@vosjs/cli 0.48.0 → 0.49.0

package/dist/{chunk-ANKECV7F.js → chunk-TAWRT7UM.js}

@@ -7,23 +7,9 @@ import {
   trackFlags
 } from "./chunk-FACYY7VV.js";
 import {
-  PRESS_HOLD_MS,
-  PRESS_LEAD_MS,
-  SCROLL_SETTLE_MS,
-  TRAILING_HOLD_MS,
-  askedMs,
-  clockMotion,
-  clockTyping,
   deadLine,
-  deadTime,
-  deadWarns,
-  holdLeftMs,
-  paceLine,
-  paceReport,
-  pointerTravelMs,
-  settleMs,
-  settleVerdict
-} from "./chunk-AUPGJJTL.js";
+  deadWarns
+} from "./chunk-72ADTMWW.js";
 
 // src/plugin/run.ts
 import { mkdir as mkdir10, readFile as readFile15, rm as rm5 } from "fs/promises";
@@ -119,238 +105,8 @@ function createReporter(json) {
   };
 }
 
-// src/plugin/setup.ts
-var VERBS = /* @__PURE__ */ new Set(["wait", "click", "type", "press", "goto"]);
-function validateSetup(value) {
-  const errors = [];
-  if (!Array.isArray(value)) return ["setup must be an array of steps"];
-  value.forEach((raw, i) => {
-    const at2 = `setup[${i}]`;
-    if (typeof raw !== "object" || raw === null) {
-      errors.push(`${at2}: must be an object`);
-      return;
-    }
-    const s = raw;
-    if (typeof s.do !== "string" || !VERBS.has(s.do)) {
-      errors.push(`${at2}: "do" must be one of ${[...VERBS].join(", ")}`);
-      return;
-    }
-    if ((s.do === "click" || s.do === "type") && typeof s.selector !== "string")
-      errors.push(`${at2}: ${s.do} needs a selector`);
-    if (s.do === "wait" && typeof s.ms !== "number")
-      errors.push(`${at2}: wait needs ms`);
-    if (s.do === "press" && typeof s.key !== "string")
-      errors.push(`${at2}: press needs a key`);
-    if (s.do === "goto" && typeof s.url !== "string")
-      errors.push(`${at2}: goto needs a url`);
-    if (s.do === "type") {
-      const t = s.text;
-      const isEnv = typeof t === "object" && t !== null && typeof t.env === "string" && Object.keys(t).length === 1;
-      if (typeof t !== "string" && !isEnv)
-        errors.push(
-          `${at2}: type needs text, a string or { "env": "NAME" } read at run time`
-        );
-      if (typeof t === "string" && /passw|secret|token/i.test(String(s.selector)) && t.length > 0)
-        errors.push(
-          `${at2}: a literal value typed into ${String(s.selector)} would live in actions.json, which is committed and pushed. Use { "env": "NAME" }`
-        );
-    }
-  });
-  return errors;
-}
-function resolveSetupText(t, env = process.env) {
-  if (typeof t === "string") return { value: t, secret: false };
-  const v = env[t.env];
-  if (v === void 0 || v === "")
-    throw new SetupEnvError(
-      `setup: the environment variable ${t.env} is not set, and a type step reads it. Export it in the shell that runs vos record; it is never written to a file`
-    );
-  return { value: v, secret: true };
-}
-async function runSetup(page, steps, opts) {
-  const lines = [];
-  for (const [i, step] of steps.entries()) {
-    const settle = "ms" in step && typeof step.ms === "number" ? step.ms : 150;
-    try {
-      switch (step.do) {
-        case "wait":
-          await opts.sleep(step.ms);
-          lines.push(`setup #${i} wait ${step.ms}ms`);
-          break;
-        case "goto":
-          await page.goto(step.url, { waitUntil: "networkidle", timeout: 45e3 }).catch(() => {
-          });
-          lines.push(`setup #${i} goto ${step.url}`);
-          break;
-        case "press":
-          await page.keyboard.press(step.key);
-          await opts.sleep(settle);
-          lines.push(`setup #${i} press ${step.key}`);
-          break;
-        case "click": {
-          const loc = page.locator(step.selector).first();
-          await loc.waitFor({ state: "visible", timeout: 8e3 });
-          await loc.click();
-          await opts.sleep(settle);
-          lines.push(`setup #${i} click ${step.selector}`);
-          break;
-        }
-        case "type": {
-          const loc = page.locator(step.selector).first();
-          await loc.waitFor({ state: "visible", timeout: 8e3 });
-          const { value, secret } = resolveSetupText(step.text, opts.env);
-          await loc.fill(value);
-          await opts.sleep(settle);
-          lines.push(
-            `setup #${i} type ${secret ? `\${${step.text.env}}` : `${value.length} chars`} into ${step.selector}`
-          );
-          break;
-        }
-      }
-    } catch (e) {
-      if (e instanceof SetupEnvError) throw e;
-      return {
-        ran: i,
-        lines,
-        failed: {
-          step: i,
-          do: step.do,
-          ..."selector" in step ? { selector: step.selector } : {}
-        }
-      };
-    }
-  }
-  return { ran: steps.length, lines };
-}
-var SetupEnvError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "SetupEnvError";
-  }
-};
-var SetupError = class extends Error {
-  constructor(failed2) {
-    super(
-      `setup #${failed2.step} ${failed2.do}${failed2.selector ? ` ${failed2.selector}` : ""}: the selector never appeared, so the take would begin at a half-finished setup. Nothing was recorded. Fix the setup step (rehearse with --dry-run), then record.`
-    );
-    this.failed = failed2;
-    this.name = "SetupError";
-  }
-  failed;
-};
-function parseHeaders(given) {
-  const out = {};
-  for (const h of given ?? []) {
-    const i = h.indexOf("=");
-    if (i <= 0) throw new Error(`--header wants name=value, got "${h}"`);
-    out[h.slice(0, i).trim()] = h.slice(i + 1);
-  }
-  return out;
-}
-
 // src/plugin/actions.ts
-var VERBS2 = /* @__PURE__ */ new Set([
-  "wait",
-  "hover",
-  "click",
-  "type",
-  "scroll",
-  "move",
-  "drag"
-]);
-function validateActions(value) {
-  const errors = [];
-  if (typeof value !== "object" || value === null)
-    return ["actions file must be a JSON object"];
-  const obj = value;
-  if (obj.url !== void 0 && typeof obj.url !== "string")
-    errors.push("url must be a string");
-  if (obj.viewport !== void 0) {
-    const v = obj.viewport;
-    if (typeof v !== "object" || v === null) {
-      errors.push("viewport must be { width, height }");
-    } else {
-      const vp = v;
-      if (typeof vp.width !== "number" || typeof vp.height !== "number") {
-        errors.push("viewport must be { width, height }");
-      }
-    }
-  }
-  if (obj.setup !== void 0) errors.push(...validateSetup(obj.setup));
-  if (obj.mask !== void 0) {
-    if (!Array.isArray(obj.mask)) {
-      errors.push("mask must be an array of { selector, as?, text? }");
-    } else {
-      obj.mask.forEach((raw, i) => {
-        const at2 = `mask[${i}]`;
-        const m = raw ?? {};
-        if (typeof m.selector !== "string" || !m.selector.trim())
-          errors.push(`${at2}: needs a selector`);
-        if (m.as !== void 0 && m.as !== "blur" && m.as !== "text")
-          errors.push(`${at2}: as must be "blur" or "text"`);
-        if (m.as === "text" && (typeof m.text !== "string" || !m.text))
-          errors.push(`${at2}: as "text" needs the text to show instead`);
-        if (m.as !== "text" && m.text !== void 0)
-          errors.push(`${at2}: text is only read with as "text"`);
-      });
-    }
-  }
-  if (!Array.isArray(obj.steps) || obj.steps.length === 0) {
-    errors.push("steps must be a non-empty array");
-    return errors;
-  }
-  const seenIds = /* @__PURE__ */ new Set();
-  obj.steps.forEach((raw, i) => {
-    const at2 = `steps[${i}]`;
-    if (typeof raw !== "object" || raw === null) {
-      errors.push(`${at2}: must be an object`);
-      return;
-    }
-    const s = raw;
-    if (typeof s.do !== "string" || !VERBS2.has(s.do)) {
-      errors.push(`${at2}: "do" must be one of ${[...VERBS2].join(", ")}`);
-      return;
-    }
-    if (s.id !== void 0) {
-      if (typeof s.id !== "string" || !s.id.trim()) {
-        errors.push(`${at2}: id must be a non-empty string`);
-      } else if (seenIds.has(s.id)) {
-        errors.push(
-          `${at2}: duplicate id "${s.id}" \u2014 an anchor could not tell the two steps apart`
-        );
-      } else {
-        seenIds.add(s.id);
-      }
-    }
-    const needSelector = s.do === "hover" || s.do === "click" || s.do === "type";
-    if (needSelector && typeof s.selector !== "string")
-      errors.push(`${at2}: ${s.do} needs a selector`);
-    if (s.do === "wait" && typeof s.ms !== "number")
-      errors.push(`${at2}: wait needs ms`);
-    if (s.ms !== void 0 && (typeof s.ms !== "number" || !Number.isFinite(s.ms) || s.ms < 0))
-      errors.push(`${at2}: ms must be a number of milliseconds \u2265 0`);
-    if (s.do === "type" && typeof s.text !== "string")
-      errors.push(`${at2}: type needs text`);
-    if (s.do === "type" && s.focus !== void 0 && typeof s.focus !== "boolean")
-      errors.push(`${at2}: type focus must be true or false`);
-    if (s.do === "scroll" && typeof s.dy !== "number")
-      errors.push(`${at2}: scroll needs dy`);
-    if (s.do === "move" && (typeof s.x !== "number" || typeof s.y !== "number")) {
-      errors.push(`${at2}: move needs x and y (CSS px)`);
-    }
-    if (s.do === "drag") {
-      if (typeof s.tx !== "number" || typeof s.ty !== "number") {
-        errors.push(`${at2}: drag needs tx and ty (CSS px)`);
-      }
-      const hasStart = typeof s.selector === "string" || typeof s.x === "number" && typeof s.y === "number";
-      if (!hasStart)
-        errors.push(
-          `${at2}: drag needs a selector OR x and y as the start point`
-        );
-    }
-  });
-  return errors;
-}
+import { validateActions } from "@vosjs/render-core/record";
 
