squally-reporter 0.10.2 → 0.12.0

package/dist/index.js

@@ -50,8 +50,30 @@ const V2_FIELD_LIMITS = {
     playwrightVersion: 50,
     os: 100,
     osVersion: 50,
+    // 0.11.0 - squally-app's own limits for the three begin fields
+    // (lib/ingest-v2-contract.ts, V2_FIELD_LIMITS).
+    ciJobKey: 64,
+    beginToken: 100,
+    ciRunUrl: 2048,
 };
+/**
+ * SQUALLY_CI_JOB_KEY's alphabet - the server's CI_JOB_KEY_PATTERN, exactly. It
+ * becomes part of the CI run id and of a GitHub check name, which is why it is
+ * this narrow.
+ */
+const CI_JOB_KEY_PATTERN = /^[A-Za-z0-9._-]+$/;
+/** The highest attempt the server accepts (MAX_CI_RUN_ATTEMPT in squally-app). */
+const MAX_CI_RUN_ATTEMPT = 1000;
 const MAX_TAGS = 20;
+// Steps (0.12.0) - squally-app lib/attempt-steps.ts holds the same limits.
+const MAX_STEPS = 300;
+const MAX_STEP_TITLE = 200;
+const MAX_STEP_CATEGORY = 32;
+const MAX_STEP_LOCATION = 300;
+// Byte ceiling of one results request (0.12.0). Vercel refuses a body over
+// 4.5 MB before squally-app sees it; with steps, 500 results could reach
+// ~20 MB. 3 MB leaves room for the JSON around the entries.
+const BATCH_MAX_BYTES = 3000000;
 const MAX_ERRORS_PER_RESULT = 10;
 const MAX_ERROR_SNIPPET = 2000;
 // ASCII only, like everything else in this file, and short: it has to fit
@@ -138,40 +160,37 @@ const RULES_REQUEST_TIMEOUT_MS = 5000;
 // limit, not a size limit (BATCH_MAX_RESULTS above is the size limit) - it
 // keeps a normal suite's "running" view within a few seconds of the suite,
 // while a very large run needs many requests spread over its whole duration
-// rather than one enormous one. 2 seconds is the shortest window that
-// cannot, on its own, exceed the ingest firewall rule (60 requests/60 s per
-// API key): 60 s / 2 s = 30 requests/minute, half of 60.
+// rather than one enormous one. 2 seconds keeps the live view a couple of
+// seconds behind the suite, and one reporter at that cadence sends 30
+// requests/minute - a tenth of the ingest rule (300 requests/60 s per API
+// key since squally-app's B2-0, 10.10.2026; it was 60 when this was written).
 const FLUSH_THRESHOLD_RESULTS = 25;
 const FLUSH_INTERVAL_MS = 2000;
-// Scaled by the shard count (0.6.0), because the budget the 2 s above was
-// derived from is NOT per reporter - it is per API key, and every shard of a
-// run carries the same key. The firewall counts `header:authorization`, so
-// eight shards each flushing every 2 s produce 8 x 30 = 240 requests/minute
-// against a 60/minute rule. The "half of 60" margin the constant above claims
-// was computed for a single reporter and silently stopped holding the day
-// sharding arrived.
+// Scaled by the shard count (0.6.0), because the budget is NOT per reporter -
+// it is per API key, and every shard of a run carries the same key. The
+// firewall counts `header:authorization`, so eight shards each flushing every
+// 2 s produce 8 x 30 = 240 requests/minute.
 //
-// interval x shards keeps the AGGREGATE rate at 30/minute for any shard count:
-// S shards x (60 s / 2S s) = 30. The live view does not get slower for it
-// either - it shows the RUN, and a run made of S shards receives an update
-// from one shard or another every 2 s on average regardless of S.
+// THE BUDGET IS 300/minute SINCE 0.12.0 (it was 60, which made 0.6.0 stretch
+// every sharded run to a 30/minute aggregate - a fifth of what the rule now
+// allows, and up to 30 s of results waiting in each shard). Each shard now
+// takes SHARD_INTERVAL_MS per shard, never less than the 2 s base: the
+// AGGREGATE is S x (60 s / (S x 0.4 s)) = 150/minute, half the rule, for any
+// shard count from 5 up; below 5 the 2 s base keeps it lower still.
 //
 // CAPPED, and the cap is about crash exposure rather than rate. Everything
 // buffered is lost if the runner is killed (CI cancellation, OOM), so the
 // interval is also the size of the window at risk. 30 s is the same figure
-// RATE_LIMIT_BACKOFF_CAP_MS uses for "the longest we ever wait", and it keeps
-// the aggregate inside the budget up to 30 shards (S x 60/30 <= 60), which
-// covers the 4-to-16 range the app's own shard documentation describes with
-// room to spare.
-//
-// Above 30 shards the aggregate creeps over the rule again. That is accepted:
-// it is outside the documented range, the retry path already handles a 429,
-// and since 0.6.0 any batch actually lost to it is visible in the
-// resultsProduced diff rather than silent.
+// RATE_LIMIT_BACKOFF_CAP_MS uses for "the longest we ever wait"; it is reached
+// at 75 shards, and the aggregate stays inside the rule up to 150 shards
+// (S x 60/30 <= 300) - far beyond the 4-to-16 the app's shard documentation
+// describes. Past that, the retry path handles a 429, and any batch lost to it
+// is visible in the resultsProduced diff rather than silent.
