feat: centralize application framework primitives

packages/syntax/src/parser.ts

@@ -393,6 +393,24 @@ export function parse(source: string): PageAst {
         throw new ParseError(`Expected a ${kind} member keyword at offset ${kw.pos}`);
       }
       switch (kw.value) {
+        case "auth": {
+          lx.next();
+          expect("eq");
+          const value = lx.next();
+          if (value.type !== "ident" || !["true", "false"].includes(value.value)) {
+            throw new ParseError(`Expected auth = true or false at offset ${value.pos}`);
+          }
+          security.auth = value.value === "true" ? "required" : "false";
+          break;
+        }
+        case "permission": {
+          lx.next();
+          expect("eq");
+          const value = expect("string").value.trim();
+          if (!value) throw new ParseError(`Page permission cannot be empty at offset ${kw.pos}`);
+          security.permission = value;
+          break;
+        }
         case "layout": {
           // layout = "public" — selects app/layouts/<name>.wrn for this page.
           lx.next();