@nxgt/janus-hono 0.1.0

package/docs/guide/routes.md

@@ -0,0 +1,243 @@
+# The routes of an application
+
+Every flow of `@nxgt/janus` as a Hono route. What this package adds is small on
+purpose — who the request belongs to, the cookie, the statuses — so each route
+below is `janus()`'s own call with Hono around it.
+
+## Wiring
+
+```ts
+import { janusErrors, session } from '@nxgt/janus-hono';
+import { Hono } from 'hono';
+import { auth } from './auth';
+
+export const app = new Hono();
+app.onError(janusErrors());
+```
+
+`janusErrors()` is what turns a `JanusError` thrown anywhere — in a route, or
+in `session()` — into its status. Without it, Hono answers 500 for all of
+them. To log what the server must fix — every error answered 5xx, an outage
+first — pass `report`; it runs before the answer:
+
+```ts
+app.onError(janusErrors({ report: (error) => logger.error(error) }));
+```
+
+To log every refusal too — why a sign-in failed, say — wrap it:
+
+```ts
+const answer = janusErrors();
+app.onError((error, c) => {
+	// `reason`, `login`, `slot`, `operation` and `cause` are here, never in the body
+	logger.error(error);
+	return answer(error, c);
+});
+```
+
+`janusErrors({ fallback })` hands every other error to `fallback`; without one,
+an `HTTPException` answers its own response and anything else is a logged
+500, as Hono does by default.
+
+### Binding the instances once
+
+Every function of this package takes `auth` or `access` first.
+`bindJanus()` binds them once — the same functions, the same types:
+
+```ts
+import { bindJanus } from '@nxgt/janus-hono';
+
+export const j = bindJanus({ auth, access });
+
+app.use(j.session(), j.provide());
+app.get('/me', j.session({ required: true }), (c) => c.json(c.var.user));
+app.post('/sign-in', async (c) => {
+	const user = j.sendSession(c, await auth.signIn(await c.req.json()));
+	return c.json({ id: user.id });
+});
+```
+
+The rest of this guide writes the unbound form; each call reads the same with
+`j.` and without its first argument.
+
+## Who the request belongs to
+
+```ts
+app.get('/', session(auth), (c) =>
+	c.text(c.var.user === null ? 'Hello' : `Hello ${c.var.user.name}`),
+);
+
+app.get('/account', session(auth, { required: true }), (c) =>
+	c.json(c.var.user), // typed: never null
+);
+```
+
+`session()` reads the session token the way `auth.authenticate` does —
+`Authorization: Bearer`, then `X-Session-Token`, then the cookie, **the first
+present wins** — and sets `c.var.user` and `c.var.session`.
+
+| The request presents | `c.var.user` | With `required: true` |
+| --- | --- | --- |
+| Nothing | `null` | 401, no body; the route never runs |
+| A lapsed, revoked or unknown session | `null` | 401 |
+| A session of an inactive user, or of another type than `type` | `null` | 401 |
+| A live session | the user | the user |
+| A session credential, while the store cannot answer | — `STORE_FAILED` is thrown | — 503 through `janusErrors()` |
+
+### For a whole app
+
+Hono types a chain, so `app.use(session(auth))` on its own line leaves the
+routes after it untyped. Declare the app with the `Env` instead:
+
+```ts
+import { type SessionEnv, session } from '@nxgt/janus-hono';
+
+const app = new Hono<SessionEnv<typeof auth>>();
+app.use(session(auth));
+app.get('/', (c) => c.json({ signedIn: c.var.user !== null }));
+```
+
+An app whose every route requires a user of one type says so in both places,
+and `c.var.user` is never `null` in it:
+
+```ts
+const rota = new Hono<SessionEnv<typeof auth, 'staff', true>>();
+rota.use(session(auth, { type: 'staff', required: true }));
+rota.get('/', (c) => c.json(rotaOf(c.var.user.username)));
+```
+
+### Renewal
+
+Every session is renewed by `authenticate` in passing once `renewAfter` has
+passed — `'1d'` by default, `false` for a fixed lifespan — and its expiry
+moves. `session()` sends the cookie again after the route ran, with the
+new `Expires` — to a request that presented the session as a cookie. A client
+using `Authorization: Bearer` is renewed too, keeps its session token, and is never
+handed a cookie. A route that sets the session cookie itself — `sendSession`
+after a sign-in, `signOut` — keeps its own: the renewal is not sent over it.
