bonescript-compiler 0.5.8 → 0.6.1

package/src/emit_runtime.ts

@@ -1,763 +1,955 @@
-/**
- * BoneScript Runtime Code Emitter
- * Generates runnable service code from IR.
- */
-
-import * as IR from "./ir";
-import { emitCapabilityBody } from "./emit_capability";
-
-function toSnakeCase(s: string): string {
-  return s.replace(/([a-z])([A-Z])/g, "$1_$2").toLowerCase();
-}
-
-function toCamelCase(s: string): string {
-  return s.replace(/_([a-z])/g, (_, c) => c.toUpperCase());
-}
-
-function toPascalCase(s: string): string {
-  const c = toCamelCase(s);
-  return c.charAt(0).toUpperCase() + c.slice(1);
-}
-
-const TS_TYPE_MAP: Record<string, string> = {
-  string: "string", uint: "number", int: "number", float: "number",
-  bool: "boolean", timestamp: "Date", uuid: "string", bytes: "Buffer", json: "unknown",
-};
-
-function toTsType(irType: string): string {
-  if (TS_TYPE_MAP[irType]) return TS_TYPE_MAP[irType];
-  const m = irType.match(/^(list|set)<(.+)>$/);
-  if (m) return `${toTsType(m[2])}[]`;
-  const om = irType.match(/^optional<(.+)>$/);
-  if (om) return `${toTsType(om[1])} | null`;
-  return irType;
-}
-
-// ─── Package.json ─────────────────────────────────────────────────────────────
-
-export function emitPackageJson(system: IR.IRSystem): string {
-  const pkg = {
-    name: toSnakeCase(system.name),
-    version: system.version,
-    private: true,
-    scripts: {
-      build: "tsc",
-      start: "node dist/index.js",
-      dev: "ts-node src/index.ts",
-      migrate: "ts-node src/migrate.ts",
-    },
-    dependencies: {
-      express: "4.18.2",
-      pg: "8.11.3",
-      ioredis: "5.3.2",
-      ws: "8.16.0",
-      uuid: "9.0.0",
-      cors: "2.8.5",
-      helmet: "7.1.0",
-      "express-rate-limit": "7.1.5",
-      jsonwebtoken: "9.0.2",
-      dotenv: "16.3.1",
-      "node-cron": "3.0.3",
-    },
-    devDependencies: {
-      "@types/express": "4.17.21",
-      "@types/node": "18.19.0",
-      "@types/pg": "8.10.9",
-      "@types/ws": "8.5.10",
-      "@types/cors": "2.8.17",
-      "@types/jsonwebtoken": "9.0.5",
-      "@types/uuid": "9.0.7",
-      "@types/node-cron": "3.0.11",
-      typescript: "5.3.3",
-      "ts-node": "10.9.2",
-    },
-  };
-  return JSON.stringify(pkg, null, 2);
-}
-
-// ─── tsconfig.json ────────────────────────────────────────────────────────────
-
-export function emitTsConfig(): string {
-  const cfg = {
-    compilerOptions: {
-      target: "ES2020",
-      module: "commonjs",
-      // ES2020 + DOM gives us the built-in fetch types (Node 18+ ships a
-      // WHATWG-compatible fetch; DOM provides the matching type declarations).
-      lib: ["ES2020", "DOM"],
-      outDir: "./dist",
-      rootDir: "./src",
-      strict: true,
-      esModuleInterop: true,
-      skipLibCheck: true,
-      forceConsistentCasingInFileNames: true,
-      declaration: true,
-      sourceMap: true,
-    },
-    include: ["src/**/*"],
-    exclude: ["node_modules", "dist"],
-  };
-  return JSON.stringify(cfg, null, 2);
-}
-
-// ─── Database Client ──────────────────────────────────────────────────────────
-
-export function emitDbClient(system: IR.IRSystem): string {
-  const name = toSnakeCase(system.name);
-  return [
-    "// Generated by BoneScript compiler. DO NOT EDIT.",
-    "import { Pool, PoolClient } from \"pg\";",
-    "",
-    "// Lazy pool — created on first use so DATABASE_URL is read after dotenv loads",
-    "let _pool: Pool | null = null;",
-    "function getPool(): Pool {",
-    "  if (!_pool) {",
-    `  _pool = new Pool({ connectionString: process.env.DATABASE_URL || "postgresql://localhost:5432/${name}", max: 20 });`,
-    "  _pool.on(\"error\", (err: Error) => console.error(\"[DB] Pool error (non-fatal):\", err.message));",
-    "  }",
-    "  return _pool;",
-    "}",
-    "export const pool = new Proxy({} as Pool, { get(_t: any, p: any) { return (getPool() as any)[p]; } });",
-    "",
-    "export async function query<T = any>(text: string, params?: any[]): Promise<T[]> {",
-    "  try { const result = await pool.query(text, params); return result.rows as T[]; }",
-    "  catch (e: any) { throw new Error(`DB query failed: ${e.message}`); }",
-    "}",
-    "export async function queryOne<T = any>(text: string, params?: any[]): Promise<T | null> {",
-    "  try { const rows = await query<T>(text, params); return rows[0] || null; }",
-    "  catch (e: any) { throw new Error(`DB query failed: ${e.message}`); }",
-    "}",
-    "export async function execute(text: string, params?: any[]): Promise<number> {",
-    "  try { const result = await pool.query(text, params); return result.rowCount || 0; }",
-    "  catch (e: any) { throw new Error(`DB execute failed: ${e.message}`); }",
-    "}",
-    "export async function transaction<T>(fn: (client: PoolClient) => Promise<T>): Promise<T> {",
-    "  const client = await pool.connect();",
-    "  try { await client.query(\"BEGIN\"); const result = await fn(client); await client.query(\"COMMIT\"); return result; }",
-    "  catch (e) { await client.query(\"ROLLBACK\"); throw e; }",
-    "  finally { client.release(); }",
-    "}",
-  ].join("\n");
-}
-
-
-export function emitAuthMiddleware(system: IR.IRSystem): string {
-  return `// Generated by BoneScript compiler. DO NOT EDIT.
-import { Request, Response, NextFunction } from "express";
-import jwt from "jsonwebtoken";
-
-// JWT_SECRET must be set in production. The server will refuse to start without it
-// when NODE_ENV is "production" to prevent accidental use of a weak fallback.
-const JWT_SECRET = (() => {
-  const secret = process.env.JWT_SECRET;
-  if (!secret) {
-    if (process.env.NODE_ENV === "production") {
-      console.error("[FATAL] JWT_SECRET environment variable is not set. Refusing to start in production.");
-      process.exit(1);
-    }
-    console.warn("[WARN] JWT_SECRET is not set. Using insecure default — do not use in production.");
-    return "bonescript-dev-secret-do-not-use-in-production";
-  }
-  if (secret.length < 32) {
-    console.warn("[WARN] JWT_SECRET is shorter than 32 characters. Use a longer secret in production.");
-  }
-  return secret;
-})();
-
-export interface AuthContext {
-  authenticated: boolean;
-  actor_id: string | null;
-  trace_id: string;
-}
-
-export function authMiddleware(req: Request, res: Response, next: NextFunction): void {
-  const header = req.headers.authorization;
-  if (!header || !header.startsWith("Bearer ")) {
-    (req as any).auth = { authenticated: false, actor_id: null, trace_id: req.headers["x-trace-id"] as string || "" };
-    next();
-    return;
-  }
-  try {
-    const token = header.slice(7);
-    const decoded = jwt.verify(token, JWT_SECRET) as { sub: string };
-    (req as any).auth = {
-      authenticated: true,
-      actor_id: decoded.sub,
-      trace_id: req.headers["x-trace-id"] as string || "",
-    };
-  } catch {
-    (req as any).auth = { authenticated: false, actor_id: null, trace_id: req.headers["x-trace-id"] as string || "" };
-  }
-  next();
-}
-
-export function requireAuth(req: Request, res: Response, next: NextFunction): void {
-  const auth: AuthContext = (req as any).auth;
-  if (!auth || !auth.authenticated) {
-    res.status(401).json({ error: { code: "UNAUTHORIZED", message: "Authentication required" } });
-    return;
-  }
-  next();
-}
-`;
-}
-
-// ─── Entity Router ────────────────────────────────────────────────────────────
-
-export function emitEntityRouter(mod: IR.IRModule, system: IR.IRSystem): string {
-  const entityModel = mod.models[0];
-  if (!entityModel) return "";
-
-  const tableName = toSnakeCase(entityModel.name) + "s";
-  const routeBase = toSnakeCase(entityModel.name) + "s";
-  const lines: string[] = [];
-
-  lines.push(`// Generated by BoneScript compiler. DO NOT EDIT.`);
-  lines.push(`// Service: ${mod.name}`);
-  lines.push(`import { Router, Request, Response } from "express";`);
-  lines.push(`import { v4 as uuid } from "uuid";`);
-  lines.push(`import { query, queryOne, execute, pool } from "../db";`);
-  lines.push(`import { eventBus } from "../events";`);
-  lines.push(`import { requireAuth, AuthContext } from "../auth";`);
-  lines.push(`import rateLimit from "express-rate-limit";`);
-  // Only import audit if module has audit: true
-  if (mod.config["audit"]) {
-    lines.push(`import { auditLog } from "../audit";`);
-  }
-  lines.push(`import { logger } from "../logger";`);
-  lines.push(`import { counter } from "../metrics";`);
-  lines.push(`import * as __algorithms from "../algorithms";`);
-  lines.push(`const { shortestPath, topologicalSort, binarySearch, bipartiteMatching, roundRobin, weightedAverage, percentile, rankBy, consistentHash } = __algorithms as any;`);
-  lines.push(``);
-
-  // Collect unknown function calls from capability effects and emit stubs
-  const unknownFunctions = collectUnknownFunctions(mod);
-  if (unknownFunctions.size > 0) {
-    lines.push(`// User-defined functions referenced in effects — implement these or use extension_point`);
-    for (const fn of unknownFunctions) {
-      lines.push(`declare function ${fn}(...args: any[]): any;`);
-    }
-    lines.push(``);
-  }
-
-  if (mod.state_machines.length > 0) {
-    const sm = mod.state_machines[0];
-    lines.push(`import { transition${sm.entity}, ${sm.entity.toUpperCase()}_INITIAL } from "../state_machines/${toSnakeCase(sm.entity)}";`);
-    lines.push(``);
-  }
-
-  lines.push(`export const ${toCamelCase(routeBase)}Router = Router();`);
-  lines.push(``);
-
-  // Per-module rate limiter (from policy declaration)
-  const modRateLimit = typeof mod.config["rate_limit"] === "number" && (mod.config["rate_limit"] as number) > 0
-    ? mod.config["rate_limit"] as number : 0;
-  const modRateLimitWindowMs = typeof mod.config["rate_limit_window_ms"] === "number"
-    ? mod.config["rate_limit_window_ms"] as number : 60000;
-  if (modRateLimit > 0) {
-    lines.push(`// Rate limiter from policy declaration`);
