flexpay-engine 0.3.1 → 0.3.2

package/CHANGELOG.md

@@ -3,6 +3,52 @@
 All notable changes to `flexpay-engine` (npm package). Only `src/` ships; the
 `worker/` runtime is deployed separately and is not part of the package.
 
+## 0.3.2 — 2026-07-31
+
+Packaging fix. **No source changes** — but `0.3.1` is effectively uninstallable for
+`flexpay-backend`, so upgrade straight to `0.3.2`.
+
+### Fixed
+
+- **`drizzle-orm` no longer appears in `dependencies`.** It was declared in *both*
+  `dependencies` and `peerDependencies`. The `dependencies` entry forces a real
+  install, so a consumer pinning an older drizzle got a **second, nested copy** —
+  and TypeScript treats two copies as unrelated types. Measured on
+  `flexpay-backend` (pins `drizzle-orm@^0.41.0`): **40 `error TS` diagnostics**,
+  all variants of
+
+  ```
+  Type '.../flexpay-engine/node_modules/drizzle-orm/sql/sql".SQL<unknown>' is not
+  assignable to type '.../flexpay-backend/node_modules/drizzle-orm/sql/sql".SQL<unknown>'.
+    Types have separate declarations of a private property 'shouldInlineParams'.
+  ```
+
+  With `0.3.2` the nested copy disappears and the same typecheck reports **0 errors**.
+  `flexpay-client-worker` was never affected — it pins `^0.44.7`, which satisfies the
+  peer range and dedupes.
+
+`drizzle-orm` remains a `peerDependency` (`^0.44.7`) — it is the one thing `src/`
+genuinely imports. Note that `flexpay-backend` does **not** satisfy that range today
+(`^0.41.0`); that mismatch predates this release and is unchanged by it.
+
+### Deliberately NOT changed
+
+- **`hono` and `@sentry/cloudflare` stay in `dependencies`.** Only `worker/` imports
+  them and `worker/` is not in the npm artifact, so moving them to `devDependencies`
+  looks correct — but it **breaks the Cloudflare Workers build**, which installs
+  production dependencies only:
+
+  ```
+  ✘ [ERROR] Could not resolve "hono"
+      worker/routes/webhooks-bnc.ts:4:21
+  ```
+
+  They are also not a consumer hazard: `src/` never imports them, so no type identity
+  is shared and no duplicate-copy breakage is possible. This repo is both an npm
+  package and a deployed Worker; `dependencies` has to satisfy the Worker build.
+  `drizzle-orm` is the one that must NOT be there, and it still resolves for the
+  Worker because peer dependencies are auto-installed.
+
 ## 0.3.1 — 2026-07-31
 
 Released from `dev`. Supersedes **0.3.0, which must not be used** — 0.3.0 was

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flexpay-engine",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "FlexPay loan servicing engine \u2014 pricing, schedules, allocation, delinquency, lock-state",
   "license": "MIT",
   "main": "src/index.ts",
@@ -38,19 +38,19 @@
     "probe:bnc": "bun run scripts/probe-bnc-sandbox.ts",
     "ci:verify": "bash scripts/check-deps.sh && bash scripts/check-engine-tables.sh && bun run typecheck && bun run typecheck:worker"
   },
-  "dependencies": {
-    "@sentry/cloudflare": "^10.20.0",
-    "drizzle-orm": "^0.44.7",
-    "hono": "^4.6.0"
-  },
   "peerDependencies": {
     "drizzle-orm": "^0.44.7"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^4.20250101.0",
     "@types/bun": "latest",
+    "drizzle-orm": "^0.44.7",
     "fast-check": "^3.22.0",
     "typescript": "^5.7.0",
     "wrangler": "^4.0.0"
+  },
+  "dependencies": {
+    "@sentry/cloudflare": "^10.20.0",
+    "hono": "^4.6.0"
   }
 }