bonescript-compiler 0.5.5 → 0.5.7

package/dist/emit_openapi.js

@@ -0,0 +1,333 @@
+"use strict";
+/**
+ * BoneScript OpenAPI Emitter
+ * Generates OpenAPI 3.0.3 YAML and JSON specs from an IRSystem.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.emitOpenApiJson = exports.emitOpenApiSpec = void 0;
+// ─── Helpers ──────────────────────────────────────────────────────────────────
+function toSnakeCase(s) {
+    return s.replace(/([a-z])([A-Z])/g, "$1_$2").toLowerCase();
+}
+function toDashCase(s) {
+    return toSnakeCase(s).replace(/_/g, "-");
+}
+function toPascalCase(s) {
+    return s.replace(/(^|_)([a-z])/g, (_, _p, c) => c.toUpperCase());
+}
+function irTypeToOpenApi(irType) {
+    if (irType === "string")
+        return { type: "string" };
+    if (irType === "uint" || irType === "int")
+        return { type: "integer" };
+    if (irType === "float")
+        return { type: "number" };
+    if (irType === "bool")
+        return { type: "boolean" };
+    if (irType === "timestamp")
+        return { type: "string", format: "date-time" };
+    if (irType === "uuid")
+        return { type: "string", format: "uuid" };
+    if (irType === "bytes")
+        return { type: "string", format: "byte" };
+    if (irType === "json")
+        return { type: "object" };
+    const listMatch = irType.match(/^list<(.+)>$/);
+    if (listMatch)
+        return { type: "array", items: irTypeToOpenApi(listMatch[1]) };
+    const setMatch = irType.match(/^set<(.+)>$/);
+    if (setMatch)
+        return { type: "array", items: irTypeToOpenApi(setMatch[1]) };
+    const optMatch = irType.match(/^optional<(.+)>$/);
+    if (optMatch)
+        return { ...irTypeToOpenApi(optMatch[1]), nullable: true };
+    return { type: "string" };
+}
+function ind(n) {
+    return "  ".repeat(n);
+}
+function yamlValue(v, depth) {
+    if (v === null || v === undefined)
+        return "null";
+    if (typeof v === "boolean")
+        return String(v);
+    if (typeof v === "number")
+        return String(v);
+    if (typeof v === "string") {
+        if (v.includes(":") ||
+            v.includes("#") ||
+            v.includes("'") ||
+            v.startsWith("{") ||
+            v.startsWith("[")) {
+            return JSON.stringify(v);
+        }
+        return v;
+    }
+    if (Array.isArray(v)) {
+        if (v.length === 0)
+            return "[]";
+        return ("\n" +
+            v
+                .map((item) => ind(depth) + "- " + yamlValue(item, depth + 1))
+                .join("\n"));
+    }
+    if (typeof v === "object") {
+        const entries = Object.entries(v);
+        if (entries.length === 0)
+            return "{}";
+        return ("\n" +
+            entries
+                .map(([k, val]) => {
+                const valStr = yamlValue(val, depth + 1);
+                if (valStr.startsWith("\n")) {
+                    return ind(depth) + k + ":" + valStr;
+                }
+                return ind(depth) + k + ": " + valStr;
+            })
+                .join("\n"));
+    }
+    return String(v);
+}
+function objToYaml(obj, depth = 0) {
+    const lines = [];
+    for (const [k, v] of Object.entries(obj)) {
+        const valStr = yamlValue(v, depth + 1);
+        if (valStr.startsWith("\n")) {
+            lines.push(ind(depth) + k + ":" + valStr);
+        }
+        else {
+            lines.push(ind(depth) + k + ": " + valStr);
+        }
+    }
+    return lines.join("\n");
+}
+// ─── Spec builder ─────────────────────────────────────────────────────────────
+function buildSpec(system) {
+    const paths = {};
+    const schemas = {};
+    for (const mod of system.modules) {
+        if (mod.kind !== "api_service" || mod.models.length === 0)
+            continue;
+        const model = mod.models[0];
+        const tableName = toSnakeCase(model.name);
+        const modelName = toPascalCase(model.name);
+        const collectionPath = "/" + tableName + "s";
+        const itemPath = "/" + tableName + "s/{id}";
+        const allMethods = mod.interfaces.flatMap((i) => i.methods);
+        const crudNames = new Set(["create", "read", "update", "delete", "list"]);
+        const capabilityMethods = allMethods.filter((m) => !crudNames.has(m.name.toLowerCase()));
+        const securityRef = [{ BearerAuth: [] }];
+        const listOp = {
+            summary: "List " + modelName,