+
+## Sign-up and sign-in
+
+```ts
+import { sendSession } from '@nxgt/janus-hono';
+
+app.post('/sign-up', async (c) => {
+	const { email, name, password } = await c.req.json(); // validate the shape yourself
+	const user = sendSession(c, auth, await auth.signUp({ email, name, password }));
+	return c.json({ id: user.id }, 201);
+});
+
+app.post('/sign-in', async (c) => {
+	const { email, password } = await c.req.json();
+	const user = sendSession(c, auth, await auth.signIn({ email, password }));
+	return c.json({ id: user.id });
+});
+```
+
+`sendSession` answers the user it signed in, so a cookie client's route never
+holds the session token: it is in the `Set-Cookie`, and the body cannot leak
+it.
+
+The refusals need no `try`: `janusErrors()` answers them.
+
+| Thrown | Answered |
+| --- | --- |
+| `USER_INVALID` | 400 `{ code, issues }`, the fields that failed |
+| `PASSWORD_TOO_SHORT` | 400 `{ code, minLength }` |
+| `LOGIN_TAKEN` | 409 `{ code }` |
+| `CREDENTIALS_INVALID` | 401 `{ code }` — the same for an unknown login and a wrong password |
+| `USER_INACTIVE` | 403 `{ code }` — only told to somebody who gave the right password |
+
+A bearer client — a mobile app — keeps its session token itself and sends it
+as `Authorization: Bearer`. Answer it the session token in the body, not a
+cookie — keep what `signIn` answered:
+
+```ts
+const signedIn = await auth.signIn({ email, password });
+return c.json({
+	id: signedIn.user.id,
+	token: signedIn.token,
+	expiresAt: signedIn.session.expiresAt,
+});
+```
+
+## Sign-out
+
+```ts
+import { signOut } from '@nxgt/janus-hono';
+
+app.post('/sign-out', async (c) => {
+	await signOut(c, auth);
+	return c.body(null, 204);
+});
+
+app.post('/sign-out-everywhere', session(auth, { required: true }), async (c) => {
+	await auth.signOutEverywhere(c.var.user, { except: c.var.session.id });
+	return c.body(null, 204);
+});
+```
+
+`signOut` clears the cookie whatever it revoked, so a browser holding a stale
+cookie drops it too.
+
+## E-mail verification and password reset
+
+Sending the e-mail is yours; the one-time token goes in a link.
+
+```ts
+app.post('/verify-email', session(auth, { required: true }), async (c) => {
+	const { token, email } = await auth.verifyEmail.send(c.var.user);
+	await mailer.send(email, `https://app.test/verify?token=${token}`);
+	return c.body(null, 202);
+});
+
+app.post('/verify-email/confirm', async (c) => {
+	const { token } = await c.req.json();
+	await auth.verifyEmail.confirm(token); // TOKEN_* → 400
+	return c.body(null, 204);
+});
+
+app.post('/reset-password', async (c) => {
+	const { email } = await c.req.json();
+	const issued = await auth.resetPassword.request(email);
+	if (issued !== null) {
+		await mailer.send(issued.email, `https://app.test/reset?token=${issued.token}`);
+	}
+	return c.body(null, 202); // the same answer either way: never say which e-mails exist
+});
+
+app.post('/reset-password/confirm', async (c) => {
+	const { token, password } = await c.req.json();
+	await auth.resetPassword.confirm(token, password); // signs the user out everywhere
+	return c.body(null, 204);
+});
+```
+
+## Several user types
+
+With `janus({ users: { patient, staff } })`, each type's flows are under its
+name, and `session()` takes the type a route admits:
+
+```ts
+app.post('/staff/sign-in', async (c) => {
+	const { username, password } = await c.req.json();
+	sendSession(c, auth, await auth.staff.signIn({ username, password }));
+	return c.body(null, 204);
+});
+
+app.get('/staff/rota', session(auth, { type: 'staff', required: true }), (c) =>
+	c.json(rotaOf(c.var.user.username)), // a staff user: the compiler knows
+);
+```
+
+A patient's session on `/staff/rota` is anonymous there, and answered 401. The
+session stands, and still authenticates the patient on the routes that admit them.
+One cookie holds one session: a browser signed in as a patient that signs in
+as staff replaces the patient's cookie.