+const SHARD_INTERVAL_MS = 400;
 const FLUSH_INTERVAL_CAP_MS = 30000;
 /**
- * This shard's flush interval: the base cadence stretched by how many shards
- * share the rate budget with it.
+ * This shard's flush interval: the base cadence, stretched once enough shards
+ * share the rate budget to need it.
  *
  * Only the TIMER is scaled. FLUSH_THRESHOLD_RESULTS is not, and that is
  * deliberate: it is a latency bound on a fast suite, not a rate control, and
@@ -182,7 +201,7 @@ const FLUSH_INTERVAL_CAP_MS = 30000;
  */
 function flushIntervalFor(shardTotal) {
     const shards = Math.max(1, shardTotal ?? 1);
-    return Math.min(FLUSH_INTERVAL_CAP_MS, FLUSH_INTERVAL_MS * shards);
+    return Math.min(FLUSH_INTERVAL_CAP_MS, Math.max(FLUSH_INTERVAL_MS, SHARD_INTERVAL_MS * shards));
 }
 // --- Retry policy (spec section 3.2) ----------------------------------------
 //
@@ -252,6 +271,34 @@ function describeRequestError(err, timeoutMs) {
     }
     return String(err);
 }
+/**
+ * An error response read once: the log line describeResponseError makes, and -
+ * when the body is squally-app's JSON `{ error, code }` - the code and the
+ * server's own sentence (0.11.0: begin's 409 carries `code`).
+ */
+async function readResponseError(response) {
+    let body = "";
+    try {
+        body = (await response.text()).trim();
+    }
+    catch {
+        // Best-effort, as in describeResponseError.
+    }
+    let code = null;
+    let message = null;
+    try {
+        const parsed = JSON.parse(body);
+        if (typeof parsed.code === "string")
+            code = parsed.code;
+        if (typeof parsed.error === "string")
+            message = parsed.error;
+    }
+    catch {
+        // Not JSON - the detail line still carries the text.
+    }
+    const detail = `${response.status} ${response.statusText}${body ? ` - ${truncate(body, ERROR_BODY_LOG_LIMIT)}` : ""}`;
+    return { detail, code, message };
+}
 async function describeResponseError(response) {
     let detail = "";
     try {
@@ -802,15 +849,17 @@ function providerRefs(provider, env, io) {
             return { branch: undefined, commitSha: undefined, describe: "checkout", checkout: undefined };
     }
 }
-// GitHub Actions' GITHUB_ACTOR is the user who triggered the workflow run
-// (a username, not necessarily the commit author, but the closest thing
-// GitHub exposes without shelling out). GitLab's CI_COMMIT_AUTHOR is
-// "Name <email>" - only the name part is kept. Unchanged in 0.10.0, and used
-// only when the reported commit is the checked-out one ("checkout" above).
-function authorFromEnv(env) {
-    const actor = envValue(env, "GITHUB_ACTOR");
-    if (actor !== undefined)
-        return actor;
+// The commit's author, as a CI hands it over: GitLab's CI_COMMIT_AUTHOR is
+// "Name <email>" - only the name part is kept. Used only when the reported
+// commit is the checked-out one ("checkout" above).
+//
+// GITHUB_ACTOR IS NO AUTHOR (0.12.0, squally-app #22): it is whoever
+// triggered the workflow - the person who pushed, merged, or clicked "Run
+// workflow", or a bot - and until 0.11.0 it was reported as the commit's
+// author outside pull requests. The checkout knows the real one (`git log`),
+// so that comes first; the actor stays only as the last resort, for a
+// checkout git cannot read.
+function commitAuthorFromEnv(env) {
     const gitlabAuthor = envValue(env, "CI_COMMIT_AUTHOR");
     if (gitlabAuthor === undefined)
         return undefined;
@@ -911,7 +960,7 @@ function gitContextParts(env, io) {
                 branch,
                 commitSha,
                 commitMessage: envValue(env, "CI_COMMIT_MESSAGE") ?? io.git("git log -1 --pretty=%B"),
-                authorName: authorFromEnv(env) ?? io.git("git log -1 --pretty=%an"),
+                authorName: commitAuthorFromEnv(env) ?? io.git("git log -1 --pretty=%an") ?? envValue(env, "GITHUB_ACTOR") ?? null,
             },
             missingHeadCommit: null,
         };
@@ -1010,37 +1059,215 @@ function isListOnlyInvocation(config) {
 }
 // env and generateFallback are parameters, not process.env/randomUUID read
 // directly, so this is unit-testable without mocking global state.
-function detectCiRunId(env, generateFallback) {
+//
+// THE JOB KEY (0.11.0, SQUALLY_CI_JOB_KEY). Several jobs of one CI run that are
+// not shards of each other - a browser matrix, an "api" and a "ui" suite -
+// share the provider's id, and squally-app grouped them into one run: the
+// second job was handed the first one's run, and its results were refused once
+// that run completed. With a key each job gets an id of its own, shared only
+// by its own shards: the key goes right after the provider's id and BEFORE
+// GitHub's attempt suffix - "<run_id>-<key>-<attempt>" - so squally-app still
+// reads the attempt off the end and links a re-run to the job's own earlier
+// attempt. Without a key every id is byte-identical to 0.10.2. An explicit
+// SQUALLY_CI_RUN_ID still wins outright; the key is then only sent on its own
+// (ciJobKey). The random fallback is already unique to this process and stays
+// as it was.
