sdk-implementation-guide

Follow the implementation order in the guide: define domain types first, then MapFileParser, EnvilderClient, the AWS and Azure providers, the Envilder facade, and validation. Each step includes required unit and acceptance tests.

Every SDK must provide a Tier 1 static facade with load and resolveFile methods, plus a Tier 2 fluent builder starting from fromMapFile with provider, vault URL, and profile options. Both tiers must support environment routing.

It depends on the runtime: Node.js and Rust are async-only, Python and PHP are sync-only, while .NET and Java offer both. Go uses sync calls with context.Context and goroutines for batch operations.

Providers must never throw on missing secrets; they return null, None, nil, or omit the entry from results. Validation is opt-in through a separate validateSecrets function that throws on empty or missing values.

Each language uses its own mechanism: internal keyword in .NET, underscore prefix in Python, unexported lowercase in Go, package-private in Java, pub(crate) in Rust, and excluding it from the barrel export in Node.js.

You need unit tests for MapFileParser, EnvilderClient, the facade, validation, and cross-provider checks, plus acceptance tests using LocalStack for AWS SSM and Lowkey Vault for Azure Key Vault. All tests must pass with Docker available.