@interrupted/murk-secrets 0.13.0 → 0.14.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/README.md +33 -17
  2. package/index.d.ts +42 -15
  3. package/index.js +309 -107
  4. package/package.json +9 -9
package/README.md CHANGED
@@ -2,6 +2,8 @@
2
2
 
3
3
  [![npm](https://img.shields.io/npm/v/@interrupted/murk-secrets)](https://www.npmjs.com/package/@interrupted/murk-secrets)
4
4
 
5
+ > **Experimental writes.** Reading secrets (`load`, `get`, `exportAll`) is stable. Writing (`add`, `describe`) is experimental: the write API is new and may change. See [Feature status](https://murk.interrupted.sh/reference/feature-status/).
6
+
5
7
  Node.js/TypeScript bindings for [murk](https://github.com/interrupted-sh/murk) — an encrypted secrets manager for developers.
6
8
 
7
9
  ## Prerequisites
@@ -27,14 +29,15 @@ npm install @interrupted/murk-secrets
27
29
  ## Quick start
28
30
 
29
31
  ```bash
30
- # Load your key (created by murk init)
32
+ # Optional on the machine that ran murk init (see "Key lookup").
33
+ # POSIX shell syntax.
31
34
  source .env
32
35
  ```
33
36
 
34
37
  ```typescript
35
- import { load, get, exportAll } from '@interrupted/murk-secrets'
38
+ import { load, get, exportAll, add } from '@interrupted/murk-secrets'
36
39
 
37
- // Load the vault (reads MURK_KEY from environment)
40
+ // Load the vault (finds your key; see "Key lookup")
38
41
  const vault = load()
39
42
 
40
43
  // Get a single secret
@@ -58,7 +61,7 @@ add('NEW_TOKEN', 'value') // one-liner
58
61
 
59
62
  ### `load(vaultPath?: string): Vault`
60
63
 
61
- Load and decrypt a murk vault. Reads `MURK_KEY` or `MURK_KEY_FILE` from the environment.
64
+ Load and decrypt a murk vault. Finds your key as described in [Key lookup](#key-lookup).
62
65
 
63
66
  ### `get(key: string, vaultPath?: string): string | null`
64
67
 
@@ -74,31 +77,36 @@ One-liner: load the vault and store a secret. See `vault.add` below.
74
77
 
75
78
  ### `hasIdentity(): boolean`
76
79
 
77
- Whether a decryption identity (`MURK_KEY` / `MURK_KEY_FILE`) is available — i.e. whether `load()` can decrypt. This is not a check for whether a secret exists; use `vault.has(key)` / `vault.keys()` for that.
80
+ Returns `true` if murk can find a key for `./.murk`: `MURK_KEY`, `MURK_KEY_FILE` or the key file `murk init` stored. Returns `false` if no key is found, if both variables are set, or if the key file cannot be read. It does not read the vault, so `true` does not guarantee that `load()` succeeds. It does not check whether a secret exists. Use `vault.has(key)` or `vault.keys()` for that.
78
81
 
79
82
  ### `Vault`
80
83
 
81
84
  | Method | Returns | Description |
82
85
  |--------|---------|-------------|
83
- | `vault.get(key)` | `string \| null` | Get a single decrypted value |
86
+ | `vault.get(key)` | `string \| null` | Decrypted value, or `null` if no value is readable for the key |
84
87
  | `vault.export()` | `Record<string, string>` | All secrets as an object |
85
- | `vault.keys()` | `string[]` | List of key names |
86
- | `vault.has(key)` | `boolean` | Check if a key exists |
87
- | `vault.length` | `number` | Number of secrets |
88
+ | `vault.keys()` | `string[]` | Key names in the vault schema, including keys you cannot read |
89
+ | `vault.has(key)` | `boolean` | `true` if the key is in the schema, even if you cannot read its value |
90
+ | `vault.length` | `number` | Number of keys in the schema |
88
91
  | `vault.add(key, value, options?)` | `void` | Store a secret (see below) |
89
92
  | `vault.describe(key, description, options?)` | `void` | Set a key's description/tags/example |
93
+ | `vault.warnings` | `string[]` | Warnings about an accepted vault, the ones the CLI prints as `warn …` (empty for a clean load) |
90
94
 
91
95
  Scoped (per-user) overrides are applied automatically — if you have a scoped value for a key, it takes priority over the shared value.
92
96
 
97
+ ### Trust
98
+
99
+ Every call that reads the vault (`load`, `get`, `exportAll`, `add`, `vault.add`, `vault.describe`) applies the same trust check as the CLI. A vault this machine does not trust — unsigned when your key could have signed it, signed by a key this machine hasn't accepted, rolled back, or tampered with — throws an `Error` whose `code` is `'MURK_TRUST'`, with the CLI's message. Nothing in the binding skips the check. Run `murk trust` once from a shell to accept a vault, or set `MURK_TRUSTED_SIGNERS` in CI. An agent grant key reads only through the trusted signers in its key file or `MURK_TRUSTED_SIGNERS`.
100
+
93
101
  ### Writing secrets
94
102
 
95
- `vault.add(key, value, options?)` mirrors `murk add`: it encrypts the value, re-signs the vault, and writes it back to disk under an exclusive lock (safe against concurrent writers). An existing key is overwritten in place. Options:
103
+ `vault.add(key, value, options?)` mirrors `murk add`: it encrypts the value, re-signs the vault, and writes it back to disk under an exclusive lock (safe against concurrent writers). An `everyone` or group write replaces the key's base value. A group write removes the shared value, and a shared write removes the group assignment. A `me` write leaves the shared value alone. `tags` are added to the key's existing tags. Options:
96
104
 
97
- - `tier` — where the value lives: `'everyone'` (default, shared to all recipients), `'me'` (a personal value encrypted to you only), or a **group name** (encrypted to that group's members; you must be a member).
105
+ - `tier` — where the value lives: `'everyone'` (encrypted to every recipient except agent grants), `'me'` (a personal value encrypted to you only), or a **group name** (encrypted to that group's members; you must be a member). Omit it to keep an existing key in its tier (a new key is shared). A key held by a group you are not a member of can't be updated, except with `'me'`, and a key holding only other recipients' overrides needs an explicit `tier`.
