@reportforge/playwright-pdf 0.22.1 → 0.24.0

package/dist/index.mjs

@@ -1229,13 +1229,13 @@ var require_ast = __commonJS({
         helperExpression: function helperExpression(node) {
           return node.type === "SubExpression" || (node.type === "MustacheStatement" || node.type === "BlockStatement") && !!(node.params && node.params.length || node.hash);
         },
-        scopedId: function scopedId(path17) {
-          return /^\.|this\b/.test(path17.original);
+        scopedId: function scopedId(path16) {
+          return /^\.|this\b/.test(path16.original);
         },
         // an ID is simple if it only has one part, and that part is not
         // `..` or `this`.
-        simpleId: function simpleId(path17) {
-          return path17.parts.length === 1 && !AST.helpers.scopedId(path17) && !path17.depth;
+        simpleId: function simpleId(path16) {
+          return path16.parts.length === 1 && !AST.helpers.scopedId(path16) && !path16.depth;
         }
       }
     };
@@ -2309,12 +2309,12 @@ var require_helpers2 = __commonJS({
         loc
       };
     }
-    function prepareMustache(path17, params, hash, open, strip, locInfo) {
+    function prepareMustache(path16, params, hash, open, strip, locInfo) {
       var escapeFlag = open.charAt(3) || open.charAt(2), escaped = escapeFlag !== "{" && escapeFlag !== "&";
       var decorator = /\*/.test(open);
       return {
         type: decorator ? "Decorator" : "MustacheStatement",
-        path: path17,
+        path: path16,
         params,
         hash,
         escaped,
@@ -2634,9 +2634,9 @@ var require_compiler = __commonJS({
       },
       DecoratorBlock: function DecoratorBlock(decorator) {
         var program = decorator.program && this.compileProgram(decorator.program);
-        var params = this.setupFullMustacheParams(decorator, program, void 0), path17 = decorator.path;
+        var params = this.setupFullMustacheParams(decorator, program, void 0), path16 = decorator.path;
         this.useDecorators = true;
-        this.opcode("registerDecorator", params.length, path17.original);
+        this.opcode("registerDecorator", params.length, path16.original);
       },
       PartialStatement: function PartialStatement(partial) {
         this.usePartial = true;
@@ -2700,46 +2700,46 @@ var require_compiler = __commonJS({
         }
       },
       ambiguousSexpr: function ambiguousSexpr(sexpr, program, inverse) {
-        var path17 = sexpr.path, name = path17.parts[0], isBlock = program != null || inverse != null;
-        this.opcode("getContext", path17.depth);
+        var path16 = sexpr.path, name = path16.parts[0], isBlock = program != null || inverse != null;
+        this.opcode("getContext", path16.depth);
         this.opcode("pushProgram", program);
         this.opcode("pushProgram", inverse);
-        path17.strict = true;
-        this.accept(path17);
+        path16.strict = true;
+        this.accept(path16);
         this.opcode("invokeAmbiguous", name, isBlock);
       },
       simpleSexpr: function simpleSexpr(sexpr) {
-        var path17 = sexpr.path;
-        path17.strict = true;
-        this.accept(path17);
+        var path16 = sexpr.path;
+        path16.strict = true;
+        this.accept(path16);
         this.opcode("resolvePossibleLambda");
       },
       helperSexpr: function helperSexpr(sexpr, program, inverse) {
-        var params = this.setupFullMustacheParams(sexpr, program, inverse), path17 = sexpr.path, name = path17.parts[0];
+        var params = this.setupFullMustacheParams(sexpr, program, inverse), path16 = sexpr.path, name = path16.parts[0];
         if (this.options.knownHelpers[name]) {
           this.opcode("invokeKnownHelper", params.length, name);
         } else if (this.options.knownHelpersOnly) {
           throw new _exception2["default"]("You specified knownHelpersOnly, but used the unknown helper " + name, sexpr);
         } else {
-          path17.strict = true;
-          path17.falsy = true;
-          this.accept(path17);
-          this.opcode("invokeHelper", params.length, path17.original, _ast2["default"].helpers.simpleId(path17));
+          path16.strict = true;
+          path16.falsy = true;
+          this.accept(path16);
+          this.opcode("invokeHelper", params.length, path16.original, _ast2["default"].helpers.simpleId(path16));
         }
       },
-      PathExpression: function PathExpression(path17) {
-        this.addDepth(path17.depth);
-        this.opcode("getContext", path17.depth);
-        var name = path17.parts[0], scoped = _ast2["default"].helpers.scopedId(path17), blockParamId = !path17.depth && !scoped && this.blockParamIndex(name);
+      PathExpression: function PathExpression(path16) {
+        this.addDepth(path16.depth);
+        this.opcode("getContext", path16.depth);
+        var name = path16.parts[0], scoped = _ast2["default"].helpers.scopedId(path16), blockParamId = !path16.depth && !scoped && this.blockParamIndex(name);
         if (blockParamId) {
-          this.opcode("lookupBlockParam", blockParamId, path17.parts);
+          this.opcode("lookupBlockParam", blockParamId, path16.parts);
         } else if (!name) {
           this.opcode("pushContext");
-        } else if (path17.data) {
+        } else if (path16.data) {
           this.options.data = true;
-          this.opcode("lookupData", path17.depth, path17.parts, path17.strict);
+          this.opcode("lookupData", path16.depth, path16.parts, path16.strict);
         } else {
-          this.opcode("lookupOnContext", path17.parts, path17.falsy, path17.strict, scoped);
+          this.opcode("lookupOnContext", path16.parts, path16.falsy, path16.strict, scoped);
         }
       },
