Release notes

All versions below belong to contract v1 (cosuite-connect/1.0) and are backward compatible: an app built for an earlier version keeps working without changes. New features are opt-in through new optional fields or new capabilities. See the versioning rules.

#1.8.0: customer API gateway

October 28, 2026

• Customers call your module's API at https://api.cosuite.io/v1/apps/{app}/{path} with their CoSuite key; the gateway forwards to your app with a Connect signature and X-CoSuite-Gateway, X-CoSuite-Tenant, X-CoSuite-Scopes, X-CoSuite-Api-Key-Id. See Gateway & customer API.
• New exports: verifyGatewayRequest, signGatewayRequest, gatewayServer.
• The conformance test calls parameterless GET operations of modules with an api: answer for the test business, 404 tenant_not_found for an unknown business, 401 without a signature.
• The cosuite security scheme is final (bearer, CoSuite API key).

#1.7.0: module definition

October 28, 2026

• Modules can describe themselves in the manifest: description, features, api (OpenAPI 3.1 document and scopes), webhooks, provides, dataCategories and markets. All fields are optional. See module definition.
• The conformance test checks the module definition (only the fields you fill in) and downloads and checks each module's OpenAPI document: every operation must require a declared scope through security: [{ "cosuite": [...] }].
• New exports: checkModuleDefinitions, checkOpenApi, loadOpenApi, PROVIDES, DATA_CATEGORIES.
• The package is published under the MIT license.

#1.6.0: detaching linked accounts

October 27, 2026

• DELETE /tenants/{tenantId} for an account that was linked with a link code no longer deletes it. The account is detached: data, users and sign-in stay in your app, billing returns to you, and the response is { "deleted": false, "detached": true }. See DELETE /tenants.
• A linked account never counts as a test account.

#1.5.0: linking existing accounts

October 27, 2026

• New capability link: a business that already uses your app can connect its existing account to CoSuite with a one-time code instead of getting a new, empty account. POST /tenants carries link: { code }. See linking an existing account.
• New error code invalid_link_code (409).
• Conformance: every app must answer an unknown link code with 409 invalid_link_code and must not create an account.

#1.4.0 and 1.4.1

October 27, 2026

• No changes to the partner contract. Internal client additions in the package.

#1.3.0: customer sync

October 26, 2026

• New capability customers: GET /tenants/{tenantId}/customers (cursor pagination) and the customer.upserted and customer.deleted events. Your customers appear in CoSuite's customer list with your app's badge. See customers.
• Contract base URLs fixed: CoSuite's side of the contract is at https://api.cosuite.io/connect/v1.

#1.2.1: SSO through a landing page

October 26, 2026

• Clarified that an app may establish its session through its own landing page (one-time ticket in the URL fragment) before going to redirect. The conformance test accepts both flows. See SSO.

#1.1.0 and 1.2.0

October 26, 2026

• No changes to the partner contract. Contract snapshot and automated breaking-change check (contract:check) added to the package.

#1.0.0: first release

October 26, 2026

• HMAC-SHA256 request signature with timestamp window and request-id replay protection, error envelope and codes.
• App endpoints: manifest, health, tenants (create, read, update, delete), entitlements with versioning, members, usage, summary, SSO.
• CoSuite endpoints: entitlements, events, JWKS.
• SSO with ES256 JWT and JWKS.
• @cosuite/connect: signing, schemas, SSO, clients, server shell, reference app and the conformance test.