tova 0.8.2 → 0.9.4

package/src/codegen/codegen.js

@@ -42,6 +42,12 @@ function getDeployCodegen() {
   return _DeployCodegen;
 }
 
+let _ThemeCodegen;
+function getThemeCodegen() {
+  if (!_ThemeCodegen) _ThemeCodegen = _require('./theme-codegen.js').ThemeCodegen;
+  return _ThemeCodegen;
+}
+
 export class CodeGenerator {
   constructor(ast, filename = '<stdin>', options = {}) {
     this.ast = ast;
@@ -66,6 +72,11 @@ export class CodeGenerator {
     const topLevel = [];
 
     for (const node of this.ast.body) {
+      // pub component declarations at top level are module-level exports, not browser block children
+      if (node.type === 'ComponentDeclaration' && node.isPublic) {
+        topLevel.push(node);
+        continue;
+      }
       const plugin = BlockRegistry.getByAstType(node.type);
       if (plugin) {
         if (!blocksByType.has(plugin.name)) blocksByType.set(plugin.name, []);
@@ -94,20 +105,66 @@ export class CodeGenerator {
     const securityBlocks = getBlocks('security');
     const edgeBlocks = getBlocks('edge');
     const deployBlocks = getBlocks('deploy');
+    const themeBlocks = getBlocks('theme');
 
     // Detect module mode: no blocks, only top-level statements
     const hasAnyBlocks = BlockRegistry.all().some(p => getBlocks(p.name).length > 0);
     const isModule = !hasAnyBlocks && topLevel.length > 0;
 
     if (isModule) {
+      // Separate pub component declarations from other top-level nodes
+      const componentNodes = topLevel.filter(n => n.type === 'ComponentDeclaration');
+      const otherNodes = topLevel.filter(n => n.type !== 'ComponentDeclaration');
+
       const moduleGen = new SharedCodegen();
       moduleGen._sourceMapsEnabled = this._sourceMaps;
       moduleGen.setSourceFile(this.filename);
-      // Use genBlockStatements for pattern optimization (array fill detection, etc.)
-      const fakeBlock = { type: 'BlockStatement', body: topLevel };
-      const moduleCode = moduleGen.genBlockStatements(fakeBlock);
+
+      // Generate non-component top-level code
+      let moduleCode = '';
+      if (otherNodes.length > 0) {
+        const fakeBlock = { type: 'BlockStatement', body: otherNodes };
+        moduleCode = moduleGen.genBlockStatements(fakeBlock);
+      }
+
+      // Generate pub component code using BrowserCodegen
+      let componentCode = '';
+      if (componentNodes.length > 0) {
+        const BrowserCodegen = getBrowserCodegen();
+        const compGen = new BrowserCodegen();
+        compGen._sourceMapsEnabled = this._sourceMaps;
+        compGen.setSourceFile(this.filename);
+
+        // Sort: parent components first, then compound (child) components
+        const sortedComponents = [...componentNodes].sort((a, b) => {
+          const aIsChild = a.parent ? 1 : 0;
+          const bIsChild = b.parent ? 1 : 0;
+          return aIsChild - bIsChild;
+        });
+
+        const compParts = [];
+        for (const comp of sortedComponents) {
+          if (comp.parent) {
+            // Compound component — assign as property on parent
+            compParts.push(`${comp.parent}.${comp.child} = ${compGen.generateComponent(comp)};`);
+          } else {
+            const exportPrefix = comp.isPublic ? 'export ' : '';
+            compParts.push(exportPrefix + compGen.generateComponent(comp));
+          }
+        }
+        componentCode = compParts.join('\n\n');
+      }
+
       const helpers = moduleGen.generateHelpers();
-      const combined = [helpers, moduleCode].filter(s => s.trim()).join('\n').trim();
+      const parts = [helpers];
+
+      // Add runtime imports for component DOM/reactivity functions
+      if (componentNodes.length > 0) {
+        parts.unshift(`import { createSignal, createEffect, createComputed, batch, onMount, onUnmount, onCleanup, tova_el, tova_fragment, tova_keyed, tova_inject_css, createRef, createContext, provide, inject } from './runtime/reactivity.js';`);
+      }
+
+      parts.push(moduleCode, componentCode);
+      const combined = parts.filter(s => s.trim()).join('\n').trim();
       return {
         shared: combined,
         server: '',
@@ -171,6 +228,11 @@ export class CodeGenerator {
       ? getSecurityCodegen().mergeSecurityBlocks(securityBlocks)
       : null;
 
