From cc5b92a66e980ebbc53b4baf0b8c38fbe2f1141f Mon Sep 17 00:00:00 2001
From: Matias <matias@edgeandnode.com>
Date: Tue, 25 Nov 2025 10:03:19 -0300
Subject: [PATCH 1/4] chore: add CI release

---
 .github/workflows/python-release.yml     | 110 +++++++++++++
 .github/workflows/typescript-release.yml | 139 ++++++++++++++++
 RELEASING.md                             | 196 +++++++++++++++++++++++
 3 files changed, 445 insertions(+)
 create mode 100644 .github/workflows/python-release.yml
 create mode 100644 .github/workflows/typescript-release.yml
 create mode 100644 RELEASING.md

diff --git a/.github/workflows/python-release.yml b/.github/workflows/python-release.yml
new file mode 100644
index 0000000..bd16841
--- /dev/null
+++ b/.github/workflows/python-release.yml
@@ -0,0 +1,110 @@
+name: Python Release
+
+on:
+  push:
+    tags:
+      - "py-v*.*.*"
+      - "py-v*.*.*a*"
+      - "py-v*.*.*b*"
+      - "py-v*.*.*rc*"
+
+permissions:
+  contents: read
+  id-token: write # Required for PyPI trusted publishing
+
+jobs:
+  validate:
+    name: "py: validate"
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Setup uv
+        uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+          cache-dependency-glob: "uv.lock"
+
+      - name: Install Python 3.13
+        run: uv python install 3.13
+
+      - name: Install dependencies
+        run: uv sync --frozen --group dev
+
+      - name: Lint
+        run: uv run -- ruff check --output-format=github python
+
+      - name: Format check
+        run: uv run -- ruff format --diff python
+
+      - name: Type check
+        run: uv run -- mypy python
+
+      - name: Test
+        run: uv run -- pytest
+
+  verify-version:
+    name: "py: verify version"
+    runs-on: ubuntu-latest
+    needs: validate
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Setup uv
+        uses: astral-sh/setup-uv@v6
+
+      - name: Install Python 3.13
+        run: uv python install 3.13
+
+      - name: Extract version from tag
+        id: tag
+        run: |
+          TAG=${GITHUB_REF#refs/tags/py-v}
+          echo "version=$TAG" >> $GITHUB_OUTPUT
+          echo "Tagged version: $TAG"
+
+      - name: Read pyproject.toml version
+        id: package
+        run: |
+          VERSION=$(uv run python -c "import tomllib; print(tomllib.load(open('python/ampersend-sdk/pyproject.toml', 'rb'))['project']['version'])")
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "Package version: $VERSION"
+
+      - name: Compare versions
+        run: |
+          if [ "${{ steps.tag.outputs.version }}" != "${{ steps.package.outputs.version }}" ]; then
+            echo "ERROR: Tag version (${{ steps.tag.outputs.version }}) does not match pyproject.toml version (${{ steps.package.outputs.version }})"
+            exit 1
+          fi
+          echo "✓ Versions match: ${{ steps.tag.outputs.version }}"
+
+  publish:
+    name: "py: publish to PyPI"
+    runs-on: ubuntu-latest
+    needs: [validate, verify-version]
+    environment:
+      name: pypi
+      url: https://pypi.org/p/ampersend-sdk
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Setup uv
+        uses: astral-sh/setup-uv@v6
+
+      - name: Install Python 3.13
+        run: uv python install 3.13
+
+      - name: Build package
+        run: uv build --package ampersend-sdk
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist/
diff --git a/.github/workflows/typescript-release.yml b/.github/workflows/typescript-release.yml
new file mode 100644
index 0000000..c1692c4
--- /dev/null
+++ b/.github/workflows/typescript-release.yml
@@ -0,0 +1,139 @@
+name: TypeScript Release
+
+on:
+  push:
+    tags:
+      - "ts-v*.*.*"
+      - "ts-v*.*.*-alpha.*"
+      - "ts-v*.*.*-beta.*"
+
+permissions:
+  contents: read
+  id-token: write # Required for npm provenance
+
+env:
+  NODE_VERSION: "22.x"
+
+jobs:
+  validate:
+    name: "ts: validate"
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      NODE_OPTIONS: --max-old-space-size=6144
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          package_json_file: package.json
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: "pnpm"
+          cache-dependency-path: pnpm-lock.yaml
