@lovrozagar/honey 0.1.1 → 0.2.0

package/README.md

@@ -38,6 +38,7 @@ This README is the full usage manual. An agent that reads only this file should
   - [Cloudflare Workers](#cloudflare-workers)
   - [Feature auto-load](#feature-auto-load)
 - [OpenAPI, docs, and manifest](#openapi-docs-and-manifest)
+  - [Meta spec](#meta-spec)
 - [WebSockets](#websockets)
 - [Realtime](#realtime)
 - [SSE and streaming](#sse-and-streaming)
@@ -57,6 +58,7 @@ This README is the full usage manual. An agent that reads only this file should
   - [E2E apps and runtimes](#e2e-apps-and-runtimes)
   - [Live Cloudflare proof](#live-cloudflare-proof)
   - [Bench](#bench)
+- [Releases](#releases)
 - [License](#license)
 
 ## Start
@@ -71,9 +73,9 @@ bun run dev
 import { honey } from "@lovrozagar/honey"
 
 export const app = honey()
-  .get("/health")
-  .handler((ctx) => ctx.res.text("ok", "ok"))
-  .openapi({ docs: "scalar", title: "My API", version: "1.0.0" })
+	.get("/health")
+	.handler((ctx) => ctx.res.text("ok", "ok"))
+	.openapi({ docs: "scalar", title: "My API", version: "1.0.0" })
 
 await app.serve({ cors: true, port: 3000 })
 ```
@@ -144,11 +146,11 @@ bun run dev
 
 That writes:
 
-| File | Role |
-|---|---|
-| `src/app.ts` | App export: health route + `openapi({ docs: "scalar" })` |
-| `src/server.ts` | `await app.serve({ port })` |
-| `vite.config.ts` | `honey({ app: "src/app.ts" })` plugin |
+| File             | Role                                                     |
+| ---------------- | -------------------------------------------------------- |
+| `src/app.ts`     | App export: health route + `openapi({ docs: "scalar" })` |
+| `src/server.ts`  | `await app.serve({ port })`                              |
+| `vite.config.ts` | `honey({ app: "src/app.ts" })` plugin                    |
 
 Scripts added to `package.json`: `dev` (runs `src/server.ts`) and `generate` (`honey generate`).
 
@@ -167,14 +169,14 @@ import { honey } from "@lovrozagar/honey"
 import * as z from "zod"
 
 const app = honey<{ DATABASE_URL: string }>()
-  .basePath("/api")
-  .trailingSlash("strip")
-  .get("/health")
-  .handler((ctx) => ctx.res.json("ok", { status: "ok" }))
-  .post("/users")
-  .input({ json: z.object({ email: z.string().email(), name: z.string() }) })
-  .output({ "application/json": { created: z.object({ id: z.string() }) } })
-  .handler((ctx) => ctx.res.json("created", { id: "u-1" }))
+	.basePath("/api")
+	.trailingSlash("strip")
+	.get("/health")
+	.handler((ctx) => ctx.res.json("ok", { status: "ok" }))
+	.post("/users")
+	.input({ json: z.object({ email: z.string().email(), name: z.string() }) })
+	.output({ "application/json": { created: z.object({ id: z.string() }) } })
+	.handler((ctx) => ctx.res.json("created", { id: "u-1" }))
 
 await app.serve({ env: { DATABASE_URL: process.env.DATABASE_URL! }, port: 3000 })
 ```
@@ -190,9 +192,9 @@ Any other first argument prints usage and exits `1`.
 
 ### `honey init`
 
-| Flag | Meaning |
-|---|---|
-| `--cf` | Also write a Workers entry and `wrangler.jsonc` |
+| Flag      | Meaning                                                                 |
+| --------- | ----------------------------------------------------------------------- |
+| `--cf`    | Also write a Workers entry and `wrangler.jsonc`                         |
 | `--force` | Overwrite `src/app.ts`, `src/server.ts`, `vite.config.ts` if they exist |
 
 ### `honey generate`
@@ -201,38 +203,38 @@ Reads the Vite `honey()` plugin config (default `vite.config.ts`) and writes art
 
 If there is no Vite config, you must pass `--app`.
 
-| Flag | Meaning |
-|---|---|
-| `--watch` | Regenerate when the route tree checksum changes. Ignores `_gen` / `.gen.*`. Requires `--app` or plugin `app`. |
-| `--config <path>` | Vite config to load (default `vite.config.ts`) |
-| `--app <path>` | App module, overrides plugin `app` |
-| `--tree` | Enable writing the generated route tree |
-| `--types` | Enable writing TypeScript route types (needs `ts-morph`) |
-| `--manifest` | Enable writing `manifest.gen.json` |
-| `--sdk` | Enable TypeScript SDK at `src/_gen` (same as `codegen.sdk: true`) |
-| `--cli` | Enable Go CLI; **requires** `--cli-out` and `--cli-binary-name` |
-| `--merge-tree <path>` | Merge this generated tree into the write |
-| `--cli-out <dir>` | Go CLI output directory |
-| `--cli-binary-name <name>` | Binary name |
-| `--cli-config-name <name>` | Optional config file name |
-| `--cli-default-base-url <url>` | Default base URL baked into the CLI |
-| `--cli-env-prefix <prefix>` | Env prefix for CLI config |
-| `--cli-module-path <path>` | Go module path |
-| `--cli-sdk-module-path <path>` | Import an existing Go SDK instead of embedding one |
+| Flag                           | Meaning                                                                                                       |
+| ------------------------------ | ------------------------------------------------------------------------------------------------------------- |
+| `--watch`                      | Regenerate when the route tree checksum changes. Ignores `_gen` / `.gen.*`. Requires `--app` or plugin `app`. |
+| `--config <path>`              | Vite config to load (default `vite.config.ts`)                                                                |
+| `--app <path>`                 | App module, overrides plugin `app`                                                                            |
+| `--tree`                       | Enable writing the generated route tree                                                                       |
+| `--types`                      | Enable writing TypeScript route types (needs `ts-morph`)                                                      |
+| `--manifest`                   | Enable writing `manifest.gen.json`                                                                            |
+| `--sdk`                        | Enable TypeScript SDK at `src/_gen` (same as `codegen.sdk: true`)                                             |
+| `--cli`                        | Enable Go CLI; **requires** `--cli-out` and `--cli-binary-name`                                               |
+| `--merge-tree <path>`          | Merge this generated tree into the write                                                                      |
+| `--cli-out <dir>`              | Go CLI output directory                                                                                       |
+| `--cli-binary-name <name>`     | Binary name                                                                                                   |
+| `--cli-config-name <name>`     | Optional config file name                                                                                     |
+| `--cli-default-base-url <url>` | Default base URL baked into the CLI                                                                           |
+| `--cli-env-prefix <prefix>`    | Env prefix for CLI config                                                                                     |
+| `--cli-module-path <path>`     | Go module path                                                                                                |
+| `--cli-sdk-module-path <path>` | Import an existing Go SDK instead of embedding one                                                            |
 
 CLI boolean flags **turn features on**. They do not turn plugin-configured features off. Plugin config is the source of truth for paths and SDK ports.
 
 Default plugin resolution (when a flag/`true` enables the feature):
 
-| Artifact | Default path | Default on? |
-|---|---|---|
-| Route tree | `src/_gen/routes.gen.ts` | yes (`tree` defaults on) |
-| Types | `src/_gen/types.gen.d.ts` | no |
-| Manifest | `src/_gen/manifest.gen.json` | no |
-| OpenAPI | `src/_gen/openapi.gen.json` (+ YAML sibling) | no, until `codegen.openApi` is set |
-| TS SDK | `src/_gen/sdk.*.gen.ts` | no |
-| Python / Go / Rust SDK | only if `codegen.sdk.ports` is set | no |
-| Go CLI | only if `codegen.cli` object is set | no |
+| Artifact               | Default path                                 | Default on?                        |
+| ---------------------- | -------------------------------------------- | ---------------------------------- |
+| Route tree             | `src/_gen/routes.gen.ts`                     | yes (`tree` defaults on)           |
+| Types                  | `src/_gen/types.gen.d.ts`                    | no                                 |
+| Manifest               | `src/_gen/manifest.gen.json`                 | no                                 |
+| OpenAPI                | `src/_gen/openapi.gen.json` (+ YAML sibling) | no, until `codegen.openApi` is set |
+| TS SDK                 | `src/_gen/sdk.*.gen.ts`                      | no                                 |
+| Python / Go / Rust SDK | only if `codegen.sdk.ports` is set           | no                                 |
+| Go CLI                 | only if `codegen.cli` object is set          | no                                 |
 
 Typical plugin config:
 
@@ -240,28 +242,28 @@ Typical plugin config:
 import { honey } from "@lovrozagar/honey/plugin"
 
 export default {
-  plugins: [
-    honey({
-      app: "src/app.ts",
-      watch: ["src/**/*.ts"],
-      codegen: {
-        tree: true,
-        types: true,
-        manifest: true,
-        openApi: { title: "My API", version: "1.0.0" },
-        sdk: {
-          name: "MySDK",
-          ports: {
-            typescript: { outDir: "src/_gen" },
-            python: { outDir: "sdk/python" },
-            go: { outDir: "sdk/go", modulePath: "example.com/myapi" },
-            rust: { outDir: "sdk/rust", crateName: "myapi" },
-          },
-        },
-        cli: { out: "cli", binaryName: "myapi" },
-      },
-    }),
-  ],
+	plugins: [
+		honey({
+			app: "src/app.ts",
+			watch: ["src/**/*.ts"],
+			codegen: {
+				tree: true,
+				types: true,
+				manifest: true,
+				openApi: { title: "My API", version: "1.0.0" },
+				sdk: {
+					name: "MySDK",
+					ports: {
+						typescript: { outDir: "src/_gen" },
+						python: { outDir: "sdk/python" },
+						go: { outDir: "sdk/go", modulePath: "example.com/myapi" },
+						rust: { outDir: "sdk/rust", crateName: "myapi" },
+					},
+				},
+				cli: { out: "cli", binaryName: "myapi" },
+			},
+		}),
+	],
 }
 ```
 
@@ -289,9 +291,9 @@ app.patch("/items/:id")
 app.delete("/items/:id")
 app.head("/items/:id")
 app.options("/items")
-app.all("/echo")                          // every method
+app.all("/echo") // every method
 app.on("GET", "/health")
-app.on(["GET", "HEAD"], "/resource")     // same handler, extra methods
+app.on(["GET", "HEAD"], "/resource") // same handler, extra methods
 ```
 