       StringLiteral: function StringLiteral(string) {
@@ -3095,16 +3095,16 @@ var require_util = __commonJS({
     }
     exports.urlGenerate = urlGenerate;
     function normalize(aPath) {
-      var path17 = aPath;
+      var path16 = aPath;
       var url = urlParse(aPath);
       if (url) {
         if (!url.path) {
           return aPath;
         }
-        path17 = url.path;
+        path16 = url.path;
       }
-      var isAbsolute = exports.isAbsolute(path17);
-      var parts = path17.split(/\/+/);
+      var isAbsolute = exports.isAbsolute(path16);
+      var parts = path16.split(/\/+/);
       for (var part, up = 0, i = parts.length - 1; i >= 0; i--) {
         part = parts[i];
         if (part === ".") {
@@ -3121,15 +3121,15 @@ var require_util = __commonJS({
           }
         }
       }
-      path17 = parts.join("/");
-      if (path17 === "") {
-        path17 = isAbsolute ? "/" : ".";
+      path16 = parts.join("/");
+      if (path16 === "") {
+        path16 = isAbsolute ? "/" : ".";
       }
       if (url) {
-        url.path = path17;
+        url.path = path16;
         return urlGenerate(url);
       }
-      return path17;
+      return path16;
     }
     exports.normalize = normalize;
     function join(aRoot, aPath) {
@@ -5932,8 +5932,8 @@ var require_printer = __commonJS({
       return this.accept(sexpr.path) + " " + params + hash;
     };
     PrintVisitor.prototype.PathExpression = function(id) {
-      var path17 = id.parts.join("/");
-      return (id.data ? "@" : "") + "PATH:" + path17;
+      var path16 = id.parts.join("/");
+      return (id.data ? "@" : "") + "PATH:" + path16;
     };
     PrintVisitor.prototype.StringLiteral = function(string) {
       return '"' + string.value + '"';
@@ -6053,7 +6053,7 @@ var require_win32 = __commonJS({
   "node_modules/chrome-finder/lib/win32.js"(exports, module) {
     "use strict";
     init_esm_shims();
-    var path17 = __require("path");
+    var path16 = __require("path");
     var { canAccess } = require_util2();
     function win32() {
       const installations = [];
@@ -6067,7 +6067,7 @@ var require_win32 = __commonJS({
       const prefixes = [process.env.LOCALAPPDATA, process.env.PROGRAMFILES, process.env["PROGRAMFILES(X86)"]];
       prefixes.forEach((prefix) => suffixes.forEach((suffix) => {
         if (prefix) {
-          const chromePath = path17.join(prefix, suffix);
+          const chromePath = path16.join(prefix, suffix);
           if (canAccess(chromePath)) {
             installations.push(chromePath);
           }
@@ -6085,7 +6085,7 @@ var require_darwin = __commonJS({
     "use strict";
     init_esm_shims();
     var { execSync: execSync3 } = __require("child_process");
-    var path17 = __require("path");
+    var path16 = __require("path");
     var { canAccess, newLineRegex, sort } = require_util2();
     function darwin() {
       const suffixes = ["/Contents/MacOS/Google Chrome Canary", "/Contents/MacOS/Google Chrome", "/Contents/MacOS/Chromium"];
@@ -6095,7 +6095,7 @@ var require_darwin = __commonJS({
     ${LSREGISTER} -dump | grep -E -i -o '/.+(google chrome( canary)?|chromium)\\.app(\\s|$)' | grep -E -v 'Caches|TimeMachine|Temporary|/Volumes|\\.Trash'
   `).toString().split(newLineRegex).forEach((inst) => {
         suffixes.forEach((suffix) => {
-          const execPath = path17.join(inst.trim(), suffix);
+          const execPath = path16.join(inst.trim(), suffix);
           if (canAccess(execPath)) {
             installations.push(execPath);
           }
@@ -6123,8 +6123,8 @@ var require_linux = __commonJS({
   "node_modules/chrome-finder/lib/linux.js"(exports, module) {
     "use strict";
     init_esm_shims();
-    var { execSync: execSync3, execFileSync: execFileSync2 } = __require("child_process");
-    var path17 = __require("path");
+    var { execSync: execSync3, execFileSync } = __require("child_process");
+    var path16 = __require("path");
     var fs16 = __require("fs");
     var { canAccess, sort, isExecutable, newLineRegex } = require_util2();
     function findChromeExecutablesForLinuxDesktop(folder) {
@@ -6142,7 +6142,7 @@ var require_linux = __commonJS({
     function linux() {
       let installations = [];
       const desktopInstallationFolders = [
-        path17.join(__require("os").homedir(), ".local/share/applications/"),
+        path16.join(__require("os").homedir(), ".local/share/applications/"),
         "/usr/share/applications/"
       ];
       desktopInstallationFolders.forEach((folder) => {
@@ -6180,7 +6180,7 @@ var require_linux = __commonJS({
           return;
         }
         try {
-          const chromePath = execFileSync2("which", [executable]).toString().split(newLineRegex)[0];
+          const chromePath = execFileSync("which", [executable]).toString().split(newLineRegex)[0];
           if (canAccess(chromePath)) {
             installations.push(chromePath);
           }
@@ -6750,8 +6750,8 @@ function getErrorMap() {
 // node_modules/zod/v3/helpers/parseUtil.js
 init_esm_shims();
 var makeIssue = (params) => {
-  const { data, path: path17, errorMaps, issueData } = params;
-  const fullPath = [...path17, ...issueData.path || []];
+  const { data, path: path16, errorMaps, issueData } = params;
+  const fullPath = [...path16, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -6871,11 +6871,11 @@ var errorUtil;
 
 // node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value, path17, key) {
+  constructor(parent, value, path16, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path17;
+    this._path = path16;
     this._key = key;
   }
   get path() {
@@ -10520,6 +10520,21 @@ var liveConfigSchema = external_exports.object({
   // Debounce window for batched flushes (ms).
