@automagik/omni 2.260714.1 → 2.260714.3

package/dist/server/index.js

@@ -225883,7 +225883,7 @@ var init_sentry_scrub = __esm(() => {
 var require_package7 = __commonJS((exports, module) => {
   module.exports = {
     name: "@omni/api",
-    version: "2.260714.1",
+    version: "2.260714.3",
     type: "module",
     exports: {
       ".": {
@@ -278135,7 +278135,16 @@ var init_schema2 = __esm(() => {
   accessModes = ["disabled", "blocklist", "allowlist"];
   settingValueTypes = ["string", "integer", "boolean", "json", "secret"];
   apiKeyStatuses = ["active", "revoked", "expired"];
-  apiKeyProfiles = ["cs", "personal", "scout", "coworker", "admin"];
+  apiKeyProfiles = [
+    "cs",
+    "personal",
+    "scout",
+    "coworker",
+    "admin",
+    "console-viewer",
+    "console-operator",
+    "console-admin"
+  ];
   eventTypes = CORE_EVENT_TYPES;
   contentTypes = [
     "text",
@@ -285031,8 +285040,80 @@ var init_genie_signature = __esm(() => {
 });
 
 // ../api/src/constants/profiles.ts
-var COWORKER_DEFAULT_DENYLIST_PRESET_KEY = "khal-os-core", PROFILES;
+var COWORKER_DEFAULT_DENYLIST_PRESET_KEY = "khal-os-core", CONSOLE_READ_SCOPES, CONSOLE_OPERATE_SCOPES, CONSOLE_ADMINISTRATION_SCOPES, CONSOLE_VIEWER_SCOPES, CONSOLE_OPERATOR_SCOPES, CONSOLE_ADMIN_SCOPES, PROFILES;
 var init_profiles = __esm(() => {
+  CONSOLE_READ_SCOPES = [
+    "access:read",
+    "agent-state:read",
+    "agent-tasks:read",
+    "agents:read",
+    "auth:validate",
+    "automations:read",
+    "batch-jobs:read",
+    "chats:read",
+    "context:read",
+    "conversations:read",
+    "dead-letters:read",
+    "event-ops:read",
+    "events:read",
+    "follow-up:read",
+    "handoffs:read",
+    "instances:read",
+    "journeys:read",
+    "logs:read",
+    "media:read",
+    "messages:read",
+    "metrics:read",
+    "payloads:read",
+    "persons:read",
+    "providers:read",
+    "routes:read",
+    "settings:read",
+    "trust:read",
+    "voice:read",
+    "webhooks:read"
+  ];
+  CONSOLE_OPERATE_SCOPES = [
+    "agent-state:write",
+    "agent-tasks:write",
+    "automations:write",
+    "batch-jobs:write",
+    "chats:write",
+    "context:write",
+    "conversations:write",
+    "dead-letters:write",
+    "event-ops:write",
+    "events:write",
+    "follow-up:write",
+    "instances:write",
+    "media:write",
+    "messages:send",
+    "messages:write",
+    "persons:write",
+    "routes:write",
+    "tts:synthesize",
+    "turns:admin",
+    "turns:close",
+    "voice:write"
+  ];
+  CONSOLE_ADMINISTRATION_SCOPES = [
+    "access:write",
+    "agents:write",
+    "keys:read",
+    "keys:write",
+    "payloads:write",
+    "providers:write",
+    "settings:write",
+    "trust:write",
+    "webhooks:write"
+  ];
+  CONSOLE_VIEWER_SCOPES = [...CONSOLE_READ_SCOPES];
+  CONSOLE_OPERATOR_SCOPES = [...CONSOLE_READ_SCOPES, ...CONSOLE_OPERATE_SCOPES];
+  CONSOLE_ADMIN_SCOPES = [
+    ...CONSOLE_READ_SCOPES,
+    ...CONSOLE_OPERATE_SCOPES,
+    ...CONSOLE_ADMINISTRATION_SCOPES
+  ];
   PROFILES = {
     cs: {
       buckets: ["outgoing", "read", "context", "turn"],
@@ -285063,6 +285144,27 @@ var init_profiles = __esm(() => {
       buckets: ["outgoing", "read", "context", "turn", "multimodal_in", "multimodal_out"],
       requiresLocks: [],
       adminOnlyFlag: true
+    },
+    "console-viewer": {
+      buckets: [],
+      requiresLocks: [],
+      defaultOverrides: {
+        extraScopes: CONSOLE_VIEWER_SCOPES
+      }
+    },
+    "console-operator": {
+      buckets: [],
+      requiresLocks: [],
+      defaultOverrides: {
+        extraScopes: CONSOLE_OPERATOR_SCOPES
+      }
+    },
+    "console-admin": {
+      buckets: [],
+      requiresLocks: [],
+      defaultOverrides: {
+        extraScopes: CONSOLE_ADMIN_SCOPES
+      }
     }
   };
 });
@@ -285420,6 +285522,17 @@ var init_scopes = __esm(() => {
