@pikku/core 0.12.125 → 0.12.127

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+## 0.12.127
+
+### Patch Changes
+
+- f02585e: `pikku audit` tags every advisory and update with `dependencyType: 'prod' | 'dev'`, walking `bun.lock` from each workspace's runtime dependencies without descending into peers or build tools (vite, esbuild, babel, the TanStack Start plugin, the pikku CLI). The console's security view counts only production advisories and folds dev-only ones into a collapsed section.
+- 5586749: A suspended workflow's pause step now reads as `running` while the run waits, and only becomes `succeeded` when the run resumes past it — previously it was marked succeeded the moment the run paused.
+
+## 0.12.126
+
+### Patch Changes
+
+- 44da33f: A scenario run records which version of the suite it ran against — the commit, and which attempt against that commit it is
+- 44da33f: The scenarios screen and the runs screen are one surface: the declared suite is the document and a run is a lens over it. A scenario is filed as `running` the moment it starts, so a console watching a run in progress can tell what is on screen now from what is still waiting, and the run snapshots each scenario's title, description and cast so the record reads as prose.
+
 ## 0.12.125
 
 ### Patch Changes

package/dist/services/file-scenario-run-store.js

@@ -15,6 +15,7 @@ export const scenarioRunSummary = (record) => ({
     runId: record.runId,
     environment: record.environment,
     surface: record.surface,
+    ...(record.version ? { version: record.version } : {}),
     status: record.status,
     startedAt: record.startedAt,
     finishedAt: record.finishedAt,
@@ -82,7 +83,18 @@ export class FileScenarioRunStore {
             if (!record) {
                 return;
             }
-            record.results.push(result);
+            const existing = record.results.findIndex((candidate) => candidate.name === result.name);
+            if (existing === -1) {
+                record.results.push(result);
+            }
+            else {
+                record.results[existing] = {
+                    ...(record.results[existing].artifacts
+                        ? { artifacts: record.results[existing].artifacts }
+                        : {}),
+                    ...result,
+                };
+            }
             await this.write(record);
         });
     }

package/dist/types/core.types.d.ts

@@ -318,6 +318,8 @@ export type CommonWireMeta = {
  */
 export type SecuritySeverity = 'critical' | 'high' | 'moderate' | 'low' | 'info';
 export type SecurityUpdateLevel = 'major' | 'minor' | 'patch' | 'unknown';
+/** `dev` = only reachable through devDependencies or build tooling, so never shipped. */
+export type SecurityDependencyType = 'prod' | 'dev';
 export interface SecurityAuditIssue {
     package: string;
     severity: SecuritySeverity;
@@ -328,12 +330,14 @@ export interface SecurityAuditIssue {
     cwe: string[];
     cvssScore: number | null;
     recommendedVersion: string | null;
+    dependencyType?: SecurityDependencyType;
 }
 export interface SecurityAuditUpdate {
     package: string;
     current: string;
     latest: string;
     level: SecurityUpdateLevel;
+    dependencyType?: SecurityDependencyType;
 }
 export interface SecurityAuditSummary {
     totalIssues: number;

package/dist/types/index.d.ts

@@ -1,2 +1,2 @@
-export type { AuthInstance, CommonWireMeta, CoreConfig, CoreServices, CoreSingletonServices, CoreUserSession, CreateConfig, CreateSingletonServices, CreateWireServices, GetCredential, PikkuWire, PikkuWiringTypes, PostgresConfig, SecretlessServices, SecurityAuditIssue, SecurityAuditReport, SecurityAuditSummary, SecurityAuditUpdate, SecuritySeverity, SecurityUpdateLevel, ServerLifecycle, WireServices, } from './core.types.js';
+export type { AuthInstance, CommonWireMeta, CoreConfig, CoreServices, CoreSingletonServices, CoreUserSession, CreateConfig, CreateSingletonServices, CreateWireServices, GetCredential, PikkuWire, PikkuWiringTypes, PostgresConfig, SecretlessServices, SecurityAuditIssue, SecurityAuditReport, SecurityAuditSummary, SecurityAuditUpdate, SecuritySeverity, SecurityUpdateLevel, SecurityDependencyType, ServerLifecycle, WireServices, } from './core.types.js';
 export type * from './state.types.js';

