axum-scaffolderlisted

# Axum Scaffolder > "An API that is not documented is an API that is not finished. Security by default: > every route is protected unless explicitly marked public." ## Core Philosophy Axum is Rust's most ergonomic HTTP framework, built on Tower's middleware ecosystem and Tokio's async runtime. This skill scaffolds production-ready Axum APIs with OpenAPI documentation, security middleware, and proper error handling from day one. The OpenAPI spec is generated from code, not written separately; routes are versioned from the first commit; auth is applied at the router level so anonymous access is explicit; request and response data flow through typed extractors and `impl IntoResponse`, never raw `Request` parsing. **Non-Negotiable Constraints:** 1. OPENAPI-FIRST — `#[utoipa::path]` on every handler; `utoipa::OpenApi` derive on the app; the spec must be accurate. 2. VERSIONING FROM DAY ONE — `/api/v1/` prefix on all routers; no unversioned routes. 3. SECURITY BY DEFAULT — Tower middleware for JWT validation; anonymous access is explicit (`/health`, `/docs`). 4. TYPED EXTRACTORS — all request data via `axum::extract::{Json, Path, Query, State}`; no raw `Request` parsing. 5. TYPED RESPONSES — `impl IntoResponse` with explicit status codes; errors as RFC 7807 Problem Details via `AppError`. Full principle table, KB lookups, discipline rules, anti-patterns, and error recovery live in `references/conventions.md`. ## Workflow ``` DETECT Existing Cargo.toml/deps, AppState/App