tova 0.4.6 → 0.4.7

package/src/codegen/server-codegen.js

@@ -98,6 +98,43 @@ export class ServerCodegen extends BaseCodegen {
     return checks;
   }
 
+  // Generate nested validation checks for a type, recursing into nested types
+  _genNestedTypeValidation(sharedTypes, objExpr, typeInfo, prefix, indent = '  ') {
+    const checks = [];
+    for (const f of typeInfo.fields) {
+      if (f.name === 'id') continue;
+      const fieldPath = prefix ? `${prefix}.${f.name}` : f.name;
+      const fieldAccess = `${objExpr}.${f.name}`;
+      // Check if this field type references another shared type (nested object)
+      if (sharedTypes.has(f.type)) {
+        const nestedType = sharedTypes.get(f.type);
+        checks.push(`${indent}if (${fieldAccess} !== undefined && ${fieldAccess} !== null) {`);
+        checks.push(`${indent}  if (typeof ${fieldAccess} !== "object" || Array.isArray(${fieldAccess})) __bodyTypeErrors.push("${fieldPath} must be an object");`);
+        checks.push(`${indent}  else {`);
+        const nestedChecks = this._genNestedTypeValidation(sharedTypes, fieldAccess, nestedType, fieldPath, indent + '    ');
+        checks.push(...nestedChecks);
+        checks.push(`${indent}  }`);
+        checks.push(`${indent}}`);
+      } else {
+        switch (f.type) {
+          case 'String':
+            checks.push(`${indent}if (${fieldAccess} !== undefined && typeof ${fieldAccess} !== "string") __bodyTypeErrors.push("${fieldPath} must be a string");`);
+            break;
+          case 'Int':
+            checks.push(`${indent}if (${fieldAccess} !== undefined && !Number.isInteger(${fieldAccess})) __bodyTypeErrors.push("${fieldPath} must be an integer");`);
+            break;
+          case 'Float':
+            checks.push(`${indent}if (${fieldAccess} !== undefined && typeof ${fieldAccess} !== "number") __bodyTypeErrors.push("${fieldPath} must be a number");`);
+            break;
+          case 'Bool':
+            checks.push(`${indent}if (${fieldAccess} !== undefined && typeof ${fieldAccess} !== "boolean") __bodyTypeErrors.push("${fieldPath} must be a boolean");`);
+            break;
+        }
+      }
+    }
+    return checks;
+  }
+
   // Emit handler call, optionally wrapped in Promise.race for timeout
   _emitHandlerCall(lines, callExpr, timeoutMs) {
     if (timeoutMs) {
@@ -108,7 +145,7 @@ export class ServerCodegen extends BaseCodegen {
       lines.push(`      new Promise((_, rej) => setTimeout(() => rej(new Error("__timeout__")), ${timeoutMs}))`);
       lines.push(`    ]);`);
       lines.push(`  } catch (__err) {`);
-      lines.push(`    if (__err.message === "__timeout__") return Response.json({ error: "Gateway Timeout" }, { status: 504 });`);
+      lines.push(`    if (__err.message === "__timeout__") return __errorResponse(504, "GATEWAY_TIMEOUT", "Gateway Timeout");`);
       lines.push(`    throw __err;`);
       lines.push(`  }`);
     } else {
@@ -132,6 +169,7 @@ export class ServerCodegen extends BaseCodegen {
     const middlewares = [];
     const otherStatements = [];
     let healthPath = null;
+    let healthChecks = null;
     let corsConfig = null;
     let errorHandler = null;
     let wsDecl = null;
@@ -180,6 +218,10 @@ export class ServerCodegen extends BaseCodegen {
           middlewares.push(stmt);
         } else if (stmt.type === 'HealthCheckDeclaration') {
           healthPath = stmt.path;
+          if (stmt.checks && stmt.checks.length > 0) {
+            if (!healthChecks) healthChecks = [];
+            healthChecks.push(...stmt.checks);
+          }
         } else if (stmt.type === 'CorsDeclaration') {
           corsConfig = stmt.config;
         } else if (stmt.type === 'ErrorHandlerDeclaration') {
@@ -702,7 +744,17 @@ export class ServerCodegen extends BaseCodegen {
     lines.push('      return obj;');
     lines.push('    } catch { return null; }');
     lines.push('  }');
-    lines.push('  try { return JSON.parse(text); } catch { return null; }');
+    lines.push('  try { return __sanitizeBody(JSON.parse(text)); } catch { return null; }');
+    lines.push('}');
+    lines.push('function __sanitizeBody(obj) {');
+    lines.push('  if (obj === null || typeof obj !== "object") return obj;');
+    lines.push('  if (Array.isArray(obj)) return obj.map(__sanitizeBody);');
+    lines.push('  const clean = {};');
+    lines.push('  for (const key of Object.keys(obj)) {');
+    lines.push('    if (key === "__proto__" || key === "constructor" || key === "prototype") continue;');
+    lines.push('    clean[key] = __sanitizeBody(obj[key]);');
+    lines.push('  }');
+    lines.push('  return clean;');
     lines.push('}');
 
     // ════════════════════════════════════════════════════════════
@@ -763,11 +815,19 @@ export class ServerCodegen extends BaseCodegen {
     lines.push('}');
     lines.push('');
 
+    // ── Structured Error Response ──
+    lines.push('function __errorResponse(status, code, message, details, headers) {');
+    lines.push('  const body = { error: { code, message } };');
+    lines.push('  if (details !== undefined && details !== null) body.error.details = details;');
+    lines.push('  return Response.json(body, { status, headers: headers || {} });');
+    lines.push('}');
+    lines.push('');
+
     // ── Auth Builtins: sign_jwt, hash_password, verify_password ──
     lines.push('// ── Auth Builtins ──');
     lines.push('let __jwtSignKey = null;');
     lines.push('async function sign_jwt(payload, secret, options = {}) {');
-    lines.push('  const __secret = secret || (typeof __authSecret !== "undefined" ? __authSecret : "secret");');
+    lines.push('  const __secret = secret || (typeof __authSecret !== "undefined" ? __authSecret : (process.env.AUTH_SECRET || process.env.JWT_SECRET || ""));');
     lines.push('  if (!__jwtSignKey || __secret !== (typeof __authSecret !== "undefined" ? __authSecret : "")) {');
     lines.push('    __jwtSignKey = await crypto.subtle.importKey(');
     lines.push('      "raw", new TextEncoder().encode(__secret),');
@@ -806,7 +866,10 @@ export class ServerCodegen extends BaseCodegen {
     lines.push('  const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(password), "PBKDF2", false, ["deriveBits"]);');
     lines.push('  const hash = await crypto.subtle.deriveBits({ name: "PBKDF2", salt, iterations, hash: "SHA-256" }, key, 256);');
     lines.push('  const hashHex = [...new Uint8Array(hash)].map(b => b.toString(16).padStart(2, "0")).join("");');
-    lines.push('  return hashHex === expectedHash;');
+    lines.push('  if (hashHex.length !== expectedHash.length) return false;');
+    lines.push('  const __a = Buffer.from(hashHex);');
+    lines.push('  const __b = Buffer.from(expectedHash);');
+    lines.push('  return require("crypto").timingSafeEqual(__a, __b);');
     lines.push('}');
     lines.push('');
 