 Each verb returns a **route builder**. Chain `.input()`, `.output()`, `.errors()`, `.boundary()`, `.meta()`, then finish with `.handler()` or `.proxy()`. After `.handler()` you are back on the app, so you can keep chaining routes.
@@ -302,14 +304,14 @@ There is no `.head` convenience beyond `.head(path)` itself. Use `.on(["GET", "H
 
 ```ts
 app.get("/orgs/:orgId/members/:memberId").handler((ctx) => {
-  ctx.params.orgId
-  ctx.params.memberId
-  return ctx.res.json("ok", ctx.params)
+	ctx.params.orgId
+	ctx.params.memberId
+	return ctx.res.json("ok", ctx.params)
 })
 
 app.get("/files/*path").handler((ctx) => {
-  // GET /files/a/b/c  →  ctx.params.path === "a/b/c"
-  return ctx.res.json("ok", { path: ctx.params.path })
+	// GET /files/a/b/c  →  ctx.params.path === "a/b/c"
+	return ctx.res.json("ok", { path: ctx.params.path })
 })
 ```
 
@@ -321,19 +323,19 @@ Optional extra validation of params (beyond “it is a string”):
 
 ```ts
 app
-  .get("/orgs/:orgId")
-  .input({ params: z.object({ orgId: z.string().uuid() }) })
-  .handler((ctx) => ctx.res.json("ok", { id: ctx.input.params.orgId }))
+	.get("/orgs/:orgId")
+	.input({ params: z.object({ orgId: z.string().uuid() }) })
+	.handler((ctx) => ctx.res.json("ok", { id: ctx.input.params.orgId }))
 ```
 
 ### Prefixes and slashes
 
 ```ts
-app.basePath("/api")              // every later route is prefixed
-app.trailingSlash("strip")        // 308 /health/ → /health
-app.trailingSlash("enforce")      // 308 /health → /health/
-app.trailingSlash("ignore")       // both match (default)
-app.stripPrefix("/app")           // inbound /app/api/x is matched as /api/x
+app.basePath("/api") // every later route is prefixed
+app.trailingSlash("strip") // 308 /health/ → /health
+app.trailingSlash("enforce") // 308 /health → /health/
+app.trailingSlash("ignore") // both match (default)
+app.stripPrefix("/app") // inbound /app/api/x is matched as /api/x
 ```
 
 - `basePath` only affects routes registered **after** the call, on that chain.
@@ -344,33 +346,36 @@ app.stripPrefix("/app")           // inbound /app/api/x is matched as /api/x
 
 `ctx` is a `HoneyContext`. Fields:
 
-| Field | Meaning |
-|---|---|
-| `ctx.req` | Web `Request` (on Node serve, a Request-shaped wrapper) |
-| `ctx.res` | `HoneyRes` — see [Responses](#responses) |
-| `ctx.env` | Bindings you passed to `fetch` / `serve` |
-| `ctx.params` | Path params (`:id`, `*path`) |
-| `ctx.search` / `ctx.searchAll` | First value / all values of the query string (lazy) |
-| `ctx.headers` / `ctx.cookies` | Lazy records (lowercase cookie names as sent) |
-| `ctx.input` | Validated input when `.input()` is declared |
-| `ctx.errors` | Typed error factory when `.errorFactory()` is set |
-| `ctx.meta` | Merged route + chain `.meta()` |
-| `ctx.path` | Request pathname after `stripPrefix` |
-| `ctx.routePattern` | Registered pattern, e.g. `/users/:id` |
-| `ctx.realtime` | `{ publish(topic, data) }` when realtime routes exist |
-| `ctx.tap(key, payload)` | Queue a tap (only if `.taps()` was declared) |
-| `ctx.background(promise)` | `waitUntil` on Workers, otherwise fire-and-forget |
-| `ctx.executionCtx` | Workers `ExecutionContext` when `fetch` received one |
-| `ctx.log` | Present when `logger({ instance })` middleware ran |
-| `ctx.requestId` | Present when `requestId()` middleware ran |
-| `ctx.timing` | Present when `serverTiming()` middleware ran |
+| Field                          | Meaning                                                 |
+| ------------------------------ | ------------------------------------------------------- |
+| `ctx.req`                      | Web `Request` (on Node serve, a Request-shaped wrapper) |
+| `ctx.res`                      | `HoneyRes` — see [Responses](#responses)                |
+| `ctx.env`                      | Bindings you passed to `fetch` / `serve`                |
+| `ctx.params`                   | Path params (`:id`, `*path`)                            |
+| `ctx.search` / `ctx.searchAll` | First value / all values of the query string (lazy)     |
+| `ctx.headers` / `ctx.cookies`  | Lazy records (lowercase cookie names as sent)           |
+| `ctx.input`                    | Validated input when `.input()` is declared             |
+| `ctx.errors`                   | Typed error factory when `.errorFactory()` is set       |
+| `ctx.meta`                     | Merged route + chain `.meta()`                          |
+| `ctx.path`                     | Request pathname after `stripPrefix`                    |
+| `ctx.routePattern`             | Registered pattern, e.g. `/users/:id`                   |
+| `ctx.realtime`                 | `{ publish(topic, data) }` when realtime routes exist   |
+| `ctx.tap(key, payload)`        | Queue a tap (only if `.taps()` was declared)            |
+| `ctx.background(promise)`      | `waitUntil` on Workers, otherwise fire-and-forget       |
+| `ctx.executionCtx`             | Workers `ExecutionContext` when `fetch` received one    |
+| `ctx.log`                      | Present when `logger({ instance })` middleware ran      |
+| `ctx.requestId`                | Present when `requestId()` middleware ran               |
+| `ctx.timing`                   | Present when `serverTiming()` middleware ran            |
 
 Reserved keys that middleware / `.context()` **cannot** overwrite: `req`, `res`, `env`, `params`, `headers`, `cookies`, `search`, `background`.
 
 ```ts
-app.context({ version: "1.0.0" }).get("/").handler((ctx) => {
-  return ctx.res.json("ok", { version: ctx.version })
-})
+app
+	.context({ version: "1.0.0" })
+	.get("/")
+	.handler((ctx) => {
+		return ctx.res.json("ok", { version: ctx.version })
+	})
 ```
 
 `ctx.res.json("ok", data)` is branded at the type level (`TypedResponse<"application/json", "ok">`) and is a real `Response` on Bun / Workers. On Node `serve()`, known-size bodies skip `new Response()` and write with `writeHead` / `end`.
@@ -381,36 +386,40 @@ Every `ctx.res.*` method takes a **status key** (except `noContent`, `redirect`,
 
 ```ts
 type ResponseOptions = {
-  status?: number                    // override numeric status (redirect only by default)
-  headers?: Record<string, string>
-  cookies?: Record<string, CookieOptions>
+	status?: number // override numeric status (redirect only by default)
+	headers?: Record<string, string>
+	cookies?: Record<string, CookieOptions>
 }
 
 type CookieOptions = {
-  value: string
-  domain?: string
-  expires?: Date
-  httpOnly?: boolean
-  maxAge?: number
-  path?: string
-  sameSite?: "lax" | "none" | "strict"
-  secure?: boolean
+	value: string
+	domain?: string
+	expires?: Date
+	httpOnly?: boolean
+	maxAge?: number
+	path?: string
+	sameSite?: "lax" | "none" | "strict"
+	secure?: boolean
 }
 ```
 
 ```ts
 ctx.res.json("ok", { id: "1" })
-ctx.res.json("created", { id: "1" }, {
-  headers: { "x-request-id": "r1" },
-  cookies: { sid: { value: "abc", httpOnly: true, sameSite: "lax", path: "/" } },
-})
+ctx.res.json(
+	"created",
+	{ id: "1" },
+	{
+		headers: { "x-request-id": "r1" },
+		cookies: { sid: { value: "abc", httpOnly: true, sameSite: "lax", path: "/" } },
+	},
+)
 ctx.res.text("ok", "hello")
 ctx.res.html("ok", "<h1>Hi</h1>")
 ctx.res.csv("ok", "id,name\n1,Ada")
 ctx.res.xml("ok", "<ok/>")
 ctx.res.binary("ok", new Uint8Array([0x48, 0x49]))
 ctx.res.noContent()
-ctx.res.redirect("/elsewhere")                    // 302
+ctx.res.redirect("/elsewhere") // 302
 ctx.res.redirect("/gone", { status: 301 })
 ctx.res.raw(new Response("passthrough"))
 ```
@@ -423,37 +432,37 @@ SSE / stream / generate: see [SSE and streaming](#sse-and-streaming).
 
 `ctx.res.json("created", data)` sets HTTP 201. Use the snake_case key, not the number, except `redirect({ status })`.
 