98
106
  - `desc` — a human-readable description recorded in the schema.
99
107
  - `tags` — tags recorded on the key; tags are the unit the agent allow-tag policy gates on.
100
108
 
101
- `vault.describe(key, description, options?)` updates a key's schema metadata (`tags`, `example`) without touching its value. A key with no value becomes a documented-but-unset entry, the same as `murk describe`.
109
+ `vault.describe(key, description, options?)` works like `murk describe`, without `--rotate-every` and `--expires`. It never touches the value and always replaces the description. `options.tags` replaces the existing tags when it is non-empty. Leaving out `options.example` clears the current example. If the key does not exist yet, `describe` creates a documented entry with no value.
102
110
 
103
111
  Trust-changing operations — rotation, adding/removing recipients or group members, and minting agent grants — are deliberately **not** exposed here; use the CLI for those.
104
112
 
@@ -121,14 +129,22 @@ the value as late as possible, pass it straight into `add`, and don't keep it ar
121
129
 
122
130
  ## Agent policy
123
131
 
124
- When the loaded key is an agent grant (minted with `murk agent grant`), the vault's agent policy is enforced on read, the same way the CLI enforces it at `murk agent exec`: `get()` and `export()` throw if the policy forbids a key. Operator keys are unaffected. This makes a policy vault strict from every entry point — though an agent already cannot decrypt out-of-scope secrets at all, since its ephemeral key is not a recipient of them.
132
+ If the loaded key is an agent grant (from `murk agent grant`), the bindings enforce the vault's agent policy on reads, as `murk agent exec` does. `get()` and `export()` throw when the policy forbids a key they can read. A grant key can't write at all: `add()` and `describe()` throw `agent grants are read-only` and leave the vault unchanged, whatever the policy says. For an operator key under `MURK_SELF_SCOPE` or `MURK_AGENT`, they check the resulting key against the policy before saving and throw without changing the vault. Once the grant's TTL has passed, `export()` and `get()` of a readable key throw too. `keys()`, `has()` and `length` read only the schema and never check the policy. A plain operator key skips the check unless `MURK_SELF_SCOPE` or `MURK_AGENT` is set. A grant also cannot decrypt out-of-scope secrets, because its key is not a recipient of them, so the policy check is a second guard.
133
+
134
+ `get()` and `export()` use the values and policy from the vault's last load. Policy changes and revocations reach them only after you call `load()` again or write through the handle. `add()` and `describe()` reload the vault from disk first, so they always check the current policy, and they refresh the handle afterwards. Grant expiry is checked again on each value read.
135
+
136
+ ## Key lookup
137
+
138
+ `load()` finds your key the same way the CLI does:
139
+
140
+ 1. `MURK_KEY` (your age secret key) or `MURK_KEY_FILE` (the path to a key file). Set one, not both. murk refuses to load when both are set.
141
+ 2. The key file that `murk init` stored under `~/.config/murk/keys/`.
142
+
143
+ `murk init` also writes a `.env` that points `MURK_KEY_FILE` at that file. On the machine where you ran `murk init`, you do not need to source it. Set the variable yourself in CI, in containers and whenever `MURK_STRICT` or `MURK_AGENT` is set, because both turn off step 2.
125
144
 
126
145
  ## Requirements
127
146
 
128
- - Node.js >= 16
129
- - [murk CLI](https://github.com/interrupted-sh/murk) installed (to create and manage vaults)
130
- - A `.murk` vault file in your project (created with `murk init`)
131
- - `MURK_KEY` or `MURK_KEY_FILE` in the environment (created by `murk init`, loaded via `source .env`)
147
+ Node.js 18.17 or later on Node 18, or 20.3 or later (not Node 19), the murk CLI, a `.murk` vault in your project and a key (see [Key lookup](#key-lookup)). The addon needs Node-API version 9.
132
148
 
133
149
  ## License
134
150
 
package/index.d.ts CHANGED
@@ -1,5 +1,14 @@
1
1
  /* auto-generated by NAPI-RS */
2
2
  /* eslint-disable */
3
+
4
+ /**
5
+ * Which binding artifact the generated loader actually loaded: `'native'` for
6
+ * a native addon, otherwise the `platformArchABI` of the WASI flavor. Every
7
+ * flavor napi-rs can build is listed, because `NAPI_RS_NATIVE_LIBRARY_PATH`
8
+ * can point the loader at a WASI artifact this package does not build itself.
9
+ */
10
+ export declare const __napiBindingTarget: 'native' | 'wasm32-wasi' | 'wasm32-wasip1'
11
+
3
12
  /** A loaded and decrypted murk vault. */
4
13
  export declare class Vault {
5
14
  /**
@@ -36,15 +45,26 @@ export declare class Vault {
36
45
  get length(): number
37
46
  /** Check if a key exists. */
38
47
  has(key: string): boolean
48
+ /**
49
+ * Warnings about this vault that did not stop the load — the ones the
50
+ * CLI prints as `warn …` (an unsigned vault read by a key that cannot
51
+ * sign, a legacy MAC, a trust pin that could not be written).
52
+ */
53
+ get warnings(): Array<string>
39
54
  /**
40
55
  * Store a secret. Mirrors `murk add`: the value is encrypted to the tier's
41
56
  * recipients and the vault is re-signed and written back to disk under an
42
57
  * exclusive lock, so it is safe against concurrent writers.
43
58
  *
44
- * `tier` selects the destination — `"everyone"` (default, shared to all
45
- * recipients), `"me"` (a personal value encrypted to the caller only), or a
46
- * group name (encrypted to that group's members; the caller must be a
47
- * member). An existing key is overwritten in place.
