Changelog · TeamGrid Developer

Track TeamGrid Developer Platform documentation, API, SDK, CLI, and MCP changes.

Current platform

API v1 uses the stable 1.1.0 contract while the SDK, CLI, and MCP npm packages are synchronized at stable version 1.1.0. Authoritative changes are recorded in the public source repositories and their release history:

Breaking changes are not made silently. OpenAPI contract changes, package versions, and migration notes are reviewed together before release.

Subscribe to the Atom changelog feed or consume the machine-readable release history.

Developer Platform 1.1.0 · 2026-08-18

Added advanced recurring tasks as task automation with immutable definition versions, deterministic wall-clock or elapsed-time policies, business calendars, lifecycle controls, occurrence overrides, external triggers, recovery operations, and ordinary generated tasks.
Added 26 recurrence operations across API v1, TypeScript SDK, and CLI, including the explicit compare-and-set workflow that ends a series and removes recurrence links from its tasks while preserving occurrence audit history. Seven bounded recurrence reads are available in the curated MCP server; mutation, event-ingress, and operation-control tools remain deliberately excluded.
Added short-lived, definition-bound placeholder proofs and If-None-Match: * so a stored-preview occurrence can be overridden before its immutable ledger row exists. Existing occurrences retain strong ETag and If-Match concurrency.
Expanded the synchronized contract to 154 paths, 237 governed operations, 90 scopes, and a 24-resource durable change feed. The SDK exposes 236 mapped operations through 54 clients; the CLI exposes 243 commands in 54 groups, and MCP exposes 36 curated read-only tools.
Qualified aligned 1.1.0 package artifacts with production dependency, edge-runtime, type, conformance, redaction, size-budget, and clean packed-install gates.

Developer Platform 1.0.7 · 2026-08-16

Added an explicit descriptionFormat field for task descriptions so clients can distinguish legacy HTML from Markdown without guessing or silently rewriting existing customer content.
Kept task description reads and writes backward compatible while exposing the format in the API, TypeScript SDK, CLI, and MCP metadata.
Synchronized the generated SDK, CLI, MCP, downloadable examples, and machine-readable references with the exact 1.0.7 package source.

Developer Platform 1.0.6 · 2026-08-10

Added scope-free, credential-authenticated self-inspection and exact self-revocation. CLI auth status --check now verifies the server context, while auth logout --revoke removes local state only after TeamGrid confirms permanent revocation.
Added signed webhook test delivery through the same cell-local queue, worker, HTTPS, signing, retry, and history path as production events without changing webhook health counters or automatic disablement.
Added bounded streaming export downloads to the TypeScript SDK and a read-only, redacted teamgrid doctor report for configuration, credential, routing, network, compatibility, and capability diagnostics.
Hardened the MCP server with exact allow/deny tool filters, strict output schemas, bounded structured errors, prompt-injection guidance, and unconditional removal of finance-sensitive product and time-entry fields.
Expanded the synchronized stable contract to 132 paths and 211 operations, with 210 SDK methods, complete CLI mappings, and an explicit MCP exposure decision for every operation. API v0 remains frozen at all 87 compatibility operations.
Added edge-runtime qualification and recoverable positive mutation certification with exact inventory coverage, idempotent intent journaling, reverse-order cleanup, and fail-closed recovery.

Developer Platform 1.0.5 · 2026-08-08

Published aligned 1.0.5 releases of the TypeScript SDK, CLI, and curated read-only MCP server.
Hardened CLI credential-store handling so secrets remain outside process arguments while preserving native macOS Keychain, Linux Secret Service, and Windows Credential Manager support.
Kept the API v1 contract stable at 208 total operations and 206 authenticated operations; patch releases 1.0.4 and 1.0.5 do not add authority or change API semantics.
Completed public documentation for browser login, workspace selection, pairing phrases, scope presets, PKCE loopback, remote terminals, named profiles, logout, revocation, and troubleshooting.
Updated installation, compatibility, SDK, CLI, MCP, OpenAPI, search, and machine-readable release material to the same stable package checkpoint.