 // src/plugin/validateDoc.ts
 import {
@@ -6674,805 +6430,67 @@ async function validateKit(kitPath, opts = {}) {
 }
 
 // src/plugin/recorder.ts
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { writeFileSync as writeFileSync2 } from "fs";
 import { join as join13 } from "path";
-
-// src/plugin/recordingCap.ts
-var HOSTED_RECORDING_CAP_SECONDS = 30 * 60;
-function parseHostedCap(body) {
-  const limits = body && typeof body === "object" ? body.limits : void 0;
-  const cap = limits?.recordingMaxSeconds;
-  return typeof cap === "number" && Number.isInteger(cap) && cap > 0 ? cap : null;
-}
-async function hostedRecordingCap(origin, key, fetchImpl = fetch) {
-  const ctl = new AbortController();
-  const timer = setTimeout(() => ctl.abort(), 2e3);
-  try {
-    const res = await fetchImpl(`${origin.replace(/\/+$/, "")}/api/limits`, {
-      signal: ctl.signal,
-      ...key ? { headers: { authorization: `Bearer ${key}` } } : {}
-    });
-    if (!res.ok) return null;
-    return parseHostedCap(await res.json());
-  } catch {
-    return null;
-  } finally {
-    clearTimeout(timer);
-  }
-}
-function defaultMaxDurationSeconds() {
-  return HOSTED_RECORDING_CAP_SECONDS;
-}
-function capReached(elapsedMs, capSeconds) {
-  return elapsedMs >= capSeconds * 1e3;
-}
-function clampWait(waitMs, elapsedMs, capSeconds) {
-  return Math.max(0, Math.min(waitMs, capSeconds * 1e3 - elapsedMs));
-}
-function formatDurationCap(seconds) {
-  if (seconds < 60) return `${seconds} s`;
-  const m = Math.round(seconds / 60);
-  if (m < 60) return `${m} min`;
-  const h = Math.floor(m / 60);
-  const rest = m % 60;
-  return rest ? `${h} h ${rest} min` : `${h} h`;
-}
-function cappedLine(capSeconds) {
-  return `stopped at ${formatDurationCap(capSeconds)} (--max-duration ${capSeconds}); the remaining steps did not run`;
-}
-
-// src/plugin/wall.ts
-var IDP_HOSTS = [
-  "accounts.google.com",
-  "login.microsoftonline.com",
-  "login.live.com",
-  "appleid.apple.com",
-  "auth0.com",
-  "okta.com",
-  "onelogin.com",
-  "clerk.accounts.dev",
-  "accounts.dev",
-  "b2clogin.com",
-  "amazoncognito.com",
-  "workos.com",
-  "stytch.com"
-];
-var SIGNIN_SEGMENTS = /* @__PURE__ */ new Set([
-  "login",
-  "log-in",
-  "signin",
-  "sign-in",
-  "sign_in",
-  "sso",
-  "auth",
-  "authenticate",
-  "authorize",
-  "oauth",
-  "oauth2",
-  "saml"
-]);
-function parse(url) {
-  try {
-    return new URL(url);
-  } catch {
-    return null;
-  }
-}
-var bareHost = (h) => h.replace(/^www\./, "").toLowerCase();
-var trimSlash = (p) => p.length > 1 ? p.replace(/\/+$/, "") : p;
-var place = (u) => `${u.origin}${trimSlash(u.pathname)}`;
-function isIdpHost(host) {
-  const h = host.toLowerCase();
-  if (h.startsWith("clerk.")) return true;
-  return IDP_HOSTS.some((idp) => h === idp || h.endsWith(`.${idp}`));
-}
-function isSignInPath(pathname) {
-  const segs = pathname.toLowerCase().split("/").filter(Boolean);
-  return segs.some((s) => SIGNIN_SEGMENTS.has(s));
-}
-function redirectedAway(asked, landed) {
-  if (bareHost(asked.hostname) !== bareHost(landed.hostname)) return true;
-  const a = trimSlash(asked.pathname).toLowerCase();
-  const l = trimSlash(landed.pathname).toLowerCase();
-  if (a === l || a === "/") return false;
-  if (l.startsWith(`${a}/`)) return false;
-  if (l.endsWith(a)) return false;
-  return true;
-}
-var LADDER = 'This is a missing or expired session, not a script bug. Ways past, cheapest first: mint a session from the test auth the project already has; script the sign-in off camera and save the storage state; or have a person sign in once (npx playwright open --channel chrome --save-storage=<file> <url>). Then pass --storage-state <file>. The ladder: https://vos.so/llms-full.txt, "Sessions". A take OF this page is --allow-wall.';
-function wallVerdict(a) {
-  const asked = parse(a.askedUrl);
-  const landed = parse(a.landedUrl);
-  if (!asked || !landed) return null;
-  if (!/^https?:$/.test(asked.protocol)) return null;
-  const away = redirectedAway(asked, landed);
-  const where = { asked: place(asked), landed: place(landed) };
-  const host = bareHost(asked.hostname);
-  if (a.status === 401 || a.status === 403) {
-    return {
-      kind: "status",
-      level: "hard",
-      ...where,
-      message: `asked for ${asked.pathname}, answered ${a.status}: no session for ${host}. ${LADDER}`
-    };
-  }
-  const askedForSignIn = isSignInPath(asked.pathname) || isIdpHost(asked.hostname);
-  if (askedForSignIn && !away) return null;
-  if (away && isIdpHost(landed.hostname) && !isIdpHost(asked.hostname)) {
-    return {
-      kind: "idp",
-      level: "hard",
-      ...where,
-      message: `asked for ${asked.pathname}, landed on ${landed.hostname}: no session for ${host}. ${LADDER}`
-    };
-  }
-  const signInForm = a.passwordFields === 1 && !a.newPasswordField || a.oneTimeCodeField;
-  if (away && isSignInPath(landed.pathname) || signInForm && !askedForSignIn) {
-    const seen = away ? `landed on ${landed.pathname}` : "the page is a sign-in form";
-    return {
-      kind: "signin",
-      level: "hard",
-      ...where,
-      message: `asked for ${asked.pathname}, ${seen}: no session for ${host}. ${LADDER}`
-    };
-  }
-  if (away) {
-    return {
-      kind: "redirect",
-      level: "soft",
-      ...where,
-      message: `asked for ${asked.pathname}, landed on ${landed.pathname}: the site sent the recorder elsewhere, which is what a page behind a login does to a stranger. If that is the page you meant, record it by its own URL. ${LADDER}`
-    };
-  }
-  return null;
-}
-var WallError = class extends Error {
-  constructor(verdict) {
-    super(verdict.message);
-    this.verdict = verdict;
-    this.name = "WallError";
-  }
-  verdict;
-};
-var WALL_PROBE = `(() => {
-  const shown = (el) => {
-    const r = el.getBoundingClientRect()
-    if (r.width < 2 || r.height < 2) return false
-    const s = getComputedStyle(el)
-    return s.visibility !== 'hidden' && s.display !== 'none'
-  }
-  const pw = [...document.querySelectorAll('input[type="password"]')].filter(shown)
-  const otp = [...document.querySelectorAll('input[autocomplete="one-time-code"]')].filter(shown)
-  return {
-    passwordFields: pw.length,
-    newPasswordField: pw.some((el) => (el.getAttribute('autocomplete') || '').includes('new-password')),
-    oneTimeCodeField: otp.length > 0,
-  }
-})()`;
-
-// src/plugin/exposure.ts
-var EXPOSURE_MATCHERS_SRC = `(() => {
-  const EMAIL = /[A-Za-z0-9._%+-]+@((?:[A-Za-z0-9-]+\\.)+[A-Za-z]{2,})/g
-  const SAFE_HOST = /(^|\\.)example\\.(com|org|net)$|\\.(test|example|invalid|localhost)$/i
-  const KEY = new RegExp([
-    '\\\\b[srp]k_(?:live|test)_[A-Za-z0-9]{8,}',
-    '\\\\bgh[pousr]_[A-Za-z0-9]{20,}',
-    '\\\\bgithub_pat_[A-Za-z0-9_]{20,}',
-    '\\\\bxox[abprs]-[A-Za-z0-9-]{10,}',
-    '\\\\bAKIA[0-9A-Z]{16}\\\\b',
-    '\\\\bAIza[0-9A-Za-z_-]{30,}',
-    '\\\\bvos_(?:sk|rg|ho)_[A-Za-z0-9]{8,}',
-    '\\\\beyJ[A-Za-z0-9_-]{8,}\\\\.eyJ[A-Za-z0-9_-]{8,}\\\\.[A-Za-z0-9_-]{8,}',
-  ].join('|'))
-  const CARD = /(?:^|[^0-9])((?:[0-9][ -]?){12,18}[0-9])(?![0-9])/g
-  const TAIL = /[\\u2022\\u00b7*xX]{2,}[ -]?[0-9]{4}(?![0-9])/
-  const luhn = (digits) => {
-    let sum = 0, alt = false
-    for (let i = digits.length - 1; i >= 0; i--) {
-      let d = digits.charCodeAt(i) - 48
-      if (alt) { d *= 2; if (d > 9) d -= 9 }
-      sum += d; alt = !alt
-    }
-    return sum % 10 === 0
-  }
-  const kindsIn = (text) => {
-    const kinds = []
-    if (!text || text.length < 6) return kinds
-    EMAIL.lastIndex = 0
-    for (let m; (m = EMAIL.exec(text)); ) {
-      if (!SAFE_HOST.test(m[1])) { kinds.push('email'); break }
-    }
-    if (KEY.test(text)) kinds.push('key')
-    CARD.lastIndex = 0
-    for (let m; (m = CARD.exec(text)); ) {
-      const digits = m[1].replace(/[ -]/g, '')
-      if (digits.length >= 13 && digits.length <= 19 && !/^0+$/.test(digits) && luhn(digits)) { kinds.push('card'); break }
-    }
-    if (TAIL.test(text)) kinds.push('card-tail')
-    return kinds
-  }
-  return { kindsIn }
-})()`;
-var EXPOSURE_PROBE = `(() => {
-  const { kindsIn } = ${EXPOSURE_MATCHERS_SRC}
-  const vw = innerWidth, vh = innerHeight
-  // A selector that reaches THIS element and no other, so it can be pasted
-  // into "mask" as it is: climb until the path is unique, and say which
-  // sibling wherever a tag-and-class alone would match several.
-  const segment = (el) => {
-    const tid = el.getAttribute('data-testid')
-    if (tid) return el.tagName.toLowerCase() + '[data-testid="' + tid + '"]'
-    if (el.id && /^[A-Za-z_][\\w-]*$/.test(el.id)) return el.tagName.toLowerCase() + '#' + el.id
-    const cls = [...el.classList].filter((c) => /^[A-Za-z_-][\\w-]*$/.test(c)).slice(0, 2)
-    let seg = el.tagName.toLowerCase() + (cls.length ? '.' + cls.join('.') : '')
-    const p = el.parentElement
-    if (p && [...p.children].filter((c) => c.matches(seg)).length > 1)
-      seg += ':nth-child(' + ([...p.children].indexOf(el) + 1) + ')'
-    return seg
-  }
-  const name = (el) => {
-    const parts = []
-    for (let cur = el; cur && cur !== document.body && cur !== document.documentElement; cur = cur.parentElement) {
-      parts.unshift(segment(cur))
-      let n = 2
-      try { n = document.querySelectorAll(parts.join(' > ')).length } catch {}
-      // a bare tag is unique HERE and nowhere else: give it its parent too
-      const bare = parts.length === 1 && !/[#.\\[]/.test(parts[0])
-      if ((n === 1 && !bare) || parts.length >= 5) break
-    }
-    return parts.join(' > ')
-  }
-  const seen = (el) => {
-    if (el.closest('[data-vos-masked]')) return null
-    const r = el.getBoundingClientRect()
-    if (r.width < 2 || r.height < 2) return null
-    if (r.bottom <= 0 || r.right <= 0 || r.top >= vh || r.left >= vw) return null
-    const s = getComputedStyle(el)
