bonescript-compiler 0.4.0 → 0.5.0

package/src/emit_full.ts

@@ -23,7 +23,7 @@ import {
   emitFailureRules,
   emitMigrationDiff,
 } from "./emit_maintenance";
-import { emitFlowRuntime } from "./emit_extras";
+import { emitFlowRuntime, emitChannelFilters } from "./emit_extras";
 import { emitAlgorithmsFile, collectUsedAlgorithms } from "./emit_composition";
 import { emitExtensionPointStub } from "./extension_manager";
 import * as AST from "./ast";
@@ -39,6 +39,22 @@ function toSnakeCase(s: string): string {
   return s.replace(/([a-z])([A-Z])/g, "$1_$2").toLowerCase();
 }
 
+/** Resolve the auth method for the system from the resolution map or module configs. */
+function resolveSystemAuthMethod(system: IR.IRSystem): "jwt" | "oauth2" | "apikey" {
+  const direct = system.resolution["implied.auth_method"] || system.resolution["system.auth_method"];
+  if (direct === "oauth2" || direct === "apikey" || direct === "jwt") return direct as "jwt" | "oauth2" | "apikey";
+  for (const [key, val] of Object.entries(system.resolution)) {
+    if (key.endsWith(".auth_method") && (val === "oauth2" || val === "apikey" || val === "jwt")) {
+      return val as "jwt" | "oauth2" | "apikey";
+    }
+  }
+  for (const mod of system.modules) {
+    const m = mod.config["auth_method"] as string | undefined;
+    if (m === "oauth2" || m === "apikey" || m === "jwt") return m;
+  }
+  return "jwt";
+}
+
 export class FullEmitter {
   private schemaEmitter = new Emitter();
 
@@ -56,6 +72,33 @@ export class FullEmitter {
     files.push({ path: "src/events.ts", content: emitDurableEventBus(system), language: "typescript", source_module: "infra" });
     // Outbox SQL schema
     files.push({ path: "migrations/event_outbox.sql", content: emitOutboxSchema(), language: "sql", source_module: "infra" });
+
+    // API key table migration (only when auth_method = apikey)
+    const authMethod = resolveSystemAuthMethod(system);
+    if (authMethod === "apikey") {
+      files.push({
+        path: "migrations/api_keys.sql",
+        content: [
+          "-- Generated by BoneScript compiler. DO NOT EDIT.",
+          "-- API key table for apikey auth strategy.",
+          "",
+          "CREATE TABLE IF NOT EXISTS api_keys (",
+          "  id         UUID PRIMARY KEY DEFAULT gen_random_uuid(),",
+          "  actor_id   UUID NOT NULL,",
+          "  key_hash   VARCHAR(64) NOT NULL UNIQUE,",
+          "  key_prefix VARCHAR(16) NOT NULL,",
+          "  name       VARCHAR(255) NOT NULL DEFAULT 'default',",
+          "  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),",
+          "  expires_at TIMESTAMPTZ NOT NULL,",
+          "  revoked    BOOLEAN NOT NULL DEFAULT false",
+          ");",
+          "CREATE INDEX IF NOT EXISTS idx_api_keys_actor ON api_keys (actor_id);",
+          "CREATE INDEX IF NOT EXISTS idx_api_keys_hash  ON api_keys (key_hash);",
+        ].join("\n"),
+        language: "sql",
+        source_module: "infra",
+      });
+    }
     // Typed event publisher functions (one per declared event)
     if (system.events.length > 0) {
       files.push({ path: "src/publishers.ts", content: emitTypedEventPublishers(system), language: "typescript", source_module: "infra" });
@@ -111,17 +154,24 @@ export class FullEmitter {
         "",
       ];
       for (const ep of system.extension_points) {
-        const params = ep.params.map((p: { name: string; type: string }) => `${p.name}: ${p.type}`).join(", ");
-        const returnType = ep.returns || "void";
-        extLines.push(`/**`);
-        extLines.push(` * Extension point: ${ep.name}`);
-        extLines.push(` * ${ep.stable ? "STABLE: implementation required." : "Optional."}`);
-        extLines.push(` */`);
-        extLines.push(`export function ${ep.name}(${params}): ${returnType} {`);
-        extLines.push(`  // <bonescript:ext:${ep.name}:begin>`);
-        extLines.push(`  throw new Error("Not implemented: ${ep.name}");`);
-        extLines.push(`  // <bonescript:ext:${ep.name}:end>`);
-        extLines.push(`}`);
+        // Use the shared emitExtensionPointStub so the format is consistent
+        // with what extension_manager.ts expects when merging on recompile.