-| Key | Code | Key | Code |
-|---|---|---|---|
-| `ok` | 200 | `bad_request` | 400 |
-| `created` | 201 | `unauthorized` | 401 |
-| `accepted` | 202 | `payment_required` | 402 |
-| `non_authoritative_information` | 203 | `forbidden` | 403 |
-| `no_content` | 204 | `not_found` | 404 |
-| `reset_content` | 205 | `method_not_allowed` | 405 |
-| `partial_content` | 206 | `not_acceptable` | 406 |
-| `multi_status` | 207 | `proxy_authentication_required` | 407 |
-| `already_reported` | 208 | `request_timeout` | 408 |
-| `im_used` | 226 | `conflict` | 409 |
-| `multiple_choices` | 300 | `gone` | 410 |
-| `moved_permanently` | 301 | `length_required` | 411 |
-| `found` | 302 | `precondition_failed` | 412 |
-| `see_other` | 303 | `content_too_large` | 413 |
-| `not_modified` | 304 | `uri_too_long` | 414 |
-| `temporary_redirect` | 307 | `unsupported_media_type` | 415 |
-| `permanent_redirect` | 308 | `range_not_satisfiable` | 416 |
-| `internal_server_error` | 500 | `expectation_failed` | 417 |
-| `not_implemented` | 501 | `im_a_teapot` | 418 |
-| `bad_gateway` | 502 | `misdirected_request` | 421 |
-| `service_unavailable` | 503 | `unprocessable_entity` | 422 |
-| `gateway_timeout` | 504 | `locked` | 423 |
-| `http_version_not_supported` | 505 | `failed_dependency` | 424 |
-| `variant_also_negotiates` | 506 | `too_early` | 425 |
-| `insufficient_storage` | 507 | `upgrade_required` | 426 |
-| `loop_detected` | 508 | `precondition_required` | 428 |
-| `not_extended` | 510 | `too_many_requests` | 429 |
-| `network_authentication_required` | 511 | `request_header_fields_too_large` | 431 |
-| | | `unavailable_for_legal_reasons` | 451 |
+| Key                               | Code | Key                               | Code |
+| --------------------------------- | ---- | --------------------------------- | ---- |
+| `ok`                              | 200  | `bad_request`                     | 400  |
+| `created`                         | 201  | `unauthorized`                    | 401  |
+| `accepted`                        | 202  | `payment_required`                | 402  |
+| `non_authoritative_information`   | 203  | `forbidden`                       | 403  |
+| `no_content`                      | 204  | `not_found`                       | 404  |
+| `reset_content`                   | 205  | `method_not_allowed`              | 405  |
+| `partial_content`                 | 206  | `not_acceptable`                  | 406  |
+| `multi_status`                    | 207  | `proxy_authentication_required`   | 407  |
+| `already_reported`                | 208  | `request_timeout`                 | 408  |
+| `im_used`                         | 226  | `conflict`                        | 409  |
+| `multiple_choices`                | 300  | `gone`                            | 410  |
+| `moved_permanently`               | 301  | `length_required`                 | 411  |
+| `found`                           | 302  | `precondition_failed`             | 412  |
+| `see_other`                       | 303  | `content_too_large`               | 413  |
+| `not_modified`                    | 304  | `uri_too_long`                    | 414  |
+| `temporary_redirect`              | 307  | `unsupported_media_type`          | 415  |
+| `permanent_redirect`              | 308  | `range_not_satisfiable`           | 416  |
+| `internal_server_error`           | 500  | `expectation_failed`              | 417  |
+| `not_implemented`                 | 501  | `im_a_teapot`                     | 418  |
+| `bad_gateway`                     | 502  | `misdirected_request`             | 421  |
+| `service_unavailable`             | 503  | `unprocessable_entity`            | 422  |
+| `gateway_timeout`                 | 504  | `locked`                          | 423  |
+| `http_version_not_supported`      | 505  | `failed_dependency`               | 424  |
+| `variant_also_negotiates`         | 506  | `too_early`                       | 425  |
+| `insufficient_storage`            | 507  | `upgrade_required`                | 426  |
+| `loop_detected`                   | 508  | `precondition_required`           | 428  |
+| `not_extended`                    | 510  | `too_many_requests`               | 429  |
+| `network_authentication_required` | 511  | `request_header_fields_too_large` | 431  |
+|                                   |      | `unavailable_for_legal_reasons`   | 451  |
 
 `.output()` only accepts **2xx success keys** plus a `redirect` map. Error statuses belong on `.errors()`, not `.output()`.
 
@@ -463,33 +472,31 @@ SSE / stream / generate: see [SSE and streaming](#sse-and-streaming).
 
 ```ts
 app
-  .put("/in/all/:resourceId")
-  .input({
-    json: z.object({ title: z.string() }),
-    search: z.object({ draft: z.coerce.boolean().optional() }),
-    headers: z.object({ "x-request-id": z.string() }),
-    cookies: z.object({ sid: z.string() }),
-    params: z.object({ resourceId: z.string().min(1) }),
-  })
-  .handler((ctx) => {
-    ctx.input.json.title
-    ctx.input.search.draft
-    ctx.input.headers["x-request-id"]
-    ctx.input.cookies.sid
-    ctx.input.params.resourceId
-    return ctx.res.json("ok", { ok: true })
-  })
+	.put("/in/all/:resourceId")
+	.input({
+		json: z.object({ title: z.string() }),
+		search: z.object({ draft: z.coerce.boolean().optional() }),
+		headers: z.object({ "x-request-id": z.string() }),
+		cookies: z.object({ sid: z.string() }),
+		params: z.object({ resourceId: z.string().min(1) }),
+	})
+	.handler((ctx) => {
+		ctx.input.json.title
+		ctx.input.search.draft
+		ctx.input.headers["x-request-id"]
+		ctx.input.cookies.sid
+		ctx.input.params.resourceId
+		return ctx.res.json("ok", { ok: true })
+	})
 ```
 
 Form + file (Zod `z.file()` or equivalent):
 
 ```ts
 app
-  .post("/upload")
-  .input({ form: z.object({ title: z.string(), upload: z.file() }) })
-  .handler((ctx) =>
-    ctx.res.json("ok", { name: ctx.input.form.upload.name, title: ctx.input.form.title }),
-  )
+	.post("/upload")
+	.input({ form: z.object({ title: z.string(), upload: z.file() }) })
+	.handler((ctx) => ctx.res.json("ok", { name: ctx.input.form.upload.name, title: ctx.input.form.title }))
 ```
 
 Leave the body for the handler (no Honey parse):
@@ -498,12 +505,12 @@ Leave the body for the handler (no Honey parse):
 import { readableStream } from "@lovrozagar/honey/input"
 
 app
-  .post("/pipe")
-  .input({ json: readableStream(z.unknown()) })
-  .handler(async (ctx) => {
-    const body = ctx.req.body
-    return ctx.res.json("ok", { piped: body !== null })
-  })
+	.post("/pipe")
+	.input({ json: readableStream(z.unknown()) })
+	.handler(async (ctx) => {
+		const body = ctx.req.body
+		return ctx.res.json("ok", { piped: body !== null })
+	})
 ```
 
 Content-Type selection:
@@ -516,7 +523,10 @@ Valibot / ArkType work the same way — pass any Standard Schema:
 
 ```ts
 import * as v from "valibot"
-app.post("/v").input({ json: v.object({ n: v.number() }) }).handler((ctx) => ctx.res.json("ok", ctx.input.json))
+app
+	.post("/v")
+	.input({ json: v.object({ n: v.number() }) })
+	.handler((ctx) => ctx.res.json("ok", ctx.input.json))
 ```
 
 ### Output
@@ -525,36 +535,36 @@ app.post("/v").input({ json: v.object({ n: v.number() }) }).handler((ctx) => ctx
 
 ```ts
 app
-  .post("/items")
-  .output({
-    "application/json": {
-      created: z.object({ id: z.string() }),
-      ok: z.object({ id: z.string() }),
-    },
-  })
-  .handler((ctx) => ctx.res.json("created", { id: "1" }))
+	.post("/items")
+	.output({
+		"application/json": {
+			created: z.object({ id: z.string() }),
+			ok: z.object({ id: z.string() }),
+		},
+	})
+	.handler((ctx) => ctx.res.json("created", { id: "1" }))
 ```
 
 Declared content types unlock the matching `ctx.res` method at the type level:
 
-| Content type | Method |
-|---|---|
-| `application/json` | `json` |
-| `text/plain` | `text` |
-| `text/html` | `html` |
-| `text/csv` | `csv` |
-| `application/xml` | `xml` |
-| `application/octet-stream` | `binary` |
-| `text/event-stream` | `sse` |
-| `redirect` | `redirect` (map of 3xx keys → `true`) |
+| Content type               | Method                                |
+| -------------------------- | ------------------------------------- |
+| `application/json`         | `json`                                |
+| `text/plain`               | `text`                                |
+| `text/html`                | `html`                                |
+| `text/csv`                 | `csv`                                 |
+| `application/xml`          | `xml`                                 |
+| `application/octet-stream` | `binary`                              |
+| `text/event-stream`        | `sse`                                 |
+| `redirect`                 | `redirect` (map of 3xx keys → `true`) |
 
 Always available: `noContent`, `raw`, `redirect`, `stream`. Also recognized in the map (no dedicated helper): `application/cbor`, `application/msgpack`, `application/pdf`.
 
 ```ts
 app
-  .get("/go")
-  .output({ redirect: { found: true, moved_permanently: true } })
-  .handler((ctx) => ctx.res.redirect("/next"))
+	.get("/go")
+	.output({ redirect: { found: true, moved_permanently: true } })
+	.handler((ctx) => ctx.res.redirect("/next"))
 ```
 
 `.outputValidation("off" | "dev" | "always")` controls runtime checks. `"dev"` (typical) validates when `NODE_ENV !== "production"`. Mismatch is **500** (`output_validation_failed` or `output_content_type_mismatch`).
@@ -569,30 +579,30 @@ app.outputValidation("always")
 import { defineErrors, HoneyError, honey } from "@lovrozagar/honey"
 
 const errors = defineErrors({
-  unauthorized: "unauthorized",
-  org_slug_taken: "conflict",
-  item_not_found: {
-    status: "not_found",
-    schema: z.object({ reason: z.string() }),
-  },
-  api_error: "internal_server_error",
+	unauthorized: "unauthorized",
+	org_slug_taken: "conflict",
+	item_not_found: {
+		status: "not_found",
+		schema: z.object({ reason: z.string() }),
+	},
+	api_error: "internal_server_error",
 })
 
 const app = honey()
-  .errorFactory(errors)
-  .defaultErrors("unauthorized")          // every route may throw these
-  .defaultBoundary("api_error")           // unexpected throws become this key
-  .onError((error, ctx) => {
-    if (error instanceof HoneyError && error.errorKey === "org_slug_taken") {
-      return ctx.jsonFromError(error)
-    }
-    return undefined                      // fall through to default handling
-  })
-  .onNotFound((ctx) => ctx.jsonFromError(errors.item_not_found({ reason: "no route" })))
-  .onMethodNotAllowed((ctx) => {
-    // ctx.allowed is the Allow list
-    return new Response(null, { status: 405, headers: { allow: ctx.allowed.join(", ") } })
-  })
+	.errorFactory(errors)
+	.defaultErrors("unauthorized") // every route may throw these
+	.defaultBoundary("api_error") // unexpected throws become this key
+	.onError((error, ctx) => {
+		if (error instanceof HoneyError && error.errorKey === "org_slug_taken") {
+			return ctx.jsonFromError(error)
+		}
+		return undefined // fall through to default handling
+	})
+	.onNotFound((ctx) => ctx.jsonFromError(errors.item_not_found({ reason: "no route" })))
+	.onMethodNotAllowed((ctx) => {
+		// ctx.allowed is the Allow list
+		return new Response(null, { status: 405, headers: { allow: ctx.allowed.join(", ") } })
+	})
 ```
 
