@vosjs/cli 0.42.0 → 0.43.0

package/dist/cli.js

@@ -511,7 +511,7 @@ async function cmdCheck(argv) {
   return result.ok ? EXIT_OK : EXIT_ERROR;
 }
 async function delegate(argv, viaAlias = false) {
-  const { run } = await import("./run-WN2IO3WL.js");
+  const { run } = await import("./run-ZYROWQ3T.js");
   if (viaAlias && argv[0]) {
     process.stderr.write(
       `note: "vos voila ${argv[0]}" is now "vos ${argv[0]}".
@@ -551,7 +551,7 @@ async function main() {
     const engine = HELP_ENGINE.split("\n").filter(
       (l) => l.startsWith(`  vos ${cmd} `)
     );
-    const { verbHelp } = await import("./run-WN2IO3WL.js");
+    const { verbHelp } = await import("./run-ZYROWQ3T.js");
     const take = verbHelp(cmd);
     process.stdout.write(
       `${engine.join("\n")}
@@ -583,7 +583,7 @@ ${take.includes("no such verb") ? "" : take}`
 main().then(async (code) => {
   if (code === EXIT_OK) {
     const verb = process.argv[2] ?? "";
-    const { HELP } = await import("./run-WN2IO3WL.js");
+    const { HELP } = await import("./run-ZYROWQ3T.js");
     const documented = [
       ...helpFlagsFor(HELP_ENGINE, verb),
       ...helpFlagsFor(HELP, verb)

package/dist/index.d.ts

@@ -141,6 +141,48 @@ interface MaskRule {
     text?: string;
 }
 
+/**
+ * `setup`: the steps that run BEFORE the camera rolls. A sign-in form, a
+ * cookie banner, the "choose your editor" modal, an onboarding tour: things
+ * a take must get past and must not show. They run after the first
+ * navigation and before `Page.startScreencast`, with no cursor synthesis,
+ * no pace accounting and nothing written to `meta.steps`. Then the recorder
+ * navigates to `url` again and the take begins where the setup left it.
+ *
+ * A `type` step's `text` may be `{ "env": "DEMO_PASSWORD" }`: resolved at run
+ * time, never logged, never stored. The guarantee is narrow and real: the
+ * secret is never in a file that travels (`actions.json` is committed and
+ * pushed with the take; `meta.json` is read by the digest) and never in the
+ * footage. An agent with a shell can still read the variable; that is the
+ * maker's decision to make, not this file's to hide.
+ */
+
+type SetupText = string | {
+    env: string;
+};
+type SetupStep = ({
+    do: 'wait';
+    ms: number;
+} | {
+    do: 'click';
+    selector: string;
+    ms?: number;
+} | {
+    do: 'type';
+    selector: string;
+    text: SetupText;
+    ms?: number;
+} | {
+    do: 'press';
+    key: string;
+    ms?: number;
+} | {
+    do: 'goto';
+    url: string;
+}) & {
+    id?: string;
+};
+
 /**
  * The action script — the declarative recipe an agent (or human) writes to
  * drive a take. Small on purpose: selectors + a handful of verbs. The recorder
@@ -163,6 +205,15 @@ interface ActionsFile {
      * copy or numbers: the video must stay true to the product.
      */
     mask?: MaskRule[];
+    /**
+     * Run BEFORE the camera rolls, after the first navigation: a sign-in form,
+     * a cookie banner, an onboarding tour. Plain actions with no cursor, no
+     * frames, no pace and nothing in `meta.steps`; then the recorder opens
+     * `url` again and the take begins where the setup left it. A `type`
+     * step's text may be `{ env: 'NAME' }`, read at run time and never logged
+     * or stored.
+     */
+    setup?: SetupStep[];
     steps: ActionStep[];
 }
 type ActionStep = ({
@@ -375,6 +426,8 @@ interface RecordOpts {
      * re-record would have replaced. A throw closes the context and propagates.
      */
     onArrival?: (arrival: Arrival) => Promise<WallVerdict | null | void> | WallVerdict | null | void;
+    /** Extra request headers on every request (`--header name=value`). */
+    headers?: Record<string, string>;
 }
 declare function recordTake(browser: Browser, url: string, actions: ActionsFile, paths: TakePaths, log: (msg: string) => void, opts?: RecordOpts): Promise<RecordResult>;
 