59
+ * `tier` selects the destination — `"everyone"` (shared to all recipients),
60
+ * `"me"` (a personal value encrypted to the caller only), or a group name
61
+ * (encrypted to that group's members; the caller must be a member). Giving
62
+ * a tier moves an existing key there. Without one, an existing key keeps its
63
+ * tier: a group value stays in its group and a personal override stays the
64
+ * caller's own. Only a new key defaults to `"everyone"`. A key held by a
65
+ * group the caller is not a member of can't be written (except as a `"me"`
66
+ * override), and a key holding only other recipients' overrides needs an
67
+ * explicit tier: otherwise the call throws.
48
68
  *
49
69
  * PLAINTEXT CAVEAT: unlike the read path — where plaintext only ever appears
50
70
  * *after* decryption — a write means the caller already holds the secret as a
@@ -52,11 +72,11 @@ export declare class Vault {
52
72
  * copied across the napi boundary into a Rust `String`, and is not zeroized on
53
73
  * either side. See `get` and THREAT_MODEL.md.
54
74
  *
55
- * Agent policy is enforced exactly as on the read path: if the loaded
56
- * identity is a granted agent (or the operator has opted into self-scope),
57
- * the resulting key must satisfy the vault's agent allow-tag policy and the
58
- * grant must be unexpired — otherwise the write throws and nothing is saved.
59
- * For a plain operator identity this is a no-op.
75
+ * An agent grant can't write: the call throws "agent grants are read-only"
76
+ * and nothing is saved. When the operator has opted into self-scope, the
77
+ * resulting key must satisfy the vault's agent allow-tag policy, otherwise
78
+ * the write throws and nothing is saved. For a plain operator identity
79
+ * the policy check is a no-op.
60
80
  */
61
81
  add(key: string, value: string, options?: AddOptions | undefined | null): void
62
82
  /**
@@ -74,10 +94,13 @@ export declare function add(key: string, value: string, options?: AddOptions | u
74
94
 
75
95
  /**
76
96
  * Options for [`Vault::add`]. All fields are optional; an omitted `tier`
77
- * defaults to `everyone` (the shared value).
97
+ * keeps an existing key in its tier and makes a new key shared (`everyone`).
78
98
  */
79
99
  export interface AddOptions {
80
- /** `"everyone"` (default), `"me"` (personal scoped), or a group name. */
100
+ /**
101
+ * `"everyone"`, `"me"` (personal scoped), or a group name. Omit it to keep
102
+ * an existing key where it is; a new key is then shared (`everyone`).
103
+ */
81
104
  tier?: string
82
105
  /** Human-readable description recorded in the vault schema. */
83
106
  desc?: string
@@ -100,11 +123,15 @@ export declare function exportAll(vaultPath?: string | undefined | null): Record
100
123
  export declare function get(key: string, vaultPath?: string | undefined | null): string | null
101
124
 
102
125
  /**
103
- * Whether a decryption identity (`MURK_KEY` / `MURK_KEY_FILE`) is available in
104
- * the environment — i.e. whether `load` can decrypt. This does not check
105
- * whether a secret exists; use `Vault.has` / `Vault.keys` for that.
126
+ * Whether murk can find a key for `./.murk`: `MURK_KEY`, `MURK_KEY_FILE` or
127
+ * the key file `murk init` stored. This does not read the vault, so `true`
128
+ * does not mean `load` succeeds. It does not check whether a secret exists;
129
+ * use `Vault.has` / `Vault.keys` for that.
106
130
  */
107
131
  export declare function hasIdentity(): boolean
108
132
 
109
- /** Load a murk vault. Reads MURK_KEY from the environment. */
133
+ /**
134
+ * Load a murk vault. Finds the key the same way the CLI does: `MURK_KEY`,
135
+ * `MURK_KEY_FILE`, or the key file `murk init` stored.
136
+ */
110
137
  export declare function load(vaultPath?: string | undefined | null): Vault
package/index.js CHANGED
@@ -1,10 +1,13 @@
1
- // prettier-ignore
2
1
  /* eslint-disable */
3
2
  // @ts-nocheck
4
3
  /* auto-generated by NAPI-RS */
5
4
 
6
- const { readFileSync } = require('node:fs')
5
+ const { readFileSync } = require('fs')
7
6
  let nativeBinding = null
7
+ // Which artifact actually loaded. The WASI fallback chain overwrites it with
8
+ // the flavor it resolved; the late native retry below leaves it alone because
9
+ // it only runs while no WASI candidate has been loaded.
10
+ let __napiLoadedBindingTarget = 'native'
8
11
  const loadErrors = []
9
12
 
10
13
  const isMusl = () => {
@@ -33,7 +36,7 @@ const isMuslFromFilesystem = () => {
33
36
 
34
37
  const isMuslFromReport = () => {
35
38
  let report = null
36
- if (typeof process.report?.getReport === 'function') {
39
+ if (process.report && typeof process.report.getReport === 'function') {
37
40
  process.report.excludeNetwork = true
38
41
  report = process.report.getReport()
39
42
  }
@@ -63,7 +66,16 @@ const isMuslFromChildProcess = () => {
63
66
  function requireNative() {
64
67
  if (process.env.NAPI_RS_NATIVE_LIBRARY_PATH) {
65
68
  try {
66
- return require(process.env.NAPI_RS_NATIVE_LIBRARY_PATH);
69
+ const overrideBinding = require(process.env.NAPI_RS_NATIVE_LIBRARY_PATH)
70
+ // The override may be a generated WASI loader, which already reports its
71
+ // own flavor. Adopt it: `module.exports` aliases this object, so claiming
72
+ // 'native' would both misreport the artifact and overwrite the loader's
73
+ // marker through the alias.
