@lastshotlabs/bunshot 0.0.9 → 0.0.13

package/dist/routes/auth.js

@@ -1,4 +1,4 @@
-import { createRoute } from "@hono/zod-openapi";
+import { createRoute, withSecurity } from "../lib/createRoute";
 import { z } from "zod";
 import { setCookie, getCookie, deleteCookie } from "hono/cookie";
 import * as AuthService from "../services/auth";
@@ -9,10 +9,17 @@ import { isLimited, trackAttempt, bustAuthLimit } from "../lib/authRateLimit";
 import { getAuthAdapter } from "../lib/authAdapter";
 import { createRouter } from "../lib/context";
 import { getVerificationToken, deleteVerificationToken, createVerificationToken } from "../lib/emailVerification";
+import { createResetToken, consumeResetToken } from "../lib/resetPassword";
 import { getUserSessions, deleteSession } from "../lib/session";
 const isProd = process.env.NODE_ENV === "production";
-const TokenResponse = z.object({ token: z.string(), emailVerified: z.boolean().optional() });
-const ErrorResponse = z.object({ error: z.string() });
+const TokenResponse = z.object({
+    token: z.string().describe("JWT session token. Also set as an HttpOnly session cookie."),
+    userId: z.string().describe("Unique user ID."),
+    email: z.string().optional().describe("User's email address (present when primaryField is 'email')."),
+    emailVerified: z.boolean().optional().describe("Whether the email address has been verified (present when emailVerification is configured)."),
+    googleLinked: z.boolean().optional().describe("Whether a Google OAuth account is linked to this user."),
+}).openapi("TokenResponse");
+const ErrorResponse = z.object({ error: z.string().describe("Human-readable error message.") }).openapi("ErrorResponse");
 const tags = ["Auth"];
 const cookieOptions = {
     httpOnly: true,
@@ -22,7 +29,7 @@ const cookieOptions = {
     maxAge: 60 * 60 * 24 * 7, // 7 days
 };
 const clientIp = (xff, xri) => (xff ? xff.split(",")[0]?.trim() : undefined) ?? xri ?? undefined;
-export const createAuthRouter = ({ primaryField, emailVerification, rateLimit }) => {
+export const createAuthRouter = ({ primaryField, emailVerification, passwordReset, rateLimit }) => {
     const router = createRouter();
     const RegisterSchema = makeRegisterSchema(primaryField);
     const LoginSchema = makeLoginSchema(primaryField);
@@ -33,16 +40,20 @@ export const createAuthRouter = ({ primaryField, emailVerification, rateLimit })
     const registerOpts = { windowMs: rateLimit?.register?.windowMs ?? 60 * 60 * 1000, max: rateLimit?.register?.max ?? 5 };
     const verifyOpts = { windowMs: rateLimit?.verifyEmail?.windowMs ?? 15 * 60 * 1000, max: rateLimit?.verifyEmail?.max ?? 10 };
     const resendOpts = { windowMs: rateLimit?.resendVerification?.windowMs ?? 60 * 60 * 1000, max: rateLimit?.resendVerification?.max ?? 3 };
+    const forgotOpts = { windowMs: rateLimit?.forgotPassword?.windowMs ?? 15 * 60 * 1000, max: rateLimit?.forgotPassword?.max ?? 5 };
+    const resetOpts = { windowMs: rateLimit?.resetPassword?.windowMs ?? 15 * 60 * 1000, max: rateLimit?.resetPassword?.max ?? 10 };
     router.openapi(createRoute({
         method: "post",
         path: "/auth/register",
+        summary: "Register a new account",
+        description: "Creates a new user account and returns a JWT session token. The token is also set as an HttpOnly session cookie. Rate-limited by IP.",
         tags,
-        request: { body: { content: { "application/json": { schema: RegisterSchema } } } },
+        request: { body: { content: { "application/json": { schema: RegisterSchema } }, description: "Registration credentials." } },
         responses: {
-            201: { content: { "application/json": { schema: TokenResponse } }, description: "Registered" },
-            400: { content: { "application/json": { schema: ErrorResponse } }, description: "Validation error" },
+            201: { content: { "application/json": { schema: TokenResponse } }, description: "Account created. Returns a session token." },
+            400: { content: { "application/json": { schema: ErrorResponse } }, description: "Validation error (e.g. missing field, password too short)." },
             409: { content: { "application/json": { schema: ErrorResponse } }, description: alreadyRegisteredMsg },
-            429: { content: { "application/json": { schema: ErrorResponse } }, description: "Too many attempts" },
+            429: { content: { "application/json": { schema: ErrorResponse } }, description: "Too many registration attempts from this IP. Try again later." },
         },
     }), async (c) => {
