@vosjs/cli 0.41.1 → 0.43.0

package/dist/cli.js

@@ -511,7 +511,7 @@ async function cmdCheck(argv) {
   return result.ok ? EXIT_OK : EXIT_ERROR;
 }
 async function delegate(argv, viaAlias = false) {
-  const { run } = await import("./run-ZIOIU3SD.js");
+  const { run } = await import("./run-ZYROWQ3T.js");
   if (viaAlias && argv[0]) {
     process.stderr.write(
       `note: "vos voila ${argv[0]}" is now "vos ${argv[0]}".
@@ -551,7 +551,7 @@ async function main() {
     const engine = HELP_ENGINE.split("\n").filter(
       (l) => l.startsWith(`  vos ${cmd} `)
     );
-    const { verbHelp } = await import("./run-ZIOIU3SD.js");
+    const { verbHelp } = await import("./run-ZYROWQ3T.js");
     const take = verbHelp(cmd);
     process.stdout.write(
       `${engine.join("\n")}
@@ -583,7 +583,7 @@ ${take.includes("no such verb") ? "" : take}`
 main().then(async (code) => {
   if (code === EXIT_OK) {
     const verb = process.argv[2] ?? "";
-    const { HELP } = await import("./run-ZIOIU3SD.js");
+    const { HELP } = await import("./run-ZYROWQ3T.js");
     const documented = [
       ...helpFlagsFor(HELP_ENGINE, verb),
       ...helpFlagsFor(HELP, verb)

package/dist/index.d.ts

@@ -110,6 +110,79 @@ interface PaceReport {
     }[];
 }
 
+/**
+ * What a signed-in take SHOWS. Getting past the login is half the problem;
+ * the other half is that the account's own data is now in the frame: an
+ * email address in the header, a key on a settings page, a card number.
+ * Asking nicely does not hold this line (a person asked to sign in with a
+ * demo account signs in as themselves, because it is the account they have),
+ * so the recorder looks.
+ *
+ * Two pieces, both run IN the page:
+ *
+ * - the EXPOSURE scan reads the text that is visible in the viewport after
+ *   each step and reports the KIND of thing it saw and where. Never the
+ *   string itself: a report that quotes the secret is a second leak.
+ * - a MASK hides a selector before the first frame is captured and keeps it
+ *   hidden across navigations and re-renders, so the real value is never in
+ *   a frame, never in the recording, never pushed. `as: 'text'` swaps the
+ *   words (a product reads better than a redaction); `as: 'blur'` blurs.
+ *
+ * The matchers are ONE plain-JavaScript source string, evaluated in the page
+ * and, by the tests, in Node: a function serialized out of a bundle picks up
+ * the bundler's `__name` helper and dies in the page, and two copies of a
+ * regex drift.
+ */
+
+interface MaskRule {
+    selector: string;
+    /** `blur` (default) blurs the element; `text` swaps its words for `text`. */
+    as?: 'blur' | 'text';
+    text?: string;
+}
+
+/**
+ * `setup`: the steps that run BEFORE the camera rolls. A sign-in form, a
+ * cookie banner, the "choose your editor" modal, an onboarding tour: things
+ * a take must get past and must not show. They run after the first
+ * navigation and before `Page.startScreencast`, with no cursor synthesis,
+ * no pace accounting and nothing written to `meta.steps`. Then the recorder
+ * navigates to `url` again and the take begins where the setup left it.
+ *
+ * A `type` step's `text` may be `{ "env": "DEMO_PASSWORD" }`: resolved at run
+ * time, never logged, never stored. The guarantee is narrow and real: the
+ * secret is never in a file that travels (`actions.json` is committed and
+ * pushed with the take; `meta.json` is read by the digest) and never in the
+ * footage. An agent with a shell can still read the variable; that is the
+ * maker's decision to make, not this file's to hide.
+ */
+
+type SetupText = string | {
+    env: string;
+};
+type SetupStep = ({
+    do: 'wait';
+    ms: number;
+} | {
+    do: 'click';
+    selector: string;
+    ms?: number;
+} | {
+    do: 'type';
+    selector: string;
+    text: SetupText;
+    ms?: number;
+} | {
+    do: 'press';
+    key: string;
+    ms?: number;
+} | {
+    do: 'goto';
+    url: string;
+}) & {
+    id?: string;
+};
+
 /**
  * The action script — the declarative recipe an agent (or human) writes to
  * drive a take. Small on purpose: selectors + a handful of verbs. The recorder
@@ -124,6 +197,23 @@ interface ActionsFile {
         width: number;
         height: number;
     };
+    /**
+     * Hidden BEFORE the first frame is captured and kept hidden across
+     * navigations: what a signed-in account shows that must not ship. `blur`
+     * (default) blurs the element; `text` swaps its words for `text`, which is
+     * for IDENTIFIERS (an email, a name, an account id), never for product
+     * copy or numbers: the video must stay true to the product.
+     */
+    mask?: MaskRule[];
+    /**
+     * Run BEFORE the camera rolls, after the first navigation: a sign-in form,
+     * a cookie banner, an onboarding tour. Plain actions with no cursor, no
+     * frames, no pace and nothing in `meta.steps`; then the recorder opens
+     * `url` again and the take begins where the setup left it. A `type`
+     * step's text may be `{ env: 'NAME' }`, read at run time and never logged
+     * or stored.
+     */
+    setup?: SetupStep[];
     steps: ActionStep[];
 }
 type ActionStep = ({
@@ -293,6 +383,10 @@ interface RecordResult {
     navTimeout: boolean;
     /** A wall the caller let through; null when the recorder landed where it was asked. */
     wall: WallVerdict | null;
+    /** Sensitive-looking text seen in the frame (kind + place, never the string). */
+    exposures: NonNullable<RecordingMeta['exposures']>;
+    /** The script's masks with how many elements each reached; hits 0 hid nothing. */
+    masks: NonNullable<RecordingMeta['masks']>;
     /**
      * Smoothness telemetry: stretches ≥400ms with no visual change. Frozen
      * footage is the #1 enemy of a smooth product video — either the flow should
@@ -332,6 +426,8 @@ interface RecordOpts {
      * re-record would have replaced. A throw closes the context and propagates.
      */
     onArrival?: (arrival: Arrival) => Promise<WallVerdict | null | void> | WallVerdict | null | void;
+    /** Extra request headers on every request (`--header name=value`). */
+    headers?: Record<string, string>;
 }
 declare function recordTake(browser: Browser, url: string, actions: ActionsFile, paths: TakePaths, log: (msg: string) => void, opts?: RecordOpts): Promise<RecordResult>;
 

