steppy-dev 0.3.0__tar.gz → 0.4.0__tar.gz

{steppy_dev-0.3.0 → steppy_dev-0.4.0}/.github/workflows/steppy-e2e.yml

@@ -7,7 +7,7 @@
 #
 #   jobs:
 #     e2e:
-#       uses: Steppy-dev/steppy/.github/workflows/steppy-e2e.yml@v0.3.0
+#       uses: Steppy-dev/steppy/.github/workflows/steppy-e2e.yml@v0.4.0
 #       with:
 #         compose-file: docker-compose.yml
 #       secrets:
@@ -57,7 +57,7 @@ on:
       steppy-ref:
         description: 'Git ref of Steppy to install. Defaults to the version this workflow ships with.'
         type: string
-        default: 'v0.3.0'
+        default: 'v0.4.0'
       extras:
         description: 'Extras to install. `report` enables report.html, `retry` enables --retries.'
         type: string

{steppy_dev-0.3.0 → steppy_dev-0.4.0}/CHANGELOG.md

@@ -6,6 +6,66 @@ follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.4.0] - 2026-10-23
+
+Fixes found by running Steppy against an app that keeps a live connection open
+and puts its own login page in front of the identity provider: navigation and
+login no longer require a network-idle page, form login gets past that page, and
+`count(...)` comparisons wait like every other assertion. Upgrading changes the
+generated code for comparison counts; regenerate with `steppy generate`.
+
+### Added
+- **Form login past the app's own login page.** Two optional `auth.form` keys:
+  `login_path` (where automatic login starts, default `/`) and `start_selector`
+  (a "Log in" button on the app's own page, clicked when it shows up before the
+  provider's form). The `login` step clicks it too.
+- **`steppy auth login <role> --auto`** logs a `form` role in headless with its
+  configured credentials and saves the session. It needs no terminal, so it works
+  in CI and scripts.
+- `steppy validate` warns when a scenario `timeout:` is above 60 s (see the note
+  under Changed).
+
+### Changed
+- **`count(sel, >=N)` and the other comparator forms now wait.** They re-count
+  until the comparison holds, within the step's timeout, like every other
+  assertion. Before, they read the page once, so a list that was still loading
+  failed with 0. Every comparison count generates different code
+  (`_wait_until(...)` instead of `_n = ….count()`); `count(sel, N)` is
+  unchanged. `<` and `<=` still hold at once on a page that has not rendered.
+- **A scenario's `timeout:` is the default timeout of each of its steps.** This
+  already shipped in 0.3.0 without a note; before 0.3.0 the field did nothing. It
+  is not a limit on the whole test, so a large value (projects had set 3–5
+  minutes) now makes every failing step wait that long. The docs say so now, and
+  `steppy validate` warns above 60 s.
+
+### Fixed
+- **`navigate` honours `timing.navigate_wait` and `wait:` for the page load
+  itself.** `goto()`/`reload()` always waited for the `load` event (30 s) before
+  the configured wait ran, so `domcontentloaded` and `none` could only add
+  waiting. They now pass `wait_until` (`none` becomes `commit`). `networkidle`
+  and `load` generate the same code as before.
+- **Form login no longer requires `networkidle`.** After submitting, it waits for
+  `timing.navigate_wait` (`none` skips the wait), so an app that keeps an
+  EventSource or WebSocket open can log in. This covers the generated tests'
+  automatic login, the `login` step, the TOTP step and `steppy.auth`.
+- **`auth.form.post_login_url_pattern` is read.** It was parsed and ignored, and
+  the fallback, any page under the app's `url`, already matches a provider
+  served on the same origin (Keycloak behind the app's proxy). Automatic login
+  waits for it, and so does the `login` step when it is set. `steppy init` no
+  longer writes the `**/callback**` placeholder, and loading a config that still
+  has it prints a warning: on a typical SPA that URL has already redirected away
+  when login is checked, so keeping it would fail every login. Remove it, or set
+  the URL your app lands on.
+- **Generated tests honour `auth.form.preset`.** They read `config.yaml` as it
+  is written, so `preset: keycloak` with no explicit selectors left the Auth0
+  defaults in place, and login waited for a field Keycloak never renders. The
+  conftest now carries the preset table and resolves it the way the config model
+  does: explicit keys win.
+- **`steppy auth login` without a terminal** fails at once with a hint to use
+  `--auto`, instead of `Login failed: EOF when reading a line`. Interactively, it
+  saves the session only once the browser has left the login page (type `save`
+  to override).
+
 ## [0.3.0] - 2026-10-22
 
