node-tpm2 0.0.1 → 0.0.3

package/README.md

@@ -3,11 +3,46 @@
 Native TPM 2.0 for Node. Zero tooling, no admin.
 
 - Windows via TBS, Linux via `/dev/tpmrm0`.
-- Ships as prebuilt native binaries: `npm install node-tpm2` pulls one binary, no build step, no tpm2-tools, no PATH edits.
-- Subsystem API: `tpm.pcr`, `tpm.keys`, `tpm.random`, `tpm.nv`, `tpm.attest`.
+- Direct TBS command marshalling — no tpm2-tss, no tpm2-tools at install or runtime.
+- Ships as prebuilt native binaries via napi-rs platform packages.
 
-> **Status: pre-release placeholder.** The native backend is not published yet.
-> `Tpm.open()` throws `NOT_IMPLEMENTED` until the first working release. Watch this repo.
+> **Status: pre-release.** `Tpm.isAvailable()` and `Tpm.info()` work on Windows and Linux.
+> `Tpm.open()` and attestation methods are not implemented yet.
+
+## Install
+
+```bash
+npm install node-tpm2
+```
+
+npm resolves exactly one prebuilt native binary from `optionalDependencies` — no build step,
+no tpm2-tools, no Rust. Requires platform packages published for your OS/arch.
+
+## Development
+
+```bash
+git clone https://github.com/stacks0x/tpm2.git
+cd tpm2
+npm install
+npm run build
+node --input-type=module -e "
+  import { Tpm } from './index.js';
+  console.log('available', await Tpm.isAvailable());
+  console.log('info', await Tpm.info());
+"
+```
+
+On Linux, your user needs read/write on `/dev/tpmrm0` (typically the `tss` group).
+
+## Windows probe (direct TBS validation)
+
+Non-elevated PowerShell on Windows 11:
+
+```powershell
+cargo run --bin tbs-probe -- all
+```
+
+See [spike/README.md](./spike/README.md) for probe details and RC discipline.
 
 ## License
 

package/api.js

@@ -0,0 +1,69 @@
+let native = null;
+let nativeLoadError = null;
+
+try {
+  const { createRequire } = await import('node:module');
+  const require = createRequire(import.meta.url);
+  native = require('./native.cjs');
+} catch (err) {
+  nativeLoadError = err;
+}
+
+export class TpmError extends Error {
+  constructor(code, message, suggestion, tpmRc) {
+    super(message);
+    this.name = 'TpmError';
+    this.code = code;
+    this.suggestion = suggestion;
+    this.tpmRc = tpmRc;
+  }
+}
+
+export const Tpm = {
+  /** Probe for an accessible TPM. False on darwin / no TPM / no access. */
+  async isAvailable() {
+    if (!native?.isAvailable) {
+      return false;
+    }
+    try {
+      return await native.isAvailable();
+    } catch {
+      return false;
+    }
+  },
+
+  /** Open a TPM handle. Not implemented in v0.0.x. */
+  async open() {
+    if (!native?.isAvailable) {
+      throw new TpmError(
+        'TPM_UNAVAILABLE',
+        nativeLoadError
+          ? `Native backend not loaded: ${nativeLoadError.message}`
+          : 'Native backend not built for this platform.',
+        'Run npm run build, or install a published platform package.',
+      );
+    }
+    throw new TpmError(
+      'NOT_IMPLEMENTED',
+      'Tpm.open() is not implemented yet; v0.0.x exposes isAvailable() and info() only.',
+      'See https://github.com/stacks0x/tpm2 for release progress.',
+    );
+  },
+
+  /** Manufacturer, firmware, and virtual-TPM hint from GetCapability. */
+  async getFixedProperties() {
+    if (!native?.getFixedProperties) {
+      throw new TpmError(
+        'TPM_UNAVAILABLE',
+        'Native backend not loaded.',
+        'Run npm run build, or install a published platform package.',
+      );
+    }
+    return native.getFixedProperties();
+  },
+
+  /** Alias for getFixedProperties. */
+  async info() {
+    return this.getFixedProperties();
+  },
+};

