@reportforge/playwright-pdf 0.0.1

package/CHANGELOG.md

@@ -0,0 +1,285 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
+
+## [0.0.1] — 2026-05-26
+
+### Changed
+
+- **Renamed npm package** from `pdf-report-forge` to `@reportforge/playwright-pdf` — moved to the `@reportforge` npm org scope to make room for `@reportforge/cypress` and future framework adapters. Update your project:
+  - `npm install @reportforge/playwright-pdf puppeteer-core`
+  - `reporter: [['@reportforge/playwright-pdf', { /* opts */ }]]`
+  - `import { defineReporterConfig } from '@reportforge/playwright-pdf'`
+
+---
+
+> **History note:** Entries below (`[1.4.3]` and earlier) document releases published under the previous package name `pdf-report-forge`. Feature set is identical at `[0.0.1]`.
+
+## [1.4.3] — 2026-05-14
+
+### Fixed
+
+- **Build scripts path regression.** All four `scripts/build/` bundlers (`bundle-chartjs`, `bundle-fonts`, `bundle-license-pubkey`, `precompile-templates`) resolved paths one directory too shallow after being moved from `scripts/` to `scripts/build/` in v1.4.2, breaking integration tests and the full build. Fixed `__dirname`-relative paths to correctly anchor to the repo root.
+- **PDF encryption password no longer visible in process argv.** The `pdfPassword` option now passes the encryption key to `qpdf` via a `--password-file` temp file (mode `0600`, deleted immediately after use) rather than as a positional command-line argument. Prevents the password appearing in `/proc/PID/cmdline` or `ps` output on shared runners. Requires `qpdf >= 10.2.0`.
+
+### Changed
+
+- **`LicenseClient` internals refactored** — `resolve()` decomposed into `_validateKey`, `_readCache`, and `_offlineFallback` helpers for clarity; no behaviour change.
+- **`PdfReporter.onEnd()` refactored** — extracted `_collectData`, `_appendTrend`, and `_buildReportData` methods; history write failures now logged as warnings instead of propagating.
+- **One-time KV migration cron removed** — `GET /api/cron/migrate-key-ttls` has completed its run; the route and cron entry are deleted. KV migration deadline dates updated to absolute dates in code comments.
+- **Docs and project layout** — build scripts relocated to `scripts/build/`, internal docs to `docs/internal/`, user docs to `docs/user/`. Server setup helper at `scripts/setup-server.ts`.
+
+## [1.4.2] — 2026-05-13
+
+### Changed
+
+- **Detailed template — trend chart redesign.** Replaced the two disconnected, unlabelled sparklines (pass-rate + duration) with a single, properly designed trend card:
+  - Smart y-axis range: pads only around actual data instead of a fixed 0–100 axis, so a 96% pass-rate run no longer renders as a flat line at the top of a near-empty canvas.
+  - Visible x-axis (formatted date labels) and y-axis (% gridlines with tick values).
+  - Data points colored by verdict (green = passed, orange = partial, red = failed).
+  - Inline data labels rendering the pass-rate % above each point.
+  - Gradient fill under the line.
+  - Run history table below the chart (date · colored pass-rate · test count · duration) replacing the meaningless colored-dot row.
+  - Delta badge ("↑ 2% vs previous run") in the card header.
+- **`ChartData.trend.entries` extended** — `timestamp` (unix ms) and `total` are now forwarded alongside `runId`, `passRate`, `duration`, and `verdict`, enabling the chart to display real dates and test counts without parsing the runId string.
+
+## [1.4.1] — 2026-05-13
+
+### Changed
+
+- **Docs: corrected USD pricing** — `$19/month` → `$12/month` and `$149/year` → `$99/year` in README and CHANGELOG. No code change.
+- **Docs: added CHANGELOG entry for v1.3.0** (test history trending) which was shipped but not recorded.
+
+## [1.4.0] — 2026-05-10
+
+### Changed
+
+- **Dev machine fingerprint — migration required.** The fingerprint for developer machines now uses a stable UUID persisted at `~/.reportforge/device.json` instead of the previous hostname + MAC address approach. This eliminates phantom seat consumption when running on VPN, Docker, or WSL2 (where MAC changes per session). **On upgrade, each dev machine will register as a new seat on first run.** The old seat will age out naturally within 30 days. Delete `~/.reportforge/device.json` to release the seat immediately if needed.
