chore: make the Node SDK installable from npm releases

[ndizazzo]

Summary

Node.js and Electron users can install @meshllm/sdk with npm install @meshllm/sdk once the canonical packaging workflow publishes the next release.

• add npm metadata required for public provenance-aware publication
• make native addon release builds locked and safe on current macOS runners
• dispatch npm publication to Publish the Node SDK from canonical packaging lanes mesh-packaging#5 with the existing release payload
• update repository and website SDK guidance with the concise npm install command

This is the source-side handoff for Mesh-LLM/mesh-packaging#5 and supersedes #1062. Cross-platform build, assembly, preflight, and publication orchestration now live in mesh-packaging.

Architecture

mesh-llm remains the SDK source repository. The package repository metadata names Mesh-LLM/mesh-packaging because npm trusted publishing requires it to match the workflow that runs npm publish; homepage and issue links continue to point to this repository.

Validation

• Node SDK tests passed
• source package dry run passed
• public website build passed
• actionlint -config-file .github/actionlint.yaml passed
• cargo run -p xtask -- repo-consistency release-targets passed
• release YAML parsing and git diff --check passed
• Publish the Node SDK from canonical packaging lanes mesh-packaging#5 assembled a 60.7 MB five-target tarball, passed npm publish --dry-run, installed it in a clean consumer, and loaded the real macOS arm64 addon

cc @ndizazzo

Summary by CodeRabbit

• New Features

  • Node.js SDK releases now include prebuilt native addons for macOS, Linux, and Windows.
  • Release publishing now includes the Node.js SDK package on npm.

• Documentation

  • Updated installation instructions to use npm install @meshllm/sdk``.
  • Clarified package, container image, and npm publishing responsibilities.
  • Added SDK package metadata and public publishing details.

[coderabbitai]

📝 Walkthrough

Walkthrough

The release workflow now requests npm publication from Mesh-LLM/mesh-packaging. Node SDK package metadata, native build flags, installation documentation, and CI/release ownership descriptions were updated to reflect npm distribution.

Changes

Node SDK npm release

Layer / File(s)	Summary
Release dispatch and ownership contract .github/workflows/release.yml, .agents/skills/..., RELEASE.md, ci/ci.md	The release dispatch now sets publish_npm: true, and CI/release documentation assigns package, GHCR, and npm publication to Mesh-LLM/mesh-packaging.
SDK package metadata and native build sdk/node/package.json, sdk/node/scripts/build-native.mjs, sdk/node/README.md	The package adds npm metadata, public provenance configuration, and the license file; native builds use locked Cargo dependencies and disable macOS release stripping.
Node SDK installation documentation docs/SDK.md, docs/sdk/node.md, website/src/docs/pages/sdk-node.md	Installation examples now use npm install @meshllm/sdk``; the SDK README documents prebuilt addon platforms.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• Mesh-LLM/mesh-llm#973: Also updates Node SDK installation documentation.
• Mesh-LLM/mesh-llm#1008: Also changes release dispatch behavior and ownership documentation.
• Mesh-LLM/mesh-llm#1059: Defines CI inventory and release workflow ownership contracts updated here.

Suggested reviewers: i386, michaelneale

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: enabling the Node SDK to be installed from npm releases.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/npm-packaging-handoff

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

This pull request is currently a draft. Reviews will not take place until the PR is marked as ready for review.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@sdk/node/package.json`:
- Around line 7-10: Update the repository metadata in sdk/node/package.json to
use the mesh-llm source repository instead of mesh-packaging, and add the
repository directory field set to "sdk/node". Leave the existing repository type
unchanged.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 96daf45a-9151-4ba5-ab5e-9a4b1d79179b

📥 Commits

Reviewing files that changed from the base of the PR and between dfd6bec and e0f0c57.

📒 Files selected for processing (10)

• .agents/skills/manage-ci/references/current-inventory.md
• .github/workflows/release.yml
• RELEASE.md
• ci/ci.md
• docs/SDK.md
• docs/sdk/node.md
• sdk/node/README.md
• sdk/node/package.json
• sdk/node/scripts/build-native.mjs
• website/src/docs/pages/sdk-node.md

[i386]

Nice reviewing now

[i386]

I found one release-ordering risk to resolve before merging: the downstream Mesh-LLM/mesh-packaging main workflow currently ignores client_payload.publish_npm; that support is only in packaging PR #5. If this PR lands first, the next release will dispatch successfully but silently omit npm publication. Please merge/deploy the packaging workflow change first (or otherwise gate/coordinate this flag) so the source and consumer workflows become active together.

[i386]

Ignore this comment. The concern is addressed once Mesh-LLM/mesh-packaging#5 is merged, because that workflow then consumes client_payload.publish_npm.

[i386]

I was not relishing this work. Thank you for doing it.