@asiyst/sdk 0.1.4 → 0.1.8

package/dist/index.d.cts

@@ -69,7 +69,7 @@ type AsiystEventName = keyof AsiystEventMap;
 
 type AnchorPosition = "bottom-right" | "bottom-left" | "top-right" | "top-left";
 type AssistantMode = "guided" | "assist";
-type ActionKind = "navigate" | "click" | "highlight" | "scroll" | "type" | "select" | "open-menu" | "open-modal" | "search" | "wait" | "explain" | "complete";
+type ActionKind = "navigate" | "click" | "highlight" | "scroll" | "type" | "select" | "open" | "close" | "filter" | "open-menu" | "open-modal" | "search" | "wait" | "explain" | "complete";
 type HighlightStyle = "spotlight" | "outline" | "glow" | "pointer" | "pulse" | "dim";
 type ElementKind = "button" | "link" | "input" | "select" | "textarea" | "form" | "navigation" | "heading" | "menu" | "dialog" | "tab" | "card" | "search" | "section" | "other";
 interface TargetRef {
@@ -102,6 +102,28 @@ interface BehaviorConfig {
     voiceSpeed?: number;
     speechBubble?: boolean;
 }
+interface AvatarRuntimeRule {
+    action?: string;
+    allowed?: boolean;
+    target?: string;
+    route?: string;
+    routes?: string[];
+    domain?: string;
+    domains?: string[];
+    enabled?: boolean;
+    sourceId?: string;
+    dataSourceId?: string;
+}
+interface AvatarDataSource {
+    id: string;
+    name?: string;
+    type?: string;
+    enabled?: boolean;
+    url?: string;
+    method?: string;
+    headers?: Record<string, string>;
+    credentials?: string;
+}
 interface ProjectConfig {
     schemaVersion: number;
     version: number;
@@ -116,6 +138,11 @@ interface ProjectConfig {
     behavior: BehaviorConfig;
     mode: AssistantMode;
     allowedActions: ActionKind[];
+    allowedDomains: string[];
+    allowedRoutes: string[];
+    blockedRoutes: string[];
+    rules: AvatarRuntimeRule[];
+    dataSources: AvatarDataSource[];
     elementSelectors: Record<string, string>;
 }
 interface Rect {
@@ -210,7 +237,7 @@ declare const Asiyst: {
     off<K extends keyof AsiystEventMap>(event: K, handler: (payload: AsiystEventMap[K]) => void): void;
 };
 
-declare const SDK_VERSION = "0.1.0";
+declare const SDK_VERSION: string;
 
 declare class AsiystError extends Error {
     readonly code: string;
@@ -299,4 +326,18 @@ declare function anchorToViewport(position: "bottom-right" | "bottom-left" | "to
     y: number;
 };
 
-export { type ActionKind, ActionNotAllowedError, Asiyst, AsiystError, type AsiystEventMap, type AsiystEventName, type AssistantMode, AuthenticationError, ConfigurationError, type HighlightStyle, type InitOptions, InitializationError, type MappedElement, NetworkError, type ProjectConfig, SDK_VERSION, type TargetInput, TargetNotFoundError, type TargetRef, type TaskDefinition, TaskExecutionError, TaskStatus, type TaskStep, type WebsiteMapSnapshot, type WorkflowDefinition, anchorToViewport, canTransition, computeAvatarDestination, fallbackConfig, isSafeSelector, normalizeProjectConfig, sanitizeText, validateInitOptions };
+declare function validateWebsiteDomain(config: ProjectConfig, currentUrl: string): {
+    allowed: boolean;
+    reason?: string;
+};
+declare function canNavigateTo(config: ProjectConfig, targetUrl: string, currentUrl: string): {
+    allowed: boolean;
+    reason?: string;
+};
+declare function evaluateActionPermission(action: ActionKind, config: ProjectConfig, currentUrl: string, target?: string): {
+    allowed: boolean;
+    reason?: string;
+};
+declare function isActionAllowed(action: ActionKind, config: ProjectConfig, source: "developer" | "cloud" | "local", currentUrl?: string, target?: string): boolean;
+
+export { type ActionKind, ActionNotAllowedError, Asiyst, AsiystError, type AsiystEventMap, type AsiystEventName, type AssistantMode, AuthenticationError, ConfigurationError, type HighlightStyle, type InitOptions, InitializationError, type MappedElement, NetworkError, type ProjectConfig, SDK_VERSION, type TargetInput, TargetNotFoundError, type TargetRef, type TaskDefinition, TaskExecutionError, TaskStatus, type TaskStep, type WebsiteMapSnapshot, type WorkflowDefinition, anchorToViewport, canNavigateTo, canTransition, computeAvatarDestination, evaluateActionPermission, fallbackConfig, isActionAllowed, isSafeSelector, normalizeProjectConfig, sanitizeText, validateInitOptions, validateWebsiteDomain };

