@automagik/omni 2.260719.2 → 2.260719.4

package/dist/index.js

@@ -125191,7 +125191,7 @@ import { fileURLToPath } from "url";
 // package.json
 var package_default = {
   name: "@automagik/omni",
-  version: "2.260719.2",
+  version: "2.260719.4",
   description: "LLM-optimized CLI for Omni",
   type: "module",
   bin: {

package/dist/server/index.js

@@ -227026,7 +227026,7 @@ var init_sentry_scrub = __esm(() => {
 var require_package7 = __commonJS((exports, module) => {
   module.exports = {
     name: "@omni/api",
-    version: "2.260719.2",
+    version: "2.260719.4",
     type: "module",
     exports: {
       ".": {
@@ -358055,7 +358055,7 @@ function isAuthoritySubset(requested, allowed) {
 }
 function enforceInstanceCeiling(c, requestedAuthority) {
   const apiKey = c.get("apiKey");
-  if (!apiKey) {
+  if (!apiKey || apiKey.profile === undefined || !isStringArray(apiKey.instanceAllowlist)) {
     return c.json({
       error: {
         code: "FORBIDDEN",
@@ -358271,32 +358271,25 @@ var init_keys = __esm(() => {
       expiresAt: data.expiresAt === null ? null : data.expiresAt ? new Date(data.expiresAt) : undefined
     };
     try {
-      if (data.instanceIds !== undefined || data.scopes !== undefined) {
-        let authorityDenied;
-        const result = await services.apiKeys.updateWithAuthorityGuard(id, updateOptions, (_current, next) => {
-          authorityDenied = enforceScopeCeiling(c, next.scopes);
-          if (authorityDenied)
-            return false;
-          authorityDenied = enforceInstanceCeiling(c, {
-            instanceIds: next.instanceIds,
-            profile: next.profile,
-            instanceAllowlist: next.instanceAllowlist
-          });
-          return authorityDenied == null;
+      let authorityDenied;
+      const result = await services.apiKeys.updateWithAuthorityGuard(id, updateOptions, (_current, next) => {
+        authorityDenied = enforceScopeCeiling(c, next.scopes);
+        if (authorityDenied)
+          return false;
+        authorityDenied = enforceInstanceCeiling(c, {
+          instanceIds: next.instanceIds,
+          profile: next.profile,
+          instanceAllowlist: next.instanceAllowlist
         });
-        if (result.status === "denied") {
-          return authorityDenied ?? c.json({ error: { code: "FORBIDDEN", message: "API key authority exceeds caller authority" } }, 403);
-        }
-        if (result.status === "not_found") {
-          return c.json({ error: { code: "NOT_FOUND", message: "API key not found" } }, 404);
-        }
-        return c.json({ data: result.key });
+        return authorityDenied == null;
+      });
+      if (result.status === "denied") {
+        return authorityDenied ?? c.json({ error: { code: "FORBIDDEN", message: "API key authority exceeds caller authority" } }, 403);
       }
-      const updated = await services.apiKeys.update(id, updateOptions);
-      if (!updated) {
+      if (result.status === "not_found") {
         return c.json({ error: { code: "NOT_FOUND", message: "API key not found" } }, 404);
       }
-      return c.json({ data: updated });
+      return c.json({ data: result.key });
     } catch (error3) {
       const message2 = error3 instanceof Error ? error3.message : "Unknown error";
       if (message2.includes("Cannot rename primary")) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@automagik/omni",
-  "version": "2.260719.2",
+  "version": "2.260719.4",
   "description": "LLM-optimized CLI for Omni",
   "type": "module",
   "bin": {