Slingshot v0.3.6 — optional peers stay optional

Fixed

slingshot-permissions forced mongoose on every consumer. adapters/mongo.ts imported Schema at module scope and built its schema at module load; the package index re-exports that file, so importing @lastshotlabs/slingshot-permissions at all pulled mongoose into the graph — turning an optional peer into a hard requirement.

This is invisible against a symlinked checkout (whose node_modules happens to contain mongoose) and fatal against the published package. A Postgres-only app installing from the registry either:

• died at boot with Cannot find package 'mongoose', or
• crashed under Bun inside bson (node:v8 isBuildingSnapshot is not yet implemented) once mongoose was installed to satisfy it.

The schema is now built inside createMongoPermissionsAdapter, from the connection's own Mongoose instance (conn.base.Schema), with a lazy require fallback for connection-likes that don't expose base. Nothing resolves mongoose until the Mongo adapter is actually constructed.

slingshot-auth already documented the rule — "Passed explicitly to avoid optional-dep resolution issues" — and was clean. Only this adapter broke it.

Why it matters

If your app doesn't use Mongo, you should never have needed Mongo installed. Consuming published packages rather than local symlinks is what surfaced this.