+        const stub = emitExtensionPointStub({
+          kind: "ExtensionPointDecl",
+          loc: { line: 0, column: 0, offset: 0 },
+          name: ep.name,
+          params: ep.params.map(p => ({
+            kind: "Param" as const,
+            loc: { line: 0, column: 0, offset: 0 },
+            name: p.name,
+            type: { kind: "PrimitiveType" as const, loc: { line: 0, column: 0, offset: 0 }, name: p.type },
+          })),
+          returns: ep.returns
+            ? { kind: "PrimitiveType" as const, loc: { line: 0, column: 0, offset: 0 }, name: ep.returns }
+            : null,
+          stable: ep.stable,
+        });
+        extLines.push(stub);
         extLines.push("");
       }
       files.push({
@@ -144,6 +194,79 @@ export class FullEmitter {
       }
     }
 
+    // 3a. Derived field helpers (one file per entity that has derived fields)
+    for (const mod of system.modules) {
+      for (const model of mod.models) {
+        const derivedFields = model.fields.filter(f =>
+          f.default_value && f.default_value.startsWith("GENERATED ALWAYS AS")
+        );
+        if (derivedFields.length === 0) continue;
+        const lines: string[] = [
+          `// Generated by BoneScript compiler. DO NOT EDIT.`,
+          `// Derived field helpers for ${model.name}.`,
+          `// These mirror the GENERATED ALWAYS AS columns in the SQL migration.`,
+          `// Use them when you need the computed value in application code before a DB round-trip.`,
+          ``,
+          `export type ${model.name}Derived = {`,
+        ];
+        for (const f of derivedFields) {
+          lines.push(`  ${f.name}: unknown;`);
+        }
+        lines.push(`};`);
+        lines.push(``);
+        lines.push(`export const ${model.name.toUpperCase()}_DERIVED_FIELDS = [${derivedFields.map(f => `"${f.name}"`).join(", ")}] as const;`);
+        lines.push(``);
+        lines.push(`/** Returns true if the field name is a derived (computed) field on ${model.name}. */`);
+        lines.push(`export function is${model.name}DerivedField(field: string): boolean {`);
+        lines.push(`  return (${model.name.toUpperCase()}_DERIVED_FIELDS as readonly string[]).includes(field);`);
+        lines.push(`}`);
+        files.push({
+          path: `src/derived/${toSnakeCase(model.name)}.ts`,
+          content: lines.join("\n"),
+          language: "typescript",
+          source_module: mod.id,
+        });
+      }
+    }
+
+    // 3b. Channel filter predicates (only if any channel has a filter expression)
+    const realtimeMods = system.modules.filter(m => m.kind === "realtime_service" && m.config["filter"]);
+    if (realtimeMods.length > 0) {
+      const filterLines: string[] = [
+        `// Generated by BoneScript compiler. DO NOT EDIT.`,
+        `// Channel filter predicates — applied before delivering messages to participants.`,
+        ``,
+        `export const CHANNEL_FILTERS: Record<string, (event: any, participant: any) => boolean> = {`,
+      ];
+      for (const mod of realtimeMods) {
+        const filterExpr = String(mod.config["filter"] || "true");
+        // Translate bone field refs to JS: event.field and participant.field pass through,
+        // bare identifiers are assumed to be event properties.
+        const jsFilter = filterExpr
+          .replace(/\band\b/g, "&&")
+          .replace(/\bor\b/g, "||")
+          .replace(/\bnot\b/g, "!")
