naider 1.21.1 → 1.24.0

package/src/gen.js

@@ -93,7 +93,7 @@ const COMPOSITE_WORDS = {
 const NOISE = new Set([
   'a', 'an', 'the', 'for', 'with', 'and', 'or', 'on', 'at', 'to', 'of', 'in', 'by',
   'that', 'which', 'this', 'it', 'its', 'my', 'is', 'are', 'has', 'have', 'do', 'does',
-  'make', 'create', 'build', 'generate', 'add', 'implement', 'simple', 'basic', 'new',
+  'make', 'create', 'build', 'generate', 'add', 'implement', 'simple', 'basic', 'new', 'remove', 'delete', 'drop',
   'please', 'want', 'need', 'like', 'just', 'some', 'using', 'use', 'based',
   'setup', 'set', 'up', 'get', 'should', 'can', 'could', 'would',
   'の', 'を', 'に', 'で', 'は', 'が', 'と', 'も', 'から', 'まで', 'より', 'って',
@@ -266,6 +266,65 @@ function applyRelationships(entities, relationships) {
   }
 }
 
+// ── Many-to-Many Relationships ────────────────────────────
+
+const MANY_TO_MANY = {
+  'User-Product': { junction: 'Favorite', fkLeft: 'user_id', fkRight: 'product_id' },
+  'User-Team':    { junction: 'TeamMember', fkLeft: 'user_id', fkRight: 'team_id' },
+  'Post-Category':{ junction: 'PostTag', fkLeft: 'post_id', fkRight: 'category_id' },
+  'Product-Category':{ junction: 'ProductCategory', fkLeft: 'product_id', fkRight: 'category_id' },
+  'User-Group':   { junction: 'GroupMember', fkLeft: 'user_id', fkRight: 'group_id' },
+};
+
+function detectManyToMany(entityNames) {
+  const rels = [];
+  for (let i = 0; i < entityNames.length; i++) {
+    for (let j = i + 1; j < entityNames.length; j++) {
+      const key1 = entityNames[i] + '-' + entityNames[j];
+      const key2 = entityNames[j] + '-' + entityNames[i];
+      const match = MANY_TO_MANY[key1] || MANY_TO_MANY[key2];
+      if (match) rels.push({ left: entityNames[i], right: entityNames[j], ...match });
+    }
+  }
+  return rels;
+}
+
+function junctionSchemaBlock(rel) {
+  return `schema ${rel.junction}:\n  id        auto\n  ${rel.fkLeft.padEnd(10)}int required\n  ${rel.fkRight.padEnd(10)}int required\n  created   auto`;
+}
+
+function manyToManyRoutes(rel) {
+  const leftPlural = pluralize(rel.left.toLowerCase());
+  const rightPlural = pluralize(rel.right.toLowerCase());
+  const store = rel.junction + 'Store';
+  return [
+    `get "/api/${leftPlural}/:id/${rightPlural}" (req, res):`,
+    `  list links = ${store}.findAll("${rel.fkLeft}", req.params.id)`,
+    `  ret links`,
+    ``,
+    `post "/api/${leftPlural}/:id/${rightPlural}" (req, res):`,
+    `  any link = ${store}.create({${rel.fkLeft}: req.params.id, ${rel.fkRight}: req.body.${rel.fkRight}})`,
+    `  ret ok(link, null)`,
+    ``,
+    `del "/api/${leftPlural}/:id/${rightPlural}/:linkId" (req, res):`,
+    `  ${store}.remove(req.params.linkId)`,
+    `  ret ok({removed: true}, null)`,
+    ``,
+    `get "/api/${rightPlural}/:id/${leftPlural}" (req, res):`,
+    `  list links = ${store}.findAll("${rel.fkRight}", req.params.id)`,
+    `  ret links`,
+  ];
+}
+
+// ── Enum Fields ───────────────────────────────────────────
+
+const ENUM_VALUES = {
+  status:     ['pending', 'active', 'completed', 'cancelled'],
+  priority:   ['low', 'medium', 'high', 'critical'],
+  role:       ['user', 'admin', 'moderator'],
+  visibility: ['public', 'private', 'unlisted'],
+};
+
 // ── Utilities ───────────────────────────────────────────────
 
 function singularize(w) {
@@ -382,6 +441,16 @@ function classify(words, raw) {
     return !NOISE.has(wl) && !allKnown.has(wl) && !/^\d+$/.test(wl) && wl.length > 2 && /^[a-z]+s?$/i.test(wl);
   }) || Object.keys(JA_ENTITIES).some(ja => raw.includes(ja));
 
+  // Entity removal detection (B8)
+  if (/(?:remove|delete|drop|取り除|削除)\s+/i.test(raw)) {
+    mods.removal = true;
+  }
+
+  // API versioning detection (B13)
+  if (/(?:version|v\d|versioning|バージョン)/i.test(raw)) {
+    mods.apiVersion = 'v1';
+  }
+
   // Complex NL phrase detection
   if (/(?:users?\s+can\s+(?:comment|post|review|write)|コメントできる|投稿できる|レビューできる)/i.test(raw)) {
     intents.add('auth'); intents.add('crud');
@@ -474,7 +543,6 @@ function extractParams(words, raw, intents, mods) {
         if (!wl || NOISE.has(wl) || allKnown.has(wl) || /^\d+$/.test(wl) || wl.length <= 2) continue;
         const name = capitalize(singularize(wl));
         if (!entityNames.includes(name)) entityNames.push(name);
-        break;
       }
     }
   }
@@ -540,6 +608,7 @@ function extractParams(words, raw, intents, mods) {
   if (params.entities.length > 1) {
     params.relationships = detectRelationships(params.entities);
     applyRelationships(params.entities, params.relationships);
+    params.m2mRelationships = detectManyToMany(params.entities.map(e => e.name));
   }
 
   // Extract bot commands
@@ -649,16 +718,33 @@ function paginatedListBlock(entity) {
   const store = entity.name + 'Store';
   return [
     `get "/api/${plural}" (req, res):`,
-    `  int page = req.query.page || 1`,
-    `  int limit = req.query.limit || 20`,
-    `  str search = req.query.search || ""`,
-    `  list all = ${store}.all()`,
+    `  int page = req.query.page or 1`,
+    `  int limit = req.query.limit or 20`,
+    `  str search = req.query.search or ""`,
+    `  str sortBy = req.query.sort or "id"`,
+    `  str order = req.query.order or "desc"`,
+    `  mut list rows = ${store}.all()`,
     `  if search:`,
-    `    all = all.filter((item) => JSON.stringify(item).includes(search))`,
-    `  int total = all.length`,
-    `  int start = (page - 1) * limit`,
-    `  list items = all.slice(start, start + limit)`,
-    `  ret {items, total, page, limit}`,
+    `    rows = rows.filter((item) => JSON.stringify(item).toLowerCase().includes(search.toLowerCase()))`,
+    `  each key in Object.keys(req.query):`,
+    `    if key.endsWith("_gte"):`,
+    `      str field = key.replace("_gte", "")`,
+    `      rows = rows.filter((item) => item[field] >= Number(req.query[key]))`,
+    `    if key.endsWith("_lte"):`,
+    `      str field = key.replace("_lte", "")`,
+    `      rows = rows.filter((item) => item[field] <= Number(req.query[key]))`,
+    `    if key.endsWith("_eq"):`,
+    `      str field = key.replace("_eq", "")`,
+    `      rows = rows.filter((item) => String(item[field]) == req.query[key])`,
+    `  if order == "asc":`,
+    `    rows = rows.sort((a, b) => String(a[sortBy]).localeCompare(String(b[sortBy])))`,
+    `  else:`,
+    `    rows = rows.sort((a, b) => String(b[sortBy]).localeCompare(String(a[sortBy])))`,
+    `  int total = rows.length`,
+    `  int offset = page - 1`,
+    `  int start = offset * limit`,
+    `  list items = rows.slice(start, start + limit)`,
+    `  ret {items, total, page, limit, sort: sortBy, order}`,
   ];
 }
 