package/index.d.ts

@@ -1,9 +1,23 @@
 export declare class TpmError extends Error {
   code: string;
   suggestion?: string;
+  tpmRc?: number;
+  constructor(code: string, message: string, suggestion?: string, tpmRc?: number);
 }
 
 export declare const Tpm: {
   isAvailable(): Promise<boolean>;
   open(): Promise<never>;
+  getFixedProperties(): Promise<{
+    manufacturer: string;
+    firmwareVersion: string;
+    isVirtual: boolean;
+    spec: string;
+  }>;
+  info(): Promise<{
+    manufacturer: string;
+    firmwareVersion: string;
+    isVirtual: boolean;
+    spec: string;
+  }>;
 };

package/index.js

@@ -1,23 +1 @@
-export class TpmError extends Error {
-  constructor(code, message, suggestion) {
-    super(message);
-    this.name = 'TpmError';
-    this.code = code;
-    this.suggestion = suggestion;
-  }
-}
-
-export const Tpm = {
-  /** Probe for an accessible TPM. Always false in this pre-release placeholder. */
-  async isAvailable() {
-    return false;
-  },
-  /** Open a TPM handle. Not implemented yet in this pre-release. */
-  async open() {
-    throw new TpmError(
-      'NOT_IMPLEMENTED',
-      'node-tpm2 is a pre-release placeholder; the native backend is not published yet.',
-      'Follow https://github.com/stacks0x/tpm2 for the first working release.',
-    );
-  },
-};
+export { TpmError, Tpm } from './api.js';

