@suronai/sdk 0.1.28 → 0.1.30

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suronai/sdk",
-  "version": "0.1.28",
+  "version": "0.1.30",
   "description": "App SDK for Suron — await vault() to load secrets",
   "type": "module",
   "main": "./src/index.js",

package/src/poll.js

@@ -1,8 +1,5 @@
 import { SuronDeniedError, SuronTimeoutError } from "./errors.js";
 
-const DEFAULT_TIMEOUT_MS       = 300_000; // 5 minutes
-const DEFAULT_POLL_INTERVAL_MS = 3_000;   // 3 seconds
-
 /**
  * Polls /status until the request is approved, denied, or times out.
  * @param {string} apiUrl
@@ -14,8 +11,8 @@ const DEFAULT_POLL_INTERVAL_MS = 3_000;   // 3 seconds
 export async function pollUntilApproved(
   apiUrl,
   requestId,
-  timeout      = DEFAULT_TIMEOUT_MS,
-  pollInterval = DEFAULT_POLL_INTERVAL_MS
+  timeout      = 300_000,
+  pollInterval = 3_000
 ) {
   const deadline = Date.now() + timeout;
 

package/src/vault.js

@@ -106,18 +106,19 @@ export async function vault(options = {}) {
     pollInterval = 3_000,
   } = options;
 
-  const config = readSuronJson(configPath);
+  const suronJson = readSuronJson(configPath);
 
-  const rawUrl = process.env.SURON_API_URL ?? config.api_url;
+  const rawUrl = process.env.SURON_API_URL ?? suronJson.api_url;
   if (!rawUrl) throw new SuronConfigError("SURON_API_URL not set. Run: suron login");
   const apiUrl = rawUrl.replace(/\/$/, "");
 
-  const requestId = await requestAccess(apiUrl, config.id);
+  const requestId = await requestAccess(apiUrl, suronJson.id);
 
   await pollUntilApproved(apiUrl, requestId, timeout, pollInterval);
 
-  const privateKey = await fetchKey(apiUrl, requestId);
+  let privateKey = await fetchKey(apiUrl, requestId);
   decryptEnv(privateKey, configPath);
+  privateKey = "";
   // Note: JS strings are immutable — there is no way to scrub the value from
   // heap memory. The reference is dropped here and will be GC'd normally.
 }