2026-08-05

Published aligned 1.0.3 releases of the TypeScript SDK, CLI, and curated read-only MCP server from one production-qualified source commit.
Added secure first-party CLI browser authentication with Authorization Code, PKCE, pairing-phrase confirmation, operating-system credential storage, bounded scope presets, and manual-token fallback for remote or non-interactive environments.
Published the final 208-operation API surface, including the anonymous one-time CLI code exchange, while keeping all 206 authenticated operations bound to the action-policy registry.
Activated reveal-once Personal Tokens for user-owned workflows and Service Accounts for unattended integrations without enabling delegated OAuth.
Refreshed the fast-uri and Hono production dependency floors and verified clean package installs on the supported Node.js and operating-system matrix.

2026-07-27

Promoted the synchronized API v1, TypeScript SDK, CLI, and curated read-only MCP server to stable version 1.0.0.
Froze the stable boundary at 128 API paths, 206 governed operations, 87 scopes, and 73 classified product capabilities. Sixty-one capabilities are released, none are partial, six are planned, and six privileged or implementation-level capabilities remain intentionally private.
Added reveal-once personal-access credentials, native service accounts, resource grants, project sharing, conflict-safe task bulk operations, time-entry billing, bounded audit exports, and the qualified 23-resource durable change feed across their required public surfaces.
Added revision-safe task duplication, placement/reordering, and atomic checklist replacement across the API, TypeScript SDK, and CLI. MCP remains read-only for all three workflows.
Completed the stable task read projection with lifecycle, provenance, count, placement, and tracking fields, plus exact contact, group, list, service, subscriber, and tag filters across API, SDK, CLI, and the curated read-only MCP response surface.
Completed the task write field set with tenant-validated direct contact assignment, explicit project-contact inheritance, and whole-interval validation for partial planning-date updates.
Completed project reads with exact creator, contact, individual ID, list, manager and subscriber filters, stable ordering/provenance fields, and a non-financial progress summary whose nested upstream shape rejects private budget, revenue and time calculations.
Qualified strong ETags and mandatory If-Match preconditions for 17 project, task, and project-template mutations, including asynchronous lifecycle starts and template instantiation.
Added developer revisions to core resource DTOs and source/result revisions to qualified asynchronous operation resources.
Preserved the curated read-only MCP policy while aligning all 206 public operations across OpenAPI, SDK, CLI, and an explicit MCP exposure decision.

2026-07-21

Prepared the 1.0.0-beta.2 contract checkpoint with 111 paths, 181 operations, and 78 canonical scopes while preserving all 87 frozen API v0 operations.
Removed the unqualified /v1/changes operation, changes:read scope, ChangeEvent schema, SDK client, and CLI commands from the public beta. The internal implementation remains unavailable until preimage, ownership, retention, failover, and recovery semantics are fully qualified.
Withdrew the unqualified core resource-CAS experiment from the public Beta 2 checkpoint. The 25 project, task, project-template, lifecycle-operation, and template-instantiation operations no longer expose core If-Match parameters, developer revision fields, CAS extensions, or legacy revision-status responses. Project lifecycle and template instantiation remain asynchronous and idempotent.
Preserved the 31 independent If-Match operations for appointments, absences, comments, documents, files, custom-field values, planned work, workspace administration, automations, workspace settings, and webhook-secret rotation. Their endpoint-specific concurrency contracts are unchanged.
Aligned the API client, CLI, and MCP package versions at 1.0.0-beta.2. MCP remains a bounded read-only interface.
Corrected the earlier documentation mismatch: 1.0.0-alpha.3 was a source checkpoint and was never the version installed by npm next. Public installation instructions only move to beta 2 after all three packages have been published and verified.

2026-07-20

The resource-CAS entries below describe the internal beta.1 checkpoint. They were superseded by the static core contract recorded on 2026-07-21 and are not part of the public Beta 2 contract.