74
+ __napiLoadedBindingTarget =
75
+ overrideBinding && typeof overrideBinding.__napiBindingTarget === 'string'
76
+ ? overrideBinding.__napiBindingTarget
77
+ : 'native'
78
+ return overrideBinding
67
79
  } catch (err) {
68
80
  loadErrors.push(err)
69
81
  }
@@ -77,8 +89,8 @@ function requireNative() {
77
89
  try {
78
90
  const binding = require('@interrupted/murk-secrets-android-arm64')
79
91
  const bindingPackageVersion = require('@interrupted/murk-secrets-android-arm64/package.json').version
80
- if (bindingPackageVersion !== '0.13.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
81
- throw new Error(`Native binding package version mismatch, expected 0.13.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
92
+ if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
93
+ throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
82
94
  }
83
95
  return binding
84
96
  } catch (e) {
@@ -93,8 +105,8 @@ function requireNative() {
93
105
  try {
94
106
  const binding = require('@interrupted/murk-secrets-android-arm-eabi')
95
107
  const bindingPackageVersion = require('@interrupted/murk-secrets-android-arm-eabi/package.json').version
96
- if (bindingPackageVersion !== '0.13.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
97
- throw new Error(`Native binding package version mismatch, expected 0.13.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
108
+ if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
109
+ throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
98
110
  }
99
111
  return binding
100
112
  } catch (e) {
@@ -105,38 +117,38 @@ function requireNative() {
105
117
  }
106
118
  } else if (process.platform === 'win32') {
107
119
  if (process.arch === 'x64') {
108
- if (process.config?.variables?.shlib_suffix === 'dll.a' || process.config?.variables?.node_target_type === 'shared_library') {
120
+ if ((process.config && process.config.variables && process.config.variables.shlib_suffix === 'dll.a') || (process.config && process.config.variables && process.config.variables.node_target_type === 'shared_library')) {
109
121
  try {
110
- return require('./murk-secrets.win32-x64-gnu.node')
111
- } catch (e) {
112
- loadErrors.push(e)
113
- }
114
- try {
115
- const binding = require('@interrupted/murk-secrets-win32-x64-gnu')
116
- const bindingPackageVersion = require('@interrupted/murk-secrets-win32-x64-gnu/package.json').version
117
- if (bindingPackageVersion !== '0.13.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
118
- throw new Error(`Native binding package version mismatch, expected 0.13.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
122
+ return require('./murk-secrets.win32-x64-gnu.node')
123
+ } catch (e) {
124
+ loadErrors.push(e)
125
+ }
126
+ try {
127
+ const binding = require('@interrupted/murk-secrets-win32-x64-gnu')
128
+ const bindingPackageVersion = require('@interrupted/murk-secrets-win32-x64-gnu/package.json').version
129
+ if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
130
+ throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
131
+ }
132
+ return binding
133
+ } catch (e) {
134
+ loadErrors.push(e)
119
135
  }
120
- return binding
121
- } catch (e) {
122
- loadErrors.push(e)
123
- }
124
136
  } else {
125
137
  try {
126
- return require('./murk-secrets.win32-x64-msvc.node')
127
- } catch (e) {
128
- loadErrors.push(e)
129
- }
130
- try {
131
- const binding = require('@interrupted/murk-secrets-win32-x64-msvc')
132
- const bindingPackageVersion = require('@interrupted/murk-secrets-win32-x64-msvc/package.json').version
133
- if (bindingPackageVersion !== '0.13.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
134
- throw new Error(`Native binding package version mismatch, expected 0.13.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
138
+ return require('./murk-secrets.win32-x64-msvc.node')
139
+ } catch (e) {
140
+ loadErrors.push(e)
141
+ }
142
+ try {
143
+ const binding = require('@interrupted/murk-secrets-win32-x64-msvc')
144
+ const bindingPackageVersion = require('@interrupted/murk-secrets-win32-x64-msvc/package.json').version
145
+ if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
146
+ throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
147
+ }
148
+ return binding
149
+ } catch (e) {
150
+ loadErrors.push(e)
135
151
  }
136
- return binding
137
- } catch (e) {
138
- loadErrors.push(e)
139
- }
140
152
  }
141
153
  } else if (process.arch === 'ia32') {
142
154
  try {
@@ -147,8 +159,8 @@ function requireNative() {
147
159
  try {
148
160
  const binding = require('@interrupted/murk-secrets-win32-ia32-msvc')
149
161
  const bindingPackageVersion = require('@interrupted/murk-secrets-win32-ia32-msvc/package.json').version
150
- if (bindingPackageVersion !== '0.13.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
151
- throw new Error(`Native binding package version mismatch, expected 0.13.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
162
+ if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
163
+ throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
152
164
  }
153
165
  return binding
154
166
  } catch (e) {
@@ -163,8 +175,8 @@ function requireNative() {
163
175
  try {
164
176
  const binding = require('@interrupted/murk-secrets-win32-arm64-msvc')
165
177
  const bindingPackageVersion = require('@interrupted/murk-secrets-win32-arm64-msvc/package.json').version
166
- if (bindingPackageVersion !== '0.13.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
167
- throw new Error(`Native binding package version mismatch, expected 0.13.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
178
+ if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
179
+ throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
168
180
  }
169
181
  return binding
170
182
  } catch (e) {
@@ -182,8 +194,8 @@ function requireNative() {
182
194
  try {
183
195
  const binding = require('@interrupted/murk-secrets-darwin-universal')
184
196
  const bindingPackageVersion = require('@interrupted/murk-secrets-darwin-universal/package.json').version
185
- if (bindingPackageVersion !== '0.13.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
186
- throw new Error(`Native binding package version mismatch, expected 0.13.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
197
+ if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
198
+ throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
187
199
  }
188
200
  return binding
189
201
  } catch (e) {
@@ -198,8 +210,8 @@ function requireNative() {
198
210
  try {
199
211
  const binding = require('@interrupted/murk-secrets-darwin-x64')
200
212
  const bindingPackageVersion = require('@interrupted/murk-secrets-darwin-x64/package.json').version
201
- if (bindingPackageVersion !== '0.13.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
202
- throw new Error(`Native binding package version mismatch, expected 0.13.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
213
+ if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
214
+ throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
203
215
  }
204
216
  return binding
205
217
  } catch (e) {
@@ -214,8 +226,8 @@ function requireNative() {
214
226
  try {
215
227
  const binding = require('@interrupted/murk-secrets-darwin-arm64')
216
228
  const bindingPackageVersion = require('@interrupted/murk-secrets-darwin-arm64/package.json').version
217
- if (bindingPackageVersion !== '0.13.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
