Changelog
Curated per release. It records what changes for you — what you can now do, what behaves differently, what to check before upgrading. The full commit history lives in the repository.
Every version below is an image you pin. Nothing upgrades you; you choose when. See deploy & the fleet.
v0.3 — the surfaces become a product
Section titled “v0.3 — the surfaces become a product”The release where the four surfaces stopped being an internal detail and became something a customer builds against.
Self-serve API keys. Issue a narrow, named credential from the admin or through the port. The key is the actor: the audit trail records its name on every call, refusals included. Scopes are fenced subset-of-issuer, and rotation mints a new credential on the same actor with an overlap window — an integration survives its own deploy without a flag day. See issue & rotate API keys.
A remote MCP endpoint. /mcp on your instance, authenticated with an API key. The tool list is the
registry, scoped to what the credential carries: a read-only key sees only reads. See
MCP: connect an agent.
A distributed CLI. npm i -g @forgecommerce/cli. Log in, store several instances, drive the whole
registry by name. See CLI: forge login.
A typed SDK. @forgecommerce/sdk — three methods, every command and read reached by name, inputs and
results typed from the registry’s own schemas. Nothing throws; every call returns a result you have to
handle. See SDK: npm install.
Rate limiting with a published contract. RateLimit-* headers on every authenticated response, success
or not, so you can design a backoff before you need one. The subject is the credential per tenant — one
runaway integration cannot take the others down.
Read scopes on the operator face. Areas of the business — logistics, promotions, the catalogue, the activity trail — became grantable names instead of things any tenant credential could read. Roles can now express “who on my staff sees what”.
This documentation. Generated from the same registry as the surfaces, so a reference page cannot describe an endpoint that is not there.
Changed
Section titled “Changed”The internal read face is gated by scope. Reads that previously answered any authenticated operator now require one of seven area scopes. ⚠️ Check before upgrading: a custom role built by cloning a builtin may not carry the new names. The scopes page lists what gates what.
Personal data is masked without pii.read. The shape of a response is unchanged; the values come back
masked. Code that reads the fields keeps working; code that matched on their values will not.
Command names, input schemas and read shapes are additive in this release: nothing that worked in v0.2 stops
working. The one behavioural change that can bite is the read gating above, and it fails loudly — a named
forbidden, never an empty list.