-    lines.push(`const __routeRateLimit = rateLimit({ windowMs: ${modRateLimitWindowMs}, max: ${modRateLimit}, standardHeaders: true, legacyHeaders: false });`);
-    lines.push(``);
-  }
-
-  // CREATE
-  const insertFields = entityModel.fields.filter(f => f.name !== "id" && f.name !== "created_at" && f.name !== "updated_at");
-  lines.push(`// CREATE`);
-  const __crudMiddlewares = modRateLimit > 0 ? "__routeRateLimit, requireAuth" : "requireAuth";
-  lines.push(`${toCamelCase(routeBase)}Router.post("/", ${__crudMiddlewares}, async (req: Request, res: Response) => {`);
-  lines.push(`  try {`);
-  lines.push(`    const id = uuid();`);
-  lines.push(`    const { ${insertFields.map(f => f.name).join(", ")} } = req.body;`);
-  if (mod.state_machines.length > 0) {
-    lines.push(`    const state = ${mod.state_machines[0].entity.toUpperCase()}_INITIAL;`);
-  }
-  const allInsertFields = ["id", ...insertFields.map(f => f.name)];
-  if (mod.state_machines.length > 0 && !insertFields.find(f => f.name === "state")) {
-    allInsertFields.push("state");
-  }
-  const placeholders = allInsertFields.map((_, i) => `$${i + 1}`).join(", ");
-  const values = allInsertFields.map(f => f === "id" ? "id" : f === "state" ? "state" : f).join(", ");
-  lines.push(`    const sql = \`INSERT INTO ${tableName} (${allInsertFields.join(", ")}) VALUES (${placeholders}) RETURNING *\`;`);
-  lines.push(`    const rows = await query(sql, [${values}]);`);
-  lines.push(`    counter("entity.created", { entity: "${entityModel.name}" });`);
-  lines.push(`    res.status(201).json(rows[0]);`);
-  lines.push(`  } catch (e: any) {`);
-  lines.push(`    res.status(400).json({ error: { code: "CREATE_FAILED", message: e.message } });`);
-  lines.push(`  }`);
-  lines.push(`});`);
-  lines.push(``);
-
-  // READ
-  lines.push(`// READ`);
-  lines.push(`${toCamelCase(routeBase)}Router.get("/:id", ${__crudMiddlewares}, async (req: Request, res: Response) => {`);
-  lines.push(`  try {`);
-  lines.push(`    const row = await queryOne(\`SELECT * FROM ${tableName} WHERE id = $1\`, [req.params.id]);`);
-  lines.push(`    if (!row) return res.status(404).json({ error: { code: "NOT_FOUND", message: "Not found" } });`);
-  lines.push(`    res.json(row);`);
-  lines.push(`  } catch (e: any) {`);
-  lines.push(`    res.status(500).json({ error: { code: "DB_ERROR", message: e.message } });`);
-  lines.push(`  }`);
-  lines.push(`});`);
-  lines.push(``);
-
-  // LIST — with optional JOINs for has_one/belongs_to relations
-  const joinRelations = mod.relations.filter(r => r.kind === "has_one" || r.kind === "belongs_to");
-  lines.push(`// LIST`);
-  lines.push(`${toCamelCase(routeBase)}Router.get("/", ${__crudMiddlewares}, async (req: Request, res: Response) => {`);
-  lines.push(`  try {`);
-  lines.push(`    const page = parseInt(req.query.page as string) || 1;`);
-  lines.push(`    const pageSize = Math.min(parseInt(req.query.page_size as string) || 50, 100);`);
-  lines.push(`    const offset = (page - 1) * pageSize;`);
-
-  if (joinRelations.length > 0) {
-    const joinClauses = joinRelations.map(r => {
-      const alias = r.to_table.slice(0, -1);
-      if (r.kind === "belongs_to") {
-        return `LEFT JOIN ${r.to_table} ${alias} ON ${tableName}.${r.foreign_key} = ${alias}.id`;
-      } else {
-        return `LEFT JOIN ${r.to_table} ${alias} ON ${alias}.${r.foreign_key} = ${tableName}.id`;
-      }
-    }).join(" ");
-    lines.push(`    const rows = await query(\`SELECT ${tableName}.*, ${joinRelations.map(r => `row_to_json(${r.to_table.slice(0, -1)}.*) as ${r.name}`).join(", ")} FROM ${tableName} ${joinClauses} ORDER BY ${tableName}.created_at DESC LIMIT $1 OFFSET $2\`, [pageSize, offset]);`);
-  } else {
-    lines.push(`    const rows = await query(\`SELECT * FROM ${tableName} ORDER BY created_at DESC LIMIT $1 OFFSET $2\`, [pageSize, offset]);`);
-  }
-
-  lines.push(`    const [{ count }] = await query(\`SELECT COUNT(*) as count FROM ${tableName}\`);`);
-  lines.push(`    res.json({ items: rows, total: parseInt(count), page, page_size: pageSize });`);
-  lines.push(`  } catch (e: any) {`);
-  lines.push(`    res.status(500).json({ error: { code: "DB_ERROR", message: e.message } });`);
-  lines.push(`  }`);
-  lines.push(`});`);
-  lines.push(``);
-
-  // UPDATE — with state machine enforcement
-  lines.push(`// UPDATE`);
-  lines.push(`${toCamelCase(routeBase)}Router.put("/:id", ${__crudMiddlewares}, async (req: Request, res: Response) => {`);
-  lines.push(`  const fields = { ...req.body };`);
-  if (mod.state_machines.length > 0) {
-    const sm = mod.state_machines[0];
-    lines.push(`  // State machine enforcement`);
-    lines.push(`  if (fields.state !== undefined) {`);
-    lines.push(`    const current = await queryOne<{ state: string }>(\`SELECT state FROM ${tableName} WHERE id = $1\`, [req.params.id]);`);
-    lines.push(`    if (!current) return res.status(404).json({ error: { code: "NOT_FOUND", message: "Not found" } });`);
-    lines.push(`    // Find the trigger for this state transition`);
-    lines.push(`    const trigger = \`\${current.state}_to_\${fields.state}\`;`);
-    lines.push(`    const tr = transition${sm.entity}(current.state as any, trigger);`);
-    lines.push(`    if (!tr.ok) return res.status(422).json({ error: { code: "INVALID_TRANSITION", message: \`Cannot transition from \${current.state} to \${fields.state}\` } });`);
-    lines.push(`  }`);
-  }
-  lines.push(`  const sets = Object.keys(fields).map((k, i) => \`\${k} = $\${i + 2}\`).join(", ");`);
-  lines.push(`  const values = Object.values(fields);`);
-  lines.push(`  const sql = \`UPDATE ${tableName} SET \${sets}, updated_at = NOW() WHERE id = $1 RETURNING *\`;`);
-  lines.push(`  const rows = await query(sql, [req.params.id, ...values]);`);
-  lines.push(`  if (rows.length === 0) return res.status(404).json({ error: { code: "NOT_FOUND", message: "Not found" } });`);
-  lines.push(`  res.json(rows[0]);`);
-  lines.push(`});`);
-  lines.push(``);
-
-  // DELETE
-  lines.push(`// DELETE`);
-  lines.push(`${toCamelCase(routeBase)}Router.delete("/:id", ${__crudMiddlewares}, async (req: Request, res: Response) => {`);
-  lines.push(`  try {`);
-  lines.push(`    const count = await execute(\`DELETE FROM ${tableName} WHERE id = $1\`, [req.params.id]);`);
-  lines.push(`    if (count === 0) return res.status(404).json({ error: { code: "NOT_FOUND", message: "Not found" } });`);
-  lines.push(`    res.status(204).send();`);
-  lines.push(`  } catch (e: any) {`);
-  lines.push(`    res.status(500).json({ error: { code: "DB_ERROR", message: e.message } });`);
-  lines.push(`  }`);
-  lines.push(`});`);
-  lines.push(``);
-
-  // Capability endpoints
-  for (const iface of mod.interfaces) {
-    for (const method of iface.methods) {
-      if (["create", "read", "update", "delete", "list"].includes(method.name)) continue;
-      lines.push(emitCapabilityEndpoint(method, mod, tableName, system));
-    }
-  }
-
-  // has_many relation endpoints: GET /:id/relation-name
-  for (const rel of mod.relations) {
-    if (rel.kind === "has_many") {
-      lines.push(`// RELATION: ${rel.name} (has_many ${rel.to_entity})`);
-      lines.push(`${toCamelCase(routeBase)}Router.get("/:id/${rel.name}", requireAuth, async (req: Request, res: Response) => {`);
-      lines.push(`  try {`);
-      lines.push(`    const page = parseInt(req.query.page as string) || 1;`);
-      lines.push(`    const pageSize = Math.min(parseInt(req.query.page_size as string) || 50, 100);`);
-      lines.push(`    const offset = (page - 1) * pageSize;`);
-      lines.push(`    const rows = await query(\`SELECT * FROM ${rel.to_table} WHERE ${rel.foreign_key} = $1 ORDER BY created_at DESC LIMIT $2 OFFSET $3\`, [req.params.id, pageSize, offset]);`);
-      lines.push(`    const [{ count }] = await query(\`SELECT COUNT(*) as count FROM ${rel.to_table} WHERE ${rel.foreign_key} = $1\`, [req.params.id]);`);
-      lines.push(`    res.json({ items: rows, total: parseInt(count), page, page_size: pageSize });`);
-      lines.push(`  } catch (e: any) {`);
-      lines.push(`    res.status(500).json({ error: { code: "DB_ERROR", message: e.message } });`);
-      lines.push(`  }`);
-      lines.push(`});`);
-      lines.push(``);
-    }
-    if (rel.kind === "many_to_many" && rel.junction_table) {
-      lines.push(`// RELATION: ${rel.name} (many_to_many ${rel.to_entity})`);
-      lines.push(`${toCamelCase(routeBase)}Router.get("/:id/${rel.name}", requireAuth, async (req: Request, res: Response) => {`);
-      lines.push(`  try {`);
-      lines.push(`    const rows = await query(\`SELECT ${rel.to_table}.* FROM ${rel.to_table} INNER JOIN ${rel.junction_table} ON ${rel.junction_table}.${rel.to_table.slice(0, -1)}_id = ${rel.to_table}.id WHERE ${rel.junction_table}.${rel.from_table.slice(0, -1)}_id = $1\`, [req.params.id]);`);
-      lines.push(`    res.json({ items: rows, total: rows.length });`);
-      lines.push(`  } catch (e: any) {`);
-      lines.push(`    res.status(500).json({ error: { code: "DB_ERROR", message: e.message } });`);
-      lines.push(`  }`);
-      lines.push(`});`);
-      lines.push(``);
-    }
-  }
-
-  return lines.join("\n");
-}
-
-function emitCapabilityEndpoint(method: IR.IRMethod, mod: IR.IRModule, tableName: string, system: IR.IRSystem): string {
-  const lines: string[] = [];
-  const routerName = toCamelCase(toSnakeCase(mod.models[0]?.name || mod.name) + "s") + "Router";
-  const endpoint = `/${method.name.replace(/_/g, "-")}`;
-  const isTransactional = method.sync === "transactional";
-
-  lines.push(`// CAPABILITY: ${method.name}${isTransactional ? " [transactional]" : ""}${method.retry ? ` [retry: ${method.retry.max_attempts}x ${method.retry.backoff}]` : ""}`);
-  // Build middleware chain: optional rate limiter + requireAuth + optional audit
-  const capMiddlewares: string[] = ["requireAuth"];
-  if (typeof mod.config["rate_limit"] === "number" && (mod.config["rate_limit"] as number) > 0) {