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build
+        run: pnpm --filter ampersend-sdk build
+
+      - name: Lint
+        run: pnpm --filter ampersend-sdk lint
+
+      - name: Format
+        run: pnpm --filter ampersend-sdk format
+
+      - name: Type check
+        run: pnpm --filter ampersend-sdk typecheck
+
+      - name: Test
+        run: pnpm --filter ampersend-sdk test
+
+  verify-version:
+    name: "ts: verify version"
+    runs-on: ubuntu-latest
+    needs: validate
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Extract version from tag
+        id: tag
+        run: |
+          TAG=${GITHUB_REF#refs/tags/ts-v}
+          echo "version=$TAG" >> $GITHUB_OUTPUT
+          echo "Tagged version: $TAG"
+
+      - name: Read package.json version
+        id: package
+        run: |
+          VERSION=$(node -p "require('./typescript/packages/ampersend-sdk/package.json').version")
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "Package version: $VERSION"
+
+      - name: Compare versions
+        run: |
+          if [ "${{ steps.tag.outputs.version }}" != "${{ steps.package.outputs.version }}" ]; then
+            echo "ERROR: Tag version (${{ steps.tag.outputs.version }}) does not match package.json version (${{ steps.package.outputs.version }})"
+            exit 1
+          fi
+          echo "✓ Versions match: ${{ steps.tag.outputs.version }}"
+
+  publish:
+    name: "ts: publish to npm"
+    runs-on: ubuntu-latest
+    needs: [validate, verify-version]
+    environment:
+      name: npm
+      url: https://www.npmjs.com/package/@edgeandnode/ampersend-sdk
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          package_json_file: package.json
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          registry-url: "https://registry.npmjs.org"
+          cache: "pnpm"
+          cache-dependency-path: pnpm-lock.yaml
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build package
+        run: pnpm --filter ampersend-sdk build
+
+      - name: Determine publish tag
+        id: publish-tag
+        run: |
+          VERSION="${GITHUB_REF#refs/tags/ts-v}"
+          if [[ "$VERSION" == *"-alpha."* ]]; then
+            echo "tag=alpha" >> $GITHUB_OUTPUT
+            echo "Publishing with tag: alpha"
+          elif [[ "$VERSION" == *"-beta."* ]]; then
+            echo "tag=beta" >> $GITHUB_OUTPUT
+            echo "Publishing with tag: beta"
+          else
+            echo "tag=latest" >> $GITHUB_OUTPUT
+            echo "Publishing with tag: latest"
+          fi
+
+      - name: Publish to npm
+        run: pnpm --filter ampersend-sdk publish --no-git-checks --access public --tag ${{ steps.publish-tag.outputs.tag }}
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/RELEASING.md b/RELEASING.md
new file mode 100644
index 0000000..595f84f
--- /dev/null
+++ b/RELEASING.md
@@ -0,0 +1,196 @@
+# Release Guide
+
+This document describes how to release new versions of the Ampersend SDK packages to npm and PyPI.
+
+## Prerequisites
+
+### TypeScript (npm)
+
+1. **npm Token**: Configure `NPM_TOKEN` in GitHub repository secrets
+   - Generate an automation token at https://www.npmjs.com/settings/tokens
+   - Token must have publish access to the `@edgeandnode` scope
+   - Add to: Repository Settings → Secrets → Actions → New repository secret
+   - Name: `NPM_TOKEN`
+
+### Python (PyPI)
+
+1. **Trusted Publishing**: Configure on PyPI (one-time setup)
+   - Visit https://pypi.org/manage/account/publishing/
+   - Click "Add a new pending publisher"
+   - Fill in:
+     - **PyPI Project Name**: `ampersend-sdk`
+     - **Owner**: `edgeandnode`
+     - **Repository name**: `ampersend-sdk`
+     - **Workflow name**: `python-release.yml`
+     - **Environment name**: `pypi`
+   - After first successful publish, this becomes a "verified publisher"
+
+## Release Process
+
+### TypeScript SDK
+
+1. **Update version** in `typescript/packages/ampersend-sdk/package.json`
+
+   ```bash
+   # Edit version field
+   vim typescript/packages/ampersend-sdk/package.json
+   ```
+
+2. **Commit the version change**
+
+   ```bash
+   git add typescript/packages/ampersend-sdk/package.json
