@polyjose/node 0.1.1 → 0.1.2

package/backend.js

@@ -1,119 +1,63 @@
 /**
- * The napi-rs backend of `@polyjose/node` (ADR 0031 §1-§2, `bindings/js/BACKEND.md`).
+ * The napi-rs backend of `@polyjose/node` (ADR 0031 §1-§2, `bindings/js/BACKEND.md`; packaging as
+ * superseded by the feature 0017 ADR: one package that ships the addon of all eight targets).
  *
- * The generated loader `binding.cjs` (`napi build --platform --js binding.cjs`) already is the
- * backend contract: one function per ADR 0030 §4 operation, camelCase, in the ADR's argument
- * order, rejecting with an `Error` whose `code` is one of `errorCodes()` (ADR 0030 §5). So this
- * module only loads it, checks what it loaded and gives it the facade's `Backend` type; it adds no
- * JOSE logic and renames nothing (ADR 0030 §1: loading and integrity checks are entry idiom).
+ * The native addon `polyjose.<platform>.node` already is the backend contract: one function per
+ * ADR 0030 §4 operation, camelCase, in the ADR's argument order, rejecting with an `Error` whose
+ * `code` is one of `errorCodes()` (ADR 0030 §5). Its types are the `binding.d.ts` that
+ * `napi build --dts` generates. So this module only picks the addon for this host, authenticates
+ * it, loads it and gives it the facade's `Backend` type; it adds no JOSE logic and renames nothing
+ * (ADR 0030 §1: loading and integrity checks are entry idiom).
  *
- * The loader is CommonJS (it picks the platform's `.node` file at run time), loaded here through
- * `createRequire`, so the package stays ESM-only (ADR 0031 §3). Its types come from the generated
- * `binding.d.ts`.
+ * **No resolving loader (feature 0017; review-security.md M1, feature 0007 F02).** napi-rs's
+ * generated loader picks the first module that loads from an override variable, the package
+ * directory, every ancestor `node_modules`, `NODE_PATH` and a WASI chain, so a JavaScript or native
+ * file planted in any of them could become the crypto backend and "verify" any token. polyjose
+ * builds no such loader (`napi build --no-js`) and resolves no module name at all: this file reads
+ * only files of its own package directory, `dirname(import.meta.url)`, by absolute path. It never
+ * reads `process.env`, so neither `NODE_PATH` nor any `NAPI_RS_*` variable changes what loads.
  *
- * **Fail closed (feature 0007 F02; review-code.md SF-4, review-security.md M1).** The generated
- * loader returns the first module that loads, of any kind:
- *   - `NAPI_RS_NATIVE_LIBRARY_PATH`, if set;
- *   - then `./polyjose.<platform>.node` next to it;
- *   - then `require('@polyjose/node-<platform>')`, which walks every ancestor `node_modules` and
- *     `NODE_PATH`;
- *   - then a WASI chain: `./polyjose.wasi.cjs`, then `@polyjose/node-wasm32-wasi`. The napi-rs CLI
- *     3.10.12 template always emits it; no `napi build` option omits it, and
- *     `NAPI_RS_FORCE_WASI` / `NAPI_RS_WASI_FLAVOR` can select it.
- * It stamps a JavaScript module found that way `"native"` too. So a JS file planted in an
- * ancestor directory or on `NODE_PATH` would become the crypto backend and could "verify" any
- * token. polyjose publishes only native addons (ADR 0031 §2: eight targets, no WASI build;
- * `@polyjose/wasm` is a separate package). The generated file is never edited; this module wraps
- * it and accepts nothing else.
- *
- * **Before loading,** nothing runs unless every module the loader could pick is a native addon:
- *   1. Neither WASI variable is set, whatever its value.
- *   2. No WASI candidate resolves.
- *   3. Every native candidate that resolves is a `.node` file: the override path, and for every
- *      platform the loader probes, `./polyjose.<platform>.node` and `@polyjose/node-<platform>`.
- *      `@polyjose/node-<platform>/package.json`, which the loader also reads, must be a
- *      `package.json`.
- * Resolution is the loader's own: `backend.js` sits next to `binding.cjs`, and `require.resolve`
- * uses the same directory, `node_modules` walk, `NODE_PATH` and symlink handling as the loader's
- * `require`, and runs no code. Node loads a `.node` file only as a native addon, never as
- * JavaScript.
