@reportforge/playwright-pdf 0.22.0 → 0.23.0

package/dist/cli/index.js

@@ -1588,13 +1588,13 @@ var require_ast = __commonJS({
         helperExpression: function helperExpression(node) {
           return node.type === "SubExpression" || (node.type === "MustacheStatement" || node.type === "BlockStatement") && !!(node.params && node.params.length || node.hash);
         },
-        scopedId: function scopedId(path14) {
-          return /^\.|this\b/.test(path14.original);
+        scopedId: function scopedId(path13) {
+          return /^\.|this\b/.test(path13.original);
         },
         // an ID is simple if it only has one part, and that part is not
         // `..` or `this`.
-        simpleId: function simpleId(path14) {
-          return path14.parts.length === 1 && !AST.helpers.scopedId(path14) && !path14.depth;
+        simpleId: function simpleId(path13) {
+          return path13.parts.length === 1 && !AST.helpers.scopedId(path13) && !path13.depth;
         }
       }
     };
@@ -2668,12 +2668,12 @@ var require_helpers2 = __commonJS({
         loc
       };
     }
-    function prepareMustache(path14, params, hash, open, strip, locInfo) {
+    function prepareMustache(path13, params, hash, open, strip, locInfo) {
       var escapeFlag = open.charAt(3) || open.charAt(2), escaped = escapeFlag !== "{" && escapeFlag !== "&";
       var decorator = /\*/.test(open);
       return {
         type: decorator ? "Decorator" : "MustacheStatement",
-        path: path14,
+        path: path13,
         params,
         hash,
         escaped,
@@ -2993,9 +2993,9 @@ var require_compiler = __commonJS({
       },
       DecoratorBlock: function DecoratorBlock(decorator) {
         var program = decorator.program && this.compileProgram(decorator.program);
-        var params = this.setupFullMustacheParams(decorator, program, void 0), path14 = decorator.path;
+        var params = this.setupFullMustacheParams(decorator, program, void 0), path13 = decorator.path;
         this.useDecorators = true;
-        this.opcode("registerDecorator", params.length, path14.original);
+        this.opcode("registerDecorator", params.length, path13.original);
       },
       PartialStatement: function PartialStatement(partial) {
         this.usePartial = true;
@@ -3059,46 +3059,46 @@ var require_compiler = __commonJS({
         }
       },
       ambiguousSexpr: function ambiguousSexpr(sexpr, program, inverse) {
-        var path14 = sexpr.path, name = path14.parts[0], isBlock = program != null || inverse != null;
-        this.opcode("getContext", path14.depth);
+        var path13 = sexpr.path, name = path13.parts[0], isBlock = program != null || inverse != null;
+        this.opcode("getContext", path13.depth);
         this.opcode("pushProgram", program);
         this.opcode("pushProgram", inverse);
-        path14.strict = true;
-        this.accept(path14);
+        path13.strict = true;
+        this.accept(path13);
         this.opcode("invokeAmbiguous", name, isBlock);
       },
       simpleSexpr: function simpleSexpr(sexpr) {
-        var path14 = sexpr.path;
-        path14.strict = true;
-        this.accept(path14);
+        var path13 = sexpr.path;
+        path13.strict = true;
+        this.accept(path13);
         this.opcode("resolvePossibleLambda");
       },
       helperSexpr: function helperSexpr(sexpr, program, inverse) {
-        var params = this.setupFullMustacheParams(sexpr, program, inverse), path14 = sexpr.path, name = path14.parts[0];
+        var params = this.setupFullMustacheParams(sexpr, program, inverse), path13 = sexpr.path, name = path13.parts[0];
         if (this.options.knownHelpers[name]) {
           this.opcode("invokeKnownHelper", params.length, name);
         } else if (this.options.knownHelpersOnly) {
           throw new _exception2["default"]("You specified knownHelpersOnly, but used the unknown helper " + name, sexpr);
         } else {
-          path14.strict = true;
-          path14.falsy = true;
-          this.accept(path14);
-          this.opcode("invokeHelper", params.length, path14.original, _ast2["default"].helpers.simpleId(path14));
+          path13.strict = true;
+          path13.falsy = true;
+          this.accept(path13);
+          this.opcode("invokeHelper", params.length, path13.original, _ast2["default"].helpers.simpleId(path13));
