[fernando-mendoza]

Adds .github/workflows/examples-typecheck.yml and .github/scripts/typecheck-example.sh. The workflow builds the SDK from the PR and runs tsc --noEmit on each TypeScript example against that build, with one matrix job per example.

How it works

1. build-sdk (same setup as sdk-test.yml: Node 22, npm install --no-audit --no-fund --legacy-peer-deps, npm run build) runs npm pack on packages/sdk and uploads the tarball as a 1-day artifact. It then lists every examples/*/tsconfig.json as the matrix. Discovery happens at run time, so a new example (for example x402-policy-daily-budget from feat(examples): daily-budget policy engine for the pre-sign hook (#127) #146) gets picked up without editing the workflow.
2. typecheck (<example>), one job per example with fail-fast: false: it runs npm ci from the example's own lockfile, then npm install --no-save of the PR tarball in place of the nirium the lockfile pins. The job fails unless node_modules/nirium/dist/index.d.ts is byte-identical to the tarball's (cmp), and only then runs npx --no-install tsc --noEmit -p ..

How each "Done when" item is met

• Runs on PRs that touch packages/sdk/** or examples/**: yes, plus the workflow and script themselves. It also runs on pushes to main with the same paths, as sdk-test.yml does.
• nirium resolves to the SDK built in the same run: the PR tarball replaces the npm release the lockfile pins (0.10.1 to 0.14.1 today) or the file: link to an unbuilt SDK. The cmp check enforces that.
• No network beyond npm install, no secrets: permissions: contents: read, no secrets.*, and tsc makes no network calls. Nothing runs the examples.
• Broken examples on main: none. All 7 current examples pass, so ALLOWED_TO_FAIL (a space-separated list in the workflow env, wired to continue-on-error) is empty and no extra issue was needed.

express-x402 has a tsconfig.json but does not depend on nirium. It is still typechecked, but nothing gets swapped in.

Validation (Node 22.23.3, npm 10.9.9)

• actionlint 1.7.12 with shellcheck 0.11.0: no errors. shellcheck on the script: no warnings.
• I replayed both jobs from a clean copy of the tree, with the feat(examples): daily-budget policy engine for the pre-sign hook (#127) #146 example added to check discovery. The matrix found 8 examples, and all 8 printed nirium resolves to nirium-0.16.1.tgz (express-x402: no nirium) and passed tsc --noEmit. The replay also caught a bug in the first draft (npm pack needs the destination directory to exist), which is fixed.
• Deliberate type error in an example (const broken: number = "not a number" in treasury-vault-quickstart): error TS2322, exit 2.
• Deliberate SDK break (renamed Agent.getTreasuryVault in packages/sdk/src, then rebuilt and repacked): treasury-vault-quickstart fails with error TS2551: Property 'getTreasuryVault' does not exist on type 'Agent', exit 2. The published 0.16.1 still has that method, so this proves the check runs against the PR build and not npm.

Out of scope, as in the issue: running the examples, and the Go/Rust/Unity C# parts. audit-forensic-bridge (pnpm, has a typecheck script but no tsconfig.json) and ws-signals-resilient (no tsconfig.json) are not covered.

Closes #143

[fernando-mendoza]

@Eras256 este PR resuelve #143 y está listo para revisión cuando tengas chance. Es independiente de los demás, así que lo puedes revisar en el orden que prefieras. ¡Gracias!