naidejs 1.0.0 → 1.1.0

package/README.md

@@ -9,7 +9,7 @@ Two modes:
 ## Install
 
 ```bash
-npm install -g naide
+npm install -g naidejs
 ```
 
 ## Usage
@@ -29,6 +29,117 @@ naide -o app.js app.nx
 naide --mid app.nx
 ```
 
+## High-Level Features
+
+NAIDE includes built-in declarations for common backend patterns. Zero dependencies — the runtime is bundled with the package.
+
+### schema — Data models with validation
+
+```python
+schema User:
+  id     auto
+  name   str required min(2) max(50)
+  email  str required email unique
+  age    int optional min(0) max(150)
+  role   enum("admin", "user") default("user")
+  joined timestamp auto
+```
+
+Types: `str`, `int`, `num`, `bool`, `auto` (UUID), `timestamp`, `enum(...)`
+Modifiers: `required`, `optional`, `min(n)`, `max(n)`, `email`, `url`, `unique`, `auto`, `default(val)`
+
+### crud — Auto-generate REST endpoints
+
+```python
+server app port 3000:
+  crud "/api/users" User
+```
+
+Generates GET (list + by ID), POST, PUT, DELETE routes with validation.
+
+### auth — JWT authentication
+
+```python
+server app port 3000:
+  auth JWT_SECRET:
+    protect "/api/*"
+    public "/api/auth/*"
+```
+
+Built-in JWT sign/verify with no external dependencies.
+
+### cors — CORS middleware
+
+```python
+server app port 3000:
+  cors "*"
+  # or: cors ["localhost:3000", "myapp.com"]
+```
+
+### limit — Rate limiting
+
+```python
+server app port 3000:
+  limit "/api/*" 100 "1m"
+```
+
+### env — Environment variables with validation
+
+```python
+env:
+  PORT       int default(3000)
+  JWT_SECRET str required
+  DB_URL     str default("sqlite:data.db")
+```
+
+Variables become constants available throughout the file.
+
+### every — Scheduled tasks
+
+```python
+every "5m":
+  log "cleanup running"
+```
+
+Intervals: `"30s"`, `"5m"`, `"1h"`, `"1d"`
+
+### watch — React to events
+
+```python
+watch User.create (event):
+  log "new user: {event.data.name}"
+```
+
+Automatically connected to `crud` events.
+
+### Full example
+
+```python
+env:
+  PORT int default(3000)
+  JWT_SECRET str required
+
+schema User:
+  id auto
+  name str required min(2) max(50)
+  email str required email
+
+server app port PORT:
+  cors "*"
+  auth JWT_SECRET:
+    protect "/api/*"
+    public "/api/auth/*"
+  limit "/api/*" 100 "1m"
+  crud "/api/users" User
+  get "/health":
+    ret {status: "ok"}
+
+watch User.create (event):
+  log "new user: {event.data.name}"
+```
+
+This generates a complete Express API with validation, auth, CORS, rate limiting, and CRUD — from 20 lines.
+
 ## NAIDE syntax (.naide)
 
 ```python
@@ -37,7 +148,7 @@ str name = "World"
 int count = 3
 mut int counter = 0
 
-# Functions — one way only
+# Functions
 fn greet(str who) -> str:
   ret "Hello, {who}!"
 
@@ -118,8 +229,12 @@ f greet(s:who)s
 @i<0..10
   log i
 
--- Server
+-- Server with high-level features
 $app:3000
+  cors "*"
+  auth SECRET:
+    protect "/api/*"
+  crud "/api/users" User
   G"/users"
     >users
   P"/users"(req,res)
@@ -156,6 +271,8 @@ $app:3000
 
 Types: `s`=str `i`=int `n`=num `b`=bool `l`=list `m`=map `a`=any
 
+High-level: `schema`, `crud`, `auth`, `cors`, `limit`, `env`, `every`, `watch` — same syntax in both modes.
+
 ## Why?
 
 AI code generation speed depends on:

package/bin/naide.js

@@ -61,6 +61,8 @@ if (flags.help || files.length === 0) {
   process.exit(0);
 }
 
+const runtimeUrl = new URL('../src/runtime.js', import.meta.url).href;
+
 for (const file of files) {
   const filePath = resolve(file);
   let source;
@@ -81,7 +83,8 @@ for (const file of files) {
       continue;
     }
 
-    const result = compile(source, { mode });
+    const runtimePath = flags.emit || flags.output ? 'naidejs/runtime' : runtimeUrl;
+    const result = compile(source, { mode, runtimePath });
 
     if (flags.tokens) {
       console.log(JSON.stringify(result.tokens, null, 2));

package/examples/fullapp.naide

@@ -0,0 +1,37 @@
+# Full NAIDE app with high-level features
+
+env:
+  PORT int default(3000)
+  JWT_SECRET str required
+
+schema User:
+  id auto
+  name str required min(2) max(50)
+  email str required email
+  role str default("user")
+
+schema Todo:
+  id auto
+  title str required min(1)
+  done bool default(false)
+  created timestamp auto
+
+server app port PORT:
+  cors "*"
+  auth JWT_SECRET:
+    protect "/api/*"
+    public "/api/auth/*"
+  limit "/api/*" 100 "1m"
+  crud "/api/users" User
+  crud "/api/todos" Todo
+  get "/health":
+    ret {status: "ok"}
+  post "/api/auth/login" (req, res):
+    str email = req.body.email
+    ret {token: "jwt-token-here"}
+
+every "30m":
+  log "cleanup running"
+
+watch User.create (event):
+  log "new user: {event.data.name}"

