@reportforge/playwright-pdf 0.22.1 → 0.24.0

package/dist/index.d.mts

@@ -73,8 +73,10 @@ interface ReporterOptions {
      */
     watermark?: string;
     /**
-     * Password to protect the generated PDF (Enterprise tier).
-     * Requires qpdf to be installed on the system.
+     * Password to protect the generated PDF (AES-256). Applied in-process — no
+     * external tools required. Also encrypts the failure-overflow sidecar JSON
+     * when one is written. Recommended: source from an env var rather than
+     * committing it — `pdfPassword: process.env.RF_PDF_PASSWORD`.
      */
     pdfPassword?: string;
     /**
@@ -279,6 +281,24 @@ interface ReporterOptions {
         /** Max console lines retained per stream. Default: 50 */
         maxConsoleLines?: number;
     };
+    /**
+     * Opt-in redaction of likely-sensitive values (credentials, tokens, emails)
+     * in report content — error messages, stacks, step titles, console output,
+     * test titles — and in the live watch stream. Off by default.
+     *
+     * @example
+     * redact: { enabled: true, patterns: ['MYCO_[A-Z0-9]+'] }
+     */
+    redact?: {
+        /** Enable redaction. Default: false */
+        enabled?: boolean;
+        /** Apply the built-in credential/PII patterns. Default: true */
+        builtins?: boolean;
+        /** Additional regexes (compiled with the `g` flag); matches are fully masked. Default: [] */
+        patterns?: string[];
+        /** Replacement text for masked values. Default: '[REDACTED]' */
+        mask?: string;
+    };
     /**
      * Live test-execution streaming (opt-in, off by default). When enabled the
      * reporter mints an unguessable watch link, prints it to the CI logs at run
@@ -483,6 +503,7 @@ declare class PdfReporter implements Reporter {
     private readonly licenseClient;
     private readonly dataCollector;
     private readonly pdfGenerator;
+    private readonly redactor?;
     private licensePromise?;
     private liveStreamer?;
     private liveShardKey;
@@ -531,9 +552,12 @@ declare class PdfReporter implements Reporter {
      * Announces the watch link once the run is confirmed live-entitled. Gating on
      * the SAME resolved entitlement the streamer requires (`jwt` + the `'live'`
      * feature) guarantees the link is never printed or posted for a run that will
-     * never stream — no dead links. The chat ping fires from the primary shard only
-     * (unsharded, or `shard.current === 1`) so an N-way matrix posts one message,
-     * not N. The banner still prints from every shard's own log.
+     * never stream — no dead links. The link's token is the server-ISSUED one from
+     * the announce handshake (random, key-independent — a key rotation can never
+     * kill the link); the key-derived HMAC is minted only as a fallback when the
+     * handshake fails (network blip, older server). The chat ping fires from the
+     * primary shard only (unsharded, or `shard.current === 1`) so an N-way matrix
+     * posts one message, not N. The banner still prints from every shard's own log.
      */
     private announceLive;
     private resolveProjectName;

package/dist/index.d.ts

@@ -73,8 +73,10 @@ interface ReporterOptions {
      */
     watermark?: string;
     /**
-     * Password to protect the generated PDF (Enterprise tier).
-     * Requires qpdf to be installed on the system.
+     * Password to protect the generated PDF (AES-256). Applied in-process — no
+     * external tools required. Also encrypts the failure-overflow sidecar JSON
+     * when one is written. Recommended: source from an env var rather than
+     * committing it — `pdfPassword: process.env.RF_PDF_PASSWORD`.
      */
     pdfPassword?: string;
     /**
@@ -279,6 +281,24 @@ interface ReporterOptions {
         /** Max console lines retained per stream. Default: 50 */
         maxConsoleLines?: number;
     };
+    /**
+     * Opt-in redaction of likely-sensitive values (credentials, tokens, emails)
+     * in report content — error messages, stacks, step titles, console output,
+     * test titles — and in the live watch stream. Off by default.
+     *
+     * @example
+     * redact: { enabled: true, patterns: ['MYCO_[A-Z0-9]+'] }
+     */
+    redact?: {
+        /** Enable redaction. Default: false */
+        enabled?: boolean;
+        /** Apply the built-in credential/PII patterns. Default: true */
+        builtins?: boolean;
+        /** Additional regexes (compiled with the `g` flag); matches are fully masked. Default: [] */
+        patterns?: string[];
+        /** Replacement text for masked values. Default: '[REDACTED]' */
+        mask?: string;
+    };
     /**
      * Live test-execution streaming (opt-in, off by default). When enabled the
      * reporter mints an unguessable watch link, prints it to the CI logs at run
@@ -483,6 +503,7 @@ declare class PdfReporter implements Reporter {
     private readonly licenseClient;
     private readonly dataCollector;
     private readonly pdfGenerator;
+    private readonly redactor?;
     private licensePromise?;
     private liveStreamer?;
     private liveShardKey;
@@ -531,9 +552,12 @@ declare class PdfReporter implements Reporter {
      * Announces the watch link once the run is confirmed live-entitled. Gating on
      * the SAME resolved entitlement the streamer requires (`jwt` + the `'live'`
      * feature) guarantees the link is never printed or posted for a run that will
-     * never stream — no dead links. The chat ping fires from the primary shard only
-     * (unsharded, or `shard.current === 1`) so an N-way matrix posts one message,
-     * not N. The banner still prints from every shard's own log.
+     * never stream — no dead links. The link's token is the server-ISSUED one from
+     * the announce handshake (random, key-independent — a key rotation can never
+     * kill the link); the key-derived HMAC is minted only as a fallback when the
+     * handshake fails (network blip, older server). The chat ping fires from the
+     * primary shard only (unsharded, or `shard.current === 1`) so an N-way matrix
+     * posts one message, not N. The banner still prints from every shard's own log.
      */
     private announceLive;
     private resolveProjectName;