+function detectCiRunId(env, generateFallback, jobKey = null) {
     if (env.SQUALLY_CI_RUN_ID)
         return env.SQUALLY_CI_RUN_ID;
+    const key = jobKey ? `-${jobKey}` : "";
     if (env.GITHUB_RUN_ID) {
         return env.GITHUB_RUN_ATTEMPT
-            ? `${env.GITHUB_RUN_ID}-${env.GITHUB_RUN_ATTEMPT}`
-            : env.GITHUB_RUN_ID;
+            ? `${env.GITHUB_RUN_ID}${key}-${env.GITHUB_RUN_ATTEMPT}`
+            : `${env.GITHUB_RUN_ID}${key}`;
     }
     if (env.CI_PIPELINE_ID)
-        return env.CI_PIPELINE_ID;
+        return `${env.CI_PIPELINE_ID}${key}`;
     if (env.CIRCLE_WORKFLOW_ID)
-        return env.CIRCLE_WORKFLOW_ID;
+        return `${env.CIRCLE_WORKFLOW_ID}${key}`;
     // 0.10.0 - the same shape as the three above: the provider's own variable,
     // read directly. BUILD_TAG only in Jenkins' own format, since the name is
     // generic enough for something else to have set it.
     if (env.BUILD_TAG?.startsWith("jenkins-"))
-        return env.BUILD_TAG;
+        return `${env.BUILD_TAG}${key}`;
     if (env.BUILD_BUILDID)
-        return env.BUILD_BUILDID;
+        return `${env.BUILD_BUILDID}${key}`;
     if (env.BITBUCKET_BUILD_NUMBER)
-        return env.BITBUCKET_BUILD_NUMBER;
+        return `${env.BITBUCKET_BUILD_NUMBER}${key}`;
     if (env.BUILDKITE_BUILD_ID)
-        return env.BUILDKITE_BUILD_ID;
+        return `${env.BUILDKITE_BUILD_ID}${key}`;
     if (env.CODEBUILD_BUILD_ID)
-        return env.CODEBUILD_BUILD_ID;
+        return `${env.CODEBUILD_BUILD_ID}${key}`;
     if (env.TRAVIS_BUILD_ID)
-        return env.TRAVIS_BUILD_ID;
+        return `${env.TRAVIS_BUILD_ID}${key}`;
     if (env.DRONE_BUILD_NUMBER)
-        return env.DRONE_BUILD_NUMBER;
+        return `${env.DRONE_BUILD_NUMBER}${key}`;
     return generateFallback();
 }
+/**
+ * SQUALLY_CI_JOB_KEY, checked by squally-app's own rule (letters, digits,
+ * '.', '_' and '-', at most 64). An invalid key is a warning, never a failed
+ * test run: the reporter continues WITHOUT a key - the id it would have built
+ * without one, and no ciJobKey - rather than send a value the server refuses
+ * or guess a cleaned-up one. Unset or empty: no key, no warning.
+ */
+function resolveCiJobKey(env) {
+    const raw = env.SQUALLY_CI_JOB_KEY;
+    if (raw === undefined || raw.trim() === "")
+        return { key: null, warning: null };
+    const key = raw.trim();
+    if (key.length > V2_FIELD_LIMITS.ciJobKey || !CI_JOB_KEY_PATTERN.test(key)) {
+        return {
+            key: null,
+            warning: `[squally-reporter] SQUALLY_CI_JOB_KEY ${JSON.stringify(truncate(raw, 80))} is not used: it may hold only ` +
+                `letters, digits, '.', '_' and '-', at most ${V2_FIELD_LIMITS.ciJobKey} characters. This job reports ` +
+                "without a key - like before - so jobs sharing this CI run's id may still be refused as a collision.",
+        };
+    }
+    return { key, warning: null };
+}
+/**
+ * The attempt to send as ciRunAttempt (0.11.0) - only when THIS reporter built
+ * the CI run id from GITHUB_RUN_ATTEMPT, so the id ends in "-<attempt>" and
+ * squally-app can link a re-run to the attempt before it (detectCiAttempt
+ * there reads the stem off that suffix). Never with SQUALLY_CI_RUN_ID: only
+ * the reporter knows the id is GitHub's, and an id the user wrote proves
+ * nothing about its suffix.
+ *
+ * GITHUB ONLY, by the providers' documentation: GitHub's attempt counts runs
+ * of the whole workflow run and is part of its id. GitLab's
+ * CI_JOB_RETRY_COUNT, Buildkite's BUILDKITE_RETRY_COUNT and Azure's job
+ * attempt count retries of ONE JOB inside a build whose id stays the same - not
+ * an attempt of the run squally-app groups - and Jenkins, Travis and Drone
+ * document no counter at all.