   flushMs: external_exports.number().int().min(500).max(1e4).default(2e3)
 }).default({});
+var redactConfigSchema = external_exports.object({
+  enabled: external_exports.boolean().default(false),
+  builtins: external_exports.boolean().default(true),
+  patterns: external_exports.array(
+    external_exports.string().refine((v) => {
+      try {
+        new RegExp(v);
+        return true;
+      } catch {
+        return false;
+      }
+    }, "Each redact.patterns entry must be a valid regular expression")
+  ).default([]),
+  mask: external_exports.string().default("[REDACTED]")
+}).default({});
 var sectionFlagsShape = Object.fromEntries(
   SECTION_KEYS.map((k) => [k, external_exports.boolean().optional()])
 );
@@ -10540,7 +10555,7 @@ var ReporterOptionsSchema = external_exports.object({
   primaryColor: hexColor.optional().default(DEFAULT_OPTIONS.primaryColor),
   accentColor: hexColor.optional().default(DEFAULT_OPTIONS.accentColor),
   watermark: external_exports.string().optional(),
-  pdfPassword: external_exports.string().optional(),
+  pdfPassword: external_exports.string().min(1, "pdfPassword must not be empty. Omit the option (or leave the env var unset) to disable encryption.").optional(),
   reportTitle: external_exports.string().optional().default(DEFAULT_OPTIONS.reportTitle),
   projectName: external_exports.string().optional(),
   open: external_exports.boolean().optional().default(DEFAULT_OPTIONS.open),
@@ -10573,6 +10588,7 @@ var ReporterOptionsSchema = external_exports.object({
   }, "requirementTagPattern must be a valid regular expression").optional().default(DEFAULT_OPTIONS.requirementTagPattern),
   failureAnalysis: failureAnalysisConfigSchema,
   capture: captureConfigSchema,
+  redact: redactConfigSchema,
   live: liveConfigSchema,
   templatePath: external_exports.union([
     external_exports.string().regex(/\.hbs$/, "templatePath must end with .hbs").refine((v) => v.slice(0, -4).trim().length > 0, "templatePath basename must not be empty"),
@@ -12615,7 +12631,7 @@ var ShardMerger = class {
 // src/pdf/PdfGenerator.ts
 init_esm_shims();
 import fs14 from "fs";
-import path14 from "path";
+import path13 from "path";
 
 // src/templates/engine.ts
 init_esm_shims();
@@ -13150,49 +13166,38 @@ var ChartRenderer = class {
 
 // src/pdf/PdfEncryptor.ts
 init_esm_shims();
-import { execFileSync } from "child_process";
 import fs11 from "fs";
-import path11 from "path";
-import os10 from "os";
-import crypto3 from "crypto";
+import { PDFDocument, PDFHeader } from "@cantoo/pdf-lib";
+var AES256_HEADER_MINOR = "7ext3";
 var PdfEncryptor = class {
   async encrypt(pdfPath, password) {
     if (!password) return;
-    if (!this.isQpdfAvailable()) {
-      logger.warn(
-        "pdfPassword is set but qpdf is not installed \u2014 PDF will NOT be encrypted. Install qpdf: https://qpdf.readthedocs.io/en/stable/installation.html"
-      );
-      return;
-    }
-    const tmpPath = path11.join(os10.tmpdir(), `rf-encrypted-${Date.now()}.pdf`);
-    const argFile = path11.join(os10.tmpdir(), `rf-qpdf-args-${crypto3.randomBytes(8).toString("hex")}`);
     try {
-      const args = ["--encrypt", password, password, "256", "--", pdfPath, tmpPath];
-      fs11.writeFileSync(argFile, args.join("\n"), { mode: 384 });
-      execFileSync("qpdf", [`@${argFile}`], { stdio: "pipe" });
-      fs11.renameSync(tmpPath, pdfPath);
-      logger.info(`PDF encrypted with password.`);
+      const doc = await PDFDocument.load(await fs11.promises.readFile(pdfPath));
+      doc.context.header = PDFHeader.forVersion(1, AES256_HEADER_MINOR);
+      doc.encrypt({
+        userPassword: password,
+        ownerPassword: password,
+        permissions: { printing: "highResolution", copying: false, modifying: false }
+      });
+      const encryptedBytes = await doc.save();
+      const tmpPath = `${pdfPath}.rf-enc-tmp`;
+      try {
+        await fs11.promises.writeFile(tmpPath, encryptedBytes);
+        await fs11.promises.rename(tmpPath, pdfPath);
+      } finally {
+        fs11.rmSync(tmpPath, { force: true });
+      }
+      logger.info("PDF encrypted with password (AES-256).");
     } catch (e) {
-      throw new Error(`qpdf encryption failed: ${e.message}`);
-    } finally {
-      if (fs11.existsSync(tmpPath)) fs11.unlinkSync(tmpPath);
-      fs11.rmSync(argFile, { force: true });
-    }
-  }
-  isQpdfAvailable() {
-    try {
-      execFileSync("qpdf", ["--version"], { stdio: "pipe" });
-      return true;
-    } catch (err) {
-      logger.debug("qpdf probe failed \u2014 treating as not installed", { error: err.message });
-      return false;
+      throw new Error(`PDF encryption failed: ${e.message}`);
     }
   }
 };
 
 // src/filename/FilenameResolver.ts
 init_esm_shims();
-import path12 from "path";
+import path11 from "path";
 import fs12 from "fs";
 var MAX_BRANCH_LENGTH = 50;
 var FilenameResolver = class {
@@ -13210,8 +13215,8 @@ var FilenameResolver = class {
     const branch = this.sanitiseBranch(ctx.branch);