@@ -838,9 +901,15 @@ export class ServerCodegen extends BaseCodegen {
       const methods = corsConfig.methods ? this.genExpression(corsConfig.methods) : '["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"]';
       const headers = corsConfig.headers ? this.genExpression(corsConfig.headers) : '["Content-Type", "Authorization"]';
       const credentials = corsConfig.credentials ? this.genExpression(corsConfig.credentials) : 'false';
+      const maxAge = corsConfig.max_age ? this.genExpression(corsConfig.max_age) : '"86400"';
+      // Compile-time warning: credentials + wildcard origin is a CORS spec violation
+      if (credentials === 'true' && (origins === '["*"]' || (corsConfig.origins && corsConfig.origins.type === 'ArrayExpression' && corsConfig.origins.elements.some(e => e.value === '*')))) {
+        lines.push('console.warn("[tova] CORS warning: credentials: true with wildcard origin \\"*\\" violates the CORS spec. Browsers will reject these responses. Use explicit origins instead.");');
+      }
       lines.push('// ── CORS ──');
       lines.push(`const __corsOrigins = ${origins};`);
       lines.push(`const __corsCredentials = ${credentials};`);
+      lines.push(`const __corsMaxAge = String(${maxAge});`);
       lines.push('function __getCorsHeaders(req) {');
       lines.push('  const origin = req.headers.get("Origin") || "*";');
       lines.push('  const allowed = __corsOrigins.includes("*") || __corsOrigins.includes(origin);');
@@ -848,21 +917,64 @@ export class ServerCodegen extends BaseCodegen {
       lines.push(`    "Access-Control-Allow-Origin": allowed ? (__corsCredentials ? origin : (origin === "*" ? "*" : origin)) : "",`);
       lines.push(`    "Access-Control-Allow-Methods": ${methods}.join(", "),`);
       lines.push(`    "Access-Control-Allow-Headers": ${headers}.join(", "),`);
+      lines.push('    "Access-Control-Max-Age": __corsMaxAge,');
       lines.push('  };');
       lines.push('  if (__corsCredentials) h["Access-Control-Allow-Credentials"] = "true";');
       lines.push('  return h;');
       lines.push('}');
+    } else if (authConfig || sessionConfig) {
+      // When auth or sessions are configured but no explicit CORS, restrict to same-origin
+      lines.push('// ── CORS (restricted — auth/sessions enabled) ──');
+      lines.push('const __corsHeadersConst = Object.freeze({');
+      lines.push('  "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, PATCH, OPTIONS",');
+      lines.push('  "Access-Control-Allow-Headers": "Content-Type, Authorization, X-Tova-CSRF",');
+      lines.push('  "Access-Control-Max-Age": "86400",');
+      lines.push('});');
+      lines.push('function __getCorsHeaders(req) {');
+      lines.push('  const origin = req && req.headers ? req.headers.get("Origin") : null;');
+      lines.push('  if (!origin) return __corsHeadersConst;');
+      lines.push('  const reqUrl = req.url ? new URL(req.url) : null;');
+      lines.push('  if (reqUrl && origin === reqUrl.origin) {');
+      lines.push('    return { ...__corsHeadersConst, "Access-Control-Allow-Origin": origin, "Access-Control-Allow-Credentials": "true" };');
+      lines.push('  }');
+      lines.push('  return __corsHeadersConst;');
+      lines.push('}');
     } else {
       lines.push('// ── CORS ──');
       lines.push('const __corsHeadersConst = Object.freeze({');
       lines.push('  "Access-Control-Allow-Origin": "*",');
       lines.push('  "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, PATCH, OPTIONS",');
       lines.push('  "Access-Control-Allow-Headers": "Content-Type, Authorization",');
+      lines.push('  "Access-Control-Max-Age": "86400",');
       lines.push('});');
       lines.push('function __getCorsHeaders() { return __corsHeadersConst; }');
     }
     lines.push('');
 
+    // ════════════════════════════════════════════════════════════
+    // 8b. Security Headers — OWASP recommended
+    // ════════════════════════════════════════════════════════════
+    if (!isFastMode) {
+      lines.push('// ── Security Headers ──');
+      lines.push('const __securityHeaders = Object.freeze({');
+      lines.push('  "X-Content-Type-Options": "nosniff",');
+      lines.push('  "X-Frame-Options": "DENY",');
+      lines.push('  "X-XSS-Protection": "0",');
+      lines.push('  "Referrer-Policy": "strict-origin-when-cross-origin",');
+      lines.push('  "Permissions-Policy": "camera=(), microphone=(), geolocation=()",');
+      lines.push('});');
+      if (tlsConfig) {
+        lines.push('const __hstsHeader = { "Strict-Transport-Security": "max-age=31536000; includeSubDomains" };');
+      }
+      lines.push('function __applySecurityHeaders(headers) {');
+      lines.push('  for (const [k, v] of Object.entries(__securityHeaders)) headers.set(k, v);');
+      if (tlsConfig) {
+        lines.push('  headers.set("Strict-Transport-Security", __hstsHeader["Strict-Transport-Security"]);');
+      }
+      lines.push('}');
+      lines.push('');
+    }
+
     // ════════════════════════════════════════════════════════════
     // 9. Auth (F1) — fixed JWT / API key
     // ════════════════════════════════════════════════════════════
@@ -882,8 +994,11 @@ export class ServerCodegen extends BaseCodegen {
         lines.push('}');
       } else {
         // JWT auth (default)
-        const secretExpr = authConfig.secret ? this.genExpression(authConfig.secret) : '"secret"';
+        const secretExpr = authConfig.secret ? this.genExpression(authConfig.secret) : 'process.env.AUTH_SECRET || process.env.JWT_SECRET';
         lines.push(`const __authSecret = ${secretExpr};`);
+        if (!authConfig.secret) {
+          lines.push('if (!process.env.AUTH_SECRET && !process.env.JWT_SECRET) console.warn("[tova] WARNING: No auth secret configured. Set AUTH_SECRET or JWT_SECRET env var, or use auth { secret: \\"...\\" }");');
+        }
         lines.push('let __authKey = null;');
         lines.push('async function __authenticate(req) {');
         lines.push('  const authHeader = req.headers.get("Authorization");');
@@ -939,24 +1054,37 @@ export class ServerCodegen extends BaseCodegen {
         lines.push(`const __rateLimitWindow = ${windowExpr};`);
       }
       lines.push('const __rateLimitStore = new Map();');
+      lines.push('const __rateLimitMaxKeys = 100000;');
       lines.push('function __checkRateLimit(key, max, windowSec) {');
       lines.push('  const now = Date.now();');
       lines.push('  const windowMs = windowSec * 1000;');
       lines.push('  let entry = __rateLimitStore.get(key);');
-      lines.push('  if (!entry) { entry = { timestamps: [] }; __rateLimitStore.set(key, entry); }');
-      lines.push('  entry.timestamps = entry.timestamps.filter(t => now - t < windowMs);');
-      lines.push('  if (entry.timestamps.length >= max) {');
-      lines.push('    const retryAfter = Math.ceil((entry.timestamps[0] + windowMs - now) / 1000);');
-      lines.push('    return { limited: true, retryAfter };');
+      lines.push('  if (!entry) {');
+      lines.push('    if (__rateLimitStore.size >= __rateLimitMaxKeys) {');
+      lines.push('      const oldest = __rateLimitStore.keys().next().value;');
+      lines.push('      __rateLimitStore.delete(oldest);');
+      lines.push('    }');
+      lines.push('    entry = { prevCount: 0, currCount: 0, windowStart: now };');
+      lines.push('    __rateLimitStore.set(key, entry);');
+      lines.push('  }');
+      lines.push('  if (now - entry.windowStart >= windowMs) {');
+      lines.push('    entry.prevCount = entry.currCount;');
+      lines.push('    entry.currCount = 0;');
+      lines.push('    entry.windowStart = now;');
+      lines.push('  }');
+      lines.push('  const elapsed = (now - entry.windowStart) / windowMs;');
+      lines.push('  const estimate = entry.prevCount * (1 - elapsed) + entry.currCount;');
+      lines.push('  if (estimate >= max) {');
+      lines.push('    const retryAfter = Math.ceil(windowSec * (1 - elapsed));');
+      lines.push('    return { limited: true, retryAfter: retryAfter || 1 };');
       lines.push('  }');
-      lines.push('  entry.timestamps.push(now);');
+      lines.push('  entry.currCount++;');
       lines.push('  return { limited: false };');
       lines.push('}');
       lines.push('setInterval(() => {');
       lines.push('  const now = Date.now();');
       lines.push('  for (const [key, entry] of __rateLimitStore) {');
-      lines.push('    entry.timestamps = entry.timestamps.filter(t => now - t < 120000);');
-      lines.push('    if (entry.timestamps.length === 0) __rateLimitStore.delete(key);');
+      lines.push('    if (now - entry.windowStart > 120000) __rateLimitStore.delete(key);');
       lines.push('  }');
       lines.push('}, 60000);');
       lines.push('');
@@ -985,9 +1113,17 @@ export class ServerCodegen extends BaseCodegen {
       lines.push('}');
       lines.push('async function save_file(file, dir) {');
       lines.push('  const fs = await import("node:fs/promises");');
+      lines.push('  const path = await import("node:path");');
       lines.push('  await fs.mkdir(dir, { recursive: true });');
-      lines.push('  const name = file.name || "upload_" + Date.now();');
-      lines.push('  const dest = dir + "/" + name;');
+      lines.push('  let name = file.name || "upload_" + Date.now();');
+      lines.push('  name = path.basename(name).replace(/[\\0]/g, "");');
+      lines.push('  if (!name || name === "." || name === "..") name = "upload_" + Date.now();');
+      lines.push('  const dest = path.join(dir, name);');
+      lines.push('  const resolved = path.resolve(dest);');
+      lines.push('  const resolvedDir = path.resolve(dir);');
+      lines.push('  if (!resolved.startsWith(resolvedDir + path.sep) && resolved !== resolvedDir) {');
+      lines.push('    throw new Error("Invalid file path: directory traversal detected");');
+      lines.push('  }');
       lines.push('  await Bun.write(dest, file);');
       lines.push('  return dest;');
       lines.push('}');
@@ -999,10 +1135,13 @@ export class ServerCodegen extends BaseCodegen {
     // ════════════════════════════════════════════════════════════
     if (sessionConfig) {
       lines.push('// ── Session Management ──');
-      const secretExpr = sessionConfig.secret ? this.genExpression(sessionConfig.secret) : '"tova-session-secret"';
+      const secretExpr = sessionConfig.secret ? this.genExpression(sessionConfig.secret) : 'process.env.SESSION_SECRET';
       const maxAgeExpr = sessionConfig.max_age ? this.genExpression(sessionConfig.max_age) : '3600';
       const cookieNameExpr = sessionConfig.cookie_name ? this.genExpression(sessionConfig.cookie_name) : '"__sid"';
       lines.push(`const __sessionSecret = ${secretExpr};`);
+      if (!sessionConfig.secret) {
+        lines.push('if (!process.env.SESSION_SECRET) console.warn("[tova] WARNING: No session secret configured. Set SESSION_SECRET env var, or use session { secret: \\"...\\" }");');
+      }
       lines.push(`const __sessionMaxAge = ${maxAgeExpr};`);
       lines.push(`const __sessionCookieName = ${cookieNameExpr};`);
       lines.push('let __sessionKey = null;');
@@ -1067,8 +1206,13 @@ export class ServerCodegen extends BaseCodegen {
       } else {
         lines.push('// In-memory session store');
         lines.push('const __sessionStore = new Map();');
+        lines.push('const __sessionMaxKeys = 50000;');
         lines.push('function __createSession(id) {');
         lines.push('  if (!__sessionStore.has(id)) {');
+        lines.push('    if (__sessionStore.size >= __sessionMaxKeys) {');
+        lines.push('      const oldest = __sessionStore.keys().next().value;');
+        lines.push('      __sessionStore.delete(oldest);');
+        lines.push('    }');
         lines.push('    __sessionStore.set(id, { data: {}, createdAt: Date.now() });');
         lines.push('  }');
         lines.push('  const entry = __sessionStore.get(id);');
@@ -1091,6 +1235,52 @@ export class ServerCodegen extends BaseCodegen {
       lines.push('');
     }
 