+   git commit -m "chore(ts): bump version to X.Y.Z"
+   git push origin main
+   ```
+
+3. **Create and push tag**
+
+   ```bash
+   # For stable release
+   git tag ts-vX.Y.Z
+
+   # For alpha release
+   git tag ts-vX.Y.Z-alpha.N
+
+   # For beta release
+   git tag ts-vX.Y.Z-beta.N
+
+   # Push tag
+   git push origin ts-vX.Y.Z
+   ```
+
+4. **Monitor release**
+   - View workflow: https://github.com/edgeandnode/ampersend-sdk/actions/workflows/typescript-release.yml
+   - Check npm: https://www.npmjs.com/package/@edgeandnode/ampersend-sdk
+
+### Python SDK
+
+1. **Update version** in `python/ampersend-sdk/pyproject.toml`
+
+   ```bash
+   # Edit version field
+   vim python/ampersend-sdk/pyproject.toml
+   ```
+
+2. **Commit the version change**
+
+   ```bash
+   git add python/ampersend-sdk/pyproject.toml
+   git commit -m "chore(py): bump version to X.Y.Z"
+   git push origin main
+   ```
+
+3. **Create and push tag**
+
+   ```bash
+   # For stable release
+   git tag py-vX.Y.Z
+
+   # For alpha release (PEP 440)
+   git tag py-vX.Y.ZaN
+
+   # For beta release (PEP 440)
+   git tag py-vX.Y.ZbN
+
+   # For release candidate (PEP 440)
+   git tag py-vX.Y.ZrcN
+
+   # Push tag
+   git push origin py-vX.Y.Z
+   ```
+
+4. **Monitor release**
+   - View workflow: https://github.com/edgeandnode/ampersend-sdk/actions/workflows/python-release.yml
+   - Check PyPI: https://pypi.org/project/ampersend-sdk/
+
+## What Happens During Release
+
+### TypeScript Release Workflow
+
+1. **Validation** - Runs full CI suite (build, lint, format, typecheck, test)
+2. **Version Verification** - Ensures git tag matches `package.json` version
+3. **Publish** - Builds and publishes to npm with provenance attestations
+   - Stable releases → `latest` tag
+   - Alpha releases → `alpha` tag
+   - Beta releases → `beta` tag
+
+### Python Release Workflow
+
+1. **Validation** - Runs full CI suite (lint, format, typecheck, test)
+2. **Version Verification** - Ensures git tag matches `pyproject.toml` version
+3. **Build & Publish** - Builds wheel/sdist and publishes to PyPI using Trusted Publishing
+
+## Version Guidelines
+
+Follow [Semantic Versioning](https://semver.org/):
+
+- **Major (X.0.0)**: Breaking changes
+- **Minor (0.X.0)**: New features, backwards compatible
+- **Patch (0.0.X)**: Bug fixes, backwards compatible
+
+### Pre-releases
+
+**TypeScript (npm style)**:
+
+- `0.1.0-alpha.1` - Early testing, unstable
+- `0.1.0-beta.1` - Feature complete, stabilizing
+- `0.1.0-rc.1` - Release candidate (not currently supported in workflow)
+
+**Python (PEP 440 style)**:
+
+- `0.1.0a1` - Alpha release
+- `0.1.0b1` - Beta release
+- `0.1.0rc1` - Release candidate
+
+## Troubleshooting
+
+### Version mismatch error
+
+If the workflow fails with "versions do not match":
+
+- Ensure the tag version (without prefix) exactly matches the package version
+- Example: `ts-v0.1.0` must match `"version": "0.1.0"` in package.json
+
+### npm publish fails
+
+- Verify `NPM_TOKEN` secret is set correctly
+- Check token has not expired
+- Ensure you have publish permissions for `@edgeandnode` scope
+
+### PyPI publish fails
+
+- Verify Trusted Publishing is configured correctly on PyPI
+- Check workflow name and environment name match exactly
+- For first publish to a new package, you may need to use an API token instead
+
+### Build artifacts missing
+
+- Ensure `pnpm build` or `uv build` completes successfully
+- Check `dist/` directory contains expected files
+- Review build logs in GitHub Actions
+
+## Security
+
+### npm Provenance
+
+All npm packages are published with provenance attestations:
+
+- Proves the package was built by this specific GitHub workflow
+- Visible on the npm package page
+- Provides transparency and supply chain security
+
+### PyPI Trusted Publishing
+
+- More secure than API tokens
+- No long-lived credentials to manage
+- Uses GitHub's OIDC for authentication
+- Recommended by PyPI for all projects
+
+## Support
+
+For issues with releases:
+
+- Check GitHub Actions logs for detailed error messages
+- Review this guide and ensure all prerequisites are met
+- Open an issue at https://github.com/edgeandnode/ampersend-sdk/issues

