@interrupted/murk-secrets 0.10.2

package/README.md

@@ -0,0 +1,104 @@
+# @interrupted/murk-secrets
+
+[![npm](https://img.shields.io/npm/v/@interrupted/murk-secrets)](https://www.npmjs.com/package/@interrupted/murk-secrets)
+
+Node.js/TypeScript bindings for [murk](https://github.com/interrupted-inc/murk) — an encrypted secrets manager for developers.
+
+## Prerequisites
+
+You need the [murk CLI](https://github.com/interrupted-inc/murk) to create and manage vaults. This package only reads them.
+
+```bash
+# Install the CLI first
+brew tap interrupted-inc/murk && brew install murk
+
+# Initialize a vault and add secrets
+murk init
+murk add DATABASE_URL
+murk add API_KEY
+```
+
+Then add the Node package to your project:
+
+```bash
+npm install @interrupted/murk-secrets
+```
+
+## Quick start
+
+```bash
+# Load your key (created by murk init)
+source .env
+```
+
+```typescript
+import { load, get, exportAll } from '@interrupted/murk-secrets'
+
+// Load the vault (reads MURK_KEY from environment)
+const vault = load()
+
+// Get a single secret
+const dbUrl = vault.get('DATABASE_URL')
+
+// Get all secrets as an object
+const secrets = vault.export()
+
+// One-liners
+get('DATABASE_URL')
+exportAll()
+```
+
+## API
+
+### `load(vaultPath?: string): Vault`
+
+Load and decrypt a murk vault. Reads `MURK_KEY` or `MURK_KEY_FILE` from the environment.
+
+### `get(key: string, vaultPath?: string): string | null`
+
+One-liner: load the vault and get a single value.
+
+### `exportAll(vaultPath?: string): Record<string, string>`
+
+One-liner: load the vault and export all secrets as an object.
+
+### `hasIdentity(): boolean`
+
+Whether a decryption identity (`MURK_KEY` / `MURK_KEY_FILE`) is available — i.e. whether `load()` can decrypt. This is not a check for whether a secret exists; use `vault.has(key)` / `vault.keys()` for that.
+
+### `Vault`
+
+| Method | Returns | Description |
+|--------|---------|-------------|
+| `vault.get(key)` | `string \| null` | Get a single decrypted value |
+| `vault.export()` | `Record<string, string>` | All secrets as an object |
+| `vault.keys()` | `string[]` | List of key names |
+| `vault.has(key)` | `boolean` | Check if a key exists |
+| `vault.length` | `number` | Number of secrets |
+
+Scoped (per-user) overrides are applied automatically — if you have a scoped value for a key, it takes priority over the shared value.
+
+## Memory hygiene
+
+Every decrypted value murk returns is a plain host-language string. murk zeroes plaintext
+from its own memory when a value is dropped, but that guarantee ends at the FFI
+boundary: once a value crosses into JavaScript the runtime owns it, and its
+garbage collector — not murk — controls its lifetime. This is inherent to
+reading secrets into a process (see the
+[threat model](https://github.com/interrupted-inc/murk/blob/main/THREAT_MODEL.md)); avoid
+holding decrypted values longer than you need them.
+
+## Agent policy
+
+When the loaded key is an agent grant (minted with `murk agent grant`), the vault's agent policy is enforced on read, the same way the CLI enforces it at `murk agent exec`: `get()` and `export()` throw if the policy forbids a key. Operator keys are unaffected. This makes a policy vault strict from every entry point — though an agent already cannot decrypt out-of-scope secrets at all, since its ephemeral key is not a recipient of them.
+
+## Requirements
+
+- Node.js >= 16
+- [murk CLI](https://github.com/interrupted-inc/murk) installed (to create and manage vaults)
+- A `.murk` vault file in your project (created with `murk init`)
+- `MURK_KEY` or `MURK_KEY_FILE` in the environment (created by `murk init`, loaded via `source .env`)
+
+## License
+
+MIT OR Apache-2.0

package/index.d.ts

@@ -0,0 +1,55 @@
+/* auto-generated by NAPI-RS */
+/* eslint-disable */
+/** A loaded and decrypted murk vault. */
+export declare class Vault {
+  /**
+   * Get a single decrypted secret value. Resolution order: a personal scoped
+   * override, then a named-group value we can read, then the shared value.
+   *
+   * Internally, vault state stores values in `Zeroizing<String>` so plaintext
+   * is wiped from memory when dropped. Crossing the napi boundary into a
+   * JavaScript `String` requires copying the plaintext into a regular Rust
+   * `String`; the V8 garbage collector owns it from there and zeroize cannot
+   * follow. This is a known leak in the JS bindings — see THREAT_MODEL.md.