package/dist/index.d.ts

@@ -69,7 +69,7 @@ type AsiystEventName = keyof AsiystEventMap;
 
 type AnchorPosition = "bottom-right" | "bottom-left" | "top-right" | "top-left";
 type AssistantMode = "guided" | "assist";
-type ActionKind = "navigate" | "click" | "highlight" | "scroll" | "type" | "select" | "open-menu" | "open-modal" | "search" | "wait" | "explain" | "complete";
+type ActionKind = "navigate" | "click" | "highlight" | "scroll" | "type" | "select" | "open" | "close" | "filter" | "open-menu" | "open-modal" | "search" | "wait" | "explain" | "complete";
 type HighlightStyle = "spotlight" | "outline" | "glow" | "pointer" | "pulse" | "dim";
 type ElementKind = "button" | "link" | "input" | "select" | "textarea" | "form" | "navigation" | "heading" | "menu" | "dialog" | "tab" | "card" | "search" | "section" | "other";
 interface TargetRef {
@@ -102,6 +102,28 @@ interface BehaviorConfig {
     voiceSpeed?: number;
     speechBubble?: boolean;
 }
+interface AvatarRuntimeRule {
+    action?: string;
+    allowed?: boolean;
+    target?: string;
+    route?: string;
+    routes?: string[];
+    domain?: string;
+    domains?: string[];
+    enabled?: boolean;
+    sourceId?: string;
+    dataSourceId?: string;
+}
+interface AvatarDataSource {
+    id: string;
+    name?: string;
+    type?: string;
+    enabled?: boolean;
+    url?: string;
+    method?: string;
+    headers?: Record<string, string>;
+    credentials?: string;
+}
 interface ProjectConfig {
     schemaVersion: number;
     version: number;
@@ -116,6 +138,11 @@ interface ProjectConfig {
     behavior: BehaviorConfig;
     mode: AssistantMode;
     allowedActions: ActionKind[];
+    allowedDomains: string[];
+    allowedRoutes: string[];
+    blockedRoutes: string[];
+    rules: AvatarRuntimeRule[];
+    dataSources: AvatarDataSource[];
     elementSelectors: Record<string, string>;
 }
 interface Rect {
@@ -210,7 +237,7 @@ declare const Asiyst: {
     off<K extends keyof AsiystEventMap>(event: K, handler: (payload: AsiystEventMap[K]) => void): void;
 };
 
-declare const SDK_VERSION = "0.1.0";
+declare const SDK_VERSION: string;
 
 declare class AsiystError extends Error {
     readonly code: string;
@@ -299,4 +326,18 @@ declare function anchorToViewport(position: "bottom-right" | "bottom-left" | "to
     y: number;
 };
 
