diff --git a/AGENTS.md b/AGENTS.md
index 6eb120d..e248622 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -20,7 +20,7 @@ REP introduces:
 3. **HMAC-SHA256 integrity verification** + SRI hashing on every payload
 4. **Automatic secret detection guardrails** (Shannon entropy, known key format matching)
 5. **Hot config reload** via Server-Sent Events (optional)
-6. A **lightweight Go gateway binary** (~3–5MB, zero dependencies, `FROM scratch` compatible)
+6. A **lightweight Go gateway binary** (~7MB, zero dependencies, `FROM scratch` compatible)
 7. A **zero-dependency TypeScript SDK** (~1.5KB gzipped) with synchronous access for public vars
 
 ---
diff --git a/CLAUDE.md b/CLAUDE.md
index dca2496..59a7956 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -20,7 +20,7 @@ REP introduces:
 3. **HMAC-SHA256 integrity verification** + SRI hashing on every payload
 4. **Automatic secret detection guardrails** (Shannon entropy, known key format matching)
 5. **Hot config reload** via Server-Sent Events (optional)
-6. A **lightweight Go gateway binary** (~3–5MB, zero dependencies, `FROM scratch` compatible)
+6. A **lightweight Go gateway binary** (~7MB, zero dependencies, `FROM scratch` compatible)
 7. A **zero-dependency TypeScript SDK** (~1.5KB gzipped) with synchronous access for public vars
 
 ---
diff --git a/docs/.astro/content-modules.mjs b/docs/.astro/content-modules.mjs
index f1f599a..1f7ebc7 100644
--- a/docs/.astro/content-modules.mjs
+++ b/docs/.astro/content-modules.mjs
@@ -1,29 +1,27 @@
 