From b956b25f1f512bde534fff935d619a5362b53fa8 Mon Sep 17 00:00:00 2001
From: Matias <matias@edgeandnode.com>
Date: Tue, 25 Nov 2025 10:18:17 -0300
Subject: [PATCH 2/4] f: versions

---
 python/ampersend-sdk/pyproject.toml            | 2 +-
 typescript/packages/ampersend-sdk/package.json | 2 +-
 uv.lock                                        | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/python/ampersend-sdk/pyproject.toml b/python/ampersend-sdk/pyproject.toml
index 6f03d47..5179224 100644
--- a/python/ampersend-sdk/pyproject.toml
+++ b/python/ampersend-sdk/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "ampersend-sdk"
-version = "0.0.1"
+version = "0.0.1a1"
 description = "Python SDK for ampersend"
 readme = "README.md"
 dependencies = [
diff --git a/typescript/packages/ampersend-sdk/package.json b/typescript/packages/ampersend-sdk/package.json
index b99f7dc..79eb5b7 100644
--- a/typescript/packages/ampersend-sdk/package.json
+++ b/typescript/packages/ampersend-sdk/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@edgeandnode/ampersend-sdk",
   "description": "Tooling for building applications with x402 payment capabilities. Supports buyer and seller roles.",
-  "version": "0.1.0",
+  "version": "0.0.1-alpha.1",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
diff --git a/uv.lock b/uv.lock
index 92b2b3f..9f7f313 100644
--- a/uv.lock
+++ b/uv.lock
@@ -114,7 +114,7 @@ wheels = [
 
 [[package]]
 name = "ampersend-sdk"
-version = "0.0.1"
+version = "0.0.1a1"
 source = { editable = "python/ampersend-sdk" }
 dependencies = [
     { name = "a2a-sdk" },

From 91d237d4dd977d1e4e1b3b93a6c1c94921f57095 Mon Sep 17 00:00:00 2001
From: Matias <matias@edgeandnode.com>
Date: Tue, 25 Nov 2025 10:19:31 -0300
Subject: [PATCH 3/4] DO NOT MERGE

---
 .github/workflows/python-release.yml     | 22 ++-------------
 .github/workflows/typescript-release.yml | 34 +++---------------------
 2 files changed, 6 insertions(+), 50 deletions(-)

diff --git a/.github/workflows/python-release.yml b/.github/workflows/python-release.yml
index bd16841..09e6aae 100644
--- a/.github/workflows/python-release.yml
+++ b/.github/workflows/python-release.yml
@@ -2,11 +2,8 @@ name: Python Release
 
 on:
   push:
-    tags:
-      - "py-v*.*.*"
-      - "py-v*.*.*a*"
-      - "py-v*.*.*b*"
-      - "py-v*.*.*rc*"
+    branches:
+      - ma/release
 
 permissions:
   contents: read
@@ -61,13 +58,6 @@ jobs:
       - name: Install Python 3.13
         run: uv python install 3.13
 
-      - name: Extract version from tag
-        id: tag
-        run: |
-          TAG=${GITHUB_REF#refs/tags/py-v}
-          echo "version=$TAG" >> $GITHUB_OUTPUT
-          echo "Tagged version: $TAG"
-
       - name: Read pyproject.toml version
         id: package
         run: |
@@ -75,14 +65,6 @@ jobs:
           echo "version=$VERSION" >> $GITHUB_OUTPUT
           echo "Package version: $VERSION"
 
