@vosjs/cli 0.48.0 → 0.49.0

package/dist/cli.js

@@ -511,7 +511,7 @@ async function cmdCheck(argv) {
   return result.ok ? EXIT_OK : EXIT_ERROR;
 }
 async function delegate(argv, viaAlias = false) {
-  const { run } = await import("./run-CYHH56KA.js");
+  const { run } = await import("./run-EQZXEPXZ.js");
   if (viaAlias && argv[0]) {
     process.stderr.write(
       `note: "vos voila ${argv[0]}" is now "vos ${argv[0]}".
@@ -551,7 +551,7 @@ async function main() {
     const engine = HELP_ENGINE.split("\n").filter(
       (l) => l.startsWith(`  vos ${cmd} `)
     );
-    const { verbHelp } = await import("./run-CYHH56KA.js");
+    const { verbHelp } = await import("./run-EQZXEPXZ.js");
     const take = verbHelp(cmd);
     process.stdout.write(
       `${engine.join("\n")}
@@ -583,7 +583,7 @@ ${take.includes("no such verb") ? "" : take}`
 main().then(async (code) => {
   if (code === EXIT_OK) {
     const verb = process.argv[2] ?? "";
-    const { HELP } = await import("./run-CYHH56KA.js");
+    const { HELP } = await import("./run-EQZXEPXZ.js");
     const documented = [
       ...helpFlagsFor(HELP_ENGINE, verb),
       ...helpFlagsFor(HELP, verb)

package/dist/index.d.ts

@@ -1,5 +1,8 @@
 import { Browser, BrowserContext, Page } from 'playwright';
-import { CursorTrack, RecordingMeta, ProjectDoc, CursorEvent, TemplateAnchor, Backdrop, LayoutParts, TranscriptSegment, Digest } from '@vosjs/studio-core';
+import * as _vosjs_render_core_record from '@vosjs/render-core/record';
+import { ActionsFile, RecordOpts as RecordOpts$1 } from '@vosjs/render-core/record';
+export { ActionStep, ActionsFile, validateActions } from '@vosjs/render-core/record';
+import { CursorTrack, RecordingMeta, ProjectDoc, TemplateAnchor, Backdrop, LayoutParts, TranscriptSegment, Digest } from '@vosjs/studio-core';
 export { Digest } from '@vosjs/studio-core';
 
 interface RenderCommonOptions {
@@ -94,217 +97,6 @@ interface PluginManifest {
 }
 declare const manifest: PluginManifest;
 
