@asiyst/sdk 0.1.6 → 0.1.9

package/README.md

@@ -20,13 +20,27 @@ npx @asiyst/cli init
 
 ## Usage
 
+Project ID is required. The value must be the public Project ID for the target Asiyst project, not the developer account user ID and not the internal Supabase UUID.
+
 ```ts
 import { Asiyst } from "@asiyst/sdk";
 
 await Asiyst.init({
-  projectId: "asiyst_project_id",
-  publicKey: "asiyst_public_key",
+  projectId: "<PUBLIC_PROJECT_ID>",
+  publicKey: "<PUBLIC_KEY>",
+  avatarId: "<PUBLIC_AVATAR_ID>",
+});
+```
+
+Do not pass a secret API key as `publicKey` or omit `projectId`.
+
+`avatarId` selects the avatar that the dashboard configured for this project. It is a public identifier, not an authorization credential. The SDK sends it as a selection hint while the Asiyst API still authenticates and authorizes the project with the public project key.
+
+```ts
+await Asiyst.init({
+  publicKey: "<PUBLIC_KEY>",
 });
+// throws: Asiyst SDK: projectId is required.
 ```
 
 Mark important controls so the assistant can find them across layouts:
@@ -41,7 +55,7 @@ Mark important controls so the assistant can find them across layouts:
 </button>
 ```
 
-The production API base is `https://asiyst.com/api/v1`. It is used by default and can only be overridden explicitly through `apiBaseUrl` for a controlled non-production deployment.
+The production API base is `https://nqhxpgsjofzqudyqkqib.supabase.co/functions/v1/api`. It is used by default and can only be overridden explicitly through `apiBaseUrl` for a controlled non-production deployment.
 
 If Cloud is unreachable, the SDK keeps a fallback avatar configuration and exposes `getConnectionStatus()` as `offline`. Conversation replies and task plans are not invented locally; those requests fail until Cloud responds.
 

package/dist/index.cjs

@@ -59,6 +59,9 @@ var ALL_ACTION_KINDS = [
   "scroll",
   "type",
   "select",
+  "open",
+  "close",
+  "filter",
   "open-menu",
   "open-modal",
   "search",
@@ -68,8 +71,8 @@ var ALL_ACTION_KINDS = [
 ];
 
 // src/core/constants.ts
-var SDK_VERSION = "0.1.5";
-var DEFAULT_API_BASE_URL = "https://asiyst.com/api/v1";
+var SDK_VERSION = "0.1.9" ;
+var DEFAULT_API_BASE_URL = "https://nqhxpgsjofzqudyqkqib.supabase.co/functions/v1/api";
 var CONFIG_SCHEMA_VERSION = 1;
 var HOST_ELEMENT_ID = "asiyst-host";
 var DATA_ATTR = "data-asiyst";
@@ -124,6 +127,19 @@ var ANCHORS = [
   "top-right",
   "top-left"
 ];
+var PUBLIC_IDENTIFIER_PATTERN = /^(?=.{1,128}$)[A-Za-z0-9_][A-Za-z0-9_-]*$/;
+function isValidPublicIdentifier(value) {
+  if (typeof value !== "string") return false;
+  const trimmed = value.trim();
+  if (!trimmed || trimmed.length > 128) return false;
+  if (/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(trimmed)) {
+    return false;
+  }
+  return PUBLIC_IDENTIFIER_PATTERN.test(trimmed);
+}
+function isValidProjectId(value) {
+  return isValidPublicIdentifier(value);
+}
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -152,6 +168,88 @@ function parseAllowedActions(value, fallback) {
   }
   return next.length > 0 ? next : [...fallback];
 }
+function parseStringList(value) {
+  if (typeof value === "string") {
+    return value.split(",").map((item) => sanitizeText(item.trim(), 200)).filter(Boolean);
+  }
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  return value.filter((item) => typeof item === "string").map((item) => sanitizeText(item.trim(), 200)).filter(Boolean);
+}
+function parseRule(value) {
+  if (!isRecord(value)) return null;
+  const action = typeof value.action === "string" ? sanitizeText(value.action, 64) : void 0;
+  if (action && !ALL_ACTION_KINDS.includes(action)) {
+    return null;
+  }
