@spunto/build 0.3.0 → 0.3.1

package/README.md

@@ -110,7 +110,11 @@ React, **no** `process.env`, and knows **nothing** about organizations, users or
 `zod` is the one exception, and a deliberate one: `./spec` describes a file format that two
 products have to validate identically, and re-deriving the same schema on each side is exactly the
 duplication this package exists to remove. It is a **peer** dependency (`^4`), so a consumer's own
-zod is the one used — which matters, since apps extend these schemas with their own.
+zod is the one used — which matters, since apps extend these schemas with their own. And an
+**optional** one, because a peer applies to the whole package while only `./spec` needs it: a
+consumer that imports `./naming` or `./steps` and nothing else should not have a schema library
+installed on its behalf. Import `./spec` without zod and resolution fails loudly, which is the
+right trade for not taxing every other entry point.
 
 Concretely: **no platform I/O**. No database, no Docker socket, no WebSocket. This package produces
 strings and parses strings; its only network call is outbound HTTP to a public extension registry,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spunto/build",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Spunto's shared Build engine \u2014 the devcontainer image protocol and VS Code extension registry clients, with no database, no HTTP framework and no UI.",
   "type": "module",
   "license": "MIT",
@@ -61,5 +61,10 @@
   },
   "peerDependencies": {
     "zod": "^4"
+  },
+  "peerDependenciesMeta": {
+    "zod": {
+      "optional": true
+    }
   }
 }