-export { type ActionKind, ActionNotAllowedError, Asiyst, AsiystError, type AsiystEventMap, type AsiystEventName, type AssistantMode, AuthenticationError, ConfigurationError, type HighlightStyle, type InitOptions, InitializationError, type MappedElement, NetworkError, type ProjectConfig, SDK_VERSION, type TargetInput, TargetNotFoundError, type TargetRef, type TaskDefinition, TaskExecutionError, TaskStatus, type TaskStep, type WebsiteMapSnapshot, type WorkflowDefinition, anchorToViewport, canTransition, computeAvatarDestination, fallbackConfig, isSafeSelector, normalizeProjectConfig, sanitizeText, validateInitOptions };
+declare function validateWebsiteDomain(config: ProjectConfig, currentUrl: string): {
+    allowed: boolean;
+    reason?: string;
+};
+declare function canNavigateTo(config: ProjectConfig, targetUrl: string, currentUrl: string): {
+    allowed: boolean;
+    reason?: string;
+};
+declare function evaluateActionPermission(action: ActionKind, config: ProjectConfig, currentUrl: string, target?: string): {
+    allowed: boolean;
+    reason?: string;
+};
+declare function isActionAllowed(action: ActionKind, config: ProjectConfig, source: "developer" | "cloud" | "local", currentUrl?: string, target?: string): boolean;
+
+export { type ActionKind, ActionNotAllowedError, Asiyst, AsiystError, type AsiystEventMap, type AsiystEventName, type AssistantMode, AuthenticationError, ConfigurationError, type HighlightStyle, type InitOptions, InitializationError, type MappedElement, NetworkError, type ProjectConfig, SDK_VERSION, type TargetInput, TargetNotFoundError, type TargetRef, type TaskDefinition, TaskExecutionError, TaskStatus, type TaskStep, type WebsiteMapSnapshot, type WorkflowDefinition, anchorToViewport, canNavigateTo, canTransition, computeAvatarDestination, evaluateActionPermission, fallbackConfig, isActionAllowed, isSafeSelector, normalizeProjectConfig, sanitizeText, validateInitOptions, validateWebsiteDomain };

package/dist/index.js

@@ -57,6 +57,9 @@ var ALL_ACTION_KINDS = [
   "scroll",
   "type",
   "select",
+  "open",
+  "close",
+  "filter",
   "open-menu",
   "open-modal",
   "search",
@@ -66,8 +69,8 @@ var ALL_ACTION_KINDS = [
 ];
 