 export default new Map([
-["src/content/docs/concepts/hot-reload.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fconcepts%2Fhot-reload.mdx&astroContentModuleFlag=true")],
+["src/content/docs/index.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Findex.mdx&astroContentModuleFlag=true")],
 ["src/content/docs/contributing.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fcontributing.mdx&astroContentModuleFlag=true")],
-["src/content/docs/concepts/security-model.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fconcepts%2Fsecurity-model.mdx&astroContentModuleFlag=true")],
+["src/content/docs/quick-start.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fquick-start.mdx&astroContentModuleFlag=true")],
+["src/content/docs/concepts/hot-reload.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fconcepts%2Fhot-reload.mdx&astroContentModuleFlag=true")],
 ["src/content/docs/concepts/how-it-works.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fconcepts%2Fhow-it-works.mdx&astroContentModuleFlag=true")],
+["src/content/docs/concepts/security-model.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fconcepts%2Fsecurity-model.mdx&astroContentModuleFlag=true")],
 ["src/content/docs/concepts/variable-classification.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fconcepts%2Fvariable-classification.mdx&astroContentModuleFlag=true")],
 ["src/content/docs/concepts/wire-format.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fconcepts%2Fwire-format.mdx&astroContentModuleFlag=true")],
-["src/content/docs/index.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Findex.mdx&astroContentModuleFlag=true")],
-["src/content/docs/deployment/docker-compose.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fdeployment%2Fdocker-compose.mdx&astroContentModuleFlag=true")],
-["src/content/docs/quick-start.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fquick-start.mdx&astroContentModuleFlag=true")],
 ["src/content/docs/deployment/ci-cd.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fdeployment%2Fci-cd.mdx&astroContentModuleFlag=true")],
+["src/content/docs/deployment/docker-compose.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fdeployment%2Fdocker-compose.mdx&astroContentModuleFlag=true")],
 ["src/content/docs/deployment/docker-embedded.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fdeployment%2Fdocker-embedded.mdx&astroContentModuleFlag=true")],
 ["src/content/docs/deployment/docker-proxy.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fdeployment%2Fdocker-proxy.mdx&astroContentModuleFlag=true")],
-["src/content/docs/examples/quick-no-manifest.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fexamples%2Fquick-no-manifest.mdx&astroContentModuleFlag=true")],
-["src/content/docs/examples/todo-react.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fexamples%2Ftodo-react.mdx&astroContentModuleFlag=true")],
 ["src/content/docs/deployment/kubernetes.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fdeployment%2Fkubernetes.mdx&astroContentModuleFlag=true")],
+["src/content/docs/examples/nextjs-csr-embedded.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fexamples%2Fnextjs-csr-embedded.mdx&astroContentModuleFlag=true")],
+["src/content/docs/examples/nextjs-proxy.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fexamples%2Fnextjs-proxy.mdx&astroContentModuleFlag=true")],
+["src/content/docs/examples/simple-html.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fexamples%2Fsimple-html.mdx&astroContentModuleFlag=true")],
+["src/content/docs/examples/todo-react.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fexamples%2Ftodo-react.mdx&astroContentModuleFlag=true")],
 ["src/content/docs/frameworks/angular.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fframeworks%2Fangular.mdx&astroContentModuleFlag=true")],
-["src/content/docs/frameworks/vue.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fframeworks%2Fvue.mdx&astroContentModuleFlag=true")],
-["src/content/docs/frameworks/vanilla.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fframeworks%2Fvanilla.mdx&astroContentModuleFlag=true")],
 ["src/content/docs/frameworks/react.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fframeworks%2Freact.mdx&astroContentModuleFlag=true")],
 ["src/content/docs/frameworks/svelte.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fframeworks%2Fsvelte.mdx&astroContentModuleFlag=true")],
-["src/content/docs/guides/installation.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fguides%2Finstallation.mdx&astroContentModuleFlag=true")],
-["src/content/docs/guides/development.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fguides%2Fdevelopment.mdx&astroContentModuleFlag=true")],
-["src/content/docs/guides/testing.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fguides%2Ftesting.mdx&astroContentModuleFlag=true")],
-["src/content/docs/guides/manifest.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fguides%2Fmanifest.mdx&astroContentModuleFlag=true")],
+["src/content/docs/frameworks/vanilla.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fframeworks%2Fvanilla.mdx&astroContentModuleFlag=true")],
+["src/content/docs/frameworks/vue.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fframeworks%2Fvue.mdx&astroContentModuleFlag=true")],
 ["src/content/docs/reference/cli.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Freference%2Fcli.mdx&astroContentModuleFlag=true")],
 ["src/content/docs/reference/codemod.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Freference%2Fcodemod.mdx&astroContentModuleFlag=true")],
 ["src/content/docs/reference/gateway-endpoints.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Freference%2Fgateway-endpoints.mdx&astroContentModuleFlag=true")],
