@asiyst/sdk 0.1.6 → 0.1.9

package/dist/index.d.cts

@@ -69,7 +69,7 @@ type AsiystEventName = keyof AsiystEventMap;
 
 type AnchorPosition = "bottom-right" | "bottom-left" | "top-right" | "top-left";
 type AssistantMode = "guided" | "assist";
-type ActionKind = "navigate" | "click" | "highlight" | "scroll" | "type" | "select" | "open-menu" | "open-modal" | "search" | "wait" | "explain" | "complete";
+type ActionKind = "navigate" | "click" | "highlight" | "scroll" | "type" | "select" | "open" | "close" | "filter" | "open-menu" | "open-modal" | "search" | "wait" | "explain" | "complete";
 type HighlightStyle = "spotlight" | "outline" | "glow" | "pointer" | "pulse" | "dim";
 type ElementKind = "button" | "link" | "input" | "select" | "textarea" | "form" | "navigation" | "heading" | "menu" | "dialog" | "tab" | "card" | "search" | "section" | "other";
 interface TargetRef {
@@ -82,6 +82,8 @@ type TargetInput = string | TargetRef;
 interface InitOptions {
     projectId: string;
     publicKey: string;
+    avatarId?: string;
+    position?: AnchorPosition;
     apiBaseUrl?: string;
     mode?: AssistantMode;
     allowedActions?: ActionKind[];
@@ -102,6 +104,28 @@ interface BehaviorConfig {
     voiceSpeed?: number;
     speechBubble?: boolean;
 }
+interface AvatarRuntimeRule {
+    action?: string;
+    allowed?: boolean;
+    target?: string;
+    route?: string;
+    routes?: string[];
+    domain?: string;
+    domains?: string[];
+    enabled?: boolean;
+    sourceId?: string;
+    dataSourceId?: string;
+}
+interface AvatarDataSource {
+    id: string;
+    name?: string;
+    type?: string;
+    enabled?: boolean;
+    url?: string;
+    method?: string;
+    headers?: Record<string, string>;
+    credentials?: string;
+}
 interface ProjectConfig {
     schemaVersion: number;
     version: number;
@@ -116,6 +140,11 @@ interface ProjectConfig {
     behavior: BehaviorConfig;
     mode: AssistantMode;
     allowedActions: ActionKind[];
+    allowedDomains: string[];
+    allowedRoutes: string[];
+    blockedRoutes: string[];
+    rules: AvatarRuntimeRule[];
+    dataSources: AvatarDataSource[];
     elementSelectors: Record<string, string>;
 }
 interface Rect {
@@ -210,7 +239,7 @@ declare const Asiyst: {
     off<K extends keyof AsiystEventMap>(event: K, handler: (payload: AsiystEventMap[K]) => void): void;
 };
 
-declare const SDK_VERSION = "0.1.5";
+declare const SDK_VERSION: string;
 
 declare class AsiystError extends Error {
     readonly code: string;
@@ -263,9 +292,13 @@ declare function normalizeProjectConfig(raw: unknown): ProjectConfig;
 declare function validateInitOptions(options: {
     projectId?: unknown;
     publicKey?: unknown;
+    avatarId?: unknown;
+    position?: unknown;
 }): {
     projectId: string;
     publicKey: string;
+    avatarId?: string;
+    position?: AnchorPosition;
 };
 
 declare function isSafeSelector(selector: string): boolean;
@@ -299,4 +332,18 @@ declare function anchorToViewport(position: "bottom-right" | "bottom-left" | "to
     y: number;
 };
 
-export { type ActionKind, ActionNotAllowedError, Asiyst, AsiystError, type AsiystEventMap, type AsiystEventName, type AssistantMode, AuthenticationError, ConfigurationError, type HighlightStyle, type InitOptions, InitializationError, type MappedElement, NetworkError, type ProjectConfig, SDK_VERSION, type TargetInput, TargetNotFoundError, type TargetRef, type TaskDefinition, TaskExecutionError, TaskStatus, type TaskStep, type WebsiteMapSnapshot, type WorkflowDefinition, anchorToViewport, canTransition, computeAvatarDestination, fallbackConfig, isSafeSelector, normalizeProjectConfig, sanitizeText, validateInitOptions };
+declare function validateWebsiteDomain(config: ProjectConfig, currentUrl: string): {
+    allowed: boolean;
+    reason?: string;
+};
+declare function canNavigateTo(config: ProjectConfig, targetUrl: string, currentUrl: string): {
+    allowed: boolean;
+    reason?: string;
+};
+declare function evaluateActionPermission(action: ActionKind, config: ProjectConfig, currentUrl: string, target?: string): {
+    allowed: boolean;
+    reason?: string;
+};
+declare function isActionAllowed(action: ActionKind, config: ProjectConfig, source: "developer" | "cloud" | "local", currentUrl?: string, target?: string): boolean;
+
+export { type ActionKind, ActionNotAllowedError, Asiyst, AsiystError, type AsiystEventMap, type AsiystEventName, type AssistantMode, AuthenticationError, ConfigurationError, type HighlightStyle, type InitOptions, InitializationError, type MappedElement, NetworkError, type ProjectConfig, SDK_VERSION, type TargetInput, TargetNotFoundError, type TargetRef, type TaskDefinition, TaskExecutionError, TaskStatus, type TaskStep, type WebsiteMapSnapshot, type WorkflowDefinition, anchorToViewport, canNavigateTo, canTransition, computeAvatarDestination, evaluateActionPermission, fallbackConfig, isActionAllowed, isSafeSelector, normalizeProjectConfig, sanitizeText, validateInitOptions, validateWebsiteDomain };

package/dist/index.d.ts

@@ -69,7 +69,7 @@ type AsiystEventName = keyof AsiystEventMap;
 
 type AnchorPosition = "bottom-right" | "bottom-left" | "top-right" | "top-left";
 type AssistantMode = "guided" | "assist";
-type ActionKind = "navigate" | "click" | "highlight" | "scroll" | "type" | "select" | "open-menu" | "open-modal" | "search" | "wait" | "explain" | "complete";
+type ActionKind = "navigate" | "click" | "highlight" | "scroll" | "type" | "select" | "open" | "close" | "filter" | "open-menu" | "open-modal" | "search" | "wait" | "explain" | "complete";
 type HighlightStyle = "spotlight" | "outline" | "glow" | "pointer" | "pulse" | "dim";
 type ElementKind = "button" | "link" | "input" | "select" | "textarea" | "form" | "navigation" | "heading" | "menu" | "dialog" | "tab" | "card" | "search" | "section" | "other";
 interface TargetRef {
@@ -82,6 +82,8 @@ type TargetInput = string | TargetRef;
 interface InitOptions {
     projectId: string;
     publicKey: string;
+    avatarId?: string;
+    position?: AnchorPosition;
     apiBaseUrl?: string;
     mode?: AssistantMode;
     allowedActions?: ActionKind[];
@@ -102,6 +104,28 @@ interface BehaviorConfig {
     voiceSpeed?: number;
     speechBubble?: boolean;
 }
+interface AvatarRuntimeRule {
+    action?: string;
+    allowed?: boolean;
+    target?: string;
+    route?: string;
+    routes?: string[];
+    domain?: string;
+    domains?: string[];
+    enabled?: boolean;
+    sourceId?: string;
+    dataSourceId?: string;
+}
+interface AvatarDataSource {
+    id: string;
+    name?: string;
+    type?: string;
+    enabled?: boolean;
+    url?: string;
+    method?: string;
+    headers?: Record<string, string>;
+    credentials?: string;
+}
 interface ProjectConfig {
     schemaVersion: number;
     version: number;
@@ -116,6 +140,11 @@ interface ProjectConfig {
     behavior: BehaviorConfig;
     mode: AssistantMode;
     allowedActions: ActionKind[];
+    allowedDomains: string[];
+    allowedRoutes: string[];
+    blockedRoutes: string[];
+    rules: AvatarRuntimeRule[];
+    dataSources: AvatarDataSource[];
     elementSelectors: Record<string, string>;
 }
 interface Rect {
@@ -210,7 +239,7 @@ declare const Asiyst: {
     off<K extends keyof AsiystEventMap>(event: K, handler: (payload: AsiystEventMap[K]) => void): void;
 };
 