+   *
+   * When the loaded identity is a granted agent, the vault's agent policy is
+   * enforced before the value is returned — the same gate the CLI applies at
+   * `agent exec`. Throws if policy forbids the key. For an operator identity
+   * this is a no-op.
+   */
+  get(key: string): string | null
+  /**
+   * Export all secrets as an object. Scoped values override shared values.
+   *
+   * See `get` for the zeroize caveat — the returned `HashMap` holds plain
+   * `String` plaintext, not `Zeroizing<String>`.
+   *
+   * For a granted agent, the vault's agent policy is enforced over the full
+   * key set first (mirroring `murk agent exec`): if any resolvable key is
+   * outside the policy, the whole export throws rather than returning a
+   * partial object. For an operator identity this is a no-op.
+   */
+  export(): Record<string, string>
+  /** List all key names. */
+  keys(): Array<string>
+  /** Number of secrets in the vault. */
+  get length(): number
+  /** Check if a key exists. */
+  has(key: string): boolean
+}
+
+/** One-liner: load the vault and export all secrets as an object. */
+export declare function exportAll(vaultPath?: string | undefined | null): Record<string, string>
+
+/** One-liner: load the vault and get a single key. */
+export declare function get(key: string, vaultPath?: string | undefined | null): string | null
+
+/**
+ * Whether a decryption identity (`MURK_KEY` / `MURK_KEY_FILE`) is available in
+ * the environment — i.e. whether `load` can decrypt. This does not check
+ * whether a secret exists; use `Vault.has` / `Vault.keys` for that.
+ */
+export declare function hasIdentity(): boolean
+
+/** Load a murk vault. Reads MURK_KEY from the environment. */
+export declare function load(vaultPath?: string | undefined | null): Vault

package/index.js

@@ -0,0 +1,583 @@
+// prettier-ignore
+/* eslint-disable */
+// @ts-nocheck
+/* auto-generated by NAPI-RS */
+
+const { readFileSync } = require('node:fs')
+let nativeBinding = null
+const loadErrors = []
+
+const isMusl = () => {
+  let musl = false
+  if (process.platform === 'linux') {
+    musl = isMuslFromFilesystem()
+    if (musl === null) {
+      musl = isMuslFromReport()
+    }
+    if (musl === null) {
+      musl = isMuslFromChildProcess()
+    }
+  }
+  return musl
+}
+
+const isFileMusl = (f) => f.includes('libc.musl-') || f.includes('ld-musl-')
+
+const isMuslFromFilesystem = () => {
+  try {
+    return readFileSync('/usr/bin/ldd', 'utf-8').includes('musl')
+  } catch {
+    return null
+  }
+}
+
+const isMuslFromReport = () => {
+  let report = null
+  if (typeof process.report?.getReport === 'function') {
+    process.report.excludeNetwork = true
+    report = process.report.getReport()
+  }
+  if (!report) {
+    return null
+  }
+  if (report.header && report.header.glibcVersionRuntime) {
+    return false
+  }
+  if (Array.isArray(report.sharedObjects)) {
+    if (report.sharedObjects.some(isFileMusl)) {
+      return true
+    }
+  }
+  return false
+}
+
+const isMuslFromChildProcess = () => {
+  try {
+    return require('child_process').execSync('ldd --version', { encoding: 'utf8' }).includes('musl')
+  } catch (e) {
+    // If we reach this case, we don't know if the system is musl or not, so is better to just fallback to false
+    return false
+  }
+}
+
+function requireNative() {
+  if (process.env.NAPI_RS_NATIVE_LIBRARY_PATH) {
+    try {
+      return require(process.env.NAPI_RS_NATIVE_LIBRARY_PATH);
+    } catch (err) {
+      loadErrors.push(err)
+    }
+  } else if (process.platform === 'android') {
+    if (process.arch === 'arm64') {
+      try {
+        return require('./murk-secrets.android-arm64.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@interrupted/murk-secrets-android-arm64')
+        const bindingPackageVersion = require('@interrupted/murk-secrets-android-arm64/package.json').version
+        if (bindingPackageVersion !== '0.9.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.9.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 'arm') {
+      try {
+        return require('./murk-secrets.android-arm-eabi.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@interrupted/murk-secrets-android-arm-eabi')
+        const bindingPackageVersion = require('@interrupted/murk-secrets-android-arm-eabi/package.json').version
+        if (bindingPackageVersion !== '0.9.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.9.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else {
+      loadErrors.push(new Error(`Unsupported architecture on Android ${process.arch}`))
+    }
+  } else if (process.platform === 'win32') {
+    if (process.arch === 'x64') {
+      if (process.config?.variables?.shlib_suffix === 'dll.a' || process.config?.variables?.node_target_type === 'shared_library') {
+        try {
+        return require('./murk-secrets.win32-x64-gnu.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@interrupted/murk-secrets-win32-x64-gnu')
+        const bindingPackageVersion = require('@interrupted/murk-secrets-win32-x64-gnu/package.json').version