         }
       },
-      PathExpression: function PathExpression(path14) {
-        this.addDepth(path14.depth);
-        this.opcode("getContext", path14.depth);
-        var name = path14.parts[0], scoped = _ast2["default"].helpers.scopedId(path14), blockParamId = !path14.depth && !scoped && this.blockParamIndex(name);
+      PathExpression: function PathExpression(path13) {
+        this.addDepth(path13.depth);
+        this.opcode("getContext", path13.depth);
+        var name = path13.parts[0], scoped = _ast2["default"].helpers.scopedId(path13), blockParamId = !path13.depth && !scoped && this.blockParamIndex(name);
         if (blockParamId) {
-          this.opcode("lookupBlockParam", blockParamId, path14.parts);
+          this.opcode("lookupBlockParam", blockParamId, path13.parts);
         } else if (!name) {
           this.opcode("pushContext");
-        } else if (path14.data) {
+        } else if (path13.data) {
           this.options.data = true;
-          this.opcode("lookupData", path14.depth, path14.parts, path14.strict);
+          this.opcode("lookupData", path13.depth, path13.parts, path13.strict);
         } else {
-          this.opcode("lookupOnContext", path14.parts, path14.falsy, path14.strict, scoped);
+          this.opcode("lookupOnContext", path13.parts, path13.falsy, path13.strict, scoped);
         }
       },
       StringLiteral: function StringLiteral(string) {
@@ -3454,16 +3454,16 @@ var require_util = __commonJS({
     }
     exports2.urlGenerate = urlGenerate;
     function normalize(aPath) {
-      var path14 = aPath;
+      var path13 = aPath;
       var url = urlParse(aPath);
       if (url) {
         if (!url.path) {
           return aPath;
         }
-        path14 = url.path;
+        path13 = url.path;
       }
-      var isAbsolute = exports2.isAbsolute(path14);
-      var parts = path14.split(/\/+/);
+      var isAbsolute = exports2.isAbsolute(path13);
+      var parts = path13.split(/\/+/);
       for (var part, up = 0, i = parts.length - 1; i >= 0; i--) {
         part = parts[i];
         if (part === ".") {
@@ -3480,15 +3480,15 @@ var require_util = __commonJS({
           }
         }
       }
-      path14 = parts.join("/");
-      if (path14 === "") {
-        path14 = isAbsolute ? "/" : ".";
+      path13 = parts.join("/");
+      if (path13 === "") {
+        path13 = isAbsolute ? "/" : ".";
       }
       if (url) {
-        url.path = path14;
+        url.path = path13;
         return urlGenerate(url);
       }
-      return path14;
+      return path13;
     }
     exports2.normalize = normalize;
     function join(aRoot, aPath) {
@@ -6291,8 +6291,8 @@ var require_printer = __commonJS({
       return this.accept(sexpr.path) + " " + params + hash;
     };
     PrintVisitor.prototype.PathExpression = function(id) {
-      var path14 = id.parts.join("/");
-      return (id.data ? "@" : "") + "PATH:" + path14;
+      var path13 = id.parts.join("/");
+      return (id.data ? "@" : "") + "PATH:" + path13;
     };
     PrintVisitor.prototype.StringLiteral = function(string) {
       return '"' + string.value + '"';
@@ -6333,8 +6333,8 @@ var require_lib = __commonJS({
     handlebars.print = printer.print;
     module2.exports = handlebars;
     function extension(module3, filename) {
-      var fs14 = require("fs");
-      var templateString = fs14.readFileSync(filename, "utf8");
+      var fs15 = require("fs");
+      var templateString = fs15.readFileSync(filename, "utf8");
       module3.exports = handlebars.compile(templateString);
     }
     if (typeof require !== "undefined" && require.extensions) {
@@ -7005,7 +7005,7 @@ var require_util2 = __commonJS({
   "node_modules/chrome-finder/lib/util.js"(exports2, module2) {
     "use strict";
     init_cjs_shims();
-    var fs14 = require("fs");
+    var fs15 = require("fs");
     var newLineRegex = /\r?\n/;
     function sort(installations, priorities) {
       const defaultPriority = 10;
@@ -7023,7 +7023,7 @@ var require_util2 = __commonJS({
         return false;
       }
       try {
-        fs14.accessSync(file);
+        fs15.accessSync(file);
         return true;
       } catch (e) {
         return false;
@@ -7034,7 +7034,7 @@ var require_util2 = __commonJS({
         return false;
       }
       try {
