fix: correct package entry points and publish contents

Five packaging defects, all pre-existing:

1. dist/esm/index.js held ESM syntax while the package is not
   "type": "module", so Node classified it as CommonJS. It failed
   outright on Node 18 ("Unexpected token 'export'") and only worked on
   Node >= 22 because Node re-parses after guessing the module type,
   paying that cost on every import. Bundles now carry explicit
   extensions: .mjs for ES output, .cjs/.js for CommonJS. The browser
   build gained a real CommonJS output too — the exports map previously
   pointed the browser "require" condition at an ES module.
   The exports map now also leads with "types" and ends with a "default"
   fallback for resolvers matching neither "node" nor "browser".

2. files: ["native"] published the local build directory: a 94.6 kB
   Linux-x64 .node binary, a 148 kB object file and generated Makefiles.
   node-gyp-build checks build/Release before prebuilds, so every
   consumer on every platform would have found this machine's binary,
   skipped compiling, and failed to load it. It fails safe (native/
   index.js catches and returns null), but the addon could never work
   for anyone else. Narrowed to the four source files.

3. binding.gyp resolves node-addon-api at build time, but nothing
   declared it: it was a devDependency of the root, absent from
   native/package.json. The build only succeeded here because a dev
   install populates the root node_modules. Declared as a dependency of
   the native package, where it is actually needed.

4. No clean step, so stale output shipped — the tarball carried both
   dist/types/core/** and a dist/types/src/** tree left over from before
   rootDir was set. build now runs clean first.

5. test:browser ran `karma start` with no karma.conf.js anywhere in the
   repo, and tests/browser is an empty directory. Removed the script and
   the karma devDependency rather than leave a script that cannot run.

Verified: CommonJS require and ESM import both resolve on Node 18.19.1
and 24.18.0; TypeScript resolves types under both bundler and node16;
npm pack now produces 35 files / 103.8 kB with no build artefacts.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-19 12:39:09 +02:00

2.2 KiB

Raw Blame History

Installation

Prerequisites

Node.js: 14.17 or higher (18 LTS recommended)
npm / yarn / pnpm
For TypeScript projects: TypeScript 4.7+

Install from npm

npm install nomyo-js

yarn add nomyo-js

pnpm add nomyo-js

Browser (CDN)

<script type="module">
  import { SecureChatCompletion } from 'https://unpkg.com/nomyo-js/dist/browser/index.mjs';
  // ...
</script>

Verify Installation

Node.js

import { SecureChatCompletion, getMemoryProtectionInfo } from 'nomyo-js';

const info = getMemoryProtectionInfo();
console.log('Memory protection:', info.method);   // e.g. "zero-only"
console.log('Can lock:', info.canLock);           // true if native addon present

const client = new SecureChatCompletion({ apiKey: 'test' });
console.log('nomyo-js installed successfully');
client.dispose();

CommonJS

const { SecureChatCompletion } = require('nomyo-js');

Optional: Native Memory Addon

The pure-JS implementation zeroes buffers immediately after use but cannot prevent the OS from paging sensitive data to swap. The optional native addon adds mlock/VirtualLock support for true OS-level memory locking.

cd node_modules/nomyo-js/native
npm install
npm run build

Or if you installed nomyo-native separately:

npm install nomyo-native

When the addon is present getMemoryProtectionInfo() will report method: 'mlock' and canLock: true.

TypeScript

All public APIs ship with bundled type declarations — no @types/ package required.

import {
  SecureChatCompletion,
  ChatCompletionRequest,
  ChatCompletionResponse,
  getMemoryProtectionInfo,
} from 'nomyo-js';

Environment Variables

Store secrets outside source code:

# .env (never commit this file)
NOMYO_API_KEY=your-api-key
NOMYO_SERVER_URL=https://api.nomyo.ai
NOMYO_KEY_PASSWORD=your-key-password

import 'dotenv/config';   // or use process.env directly
import { SecureChatCompletion } from 'nomyo-js';

const client = new SecureChatCompletion({
  baseUrl: process.env.NOMYO_SERVER_URL,
  apiKey:  process.env.NOMYO_API_KEY,
});

2.2 KiB Raw Blame History