+            operationId: "list" + modelName,
+            tags: [modelName],
+            parameters: [
+                { name: "page", in: "query", schema: { type: "integer", default: 1 } },
+                {
+                    name: "page_size",
+                    in: "query",
+                    schema: { type: "integer", default: 50 },
+                },
+            ],
+            responses: {
+                "200": {
+                    description: "List of " + modelName,
+                    content: {
+                        "application/json": {
+                            schema: {
+                                type: "object",
+                                properties: {
+                                    items: {
+                                        type: "array",
+                                        items: { $ref: "#/components/schemas/" + modelName },
+                                    },
+                                    total: { type: "integer" },
+                                    page: { type: "integer" },
+                                    page_size: { type: "integer" },
+                                },
+                            },
+                        },
+                    },
+                },
+                "401": { description: "Unauthorized" },
+            },
+        };
+        const createOp = {
+            summary: "Create " + modelName,
+            operationId: "create" + modelName,
+            tags: [modelName],
+            security: securityRef,
+            requestBody: {
+                required: true,
+                content: {
+                    "application/json": {
+                        schema: { $ref: "#/components/schemas/" + modelName },
+                    },
+                },
+            },
+            responses: {
+                "200": {
+                    description: "Created",
+                    content: {
+                        "application/json": {
+                            schema: { $ref: "#/components/schemas/" + modelName },
+                        },
+                    },
+                },
+                "401": { description: "Unauthorized" },
+                "422": { description: "Precondition failed" },
+                "400": { description: "Bad request" },
+            },
+        };
+        paths[collectionPath] = { get: listOp, post: createOp };
+        const idParam = [
+            {
+                name: "id",
+                in: "path",
+                required: true,
+                schema: { type: "string", format: "uuid" },
+            },
+        ];
+        paths[itemPath] = {
+            get: {
+                summary: "Get " + modelName,
+                operationId: "get" + modelName,
+                tags: [modelName],
+                parameters: idParam,
+                security: securityRef,
+                responses: {
+                    "200": {
+                        description: "Found",
+                        content: {
+                            "application/json": {
+                                schema: { $ref: "#/components/schemas/" + modelName },
+                            },
+                        },
+                    },
+                    "401": { description: "Unauthorized" },
+                    "400": { description: "Not found" },
+                },
+            },
+            put: {
+                summary: "Update " + modelName,
+                operationId: "update" + modelName,
+                tags: [modelName],
+                parameters: idParam,
+                security: securityRef,
+                requestBody: {
+                    required: true,
+                    content: {
+                        "application/json": {
+                            schema: { $ref: "#/components/schemas/" + modelName },
+                        },
+                    },
+                },
+                responses: {
+                    "200": {
+                        description: "Updated",
+                        content: {
+                            "application/json": {
+                                schema: { $ref: "#/components/schemas/" + modelName },
+                            },
+                        },
+                    },