-        var stat = fs14.statSync(file);
+        var stat = fs15.statSync(file);
         return stat && typeof stat.isFile === "function" && stat.isFile();
       } catch (e) {
         return false;
@@ -7054,7 +7054,7 @@ var require_win32 = __commonJS({
   "node_modules/chrome-finder/lib/win32.js"(exports2, module2) {
     "use strict";
     init_cjs_shims();
-    var path14 = require("path");
+    var path13 = require("path");
     var { canAccess } = require_util2();
     function win32() {
       const installations = [];
@@ -7068,7 +7068,7 @@ var require_win32 = __commonJS({
       const prefixes = [process.env.LOCALAPPDATA, process.env.PROGRAMFILES, process.env["PROGRAMFILES(X86)"]];
       prefixes.forEach((prefix) => suffixes.forEach((suffix) => {
         if (prefix) {
-          const chromePath = path14.join(prefix, suffix);
+          const chromePath = path13.join(prefix, suffix);
           if (canAccess(chromePath)) {
             installations.push(chromePath);
           }
@@ -7086,7 +7086,7 @@ var require_darwin = __commonJS({
     "use strict";
     init_cjs_shims();
     var { execSync: execSync2 } = require("child_process");
-    var path14 = require("path");
+    var path13 = require("path");
     var { canAccess, newLineRegex, sort } = require_util2();
     function darwin() {
       const suffixes = ["/Contents/MacOS/Google Chrome Canary", "/Contents/MacOS/Google Chrome", "/Contents/MacOS/Chromium"];
@@ -7096,7 +7096,7 @@ var require_darwin = __commonJS({
     ${LSREGISTER} -dump | grep -E -i -o '/.+(google chrome( canary)?|chromium)\\.app(\\s|$)' | grep -E -v 'Caches|TimeMachine|Temporary|/Volumes|\\.Trash'
   `).toString().split(newLineRegex).forEach((inst) => {
         suffixes.forEach((suffix) => {
-          const execPath = path14.join(inst.trim(), suffix);
+          const execPath = path13.join(inst.trim(), suffix);
           if (canAccess(execPath)) {
             installations.push(execPath);
           }
@@ -7124,9 +7124,9 @@ var require_linux = __commonJS({
   "node_modules/chrome-finder/lib/linux.js"(exports2, module2) {
     "use strict";
     init_cjs_shims();
-    var { execSync: execSync2, execFileSync: execFileSync2 } = require("child_process");
-    var path14 = require("path");
-    var fs14 = require("fs");
+    var { execSync: execSync2, execFileSync } = require("child_process");
+    var path13 = require("path");
+    var fs15 = require("fs");
     var { canAccess, sort, isExecutable, newLineRegex } = require_util2();
     function findChromeExecutablesForLinuxDesktop(folder) {
       const argumentsRegex = /(^[^ ]+).*/;
@@ -7143,7 +7143,7 @@ var require_linux = __commonJS({
     function linux() {
       let installations = [];
       const desktopInstallationFolders = [
-        path14.join(require("os").homedir(), ".local/share/applications/"),
+        path13.join(require("os").homedir(), ".local/share/applications/"),
         "/usr/share/applications/"
       ];
       desktopInstallationFolders.forEach((folder) => {
@@ -7169,7 +7169,7 @@ var require_linux = __commonJS({
         ].map((possiblePath) => {
           try {
             const chromePathToTest = possiblePath + "/" + executable;
-            if (fs14.existsSync(chromePathToTest) && canAccess(chromePathToTest) && isExecutable(chromePathToTest)) {
+            if (fs15.existsSync(chromePathToTest) && canAccess(chromePathToTest) && isExecutable(chromePathToTest)) {
               installations.push(chromePathToTest);
               return chromePathToTest;
             }
@@ -7181,7 +7181,7 @@ var require_linux = __commonJS({
           return;
         }
         try {
-          const chromePath = execFileSync2("which", [executable]).toString().split(newLineRegex)[0];
+          const chromePath = execFileSync("which", [executable]).toString().split(newLineRegex)[0];
           if (canAccess(chromePath)) {
             installations.push(chromePath);
           }
@@ -7384,48 +7384,37 @@ var init_ChartRenderer = __esm({
 });
 
 // src/pdf/PdfEncryptor.ts
-var import_child_process2, import_fs5, import_path3, import_os2, import_crypto2, PdfEncryptor;
+var import_fs5, import_pdf_lib, AES256_HEADER_MINOR, PdfEncryptor;
 var init_PdfEncryptor = __esm({
   "src/pdf/PdfEncryptor.ts"() {
     "use strict";
     init_cjs_shims();