+    // ════════════════════════════════════════════════════════════
+    // 11d. CSRF Protection — server-side token generation + validation
+    // ════════════════════════════════════════════════════════════
+    const needsCsrf = !isFastMode && (sessionConfig || authConfig);
+    if (needsCsrf) {
+      lines.push('// ── CSRF Protection ──');
+      lines.push('let __csrfKey = null;');
+      lines.push('async function __getCSRFKey() {');
+      lines.push('  if (!__csrfKey) {');
+      lines.push('    const secret = typeof __sessionSecret !== "undefined" ? __sessionSecret : (typeof __authSecret !== "undefined" ? __authSecret : (process.env.CSRF_SECRET || process.env.AUTH_SECRET || ""));');
+      lines.push('    __csrfKey = await crypto.subtle.importKey(');
+      lines.push('      "raw", new TextEncoder().encode(secret + ":csrf"),');
+      lines.push('      { name: "HMAC", hash: "SHA-256" }, false, ["sign", "verify"]');
+      lines.push('    );');
+      lines.push('  }');
+      lines.push('  return __csrfKey;');
+      lines.push('}');
+      lines.push('async function __generateCSRFToken() {');
+      lines.push('  const key = await __getCSRFKey();');
+      lines.push('  const timestamp = Date.now().toString(36);');
+      lines.push('  const nonce = crypto.getRandomValues(new Uint8Array(8));');
+      lines.push('  const nonceHex = [...nonce].map(b => b.toString(16).padStart(2, "0")).join("");');
+      lines.push('  const data = timestamp + ":" + nonceHex;');
+      lines.push('  const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(data));');
+      lines.push('  const sigHex = [...new Uint8Array(sig)].map(b => b.toString(16).padStart(2, "0")).join("");');
+      lines.push('  return data + ":" + sigHex;');
+      lines.push('}');
+      lines.push('async function __validateCSRFToken(token) {');
+      lines.push('  if (!token || typeof token !== "string") return false;');
+      lines.push('  const parts = token.split(":");');
+      lines.push('  if (parts.length !== 3) return false;');
+      lines.push('  const [timestamp, nonce, sig] = parts;');
+      lines.push('  const age = Date.now() - parseInt(timestamp, 36);');
+      lines.push('  if (isNaN(age) || age < 0 || age > 86400000) return false;');
+      lines.push('  const key = await __getCSRFKey();');
+      lines.push('  const data = timestamp + ":" + nonce;');
+      lines.push('  const expectedSig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(data));');
+      lines.push('  const expectedHex = [...new Uint8Array(expectedSig)].map(b => b.toString(16).padStart(2, "0")).join("");');
+      lines.push('  if (sig.length !== expectedHex.length) return false;');
+      lines.push('  const __a = Buffer.from(sig);');
+      lines.push('  const __b = Buffer.from(expectedHex);');
+      lines.push('  return require("crypto").timingSafeEqual(__a, __b);');
+      lines.push('}');
+      lines.push('');
+    }
+
     // ════════════════════════════════════════════════════════════
     // 12. Event Bus (F5) — if subscriptions exist
     // ════════════════════════════════════════════════════════════
@@ -1131,16 +1321,24 @@ export class ServerCodegen extends BaseCodegen {
       lines.push('// ── Background Jobs ──');
       lines.push('const __jobQueue = [];');
       lines.push('let __jobProcessing = false;');
+      lines.push('const __JOB_BASE_DELAY = 1000;');
+      lines.push('const __JOB_MAX_DELAY = 30000;');
+      lines.push('function __jobBackoffDelay(attempt) {');
+      lines.push('  const exp = Math.min(__JOB_BASE_DELAY * Math.pow(2, attempt), __JOB_MAX_DELAY);');
+      lines.push('  const jitter = exp * (0.5 + Math.random() * 0.5);');
+      lines.push('  return Math.round(jitter);');
+      lines.push('}');
       lines.push('async function __processJobQueue() {');
       lines.push('  if (__jobProcessing) return;');
       lines.push('  __jobProcessing = true;');
       lines.push('  while (__jobQueue.length > 0) {');
       lines.push('    const job = __jobQueue.shift();');
       lines.push('    try { await job.fn(...job.args); } catch (err) {');
-      lines.push('      __log("error", `Background job ${job.name} failed`, { error: err.message });');
-      lines.push('      if (job.retries > 0) {');
-      lines.push('        job.retries--;');
-      lines.push('        __jobQueue.push(job);');
+      lines.push('      __log("error", `Background job ${job.name} failed (attempt ${job.attempt + 1}/${job.maxRetries + 1})`, { error: err.message });');
+      lines.push('      if (job.attempt < job.maxRetries) {');
+      lines.push('        const delay = __jobBackoffDelay(job.attempt);');
+      lines.push('        job.attempt++;');
+      lines.push('        setTimeout(() => { __jobQueue.push(job); __processJobQueue(); }, delay);');
       lines.push('      }');
       lines.push('    }');
       lines.push('  }');
@@ -1165,7 +1363,7 @@ export class ServerCodegen extends BaseCodegen {
       lines.push('  };');
       lines.push('  const fn = __jobFns[name];');
       lines.push('  if (!fn) throw new Error(`Unknown background job: ${name}`);');
-      lines.push('  __jobQueue.push({ name, fn, args, retries: 2 });');
+      lines.push('  __jobQueue.push({ name, fn, args, attempt: 0, maxRetries: 3 });');
       lines.push('  setTimeout(__processJobQueue, 0);');
       lines.push('}');
       lines.push('');
@@ -1431,6 +1629,48 @@ export class ServerCodegen extends BaseCodegen {
         lines.push('    return row ? row.count : 0;');
         lines.push('  },');
 