+ */
+function detectCiRunAttempt(env) {
+    if (env.SQUALLY_CI_RUN_ID || !env.GITHUB_RUN_ID || !env.GITHUB_RUN_ATTEMPT)
+        return null;
+    if (!/^[1-9]\d*$/.test(env.GITHUB_RUN_ATTEMPT))
+        return null;
+    const attempt = Number(env.GITHUB_RUN_ATTEMPT);
+    return attempt <= MAX_CI_RUN_ATTEMPT ? attempt : null;
+}
+/** An absolute https: URL with a host - squally-app's isHttpsUrl. */
+function isHttpsUrl(value) {
+    try {
+        const url = new URL(value);
+        return url.protocol === "https:" && url.hostname.length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The CI run's page, sent as ciRunUrl (0.11.0) so Squally can link a run to
+ * its CI run. One builder per provider, from each provider's documented
+ * variable:
+ *   - GitHub Actions: GITHUB_SERVER_URL/GITHUB_REPOSITORY/actions/runs/
+ *     GITHUB_RUN_ID - the URL GitHub's own docs give - and /attempts/
+ *     GITHUB_RUN_ATTEMPT when set, the page of exactly this attempt;
+ *   - GitLab CI: CI_PIPELINE_URL ("The URL for the pipeline details");
+ *   - Jenkins: BUILD_URL ("The URL where the results of this build can be
+ *     found");
+ *   - Buildkite: BUILDKITE_BUILD_URL ("The url for this build on Buildkite");
+ *   - Travis CI: TRAVIS_BUILD_WEB_URL ("URL to the build log");
+ *   - Drone: DRONE_BUILD_LINK ("a deep link the Drone build results").
+ * The run, never the job: the id groups a whole build's jobs, so its link is
+ * the build's. Independent of SQUALLY_CI_RUN_ID - the page is the same.
+ *
+ * ONLY HTTPS, AT MOST 2048 CHARACTERS (squally-app's rule). Anything else - a
+ * Jenkins without TLS, a value that is not a URL - is left out silently, with
+ * a debug line: a missing link is no reason to warn on every run.
+ */
+function detectCiRunUrl(env) {
+    const url = ciRunUrlCandidate(env);
+    if (url === null)
+        return null;
+    if (url.length > V2_FIELD_LIMITS.ciRunUrl || !isHttpsUrl(url)) {
+        debugLog(`ciRunUrl not sent: not an https URL of at most ${V2_FIELD_LIMITS.ciRunUrl} characters`);
+        return null;
+    }
+    return url;
+}
+function ciRunUrlCandidate(env) {
+    const value = (name) => envValue(env, name) ?? null;
+    switch (detectCiProvider(env)) {
+        case "github-actions": {
+            const server = value("GITHUB_SERVER_URL");
+            const repository = value("GITHUB_REPOSITORY");
+            const runId = value("GITHUB_RUN_ID");
+            if (!server || !repository || !runId)
+                return null;
+            const attempt = value("GITHUB_RUN_ATTEMPT");
+            return `${server.replace(/\/+$/, "")}/${repository}/actions/runs/${runId}${attempt ? `/attempts/${attempt}` : ""}`;
+        }
+        case "gitlab-ci":
+            return value("CI_PIPELINE_URL");
+        case "jenkins":
+            return value("BUILD_URL");
+        case "buildkite":
+            return value("BUILDKITE_BUILD_URL");
+        case "travis":
+            return value("TRAVIS_BUILD_WEB_URL");
+        case "drone":
+            return value("DRONE_BUILD_LINK");
+        default:
+            return null;
+    }
+}
+/** The YAML a refused begin shows: one key per matrix job. */
+const JOB_KEY_YAML_EXAMPLE = [
+    "      strategy:",
+    "        matrix:",
+    "          browser: [chromium, firefox]",
+    "      env:",
+    "        SQUALLY_CI_JOB_KEY: ${{ matrix.browser }}",
+].join("\n");
+/**
+ * What the reporter prints when squally-app refuses this job's begin with a
+ * 409 (0.11.0). One block per code; nothing is retried and nothing more is
+ * sent for this job - the test run itself is untouched.
+ *   - ci_run_collision: another job already reports this CI run id's slot;
+ *   - ci_run_mixed: the id would group an unsharded job with a sharded one,
+ *     or shards of different totals;
+ *   - anything else: the server's own sentence.
+ */
+// The app's refusal codes this reporter words itself (0.12.0): a run cancelled
+// in Squally (409, begin and results), and a read key on the ingest (401).
+const RUN_CANCELLED_CODE = "run_cancelled";
+const RUN_CANCELLED_SENTENCE = "This run was cancelled in Squally";
+const READ_API_KEY_CODE = "read_api_key";
+function beginRefusalMessage(refusal, where) {
+    const slot = where.shardIndex === null ? "" : ` (shard ${where.shardIndex})`;
+    const tail = [
+        "  No results from this job will be sent to Squally. Your test run and its exit code are not affected.",
+        "  Give every job of the workflow its own SQUALLY_CI_JOB_KEY - the shards of one job share it. For a matrix:",
+        JOB_KEY_YAML_EXAMPLE,
+    ];
+    if (where.jobKey !== null) {
+        tail.splice(1, 1, `  This job's SQUALLY_CI_JOB_KEY is "${where.jobKey}" - another job uses the same key, or the same SQUALLY_CI_RUN_ID. Give each job its own:`);
+    }
+    if (refusal.code === "ci_run_collision") {
+        return [
+            `[squally-reporter] Squally refused this job (ci_run_collision): another job already reports under the CI run id "${where.ciRunId}"${slot}.`,
+            ...tail,
+        ].join("\n");
+    }
+    if (refusal.code === "ci_run_mixed") {
+        return [
+            `[squally-reporter] Squally refused this job (ci_run_mixed): the CI run id "${where.ciRunId}" would mix sharded and unsharded jobs, or shards of different totals, in one run.`,
+            ...tail,
+        ].join("\n");
+    }
+    // squally-app 19.10.2026 (#44): someone cancelled this run in Squally before
+    // this shard began. Nothing to set - the job is simply too late for the run.
