
Security News
Static vs. Runtime Reachability: Insights from Latio’s On the Record Podcast
The Latio podcast explores how static and runtime reachability help teams prioritize exploitable vulnerabilities and streamline AppSec workflows.
@amccarthy1/typed-env
Advanced tools
A strongly-typed, 0-dependency environment variable parser for Typescript!
npm install --save @amccarthy1/typed-env # npm
yarn add @amccarthy1/typed-env # yarn
import { TypedEnv, EnumVar } from '@amccarthy1/typed-env'
const env = TypedEnv({
ENVIRONMENT: EnumVar({ options: ['dev', 'staging', 'prod'] }),
})
doWhateverToRunApp(env.ENVIRONMENT) // env.ENVIRONMENT is of type 'dev' | 'staging' | 'prod'
Many services use environment variables for runtime configuration, anything from the current environment or logging verbosity, to things like API keys and secrets. But many times, these environment variables are unvalidated and naively parsed from strings when needed.
This library aims to allow you to define environment variables in a more type-safe way. Take this example:
const environment = process.env.ENVIRONMENT
const makePayment = (amount: bigint) => {
if (environment === 'prod') {
makeRealPayment(amount)
} else {
makeMockPayment(amount)
}
}
What if you configured your server with ENVIRONMENT=production
instead of ENVIRONMENT=prod
?
Suddenly, all your users are getting free products because you're making mock payments instead of
real ones!
If you'd used TypedEnv instead, you'd get this
const env = TypedEnv({
ENVIRONMENT: EnumVar({ options: ['dev', 'staging', 'production'] }),
})
const makePayment = (amount: bigint) => {
if (env.ENVIRONMENT === 'prod') {
// TypeError!
// `This condition will always return 'false' since
// the types '"dev" | "staging" | "production"' and
// '"prod"' have no overlap.`
return makeRealPayment(amount)
} else {
return makeFakePayment(amount)
}
}
Currently, strings, enums, integers, booleans, and dates are supported, although you can define your own custom type
using the Declaration<T>
type
export type Declaration<T> = {
variable?: string // The name of the environment variable; defaults to match the key if not specified
parser: Parser<T> // A function (value: string) => T
}
TypedEnv is primarily built for required variables, but does support optionals using a defaultValue
property.
If you do not want to use an explicit default, you can use the optional()
wrapper provided, which will automatically
inject a default value of null
and convert a Declaration<T>
to a Declaration<T|null>
const env = TypedEnv({
required: BoolVar({ defaultValue: false }),
optional: optional(BoolVar()),
})
// This schema yields the following type object
const env: {
required: boolean
optional: boolean | null
}
It is generally preferred to use defaultValue
over the optional
wrapper, but optional
may be useful in migrating
existing codebases which already treat env vars as optional.
FAQs
Typed environment variables
The npm package @amccarthy1/typed-env receives a total of 1,005 weekly downloads. As such, @amccarthy1/typed-env popularity was classified as popular.
We found that @amccarthy1/typed-env demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
The Latio podcast explores how static and runtime reachability help teams prioritize exploitable vulnerabilities and streamline AppSec workflows.
Security News
The latest Opengrep releases add Apex scanning, precision rule tuning, and performance gains for open source static code analysis.
Security News
npm now supports Trusted Publishing with OIDC, enabling secure package publishing directly from CI/CD workflows without relying on long-lived tokens.