package/dist/wirings/workflow/pikku-scenario-service.d.ts

@@ -8,7 +8,7 @@ import type { ScenarioBrowserProvider, ScenarioEnvironment, ScenarioSurface } fr
 import type { PikkuWorkflowWire, WorkflowQueueOptions } from './workflow.types.js';
 export { addFeature, resolveFeatureScenarios } from './feature.js';
 export type { CoreFeature, CoreFeatureScenario, FeatureMeta, FeaturesMeta, PikkuBrowserWire, PikkuScenarioWire, ScenarioBrowserFailure, ScenarioBrowserProvider, ScenarioEnvironment, ScenarioStepKind, ScenarioStepMeta, ScenarioStepOptions, ScenarioScreenshotOptions, ScenarioStepPhase, ScenarioSurface, TestIdSelector, } from './scenario.types.js';
-export type { ScenarioArtifact, ScenarioFailureDetail, ScenarioResult, ScenarioRunRecord, ScenarioRunReport, ScenarioRunSelection, ScenarioRunStatus, ScenarioRunStore, ScenarioRunSummary, ScenarioStepRow, ScenarioStepVideoOffset, } from './scenario-run.types.js';
+export type { ScenarioArtifact, ScenarioFailureDetail, ScenarioResult, ScenarioRunRecord, ScenarioRunReport, ScenarioRunSelection, ScenarioRunStatus, ScenarioRunStore, ScenarioRunSummary, ScenarioRunVersion, ScenarioStepRow, ScenarioStepVideoOffset, } from './scenario-run.types.js';
 export { SCENARIO_SURFACES } from './scenario-step.types.js';
 export { resolveScenarioSurfaces } from './scenario-surface.js';
 export { pollUntil, type PollOptions } from './scenario-poll.js';

package/dist/wirings/workflow/scenario-run.types.d.ts

@@ -95,7 +95,12 @@ export interface ScenarioFailureDetail {
 }
 export interface ScenarioResult {
     name: string;
-    status: 'passed' | 'failed';
+    /**
+     * `running` is filed the moment the scenario starts and replaced when it
+     * ends, so a console watching a run in progress can tell the scenario on
+     * screen right now from the ones still waiting their turn.
+     */
+    status: 'passed' | 'failed' | 'running';
     durationMs: number;
     output?: unknown;
     error?: string;
@@ -117,6 +122,11 @@ export interface ScenarioResult {
      * feature under, and it is what survives the title being rewritten.
      */
     featureId?: string;
+    /** The scenario's declared title, snapshotted so the record reads as prose. */
+    title?: string;
+    description?: string;
+    /** Who the scenario cast, in declaration order. */
+    actors?: string[];
     tags?: string[];
     /** Images and footage this scenario produced, filed under the run. */
     artifacts?: ScenarioArtifact[];
@@ -155,6 +165,32 @@ export interface ScenarioRunSelection {
     tags?: string[];
     excludeTags?: string[];
 }
+/**
+ * Which version of the suite a run ran against.
+ *
+ * A run is only comparable to another run of the same thing, and "the same
+ * thing" is the commit — two runs a day apart are not a flake and a fix if the
+ * suite moved between them. `attempt` counts the runs already filed against
+ * that commit, so a suite re-run until it passes reads as one version with
+ * several attempts rather than several unrelated runs.
+ *
+ * Absent when the project is not in a git repository, or has no commits yet:
+ * an unversioned run is still a run, and saying nothing is better than
+ * inventing a version for it.
+ */
+export interface ScenarioRunVersion {
+    /** The commit the working tree was at, in full. */
+    commit: string;
+    /**
+     * The tree had uncommitted changes, so the commit does not describe what
+     * actually ran. Recorded rather than refused — running against a dirty tree
+     * is the normal way to work — but a reader comparing two attempts of the
+     * same commit needs to know one of them was not really that commit.
+     */
+    dirty?: boolean;
+    /** Which run this is against that commit, counting from one. */
+    attempt: number;
+}
 /**
  * A whole run, as it is stored and read back.
  *
@@ -170,6 +206,8 @@ export interface ScenarioRunRecord extends ScenarioRunReport {
     surface: string;
     /** Absent on a run of the whole suite; see {@link ScenarioRunSelection}. */
     selection?: ScenarioRunSelection;
+    /** The suite version this ran against, when the project has one. */
+    version?: ScenarioRunVersion;
     startedAt: string;
     finishedAt?: string;
 }
@@ -178,6 +216,7 @@ export interface ScenarioRunSummary {
     runId: string;
     environment: string;
     surface: string;
+    version?: ScenarioRunVersion;
     status: ScenarioRunStatus;
     startedAt: string;
     finishedAt?: string;
@@ -202,7 +241,11 @@ export interface ScenarioRunSummary {
 export interface ScenarioRunStore {
     /** Open a run. Called before the first scenario, with `status: 'running'`. */
     start(record: ScenarioRunRecord): Promise<void>;
-    /** Append one finished scenario to an open run. */
+    /**
+     * File one scenario's state against an open run, replacing whatever was
+     * filed for that name before — a scenario is recorded twice, once as
+     * `running` and once with its outcome.
+     */
     recordScenario(runId: string, result: ScenarioResult): Promise<void>;
     /**
      * File the run's artifacts against the scenarios that produced them.

