@suronai/sdk 0.1.10 → 0.1.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suronai/sdk",
-  "version": "0.1.10",
+  "version": "0.1.13",
   "description": "App SDK for Suron — await vault() to load secrets",
   "type": "module",
   "main": "./src/index.js",

package/src/decrypt.js

@@ -1,21 +1,29 @@
-import { config as dotenvxConfig } from "@dotenvx/dotenvx";
+import { parse as dotenvxParse } from "@dotenvx/dotenvx";
+import { readFileSync } from "fs";
+import { join } from "path";
 
 /**
- * Decrypts the encrypted .env into process.env using dotenvx.
- * dotenvx reads DOTENV_PRIVATE_KEY from process.env, so we set it
- * temporarily, call config(), then restore the previous value.
- * @param {string} privateKey
+ * Decrypts the encrypted .env (in envDir) into process.env using dotenvx.
+ *
+ * We use dotenvx.parse(src, { privateKey }) rather than config():
+ *   - parse() is the documented API that accepts privateKey directly
+ *   - It decrypts in-memory without touching process.env or requiring
+ *     DOTENV_PRIVATE_KEY to be set anywhere
+ *   - We then assign the decrypted values into process.env ourselves,
+ *     which is explicit and race-condition-free
+ *
+ * @param {string} privateKey  - 64-char hex secp256k1 private key from Suron
+ * @param {string} envDir      - Directory containing the encrypted .env file
  */
-export function decryptEnv(privateKey) {
-  const prev = process.env.DOTENV_PRIVATE_KEY;
-  process.env.DOTENV_PRIVATE_KEY = privateKey;
-  try {
-    dotenvxConfig();
-  } finally {
-    if (prev === undefined) {
-      delete process.env.DOTENV_PRIVATE_KEY;
-    } else {
-      process.env.DOTENV_PRIVATE_KEY = prev;
-    }
+export function decryptEnv(privateKey, envDir = process.cwd()) {
+  const envPath = join(envDir, ".env");
+  const src = readFileSync(envPath, "utf-8");
+  const parsed = dotenvxParse(src, { privateKey });
+  for (const [key, value] of Object.entries(parsed)) {
+    // Skip dotenvx's own metadata keys — these are infrastructure, not app secrets.
+    // DOTENV_PUBLIC_KEY is stored in plaintext in the .env file by dotenvx and
+    // would otherwise pollute the app's runtime environment.
+    if (key.startsWith("DOTENV_PUBLIC_KEY") || key.startsWith("DOTENV_PRIVATE_KEY")) continue;
+    process.env[key] = value;
   }
 }

package/src/poll.js

@@ -32,7 +32,13 @@ export async function pollUntilApproved(
 
     if (!res.ok) continue; // Transient error — keep polling
 
-    const { status } = await res.json();
+    let status;
+    try {
+      ({ status } = await res.json());
+    } catch {
+      // Malformed JSON — treat as transient and keep polling
+      continue;
+    }
 
     if (status === "approved") return;
     if (status === "denied") {

package/src/vault.js

@@ -33,9 +33,13 @@ function readSuronJson(dir) {
   } catch {
     throw new SuronConfigError(".suron.json is malformed JSON");
   }
-  if (!parsed.app || !parsed.id) {
+  const app = typeof parsed.app === "string" ? parsed.app.trim() : "";
+  const id  = typeof parsed.id  === "string" ? parsed.id.trim()  : "";
+  if (!app || !id) {
     throw new SuronConfigError(".suron.json is missing 'app' or 'id' field");
   }
+  parsed.app = app;
+  parsed.id  = id;
   return parsed;
 }
 
@@ -114,7 +118,7 @@ export async function vault(options = {}) {
   await pollUntilApproved(apiUrl, requestId, timeout, pollInterval);
 
   const privateKey = await fetchKey(apiUrl, requestId);
-  decryptEnv(privateKey);
+  decryptEnv(privateKey, configPath);
   // Note: JS strings are immutable — there is no way to scrub the value from
   // heap memory. The reference is dropped here and will be GC'd normally.