@@ -817,7 +903,9 @@ function openApiSpec(entities, intents, params, relationships) {
         { name: 'page', in: 'query', schema: { type: 'integer', default: 1 } },
         { name: 'limit', in: 'query', schema: { type: 'integer', default: 20 } },
         { name: 'search', in: 'query', schema: { type: 'string' } },
-      ], responses: { '200': { description: `List of ${plural}` } } },
+        { name: 'sort', in: 'query', schema: { type: 'string' }, description: 'Field to sort by' },
+        { name: 'order', in: 'query', schema: { type: 'string', enum: ['asc','desc'], default: 'asc' } },
+      ], responses: { '200': { description: `List of ${plural} with pagination` } } },
       post: { summary: `Create ${entity.name.toLowerCase()}`, requestBody: { content: { 'application/json': { schema: {
         type: 'object', required: requiredFields.map(f => f.name),
         properties: Object.fromEntries(requiredFields.map(f => [f.name, properties[f.name]])),
@@ -847,12 +935,24 @@ function openApiSpec(entities, intents, params, relationships) {
     };
   }
   if (intents.has('auth')) {
-    paths['/api/auth/register'] = { post: { summary: 'Register', responses: { '200': { description: 'Token + user' } } } };
-    paths['/api/auth/login'] = { post: { summary: 'Login', responses: { '200': { description: 'Token + user' } } } };
+    paths['/api/auth/register'] = { post: { summary: 'Register', requestBody: { content: { 'application/json': { schema: { type: 'object', required: ['email','password'], properties: { email:{type:'string'}, password:{type:'string'}, name:{type:'string'} } } } } }, responses: { '200': { description: 'Token + user' }, '400': { description: 'Validation error' } } } };
+    paths['/api/auth/login'] = { post: { summary: 'Login', requestBody: { content: { 'application/json': { schema: { type: 'object', required: ['email','password'], properties: { email:{type:'string'}, password:{type:'string'} } } } } }, responses: { '200': { description: 'Token + user' }, '401': { description: 'Invalid credentials' } } } };
     paths['/api/auth/me'] = { get: { summary: 'Current user', security: [{ bearerAuth: [] }], responses: { '200': { description: 'User' } } } };
+    paths['/api/auth/forgot-password'] = { post: { summary: 'Request password reset', requestBody: { content: { 'application/json': { schema: { type: 'object', required: ['email'], properties: { email:{type:'string'} } } } } }, responses: { '200': { description: 'Reset token sent' } } } };
+    paths['/api/auth/reset-password'] = { post: { summary: 'Reset password with token', requestBody: { content: { 'application/json': { schema: { type: 'object', required: ['token','password'], properties: { token:{type:'string'}, password:{type:'string'} } } } } }, responses: { '200': { description: 'Password reset' }, '400': { description: 'Invalid token' } } } };
+    paths['/api/auth/change-password'] = { post: { summary: 'Change password (authenticated)', security: [{ bearerAuth: [] }], requestBody: { content: { 'application/json': { schema: { type: 'object', required: ['oldPassword','newPassword'], properties: { oldPassword:{type:'string'}, newPassword:{type:'string'} } } } } }, responses: { '200': { description: 'Password changed' }, '401': { description: 'Wrong password' } } } };
+  }
+  const m2m = detectManyToMany(entities.map(e => e.name));
+  for (const rel of m2m) {
+    const lp = pluralize(rel.left.toLowerCase());
+    const rp = pluralize(rel.right.toLowerCase());
+    paths[`/api/${lp}/{id}/${rp}`] = { get: { summary: `${rel.right}s for ${rel.left}`, responses: { '200': { description: `List of ${rp}` } } } };
+    paths[`/api/${rp}/{id}/${lp}`] = { get: { summary: `${rel.left}s for ${rel.right}`, responses: { '200': { description: `List of ${lp}` } } } };
+    paths[`/api/${rel.junction.toLowerCase()}`] = { post: { summary: `Link ${rel.left}↔${rel.right}`, responses: { '201': { description: 'Linked' } } }, delete: { summary: `Unlink ${rel.left}↔${rel.right}`, responses: { '200': { description: 'Unlinked' } } } };
   }
   paths['/api/health'] = { get: { summary: 'Health check', responses: { '200': { description: 'Status' } } } };
   paths['/api/upload'] = { post: { summary: 'Upload file', responses: { '200': { description: 'File info' } } } };
+  paths['/docs'] = { get: { summary: 'Swagger UI documentation', responses: { '200': { description: 'HTML page' } } } };
 
   const spec = {
     openapi: '3.0.3',
@@ -991,6 +1091,446 @@ function apiClientCode(entities, intents, port) {
   return lines.join('\n') + '\n';
 }
 