     "POST /events/search": "events:read",
     "GET /events/:id": "events:read",
     "GET /events/by-sender/:senderId": "events:read",
+    "GET /follow-up/agents/:id": "follow-up:read",
+    "PUT /follow-up/agents/:id": "follow-up:write",
+    "DELETE /follow-up/agents/:id": "follow-up:write",
+    "GET /follow-up/instances/:id": "follow-up:read",
+    "PUT /follow-up/instances/:id": "follow-up:write",
+    "DELETE /follow-up/instances/:id": "follow-up:write",
+    "GET /follow-up/chats/:id": "follow-up:read",
+    "PUT /follow-up/chats/:id": "follow-up:write",
+    "DELETE /follow-up/chats/:id": "follow-up:write",
+    "GET /handoffs": "handoffs:read",
+    "GET /handoffs/:id": "handoffs:read",
     "GET /instances": "instances:read",
     "GET /instances/supported-channels": "instances:read",
     "GET /instances/:id": "instances:read",
@@ -285553,6 +285666,15 @@ var init_scopes = __esm(() => {
     "POST /turns/:id/close": "turns:admin",
     "POST /turns/close-all": "turns:admin",
     "POST /turns/close": "turns:close",
+    "POST /trust/handshake": "trust:write",
+    "GET /trust/hosts": "trust:read",
+    "GET /trust/hosts/:id": "trust:read",
+    "PATCH /trust/hosts/:id": "trust:write",
+    "DELETE /trust/hosts/:id": "trust:write",
+    "POST /voice/join": "voice:write",
+    "POST /voice/leave": "voice:write",
+    "GET /voice/sessions": "voice:read",
+    "GET /voice/sessions/:id": "voice:read",
     "GET /webhook-sources": "webhooks:read",
     "GET /webhook-sources/:id": "webhooks:read",
     "POST /webhook-sources": "webhooks:write",
@@ -346319,7 +346441,7 @@ function registerAuthSchemas(registry4) {
   registry4.register("AuthValidateResponse", AuthValidateResponseSchema);
   registry4.registerPath({
     method: "post",
-    path: "/api/v2/auth/validate",
+    path: "/auth/validate",
     operationId: "validateApiKey",
     tags: ["Auth"],
     summary: "Validate API key",
@@ -349766,9 +349888,28 @@ var init_webhooks2 = __esm(() => {
 });
 
 // ../api/src/routes/openapi.ts
+function annotateScopes(document2) {
+  const paths = document2.paths;
+  if (!paths)
+    return;
+  for (const [pathKey, pathItem] of Object.entries(paths)) {
+    if (!pathItem)
+      continue;
+    const honoPath = pathKey.replace(/\{([^}]+)\}/g, ":$1");
+    for (const method of HTTP_METHODS) {
+      const operation = pathItem[method];
+      if (!operation || typeof operation !== "object")
+        continue;
+      const scope = SCOPE_MAP[`${method.toUpperCase()} ${honoPath}`];
+      if (scope) {
+        operation["x-omni-scope"] = scope;
+      }
+    }
+  }
+}
 function generateOpenApiSpec() {
   const generator = new OpenApiGeneratorV3(registry4.definitions);
-  return generator.generateDocument({
+  const document2 = generator.generateDocument({
     openapi: "3.0.3",
     info: openApiInfo,
     servers: [
@@ -349784,12 +349925,15 @@ function generateOpenApiSpec() {
     ],
     tags: apiTags
   });
+  annotateScopes(document2);
+  return document2;
 }
-var registry4, openapiRoutes, openApiSpec;
+var registry4, openapiRoutes, HTTP_METHODS, openApiSpec;
 var init_openapi2 = __esm(() => {
   init_dist4();
   init_dist5();
   init_dist2();
+  init_scopes();
   init_openapi();
   init_zod_openapi();
   init_access2();
@@ -349841,6 +349985,7 @@ var init_openapi2 = __esm(() => {
   registerFollowUpSchemas(registry4);
   registerVoiceSchemas(registry4);
   openapiRoutes = new Hono2;
+  HTTP_METHODS = ["get", "put", "post", "delete", "patch", "options", "head", "trace"];
   openApiSpec = generateOpenApiSpec();
   openapiRoutes.get("/openapi.json", (c) => {
     return c.json(openApiSpec);
@@ -356630,6 +356775,18 @@ function normalizeOverrides(overrides) {
     denylistPresetKey: overrides.denylistPresetKey === null ? undefined : overrides.denylistPresetKey
   };
 }
+function enforceMintCeiling(c, requestedScopes) {
