@axiomify/cli 5.0.0 → 6.0.0-rc.2

package/dist/index.js

@@ -2,13 +2,14 @@
 'use strict';
 
 var esbuild = require('esbuild');
-var path4 = require('path');
+var path7 = require('path');
 var fs = require('fs');
+var pc = require('picocolors');
+var fs5 = require('fs/promises');
 var child_process = require('child_process');
+var net = require('net');
 var enquirer = require('enquirer');
 var execa = require('execa');
-var fs2 = require('fs/promises');
-var pc = require('picocolors');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
@@ -31,10 +32,10 @@ function _interopNamespace(e) {
 }
 
 var esbuild__namespace = /*#__PURE__*/_interopNamespace(esbuild);
-var path4__default = /*#__PURE__*/_interopDefault(path4);
+var path7__default = /*#__PURE__*/_interopDefault(path7);
 var fs__default = /*#__PURE__*/_interopDefault(fs);
-var fs2__default = /*#__PURE__*/_interopDefault(fs2);
 var pc__default = /*#__PURE__*/_interopDefault(pc);
+var fs5__default = /*#__PURE__*/_interopDefault(fs5);
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -48,9 +49,21 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
   if (typeof require !== "undefined") return require.apply(this, arguments);
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
-var __commonJS = (cb, mod) => function __require2() {
+var __glob = (map) => (path11) => {
+  var fn = map[path11];
+  if (fn) return fn();
+  throw new Error("Module not found in bundle: " + path11);
+};
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __commonJS = (cb, mod) => function __require3() {
   return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
 };
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
 var __copyProps = (to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") {
     for (let key of __getOwnPropNames(from))
@@ -957,8 +970,8 @@ var require_command = __commonJS({
   "node_modules/commander/lib/command.js"(exports) {
     var EventEmitter = __require("events").EventEmitter;
     var childProcess = __require("child_process");
-    var path6 = __require("path");
-    var fs4 = __require("fs");
+    var path11 = __require("path");
+    var fs9 = __require("fs");
     var process2 = __require("process");
     var { Argument: Argument2, humanReadableArgName } = require_argument();
     var { CommanderError: CommanderError2 } = require_error();
@@ -1841,10 +1854,10 @@ Expecting one of '${allowedValues.join("', '")}'`);
         let launchWithNode = false;
         const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
         function findFile(baseDir, baseName) {
-          const localBin = path6.resolve(baseDir, baseName);
-          if (fs4.existsSync(localBin)) return localBin;
-          if (sourceExt.includes(path6.extname(baseName))) return void 0;
-          const foundExt = sourceExt.find((ext) => fs4.existsSync(`${localBin}${ext}`));
+          const localBin = path11.resolve(baseDir, baseName);
+          if (fs9.existsSync(localBin)) return localBin;
+          if (sourceExt.includes(path11.extname(baseName))) return void 0;
+          const foundExt = sourceExt.find((ext) => fs9.existsSync(`${localBin}${ext}`));
           if (foundExt) return `${localBin}${foundExt}`;
           return void 0;
         }
@@ -1855,23 +1868,23 @@ Expecting one of '${allowedValues.join("', '")}'`);
         if (this._scriptPath) {
           let resolvedScriptPath;
           try {
-            resolvedScriptPath = fs4.realpathSync(this._scriptPath);
+            resolvedScriptPath = fs9.realpathSync(this._scriptPath);
           } catch (err) {
             resolvedScriptPath = this._scriptPath;
           }
-          executableDir = path6.resolve(path6.dirname(resolvedScriptPath), executableDir);
+          executableDir = path11.resolve(path11.dirname(resolvedScriptPath), executableDir);
         }
         if (executableDir) {
           let localFile = findFile(executableDir, executableFile);
           if (!localFile && !subcommand._executableFile && this._scriptPath) {
-            const legacyName = path6.basename(this._scriptPath, path6.extname(this._scriptPath));
+            const legacyName = path11.basename(this._scriptPath, path11.extname(this._scriptPath));
             if (legacyName !== this._name) {
               localFile = findFile(executableDir, `${legacyName}-${subcommand._name}`);
             }
           }
           executableFile = localFile || executableFile;
         }
-        launchWithNode = sourceExt.includes(path6.extname(executableFile));
+        launchWithNode = sourceExt.includes(path11.extname(executableFile));
         let proc;
         if (process2.platform !== "win32") {
           if (launchWithNode) {
@@ -2660,7 +2673,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return {Command}
        */
       nameFromFilename(filename) {
-        this._name = path6.basename(filename, path6.extname(filename));
+        this._name = path11.basename(filename, path11.extname(filename));
         return this;
       }
       /**
@@ -2674,9 +2687,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} [path]
        * @return {(string|null|Command)}
        */
-      executableDir(path7) {
-        if (path7 === void 0) return this._executableDir;
-        this._executableDir = path7;
+      executableDir(path12) {
+        if (path12 === void 0) return this._executableDir;
+        this._executableDir = path12;
         return this;
       }
       /**
@@ -2904,6 +2917,631 @@ var require_commander = __commonJS({
   }
 });
 
+// ../../node_modules/uWebSockets.js/uws_darwin_arm64_108.node
+var require_uws_darwin_arm64_108 = __commonJS({
+  "../../node_modules/uWebSockets.js/uws_darwin_arm64_108.node"(exports, module) {
+    module.exports = "./uws_darwin_arm64_108-CLFXMYPI.node";
+  }
+});
+
+// ../../node_modules/uWebSockets.js/uws_darwin_arm64_115.node
+var require_uws_darwin_arm64_115 = __commonJS({
+  "../../node_modules/uWebSockets.js/uws_darwin_arm64_115.node"(exports, module) {
+    module.exports = "./uws_darwin_arm64_115-7FFEG3YF.node";
+  }
+});
+
+// ../../node_modules/uWebSockets.js/uws_darwin_arm64_120.node
+var require_uws_darwin_arm64_120 = __commonJS({
+  "../../node_modules/uWebSockets.js/uws_darwin_arm64_120.node"(exports, module) {
+    module.exports = "./uws_darwin_arm64_120-GFZT7CLS.node";
+  }
+});
+
+// ../../node_modules/uWebSockets.js/uws_darwin_arm64_127.node
+var require_uws_darwin_arm64_127 = __commonJS({
+  "../../node_modules/uWebSockets.js/uws_darwin_arm64_127.node"(exports, module) {
+    module.exports = "./uws_darwin_arm64_127-KHC2FVAM.node";
+  }
+});
+
+// ../../node_modules/uWebSockets.js/uws_darwin_x64_108.node
+var require_uws_darwin_x64_108 = __commonJS({
+  "../../node_modules/uWebSockets.js/uws_darwin_x64_108.node"(exports, module) {
+    module.exports = "./uws_darwin_x64_108-BRGT45AT.node";
+  }
+});
+
+// ../../node_modules/uWebSockets.js/uws_darwin_x64_115.node
+var require_uws_darwin_x64_115 = __commonJS({
+  "../../node_modules/uWebSockets.js/uws_darwin_x64_115.node"(exports, module) {
+    module.exports = "./uws_darwin_x64_115-4HGPQGDD.node";
+  }
+});
+
+// ../../node_modules/uWebSockets.js/uws_darwin_x64_120.node
+var require_uws_darwin_x64_120 = __commonJS({
+  "../../node_modules/uWebSockets.js/uws_darwin_x64_120.node"(exports, module) {
+    module.exports = "./uws_darwin_x64_120-C2SGUHP4.node";
+  }
+});
+
+// ../../node_modules/uWebSockets.js/uws_darwin_x64_127.node
+var require_uws_darwin_x64_127 = __commonJS({
+  "../../node_modules/uWebSockets.js/uws_darwin_x64_127.node"(exports, module) {
+    module.exports = "./uws_darwin_x64_127-NHKQMMST.node";
+  }
+});
+
+// ../../node_modules/uWebSockets.js/uws_linux_arm64_108.node
+var require_uws_linux_arm64_108 = __commonJS({
+  "../../node_modules/uWebSockets.js/uws_linux_arm64_108.node"(exports, module) {
+    module.exports = "./uws_linux_arm64_108-YHK7ACON.node";
+  }
+});
+
+// ../../node_modules/uWebSockets.js/uws_linux_arm64_115.node
+var require_uws_linux_arm64_115 = __commonJS({
+  "../../node_modules/uWebSockets.js/uws_linux_arm64_115.node"(exports, module) {
+    module.exports = "./uws_linux_arm64_115-EIAAY4WO.node";
+  }
+});
+
+// ../../node_modules/uWebSockets.js/uws_linux_arm64_120.node
+var require_uws_linux_arm64_120 = __commonJS({
+  "../../node_modules/uWebSockets.js/uws_linux_arm64_120.node"(exports, module) {
+    module.exports = "./uws_linux_arm64_120-OADY5FIN.node";
+  }
+});
+
+// ../../node_modules/uWebSockets.js/uws_linux_arm64_127.node
+var require_uws_linux_arm64_127 = __commonJS({
+  "../../node_modules/uWebSockets.js/uws_linux_arm64_127.node"(exports, module) {
+    module.exports = "./uws_linux_arm64_127-U2SRLYQM.node";
+  }
+});
+
+// ../../node_modules/uWebSockets.js/uws_linux_arm_108.node
+var require_uws_linux_arm_108 = __commonJS({
+  "../../node_modules/uWebSockets.js/uws_linux_arm_108.node"(exports, module) {
+    module.exports = "./uws_linux_arm_108-BKVITVZA.node";
+  }
+});
+
+// ../../node_modules/uWebSockets.js/uws_linux_arm_115.node
+var require_uws_linux_arm_115 = __commonJS({
+  "../../node_modules/uWebSockets.js/uws_linux_arm_115.node"(exports, module) {
+    module.exports = "./uws_linux_arm_115-7IORQF77.node";
+  }
+});
+
+// ../../node_modules/uWebSockets.js/uws_linux_arm_120.node
+var require_uws_linux_arm_120 = __commonJS({
+  "../../node_modules/uWebSockets.js/uws_linux_arm_120.node"(exports, module) {
+    module.exports = "./uws_linux_arm_120-LCX4ED5F.node";
+  }
+});
+
+// ../../node_modules/uWebSockets.js/uws_linux_arm_127.node
+var require_uws_linux_arm_127 = __commonJS({
+  "../../node_modules/uWebSockets.js/uws_linux_arm_127.node"(exports, module) {
+    module.exports = "./uws_linux_arm_127-6UTO7TL6.node";
+  }
+});
+
+// ../../node_modules/uWebSockets.js/uws_linux_x64_108.node
+var require_uws_linux_x64_108 = __commonJS({
+  "../../node_modules/uWebSockets.js/uws_linux_x64_108.node"(exports, module) {
+    module.exports = "./uws_linux_x64_108-QSNE6XWU.node";
+  }
+});
+
+// ../../node_modules/uWebSockets.js/uws_linux_x64_115.node
+var require_uws_linux_x64_115 = __commonJS({
+  "../../node_modules/uWebSockets.js/uws_linux_x64_115.node"(exports, module) {
