Add repo setup orchestration commands

.env.example

@@ -1,7 +1,9 @@
 # Checkout Kit sample storefront configuration.
-# Copy this file to .env, fill in local values, then run:
+# Copy this file to .env, fill in local values, then run dev bootstrap or:
 # scripts/setup_storefront_env
-# Optional Apple Pay and Customer Account API values can stay blank.
+# Direct interactive setup prompts for optional Apple Pay and Customer Account
+# API values by default. dev up/dev bootstrap use non-interactive setup, so
+# missing optional values can stay blank.
 #
 # Do not commit real values from .env or generated platform config files.
 

.github/CONTRIBUTING.md

@@ -2,7 +2,7 @@
 
 The following is a set of guidelines for contributing to this project. Please take a moment to read through them before submitting your first PR.
 
-This is a monorepo containing the iOS/Swift, Android, and (forthcoming) React Native implementations of the Shopify Checkout Kit. Each platform has its own conventions, tooling, and release process; the shared guidelines below apply to all of them.
+This is a monorepo containing the Swift, Android, React Native, and Web implementations of the Shopify Checkout Kit. Each platform has its own conventions, tooling, and release process; the shared guidelines below apply to all of them.
 
 ## Code of Conduct
 
@@ -48,7 +48,25 @@ dev up
 dev check
 ```
 
-Platform-scoped commands are available as `dev android <command>`, `dev swift <command>`, and `dev react-native <command>` (or `dev rn`). Protocol schema/model commands are available as `dev protocol <command>`. For cross-platform changes, use `dev lint`, `dev test`, `dev check`, `dev format`, and `dev build`.
+`dev up` performs full DevHub provisioning, then runs Checkout Kit's repo-owned
+setup steps. Those repo-owned steps are summarized at the end so a Swift,
+Android, React Native, or Web setup failure is visible without hiding later
+platform results. If a platform-specific setup step fails, fix it and rerun that
+platform directly, for example `dev swift setup`. To rerun the repo-owned setup
+summary without DevHub's native provisioning, use `dev bootstrap`.
+
+Setup creates or syncs sample app storefront configuration from the repo-root
+`.env`. If `.env` is missing, setup prompts for required storefront values and
+then generates the Android, Swift, and React Native sample config files.
+Optional Apple Pay and Customer Account API values are preserved if already set,
+but `dev up` leaves missing optional values blank instead of prompting. To fill
+optional values interactively, run `dev storefront-env sync --prompt-optional`.
+
+Platform-scoped commands are available as `dev android <command>`, `dev swift <command>`, `dev react-native <command>` (or `dev rn`), and `dev web <command>`. Each platform also supports `dev <platform> setup` and `dev <platform> up` for platform-local setup when the full repo does not need to be reprovisioned. Protocol schema/model commands are available as `dev protocol <command>`. For cross-platform changes, use `dev lint`, `dev test`, `dev check`, `dev format`, and `dev build`.
+
+React Native sample apps can be run against local in-repo SDK sources with
+`dev rn ios --local` or `dev rn android --local`. The Web sample accepts a
+checkout URL directly and does not use the shared storefront credential files.
 
 ---
 
@@ -121,7 +139,7 @@ If your change intentionally modifies the public API:
 2. Review the diff in `platforms/android/lib/api/lib.api` alongside your code changes.
 3. Commit the updated `.api` file in the same PR.
 
-If you did *not* intend to change public API and `apiCheck` is failing, the diff shows what your change inadvertently affected — treat it as a signal that something in your PR has consumer-visible impact.
+If you did _not_ intend to change public API and `apiCheck` is failing, the diff shows what your change inadvertently affected — treat it as a signal that something in your PR has consumer-visible impact.
 
 ### Releasing a new Android version
 

AGENTS.md

@@ -5,6 +5,7 @@ platforms/
   swift/         # iOS Swift Package and CocoaPods sources
   android/       # Android library and sample apps
   react-native/  # React Native wrapper
+  web/           # Web component package and sample app
 protocol/        # cross-platform communication layer based on UCP
 e2e/             # cross-platform end-to-end tests
 .github/         # workflows, issue templates, CODEOWNERS
@@ -27,10 +28,23 @@ For platform-scoped work, prefer the root `dev.yml` commands:
 - Android: `dev android <command>`
 - Swift: `dev swift <command>`
 - React Native: `dev react-native <command>` or `dev rn <command>`
+- Web: `dev web <command>`
+
+Use `dev <platform> setup` or `dev <platform> up` for platform-local setup when
+the full repo has already been provisioned. Use `dev bootstrap` to rerun the
+repo-owned setup aggregator without rerunning DevHub's native provisioning.
 
 For protocol schema/model work, use `dev protocol <command>`.
 
 For cross-platform changes, use the repo-wide aggregates: `dev lint`,
 `dev test`, `dev check`, `dev format`, and `dev build`. Use
 `dev <platform> format` for formatting; `fix` remains an alias for existing
 workflows.
+
+## Sensitive configuration
+
+Treat storefront environment and generated sample app configuration values as
+sensitive. Never print, commit, paste, or document real values from `.env`,
+generated platform config, access tokens, merchant identifiers, shop IDs,
+account IDs, or storefront domains. Use synthetic placeholders for docs and
+verification.