+// ── Input Validation (A4) ──────────────────────────────────
+
+function validationBlock(entity) {
+  const lines = [];
+  lines.push(`fn validate${entity.name}(any body):`);
+  lines.push(`  list errors = []`);
+  for (const f of entity.fields) {
+    if (f.type === 'auto') continue;
+    if (f.modifiers.includes('required')) {
+      lines.push(`  if not body.${f.name}:`);
+      lines.push(`    errors.push("${f.name} is required")`);
+    }
+    if (f.modifiers.includes('email')) {
+      lines.push(`  if body.${f.name} and not body.${f.name}.includes("@"):`);
+      lines.push(`    errors.push("${f.name} must be a valid email")`);
+    }
+    const minMod = f.modifiers.find(m => m.startsWith('min('));
+    if (minMod) {
+      const minVal = minMod.match(/\d+/)[0];
+      if (f.type === 'str') {
+        lines.push(`  if body.${f.name} and body.${f.name}.length < ${minVal}:`);
+        lines.push(`    errors.push("${f.name} must be at least ${minVal} characters")`);
+      }
+    }
+    const maxMod = f.modifiers.find(m => m.startsWith('max('));
+    if (maxMod) {
+      const maxVal = maxMod.match(/\d+/)[0];
+      if (f.type === 'str') {
+        lines.push(`  if body.${f.name} and body.${f.name}.length > ${maxVal}:`);
+        lines.push(`    errors.push("${f.name} must be at most ${maxVal} characters")`);
+      }
+    }
+    if (ENUM_VALUES[f.name]) {
+      const vals = ENUM_VALUES[f.name].map(v => `"${v}"`).join(', ');
+      lines.push(`  if body.${f.name} and not [${vals}].includes(body.${f.name}):`);
+      lines.push(`    errors.push("${f.name} must be one of: ${ENUM_VALUES[f.name].join(', ')}")`);
+    }
+  }
+  lines.push(`  ret errors`);
+  return lines.join('\n');
+}
+
+function validatedCreateRoute(entity) {
+  const lower = entity.name.toLowerCase();
+  const plural = pluralize(lower);
+  const store = entity.name + 'Store';
+  return [
+    `post "/api/${plural}" (req, res):`,
+    `  list errors = validate${entity.name}(req.body)`,
+    `  if errors.length > 0:`,
+    `    ret.status(400) {ok: false, errors}`,
+    `  any created = ${store}.create(req.body)`,
+    `  ret.status(201) ok(created, null)`,
+    ``,
+    `put "/api/${plural}/:id" (req, res):`,
+    `  list errors = validate${entity.name}(req.body)`,
+    `  if errors.length > 0:`,
+    `    ret.status(400) {ok: false, errors}`,
+    `  any updated = ${store}.update(req.params.id, req.body)`,
+    `  ret ok(updated, null)`,
+  ];
+}
+
+// ── Swagger UI Route (A5) ──────────────────────────────────
+
+function swaggerUIRoute() {
+  return [
+    `get "/docs" (req, res):`,
+    `  str html = "<!DOCTYPE html><html><head><title>API Docs</title><link rel=stylesheet href=https://unpkg.com/swagger-ui-dist/swagger-ui.css></head><body><div id=swagger-ui></div><script src=https://unpkg.com/swagger-ui-dist/swagger-ui-bundle.js></script><script>SwaggerUIBundle({url:'/api/openapi.json',dom_id:'#swagger-ui'})</script></body></html>"`,
+    `  res.type("html")`,
+    `  ret html`,
+  ];
+}
+
+// ── Password Reset Routes (A6) ─────────────────────────────
+
+function passwordResetRoutes() {
+  return [
+    `post "/api/auth/forgot-password" (req, res):`,
+    `  any user = UserStore.findBy("email", req.body.email)`,
+    `  if not user:`,
+    `    ret ok({message: "If the email exists, a reset link has been sent"}, null)`,
+    `  str resetToken = crypto.randomUUID()`,
+    `  UserStore.update(user.id, {resetToken})`,
+    `  log("Password reset requested for: " + req.body.email)`,
+    `  ret ok({message: "If the email exists, a reset link has been sent"}, null)`,
+    ``,
+    `post "/api/auth/reset-password" (req, res):`,
+    `  if not req.body.token or not req.body.password:`,
+    `    ret.status(400) err("Token and password are required", 400)`,
+    `  any user = UserStore.findBy("resetToken", req.body.token)`,
+    `  if not user:`,
+    `    ret.status(400) err("Invalid or expired token", 400)`,
+    `  str hashed = await hash(req.body.password)`,
+    `  UserStore.update(user.id, {password: hashed, resetToken: null})`,
+    `  ret ok({message: "Password has been reset"}, null)`,
+    ``,
+    `post "/api/auth/change-password" (req, res):`,
+    `  if not req.body.oldPassword or not req.body.newPassword:`,
+    `    ret.status(400) err("Old and new passwords are required", 400)`,
+    `  bool valid = await verify(req.body.oldPassword, req.user.password)`,
+    `  if not valid:`,
+    `    ret.status(401) err("Invalid old password", 401)`,
+    `  str hashed = await hash(req.body.newPassword)`,
+    `  UserStore.update(req.user.id, {password: hashed})`,
+    `  ret ok({message: "Password changed"}, null)`,
+  ];
+}
+
+// ── WebSocket Rooms (B11) ──────────────────────────────────
+
+function wsRoomsBlock(hasAuth) {
+  const lines = [
+    `ws "/ws":`,
+    `  on "connection" (socket, req):`,
+  ];
+  if (hasAuth) {
+    lines.push(
+      `    # WS auth: verify token from query string`,
+      `    str wsToken = ""`,
+      `    if req.url and req.url.includes("token="):`,
+      `      str qs = req.url.split("token=")[1] or ""`,
+      `      int ampIdx = qs.indexOf("&")`,
+      `      if ampIdx > 0:`,
+      `        wsToken = qs.slice(0, ampIdx)`,
+      `      else:`,
+      `        wsToken = qs`,
+      `    if wsToken:`,
+      `      any wsDecoded = jwt.verify(wsToken, JWT_SECRET)`,
+      `      if wsDecoded:`,
+      `        socket.user = wsDecoded`,
+      `        socket.authenticated = true`,
+      `      else:`,
+      `        socket.authenticated = false`,
+      `        socket.send(JSON.stringify({type: "error", message: "Invalid token"}))`,
+      `        socket.close()`,
+      `    else:`,
+      `      socket.authenticated = false`,
+    );
+  }
+  lines.push(
+    `    socket.room = "general"`,
+    `    log("Client connected to room: general")`,
+    `  on "message" (data, socket):`,
+  );
+  if (hasAuth) {
+    lines.push(
+      `    if not socket.authenticated:`,
+      `      socket.send(JSON.stringify({type: "error", message: "Not authenticated"}))`,
+      `      ret`,
+    );
+  }
+  lines.push(
+    `    any msg = JSON.parse(data)`,
+    `    if msg.type == "join":`,
+    `      socket.room = msg.room`,
+    `      socket.send(JSON.stringify({type: "joined", room: msg.room}))`,
+    `    if msg.type == "leave":`,
+    `      socket.room = "general"`,
+    `    if msg.type == "message":`,
+    `      broadcast({type: "message", room: socket.room, data: msg.data, sender: msg.sender}, socket.room)`,
+    `    if msg.type == "broadcast":`,
+    `      broadcast(msg.data)`,
+    `  on "close" (socket):`,
+    `    log("Client disconnected")`,
+  );
+  return lines;
+}
+
+// ── Rate Limiting (B12) ────────────────────────────────────
+
+function rateLimitBlock() {
+  return `fn rateLimit(int windowMs, int maxReqs):
+  map hits = {}
+  ret fn(req, res, next):
+    str key = req.ip
+    int now = Date.now()
+    if not hits[key] or now - hits[key].start > windowMs:
+      hits[key] = {count: 1, start: now}
+    else:
+      hits[key].count = hits[key].count + 1
+    if hits[key].count > maxReqs:
+      ret.status(429) {error: "Too many requests"}
+    next()`;
+}
+
+// ── Logging Middleware (C17) ───────────────────────────────
+
+function loggingBlock() {
+  return `fn requestLogger(req, res, next):
+  int startTime = Date.now()
+  log("[" + req.method + "] " + req.path)
+  next()`;
+}
+
+// ── RBAC Middleware (D1) ──────────────────────────────────
+
+function rbacBlock() {
+  return `fn requireRole(list allowed):
+  ret fn(req, res, next):
+    if not req.user:
+      ret.status(401) {error: "Not authenticated"}
+    str userRole = req.user.role or "user"
+    if not allowed.includes(userRole):
+      ret.status(403) {error: "Insufficient permissions"}
+    next()`;
+}
+
+function rbacRouteGuards(entity) {
+  const lower = entity.name.toLowerCase();
+  const plural = pluralize(lower);
+  return [
+    `# Role guards for ${plural}`,
+    `del "/api/${plural}/:id" (req, res):`,
+    `  str role = req.user.role or "user"`,
+    `  if role != "admin" and role != "moderator":`,
+    `    ret.status(403) {error: "Only admin/moderator can delete"}`,
+    `  ${entity.name}Store.remove(req.params.id)`,
+    `  ret {deleted: true}`,
+  ];
+}
+
+// ── Caching Headers (C18) ─────────────────────────────────
+
+function cachingRoute() {
+  return [
+    `get "/api/cache-headers" (req, res):`,
+    `  res.set("Cache-Control", "public, max-age=60")`,
+    `  ret {cached: true, ttl: 60}`,
+  ];
+}
+
+// ── Frontend SPA (S2) ─────────────────────────────────────
+
+function frontendSPA(entities, intents, port) {
+  const L = [];
+  L.push('<!DOCTYPE html>');
+  L.push('<html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1">');
+  L.push('<title>App</title>');
+  L.push(`<style>
+:root{--bg:#f8fafc;--card:#fff;--primary:#2563eb;--danger:#dc2626;--text:#1e293b;--muted:#64748b;--border:#e2e8f0;--radius:8px}
+*{margin:0;padding:0;box-sizing:border-box}body{font-family:system-ui,-apple-system,sans-serif;background:var(--bg);color:var(--text);line-height:1.6}
+nav{background:var(--primary);color:#fff;padding:1rem 2rem;display:flex;gap:1rem;align-items:center;box-shadow:0 2px 4px rgba(0,0,0,.1)}
+nav a{color:#fff;text-decoration:none;padding:.4rem 1rem;border-radius:var(--radius);opacity:.8;cursor:pointer}nav a:hover,nav a.active{opacity:1;background:rgba(255,255,255,.15)}
+.container{max-width:1200px;margin:2rem auto;padding:0 1rem}
+.card{background:var(--card);border:1px solid var(--border);border-radius:var(--radius);padding:1.5rem;margin-bottom:1rem;box-shadow:0 1px 3px rgba(0,0,0,.05)}
+.grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(300px,1fr));gap:1rem}
+.form-group{margin-bottom:1rem}
+.form-group label{display:block;font-weight:500;margin-bottom:.25rem;font-size:.875rem}
+.form-group input,.form-group textarea,.form-group select{width:100%;padding:.5rem .75rem;border:1px solid var(--border);border-radius:var(--radius);font-size:.875rem}
+.form-group textarea{min-height:80px;resize:vertical}
+.btn{padding:.5rem 1rem;border:none;border-radius:var(--radius);cursor:pointer;font-size:.875rem;font-weight:500;transition:opacity .2s}
+.btn-primary{background:var(--primary);color:#fff}.btn-danger{background:var(--danger);color:#fff}
+.btn:hover{opacity:.85}.btn-sm{padding:.25rem .5rem;font-size:.75rem}
+table{width:100%;border-collapse:collapse}th,td{padding:.75rem;text-align:left;border-bottom:1px solid var(--border)}
+th{background:var(--bg);font-weight:600;font-size:.875rem;color:var(--muted)}
+.search{display:flex;gap:.5rem;margin-bottom:1rem}
+.search input{flex:1;padding:.5rem .75rem;border:1px solid var(--border);border-radius:var(--radius)}
+.pagination{display:flex;gap:.5rem;justify-content:center;margin-top:1rem;align-items:center}
+.toast{position:fixed;top:1rem;right:1rem;background:#22c55e;color:#fff;padding:.75rem 1.5rem;border-radius:var(--radius);opacity:0;transition:opacity .3s;z-index:999}
+.toast.show{opacity:1}.toast.error{background:var(--danger)}.toast.warn{background:#f59e0b}
+.loading{text-align:center;padding:2rem;color:var(--muted)}.loading::after{content:"";display:inline-block;width:1.5rem;height:1.5rem;border:2px solid var(--border);border-top-color:var(--primary);border-radius:50%;animation:spin .6s linear infinite;margin-left:.5rem}
+@keyframes spin{to{transform:rotate(360deg)}}
+.error-banner{background:#fef2f2;border:1px solid #fecaca;color:#991b1b;padding:.75rem 1rem;border-radius:var(--radius);margin-bottom:1rem;font-size:.875rem}
+.modal-bg{position:fixed;inset:0;background:rgba(0,0,0,.4);display:flex;align-items:center;justify-content:center;z-index:100}
+.modal{background:var(--card);border-radius:var(--radius);padding:2rem;width:90%;max-width:500px;box-shadow:0 20px 60px rgba(0,0,0,.2)}
+.modal h3{margin-bottom:1rem}.modal-actions{display:flex;gap:.5rem;justify-content:flex-end;margin-top:1.5rem}
+.badge{display:inline-block;padding:.15rem .5rem;border-radius:99px;font-size:.75rem;font-weight:500;background:var(--border)}
+.hidden{display:none}
+</style></head><body>`);
+  L.push('<div id="toast" class="toast"></div>');
+  const hasAuth = intents.has('auth');
+  const navLinks = entities.map(e => `<a onclick="showSection('${e.name.toLowerCase()}')" id="nav-${e.name.toLowerCase()}">${pluralize(e.name)}</a>`).join('');
+  const authNav = hasAuth ? `<a onclick="showSection('auth')" id="nav-auth">Login</a><span id="user-info" class="hidden" style="margin-left:auto;font-size:.875rem"></span><a id="logout-btn" class="hidden" onclick="doLogout()">Logout</a>` : '';
+  L.push(`<nav><strong style="font-size:1.25rem">App</strong>${navLinks}${authNav}</nav>`);
+  L.push('<div class="container">');
+  if (hasAuth) {