-declare const SDK_VERSION = "0.1.5";
+declare const SDK_VERSION: string;
 
 declare class AsiystError extends Error {
     readonly code: string;
@@ -263,9 +292,13 @@ declare function normalizeProjectConfig(raw: unknown): ProjectConfig;
 declare function validateInitOptions(options: {
     projectId?: unknown;
     publicKey?: unknown;
+    avatarId?: unknown;
+    position?: unknown;
 }): {
     projectId: string;
     publicKey: string;
+    avatarId?: string;
+    position?: AnchorPosition;
 };
 
 declare function isSafeSelector(selector: string): boolean;
@@ -299,4 +332,18 @@ declare function anchorToViewport(position: "bottom-right" | "bottom-left" | "to
     y: number;
 };
 
-export { type ActionKind, ActionNotAllowedError, Asiyst, AsiystError, type AsiystEventMap, type AsiystEventName, type AssistantMode, AuthenticationError, ConfigurationError, type HighlightStyle, type InitOptions, InitializationError, type MappedElement, NetworkError, type ProjectConfig, SDK_VERSION, type TargetInput, TargetNotFoundError, type TargetRef, type TaskDefinition, TaskExecutionError, TaskStatus, type TaskStep, type WebsiteMapSnapshot, type WorkflowDefinition, anchorToViewport, canTransition, computeAvatarDestination, fallbackConfig, isSafeSelector, normalizeProjectConfig, sanitizeText, validateInitOptions };
+declare function validateWebsiteDomain(config: ProjectConfig, currentUrl: string): {
+    allowed: boolean;
+    reason?: string;
+};
+declare function canNavigateTo(config: ProjectConfig, targetUrl: string, currentUrl: string): {
+    allowed: boolean;
+    reason?: string;
+};
+declare function evaluateActionPermission(action: ActionKind, config: ProjectConfig, currentUrl: string, target?: string): {
+    allowed: boolean;
+    reason?: string;
+};
+declare function isActionAllowed(action: ActionKind, config: ProjectConfig, source: "developer" | "cloud" | "local", currentUrl?: string, target?: string): boolean;
+
+export { type ActionKind, ActionNotAllowedError, Asiyst, AsiystError, type AsiystEventMap, type AsiystEventName, type AssistantMode, AuthenticationError, ConfigurationError, type HighlightStyle, type InitOptions, InitializationError, type MappedElement, NetworkError, type ProjectConfig, SDK_VERSION, type TargetInput, TargetNotFoundError, type TargetRef, type TaskDefinition, TaskExecutionError, TaskStatus, type TaskStep, type WebsiteMapSnapshot, type WorkflowDefinition, anchorToViewport, canNavigateTo, canTransition, computeAvatarDestination, evaluateActionPermission, fallbackConfig, isActionAllowed, isSafeSelector, normalizeProjectConfig, sanitizeText, validateInitOptions, validateWebsiteDomain };

package/dist/index.js

@@ -57,6 +57,9 @@ var ALL_ACTION_KINDS = [
   "scroll",
   "type",
   "select",
+  "open",
+  "close",
+  "filter",
   "open-menu",
   "open-modal",
   "search",
@@ -66,8 +69,8 @@ var ALL_ACTION_KINDS = [
 ];
 