+
+## See also
+
+- [`@nxgt/janus` — sessions](https://github.com/softistx/nxgt-janus/blob/develop/packages/janus/docs/guide/sessions.md) — lifespans, renewal, the cookie's attributes
+- [`@nxgt/janus` — errors](https://github.com/softistx/nxgt-janus/blob/develop/packages/janus/docs/guide/errors.md) — every code
+- [Guarded routes and writing tuples](permissions.md) — `permission()`, `provide()`
+- [Troubleshooting](../troubleshooting.md)

package/docs/roadmap.md

@@ -0,0 +1,40 @@
+# Roadmap
+
+Where `@nxgt/janus-hono` is heading. A direction, not a commitment: there are
+no dates here, and the version something shipped in is the only number.
+
+## Now
+
+Nothing in progress.
+
+## Next
+
+Nothing yet.
+
+## Later
+
+Nothing yet.
+
+## Not planned
+
+- **A middleware that guesses the object** — `permission()` takes a `load`
+  and never picks a path parameter or a table for you: the application knows
+  where its objects live. `byParam('id', find)` reads the parameter it is
+  named, with the `find` it is given.
+- **Routes of its own** — no `/sign-in` mounted for you. Every application
+  names, validates and answers its routes its own way; the flows are one call
+  each.
+- **Body validation** — the shape of a request body is the route's to check,
+  with Hono's validator or your own. `janus()` validates the fields against
+  your schema, not that `password` is a string.
+- **Error classes of its own** — it throws nothing but `@nxgt/janus`'s, which
+  is why `@nxgt/janus` is a required peer and never a dependency.
+- **`moduleResolution: "nodenext"`** — like `@nxgt/janus`, the package imports
+  without extensions. Use `"moduleResolution": "bundler"`.
+
+## Shipped
+
+- **The first release** — `session()`,
+  `sendSession` (which answers the user), `signOut`, `permission()` and
+  `byParam`, `provide()`, `janusErrors({ report, fallback })`, and
+  `bindJanus()` binding them to the instances once. — v0.1

package/docs/troubleshooting.md

@@ -0,0 +1,324 @@
+# Troubleshooting `@nxgt/janus-hono`
+
+Each entry is headed by what you see: a compiler error, a thrown `TypeError`,
+or a status and its body. Search this page for its words.
+
+This package **defines no error class**. What reaches `app.onError` is one of
+`@nxgt/janus`'s errors, and the codes are those of the core — see
+[`@nxgt/janus`'s troubleshooting](https://github.com/softistx/nxgt-janus/blob/develop/packages/janus/docs/troubleshooting.md)
+for what causes each.
+
+## Index
+
+**Types**
+- [`'c.var.user' is possibly 'null'`](#cvaruser-is-possibly-null)
+- [`Property 'user' does not exist on type 'Readonly<ContextVariableMap>'`](#property-user-does-not-exist-on-type-readonlycontextvariablemap)
+- [`Property 'email' does not exist on type 'User<"patient", …> | User<"staff", …>'`](#property-email-does-not-exist-on-type-userpatient---userstaff-)
+- [`Type '"doctor"' is not assignable to type '"patient" | "staff"'`](#type-doctor-is-not-assignable-to-type-patient--staff)
+- [`Argument of type 'string | undefined' is not assignable to parameter of type 'string'`, in `load`](#argument-of-type-string--undefined-is-not-assignable-to-parameter-of-type-string-in-load)
+- [`Expected 5 arguments, but got 4`, on `permission()`](#expected-5-arguments-but-got-4-on-permission)
+- [`Type '{ id: string; }' is not assignable to type 'Awaitable<ObjectData<…> | null>'`](#type--id-string--is-not-assignable-to-type-awaitableobjectdata--null)
+- [`Property 'access' does not exist on type 'Readonly<ContextVariableMap & …>'`](#property-access-does-not-exist-on-type-readonlycontextvariablemap--)
+
+**Runtime**
+- [`500 Internal Server Error` for every refusal](#500-internal-server-error-for-every-refusal)
+- [`TypeError: permission(): c.var.object is already set`](#typeerror-permission-cvarobject-is-already-set)
+- [`TypeError: permission(): c.var.user is not set`](#typeerror-permission-cvaruser-is-not-set)
+- [`403` where the user should be allowed](#403-where-the-user-should-be-allowed)
+- [`401` with an empty body, for a signed-in user](#401-with-an-empty-body-for-a-signed-in-user)
+- [`503 {"code":"STORE_FAILED"}` on every route](#503-codestore_failed-on-every-route)
+- [`400 {"code":"HASH_UNSUPPORTED"}` on sign-in](#400-codehash_unsupported-on-sign-in)
+- [The browser never sends the cookie back](#the-browser-never-sends-the-cookie-back)
+- [A bearer client holds an expiry earlier than the session's](#a-bearer-client-holds-an-expiry-earlier-than-the-sessions)
+
+## Types
+
+### `'c.var.user' is possibly 'null'`
+
+**When:** reading `c.var.user` in a route behind `session(auth)`.