-    capMiddlewares.unshift("__routeRateLimit");
-  }
-  if (mod.config["audit"]) {
-    capMiddlewares.push(`auditLog("${method.name}", "${mod.models[0]?.name ?? ""}")`);
-  }
-  lines.push(`${routerName}.post("${endpoint}", ${capMiddlewares.join(", ")}, async (req: Request, res: Response) => {`);
-  lines.push(`  const auth: AuthContext = (req as any).auth;`);
-
-  // Wrap in retry logic if declared
-  if (method.retry) {
-    const { max_attempts, backoff, interval_ms } = method.retry;
-    lines.push(`  let __attempt = 0;`);
-    lines.push(`  const __maxAttempts = ${max_attempts};`);
-    lines.push(`  const __intervalMs = ${interval_ms};`);
-    lines.push(`  const __backoff = "${backoff}";`);
-    lines.push(`  while (__attempt < __maxAttempts) {`);
-    lines.push(`    __attempt++;`);
-    lines.push(`    try {`);
-  }
-
-  if (isTransactional) {
-    lines.push(`  const __client = await pool.connect();`);
-    lines.push(`  try {`);
-    lines.push(`    await __client.query("BEGIN");`);
-  } else if (method.sync === "realtime") {
-    lines.push(`  try {`);
-    lines.push(`    // sync: realtime — execute then broadcast to WebSocket channel`);
-  } else if (method.sync === "eventual") {
-    lines.push(`  try {`);
-    lines.push(`    // sync: eventual — effects applied, events queued via outbox`);
-  } else if (method.sync === "batch") {
-    lines.push(`  try {`);
-    lines.push(`    // sync: batch — enqueued for batch processing`);
-    lines.push(`    const { enqueueBatch } = require("../batch");`);
-    lines.push(`    const result = await enqueueBatch("${mod.name}.${method.name}", req.body);`);
-    lines.push(`    res.json({ ok: true, action: "${method.name}", queued: true, result });`);
-    lines.push(`    return;`);
-  } else {
-    lines.push(`  try {`);
-  }
-
-  if (method.pipeline) {
-    const { emitPipelineBody } = require("./emit_composition");
-    lines.push(emitPipelineBody(method, "    "));
-  } else if (method.algorithm) {
-    const { emitAlgorithmBody } = require("./emit_composition");
-    lines.push(emitAlgorithmBody(method, "    "));
-  } else {
-    // Real capability body: compiled preconditions + effects + emissions
-    lines.push(emitCapabilityBody(method, mod, system, "    "));
-  }
-
-  if (isTransactional) {
-    lines.push(`    await __client.query("COMMIT");`);
-    lines.push(`  } catch (e: any) {`);
-    lines.push(`    await __client.query("ROLLBACK");`);
-    lines.push(`    res.status(400).json({ error: { code: "CAPABILITY_FAILED", message: e.message } });`);
-    lines.push(`  } finally {`);
-    lines.push(`    __client.release();`);
-    lines.push(`  }`);
-  } else if (method.sync === "realtime") {
-    lines.push(`    // Broadcast to WebSocket subscribers after successful execution`);
-    lines.push(`    if (typeof broadcastToChannel === "function") {`);
-    lines.push(`      broadcastToChannel("${mod.name}", { type: "${method.name}", payload: req.body, actor: auth.actor_id });`);
-    lines.push(`    }`);
-    lines.push(`  } catch (e: any) {`);
-    lines.push(`    res.status(400).json({ error: { code: "CAPABILITY_FAILED", message: e.message } });`);
-    lines.push(`  }`);
-  } else {
-    lines.push(`  } catch (e: any) {`);
-    lines.push(`    res.status(400).json({ error: { code: "CAPABILITY_FAILED", message: e.message } });`);
-    lines.push(`  }`);
-  }
-
-  if (method.retry) {
-    // Close the retry while loop
-    lines.push(`    } catch (e: any) {`);
-    lines.push(`      if (__attempt >= __maxAttempts) {`);
-    lines.push(`        res.status(503).json({ error: { code: "MAX_RETRIES_EXCEEDED", message: e.message, attempts: __attempt } });`);
-    lines.push(`        return;`);
-    lines.push(`      }`);
-    lines.push(`      const delay = __backoff === "exponential" ? __intervalMs * Math.pow(2, __attempt - 1)`);
-    lines.push(`        : __backoff === "linear" ? __intervalMs * __attempt`);
-    lines.push(`        : __intervalMs;`);
-    lines.push(`      await new Promise(r => setTimeout(r, delay));`);
-    lines.push(`    }`);
-    lines.push(`  } // end retry loop`);
-  }
-
-  lines.push(`});`);
-  lines.push(``);
-  return lines.join("\n");
-}
-
-// ─── State Machine Runtime ────────────────────────────────────────────────────
-
-export function emitStateMachineRuntime(sm: IR.IRStateMachine): string {
-  const lines: string[] = [];
-  const stateUnion = sm.states.map(s => `"${s}"`).join(" | ");
-
-  lines.push(`// Generated by BoneScript compiler. DO NOT EDIT.`);
-  lines.push(``);
-  lines.push(`export type ${sm.entity}State = ${stateUnion};`);
-  lines.push(``);
-  lines.push(`export const ${sm.entity.toUpperCase()}_INITIAL: ${sm.entity}State = "${sm.initial}";`);
-  lines.push(``);
-
-  lines.push(`const TRANSITIONS: Record<${sm.entity}State, Record<string, ${sm.entity}State>> = {`);
-  for (const state of sm.states) {
-    const trans = sm.transitions.filter(t => t.from === state);
-    const entries = trans.map(t => `"${t.trigger}": "${t.to}"`).join(", ");
-    lines.push(`  "${state}": { ${entries} },`);
-  }
-  lines.push(`};`);
-  lines.push(``);
-
-  lines.push(`export function transition${sm.entity}(`);
-  lines.push(`  current: ${sm.entity}State,`);
-  lines.push(`  trigger: string`);
-  lines.push(`): { ok: true; next: ${sm.entity}State } | { ok: false; error: string } {`);
-  lines.push(`  const next = TRANSITIONS[current]?.[trigger];`);
-  lines.push(`  if (!next) return { ok: false, error: \`Invalid transition: \${current} --[\${trigger}]--> ?\` };`);
-  lines.push(`  return { ok: true, next };`);
-  lines.push(`}`);
-  lines.push(``);
-
-  return lines.join("\n");
-}
-
-// ─── Main Entry Point ─────────────────────────────────────────────────────────
-
-export function emitIndex(system: IR.IRSystem): string {
-  const apiModules = system.modules.filter(m => m.kind === "api_service");
-  const hasWebSocket = system.modules.some(m => m.kind === "realtime_service");
-  const lines: string[] = [];
-
-  lines.push(`// Generated by BoneScript compiler. DO NOT EDIT.`);
-  lines.push(`// System: ${system.name}`);
-  lines.push(`require("dotenv").config();`);
-  lines.push(`import express from "express";`);
-  lines.push(`import { createServer } from "http";`);
-  lines.push(`import cors from "cors";`);
-  lines.push(`import helmet from "helmet";`);
-  lines.push(`import rateLimit from "express-rate-limit";`);
-  lines.push(`import { authMiddleware } from "./auth";`);
-  lines.push(`import { healthRouter } from "./health";`);
-  lines.push(`import { logger } from "./logger";`);
-  lines.push(`import { eventBus } from "./events";`);
-  lines.push(`import { pool } from "./db";`);
-
-  // Import batch worker if any batch capabilities exist
-  const hasBatch = system.modules.some(m =>
-    m.interfaces.some(i => i.methods.some(mth => mth.sync === "batch"))
-  );
-  if (hasBatch) {
-    lines.push(`import { startBatchWorker } from "./batch";`);
-    lines.push(`import { startCronJobs } from "./cron";`);
-  }
-  if (hasWebSocket) {
-    lines.push(`import { setupWebSocketServer } from "./websocket";`);
-  }
-  lines.push(``);
-
-  for (const mod of apiModules) {
-    const model = mod.models[0];
-    if (!model) continue;
-    const routerName = toCamelCase(toSnakeCase(model.name) + "s") + "Router";
-    lines.push(`import { ${routerName} } from "./routes/${toSnakeCase(model.name)}";`);
-  }
-
-  lines.push(``);
-  lines.push(`const app = express();`);
-  lines.push(`const httpServer = createServer(app);`);
-  lines.push(`const PORT = parseInt(process.env.PORT || "3000");`);
-  lines.push(``);
-  lines.push(`// Middleware`);
-  lines.push(`app.use(helmet());`);
-  lines.push(`// CORS: restrict to ALLOWED_ORIGINS env var (comma-separated). Defaults to same-origin only.`);
-  lines.push(`const __allowedOrigins = (process.env.ALLOWED_ORIGINS || "").split(",").map(s => s.trim()).filter(Boolean);`);
-  lines.push(`app.use(cors({`);
-  lines.push(`  origin: __allowedOrigins.length > 0`);
-  lines.push(`    ? (origin, cb) => { if (!origin || __allowedOrigins.includes(origin)) cb(null, true); else cb(new Error("Not allowed by CORS")); }`);
-  lines.push(`    : false,`);
-  lines.push(`  credentials: true,`);
-  lines.push(`}));`);
-  lines.push(`app.use(express.json({ limit: "1mb" }));`);
-  lines.push(`app.use(express.urlencoded({ extended: false, limit: "1mb" }));`);
-  lines.push(`app.use(authMiddleware);`);
-
-  const gw = system.modules.find(m => m.kind === "gateway");
-  const rateVal = gw?.config["rate_limit"] || 1000;
-  lines.push(`app.use(rateLimit({ windowMs: 60000, max: ${rateVal} }));`);
-  lines.push(``);
-  // Request timeout middleware
-  lines.push(`// Request timeout (default 30s, override per-route)`);
-  lines.push(`app.use((req: any, res: any, next: any) => {`);
-  lines.push(`  const timeout = parseInt(process.env.REQUEST_TIMEOUT_MS || "30000");`);
-  lines.push(`  const timer = setTimeout(() => {`);
-  lines.push(`    if (!res.headersSent) {`);
-  lines.push(`      res.status(503).json({ error: { code: "REQUEST_TIMEOUT", message: "Request timed out" } });`);
-  lines.push(`    }`);
-  lines.push(`  }, timeout);`);
-  lines.push(`  res.on("finish", () => clearTimeout(timer));`);
-  lines.push(`  next();`);
-  lines.push(`});`);
-  lines.push(``);
-
-  lines.push(`// Health & metrics`);
-  lines.push(`app.use("/health", healthRouter);`);
-  lines.push(``);
-
-  lines.push(`// Routes`);
-  for (const mod of apiModules) {
-    const model = mod.models[0];
-    if (!model) continue;
-    const routerName = toCamelCase(toSnakeCase(model.name) + "s") + "Router";
-    lines.push(`app.use("/${toSnakeCase(model.name)}s", ${routerName});`);
-  }
-  lines.push(``);
-
-  if (hasWebSocket) {
-    lines.push(`// WebSocket`);
-    lines.push(`setupWebSocketServer(httpServer);`);
-    lines.push(``);
-  }
-
-  lines.push(`// Start`);