+        if (bindingPackageVersion !== '0.9.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.9.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      } else {
+        try {
+        return require('./murk-secrets.win32-x64-msvc.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@interrupted/murk-secrets-win32-x64-msvc')
+        const bindingPackageVersion = require('@interrupted/murk-secrets-win32-x64-msvc/package.json').version
+        if (bindingPackageVersion !== '0.9.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.9.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      }
+    } else if (process.arch === 'ia32') {
+      try {
+        return require('./murk-secrets.win32-ia32-msvc.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@interrupted/murk-secrets-win32-ia32-msvc')
+        const bindingPackageVersion = require('@interrupted/murk-secrets-win32-ia32-msvc/package.json').version
+        if (bindingPackageVersion !== '0.9.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.9.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 'arm64') {
+      try {
+        return require('./murk-secrets.win32-arm64-msvc.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@interrupted/murk-secrets-win32-arm64-msvc')
+        const bindingPackageVersion = require('@interrupted/murk-secrets-win32-arm64-msvc/package.json').version
+        if (bindingPackageVersion !== '0.9.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.9.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else {
+      loadErrors.push(new Error(`Unsupported architecture on Windows: ${process.arch}`))
+    }
+  } else if (process.platform === 'darwin') {
+    try {
+      return require('./murk-secrets.darwin-universal.node')
+    } catch (e) {
+      loadErrors.push(e)
+    }
+    try {
+      const binding = require('@interrupted/murk-secrets-darwin-universal')
+      const bindingPackageVersion = require('@interrupted/murk-secrets-darwin-universal/package.json').version
+      if (bindingPackageVersion !== '0.9.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+        throw new Error(`Native binding package version mismatch, expected 0.9.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+      }
+      return binding
+    } catch (e) {
+      loadErrors.push(e)
+    }
+    if (process.arch === 'x64') {
+      try {
+        return require('./murk-secrets.darwin-x64.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@interrupted/murk-secrets-darwin-x64')
+        const bindingPackageVersion = require('@interrupted/murk-secrets-darwin-x64/package.json').version
+        if (bindingPackageVersion !== '0.9.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.9.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 'arm64') {
+      try {
+        return require('./murk-secrets.darwin-arm64.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@interrupted/murk-secrets-darwin-arm64')
+        const bindingPackageVersion = require('@interrupted/murk-secrets-darwin-arm64/package.json').version
+        if (bindingPackageVersion !== '0.9.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.9.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else {
+      loadErrors.push(new Error(`Unsupported architecture on macOS: ${process.arch}`))
+    }
+  } else if (process.platform === 'freebsd') {
+    if (process.arch === 'x64') {
+      try {
+        return require('./murk-secrets.freebsd-x64.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@interrupted/murk-secrets-freebsd-x64')
+        const bindingPackageVersion = require('@interrupted/murk-secrets-freebsd-x64/package.json').version
+        if (bindingPackageVersion !== '0.9.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.9.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 'arm64') {
+      try {
+        return require('./murk-secrets.freebsd-arm64.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@interrupted/murk-secrets-freebsd-arm64')
+        const bindingPackageVersion = require('@interrupted/murk-secrets-freebsd-arm64/package.json').version
+        if (bindingPackageVersion !== '0.9.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.9.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else {
+      loadErrors.push(new Error(`Unsupported architecture on FreeBSD: ${process.arch}`))
+    }
+  } else if (process.platform === 'linux') {
+    if (process.arch === 'x64') {
+      if (isMusl()) {
+        try {
+          return require('./murk-secrets.linux-x64-musl.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('@interrupted/murk-secrets-linux-x64-musl')
+          const bindingPackageVersion = require('@interrupted/murk-secrets-linux-x64-musl/package.json').version
+          if (bindingPackageVersion !== '0.9.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.9.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      } else {
+        try {
+          return require('./murk-secrets.linux-x64-gnu.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('@interrupted/murk-secrets-linux-x64-gnu')
+          const bindingPackageVersion = require('@interrupted/murk-secrets-linux-x64-gnu/package.json').version
