backend-skeleton 1.2.0 → 1.4.0

package/bin/bskel.mjs

@@ -44,7 +44,15 @@ import {
 	findCollisions, evaluateCrossFeatureFindings, waiverKey,
 	crossFeatureReportPath, loadCrossFeatureReport, loadCrossFeatureResolution, saveCrossFeatureResolution,
 } from '../lib/cross-feature-collisions.mjs';
-import { STACKS as NEW_STACKS, ALL_STACK_PARAMS, stacksAccepting } from '../new/index.mjs';
+import { STACKS as NEW_STACKS, ALL_STACK_PARAMS, stacksAccepting, reusableParamsFor } from '../new/index.mjs';
+import { recordPattern, listPatterns, getPattern, isMissingPatternTable, summarizePatternFrequency } from '../patterns/store.mjs';
+// D-business-rules. rules/compile.mjs is pure (no fs/git/exit); rules/store.mjs owns all disk I/O.
+import { compileRules, summarizeArtifact } from '../rules/compile.mjs';
+import { rulesSourcePath, loadRulesSource, loadRulesArtifact, saveRulesArtifact, starterRulesSource } from '../rules/store.mjs';
+import { PREDICATE_KINDS, explainRule } from '../rules/vocabulary.mjs';
+import { emitRulesJavaSpring } from '../handles/providers/java-spring/rules.mjs';
+import { emitRulesPythonFastApi } from '../handles/providers/python-fastapi/rules.mjs';
+import { emitRulesTypeScriptExpress } from '../handles/providers/typescript-express/rules.mjs';
 import {
 	requireSingleLineText, requireValidJavaPackageName, requireValidArtifactId,
 	requireValidPythonVersion, requireValidLicense, requireValidDatabase, requireSupportedJavaVersion,
@@ -53,6 +61,8 @@ import {
 import { DEFAULT_GROUP_ID, DEFAULT_JAVA_VERSION, resolveSpringDependencies } from '../new/spring.mjs';
 import { buildReconciliation, snapshotFromReconciliation, describeSourceFile } from '../contracts/openapi.mjs';
 import { buildOpenApiDocument, pathPrefixCandidates, unreflectedPathPrefixes, STATUS_CODE_MODES } from '../contracts/export.mjs';
+import { buildContractCsv } from '../contracts/csv.mjs';
+import { buildErdDiagram } from '../scanners/db/erd.mjs';
 import { loadCatalogEntry, listCatalogChoices, planApply, applyPlan } from '../stack/apply.mjs';
 import { PROVIDERS, PROVIDER_LOAD_ERRORS, providerById } from '../handles/registry.mjs';
 import { detectAstHelperAvailable, runAstClassify } from '../handles/providers/java-spring/ast-bridge.mjs';
@@ -65,7 +75,7 @@ import { plan as planTypeScriptExpress } from '../handles/providers/typescript-e
 import { emitObserveTypeScriptExpress } from '../handles/providers/typescript-express/observe.mjs';
 import { collectGateStatuses, runBuildCheck, checkArtifacts, checkResolverConflicts } from '../lib/verify.mjs';
 import { computeWorkflowState } from '../lib/workflow.mjs';
-import { computeDoctorChecks, WORKFLOWS as DOCTOR_WORKFLOWS } from '../lib/doctor.mjs';
+import { computeDoctorChecks, WORKFLOWS as DOCTOR_WORKFLOWS, binaryAvailable } from '../lib/doctor.mjs';
 import { parseCommand, renderCommandHelp, diagnostic } from '../lib/cli.mjs';
 import { EXIT_CODES } from '../lib/exit-codes.mjs';
 import { RESIDUAL_TEMPLATE_VAR_RE } from '../lib/template.mjs';
@@ -76,7 +86,10 @@ const SKILL_ROOT = path.resolve(__dirname, '..');
 function usage() {
 	console.error(`bskel -- backend-skeleton CLI
 
-  bskel new --stack spring|fastapi --slug <name> [--dir <path>] [--offline] [--json] [--name <text>] [--description <text>] [--project-version <v>] [--group-id <pkg>] [--artifact-id <id>] [--package-name <pkg>] [--java-version <n>] [--packaging jar|war] [--dependencies a,b,c] [--add-dependencies a,b,c] [--python-version <spec>] [--port N] [--license <spdx>] [--database postgres|sqlite|none]
+  bskel new --stack spring|fastapi --slug <name> [--dir <path>] [--offline] [--json] [--name <text>] [--description <text>] [--project-version <v>] [--group-id <pkg>] [--artifact-id <id>] [--package-name <pkg>] [--java-version <n>] [--packaging jar|war] [--dependencies a,b,c] [--add-dependencies a,b,c] [--python-version <spec>] [--port N] [--license <spdx>] [--database postgres|sqlite|none] [--record-pattern --pattern-database-url-env <NAME>]
+  bskel pattern list --pattern-database-url-env <NAME> [--stack spring|fastapi] [--json]
+  bskel pattern show <pattern_id> --pattern-database-url-env <NAME> [--json]
+  bskel pattern suggest --stack spring|fastapi --pattern-database-url-env <NAME> [--json]
   bskel preflight [--max-behind N] [--offline|--no-fetch] [--allow-dirty] [--max-age-minutes N] [--fetch-timeout-seconds N] [--json]
   bskel scan [--feature <id>] [--terms a,b,c] [--json] [--accept-low-confidence] [--db [--database-url-env <NAME>] [--schema public]]
   bskel scan disposition --feature <id> --mode reuse|extend|replace|parallel [--module <name>] [--note "..."] [--breaking-approved]
@@ -92,6 +105,8 @@ function usage() {
   bskel feature archive <id> --reason "..." [--json]
   bskel contract emit --feature <id> [--module <name>] [--json] [--openapi-file <path>] [--path-prefix /api/v0] [--descriptions]
   bskel contract export --feature <id> [--out <path>] [--json] [--allow-unprefixed] [--status-codes range|literal]
+  bskel contract export-csv --feature <id> [--out <path>] [--bom] [--json]
+  bskel db erd [--database-url-env <NAME>] [--schema public] [--out <path>] [--json]
   bskel contract history --feature <id> [--json]
   bskel contract validate --feature <id> --file <envelope.json>
   bskel contract tool-schema --feature <id> --operation <operationId>
@@ -99,6 +114,10 @@ function usage() {
   bskel dependency declare --feature <id> --resource <Type> --field <name> --source-feature <id> --source-resource <Type> --source-field <name> --reason "..." [--memo "..."]