+    module.exports = "./uws_linux_x64_115-7AAZWMWE.node";
+  }
+});
+
+// ../../node_modules/uWebSockets.js/uws_linux_x64_120.node
+var require_uws_linux_x64_120 = __commonJS({
+  "../../node_modules/uWebSockets.js/uws_linux_x64_120.node"(exports, module) {
+    module.exports = "./uws_linux_x64_120-AIZ6RIW2.node";
+  }
+});
+
+// ../../node_modules/uWebSockets.js/uws_linux_x64_127.node
+var require_uws_linux_x64_127 = __commonJS({
+  "../../node_modules/uWebSockets.js/uws_linux_x64_127.node"(exports, module) {
+    module.exports = "./uws_linux_x64_127-HBA6RNSU.node";
+  }
+});
+
+// ../../node_modules/uWebSockets.js/uws_win32_x64_108.node
+var require_uws_win32_x64_108 = __commonJS({
+  "../../node_modules/uWebSockets.js/uws_win32_x64_108.node"(exports, module) {
+    module.exports = "./uws_win32_x64_108-J6KONPDM.node";
+  }
+});
+
+// ../../node_modules/uWebSockets.js/uws_win32_x64_115.node
+var require_uws_win32_x64_115 = __commonJS({
+  "../../node_modules/uWebSockets.js/uws_win32_x64_115.node"(exports, module) {
+    module.exports = "./uws_win32_x64_115-V5N4NHJ5.node";
+  }
+});
+
+// ../../node_modules/uWebSockets.js/uws_win32_x64_120.node
+var require_uws_win32_x64_120 = __commonJS({
+  "../../node_modules/uWebSockets.js/uws_win32_x64_120.node"(exports, module) {
+    module.exports = "./uws_win32_x64_120-XH4MVJGN.node";
+  }
+});
+
+// ../../node_modules/uWebSockets.js/uws_win32_x64_127.node
+var require_uws_win32_x64_127 = __commonJS({
+  "../../node_modules/uWebSockets.js/uws_win32_x64_127.node"(exports, module) {
+    module.exports = "./uws_win32_x64_127-JBAEKR4X.node";
+  }
+});
+
+// require("./uws_*_*_*.node") in ../../node_modules/uWebSockets.js/uws.js
+var globRequire_uws______node;
+var init_ = __esm({
+  'require("./uws_*_*_*.node") in ../../node_modules/uWebSockets.js/uws.js'() {
+    globRequire_uws______node = __glob({
+      "./uws_darwin_arm64_108.node": () => require_uws_darwin_arm64_108(),
+      "./uws_darwin_arm64_115.node": () => require_uws_darwin_arm64_115(),
+      "./uws_darwin_arm64_120.node": () => require_uws_darwin_arm64_120(),
+      "./uws_darwin_arm64_127.node": () => require_uws_darwin_arm64_127(),
+      "./uws_darwin_x64_108.node": () => require_uws_darwin_x64_108(),
+      "./uws_darwin_x64_115.node": () => require_uws_darwin_x64_115(),
+      "./uws_darwin_x64_120.node": () => require_uws_darwin_x64_120(),
+      "./uws_darwin_x64_127.node": () => require_uws_darwin_x64_127(),
+      "./uws_linux_arm64_108.node": () => require_uws_linux_arm64_108(),
+      "./uws_linux_arm64_115.node": () => require_uws_linux_arm64_115(),
+      "./uws_linux_arm64_120.node": () => require_uws_linux_arm64_120(),
+      "./uws_linux_arm64_127.node": () => require_uws_linux_arm64_127(),
+      "./uws_linux_arm_108.node": () => require_uws_linux_arm_108(),
+      "./uws_linux_arm_115.node": () => require_uws_linux_arm_115(),
+      "./uws_linux_arm_120.node": () => require_uws_linux_arm_120(),
+      "./uws_linux_arm_127.node": () => require_uws_linux_arm_127(),
+      "./uws_linux_x64_108.node": () => require_uws_linux_x64_108(),
+      "./uws_linux_x64_115.node": () => require_uws_linux_x64_115(),
+      "./uws_linux_x64_120.node": () => require_uws_linux_x64_120(),
+      "./uws_linux_x64_127.node": () => require_uws_linux_x64_127(),
+      "./uws_win32_x64_108.node": () => require_uws_win32_x64_108(),
+      "./uws_win32_x64_115.node": () => require_uws_win32_x64_115(),
+      "./uws_win32_x64_120.node": () => require_uws_win32_x64_120(),
+      "./uws_win32_x64_127.node": () => require_uws_win32_x64_127()
+    });
+  }
+});
+
+// ../../node_modules/uWebSockets.js/uws.js
+var require_uws = __commonJS({
+  "../../node_modules/uWebSockets.js/uws.js"(exports, module) {
+    init_();
+    module.exports = (() => {
+      try {
+        return globRequire_uws______node("./uws_" + process.platform + "_" + process.arch + "_" + process.versions.modules + ".node");
+      } catch (e) {
+        throw new Error("This version of uWS.js supports only Node.js versions 18, 20, 21 and 22 on (glibc) Linux, macOS and Windows, on Tier 1 platforms (https://github.com/nodejs/node/blob/master/BUILDING.md#platform-list).\n\n" + e.toString());
+      }
+    })();
+    module.exports.DeclarativeResponse = class DeclarativeResponse {
+      constructor() {
+        this.instructions = [];
+      }
+      // Utility method to encode text and append instruction
+      _appendInstruction(opcode, ...text) {
+        this.instructions.push(opcode);
+        text.forEach((str) => {
+          const bytes = typeof str === "string" ? new TextEncoder().encode(str) : str;
+          this.instructions.push(bytes.length, ...bytes);
+        });
+      }
+      // Utility method to append 2-byte length text in little-endian format
+      _appendInstructionWithLength(opcode, text) {
+        this.instructions.push(opcode);
+        const bytes = new TextEncoder().encode(text);
+        const length = bytes.length;
+        this.instructions.push(length & 255, length >> 8 & 255, ...bytes);
+      }
+      writeHeader(key, value) {
+        return this._appendInstruction(1, key, value), this;
+      }
+      writeBody() {
+        return this.instructions.push(2), this;
+      }
+      writeQueryValue(key) {
+        return this._appendInstruction(3, key), this;
+      }
+      writeHeaderValue(key) {
+        return this._appendInstruction(4, key), this;
+      }
+      write(value) {
+        return this._appendInstructionWithLength(5, value), this;
+      }
+      writeParameterValue(key) {
+        return this._appendInstruction(6, key), this;
+      }
+      end(value) {
+        const bytes = new TextEncoder().encode(value);
+        const length = bytes.length;
+        this.instructions.push(0, length & 255, length >> 8 & 255, ...bytes);
+        return new Uint8Array(this.instructions).buffer;
+      }
+    };
+  }
+});
+
+// ../openapi/dist/index.mjs
+var dist_exports = {};
+__export(dist_exports, {
+  OpenApiGenerator: () => OpenApiGenerator,
+  Security: () => Security,
+  defineSecuritySchemes: () => defineSecuritySchemes,
+  useOpenAPI: () => useOpenAPI
+});
+function zodSchemaToOpenApi(schema) {
+  const s = schema;
+  if (typeof s.toJSONSchema === "function") {
+    const full = s.toJSONSchema({ target: "openApi3_1" });
+    const { $schema: _dropped, ...rest } = full;
+    return rest;
+  }
+  try {
+    const { zodToJsonSchema } = __require2("zod-to-json-schema");
+    return zodToJsonSchema(schema, { target: "openApi3" });
+  } catch {
+    return { type: "object" };
+  }
+}
+function isZodSchema(value) {
+  return typeof value === "object" && value !== null && typeof value.safeParse === "function";
+}
+function escapeHtml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function escapeJsString(s) {
+  return s.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+}
+function defineSecuritySchemes(schemes) {
+  return {
+    schemes,
+    require: (name, scopes = []) => [{ [name]: scopes }],
+    requireMultiple: (requirements) => {
+      const combined = {};
+      requirements.forEach((req) => {
+        combined[req] = [];
+      });
+      return [combined];
+    }
+  };
+}
+function inferSchemaFromPayload(data, depth = 0) {
+  if (depth > 32) return { type: "object" };
+  if (data === null) return { type: "null" };
+  if (Array.isArray(data)) {
+    return {
+      type: "array",
+      items: data.length > 0 ? inferSchemaFromPayload(data[0], depth + 1) : { type: "object" }
+    };
+  }
+  if (typeof data === "object") {
+    const properties = {};
+    for (const [key, value] of Object.entries(data)) {
+      properties[key] = inferSchemaFromPayload(value, depth + 1);
+    }
+    return { type: "object", properties };
+  }
+  return { type: typeof data };
+}
+function useOpenAPI(app, options) {
+  const rawPrefix = options.prefix ?? "/docs";
+  const normalizedPrefix = rawPrefix.startsWith("/") ? rawPrefix : `/${rawPrefix}`;
+  const prefix = normalizedPrefix === "/" ? "/" : normalizedPrefix.endsWith("/") ? normalizedPrefix.slice(0, -1) : normalizedPrefix;
+  const docsPaths = prefix === "/" ? ["/"] : [prefix, `${prefix}/`];
+  const docsPathSet = new Set(docsPaths);
+  const specPath = prefix === "/" ? "/openapi.json" : `${prefix}/openapi.json`;
+  const generator = new OpenApiGenerator(app, options);
+  let cachedSpec = null;
+  let cachedSpecJson = null;
+  let emittedPublicDocsWarning = false;
+  if (options.autoInferResponses) {
+    app.addHook("onPostHandler", (req, res, match) => {
+      if (!match?.route) return;
+      if (req.path === specPath || docsPathSet.has(req.path)) {
+        return;
+      }
+      const payload = res.payload;
+      if (payload === void 0) return;
+      if (!cachedSpec) cachedSpec = generator.generate();
+      const path11 = generator.formatPath(match.route.path);
+      const method = match.route.method.toLowerCase();
+      const statusCode = String(res.statusCode);
+      const existingResponse = cachedSpec.paths[path11]?.[method]?.responses?.[statusCode];
+      const isDefault = existingResponse?.description === "Successful response" && existingResponse?.content?.["application/json"]?.schema?.type === "object";
+      if (existingResponse && !isDefault) return;
+      let parsedData = payload;
+      if (typeof payload === "string") {
+        try {
+          parsedData = JSON.parse(payload);
+        } catch {
+        }
+      }
+      if (cachedSpec.paths[path11]?.[method]) {
+        cachedSpec.paths[path11][method].responses[statusCode] = {
+          description: "Auto-inferred response",
+          content: {
+            "application/json": { schema: inferSchemaFromPayload(parsedData) }
+          }
+        };
+        cachedSpecJson = null;
+      }
+    });
+  }
+  const guard = async (req) => {
+    if (!options.protect) {
+      if (process.env.NODE_ENV === "production") {
+        if (!emittedPublicDocsWarning) {
+          emittedPublicDocsWarning = true;
+          console.warn(
+            "[axiomify/openapi] OpenAPI endpoints are not protected. Production access is denied by default. Provide a `protect` function or set `allowPublicInProduction: true` explicitly."