         const ip = clientIp(c.req.header("x-forwarded-for"), c.req.header("x-real-ip")) ?? "unknown";
@@ -55,20 +66,22 @@ export const createAuthRouter = ({ primaryField, emailVerification, rateLimit })
             ipAddress: ip !== "unknown" ? ip : undefined,
             userAgent: c.req.header("user-agent") ?? undefined,
         };
-        const token = await AuthService.register(identifier, body.password, metadata);
-        setCookie(c, COOKIE_TOKEN, token, cookieOptions);
-        return c.json({ token }, 201);
+        const result = await AuthService.register(identifier, body.password, metadata);
+        setCookie(c, COOKIE_TOKEN, result.token, cookieOptions);
+        return c.json(result, 201);
     });
     router.openapi(createRoute({
         method: "post",
         path: "/auth/login",
+        summary: "Log in",
+        description: "Authenticates with credentials and returns a JWT session token. The token is also set as an HttpOnly session cookie. Failed attempts are rate-limited per identifier.",
         tags,
-        request: { body: { content: { "application/json": { schema: LoginSchema } } } },
+        request: { body: { content: { "application/json": { schema: LoginSchema } }, description: "Login credentials." } },
         responses: {
-            200: { content: { "application/json": { schema: TokenResponse } }, description: "Logged in" },
-            401: { content: { "application/json": { schema: ErrorResponse } }, description: "Invalid credentials" },
-            403: { content: { "application/json": { schema: ErrorResponse } }, description: "Email not verified" },
-            429: { content: { "application/json": { schema: ErrorResponse } }, description: "Too many attempts" },
+            200: { content: { "application/json": { schema: TokenResponse } }, description: "Authenticated. Returns a session token." },
+            401: { content: { "application/json": { schema: ErrorResponse } }, description: "Invalid credentials." },
+            403: { content: { "application/json": { schema: ErrorResponse } }, description: "Email not verified. Verification is required before login." },
+            429: { content: { "application/json": { schema: ErrorResponse } }, description: "Too many failed login attempts for this identifier. Try again later." },
         },
     }), async (c) => {
         const body = c.req.valid("json");
@@ -93,27 +106,29 @@ export const createAuthRouter = ({ primaryField, emailVerification, rateLimit })
         }
     });
     router.use("/auth/me", userAuth);
-    router.openapi(createRoute({
+    router.openapi(withSecurity(createRoute({
         method: "get",
         path: "/auth/me",
+        summary: "Get current user",
+        description: "Returns the authenticated user's profile. Requires a valid session via cookie or x-user-token header.",
         tags,
         responses: {
             200: {
                 content: {
                     "application/json": {
                         schema: z.object({
-                            userId: z.string(),
-                            email: z.string().optional(),
-                            emailVerified: z.boolean().optional(),
-                            googleLinked: z.boolean().optional(),
+                            userId: z.string().describe("Unique user ID."),
+                            email: z.string().optional().describe("User's email address."),
+                            emailVerified: z.boolean().optional().describe("Whether the email address has been verified."),
+                            googleLinked: z.boolean().optional().describe("Whether a Google OAuth account is linked."),
                         }),
                     },
                 },
-                description: "Current user",
+                description: "Authenticated user's profile.",
             },
-            401: { content: { "application/json": { schema: ErrorResponse } }, description: "Unauthorized" },
+            401: { content: { "application/json": { schema: ErrorResponse } }, description: "No valid session." },
         },
-    }), async (c) => {
+    }), { cookieAuth: [] }, { userToken: [] }), async (c) => {
         const authUserId = c.get("authUserId");
         const adapter = getAuthAdapter();
         const user = adapter.getUser ? await adapter.getUser(authUserId) : null;
@@ -121,17 +136,20 @@ export const createAuthRouter = ({ primaryField, emailVerification, rateLimit })
         return c.json({ userId: authUserId, email: user?.email, emailVerified: user?.emailVerified, googleLinked }, 200);
     });
     router.use("/auth/set-password", userAuth);