-interface PaceReport {
-    askedMs: number;
-    gestureMs: number;
-    wallMs: number;
-    /** Wall time neither asked nor a gesture: what the page and the round trips cost. */
-    overheadMs: number;
-    overheadPct: number;
-    /** The steps whose wall ran past their ask plus gesture by more than a third. */
-    slow: {
-        step: number;
-        do: string;
-        askedMs: number;
-        wallMs: number;
-    }[];
-}
-interface DeadStep {
-    step: number;
-    id?: string;
-    do: string;
-    /** ms from the step's act (its press, else its start) to the last frame change in the step. */
-    settledMs: number;
-    /** ms the settled frame was held before the step ended. */
-    heldMs: number;
-    /** the hold past the reading beat, while the cursor was parked; 0 when the hold was read or the pointer moved. */
-    deadMs: number;
-}
-interface DeadReport {
-    ms: number;
-    pct: number;
-    /** the steps that carried any dead time, in order. */
-    steps: DeadStep[];
-    /** the longest single dead hold. */
-    longestMs: number;
-}
-
-/**
- * What a signed-in take SHOWS. Getting past the login is half the problem;
- * the other half is that the account's own data is now in the frame: an
- * email address in the header, a key on a settings page, a card number.
- * Asking nicely does not hold this line (a person asked to sign in with a
- * demo account signs in as themselves, because it is the account they have),
- * so the recorder looks.
- *
- * Two pieces, both run IN the page:
- *
- * - the EXPOSURE scan reads the text that is visible in the viewport after
- *   each step and reports the KIND of thing it saw and where. Never the
- *   string itself: a report that quotes the secret is a second leak.
- * - a MASK hides a selector before the first frame is captured and keeps it
- *   hidden across navigations and re-renders, so the real value is never in
- *   a frame, never in the recording, never pushed. `as: 'text'` swaps the
- *   words (a product reads better than a redaction); `as: 'blur'` blurs.
- *
- * The matchers are ONE plain-JavaScript source string, evaluated in the page
- * and, by the tests, in Node: a function serialized out of a bundle picks up
- * the bundler's `__name` helper and dies in the page, and two copies of a
- * regex drift.
- */
-
-interface MaskRule {
-    selector: string;
-    /** `blur` (default) blurs the element; `text` swaps its words for `text`. */
-    as?: 'blur' | 'text';
-    text?: string;
-}
-
-/**
- * `setup`: the steps that run BEFORE the camera rolls. A sign-in form, a
- * cookie banner, the "choose your editor" modal, an onboarding tour: things
- * a take must get past and must not show. They run after the first
- * navigation and before `Page.startScreencast`, with no cursor synthesis,
- * no pace accounting and nothing written to `meta.steps`. Then the recorder
- * navigates to `url` again and the take begins where the setup left it.
- *
- * A `type` step's `text` may be `{ "env": "DEMO_PASSWORD" }`: resolved at run
- * time, never logged, never stored. The guarantee is narrow and real: the
- * secret is never in a file that travels (`actions.json` is committed and
- * pushed with the take; `meta.json` is read by the digest) and never in the
- * footage. An agent with a shell can still read the variable; that is the
- * maker's decision to make, not this file's to hide.
- */
-
-type SetupText = string | {
-    env: string;
-};
-type SetupStep = ({
-    do: 'wait';
-    ms: number;
-} | {
-    do: 'click';
-    selector: string;
-    ms?: number;
-} | {
-    do: 'type';
-    selector: string;
-    text: SetupText;
-    ms?: number;
-} | {
-    do: 'press';
-    key: string;
-    ms?: number;
-} | {
-    do: 'goto';
-    url: string;