package/dist/wirings/workflow/scenario-step.types.d.ts

@@ -180,6 +180,9 @@ export interface ScenarioScreenshotOptions {
 /**
  * One actor's browser session, handed to a step as `wire.browser`.
  *
+ * Every actor gets their own, so a two-actor scenario drives two sessions and
+ * `screenshot` files each shot under the actor it belongs to.
+ *
  * Only what every driver can honour is declared here. A driver package adds
  * the rest by declaration-merging onto this interface — `@pikku/playwright`
  * contributes `page`, `context` and `locate` — so a step written against the

package/dist/wirings/workflow/workflow-suspend.d.ts

@@ -6,7 +6,7 @@ export type SuspendStore = Pick<ApprovalStore, 'getStepState' | 'insertStepState
 /**
  * Record a suspension point and unwind the run.
  *
- * A suspension that has already succeeded returns instead of throwing, so a
- * replay walks past a gate the run has already passed through.
+ * The gate stays `running` while the run waits, so it reads as in progress; the
+ * replay that follows a resume settles it and walks past.
  */
 export declare const recordSuspension: (store: SuspendStore, runId: string, reason: string, stepName: string, fromStepName: string | undefined) => Promise<void>;

package/dist/wirings/workflow/workflow-suspend.js

@@ -4,8 +4,8 @@ export const suspendStepNameFor = (reason) => `__workflow_suspend:${reason}`;
 /**
  * Record a suspension point and unwind the run.
  *
- * A suspension that has already succeeded returns instead of throwing, so a
- * replay walks past a gate the run has already passed through.
+ * The gate stays `running` while the run waits, so it reads as in progress; the
+ * replay that follows a resume settles it and walks past.
  */
 export const recordSuspension = async (store, runId, reason, stepName, fromStepName) => {
     const insert = () => store.insertStepState(runId, stepName, 'pikkuWorkflowSuspend', { reason }, undefined, fromStepName);
@@ -22,12 +22,10 @@ export const recordSuspension = async (store, runId, reason, stepName, fromStepN
     if (stepState.status === 'succeeded') {
         return;
     }
-    if (stepState.status === 'pending') {
-        await store.setStepRunning(stepState.stepId);
+    if (stepState.status === 'running') {
+        await store.setStepResult(stepState.stepId, { reason });
+        return;
     }
-    await store.setStepResult(stepState.stepId, {
-        reason,
-        suspendedAt: new Date().toISOString(),
-    });
+    await store.setStepRunning(stepState.stepId);
     throw new WorkflowSuspendedException(runId, reason);
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/core",
-  "version": "0.12.125",
+  "version": "0.12.127",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/pikkujs/pikku.git",