+    // Merge theme blocks into a single config
+    const themeConfig = themeBlocks.length > 0
+      ? getThemeCodegen().mergeThemeBlocks(themeBlocks)
+      : null;
+
     // Generate server outputs (one per named group)
     const servers = {};
     for (const [name, blocks] of serverGroups) {
@@ -222,7 +284,7 @@ export class CodeGenerator {
       const gen = new (getBrowserCodegen())();
       gen._sourceMapsEnabled = this._sourceMaps;
       const key = name || 'default';
-      browsers[key] = gen.generate(blocks, combinedShared, sharedGen._usedBuiltins, securityConfig, typeValidatorsMap);
+      browsers[key] = gen.generate(blocks, combinedShared, sharedGen._usedBuiltins, securityConfig, typeValidatorsMap, themeConfig);
     }
 
     // Generate edge outputs (one per named group)

package/src/codegen/server-codegen.js

@@ -1052,6 +1052,22 @@ export class ServerCodegen extends BaseCodegen {
     // ════════════════════════════════════════════════════════════
     // 8b. Security Headers — OWASP recommended
     // ════════════════════════════════════════════════════════════
+    // Always emit base security headers (even in fast mode)
+    lines.push('// ── Base Security Headers (always) ──');
+    lines.push('const __baseSecurityHeaders = Object.freeze({');
+    lines.push('  "X-Content-Type-Options": "nosniff",');
+    lines.push('  "X-Frame-Options": "DENY",');
+    lines.push('  "X-XSS-Protection": "0",');
+    lines.push('  "Referrer-Policy": "strict-origin-when-cross-origin",');
+    lines.push('});');
+    lines.push('function __applyBaseHeaders(res) {');
+    lines.push('  if (!res) return res;');
+    lines.push('  const h = new Headers(res.headers);');
+    lines.push('  for (const [k, v] of Object.entries(__baseSecurityHeaders)) h.set(k, v);');
+    lines.push('  return new Response(res.body, { status: res.status, statusText: res.statusText, headers: h });');
+    lines.push('}');
+    lines.push('');
+
     if (!isFastMode) {
       lines.push('// ── Security Headers ──');
       lines.push('const __securityHeaders = Object.freeze({');
@@ -2365,7 +2381,12 @@ export class ServerCodegen extends BaseCodegen {
           const rlWindow = rateLimitDec.args[1] ? this.genExpression(rateLimitDec.args[1]) : '60';
           lines.push(`  const __rlIp = __getClientIp(req);`);
           lines.push(`  const __rlRoute = __checkRateLimit(\`route:${path}:\${__rlIp}\`, ${rlMax}, ${rlWindow});`);
-          lines.push(`  if (__rlRoute.limited) return __errorResponse(429, "RATE_LIMITED", "Too Many Requests", null, { "Retry-After": String(__rlRoute.retryAfter) });`);
+          lines.push(`  if (__rlRoute.limited) {`);
+          if (securityFragments && securityFragments.auditCode) {
+            lines.push(`    __auditLog("rate_limit:exceeded", { method: req.method, path: __pathname }, { id: null });`);
+          }
+          lines.push(`    return __errorResponse(429, "RATE_LIMITED", "Too Many Requests", null, { "Retry-After": String(__rlRoute.retryAfter) });`);
+          lines.push(`  }`);
         }
 
         // Upload decorator — parse multipart body, validate file field
@@ -3133,8 +3154,8 @@ export class ServerCodegen extends BaseCodegen {
         }
       }
 