-    router.openapi(createRoute({
+    router.openapi(withSecurity(createRoute({
         method: "post",
         path: "/auth/set-password",
+        summary: "Set or update password",
+        description: "Sets or updates the password for the authenticated user. Useful for OAuth-only users who want to add a password. Requires a valid session.",
         tags,
-        request: { body: { content: { "application/json": { schema: z.object({ password: z.string().min(8) }) } } } },
+        request: { body: { content: { "application/json": { schema: z.object({ password: z.string().min(8).describe("New password. Minimum 8 characters.") }) } }, description: "New password." } },
         responses: {
-            200: { content: { "application/json": { schema: z.object({ message: z.string() }) } }, description: "Password set" },
-            400: { content: { "application/json": { schema: ErrorResponse } }, description: "Validation error" },
-            501: { content: { "application/json": { schema: ErrorResponse } }, description: "Not supported by adapter" },
+            200: { content: { "application/json": { schema: z.object({ message: z.string() }) } }, description: "Password updated successfully." },
+            400: { content: { "application/json": { schema: ErrorResponse } }, description: "Validation error (e.g. password too short)." },
+            401: { content: { "application/json": { schema: ErrorResponse } }, description: "No valid session." },
+            501: { content: { "application/json": { schema: ErrorResponse } }, description: "The configured auth adapter does not support setPassword." },
         },
-    }), async (c) => {
+    }), { cookieAuth: [] }, { userToken: [] }), async (c) => {
         const adapter = getAuthAdapter();
         if (!adapter.setPassword) {
             return c.json({ error: "Auth adapter does not support setPassword" }, 501);
@@ -145,9 +163,11 @@ export const createAuthRouter = ({ primaryField, emailVerification, rateLimit })
     router.openapi(createRoute({
         method: "post",
         path: "/auth/logout",
+        summary: "Log out",
+        description: "Invalidates the current session and clears the session cookie. Safe to call even without an active session.",
         tags,
         responses: {
-            200: { content: { "application/json": { schema: z.object({ message: z.string() }) } }, description: "Logged out" },
+            200: { content: { "application/json": { schema: z.object({ message: z.string() }) } }, description: "Logged out. Session is invalidated and cookie is cleared." },
         },
     }), async (c) => {
         const token = getCookie(c, COOKIE_TOKEN) ?? c.req.header(HEADER_USER_TOKEN) ?? null;
@@ -160,12 +180,14 @@ export const createAuthRouter = ({ primaryField, emailVerification, rateLimit })
         router.openapi(createRoute({
             method: "post",
             path: "/auth/verify-email",
+            summary: "Verify email address",
+            description: "Consumes a single-use email verification token and marks the account as verified. The token is delivered by the `emailVerification.onSend` callback configured in CreateAppConfig. Rate-limited by IP.",
             tags,
-            request: { body: { content: { "application/json": { schema: z.object({ token: z.string() }) } } } },
+            request: { body: { content: { "application/json": { schema: z.object({ token: z.string().describe("Single-use verification token received via email.") }) } }, description: "Verification token." } },
             responses: {
-                200: { content: { "application/json": { schema: z.object({ message: z.string() }) } }, description: "Email verified" },
-                400: { content: { "application/json": { schema: ErrorResponse } }, description: "Invalid or expired token" },
-                429: { content: { "application/json": { schema: ErrorResponse } }, description: "Too many attempts" },
+                200: { content: { "application/json": { schema: z.object({ message: z.string() }) } }, description: "Email verified successfully." },
+                400: { content: { "application/json": { schema: ErrorResponse } }, description: "Invalid or expired verification token." },
+                429: { content: { "application/json": { schema: ErrorResponse } }, description: "Too many verification attempts from this IP. Try again later." },
             },
         }), async (c) => {
             const ip = c.req.header("x-forwarded-for") ?? "unknown";
@@ -183,17 +205,20 @@ export const createAuthRouter = ({ primaryField, emailVerification, rateLimit })