-    import_child_process2 = require("child_process");
     import_fs5 = __toESM(require("fs"));
-    import_path3 = __toESM(require("path"));
-    import_os2 = __toESM(require("os"));
-    import_crypto2 = __toESM(require("crypto"));
+    import_pdf_lib = require("@cantoo/pdf-lib");
     init_logger();
+    AES256_HEADER_MINOR = "7ext3";
     PdfEncryptor = class {
       async encrypt(pdfPath, password) {
         if (!password) return;
-        if (!this.isQpdfAvailable()) {
-          logger.warn(
-            "pdfPassword is set but qpdf is not installed \u2014 PDF will NOT be encrypted. Install qpdf: https://qpdf.readthedocs.io/en/stable/installation.html"
-          );
-          return;
-        }
-        const tmpPath = import_path3.default.join(import_os2.default.tmpdir(), `rf-encrypted-${Date.now()}.pdf`);
-        const argFile = import_path3.default.join(import_os2.default.tmpdir(), `rf-qpdf-args-${import_crypto2.default.randomBytes(8).toString("hex")}`);
         try {
-          const args = ["--encrypt", password, password, "256", "--", pdfPath, tmpPath];
-          import_fs5.default.writeFileSync(argFile, args.join("\n"), { mode: 384 });
-          (0, import_child_process2.execFileSync)("qpdf", [`@${argFile}`], { stdio: "pipe" });
-          import_fs5.default.renameSync(tmpPath, pdfPath);
-          logger.info(`PDF encrypted with password.`);
+          const doc = await import_pdf_lib.PDFDocument.load(await import_fs5.default.promises.readFile(pdfPath));
+          doc.context.header = import_pdf_lib.PDFHeader.forVersion(1, AES256_HEADER_MINOR);
+          doc.encrypt({
+            userPassword: password,
+            ownerPassword: password,
+            permissions: { printing: "highResolution", copying: false, modifying: false }
+          });
+          const encryptedBytes = await doc.save();
+          const tmpPath = `${pdfPath}.rf-enc-tmp`;
+          try {
+            await import_fs5.default.promises.writeFile(tmpPath, encryptedBytes);
+            await import_fs5.default.promises.rename(tmpPath, pdfPath);
+          } finally {
+            import_fs5.default.rmSync(tmpPath, { force: true });
+          }
+          logger.info("PDF encrypted with password (AES-256).");
         } catch (e) {
-          throw new Error(`qpdf encryption failed: ${e.message}`);
-        } finally {
-          if (import_fs5.default.existsSync(tmpPath)) import_fs5.default.unlinkSync(tmpPath);
-          import_fs5.default.rmSync(argFile, { force: true });
-        }
-      }
-      isQpdfAvailable() {
-        try {
-          (0, import_child_process2.execFileSync)("qpdf", ["--version"], { stdio: "pipe" });
-          return true;
-        } catch (err) {
-          logger.debug("qpdf probe failed \u2014 treating as not installed", { error: err.message });
-          return false;
+          throw new Error(`PDF encryption failed: ${e.message}`);
         }
       }
     };
@@ -7433,12 +7422,12 @@ var init_PdfEncryptor = __esm({
 });
 
 // src/filename/FilenameResolver.ts
-var import_path4, import_fs6, MAX_BRANCH_LENGTH, FilenameResolver;
+var import_path3, import_fs6, MAX_BRANCH_LENGTH, FilenameResolver;
 var init_FilenameResolver = __esm({
   "src/filename/FilenameResolver.ts"() {
     "use strict";
     init_cjs_shims();
-    import_path4 = __toESM(require("path"));
+    import_path3 = __toESM(require("path"));
     import_fs6 = __toESM(require("fs"));
     MAX_BRANCH_LENGTH = 50;
     FilenameResolver = class {
@@ -7456,8 +7445,8 @@ var init_FilenameResolver = __esm({
         const branch = this.sanitiseBranch(ctx.branch);
         const status = ctx.status;
         const resolved = template.replace(/\{date\}/g, date).replace(/\{branch\}/g, branch).replace(/\{status\}/g, status);
-        const absolute = import_path4.default.isAbsolute(resolved) ? resolved : import_path4.default.resolve(process.cwd(), resolved);
-        import_fs6.default.mkdirSync(import_path4.default.dirname(absolute), { recursive: true });
+        const absolute = import_path3.default.isAbsolute(resolved) ? resolved : import_path3.default.resolve(process.cwd(), resolved);
+        import_fs6.default.mkdirSync(import_path3.default.dirname(absolute), { recursive: true });
         return absolute;
       }
       /**
@@ -7469,7 +7458,7 @@ var init_FilenameResolver = __esm({