     const status = ctx.status;
     const resolved = template.replace(/\{date\}/g, date).replace(/\{branch\}/g, branch).replace(/\{status\}/g, status);
-    const absolute = path12.isAbsolute(resolved) ? resolved : path12.resolve(process.cwd(), resolved);
-    fs12.mkdirSync(path12.dirname(absolute), { recursive: true });
+    const absolute = path11.isAbsolute(resolved) ? resolved : path11.resolve(process.cwd(), resolved);
+    fs12.mkdirSync(path11.dirname(absolute), { recursive: true });
     return absolute;
   }
   /**
@@ -13223,7 +13228,7 @@ var FilenameResolver = class {
    * // → '/out/2026-report-executive.pdf'
    */
   injectTemplateSuffix(outputPath, suffix) {
-    const ext = path12.extname(outputPath);
+    const ext = path11.extname(outputPath);
     const base = outputPath.slice(0, outputPath.length - ext.length);
     return `${base}-${suffix}${ext}`;
   }
@@ -13282,7 +13287,12 @@ var PRESETS = {
 // src/pdf/FailurePaginator.ts
 init_esm_shims();
 import fs13 from "fs";
-import path13 from "path";
+import path12 from "path";
+function sidecarPathFor(pdfPath) {
+  const dir = path12.dirname(pdfPath);
+  const base = path12.basename(pdfPath, path12.extname(pdfPath));
+  return path12.join(dir, `${base}-failures.json`);
+}
 var FailurePaginator = class {
   async paginate(failures, maxInline, pdfOutputPath) {
     if (failures.length <= maxInline) {
@@ -13290,7 +13300,7 @@ var FailurePaginator = class {
     }
     const inline = failures.slice(0, maxInline);
     const overflow = failures.slice(maxInline);
-    const sidecarPath = this.sidecarPathFor(pdfOutputPath);
+    const sidecarPath = sidecarPathFor(pdfOutputPath);
     try {
       await fs13.promises.writeFile(
         sidecarPath,
@@ -13298,7 +13308,7 @@ var FailurePaginator = class {
         "utf8"
       );
       logger.info(
-        `Emitted ${overflow.length} overflow failures \u2192 ${path13.basename(sidecarPath)}`
+        `Emitted ${overflow.length} overflow failures \u2192 ${path12.basename(sidecarPath)}`
       );
     } catch (e) {
       logger.warn(`Could not write failure sidecar: ${e.message}`);
@@ -13306,11 +13316,6 @@ var FailurePaginator = class {
     }
     return { inline, overflowCount: overflow.length, sidecarPath };
   }
-  sidecarPathFor(pdfPath) {
-    const dir = path13.dirname(pdfPath);
-    const base = path13.basename(pdfPath, path13.extname(pdfPath));
-    return path13.join(dir, `${base}-failures.json`);
-  }
   /**
    * Drops the inlined image bytes — a 150-entry overflow would otherwise
    * produce a 40 MB JSON. The path still references the on-disk screenshot
@@ -13325,6 +13330,21 @@ var FailurePaginator = class {
   }
 };
 
+// src/pdf/sidecar-crypto.ts
+init_esm_shims();
+import crypto3 from "crypto";
+var MAGIC = Buffer.from("RFENC1");
+var SALT_LEN = 16;
+var IV_LEN = 12;
+function encryptSidecar(plain, password) {
+  const salt = crypto3.randomBytes(SALT_LEN);
+  const key = crypto3.scryptSync(password, salt, 32, { N: 16384, r: 8, p: 1 });
+  const iv = crypto3.randomBytes(IV_LEN);
+  const cipher = crypto3.createCipheriv("aes-256-gcm", key, iv);
+  const enc = Buffer.concat([cipher.update(plain), cipher.final()]);
+  return Buffer.concat([MAGIC, salt, iv, cipher.getAuthTag(), enc]);
+}
+
 // src/pdf/PdfGenerator.ts
 var PdfGenerator = class {
   constructor() {
@@ -13422,7 +13442,7 @@ var PdfGenerator = class {
         const templateId = source.kind === "builtin" ? source.id : "detailed";
         const templateData = { ...data, meta: { ...data.meta, template: templateId } };
         const templateOptions = { ...options, template: templateId };
-        await this.renderPdf(templateData, templateOptions, source, compression, outputPath, page);
+        let { sidecarPath } = await this.renderPdf(templateData, templateOptions, source, compression, outputPath, page);
         const capBytes = (options.maxFileSizeMb ?? 0) * 1024 * 1024;
         if (capBytes > 0) {
           const sizeBytes = (await fs14.promises.stat(outputPath)).size;
@@ -13432,7 +13452,8 @@ var PdfGenerator = class {
             logger.warn(
               `PDF size ${fmtMb(sizeBytes)} exceeds cap ${fmtMb(capBytes)} \u2014 re-rendering (jpeg-q=${tighter.quality}, max-w=${tighter.maxWidth}px, inline-failures\u2264${tighter.maxInlineFailures}).`
             );
-            await this.renderPdf(templateData, templateOptions, source, tighter, outputPath, page);
+            const retuned = await this.renderPdf(templateData, templateOptions, source, tighter, outputPath, page);
+            sidecarPath = retuned.sidecarPath ?? sidecarPath;
             const finalSize = (await fs14.promises.stat(outputPath)).size;
             if (finalSize > capBytes) {
               logger.warn(
@@ -13444,7 +13465,36 @@ var PdfGenerator = class {
           }
         }
         if (options.pdfPassword) {
-          await this.pdfEncryptor.encrypt(outputPath, options.pdfPassword);
+          let pdfEncrypted = false;