 The first public release, under the Apache-2.0 licence. This entry captures
@@ -858,5 +918,6 @@ individual commit.
   `output:` also gained `extra: forbid`, so a `screenshot_dir:` typo now fails
   loudly instead of being swallowed.
 
-[Unreleased]: https://github.com/Steppy-dev/steppy/compare/v0.3.0...HEAD
+[Unreleased]: https://github.com/Steppy-dev/steppy/compare/v0.4.0...HEAD
+[0.4.0]: https://github.com/Steppy-dev/steppy/compare/v0.3.0...v0.4.0
 [0.3.0]: https://github.com/Steppy-dev/steppy/releases/tag/v0.3.0

{steppy_dev-0.3.0 → steppy_dev-0.4.0}/CLAUDE.md

@@ -147,14 +147,14 @@ Code generator, not a runtime engine — generated tests are standalone.
   - `optional: true` and `when: visible(sel)|hidden(sel)|count(sel,>=N)|contains(sel,"x")`. Placement is load-bearing: `optional` wraps the body **inside** the step markers (the step ran), `when` joins `_step_runs` **outside** them (it did not). `when`'s vocabulary is deliberately smaller than `expect:` — an assertion auto-waits, and a guarded step must not pay a timeout for something that was never coming.
   - `match:`/`within:` widened from 4 actions to every action that resolves a selector. `pick-date`/`pick-time` take a selector *string*, so the chain folds into it via Playwright's `>>` (`disambig_selector`); everything else gets a real locator, which is what lets `_safe_bbox_locator` give the guide cursor a bbox.
 - **`call` action** — run a project helper as a first-class step: `fn: mod.func`, `args:`, `kwargs:`, `store:`, `page: false` for a helper that takes no page. The runtime helper `call_helper` imports through `importlib`; **no `sys.path` setup is needed or emitted** — pytest runs as `python -m pytest` from the project root, which puts it on `sys.path[0]` (the worker image sets `WORKDIR /steppy/project` for the same reason). A `call` step shares `custom`'s cursor decision: it honours `guide-cursor:` and shows nothing without one, which is the reason to prefer it over `custom` for a helper-driven guide step.
-- **`expect:` is a list, and carries messages.** A scalar is still one assertion and still generates byte-identically; a list holds several, each optionally `{check:, message:}`. `message` maps to Playwright's own `expect(locator, message=...)`, except on `count-cmp`, which is a bare `assert` and takes it in the assert clause. The descriptor key is `fail_message`, **not** `message` — `toast(...)`'s descriptor already owns `message`, and clobbering it silently asserted on the string `"None"`. New forms: `value` · `attribute` · `not-contains` · `not-visible` · `icontains` · `checked`/`unchecked` · `stays-hidden(sel, "3s")` (a *held* assertion — `hidden()` auto-waits for the element to *become* hidden, the opposite of proving it never appears).
+- **`expect:` is a list, and carries messages.** A scalar is still one assertion and still generates byte-identically; a list holds several, each optionally `{check:, message:}`. `message` maps to Playwright's own `expect(locator, message=...)`, except on `count-cmp`, which polls through the conftest's `_wait_until` and passes it as that helper's `message=`. The descriptor key is `fail_message`, **not** `message` — `toast(...)`'s descriptor already owns `message`, and clobbering it silently asserted on the string `"None"`. New forms: `value` · `attribute` · `not-contains` · `not-visible` · `icontains` · `checked`/`unchecked` · `stays-hidden(sel, "3s")` (a *held* assertion — `hidden()` auto-waits for the element to *become* hidden, the opposite of proving it never appears).
 - **The assertion grammar lives in `src/steppy/assertions.py`** (stdlib-only leaf), imported by both `generator._format_assertion` and `Step.validate_expect_grammar`. Before that split, an unrecognised `expect:` returned `{"type": "unknown"}`, `assert_body`'s `{% else %}` rendered `pass`, and `steppy validate` said nothing — so `status("done")` parsed, generated, and asserted **nothing**. Adding a form means adding a parser branch AND a macro branch; `tests/test_assertion_grammar.py::test_every_parsed_form_generates_real_code_not_pass` is the drift guard. Argument splitting is quote/bracket-aware (`split_top_level`), because selectors are written bare and `[data-testid="a,b"]` used to be cut in half.
