Add repo setup orchestration commands

.env.example

@@ -1,7 +1,9 @@
 # Checkout Kit sample storefront configuration.
-# Copy this file to .env, fill in local values, then run:
+# Copy this file to .env, fill in local values, then run dev up or:
 # scripts/setup_storefront_env
-# Optional Apple Pay and Customer Account API values can stay blank.
+# Direct interactive setup prompts for optional Apple Pay and Customer Account
+# API values by default. dev up uses non-interactive setup, so missing optional
+# values can stay blank.
 #
 # Do not commit real values from .env or generated platform config files.
 

.github/CONTRIBUTING.md

@@ -2,7 +2,7 @@
 
 The following is a set of guidelines for contributing to this project. Please take a moment to read through them before submitting your first PR.
 
-This is a monorepo containing the iOS/Swift, Android, and (forthcoming) React Native implementations of the Shopify Checkout Kit. Each platform has its own conventions, tooling, and release process; the shared guidelines below apply to all of them.
+This is a monorepo containing the Swift, Android, React Native, and Web implementations of the Shopify Checkout Kit. Each platform has its own conventions, tooling, and release process; the shared guidelines below apply to all of them.
 
 ## Code of Conduct
 
@@ -41,14 +41,30 @@ When in doubt about whether we will be interested in including a new feature, pl
 
 ### Dev tooling
 
-Shopify employees can use the root `dev.yml` from the repo root:
+Shopify employees can use the root `dev.yml` from the repo root or any platform
+directory:
 
 ```bash
 dev up
 dev check
 ```
 
-Platform-scoped commands are available as `dev android <command>`, `dev swift <command>`, and `dev react-native <command>` (or `dev rn`). Protocol schema/model commands are available as `dev protocol <command>`. For cross-platform changes, use `dev lint`, `dev test`, `dev check`, `dev format`, and `dev build`.
+`dev up` performs full DevHub provisioning, then runs Checkout Kit's repo-owned
+setup steps. Those repo-owned steps are summarized at the end so a Swift,
+Android, React Native, or Web setup failure is visible without hiding later
+platform results. If a setup step fails, fix it and rerun `dev up`.
+
+Setup creates or syncs sample app storefront configuration from the repo-root
+`.env`. If `.env` is missing, setup prompts for required storefront values and
+then generates the Android, Swift, and React Native sample config files.
+Optional Apple Pay and Customer Account API values are preserved if already set,
+but `dev up` leaves missing optional values blank instead of prompting.
+
+Platform-scoped commands are available as `dev android <command>`, `dev swift <command>`, `dev react-native <command>` (or `dev rn`), and `dev web <command>` after setup. Protocol schema/model commands are available as `dev protocol <command>`. For cross-platform changes, use `dev lint`, `dev test`, `dev check`, `dev format`, and `dev build`.
+
+React Native sample apps can be run against local in-repo SDK sources with
+`dev rn ios --local` or `dev rn android --local`. The Web sample accepts a
+checkout URL directly and does not use the shared storefront credential files.
 
 Sample app storefront configuration is generated from the repo-root `.env`.
 Shopify employees get this through `dev up`. External contributors can copy
@@ -142,7 +158,7 @@ If your change intentionally modifies the public API:
 2. Review the diff in `platforms/android/lib/api/lib.api` alongside your code changes.
 3. Commit the updated `.api` file in the same PR.
 
-If you did *not* intend to change public API and `apiCheck` is failing, the diff shows what your change inadvertently affected — treat it as a signal that something in your PR has consumer-visible impact.
+If you did _not_ intend to change public API and `apiCheck` is failing, the diff shows what your change inadvertently affected — treat it as a signal that something in your PR has consumer-visible impact.
 
 ### Releasing a new Android version
 

AGENTS.md

@@ -5,6 +5,7 @@ platforms/
   swift/         # iOS Swift Package and CocoaPods sources
   android/       # Android library and sample apps
   react-native/  # React Native wrapper
+  web/           # Web component package and sample app
 protocol/        # cross-platform communication layer based on UCP
 e2e/             # cross-platform end-to-end tests
 .github/         # workflows, issue templates, CODEOWNERS
@@ -19,14 +20,17 @@ e2e/             # cross-platform end-to-end tests
 > shadowenv exec --dir <repo_root> -- /opt/dev/bin/dev test [ARGS]
 > ```
 
-Run `dev` commands from the repo root. Use `dev up` before running commands when
-the environment may not be provisioned.
+Run `dev` commands from the repo root or any platform directory. Use `dev up`
+before running commands when the environment may not be provisioned.
 
 For platform-scoped work, prefer the root `dev.yml` commands:
 
 - Android: `dev android <command>`
 - Swift: `dev swift <command>`
 - React Native: `dev react-native <command>` or `dev rn <command>`
+- Web: `dev web <command>`
+
+Use `dev up` for setup and setup recovery.
 
 For protocol schema/model work, use `dev protocol <command>`.
 
@@ -87,3 +91,11 @@ USE_LOCAL_SDK=1 ./scripts/publish_android_snapshot
 cd sample/android
 USE_LOCAL_SDK=1 ./gradlew :shopify_checkout-kit-react-native:testDebugUnitTest
 ```
+
+## Sensitive configuration
+
+Treat storefront environment and generated sample app configuration values as
+sensitive. Never print, commit, paste, or document real values from `.env`,
+generated platform config, access tokens, merchant identifiers, shop IDs,
+account IDs, or storefront domains. Use synthetic placeholders for docs and
+verification.