             return c.json({ message: "Email verified" }, 200);
         });
         router.use("/auth/resend-verification", userAuth);
-        router.openapi(createRoute({
+        router.openapi(withSecurity(createRoute({
             method: "post",
             path: "/auth/resend-verification",
+            summary: "Resend verification email",
+            description: "Sends a new verification email to the authenticated user's address. Returns 400 if already verified. Rate-limited per user. Requires a valid session.",
             tags,
             responses: {
-                200: { content: { "application/json": { schema: z.object({ message: z.string() }) } }, description: "Verification email sent" },
-                400: { content: { "application/json": { schema: ErrorResponse } }, description: "Already verified" },
-                429: { content: { "application/json": { schema: ErrorResponse } }, description: "Too many attempts" },
-                501: { content: { "application/json": { schema: ErrorResponse } }, description: "Not supported by adapter" },
+                200: { content: { "application/json": { schema: z.object({ message: z.string() }) } }, description: "Verification email sent." },
+                400: { content: { "application/json": { schema: ErrorResponse } }, description: "Email is already verified, or no email address on file." },
+                401: { content: { "application/json": { schema: ErrorResponse } }, description: "No valid session." },
+                429: { content: { "application/json": { schema: ErrorResponse } }, description: "Too many resend attempts for this user. Try again later." },
+                501: { content: { "application/json": { schema: ErrorResponse } }, description: "The configured auth adapter does not support email verification." },
             },
-        }), async (c) => {
+        }), { cookieAuth: [] }, { userToken: [] }), async (c) => {
             const adapter = getAuthAdapter();
             if (!adapter.getEmailVerified || !adapter.getUser) {
                 return c.json({ error: "Auth adapter does not support email verification" }, 501);
@@ -213,47 +238,139 @@ export const createAuthRouter = ({ primaryField, emailVerification, rateLimit })
             return c.json({ message: "Verification email sent" }, 200);
         });
     }
+    // Password reset routes — only mounted when passwordReset is configured and primaryField is "email"
+    if (passwordReset && primaryField === "email") {
+        router.openapi(createRoute({
+            method: "post",
+            path: "/auth/forgot-password",
+            summary: "Request password reset",
+            description: "Sends a password reset email if the address is registered. Always returns 200 regardless of whether the address exists, to prevent email enumeration. Rate-limited by both IP and email address.",
+            tags,
+            request: { body: { content: { "application/json": { schema: z.object({ email: z.string().email().describe("Email address to send the reset link to.") }) } }, description: "Email address for the account to reset." } },
+            responses: {
+                200: { content: { "application/json": { schema: z.object({ message: z.string() }) } }, description: "Request received. A reset email will be sent if the address is registered." },
+                400: { content: { "application/json": { schema: ErrorResponse } }, description: "Validation error (e.g. not a valid email address)." },
+                429: { content: { "application/json": { schema: ErrorResponse } }, description: "Too many attempts from this IP or for this email address. Try again later." },
+            },
+        }), async (c) => {
+            const ip = clientIp(c.req.header("x-forwarded-for"), c.req.header("x-real-ip")) ?? "unknown";
+            const { email } = c.req.valid("json");
+            // Rate-limit by both IP and email to prevent distributed email-bombing
+            const ipLimited = await trackAttempt(`forgot:ip:${ip}`, forgotOpts);
+            const emailLimited = await trackAttempt(`forgot:email:${email}`, forgotOpts);
+            if (ipLimited || emailLimited) {
+                return c.json({ error: "Too many attempts. Try again later." }, 429);
+            }
+            const adapter = getAuthAdapter();
+            const user = await adapter.findByEmail(email);
+            // Fire-and-forget: the response does not wait for token creation or email sending,
+            // which reduces obvious timing differences between registered and unregistered emails.