-  lines.push(`httpServer.listen(PORT, () => {`);
-  lines.push(`  logger.info("server_started", { event: "startup", metadata: { port: PORT } });`);
-  lines.push(`  // Start durable event worker (no-op in in_process mode)`);
-  lines.push(`  eventBus.startWorker(parseInt(process.env.EVENT_WORKER_INTERVAL_MS || "1000"));`);
-  if (hasBatch) {
-    lines.push(`  // Start batch executor`);
-    lines.push(`  startBatchWorker();`);
-    lines.push(`  // Start cron jobs`);
-    lines.push(`  startCronJobs();`);
-  }
-  lines.push(`  console.log(\`[${system.name}] Running on port \${PORT}\`);`);
-  lines.push(`  console.log(\`  HTTP routes:\`);`);
-  for (const mod of apiModules) {
-    const model = mod.models[0];
-    if (!model) continue;
-    lines.push(`  console.log(\`    /${toSnakeCase(model.name)}s\`);`);
-  }
-  if (hasWebSocket) {
-    lines.push(`  console.log(\`  WebSocket: /ws?channel=<name>&token=<jwt>\`);`);
-  }
-  lines.push(`  console.log(\`  Health: /health/live, /health/ready, /health/metrics\`);`);
-  lines.push(`});`);
-  lines.push(``);
-
-  // Graceful shutdown
-  lines.push(`// Graceful shutdown`);
-  lines.push(`const shutdown = async (signal: string) => {`);
-  lines.push(`  logger.info("server_stopping", { event: "shutdown", metadata: { signal } });`);
-  lines.push(`  httpServer.close(async () => {`);
-  lines.push(`    try {`);
-  lines.push(`      await pool.end();`);
-  lines.push(`      logger.info("server_stopped", { event: "shutdown", status: "success" });`);
-  lines.push(`    } catch (e: any) {`);
-  lines.push(`      logger.error("shutdown_error", { event: "shutdown", metadata: { error: e.message } });`);
-  lines.push(`    }`);
-  lines.push(`    process.exit(0);`);
-  lines.push(`  });`);
-  lines.push(`  // Force exit after 10s if connections don't drain`);
-  lines.push(`  setTimeout(() => { logger.error("shutdown_timeout", { event: "shutdown" }); process.exit(1); }, 10000);`);
-  lines.push(`};`);
-  lines.push(`process.on("SIGTERM", () => shutdown("SIGTERM"));`);
-  lines.push(`process.on("SIGINT", () => shutdown("SIGINT"));`);
-  lines.push(``);
-  lines.push(`export { app, httpServer };`);
-
-  return lines.join("\n");
-}
-
-// ─── Migration Script ─────────────────────────────────────────────────────────
-
-export function emitMigration(system: IR.IRSystem, schemas: string[]): string {
-  const lines: string[] = [];
-  lines.push(`// Generated by BoneScript compiler. DO NOT EDIT.`);
-  lines.push(`require("dotenv").config();`);
-  lines.push(`import { pool } from "./db";`);
-  lines.push(``);
-  lines.push(`async function migrate() {`);
-  lines.push(`  console.log("Running migrations...");`);
-  lines.push(`  const client = await pool.connect();`);
-  lines.push(`  try {`);
-
-  for (const schema of schemas) {
-    const escaped = schema.replace(/`/g, "\\`").replace(/\$/g, "\\$");
-    lines.push(`    await client.query(\`${escaped}\`);`);
-  }
-
-  lines.push(`    console.log("Migrations complete.");`);
-  lines.push(`  } finally {`);
-  lines.push(`    client.release();`);
-  lines.push(`    await pool.end();`);
-  lines.push(`  }`);
-  lines.push(`}`);
-  lines.push(``);
-  lines.push(`migrate().catch(e => { console.error(e); process.exit(1); });`);
-
-  return lines.join("\n");
-}
-
-// ─── Unknown Function Collector ───────────────────────────────────────────────
-// Finds function calls in effect expressions that aren't built-ins or known names.
-
-const KNOWN_FUNCTIONS = new Set([
-  "now", "count", "sum", "min", "max", "avg", "length", "size",
-  "shortestPath", "topologicalSort", "binarySearch", "bipartiteMatching",
-  "roundRobin", "weightedAverage", "percentile", "rankBy", "consistentHash",
-]);
-
-function collectUnknownFunctions(mod: IR.IRModule): Set<string> {
-  const found = new Set<string>();
-  for (const iface of mod.interfaces) {
-    for (const method of iface.methods) {
-      for (const effect of method.effects) {
-        extractFunctionCalls(effect.value, found);
-      }
-      for (const pre of method.preconditions) {
-        extractFunctionCalls(pre.expression, found);
-      }
-    }
-  }
-  return found;
-}
-
-function extractFunctionCalls(expr: string, found: Set<string>): void {
-  const pattern = /\b([a-zA-Z_]\w*)\s*\(/g;
-  let match: RegExpExecArray | null;
-  while ((match = pattern.exec(expr)) !== null) {
-    const name = match[1];
-    if (!KNOWN_FUNCTIONS.has(name)) {
-      found.add(name);
-    }
-  }
-}
+/**
+ * BoneScript Runtime Code Emitter
+ * Generates runnable service code from IR.
+ */
+
+import * as IR from "./ir";
+import { createHash } from "crypto";
+import { emitCapabilityBody } from "./emit_capability";
+
+function toSnakeCase(s: string): string {
+  return s.replace(/([a-z])([A-Z])/g, "$1_$2").toLowerCase();
+}
+
+function toCamelCase(s: string): string {
+  return s.replace(/_([a-z])/g, (_, c) => c.toUpperCase());
+}
+
+function toPascalCase(s: string): string {
+  const c = toCamelCase(s);
+  return c.charAt(0).toUpperCase() + c.slice(1);
+}
+
+const TS_TYPE_MAP: Record<string, string> = {
+  string: "string", uint: "number", int: "number", float: "number",
+  bool: "boolean", timestamp: "Date", uuid: "string", bytes: "Buffer", json: "unknown",
+};
+
+function toTsType(irType: string): string {
+  if (TS_TYPE_MAP[irType]) return TS_TYPE_MAP[irType];
+  const m = irType.match(/^(list|set)<(.+)>$/);
+  if (m) return `${toTsType(m[2])}[]`;
+  const om = irType.match(/^optional<(.+)>$/);
+  if (om) return `${toTsType(om[1])} | null`;
+  return irType;
+}
+
+// ─── Package.json ─────────────────────────────────────────────────────────────
+
+export function emitPackageJson(system: IR.IRSystem): string {
+  const pkg = {
+    name: toSnakeCase(system.name),
+    version: system.version,
+    private: true,
+    scripts: {
+      build: "tsc",
+      start: "node dist/index.js",
+      dev: "ts-node src/index.ts",
+      migrate: "ts-node src/migrate.ts",
+    },
+    dependencies: {
+      // Pinned to specific patch versions. Update consciously — a bump should
+      // be paired with a quick read of the release notes / advisories.
+      express: "4.22.2",          // 4.22.x patches qs / path-to-regexp DoS
+      pg: "8.13.1",
+      ioredis: "5.4.1",
+      ws: "8.18.0",               // 8.17.1 patched CVE-2024-37890 (DoS)
+      uuid: "10.0.0",
+      cors: "2.8.5",
+      helmet: "8.0.0",
+      "express-rate-limit": "7.5.0",
+      jsonwebtoken: "9.0.2",
+      dotenv: "16.4.7",
+      "node-cron": "3.0.3",
+      zod: "3.23.8",
+    },
+    devDependencies: {
+      "@types/express": "4.17.21",
+      "@types/node": "20.14.0",
+      "@types/pg": "8.11.10",
+      "@types/ws": "8.5.13",
+      "@types/cors": "2.8.17",
+      "@types/jsonwebtoken": "9.0.7",
+      "@types/uuid": "10.0.0",
+      "@types/node-cron": "3.0.11",
+      typescript: "5.6.3",
+      "ts-node": "10.9.2",
+    },
+  };
+  return JSON.stringify(pkg, null, 2);
+}
+
+// ─── tsconfig.json ────────────────────────────────────────────────────────────
+
+export function emitTsConfig(): string {
+  const cfg = {
+    compilerOptions: {
+      target: "ES2020",
+      module: "commonjs",
+      // ES2020 + DOM gives us the built-in fetch types (Node 18+ ships a
+      // WHATWG-compatible fetch; DOM provides the matching type declarations).
+      lib: ["ES2020", "DOM"],
+      outDir: "./dist",
+      rootDir: "./src",
+      strict: true,
+      esModuleInterop: true,
+      skipLibCheck: true,
+      forceConsistentCasingInFileNames: true,
+      declaration: true,
+      sourceMap: true,
+    },
+    include: ["src/**/*"],
+    exclude: ["node_modules", "dist"],
+  };
+  return JSON.stringify(cfg, null, 2);
+}
+
+// ─── Database Client ──────────────────────────────────────────────────────────
+
+export function emitDbClient(system: IR.IRSystem): string {
+  const name = toSnakeCase(system.name);
+  return [
+    "// Generated by BoneScript compiler. DO NOT EDIT.",
+    "import { Pool, PoolClient } from \"pg\";",
+    "",
+    "// Lazy pool — created on first use so DATABASE_URL is read after dotenv loads",
+    "let _pool: Pool | null = null;",
+    "function getPool(): Pool {",
+    "  if (!_pool) {",
+    `  _pool = new Pool({ connectionString: process.env.DATABASE_URL || "postgresql://localhost:5432/${name}", max: 20 });`,
+    "  _pool.on(\"error\", (err: Error) => console.error(\"[DB] Pool error (non-fatal):\", err.message));",
+    "  }",
+    "  return _pool;",
+    "}",
+    "export const pool = new Proxy({} as Pool, { get(_t: any, p: any) { return (getPool() as any)[p]; } });",
+    "",
+    "export async function query<T = any>(text: string, params?: any[]): Promise<T[]> {",
+    "  try { const result = await pool.query(text, params); return result.rows as T[]; }",
+    "  catch (e: any) { throw new Error(`DB query failed: ${e.message}`); }",
+    "}",
+    "export async function queryOne<T = any>(text: string, params?: any[]): Promise<T | null> {",
+    "  try { const rows = await query<T>(text, params); return rows[0] || null; }",
+    "  catch (e: any) { throw new Error(`DB query failed: ${e.message}`); }",
+    "}",
+    "export async function execute(text: string, params?: any[]): Promise<number> {",
+    "  try { const result = await pool.query(text, params); return result.rowCount || 0; }",
+    "  catch (e: any) { throw new Error(`DB execute failed: ${e.message}`); }",
+    "}",
+    "export async function transaction<T>(fn: (client: PoolClient) => Promise<T>): Promise<T> {",
+    "  const client = await pool.connect();",
+    "  try { await client.query(\"BEGIN\"); const result = await fn(client); await client.query(\"COMMIT\"); return result; }",
+    "  catch (e) { await client.query(\"ROLLBACK\"); throw e; }",
+    "  finally { client.release(); }",
+    "}",
+  ].join("\n");
+}
+
+
+export function emitAuthMiddleware(system: IR.IRSystem): string {
+  return `// Generated by BoneScript compiler. DO NOT EDIT.