+          .replace(/\b==\b/g, "===")
+          .replace(/\b!=\b/g, "!==")
+          .replace(/\bcontains\b/g, "?.includes");
+        filterLines.push(`  "${mod.name}": (event, participant) => {`);
+        filterLines.push(`    try { return Boolean(${jsFilter}); } catch { return true; }`);
+        filterLines.push(`  },`);
+      }
+      filterLines.push(`};`);
+      filterLines.push(``);
+      filterLines.push(`export function shouldDeliver(channel: string, event: any, participant: any): boolean {`);
+      filterLines.push(`  const filter = CHANNEL_FILTERS[channel];`);
+      filterLines.push(`  return filter ? filter(event, participant) : true;`);
+      filterLines.push(`}`);
+      files.push({
+        path: "src/channel_filters.ts",
+        content: filterLines.join("\n"),
+        language: "typescript",
+        source_module: "infra",
+      });
+    }
+
     // 4. Source: route files (CRUD + capabilities)
     for (const mod of system.modules) {
       if (mod.kind === "api_service" && mod.models.length > 0) {
@@ -186,6 +309,7 @@ export class FullEmitter {
     }
 
     // 6. SQL migrations — run schema emitter ONCE, then match by model name
+    // Includes both api_service entities AND data_store schemas.
     const schemas: string[] = [];
     const allSchemaFiles = this.schemaEmitter.emit(system);
     for (const mod of system.modules) {

package/src/emit_index.ts

@@ -1,161 +1,210 @@
-/**
- * BoneScript Server Entry Point Emitter
- * Generates src/index.ts — the Express server with all middleware and routes wired.
- */
-
-import * as IR from "./ir";
-import { toSnakeCase, toCamelCase } from "./emit_router";
-
-export function emitIndex(system: IR.IRSystem): string {
-  const apiModules = system.modules.filter(m => m.kind === "api_service");
-  const hasWebSocket = system.modules.some(m => m.kind === "realtime_service");
-  const hasBatch = system.modules.some(m =>
-    m.interfaces.some(i => i.methods.some(mth => mth.sync === "batch"))
-  );
-  const lines: string[] = [];
-
-  lines.push(`// Generated by BoneScript compiler. DO NOT EDIT.`);
-  lines.push(`// System: ${system.name}`);
-  lines.push(`require("dotenv").config();`);
-  lines.push(`import express from "express";`);
-  lines.push(`import { createServer } from "http";`);
-  lines.push(`import cors from "cors";`);
-  lines.push(`import helmet from "helmet";`);
-  lines.push(`import rateLimit from "express-rate-limit";`);
-  lines.push(`import { authMiddleware } from "./auth";`);
-  lines.push(`import { healthRouter } from "./health";`);
-  lines.push(`import { logger } from "./logger";`);
-  lines.push(`import { eventBus } from "./events";`);
-  lines.push(`import { pool } from "./db";`);
-  if (hasBatch)     lines.push(`import { startBatchWorker } from "./batch";`);
-  if (hasWebSocket) lines.push(`import { setupWebSocketServer } from "./websocket";`);
-  lines.push(``);
-
-  for (const mod of apiModules) {
-    const model = mod.models[0];
-    if (!model) continue;
-    const routerName = toCamelCase(toSnakeCase(model.name) + "s") + "Router";
-    lines.push(`import { ${routerName} } from "./routes/${toSnakeCase(model.name)}";`);
-  }
-
-  lines.push(``);
-  lines.push(`const app = express();`);
-  lines.push(`const httpServer = createServer(app);`);
-  lines.push(`const PORT = parseInt(process.env.PORT || "3000");`);
-  lines.push(``);
-
-  // Middleware
-  lines.push(`// Middleware`);
-  lines.push(`app.use(helmet());`);
-  lines.push(`// CORS: restrict to ALLOWED_ORIGINS env var (comma-separated). Defaults to same-origin only.`);
-  lines.push(`const __allowedOrigins = (process.env.ALLOWED_ORIGINS || "").split(",").map(s => s.trim()).filter(Boolean);`);