 - **`_ALLOWED_FIELDS` is the inverse of `_REQUIRED_FIELDS`** (models.py). `extra = "forbid"` only ever caught a key *no* action has; a key belonging to a *different* action passed. Probed before the fix: `retry`, `interval`, `format`, `variant`, `button`, `danger`, `search` and `method` each validated on all 23 actions and generated code on one, so `- action: click` + `- date: today` passed `steppy validate` and did nothing. Adding a field to an action means adding it here too, or validation rejects the very scenario the feature is for. Only explicitly-set, non-`None` keys are checked.
 - **Inline flow collections parse now** — `- layouts: [desktop, mobile]`, `- args: [a, b]`, `- guide-cursor: {behavior: click, target: '#a'}`. CLAUDE.md had documented that spelling in five places while `_parse_step_content` stored the literal string. Restricted to `parser._STRUCTURED_STEP_KEYS`, derived from the model: a bare attribute selector is shaped exactly like a flow sequence, and `- selector: [data-testid="row"]` is how 2 981 steps across the live projects are written.
 - **`upload` action**: codegens to `locator(selector).set_input_files(value)`. `selector` targets the `<input type="file">`; `value` is the file path (relative paths resolve from pytest cwd = project root). For hidden inputs behind a styled trigger, scenarios add `guide-cursor: { behavior: click, target: '<visible-selector>' }` and bbox + screenshot land on the visible trigger (mirrors the `custom` branch's `guide-cursor` handling). Touch points: see **Adding a new action** above — `upload` needs no bespoke validator (it is pure `_REQUIRED_FIELDS` rows) and no bespoke cursor branch (`_SIMPLE_CURSOR`), but it does read `step.guide_cursor` in `_cursor_from_override`.
 - **`select-option` action** (component dropdown): drives a PrimeNG-style `p-select`/`p-autocomplete`/`p-multiselect` (native `select` only drives `<select>`). `selector` = the trigger/host; opens it, optionally types `search:` into the filter box (then settles per `config.dropdown.settle`), and picks via `option: first|last|N|text:"..."` — or several via `multiple:` (a YAML **indented** list, like `layouts:`; inline `[a, b]` is **not** parsed as a list) which auto-`Escape`s to close. Framework selectors come from the `dropdown:` config preset (`DropdownConfig` in models.py, PrimeNG defaults so it works with no config). Option parsing is the `format_dropdown_option` Jinja filter (generator.py). The option-pick clicks (all `first`/`last`/`nth`/`text` branches + the `multiple:` loop) emit `.click(force=True)`; the trigger-open click stays plain. Force is required because the PrimeNG overlay open-animation + highlighted-option re-render leaves it never "stable", so a non-forced click times out (esp. when the option is already `aria-selected`) — matching the hand-written code this action replaced. Guide cursor auto-targets the trigger (grouped with `click`/`select` in `_compute_cursor_behavior`). Touch points: see **Adding a new action** above, plus the `search`/`option`/`multiple` fields and `validate_select_option_fields` (models.py) for the option/multiple exclusivity rule a required-field table cannot express.
 - **`wait-for` `state:` field**: `state: visible|hidden|detached|attached` passes through to `wait_for_selector(state=...)`; the dominant use is `hidden` (wait for a dialog to close as the success signal after a save). Omitting `state` emits no `state=` kwarg (byte-identical to pre-feature output). Field is `Step.state` (models.py); codegen is the `wait-for` Jinja block.
-- **`assert` `contains` / comparator `count`**: `expect: contains(<selector>, "text")` → Playwright `to_contain_text` (substring, auto-waiting); `expect: count(<selector>, >=N)` (`>= <= == != > <`) → a manual `_n = locator.count(); assert _n >= N` (Playwright's `to_have_count` has no comparator). **Bare-integer `count(sel, 3)` / `count(sel, 0)` stay on `to_have_count` (byte-identical).** Parsing is in `_format_assertion` (generator.py); each form is one `{% elif %}` branch in the shared `assert_body(...)` macro (`templates/test_scenario.py.j2`), which both `expect:` sites — the standalone `- action: assert` step and an `expect:` riding on another action — render. The historical "edit both assert blocks in both template trees" rule is gone.
