Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Use when building APIs on Hono (Cloudflare Workers, Bun, Deno, Node), debugging route ordering, wiring middleware, validating with @hono/zod-validator, returning streaming responses, configuring CORS with credentials, handling errors via app.onError, or composing typed RPC clients. Triggers: c.env binding types, c.header + c.redirect interaction, missing await next() bugs, Set-Cookie not attaching to redirect, route-precedence surprises, JWT middleware setup, hono/client typed RPC end-to-end. NOT for Express/Fastify/Koa idioms, tRPC/GraphQL paradigms, or Next.js Route Handlers.
metadata
{"category":"Backend & Infrastructure","tags":["hono","cloudflare-workers","bun","edge","middleware","typescript"],"provenance":{"kind":"first-party","owners":["port-daddy"]},"pairs-with":[{"skill":"htmx-progressive-enhancement","reason":"Hono is a natural server for htmx -- routes return HTML fragments and the HX-Request header decides fragment vs full page"},{"skill":"websocket-realtime-expert","reason":"Long-lived WebSocket/SSE connections behind Hono routes need the realtime design (backpressure, reconnect) this skill does not cover"},{"skill":"error-handling-patterns","reason":"app.onError is the framework hook; what a sanitized, typed error taxonomy looks like is the paired skill's domain"}],"io-contract":{"kind":"deliverable","consumes":["[Truncated]","[Truncated]"],"produces":["[Truncated]","[Truncated]"]}}
Hono Patterns
Hono is a small router with a strong middleware model and ergonomic typing. Most surprises come from middleware ordering, deferred header semantics, and the c.env/Variables generic dance.
When to use
Designing an API on Workers, Bun, or Deno where Express would be overkill.
Type-safe end-to-end RPC client (hono/client).
Streaming SSE / NDJSON responses.
A redirect-driven login flow where Set-Cookie must attach to the response.
c.header() registers a deferred header on the context; the final Response (whether from c.json, c.text, or c.redirect) merges those deferred headers. The cookie WILL attach. If a downstream observer says it didn't, the issue is browser-side (SameSite=Strict on a redirect) or upstream (proxy stripping headers), not Hono.
The client mirrors the server type tree exactly. Refactor a route → the client breaks at compile time.
Anti-patterns
Catch-all before specific routes
Symptom: Specific routes return 404 / wrong handler responses.
Diagnosis:app.all('*', …) registered before specific GETs. First match wins.
Fix: Register catch-alls last. Use app.notFound(handler) for 404 instead of a wildcard.
Forgetting await next()
Symptom: Request hangs or returns nothing; logs show middleware ran but handler didn't.
Diagnosis: Middleware returned without awaiting next().
Fix: Always await next() unless you intentionally short-circuit (auth fail, rate limit). Linting rule helps.
c.set without typed Variables
Symptom:c.get('user') returns unknown; downstream code does string casts.
Diagnosis: Variables generic not declared.
Fix: Add Variables to the Hono<{Bindings, Variables}> generic. Now both set and get are typed.
Heavy work in middleware
Symptom: Every endpoint, even health checks, costs 50ms.
Diagnosis: Middleware does DB-loaded user-loading or audit-logging on every path.
Fix: Scope middleware narrowly (app.use('/api/v1/*', loadUser)), or memoize per-request.
SameSite=Strict on a redirect-driven login
Symptom: Browser shows 302 with Set-Cookie; immediate follow-up request to dashboard returns 403.
Diagnosis: Strict drops cookies on cross-context navigation in some browsers, including the auto-followed redirect from the login URL.
Fix:SameSite=Lax for session cookies that ride a redirect.
Returning a raw Response and expecting middleware to mutate it
Symptom: Middleware "after next()" can't read body, can't set headers reliably.
Diagnosis: The middleware mutates c.res, but the handler returned a fresh Response that bypassed it.
Fix: Either use c.res = newResponse; in the handler, or return through c.json/c.text/c.html/c.body.
Quality gates
Every route has a validator (zod) or explicit typed parsing.
Every middleware that intends to continue calls await next().
Bindings and Variables generics declared on the root app.
app.onError returns a sanitized response — no stack leaks.
CORS with credentials: true echoes a typed allowlist of origins, never *.
Streaming endpoints check stream.aborted in any long loop.
Cookie helpers used over raw Set-Cookie unless a specific reason.
Deterministic Audit
Before shipping (or reviewing) a Hono app, write its shape as a JSON plan matching
schemas/hono-patterns-plan.schema.json and run it through the deterministic auditor:
auditHonoPatterns(plan) (in scripts/hono_patterns_audit.mjs) turns this skill's
anti-patterns and Quality Gates into machine-checkable rules over structured fields — no
keyword matching: a middleware that never await next()s (the hanging-request bug), a
catch-all registered before specific routes, unvalidated route inputs, an onError that
leaks internals, credentials: true CORS with a wildcard or blind-echo origin, streaming
loops that never check stream.aborted, SameSite=Strict on a redirect-driven login, and
undeclared Bindings/Variables generics. It returns
{ pass, score, findings, recommendations } and exits 1 on failure.
examples/sample-input.json is a correctly wired app plan (pass: true, zero findings).
See CHANGELOG.md for the bundle's history.
NOT for
Express/Fastify/Koa — different middleware models, different ergonomics.
tRPC/GraphQL — different paradigms; Hono's RPC is REST-flavored.
Next.js Route Handlers — app/api/*/route.ts is a different framework.
Pure node http — Hono's value is the middleware + typing; if you need neither, drop down. No dedicated skill.
Cloudflare Workers platform issues (binding errors, deploy failures, secret upload) — once it's the platform, → cloudflare-workers-debugging.
Webhook signature verification on Hono routes — Hono is the framework, not the protocol. → webhook-receiver-design for HMAC, raw-body, idempotency.