   bskel dependency remove --feature <id> --resource <Type> --field <name> --source-feature <id> --source-resource <Type> --source-field <name> --reason "..."
   bskel dependency list --feature <id> [--json]
+  bskel rules check --feature <id> [--init] [--json]
+  bskel rules list --feature <id> [--json]
+  bskel rules explain --feature <id> --rule <id> [--json]
+  bskel rules emit --feature <id> [--module <name>] [--check] [--diff] [--force --reason "..."] [--json]
   bskel stack apply --choice <id> [--apply] [--port N] [--force --reason "..."] [--json]
   bskel catalog lint [<choice>] [--json]
   bskel handles plan --feature <id> [--module <name>] [--resource type1,type2] [--diff] [--ast]
@@ -605,8 +624,16 @@ async function cmdScan(args) {
 	setContext('scan', flags);
 	const root = requireRepoRoot();
 	const terms = deriveTerms(flags);
-	if (terms.length === 0) {
-		fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', 'usage: bskel scan [--feature <id>] --terms a,b,c   (need at least one search term, from --terms or a --feature slug)');
+	// D-zero-config-scan: only refuse when the user EXPLICITLY tried to supply terms (or a
+	// --feature) and it resolved to nothing -- a real usage mistake worth catching (a `--terms ""`/
+	// `--terms ,,` typo, or a --feature slug that pathologically derives zero words), same as
+	// before this item. Neither flag given at all is no longer an error -- it's the new zero-flag
+	// "inventory" mode (every module this adapter finds, unscored -- see scanners/index.mjs's
+	// runScan()), reachable only because the block below still gates it on `!flags.feature` before
+	// any gate/file write happens, exactly like today's ad-hoc mode already does.
+	const termsFlagGiven = args.some((a) => a === '--terms' || a.startsWith('--terms='));
+	if (terms.length === 0 && (termsFlagGiven || flags.feature)) {
+		fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', 'usage: bskel scan [--feature <id>] [--terms a,b,c]   (--terms was given but resolved to no real search term -- pass at least one, e.g. --terms organization, or drop --terms entirely for a full unscored inventory of every module this repo\'s adapter finds)');
 	}
 	if (flags.feature) {
 		requireValidFeatureId(flags.feature);
@@ -614,6 +641,11 @@ async function cmdScan(args) {
 	}
 
 	const dbSchema = await resolveDbSchemaOrExit(root, flags);
+	// D-zero-config-scan: the same CLI-boundary-resolved-input pattern `dbSchema` above already
+	// establishes, applied to a second external dependency -- computed once, used on BOTH the
+	// inventory and the --feature-scoped path (a real Spring repo scanned with --feature+--terms is
+	// exactly as vulnerable to the silent detect()-time degradation as the zero-flag case).
+	const rgAvailable = binaryAvailable('rg');
 
 	// G1: a broken adapter file doesn't stop the adapters that DID load, but every `scan` run
 	// says so loudly (also see `bskel doctor`, which exits 1 while any of these remain).
@@ -622,7 +654,7 @@ async function cmdScan(args) {
 	}
 	let report;
 	try {
-		report = runScan({ repoRoot: root, terms, includeDb: flags.db, dbSchema });
+		report = runScan({ repoRoot: root, terms, includeDb: flags.db, dbSchema, rgAvailable });
 	} catch (err) {
 		// Unreachable with the two shipped adapters (generic-grep's specificity-0 detect() is
 		// unconditional) -- becomes reachable the moment a future adapter's detect() is
@@ -1589,6 +1621,181 @@ function cmdContractExport(args) {
 	process.exitCode = EXIT.PASS;
 }
 
+// D-contract-csv: the soft-refusal counterpart to loadScanReportOrExit() above -- returns null
+// (skip the path-prefix check entirely) on ANY failure (missing file, unparseable JSON, schema
+// violation) instead of exiting. `contract export-csv` treats this check as advisory (see C5 in
+// D-contract-csv, DECISIONS.md): a scan report that can't be read is not itself a reason to block a
+// human-reviewed artifact, unlike `contract export`'s own hard guard for a machine-consumed one.
+function tryLoadScanReport(root, featureId) {
+	const scanReportPath = specPath(root, featureId, 'brownfield-scan.json');
+	if (!fs.existsSync(scanReportPath)) return null;
+	try {
+		const parsed = JSON.parse(fs.readFileSync(scanReportPath, 'utf8'));
+		const { ok } = validateAgainstSchema('scan-report.schema.json', parsed);
+		return ok ? parsed : null;
+	} catch {
+		return null;
+	}
+}
+
+// D-contract-csv: a spreadsheet-shaped projection of a feature contract. Mirrors
+// cmdContractExport's overall shape (loadContract, zero-operation refusal, --out/stdout via
+// writeFileAtomic) but is deliberately UNGATED -- it never calls requireNamedGate('contract', ...)
+// and never hard-refuses on an unreflected path prefix, only warns. See D-contract-csv in
+// DECISIONS.md for the full risk-model argument (a CSV is read by a human deciding whether to
+// waive a partial contract -- gating it would make it useless exactly when it matters).
+function cmdContractExportCsv(args) {
+	const flags = parseCommand('contract export-csv', args);
+	if (flags.help) { console.log(renderCommandHelp('contract export-csv')); process.exit(0); }
+	setContext('contract export-csv', flags);
+	const root = requireRepoRoot();
+	requireValidFeatureId(flags.feature);
+
+	const contract = loadContract(root, flags.feature);
+
+	// Same positive-false-claim refusal `contract export` itself makes (see that function's own
+	// comment) -- a zero-row CSV handed to a stakeholder reads as "this feature has no API".
+	if (Object.keys(contract.operations).length === 0) {
+		fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', `\`${flags.feature}\`'s contract has zero operations (completeness: ${contract.completeness.status}) -- exporting it would produce a table positively claiming this API has no operations. Fix --module/--terms and re-run \`bskel contract emit --feature ${flags.feature}\`.`);
+	}
+
+	// C5 (D-contract-csv): advisory only. If the scan report cannot be read, the check is skipped
+	// silently rather than refusing (contrast cmdContractExport's loadScanReportOrExit(), which hard-exits).