package/examples/fullapp.nx

@@ -0,0 +1,37 @@
+-- Full NAIDE-X app with high-level features
+
+env:
+  PORT int default(3000)
+  JWT_SECRET str required
+
+schema User:
+  id auto
+  name str required min(2) max(50)
+  email str required email
+  role str default("user")
+
+schema Todo:
+  id auto
+  title str required min(1)
+  done bool default(false)
+  created timestamp auto
+
+$app:PORT
+  cors "*"
+  auth JWT_SECRET:
+    protect "/api/*"
+    public "/api/auth/*"
+  limit "/api/*" 100 "1m"
+  crud "/api/users" User
+  crud "/api/todos" Todo
+  G"/health"
+    >{status:"ok"}
+  P"/api/auth/login"(req,res)
+    s:email=req.body.email
+    >{token:"jwt-token-here"}
+
+every "30m":
+  log"cleanup running"
+
+watch User.create (event):
+  log"new user: {event.data.name}"

package/package.json

@@ -1,8 +1,12 @@
 {
   "name": "naidejs",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "NAIDE - Node AI Development Environment. A language optimized for AI code generation that transpiles to Node.js. Standard mode (~40% fewer tokens) and X mode (~80% fewer tokens).",
   "main": "src/index.js",
+  "exports": {
+    ".": "./src/index.js",
+    "./runtime": "./src/runtime.js"
+  },
   "bin": {
     "naide": "bin/naide.js"
   },

package/src/generator.js

@@ -1,13 +1,39 @@
 export class Generator {
-  constructor() {
+  constructor(options = {}) {
     this.indent = 0;
     this.output = [];
     this.usesExpress = false;
     this.models = new Map();
+    this.runtimeImports = new Set();
+    this.schemas = new Map();
+    this.needsEventBus = false;
+    this.runtimePath = options.runtimePath || 'naidejs/runtime';
   }
 
   generate(ast) {
     this.visitProgram(ast);
+
+    const preamble = [];
+
+    if (this.needsEventBus) {
+      this.runtimeImports.add('createEventBus');
+    }
+
+    if (this.runtimeImports.size > 0) {
+      const imports = [...this.runtimeImports].join(', ');
+      preamble.push(`import { ${imports} } from '${this.runtimePath}';`);
+      preamble.push('');
+    }
+
+    if (this.needsEventBus) {
+      preamble.push('const __eventBus = createEventBus();');
+      preamble.push('');
+    }
+
+    if (preamble.length > 0) {
+      this.output.unshift(...preamble);
+    }
+
     return this.output.join('\n');
   }
 
@@ -51,6 +77,14 @@ export class Generator {
       case 'ExprStatement': this.emit(this.expr(node.expression) + ';'); return;
       case 'DbConnect': return this.visitDbConnect(node);
       case 'AwaitAll': return this.visitAwaitAllStatement(node);
+      case 'SchemaDecl': return this.visitSchema(node);
+      case 'CrudDecl': return this.visitCrudTopLevel(node);
+      case 'AuthDecl': return this.visitAuthTopLevel(node);
+      case 'CorsDecl': return this.visitCorsTopLevel(node);
+      case 'LimitDecl': return this.visitLimitTopLevel(node);
+      case 'EnvDecl': return this.visitEnv(node);
+      case 'EveryDecl': return this.visitEvery(node);
+      case 'WatchDecl': return this.visitWatch(node);
       default:
         this.emit(`/* unknown: ${node.type} */`);
     }
@@ -111,7 +145,6 @@ export class Generator {
     const target = this.expr(node.target);
     const value = this.expr(node.value);
 
-    // Destructuring assignment
     if (node.target.type === 'Array') {
       const names = node.target.elements.map(e => this.expr(e)).join(', ');
       this.emit(`const [${names}] = ${value};`);
@@ -225,22 +258,27 @@ export class Generator {
     this.emit(`${node.name}.use(express.json());`);
     this.emitRaw('');
 
-    // Middleware
     for (const mid of node.middleware) {
       this.emit(`${node.name}.use(${this.generateMiddleware(mid)});`);
       this.emitRaw('');
     }
 
-    // Routes
-    for (const route of node.routes) {
-      if (route.type === 'Route') {
-        this.visitRoute(node.name, route);
+    for (const child of node.routes) {
+      if (child.type === 'Route') {
+        this.visitRoute(node.name, child);
+      } else if (child.type === 'CrudDecl') {
+        this.visitCrud(node.name, child);
+      } else if (child.type === 'AuthDecl') {
+        this.visitAuth(node.name, child);
+      } else if (child.type === 'CorsDecl') {
+        this.visitCors(node.name, child);
+      } else if (child.type === 'LimitDecl') {
+        this.visitLimit(node.name, child);
       } else {
-        this.visitStatement(route);
+        this.visitStatement(child);
       }
     }
 
-    // Listen
     const port = node.port ? this.expr(node.port) : '3000';
     this.emitRaw('');
     this.emit(`${node.name}.listen(${port}, () => {`);
@@ -255,17 +293,14 @@ export class Generator {
     const path = this.stringValue(route.path);
     const params = route.params.length > 0 ? route.params.join(', ') : 'req, res';
 