        * // → '/out/2026-report-executive.pdf'
        */
       injectTemplateSuffix(outputPath, suffix) {
-        const ext = import_path4.default.extname(outputPath);
+        const ext = import_path3.default.extname(outputPath);
         const base = outputPath.slice(0, outputPath.length - ext.length);
         return `${base}-${suffix}${ext}`;
       }
@@ -7534,13 +7523,18 @@ var init_compression = __esm({
 });
 
 // src/pdf/FailurePaginator.ts
-var import_fs7, import_path5, FailurePaginator;
+function sidecarPathFor(pdfPath) {
+  const dir = import_path4.default.dirname(pdfPath);
+  const base = import_path4.default.basename(pdfPath, import_path4.default.extname(pdfPath));
+  return import_path4.default.join(dir, `${base}-failures.json`);
+}
+var import_fs7, import_path4, FailurePaginator;
 var init_FailurePaginator = __esm({
   "src/pdf/FailurePaginator.ts"() {
     "use strict";
     init_cjs_shims();
     import_fs7 = __toESM(require("fs"));
-    import_path5 = __toESM(require("path"));
+    import_path4 = __toESM(require("path"));
     init_logger();
     FailurePaginator = class {
       async paginate(failures, maxInline, pdfOutputPath) {
@@ -7549,7 +7543,7 @@ var init_FailurePaginator = __esm({
         }
         const inline = failures.slice(0, maxInline);
         const overflow = failures.slice(maxInline);
-        const sidecarPath = this.sidecarPathFor(pdfOutputPath);
+        const sidecarPath = sidecarPathFor(pdfOutputPath);
         try {
           await import_fs7.default.promises.writeFile(
             sidecarPath,
@@ -7557,7 +7551,7 @@ var init_FailurePaginator = __esm({
             "utf8"
           );
           logger.info(
-            `Emitted ${overflow.length} overflow failures \u2192 ${import_path5.default.basename(sidecarPath)}`
+            `Emitted ${overflow.length} overflow failures \u2192 ${import_path4.default.basename(sidecarPath)}`
           );
         } catch (e) {
           logger.warn(`Could not write failure sidecar: ${e.message}`);
@@ -7565,11 +7559,6 @@ var init_FailurePaginator = __esm({
         }
         return { inline, overflowCount: overflow.length, sidecarPath };
       }
-      sidecarPathFor(pdfPath) {
-        const dir = import_path5.default.dirname(pdfPath);
-        const base = import_path5.default.basename(pdfPath, import_path5.default.extname(pdfPath));
-        return import_path5.default.join(dir, `${base}-failures.json`);
-      }
       /**
        * Drops the inlined image bytes — a 150-entry overflow would otherwise
        * produce a 40 MB JSON. The path still references the on-disk screenshot
@@ -7586,6 +7575,41 @@ var init_FailurePaginator = __esm({
   }
 });
 
+// src/pdf/sidecar-crypto.ts
+function encryptSidecar(plain, password) {
+  const salt = import_crypto2.default.randomBytes(SALT_LEN);
+  const key = import_crypto2.default.scryptSync(password, salt, 32, { N: 16384, r: 8, p: 1 });
+  const iv = import_crypto2.default.randomBytes(IV_LEN);
+  const cipher = import_crypto2.default.createCipheriv("aes-256-gcm", key, iv);
+  const enc = Buffer.concat([cipher.update(plain), cipher.final()]);
+  return Buffer.concat([MAGIC, salt, iv, cipher.getAuthTag(), enc]);
+}
+function decryptSidecar(blob, password) {
+  if (blob.length < MAGIC.length + SALT_LEN + IV_LEN + TAG_LEN || !blob.subarray(0, MAGIC.length).equals(MAGIC)) {
+    throw new Error("Not an RFENC1-encrypted file");
+  }
+  let o = MAGIC.length;
+  const salt = blob.subarray(o, o += SALT_LEN);
+  const iv = blob.subarray(o, o += IV_LEN);
+  const tag = blob.subarray(o, o += TAG_LEN);
+  const key = import_crypto2.default.scryptSync(password, salt, 32, { N: 16384, r: 8, p: 1 });
+  const decipher = import_crypto2.default.createDecipheriv("aes-256-gcm", key, iv);
+  decipher.setAuthTag(tag);
+  return Buffer.concat([decipher.update(blob.subarray(o)), decipher.final()]);
+}
+var import_crypto2, MAGIC, SALT_LEN, IV_LEN, TAG_LEN;
+var init_sidecar_crypto = __esm({
+  "src/pdf/sidecar-crypto.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_crypto2 = __toESM(require("crypto"));
+    MAGIC = Buffer.from("RFENC1");
+    SALT_LEN = 16;
+    IV_LEN = 12;
+    TAG_LEN = 16;
+  }
+});
+
 // src/license/JwtVerifier.ts
 var init_JwtVerifier = __esm({
   "src/license/JwtVerifier.ts"() {
@@ -7622,13 +7646,13 @@ var init_chartjs_bundle = __esm({
