
Product
Microsoft Teams Notifications Are Now Available in Socket
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.
@specsafe/core
Advanced tools
Core workflow engine, types, and utilities for the SpecSafe spec-driven development framework.
npm install @specsafe/core
The main class for managing spec workflows.
import { Workflow } from '@specsafe/core';
const workflow = new Workflow({
specsDir: './specs',
projectName: 'My Project'
});
createSpec(specId: string, content: string): Promise<Spec>Create a new specification.
const spec = await workflow.createSpec('user-auth', `# User Authentication
## Requirements
### REQ-001: Login
**Given** a registered user
**When** they enter valid credentials
**Then** they should be logged in
`);
moveToTest(specId: string): Promise<Spec>Move a spec to the "test" phase.
const spec = await workflow.moveToTest('user-auth');
moveToCode(specId: string): Promise<Spec>Move a spec to the "code" phase.
const spec = await workflow.moveToCode('user-auth');
moveToQA(specId: string, report?: QAReport): Promise<Spec>Transition a spec into QA review or mark QA as complete. Optionally accepts a QAReport to record results.
const spec = await workflow.moveToQA('user-auth', {
passed: true,
notes: 'All tests passing'
});
complete(specId: string): Promise<Spec>Mark a spec as complete.
const spec = await workflow.complete('user-auth');
archive(specId: string): Promise<Spec>Archive a completed spec.
const spec = await workflow.archive('user-auth');
getSpec(specId: string): Promise<Spec | null>Get a spec by ID.
const spec = await workflow.getSpec('user-auth');
listSpecs(phase?: Phase): Promise<Spec[]>List all specs or filter by phase.
// All specs
const allSpecs = await workflow.listSpecs();
// Only active specs
const activeSpecs = await workflow.listSpecs('active');
Track project-level state and metadata.
import { ProjectTracker } from '@specsafe/core';
const tracker = new ProjectTracker('./specs');
getProjectState(): Promise<ProjectState>Get the current project state.
const state = await tracker.getProjectState();
console.log(state.activeSpecs.length);
console.log(state.completedSpecs.length);
updateSpecStatus(specId: string, status: SpecStatus): Promise<void>Update the status of a spec.
await tracker.updateSpecStatus('user-auth', 'in-progress');
validateSpecId(specId: string): booleanValidate a spec ID format.
import { validateSpecId } from '@specsafe/core';
validateSpecId('user-auth'); // true
validateSpecId('user_auth'); // false (underscores not allowed)
validateSpecId('user-auth-123'); // true
interface Spec {
id: string;
title: string;
description: string;
phase: Phase;
status: SpecStatus;
requirements: Requirement[];
acceptanceCriteria: string[];
technicalNotes?: string;
createdAt: Date;
updatedAt: Date;
completedAt?: Date;
qaReport?: QAReport;
}
interface Requirement {
id: string;
title: string;
given: string;
when: string;
then: string;
}
interface QAReport {
passed: boolean;
notes?: string;
testedAt: Date;
testedBy?: string;
}
type Phase = 'draft' | 'active' | 'test' | 'code' | 'qa' | 'completed' | 'archived';
type SpecStatus = 'pending' | 'in-progress' | 'blocked' | 'completed';
import { Workflow } from '@specsafe/core';
async function main() {
const workflow = new Workflow({
specsDir: './specs',
projectName: 'My App'
});
// Create a spec
await workflow.createSpec('email-validation', `
# Email Validation
## Requirements
### REQ-001: Valid Email Format
**Given** an email input field
**When** the user enters "user@example.com"
**Then** the email should be marked as valid
### REQ-002: Invalid Email Format
**Given** an email input field
**When** the user enters "invalid-email"
**Then** an error message should be shown
`);
// Move through phases
await workflow.moveToTest('email-validation');
await workflow.moveToCode('email-validation');
await workflow.moveToQA('email-validation', { passed: true });
await workflow.complete('email-validation');
}
main();
import { ProjectTracker } from '@specsafe/core';
async function printStats() {
const tracker = new ProjectTracker('./specs');
const state = await tracker.getProjectState();
console.log(`Active specs: ${state.activeSpecs.length}`);
console.log(`Completed: ${state.completedSpecs.length}`);
console.log(`Archived: ${state.archivedSpecs.length}`);
}
MIT © Agentic Engineering
FAQs
Core types and workflow engine for SpecSafe
The npm package @specsafe/core receives a total of 8 weekly downloads. As such, @specsafe/core popularity was classified as not popular.
We found that @specsafe/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.

Security News
Socket CTO Ahmad Nassri joins AppSec leaders at Black Hat to discuss active malware, package manager risks, and software supply chain defense.