+          );
+        }
+        return options.allowPublicInProduction === true;
+      }
+      return true;
+    }
+    return Boolean(await options.protect(req));
+  };
+  app.route({
+    method: "GET",
+    path: specPath,
+    handler: async (req, res) => {
+      if (!await guard(req)) return res.status(403).send(null, "Forbidden");
+      if (!cachedSpec) cachedSpec = generator.generate();
+      if (!cachedSpecJson) cachedSpecJson = JSON.stringify(cachedSpec);
+      res.status(200).sendRaw(cachedSpecJson, "application/json");
+    }
+  });
+  const docsHandler = async (req, res) => {
+    if (!await guard(req)) return res.status(403).send(null, "Forbidden");
+    if (typeof res.setHeader === "function") {
+      res.setHeader("Content-Security-Policy", DOCS_CSP);
+    } else if (typeof res.header === "function") {
+      res.header("Content-Security-Policy", DOCS_CSP);
+    }
+    const isDev = process.env.NODE_ENV !== "production";
+    const specUrl = isDev ? `${specPath}?t=${Date.now()}` : specPath;
+    const html = `<!DOCTYPE html>
+        <html lang="en">
+        <head>
+          <meta charset="utf-8" />
+          <meta name="viewport" content="width=device-width, initial-scale=1" />
+          <title>${escapeHtml(options.info.title)} - API Docs</title> 
+          <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/5.11.0/swagger-ui.min.css" integrity="sha384-bIuUyBV7i6P7z/kPAs1oeBIf8PMIqVkPVDzzaOL+QH7kWmvCT9HDTWwGVs0L4/9Q" crossorigin="anonymous" referrerpolicy="no-referrer" />
+        </head>
+        <body style="margin: 0; padding: 0;">
+          <div id="swagger-ui"></div>
+          <script src="https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/5.11.0/swagger-ui-bundle.min.js" integrity="sha384-XHDYRdiHvBq7oL4CtkiJKfdVVA5PydxYtssHVtRrvPlha1m+zz8kboiyx/MAsyl3" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
+          <script>
+            window.onload = () => {
+              window.ui = SwaggerUIBundle({
+                url: '${escapeJsString(specUrl)}',
+                dom_id: '#swagger-ui',
+              });
+            };
+          </script>
+        </body>
+        </html>`;
+    res.status(200).sendRaw(html, "text/html");
+  };
+  app.route({
+    method: "GET",
+    path: prefix,
+    handler: docsHandler
+  });
+}
+var __require2, OpenApiGenerator, DOCS_CSP, Security;
+var init_dist = __esm({
+  "../openapi/dist/index.mjs"() {
+    __require2 = /* @__PURE__ */ ((x) => typeof __require !== "undefined" ? __require : typeof Proxy !== "undefined" ? new Proxy(x, {
+      get: (a, b) => (typeof __require !== "undefined" ? __require : a)[b]
+    }) : x)(function(x) {
+      if (typeof __require !== "undefined") return __require.apply(this, arguments);
+      throw Error('Dynamic require of "' + x + '" is not supported');
+    });
+    OpenApiGenerator = class {
+      constructor(app, options) {
+        this.app = app;
+        this.options = options;
+      }
+      app;
+      options;
+      generate() {
+        const spec = {
+          openapi: "3.0.3",
+          info: this.options.info,
+          paths: {}
+        };
+        if (this.options.components) spec.components = this.options.components;
+        if (this.options.security) spec.security = this.options.security;
+        for (const route of this.app.registeredRoutes) {
+          const openApiPath = this.formatPath(route.path);
+          const method = route.method.toLowerCase();
+          const paths = spec.paths;
+          if (!paths[openApiPath]) paths[openApiPath] = {};
+          const op = route.openapi ?? void 0;
+          const operation = {
+            // OAS §4.7.10.2 — summary. Default to `${method} ${path}` so the
+            // docs UI always has a human-readable title even without user input.
+            summary: op?.summary ?? `${route.method} ${route.path}`,
+            // OAS §4.7.10.5 — operationId. Client codegen tools
+            // (openapi-typescript, openapi-generator) use this to name the
+            // generated function. When the user doesn't supply one we
+            // synthesise a stable name from method+path:
+            //   GET /users/:id → "getUsersById"
+            //   POST /users    → "postUsers"
+            // Determinism matters here — codegen output should not drift
+            // between releases unless method+path actually change.
+            operationId: op?.operationId ?? this.synthesiseOperationId(route.method, route.path),
+            parameters: this.extractParameters(route),
+            responses: this.extractResponses(route)
+          };
+          const legacySchema = route.schema ?? {};
+          const description = op?.description ?? legacySchema.description;
+          const tags = op?.tags ?? legacySchema.tags;
+          const security = op?.security ?? legacySchema.security;
+          if (description) operation.description = description;
+          if (tags) operation.tags = tags;
+          if (security !== void 0) operation.security = security;
+          if (op?.deprecated) operation.deprecated = true;
+          if (op?.externalDocs) operation.externalDocs = op.externalDocs;
+          if (op?.servers) operation.servers = op.servers;
+          if (op?.callbacks) operation.callbacks = op.callbacks;
+          const body = this.extractBody(route);
+          if (body) {
+            if (op?.requestBodyDescription) {
+              body.description = op.requestBodyDescription;
+            }
+            operation.requestBody = body;
+          }
+          paths[openApiPath][method] = operation;
+        }
+        return spec;
+      }
+      /** Translates Axiomify path syntax to OpenAPI: `/users/:id` → `/users/{id}` */
+      formatPath(path11) {
+        return path11.replace(/:([a-zA-Z0-9_]+)/g, "{$1}");
+      }
+      extractParameters(route) {
+        const parameters = [];
+        if (route.schema?.params) {
+          const paramSchema = zodSchemaToOpenApi(route.schema.params);
+          const properties = paramSchema.properties ?? {};
+          for (const [key, prop] of Object.entries(properties)) {
+            parameters.push({ name: key, in: "path", required: true, schema: prop });
+          }
+        }
+        if (route.schema?.query) {
+          const querySchema = zodSchemaToOpenApi(route.schema.query);
+          const properties = querySchema.properties ?? {};
+          const required = querySchema.required ?? [];
+          for (const [key, prop] of Object.entries(properties)) {
+            parameters.push({
+              name: key,
+              in: "query",
+              required: required.includes(key),
+              schema: prop
+            });
+          }
+        }
+        return parameters;
+      }
+      /**
+       * Synthesise a stable, codegen-friendly operationId from method+path
+       * when the route definition doesn't supply one. Example outputs:
+       *   GET  /users/:id            → getUsersById
+       *   POST /users                → postUsers
+       *   GET  /users/:id/posts/:pid → getUsersByIdPostsByPid
+       *
+       * Determinism matters here — client codegen produces the same function
+       * names on every run as long as method+path are stable.
+       */
+      synthesiseOperationId(method, path11) {
+        const verb = method.toLowerCase();
+        const parts = [];
+        for (const seg of path11.split("/")) {
+          if (!seg) continue;
+          if (seg.startsWith(":")) {
+            const name = seg.slice(1);
+            parts.push("By", name.charAt(0).toUpperCase() + name.slice(1));
+          } else if (seg === "*") {
+            parts.push("All");
+          } else {
+            parts.push(seg.charAt(0).toUpperCase() + seg.slice(1));
+          }
+        }
+        return verb + parts.join("");
+      }
+      extractBody(route) {
+        if (!route.schema?.body && !route.schema?.files) return void 0;
+        const hasFiles = !!route.schema.files;
+        const contentType = hasFiles ? "multipart/form-data" : "application/json";
+        let finalSchema = { type: "object", properties: {} };
+        if (route.schema.body) {
+          const bodySchema = zodSchemaToOpenApi(route.schema.body);
+          if (bodySchema.type === "object") {
+            finalSchema.properties = { ...bodySchema.properties };
+            if (bodySchema.required) finalSchema.required = bodySchema.required;
+            if (bodySchema.additionalProperties !== void 0) {
+              finalSchema.additionalProperties = bodySchema.additionalProperties;
+            }
+          } else {
+            finalSchema = hasFiles ? { type: "object", properties: { payload: bodySchema } } : bodySchema;
+          }
+        }
+        if (hasFiles) {
+          const files = route.schema.files;
+          const props = finalSchema.properties ?? {};
+          for (const [fieldName, config] of Object.entries(files)) {
+            props[fieldName] = {
+              type: "string",
+              format: "binary",
+              ...config.description ? { description: config.description } : {},
+              ...config.maxSize ? { description: `Max size: ${config.maxSize} bytes` } : {}
+            };
+          }
+          finalSchema.properties = props;
+        }
+        return { required: true, content: { [contentType]: { schema: finalSchema } } };
+      }
+      extractResponses(route) {
+        const op = route.openapi;
+        const descriptions = op?.responseDescriptions ?? {};
+        const defaultResponse = {
+          "200": {
+            description: descriptions["200"] ?? "Successful response",
+            content: { "application/json": { schema: { type: "object" } } }
+          }
+        };
+        if (!route.schema?.response) return defaultResponse;
+        const responseSchema = route.schema.response;
+        const responses = {};
+        if (isZodSchema(responseSchema)) {
+          responses["200"] = {
+            description: descriptions["200"] ?? "Successful response",
+            content: {
+              "application/json": { schema: zodSchemaToOpenApi(responseSchema) }
+            }
+          };
+        } else if (typeof responseSchema === "object" && responseSchema !== null) {
+          for (const [code, schema] of Object.entries(
+            responseSchema
+          )) {
+            responses[code] = {
+              description: descriptions[code] ?? `Response ${code}`,
+              content: {
+                "application/json": { schema: zodSchemaToOpenApi(schema) }
+              }
+            };
+          }
+        }
+        return Object.keys(responses).length > 0 ? responses : defaultResponse;
+      }
+    };
+    DOCS_CSP = "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://unpkg.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.jsdelivr.net https://cdnjs.cloudflare.com; font-src 'self' https://fonts.gstatic.com data:; img-src 'self' data: https://validator.swagger.io; worker-src 'self' blob:;";
+    Security = defineSecuritySchemes({
+      bearerAuth: { type: "http", scheme: "bearer" },
+      apiKey: { type: "apiKey", in: "header", name: "X-API-KEY" },
+      basicAuth: { type: "http", scheme: "basic" }
+    });
+  }
+});
+
 // node_modules/commander/esm.mjs
 var import_index = __toESM(require_commander());
 var {
@@ -2923,12 +3561,12 @@ var {
 
 // package.json
 var package_default = {
-  version: "5.0.0"};
+  version: "6.0.0-rc.2"};
 var ALWAYS_EXTERNAL = ["uWebSockets.js"];
 function getUserExternals(cwd) {
   let pkgExternals = [];
   try {
-    const pkgPath = path4__default.default.join(cwd, "package.json");
+    const pkgPath = path7__default.default.join(cwd, "package.json");
     if (fs__default.default.existsSync(pkgPath)) {
       const pkg = JSON.parse(fs__default.default.readFileSync(pkgPath, "utf8"));
       const deps = Object.keys(pkg.dependencies || {});
@@ -2946,8 +3584,8 @@ function getUserExternals(cwd) {
 
 // src/commands/build.ts
 async function buildProject(entry) {
-  const entryPath = path4__default.default.resolve(process.cwd(), entry);
-  const outPath = path4__default.default.resolve(process.cwd(), "dist/index.js");
+  const entryPath = path7__default.default.resolve(process.cwd(), entry);
+  const outPath = path7__default.default.resolve(process.cwd(), "dist/index.js");
   const userExternals = getUserExternals(process.cwd());
   console.log(`\u{1F528} Building production bundle from ${entry}...`);
   try {
@@ -2967,9 +3605,379 @@ async function buildProject(entry) {
     process.exit(1);
   }
 }
+function colourMethod(method) {
+  const m = method.toUpperCase();
+  const padded = m.padEnd(7);
+  switch (m) {
+    case "GET":
+      return pc__default.default.bold(pc__default.default.green(padded));
+    case "POST":
+      return pc__default.default.bold(pc__default.default.blue(padded));
+    case "PUT":
+      return pc__default.default.bold(pc__default.default.yellow(padded));
+    case "PATCH":
+      return pc__default.default.bold(pc__default.default.magenta(padded));
+    case "DELETE":
+      return pc__default.default.bold(pc__default.default.red(padded));
+    case "HEAD":
+      return pc__default.default.dim(padded);
+    case "OPTIONS":
+      return pc__default.default.dim(padded);
+    case "WS":
+      return pc__default.default.bold(pc__default.default.cyan(padded));
+    default:
+      return padded;
+  }
+}
+var badge = {
+  validation(label) {
+    return pc__default.default.cyan(label);
+  },
+  deprecated() {
+    return pc__default.default.bold(pc__default.default.red("\u2298 DEPRECATED"));
+  },
+  timeout(ms) {
+    return pc__default.default.dim(`${ms}ms`);
+  },
+  tags(tags) {
+    if (!tags.length) return "";
+    return tags.map((t) => pc__default.default.dim(`#${t}`)).join(" ");
+  }
+};
+function visibleLength(s) {
+  return s.replace(/\x1b\[[0-9;]*m/g, "").length;
+}
+function pad(s, width, align) {
+  const v = visibleLength(s);
+  if (v >= width) return s;
+  const filler = " ".repeat(width - v);
+  return align === "right" ? filler + s : s + filler;
+}
+function truncate(s, max) {
+  if (visibleLength(s) <= max) return s;
+  const stripped = s.replace(/\x1b\[[0-9;]*m/g, "");
+  return stripped.slice(0, max - 1) + pc__default.default.dim("\u2026");
+}
+function renderTable(columns, rows, terminalWidth = process.stdout.columns || 100) {
+  const widths = columns.map((col, i) => {
+    const headerW = visibleLength(col.header);
+    const cellW = Math.max(
+      headerW,
+      ...rows.map((r) => visibleLength(r[i] ?? ""))
+    );
+    let w = Math.max(headerW, cellW);
+    if (col.minWidth) w = Math.max(w, col.minWidth);
+    if (col.maxWidth) w = Math.min(w, col.maxWidth);
+    return w;
+  });
+  const overheadPerSep = 3;
+  const overhead = (columns.length + 1) * 2 + overheadPerSep * (columns.length - 1);
+  let total = widths.reduce((a, b) => a + b, 0) + overhead;
+  if (total > terminalWidth) {
+    const flexIdx = columns.map((c, i) => ({ c, i })).filter(({ c }) => !c.minWidth).map(({ i }) => i);
+    let excess = total - terminalWidth;
+    for (let pass = 0; pass < 8 && excess > 0; pass++) {
+      for (const i of flexIdx) {
+        if (excess <= 0) break;
+        if (widths[i] > 8) {
+          widths[i]--;
+          excess--;
+          total--;
+        }
+      }
+    }
+  }
+  const bar = (l, m, r) => l + widths.map((w) => "\u2500".repeat(w + 2)).join(m) + r;
+  const lines = [];
+  lines.push(pc__default.default.dim(bar("\u250C", "\u252C", "\u2510")));
+  lines.push(
+    pc__default.default.dim("\u2502 ") + columns.map((c, i) => pc__default.default.bold(pad(c.header, widths[i], c.align ?? "left"))).join(pc__default.default.dim(" \u2502 ")) + pc__default.default.dim(" \u2502")
+  );
+  lines.push(pc__default.default.dim(bar("\u251C", "\u253C", "\u2524")));
+  for (const row of rows) {
+    lines.push(
+      pc__default.default.dim("\u2502 ") + columns.map((c, i) => {
+        const cell = row[i] ?? "";
+        const truncated = c.maxWidth ? truncate(cell, widths[i]) : cell;
+        return pad(truncated, widths[i], c.align ?? "left");
+      }).join(pc__default.default.dim(" \u2502 ")) + pc__default.default.dim(" \u2502")
+    );
+  }
+  lines.push(pc__default.default.dim(bar("\u2514", "\u2534", "\u2518")));
+  return lines.join("\n");
+}
+function pluralise(n, singular, plural) {
+  return n === 1 ? `${n} ${singular}` : `${n} ${plural ?? singular + "s"}`;
+}
+var symbols = {
+  ok: pc__default.default.green("\u2713"),
+  warn: pc__default.default.yellow("\u26A0"),
+  fail: pc__default.default.red("\u2717"),
+  info: pc__default.default.cyan("\u2139"),
+  bullet: pc__default.default.dim("\u2022"),
+  arrow: pc__default.default.dim("\u2192")
+};
+async function loadApp(entry) {
+  const entryPath = path7__default.default.resolve(process.cwd(), entry);
+  const tempDir = path7__default.default.resolve(process.cwd(), ".axiomify");
+  const tempPath = path7__default.default.join(tempDir, "inspect.cjs");
+  const userExternals = getUserExternals(process.cwd());
+  await esbuild__namespace.build({
+    entryPoints: [entryPath],
+    bundle: true,
+    platform: "node",
+    format: "cjs",
+    outfile: tempPath,
+    external: [.../* @__PURE__ */ new Set([...userExternals, "node:*"])],
+    // Silence esbuild's own progress chatter — the CLI command above is
+    // responsible for its own user-facing output.