 // src/core/constants.ts
-var SDK_VERSION = "0.1.0";
-var DEFAULT_API_BASE_URL = "https://asiyst.com/api/v1";
+var SDK_VERSION = "0.1.7" ;
+var DEFAULT_API_BASE_URL = "https://nqhxpgsjofzqudyqkqib.supabase.co/functions/v1/api";
 var CONFIG_SCHEMA_VERSION = 1;
 var HOST_ELEMENT_ID = "asiyst-host";
 var DATA_ATTR = "data-asiyst";
@@ -122,6 +125,19 @@ var ANCHORS = [
   "top-right",
   "top-left"
 ];
+var PUBLIC_IDENTIFIER_PATTERN = /^(?=.{1,128}$)[A-Za-z0-9_][A-Za-z0-9_-]*$/;
+function isValidPublicIdentifier(value) {
+  if (typeof value !== "string") return false;
+  const trimmed = value.trim();
+  if (!trimmed || trimmed.length > 128) return false;
+  if (/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(trimmed)) {
+    return false;
+  }
+  return PUBLIC_IDENTIFIER_PATTERN.test(trimmed);
+}
+function isValidProjectId(value) {
+  return isValidPublicIdentifier(value);
+}
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -150,6 +166,88 @@ function parseAllowedActions(value, fallback) {
   }
   return next.length > 0 ? next : [...fallback];
 }
+function parseStringList(value) {
+  if (typeof value === "string") {
+    return value.split(",").map((item) => sanitizeText(item.trim(), 200)).filter(Boolean);
+  }
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  return value.filter((item) => typeof item === "string").map((item) => sanitizeText(item.trim(), 200)).filter(Boolean);
+}
+function parseRule(value) {
+  if (!isRecord(value)) return null;
+  const action = typeof value.action === "string" ? sanitizeText(value.action, 64) : void 0;
+  if (action && !ALL_ACTION_KINDS.includes(action)) {
+    return null;
+  }
+  const routeList = parseStringList(value.routes ?? value.route);
+  const domainList = parseStringList(value.domains ?? value.domain);
+  const hasAllowedValue = typeof value.allowed === "boolean";
+  const hasAnySemanticField = hasAllowedValue || typeof value.target === "string" || typeof value.route === "string" || routeList.length > 0 || typeof value.domain === "string" || domainList.length > 0 || typeof value.enabled === "boolean" || typeof value.sourceId === "string" || typeof value.dataSourceId === "string";
+  if (!hasAnySemanticField) {
+    return null;
+  }
+  const rule = {
+    action,
+    allowed: typeof value.allowed === "boolean" ? value.allowed : void 0,
+    target: typeof value.target === "string" ? sanitizeText(value.target, 200) : void 0,
+    route: typeof value.route === "string" ? sanitizeText(value.route, 200) : void 0,
+    routes: routeList,
+    domain: typeof value.domain === "string" ? sanitizeText(value.domain, 200) : void 0,
+    domains: domainList,
+    enabled: typeof value.enabled === "boolean" ? value.enabled : void 0,
+    sourceId: typeof value.sourceId === "string" ? sanitizeText(value.sourceId, 128) : void 0,
+    dataSourceId: typeof value.dataSourceId === "string" ? sanitizeText(value.dataSourceId, 128) : void 0
+  };
+  if (typeof value.allowed !== "undefined" && typeof value.allowed !== "boolean") {
+    return null;
+  }
+  return rule;
+}
+function parseRules(value) {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  const rules = [];
+  for (const entry of value) {
+    const rule = parseRule(entry);
+    if (rule) {
+      rules.push(rule);
+    }
+  }
+  return rules;
+}
+function parseDataSources(value) {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  const next = [];
+  for (const entry of value) {
+    if (!isRecord(entry)) continue;
+    const id = typeof entry.id === "string" ? sanitizeText(entry.id, 128) : "";
+    if (!id) continue;
+    next.push({
+      id,
+      name: typeof entry.name === "string" ? sanitizeText(entry.name, 128) : void 0,
+      type: typeof entry.type === "string" ? sanitizeText(entry.type, 64) : void 0,
+      enabled: typeof entry.enabled === "boolean" ? entry.enabled : void 0,
+      url: typeof entry.url === "string" ? sanitizeText(entry.url, 400) : void 0,