+          try {
+            await this.pdfEncryptor.encrypt(outputPath, options.pdfPassword);
+            pdfEncrypted = true;
+            if (sidecarPath && fs14.existsSync(sidecarPath)) {
+              const blob = encryptSidecar(await fs14.promises.readFile(sidecarPath), options.pdfPassword);
+              await fs14.promises.writeFile(`${sidecarPath}.enc`, blob);
+              await fs14.promises.unlink(sidecarPath);
+              logger.info(`Overflow sidecar encrypted \u2192 ${path13.basename(sidecarPath)}.enc`);
+            } else {
+              const staleSidecarPath = sidecarPathFor(outputPath);
+              if (fs14.existsSync(staleSidecarPath)) {
+                fs14.rmSync(staleSidecarPath, { force: true });
+                logger.info(`Removed stale plaintext sidecar: ${path13.basename(staleSidecarPath)}`);
+              }
+            }
+          } catch (err) {
+            const sidecarTargets = sidecarPath ? [sidecarPath, `${sidecarPath}.enc`] : [];
+            const cleanupTargets = pdfEncrypted ? sidecarTargets : [outputPath, ...sidecarTargets];
+            for (const target of cleanupTargets) {
+              try {
+                fs14.rmSync(target, { force: true });
+              } catch (cleanupErr) {
+                logger.warn(
+                  `Could not remove leftover file after encryption failure: ${target} (${cleanupErr.message})`
+                );
+              }
+            }
+            throw err;
+          }
         }
         const finalSizeMb = fmtMb((await fs14.promises.stat(outputPath)).size);
         logger.info(`PDF report generated: ${outputPath} (${finalSizeMb})`);
@@ -13459,17 +13509,17 @@ var PdfGenerator = class {
     if (options.templatePath && options.templatePath.length > 0) {
       const byAbsolutePath = /* @__PURE__ */ new Map();
       for (const p of options.templatePath) {
-        const absolutePath = path14.isAbsolute(p) ? p : path14.resolve(process.cwd(), p);
+        const absolutePath = path13.isAbsolute(p) ? p : path13.resolve(process.cwd(), p);
         if (!byAbsolutePath.has(absolutePath)) byAbsolutePath.set(absolutePath, p);
       }
       const labelCounts = /* @__PURE__ */ new Map();
       for (const rawPath of byAbsolutePath.values()) {
-        const label = path14.basename(rawPath, ".hbs");
+        const label = path13.basename(rawPath, ".hbs");
         labelCounts.set(label, (labelCounts.get(label) ?? 0) + 1);
       }
       const seenPerLabel = /* @__PURE__ */ new Map();
       return Array.from(byAbsolutePath.entries()).map(([absolutePath, rawPath]) => {
-        const baseLabel = path14.basename(rawPath, ".hbs");
+        const baseLabel = path13.basename(rawPath, ".hbs");
         let label = baseLabel;
         if ((labelCounts.get(baseLabel) ?? 0) > 1) {
           const n = (seenPerLabel.get(baseLabel) ?? 0) + 1;
@@ -13529,7 +13579,7 @@ var PdfGenerator = class {
       ...data,
       failures: paginated.inline,
       overflowFailureCount: paginated.overflowCount,
-      overflowSidecarName: paginated.sidecarPath ? path14.basename(paginated.sidecarPath) : void 0
+      overflowSidecarName: paginated.sidecarPath ? path13.basename(paginated.sidecarPath) + (options.pdfPassword ? ".enc" : "") : void 0
     };
     for (const f of renderData.failures) f.screenshotBase64 = void 0;
     if (options.includeScreenshots !== false) {
@@ -13554,7 +13604,7 @@ var PdfGenerator = class {
       await page.goto(fileUrl, { waitUntil: "domcontentloaded", timeout: 6e4 });
       const showCharts = source.kind === "builtin" ? resolveSections(source.id, options.sections).charts : true;
       await this.chartRenderer.waitForCharts(page, showCharts);
-      logger.info(`Generating PDF \u2192 ${path14.relative(process.cwd(), outputPath)}`);
+      logger.info(`Generating PDF \u2192 ${path13.relative(process.cwd(), outputPath)}`);
       await page.pdf({
         path: outputPath,
         format: "A4",
@@ -13564,19 +13614,129 @@ var PdfGenerator = class {
     } finally {
       await this.htmlWriter.cleanup();
     }
+    return { sidecarPath: paginated.overflowCount > 0 ? paginated.sidecarPath : void 0 };
   }
 };
 function fmtMb(bytes) {
   return `${(bytes / 1024 / 1024).toFixed(2)} MB`;
 }
 
+// src/redact/Redactor.ts
+init_esm_shims();
+var Redactor = class {
+  constructor(opts) {
+    /** Indexes of user patterns disabled after throwing (warned once each). */
+    this.disabled = /* @__PURE__ */ new Set();
+    this.maskRaw = opts.mask;
+    this.maskReplacement = opts.mask.replace(/\$/g, "$$$$");
+    this.useBuiltins = opts.builtins;
+    this.userPatterns = opts.patterns.map((p) => new RegExp(p, "g"));
+  }
+  redactText(s) {
+    if (!s) return s;
+    let out = s;
+    if (this.useBuiltins) out = this.applyBuiltins(out);
+    for (let i = 0; i < this.userPatterns.length; i++) {
+      if (this.disabled.has(i)) continue;
+      try {
+        out = out.replace(this.userPatterns[i], this.maskReplacement);