+    logLevel: "error"
+  });
+  try {
+    delete __require.cache[__require.resolve(tempPath)];
+  } catch {
+  }
+  const hangTimer = setTimeout(() => {
+    process.stderr.write(
+      "\n" + pc__default.default.yellow("\u26A0  CLI inspection is taking longer than expected.") + "\n   Your entry file may be starting a server unconditionally.\n   Wrap the listen() call in " + pc__default.default.cyan("if (require.main === module) { ... }") + " so it only runs when executed directly.\n\n"
+    );
+  }, 5e3);
+  hangTimer.unref();
+  let mod;
+  try {
+    mod = __require(tempPath);
+  } finally {
+    clearTimeout(hangTimer);
+  }
+  const app = mod.app ?? mod.default;
+  if (!app || typeof app.registeredRoutes === "undefined") {
+    await fs5__default.default.rm(tempDir, { recursive: true, force: true }).catch(() => {
+    });
+    throw new Error(
+      "Could not find an exported Axiomify instance.\nEnsure your entry file exports the app:\n  export const app = new Axiomify();\nor:\n  export default app;"
+    );
+  }
+  const cleanup = async () => {
+    await fs5__default.default.rm(tempDir, { recursive: true, force: true }).catch(() => {
+    });
+  };
+  return { app, cleanup };
+}
+
+// src/commands/check.ts
+function add(ctx, f) {
+  ctx.findings.push(f);
+}
+function checkRequestId(ctx) {
+  const onRequest = ctx.app.hooks?.hooks?.onRequest ?? [];
+  if (onRequest.length === 0) {
+    add(ctx, {
+      severity: "warn",
+      area: "observability",
+      message: "`app.enableRequestId()` has not been called",
+      hint: "Distributed-trace correlation will be impossible without an X-Request-Id header. Add `app.enableRequestId()` after construction unless you handle this elsewhere."
+    });
+    return;
+  }
+  add(ctx, {
+    severity: "ok",
+    area: "observability",
+    message: `onRequest hooks: ${onRequest.length} registered`
+  });
+}
+function checkEnvVars(ctx) {
+  const expectedInProd = ["JWT_SECRET", "NODE_ENV"];
+  for (const key of expectedInProd) {
+    if (!ctx.envKeys.has(key)) continue;
+    if (process.env[key]) {
+      add(ctx, { severity: "ok", area: "env", message: `${key} is set` });
+    } else {
+      add(ctx, {
+        severity: "warn",
+        area: "env",
+        message: `${key} referenced in source but not set in environment`,
+        hint: key === "JWT_SECRET" ? "Set this before deploying. Generate one via `node -e \"console.log(require('crypto').randomBytes(48).toString('base64'))\"`" : `Ensure ${key} is set in your deployment environment.`
+      });
+    }
+  }
+}
+function checkResponseSchemas(ctx) {
+  const routes = ctx.app.registeredRoutes ?? [];
+  const missing = routes.filter(
+    (r) => r.schema?.body && !r.schema?.response
+  );
+  if (missing.length > 0) {
+    add(ctx, {
+      severity: "warn",
+      area: "validation",
+      message: `${missing.length} route${missing.length === 1 ? "" : "s"} with body schema but no response schema`,
+      hint: `Declaring \`schema.response\` pins the API contract \u2014 without it, internal model field names leak to clients and breaking changes go undetected. First offender: ${missing[0].method} ${missing[0].path}`
+    });
+  } else if (routes.length > 0) {
+    add(ctx, {
+      severity: "ok",
+      area: "validation",
+      message: "every route with a body schema also declares a response schema"
+    });
+  }
+}
+function checkOpenApiNaming(ctx) {
+  const routes = ctx.app.registeredRoutes ?? [];
+  const usingMeta = routes.filter((r) => r.meta);
+  if (usingMeta.length > 0) {
+    add(ctx, {
+      severity: "fail",
+      area: "api",
+      message: `${usingMeta.length} route${usingMeta.length === 1 ? "" : "s"} use the removed \`meta:\` field`,
+      hint: `The \`meta:\` field was removed in 6.0. Rename to \`openapi:\` \u2014 shape is identical. First offender: ${usingMeta[0].method} ${usingMeta[0].path}`
+    });
+  }
+}
+function checkHealthCheck(ctx) {
+  const routes = ctx.app.registeredRoutes ?? [];
+  const hasHealth = routes.some(
+    (r) => r.method === "GET" && ["/health", "/healthz", "/-/health", "/ping", "/live", "/ready"].some(
+      (p) => r.path === p
+    )
+  );
+  if (hasHealth) {
+    add(ctx, { severity: "ok", area: "ops", message: "health-check route registered" });
+  } else {
+    add(ctx, {
+      severity: "warn",
+      area: "ops",
+      message: "no health-check route detected",
+      hint: 'Kubernetes, ECS, and load balancers expect a `/health` (or similar) endpoint. Register one via `app.healthCheck("/health")` from `@axiomify/core`.'
+    });
+  }
+}
+function checkOpenApiExposure(ctx) {
+  const routes = ctx.app.registeredRoutes ?? [];
+  const docsRoute = routes.find(
+    (r) => r.method === "GET" && (r.path === "/docs" || r.path.endsWith("/docs"))
+  );
+  const specRoute = routes.find(
+    (r) => r.method === "GET" && r.path.endsWith("/openapi.json")
+  );
+  if (docsRoute || specRoute) {
+    add(ctx, {
+      severity: "warn",
+      area: "security",
+      message: "OpenAPI docs endpoint is registered",
+      hint: "In production, supply `protect: (req) => ...` to `useOpenAPI()` (or set `allowPublicInProduction: true` if exposure is intentional). The runtime warning is logged on the first request."
+    });
+  }
+}
+function checkRoutesLockState(ctx) {
+  if (ctx.app._routesLocked) {
+    add(ctx, {
+      severity: "warn",
+      area: "config",
+      message: "app.lockRoutes() has already been called",
+      hint: "The entry file appears to construct an adapter at the top level. Wrap adapter construction in `if (require.main === module) { ... }` so the CLI can introspect the app without triggering it."
+    });
+  }
+}
+function checkSecurityPlugins(ctx) {
+  const onRequest = ctx.app.hooks?.hooks?.onRequest ?? [];
+  if (onRequest.length < 2) {
+    add(ctx, {
+      severity: "warn",
+      area: "security",
+      message: "few onRequest hooks detected \u2014 security plugins may not be registered",
+      hint: "`@axiomify/helmet`, `@axiomify/cors`, and `@axiomify/security` each install onRequest hooks. If you are not using these, ensure equivalent defences are in place elsewhere."
