@pikku/core 0.12.126 → 0.12.127

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+## 0.12.127
+
+### Patch Changes
+
+- f02585e: `pikku audit` tags every advisory and update with `dependencyType: 'prod' | 'dev'`, walking `bun.lock` from each workspace's runtime dependencies without descending into peers or build tools (vite, esbuild, babel, the TanStack Start plugin, the pikku CLI). The console's security view counts only production advisories and folds dev-only ones into a collapsed section.
+- 5586749: A suspended workflow's pause step now reads as `running` while the run waits, and only becomes `succeeded` when the run resumes past it — previously it was marked succeeded the moment the run paused.
+
 ## 0.12.126
 
 ### Patch Changes

package/dist/types/core.types.d.ts

@@ -318,6 +318,8 @@ export type CommonWireMeta = {
  */
 export type SecuritySeverity = 'critical' | 'high' | 'moderate' | 'low' | 'info';
 export type SecurityUpdateLevel = 'major' | 'minor' | 'patch' | 'unknown';
+/** `dev` = only reachable through devDependencies or build tooling, so never shipped. */
+export type SecurityDependencyType = 'prod' | 'dev';
 export interface SecurityAuditIssue {
     package: string;
     severity: SecuritySeverity;
@@ -328,12 +330,14 @@ export interface SecurityAuditIssue {
     cwe: string[];
     cvssScore: number | null;
     recommendedVersion: string | null;
+    dependencyType?: SecurityDependencyType;
 }
 export interface SecurityAuditUpdate {
     package: string;
     current: string;
     latest: string;
     level: SecurityUpdateLevel;
+    dependencyType?: SecurityDependencyType;
 }
 export interface SecurityAuditSummary {
     totalIssues: number;

package/dist/types/index.d.ts

@@ -1,2 +1,2 @@
-export type { AuthInstance, CommonWireMeta, CoreConfig, CoreServices, CoreSingletonServices, CoreUserSession, CreateConfig, CreateSingletonServices, CreateWireServices, GetCredential, PikkuWire, PikkuWiringTypes, PostgresConfig, SecretlessServices, SecurityAuditIssue, SecurityAuditReport, SecurityAuditSummary, SecurityAuditUpdate, SecuritySeverity, SecurityUpdateLevel, ServerLifecycle, WireServices, } from './core.types.js';
+export type { AuthInstance, CommonWireMeta, CoreConfig, CoreServices, CoreSingletonServices, CoreUserSession, CreateConfig, CreateSingletonServices, CreateWireServices, GetCredential, PikkuWire, PikkuWiringTypes, PostgresConfig, SecretlessServices, SecurityAuditIssue, SecurityAuditReport, SecurityAuditSummary, SecurityAuditUpdate, SecuritySeverity, SecurityUpdateLevel, SecurityDependencyType, ServerLifecycle, WireServices, } from './core.types.js';
 export type * from './state.types.js';

package/dist/wirings/workflow/workflow-suspend.d.ts

@@ -6,7 +6,7 @@ export type SuspendStore = Pick<ApprovalStore, 'getStepState' | 'insertStepState
 /**
  * Record a suspension point and unwind the run.
  *
- * A suspension that has already succeeded returns instead of throwing, so a
- * replay walks past a gate the run has already passed through.
+ * The gate stays `running` while the run waits, so it reads as in progress; the
+ * replay that follows a resume settles it and walks past.
  */
 export declare const recordSuspension: (store: SuspendStore, runId: string, reason: string, stepName: string, fromStepName: string | undefined) => Promise<void>;

package/dist/wirings/workflow/workflow-suspend.js

@@ -4,8 +4,8 @@ export const suspendStepNameFor = (reason) => `__workflow_suspend:${reason}`;
 /**
  * Record a suspension point and unwind the run.
  *
- * A suspension that has already succeeded returns instead of throwing, so a
- * replay walks past a gate the run has already passed through.
+ * The gate stays `running` while the run waits, so it reads as in progress; the
+ * replay that follows a resume settles it and walks past.
  */
 export const recordSuspension = async (store, runId, reason, stepName, fromStepName) => {
     const insert = () => store.insertStepState(runId, stepName, 'pikkuWorkflowSuspend', { reason }, undefined, fromStepName);
@@ -22,12 +22,10 @@ export const recordSuspension = async (store, runId, reason, stepName, fromStepN
     if (stepState.status === 'succeeded') {
         return;
     }
-    if (stepState.status === 'pending') {
-        await store.setStepRunning(stepState.stepId);
+    if (stepState.status === 'running') {
+        await store.setStepResult(stepState.stepId, { reason });
+        return;
     }
-    await store.setStepResult(stepState.stepId, {
-        reason,
-        suspendedAt: new Date().toISOString(),
-    });
+    await store.setStepRunning(stepState.stepId);
     throw new WorkflowSuspendedException(runId, reason);
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/core",
-  "version": "0.12.126",
+  "version": "0.12.127",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/pikkujs/pikku.git",