+                    "401": { description: "Unauthorized" },
+                    "422": { description: "Precondition failed" },
+                    "400": { description: "Bad request" },
+                },
+            },
+            delete: {
+                summary: "Delete " + modelName,
+                operationId: "delete" + modelName,
+                tags: [modelName],
+                parameters: idParam,
+                security: securityRef,
+                responses: {
+                    "200": { description: "Deleted" },
+                    "401": { description: "Unauthorized" },
+                    "400": { description: "Not found" },
+                },
+            },
+        };
+        for (const method of capabilityMethods) {
+            const capPath = collectionPath + "/" + toDashCase(method.name);
+            const capOp = {
+                summary: method.name + " on " + modelName,
+                operationId: method.name + modelName,
+                tags: [modelName],
+                requestBody: {
+                    required: true,
+                    content: {
+                        "application/json": {
+                            schema: { $ref: "#/components/schemas/" + modelName },
+                        },
+                    },
+                },
+                responses: {
+                    "200": {
+                        description: "Success",
+                        content: {
+                            "application/json": {
+                                schema: {
+                                    type: "object",
+                                    properties: {
+                                        ok: { type: "boolean" },
+                                        action: { type: "string" },
+                                    },
+                                },
+                            },
+                        },
+                    },
+                    "401": { description: "Unauthorized" },
+                    "422": { description: "Precondition failed" },
+                    "400": { description: "Bad request" },
+                },
+            };
+            if (method.authenticated) {
+                capOp.security = securityRef;
+            }
+            paths[capPath] = { post: capOp };
+        }
+        const properties = {};
+        for (const field of model.fields) {
+            properties[field.name] = irTypeToOpenApi(field.type);
+        }
+        schemas[modelName] = {
+            type: "object",
+            properties,
+        };
+    }
+    return {
+        openapi: "3.0.3",
+        info: {
+            title: system.name,
+            version: system.version,
+            description: "Generated by BoneScript compiler",
+        },
+        servers: [{ url: "http://localhost:3000" }],
+        paths,
+        components: {
+            securitySchemes: {
+                BearerAuth: {
+                    type: "http",
+                    scheme: "bearer",
+                    bearerFormat: "JWT",
+                },
+            },
+            schemas,
+        },
+    };
+}
+// ─── Public API ───────────────────────────────────────────────────────────────
+function emitOpenApiSpec(system) {
+    const spec = buildSpec(system);
+    const lines = ["# Generated by BoneScript compiler"];
+    lines.push(objToYaml(spec));
+    return lines.join("\n") + "\n";
+}
+exports.emitOpenApiSpec = emitOpenApiSpec;
+function emitOpenApiJson(system) {
+    return JSON.stringify(buildSpec(system), null, 2);
+}
+exports.emitOpenApiJson = emitOpenApiJson;
+//# sourceMappingURL=emit_openapi.js.map

package/dist/emit_openapi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emit_openapi.js","sourceRoot":"","sources":["../src/emit_openapi.