+          if (bindingPackageVersion !== '0.9.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.9.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      }
+    } else if (process.arch === 'arm64') {
+      if (isMusl()) {
+        try {
+          return require('./murk-secrets.linux-arm64-musl.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('@interrupted/murk-secrets-linux-arm64-musl')
+          const bindingPackageVersion = require('@interrupted/murk-secrets-linux-arm64-musl/package.json').version
+          if (bindingPackageVersion !== '0.9.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.9.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      } else {
+        try {
+          return require('./murk-secrets.linux-arm64-gnu.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('@interrupted/murk-secrets-linux-arm64-gnu')
+          const bindingPackageVersion = require('@interrupted/murk-secrets-linux-arm64-gnu/package.json').version
+          if (bindingPackageVersion !== '0.9.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.9.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      }
+    } else if (process.arch === 'arm') {
+      if (isMusl()) {
+        try {
+          return require('./murk-secrets.linux-arm-musleabihf.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('@interrupted/murk-secrets-linux-arm-musleabihf')
+          const bindingPackageVersion = require('@interrupted/murk-secrets-linux-arm-musleabihf/package.json').version
+          if (bindingPackageVersion !== '0.9.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.9.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      } else {
+        try {
+          return require('./murk-secrets.linux-arm-gnueabihf.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('@interrupted/murk-secrets-linux-arm-gnueabihf')
+          const bindingPackageVersion = require('@interrupted/murk-secrets-linux-arm-gnueabihf/package.json').version
+          if (bindingPackageVersion !== '0.9.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.9.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      }
+    } else if (process.arch === 'loong64') {
+      if (isMusl()) {
+        try {
+          return require('./murk-secrets.linux-loong64-musl.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('@interrupted/murk-secrets-linux-loong64-musl')
+          const bindingPackageVersion = require('@interrupted/murk-secrets-linux-loong64-musl/package.json').version
+          if (bindingPackageVersion !== '0.9.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.9.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      } else {
+        try {
+          return require('./murk-secrets.linux-loong64-gnu.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('@interrupted/murk-secrets-linux-loong64-gnu')
+          const bindingPackageVersion = require('@interrupted/murk-secrets-linux-loong64-gnu/package.json').version
+          if (bindingPackageVersion !== '0.9.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.9.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      }
+    } else if (process.arch === 'riscv64') {
+      if (isMusl()) {
+        try {
+          return require('./murk-secrets.linux-riscv64-musl.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('@interrupted/murk-secrets-linux-riscv64-musl')
+          const bindingPackageVersion = require('@interrupted/murk-secrets-linux-riscv64-musl/package.json').version
+          if (bindingPackageVersion !== '0.9.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.9.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      } else {
+        try {
+          return require('./murk-secrets.linux-riscv64-gnu.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('@interrupted/murk-secrets-linux-riscv64-gnu')
+          const bindingPackageVersion = require('@interrupted/murk-secrets-linux-riscv64-gnu/package.json').version
+          if (bindingPackageVersion !== '0.9.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.9.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      }
+    } else if (process.arch === 'ppc64') {
+      try {
+        return require('./murk-secrets.linux-ppc64-gnu.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@interrupted/murk-secrets-linux-ppc64-gnu')
+        const bindingPackageVersion = require('@interrupted/murk-secrets-linux-ppc64-gnu/package.json').version
+        if (bindingPackageVersion !== '0.9.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.9.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 's390x') {
+      try {
+        return require('./murk-secrets.linux-s390x-gnu.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@interrupted/murk-secrets-linux-s390x-gnu')
+        const bindingPackageVersion = require('@interrupted/murk-secrets-linux-s390x-gnu/package.json').version
+        if (bindingPackageVersion !== '0.9.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.9.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else {
