fix: Improve deploy and ci processes by using workspaces

.agents/skills/guardian-auth-signature-flows/SKILL.md

@@ -62,13 +62,15 @@ Default targeted checks:
 ```bash
 cargo test -p guardian-client
 cargo test -p guardian-server
-cd packages/guardian-client && npm test
+cd packages
+npm ci
+npm test -w @openzeppelin/guardian-client
 ```
 
 Expand when the auth or signature change crosses into multisig execution:
 
 - `cargo test -p miden-multisig-client`
-- `cd packages/miden-multisig-client && npm test`
+- `cd packages && npm run build -w @openzeppelin/guardian-client && npm test -w @openzeppelin/miden-multisig-client`
 - `smoke-test-rust-multisig-sdk`
 - `smoke-test-ts-multisig-sdk`
 

.agents/skills/guardian-change-impact/references/impact-matrix.md

@@ -24,7 +24,7 @@ Likely surfaces:
 Validation:
 - `cargo test -p guardian-server`
 - `cargo test -p guardian-client`
-- `cd packages/guardian-client && npm test`
+- `cd packages && npm ci && npm test -w @openzeppelin/guardian-client`
 - one upstream smoke when user-visible behavior changes
 
 ## Canonicalization Or State Lifecycle
@@ -85,7 +85,7 @@ Likely surfaces:
 
 Validation:
 - `cargo test -p guardian-client`
-- `cd packages/guardian-client && npm test`
+- `cd packages && npm ci && npm test -w @openzeppelin/guardian-client`
 
 ## Multisig Proposal Lifecycle
 

.agents/skills/guardian-contract-change/references/contract-surfaces.md

@@ -76,11 +76,11 @@ Update these when the public workflow or expected responses changed.
 Minimum:
 - `cargo test -p guardian-server`
 - `cargo test -p guardian-client`
-- `cd packages/guardian-client && npm test`
+- `cd packages && npm ci && npm test -w @openzeppelin/guardian-client`
 
 Expand when the contract crosses layers:
 - `cargo test -p miden-multisig-client`
-- `cd packages/miden-multisig-client && npm test`
+- `cd packages && npm run build -w @openzeppelin/guardian-client && npm test -w @openzeppelin/miden-multisig-client`
 - `cargo test -p guardian-demo`
 - `cd examples/smoke-web && npm run typecheck && npm run build`
 - manual smoke with `smoke-test-rust-multisig-sdk` or `smoke-test-ts-multisig-sdk`

.agents/skills/guardian-multisig-proposal-lifecycle/SKILL.md

@@ -62,12 +62,15 @@ Default targeted checks:
 
 ```bash
 cargo test -p miden-multisig-client
-cd packages/miden-multisig-client && npm test
+cd packages
+npm ci
+npm run build -w @openzeppelin/guardian-client
+npm test -w @openzeppelin/miden-multisig-client
 ```
 
 Then expand as needed:
 
-- `cargo test -p guardian-client` or `cd packages/guardian-client && npm test` if the change crosses the GUARDIAN client boundary
+- `cargo test -p guardian-client` or `cd packages && npm test -w @openzeppelin/guardian-client` if the change crosses the GUARDIAN client boundary
 - `cargo test -p guardian-demo`
 - `cd examples/smoke-web && npm run typecheck && npm run build`
 - `cd examples/web && npm run build`

.agents/skills/guardian-validation-matrix/references/command-matrix.md

@@ -37,8 +37,10 @@ Code in:
 
 Run:
 ```bash
-cd packages/guardian-client && npm test
-cd packages/guardian-client && npm run build
+cd packages
+npm ci
+npm test -w @openzeppelin/guardian-client
+npm run build -w @openzeppelin/guardian-client
 ```
 
 ## Rust Multisig SDK
@@ -63,8 +65,11 @@ Code in:
 
 Run:
 ```bash
-cd packages/miden-multisig-client && npm test
-cd packages/miden-multisig-client && npm run build
+cd packages
+npm ci
+npm run build -w @openzeppelin/guardian-client
+npm test -w @openzeppelin/miden-multisig-client
+npm run build -w @openzeppelin/miden-multisig-client
 ```
 