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAIH,iFAAiF;AAEjF,SAAS,WAAW,CAAC,CAAS;IAC5B,OAAO,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,CAAS,EAAE,EAAU,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACnD,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACtE,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAClD,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAClD,IAAI,MAAM,KAAK,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC3E,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjE,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAClE,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACjD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC/C,IAAI,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC7C,IAAI,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAClD,IAAI,QAAQ;QAAE,OAAO,EAAE,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACzE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,GAAG,CAAC,CAAS;IACpB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,SAAS,CAAC,CAAU,EAAE,KAAa;IAC1C,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACjD,IAAI,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,IACE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YACf,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YACf,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YACf,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YACjB,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EACjB,CAAC;YACD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAChC,OAAO,CACL,IAAI;YACJ,CAAC;iBACE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;iBAC7D,IAAI,CAAC,IAAI,CAAC,CACd,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAA4B,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,OAAO,CACL,IAAI;YACJ,OAAO;iBACJ,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE;gBAChB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBACzC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC5B,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,MAAM,CAAC;gBACvC,CAAC;gBACD,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,MAAM,CAAC;YACxC,CAAC,CAAC;iBACD,IAAI,CAAC,IAAI,CAAC,CACd,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,SAAS,CAAC,GAA4B,EAAE,KAAK,GAAG,CAAC;IACxD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACvC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,MAAM,CAAC,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,iFAAiF;AAEjF,SAAS,SAAS,CAAC,MAAmB;IACpC,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,MAAM,OAAO,GAA4B,EAAE,CAAC;IAE5C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACjC,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEpE,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,cAAc,GAAG,GAAG,GAAG,SAAS,GAAG,GAAG,CAAC;QAC7C,MAAM,QAAQ,GAAG,GAAG,GAAG,SAAS,GAAG,QAAQ,CAAC;QAE5C,MAAM,UAAU,GAAkB,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1E,MAAM,iBAAiB,GAAG,UAAU,CAAC,MAAM,CACzC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAC5C,CAAC;QAEF,MAAM,WAAW,GAAG,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QAEzC,MAAM,MAAM,GAA4B;YACtC,OAAO,EAAE,OAAO,GAAG,SAAS;YAC5B,WAAW,EAAE,MAAM,GAAG,SAAS;YAC/B,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,UAAU,EAAE;gBACV,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE;gBACtE;oBACE,IAAI,EAAE,WAAW;oBACjB,EAAE,EAAE,OAAO;oBACX,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE;iBACzC;aACF;YACD,SAAS,EAAE;gBACT,KAAK,EAAE;oBACL,WAAW,EAAE,UAAU,GAAG,SAAS;oBACnC,OAAO,EAAE;wBACP,kBAAkB,EAAE;4BAClB,MAAM,EAAE;gCACN,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE;oCACV,KAAK,EAAE;wCACL,IAAI,EAAE,OAAO;wCACb,KAAK,EAAE,EAAE,IAAI,EAAE,uBAAuB,GAAG,SAAS,EAAE;qCACrD;oCACD,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;oCAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;oCACzB,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;iCAC/B;6BACF;yBACF;qBACF;iBACF;gBACD,KAAK,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE;aACvC;SACF,CAAC;QAEF,MAAM,QAAQ,GAA4B;YACxC,OAAO,EAAE,SAAS,GAAG,SAAS;YAC9B,WAAW,EAAE,QAAQ,GAAG,SAAS;YACjC,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,QAAQ,EAAE,WAAW;YACrB,WAAW,EAAE;gBACX,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE;oBACP,kBAAkB,EAAE;wBAClB,MAAM,EAAE,EAAE,IAAI,EAAE,uBAAuB,GAAG,SAAS,EAAE;qBACtD;iBACF;aACF;YACD,SAAS,EAAE;gBACT,KAAK,EAAE;oBACL,WAAW,EAAE,SAAS;oBACtB,OAAO,EAAE;wBACP,kBAAkB,EAAE;4BAClB,MAAM,EAAE,EAAE,IAAI,EAAE,uBAAuB,GAAG,SAAS,EAAE;yBACtD;qBACF;iBACF;gBACD,KAAK,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE;gBACtC,KAAK,EAAE,EAAE,WAAW,EAAE,qBAAqB,EAAE;gBAC7C,KAAK,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE;aACtC;SACF,CAAC;QAEF,KAAK,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAExD,MAAM,OAAO,GAAG;YACd;gBACE,IAAI,EAAE,IAAI;gBACV,EAAE,EAAE,MAAM;gBACV,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE;aAC3C;SACF,CAAC;QAEF,KAAK,CAAC,QAAQ,CAAC,GAAG;YAChB,GAAG,EAAE;gBACH,OAAO,EAAE,MAAM,