-    // Check if body uses await
     const needsAsync = this.bodyUsesAwait(route.body);
     const asyncPrefix = needsAsync ? 'async ' : '';
 
     this.emit(`${appName}.${method}(${path}, ${asyncPrefix}(${params}) => {`);
     this.indent++;
 
-    // If params don't include res, inject it
     const hasRes = params.includes('res');
 
-    // Transform body: last expression with ret becomes res.json
     for (let i = 0; i < route.body.length; i++) {
       const stmt = route.body[i];
       if (stmt.type === 'Return' && stmt.value !== null) {
@@ -326,7 +361,6 @@ export class Generator {
       this.emitRaw('');
     }
 
-    // Methods
     for (const method of node.methods) {
       const async = method.isAsync ? 'async ' : '';
       const params = method.params.map(p => {
@@ -353,8 +387,6 @@ export class Generator {
 
   visitOn(node) {
     const event = this.expr(node.event);
-    // Split event into object and event name
-    // e.g., process.exit -> process.on('exit', ...)
     if (node.event.type === 'MemberAccess') {
       const obj = this.expr(node.event.object);
       const evt = node.event.property;
@@ -376,7 +408,6 @@ export class Generator {
 
   visitThrow(node) {
     const value = this.expr(node.value);
-    // If it's a string, wrap in Error
     if (node.value.type === 'String') {
       this.emit(`throw new Error(${value});`);
     } else {
@@ -393,7 +424,207 @@ export class Generator {
     this.emit(`await Promise.all([${exprs}]);`);
   }
 
-  // Expression generation
+  // ===== New high-level features =====
+
+  visitSchema(node) {
+    this.runtimeImports.add('createSchema');
+    this.runtimeImports.add('createStore');
+
+    this.emit(`const ${node.name}Schema = createSchema('${node.name}', {`);
+    this.indent++;
+
+    for (const field of node.fields) {
+      const props = [];
+
+      switch (field.type) {
+        case 'auto':
+          props.push("type: 'id'", 'auto: true');
+          break;
+        case 'timestamp':
+          props.push("type: 'timestamp'");
+          break;
+        case 'str':
+          props.push("type: 'string'");
+          break;
+        case 'int':
+          props.push("type: 'integer'");
+          break;
+        case 'num':
+          props.push("type: 'number'");
+          break;
+        case 'bool':
+          props.push("type: 'boolean'");
+          break;
+        case 'enum':
+          if (field.enumValues) {
+            const vals = field.enumValues.map(v => this.expr(v)).join(', ');
+            props.push("type: 'enum'", `values: [${vals}]`);
+          } else {
+            props.push("type: 'enum'");
+          }
+          break;
+        default:
+          props.push(`type: '${field.type}'`);
+          break;
+      }
+
+      for (const mod of field.modifiers) {
+        switch (mod.name) {
+          case 'required': props.push('required: true'); break;
+          case 'optional': props.push('required: false'); break;
+          case 'unique': props.push('unique: true'); break;
+          case 'email': props.push('email: true'); break;
+          case 'url': props.push('url: true'); break;
+          case 'auto': props.push('auto: true'); break;
+          case 'min': props.push(`min: ${this.expr(mod.args[0])}`); break;
+          case 'max': props.push(`max: ${this.expr(mod.args[0])}`); break;
+          case 'default': props.push(`default: ${this.expr(mod.args[0])}`); break;
+        }
+      }
+
+      this.emit(`${field.name}: { ${props.join(', ')} },`);
+    }
+
+    this.indent--;
+    this.emit('});');
+    this.emit(`const ${node.name}Store = createStore(${node.name}Schema);`);
+    this.emitRaw('');
+
+    this.schemas.set(node.name, node);
+  }
+
+  visitCrud(appName, node) {
+    this.runtimeImports.add('registerCrud');
+    this.needsEventBus = true;