+- **`assert` `contains` / comparator `count`**: `expect: contains(<selector>, "text")` → Playwright `to_contain_text` (substring, auto-waiting); `expect: count(<selector>, >=N)` (`>= <= == != > <`) → `_wait_until(locator, "count:>=N", <step timeout>, message=...)`, the same poll `wait-for until: count:` uses (Playwright's `to_have_count` has no comparator, and a one-shot `.count()` read 0 on a list still loading). `migrate/verify.SUBSTITUTIONS["count"]` names `_wait_until`, or the assert-count codemod rule stops verifying. **Bare-integer `count(sel, 3)` / `count(sel, 0)` stay on `to_have_count` (byte-identical).** Parsing is in `_format_assertion` (generator.py); each form is one `{% elif %}` branch in the shared `assert_body(...)` macro (`templates/test_scenario.py.j2`), which both `expect:` sites — the standalone `- action: assert` step and an `expect:` riding on another action — render. The historical "edit both assert blocks in both template trees" rule is gone.
 - **`match` / `within` locator disambiguation** (Cmd 6, P1): `click`/`hover`/`wait-for`/`assert` gain optional `within: <scope-selector>` and `match: first|last|N` to resolve a selector that hits >1 element (the strict-mode escape that drove ~2,300 `.first`/`.nth` custom blocks). Codegen only switches from the string form (`page.click(sel)`) to the locator chain (`page.locator(within).locator(sel).nth(i).click()`) **when `within`/`match` is present** — absent ⇒ byte-identical. A shared Jinja macro `disambig_locator(role, selector, step)` (top of `test_scenario.py.j2`) emits the chain; the assert block reuses it once via `{% set _aloc %}` across all selector-based subtypes. `match` parsing is the `format_match_suffix` filter (generator.py). For guide-mode bbox, `_safe_bbox_locator(page, locator)` (conftest, both trees) measures the resolved locator; `wait-for` switches to `locator.wait_for(...)` (keeps `state:`). Touch points: `within`/`match` fields + `validate_match_within` (models.py); the four action blocks in `templates/test_scenario.py.j2`; no `schema.ts` change (runtime-only).
 - **`confirm` action** (Cmd 2, P1): clicks a confirmation-dialog button (PrimeNG `p-confirmDialog`, whose accept/reject buttons have no `data-testid`). Default = accept the active (`.last`) overlay; `variant: reject`, `danger: true`, or `button: "<label>"` (filter by visible text, mutually exclusive with variant/danger) pick a different button. Selectors come from the `dialog:` config preset (`DialogConfig`, PrimeNG defaults, so it works with no config). The cursor auto-targets the resolved button via `_safe_bbox_locator` (no `step.selector`; guide bbox flows from the sidecar). Touch points: see **Adding a new action** above, plus `variant`/`button`/`danger` + `validate_confirm_fields` and `DialogConfig` on `SteppyConfig` (models.py). `confirm` is the one entry in `_NO_SELECTOR_CURSOR` (guide.py) — it resolves its button imperatively, so the cursor rides on the sidecar bbox alone.
 - **`fill-date` action** (Cmd 3, P1): computes a relative/dynamic date **at test run time** (so tests stay valid forever) and types it into a date input via `press_sequentially` + `Tab` (fires Angular `ngModelChange`). `date:` grammar = `today | this-<weekday> | next-<weekday> | ±N[d|w|m|y] | YYYY-MM-DD`; `format:` defaults to `%d/%m/%Y`. The runtime helper `_resolve_date(expr, fmt)` lives in `conftest.py.j2` (both trees) — plain Python (calendar/datetime), unit-tested by extracting its source. `method: calendar` is reserved for the future `pick-date` action (Cmd 7) and currently rejected. Touch points: see **Adding a new action** above, plus the `date`/`format`/`method` fields, `validate_fill_date_fields` (models.py, which now only rejects `method: calendar`) and the `_resolve_date` conftest helper.