+import { Request, Response, NextFunction } from "express";
+import jwt from "jsonwebtoken";
+import { v4 as uuid } from "uuid";
+
+// JWT_SECRET must be set in production. The server will refuse to start without it
+// when NODE_ENV is "production" to prevent accidental use of a weak fallback.
+const JWT_SECRET = (() => {
+  const secret = process.env.JWT_SECRET;
+  if (!secret) {
+    if (process.env.NODE_ENV === "production") {
+      console.error("[FATAL] JWT_SECRET environment variable is not set. Refusing to start in production.");
+      process.exit(1);
+    }
+    console.warn("[WARN] JWT_SECRET is not set. Using insecure default — do not use in production.");
+    return "bonescript-dev-secret-do-not-use-in-production";
+  }
+  if (secret.length < 32) {
+    console.warn("[WARN] JWT_SECRET is shorter than 32 characters. Use a longer secret in production.");
+  }
+  return secret;
+})();
+
+export interface AuthContext {
+  authenticated: boolean;
+  actor_id: string | null;
+  trace_id: string;
+}
+
+// Trace IDs are server-generated. We accept a client-supplied X-Trace-Id only
+// if it parses as a UUID, so callers can correlate their own logs without
+// being able to forge correlation IDs in audit / event records.
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+function resolveTraceId(req: Request): string {
+  const supplied = req.headers["x-trace-id"];
+  if (typeof supplied === "string" && UUID_RE.test(supplied)) return supplied;
+  return uuid();
+}
+
+export function authMiddleware(req: Request, res: Response, next: NextFunction): void {
+  const header = req.headers.authorization;
+  const traceId = resolveTraceId(req);
+  if (!header || !header.startsWith("Bearer ")) {
+    (req as any).auth = { authenticated: false, actor_id: null, trace_id: traceId };
+    next();
+    return;
+  }
+  try {
+    const token = header.slice(7);
+    // Pin algorithms to HS256 and require an expiration. Without pinning,
+    // jsonwebtoken would accept any algorithm including RS/HS confusion attacks.
+    // maxAge is a safety net even if exp is set far in the future.
+    const decoded = jwt.verify(token, JWT_SECRET, {
+      algorithms: ["HS256"],
+      maxAge: process.env.JWT_MAX_AGE || "1h",
+    }) as { sub?: unknown };
+    if (typeof decoded.sub !== "string" || decoded.sub.length === 0) {
+      (req as any).auth = { authenticated: false, actor_id: null, trace_id: traceId };
+      next();
+      return;
+    }
+    (req as any).auth = {
+      authenticated: true,
+      actor_id: decoded.sub,
+      trace_id: traceId,
+    };
+  } catch {
+    (req as any).auth = { authenticated: false, actor_id: null, trace_id: traceId };
+  }
+  next();
+}
+
+export function requireAuth(req: Request, res: Response, next: NextFunction): void {
+  const auth: AuthContext = (req as any).auth;
+  if (!auth || !auth.authenticated) {
+    res.status(401).json({ error: { code: "UNAUTHORIZED", message: "Authentication required" } });
+    return;
+  }
+  next();
+}
+`;
+}
+
+// ─── Entity Router ────────────────────────────────────────────────────────────
+
+export function emitEntityRouter(mod: IR.IRModule, system: IR.IRSystem): string {
+  const entityModel = mod.models[0];
+  if (!entityModel) return "";
+
+  const tableName = toSnakeCase(entityModel.name) + "s";
+  const routeBase = toSnakeCase(entityModel.name) + "s";
+  const lines: string[] = [];
+
+  lines.push(`// Generated by BoneScript compiler. DO NOT EDIT.`);
+  lines.push(`// Service: ${mod.name}`);
+  lines.push(`import { Router, Request, Response } from "express";`);
+  lines.push(`import { v4 as uuid } from "uuid";`);
+  lines.push(`import { query, queryOne, execute, pool } from "../db";`);
+  lines.push(`import { eventBus } from "../events";`);
+  lines.push(`import { requireAuth, AuthContext } from "../auth";`);
+  lines.push(`import rateLimit from "express-rate-limit";`);
+  // Only import audit if module has audit: true
+  if (mod.config["audit"]) {
+    lines.push(`import { auditLog } from "../audit";`);
+  }
+  lines.push(`import { logger } from "../logger";`);
+  lines.push(`import { counter } from "../metrics";`);
+  // Zod schemas for input validation. The Create / Update derivatives are
+  // generated alongside the full model schema in src/schemas.ts.
+  lines.push(`import { ${toPascalCase(entityModel.name)}CreateSchema, ${toPascalCase(entityModel.name)}UpdateSchema } from "../schemas";`);
+  lines.push(`import * as __algorithms from "../algorithms";`);
+  lines.push(`const { shortestPath, topologicalSort, binarySearch, bipartiteMatching, roundRobin, weightedAverage, percentile, rankBy, consistentHash } = __algorithms as any;`);
+  lines.push(``);
+
+  // Collect unknown function calls from capability effects and emit stubs
+  const unknownFunctions = collectUnknownFunctions(mod);
+  if (unknownFunctions.size > 0) {
+    lines.push(`// User-defined functions referenced in effects — implement these or use extension_point`);
+    for (const fn of unknownFunctions) {
+      lines.push(`declare function ${fn}(...args: any[]): any;`);
+    }
+    lines.push(``);
+  }
+
+  if (mod.state_machines.length > 0) {
+    const sm = mod.state_machines[0];
+    lines.push(`import { transition${sm.entity}, ${sm.entity.toUpperCase()}_INITIAL } from "../state_machines/${toSnakeCase(sm.entity)}";`);
+    lines.push(``);
+  }
+
+  lines.push(`export const ${toCamelCase(routeBase)}Router = Router();`);
+  lines.push(``);
+
+  // Per-module rate limiter (from policy declaration)
+  const modRateLimit = typeof mod.config["rate_limit"] === "number" && (mod.config["rate_limit"] as number) > 0
+    ? mod.config["rate_limit"] as number : 0;
+  const modRateLimitWindowMs = typeof mod.config["rate_limit_window_ms"] === "number"
+    ? mod.config["rate_limit_window_ms"] as number : 60000;
+  if (modRateLimit > 0) {
+    lines.push(`// Rate limiter from policy declaration`);
+    lines.push(`const __routeRateLimit = rateLimit({ windowMs: ${modRateLimitWindowMs}, max: ${modRateLimit}, standardHeaders: true, legacyHeaders: false });`);
+    lines.push(``);
+  }
+
+  // CREATE
+  const insertFields = entityModel.fields.filter(f => f.name !== "id" && f.name !== "created_at" && f.name !== "updated_at");
+  lines.push(`// CREATE`);
+  const __crudMiddlewares = modRateLimit > 0 ? "__routeRateLimit, requireAuth" : "requireAuth";
+  lines.push(`${toCamelCase(routeBase)}Router.post("/", ${__crudMiddlewares}, async (req: Request, res: Response) => {`);
+  lines.push(`  // Validate the request body against the generated Zod schema.`);
+  lines.push(`  const __parsed = ${toPascalCase(entityModel.name)}CreateSchema.safeParse(req.body);`);
+  lines.push(`  if (!__parsed.success) {`);
+  lines.push(`    return res.status(400).json({ error: { code: "VALIDATION_FAILED", message: "Invalid request body", issues: __parsed.error.flatten() } });`);
+  lines.push(`  }`);
+  lines.push(`  const __body = __parsed.data;`);
+  lines.push(`  try {`);
+  lines.push(`    const id = uuid();`);
+  lines.push(`    const { ${insertFields.map(f => f.name).join(", ")} } = __body as any;`);
+  if (mod.state_machines.length > 0) {
+    lines.push(`    const state = ${mod.state_machines[0].entity.toUpperCase()}_INITIAL;`);
+  }
+  const allInsertFields = ["id", ...insertFields.map(f => f.name)];
+  if (mod.state_machines.length > 0 && !insertFields.find(f => f.name === "state")) {
+    allInsertFields.push("state");
+  }
+  const placeholders = allInsertFields.map((_, i) => `$${i + 1}`).join(", ");
+  const values = allInsertFields.map(f => f === "id" ? "id" : f === "state" ? "state" : f).join(", ");
+  lines.push(`    const sql = \`INSERT INTO ${tableName} (${allInsertFields.join(", ")}) VALUES (${placeholders}) RETURNING *\`;`);
+  lines.push(`    const rows = await query(sql, [${values}]);`);
+  lines.push(`    counter("entity.created", { entity: "${entityModel.name}" });`);
+  lines.push(`    res.status(201).json(rows[0]);`);
+  lines.push(`  } catch (e: any) {`);
+  lines.push(`    res.status(400).json({ error: { code: "CREATE_FAILED", message: e.message } });`);
+  lines.push(`  }`);
+  lines.push(`});`);
+  lines.push(``);
+
+  // READ
+  lines.push(`// READ`);
+  lines.push(`${toCamelCase(routeBase)}Router.get("/:id", ${__crudMiddlewares}, async (req: Request, res: Response) => {`);
+  lines.push(`  try {`);
+  lines.push(`    const row = await queryOne(\`SELECT * FROM ${tableName} WHERE id = $1\`, [req.params.id]);`);
+  lines.push(`    if (!row) return res.status(404).json({ error: { code: "NOT_FOUND", message: "Not found" } });`);
+  lines.push(`    res.json(row);`);
+  lines.push(`  } catch (e: any) {`);
+  lines.push(`    res.status(500).json({ error: { code: "DB_ERROR", message: e.message } });`);
+  lines.push(`  }`);
+  lines.push(`});`);
+  lines.push(``);
+
+  // LIST — with optional JOINs for has_one/belongs_to relations
+  const joinRelations = mod.relations.filter(r => r.kind === "has_one" || r.kind === "belongs_to");
+  lines.push(`// LIST`);
+  lines.push(`${toCamelCase(routeBase)}Router.get("/", ${__crudMiddlewares}, async (req: Request, res: Response) => {`);
+  lines.push(`  try {`);
+  lines.push(`    const page = parseInt(req.query.page as string) || 1;`);
+  lines.push(`    const pageSize = Math.min(parseInt(req.query.page_size as string) || 50, 100);`);
+  lines.push(`    const offset = (page - 1) * pageSize;`);
+
+  if (joinRelations.length > 0) {
+    const joinClauses = joinRelations.map(r => {
+      const alias = r.to_table.slice(0, -1);
+      if (r.kind === "belongs_to") {
+        return `LEFT JOIN ${r.to_table} ${alias} ON ${tableName}.${r.foreign_key} = ${alias}.id`;
+      } else {
+        return `LEFT JOIN ${r.to_table} ${alias} ON ${alias}.${r.foreign_key} = ${tableName}.id`;
+      }
+    }).join(" ");
+    lines.push(`    const rows = await query(\`SELECT ${tableName}.*, ${joinRelations.map(r => `row_to_json(${r.to_table.slice(0, -1)}.*) as ${r.name}`).join(", ")} FROM ${tableName} ${joinClauses} ORDER BY ${tableName}.created_at DESC LIMIT $1 OFFSET $2\`, [pageSize, offset]);`);
+  } else {
+    lines.push(`    const rows = await query(\`SELECT * FROM ${tableName} ORDER BY created_at DESC LIMIT $1 OFFSET $2\`, [pageSize, offset]);`);
+  }
+
+  lines.push(`    const [{ count }] = await query(\`SELECT COUNT(*) as count FROM ${tableName}\`);`);
+  lines.push(`    res.json({ items: rows, total: parseInt(count), page, page_size: pageSize });`);
+  lines.push(`  } catch (e: any) {`);
+  lines.push(`    res.status(500).json({ error: { code: "DB_ERROR", message: e.message } });`);
+  lines.push(`  }`);
+  lines.push(`});`);
+  lines.push(``);
+
+  // UPDATE — with state machine enforcement and column allow-list
+  // The allow-list is derived from the IR model so generated SQL never
+  // interpolates user-supplied keys as identifiers.
