blumenjs 0.2.1 → 0.2.2

package/dist/cli/blumen.js

@@ -68,7 +68,7 @@ async function select(question, options) {
     input: process.stdin,
     output: process.stdout
   });
-  return new Promise((resolve3) => {
+  return new Promise((resolve6) => {
     console.log(`
   ${c.bold}${question}${c.reset}`);
     options.forEach((opt, i) => {
@@ -79,9 +79,9 @@ async function select(question, options) {
       rl.close();
       const idx = parseInt(answer, 10) - 1;
       if (idx >= 0 && idx < options.length) {
-        resolve3(options[idx]);
+        resolve6(options[idx]);
       } else {
-        resolve3(options[0]);
+        resolve6(options[0]);
       }
     });
   });
@@ -93,14 +93,14 @@ async function confirm(question, defaultYes = true) {
     output: process.stdout
   });
   const hint = defaultYes ? "Y/n" : "y/N";
-  return new Promise((resolve3) => {
+  return new Promise((resolve6) => {
     rl.question(`  ${c.bold}${question}${c.reset} ${c.dim}(${hint})${c.reset} `, (answer) => {
       rl.close();
       const a = answer.trim().toLowerCase();
       if (a === "")
-        resolve3(defaultYes);
+        resolve6(defaultYes);
       else
-        resolve3(a === "y" || a === "yes");
+        resolve6(a === "y" || a === "yes");
     });
   });
 }
@@ -321,6 +321,39 @@ async function dev() {
 
 // cli/commands/build.ts
 import { execSync as execSync3 } from "child_process";
+import * as fs2 from "fs";
+import * as path2 from "path";
+function generateChunkManifest() {
+  const jsDir = path2.resolve("static/js");
+  const chunksDir = path2.resolve("static/js/chunks");
+  const manifest = {};
+  if (fs2.existsSync(jsDir)) {
+    for (const file of fs2.readdirSync(jsDir)) {
+      if (!file.endsWith(".js") || file.endsWith(".map"))
+        continue;
+      const match = file.match(/^([^.]+)\.[a-f0-9]+\.js$/);
+      if (match) {
+        manifest[match[1]] = `/static/js/${file}`;
+      }
+    }
+  }
+  if (fs2.existsSync(chunksDir)) {
+    for (const file of fs2.readdirSync(chunksDir)) {
+      if (!file.endsWith(".js") || file.endsWith(".map"))
+        continue;
+      const match = file.match(/^([^.]+)\.[a-f0-9]+\.js$/);
+      if (match) {
+        manifest[match[1]] = `/static/js/chunks/${file}`;
+      }
+    }
+  }
+  fs2.mkdirSync("dist", { recursive: true });
+  fs2.writeFileSync("dist/chunk-manifest.json", JSON.stringify(manifest, null, 2));
+  const coreChunks = ["runtime", "vendor", "framework", "main"].filter((k) => manifest[k]);
+  const pageChunks = Object.keys(manifest).filter((k) => k.startsWith("page-"));
+  log.info(`  Core chunks: ${coreChunks.join(", ")} (${coreChunks.length})`);
+  log.info(`  Page chunks: ${pageChunks.length} page(s)`);
+}
 async function build(args = []) {
   banner();
   const analyze = args.includes("--analyze");
@@ -335,10 +368,14 @@ async function build(args = []) {
       cmd: "npx tsx scripts/generate-routes.ts"
     },
     {
-      label: "Building client bundle",
+      label: "Building client bundle (code splitting)",
       cmd: "npx webpack --mode production",
       env: analyze ? { BLUMEN_ANALYZE: "1" } : void 0
     },
+    {
+      label: "Generating chunk manifest",
+      fn: generateChunkManifest
+    },
     {
       label: "Building SSR server",
       cmd: "npx esbuild node-ssr/server.ts --bundle --platform=node --format=esm --outfile=dist/ssr-server.js --packages=external --alias:@=./app"
@@ -355,11 +392,15 @@ async function build(args = []) {
     const step = steps[i];
     log.step(`[${i + 1}/${steps.length}] ${step.label}...`);
     try {
-      execSync3(step.cmd, {
-        stdio: "inherit",
-        cwd: process.cwd(),
-        env: { ...process.env, ...step.env || {} }
-      });
+      if (step.fn) {
+        step.fn();
+      } else if (step.cmd) {
+        execSync3(step.cmd, {
+          stdio: "inherit",
+          cwd: process.cwd(),
+          env: { ...process.env, ...step.env || {} }
+        });
+      }
       log.success(step.label);
     } catch {
       if (step.optional) {
@@ -385,10 +426,10 @@ async function build(args = []) {
 
 // cli/commands/start.ts
 import { spawn as spawn2 } from "child_process";
-import * as fs2 from "fs";
+import * as fs3 from "fs";
 async function start() {
   banner();
-  if (!fs2.existsSync("dist/ssr-server.js")) {
+  if (!fs3.existsSync("dist/ssr-server.js")) {
     log.error("Production build not found.");
     log.info(
       `Run ${c.bold}blumen build${c.reset} first to create a production build.`
@@ -473,23 +514,23 @@ async function start() {
 }
 
 // cli/commands/create.ts
-import * as fs3 from "fs";
-import * as path2 from "path";
+import * as fs4 from "fs";
+import * as path3 from "path";
 import { execSync as execSync4 } from "child_process";
 function getFrameworkRoot() {
-  const cliEntry = fs3.realpathSync(process.argv[1]);
-  const cliDir = path2.dirname(cliEntry);
-  return path2.resolve(cliDir, "..");
+  const cliEntry = fs4.realpathSync(process.argv[1]);
+  const cliDir = path3.dirname(cliEntry);
+  return path3.resolve(cliDir, "..");
 }
 function readProjectFile(relativePath) {
   const root = getFrameworkRoot();
