Rename SDK to sdk-typescript, add e2e download test

.github/workflows/sdk-typescript-ci.yml

@@ -0,0 +1,49 @@
+name: TypeScript SDK CI
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'packages/sdk-typescript/**'
+  pull_request:
+    branches: [main]
+    paths:
+      - 'packages/sdk-typescript/**'
+
+concurrency:
+  group: sdk-typescript-ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build
+        run: pnpm --filter @nimblebrain/mpak-sdk... build
+
+      - name: Lint
+        run: pnpm --filter @nimblebrain/mpak-sdk lint
+
+      - name: Format check
+        run: pnpm --filter @nimblebrain/mpak-sdk exec prettier --check "src/**/*.ts" "tests/**/*.ts"
+
+      - name: Typecheck
+        run: pnpm --filter @nimblebrain/mpak-sdk typecheck
+
+      - name: Test
+        run: pnpm --filter @nimblebrain/mpak-sdk test

.github/workflows/sdk-typescript-publish.yml

@@ -0,0 +1,57 @@
+name: Publish TypeScript SDK
+
+on:
+  push:
+    tags:
+      - 'sdk-typescript-v*'
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm --filter @nimblebrain/mpak-sdk... build
+      - run: pnpm --filter @nimblebrain/mpak-sdk lint
+      - run: pnpm --filter @nimblebrain/mpak-sdk exec prettier --check "src/**/*.ts" "tests/**/*.ts"
+      - run: pnpm --filter @nimblebrain/mpak-sdk typecheck
+      - run: pnpm --filter @nimblebrain/mpak-sdk test
+
+  publish:
+    needs: verify
+    runs-on: ubuntu-latest
+    environment: npm
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: pnpm
+          registry-url: 'https://registry.npmjs.org'
+
+      - run: pnpm install --frozen-lockfile
+
+      - name: Verify tag matches package version
+        run: |
+          TAG_VERSION="${GITHUB_REF#refs/tags/sdk-typescript-v}"
+          PKG_VERSION=$(node -e "console.log(require('./packages/sdk-typescript/package.json').version)")
+          if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
+            echo "::error::Tag version ($TAG_VERSION) != package.json version ($PKG_VERSION)"
+            exit 1
+          fi
+
+      - name: Build
+        run: pnpm --filter @nimblebrain/mpak-sdk... build
+
+      - name: Publish to npm
+        run: npm publish --provenance --access public
+        working-directory: packages/sdk-typescript

PUBLISHING.md

@@ -103,7 +103,7 @@ pnpm build && pnpm publish --no-git-checks
 cd -
 
 # 3. Bump and publish sdk
-cd packages/sdk
+cd packages/sdk-typescript
 npm version patch
 pnpm build && pnpm publish --no-git-checks
 cd -
@@ -115,7 +115,7 @@ pnpm build && pnpm publish --no-git-checks
 cd -
 
 # 5. Commit and tag each
-git add packages/schemas/package.json packages/sdk/package.json packages/cli/package.json
+git add packages/schemas/package.json packages/sdk-typescript/package.json packages/cli/package.json
 git commit -m "release: mpak-schemas@0.2.0, mpak-sdk@0.1.1, mpak@0.1.1"
 git push
 ```

README.md

@@ -165,7 +165,7 @@ Zod schemas and inferred TypeScript types for the MCPB manifest format, API resp
 
 **Key exports:** `BundleSchema`, `SkillSchema`, `MpakJsonSchema`, `SearchParamsSchema`, validation functions.
 
-### `packages/sdk`
+### `packages/sdk-typescript`
 
 TypeScript SDK for interacting with a mpak registry. Wraps the HTTP API with typed methods for searching, downloading, and inspecting bundles and skills.
 

SECURITY.md

@@ -29,7 +29,7 @@ The following are in scope:
 
 - The mpak registry server (`apps/registry`)
 - The mpak CLI (`packages/cli`)
-- The mpak SDK (`packages/sdk`)
+- The mpak SDK (`packages/sdk-typescript`)
 - The mpak web UI (`apps/web`)
 - The MTF security scanner (`apps/scanner`)
 - The OIDC publishing flow

packages/sdk/README.md → packages/sdk-typescript/README.md

@@ -1,23 +1,20 @@
 # @nimblebrain/mpak-sdk
 
-TypeScript SDK for mpak registry - MCPB bundles and Agent Skills.
+[![CI](https://github.com/NimbleBrainInc/mpak/actions/workflows/sdk-typescript-ci.yml/badge.svg)](https://github.com/NimbleBrainInc/mpak/actions/workflows/sdk-typescript-ci.yml)
+[![npm](https://img.shields.io/npm/v/@nimblebrain/mpak-sdk)](https://www.npmjs.com/package/@nimblebrain/mpak-sdk)
+[![Node](https://img.shields.io/node/v/@nimblebrain/mpak-sdk)](https://www.npmjs.com/package/@nimblebrain/mpak-sdk)
+[![License](https://img.shields.io/npm/l/@nimblebrain/mpak-sdk)](https://github.com/NimbleBrainInc/mpak/blob/main/packages/sdk-typescript/LICENSE)
+[![mpak.dev](https://mpak.dev/badge.svg)](https://mpak.dev)
 
-## Features
-
-- Type-safe API (types from `@nimblebrain/mpak-schemas`)
-- Fail-closed integrity verification
-- Skill resolution from mpak, GitHub, and URL sources
-- Requires Node.js 18+ (native fetch)
+TypeScript SDK for the mpak registry - search, download, and resolve MCPB bundles and Agent Skills.
 
 ## Installation
 