+
+**Why:** the route does not require a user, so an anonymous request reaches
+it. The same holds for `required` given a computed `boolean`: only a literal
+`true` removes the `null`.
+
+**Fix:** require a user, or answer the anonymous request yourself.
+
+```ts
+app.get('/me', session(auth, { required: true }), (c) => c.json(c.var.user));
+```
+
+### `Property 'user' does not exist on type 'Readonly<ContextVariableMap>'`
+
+**When:** `app.use(session(auth))` on its own line, then `c.var.user` in a
+route declared after it.
+
+**Why:** Hono types a chain of calls, not separate statements.
+
+**Fix:** declare the app with the `Env`, or pass `session(auth)` to the route.
+
+```ts
+const app = new Hono<SessionEnv<typeof auth>>();
+app.use(session(auth));
+```
+
+### `Property 'email' does not exist on type 'User<"patient", …> | User<"staff", …>'`
+
+**When:** several user types, and `session(auth)` without `type`.
+
+**Why:** the route admits every user type, so `c.var.user` is their union, and
+a field only one type has is not on it.
+
+**Fix:** name the type the route admits, or narrow on `user.type`.
+
+```ts
+app.get('/me', session(auth, { type: 'patient', required: true }), (c) =>
+	c.json({ email: c.var.user.email }),
+);
+```
+
+### `Type '"doctor"' is not assignable to type '"patient" | "staff"'`
+
+**When:** `session(auth, { type: 'doctor' })`, or `SessionEnv<typeof auth, 'doctor'>`.
+
+**Why:** `type` names a user type of the instance you pass, and `doctor` is
+not one of them — a misspelling, or a type from another `janus()`.
+
+**Fix:** use one of the names in the message, the keys of `users` in
+`janus({ users })`.
+
+### `Argument of type 'string | undefined' is not assignable to parameter of type 'string'`, in `load`
+
+**When:** `permission(access, 'view', 'record', (c) => records.find(c.req.param('id')))`.
+
+**Why:** `load` takes a plain `Context`: `permission()` is built before Hono
+attaches it to a route, so `c.req.param('id')` is `string | undefined` there.
+
+**Fix:** a missing id is nothing to load: answer `null`, which is a 404 —
+what `byParam` does.
+
+```ts
+permission(access, 'view', 'record', byParam('id', (id) => records.find(id)));
+```
+
+### `Expected 5 arguments, but got 4`, on `permission()`
+
+**When:** the permission reaches a `when()` condition, and no options were
+passed.
+
+**Why:** a condition needs its `ctx`, and `permission()` requires it exactly
+then — as `can()` does.
+
+**Fix:** pass `ctx`, read from the request and the loaded object.
+
+```ts
+permission(access, 'edit', 'record', load, {
+	ctx: (c, record) => ({ locked: record.locked }),
+});
+```
+
+### `Type '{ id: string; }' is not assignable to type 'Awaitable<ObjectData<…> | null>'`
+
+Also: `Property 'doctorId' is missing in type '{ id: string; }'`.
+
+**When:** `load` answers an object without a field a `fromField` of its type
+reads — `doctorId` for `fromField('doctorId', 'staff')`.
+
+**Why:** `can()` reads that relation from the object. At run time a missing
+field is a `TypeError` — `can: record.doctor reads doctorId, which the object
+does not carry …` — never a denial, so the type refuses it first.
+
+**Fix:** load the field — `null` when it holds nobody.
+
+### `Property 'access' does not exist on type 'Readonly<ContextVariableMap & …>'`
+
+**When:** `c.var.access` or `c.var.auth` in a route. With nothing before the
+route that sets a variable, the type is `'Readonly<ContextVariableMap>'`, with
+no `&`.
