@zensre/lenny-napi 0.0.0 → 0.0.1

package/README.md

@@ -0,0 +1,90 @@
+# @zensre/lenny-napi
+
+Native Node.js bindings for the [Lenny](https://github.com/ZenSRE/lenny) secret redaction engine.
+
+Scans and redacts known secrets using BLAKE3 + rolling hash (no secret values stored in memory at runtime). Includes 216 built-in pattern rules for detecting unknown secrets (API keys, tokens, connection strings).
+
+## Installation
+
+```bash
+npm install @zensre/lenny-napi
+```
+
+Requires Node.js 18+. Prebuilt binaries for Linux (x86_64, aarch64) and macOS (x86_64, aarch64).
+
+## Usage
+
+### Exact-match redaction
+
+```js
+const { Engine, PatternScanner } = require('@zensre/lenny-napi');
+
+const engine = new Engine();
+engine.loadSecrets([{ name: 'db_pass', value: 'hunter2' }]);
+
+const result = engine.scan('password is hunter2');
+console.log(result.output.toString()); // "password is [REDACTED:db_pass]"
+console.log(result.hasRedactions);      // true
+```
+
+### Pattern scanning
+
+```js
+const scanner = new PatternScanner();
+const matches = scanner.scan('GITHUB_TOKEN=ghp_abc123def456ghi789jkl012mno345pqr678');
+console.log(matches[0].ruleId);      // "github-pat"
+console.log(matches[0].description); // "GitHub Personal Access Token"
+```
+
+### Streaming with Transform
+
+```js
+const { ScanTransform } = require('@zensre/lenny-napi');
+
+const transform = new ScanTransform();
+transform.engine.loadSecrets([{ name: 'key', value: 'secret123' }]);
+
+process.stdin.pipe(transform).pipe(process.stdout);
+```
+
+## API
+
+### `new Engine(opts?)`
+
+Creates a scanning engine. Options: `{ patterns: boolean }` (default: true).
+
+### `engine.loadSecrets(secrets)`
+
+Load secrets from an array of objects. Required: `name` (string), `value` (string).
+
+Optional fields:
+- `tier`: `"log"` (default), `"alert"`, or `"page"`
+- `redaction`: `"tagged"` (default), `"full"`, or `"partial"`
+- `redactionPrefix` / `redactionSuffix`: bytes to show for partial (default: 4)
+- `canary`: boolean (default: false)
+- `transformations`: array of `"base64"` and/or `"url"`
+
+### `engine.scan(input) -> ScanResult`
+
+Scan input (string or Buffer). Returns:
+- `output` (Buffer) -- redacted output
+- `hasRedactions`, `hasCanaryHit`, `hasExactMatchRedactions` (boolean)
+- `eventCount` (number)
+- `events` (RedactionEvent[]) -- `secretName`, `tier`, `isCanary`, `byteOffset`, `matchedLen`, `contextSnippet`, `source`
+
+### `new PatternScanner()`
+
+- `scan(input)` -- returns PatternMatchResult[] with `ruleId`, `description`, `tier`, `start`, `end`
+- `ruleCount()` -- returns number of loaded rules
+
+## WASM Alternative
+
+For universal compatibility (browsers, serverless, any OS), see [`lenny-wasm`](https://www.npmjs.com/package/lenny-wasm).
+
+## Full Documentation
+
+See the [Lenny project](https://github.com/ZenSRE/lenny) for configuration, deployment, threat model, and the complete list of pattern rules.
+
+## License
+
+MIT

package/index.d.ts

@@ -0,0 +1,77 @@
+/* auto-generated by NAPI-RS */
+/* eslint-disable */
+export declare class Engine {
+  /**
+   * Create a new scanning engine.
+   *
+   * By default, built-in pattern scanning (gitleaks-compatible rules) is
+   * enabled so unknown secrets such as AWS keys and GitHub tokens are also
+   * detected. Pass `{ patterns: false }` to disable pattern scanning and
+   * perform exact-match only.
+   */
+  constructor(opts?: EngineOptions | undefined | null)
+  /**
+   * Load secrets from an array of objects.
+   *
+   * Each object must have at minimum `name` (string) and `value` (string).
+   * Optional fields:
+   * - `tier`: `"log"` (default) | `"alert"` | `"page"`
+   * - `redaction`: `"full"` | `"tagged"` (default)
+   * - `canary`: boolean (default false)
+   * - `transformations`: array of `"base64"` | `"url"`
+   */
+  loadSecrets(secrets: Array<SecretInput>): void
+  maxSecretLength(): number
+  /** Scan a buffer or string for secrets. Returns a `ScanResult`. */
+  scan(input: string | Buffer): ScanResult
+}
+
+export declare class PatternScanner {
+  constructor()
+  scan(input: string | Buffer): Array<PatternMatchResult>
+  /** Returns the number of loaded pattern rules. */
+  ruleCount(): number
+}
+
+export interface EngineOptions {
+  /** Enable built-in pattern scanning (default: true). */
+  patterns?: boolean
+}
+
+export interface PatternMatchResult {
+  ruleId: string
+  description: string
+  tier: string
+  start: number
+  end: number
+}
+
+export interface RedactionEvent {
+  secretName: string
+  tier: string
+  isCanary: boolean
+  byteOffset: number
+  matchedLen: number
+  contextSnippet: string
+  source?: string
+}
+
+export interface ScanResult {
+  output: Buffer
+  hasRedactions: boolean
+  hasCanaryHit: boolean
+  hasExactMatchRedactions: boolean
+  eventCount: number
+  events: Array<RedactionEvent>
+}
+
+export interface SecretInput {
+  name: string
+  value: string
+  tier?: string
+  redaction?: string
+  redactionPrefix?: number
+  redactionSuffix?: number
+  canary?: boolean
+  transformations?: Array<string>
+}

package/index.js

@@ -0,0 +1,65 @@
+'use strict';
+
+// Load the native symbols via the napi-rs generated loader (native.js),
+// which handles platform-specific .node filename resolution.
+// Falls back to loading lenny.node directly for local development.
+let native;
+try {
+  native = require('./native.js');
+} catch (_) {
+  native = require('./lenny.node');
+}
+
+// Re-export all native symbols.
+const { Engine, PatternScanner } = native;
+exports.Engine = Engine;
+exports.PatternScanner = PatternScanner;
+
+// ---------------------------------------------------------------------------
+// ScanTransform — Node.js Transform stream wrapper around Engine.scan()
+//
+// Usage:
+//   const { Engine, ScanTransform } = require('@zensre/lenny-napi');
+//   const engine = new Engine();
+//   engine.loadSecrets([{ name: 'db_pass', value: 'hunter2' }]);
+//   const transform = new ScanTransform(engine);
+//   req.pipe(transform).pipe(res);
+//
+// Note: secrets that span chunk boundaries will not be detected.
+// For complete coverage, buffer the entire input before scanning, or
+// use engine.scan() directly on complete messages.
+// ---------------------------------------------------------------------------
+
+const { Transform } = require('stream');
+
+class ScanTransform extends Transform {
+  constructor(engine, opts) {
+    super(opts);
+    if (!(engine instanceof Engine)) {
+      throw new TypeError('ScanTransform requires an Engine instance');
+    }
+    this._engine = engine;
+  }
+
+  _transform(chunk, encoding, callback) {
+    try {
+      const result = this._engine.scan(chunk);
+      this.push(result.output);
+
+      if (result.events) {
+        for (const event of result.events) {
+          this.emit('redaction', event);
+        }
+      }
+      if (result.hasCanaryHit) {
+        this.emit('canary', result);
+      }
+
+      callback();
+    } catch (e) {
+      callback(e);
+    }
+  }
+}
+
+exports.ScanTransform = ScanTransform;

package/native.js

@@ -0,0 +1,580 @@
+// prettier-ignore
+/* eslint-disable */
+// @ts-nocheck
+/* auto-generated by NAPI-RS */
+
+const { readFileSync } = require('node:fs')
+let nativeBinding = null
+const loadErrors = []
+
+const isMusl = () => {
+  let musl = false
+  if (process.platform === 'linux') {
+    musl = isMuslFromFilesystem()
+    if (musl === null) {
+      musl = isMuslFromReport()
+    }
+    if (musl === null) {
+      musl = isMuslFromChildProcess()
+    }
+  }
+  return musl
+}
+
+const isFileMusl = (f) => f.includes('libc.musl-') || f.includes('ld-musl-')
+
+const isMuslFromFilesystem = () => {
+  try {
+    return readFileSync('/usr/bin/ldd', 'utf-8').includes('musl')
+  } catch {
+    return null
+  }
+}
+
+const isMuslFromReport = () => {
+  let report = null
+  if (typeof process.report?.getReport === 'function') {
+    process.report.excludeNetwork = true
+    report = process.report.getReport()
+  }
+  if (!report) {
+    return null
+  }
+  if (report.header && report.header.glibcVersionRuntime) {
+    return false
+  }
+  if (Array.isArray(report.sharedObjects)) {
+    if (report.sharedObjects.some(isFileMusl)) {
+      return true
+    }
+  }
+  return false
+}
+
+const isMuslFromChildProcess = () => {
+  try {
+    return require('child_process').execSync('ldd --version', { encoding: 'utf8' }).includes('musl')
+  } catch (e) {
+    // If we reach this case, we don't know if the system is musl or not, so is better to just fallback to false
+    return false
+  }
+}
+
+function requireNative() {
+  if (process.env.NAPI_RS_NATIVE_LIBRARY_PATH) {
+    try {
+      return require(process.env.NAPI_RS_NATIVE_LIBRARY_PATH);
+    } catch (err) {
+      loadErrors.push(err)
+    }
+  } else if (process.platform === 'android') {
+    if (process.arch === 'arm64') {
+      try {
+        return require('./lenny.android-arm64.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@zensre/lenny-napi-android-arm64')
+        const bindingPackageVersion = require('@zensre/lenny-napi-android-arm64/package.json').version
+        if (bindingPackageVersion !== '0.0.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 'arm') {
+      try {
+        return require('./lenny.android-arm-eabi.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@zensre/lenny-napi-android-arm-eabi')
+        const bindingPackageVersion = require('@zensre/lenny-napi-android-arm-eabi/package.json').version
+        if (bindingPackageVersion !== '0.0.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else {
+      loadErrors.push(new Error(`Unsupported architecture on Android ${process.arch}`))
+    }
+  } else if (process.platform === 'win32') {
+    if (process.arch === 'x64') {
+      if (process.config?.variables?.shlib_suffix === 'dll.a' || process.config?.variables?.node_target_type === 'shared_library') {
+        try {
+        return require('./lenny.win32-x64-gnu.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@zensre/lenny-napi-win32-x64-gnu')
+        const bindingPackageVersion = require('@zensre/lenny-napi-win32-x64-gnu/package.json').version
+        if (bindingPackageVersion !== '0.0.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      } else {
+        try {
+        return require('./lenny.win32-x64-msvc.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@zensre/lenny-napi-win32-x64-msvc')
+        const bindingPackageVersion = require('@zensre/lenny-napi-win32-x64-msvc/package.json').version
+        if (bindingPackageVersion !== '0.0.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      }
+    } else if (process.arch === 'ia32') {
+      try {
+        return require('./lenny.win32-ia32-msvc.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@zensre/lenny-napi-win32-ia32-msvc')
+        const bindingPackageVersion = require('@zensre/lenny-napi-win32-ia32-msvc/package.json').version
+        if (bindingPackageVersion !== '0.0.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 'arm64') {
+      try {
+        return require('./lenny.win32-arm64-msvc.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@zensre/lenny-napi-win32-arm64-msvc')
+        const bindingPackageVersion = require('@zensre/lenny-napi-win32-arm64-msvc/package.json').version
+        if (bindingPackageVersion !== '0.0.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else {
+      loadErrors.push(new Error(`Unsupported architecture on Windows: ${process.arch}`))
+    }
+  } else if (process.platform === 'darwin') {
+    try {
+      return require('./lenny.darwin-universal.node')
+    } catch (e) {
+      loadErrors.push(e)
+    }
+    try {
+      const binding = require('@zensre/lenny-napi-darwin-universal')
+      const bindingPackageVersion = require('@zensre/lenny-napi-darwin-universal/package.json').version
+      if (bindingPackageVersion !== '0.0.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+        throw new Error(`Native binding package version mismatch, expected 0.0.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+      }
+      return binding
+    } catch (e) {
+      loadErrors.push(e)
+    }
+    if (process.arch === 'x64') {
+      try {
+        return require('./lenny.darwin-x64.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@zensre/lenny-napi-darwin-x64')
+        const bindingPackageVersion = require('@zensre/lenny-napi-darwin-x64/package.json').version
+        if (bindingPackageVersion !== '0.0.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 'arm64') {
+      try {
+        return require('./lenny.darwin-arm64.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@zensre/lenny-napi-darwin-arm64')
+        const bindingPackageVersion = require('@zensre/lenny-napi-darwin-arm64/package.json').version
+        if (bindingPackageVersion !== '0.0.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else {
+      loadErrors.push(new Error(`Unsupported architecture on macOS: ${process.arch}`))
+    }
+  } else if (process.platform === 'freebsd') {
+    if (process.arch === 'x64') {
+      try {
+        return require('./lenny.freebsd-x64.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@zensre/lenny-napi-freebsd-x64')
+        const bindingPackageVersion = require('@zensre/lenny-napi-freebsd-x64/package.json').version
+        if (bindingPackageVersion !== '0.0.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 'arm64') {
+      try {
+        return require('./lenny.freebsd-arm64.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@zensre/lenny-napi-freebsd-arm64')
+        const bindingPackageVersion = require('@zensre/lenny-napi-freebsd-arm64/package.json').version
+        if (bindingPackageVersion !== '0.0.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else {
+      loadErrors.push(new Error(`Unsupported architecture on FreeBSD: ${process.arch}`))
+    }
+  } else if (process.platform === 'linux') {
+    if (process.arch === 'x64') {
+      if (isMusl()) {
+        try {
+          return require('./lenny.linux-x64-musl.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('@zensre/lenny-napi-linux-x64-musl')
+          const bindingPackageVersion = require('@zensre/lenny-napi-linux-x64-musl/package.json').version
+          if (bindingPackageVersion !== '0.0.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.0.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      } else {
+        try {
+          return require('./lenny.linux-x64-gnu.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('@zensre/lenny-napi-linux-x64-gnu')
+          const bindingPackageVersion = require('@zensre/lenny-napi-linux-x64-gnu/package.json').version
+          if (bindingPackageVersion !== '0.0.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.0.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      }
+    } else if (process.arch === 'arm64') {
+      if (isMusl()) {
+        try {
+          return require('./lenny.linux-arm64-musl.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('@zensre/lenny-napi-linux-arm64-musl')
+          const bindingPackageVersion = require('@zensre/lenny-napi-linux-arm64-musl/package.json').version
+          if (bindingPackageVersion !== '0.0.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.0.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      } else {
+        try {
+          return require('./lenny.linux-arm64-gnu.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('@zensre/lenny-napi-linux-arm64-gnu')
+          const bindingPackageVersion = require('@zensre/lenny-napi-linux-arm64-gnu/package.json').version
+          if (bindingPackageVersion !== '0.0.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.0.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      }
+    } else if (process.arch === 'arm') {
+      if (isMusl()) {
+        try {
+          return require('./lenny.linux-arm-musleabihf.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('@zensre/lenny-napi-linux-arm-musleabihf')
+          const bindingPackageVersion = require('@zensre/lenny-napi-linux-arm-musleabihf/package.json').version
+          if (bindingPackageVersion !== '0.0.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.0.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      } else {
+        try {
+          return require('./lenny.linux-arm-gnueabihf.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('@zensre/lenny-napi-linux-arm-gnueabihf')
+          const bindingPackageVersion = require('@zensre/lenny-napi-linux-arm-gnueabihf/package.json').version
+          if (bindingPackageVersion !== '0.0.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.0.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      }
+    } else if (process.arch === 'loong64') {
+      if (isMusl()) {
+        try {
+          return require('./lenny.linux-loong64-musl.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('@zensre/lenny-napi-linux-loong64-musl')
+          const bindingPackageVersion = require('@zensre/lenny-napi-linux-loong64-musl/package.json').version
+          if (bindingPackageVersion !== '0.0.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.0.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      } else {
+        try {
+          return require('./lenny.linux-loong64-gnu.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('@zensre/lenny-napi-linux-loong64-gnu')
+          const bindingPackageVersion = require('@zensre/lenny-napi-linux-loong64-gnu/package.json').version
+          if (bindingPackageVersion !== '0.0.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.0.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      }
+    } else if (process.arch === 'riscv64') {
+      if (isMusl()) {
+        try {
+          return require('./lenny.linux-riscv64-musl.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('@zensre/lenny-napi-linux-riscv64-musl')
+          const bindingPackageVersion = require('@zensre/lenny-napi-linux-riscv64-musl/package.json').version
+          if (bindingPackageVersion !== '0.0.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.0.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      } else {
+        try {
+          return require('./lenny.linux-riscv64-gnu.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('@zensre/lenny-napi-linux-riscv64-gnu')
+          const bindingPackageVersion = require('@zensre/lenny-napi-linux-riscv64-gnu/package.json').version
+          if (bindingPackageVersion !== '0.0.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.0.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      }
+    } else if (process.arch === 'ppc64') {
+      try {
+        return require('./lenny.linux-ppc64-gnu.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@zensre/lenny-napi-linux-ppc64-gnu')
+        const bindingPackageVersion = require('@zensre/lenny-napi-linux-ppc64-gnu/package.json').version
+        if (bindingPackageVersion !== '0.0.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 's390x') {
+      try {
+        return require('./lenny.linux-s390x-gnu.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@zensre/lenny-napi-linux-s390x-gnu')
+        const bindingPackageVersion = require('@zensre/lenny-napi-linux-s390x-gnu/package.json').version
+        if (bindingPackageVersion !== '0.0.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else {
+      loadErrors.push(new Error(`Unsupported architecture on Linux: ${process.arch}`))
+    }
+  } else if (process.platform === 'openharmony') {
+    if (process.arch === 'arm64') {
+      try {
+        return require('./lenny.openharmony-arm64.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@zensre/lenny-napi-openharmony-arm64')
+        const bindingPackageVersion = require('@zensre/lenny-napi-openharmony-arm64/package.json').version
+        if (bindingPackageVersion !== '0.0.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 'x64') {
+      try {
+        return require('./lenny.openharmony-x64.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@zensre/lenny-napi-openharmony-x64')
+        const bindingPackageVersion = require('@zensre/lenny-napi-openharmony-x64/package.json').version
+        if (bindingPackageVersion !== '0.0.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 'arm') {
+      try {
+        return require('./lenny.openharmony-arm.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('@zensre/lenny-napi-openharmony-arm')
+        const bindingPackageVersion = require('@zensre/lenny-napi-openharmony-arm/package.json').version
+        if (bindingPackageVersion !== '0.0.1' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.1 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else {
+      loadErrors.push(new Error(`Unsupported architecture on OpenHarmony: ${process.arch}`))
+    }
+  } else {
+    loadErrors.push(new Error(`Unsupported OS: ${process.platform}, architecture: ${process.arch}`))
+  }
+}
+
+nativeBinding = requireNative()
+
+if (!nativeBinding || process.env.NAPI_RS_FORCE_WASI) {
+  let wasiBinding = null
+  let wasiBindingError = null
+  try {
+    wasiBinding = require('./lenny.wasi.cjs')
+    nativeBinding = wasiBinding
+  } catch (err) {
+    if (process.env.NAPI_RS_FORCE_WASI) {
+      wasiBindingError = err
+    }
+  }
+  if (!nativeBinding || process.env.NAPI_RS_FORCE_WASI) {
+    try {
+      wasiBinding = require('@zensre/lenny-napi-wasm32-wasi')
+      nativeBinding = wasiBinding
+    } catch (err) {
+      if (process.env.NAPI_RS_FORCE_WASI) {
+        if (!wasiBindingError) {
+          wasiBindingError = err
+        } else {
+          wasiBindingError.cause = err
+        }
+        loadErrors.push(err)
+      }
+    }
+  }
+  if (process.env.NAPI_RS_FORCE_WASI === 'error' && !wasiBinding) {
+    const error = new Error('WASI binding not found and NAPI_RS_FORCE_WASI is set to error')
+    error.cause = wasiBindingError
+    throw error
+  }
+}
+
+if (!nativeBinding) {
+  if (loadErrors.length > 0) {
+    throw new Error(
+      `Cannot find native binding. ` +
+        `npm has a bug related to optional dependencies (https://github.com/npm/cli/issues/4828). ` +
+        'Please try `npm i` again after removing both package-lock.json and node_modules directory.',
+      {
+        cause: loadErrors.reduce((err, cur) => {
+          cur.cause = err
+          return cur
+        }),
+      },
+    )
+  }
+  throw new Error(`Failed to load native binding`)
+}
+
+module.exports = nativeBinding
+module.exports.Engine = nativeBinding.Engine
+module.exports.PatternScanner = nativeBinding.PatternScanner

package/package.json

@@ -1 +1,38 @@
-{"name":"@zensre/lenny-napi","version":"0.0.0","description":"Native Node.js bindings for Lenny secret redaction engine"}
+{
+  "name": "@zensre/lenny-napi",
+  "version": "0.0.1",
+  "description": "Native Node.js bindings for Lenny secret redaction engine",
+  "main": "index.js",
+  "types": "index.d.ts",
+  "napi": {
+    "name": "lenny",
+    "triples": {
+      "defaults": false,
+      "additional": [
+        "x86_64-unknown-linux-gnu",
+        "x86_64-unknown-linux-musl",
+        "aarch64-unknown-linux-gnu",
+        "aarch64-unknown-linux-musl",
+        "x86_64-apple-darwin",
+        "aarch64-apple-darwin"
+      ]
+    }
+  },
+  "license": "(MIT OR Apache-2.0)",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/ZenSRE/lenny"
+  },
+  "files": [
+    "index.js",
+    "index.d.ts",
+    "native.js"
+  ],
+  "scripts": {
+    "build": "napi build --platform --release",
+    "prepublishOnly": "napi prepublish -t npm"
+  },
+  "devDependencies": {
+    "@napi-rs/cli": "^3.0.0"
+  }
+}