218
- throw new Error(`Native binding package version mismatch, expected 0.13.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
229
+ if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
230
+ throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
219
231
  }
220
232
  return binding
221
233
  } catch (e) {
@@ -234,8 +246,8 @@ function requireNative() {
234
246
  try {
235
247
  const binding = require('@interrupted/murk-secrets-freebsd-x64')
236
248
  const bindingPackageVersion = require('@interrupted/murk-secrets-freebsd-x64/package.json').version
237
- if (bindingPackageVersion !== '0.13.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
238
- throw new Error(`Native binding package version mismatch, expected 0.13.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
249
+ if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
250
+ throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
239
251
  }
240
252
  return binding
241
253
  } catch (e) {
@@ -250,8 +262,8 @@ function requireNative() {
250
262
  try {
251
263
  const binding = require('@interrupted/murk-secrets-freebsd-arm64')
252
264
  const bindingPackageVersion = require('@interrupted/murk-secrets-freebsd-arm64/package.json').version
253
- if (bindingPackageVersion !== '0.13.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
254
- throw new Error(`Native binding package version mismatch, expected 0.13.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
265
+ if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
266
+ throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
255
267
  }
256
268
  return binding
257
269
  } catch (e) {
@@ -271,8 +283,8 @@ function requireNative() {
271
283
  try {
272
284
  const binding = require('@interrupted/murk-secrets-linux-x64-musl')
273
285
  const bindingPackageVersion = require('@interrupted/murk-secrets-linux-x64-musl/package.json').version
274
- if (bindingPackageVersion !== '0.13.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
275
- throw new Error(`Native binding package version mismatch, expected 0.13.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
286
+ if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
287
+ throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
276
288
  }
277
289
  return binding
278
290
  } catch (e) {
@@ -287,8 +299,8 @@ function requireNative() {
287
299
  try {
288
300
  const binding = require('@interrupted/murk-secrets-linux-x64-gnu')
289
301
  const bindingPackageVersion = require('@interrupted/murk-secrets-linux-x64-gnu/package.json').version
290
- if (bindingPackageVersion !== '0.13.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
291
- throw new Error(`Native binding package version mismatch, expected 0.13.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
302
+ if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
303
+ throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
292
304
  }
293
305
  return binding
294
306
  } catch (e) {
@@ -305,8 +317,8 @@ function requireNative() {
305
317
  try {
306
318
  const binding = require('@interrupted/murk-secrets-linux-arm64-musl')
307
319
  const bindingPackageVersion = require('@interrupted/murk-secrets-linux-arm64-musl/package.json').version
308
- if (bindingPackageVersion !== '0.13.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
309
- throw new Error(`Native binding package version mismatch, expected 0.13.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
320
+ if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
321
+ throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
310
322
  }
311
323
  return binding
312
324
  } catch (e) {
@@ -321,8 +333,8 @@ function requireNative() {
321
333
  try {
322
334
  const binding = require('@interrupted/murk-secrets-linux-arm64-gnu')
323
335
  const bindingPackageVersion = require('@interrupted/murk-secrets-linux-arm64-gnu/package.json').version
324
- if (bindingPackageVersion !== '0.13.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
325
- throw new Error(`Native binding package version mismatch, expected 0.13.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
336
+ if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
337
+ throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
326
338
  }
327
339
  return binding
328
340
  } catch (e) {
@@ -339,8 +351,8 @@ function requireNative() {
339
351
  try {
340
352
  const binding = require('@interrupted/murk-secrets-linux-arm-musleabihf')
341
353
  const bindingPackageVersion = require('@interrupted/murk-secrets-linux-arm-musleabihf/package.json').version
342
- if (bindingPackageVersion !== '0.13.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
343
- throw new Error(`Native binding package version mismatch, expected 0.13.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
354
+ if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
355
+ throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
344
356
  }
345
357
  return binding
346
358
  } catch (e) {
@@ -355,8 +367,8 @@ function requireNative() {
355
367
  try {
356
368
  const binding = require('@interrupted/murk-secrets-linux-arm-gnueabihf')
357
369
  const bindingPackageVersion = require('@interrupted/murk-secrets-linux-arm-gnueabihf/package.json').version
358
- if (bindingPackageVersion !== '0.13.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
359
- throw new Error(`Native binding package version mismatch, expected 0.13.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
370
+ if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
371
+ throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
360
372
  }
361
373
  return binding
362
374
  } catch (e) {
@@ -373,8 +385,8 @@ function requireNative() {
373
385
  try {
374
386
  const binding = require('@interrupted/murk-secrets-linux-loong64-musl')
375
387
  const bindingPackageVersion = require('@interrupted/murk-secrets-linux-loong64-musl/package.json').version
376
- if (bindingPackageVersion !== '0.13.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
377
- throw new Error(`Native binding package version mismatch, expected 0.13.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
388
+ if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
389
+ throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
378
390
  }
379
391
  return binding
380
392
  } catch (e) {
@@ -389,8 +401,8 @@ function requireNative() {
389
401
  try {
390
402
  const binding = require('@interrupted/murk-secrets-linux-loong64-gnu')
391
403
  const bindingPackageVersion = require('@interrupted/murk-secrets-linux-loong64-gnu/package.json').version
392
- if (bindingPackageVersion !== '0.13.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
393
- throw new Error(`Native binding package version mismatch, expected 0.13.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
404
+ if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
405
+ throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
394
406
  }
395
407
  return binding
396
408
  } catch (e) {
@@ -407,8 +419,8 @@ function requireNative() {
407
419
  try {
408
420
  const binding = require('@interrupted/murk-secrets-linux-riscv64-musl')
409
421
  const bindingPackageVersion = require('@interrupted/murk-secrets-linux-riscv64-musl/package.json').version
410
- if (bindingPackageVersion !== '0.13.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
411