+	let pathPrefixWarning = null;
+	const scanReport = tryLoadScanReport(root, flags.feature);
+	if (scanReport) {
+		const candidates = pathPrefixCandidates(scanReport.path_prefix_signals);
+		const unreflected = unreflectedPathPrefixes(contract, candidates);
+		if (unreflected.length > 0) {
+			pathPrefixWarning = `this repo's scan found a global path-prefix signal (${unreflected.join(', ')}) that ${flags.feature}'s contract paths do not reflect -- the paths in this CSV may be missing it. Re-run \`bskel contract emit --feature ${flags.feature} --openapi-file <real-generated-doc>\` to correct them, or treat this export as informational only.`;
+			console.error(`note: ${pathPrefixWarning}`);
+		}
+	}
+
+	const built = buildContractCsv({ contract });
+	if (!built.ok) {
+		// Unreachable given the zero-operation refusal above already covers this case -- kept as
+		// a real check rather than assuming buildContractCsv()'s precondition forever.
+		fail(EXIT_CODES.NOT_PASSED, 'INVALID_ARTIFACT', `cannot export ${flags.feature}'s contract to CSV: ${built.error}`);
+	}
+
+	// C2 (D-contract-csv): unconditional -- a reader must not have to guess whether a blank column
+	// means "nothing to show" or "the tool is broken".
+	if (built.emptyColumns.length > 0) {
+		console.error(`note: ${built.emptyColumns.length} of ${built.columns.length} columns are empty for every operation (${built.emptyColumns.join(', ')}) -- this contract was emitted without --openapi-file, so no source document ever stated them. Re-run \`bskel contract emit --feature ${flags.feature} --openapi-file <doc>\` to populate them.`);
+	}
+
+	// C4 (D-contract-csv): BOM is opt-in -- Excel-on-Windows mangles non-ASCII without one, but a
+	// BOM breaks naive parsers/`head`/`diff` for everyone else, so neither default is right for everyone.
+	const csvText = flags.bom ? `\uFEFF${built.csv}` : built.csv;
+
+	if (flags.out) {
+		const outPath = path.resolve(process.cwd(), flags.out);
+		writeFileAtomic(outPath, csvText);
+		if (flags.json) {
+			console.log(JSON.stringify({
+				schema: 'sbf.contract-export-csv/1',
+				feature_id: contract.feature_id,
+				out: flags.out,
+				row_count: built.rowCount,
+				columns: built.columns,
+				completeness: contract.completeness.status,
+				path_prefix_warning: pathPrefixWarning,
+			}, null, 2));
+		} else if (!flags.quiet) {
+			console.log(`wrote ${flags.out} -- ${built.rowCount} operation(s), completeness: ${contract.completeness.status}`);
+		}
+	} else {
+		// process.stdout.write, not console.log -- `csvText` already ends in exactly one `\n`
+		// (contracts/csv.mjs's toCsv()), and console.log would append a SECOND one, making stdout
+		// byte-different from the file --out writes. C7 (D-contract-csv): the artifact is the only
+		// thing on stdout here.
+		process.stdout.write(csvText);
+		if (flags.json) {
+			console.error('note: --json has no effect without --out -- stdout is the CSV itself. Pass --out <path> to get both.');
+		}
+	}
+	// D-process-exit-audit: NOT process.exit() -- same reasoning as cmdContractExport's own
+	// trailing comment; a 300-operation CSV can clear the 64KB pipe buffer just as easily.
+	process.exitCode = EXIT.PASS;
+}
+
+// D-db-erd: a Mermaid `erDiagram` of the database plane -- repo-independent like `bskel new`/
+// `bskel pattern *` (no --feature; the database plane is not feature-scoped, see E6 in D-db-erd,
+// DECISIONS.md). Reuses resolveDbSchemaOrExit() unchanged (via a synthetic `db: true`) so
+// --database-url-env's env-var handling and every error string stay byte-identical to `scan --db`.
+async function cmdDbErd(args) {
+	const flags = parseCommand('db erd', args);
+	if (flags.help) { console.log(renderCommandHelp('db erd')); process.exit(0); }
+	setContext('db erd', flags);
+	const root = requireRepoRoot();
+
+	// E1 (D-db-erd)'s own `--db` flag doesn't exist on this command -- the verb `db erd` implies
+	// it, so a synthetic `db: true` is threaded through to the exact same helper `scan --db` uses,
+	// never a second copy of its env-var-unset/connection-failure handling.
+	const { live, migrations } = await resolveDbSchemaOrExit(root, { ...flags, db: true });
+
+	if (!live && (!migrations || migrations.tables.length === 0)) {
+		if (migrations && migrations.tool === 'liquibase') {
+			fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', `no schema to draw: this repo's Liquibase changelogs were detected (${migrations.files.length} file(s)) but none are plain .sql -- XML/YAML changelog parsing is not supported (see D-db-schema-plane in DECISIONS.md). Pass --database-url-env <NAME> for live introspection instead.`);
+		}
+		fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', 'no schema to draw: no Flyway/Liquibase migration files found in this repo, and no --database-url-env was given. Pass --database-url-env <NAME> (an already-exported environment variable; never read from .env directly -- see D-db-schema-plane in DECISIONS.md) for live introspection.');
+	}
+
+	const version = JSON.parse(fs.readFileSync(path.join(SKILL_ROOT, 'package.json'), 'utf8')).version;
+	const invocation = flags['database-url-env']
+		? `bskel db erd --database-url-env ${flags['database-url-env']} --schema ${flags.schema}`
+		: 'bskel db erd';
+	const built = buildErdDiagram({ live, migrations, generatedBy: `bskel ${version} -- \`${invocation}\`` });
+	if (!built.ok) {
+		// Unreachable given the refusal above already covers both reasons buildErdDiagram() can
+		// report -- kept as a real check rather than assuming its precondition forever.
+		fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', `no schema to draw (${built.reason})`);
+	}
+
+	// E2 (D-db-erd): unconditional when degraded -- a reader must see this before the diagram, not
+	// discover it by noticing every type says `unknown`.
+	if (built.degraded) {
+		console.error(`note: this diagram is DEGRADED -- built from migration files, not a live database. Missing: ${built.missing.join(', ')}. Pass --database-url-env <NAME> for a complete diagram.`);
+	}
+	// E6 (D-db-erd): a readability nudge only, never a refusal -- whole-schema is the only mode
+	// this version supports.