 // src/core/constants.ts
-var SDK_VERSION = "0.1.5";
-var DEFAULT_API_BASE_URL = "https://asiyst.com/api/v1";
+var SDK_VERSION = "0.1.9" ;
+var DEFAULT_API_BASE_URL = "https://nqhxpgsjofzqudyqkqib.supabase.co/functions/v1/api";
 var CONFIG_SCHEMA_VERSION = 1;
 var HOST_ELEMENT_ID = "asiyst-host";
 var DATA_ATTR = "data-asiyst";
@@ -122,6 +125,19 @@ var ANCHORS = [
   "top-right",
   "top-left"
 ];
+var PUBLIC_IDENTIFIER_PATTERN = /^(?=.{1,128}$)[A-Za-z0-9_][A-Za-z0-9_-]*$/;
+function isValidPublicIdentifier(value) {
+  if (typeof value !== "string") return false;
+  const trimmed = value.trim();
+  if (!trimmed || trimmed.length > 128) return false;
+  if (/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(trimmed)) {
+    return false;
+  }
+  return PUBLIC_IDENTIFIER_PATTERN.test(trimmed);
+}
+function isValidProjectId(value) {
+  return isValidPublicIdentifier(value);
+}
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -150,6 +166,88 @@ function parseAllowedActions(value, fallback) {
   }
   return next.length > 0 ? next : [...fallback];
 }
+function parseStringList(value) {
+  if (typeof value === "string") {
+    return value.split(",").map((item) => sanitizeText(item.trim(), 200)).filter(Boolean);
+  }
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  return value.filter((item) => typeof item === "string").map((item) => sanitizeText(item.trim(), 200)).filter(Boolean);
+}
+function parseRule(value) {
+  if (!isRecord(value)) return null;
+  const action = typeof value.action === "string" ? sanitizeText(value.action, 64) : void 0;
+  if (action && !ALL_ACTION_KINDS.includes(action)) {
+    return null;
+  }
+  const routeList = parseStringList(value.routes ?? value.route);
+  const domainList = parseStringList(value.domains ?? value.domain);
+  const hasAllowedValue = typeof value.allowed === "boolean";
+  const hasAnySemanticField = hasAllowedValue || typeof value.target === "string" || typeof value.route === "string" || routeList.length > 0 || typeof value.domain === "string" || domainList.length > 0 || typeof value.enabled === "boolean" || typeof value.sourceId === "string" || typeof value.dataSourceId === "string";
+  if (!hasAnySemanticField) {
+    return null;
+  }
+  const rule = {
+    action,
+    allowed: typeof value.allowed === "boolean" ? value.allowed : void 0,
+    target: typeof value.target === "string" ? sanitizeText(value.target, 200) : void 0,
+    route: typeof value.route === "string" ? sanitizeText(value.route, 200) : void 0,
+    routes: routeList,
+    domain: typeof value.domain === "string" ? sanitizeText(value.domain, 200) : void 0,
+    domains: domainList,
+    enabled: typeof value.enabled === "boolean" ? value.enabled : void 0,
+    sourceId: typeof value.sourceId === "string" ? sanitizeText(value.sourceId, 128) : void 0,
+    dataSourceId: typeof value.dataSourceId === "string" ? sanitizeText(value.dataSourceId, 128) : void 0
+  };
+  if (typeof value.allowed !== "undefined" && typeof value.allowed !== "boolean") {
+    return null;
+  }
+  return rule;
+}
+function parseRules(value) {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  const rules = [];
+  for (const entry of value) {
+    const rule = parseRule(entry);
+    if (rule) {
+      rules.push(rule);
+    }
+  }
+  return rules;
+}
+function parseDataSources(value) {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  const next = [];
+  for (const entry of value) {
+    if (!isRecord(entry)) continue;
+    const id = typeof entry.id === "string" ? sanitizeText(entry.id, 128) : "";
+    if (!id) continue;
+    next.push({
+      id,