+            const msg = { message: "If that email is registered, a password reset link has been sent." };
+            if (user) {
+                void (async () => {
+                    try {
+                        const token = await createResetToken(user.id, email);
+                        await passwordReset.onSend(email, token);
+                    }
+                    catch (err) {
+                        console.error("Failed to send password reset email:", err);
+                    }
+                })();
+            }
+            return c.json(msg, 200);
+        });
+        router.openapi(createRoute({
+            method: "post",
+            path: "/auth/reset-password",
+            summary: "Reset password",
+            description: "Consumes a single-use reset token and sets a new password. All active sessions are revoked after a successful reset to invalidate any stolen JWTs. Rate-limited by IP.",
+            tags,
+            request: {
+                body: {
+                    content: {
+                        "application/json": {
+                            schema: z.object({
+                                token: z.string().describe("Single-use reset token received via email."),
+                                password: z.string().min(8).describe("New password. Minimum 8 characters."),
+                            }),
+                        },
+                    },
+                    description: "Reset token and new password.",
+                },
+            },
+            responses: {
+                200: { content: { "application/json": { schema: z.object({ message: z.string() }) } }, description: "Password reset. All sessions have been revoked." },
+                400: { content: { "application/json": { schema: ErrorResponse } }, description: "Validation error, or the reset token is invalid or expired." },
+                429: { content: { "application/json": { schema: ErrorResponse } }, description: "Too many reset attempts from this IP. Try again later." },
+                501: { content: { "application/json": { schema: ErrorResponse } }, description: "The configured auth adapter does not support setPassword." },
+            },
+        }), async (c) => {
+            const ip = clientIp(c.req.header("x-forwarded-for"), c.req.header("x-real-ip")) ?? "unknown";
+            if (await trackAttempt(`reset:${ip}`, resetOpts)) {
+                return c.json({ error: "Too many attempts. Try again later." }, 429);
+            }
+            const { token, password } = c.req.valid("json");
+            // consumeResetToken atomically gets and deletes — prevents concurrent replay
+            const entry = await consumeResetToken(token);
+            if (!entry)
+                return c.json({ error: "Invalid or expired reset token" }, 400);
+            const adapter = getAuthAdapter();
+            if (!adapter.setPassword) {
+                return c.json({ error: "Auth adapter does not support setPassword" }, 501);
+            }
+            const passwordHash = await Bun.password.hash(password);
+            await adapter.setPassword(entry.userId, passwordHash);
+            // Revoke all sessions so stolen JWTs can't stay valid after a reset
+            const sessions = await getUserSessions(entry.userId);
+            await Promise.all(sessions.map((s) => deleteSession(s.sessionId)));
+            return c.json({ message: "Password reset successfully" }, 200);
+        });
+    }
     // ---------------------------------------------------------------------------
     // Session management
     // ---------------------------------------------------------------------------
     const SessionInfoSchema = z.object({
-        sessionId: z.string(),
-        createdAt: z.number(),
-        lastActiveAt: z.number(),
-        expiresAt: z.number(),
-        ipAddress: z.string().optional(),