-  lines.push(`app.use(cors({`);
-  lines.push(`  origin: __allowedOrigins.length > 0`);
-  lines.push(`    ? (origin, cb) => { if (!origin || __allowedOrigins.includes(origin)) cb(null, true); else cb(new Error("Not allowed by CORS")); }`);
-  lines.push(`    : false,`);
-  lines.push(`  credentials: true,`);
-  lines.push(`}));`);
-  lines.push(`app.use(express.json({ limit: "1mb" }));`);
-  lines.push(`app.use(express.urlencoded({ extended: false, limit: "1mb" }));`);
-  lines.push(`app.use(authMiddleware);`);
-  lines.push(``);
-
-  // Rate limiting
-  const gw = system.modules.find(m => m.kind === "gateway");
-  const rateVal = gw?.config["rate_limit"] || 300;
-  lines.push(`// Global rate limit (default ${rateVal} req/min, override with RATE_LIMIT_MAX env var)`);
-  lines.push(`const __globalRateLimit = rateLimit({`);
-  lines.push(`  windowMs: parseInt(process.env.RATE_LIMIT_WINDOW_MS || "60000"),`);
-  lines.push(`  max: parseInt(process.env.RATE_LIMIT_MAX || "${rateVal}"),`);
-  lines.push(`  standardHeaders: true,`);
-  lines.push(`  legacyHeaders: false,`);
-  lines.push(`  message: { error: { code: "RATE_LIMITED", message: "Too many requests, please slow down." } },`);
-  lines.push(`});`);
-  lines.push(`app.use(__globalRateLimit);`);
-  lines.push(``);
-  lines.push(`// Strict rate limit on auth endpoints (20 req/min per IP)`);
-  lines.push(`const __authRateLimit = rateLimit({`);
-  lines.push(`  windowMs: 60000,`);
-  lines.push(`  max: parseInt(process.env.AUTH_RATE_LIMIT_MAX || "20"),`);
-  lines.push(`  standardHeaders: true,`);
-  lines.push(`  legacyHeaders: false,`);
-  lines.push(`  message: { error: { code: "RATE_LIMITED", message: "Too many auth attempts." } },`);
-  lines.push(`});`);
-  lines.push(``);
-
-  // Request timeout
-  lines.push(`// Request timeout (default 30s, override per-route)`);
-  lines.push(`app.use((req: any, res: any, next: any) => {`);
-  lines.push(`  const timeout = parseInt(process.env.REQUEST_TIMEOUT_MS || "30000");`);
-  lines.push(`  const timer = setTimeout(() => {`);
-  lines.push(`    if (!res.headersSent) {`);
-  lines.push(`      res.status(503).json({ error: { code: "REQUEST_TIMEOUT", message: "Request timed out" } });`);
-  lines.push(`    }`);
-  lines.push(`  }, timeout);`);
-  lines.push(`  res.on("finish", () => clearTimeout(timer));`);
-  lines.push(`  next();`);
-  lines.push(`});`);
-  lines.push(``);
-
-  // Routes
-  lines.push(`// Health & metrics`);
-  lines.push(`app.use("/health", healthRouter);`);
-  lines.push(``);
-  lines.push(`// Routes`);
-  for (const mod of apiModules) {
-    const model = mod.models[0];
-    if (!model) continue;
-    const routerName = toCamelCase(toSnakeCase(model.name) + "s") + "Router";
-    const routePath = `/${toSnakeCase(model.name)}s`;
-    lines.push(`app.use("${routePath}", ${routerName});`);
-    lines.push(`app.use("${routePath}/login", __authRateLimit);`);
-    lines.push(`app.use("${routePath}/register", __authRateLimit);`);
-  }
-  lines.push(``);
-
-  if (hasWebSocket) {
-    lines.push(`// WebSocket`);
-    lines.push(`setupWebSocketServer(httpServer);`);
-    lines.push(``);
-  }
-
-  // Startup
-  lines.push(`// Start`);
-  lines.push(`httpServer.listen(PORT, () => {`);
-  lines.push(`  logger.info("server_started", { event: "startup", metadata: { port: PORT } });`);
-  lines.push(`  eventBus.startWorker(parseInt(process.env.EVENT_WORKER_INTERVAL_MS || "1000"));`);
-  if (hasBatch) lines.push(`  startBatchWorker();`);
-  lines.push(`  console.log(\`[${system.name}] Running on port \${PORT}\`);`);
-  lines.push(`  console.log(\`  HTTP routes:\`);`);
-  for (const mod of apiModules) {
-    const model = mod.models[0];
-    if (!model) continue;