-    if (s.visibility === 'hidden' || s.display === 'none' || +s.opacity === 0) return null
-    return r
-  }
-  const out = [], keys = new Set()
-  const add = (el, text) => {
-    const kinds = kindsIn(text)
-    if (!kinds.length) return
-    const r = seen(el)
-    if (!r) return
-    const selector = name(el)
-    for (const kind of kinds) {
-      const k = kind + '|' + selector
-      if (keys.has(k) || out.length >= 40) continue
-      keys.add(k)
-      out.push({ kind, selector, rect: { x: Math.round(r.left), y: Math.round(r.top), w: Math.round(r.width), h: Math.round(r.height) } })
-    }
-  }
-  const walker = document.createTreeWalker(document.body || document.documentElement, NodeFilter.SHOW_TEXT)
-  for (let n; (n = walker.nextNode()); ) {
-    const el = n.parentElement
-    if (!el || /^(SCRIPT|STYLE|NOSCRIPT|TEMPLATE)$/.test(el.tagName)) continue
-    add(el, n.nodeValue)
-  }
-  for (const el of document.querySelectorAll('input, textarea')) {
-    if (/^(password|hidden|file|checkbox|radio)$/.test(el.type)) continue
-    add(el, el.value)
-  }
-  const hits = {}
-  for (const [sel, n] of Object.entries(window.__vosMaskHits || {})) hits[sel] = n
-  return { exposures: out, maskHits: hits }
-})()`;
-function maskInitScript(masks) {
-  const rules = masks.map((m) => ({
-    selector: m.selector,
-    as: m.as === "text" ? "text" : "blur",
-    text: m.text ?? ""
-  }));
-  return `(() => {
-  const RULES = ${JSON.stringify(rules)}
-  const hits = (window.__vosMaskHits = window.__vosMaskHits || {})
-  for (const r of RULES) hits[r.selector] = hits[r.selector] || 0
-  const css = RULES.map((r) => r.selector + '[data-vos-masked="blur"]{filter:blur(7px) !important;user-select:none !important}').join('\\n')
-  const paint = () => {
-    const root = document.head || document.documentElement
-    if (!root || document.getElementById('__vos-mask-style')) return
-    const style = document.createElement('style')
-    style.id = '__vos-mask-style'
-    style.textContent = css
-    root.appendChild(style)
-  }
-  const apply = () => {
-    paint()
-    for (const r of RULES) {
-      let found
-      try { found = document.querySelectorAll(r.selector) } catch { continue }
-      if (found.length > hits[r.selector]) hits[r.selector] = found.length
-      for (const el of found) {
-        const form = /^(INPUT|TEXTAREA|SELECT)$/.test(el.tagName)
-        const mode = r.as === 'text' && !form ? 'text' : 'blur'
-        if (el.getAttribute('data-vos-masked') !== mode) el.setAttribute('data-vos-masked', mode)
-        if (mode !== 'text') continue
-        const texts = []
-        const w = document.createTreeWalker(el, NodeFilter.SHOW_TEXT)
-        for (let n; (n = w.nextNode()); ) texts.push(n)
-        if (!texts.length) { if (el.textContent !== r.text) el.textContent = r.text; continue }
-        texts.forEach((n, i) => { const want = i === 0 ? r.text : ''; if (n.nodeValue !== want) n.nodeValue = want })
-      }
-    }
-  }
-  new MutationObserver(apply).observe(document, { childList: true, subtree: true, characterData: true })
-  document.addEventListener('DOMContentLoaded', apply)
-  apply()
-})()`;
-}
-var ExposureLog = class {
-  byKey = /* @__PURE__ */ new Map();
-  maskHits = /* @__PURE__ */ new Map();
-  constructor(masks = []) {
-    for (const m of masks) this.maskHits.set(m.selector, 0);
-  }
-  add(step, scan) {
-    if (!scan) return;
-    for (const e of scan.exposures ?? []) {
-      const key = `${e.kind}|${e.selector}`;
-      const had = this.byKey.get(key);
-      if (had) had.seen += 1;
-      else this.byKey.set(key, { step, ...e, seen: 1 });
-    }
-    for (const [sel, n] of Object.entries(scan.maskHits ?? {})) {
-      if (n > (this.maskHits.get(sel) ?? 0)) this.maskHits.set(sel, n);
-    }
-  }
-  exposures() {
-    return [...this.byKey.values()];
-  }
-  masks(rules) {
-    return rules.map((m) => ({
-      selector: m.selector,
-      as: m.as === "text" ? "text" : "blur",
-      hits: this.maskHits.get(m.selector) ?? 0
-    }));
-  }
-};
-var KIND_WORDS = {
-  email: "an email address",
-  key: "something shaped like an API key or token",
-  card: "a card number",
-  "card-tail": "a card's last digits"
-};
-function exposureLine(e) {
-  const when = e.step < 0 ? "as the page opened" : `at step #${e.step}`;
-  return `${KIND_WORDS[e.kind]} in ${e.selector} (${when}, ${e.rect.x},${e.rect.y} ${e.rect.w}\xD7${e.rect.h})`;
-}
-var EXPOSURE_ADVICE = 'The recording shows these. Record from a demo account, or hide them before the camera rolls with "mask" in actions.json: { "selector": "\u2026", "as": "text", "text": "demo@acme.test" } swaps the words, "as": "blur" blurs. Then re-record.';
-
-// src/plugin/recorder.ts
-var realSleep = (ms) => new Promise((r) => setTimeout(r, ms));
-var DRY_PAUSE_MS = 120;
-function jpegDims(buf) {
-  let i = 2;
-  while (i < buf.length - 9) {
-    if (buf[i] !== 255) return null;
-    const marker = buf[i + 1];
-    const len = buf.readUInt16BE(i + 2);
-    if (marker >= 192 && marker <= 207 && marker !== 196 && marker !== 200 && marker !== 204) {
-      return { h: buf.readUInt16BE(i + 5), w: buf.readUInt16BE(i + 7) };
-    }
-    i += 2 + len;
-  }
-  return null;
-}
+import { recordTake as recordTakeCore } from "@vosjs/render-core/record";
 async function recordTake(browser, url, actions, paths, log, opts = {}) {
   const dry = opts.dryRun === true;
-  const sleep = dry ? (ms) => realSleep(Math.min(ms, DRY_PAUSE_MS)) : realSleep;
-  const maxSeconds = dry ? Infinity : opts.maxDurationSeconds ?? Infinity;
-  const vw = actions.viewport?.width ?? 1280;
-  const vh = actions.viewport?.height ?? 720;
-  const context = opts.context ?? await browser.newContext({
-    viewport: { width: vw, height: vh },
-    deviceScaleFactor: 1,
-    ...opts.storageState ? { storageState: opts.storageState } : {},
-    ...opts.headers && Object.keys(opts.headers).length ? { extraHTTPHeaders: opts.headers } : {}
-  });
-  if (opts.context && opts.headers && Object.keys(opts.headers).length)
-    await context.setExtraHTTPHeaders(opts.headers);
-  const masks = actions.mask ?? [];
-  if (masks.length) await context.addInitScript(maskInitScript(masks));
-  const exposureLog = new ExposureLog(masks);
-  const page = await context.newPage();
-  const scanExposures = async (step) => {
-    const scan = await page.evaluate(EXPOSURE_PROBE).catch(() => null);
-    exposureLog.add(step, scan);
-  };
-  page.on("console", (m) => {
-    if (m.type() === "error") log(`   [page error] ${m.text()}`);
-  });
-  log(`goto ${url}`);
-  let navTimeout = false;
-  let response = await page.goto(url, { waitUntil: "networkidle", timeout: 45e3 }).catch(() => {
-    navTimeout = true;
-    log("   (networkidle timeout \u2014 continuing)");
-    return null;
-  });
-  await sleep(800);
-  const setup = actions.setup ?? [];
-  if (setup.length) {
-    log(`setup: ${setup.length} step(s), off camera`);
-    const result = await runSetup(page, setup, { sleep: realSleep });
-    for (const line of result.lines) log(`   ${line}`);
-    if (result.failed) {
-      await context.close().catch(() => {
-      });
-      throw new SetupError(result.failed);
-    }
-    log(`goto ${url} (after setup)`);
-    response = await page.goto(url, { waitUntil: "networkidle", timeout: 45e3 }).catch(() => null);
-    await sleep(800);
-  }
-  let wall = null;
-  if (opts.onArrival) {
-    const seen = await page.evaluate(WALL_PROBE).catch(() => null);
-    try {
-      wall = await opts.onArrival({
-        askedUrl: url,
-        landedUrl: page.url(),
-        ...response ? { status: response.status() } : {},
-        passwordFields: seen?.passwordFields ?? 0,
-        newPasswordField: seen?.newPasswordField ?? false,
-        oneTimeCodeField: seen?.oneTimeCodeField ?? false
-      }) ?? null;
-    } catch (e) {
-      await context.close().catch(() => {
-      });
-      throw e;
-    }
-  }
-  await scanExposures(-1);
-  const cdp = await context.newCDPSession(page);
-  const frames = [];
-  let frameIdx = 0;
-  let t0 = 0;
-  if (!dry)
-    cdp.on("Page.screencastFrame", (ev) => {
-      const tsMs = ev.metadata.timestamp ? ev.metadata.timestamp * 1e3 : Date.now();
-      const file = `frame-${String(frameIdx++).padStart(5, "0")}.jpg`;
-      writeFileSync2(join13(paths.framesDir, file), Buffer.from(ev.data, "base64"));
-      frames.push({ file, tMs: Math.max(0, Math.round(tsMs - t0)) });
-      cdp.send("Page.screencastFrameAck", { sessionId: ev.sessionId }).catch(() => {
-      });
-    });
-  t0 = Date.now();
-  if (!dry)
-    await cdp.send("Page.startScreencast", {
-      format: "jpeg",
-      quality: 90,
-      maxWidth: vw,
-      maxHeight: vh,
-      everyNthFrame: 1
-    });
-  const events = [];
-  const cur = { x: 48, y: 48 };
-  const now = () => Date.now() - t0;
-  const emit = (e) => events.push({ t: now(), ...e });
-  await page.mouse.move(cur.x, cur.y);
-  emit({ x: cur.x, y: cur.y, type: "move" });
-  const clock = { now: () => Date.now(), sleep };
-  const moveTo = async (tx, ty) => {
-    const dist = Math.hypot(tx - cur.x, ty - cur.y);
-    const from = { ...cur };
-    await clockMotion(
-      dry ? 0 : pointerTravelMs(dist),
-      async (u) => {
-        cur.x = from.x + (tx - from.x) * u;
-        cur.y = from.y + (ty - from.y) * u;
-        await page.mouse.move(cur.x, cur.y);
-        emit({ x: Math.round(cur.x), y: Math.round(cur.y), type: "move" });
-      },
-      clock
-    );
-  };
-  const boxOf = async (selector) => {
-    const loc = page.locator(selector).first();
-    try {
-      await loc.waitFor({ state: "visible", timeout: 8e3 });
-      const before = await page.evaluate(() => [window.scrollX, window.scrollY]).catch(() => [0, 0]);
-      await loc.scrollIntoViewIfNeeded();
-      const after = await page.evaluate(() => [window.scrollX, window.scrollY]).catch(() => before);
-      if (before[0] !== after[0] || before[1] !== after[1])
-        await sleep(SCROLL_SETTLE_MS);
-      const bb = await loc.boundingBox();
-      if (!bb) return null;
-      return { x: bb.x, y: bb.y, w: bb.width, h: bb.height };
-    } catch {
-      log(`   (selector not found, skipping: ${selector})`);
-      return null;
-    }
-  };
-  const clickAt = async (rect) => {
-    await moveTo(rect.x + rect.w / 2, rect.y + rect.h / 2);
-    await sleep(PRESS_LEAD_MS);
-    emit({
-      x: Math.round(cur.x),
-      y: Math.round(cur.y),
-      type: "down",
-      button: 0,
-      rect
-    });
-    await page.mouse.down();
-    await sleep(PRESS_HOLD_MS);
-    await page.mouse.up();
-    emit({
-      x: Math.round(cur.x),
-      y: Math.round(cur.y),
-      type: "up",
-      button: 0,
-      rect
-    });
-  };
-  const waitSettled = async () => {
-    if (dry) return null;
-    const pressAt = now();
-    const before = frames.length;
-    for (; ; ) {
-      const t = now();
-      const last = frames.length > before ? frames[frames.length - 1] : null;
-      const sinceChange = last ? t - last.tMs : null;
-      if (settleVerdict({ sincePress: t - pressAt, sinceChange }) === "settled")
-        return sinceChange;
-      await sleep(40);
-    }
-  };
-  const skipped = [];
-  const stepSpans = [];
-  const paces = [];
-  let capped = false;
-  for (const [stepIdx, step] of actions.steps.entries()) {
-    if (capReached(now(), maxSeconds)) {
-      capped = true;
-      break;
-    }
-    const stepStart = now();
-    let gestureMs = 0;
-    const gesture = async (fn) => {
-      const t = now();
-      const out = await fn();
-      gestureMs += now() - t;
-      return out;
-    };
-    const skippedBefore = skipped.length;
-    const urlBefore = page.url();
-    let stepRect = null;
-    switch (step.do) {
-      case "wait":
-        await sleep(clampWait(step.ms, now(), maxSeconds));
-        break;
-      case "move":
-        await moveTo(step.x, step.y);
-        break;
-      case "hover": {
-        const rect = await boxOf(step.selector);
-        stepRect = rect;
-        if (rect) {
-          await gesture(() => moveTo(rect.x + rect.w / 2, rect.y + rect.h / 2));
-          log(`hover ${step.selector}`);
-          await sleep(step.ms ?? 700);
-        } else
-          skipped.push({ step: stepIdx, do: step.do, selector: step.selector });
-        break;
-      }
-      case "click": {
-        const rect = await boxOf(step.selector);
-        stepRect = rect;
-        if (rect) {
-          await gesture(() => clickAt(rect));
-          log(`click ${step.selector}`);
-          const sinceChange = await gesture(() => waitSettled());
-          await sleep(holdLeftMs(settleMs(step), sinceChange));
-        } else
-          skipped.push({ step: stepIdx, do: step.do, selector: step.selector });
-        break;
-      }
-      case "type": {
-        const rect = await boxOf(step.selector);
-        stepRect = rect;
-        if (rect) {
-          if (step.focus !== false) await gesture(() => clickAt(rect));
-          const delay = step.delayMs ?? 40;
-          const ping = () => emit({
-            x: Math.round(rect.x + rect.w / 2),
-            y: Math.round(rect.y + rect.h / 2),
-            type: "key",
-            rect
-          });
-          let lastPing = -Infinity;
-          await clockTyping(
-            [...step.text],
-            delay,
-            async (ch) => {
-              if (now() - lastPing >= 350) {
-                lastPing = now();
-                ping();
-              }
-              await page.keyboard.type(ch);
-            },
-            clock
-          );
-          ping();
-          log(`type "${step.text}" into ${step.selector}`);
-          await gesture(() => sleep(settleMs(step)));
-        } else
-          skipped.push({ step: stepIdx, do: step.do, selector: step.selector });
-        break;
-      }
-      case "scroll": {
-        const total = Math.abs(step.dy);
-        const dir = Math.sign(step.dy);
-        for (let done = 0; done < total; done += 120) {
-          await page.mouse.wheel(0, dir * Math.min(120, total - done));
-          emit({ x: Math.round(cur.x), y: Math.round(cur.y), type: "scroll" });
-          await sleep(40);
-        }
-        await gesture(() => sleep(settleMs(step)));
-        break;
-      }
-      case "drag": {
-        let start = null;
-        let rect;
-        if (step.selector) {
-          const box = await boxOf(step.selector);
-          stepRect = box;
-          if (box) {
-            rect = box;
-            start = { x: box.x + box.w / 2, y: box.y + box.h / 2 };
-          } else {
-            skipped.push({
-              step: stepIdx,
-              do: step.do,
-              selector: step.selector
-            });
-            break;
-          }
-        } else if (typeof step.x === "number" && typeof step.y === "number") {
-          start = { x: step.x, y: step.y };
-        }
-        if (!start) break;
-        await gesture(() => moveTo(start.x, start.y));
-        await gesture(() => sleep(PRESS_LEAD_MS));
-        emit({
-          x: Math.round(cur.x),
-          y: Math.round(cur.y),
-          type: "down",
-          button: 0,
-          rect
-        });
-        await page.mouse.down();
-        await gesture(() => sleep(PRESS_HOLD_MS));
-        const dur = step.ms ?? 700;
-        const from = { ...cur };
-        await clockMotion(
-          dur,
-          async (u) => {
-            cur.x = from.x + (step.tx - from.x) * u;
-            cur.y = from.y + (step.ty - from.y) * u;
-            await page.mouse.move(cur.x, cur.y);
-            emit({ x: Math.round(cur.x), y: Math.round(cur.y), type: "move" });
-          },
-          clock
-        );
-        await gesture(() => sleep(settleMs({ do: "drag" })));
-        await page.mouse.up();
-        emit({
-          x: Math.round(cur.x),
-          y: Math.round(cur.y),
-          type: "up",
-          button: 0,
-          rect
-        });
-        log(
-          `drag ${step.selector ?? `${start.x},${start.y}`} \u2192 ${step.tx},${step.ty}`
-        );
-        await sleep(400);
-        break;
+  const result = await recordTakeCore(
+    browser,
+    url,
+    actions,
+    {
+      frame: (file, bytes) => {
+        writeFileSync2(join13(paths.framesDir, file), bytes);
       }
+    },
+    log,
+    {
+      ...opts,
+      env: process.env,
+      platform: process.platform === "darwin" ? "mac" : process.platform === "win32" ? "windows" : "linux"
     }
-    const stepInfo = step;
-    stepSpans.push({
-      step: stepIdx,
-      ...stepInfo.id ? { id: stepInfo.id } : {},
-      do: step.do,
-      ...stepInfo.selector ? { selector: stepInfo.selector } : {},
-      tStart: +(stepStart / 1e3).toFixed(3),
-      tEnd: +(now() / 1e3).toFixed(3),
-      ...skipped.length > skippedBefore ? { skipped: true } : {},
-      ...page.url() !== urlBefore ? { navigated: true } : {},
-      ...stepRect ? {
-        rect: {
-          x: +stepRect.x.toFixed(1),
-          y: +stepRect.y.toFixed(1),
-          w: +stepRect.w.toFixed(1),
-          h: +stepRect.h.toFixed(1)
-        }
-      } : {}
-    });
-    paces.push({
-      step: stepIdx,
-      do: step.do,
-      askedMs: askedMs(step),
-      gestureMs,
-      wallMs: now() - stepStart
-    });
-    await scanExposures(stepIdx);
-  }
-  if (!capped) await sleep(TRAILING_HOLD_MS);
-  if (capped || capReached(now(), maxSeconds)) {
-    capped = true;
-    log(`   ${cappedLine(maxSeconds)}`);
-  }
-  const durationMs = capped ? Math.min(now(), maxSeconds * 1e3) : now();
-  await cdp.send("Page.stopScreencast").catch(() => {
-  });
-  await sleep(200);
-  const pageTitle = await page.title().catch(() => "");
-  await context.close();
-  const firstFrame = frames[0] ? jpegDims(readFileSync3(join13(paths.framesDir, frames[0].file))) : null;
-  const meta = {
-    dpr: 1,
-    zoom: 1,
-    t0,
-    durationMs,
-    width: vw,
-    height: vh,
-    fps: 30,
-    hasAudio: false,
-    captureWidth: firstFrame?.w ?? vw,
-    captureHeight: firstFrame?.h ?? vh,
-    captureSurface: "tab",
-    pageUrl: url,
-    pageTitle,
-    platform: process.platform === "darwin" ? "mac" : process.platform === "win32" ? "windows" : "linux",
-    producer: "cli",
-    steps: stepSpans,
-    ...wall ? { wall: { kind: wall.kind, asked: wall.asked, landed: wall.landed } } : {},
-    ...exposureLog.exposures().length ? { exposures: exposureLog.exposures() } : {},
-    ...masks.length ? { masks: exposureLog.masks(masks) } : {}
-  };
-  const freezes = [];
-  for (let i = 1; i < frames.length; i++) {
-    const gap = frames[i].tMs - frames[i - 1].tMs;
-    if (gap >= 400) {
-      freezes.push({
-        from: +(frames[i - 1].tMs / 1e3).toFixed(2),
-        to: +(frames[i].tMs / 1e3).toFixed(2),
-        ms: gap
-      });
-    }
-  }
-  const frozenMs = freezes.reduce((sum, f) => sum + f.ms, 0);
-  const freezePct = durationMs > 0 ? Math.round(frozenMs / durationMs * 100) : 0;
-  const dead = deadTime(stepSpans, frames, events, durationMs);
-  if (deadWarns(dead)) log(`   WARNING: ${deadLine(dead)}`);
-  const pace = paceReport(paces);
+  );
   if (!dry) {
-    await writeJson(paths.cursor, events);
-    await writeJson(paths.meta, meta, true);
-    await writeJson(paths.framesIndex, frames);
-    await writeJson(paths.actions, { ...actions, url }, true);
-    log(`   ${paceLine(pace)}`);
+    await writeJson(paths.cursor, result.events);
+    await writeJson(paths.meta, result.meta, true);
+    await writeJson(paths.framesIndex, result.frames);
+    await writeJson(paths.actions, result.actions, true);
   }
-  return {
-    events,
-    frames,
-    meta,
-    pace,
-    skipped,
-    navTimeout,
-    wall,
-    exposures: exposureLog.exposures(),
-    masks: exposureLog.masks(masks),
-    freezes,
-    freezePct,
-    dead,
-    capped
-  };
+  return result;
 }
 
+// src/plugin/wall.ts
+import {
+  WALL_PROBE,
+  WallError,
+  isIdpHost,
+  isSignInPath,
+  redirectedAway,
+  wallVerdict
+} from "@vosjs/render-core/record";
+
+// src/plugin/exposure.ts
+import {
+  EXPOSURE_ADVICE,
+  EXPOSURE_MATCHERS_SRC,
+  EXPOSURE_PROBE,
+  ExposureLog,
+  exposureLine,
+  maskInitScript
+} from "@vosjs/render-core/record";
+
+// src/plugin/setup.ts
+import {
+  SetupEnvError,
+  SetupError,
+  parseHeaders,
+  resolveSetupText,
+  runSetup,
+  setupEnvNames,
+  validateSetup
+} from "@vosjs/render-core/record";
+
 // src/plugin/session.ts
 import { spawn } from "child_process";
 import { existsSync as existsSync12, mkdirSync as mkdirSync2, readdirSync as readdirSync2, rmSync, statSync as statSync3 } from "fs";
@@ -7616,47 +6634,47 @@ function looksLikeStorageState(value) {
   return Array.isArray(v.cookies) && Array.isArray(v.origins);
 }
 
+// src/plugin/recordingCap.ts
+import {
+  capReached,
+  cappedLine,
+  clampWait,
+  formatDurationCap
+} from "@vosjs/render-core/record";
+var HOSTED_RECORDING_CAP_SECONDS = 30 * 60;
+function parseHostedCap(body) {
+  const limits = body && typeof body === "object" ? body.limits : void 0;
+  const cap = limits?.recordingMaxSeconds;
+  return typeof cap === "number" && Number.isInteger(cap) && cap > 0 ? cap : null;
+}
+async function hostedRecordingCap(origin, key, fetchImpl = fetch) {
+  const ctl = new AbortController();
+  const timer = setTimeout(() => ctl.abort(), 2e3);
+  try {
+    const res = await fetchImpl(`${origin.replace(/\/+$/, "")}/api/limits`, {
+      signal: ctl.signal,
+      ...key ? { headers: { authorization: `Bearer ${key}` } } : {}
+    });
+    if (!res.ok) return null;
+    return parseHostedCap(await res.json());
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function defaultMaxDurationSeconds() {
+  return HOSTED_RECORDING_CAP_SECONDS;
+}
+
 // src/plugin/encode.ts
-var MEDIABUNNY_URL2 = "https://esm.sh/mediabunny@1.55.7?target=es2022";
-var ENCODE_HTML = `<!doctype html><html><head><meta charset="utf-8"></head><body>
-<script type="module">
-try {
-  const MB = await import('${MEDIABUNNY_URL2}')
-  const frames = await (await fetch('/frames.json')).json()
-  const meta = await (await fetch('/meta.json')).json()
-  const W = meta.captureWidth ?? meta.width, H = meta.captureHeight ?? meta.height
-  const FPS = 30
-  const durSec = meta.durationMs / 1000
-  const cv = document.createElement('canvas')
-  cv.width = W; cv.height = H
-  const c2 = cv.getContext('2d')
-  const output = new MB.Output({ format: new MB.WebMOutputFormat(), target: new MB.BufferTarget() })
-  const src = new MB.CanvasSource(cv, { codec: 'vp9', bitrate: 8_000_000 })
-  output.addVideoTrack(src, { frameRate: FPS })
-  await output.start()
-  let fi = -1
-  const total = Math.ceil(durSec * FPS)
-  for (let i = 0; i < total; i++) {
-    const t = i / FPS
-    let next = fi
-    while (next + 1 < frames.length && frames[next + 1].tMs <= t * 1000) next++
-    if (next < 0) next = 0
-    if (next !== fi) {
-      fi = next
-      const blob = await (await fetch('/frames/' + frames[fi].file)).blob()
-      const bmp = await createImageBitmap(blob)
-      c2.drawImage(bmp, 0, 0, W, H)
-      bmp.close()
-    }
-    await src.add(t, 1 / FPS)
-    window.__progress = i / total
-  }
-  await output.finalize()
-  const buf = output.target.buffer
-  await fetch('/save?name=${RECORDING_NAME}', { method: 'POST', body: buf })
-  window.__done = { ok: true, bytes: buf.byteLength }
-} catch (e) { window.__error = String(e && e.stack || e) }
-</script></body></html>`;
+import { buildEncodePage } from "@vosjs/render-core/record";
+var ENCODE_HTML = buildEncodePage({
+  framesIndexUrl: "/frames.json",
+  metaUrl: "/meta.json",
+  framesBaseUrl: "/frames/",
+  save: { method: "POST", url: `/save?name=${RECORDING_NAME}` }
+});
 async function encodeRecording(browser, takeDir, onProgress) {
   const server = await startTakeServer(takeDir, { "/encode.html": ENCODE_HTML });
   const page = await browser.newPage();
@@ -8112,7 +7130,7 @@ async function planTake(dir, opts = {}) {
 
 // src/plugin/sync.ts
 import { createHash } from "crypto";
-import { existsSync as existsSync14, readFileSync as readFileSync4, readdirSync as readdirSync3 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync3, readdirSync as readdirSync3 } from "fs";
 import { readFile as readFile13 } from "fs/promises";
 import { createInterface } from "readline/promises";
 import { basename as basename3, join as join17 } from "path";
@@ -8616,7 +7634,7 @@ function storageStateInDir(dir) {
     if (!f.endsWith(".json") || f === "doc.json" || f === "meta.json" || f === "actions.json" || f === "cursor.json" || f === "vos.json" || f === "doc.prev.json")
       continue;
     try {
-      const v = JSON.parse(readFileSync4(join17(dir, f), "utf8"));
+      const v = JSON.parse(readFileSync3(join17(dir, f), "utf8"));
       if (looksLikeStorageState(v)) return join17(dir, f);
     } catch {
     }
@@ -9059,6 +8077,41 @@ async function browserLogin(origin, r, opts) {
     "no approval within 15 minutes \u2014 run `vos login` again, or mint a key at https://vos.so/app/api and pass --key"
   );
 }
+var HANDOFF_URL = /^(https?:\/\/[^/]+)\/h\/(vos_ho_[A-Za-z0-9_-]+)$/;
+function parseHandoffUrl(url) {
+  const m = HANDOFF_URL.exec(url.trim());
+  return m ? { origin: m[1], token: m[2] } : null;
+}
+async function handoffLogin(url, r, opts = {}) {
+  const parsed = parseHandoffUrl(url);
+  if (!parsed)
+    throw new Error(
+      "--handoff wants the link a person copied from vos.so, https://vos.so/h/vos_ho_\u2026"
+    );
+  r.log(`exchanging the setup link at ${parsed.origin}\u2026`);
+  const res = await apiJson(parsed.origin, "/api/cli/login/exchange", {
+    method: "POST",
+    body: { token: parsed.token, hostname: hostname().slice(0, 64) }
+  });
+  if (res.status === 200 && res.body.status === "ok") {
+    const path = (opts.store ?? writeCredential)(res.body.key);
+    const user = typeof res.body.user === "object" && res.body.user !== null ? res.body.user.name ?? "" : "";
+    return {
+      path,
+      user,
+      keyName: String(res.body.keyName ?? ""),
+      origin: parsed.origin
+    };
+  }
+  if (res.status === 404 && !res.body.status) {
+    throw new Error(
+      `${parsed.origin} does not support setup links yet \u2014 run \`vos login\` instead`
+    );
+  }
+  const said = typeof res.body.error === "string" ? res.body.error : apiError("exchange", res);
+  const hint = typeof res.body.hint === "string" ? ` ${res.body.hint}` : "";
+  throw new Error(`${said}${hint}`);
+}
 
