build: cleanup of python and node builds

Author: bordumb

.github/actionlint.yaml

@@ -0,0 +1,4 @@
+self-hosted-runner:
+  labels:
+    - ubuntu-24.04-arm
+    - windows-11-arm

.github/workflows/publish-node.yml

@@ -25,20 +25,39 @@ jobs:
       fail-fast: false
       matrix:
         include:
+          # macOS — both archs build natively on arm64 runner
+          - os: macos-latest
+            target: aarch64-apple-darwin
+
+          # Linux (glibc) — native runners per arch
           - os: ubuntu-latest
             target: x86_64-unknown-linux-gnu
-          - os: ubuntu-latest
+          - os: ubuntu-24.04-arm
             target: aarch64-unknown-linux-gnu
-          - os: macos-latest
-            target: aarch64-apple-darwin
+
+          # Linux (musl) — native runners per arch
+          - os: ubuntu-latest
+            target: x86_64-unknown-linux-musl
+          - os: ubuntu-24.04-arm
+            target: aarch64-unknown-linux-musl
+
+          # Windows — native runners per arch
           - os: windows-latest
             target: x86_64-pc-windows-msvc
+          - os: windows-11-arm
+            target: aarch64-pc-windows-msvc
     steps:
       - uses: actions/checkout@v4
 
-      - uses: dtolnay/rust-toolchain@stable
+      - name: Remove rust-toolchain.toml
+        shell: bash
+        run: rm -f rust-toolchain.toml
+
+      - uses: dtolnay/rust-toolchain@master
         with:
+          toolchain: "1.93"
           targets: ${{ matrix.target }}
+          components: clippy,rustfmt
 
       - uses: actions/setup-node@v4
         with:
@@ -51,16 +70,22 @@ jobs:
         working-directory: packages/auths-node
         run: pnpm install
 
-      - name: Install cross-compilation tools (Linux ARM64)
-        if: matrix.target == 'aarch64-unknown-linux-gnu'
+      - name: Install musl tools (Linux x64)
+        if: matrix.target == 'x86_64-unknown-linux-musl'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y musl-tools
+
+      - name: Install musl tools (Linux arm64)
+        if: matrix.target == 'aarch64-unknown-linux-musl'
         run: |
           sudo apt-get update
-          sudo apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu
+          sudo apt-get install -y musl-tools
 
       - name: Build native module
         working-directory: packages/auths-node
         env:
-          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: ${{ matrix.target == 'aarch64-unknown-linux-gnu' && 'aarch64-linux-gnu-gcc' || '' }}
+          RUSTUP_TOOLCHAIN: "1.93"
         run: pnpm build -- --target ${{ matrix.target }}
 
       - uses: actions/upload-artifact@v4
@@ -78,8 +103,12 @@ jobs:
         include:
           - os: ubuntu-latest
             artifact: bindings-x86_64-unknown-linux-gnu
-          - os: macos-14
+          - os: ubuntu-24.04-arm
+            artifact: bindings-aarch64-unknown-linux-gnu
+          - os: macos-latest
             artifact: bindings-aarch64-apple-darwin
+          - os: windows-latest
+            artifact: bindings-x86_64-pc-windows-msvc
     steps:
       - uses: actions/checkout@v4
 
@@ -108,9 +137,48 @@ jobs:
         working-directory: packages/auths-node
         run: pnpm test
 
+  universal-macos:
+    name: Universal macOS binary
+    needs: [build]
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Install pnpm
+        run: npm install -g pnpm
+
+      - name: Install dependencies
+        working-directory: packages/auths-node
+        run: pnpm install
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: bindings-aarch64-apple-darwin
+          path: packages/auths-node/artifacts
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: bindings-x86_64-apple-darwin
+          path: packages/auths-node/artifacts
+
+      - name: Build universal binary
+        working-directory: packages/auths-node
+        run: |
+          pnpm artifacts
+          pnpm universal
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: bindings-universal-apple-darwin
+          path: packages/auths-node/auths.darwin-universal.node
+
   publish:
     name: Publish to npm
-    needs: [build, test]
+    needs: [build, test, universal-macos]
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'workflow_dispatch' && github.event.inputs.target == 'npm')
     permissions:

.github/workflows/publish-python.yml

@@ -116,7 +116,7 @@ jobs:
       id-token: write
     environment:
       name: ${{ (github.event_name == 'workflow_dispatch' && github.event.inputs.target == 'testpypi') && 'testpypi' || 'pypi' }}
-      url: ${{ (github.event_name == 'workflow_dispatch' && github.event.inputs.target == 'testpypi') && 'https://test.pypi.org/p/auths-python' || 'https://pypi.org/p/auths-python' }}
+      url: ${{ (github.event_name == 'workflow_dispatch' && github.event.inputs.target == 'testpypi') && 'https://test.pypi.org/p/auths' || 'https://pypi.org/p/auths' }}
     steps:
       - uses: actions/download-artifact@v4
         with:

.github/workflows/test-windows-build.yml

@@ -0,0 +1,45 @@
+name: Test Windows CLI Build
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        run: |
+          rustup toolchain install 1.93 --profile minimal
+          rustup default 1.93
+          rustup target add x86_64-pc-windows-msvc
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          key: x86_64-pc-windows-msvc
+
+      - name: Build CLI
+        run: cargo build --release --package auths-cli --target x86_64-pc-windows-msvc
+
+      - name: Verify binary
+        run: |
+          dir target\x86_64-pc-windows-msvc\release\auths.exe
+          target\x86_64-pc-windows-msvc\release\auths.exe --version
+          target\x86_64-pc-windows-msvc\release\auths.exe --help
+
+      - name: Package
+        run: |
+          New-Item -ItemType Directory -Force -Path staging
+          Copy-Item target/x86_64-pc-windows-msvc/release/auths.exe staging/
+          Copy-Item target/x86_64-pc-windows-msvc/release/auths-sign.exe staging/ -ErrorAction SilentlyContinue
+          Copy-Item target/x86_64-pc-windows-msvc/release/auths-verify.exe staging/ -ErrorAction SilentlyContinue
+          Compress-Archive -Path staging/* -DestinationPath auths-windows-x86_64.zip
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: auths-windows-x86_64
+          path: auths-windows-x86_64.zip

docs/sdk/node/errors.md

@@ -21,7 +21,7 @@ AuthsError
 All SDK errors extend `AuthsError`, so a single catch handles everything:
 
 ```typescript
-import { AuthsError } from '@auths-dev/node'
+import { AuthsError } from '@auths-dev/sdk'
 
 try {
   auths.signAs({ message: data, identityDid: did })
@@ -35,7 +35,7 @@ try {
 For finer control, catch specific subclasses:
 
 ```typescript
-import { CryptoError, KeychainError, NetworkError } from '@auths-dev/node'
+import { CryptoError, KeychainError, NetworkError } from '@auths-dev/sdk'
 
 try {
   auths.signAs({ message: data, identityDid: did })

docs/sdk/node/overview.md

@@ -5,15 +5,15 @@ Full-featured Node.js SDK for Auths decentralized identity, backed by Rust via n
 ## Installation
 
 ```bash
-npm install @auths-dev/node
+npm install @auths-dev/sdk
 ```
 
 Pre-built native binaries for Linux, macOS, and Windows (x86_64 and aarch64). No Rust toolchain required. Requires Node.js 20+.
 
 ## Quick taste
 
 ```typescript
-import { Auths } from '@auths-dev/node'
+import { Auths } from '@auths-dev/sdk'
 
 const auths = new Auths()
 const identity = auths.identities.create({ label: 'laptop' })

docs/sdk/node/quickstart.md

@@ -3,13 +3,13 @@
 ## Install
 
 ```bash
-npm install @auths-dev/node
+npm install @auths-dev/sdk
 ```
 
 ## Create an identity and sign a commit
 
