CR: publish @turbodocx/embed 0.2.1 (README header, site link, developer-first reorganization) #91

Change type

Planned: review, merge to main, then publish to npm through the embed-v* release workflow (#89).

Risk / impact

Low. README-only content change plus a patch version bump (0.2.0 to 0.2.1) so npm shows the new README. No code change in packages/embed/src.

Security impact assessed?

No security impact. The README makes the existing security behavior easier to find: origin pinning that fails closed, source pinning, and allowAnyOrigin as dev-only.

Details

• Adds the TurboDocx banner header (the same image the JS and Ruby SDK READMEs use), badges, and a link to https://www.turbodocx.com.
• Reorganizes for developers:
  1. install;
  2. getting the embedUrl on the server (createEmbeddedSignature / createSigningUrl; the API key must be Administrator or Contributor);
  3. React <TurboSignForm> first, with props and the completion payload;
  4. then the <turbosign-form> web component;
  5. then the plain handler;
  6. then security and allowed embedding domains;
  7. then the example app and changelog.
• Bumps packages/embed to 0.2.1.

Testing and validation

• CI green on the PR (13 checks, including Test Embed Widget)
• Published @turbodocx/embed@0.2.0 with @turbodocx/sdk@0.8.0 validated end to end in production with the example app: widget, single signer (email passcode), external IdV and sequential kiosk all completed
• npm view @turbodocx/embed version returns 0.2.1 and the npm page shows the header

Rollback plan

Publish a corrected 0.2.2. No code change to revert. Optionally deprecate 0.2.1 with npm deprecate.

Related

• PR: docs(embed): add TurboDocx header and site link to the README #90
• Publish workflow: ci(embed): publish @turbodocx/embed to npm on embed-v* releases #89