package/dist/index.js

@@ -30,7 +30,7 @@ import {
   validateActions,
   waitForPageDone,
   writeSyncState
-} from "./chunk-7RMULTDM.js";
+} from "./chunk-6PJPGBKH.js";
 import {
   BrowserUnavailableError,
   configDuration,

package/dist/{run-WN2IO3WL.js → run-ZYROWQ3T.js}

@@ -5,7 +5,7 @@ import {
   run,
   takeBrowserArgs,
   verbHelp
-} from "./chunk-7RMULTDM.js";
+} from "./chunk-6PJPGBKH.js";
 import "./chunk-FACYY7VV.js";
 export {
   HELP,
@@ -14,4 +14,4 @@ export {
   takeBrowserArgs,
   verbHelp
 };
-//# sourceMappingURL=run-WN2IO3WL.js.map
+//# sourceMappingURL=run-ZYROWQ3T.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vosjs/cli",
-  "version": "0.42.0",
+  "version": "0.43.0",
   "description": "The vos CLI: record the real product from a scripted browser flow, auto-zoom from the cursor track, cut as data in doc.json, render deterministic video and stills, deliver a release's media per destination spec, and sync with vos.so. One binary, every verb, MIT.",
   "type": "module",
   "license": "MIT",
@@ -49,13 +49,13 @@
     "mediabunny": "^1.55.7",
     "playwright": "^1.49.0",
     "@vosjs/core": "^0.25.0",
+    "@vosjs/editor": "^1.3.1",
     "@vosjs/elements": "^0.8.1",
     "@vosjs/render-core": "^0.2.8",
     "@vosjs/shared": "^0.4.1",
-    "@vosjs/editor": "^1.3.1",
+    "@vosjs/studio-core": "^0.29.0",
     "@vosjs/timeline": "^0.4.1",
-    "@vosjs/tween": "^0.8.2",
-    "@vosjs/studio-core": "^0.29.0"
+    "@vosjs/tween": "^0.8.2"
   },
   "devDependencies": {
     "@types/node": "^22",

package/schema/actions.schema.json

@@ -29,6 +29,51 @@
         }
       }
     },
+    "setup": {
+      "type": "array",
+      "description": "Run BEFORE the camera rolls, after the first navigation: a sign-in form, a cookie banner, an onboarding tour. Plain actions with no cursor, no frames, no pace and nothing in meta.steps; then the recorder opens `url` again and the take begins where the setup left it. A selector that never appears fails the take before anything is recorded (exit 2). A `type` step's text may be { \"env\": \"NAME\" }, read at run time and never logged or stored; a literal typed into a password field is refused, because actions.json is committed and pushed.",
+      "items": {
+        "type": "object",
+        "required": ["do"],
+        "additionalProperties": false,
+        "properties": {
+          "do": {
+            "type": "string",
+            "enum": ["wait", "click", "type", "press", "goto"]
+          },
+          "id": { "type": "string" },
+          "selector": { "type": "string" },
+          "text": {
+            "oneOf": [
+              { "type": "string" },
+              {
+                "type": "object",
+                "required": ["env"],
+                "additionalProperties": false,
+                "properties": {
+                  "env": {
+                    "type": "string",
+                    "description": "the environment variable holding the value"
+                  }
+                }
+              }
+            ]
+          },
+          "key": {
+            "type": "string",
+            "description": "press: a Playwright key name (Enter, Tab, Escape)"
+          },
+          "url": {
+            "type": "string",
+            "description": "goto: a page to open, for a sign-in that lives elsewhere"
+          },
+          "ms": {
+            "type": "number",
+            "description": "wait: the pause; other verbs: the settle after (default 150)"
+          }
+        }
+      }
+    },
     "mask": {
       "type": "array",
       "description": "Hidden BEFORE the first frame is captured and kept hidden across navigations and re-renders: what a signed-in account shows that must not ship. The real value is never in a frame, never in the recording, never pushed. `vos record` reports what it still sees afterwards (meta.exposures), and a mask whose selector reached nothing fails --strict.",