 ```bash
 pnpm add @nimblebrain/mpak-sdk
 ```
 
-## Usage
-
-### Search Bundles
+## Quick Start
 
 ```typescript
 import { MpakClient } from '@nimblebrain/mpak-sdk';
@@ -26,12 +23,18 @@ const client = new MpakClient();
 
 // Search for bundles
 const results = await client.searchBundles({ q: 'mcp', limit: 10 });
-
 for (const bundle of results.bundles) {
   console.log(`${bundle.name}@${bundle.latest_version}`);
 }
+
+// Get download info
+const download = await client.getBundleDownload('@nimblebraininc/echo', 'latest');
+console.log(`Download URL: ${download.url}`);
+console.log(`SHA256: ${download.bundle.sha256}`);
 ```
 
+## Usage
+
 ### Get Bundle Details
 
 ```typescript
@@ -41,20 +44,6 @@ console.log(bundle.description);
 console.log(`Versions: ${bundle.versions.map(v => v.version).join(', ')}`);
 ```
 
-### Download a Bundle
-
-```typescript
-// Get download info for the latest version
-const versions = await client.getBundleVersions('@nimblebraininc/echo');
-const download = await client.getBundleDownload(
-  '@nimblebraininc/echo',
-  versions.latest
-);
-
-console.log(`Download URL: ${download.url}`);
-console.log(`SHA256: ${download.bundle.sha256}`);
-```
-
 ### Platform-Specific Downloads
 
 ```typescript
@@ -220,6 +209,50 @@ pnpm typecheck
 pnpm build
 ```
 
+### Verification
+
+Run all checks before submitting changes:
+
+```bash
+pnpm --filter @nimblebrain/mpak-sdk lint           # lint
+pnpm --filter @nimblebrain/mpak-sdk exec prettier --check "src/**/*.ts" "tests/**/*.ts"  # format
+pnpm --filter @nimblebrain/mpak-sdk typecheck       # type check
+pnpm --filter @nimblebrain/mpak-sdk test            # unit tests
+pnpm --filter @nimblebrain/mpak-sdk test:integration  # integration tests (hits live registry)
+```
+
+CI runs lint, format check, typecheck, and unit tests on every PR via [`sdk-typescript-ci.yml`](../../.github/workflows/sdk-typescript-ci.yml).
+
+## Releasing
+
+Releases are automated via GitHub Actions. The publish workflow is triggered by git tags.
+
+**Version is defined in one place:** `package.json`.
+
+### Steps
+
+1. **Bump version** in `package.json`:
+   ```bash
+   cd packages/sdk-typescript
+   npm version patch   # 0.1.0 -> 0.1.1
+   npm version minor   # 0.1.0 -> 0.2.0
+   npm version major   # 0.1.0 -> 1.0.0
+   ```
+
+2. **Commit and push:**
+   ```bash
+   git commit -am "sdk-typescript: bump to X.Y.Z"
+   git push
+   ```
+
+3. **Tag and push** (this triggers the publish):
+   ```bash
+   git tag sdk-typescript-vX.Y.Z
+   git push origin sdk-typescript-vX.Y.Z
+   ```
+
+CI will run the full verification suite, verify the tag matches `package.json`, build, and publish to npm. See [`sdk-typescript-publish.yml`](../../.github/workflows/sdk-typescript-publish.yml).
+
 ## License
 
 Apache-2.0

packages/sdk/package.json → packages/sdk-typescript/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@nimblebrain/mpak-sdk",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "TypeScript SDK for mpak registry - MCPB bundles and Agent Skills",
   "author": "NimbleBrain Inc <engineering@mpak.dev>",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/NimbleBrainInc/mpak.git",
-    "directory": "packages/sdk"
+    "directory": "packages/sdk-typescript"
   },
   "homepage": "https://mpak.dev",
   "bugs": {
@@ -50,7 +50,7 @@
     "build": "tsup",
     "clean": "rm -rf dist coverage",
     "dev": "tsup --watch",
-    "lint": "eslint src/",
+    "lint": "eslint src/ tests/",
     "test": "vitest run",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",