package/native.cjs

@@ -0,0 +1,591 @@
+// prettier-ignore
+/* eslint-disable */
+// @ts-nocheck
+/* auto-generated by NAPI-RS */
+
+const { readFileSync } = require('fs')
+let nativeBinding = null
+const loadErrors = []
+
+const isMusl = () => {
+  let musl = false
+  if (process.platform === 'linux') {
+    musl = isMuslFromFilesystem()
+    if (musl === null) {
+      musl = isMuslFromReport()
+    }
+    if (musl === null) {
+      musl = isMuslFromChildProcess()
+    }
+  }
+  return musl
+}
+
+const isFileMusl = (f) => f.includes('libc.musl-') || f.includes('ld-musl-')
+
+const isMuslFromFilesystem = () => {
+  try {
+    return readFileSync('/usr/bin/ldd', 'utf-8').includes('musl')
+  } catch {
+    return null
+  }
+}
+
+const isMuslFromReport = () => {
+  let report = null
+  if (process.report && typeof process.report.getReport === 'function') {
+    process.report.excludeNetwork = true
+    report = process.report.getReport()
+  }
+  if (!report) {
+    return null
+  }
+  if (report.header && report.header.glibcVersionRuntime) {
+    return false
+  }
+  if (Array.isArray(report.sharedObjects)) {
+    if (report.sharedObjects.some(isFileMusl)) {
+      return true
+    }
+  }
+  return false
+}
+
+const isMuslFromChildProcess = () => {
+  try {
+    return require('child_process').execSync('ldd --version', { encoding: 'utf8' }).includes('musl')
+  } catch (e) {
+    // If we reach this case, we don't know if the system is musl or not, so is better to just fallback to false
+    return false
+  }
+}
+
+function requireNative() {
+  if (process.env.NAPI_RS_NATIVE_LIBRARY_PATH) {
+    try {
+      return require(process.env.NAPI_RS_NATIVE_LIBRARY_PATH);
+    } catch (err) {
+      loadErrors.push(err)
+    }
+  } else if (process.platform === 'android') {
+    if (process.arch === 'arm64') {
+      try {
+        return require('./node-tpm2.android-arm64.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('node-tpm2-android-arm64')
+        const bindingPackageVersion = require('node-tpm2-android-arm64/package.json').version
+        if (bindingPackageVersion !== '0.0.3' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.3 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 'arm') {
+      try {
+        return require('./node-tpm2.android-arm-eabi.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('node-tpm2-android-arm-eabi')
+        const bindingPackageVersion = require('node-tpm2-android-arm-eabi/package.json').version
+        if (bindingPackageVersion !== '0.0.3' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.3 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else {
+      loadErrors.push(new Error(`Unsupported architecture on Android ${process.arch}`))
+    }
+  } else if (process.platform === 'win32') {
+    if (process.arch === 'x64') {
+      if ((process.config && process.config.variables && process.config.variables.shlib_suffix === 'dll.a') || (process.config && process.config.variables && process.config.variables.node_target_type === 'shared_library')) {
+        try {
+        return require('./node-tpm2.win32-x64-gnu.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('node-tpm2-win32-x64-gnu')
+        const bindingPackageVersion = require('node-tpm2-win32-x64-gnu/package.json').version
+        if (bindingPackageVersion !== '0.0.3' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.3 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      } else {
+        try {
+        return require('./node-tpm2.win32-x64-msvc.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('node-tpm2-windows-x64-msvc')
+        const bindingPackageVersion = require('node-tpm2-windows-x64-msvc/package.json').version
+        if (bindingPackageVersion !== '0.0.3' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.3 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      }
+    } else if (process.arch === 'ia32') {
+      try {
+        return require('./node-tpm2.win32-ia32-msvc.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('node-tpm2-win32-ia32-msvc')
+        const bindingPackageVersion = require('node-tpm2-win32-ia32-msvc/package.json').version
+        if (bindingPackageVersion !== '0.0.3' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.3 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 'arm64') {
+      try {
+        return require('./node-tpm2.win32-arm64-msvc.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('node-tpm2-windows-arm64-msvc')
+        const bindingPackageVersion = require('node-tpm2-windows-arm64-msvc/package.json').version
+        if (bindingPackageVersion !== '0.0.3' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.3 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else {
+      loadErrors.push(new Error(`Unsupported architecture on Windows: ${process.arch}`))
+    }
+  } else if (process.platform === 'darwin') {
+    try {
+      return require('./node-tpm2.darwin-universal.node')
+    } catch (e) {
+      loadErrors.push(e)
+    }
+    try {
+      const binding = require('node-tpm2-darwin-universal')
+      const bindingPackageVersion = require('node-tpm2-darwin-universal/package.json').version
+      if (bindingPackageVersion !== '0.0.3' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+        throw new Error(`Native binding package version mismatch, expected 0.0.3 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+      }
+      return binding
+    } catch (e) {
+      loadErrors.push(e)
+    }
+    if (process.arch === 'x64') {
+      try {
+        return require('./node-tpm2.darwin-x64.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('node-tpm2-darwin-x64')
+        const bindingPackageVersion = require('node-tpm2-darwin-x64/package.json').version