+	if (built.entityCount > 40) {
+		console.error(`note: ${built.entityCount} entities -- this diagram may be dense (whole-schema only in this version; see E6 in D-db-erd, DECISIONS.md).`);
+	}
+
+	if (flags.out) {
+		const outPath = path.resolve(process.cwd(), flags.out);
+		writeFileAtomic(outPath, built.mermaid);
+		if (flags.json) {
+			console.log(JSON.stringify({
+				schema: 'sbf.db-erd/1',
+				out: flags.out,
+				plane: built.plane,
+				entity_count: built.entityCount,
+				relationship_count: built.relationshipCount,
+				unresolved_relationships: built.unresolvedRelationships,
+				external_tables: built.externalTables,
+				renames: built.renames,
+				degraded: built.degraded,
+				missing: built.missing,
+			}, null, 2));
+		} else if (!flags.quiet) {
+			console.log(`wrote ${flags.out} -- ${built.entityCount} entity(ies), ${built.relationshipCount} relationship(s), plane: ${built.plane}${built.degraded ? ' (degraded)' : ''}`);
+		}
+	} else {
+		// process.stdout.write, not console.log -- same E10 (D-db-erd) byte-exactness reasoning as
+		// cmdContractExportCsv's own C7 (built.mermaid already ends in exactly one `\n`).
+		process.stdout.write(built.mermaid);
+		if (flags.json) {
+			console.error('note: --json has no effect without --out -- stdout is the diagram itself. Pass --out <path> to get both.');
+		}
+	}
+	// D-process-exit-audit: NOT process.exit() -- a 200-table diagram can clear the 64KB pipe
+	// buffer just as easily as a schema-rich OpenAPI export.
+	process.exitCode = EXIT.PASS;
+}
+
 // A5: the `scan disposition` of contracts -- lets a human explicitly accept a `partial`
 // contract's outstanding warnings so the `contract` gate can pass. Deliberately no wildcard
 // waiver: `--all` expands to the SPECIFIC code+subject pairs present right now, recorded as
@@ -1819,6 +2026,292 @@ function cmdDependencyList(args) {
 	process.exit(0);
 }
 
+// D-business-rules (R6): compiles specs/<id>/rules.yaml (optional) plus the feature's own contract
+// into specs/<id>/rules/<id>.rules.json, and establishes the `rules` gate.
+//
+// Gated on `contract` having PASSED, the same posture `contract export`/`handles emit` take and
+// deliberately not the ungated posture `contract validate` takes: every rule's pointer, scalar
+// type, and enum state is verified against the contract, so compiling against a contract nobody
+// has accepted yet would bake unaccepted facts into an artifact that later drives real codegen.
+//
+// Refuses rather than approximates (R6): an ERROR-severity diagnostic is an authored mistake with
+// a real fix, not a fact to be waived -- see rules/diagnostics.mjs's own header for why this
+// command has no `waive` sibling the way `contract` does.
+function cmdRulesCheck(args) {
+	const flags = parseCommand('rules check', args);
+	if (flags.help) { console.log(renderCommandHelp('rules check')); process.exit(0); }
+	setContext('rules check', flags);
+	const root = requireRepoRoot();
+	requirePreflightPassed(root);
+	const contractResult = requireNamedGate(root, 'contract', flags.feature);
+	if (contractResult.code !== EXIT.PASS) {
+		const hint = contractResult.status === 'awaiting_disposition'
+			? `resolve it first -- \`bskel contract waive --feature ${flags.feature} --code <CODE> (--subject "..."|--all) --reason "..."\`, or \`bskel gate force contract --feature ${flags.feature} --reason "..."\` if intentional.`
+			: `run \`bskel contract emit --feature ${flags.feature}\` first.`;
+		fail(contractResult.code, gateReasonForCode(contractResult.code), `blocked: \`contract\` gate for ${flags.feature} is ${contractResult.status} -- ${hint}`, {
+			next_actions: [{ command: `bskel contract emit --feature ${flags.feature}`, reason: 'the contract gate has not passed yet', mutating: true }],
+		});
+	}
+
+	const contract = loadContract(root, flags.feature);
+	const contractRef = sha256File(specPath(root, flags.feature, 'contracts', `${flags.feature}.schema.json`));
+
+	const sourcePath = rulesSourcePath(root, flags.feature);
+	if (flags.init) {
+		// Never overwrites: a starter file is a convenience for an empty slot, not a reset button.
+		if (fs.existsSync(sourcePath)) {
+			fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', `--init refuses to overwrite an existing ${path.relative(root, sourcePath)} -- edit it directly, or delete it first if you really want a fresh starter.`);
+		}
+		fs.mkdirSync(path.dirname(sourcePath), { recursive: true });
+		writeFileAtomic(sourcePath, starterRulesSource(flags.feature));
+	}
+
+	let source;
+	try {
+		source = loadRulesSource(root, flags.feature);
+	} catch (err) {
+		fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', err.message);
+	}
+
+	const { artifact, diagnostics, blocking } = compileRules({ contract, source, contractRef });
+	const errors = diagnostics.filter((d) => d.severity === 'error');
+	const warnings = diagnostics.filter((d) => d.severity === 'warn');
+
+	if (blocking) {
+		// Nothing is written on refusal -- the same "Nothing was written." posture
+		// explainMissingCapability() uses. A half-compiled artifact would be worse than none.
+		const detail = errors.map((e) => `  ${e.code}${e.subject ? ` (${e.subject})` : ''}: ${e.message}`).join('\n');
+		fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', `blocked: ${errors.length} rule error(s) in ${path.relative(root, sourcePath)} -- nothing was written.\n${detail}`, {
+			next_actions: [{ command: `bskel rules check --feature ${flags.feature}`, reason: 'fix the rule(s) above and re-run', mutating: true }],
+		});
+	}
+
+	saveRulesArtifact(root, flags.feature, artifact);
+	const summary = summarizeArtifact(artifact);
+	const gateState = passNamedGate(root, 'rules', flags.feature, {
+		rule_count: summary.field + summary.cross + summary.transition + summary.derived,
+		from_contract: summary.fromContract,
+		declared: summary.declared,
+		unsupported: summary.unsupported,
+	});
+
+	if (flags.json) {
+		// `gateState.gates.rules`, not the whole state object -- passNamedGate() returns the full
+		// state, and every other command's --json exposes just its own gate record (cmdScan,
+		// cmdScanDisposition, cmdScanCrossFeatureCheck all do exactly this).
