@asstio-dev/storefront 0.1.0 → 0.2.0

package/README.md

@@ -9,6 +9,11 @@ deliberate commit, so a change here always shows up in a diff.
 npm install @asstio-dev/storefront
 ```
 
+Setting a shop up in the first place — the Asstio-side MCP calls, the API key kinds, CORS, the filter and
+price model — is one document: [`docs/PUBLIC_STOREFRONT_ONBOARDING.md`](../../docs/PUBLIC_STOREFRONT_ONBOARDING.md),
+served publicly at <https://api.storefront.asstio.com/docs/onboarding>. This file is only about using the
+package.
+
 ```ts
 import { createStorefrontClient, filterQuery } from "@asstio-dev/storefront";
 
@@ -132,12 +137,46 @@ Errors are never stored (`Cache-Control: no-store`) and never carry an ETag.
 
 ## Development
 
+From `sdk/typescript`:
+
 ```bash
-npm install
+npm ci
 npm run build     # regenerates src/schema.d.ts from the snapshot, compiles, then typechecks the examples
 npm run check     # fails if the committed schema.d.ts is stale, modified or untracked, or an example broke
 ```
 
 `src/schema.d.ts` is generated **and committed**: it is reviewed in pull requests exactly like the
-OpenAPI snapshot it comes from. After changing the API, regenerate the snapshot
-(`UPDATE_SNAPSHOTS=1 dotnet test --project tests/Storefront.Api.Tests`), then `npm run build` here.
+OpenAPI snapshot it comes from. After changing the public API, regenerate the snapshot from the repo
+root, then build and check the SDK:
+
+```bash
+UPDATE_SNAPSHOTS=1 dotnet test --project tests/Storefront.Api.Tests -- --filter-query "/*/*/OpenApiSnapshotTests/*"
+cd sdk/typescript
+npm ci
+npm run build
+npm run check
+```
+
+Review and commit `tests/Storefront.Api.Tests/Snapshots/openapi-v1.json` and
+`sdk/typescript/src/schema.d.ts` together. An API or worker implementation change that leaves the
+OpenAPI snapshot unchanged does not require a generated SDK change.
+
+## Publishing
+
+The SDK and backend share a release version. Do not edit the placeholder version in `package.json`
+and do not run `npm publish` locally. Pushing a repository tag such as `v1.2.3` runs
+`publish-npm.yml`, which derives version `1.2.3` from the tag, installs and checks the package, runs a
+publish dry run, and creates a pending staged package through npm trusted publishing. No long-lived
+`NPM_TOKEN` is used.
+
+The tag does not make the package public. A maintainer must inspect and approve it with npm 2FA, on
+the npm website under **Staged Packages** or with npm 11.19 or newer:
+
+```bash
+npm stage list @asstio-dev/storefront
+npm stage view <stage-id>
+npm stage approve <stage-id>
+```
+
+After approval, verify the registry version and a clean consumer install. The full API, worker, and
+npm release checklist is in [`docs/ops/deploy.md`](../../docs/ops/deploy.md).