-}) & {
-    id?: string;
-};
-
-/**
- * The action script — the declarative recipe an agent (or human) writes to
- * drive a take. Small on purpose: selectors + a handful of verbs. The recorder
- * executes it with humanized cursor motion and synthesizes the CursorTrack
- * from its own dispatches.
- */
-interface ActionsFile {
-    /** Page to record. `--url` overrides. */
-    url?: string;
-    /** Recording viewport in CSS px (default 1280x720). */
-    viewport?: {
-        width: number;
-        height: number;
-    };
-    /**
-     * Hidden BEFORE the first frame is captured and kept hidden across
-     * navigations: what a signed-in account shows that must not ship. `blur`
-     * (default) blurs the element; `text` swaps its words for `text`, which is
-     * for IDENTIFIERS (an email, a name, an account id), never for product
-     * copy or numbers: the video must stay true to the product.
-     */
-    mask?: MaskRule[];
-    /**
-     * Run BEFORE the camera rolls, after the first navigation: a sign-in form,
-     * a cookie banner, an onboarding tour. Plain actions with no cursor, no
-     * frames, no pace and nothing in `meta.steps`; then the recorder opens
-     * `url` again and the take begins where the setup left it. A `type`
-     * step's text may be `{ env: 'NAME' }`, read at run time and never logged
-     * or stored.
-     */
-    setup?: SetupStep[];
-    steps: ActionStep[];
-}
-type ActionStep = ({
-    do: 'wait';
-    ms: number;
-} | {
-    do: 'hover';
-    selector: string;
-    ms?: number;
-}
-/** `ms` is the settle after the press (default 150). */
- | {
-    do: 'click';
-    selector: string;
-    ms?: number;
-}
-/**
- * Type into `selector`. The recorder clicks the field first, which is what
- * opens the typing zoom on it; `focus: false` types into the field as it is
- * already focused, for a keystroke that follows earlier typing (a submitting
- * Enter) rather than starting it — a second click there rings a click effect
- * on empty space beside the text.
- */
- | {
-    do: 'type';
-    selector: string;
-    text: string;
-    delayMs?: number;
-    focus?: boolean;
-    /** the settle after the last character (default 150) */
-    ms?: number;
-}
-/** `ms` is the settle after the scroll lands (default 200). */
- | {
-    do: 'scroll';
-    dy: number;
-    ms?: number;
-} | {
-    do: 'move';
-    x: number;
-    y: number;
-}
-/**
- * Press-move-release — real edits (drag an element on the stage canvas,
- * slide a range input, move a timeline clip). Start = the selector's center
- * when given, else (x, y); end = (tx, ty); eased over ms (default 700).
- */
- | {
-    do: 'drag';
-    selector?: string;
-    x?: number;
-    y?: number;
-    tx: number;
-    ty: number;
-    ms?: number;
-}) & {
-    /**
-     * Optional stable identity: anchors in doc.json name a step by this
-     * id (else by index), so a step can move or gain neighbours across script
-     * edits without breaking the cut anchored to it. Unique when present.
-     */
-    id?: string;
-    /**
-     * A beat's caption, two to eight words: `vos deliver` lands it as a
-     * lower-third at this step's moment on the cuts that take words, and
-     * `vos actions script` leads the beat with it.
-     */
-    caption?: string;
-};
-/** Structural validation with actionable messages. Returns [] when valid. */
-declare function validateActions(value: unknown): string[];
-
 /** The name `record` writes its footage under — its encoder emits WebM. */
 declare const RECORDING_NAME = "recording.webm";
 interface TakePaths {
@@ -330,143 +122,14 @@ interface TakeData {
 /** Load a take directory; cursor+meta are required, doc/actions optional. */
 declare function loadTake(dir: string): Promise<TakeData>;
 