+      name: typeof entry.name === "string" ? sanitizeText(entry.name, 128) : void 0,
+      type: typeof entry.type === "string" ? sanitizeText(entry.type, 64) : void 0,
+      enabled: typeof entry.enabled === "boolean" ? entry.enabled : void 0,
+      url: typeof entry.url === "string" ? sanitizeText(entry.url, 400) : void 0,
+      method: typeof entry.method === "string" ? sanitizeText(entry.method, 20) : void 0,
+      headers: isRecord(entry.headers) ? (() => {
+        const safeHeaders = {};
+        for (const [key, value2] of Object.entries(entry.headers)) {
+          if (typeof value2 === "string") {
+            safeHeaders[sanitizeText(key, 64)] = sanitizeText(value2, 200);
+          }
+        }
+        return safeHeaders;
+      })() : void 0,
+      credentials: typeof entry.credentials === "string" ? "[redacted]" : void 0
+    });
+  }
+  return next;
+}
 function parseTheme(value) {
   if (!isRecord(value)) {
     return {};
@@ -220,6 +318,11 @@ function fallbackConfig() {
     },
     mode: "guided",
     allowedActions: ["navigate", "highlight", "scroll", "wait", "explain", "complete"],
+    allowedDomains: [],
+    allowedRoutes: [],
+    blockedRoutes: [],
+    rules: [],
+    dataSources: [],
     elementSelectors: {}
   };
 }
@@ -243,22 +346,41 @@ function normalizeProjectConfig(raw) {
     behavior: { ...base.behavior, ...parseBehavior(raw.behavior) },
     mode: raw.mode === "assist" ? "assist" : "guided",
     allowedActions: parseAllowedActions(raw.allowedActions, base.allowedActions),
+    allowedDomains: parseStringList(raw.allowedDomains ?? raw.allowed_domains),
+    allowedRoutes: parseStringList(raw.allowedRoutes ?? raw.allowed_routes),
+    blockedRoutes: parseStringList(raw.blockedRoutes ?? raw.blocked_routes),
+    rules: parseRules(raw.rules ?? raw.avatarRules),
+    dataSources: parseDataSources(raw.dataSources ?? raw.enabledDataSources),
     elementSelectors: parseElementSelectors(raw.elementSelectors)
   };
 }
 function validateInitOptions(options) {
-  if (typeof options.projectId !== "string" || !options.projectId.trim()) {
-    throw new ConfigurationError("projectId is required");
+  const projectIdValue = typeof options.projectId === "string" ? options.projectId.trim() : "";
+  if (!projectIdValue) {
+    throw new ConfigurationError("Asiyst SDK: projectId is required.");
+  }
+  if (!isValidProjectId(projectIdValue)) {
+    throw new ConfigurationError("Asiyst SDK: projectId is invalid. Use a public Project ID.");
   }
   if (typeof options.publicKey !== "string" || !options.publicKey.trim()) {
     throw new ConfigurationError("publicKey is required");
   }
-  if (options.projectId.length > 128 || options.publicKey.length > 256) {
+  if (projectIdValue.length > 128 || options.publicKey.trim().length > 256) {
     throw new ConfigurationError("project credentials exceed allowed length");
   }
+  const avatarId = typeof options.avatarId === "string" ? options.avatarId.trim() : "";
+  if (options.avatarId !== void 0 && (!avatarId || avatarId.length > 128 || !/^[A-Za-z0-9_-]+$/.test(avatarId))) {
+    throw new ConfigurationError("Asiyst SDK: avatarId is invalid.");
+  }
+  const position = options.position === void 0 ? void 0 : ANCHORS.includes(options.position) ? options.position : void 0;
+  if (options.position !== void 0 && !position) {
+    throw new ConfigurationError("Asiyst SDK: position is invalid.");
+  }
   return {
-    projectId: options.projectId.trim(),
-    publicKey: options.publicKey.trim()
+    projectId: projectIdValue,
+    publicKey: options.publicKey.trim(),
+    avatarId: avatarId || void 0,
+    position
   };
 }
 