+
+    const path = this.stringValue(node.path);
+    this.emit(`registerCrud(${appName}, ${path}, ${node.schemaName}Schema, ${node.schemaName}Store, __eventBus);`);
+    this.emitRaw('');
+  }
+
+  visitCrudTopLevel(node) {
+    this.visitCrud('app', node);
+  }
+
+  visitAuth(appName, node) {
+    this.runtimeImports.add('jwtAuth');
+
+    const secret = this.expr(node.secret);
+    const options = [];
+    if (node.publicPaths.length > 0) {
+      const paths = node.publicPaths.map(p => this.stringValue(p)).join(', ');
+      options.push(`public: [${paths}]`);
+    }
+    const optStr = options.length > 0 ? `, { ${options.join(', ')} }` : '';
+
+    if (node.protectedPaths.length > 0) {
+      const path = this.stringValue(node.protectedPaths[0]);
+      this.emit(`${appName}.use(${path}, jwtAuth(${secret}${optStr}));`);
+    } else {
+      this.emit(`${appName}.use(jwtAuth(${secret}${optStr}));`);
+    }
+    this.emitRaw('');
+  }
+
+  visitAuthTopLevel(node) {
+    this.visitAuth('app', node);
+  }
+
+  visitCors(appName, node) {
+    this.runtimeImports.add('corsMiddleware');
+
+    const origins = this.expr(node.origins);
+    if (node.origins.type === 'String') {
+      this.emit(`${appName}.use(corsMiddleware([${origins}]));`);
+    } else {
+      this.emit(`${appName}.use(corsMiddleware(${origins}));`);
+    }
+    this.emitRaw('');
+  }
+
+  visitCorsTopLevel(node) {
+    this.visitCors('app', node);
+  }
+
+  visitLimit(appName, node) {
+    this.runtimeImports.add('rateLimit');
+
+    const path = this.stringValue(node.path);
+    const max = this.expr(node.max);
+    const window = this.expr(node.window);
+    this.emit(`${appName}.use(${path}, rateLimit(${max}, ${window}));`);
+    this.emitRaw('');
+  }
+
+  visitLimitTopLevel(node) {
+    this.visitLimit('app', node);
+  }
+
+  visitEnv(node) {
+    this.runtimeImports.add('loadEnv');
+
+    const names = node.vars.map(v => v.name);
+    this.emit(`const { ${names.join(', ')} } = loadEnv({`);
+    this.indent++;
+
+    for (const v of node.vars) {
+      const props = [];
+
+      switch (v.type) {
+        case 'str': props.push("type: 'string'"); break;
+        case 'int': props.push("type: 'integer'"); break;
+        case 'num': props.push("type: 'number'"); break;
+        case 'bool': props.push("type: 'boolean'"); break;
+        default: props.push(`type: '${v.type}'`); break;
+      }
+
+      for (const mod of v.modifiers) {
+        switch (mod.name) {
+          case 'required': props.push('required: true'); break;
+          case 'default': props.push(`default: ${this.expr(mod.args[0])}`); break;
+        }
+      }
+
+      this.emit(`${v.name}: { ${props.join(', ')} },`);
+    }
+
+    this.indent--;
+    this.emit('});');
+    this.emitRaw('');
+  }
+
+  visitEvery(node) {
+    this.runtimeImports.add('scheduleEvery');
+
+    const interval = this.expr(node.interval);
+    const needsAsync = this.bodyUsesAwait(node.body);
+    const asyncPrefix = needsAsync ? 'async ' : '';
+
+    this.emit(`scheduleEvery(${interval}, ${asyncPrefix}() => {`);
+    this.indent++;
+    for (const stmt of node.body) this.visitStatement(stmt);
+    this.indent--;
+    this.emit('});');
+    this.emitRaw('');
+  }
+
+  visitWatch(node) {
+    this.needsEventBus = true;
+
+    const params = node.params.length > 0 ? node.params.join(', ') : 'event';
+    const needsAsync = this.bodyUsesAwait(node.body);
+    const asyncPrefix = needsAsync ? 'async ' : '';
+
+    this.emit(`__eventBus.on('${node.eventName}', ${asyncPrefix}(${params}) => {`);
+    this.indent++;
+    for (const stmt of node.body) this.visitStatement(stmt);
+    this.indent--;
+    this.emit('});');
+    this.emitRaw('');
+  }
+
+  // ===== Expression generation =====
+
   expr(node) {
     if (!node) return 'undefined';
 