+    L.push(`<div id="section-auth"><div class="card" style="max-width:400px;margin:2rem auto"><h2 id="auth-title">Login</h2>`);
+    L.push(`<div class="form-group"><label>Email</label><input type="email" id="auth-email" placeholder="email@example.com"></div>`);
+    L.push(`<div class="form-group"><label>Password</label><input type="password" id="auth-password" placeholder="password"></div>`);
+    L.push(`<div id="auth-name-group" class="form-group hidden"><label>Name</label><input type="text" id="auth-name" placeholder="Your name"></div>`);
+    L.push(`<button class="btn btn-primary" style="width:100%" onclick="doAuth()">Login</button>`);
+    L.push(`<p style="text-align:center;margin-top:1rem;font-size:.875rem">Don't have an account? <a onclick="toggleAuthMode()" style="color:var(--primary);cursor:pointer">Register</a></p>`);
+    L.push(`</div></div>`);
+  }
+  for (const entity of entities) {
+    const lower = entity.name.toLowerCase();
+    const plural = pluralize(lower);
+    const fields = entity.fields.filter(f => f.type !== 'auto');
+    L.push(`<div id="section-${lower}" class="hidden">`);
+    L.push(`<div style="display:flex;justify-content:space-between;align-items:center;margin-bottom:1rem"><h2>${pluralize(entity.name)}</h2><button class="btn btn-primary" onclick="${lower}ShowModal()">+ New ${entity.name}</button></div>`);
+    L.push(`<div class="search"><input id="${lower}-search" placeholder="Search ${plural}..." oninput="${lower}Load()"><select id="${lower}-sort" onchange="${lower}Load()">`);
+    for (const f of entity.fields) L.push(`<option value="${f.name}">${f.name}</option>`);
+    L.push(`</select><select id="${lower}-order" onchange="${lower}Load()"><option value="desc">Newest</option><option value="asc">Oldest</option></select></div>`);
+    L.push(`<div class="card"><table><thead><tr>${entity.fields.map(f => `<th>${f.name}</th>`).join('')}<th>Actions</th></tr></thead><tbody id="${lower}-tbody"></tbody></table>`);
+    L.push(`<div class="pagination" id="${lower}-pager"></div></div>`);
+    L.push(`<div id="${lower}-modal" class="modal-bg hidden" onclick="if(event.target===this)this.classList.add('hidden')"><div class="modal"><h3 id="${lower}-modal-title">New ${entity.name}</h3>`);
+    L.push(`<input type="hidden" id="${lower}-edit-id">`);
+    for (const f of fields) {
+      if (f.type === 'bool') {
+        L.push(`<div class="form-group"><label><input type="checkbox" id="${lower}-f-${f.name}"> ${f.name}</label></div>`);
+      } else {
+        const inputType = f.type === 'int' ? 'number' : f.name === 'password' ? 'password' : f.name === 'email' ? 'email' : 'text';
+        const tag = f.name === 'body' || f.name === 'content' || f.name === 'description' ? 'textarea' : 'input';
+        L.push(`<div class="form-group"><label>${f.name}${f.modifiers.includes('required') ? ' *' : ''}</label><${tag} ${tag === 'input' ? `type="${inputType}" ` : ''}id="${lower}-f-${f.name}" placeholder="${f.name}"></${tag}></div>`);
+      }
+    }
+    L.push(`<div class="modal-actions"><button class="btn" onclick="document.getElementById('${lower}-modal').classList.add('hidden')">Cancel</button><button class="btn btn-primary" onclick="${lower}Save()">Save</button></div></div></div>`);
+    L.push('</div>');
+  }
+  L.push('</div>');
+  L.push('<script>');
+  L.push(`const API="";let currentPage={};let _token=null;let _isRegister=false;`);
+  L.push(`function authHeaders(){const h={"Content-Type":"application/json"};if(_token)h.Authorization="Bearer "+_token;return h}`);
+  L.push(`function toast(m,type){const t=document.getElementById("toast");t.textContent=m;t.className="toast show"+(type?" "+type:"");setTimeout(()=>{t.classList.remove("show")},2500)}`);
+  L.push(`function showError(msg){toast(msg,"error")}`);
+  L.push(`async function apiFetch(url,opts){try{const r=await fetch(url,opts||{headers:authHeaders()});if(r.status===401){${hasAuth?'showError("Session expired — please log in again");doLogout();':''} return null}if(!r.ok){const e=await r.json().catch(()=>({error:"Request failed"}));showError(e.error||"Error "+r.status);return null}return await r.json()}catch(e){showError("Network error: "+e.message);return null}}`);
+  L.push(`function setLoading(id,on){const el=document.getElementById(id);if(el)el.innerHTML=on?'<div class="loading">Loading...</div>':""}`);
+  L.push(`function showBanner(containerId,msg){const el=document.getElementById(containerId);if(!el)return;let b=el.querySelector(".error-banner");if(!b){b=document.createElement("div");b.className="error-banner";el.prepend(b)}b.textContent=msg;setTimeout(()=>b.remove(),5000)}`);
+  L.push(`function showSection(name){document.querySelectorAll('[id^="section-"]').forEach(s=>s.classList.add("hidden"));const el=document.getElementById("section-"+name);if(el)el.classList.remove("hidden");document.querySelectorAll("nav a").forEach(a=>a.classList.remove("active"));const n=document.getElementById("nav-"+name);if(n)n.classList.add("active");if(window[name+"Load"])window[name+"Load"]()}`);
+  if (hasAuth) {
+    L.push(`function toggleAuthMode(){_isRegister=!_isRegister;document.getElementById("auth-title").textContent=_isRegister?"Register":"Login";document.getElementById("auth-name-group").classList.toggle("hidden",!_isRegister)}`);
+    L.push(`async function doAuth(){const email=document.getElementById("auth-email").value;const password=document.getElementById("auth-password").value;if(!email||!password){showError("Email and password are required");return}const url=_isRegister?"/api/auth/register":"/api/auth/login";const body=_isRegister?{name:document.getElementById("auth-name").value,email,password}:{email,password};try{const r=await fetch(API+url,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(body)});const d=await r.json();if(!r.ok){showError(d.error||"Auth failed ("+r.status+")");return}if(d.token){_token=d.token;localStorage.setItem("_token",d.token);document.getElementById("user-info").textContent="Hi, "+(d.user?.name||email);document.getElementById("user-info").classList.remove("hidden");document.getElementById("logout-btn").classList.remove("hidden");document.getElementById("nav-auth").classList.add("hidden");toast(_isRegister?"Registered!":"Logged in!");showSection("${entities[0].name.toLowerCase()}")}else{showError(d.error||"No token received")}}catch(e){showError("Network error: "+e.message)}}`);
+    L.push(`function doLogout(){_token=null;localStorage.removeItem("_token");document.getElementById("user-info").classList.add("hidden");document.getElementById("logout-btn").classList.add("hidden");document.getElementById("nav-auth").classList.remove("hidden");toast("Logged out");showSection("auth")}`);
+    L.push(`(function(){const t=localStorage.getItem("_token");if(t){_token=t;document.getElementById("user-info").textContent="Logged in";document.getElementById("user-info").classList.remove("hidden");document.getElementById("logout-btn").classList.remove("hidden");document.getElementById("nav-auth").classList.add("hidden")}})()`);
+  }
+  for (const entity of entities) {
+    const lower = entity.name.toLowerCase();
+    const plural = pluralize(lower);
+    const fields = entity.fields.filter(f => f.type !== 'auto');
+    L.push(`async function ${lower}Load(page){page=page||1;currentPage["${lower}"]=page;const s=document.getElementById("${lower}-search").value;const sort=document.getElementById("${lower}-sort").value;const ord=document.getElementById("${lower}-order").value;`);
+    L.push(`setLoading("${lower}-tbody",true);`);
+    L.push(`const d=await apiFetch(API+"/api/${plural}?page="+page+"&limit=10&search="+encodeURIComponent(s)+"&sort="+sort+"&order="+ord);if(!d){setLoading("${lower}-tbody",false);return}const items=d.items||d;`);
+    L.push(`document.getElementById("${lower}-tbody").innerHTML=items.map(i=>"<tr>${entity.fields.map(f => `<td>"+(i.${f.name}!=null?i.${f.name}:"")+"</td>`).join('')}<td><button class='btn btn-sm btn-primary' onclick='${lower}Edit("+i.id+")'>Edit</button> <button class='btn btn-sm btn-danger' onclick='${lower}Del("+i.id+")'>Del</button></td></tr>").join("");`);
+    L.push(`const tp=Math.ceil((d.total||items.length)/10);let pg="";for(let p=1;p<=tp;p++)pg+="<button class='btn btn-sm "+(p===page?"btn-primary":"")+"' onclick='${lower}Load("+p+")'>"+p+"</button>";document.getElementById("${lower}-pager").innerHTML=pg}`);
+    L.push(`function ${lower}ShowModal(id){document.getElementById("${lower}-edit-id").value=id||"";document.getElementById("${lower}-modal-title").textContent=id?"Edit ${entity.name}":"New ${entity.name}";${fields.map(f => f.type === 'bool' ? `document.getElementById("${lower}-f-${f.name}").checked=false` : `document.getElementById("${lower}-f-${f.name}").value=""`).join(';')};document.getElementById("${lower}-modal").classList.remove("hidden")}`);
+    L.push(`async function ${lower}Edit(id){const d=await apiFetch(API+"/api/${plural}/"+id);if(!d)return;const i=d.data||d;${lower}ShowModal(id);${fields.map(f => f.type === 'bool' ? `document.getElementById("${lower}-f-${f.name}").checked=!!i.${f.name}` : `document.getElementById("${lower}-f-${f.name}").value=i.${f.name}||""`).join(';')}}`);
+    L.push(`async function ${lower}Save(){const id=document.getElementById("${lower}-edit-id").value;const body={${fields.map(f => {
+      if (f.type === 'bool') return `${f.name}:document.getElementById("${lower}-f-${f.name}").checked`;
+      if (f.type === 'int') return `${f.name}:+document.getElementById("${lower}-f-${f.name}").value`;
+      return `${f.name}:document.getElementById("${lower}-f-${f.name}").value`;
+    }).join(',')}};`);
+    L.push(`const method=id?"PUT":"POST";const url=API+"/api/${plural}"+(id?"/"+id:"");const d=await apiFetch(url,{method,headers:authHeaders(),body:JSON.stringify(body)});if(!d){showBanner("section-${lower}","Save failed — check required fields");return}document.getElementById("${lower}-modal").classList.add("hidden");toast(id?"Updated!":"Created!");${lower}Load()}`);
+    L.push(`async function ${lower}Del(id){if(!confirm("Delete this ${lower}?"))return;const d=await apiFetch(API+"/api/${plural}/"+id,{method:"DELETE",headers:authHeaders()});if(!d)return;toast("Deleted!");${lower}Load()}`);
+  }
+  const initSection = hasAuth ? 'auth' : entities[0].name.toLowerCase();
+  L.push(`showSection("${initSection}")`);
+  L.push('</script></body></html>');
+  return L.join('\n');
+}
+
+// ── Docker Compose (B14) ──────────────────────────────────
+
+function dockerCompose(projectName, port, intents) {
+  const lines = ['version: "3.8"', '', 'services:'];
+  lines.push(`  app:`);
+  lines.push(`    build: .`);
+  lines.push(`    ports:`);
+  lines.push(`      - "${port}:${port}"`);
+  lines.push(`    env_file: .env`);
+  lines.push(`    volumes:`);
+  lines.push(`      - app-data:/app/data`);
+  if (intents.has('database')) {
+    lines.push(`    depends_on:`);
+    lines.push(`      - db`);
+    lines.push('');
+    lines.push(`  db:`);
+    lines.push(`    image: postgres:16-alpine`);
+    lines.push(`    environment:`);
+    lines.push(`      POSTGRES_DB: ${projectName.replace(/-/g, '_')}`);
+    lines.push(`      POSTGRES_USER: app`);
+    lines.push(`      POSTGRES_PASSWORD: changeme`);
+    lines.push(`    ports:`);
+    lines.push(`      - "5432:5432"`);
+    lines.push(`    volumes:`);
+    lines.push(`      - db-data:/var/lib/postgresql/data`);
+  }
+  lines.push('');
+  lines.push('volumes:');
+  lines.push('  app-data:');
+  if (intents.has('database')) lines.push('  db-data:');
+  return lines.join('\n') + '\n';
+}
+
+// ── GitHub Actions CI (C16) ────────────────────────────────
+
+function githubActionsCI(projectName) {
+  return `name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [20, 22]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: \${{ matrix.node-version }}
+          cache: npm
+      - run: npm ci
+      - run: npm run build
+      - run: npm test
+
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npx naide app.naide --check
+`;
+}
+
+// ── Environment Files (C15) ───────────────────────────────
+
+function envDevelopment(port, intents) {
+  const lines = ['NODE_ENV=development', `PORT=${port}`, 'LOG_LEVEL=debug'];
+  if (intents.has('auth')) lines.push('JWT_SECRET=dev-secret-do-not-use-in-prod');
+  if (intents.has('database')) lines.push('DATABASE_URL=postgres://app:changeme@localhost:5432/app_dev');
+  return lines.join('\n') + '\n';
+}
+
+function envProduction(port, intents) {
+  const lines = ['NODE_ENV=production', `PORT=${port}`, 'LOG_LEVEL=warn'];
+  if (intents.has('auth')) lines.push('JWT_SECRET=CHANGE_ME_TO_RANDOM_SECRET');
+  if (intents.has('database')) lines.push('DATABASE_URL=postgres://user:pass@db-host:5432/app_prod');
+  return lines.join('\n') + '\n';
+}
+
 // ── Auth Route Templates ────────────────────────────────────
 