-  const bundledPath = path2.join(root, "templates", relativePath);
-  if (fs3.existsSync(bundledPath)) {
-    return fs3.readFileSync(bundledPath, "utf-8");
+  const bundledPath = path3.join(root, "templates", relativePath);
+  if (fs4.existsSync(bundledPath)) {
+    return fs4.readFileSync(bundledPath, "utf-8");
   }
-  const sourcePath = path2.join(root, relativePath);
-  if (fs3.existsSync(sourcePath)) {
-    return fs3.readFileSync(sourcePath, "utf-8");
+  const sourcePath = path3.join(root, relativePath);
+  if (fs4.existsSync(sourcePath)) {
+    return fs4.readFileSync(sourcePath, "utf-8");
   }
   throw new Error(`Template file not found: ${relativePath}`);
 }
@@ -754,9 +795,9 @@ static/js/bundle.js
 .DS_Store
 `;
 function writeFile(base, relPath, content) {
-  const fullPath = path2.join(base, relPath);
-  fs3.mkdirSync(path2.dirname(fullPath), { recursive: true });
-  fs3.writeFileSync(fullPath, content, "utf-8");
+  const fullPath = path3.join(base, relPath);
+  fs4.mkdirSync(path3.dirname(fullPath), { recursive: true });
+  fs4.writeFileSync(fullPath, content, "utf-8");
 }
 var TEMPLATE_MAP = {
   starter: {
@@ -825,8 +866,8 @@ async function create(projectName) {
     );
     process.exit(1);
   }
-  const projectDir = path2.resolve(process.cwd(), projectName);
-  if (fs3.existsSync(projectDir)) {
+  const projectDir = path3.resolve(process.cwd(), projectName);
+  if (fs4.existsSync(projectDir)) {
     log.error(`Directory ${c.bold}${projectName}${c.reset} already exists.`);
     process.exit(1);
   }
@@ -895,8 +936,8 @@ async function create(projectName) {
 
 // cli/commands/deploy.ts
 import { execSync as execSync5, spawnSync } from "child_process";
-import * as fs4 from "fs";
-import * as path3 from "path";
+import * as fs5 from "fs";
+import * as path4 from "path";
 var PLATFORMS = [
   { name: "Docker (any cloud)", ok: true, note: "Best option \u2014 multi-stage Dockerfile included" },
   { name: "Railway", ok: true, note: "Auto-detects Dockerfile, deploy with railway up" },
@@ -916,7 +957,7 @@ function hasCommand(cmd) {
   }
 }
 function ensureDockerfile() {
-  if (!fs4.existsSync("Dockerfile")) {
+  if (!fs5.existsSync("Dockerfile")) {
     log.error("No Dockerfile found in the current directory.");
     log.info(
       `Run ${c.bold}blumen create${c.reset} to scaffold a project with Docker support.`
@@ -934,7 +975,7 @@ async function deployDocker() {
     );
     process.exit(1);
   }
-  const projectName = path3.basename(process.cwd()).toLowerCase().replace(/[^a-z0-9-]/g, "-");
+  const projectName = path4.basename(process.cwd()).toLowerCase().replace(/[^a-z0-9-]/g, "-");
   const imageName = `blumen-${projectName}`;
   log.step(`Building image: ${c.bold}${imageName}${c.reset}...`);
   divider();
@@ -976,8 +1017,8 @@ async function deployDocker() {
 async function deployFly() {
   log.info("Fly.io Deployment\n");
   ensureDockerfile();
-  const projectName = path3.basename(process.cwd()).toLowerCase().replace(/[^a-z0-9-]/g, "-");
-  if (!fs4.existsSync("fly.toml")) {
+  const projectName = path4.basename(process.cwd()).toLowerCase().replace(/[^a-z0-9-]/g, "-");
+  if (!fs5.existsSync("fly.toml")) {
     log.step("Generating fly.toml...");
     const flyConfig = `# Fly.io configuration for Blumen app
 # Deploy with: fly deploy
@@ -1007,7 +1048,7 @@ primary_region = "iad"
   cpu_kind = "shared"
   cpus = 1
 `;
-    fs4.writeFileSync("fly.toml", flyConfig);
+    fs5.writeFileSync("fly.toml", flyConfig);
     log.success("fly.toml created");
   } else {
     log.info("fly.toml already exists, skipping generation.");
@@ -1048,7 +1089,7 @@ primary_region = "iad"
 async function deployRailway() {
   log.info("Railway Deployment\n");
   ensureDockerfile();
-  if (!fs4.existsSync("railway.toml")) {
+  if (!fs5.existsSync("railway.toml")) {
     log.step("Generating railway.toml...");
     const railwayConfig = `# Railway configuration for Blumen app
 # Deploy with: railway up
@@ -1064,7 +1105,7 @@ async function deployRailway() {
   restartPolicyType = "ON_FAILURE"
   restartPolicyMaxRetries = 5
 `;
-    fs4.writeFileSync("railway.toml", railwayConfig);
+    fs5.writeFileSync("railway.toml", railwayConfig);
     log.success("railway.toml created");
   } else {
     log.info("railway.toml already exists, skipping generation.");
@@ -1159,12 +1200,12 @@ async function deploy(subcommand) {
 }
 
 // cli/commands/fonts.ts
-import * as fs5 from "fs";
-import * as path4 from "path";
+import * as fs6 from "fs";
+import * as path5 from "path";
 import * as https from "https";
-var FONTS_DIR = path4.resolve("static/fonts");
-var FONTS_CSS = path4.resolve("static/css/fonts.css");
-var FONTS_CONFIG = path4.resolve("blumen.fonts.json");
+var FONTS_DIR = path5.resolve("static/fonts");
+var FONTS_CSS = path5.resolve("static/css/fonts.css");
+var FONTS_CONFIG = path5.resolve("blumen.fonts.json");
 var DEFAULT_MANIFEST = {
   fonts: []
 };
@@ -1182,13 +1223,13 @@ var FALLBACK_MAP = {
   "JetBrains Mono": { fallback: "'Courier New', Courier, monospace", sizeAdjust: "103%" }
 };
 function downloadFile(url, dest) {
-  return new Promise((resolve3, reject) => {