+      method: typeof entry.method === "string" ? sanitizeText(entry.method, 20) : void 0,
+      headers: isRecord(entry.headers) ? (() => {
+        const safeHeaders = {};
+        for (const [key, value2] of Object.entries(entry.headers)) {
+          if (typeof value2 === "string") {
+            safeHeaders[sanitizeText(key, 64)] = sanitizeText(value2, 200);
+          }
+        }
+        return safeHeaders;
+      })() : void 0,
+      credentials: typeof entry.credentials === "string" ? "[redacted]" : void 0
+    });
+  }
+  return next;
+}
 function parseTheme(value) {
   if (!isRecord(value)) {
     return {};
@@ -220,6 +318,11 @@ function fallbackConfig() {
     },
     mode: "guided",
     allowedActions: ["navigate", "highlight", "scroll", "wait", "explain", "complete"],
+    allowedDomains: [],
+    allowedRoutes: [],
+    blockedRoutes: [],
+    rules: [],
+    dataSources: [],
     elementSelectors: {}
   };
 }
@@ -243,21 +346,30 @@ function normalizeProjectConfig(raw) {
     behavior: { ...base.behavior, ...parseBehavior(raw.behavior) },
     mode: raw.mode === "assist" ? "assist" : "guided",
     allowedActions: parseAllowedActions(raw.allowedActions, base.allowedActions),
+    allowedDomains: parseStringList(raw.allowedDomains ?? raw.allowed_domains),
+    allowedRoutes: parseStringList(raw.allowedRoutes ?? raw.allowed_routes),
+    blockedRoutes: parseStringList(raw.blockedRoutes ?? raw.blocked_routes),
+    rules: parseRules(raw.rules ?? raw.avatarRules),
+    dataSources: parseDataSources(raw.dataSources ?? raw.enabledDataSources),
     elementSelectors: parseElementSelectors(raw.elementSelectors)
   };
 }
 function validateInitOptions(options) {
-  if (typeof options.projectId !== "string" || !options.projectId.trim()) {
-    throw new ConfigurationError("projectId is required");
+  const projectIdValue = typeof options.projectId === "string" ? options.projectId.trim() : "";
+  if (!projectIdValue) {
+    throw new ConfigurationError("Asiyst SDK: projectId is required.");
+  }
+  if (!isValidProjectId(projectIdValue)) {
+    throw new ConfigurationError("Asiyst SDK: projectId is invalid. Use a public Project ID.");
   }
   if (typeof options.publicKey !== "string" || !options.publicKey.trim()) {
     throw new ConfigurationError("publicKey is required");
   }
-  if (options.projectId.length > 128 || options.publicKey.length > 256) {
+  if (projectIdValue.length > 128 || options.publicKey.trim().length > 256) {
     throw new ConfigurationError("project credentials exceed allowed length");
   }
   return {
-    projectId: options.projectId.trim(),
+    projectId: projectIdValue,
     publicKey: options.publicKey.trim()
   };
 }
@@ -980,7 +1092,17 @@ var TargetResolver = class {
     if (!best || bestScore < 2) {
       return null;
     }
-    return findElementByAsiystId(this.doc, best.id) ?? this.doc.querySelector(`[id="${best.id.replace(/^dom:/, "")}"]`);
+    return findElementByAsiystId(this.doc, best.id) ?? this.doc.querySelector(`[id="${best.id.replace(/^dom:/, "")}"]`) ?? this.findMappedElement(best);
+  }
+  findMappedElement(mapped) {
+    const candidates = Array.from(this.doc.querySelectorAll("a[href], button, input, select, textarea, form, nav, h1, h2, h3, [role]"));
+    return candidates.find((element) => {
+      if (!isElementVisible(element) || isDisabled(element)) return false;
+      const text = normalize(`${element.getAttribute("aria-label") ?? ""} ${element.textContent ?? ""}`);
+      const wanted = normalize(`${mapped.label} ${mapped.text}`);
+      const role = normalize(element.getAttribute("role") ?? "");
+      return wanted.length > 0 && (text.includes(wanted) || wanted.includes(text)) || mapped.role !== null && role === normalize(mapped.role);
+    }) ?? null;
   }
   matchesMapped(item, element, ref) {
     if (ref.id && item.id === ref.id) {
@@ -1625,14 +1747,110 @@ var AvatarController = class {
 };
 
