@suronai/sdk 0.1.11 → 0.1.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suronai/sdk",
-  "version": "0.1.11",
+  "version": "0.1.15",
   "description": "App SDK for Suron — await vault() to load secrets",
   "type": "module",
   "main": "./src/index.js",

package/src/decrypt.js

@@ -20,6 +20,10 @@ export function decryptEnv(privateKey, envDir = process.cwd()) {
   const src = readFileSync(envPath, "utf-8");
   const parsed = dotenvxParse(src, { privateKey });
   for (const [key, value] of Object.entries(parsed)) {
+    // Skip dotenvx's own metadata keys — these are infrastructure, not app secrets.
+    // DOTENV_PUBLIC_KEY is stored in plaintext in the .env file by dotenvx and
+    // would otherwise pollute the app's runtime environment.
+    if (key.startsWith("DOTENV_PUBLIC_KEY") || key.startsWith("DOTENV_PRIVATE_KEY")) continue;
     process.env[key] = value;
   }
 }

package/src/poll.js

@@ -32,7 +32,13 @@ export async function pollUntilApproved(
 
     if (!res.ok) continue; // Transient error — keep polling
 
-    const { status } = await res.json();
+    let status;
+    try {
+      ({ status } = await res.json());
+    } catch {
+      // Malformed JSON — treat as transient and keep polling
+      continue;
+    }
 
     if (status === "approved") return;
     if (status === "denied") {

package/src/vault.js

@@ -33,9 +33,13 @@ function readSuronJson(dir) {
   } catch {
     throw new SuronConfigError(".suron.json is malformed JSON");
   }
-  if (!parsed.app || !parsed.id) {
+  const app = typeof parsed.app === "string" ? parsed.app.trim() : "";
+  const id  = typeof parsed.id  === "string" ? parsed.id.trim()  : "";
+  if (!app || !id) {
     throw new SuronConfigError(".suron.json is missing 'app' or 'id' field");
   }
+  parsed.app = app;
+  parsed.id  = id;
   return parsed;
 }
 
@@ -109,14 +113,14 @@ export async function vault(options = {}) {
 
   const requestId = await requestAccess(apiUrl, config.id);
 
-  process.stdout.write(`[suron] Waiting for Telegram approval for "${config.app}" ...\n`);
+  process.stdout.write(`\n  △ Suron — waiting for Telegram approval\n  │ App: ${config.app}\n  │ Tap ✅ Approve in Telegram to continue.\n\n`);
 
   await pollUntilApproved(apiUrl, requestId, timeout, pollInterval);
 
   const privateKey = await fetchKey(apiUrl, requestId);
   decryptEnv(privateKey, configPath);
   // Note: JS strings are immutable — there is no way to scrub the value from
-  // heap memory. The reference is dropped here and will be GC'd normally.
+  // heap memory. The reference is dropped here and will be GC’d normally.
 
-  process.stdout.write(`[suron] Secrets loaded for "${config.app}"\n`);
+  process.stdout.write(`  ✔ Suron — secrets loaded for “${config.app}”\n\n`);
 }