Developer changelog

This page establishes the current Developer Platform baseline. It does not invent historical releases. Future entries should identify the affected API or app-version contract and use one of the categories below.

2026-09-09 — Read capabilities

• Four newly requestable scopes provide six read endpoints for customer contacts, active discounts, inventory and store identity. Each uses explicit reviewed contracts and merchant consent.
• New reads use exact timestamp/UUID cursors and recheck authority inside the data transaction. Bank settings, internal notes and redemption records are excluded.
• Product, discount and order write scopes remain disabled.

Added and Security — 2026-09-09

• Merchant login, reviewed consent, explicit store selection and one-use S256 authorization are implemented behind the release gate.
• Three operational scope contracts are enforced; seven unsupported scope requests are disabled. Future expansion requires fresh review and consent.
• Queued webhook delivery now checks immutable authorization provenance and one-use admission. Already admitted requests cannot be recalled.
• Resource event producers and bounded uninstall receipts are implemented with explicit merchant event consent. Full environment acceptance remains pending; Marketplace installation stays disabled.

Categories

• Added: a new backward-compatible public capability or document.
• Changed: a compatible clarification or behavior change within a current contract.
• Deprecated: a current capability with published replacement and governance.
• Removed: a capability removed according to published governance.
• Security: a public security correction or developer action requirement, described without exploit-sensitive internals.

Security — 2026-08-24

• Marketplace public listing metadata now comes from immutable reviewed, version-scoped snapshots, and publication is serialized around the protected active listing pointer.
• Legacy listing provenance that cannot be proven fails closed. A legacy submitted version must be rejected before its owning developer supplies a complete replacement draft and returns to the normal review lifecycle.
• Historical follow-up: exact-version and generation-bound authorization subsequently merged in PR #188. The current reference describes the implemented behavior.
• Existing installations remain pinned to their installed app versions and granted scopes. See the later entry for subsequent consent, capability and delivery work; Marketplace remains disabled/pre-enable.

Baseline — 2026-08-23

Added

• Bilingual Developer Wiki sources with stable shared slugs, ownership, status, verification date, hierarchy, and API applicability.
• Public extension-boundary and authorization references.
• Canonical references for five API v1 operations and ten registered scopes.
• Marketplace development rules, prohibited behavior, lifecycle values, testing model, and review flow.

Changed

• OAuth is documented as PARTIAL because merchant consent initiation is incomplete.
• Product and order scope coverage is documented narrowly and truthfully.
• Webhook declarations are separated from verified emitted business events.
• Webhook creation is documented to return a one-time signing secret.
• API errors and the fixed-window per-installation/per-route rate limit now match current runtime behavior.

Deprecated

• None. Formal deprecation governance is planned.

Removed

• No public runtime capability was removed. Unsupported documentation claims were removed from the contract.

Security

• Public rules now prohibit internal topology dependencies, private database access, service-role usage, credential logging, cross-tenant access, and authorization bypass.