 // src/interaction/permissions.ts
-function isActionAllowed(action, config, source) {
+function normalizeHost(host) {
+  return host.replace(/^https?:\/\//i, "").replace(/\/$/, "").toLowerCase();
+}
+function matchesRoutePattern(pathname, pattern) {
+  const candidate = pathname;
+  const normalized = pattern.trim();
+  if (!normalized) {
+    return false;
+  }
+  const escaped = normalized.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/\\\*/g, ".*");
+  return new RegExp(`^${escaped}$`, "i").test(candidate);
+}
+function isLikelyJavaScriptUrl(value) {
+  const lower = value.trim().toLowerCase();
+  return lower.startsWith("javascript:") || lower.startsWith("data:") || lower.startsWith("vbscript:") || lower.includes("eval(") || lower.includes("new function") || lower.includes("document.cookie");
+}
+function validateWebsiteDomain(config, currentUrl) {
+  const allowedDomains = config.allowedDomains.map((domain) => normalizeHost(domain));
+  if (allowedDomains.length === 0) {
+    return { allowed: true };
+  }
+  try {
+    const parsed = new URL(currentUrl);
+    const host = normalizeHost(parsed.host);
+    const allowed = allowedDomains.some((domain) => host === domain || host.endsWith(`.${domain}`));
+    if (!allowed) {
+      return { allowed: false, reason: "DOMAIN_NOT_AUTHORIZED" };
+    }
+    return { allowed: true };
+  } catch {
+    return { allowed: false, reason: "DOMAIN_NOT_AUTHORIZED" };
+  }
+}
+function canNavigateTo(config, targetUrl, currentUrl) {
+  if (!targetUrl || typeof targetUrl !== "string") {
+    return { allowed: false, reason: "ACTION_NOT_PERMITTED" };
+  }
+  if (isLikelyJavaScriptUrl(targetUrl)) {
+    return { allowed: false, reason: "ACTION_NOT_PERMITTED" };
+  }
+  let target;
+  try {
+    target = new URL(targetUrl, currentUrl);
+  } catch {
+    return { allowed: false, reason: "ACTION_NOT_PERMITTED" };
+  }
+  if (!["http:", "https:"].includes(target.protocol)) {
+    return { allowed: false, reason: "ACTION_NOT_PERMITTED" };
+  }
+  const domainCheck = validateWebsiteDomain(config, currentUrl);
+  if (!domainCheck.allowed) {
+    return domainCheck;
+  }
+  const host = normalizeHost(target.host);
+  const allowedDomains = config.allowedDomains.map((domain) => normalizeHost(domain));
+  if (allowedDomains.length > 0 && !allowedDomains.some((domain) => host === domain || host.endsWith(`.${domain}`))) {
+    return { allowed: false, reason: "DOMAIN_NOT_ALLOWED" };
+  }
+  const pathname = target.pathname || "/";
+  if (config.blockedRoutes.some((route) => matchesRoutePattern(pathname, route))) {
+    return { allowed: false, reason: "ROUTE_BLOCKED" };
+  }
+  if (config.allowedRoutes.length > 0 && !config.allowedRoutes.some((route) => matchesRoutePattern(pathname, route))) {
+    return { allowed: false, reason: "ROUTE_NOT_PERMITTED" };
+  }
+  return { allowed: true };
+}
+function evaluateActionPermission(action, config, currentUrl, target) {
+  const explicitRule = config.rules.find((rule) => rule.action === action && rule.enabled !== false);
+  if (explicitRule && typeof explicitRule.allowed === "boolean") {
+    if (!explicitRule.allowed) {
+      return { allowed: false, reason: "ACTION_NOT_PERMITTED" };
+    }
+  }
+  if (!config.allowedActions.includes(action)) {
+    return { allowed: false, reason: "ACTION_NOT_PERMITTED" };
+  }
+  if (action === "navigate") {
+    if (!target) {
+      return { allowed: true };
+    }
+    return canNavigateTo(config, target, currentUrl);
+  }
+  const allowedDomains = config.allowedDomains;
+  if (allowedDomains.length > 0) {
+    const domainCheck = validateWebsiteDomain(config, currentUrl);
+    if (!domainCheck.allowed) {
+      return domainCheck;
+    }
+  }
+  return { allowed: true };
+}
+function isActionAllowed(action, config, source, currentUrl, target) {
   if (source === "developer") {
     return true;
   }
-  return config.allowedActions.includes(action);
+  if (currentUrl) {
+    return evaluateActionPermission(action, config, currentUrl, target).allowed;
