's own existing "kept on record, excluded from current evidence" precedent.
 	let matched = 0;
 	let staleContractRef = 0;
 	let violationCount = 0;
 	let unsupportedCount = 0;
 	const byOperation = {};
-	for (const r of receipts) {
+	receipts.forEach((r, i) => {
+		if (!trustedByIndex[i]) return;
 		const isMatched = r.contract_ref === currentContractHash;
 		if (isMatched) matched++; else staleContractRef++;
 		const opStats = byOperation[r.operation_id] ?? { matched: 0, stale_contract_ref: 0, violations: 0 };
@@ -3059,7 +3381,7 @@ function cmdObserveImport(args) {
 			if (isMatched) opStats.violations++;
 		}
 		byOperation[r.operation_id] = opStats;
-	}
+	});
 
 	const report = {
 		sbf_conformance_report: '1',
@@ -3073,8 +3395,11 @@ function cmdObserveImport(args) {
 			matched, stale_contract_ref: staleContractRef,
 			violations: violationCount,
 			unsupported: unsupportedCount,
+			unsigned: unsignedCount,
+			signature_invalid: signatureInvalidCount,
 		},
 		by_operation: byOperation,
+		verification: { pubkey_given: Boolean(pubkeyPem), require_signature: Boolean(flags['require-signature']) },
 	};
 	const { ok: reportOk, errors: reportErrors } = validateAgainstSchema('conformance-report.schema.json', report);
 	if (!reportOk) {
@@ -3103,6 +3428,9 @@ function cmdObserveImport(args) {
 		console.log(JSON.stringify({ report, noise_lines: noiseLines, gate: gateState.gates.conformance }, null, 2));
 	} else {
 		console.log(`imported ${receipts.length} receipt(s) (${matched} matched the current contract, ${staleContractRef} stale, ${noiseLines} noise line(s) skipped)`);
+		if (pubkeyPem) {
+			console.log(`signatures: ${unsignedCount} unsigned, ${signatureInvalidCount} invalid (both excluded from the counts above)`);
+		}
 		console.log(`${violationCount} violation(s), ${unsupportedCount} unsupported field(s) across matched receipts`);
 		console.log(`wrote ${path.relative(root, reportPath)}`);
 		console.log(`gate: conformance -> ${gateState.gates.conformance.status}`);
@@ -3485,6 +3813,132 @@ async function resolveNewParams(stack, flags) {
 	};
 }
 
+// D-pattern-accrual: all three pattern commands are repo-independent, like `bskel new` itself --
+// a pattern store is a user-owned CROSS-PROJECT resource, never scoped to the current repo/feature,
+// so none of them call requireRepoRoot(). Read-only; --pattern-database-url-env is required on all
+// three (mirrors O7's `handles audit` -- there is no meaningful "run without a live connection" mode).
+async function cmdPatternList(args) {
+	const flags = parseCommand('pattern list', args);
+	if (flags.help) { console.log(renderCommandHelp('pattern list')); process.exit(0); }
+	setContext('pattern list', flags);
+
+	const connectionString = process.env[flags['pattern-database-url-env']];
+	if (!connectionString) {
+		fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', `--pattern-database-url-env ${flags['pattern-database-url-env']} names an environment variable that isn't set -- export it first (never read from .env directly; see D-db-schema-plane in DECISIONS.md)`);
+	}
+	if (flags.stack && !NEW_STACKS[flags.stack]) {
+		fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', `--stack must be one of: ${Object.keys(NEW_STACKS).join(', ')} (got ${JSON.stringify(flags.stack)})`);
+	}
+
+	let records;
+	try {
+		records = await listPatterns({ connectionString, stack: flags.stack });
+	} catch (err) {
+		if (isMissingPatternTable(err)) {
+			fail(EXIT_CODES.REFRESH_FAILED, 'REFRESH_FAILED', 'sbf_pattern does not exist in this database -- run patterns/schema.sql against it first (bskel never applies it automatically; see D-migration-scope in DECISIONS.md).');
+		}
+		fail(EXIT_CODES.REFRESH_FAILED, 'REFRESH_FAILED', `could not query the pattern store: ${describeConnectionError(err)}`);
+	}
+
+	if (flags.json) {
+		console.log(JSON.stringify({ records }, null, 2));
+	} else {
+		console.log(`pattern store -- ${records.length} record(s)${flags.stack ? ` (stack: ${flags.stack})` : ''}`);
+		for (const r of records) {
+			console.log(`  ${r.pattern_id}  [${r.stack}]  ${r.recorded_at}  ${JSON.stringify(r.params)}`);
+		}
+	}
+	process.exit(0);
+}
+
+async function cmdPatternShow(args) {
+	const flags = parseCommand('pattern show', args);
+	if (flags.help) { console.log(renderCommandHelp('pattern show')); process.exit(0); }
+	setContext('pattern show', flags);
+	const patternId = flags._[0];
+	if (!patternId) {
+		fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', 'usage: bskel pattern show <pattern_id> --pattern-database-url-env <NAME>');
+	}
+	const connectionString = process.env[flags['pattern-database-url-env']];
+	if (!connectionString) {