 function authRoutesBlock(userEntity) {
@@ -1034,6 +1574,173 @@ function envLines(intents, params) {
   return lines;
 }
 
+// ── Test Runner (D2) ─────────────────────────────────────
+
+function testRunnerFile(entities, intents, port) {
+  const lines = [];
+  lines.push(`import { describe, it } from 'node:test';`);
+  lines.push(`import assert from 'node:assert/strict';`);
+  lines.push('');
+  lines.push(`const BASE = process.env.TEST_URL || 'http://localhost:${port}';`);
+  lines.push(`const headers = {'Content-Type': 'application/json'};`);
+  lines.push(`let authToken = null;`);
+  lines.push('');
+  lines.push(`async function api(path, opts = {}) {`);
+  lines.push(`  const h = {...headers};`);
+  lines.push(`  if (authToken) h.Authorization = 'Bearer ' + authToken;`);
+  lines.push(`  const r = await fetch(BASE + path, {...opts, headers: {...h, ...opts.headers}});`);
+  lines.push(`  const body = await r.json().catch(() => null);`);
+  lines.push(`  return {status: r.status, body, ok: r.ok};`);
+  lines.push(`}`);
+  lines.push('');
+  lines.push(`describe('Health', () => {`);
+  lines.push(`  it('GET /api/health returns ok', async () => {`);
+  lines.push(`    const r = await api('/api/health');`);
+  lines.push(`    assert.equal(r.status, 200);`);
+  lines.push(`    assert.equal(r.body.status, 'ok');`);
+  lines.push(`  });`);
+  lines.push(`});`);
+  lines.push('');
+  if (intents.has('auth')) {
+    lines.push(`describe('Auth', () => {`);
+    lines.push(`  const email = 'test' + Date.now() + '@test.com';`);
+    lines.push(`  it('POST /api/auth/register creates user', async () => {`);
+    lines.push(`    const r = await api('/api/auth/register', {method: 'POST', body: JSON.stringify({name: 'Test', email, password: 'test1234'})});`);
+    lines.push(`    assert.equal(r.status, 200);`);
+    lines.push(`    assert.ok(r.body.token);`);
+    lines.push(`    authToken = r.body.token;`);
+    lines.push(`  });`);
+    lines.push(`  it('POST /api/auth/login returns token', async () => {`);
+    lines.push(`    const r = await api('/api/auth/login', {method: 'POST', body: JSON.stringify({email, password: 'test1234'})});`);
+    lines.push(`    assert.equal(r.status, 200);`);
+    lines.push(`    assert.ok(r.body.token);`);
+    lines.push(`    authToken = r.body.token;`);
+    lines.push(`  });`);
+    lines.push(`  it('GET /api/auth/me returns current user', async () => {`);
+    lines.push(`    const r = await api('/api/auth/me');`);
+    lines.push(`    assert.equal(r.status, 200);`);
+    lines.push(`    assert.equal(r.body.email || r.body.data?.email, email);`);
+    lines.push(`  });`);
+    lines.push(`  it('rejects invalid login', async () => {`);
+    lines.push(`    const r = await api('/api/auth/login', {method: 'POST', body: JSON.stringify({email: 'no@no.com', password: 'wrong'})});`);
+    lines.push(`    assert.equal(r.status, 401);`);
+    lines.push(`  });`);
+    lines.push(`});`);
+    lines.push('');
+  }
+  for (const entity of entities) {
+    const lower = entity.name.toLowerCase();
+    const plural = pluralize(lower);
+    const requiredFields = entity.fields.filter(f => f.modifiers.includes('required') && f.type !== 'auto');
+    const sampleData = {};
+    for (const f of requiredFields) {
+      if (f.type === 'int') sampleData[f.name] = 1;
+      else if (f.type === 'bool') sampleData[f.name] = true;
+      else sampleData[f.name] = 'test_' + f.name;
+    }
+    if (Object.keys(sampleData).length === 0) {
+      const first = entity.fields.find(f => f.type !== 'auto' && f.type !== 'bool');
+      if (first) sampleData[first.name] = first.type === 'int' ? 1 : 'test';
+    }
+    lines.push(`describe('${entity.name} CRUD', () => {`);
+    lines.push(`  let createdId;`);
+    lines.push(`  it('POST /api/${plural} creates', async () => {`);
+    lines.push(`    const r = await api('/api/${plural}', {method: 'POST', body: JSON.stringify(${JSON.stringify(sampleData)})});`);
+    lines.push(`    assert.ok(r.ok, 'status ' + r.status);`);
+    lines.push(`    createdId = r.body.id || r.body.data?.id;`);
+    lines.push(`    assert.ok(createdId, 'has id');`);
+    lines.push(`  });`);
+    lines.push(`  it('GET /api/${plural} lists', async () => {`);
+    lines.push(`    const r = await api('/api/${plural}');`);
+    lines.push(`    assert.equal(r.status, 200);`);
+    lines.push(`    const items = r.body.items || r.body;`);
+    lines.push(`    assert.ok(Array.isArray(items));`);
+    lines.push(`  });`);
+    lines.push(`  it('GET /api/${plural}/:id finds', async () => {`);
+    lines.push(`    const r = await api('/api/${plural}/' + createdId);`);
+    lines.push(`    assert.equal(r.status, 200);`);
+    lines.push(`  });`);
+    lines.push(`  it('PUT /api/${plural}/:id updates', async () => {`);
+    lines.push(`    const r = await api('/api/${plural}/' + createdId, {method: 'PUT', body: JSON.stringify(${JSON.stringify(sampleData)})});`);
+    lines.push(`    assert.ok(r.ok);`);
+    lines.push(`  });`);
+    lines.push(`  it('DELETE /api/${plural}/:id deletes', async () => {`);
+    lines.push(`    const r = await api('/api/${plural}/' + createdId, {method: 'DELETE'});`);
+    lines.push(`    assert.ok(r.ok);`);
+    lines.push(`  });`);
+    lines.push(`});`);
+    lines.push('');
+  }
+  return lines.join('\n');
+}
+
+// ── DB Migration (D3) ───────────────────────────────────────
+
+function migrationFile(entities, relationships, m2mRels) {
+  const lines = [];
+  const ts = new Date().toISOString().replace(/[-:T]/g, '').slice(0, 14);
+  lines.push(`# Migration: ${ts}`);
+  lines.push(`# Auto-generated by NAIDE ~~ engine`);
+  lines.push(`# Run: naide migrate.naide`);
+  lines.push('');
+  lines.push('use "node:fs"');
+  lines.push('');
+  lines.push(`fn migrate():`);
+  for (const entity of entities) {
+    const lower = entity.name.toLowerCase();
+    const plural = pluralize(lower);
+    lines.push(`  log("Creating table: ${plural}")`);
+    const cols = entity.fields.map(f => {
+      let col = f.name;
+      if (f.type === 'auto') col += ' INTEGER PRIMARY KEY AUTOINCREMENT';
+      else if (f.type === 'int') col += ' INTEGER';
+      else if (f.type === 'bool') col += ' BOOLEAN DEFAULT false';
+      else col += ' TEXT';
+      if (f.modifiers.includes('required') && f.type !== 'auto') col += ' NOT NULL';
+      if (f.modifiers.includes('unique')) col += ' UNIQUE';
+      return col;
+    });
+    lines.push(`  str sql_${lower} = "CREATE TABLE IF NOT EXISTS ${plural} (${cols.join(', ')}"`);
+    const fks = relationships.filter(r => r.child === entity.name);
+    if (fks.length > 0) {
+      for (const fk of fks) {
+        const parentPlural = pluralize(fk.parent.toLowerCase());
+        lines.push(`  sql_${lower} = sql_${lower} + ", FOREIGN KEY (${fk.fk}) REFERENCES ${parentPlural}(id)"`);
+      }
+    }
+    lines.push(`  sql_${lower} = sql_${lower} + ")"`);
+    lines.push(`  log(sql_${lower})`);
+    lines.push('');
+  }
+  for (const rel of m2mRels) {
+    const jLower = rel.junction.toLowerCase();
+    lines.push(`  log("Creating junction table: ${jLower}")`);
+    const lp = pluralize(rel.left.toLowerCase());
+    const rp = pluralize(rel.right.toLowerCase());
+    lines.push(`  str sql_${jLower} = "CREATE TABLE IF NOT EXISTS ${jLower} (id INTEGER PRIMARY KEY AUTOINCREMENT, ${rel.fkLeft} INTEGER NOT NULL, ${rel.fkRight} INTEGER NOT NULL, created TEXT DEFAULT CURRENT_TIMESTAMP, FOREIGN KEY (${rel.fkLeft}) REFERENCES ${lp}(id), FOREIGN KEY (${rel.fkRight}) REFERENCES ${rp}(id), UNIQUE(${rel.fkLeft}, ${rel.fkRight}))"`);
+    lines.push(`  log(sql_${jLower})`);
+    lines.push('');
+  }
+  lines.push('  log("Migration complete")');
+  lines.push('');
+  lines.push(`fn rollback():`);
+  for (const entity of [...entities].reverse()) {
+    const plural = pluralize(entity.name.toLowerCase());
+    lines.push(`  log("Dropping table: ${plural}")`);
+    lines.push(`  str drop_${entity.name.toLowerCase()} = "DROP TABLE IF EXISTS ${plural}"`);
+    lines.push(`  log(drop_${entity.name.toLowerCase()})`);
+  }
+  for (const rel of m2mRels) {
+    const jLower = rel.junction.toLowerCase();
+    lines.push(`  str drop_${jLower} = "DROP TABLE IF EXISTS ${jLower}"`);
+    lines.push(`  log(drop_${jLower})`);
+  }
+  lines.push('  log("Rollback complete")');
+  lines.push('');
+  lines.push('migrate()');
+  return lines.join('\n') + '\n';
+}
+
 // ── Code Composer ───────────────────────────────────────────
 
 function compose(intents, params) {
@@ -1058,6 +1765,24 @@ function compose(intents, params) {
   const utils = utilityFunctions(intents);
   if (utils.length > 0) sections.push(...utils);
 