 Throw from a handler:
@@ -601,8 +611,8 @@ Throw from a handler:
 throw ctx.errors.org_slug_taken({ vars: { slug: "acme" } })
 throw ctx.errors.item_not_found({ reason: "deleted" })
 throw ctx.errors.unauthorized({
-  fields: { token: [{ error_key: "required", message: "missing", path: "token" }] },
-  headers: { "www-authenticate": "Bearer" },
+	fields: { token: [{ error_key: "required", message: "missing", path: "token" }] },
+	headers: { "www-authenticate": "Bearer" },
 })
 ```
 
@@ -610,13 +620,13 @@ Standard error JSON:
 
 ```json
 {
-  "error_key": "org_slug_taken",
-  "status": 409,
-  "status_key": "conflict",
-  "message": "org_slug_taken",
-  "success": false,
-  "fields": {},
-  "vars": { "slug": "acme" }
+	"error_key": "org_slug_taken",
+	"status": 409,
+	"status_key": "conflict",
+	"message": "org_slug_taken",
+	"success": false,
+	"fields": {},
+	"vars": { "slug": "acme" }
 }
 ```
 
@@ -626,12 +636,12 @@ Per-route:
 
 ```ts
 app
-  .post("/orgs")
-  .errors("org_slug_taken", "unauthorized")
-  .boundary("api_error")                  // this route's unexpected-throw key
-  .handler((ctx) => {
-    throw ctx.errors.org_slug_taken({ vars: { slug: "x" } })
-  })
+	.post("/orgs")
+	.errors("org_slug_taken", "unauthorized")
+	.boundary("api_error") // this route's unexpected-throw key
+	.handler((ctx) => {
+		throw ctx.errors.org_slug_taken({ vars: { slug: "x" } })
+	})
 ```
 
 `.errors(factory, ...keys)` also accepts the factory object as the first argument (kitchen style). Undeclared `HoneyError` keys fail the boundary check and become the boundary error.
@@ -640,14 +650,14 @@ Formatters:
 
 ```ts
 app.defaultErrorFormatter((error, defaultShape) => ({
-  ...defaultShape,
-  request_id: "r1",
+	...defaultShape,
+	request_id: "r1",
 }))
 
-app.defaultErrorFormatter(
-  z.object({ error_key: z.string(), status: z.number() }),
-  (error) => ({ error_key: error.errorKey, status: error.status }),
-)
+app.defaultErrorFormatter(z.object({ error_key: z.string(), status: z.number() }), (error) => ({
+	error_key: error.errorKey,
+	status: error.status,
+}))
 
 app.customErrorFormatter((error, data) => ({ ...data, error_key: error.errorKey }))
 ```
@@ -658,17 +668,17 @@ i18n (loads `@lovrozagar/honey/i18n` when called):
 import "@lovrozagar/honey/i18n"
 
 app.errorI18n({
-  errors: {
-    en: { org_slug_taken: "Slug {slug} is taken", unauthorized: "Sign in" },
-    de: { org_slug_taken: "Name {slug} ist vergeben", unauthorized: "Anmeldung nötig" },
-  },
-  fieldNames: {
-    en: { email: "Email" },
-  },
-  resolveLocale: (ctx) => {
-    const accept = ctx.req.headers.get("accept-language")
-    return accept?.startsWith("de") ? "de" : "en"
-  },
+	errors: {
+		en: { org_slug_taken: "Slug {slug} is taken", unauthorized: "Sign in" },
+		de: { org_slug_taken: "Name {slug} ist vergeben", unauthorized: "Anmeldung nötig" },
+	},
+	fieldNames: {
+		en: { email: "Email" },
+	},
+	resolveLocale: (ctx) => {
+		const accept = ctx.req.headers.get("accept-language")
+		return accept?.startsWith("de") ? "de" : "en"
+	},
 })
 ```
 
@@ -684,13 +694,13 @@ Framework-owned keys you do not declare: `validation_failed` (400), `output_vali
 import { createMiddleware } from "@lovrozagar/honey"
 
 const withAuth = createMiddleware(async (ctx, next) => {
-  const token = ctx.req.headers.get("authorization")
-  if (!token) throw ctx.errors.unauthorized()
-  return next({ user: { id: "u-1" } })
+	const token = ctx.req.headers.get("authorization")
+	if (!token) throw ctx.errors.unauthorized()
+	return next({ user: { id: "u-1" } })
 })
 
-app.use(withAuth)                 // global on this chain
-app.use("/admin", withAuth)       // prefix-scoped; additions only exist under /admin
+app.use(withAuth) // global on this chain
+app.use("/admin", withAuth) // prefix-scoped; additions only exist under /admin
 ```
 
 `createMiddleware` infers additions from `next({ ... })`. Later handlers see `ctx.user`. Return `next()` with no argument to add nothing.
@@ -707,14 +717,16 @@ Import each from its path. Do **not** `import { cors } from "@lovrozagar/honey"`
 import { cors } from "@lovrozagar/honey/cors"
 
 app.use(cors())
-app.use(cors({
-  origin: "https://app.example.com",          // or "*" | string[] | (origin) => boolean
-  credentials: true,                          // wildcard origin is echoed (spec-safe)
-  methods: ["GET", "POST"],
-  headers: ["authorization", "content-type"],
-  exposeHeaders: ["x-request-id"],
-  maxAge: 86400,
-}))
+app.use(
+	cors({
+		origin: "https://app.example.com", // or "*" | string[] | (origin) => boolean
+		credentials: true, // wildcard origin is echoed (spec-safe)
+		methods: ["GET", "POST"],
+		headers: ["authorization", "content-type"],
+		exposeHeaders: ["x-request-id"],
+		maxAge: 86400,
+	}),
+)
 ```
 
 No `Origin` header → middleware is a no-op. Preflight is `OPTIONS` + `access-control-request-method`. `app.serve({ cors: true })` is `cors()` with defaults. `app.serve({ cors: { origin } })` passes the object through.
@@ -734,11 +746,13 @@ Safe methods (`GET`/`HEAD`/`OPTIONS`) pass. Non-form JSON also passes. Form post
 ```ts
 import { bodyLimit } from "@lovrozagar/honey/body-limit"
 
-app.use(bodyLimit({
-  maxSize: 1_048_576,
-  limits: { "application/json": 64_000, "multipart/": 10_485_760 },
-  trustContentLength: false,     // default; true skips counting when Content-Length is in range
-}))
+app.use(
+	bodyLimit({
+		maxSize: 1_048_576,
+		limits: { "application/json": 64_000, "multipart/": 10_485_760 },
+		trustContentLength: false, // default; true skips counting when Content-Length is in range
+	}),
+)
 ```
 
 Skipped for GET/HEAD/OPTIONS/DELETE. Oversize is **413** `content_too_large`. `limits` keys are matched with `startsWith` against `Content-Type`.
@@ -749,19 +763,22 @@ Skipped for GET/HEAD/OPTIONS/DELETE. Oversize is **413** `content_too_large`. `l
 import { createLogger, logger } from "@lovrozagar/honey/logger"
 
 const log = createLogger({
-  level: "info",                 // trace | debug | info | warn | error | fatal
-  base: { service: "api" },
-  write: (line) => console.log(line),
+	level: "info", // trace | debug | info | warn | error | fatal
+	base: { service: "api" },
+	write: (line) => console.log(line),
 })
 
 app.use(logger())
-app.use(logger({
-  instance: log,                 // pino-shaped; sets ctx.log
-  skip: (data) => data.path === "/health",
-  log: (data) => {               // used when instance is omitted
-    console.log(`${data.method} ${data.path} ${data.status} ${data.duration}ms`)
-  },
-}))
+app.use(
+	logger({
+		instance: log, // pino-shaped; sets ctx.log
+		skip: (data) => data.path === "/health",
+		log: (data) => {
+			// used when instance is omitted
+			console.log(`${data.method} ${data.path} ${data.status} ${data.duration}ms`)
+		},
+	}),
+)
 ```
 
 `createLogger` writes one JSON line per call (`level`, `msg`, `time`, plus `base`). `ctx.log.info("hello")` / `ctx.log.info({ k: 1 }, "hello")`.
@@ -771,12 +788,14 @@ app.use(logger({
 ```ts
 import { curlLogger } from "@lovrozagar/honey/curl-logger"
 
-app.use(curlLogger({
-  body: { maxBytes: 2048, allowContentTypes: ["application/json"] },
-  redactHeader: (name, value) => (name === "authorization" ? "Bearer ***" : value),
-  redactQueryParam: (name, value) => (name === "token" ? "***" : value),
-  skip: (data) => data.path === "/health",
-}))
+app.use(
+	curlLogger({
+		body: { maxBytes: 2048, allowContentTypes: ["application/json"] },
+		redactHeader: (name, value) => (name === "authorization" ? "Bearer ***" : value),
+		redactQueryParam: (name, value) => (name === "token" ? "***" : value),
+		skip: (data) => data.path === "/health",
+	}),
+)
 ```
 
 #### `request-id` — `@lovrozagar/honey/request-id`
@@ -795,7 +814,7 @@ Adds `ctx.requestId` and echoes the header on the response. Reuses the inbound h
 ```ts
 import { etag } from "@lovrozagar/honey/etag"
 