-      - name: Compare versions
-        run: |
-          if [ "${{ steps.tag.outputs.version }}" != "${{ steps.package.outputs.version }}" ]; then
-            echo "ERROR: Tag version (${{ steps.tag.outputs.version }}) does not match pyproject.toml version (${{ steps.package.outputs.version }})"
-            exit 1
-          fi
-          echo "✓ Versions match: ${{ steps.tag.outputs.version }}"
-
   publish:
     name: "py: publish to PyPI"
     runs-on: ubuntu-latest
diff --git a/.github/workflows/typescript-release.yml b/.github/workflows/typescript-release.yml
index c1692c4..9738b73 100644
--- a/.github/workflows/typescript-release.yml
+++ b/.github/workflows/typescript-release.yml
@@ -2,10 +2,8 @@ name: TypeScript Release
 
 on:
   push:
-    tags:
-      - "ts-v*.*.*"
-      - "ts-v*.*.*-alpha.*"
-      - "ts-v*.*.*-beta.*"
+    branches:
+      - ma/release
 
 permissions:
   contents: read
@@ -65,13 +63,6 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Extract version from tag
-        id: tag
-        run: |
-          TAG=${GITHUB_REF#refs/tags/ts-v}
-          echo "version=$TAG" >> $GITHUB_OUTPUT
-          echo "Tagged version: $TAG"
-
       - name: Read package.json version
         id: package
         run: |
@@ -79,14 +70,6 @@ jobs:
           echo "version=$VERSION" >> $GITHUB_OUTPUT
           echo "Package version: $VERSION"
 
-      - name: Compare versions
-        run: |
-          if [ "${{ steps.tag.outputs.version }}" != "${{ steps.package.outputs.version }}" ]; then
-            echo "ERROR: Tag version (${{ steps.tag.outputs.version }}) does not match package.json version (${{ steps.package.outputs.version }})"
-            exit 1
-          fi
-          echo "✓ Versions match: ${{ steps.tag.outputs.version }}"
-
   publish:
     name: "ts: publish to npm"
     runs-on: ubuntu-latest
@@ -121,17 +104,8 @@ jobs:
       - name: Determine publish tag
         id: publish-tag
         run: |
-          VERSION="${GITHUB_REF#refs/tags/ts-v}"
-          if [[ "$VERSION" == *"-alpha."* ]]; then
-            echo "tag=alpha" >> $GITHUB_OUTPUT
-            echo "Publishing with tag: alpha"
-          elif [[ "$VERSION" == *"-beta."* ]]; then
-            echo "tag=beta" >> $GITHUB_OUTPUT
-            echo "Publishing with tag: beta"
-          else
-            echo "tag=latest" >> $GITHUB_OUTPUT
-            echo "Publishing with tag: latest"
-          fi
+          echo "tag=alpha" >> $GITHUB_OUTPUT
+          echo "Publishing with tag: alpha"
 
       - name: Publish to npm
         run: pnpm --filter ampersend-sdk publish --no-git-checks --access public --tag ${{ steps.publish-tag.outputs.tag }}

From 6e5e6867e166954bacbfd6890372e46c7eb42e83 Mon Sep 17 00:00:00 2001
From: Matias <matias@edgeandnode.com>
Date: Tue, 25 Nov 2025 15:19:09 -0300
Subject: [PATCH 4/4] DO NOT MERGE: github package manager

---
 .github/workflows/python-release-test.yml     |  93 +++++++++++++
 .github/workflows/typescript-release-test.yml | 123 ++++++++++++++++++
 2 files changed, 216 insertions(+)
 create mode 100644 .github/workflows/python-release-test.yml
 create mode 100644 .github/workflows/typescript-release-test.yml