+    });
+  } else {
+    add(ctx, {
+      severity: "ok",
+      area: "security",
+      message: `${onRequest.length} onRequest hooks registered (security plugins likely active)`
+    });
+  }
+}
+function collectEnvKeysFromBundle(bundlePath) {
+  const keys = /* @__PURE__ */ new Set();
+  try {
+    const src = fs__default.default.readFileSync(bundlePath, "utf8");
+    const re = /process\.env\.([A-Z][A-Z0-9_]*)|process\.env\[(['"])([A-Z][A-Z0-9_]*)\2\]/g;
+    let m;
+    while ((m = re.exec(src)) !== null) {
+      keys.add(m[1] ?? m[3]);
+    }
+  } catch {
+  }
+  return keys;
+}
+function loadPkgJson(cwd) {
+  try {
+    return JSON.parse(fs__default.default.readFileSync(path7__default.default.join(cwd, "package.json"), "utf8"));
+  } catch {
+    return null;
+  }
+}
+async function runCheck(entry) {
+  let app;
+  let cleanup = async () => {
+  };
+  let bundlePath = "";
+  try {
+    const loaded = await loadApp(entry);
+    app = loaded.app;
+    cleanup = loaded.cleanup;
+    bundlePath = path7__default.default.resolve(process.cwd(), ".axiomify/inspect.cjs");
+  } catch (err) {
+    console.error(pc__default.default.red("\u2717 Failed to load app:"));
+    console.error(err.message);
+    process.exit(1);
+  }
+  const ctx = {
+    app,
+    cwd: process.cwd(),
+    findings: [],
+    pkgJson: loadPkgJson(process.cwd()),
+    envKeys: collectEnvKeysFromBundle(bundlePath)
+  };
+  checkEnvVars(ctx);
+  checkRequestId(ctx);
+  checkRoutesLockState(ctx);
+  checkOpenApiNaming(ctx);
+  checkSecurityPlugins(ctx);
+  checkOpenApiExposure(ctx);
+  checkResponseSchemas(ctx);
+  checkHealthCheck(ctx);
+  await cleanup();
+  console.log();
+  console.log(pc__default.default.bold("  \u{1F50D} Production-readiness check"));
+  console.log();
+  const sevOrder = { fail: 0, warn: 1, ok: 2 };
+  ctx.findings.sort(
+    (a, b) => sevOrder[a.severity] - sevOrder[b.severity] || a.area.localeCompare(b.area)
+  );
+  const sym = {
+    ok: symbols.ok,
+    warn: symbols.warn,
+    fail: symbols.fail
+  };
+  for (const f of ctx.findings) {
+    const tag = pc__default.default.dim(`[${f.area}]`);
+    console.log(`  ${sym[f.severity]} ${tag} ${f.message}`);
+    if (f.hint && f.severity !== "ok") {
+      const wrapped = f.hint.replace(/(.{1,80})(\s+|$)/g, "\n      " + pc__default.default.dim("$1"));
+      console.log(wrapped);
+    }
+  }
+  const fails = ctx.findings.filter((f) => f.severity === "fail").length;
+  const warns = ctx.findings.filter((f) => f.severity === "warn").length;
+  const oks = ctx.findings.filter((f) => f.severity === "ok").length;
+  console.log();
+  const summary = `  ${symbols.ok} ${pluralise(oks, "pass", "passes")}` + pc__default.default.dim("  \xB7  ") + (warns > 0 ? `${symbols.warn} ${pluralise(warns, "warning")}` : pc__default.default.dim("0 warnings")) + pc__default.default.dim("  \xB7  ") + (fails > 0 ? `${symbols.fail} ${pluralise(fails, "failure")}` : pc__default.default.dim("0 failures"));
+  console.log(summary);
+  console.log();
+  if (fails > 0) process.exit(1);
+}
 async function devServer(entry) {
-  const entryPath = path4__default.default.resolve(process.cwd(), entry);
-  const outPath = path4__default.default.resolve(process.cwd(), ".axiomify/dev.js");
+  const entryPath = path7__default.default.resolve(process.cwd(), entry);
+  const outPath = path7__default.default.resolve(process.cwd(), ".axiomify/dev.js");
   let child = null;
   let firstBuild = true;
   const startChild = () => {
@@ -3049,6 +4057,213 @@ async function devServer(entry) {
   console.log(`\u{1F440} Axiomify Dev Engine watching for changes...`);
   await ctx.watch();
 }
+function add2(findings, f) {
+  findings.push(f);
+}
+function probePort(port) {
+  return new Promise((resolve) => {
+    const server = net.createServer();
+    server.once("error", (err) => {
+      if (err.code === "EADDRINUSE") resolve("busy");
+      else if (err.code === "EACCES") resolve("denied");
+      else resolve("busy");
+    });
+    server.once("listening", () => {
+      server.close(() => resolve("free"));
+    });
+    server.listen(port, "127.0.0.1");
+  });
+}
+function checkNodeVersion(findings) {
+  const major = parseInt(process.versions.node.split(".")[0], 10);
+  if (major < 18) {
+    add2(findings, {
+      severity: "fail",
+      area: "node",
+      message: `Node ${process.versions.node} is below the supported minimum`,
+      hint: "Axiomify requires Node 18 or later. Upgrade via nvm: `nvm install 22 && nvm use 22`."
+    });
+  } else if (major > 22) {
+    add2(findings, {
+      severity: "warn",
+      area: "node",
+      message: `Node ${process.versions.node} \u2014 uWebSockets.js has no prebuilt binary for this version`,
+      hint: "Tests and benchmarks that need a real uWS listener will skip; the framework still builds. For a runnable production deploy, downgrade to Node 22 LTS."
+    });
+  } else {
+    add2(findings, {
+      severity: "ok",
+      area: "node",
+      message: `Node ${process.versions.node} (uWS prebuilt available)`
+    });
+  }
+}
+function checkPlatform(findings) {
+  if (process.platform === "linux") {
+    add2(findings, {
+      severity: "ok",
+      area: "platform",
+      message: "Linux \u2014 SO_REUSEPORT clustering supported natively"
+    });
+  } else {
+    add2(findings, {
+      severity: "warn",
+      area: "platform",
+      message: `${process.platform} \u2014 \`listenClustered()\` requires \`allowUserspaceProxy: true\``,
+      hint: "Clustering on non-Linux falls back to a userspace L4 proxy that adds two event-loop hops per byte. Single-process `listen()` is the recommended path on this OS."
+    });
+  }
+}
+function checkDependencyDrift(findings) {
+  try {
+    const pkgPath = path7__default.default.join(process.cwd(), "package.json");
+    const pkg = JSON.parse(fs__default.default.readFileSync(pkgPath, "utf8"));
+    const all = { ...pkg.dependencies, ...pkg.devDependencies };
+    const axiomifyDeps = Object.entries(all).filter(
+      ([k]) => k.startsWith("@axiomify/")
+    );
+    if (axiomifyDeps.length === 0) {
+      add2(findings, {
+        severity: "warn",
+        area: "deps",
+        message: "No @axiomify/* packages found in package.json",
+        hint: "Run this from the root of a project that uses Axiomify."
+      });
+      return;
+    }
+    const versions = new Set(
+      axiomifyDeps.map(([, v]) => v.replace(/^[\^~]/, "").replace(/^\*$/, "workspace"))
+    );
+    if (versions.size > 1) {
+      add2(findings, {
+        severity: "warn",
+        area: "deps",
+        message: `@axiomify/* packages are on ${versions.size} different versions`,
+        hint: "Mixed @axiomify/* versions can cause subtle compat issues. Pin them all to the same version: " + [...versions].join(", ")
+      });
+    } else {
+      add2(findings, {
+        severity: "ok",
+        area: "deps",
+        message: `${axiomifyDeps.length} @axiomify/* packages aligned (${[...versions][0]})`
+      });
+    }
+  } catch {
+    add2(findings, {
+      severity: "warn",
+      area: "deps",
+      message: "Could not read package.json",
+      hint: "Run `axiomify doctor` from a project root."
+    });
+  }
+}
+function checkUwsLoads(findings) {
+  try {
+    require_uws();
+    add2(findings, {
+      severity: "ok",
+      area: "uws",
+      message: "uWebSockets.js loads successfully"
+    });
+  } catch (err) {
+    const msg = String(err.message ?? err);
+    if (msg.includes("Cannot find module")) {
+      add2(findings, {
+        severity: "warn",
+        area: "uws",
+        message: "uWebSockets.js is not installed in this project",
+        hint: "It is a peer dependency of `@axiomify/native`. Install via `npm install --save-optional uWebSockets.js` (the package handles platform selection)."
+      });
+    } else {
+      add2(findings, {
+        severity: "fail",
+        area: "uws",
+        message: "uWebSockets.js native binding failed to load",
+        hint: msg.length > 200 ? msg.slice(0, 200) + "\u2026" : msg
+      });
+    }
+  }
+}
+async function checkPortAvailability(findings) {
+  const port = parseInt(process.env.PORT ?? "3000", 10);
+  const state = await probePort(port);
+  if (state === "free") {
+    add2(findings, {
+      severity: "ok",
+      area: "port",
+      message: `Port ${port} is available on 127.0.0.1`
+    });
+  } else if (state === "busy") {
+    add2(findings, {
+      severity: "warn",
+      area: "port",
+      message: `Port ${port} is already in use`,
+      hint: "Stop the conflicting process or set `PORT` to a different value."
+    });
+  } else {
+    add2(findings, {
+      severity: "warn",
+      area: "port",
+      message: `Port ${port}: bind denied (permission)`,
+      hint: "Ports below 1024 typically require root. Use a port \u2265 1024 in development."
+    });
+  }
+}
+function checkBuildArtifacts(findings) {
+  const dist = path7__default.default.join(process.cwd(), "dist");
+  if (fs__default.default.existsSync(dist)) {
+    add2(findings, {
+      severity: "ok",
+      area: "build",
+      message: "dist/ exists (recent `axiomify build`)"
+    });
+  } else {
+    add2(findings, {
+      severity: "warn",
+      area: "build",
+      message: "No dist/ directory \u2014 production build has not been run",
+      hint: "Run `axiomify build` before deploying."
+    });
+  }
+}
+async function runDoctor() {
+  const findings = [];
+  checkNodeVersion(findings);
+  checkPlatform(findings);
+  checkDependencyDrift(findings);
+  checkUwsLoads(findings);
+  checkBuildArtifacts(findings);
+  await checkPortAvailability(findings);
+  console.log();
+  console.log(pc__default.default.bold("  \u{1FA7A} Axiomify doctor"));
+  console.log();
+  const sevOrder = { fail: 0, warn: 1, ok: 2 };
+  findings.sort(
+    (a, b) => sevOrder[a.severity] - sevOrder[b.severity] || a.area.localeCompare(b.area)
+  );
+  const sym = {
+    ok: symbols.ok,
+    warn: symbols.warn,
+    fail: symbols.fail
+  };
+  for (const f of findings) {
+    const tag = pc__default.default.dim(`[${f.area}]`);
+    console.log(`  ${sym[f.severity]} ${tag} ${f.message}`);
+    if (f.hint && f.severity !== "ok") {
+      const wrapped = f.hint.replace(/(.{1,80})(\s+|$)/g, "\n      " + pc__default.default.dim("$1"));
+      console.log(wrapped);
+    }
+  }
+  const fails = findings.filter((f) => f.severity === "fail").length;
+  const warns = findings.filter((f) => f.severity === "warn").length;
+  const oks = findings.filter((f) => f.severity === "ok").length;
+  console.log();
+  console.log(
+    `  ${symbols.ok} ${pluralise(oks, "pass", "passes")}` + pc__default.default.dim("  \xB7  ") + (warns > 0 ? `${symbols.warn} ${pluralise(warns, "warning")}` : pc__default.default.dim("0 warnings")) + pc__default.default.dim("  \xB7  ") + (fails > 0 ? `${symbols.fail} ${pluralise(fails, "failure")}` : pc__default.default.dim("0 failures"))
+  );
+  console.log();
+  if (fails > 0) process.exit(1);
+}
 var DEV_COMMAND_BY_PM = {
   npm: "npm run dev",
   pnpm: "pnpm dev",
@@ -3066,20 +4281,6 @@ async function initProject(targetDir, options = {}) {
     });
   }
   questions.push(
-    {
-      type: "select",
-      name: "adapter",
-      message: "Which HTTP adapter do you want to use?",
-      choices: [
-        "Native (uWS \u2014 Fastest, 50k+ req/s)",
-        "Fastify (High-throughput, recommended)",
-        "Express (Max ecosystem compatibility)",
-        "Hapi (Enterprise, plugin-first)",
-        "Node HTTP (Zero dependency)"
-      ],
-      initial: 0
-      // Native is the recommended default
-    },
     {
       type: "input",
       name: "description",
@@ -3133,12 +4334,12 @@ async function initProject(targetDir, options = {}) {
     );
     process.exit(1);
   }
-  const dir = path4__default.default.resolve(process.cwd(), projectName);
+  const dir = path7__default.default.resolve(process.cwd(), projectName);