package/src/index.js

@@ -3,7 +3,7 @@ import { Parser } from './parser.js';
 import { Generator } from './generator.js';
 import { preprocess } from './preprocess.js';
 
-export function compile(source, { mode = 'naide' } = {}) {
+export function compile(source, { mode = 'naide', runtimePath } = {}) {
   if (mode === 'x') {
     source = preprocess(source);
   }
@@ -11,7 +11,7 @@ export function compile(source, { mode = 'naide' } = {}) {
   const tokens = lexer.tokenize();
   const parser = new Parser(tokens);
   const ast = parser.parse();
-  const generator = new Generator();
+  const generator = new Generator({ runtimePath });
   const js = generator.generate(ast);
   return { js, ast, tokens, naide: mode === 'x' ? source : null };
 }

package/src/parser.js

@@ -91,7 +91,10 @@ export class Parser {
         tok.type === T.LOG || tok.type === T.DB || tok.type === T.GET ||
         tok.type === T.POST || tok.type === T.PUT || tok.type === T.DEL ||
         tok.type === T.MATCH || tok.type === T.ON || tok.type === T.NEW ||
-        tok.type === T.FROM || tok.type === T.AS || tok.type === T.SELF) {
+        tok.type === T.FROM || tok.type === T.AS || tok.type === T.SELF ||
+        tok.type === T.SCHEMA || tok.type === T.CRUD || tok.type === T.AUTH ||
+        tok.type === T.CORS || tok.type === T.LIMIT || tok.type === T.ENV ||
+        tok.type === T.EVERY || tok.type === T.WATCH) {
       return tok.value;
     }
     throw this.error(`Expected property name but got ${tok.type} ('${tok.value}')`, tok);
@@ -148,6 +151,28 @@ export class Parser {
       case T.DB: return this.parseDbStatement();
       case T.AWAIT: return this.parseAwaitStatement();
       case T.AWAIT_ALL: return this.parseAwaitAll();
+      case T.SCHEMA: return this.parseSchema();
+      case T.CRUD:
+        if (this.peek(1).type === T.DOT) return this.parseExpressionStatement();
+        return this.parseCrud();
+      case T.AUTH:
+        if (this.peek(1).type === T.DOT) return this.parseExpressionStatement();
+        return this.parseAuth();
+      case T.CORS:
+        if (this.peek(1).type === T.DOT) return this.parseExpressionStatement();
+        return this.parseCors();
+      case T.LIMIT:
+        if (this.peek(1).type === T.DOT) return this.parseExpressionStatement();
+        return this.parseLimit();
+      case T.ENV:
+        if (this.peek(1).type === T.DOT) return this.parseExpressionStatement();
+        return this.parseEnv();
+      case T.EVERY:
+        if (this.peek(1).type === T.DOT) return this.parseExpressionStatement();
+        return this.parseEvery();
+      case T.WATCH:
+        if (this.peek(1).type === T.DOT) return this.parseExpressionStatement();
+        return this.parseWatch();
       default:
         if (TYPE_TOKENS.has(tok.type)) {
           return this.parseTypedVariable();
@@ -497,8 +522,15 @@ export class Parser {
         routes.push(this.parseRoute());
       } else if (this.at(T.MID)) {
         middleware.push(this.parseMiddleware());
+      } else if (this.at(T.CRUD)) {
+        routes.push(this.parseCrud());
+      } else if (this.at(T.AUTH)) {
+        routes.push(this.parseAuth());
+      } else if (this.at(T.CORS)) {
+        routes.push(this.parseCors());
+      } else if (this.at(T.LIMIT)) {
+        routes.push(this.parseLimit());
       } else {
-        // generic statement in server block
         routes.push(this.parseStatement());
       }
       this.skipNewlines();
@@ -894,6 +926,11 @@ export class Parser {
         this.advance();
         return new ASTNode('Identifier', { name: tok.value });
 
+      case T.SCHEMA: case T.CRUD: case T.AUTH: case T.CORS:
+      case T.LIMIT: case T.ENV: case T.EVERY: case T.WATCH:
+        this.advance();
+        return new ASTNode('Identifier', { name: tok.value });
+
       case T.DB:
         return this.parseDbExpression();
 