- *
- * **The hash pin (feature 0007 F07; bindings security audit N-M1, the JVM's 0008 F05 bar).** Steps
- * 1-6 make sure the package loads a native addon at this version, but `version()` is what the
- * addon itself says, and a native addon is as easy to plant as a JavaScript file. So before the
- * loader runs, this module also *authenticates* the addon:
- *   a. `addon-sha256.json`, next to this file, maps each platform polyjose built this package for
- *      to its addon's SHA-256 (FIPS 180-4). It is generated, never hand-edited:
- *      `scripts/addon-hashes.sh`, run by `scripts/build.sh` for a local build and by the release
- *      assembly of the main package for every published platform. No map, a malformed one, or no
- *      entry for this host refuses the load: nothing is trusted by default.
- *   b. It picks the one file the loader would load on this host (the platform name of
- *      `hostPlatform`, the loader's own): `NAPI_RS_NATIVE_LIBRARY_PATH` when set, else
- *      `./polyjose.<platform>.node`, else `@polyjose/node-<platform>`, resolved as above. A
- *      caller's override is not refused; it is held to the same pin.
- *   c. It reads that file once, hashes those bytes with `node:crypto` and refuses on a mismatch,
- *      naming the platform, the source and both hashes. There is no fallback to another candidate.
- *   d. It writes the same bytes, with `O_EXCL`, into a new directory from `fs.mkdtempSync` under
+ * **The steps (the F07 hash-pin model, bindings security audit N-M1, the JVM's 0008 F05 bar):**
+ *   1. The platform name (`detectPlatform`): `darwin-<arch>`, `win32-<arch>-msvc`, or
+ *      `linux-<arch>-gnu|musl` for x64 and arm64, with napi-rs's names. Any other host is refused
+ *      by name, pointing at `@polyjose/wasm`, which runs everywhere.
+ *   2. `addon-sha256.json`, in the package directory, maps each shipped platform to its addon's
+ *      SHA-256 (FIPS 180-4). It is generated, never hand-edited: `scripts/addon-hashes.sh`, run by
+ *      `scripts/build.sh` for a local build and by `scripts/pack-main.sh` over the eight addons the
+ *      package ships. No map, a malformed one, or no entry for this host refuses the load: nothing
+ *      is trusted by default.
+ *   3. It reads `polyjose.<platform>.node` from the package directory once, hashes those bytes with
+ *      `node:crypto` and refuses on a mismatch, naming the platform, the file and both hashes.
+ *      There is no fallback to another file.
+ *   4. It writes the same bytes, with `O_EXCL`, into a new directory from `fs.mkdtempSync` under
  *      `os.tmpdir()` (mode 0700 on POSIX; on Windows the per-user `%TEMP%` ACL), under a random
  *      leaf name (macOS looks a leaf name up in `DYLD_LIBRARY_PATH` before the path), checks the
- *      copy's SHA-256 again, and points `NAPI_RS_NATIVE_LIBRARY_PATH` at it for the one
- *      synchronous `require("./binding.cjs")`. The loader's override branch loads exactly that
- *      path and probes nothing else, so between the check and `dlopen` only this user (who can
- *      already change anything they run) could swap the file; whoever can write the installed
- *      file or an ancestor `node_modules` can't. The caller's environment is restored right
- *      after, and the copy is deleted (a loaded library stays mapped; Windows can't delete a
- *      loaded DLL, so there the copy stays in the temporary directory).
- *
- * **After loading,** what the loader returned must be:
- *   4. the exports of exactly one `.node` module in the CommonJS cache, the private copy of step
- *      d, shared only with a loader (`binding.cjs`), so no JavaScript module wraps or re-exports
- *      it, and a `binding.cjs` that other code required first (with its own addon) is refused;
- *   5. stamped `__napiBindingTarget === "native"`;
- *   6. at this package's version: `version()` must equal `package.json`'s version. That is the
- *      workspace version, which every release keeps in step (feature 0007 T04). So an addon from
- *      another release is refused, whatever `NAPI_RS_ENFORCE_VERSION_CHECK` says (SF-4 item 3).