 ```typescript
-import { Auths } from '@auths-dev/node'
+import { Auths } from '@auths-dev/sdk'
 
 const auths = new Auths()
 const identity = auths.identities.create({ label: 'laptop' })
@@ -36,7 +36,7 @@ console.log(`Device: ${device.did}`)
 ## Verify a single attestation
 
 ```typescript
-import { verifyAttestation } from '@auths-dev/node'
+import { verifyAttestation } from '@auths-dev/sdk'
 
 const result = await verifyAttestation(attestationJson, publicKeyHex)
 console.log(`Valid: ${result.valid}`)
@@ -45,7 +45,7 @@ console.log(`Valid: ${result.valid}`)
 ## Verify a chain
 
 ```typescript
-import { verifyChain } from '@auths-dev/node'
+import { verifyChain } from '@auths-dev/sdk'
 
 const report = await verifyChain(attestationChain, rootPublicKeyHex)
 console.log(`Chain status: ${report.status.statusType}`) // 'Valid'
@@ -54,7 +54,7 @@ console.log(`Chain status: ${report.status.statusType}`) // 'Valid'
 ## Build a policy
 
 ```typescript
-import { PolicyBuilder } from '@auths-dev/node'
+import { PolicyBuilder } from '@auths-dev/sdk'
 
 const policy = new PolicyBuilder()
   .notRevoked()
@@ -111,7 +111,7 @@ const members = auths.orgs.listMembers({ orgDid: org.orgDid })
 ## Error handling
 
 ```typescript
-import { Auths, CryptoError, KeychainError, AuthsError } from '@auths-dev/node'
+import { Auths, CryptoError, KeychainError, AuthsError } from '@auths-dev/sdk'
 
 try {
   auths.signAs({ message: data, identityDid: 'did:keri:nonexistent' })

docs/sdk/python/overview.md

@@ -5,15 +5,15 @@ Full-featured Python SDK for Auths decentralized identity, backed by Rust via Py
 ## Installation
 
 ```bash
-pip install auths-python
+pip install auths
 ```
 
 Pre-built wheels for Linux, macOS, and Windows (Python 3.8+ via ABI3). No Rust toolchain required.
 
 For JWT token verification, install the optional dependency:
 
 ```bash
-pip install auths-python[jwt]
+pip install auths[jwt]
 ```
 
 ## Quick taste

docs/sdk/python/quickstart.md

@@ -3,7 +3,7 @@
 ## Install
 
 ```bash
-pip install auths-python
+pip install auths
 ```
 
 ## Create an identity and sign a commit

packages/auths-node/README.md

@@ -5,13 +5,13 @@ Decentralized identity for developers and AI agents. Sign, verify, and manage cr
 ## Install
 
 ```bash
-npm install @auths-dev/node
+npm install @auths-dev/sdk
 ```
 
 ## Quick start
 
 ```typescript
-import { Auths, verifyAttestation } from '@auths-dev/node'
+import { Auths, verifyAttestation } from '@auths-dev/sdk'
 
 const auths = new Auths()
 
@@ -28,7 +28,7 @@ console.log(sig.signature) // hex-encoded Ed25519 signature
 ## Identity management
 
 ```typescript
-import { Auths } from '@auths-dev/node'
+import { Auths } from '@auths-dev/sdk'
 
 const auths = new Auths({ repoPath: '~/.auths' })
 
@@ -64,7 +64,7 @@ auths.devices.revoke({
 ## Policy engine
 
 ```typescript
-import { PolicyBuilder, evaluatePolicy } from '@auths-dev/node'
+import { PolicyBuilder, evaluatePolicy } from '@auths-dev/sdk'
 
 // Build a standard policy
 const policy = PolicyBuilder.standard('sign_commit')
@@ -109,7 +109,7 @@ import {
   verifyAttestation,
   verifyChain,
   verifyAttestationWithCapability,
-} from '@auths-dev/node'
+} from '@auths-dev/sdk'
 
 // Single attestation
 const result = verifyAttestation(attestationJson, issuerPublicKeyHex)
@@ -127,7 +127,7 @@ const capResult = verifyAttestationWithCapability(
 ## Error handling
 
 ```typescript
-import { Auths, VerificationError, CryptoError, NetworkError } from '@auths-dev/node'
+import { Auths, VerificationError, CryptoError, NetworkError } from '@auths-dev/sdk'
 
 const auths = new Auths()
 try {