feat(sdks): add ts/python/go/libmoltis SDK foundations with CI and docs

.github/workflows/ci.yml

@@ -372,7 +372,7 @@ jobs:
 
       - name: Export GraphQL schema and generate project
         run: |
-          cargo run -p moltis-schema-export -- apps/ios/GraphQL/Schema/schema.graphqls
+          ./scripts/export-graphql-schema.sh
           ./scripts/generate-ios-graphql.sh
           ./scripts/generate-ios-project.sh
 

.github/workflows/sdk-ci.yml

@@ -0,0 +1,186 @@
+name: SDK CI
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - ".github/workflows/sdk-ci.yml"
+      - "scripts/export-graphql-schema.sh"
+      - "scripts/build-libmoltis-sdk.sh"
+      - "sdks/**"
+      - "crates/graphql/**"
+      - "crates/schema-export/**"
+      - "apps/ios/GraphQL/Schema/**"
+  pull_request:
+    paths:
+      - ".github/workflows/sdk-ci.yml"
+      - "scripts/export-graphql-schema.sh"
+      - "scripts/build-libmoltis-sdk.sh"
+      - "sdks/**"
+      - "crates/graphql/**"
+      - "crates/schema-export/**"
+      - "apps/ios/GraphQL/Schema/**"
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  schema-sync:
+    name: Schema Sync
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+
+      - uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # master
+        with:
+          toolchain: stable
+
+      - name: Verify schema sync
+        run: ./scripts/export-graphql-schema.sh --check
+
+  typescript-sdk:
+    name: TypeScript SDK
+    needs: schema-sync
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: "22"
+          package-manager-cache: false
+
+      - name: Install dependencies
+        working-directory: sdks/typescript
+        run: npm ci
+
+      - name: Generate GraphQL types
+        working-directory: sdks/typescript
+        run: npm run generate
+
+      - name: Typecheck
+        working-directory: sdks/typescript
+        run: npm run typecheck
+
+      - name: Test
+        working-directory: sdks/typescript
+        run: npm run test
+
+      - name: Package dry run
+        working-directory: sdks/typescript
+        run: npm run pack:dry
+
+  python-sdk:
+    name: Python SDK
+    needs: schema-sync
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install uv
+        run: python -m pip install --upgrade uv
+
+      - name: Sync dependencies
+        working-directory: sdks/python
+        run: uv sync --group dev
+
+      - name: Generate GraphQL types
+        working-directory: sdks/python
+        run: uv run ariadne-codegen
+
+      - name: Lint
+        working-directory: sdks/python
+        run: uv run ruff check .
+
+      - name: Typecheck
+        working-directory: sdks/python
+        run: uv run mypy .
+
+      - name: Test
+        working-directory: sdks/python
+        run: uv run pytest
+
+      - name: Build package
+        working-directory: sdks/python
+        run: uv run python -m build
+
+  go-sdk:
+    name: Go SDK
+    needs: schema-sync
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.22.x"
+
+      - name: Download modules
+        working-directory: sdks/go
+        run: go mod tidy
+
+      - name: Generate GraphQL code
+        working-directory: sdks/go
+        run: go generate ./...
+
+      - name: Vet
+        working-directory: sdks/go
+        run: go vet ./...
+
+      - name: Test
+        working-directory: sdks/go
+        run: go test ./...
+
+  libmoltis-sdk:
+    name: libmoltis SDK
+    needs: schema-sync
+    runs-on: macos-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # master
+        with:
+          toolchain: stable
+          targets: x86_64-apple-darwin,aarch64-apple-darwin,wasm32-wasip2
+
+      - name: Install native build dependencies
+        run: brew install cbindgen
+
+      - name: Build SDK artifacts
+        run: ./scripts/build-libmoltis-sdk.sh
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: libmoltis-sdk-${{ github.run_id }}-${{ github.run_attempt }}
+          path: sdks/libmoltis/dist/
+          if-no-files-found: error

.github/workflows/sdk-release.yml

@@ -0,0 +1,134 @@
+name: SDK Release
+
+on:
+  push:
+    tags:
+      - "sdk-ts-v*"
+      - "sdk-py-v*"
+      - "sdks/go/v*"
+      - "sdk-libmoltis-v*"
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  publish-typescript:
+    name: Publish TypeScript SDK
+    if: startsWith(github.ref, 'refs/tags/sdk-ts-v')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: "22"
+          registry-url: "https://registry.npmjs.org"
+          package-manager-cache: false
+
+      - name: Install dependencies
+        working-directory: sdks/typescript
+        run: npm ci
+
+      - name: Build package
+        working-directory: sdks/typescript
+        run: npm run build
+
+      - name: Publish to npm
+        working-directory: sdks/typescript
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: npm publish --provenance --access public
+
+  publish-python:
+    name: Publish Python SDK
+    if: startsWith(github.ref, 'refs/tags/sdk-py-v')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install uv
+        run: python -m pip install --upgrade uv
+
+      - name: Build sdist and wheel
+        working-directory: sdks/python
+        run: |
+          uv sync --group dev
+          uv run python -m build
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: sdks/python/dist/
+
+  release-go:
+    name: Validate Go SDK Tag
+    if: startsWith(github.ref, 'refs/tags/sdks/go/v')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.22.x"
+
+      - name: Validate module
+        working-directory: sdks/go
+        run: |
+          go mod tidy
+          go generate ./...
+          go test ./...
+          go list -m
+
+  release-libmoltis:
+    name: Release libmoltis SDK artifacts
+    if: startsWith(github.ref, 'refs/tags/sdk-libmoltis-v')
+    runs-on: macos-latest
+    permissions:
+      contents: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # master
+        with:
+          toolchain: stable
+          targets: x86_64-apple-darwin,aarch64-apple-darwin,wasm32-wasip2
+
+      - name: Install native build dependencies
+        run: brew install cbindgen
+
+      - name: Build SDK artifacts
+        run: ./scripts/build-libmoltis-sdk.sh
+
+      - name: Upload release assets
+        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2
+        with:
+          files: |
+            sdks/libmoltis/dist/MoltisBridge.xcframework.zip
+            sdks/libmoltis/dist/moltis_bridge.h
+            sdks/libmoltis/dist/libmoltis_bridge.a