-      // Client HTML fallback
-      lines.push('  if (__pathname === "/" && typeof __clientHTML !== "undefined") {');
+      // Client HTML fallback — serve SPA shell for any non-API route so client router handles 404s
+      lines.push('  if (typeof __clientHTML !== "undefined") {');
       lines.push('    return new Response(__clientHTML, { status: 200, headers: { "Content-Type": "text/html" } });');
       lines.push('  }');
       lines.push('  return new Response("Not Found", { status: 404 });');
@@ -3217,6 +3238,9 @@ export class ServerCodegen extends BaseCodegen {
       lines.push('  const __clientIp = __getClientIp(req);');
       lines.push('  const __rl = __checkRateLimit(__clientIp, __rateLimitMax, __rateLimitWindow);');
       lines.push('  if (__rl.limited) {');
+      if (securityFragments && securityFragments.auditCode) {
+        lines.push('    __auditLog("rate_limit:exceeded", { method: req.method, path: __pathname, ip: __clientIp }, { id: null });');
+      }
       lines.push('    return __errorResponse(429, "RATE_LIMITED", "Too Many Requests", null, { ...__cors, "Retry-After": String(__rl.retryAfter) });');
       lines.push('  }');
     }
@@ -3266,6 +3290,10 @@ export class ServerCodegen extends BaseCodegen {
       lines.push('  // Security block: route protection');
       if (authConfig) {
         lines.push('  const __secUser = await __authenticate(req);');
+        if (securityFragments && securityFragments.auditCode) {
+          lines.push('  if (__secUser) __auditLog("auth:success", { method: req.method, path: __pathname }, __secUser);');
+          lines.push('  else if (req.headers.get("Authorization")) __auditLog("auth:failure", { method: req.method, path: __pathname, reason: "invalid_token" }, { id: null });');
+        }
       } else {
         lines.push('  const __secUser = null;');
       }
@@ -3273,17 +3301,31 @@ export class ServerCodegen extends BaseCodegen {
       lines.push('  if (!__protection.allowed) {');
       lines.push('    const __statusCode = __secUser ? 403 : 401;');
       lines.push('    const __errorCode = __secUser ? "FORBIDDEN" : "AUTH_REQUIRED";');
+      if (securityFragments && securityFragments.auditCode) {
+        lines.push('    __auditLog("auth:denied", { method: req.method, path: __pathname }, __secUser || { id: null });');
+      }
       lines.push('    return __errorResponse(__statusCode, __errorCode, __protection.reason, null, __cors);');
       lines.push('  }');
       lines.push('  if (__protection.rateLimit && __protection.rateLimit.max) {');
       lines.push('    const __protectIp = __getClientIp(req);');
       lines.push('    const __protectRl = __checkRateLimit("protect:" + __pathname + ":" + __protectIp, __protection.rateLimit.max, __protection.rateLimit.window || 60);');
       lines.push('    if (__protectRl.limited) {');
+      if (securityFragments && securityFragments.auditCode) {
+        lines.push('      __auditLog("rate_limit:exceeded", { method: req.method, path: __pathname, ip: __protectIp }, { id: null });');
+      }
       lines.push('      return __errorResponse(429, "RATE_LIMITED", "Too Many Requests", null, { ...__cors, "Retry-After": String(__protectRl.retryAfter) });');
       lines.push('    }');
       lines.push('  }');
     }
 
+    // Audit logging for auth (when no protection block but auth+audit configured)
+    if (!(securityFragments && securityFragments.protectCode) && authConfig && securityFragments && securityFragments.auditCode) {
+      lines.push('  // Audit: auth logging');
+      lines.push('  const __secUser = await __authenticate(req);');
+      lines.push('  if (__secUser) __auditLog("auth:success", { method: req.method, path: __pathname }, __secUser);');
+      lines.push('  else if (req.headers.get("Authorization")) __auditLog("auth:failure", { method: req.method, path: __pathname, reason: "invalid_token" }, { id: null });');
+    }
+
     // Idempotency key check
     lines.push('  const __idempotencyKey = req.headers.get("Idempotency-Key");');
     lines.push('  if (__idempotencyKey && req.method !== "GET" && req.method !== "HEAD" && req.method !== "OPTIONS") {');
@@ -3422,8 +3464,8 @@ export class ServerCodegen extends BaseCodegen {
     lines.push('    }');
     lines.push('  }');
 
