Hono Framework Guidelines

This skill defines the standards for building ultra-fast web applications using Hono, primarily targeted at edge runtimes like Cloudflare Workers.

1. Core Principles

• Standard Request/Response: Hono is built on Web Standards. Familiarize yourself with standard Request and Response objects.
• Context (c): The Context object is central to Hono. It wraps the request, response, and environment bindings.
• Middleware-First: Prefer composing small, focused middleware over large handler functions.
• RPC (hono/client): Use Hono's RPC feature for end-to-end type safety between backend routes and frontend clients.

2. Environment Variables & Bindings (Cloudflare Workers)

Always strictly type your environment bindings for Cloudflare Workers.

import { Hono } from 'hono'

type Bindings = {
  DB: D1Database
  API_KEY: string
}

const app = new Hono<{ Bindings: Bindings }>()

app.get('/', (c) => {
  const db = c.env.DB
  return c.text('Hello Hono!')
})

3. Middleware Usage

Always use the built-in middleware for common tasks.

• cors() for CORS.
• secureHeaders() for security headers.
• logger() for request logging.

import { cors } from 'hono/cors'
import { secureHeaders } from 'hono/secure-headers'

app.use('*', cors())
app.use('*', secureHeaders())

4. Routing & Validation

Use zodValidator from @hono/zod-validator to validate inputs securely.

import { zValidator } from '@hono/zod-validator'
import { z } from 'zod'

app.post(
  '/post',
  zValidator(
    'json',
    z.object({
      title: z.string(),
      body: z.string(),
    })
  ),
  (c) => {
    const { title, body } = c.req.valid('json')
    return c.json({ title, body })
  }
)

5. Security Gates

• Input Validation: Never trust client input. Always validate using Zod.
• Secrets: Do not hardcode secrets. Always use c.env.
• SQL Injection: When using D1 or SQLite, always use parameterized queries or an ORM like Drizzle. Never concatenate user input into SQL strings.