+
+**Why:** `provide()` was not in the chain before the route, or was not given
+that instance: it sets, and types, only what it is given.
+
+**Fix:**
+
+```ts
+const app = new Hono().use(session(auth), provide({ auth, access }));
+```
+
+## Runtime
+
+### `TypeError: permission(): c.var.object is already set`
+
+**When:** the first request to a route with two `permission()` guards, or one
+behind a middleware of yours that sets `c.var.object`.
+
+**Why:** `permission()` hands the route its object as `c.var.object`. Two
+would claim the one variable, and the route would be typed as if it held both.
+
+**Fix:** one `permission()` per route. Check a parent through an arrow in the
+model, so the one check covers it.
+
+```ts
+record: {
+	relations: { owner: ['patient'], folder: ['folder'] },
+	permissions: { view: ['owner', 'folder->view'] },
+},
+```
+
+### `TypeError: permission(): c.var.user is not set`
+
+**When:** the first request to a route guarded by `permission()`.
+
+**Why:** nothing set `c.var.user`: no `session()` before `permission()` in that
+route's chain, and no `subject` option. It is a wiring error, so it is thrown
+rather than answered 401.
+
+**Fix:** put `session(auth)` before it — on the route or with `app.use` — or
+say who the subject is.
+
+```ts
+app.get('/records/:id', session(auth), permission(access, 'view', 'record', load), handler);
+```
+
+### `403` where the user should be allowed
+
+**When:** a user who holds the relation is refused.
+
+**Why**, in the order to check:
+
+1. The user holds a relation, and the route asks a permission that does not
+   include it — `edit` is not `view`.
+2. A condition answered `false`: check what `ctx` computes.
+3. A `fromField`'s field holds another id, or `null`, in what `load` answered.
+4. The tuple names another user type than the one signed in — granted to
+   `patient:u1`, checked for `staff:u1`: the same id under another type is
+   somebody else.
+
+**Fix:** ask `can()` directly with the same arguments; it answers the same.
+
+```ts
+await access.can(user, 'view', { ...record, type: 'record' }); // the check permission() makes
+```
+
+### `500 Internal Server Error` for every refusal
+
+**When:** a sign-in with a wrong password, a taken login or an outage answers
+500 instead of 401, 409 or 503.
+
+**Why:** no `janusErrors()` on the app that ran the throwing code. A sub-app's
+own `onError` is captured when `app.route()` mounts it; one with none uses the
+parent's. An error from a middleware on the parent — `app.use(session(auth))`
+— always uses the parent's.
+
+**Fix:** set it on the app you serve, and on a sub-app before mounting it if
+that sub-app has a handler of its own.
+
+```ts
+app.onError(janusErrors());
+sub.onError(janusErrors());
+app.route('/staff', sub);
+```
+
+### `401` with an empty body, for a signed-in user
+
+**When:** a route with `required: true` answers 401 although the user signed
+in.
+
+**Why**, in the order to check:
+
+1. The route passes `type`, and the user is of another type. The session
+   stands; it does not authenticate that user on this route.
+2. The request presents two session credentials, and the first one is stale.
+   **The first present wins, not the first valid one**: a lapsed
+   `Authorization: Bearer` beside a live cookie is anonymous.
+3. The session lapsed or was revoked — `signOut`, `signOutEverywhere`, a
+   password reset — or the user was deactivated.
+4. The browser did not send the cookie: see
+   [The browser never sends the cookie back](#the-browser-never-sends-the-cookie-back).
+
+**Fix:** for 2, stop sending the stale header. For 1 and 3, it is the answer
+you asked for.
+
+```ts
+fetch(url, { credentials: 'include' }); // the cookie, and no stale Authorization header
+```
+
+### `503 {"code":"STORE_FAILED"}` on every route
+
+**When:** every request that presents a session credential answers 503.
+
+**Why:** a store cannot answer. `session()` calls the sessions store on every
+request that presents a session token, and **an outage is never anonymous**: it
+is `STORE_FAILED`, answered 503, so that nobody is told they are signed out
+while the database is down. A request that presents nothing never reaches the
+store, and stays anonymous.
+
+**Fix:** the database. `janusErrors()` answers without logging: pass `report`
+to see which store failed and why.
