Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
Use when building APIs on Hono (Cloudflare Workers, Bun, Deno, Node), debugging route ordering, wiring middleware, validating with @hono/zod-validator, returning streaming responses, configuring CORS with credentials, handling errors via app.onError, or composing typed RPC clients. Triggers: c.env binding types, c.header + c.redirect interaction, missing await next() bugs, Set-Cookie not attaching to redirect, route-precedence surprises, JWT middleware setup, hono/client typed RPC end-to-end. NOT for Express/Fastify/Koa idioms, tRPC/GraphQL paradigms, or Next.js Route Handlers.
metadata
{"category":"Backend & Infrastructure","tags":["hono","cloudflare-workers","bun","edge","middleware","typescript"],"provenance":{"kind":"first-party","owners":["port-daddy"]},"pairs-with":[{"skill":"htmx-progressive-enhancement","reason":"Hono is a natural server for htmx -- routes return HTML fragments and the HX-Request header decides fragment vs full page"},{"skill":"websocket-realtime-expert","reason":"Long-lived WebSocket/SSE connections behind Hono routes need the realtime design (backpressure, reconnect) this skill does not cover"},{"skill":"error-handling-patterns","reason":"app.onError is the framework hook; what a sanitized, typed error taxonomy looks like is the paired skill's domain"}],"io-contract":{"kind":"deliverable","consumes":["[Truncated]","[Truncated]"],"produces":["[Truncated]","[Truncated]"]}}
Hono Patterns
Hono is a small router with a strong middleware model and ergonomic typing. Most surprises come from middleware ordering, deferred header semantics, and the c.env/Variables generic dance.
When to use
Designing an API on Workers, Bun, or Deno where Express would be overkill.
Type-safe end-to-end RPC client (hono/client).
Streaming SSE / NDJSON responses.
A redirect-driven login flow where Set-Cookie must attach to the response.
c.header() registers a deferred header on the context; the final Response (whether from c.json, c.text, or c.redirect) merges those deferred headers. The cookie WILL attach. If a downstream observer says it didn't, the issue is browser-side (SameSite=Strict on a redirect) or upstream (proxy stripping headers), not Hono.
The client mirrors the server type tree exactly. Refactor a route → the client breaks at compile time.
Anti-patterns
Catch-all before specific routes
Symptom: Specific routes return 404 / wrong handler responses.
Diagnosis:app.all('*', …) registered before specific GETs. First match wins.
Fix: Register catch-alls last. Use app.notFound(handler) for 404 instead of a wildcard.
Forgetting await next()
Symptom: Request hangs or returns nothing; logs show middleware ran but handler didn't.
Diagnosis: Middleware returned without awaiting next().
Fix: Always await next() unless you intentionally short-circuit (auth fail, rate limit). Linting rule helps.
c.set without typed Variables
Symptom:c.get('user') returns unknown; downstream code does string casts.
Diagnosis: Variables generic not declared.
Fix: Add Variables to the Hono<{Bindings, Variables}> generic. Now both set and get are typed.
Heavy work in middleware
Symptom: Every endpoint, even health checks, costs 50ms.
Diagnosis: Middleware does DB-loaded user-loading or audit-logging on every path.
Fix: Scope middleware narrowly (app.use('/api/v1/*', loadUser)), or memoize per-request.
SameSite=Strict on a redirect-driven login
Symptom: Browser shows 302 with Set-Cookie; immediate follow-up request to dashboard returns 403.
Diagnosis: Strict drops cookies on cross-context navigation in some browsers, including the auto-followed redirect from the login URL.
Fix:SameSite=Lax for session cookies that ride a redirect.
Returning a raw Response and expecting middleware to mutate it
Symptom: Middleware "after next()" can't read body, can't set headers reliably.
Diagnosis: The middleware mutates c.res, but the handler returned a fresh Response that bypassed it.
Fix: Either use c.res = newResponse; in the handler, or return through c.json/c.text/c.html/c.body.
Quality gates
Every route has a validator (zod) or explicit typed parsing.
Every middleware that intends to continue calls await next().
Bindings and Variables generics declared on the root app.
app.onError returns a sanitized response — no stack leaks.
CORS with credentials: true echoes a typed allowlist of origins, never *.
Streaming endpoints check stream.aborted in any long loop.
Cookie helpers used over raw Set-Cookie unless a specific reason.
Deterministic Audit
Before shipping (or reviewing) a Hono app, write its shape as a JSON plan matching
schemas/hono-patterns-plan.schema.json and run it through the deterministic auditor:
auditHonoPatterns(plan) (in scripts/hono_patterns_audit.mjs) turns this skill's
anti-patterns and Quality Gates into machine-checkable rules over structured fields — no
keyword matching: a middleware that never await next()s (the hanging-request bug), a
catch-all registered before specific routes, unvalidated route inputs, an onError that
leaks internals, credentials: true CORS with a wildcard or blind-echo origin, streaming
loops that never check stream.aborted, SameSite=Strict on a redirect-driven login, and
undeclared Bindings/Variables generics. It returns
{ pass, score, findings, recommendations } and exits 1 on failure.
examples/sample-input.json is a correctly wired app plan (pass: true, zero findings).
See CHANGELOG.md for the bundle's history.
NOT for
Express/Fastify/Koa — different middleware models, different ergonomics.
tRPC/GraphQL — different paradigms; Hono's RPC is REST-flavored.
Next.js Route Handlers — app/api/*/route.ts is a different framework.
Pure node http — Hono's value is the middleware + typing; if you need neither, drop down. No dedicated skill.
Cloudflare Workers platform issues (binding errors, deploy failures, secret upload) — once it's the platform, → cloudflare-workers-debugging.
Webhook signature verification on Hono routes — Hono is the framework, not the protocol. → webhook-receiver-design for HMAC, raw-body, idempotency.