+		console.log(JSON.stringify({ feature_id: flags.feature, summary, unsupported: artifact.unsupported, gate: gateState.gates.rules }, null, 2));
+	} else {
+		console.log(`rules -- feature ${flags.feature}`);
+		console.log(`  ${summary.field} field, ${summary.cross} cross-field, ${summary.transition} transition across ${summary.operations} operation(s), ${summary.derived} derived (resource-scoped)`);
+		console.log(`  ${summary.fromContract} projected from the contract's own schema, ${summary.declared} declared in rules.yaml`);
+		if (warnings.length > 0) {
+			// Warnings go to stderr so `--json` stdout stays exactly one JSON document, and so
+			// --quiet never suppresses them -- D-cli-contract's own rule.
+			console.error(`\n${warnings.length} constraint(s) in the contract are NOT enforced by these rules:`);
+			for (const w of warnings) console.error(`  ${w.code}: ${w.message}`);
+		}
+		if (summary.field + summary.cross + summary.transition + summary.derived === 0) {
+			console.log(`  (no rules yet -- run \`bskel rules check --feature ${flags.feature} --init\` for a starter rules.yaml, or point \`bskel contract emit\` at an OpenAPI document to pick up its constraints automatically)`);
+		}
+	}
+	process.exit(0);
+}
+
+function cmdRulesList(args) {
+	const flags = parseCommand('rules list', args);
+	if (flags.help) { console.log(renderCommandHelp('rules list')); process.exit(0); }
+	setContext('rules list', flags);
+	const root = requireRepoRoot();
+	const artifact = loadRulesArtifactOrExit(root, flags.feature);
+
+	if (flags.json) { console.log(JSON.stringify(artifact, null, 2)); process.exit(0); }
+
+	console.log(`rules -- feature ${artifact.feature_id}`);
+	for (const [operationId, kinds] of Object.entries(artifact.operations)) {
+		console.log(`\n  ${operationId}`);
+		for (const r of kinds.field ?? []) console.log(`    [field]      ${r.id}  ${r.pointer} ${r.assert} ${JSON.stringify(r.value)}  (${r.origin})`);
+		for (const r of kinds.cross ?? []) console.log(`    [cross]      ${r.id}  ${r.pointers.join(` ${r.assert} `)}  (${r.origin})`);
+		for (const r of kinds.transition ?? []) console.log(`    [transition] ${r.id}  ${r.pointer}: ${r.from.join('|')} -> ${r.to.join('|')}  (${r.origin})`);
+	}
+	if (Object.keys(artifact.operations).length === 0 && (artifact.derived ?? []).length === 0) console.log('  (none)');
+	if ((artifact.derived ?? []).length > 0) {
+		console.log('\n  derived (resource-scoped, not operation-scoped):');
+		for (const r of artifact.derived) console.log(`    [derived]    ${r.id}  ${r.resource}.${r.field} <- (${r.params.join(', ')})  (${r.origin})`);
+	}
+	if (artifact.unsupported.length > 0) {
+		console.log(`\n  NOT enforced (${artifact.unsupported.length}):`);
+		for (const u of artifact.unsupported) console.log(`    ${u.code}: ${u.reason}`);
+	}
+	process.exit(0);
+}
+
+function cmdRulesExplain(args) {
+	const flags = parseCommand('rules explain', args);
+	if (flags.help) { console.log(renderCommandHelp('rules explain')); process.exit(0); }
+	setContext('rules explain', flags);
+	const root = requireRepoRoot();
+	const artifact = loadRulesArtifactOrExit(root, flags.feature);
+
+	const found = [];
+	for (const [operationId, kinds] of Object.entries(artifact.operations)) {
+		for (const kind of PREDICATE_KINDS) {
+			for (const rule of kinds[kind] ?? []) {
+				if (rule.id === flags.rule) found.push({ operation: operationId, kind, rule });
+			}
+		}
+	}
+	// `derived` rules are resource-scoped, not operation-scoped (R5) -- searched separately, same
+	// reasoning compileRules() gives for compiling them on their own path.
+	for (const rule of artifact.derived ?? []) {
+		if (rule.id === flags.rule) found.push({ operation: null, kind: 'derived', rule });
+	}
+	if (found.length === 0) {
+		const known = [];
+		for (const kinds of Object.values(artifact.operations)) {
+			for (const kind of PREDICATE_KINDS) for (const r of kinds[kind] ?? []) known.push(r.id);
+		}
+		for (const r of artifact.derived ?? []) known.push(r.id);
+		fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', `no rule "${flags.rule}" in feature ${flags.feature} -- known rule ids: ${known.sort().join(', ') || '(none)'}`);
+	}
+	const [{ operation, kind, rule }] = found;
+	const explanation = explainRule({ operation, kind, rule });
+	if (flags.json) console.log(JSON.stringify({ feature_id: artifact.feature_id, operation, kind, rule, explanation }, null, 2));
+	else {
+		console.log(`rule "${rule.id}" -- feature ${artifact.feature_id}`);
+		if (operation) console.log(`  operation: ${operation}`);
+		else console.log(`  resource:  ${rule.resource}.${rule.field}`);
+		console.log(`  kind:      ${kind}`);
+		console.log(`  origin:    ${rule.origin}${rule.origin === 'contract' ? " (projected from this operation's own requestBodySchema -- change the OpenAPI document, not rules.yaml)" : ' (declared in rules.yaml)'}`);
+		console.log(`  means:     ${explanation}`);
+	}
+	process.exit(0);
+}
+
+// D-business-rules (R9): emits the generic rule executor plus the compiled artifact as a classpath
+// resource. Mirrors cmdObserveEmit's own precondition chain and blocked/--check reporting shape --
+// same emitUnits() conflict machinery, same --check/--diff/--force/--reason semantics, and the same
+// explicit adapter dispatch rather than handles/registry.mjs's plan+emit provider mechanism (this
+// command has no `plan` verb either, and operates directly on an already-compiled artifact).
+//
+// Gated on the `rules` gate rather than `contract`: the artifact this emits is what `rules check`
+// produced and schema-validated, so emitting while that gate is stale would ship a runtime resource
+// that no longer matches the rules anyone reviewed.