+
+- **Atomic machine seat management.** Machine slot registration is now enforced by a Lua script executed atomically in Redis, closing a race condition where two concurrent CI activations could both bypass the 25-seat cap or silently lose each other's seat entry.
+
+- **Atomic JWT cache write.** The license cache at `~/.reportforge/license.json` is now written via a temporary file + atomic rename, preventing cache corruption when multiple Playwright workers run in parallel.
+
+### Fixed
+
+- **Refund access revocation — late webhook bypass.** A delayed `subscription.pending` or `subscription.halted` Razorpay webhook arriving after a refund could re-activate the license key index and overwrite the subscription status, allowing a refunded customer to re-activate. The webhook handlers now guard against overwriting refund status.
+
+- **Refund key expiry — transient KV failure.** A transient KV read failure during Phase B of the refund flow could leave the license key permanently active despite a completed Razorpay refund. The TTL is now set unconditionally on refund success.
+
+## [1.3.0] — 2026-05-09
+
+### Added
+- **Test history trending** — the `detailed` template now renders a pass-rate sparkline and verdict row from a local run history file. Configure with `historyFile` (default `~/.reportforge/{key}/history.json`), `historySize` (default `10` entries), and `showTrend` (default `true`). In CI with ephemeral runners, set `historyFile` to a project-relative path and cache it between runs.
+  ```ts
+  reporter: [['pdf-report-forge', {
+    template: 'detailed',
+    historyFile: '.reportforge/history.json',
+    historySize: 10,
+  }]]
+  ```
+  The history file is local — it is never sent to the licensing server.
+
+## [1.2.16] — 2026-05-02
+
+### Added
+- **Webhook notifications** — post pass/fail summaries to Slack, Teams, or Discord after each run.
+  Configure per channel with `url`, `enabled: true`, and `on: 'always' | 'failure' | 'success'`.
+  ```ts
+  notify: {
+    slack: { url: process.env.SLACK_WEBHOOK_URL, enabled: true, on: 'failure' },
+  }
+  ```
+  Notifications fire after PDF generation (even if PDF fails). Requires a valid license.
+
+## [1.2.15] — 2026-05-01
+
+### Added
+- **Shard merging** — configure `shardResults` in the reporter options with paths or glob patterns
+  pointing at Playwright JSON shard files to produce a single merged PDF covering all shards.
+  ```ts
+  // playwright.config.ts
+  reporter: [['pdf-report-forge', { shardResults: 'results/shard-*.json' }]]
+  ```
+
+## [1.2.14] — 2026-05-01
+
+### Added
+- **`logger.debug()`** — new debug method on the internal logger, gated on `RF_DEBUG=1`. Logs license cache-hits, network responses, and POST requests with non-sensitive metadata (sha256 fingerprint hashes, expiry timestamps, machine counts). No license key values are logged.
+- **Trial countdown badge** — subscription dashboard now shows a colour-coded days-left badge during trial periods (`text-red-600` ≤1d, `text-orange-500` ≤3d, `text-terracotta-600` otherwise).
+
+### Fixed
+- **`open: true` error surfacing** — `openPdf()` now checks file existence before spawning the OS viewer and emits a `logger.warn` if the PDF is not found. Spawn errors on Linux/macOS (e.g. `xdg-open` not installed) are also surfaced via `logger.warn`.
+
+## [1.2.13] — 2026-05-01
+
+### Changed
+- **README** — added `defineReporterConfig` to Quick Start example; prominent badge CTA for the free trial; license note converted to blockquote.
+- **CHANGELOG** — backfilled entries for v1.2.4 – v1.2.12.
+
+## [1.2.12] — 2026-05-01
+
+### Fixed
+- **Stable machine fingerprint across VPN / Docker / WSL** — `os.networkInterfaces()` enumeration order is not stable across network-state changes on Windows. The MAC selection now sorts interface names and prefers physical adapters (Ethernet, Wi-Fi) over virtual ones (vethernet, Docker, WSL, VPN tap). Same physical machine always produces the same fingerprint hash regardless of which virtual adapters are active.