+    if (refusal.code === RUN_CANCELLED_CODE) {
+        return (`[squally-reporter] ${RUN_CANCELLED_SENTENCE} (CI run id "${where.ciRunId}"${slot}) - no results ` +
+            "from this job will be sent. Your test run and its exit code are not affected.");
+    }
+    return (`[squally-reporter] Squally refused this job (409): ${refusal.message ?? refusal.detail} - ` +
+        "no results from this job will be sent. Your test run and its exit code are not affected.");
+}
 function resolveProjectName(projectSuites) {
     if (projectSuites.length !== 1)
         return null;
@@ -1254,6 +1481,120 @@ function maskSecrets(value) {
     }
     return masked;
 }
+// THE VALUE HAS NO RELIABLE END. Measured on Playwright 1.62.1: the title is
+// `Fill "<value>" <locator>` with the value's own quotes NOT escaped -
+// `Fill "a "b" c" getByLabel('P')` - and pressSequentially reads `Type "…"`.
+// So nothing between the verb and the locator is trusted: everything up to
+// the LAST place a locator begins goes, and with no locator in sight,
+// everything after the verb. The last, not the first: a value may itself
+// contain " getByX(", and cutting there would keep the rest of it.
+const TYPED_ACTION = /^(Fill|Type|Press sequentially)\s+"/i;
+const LOCATOR_START = /\s(?:getBy[A-Za-z]*|locator|frameLocator)\(/g;
+function stripTypedValue(title) {
+    const action = TYPED_ACTION.exec(title);
+    if (!action)
+        return title;
+    let locatorAt = -1;
+    LOCATOR_START.lastIndex = 0;
+    for (let match = LOCATOR_START.exec(title); match; match = LOCATOR_START.exec(title)) {
+        if (match.index >= action[0].length)
+            locatorAt = match.index;
+    }
+    return `${action[1]} "•••"${locatorAt >= 0 ? title.slice(locatorAt) : ""}`;
+}
+/** Whether this attempt sends its steps: a failure, a timeout, or any retry. */
+function attemptSendsSteps(result) {
+    return result.retry > 0 || result.status === "failed" || result.status === "timedOut";
+}
+/**
+ * The attempt's steps for the wire, at most MAX_STEPS, and how many were left
+ * out. Null when there are none.
+ *
+ * FAILED IS MARKED ON THE DEEPEST STEP ONLY: Playwright puts the error on a
+ * failing expect AND on every test.step around it, and the page should point
+ * at the one that broke, not paint its whole ancestry red.
+ *
+ * THE CUT KEEPS THE FAILING PATH (decision 4): every marked step and its
+ * ancestors first, then the rest in order until MAX_STEPS. A kept step whose
+ * parent was cut hangs from its nearest kept ancestor.
+ */
+function stepsForAttempt(steps, rootDir) {
+    if (!Array.isArray(steps) || steps.length === 0)
+        return null;
+    const flat = [];
+    const hasError = (step) => step.error !== undefined && step.error !== null;
+    const walk = (list, parent) => {
+        for (const step of list) {
+            const index = flat.length;
+            const children = Array.isArray(step.steps) ? step.steps : [];
+            flat.push({ step, parent, failed: hasError(step) && !children.some(hasError) });
+            walk(children, index);
+        }
+    };
+    walk(steps, null);
+    const keep = new Set();
+    for (let i = 0; i < flat.length; i++) {
+        if (!flat[i].failed)
+            continue;
+        for (let at = i; at !== null && !keep.has(at); at = flat[at].parent)
+            keep.add(at);
+    }
+    // A failing path deeper than MAX_STEPS keeps its first MAX_STEPS steps.
+    let kept = [...keep].sort((a, b) => a - b).slice(0, MAX_STEPS);
+    const keptSet = new Set(kept);
+    for (let i = 0; i < flat.length && keptSet.size < MAX_STEPS; i++)
+        keptSet.add(i);
+    kept = [...keptSet].sort((a, b) => a - b);
+    const newIndex = new Map();
+    kept.forEach((old, index) => newIndex.set(old, index));
+    const entries = kept.map((old) => {
+        const { step, failed } = flat[old];
+        let parent = flat[old].parent;
+        while (parent !== null && !newIndex.has(parent))
+            parent = flat[parent].parent;
+        const location = step.location
+            ? truncate(`${toPosixPath(node_path_1.default.relative(rootDir, step.location.file))}:${step.location.line}`, MAX_STEP_LOCATION)
+            : undefined;
+        const entry = {
+            t: truncate(maskSecrets(stripTypedValue(stripAnsi(step.title))), MAX_STEP_TITLE),
+            c: truncate(step.category ?? "", MAX_STEP_CATEGORY),
+            p: parent === null ? null : newIndex.get(parent),
+            d: Number.isFinite(step.duration) && step.duration >= 0 ? Math.round(step.duration) : null,
+        };
+        if (location)
+            entry.l = maskSecrets(location);
+        if (failed)
+            entry.e = true;
+        return entry;
+    });
+    return { steps: entries, omitted: flat.length - kept.length };
+}
+/** The result entry's step fields: none at all when there are no steps, no stepsOmitted when nothing was cut. */
+function stepFields(payload) {
+    if (!payload)
+        return {};
+    return payload.omitted > 0 ? { steps: payload.steps, stepsOmitted: payload.omitted } : { steps: payload.steps };
+}
+/**
+ * How many of the buffered results go into the next request: up to
+ * BATCH_MAX_RESULTS and BATCH_MAX_BYTES, and always at least one - a single
+ * result is bounded far below the byte limit by its own field limits.