-app.use(etag())            // weak ETag (default)
+app.use(etag()) // weak ETag (default)
 app.use(etag({ weak: false }))
 ```
 
@@ -817,18 +836,20 @@ Slow handlers reject with **504** `request_timeout`.
 import { secureHeaders } from "@lovrozagar/honey/secure-headers"
 
 app.use(secureHeaders())
-app.use(secureHeaders({
-  contentSecurityPolicy: "default-src 'self'",
-  strictTransportSecurity: "max-age=63072000; includeSubDomains",
-  permissionsPolicy: "camera=()",
-  referrerPolicy: "strict-origin-when-cross-origin",  // or false to omit
-  xContentTypeOptions: "nosniff",                     // or false
-  xFrameOptions: "SAMEORIGIN",
-  xXssProtection: "0",
-  crossOriginOpenerPolicy: "same-origin",
-  crossOriginEmbedderPolicy: "require-corp",
-  crossOriginResourcePolicy: "same-site",
-}))
+app.use(
+	secureHeaders({
+		contentSecurityPolicy: "default-src 'self'",
+		strictTransportSecurity: "max-age=63072000; includeSubDomains",
+		permissionsPolicy: "camera=()",
+		referrerPolicy: "strict-origin-when-cross-origin", // or false to omit
+		xContentTypeOptions: "nosniff", // or false
+		xFrameOptions: "SAMEORIGIN",
+		xXssProtection: "0",
+		crossOriginOpenerPolicy: "same-origin",
+		crossOriginEmbedderPolicy: "require-corp",
+		crossOriginResourcePolicy: "same-site",
+	}),
+)
 ```
 
 Defaults when omitted: `x-content-type-options: nosniff`, `x-frame-options: SAMEORIGIN`, `referrer-policy: strict-origin-when-cross-origin`, `x-xss-protection: 0`.
@@ -840,9 +861,9 @@ import { serverTiming } from "@lovrozagar/honey/server-timing"
 
 app.use(serverTiming())
 app.get("/work").handler((ctx) => {
-  ctx.timing.start("db", "query")
-  ctx.timing.end("db")
-  return ctx.res.json("ok", {})
+	ctx.timing.start("db", "query")
+	ctx.timing.end("db")
+	return ctx.res.json("ok", {})
 })
 ```
 
@@ -851,12 +872,14 @@ app.get("/work").handler((ctx) => {
 ```ts
 import { ipRestrict } from "@lovrozagar/honey/ip-restrict"
 
-app.use(ipRestrict({
-  allowList: ["127.0.0.1", "10.0.0.0/8"],
-  denyList: ["192.168.1.50"],
-  trustProxy: false,             // true: X-Forwarded-For / X-Real-IP after CF
-  getIp: (req) => req.headers.get("cf-connecting-ip"),
-}))
+app.use(
+	ipRestrict({
+		allowList: ["127.0.0.1", "10.0.0.0/8"],
+		denyList: ["192.168.1.50"],
+		trustProxy: false, // true: X-Forwarded-For / X-Real-IP after CF
+		getIp: (req) => req.headers.get("cf-connecting-ip"),
+	}),
+)
 ```
 
 Default IP: `cf-connecting-ip` only. Denied / not-allowed is **403**.
@@ -866,7 +889,7 @@ Default IP: `cf-connecting-ip` only. Denied / not-allowed is **403**.
 ```ts
 import { poweredBy } from "@lovrozagar/honey/powered-by"
 
-app.use(poweredBy())                 // x-powered-by: Honey
+app.use(poweredBy()) // x-powered-by: Honey
 app.use(poweredBy({ name: "api" }))
 ```
 
@@ -875,7 +898,7 @@ app.use(poweredBy({ name: "api" }))
 ```ts
 import { prettyJson } from "@lovrozagar/honey/pretty-json"
 
-app.use(prettyJson())                          // ?pretty=
+app.use(prettyJson()) // ?pretty=
 app.use(prettyJson({ query: "pretty", space: 2 }))
 ```
 
@@ -885,11 +908,11 @@ Only rewrites `application/json` when the query string contains the key.
 
 ```ts
 const users = honey()
-  .basePath("/users")
-  .get("/:id")
-  .handler((ctx) => ctx.res.json("ok", { id: ctx.params.id }))
+	.basePath("/users")
+	.get("/:id")
+	.handler((ctx) => ctx.res.json("ok", { id: ctx.params.id }))
 
-const app = honey().route(users)     // merges routes, realtime, taps, static map
+const app = honey().route(users) // merges routes, realtime, taps, static map
 ```
 
 `.route(sub)` copies the sub-app's tree into this one. Duplicate paths throw.
@@ -900,18 +923,20 @@ Taps run **after** a successful handler. They do not run on thrown errors.
 
 ```ts
 const app = honey()
-  .taps<{ audit: { action: string } }>()
-  .tap("audit", (ctx, payload) => {
-    ctx.background(fetch("https://logs.example.com", {
-      method: "POST",
-      body: JSON.stringify({ path: ctx.req.url, ...payload }),
-    }))
-  })
-  .post("/items")
-  .handler((ctx) => {
-    ctx.tap("audit", { action: "create" })
-    return ctx.res.json("created", { id: "1" })
-  })
+	.taps<{ audit: { action: string } }>()
+	.tap("audit", (ctx, payload) => {
+		ctx.background(
+			fetch("https://logs.example.com", {
+				method: "POST",
+				body: JSON.stringify({ path: ctx.req.url, ...payload }),
+			}),
+		)
+	})
+	.post("/items")
+	.handler((ctx) => {
+		ctx.tap("audit", { action: "create" })
+		return ctx.res.json("created", { id: "1" })
+	})
 ```
 
 ### Proxy routes
@@ -919,18 +944,16 @@ const app = honey()
 Finish a route with `.proxy()` instead of `.handler()`:
 
 ```ts
-app
-  .all("/upstream/*path")
-  .proxy({
-    destination: (ctx, url, init) => fetch(`https://api.internal${url}`, init),
-    rewriteUrl: (url) => url.replace(/^\/upstream/, ""),
-    requestHeaders: { "x-forwarded-by": "honey" },
-    // or requestHeaders: (ctx, headers) => { headers.set("x-user", ctx.user.id) }
-    timeout: 10_000,                 // or (ctx) => 5_000; default 30_000; disabled for WS upgrades
-    onResponse: (ctx, response) => {
-      response.headers.set("x-proxied", "1")
-    },
-  })
+app.all("/upstream/*path").proxy({
+	destination: (ctx, url, init) => fetch(`https://api.internal${url}`, init),
+	rewriteUrl: (url) => url.replace(/^\/upstream/, ""),
+	requestHeaders: { "x-forwarded-by": "honey" },
+	// or requestHeaders: (ctx, headers) => { headers.set("x-user", ctx.user.id) }
+	timeout: 10_000, // or (ctx) => 5_000; default 30_000; disabled for WS upgrades
+	onResponse: (ctx, response) => {
+		response.headers.set("x-proxied", "1")
+	},
+})
 ```
 
 `destination` receives path + query (after `rewriteUrl`) and a prepared `RequestInit` (method, headers, body, signal, redirect). Hop-by-hop headers are stripped. `onResponse` is not called for 101 upgrades.
@@ -940,17 +963,19 @@ app
 ```ts
 import { staticFiles } from "@lovrozagar/honey/static"
 
-app.use(staticFiles({
-  prefix: "/assets",
-  resolve: async (_ctx, filePath) => {
-    const file = Bun.file(`./public${filePath}`)
-    if (!(await file.exists())) return null
-    return new Response(file)
-  },
-  headers: { "cache-control": "public, max-age=3600" },
-  // or headers: (filePath) => ({ "content-type": mime(filePath) })
-  rewritePath: (filePath) => (filePath === "/" ? "/index.html" : filePath),
-}))
+app.use(
+	staticFiles({
+		prefix: "/assets",
+		resolve: async (_ctx, filePath) => {
+			const file = Bun.file(`./public${filePath}`)
+			if (!(await file.exists())) return null
+			return new Response(file)
+		},
+		headers: { "cache-control": "public, max-age=3600" },
+		// or headers: (filePath) => ({ "content-type": mime(filePath) })
+		rewritePath: (filePath) => (filePath === "/" ? "/index.html" : filePath),
+	}),
+)
 ```
 
 GET/HEAD only. `..` segments are rejected. `resolve` returning `null` falls through to the next route.
@@ -971,14 +996,14 @@ import { otelAdapter } from "@lovrozagar/honey/telemetry/otel"
 app.telemetry(otelAdapter({ tracer }))
 // or a hand-rolled adapter:
 app.telemetry({
-  onRequest: ({ req }) => {},
-  onRoute: ({ method, path, params }) => {},
-  onHandler: ({ status, duration }) => {},
-  onResponse: ({ status, duration }) => {},
-  onError: ({ error, duration }) => {},
-  onMiddleware: ({ name, duration, error }) => {},
-  onNotFound: ({ method, path }) => {},
-  onMethodNotAllowed: ({ allowed }) => {},
+	onRequest: ({ req }) => {},
+	onRoute: ({ method, path, params }) => {},
+	onHandler: ({ status, duration }) => {},
+	onResponse: ({ status, duration }) => {},
+	onError: ({ error, duration }) => {},
+	onMiddleware: ({ name, duration, error }) => {},
+	onNotFound: ({ method, path }) => {},
+	onMethodNotAllowed: ({ allowed }) => {},
 })
 ```
 
@@ -1001,27 +1026,27 @@ const snapshot = app.toRouteTree()
 
 ```ts
 const handle = await app.serve({
-  port: 3000,
-  hostname: "0.0.0.0",
-  cors: true,              // or a CORS options object
-  env: { DATABASE_URL },
-  runtime: "bun",          // optional; detected if omitted
+	port: 3000,
+	hostname: "0.0.0.0",
+	cors: true, // or a CORS options object
+	env: { DATABASE_URL },
+	runtime: "bun", // optional; detected if omitted
 })
 
-handle.url        // http://127.0.0.1:3000
+handle.url // http://127.0.0.1:3000
 handle.port
 handle.hostname
-handle.runtime    // "bun" | "node" | "deno"
+handle.runtime // "bun" | "node" | "deno"
 await handle.close()
 ```
 
 Defaults: `port` 3000, `hostname` `0.0.0.0` (Deno defaults to `127.0.0.1`). Bound `0.0.0.0` / `::` is printed as `127.0.0.1` in `url`.
 