Published the code-owned developer-action-policy-v4 registry for all 182 operations and all 12 principal-policy families. V4 adds the conditional scopes and dynamic target policies required by collaboration, automation, custom-field content, calendar, work-management, and search/export; it is pinned by SHA-256 across API, App, packages, and documentation. Native personal, service-account, and OAuth issuance remains closed and is not implied by this contract update.
Published the internal 1.0.0-beta.1 contract checkpoint without changing the controlled-beta claim: the contract still contains 112 paths and 182 operations and does not claim complete TeamGrid product coverage.
Added opaque developerRevision and developerUpdatedAt fields to public project, task, and project-template representations, with body-to-header validation for type-specific prj1, tsk1, and tpl1 strong ETags.
Made If-Match mandatory on exactly 14 project, task, and project-template mutations. Missing, malformed, stale, legacy-operation, and temporarily unverifiable revision states use explicit 428, 400, 412, 410, and 503 responses.
Bound asynchronous project lifecycle and project-template instantiation requests to both their idempotency key and source revision. Operation resources now distinguish sourceRevision from a successful resultRevision.
Added SDK revision and ETag types, required mutation options, CLI --if-match handling, and read–mutate–reconcile guidance in the synchronized 1.0.0-alpha.3 package checkpoint. Typed transport ETags preserve their resource brand, and wait helpers bind polling to the accepted operation identity and source revision. MCP remains a curated read-only surface and exposes no resource-CAS mutation tools.
Kept revisions cell-local: clients must return a revision to the same credential-derived regional endpoint and must not use a global or cross-region bearer redirect.

2026-07-19

Expanded the controlled-beta API v1 contract to 112 paths and 182 operations, with matching SDK methods, CLI commands, and an explicit MCP exposure decision for every operation.
Added scope- and entitlement-aware system capabilities, secret-free workspace entitlements, a six-field revisioned workspace-settings resource, and an authorization-filtered event catalog.
Added credential-owned webhook configuration revisions and replay-safe reveal-once signing-secret rotation. Workspace administration, capability negotiation, event discovery, and secret rotation remain unavailable through MCP.
Added a machine-checked 73-entry product capability ledger plus a canonical SHA-256 manifest for the v0 inventory, both OpenAPI contracts, and the cross-interface policy.
Added asynchronous project complete, reopen, archive, and restore operations with idempotent start, durable status records, SDK polling helpers, and CLI wait controls.
Added scoped call-note and contact-group lifecycle resources. Call notes expose plain text rather than internal rich-text state; contact-group parent changes reject cycles and invalid hierarchies.
Added product, product-group, and project-statement resources. Product acquisition cost and project-statement budget data use separate finance read and write overlays.
Added scoped custom-field-definition lifecycle operations with canonical type/configuration validation and explicit legacy compatibility states. Dedicated custom-field-value operations use target-resource scopes and strong compare-and-set revisions.
Added metadata-only project templates with asynchronous, credential-owned instantiation and added bounded planned-work reads plus idempotent compare-and-set schedule replacement operations.
Added credential-owned webhook delivery history with pagination and sanitized attempt metadata. URLs, payloads, headers, bodies, signing secrets, and tenant-routing fields are not exposed.
Added a 90-day, cell-local metadata change feed with credential- and filter-bound checkpoints, explicit 410 resynchronization semantics, an authoritative caughtUp watermark, typed SDK bootstrap helpers, and script-safe CLI checkpoint output. The high-volume feed remains unavailable through MCP.
Added bounded calendar, absence, availability, comments, activity, document, private-file, workspace-administration, federated-search, export, automation, and integration-status contracts. Export capabilities are header-only and private storage is streamed through TeamGrid.
Expanded the read-only MCP profiles to 15 core tools and 29 all tools. Federated search is the only newly curated tool; product tools always omit purchasePrice, while personal schedules, files, exports, administration, automations, project statements, and webhook delivery history remain forbidden.
Removed Developer Platform audit events from MCP. Audit metadata remains available through the explicitly governed API, SDK, and CLI surfaces, but is forbidden in model transcripts.
Added API discovery, runtime response conformance checks, v1 rate-limit and retry documentation, immutable SDK transport metadata, and a Web Crypto webhook verifier with replay protection.
Added explicit task and time-entry restore operations, task timer start/stop, task complete/reopen, and the distinct timeentry_restored webhook event.
Added dedicated lifecycle scopes for lists, services, tags, products, product groups, project statements, call notes, contact groups, and custom-field definitions instead of coupling them to unrelated task or project access.

Legacy API v0 history

The previous ReadMe changelog has been preserved below for historical context: