@flowriki/agent 0.1.0-beta.17 → 0.1.0-beta.18

package/dist/{chunk-NTARVVKX.js → chunk-ZGXVQ2QA.js}

@@ -6,7 +6,7 @@ import os from "os";
 import path from "path";
 import { createRequire } from "module";
 import { spawnSync } from "child_process";
-var AGENT_VERSION = "0.1.0-beta.17";
+var AGENT_VERSION = "0.1.0-beta.18";
 async function prepareBrowsers() {
   if (browsersReady()) {
     return { ok: true, already: true, message: "chromium is already installed" };
@@ -458,7 +458,7 @@ import path7 from "path";
 // ../engine-playwright/dist/index.js
 import path3 from "path";
 
-// ../test-model/dist/chunk-T76NYOOM.js
+// ../test-model/dist/chunk-ZRUZU4TI.js
 import { z as z3 } from "zod";
 var LocatorOverrideSchema = z3.object({
   strategy: z3.enum(["css", "xpath", "id", "testId", "text", "label", "placeholder", "altText", "title"]),
@@ -758,6 +758,20 @@ var FlowDocumentSchema = z3.object({
   updatedAt: z3.string(),
   steps: z3.array(RecordedStepSchema),
   environment: ExecutionEnvironmentSchema.optional(),
+  /** WHICH DEPLOYMENT THIS WAS RECORDED AGAINST, by name — "staging",
+   *  "production", whatever the project calls them.
+   *
+   *  A record of fact, not a constraint: the flow can still be run against any
+   *  environment, which is the point of naming them. What it answers is the
+   *  question somebody asks of a test that fails only in one place — "where
+   *  was this made?" — which was previously unanswerable, because the address
+   *  it used belonged to a setting that had since moved on.
+   *
+   *  Deliberately NOT the address. An origin in a git-tracked file is the
+   *  mistake documented on `baseUrl` above; a name survives the deployment
+   *  moving. Absent on everything recorded before this, and on a project that
+   *  has never named its environments. */
+  recordedIn: z3.string().min(1).optional(),
   path: z3.string().optional(),
   actors: z3.array(ActorDefinitionSchema).optional(),
   defaultActorId: z3.string().optional(),
@@ -1134,17 +1148,25 @@ var AuthProfileSchema = z32.object({
   updatedAt: z32.string(),
   revision: z32.number().int().nonnegative().default(0)
 }).strict();
-var ACCOUNT_BINDING_SCHEMA_VERSION = 2;
+var ACCOUNT_BINDING_SCHEMA_VERSION = 3;
 var AccountBindingSchema = z32.object({
   schemaVersion: z32.literal(ACCOUNT_BINDING_SCHEMA_VERSION),
   id: z32.string().min(1),
   slug: z32.string().regex(/^[a-z0-9][a-z0-9-]*$/),
   name: z32.string().min(1),
   profileId: z32.string().min(1),
-  /** Which environment of the APPLICATION UNDER TEST these credentials belong
-   *  to — never Flowriki's own dev or staging. Null means every environment,
-   *  which is what a project with one environment wants. */
-  environment: z32.string().min(1).nullable().default(null),
+  /** Which environments of the APPLICATION UNDER TEST these credentials work
+   *  in — never Flowriki's own dev or staging.
+   *
+   * EMPTY MEANS EVERY ONE, which is what a project with a single deployment
+   * wants and what most accounts will always say.
+   *
+   * A LIST because the same person usually exists in more than one place. One
+   * environment per account was the shape until version 3, and it forced a
+   * duplicate account — same name, same password, same everything — for each
+   * deployment the identity existed in, or a blank "works anywhere" that also
+   * claimed environments it had never been created in. Neither was true. */
+  environments: z32.array(z32.string().min(1)).default([]),
   /** Step id → what this identity types there. Ordinary values: a username is
    *  not a credential, and keeping it here is what lets somebody read an
    *  account and know who it is. */
@@ -2125,6 +2147,20 @@ function installRecorder() {
     },
     true
   );
+  const SECRET_WORDS = /password|passwd|pass[-_\s]?code|pwd|secret|otp|one[-_\s]?time[-_\s]?(code|pass)|security[-_\s]?(code|answer)|cvv|cvc|\bpin\b/i;
+  const looksSecret = (el, type, name) => {
+    if (type === "password") return true;
+    const auto = String(el.autocomplete || el.getAttribute?.("autocomplete") || "").toLowerCase();
+    if (/current-password|new-password|one-time-code/.test(auto)) return true;
+    try {
+      const masked = getComputedStyle(el).webkitTextSecurity;
+      if (masked && masked !== "none") return true;
+    } catch {
+    }
+    return SECRET_WORDS.test(
+      [name, el.name, el.id, el.getAttribute?.("aria-label"), el.placeholder].filter(Boolean).join(" ")
+    );
+  };
   const editedValues = /* @__PURE__ */ new WeakMap();
   const onEdit = (e) => {
     if (e.isComposing) return;
@@ -2155,15 +2191,16 @@ function installRecorder() {
     const signature = JSON.stringify(values ?? value);
     if (editedValues.get(el) === signature) return;
     editedValues.set(el, signature);
+    const identity = identify(el);
     send({
       type: type === "range" ? "setRange" : tag === "select" ? "select" : "fill",
       role: roleOf(el),
-      ...identify(el),
-      ...scoping(el, roleOf(el), identify(el).name),
+      ...identity,
+      ...scoping(el, roleOf(el), identity.name),
       legacySelector: cssPath(el),
       value,
       ...values ? { values } : {},
-      secret: type === "password"
+      secret: looksSecret(el, type, identity.name)
     });
   };
   document.addEventListener("input", onEdit, true);
@@ -6310,7 +6347,7 @@ function toSummary(row) {
   };
 }
 