- throw new Error(`Native binding package version mismatch, expected 0.13.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
422
+ if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
423
+ throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
412
424
  }
413
425
  return binding
414
426
  } catch (e) {
@@ -423,8 +435,8 @@ function requireNative() {
423
435
  try {
424
436
  const binding = require('@interrupted/murk-secrets-linux-riscv64-gnu')
425
437
  const bindingPackageVersion = require('@interrupted/murk-secrets-linux-riscv64-gnu/package.json').version
426
- if (bindingPackageVersion !== '0.13.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
427
- throw new Error(`Native binding package version mismatch, expected 0.13.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
438
+ if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
439
+ throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
428
440
  }
429
441
  return binding
430
442
  } catch (e) {
@@ -440,8 +452,8 @@ function requireNative() {
440
452
  try {
441
453
  const binding = require('@interrupted/murk-secrets-linux-ppc64-gnu')
442
454
  const bindingPackageVersion = require('@interrupted/murk-secrets-linux-ppc64-gnu/package.json').version
443
- if (bindingPackageVersion !== '0.13.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
444
- throw new Error(`Native binding package version mismatch, expected 0.13.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
455
+ if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
456
+ throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
445
457
  }
446
458
  return binding
447
459
  } catch (e) {
@@ -456,8 +468,8 @@ function requireNative() {
456
468
  try {
457
469
  const binding = require('@interrupted/murk-secrets-linux-s390x-gnu')
458
470
  const bindingPackageVersion = require('@interrupted/murk-secrets-linux-s390x-gnu/package.json').version
459
- if (bindingPackageVersion !== '0.13.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
460
- throw new Error(`Native binding package version mismatch, expected 0.13.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
471
+ if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
472
+ throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
461
473
  }
462
474
  return binding
463
475
  } catch (e) {
@@ -476,8 +488,8 @@ function requireNative() {
476
488
  try {
477
489
  const binding = require('@interrupted/murk-secrets-openharmony-arm64')
478
490
  const bindingPackageVersion = require('@interrupted/murk-secrets-openharmony-arm64/package.json').version
479
- if (bindingPackageVersion !== '0.13.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
480
- throw new Error(`Native binding package version mismatch, expected 0.13.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
491
+ if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
492
+ throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
481
493
  }
482
494
  return binding
483
495
  } catch (e) {
@@ -492,8 +504,8 @@ function requireNative() {
492
504
  try {
493
505
  const binding = require('@interrupted/murk-secrets-openharmony-x64')
494
506
  const bindingPackageVersion = require('@interrupted/murk-secrets-openharmony-x64/package.json').version
495
- if (bindingPackageVersion !== '0.13.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
496
- throw new Error(`Native binding package version mismatch, expected 0.13.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
507
+ if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
508
+ throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
497
509
  }
498
510
  return binding
499
511
  } catch (e) {
@@ -508,8 +520,8 @@ function requireNative() {
508
520
  try {
509
521
  const binding = require('@interrupted/murk-secrets-openharmony-arm')
510
522
  const bindingPackageVersion = require('@interrupted/murk-secrets-openharmony-arm/package.json').version
511
- if (bindingPackageVersion !== '0.13.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
512
- throw new Error(`Native binding package version mismatch, expected 0.13.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
523
+ if (bindingPackageVersion !== '0.14.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
524
+ throw new Error(`Native binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
513
525
  }
514
526
  return binding
515
527
  } catch (e) {
@@ -523,58 +535,248 @@ function requireNative() {
523
535
  }
524
536
  }
525
537
 
526
- nativeBinding = requireNative()
538
+ function createLoadErrorChain(errors) {
539
+ return errors.reduce((previous, current) => {
540
+ let message
541
+ try {
542
+ message =
543
+ current && typeof current.message === 'string'
544
+ ? current.message
545
+ : String(current)
546
+ } catch {
547
+ message = 'Unknown error'
548
+ }
549
+ const error = new Error(message)
550
+ error.cause = previous
551
+ return error
552
+ }, null)
553
+ }
554
+
555
+ // NAPI_RS_FORCE_WASI is a tri-state flag:
556
+ // unset / any other value → native binding preferred, WASI is only a fallback
557
+ // 'true' → prefer WASI, but retain native as a lazy fallback
558
+ // 'error' → require WASI without initializing a native fallback
559
+ // Treating any non-empty string as truthy (the historical behavior) meant
560
+ // NAPI_RS_FORCE_WASI=false, NAPI_RS_FORCE_WASI=0, etc. inadvertently triggered
561
+ // the WASI path, causing ENOENT for packages shipped without a .wasi.cjs file.
562
+ //
563
+ // NAPI_RS_WASI_FLAVOR selects one exact generated flavor and implies strict
564
+ // WASI loading. It never crosses into another flavor or falls back to native.
565
+ const __napiWasiFlavors = ['wasm32-wasi']
566
+ const __napiWasiFlavor = process.env.NAPI_RS_WASI_FLAVOR
567
+ const __napiWasiFlavorRequested =
568
+ typeof __napiWasiFlavor === 'string' && __napiWasiFlavor.length > 0
569
+ if (
570
+ __napiWasiFlavorRequested &&
571
+ __napiWasiFlavors.indexOf(__napiWasiFlavor) === -1
572
+ ) {
573
+ throw new Error(
574
+ 'Unsupported WASI flavor "' +
575
+ __napiWasiFlavor +
576
+ '". Available flavors: ' +
577
+ __napiWasiFlavors.join(', '),
578
+ )
579
+ }
580
+ const forceWasiError = process.env.NAPI_RS_FORCE_WASI === 'error'
581
+ const forceWasi =
582
+ process.env.NAPI_RS_FORCE_WASI === 'true' ||
583
+ forceWasiError ||
584
+ __napiWasiFlavorRequested
585
+
586
+ if (!forceWasi) {
587
+ nativeBinding = requireNative()
588
+ }
527
589
 
528
- if (!nativeBinding || process.env.NAPI_RS_FORCE_WASI) {
590
+ if (!nativeBinding || forceWasi) {
529
591
  let wasiBinding = null
530
- let wasiBindingError = null
531
- try {
532
- wasiBinding = require('./murk-secrets.wasi.cjs')
533
- nativeBinding = wasiBinding
534
- } catch (err) {
535
- if (process.env.NAPI_RS_FORCE_WASI) {
536
- wasiBindingError = err
592
+ let wasiBindingLoaded = false
593
+ const wasiBindingErrors = []
594
+ const __napiWasiResolveCandidate = (specifier, isPackage, localArtifacts) => {
595
+ try {
596
+ require.resolve(specifier)
597
+ } catch (resolveError) {
598
+ if (!resolveError || resolveError.code !== 'MODULE_NOT_FOUND') {
599
+ throw resolveError
600
+ }
601
+ if (isPackage) {
602
+ try {
603
+ require.resolve(specifier + '/package.json')
604
+ } catch (packageError) {
605
+ if (packageError && packageError.code === 'MODULE_NOT_FOUND') {
606
+ return resolveError
607
+ }
608
+ // An exports restriction proves the package exists even when its
609
+ // package.json is not public. Preserve the root resolution failure.