-/**
- * The wall check: did the recorder land where it was asked, or in front of
- * a sign-in? A take of a product behind a login, recorded without a session,
- * used to succeed: the footage was the login page (or wherever the site
- * sends a stranger), and the only symptom was a skipped selector. This says
- * it in words, before a frame is captured and before a re-record clears the
- * footage it would have replaced.
- *
- * Pure: the recorder gathers the evidence, this decides. A heuristic is
- * acceptable because both failure directions are cheap: a false refusal
- * costs one flag (`--allow-wall`), a false pass costs what every such take
- * cost before.
- */
-/** What the recorder saw once the first navigation settled. */
-interface Arrival {
-    askedUrl: string;
-    landedUrl: string;
-    /** HTTP status of the main document, when the navigation produced one. */
-    status?: number;
-    /** `input[type=password]` fields that are visible on the page. */
-    passwordFields: number;
-    /** A password field marked `autocomplete="new-password"` (a settings or sign-up form). */
-    newPasswordField: boolean;
-    /** A visible one-time-code field (`autocomplete="one-time-code"`). */
-    oneTimeCodeField: boolean;
-}
-type WallKind = 
-/** the asked URL answered 401 or 403 */
-'status'
-/** landed on an identity provider's host */
- | 'idp'
-/** landed on a sign-in form or a sign-in path */
- | 'signin'
-/** sent somewhere else, with no sign-in in sight (a site that shows strangers a public page) */
- | 'redirect';
-interface WallVerdict {
-    kind: WallKind;
-    /**
-     * `hard` is refused always; `soft` is refused under `--strict` and said as
-     * a warning otherwise, because a redirect alone is not proof of a wall.
-     */
-    level: 'hard' | 'soft';
-    /** origin + path, never the query or hash (they can carry tokens). */
-    asked: string;
-    landed: string;
-    message: string;
-}
-
-interface FrameRec {
-    file: string;
-    /** ms since t0 */
-    tMs: number;
-}
-interface SkippedStep {
-    /** index into actions.steps */
-    step: number;
-    do: string;
-    selector: string;
-}
-/** A stretch with no screencast frames — the page pixels did not change. */
-interface FreezeSpan {
-    /** seconds into the take */
-    from: number;
-    to: number;
-    ms: number;
-}
-interface RecordResult {
-    events: CursorEvent[];
-    frames: FrameRec[];
-    meta: RecordingMeta;
-    /** The take's pace: what the script asked, what the gestures added, what the page cost. */
-    pace: PaceReport;
-    /** steps whose selector never became visible — the take continued without them. */
-    skipped: SkippedStep[];
-    /** the initial goto never reached networkidle (recording proceeded anyway). */
-    navTimeout: boolean;
-    /** A wall the caller let through; null when the recorder landed where it was asked. */
-    wall: WallVerdict | null;
-    /** Sensitive-looking text seen in the frame (kind + place, never the string). */
-    exposures: NonNullable<RecordingMeta['exposures']>;
-    /** The script's masks with how many elements each reached; hits 0 hid nothing. */
-    masks: NonNullable<RecordingMeta['masks']>;
-    /**
-     * Smoothness telemetry: stretches ≥400ms with no visual change. Frozen
-     * footage is the #1 enemy of a smooth product video — either the flow should
-     * keep motion in frame (animate, hover a preview, scroll) or the doc should
-     * trim/speed through these. freezePct = share of the take that is frozen.
-     */
-    freezes: FreezeSpan[];
-    freezePct: number;
-    /**
-     * The smoothness WARNING: still footage under a parked cursor past the
-     * beat it takes to read what changed, per step (`deadTime`). A still page
-     * being read is content; this is the part of a hold nobody is reading.
-     */
-    dead: DeadReport;
-    /** The take reached --max-duration and stopped there; later steps did not run. */
-    capped: boolean;
-}
-interface RecordOpts {
-    /** Stop the capture at this many seconds (the hosted cap). */
-    maxDurationSeconds?: number;
-    /**
-     * Path to a Playwright storage state (cookies + origin storage), so the
-     * recorder drives a SIGNED-IN product. A demo of anything behind a login
-     * needs it, and a sign-in form cannot always be scripted (an emailed code,
-     * an SSO hop). Export one from a real browser, or with
-     * `context.storageState({ path })`.
-     */
-    storageState?: string;
-    /**
-     * REHEARSE the flow: every step runs against the real page, in order,
-     * because a later selector usually exists only after an earlier click. But
-     * nothing is captured (no screencast, no frames), nothing is written, the
-     * pointer lands instead of travelling and every pause is cut to a beat, so
-     * a script that misses a selector says so in seconds instead of after a
-     * full real-time take and its encode. Selector lookups keep their whole
-     * timeout, so a miss here is a miss in the take.
-     */
-    dryRun?: boolean;
-    /**
-     * Called once the first navigation has settled, BEFORE a frame is captured.
-     * The caller judges the wall here and only then prepares the take
-     * directory, so a take refused at a sign-in never clears the footage a
-     * re-record would have replaced. A throw closes the context and propagates.
-     */
-    onArrival?: (arrival: Arrival) => Promise<WallVerdict | null | void> | WallVerdict | null | void;
-    /** Extra request headers on every request (`--header name=value`). */
-    headers?: Record<string, string>;
+type RecordOpts = Omit<RecordOpts$1, 'context' | 'env' | 'platform'> & {
     /**
      * A ready-made context to record IN, instead of one made from `browser`:
-     * `--session <name>`, a persistent profile the person signed in to. The
-     * recorder still sizes the viewport and closes it at the end.
+     * `--session <name>`, a persistent profile the person signed in to.
      */
     context?: BrowserContext;
-}
-declare function recordTake(browser: Browser, url: string, actions: ActionsFile, paths: TakePaths, log: (msg: string) => void, opts?: RecordOpts): Promise<RecordResult>;
+};
+declare function recordTake(browser: Browser, url: string, actions: ActionsFile, paths: TakePaths, log: (msg: string) => void, opts?: RecordOpts): Promise<_vosjs_render_core_record.RecordResult>;
 