+  // Rate limiting & logging middleware (B12, C17)
+  if (intents.has('server')) {
+    sections.push(rateLimitBlock());
+    sections.push(loggingBlock());
+  }
+
+  // RBAC middleware (D1)
+  if (hasAuth) {
+    sections.push(rbacBlock());
+  }
+
+  // Input validation functions (A4)
+  if (intents.has('schema') && intents.has('crud')) {
+    for (const entity of entities) {
+      sections.push(validationBlock(entity));
+    }
+  }
+
   // Schema blocks for all entities (add role + deleted fields)
   if (intents.has('schema')) {
     for (const entity of entities) {
@@ -1071,6 +1796,12 @@ function compose(intents, params) {
         sections.push(schemaBlock(entity.name, entity.fields));
       }
     }
+    // M:N junction table schemas (S3)
+    const m2mRels = detectManyToMany(entities.map(e => e.name));
+    for (const rel of m2mRels) {
+      sections.push(junctionSchemaBlock(rel));
+    }
+
     // Audit log schema when auth is present
     if (hasAuth) {
       sections.push(auditSchema());
@@ -1099,6 +1830,8 @@ function compose(intents, params) {
       body.push('  protect "/api/*"');
       body.push('  public "/api/auth/*"');
       body.push('  public "/api/health"');
+      body.push('  public "/docs"');
+      body.push('  public "/api/openapi.json"');
       if (userEntity) {
         body.push('');
         body.push(...authRoutesBlock(userEntity.name));
@@ -1114,6 +1847,12 @@ function compose(intents, params) {
           body.push('  ret {status: "ok"}');
         }
       }
+
+      // Password reset routes (A6)
+      if (userEntity) {
+        body.push('');
+        body.push(...passwordResetRoutes());
+      }
     }
 
     // Paginated list endpoints (override default CRUD list)
@@ -1125,21 +1864,30 @@ function compose(intents, params) {
       }
     }
 
+    // Validated create/update routes (A4)
+    if (intents.has('crud') && intents.has('schema')) {
+      for (const entity of entities) {
+        body.push(...validatedCreateRoute(entity));
+        body.push('');
+      }
+    }
+
     // Nested routes for relationships
     for (const rel of relationships) {
       body.push(...nestedRouteBlock(rel.parent, rel.child, rel.fk));
       body.push('');
     }
 
-    // WebSocket
+    // M:N routes (S3)
+    const m2mRels = detectManyToMany(entities.map(e => e.name));
+    for (const rel of m2mRels) {
+      body.push(...manyToManyRoutes(rel));
+      body.push('');
+    }
+
+    // WebSocket with rooms + auth (B11, D4)
     if (intents.has('websocket')) {
-      body.push('ws "/ws":');
-      body.push('  on "connection" (socket):');
-      body.push('    log("Client connected")');
-      body.push('  on "message" (data, socket):');
-      body.push('    socket.send(data)');
-      body.push('  on "close" (socket):');
-      body.push('    log("Client disconnected")');
+      body.push(...wsRoomsBlock(hasAuth));
       body.push('');
     }
 
@@ -1163,6 +1911,14 @@ function compose(intents, params) {
       }
     }
 
+    // RBAC role-guarded delete routes (D1)
+    if (hasAuth && intents.has('crud') && intents.has('schema')) {
+      for (const entity of entities) {
+        body.push(...rbacRouteGuards(entity));
+        body.push('');
+      }
+    }
+
     // File upload
     if (intents.has('crud')) {
       body.push(...uploadRoute());
@@ -1175,6 +1931,14 @@ function compose(intents, params) {
       body.push('');
     }
 
+    // Swagger UI (A5)
+    body.push(...swaggerUIRoute());
+    body.push('');
+
+    // Cache control (C18)
+    body.push(...cachingRoute());
+    body.push('');
+
     // Health check
     body.push('get "/api/health" (req, res):');
     if (intents.has('schema') && intents.has('crud') && entities.length > 0) {
@@ -1355,8 +2119,10 @@ export function generateProject(instruction, options = {}) {
       dev: 'naide app.naide',
       build: 'naide app.naide --emit -o dist/app.mjs',
       start: 'node dist/app.mjs',
-      test: 'naide test app.naide',
+      test: 'node --test test.mjs',
+      'test:unit': 'naide test app.naide',
       seed: 'naide app.naide --run-seed',
+      migrate: 'naide migrate.naide',
     },
     dependencies: deps,
   };
@@ -1416,40 +2182,33 @@ CMD ["node", "dist/app.mjs"]
   if (intents.has('server')) {
     readmeLines.push(`## API Endpoints\n`);
     readmeLines.push(`- \`GET /api/health\` — Health check`);
+    readmeLines.push(`- \`GET /docs\` — Swagger UI`);
     for (const e of entities) {
       const ep = pluralize(e.toLowerCase());
-      readmeLines.push(`- \`GET /api/${ep}?page=1&limit=20&search=\` — List ${ep} (paginated)`);
-      readmeLines.push(`- \`POST /api/${ep}\` — Create ${e.toLowerCase()}`);
-      readmeLines.push(`- \`GET /api/${ep}/:id\` — Get ${e.toLowerCase()}`);
-      readmeLines.push(`- \`PUT /api/${ep}/:id\` — Update ${e.toLowerCase()}`);
-      readmeLines.push(`- \`DELETE /api/${ep}/:id\` — Delete ${e.toLowerCase()}`);
-      readmeLines.push(`- \`DELETE /api/${ep}/:id/soft\` — Soft delete ${e.toLowerCase()}`);
-      readmeLines.push(`- \`PUT /api/${ep}/:id/restore\` — Restore ${e.toLowerCase()}`);
-      readmeLines.push(`- \`POST /api/${ep}/batch\` — Batch create ${ep}`);
-      readmeLines.push(`- \`DELETE /api/${ep}/batch\` — Batch delete ${ep}`);
+      readmeLines.push(`- \`GET /api/${ep}?page=1&limit=20&search=&sort=id&order=desc\` — List (paginated, sortable, filterable)`);
+      readmeLines.push(`- \`POST /api/${ep}\` — Create (validated)`, `- \`PUT /api/${ep}/:id\` — Update (validated)`);
+      readmeLines.push(`- \`GET /api/${ep}/:id\` — Get`, `- \`DELETE /api/${ep}/:id\` — Delete`);
+      readmeLines.push(`- \`DELETE /api/${ep}/:id/soft\` — Soft delete`, `- \`PUT /api/${ep}/:id/restore\` — Restore`);
+      readmeLines.push(`- \`POST /api/${ep}/batch\` — Batch create`, `- \`DELETE /api/${ep}/batch\` — Batch delete`);
     }
     for (const r of result.analysis.relationships) {
-      const parentPlural = pluralize(r.parent.toLowerCase());
-      const childPlural = pluralize(r.child.toLowerCase());
-      readmeLines.push(`- \`GET /api/${parentPlural}/:id/${childPlural}\` — ${r.child}s by ${r.parent}`);
+      readmeLines.push(`- \`GET /api/${pluralize(r.parent.toLowerCase())}/:id/${pluralize(r.child.toLowerCase())}\` — ${r.child}s by ${r.parent}`);
     }
-    readmeLines.push(`- \`POST /api/upload\` — File upload`);
-    readmeLines.push(`- \`POST /api/webhooks\` — Register webhook`);
-    readmeLines.push(`- \`GET /api/webhooks/health\` — Webhook health`);
+    readmeLines.push(`- \`POST /api/upload\` — File upload`, `- \`POST /api/webhooks\` — Webhook`);
     if (intents.has('auth')) {
-      readmeLines.push(`- \`POST /api/auth/register\` — Register`);
-      readmeLines.push(`- \`POST /api/auth/login\` — Login`);
-      readmeLines.push(`- \`GET /api/auth/me\` — Current user`);
-      readmeLines.push(`- \`GET /api/admin/stats\` — Admin stats (role: admin)`);
+      readmeLines.push(`- \`POST /api/auth/register\` — Register`, `- \`POST /api/auth/login\` — Login`, `- \`GET /api/auth/me\` — Current user`);
+      readmeLines.push(`- \`POST /api/auth/forgot-password\` — Forgot password`, `- \`POST /api/auth/reset-password\` — Reset password`);
+      readmeLines.push(`- \`POST /api/auth/change-password\` — Change password`, `- \`GET /api/admin/stats\` — Admin stats`);
     }
   }
   if (intents.has('server')) {
-    readmeLines.push(`\n## Docker\n`);
-    readmeLines.push('```bash');
-    readmeLines.push(`docker build -t ${projectName} .`);
-    readmeLines.push(`docker run -p ${result.port}:${result.port} --env-file .env ${projectName}`);
-    readmeLines.push('```');
+    readmeLines.push(`\n## Docker\n`, '```bash', `docker-compose up -d`, '```');
   }
+  readmeLines.push(`\n## Generated Files\n`);
+  readmeLines.push('| File | Purpose |', '|------|---------|');
+  readmeLines.push('| app.naide | Main application |', '| index.html | Frontend SPA |', '| admin.html | Admin dashboard |');
+  readmeLines.push('| client.mjs | API client library |', '| openapi.json | OpenAPI 3.0 spec |');
+  readmeLines.push('| docker-compose.yml | Docker orchestration |', '| .github/workflows/ci.yml | CI/CD pipeline |');
   files.push({ path: 'README.md', content: readmeLines.join('\n') + '\n' });
 