+      } catch (err) {
+        this.disabled.add(i);
+        logger.warn(
+          `redact: custom pattern #${i + 1} threw and is disabled for this run: ${err.message}`
+        );
+      }
+    }
+    return out;
+  }
+  applyBuiltins(s) {
+    const M = this.maskRaw;
+    const MR = this.maskReplacement;
+    return s.replace(/(\b[a-z][\w+.-]{0,63}:\/\/[^/\s:@]{1,512}:)([^@\s/]{1,512})(?=@)/gi, `$1${MR}`).replace(
+      /\b(?:(authorization\s*[:=]\s*basic\s+)([A-Za-z0-9._~+/=-]{8,})|((?:authorization\s*[:=]\s*)?bearer\s+)([A-Za-z0-9._~+/=-]{8,}))/gi,
+      (fullMatch, basicPrefix, _basicToken, bearerPrefix, bearerToken) => {
+        if (basicPrefix) return `${basicPrefix}${M}`;
+        if (bearerToken && /[^a-z]/.test(bearerToken)) return `${bearerPrefix}${M}`;
+        return fullMatch;
+      }
+    ).replace(/\beyJ[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\b/g, MR).replace(
+      /\b(?:AKIA[0-9A-Z]{16}|ghp_[A-Za-z0-9]{16,}|gho_[A-Za-z0-9]{16,}|github_pat_[A-Za-z0-9_]{20,}|xox[baprs]-[A-Za-z0-9-]{10,}|sk-[A-Za-z0-9_-]{16,}|rzp_(?:live|test)_[A-Za-z0-9]{8,}|AIza[A-Za-z0-9_-]{30,})\b/g,
+      MR
+    ).replace(
+      /\b((?:[A-Za-z0-9]{1,32}[_-]){0,8}(?:password|passwd|passcode|pwd|secret|token|api[_-]?key|apikey|auth|authorization|credential|private[_-]?key|access[_-]?key|client[_-]?secret))\b(["']?\s*[=:]\s*)(?!(?:bearer|basic)\b)(?:(["'])((?:(?!\3).){1,512})\3|([^\s"',;&]{1,512}))/gi,
+      (_m, key, sep, q, _quotedVal, _plainVal) => q ? `${key}${sep}${q}${M}${q}` : `${key}${sep}${M}`
+    ).replace(
+      /\b(fill|type|press)\b([^\n]{0,80}?\b(?:password|secret|token|pass|passcode|pin|otp)\b[^\n]{0,80}?\s)(["'])((?:(?!\3).)+)\3/gi,
+      (_m, action, mid, q) => `${action}${mid}${q}${M}${q}`
+    ).replace(/\b([A-Za-z0-9._%+-])[A-Za-z0-9._%+-]{0,63}@([A-Za-z0-9.-]{1,255}\.[A-Za-z]{2,})\b/g, "$1***@$2").replace(/[A-Za-z0-9_+/=-]{20,}/g, (m, offset, str) => {
+      const before = offset > 0 ? str[offset - 1] : " ";
+      const after = offset + m.length < str.length ? str[offset + m.length] : " ";
+      const beforeIsWord = /[A-Za-z0-9_]/.test(before);
+      const afterIsWord = /[A-Za-z0-9_]/.test(after);
+      if (!beforeIsWord && !afterIsWord && /\d/.test(m) && /[A-Za-z]/.test(m)) {
+        return M;
+      }
+      return m;
+    });
+  }
+};
+
+// src/redact/redact-report.ts
+init_esm_shims();
+function redactReportData(data, r) {
+  const rd = (s) => s === void 0 ? void 0 : r.redactText(s);
+  for (const f of data.failures) {
+    f.testTitle = r.redactText(f.testTitle);
+    f.suitePath = f.suitePath.map((s) => r.redactText(s));
+    f.error.message = r.redactText(f.error.message);
+    f.error.stack = rd(f.error.stack);
+    if (f.execution) {
+      f.execution.steps?.forEach((s) => redactStep(s, r));
+      if (f.execution.failingStep) redactStep(f.execution.failingStep, r);
+      if (f.execution.console) {
+        f.execution.console.stdout = f.execution.console.stdout.map((l) => r.redactText(l));
+        f.execution.console.stderr = f.execution.console.stderr.map((l) => r.redactText(l));
+      }
+    }
+  }
+  for (const p of data.projects) p.suites.forEach((s) => redactSuite(s, r));
+  if (data.analysis) {
+    for (const c of data.analysis.clusters) {
+      c.representativeMessage = r.redactText(c.representativeMessage);
+      c.tests = c.tests.map((t) => r.redactText(t));
+    }
+    data.analysis.oneLiner = r.redactText(data.analysis.oneLiner);
+  }
+  data.classifications?.forEach((c) => c.message = r.redactText(c.message));
+  data.briefSentence = rd(data.briefSentence);
+  data.charts.suiteResults.forEach((s) => s.label = r.redactText(s.label));
+  data.charts.flakinessTable?.forEach((row) => row.title = r.redactText(row.title));
+  data.environment.buildUrl = r.redactText(data.environment.buildUrl);
+}
+function redactStep(s, r) {
+  s.title = r.redactText(s.title);
+  if (s.errorMessage !== void 0) s.errorMessage = r.redactText(s.errorMessage);
+}
+function redactSuite(s, r) {
+  s.title = r.redactText(s.title);
+  for (const t of s.tests) {
+    t.title = r.redactText(t.title);
+    t.fullTitle = r.redactText(t.fullTitle);
+    t.tags = t.tags.map((tag) => r.redactText(tag));
+    t.annotations.forEach((a) => {
+      if (a.description !== void 0) a.description = r.redactText(a.description);
+    });
+  }
+  s.suites.forEach((child) => redactSuite(child, r));
+}
+
 // src/reporter.ts
-import path16 from "path";
+import path15 from "path";
 
 // src/history/HistoryManager.ts
 init_esm_shims();
 import fs15 from "fs";
-import path15 from "path";
+import path14 from "path";
 var HistoryManager = class {
   constructor(filePath) {
     this.filePath = filePath;
@@ -13597,7 +13757,7 @@ var HistoryManager = class {
   }
   append(entry, maxSize) {
     try {
-      fs15.mkdirSync(path15.dirname(this.filePath), { recursive: true });
+      fs15.mkdirSync(path14.dirname(this.filePath), { recursive: true });
       const next = {