+  const updatableColumns = entityModel.fields
+    .filter(f => !["id", "created_at", "updated_at"].includes(f.name))
+    .map(f => f.name);
+  // Entities with a state machine carry a `state` column not present in the
+  // IR field list. Include it so PUT can drive transitions.
+  if (mod.state_machines.length > 0 && !updatableColumns.includes("state")) {
+    updatableColumns.push("state");
+  }
+  lines.push(`// UPDATE`);
+  lines.push(`const __${toCamelCase(routeBase)}Updatable = new Set<string>(${JSON.stringify(updatableColumns)});`);
+  lines.push(`${toCamelCase(routeBase)}Router.put("/:id", ${__crudMiddlewares}, async (req: Request, res: Response) => {`);
+  lines.push(`  // 1. Validate body shape and types via Zod (UpdateSchema is partial).`);
+  lines.push(`  const __parsed = ${toPascalCase(entityModel.name)}UpdateSchema.safeParse(req.body);`);
+  lines.push(`  if (!__parsed.success) {`);
+  lines.push(`    return res.status(400).json({ error: { code: "VALIDATION_FAILED", message: "Invalid request body", issues: __parsed.error.flatten() } });`);
+  lines.push(`  }`);
+  lines.push(`  // 2. Reject unknown columns (defense in depth — Zod would already strip them).`);
+  lines.push(`  const __unknown = Object.keys(req.body || {}).filter(k => !__${toCamelCase(routeBase)}Updatable.has(k));`);
+  lines.push(`  if (__unknown.length > 0) {`);
+  lines.push(`    return res.status(400).json({ error: { code: "UNKNOWN_FIELDS", message: \`Unknown fields: \${__unknown.join(", ")}\`, fields: __unknown } });`);
+  lines.push(`  }`);
+  lines.push(`  // 3. Use the Zod-parsed object as the update set.`);
+  lines.push(`  const fields: Record<string, unknown> = __parsed.data as Record<string, unknown>;`);
+  lines.push(`  if (Object.keys(fields).length === 0) {`);
+  lines.push(`    return res.status(400).json({ error: { code: "NO_FIELDS", message: "No updatable fields supplied" } });`);
+  lines.push(`  }`);
+  if (mod.state_machines.length > 0) {
+    const sm = mod.state_machines[0];
+    lines.push(`  // State machine enforcement`);
+    lines.push(`  if (fields.state !== undefined) {`);
+    lines.push(`    const current = await queryOne<{ state: string }>(\`SELECT state FROM ${tableName} WHERE id = $1\`, [req.params.id]);`);
+    lines.push(`    if (!current) return res.status(404).json({ error: { code: "NOT_FOUND", message: "Not found" } });`);
+    lines.push(`    // Find the trigger for this state transition`);
+    lines.push(`    const trigger = \`\${current.state}_to_\${fields.state}\`;`);
+    lines.push(`    const tr = transition${sm.entity}(current.state as any, trigger);`);
+    lines.push(`    if (!tr.ok) return res.status(422).json({ error: { code: "INVALID_TRANSITION", message: \`Cannot transition from \${current.state} to \${fields.state}\` } });`);
+    lines.push(`  }`);
+  }
+  lines.push(`  const keys = Object.keys(fields);`);
+  lines.push(`  const sets = keys.map((k, i) => \`\${k} = $\${i + 2}\`).join(", ");`);
+  lines.push(`  const values = keys.map(k => fields[k]);`);
+  lines.push(`  const sql = \`UPDATE ${tableName} SET \${sets}, updated_at = NOW() WHERE id = $1 RETURNING *\`;`);
+  lines.push(`  const rows = await query(sql, [req.params.id, ...values]);`);
+  lines.push(`  if (rows.length === 0) return res.status(404).json({ error: { code: "NOT_FOUND", message: "Not found" } });`);
+  lines.push(`  res.json(rows[0]);`);
+  lines.push(`});`);
+  lines.push(``);
+
+  // DELETE
+  lines.push(`// DELETE`);
+  lines.push(`${toCamelCase(routeBase)}Router.delete("/:id", ${__crudMiddlewares}, async (req: Request, res: Response) => {`);
+  lines.push(`  try {`);
+  lines.push(`    const count = await execute(\`DELETE FROM ${tableName} WHERE id = $1\`, [req.params.id]);`);
+  lines.push(`    if (count === 0) return res.status(404).json({ error: { code: "NOT_FOUND", message: "Not found" } });`);
+  lines.push(`    res.status(204).send();`);
+  lines.push(`  } catch (e: any) {`);
+  lines.push(`    res.status(500).json({ error: { code: "DB_ERROR", message: e.message } });`);
+  lines.push(`  }`);
+  lines.push(`});`);
+  lines.push(``);
+
+  // Capability endpoints
+  for (const iface of mod.interfaces) {
+    for (const method of iface.methods) {
+      if (["create", "read", "update", "delete", "list"].includes(method.name)) continue;
+      lines.push(emitCapabilityEndpoint(method, mod, tableName, system));
+    }
+  }
+
+  // has_many relation endpoints: GET /:id/relation-name
+  for (const rel of mod.relations) {
+    if (rel.kind === "has_many") {
+      lines.push(`// RELATION: ${rel.name} (has_many ${rel.to_entity})`);
+      lines.push(`${toCamelCase(routeBase)}Router.get("/:id/${rel.name}", requireAuth, async (req: Request, res: Response) => {`);
+      lines.push(`  try {`);
+      lines.push(`    const page = parseInt(req.query.page as string) || 1;`);
+      lines.push(`    const pageSize = Math.min(parseInt(req.query.page_size as string) || 50, 100);`);
+      lines.push(`    const offset = (page - 1) * pageSize;`);
+      lines.push(`    const rows = await query(\`SELECT * FROM ${rel.to_table} WHERE ${rel.foreign_key} = $1 ORDER BY created_at DESC LIMIT $2 OFFSET $3\`, [req.params.id, pageSize, offset]);`);
+      lines.push(`    const [{ count }] = await query(\`SELECT COUNT(*) as count FROM ${rel.to_table} WHERE ${rel.foreign_key} = $1\`, [req.params.id]);`);
+      lines.push(`    res.json({ items: rows, total: parseInt(count), page, page_size: pageSize });`);
+      lines.push(`  } catch (e: any) {`);
+      lines.push(`    res.status(500).json({ error: { code: "DB_ERROR", message: e.message } });`);
+      lines.push(`  }`);
+      lines.push(`});`);
+      lines.push(``);
+    }
+    if (rel.kind === "many_to_many" && rel.junction_table) {
+      lines.push(`// RELATION: ${rel.name} (many_to_many ${rel.to_entity})`);
+      lines.push(`${toCamelCase(routeBase)}Router.get("/:id/${rel.name}", requireAuth, async (req: Request, res: Response) => {`);
+      lines.push(`  try {`);
+      lines.push(`    const rows = await query(\`SELECT ${rel.to_table}.* FROM ${rel.to_table} INNER JOIN ${rel.junction_table} ON ${rel.junction_table}.${rel.to_table.slice(0, -1)}_id = ${rel.to_table}.id WHERE ${rel.junction_table}.${rel.from_table.slice(0, -1)}_id = $1\`, [req.params.id]);`);
+      lines.push(`    res.json({ items: rows, total: rows.length });`);
+      lines.push(`  } catch (e: any) {`);
+      lines.push(`    res.status(500).json({ error: { code: "DB_ERROR", message: e.message } });`);
+      lines.push(`  }`);
+      lines.push(`});`);
+      lines.push(``);
+    }
+  }
+
+  return lines.join("\n");
+}
+
+function emitCapabilityEndpoint(method: IR.IRMethod, mod: IR.IRModule, tableName: string, system: IR.IRSystem): string {
+  const lines: string[] = [];
+  const routerName = toCamelCase(toSnakeCase(mod.models[0]?.name || mod.name) + "s") + "Router";
+  const endpoint = `/${method.name.replace(/_/g, "-")}`;
+  const isTransactional = method.sync === "transactional";
+
+  lines.push(`// CAPABILITY: ${method.name}${isTransactional ? " [transactional]" : ""}${method.retry ? ` [retry: ${method.retry.max_attempts}x ${method.retry.backoff}]` : ""}`);
+  // Build middleware chain: optional rate limiter + requireAuth + optional audit
+  const capMiddlewares: string[] = ["requireAuth"];
+  if (typeof mod.config["rate_limit"] === "number" && (mod.config["rate_limit"] as number) > 0) {
+    capMiddlewares.unshift("__routeRateLimit");
+  }
+  if (mod.config["audit"]) {
+    capMiddlewares.push(`auditLog("${method.name}", "${mod.models[0]?.name ?? ""}")`);
+  }
+  lines.push(`${routerName}.post("${endpoint}", ${capMiddlewares.join(", ")}, async (req: Request, res: Response) => {`);
+  lines.push(`  const auth: AuthContext = (req as any).auth;`);
+
+  // Wrap in retry logic if declared
+  if (method.retry) {
+    const { max_attempts, backoff, interval_ms } = method.retry;
+    lines.push(`  let __attempt = 0;`);
+    lines.push(`  const __maxAttempts = ${max_attempts};`);
+    lines.push(`  const __intervalMs = ${interval_ms};`);
+    lines.push(`  const __backoff = "${backoff}";`);
+    lines.push(`  while (__attempt < __maxAttempts) {`);
+    lines.push(`    __attempt++;`);
+    lines.push(`    try {`);
+  }
+
+  if (isTransactional) {
+    lines.push(`  const __client = await pool.connect();`);
+    lines.push(`  try {`);
+    lines.push(`    await __client.query("BEGIN");`);
+  } else if (method.sync === "realtime") {
+    lines.push(`  try {`);
+    lines.push(`    // sync: realtime — execute then broadcast to WebSocket channel`);
+  } else if (method.sync === "eventual") {
+    lines.push(`  try {`);
+    lines.push(`    // sync: eventual — effects applied, events queued via outbox`);
+  } else if (method.sync === "batch") {
+    lines.push(`  try {`);
+    lines.push(`    // sync: batch — enqueued for batch processing`);
+    lines.push(`    const { enqueueBatch } = require("../batch");`);
+    lines.push(`    const result = await enqueueBatch("${mod.name}.${method.name}", req.body);`);
+    lines.push(`    res.json({ ok: true, action: "${method.name}", queued: true, result });`);
+    lines.push(`    return;`);
+  } else {
+    lines.push(`  try {`);
+  }
+
+  if (method.pipeline) {
+    const { emitPipelineBody } = require("./emit_composition");
+    lines.push(emitPipelineBody(method, "    "));
+  } else if (method.algorithm) {
+    const { emitAlgorithmBody } = require("./emit_composition");
+    lines.push(emitAlgorithmBody(method, "    "));
+  } else {
+    // Real capability body: compiled preconditions + effects + emissions
+    lines.push(emitCapabilityBody(method, mod, system, "    "));
+  }
+
+  if (isTransactional) {
+    lines.push(`    await __client.query("COMMIT");`);
+    lines.push(`  } catch (e: any) {`);
+    lines.push(`    await __client.query("ROLLBACK");`);
+    lines.push(`    res.status(400).json({ error: { code: "CAPABILITY_FAILED", message: e.message } });`);
+    lines.push(`  } finally {`);
+    lines.push(`    __client.release();`);
+    lines.push(`  }`);
+  } else if (method.sync === "realtime") {