+  const routeList = parseStringList(value.routes ?? value.route);
+  const domainList = parseStringList(value.domains ?? value.domain);
+  const hasAllowedValue = typeof value.allowed === "boolean";
+  const hasAnySemanticField = hasAllowedValue || typeof value.target === "string" || typeof value.route === "string" || routeList.length > 0 || typeof value.domain === "string" || domainList.length > 0 || typeof value.enabled === "boolean" || typeof value.sourceId === "string" || typeof value.dataSourceId === "string";
+  if (!hasAnySemanticField) {
+    return null;
+  }
+  const rule = {
+    action,
+    allowed: typeof value.allowed === "boolean" ? value.allowed : void 0,
+    target: typeof value.target === "string" ? sanitizeText(value.target, 200) : void 0,
+    route: typeof value.route === "string" ? sanitizeText(value.route, 200) : void 0,
+    routes: routeList,
+    domain: typeof value.domain === "string" ? sanitizeText(value.domain, 200) : void 0,
+    domains: domainList,
+    enabled: typeof value.enabled === "boolean" ? value.enabled : void 0,
+    sourceId: typeof value.sourceId === "string" ? sanitizeText(value.sourceId, 128) : void 0,
+    dataSourceId: typeof value.dataSourceId === "string" ? sanitizeText(value.dataSourceId, 128) : void 0
+  };
+  if (typeof value.allowed !== "undefined" && typeof value.allowed !== "boolean") {
+    return null;
+  }
+  return rule;
+}
+function parseRules(value) {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  const rules = [];
+  for (const entry of value) {
+    const rule = parseRule(entry);
+    if (rule) {
+      rules.push(rule);
+    }
+  }
+  return rules;
+}
+function parseDataSources(value) {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  const next = [];
+  for (const entry of value) {
+    if (!isRecord(entry)) continue;
+    const id = typeof entry.id === "string" ? sanitizeText(entry.id, 128) : "";
+    if (!id) continue;
+    next.push({
+      id,
+      name: typeof entry.name === "string" ? sanitizeText(entry.name, 128) : void 0,
+      type: typeof entry.type === "string" ? sanitizeText(entry.type, 64) : void 0,
+      enabled: typeof entry.enabled === "boolean" ? entry.enabled : void 0,
+      url: typeof entry.url === "string" ? sanitizeText(entry.url, 400) : void 0,
+      method: typeof entry.method === "string" ? sanitizeText(entry.method, 20) : void 0,
+      headers: isRecord(entry.headers) ? (() => {
+        const safeHeaders = {};
+        for (const [key, value2] of Object.entries(entry.headers)) {
+          if (typeof value2 === "string") {
+            safeHeaders[sanitizeText(key, 64)] = sanitizeText(value2, 200);
+          }
+        }
+        return safeHeaders;
+      })() : void 0,
+      credentials: typeof entry.credentials === "string" ? "[redacted]" : void 0
+    });
+  }
+  return next;
+}
 function parseTheme(value) {
   if (!isRecord(value)) {
     return {};
@@ -222,6 +320,11 @@ function fallbackConfig() {
     },
     mode: "guided",
     allowedActions: ["navigate", "highlight", "scroll", "wait", "explain", "complete"],
+    allowedDomains: [],
+    allowedRoutes: [],
+    blockedRoutes: [],
+    rules: [],
+    dataSources: [],
     elementSelectors: {}
   };
 }
@@ -245,22 +348,41 @@ function normalizeProjectConfig(raw) {
     behavior: { ...base.behavior, ...parseBehavior(raw.behavior) },
     mode: raw.mode === "assist" ? "assist" : "guided",
     allowedActions: parseAllowedActions(raw.allowedActions, base.allowedActions),
+    allowedDomains: parseStringList(raw.allowedDomains ?? raw.allowed_domains),
+    allowedRoutes: parseStringList(raw.allowedRoutes ?? raw.allowed_routes),
+    blockedRoutes: parseStringList(raw.blockedRoutes ?? raw.blocked_routes),
