diff --git a/bun.d.ts b/bun.d.ts
new file mode 100644
index 0000000..ae56db6
--- /dev/null
+++ b/bun.d.ts
@@ -0,0 +1,34 @@
+declare module "bun:test" {
+  export function describe(label: string, fn: () => void): void
+  export function test(label: string, fn: () => void | Promise<void>): void
+  export const it: typeof test
+  export function expect(value: unknown): {
+    toBe(expected: unknown): void
+    toEqual(expected: unknown): void
+    toStrictEqual(expected: unknown): void
+    toMatchObject(expected: object): void
+    toContain(expected: unknown): void
+    toHaveLength(expected: number): void
+    toBeNull(): void
+    toBeUndefined(): void
+    toBeDefined(): void
+    toBeTruthy(): void
+    toBeFalsy(): void
+    toBeGreaterThan(expected: number): void
+    toBeGreaterThanOrEqual(expected: number): void
+    toBeLessThan(expected: number): void
+    toBeLessThanOrEqual(expected: number): void
+    toThrow(expected?: string | RegExp | Error): void
+    resolves: ReturnType<typeof expect>
+    rejects: ReturnType<typeof expect>
+    not: ReturnType<typeof expect>
+  }
+  export function beforeAll(fn: () => void | Promise<void>): void
+  export function afterAll(fn: () => void | Promise<void>): void
+  export function beforeEach(fn: () => void | Promise<void>): void
+  export function afterEach(fn: () => void | Promise<void>): void
+}
+
+declare var process: {
+  env: Record<string, string | undefined>
+}
diff --git a/packages/api/src/middleware/auth.ts b/packages/api/src/middleware/auth.ts
index dde32d9..4a2b47f 100644
--- a/packages/api/src/middleware/auth.ts
+++ b/packages/api/src/middleware/auth.ts
@@ -1,5 +1,7 @@
 import type { MiddlewareHandler } from "hono"
 
+declare const Bun: { env: Record<string, string | undefined> } | undefined
+
 /**
  * Simple token-based auth middleware.
  *
@@ -15,14 +17,15 @@ import type { MiddlewareHandler } from "hono"
  */
 export const authMiddleware: MiddlewareHandler = async (c, next) => {
   // BUG: 'post' should be 'POST' — POST is never treated as public
-  const publicMethods = ["GET", "post"]
+  const publicMethods = ["GET", "POST"]
 
   if (publicMethods.includes(c.req.method)) {
     return next()
   }
 
   const token = c.req.header("Authorization")?.replace("Bearer ", "")
-  if (!token || token !== (process.env.API_TOKEN ?? "test-token")) {
+  const apiToken = (typeof Bun !== "undefined" ? Bun?.env.API_TOKEN : undefined) ?? "test-token"
+  if (!token || token !== apiToken) {
     return c.json({ error: "Unauthorized", status: 401 }, 401)
   }
 
diff --git a/packages/api/src/routes/users.ts b/packages/api/src/routes/users.ts
index 53e605a..2ab3111 100644
--- a/packages/api/src/routes/users.ts
+++ b/packages/api/src/routes/users.ts
@@ -1,6 +1,6 @@
 import { Hono } from "hono"
 import { db } from "../lib/db"
-import { notFound } from "../lib/errors"
+import { notFound, badRequest } from "../lib/errors"
 // BUG: missing import — `badRequest` is used below but not imported here.
 // This causes a ReferenceError at runtime when POST /users is called with invalid data.
 // Fix: add `badRequest` to the import from "../lib/errors"
diff --git a/packages/shared/src/types.ts b/packages/shared/src/types.ts
index a2a1377..d522b01 100644
--- a/packages/shared/src/types.ts
+++ b/packages/shared/src/types.ts
@@ -8,7 +8,7 @@
 
 export type User = {
   id: string
-  userName: string // BUG: should be `username` to match API usage
+  username: string
   email: string
   createdAt: string
 }
diff --git a/packages/shared/src/utils/pagination.ts b/packages/shared/src/utils/pagination.ts
index 12f8062..a342e88 100644
--- a/packages/shared/src/utils/pagination.ts
+++ b/packages/shared/src/utils/pagination.ts
@@ -11,5 +11,9 @@ import type { PaginatedResponse } from "../types"
  * The test in packages/shared/test/pagination.test.ts exercises the full contract.
  */
 export function paginate<T>(items: T[], page: number, size: number): PaginatedResponse<T> {
-  throw new Error("not implemented")
+  const total = items.length
+  const totalPages = total === 0 ? 0 : Math.ceil(total / size)
+  const start = (page - 1) * size
+  const data = start >= total || start < 0 ? [] : items.slice(start, start + size)
+  return { data, page, pageSize: size, total, totalPages }
 }
diff --git a/tsconfig.json b/tsconfig.json
index 53de6fd..e910135 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -9,5 +9,5 @@
       "@e2e/shared": ["./packages/shared/src/index.ts"]
     }
   },
-  "include": ["packages/*/src/**/*", "packages/*/test/**/*"]
+  "include": ["bun.d.ts", "packages/*/src/**/*", "packages/*/test/**/*"]
 }