+		fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', `--pattern-database-url-env ${flags['pattern-database-url-env']} names an environment variable that isn't set -- export it first (never read from .env directly; see D-db-schema-plane in DECISIONS.md)`);
+	}
+
+	let record;
+	try {
+		record = await getPattern({ connectionString, patternId });
+	} catch (err) {
+		if (isMissingPatternTable(err)) {
+			fail(EXIT_CODES.REFRESH_FAILED, 'REFRESH_FAILED', 'sbf_pattern does not exist in this database -- run patterns/schema.sql against it first (bskel never applies it automatically; see D-migration-scope in DECISIONS.md).');
+		}
+		fail(EXIT_CODES.REFRESH_FAILED, 'REFRESH_FAILED', `could not query the pattern store: ${describeConnectionError(err)}`);
+	}
+	if (!record) {
+		fail(EXIT_CODES.NOT_PASSED, 'MISSING_ARTIFACT', `no pattern record with id ${patternId}`);
+	}
+
+	if (flags.json) {
+		console.log(JSON.stringify(record, null, 2));
+	} else {
+		console.log(`pattern ${record.pattern_id}  [${record.stack}]  recorded ${record.recorded_at}`);
+		for (const [k, v] of Object.entries(record.params)) console.log(`  --${k} ${v}`);
+	}
+	process.exit(0);
+}
+
+// D-pattern-accrual: `suggest`'s output is TEXT only -- a per-value frequency breakdown, honest about
+// disagreement, plus one paste-ready command line built from the top-ranked value per param. Never
+// fed into `bskel new` as a default; `bskel new` has no flag that would accept it as one (see
+// D-pattern-accrual's WHY for why this is the one design decision that keeps this feature inside
+// D-greenfield-parameters' safe/unsafe line).
+async function cmdPatternSuggest(args) {
+	const flags = parseCommand('pattern suggest', args);
+	if (flags.help) { console.log(renderCommandHelp('pattern suggest')); process.exit(0); }
+	setContext('pattern suggest', flags);
+
+	const stack = NEW_STACKS[flags.stack];
+	if (!stack) {
+		fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', `--stack must be one of: ${Object.keys(NEW_STACKS).join(', ')} (got ${JSON.stringify(flags.stack)})`);
+	}
+	const connectionString = process.env[flags['pattern-database-url-env']];
+	if (!connectionString) {
+		fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', `--pattern-database-url-env ${flags['pattern-database-url-env']} names an environment variable that isn't set -- export it first (never read from .env directly; see D-db-schema-plane in DECISIONS.md)`);
+	}
+
+	let records;
+	try {
+		records = await listPatterns({ connectionString, stack: flags.stack });
+	} catch (err) {
+		if (isMissingPatternTable(err)) {
+			fail(EXIT_CODES.REFRESH_FAILED, 'REFRESH_FAILED', 'sbf_pattern does not exist in this database -- run patterns/schema.sql against it first (bskel never applies it automatically; see D-migration-scope in DECISIONS.md).');
+		}
+		fail(EXIT_CODES.REFRESH_FAILED, 'REFRESH_FAILED', `could not query the pattern store: ${describeConnectionError(err)}`);
+	}
+
+	const summary = summarizePatternFrequency(records, stack.reusableParams);
+	const suggestedFlags = summary.map(({ param, values }) => `--${param} ${values[0].value}`).join(' ');
+	const suggestedCommand = `bskel new --stack ${stack.id} --slug <name>${suggestedFlags ? ` ${suggestedFlags}` : ''}`;
+
+	if (flags.json) {
+		console.log(JSON.stringify({ stack: stack.id, total_records: records.length, summary, suggested_command: suggestedCommand }, null, 2));
+	} else {
+		console.log(`pattern suggest -- ${records.length} recorded ${stack.id} run(s)`);
+		if (records.length === 0) {
+			console.log('  (no patterns recorded yet for this stack -- nothing to suggest)');
+		} else {
+			for (const { param, values } of summary) {
+				for (const { value, count, total } of values) {
+					console.log(`  --${param} ${value}   (${count}/${total} runs)`);
+				}
+			}
+			console.log('');
+			console.log('suggested command (edit before running -- bskel never applies this automatically):');
+			console.log(`  ${suggestedCommand}`);
+		}
+	}
+	process.exit(0);
+}
+
 async function cmdNew(args) {
 	const flags = parseCommand('new', args);
 	if (flags.help) { console.log(renderCommandHelp('new')); process.exit(0); }
@@ -3496,6 +3950,21 @@ async function cmdNew(args) {
 	}
 	requireValidSlug(flags.slug);
 	requireStackParams(stack, flags);
+	// D-pattern-accrual: checked BEFORE any network call or filesystem write, same ordering
+	// principle P2b's own comment states above -- a usage mistake (flag given without its required
+	// partner, or an env var that was never exported) must never leave a half-scaffolded project
+	// behind. The actual DB write later in this function is a SEPARATE, best-effort concern; this
+	// block only validates that recording, if requested, is even POSSIBLE to attempt.
