Changelog

v1.1.6 — Seven Appearance Presets

2026-08-04

> Five new one-click presets in the Apparence tab. Every HZ resource follows the moment you apply one — loading screen, HUD, pause menu, panels.

New Features

  • Ember, Toxic, Amethyst, Crimson and Mono join the existing Industrial and Vice, bringing the built-in preset count to seven. Each writes the full appearance set in one click: the three accent colours, the three surfaces, the gradient mode and the six-tier radius scale.
  • All five keep the charte's neutral near-black surfaces (#0F0F12 panel, pure black sub-panel) and the sharp radius scale — only the signature colour changes, so a preset switch never reshapes your UI.
  • Mono is the deliberate exception. No hue at all: a white signature, solid gradient mode so every accent gradient collapses to a flat fill, and near-square corners (0/0/2/2/4/4). For servers that want the HUD to read as a tool rather than a brand.

Improvements

  • Adding a preset no longer requires editing a TypeScript union — the preset identifiers in the panel view are plain strings, so a new entry is data, not a type change.

Upgrade Notes

  • Drop-in replace. No config, event or schema breaking changes — your current appearance is untouched until you click a preset.
  • Presets are a starting point, not a lock: every value stays editable afterwards, and the custom tag records that you diverged.

v1.1.5 — Duplicate Modules in the Panel

2026-07-27

Bug Fixes

A resource declaring provide appeared several times in the panel. FiveM enumerates a provide alias as its own resource, and LoadResourceFile(alias, 'bridge_schema.lua') resolves to the provider's* schema — so HZ-Appearance, which provides qb-clothing, skinchanger and esx_skin, registered four identical Character modules. The loader now recognises an alias by comparing the resource's folder name with its resource name: a real resource always matches, an alias never does. Unknown resources fail open, so nothing legitimate is dropped.

Housekeeping

  • Removed five orphaned per-module saves left behind in data/ by those duplicates (esx_multicharacter, qb-clothing, qb-multicharacter, qb-spawn, qb-weathersync). Safe to delete on your own install too — they were never read by a real module.

v1.1.4 — ak47_inventory

2026-07-03

New Features

  • ak47_inventory adapter. Auto-detected like every other inventory backend, no configuration needed.

v1.1.3 — Panel Order + Usable-Item Diagnostics

2026-06-19

Improvements

  • The panel's module list follows the player journey, not the boot order. Modules are now sorted along a stable logical sequence — theme, then join flow, then in-game UI, then world, then activities — instead of appearing in whatever order the resources happened to start. Anything not in the list appends at the end, alphabetically by label.
  • HZ-Television's panel view is registered and available.

Bug Fixes

  • RegisterUsableItem no longer fails in silence. When no inventory adapter implements it, the call falls back to the framework's usable-item registry — which does not exist on standalone, and is bypassed by some inventories (qb-inventory standalone, codem…). Previously the item simply never fired and nothing said why. It now prints an explicit warning on standalone, and an explicit error when neither an inventory nor a framework adapter can register the item, naming the item in both cases.

v1.1.2 — HZ-Weather Panel Polish

2026-06-09

> Two small but high-impact polish fixes for the HZ-Weather views inside the unified panel. No hz_lib core changes.

Bug Fixes

  • Events panel showed IDLE after reopen mid-event. The Tsunami / Tornado view subscribed to viewData updates but never asked the server for current state on mount. Now invokes requestData on mount and seeds the state from GlobalState.tsunami / GlobalState.tornado. Requires HZ-Weather v1.3.0+ for the matching schema allowlist.

New Features

  • Immediate time change confirmation modal. Clicking "Apply time" in the HZ-Weather Time panel with the Immediate option checked now opens a confirm dialog showing the target time, a warning that every player on the server sees the snap, and a hint to uncheck Immediate for a smooth transition instead. Cancel / Apply Immediately buttons, Esc dismisses, Enter confirms. The Quick Set buttons (00:00, 06:00, 12:00, 18:00) go through the same modal — no accidental midnight snaps from a stray click.