@@ -31,14 +29,20 @@ export default new Map([
 ["src/content/docs/reference/manifest-schema.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Freference%2Fmanifest-schema.mdx&astroContentModuleFlag=true")],
 ["src/content/docs/reference/sdk.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Freference%2Fsdk.mdx&astroContentModuleFlag=true")],
 ["src/content/docs/spec/conformance.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fspec%2Fconformance.mdx&astroContentModuleFlag=true")],
-["src/content/docs/spec/rfc-0001.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fspec%2Frfc-0001.mdx&astroContentModuleFlag=true")],
 ["src/content/docs/spec/index.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fspec%2Findex.mdx&astroContentModuleFlag=true")],
+["src/content/docs/spec/rfc-0001.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fspec%2Frfc-0001.mdx&astroContentModuleFlag=true")],
 ["src/content/docs/spec/security-model.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fspec%2Fsecurity-model.mdx&astroContentModuleFlag=true")],
-["src/content/docs/reference/adapters/vue.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Freference%2Fadapters%2Fvue.mdx&astroContentModuleFlag=true")],
-["src/content/docs/reference/adapters/svelte.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Freference%2Fadapters%2Fsvelte.mdx&astroContentModuleFlag=true")],
+["src/content/docs/guides/development.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fguides%2Fdevelopment.mdx&astroContentModuleFlag=true")],
+["src/content/docs/guides/installation.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fguides%2Finstallation.mdx&astroContentModuleFlag=true")],
+["src/content/docs/guides/testing.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fguides%2Ftesting.mdx&astroContentModuleFlag=true")],
+["src/content/docs/guides/manifest.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fguides%2Fmanifest.mdx&astroContentModuleFlag=true")],
 ["src/content/docs/reference/adapters/react.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Freference%2Fadapters%2Freact.mdx&astroContentModuleFlag=true")],
-["src/content/docs/guides/migration/from-vite.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fguides%2Fmigration%2Ffrom-vite.mdx&astroContentModuleFlag=true")],
-["src/content/docs/guides/migration/from-next.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fguides%2Fmigration%2Ffrom-next.mdx&astroContentModuleFlag=true")],
+["src/content/docs/reference/adapters/svelte.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Freference%2Fadapters%2Fsvelte.mdx&astroContentModuleFlag=true")],
+["src/content/docs/reference/adapters/vue.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Freference%2Fadapters%2Fvue.mdx&astroContentModuleFlag=true")],
+["src/content/docs/reference/plugins/next.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Freference%2Fplugins%2Fnext.mdx&astroContentModuleFlag=true")],
+["src/content/docs/reference/plugins/vite.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Freference%2Fplugins%2Fvite.mdx&astroContentModuleFlag=true")],
 ["src/content/docs/guides/migration/from-cra.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fguides%2Fmigration%2Ffrom-cra.mdx&astroContentModuleFlag=true")],
+["src/content/docs/guides/migration/from-next.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fguides%2Fmigration%2Ffrom-next.mdx&astroContentModuleFlag=true")],
+["src/content/docs/guides/migration/from-vite.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fguides%2Fmigration%2Ffrom-vite.mdx&astroContentModuleFlag=true")],
 ["src/content/docs/guides/migration/overview.mdx", () => import("astro:content-layer-deferred-module?astro%3Acontent-layer-deferred-module=&fileName=src%2Fcontent%2Fdocs%2Fguides%2Fmigration%2Foverview.mdx&astroContentModuleFlag=true")]]);
 		
\ No newline at end of file
diff --git a/docs/astro.config.mjs b/docs/astro.config.mjs
index c5e0cf6..63b5588 100644
--- a/docs/astro.config.mjs
+++ b/docs/astro.config.mjs
@@ -194,16 +194,12 @@ export default defineConfig({
         {
           label: 'Examples',
           items: [
-            {
-              label: 'Zero-Config Quick Start',
-              slug: 'examples/quick-no-manifest',
-            },
             { label: 'Todo App (React)', slug: 'examples/todo-react' },
             { label: 'Simple HTML (ESM.sh)', slug: 'examples/simple-html' },
             { label: 'Next.js — Proxy Mode', slug: 'examples/nextjs-proxy' },
             {
               label: 'Next.js CSR + Kubernetes',
-              slug: 'examples/nextjs-csr-kubernetes',
+              slug: 'examples/nextjs-csr-embedded',
             },
           ],
         },
@@ -226,6 +222,13 @@ export default defineConfig({
                 { label: 'Svelte', slug: 'reference/adapters/svelte' },
               ],
             },
+            {
+              label: 'Build-Tool Plugins',
+              items: [
+                { label: 'Vite', slug: 'reference/plugins/vite' },
+                { label: 'Next.js', slug: 'reference/plugins/next' },
+              ],
+            },
             { label: 'Codemod', slug: 'reference/codemod' },
           ],
         },
diff --git a/docs/src/content/docs/deployment/docker-embedded.mdx b/docs/src/content/docs/deployment/docker-embedded.mdx
index 94050d1..73b8d0d 100644
--- a/docs/src/content/docs/deployment/docker-embedded.mdx
+++ b/docs/src/content/docs/deployment/docker-embedded.mdx
@@ -36,7 +36,7 @@ CMD ["--mode", "embedded", "--static-dir", "/static", "--port", "8080", "--stric
 
