From b4b1638f6e59b317de04685814f0b0ceb1c3c255 Mon Sep 17 00:00:00 2001
From: yanny-sec <yanny@secureagentics.ai>
Date: Tue, 16 Jun 2026 12:52:06 +0100
Subject: [PATCH 1/2] ci(workflows): add TypeScript SDK build/test matrix

Run `npm ci`, build, and the vitest suite for sdk/typescript on ubuntu, macOS, and Windows whenever the TypeScript SDK changes.
---
 .github/workflows/ts-sdk-ci.yml | 43 +++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)
 create mode 100644 .github/workflows/ts-sdk-ci.yml

diff --git a/.github/workflows/ts-sdk-ci.yml b/.github/workflows/ts-sdk-ci.yml
new file mode 100644
index 0000000..b940af0
--- /dev/null
+++ b/.github/workflows/ts-sdk-ci.yml
@@ -0,0 +1,43 @@
+# CI for the TypeScript SDK (sdk/typescript).
+#
+# Runs the canonical install + build + test on every supported OS so a
+# platform-incomplete or peer-broken package-lock.json fails CI instead of
+# shipping.
+#
+# # `npm ci` is deliberate (not `npm install`): it refuses to mutate the
+# lockfile and fails fast on any of the above. The OS matrix is what catches
+# a lockfile that only carries one platform's optional native binaries.
+
+name: TS SDK CI
+
+on:
+  pull_request:
+    paths:
+      - "sdk/typescript/**"
+      - ".github/workflows/ts-sdk-ci.yml"
+
+defaults:
+  run:
+    working-directory: sdk/typescript
+
+jobs:
+  test:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: sdk/typescript/package-lock.json
+      # Strict, lockfile-faithful install. Fails on peer conflicts, an
+      # out-of-sync lockfile, or missing integrity hashes.
+      - run: npm ci
+      # build runs tsup + tsc; test runs vitest (whose native binding is the
+      # piece that breaks when the lockfile omits this OS's optional binary).
+      - run: npm run build -w @secureagentics/adrian
+      - run: npm run test -w @secureagentics/adrian

From e3c908c5a6792b1fb0defd005db7ea1f85eb8ec4 Mon Sep 17 00:00:00 2001
From: yanny-sec <yanny@secureagentics.ai>
Date: Fri, 26 Jun 2026 13:38:53 +0100
Subject: [PATCH 2/2] ci(workflows): build and test all TS SDK workspaces

---
 .github/workflows/ts-sdk-ci.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ts-sdk-ci.yml b/.github/workflows/ts-sdk-ci.yml
index b940af0..17e3981 100644
--- a/.github/workflows/ts-sdk-ci.yml
+++ b/.github/workflows/ts-sdk-ci.yml
@@ -39,5 +39,6 @@ jobs:
       - run: npm ci
       # build runs tsup + tsc; test runs vitest (whose native binding is the
       # piece that breaks when the lockfile omits this OS's optional binary).
-      - run: npm run build -w @secureagentics/adrian
-      - run: npm run test -w @secureagentics/adrian
+      # No -w: build/test every workspace package (core + openai + future providers).
+      - run: npm run build
+      - run: npm run test