+        if (bindingPackageVersion !== '0.0.3' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.3 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 'arm64') {
+      try {
+        return require('./node-tpm2.darwin-arm64.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('node-tpm2-darwin-arm64')
+        const bindingPackageVersion = require('node-tpm2-darwin-arm64/package.json').version
+        if (bindingPackageVersion !== '0.0.3' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.3 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else {
+      loadErrors.push(new Error(`Unsupported architecture on macOS: ${process.arch}`))
+    }
+  } else if (process.platform === 'freebsd') {
+    if (process.arch === 'x64') {
+      try {
+        return require('./node-tpm2.freebsd-x64.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('node-tpm2-freebsd-x64')
+        const bindingPackageVersion = require('node-tpm2-freebsd-x64/package.json').version
+        if (bindingPackageVersion !== '0.0.3' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.3 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 'arm64') {
+      try {
+        return require('./node-tpm2.freebsd-arm64.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('node-tpm2-freebsd-arm64')
+        const bindingPackageVersion = require('node-tpm2-freebsd-arm64/package.json').version
+        if (bindingPackageVersion !== '0.0.3' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.3 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else {
+      loadErrors.push(new Error(`Unsupported architecture on FreeBSD: ${process.arch}`))
+    }
+  } else if (process.platform === 'linux') {
+    if (process.arch === 'x64') {
+      if (isMusl()) {
+        try {
+          return require('./node-tpm2.linux-x64-musl.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('node-tpm2-linux-x64-musl')
+          const bindingPackageVersion = require('node-tpm2-linux-x64-musl/package.json').version
+          if (bindingPackageVersion !== '0.0.3' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.0.3 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      } else {
+        try {
+          return require('./node-tpm2.linux-x64-gnu.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('node-tpm2-linux-x64-gnu')
+          const bindingPackageVersion = require('node-tpm2-linux-x64-gnu/package.json').version
+          if (bindingPackageVersion !== '0.0.3' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.0.3 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      }
+    } else if (process.arch === 'arm64') {
+      if (isMusl()) {
+        try {
+          return require('./node-tpm2.linux-arm64-musl.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('node-tpm2-linux-arm64-musl')
+          const bindingPackageVersion = require('node-tpm2-linux-arm64-musl/package.json').version
+          if (bindingPackageVersion !== '0.0.3' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.0.3 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      } else {
+        try {
+          return require('./node-tpm2.linux-arm64-gnu.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('node-tpm2-linux-arm64-gnu')
+          const bindingPackageVersion = require('node-tpm2-linux-arm64-gnu/package.json').version
+          if (bindingPackageVersion !== '0.0.3' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.0.3 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      }
+    } else if (process.arch === 'arm') {
+      if (isMusl()) {
+        try {
+          return require('./node-tpm2.linux-arm-musleabihf.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('node-tpm2-linux-arm-musleabihf')
+          const bindingPackageVersion = require('node-tpm2-linux-arm-musleabihf/package.json').version
+          if (bindingPackageVersion !== '0.0.3' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.0.3 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      } else {
+        try {
+          return require('./node-tpm2.linux-arm-gnueabihf.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('node-tpm2-linux-arm-gnueabihf')
+          const bindingPackageVersion = require('node-tpm2-linux-arm-gnueabihf/package.json').version
+          if (bindingPackageVersion !== '0.0.3' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.0.3 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      }
+    } else if (process.arch === 'loong64') {
+      if (isMusl()) {
+        try {
+          return require('./node-tpm2.linux-loong64-musl.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('node-tpm2-linux-loong64-musl')
+          const bindingPackageVersion = require('node-tpm2-linux-loong64-musl/package.json').version
+          if (bindingPackageVersion !== '0.0.3' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.0.3 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      } else {
+        try {
+          return require('./node-tpm2.linux-loong64-gnu.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('node-tpm2-linux-loong64-gnu')
+          const bindingPackageVersion = require('node-tpm2-linux-loong64-gnu/package.json').version
+          if (bindingPackageVersion !== '0.0.3' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.0.3 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      }
+    } else if (process.arch === 'riscv64') {
+      if (isMusl()) {
+        try {
+          return require('./node-tpm2.linux-riscv64-musl.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('node-tpm2-linux-riscv64-musl')
+          const bindingPackageVersion = require('node-tpm2-linux-riscv64-musl/package.json').version
