@vosjs/cli 0.41.1 → 0.42.0

package/dist/cli.js

@@ -511,7 +511,7 @@ async function cmdCheck(argv) {
   return result.ok ? EXIT_OK : EXIT_ERROR;
 }
 async function delegate(argv, viaAlias = false) {
-  const { run } = await import("./run-ZIOIU3SD.js");
+  const { run } = await import("./run-WN2IO3WL.js");
   if (viaAlias && argv[0]) {
     process.stderr.write(
       `note: "vos voila ${argv[0]}" is now "vos ${argv[0]}".
@@ -551,7 +551,7 @@ async function main() {
     const engine = HELP_ENGINE.split("\n").filter(
       (l) => l.startsWith(`  vos ${cmd} `)
     );
-    const { verbHelp } = await import("./run-ZIOIU3SD.js");
+    const { verbHelp } = await import("./run-WN2IO3WL.js");
     const take = verbHelp(cmd);
     process.stdout.write(
       `${engine.join("\n")}
@@ -583,7 +583,7 @@ ${take.includes("no such verb") ? "" : take}`
 main().then(async (code) => {
   if (code === EXIT_OK) {
     const verb = process.argv[2] ?? "";
-    const { HELP } = await import("./run-ZIOIU3SD.js");
+    const { HELP } = await import("./run-WN2IO3WL.js");
     const documented = [
       ...helpFlagsFor(HELP_ENGINE, verb),
       ...helpFlagsFor(HELP, verb)

package/dist/index.d.ts

@@ -110,6 +110,37 @@ interface PaceReport {
     }[];
 }
 
+/**
+ * What a signed-in take SHOWS. Getting past the login is half the problem;
+ * the other half is that the account's own data is now in the frame: an
+ * email address in the header, a key on a settings page, a card number.
+ * Asking nicely does not hold this line (a person asked to sign in with a
+ * demo account signs in as themselves, because it is the account they have),
+ * so the recorder looks.
+ *
+ * Two pieces, both run IN the page:
+ *
+ * - the EXPOSURE scan reads the text that is visible in the viewport after
+ *   each step and reports the KIND of thing it saw and where. Never the
+ *   string itself: a report that quotes the secret is a second leak.
+ * - a MASK hides a selector before the first frame is captured and keeps it
+ *   hidden across navigations and re-renders, so the real value is never in
+ *   a frame, never in the recording, never pushed. `as: 'text'` swaps the
+ *   words (a product reads better than a redaction); `as: 'blur'` blurs.
+ *
+ * The matchers are ONE plain-JavaScript source string, evaluated in the page
+ * and, by the tests, in Node: a function serialized out of a bundle picks up
+ * the bundler's `__name` helper and dies in the page, and two copies of a
+ * regex drift.
+ */
+
+interface MaskRule {
+    selector: string;
+    /** `blur` (default) blurs the element; `text` swaps its words for `text`. */
+    as?: 'blur' | 'text';
+    text?: string;
+}
+
 /**
  * The action script — the declarative recipe an agent (or human) writes to
  * drive a take. Small on purpose: selectors + a handful of verbs. The recorder
@@ -124,6 +155,14 @@ interface ActionsFile {
         width: number;
         height: number;
     };
+    /**
+     * Hidden BEFORE the first frame is captured and kept hidden across
+     * navigations: what a signed-in account shows that must not ship. `blur`
+     * (default) blurs the element; `text` swaps its words for `text`, which is
+     * for IDENTIFIERS (an email, a name, an account id), never for product
+     * copy or numbers: the video must stay true to the product.
+     */
+    mask?: MaskRule[];
     steps: ActionStep[];
 }
 type ActionStep = ({
@@ -293,6 +332,10 @@ interface RecordResult {
     navTimeout: boolean;
     /** A wall the caller let through; null when the recorder landed where it was asked. */
     wall: WallVerdict | null;
+    /** Sensitive-looking text seen in the frame (kind + place, never the string). */
+    exposures: NonNullable<RecordingMeta['exposures']>;
+    /** The script's masks with how many elements each reached; hits 0 hid nothing. */
+    masks: NonNullable<RecordingMeta['masks']>;
     /**
      * Smoothness telemetry: stretches ≥400ms with no visual change. Frozen
      * footage is the #1 enemy of a smooth product video — either the flow should

package/dist/index.js

@@ -30,7 +30,7 @@ import {
   validateActions,
   waitForPageDone,
   writeSyncState
-} from "./chunk-4QVEV3HX.js";
+} from "./chunk-7RMULTDM.js";
 import {
   BrowserUnavailableError,
   configDuration,