-    // Serve client HTML at root
-    lines.push('  if (__pathname === "/" && typeof __clientHTML !== "undefined") {');
+    // Serve client HTML — SPA fallback for any non-API route so client router handles 404s
+    lines.push('  if (typeof __clientHTML !== "undefined") {');
     lines.push('    return new Response(__clientHTML, { status: 200, headers: { "Content-Type": "text/html", ...(__cors) } });');
     lines.push('  }');
     lines.push('  const __notFound = __errorResponse(404, "NOT_FOUND", "Not Found", null, __cors);');
@@ -3490,8 +3532,14 @@ export class ServerCodegen extends BaseCodegen {
       lines.push('  if (!res) return res;');
       lines.push('  return __compressResponse(req, res);');
       lines.push('};');
+    } else if (isFastMode) {
+      // Fast mode: wrap with base security headers
+      lines.push('const __secureFetch = async (req) => {');
+      lines.push('  const res = await __handleRequest(req);');
+      lines.push('  return __applyBaseHeaders(res);');
+      lines.push('};');
     }
-    const fetchHandler = (!isFastMode || compressionConfig) ? '__idempotentFetch' : '__handleRequest';
+    const fetchHandler = !isFastMode ? '__idempotentFetch' : (compressionConfig ? '__idempotentFetch' : '__secureFetch');
     lines.push(`const __server = Bun.serve({`);
     lines.push(`  port: __port,`);
     lines.push(`  maxRequestBodySize: __maxBodySize,`);

package/src/codegen/theme-codegen.js

@@ -0,0 +1,69 @@
+// Theme codegen: converts ThemeBlock AST to CSS custom properties
+
+const PX_SECTIONS = new Set(['spacing', 'radius']);
+const PX_FONT_PREFIXES = ['size.'];
+
+const CATEGORY_MAP = {
+  colors: 'color',
+  spacing: 'spacing',
+  radius: 'radius',
+  shadow: 'shadow',
+  font: 'font',
+  breakpoints: 'breakpoint',
+  transition: 'transition',
+};
+
+export class ThemeCodegen {
+  static mergeThemeBlocks(themeBlocks) {
+    const sections = new Map();
+    const darkOverrides = [];
+    for (const block of themeBlocks) {
+      for (const section of block.sections) {
+        if (!sections.has(section.name)) sections.set(section.name, []);
+        sections.get(section.name).push(...section.tokens);
+      }
+      darkOverrides.push(...block.darkOverrides);
+    }
+    return { sections, darkOverrides };
+  }
+
+  static generateCSS(themeConfig) {
+    const { sections, darkOverrides } = themeConfig;
+    const rootProps = [];
+    const darkProps = [];
+
+    for (const [sectionName, tokens] of sections) {
+      const prefix = CATEGORY_MAP[sectionName] || sectionName;
+      for (const token of tokens) {
+        const cssName = `--tova-${prefix}-${token.name.replace(/\./g, '-')}`;
+        const cssValue = ThemeCodegen._formatValue(sectionName, token.name, token.value);
+        rootProps.push(`  ${cssName}: ${cssValue};`);
+      }
+    }
+
+    for (const override of darkOverrides) {
+      const dotIdx = override.name.indexOf('.');
+      const sectionName = override.name.slice(0, dotIdx);
+      const tokenName = override.name.slice(dotIdx + 1);
+      const prefix = CATEGORY_MAP[sectionName] || sectionName;
+      const cssName = `--tova-${prefix}-${tokenName.replace(/\./g, '-')}`;
+      const cssValue = ThemeCodegen._formatValue(sectionName, tokenName, override.value);
+      darkProps.push(`    ${cssName}: ${cssValue};`);
+    }
+
+    let css = `:root {\n${rootProps.join('\n')}\n}`;
+    if (darkProps.length > 0) {
+      css += `\n@media (prefers-color-scheme: dark) {\n  :root {\n${darkProps.join('\n')}\n  }\n}`;
+    }
+    return css;
+  }
+
+  static _formatValue(sectionName, tokenName, value) {
+    if (typeof value === 'number') {
+      if (PX_SECTIONS.has(sectionName)) return value + 'px';
+      if (sectionName === 'font' && PX_FONT_PREFIXES.some(p => tokenName.startsWith(p))) return value + 'px';
+      return String(value);
+    }
+    return value;
+  }
+}

package/src/config/module-path.js

@@ -2,19 +2,51 @@
 // Determines whether an import is a Tova module (vs npm/relative),
 // parses module paths into components, and converts them to git URLs.
 