+ *      copy's SHA-256 again, and `require`s that absolute path, which Node's `.node` handler hands
+ *      to `dlopen`. So between the check and `dlopen` only this user (who can already change
+ *      anything they run) could swap the file; whoever can write the installed package can't. The
+ *      copy is deleted right after (a loaded library stays mapped; Windows can't delete a loaded
+ *      DLL, so there the copy stays in the temporary directory).
+ *   5. What loaded must be the exports of exactly that one module in the CommonJS cache, the
+ *      private copy, so no JavaScript module wraps or re-exports it.
+ *   6. It must be this package's version: `version()` equals `package.json`'s version, the
+ *      workspace version every release keeps in step (feature 0007 T04), so an addon of another
+ *      release is refused.
  * Every refusal is an `Error` with `code` `ERR_POLYJOSE_ADDON_REFUSED`. This doesn't defend against
  * code already running in the process, which can patch anything. It makes sure the package never
  * selects a substitute.
  *
- * `test/loader.test.ts` pins the loader's load targets and checks `LOADER_PLATFORMS` against them.
- * So a CLI bump that adds a candidate fails there before this module can miss it.
+ * `test/loader.test.ts` pins what this module loads (its built-ins and its one `require`), the
+ * platform detection, and each refusal.
  */
-/** The loader's override variable: a path it `require`s instead of probing (binding.cjs `requireNative`). */
-const OVERRIDE = "NAPI_RS_NATIVE_LIBRARY_PATH";
-/** The addon hash map next to this file (step a): `{ "<platform>": "<SHA-256, 64 lowercase hex>" }`. */
-const PINS = "./addon-sha256.json";
-/** The `code` of every load refusal (step c's mismatch included). */
+/** The addon hash map in the package directory (step 2): `{ "<platform>": "<SHA-256, 64 lowercase hex>" }`. */
+const PINS = "addon-sha256.json";
+/** The `code` of every load refusal. */
 const REFUSED = "ERR_POLYJOSE_ADDON_REFUSED";
-/** The loader's WASI switches: `NAPI_RS_FORCE_WASI` (`true`, `error`) and `NAPI_RS_WASI_FLAVOR`. */
-const WASI_VARIABLES = ["NAPI_RS_FORCE_WASI", "NAPI_RS_WASI_FLAVOR"];
-/**
- * Everything the loader's WASI chain resolves before it loads (binding.cjs,
- * `__napiWasiResolveCandidate`): the local loader and the package, whose `package.json` alone
- * already proves it is installed.
- */
-const WASI_CANDIDATES = [
-    "./polyjose.wasi.cjs",
-    "@polyjose/node-wasm32-wasi",
-    "@polyjose/node-wasm32-wasi/package.json",
-];
-/** The eight platforms polyjose publishes an addon for (ADR 0031 §2): the only keys a map may have. */
-const PUBLISHED_PLATFORMS = [
-    "darwin-x64",
-    "darwin-arm64",
-    "linux-x64-gnu",
-    "linux-arm64-gnu",
-    "linux-x64-musl",
-    "linux-arm64-musl",
-    "win32-x64-msvc",
-    "win32-arm64-msvc",
-];
 /**
- * Every platform name the generated loader probes: the eight polyjose publishes (ADR 0031 §2) and
- * the napi-rs template's others, which are never published. `test/loader.test.ts` checks that this
- * is exactly the loader's set.
+ * The eight platforms whose addon this package ships (ADR 0031 §2's targets): the only keys a map
+ * may have. `test/loader.test.ts` checks them against package.json's `napi.targets` and `files`.
  */
-export const LOADER_PLATFORMS = [
+export const PLATFORMS = [
     "darwin-x64",
     "darwin-arm64",
     "linux-x64-gnu",
@@ -122,139 +66,82 @@ export const LOADER_PLATFORMS = [
     "linux-arm64-musl",
     "win32-x64-msvc",
     "win32-arm64-msvc",
-    "android-arm64",
-    "android-arm-eabi",
-    "win32-x64-gnu",
-    "win32-ia32-msvc",
-    "darwin-universal",
-    "freebsd-x64",
-    "freebsd-arm64",
-    "freebsd-ppc64",
-    "linux-arm-musleabihf",
-    "linux-arm-gnueabihf",
-    "linux-loong64-musl",
-    "linux-loong64-gnu",
-    "linux-riscv64-musl",
-    "linux-riscv64-gnu",
-    "linux-ppc64-gnu",
-    "linux-s390x-gnu",
-    "openharmony-arm64",
-    "openharmony-x64",
-    "openharmony-arm",
 ];
+const SHIPPED = PLATFORMS;
 /**
- * A load refusal, with `code` `ERR_POLYJOSE_ADDON_REFUSED`. It names a variable, a specifier, a
- * platform, a version or a SHA-256; never a path's contents.
+ * A load refusal, with `code` `ERR_POLYJOSE_ADDON_REFUSED`. It names a platform, a file of the
+ * package, a version or a SHA-256; never a file's contents.
  */
 function refuse(reason) {
     throw Object.assign(new Error(`@polyjose/node: ${reason}`), { code: REFUSED });
 }
 /**
- * Where `id` resolves from the loader's directory: the file, or `null` when it is absent. Only
- * `MODULE_NOT_FOUND` means absent. Any other failure, such as an `exports` restriction or an
- * unreadable directory, is a refusal.
+ * Step 1: this host's platform name, napi-rs's (`napi build --platform` names the addon after it):
+ * `darwin-x64|arm64`, `win32-x64|arm64-msvc`, `linux-x64|arm64-gnu|musl`. Any other platform or
+ * architecture is `<platform>-<arch>`, which `PLATFORMS` does not list. On Linux it reads
+ * /usr/bin/ldd and may take a process report (`isMusl`); it refuses when it cannot tell the libc.
  */
-function resolved(req, id) {
-    try {
-        return req.resolve(id);
-    }
-    catch (err) {
-        if (err?.code === "MODULE_NOT_FOUND")
-            return null;
-        return refuse(`${id} cannot be resolved cleanly, so it cannot be checked; refusing to load`);
-    }
-}
-/** Steps 1-3 of the module comment: every module the loader could pick is a native addon. */
-function checkCandidates(host, req) {
-    for (const name of WASI_VARIABLES) {
-        if (host.env[name] !== undefined) {
-            refuse(`${name} is set, but polyjose publishes no WASI build; unset it to load the native addon`);
-        }
-    }
-    for (const id of WASI_CANDIDATES) {
-        if (resolved(req, id) !== null) {
-            refuse(`${id} resolves next to the loader, but polyjose publishes no WASI build; remove it`);
-        }
-    }
-    // The loader tests the override for truthiness, so an empty value means "not set".
-    const override = host.env[OVERRIDE];
-    if (override !== undefined && override !== "") {
-        const file = resolved(req, override);
-        if (file === null || !file.endsWith(".node")) {
-            refuse("NAPI_RS_NATIVE_LIBRARY_PATH does not name a native .node addon; refusing to load");
-        }
-    }
-    for (const platform of LOADER_PLATFORMS) {
-        for (const id of [`./polyjose.${platform}.node`, `@polyjose/node-${platform}`]) {
-            const file = resolved(req, id);
-            if (file !== null && !file.endsWith(".node")) {
-                refuse(`${id} resolves to a file that is not a native .node addon; refusing to load`);
-            }
-        }
-        const manifest = resolved(req, `@polyjose/node-${platform}/package.json`);
-        if (manifest !== null && !/[\\/]package\.json$/.test(manifest)) {
-            refuse(`@polyjose/node-${platform}/package.json resolves to another file; refusing to load`);
-        }
-    }
-}
-/**
- * The loader's platform name for this host, as binding.cjs `requireNative` computes it for the
- * eight published platforms; any other host gets `<platform>-<arch>`, which no map lists.
- */
-function hostPlatform(host, fs) {
+export function detectPlatform(host, fs) {
     const { platform, arch } = host;
     if (arch !== "x64" && arch !== "arm64")
         return `${platform}-${arch}`;
     if (platform === "darwin")
         return `darwin-${arch}`;
+    if (platform === "win32")
+        return `win32-${arch}-msvc`;
     if (platform === "linux")
         return `linux-${arch}-${isMusl(host, fs) ? "musl" : "gnu"}`;
-    if (platform === "win32") {
-        // The loader sends these Windows x64 hosts to win32-x64-gnu, which polyjose doesn't publish.
-        const v = host.config?.variables;
-        if (arch === "x64" && (v?.shlib_suffix === "dll.a" || v?.node_target_type === "shared_library"))
-            return "win32-x64-gnu";
-        return `win32-${arch}-msvc`;
-    }
     return `${platform}-${arch}`;
 }
 /**
- * musl or glibc, decided as the loader's `isMusl` decides it, in its order: `/usr/bin/ldd` names
- * musl or not; else the process report (setting `excludeNetwork` first, as the loader does): a
- * glibc runtime version means glibc, a `libc.musl-`/`ld-musl-` shared object means musl. The
- * loader's last resort, `ldd --version` in a child process, is not run: without a report this
- * refuses instead of guessing.
+ * musl or glibc, decided in napi-rs's order (its generated `isMusl`): `/usr/bin/ldd` names musl
+ * or not (glibc ships ldd as a script of its own, musl's runs `ld-musl-*`); if it cannot be read,
+ * the process report, taken with `excludeNetwork` set (restored after): a glibc runtime version
+ * means glibc, else a `libc.musl-`/`ld-musl-` shared object means musl. napi-rs's last resort,
+ * `ldd --version` in a child process, is not run: without a usable report this refuses instead
+ * of guessing.
  */
 function isMusl(host, fs) {
     try {
         return fs.readFileSync("/usr/bin/ldd", "utf8").includes("musl");
     }
     catch {
-        // Unreadable: ask the process report, as the loader does.
+        // Unreadable: ask the process report, as napi-rs does.
     }
     const report = host.report;
     if (report === undefined || typeof report.getReport !== "function") {
-        return refuse("cannot tell glibc from musl (no /usr/bin/ldd, no process report); refusing to load");
+        return refuse(`cannot tell glibc from musl on linux-${host.arch} (no /usr/bin/ldd, no process report); refusing to load`);
     }
+    const before = report.excludeNetwork;
     report.excludeNetwork = true;
-    const r = report.getReport();
-    if (r === null || typeof r !== "object")
-        return refuse("cannot tell glibc from musl (empty process report)");
+    let r;
+    try {
+        r = report.getReport();
+    }
+    finally {
+        report.excludeNetwork = before;
+    }
+    if (r === null || typeof r !== "object") {
+        return refuse(`cannot tell glibc from musl on linux-${host.arch} (empty process report); refusing to load`);
+    }
     if (r.header?.glibcVersionRuntime)
         return false;
     const objects = r.sharedObjects;
     const musl = (f) => typeof f === "string" && (f.includes("libc.musl-") || f.includes("ld-musl-"));
     return Array.isArray(objects) && objects.some(musl);
 }
-/** Step a: the package's addon hash map, validated, as a null-prototype record. */
-function readPins(req, fs) {
-    const file = resolved(req, PINS);
-    if (file === null) {
+/** Step 2: the package's addon hash map, validated, as a null-prototype record. */
+function readPins(fs, file) {
+    let text;
+    try {
+        text = fs.readFileSync(file, "utf8");
+    }
+    catch {
         return refuse("addon-sha256.json is missing, so no native addon is trusted; this package was not assembled by polyjose's build");
     }
     let parsed;
     try {
-        parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+        parsed = JSON.parse(text);
     }
     catch {
         return refuse("addon-sha256.json is not valid JSON; refusing to load");
@@ -264,13 +151,13 @@ function readPins(req, fs) {
         parsed !== null &&
         !Array.isArray(parsed) &&
         Object.entries(parsed).every(([platform, hash]) => {
-            if (!PUBLISHED_PLATFORMS.includes(platform) || typeof hash !== "string" || !/^[0-9a-f]{64}$/.test(hash))
+            if (!SHIPPED.includes(platform) || typeof hash !== "string" || !/^[0-9a-f]{64}$/.test(hash))
                 return false;
             pins[platform] = hash;
             return true;
         });
     if (!valid) {
-        return refuse("addon-sha256.json is not a map of published platforms to lowercase SHA-256 hex; refusing to load");
+        return refuse("addon-sha256.json is not a map of shipped platforms to lowercase SHA-256 hex; refusing to load");
     }
     return pins;
 }
@@ -278,101 +165,89 @@ function readPins(req, fs) {
 function sha256(crypto, bytes) {
     return crypto.createHash("sha256").update(bytes).digest("hex");
 }
-/** Step b: the one file the loader would load on this host, and how it was named. */
-function pickSource(host, req, platform) {
-    const override = host.env[OVERRIDE];
-    const overridden = override !== undefined && override !== "";
-    const ids = overridden ? [override] : [`./polyjose.${platform}.node`, `@polyjose/node-${platform}`];
-    for (const id of ids) {
-        const file = resolved(req, id);
-        if (file !== null)
-            return { file, name: overridden ? OVERRIDE : id };
-    }
-    return refuse(`no native addon for ${platform} is installed (@polyjose/node-${platform}); reinstall without --omit=optional`);
-}
 /**
- * Steps a-d: loads `binding.cjs` with the override pointing at a private, hash-checked copy of
- * the addon. Returns what it loaded and the copy's path (the CommonJS cache key, step 4).