+  }
+  return config.allowedActions.includes(action) && !config.rules.some((rule) => rule.action === action && rule.allowed === false);
 }
-function assertActionAllowed(action, config, source) {
-  if (!isActionAllowed(action, config, source)) {
+function assertActionAllowed(action, config, source, currentUrl, target) {
+  const allowed = isActionAllowed(action, config, source, currentUrl, target);
+  if (!allowed) {
     throw new ActionNotAllowedError(`Action "${action}" is not permitted for this project`);
   }
 }
@@ -1662,7 +1880,12 @@ var InteractionEngine = class {
   }
   async execute(step, source) {
     const config = this.getConfig();
-    assertActionAllowed(step.action, config, source);
+    const currentUrl = this.win.location.href;
+    const target = step.url ?? (typeof step.target === "string" ? step.target : void 0);
+    const allowed = this.evaluatePermission(step.action, config, currentUrl, target, source);
+    if (!allowed.ok) {
+      return { ok: false, waitedForUser: false, allowed: false, reason: allowed.reason ?? "ACTION_NOT_PERMITTED" };
+    }
     const wait = shouldWaitForUser(step.action, config.mode, step.waitForUser);
     switch (step.action) {
       case "explain":
@@ -1693,6 +1916,14 @@ var InteractionEngine = class {
         throw new TaskExecutionError("Unsupported action");
     }
   }
+  evaluatePermission(action, config, currentUrl, target, source) {
+    try {
+      assertActionAllowed(action, config, source, currentUrl, target);
+      return { ok: true };
+    } catch {
+      return { ok: false, reason: "ACTION_NOT_PERMITTED" };
+    }
+  }
   async highlight(step, source, wait) {
     if (!step.target) {
       throw new TaskExecutionError("Highlight requires a target");
@@ -1876,6 +2107,11 @@ var TaskEngine = class {
         }
         this.move(TaskStatus.ActionStarted);
         const result = await this.interaction.execute(step, source);
+        if (!result.ok) {
+          this.events.emit("asiyst:task:failed", { taskId: task.id, reason: result.reason ?? "ACTION_NOT_PERMITTED" });
+          this.analytics.track("task_failed", { taskId: task.id });
+          return this.finish(TaskStatus.Failed, result.reason ?? "ACTION_NOT_PERMITTED");
+        }
         if (result.waitedForUser && result.elementId) {
           this.move(TaskStatus.WaitingForUser);
           const clicked = await this.interaction.waitForElementClick(result.elementId, step.timeoutMs ?? 3e4);
@@ -2178,6 +2414,15 @@ var AsiystRuntime = class {
   async start() {
     this.events.emit("asiyst:initialized", { projectId: this.options.projectId });
     const cfg = await isolateAsync(() => this.config.refresh(), this.config.get());
+    const domainCheck = validateWebsiteDomain(cfg, window.location.href);
+    if (!domainCheck.allowed) {
+      this.connectionStatus = "disconnected";
+      this.events.emit("asiyst:error", {
+        code: "domain_not_authorized",
+        message: "This website is not authorized for the current Asiyst project."
+      });
+      return;
+    }
     this.avatar.applyConfig(cfg);
     this.avatar.show();
     try {
@@ -2372,6 +2617,6 @@ var Asiyst = {
   }
 };
 
-export { ActionNotAllowedError, Asiyst, AsiystError, AuthenticationError, ConfigurationError, InitializationError, NetworkError, SDK_VERSION, TargetNotFoundError, TaskExecutionError, TaskStatus, anchorToViewport, canTransition, computeAvatarDestination, fallbackConfig, isSafeSelector, normalizeProjectConfig, sanitizeText, validateInitOptions };
+export { ActionNotAllowedError, Asiyst, AsiystError, AuthenticationError, ConfigurationError, InitializationError, NetworkError, SDK_VERSION, TargetNotFoundError, TaskExecutionError, TaskStatus, anchorToViewport, canNavigateTo, canTransition, computeAvatarDestination, evaluateActionPermission, fallbackConfig, isActionAllowed, isSafeSelector, normalizeProjectConfig, sanitizeText, validateInitOptions, validateWebsiteDomain };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map