@@ -309,6 +431,7 @@ var HttpTransport = class {
           "Content-Type": "application/json",
           "X-Asiyst-Project-Id": this.options.projectId,
           "X-Asiyst-Public-Key": this.options.publicKey,
+          ...this.options.avatarId ? { "X-Asiyst-Avatar-Id": this.options.avatarId } : {},
           "X-Asiyst-SDK-Version": SDK_VERSION
         },
         body: req.body === void 0 ? void 0 : JSON.stringify(req.body),
@@ -538,6 +661,7 @@ var ConfigManager = class {
     return {
       ...base,
       mode: this.options.mode ?? base.mode,
+      position: this.options.position ?? base.position,
       allowedActions: this.options.allowedActions ?? base.allowedActions
     };
   }
@@ -1635,14 +1759,110 @@ var AvatarController = class {
 };
 
 // src/interaction/permissions.ts
-function isActionAllowed(action, config, source) {
+function normalizeHost(host) {
+  return host.replace(/^https?:\/\//i, "").replace(/\/$/, "").toLowerCase();
+}
+function matchesRoutePattern(pathname, pattern) {
+  const candidate = pathname;
+  const normalized = pattern.trim();
+  if (!normalized) {
+    return false;
+  }
+  const escaped = normalized.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/\\\*/g, ".*");
+  return new RegExp(`^${escaped}$`, "i").test(candidate);
+}
+function isLikelyJavaScriptUrl(value) {
+  const lower = value.trim().toLowerCase();
+  return lower.startsWith("javascript:") || lower.startsWith("data:") || lower.startsWith("vbscript:") || lower.includes("eval(") || lower.includes("new function") || lower.includes("document.cookie");
+}
+function validateWebsiteDomain(config, currentUrl) {
+  const allowedDomains = config.allowedDomains.map((domain) => normalizeHost(domain));
+  if (allowedDomains.length === 0) {
+    return { allowed: true };
+  }
+  try {
+    const parsed = new URL(currentUrl);
+    const host = normalizeHost(parsed.host);
+    const allowed = allowedDomains.some((domain) => host === domain || host.endsWith(`.${domain}`));
+    if (!allowed) {
+      return { allowed: false, reason: "DOMAIN_NOT_AUTHORIZED" };
+    }
+    return { allowed: true };
+  } catch {
+    return { allowed: false, reason: "DOMAIN_NOT_AUTHORIZED" };
+  }
+}
+function canNavigateTo(config, targetUrl, currentUrl) {
+  if (!targetUrl || typeof targetUrl !== "string") {
+    return { allowed: false, reason: "ACTION_NOT_PERMITTED" };
+  }
+  if (isLikelyJavaScriptUrl(targetUrl)) {
+    return { allowed: false, reason: "ACTION_NOT_PERMITTED" };
+  }
+  let target;
+  try {
+    target = new URL(targetUrl, currentUrl);
+  } catch {
+    return { allowed: false, reason: "ACTION_NOT_PERMITTED" };
+  }
+  if (!["http:", "https:"].includes(target.protocol)) {
+    return { allowed: false, reason: "ACTION_NOT_PERMITTED" };
+  }
+  const domainCheck = validateWebsiteDomain(config, currentUrl);
+  if (!domainCheck.allowed) {
+    return domainCheck;
+  }
+  const host = normalizeHost(target.host);
+  const allowedDomains = config.allowedDomains.map((domain) => normalizeHost(domain));
+  if (allowedDomains.length > 0 && !allowedDomains.some((domain) => host === domain || host.endsWith(`.${domain}`))) {
+    return { allowed: false, reason: "DOMAIN_NOT_ALLOWED" };
+  }
+  const pathname = target.pathname || "/";
+  if (config.blockedRoutes.some((route) => matchesRoutePattern(pathname, route))) {
+    return { allowed: false, reason: "ROUTE_BLOCKED" };
+  }
+  if (config.allowedRoutes.length > 0 && !config.allowedRoutes.some((route) => matchesRoutePattern(pathname, route))) {
+    return { allowed: false, reason: "ROUTE_NOT_PERMITTED" };
+  }
+  return { allowed: true };
+}
+function evaluateActionPermission(action, config, currentUrl, target) {
+  const explicitRule = config.rules.find((rule) => rule.action === action && rule.enabled !== false);
+  if (explicitRule && typeof explicitRule.allowed === "boolean") {
+    if (!explicitRule.allowed) {
+      return { allowed: false, reason: "ACTION_NOT_PERMITTED" };
+    }
+  }
+  if (!config.allowedActions.includes(action)) {
+    return { allowed: false, reason: "ACTION_NOT_PERMITTED" };
+  }
+  if (action === "navigate") {
+    if (!target) {
+      return { allowed: true };
+    }
+    return canNavigateTo(config, target, currentUrl);
+  }
+  const allowedDomains = config.allowedDomains;
+  if (allowedDomains.length > 0) {
+    const domainCheck = validateWebsiteDomain(config, currentUrl);
+    if (!domainCheck.allowed) {
+      return domainCheck;
+    }
+  }
+  return { allowed: true };
+}
+function isActionAllowed(action, config, source, currentUrl, target) {
   if (source === "developer") {