+ * Steps 1-4: requires a private, hash-checked copy of this package's addon for this host. Returns
+ * what it loaded and the copy's path (the CommonJS cache key, step 5).
  */
-function loadPinned(host, req, b) {
-    const pins = readPins(req, b.fs);
-    const platform = hostPlatform(host, b.fs);
+function loadPinned(host, req, b, dir) {
+    const platform = detectPlatform(host, b.fs);
+    if (!SHIPPED.includes(platform)) {
+        return refuse(`there is no native addon for ${platform} (this package ships ${SHIPPED.join(", ")}); ` +
+            "use @polyjose/wasm, which has the same API and runs on every platform");
+    }
+    const pins = readPins(b.fs, b.path.join(dir, PINS));
     const expected = pins[platform];
     if (expected === undefined) {
         const listed = Object.keys(pins).sort().join(", ");
         return refuse(`this package has no pinned SHA-256 for ${platform} (addon-sha256.json lists ${listed || "none"}); refusing to load`);
     }
-    const source = pickSource(host, req, platform);
-    const bytes = b.fs.readFileSync(source.file);
+    const name = `polyjose.${platform}.node`;
+    let bytes;
+    try {
+        bytes = b.fs.readFileSync(b.path.join(dir, name));
+    }
+    catch {
+        return refuse(`./${name} is missing from this package or cannot be read; reinstall @polyjose/node`);
+    }
     const actual = sha256(b.crypto, bytes);
     if (actual !== expected) {
-        refuse(`${source.name} for ${platform} has SHA-256 ${actual}, but this package pins ${expected}; refusing to load it`);
+        refuse(`./${name} for ${platform} has SHA-256 ${actual}, but this package pins ${expected}; refusing to load it`);
     }
     // The real path, as the CommonJS cache keys it (macOS's tmpdir is a symlink).
-    const dir = b.fs.realpathSync(b.fs.mkdtempSync(b.path.join(b.os.tmpdir(), "polyjose-addon-")));
+    const tmp = b.fs.realpathSync(b.fs.mkdtempSync(b.path.join(b.os.tmpdir(), "polyjose-addon-")));
     try {
-        const copy = b.path.join(dir, `polyjose-${b.crypto.randomBytes(16).toString("hex")}.node`);
+        const copy = b.path.join(tmp, `polyjose-${b.crypto.randomBytes(16).toString("hex")}.node`);
         b.fs.writeFileSync(copy, bytes, { flag: "wx", mode: 0o700 });
         if (sha256(b.crypto, b.fs.readFileSync(copy)) !== expected) {
             refuse(`the private copy of the addon for ${platform} does not have the pinned SHA-256; refusing to load it`);
         }
-        const previous = host.env[OVERRIDE];
-        host.env[OVERRIDE] = copy;
-        try {
-            return { loaded: req("./binding.cjs"), copy };
-        }
-        finally {
-            if (previous === undefined)
-                delete host.env[OVERRIDE];
-            else
-                host.env[OVERRIDE] = previous;
-        }
+        return { loaded: req(copy), copy };
     }
     finally {
         try {
-            b.fs.rmSync(dir, { recursive: true, force: true });
+            b.fs.rmSync(tmp, { recursive: true, force: true });
         }
         catch {
             // Windows can't delete a DLL while it is loaded; the copy stays in the temporary directory.
         }
     }
 }
-/** Steps 4-6 of the module comment: the loaded binding is this release's native addon. */
-function checkLoaded(req, loaded, copy) {
+/** Steps 5-6: the loaded binding is the private copy, at this package's version. */
+function checkLoaded(req, b, dir, loaded, copy) {
     if (typeof loaded !== "object" || loaded === null) {
-        return refuse("the loader returned no binding object");
+        return refuse("the native addon returned no binding object");
     }
     const owners = Object.keys(req.cache).filter((file) => req.cache[file]?.exports === loaded);
-    const addons = owners.filter((file) => file.endsWith(".node"));
-    // A second copy of this package (another path, same platform package) has its own binding.cjs.