+function cmdRulesEmit(args) {
+	const flags = parseCommand('rules emit', args);
+	if (flags.help) { console.log(renderCommandHelp('rules emit')); process.exit(0); }
+	setContext('rules emit', flags);
+	const root = requireRepoRoot();
+	requirePreflightPassed(root);
+	if (flags.force && (!flags.reason || !flags.reason.trim())) {
+		fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', 'bskel rules emit --force requires --reason "..." -- every overwrite of diverged generated code must be auditable');
+	}
+
+	const rulesResult = requireNamedGate(root, 'rules', flags.feature);
+	if (rulesResult.code !== EXIT.PASS) {
+		fail(rulesResult.code, gateReasonForCode(rulesResult.code), `blocked: \`rules\` gate for ${flags.feature} is ${rulesResult.status} -- run \`bskel rules check --feature ${flags.feature}\` first.`, {
+			next_actions: [{ command: `bskel rules check --feature ${flags.feature}`, reason: 'the rules gate has not passed yet', mutating: true }],
+		});
+	}
+
+	const scanReport = loadHydratedScanReportOrExit(root, flags.feature);
+	const artifact = loadRulesArtifactOrExit(root, flags.feature);
+	const dryRun = flags.check || flags.diff;
+
+	let result;
+	if (scanReport.adapter === 'java-spring') {
+		let basePackage;
+		try {
+			basePackage = detectBasePackage(root);
+		} catch (err) {
+			fail(EXIT_CODES.NOT_PASSED, 'PLAN_FAILED', err.message);
+		}
+		if (!basePackage) {
+			fail(EXIT_CODES.NOT_PASSED, 'PLAN_FAILED', 'could not detect the base package (no *Application.java found under src/main/java) -- is this a Spring Boot project?');
+		}
+		try {
+			result = emitRulesJavaSpring({ repoRoot: root, featureId: flags.feature, artifact, basePackage, force: flags.force, reason: flags.reason, dryRun, computeDiff: flags.diff });
+		} catch (err) {
+			fail(EXIT_CODES.NOT_PASSED, 'PLAN_FAILED', err.message);
+		}
+	} else if (scanReport.adapter === 'python-fastapi') {
+		// python's own package-root detection needs a module to anchor itself -- same asymmetry
+		// observe emit's own comment already documents for this exact adapter.
+		let fastApiPlan;
+		try {
+			fastApiPlan = planPythonFastApi({ repoRoot: root, scanReport, module: flags.module, resourceFilter: null });
+		} catch (err) {
+			fail(EXIT_CODES.NOT_PASSED, 'PLAN_FAILED', err.message);
+		}
+		try {
+			result = emitRulesPythonFastApi({ repoRoot: root, featureId: flags.feature, artifact, plan: fastApiPlan, force: flags.force, reason: flags.reason, dryRun, computeDiff: flags.diff });
+		} catch (err) {
+			fail(EXIT_CODES.NOT_PASSED, 'PLAN_FAILED', err.message);
+		}
+	} else if (scanReport.adapter === 'typescript-express') {
+		// TS's own project-root detection needs a module to anchor itself too -- same --module
+		// dependency python-fastapi's own rules emit already established.
+		let tsPlan;
+		try {
+			tsPlan = planTypeScriptExpress({ repoRoot: root, scanReport, module: flags.module, resourceFilter: null });
+		} catch (err) {
+			fail(EXIT_CODES.NOT_PASSED, 'PLAN_FAILED', err.message);
+		}
+		try {
+			result = emitRulesTypeScriptExpress({ repoRoot: root, featureId: flags.feature, artifact, plan: tsPlan, force: flags.force, reason: flags.reason, dryRun, computeDiff: flags.diff });
+		} catch (err) {
+			fail(EXIT_CODES.NOT_PASSED, 'PLAN_FAILED', err.message);
+		}
+	} else {
+		fail(EXIT_CODES.MISSING_CAPABILITY, 'MISSING_CAPABILITY', `bskel rules emit does not support the "${scanReport.adapter}" adapter yet (supported: java-spring, python-fastapi, typescript-express).`);
+	}
+
+	const { written, conflicts, orphans, notes, forced, blocked, actions, postEmitNotes = [] } = result;
+	const wouldChange = actions.some((a) => a.action !== 'unchanged' && a.action !== 'adopt-unchanged');
+	const allNotes = [...notes];
+	if (flags.force && forced.length === 0 && conflicts.length === 0) allNotes.push('--force had no effect: 0 conflicts found in this run\'s scope');
+	else if (flags.force && forced.length > 0) allNotes.push(`--force overwrote ${forced.length} diverged file(s): ${forced.join(', ')}`);
+
+	if (blocked) {
+		if (flags.json) {
+			console.log(JSON.stringify({ written, conflicts, orphans, forced, notes: allNotes, actions, blocked: true, check: dryRun }, null, 2));
+		} else {
+			const verb = dryRun ? 'would be blocked' : 'blocked';
+			console.error(`${verb}: ${conflicts.length} generated file(s) diverged from what backend-skeleton last wrote -- ${dryRun ? 'a real run would refuse to overwrite them' : 'refusing to overwrite'} without --force:`);
+			for (const c of conflicts) console.error(`  ${c.path} (${c.kind})\n    ${c.reason}`);
+			if (!dryRun) console.error(`\nre-run with: bskel rules emit --feature ${flags.feature}${flags.module ? ` --module ${flags.module}` : ''} --force --reason "..."`);
+		}
+		process.exit(EXIT_CODES.HANDLES_CONFLICT);
+	}
+
+	if (flags.json) {
+		console.log(JSON.stringify({ written, conflicts, orphans, forced, notes: allNotes, actions, blocked: false, check: dryRun, postEmitNotes }, null, 2));
+	} else if (!flags.quiet) {
+		console.log(`${dryRun ? 'would write' : 'wrote'} ${written.length} file(s):`);
+		for (const w of written) console.log(`  ${w}`);
+		if (allNotes.length > 0) {
+			console.log('\nnotes:');
+			for (const n of allNotes) console.log(`  - ${n}`);
+		}
+		if (dryRun) console.log(`\n${renderFileActions(actions)}`);
+		else for (const n of postEmitNotes) console.log(`\n${n}`);
+	}
+	if (dryRun) process.exit(wouldChange ? EXIT_CODES.CHECK_FAILED : EXIT_CODES.OK);
+	process.exit(0);
+}
+
+function loadRulesArtifactOrExit(root, featureId) {
+	let artifact;
+	try {
+		artifact = loadRulesArtifact(root, featureId);
+	} catch (err) {
+		fail(EXIT_CODES.NOT_PASSED, 'INVALID_ARTIFACT', err.message);
+	}
+	if (!artifact) {
+		fail(EXIT_CODES.NOT_PASSED, 'MISSING_ARTIFACT', `no compiled rules for ${featureId} -- run \`bskel rules check --feature ${featureId}\` first`);
+	}
+	return artifact;
+}
+
 // D-contract-history: a derived VIEW over the contract file's own git history in whatever repo
 // bskel is invoked in -- reads, never writes. Deliberately does NOT try to correlate a commit to
 // a specific `.sbf/<feature>.history.jsonl` gate-pass event: that file is per-machine, gitignored,
@@ -3617,6 +4110,132 @@ async function resolveNewParams(stack, flags) {
 	};
 }
 
+// D-pattern-accrual: all three pattern commands are repo-independent, like `bskel new` itself --
+// a pattern store is a user-owned CROSS-PROJECT resource, never scoped to the current repo/feature,
+// so none of them call requireRepoRoot(). Read-only; --pattern-database-url-env is required on all
+// three (mirrors O7's `handles audit` -- there is no meaningful "run without a live connection" mode).
