@adibilis/sdk (0.0.0-dev.3)
Installation
@adibilis:registry=npm install @adibilis/sdk@0.0.0-dev.3"@adibilis/sdk": "0.0.0-dev.3"About this package
@adibilis/sdk
Shop-site SDK for Adibilis CORE. Everything an Adibilis shop website needs to talk to the ERP: a server-side API client, a zod form layer, the order model, the checkout step machine, and the holidays client.
It exists so a shop site is mostly configuration and design. Before it, each site carried its own copy of the ERP integration, and those copies drifted.
The two entry points
The export map is the architectural boundary of this package, not a convenience:
| Import | Contains | Safe in a browser bundle |
|---|---|---|
@adibilis/sdk |
forms, order model, checkout context, holidays | yes |
@adibilis/sdk/server |
the API client — holds the WEBSITE key | no — server only |
A satellite that imports the wrong one gets a build error instead of a leaked key. Nothing reachable from the root entry may transitively import the server entry.
Install
pnpm add @adibilis/sdk
Reads from the registry are public — no token is required to install. Point the scope at it:
@adibilis:registry=https://forge.cloud.adibilis.ch/api/packages/core/npm/
(.npmrc.example carries exactly this.)
Release channels
The SDK carries its own semver — it is not pinned to the core release tag.
| Ref | Version | dist-tag |
|---|---|---|
tag v1.2.3 |
1.2.3 |
latest |
push to main |
0.0.0-dev.<run> |
dev |
A plain pnpm add @adibilis/sdk resolves to the newest released version and never to a dev build.
Opt in explicitly with pnpm add @adibilis/sdk@dev.
Relationship to @adibilis/api-types
@adibilis/api-types is generated from the CORE backend and versioned 1:1 with the core release tag.
The dependency range here is the statement of which core releases this SDK speaks to.
During 3c-i it is pinned to a dev build (0.0.0-dev.193), because core has not cut a release since
the package began publishing. This must be repinned to a released version before any satellite goes
to production — latest is the only channel carrying the 1:1-with-a-core-tag guarantee.
Two credentials, never confuse them
- Registry token — build-time, only needed to publish. Not needed to install.
- WEBSITE API key — runtime, lives in a satellite's environment, authenticates the API client against CORE.
Different lifetimes, different blast radii. Neither belongs in a commit.
Dependencies
Dependencies
| ID | Version |
|---|---|
| @adibilis/api-types | 0.0.0-dev.193 |
Development dependencies
| ID | Version |
|---|---|
| @types/react | ^19 |
| typescript | ^5 |
| vitest | ^4.1.10 |
Peer dependencies
| ID | Version |
|---|---|
| react | >=19 |
| zod | ^4.1.12 |