-    lines.push(`  console.log(\`    /${toSnakeCase(model.name)}s\`);`);
-  }
-  if (hasWebSocket) lines.push(`  console.log(\`  WebSocket: /ws?channel=<name>&token=<jwt>\`);`);
-  lines.push(`  console.log(\`  Health: /health/live, /health/ready, /health/metrics\`);`);
-  lines.push(`});`);
-  lines.push(``);
-
-  // Graceful shutdown
-  lines.push(`// Graceful shutdown`);
-  lines.push(`const shutdown = async (signal: string) => {`);
-  lines.push(`  logger.info("server_stopping", { event: "shutdown", metadata: { signal } });`);
-  lines.push(`  httpServer.close(async () => {`);
-  lines.push(`    try {`);
-  lines.push(`      await pool.end();`);
-  lines.push(`      logger.info("server_stopped", { event: "shutdown", status: "success" });`);
-  lines.push(`    } catch (e: any) {`);
-  lines.push(`      logger.error("shutdown_error", { event: "shutdown", metadata: { error: e.message } });`);
-  lines.push(`    }`);
-  lines.push(`    process.exit(0);`);
-  lines.push(`  });`);
-  lines.push(`  setTimeout(() => { logger.error("shutdown_timeout", { event: "shutdown" }); process.exit(1); }, 10000);`);
-  lines.push(`};`);
-  lines.push(`process.on("SIGTERM", () => shutdown("SIGTERM"));`);
-  lines.push(`process.on("SIGINT",  () => shutdown("SIGINT"));`);
-  lines.push(``);
-  lines.push(`export { app, httpServer };`);
-
-  return lines.join("\n");
-}
+/**
+ * BoneScript Server Entry Point Emitter
+ * Generates src/index.ts — the Express server with all middleware and routes wired.
+ */
+
+import * as IR from "./ir";
+import { toSnakeCase, toCamelCase } from "./emit_router";
+
+export function emitIndex(system: IR.IRSystem): string {
+  const apiModules = system.modules.filter(m => m.kind === "api_service");
+  const hasWebSocket = system.modules.some(m => m.kind === "realtime_service");
+  const hasBatch = system.modules.some(m =>
+    m.interfaces.some(i => i.methods.some(mth => mth.sync === "batch"))
+  );
+
+  // Collect policy settings from the gateway config (populated by lowering from PolicyDecl)
+  const gw = system.modules.find(m => m.kind === "gateway");
+  const encryptionMode = (gw?.config["encryption"] as string | undefined) || "none";
+  const enforceHttps = encryptionMode === "in_transit" || encryptionMode === "both";
+
+  const lines: string[] = [];
+
+  lines.push(`// Generated by BoneScript compiler. DO NOT EDIT.`);
+  lines.push(`// System: ${system.name}`);
+  lines.push(`require("dotenv").config();`);
+  lines.push(`import express from "express";`);
+  lines.push(`import { createServer } from "http";`);
+  lines.push(`import cors from "cors";`);
+  lines.push(`import helmet from "helmet";`);
+  lines.push(`import rateLimit from "express-rate-limit";`);
+  lines.push(`import { authMiddleware } from "./auth";`);
+  lines.push(`import { healthRouter } from "./health";`);
+  lines.push(`import { logger } from "./logger";`);
+  lines.push(`import { eventBus } from "./events";`);
+  lines.push(`import { pool } from "./db";`);
+  if (hasBatch)     lines.push(`import { startBatchWorker } from "./batch";`);
+  if (hasWebSocket) lines.push(`import { setupWebSocketServer } from "./websocket";`);
+
+  // Auth router import — must be at top-level with other imports
+  const authMethod = (() => {
+    const direct = system.resolution["implied.auth_method"] || system.resolution["system.auth_method"];
+    if (direct === "oauth2" || direct === "apikey" || direct === "jwt") return direct;
+    for (const [key, val] of Object.entries(system.resolution)) {
+      if (key.endsWith(".auth_method") && (val === "oauth2" || val === "apikey" || val === "jwt")) return val;
+    }
+    for (const mod of system.modules) {
+      const m = mod.config["auth_method"] as string | undefined;