-    const file = fs5.createWriteStream(dest);
+  return new Promise((resolve6, reject) => {
+    const file = fs6.createWriteStream(dest);
     https.get(url, { headers: { "User-Agent": "Mozilla/5.0" } }, (response) => {
       if (response.statusCode === 301 || response.statusCode === 302) {
         const redirectUrl = response.headers.location;
         if (redirectUrl) {
-          downloadFile(redirectUrl, dest).then(resolve3).catch(reject);
+          downloadFile(redirectUrl, dest).then(resolve6).catch(reject);
           return;
         }
       }
@@ -1199,17 +1240,17 @@ function downloadFile(url, dest) {
       response.pipe(file);
       file.on("finish", () => {
         file.close();
-        resolve3();
+        resolve6();
       });
     }).on("error", (err) => {
-      fs5.unlink(dest, () => {
+      fs6.unlink(dest, () => {
       });
       reject(err);
     });
   });
 }
 function fetchGoogleFontsCSS(family, weights, subsets) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve6, reject) => {
     const weightStr = weights.join(";");
     const url = `https://fonts.googleapis.com/css2?family=${encodeURIComponent(family)}:wght@${weightStr}&display=swap&subset=${subsets.join(",")}`;
     https.get(url, {
@@ -1222,7 +1263,7 @@ function fetchGoogleFontsCSS(family, weights, subsets) {
       response.on("data", (chunk) => {
         data += chunk.toString();
       });
-      response.on("end", () => resolve3(data));
+      response.on("end", () => resolve6(data));
     }).on("error", reject);
   });
 }
@@ -1292,11 +1333,11 @@ async function processFont(config) {
     const ext = font.format === "woff2" ? "woff2" : "woff";
     const safeName = config.family.replace(/\s+/g, "-").toLowerCase();
     const fileName = `${safeName}-${font.weight}-${font.style}.${ext}`;
-    const filePath = path4.join(FONTS_DIR, fileName);
-    if (!fs5.existsSync(filePath)) {
+    const filePath = path5.join(FONTS_DIR, fileName);
+    if (!fs6.existsSync(filePath)) {
       try {
         await downloadFile(font.url, filePath);
-        const size = fs5.statSync(filePath).size;
+        const size = fs6.statSync(filePath).size;
         console.log(`    Downloaded: ${fileName} (${(size / 1024).toFixed(1)} KB)`);
       } catch (err) {
         console.error(`    Failed to download ${fileName}: ${err}`);
@@ -1317,13 +1358,13 @@ async function processFont(config) {
   return generatedCSS;
 }
 function loadManifest() {
-  if (fs5.existsSync(FONTS_CONFIG)) {
-    return JSON.parse(fs5.readFileSync(FONTS_CONFIG, "utf-8"));
+  if (fs6.existsSync(FONTS_CONFIG)) {
+    return JSON.parse(fs6.readFileSync(FONTS_CONFIG, "utf-8"));
   }
   return { ...DEFAULT_MANIFEST };
 }
 function saveManifest(manifest) {
-  fs5.writeFileSync(FONTS_CONFIG, JSON.stringify(manifest, null, 2), "utf-8");
+  fs6.writeFileSync(FONTS_CONFIG, JSON.stringify(manifest, null, 2), "utf-8");
 }
 async function fontsCommand(args) {
   console.log("\n  \u{1F338} Blumen Font Optimizer\n");
@@ -1365,8 +1406,8 @@ async function fontsCommand(args) {
     console.log('    blumen fonts --add "Roboto"');
     return;
   }
-  fs5.mkdirSync(FONTS_DIR, { recursive: true });
-  fs5.mkdirSync(path4.dirname(FONTS_CSS), { recursive: true });
+  fs6.mkdirSync(FONTS_DIR, { recursive: true });
+  fs6.mkdirSync(path5.dirname(FONTS_CSS), { recursive: true });
   let allCSS = `/* Auto-generated by Blumen Font Optimizer */
 /* Do not edit manually - run 'blumen fonts' to regenerate */
 
@@ -1375,10 +1416,10 @@ async function fontsCommand(args) {
     const css = await processFont(fontConfig);
     allCSS += css + "\n";
   }
-  fs5.writeFileSync(FONTS_CSS, allCSS, "utf-8");
+  fs6.writeFileSync(FONTS_CSS, allCSS, "utf-8");
   console.log(`
-  \u2705 Font CSS written to: ${path4.relative(process.cwd(), FONTS_CSS)}`);
-  console.log(`  \u2705 Font files saved to: ${path4.relative(process.cwd(), FONTS_DIR)}/`);
+  \u2705 Font CSS written to: ${path5.relative(process.cwd(), FONTS_CSS)}`);
+  console.log(`  \u2705 Font files saved to: ${path5.relative(process.cwd(), FONTS_DIR)}/`);
   console.log(`
   To use these fonts, import the CSS in your _app.tsx or _document.tsx:`);
   console.log(`    import '../../static/css/fonts.css';`);
@@ -1388,6 +1429,748 @@ async function fontsCommand(args) {
   console.log();
 }
 
+// cli/commands/audit.ts
+import { execSync as execSync6 } from "child_process";
+function severityColor(severity) {
+  switch (severity) {
+    case "critical":
+      return c.red;
+    case "high":
+      return c.red;
+    case "moderate":
+      return c.yellow;
+    case "low":
+      return c.dim;
+    default:
+      return c.dim;
+  }
+}
+function severityIcon(severity) {
+  switch (severity) {
+    case "critical":
+      return "\u{1F534}";
+    case "high":
+      return "\u{1F7E0}";
+    case "moderate":
+      return "\u{1F7E1}";
+    case "low":
+      return "\u{1F535}";
+    default:
+      return "\u26AA";
+  }
+}
+async function audit(args = []) {
+  banner();
+  const fix = args.includes("--fix");
+  const ci = args.includes("--ci");
+  const jsonOutput = args.includes("--json");
+  if (fix) {