-        userAgent: z.string().optional(),
-        isActive: z.boolean(),
-    });
+        sessionId: z.string().describe("Unique session identifier (UUID)."),
+        createdAt: z.number().describe("Unix timestamp (ms) when the session was created."),
+        lastActiveAt: z.number().describe("Unix timestamp (ms) of the most recent authenticated request (updated when trackLastActive is enabled)."),
+        expiresAt: z.number().describe("Unix timestamp (ms) when the session expires."),
+        ipAddress: z.string().optional().describe("IP address of the client at session creation."),
+        userAgent: z.string().optional().describe("User-agent string of the client at session creation."),
+        isActive: z.boolean().describe("Whether the session is currently valid and unexpired."),
+    }).openapi("SessionInfo");
     router.use("/auth/sessions", userAuth);
     router.use("/auth/sessions/*", userAuth);
-    router.openapi(createRoute({
+    router.openapi(withSecurity(createRoute({
         method: "get",
         path: "/auth/sessions",
+        summary: "List sessions",
+        description: "Returns all sessions for the authenticated user. Includes inactive sessions when `sessionPolicy.includeInactiveSessions` is enabled. Requires a valid session.",
         tags,
         responses: {
             200: {
                 content: { "application/json": { schema: z.object({ sessions: z.array(SessionInfoSchema) }) } },
-                description: "List of sessions for the current user",
+                description: "Sessions belonging to the authenticated user.",
             },
-            401: { content: { "application/json": { schema: ErrorResponse } }, description: "Unauthorized" },
+            401: { content: { "application/json": { schema: ErrorResponse } }, description: "No valid session." },
         },
-    }), async (c) => {
+    }), { cookieAuth: [] }, { userToken: [] }), async (c) => {
         const userId = c.get("authUserId");
         const sessions = await getUserSessions(userId);
         return c.json({ sessions }, 200);
     });
-    router.openapi(createRoute({
+    router.openapi(withSecurity(createRoute({
         method: "delete",
         path: "/auth/sessions/{sessionId}",
+        summary: "Revoke a session",
+        description: "Revokes a specific session by ID. Users can only revoke their own sessions. Useful for 'sign out of other devices' flows. Requires a valid session.",
         tags,
-        request: { params: z.object({ sessionId: z.string() }) },
+        request: { params: z.object({ sessionId: z.string().describe("UUID of the session to revoke.") }) },
         responses: {
-            200: { content: { "application/json": { schema: z.object({ message: z.string() }) } }, description: "Session revoked" },
-            401: { content: { "application/json": { schema: ErrorResponse } }, description: "Unauthorized" },
-            404: { content: { "application/json": { schema: ErrorResponse } }, description: "Session not found" },
+            200: { content: { "application/json": { schema: z.object({ message: z.string() }) } }, description: "Session revoked successfully." },
+            401: { content: { "application/json": { schema: ErrorResponse } }, description: "No valid session." },
+            404: { content: { "application/json": { schema: ErrorResponse } }, description: "Session not found or does not belong to the authenticated user." },
         },
-    }), async (c) => {
+    }), { cookieAuth: [] }, { userToken: [] }), async (c) => {
         const userId = c.get("authUserId");
         const { sessionId } = c.req.valid("param");
         const sessions = await getUserSessions(userId);

package/dist/services/auth.d.ts

@@ -1,7 +1,14 @@
 import type { SessionMetadata } from "../lib/session";
-export declare const register: (identifier: string, password: string, metadata?: SessionMetadata) => Promise<string>;