610
+ throw resolveError
611
+ }
612
+ // The package exists but its main/export target is broken.
613
+ throw resolveError
614
+ }
615
+ return resolveError
537
616
  }
617
+ if (localArtifacts) {
618
+ let artifactError = null
619
+ for (let i = 0; i < localArtifacts.length; i++) {
620
+ try {
621
+ require.resolve(localArtifacts[i])
622
+ return null
623
+ } catch (resolveError) {
624
+ if (!resolveError || resolveError.code !== 'MODULE_NOT_FOUND') {
625
+ throw resolveError
626
+ }
627
+ artifactError = resolveError
628
+ }
629
+ }
630
+ return artifactError
631
+ }
632
+ return null
538
633
  }
539
- if (!nativeBinding || process.env.NAPI_RS_FORCE_WASI) {
634
+ if (!wasiBindingLoaded && (!__napiWasiFlavorRequested || __napiWasiFlavor === 'wasm32-wasi')) {
635
+ let candidateError = null
636
+ let candidateFailed = false
540
637
  try {
541
- wasiBinding = require('@interrupted/murk-secrets-wasm32-wasi')
542
- nativeBinding = wasiBinding
638
+ candidateError = __napiWasiResolveCandidate('./murk-secrets.wasi.cjs', false, ['./murk-secrets.wasm32-wasi.debug.wasm', './murk-secrets.wasm32-wasi.wasm'])
639
+ candidateFailed = candidateError !== null
640
+ if (!candidateFailed) {
641
+ wasiBinding = require('./murk-secrets.wasi.cjs')
642
+ nativeBinding = wasiBinding
643
+ __napiLoadedBindingTarget = 'wasm32-wasi'
644
+ wasiBindingLoaded = true
645
+ }
543
646
  } catch (err) {
544
- if (process.env.NAPI_RS_FORCE_WASI) {
545
- if (!wasiBindingError) {
546
- wasiBindingError = err
547
- } else {
548
- wasiBindingError.cause = err
647
+ candidateError = err
648
+ candidateFailed = true
649
+ }
650
+ if (candidateFailed) {
651
+ wasiBindingErrors.push(candidateError)
652
+ loadErrors.push(candidateError)
653
+ }
654
+ }
655
+ if (!wasiBindingLoaded && (!__napiWasiFlavorRequested || __napiWasiFlavor === 'wasm32-wasi')) {
656
+ let candidateError = null
657
+ let candidateFailed = false
658
+ try {
659
+ candidateError = __napiWasiResolveCandidate('@interrupted/murk-secrets-wasm32-wasi', true, undefined)
660
+ candidateFailed = candidateError !== null
661
+ if (!candidateFailed) {
662
+ if (process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
663
+ const bindingPackageVersion = require('@interrupted/murk-secrets-wasm32-wasi/package.json').version
664
+ if (bindingPackageVersion !== '0.14.1') {
665
+ throw new Error(`WASI binding package version mismatch, expected 0.14.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
666
+ }
549
667
  }
550
- loadErrors.push(err)
668
+ wasiBinding = require('@interrupted/murk-secrets-wasm32-wasi')
669
+ nativeBinding = wasiBinding
670
+ __napiLoadedBindingTarget = 'wasm32-wasi'
671
+ wasiBindingLoaded = true
551
672
  }
673
+ } catch (err) {
674
+ candidateError = err
675
+ candidateFailed = true
552
676
  }
677
+ if (candidateFailed) {
678
+ wasiBindingErrors.push(candidateError)
679
+ loadErrors.push(candidateError)
680
+ }
681
+ }
682
+ if (
683
+ !wasiBindingLoaded &&
684
+ forceWasi &&
685
+ !forceWasiError &&
686
+ !__napiWasiFlavorRequested
687
+ ) {
688
+ nativeBinding = requireNative()
553
689
  }
554
- if (process.env.NAPI_RS_FORCE_WASI === 'error' && !wasiBinding) {
555
- const error = new Error('WASI binding not found and NAPI_RS_FORCE_WASI is set to error')
556
- error.cause = wasiBindingError
690
+ if ((forceWasiError || __napiWasiFlavorRequested) && !wasiBindingLoaded) {
691
+ const error = new Error(
692
+ __napiWasiFlavorRequested
693
+ ? 'WASI binding for flavor "' + __napiWasiFlavor + '" not found'
694
+ : 'WASI binding not found and NAPI_RS_FORCE_WASI is set to error',
695
+ )
696
+ error.cause = createLoadErrorChain(wasiBindingErrors)
557
697
  throw error
558
698
  }
559
699
  }
560
700
 
561
701
  if (!nativeBinding) {
562
702
  if (loadErrors.length > 0) {
563
- throw new Error(
703
+ const error = new Error(
564
704
  `Cannot find native binding. ` +
565
705
  `npm has a bug related to optional dependencies (https://github.com/npm/cli/issues/4828). ` +
566
706
  'Please try `npm i` again after removing both package-lock.json and node_modules directory.',
567
- {
568
- cause: loadErrors.reduce((err, cur) => {
569
- cur.cause = err
570
- return cur
571
- }),
572
- },
573
707
  )
708
+ // assign instead of the `new Error(message, { cause })` options form,
709
+ // which Node < 16.9 silently ignores
710
+ error.cause = createLoadErrorChain(loadErrors)
711
+ throw error
574
712
  }
575
713
  throw new Error(`Failed to load native binding`)
576
714
  }
577
715
 
716
+ function __napiStampBindingTarget(exportsObject, target) {
717
+ if (
718
+ Object.prototype.hasOwnProperty.call(exportsObject, '__napiBindingTarget')
719
+ ) {
720
+ if (exportsObject.__napiBindingTarget === target) {
721
+ // Already ours: the root entry aliases the object it loaded, so a WASI
722
+ // fallback candidate — or a `NAPI_RS_NATIVE_LIBRARY_PATH` override that
723
+ // is a generated loader — arrives already stamped with this same value.