 Exactly two things:
 - Your built static files (`dist/`)
-- The REP gateway binary (~6MB)
+- The REP gateway binary (~7MB)
 
 No OS, no shell, no utilities, no package manager. Attack surface: near zero.
 
diff --git a/docs/src/content/docs/examples/nextjs-csr-kubernetes.mdx b/docs/src/content/docs/examples/nextjs-csr-embedded.mdx
similarity index 100%
rename from docs/src/content/docs/examples/nextjs-csr-kubernetes.mdx
rename to docs/src/content/docs/examples/nextjs-csr-embedded.mdx
diff --git a/docs/src/content/docs/examples/quick-no-manifest.mdx b/docs/src/content/docs/examples/quick-no-manifest.mdx
deleted file mode 100644
index af6f299..0000000
--- a/docs/src/content/docs/examples/quick-no-manifest.mdx
+++ /dev/null
@@ -1,123 +0,0 @@
----
-title: Zero-Config Quick Start — No Manifest Required
-description: Use REP with just naming conventions and no configuration file. Rename env vars with REP_PUBLIC_/REP_SENSITIVE_ prefixes, install the SDK, and run the gateway.
----
-
-import { Aside } from '@astrojs/starlight/components';
-
-The `.rep.yaml` manifest is entirely optional. The gateway works with nothing but environment variables — the naming convention **is** the configuration.
-
-## How it works
-
-| Env var prefix | Tier | In the browser |
-|---|---|---|
-| `REP_PUBLIC_*` | PUBLIC | Plaintext in `<script id="__rep__">`. Read with `rep.get()`. |
-| `REP_SENSITIVE_*` | SENSITIVE | AES-256-GCM encrypted. Decrypt with `await rep.getSecure()`. |
-| `REP_SERVER_*` | SERVER | Never leaves the gateway process. |
-| `REP_GATEWAY_*` | Config | Gateway settings. Not injected into the app. |
-
-That's the entire protocol.
-
-## Step 1 — Rename your env vars
-
-```bash
-# Before (Vite)            → After (REP)
-VITE_API_URL               → REP_PUBLIC_API_URL
-VITE_FEATURE_FLAGS         → REP_PUBLIC_FEATURE_FLAGS
-
-# Before (CRA)             → After (REP)
-REACT_APP_API_URL          → REP_PUBLIC_API_URL
-
-# Should be encrypted
-REACT_APP_ANALYTICS_KEY    → REP_SENSITIVE_ANALYTICS_KEY
-
-# Should never reach the browser
-DB_PASSWORD                → REP_SERVER_DB_PASSWORD
-```
-
-## Step 2 — Install the SDK and update reads
-
-```bash
-npm install @rep-protocol/sdk
-```
-
-```typescript
-import { rep } from '@rep-protocol/sdk';
-
-// Was: import.meta.env.VITE_API_URL
-const apiUrl = rep.get('API_URL');
-
-// With a default for local development
-const apiUrl = rep.get('API_URL', 'http://localhost:3001');
-
-// Sensitive — encrypted, decrypted on demand
-const key = await rep.getSecure('ANALYTICS_KEY');
-```
-
-## Step 3 — Build your app (nothing changes)
-
-```bash
-npm run build
-```
-
-The output is now environment-agnostic.
-
-## Step 4 — Run the gateway
-
-```bash
-REP_PUBLIC_API_URL=https://api.example.com \
-REP_PUBLIC_FEATURE_FLAGS=dark-mode,new-checkout \
-REP_SENSITIVE_ANALYTICS_KEY=ak_live_abc123 \
-./rep-gateway --mode embedded --static-dir ./dist
-```
-
-Open `http://localhost:8080` — done.
-
-## Changing config without rebuilding
-
-```bash
-# Stop. Change values. Restart.
-REP_PUBLIC_API_URL=https://api.prod.example.com \
-REP_PUBLIC_FEATURE_FLAGS=dark-mode \
-./rep-gateway --mode embedded --static-dir ./dist
-```
-
-Same `dist/` folder. Different runtime config.
-
-### Dev mode — file watch hot reload
-
-For local development, point the gateway at a `.env.local` file and let it watch for changes automatically — no signals, no restarts:
-
-```bash
-# .env.local
-REP_PUBLIC_API_URL=http://localhost:3001
-REP_PUBLIC_FEATURE_FLAGS=dark-mode
-REP_SENSITIVE_ANALYTICS_KEY=ak_dev_abc123
-```
-
-```bash
-./rep-gateway --mode embedded --static-dir ./dist \
-  --hot-reload \
-  --hot-reload-mode=file_watch \
-  --env-file=.env.local \
-  --watch-path=.env.local
-```
-
-Edit `.env.local` and save — the gateway picks up the changes immediately, re-encrypts sensitive vars with a fresh ephemeral key, and pushes a reload event over `/rep/changes` (SSE). Components using `rep.onChange()` re-render automatically without a browser refresh.
-
-<Aside type="tip">
-  The CLI dev command handles this automatically: `npx @rep-protocol/cli dev --proxy http://localhost:5173` starts the gateway with file watch mode already enabled. See the [Local Development guide](/guides/development/).
-</Aside>
-
-## When to add a manifest
-
-The manifest is additive. Add it when you need:
-
-- **Startup validation** — fail fast if a required variable is missing
-- **Type constraints** — enforce `url`, `number`, `enum` shapes
-- **TypeScript types** — `rep typegen` generates typed overloads
-- **Documentation** — single source of truth for all variables
-
-<Aside type="tip">
-  Start without a manifest. Add one later when you want validation and type generation. See the [Manifest guide](/guides/manifest/).
-</Aside>
diff --git a/docs/src/content/docs/frameworks/react.mdx b/docs/src/content/docs/frameworks/react.mdx
index f550961..9dd47cb 100644
--- a/docs/src/content/docs/frameworks/react.mdx
+++ b/docs/src/content/docs/frameworks/react.mdx
@@ -118,7 +118,7 @@ Without the gateway running, `useRep()` returns `undefined`. Three approaches:
   });
   ```
 
-  The plugin reads `.env.local` and injects the REP payload during `vite dev` — no gateway needed. Just run `npm run dev` as normal.
+  The plugin reads `.env.local` and injects the REP payload during `vite dev` — no gateway needed. Just run `npm run dev` as normal. Using Next.js instead? See the [Next.js plugin reference](/reference/plugins/next/) — same idea, `RepScript` instead of `repPlugin()`. Full option list: [Vite plugin reference](/reference/plugins/vite/).
   </TabItem>
   <TabItem label="Default values">
   ```tsx
diff --git a/docs/src/content/docs/frameworks/vanilla.mdx b/docs/src/content/docs/frameworks/vanilla.mdx
index bf7e971..1671ceb 100644
--- a/docs/src/content/docs/frameworks/vanilla.mdx
+++ b/docs/src/content/docs/frameworks/vanilla.mdx
@@ -104,3 +104,5 @@ REP works without any build tool. If you have a static HTML site with inline `<s
 ```
 
 The gateway injects the `<script id="__rep__">` payload into your HTML regardless of how your JavaScript is loaded.
+
+For a complete, runnable single-file app — SDK loaded from [esm.sh](https://esm.sh), no `npm install`, no build step — see the [Simple HTML example](/examples/simple-html/).
diff --git a/docs/src/content/docs/guides/installation.mdx b/docs/src/content/docs/guides/installation.mdx
index 3847901..0aa2200 100644
--- a/docs/src/content/docs/guides/installation.mdx
+++ b/docs/src/content/docs/guides/installation.mdx
@@ -55,7 +55,7 @@ For the best dev experience, install the plugin for your build tool. These injec
   });
   ```
 