+    log.info("Attempting to fix vulnerabilities...");
+    log.blank();
+    try {
+      execSync6("npm audit fix", {
+        stdio: "inherit",
+        cwd: process.cwd()
+      });
+      log.blank();
+      log.success("Audit fix completed.");
+    } catch {
+      log.warn("Some vulnerabilities could not be fixed automatically.");
+      log.info(`Run ${c.bold}npm audit fix --force${c.reset} to force-fix (may include breaking changes).`);
+    }
+    return;
+  }
+  if (jsonOutput) {
+    try {
+      execSync6("npm audit --json", {
+        stdio: "inherit",
+        cwd: process.cwd()
+      });
+    } catch {
+      process.exit(1);
+    }
+    return;
+  }
+  log.info("Scanning dependencies for known vulnerabilities...");
+  log.blank();
+  let auditOutput;
+  let hasVulnerabilities = false;
+  try {
+    auditOutput = execSync6("npm audit --json 2>/dev/null", {
+      cwd: process.cwd(),
+      encoding: "utf-8"
+    });
+  } catch (err) {
+    auditOutput = err.stdout || "{}";
+    hasVulnerabilities = true;
+  }
+  try {
+    const report = JSON.parse(auditOutput);
+    const meta = report.metadata || {};
+    const vulns = meta.vulnerabilities || {
+      info: 0,
+      low: 0,
+      moderate: 0,
+      high: 0,
+      critical: 0,
+      total: 0
+    };
+    const deps = meta.dependencies || {};
+    const total = vulns.total || vulns.critical + vulns.high + vulns.moderate + vulns.low + (vulns.info || 0);
+    divider();
+    log.blank();
+    if (total === 0) {
+      log.success(`${c.bold}No vulnerabilities found!${c.reset} \u2728`);
+      log.blank();
+      if (deps.total) {
+        log.info(`Scanned ${c.bold}${deps.total}${c.reset} dependencies.`);
+      }
+    } else {
+      log.warn(`${c.bold}${total} vulnerabilit${total === 1 ? "y" : "ies"} found${c.reset}`);
+      log.blank();
+      const levels = [
+        { name: "critical", count: vulns.critical },
+        { name: "high", count: vulns.high },
+        { name: "moderate", count: vulns.moderate },
+        { name: "low", count: vulns.low }
+      ];
+      for (const level of levels) {
+        if (level.count > 0) {
+          const color = severityColor(level.name);
+          const icon = severityIcon(level.name);
+          console.log(`  ${icon}  ${color}${level.count} ${level.name}${c.reset}`);
+        }
+      }
+      log.blank();
+      if (deps.total) {
+        log.info(`Scanned ${c.bold}${deps.total}${c.reset} dependencies.`);
+      }
+      log.info(`Run ${c.bold}blumen audit --fix${c.reset} to attempt automatic fixes.`);
+    }
+    log.blank();
+    divider();
+    log.blank();
+    if (ci && (vulns.critical > 0 || vulns.high > 0)) {
+      log.error("CI check failed: high or critical vulnerabilities detected.");
+      process.exit(1);
+    }
+  } catch {
+    log.info("Detailed report:");
+    log.blank();
+    try {
+      execSync6("npm audit", {
+        stdio: "inherit",
+        cwd: process.cwd()
+      });
+    } catch {
+      if (ci) {
+        process.exit(1);
+      }
+    }
+  }
+}
+
+// cli/commands/test.ts
+import { execSync as execSync7 } from "child_process";
+async function test(args = []) {
+  banner();
+  const watch = args.includes("--watch");
+  const coverage = args.includes("--coverage");
+  const ui = args.includes("--ui");
+  const pattern = args.filter((a) => !a.startsWith("--")).join(" ");
+  let cmd = "npx vitest run";
+  if (watch) {
+    cmd = "npx vitest";
+    log.info("Starting test watcher...");
+  } else if (ui) {
+    cmd = "npx vitest --ui";
+    log.info("Opening Vitest UI...");
+  } else if (coverage) {
+    cmd = "npx vitest run --coverage";
+    log.info("Running tests with coverage...");
+  } else {
+    log.info("Running tests...");
+  }
+  if (pattern) {
+    cmd += ` ${pattern}`;
+  }
+  log.blank();
+  divider();
+  log.blank();
+  try {
+    execSync7(cmd, {
+      stdio: "inherit",
+      cwd: process.cwd(),
+      env: {
+        ...process.env,
+        NODE_ENV: "test"
+      }
+    });
+    log.blank();
+    divider();
+    log.blank();
+    log.success("All tests passed! \u2728");
+    log.blank();
+  } catch (err) {
+    log.blank();
+    divider();
+    log.blank();
+    if (err.status) {
+      log.error(`Tests failed with exit code ${err.status}`);
+      process.exit(err.status);
+    } else {
+      log.error("Test runner encountered an error");
+      process.exit(1);
+    }
+  }
+}
+
+// cli/commands/bench.ts
+import * as http from "http";
+function percentile(sorted, p) {
+  const idx = Math.ceil(p / 100 * sorted.length) - 1;
+  return sorted[Math.max(0, idx)];
+}
+function makeRequest(url) {
+  return new Promise((resolve6, reject) => {
+    const start2 = performance.now();
+    const req = http.get(url, (res) => {
+      let body = "";
+      res.on("data", (chunk) => {
+        body += chunk;
+      });
+      res.on("end", () => {
+        resolve6({
+          latency: performance.now() - start2,
+          status: res.statusCode || 0,
+          cacheHeader: res.headers["x-blumen-cache"] || ""
+        });
+      });
+    });
+    req.on("error", reject);
+    req.setTimeout(1e4, () => {
+      req.destroy();