 ## Rust Example Surface

.agents/skills/release-guardian-sdk-packages/SKILL.md

@@ -14,13 +14,10 @@ Read the current source of truth at the start of every release task:
 - `crates/contracts/Cargo.toml`
 - `crates/miden-multisig-client/Cargo.toml`
 - `packages/guardian-client/package.json`
-- `packages/guardian-client/package-lock.json`
 - `packages/guardian-evm-client/package.json`
-- `packages/guardian-evm-client/package-lock.json`
 - `packages/miden-multisig-client/package.json`
-- `packages/miden-multisig-client/package-lock.json`
 - `packages/guardian-operator-client/package.json`
-- `packages/guardian-operator-client/package-lock.json`
+- `packages/package-lock.json`
 - `references/release-surface.md`
 
 Trust these sources in this order:
@@ -101,16 +98,14 @@ For a coordinated release, update all of these:
 - `packages/miden-multisig-client/package.json` `@openzeppelin/guardian-client` dependency range
 - `packages/guardian-operator-client/package.json` `version`
 
-After editing TypeScript versions, refresh lockfiles from the package directories:
+After editing TypeScript versions, refresh the workspace lockfile:
 
 ```bash
-cd packages/guardian-client && npm install --package-lock-only
-cd packages/guardian-evm-client && npm install --package-lock-only
-cd packages/miden-multisig-client && npm install --package-lock-only
-cd packages/guardian-operator-client && npm install --package-lock-only
+cd packages
+npm install
 ```
 
-Inspect the resulting lockfile diff. Keep the refresh focused on version and dependency metadata.
+Inspect the resulting lockfile diff. Keep the refresh focused on version and dependency metadata. `@openzeppelin/guardian-client` must remain a workspace link (`resolved: "guardian-client"`, `link: true`), not a registry tarball.
 
 ## Validation
 
@@ -124,14 +119,16 @@ cargo test -p miden-multisig-client
 ```
 
 ```bash
-cd packages/guardian-client && npm test
-cd packages/guardian-client && npm run build
-cd packages/guardian-evm-client && npm test
-cd packages/guardian-evm-client && npm run build
-cd packages/miden-multisig-client && npm test
-cd packages/miden-multisig-client && npm run build
-cd packages/guardian-operator-client && npm test
-cd packages/guardian-operator-client && npm run build
+cd packages
+npm ci
+npm run build -w @openzeppelin/guardian-client
+npm test -w @openzeppelin/guardian-client
+npm run build -w @openzeppelin/guardian-evm-client
+npm test -w @openzeppelin/guardian-evm-client
+npm run build -w @openzeppelin/miden-multisig-client
+npm test -w @openzeppelin/miden-multisig-client
+npm run build -w @openzeppelin/guardian-operator-client
+npm test -w @openzeppelin/guardian-operator-client
 ```
 
 Then check that each publishable README still matches its shipped surface.
@@ -158,10 +155,11 @@ cargo publish --dry-run --locked \
 ```
 
 ```bash
-cd packages/guardian-client && npm publish --access public --dry-run
-cd packages/guardian-evm-client && npm publish --access public --dry-run
-cd packages/miden-multisig-client && npm publish --access public --dry-run
-cd packages/guardian-operator-client && npm publish --access public --dry-run
+cd packages
+npm publish -w @openzeppelin/guardian-client --access public --dry-run
+npm publish -w @openzeppelin/guardian-evm-client --access public --dry-run
+npm publish -w @openzeppelin/miden-multisig-client --access public --dry-run
+npm publish -w @openzeppelin/guardian-operator-client --access public --dry-run
 ```
 
 If a dry-run or test fails, stop there and report the failing step, package, and minimal next action.