+// Blessed first-party packages: tova/X → github.com/tova-lang/X
+export const BLESSED_PACKAGES = {
+  fp: 'github.com/tova-lang/fp',
+  validate: 'github.com/tova-lang/validate',
+  encoding: 'github.com/tova-lang/encoding',
+  test: 'github.com/tova-lang/test',
+  retry: 'github.com/tova-lang/retry',
+  template: 'github.com/tova-lang/template',
+  data: 'github.com/tova-lang/data',
+  stats: 'github.com/tova-lang/stats',
+  plot: 'github.com/tova-lang/plot',
+  ml: 'github.com/tova-lang/ml',
+  ui: 'github.com/tova-lang/ui',
+};
+
+export function expandBlessedPackage(source) {
+  if (!source || !source.startsWith('tova/')) return null;
+  const rest = source.slice(5);
+  const name = rest.split('/')[0];
+  if (BLESSED_PACKAGES[name]) return BLESSED_PACKAGES[name] + (rest.includes('/') ? '/' + rest.slice(name.length + 1) : '');
+  return null;
+}
+
 export function isTovModule(source) {
   if (!source || source.startsWith('.') || source.startsWith('/') || source.startsWith('@') || source.includes(':')) {
     return false;
   }
+  // Check blessed packages first
+  if (source.startsWith('tova/')) {
+    const name = source.slice(5).split('/')[0];
+    return !!BLESSED_PACKAGES[name];
+  }
   const firstSegment = source.split('/')[0];
   return firstSegment.includes('.');
 }
 
 export function parseModulePath(source) {
-  if (!isTovModule(source)) {
+  // Expand blessed packages: tova/data → github.com/tova-lang/data
+  const expanded = expandBlessedPackage(source);
+  const actual = expanded || source;
+
+  if (!expanded && !isTovModule(actual)) {
     throw new Error(`Invalid Tova module path: "${source}"`);
   }
-  const parts = source.split('/');
+  const parts = actual.split('/');
   if (parts.length < 3) {
     throw new Error(`Invalid Tova module path: "${source}" — expected at least host/owner/repo`);
   }

package/src/config/resolve.js

@@ -14,6 +14,9 @@ const DEFAULTS = {
   build: {
     output: '.tova-out',
   },
+  deploy: {
+    base: '/',
+  },
   dev: {
     port: 3000,
   },
@@ -53,6 +56,9 @@ function normalizeConfig(parsed, source) {
     build: {
       output: parsed.build?.output || DEFAULTS.build.output,
     },
+    deploy: {
+      base: parsed.deploy?.base || DEFAULTS.deploy.base,
+    },
     dev: {
       port: parsed.dev?.port ?? DEFAULTS.dev.port,
     },
@@ -104,6 +110,9 @@ function configFromPackageJson(pkg) {
     build: {
       output: DEFAULTS.build.output,
     },
+    deploy: {
+      base: '/',
+    },
     dev: {
       port: DEFAULTS.dev.port,
     },

package/src/config/toml.js

@@ -37,7 +37,19 @@ export function parseTOML(input) {
     if (eqIdx === -1) continue; // skip lines without =
 
     const key = line.slice(0, eqIdx).trim();
-    const rawValue = line.slice(eqIdx + 1).trim();
+    let rawValue = line.slice(eqIdx + 1).trim();
+
+    // Multi-line array: starts with [ but doesn't end with ]
+    if (rawValue.startsWith('[') && !rawValue.endsWith(']')) {
+      // Collect continuation lines until we find the closing ]
+      while (i + 1 < lines.length) {
+        i++;
+        const contLine = lines[i].trim();
+        if (contLine === '' || contLine.startsWith('#')) continue;
+        rawValue += ' ' + contLine;
+        if (contLine.includes(']')) break;
+      }
+    }
 
     current[key] = parseValue(rawValue, i + 1);
   }

package/src/deploy/provision.js

@@ -138,6 +138,8 @@ export function generateProvisionScript(manifest) {
       domain: manifest.domain,
       instances: manifest.instances || 1,
       health: manifest.health,
+      health_interval: manifest.health_interval,
+      health_timeout: manifest.health_timeout,
       hasWebSocket: manifest.hasWebSocket,
     });
     lines.push(`cat > /etc/caddy/Caddyfile <<'CADDY_EOF'`);
@@ -257,6 +259,8 @@ export function generateCaddyConfig(appName, opts = {}) {
   const domain = opts.domain || 'localhost';
   const instances = opts.instances || 1;
   const health = opts.health || '/healthz';
+  const healthInterval = opts.health_interval || 30;
+  const healthTimeout = opts.health_timeout || 5;
   const hasWebSocket = opts.hasWebSocket || false;
 
   const lines = [];
@@ -277,8 +281,8 @@ export function generateCaddyConfig(appName, opts = {}) {
 