+      reject(new Error("Timeout"));
+    });
+  });
+}
+async function runBenchmark(url, totalRequests, concurrency) {
+  const latencies = [];
+  let successful = 0;
+  let failed = 0;
+  let cacheHits = 0;
+  let cacheMisses = 0;
+  let streamed = 0;
+  let completed = 0;
+  const start2 = performance.now();
+  for (let i = 0; i < totalRequests; i += concurrency) {
+    const batchSize = Math.min(concurrency, totalRequests - i);
+    const batch = Array.from(
+      { length: batchSize },
+      () => makeRequest(url).then((result) => {
+        latencies.push(result.latency);
+        if (result.status >= 200 && result.status < 400) {
+          successful++;
+        } else {
+          failed++;
+        }
+        if (result.cacheHeader === "HIT" || result.cacheHeader === "STALE")
+          cacheHits++;
+        else if (result.cacheHeader === "MISS")
+          cacheMisses++;
+        else if (result.cacheHeader === "STREAM")
+          streamed++;
+        completed++;
+      }).catch(() => {
+        failed++;
+        completed++;
+      })
+    );
+    await Promise.all(batch);
+    const pct = Math.round(completed / totalRequests * 100);
+    process.stdout.write(`\r  \u25CF  Progress: ${pct}% (${completed}/${totalRequests})`);
+  }
+  process.stdout.write("\r" + " ".repeat(60) + "\r");
+  const totalTimeMs = performance.now() - start2;
+  const sorted = latencies.sort((a, b) => a - b);
+  return {
+    url,
+    totalRequests,
+    successfulRequests: successful,
+    failedRequests: failed,
+    totalTimeMs,
+    requestsPerSec: successful / totalTimeMs * 1e3,
+    latencies: sorted,
+    p50: sorted.length ? percentile(sorted, 50) : 0,
+    p95: sorted.length ? percentile(sorted, 95) : 0,
+    p99: sorted.length ? percentile(sorted, 99) : 0,
+    min: sorted.length ? sorted[0] : 0,
+    max: sorted.length ? sorted[sorted.length - 1] : 0,
+    avg: sorted.length ? sorted.reduce((a, b) => a + b, 0) / sorted.length : 0,
+    cacheHits,
+    cacheMisses,
+    streamed
+  };
+}
+function formatMs(ms) {
+  if (ms < 1)
+    return `${(ms * 1e3).toFixed(0)}\xB5s`;
+  if (ms < 1e3)
+    return `${ms.toFixed(1)}ms`;
+  return `${(ms / 1e3).toFixed(2)}s`;
+}
+function printResult(result) {
+  console.log(`  ${c.bold}URL${c.reset}             ${result.url}`);
+  console.log(`  ${c.bold}Requests${c.reset}        ${result.successfulRequests}/${result.totalRequests} successful${result.failedRequests > 0 ? ` (${result.failedRequests} failed)` : ""}`);
+  console.log(`  ${c.bold}Duration${c.reset}        ${formatMs(result.totalTimeMs)}`);
+  console.log(`  ${c.bold}Throughput${c.reset}      ${c.green}${result.requestsPerSec.toFixed(1)} req/sec${c.reset}`);
+  console.log("");
+  console.log(`  ${c.bold}Latency${c.reset}`);
+  console.log(`    min         ${formatMs(result.min)}`);
+  console.log(`    avg         ${formatMs(result.avg)}`);
+  console.log(`    p50         ${formatMs(result.p50)}`);
+  console.log(`    p95         ${c.yellow}${formatMs(result.p95)}${c.reset}`);
+  console.log(`    p99         ${c.yellow}${formatMs(result.p99)}${c.reset}`);
+  console.log(`    max         ${formatMs(result.max)}`);
+  if (result.cacheHits > 0 || result.cacheMisses > 0 || result.streamed > 0) {
+    console.log("");
+    console.log(`  ${c.bold}Cache${c.reset}`);
+    if (result.cacheHits > 0)
+      console.log(`    HIT         ${result.cacheHits} (${(result.cacheHits / result.totalRequests * 100).toFixed(0)}%)`);
+    if (result.cacheMisses > 0)
+      console.log(`    MISS        ${result.cacheMisses}`);
+    if (result.streamed > 0)
+      console.log(`    STREAM      ${result.streamed}`);
+  }
+}
+async function bench(args = []) {
+  banner();
+  let baseUrl = "http://localhost:3000";
+  let totalRequests = 200;
+  let concurrency = 10;
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === "--url" && args[i + 1]) {
+      baseUrl = args[++i];
+    } else if (args[i] === "--requests" && args[i + 1]) {
+      totalRequests = parseInt(args[++i], 10);
+    } else if (args[i] === "--concurrency" && args[i + 1]) {
+      concurrency = parseInt(args[++i], 10);
+    }
+  }
+  log.info(`Benchmarking ${c.bold}${baseUrl}${c.reset}`);
+  log.info(`${totalRequests} requests, ${concurrency} concurrent connections`);
+  log.blank();
+  divider();
+  const endpoints = [
+    { name: "Homepage (SSR)", path: "/" },
+    { name: "About (SSR)", path: "/about" },
+    { name: "Static Asset", path: "/static/js/runtime.js" }
+  ];
+  for (const endpoint of endpoints) {
+    const url = `${baseUrl}${endpoint.path}`;
+    log.blank();
+    console.log(`  ${c.bold}${c.cyan}\u25B8 ${endpoint.name}${c.reset}`);
+    log.blank();
+    try {
+      const result = await runBenchmark(url, totalRequests, concurrency);
+      printResult(result);
+    } catch (err) {
+      log.error(`  Failed to benchmark ${url}: ${err.message}`);
+      log.info(`  Make sure the server is running (${c.bold}blumen dev${c.reset} or ${c.bold}blumen start${c.reset})`);
+    }
+    log.blank();
+    divider();
+  }
+  log.blank();
+  log.success("Benchmark complete! \u2728");
+  log.blank();
