So after another day or so on this I've figured it out:
Mask doesn't do anything on it's own, it's pretty useless really. It merely takes the supplied mask image and uses it to write protect the masked pixels from subsequent alteration if additional processing / drawing is performed on the image.
Because Node GM doesn't support composite, my solution is to apply the mask using a system call. Because there doesn't seem to be any way to combine cropping and composite in a single step (graphicsmagick composite and crop in the same command), I've done it in two steps:
var exec = require('child_process').exec
gm = require('gm')
gm(tempfile)
.quality(90)
.resize(null, thumbOffset)
.gravity('Center')
.crop(thumbWidth, thumbHeight)
.write(thumb, function (err) {
if (err) throw err
console.log('thumb sized')
compositeMask(thumb, mask, function(){
console.log('mask1 done')
})
})
function compositeMask(thumb, mask, next) {
var gmComposite = 'gm composite -compose in ' + thumb + ' ' + mask + ' ' + thumb
exec(gmComposite, function(err) {
if (err) throw err
pathUpdate(entryID, { thumb: thumb })
next()
})
}