@kirjapro/mcp-server 0.5.7 → 0.5.8

package/CHANGELOG.md

@@ -1,5 +1,53 @@
 # Changelog
 
+## [0.5.8] - 2026-05-18
+
+Three coordinated dep-migration waves (W1, W3, W4b) of the pre-launch
+version-migration campaign. No runtime behavior changes for MCP consumers;
+tool input schemas gain explicit `z.record(string, unknown)` form (Zod 4
+requirement) which shifts JSON-schema hashes — fingerprint baseline updated.
+
+### Changed
+
+- **Dependencies (W1)** — `@modelcontextprotocol/sdk` 1.12 → 1.29,
+  `@supabase/supabase-js` 2.49 → 2.105, `tsx` 4.19 → 4.22.
+- **Dependencies (W3)** — `esbuild` 0.25 → 0.28, `typescript` 5.7 → 6.0,
+  `vitest` 3.0 → 4.1. Added `@types/node` ^22.18.0 as direct devDep
+  (was transitive — TS 6 dropped that auto-discovery).
+- **Dependencies (W4b)** — `zod` 3.24 → 4.4.
+
+### Fixed
+
+- **(W1) supabase-js v2.100+ `RejectExcessProperties` rejects `Record<string, unknown>`**
+  at `.update()` / `.insert()` call sites — the new generic wrapper
+  resolves to `{ [x: string]: never }` for any source carrying an open
+  index signature. Re-typed `updates` / `updateFields` in four tool files
+  as `Database['public']['Tables']['<table>']['Update']`:
+  `customers.ts`, `invoices.ts`, `offers.ts`, `recurring-invoices.ts`.
+  Skill: `supabase-js-update-rejectexcessproperties`.
+- **(W1) `customers.ts` latent NOT-NULL bug** — `updates.name = sanitizeText(...)`
+  would attempt to set `name = null` (and trip the column's NOT NULL
+  CHECK at the DB) when the sanitizer collapsed whitespace-only input.
+  Now coalesces `?? undefined` so the field is skipped instead.
+- **(W1) `offers.ts` dynamic-key write** refactored from a `timestampMap[newStatus]`
+  lookup into an explicit `switch` on the discriminator — typed Update
+  rejects open-string indexing.
+- **(W1) `recurring-invoices.ts` `template_data` assignment** — cast as `Json`
+  at the assignment site; `Record<string, unknown>` is not a subtype of
+  the recursive `Json` type.
+- **(W3) `tsconfig.json` — added `"types": ["node"]`.** TS 6 with
+  `moduleResolution: "bundler"` stopped auto-including `@types/node` from
+  transitive deps. Without explicit declaration, 21 TS2591 errors hit
+  (`process`, `Buffer`, `node:crypto`, `.unref` on `setTimeout` return).
+  Skill: `ts6-bundler-resolution-types-node-explicit`.
+- **(W4b) Zod 4 `z.record` API requires explicit key schema.** Migrated
+  11 sites from `z.record(z.unknown())` → `z.record(z.string(), z.unknown())`
+  across `schemas.ts` and six tool files. Tool fingerprints regenerated
+  via `npm run fingerprints:update` — the rug-pull guard correctly caught
+  the JSON-schema-shape shift even though it's semantically equivalent.
+
+## [0.5.7] - 2026-05-09
+
 ## [0.5.7] - 2026-05-09
 
 Pre-launch trim and supply-chain hardening. Two coordinated changes shape
@@ -108,7 +156,7 @@ legacy rows continue to work without backfill.
   ages past `CLAIM_STALE_MS`; on exhaustion returns an explicit `retry_later`
   error instead of racing into a duplicate write.
 - **Idempotency body-hash check** (T3-6, migration
-  `20260420185239_mcp_idempotency_body_hash.sql`) — each claim stores
+  `20260420192510_mcp_idempotency_body_hash.sql`) — each claim stores
   `sha256(canonical JSON of params ∖ idempotencyKey)`. On cache hit the server
   recomputes and compares; mismatch returns `IDEMPOTENCY_BODY_MISMATCH`
   instead of silently replaying the wrong cached response. Nullable column,
@@ -144,7 +192,7 @@ legacy rows continue to work without backfill.
 
 Published artefact requires:
 
-1. Apply migration `20260420185239_mcp_idempotency_body_hash.sql` to the
+1. Apply migration `20260420192510_mcp_idempotency_body_hash.sql` to the
    Supabase project (adds nullable `body_sha256`). Missing column will NOT
    break the server — the INSERT still succeeds with PostgREST schema-cache
    tolerance — but the mismatch check will be inert until migrated.