   // Build full entity objects for generators
@@ -1476,6 +2235,34 @@ CMD ["node", "dist/app.mjs"]
     files.push({ path: 'client.mjs', content: apiClientCode(entityObjs, intents, result.port) });
   }
 
+  // Frontend SPA (S2)
+  if (intents.has('server') && entityObjs.length > 0) {
+    files.push({ path: 'index.html', content: frontendSPA(entityObjs, intents, result.port) });
+  }
+
+  // Docker Compose (B14)
+  if (intents.has('server')) {
+    files.push({ path: 'docker-compose.yml', content: dockerCompose(projectName, result.port, intents) });
+  }
+
+  // Environment files (C15)
+  files.push({ path: '.env.development', content: envDevelopment(result.port, intents) });
+  files.push({ path: '.env.production', content: envProduction(result.port, intents) });
+
+  // GitHub Actions CI (C16)
+  files.push({ path: '.github/workflows/ci.yml', content: githubActionsCI(projectName) });
+
+  // Test runner (D2)
+  if (intents.has('server') && entityObjs.length > 0) {
+    files.push({ path: 'test.mjs', content: testRunnerFile(entityObjs, intents, result.port) });
+  }
+
+  // DB migration (D3)
+  if (intents.has('database') && entityObjs.length > 0) {
+    const m2mRels = detectManyToMany(entities.map(e => e));
+    files.push({ path: 'migrate.naide', content: migrationFile(entityObjs, result.relationships || [], m2mRels) });
+  }
+
   return { ...result, files };
 }
 
@@ -1487,8 +2274,34 @@ export function updateProject(projectDir, instruction, options = {}) {
 
   const existingState = existing ? parseExistingProject(existing) : { entities: [], intents: [], port: 3000 };
   const newResult = generate(instruction, options);
-  const newEntities = (newResult.entities || []).filter(e => !existingState.entities.includes(e));
 
+  // Entity removal detection (B8)
+  const isRemoval = /(?:remove|delete|drop|取り除|削除)\s+/i.test(instruction);
+  let removedEntities = [];
+  if (isRemoval) {
+    const removeTargets = (newResult.entities || []);
+    removedEntities = existingState.entities.filter(e => removeTargets.includes(e));
+    const allEntities = existingState.entities.filter(e => !removeTargets.includes(e));
+    if (allEntities.length === 0) {
+      return { code: '', valid: true, fixed: false, repairs: [], intents: [], entities: [], relationships: [], port: existingState.port,
+        files: [{ path: 'app.naide', content: '' }], analysis: { instruction, entities: [], relationships: [], plan: [`Removed: ${removedEntities.join(', ')}`], added: [] },
+        action: 'removed', removed: removedEntities };
+    }
+    const combinedIntents = existingState.intents.filter(i => i !== 'schema' || allEntities.length > 0);
+    const extras = [];
+    if (combinedIntents.includes('auth')) extras.push('auth');
+    if (combinedIntents.includes('websocket')) extras.push('websocket');
+    if (combinedIntents.includes('database')) extras.push('database');
+    const fullInstruction = 'REST API for ' + allEntities.join(' and ') + (extras.length ? ' with ' + extras.join(' and ') : '');
+    const combined = generate(fullInstruction, options);
+    const result = buildUpdateFiles(projectDir, combined, allEntities, existingState, options);
+    result.action = 'removed';
+    result.removed = removedEntities;
+    result.analysis.plan.unshift(`Removed: ${removedEntities.join(', ')}`);
+    return result;
+  }
+
+  const newEntities = (newResult.entities || []).filter(e => !existingState.entities.includes(e));
   const allEntities = [...existingState.entities, ...newEntities];
   const combinedIntents = [...new Set([...existingState.intents, ...newResult.intents])];
   const extras = [];
@@ -1498,8 +2311,12 @@ export function updateProject(projectDir, instruction, options = {}) {
   const fullInstruction = 'REST API for ' + allEntities.join(' and ') + (extras.length ? ' with ' + extras.join(' and ') : '');
 
   const combined = generate(fullInstruction, options);
-  const finalCode = combined.code;
+  return buildUpdateFiles(projectDir, combined, allEntities, existingState, options);
+}
 
+function buildUpdateFiles(projectDir, combined, allEntities, existingState, options) {
+  const existing = _existsFS(projectDir + '/app.naide') ? _readFS(projectDir + '/app.naide', 'utf-8') : '';
+  const finalCode = combined.code;
   const files = [];
   files.push({ path: 'app.naide', content: finalCode });
 
@@ -1514,10 +2331,7 @@ export function updateProject(projectDir, instruction, options = {}) {
   const deps = {};
   if (intents.has('server'))    deps.express = '^4.21.0';
   if (intents.has('websocket')) deps.ws = '^8.18.0';
-  if (intents.has('auth')) {
-    deps.jsonwebtoken = '^9.0.2';
-    deps.bcryptjs = '^2.4.3';
-  }
+  if (intents.has('auth')) { deps.jsonwebtoken = '^9.0.2'; deps.bcryptjs = '^2.4.3'; }
   if (intents.has('mail'))      deps.nodemailer = '^6.9.0';
   if (entities.length > 0)     deps.naider = '^1.21.0';
 
@@ -1536,8 +2350,7 @@ export function updateProject(projectDir, instruction, options = {}) {
   }
   files.push({ path: 'package.json', content: JSON.stringify(pkg, null, 2) + '\n' });
 
-  const envL = [];
-  envL.push(`PORT=${port}`);
+  const envL = [`PORT=${port}`];
   if (intents.has('auth')) envL.push('JWT_SECRET=change-me-in-production');
   if (intents.has('bot'))  envL.push(`${(options.platform || 'DISCORD').toUpperCase()}_TOKEN=your-bot-token`);
   if (intents.has('mail')) { envL.push('SMTP_HOST=smtp.example.com'); envL.push('SMTP_USER=user@example.com'); envL.push('SMTP_PASS=password'); }
@@ -1547,9 +2360,7 @@ export function updateProject(projectDir, instruction, options = {}) {
     const existingEnv = _readFS(existingEnvPath, 'utf-8');
     const existingKeys = new Set(existingEnv.split('\n').map(l => l.split('=')[0]).filter(Boolean));
     const newEnvLines = envL.filter(l => !existingKeys.has(l.split('=')[0]));
-    if (newEnvLines.length > 0) {
-      files.push({ path: '.env', content: existingEnv.trimEnd() + '\n' + newEnvLines.join('\n') + '\n' });
-    }
+    if (newEnvLines.length > 0) files.push({ path: '.env', content: existingEnv.trimEnd() + '\n' + newEnvLines.join('\n') + '\n' });
   } else {
     files.push({ path: '.env', content: envL.join('\n') + '\n' });
   }
@@ -1559,56 +2370,48 @@ export function updateProject(projectDir, instruction, options = {}) {
   if (intents.has('server')) {
     files.push({ path: 'Dockerfile', content: `FROM node:22-slim\nWORKDIR /app\nCOPY package*.json ./\nRUN npm ci --omit=dev\nRUN npm install -g naider\nCOPY . .\nRUN naide app.naide --emit -o dist/app.mjs\nEXPOSE ${port}\nCMD ["node", "dist/app.mjs"]\n` });
     files.push({ path: '.dockerignore', content: 'node_modules\ndist\ndata\n.env\n.git\n' });
+    files.push({ path: 'docker-compose.yml', content: dockerCompose(projectName, port, intents) });
   }
 
