@omnikit-ai/sdk 2.2.2 → 2.2.4

package/dist/index.mjs

@@ -1719,7 +1719,7 @@ Example: await ${collectionName}.list({ limit: 100, sort: '-created_at' })`,
             if (options.offset !== void 0) {
               queryParams.append("offset", String(options.offset));
             }
-            if (options.after !== void 0) {
+            if (options.after) {
               queryParams.append("after", options.after);
             }
           }
@@ -2687,43 +2687,52 @@ Example: await ${collectionName}.list({ limit: 100, sort: '-created_at' })`,
   /**
    * Get a secret value at runtime (for backend functions).
    *
-   * This method securely fetches secrets from the Omnikit API using the app's API key.
-   * Use this in Supabase Edge Functions instead of storing secrets in Supabase's
-   * environment variables to ensure proper isolation between apps.
+   * This method securely fetches secrets from the Omnikit API at runtime.
+   * Secrets are NOT injected into function code - they are fetched via API
+   * to ensure they cannot be leaked through source code, logs, or backups.
    *
    * @example
    * ```typescript
    * // In a backend function (Deno Edge Function)
-   * const omnikit = createClient({
-   *   appId: __OMNIKIT_APP_ID__,
-   *   serverUrl: __OMNIKIT_API_URL__,
-   *   apiKey: __OMNIKIT_API_KEY__,
-   * });
+   * import { createServerClient } from '@omnikit-ai/sdk';
+   *
+   * Deno.serve(async (req) => {
+   *   const omnikit = createServerClient(req);
+   *
+   *   // Fetch secret at runtime - secure, never in source code
+   *   const stripeKey = await omnikit.getSecret('STRIPE_SECRET_KEY');
+   *   const stripe = new Stripe(stripeKey);
    *
-   * const stripeKey = await omnikit.getSecret('STRIPE_SECRET_KEY');
-   * const stripe = new Stripe(stripeKey);
+   *   // ... rest of function
+   * });
    * ```
    *
    * @param secretName - Name of the secret to retrieve
    * @returns The decrypted secret value
-   * @throws Error if the secret is not found or API key is invalid
+   * @throws Error if the secret is not found or service token is invalid
    */
   async getSecret(secretName) {
-    if (!this._apiKey) {
+    const authToken = this._serviceToken || this._apiKey;
+    if (!authToken) {
       throw new OmnikitError(
-        "API key is required to fetch secrets. Provide apiKey in config.",
+        "Service token required. Use createServerClient(req) in backend functions.",
         403,
-        "API_KEY_REQUIRED"
+        "AUTH_REQUIRED"
       );
     }
+    const headers = {
+      "Content-Type": "application/json"
+    };
+    if (this._serviceToken) {
+      headers["X-Service-Token"] = this._serviceToken;
+    } else if (this._apiKey) {
+      headers["X-API-Key"] = this._apiKey;
+    }
     const response = await fetch(
       `${this.baseUrl}/apps/${this.appId}/secrets/${secretName}/value`,
       {
         method: "GET",
-        headers: {
-          "X-API-Key": this._apiKey,
-          "Content-Type": "application/json"
-        }
+        headers
       }
     );
     if (!response.ok) {