+    lines.push(`    // Broadcast to WebSocket subscribers after successful execution`);
+    lines.push(`    if (typeof broadcastToChannel === "function") {`);
+    lines.push(`      broadcastToChannel("${mod.name}", { type: "${method.name}", payload: req.body, actor: auth.actor_id });`);
+    lines.push(`    }`);
+    lines.push(`  } catch (e: any) {`);
+    lines.push(`    res.status(400).json({ error: { code: "CAPABILITY_FAILED", message: e.message } });`);
+    lines.push(`  }`);
+  } else {
+    lines.push(`  } catch (e: any) {`);
+    lines.push(`    res.status(400).json({ error: { code: "CAPABILITY_FAILED", message: e.message } });`);
+    lines.push(`  }`);
+  }
+
+  if (method.retry) {
+    // Close the retry while loop
+    lines.push(`    } catch (e: any) {`);
+    lines.push(`      if (__attempt >= __maxAttempts) {`);
+    lines.push(`        res.status(503).json({ error: { code: "MAX_RETRIES_EXCEEDED", message: e.message, attempts: __attempt } });`);
+    lines.push(`        return;`);
+    lines.push(`      }`);
+    lines.push(`      const delay = __backoff === "exponential" ? __intervalMs * Math.pow(2, __attempt - 1)`);
+    lines.push(`        : __backoff === "linear" ? __intervalMs * __attempt`);
+    lines.push(`        : __intervalMs;`);
+    lines.push(`      await new Promise(r => setTimeout(r, delay));`);
+    lines.push(`    }`);
+    lines.push(`  } // end retry loop`);
+  }
+
+  lines.push(`});`);
+  lines.push(``);
+  return lines.join("\n");
+}
+
+// ─── State Machine Runtime ────────────────────────────────────────────────────
+
+export function emitStateMachineRuntime(sm: IR.IRStateMachine): string {
+  const lines: string[] = [];
+  const stateUnion = sm.states.map(s => `"${s}"`).join(" | ");
+
+  lines.push(`// Generated by BoneScript compiler. DO NOT EDIT.`);
+  lines.push(``);
+  lines.push(`export type ${sm.entity}State = ${stateUnion};`);
+  lines.push(``);
+  lines.push(`export const ${sm.entity.toUpperCase()}_INITIAL: ${sm.entity}State = "${sm.initial}";`);
+  lines.push(``);
+
+  lines.push(`const TRANSITIONS: Record<${sm.entity}State, Record<string, ${sm.entity}State>> = {`);
+  for (const state of sm.states) {
+    const trans = sm.transitions.filter(t => t.from === state);
+    const entries = trans.map(t => `"${t.trigger}": "${t.to}"`).join(", ");
+    lines.push(`  "${state}": { ${entries} },`);
+  }
+  lines.push(`};`);
+  lines.push(``);
+
+  lines.push(`export function transition${sm.entity}(`);
+  lines.push(`  current: ${sm.entity}State,`);
+  lines.push(`  trigger: string`);
+  lines.push(`): { ok: true; next: ${sm.entity}State } | { ok: false; error: string } {`);
+  lines.push(`  const next = TRANSITIONS[current]?.[trigger];`);
+  lines.push(`  if (!next) return { ok: false, error: \`Invalid transition: \${current} --[\${trigger}]--> ?\` };`);
+  lines.push(`  return { ok: true, next };`);
+  lines.push(`}`);
+  lines.push(``);
+
+  return lines.join("\n");
+}
+
+// ─── Main Entry Point ─────────────────────────────────────────────────────────
+
+export function emitIndex(system: IR.IRSystem): string {
+  const apiModules = system.modules.filter(m => m.kind === "api_service");
+  const hasWebSocket = system.modules.some(m => m.kind === "realtime_service");
+  const lines: string[] = [];
+
+  lines.push(`// Generated by BoneScript compiler. DO NOT EDIT.`);
+  lines.push(`// System: ${system.name}`);
+  lines.push(`require("dotenv").config();`);
+  lines.push(`import express from "express";`);
+  lines.push(`import { createServer } from "http";`);
+  lines.push(`import cors from "cors";`);
+  lines.push(`import helmet from "helmet";`);
+  lines.push(`import rateLimit from "express-rate-limit";`);
+  lines.push(`import { authMiddleware } from "./auth";`);
+  lines.push(`import { healthRouter } from "./health";`);
+  lines.push(`import { logger } from "./logger";`);
+  lines.push(`import { eventBus } from "./events";`);
+  lines.push(`import { pool } from "./db";`);
+
+  // Import batch worker if any batch capabilities exist
+  const hasBatch = system.modules.some(m =>
+    m.interfaces.some(i => i.methods.some(mth => mth.sync === "batch"))
+  );
+  if (hasBatch) {
+    lines.push(`import { startBatchWorker } from "./batch";`);
+    lines.push(`import { startCronJobs } from "./cron";`);
+  }
+  if (hasWebSocket) {
+    lines.push(`import { setupWebSocketServer } from "./websocket";`);
+  }
+  lines.push(``);
+
+  for (const mod of apiModules) {
+    const model = mod.models[0];
+    if (!model) continue;
+    const routerName = toCamelCase(toSnakeCase(model.name) + "s") + "Router";
+    lines.push(`import { ${routerName} } from "./routes/${toSnakeCase(model.name)}";`);
+  }
+
+  lines.push(``);
+  lines.push(`const app = express();`);
+  lines.push(`const httpServer = createServer(app);`);
+  lines.push(`const PORT = parseInt(process.env.PORT || "3000");`);
+  lines.push(``);
+  lines.push(`// Trust the immediate hop's X-Forwarded-* headers when running behind a`);
+  lines.push(`// load balancer / k8s ingress. Override with TRUST_PROXY=<n> for multi-hop`);
+  lines.push(`// (e.g. "2" for ingress + service mesh). Set to "false" to disable.`);
+  lines.push(`const __trust = process.env.TRUST_PROXY ?? "loopback, linklocal, uniquelocal";`);
+  lines.push(`if (__trust === "false") app.set("trust proxy", false);`);
+  lines.push(`else if (/^\\d+$/.test(__trust)) app.set("trust proxy", Number(__trust));`);
+  lines.push(`else app.set("trust proxy", __trust);`);
+  lines.push(``);
+  lines.push(`// Middleware`);
+  lines.push(`app.use(helmet());`);
+  lines.push(`// CORS: restrict to ALLOWED_ORIGINS env var (comma-separated). Defaults to same-origin only.`);
+  lines.push(`const __allowedOrigins = (process.env.ALLOWED_ORIGINS || "").split(",").map(s => s.trim()).filter(Boolean);`);
+  lines.push(`app.use(cors({`);
+  lines.push(`  origin: __allowedOrigins.length > 0`);
+  lines.push(`    ? (origin, cb) => { if (!origin || __allowedOrigins.includes(origin)) cb(null, true); else cb(new Error("Not allowed by CORS")); }`);
+  lines.push(`    : false,`);
+  lines.push(`  credentials: true,`);
+  lines.push(`}));`);
+  lines.push(`app.use(express.json({ limit: "1mb" }));`);
+  lines.push(`app.use(express.urlencoded({ extended: false, limit: "1mb" }));`);
+  lines.push(`app.use(authMiddleware);`);
+
+  const gw = system.modules.find(m => m.kind === "gateway");
+  const rateVal = gw?.config["rate_limit"] || 1000;
+  lines.push(`app.use(rateLimit({ windowMs: 60000, max: ${rateVal} }));`);
+  lines.push(``);
+  // Request timeout middleware
+  lines.push(`// Request timeout (default 30s, override per-route)`);
+  lines.push(`app.use((req: any, res: any, next: any) => {`);
+  lines.push(`  const timeout = parseInt(process.env.REQUEST_TIMEOUT_MS || "30000");`);
+  lines.push(`  const timer = setTimeout(() => {`);
+  lines.push(`    if (!res.headersSent) {`);
+  lines.push(`      res.status(503).json({ error: { code: "REQUEST_TIMEOUT", message: "Request timed out" } });`);
+  lines.push(`    }`);
+  lines.push(`  }, timeout);`);
+  lines.push(`  res.on("finish", () => clearTimeout(timer));`);
+  lines.push(`  next();`);
+  lines.push(`});`);
+  lines.push(``);
+
+  lines.push(`// Health & metrics`);
+  lines.push(`app.use("/health", healthRouter);`);
+  lines.push(``);
+
+  lines.push(`// Routes`);
+  for (const mod of apiModules) {
+    const model = mod.models[0];
+    if (!model) continue;
+    const routerName = toCamelCase(toSnakeCase(model.name) + "s") + "Router";
+    lines.push(`app.use("/${toSnakeCase(model.name)}s", ${routerName});`);
+  }
+  lines.push(``);
+
+  if (hasWebSocket) {
+    lines.push(`// WebSocket`);
+    lines.push(`setupWebSocketServer(httpServer);`);
+    lines.push(``);
+  }
+
+  lines.push(`// Start`);
+  lines.push(`httpServer.listen(PORT, () => {`);
+  lines.push(`  logger.info("server_started", { event: "startup", metadata: { port: PORT } });`);
+  lines.push(`  // Start durable event worker (no-op in in_process mode)`);
+  lines.push(`  eventBus.startWorker(parseInt(process.env.EVENT_WORKER_INTERVAL_MS || "1000"));`);
+  if (hasBatch) {
+    lines.push(`  // Start batch executor`);
+    lines.push(`  startBatchWorker();`);
+    lines.push(`  // Start cron jobs`);
+    lines.push(`  startCronJobs();`);
+  }
+  lines.push(`  console.log(\`[${system.name}] Running on port \${PORT}\`);`);
+  lines.push(`  console.log(\`  HTTP routes:\`);`);
+  for (const mod of apiModules) {
+    const model = mod.models[0];
+    if (!model) continue;
+    lines.push(`  console.log(\`    /${toSnakeCase(model.name)}s\`);`);
+  }
+  if (hasWebSocket) {
+    lines.push(`  console.log(\`  WebSocket: /ws?channel=<name>&token=<jwt>\`);`);
+  }
+  lines.push(`  console.log(\`  Health: /health/live, /health/ready, /health/metrics\`);`);
+  lines.push(`});`);
+  lines.push(``);
+
+  // Graceful shutdown
+  lines.push(`// Graceful shutdown`);
+  lines.push(`const shutdown = async (signal: string) => {`);
+  lines.push(`  logger.info("server_stopping", { event: "shutdown", metadata: { signal } });`);
+  lines.push(`  httpServer.close(async () => {`);
+  lines.push(`    try {`);
+  lines.push(`      await pool.end();`);
+  lines.push(`      logger.info("server_stopped", { event: "shutdown", status: "success" });`);
+  lines.push(`    } catch (e: any) {`);
+  lines.push(`      logger.error("shutdown_error", { event: "shutdown", metadata: { error: e.message } });`);
+  lines.push(`    }`);
+  lines.push(`    process.exit(0);`);
+  lines.push(`  });`);
+  lines.push(`  // Force exit after 10s if connections don't drain`);
+  lines.push(`  setTimeout(() => { logger.error("shutdown_timeout", { event: "shutdown" }); process.exit(1); }, 10000);`);
+  lines.push(`};`);
+  lines.push(`process.on("SIGTERM", () => shutdown("SIGTERM"));`);
+  lines.push(`process.on("SIGINT", () => shutdown("SIGINT"));`);
+  lines.push(``);
+  lines.push(`export { app, httpServer };`);
+
+  return lines.join("\n");
+}
+
+// ─── Migration Script ─────────────────────────────────────────────────────────
+
+/**
+ * A migration block paired with a stable identifier and content checksum.