diff --git a/.github/workflows/python-release-test.yml b/.github/workflows/python-release-test.yml
new file mode 100644
index 0000000..4bcdd61
--- /dev/null
+++ b/.github/workflows/python-release-test.yml
@@ -0,0 +1,93 @@
+name: Python Release (Test - TestPyPI)
+
+on:
+  push:
+    branches:
+      - ma/release
+
+permissions:
+  contents: read
+  id-token: write # Required for PyPI trusted publishing
+
+jobs:
+  validate:
+    name: "py: validate"
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Setup uv
+        uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+          cache-dependency-glob: "uv.lock"
+
+      - name: Install Python 3.13
+        run: uv python install 3.13
+
+      - name: Install dependencies
+        run: uv sync --frozen --group dev
+
+      - name: Lint
+        run: uv run -- ruff check --output-format=github python
+
+      - name: Format check
+        run: uv run -- ruff format --diff python
+
+      - name: Type check
+        run: uv run -- mypy python
+
+      - name: Test
+        run: uv run -- pytest
+
+  verify-version:
+    name: "py: verify version"
+    runs-on: ubuntu-latest
+    needs: validate
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Setup uv
+        uses: astral-sh/setup-uv@v6
+
+      - name: Install Python 3.13
+        run: uv python install 3.13
+
+      - name: Read pyproject.toml version
+        id: package
+        run: |
+          VERSION=$(uv run python -c "import tomllib; print(tomllib.load(open('python/ampersend-sdk/pyproject.toml', 'rb'))['project']['version'])")
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "📦 Package version: $VERSION"
+
+  publish:
+    name: "py: publish to TestPyPI"
+    runs-on: ubuntu-latest
+    needs: [validate, verify-version]
+    environment:
+      name: test-pypi
+      url: https://test.pypi.org/p/ampersend-sdk
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Setup uv
+        uses: astral-sh/setup-uv@v6
+
+      - name: Install Python 3.13
+        run: uv python install 3.13
+
+      - name: Build package
+        run: uv build --package ampersend-sdk
+
+      - name: Publish to TestPyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+          packages-dir: dist/
diff --git a/.github/workflows/typescript-release-test.yml b/.github/workflows/typescript-release-test.yml
new file mode 100644
index 0000000..f9bb6da
--- /dev/null
+++ b/.github/workflows/typescript-release-test.yml
@@ -0,0 +1,123 @@
+name: TypeScript Release (Test - GitHub Packages)
+
+on:
+  push:
+    branches:
+      - ma/release
+
+permissions:
+  contents: read
+  packages: write # Required for GitHub Packages
+
+env:
+  NODE_VERSION: "22.x"
+
+jobs:
+  validate:
+    name: "ts: validate"
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      NODE_OPTIONS: --max-old-space-size=6144
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          package_json_file: package.json
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: "pnpm"
+          cache-dependency-path: pnpm-lock.yaml
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build
+        run: pnpm --filter ampersend-sdk build
+
+      - name: Lint
+        run: pnpm --filter ampersend-sdk lint
+
+      - name: Format
+        run: pnpm --filter ampersend-sdk format
+
+      - name: Type check
+        run: pnpm --filter ampersend-sdk typecheck
+
+      - name: Test
+        run: pnpm --filter ampersend-sdk test
+
+  verify-version:
+    name: "ts: verify version"
+    runs-on: ubuntu-latest
+    needs: validate
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Read package.json version
+        id: package
+        run: |
+          VERSION=$(node -p "require('./typescript/packages/ampersend-sdk/package.json').version")
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "📦 Package version: $VERSION"
+
+  publish:
+    name: "ts: publish to GitHub Packages"
+    runs-on: ubuntu-latest
+    needs: [validate, verify-version]
+    environment:
+      name: github-packages
+      url: https://github.com/edgeandnode/ampersend-sdk/packages
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          package_json_file: package.json
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          registry-url: "https://npm.pkg.github.com"
+          scope: "@edgeandnode"
+          cache: "pnpm"
+          cache-dependency-path: pnpm-lock.yaml
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build package
+        run: pnpm --filter ampersend-sdk build
+
+      - name: Determine publish tag
+        id: publish-tag
+        run: |
+          VERSION=$(node -p "require('./typescript/packages/ampersend-sdk/package.json').version")
+          if [[ "$VERSION" == *"-alpha."* ]]; then
+            echo "tag=alpha" >> $GITHUB_OUTPUT
+            echo "📌 Publishing with tag: alpha"
+          elif [[ "$VERSION" == *"-beta."* ]]; then
+            echo "tag=beta" >> $GITHUB_OUTPUT
+            echo "📌 Publishing with tag: beta"
+          else
+            echo "tag=latest" >> $GITHUB_OUTPUT
+            echo "📌 Publishing with tag: latest"
+          fi
+
+      - name: Publish to GitHub Packages
+        run: pnpm --filter ampersend-sdk publish --no-git-checks --access public --tag ${{ steps.publish-tag.outputs.tag }} --registry https://npm.pkg.github.com
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}