+  log.info(`For production load testing, use k6:`);
+  log.info(`  ${c.bold}k6 run benchmarks/k6-load-test.js${c.reset}`);
+  log.blank();
+}
+
+// cli/commands/export.ts
+import { execSync as execSync8, spawn as spawn3 } from "child_process";
+import * as fs7 from "fs";
+import * as path6 from "path";
+import * as http2 from "http";
+async function renderPage(route, ssrUrl) {
+  const body = JSON.stringify({
+    path: route,
+    query: {},
+    params: {}
+  });
+  return new Promise((resolve6, reject) => {
+    const req = http2.request(ssrUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "Content-Length": Buffer.byteLength(body)
+      }
+    }, (res) => {
+      let data = "";
+      res.on("data", (chunk) => data += chunk);
+      res.on("end", () => {
+        try {
+          const json = JSON.parse(data);
+          if (json.html) {
+            resolve6(json.html);
+          } else {
+            reject(new Error("SSR response missing html field"));
+          }
+        } catch {
+          reject(new Error(`Invalid SSR response: ${data.slice(0, 100)}`));
+        }
+      });
+    });
+    req.on("error", (err) => reject(new Error(`SSR server unreachable: ${err.message}`)));
+    req.setTimeout(15e3, () => {
+      req.destroy();
+      reject(new Error("SSR timeout"));
+    });
+    req.write(body);
+    req.end();
+  });
+}
+function discoverRoutes() {
+  const pagesDir = path6.resolve("app/pages");
+  const routes = [];
+  function scan(dir, prefix) {
+    if (!fs7.existsSync(dir))
+      return;
+    const entries = fs7.readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      if (entry.name.startsWith("_") || entry.name.startsWith("."))
+        continue;
+      if (entry.isDirectory()) {
+        scan(path6.join(dir, entry.name), `${prefix}/${entry.name.toLowerCase()}`);
+      } else if (entry.name.endsWith(".tsx") && !entry.name.startsWith("NotFound")) {
+        const name = entry.name.replace(".tsx", "");
+        if (name.toLowerCase() === "home") {
+          routes.push("/");
+        } else if (name === "index") {
+          routes.push(prefix || "/");
+        } else if (!name.includes("[")) {
+          routes.push(`${prefix}/${name.toLowerCase()}`);
+        }
+      }
+    }
+  }
+  scan(pagesDir, "");
+  return routes;
+}
+async function waitForServer(url, maxWaitMs = 15e3) {
+  const start2 = Date.now();
+  while (Date.now() - start2 < maxWaitMs) {
+    try {
+      await new Promise((resolve6, reject) => {
+        const req = http2.get(url, () => resolve6());
+        req.on("error", reject);
+        req.setTimeout(1e3, () => {
+          req.destroy();
+          reject(new Error("timeout"));
+        });
+      });
+      return true;
+    } catch {
+      await new Promise((r) => setTimeout(r, 500));
+    }
+  }
+  return false;
+}
+async function exportSite(args = []) {
+  banner();
+  let outDir = "dist/export";
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === "--out" && args[i + 1]) {
+      outDir = args[++i];
+    }
+  }
+  log.info("Exporting static site...");
+  log.blank();
+  log.info("Step 1/4: Building production bundle...");
+  try {
+    execSync8("npx tsx cli/blumen.ts build", { stdio: "inherit", cwd: process.cwd() });
+  } catch {
+    log.error("Build failed. Fix errors and try again.");
+    process.exit(1);
+  }
+  log.blank();
+  log.info("Step 2/4: Starting SSR server for pre-rendering...");
+  const ssrProcess = spawn3("node", ["dist/ssr-server.js"], {
+    cwd: process.cwd(),
+    env: { ...process.env, NODE_ENV: "production", PORT: "4001" },
+    stdio: "pipe"
+  });
+  const ssrUrl = "http://localhost:4001/render";
+  const serverReady = await waitForServer("http://localhost:4001/health", 15e3);
+  if (!serverReady) {
+    log.warn("SSR server health check failed, attempting rendering anyway...");
+  }
+  log.blank();
+  log.info("Step 3/4: Pre-rendering pages...");
+  const routes = discoverRoutes();
+  const outputDir = path6.resolve(outDir);
+  fs7.mkdirSync(outputDir, { recursive: true });
+  let success = 0;
+  let failed = 0;
+  for (const route of routes) {
+    try {
+      const html = await renderPage(route, ssrUrl);
+      const filePath = route === "/" ? path6.join(outputDir, "index.html") : path6.join(outputDir, route.slice(1), "index.html");
+      fs7.mkdirSync(path6.dirname(filePath), { recursive: true });
+      fs7.writeFileSync(filePath, html, "utf-8");
+      console.log(`  ${c.green}\u2713${c.reset} ${route} \u2192 ${path6.relative(process.cwd(), filePath)}`);
+      success++;
+    } catch (err) {
+      console.log(`  ${c.red}\u2717${c.reset} ${route}: ${err.message}`);
+      failed++;
+    }
+  }
+  ssrProcess.kill("SIGTERM");
+  log.blank();
+  log.info("Step 4/4: Copying static assets...");
+  const staticDir = path6.resolve("static");
+  if (fs7.existsSync(staticDir)) {
+    copyDir(staticDir, path6.join(outputDir, "static"));
+    log.success("Static assets copied.");
+  }
+  const distJs = path6.resolve("dist/client");
+  if (fs7.existsSync(distJs)) {
+    copyDir(distJs, path6.join(outputDir, "static/js"));
+  }
+  log.blank();
+  divider();
+  log.blank();