+        // paginate(page, perPage) — returns { data, page, perPage, total, totalPages }
+        lines.push(`  ${isAsync ? 'async ' : ''}paginate(page = 1, perPage = 20) {`);
+        lines.push('    const p = Math.max(1, Math.floor(page));');
+        lines.push('    const pp = Math.max(1, Math.min(100, Math.floor(perPage)));');
+        lines.push('    const offset = (p - 1) * pp;');
+        if (dbDriver === 'postgres') {
+          lines.push(`    const rows = ${aw}db.query("SELECT * FROM ${tableName} ORDER BY id LIMIT $1 OFFSET $2", pp, offset);`);
+        } else {
+          lines.push(`    const rows = ${aw}db.query("SELECT * FROM ${tableName} ORDER BY id LIMIT ? OFFSET ?", pp, offset);`);
+        }
+        lines.push(`    const countRow = ${aw}db.get("SELECT COUNT(*) as count FROM ${tableName}");`);
+        lines.push('    const total = countRow ? countRow.count : 0;');
+        lines.push('    return { data: rows, page: p, perPage: pp, total, totalPages: Math.ceil(total / pp) };');
+        lines.push('  },');
+
+        // soft_delete(id) — sets deleted_at timestamp instead of removing row
+        lines.push(`  ${isAsync ? 'async ' : ''}soft_delete(id) {`);
+        if (dbDriver === 'postgres') {
+          lines.push(`    const rows = ${aw}db.query("UPDATE ${tableName} SET deleted_at = NOW() WHERE id = $1 RETURNING *", id);`);
+          lines.push('    return rows[0];');
+        } else {
+          lines.push(`    ${aw}db.run("UPDATE ${tableName} SET deleted_at = datetime('now') WHERE id = ?", id);`);
+          lines.push(`    return ${aw}db.get("SELECT * FROM ${tableName} WHERE id = ?", id);`);
+        }
+        lines.push('  },');
+
+        // restore(id) — clears deleted_at to restore a soft-deleted row
+        lines.push(`  ${isAsync ? 'async ' : ''}restore(id) {`);
+        if (dbDriver === 'postgres') {
+          lines.push(`    const rows = ${aw}db.query("UPDATE ${tableName} SET deleted_at = NULL WHERE id = $1 RETURNING *", id);`);
+          lines.push('    return rows[0];');
+        } else {
+          lines.push(`    ${aw}db.run("UPDATE ${tableName} SET deleted_at = NULL WHERE id = ?", id);`);
+          lines.push(`    return ${aw}db.get("SELECT * FROM ${tableName} WHERE id = ?", id);`);
+        }
+        lines.push('  },');
+
+        // active() — returns only non-soft-deleted rows
+        lines.push(`  ${isAsync ? 'async ' : ''}active() {`);
+        lines.push(`    return ${aw}db.query("SELECT * FROM ${tableName} WHERE deleted_at IS NULL");`);
+        lines.push('  },');
+
         // belongs_to accessors: PostModel.user(user_id) → single parent record
         for (const parentName of belongsToNames) {
           const parentTable = parentName.toLowerCase() + 's';
@@ -1464,12 +1704,18 @@ export class ServerCodegen extends BaseCodegen {
     // ════════════════════════════════════════════════════════════
     if (sseDecls.length > 0) {
       lines.push('// ── SSE (Server-Sent Events) ──');
+      lines.push('let __sseEventId = 0;');
       lines.push('class __SSEChannel {');
       lines.push('  constructor() { this.clients = new Set(); }');
-      lines.push('  subscribe(controller) { this.clients.add(controller); }');
+      lines.push('  subscribe(controller) {');
+      lines.push('    this.clients.add(controller);');
+      lines.push('    // Send retry directive so browser reconnects after 3s');
+      lines.push('    try { controller.enqueue(new TextEncoder().encode("retry: 3000\\n\\n")); } catch {}');
+      lines.push('  }');
       lines.push('  unsubscribe(controller) { this.clients.delete(controller); }');
       lines.push('  send(data, event = null) {');
       lines.push('    let msg = "";');
+      lines.push('    msg += `id: ${++__sseEventId}\\n`;');
       lines.push('    if (event) msg += `event: ${event}\\n`;');
       lines.push('    msg += `data: ${typeof data === "string" ? data : JSON.stringify(data)}\\n\\n`;');
       lines.push('    const encoded = new TextEncoder().encode(msg);');
@@ -1477,6 +1723,13 @@ export class ServerCodegen extends BaseCodegen {
       lines.push('  }');
       lines.push('  get count() { return this.clients.size; }');
       lines.push('}');
+      // Periodic heartbeat to detect dead connections
+      lines.push('setInterval(() => {');
+      lines.push('  const hb = new TextEncoder().encode(": heartbeat\\n\\n");');
+      lines.push('  for (const [, ch] of __sseChannels) {');
+      lines.push('    for (const c of ch.clients) { try { c.enqueue(hb); } catch { ch.clients.delete(c); } }');
+      lines.push('  }');
+      lines.push('}, 30000);');
       lines.push('const __sseChannels = new Map();');
       lines.push('function sse_channel(name) {');
       lines.push('  if (!__sseChannels.has(name)) __sseChannels.set(name, new __SSEChannel());');
@@ -1492,10 +1745,12 @@ export class ServerCodegen extends BaseCodegen {
         this.popScope();
 
         lines.push(`__addRoute("GET", ${JSON.stringify(sse.path)}, async (req) => {`);
+        lines.push('  const __lastEventId = req.headers.get("Last-Event-ID");');
         lines.push('  const stream = new ReadableStream({');
         lines.push(`    start(controller) {`);
+        lines.push('      controller.enqueue(new TextEncoder().encode("retry: 3000\\n\\n"));');
         lines.push('      const send = (data, event) => {');
-        lines.push('        let msg = "";');
+        lines.push('        let msg = `id: ${++__sseEventId}\\n`;');
         lines.push('        if (event) msg += `event: ${event}\\n`;');
         lines.push('        msg += `data: ${typeof data === "string" ? data : JSON.stringify(data)}\\n\\n`;');
         lines.push('        controller.enqueue(new TextEncoder().encode(msg));');
@@ -1541,7 +1796,7 @@ export class ServerCodegen extends BaseCodegen {
     // ════════════════════════════════════════════════════════════
     // 12h. Race Condition Protection — Async Mutex for shared state
     // ════════════════════════════════════════════════════════════
-    lines.push('// ── Async Mutex ──');
+    lines.push('// ── Async Mutex (Named) ──');
     lines.push('class __Mutex {');
     lines.push('  constructor() { this._queue = []; this._locked = false; }');
     lines.push('  async acquire() {');
@@ -1553,13 +1808,49 @@ export class ServerCodegen extends BaseCodegen {
     lines.push('    else { this._locked = false; }');
     lines.push('  }');
     lines.push('}');
-    lines.push('const __mutex = new __Mutex();');
-    lines.push('async function withLock(fn) {');
-    lines.push('  await __mutex.acquire();');
-    lines.push('  try { return await fn(); } finally { __mutex.release(); }');
+    lines.push('const __locks = new Map();');
+    lines.push('function __getLock(name) {');
+    lines.push('  if (!__locks.has(name)) __locks.set(name, new __Mutex());');
+    lines.push('  return __locks.get(name);');
+    lines.push('}');
+    lines.push('async function withLock(nameOrFn, fn) {');
+    lines.push('  if (typeof nameOrFn === "function") { fn = nameOrFn; nameOrFn = "default"; }');
+    lines.push('  const lock = __getLock(nameOrFn);');
+    lines.push('  await lock.acquire();');
+    lines.push('  try { return await fn(); } finally { lock.release(); }');
     lines.push('}');
     lines.push('');
 
