I’m the author of the node-wpapi library, thanks for checking it out. Unfortunately we do not currently support any external authentication scheme out of the box, because WordPress itself does not ship with any authentication scheme other than the cookie/nonce option (which doesn’t work with external apps, as you describe).
There are plugins for authenticating API requests using JWT and OAuth 1.0a, and handling for those methods could be executed for node-wpapi using a combination of custom transport methods and the new .setHeaders() function that we introduced in last week’s 1.1 release of node-api.
However, what you are describing does not quite sound like something that would be solved by those approaches. Specifically, REST API authentication is a way to authenticate a single request against your WordPress site — to say, in effect, “I have the right to view or edit the resource I am requesting.” The REST API does not provide a mechanism to log in to WordPress, that should be handled using the existing WordPress login form.
If your SPA is designed to run in a plugin, I recommend setting it up to make a page that can only be viewed on login — then when your users try to open the app they will be directed to WordPress’s existing login page, then back to your app. Once logged in, a single page application can then use cookie/nonce authentication for API requests. For an example, see the project at https://github.com/kadamwhite/wp-notebook
Hope this helps, and thanks for using the REST API!