 declare function encodeRecording(browser: Browser, takeDir: string, onProgress: (fraction: number) => void): Promise<{
     bytes: number;
@@ -869,4 +532,4 @@ interface VersionChange {
     summary?: string;
 }
 
-export { type ActionStep, type ActionsFile, type AgentBrowserRecord, BrowserUnavailableError, type ConvertOptions, type ConvertResult, type DigestOptions, type DigestResult, type LoadedConfig, RECORDING_NAME, type RenderAnimationOptions, type RenderAnimationResult, type RenderResult, type RenderStillOptions, type RenderTakeOptions, type RenderTakeResult, type RenderVideoOptions, type SyncState, type TakeData, type TakePaths, type TakeServer, type VersionChange, apiError, apiJson, configDuration, convertAgentBrowser, digestTake, encodeRecording, launchBrowser, loadTake, loadVosConfig, manifest, parseAgentBrowserLog, parseTranscript, parseVosId, planTake, platformOrigin, previewPages, pullMedia, readSyncState, recordTake, renderAnimation, renderStill, renderTake, renderVideo, resolveCredential, run, splitCommand, startTakeServer, takePaths, validateActions, waitForPageDone, writeSyncState };
+export { type AgentBrowserRecord, BrowserUnavailableError, type ConvertOptions, type ConvertResult, type DigestOptions, type DigestResult, type LoadedConfig, RECORDING_NAME, type RenderAnimationOptions, type RenderAnimationResult, type RenderResult, type RenderStillOptions, type RenderTakeOptions, type RenderTakeResult, type RenderVideoOptions, type SyncState, type TakeData, type TakePaths, type TakeServer, type VersionChange, apiError, apiJson, configDuration, convertAgentBrowser, digestTake, encodeRecording, launchBrowser, loadTake, loadVosConfig, manifest, parseAgentBrowserLog, parseTranscript, parseVosId, planTake, platformOrigin, previewPages, pullMedia, readSyncState, recordTake, renderAnimation, renderStill, renderTake, renderVideo, resolveCredential, run, splitCommand, startTakeServer, takePaths, waitForPageDone, writeSyncState };

package/dist/index.js

@@ -30,14 +30,14 @@ import {
   validateActions,
   waitForPageDone,
   writeSyncState
-} from "./chunk-ANKECV7F.js";
+} from "./chunk-TAWRT7UM.js";
 import {
   BrowserUnavailableError,
   configDuration,
   launchBrowser,
   loadVosConfig
 } from "./chunk-FACYY7VV.js";
-import "./chunk-AUPGJJTL.js";
+import "./chunk-72ADTMWW.js";
 import {
   manifest
 } from "./chunk-P3X5KVA6.js";

package/dist/{run-CYHH56KA.js → run-EQZXEPXZ.js}

@@ -5,9 +5,9 @@ import {
   run,
   takeBrowserArgs,
   verbHelp
-} from "./chunk-ANKECV7F.js";
+} from "./chunk-TAWRT7UM.js";
 import "./chunk-FACYY7VV.js";
-import "./chunk-AUPGJJTL.js";
+import "./chunk-72ADTMWW.js";
 export {
   HELP,
   MULTI_FLAGS,
@@ -15,4 +15,4 @@ export {
   takeBrowserArgs,
   verbHelp
 };
-//# sourceMappingURL=run-CYHH56KA.js.map
+//# sourceMappingURL=run-EQZXEPXZ.js.map

package/dist/{shotList-7F2FE3RU.js → shotList-IYFDHSIK.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   askedMs
-} from "./chunk-AUPGJJTL.js";
+} from "./chunk-72ADTMWW.js";
 
 // src/plugin/shotList.ts
 function sayTarget(selector) {
@@ -108,4 +108,4 @@ export {
   sayTarget,
   shotList
 };
-//# sourceMappingURL=shotList-7F2FE3RU.js.map
+//# sourceMappingURL=shotList-IYFDHSIK.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vosjs/cli",
-  "version": "0.48.0",
+  "version": "0.49.0",
   "description": "The vos CLI: record the real product from a scripted browser flow, auto-zoom from the cursor track, cut as data in doc.json, render deterministic video and stills, deliver a release's media per destination spec, and sync with vos.so. One binary, every verb, MIT.",
   "type": "module",
   "license": "MIT",
@@ -49,14 +49,14 @@
   "dependencies": {
     "mediabunny": "^1.55.7",
     "playwright": "^1.49.0",
-    "@vosjs/core": "^0.25.0",
     "@vosjs/editor": "^1.3.1",
+    "@vosjs/core": "^0.25.0",
+    "@vosjs/render-core": "^0.3.0",
     "@vosjs/elements": "^0.8.1",
-    "@vosjs/render-core": "^0.2.9",
     "@vosjs/shared": "^0.4.1",
     "@vosjs/studio-core": "^0.30.3",
-    "@vosjs/tween": "^0.8.2",
-    "@vosjs/timeline": "^0.4.1"
+    "@vosjs/timeline": "^0.4.1",
+    "@vosjs/tween": "^0.8.2"
   },
   "devDependencies": {
     "@types/node": "^22",