-// ../repository-store/dist/chunk-QSTSWM2T.js
+// ../repository-store/dist/chunk-A4JZPKZT.js
 var FLOWRIKI_DIR = ".flowriki";
 var FEATURES_DIR = `${FLOWRIKI_DIR}/features`;
 var CONFIG_PATH = `${FLOWRIKI_DIR}/config.json`;
@@ -6351,6 +6388,7 @@ function parseConfig(raw) {
   return {
     baseUrl: typeof source["baseUrl"] === "string" ? source["baseUrl"] : "",
     ...typeof source["applicationEnvironment"] === "string" ? { applicationEnvironment: source["applicationEnvironment"] } : {},
+    ...Array.isArray(source["environments"]) ? { environments: readEnvironments(source["environments"]) } : {},
     reuseAuthentication: source["reuseAuthentication"] === true,
     headless: source["headless"] === true,
     environment: ExecutionEnvironmentSchema.parse(source["environment"] ?? {}),
@@ -6358,6 +6396,20 @@ function parseConfig(raw) {
     flakinessRepeat: clampRepeat(source["flakinessRepeat"])
   };
 }
+function readEnvironments(raw) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of raw) {
+    if (!entry || typeof entry !== "object") continue;
+    const { name, baseUrl } = entry;
+    if (typeof name !== "string" || !name.trim()) continue;
+    const key = name.trim().toLowerCase();
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push({ name: name.trim(), baseUrl: typeof baseUrl === "string" ? baseUrl : "" });
+  }
+  return out;
+}
 var FlowNotFound = class extends Error {
   constructor(message) {
     super(message);

package/dist/cli.js

@@ -8,7 +8,7 @@ import {
   resolveCheckouts,
   start,
   status
-} from "./chunk-NTARVVKX.js";
+} from "./chunk-ZGXVQ2QA.js";
 
 // src/cli.ts
 import { parseArgs } from "util";

package/dist/engine.js

@@ -9,7 +9,7 @@ import {
   resolveCheckouts,
   start,
   status
-} from "./chunk-NTARVVKX.js";
+} from "./chunk-ZGXVQ2QA.js";
 export {
   AGENT_VERSION,
   browsersReady,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flowriki/agent",
-  "version": "0.1.0-beta.17",
+  "version": "0.1.0-beta.18",
   "description": "Run Flowriki UI tests on your own computer. Connects this machine to your Flowriki account.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",