@automagik/omni 2.260719.5 → 2.260720.1

package/dist/index.js

@@ -125191,7 +125191,7 @@ import { fileURLToPath } from "url";
 // package.json
 var package_default = {
   name: "@automagik/omni",
-  version: "2.260719.5",
+  version: "2.260720.1",
   description: "LLM-optimized CLI for Omni",
   type: "module",
   bin: {

package/dist/server/index.js

@@ -227026,7 +227026,7 @@ var init_sentry_scrub = __esm(() => {
 var require_package7 = __commonJS((exports, module) => {
   module.exports = {
     name: "@omni/api",
-    version: "2.260719.5",
+    version: "2.260720.1",
     type: "module",
     exports: {
       ".": {
@@ -358053,6 +358053,43 @@ function isAuthoritySubset(requested, allowed) {
     return false;
   return [...requested].every((instanceId) => allowed.has(instanceId));
 }
+function deriveProfileAllowlistAuthorities(input) {
+  if (!isStringArray(input.chatAllowlist) || !isStringArray(input.outboundRecipientAllowlist))
+    return null;
+  if (input.profile !== null && (typeof input.profile !== "string" || !KNOWN_API_KEY_PROFILES.has(input.profile))) {
+    return null;
+  }
+  return {
+    chat: isLockActive(input.profile, "chatAllowlist", input.chatAllowlist) ? new Set(input.chatAllowlist) : null,
+    outboundRecipient: isLockActive(input.profile, "outboundRecipientAllowlist", input.outboundRecipientAllowlist) ? new Set(input.outboundRecipientAllowlist) : null
+  };
+}
+function enforceProfileAllowlistCeilings(c, requestedAuthority) {
+  const apiKey = c.get("apiKey");
+  if (!apiKey || apiKey.profile === undefined || !isStringArray(apiKey.chatAllowlist) || !isStringArray(apiKey.outboundRecipientAllowlist)) {
+    return c.json({
+      error: {
+        code: "FORBIDDEN",
+        message: "Cannot grant chat or recipient access that exceeds the caller's own."
+      }
+    }, 403);
+  }
+  const callerAuthorities = deriveProfileAllowlistAuthorities({
+    profile: apiKey.profile,
+    chatAllowlist: apiKey.chatAllowlist,
+    outboundRecipientAllowlist: apiKey.outboundRecipientAllowlist
+  });
+  const childAuthorities = deriveProfileAllowlistAuthorities(requestedAuthority);
+  const exceedsCaller = callerAuthorities === null || childAuthorities === null || !isAuthoritySubset(childAuthorities.chat, callerAuthorities.chat) || !isAuthoritySubset(childAuthorities.outboundRecipient, callerAuthorities.outboundRecipient);
+  if (!exceedsCaller)
+    return null;
+  return c.json({
+    error: {
+      code: "FORBIDDEN",
+      message: "Cannot grant chat or recipient access that exceeds the caller's own."
+    }
+  }, 403);
+}
 function enforceInstanceCeiling(c, requestedAuthority) {
   const apiKey = c.get("apiKey");
   if (!apiKey || apiKey.profile === undefined || !isStringArray(apiKey.instanceAllowlist)) {
@@ -358100,6 +358137,13 @@ async function handleProfileCreate(c, data, services) {
     });
     if (instanceCeilingDenied)
       return instanceCeilingDenied;
+    const allowlistCeilingDenied = enforceProfileAllowlistCeilings(c, {
+      profile: resolved.profile,
+      chatAllowlist: resolved.chatAllowlist,
+      outboundRecipientAllowlist: resolved.outboundRecipientAllowlist
+    });
+    if (allowlistCeilingDenied)
+      return allowlistCeilingDenied;
     const result = await services.apiKeys.create({
       name: data.name,
       description: data.description,
@@ -358142,6 +358186,13 @@ async function handleLegacyCreate(c, data, services) {
   });
   if (instanceCeilingDenied)
     return instanceCeilingDenied;
+  const allowlistCeilingDenied = enforceProfileAllowlistCeilings(c, {
+    profile: null,
+    chatAllowlist: [],
+    outboundRecipientAllowlist: []
+  });
+  if (allowlistCeilingDenied)
+    return allowlistCeilingDenied;
   const result = await services.apiKeys.create({
     name: data.name,
     description: data.description,
@@ -358281,6 +358332,13 @@ var init_keys = __esm(() => {
           profile: next.profile,
           instanceAllowlist: next.instanceAllowlist
         });
+        if (authorityDenied)
+          return false;
+        authorityDenied = enforceProfileAllowlistCeilings(c, {
+          profile: next.profile,
+          chatAllowlist: next.chatAllowlist,
+          outboundRecipientAllowlist: next.outboundRecipientAllowlist
+        });
         return authorityDenied == null;
       });
       if (result.status === "denied") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@automagik/omni",
-  "version": "2.260719.5",
+  "version": "2.260720.1",
   "description": "LLM-optimized CLI for Omni",
   "type": "module",
   "bin": {