+	let patternConnectionString = null;
+	if (flags['record-pattern']) {
+		if (!flags['pattern-database-url-env']) {
+			fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', '--record-pattern requires --pattern-database-url-env <NAME>. Nothing was written.');
+		}
+		patternConnectionString = process.env[flags['pattern-database-url-env']];
+		if (!patternConnectionString) {
+			fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', `--pattern-database-url-env ${flags['pattern-database-url-env']} names an environment variable that isn't set -- export it first (never read from .env directly; see D-db-schema-plane in DECISIONS.md). Nothing was written.`);
+		}
+	}
 
 	let stackParams;
 	let warnings;
@@ -3539,6 +4008,27 @@ async function cmdNew(args) {
 	}
 	execFileSync('git', commitArgs, { cwd: dir });
 
+	// D-pattern-accrual: best-effort, deliberately AFTER the project is already scaffolded and
+	// committed -- failing here would be strictly worse than not recording (the project the user
+	// asked for already exists). Only ever a stderr warning, never a fail()/non-zero exit; records
+	// ONLY the flags new/index.mjs's reusableParamsFor(stack) names, and only the ones the user
+	// actually typed (a param the user never passed stays absent from `params`, not defaulted in --
+	// an omission is itself real information for `pattern suggest`, see patterns/store.mjs).
+	if (patternConnectionString) {
+		const patternParams = {};
+		for (const param of reusableParamsFor(stack.id)) {
+			if (flags[param] != null) patternParams[param] = String(flags[param]);
+		}
+		try {
+			await recordPattern({ connectionString: patternConnectionString, stack: stack.id, params: patternParams });
+		} catch (err) {
+			const hint = isMissingPatternTable(err)
+				? 'sbf_pattern does not exist in this database -- run patterns/schema.sql against it first (bskel never applies it automatically; see D-migration-scope).'
+				: describeConnectionError(err);
+			console.error(`warning: --record-pattern could not write to the pattern store: ${hint}`);
+		}
+	}
+
 	const { postScaffoldNotes = [], ...resultRest } = result;
 	if (flags.json) {
 		console.log(JSON.stringify({ stack: flags.stack, dir, ...resultRest, warnings, postScaffoldNotes }, null, 2));
@@ -3625,6 +4115,7 @@ async function dispatchCommand(cmd, rest) {
 		case 'scan': {
 			if (rest[0] === 'disposition') return cmdScanDisposition(rest.slice(1));
 			if (rest[0] === 'explain') return cmdScanExplain(rest.slice(1));
+			if (rest[0] === 'repair') return cmdScanRepair(rest.slice(1));
 			if (rest[0] === 'cross-feature-check') return cmdScanCrossFeatureCheck(rest.slice(1));
 			if (rest[0] === 'cross-feature-waive') return cmdScanCrossFeatureWaive(rest.slice(1));
 			await cmdScan(rest);
@@ -3646,6 +4137,7 @@ async function dispatchCommand(cmd, rest) {
 			const subArgs = rest.slice(1);
 			if (sub === 'emit') return cmdContractEmit(subArgs);
 			if (sub === 'export') return cmdContractExport(subArgs);
+			if (sub === 'export-csv') return cmdContractExportCsv(subArgs);
 			if (sub === 'history') return cmdContractHistory(subArgs);
 			if (sub === 'validate') return cmdContractValidate(subArgs);
 			if (sub === 'tool-schema') return cmdContractToolSchema(subArgs);
@@ -3738,6 +4230,20 @@ async function dispatchCommand(cmd, rest) {
 			return cmdServe(rest);
 		case 'new':
 			return cmdNew(rest);
+		case 'pattern': {
+			if (rest[0] === 'list') return cmdPatternList(rest.slice(1));
+			if (rest[0] === 'show') return cmdPatternShow(rest.slice(1));
+			if (rest[0] === 'suggest') return cmdPatternSuggest(rest.slice(1));
+			usage();
+			process.exit(14);
+			break;
+		}
+		case 'db': {
+			if (rest[0] === 'erd') return await cmdDbErd(rest.slice(1));
+			usage();
+			process.exit(14);
+			break;
+		}
 		default:
 			usage();
 			process.exit(cmd ? 14 : 0);