-  That's it — `rep.get()` and `rep.getSecure()` now work in `vite dev`. No gateway needed.
+  That's it — `rep.get()` and `rep.getSecure()` now work in `vite dev`. No gateway needed. See the [Vite plugin reference](/reference/plugins/vite/) for all options.
   </TabItem>
   <TabItem label="Next.js">
   ```bash
@@ -82,7 +82,7 @@ For the best dev experience, install the plugin for your build tool. These injec
   export { GET } from '@rep-protocol/next/session-key';
   ```
 
-  `RepScript` renders the REP payload during `next dev` and returns `null` in production — the gateway handles injection in prod.
+  `RepScript` renders the REP payload during `next dev` and returns `null` in production — the gateway handles injection in prod. See the [Next.js plugin reference](/reference/plugins/next/) for all options.
   </TabItem>
 </Tabs>
 
@@ -107,7 +107,7 @@ npx @rep-protocol/cli dev --proxy http://localhost:5173
 
 ## Gateway binary
 
-The gateway is a standalone Go binary (~6MB). There are several ways to get it:
+The gateway is a standalone Go binary (~7MB). There are several ways to get it:
 
 ### Via the CLI (recommended)
 
diff --git a/docs/src/content/docs/index.mdx b/docs/src/content/docs/index.mdx
index bfd1465..d0b6b94 100644
--- a/docs/src/content/docs/index.mdx
+++ b/docs/src/content/docs/index.mdx
@@ -64,7 +64,7 @@ REP is an open protocol and reference implementation that **decouples environmen
 
 ## Works Everywhere
 
-REP operates at the **infrastructure layer** — no build-tool plugins, no framework coupling. It works with any frontend stack that produces HTML.
+REP operates at the **infrastructure layer** in production — no build-tool plugin required, no framework coupling. It works with any frontend stack that produces HTML. Optional dev-time plugins exist purely for local DX (see below).
 
 <CardGrid>
   <Card title="Containers" icon="rocket">
@@ -74,7 +74,7 @@ REP operates at the **infrastructure layer** — no build-tool plugins, no frame
     Build your app once with `npm run build`. The gateway injects config into the static HTML at serve time — same artifact for every environment.
   </Card>
   <Card title="Local Development" icon="terminal">
-    The CLI wraps the gateway for local dev. Proxy your Vite/webpack dev server with hot reload, or serve a production build with live config changes.
+    Install the [Vite](/reference/plugins/vite/) or [Next.js](/reference/plugins/next/) plugin for zero-config `dev` support, or the CLI wraps the gateway to proxy any dev server with hot reload.
   </Card>
   <Card title="Any Framework" icon="puzzle">
     First-party adapters for React, Vue, and Svelte. A zero-dependency TypeScript SDK works with anything — Angular, vanilla JS, or your custom setup.
@@ -89,7 +89,7 @@ REP operates at the **infrastructure layer** — no build-tool plugins, no frame
 | Fetch `/config.json` at runtime | -- | -- | -- | -- | -- |
 | `window.__ENV__` via shell script | -- | -- | -- | -- | -- |
 | Build-tool plugins (dotenv, etc.) | -- | -- | -- | -- | -- |
-| **REP** | **3-tier** | **AES-256-GCM** | **HMAC + SRI** | **SSE** | **~6MB Go** |
+| **REP** | **3-tier** | **AES-256-GCM** | **HMAC + SRI** | **SSE** | **~7MB Go** |
 