+          if (bindingPackageVersion !== '0.0.3' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.0.3 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      } else {
+        try {
+          return require('./node-tpm2.linux-riscv64-gnu.node')
+        } catch (e) {
+          loadErrors.push(e)
+        }
+        try {
+          const binding = require('node-tpm2-linux-riscv64-gnu')
+          const bindingPackageVersion = require('node-tpm2-linux-riscv64-gnu/package.json').version
+          if (bindingPackageVersion !== '0.0.3' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.0.3 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          }
+          return binding
+        } catch (e) {
+          loadErrors.push(e)
+        }
+      }
+    } else if (process.arch === 'ppc64') {
+      try {
+        return require('./node-tpm2.linux-ppc64-gnu.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('node-tpm2-linux-ppc64-gnu')
+        const bindingPackageVersion = require('node-tpm2-linux-ppc64-gnu/package.json').version
+        if (bindingPackageVersion !== '0.0.3' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.3 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 's390x') {
+      try {
+        return require('./node-tpm2.linux-s390x-gnu.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('node-tpm2-linux-s390x-gnu')
+        const bindingPackageVersion = require('node-tpm2-linux-s390x-gnu/package.json').version
+        if (bindingPackageVersion !== '0.0.3' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.3 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else {
+      loadErrors.push(new Error(`Unsupported architecture on Linux: ${process.arch}`))
+    }
+  } else if (process.platform === 'openharmony') {
+    if (process.arch === 'arm64') {
+      try {
+        return require('./node-tpm2.openharmony-arm64.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('node-tpm2-openharmony-arm64')
+        const bindingPackageVersion = require('node-tpm2-openharmony-arm64/package.json').version
+        if (bindingPackageVersion !== '0.0.3' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.3 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 'x64') {
+      try {
+        return require('./node-tpm2.openharmony-x64.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('node-tpm2-openharmony-x64')
+        const bindingPackageVersion = require('node-tpm2-openharmony-x64/package.json').version
+        if (bindingPackageVersion !== '0.0.3' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.3 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else if (process.arch === 'arm') {
+      try {
+        return require('./node-tpm2.openharmony-arm.node')
+      } catch (e) {
+        loadErrors.push(e)
+      }
+      try {
+        const binding = require('node-tpm2-openharmony-arm')
+        const bindingPackageVersion = require('node-tpm2-openharmony-arm/package.json').version
+        if (bindingPackageVersion !== '0.0.3' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.0.3 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        }
+        return binding
+      } catch (e) {
+        loadErrors.push(e)
+      }
+    } else {
+      loadErrors.push(new Error(`Unsupported architecture on OpenHarmony: ${process.arch}`))
+    }
+  } else {
+    loadErrors.push(new Error(`Unsupported OS: ${process.platform}, architecture: ${process.arch}`))
+  }
+}
+
+nativeBinding = requireNative()
+
+// NAPI_RS_FORCE_WASI is a tri-state flag:
+//   unset / any other value → native binding preferred, WASI is only a fallback
+//   'true'                   → force WASI fallback even if native loaded
+//   'error'                  → force WASI and throw if no WASI binding is found
+// Treating any non-empty string as truthy (the historical behavior) meant
+// NAPI_RS_FORCE_WASI=false, NAPI_RS_FORCE_WASI=0, etc. inadvertently triggered
+// the WASI path, causing ENOENT for packages shipped without a .wasi.cjs file.
+const forceWasi =
+  process.env.NAPI_RS_FORCE_WASI === 'true' || process.env.NAPI_RS_FORCE_WASI === 'error'
+
+if (!nativeBinding || forceWasi) {
+  let wasiBinding = null
+  let wasiBindingError = null
+  try {
+    wasiBinding = require('./node-tpm2.wasi.cjs')
+    nativeBinding = wasiBinding
+  } catch (err) {
+    if (forceWasi) {
+      wasiBindingError = err
+    }
+  }
+  if (!nativeBinding || forceWasi) {
+    try {
+      wasiBinding = require('node-tpm2-wasm32-wasi')
+      nativeBinding = wasiBinding
+    } catch (err) {
+      if (forceWasi) {
+        if (!wasiBindingError) {
+          wasiBindingError = err
+        } else {
+          wasiBindingError.cause = err
+        }
+        loadErrors.push(err)
+      }
+    }
+  }
+  if (process.env.NAPI_RS_FORCE_WASI === 'error' && !wasiBinding) {
+    const error = new Error('WASI binding not found and NAPI_RS_FORCE_WASI is set to error')
+    error.cause = wasiBindingError
+    throw error
+  }
+}
+
+if (!nativeBinding) {
+  if (loadErrors.length > 0) {
+    const error = new Error(
+      `Cannot find native binding. ` +
+        `npm has a bug related to optional dependencies (https://github.com/npm/cli/issues/4828). ` +
+        'Please try `npm i` again after removing both package-lock.json and node_modules directory.',
+    )
+    // assign instead of the `new Error(message, { cause })` options form,
+    // which Node < 16.9 silently ignores
+    error.cause = loadErrors.reduce((err, cur) => {
+      cur.cause = err
+      return cur
+    })
+    throw error
+  }
+  throw new Error(`Failed to load native binding`)
+}
+
+module.exports = nativeBinding
+module.exports.getFixedProperties = nativeBinding.getFixedProperties
+module.exports.isAvailable = nativeBinding.isAvailable