 function fmtMb(bytes) {
   return `${(bytes / 1024 / 1024).toFixed(2)} MB`;
 }
-var import_fs8, import_path6, PdfGenerator;
+var import_fs8, import_path5, PdfGenerator;
 var init_PdfGenerator = __esm({
   "src/pdf/PdfGenerator.ts"() {
     "use strict";
     init_cjs_shims();
     import_fs8 = __toESM(require("fs"));
-    import_path6 = __toESM(require("path"));
+    import_path5 = __toESM(require("path"));
     init_engine();
     init_ScreenshotEmbedder();
     init_BrowserManager();
@@ -7638,6 +7662,7 @@ var init_PdfGenerator = __esm({
     init_FilenameResolver();
     init_compression();
     init_FailurePaginator();
+    init_sidecar_crypto();
     init_logger();
     init_sections();
     init_JwtVerifier();
@@ -7738,7 +7763,7 @@ var init_PdfGenerator = __esm({
             const templateId = source.kind === "builtin" ? source.id : "detailed";
             const templateData = { ...data, meta: { ...data.meta, template: templateId } };
             const templateOptions = { ...options, template: templateId };
-            await this.renderPdf(templateData, templateOptions, source, compression, outputPath, page);
+            let { sidecarPath } = await this.renderPdf(templateData, templateOptions, source, compression, outputPath, page);
             const capBytes = (options.maxFileSizeMb ?? 0) * 1024 * 1024;
             if (capBytes > 0) {
               const sizeBytes = (await import_fs8.default.promises.stat(outputPath)).size;
@@ -7748,7 +7773,8 @@ var init_PdfGenerator = __esm({
                 logger.warn(
                   `PDF size ${fmtMb(sizeBytes)} exceeds cap ${fmtMb(capBytes)} \u2014 re-rendering (jpeg-q=${tighter.quality}, max-w=${tighter.maxWidth}px, inline-failures\u2264${tighter.maxInlineFailures}).`
                 );
-                await this.renderPdf(templateData, templateOptions, source, tighter, outputPath, page);
+                const retuned = await this.renderPdf(templateData, templateOptions, source, tighter, outputPath, page);
+                sidecarPath = retuned.sidecarPath ?? sidecarPath;
                 const finalSize = (await import_fs8.default.promises.stat(outputPath)).size;
                 if (finalSize > capBytes) {
                   logger.warn(
@@ -7760,7 +7786,36 @@ var init_PdfGenerator = __esm({
               }
             }
             if (options.pdfPassword) {
-              await this.pdfEncryptor.encrypt(outputPath, options.pdfPassword);
+              let pdfEncrypted = false;
+              try {
+                await this.pdfEncryptor.encrypt(outputPath, options.pdfPassword);
+                pdfEncrypted = true;
+                if (sidecarPath && import_fs8.default.existsSync(sidecarPath)) {
+                  const blob = encryptSidecar(await import_fs8.default.promises.readFile(sidecarPath), options.pdfPassword);
+                  await import_fs8.default.promises.writeFile(`${sidecarPath}.enc`, blob);
+                  await import_fs8.default.promises.unlink(sidecarPath);
+                  logger.info(`Overflow sidecar encrypted \u2192 ${import_path5.default.basename(sidecarPath)}.enc`);
+                } else {
+                  const staleSidecarPath = sidecarPathFor(outputPath);
+                  if (import_fs8.default.existsSync(staleSidecarPath)) {
+                    import_fs8.default.rmSync(staleSidecarPath, { force: true });
+                    logger.info(`Removed stale plaintext sidecar: ${import_path5.default.basename(staleSidecarPath)}`);
+                  }
+                }
+              } catch (err) {
+                const sidecarTargets = sidecarPath ? [sidecarPath, `${sidecarPath}.enc`] : [];
+                const cleanupTargets = pdfEncrypted ? sidecarTargets : [outputPath, ...sidecarTargets];
+                for (const target of cleanupTargets) {
+                  try {
+                    import_fs8.default.rmSync(target, { force: true });
+                  } catch (cleanupErr) {
+                    logger.warn(
+                      `Could not remove leftover file after encryption failure: ${target} (${cleanupErr.message})`
+                    );
+                  }
+                }
+                throw err;
+              }
             }
             const finalSizeMb = fmtMb((await import_fs8.default.promises.stat(outputPath)).size);
