new docs, plugins, deps bump

.github/PUBLISHING-RELEASE.md

@@ -6,24 +6,24 @@ Builds binaries (5 platforms), Docker images (4 images), uploads to GCP, creates
 
 ### Secrets
 
-| Secret | Purpose |
-|--------|---------|
-| `GH_DEPLOY_KEY` | SSH key for cloning `dwallet-labs/cryptography-private` (private dependency) |
-| `GAR_KEY` | Google Cloud service account JSON for Artifact Registry |
-| `GITHUB_TOKEN` | Automatic — creates draft releases |
-| `HOMEBREW_TAP_DEPLOY_KEY` | SSH deploy key with write access to `ika-xyz/homebrew-tap` |
+| Secret                    | Purpose                                                                      |
+| ------------------------- | ---------------------------------------------------------------------------- |
+| `GH_DEPLOY_KEY`           | SSH key for cloning `dwallet-labs/cryptography-private` (private dependency) |
+| `GAR_KEY`                 | Google Cloud service account JSON for Artifact Registry                      |
+| `GITHUB_TOKEN`            | Automatic — creates draft releases                                           |
+| `HOMEBREW_TAP_DEPLOY_KEY` | SSH deploy key with write access to `ika-xyz/homebrew-tap`                   |
 
 ### Runner labels
 
 Configured in the `version` job outputs — change there to update all jobs:
 
-| Label | Used by |
-|-------|---------|
-| `linux-32-runner` | Linux builds, Docker packaging |
-| `macos-13` | macOS Intel CLI build |
-| `macos-latest` | macOS Apple Silicon CLI build |
-| `windows-latest` | Windows CLI build |
-| `ubuntu-latest` | Version resolution, uploads, release, homebrew |
+| Label             | Used by                                        |
+| ----------------- | ---------------------------------------------- |
+| `linux-32-runner` | Linux builds, Docker packaging                 |
+| `macos-13`        | macOS Intel CLI build                          |
+| `macos-latest`    | macOS Apple Silicon CLI build                  |
+| `windows-latest`  | Windows CLI build                              |
+| `ubuntu-latest`   | Version resolution, uploads, release, homebrew |
 
 ## Release Publish (via tag)
 
@@ -50,6 +50,7 @@ release/{network}-{version}
 - `version`: must match `Cargo.toml` workspace version
 
 Examples:
+
 - `release/mainnet-1.2.0` — full release + Homebrew update
 - `release/testnet-1.2.0` — full release, no Homebrew
 - `release/devnet-1.2.0` — full release, no Homebrew
@@ -72,22 +73,22 @@ Manual dispatch builds and uploads everything but does **not** create a GitHub r
 
 ### Binaries
 
-| Platform | Binaries | Method |
-|----------|----------|--------|
-| linux-x64 | ika, ika-validator, ika-fullnode, ika-notifier, ika-proxy | Docker (reproducible) |
-| linux-arm64 | ika, ika-validator, ika-fullnode, ika-notifier | Docker (cross-compile) |
-| macos-x64 | ika | Native runner |
-| macos-arm64 | ika | Native runner |
-| windows-x64 | ika.exe | Native runner |
+| Platform    | Binaries                                                  | Method                 |
+| ----------- | --------------------------------------------------------- | ---------------------- |
+| linux-x64   | ika, ika-validator, ika-fullnode, ika-notifier, ika-proxy | Docker (reproducible)  |
+| linux-arm64 | ika, ika-validator, ika-fullnode, ika-notifier            | Docker (cross-compile) |
+| macos-x64   | ika                                                       | Native runner          |
+| macos-arm64 | ika                                                       | Native runner          |
+| windows-x64 | ika.exe                                                   | Native runner          |
 
 ### Docker images
 
-| Image | Registry | Binary |
-|-------|----------|--------|
+| Image         | Registry                                             | Binary        |
+| ------------- | ---------------------------------------------------- | ------------- |
 | ika-validator | `us-docker.pkg.dev/.../ika-common-public-containers` | ika-validator |
-| ika-fullnode | `us-docker.pkg.dev/.../ika-common-public-containers` | ika-fullnode |
-| ika-notifier | `us-docker.pkg.dev/.../ika-common-public-containers` | ika-notifier |
-| ika-proxy | `us-docker.pkg.dev/.../ika-common-containers` | ika-proxy |
+| ika-fullnode  | `us-docker.pkg.dev/.../ika-common-public-containers` | ika-fullnode  |
+| ika-notifier  | `us-docker.pkg.dev/.../ika-common-public-containers` | ika-notifier  |
+| ika-proxy     | `us-docker.pkg.dev/.../ika-common-containers`        | ika-proxy     |
 