+
+## [1.2.11] — 2026-05-01
+
+### Added
+- **`defineReporterConfig` helper** — typed identity function exported from `pdf-report-forge`. Wrap your reporter options object with it in `playwright.config.ts` to get full IntelliSense and type checking without a separate import of `ReporterOptions`.
+
+### Fixed
+- **Server: silent email failures surfaced** — Resend SDK v3 changed from throwing to returning `{ data, error }`. All four send paths now check the error field and throw, so failures appear in logs and trigger Razorpay webhook retries.
+- **Server: Razorpay customer-fetch errors now logged** — `resolveCustomerEmail` was catching all errors silently. Errors now emit a `webhook.customer_fetch_failed` log entry with the customer ID and error message.
+
+## [1.2.10] — 2026-04-30
+
+### Fixed
+- **Server: accept raw base64 DER keys** — `LICENSE_SIGNING_PRIVATE_KEY` / `LICENSE_SIGNING_PUBLIC_KEY` can now be pasted into Vercel as raw base64-encoded DER (no PEM headers required). The server auto-detects the format and constructs the correct `KeyObject`.
+- **Server: strip surrounding quotes from PEM env vars** — Vercel UI sometimes wraps values in quotes; the key parser now trims them before attempting PEM or DER decode.
+
+## [1.2.9] — 2026-04-30
+
+### Fixed
+- **Windows libuv teardown crash** (`Assertion failed: !(handle->flags & UV_HANDLE_CLOSING)`) — a 5xx response body left open across Playwright's async teardown kept a libuv handle alive. The 5xx path now drains and cancels the response body before throwing.
+- **PEM env var newlines normalised** — `\n` literal sequences in Vercel / CI env vars are expanded to real newlines before passing to `createPrivateKey`.
+
+## [1.2.8] — 2026-04-29
+
+### Changed
+- Added `beta` dist-tag support to the publish pipeline so pre-release builds can be installed with `npm install pdf-report-forge@beta` without affecting the `latest` tag.
+
+## [1.2.7] — 2026-04-29
+
+### Fixed
+- **Windows libuv teardown crash (definitive fix)** — v1.2.6 used `AbortSignal.timeout()` to cancel the license fetch, but `AbortSignal.timeout()` internally schedules a timer that keeps Node's event loop alive through Playwright's async teardown, recreating the same `UV_HANDLE_CLOSING` assertion. Reverted to `AbortController` + explicit `clearTimeout` with eager `controller.abort()` in a `finally` block, which is safe across all Node versions and teardown paths.
+
+## [1.2.6] — 2026-04-29
+
+### Fixed
+- **JWT signature validation now clears the cache** — a stale cached JWT with an invalid signature previously fell through to a misleading "unreachable" log path and silently kept the bad token. The validation path now clears the cache on any signature mismatch and surfaces a clear error.
+- **Misleading "unreachable" log warning** removed from the license refresh path.
+- **Windows libuv teardown crash (initial fix via `AbortSignal.timeout()`)** — see v1.2.7 for the definitive approach.
+
+## [1.2.5] — 2026-04-29
+
+### Fixed
+- **`RF_LICENSE_KEY` full-assignment paste** — if a user accidentally pastes the full shell assignment (`RF_LICENSE_KEY=RFSU-…`) as the env value, the reporter now strips the `RF_LICENSE_KEY=` prefix and uses the key value correctly.
+
+## [1.2.4] — 2026-04-29
+
+### Fixed
+- **License key env var empty-string fallback** — an empty `RF_LICENSE_KEY=""` was treated as a set key, bypassing the "no key" path and sending an empty string to the server. Empty strings are now treated as unset.
+
+## [1.2.3] — 2026-04-28
+
+### Changed
+- **Removed postinstall script entirely.** `npm install` runs no lifecycle hook. License validation happens at test-run time only — the reporter logs a warning and skips PDF generation if no valid key is found. No behaviour change for users with `RF_LICENSE_KEY` set.
+
+## [1.2.2] — 2026-04-28
+
+### Fixed
+- **Package size reduced by 57%** — source maps (`dist/*.map`) are no longer published. Packed size: 648 KB (was 1.4 MB). Unpacked: 1.7 MB (was 4.2 MB). No runtime behaviour change.