+export declare const register: (identifier: string, password: string, metadata?: SessionMetadata) => Promise<{
+    token: string;
+    userId: string;
+    email?: string;
+}>;
 export declare const login: (identifier: string, password: string, metadata?: SessionMetadata) => Promise<{
     token: string;
+    userId: string;
+    email?: string;
     emailVerified?: boolean;
+    googleLinked?: boolean;
 }>;
 export declare const logout: (token: string | null) => Promise<void>;

package/dist/services/auth.js

@@ -27,7 +27,7 @@ export const register = async (identifier, password, metadata) => {
             console.error("[email-verification] Failed to send verification email:", e);
         }
     }
-    return token;
+    return { token, userId: user.id, email: identifier };
 };
 export const login = async (identifier, password, metadata) => {
     const adapter = getAuthAdapter();
@@ -41,6 +41,8 @@ export const login = async (identifier, password, metadata) => {
     while (await getActiveSessionCount(user.id) >= getMaxSessions()) {
         await evictOldestSession(user.id);
     }
+    const fullUser = adapter.getUser ? await adapter.getUser(user.id) : null;
+    const googleLinked = fullUser?.providerIds?.some((id) => id.startsWith("google:")) ?? false;
     const evConfig = getEmailVerificationConfig();
     if (evConfig && getPrimaryField() === "email" && adapter.getEmailVerified) {
         const verified = await adapter.getEmailVerified(user.id);
@@ -48,10 +50,10 @@ export const login = async (identifier, password, metadata) => {
             throw new HttpError(403, "Email not verified");
         }
         await createSession(user.id, token, sessionId, metadata);
-        return { token, emailVerified: verified };
+        return { token, userId: user.id, email: fullUser?.email, emailVerified: verified, googleLinked };
     }
     await createSession(user.id, token, sessionId, metadata);
-    return { token };
+    return { token, userId: user.id, email: fullUser?.email, googleLinked };
 };
 export const logout = async (token) => {
     if (token) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lastshotlabs/bunshot",
-  "version": "0.0.9",
+  "version": "0.0.13",
   "description": "Batteries-included Bun + Hono API framework — auth, sessions, rate limiting, WebSocket, queues, and OpenAPI docs out of the box",
   "repository": {
     "type": "git",
@@ -22,6 +22,18 @@
     ".": {
       "import": "./dist/index.js",
       "types": "./dist/index.d.ts"
+    },
+    "./mongo": {
+      "import": "./dist/entrypoints/mongo.js",
+      "types": "./dist/entrypoints/mongo.d.ts"
+    },
+    "./redis": {
+      "import": "./dist/entrypoints/redis.js",
+      "types": "./dist/entrypoints/redis.d.ts"
+    },
+    "./queue": {
+      "import": "./dist/entrypoints/queue.js",
+      "types": "./dist/entrypoints/queue.d.ts"
     }
   },
   "bin": {
@@ -41,17 +53,35 @@
     "@hono/zod-openapi": "1.2.2",
     "@scalar/hono-api-reference": "0.10.0",
     "arctic": "^3.7.0",
-    "bullmq": "^5.70.4",
-    "hono": "4.12.7",
-    "ioredis": "5.10.0",
-    "jose": "6.2.0",
-    "mongoose": "9.2.4",
-    "zod": "4.3.6"
+    "jose": "6.2.0"
+  },
+  "peerDependencies": {
+    "hono": ">=4.12 <5",
+    "zod": ">=4.0 <5",
+    "mongoose": ">=9.0 <10",
+    "ioredis": ">=5.0 <6",
+    "bullmq": ">=5.0 <6"
+  },
+  "peerDependenciesMeta": {
+    "mongoose": {
+      "optional": true
+    },
+    "ioredis": {
+      "optional": true
+    },
+    "bullmq": {
+      "optional": true
+    }
   },
   "devDependencies": {
     "@types/bun": "1.3.10",
     "tsc-alias": "^1.8.16",
-    "typescript": "^5.9.3"
+    "typescript": "^5.9.3",
+    "hono": ">=4.12",
+    "zod": ">=4.0",
+    "mongoose": "9.2.4",
+    "ioredis": "5.10.0",
+    "bullmq": "^5.70.4"
   },
   "publishConfig": {
     "access": "public"