 Docker tag format: `{network}-v{version}` (e.g., `mainnet-v1.2.0`)
 
@@ -103,12 +104,12 @@ version ──┬── build-linux (x64, arm64) ──┬── docker (4x para
 
 ## Where artifacts end up
 
-| Destination | What | When |
-|-------------|------|------|
-| GCP Artifact Registry (binaries) | All platform binaries | Always |
-| GCP Artifact Registry (Docker) | 4 Docker images | Always |
-| GitHub Release (draft) | Platform tarballs | Tag push only |
-| Homebrew (`ika-xyz/homebrew-tap`) | Updated formula | Mainnet tag push only |
+| Destination                       | What                  | When                  |
+| --------------------------------- | --------------------- | --------------------- |
+| GCP Artifact Registry (binaries)  | All platform binaries | Always                |
+| GCP Artifact Registry (Docker)    | 4 Docker images       | Always                |
+| GitHub Release (draft)            | Platform tarballs     | Tag push only         |
+| Homebrew (`ika-xyz/homebrew-tap`) | Updated formula       | Mainnet tag push only |
 
 ## After the release
 
@@ -120,6 +121,7 @@ The GitHub release is created as a **draft**. After verifying:
 4. Click **Publish release**
 
 Users can then install via:
+
 ```bash
 brew install ika-xyz/tap/ika
 ```

.github/PUBLISHING-SDK.md

@@ -30,6 +30,7 @@ sdk/typescript-{version}
 ```
 
 Examples:
+
 - `sdk/typescript-0.6.0`
 - `sdk/typescript-1.0.0`
 
@@ -58,15 +59,15 @@ Pre-release versions are published with their own npm dist-tag (e.g., `0.6.0-rc1
 
 ## Packages published
 
-| Package | Directory | Description |
-|---------|-----------|-------------|
-| `@ika.xyz/ika-wasm` | `sdk/ika-wasm/` | Rust-to-WASM crypto bindings |
-| `@ika.xyz/sdk` | `sdk/typescript/` | TypeScript SDK |
+| Package             | Directory         | Description                  |
+| ------------------- | ----------------- | ---------------------------- |
+| `@ika.xyz/ika-wasm` | `sdk/ika-wasm/`   | Rust-to-WASM crypto bindings |
+| `@ika.xyz/sdk`      | `sdk/typescript/` | TypeScript SDK               |
 
 ## npm dist-tags
 
-| Version format | npm tag | Example |
-|----------------|---------|---------|
-| `0.6.0` (tag push) | `latest` | `npm install @ika.xyz/sdk` |
-| `0.6.0-rc1` (manual) | `rc` | `npm install @ika.xyz/sdk@rc` |
-| `0.6.0-beta.1` (manual) | `beta` | `npm install @ika.xyz/sdk@beta` |
+| Version format          | npm tag  | Example                         |
+| ----------------------- | -------- | ------------------------------- |
+| `0.6.0` (tag push)      | `latest` | `npm install @ika.xyz/sdk`      |
+| `0.6.0-rc1` (manual)    | `rc`     | `npm install @ika.xyz/sdk@rc`   |
+| `0.6.0-beta.1` (manual) | `beta`   | `npm install @ika.xyz/sdk@beta` |

.github/PUBLISHING-SKILLS.md

@@ -25,6 +25,7 @@ skills/{skill_name}-{version}
 ```
 
 Examples:
+
 - `skills/ika-sdk-1.1.0`
 - `skills/ika-cli-2.0.0`
 - `skills/ika-move-1.0.1`
@@ -48,9 +49,9 @@ Bare versions like `1.1.0` are rejected on manual dispatch — they are reserved
 
