Node.js SDK

The Node.js / TypeScript SDK (secretspec) is a thin wrapper over a napi-rs native addon that embeds the resolver. Resolution happens in the Rust core, so the SDK inherits every provider with no JS-side logic. The addon is built from the Rust core with scripts/build-addon.sh; prebuilt per-platform npm packages are a follow-up. TypeScript declarations ship in index.d.ts.

Quick start

const { SecretSpec } = require('secretspec');

const resolved = SecretSpec.builder()
  .withProvider('keyring://')
  .withProfile('production')
  .withReason('boot web app')
  .load();

console.log(resolved.provider, resolved.profile);
const db = resolved.secrets.DATABASE_URL;
console.log(db.get());   // the value, or the file path for as_path secrets
resolved.setAsEnv();     // export everything into process.env

A missing required secret throws MissingRequiredError; any other failure throws SecretSpecError (with a stable .kind).

Scopes (0.17+)

Use .withScope('api') to resolve only a named [scopes.api] subset. The selected name is available as resolved.scope and report.scope:

const resolved = SecretSpec.builder().withScope('api').load();

Typed access (codegen)

Generate typed interfaces with secretspec schema plus quicktype, then convert resolved.fieldsJson():

secretspec schema | quicktype -s schema --top-level SecretSpec --lang typescript -o secrets_gen.ts

import { Convert } from './secrets_gen'; // typed, generated

const typed = Convert.toSecretSpec(resolved.fieldsJson());
console.log(typed.DATABASE_URL);