-| Runtime | How it listens |
-|---|---|
-| Bun | `Bun.serve({ fetch })` + `honey/ws/bun` |
-| Node | `node:http` + `honey/serve` + `honey/ws/node` |
-| Deno | `Deno.serve` + `honey/ws/deno` |
+| Runtime | How it listens                                |
+| ------- | --------------------------------------------- |
+| Bun     | `Bun.serve({ fetch })` + `honey/ws/bun`       |
+| Node    | `node:http` + `honey/serve` + `honey/ws/node` |
+| Deno    | `Deno.serve` + `honey/ws/deno`                |
 
 On Node, import `honey/serve` (or call `app.serve()`, which loads it) so the listen implementation is registered. The Node adapter wraps `IncomingMessage` instead of `new Request()` on the inbound hot path, and writes known JSON/text bodies with `res.end` instead of draining a Fetch `Response`.
 
@@ -1051,7 +1076,7 @@ import { app } from "./app.ts"
 app.wsAdapter(cfWebSocket())
 
 export default {
-  fetch: (req: Request, env: Env, ctx: ExecutionContext) => app.fetch(req, env, ctx),
+	fetch: (req: Request, env: Env, ctx: ExecutionContext) => app.fetch(req, env, ctx),
 }
 ```
 
@@ -1063,11 +1088,11 @@ Adapters if you wire them yourself: `bunWebSocket` (`honey/ws/bun`), `nodeWebSoc
 
 `honey()` stays fetch-only until you opt in:
 
-| Call or import | Loads |
-|---|---|
-| `app.serve()` or `import "@lovrozagar/honey/serve"` | Listen adapters |
-| `app.openapi()` / `app.manifest()` or `import "@lovrozagar/honey/openapi"` | Spec + docs |
-| `app.errorI18n()` or `import "@lovrozagar/honey/i18n"` | Error i18n |
+| Call or import                                                             | Loads           |
+| -------------------------------------------------------------------------- | --------------- |
+| `app.serve()` or `import "@lovrozagar/honey/serve"`                        | Listen adapters |
+| `app.openapi()` / `app.manifest()` or `import "@lovrozagar/honey/openapi"` | Spec + docs     |
+| `app.errorI18n()` or `import "@lovrozagar/honey/i18n"`                     | Error i18n      |
 
 Production bundles that only call `app.fetch` do not pull listen, OpenAPI, or i18n code. The load uses an opaque `import(["@lovrozagar/honey", name].join("/"))` so bundlers do not follow unused feature entries.
 
@@ -1077,8 +1102,8 @@ Production bundles that only call `app.fetch` do not pull listen, OpenAPI, or i1
 import { createBuildPlugin } from "@lovrozagar/honey/build"
 
 createBuildPlugin(
-  { target: "bun", port: 3000, minify: true, outDir: "dist", external: [] },
-  { entry: "src/app.ts", export: "app" }, // or export: "default"
+	{ target: "bun", port: 3000, minify: true, outDir: "dist", external: [] },
+	{ entry: "src/app.ts", export: "app" }, // or export: "default"
 )
 ```
 
@@ -1086,16 +1111,16 @@ createBuildPlugin(
 
 ```ts
 app.openapi({
-  title: "My API",
-  version: "1.0.0",
-  description: "Optional",
-  docs: "scalar",          // or "swagger"
-  docsPath: "/docs",       // default /docs, then /reference if /docs is taken
-  path: "/openapi",        // stem → /openapi.json, .yaml, .yml
-  filterRoutes: (route) => route.path !== "/debug",
-  securitySchemes: {
-    bearerAuth: { type: "http", scheme: "bearer" },
-  },
+	title: "My API",
+	version: "1.0.0",
+	description: "Optional",
+	docs: "scalar", // or "swagger"
+	docsPath: "/docs", // default /docs, then /reference if /docs is taken
+	path: "/openapi", // stem → /openapi.json, .yaml, .yml
+	filterRoutes: (route) => route.path !== "/debug",
+	securitySchemes: {
+		bearerAuth: { type: "http", scheme: "bearer" },
+	},
 })
 
 app.manifest()
@@ -1104,12 +1129,12 @@ app.manifest({ path: "/manifest.json" })
 
 Served (cached, invalidated when the route graph changes):
 
-| Path | Body |
-|---|---|
-| `/openapi.json` | OpenAPI 3.1 |
-| `/openapi.yaml` / `/openapi.yml` | Same document as YAML |
-| `/docs` | Scalar or Swagger UI pointing at the JSON spec |
-| `/manifest.json` | Route methods, paths, middleware names, error keys |
+| Path                             | Body                                               |
+| -------------------------------- | -------------------------------------------------- |
+| `/openapi.json`                  | OpenAPI 3.1                                        |
+| `/openapi.yaml` / `/openapi.yml` | Same document as YAML                              |
+| `/docs`                          | Scalar or Swagger UI pointing at the JSON spec     |
+| `/manifest.json`                 | Route methods, paths, middleware names, error keys |
 
 Those routes are marked internal. They do not appear inside the spec or the manifest. If `/docs` is already a user route, pass `docsPath` or Honey throws.
 
@@ -1125,22 +1150,74 @@ Generate-time sanitize (plugin `codegen.openApi.sanitize`):
 }
 ```
 
+### Meta spec
+
+`.metaSpec()` declares what flows from route meta and route schemas into the document. Without it, the built-in policy maps the eight fields above and drops everything else silently.
+
+```ts
+const app = honey<Env>()
+	.meta<HoneyMeta<AppRouteMeta>>()
+	.metaSpec({
+		strict: "error", // an app meta key with no entry fails the build
+		meta: {
+			permissions: "x-permissions", // verbatim
+			rateLimit: { key: "x-rate-limit", map: (v) => ({ category: v, rps: RPS[v] }) },
+			worker: false, // deliberately internal — never emitted
+			captcha: false,
+		},
+		schema: {
+			// read off `.meta({ entity })` stamped on the route's schemas, fan out to several tags
+			entity: {
+				from: ["output"],
+				search: "deep", // looks inside `{ articles: [Article], nextCursor }` envelopes
+				expand: (e) => ({
+					"x-entity": e.table,
+					"x-generated": e.generated,
+					"x-soft-delete": e.softDelete ? { field: e.softDelete } : undefined,
+				}),
+			},
+		},
+		profiles: {
+			// allowlist — a tag added later stays out of the public document until opted in
+			public: { include: ["x-entity", "x-query"] },
+		},
+	})
+```
+
+Every key of the app's meta type needs an entry — mapped, or `false` — enforced by the type of the `meta` section and again at codegen. Route meta beats schema-derived facts; `meta.extensions` (a record of `x-*` keys) is the escape hatch and outranks both. `profile` on `app.openapi()` or on a `codegen.openApi` entry emits several documents with different extension sets from one policy. Codegen-time only; nothing runs per request.
+
+Full reference, precedence rules, error taxonomy and migration path: [meta-spec.md](./docs/meta-spec.md).
+
+#### Middleware-contributed meta
+
+A fact that middleware already enforces should not be retyped on every route it protects:
+
+```ts
+export const shard = createMiddleware(fn, { meta: { tenant: "project_id" } })
+
+app.use(shard) // every route on the chain — or app.use("/orgs", shard), or .get("/x").use(shard)
+```
+
+Explicit `.meta()` (route, then chain) always outranks a contributed value; among middleware, later mount order wins. Contributed meta lands in the route's `mt`, so it reaches `ctx.meta`, the manifest, and the policy — with `strict: "error"` a middleware cannot contribute a key that has no entry. A path-scoped middleware registered _after_ the routes it covers still back-fills them. `internal` may not be contributed, since a middleware that removed routes from the document would be invisible from both sides.
+
+Resolved once at registration, never per request: the precompiled route tree bakes `mt` as a literal and patch mode does not overwrite it, so a lazily-derived value would differ between dev and production. Change what a middleware contributes, then regenerate.
+
 ## WebSockets
 
 ```ts
 app.ws("/echo-ws").handler({
-  onOpen(_ctx, ws) {
-    ws.send("connected")
-    ws.send({ hello: true })         // objects are JSON.stringified
-  },
-  onMessage(_ctx, ws, data) {
-    ws.send(data)                    // string | ArrayBuffer
-  },
-  onReconnect(_ctx, ws, token) {
-    ws.send(JSON.stringify({ event: "reconnected", token }))
-  },
-  onClose(_ctx, _ws, code, reason) {},
-  onError(_ctx, _ws, error) {},
+	onOpen(_ctx, ws) {
+		ws.send("connected")
+		ws.send({ hello: true }) // objects are JSON.stringified
+	},
+	onMessage(_ctx, ws, data) {
+		ws.send(data) // string | ArrayBuffer
+	},
+	onReconnect(_ctx, ws, token) {
+		ws.send(JSON.stringify({ event: "reconnected", token }))
+	},
+	onClose(_ctx, _ws, code, reason) {},
+	onError(_ctx, _ws, error) {},
 })
 ```
 
@@ -1158,40 +1235,40 @@ Honey's room protocol (not a raw socket). Transports: `ws`, `sse`, `longpoll`.
 
 ```ts
 app.realtime("/realtime/chat/:roomId", {
-  reconnectBuffer: 32,
-  use: [withAuth],                   // extra middleware for this socket only
-  handler: (ctx, conn) => {
-    conn.join("room:default")
-    conn.send({ event: "joined", id: conn.id, userId: conn.userId })
-    conn.on("message", (payload) => {
-      conn.publish("room:default", payload)
-    })
-    conn.on("close", (_reason) => {
-      conn.leave("room:default")
-    })
-  },
+	reconnectBuffer: 32,
+	use: [withAuth], // extra middleware for this socket only
+	handler: (ctx, conn) => {
+		conn.join("room:default")
+		conn.send({ event: "joined", id: conn.id, userId: conn.userId })
+		conn.on("message", (payload) => {
+			conn.publish("room:default", payload)
+		})
+		conn.on("close", (_reason) => {
+			conn.leave("room:default")
+		})
+	},
 })
 
 app.post("/realtime/broadcast/:topic").handler(async (ctx) => {
-  const body = await ctx.req.json()
-  ctx.realtime.publish(ctx.params.topic, body)
-  return ctx.res.json("ok", { published: true })
+	const body = await ctx.req.json()
+	ctx.realtime.publish(ctx.params.topic, body)
+	return ctx.res.json("ok", { published: true })
 })
 ```
 
 `conn`:
 
-| Field | Meaning |
-|---|---|
-| `id` | Connection id |
-| `userId` | `string \| null` |
-| `transport` | `"ws" \| "sse" \| "longpoll"` |
-| `state` | Mutable bag |
-| `join(topic)` / `leave(topic)` | Topic membership |
-| `send(payload)` | To this connection |
-| `publish(topic, payload)` | To everyone on the topic |
-| `close(reason?)` | Disconnect |
-| `on("message" \| "close", fn)` | Inbound / teardown |
+| Field                          | Meaning                       |
+| ------------------------------ | ----------------------------- |
+| `id`                           | Connection id                 |
+| `userId`                       | `string \| null`              |
+| `transport`                    | `"ws" \| "sse" \| "longpoll"` |
+| `state`                        | Mutable bag                   |
+| `join(topic)` / `leave(topic)` | Topic membership              |
+| `send(payload)`                | To this connection            |
+| `publish(topic, payload)`      | To everyone on the topic      |
+| `close(reason?)`               | Disconnect                    |
+| `on("message" \| "close", fn)` | Inbound / teardown            |
 
 Duplicate `realtime()` paths throw. Cloudflare's isolate-local bus does **not** cross isolates — REST publish to another connection is skipped on the CF e2e env.
 