+    rules: parseRules(raw.rules ?? raw.avatarRules),
+    dataSources: parseDataSources(raw.dataSources ?? raw.enabledDataSources),
     elementSelectors: parseElementSelectors(raw.elementSelectors)
   };
 }
 function validateInitOptions(options) {
-  if (typeof options.projectId !== "string" || !options.projectId.trim()) {
-    throw new ConfigurationError("projectId is required");
+  const projectIdValue = typeof options.projectId === "string" ? options.projectId.trim() : "";
+  if (!projectIdValue) {
+    throw new ConfigurationError("Asiyst SDK: projectId is required.");
+  }
+  if (!isValidProjectId(projectIdValue)) {
+    throw new ConfigurationError("Asiyst SDK: projectId is invalid. Use a public Project ID.");
   }
   if (typeof options.publicKey !== "string" || !options.publicKey.trim()) {
     throw new ConfigurationError("publicKey is required");
   }
-  if (options.projectId.length > 128 || options.publicKey.length > 256) {
+  if (projectIdValue.length > 128 || options.publicKey.trim().length > 256) {
     throw new ConfigurationError("project credentials exceed allowed length");
   }
+  const avatarId = typeof options.avatarId === "string" ? options.avatarId.trim() : "";
+  if (options.avatarId !== void 0 && (!avatarId || avatarId.length > 128 || !/^[A-Za-z0-9_-]+$/.test(avatarId))) {
+    throw new ConfigurationError("Asiyst SDK: avatarId is invalid.");
+  }
+  const position = options.position === void 0 ? void 0 : ANCHORS.includes(options.position) ? options.position : void 0;
+  if (options.position !== void 0 && !position) {
+    throw new ConfigurationError("Asiyst SDK: position is invalid.");
+  }
   return {
-    projectId: options.projectId.trim(),
-    publicKey: options.publicKey.trim()
+    projectId: projectIdValue,
+    publicKey: options.publicKey.trim(),
+    avatarId: avatarId || void 0,
+    position
   };
 }
 
@@ -311,6 +433,7 @@ var HttpTransport = class {
           "Content-Type": "application/json",
           "X-Asiyst-Project-Id": this.options.projectId,
           "X-Asiyst-Public-Key": this.options.publicKey,
+          ...this.options.avatarId ? { "X-Asiyst-Avatar-Id": this.options.avatarId } : {},
           "X-Asiyst-SDK-Version": SDK_VERSION
         },
         body: req.body === void 0 ? void 0 : JSON.stringify(req.body),
@@ -540,6 +663,7 @@ var ConfigManager = class {
     return {
       ...base,
       mode: this.options.mode ?? base.mode,
+      position: this.options.position ?? base.position,
       allowedActions: this.options.allowedActions ?? base.allowedActions
     };
   }
@@ -1637,14 +1761,110 @@ var AvatarController = class {
 };
 
 // src/interaction/permissions.ts
-function isActionAllowed(action, config, source) {
+function normalizeHost(host) {
+  return host.replace(/^https?:\/\//i, "").replace(/\/$/, "").toLowerCase();
+}
+function matchesRoutePattern(pathname, pattern) {
+  const candidate = pathname;
+  const normalized = pattern.trim();
+  if (!normalized) {
+    return false;
+  }
+  const escaped = normalized.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/\\\*/g, ".*");
+  return new RegExp(`^${escaped}$`, "i").test(candidate);
+}
+function isLikelyJavaScriptUrl(value) {
+  const lower = value.trim().toLowerCase();
+  return lower.startsWith("javascript:") || lower.startsWith("data:") || lower.startsWith("vbscript:") || lower.includes("eval(") || lower.includes("new function") || lower.includes("document.cookie");
+}
+function validateWebsiteDomain(config, currentUrl) {
+  const allowedDomains = config.allowedDomains.map((domain) => normalizeHost(domain));
+  if (allowedDomains.length === 0) {
+    return { allowed: true };