+    // ════════════════════════════════════════════════════════════
+    // 12i. Idempotency Key Support
+    // ════════════════════════════════════════════════════════════
+    if (!isFastMode) {
+      lines.push('// ── Idempotency Key Cache ──');
+      lines.push('const __idempotencyCache = new Map();');
+      lines.push('const __idempotencyMaxKeys = 10000;');
+      lines.push('const __idempotencyTTL = 86400000;'); // 24h default
+      lines.push('function __checkIdempotencyKey(key) {');
+      lines.push('  const entry = __idempotencyCache.get(key);');
+      lines.push('  if (!entry) return null;');
+      lines.push('  if (Date.now() - entry.timestamp > __idempotencyTTL) { __idempotencyCache.delete(key); return null; }');
+      lines.push('  return entry;');
+      lines.push('}');
+      lines.push('function __storeIdempotencyResult(key, status, body, headers) {');
+      lines.push('  if (__idempotencyCache.size >= __idempotencyMaxKeys) {');
+      lines.push('    const oldest = __idempotencyCache.keys().next().value;');
+      lines.push('    __idempotencyCache.delete(oldest);');
+      lines.push('  }');
+      lines.push('  __idempotencyCache.set(key, { status, body, headers, timestamp: Date.now() });');
+      lines.push('}');
+      lines.push('setInterval(() => {');
+      lines.push('  const now = Date.now();');
+      lines.push('  for (const [key, entry] of __idempotencyCache) {');
+      lines.push('    if (now - entry.timestamp > __idempotencyTTL) __idempotencyCache.delete(key);');
+      lines.push('  }');
+      lines.push('}, 3600000);'); // cleanup every hour
+      lines.push('');
+    }
+
     // ════════════════════════════════════════════════════════════
     // 13. Other statements + Server Functions
     // ════════════════════════════════════════════════════════════
@@ -1627,7 +1918,48 @@ export class ServerCodegen extends BaseCodegen {
     if (healthPath) {
       lines.push('// ── Health Check ──');
       lines.push(`__addRoute("GET", ${JSON.stringify(healthPath)}, async () => {`);
-      lines.push('  return Response.json({ status: "ok", uptime: process.uptime() });');
+      if (healthChecks && healthChecks.length > 0) {
+        lines.push('  const __checks = {};');
+        lines.push('  let __overallStatus = "healthy";');
+        // check_memory: report heap usage
+        if (healthChecks.includes('check_memory')) {
+          lines.push('  const __mem = process.memoryUsage();');
+          lines.push('  const __heapPct = __mem.heapUsed / __mem.heapTotal;');
+          lines.push('  __checks.memory = { status: __heapPct > 0.9 ? "degraded" : "healthy", heapUsed: __mem.heapUsed, heapTotal: __mem.heapTotal, rss: __mem.rss };');
+          lines.push('  if (__heapPct > 0.9) __overallStatus = "degraded";');
+        }
+        // check_db: ping database
+        if (healthChecks.includes('check_db') && (dbConfig || usesDb)) {
+          lines.push('  try {');
+          if (dbDriver === 'postgres') {
+            lines.push('    await db.query("SELECT 1");');
+          } else if (dbDriver === 'mysql') {
+            lines.push('    await db.query("SELECT 1");');
+          } else {
+            lines.push('    db.query("SELECT 1");');
+          }
+          lines.push('    __checks.db = { status: "healthy" };');
+          lines.push('  } catch (__dbErr) {');
+          lines.push('    __checks.db = { status: "unhealthy", error: __dbErr.message };');
+          lines.push('    __overallStatus = "unhealthy";');
+          lines.push('  }');
+        }
+        // Always include uptime
+        lines.push('  __checks.uptime = { seconds: Math.floor(process.uptime()) };');
+        lines.push('  return Response.json({ status: __overallStatus, checks: __checks, timestamp: new Date().toISOString() });');
+      } else {
+        lines.push('  return Response.json({ status: "ok", uptime: process.uptime() });');
+      }
+      lines.push('});');
+      lines.push('');
+    }
+
+    // CSRF Token Endpoint
+    if (needsCsrf) {
+      lines.push('// ── CSRF Token Endpoint ──');
+      lines.push('__addRoute("GET", "/csrf-token", async () => {');
+      lines.push('  const token = await __generateCSRFToken();');
+      lines.push('  return Response.json({ token });');
       lines.push('});');
       lines.push('');
     }
@@ -1650,7 +1982,7 @@ export class ServerCodegen extends BaseCodegen {
             for (const check of validationChecks) {
               lines.push(check);
             }
-            lines.push(`  if (__validationErrors.length > 0) return Response.json({ error: "Validation failed", details: __validationErrors }, { status: 400 });`);
+            lines.push(`  if (__validationErrors.length > 0) return __errorResponse(400, "VALIDATION_FAILED", "Validation failed", __validationErrors);`);
           }
           lines.push(`  const result = await ${name}(${paramNames.join(', ')});`);
         } else {
@@ -1736,10 +2068,10 @@ export class ServerCodegen extends BaseCodegen {
         // Auth decorator check
         if (hasAuth && authConfig) {
           lines.push(`  const __user = await __authenticate(req);`);
-          lines.push(`  if (!__user) return Response.json({ error: "Unauthorized" }, { status: 401 });`);
+          lines.push(`  if (!__user) return __errorResponse(401, "AUTH_REQUIRED", "Unauthorized");`);
           if (roleDecorator && roleDecorator.args.length > 0) {
             const roleExpr = this.genExpression(roleDecorator.args[0]);
-            lines.push(`  if (__user.role !== ${roleExpr}) return Response.json({ error: "Forbidden" }, { status: 403 });`);
+            lines.push(`  if (__user.role !== ${roleExpr}) return __errorResponse(403, "FORBIDDEN", "Forbidden");`);
           }
         }
 
@@ -1749,7 +2081,7 @@ export class ServerCodegen extends BaseCodegen {
           const rlWindow = rateLimitDec.args[1] ? this.genExpression(rateLimitDec.args[1]) : '60';
           lines.push(`  const __rlIp = req.headers.get("x-forwarded-for") || "unknown";`);
           lines.push(`  const __rlRoute = __checkRateLimit(\`route:${path}:\${__rlIp}\`, ${rlMax}, ${rlWindow});`);
-          lines.push(`  if (__rlRoute.limited) return Response.json({ error: "Too Many Requests" }, { status: 429, headers: { "Retry-After": String(__rlRoute.retryAfter) } });`);
+          lines.push(`  if (__rlRoute.limited) return __errorResponse(429, "RATE_LIMITED", "Too Many Requests", null, { "Retry-After": String(__rlRoute.retryAfter) });`);
         }
 
         // Upload decorator — parse multipart body, validate file field
@@ -1759,7 +2091,7 @@ export class ServerCodegen extends BaseCodegen {
           lines.push(`  const __uploadField = ${fieldExpr};`);
           lines.push(`  const __uploadFile = __body[__uploadField];`);
           lines.push(`  const __uploadCheck = __validateFile(__uploadFile, __uploadField);`);
-          lines.push(`  if (!__uploadCheck.valid) return Response.json({ error: __uploadCheck.error }, { status: 400 });`);
+          lines.push(`  if (!__uploadCheck.valid) return __errorResponse(400, "VALIDATION_FAILED", __uploadCheck.error);`);
         }
 
         // Validate decorator — advanced field validation on body
@@ -1770,7 +2102,7 @@ export class ServerCodegen extends BaseCodegen {
           lines.push(`  const __validationErrors = [];`);
           const advChecks = this._genAdvancedValidationCode(validateDec.args[0]);
           for (const check of advChecks) lines.push(check);
-          lines.push(`  if (__validationErrors.length > 0) return Response.json({ error: "Validation failed", details: __validationErrors }, { status: 400 });`);
+          lines.push(`  if (__validationErrors.length > 0) return __errorResponse(400, "VALIDATION_FAILED", "Validation failed", __validationErrors);`);
         }
 
