Go live

Shopify side

• Public Storefront token only. The token on <storesynk-store> ships to every browser. Use the Headless channel’s public access token, never an Admin token.
• Products and collections are published to the Headless channel. Unpublished items return nothing and the page renders blank.
• Store password removed. Browsing and cart work on an unlaunched store, but checkout dead-ends at the password wall.

One request checks token, scopes, publication, and handles:

curl -s https://your-store.myshopify.com/api/2026-07/graphql.json \
  -H 'Content-Type: application/json' \
  -H 'X-Shopify-Storefront-Access-Token: your-public-storefront-token' \
  -d '{"query":"{ shop { name } product(handle: \"a-real-handle\") { title } collection(handle: \"a-real-collection\") { title } }"}'

A 401 or 403 is a bad token or missing scope. A null product or collection is a wrong handle or an unpublished item.

Your code

• Pin the engine version. Switch the rolling CDN URL to an exact pin, or pin exact npm versions and commit the lockfile (see below).
• Validate every page. Ask your connected AI tool to validate each authored page. The rules are listed under validator rules.
• Every price comes from a displayer. A hardcoded price is wrong the moment the currency or market changes.
• Consent, if you track. Consent is enforced through Shopify’s Customer Privacy API; install a banner if your jurisdiction needs one. See analytics.
• Accessible names on the inputs you wrap. A real <label> or aria-label on every field inside apply-discount, cart-note, and similar controls.
• Server-render if SEO matters. On the plain-HTML path the served HTML has no product data. The Astro, Next.js, and React packages put data, metadata, and JSON-LD in the HTML.
• Place one real order end to end, then refund it.

Versioning

All five packages (core, elements, astro, next, react) version in lockstep on the npm beta tag. Install with the tag and upgrade them together:

npm i @storesynk/elements@beta

Before 1.0, a minor bump (0.1 to 0.2) may contain breaking changes; only patch releases are guaranteed safe. Pin exact versions, no ^ or ~.

CDN URL	Behaviour
https://cdn.storesynk.io/elements/0.1/storesynk.js	Rolling 0.1 channel, receives patches automatically. Fine while building.
https://cdn.storesynk.io/elements/<x.y.z>/storesynk.js	Immutable pin. Use in production.

Changes are announced in the engine repo’s changelog in the storesynk GitHub org. File bugs there with package versions, a minimal tag reproduction, and which surface you are on (plain HTML, Astro, Next.js, or React SSR). Security reports go to the maintainer by email.