         version: 1,
         entries: [entry, ...this.read()].slice(0, maxSize)
@@ -14089,6 +14249,7 @@ var LiveStreamer = class {
     this.enabled = true;
     this.gated = false;
     this.gatePromise = null;
+    this.announcePromise = null;
     this.jwt = null;
     this.envSent = false;
     this.lastWarnMs = 0;
@@ -14100,6 +14261,10 @@ var LiveStreamer = class {
   }
   enqueueTest(update) {
     if (!this.enabled) return;
+    if (this.config.redact) {
+      if (update.title !== void 0) update.title = this.config.redact(update.title);
+      if (update.currentStep !== void 0) update.currentStep = this.config.redact(update.currentStep);
+    }
     const prevRetry = this.testStates.get(update.id)?.retry;
     this.testStates.set(update.id, { status: update.status, retry: update.retry ?? prevRetry });
     this.testBuffer.push(update);
@@ -14108,11 +14273,67 @@ var LiveStreamer = class {
   }
   enqueueEvent(event) {
     if (!this.enabled) return;
+    if (this.config.redact) {
+      if (event.title !== void 0) event.title = this.config.redact(event.title);
+      if (event.text !== void 0) event.text = this.config.redact(event.text);
+    }
     event.id = `${this.config.shardKey}:${this.eventSeq++}`;
     this.eventBuffer.push(event);
     this.capPreLicenseBuffer();
     this.scheduleFlush();
   }
+  /**
+   * One immediate empty "hello" batch, sent at run start before the banner
+   * prints. It binds the run server-side (so early link-openers and the
+   * dashboard see it instantly instead of a pending window) and returns the
+   * server-ISSUED watch token from the ack — the capability that survives
+   * every license-key lifecycle event, unlike the key-derived HMAC fallback.
+   * Returns null on any failure (not entitled, network error, older server
+   * whose ack carries no token); the caller then falls back to the HMAC link.
+   * Memoized so drain() can await the same in-flight promise (see drain()).
+   */
+  announce() {
+    return this.announcePromise ?? (this.announcePromise = this.announceOnce());
+  }
+  async announceOnce() {
+    const entitled = await this.ensureGate();
+    if (!entitled || !this.jwt) return null;
+    const body = {
+      runId: this.config.runId,
+      shardKey: this.config.shardKey,
+      shardTotal: this.config.shardTotal,
+      status: "running",
+      counts: this.snapshotCounts(),
+      tests: [],
+      events: [],
+      ...this.envSent ? {} : { env: this.config.env }
+    };
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), NETWORK_TIMEOUT_MS3);
+    try {
+      const res = await fetch(`${this.serverUrl}/api/live/ingest`, {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          authorization: `Bearer ${this.jwt}`
+        },
+        body: JSON.stringify(body),
+        signal: controller.signal
+      });
+      if (!res.ok) {
+        await res.body?.cancel().catch(() => {
+        });
+        return null;
+      }
+      const ack = await res.json().catch(() => null);
+      if (body.env) this.envSent = true;
+      return typeof ack?.watchToken === "string" && ack.watchToken ? ack.watchToken : null;
+    } catch {
+      return null;
+    } finally {
+      clearTimeout(timeout);
+    }
+  }
   /**
    * Final flush: cancels the pending timer, emits the terminal `finished` batch,
    * then awaits in-flight requests bounded by LIVE_DRAIN_DEADLINE_MS. Called from
@@ -14124,6 +14345,7 @@ var LiveStreamer = class {
       clearTimeout(this.flushTimer);
       this.flushTimer = null;
     }
+    if (this.announcePromise) await this.announcePromise;
     await this.flush("finished");
     await Promise.race([
       Promise.allSettled([...this.inFlight]),
@@ -14301,7 +14523,7 @@ function computeWatchToken(runId, key) {
 }
 function buildWatchUrl(serverUrl, runId, token) {
   const base = serverUrl.endsWith("/") ? serverUrl.slice(0, -1) : serverUrl;
-  return `${base}/live/${encodeURIComponent(runId)}?t=${encodeURIComponent(token)}`;
+  return `${base}/live/${encodeURIComponent(runId)}#t=${encodeURIComponent(token)}`;
 }
 function formatLiveBanner(url) {
   const label = "Live Tracker";
@@ -14414,7 +14636,10 @@ var PdfReporter = class {
     this.options = parseOptions(rawOptions);
     setLogLevel(this.options.logLevel);
     this.dataCollector = new DataCollector(this.options.capture);
-    this.version = true ? "0.22.1" : "0.x";
+    if (this.options.redact.enabled) {
+      this.redactor = new Redactor(this.options.redact);
+    }
+    this.version = true ? "0.24.0" : "0.x";
     logger.info(`@reportforge/playwright-pdf v${this.version} initialised`);
     this.licenseClient = new LicenseClient({
       licenseKey: this.options.licenseKey,
@@ -14505,6 +14730,9 @@ var PdfReporter = class {
     const reportData = this._buildReportData(collected, licenseInfo);
     runFailureAnalysis(reportData, this.options, this.cwd);
     reportData.briefSentence = buildBriefSentence(reportData.stats, reportData.analysis, reportData.charts.trend);