 ## Available skills
 
-| Skill | Directory |
-|-------|-----------|
-| ika-cli | `skills/ika-cli/` |
-| ika-sdk | `skills/ika-sdk/` |
-| ika-move | `skills/ika-move/` |
+| Skill        | Directory              |
+| ------------ | ---------------------- |
+| ika-cli      | `skills/ika-cli/`      |
+| ika-sdk      | `skills/ika-sdk/`      |
+| ika-move     | `skills/ika-move/`     |
 | ika-operator | `skills/ika-operator/` |

.github/labeler.yml

@@ -1,23 +1,23 @@
-"Type: Documentation":
+'Type: Documentation':
   - changed-files:
-      - any-glob-to-any-file: "docs/content/**/*"
+      - any-glob-to-any-file: 'docs/content/**/*'
 
-"Area: Rust":
+'Area: Rust':
   - changed-files:
-      - any-glob-to-any-file: "crates/**"
+      - any-glob-to-any-file: 'crates/**'
 
-"Area: Move":
+'Area: Move':
   - changed-files:
-      - any-glob-to-any-file: "contracts/**"
+      - any-glob-to-any-file: 'contracts/**'
 
-"Area: SDK":
+'Area: SDK':
   - changed-files:
-      - any-glob-to-any-file: "sdk/**"
+      - any-glob-to-any-file: 'sdk/**'
 
-"Area: Docker":
+'Area: Docker':
   - changed-files:
-      - any-glob-to-any-file: "docker/**"
+      - any-glob-to-any-file: 'docker/**'
 
-"Area: CI":
+'Area: CI':
   - changed-files:
-      - any-glob-to-any-file: ".github/**"
+      - any-glob-to-any-file: '.github/**'

.github/workflows/deploy-docs.yaml

@@ -5,7 +5,7 @@ on:
     branches:
       - main
     paths:
-      - "docs/**"
+      - 'docs/**'
   workflow_dispatch:
 
 concurrency:
@@ -25,7 +25,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: '20'
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2

.github/workflows/labeler.yml

@@ -13,4 +13,4 @@ jobs:
     steps:
       - uses: actions/labeler@v6
         with:
-          repo-token: "${{ secrets.GITHUB_TOKEN }}"
+          repo-token: '${{ secrets.GITHUB_TOKEN }}'

.github/workflows/publish-skills.yaml

@@ -3,7 +3,7 @@ name: Publish Skills to ClawHub
 on:
   push:
     tags:
-      - "skills/*-*"
+      - 'skills/*-*'
   workflow_dispatch:
     inputs:
       skill:
@@ -12,7 +12,7 @@ on:
         type: string
         default: all
       version:
-        description: "Version override — MUST include a pre-release tag (e.g., 1.1.9-test, 1.2.0-rc1). Bare versions like 1.2.0 are not allowed."
+        description: 'Version override — MUST include a pre-release tag (e.g., 1.1.9-test, 1.2.0-rc1). Bare versions like 1.2.0 are not allowed.'
         required: true
         type: string
 
@@ -74,7 +74,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: "22"
+          node-version: '22'
 
       - name: Install ClawHub CLI
         run: npm install -g clawhub

.github/workflows/publish-typescript-sdk.yml

@@ -1,9 +1,10 @@
-name: Publish SDKs (ika-wasm + typescript via pnpm Trusted Publishing)
+name: Publish SDKs (ika-wasm + typescript + plugins via pnpm Trusted Publishing)
 
 on:
   push:
     tags:
       - 'sdk/typescript-*'
+      - 'sdk/plugins-*'
   workflow_dispatch:
     inputs:
       version:
@@ -44,11 +45,25 @@ jobs:
       - name: Validate tag version matches package.json
         if: github.event_name == 'push'
         run: |
-          TAG_VERSION="${GITHUB_REF#refs/tags/sdk/typescript-}"
-          PKG_VERSION=$(node -p "require('./sdk/typescript/package.json').version")
+          TAG="${GITHUB_REF#refs/tags/}"
+          case "$TAG" in
+            sdk/typescript-*)
+              PKG_PATH="./sdk/typescript/package.json"
+              TAG_VERSION="${TAG#sdk/typescript-}"
+              ;;
+            sdk/plugins-*)
+              PKG_PATH="./sdk/plugins/package.json"
+              TAG_VERSION="${TAG#sdk/plugins-}"
+              ;;
+            *)
+              echo "::error::Unknown tag pattern: $TAG"
+              exit 1
+              ;;
+          esac
+          PKG_VERSION=$(node -p "require('$PKG_PATH').version")
 