             logger.info(`PDF report generated: ${outputPath} (${finalSizeMb})`);
@@ -7775,17 +7830,17 @@ var init_PdfGenerator = __esm({
         if (options.templatePath && options.templatePath.length > 0) {
           const byAbsolutePath = /* @__PURE__ */ new Map();
           for (const p of options.templatePath) {
-            const absolutePath = import_path6.default.isAbsolute(p) ? p : import_path6.default.resolve(process.cwd(), p);
+            const absolutePath = import_path5.default.isAbsolute(p) ? p : import_path5.default.resolve(process.cwd(), p);
             if (!byAbsolutePath.has(absolutePath)) byAbsolutePath.set(absolutePath, p);
           }
           const labelCounts = /* @__PURE__ */ new Map();
           for (const rawPath of byAbsolutePath.values()) {
-            const label = import_path6.default.basename(rawPath, ".hbs");
+            const label = import_path5.default.basename(rawPath, ".hbs");
             labelCounts.set(label, (labelCounts.get(label) ?? 0) + 1);
           }
           const seenPerLabel = /* @__PURE__ */ new Map();
           return Array.from(byAbsolutePath.entries()).map(([absolutePath, rawPath]) => {
-            const baseLabel = import_path6.default.basename(rawPath, ".hbs");
+            const baseLabel = import_path5.default.basename(rawPath, ".hbs");
             let label = baseLabel;
             if ((labelCounts.get(baseLabel) ?? 0) > 1) {
               const n = (seenPerLabel.get(baseLabel) ?? 0) + 1;
@@ -7845,7 +7900,7 @@ var init_PdfGenerator = __esm({
           ...data,
           failures: paginated.inline,
           overflowFailureCount: paginated.overflowCount,
-          overflowSidecarName: paginated.sidecarPath ? import_path6.default.basename(paginated.sidecarPath) : void 0
+          overflowSidecarName: paginated.sidecarPath ? import_path5.default.basename(paginated.sidecarPath) + (options.pdfPassword ? ".enc" : "") : void 0
         };
         for (const f of renderData.failures) f.screenshotBase64 = void 0;
         if (options.includeScreenshots !== false) {
@@ -7870,7 +7925,7 @@ var init_PdfGenerator = __esm({
           await page.goto(fileUrl, { waitUntil: "domcontentloaded", timeout: 6e4 });
           const showCharts = source.kind === "builtin" ? resolveSections(source.id, options.sections).charts : true;
           await this.chartRenderer.waitForCharts(page, showCharts);
-          logger.info(`Generating PDF \u2192 ${import_path6.default.relative(process.cwd(), outputPath)}`);
+          logger.info(`Generating PDF \u2192 ${import_path5.default.relative(process.cwd(), outputPath)}`);
           await page.pdf({
             path: outputPath,
             format: "A4",
@@ -7880,6 +7935,7 @@ var init_PdfGenerator = __esm({
         } finally {
           await this.htmlWriter.cleanup();
         }
+        return { sidecarPath: paginated.overflowCount > 0 ? paginated.sidecarPath : void 0 };
       }
     };
   }
@@ -8307,8 +8363,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path14, errorMaps, issueData } = params;
-      const fullPath = [...path14, ...issueData.path || []];
+      const { data, path: path13, errorMaps, issueData } = params;
+      const fullPath = [...path13, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -8622,11 +8678,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path14, key) {
+      constructor(parent, value, path13, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path14;
+        this._path = path13;
         this._key = key;
       }
       get path() {
@@ -12021,7 +12077,7 @@ ${issues}`);
   }
   return result.data;
 }
-var hexColor, channelConfigSchema, discordChannelConfigSchema, emailChannelConfigSchema, notifyConfigSchema, failureAnalysisConfigSchema, captureConfigSchema, liveConfigSchema, sectionFlagsShape, sectionFlagsSchema, sectionsSchema, ReporterOptionsSchema;
+var hexColor, channelConfigSchema, discordChannelConfigSchema, emailChannelConfigSchema, notifyConfigSchema, failureAnalysisConfigSchema, captureConfigSchema, liveConfigSchema, redactConfigSchema, sectionFlagsShape, sectionFlagsSchema, sectionsSchema, ReporterOptionsSchema;
 var init_schema = __esm({
   "src/config/schema.ts"() {
     "use strict";
@@ -12094,6 +12150,21 @@ var init_schema = __esm({
       // Debounce window for batched flushes (ms).