@@ -1076,4 +1113,217 @@ export class Parser {
     const body = this.parseBlock();
     return new ASTNode('Lambda', { params, returnType, body, isAsync });
   }
+
+  // schema User:
+  //   id     auto
+  //   name   str required min(2) max(50)
+  //   email  str required email unique
+  parseSchema() {
+    this.advance(); // schema
+    const name = this.expect(T.IDENT).value;
+    this.expect(T.COLON);
+    this.skipNewlines();
+    this.expect(T.INDENT);
+
+    const fields = [];
+    this.skipNewlines();
+
+    while (!this.at(T.DEDENT) && !this.at(T.EOF)) {
+      fields.push(this.parseSchemaField());
+      this.skipNewlines();
+    }
+    this.match(T.DEDENT);
+
+    return new ASTNode('SchemaDecl', { name, fields });
+  }
+
+  parseSchemaField() {
+    const name = this.expect(T.IDENT).value;
+
+    let fieldType;
+    let enumValues = null;
+
+    if (TYPE_TOKENS.has(this.peek().type)) {
+      fieldType = this.advance().value;
+    } else if (this.at(T.IDENT)) {
+      fieldType = this.advance().value;
+      if (fieldType === 'enum' && this.at(T.LPAREN)) {
+        this.advance();
+        enumValues = [];
+        while (!this.at(T.RPAREN) && !this.at(T.EOF)) {
+          enumValues.push(this.parseExpression());
+          this.match(T.COMMA);
+        }
+        this.expect(T.RPAREN);
+      }
+    } else {
+      throw this.error('Expected type in schema field');
+    }
+
+    const modifiers = [];
+    while (!this.at(T.NEWLINE) && !this.at(T.DEDENT) && !this.at(T.EOF)) {
+      if (this.at(T.IDENT) || this.at(T.IDENT)) {
+        const modName = this.advance().value;
+        if (this.at(T.LPAREN)) {
+          this.advance();
+          const args = [];
+          while (!this.at(T.RPAREN) && !this.at(T.EOF)) {
+            args.push(this.parseExpression());
+            this.match(T.COMMA);
+          }
+          this.expect(T.RPAREN);
+          modifiers.push({ name: modName, args });
+        } else {
+          modifiers.push({ name: modName, args: [] });
+        }
+      } else {
+        break;
+      }
+    }
+
+    return { name, type: fieldType, enumValues, modifiers };
+  }
+
+  // crud "/api/users" User
+  parseCrud() {
+    this.advance(); // crud
+    const path = this.parseString();
+    const schemaName = this.expect(T.IDENT).value;
+    return new ASTNode('CrudDecl', { path, schemaName });
+  }
+
+  // auth SECRET:
+  //   protect "/api/*"
+  //   public "/api/auth/*"
+  parseAuth() {
+    this.advance(); // auth
+    const secret = this.parseExpression();
+
+    const protectedPaths = [];
+    const publicPaths = [];
+
+    if (this.match(T.COLON)) {
+      this.skipNewlines();
+      this.expect(T.INDENT);
+      this.skipNewlines();
+      while (!this.at(T.DEDENT) && !this.at(T.EOF)) {
+        if (this.at(T.IDENT) && this.peek().value === 'protect') {
+          this.advance();
+          protectedPaths.push(this.parseString());
+        } else if (this.at(T.IDENT) && this.peek().value === 'public') {
+          this.advance();
+          publicPaths.push(this.parseString());
+        } else {
+          this.advance();
+        }
+        this.skipNewlines();
+      }
+      this.match(T.DEDENT);
+    }
+
+    return new ASTNode('AuthDecl', { secret, protectedPaths, publicPaths });
+  }
+
+  // cors "*"
+  // cors ["origin1", "origin2"]
+  parseCors() {
+    this.advance(); // cors
+    const origins = this.parseExpression();
+    return new ASTNode('CorsDecl', { origins });
+  }
+
+  // limit "/api/*" 100 "1m"
+  parseLimit() {
+    this.advance(); // limit
+    const path = this.parseString();
+    const max = this.parseExpression();
+    const window = this.parseExpression();
+    return new ASTNode('LimitDecl', { path, max, window });
+  }
+
+  // env:
+  //   PORT int default(3000)
+  //   JWT_SECRET str required
+  parseEnv() {
+    this.advance(); // env
+    this.expect(T.COLON);
+    this.skipNewlines();
+    this.expect(T.INDENT);
+
+    const vars = [];
+    this.skipNewlines();
+
+    while (!this.at(T.DEDENT) && !this.at(T.EOF)) {
+      vars.push(this.parseEnvField());
+      this.skipNewlines();
+    }
+    this.match(T.DEDENT);
+
+    return new ASTNode('EnvDecl', { vars });
+  }
+
+  parseEnvField() {
+    const name = this.expect(T.IDENT).value;
+
+    let fieldType = 'string';
+    if (TYPE_TOKENS.has(this.peek().type)) {
+      fieldType = this.advance().value;
+    } else if (this.at(T.IDENT) && ['string', 'number', 'integer', 'boolean'].includes(this.peek().value)) {
+      fieldType = this.advance().value;
+    }
+
+    const modifiers = [];
+    while (!this.at(T.NEWLINE) && !this.at(T.DEDENT) && !this.at(T.EOF)) {
+      if (this.at(T.IDENT)) {
+        const modName = this.advance().value;
+        if (this.at(T.LPAREN)) {
+          this.advance();
+          const args = [];
+          while (!this.at(T.RPAREN) && !this.at(T.EOF)) {
+            args.push(this.parseExpression());
+            this.match(T.COMMA);
+          }
+          this.expect(T.RPAREN);
+          modifiers.push({ name: modName, args });
+        } else {
+          modifiers.push({ name: modName, args: [] });
+        }
+      } else {
+        break;
+      }
+    }
+
+    return { name, type: fieldType, modifiers };
+  }
+
+  // every "5m":
+  //   log "tick"
+  parseEvery() {
+    this.advance(); // every
+    const interval = this.parseExpression();
+    this.expect(T.COLON);
+    const body = this.parseBlock();
+    return new ASTNode('EveryDecl', { interval, body });
+  }
+
+  // watch User.create (event):
+  //   log event
+  parseWatch() {
+    this.advance(); // watch
+    let eventName = this.expect(T.IDENT).value;
+    while (this.match(T.DOT)) {
+      eventName += '.' + this.expectPropertyName();
+    }
+    let params = [];
+    if (this.match(T.LPAREN)) {
+      while (!this.at(T.RPAREN) && !this.at(T.EOF)) {
+        params.push(this.expect(T.IDENT).value);
+        this.match(T.COMMA);
+      }
+      this.expect(T.RPAREN);
+    }
+    this.expect(T.COLON);
+    const body = this.parseBlock();
+    return new ASTNode('WatchDecl', { eventName, params, body });
+  }
 }