+
+## [1.2.1] — 2026-04-28
+
+### Fixed
+- **postinstall no longer fails `npm install`** on Windows (and non-TTY environments). Removed the interactive prompt and TTY gate; postinstall now prints a one-line notice and exits 0 unconditionally. License enforcement is unchanged — the reporter itself checks at test-run time.
+
+## [1.2.0] — 2026-04-28
+
+### Added
+- **Multi-template output** — `template` now accepts `TemplateId | TemplateId[]`. Pass an array to generate one PDF per template in a single run. The template name is automatically appended to the output filename (e.g. `report-detailed.pdf`, `report-executive.pdf`). One license check, one data-collection pass. Single-element arrays produce the same output as a plain string (no suffix). Duplicate entries are silently deduplicated.
+
+## [Unreleased]
+
+### Changed (BREAKING)
+- **Renamed npm package** from `playwright-pdf-reporter` to `pdf-report-forge` — the bare name was already taken on npm. Update install commands and reporter array entries:
+  - `npm install pdf-report-forge puppeteer-core`
+  - `reporter: [['pdf-report-forge', { /* opts */ }]]`
+- Log prefix changed from `[playwright-pdf-reporter]` to `[reportforge]` to match the new brand-aligned identity. Update any CI grep filters accordingly.
+- PDF footer text changed from "Generated by playwright-pdf-reporter" to "Generated by ReportForge" across all three templates.
+- **Removed the free tier.** A valid subscription is now required to generate any PDF; the reporter logs a single warning and skips PDF generation when no license is available (no key, invalid key, expired sub, denied by server, or offline with no cache). Playwright tests still run normally — only the PDF artifact is missing.
+- `LicenseClient.resolve()` now returns `LicenseInfo | null` (was `LicenseInfo` always); deleted `FREE_LICENSE` constant.
+- `LicensePlan` type narrowed to `'subscription'` only (was `'free' | 'subscription'`).
+- Deleted `FeatureGate` and the `showCommunityBadge` plumbing — every feature is available with a valid license, none with an invalid one.
+- 4xx denial path no longer leaks the just-cleared cache through the offline fallback.
+
+### Marketing
+- Pricing page, homepage, and dashboards now sell a single subscription plan with a 7-day free trial. Removed all "Free forever" surfaces.
+
+## [1.0.0] — 2026-04-21
+
+First public release. Subscription model replaces the former one-time tiers.
+(Note: this release still shipped a free tier on the marketing site; that was
+removed in the unreleased breaking change above.)
+
+### Added
+- Subscription licensing: **$19/mo** or **$149/yr** (~35% savings), 7-day free trial with no card.
+- Hybrid offline-first activation — short `RFSU-…` handoff key exchanges for an Ed25519-signed JWT cached at `~/.reportforge/license.json`. Subsequent runs verify the JWT locally with a bundled public key, so reports render with no network access.
+- Automatic JWT refresh in the background when the cache has < 24h remaining.
+- **25-machine** sliding 30-day cap per subscription, enforced by a stable hash of `(provider:repo)` in CI or `(hostname:mac)` on dev machines. Stale machines auto-prune after 30 days.
+- Customer self-service portal (cancel, switch plan, update card) via Stripe Customer Portal.
+- Claude design refresh across all three templates: cream `#FAF9F5` canvases, Source Serif Pro headings, Inter body, JetBrains Mono code, terracotta primary `#CC785C`, forest accent `#3F7D58`.
+- Fonts (Source Serif Pro, Inter, JetBrains Mono) bundled into the PDF — no web font fetch at render time.
+- Bulk-run performance: 1 500-test report renders to ~0.65 MB (was ~10.4 MB).
+
+### Changed
+- Default `primaryColor` → `#CC785C`, `accentColor` → `#3F7D58` (matches the shipped templates).
+- Default `maxFileSizeMb` → `8` (was `12`). The bulk-test floor now comfortably fits under the new cap after the design refresh.
+- Pricing structure: two subscription prices (monthly / yearly) replace the former three-tier matrix.
+- CI builds now fail hard if `LICENSE_SIGNING_PUBLIC_KEY` is unset, preventing the publish of an artifact that would silently downgrade paying customers to the free tier.
+
+### Removed
+- One-time license tiers Professional (`RFPR-…`, $199/yr) and Enterprise (`RFEN-…`, $999/yr).
+- CLI generation of legacy `RFPR-`/`RFEN-` keys from `scripts/generate-license.ts`.