+async function cmdPatternList(args) {
+	const flags = parseCommand('pattern list', args);
+	if (flags.help) { console.log(renderCommandHelp('pattern list')); process.exit(0); }
+	setContext('pattern list', flags);
+
+	const connectionString = process.env[flags['pattern-database-url-env']];
+	if (!connectionString) {
+		fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', `--pattern-database-url-env ${flags['pattern-database-url-env']} names an environment variable that isn't set -- export it first (never read from .env directly; see D-db-schema-plane in DECISIONS.md)`);
+	}
+	if (flags.stack && !NEW_STACKS[flags.stack]) {
+		fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', `--stack must be one of: ${Object.keys(NEW_STACKS).join(', ')} (got ${JSON.stringify(flags.stack)})`);
+	}
+
+	let records;
+	try {
+		records = await listPatterns({ connectionString, stack: flags.stack });
+	} catch (err) {
+		if (isMissingPatternTable(err)) {
+			fail(EXIT_CODES.REFRESH_FAILED, 'REFRESH_FAILED', 'sbf_pattern does not exist in this database -- run patterns/schema.sql against it first (bskel never applies it automatically; see D-migration-scope in DECISIONS.md).');
+		}
+		fail(EXIT_CODES.REFRESH_FAILED, 'REFRESH_FAILED', `could not query the pattern store: ${describeConnectionError(err)}`);
+	}
+
+	if (flags.json) {
+		console.log(JSON.stringify({ records }, null, 2));
+	} else {
+		console.log(`pattern store -- ${records.length} record(s)${flags.stack ? ` (stack: ${flags.stack})` : ''}`);
+		for (const r of records) {
+			console.log(`  ${r.pattern_id}  [${r.stack}]  ${r.recorded_at}  ${JSON.stringify(r.params)}`);
+		}
+	}
+	process.exit(0);
+}
+
+async function cmdPatternShow(args) {
+	const flags = parseCommand('pattern show', args);
+	if (flags.help) { console.log(renderCommandHelp('pattern show')); process.exit(0); }
+	setContext('pattern show', flags);
+	const patternId = flags._[0];
+	if (!patternId) {
+		fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', 'usage: bskel pattern show <pattern_id> --pattern-database-url-env <NAME>');
+	}
+	const connectionString = process.env[flags['pattern-database-url-env']];
+	if (!connectionString) {
+		fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', `--pattern-database-url-env ${flags['pattern-database-url-env']} names an environment variable that isn't set -- export it first (never read from .env directly; see D-db-schema-plane in DECISIONS.md)`);
+	}
+
+	let record;
+	try {
+		record = await getPattern({ connectionString, patternId });
+	} catch (err) {
+		if (isMissingPatternTable(err)) {
+			fail(EXIT_CODES.REFRESH_FAILED, 'REFRESH_FAILED', 'sbf_pattern does not exist in this database -- run patterns/schema.sql against it first (bskel never applies it automatically; see D-migration-scope in DECISIONS.md).');
+		}
+		fail(EXIT_CODES.REFRESH_FAILED, 'REFRESH_FAILED', `could not query the pattern store: ${describeConnectionError(err)}`);
+	}
+	if (!record) {
+		fail(EXIT_CODES.NOT_PASSED, 'MISSING_ARTIFACT', `no pattern record with id ${patternId}`);
+	}
+
+	if (flags.json) {
+		console.log(JSON.stringify(record, null, 2));
+	} else {
+		console.log(`pattern ${record.pattern_id}  [${record.stack}]  recorded ${record.recorded_at}`);
+		for (const [k, v] of Object.entries(record.params)) console.log(`  --${k} ${v}`);
+	}
+	process.exit(0);
+}
+
+// D-pattern-accrual: `suggest`'s output is TEXT only -- a per-value frequency breakdown, honest about
+// disagreement, plus one paste-ready command line built from the top-ranked value per param. Never
+// fed into `bskel new` as a default; `bskel new` has no flag that would accept it as one (see
+// D-pattern-accrual's WHY for why this is the one design decision that keeps this feature inside
+// D-greenfield-parameters' safe/unsafe line).