+
+```ts
+app.onError(
+	janusErrors({
+		report: (error) =>
+			logger.error({ slot: error.slot, operation: error.operation }, error.cause),
+	}),
+);
+```
+
+### `400 {"code":"HASH_UNSUPPORTED"}` on sign-in
+
+**When:** users imported from another system, or after a change of hasher.
+
+**Why:** the stored password hash has a prefix no wired hasher reads. It is a
+wiring fault, not the user's: they cannot act on the 400.
+
+**Fix:** wire the hasher that wrote those hashes back as a verifier — see
+[`@nxgt/janus`'s passwords guide](https://github.com/softistx/nxgt-janus/blob/develop/packages/janus/docs/guide/passwords.md).
+
+```ts
+janus({ …, hasher: bunHasher(), verifiers: [scryptHasher()] }); // old hashes still verify
+```
+
+### The browser never sends the cookie back
+
+**When:** `sendSession` answered a `Set-Cookie`, and the next request presents
+no cookie.
+
+**Why:** one of three.
+
+- The cookie is `Secure` by default, and the page is served over plain
+  `http://` on a host other than `localhost`.
+- The front end is on another origin: the browser sends a cookie cross-origin
+  only with `credentials: 'include'`, to a server that allows credentials, and
+  `SameSite=Lax` (the default) drops it from a cross-site `POST`.
+- `sameSite: 'none'` without `secure` is refused when `janus()` is called —
+  `cookie.sameSite "none" requires cookie.secure` — so it never gets that far.
+
+**Fix:** serve over HTTPS; for a development server off `localhost`,
+`cookie: { secure: false }` in `janus()`, never in production. For a front end
+on another origin:
+
+```ts
+import { cors } from 'hono/cors';
+
+// janus({ …, cookie: { sameSite: 'none' } }) — secure stays true
+app.use(cors({ origin: 'https://front.example', credentials: true }));
+// in the front end: fetch(url, { credentials: 'include' })
+```
+
+### A bearer client holds an expiry earlier than the session's
+
+**When:** a bearer client caches `session.expiresAt` from its sign-in, and
+treats the session as over at that date.
+
+**Why:** the session was renewed in passing, and its expiry moved in the store.
+A bearer client is never sent a cookie saying so, and its session token does
+not change.
+
+**Fix:** nothing to fix unless the client caches the expiry. If it does, answer
+`c.var.session.expiresAt` from a route it calls.
+
+```ts
+app.get('/session', session(auth, { required: true }), (c) =>
+	c.json({ expiresAt: c.var.session.expiresAt }),
+);
+```

package/package.json

@@ -0,0 +1,62 @@
+{
+	"name": "@nxgt/janus-hono",
+	"version": "0.1.0",
+	"description": "Hono middleware for @nxgt/janus: the signed-in user on every request, the session cookie, routes guarded by a permission, and every error as its status",
+	"license": "MIT",
+	"type": "module",
+	"main": "./dist/index.js",
+	"types": "./dist/index.d.ts",
+	"files": [
+		"dist",
+		"docs",
+		"README.md",
+		"package.json",
+		"LICENSE"
+	],
+	"exports": {
+		".": {
+			"types": "./dist/index.d.ts",
+			"import": "./dist/index.js",
+			"default": "./dist/index.js"
+		},
+		"./package.json": "./package.json"
+	},
+	"keywords": [
+		"identity",
+		"authentication",
+		"hono",
+		"middleware",
+		"janus",
+		"typescript"
+	],
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/softistx/nxgt-janus.git",
+		"directory": "packages/janus-hono"
+	},
+	"publishConfig": {
+		"registry": "https://registry.npmjs.org",
+		"access": "public"
+	},
+	"scripts": {
+		"build": "bun run ../../build.ts",
+		"test": "bun test src",
+		"typecheck": "tsc --noEmit"
+	},
+	"nxgt": {
+		"entrypoints": [
+			"src/index.ts"
+		]
+	},
+	"devDependencies": {
+		"@nxgt/janus": "^0.1.3",
+		"@types/bun": "^1.4.2",
+		"hono": "^4.13.9",
+		"zod": "^4.6.5"
+	},
+	"peerDependencies": {
+		"@nxgt/janus": "^0.1.3",
+		"hono": "^4.13.4",
+		"typescript": "^6.0.3"
+	}
+}