         // T9-1: Route-level body type validation — route POST "/api/users" body: User => handler
@@ -1783,7 +2115,7 @@ export class ServerCodegen extends BaseCodegen {
             }
             const isArray = route.bodyType.type === 'ArrayTypeAnnotation';
             if (isArray) {
-              lines.push(`  if (!Array.isArray(__body)) return Response.json({ error: "Request body must be an array of ${typeName}" }, { status: 400 });`);
+              lines.push(`  if (!Array.isArray(__body)) return __errorResponse(400, "VALIDATION_FAILED", "Request body must be an array of ${typeName}");`);
               lines.push(`  const __bodyTypeErrors = [];`);
               lines.push(`  for (let __i = 0; __i < __body.length; __i++) {`);
               lines.push(`    const __item = __body[__i];`);
@@ -1805,32 +2137,18 @@ export class ServerCodegen extends BaseCodegen {
                 }
               }
               lines.push(`  }`);
-              lines.push(`  if (__bodyTypeErrors.length > 0) return Response.json({ error: "Validation failed for ${typeName}[]", details: __bodyTypeErrors }, { status: 400 });`);
+              lines.push(`  if (__bodyTypeErrors.length > 0) return __errorResponse(400, "VALIDATION_FAILED", "Validation failed for ${typeName}[]", __bodyTypeErrors);`);
             } else {
               lines.push(`  const __bodyTypeErrors = [];`);
-              for (const f of typeInfo.fields) {
-                if (f.name === 'id') continue;
-                switch (f.type) {
-                  case 'String':
-                    lines.push(`  if (__body.${f.name} !== undefined && typeof __body.${f.name} !== "string") __bodyTypeErrors.push("${f.name} must be a string");`);
-                    break;
-                  case 'Int':
-                    lines.push(`  if (__body.${f.name} !== undefined && !Number.isInteger(__body.${f.name})) __bodyTypeErrors.push("${f.name} must be an integer");`);
-                    break;
-                  case 'Float':
-                    lines.push(`  if (__body.${f.name} !== undefined && typeof __body.${f.name} !== "number") __bodyTypeErrors.push("${f.name} must be a number");`);
-                    break;
-                  case 'Bool':
-                    lines.push(`  if (__body.${f.name} !== undefined && typeof __body.${f.name} !== "boolean") __bodyTypeErrors.push("${f.name} must be a boolean");`);
-                    break;
-                }
-              }
+              // Recursive nested validation for body type fields
+              const nestedChecks = this._genNestedTypeValidation(sharedTypes, '__body', typeInfo, '');
+              for (const check of nestedChecks) lines.push(check);
               // Check for required fields (non-id fields without defaults)
               for (const f of typeInfo.fields) {
                 if (f.name === 'id') continue;
                 lines.push(`  if (__body.${f.name} === undefined || __body.${f.name} === null) __bodyTypeErrors.push("${f.name} is required");`);
               }
-              lines.push(`  if (__bodyTypeErrors.length > 0) return Response.json({ error: "Validation failed for type ${typeName}", details: __bodyTypeErrors }, { status: 400 });`);
+              lines.push(`  if (__bodyTypeErrors.length > 0) return __errorResponse(400, "VALIDATION_FAILED", "Validation failed for type ${typeName}", __bodyTypeErrors);`);
             }
           }
         }
@@ -1862,7 +2180,7 @@ export class ServerCodegen extends BaseCodegen {
                     break;
                 }
               }
-              lines.push(`  if (__tsErrors_${p.name}.length > 0) return Response.json({ error: "Validation failed", details: __tsErrors_${p.name} }, { status: 400 });`);
+              lines.push(`  if (__tsErrors_${p.name}.length > 0) return __errorResponse(400, "VALIDATION_FAILED", "Validation failed", __tsErrors_${p.name});`);
             }
           }
         }
@@ -1906,7 +2224,7 @@ export class ServerCodegen extends BaseCodegen {
                 if (validationChecks.length > 0) {
                   lines.push(`  const __validationErrors = [];`);
                   for (const check of validationChecks) lines.push(check);
-                  lines.push(`  if (__validationErrors.length > 0) return Response.json({ error: "Validation failed", details: __validationErrors }, { status: 400 });`);
+                  lines.push(`  if (__validationErrors.length > 0) return __errorResponse(400, "VALIDATION_FAILED", "Validation failed", __validationErrors);`);
                 }
               }
               if (groupMws.length > 0) {
@@ -1938,7 +2256,7 @@ export class ServerCodegen extends BaseCodegen {
               if (validationChecks.length > 0) {
                 lines.push(`  const __validationErrors = [];`);
                 for (const check of validationChecks) lines.push(check);
-                lines.push(`  if (__validationErrors.length > 0) return Response.json({ error: "Validation failed", details: __validationErrors }, { status: 400 });`);
+                lines.push(`  if (__validationErrors.length > 0) return __errorResponse(400, "VALIDATION_FAILED", "Validation failed", __validationErrors);`);
               }
             }
             if (groupMws.length > 0) {
@@ -2033,9 +2351,32 @@ export class ServerCodegen extends BaseCodegen {
       lines.push('  openapi: "3.0.3",');
       lines.push(`  info: { title: ${JSON.stringify(blockName || 'Tova API')}, version: "1.0.0" },`);
       lines.push('  paths: {},');
-      lines.push('  components: { schemas: {} },');
+      lines.push('  components: { schemas: {}, securitySchemes: {} },');
+      lines.push('};');
+
+      // Standard error response schema
+      lines.push('__openApiSpec.components.schemas.ErrorResponse = {');
+      lines.push('  type: "object",');
+      lines.push('  properties: {');
+      lines.push('    error: { type: "object", properties: {');
+      lines.push('      code: { type: "string", description: "Machine-readable error code" },');
+      lines.push('      message: { type: "string", description: "Human-readable error message" },');
+      lines.push('      details: { type: "array", items: { type: "string" }, description: "Validation error details", nullable: true },');
+      lines.push('    }, required: ["code", "message"] },');
+      lines.push('  },');
       lines.push('};');
 
+      // Add auth security schemes to OpenAPI spec
+      if (authConfig) {
+        const authType = authConfig.type ? authConfig.type.value : 'jwt';
+        if (authType === 'api_key') {
+          const headerExpr = authConfig.header ? this.genExpression(authConfig.header) : '"X-API-Key"';
+          lines.push(`__openApiSpec.components.securitySchemes.ApiKeyAuth = { type: "apiKey", in: "header", name: ${headerExpr} };`);
+        } else {
+          lines.push('__openApiSpec.components.securitySchemes.BearerAuth = { type: "http", scheme: "bearer", bearerFormat: "JWT" };');
+        }
+      }
+
       // Generate schemas from shared types
       for (const [typeName, typeInfo] of sharedTypes) {
         const props = typeInfo.fields.map(f => {
@@ -2145,6 +2486,38 @@ export class ServerCodegen extends BaseCodegen {
           lines.push('  responses: { "200": { description: "Success" } },');
         }
 
+        // Auto-generate error responses based on route context
+        const routeHasAuth = (route.decorators || []).some(d => d.name === 'auth');
+        const routeHasRateLimit = (route.decorators || []).some(d => d.name === 'rate_limit');
+        const routeHasValidation = (route.decorators || []).some(d => d.name === 'validate') || route.bodyType;
+        const routeHasTimeout = (route.decorators || []).some(d => d.name === 'timeout');
+        const errRef = '{ "$ref": "#/components/schemas/ErrorResponse" }';
+
+        // Merge error responses into existing 200 response
+        lines.push(`const __r = __openApiSpec.paths[${JSON.stringify(path)}][${JSON.stringify(method)}].responses;`);
+        if (routeHasValidation || ['post', 'put', 'patch'].includes(method)) {
+          lines.push(`__r["400"] = { description: "Validation Failed", content: { "application/json": { schema: ${errRef} } } };`);
+        }
+        if (routeHasAuth && authConfig) {
+          const authType = authConfig.type ? authConfig.type.value : 'jwt';
+          const schemeName = authType === 'api_key' ? 'ApiKeyAuth' : 'BearerAuth';
+          lines.push(`__openApiSpec.paths[${JSON.stringify(path)}][${JSON.stringify(method)}].security = [{ "${schemeName}": [] }];`);
+          lines.push(`__r["401"] = { description: "Unauthorized", content: { "application/json": { schema: ${errRef} } } };`);
+          if ((route.decorators || []).some(d => d.name === 'role')) {
+            lines.push(`__r["403"] = { description: "Forbidden", content: { "application/json": { schema: ${errRef} } } };`);
+          }
+        }
+        if (pathParams.length > 0) {
+          lines.push(`__r["404"] = { description: "Not Found", content: { "application/json": { schema: ${errRef} } } };`);
+        }
+        if (routeHasRateLimit || rateLimitConfig) {
+          lines.push(`__r["429"] = { description: "Too Many Requests", content: { "application/json": { schema: ${errRef} } } };`);
+        }
+        if (routeHasTimeout) {
+          lines.push(`__r["504"] = { description: "Gateway Timeout", content: { "application/json": { schema: ${errRef} } } };`);
+        }
+        lines.push(`__r["500"] = { description: "Internal Server Error", content: { "application/json": { schema: ${errRef} } } };`);
+
         lines.push('};');
       }
 