.agents/skills/release-guardian-sdk-packages/references/release-surface.md

@@ -19,20 +19,21 @@ Current coordinated SDK release line: `0.16.x`
 
 ## Publishable TypeScript Packages
 
+TypeScript packages live in the `packages/` npm workspace with a single
+lockfile at `packages/package-lock.json`. `@openzeppelin/miden-multisig-client` depends
+on `@openzeppelin/guardian-client` via a version range; the workspace links the
+in-repo package for install/test/publish. Do not use the `workspace:` protocol.
+
 1. `@openzeppelin/guardian-client`
    - manifest: `packages/guardian-client/package.json`
-   - lockfile: `packages/guardian-client/package-lock.json`
 2. `@openzeppelin/guardian-evm-client`
    - manifest: `packages/guardian-evm-client/package.json`
-   - lockfile: `packages/guardian-evm-client/package-lock.json`
    - no internal release dependencies
 3. `@openzeppelin/miden-multisig-client`
    - manifest: `packages/miden-multisig-client/package.json`
-   - lockfile: `packages/miden-multisig-client/package-lock.json`
    - internal release dependency: `@openzeppelin/guardian-client`
 4. `@openzeppelin/guardian-operator-client`
    - manifest: `packages/guardian-operator-client/package.json`
-   - lockfile: `packages/guardian-operator-client/package-lock.json`
    - no internal release dependencies
 
 ## Files Usually Touched In A Coordinated Release
@@ -42,11 +43,10 @@ Current coordinated SDK release line: `0.16.x`
 - `crates/contracts/Cargo.toml`
 - `crates/miden-multisig-client/Cargo.toml`
 - `packages/guardian-client/package.json`
-- `packages/guardian-client/package-lock.json`
 - `packages/guardian-evm-client/package.json`
-- `packages/guardian-evm-client/package-lock.json`
 - `packages/miden-multisig-client/package.json`
-- `packages/miden-multisig-client/package-lock.json`
+- `packages/guardian-operator-client/package.json`
+- `packages/package-lock.json`
 - `docs/MULTISIG_SDK.md` if release examples or tag snippets need updating
 
 ## Rust Publication Automation
@@ -85,8 +85,10 @@ OIDC trusted publishing is the only publication authentication path.
 ## TypeScript Publish Sequence
 
 ```bash
-cd packages/guardian-client && npm publish --access public
-cd packages/guardian-evm-client && npm publish --access public
-cd packages/miden-multisig-client && npm publish --access public
-cd packages/guardian-operator-client && npm publish --access public
+cd packages
+npm ci
+npm publish -w @openzeppelin/guardian-client --access public
+npm publish -w @openzeppelin/guardian-evm-client --access public
+npm publish -w @openzeppelin/miden-multisig-client --access public
+npm publish -w @openzeppelin/guardian-operator-client --access public
 ```

.agents/skills/smoke-test-evm-proposal-support/SKILL.md

@@ -22,8 +22,13 @@ Run the focused checks before manual browser work:
 ```bash
 cargo test -p guardian-server
 cargo test -p guardian-server --features evm
-cd packages/guardian-evm-client && npm test && npm run build
-cd examples/evm-smoke-web && npm run typecheck && npm run build
+(
+  cd packages
+  npm ci
+  npm test -w @openzeppelin/guardian-evm-client
+  npm run build -w @openzeppelin/guardian-evm-client
+)
+(cd examples/evm-smoke-web && npm run typecheck && npm run build)
 ```
 
