@tracelane/report

The HTML report builder behind tracelane — turns a captured rrweb event stream into a single, self-contained .html file that replays offline. No SaaS, no dashboard, no signup.

The self-contained, offline HTML report builder for tracelane. Given a captured rrweb event stream plus test metadata, it produces a single .html file that:

• opens in any browser, fully offline (no network fetch at view time);
• embeds the rrweb-player UMD + CSS inline;
• embeds the events as a gzipped, base64-encoded blob that is decompressed in-page with an inlined fflate gunzip;
• renders console + network panels, a metadata header, an advisory security-hygiene panel (when the analyzer flags anything), and a "Copy as Markdown for AI paste" button.

Not generally intended for direct consumption — depend on a product package (@tracelane/wdio) instead. See the @tracelane/wdio README for the integration guide.

Install

npm install @tracelane/report

• ESM-only. The package ships "type": "module" and a single import export — there is no CommonJS entry, so require('@tracelane/report') will not work. Use import { buildReport } from '@tracelane/report' (or a dynamic import() from CJS).
• Node >= 22 is required (engines.node).

Usage

import { buildReport } from '@tracelane/report';

const html = buildReport(events, {
  spec: 'login.spec.ts',
  title: 'logs in with valid credentials',
  status: 'failed',
  error: 'expected element to be visible',
  durationMs: 4210,
  browserName: 'chrome',
  browserVersion: '124.0',
  viewport: { width: 1280, height: 720 },
  // commitSha / buildUrl auto-detected from CI env when omitted
});
// write `html` to ./tracelane-reports/<spec>--<title>.html

An optional third argument tunes the build (BuildReportOptions):

• enforceSizeBudget (default true) — prune events to the 25 MB budget (ADR-0005) before embedding; the report shows a banner when a prune fired.
• footer (default true) — render the self-marketing report footer; pass false to suppress it.
• security (default true) — run the advisory @tracelane/security analyzer over the stream and surface findings in a collapsed panel + the Markdown export. Advisory only, not a security audit; pass false to skip analysis entirely.
• securitySuppress — Suppression[] forwarded to the analyzer to silence known-acceptable signals (ignored when security is false).

Design

• Player: [email protected] (upstream). @posthog/rrweb-player was the natural lineage match for the @cubenest/rrweb-core substrate fork, but every published version pins an unpublished dependency (@posthog/[email protected], 404) and is therefore uninstallable. Upstream rrweb-player descends from the same rrweb 2.x line (2.0.0-alpha.x) that the substrate's @posthog/[email protected] was forked from (2.0.0-alpha.17), so the recorded event shape replays correctly.
• Decompression: the build side uses @cubenest/rrweb-core's compress() (fflate gzip); the view side inlines fflate's browser gunzipSync for a small (~8 KB) offline decompressor.
• Asset inlining: the player UMD/CSS and the fflate gunzip source are read from node_modules at build time (fs.readFileSync) — never hand-pasted into source.

License

Apache 2.0. The inlined rrweb player and fflate remain MIT-licensed; see NOTICE.

Related packages

• @tracelane/cli — wires the recorder into your test runners (WebdriverIO and Playwright; Cypress on the roadmap).
• @tracelane/wdio — the WebdriverIO integration that captures sessions and calls this builder on failure.
• @tracelane/playwright — the Playwright integration.
• @tracelane/core — the capture engine (rrweb event stream + compress()).

See the CHANGELOG for release history.