package/src/runtime.js

@@ -0,0 +1,267 @@
+import { createHmac, randomUUID, timingSafeEqual } from 'crypto';
+
+// ===== Schema + Validation =====
+export function createSchema(name, fieldDefs) {
+  const schema = {
+    name,
+    fields: fieldDefs,
+    validate(data) {
+      const errors = [];
+      const result = {};
+      for (const [field, rules] of Object.entries(fieldDefs)) {
+        let val = data[field];
+        if (rules.auto && rules.type === 'id' && val === undefined) { result[field] = randomUUID(); continue; }
+        if (rules.auto && rules.type === 'timestamp' && val === undefined) { result[field] = new Date().toISOString(); continue; }
+        if (val === undefined && rules.default !== undefined) val = rules.default;
+        if (rules.required && (val === undefined || val === null || val === '')) { errors.push(`${field} is required`); continue; }
+        if (val === undefined || val === null) continue;
+        if (rules.type === 'string') {
+          if (typeof val !== 'string') { errors.push(`${field} must be a string`); continue; }
+          if (rules.min !== undefined && val.length < rules.min) errors.push(`${field} must be at least ${rules.min} characters`);
+          if (rules.max !== undefined && val.length > rules.max) errors.push(`${field} must be at most ${rules.max} characters`);
+          if (rules.email && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(val)) errors.push(`${field} must be a valid email`);
+          if (rules.url && !/^https?:\/\/.+/.test(val)) errors.push(`${field} must be a valid URL`);
+          if (rules.match && !rules.match.test(val)) errors.push(`${field} format is invalid`);
+        }
+        if (rules.type === 'number' || rules.type === 'integer') {
+          const n = Number(val);
+          if (isNaN(n)) { errors.push(`${field} must be a number`); continue; }
+          if (rules.type === 'integer' && !Number.isInteger(n)) errors.push(`${field} must be an integer`);
+          if (rules.min !== undefined && n < rules.min) errors.push(`${field} must be at least ${rules.min}`);
+          if (rules.max !== undefined && n > rules.max) errors.push(`${field} must be at most ${rules.max}`);
+          val = n;
+        }
+        if (rules.type === 'boolean') val = Boolean(val);
+        if (rules.type === 'enum' && !rules.values.includes(val)) errors.push(`${field} must be one of: ${rules.values.join(', ')}`);
+        result[field] = val;
+      }
+      return errors.length > 0 ? { valid: false, errors } : { valid: true, data: result };
+    },
+    defaults() {
+      const d = {};
+      for (const [field, rules] of Object.entries(fieldDefs)) {
+        if (rules.default !== undefined) d[field] = rules.default;
+        if (rules.auto && rules.type === 'id') d[field] = randomUUID();
+        if (rules.auto && rules.type === 'timestamp') d[field] = new Date().toISOString();
+      }
+      return d;
+    }
+  };
+  return schema;
+}
+
+// ===== In-Memory Store =====
+export function createStore(schema) {
+  const items = new Map();
+  let _idField = null;
+  for (const [f, r] of Object.entries(schema.fields)) {
+    if (r.auto && r.type === 'id') { _idField = f; break; }
+  }
+  const idField = _idField || 'id';
+
+  return {
+    getAll() { return [...items.values()]; },
+    getById(id) { return items.get(String(id)) || null; },
+    count() { return items.size; },
+    create(data) {
+      const { valid, errors, data: validated } = schema.validate(data);
+      if (!valid) return { error: errors };
+      const id = validated[idField] || randomUUID();
+      validated[idField] = id;
+      items.set(String(id), validated);
+      return validated;
+    },
+    update(id, data) {
+      const existing = items.get(String(id));
+      if (!existing) return null;
+      const merged = { ...existing, ...data, [idField]: existing[idField] };
+      items.set(String(id), merged);
+      return merged;
+    },
+    delete(id) {
+      return items.delete(String(id));
+    },
+    where(conditions) {
+      return [...items.values()].filter(item => {
+        for (const [k, v] of Object.entries(conditions)) {
+          if (item[k] !== v) return false;
+        }
+        return true;
+      });
+    },
+    clear() { items.clear(); }
+  };
+}
+
+// ===== CRUD Route Registration =====
+export function registerCrud(app, basePath, schema, store, eventBus) {
+  app.get(basePath, (_req, res) => {
+    res.json(store.getAll());
+  });
+
+  app.get(`${basePath}/:id`, (req, res) => {
+    const item = store.getById(req.params.id);
+    if (!item) return res.status(404).json({ error: `${schema.name} not found` });
+    res.json(item);
+  });
+
+  app.post(basePath, (req, res) => {
+    const result = store.create(req.body);
+    if (result.error) return res.status(400).json({ errors: result.error });
+    if (eventBus) eventBus.emit(`${schema.name}.create`, result);
+    res.status(201).json(result);
+  });
+
+  app.put(`${basePath}/:id`, (req, res) => {
+    const item = store.getById(req.params.id);
+    if (!item) return res.status(404).json({ error: `${schema.name} not found` });
+    const updated = store.update(req.params.id, req.body);
+    if (eventBus) eventBus.emit(`${schema.name}.update`, updated);
+    res.json(updated);
+  });
+
+  app.delete(`${basePath}/:id`, (req, res) => {
+    const item = store.getById(req.params.id);
+    if (!item) return res.status(404).json({ error: `${schema.name} not found` });
+    store.delete(req.params.id);
+    if (eventBus) eventBus.emit(`${schema.name}.delete`, { id: req.params.id });
+    res.json({ deleted: true });
+  });
+}
+