GAAG,SAAS;gBAC3B,WAAW,EAAE,KAAK,GAAG,SAAS;gBAC9B,IAAI,EAAE,CAAC,SAAS,CAAC;gBACjB,UAAU,EAAE,OAAO;gBACnB,QAAQ,EAAE,WAAW;gBACrB,SAAS,EAAE;oBACT,KAAK,EAAE;wBACL,WAAW,EAAE,OAAO;wBACpB,OAAO,EAAE;4BACP,kBAAkB,EAAE;gCAClB,MAAM,EAAE,EAAE,IAAI,EAAE,uBAAuB,GAAG,SAAS,EAAE;6BACtD;yBACF;qBACF;oBACD,KAAK,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE;oBACtC,KAAK,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE;iBACpC;aACF;YACD,GAAG,EAAE;gBACH,OAAO,EAAE,SAAS,GAAG,SAAS;gBAC9B,WAAW,EAAE,QAAQ,GAAG,SAAS;gBACjC,IAAI,EAAE,CAAC,SAAS,CAAC;gBACjB,UAAU,EAAE,OAAO;gBACnB,QAAQ,EAAE,WAAW;gBACrB,WAAW,EAAE;oBACX,QAAQ,EAAE,IAAI;oBACd,OAAO,EAAE;wBACP,kBAAkB,EAAE;4BAClB,MAAM,EAAE,EAAE,IAAI,EAAE,uBAAuB,GAAG,SAAS,EAAE;yBACtD;qBACF;iBACF;gBACD,SAAS,EAAE;oBACT,KAAK,EAAE;wBACL,WAAW,EAAE,SAAS;wBACtB,OAAO,EAAE;4BACP,kBAAkB,EAAE;gCAClB,MAAM,EAAE,EAAE,IAAI,EAAE,uBAAuB,GAAG,SAAS,EAAE;6BACtD;yBACF;qBACF;oBACD,KAAK,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE;oBACtC,KAAK,EAAE,EAAE,WAAW,EAAE,qBAAqB,EAAE;oBAC7C,KAAK,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE;iBACtC;aACF;YACD,MAAM,EAAE;gBACN,OAAO,EAAE,SAAS,GAAG,SAAS;gBAC9B,WAAW,EAAE,QAAQ,GAAG,SAAS;gBACjC,IAAI,EAAE,CAAC,SAAS,CAAC;gBACjB,UAAU,EAAE,OAAO;gBACnB,QAAQ,EAAE,WAAW;gBACrB,SAAS,EAAE;oBACT,KAAK,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE;oBACjC,KAAK,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE;oBACtC,KAAK,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE;iBACpC;aACF;SACF,CAAC;QAEF,KAAK,MAAM,MAAM,IAAI,iBAAiB,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,cAAc,GAAG,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC/D,MAAM,KAAK,GAA4B;gBACrC,OAAO,EAAE,MAAM,CAAC,IAAI,GAAG,MAAM,GAAG,SAAS;gBACzC,WAAW,EAAE,MAAM,CAAC,IAAI,GAAG,SAAS;gBACpC,IAAI,EAAE,CAAC,SAAS,CAAC;gBACjB,WAAW,EAAE;oBACX,QAAQ,EAAE,IAAI;oBACd,OAAO,EAAE;wBACP,kBAAkB,EAAE;4BAClB,MAAM,EAAE,EAAE,IAAI,EAAE,uBAAuB,GAAG,SAAS,EAAE;yBACtD;qBACF;iBACF;gBACD,SAAS,EAAE;oBACT,KAAK,EAAE;wBACL,WAAW,EAAE,SAAS;wBACtB,OAAO,EAAE;4BACP,kBAAkB,EAAE;gCAClB,MAAM,EAAE;oCACN,IAAI,EAAE,QAAQ;oCACd,UAAU,EAAE;wCACV,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;wCACvB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;qCAC3B;iCACF;6BACF;yBACF;qBACF;oBACD,KAAK,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE;oBACtC,KAAK,EAAE,EAAE,WAAW,EAAE,qBAAqB,EAAE;oBAC7C,KAAK,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE;iBACtC;aACF,CAAC;YACF,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;gBACzB,KAAK,CAAC,QAAQ,GAAG,WAAW,CAAC;YAC/B,CAAC;YACD,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACnC,CAAC;QAED,MAAM,UAAU,GAA4B,EAAE,CAAC;QAC/C,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,CAAC,SAAS,CAAC,GAAG;YACnB,IAAI,EAAE,QAAQ;YACd,UAAU;SACX,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ,KAAK,EAAE,MAAM,CAAC,IAAI;YAClB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,WAAW,EAAE,kCAAkC;SAChD;QACD,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,uBAAuB,EAAE,CAAC;QAC3C,KAAK;QACL,UAAU,EAAE;YACV,eAAe,EAAE;gBACf,UAAU,EAAE;oBACV,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,QAAQ;oBAChB,YAAY,EAAE,KAAK;iBACpB;aACF;YACD,OAAO;SACR;KACF,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF,SAAgB,eAAe,CAAC,MAAmB;IACjD,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAa,CAAC,oCAAoC,CAAC,CAAC;IAC/D,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AALD,0CAKC;AAED,SAAgB,eAAe,CAAC,MAAmB;IACjD,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACpD,CAAC;AAFD,0CAEC"}

package/dist/emit_postman.d.ts

@@ -0,0 +1,6 @@
+/**
+ * BoneScript Postman Collection Emitter
+ * Generates a Postman Collection v2.1 JSON from an IRSystem.
+ */
+import * as IR from "./ir";
+export declare function emitPostmanCollection(system: IR.IRSystem): string;

package/dist/emit_postman.js

@@ -0,0 +1,126 @@
+"use strict";
+/**
+ * BoneScript Postman Collection Emitter
+ * Generates a Postman Collection v2.1 JSON from an IRSystem.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.emitPostmanCollection = void 0;
+// ─── Helpers ──────────────────────────────────────────────────────────────────
+function toSnakeCase(s) {
+    return s.replace(/([a-z])([A-Z])/g, "$1_$2").toLowerCase();
+}
+function toDashCase(s) {
+    return toSnakeCase(s).replace(/_/g, "-");
+}
+function sampleValue(irType) {
+    if (irType === "string")
+        return "example";
+    if (irType === "uint" || irType === "int")
