@automagik/omni 2.260717.2 → 2.260717.3

package/dist/index.js

@@ -125164,7 +125164,7 @@ import { fileURLToPath } from "url";
 // package.json
 var package_default = {
   name: "@automagik/omni",
-  version: "2.260717.2",
+  version: "2.260717.3",
   description: "LLM-optimized CLI for Omni",
   type: "module",
   bin: {

package/dist/server/index.js

@@ -225883,7 +225883,7 @@ var init_sentry_scrub = __esm(() => {
 var require_package7 = __commonJS((exports, module) => {
   module.exports = {
     name: "@omni/api",
-    version: "2.260717.2",
+    version: "2.260717.3",
     type: "module",
     exports: {
       ".": {
@@ -356775,15 +356775,17 @@ function normalizeOverrides(overrides) {
     denylistPresetKey: overrides.denylistPresetKey === null ? undefined : overrides.denylistPresetKey
   };
 }
-function enforceMintCeiling(c, requestedScopes) {
+function enforceScopeCeiling(c, requestedScopes) {
   const callerScopes = c.get("apiKey")?.scopes ?? [];
-  const exceeding = requestedScopes.filter((scope) => !ApiKeyService.scopeAllows(callerScopes, scope));
+  const signedByScopes = c.get("signedBy") ? c.get("signedByScopes") : undefined;
+  const authorizerScopeSets = signedByScopes ? [callerScopes, signedByScopes] : [callerScopes];
+  const exceeding = requestedScopes.filter((scope) => authorizerScopeSets.some((authorizerScopes) => !ApiKeyService.scopeAllows(authorizerScopes, scope)));
   if (exceeding.length === 0)
     return null;
   return c.json({
     error: {
       code: "FORBIDDEN",
-      message: `Cannot mint a key whose scopes exceed the caller's own. Disallowed: ${exceeding.join(", ")}`
+      message: `Cannot grant scopes that exceed the caller's own. Disallowed: ${exceeding.join(", ")}`
     }
   }, 403);
 }
@@ -356798,7 +356800,7 @@ async function handleProfileCreate(c, data, services) {
       overrides: normalizeOverrides(data.overrides),
       denylistPresetKey: data.denylistPresetKey
     });
-    const ceilingDenied = enforceMintCeiling(c, resolved.scopes);
+    const ceilingDenied = enforceScopeCeiling(c, resolved.scopes);
     if (ceilingDenied)
       return ceilingDenied;
     const result = await services.apiKeys.create({
@@ -356833,7 +356835,7 @@ async function handleLegacyCreate(c, data, services) {
   if (!data.scopes || data.scopes.length === 0) {
     return c.json({ error: { code: "VALIDATION_ERROR", message: "scopes is required when no profile is supplied" } }, 400);
   }
-  const ceilingDenied = enforceMintCeiling(c, data.scopes);
+  const ceilingDenied = enforceScopeCeiling(c, data.scopes);
   if (ceilingDenied)
     return ceilingDenied;
   const result = await services.apiKeys.create({
@@ -356957,6 +356959,11 @@ var init_keys = __esm(() => {
     const id = c.req.param("id");
     const data = c.req.valid("json");
     const services = c.get("services");
+    if (data.scopes) {
+      const ceilingDenied = enforceScopeCeiling(c, data.scopes);
+      if (ceilingDenied)
+        return ceilingDenied;
+    }
     try {
       const updated = await services.apiKeys.update(id, {
         ...data,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@automagik/omni",
-  "version": "2.260717.2",
+  "version": "2.260717.3",
   "description": "LLM-optimized CLI for Omni",
   "type": "module",
   "bin": {