package/dist/index.js

@@ -30,7 +30,7 @@ import {
   validateActions,
   waitForPageDone,
   writeSyncState
-} from "./chunk-4QVEV3HX.js";
+} from "./chunk-6PJPGBKH.js";
 import {
   BrowserUnavailableError,
   configDuration,

package/dist/{run-ZIOIU3SD.js → run-ZYROWQ3T.js}

@@ -5,7 +5,7 @@ import {
   run,
   takeBrowserArgs,
   verbHelp
-} from "./chunk-4QVEV3HX.js";
+} from "./chunk-6PJPGBKH.js";
 import "./chunk-FACYY7VV.js";
 export {
   HELP,
@@ -14,4 +14,4 @@ export {
   takeBrowserArgs,
   verbHelp
 };
-//# sourceMappingURL=run-ZIOIU3SD.js.map
+//# sourceMappingURL=run-ZYROWQ3T.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vosjs/cli",
-  "version": "0.41.1",
+  "version": "0.43.0",
   "description": "The vos CLI: record the real product from a scripted browser flow, auto-zoom from the cursor track, cut as data in doc.json, render deterministic video and stills, deliver a release's media per destination spec, and sync with vos.so. One binary, every verb, MIT.",
   "type": "module",
   "license": "MIT",
@@ -48,14 +48,14 @@
   "dependencies": {
     "mediabunny": "^1.55.7",
     "playwright": "^1.49.0",
+    "@vosjs/core": "^0.25.0",
     "@vosjs/editor": "^1.3.1",
     "@vosjs/elements": "^0.8.1",
-    "@vosjs/core": "^0.25.0",
-    "@vosjs/shared": "^0.4.1",
     "@vosjs/render-core": "^0.2.8",
+    "@vosjs/shared": "^0.4.1",
+    "@vosjs/studio-core": "^0.29.0",
     "@vosjs/timeline": "^0.4.1",
-    "@vosjs/tween": "^0.8.2",
-    "@vosjs/studio-core": "^0.28.0"
+    "@vosjs/tween": "^0.8.2"
   },
   "devDependencies": {
     "@types/node": "^22",

