@hilbras/keystone 1.2.0 → 1.3.0

package/CHANGELOG.md

@@ -66,6 +66,24 @@ Dependency updates — safe patches and minor versions.
 - **lucide-react** 1.24.0 → latest 1.x (frontend)
 - **@playwright/test** 1.61.1 → latest 1.x (frontend)
 
+## [1.3.0] - 2026-09-20
+
+Core tooling upgrades — TypeScript 7, Zod 4, Drizzle latest, Commander 15, Dotenv 18.
+
+### Changed
+
+- **TypeScript** 5.9.3 → 7.0.2 — new major version with stricter type checking.
+- **Zod** 3.25.76 → 4.6.5 — API redesign: `z.record()` now requires explicit key type. Updated 7 call sites across 6 route files.
+- **Drizzle ORM** 0.31.4 → 0.45.2
+- **Drizzle Kit** 0.22.8 → 0.31.10
+- **Commander** 12.1.0 → 15.0.0
+- **Dotenv** 16.6.1 → 18.0.1
+
+### Fixed
+
+- **Zod 4 migration** — Updated all `z.record()` calls to include explicit `z.string()` key type parameter (sso.ts, auth.ts, config.ts, profile.ts, setup.ts, webauthn.ts, workflows.ts).
+
+[1.3.0]: https://github.com/Hilbras/Keystone/releases/tag/v1.3.0
 [1.2.0]: https://github.com/Hilbras/Keystone/releases/tag/v1.2.0
 [1.1.0]: https://github.com/Hilbras/Keystone/releases/tag/v1.1.0
 [1.0.0]: https://github.com/Hilbras/Keystone/releases/tag/v1.0.0

package/README.md

@@ -20,6 +20,10 @@ Keystone is a **standalone identity platform**, not a wrapper around another ide
 
 ---
 
+## What's new in v1.3.0
+
+- **Core tooling upgrades** — TypeScript 7, Zod 4, Drizzle ORM 0.45, Commander 15, Dotenv 18. Updated all `z.record()` calls for Zod 4 compatibility.
+
 ## What's new in v1.2.0
 
 - **Dependency updates** — All root and frontend packages updated to latest safe patch/minor versions (fastify, argon2, otpauth, OpenTelemetry, autoprefixer, postcss, lucide-react, Playwright).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hilbras/keystone",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "type": "module",
   "files": [
     "dist",
@@ -44,9 +44,9 @@
     "@simplewebauthn/server": "^13.3.2",
     "argon2": "^0.45.1",
     "bullmq": "^5.80.2",
-    "commander": "^12.1.0",
-    "dotenv": "^16.4.5",
-    "drizzle-orm": "^0.31.2",
+    "commander": "^15.0.0",
+    "dotenv": "^18.0.1",
+    "drizzle-orm": "^0.45.2",
     "fastify": "^5.12.5",
     "fastify-plugin": "^5.0.0",
     "ioredis": "^5.4.0",
@@ -56,14 +56,14 @@
     "postgres": "^3.4.4",
     "prom-client": "^15.1.3",
     "samlify": "^2.13.1",
-    "zod": "^3.23.8"
+    "zod": "^4.6.5"
   },
   "devDependencies": {
     "@types/node": "^20.14.0",
     "@types/nodemailer": "^8.0.1",
-    "drizzle-kit": "^0.22.0",
+    "drizzle-kit": "^0.31.10",
     "light-my-request": "^6.0.0",
     "tsx": "^4.15.0",
-    "typescript": "^5.4.0"
+    "typescript": "^7.0.2"
   }
 }

package/src/routes/admin/sso.ts

@@ -11,7 +11,7 @@ const SamlConnectionSchema = z.object({
   idpCertificate: z.string().optional(),
   spEntityId: z.string().min(1),
   spAcsUrl: z.string().url(),
-  attributeMapping: z.record(z.array(z.string())).optional(),
+  attributeMapping: z.record(z.string(), z.array(z.string())).optional(),
   isActive: z.boolean().optional(),
 });
 
@@ -25,7 +25,7 @@ const OidcConnectionSchema = z.object({
   clientId: z.string().min(1),
   clientSecret: z.string().min(1),
   scopes: z.array(z.string()).optional(),
-  attributeMapping: z.record(z.array(z.string())).optional(),
+  attributeMapping: z.record(z.string(), z.array(z.string())).optional(),
   isActive: z.boolean().optional(),
 });
 

package/src/routes/auth.ts

@@ -41,7 +41,7 @@ const RegisterSchema = z.object({
   password: z.string().min(8).max(128),
   name: z.string().max(255).optional(),
   client_id: z.string().optional(),
-  metadata: z.record(z.unknown()).optional(),
+  metadata: z.record(z.string(), z.unknown()).optional(),
 });
 
 const LoginSchema = z.object({

package/src/routes/config.ts

@@ -4,7 +4,7 @@ import { createConfigWriter } from "../services/setup/configWriter.js";
 import { queue } from "../services/queue/index.js";
 
 const UpdateConfigSchema = z.object({
-  values: z.record(z.string()),
+  values: z.record(z.string(), z.string()),
 });
 
 async function requireOwner(request: FastifyRequest, reply: FastifyReply) {

package/src/routes/profile.ts

@@ -6,7 +6,7 @@ const UpdateProfileSchema = z.object({
   name: z.string().max(255).optional(),
   avatarUrl: z.string().url().max(2048).nullable().optional(),
   phoneNumber: z.string().max(32).nullable().optional(),
-  metadata: z.record(z.unknown()).optional(),
+  metadata: z.record(z.string(), z.unknown()).optional(),
 });
 
 export default async function profileRoutes(app: FastifyInstance) {

package/src/routes/setup.ts

@@ -57,7 +57,7 @@ const ValidateSmsSchema = z.object({
 });
 
 const SetupConfigSchema = z.object({
-  env: z.record(z.string()),
+  env: z.record(z.string(), z.string()),
 });
 
 function parseBody<T>(schema: z.ZodSchema<T>, body: unknown, reply: FastifyReply): T | null {

package/src/routes/webauthn.ts

@@ -37,7 +37,7 @@ function clearChallengeCookie(reply: FastifyReply): void {
 }
 
 const RegisterVerifySchema = z.object({
-  response: z.record(z.unknown()),
+  response: z.record(z.string(), z.unknown()),
   deviceName: z.string().max(100).optional(),
 });
 
@@ -46,7 +46,7 @@ const AuthenticateOptionsSchema = z.object({
 });
 
 const AuthenticateVerifySchema = z.object({
-  response: z.record(z.unknown()),
+  response: z.record(z.string(), z.unknown()),
 });
 
 export default async function webauthnRoutes(app: FastifyInstance) {

package/src/routes/workflows.ts

@@ -15,7 +15,7 @@ const CreateWorkflowSchema = z.object({
   name: z.string().min(1).max(255),
   trigger: z.enum(["user_registered", "user_login", "organization_created"]),
   definition: z.object({
-    steps: z.array(WorkflowStepSchema.and(z.record(z.unknown()))),
+    steps: z.array(WorkflowStepSchema.and(z.record(z.string(), z.unknown()))),
   }),
   isActive: z.boolean().optional(),
 });