+ * - `id` is a human-readable, ordered name (e.g. "0001_create_sellers").
+ * - `checksum` is a sha256 of the SQL body — used by the ledger to detect
+ *   tampering with already-applied migrations.
+ */
+export interface MigrationBlock {
+  id: string;
+  checksum: string;
+  sql: string;
+}
+
+/**
+ * Build deterministic migration blocks from raw schema strings.
+ * The order of `schemas` is preserved; each block gets a zero-padded prefix
+ * so lexicographic sort matches insertion order.
+ */
+export function buildMigrationBlocks(schemas: string[]): MigrationBlock[] {
+  const blocks: MigrationBlock[] = [];
+  schemas.forEach((sql, i) => {
+    const checksum = createHash("sha256").update(sql).digest("hex");
+    // Try to extract the module name from the schema header for a friendlier id.
+    const moduleMatch = sql.match(/^--\s*Module:\s*(\S+)/m);
+    const tableMatch = sql.match(/CREATE TABLE IF NOT EXISTS\s+(\w+)/i);
+    const slug = (tableMatch?.[1] || moduleMatch?.[1] || `block_${i}`)
+      .replace(/[^a-zA-Z0-9_]/g, "_")
+      .toLowerCase();
+    const id = `${String(i).padStart(4, "0")}_${slug}`;
+    blocks.push({ id, checksum, sql });
+  });
+  return blocks;
+}
+
+export function emitMigration(_system: IR.IRSystem, schemas: string[]): string {
+  const blocks = buildMigrationBlocks(schemas);
+
+  const lines: string[] = [];
+  lines.push(`// Generated by BoneScript compiler. DO NOT EDIT.`);
+  lines.push(`// Migration runner with a schema_migrations ledger.`);
+  lines.push(`// Each block is hashed at compile time; runs are skipped if the same`);
+  lines.push(`// (id, checksum) pair has already been recorded as applied.`);
+  lines.push(`require("dotenv").config();`);
+  lines.push(`import * as fs from "fs";`);
+  lines.push(`import * as path from "path";`);
+  lines.push(`import { createHash } from "crypto";`);
+  lines.push(`import { pool } from "./db";`);
+  lines.push(``);
+  lines.push(`interface Block { id: string; checksum: string; sql: string; }`);
+  lines.push(``);
+  lines.push(`const GENERATED_BLOCKS: Block[] = [`);
+  for (const b of blocks) {
+    const escaped = b.sql.replace(/\\/g, "\\\\").replace(/`/g, "\\`").replace(/\$/g, "\\$");
+    lines.push(`  {`);
+    lines.push(`    id: ${JSON.stringify(b.id)},`);
+    lines.push(`    checksum: ${JSON.stringify(b.checksum)},`);
+    lines.push(`    sql: \`${escaped}\`,`);
+    lines.push(`  },`);
+  }
+  lines.push(`];`);
+  lines.push(``);
+  lines.push(`/**`);
+  lines.push(` * Pick up any hand-authored migrations dropped into migrations/_manual/.`);
+  lines.push(` * Files are picked up in lexicographic order; \`bonec diff --write\` writes`);
+  lines.push(` * them with a numeric prefix so insertion order is stable.`);
+  lines.push(` */`);
+  lines.push(`function loadManualBlocks(): Block[] {`);
+  lines.push(`  const dir = path.resolve(__dirname, "..", "migrations", "_manual");`);
+  lines.push(`  if (!fs.existsSync(dir)) return [];`);
+  lines.push(`  return fs.readdirSync(dir)`);
+  lines.push(`    .filter(f => f.endsWith(".sql"))`);
+  lines.push(`    .sort()`);
+  lines.push(`    .map(f => {`);
+  lines.push(`      const sql = fs.readFileSync(path.join(dir, f), "utf-8");`);
+  lines.push(`      return {`);
+  lines.push(`        id: "manual_" + f.replace(/\\.sql$/, ""),`);
+  lines.push(`        checksum: createHash("sha256").update(sql).digest("hex"),`);
+  lines.push(`        sql,`);
+  lines.push(`      };`);
+  lines.push(`    });`);
+  lines.push(`}`);
+  lines.push(``);
+  lines.push(`const LEDGER_DDL = \`CREATE TABLE IF NOT EXISTS schema_migrations (`);
+  lines.push(`  id           VARCHAR PRIMARY KEY,`);
+  lines.push(`  checksum     VARCHAR NOT NULL,`);
+  lines.push(`  applied_at   TIMESTAMPTZ NOT NULL DEFAULT NOW(),`);
+  lines.push(`  applied_by   VARCHAR NOT NULL DEFAULT current_user,`);
+  lines.push(`  duration_ms  INTEGER NOT NULL DEFAULT 0`);
+  lines.push(`);\`;`);
+  lines.push(``);
+  lines.push(`async function migrate() {`);
+  lines.push(`  const client = await pool.connect();`);
+  lines.push(`  let applied = 0, skipped = 0;`);
+  lines.push(`  try {`);
+  lines.push(`    await client.query(LEDGER_DDL);`);
+  lines.push(``);
+  lines.push(`    // Generated blocks come first (compile-time schema), then manual diffs.`);
+  lines.push(`    const allBlocks: Block[] = [...GENERATED_BLOCKS, ...loadManualBlocks()];`);
+  lines.push(``);
+  lines.push(`    // Load already-applied entries.`);
+  lines.push(`    const existing = await client.query(`);
+  lines.push(`      "SELECT id, checksum FROM schema_migrations"`);
+  lines.push(`    );`);
+  lines.push(`    const rows = existing.rows as Array<{ id: string; checksum: string }>;`);
+  lines.push(`    const appliedById = new Map(rows.map(r => [r.id, r.checksum]));`);
+  lines.push(``);
+  lines.push(`    for (const block of allBlocks) {`);
+  lines.push(`      const prior = appliedById.get(block.id);`);
+  lines.push(`      if (prior === block.checksum) {`);
+  lines.push(`        skipped++;`);
+  lines.push(`        continue;`);
+  lines.push(`      }`);
+  lines.push(`      if (prior && prior !== block.checksum) {`);
+  lines.push(`        // Someone changed an already-applied migration. Refuse to proceed —`);
+  lines.push(`        // an explicit migration file should be authored instead.`);
+  lines.push(`        throw new Error(`);
+  lines.push("          `Migration ${block.id} was previously applied with a different ` +");
+  lines.push("          `checksum. Generate a new migration via 'bonec diff --write' ` +");
+  lines.push("          `instead of editing existing schemas.`");
+  lines.push(`        );`);
+  lines.push(`      }`);
+  lines.push(``);
+  lines.push(`      const start = Date.now();`);
+  lines.push(`      try {`);
+  lines.push(`        await client.query("BEGIN");`);
+  lines.push(`        await client.query(block.sql);`);
+  lines.push(`        await client.query(`);
+  lines.push(`          "INSERT INTO schema_migrations (id, checksum, duration_ms) VALUES ($1, $2, $3)",`);
+  lines.push(`          [block.id, block.checksum, Date.now() - start]`);
+  lines.push(`        );`);
+  lines.push(`        await client.query("COMMIT");`);
+  lines.push("        console.log(`  applied  ${block.id}  (${Date.now() - start}ms)`);");
+  lines.push(`        applied++;`);
+  lines.push(`      } catch (e) {`);
+  lines.push(`        await client.query("ROLLBACK").catch(() => {});`);
+  lines.push(`        throw e;`);
+  lines.push(`      }`);
+  lines.push(`    }`);
+  lines.push(``);
+  lines.push("    console.log(`Migrations complete: ${applied} applied, ${skipped} already up to date.`);");
+  lines.push(`  } finally {`);
+  lines.push(`    client.release();`);
+  lines.push(`    await pool.end();`);
+  lines.push(`  }`);
+  lines.push(`}`);
+  lines.push(``);
+  lines.push(`migrate().catch(e => { console.error(e); process.exit(1); });`);
+
+  return lines.join("\n");
+}
+
+// ─── Unknown Function Collector ───────────────────────────────────────────────
+// Finds function calls in effect expressions that aren't built-ins or known names.
+
+const KNOWN_FUNCTIONS = new Set([
+  "now", "count", "sum", "min", "max", "avg", "length", "size",
+  "shortestPath", "topologicalSort", "binarySearch", "bipartiteMatching",
+  "roundRobin", "weightedAverage", "percentile", "rankBy", "consistentHash",
+]);
+
+function collectUnknownFunctions(mod: IR.IRModule): Set<string> {
+  const found = new Set<string>();
+  for (const iface of mod.interfaces) {
+    for (const method of iface.methods) {
+      for (const effect of method.effects) {
+        extractFunctionCalls(effect.value, found);
+      }
+      for (const pre of method.preconditions) {
+        extractFunctionCalls(pre.expression, found);
+      }
+    }
+  }
+  return found;
+}
+
+function extractFunctionCalls(expr: string, found: Set<string>): void {
+  const pattern = /\b([a-zA-Z_]\w*)\s*\(/g;
+  let match: RegExpExecArray | null;
+  while ((match = pattern.exec(expr)) !== null) {
+    const name = match[1];
+    if (!KNOWN_FUNCTIONS.has(name)) {
+      found.add(name);
+    }
+  }
+}