@zap-studio/permit 1.1.0 → 1.1.1

package/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.1.1]
+
+### Changed
+
+`@zap-studio/logger` is now an optional peer dependency instead of a regular dependency. Every import from it is type-only (`import type { Logger }`), so it was never pulled in at runtime — pass any object matching the `Logger` shape (including `pino`) with no install required. Existing consumers of `logger?: Logger` are unaffected.
+
 ## [1.1.0]
 
 ### Added

package/README.md

@@ -4,6 +4,16 @@ A type-safe, declarative authorization library for TypeScript with [Standard Sch
 
 Full documentation: [zapstudio.dev/permit](https://www.zapstudio.dev/permit)
 
+## Motivation
+
+Authorization checks written by hand, like `if (user.role === "admin")`, spread through a codebase over time. After a while, nobody can answer "who is allowed to delete a post?" without searching the whole app.
+
+A framework like CASL solves the spreading problem, but it comes with its own vocabulary to learn (`subject`, `can`, `cannot`, `rules`), and its rules are not checked against your actual data shapes — you can write a rule that references a field your resource does not have, and it will only fail once that code runs.
+
+`@zap-studio/permit` keeps all rules in one place, through `createPolicy(...)` with `allow()`, `deny()`, and `when(condition)` — one file answers "who can do what."
+
+And because resources come from your Standard Schema schemas, policy types are derived straight from your real data shapes. Reference a field that does not exist, and you get an error while writing the code, not a silent `undefined` in production.
+
 ## Installation
 
 ```bash

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@zap-studio/permit",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "private": false,
-  "description": "A type-safe, declarative, tree-shakeable authorization library for TypeScript with Standard Schema support",
+  "description": "A type-safe, declarative, tree-shakeable authorization library for TypeScript with Standard Schema support.",
   "keywords": [
     "abac",
     "access-control",
@@ -44,15 +44,23 @@
     "access": "public"
   },
   "dependencies": {
-    "@zap-studio/logger": "1.0.0",
     "@zap-studio/validation": "1.0.0"
   },
   "devDependencies": {
     "tsdown": "^0.22.14",
     "typescript": "^7.0.2",
     "vitest": "^4.1.10",
+    "@zap-studio/logger": "1.0.0",
     "@zap-studio/typescript": "0.0.0"
   },
+  "peerDependencies": {
+    "@zap-studio/logger": "1.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@zap-studio/logger": {
+      "optional": true
+    }
+  },
   "engines": {
     "node": ">=18.0.0"
   }