{steppy_dev-0.3.0 → steppy_dev-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: steppy-dev
-Version: 0.3.0
+Version: 0.4.0
 Summary: Generate Playwright pytest suites from Markdown scenarios, and turn their screenshots into multi-locale user guides
 Project-URL: Homepage, https://github.com/Steppy-dev/steppy
 Project-URL: Source, https://github.com/Steppy-dev/steppy
@@ -399,6 +399,7 @@ See [In-app tours](#in-app-tours-opt-in-1) below.
 
 ```bash
 steppy auth login editor                      # interactive (headed) login
+steppy auth login editor --auto               # headless, with a form role's credentials (CI, scripts)
 steppy auth status                           # cached session state per role
 steppy auth clear                            # clear everything
 steppy auth clear editor                      # clear a single role

{steppy_dev-0.3.0 → steppy_dev-0.4.0}/README.md

@@ -354,6 +354,7 @@ See [In-app tours](#in-app-tours-opt-in-1) below.
 
 ```bash
 steppy auth login editor                      # interactive (headed) login
+steppy auth login editor --auto               # headless, with a form role's credentials (CI, scripts)
 steppy auth status                           # cached session state per role
 steppy auth clear                            # clear everything
 steppy auth clear editor                      # clear a single role

{steppy_dev-0.3.0 → steppy_dev-0.4.0}/SECURITY.md

@@ -55,7 +55,15 @@ Hardening:
   fills the role's credentials, submits, handles an optional consent screen, and
   waits for the redirect. Works against **any IdP with a fillable login form**
   (Auth0, Keycloak, …). The three selectors live under global `auth.form:` and
-  can be filled at once with an IdP `preset:` (`auth0` | `keycloak`). *(The old
+  can be filled at once with an IdP `preset:` (`auth0` | `keycloak`). Three
+  optional keys shape the flow around them: `login_path` (where automatic login
+  starts, default `/`) and `start_selector` (a "Log in" button on the app's own
+  page, clicked when it shows up before the provider), and
+  `post_login_url_pattern` (the URL glob that means "logged in"; without it the
+  login waits for any page under the app's `url`, which a provider served on the
+  same origin already matches). After submitting, it waits for
+  `timing.navigate_wait`, so an app that holds an EventSource or WebSocket open
+  can use `domcontentloaded` or `none`. *(The old
   name `auth0` — both the mode and the `auth0-login` step action — is a
   kept-forever deprecated alias.)*
 - **`storage-state`** — reuse a Playwright storage-state file you captured out of
@@ -69,9 +77,11 @@ Hardening:
 **Flows without a scriptable form** — SAML / corporate SSO with conditional
 access, magic-link email, or CAPTCHA — are not automatable headlessly by design.
 The supported answer is a **one-time headed login**: run `steppy auth login`,
-complete the challenge in the visible browser, and Steppy caches the storage
-state (subject to `auth.storage_state_ttl`). This is the same posture Playwright
-itself recommends. TOTP-based MFA automation (via a shared secret) is a possible
+complete the challenge in the visible browser, press Enter, and Steppy caches the
+storage state (subject to `auth.storage_state_ttl`) once the browser has left the
+login page. This is the same posture Playwright itself recommends. A `form` role
+needs no person at all: `steppy auth login <role> --auto` logs in headless with
+its configured credentials, which also works where there is no terminal. TOTP-based MFA automation (via a shared secret) is a possible
 future opt-in, not shipped today.
 