-    const others = owners.filter((file) => !file.endsWith(".node") && !/[\\/]binding\.cjs$/.test(file));
-    if (addons.length !== 1 || addons[0] !== copy || others.length !== 0) {
+    if (owners.length !== 1 || owners[0] !== copy) {
         refuse("the loaded binding is not exactly the hash-checked native addon; refusing to load");
     }
-    if (loaded.__napiBindingTarget !== "native") {
-        refuse('the loaded binding is not the native addon (__napiBindingTarget is not "native")');
+    let expected;
+    try {
+        expected = JSON.parse(b.fs.readFileSync(b.path.join(dir, "package.json"), "utf8")).version;
+    }
+    catch {
+        expected = undefined;
     }
-    const expected = req("./package.json").version;
     const actual = typeof loaded.version === "function" ? loaded.version() : undefined;
     if (typeof expected !== "string" || actual !== expected) {
         refuse(`the native addon is version ${String(actual)}, but this package is ${String(expected)}; reinstall it`);
     }
     return loaded;
 }
-/** Loads `binding.cjs` only when it can load nothing but the pinned native addon (the module comment). */
+/** Loads this package's pinned native addon for this host (the module comment). */
 function loadBinding(host, moduleUrl) {
-    // backend.js and binding.cjs are siblings, so this resolves exactly as the loader does.
-    const req = host.getBuiltinModule("node:module").createRequire(moduleUrl);
-    checkCandidates(host, req);
     const builtins = {
         fs: host.getBuiltinModule("node:fs"),
         crypto: host.getBuiltinModule("node:crypto"),
         os: host.getBuiltinModule("node:os"),
         path: host.getBuiltinModule("node:path"),
     };
-    const { loaded, copy } = loadPinned(host, req, builtins);
-    return checkLoaded(req, loaded, copy);
+    // The package directory: backend.js sits at its root, next to the addons and the pins.
+    const dir = builtins.path.dirname(host.getBuiltinModule("node:url").fileURLToPath(moduleUrl));
+    const req = host.getBuiltinModule("node:module").createRequire(moduleUrl);
+    const { loaded, copy } = loadPinned(host, req, builtins, dir);
+    return checkLoaded(req, builtins, dir, loaded, copy);
 }
 const binding = loadBinding(globalThis.process, import.meta.url);
-/** The napi loader, typed as the facade's backend. */
+/** The native addon, typed as the facade's backend. */
 export const backend = binding;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@polyjose/node",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "polyjose for Node.js: JOSE (JWS, JWE, JWK, JWT) in pure Rust through Node-API, with the shared TypeScript facade (ADR 0031, ADR 0047).",
   "license": "MIT",
   "repository": {
@@ -26,8 +26,14 @@
     "backend.d.ts",
     "facade/*.js",
     "facade/*.d.ts",
-    "binding.cjs",
-    "binding.d.ts",
+    "polyjose.darwin-x64.node",
+    "polyjose.darwin-arm64.node",
+    "polyjose.linux-x64-gnu.node",
+    "polyjose.linux-arm64-gnu.node",
+    "polyjose.linux-x64-musl.node",
+    "polyjose.linux-arm64-musl.node",
+    "polyjose.win32-x64-msvc.node",
+    "polyjose.win32-arm64-msvc.node",
     "addon-sha256.json",
     "LICENSE",
     "README.md",
@@ -52,15 +58,5 @@
   },
   "devDependencies": {
     "@napi-rs/cli": "3.10.12"
-  },
-  "optionalDependencies": {
-    "@polyjose/node-darwin-arm64": "0.1.1",
-    "@polyjose/node-darwin-x64": "0.1.1",
-    "@polyjose/node-linux-arm64-gnu": "0.1.1",
-    "@polyjose/node-linux-arm64-musl": "0.1.1",
-    "@polyjose/node-linux-x64-gnu": "0.1.1",
-    "@polyjose/node-linux-x64-musl": "0.1.1",
-    "@polyjose/node-win32-arm64-msvc": "0.1.1",
-    "@polyjose/node-win32-x64-msvc": "0.1.1"
   }
 }