package/native.d.ts

@@ -0,0 +1,12 @@
+/* auto-generated by NAPI-RS */
+/* eslint-disable */
+export interface FixedPropertiesJs {
+  manufacturer: string
+  firmwareVersion: string
+  isVirtual: boolean
+  spec: string
+}
+
+export declare function getFixedProperties(): Promise<FixedPropertiesJs>
+
+export declare function isAvailable(): Promise<boolean>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "node-tpm2",
-  "version": "0.0.1",
+  "version": "0.0.3",
   "description": "Native TPM 2.0 for Node. Zero tooling, no admin. Windows (TBS) and Linux (/dev/tpmrm0). Pre-release.",
   "type": "module",
   "license": "Apache-2.0",
@@ -21,14 +21,31 @@
       "types": "./index.d.ts"
     }
   },
-  "files": ["index.js", "index.d.ts"],
+  "napi": {
+    "binaryName": "node-tpm2",
+    "targets": [
+      "x86_64-pc-windows-msvc",
+      "aarch64-pc-windows-msvc",
+      "x86_64-unknown-linux-gnu",
+      "aarch64-unknown-linux-gnu",
+      "x86_64-unknown-linux-musl",
+      "aarch64-unknown-linux-musl",
+      "aarch64-apple-darwin"
+    ]
+  },
+  "files": [
+    "index.js",
+    "index.d.ts",
+    "api.js",
+    "native.cjs",
+    "native.d.ts"
+  ],
   "engines": {
     "node": ">=20"
   },
   "keywords": [
     "tpm",
     "tpm2",
-    "node-tpm2",
     "attestation",
     "tbs",
     "trusted-platform-module",
@@ -37,5 +54,30 @@
   ],
   "publishConfig": {
     "access": "public"
+  },
+  "scripts": {
+    "build": "napi build --platform --release --js native.cjs --dts native.d.ts",
+    "build:debug": "napi build --platform --js native.cjs --dts native.d.ts",
+    "build:esapi": "napi build --platform --release --features esapi --js native.cjs --dts native.d.ts",
+    "tbs-probe": "cargo run --bin tbs-probe",
+    "spike": "cargo run --features esapi --bin spike --",
+    "spike:all": "cargo run --features esapi --bin spike -- all",
+    "artifacts": "napi artifacts",
+    "patch-windows-npm": "node scripts/patch-windows-npm-packages.mjs",
+    "prepublishOnly": "napi prepublish -t npm --skip-optional-publish"
+  },
+  "devDependencies": {
+    "@napi-rs/cli": "^3.7.2"
+  },
+  "optionalDependencies": {
+    "node-tpm2-windows-x64-msvc": "0.0.3",
+    "node-tpm2-windows-arm64-msvc": "0.0.3",
+    "node-tpm2-linux-x64-gnu": "0.0.3",
+    "node-tpm2-linux-arm64-gnu": "0.0.3",
+    "node-tpm2-linux-x64-musl": "0.0.3",
+    "node-tpm2-linux-arm64-musl": "0.0.3",
+    "node-tpm2-darwin-arm64": "0.0.3",
+    "node-tpm2-win32-x64-msvc": "0.0.3",
+    "node-tpm2-win32-arm64-msvc": "0.0.3"
   }
-}
+}