Upgrade Notes

> Preserve your saved configs when updating. hz_lib stores every panel-saved value under hz_lib/data/ — one JSON file per module (hz_weather.json, hz_hud.json, hz_television.json, etc.) plus the deprecated archive and the audit log. Overwriting the resource folder on update wipes your saved panel state.
>
> Procedure:
>
> 1. Stop the server.
> 2. Copy your existing hz_lib/data/ folder somewhere safe.
> 3. Replace the hz_lib resource with the new build from Keymaster.
> 4. Copy your saved data/ folder back into the new hz_lib/data/ (overwrite the freshly-shipped files).
> 5. Start the server. Panel saves intact.

Files inside hz_lib/data/:

  • *.json — per-module panel saves (operator config), keep.
  • *.deprecated.json — archive of removed fields, safe to drop.
  • _audit.log — who changed what / when, safe to drop if you don't need the history.

v1.1.1 — Hotfix : ACE Permission Mismatch + Actionable Error

2026-05-18

Bug Fixes

  • ACE fallback inconsistency — when HZBridge.Panel.AcePermission was missing, nil, or empty in config.lua, the panel fell back to "hz_lib.admin" while the documented default (and the config.lua shipped default) were both "admin". Customers with a valid add_ace group.admin admin allow were locked out for no reason. Fallback now correctly resolves to "admin", aligned on config + docs.
  • Fixed in both modules/panel/api_server.lua and modules/panel/theme.lua (the mismatch lived in two places).

Improvements

  • Permission error message is now actionable. When /hzpanel ACE check fails, the server console prints the exact two lines to copy-paste, with the player's license already interpolated:
    add_principal license:abcdef... group.admin
    add_ace group.admin admin allow
  • Chat notification names the missing ACE node explicitly instead of a vague "perm. hz_lib". Players know exactly what to fix.
  • The console output also explicitly flags that command.hzpanel is NOT the right ACE node — customers were trying it out of confusion (most common ticket source pre-v1.1.1).

Upgrade Notes

  • Drop-in replace. No config / DB / event / schema changes.
  • If your panel was working in v1.1.0 it still works in v1.1.1 — the fix only unblocks customers who were locked out by the bad fallback.
  • See the Permissions setup section of the Admin Panel guide for the canonical setup (and the qb-core boilerplate gotcha that explains why so many tickets reference this).

v1.1.0 — Centralised Admin Panel + Theme Cascade

2026-05-15

The headline change: hz_lib ships a full in-game admin panel. Every HZ-Script module now declares its config schema via a small Lua DSL, and the panel auto-builds a typed editor for it. No more per-script commands, no more touching config.lua between every tweak, no more restart-to-apply.

New Features

  • /hzpanel command — opens the central admin panel in-game. ACE-gated (default admin, configurable via HZBridge.Panel.AcePermission). Skips the ACE check entirely when HZBridge.Panel.DevAllowAll = true (dev only — turn off in production).
  • Schema DSL (bridge_schema.lua) — every module declares its config as a sandboxed Lua chunk that calls module() / section() / group() / field() / invariant() / migrations(). The panel auto-builds a typed editor from the declaration. Field types supported: boolean, number, string, enum, color, keybind, list<string>, list<object>, vehicle-list, weapon-list, action, enum-action, view.
  • enum-multi field type — constrained multi-select picker (toggle chips). Stored as list<string>, but the admin can only tick values from a fixed choices array. First consumer: HZ-Weather's BlackoutExceptions.
  • Custom views — modules can register full-width React components in the panel under web/src/views/<module>/. Used by HZ-Weather to ship a polygon + circle zone editor, a satellite map, a forecast graph, a calendar, a seasons panel, and a time controller.
  • Theme cascade ("Apparence" tab) — one place to control the visual surface of every HZ NUI. Four orthogonal axes:
* Accent (accent / accentHi / gold) — Vice signature pink / hot pink / gold. Presets: Vice, Industrial. * Surfaces (surface / subpanel / tint) — outer panel / inner sub-panel / hover tint. RGB only — opacity decided per consumer via rgb(var(--hz-surface-rgb) / 0.X). * Gradient mode (gradient / solid) — solid collapses every accent gradient to a 1-stop flat fill. * Radii (radiusNone / Xs / Sm / Md / Lg / Xl) — six-tier corner scale. Presets: Sharp (0/2/4/6/8/10), Soft (0/3/6/8/12/16), Round (0/4/8/12/16/20), Industrial (0/0/2/2/4/4).
  • Live broadcasthz_lib:theme:updated (server + client) fires on every save. Resources subscribe and apply applyTheme() to their own NUI. New GetTheme() export returns the current effective theme synchronously.
  • OpenPanel(src, module?) server export — open the panel for a player from another script, optionally preselecting a module's tab.

