@suronai/sdk 0.1.11 → 0.1.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suronai/sdk",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "description": "App SDK for Suron — await vault() to load secrets",
   "type": "module",
   "main": "./src/index.js",

package/src/decrypt.js

@@ -20,6 +20,10 @@ export function decryptEnv(privateKey, envDir = process.cwd()) {
   const src = readFileSync(envPath, "utf-8");
   const parsed = dotenvxParse(src, { privateKey });
   for (const [key, value] of Object.entries(parsed)) {
+    // Skip dotenvx's own metadata keys — these are infrastructure, not app secrets.
+    // DOTENV_PUBLIC_KEY is stored in plaintext in the .env file by dotenvx and
+    // would otherwise pollute the app's runtime environment.
+    if (key.startsWith("DOTENV_PUBLIC_KEY") || key.startsWith("DOTENV_PRIVATE_KEY")) continue;
     process.env[key] = value;
   }
 }

package/src/poll.js

@@ -32,7 +32,13 @@ export async function pollUntilApproved(
 
     if (!res.ok) continue; // Transient error — keep polling
 
-    const { status } = await res.json();
+    let status;
+    try {
+      ({ status } = await res.json());
+    } catch {
+      // Malformed JSON — treat as transient and keep polling
+      continue;
+    }
 
     if (status === "approved") return;
     if (status === "denied") {

package/src/vault.js

@@ -33,9 +33,13 @@ function readSuronJson(dir) {
   } catch {
     throw new SuronConfigError(".suron.json is malformed JSON");
   }
-  if (!parsed.app || !parsed.id) {
+  const app = typeof parsed.app === "string" ? parsed.app.trim() : "";
+  const id  = typeof parsed.id  === "string" ? parsed.id.trim()  : "";
+  if (!app || !id) {
     throw new SuronConfigError(".suron.json is missing 'app' or 'id' field");
   }
+  parsed.app = app;
+  parsed.id  = id;
   return parsed;
 }