+- Standalone token-management dashboard (`/dashboard/tokens`, `/api/tokens/…`) — superseded by the subscription dashboard at `/dashboard`.
+
+### Migration
+No existing customers — clean cutover. New installs get the subscription flow.
+
+## [0.1.0] — 2026-04-13
+
+### Added
+- Initial release of `pdf-report-forge`
+- Three configurable report templates: `minimal`, `detailed`, `executive`
+- Sections: Executive Summary + KPIs, Suite Breakdown, Failure Deep-Dive, CI/CD & Environment
+- Embedded Chart.js charts (doughnut pass-rate, bar suite results) in `detailed` and `executive` templates
+- Screenshot embedding — failures with screenshots are embedded inline (base64) in the PDF
+- Requirements traceability matrix built from test tags in `detailed` template
+- Defect log table in `detailed` template
+- Cover page with verdict in `executive` template
+- Custom branding: `logo`, `primaryColor`, `accentColor`
+- Dynamic output filename tokens: `{date}`, `{branch}`, `{status}`
+- Watermark overlay support
+- PDF password encryption via `qpdf` integration
+- Offline HMAC-based license key validation
+- License tiers: Free (no key), Professional (`RFPR-`), Enterprise (`RFEN-`)
+- CI/CD integration templates: GitHub Actions (basic + sharded), Jenkins, GitLab CI, Azure DevOps
+- Reusable GitHub composite Action in `.github/actions/playwright-pdf-report/`
+- Auto Chrome/Chromium discovery via `chrome-finder` + common system paths
+- Full TypeScript support with exported types
+
+[Unreleased]: https://github.com/muralidharan92/reportforge/compare/v1.4.1...HEAD
+[1.4.1]: https://github.com/muralidharan92/reportforge/compare/v1.4.0...v1.4.1
+[1.4.0]: https://github.com/muralidharan92/reportforge/compare/v1.3.0...v1.4.0
+[1.3.0]: https://github.com/muralidharan92/reportforge/compare/v1.2.16...v1.3.0
+[1.2.16]: https://github.com/muralidharan92/reportforge/compare/v1.2.15...v1.2.16
+[1.2.15]: https://github.com/muralidharan92/reportforge/compare/v1.2.14...v1.2.15
+[1.2.14]: https://github.com/muralidharan92/reportforge/compare/v1.2.13...v1.2.14
+[1.2.13]: https://github.com/muralidharan92/reportforge/compare/v1.2.12...v1.2.13
+[1.2.12]: https://github.com/muralidharan92/reportforge/compare/v1.2.11...v1.2.12
+[1.2.11]: https://github.com/muralidharan92/reportforge/compare/v1.2.10...v1.2.11
+[1.2.10]: https://github.com/muralidharan92/reportforge/compare/v1.2.9...v1.2.10
+[1.2.9]: https://github.com/muralidharan92/reportforge/compare/v1.2.8...v1.2.9
+[1.2.8]: https://github.com/muralidharan92/reportforge/compare/v1.2.7...v1.2.8
+[1.2.7]: https://github.com/muralidharan92/reportforge/compare/v1.2.6...v1.2.7
+[1.2.6]: https://github.com/muralidharan92/reportforge/compare/v1.2.5...v1.2.6
+[1.2.5]: https://github.com/muralidharan92/reportforge/compare/v1.2.4...v1.2.5
+[1.2.4]: https://github.com/muralidharan92/reportforge/compare/v1.2.3...v1.2.4
+[1.2.3]: https://github.com/muralidharan92/reportforge/compare/v1.2.2...v1.2.3
+[1.2.2]: https://github.com/muralidharan92/reportforge/compare/v1.2.1...v1.2.2
+[1.2.1]: https://github.com/muralidharan92/reportforge/compare/v1.2.0...v1.2.1
+[1.2.0]: https://github.com/muralidharan92/reportforge/compare/v1.1.0...v1.2.0
+[1.1.0]: https://github.com/muralidharan92/reportforge/compare/v1.0.0...v1.1.0
+[1.0.0]: https://github.com/muralidharan92/reportforge/releases/tag/v1.0.0
+[0.1.0]: https://github.com/muralidharan92/reportforge/releases/tag/v0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ReportForge
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.