+ */
+function takeBatch(buffer, maxResults, maxBytes) {
+    let bytes = 0;
+    let count = 0;
+    for (const entry of buffer) {
+        if (count >= maxResults)
+            break;
+        // +1 for the comma between entries.
+        const size = Buffer.byteLength(JSON.stringify(entry), "utf8") + 1;
+        if (count > 0 && bytes + size > maxBytes)
+            break;
+        bytes += size;
+        count++;
+    }
+    return count;
+}
 // MASKED FIRST, CUT SECOND - for every piece of free text, and for two
 // reasons. Cutting first can split a token and leave a prefix no pattern
 // recognises. And masking can LENGTHEN a value (a one-character URL password
@@ -1637,13 +1978,26 @@ function attemptQualifiesForArtifacts(mappedStatus, retryCount) {
 function artifactKey(testName, filePath, retryCount, repeatIndex, type) {
     return [testName, filePath, String(retryCount), String(repeatIndex), type].join(String.fromCharCode(1));
 }
-function skipReasonMessage(reason) {
+// The app's per-kind size limits (squally-app lib/artifact-limits.ts): a
+// console's is 4 MB since squally-app B2-2 (10.10.2026), everything else 50 MB.
+// And at most ARTIFACTS_PER_REQUEST_LIMIT per presign request (one shard).
+const ARTIFACT_SIZE_LIMIT_LABEL = {
+    screenshot: "50 MB",
+    trace: "50 MB",
+    console: "4 MB",
+};
+const ARTIFACTS_PER_REQUEST_LIMIT = 250;
+/** Why the app skipped an artifact, as a sentence (0.12.0: the limit per kind, and `limit`). */
+function skipReasonMessage(reason, type) {
     if (reason === "file_too_large")
-        return "file_too_large (limit 50 MB)";
+        return `file_too_large (limit ${ARTIFACT_SIZE_LIMIT_LABEL[type]})`;
     if (reason === "cap_exceeded")
         return "cap_exceeded (storage limit reached, upgrade your plan)";
     if (reason === "not_found")
         return "not_found (test result not found on server)";
+    if (reason === "limit") {
+        return `limit (Squally keeps at most ${ARTIFACTS_PER_REQUEST_LIMIT} artifacts per shard; the first ${ARTIFACTS_PER_REQUEST_LIMIT} were kept)`;
+    }
     return reason;
 }
 function confirmReasonMessage(reason) {
@@ -1654,6 +2008,9 @@ function confirmReasonMessage(reason) {
     return reason;
 }
 function artifactLabel(type) {
+    // "console" read "Trace" here until 0.12.0 - the label predated the kind.
+    if (type === "console")
+        return "Browser console";
     return type === "screenshot" ? "Screenshot" : "Trace";
 }
 /**
@@ -1760,6 +2117,19 @@ let rulesCache = null;
 // Explicit options win over all of it, as before.
 //
 // Every warning names variables, never a value.
+//
+// THE DEFAULT URL (0.12.0): a key without a URL used to send nothing. Now it
+// reports to https://app.squally.dev - the only Squally there is - so the
+// setup is one secret, not two. NOT when SQUALLY_API_URL is set but unused
+// (a key from the new name or the options): that variable says someone meant
+// another target, and replacing it silently with production would be the
+// worst reading of it. That case still skips, with the warning it had.
+//
+// A READ KEY IS REFUSED FROM EVERY SOURCE (0.12.0, squally-app #23): the
+// option and SQUALLY_INGEST_KEY too, not only the legacy variable. The app
+// refuses it as well (401 read_api_key), but saying so here costs no request
+// and names the variable to fix.
+const DEFAULT_INGEST_URL = "https://app.squally.dev";
 const READ_KEY_PREFIX = "sqly_ro_";
 // One deprecation warning per variable per run: the reporter is constructed
 // once per run, but a config that builds it twice must not say it twice.
@@ -1794,24 +2164,34 @@ function resolveConnection(options, env, warned = deprecationsWarned) {
             }
         }
     }
+    // A read key from the option or SQUALLY_INGEST_KEY (0.12.0) - the legacy
+    // variable said so above already.
+    if (apiKey?.startsWith(READ_KEY_PREFIX)) {
+        const source = options.apiKey !== undefined ? "The apiKey option" : "SQUALLY_INGEST_KEY";
+        console.warn(`[squally-reporter] ${source} holds a read key (sqly_ro_…); reporting needs the project's ` +
+            "ingest key (Settings › Project › Ingest key). Nothing from this run will be sent.");
+        return {};
+    }
     let apiUrl = options.apiUrl ?? envValue(env, "SQUALLY_INGEST_URL");
     const legacyUrl = envValue(env, "SQUALLY_API_URL");
     if (apiUrl === undefined && keyFromLegacy && legacyUrl !== undefined) {
         warnDeprecated("SQUALLY_API_URL", "SQUALLY_INGEST_URL", warned);
         apiUrl = legacyUrl;
     }
-    if (!apiUrl || !apiKey) {
-        const ignoredUrl = !apiUrl && legacyUrl !== undefined;
-        console.warn("[squally-reporter] no ingest key or URL configured, skipping report - set " +
-            "SQUALLY_INGEST_URL/SQUALLY_INGEST_KEY as env vars, or pass apiUrl/apiKey " +
-            "in playwright.config.ts" +
+    // Set but not taken (see above): someone meant another target - never
+    // fall back to production in its place.