+        return 1;
+    if (irType === "float")
+        return 1.0;
+    if (irType === "bool")
+        return true;
+    if (irType === "uuid")
+        return "00000000-0000-0000-0000-000000000001";
+    if (irType === "timestamp")
+        return "2024-01-01T00:00:00.000Z";
+    if (irType === "bytes")
+        return "";
+    if (irType === "json")
+        return {};
+    const listMatch = irType.match(/^list<(.+)>$/);
+    if (listMatch)
+        return [];
+    const setMatch = irType.match(/^set<(.+)>$/);
+    if (setMatch)
+        return [];
+    const optMatch = irType.match(/^optional<(.+)>$/);
+    if (optMatch)
+        return null;
+    return "example";
+}
+function buildSampleBody(model) {
+    const body = {};
+    for (const field of model.fields) {
+        body[field.name] = sampleValue(field.type);
+    }
+    return body;
+}
+function makeRequest(name, method, url, body) {
+    const headers = [
+        { key: "Content-Type", value: "application/json" },
+        { key: "Authorization", value: "Bearer {{token}}" },
+    ];
+    const req = {
+        name,
+        request: {
+            method,
+            header: headers,
+            url: {
+                raw: url,
+                host: ["{{baseUrl}}"],
+                path: url
+                    .replace("{{baseUrl}}/", "")
+                    .split("/")
+                    .filter(Boolean),
+            },
+        },
+    };
+    if (body !== undefined) {
+        req.request.body = {
+            mode: "raw",
+            raw: JSON.stringify(body, null, 2),
+            options: { raw: { language: "json" } },
+        };
+    }
+    return req;
+}
+// ─── Public API ───────────────────────────────────────────────────────────────
+function emitPostmanCollection(system) {
+    const folders = [];
+    for (const mod of system.modules) {
+        if (mod.kind !== "api_service" || mod.models.length === 0)
+            continue;
+        const model = mod.models[0];
+        const tableName = toSnakeCase(model.name);
+        const baseUrl = `{{baseUrl}}/${tableName}s`;
+        const sampleBody = buildSampleBody(model);
+        const items = [
+            makeRequest(`List ${model.name}s`, "GET", baseUrl),
+            makeRequest(`Create ${model.name}`, "POST", baseUrl, sampleBody),
+            makeRequest(`Get ${model.name}`, "GET", `${baseUrl}/:id`),
+            makeRequest(`Update ${model.name}`, "PUT", `${baseUrl}/:id`, sampleBody),
+            makeRequest(`Delete ${model.name}`, "DELETE", `${baseUrl}/:id`),
+        ];
+        const crudNames = new Set(["create", "read", "update", "delete", "list"]);
+        const allMethods = mod.interfaces.flatMap((i) => i.methods);
+        const capabilityMethods = allMethods.filter((m) => !crudNames.has(m.name.toLowerCase()));
+        for (const method of capabilityMethods) {
+            const dashName = toDashCase(method.name);
+            items.push(makeRequest(method.name + " " + model.name, "POST", `${baseUrl}/${dashName}`, sampleBody));
+        }
+        folders.push({
+            name: mod.name,
+            item: items,
+        });
+    }
+    const collection = {
+        info: {
+            name: system.name,
+            schema: "https://schema.getpostman.com/json/collection/v2.1.0/collection.json",
+        },
+        auth: {
+            type: "bearer",
+            bearer: [{ key: "token", value: "{{token}}", type: "string" }],
+        },
+        variable: [
+            { key: "baseUrl", value: "http://localhost:3000" },
+            { key: "token", value: "" },
+        ],
+        item: folders,
+    };
+    return JSON.stringify(collection, null, 2);
+}
+exports.emitPostmanCollection = emitPostmanCollection;
+//# sourceMappingURL=emit_postman.js.map