+  log.success(`Static export complete! \u2728`);
+  log.info(`${success} page(s) exported${failed > 0 ? `, ${failed} failed` : ""}`);
+  log.info(`Output: ${c.bold}${outDir}/${c.reset}`);
+  log.blank();
+  log.info(`Deploy anywhere:`);
+  log.info(`  ${c.dim}GitHub Pages:${c.reset} push ${outDir}/ to gh-pages branch`);
+  log.info(`  ${c.dim}Netlify:${c.reset}      set publish directory to ${outDir}/`);
+  log.info(`  ${c.dim}S3:${c.reset}           aws s3 sync ${outDir}/ s3://my-bucket`);
+  log.info(`  ${c.dim}Local:${c.reset}        npx serve ${outDir}/`);
+  log.blank();
+}
+function copyDir(src, dest) {
+  fs7.mkdirSync(dest, { recursive: true });
+  const entries = fs7.readdirSync(src, { withFileTypes: true });
+  for (const entry of entries) {
+    const srcPath = path6.join(src, entry.name);
+    const destPath = path6.join(dest, entry.name);
+    if (entry.isDirectory()) {
+      copyDir(srcPath, destPath);
+    } else {
+      fs7.copyFileSync(srcPath, destPath);
+    }
+  }
+}
+
+// cli/commands/migrate.ts
+import * as fs8 from "fs";
+import * as path7 from "path";
+function isNextJsProject(dir) {
+  return fs8.existsSync(path7.join(dir, "next.config.js")) || fs8.existsSync(path7.join(dir, "next.config.mjs")) || fs8.existsSync(path7.join(dir, "next.config.ts")) || fs8.existsSync(path7.join(dir, "pages")) || fs8.existsSync(path7.join(dir, "src/pages"));
+}
+function findPagesDir(dir) {
+  if (fs8.existsSync(path7.join(dir, "pages")))
+    return path7.join(dir, "pages");
+  if (fs8.existsSync(path7.join(dir, "src/pages")))
+    return path7.join(dir, "src/pages");
+  if (fs8.existsSync(path7.join(dir, "app")))
+    return path7.join(dir, "app");
+  return null;
+}
+function getAllTsxFiles(dir) {
+  const results = [];
+  if (!fs8.existsSync(dir))
+    return results;
+  const entries = fs8.readdirSync(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    const fullPath = path7.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      results.push(...getAllTsxFiles(fullPath));
+    } else if (/\.(tsx?|jsx?)$/.test(entry.name)) {
+      results.push(fullPath);
+    }
+  }
+  return results;
+}
+function rewriteImports(content, depth) {
+  const prefix = "../".repeat(depth) || "./";
+  const sharedPrefix = `${prefix}../shared`;
+  content = content.replace(
+    /import\s+(?:Link|{[^}]*})\s+from\s+['"]next\/link['"]/g,
+    `import { Link } from "${sharedPrefix}/Link"`
+  );
+  content = content.replace(
+    /import\s+(?:Head|{[^}]*})\s+from\s+['"]next\/head['"]/g,
+    `import { BlumenHead } from "${sharedPrefix}/BlumenHead"`
+  );
+  content = content.replace(
+    /import\s+(?:Image|{[^}]*})\s+from\s+['"]next\/image['"]/g,
+    `// TODO: Replace next/image with standard <img> or BlumenImage
+// import Image from "next/image"`
+  );
+  content = content.replace(
+    /import\s+(?:{[^}]*})\s+from\s+['"]next\/router['"]/g,
+    `import { useRouter } from "${sharedPrefix}/RouterContext"`
+  );
+  return content;
+}
+function rewriteDataFetching(content) {
+  const changes = [];
+  if (content.includes("getServerSideProps")) {
+    content = content.replace(/getServerSideProps/g, "getServerProps");
+    changes.push("getServerSideProps \u2192 getServerProps");
+  }
+  if (content.includes("getStaticProps") && !content.includes("force-static")) {
+    content += `
+
+// Mark this page for static generation
+export const dynamic = 'force-static';
+`;
+    changes.push("Added export const dynamic = 'force-static'");
+  }
+  content = content.replace(/GetServerSidePropsContext/g, "BlumenContext");
+  if (content.includes("BlumenContext") && !content.includes("import")) {
+    changes.push("GetServerSidePropsContext \u2192 BlumenContext");
+  }
+  return { content, changes };
+}
+async function migrate(args = []) {
+  banner();
+  const dryRun = args.includes("--dry-run");
+  const sourceDir = args.find((a) => !a.startsWith("--")) || ".";
+  const absDir = path7.resolve(sourceDir);
+  log.info(`Analyzing ${c.bold}${absDir}${c.reset} for Next.js project...`);
+  log.blank();
+  if (!isNextJsProject(absDir)) {
+    log.error("No Next.js project detected.");
+    log.info("Expected: next.config.js/mjs/ts or pages/ directory");
+    process.exit(1);
+  }
+  log.success("Next.js project detected!");
+  log.blank();
+  const result = {
+    moved: [],
+    rewritten: [],
+    warnings: [],
+    errors: []
+  };
+  const pagesDir = findPagesDir(absDir);
+  if (!pagesDir) {
+    log.error("Could not find pages/ or src/pages/ directory");
+    process.exit(1);
+  }
+  const isAppRouter = pagesDir.endsWith("/app");
+  if (isAppRouter) {
+    result.warnings.push("Next.js App Router detected. Migration from App Router requires manual review.");
+  }
+  log.info(`Pages directory: ${c.bold}${path7.relative(absDir, pagesDir)}/${c.reset}`);
+  log.blank();
+  divider();
+  log.blank();
+  console.log(`  ${c.bold}${c.cyan}\u25B8 Step 1: Analyzing files${c.reset}`);
+  log.blank();
+  const files = getAllTsxFiles(pagesDir);
+  console.log(`  Found ${files.length} source file(s)`);
+  log.blank();
+  console.log(`  ${c.bold}${c.cyan}\u25B8 Step 2: Rewriting imports${c.reset}`);