@@ -1199,17 +1276,17 @@ Duplicate `realtime()` paths throw. Cloudflare's isolate-local bus does **not**
 
 ```ts
 app.get("/events").handler((ctx) =>
-  ctx.res.sse(
-    async (stream) => {
-      if (stream.lastEventId) {
-        await stream.send({ event: "resume", data: `from ${stream.lastEventId}` })
-      }
-      await stream.send({ event: "tick", data: "hello", id: "1", retry: 3000 })
-      await stream.send({ event: "data", data: { n: 42 }, id: "2" })
-      stream.close()
-    },
-    { defaultRetry: 3000, keepalive: 15_000 },
-  ),
+	ctx.res.sse(
+		async (stream) => {
+			if (stream.lastEventId) {
+				await stream.send({ event: "resume", data: `from ${stream.lastEventId}` })
+			}
+			await stream.send({ event: "tick", data: "hello", id: "1", retry: 3000 })
+			await stream.send({ event: "data", data: { n: 42 }, id: "2" })
+			stream.close()
+		},
+		{ defaultRetry: 3000, keepalive: 15_000 },
+	),
 )
 ```
 
@@ -1217,21 +1294,21 @@ app.get("/events").handler((ctx) =>
 
 ```ts
 app.get("/stream").handler((ctx) =>
-  ctx.res.stream(async (writable) => {
-    const w = writable.getWriter()
-    await w.write(new TextEncoder().encode("chunk"))
-    await w.close()
-  }),
+	ctx.res.stream(async (writable) => {
+		const w = writable.getWriter()
+		await w.write(new TextEncoder().encode("chunk"))
+		await w.close()
+	}),
 )
 
 app.get("/gen").handler((ctx) =>
-  ctx.res.generate(
-    (async function* () {
-      yield "one"
-      yield "two"
-    })(),
-    { contentType: "text/plain", status: 200 },
-  ),
+	ctx.res.generate(
+		(async function* () {
+			yield "one"
+			yield "two"
+		})(),
+		{ contentType: "text/plain", status: 200 },
+	),
 )
 ```
 
@@ -1251,14 +1328,18 @@ Hand-typed client against `InferRoutes<typeof app>` (no generate):
 import { createClient, isClientError } from "@lovrozagar/honey/client"
 
 const client = createClient<typeof app>({
-  baseURL: "http://127.0.0.1:3000",
-  headers: { authorization: "Bearer t" },
-  timeout: 10_000,
-  throwOnError: false,
-  credentials: "include",
-  onAuthExpired: async () => "new-token",
-  onRequest: [async (ctx) => { ctx.headers.set("x-trace", "1") }],
-  onResponse: [async (ctx) => ctx.response],
+	baseURL: "http://127.0.0.1:3000",
+	headers: { authorization: "Bearer t" },
+	timeout: 10_000,
+	throwOnError: false,
+	credentials: "include",
+	onAuthExpired: async () => "new-token",
+	onRequest: [
+		async (ctx) => {
+			ctx.headers.set("x-trace", "1")
+		},
+	],
+	onResponse: [async (ctx) => ctx.response],
 })
 
 const res = await client.get("/api/health")
@@ -1281,14 +1362,18 @@ After `honey generate` with `codegen.sdk.ports.typescript`:
 import { MySDK, isClientError, UnauthorizedError } from "./_gen/sdk.index.gen.ts"
 
 const sdk = new MySDK({
-  baseURL: "http://127.0.0.1:3000",
-  headers: { Authorization: "Bearer t" },
-  onAuthExpired: () => Promise.resolve("new-token"),
-  onLog: (entry) => console.debug(entry.event, entry.operation, entry.duration_ms),
-  onRequest: [(ctx) => { ctx.headers["X-Trace-Id"] = crypto.randomUUID() }],
-  throwOnError: true,
-  timeout: 10_000,
-  invalidation: { staleTime: 5 },
+	baseURL: "http://127.0.0.1:3000",
+	headers: { Authorization: "Bearer t" },
+	onAuthExpired: () => Promise.resolve("new-token"),
+	onLog: (entry) => console.debug(entry.event, entry.operation, entry.duration_ms),
+	onRequest: [
+		(ctx) => {
+			ctx.headers["X-Trace-Id"] = crypto.randomUUID()
+		},
+	],
+	throwOnError: true,
+	timeout: 10_000,
+	invalidation: { staleTime: 5 },
 })
 
 const user = await sdk.createUser({ json: { email: "a@b.com", name: "Ada" } })
@@ -1320,12 +1405,12 @@ Equivalent CLI: `honey generate --cli --cli-out cli --cli-binary-name myapi`.
 
 ```ts
 import {
-  generateOpenApi,
-  generateManifest,
-  generateSDK,
-  generateRouteTreeFromApp,
-  mergeSpecs,
-  sanitizeOpenApiSpec,
+	generateOpenApi,
+	generateManifest,
+	generateSDK,
+	generateRouteTreeFromApp,
+	mergeSpecs,
+	sanitizeOpenApiSpec,
 } from "@lovrozagar/honey/codegen"
 import { generateGoCLI } from "@lovrozagar/honey/codegen-go-cli"
 
@@ -1339,26 +1424,26 @@ Language printers used by the plugin (`generatePythonSDK`, `generateGoSDK`, `gen
 
 Exported from `@lovrozagar/honey`. They describe the **app you built**:
 
-| Type | Meaning |
-|---|---|
-| `InferRoutes<typeof app>` | Path → methods → input/output/errors |
-| `InferRoutePaths<typeof app>` | Union of paths |
-| `InferRouteMethods<typeof app, Path>` | Methods on one path |
-| `InferRouteInput<typeof app, Path, Method>` | Validated input |
-| `InferRouteOutput<typeof app, Path, Method>` | Output map |
-| `InferRouteErrors<typeof app, Path, Method>` | Declared error keys |
-| `InferRouteMeta<typeof app, Path, Method>` | Route meta |
-| `InferRouteCtx<typeof app, Path, Method>` | Handler ctx for one route |
-| `InferCtx<typeof app>` | Handler context (no `res` brand) |
-| `InferEnv<typeof app>` | `ctx.env` |
-| `InferMeta<typeof app>` | App-level meta |
-| `InferErrorFactory<typeof app>` | Error factory |
-| `InferBasePath<typeof app>` | Base path string |
-| `StatusKey` / `SuccessStatusKey` | Status-key unions |
-| `HoneyCtx<TEnv>` | Untyped context shape |
-| `HoneyServeOptions` / `ServeHandle` / `ServeRuntime` | Serve types |
-| `WSHandler` / `WSContext` / `WSAdapter` | Socket types |
-| `ConnContext` / `RealtimeRouteOpts` | Realtime types |
+| Type                                                 | Meaning                              |
+| ---------------------------------------------------- | ------------------------------------ |
+| `InferRoutes<typeof app>`                            | Path → methods → input/output/errors |
+| `InferRoutePaths<typeof app>`                        | Union of paths                       |
+| `InferRouteMethods<typeof app, Path>`                | Methods on one path                  |
+| `InferRouteInput<typeof app, Path, Method>`          | Validated input                      |
+| `InferRouteOutput<typeof app, Path, Method>`         | Output map                           |
+| `InferRouteErrors<typeof app, Path, Method>`         | Declared error keys                  |
+| `InferRouteMeta<typeof app, Path, Method>`           | Route meta                           |
+| `InferRouteCtx<typeof app, Path, Method>`            | Handler ctx for one route            |
+| `InferCtx<typeof app>`                               | Handler context (no `res` brand)     |
+| `InferEnv<typeof app>`                               | `ctx.env`                            |
+| `InferMeta<typeof app>`                              | App-level meta                       |
+| `InferErrorFactory<typeof app>`                      | Error factory                        |
+| `InferBasePath<typeof app>`                          | Base path string                     |
+| `StatusKey` / `SuccessStatusKey`                     | Status-key unions                    |
+| `HoneyCtx<TEnv>`                                     | Untyped context shape                |
+| `HoneyServeOptions` / `ServeHandle` / `ServeRuntime` | Serve types                          |
+| `WSHandler` / `WSContext` / `WSAdapter`              | Socket types                         |
+| `ConnContext` / `RealtimeRouteOpts`                  | Realtime types                       |
 