+  }
+  try {
+    const parsed = new URL(currentUrl);
+    const host = normalizeHost(parsed.host);
+    const allowed = allowedDomains.some((domain) => host === domain || host.endsWith(`.${domain}`));
+    if (!allowed) {
+      return { allowed: false, reason: "DOMAIN_NOT_AUTHORIZED" };
+    }
+    return { allowed: true };
+  } catch {
+    return { allowed: false, reason: "DOMAIN_NOT_AUTHORIZED" };
+  }
+}
+function canNavigateTo(config, targetUrl, currentUrl) {
+  if (!targetUrl || typeof targetUrl !== "string") {
+    return { allowed: false, reason: "ACTION_NOT_PERMITTED" };
+  }
+  if (isLikelyJavaScriptUrl(targetUrl)) {
+    return { allowed: false, reason: "ACTION_NOT_PERMITTED" };
+  }
+  let target;
+  try {
+    target = new URL(targetUrl, currentUrl);
+  } catch {
+    return { allowed: false, reason: "ACTION_NOT_PERMITTED" };
+  }
+  if (!["http:", "https:"].includes(target.protocol)) {
+    return { allowed: false, reason: "ACTION_NOT_PERMITTED" };
+  }
+  const domainCheck = validateWebsiteDomain(config, currentUrl);
+  if (!domainCheck.allowed) {
+    return domainCheck;
+  }
+  const host = normalizeHost(target.host);
+  const allowedDomains = config.allowedDomains.map((domain) => normalizeHost(domain));
+  if (allowedDomains.length > 0 && !allowedDomains.some((domain) => host === domain || host.endsWith(`.${domain}`))) {
+    return { allowed: false, reason: "DOMAIN_NOT_ALLOWED" };
+  }
+  const pathname = target.pathname || "/";
+  if (config.blockedRoutes.some((route) => matchesRoutePattern(pathname, route))) {
+    return { allowed: false, reason: "ROUTE_BLOCKED" };
+  }
+  if (config.allowedRoutes.length > 0 && !config.allowedRoutes.some((route) => matchesRoutePattern(pathname, route))) {
+    return { allowed: false, reason: "ROUTE_NOT_PERMITTED" };
+  }
+  return { allowed: true };
+}
+function evaluateActionPermission(action, config, currentUrl, target) {
+  const explicitRule = config.rules.find((rule) => rule.action === action && rule.enabled !== false);
+  if (explicitRule && typeof explicitRule.allowed === "boolean") {
+    if (!explicitRule.allowed) {
+      return { allowed: false, reason: "ACTION_NOT_PERMITTED" };
+    }
+  }
+  if (!config.allowedActions.includes(action)) {
+    return { allowed: false, reason: "ACTION_NOT_PERMITTED" };
+  }
+  if (action === "navigate") {
+    if (!target) {
+      return { allowed: true };
+    }
+    return canNavigateTo(config, target, currentUrl);
+  }
+  const allowedDomains = config.allowedDomains;
+  if (allowedDomains.length > 0) {
+    const domainCheck = validateWebsiteDomain(config, currentUrl);
+    if (!domainCheck.allowed) {
+      return domainCheck;
+    }
+  }
+  return { allowed: true };
+}
+function isActionAllowed(action, config, source, currentUrl, target) {
   if (source === "developer") {
     return true;
   }
-  return config.allowedActions.includes(action);
+  if (currentUrl) {
+    return evaluateActionPermission(action, config, currentUrl, target).allowed;
+  }
+  return config.allowedActions.includes(action) && !config.rules.some((rule) => rule.action === action && rule.allowed === false);
 }
-function assertActionAllowed(action, config, source) {
-  if (!isActionAllowed(action, config, source)) {
+function assertActionAllowed(action, config, source, currentUrl, target) {
+  const allowed = isActionAllowed(action, config, source, currentUrl, target);
+  if (!allowed) {
     throw new ActionNotAllowedError(`Action "${action}" is not permitted for this project`);
   }
 }
@@ -1674,7 +1894,12 @@ var InteractionEngine = class {
   }
   async execute(step, source) {
     const config = this.getConfig();