@@ -2202,9 +2575,14 @@ export class ServerCodegen extends BaseCodegen {
     if (!isFastMode) {
     lines.push('// ── Structured Logging ──');
     lines.push('let __reqCounter = 0;');
+    lines.push('const __validRequestId = /^[a-zA-Z0-9\\-_.]{1,128}$/;');
     lines.push('function __genRequestId() {');
     lines.push('  return `${Date.now().toString(36)}-${(++__reqCounter).toString(36)}`;');
     lines.push('}');
+    lines.push('function __sanitizeRequestId(raw) {');
+    lines.push('  if (raw && __validRequestId.test(raw)) return raw;');
+    lines.push('  return __genRequestId();');
+    lines.push('}');
     lines.push('const __logLevels = { debug: 0, info: 1, warn: 2, error: 3 };');
     lines.push('const __logMinLevel = __logLevels[process.env.LOG_LEVEL || "info"] || 1;');
     lines.push('let __logFile = null;');
@@ -2228,8 +2606,13 @@ export class ServerCodegen extends BaseCodegen {
       if (staticDecl.fallback) {
         lines.push(`const __staticFallback = ${JSON.stringify(staticDecl.fallback)};`);
       }
+      lines.push('const __path = await import("node:path");');
+      lines.push('const __resolvedStaticDir = __path.resolve(__staticDir);');
       lines.push('async function __serveStatic(pathname, req) {');
-      lines.push('  const filePath = __staticDir + pathname.slice(__staticPrefix.length);');
+      lines.push('  const relative = pathname.slice(__staticPrefix.length);');
+      lines.push('  const filePath = __path.join(__staticDir, relative);');
+      lines.push('  const resolved = __path.resolve(filePath);');
+      lines.push('  if (!resolved.startsWith(__resolvedStaticDir + __path.sep) && resolved !== __resolvedStaticDir) return null;');
       lines.push('  try {');
       lines.push('    const file = Bun.file(filePath);');
       lines.push('    if (await file.exists()) {');
@@ -2257,6 +2640,20 @@ export class ServerCodegen extends BaseCodegen {
       lines.push('// ── WebSocket Handlers ──');
       lines.push('const __wsClients = new Set();');
       lines.push('const __wsRooms = new Map();');
+      // Per-client message rate limiting
+      lines.push('const __wsRateLimit = new Map();');
+      lines.push('const __wsRateLimitMax = 100;');  // max messages per window
+      lines.push('const __wsRateLimitWindow = 10000;'); // 10 second window
+      lines.push('function __wsCheckRate(ws) {');
+      lines.push('  const now = Date.now();');
+      lines.push('  let entry = __wsRateLimit.get(ws);');
+      lines.push('  if (!entry || now - entry.windowStart >= __wsRateLimitWindow) {');
+      lines.push('    entry = { count: 0, windowStart: now };');
+      lines.push('    __wsRateLimit.set(ws, entry);');
+      lines.push('  }');
+      lines.push('  entry.count++;');
+      lines.push('  return entry.count <= __wsRateLimitMax;');
+      lines.push('}');
       lines.push('function broadcast(data, exclude = null) {');
       lines.push('  const msg = typeof data === "string" ? data : JSON.stringify(data);');
       lines.push('  for (const c of __wsClients) { if (c !== exclude) c.send(msg); }');
@@ -2457,7 +2854,7 @@ export class ServerCodegen extends BaseCodegen {
     lines.push('  const __pStart = __rawUrl.indexOf("/", 12);');  // skip "http://x:p" or "https://x:p"
     lines.push('  const __qIdx = __rawUrl.indexOf("?", __pStart);');
     lines.push('  const __pathname = __qIdx === -1 ? __rawUrl.slice(__pStart) : __rawUrl.slice(__pStart, __qIdx);');
-    lines.push('  const __rid = req.headers.get("X-Request-Id") || __genRequestId();');
+    lines.push('  const __rid = __sanitizeRequestId(req.headers.get("X-Request-Id"));');
     lines.push('  const __startTime = Date.now();');
     lines.push('  const __cors = __getCorsHeaders(req);');
 
@@ -2482,7 +2879,7 @@ export class ServerCodegen extends BaseCodegen {
         lines.push('      if (upgraded) return undefined;');
         lines.push('      return new Response("WebSocket upgrade failed", { status: 400 });');
         lines.push('    } catch (__authErr) {');
-        lines.push('      return Response.json({ error: "Unauthorized" }, { status: 401 });');
+        lines.push('      return __errorResponse(401, "AUTH_REQUIRED", "Unauthorized");');
         lines.push('    }');
       } else {
         lines.push('    const upgraded = __server.upgrade(req, { data: { rid: __rid } });');
@@ -2499,7 +2896,7 @@ export class ServerCodegen extends BaseCodegen {
     // Max body size check
     lines.push('  const __contentLength = parseInt(req.headers.get("Content-Length") || "0", 10);');
     lines.push('  if (__contentLength > __maxBodySize) {');
-    lines.push('    return Response.json({ error: "Payload Too Large" }, { status: 413, headers: __cors });');
+    lines.push('    return __errorResponse(413, "PAYLOAD_TOO_LARGE", "Payload Too Large", null, __cors);');
     lines.push('  }');
 
     // Global rate limit check (F2)
@@ -2507,7 +2904,7 @@ export class ServerCodegen extends BaseCodegen {
       lines.push('  const __clientIp = req.headers.get("x-forwarded-for") || "unknown";');
       lines.push('  const __rl = __checkRateLimit(__clientIp, __rateLimitMax, __rateLimitWindow);');
       lines.push('  if (__rl.limited) {');
-      lines.push('    return Response.json({ error: "Too Many Requests" }, { status: 429, headers: { ...__cors, "Retry-After": String(__rl.retryAfter) } });');
+      lines.push('    return __errorResponse(429, "RATE_LIMITED", "Too Many Requests", null, { ...__cors, "Retry-After": String(__rl.retryAfter) });');
       lines.push('  }');
     }
 
@@ -2527,6 +2924,28 @@ export class ServerCodegen extends BaseCodegen {
       lines.push('  req.__session = __createSession(__sessionId);');
     }
 
+    // CSRF validation on state-mutating requests
+    if (needsCsrf) {
+      lines.push('  if (req.method !== "GET" && req.method !== "HEAD" && req.method !== "OPTIONS") {');
+      lines.push('    const __csrfToken = req.headers.get("X-Tova-CSRF") || req.headers.get("x-tova-csrf");');
+      lines.push('    const __csrfValid = await __validateCSRFToken(__csrfToken);');
+      lines.push('    if (!__csrfValid) {');
+      lines.push('      __log("warn", "CSRF validation failed", { rid: __rid, method: req.method, path: __pathname });');
+      lines.push('      return __errorResponse(403, "CSRF_INVALID", "CSRF token invalid or missing", null, __cors);');
+      lines.push('    }');
+      lines.push('  }');
+    }
+
+    // Idempotency key check
+    lines.push('  const __idempotencyKey = req.headers.get("Idempotency-Key");');
+    lines.push('  if (__idempotencyKey && req.method !== "GET" && req.method !== "HEAD" && req.method !== "OPTIONS") {');
+    lines.push('    const __cached = __checkIdempotencyKey(__idempotencyKey);');
+    lines.push('    if (__cached) {');
+    lines.push('      const __cachedHeaders = { ...__cors, ...(__cached.headers || {}), "X-Idempotent-Replayed": "true" };');
+    lines.push('      return new Response(JSON.stringify(__cached.body), { status: __cached.status, headers: { "Content-Type": "application/json", ...__cachedHeaders } });');
+    lines.push('    }');
+    lines.push('  }');
+
     // Static file serving
     if (staticDecl) {
       lines.push(`  if (__pathname.startsWith(__staticPrefix)) {`);
@@ -2556,7 +2975,7 @@ export class ServerCodegen extends BaseCodegen {
       lines.push('      for (const [k, v] of Object.entries(__cors)) headers.set(k, v);');
       lines.push('      return new Response(res.body, { status: res.status, headers });');
       lines.push('    } catch (err) {');
-      lines.push('      if (err.message === "__BODY_TOO_LARGE__") return Response.json({ error: "Payload Too Large" }, { status: 413, headers: __cors });');
+      lines.push('      if (err.message === "__BODY_TOO_LARGE__") return __errorResponse(413, "PAYLOAD_TOO_LARGE", "Payload Too Large", null, __cors);');
       if (errorHandler) {
         lines.push('      try {');
         lines.push('        const errRes = await __errorHandler(err, req);');
@@ -2569,7 +2988,7 @@ export class ServerCodegen extends BaseCodegen {
         lines.push('      } catch { /**/ }');
       }
       lines.push('      __log("error", `Unhandled error: ${err.message}`, { error: err.stack || err.message });');
-      lines.push('      return Response.json({ error: "Internal Server Error" }, { status: 500, headers: __cors });');
+      lines.push('      return __errorResponse(500, "INTERNAL_ERROR", "Internal Server Error", null, __cors);');
       lines.push('    }');
     } else {
       lines.push('    try {');
@@ -2578,7 +2997,7 @@ export class ServerCodegen extends BaseCodegen {
       lines.push('      for (const [k, v] of Object.entries(__cors)) res.headers.set(k, v);');
       lines.push('      return res;');
       lines.push('    } catch (err) {');
-      lines.push('      if (err.message === "__BODY_TOO_LARGE__") return Response.json({ error: "Payload Too Large" }, { status: 413, headers: __cors });');
+      lines.push('      if (err.message === "__BODY_TOO_LARGE__") return __errorResponse(413, "PAYLOAD_TOO_LARGE", "Payload Too Large", null, __cors);');
       if (errorHandler) {
         lines.push('      try {');
         lines.push('        const errRes = await __errorHandler(err, req);');
@@ -2590,7 +3009,7 @@ export class ServerCodegen extends BaseCodegen {
         lines.push('      } catch { /**/ }');
       }
       lines.push('      __log("error", `Unhandled error: ${err.message}`, { error: err.stack || err.message });');
-      lines.push('      return Response.json({ error: "Internal Server Error" }, { status: 500, headers: __cors });');
+      lines.push('      return __errorResponse(500, "INTERNAL_ERROR", "Internal Server Error", null, __cors);');
       lines.push('    }');
     }
     lines.push('  }');
@@ -2614,7 +3033,7 @@ export class ServerCodegen extends BaseCodegen {
       lines.push('          for (const [k, v] of Object.entries(__cors)) res.headers.set(k, v);');
       lines.push('          return res;');
       lines.push('        } catch (err) {');
-      lines.push('          if (err.message === "__BODY_TOO_LARGE__") return Response.json({ error: "Payload Too Large" }, { status: 413, headers: __cors });');
+      lines.push('          if (err.message === "__BODY_TOO_LARGE__") return __errorResponse(413, "PAYLOAD_TOO_LARGE", "Payload Too Large", null, __cors);');
       if (errorHandler) {
         lines.push('          try {');
         lines.push('            const errRes = await __errorHandler(err, req);');
@@ -2626,7 +3045,7 @@ export class ServerCodegen extends BaseCodegen {
         lines.push('          } catch { /**/ }');
       }
       lines.push('          __log("error", `Unhandled error: ${err.message}`, { error: err.stack || err.message });');
-      lines.push('          return Response.json({ error: "Internal Server Error" }, { status: 500, headers: __cors });');
+      lines.push('          return __errorResponse(500, "INTERNAL_ERROR", "Internal Server Error", null, __cors);');
       lines.push('        }');
     } else {
       lines.push('        try {');
@@ -2635,7 +3054,7 @@ export class ServerCodegen extends BaseCodegen {
       lines.push('          for (const [k, v] of Object.entries(__cors)) res.headers.set(k, v);');
       lines.push('          return res;');
       lines.push('        } catch (err) {');
-      lines.push('          if (err.message === "__BODY_TOO_LARGE__") return Response.json({ error: "Payload Too Large" }, { status: 413, headers: __cors });');
+      lines.push('          if (err.message === "__BODY_TOO_LARGE__") return __errorResponse(413, "PAYLOAD_TOO_LARGE", "Payload Too Large", null, __cors);');
       if (errorHandler) {
         lines.push('          try {');
         lines.push('            const errRes = await __errorHandler(err, req);');
@@ -2647,7 +3066,7 @@ export class ServerCodegen extends BaseCodegen {
         lines.push('          } catch { /**/ }');
       }
       lines.push('          __log("error", `Unhandled error: ${err.message}`, { error: err.stack || err.message });');
-      lines.push('          return Response.json({ error: "Internal Server Error" }, { status: 500, headers: __cors });');
+      lines.push('          return __errorResponse(500, "INTERNAL_ERROR", "Internal Server Error", null, __cors);');
       lines.push('        }');
     }
 