+    const ignoredUrl = apiUrl === undefined && legacyUrl !== undefined;
+    if (!apiKey || ignoredUrl) {
+        console.warn("[squally-reporter] no ingest key configured, skipping report - set SQUALLY_INGEST_KEY " +
+            `(and SQUALLY_INGEST_URL only for a Squally other than ${DEFAULT_INGEST_URL}), or pass ` +
+            "apiKey in playwright.config.ts" +
             (ignoredUrl
                 ? ". SQUALLY_API_URL is set but not used for ingest unless the key comes from " +
                     "SQUALLY_API_KEY too - set SQUALLY_INGEST_URL."
                 : ""));
         return {};
     }
-    return { apiUrl, apiKey };
+    return { apiUrl: apiUrl ?? DEFAULT_INGEST_URL, apiKey };
 }
 class SquallyReporter {
     constructor(options = {}) {
@@ -1826,6 +2206,14 @@ class SquallyReporter {
         this.startedAt = new Date();
         this.ciRunId = "";
         this.shardIndex = null;
+        /**
+         * 0.11.0: one per reporter process, the same on every retry of begin - a
+         * retried begin is the same job, another process with the same CI run id
+         * and shard is not (squally-app answers that one 409 ci_run_collision).
+         */
+        this.beginToken = (0, node_crypto_1.randomUUID)();
+        /** SQUALLY_CI_JOB_KEY, validated (resolveCiJobKey) - or null. */
+        this.ciJobKey = null;
         this.shardTotal = null;
         this.projectName = null;
         this.buffer = [];
@@ -1975,7 +2363,13 @@ class SquallyReporter {
             headersTimeout: UPLOAD_REQUEST_TIMEOUT_MS,
             bodyTimeout: UPLOAD_REQUEST_TIMEOUT_MS,
         });
-        this.ciRunId = truncate(detectCiRunId(process.env, () => (0, node_crypto_1.randomUUID)()), V2_FIELD_LIMITS.ciRunId);
+        // The job key first (0.11.0): the id is built with it. An invalid key is
+        // one warning and no key - never a failed run.
+        const jobKey = resolveCiJobKey(process.env);
+        if (jobKey.warning)
+            console.warn(jobKey.warning);
+        this.ciJobKey = jobKey.key;
+        this.ciRunId = truncate(detectCiRunId(process.env, () => (0, node_crypto_1.randomUUID)(), this.ciJobKey), V2_FIELD_LIMITS.ciRunId);
         // Playwright's shard.current/total are already 1-based, matching the
         // server's own shardIndex >= 1 constraint (docs/ingest-v2-spec.md
         // section 1.2) - no adjustment needed.
@@ -2139,6 +2533,8 @@ class SquallyReporter {
                 : undefined,
             browserName: resolveBrowserName(test),
             errorContext: text.errorContext,
+            // 0.12.0: the steps, only for an attempt that did not pass first time.
+            ...stepFields(attemptSendsSteps(result) ? stepsForAttempt(result.steps, process.cwd()) : null),
         });
         if (this.buffer.length > MAX_TEST_RESULTS_WARNING && this.buffer.length % MAX_TEST_RESULTS_WARNING === 1) {
             console.warn(`[squally-reporter] This run has sent well over ${MAX_TEST_RESULTS_WARNING} test results so far. ` +
@@ -2340,7 +2736,9 @@ class SquallyReporter {
         if (!runId)
             return;
         while (this.buffer.length > 0 && !this.sendingDisabled) {
-            const chunk = this.buffer.splice(0, BATCH_MAX_RESULTS);
+            // By count AND bytes since 0.12.0 - steps made a 500-result batch able
+            // to outgrow the request body limit (BATCH_MAX_BYTES).
+            const chunk = this.buffer.splice(0, takeBatch(this.buffer, BATCH_MAX_RESULTS, BATCH_MAX_BYTES));
             await this.sendBatch(runId, chunk);
         }
     }
@@ -2392,13 +2790,25 @@ class SquallyReporter {
                     // everything this job sends is refused. The warning says that, and
                     // what to set, once per run. Same give-up as before: nothing about
                     // the customer's own test run changes.
+                    //
+                    // CANCELLED IN SQUALLY (0.12.0, #44) is the other 409, with its own
+                    // code: someone stopped the run in the app. The CI job keeps
+                    // running - Squally does not stop it - and what it sends from now on
+                    // is discarded. Saying "another job used the same CI run id" there
+                    // would send the reader after a misconfiguration that does not exist.
+                    if (!this.warnedAlreadyComplete && outcome.code === RUN_CANCELLED_CODE) {
+                        this.warnedAlreadyComplete = true;
+                        console.warn(`[squally-reporter] ${RUN_CANCELLED_SENTENCE} - results sent after the cancel are discarded, ` +
+                            "and no further results from this job will be sent. Your test run and its exit code are not affected.");
+                    }
                     if (!this.warnedAlreadyComplete) {
                         this.warnedAlreadyComplete = true;
                         console.warn(`[squally-reporter] Squally has already completed run ${runId} for CI run id "${this.ciRunId}"` +
                             (this.shardIndex !== null ? ` (shard ${this.shardIndex})` : "") +
                             " - no further results from this job will be sent. Most likely another job used the same " +
-                            "CI run id and finished first: a matrix job, or a re-run. Set SQUALLY_CI_RUN_ID to a value " +
-                            "unique per job - shared only by the shards of one job - to report each job as its own run.");
+                            "CI run id and finished first: a matrix job, or a re-run. Set SQUALLY_CI_JOB_KEY to a value " +
+                            "unique per job - shared only by the shards of one job, for example ${{ matrix.browser }} - " +
+                            "to report each job as its own run.");
                     }
                     this.giveUp();
                     return;
@@ -2456,6 +2866,16 @@ class SquallyReporter {
             runTags: this.runTags,
             config: this.runConfig,
         };
+        // 0.11.0 (squally-app block 1b): sent only when known. The token always.