   // Health check
   lines.push(`    health_uri ${health}`);
-  lines.push('    health_interval 30s');
-  lines.push('    health_timeout 5s');
+  lines.push(`    health_interval ${healthInterval}s`);
+  lines.push(`    health_timeout ${healthTimeout}s`);
 
   lines.push('  }');
 

package/src/diagnostics/security-scorecard.js

@@ -0,0 +1,111 @@
+/**
+ * Security Scorecard — post-compilation security posture summary.
+ */
+
+export function generateSecurityScorecard(securityConfig, warnings, hasServer, hasEdge) {
+  if (!hasServer && !hasEdge) return null;
+
+  const items = [];
+  let score = 10;
+
+  const warningCodes = new Set((warnings || []).map(w => w.code).filter(Boolean));
+
+  if (!securityConfig) {
+    items.push({ pass: false, label: 'No security block configured', deduction: 3 });
+    score -= 3;
+    items.push({ pass: false, label: 'No auth configured', deduction: 2 });
+    score -= 2;
+    items.push({ pass: false, label: 'No CSRF protection', deduction: 1 });
+    score -= 1;
+    items.push({ pass: false, label: 'No rate limiting', deduction: 1 });
+    score -= 1;
+    items.push({ pass: false, label: 'No CSP configured', deduction: 1 });
+    score -= 1;
+    items.push({ pass: false, label: 'No audit logging', deduction: 1 });
+    score -= 1;
+    return { score: Math.max(0, score), items, format: () => formatScorecard(Math.max(0, score), items) };
+  }
+
+  // Auth
+  if (securityConfig.auth) {
+    const isCookie = securityConfig.auth.storage === 'cookie';
+    const authType = securityConfig.auth.authType || 'JWT';
+    if (isCookie) {
+      items.push({ pass: true, label: `${authType} auth with HttpOnly cookies` });
+    } else {
+      items.push({ pass: true, label: `${authType} auth configured` });
+    }
+    if (warningCodes.has('W_LOCALSTORAGE_TOKEN')) {
+      items.push({ pass: false, label: 'Auth tokens in localStorage (XSS vulnerable)', deduction: 1 });
+      score -= 1;
+    }
+  } else {
+    items.push({ pass: false, label: 'No auth configured', deduction: 2 });
+    score -= 2;
+  }
+
+  // CSRF
+  if (securityConfig.csrf && securityConfig.csrf.enabled === false) {
+    items.push({ pass: false, label: 'CSRF protection disabled', deduction: 1 });
+    score -= 1;
+  } else if (securityConfig.auth) {
+    items.push({ pass: true, label: 'CSRF enabled with session binding' });
+  } else {
+    items.push({ pass: false, label: 'No CSRF protection', deduction: 1 });
+    score -= 1;
+  }
+
+  // Rate limiting
+  if (securityConfig.rateLimit) {
+    items.push({ pass: true, label: 'Rate limiting configured' });
+  } else if (securityConfig.auth) {
+    items.push({ pass: false, label: 'No rate limiting (auth without brute-force protection)', deduction: 1 });
+    score -= 1;
+  }
+
+  // CSP
+  if (securityConfig.csp) {
+    items.push({ pass: true, label: 'Content Security Policy configured' });
+  } else {
+    items.push({ pass: false, label: 'No CSP configured', deduction: 1 });
+    score -= 1;
+  }
+
+  // CORS wildcard
+  if (warningCodes.has('W_CORS_WILDCARD')) {
+    items.push({ pass: false, label: 'CORS allows wildcard origins', deduction: 1 });
+    score -= 1;
+  } else if (securityConfig.cors) {
+    items.push({ pass: true, label: 'CORS restricted to specific origins' });
+  }
+
+  // Hardcoded secret
+  if (warningCodes.has('W_HARDCODED_SECRET')) {
+    items.push({ pass: false, label: 'Auth secret hardcoded in source', deduction: 1 });
+    score -= 1;
+  }
+
+  // Audit logging
+  if (securityConfig.audit) {
+    items.push({ pass: true, label: 'Audit logging configured' });
+  } else {
+    items.push({ pass: false, label: 'No audit logging', deduction: 1 });
+    score -= 1;
+  }
+
+  score = Math.max(0, score);
+  return { score, items, format: () => formatScorecard(score, items) };
+}
+
+function formatScorecard(score, items) {
+  const lines = [];
+  lines.push(`\x1b[1mSecurity: ${score}/10\x1b[0m`);
+  for (const item of items) {
+    if (item.pass) {
+      lines.push(`  \x1b[32m[pass]\x1b[0m ${item.label}`);
+    } else {
+      lines.push(`  \x1b[33m[warn]\x1b[0m ${item.label} (-${item.deduction})`);
+    }
+  }
+  return lines.join('\n');
+}