 // src/plugin/program.ts
 var BOOLEAN_FLAGS2 = /* @__PURE__ */ new Set([
@@ -9605,6 +8658,21 @@ async function cmdLogin(argv) {
     origin: strFlag(flags, "origin"),
     api: strFlag(flags, "api")
   });
+  const handoffUrl = strFlag(flags, "handoff");
+  if (handoffUrl) {
+    const done = await handoffLogin(handoffUrl, r);
+    r.done(
+      {
+        path: done.path,
+        origin: done.origin,
+        user: done.user,
+        keyName: done.keyName,
+        next_step: "the link is spent; vos push when you want the work hosted"
+      },
+      `Signed in${done.user ? ` as ${done.user}` : ""} \u2014 key "${done.keyName}" stored at ${done.path} (used by every vos platform verb). The link is spent.`
+    );
+    return EXIT_OK;
+  }
   const explicit = strFlag(flags, "key") ?? process.env.VOS_API_KEY?.trim();
   if (explicit) return storeKey(explicit, origin, r);
   try {
@@ -9673,7 +8741,7 @@ async function writeProgramDoc(dir, hosted) {
 }
 
 // src/plugin/asset.ts
-import { readFileSync as readFileSync5 } from "fs";
+import { readFileSync as readFileSync4 } from "fs";
 import { basename as basename5, extname as extname2 } from "path";
 var BOOLEAN_FLAGS3 = /* @__PURE__ */ new Set(["json", "help"]);
 var MIME_BY_EXT = {
@@ -9727,7 +8795,7 @@ async function cmdPush(argv) {
   for (const file of positionals) {
     const name = basename5(file);
     const mime = MIME_BY_EXT[extname2(name).toLowerCase()] ?? "application/octet-stream";
-    const body = readFileSync5(file);
+    const body = readFileSync4(file);
     const form = new FormData();
     form.set("file", new Blob([body], { type: mime }), name);
     if (folder) form.set("folderId", folder.id);
@@ -9781,7 +8849,7 @@ async function cmdAsset(argv) {
 }
 
 // src/plugin/recipe.ts
-import { readFileSync as readFileSync6 } from "fs";
+import { readFileSync as readFileSync5 } from "fs";
 import { basename as basename6 } from "path";
 var BOOLEAN_FLAGS4 = /* @__PURE__ */ new Set(["json", "help"]);
 var USAGE = "vos recipe push <file.md> (--folder <folderId|slug> | --asset <assetId>)";
@@ -9801,7 +8869,7 @@ async function cmdPush2(argv) {
     throw new UsageError(USAGE);
   }
   const filename = recipeFilename(file);
-  const body = readFileSync6(file);
+  const body = readFileSync5(file);
   const r = createReporter(flags.json === true);
   const origin = platformOrigin({
     origin: strFlag(flags, "origin"),
@@ -10244,6 +9312,103 @@ async function cmdBrand(argv) {
   return 0;
 }
 
+// src/plugin/hostedRecord.ts
+import { setupEnvNames as setupEnvNames2 } from "@vosjs/render-core/record";
+var POLL_MS = 3e3;
+var DEFAULT_TIMEOUT_MS = 20 * 60 * 1e3;
+function hostedEnv(actions, shell) {
+  const env = {};
+  const missing = [];
+  for (const name of setupEnvNames2(actions.setup)) {
+    const v = shell[name];
+    if (v === void 0 || v === "") missing.push(name);
+    else env[name] = v;
+  }
+  return { env, missing };
+}
+function isWallError(error) {
+  return !!error && /^(\[\w+\] )?The page is behind a sign-in/.test(error);
+}
+async function recordHosted(input) {
+  const sleep = input.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const posted = await apiJson(input.origin, "/api/record/jobs", {
+    method: "POST",
+    key: input.key,
+    body: {
+      url: input.url,
+      actions: input.actions,
+      viewport: input.actions.viewport,
+      ...Object.keys(input.headers).length ? { headers: input.headers } : {},
+      ...Object.keys(input.env).length ? { env: input.env } : {},
+      ...input.title ? { title: input.title } : {},
+      ...input.folderId ? { folderId: input.folderId } : {}
+    }
+  });
+  if (posted.status !== 202) {
+    return {
+      ok: false,
+      wall: false,
+      error: apiError("record on vos.so", posted),
+      vosId: null,
+      jobId: null
+    };
+  }
+  const job = posted.body.job;
+  const vos = posted.body.vos;
+  const cap = posted.body.cap;
+  input.log(
+    `queued on vos.so as job ${job.id.slice(0, 8)} (vos ${job.vosId}${cap?.seconds ? `, cap ${cap.seconds}s` : ""})`
+  );
+  const deadline = Date.now() + (input.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+  let lastStatus = "queued";
+  while (Date.now() < deadline) {
+    await sleep(POLL_MS);
+    const polled = await apiJson(input.origin, `/api/record/jobs/${job.id}`, {
+      key: input.key
+    });
+    if (polled.status !== 200) {
+      return {
+        ok: false,
+        wall: false,
+        error: apiError(`poll record job ${job.id}`, polled),
+        vosId: job.vosId,
+        jobId: job.id
+      };
+    }
+    const state = polled.body.job;
+    if (state.status !== lastStatus) {
+      input.log(`${state.status}\u2026`);
+      lastStatus = state.status;
+    }
+    if (state.status === "completed") {
+      return {
+        ok: true,
+        vosId: state.vosId,
+        jobId: state.id,
+        job: state,
+        studio: vos?.studio ?? `${input.origin}/studio?vos=${state.vosId}`
+      };
+    }
+    if (state.status === "failed" || state.status === "canceled") {
+      const error = state.error ?? (state.status === "canceled" ? "the record job was canceled" : "the record job failed");
+      return {
+        ok: false,
+        wall: isWallError(error),
+        error,
+        vosId: state.vosId,
+        jobId: state.id
+      };
+    }
+  }
+  return {
+    ok: false,
+    wall: false,
+    error: `the record job ${job.id} did not finish within ${Math.round((input.timeoutMs ?? DEFAULT_TIMEOUT_MS) / 6e4)} min; poll ${input.origin}/api/record/jobs/${job.id}`,
+    vosId: job.vosId,
+    jobId: job.id
+  };
+}
+
 // src/plugin/agentBrowser.ts
 import { writeFile as writeFile13 } from "fs/promises";
 import { resolve as resolve8 } from "path";
@@ -10764,7 +9929,7 @@ function summary(result) {
 async function cmdActionsScript(input, flags) {
   const r = createReporter(flags.json === true);
   const { readFile: readFile16 } = await import("fs/promises");
-  const { shotList, formatShotList } = await import("./shotList-7F2FE3RU.js");
+  const { shotList, formatShotList } = await import("./shotList-IYFDHSIK.js");
   const raw = JSON.parse(await readFile16(resolve8(input), "utf8"));
   const errors = validateActions(raw);
   if (errors.length) throw new UsageError(`${input}:
@@ -10780,7 +9945,7 @@ import {
   cpSync,
   existsSync as existsSync17,
   mkdirSync as mkdirSync3,
-  readFileSync as readFileSync8,
+  readFileSync as readFileSync7,
   rmSync as rmSync2,
   writeFileSync as writeFileSync3
 } from "fs";
@@ -10789,7 +9954,7 @@ import { join as join20 } from "path";
 import { chromium as chromium2 } from "playwright";
 