 Use `git diff -- packages/guardian-client crates/client crates/shared` when the user wants the EVM client isolated from the base clients. Those paths should stay unchanged unless a separate contract change requires them.
@@ -135,7 +140,7 @@ EVM_ENTRYPOINT_ADDRESS=0x433709009b8330fda32311df1c2afa402ed8d009 \
 node .agents/skills/smoke-test-evm-proposal-support/scripts/run-evm-client-smoke.mjs
 ```
 
-The script uses the workspace build output at `packages/guardian-evm-client/dist/index.js`, so run `npm run build` in that package first after TypeScript edits.
+The script uses the workspace build output at `packages/guardian-evm-client/dist/index.js`, so run `npm run build -w @openzeppelin/guardian-evm-client` from `packages/` first after TypeScript edits.
 
 ## Browser Smoke
 

.agents/skills/smoke-test-evm-proposal-support/scripts/run-evm-client-smoke.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { createRequire } from 'node:module';
 import path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
@@ -7,8 +8,9 @@ const skillDir = path.resolve(scriptDir, '..');
 const repoRoot = path.resolve(skillDir, '../../..');
 const evmClientPackage = path.join(repoRoot, 'packages/guardian-evm-client');
 const clientDist = path.join(evmClientPackage, 'dist/index.js');
-const viemEntry = path.join(evmClientPackage, 'node_modules/viem/_esm/index.js');
-const viemAccountsEntry = path.join(evmClientPackage, 'node_modules/viem/_esm/accounts/index.js');
+const workspaceRequire = createRequire(pathToFileURL(clientDist));
+const viemEntry = workspaceRequire.resolve('viem');
+const viemAccountsEntry = workspaceRequire.resolve('viem/accounts');
 
 const {
   GuardianEvmClient,

.agents/skills/smoke-test-operator-dashboard/SKILL.md

@@ -27,8 +27,14 @@ Use `examples/operator-smoke-web` as the primary smoke surface for operator auth
    - `docs/PRODUCTION.md`
 2. Run the focused checks:
    ```bash
-   cd packages/guardian-operator-client && npm run typecheck && npm test && npm run build
-   cd examples/operator-smoke-web && npm run typecheck && npm run build
+   (
+     cd packages
+     npm ci
+     npm run typecheck -w @openzeppelin/guardian-operator-client
+     npm test -w @openzeppelin/guardian-operator-client
+     npm run build -w @openzeppelin/guardian-operator-client
+   )
+   (cd examples/operator-smoke-web && npm run typecheck && npm run build)
    cargo test -p guardian-server api::dashboard::tests
    cargo test -p guardian-server dashboard::tests
    ```

.agents/skills/smoke-test-ts-multisig-sdk/SKILL.md

@@ -73,9 +73,14 @@ When reporting, capture the concrete tool invocation path used (Chrome MCP vs Cl
    - `examples/smoke-web/src/App.tsx`
 2. Run targeted TypeScript validation before manual smoke:
    ```bash
-   cd packages/miden-multisig-client && npm test
-   cd examples/smoke-web && npm run typecheck && npm run build
-   cd examples/web && npm run build
+   (
+     cd packages
+     npm ci
+     npm run build -w @openzeppelin/guardian-client
+     npm test -w @openzeppelin/miden-multisig-client
+   )
+   (cd examples/smoke-web && npm run typecheck && npm run build)
+   (cd examples/web && npm run build)
    ```
 3. Start one GUARDIAN server from the repo root:
    ```bash

.agents/skills/smoke-test-ts-multisig-sdk/references/workflow-matrix.md

@@ -9,9 +9,14 @@ Map the changed area to the smallest browser smoke workflow that still proves th
 Run validation first:
 
 ```bash
-cd packages/miden-multisig-client && npm test
-cd examples/smoke-web && npm run typecheck && npm run build
-cd examples/web && npm run build
+(
+  cd packages
+  npm ci
+  npm run build -w @openzeppelin/guardian-client
+  npm test -w @openzeppelin/miden-multisig-client
+)
+(cd examples/smoke-web && npm run typecheck && npm run build)
+(cd examples/web && npm run build)
 ```
 
 Primary smoke server commands:
@@ -453,4 +458,3 @@ Use when:
 - thrown auth/unauthenticated error (proof-of-possession metadata regression)
 - recovered `accountId` differs from `originalAccountId` (server-side index regression)
 - `verifyStateCommitment` mismatch after recover + load (state-fetch regression)
-