feat(sdk-node): add Node.js SDK

[macalbert]

Summary

Add the Node.js SDK (@envilder/sdk) — an independent, async-first runtime library that loads secrets from AWS SSM Parameter Store or Azure Key Vault directly into process.env. No .env files, no intermediaries. Works with both JavaScript and TypeScript projects.

Changes

SDK Source (src/sdks/nodejs/)

• Domain: ISecretProvider interface (batch getSecrets), MapFileConfig, EnvilderOptions, ParsedMapFile, SecretProviderType enum
• Application: Envilder async facade (load, resolveFile, fromMapFile + env-routing overloads), EnvilderClient core resolver, MapFileParser, validateSecrets opt-in validation
• Infrastructure: AwsSsmSecretProvider (batch GetParametersCommand), AzureKeyVaultSecretProvider, createSecretProvider factory (internal)

Tests (tests/sdks/nodejs/)

• 55 unit tests across 7 files (facade, client, parser, validation, providers, factory)
• 4 acceptance tests using TestContainers (LocalStack for AWS, Lowkey Vault for Azure)
• Should_<Expected>_When_<Condition> naming, AAA pattern

CI & Workflows

• tests-nodejs-sdk.yml — runs all tests (unit + acceptance) on every PR and push to main
• publish-npm-sdk.yml — publishes to npm with OIDC provenance on sdk-nodejs/v* tags
• coverage-report.yml — Node.js SDK coverage section added

Website & Docs

• SDK card, docs section, and changelog page for all 3 locales (en, es, ca)
• i18n keys for Node.js SDK across all locales
• ROADMAP, ADR, and changelogs updated

Supporting

• pnpm-workspace.yaml and dependabot.yml updated
• Copilot instructions and skills updated for Node.js SDK conventions
• SDK release checklist skill added

Testing

• pnpm build passes (SDK)
• 55/55 unit tests pass
• Biome formatting clean
• Zero stale typescript-sdk references in codebase

---

Summary by CodeRabbit

• New Features
  • Introduced a Node.js SDK that loads secrets into runtime env, with AWS SSM and Azure Key Vault support, fluent builder API, env-based routing, and optional secret validation.
• Documentation
  • Added Node.js SDK docs, examples, and initial changelog; added ADR standardizing SDK acceptance-test infrastructure.
• Tests
  • Added extensive unit and acceptance tests and test container utilities for LocalStack and Lowkey Vault.
• Chores
  • Website and tooling updates for SDK/version/changelog integration and test config scripts.

[coderabbitai]

🧹 Nitpick comments (1)

examples/sdk/nodejs/2_env_routing.ts (1)

13-15: ⚡ Quick win

Prefer masked output in examples instead of raw secret values.

Printing raw values (${value}) can leak secrets into terminal history and CI logs when users copy this sample.

♻️ Suggested patch

 for (const [key, value] of secrets) {
-  console.log(`${key} = ${value}`);
+  const masked = value.length > 3 ? `***${value.slice(-3)}` : '***';
+  console.log(`${key} = ${masked}`);
 }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@examples/sdk/nodejs/2_env_routing.ts` around lines 13 - 15, The example
currently logs raw secret values in the for loop iterating over secrets (for
(const [key, value] of secrets) { ... }) which can leak sensitive data; change
the console output to mask or redact the value (e.g., log `${key} = ****` or
show only last4 chars) instead of printing `${value}` so examples never emit
full secret values to terminal or CI logs.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@examples/sdk/nodejs/2_env_routing.ts`:
- Around line 13-15: The example currently logs raw secret values in the for
loop iterating over secrets (for (const [key, value] of secrets) { ... }) which
can leak sensitive data; change the console output to mask or redact the value
(e.g., log `${key} = ****` or show only last4 chars) instead of printing
`${value}` so examples never emit full secret values to terminal or CI logs.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 5f4a482b-b3e4-4a3d-b640-d2aa70c4bf4e

📥 Commits

Reviewing files that changed from the base of the PR and between ca91538 and fd2bc8b.

⛔ Files ignored due to path filters (2)

• .github/workflows/coverage-report/extract-test-stats.mjs is excluded by none and included by none
• examples/sdk/nodejs/package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json and included by examples/**

📒 Files selected for processing (10)

• examples/sdk/nodejs/1_fluent.ts
• examples/sdk/nodejs/2_env_routing.ts
• examples/sdk/nodejs/3_validation.ts
• examples/sdk/nodejs/4_load.ts
• examples/sdk/nodejs/5_resolve.ts
• examples/sdk/nodejs/README.md
• examples/sdk/nodejs/package.json
• src/sdks/nodejs/package.json
• src/sdks/nodejs/src/application/envilder.ts
• src/sdks/nodejs/src/infrastructure/secret-provider-factory.ts

✅ Files skipped from review due to trivial changes (5)

• examples/sdk/nodejs/4_load.ts
• examples/sdk/nodejs/5_resolve.ts
• examples/sdk/nodejs/README.md
• src/sdks/nodejs/package.json
• examples/sdk/nodejs/package.json