+  log.blank();
+  for (const file of files) {
+    const relPath = path7.relative(pagesDir, file);
+    const depth = relPath.split("/").length;
+    let content = fs8.readFileSync(file, "utf-8");
+    let modified = false;
+    const fileChanges = [];
+    const newContent = rewriteImports(content, depth);
+    if (newContent !== content) {
+      content = newContent;
+      modified = true;
+      fileChanges.push("Import rewrites");
+    }
+    const { content: dfContent, changes } = rewriteDataFetching(content);
+    if (changes.length > 0) {
+      content = dfContent;
+      modified = true;
+      fileChanges.push(...changes);
+    }
+    if (modified) {
+      if (!dryRun) {
+        fs8.writeFileSync(file, content, "utf-8");
+      }
+      console.log(`  ${c.green}\u2713${c.reset} ${relPath}: ${fileChanges.join(", ")}`);
+      result.rewritten.push(relPath);
+    }
+  }
+  if (result.rewritten.length === 0) {
+    console.log(`  ${c.dim}No import rewrites needed${c.reset}`);
+  }
+  log.blank();
+  console.log(`  ${c.bold}${c.cyan}\u25B8 Step 3: File structure mapping${c.reset}`);
+  log.blank();
+  const mappings = [
+    ["pages/_app.tsx", "\u2192", "app/shared/_app.tsx"],
+    ["pages/_document.tsx", "\u2192", "app/shared/_document.tsx"],
+    ["pages/index.tsx", "\u2192", "app/pages/Home.tsx"],
+    ["pages/[slug].tsx", "\u2192", "app/pages/[slug].tsx"],
+    ["pages/api/", "\u2192", "app/api/ (Blumen API routes)"],
+    ["public/", "\u2192", "static/"],
+    ["styles/", "\u2192", "app/shared/styles/"]
+  ];
+  for (const [from, arrow, to] of mappings) {
+    console.log(`  ${c.dim}${from}${c.reset} ${arrow} ${c.bold}${to}${c.reset}`);
+  }
+  log.blank();
+  divider();
+  log.blank();
+  console.log(`  ${c.bold}Migration Summary${c.reset}`);
+  log.blank();
+  const summaryTable = [
+    ["Files analyzed", `${files.length}`],
+    ["Imports rewritten", `${result.rewritten.length}`],
+    ["Warnings", `${result.warnings.length}`],
+    ["Mode", dryRun ? "Dry run (no changes)" : "Applied"]
+  ];
+  for (const [label, value] of summaryTable) {
+    console.log(`  ${c.dim}${label}:${c.reset} ${value}`);
+  }
+  log.blank();
+  if (result.warnings.length > 0) {
+    console.log(`  ${c.yellow}${c.bold}Warnings:${c.reset}`);
+    for (const w of result.warnings) {
+      console.log(`  ${c.yellow}\u26A0${c.reset}  ${w}`);
+    }
+    log.blank();
+  }
+  console.log(`  ${c.bold}Next Steps${c.reset}`);
+  log.blank();
+  console.log(`  1. Move your page files to ${c.bold}app/pages/${c.reset}`);
+  console.log(`  2. Move ${c.bold}_app.tsx${c.reset} to ${c.bold}app/shared/_app.tsx${c.reset}`);
+  console.log(`  3. Move ${c.bold}public/${c.reset} to ${c.bold}static/${c.reset}`);
+  console.log(`  4. Replace ${c.bold}next/image${c.reset} usage with standard ${c.bold}<img>${c.reset} or ${c.bold}<BlumenImage>${c.reset}`);
+  console.log(`  5. Run ${c.bold}blumen dev${c.reset} to test`);
+  log.blank();
+  console.log(`  ${c.bold}API Comparison${c.reset}`);
+  log.blank();
+  const comparison = [
+    ["next/link", "Link from shared/Link", "\u2713 Auto-converted"],
+    ["next/head", "BlumenHead", "\u2713 Auto-converted"],
+    ["next/router", "useRouter from RouterContext", "\u2713 Auto-converted"],
+    ["getServerSideProps", "getServerProps", "\u2713 Auto-converted"],
+    ["getStaticProps", "getStaticProps", "\u2713 Same API + force-static"],
+    ["next/image", "<img> or <BlumenImage>", "\u26A0 Manual review"],
+    ["API Routes (pages/api)", "app/api/ handlers", "\u26A0 Manual migration"],
+    ["Middleware", "Go middleware", "\u26A0 Manual migration"]
+  ];
+  for (const [next, blumen, status] of comparison) {
+    console.log(`  ${c.dim}${next.padEnd(25)}${c.reset}\u2192 ${blumen.padEnd(30)} ${status}`);
+  }
+  log.blank();
+}
+
 // cli/blumen.ts
 async function main() {
   const command = process.argv[2];
@@ -1412,6 +2195,21 @@ async function main() {
     console.log(
       `    fonts      Download and optimize fonts`
     );
+    console.log(
+      `    audit      Scan dependencies for vulnerabilities`
+    );
+    console.log(
+      `    test       Run unit and component tests`
+    );
+    console.log(
+      `    bench      Run performance benchmarks`
+    );
+    console.log(
+      `    export     Export as a fully static site`
+    );
+    console.log(
+      `    migrate    Migrate a Next.js project to Blumen`
+    );
     console.log("");
     console.log(`  ${c.bold}Options${c.reset}`);
     console.log(`    --help     Show this help message`);
@@ -1442,6 +2240,21 @@ async function main() {
     case "fonts":
       await fontsCommand(process.argv.slice(3));
       break;
+    case "audit":
+      await audit(process.argv.slice(3));
+      break;
+    case "test":
+      await test(process.argv.slice(3));
+      break;
+    case "bench":
+      await bench(process.argv.slice(3));
+      break;
+    case "export":
+      await exportSite(process.argv.slice(3));
+      break;
+    case "migrate":
+      await migrate(process.argv.slice(3));
+      break;
     default:
       log.error(
         `Unknown command: ${c.bold}${command}${c.reset}`