fix: packaging exports + remove API key from URLs#2
Merged
Conversation
Add "type": "module" to package.json so tsup emits index.js (ESM) and index.cjs (CJS), matching the main/exports map. Without it, tsup emitted index.js/index.mjs and require() of the published package failed. Send the Syncro API key via the Authorization header instead of an api_key URL query parameter, which leaked the key into server/proxy logs. Update MSW mock handlers to assert on the Authorization header.
- Make 5xx retry path use configurable maxRetries/backoff (matches 429) - Bump @types/node to ^22, tsup target node22, CI matrix to Node 22 - npm audit fix: 23 -> 8 vulnerabilities (remaining 8 need breaking vitest v4) - Remove unused url declarations in test mock handlers (eslint) - eslint kept at v8 deliberately (v10 needs flat-config rewrite)
github-actions Bot
pushed a commit
that referenced
this pull request
May 20, 2026
## [1.0.2](v1.0.1...v1.0.2) (2026-05-20) ### Bug Fixes * packaging exports + remove API key from URLs ([#2](#2)) ([ec25bce](ec25bce))
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two correctness/security fixes plus build-config cleanup.
CRITICAL — Package exports resolve correctly
Added
"type": "module"topackage.json. Without it, the.cjs/.d.ctsconditional exports do not resolve correctly for consumers, breaking both
CommonJS
require()and TypeScript type resolution against the package.HIGH — API key no longer leaks in URLs
The SDK previously appended
api_keyas a URL query parameter on everyrequest, exposing the secret in server access logs, proxy logs, and browser
history. The key is now sent in an
Authorizationheader instead:request()no longer appendsapi_keyto the query string.requestUrl()(pagination) strips any legacyapi_keyquery param.executeRequest()setsAuthorization: Bearer <apiKey>.Other
max-retries + backoff as 429 responses (previously a single fixed retry).
tsup.config.ts).npm audit fixapplied (package-lock.json).Verification
npm run build— green (.cjs,.js,.d.ts,.d.ctsall emitted)npm test— 61/61 passingnpm run lint— cleanBranch rebased onto latest
main(resolvedpackage.jsonversion conflict,keeping
1.0.1).