.gitignore

@@ -25,3 +25,14 @@ crates/web/src/assets/style.css
 crates/gateway/ui/node_modules/
 crates/gateway/ui/playwright-report/
 crates/gateway/ui/test-results/
+sdks/typescript/node_modules/
+sdks/typescript/dist/
+sdks/python/.venv/
+sdks/python/.mypy_cache/
+sdks/python/.pytest_cache/
+sdks/python/.ruff_cache/
+sdks/python/dist/
+sdks/python/build/
+sdks/python/**/__pycache__/
+sdks/go/internal/generated/generated.go
+sdks/libmoltis/dist/

CLAUDE.md

@@ -237,7 +237,7 @@ Exact commands (must match `local-validate.sh`):
 - Clippy: `cargo +nightly-2025-11-30 clippy -Z unstable-options --workspace --all-features --all-targets --timings -- -D warnings`
 - macOS without `nvcc`: clippy without `--all-features`
 - macOS app (Darwin hosts): `./scripts/build-swift-bridge.sh && ./scripts/generate-swift-project.sh && ./scripts/lint-swift.sh && xcodebuild -project apps/macos/Moltis.xcodeproj -scheme Moltis -configuration Release -destination "platform=macOS" -derivedDataPath apps/macos/.derivedData-local-validate build`
-- iOS app (Darwin hosts): `cargo run -p moltis-schema-export -- apps/ios/GraphQL/Schema/schema.graphqls && ./scripts/generate-ios-graphql.sh && ./scripts/generate-ios-project.sh && xcodebuild -project apps/ios/Moltis.xcodeproj -scheme Moltis -configuration Debug -destination "generic/platform=iOS" CODE_SIGNING_ALLOWED=NO build`
+- iOS app (Darwin hosts): `./scripts/export-graphql-schema.sh && ./scripts/generate-ios-graphql.sh && ./scripts/generate-ios-project.sh && xcodebuild -project apps/ios/Moltis.xcodeproj -scheme Moltis -configuration Debug -destination "generic/platform=iOS" CODE_SIGNING_ALLOWED=NO build`
 
 ### PR Descriptions
 

README.md

@@ -128,6 +128,22 @@ See [Security Architecture](https://docs.moltis.org/security.html) for details.
 - **Security** — Encryption-at-rest vault (XChaCha20-Poly1305 + Argon2id), password + passkey + API key auth, sandbox isolation, SSRF/CSWSH protection
 - **Operations** — Cron scheduling, OpenTelemetry tracing, Prometheus metrics, cloud deploy (Fly.io, DigitalOcean), Tailscale integration
 
+## SDKs
+
+Moltis now includes first-party SDK workspaces under `sdks/`:
+
+- `sdks/typescript` — TypeScript GraphQL SDK
+- `sdks/python` — Python GraphQL SDK
+- `sdks/go` — Go GraphQL SDK
+- `sdks/libmoltis` — native C ABI packaging from `moltis-swift-bridge`
+
+Shared GraphQL SDK schema and operations live in:
+
+- `sdks/schema/schema.graphqls`
+- `sdks/operations/**/*.graphql`
+
+See [SDK docs](https://docs.moltis.org/sdks.html) for usage and release details.
+
 ## How It Works
 
 Moltis is a **local-first AI gateway** — a single Rust binary that sits

docs/src/SUMMARY.md

@@ -26,6 +26,11 @@
 - [Sandbox](sandbox.md)
   - [Trusted Network](trusted-network.md)
 - [Voice](voice.md)
+- [SDKs](sdks.md)
+  - [TypeScript SDK](sdk-typescript.md)
+  - [Python SDK](sdk-python.md)
+  - [Go SDK](sdk-go.md)
+  - [libmoltis SDK](sdk-libmoltis.md)
 - [Channels](channels.md)
   - [Discord](discord.md)
   - [WhatsApp](whatsapp.md)

docs/src/index.md

@@ -102,6 +102,7 @@ Authentication is only required when accessing Moltis from a non-localhost addre
 - **[MCP Servers](mcp.md)** — Extend with Model Context Protocol
 - **[Hooks](hooks.md)** — Lifecycle hooks for customization
 - **[Local LLMs](local-llm.md)** — Run models on your machine
+- **[SDKs](sdks.md)** — TypeScript, Python, Go, and native bridge SDKs
 
 ### Deployment
 - **[Docker](docker.md)** — Container deployment