+      if (m === "oauth2" || m === "apikey" || m === "jwt") return m;
+    }
+    return "jwt";
+  })();
+  if (authMethod === "oauth2" || authMethod === "apikey") {
+    lines.push(`import { authRouter } from "./auth";`);
+  }
+  lines.push(``);
+
+  for (const mod of apiModules) {
+    const model = mod.models[0];
+    if (!model) continue;
+    const routerName = toCamelCase(toSnakeCase(model.name) + "s") + "Router";
+    lines.push(`import { ${routerName} } from "./routes/${toSnakeCase(model.name)}";`);
+  }
+
+  lines.push(``);
+  lines.push(`const app = express();`);
+  lines.push(`const httpServer = createServer(app);`);
+  lines.push(`const PORT = parseInt(process.env.PORT || "3000");`);
+  lines.push(``);
+
+  // Middleware
+  lines.push(`// Middleware`);
+  lines.push(`app.use(helmet());`);
+
+  // HTTPS enforcement (in_transit or both encryption mode)
+  if (enforceHttps) {
+    lines.push(`// Encryption policy: in_transit — redirect HTTP to HTTPS in production`);
+    lines.push(`app.use((req: any, res: any, next: any) => {`);
+    lines.push(`  if (process.env.NODE_ENV === "production" && req.headers["x-forwarded-proto"] !== "https") {`);
+    lines.push(`    return res.redirect(301, \`https://\${req.headers.host}\${req.url}\`);`);
+    lines.push(`  }`);
+    lines.push(`  next();`);
+    lines.push(`});`);
+  }
+
+  // At-rest encryption warning (at_rest or both)
+  if (encryptionMode === "at_rest" || encryptionMode === "both") {
+    lines.push(`// Encryption policy: at_rest — ensure DATABASE_URL uses SSL and disk encryption is enabled`);
+    lines.push(`if (process.env.NODE_ENV === "production" && process.env.DATABASE_URL && !process.env.DATABASE_URL.includes("sslmode=require")) {`);
+    lines.push(`  console.warn("[WARN] Encryption policy requires at-rest encryption. Add ?sslmode=require to DATABASE_URL.");`);
+    lines.push(`}`);
+  }
+  lines.push(`// CORS: restrict to ALLOWED_ORIGINS env var (comma-separated). Defaults to same-origin only.`);
+  lines.push(`const __allowedOrigins = (process.env.ALLOWED_ORIGINS || "").split(",").map(s => s.trim()).filter(Boolean);`);
+  lines.push(`app.use(cors({`);
+  lines.push(`  origin: __allowedOrigins.length > 0`);
+  lines.push(`    ? (origin, cb) => { if (!origin || __allowedOrigins.includes(origin)) cb(null, true); else cb(new Error("Not allowed by CORS")); }`);
+  lines.push(`    : false,`);
+  lines.push(`  credentials: true,`);
+  lines.push(`}));`);
+  lines.push(`app.use(express.json({ limit: "1mb" }));`);
+  lines.push(`app.use(express.urlencoded({ extended: false, limit: "1mb" }));`);
+  lines.push(`app.use(authMiddleware);`);
+  lines.push(``);
+
+  // Rate limiting
+  const rateVal = gw?.config["rate_limit"] || 300;
+  lines.push(`// Global rate limit (default ${rateVal} req/min, override with RATE_LIMIT_MAX env var)`);
+  lines.push(`const __globalRateLimit = rateLimit({`);
+  lines.push(`  windowMs: parseInt(process.env.RATE_LIMIT_WINDOW_MS || "60000"),`);
+  lines.push(`  max: parseInt(process.env.RATE_LIMIT_MAX || "${rateVal}"),`);
+  lines.push(`  standardHeaders: true,`);
+  lines.push(`  legacyHeaders: false,`);
+  lines.push(`  message: { error: { code: "RATE_LIMITED", message: "Too many requests, please slow down." } },`);
+  lines.push(`});`);
+  lines.push(`app.use(__globalRateLimit);`);
+  lines.push(``);
+  lines.push(`// Strict rate limit on auth endpoints (20 req/min per IP)`);
+  lines.push(`const __authRateLimit = rateLimit({`);
+  lines.push(`  windowMs: 60000,`);
+  lines.push(`  max: parseInt(process.env.AUTH_RATE_LIMIT_MAX || "20"),`);
+  lines.push(`  standardHeaders: true,`);
+  lines.push(`  legacyHeaders: false,`);