       flushMs: external_exports.number().int().min(500).max(1e4).default(2e3)
     }).default({});
+    redactConfigSchema = external_exports.object({
+      enabled: external_exports.boolean().default(false),
+      builtins: external_exports.boolean().default(true),
+      patterns: external_exports.array(
+        external_exports.string().refine((v) => {
+          try {
+            new RegExp(v);
+            return true;
+          } catch {
+            return false;
+          }
+        }, "Each redact.patterns entry must be a valid regular expression")
+      ).default([]),
+      mask: external_exports.string().default("[REDACTED]")
+    }).default({});
     sectionFlagsShape = Object.fromEntries(
       SECTION_KEYS.map((k) => [k, external_exports.boolean().optional()])
     );
@@ -12114,7 +12185,7 @@ var init_schema = __esm({
       primaryColor: hexColor.optional().default(DEFAULT_OPTIONS.primaryColor),
       accentColor: hexColor.optional().default(DEFAULT_OPTIONS.accentColor),
       watermark: external_exports.string().optional(),
-      pdfPassword: external_exports.string().optional(),
+      pdfPassword: external_exports.string().min(1, "pdfPassword must not be empty. Omit the option (or leave the env var unset) to disable encryption.").optional(),
       reportTitle: external_exports.string().optional().default(DEFAULT_OPTIONS.reportTitle),
       projectName: external_exports.string().optional(),
       open: external_exports.boolean().optional().default(DEFAULT_OPTIONS.open),
@@ -12147,6 +12218,7 @@ var init_schema = __esm({
       }, "requirementTagPattern must be a valid regular expression").optional().default(DEFAULT_OPTIONS.requirementTagPattern),
       failureAnalysis: failureAnalysisConfigSchema,
       capture: captureConfigSchema,
+      redact: redactConfigSchema,
       live: liveConfigSchema,
       templatePath: external_exports.union([
         external_exports.string().regex(/\.hbs$/, "templatePath must end with .hbs").refine((v) => v.slice(0, -4).trim().length > 0, "templatePath basename must not be empty"),
@@ -12858,7 +12930,7 @@ function parseArgs() {
     console.warn(`[reportforge] Unknown template '${rawTemplate}', using 'detailed'. Valid: ${TEMPLATE_IDS.join(", ")}`);
   }
   const template = rawTemplate && VALID_TEMPLATES.has(rawTemplate) ? rawTemplate : "detailed";
-  const outputFile = rawOutput ?? import_path7.default.join("playwright-report", "demo-report.pdf");
+  const outputFile = rawOutput ?? import_path6.default.join("playwright-report", "demo-report.pdf");
   return { template, outputFile };
 }
 async function run() {
@@ -12900,12 +12972,12 @@ async function runDemo() {
     process.exit(1);
   }
 }
-var import_path7, DEMO_LICENSE_INFO2, VALID_TEMPLATES;
+var import_path6, DEMO_LICENSE_INFO2, VALID_TEMPLATES;
 var init_cli = __esm({
   "src/demo/cli.ts"() {
     "use strict";
     init_cjs_shims();
-    import_path7 = __toESM(require("path"));
+    import_path6 = __toESM(require("path"));
     init_fixture();
     init_PdfGenerator();
     init_schema();
@@ -13508,6 +13580,32 @@ var init_evaluate_model = __esm({
   }
 });
 
+// src/cli/decrypt-failures.ts
+var decrypt_failures_exports = {};
+__export(decrypt_failures_exports, {
+  decryptFailuresCli: () => decryptFailuresCli
+});
+function decryptFailuresCli(argv) {
+  const input = argv.find((a) => !a.startsWith("--"));
+  if (!input) throw new Error("Usage: decrypt-failures <file.json.enc> [--password=\u2026] [--out=\u2026]");
+  const password = flagValue(argv, "--password") ?? process.env.RF_PDF_PASSWORD;
+  if (!password) throw new Error("No password: pass --password=\u2026 or set RF_PDF_PASSWORD.");
+  const out = flagValue(argv, "--out") ?? (input.endsWith(".enc") ? input.slice(0, -".enc".length) : `${input}.json`);
+  const plain = decryptSidecar(import_fs9.default.readFileSync(input), password);
+  import_fs9.default.writeFileSync(out, plain);
+  return out;
+}
+var import_fs9;
+var init_decrypt_failures = __esm({
+  "src/cli/decrypt-failures.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_fs9 = __toESM(require("fs"));
+    init_sidecar_crypto();
+    init_model_cli_shared();
+  }
+});
+
 // src/cli/index.ts
 init_cjs_shims();
 
@@ -13528,6 +13626,9 @@ Commands:
                      --project      train only on feedback from the current directory's project
   evaluate-model   Compare base vs. base+local on your labeled feedback without writing anything.
                      --model=<path> also print a stored model file's metadata and metrics
+  decrypt-failures Decrypt an encrypted failure-overflow sidecar (*.json.enc).
+                     --password=<pw>  (or RF_PDF_PASSWORD env)
+                     --out=<path>     (default: input path minus .enc)
 
 Run "npx @reportforge/playwright-pdf demo" to see the report ReportForge produces.`;
 function pickCommand(arg) {
@@ -13542,6 +13643,8 @@ function pickCommand(arg) {
       return "train-model";
     case "evaluate-model":
       return "evaluate-model";
+    case "decrypt-failures":
+      return "decrypt-failures";
     default:
       return "help";
   }
@@ -13590,6 +13693,13 @@ async function main() {
       evaluateModelCli2(process.argv.slice(3));
       return;
     }
+    case "decrypt-failures": {
+      const { decryptFailuresCli: decryptFailuresCli2 } = await Promise.resolve().then(() => (init_decrypt_failures(), decrypt_failures_exports));
+      const out = decryptFailuresCli2(process.argv.slice(3));
+      process.stdout.write(`Decrypted \u2192 ${out}
+`);
+      return;
+    }
     case "help": {
       const { text, stream, code } = helpOutput(arg);
       (stream === "stdout" ? process.stdout : process.stderr).write(text);