[Nic-dorman]

Linear issue

Closes V2-1764

Summary

This removes the Node.js (napi) bindings, which were never published. It's part of the 2026-10-27 faux-CI audit (V2-1747, item 3).

• They never shipped. @withautonomi/self-encryption is a 404 on npm, and nodejs-publish.yml (workflow_dispatch only) has 0 runs, so the NPM_TOKEN secret was never used. The versions had also drifted apart: nodejs/package.json says 0.1.1 and nodejs/Cargo.toml says 0.1.0.
• Nothing uses them. No WithAutonomi repo depends on the package. A napi addon is Node-only, so it wouldn't serve browser clients either.
• They still cost CI. nodejs.yml built and tested them on Linux, Windows and macOS on every PR, with contents: write + id-token: write on a test workflow. Its push filter named main, but the default branch is master.

Removed:

• nodejs/ (the napi crate, JS shims, per-platform npm stubs and tests).
• .github/workflows/nodejs.yml and nodejs-publish.yml.
• The nodejs workspace member, and the self-encryption-nodejs entry in release-plz.toml.

The [workspace] table stays (now root-only), and the CHANGELOG history is untouched.

Not changed: the self_encryption crate (no src/, dependency or feature changes) and the Python bindings. Fixing PyPI publishing is tracked separately in V2-1763.

Admin follow-ups (not in this PR):

• Delete the unused NPM_TOKEN repo secret.
• Optional: yank self-encryption-nodejs 0.1.0 on crates.io. It was published on 2025-08-05, but a napi cdylib isn't usable as a dependency.

Risk tier

• T0 — docs / tooling / CI / pure UX-output. Repo CI only.
• T1 — client-only, no network-facing behavior change. CI + prod compat smoke.
• T2 — node/client logic with behavioral surface, no protocol/format/economics change. Dev testnet + ADR.
• T3 — protocol / storage format / payments / routing. T2 evidence + adversarial testing.

Compatibility

• Wire: none
• Storage: none
• API: none for self_encryption. The removed self-encryption-nodejs crate was release = false and never reached npm.

Semver impact

• breaking
• feature
• fix

Test evidence

This mirrors merge.yml (RUSTFLAGS=-D warnings) and release.yml. It was run on dev2 (Ubuntu 24.04) against master 656f96a plus this diff; the tested tree is byte-identical to this branch.

Check	Result
cargo build --release	pass
cargo build --release --workspace (release.yml)	pass
cargo clippy --all-targets --all-features	pass
cargo test --release	45 unit + 31 integration + 5 lib + 5 stream tests, all passed
cargo publish --dry-run	pass
cargo deny check	pass
cargo metadata workspace members	self_encryption only

New dependency

none

ADR

n/a

Mitigation / rollback

Revert the PR. Nothing downstream consumes the bindings.

🤖 Generated with Claude Code