package/src/lexer/lexer.js

@@ -899,15 +899,30 @@ export class Lexer {
       return;
     }
 
-    // Special case: "style {" → read raw CSS block
+    // Special case: "style {" or "style(...) {" → read raw CSS block
     if (value === 'style') {
       const savedPos = this.pos;
       const savedLine = this.line;
       const savedCol = this.column;
-      // Skip whitespace (including newlines) to check for {
+      // Skip whitespace (including newlines) to check for ( or {
       while (this.pos < this.length && (this.isWhitespace(this.peek()) || this.peek() === '\n')) {
         this.advance();
       }
+      // Check for style(...) config
+      let configPrefix = '';
+      if (this.peek() === '(') {
+        this.advance(); // skip (
+        let configStr = '';
+        while (this.pos < this.length && this.peek() !== ')') {
+          configStr += this.advance();
+        }
+        if (this.pos < this.length) this.advance(); // skip )
+        configPrefix = '__CONFIG:' + configStr.trim() + '__';
+        // Skip whitespace after )
+        while (this.pos < this.length && (this.isWhitespace(this.peek()) || this.peek() === '\n')) {
+          this.advance();
+        }
+      }
       if (this.peek() === '{') {
         this.advance(); // skip {
         let depth = 1;
@@ -924,7 +939,7 @@ export class Lexer {
         if (depth > 0) {
           this.error('Unterminated style block');
         }
-        this.tokens.push(new Token(TokenType.STYLE_BLOCK, css.trim(), startLine, startCol));
+        this.tokens.push(new Token(TokenType.STYLE_BLOCK, configPrefix + css.trim(), startLine, startCol));
         return;
       }
       // Not a style block — restore position

package/src/parser/animate-ast.js

@@ -0,0 +1,45 @@
+// Animate-specific AST Node definitions for the Tova language
+// Extracted for lazy loading — only loaded when animate { } blocks are used.
+
+// ============================================================
+// Animate-specific nodes
+// ============================================================
+
+export class AnimateDeclaration {
+  constructor(name, enter, exit, duration, easing, stagger, stay, loc) {
+    this.type = 'AnimateDeclaration';
+    this.name = name;       // string — animation name, e.g. "fadeIn"
+    this.enter = enter;     // AnimatePrimitive|AnimateSequence|AnimateParallel|null
+    this.exit = exit;       // AnimatePrimitive|AnimateSequence|AnimateParallel|null
+    this.duration = duration; // number|null — duration in ms
+    this.easing = easing;   // string|null — CSS easing function
+    this.stagger = stagger; // number|null — stagger delay in ms
+    this.stay = stay;       // number|null — auto-dismiss delay in ms
+    this.loc = loc;
+  }
+}
+
+export class AnimatePrimitive {
+  constructor(name, params, loc) {
+    this.type = 'AnimatePrimitive';
+    this.name = name;       // 'fade'|'slide'|'scale'|'rotate'|'blur'
+    this.params = params;   // object e.g. {from: 0, to: 1, y: 20}
+    this.loc = loc;
+  }
+}
+
+export class AnimateSequence {
+  constructor(children, loc) {
+    this.type = 'AnimateSequence';
+    this.children = children; // AnimatePrimitive[] or AnimateParallel[]
+    this.loc = loc;
+  }
+}
+
+export class AnimateParallel {
+  constructor(children, loc) {
+    this.type = 'AnimateParallel';
+    this.children = children; // AnimatePrimitive[]
+    this.loc = loc;
+  }
+}