+      loadErrors.push(new Error(`Unsupported architecture on Linux: ${process.arch}`))
+    }
+  } else if (process.platform === 'openharmony') {
+    if (process.arch === 'arm64') {
+      try {
+        return require('./murk-secrets.openharmony-arm64.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@interrupted/murk-secrets-openharmony-arm64')
+        const bindingPackageVersion = require('@interrupted/murk-secrets-openharmony-arm64/package.json').version
+        if (bindingPackageVersion !== '0.9.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.9.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 'x64') {
+      try {
+        return require('./murk-secrets.openharmony-x64.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@interrupted/murk-secrets-openharmony-x64')
+        const bindingPackageVersion = require('@interrupted/murk-secrets-openharmony-x64/package.json').version
+        if (bindingPackageVersion !== '0.9.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.9.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 'arm') {
+      try {
+        return require('./murk-secrets.openharmony-arm.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@interrupted/murk-secrets-openharmony-arm')
+        const bindingPackageVersion = require('@interrupted/murk-secrets-openharmony-arm/package.json').version
+        if (bindingPackageVersion !== '0.9.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.9.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else {
+      loadErrors.push(new Error(`Unsupported architecture on OpenHarmony: ${process.arch}`))
+    }
+  } else {
+    loadErrors.push(new Error(`Unsupported OS: ${process.platform}, architecture: ${process.arch}`))
+  }
+}
+
+nativeBinding = requireNative()
+
+if (!nativeBinding || process.env.NAPI_RS_FORCE_WASI) {
+  let wasiBinding = null
+  let wasiBindingError = null
+  try {
+    wasiBinding = require('./murk-secrets.wasi.cjs')
+    nativeBinding = wasiBinding
+  } catch (err) {
+    if (process.env.NAPI_RS_FORCE_WASI) {
+      wasiBindingError = err
+    }
+  }
+  if (!nativeBinding || process.env.NAPI_RS_FORCE_WASI) {
+    try {
+      wasiBinding = require('@interrupted/murk-secrets-wasm32-wasi')
+      nativeBinding = wasiBinding
+    } catch (err) {
+      if (process.env.NAPI_RS_FORCE_WASI) {
+        if (!wasiBindingError) {
+          wasiBindingError = err
+        } else {
+          wasiBindingError.cause = err
+        }
+        loadErrors.push(err)
+      }
+    }
+  }
+  if (process.env.NAPI_RS_FORCE_WASI === 'error' && !wasiBinding) {
+    const error = new Error('WASI binding not found and NAPI_RS_FORCE_WASI is set to error')
+    error.cause = wasiBindingError
+    throw error
+  }
+}
+
+if (!nativeBinding) {
+  if (loadErrors.length > 0) {
+    throw new Error(
+      `Cannot find native binding. ` +
+        `npm has a bug related to optional dependencies (https://github.com/npm/cli/issues/4828). ` +
+        'Please try `npm i` again after removing both package-lock.json and node_modules directory.',
+      {
+        cause: loadErrors.reduce((err, cur) => {
+          cur.cause = err
+          return cur
+        }),
+      },
+    )
+  }
+  throw new Error(`Failed to load native binding`)
+}
+
+module.exports = nativeBinding
+module.exports.Vault = nativeBinding.Vault
+module.exports.exportAll = nativeBinding.exportAll
+module.exports.get = nativeBinding.get
+module.exports.hasIdentity = nativeBinding.hasIdentity
+module.exports.load = nativeBinding.load

package/package.json

@@ -0,0 +1,59 @@
+{
+  "name": "@interrupted/murk-secrets",
+  "version": "0.10.2",
+  "description": "Node.js/TypeScript bindings for murk — encrypted secrets manager",
+  "main": "index.js",
+  "types": "index.d.ts",
+  "license": "MIT OR Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/interrupted-inc/murk"
+  },
+  "keywords": [
+    "secrets",
+    "encryption",
+    "age",
+    "dotenv",
+    "security",
+    "murk"
+  ],
+  "napi": {
+    "binaryName": "murk-secrets",
+    "targets": [
+      "x86_64-apple-darwin",
+      "aarch64-apple-darwin",
+      "x86_64-unknown-linux-gnu",
+      "x86_64-unknown-linux-musl",
+      "aarch64-unknown-linux-gnu",
+      "aarch64-unknown-linux-musl",
+      "x86_64-pc-windows-msvc"
+    ]
+  },
+  "scripts": {
+    "artifacts": "napi artifacts",
+    "build": "napi build --platform --release",
+    "test": "node __test__/index.test.mjs",
+    "lint": "biome check",
+    "format": "biome check --write"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "^2.4.9",
+    "@napi-rs/cli": "^3"
+  },
+  "engines": {
+    "node": ">= 16"
+  },
+  "files": [
+    "index.js",
+    "index.d.ts"
+  ],
+  "optionalDependencies": {
+    "@interrupted/murk-secrets-darwin-x64": "0.10.2",
+    "@interrupted/murk-secrets-darwin-arm64": "0.10.2",
+    "@interrupted/murk-secrets-linux-x64-gnu": "0.10.2",
+    "@interrupted/murk-secrets-linux-x64-musl": "0.10.2",
+    "@interrupted/murk-secrets-linux-arm64-gnu": "0.10.2",
+    "@interrupted/murk-secrets-linux-arm64-musl": "0.10.2",
+    "@interrupted/murk-secrets-win32-x64-msvc": "0.10.2"
+  }
+}