 ## Quick Example
 
@@ -148,7 +148,7 @@ REP_SERVER_DB_PASSWORD=never-reaches-browser
 
 <CardGrid>
   <Card title="Gateway" icon="rocket">
-    Go binary (~6MB). Zero dependencies. `FROM scratch` compatible. Proxy or embedded mode.
+    Go binary (~7MB). Zero dependencies. `FROM scratch` compatible. Proxy or embedded mode.
   </Card>
   <Card title="SDK" icon="document">
     TypeScript. Zero runtime deps. ~1.5KB gzipped. Synchronous `get()`, async `getSecure()`.
@@ -159,6 +159,12 @@ REP_SERVER_DB_PASSWORD=never-reaches-browser
   <Card title="Adapters" icon="puzzle">
     First-party React, Vue, and Svelte adapters with hot-reload-aware hooks and stores.
   </Card>
+  <Card title="Build-Tool Plugins" icon="setting">
+    Vite (`repPlugin()`) and Next.js (`RepScript`) plugins inject the same payload during `npm run dev` — no gateway needed locally.
+  </Card>
+  <Card title="Codemod" icon="magnifier">
+    `npx @rep-protocol/codemod` automates migration from Vite, CRA, or Next.js `process.env`/`import.meta.env` reads to `rep.get()`.
+  </Card>
 </CardGrid>
 
 ## Specification Status
diff --git a/docs/src/content/docs/quick-start.mdx b/docs/src/content/docs/quick-start.mdx
index 204da5f..d884ec4 100644
--- a/docs/src/content/docs/quick-start.mdx
+++ b/docs/src/content/docs/quick-start.mdx
@@ -111,6 +111,39 @@ REP_PUBLIC_API_URL=https://api.example.com \
 
 The gateway intercepts `text/html` responses, injects the `<script>` tag, and passes everything else through unmodified.
 
+## Dev mode — file watch hot reload
+
+For local development, point the gateway at a `.env.local` file and let it watch for changes automatically — no signals, no restarts:
+
+```bash
+# .env.local
+REP_PUBLIC_API_URL=http://localhost:3001
+REP_PUBLIC_FEATURE_FLAGS=dark-mode
+REP_SENSITIVE_ANALYTICS_KEY=ak_dev_abc123
+```
+
+```bash
+./rep-gateway --mode embedded --static-dir ./dist \
+  --hot-reload \
+  --hot-reload-mode=file_watch \
+  --env-file=.env.local \
+  --watch-path=.env.local
+```
+
+Edit `.env.local` and save — the gateway picks up the changes immediately, re-encrypts sensitive vars with a fresh ephemeral key, and pushes a reload event over `/rep/changes` (SSE). Components using `rep.onChange()` re-render automatically without a browser refresh.
+
+<Aside type="tip">
+  The CLI dev command handles this automatically: `npx @rep-protocol/cli dev --proxy http://localhost:5173` starts the gateway with file watch mode already enabled. See the [Local Development guide](/guides/development/).
+</Aside>
+
+## No build step? No framework?
+
+REP works the same way with a single `index.html` and no bundler — see the [Simple HTML example](/examples/simple-html/) for the SDK loaded straight from a CDN.
+
+## Build-tool plugins for local dev
+
+Running `vite dev` or `next dev` without the gateway? Install the [Vite](/reference/plugins/vite/) or [Next.js](/reference/plugins/next/) plugin to get the same injected payload during development — no second terminal, no gateway binary needed locally.
+
 ## What's next?
 