package/schema/actions.schema.json

@@ -29,6 +29,73 @@
         }
       }
     },
+    "setup": {
+      "type": "array",
+      "description": "Run BEFORE the camera rolls, after the first navigation: a sign-in form, a cookie banner, an onboarding tour. Plain actions with no cursor, no frames, no pace and nothing in meta.steps; then the recorder opens `url` again and the take begins where the setup left it. A selector that never appears fails the take before anything is recorded (exit 2). A `type` step's text may be { \"env\": \"NAME\" }, read at run time and never logged or stored; a literal typed into a password field is refused, because actions.json is committed and pushed.",
+      "items": {
+        "type": "object",
+        "required": ["do"],
+        "additionalProperties": false,
+        "properties": {
+          "do": {
+            "type": "string",
+            "enum": ["wait", "click", "type", "press", "goto"]
+          },
+          "id": { "type": "string" },
+          "selector": { "type": "string" },
+          "text": {
+            "oneOf": [
+              { "type": "string" },
+              {
+                "type": "object",
+                "required": ["env"],
+                "additionalProperties": false,
+                "properties": {
+                  "env": {
+                    "type": "string",
+                    "description": "the environment variable holding the value"
+                  }
+                }
+              }
+            ]
+          },
+          "key": {
+            "type": "string",
+            "description": "press: a Playwright key name (Enter, Tab, Escape)"
+          },
+          "url": {
+            "type": "string",
+            "description": "goto: a page to open, for a sign-in that lives elsewhere"
+          },
+          "ms": {
+            "type": "number",
+            "description": "wait: the pause; other verbs: the settle after (default 150)"
+          }
+        }
+      }
+    },
+    "mask": {
+      "type": "array",
+      "description": "Hidden BEFORE the first frame is captured and kept hidden across navigations and re-renders: what a signed-in account shows that must not ship. The real value is never in a frame, never in the recording, never pushed. `vos record` reports what it still sees afterwards (meta.exposures), and a mask whose selector reached nothing fails --strict.",
+      "items": {
+        "type": "object",
+        "required": ["selector"],
+        "additionalProperties": false,
+        "properties": {
+          "selector": { "type": "string" },
+          "as": {
+            "type": "string",
+            "enum": ["blur", "text"],
+            "default": "blur",
+            "description": "blur the element, or swap its words for `text`. A form control is always blurred: writing into an input would change what the app submits. `text` is for IDENTIFIERS (an email, a name, an account id), never for product copy or numbers."
+          },
+          "text": {
+            "type": "string",
+            "description": "shown instead, with as: \"text\""
+          }
+        }
+      }
+    },
     "steps": {
       "type": "array",
       "minItems": 1,

package/schema/digest.schema.json

@@ -46,6 +46,28 @@
           "description": "false = browser-recorder take: moments are head/tail/scenes only"
         },
         "windowFocusedFrac": { "type": ["number", "null"] },
+        "exposures": {
+          "type": "array",
+          "description": "sensitive-looking text the recorder saw IN the frame: the KIND and the place, never the string. Listed once each, at the first step it was visible (step -1 = as the page opened). `rect` is viewport CSS px. Look at those frames before the take goes anywhere; the fix is a demo account or a `mask` in actions.json and a re-record",
+          "items": {
+            "type": "object",
+            "properties": {
+              "step": { "type": "integer" },
+              "kind": {
+                "type": "string",
+                "enum": ["email", "key", "card", "card-tail"]
+              },
+              "selector": { "type": "string" },
+              "rect": { "type": "object" },
+              "seen": { "type": "integer" }
+            }
+          }
+        },
+        "masks": {
+          "type": "array",
+          "description": "what the script hid before the camera rolled, with how many elements each selector reached; hits 0 hid nothing",
+          "items": { "type": "object" }
+        },
         "wall": {
           "type": ["object", "null"],
           "description": "the recorder did not land where it was asked (a sign-in, an identity provider, a 401/403, a redirect elsewhere) and the take was recorded anyway: the footage may be the wrong page. `asked`/`landed` are origin + path. null = it landed where it was asked, or the recorder does not check",