+        const ciRunAttempt = detectCiRunAttempt(process.env);
+        const ciRunUrl = detectCiRunUrl(process.env);
+        payload.beginToken = this.beginToken;
+        if (this.ciJobKey !== null)
+            payload.ciJobKey = this.ciJobKey;
+        if (ciRunAttempt !== null)
+            payload.ciRunAttempt = ciRunAttempt;
+        if (ciRunUrl !== null)
+            payload.ciRunUrl = ciRunUrl;
         const outcome = await this.requestJson("POST", `${this.apiUrl}/api/ingest/v2/runs`, payload);
         if (outcome.kind === "ok")
             return outcome.json.runId;
@@ -2468,11 +2888,27 @@ class SquallyReporter {
         // explicit that a silent protocol downgrade would make "my streaming
         // isn't working" undiagnosable. The reporter falls back to sending
         // nothing for this run instead.
+        // A REFUSED JOB (0.11.0, squally-app block 1b): 409 at begin means another
+        // job holds this CI run id's slot (ci_run_collision) or the id would mix
+        // kinds of job (ci_run_mixed). Not retried - requestJson never retries a
+        // 4xx - and nothing more is sent for this job; the block says what to set.
+        if (outcome.kind === "http_error" && outcome.status === 409) {
+            console.warn(beginRefusalMessage({ code: outcome.code ?? null, message: outcome.message ?? null, detail: outcome.detail }, { ciRunId: this.ciRunId, shardIndex: this.shardIndex, jobKey: this.ciJobKey }));
+            this.giveUp();
+            return null;
+        }
         if (outcome.kind === "http_error" && outcome.status === 404) {
             console.warn("[squally-reporter] This Squally instance does not support the v2 ingest API yet (404 on " +
                 "/api/ingest/v2/runs). No results from this run will be sent - update squally-app, or check " +
                 "SQUALLY_INGEST_URL (or the apiUrl option) if this is unexpected.");
         }
+        else if (outcome.kind === "http_error" && outcome.status === 401 && outcome.code === READ_API_KEY_CODE) {
+            // resolveConnection refuses a sqly_ro_ key before any request; this is
+            // the app saying the same about a key that does not carry the prefix
+            // locally - a read key set through some other path (#23, 0.12.0).
+            console.error("[squally-reporter] Squally refused the key: it is a read API key. Reporting needs the project's " +
+                "ingest key (Settings › Project › Ingest key) in SQUALLY_INGEST_KEY. No results from this run will be sent.");
+        }
         else {
             const detail = outcome.kind === "http_error" ? `${outcome.status} - ${outcome.detail}` : outcome.detail;
             console.error(`[squally-reporter] Failed to start reporting to Squally: ${detail}`);
@@ -2590,7 +3026,10 @@ class SquallyReporter {
                 continue;
             }
             if (!response.ok) {
-                return { kind: "http_error", status: response.status, detail: await describeResponseError(response) };
+                // Read once, kept whole: the log line, and squally-app's `code` and
+                // `error` when it sent them (begin's 409, 0.11.0).
+                const error = await readResponseError(response);
+                return { kind: "http_error", status: response.status, ...error };
             }
             try {
                 const json = (await response.json());
@@ -2666,7 +3105,7 @@ class SquallyReporter {
             if (!local)
                 continue;
             if (item.skip) {
-                console.warn(`[squally-reporter] ${artifactLabel(item.type)} for '${item.testName}' skipped: ${skipReasonMessage(item.reason)}`);
+                console.warn(`[squally-reporter] ${artifactLabel(item.type)} for '${item.testName}' skipped: ${skipReasonMessage(item.reason, item.type)}`);
                 continue;
             }
             uploads.push({ artifact: local, uploadUrl: item.uploadUrl });
@@ -2756,6 +3195,11 @@ exports.__internal = {
     toPosixPath,
     detectCiRunId,
     detectCiProvider,
+    resolveCiJobKey,
+    detectCiRunAttempt,
+    detectCiRunUrl,
+    isHttpsUrl,
+    beginRefusalMessage,
     resolveGitContext,
     resolveGitContextForRun,
     fetchCommitFromOrigin,
@@ -2774,5 +3218,17 @@ exports.__internal = {
     flushIntervalFor,
     attemptQualifiesForArtifacts,
     artifactKey,
+    // 0.12.0
+    stepsForAttempt,
+    stepFields,
+    stripTypedValue,
+    attemptSendsSteps,
+    takeBatch,
+    skipReasonMessage,
+    artifactLabel,
+    MAX_STEPS,
+    MAX_STEP_TITLE,
+    BATCH_MAX_BYTES,
+    DEFAULT_INGEST_URL,
 };
 //# sourceMappingURL=index.js.map