package/dist/emit_postman.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emit_postman.js","sourceRoot":"","sources":["../src/emit_postman.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAIH,iFAAiF;AAEjF,SAAS,WAAW,CAAC,CAAS;IAC5B,OAAO,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,CAAC,CAAC;IACpD,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,GAAG,CAAC;IACnC,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,sCAAsC,CAAC;IACrE,IAAI,MAAM,KAAK,WAAW;QAAE,OAAO,0BAA0B,CAAC;IAC9D,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,EAAE,CAAC;IAClC,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC/C,IAAI,SAAS;QAAE,OAAO,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC7C,IAAI,QAAQ;QAAE,OAAO,EAAE,CAAC;IACxB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAClD,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CAAC,KAAiB;IACxC,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAClB,IAAY,EACZ,MAAc,EACd,GAAW,EACX,IAA8B;IAE9B,MAAM,OAAO,GAAG;QACd,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,kBAAkB,EAAE;QAClD,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,kBAAkB,EAAE;KACpD,CAAC;IAEF,MAAM,GAAG,GAA4B;QACnC,IAAI;QACJ,OAAO,EAAE;YACP,MAAM;YACN,MAAM,EAAE,OAAO;YACf,GAAG,EAAE;gBACH,GAAG,EAAE,GAAG;gBACR,IAAI,EAAE,CAAC,aAAa,CAAC;gBACrB,IAAI,EAAE,GAAG;qBACN,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;qBAC3B,KAAK,CAAC,GAAG,CAAC;qBACV,MAAM,CAAC,OAAO,CAAC;aACnB;SACF;KACF,CAAC;IAEF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACtB,GAAG,CAAC,OAAmC,CAAC,IAAI,GAAG;YAC9C,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAClC,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;SACvC,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AAEjF,SAAgB,qBAAqB,CAAC,MAAmB;IACvD,MAAM,OAAO,GAAc,EAAE,CAAC;IAE9B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACjC,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEpE,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,eAAe,SAAS,GAAG,CAAC;QAC5C,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QAE1C,MAAM,KAAK,GAAc;YACvB,WAAW,CAAC,QAAQ,KAAK,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC;YAClD,WAAW,CAAC,UAAU,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC;YAChE,WAAW,CAAC,OAAO,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,OAAO,MAAM,CAAC;YACzD,WAAW,CAAC,UAAU,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,OAAO,MAAM,EAAE,UAAU,CAAC;YACxE,WAAW,CAAC,UAAU,KAAK,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,GAAG,OAAO,MAAM,CAAC;SAChE,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1E,MAAM,UAAU,GAAkB,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3E,MAAM,iBAAiB,GAAG,UAAU,CAAC,MAAM,CACzC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAC5C,CAAC;QAEF,KAAK,MAAM,MAAM,IAAI,iBAAiB,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACzC,KAAK,CAAC,IAAI,CACR,WAAW,CACT,MAAM,CAAC,IAAI,GAAG,GAAG,GAAG,KAAK,CAAC,IAAI,EAC9B,MAAM,EACN,GAAG,OAAO,IAAI,QAAQ,EAAE,EACxB,UAAU,CACX,CACF,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG;QACjB,IAAI,EAAE;YACJ,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EACJ,sEAAsE;SACzE;QACD,IAAI,EAAE;YACJ,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;SAC/D;QACD,QAAQ,EAAE;YACR,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,uBAAuB,EAAE;YAClD,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE;SAC5B;QACD,IAAI,EAAE,OAAO;KACd,CAAC;IAEF,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC7C,CAAC;AA7DD,sDA6DC"}

package/dist/emit_runtime.js

@@ -209,6 +209,11 @@ function emitEntityRouter(mod, system) {
     lines.push(`import { query, queryOne, execute, pool } from "../db";`);
     lines.push(`import { eventBus } from "../events";`);
     lines.push(`import { requireAuth, AuthContext } from "../auth";`);
+    lines.push(`import rateLimit from "express-rate-limit";`);
+    // Only import audit if module has audit: true
+    if (mod.config["audit"]) {
+        lines.push(`import { auditLog } from "../audit";`);
+    }
     lines.push(`import { logger } from "../logger";`);
     lines.push(`import { counter } from "../metrics";`);
     lines.push(`import * as __algorithms from "../algorithms";`);
@@ -230,10 +235,21 @@ function emitEntityRouter(mod, system) {
     }
     lines.push(`export const ${toCamelCase(routeBase)}Router = Router();`);
     lines.push(``);
+    // Per-module rate limiter (from policy declaration)
+    const modRateLimit = typeof mod.config["rate_limit"] === "number" && mod.config["rate_limit"] > 0
+        ? mod.config["rate_limit"] : 0;
+    const modRateLimitWindowMs = typeof mod.config["rate_limit_window_ms"] === "number"
+        ? mod.config["rate_limit_window_ms"] : 60000;
+    if (modRateLimit > 0) {
+        lines.push(`// Rate limiter from policy declaration`);
+        lines.push(`const __routeRateLimit = rateLimit({ windowMs: ${modRateLimitWindowMs}, max: ${modRateLimit}, standardHeaders: true, legacyHeaders: false });`);
+        lines.push(``);
