[AHB]

Summary

• Publish @spotify-confidence/privacy-review as a separate package for local recorder privacy checks.
• Add a floating control panel and a self-contained HTML replay file. Capture uses the recorder's masking and blocking options without creating a backend session or uploading events.
• Keep the viewer and panel out of the normal @spotify-confidence/session-recording package.

Usage

import { mountPrivacyReviewControls } from '@spotify-confidence/privacy-review';

mountPrivacyReviewControls({
  maskSelectors: ['.pii'],
  blockSelectors: ['.sensitive-widget'],
  maskInputs: true,
});

Use this on a temporary test page or local-only build, separate from normal session recording.

Verification

• Full CSR build and 252 CSR tests passed.
• CSR ESLint and TypeScript checks passed.
• Browser checks covered local replay, masking, control exclusion, and the download fallback under nonce CSP and Trusted Types enforcement.
• Verified that the normal session-recording publish artifact contains no privacy viewer files.

[nicklasl]

Did you consider if we should ship this as a separate package? then people can have it in their dev-deps...