@siglume/api-sdk 0.7.6 → 0.8.0

package/README.md

@@ -2,7 +2,7 @@
 
 TypeScript runtime for building, testing, and registering Siglume developer apps.
 
-This package is prepared in the public SDK repo and ships with the v0.4 release line.
+This package is prepared in the public SDK repo and ships with the current v0.7.6 release line.
 
 It also includes `draft_tool_manual()` and `fill_tool_manual_gaps()` with
 bundled `AnthropicProvider` and `OpenAIProvider` classes. Provide
@@ -21,7 +21,7 @@ const result = await draft_tool_manual({
 console.log(result.quality_report.grade);
 ```
 
-Buyer-side runtime helpers are also included:
+Buyer-side discovery and export helpers are also included:
 
 ```ts
 import { SiglumeBuyerClient, to_anthropic_tool } from "@siglume/api-sdk";
@@ -29,13 +29,16 @@ import { SiglumeBuyerClient, to_anthropic_tool } from "@siglume/api-sdk";
 const buyer = new SiglumeBuyerClient({
   api_key: process.env.SIGLUME_API_KEY ?? "sig_mock_key",
   default_agent_id: process.env.SIGLUME_AGENT_ID,
-  allow_internal_execute: true,
 });
 
 const listing = await buyer.get_listing("currency-converter-v2");
 const anthropicTool = to_anthropic_tool(listing.tool_manual).schema;
 ```
 
+`SiglumeBuyerClient.invoke()` remains experimental and stays gated behind
+`allow_internal_execute: true` for privileged test environments until a public
+buyer execution route is available.
+
 See [`../docs/buyer-sdk.md`](../docs/buyer-sdk.md) and
 [`../examples/buyer_claude_agent_sdk.ts`](../examples/buyer_claude_agent_sdk.ts)
 for the current experimental limitations and the mocked integration example.
@@ -50,3 +53,31 @@ siglume init --from-operation owner.charter.update ./my-charter-editor
 
 See [`../docs/template-generator.md`](../docs/template-generator.md) for the
 generated file layout, fallback behavior, and review samples.
+
+For API Store publishing, the recommended CLI flow is:
+
+```bash
+siglume init --template price-compare
+siglume test .
+siglume score . --offline
+
+# Issue SIGLUME_API_KEY from Developer Portal -> CLI / API keys before production checks:
+siglume validate .
+siglume score . --remote
+siglume preflight .         # checks blockers without creating a draft
+siglume register .            # preflight + draft only
+siglume register . --confirm # confirm + publish
+```
+
+`siglume register` reads `tool_manual.json`, the local Git-ignored
+`runtime_validation.json`, and optional local Git-ignored
+`oauth_credentials.json`. Generated projects keep runtime validation and OAuth
+credential files Git-ignored because they can contain review keys and client
+secrets. SDK / HTTP automation can pass
+`source_url`, `source_context`, and `input_form_spec` directly to
+`auto-register`. The CLI runs preflight by default, then calls the same
+`auto-register` route used by SDK / automation clients. Re-run the
+same `capability_key` to stage an upgrade. The server-side publish gate
+includes runtime checks, contract checks, seller OAuth checks, pricing / payout
+rules, and a mandatory fail-closed LLM legal review for law compliance plus
+public-order / morals compliance.