+    if (this.redactor) {
+      redactReportData(reportData, this.redactor);
+    }
     let pdfPaths = [];
     try {
       pdfPaths = await this.pdfGenerator.generateAll(reportData, this.options, licenseInfo);
@@ -14536,7 +14764,10 @@ var PdfReporter = class {
     const historyPath = resolveHistoryPath(this.options, this.cwd);
     const hm = new HistoryManager(historyPath);
     const suffix = Math.random().toString(36).padEnd(8, "0").slice(2, 6);
-    const flakyTests = collectFlakyTests(collected.projects);
+    const redactor = this.redactor;
+    const flakyTests = collectFlakyTests(collected.projects).map(
+      (t) => redactor ? { ...t, title: redactor.redactText(t.title) } : t
+    );
     const entry = {
       runId: `${(/* @__PURE__ */ new Date()).toISOString()}-${suffix}`,
       timestamp: Date.now(),
@@ -14673,36 +14904,39 @@ var PdfReporter = class {
     this.liveSteps = live.steps;
     this.liveConsole = live.console;
     void this.license();
-    const token = computeWatchToken(runId, this.options.licenseKey);
-    const watchUrl = token ? buildWatchUrl(serverUrl, runId, token) : void 0;
     const env = detectCiEnv();
-    if (watchUrl) {
-      void this.announceLive(watchUrl, env, shard).catch(() => {
-      });
-    } else {
-      logger.warn(
-        "Live is enabled but no RF_LICENSE_KEY was found \u2014 cannot mint a watch link or stream. Set RF_LICENSE_KEY (or the `licenseKey` option)."
-      );
-    }
+    if (this.redactor && env?.buildUrl) env.buildUrl = this.redactor.redactText(env.buildUrl);
     this.liveStreamer = new LiveStreamer({
       serverUrl,
       runId,
       shardKey: this.liveShardKey,
       shardTotal: shard?.total ?? null,
       license: () => this.license(),
+      redact: this.redactor ? (s) => this.redactor.redactText(s) : void 0,
       env,
       flushMs: live.flushMs
     });
+    if (!this.options.licenseKey?.trim() && !process.env.RF_LICENSE_KEY?.trim()) {
+      logger.warn(
+        "Live is enabled but no RF_LICENSE_KEY was found \u2014 cannot mint a watch link or stream. Set RF_LICENSE_KEY (or the `licenseKey` option)."
+      );
+      return;
+    }
+    void this.announceLive(serverUrl, runId, env, shard).catch(() => {
+    });
   }
   /**
    * Announces the watch link once the run is confirmed live-entitled. Gating on
    * the SAME resolved entitlement the streamer requires (`jwt` + the `'live'`
    * feature) guarantees the link is never printed or posted for a run that will
-   * never stream — no dead links. The chat ping fires from the primary shard only
-   * (unsharded, or `shard.current === 1`) so an N-way matrix posts one message,
-   * not N. The banner still prints from every shard's own log.
+   * never stream — no dead links. The link's token is the server-ISSUED one from
+   * the announce handshake (random, key-independent — a key rotation can never
+   * kill the link); the key-derived HMAC is minted only as a fallback when the
+   * handshake fails (network blip, older server). The chat ping fires from the
+   * primary shard only (unsharded, or `shard.current === 1`) so an N-way matrix
+   * posts one message, not N. The banner still prints from every shard's own log.
    */
-  async announceLive(watchUrl, env, shard) {
+  async announceLive(serverUrl, runId, env, shard) {
     const info = await this.license();
     if (!info) {
       logger.warn("Live is enabled but no active license resolved \u2014 no watch link or streaming.");
@@ -14720,6 +14954,13 @@ var PdfReporter = class {
       );
       return;
     }
+    const issued = await this.liveStreamer?.announce();
+    const token = issued ?? computeWatchToken(runId, this.options.licenseKey);
+    if (!token) {
+      logger.warn("Live is enabled but no watch link could be established \u2014 streaming continues without one.");
+      return;
+    }
+    const watchUrl = buildWatchUrl(serverUrl, runId, token);
     if (isLevelEnabled("info")) {
       console.log(formatLiveBanner(watchUrl));
     }
@@ -14731,7 +14972,7 @@ var PdfReporter = class {
   }
   resolveProjectName() {
     try {
-      const pkgPath = path16.resolve(process.cwd(), "package.json");
+      const pkgPath = path15.resolve(process.cwd(), "package.json");
       const pkg = __require(pkgPath);
       return pkg.name ?? "Playwright Tests";
     } catch {
@@ -14781,9 +15022,9 @@ function deriveVerdict(stats) {
 }
 function resolveHistoryPath(options, cwd) {
   if (options.historyFile) {
-    return path16.isAbsolute(options.historyFile) ? options.historyFile : path16.resolve(cwd, options.historyFile);
+    return path15.isAbsolute(options.historyFile) ? options.historyFile : path15.resolve(cwd, options.historyFile);
   }
-  return path16.join(resolveProjectDir(options, cwd), "history.json");
+  return path15.join(resolveProjectDir(options, cwd), "history.json");
 }
 function flattenSuiteNodes(suites) {
   return suites.flatMap((s) => [s, ...flattenSuiteNodes(s.suites)]);