 - [Add a manifest file](/guides/manifest/) for startup validation and TypeScript type generation
diff --git a/docs/src/content/docs/reference/plugins/next.mdx b/docs/src/content/docs/reference/plugins/next.mdx
new file mode 100644
index 0000000..16da353
--- /dev/null
+++ b/docs/src/content/docs/reference/plugins/next.mdx
@@ -0,0 +1,78 @@
+---
+title: Next.js Plugin Reference — @rep-protocol/next
+description: API reference for the REP Next.js plugin. RepScript props, the session-key route handler, and how the plugin behaves in dev vs. production builds.
+---
+
+import { Aside } from '@astrojs/starlight/components';
+
+```bash
+npm install -D @rep-protocol/next
+```
+
+```tsx
+// app/layout.tsx
+import type { ReactNode } from 'react';
+import { RepScript } from '@rep-protocol/next';
+
+export default function RootLayout({ children }: { children: ReactNode }) {
+  return (
+    <html>
+      <head><RepScript /></head>
+      <body>{children}</body>
+    </html>
+  );
+}
+```
+
+## `<RepScript />`
+
+```typescript
+interface RepScriptProps {
+  env?: string;
+  strict?: boolean;
+}
+
+function RepScript(props?: RepScriptProps): React.ReactElement | null;
+```
+
+A React Server Component. Renders `<script id="__rep__">` during `next dev`; renders `null` in production.
+
+| Prop | Type | Default | Description |
+|---|---|---|---|
+| `env` | `string` | `'.env.local'` | Path to the env file, resolved relative to `process.cwd()`. Same `REP_PUBLIC_*` / `REP_SENSITIVE_*` / `REP_SERVER_*` classification as the gateway. |
+| `strict` | `boolean` | `false` | Turn guardrail warnings into thrown errors instead of `console.warn`. |
+
+```tsx
+<RepScript env=".env.development" strict />
+```
+
+## `GET` — session-key route handler
+
+```ts
+// app/api/rep/session-key/route.ts
+export { GET } from '@rep-protocol/next/session-key';
+```
+
+Only needed if you read `REP_SENSITIVE_*` variables with `rep.getSecure()` / `useRepSecure()` during development. Returns the ephemeral AES key as JSON, matching the gateway's `/rep/session-key` response shape.
+
+<Aside type="caution">
+  **Returns 404 in production** (`NODE_ENV === 'production'`). This dev handler has no rate limiting, no single-use token enforcement, and no CORS origin checking — the gateway's `/rep/session-key` endpoint is the only one hardened for production use. Don't route around the 404 by hand-rolling your own version of this handler.
+</Aside>
+
+## Behavior
+
+- **Renders nothing in production.** `NODE_ENV === 'production'` (which `next build` sets automatically) makes `RepScript` return `null`. This also prevents build-time env vars from being baked into the static output — the whole point of REP is that config is resolved after the build, not during it.
+- **Server Component only.** `RepScript` reads the filesystem (`env`) and generates keys server-side; it cannot be used in a Client Component. Consume the injected payload from Client Components via `rep.get()` / `useRep()` as usual — the SDK reads the DOM, not React context.
+- **Script content is Go-escaped** (`<`, `>`, `&` → `<`, `>`, `&`) before being written via `dangerouslySetInnerHTML`, preventing `</script>` breakout from untrusted env values. The tag still carries `type="application/json"`, so the browser never executes it.
+- **Ephemeral keys are process-scoped**, held in a module-level singleton (`getOrCreateKeys()`) so the same key survives across route handler invocations within one `next dev` process.
+- **Byte-identical payload** to the Go gateway and the Vite plugin (sorted keys, same HMAC + SRI format) — `rep.verify()` and `rep.meta()` behave the same regardless of which one produced the payload.
+
+## App Router only
+
+`RepScript` is a Server Component and requires the App Router (`app/`). The Pages Router (`pages/`) doesn't support React Server Components — use the [CLI dev server](/guides/development/#option-d-cli-dev-server-full-fidelity) or [mock payload](/guides/development/#option-c-mock-payload-in-html) approach instead.
+
+## See also
+
+- [Local Development guide](/guides/development/) — where this fits alongside the CLI dev server and mock-payload approaches
+- [Next.js — Proxy Mode example](/examples/nextjs-proxy/) — production deployment behind the gateway
+- [Vite plugin reference](/reference/plugins/vite/) — the equivalent for Vite
diff --git a/docs/src/content/docs/reference/plugins/vite.mdx b/docs/src/content/docs/reference/plugins/vite.mdx
new file mode 100644
index 0000000..3617ca2
--- /dev/null
+++ b/docs/src/content/docs/reference/plugins/vite.mdx
@@ -0,0 +1,62 @@
+---
+title: Vite Plugin Reference — @rep-protocol/vite
+description: API reference for the REP Vite plugin. repPlugin() options, dev-mode behavior, the /rep/session-key middleware, and how it differs from the production gateway.
+---
+
+import { Aside } from '@astrojs/starlight/components';
+
+```bash
+npm install -D @rep-protocol/vite
+```
+
+```ts
+// vite.config.ts
+import { defineConfig } from 'vite';
+import { repPlugin } from '@rep-protocol/vite';
+
+export default defineConfig({
+  plugins: [repPlugin()],
+});
+```
+
+## `repPlugin(options?)`
+
+```typescript
+interface RepPluginOptions {
+  env?: string;
+  strict?: boolean;
+}
+
+function repPlugin(options?: RepPluginOptions): Plugin;
+```
+
+| Option | Type | Default | Description |
+|---|---|---|---|
+| `env` | `string` | `'.env.local'` | Path to the env file, relative to the project root. Classified the same way as the gateway: `REP_PUBLIC_*`, `REP_SENSITIVE_*`, `REP_SERVER_*` prefixes. |
+| `strict` | `boolean` | `false` | Turn guardrail warnings into thrown errors instead of console warnings. |
+
+```ts
+repPlugin({
+  env: '.env.development',
+  strict: true,
+})
+```
+
+## Behavior
+
+- **Dev only.** The plugin only runs during `vite dev` (`configureServer` hook). It does nothing during `vite build` — production HTML ships with no `__rep__` script tag, and the gateway injects it at serve time instead.
+- **Injects `<script id="__rep__">`** into every HTML response via `transformIndexHtml`, using the same JSON shape, HMAC integrity token, and SRI hash format as the Go gateway. `rep.get()`, `rep.getSecure()`, and `rep.verify()` behave identically whether the payload came from the plugin or the gateway.
+- **Watches the env file.** Changes to the file at `env` trigger a full page reload (`server.ws.send({ type: 'full-reload' })`) — no restart needed.
+- **Serves `GET /rep/session-key`** as dev middleware, so `rep.getSecure()` works without a separate gateway process. Unlike the gateway's endpoint, this dev version has no rate limiting or single-use enforcement — it's not meant to run in production.
+- **Runs guardrails** (entropy + known secret-format scanning) on every `REP_PUBLIC_*` value at each rebuild, logging warnings through the Vite server logger.
+- **Ephemeral keys per dev-server start.** A fresh AES key and HMAC secret are generated when the dev server boots and again on every env-file change — matching the gateway's "new keys on every restart" behavior.
+
+<Aside type="caution">
+  The plugin produces byte-identical payload JSON to the gateway (sorted keys, Go-style `&lt;&gt;&amp;` escaping), but it is a development convenience, not a production component. Don't run `vite preview` with an unstripped `.env.local` and call it deployed — the gateway is the only thing that should inject config in production.
+</Aside>
+
+## See also
+
+- [Local Development guide](/guides/development/) — where this fits alongside the CLI dev server and mock-payload approaches
+- [React framework guide](/frameworks/react/) — using the plugin with `useRep()` / `useRepSecure()`
+- [Next.js plugin reference](/reference/plugins/next/) — the equivalent for Next.js
diff --git a/docs/src/content/docs/spec/rfc-0001.mdx b/docs/src/content/docs/spec/rfc-0001.mdx
index 821e7ab..f7ba2bc 100644
--- a/docs/src/content/docs/spec/rfc-0001.mdx
+++ b/docs/src/content/docs/spec/rfc-0001.mdx
@@ -47,7 +47,7 @@ The full specification covers 14 sections. Key topics are documented separately
 | R3 | **Integrity-verified.** The injected configuration must be verifiable by the client SDK. |
 | R4 | **Synchronously accessible.** Public variables must be available immediately on page load. |
 | R5 | **Zero application dependencies.** The client SDK must have zero runtime dependencies. |
-| R6 | **Minimal footprint.** Gateway under 5MB, SDK under 2KB gzipped. |
+| R6 | **Minimal footprint.** Gateway under 8MB, SDK under 2KB gzipped. |
 | R7 | **Container-native.** Must integrate with Docker and Kubernetes via standard env vars. |
 | R8 | **Incrementally adoptable.** Must not require all-or-nothing migration. |
 | R9 | **Observable.** Must emit structured logs and metrics for injection events. |
diff --git a/examples/no-manifest.md b/examples/no-manifest.md
index d725f19..43feb7b 100644
--- a/examples/no-manifest.md
+++ b/examples/no-manifest.md
@@ -1,172 +1,18 @@
 # Using REP Without a Manifest
 