 ## `capture from.type=shell` — command execution

{steppy_dev-0.3.0 → steppy_dev-0.4.0}/STEPPY-REFERENCE.md

@@ -86,7 +86,7 @@ guide:
 | `tags` | list of strings | `[]` | Free-form. `user-guide-<role>` tags drive guide discovery; `--tag X` filters runs. |
 | `priority` | `critical` \| `high` \| `medium` \| `low` | — | Metadata only. |
 | `auth` | bool | `true` | `false` = the scenario tests the login flow itself (no pre-auth fixture). |
-| `timeout` | int (ms) | — | Per-scenario timeout hint. |
+| `timeout` | int (ms) | — | Default timeout for **each step** of this scenario (a step's own `timeout:` wins; `timing.step_timeout` applies when neither is set). Not a limit on the whole test: `steppy validate` warns above 60000. |
 | `layouts` | list of strings | — | Viewports this scenario must pass in (keys of `screenshot.layouts`). **Authoritative**: even a plain `steppy run` parametrizes the whole flow over these; `--layouts`/`--guide` filters the declared set (disjoint ⇒ the scenario is deselected). Omit ⇒ no scenario-level layout dimension (unchanged behavior). Composes with the step-level `layouts:` in §3. |
 | `exclusive` | string | — | Exclusion group. Two scenarios naming the same group never run **at the same time** under `steppy run --workers N`; different groups still run concurrently. Lowercase `[a-z0-9._+-]`, starting alphanumeric (the name becomes a filename). Promises non-overlap only — not ordering, not indivisibility. Inert without `--workers N ≥ 2`, where one pytest process is already sequential. |
 | `seed` | string \| object | — | Seed script to run around the test. String `base` ≡ `{script: base, run: before}`. `run` = `before` \| `after` \| `both`. Scripts live in `seed/<script>.py`. |
@@ -378,7 +378,11 @@ Keycloak, …). `auth0-login` is a kept-forever deprecated alias.
 
 > **Auth modes:** `apps.<role>.auth.mode` is `form` \| `storage-state` \| `bypass` \| `token`
 > (`auth0` is a deprecated alias for `form`). The `form` selectors live under global
-> `auth.form:` and accept an IdP `preset:` (`auth0` \| `keycloak`). `token` mode fetches a
+> `auth.form:` and accept an IdP `preset:` (`auth0` \| `keycloak`). Optional
+> `login_path` + `start_selector` get automatic login past the app's own "Log in" page,
+> `post_login_url_pattern` names the URL that means "logged in" (default: any page
+> under the app's `url`), and the post-submit wait follows `timing.navigate_wait`.
+> The `login` step clicks `start_selector` too when that page is showing. `token` mode fetches a
 > JWT from an endpoint and injects it via `inject_as: localStorage | cookie | header`.
 > For SAML / corporate SSO with conditional access, magic links, or CAPTCHA, use the
 > one-time headed `steppy auth login` + storage-state TTL (see SECURITY.md).
@@ -402,7 +406,7 @@ arguments accept the same `within`/`match` disambiguation as element actions.
 | `contains(selector, "expected")` | `to_contain_text` (substring, auto-waiting). |
 | `url-contains("/path")` | URL matches `.*<path>.*`. |
 | `count(selector, N)` | `to_have_count(N)` (exact integer). |
-| `count(selector, >=N)` | Manual `assert` with a comparator: `>=` `<=` `==` `!=` `>` `<`. |
+| `count(selector, >=N)` | Re-counts until the comparison holds (`>=` `<=` `==` `!=` `>` `<`), within the step timeout. `<`/`<=` hold at once on an empty page. |
 | `row-contains("text")` | A `text="text"` element is visible. |
 | `status("value")` | Status-badge text check. |
 