@@ -2659,7 +3078,7 @@ export class ServerCodegen extends BaseCodegen {
     lines.push('  if (__pathname === "/" && typeof __clientHTML !== "undefined") {');
     lines.push('    return new Response(__clientHTML, { status: 200, headers: { "Content-Type": "text/html", ...(__cors) } });');
     lines.push('  }');
-    lines.push('  const __notFound = Response.json({ error: "Not Found" }, { status: 404, headers: __cors });');
+    lines.push('  const __notFound = __errorResponse(404, "NOT_FOUND", "Not Found", null, __cors);');
     lines.push('  __log("warn", "Not Found", { rid: __rid, method: req.method, path: __pathname, status: 404, ms: Date.now() - __startTime });');
     lines.push('  return __notFound;');
 
@@ -2670,7 +3089,7 @@ export class ServerCodegen extends BaseCodegen {
       lines.push('    if (__res && __sessionIsNew) {');
       lines.push('      const __signed = await __signSessionId(__sessionId);');
       lines.push('      const __h = new Headers(__res.headers);');
-      lines.push('      __h.set("Set-Cookie", `${__sessionCookieName}=${__signed}; Path=/; HttpOnly; Max-Age=${__sessionMaxAge}`);');
+      lines.push('      __h.set("Set-Cookie", `${__sessionCookieName}=${__signed}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=${__sessionMaxAge}`);');
       lines.push('      return new Response(__res.body, { status: __res.status, headers: __h });');
       lines.push('    }');
       lines.push('    return __res;');
@@ -2695,18 +3114,39 @@ export class ServerCodegen extends BaseCodegen {
     const portVar = blockName ? `PORT_${blockName.toUpperCase().replace(/[^A-Z0-9]/g, '_')}` : 'PORT';
     lines.push('// ── Start Server ──');
     lines.push(`const __port = process.env.${portVar} || process.env.PORT || 3000;`);
-    // Compression wrapper
-    if (compressionConfig) {
-      lines.push('const __fetchHandler = async (req) => {');
+    // Idempotency + Compression wrapper
+    if (!isFastMode) {
+      lines.push('const __idempotentFetch = async (req) => {');
+      if (compressionConfig) {
+        lines.push('  const __rawRes = await __handleRequest(req);');
+        lines.push('  if (!__rawRes) return __rawRes;');
+        lines.push('  const res = await __compressResponse(req, __rawRes);');
+      } else {
+        lines.push('  const res = await __handleRequest(req);');
+      }
+      lines.push('  const __idk = req.headers.get("Idempotency-Key");');
+      lines.push('  if (__idk && res && req.method !== "GET" && req.method !== "HEAD" && req.method !== "OPTIONS") {');
+      lines.push('    try {');
+      lines.push('      const __cloned = res.clone();');
+      lines.push('      const __resBody = await __cloned.json();');
+      lines.push('      __storeIdempotencyResult(__idk, res.status, __resBody, {});');
+      lines.push('    } catch {}');
+      lines.push('  }');
+      lines.push('  if (res) __applySecurityHeaders(res.headers);');
+      lines.push('  return res;');
+      lines.push('};');
+    } else if (compressionConfig) {
+      lines.push('const __idempotentFetch = async (req) => {');
       lines.push('  const res = await __handleRequest(req);');
       lines.push('  if (!res) return res;');
       lines.push('  return __compressResponse(req, res);');
       lines.push('};');
     }
+    const fetchHandler = (!isFastMode || compressionConfig) ? '__idempotentFetch' : '__handleRequest';
     lines.push(`const __server = Bun.serve({`);
     lines.push(`  port: __port,`);
     lines.push(`  maxRequestBodySize: __maxBodySize,`);
-    lines.push(`  fetch: ${compressionConfig ? '__fetchHandler' : '__handleRequest'},`);
+    lines.push(`  fetch: ${fetchHandler},`);
     if (tlsConfig) {
       const certExpr = tlsConfig.cert ? this.genExpression(tlsConfig.cert) : 'undefined';
       const keyExpr = tlsConfig.key ? this.genExpression(tlsConfig.key) : 'undefined';
@@ -2720,18 +3160,23 @@ export class ServerCodegen extends BaseCodegen {
     }
     if (wsDecl) {
       lines.push(`  websocket: {`);
+      lines.push(`    idleTimeout: 120,`);  // 2 minute idle timeout with auto-ping
       if (wsDecl.handlers.on_open) {
         lines.push(`    open(ws) { __wsClients.add(ws); __wsHandlers.on_open(ws); },`);
       } else {
         lines.push(`    open(ws) { __wsClients.add(ws); },`);
       }
       if (wsDecl.handlers.on_message) {
-        lines.push(`    message(ws, message) { __wsHandlers.on_message(ws, message); },`);
+        // Rate limit check before dispatching to user handler
+        lines.push(`    message(ws, message) {`);
+        lines.push(`      if (!__wsCheckRate(ws)) { ws.send(JSON.stringify({ error: "RATE_LIMITED", message: "Too many messages" })); return; }`);
+        lines.push(`      __wsHandlers.on_message(ws, message);`);
+        lines.push(`    },`);
       }
       if (wsDecl.handlers.on_close) {
-        lines.push(`    close(ws, code, reason) { __wsClients.delete(ws); for (const [,r] of __wsRooms) r.delete(ws); __wsHandlers.on_close(ws, code, reason); },`);
+        lines.push(`    close(ws, code, reason) { __wsClients.delete(ws); __wsRateLimit.delete(ws); for (const [,r] of __wsRooms) r.delete(ws); __wsHandlers.on_close(ws, code, reason); },`);
       } else {
-        lines.push(`    close(ws) { __wsClients.delete(ws); for (const [,r] of __wsRooms) r.delete(ws); },`);
+        lines.push(`    close(ws) { __wsClients.delete(ws); __wsRateLimit.delete(ws); for (const [,r] of __wsRooms) r.delete(ws); },`);
       }
       if (wsDecl.handlers.on_error) {
         lines.push(`    error(ws, error) { __wsHandlers.on_error(ws, error); },`);