   if (fs.existsSync(dir) && !options.force && targetDir) {
     const targets = [
-      path4__default.default.join(dir, "package.json"),
-      path4__default.default.join(dir, "tsconfig.json"),
-      path4__default.default.join(dir, "src", "index.ts")
+      path7__default.default.join(dir, "package.json"),
+      path7__default.default.join(dir, "tsconfig.json"),
+      path7__default.default.join(dir, "src", "index.ts")
     ];
     const collisions = targets.filter((p) => fs.existsSync(p));
     if (collisions.length > 0) {
@@ -3150,28 +4351,11 @@ async function initProject(targetDir, options = {}) {
       process.exit(1);
     }
   }
-  await fs2__default.default.mkdir(path4__default.default.join(dir, "src"), { recursive: true });
+  await fs5__default.default.mkdir(path7__default.default.join(dir, "src"), { recursive: true });
   const AXIOMIFY_VERSION = `^${package_default.version}`;
-  let adapterPackage = "@axiomify/native";
-  let adapterImport = "import { NativeAdapter } from '@axiomify/native';";
-  let adapterInit = "const server = new NativeAdapter(app, { port: 3000 });\n  server.listen(() => console.log('  Axiomify Native on :3000'));";
-  if (answers.adapter.includes("Fastify")) {
-    adapterPackage = "@axiomify/fastify";
-    adapterImport = "import { FastifyAdapter } from '@axiomify/fastify';";
-    adapterInit = "const server = new FastifyAdapter(app);\n  await server.listen(3000);\n  console.log('  Axiomify Fastify on :3000');";
-  } else if (answers.adapter.includes("Express")) {
-    adapterPackage = "@axiomify/express";
-    adapterImport = "import { ExpressAdapter } from '@axiomify/express';";
-    adapterInit = "const server = new ExpressAdapter(app);\n  server.listen(3000, () => console.log('  Axiomify Express on :3000'));";
-  } else if (answers.adapter.includes("Hapi")) {
-    adapterPackage = "@axiomify/hapi";
-    adapterImport = "import { HapiAdapter } from '@axiomify/hapi';";
-    adapterInit = "const server = new HapiAdapter(app);\n  await server.listen(3000);\n  console.log('  Axiomify Hapi on :3000');";
-  } else if (answers.adapter.includes("HTTP")) {
-    adapterPackage = "@axiomify/http";
-    adapterImport = "import { HttpAdapter } from '@axiomify/http';";
-    adapterInit = "const server = new HttpAdapter(app);\n  server.listen(3000, () => console.log('  Axiomify HTTP on :3000'));";
-  }
+  const adapterPackage = "@axiomify/native";
+  const adapterImport = "import { NativeAdapter } from '@axiomify/native';";
+  const adapterInit = "const server = new NativeAdapter(app, { port: 3000 });\n  server.listen(() => console.log('  Axiomify Native on :3000'));";
   const pkgJson = {
     name: projectName,
     version: "1.0.0",
@@ -3239,14 +4423,14 @@ async function initProject(targetDir, options = {}) {
       "printWidth": 100,
       "tabWidth": 2
     }`;
-    await fs2__default.default.writeFile(path4__default.default.join(dir, ".eslintrc.cjs"), eslintConfig);
-    await fs2__default.default.writeFile(path4__default.default.join(dir, ".prettierrc"), prettierConfig);
-    await fs2__default.default.writeFile(
-      path4__default.default.join(dir, ".prettierignore"),
+    await fs5__default.default.writeFile(path7__default.default.join(dir, ".eslintrc.cjs"), eslintConfig);
+    await fs5__default.default.writeFile(path7__default.default.join(dir, ".prettierrc"), prettierConfig);
+    await fs5__default.default.writeFile(
+      path7__default.default.join(dir, ".prettierignore"),
       "dist\nnode_modules\ncoverage\n"
     );
-    await fs2__default.default.writeFile(
-      path4__default.default.join(dir, ".editorconfig"),
+    await fs5__default.default.writeFile(
+      path7__default.default.join(dir, ".editorconfig"),
       "root = true\n\n[*]\ncharset = utf-8\nend_of_line = lf\nindent_style = space\nindent_size = 2\ninsert_final_newline = true\ntrim_trailing_whitespace = true\n"
     );
   }
@@ -3307,19 +4491,19 @@ async function initProject(targetDir, options = {}) {
     "coverage",
     "*.log"
   ].join("\n") + "\n";
-  await fs2__default.default.writeFile(
-    path4__default.default.join(dir, "package.json"),
+  await fs5__default.default.writeFile(
+    path7__default.default.join(dir, "package.json"),
     JSON.stringify(pkgJson, null, 2)
   );
-  await fs2__default.default.writeFile(
-    path4__default.default.join(dir, "tsconfig.json"),
+  await fs5__default.default.writeFile(
+    path7__default.default.join(dir, "tsconfig.json"),
     JSON.stringify(tsConfig, null, 2)
   );
-  await fs2__default.default.writeFile(path4__default.default.join(dir, "src", "index.ts"), indexTs);
-  await fs2__default.default.writeFile(path4__default.default.join(dir, ".gitignore"), gitignore);
+  await fs5__default.default.writeFile(path7__default.default.join(dir, "src", "index.ts"), indexTs);
+  await fs5__default.default.writeFile(path7__default.default.join(dir, ".gitignore"), gitignore);
   console.log(pc__default.default.green(`
 \u2705 Axiomify project initialized in ${pc__default.default.bold(dir)}`));
-  if (answers.useGit && !fs.existsSync(path4__default.default.join(dir, ".git"))) {
+  if (answers.useGit && !fs.existsSync(path7__default.default.join(dir, ".git"))) {
     try {
       await execa.execa("git", ["init"], { cwd: dir });
       console.log(pc__default.default.green("\u2705 Git repository initialized"));
@@ -3353,64 +4537,641 @@ async function initProject(targetDir, options = {}) {
 \u{1F525} Run "${devCommand}" to start your development server!`)
   );
 }
-async function inspectRoutes(entry) {
-  const entryPath = path4__default.default.resolve(process.cwd(), entry);
-  const tempPath = path4__default.default.resolve(process.cwd(), ".axiomify/inspect.cjs");
-  const userExternals = getUserExternals(process.cwd());
-  try {
-    await esbuild__namespace.build({
-      entryPoints: [entryPath],
-      bundle: true,
-      platform: "node",
-      format: "cjs",
-      outfile: tempPath,
-      external: [.../* @__PURE__ */ new Set([...userExternals, "node:*"])]
-    });
+var RULES = [
+  {
+    id: "meta-to-openapi",
+    description: "`meta:` route field renamed to `openapi:` (OpenAPI 3.0.3 Operation Object terminology)",
+    // Match `meta: {` or `meta:{` after whitespace/comma — avoid matching
+    // unrelated `meta:` fields in other object literals by requiring an
+    // adjacent route-definition cue (method, path, schema, handler nearby).
+    // To stay simple and conservative, only rewrite when the line starts
+    // with optional whitespace + `meta:` (the common formatting).
+    match: /^(\s*)meta:(\s*\{)/gm,
+    replace: "$1openapi:$2"
+  },
+  {
+    id: "useSwagger-import",
+    description: "`useSwagger` import \u2192 `useOpenAPI` (the function was never named `useSwagger` in shipped code \u2014 docs were wrong)",
+    match: /\buseSwagger\b/g,
+    replace: "useOpenAPI"
+  },
+  {
+    id: "routePrefix-option",
+    description: "`routePrefix:` \u2192 `prefix:` on `useOpenAPI()` options",
+    match: /(\buseOpenAPI\s*\([\s\S]*?)\brouteprefix(\s*:)/gi,
+    // Naive: just rename the property when it appears inside a useOpenAPI() call.
+    // The capture-group lookbehind avoids touching unrelated `routePrefix`
+    // properties in other contexts.
+    replace: (_match, before, suffix) => `${before}prefix${suffix}`
+  },
+  {
+    id: "RouteMeta-type",
+    description: "`RouteMeta` type \u2192 `OpenApiOperation` (alias kept through 5.x, removed in 6.0)",
+    // Match `RouteMeta` only as a type position (after `:` or `<` or
+    // `as`) — avoids hitting an unrelated variable named `RouteMeta`.
+    match: /(:\s*|<\s*|\bas\s+)RouteMeta\b/g,
+    replace: "$1OpenApiOperation"
+  },
+  {
+    id: "AppPlugin-type",
+    description: "`AppPlugin` type alias \u2192 `AppConfigurator` (removed in 5.0; runtime accepts 1-arg fns identically)",
+    match: /(:\s*|<\s*|\bas\s+)AppPlugin\b/g,
+    replace: "$1AppConfigurator"
+  }
+];
+async function listSourceFiles(rootAbs) {
+  const out = [];
+  const skip = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", ".axiomify", "coverage"]);
+  const walk = async (dir) => {
+    let entries;
     try {
-      delete __require.cache[__require.resolve(tempPath)];
-    } catch (e) {
+      entries = await fs5__default.default.readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
     }
-    const inspectionTimeout = setTimeout(() => {
-      console.warn(
-        "\n\u26A0\uFE0F  Route inspection is taking longer than expected.\n   Your entry file may be starting a server unconditionally.\n   Wrap the listen() call in `if (require.main === module) { ... }`\n   so it only runs when the file is executed directly.\n"
-      );
-    }, 5e3);
-    inspectionTimeout.unref();
-    const mod = __require(tempPath);
-    const app = mod.app || mod.default;
-    if (!app || typeof app.registeredRoutes === "undefined") {
-      console.error("\u274C Error: Could not find an exported Axiomify instance.");
+    for (const e of entries) {
+      if (e.isDirectory()) {
+        if (skip.has(e.name) || e.name.startsWith(".")) continue;
+        await walk(path7__default.default.join(dir, e.name));
+      } else if (e.isFile()) {
+        const ext = path7__default.default.extname(e.name);
+        if ([".ts", ".tsx", ".js", ".mjs", ".cjs"].includes(ext)) {
+          out.push(path7__default.default.join(dir, e.name));
+        }
+      }
+    }
+  };
+  await walk(rootAbs);
+  return out;
+}
+function applyRules(src) {
+  let updated = src;
+  const counts = {};
+  for (const rule of RULES) {
+    const before = updated;
+    if (typeof rule.replace === "string") {
+      updated = updated.replace(rule.match, rule.replace);
+    } else {
+      updated = updated.replace(rule.match, rule.replace);
+    }
+    if (updated !== before) {
+      const matches = before.match(rule.match);
+      counts[rule.id] = matches ? matches.length : 1;
+    }
+  }
+  return { updated, counts };
+}
+function renderUnifiedDiff(file, original, updated) {
+  if (original === updated) return "";
+  const origLines = original.split("\n");
+  const updatedLines = updated.split("\n");
+  const out = [];
+  out.push(pc__default.default.bold(`--- ${file}`));
+  out.push(pc__default.default.bold(`+++ ${file}`));
+  const max = Math.max(origLines.length, updatedLines.length);
+  for (let i = 0; i < max; i++) {
+    const a = origLines[i];
+    const b = updatedLines[i];
+    if (a === b) continue;
+    if (a !== void 0) out.push(pc__default.default.red("- " + a));
+    if (b !== void 0) out.push(pc__default.default.green("+ " + b));
+  }
+  return out.join("\n");
+}
+async function runMigrate(opts = {}) {
+  const dir = opts.dir ?? "src";
+  const rootAbs = path7__default.default.resolve(process.cwd(), dir);
+  try {
+    const stat = await fs5__default.default.stat(rootAbs);
+    if (!stat.isDirectory()) throw new Error("not a directory");
+  } catch {
+    console.error(
+      pc__default.default.red(`\u2717 ${dir} does not exist or is not a directory.`),
+      `
+  Run from a project root that contains the directory you want to migrate.`
+    );
+    process.exit(1);
+  }
+  const files = await listSourceFiles(rootAbs);
+  if (files.length === 0) {
+    console.log(`${symbols.info} No source files found under ${pc__default.default.cyan(dir)}.`);
+    return;
+  }
+  const results = [];
+  for (const f of files) {
+    const original = await fs5__default.default.readFile(f, "utf8");
+    const { updated, counts } = applyRules(original);
+    if (Object.keys(counts).length > 0) {
+      results.push({ file: f, counts, original, updated });
+    }
+  }
+  console.log();
+  console.log(pc__default.default.bold("  \u{1F504} Axiomify v4 \u2192 v5 migration"));
+  console.log(
+    pc__default.default.dim(
+      `  Scanned ${pluralise(files.length, "file")} under ${path7__default.default.relative(process.cwd(), rootAbs) || "."}/.