-    assertActionAllowed(step.action, config, source);
+    const currentUrl = this.win.location.href;
+    const target = step.url ?? (typeof step.target === "string" ? step.target : void 0);
+    const allowed = this.evaluatePermission(step.action, config, currentUrl, target, source);
+    if (!allowed.ok) {
+      return { ok: false, waitedForUser: false, allowed: false, reason: allowed.reason ?? "ACTION_NOT_PERMITTED" };
+    }
     const wait = shouldWaitForUser(step.action, config.mode, step.waitForUser);
     switch (step.action) {
       case "explain":
@@ -1705,6 +1930,14 @@ var InteractionEngine = class {
         throw new TaskExecutionError("Unsupported action");
     }
   }
+  evaluatePermission(action, config, currentUrl, target, source) {
+    try {
+      assertActionAllowed(action, config, source, currentUrl, target);
+      return { ok: true };
+    } catch {
+      return { ok: false, reason: "ACTION_NOT_PERMITTED" };
+    }
+  }
   async highlight(step, source, wait) {
     if (!step.target) {
       throw new TaskExecutionError("Highlight requires a target");
@@ -1888,6 +2121,11 @@ var TaskEngine = class {
         }
         this.move(TaskStatus.ActionStarted);
         const result = await this.interaction.execute(step, source);
+        if (!result.ok) {
+          this.events.emit("asiyst:task:failed", { taskId: task.id, reason: result.reason ?? "ACTION_NOT_PERMITTED" });
+          this.analytics.track("task_failed", { taskId: task.id });
+          return this.finish(TaskStatus.Failed, result.reason ?? "ACTION_NOT_PERMITTED");
+        }
         if (result.waitedForUser && result.elementId) {
           this.move(TaskStatus.WaitingForUser);
           const clicked = await this.interaction.waitForElementClick(result.elementId, step.timeoutMs ?? 3e4);
@@ -2133,7 +2371,8 @@ var AsiystRuntime = class {
     const transport = new HttpTransport({
       apiBaseUrl: options.apiBaseUrl ?? DEFAULT_API_BASE_URL,
       projectId: options.projectId,
-      publicKey: options.publicKey
+      publicKey: options.publicKey,
+      avatarId: options.avatarId
     });
     this.cloud = new CloudClient(transport, options.projectId);
     this.config = new ConfigManager(options, this.cloud, this.events);
@@ -2190,6 +2429,15 @@ var AsiystRuntime = class {
   async start() {
     this.events.emit("asiyst:initialized", { projectId: this.options.projectId });
     const cfg = await isolateAsync(() => this.config.refresh(), this.config.get());
+    const domainCheck = validateWebsiteDomain(cfg, window.location.href);
+    if (!domainCheck.allowed) {
+      this.connectionStatus = "disconnected";
+      this.events.emit("asiyst:error", {
+        code: "domain_not_authorized",
+        message: "This website is not authorized for the current Asiyst project."
+      });
+      return;
+    }
     this.avatar.applyConfig(cfg);
     this.avatar.show();
     try {
@@ -2396,12 +2644,16 @@ exports.TargetNotFoundError = TargetNotFoundError;
 exports.TaskExecutionError = TaskExecutionError;
 exports.TaskStatus = TaskStatus;
 exports.anchorToViewport = anchorToViewport;
+exports.canNavigateTo = canNavigateTo;
 exports.canTransition = canTransition;
 exports.computeAvatarDestination = computeAvatarDestination;
+exports.evaluateActionPermission = evaluateActionPermission;
 exports.fallbackConfig = fallbackConfig;
+exports.isActionAllowed = isActionAllowed;
 exports.isSafeSelector = isSafeSelector;
 exports.normalizeProjectConfig = normalizeProjectConfig;
 exports.sanitizeText = sanitizeText;
 exports.validateInitOptions = validateInitOptions;
+exports.validateWebsiteDomain = validateWebsiteDomain;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map