+    }
     // CREATE
     const insertFields = entityModel.fields.filter(f => f.name !== "id" && f.name !== "created_at" && f.name !== "updated_at");
     lines.push(`// CREATE`);
-    lines.push(`${toCamelCase(routeBase)}Router.post("/", requireAuth, async (req: Request, res: Response) => {`);
+    const __crudMiddlewares = modRateLimit > 0 ? "__routeRateLimit, requireAuth" : "requireAuth";
+    lines.push(`${toCamelCase(routeBase)}Router.post("/", ${__crudMiddlewares}, async (req: Request, res: Response) => {`);
     lines.push(`  try {`);
     lines.push(`    const id = uuid();`);
     lines.push(`    const { ${insertFields.map(f => f.name).join(", ")} } = req.body;`);
@@ -257,7 +273,7 @@ function emitEntityRouter(mod, system) {
     lines.push(``);
     // READ
     lines.push(`// READ`);
-    lines.push(`${toCamelCase(routeBase)}Router.get("/:id", requireAuth, async (req: Request, res: Response) => {`);
+    lines.push(`${toCamelCase(routeBase)}Router.get("/:id", ${__crudMiddlewares}, async (req: Request, res: Response) => {`);
     lines.push(`  try {`);
     lines.push(`    const row = await queryOne(\`SELECT * FROM ${tableName} WHERE id = $1\`, [req.params.id]);`);
     lines.push(`    if (!row) return res.status(404).json({ error: { code: "NOT_FOUND", message: "Not found" } });`);
@@ -270,7 +286,7 @@ function emitEntityRouter(mod, system) {
     // LIST — with optional JOINs for has_one/belongs_to relations
     const joinRelations = mod.relations.filter(r => r.kind === "has_one" || r.kind === "belongs_to");
     lines.push(`// LIST`);
-    lines.push(`${toCamelCase(routeBase)}Router.get("/", requireAuth, async (req: Request, res: Response) => {`);
+    lines.push(`${toCamelCase(routeBase)}Router.get("/", ${__crudMiddlewares}, async (req: Request, res: Response) => {`);
     lines.push(`  try {`);
     lines.push(`    const page = parseInt(req.query.page as string) || 1;`);
     lines.push(`    const pageSize = Math.min(parseInt(req.query.page_size as string) || 50, 100);`);
@@ -299,7 +315,7 @@ function emitEntityRouter(mod, system) {
     lines.push(``);
     // UPDATE — with state machine enforcement
     lines.push(`// UPDATE`);
-    lines.push(`${toCamelCase(routeBase)}Router.put("/:id", requireAuth, async (req: Request, res: Response) => {`);
+    lines.push(`${toCamelCase(routeBase)}Router.put("/:id", ${__crudMiddlewares}, async (req: Request, res: Response) => {`);
     lines.push(`  const fields = { ...req.body };`);
     if (mod.state_machines.length > 0) {
         const sm = mod.state_machines[0];
@@ -323,7 +339,7 @@ function emitEntityRouter(mod, system) {
     lines.push(``);
     // DELETE
     lines.push(`// DELETE`);
-    lines.push(`${toCamelCase(routeBase)}Router.delete("/:id", requireAuth, async (req: Request, res: Response) => {`);
+    lines.push(`${toCamelCase(routeBase)}Router.delete("/:id", ${__crudMiddlewares}, async (req: Request, res: Response) => {`);
     lines.push(`  try {`);
     lines.push(`    const count = await execute(\`DELETE FROM ${tableName} WHERE id = $1\`, [req.params.id]);`);
     lines.push(`    if (count === 0) return res.status(404).json({ error: { code: "NOT_FOUND", message: "Not found" } });`);
@@ -381,7 +397,15 @@ function emitCapabilityEndpoint(method, mod, tableName, system) {
     const endpoint = `/${method.name.replace(/_/g, "-")}`;
     const isTransactional = method.sync === "transactional";
     lines.push(`// CAPABILITY: ${method.name}${isTransactional ? " [transactional]" : ""}${method.retry ? ` [retry: ${method.retry.max_attempts}x ${method.retry.backoff}]` : ""}`);
-    lines.push(`${routerName}.post("${endpoint}", requireAuth, async (req: Request, res: Response) => {`);
+    // Build middleware chain: optional rate limiter + requireAuth + optional audit
+    const capMiddlewares = ["requireAuth"];
+    if (typeof mod.config["rate_limit"] === "number" && mod.config["rate_limit"] > 0) {
+        capMiddlewares.unshift("__routeRateLimit");
+    }
+    if (mod.config["audit"]) {
+        capMiddlewares.push(`auditLog("${method.name}", "${mod.models[0]?.name ?? ""}")`);
+    }
+    lines.push(`${routerName}.post("${endpoint}", ${capMiddlewares.join(", ")}, async (req: Request, res: Response) => {`);
     lines.push(`  const auth: AuthContext = (req as any).auth;`);
     // Wrap in retry logic if declared
     if (method.retry) {