     return true;
   }
-  return config.allowedActions.includes(action);
+  if (currentUrl) {
+    return evaluateActionPermission(action, config, currentUrl, target).allowed;
+  }
+  return config.allowedActions.includes(action) && !config.rules.some((rule) => rule.action === action && rule.allowed === false);
 }
-function assertActionAllowed(action, config, source) {
-  if (!isActionAllowed(action, config, source)) {
+function assertActionAllowed(action, config, source, currentUrl, target) {
+  const allowed = isActionAllowed(action, config, source, currentUrl, target);
+  if (!allowed) {
     throw new ActionNotAllowedError(`Action "${action}" is not permitted for this project`);
   }
 }
@@ -1672,7 +1892,12 @@ var InteractionEngine = class {
   }
   async execute(step, source) {
     const config = this.getConfig();
-    assertActionAllowed(step.action, config, source);
+    const currentUrl = this.win.location.href;
+    const target = step.url ?? (typeof step.target === "string" ? step.target : void 0);
+    const allowed = this.evaluatePermission(step.action, config, currentUrl, target, source);
+    if (!allowed.ok) {
+      return { ok: false, waitedForUser: false, allowed: false, reason: allowed.reason ?? "ACTION_NOT_PERMITTED" };
+    }
     const wait = shouldWaitForUser(step.action, config.mode, step.waitForUser);
     switch (step.action) {
       case "explain":
@@ -1703,6 +1928,14 @@ var InteractionEngine = class {
         throw new TaskExecutionError("Unsupported action");
     }
   }
+  evaluatePermission(action, config, currentUrl, target, source) {
+    try {
+      assertActionAllowed(action, config, source, currentUrl, target);
+      return { ok: true };
+    } catch {
+      return { ok: false, reason: "ACTION_NOT_PERMITTED" };
+    }
+  }
   async highlight(step, source, wait) {
     if (!step.target) {
       throw new TaskExecutionError("Highlight requires a target");
@@ -1886,6 +2119,11 @@ var TaskEngine = class {
         }
         this.move(TaskStatus.ActionStarted);
         const result = await this.interaction.execute(step, source);
+        if (!result.ok) {
+          this.events.emit("asiyst:task:failed", { taskId: task.id, reason: result.reason ?? "ACTION_NOT_PERMITTED" });
+          this.analytics.track("task_failed", { taskId: task.id });
+          return this.finish(TaskStatus.Failed, result.reason ?? "ACTION_NOT_PERMITTED");
+        }
         if (result.waitedForUser && result.elementId) {
           this.move(TaskStatus.WaitingForUser);
           const clicked = await this.interaction.waitForElementClick(result.elementId, step.timeoutMs ?? 3e4);
@@ -2131,7 +2369,8 @@ var AsiystRuntime = class {
     const transport = new HttpTransport({
       apiBaseUrl: options.apiBaseUrl ?? DEFAULT_API_BASE_URL,
       projectId: options.projectId,
-      publicKey: options.publicKey
+      publicKey: options.publicKey,
+      avatarId: options.avatarId
     });
     this.cloud = new CloudClient(transport, options.projectId);
     this.config = new ConfigManager(options, this.cloud, this.events);
@@ -2188,6 +2427,15 @@ var AsiystRuntime = class {
   async start() {
     this.events.emit("asiyst:initialized", { projectId: this.options.projectId });
     const cfg = await isolateAsync(() => this.config.refresh(), this.config.get());
+    const domainCheck = validateWebsiteDomain(cfg, window.location.href);
+    if (!domainCheck.allowed) {
+      this.connectionStatus = "disconnected";
+      this.events.emit("asiyst:error", {
+        code: "domain_not_authorized",
+        message: "This website is not authorized for the current Asiyst project."
+      });
+      return;
+    }
     this.avatar.applyConfig(cfg);
     this.avatar.show();
     try {
@@ -2382,6 +2630,6 @@ var Asiyst = {
   }
 };
 
-export { ActionNotAllowedError, Asiyst, AsiystError, AuthenticationError, ConfigurationError, InitializationError, NetworkError, SDK_VERSION, TargetNotFoundError, TaskExecutionError, TaskStatus, anchorToViewport, canTransition, computeAvatarDestination, fallbackConfig, isSafeSelector, normalizeProjectConfig, sanitizeText, validateInitOptions };
+export { ActionNotAllowedError, Asiyst, AsiystError, AuthenticationError, ConfigurationError, InitializationError, NetworkError, SDK_VERSION, TargetNotFoundError, TaskExecutionError, TaskStatus, anchorToViewport, canNavigateTo, canTransition, computeAvatarDestination, evaluateActionPermission, fallbackConfig, isActionAllowed, isSafeSelector, normalizeProjectConfig, sanitizeText, validateInitOptions, validateWebsiteDomain };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map