 // src/plugin/machine.ts
-import { existsSync as existsSync16, readFileSync as readFileSync7, readdirSync as readdirSync4, statSync as statSync4 } from "fs";
+import { existsSync as existsSync16, readFileSync as readFileSync6, readdirSync as readdirSync4, statSync as statSync4 } from "fs";
 import { dirname as dirname5, join as join19 } from "path";
 var AGENT_NAMES = [
   "claude",
@@ -11006,7 +10171,7 @@ function bundledSkillsDir(from) {
     const pkg = join19(dir, "package.json");
     if (existsSync16(pkg)) {
       try {
-        const name = JSON.parse(readFileSync7(pkg, "utf8")).name;
+        const name = JSON.parse(readFileSync6(pkg, "utf8")).name;
         if (name === "@vosjs/cli") {
           const skills = join19(dir, "skills");
           return existsSync16(skills) && statSync4(skills).isDirectory() ? skills : null;
@@ -11188,7 +10353,7 @@ async function cmdSetup(argv) {
   let rules = null;
   if (!noRules) {
     const file = rulesFileFor(root);
-    const existing = existsSync17(file) ? readFileSync8(file, "utf8") : null;
+    const existing = existsSync17(file) ? readFileSync7(file, "utf8") : null;
     const { text, changed } = applyRulesBlock(existing);
     if (changed) writeFileSync3(file, text);
     rules = { file, changed };
@@ -11339,7 +10504,8 @@ var BOOLEAN_FLAGS6 = /* @__PURE__ */ new Set([
   "leader",
   "keep-frames",
   "dry-run",
-  "allow-wall"
+  "allow-wall",
+  "hosted"
 ]);
 var MULTI_FLAGS2 = /* @__PURE__ */ new Set(["set", "override", "browser-arg", "header"]);
 var HELP = `vos \u2014 record a browser flow, plan effects, render a product video; sync with vos.so
@@ -11347,6 +10513,8 @@ var HELP = `vos \u2014 record a browser flow, plan effects, render a product vid
 Take pipeline
   vos create --actions actions.json [--url <url>] [--out take] [out.webm] [--strict] [--allow-wall] [--keep-frames] [--max-duration <s>] [--storage-state <file>|--session <name>] [--header name=value]... [--browser-arg=<switch>]... [--background <slug|url|none>] [render flags] [--json]
   vos record --actions actions.json [--url <url>] [--out take] [--strict] [--dry-run] [--allow-wall] [--keep-frames] [--max-duration <s>] [--storage-state <file>|--session <name>] [--header name=value]... [--browser-arg=<switch>]... [--background <slug|url|none>] [--json]
+  vos record --hosted --actions actions.json [--url <url>] [--out take] [--title "\u2026"] [--folder <id>] [--header name=value]... [--json]
+            the take recorded on vos.so's fleet (no browser here): lands as a private vos with its doc and digest, then fetched into --out with its media
   vos plan <take> [--fresh] [--reuse [--from <doc.json>]] [--style <doc.json|vosId>] [--with <doc.json|vosId>[@end|@start|@step:<id>|@<s>]]... [--background <slug|url|none>] [--motion] [--headline "\u2026"] [--kicker "\u2026"] [--launch LAUNCH.md] [--brand BRAND.md] [--music <slug|mood|none>] [--entrance tilt-in|pull-out|rise|fade|slide|none] [--transitions slide|fade|scale|none] [--end-card on|none|<doc.json|vosId>] [--captions none] [--clicks none] [--still <t>] [--release v2.1] [--json]
   vos render <take> [out.webm] [--width] [--height] [--fps] [--format webm|mp4] [--parallel N] [--range a..b] [--draft] [--frame <kind>] [--background <url|slug>] [--set <path=value>]... [--json]
   vos frames <take> [--times 0,25%,50%,75%,100%] [--frame <t>] [--at-zooms] [--at-moments] [--at-still] [--size WxH] [--out dir] [--background <url|slug>] [--set <path=value>]... [--json]
@@ -11381,10 +10549,12 @@ This machine (no account)
             remove ~/.config/vos/credentials (VOS_API_KEY still resolves)
 
 Platform (vos.so) \u2014 fetch, edit, push, pull, repeat
-  vos login [--key <vos_sk_\u2026>] [--label <name>] [--no-browser]
+  vos login [--key <vos_sk_\u2026>] [--handoff <url>] [--label <name>] [--no-browser]
             sign in via the browser (approve at vos.so/cli/auth; works
             headless \u2014 print the URL, a human approves, the key stores
-            itself). --key skips the browser (mint at vos.so/app/api)
+            itself). --key skips the browser (mint at vos.so/app/api).
+            --handoff https://vos.so/h/\u2026 exchanges the setup link a
+            signed-in person's line carries for a key, once, no click
   vos fetch <vosId|watch-url> [--out dir] [--media] [--json]
             writes config.json + vos.json (no auth needed for public programs);
             a take vos also gets its doc.json, and --media its footage
@@ -11759,12 +10929,102 @@ async function cmdRecord(argv) {
   if (!url)
     throw new UsageError('no URL \u2014 set "url" in the actions file or pass --url');
   const outDir = resolve9(strFlag(flags, "out") ?? "take");
-  const backdrop = await takeBackdrop(flags, r);
-  const maxDurationSeconds = await maxDuration(flags, r);
   const storageState = takeStorageState(flags);
   const sessionName = takeSessionName(flags, storageState);
   const browserArgs = takeBrowserArgs(multi);
   const headers = takeHeaders(multi);
+  if (flags.hosted === true) {
+    if (flags["dry-run"] === true)
+      throw new UsageError(
+        "--dry-run rehearses on this machine; drop --hosted to rehearse, or --dry-run to record on vos.so"
+      );
+    if (storageState || sessionName)
+      throw new UsageError(
+        'a session never reaches vos.so: --hosted takes no --session or --storage-state. Put the sign-in in the setup steps with { "env": "NAME" }, or record here with vos record.'
+      );
+    const origin = platformOrigin({
+      origin: strFlag(flags, "origin"),
+      api: strFlag(flags, "api")
+    });
+    const key = resolveCredential(strFlag(flags, "key"));
+    if (!key)
+      throw new UsageError(
+        "recording on vos.so needs a credential: vos login, or VOS_API_KEY (mint a key at https://vos.so/app/api)"
+      );
+    const { env, missing } = hostedEnv(actions, process.env);
+    if (missing.length)
+      throw new UsageError(
+        `the setup reads ${missing.map((n) => `{ "env": "${n}" }`).join(", ")} and this shell has no ${missing.length === 1 ? "value for it" : "values for them"}; export ${missing.join(", ")} and run again (the value rides the job, and is never stored)`
+      );
+    r.log("recording on vos.so\u2026");
+    r.event({ event: "phase", phase: "record" });
+    const started = Date.now();
+    const outcome = await recordHosted({
+      origin,
+      key,
+      url,
+      actions: { ...actions, url },
+      headers,
+      title: strFlag(flags, "title"),
+      folderId: strFlag(flags, "folder"),
+      env,
+      log: r.log
+    });
+    if (!outcome.ok) {
+      if (outcome.vosId) {
+        const gone = await apiJson(origin, `/api/vos/${outcome.vosId}`, {
+          method: "DELETE",
+          key
+        });
+        if (gone.status === 200)
+          r.log("the empty vos it would have landed on was removed");
+      }
+      r.done(
+        {
+          hosted: true,
+          ok: false,
+          wall: outcome.wall,
+          error: outcome.error,
+          vosId: outcome.vosId,
+          jobId: outcome.jobId
+        },
+        `${outcome.wall ? "REFUSED" : "FAILED"} on vos.so: ${outcome.error}`
+      );
+      return outcome.wall ? EXIT_WALL : EXIT_ERROR;
+    }
+    r.event({ event: "phase", phase: "fetch" });
+    r.log(`landed as ${outcome.studio}; fetching the take into ${outDir}\u2026`);
+    const fetched = await cmdFetch([
+      outcome.vosId,
+      "--out",
+      outDir,
+      "--media",
+      ...strFlag(flags, "origin") ? ["--origin", strFlag(flags, "origin")] : [],
+      ...strFlag(flags, "key") ? ["--key", strFlag(flags, "key")] : [],
+      ...flags.json === true ? ["--json"] : []
+    ]);
+    if (fetched !== EXIT_OK) return fetched;
+    const t = outcome.job.telemetry ?? {};
+    r.done(
+      {
+        hosted: true,
+        ok: true,
+        vosId: outcome.vosId,
+        jobId: outcome.jobId,
+        out: outDir,
+        seconds: +((Date.now() - started) / 1e3).toFixed(1),
+        telemetry: t
+      },
+      `Recorded on vos.so in ${((Date.now() - started) / 1e3).toFixed(1)}s: ${outcome.studio}
+  ${outDir}/ holds doc.json, the recording and vos.json${typeof t.durationMs === "number" ? ` (${(t.durationMs / 1e3).toFixed(1)}s of footage)` : ""}${Array.isArray(t.dead) && t.dead.length ? `
+  DEAD TIME: ${t.dead.length} stretch(es) under a parked cursor; give those steps their ms` : ""}${Array.isArray(t.exposures) && t.exposures.length ? `
+  EXPOSURES: ${t.exposures.length} sensitive-looking text(s) in frame; mask them in actions.json` : ""}
+  Next: vos digest ${outDir} \u2014 look before you cut; edit doc.json; vos push ${outDir}`
+    );
+    return EXIT_OK;
+  }
+  const backdrop = await takeBackdrop(flags, r);
+  const maxDurationSeconds = await maxDuration(flags, r);
   if (flags["dry-run"] === true) {
     void flags.strict;
     void flags["keep-frames"];
@@ -13274,4 +12534,4 @@ export {
   verbHelp,
   run
 };
-//# sourceMappingURL=chunk-ANKECV7F.js.map
+//# sourceMappingURL=chunk-TAWRT7UM.js.map