           if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
-            echo "::error::Tag version ($TAG_VERSION) does not match sdk/typescript/package.json version ($PKG_VERSION). Update package.json first."
+            echo "::error::Tag version ($TAG_VERSION) does not match $PKG_PATH version ($PKG_VERSION). Update package.json first."
             exit 1
           fi
           echo "Tag version matches package.json: $PKG_VERSION"
@@ -104,7 +119,7 @@ jobs:
         if: github.event_name == 'workflow_dispatch' && inputs.version != ''
         run: |
           VERSION="${{ inputs.version }}"
-          for pkg in sdk/ika-wasm/package.json sdk/typescript/package.json; do
+          for pkg in sdk/ika-wasm/package.json sdk/typescript/package.json sdk/plugins/package.json; do
             node -e "
               const fs = require('fs');
               const pkg = JSON.parse(fs.readFileSync('$pkg', 'utf8'));
@@ -216,6 +231,52 @@ jobs:
           pnpm publish --provenance --access public --tag "$TAG" --no-git-checks
           echo "Published ${{ steps.ts_pkg.outputs.name }}@$VERSION with tag $TAG"
 
+      # ---------- sdk/plugins ----------
+
+      - name: Get sdk/plugins package info
+        id: plugins_pkg
+        working-directory: ./sdk/plugins
+        run: |
+          NAME=$(node -p "require('./package.json').name")
+          VERSION=$(node -p "require('./package.json').version")
+          echo "name=$NAME" >> "$GITHUB_OUTPUT"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "Package: $NAME"
+          echo "Version: $VERSION"
+
+      - name: Check if sdk/plugins version is already published
+        id: plugins_check
+        env:
+          PKG_NAME: ${{ steps.plugins_pkg.outputs.name }}
+          PKG_VERSION: ${{ steps.plugins_pkg.outputs.version }}
+        run: |
+          echo "Checking if $PKG_NAME@$PKG_VERSION is already on npm..."
+          if npm view "$PKG_NAME@$PKG_VERSION" version > /dev/null 2>&1; then
+            echo "published=true" >> "$GITHUB_OUTPUT"
+            echo "$PKG_NAME@$PKG_VERSION is already published. Skipping."
+          else
+            echo "published=false" >> "$GITHUB_OUTPUT"
+            echo "$PKG_NAME@$PKG_VERSION is NOT published yet. Will publish."
+          fi
+
+      - name: Build (sdk/plugins)
+        if: steps.plugins_check.outputs.published == 'false'
+        working-directory: ./sdk/plugins
+        run: pnpm build
+
+      - name: Publish sdk/plugins via pnpm (Trusted Publishing)
+        if: steps.plugins_check.outputs.published == 'false'
+        working-directory: ./sdk/plugins
+        run: |
+          # Pre-release versions get their own dist-tag, not "latest"
+          TAG="latest"
+          VERSION="${{ steps.plugins_pkg.outputs.version }}"
+          if [[ "$VERSION" == *-* ]]; then
+            TAG=$(echo "$VERSION" | sed 's/.*-//' | sed 's/\..*//')
+          fi
+          pnpm publish --provenance --access public --tag "$TAG" --no-git-checks
+          echo "Published ${{ steps.plugins_pkg.outputs.name }}@$VERSION with tag $TAG"
+
       - name: Summary
         if: always()
         run: |
@@ -235,3 +296,9 @@ jobs:
           else
             echo "| ${{ steps.ts_pkg.outputs.name }} | ${{ steps.ts_pkg.outputs.version }} | Published |" >> "$GITHUB_STEP_SUMMARY"
           fi
+
+          if [ "${{ steps.plugins_check.outputs.published }}" = "true" ]; then
+            echo "| ${{ steps.plugins_pkg.outputs.name }} | ${{ steps.plugins_pkg.outputs.version }} | Skipped (already published) |" >> "$GITHUB_STEP_SUMMARY"
+          else
+            echo "| ${{ steps.plugins_pkg.outputs.name }} | ${{ steps.plugins_pkg.outputs.version }} | Published |" >> "$GITHUB_STEP_SUMMARY"
+          fi