724
+ return target
725
+ }
726
+ const error = new Error(
727
+ '`__napiBindingTarget` is reserved by the generated binding loader, but the loaded binding already exports it. Rename the export, e.g. #[napi(js_name = "...")].',
728
+ )
729
+ error.code = 'ERR_NAPI_BINDING_TARGET_CONFLICT'
730
+ throw error
731
+ }
732
+ if (!Object.isExtensible(exportsObject)) {
733
+ // A `#[napi(module_exports)]` hook may seal or freeze this object
734
+ // (`Object::seal` / `Object::freeze`). Reporting the artifact is metadata,
735
+ // never a reason to fail an otherwise successful load, so the stamp is
736
+ // skipped. What a consumer still sees then follows the entry point: the
737
+ // browser and deferred loaders declare `__napiBindingTarget` at module
738
+ // level and go on reporting it, while the CommonJS entries hand back this
739
+ // very object as `module.exports`, so there the value is absent.
740
+ return target
741
+ }
742
+ try {
743
+ // [[Define]], not [[Set]]: an ordinary assignment walks the prototype
744
+ // chain, so an inherited accessor could swallow the value or throw and
745
+ // fail an otherwise successful load. The descriptor is what a successful
746
+ // assignment would have produced.
747
+ Object.defineProperty(exportsObject, '__napiBindingTarget', {
748
+ configurable: true,
749
+ enumerable: true,
750
+ value: target,
751
+ writable: true,
752
+ })
753
+ } catch {
754
+ // Same rule as the non-extensible skip above: reporting the artifact is
755
+ // metadata, never a reason to fail an otherwise successful load. An exotic
756
+ // object (a Proxy whose defineProperty trap refuses) is skipped, not
757
+ // thrown over.
758
+ }
759
+ // The CommonJS loaders assign this return value so `cjs-module-lexer` — and
760
+ // therefore Node's CJS -> ESM named export detection — can see
761
+ // `__napiBindingTarget` statically.
762
+ return target
763
+ }
764
+ // Stamp before the alias, not after. The guard only reads `nativeBinding`
765
+ // (`hasOwnProperty` plus a comparison), which is safe against any addon
766
+ // accessor; an assignment is not, because a `#[napi(module_exports)]` hook can
767
+ // expose a getter reporting this very value and a setter that throws. So the
768
+ // assignment lands on the loader's own `module.exports`, still the original
769
+ // object here, and the alias below replaces it.
770
+ //
771
+ // The assignment is what keeps the marker a statically visible CommonJS export:
772
+ // `cjs-module-lexer` is Node's CJS -> ESM named export detection, it cannot see
773
+ // a bare call, and the later `module.exports = nativeBinding` does not undo the
774
+ // detection. The assignment itself always succeeds — its target is this
775
+ // loader's own, still extensible `module.exports` — and the alias below then
776
+ // discards the value it wrote. What a consumer reads is whatever the guard put
777
+ // on `nativeBinding`, so on a frozen binding, where the guard skips, the
778
+ // linked import resolves to `undefined`.
779
+ module.exports.__napiBindingTarget = __napiStampBindingTarget(nativeBinding, __napiLoadedBindingTarget)
578
780
  module.exports = nativeBinding
579
781
  module.exports.Vault = nativeBinding.Vault
580
782
  module.exports.add = nativeBinding.add
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@interrupted/murk-secrets",
3
- "version": "0.13.0",
3
+ "version": "0.14.1",
4
4
  "description": "Node.js/TypeScript bindings for murk — encrypted secrets manager",
5
5
  "main": "index.js",
6
6
  "types": "index.d.ts",
@@ -45,7 +45,7 @@
45
45
  "@napi-rs/cli": "^3"
46
46
  },
47
47
  "engines": {
48
- "node": ">= 16"
48
+ "node": ">=18.17.0 <19 || >=20.3.0"
49
49
  },
50
50
  "files": [
51
51
  "index.js",
@@ -54,12 +54,12 @@
54
54
  "LICENSE-APACHE"
55
55
  ],
56
56
  "optionalDependencies": {
57
- "@interrupted/murk-secrets-darwin-x64": "0.13.0",
58
- "@interrupted/murk-secrets-darwin-arm64": "0.13.0",
59
- "@interrupted/murk-secrets-linux-x64-gnu": "0.13.0",
60
- "@interrupted/murk-secrets-linux-x64-musl": "0.13.0",
61
- "@interrupted/murk-secrets-linux-arm64-gnu": "0.13.0",
62
- "@interrupted/murk-secrets-linux-arm64-musl": "0.13.0",
63
- "@interrupted/murk-secrets-win32-x64-msvc": "0.13.0"
57
+ "@interrupted/murk-secrets-darwin-x64": "0.14.1",
58
+ "@interrupted/murk-secrets-darwin-arm64": "0.14.1",
59
+ "@interrupted/murk-secrets-linux-x64-gnu": "0.14.1",
60
+ "@interrupted/murk-secrets-linux-x64-musl": "0.14.1",
61
+ "@interrupted/murk-secrets-linux-arm64-gnu": "0.14.1",
62
+ "@interrupted/murk-secrets-linux-arm64-musl": "0.14.1",
63
+ "@interrupted/murk-secrets-win32-x64-msvc": "0.14.1"
64
64
  }
65
65
  }