 ```ts
 import type { InferCtx, InferRouteInput, InferRoutes } from "@lovrozagar/honey"
@@ -1377,9 +1462,9 @@ const client = testClient(app, { env: { DATABASE_URL: "…" }, cookies: true })
 
 const res = await client.get("/api/health")
 await client.post("/api/users", {
-  json: { email: "a@b.com", name: "Ada" },
-  headers: { authorization: "Bearer t" },
-  search: { dry: "1" },
+	json: { email: "a@b.com", name: "Ada" },
+	headers: { authorization: "Bearer t" },
+	search: { dry: "1" },
 })
 await client.post("/login", { form: { user: "a", pass: "b" } })
 ```
@@ -1412,30 +1497,30 @@ await requestToCurl(req, { excludeHeader: (n) => n === "authorization" })
 
 Import features from their path.
 
-| Export | Purpose |
-|---|---|
-| `@lovrozagar/honey` | `honey`, `defineErrors`, `HoneyError`, `createMiddleware`, `HoneyRes`, Infer* types, `mergeTree`, `detectRuntime` |
-| `honey/serve` | Register Node/Bun/Deno listen |
-| `honey/node` | Low-level Node `serve()` |
-| `honey/openapi` | Register spec generation |
-| `honey/openapi/spec` `honey/openapi/scalar` `honey/openapi/swagger` | Spec / UI pieces |
-| `honey/i18n` | Register error i18n |
-| `@lovrozagar/honey/plugin` | Vite plugin + `generateFromApp` |
-| `honey/client` / `honey/client/sdk` | Typed TS client runtime / generated-SDK helpers |
-| `honey/cors` `honey/csrf` `honey/body-limit` `honey/logger` `honey/curl-logger` `honey/etag` `honey/timeout` `honey/request-id` `honey/secure-headers` `honey/server-timing` `honey/ip-restrict` `honey/powered-by` `honey/pretty-json` `honey/static` | Middleware |
-| `honey/proxy` | `ProxyConfig` type (`.proxy()` lives on the route builder) |
-| `honey/input` | `readableStream()` |
-| `honey/testing` | `testClient` |
-| `honey/ws/bun` `honey/ws/node` `honey/ws/deno` `honey/ws/cloudflare` | WS adapters |
-| `honey/accepts` `honey/cookie` `honey/cookie-sign` `honey/crypto` `honey/request-to-curl` | Utilities |
-| `honey/telemetry/otel` | `otelAdapter` |
-| `honey/codegen` | `generateOpenApi`, `generateSDK`, `generateManifest`, trees, sanitize |
-| `honey/codegen-go-cli` | `generateGoCLI` |
-| `honey/codegen/extract` | ts-morph chain extractor |
-| `honey/build` | `createBuildPlugin` |
-| `honey/tree` | Tree types + `mergeTree` |
-| `honey/cli` | `honey` binary |
-| `honey/errors` | `defineErrors` (also on the root export) |
+| Export                                                                                                                                                                                                                                                 | Purpose                                                                                                           |
+| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------- |
+| `@lovrozagar/honey`                                                                                                                                                                                                                                    | `honey`, `defineErrors`, `HoneyError`, `createMiddleware`, `HoneyRes`, Infer* types, `mergeTree`, `detectRuntime` |
+| `honey/serve`                                                                                                                                                                                                                                          | Register Node/Bun/Deno listen                                                                                     |
+| `honey/node`                                                                                                                                                                                                                                           | Low-level Node `serve()`                                                                                          |
+| `honey/openapi`                                                                                                                                                                                                                                        | Register spec generation                                                                                          |
+| `honey/openapi/spec` `honey/openapi/scalar` `honey/openapi/swagger`                                                                                                                                                                                    | Spec / UI pieces                                                                                                  |
+| `honey/i18n`                                                                                                                                                                                                                                           | Register error i18n                                                                                               |
+| `@lovrozagar/honey/plugin`                                                                                                                                                                                                                             | Vite plugin + `generateFromApp`                                                                                   |
+| `honey/client` / `honey/client/sdk`                                                                                                                                                                                                                    | Typed TS client runtime / generated-SDK helpers                                                                   |
+| `honey/cors` `honey/csrf` `honey/body-limit` `honey/logger` `honey/curl-logger` `honey/etag` `honey/timeout` `honey/request-id` `honey/secure-headers` `honey/server-timing` `honey/ip-restrict` `honey/powered-by` `honey/pretty-json` `honey/static` | Middleware                                                                                                        |
+| `honey/proxy`                                                                                                                                                                                                                                          | `ProxyConfig` type (`.proxy()` lives on the route builder)                                                        |
+| `honey/input`                                                                                                                                                                                                                                          | `readableStream()`                                                                                                |
+| `honey/testing`                                                                                                                                                                                                                                        | `testClient`                                                                                                      |
+| `honey/ws/bun` `honey/ws/node` `honey/ws/deno` `honey/ws/cloudflare`                                                                                                                                                                                   | WS adapters                                                                                                       |
+| `honey/accepts` `honey/cookie` `honey/cookie-sign` `honey/crypto` `honey/request-to-curl`                                                                                                                                                              | Utilities                                                                                                         |
+| `honey/telemetry/otel`                                                                                                                                                                                                                                 | `otelAdapter`                                                                                                     |
+| `honey/codegen`                                                                                                                                                                                                                                        | `generateOpenApi`, `generateSDK`, `generateManifest`, trees, sanitize                                             |
+| `honey/codegen-go-cli`                                                                                                                                                                                                                                 | `generateGoCLI`                                                                                                   |
+| `honey/codegen/extract`                                                                                                                                                                                                                                | ts-morph chain extractor                                                                                          |
+| `honey/build`                                                                                                                                                                                                                                          | `createBuildPlugin`                                                                                               |
+| `honey/tree`                                                                                                                                                                                                                                           | Tree types + `mergeTree`                                                                                          |
+| `honey/cli`                                                                                                                                                                                                                                            | `honey` binary                                                                                                    |
+| `honey/errors`                                                                                                                                                                                                                                         | `defineErrors` (also on the root export)                                                                          |
 
 ## Repository layout
 
@@ -1485,31 +1570,43 @@ Typecheck stays strict. Do not weaken `strict` or add `as any` to make it pass.
 
 ### Test matrix
 
-| Command | What it proves |
-|---|---|
-| `bun run test` | Core unit + integration. Default CI gate. |
-| `bun run test:consumers` | Each e2e app imports `honey` and hits a few routes in-process. |
-| `bun run test:e2e` | Playwright against Bun listen, every app. |
-| `bun run test:e2e:node` | Same tests, Node (`tsx`) listen. |
-| `bun run test:e2e:deno` | Same tests, Deno listen. |
-| `bun run test:e2e:cf` | Same tests, local workerd. Kitchen REST publish is skipped (`HONEY_E2E_ENV=cf`). |
-| `bun run test:harness` | Generated SDKs compile and behave. |
+| Command                  | What it proves                                                                   |
+| ------------------------ | -------------------------------------------------------------------------------- |
+| `bun run test`           | Core unit + integration. Default CI gate.                                        |
+| `bun run test:consumers` | Each e2e app imports `honey` and hits a few routes in-process.                   |
+| `bun run test:e2e`       | Playwright against Bun listen, every app.                                        |
+| `bun run test:e2e:node`  | Same tests, Node (`tsx`) listen.                                                 |
+| `bun run test:e2e:deno`  | Same tests, Deno listen.                                                         |
+| `bun run test:e2e:cf`    | Same tests, local workerd. Kitchen REST publish is skipped (`HONEY_E2E_ENV=cf`). |
+| `bun run test:build`     | Every app builds for every deploy target; artifacts and size budgets hold.       |
+| `bun run test:harness`   | Generated SDKs compile and behave.                                               |
 
 ```bash
 bun e2e/run.ts --env node --app kitchen
 bun e2e/run.ts --env all --app surface
 bun e2e/run.ts --env bun --mode prod
+
+bun e2e/run-build.ts --app kitchen --target cloudflare
+bun e2e/run-build.ts --runtime all           # run the builds under node and bun
+bun e2e/run-build.ts --check-generated       # CI: a build must not rewrite committed files
 ```
 
+The build tier builds each e2e app through its own `vite.config.ts` plus
+`createBuildPlugin`, once per target (`node`, `bun`, `deno`, `cloudflare`). A cell
+passes when the build exits 0, emits `dist/<target>/index.js`, and stays under its
+gzipped size budget. The budget is not decoration: honey loads `zod` and `effect`
+dynamically, and a bundler that resolves one of those dynamic imports silently adds
+~300KB to every worker bundle. Size is the only signal that catches it.
+
 ### E2E apps and runtimes
 
-| App | Covers |
-|---|---|
-| `kitchen` | Auth, CRUD, i18n, OpenAPI, SSE, WS, realtime, trailing slash, errors |
-| `defaults` | Empty-middleware app, root OpenAPI, no CORS by default |
-| `compose` | `.route()` groups, Scalar collision with a user `/docs` |
-| `surface` | Every input source, output type, method, SSE, WS, uploads |
-| `gateway` | `stripPrefix` + enforce slash, Swagger behind a prefix |
+| App        | Covers                                                               |
+| ---------- | -------------------------------------------------------------------- |
+| `kitchen`  | Auth, CRUD, i18n, OpenAPI, SSE, WS, realtime, trailing slash, errors |
+| `defaults` | Empty-middleware app, root OpenAPI, no CORS by default               |
+| `compose`  | `.route()` groups, Scalar collision with a user `/docs`              |
+| `surface`  | Every input source, output type, method, SSE, WS, uploads            |
+| `gateway`  | `stripPrefix` + enforce slash, Swagger behind a prefix               |
 
 Runtimes: `e2e/bun`, `e2e/node`, `e2e/deno`, `e2e/cf-workers`.
 
@@ -1533,6 +1630,12 @@ Numbers and bundle sizes: [`bench/RESULTS.md`](https://github.com/lovrozagar/hon
 
 Python runtime tests skip without `httpx` (`pip install httpx`). Rust cargo tests skip without `cargo` or when `HONEY_RUST_INTEGRATION=0`. Go tests skip without `go`. Cargo artifacts go to `.cache/cargo-target`, not `/tmp`.
 
+## Releases
+
+The published package is [`@lovrozagar/honey`](https://www.npmjs.com/package/@lovrozagar/honey). That URL is the repository website. GitHub Releases match npm versions. Pushing a tag `vX.Y.Z` (same as this `package.json` `version`) runs the repo [`.github/workflows/release.yml`](https://github.com/lovrozagar/honey/blob/main/.github/workflows/release.yml): unit + typecheck + consumer tests, `npm publish` via trusted publishing, GitHub Packages, then a GitHub Release.
+
+Configure the trusted publisher once on this package (Settings → Trusted Publisher → GitHub Actions): repository `lovrozagar/honey`, workflow `release.yml`, no environment, allow npm publish. Do not put an npm token in GitHub secrets.
+
 ## License
 
 MIT