@frankieai/server 0.2.3 → 0.2.4

package/dist/{chunk-MKN5663J.js → chunk-7J5Z5MIK.js}

@@ -441,7 +441,6 @@ var OpenApiError = class extends Error {
 };
 async function inspectApiCapabilities(source, options = {}) {
   const doc = await loadSpec(source.spec, options.fetchImpl);
-  const allowedMethods = new Set(source.methods);
   const hasPerUserAuth = Boolean(source.forwardUserTokenAs) || source.forwardUserClaims.length > 0;
   const capabilities = [];
   for (const [path, item] of Object.entries(doc.paths ?? {})) {
@@ -451,7 +450,6 @@ async function inspectApiCapabilities(source, options = {}) {
       const operation = item[method];
       if (!isRecord(operation)) continue;
       const httpMethod = method.toUpperCase();
-      if (!allowedMethods.has(httpMethod)) continue;
       const operationId = typeof operation["operationId"] === "string" ? operation["operationId"] : `${method}_${slug(path)}`;
       if (source.operations.length > 0 && !source.operations.includes(operationId)) continue;
       const toolName = `${API_TOOL_PREFIX}${source.name}__${sanitize(operationId)}`;
@@ -499,14 +497,14 @@ async function buildOne(source, options) {
     for (const method of ["get", "post", "put", "patch", "delete"]) {
       const operation = item[method];
       if (!isRecord(operation)) continue;
-      if (!allowedMethods.has(method.toUpperCase())) continue;
       const operationId = typeof operation["operationId"] === "string" ? operation["operationId"] : `${method}_${slug(path)}`;
       if (source.operations.length > 0 && !source.operations.includes(operationId)) continue;
-      if (source.selectedTools && !source.selectedTools.includes(operationId)) continue;
+      if (source.selectedTools ? !source.selectedTools.includes(operationId) : !allowedMethods.has(method.toUpperCase())) continue;
       const name = `${API_TOOL_PREFIX}${source.name}__${sanitize(operationId)}`;
       if (!evaluateToolPolicy(name, options.policy).allowed) continue;
       const params = collectParameters(doc, item, operation);
       const body = collectRequestBody(doc, operation);
+      const scopeRules = parseScopeRules(operation);
       const { headers: securedHeaders, query: securityQuery } = applySecurity(doc, source, operation, schemes);
       const headers = buildForwardedHeaders({ ...source, headers: securedHeaders }, options.session);
       const opBaseUrl = resolveOperationBaseUrl(source, doc, item, operation, baseUrl ?? "");
@@ -540,6 +538,7 @@ ${retrySafetyNote(method, doc, item, operation)}`,
             );
           }
           const input = enforceIdentityParams(params, isRecord(args) ? args : {}, options.session);
+          enforceResourceScope(scopeRules, input, options.session);
           const url = buildUrl(opBaseUrl, path, params, input, securityQuery);
           const rawBody = body ? input["body"] : void 0;
           const requestBody = isRecord(rawBody) ? enforceServerDerivedIdentity(rawBody, options.session) : rawBody;
@@ -859,6 +858,39 @@ function enforceIdentityParams(params, input, session) {
   }
   return next;
 }
+function parseScopeRules(operation) {
+  const raw = operation["x-frankie-scope"];
+  const entries = Array.isArray(raw) ? raw : raw !== void 0 ? [raw] : [];
+  const rules = [];
+  for (const entry of entries) {
+    if (isRecord(entry) && typeof entry["param"] === "string" && typeof entry["claim"] === "string") {
+      rules.push({ param: entry["param"], claim: entry["claim"] });
+    }
+  }
+  return rules;
+}
+function enforceResourceScope(rules, input, session) {
+  for (const rule of rules) {
+    if (session.user.anonymous) {
+      throw new Error(
+        `"${rule.param}" is access-scoped, but the chat session is anonymous \u2014 Frankie will not call it for an unauthenticated visitor. Report this to the user instead of retrying.`
+      );
+    }
+    const requested = input[rule.param];
+    if (requested === void 0 || requested === null || requested === "") {
+      throw new Error(
+        `This operation requires an in-scope "${rule.param}" and none was given. Report this to the user instead of retrying.`
+      );
+    }
+    const allowed = session.user.claims[rule.claim];
+    const allowedList = Array.isArray(allowed) ? allowed.map((entry) => String(entry)) : typeof allowed === "string" ? [allowed] : [];
+    if (!allowedList.includes(String(requested))) {
+      throw new Error(
+        `Access denied: "${String(requested)}" is not in this user's "${rule.claim}" scope. Do not retry with a different id \u2014 report this to the user.`
+      );
+    }
+  }
+}
 
 // src/agent/mcp.ts
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
@@ -1922,6 +1954,7 @@ var EventQueue = class {
 // src/app.ts
 import { randomUUID as randomUUID4 } from "crypto";
 import { Hono as Hono3 } from "hono";
+import { suggestedPromptsFromSkills } from "@frankieai/core";
 
 // src/guide.ts
 import { Hono as Hono2 } from "hono";
@@ -2154,7 +2187,13 @@ function createFrankieApp(options) {
         launcherLabel: config.branding.launcherLabel
       },
       greeting: config.agent.greeting,
-      suggestedPrompts: config.agent.suggestedPrompts,
+      // Fall back to prompts derived from the workspace's own published skills,
+      // so an empty chat suggests what this assistant can actually do instead of
+      // nothing. An explicitly authored list always wins.
+      suggestedPrompts: config.agent.suggestedPrompts.length ? config.agent.suggestedPrompts : suggestedPromptsFromSkills(config),
+      // Explicit starter cards configured in the dashboard's Appearance tab.
+      // When set, the widget renders these instead of the suggestedPrompts.
+      starterPrompts: config.agent.starterPrompts,
       theme: config.theme,
       allowAnonymous: config.auth.allowAnonymous,
       showToolActivity: config.agent.showToolActivity,
@@ -2652,6 +2691,11 @@ function toPublicTenant(record) {
     ...record.vercel ? { vercel: publicVercelLink(record.vercel) } : {},
     theme: config.theme,
     features: config.features,
+    agent: {
+      greeting: config.agent.greeting,
+      suggestedPrompts: config.agent.suggestedPrompts,
+      starterPrompts: config.agent.starterPrompts
+    },
     createdAt: record.createdAt,
     updatedAt: record.updatedAt
   };
@@ -3163,4 +3207,4 @@ export {
   resolveStores,
   resolveTenantStore
 };
-//# sourceMappingURL=chunk-MKN5663J.js.map
+//# sourceMappingURL=chunk-7J5Z5MIK.js.map