package/dist/{run-ZIOIU3SD.js → run-WN2IO3WL.js}

@@ -5,7 +5,7 @@ import {
   run,
   takeBrowserArgs,
   verbHelp
-} from "./chunk-4QVEV3HX.js";
+} from "./chunk-7RMULTDM.js";
 import "./chunk-FACYY7VV.js";
 export {
   HELP,
@@ -14,4 +14,4 @@ export {
   takeBrowserArgs,
   verbHelp
 };
-//# sourceMappingURL=run-ZIOIU3SD.js.map
+//# sourceMappingURL=run-WN2IO3WL.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vosjs/cli",
-  "version": "0.41.1",
+  "version": "0.42.0",
   "description": "The vos CLI: record the real product from a scripted browser flow, auto-zoom from the cursor track, cut as data in doc.json, render deterministic video and stills, deliver a release's media per destination spec, and sync with vos.so. One binary, every verb, MIT.",
   "type": "module",
   "license": "MIT",
@@ -48,14 +48,14 @@
   "dependencies": {
     "mediabunny": "^1.55.7",
     "playwright": "^1.49.0",
-    "@vosjs/editor": "^1.3.1",
-    "@vosjs/elements": "^0.8.1",
     "@vosjs/core": "^0.25.0",
-    "@vosjs/shared": "^0.4.1",
+    "@vosjs/elements": "^0.8.1",
     "@vosjs/render-core": "^0.2.8",
+    "@vosjs/shared": "^0.4.1",
+    "@vosjs/editor": "^1.3.1",
     "@vosjs/timeline": "^0.4.1",
     "@vosjs/tween": "^0.8.2",
-    "@vosjs/studio-core": "^0.28.0"
+    "@vosjs/studio-core": "^0.29.0"
   },
   "devDependencies": {
     "@types/node": "^22",

package/schema/actions.schema.json

@@ -29,6 +29,28 @@
         }
       }
     },
+    "mask": {
+      "type": "array",
+      "description": "Hidden BEFORE the first frame is captured and kept hidden across navigations and re-renders: what a signed-in account shows that must not ship. The real value is never in a frame, never in the recording, never pushed. `vos record` reports what it still sees afterwards (meta.exposures), and a mask whose selector reached nothing fails --strict.",
+      "items": {
+        "type": "object",
+        "required": ["selector"],
+        "additionalProperties": false,
+        "properties": {
+          "selector": { "type": "string" },
+          "as": {
+            "type": "string",
+            "enum": ["blur", "text"],
+            "default": "blur",
+            "description": "blur the element, or swap its words for `text`. A form control is always blurred: writing into an input would change what the app submits. `text` is for IDENTIFIERS (an email, a name, an account id), never for product copy or numbers."
+          },
+          "text": {
+            "type": "string",
+            "description": "shown instead, with as: \"text\""
+          }
+        }
+      }
+    },
     "steps": {
       "type": "array",
       "minItems": 1,

package/schema/digest.schema.json

@@ -46,6 +46,28 @@
           "description": "false = browser-recorder take: moments are head/tail/scenes only"
         },
         "windowFocusedFrac": { "type": ["number", "null"] },
+        "exposures": {
+          "type": "array",
+          "description": "sensitive-looking text the recorder saw IN the frame: the KIND and the place, never the string. Listed once each, at the first step it was visible (step -1 = as the page opened). `rect` is viewport CSS px. Look at those frames before the take goes anywhere; the fix is a demo account or a `mask` in actions.json and a re-record",
+          "items": {
+            "type": "object",
+            "properties": {
+              "step": { "type": "integer" },
+              "kind": {
+                "type": "string",
+                "enum": ["email", "key", "card", "card-tail"]
+              },
+              "selector": { "type": "string" },
+              "rect": { "type": "object" },
+              "seen": { "type": "integer" }
+            }
+          }
+        },
+        "masks": {
+          "type": "array",
+          "description": "what the script hid before the camera rolled, with how many elements each selector reached; hits 0 hid nothing",
+          "items": { "type": "object" }
+        },
         "wall": {
           "type": ["object", "null"],
           "description": "the recorder did not land where it was asked (a sign-in, an identity provider, a 401/403, a redirect elsewhere) and the take was recorded anyway: the footage may be the wrong page. `asked`/`landed` are origin + path. null = it landed where it was asked, or the recorder does not check",