-  const readmeLines = [`# ${projectName}\n`];
-  readmeLines.push(`Generated by NAIDE Agent Coder (~~)\n`);
-  readmeLines.push(`## Entities\n`);
+  files.push({ path: '.env.development', content: envDevelopment(port, intents) });
+  files.push({ path: '.env.production', content: envProduction(port, intents) });
+  files.push({ path: '.github/workflows/ci.yml', content: githubActionsCI(projectName) });
+
+  const readmeLines = [`# ${projectName}\n`, `Generated by NAIDE Agent Coder (~~)\n`, `## Entities\n`];
   for (const e of entities) {
-    const preset = SCHEMA_PRESETS[e.toLowerCase()];
-    const fc = preset ? preset.length : 3;
+    const fc = SCHEMA_PRESETS[e.toLowerCase()]?.length || 3;
     readmeLines.push(`- **${e}** (${fc} fields)`);
   }
   if (relationships.length > 0) {
     readmeLines.push(`\n## Relationships\n`);
     for (const r of relationships) readmeLines.push(`- ${r.parent} → ${r.child} (${r.fk})`);
   }
-  readmeLines.push(`\n## Quick Start\n`);
-  readmeLines.push('```bash\nnpm install\nnpm run dev\n```\n');
+  readmeLines.push(`\n## Quick Start\n`, '```bash', 'npm install', 'npm run dev', '```\n');
   if (intents.has('server')) {
-    readmeLines.push(`## API Endpoints\n`);
-    readmeLines.push(`- \`GET /api/health\` — Health check`);
+    readmeLines.push(`## API Endpoints\n`, `- \`GET /api/health\` — Health check`, `- \`GET /docs\` — Swagger UI`);
     for (const e of entities) {
       const ep = pluralize(e.toLowerCase());
-      readmeLines.push(`- \`GET /api/${ep}?page=1&limit=20&search=\` — List ${ep} (paginated)`);
-      readmeLines.push(`- \`POST /api/${ep}\` — Create ${e.toLowerCase()}`);
-      readmeLines.push(`- \`GET /api/${ep}/:id\` — Get ${e.toLowerCase()}`);
-      readmeLines.push(`- \`PUT /api/${ep}/:id\` — Update ${e.toLowerCase()}`);
-      readmeLines.push(`- \`DELETE /api/${ep}/:id\` — Delete ${e.toLowerCase()}`);
-      readmeLines.push(`- \`DELETE /api/${ep}/:id/soft\` — Soft delete`);
-      readmeLines.push(`- \`PUT /api/${ep}/:id/restore\` — Restore`);
-      readmeLines.push(`- \`POST /api/${ep}/batch\` — Batch create`);
-      readmeLines.push(`- \`DELETE /api/${ep}/batch\` — Batch delete`);
-    }
-    for (const r of relationships) {
-      readmeLines.push(`- \`GET /api/${pluralize(r.parent.toLowerCase())}/:id/${pluralize(r.child.toLowerCase())}\` — ${r.child}s by ${r.parent}`);
+      readmeLines.push(`- \`GET /api/${ep}?page=1&limit=20&search=&sort=id&order=desc\` — List (paginated, sortable, filterable)`);
+      readmeLines.push(`- \`POST /api/${ep}\` — Create (validated)`, `- \`PUT /api/${ep}/:id\` — Update (validated)`);
+      readmeLines.push(`- \`GET /api/${ep}/:id\` — Get`, `- \`DELETE /api/${ep}/:id\` — Delete`);
+      readmeLines.push(`- \`DELETE /api/${ep}/:id/soft\` — Soft delete`, `- \`PUT /api/${ep}/:id/restore\` — Restore`);
+      readmeLines.push(`- \`POST /api/${ep}/batch\` — Batch create`, `- \`DELETE /api/${ep}/batch\` — Batch delete`);
     }
-    readmeLines.push(`- \`POST /api/upload\` — File upload`);
-    readmeLines.push(`- \`POST /api/webhooks\` — Register webhook`);
+    readmeLines.push(`- \`POST /api/upload\` — File upload`, `- \`POST /api/webhooks\` — Webhook`);
     if (intents.has('auth')) {
-      readmeLines.push(`- \`POST /api/auth/register\` — Register`);
-      readmeLines.push(`- \`POST /api/auth/login\` — Login`);
-      readmeLines.push(`- \`GET /api/auth/me\` — Current user`);
-      readmeLines.push(`- \`GET /api/admin/stats\` — Admin stats`);
+      readmeLines.push(`- \`POST /api/auth/register\` — Register`, `- \`POST /api/auth/login\` — Login`, `- \`GET /api/auth/me\` — Current user`);
+      readmeLines.push(`- \`POST /api/auth/forgot-password\` — Forgot password`, `- \`POST /api/auth/reset-password\` — Reset password`);
+      readmeLines.push(`- \`POST /api/auth/change-password\` — Change password`, `- \`GET /api/admin/stats\` — Admin stats`);
     }
   }
   if (intents.has('server')) {
-    readmeLines.push(`\n## Docker\n`);
-    readmeLines.push('```bash');
-    readmeLines.push(`docker build -t ${projectName} .`);
-    readmeLines.push(`docker run -p ${port}:${port} --env-file .env ${projectName}`);
-    readmeLines.push('```');
+    readmeLines.push(`\n## Docker\n`, '```bash', `docker-compose up -d`, '```');
   }
+  readmeLines.push(`\n## Generated Files\n`);
+  readmeLines.push('| File | Purpose |', '|------|---------|');
+  readmeLines.push('| app.naide | Main application |', '| index.html | Frontend SPA |', '| admin.html | Admin dashboard |');
+  readmeLines.push('| client.mjs | API client library |', '| openapi.json | OpenAPI 3.0 spec |');
+  readmeLines.push('| docker-compose.yml | Docker orchestration |', '| .github/workflows/ci.yml | CI/CD pipeline |');
   files.push({ path: 'README.md', content: readmeLines.join('\n') + '\n' });
 
   const entityObjs = entities.map(name => {
@@ -1621,25 +2424,20 @@ export function updateProject(projectDir, instruction, options = {}) {
   if (intents.has('server') && entityObjs.length > 0) {
     files.push({ path: 'openapi.json', content: JSON.stringify(openApiSpec(entityObjs, intents, { port }, relationships), null, 2) + '\n' });
     files.push({ path: 'admin.html', content: adminPage(entityObjs, intents) });
+    files.push({ path: 'index.html', content: frontendSPA(entityObjs, intents, port) });
   }
   if (intents.has('server')) {
     files.push({ path: 'client.mjs', content: apiClientCode(entityObjs, intents, port) });
   }
 
-  const added = existing
-    ? entities.filter(e => !existing.includes(`schema ${e}`))
-    : entities;
+  const added = existing ? entities.filter(e => !existing.includes(`schema ${e}`)) : entities;
   const analysis = {
-    instruction,
-    entities: entityObjs.map(e => ({ name: e.name, fieldCount: e.fields.length })),
-    relationships,
-    plan: [],
-    added,
+    instruction: '', entities: entityObjs.map(e => ({ name: e.name, fieldCount: e.fields.length })),
+    relationships, plan: [], added,
   };
   if (added.length > 0) analysis.plan.push(`Added: ${added.join(', ')}`);
   if (existing) analysis.plan.push('Merged with existing app.naide');
-  analysis.plan.push(`Total entities: ${entities.length}`);
-  analysis.plan.push(`Supporting files regenerated`);
+  analysis.plan.push(`Total entities: ${entities.length}`, `Supporting files regenerated (${files.length} files)`);
 
   return {
     code: finalCode, valid: combined.valid, fixed: combined.fixed, repairs: combined.repairs,
@@ -1793,17 +2591,22 @@ function buildAnalysis(instruction, intents, params) {
   }
 
   if (intents.has('database')) plan.push(`Database: ${params.dbType || 'file-based'}`);
-  if (intents.has('server'))   plan.push(`Server on port ${params.port}`);
-  if (intents.has('crud'))     plan.push(`CRUD endpoints for ${params.entities.map(e => pluralize(e.name.toLowerCase())).join(', ')} (paginated)`);
-  if (intents.has('auth'))     plan.push('Auth: JWT + register/login/me + role-based admin');
+  if (intents.has('server'))   plan.push(`Server on port ${params.port} (rate-limited, request logging)`);
+  if (intents.has('crud'))     plan.push(`CRUD endpoints for ${params.entities.map(e => pluralize(e.name.toLowerCase())).join(', ')} (paginated, sortable, filterable)`);
+  if (intents.has('crud'))     plan.push(`Input validation: ${params.entities.map(e => `validate${e.name}()`).join(', ')}`);
+  if (intents.has('auth'))     plan.push('Auth: JWT + register/login/me + forgot/reset/change password + role-based admin');
   if (params.relationships.length > 0) plan.push(`Nested routes: ${params.relationships.map(r => `/${pluralize(r.parent.toLowerCase())}/:id/${pluralize(r.child.toLowerCase())}`).join(', ')}`);
-  if (intents.has('websocket'))plan.push('WebSocket: real-time messaging');
+  const m2m = detectManyToMany(params.entities.map(e => e.name));
+  if (m2m.length > 0) plan.push(`M:N relations: ${m2m.map(r => `${r.left}↔${r.right} via ${r.junction}`).join(', ')}`);
+  if (intents.has('auth'))     plan.push('RBAC: requireRole() middleware for admin/moderator/user');
+  if (intents.has('websocket'))plan.push('WebSocket: rooms + broadcast' + (intents.has('auth') ? ' (token auth)' : ''));
   if (intents.has('ai'))       plan.push('AI endpoint: /api/ask');
   if (intents.has('bot'))      plan.push(`Bot: ${params.platform || 'discord'}`);
   if (intents.has('mail'))     plan.push('Mail: SMTP configuration');
   if (intents.has('graphql'))  plan.push('GraphQL endpoint');
   if (intents.has('page'))     plan.push('Page: HTML generation');
   if (intents.has('cli'))      plan.push('CLI app with flags');
+  if (intents.has('server'))   plan.push('Swagger UI at /docs');
   if (intents.has('database') && intents.has('schema')) plan.push('Seed: sample data function');
   plan.push(`Tests: ${params.entities.length} entity CRUD test suites`);
 
@@ -1852,3 +2655,62 @@ export function generate(instruction, options = {}) {
     analysis,
   };
 }
+
+// ── Multi-Target Generation (D6) ─────────────────────────────
+
+const TARGET_EXTENSIONS = {
+  node: '.mjs', python: '.py', bun: '.mjs', typescript: '.ts',
+  go: '.go', java: '.java', rust: '.rs', cpp: '.cpp', c: '.c',
+  csharp: '.cs', kotlin: '.kt', swift: '.swift', dart: '.dart',
+  php: '.php', ruby: '.rb',
+};
+
+const ALL_TARGETS = Object.keys(TARGET_EXTENSIONS);
+
+export async function generateForTarget(instruction, target, options = {}) {
+  const result = generate(instruction, options);
+  if (!result.valid) return { ...result, compiled: null, target };
+
+  let compiled;
+  try {
+    const { compile, compileAsync } = await import('./index.js');
+    if (target === 'node') {
+      const r = compile(result.code);
+      compiled = r.js;
+    } else {
+      const r = await compileAsync(result.code, { target });
+      compiled = r.code;
+    }
+  } catch (e) {
+    compiled = null;
+    result.compileError = e.message;
+  }
+
+  return { ...result, compiled, target, extension: TARGET_EXTENSIONS[target] || '.txt' };
+}
+
+export async function generateAllTargets(instruction, options = {}) {
+  const result = generate(instruction, options);
+  if (!result.valid) return { ...result, targets: {} };
+
+  const targets = {};
+  try {
+    const { compile, compileAsync } = await import('./index.js');
+    for (const target of ALL_TARGETS) {
+      try {
+        if (target === 'node') {
+          targets[target] = { code: compile(result.code).js, ext: '.mjs' };
+        } else {
+          const r = await compileAsync(result.code, { target });
+          targets[target] = { code: r.code, ext: TARGET_EXTENSIONS[target] };
+        }
+      } catch (e) {
+        targets[target] = { error: e.message, ext: TARGET_EXTENSIONS[target] };
+      }
+    }
+  } catch (e) {
+    return { ...result, targets: {}, importError: e.message };
+  }
+
+  return { ...result, targets };
+}