@suronai/sdk 0.1.10 → 0.1.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suronai/sdk",
-  "version": "0.1.10",
+  "version": "0.1.11",
   "description": "App SDK for Suron — await vault() to load secrets",
   "type": "module",
   "main": "./src/index.js",

package/src/decrypt.js

@@ -1,21 +1,25 @@
-import { config as dotenvxConfig } from "@dotenvx/dotenvx";
+import { parse as dotenvxParse } from "@dotenvx/dotenvx";
+import { readFileSync } from "fs";
+import { join } from "path";
 
 /**
- * Decrypts the encrypted .env into process.env using dotenvx.
- * dotenvx reads DOTENV_PRIVATE_KEY from process.env, so we set it
- * temporarily, call config(), then restore the previous value.
- * @param {string} privateKey
+ * Decrypts the encrypted .env (in envDir) into process.env using dotenvx.
+ *
+ * We use dotenvx.parse(src, { privateKey }) rather than config():
+ *   - parse() is the documented API that accepts privateKey directly
+ *   - It decrypts in-memory without touching process.env or requiring
+ *     DOTENV_PRIVATE_KEY to be set anywhere
+ *   - We then assign the decrypted values into process.env ourselves,
+ *     which is explicit and race-condition-free
+ *
+ * @param {string} privateKey  - 64-char hex secp256k1 private key from Suron
+ * @param {string} envDir      - Directory containing the encrypted .env file
  */
-export function decryptEnv(privateKey) {
-  const prev = process.env.DOTENV_PRIVATE_KEY;
-  process.env.DOTENV_PRIVATE_KEY = privateKey;
-  try {
-    dotenvxConfig();
-  } finally {
-    if (prev === undefined) {
-      delete process.env.DOTENV_PRIVATE_KEY;
-    } else {
-      process.env.DOTENV_PRIVATE_KEY = prev;
-    }
+export function decryptEnv(privateKey, envDir = process.cwd()) {
+  const envPath = join(envDir, ".env");
+  const src = readFileSync(envPath, "utf-8");
+  const parsed = dotenvxParse(src, { privateKey });
+  for (const [key, value] of Object.entries(parsed)) {
+    process.env[key] = value;
   }
 }

package/src/vault.js

@@ -114,7 +114,7 @@ export async function vault(options = {}) {
   await pollUntilApproved(apiUrl, requestId, timeout, pollInterval);
 
   const privateKey = await fetchKey(apiUrl, requestId);
-  decryptEnv(privateKey);
+  decryptEnv(privateKey, configPath);
   // Note: JS strings are immutable — there is no way to scrub the value from
   // heap memory. The reference is dropped here and will be GC'd normally.