+async function cmdPatternSuggest(args) {
+	const flags = parseCommand('pattern suggest', args);
+	if (flags.help) { console.log(renderCommandHelp('pattern suggest')); process.exit(0); }
+	setContext('pattern suggest', flags);
+
+	const stack = NEW_STACKS[flags.stack];
+	if (!stack) {
+		fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', `--stack must be one of: ${Object.keys(NEW_STACKS).join(', ')} (got ${JSON.stringify(flags.stack)})`);
+	}
+	const connectionString = process.env[flags['pattern-database-url-env']];
+	if (!connectionString) {
+		fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', `--pattern-database-url-env ${flags['pattern-database-url-env']} names an environment variable that isn't set -- export it first (never read from .env directly; see D-db-schema-plane in DECISIONS.md)`);
+	}
+
+	let records;
+	try {
+		records = await listPatterns({ connectionString, stack: flags.stack });
+	} catch (err) {
+		if (isMissingPatternTable(err)) {
+			fail(EXIT_CODES.REFRESH_FAILED, 'REFRESH_FAILED', 'sbf_pattern does not exist in this database -- run patterns/schema.sql against it first (bskel never applies it automatically; see D-migration-scope in DECISIONS.md).');
+		}
+		fail(EXIT_CODES.REFRESH_FAILED, 'REFRESH_FAILED', `could not query the pattern store: ${describeConnectionError(err)}`);
+	}
+
+	const summary = summarizePatternFrequency(records, stack.reusableParams);
+	const suggestedFlags = summary.map(({ param, values }) => `--${param} ${values[0].value}`).join(' ');
+	const suggestedCommand = `bskel new --stack ${stack.id} --slug <name>${suggestedFlags ? ` ${suggestedFlags}` : ''}`;
+
+	if (flags.json) {
+		console.log(JSON.stringify({ stack: stack.id, total_records: records.length, summary, suggested_command: suggestedCommand }, null, 2));
+	} else {
+		console.log(`pattern suggest -- ${records.length} recorded ${stack.id} run(s)`);
+		if (records.length === 0) {
+			console.log('  (no patterns recorded yet for this stack -- nothing to suggest)');
+		} else {
+			for (const { param, values } of summary) {
+				for (const { value, count, total } of values) {
+					console.log(`  --${param} ${value}   (${count}/${total} runs)`);
+				}
+			}
+			console.log('');
+			console.log('suggested command (edit before running -- bskel never applies this automatically):');
+			console.log(`  ${suggestedCommand}`);
+		}
+	}
+	process.exit(0);
+}
+
 async function cmdNew(args) {
 	const flags = parseCommand('new', args);
 	if (flags.help) { console.log(renderCommandHelp('new')); process.exit(0); }
@@ -3628,6 +4247,21 @@ async function cmdNew(args) {
 	}
 	requireValidSlug(flags.slug);
 	requireStackParams(stack, flags);
+	// D-pattern-accrual: checked BEFORE any network call or filesystem write, same ordering
+	// principle P2b's own comment states above -- a usage mistake (flag given without its required
+	// partner, or an env var that was never exported) must never leave a half-scaffolded project
+	// behind. The actual DB write later in this function is a SEPARATE, best-effort concern; this
+	// block only validates that recording, if requested, is even POSSIBLE to attempt.
+	let patternConnectionString = null;
+	if (flags['record-pattern']) {
+		if (!flags['pattern-database-url-env']) {
+			fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', '--record-pattern requires --pattern-database-url-env <NAME>. Nothing was written.');
+		}
+		patternConnectionString = process.env[flags['pattern-database-url-env']];
+		if (!patternConnectionString) {
+			fail(EXIT_CODES.BAD_ARGS, 'BAD_ARGS', `--pattern-database-url-env ${flags['pattern-database-url-env']} names an environment variable that isn't set -- export it first (never read from .env directly; see D-db-schema-plane in DECISIONS.md). Nothing was written.`);
+		}
+	}
 
 	let stackParams;
 	let warnings;
@@ -3671,6 +4305,27 @@ async function cmdNew(args) {
 	}
 	execFileSync('git', commitArgs, { cwd: dir });
 
+	// D-pattern-accrual: best-effort, deliberately AFTER the project is already scaffolded and
+	// committed -- failing here would be strictly worse than not recording (the project the user
+	// asked for already exists). Only ever a stderr warning, never a fail()/non-zero exit; records
+	// ONLY the flags new/index.mjs's reusableParamsFor(stack) names, and only the ones the user
+	// actually typed (a param the user never passed stays absent from `params`, not defaulted in --
+	// an omission is itself real information for `pattern suggest`, see patterns/store.mjs).
+	if (patternConnectionString) {
+		const patternParams = {};
+		for (const param of reusableParamsFor(stack.id)) {
+			if (flags[param] != null) patternParams[param] = String(flags[param]);
+		}
+		try {
+			await recordPattern({ connectionString: patternConnectionString, stack: stack.id, params: patternParams });
+		} catch (err) {
+			const hint = isMissingPatternTable(err)
+				? 'sbf_pattern does not exist in this database -- run patterns/schema.sql against it first (bskel never applies it automatically; see D-migration-scope).'
+				: describeConnectionError(err);
+			console.error(`warning: --record-pattern could not write to the pattern store: ${hint}`);
+		}
+	}
+
 	const { postScaffoldNotes = [], ...resultRest } = result;
 	if (flags.json) {
 		console.log(JSON.stringify({ stack: flags.stack, dir, ...resultRest, warnings, postScaffoldNotes }, null, 2));
@@ -3779,6 +4434,7 @@ async function dispatchCommand(cmd, rest) {
 			const subArgs = rest.slice(1);
 			if (sub === 'emit') return cmdContractEmit(subArgs);
 			if (sub === 'export') return cmdContractExport(subArgs);
+			if (sub === 'export-csv') return cmdContractExportCsv(subArgs);
 			if (sub === 'history') return cmdContractHistory(subArgs);
 			if (sub === 'validate') return cmdContractValidate(subArgs);
 			if (sub === 'tool-schema') return cmdContractToolSchema(subArgs);
@@ -3797,6 +4453,17 @@ async function dispatchCommand(cmd, rest) {
 			process.exit(14);
 			break;
 		}
+		case 'rules': {
+			const sub = rest[0];
+			const subArgs = rest.slice(1);
+			if (sub === 'check') return cmdRulesCheck(subArgs);
+			if (sub === 'list') return cmdRulesList(subArgs);
+			if (sub === 'explain') return cmdRulesExplain(subArgs);
+			if (sub === 'emit') return cmdRulesEmit(subArgs);
+			usage();
+			process.exit(14);
+			break;
+		}
 		case 'stack': {
 			if (rest[0] === 'apply') return cmdStackApply(rest.slice(1));
 			usage();
@@ -3871,6 +4538,20 @@ async function dispatchCommand(cmd, rest) {
 			return cmdServe(rest);
 		case 'new':
 			return cmdNew(rest);
+		case 'pattern': {
+			if (rest[0] === 'list') return cmdPatternList(rest.slice(1));
+			if (rest[0] === 'show') return cmdPatternShow(rest.slice(1));
+			if (rest[0] === 'suggest') return cmdPatternSuggest(rest.slice(1));
+			usage();
+			process.exit(14);
+			break;
+		}
+		case 'db': {
+			if (rest[0] === 'erd') return await cmdDbErd(rest.slice(1));
+			usage();
+			process.exit(14);
+			break;
+		}
 		default:
 			usage();
 			process.exit(cmd ? 14 : 0);