Safety + ops

  • Sandboxed schemas — DSL runs without raw io / os / debug, with restricted string / table / math subsets. A buggy bridge_schema.lua fails to load (logged) but can't crash the server.
  • Rate-limited writes — default 10 writes per 5s per source (configurable).
  • Session tokens — every panel open issues a short-lived token (default 5 min TTL) that gates every save.
  • Per-source ACE check on every action — not just at panel open. A revoked admin can't keep editing on an already-open panel.
  • Audit log — every accepted save writes a line to data/audit-YYYY-MM-DD.log. Rolling files older than AuditRetentionDays (default 90) are pruned at boot.
  • Atomic writes — effective config per module is written via tmpfile + rename (data/<module>.json). Pending writes use data/<module>.pending.json and are committed atomically.

Performance

  • Map tile pre-fetch — the 257 satellite tiles used by HZ-Weather's Map / ZoneEditor views are pre-warmed in CEF's cache at panel mount via requestIdleCallback, capped at 12 concurrent requests. First open of a map view is now instant instead of 1-3s.
  • No backdrop-filter anywhere — compositor blur was removed from every HZ NUI (the previous "allowed on overlays" carve-out is revoked). Even paused overlays cost 8-12 FPS to a single blur. Replaced with deeper alpha scrims (rgba(0,0,0,0.78)+ on backdrops, 0.55–0.92 on glass cards).

Improvements

  • Mercator-safe circle rendering in HZ-Weather views — Cayo Perico (game Y ≈ -5150) used to render circles too small because the previous <circle r=radius/SCALE_X> ignored Mercator stretch at high latitudes. Now uses a true projected ellipse with local px-per-meter on each axis. Both the editor and the map view agree.
  • Default Apparence colour matches the rest of the HZ ecosystem — Vice palette + Vice surfaces + Sharp radii pre-applied at first boot.

Upgrade Notes

  • No breaking changes for consumers of the bridge's framework / inventory / notification APIs — those continue to work identically.
  • Resources that want to expose config in the panel ship a bridge_schema.lua at their root. See the Admin Panel guide for the DSL reference.
  • If you set HZBridge.Panel.DevAllowAll = true while iterating, set it back to false before going live — the panel is a serious tool, not something to leave open.

v1.0.0 — Initial Release

2026-02-15

  • Universal framework adapter — auto-detects ESX, QBCore, QBX, Ox Core, vRP, or runs standalone
  • Inventory adapter — ox\_inventory, qs-inventory, ps-inventory, codem, core, origen, tgiann, or framework native
  • Notifications adapter — ox\_lib, okokNotify, mythic\_notify, codem, pNotify, framework, or GTA native
  • Target adapter — ox\_target, qb-target, interact, or built-in TextUI fallback
  • Menu / input adapter — ox\_lib (full), qb-menu + qb-input, ESX menu, or GTA native fallback
  • Dispatch adapter — cd\_dispatch, ps-dispatch, qs-dispatch, rcore\_dispatch, emergencydispatch, or built-in
  • Bidirectional callbacks (client ↔ server) with rate limiting + timeout
  • Built-in minigames — progress bar, skill check, sequence
  • Single 'auto' mode that resolves the right backend per system