+`
+    )
+  );
+  if (results.length === 0) {
+    console.log(`  ${symbols.ok} Nothing to migrate \u2014 looks like you're already on the v5 shape.`);
+    console.log();
+    return;
+  }
+  const totalsByRule = {};
+  for (const r of results) {
+    for (const [rule, n] of Object.entries(r.counts)) {
+      totalsByRule[rule] = (totalsByRule[rule] ?? 0) + n;
+    }
+  }
+  for (const rule of RULES) {
+    const count = totalsByRule[rule.id];
+    if (!count) continue;
+    console.log(
+      `  ${pc__default.default.cyan(rule.id)} ${pc__default.default.dim("\u2014")} ${rule.description}`
+    );
+    console.log(
+      `    ${symbols.bullet} ${pluralise(count, "change")} across ${pluralise(
+        results.filter((r) => r.counts[rule.id]).length,
+        "file"
+      )}`
+    );
+  }
+  console.log();
+  if (opts.reportOnly) {
+    console.log(pc__default.default.dim("  --report-only: no files were modified."));
+    console.log();
+    return;
+  }
+  if (opts.dryRun) {
+    for (const r of results) {
+      const rel = path7__default.default.relative(process.cwd(), r.file);
+      console.log(renderUnifiedDiff(rel, r.original, r.updated));
+      console.log();
+    }
+    console.log(
+      `${symbols.info} ${pluralise(results.length, "file")} would be modified. Re-run without ${pc__default.default.cyan("--dry-run")} to apply.`
+    );
+    console.log();
+    return;
+  }
+  for (const r of results) {
+    await fs5__default.default.writeFile(r.file, r.updated, "utf8");
+    console.log(`  ${symbols.ok} ${pc__default.default.green("Updated")} ${path7__default.default.relative(process.cwd(), r.file)}`);
+  }
+  console.log();
+  console.log(
+    `  ${symbols.ok} ${pluralise(results.length, "file")} migrated, ${pluralise(
+      Object.values(totalsByRule).reduce((a, b) => a + b, 0),
+      "total change"
+    )} applied.`
+  );
+  console.log();
+  console.log(pc__default.default.dim("  Manual review needed for:"));
+  console.log(
+    pc__default.default.dim(
+      `    ${symbols.bullet} Dangling \`AppPlugin\` / \`RouteMeta\` in import statements \u2014 the codemod renames`
+    )
+  );
+  console.log(
+    pc__default.default.dim(
+      `        type USAGES but not the import bindings themselves. TypeScript flags the unused`
+    )
+  );
+  console.log(
+    pc__default.default.dim(
+      `        import; remove it (or run \`tsc --noUnusedLocals\` once and let your editor clean up).`
+    )
+  );
+  console.log(
+    pc__default.default.dim(
+      `    ${symbols.bullet} 5-arg positional \`SerializerFn\` signatures \u2014 the function body needs by-hand updates`
+    )
+  );
+  console.log(
+    pc__default.default.dim(
+      `    ${symbols.bullet} \`new Axiomify()\` callers that relied on automatic \`X-Request-Id\` injection`
+    )
+  );
+  console.log(
+    pc__default.default.dim(
+      `    ${symbols.bullet} JWT secrets \u2014 verify they are \u2265 32 BYTES (not chars) per RFC 7518 \xA73.2`
+    )
+  );
+  console.log();
+  console.log(
+    `  See ${pc__default.default.cyan("docs/migration-v4-to-v5.md")} for the full guide and ` + pc__default.default.cyan("axiomify check") + " to verify the migrated app."
+  );
+  console.log();
+}
+async function jsonToYaml(obj) {
+  const emit = (v, indent) => {
+    const pad2 = "  ".repeat(indent);
+    if (v === null) return "null";
+    if (typeof v === "boolean" || typeof v === "number") return String(v);
+    if (typeof v === "string") {
+      if (/[:#\n\r\t"'{}[\]&*!|>%@`]|^\s|\s$/.test(v) || v === "") {
+        return JSON.stringify(v);
+      }
+      return v;
+    }
+    if (Array.isArray(v)) {
+      if (v.length === 0) return "[]";
+      return v.map((item) => `
+${pad2}- ${emit(item, indent + 1).replace(/^/gm, "  ").trimStart()}`).join("");
+    }
+    if (typeof v === "object") {
+      const keys = Object.keys(v);
+      if (keys.length === 0) return "{}";
+      return keys.map((k) => {
+        const val = v[k];
+        const rendered = emit(val, indent + 1);
+        if (rendered.startsWith("\n")) return `
+${pad2}${k}:${rendered}`;
+        return `
+${pad2}${k}: ${rendered}`;
+      }).join("");
+    }
+    return JSON.stringify(v);
+  };
+  return emit(obj, 0).trimStart();
+}
+async function emitOpenApi(entry, opts = {}) {
+  let app;
+  let cleanup = async () => {
+  };
+  try {
+    const loaded = await loadApp(entry);
+    app = loaded.app;
+    cleanup = loaded.cleanup;
+  } catch (err) {
+    console.error(pc__default.default.red("\u2717 Failed to load app:"));
+    console.error(err.message);
+    process.exit(1);
+  }
+  try {
+    let OpenApiGenerator2;
+    try {
+      ({ OpenApiGenerator: OpenApiGenerator2 } = await Promise.resolve().then(() => (init_dist(), dist_exports)));
+    } catch {
       console.error(
-        "Ensure your entry file exports the app: `export const app = new Axiomify();`"
+        pc__default.default.red("\u2717 @axiomify/openapi is not installed."),
+        "\n  Install it:",
+        pc__default.default.cyan("npm install @axiomify/openapi")
       );
       process.exit(1);
     }
-    console.log("\n\u{1F9ED} Registered Axiomify Routes:");
-    console.log("----------------------------------------------------");
-    console.log(`${"METHOD".padEnd(10)} | ${"PATH".padEnd(30)} | VALIDATION`);
-    console.log("----------------------------------------------------");
-    app.registeredRoutes.forEach((route) => {
-      const schemas = [];
-      if (route.schema?.body) schemas.push("Body");
-      if (route.schema?.query) schemas.push("Query");
-      if (route.schema?.params) schemas.push("Params");
-      if (route.schema?.response) schemas.push("Response");
-      if (route.schema?.files) schemas.push("Files");
-      const validationStr = schemas.length > 0 ? schemas.join(", ") : "None";
+    const info = {
+      title: opts.title ?? "API",
+      version: opts.version ?? "1.0.0"
+    };
+    const generator = new OpenApiGenerator2(app, { info });
+    const spec = generator.generate();
+    if (opts.title) spec.info.title = opts.title;
+    if (opts.version) spec.info.version = opts.version;
+    const format = opts.format ?? "json";
+    const serialised = format === "yaml" ? await jsonToYaml(spec) : opts.minify ? JSON.stringify(spec) : JSON.stringify(spec, null, 2);
+    if (opts.output) {
+      const outPath = path7__default.default.resolve(process.cwd(), opts.output);
+      await fs5__default.default.mkdir(path7__default.default.dirname(outPath), { recursive: true });
+      await fs5__default.default.writeFile(outPath, serialised + "\n", "utf8");
+      const routeCount = (app.registeredRoutes ?? []).length;
       console.log(
-        `${route.method.padEnd(10)} | ${route.path.padEnd(
-          30
-        )} | ${validationStr}`
+        `${pc__default.default.green("\u2713")} OpenAPI spec written to ${pc__default.default.cyan(opts.output)} ` + pc__default.default.dim(`(${routeCount} route${routeCount === 1 ? "" : "s"}, ${format})`)
       );
-    });
-    console.log("----------------------------------------------------\n");
+    } else {
+      process.stdout.write(serialised + "\n");
+    }
   } catch (error) {
-    console.error("\u274C Failed to inspect routes:", error);
+    console.error(pc__default.default.red("\u2717 Failed to generate spec:"), error);
+    process.exit(1);
   } finally {
-    await fs2__default.default.rm(path4__default.default.dirname(tempPath), { recursive: true, force: true }).catch(() => {
+    await cleanup();
+  }
+}
+function normalise(raw, isWs) {
+  const validation = [];
+  if (raw.schema?.body) validation.push("Body");
+  if (raw.schema?.query) validation.push("Query");
+  if (raw.schema?.params) validation.push("Params");
+  if (raw.schema?.response) validation.push("Response");
+  if (raw.schema?.files) validation.push("Files");
+  if (raw.schema?.message) validation.push("Message");
+  const op = raw.openapi ?? {};
+  return {
+    method: isWs ? "WS" : raw.method,
+    path: raw.path,
+    validation,
+    tags: Array.isArray(op.tags) ? op.tags : [],
+    operationId: typeof op.operationId === "string" ? op.operationId : void 0,
+    deprecated: op.deprecated === true,
+    timeout: typeof raw.timeout === "number" && raw.timeout > 0 ? raw.timeout : void 0,
+    plugins: Array.isArray(raw.plugins) ? raw.plugins.length : 0,
+    isWs
+  };
+}
+function matchesFilter(route, opts) {
+  if (opts.method) {
+    const wanted = opts.method.split(",").map((m) => m.trim().toUpperCase()).filter(Boolean);
+    if (wanted.length && !wanted.includes(route.method)) return false;
+  }
+  if (opts.filter) {
+    const pat = opts.filter;
+    if (pat.includes("*")) {
+      const re = new RegExp(
+        "^" + pat.split("*").map((s) => s.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*") + "$"
+      );
+      if (!re.test(route.path)) return false;
+    } else if (!route.path.includes(pat)) {
+      return false;
+    }
+  }
+  return true;
+}
+function sortRoutes(routes, by) {
+  const methodOrder = {
+    GET: 0,
+    POST: 1,
+    PUT: 2,
+    PATCH: 3,
+    DELETE: 4,
+    HEAD: 5,
+    OPTIONS: 6,
+    WS: 7
+  };
+  return [...routes].sort((a, b) => {
+    if (by === "method") {
+      const am = methodOrder[a.method] ?? 99;
+      const bm = methodOrder[b.method] ?? 99;
+      if (am !== bm) return am - bm;
+      return a.path.localeCompare(b.path);
+    }
+    if (a.path !== b.path) return a.path.localeCompare(b.path);
+    return (methodOrder[a.method] ?? 99) - (methodOrder[b.method] ?? 99);
+  });
+}
+async function inspectRoutes(entry, opts = {}) {
+  let app;
+  let cleanup = async () => {
+  };
+  try {
+    const loaded = await loadApp(entry);
+    app = loaded.app;
+    cleanup = loaded.cleanup;
+  } catch (err) {
+    console.error(pc__default.default.red("\u2717 Failed to load app:"));
+    console.error(err.message);
+    process.exit(1);
+  }
+  try {
+    const httpRoutes = (app.registeredRoutes ?? []).map(
+      (r) => normalise(r, false)
+    );
+    const wsRoutes = (app.registeredWsRoutes ?? []).map(
+      (r) => normalise(r, true)
+    );
+    const all = sortRoutes([...httpRoutes, ...wsRoutes], opts.sort ?? "path");
+    const filtered = all.filter((r) => matchesFilter(r, opts));
+    if (opts.json) {
+      process.stdout.write(JSON.stringify(filtered, null, 2) + "\n");
+      return;
+    }
+    if (filtered.length === 0) {
+      console.log(
+        "\n" + symbols.info + pc__default.default.dim(
+          `  No routes match the current filter (${all.length} total registered).