+// ===== JWT Auth =====
+function base64url(buf) {
+  return Buffer.from(buf).toString('base64url');
+}
+
+export function jwtSign(payload, secret, expiresIn = '24h') {
+  const header = base64url(JSON.stringify({ alg: 'HS256', typ: 'JWT' }));
+  const ms = typeof expiresIn === 'number' ? expiresIn : parseMs(expiresIn);
+  const body = base64url(JSON.stringify({ ...payload, iat: Math.floor(Date.now() / 1000), exp: Math.floor((Date.now() + ms) / 1000) }));
+  const sig = createHmac('sha256', secret).update(`${header}.${body}`).digest('base64url');
+  return `${header}.${body}.${sig}`;
+}
+
+export function jwtVerify(token, secret) {
+  const parts = token.split('.');
+  if (parts.length !== 3) throw new Error('Invalid token');
+  const sig = createHmac('sha256', secret).update(`${parts[0]}.${parts[1]}`).digest('base64url');
+  const sigBuf = Buffer.from(sig);
+  const tokenSigBuf = Buffer.from(parts[2]);
+  if (sigBuf.length !== tokenSigBuf.length || !timingSafeEqual(sigBuf, tokenSigBuf)) throw new Error('Invalid signature');
+  const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString());
+  if (payload.exp && payload.exp < Math.floor(Date.now() / 1000)) throw new Error('Token expired');
+  return payload;
+}
+
+export function jwtAuth(secret, options = {}) {
+  const publicPaths = (options.public || []).map(p => new RegExp('^' + p.replace(/\*/g, '.*') + '$'));
+  return (req, res, next) => {
+    const isPublic = publicPaths.some(re => re.test(req.path));
+    if (isPublic) return next();
+    const authHeader = req.headers.authorization;
+    if (!authHeader || !authHeader.startsWith('Bearer ')) return res.status(401).json({ error: 'No token provided' });
+    try {
+      req.user = jwtVerify(authHeader.slice(7), secret);
+      next();
+    } catch (e) {
+      res.status(403).json({ error: e.message });
+    }
+  };
+}
+
+// ===== CORS Middleware =====
+export function corsMiddleware(origins = ['*']) {
+  const allowAll = origins.includes('*');
+  const originSet = new Set(origins.map(o => o.replace(/^https?:\/\//, '')));
+  return (req, res, next) => {
+    const reqOrigin = req.headers.origin || '';
+    const host = reqOrigin.replace(/^https?:\/\//, '');
+    if (allowAll || originSet.has(host)) {
+      res.setHeader('Access-Control-Allow-Origin', reqOrigin || '*');
+      res.setHeader('Access-Control-Allow-Methods', 'GET,POST,PUT,DELETE,PATCH,OPTIONS');
+      res.setHeader('Access-Control-Allow-Headers', 'Content-Type,Authorization');
+      res.setHeader('Access-Control-Allow-Credentials', 'true');
+    }
+    if (req.method === 'OPTIONS') return res.status(204).end();
+    next();
+  };
+}
+
+// ===== Rate Limiting =====
+export function rateLimit(max, window = '1m') {
+  const windowMs = parseMs(window);
+  const hits = new Map();
+  setInterval(() => hits.clear(), windowMs);
+  return (req, res, next) => {
+    const key = req.ip;
+    const count = (hits.get(key) || 0) + 1;
+    hits.set(key, count);
+    res.setHeader('X-RateLimit-Limit', max);
+    res.setHeader('X-RateLimit-Remaining', Math.max(0, max - count));
+    if (count > max) return res.status(429).json({ error: 'Too many requests' });
+    next();
+  };
+}
+
+// ===== Env =====
+export function loadEnv(spec) {
+  const env = {};
+  for (const [key, rules] of Object.entries(spec)) {
+    let val = process.env[key];
+    if (val === undefined && rules.default !== undefined) val = String(rules.default);
+    if (rules.required && val === undefined) {
+      console.error(`[NAIDE] Missing required env var: ${key}`);
+      process.exit(1);
+    }
+    if (val !== undefined) {
+      if (rules.type === 'number' || rules.type === 'integer') val = Number(val);
+      if (rules.type === 'boolean') val = val === 'true' || val === '1';
+    }
+    env[key] = val;
+  }
+  return env;
+}
+
+// ===== Cron / Scheduler =====
+export function scheduleEvery(interval, fn) {
+  const ms = parseMs(interval);
+  const timer = setInterval(async () => {
+    try { await fn(); } catch (e) { console.error('[NAIDE Cron]', e.message); }
+  }, ms);
+  fn();
+  return timer;
+}
+
+// ===== Event Bus (for watch) =====
+export function createEventBus() {
+  const listeners = new Map();
+  return {
+    on(event, fn) {
+      if (!listeners.has(event)) listeners.set(event, []);
+      listeners.get(event).push(fn);
+    },
+    emit(event, data) {
+      const fns = listeners.get(event) || [];
+      for (const fn of fns) {
+        try { fn({ event, data, timestamp: new Date().toISOString() }); } catch (e) { console.error('[NAIDE Event]', e.message); }
+      }
+    }
+  };
+}
+
+// ===== Helpers =====
+function parseMs(str) {
+  if (typeof str === 'number') return str;
+  const m = str.match(/^(\d+)(ms|s|m|h|d)$/);
+  if (!m) return 60000;
+  const n = parseInt(m[1]);
+  switch (m[2]) {
+    case 'ms': return n;
+    case 's': return n * 1000;
+    case 'm': return n * 60000;
+    case 'h': return n * 3600000;
+    case 'd': return n * 86400000;
+    default: return 60000;
+  }
+}

package/src/tokens.js

@@ -57,6 +57,14 @@ export const T = {
   BREAK: 'BREAK',
   CONTINUE: 'CONTINUE',
   THROW: 'THROW',
+  SCHEMA: 'SCHEMA',
+  CRUD: 'CRUD',
+  AUTH: 'AUTH',
+  CORS: 'CORS',
+  LIMIT: 'LIMIT',
+  ENV: 'ENV',
+  EVERY: 'EVERY',
+  WATCH: 'WATCH',
 
   // Operators
   ASSIGN: 'ASSIGN',
@@ -142,6 +150,14 @@ export const KEYWORDS = {
   'break': T.BREAK,
   'continue': T.CONTINUE,
   'throw': T.THROW,
+  'schema': T.SCHEMA,
+  'crud': T.CRUD,
+  'auth': T.AUTH,
+  'cors': T.CORS,
+  'limit': T.LIMIT,
+  'env': T.ENV,
+  'every': T.EVERY,
+  'watch': T.WATCH,
   'true': T.BOOL,
   'false': T.BOOL,
   'null': T.NULL,