+  lines.push(`  message: { error: { code: "RATE_LIMITED", message: "Too many auth attempts." } },`);
+  lines.push(`});`);
+  lines.push(``);
+
+  // Request timeout
+  lines.push(`// Request timeout (default 30s, override per-route)`);
+  lines.push(`app.use((req: any, res: any, next: any) => {`);
+  lines.push(`  const timeout = parseInt(process.env.REQUEST_TIMEOUT_MS || "30000");`);
+  lines.push(`  const timer = setTimeout(() => {`);
+  lines.push(`    if (!res.headersSent) {`);
+  lines.push(`      res.status(503).json({ error: { code: "REQUEST_TIMEOUT", message: "Request timed out" } });`);
+  lines.push(`    }`);
+  lines.push(`  }, timeout);`);
+  lines.push(`  res.on("finish", () => clearTimeout(timer));`);
+  lines.push(`  next();`);
+  lines.push(`});`);
+  lines.push(``);
+
+  // Routes
+  lines.push(`// Health & metrics`);
+  lines.push(`app.use("/health", healthRouter);`);
+  lines.push(``);
+
+  // Auth routes for OAuth2 and API key strategies
+  if (authMethod === "oauth2" || authMethod === "apikey") {
+    lines.push(`// Auth routes (${authMethod})`);
+    lines.push(`app.use("/auth", __authRateLimit, authRouter);`);
+    lines.push(``);
+  }
+
+  lines.push(`// Routes`);
+  for (const mod of apiModules) {
+    const model = mod.models[0];
+    if (!model) continue;
+    const routerName = toCamelCase(toSnakeCase(model.name) + "s") + "Router";
+    const routePath = `/${toSnakeCase(model.name)}s`;
+    lines.push(`app.use("${routePath}", ${routerName});`);
+    lines.push(`app.use("${routePath}/login", __authRateLimit);`);
+    lines.push(`app.use("${routePath}/register", __authRateLimit);`);
+  }
+  lines.push(``);
+
+  if (hasWebSocket) {
+    lines.push(`// WebSocket`);
+    lines.push(`setupWebSocketServer(httpServer);`);
+    lines.push(``);
+  }
+
+  // Startup
+  lines.push(`// Start`);
+  lines.push(`httpServer.listen(PORT, () => {`);
+  lines.push(`  logger.info("server_started", { event: "startup", metadata: { port: PORT } });`);
+  lines.push(`  eventBus.startWorker(parseInt(process.env.EVENT_WORKER_INTERVAL_MS || "1000"));`);
+  if (hasBatch) lines.push(`  startBatchWorker();`);
+  lines.push(`  console.log(\`[${system.name}] Running on port \${PORT}\`);`);
+  lines.push(`  console.log(\`  HTTP routes:\`);`);
+  for (const mod of apiModules) {
+    const model = mod.models[0];
+    if (!model) continue;
+    lines.push(`  console.log(\`    /${toSnakeCase(model.name)}s\`);`);
+  }
+  if (hasWebSocket) lines.push(`  console.log(\`  WebSocket: /ws?channel=<name>&token=<jwt>\`);`);
+  lines.push(`  console.log(\`  Health: /health/live, /health/ready, /health/metrics\`);`);
+  lines.push(`});`);
+  lines.push(``);
+
+  // Graceful shutdown
+  lines.push(`// Graceful shutdown`);
+  lines.push(`const shutdown = async (signal: string) => {`);
+  lines.push(`  logger.info("server_stopping", { event: "shutdown", metadata: { signal } });`);
+  lines.push(`  httpServer.close(async () => {`);
+  lines.push(`    try {`);
+  lines.push(`      await pool.end();`);
+  lines.push(`      logger.info("server_stopped", { event: "shutdown", status: "success" });`);
+  lines.push(`    } catch (e: any) {`);
+  lines.push(`      logger.error("shutdown_error", { event: "shutdown", metadata: { error: e.message } });`);
+  lines.push(`    }`);
+  lines.push(`    process.exit(0);`);
+  lines.push(`  });`);
+  lines.push(`  setTimeout(() => { logger.error("shutdown_timeout", { event: "shutdown" }); process.exit(1); }, 10000);`);
+  lines.push(`};`);
+  lines.push(`process.on("SIGTERM", () => shutdown("SIGTERM"));`);
+  lines.push(`process.on("SIGINT",  () => shutdown("SIGINT"));`);
+  lines.push(``);
+  lines.push(`export { app, httpServer };`);
+
+  return lines.join("\n");
+}