+  const callerScopes = c.get("apiKey")?.scopes ?? [];
+  const exceeding = requestedScopes.filter((scope) => !ApiKeyService.scopeAllows(callerScopes, scope));
+  if (exceeding.length === 0)
+    return null;
+  return c.json({
+    error: {
+      code: "FORBIDDEN",
+      message: `Cannot mint a key whose scopes exceed the caller's own. Disallowed: ${exceeding.join(", ")}`
+    }
+  }, 403);
+}
 async function handleProfileCreate(c, data, services) {
   try {
     const resolved = resolveProfile({
@@ -356641,6 +356798,9 @@ async function handleProfileCreate(c, data, services) {
       overrides: normalizeOverrides(data.overrides),
       denylistPresetKey: data.denylistPresetKey
     });
+    const ceilingDenied = enforceMintCeiling(c, resolved.scopes);
+    if (ceilingDenied)
+      return ceilingDenied;
     const result = await services.apiKeys.create({
       name: data.name,
       description: data.description,
@@ -356673,6 +356833,9 @@ async function handleLegacyCreate(c, data, services) {
   if (!data.scopes || data.scopes.length === 0) {
     return c.json({ error: { code: "VALIDATION_ERROR", message: "scopes is required when no profile is supplied" } }, 400);
   }
+  const ceilingDenied = enforceMintCeiling(c, data.scopes);
+  if (ceilingDenied)
+    return ceilingDenied;
   const result = await services.apiKeys.create({
     name: data.name,
     description: data.description,
@@ -356691,8 +356854,17 @@ var init_keys = __esm(() => {
   init_zod();
   init_resolve_profile();
   init_date_query();
+  init_api_keys();
   keysRoutes = new Hono2;
-  NON_ADMIN_PROFILES = ["cs", "personal", "scout", "coworker"];
+  NON_ADMIN_PROFILES = [
+    "cs",
+    "personal",
+    "scout",
+    "coworker",
+    "console-viewer",
+    "console-operator",
+    "console-admin"
+  ];
   profileOverridesSchema = exports_external.object({
     add: exports_external.array(exports_external.string()).optional(),
     remove: exports_external.array(exports_external.string()).optional(),
@@ -356706,7 +356878,7 @@ var init_keys = __esm(() => {
     instanceIds: exports_external.array(exports_external.string().uuid()).optional().describe("Restrict key to specific instance IDs"),
     rateLimit: exports_external.number().int().positive().optional().describe("Rate limit in requests per minute"),
     expiresAt: exports_external.string().datetime().optional().describe("Expiration timestamp (ISO 8601)"),
-    profile: exports_external.enum(NON_ADMIN_PROFILES).optional().describe("Profile template: cs, personal, scout, coworker. admin is CLI-only and rejected here."),
+    profile: exports_external.enum(NON_ADMIN_PROFILES).optional().describe("Profile template: cs, personal, scout, coworker, console-viewer, console-operator, console-admin. " + "admin is CLI-only and rejected here."),
     overrides: profileOverridesSchema.optional().describe("Tenant overrides merged on top of the profile template"),
     chatAllowlist: exports_external.array(exports_external.string()).optional().describe("Chats this key may target (profile-aware semantics)"),
     instanceAllowlist: exports_external.array(exports_external.string().uuid()).optional().describe("Instances this key may target"),
@@ -356739,7 +356911,7 @@ var init_keys = __esm(() => {
     cursor: exports_external.string().optional().describe("Pagination cursor")
   });
   keysRoutes.post("/", async (c, next) => {
-    const raw2 = await c.req.raw.clone().json().catch(() => null);
+    const raw2 = await c.req.json().catch(() => null);
     if (raw2 && typeof raw2 === "object" && raw2.profile === "admin") {
       return c.json({
         error: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@automagik/omni",
-  "version": "2.260714.1",
+  "version": "2.260714.3",
   "description": "LLM-optimized CLI for Omni",
   "type": "module",
   "bin": {