 The `.rep.yaml` manifest is entirely optional. The gateway works with nothing
-but environment variables — the naming convention **is** the configuration.
+but environment variables — the `REP_PUBLIC_` / `REP_SENSITIVE_` /
+`REP_SERVER_` prefix convention **is** the configuration.
 
-This guide shows the minimum viable setup: no manifest file, no CLI tooling,
-no configuration step. Just rename your vars, add the SDK, and run the gateway.
+The full walkthrough — renaming vars, installing the SDK, running the
+gateway, changing config without a rebuild, and dev-mode file-watch hot
+reload — lives on the docs site:
 
----
+**[rep-protocol.dev/quick-start](https://rep-protocol.dev/quick-start/)**
 
-## How it works
-
-The gateway classifies every `REP_*` variable it finds in the environment by
-prefix. Nothing to declare, nothing to register:
-
-| Env var prefix | Tier | In the browser |
-|---|---|---|
-| `REP_PUBLIC_*` | PUBLIC | Plaintext in `<script id="__rep__">`. Read with `rep.get()`. |
-| `REP_SENSITIVE_*` | SENSITIVE | AES-256-GCM encrypted. Decrypt with `await rep.getSecure()`. |
-| `REP_SERVER_*` | SERVER | Never leaves the gateway process. |
-| `REP_GATEWAY_*` | Config | Gateway settings. Not injected into the app. |
-
-That's the entire protocol. No file needed to make it work.
-
----
-
-## Step 1 — Rename your env vars
-
-If you're migrating from Vite or Create React App, rename your existing vars:
-
-```bash
-# Before (Vite)            → After (REP)
-VITE_API_URL               → REP_PUBLIC_API_URL
-VITE_FEATURE_FLAGS         → REP_PUBLIC_FEATURE_FLAGS
-
-# Before (CRA)             → After (REP)
-REACT_APP_API_URL          → REP_PUBLIC_API_URL
-
-# Anything that should stay encrypted
-REACT_APP_ANALYTICS_KEY    → REP_SENSITIVE_ANALYTICS_KEY
-
-# Anything that should never reach the browser
-DB_PASSWORD                → REP_SERVER_DB_PASSWORD
-```
-
-**Nothing changes in your build.** The Vite/CRA references will break (that's
-the point — you'll update them in Step 2).
-
----
-
-## Step 2 — Install the SDK and update your reads
-
-```bash
-npm install @rep-protocol/sdk
-```
-
-Replace every `import.meta.env.VITE_X` / `process.env.REACT_APP_X` call:
-
-```ts
-import { rep } from '@rep-protocol/sdk';
-
-// Was: import.meta.env.VITE_API_URL
-const apiUrl = rep.get('API_URL');
-
-// Was: import.meta.env.VITE_API_URL ?? 'http://localhost:3001'
-const apiUrl = rep.get('API_URL', 'http://localhost:3001');
-
-// Was: process.env.REACT_APP_ANALYTICS_KEY  (sensitive — encrypted)
-const key = await rep.getSecure('ANALYTICS_KEY');
-```
-
-`rep.get()` is synchronous — the SDK reads the payload from the DOM on import,
-before your first component renders. No loading state, no Suspense.
-
----
-
-## Step 3 — Build your app
-
-Nothing changes in your build command. The gateway injects config at request
-time, after the build:
-
-```bash
-# Vite
-vite build
-
-# Create React App
-react-scripts build
-
-# Next.js (static export)
-next build && next export
-```
-
-The output `dist/` (or `build/`, `out/`) is environment-agnostic. The same
-artifact goes to every environment.
-
----
-
-## Step 4 — Run the gateway
-
-Download the latest binary for your platform from
-[GitHub Releases](https://github.com/ruachtech/rep/releases), then:
-
-```bash
-# Embedded mode: gateway serves your static files directly.
-REP_PUBLIC_API_URL=https://api.example.com \
-REP_PUBLIC_FEATURE_FLAGS=dark-mode,new-checkout \
-REP_SENSITIVE_ANALYTICS_KEY=ak_live_abc123 \
-./rep-gateway --mode embedded --static-dir ./dist
-```
-
-Or with Docker (no binary download needed):
-
-```bash
-docker run --rm -p 8080:8080 \
-  -e REP_PUBLIC_API_URL=https://api.example.com \
-  -e REP_PUBLIC_FEATURE_FLAGS=dark-mode,new-checkout \
-  -e REP_SENSITIVE_ANALYTICS_KEY=ak_live_abc123 \
-  -v "$(pwd)/dist:/static:ro" \
-  ghcr.io/ruachtech/rep/gateway:latest \
-  --mode embedded --static-dir /static
-```
-
-Open `http://localhost:8080` — done. The gateway injected your vars into every
-HTML response without modifying the build artifact.
-
----
-
-## Changing config without rebuilding
-
-Stop the gateway. Restart with different values. The app picks them up
-immediately — no `npm run build`, no CI pipeline, no new image:
-
-```bash
-# Switch to production config
-REP_PUBLIC_API_URL=https://api.prod.example.com \
-REP_PUBLIC_FEATURE_FLAGS=dark-mode \
-REP_SENSITIVE_ANALYTICS_KEY=ak_live_prod_xyz \
-./rep-gateway --mode embedded --static-dir ./dist
-```
-
-Same `dist/` folder. Different runtime config. This is the core proposition.
-
----
-
-## Proxy mode (existing nginx / Caddy upstream)
-
-If you already have a static file server, run the gateway in front of it
-instead of replacing it:
-
-```bash
-# Proxy mode: gateway injects into HTML responses from the upstream.
-REP_PUBLIC_API_URL=https://api.example.com \
-./rep-gateway --mode proxy --upstream localhost:80
-```
-
-The gateway intercepts `text/html` responses, injects the `<script>` tag, and
-passes everything else through unmodified.
-
----
-
-## When to add a `.rep.yaml` manifest
-
-The manifest is additive. You can start without it and add it when you need:
-
-- **Startup validation** — fail fast if a required variable is missing
-- **Type constraints** — enforce `url`, `number`, `enum`, `csv` shapes
-- **TypeScript types** — `rep typegen` generates `get()` / `getSecure()`
-  overloads keyed to your actual variable names
-- **Documentation** — a single source of truth for every variable the app uses
-
-See [`examples/.rep.yaml`](./.rep.yaml) for a full annotated example, or the
-[todo-react example](./todo-react/README.md) for a complete app that uses one.
+When you outgrow prefix-only config, add a manifest for startup validation
+and generated TypeScript types — see
+[`examples/.rep.yaml`](./.rep.yaml) for a full annotated example, the
+[todo-react example](./todo-react/README.md) for a complete app that uses
+one, or the [manifest guide](https://rep-protocol.dev/guides/manifest/) on
+the docs site.
diff --git a/gateway/README.md b/gateway/README.md
index eefd239..e28d32d 100644
--- a/gateway/README.md
+++ b/gateway/README.md
@@ -7,7 +7,7 @@ It reads `REP_*` environment variables at startup, classifies them into PUBLIC /
 ## Features
 
 - **Zero dependencies** — uses only the Go standard library.
-- **~3–5MB binary** — statically compiled, `FROM scratch` compatible.
+- **~7MB binary** — statically compiled, `FROM scratch` compatible.
 - **Two modes** — reverse proxy (in front of nginx/caddy) or embedded file server.
 - **Three-tier security** — PUBLIC (plaintext), SENSITIVE (AES-256-GCM encrypted), SERVER (never sent to client).
 - **Integrity verification** — HMAC-SHA256 signature + SRI hash on every payload.
@@ -50,7 +50,7 @@ make build
 # Build for Linux (Docker/K8s target)
 make build-linux
 
-# Build Docker image (~5MB)
+# Build Docker image (~7MB)
 make docker
 ```
 
diff --git a/spec/REP-RFC-0001.md b/spec/REP-RFC-0001.md
index 4531cb3..01ec66f 100644
--- a/spec/REP-RFC-0001.md
+++ b/spec/REP-RFC-0001.md
@@ -54,7 +54,7 @@ REP is designed to satisfy the following requirements:
 | R3 | **Integrity-verified.** The injected configuration must be verifiable by the client SDK. |
 | R4 | **Synchronously accessible.** Public variables must be available immediately on page load without async operations. |
 | R5 | **Zero application dependencies.** The client SDK must have zero runtime dependencies. |
-| R6 | **Minimal footprint.** The gateway binary must be statically compilable and under 5MB. The client SDK must be under 2KB gzipped. |
+| R6 | **Minimal footprint.** The gateway binary must be statically compilable and under 8MB. The client SDK must be under 2KB gzipped. |
 | R7 | **Container-native.** Must integrate with Docker, Kubernetes, and OCI-compliant runtimes via standard environment variables. |
 | R8 | **Incrementally adoptable.** Must not require an all-or-nothing migration. |
 | R9 | **Observable.** Must emit structured logs and metrics for config injection events. |