Changelog
Developer changelog
Changes to the app SDK, App Bridge, the CLI and Store API webhooks, each dated by its npm release or code merge. Every entry says who is affected and what to do.
Latest on npm
Published versions on the public npm registry.
October 2026
- @tanqory/plugin-sdk 0.6.4
@tanqory/plugin-sdk 0.6.4 installs cleanly from npm
The published package now depends on a real @tanqory/app-bridge version. Versions 0.3.0 to 0.6.3 failed to install outside our repository.
What to do Install again. A fresh scaffold resolves 0.6.4 and app-bridge 0.7.1 on its own; an existing project needs one upgrade.
September 2026
- Store API webhooks
Webhook deliveries now carry an X-Tanqory-Topic header
Every delivery and every test send names its topic, such as orders/create, in a new header. No mapping table on your side.
What to do Route on
X-Tanqory-Topicand retire any event name mapping you keep. - @tanqory/plugin-sdk 0.6.3, @tanqory/app-bridge 0.7.1
SDK and App Bridge tarballs ship an MIT license file
plugin-sdk 0.6.3 and app-bridge 0.7.1 include the LICENSE their package.json names, and plugin-sdk no longer ships compiled test files.
What to do Nothing. The next upgrade picks it up.
- @tanqory/app-bridge 0.7.0, @tanqory/plugin-sdk 0.6.2
can(scope) now checks the scopes a merchant granted your app
App Bridge passes grantedScopes to marketplace apps, and useTanqoryApp().can() refuses any scope outside that grant.
What to do Treat those three fields as optional, and expect
can()to return false for scopes your manifest did not request.
August 2026
- @tanqory/cli 0.9.0
CLI 0.9.0 sends your support and privacy links on submit
supportUrl and privacyPolicyUrl from tanqory.app.json now reach your listing, and app deploy warns when the listing is still empty.
What to do Upgrade, deploy again, and fill any listing field the warning names in the Dev Dashboard.
- @tanqory/plugin-sdk 0.6.1, create-tanqory-app 0.3.1
Apps can take their own top level menu entry with root
navigation.placement documents a thirteenth value, root, for an app that is not an extension of an existing dashboard section.
What to do Set
navigation.placementtorootin tanqory.app.json if your app needs its own entry. - @tanqory/cli 0.8.0
tanqory app dev runs more than once, and app withdraw is new
The dev loop withdraws its own queued submission before it files again, so every save no longer stops on a pending review.
What to do Upgrade the CLI. If a submission is stuck in the queue, withdraw it.
- @tanqory/plugin-sdk 0.6.0, create-tanqory-app 0.3.0, @tanqory/cli 0.7.1
New apps ship AGENTS.md and a JSON Schema for the manifest
A scaffolded project now tells your coding assistant the rules that fail silently, and editors validate tanqory.app.json as you type.
What to do Upgrade the CLI and push again. In an older project, add the
$schemaline to get editor checks. - @tanqory/plugin-sdk 0.5.0
Apps can send a notification type or add a delivery channel
Manifest v2 accepts notification-override and notification-channel capabilities, with a dispatchUrl Tanqory posts rendered messages to.
What to do Declare the capability and a public https dispatchUrl, then submit for review.
- Store API webhooks
New app topics: customers/redact and store/redact
Apps receive a notice when a customer's data must be erased, and 48 hours after uninstall to erase a store's data.
What to do Handle both topics and delete what you hold for that customer or store.
- Store API webhooks
Rotate one webhook's secret with a 24 hour grace window
Each subscription rotates its own signing secret, and the old one keeps signing for 24 hours. The store wide rotate route is deprecated.
What to do Rotate per subscription, and check every
v1entry in the signature header, not only the first. - @tanqory/plugin-sdk 0.4.0
Manifest v2: your app's place in the dashboard joins review
tanqory.app.json takes appType, navigation, iframe and provides, so the SDK validates them and review sees them.
What to do Move your menu and frame settings into tanqory.app.json and remove any
embeddedPath. - @tanqory/app-bridge 0.6.0, 0.5.0
App Bridge adds modals, a resource picker, title bar and save bar
Embedded apps can open dashboard native modals, pickers, a loading bar, title bar actions and the save bar from inside their frame.
What to do Swap your own versions for the bridge calls so the app looks native.
- @tanqory/cli 0.7.0
tanqory app: one command for the local app loop
The CLI gains app init, app dev, app deploy and app info, the app counterpart of theme dev.
What to do Install the CLI and start from
tanqory app init. - @tanqory/app-bridge 0.4.0
App Bridge validates every message and stamps a protocol version
Malformed messages are refused at the boundary, every envelope carries a version, and a hung host handler times out after 15 seconds.
What to do Nothing. Upgrade to pick it up.
- create-tanqory-app 0.2.2
App template verifies webhooks with the webhook secret
The scaffolded handler now checks signatures with TANQORY_WEBHOOK_SECRET, the per installation secret that signs deliveries.
What to do Store the webhook secret from the token response and verify with it.
- @tanqory/plugin-sdk 0.3.0, @tanqory/app-bridge 0.3.0
Embedded app API calls now go through the dashboard
api.get() and friends travel over the bridge and are signed with a token scoped to your app's grant. createTanqoryApp now needs an apiBase.
What to do Upgrade to the latest release. If you stay on 0.3.x, pass
apiBasewhen you create the server client. - @tanqory/plugin-sdk 0.2.0, @tanqory/app-bridge 0.2.1
@tanqory/plugin-sdk: the package to build a Tanqory app
First public release. One hook boots an embedded app, and the server half exchanges tokens and verifies webhook signatures.
What to do Start from create-tanqory-app, which wires the SDK for you.
July 2026
- @tanqory/cli 0.2.0
@tanqory/cli: build storefront themes from your terminal
First public theme CLI: sign in, start a theme, preview it on localhost with live store data, push, pull and submit for review.
What to do Install the CLI and run
tanqory theme init.