ci: unified npm package with native binding + CLI binary

The `authy-cli` npm package now ships both:
- napi-rs native .node files (import { Authy } from "authy-cli")
- prebuilt CLI binaries (authy command on PATH)

One `npm install authy-cli` gives users the Node.js binding AND the CLI.

Release workflow builds napi-rs cdylib for 5 platforms in parallel,
then collects all .node files and CLI binaries into a single npm publish.

Author: eric8810

.github/workflows/release.yml

@@ -162,9 +162,11 @@ jobs:
           path: bindings/node/*.node
           if-no-files-found: error
 
+  # ── Publish unified npm package (native binding + CLI binary) ───
+
   npm-publish:
     name: Publish npm package
-    needs: [node-build, release]
+    needs: [build, node-build, release]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -174,15 +176,53 @@ jobs:
           node-version: 20
           registry-url: https://registry.npmjs.org
 
-      - name: Download all native artifacts
+      # Collect napi-rs .node files
+      - name: Download native binding artifacts
         uses: actions/download-artifact@v4
         with:
           pattern: node-*
           path: bindings/node
           merge-multiple: true
 
-      - name: List native modules
-        run: ls -la bindings/node/*.node
+      # Collect prebuilt CLI binaries
+      - name: Download CLI binary artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+
+      - name: Place CLI binaries into package
+        run: |
+          # Linux x64
+          tar xzf artifacts/authy-x86_64-unknown-linux-gnu/authy-x86_64-unknown-linux-gnu.tar.gz -C /tmp
+          mv /tmp/authy bindings/node/bin/authy-linux-x64
+
+          # Linux arm64
+          tar xzf artifacts/authy-aarch64-unknown-linux-gnu/authy-aarch64-unknown-linux-gnu.tar.gz -C /tmp
+          mv /tmp/authy bindings/node/bin/authy-linux-arm64
+
+          # macOS x64
+          tar xzf artifacts/authy-x86_64-apple-darwin/authy-x86_64-apple-darwin.tar.gz -C /tmp
+          mv /tmp/authy bindings/node/bin/authy-darwin-x64
+
+          # macOS arm64
+          tar xzf artifacts/authy-aarch64-apple-darwin/authy-aarch64-apple-darwin.tar.gz -C /tmp
+          mv /tmp/authy bindings/node/bin/authy-darwin-arm64
+
+          # Windows x64
+          cd artifacts/authy-x86_64-pc-windows-msvc
+          7z x authy-x86_64-pc-windows-msvc.zip -o/tmp/win
+          cd ../..
+          mv /tmp/win/authy.exe bindings/node/bin/authy-win32-x64.exe
+
+          # Make all binaries executable
+          chmod +x bindings/node/bin/authy-*
+
+      - name: List package contents
+        run: |
+          echo "=== Native modules ==="
+          ls -la bindings/node/*.node
+          echo "=== CLI binaries ==="
+          ls -la bindings/node/bin/
 
       - name: Extract version from tag
         id: version

.gitignore

@@ -40,3 +40,4 @@ bindings/*/target/
 bindings/*/Cargo.lock
 bindings/node/node_modules/
 bindings/node/*.node
+bindings/node/bin/authy-*

bindings/node/bin/authy

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+"use strict";
+
+const { execFileSync } = require("child_process");
+const path = require("path");
+
+const PLATFORMS = {
+  "linux-x64": "authy-linux-x64",
+  "linux-arm64": "authy-linux-arm64",
+  "darwin-x64": "authy-darwin-x64",
+  "darwin-arm64": "authy-darwin-arm64",
+  "win32-x64": "authy-win32-x64.exe",
+};
+
+const key = `${process.platform}-${process.arch}`;
+const binary = PLATFORMS[key];
+
+if (!binary) {
+  console.error(`Unsupported platform: ${key}`);
+  console.error(`Supported: ${Object.keys(PLATFORMS).join(", ")}`);
+  process.exit(1);
+}
+
+const binPath = path.join(__dirname, binary);
+
+try {
+  execFileSync(binPath, process.argv.slice(2), { stdio: "inherit" });
+} catch (err) {
+  if (err.status !== null) {
+    process.exit(err.status);
+  }
+  throw err;
+}

bindings/node/package.json

@@ -1,19 +1,23 @@
 {
   "name": "authy-cli",
   "version": "0.7.1",
-  "description": "Native Node.js binding for the authy secrets manager (Rust-powered)",
+  "description": "Secrets store & dispatch for AI agents — native Node.js binding + CLI binary (Rust-powered)",
   "main": "index.js",
   "types": "index.d.ts",
+  "bin": {
+    "authy": "bin/authy"
+  },
   "license": "MIT",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/eric8810/authy.git",
     "directory": "bindings/node"
   },
-  "keywords": ["secrets", "vault", "agents", "ai", "encryption", "napi-rs"],
+  "keywords": ["secrets", "vault", "agents", "ai", "encryption", "napi-rs", "cli"],
   "files": [
     "index.js",
     "index.d.ts",
+    "bin/",
     "*.node"
   ],
   "napi": {