+`
+        )
+      );
+      return;
+    }
+    console.log();
+    console.log(pc__default.default.bold("  \u{1F9ED} Axiomify routes"));
+    console.log();
+    const columns = [
+      { header: "METHOD", minWidth: 7 },
+      { header: "PATH", minWidth: 20, maxWidth: 60 },
+      { header: "VALIDATION", minWidth: 10, maxWidth: 32 },
+      { header: "META", maxWidth: 40 }
+    ];
+    const rows = filtered.map((r) => {
+      const method = colourMethod(r.method);
+      const path11 = r.deprecated ? pc__default.default.strikethrough(r.path) + " " + badge.deprecated() : r.path;
+      const validation = r.validation.length > 0 ? r.validation.map(badge.validation).join(pc__default.default.dim(",")) : pc__default.default.dim("\u2014");
+      const metaBits = [];
+      if (r.operationId) metaBits.push(pc__default.default.dim(`op:`) + r.operationId);
+      if (r.tags.length) metaBits.push(badge.tags(r.tags));
+      if (r.timeout !== void 0) metaBits.push(badge.timeout(r.timeout));
+      if (r.plugins > 0) metaBits.push(pc__default.default.dim(`+${r.plugins} plugin${r.plugins === 1 ? "" : "s"}`));
+      const meta = metaBits.length ? metaBits.join(" ") : pc__default.default.dim("\u2014");
+      return [method, path11, validation, meta];
     });
+    console.log(renderTable(columns, rows));
+    const byMethod = filtered.reduce((acc, r) => {
+      acc[r.method] = (acc[r.method] ?? 0) + 1;
+      return acc;
+    }, {});
+    const summaryParts = Object.entries(byMethod).sort(([a], [b]) => a.localeCompare(b)).map(([m, n]) => `${colourMethod(m).trimEnd()} ${pc__default.default.bold(String(n))}`);
+    console.log();
+    console.log(
+      `  ${symbols.ok} ${pluralise(filtered.length, "route")}` + (filtered.length < all.length ? pc__default.default.dim(` (filtered from ${all.length})`) : "") + "   " + summaryParts.join(pc__default.default.dim(" \xB7 "))
+    );
+    const filteredWs = filtered.filter((r) => r.isWs).length;
+    if (filteredWs > 0) {
+      console.log(
+        pc__default.default.dim(`    \u2514 ${pluralise(filteredWs, "WebSocket route")} included`)
+      );
+    }
+    console.log();
+  } catch (error) {
+    console.error(pc__default.default.red("\u2717 Failed to inspect routes:"), error);
+    process.exit(1);
+  } finally {
+    await cleanup();
   }
 }
+var VALID_METHODS = /* @__PURE__ */ new Set([
+  "GET",
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE",
+  "OPTIONS",
+  "HEAD",
+  "WS"
+]);
+function pathToFilename(routePath) {
+  const cleaned = routePath.split("/").filter(Boolean).map((seg) => seg.startsWith(":") ? `by-${seg.slice(1)}` : seg).join("-");
+  return cleaned || "root";
+}
+function generateRouteSource(method, routePath, opts) {
+  const isWs = method === "WS";
+  const params = routePath.match(/:[a-zA-Z_][a-zA-Z0-9_]*/g) ?? [];
+  const paramKeys = params.map((p) => p.slice(1));
+  const plugins = [];
+  const extraImports = [];
+  if (opts.auth) {
+    plugins.push("requireAuth");
+    extraImports.push(
+      `import { createAuthPlugin } from '@axiomify/auth';
+
+const requireAuth = createAuthPlugin({
+  secret: process.env.JWT_SECRET!,
+});`
+    );
+  }
+  if (opts.rateLimit) {
+    plugins.push("limiter");
+    extraImports.push(
+      `import { createRateLimitPlugin, MemoryStore } from '@axiomify/rate-limit';
+
+// Replace MemoryStore with RedisStore for multi-process / multi-host.
+const limiter = createRateLimitPlugin({
+  windowMs: 60_000,
+  max: 100,
+  store: new MemoryStore(),
+});`
+    );
+  }
+  if (isWs) {
+    return [
+      `import type { Axiomify } from '@axiomify/core';`,
+      `import { z } from 'zod';`,
+      extraImports.length ? extraImports.join("\n\n") + "\n" : "",
+      `/**`,
+      ` * Registers WebSocket route ${routePath}.`,
+      ` * Wire this into your entry file:`,
+      ` *   import { registerRoute } from './routes/${pathToFilename(routePath)}';`,
+      ` *   registerRoute(app);`,
+      ` */`,
+      `export function registerRoute(app: Axiomify): void {`,
+      `  app.ws({`,
+      `    path: '${routePath}',`,
+      paramKeys.length > 0 ? `    schema: {
+      params: z.object({ ${paramKeys.map((k) => `${k}: z.string()`).join(", ")} }),
+      // Define your message shape here \u2014 runtime-validated on every incoming frame.
+      message: z.object({
+        text: z.string(),
+      }),
+    },` : `    schema: {
+      // Define your message shape here \u2014 runtime-validated on every incoming frame.
+      message: z.object({
+        text: z.string(),
+      }),
+    },`,
+      plugins.length > 0 ? `    plugins: [${plugins.join(", ")}],` : "",
+      `    open: (client, _req) => {`,
+      `      client.send({ type: 'welcome' });`,
+      `    },`,
+      `    message: (client, data) => {`,
+      `      // \`data\` is typed and validated from the schema above.`,
+      `      client.send({ echo: data.text });`,
+      `    },`,
+      `    close: (_client, code, reason) => {`,
+      `      console.log('connection closed', code, reason);`,
+      `    },`,
+      `  });`,
+      `}`,
+      ``
+    ].filter(Boolean).join("\n");
+  }
+  return [
+    `import type { Axiomify } from '@axiomify/core';`,
+    `import { z } from 'zod';`,
+    extraImports.length ? extraImports.join("\n\n") + "\n" : "",
+    `/**`,
+    ` * Registers ${method} ${routePath}.`,
+    ` * Wire this into your entry file:`,
+    ` *   import { registerRoute } from './routes/${pathToFilename(routePath)}';`,
+    ` *   registerRoute(app);`,
+    ` */`,
+    `export function registerRoute(app: Axiomify): void {`,
+    `  app.route({`,
+    `    method: '${method}',`,
+    `    path: '${routePath}',`,
+    `    schema: {`,
+    paramKeys.length > 0 ? `      params: z.object({ ${paramKeys.map((k) => `${k}: z.string()`).join(", ")} }),` : "",
+    method === "POST" || method === "PUT" || method === "PATCH" ? `      body: z.object({
+        // TODO \u2014 define request body shape
+      }),` : "",
+    `      // response: z.object({ /* response shape */ }),`,
+    `    },`,
+    `    openapi: {`,
+    `      tags: ['${pathToFilename(routePath).split("-")[0] || "general"}'],`,
+    `      summary: '${method} ${routePath}',`,
+    `    },`,
+    plugins.length > 0 ? `    plugins: [${plugins.join(", ")}],` : "",
+    `    handler: async (${paramKeys.length > 0 || method !== "GET" ? "req" : "_req"}, res) => {`,
+    method === "POST" ? `      // TODO \u2014 handler logic
+      res.status(201).send({ ok: true });` : method === "DELETE" ? `      // TODO \u2014 handler logic
+      res.status(204).send(null);` : `      // TODO \u2014 handler logic
+      res.send({ ok: true });`,
+    `    },`,
+    `  });`,
+    `}`,
+    ``
+  ].filter(Boolean).join("\n");
+}
+async function scaffoldRoute(method, routePath, opts = {}) {
+  const upperMethod = method.toUpperCase();
+  if (!VALID_METHODS.has(upperMethod)) {
+    console.error(
+      pc__default.default.red(`\u2717 Invalid method "${method}".`),
+      `Expected one of: ${[...VALID_METHODS].join(", ")}.`
+    );
+    process.exit(1);
+  }
+  if (!routePath.startsWith("/")) {
+    console.error(
+      pc__default.default.red('\u2717 Path must start with "/".'),
+      `Got: ${routePath}`
+    );
+    process.exit(1);
+  }
+  const dir = opts.dir ?? "src/routes";
+  const filename = pathToFilename(routePath) + ".ts";
+  const fileAbs = path7__default.default.resolve(process.cwd(), dir, filename);
+  const source = generateRouteSource(upperMethod, routePath, opts);
+  if (opts.dryRun) {
+    console.log(pc__default.default.dim(`# would write ${path7__default.default.relative(process.cwd(), fileAbs)}
+`));
+    console.log(source);
+    return;
+  }
+  let exists = false;
+  try {
+    await fs5__default.default.access(fileAbs);
+    exists = true;
+  } catch {
+  }
+  if (exists && !opts.force) {
+    console.log(
+      `${symbols.warn} ${pc__default.default.yellow("Already exists:")} ${path7__default.default.relative(process.cwd(), fileAbs)}
+   Pass ${pc__default.default.cyan("--force")} to overwrite, or pick a different path.`
+    );
+    return;
+  }
+  await fs5__default.default.mkdir(path7__default.default.dirname(fileAbs), { recursive: true });
+  await fs5__default.default.writeFile(fileAbs, source, "utf8");
+  console.log();
+  console.log(
+    `${symbols.ok} ${pc__default.default.green("Created")} ${pc__default.default.cyan(path7__default.default.relative(process.cwd(), fileAbs))}`
+  );
+  console.log();
+  console.log(pc__default.default.dim("  Next steps:"));
+  console.log(
+    `    1. Wire it into your entry file:
+` + pc__default.default.dim(`         import { registerRoute } from './routes/${pathToFilename(routePath)}';
+`) + pc__default.default.dim(`         registerRoute(app);`)
+  );
+  console.log(
+    `    2. Fill in the TODOs in ${pc__default.default.cyan(path7__default.default.relative(process.cwd(), fileAbs))}.`
+  );
+  console.log(
+    `    3. Verify with ${pc__default.default.cyan("npx axiomify routes")} and ${pc__default.default.cyan("npx axiomify check")}.`
+  );
+  console.log();
+}
 
 // src/index.ts
 var program2 = new Command();
@@ -3420,5 +5181,37 @@ program2.command("init").description("Bootstrap a new Axiomify project").argumen
 );
 program2.command("dev").description("Start the development server with hot-reload").argument("[entry]", "Entry file", "src/index.ts").action(devServer);
 program2.command("build").description("Compile the application for production").argument("[entry]", "Entry file", "src/index.ts").action(buildProject);
-program2.command("routes").description("Inspect and list all registered routes in the application").argument("[entry]", "Entry file", "src/index.ts").action(inspectRoutes);
+program2.command("routes").description("Inspect and list all registered HTTP + WebSocket routes").argument("[entry]", "Entry file", "src/index.ts").option("--json", "Emit machine-readable JSON instead of the formatted table", false).option(
+  "-m, --method <list>",
+  "Comma-separated list of methods to include (e.g. GET,POST,WS)"
+).option(
+  "-f, --filter <pattern>",
+  'Path filter \u2014 substring match, or glob with "*" (e.g. /api/v1/*)'
+).option(
+  "-s, --sort <by>",
+  'Sort routes by "method" or "path"',
+  "path"
+).action(
+  (entry, options) => inspectRoutes(entry, options)
+);
+program2.command("openapi").description("Generate the OpenAPI spec from the app and emit it").argument("[entry]", "Entry file", "src/index.ts").option(
+  "-o, --output <file>",
+  "Write the spec to this file path instead of stdout"
+).option("--format <fmt>", 'Output format: "json" (default) or "yaml"', "json").option("--minify", "Minified JSON (single line). Ignored for yaml.", false).option("--title <title>", "Override info.title in the generated spec").option("--spec-version <version>", "Override info.version in the generated spec").action(
+  (entry, options) => emitOpenApi(entry, {
+    ...options,
+    // Map the CLI flag name (`spec-version` → camel `specVersion`) onto
+    // the internal `version` field that emitOpenApi() expects.
+    version: options.specVersion
+  })
+);
+program2.command("check").description("Run a static production-readiness audit against the app").argument("[entry]", "Entry file", "src/index.ts").action(runCheck);
+program2.command("doctor").description("Diagnose the host environment (Node, uWS, ports, dep drift)").action(runDoctor);
+var scaffold = program2.command("scaffold").description("Generate boilerplate (routes, modules, plugins)");
+scaffold.command("route <method> <path>").description("Create a new route file under src/routes/").option("--auth", "Include `requireAuth` plugin and import", false).option("--rate-limit", "Include a default rate-limit plugin", false).option("--dry-run", "Print the generated source without writing", false).option("--force", "Overwrite the file if it already exists", false).option("--dir <dir>", "Directory under cwd to create the file in", "src/routes").action(
+  (method, routePath, options) => scaffoldRoute(method, routePath, options)
+);
+program2.command("migrate").description("v4 \u2192 v5 codemod: rename meta\u2192openapi, useSwagger\u2192useOpenAPI, etc").option("--dry-run", "Show the unified diff without writing", false).option("--report-only", "Print a migration report and exit; do not write", false).option("--dir <dir>", "Directory to scan recursively", "src").action(
+  (options) => runMigrate(options)
+);
 program2.parse(process.argv);