{steppy_dev-0.3.0 → steppy_dev-0.4.0}/config.yaml

@@ -59,8 +59,16 @@ auth:
     username_selector: "input[name='username'], input[name='email'], #username"
     password_selector: "input[name='password'], #password"
     submit_selector: "button[type='submit'], button[name='action'][value='default']"
-    post_login_url_pattern: "**/callback**"
     consent_selector: null
+    # Where the login ends (a URL glob). Unset, Steppy waits for any page under
+    # the app's url — which a provider on the app's own origin (Keycloak behind
+    # the same proxy) already matches, so set it there.
+    #   post_login_url_pattern: "**/home**"
+    # When the app shows its own page with a "Log in" button before the
+    # provider: where automatic login starts, and the button to click.
+    #   login_path: /auth
+    #   start_selector: "[data-testid='login-button']"
+    # After submitting, login waits for timing.navigate_wait (none = no wait).
     # TOTP/MFA (optional): set totp_selector here and a per-app
     # credentials.totp_secret (env-ref) to auto-fill a time-based one-time code
     # after the password submit. The auth0/keycloak presets fill a starter

{steppy_dev-0.3.0 → steppy_dev-0.4.0}/fixtures/demo-guide/package-lock.json

@@ -13,7 +13,7 @@
       }
     },
     "../../packages/steppy": {
-      "version": "0.3.0",
+      "version": "0.4.0",
       "dev": true,
       "license": "Apache-2.0"
     },

{steppy_dev-0.3.0 → steppy_dev-0.4.0}/fixtures/tour-demo-angular/app/package-lock.json

@@ -34,7 +34,7 @@
     },
     "../../../packages/angular/dist": {
       "name": "@steppy/angular",
-      "version": "0.3.0",
+      "version": "0.4.0",
       "license": "Apache-2.0",
       "dependencies": {
         "tslib": "^2.3.0"
@@ -43,13 +43,13 @@
         "@angular/common": ">=20.0.0 <23.0.0",
         "@angular/core": ">=20.0.0 <23.0.0",
         "@angular/router": ">=20.0.0 <23.0.0",
-        "@steppy/player": "0.3.0",
+        "@steppy/player": "0.4.0",
         "rxjs": "^7.4.0"
       }
     },
     "../../../packages/player": {
       "name": "@steppy/player",
-      "version": "0.3.0",
+      "version": "0.4.0",
       "license": "Apache-2.0",
       "dependencies": {
         "lit": "^3.2.0",

{steppy_dev-0.3.0 → steppy_dev-0.4.0}/packages/angular/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@steppy/angular",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@steppy/angular",
-      "version": "0.3.0",
+      "version": "0.4.0",
       "license": "Apache-2.0",
       "dependencies": {
         "tslib": "^2.3.0"
@@ -32,13 +32,13 @@
         "@angular/common": ">=20.0.0 <23.0.0",
         "@angular/core": ">=20.0.0 <23.0.0",
         "@angular/router": ">=20.0.0 <23.0.0",
-        "@steppy/player": "0.3.0",
+        "@steppy/player": "0.4.0",
         "rxjs": "^7.4.0"
       }
     },
     "../player": {
       "name": "@steppy/player",
-      "version": "0.3.0",
+      "version": "0.4.0",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {

{steppy_dev-0.3.0 → steppy_dev-0.4.0}/packages/angular/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@steppy/angular",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Angular adapter for the Steppy in-app tour overlay: provideSteppyTours(), <steppy-tours> and the SteppyTours service",
   "license": "Apache-2.0",
   "repository": {
@@ -23,7 +23,7 @@
     "@angular/common": ">=20.0.0 <23.0.0",
     "@angular/core": ">=20.0.0 <23.0.0",
     "@angular/router": ">=20.0.0 <23.0.0",
-    "@steppy/player": "0.3.0",
+    "@steppy/player": "0.4.0",
     "rxjs": "^7.4.0"
   },
   "dependencies": {

{steppy_dev-0.3.0 → steppy_dev-0.4.0}/packages/player/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@steppy/player",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@steppy/player",
-      "version": "0.3.0",
+      "version": "0.4.0",
       "license": "Apache-2.0",
       "dependencies": {
         "lit": "^3.2.0",

{steppy_dev-0.3.0 → steppy_dev-0.4.0}/packages/player/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@steppy/player",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Steppy players — the interactive guide (Lit web component + manifest validator) and the in-app tour overlay",
   "license": "Apache-2.0",
   "repository": {

{steppy_dev-0.3.0 → steppy_dev-0.4.0}/packages/react/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@steppy/react",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@steppy/react",
-      "version": "0.3.0",
+      "version": "0.4.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@steppy/player": "file:../player"
@@ -27,7 +27,7 @@
     },
     "../player": {
       "name": "@steppy/player",
-      "version": "0.3.0",
+      "version": "0.4.0",
       "license": "Apache-2.0",
       "dependencies": {
         "lit": "^3.2.0",

{steppy_dev-0.3.0 → steppy_dev-0.4.0}/packages/react/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@steppy/react",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Thin React wrapper around the Steppy <steppy-guide> web component",
   "type": "module",
   "main": "./dist/index.js",

{steppy_dev-0.3.0 → steppy_dev-0.4.0}/packages/steppy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "steppy",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "TypeScript types and config helper for Steppy guide builds",
   "type": "module",
   "main": "./index.js",

{steppy_dev-0.3.0 → steppy_dev-0.4.0}/packages/vue/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@steppy/vue",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@steppy/vue",
-      "version": "0.3.0",
+      "version": "0.4.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@steppy/player": "file:../player"
@@ -24,7 +24,7 @@
     },
     "../player": {
       "name": "@steppy/player",
-      "version": "0.3.0",
+      "version": "0.4.0",
       "license": "Apache-2.0",
       "dependencies": {
         "lit": "^3.2.0",

{steppy_dev-0.3.0 → steppy_dev-0.4.0}/packages/vue/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@steppy/vue",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Thin Vue 3 wrapper around the Steppy <steppy-guide> web component",
   "type": "module",
   "main": "./dist/index.js",

{steppy_dev-0.3.0 → steppy_dev-0.4.0}/pyproject.toml

@@ -2,7 +2,7 @@
 # `steppy` on PyPI is an unrelated project. The import package and the command
 # stay `steppy`; `steppy.DISTRIBUTION` must match this name.
 name = "steppy-dev"
-version = "0.3.0"
+version = "0.4.0"
 description = "Generate Playwright pytest suites from Markdown scenarios, and turn their screenshots into multi-locale user guides"
 readme = "README.md"
 # PEP 639 SPDX expression; needs hatchling>=1.27 (pinned in [build-system]).

{steppy_dev-0.3.0 → steppy_dev-0.4.0}/skills/steppy-ci-report/SKILL.md

@@ -64,7 +64,7 @@ ships, called by ref:
 ```yaml
 jobs:
   e2e:
-    uses: Steppy-dev/steppy/.github/workflows/steppy-e2e.yml@v0.3.0
+    uses: Steppy-dev/steppy/.github/workflows/steppy-e2e.yml@v0.4.0
     with:
       compose-file: docker-compose.yml
     secrets:

{steppy_dev-0.3.0 → steppy_dev-0.4.0}/skills/steppy-scenario-author/SKILL.md

@@ -46,7 +46,7 @@ tags:                                             # optional; enables filtering
 seed: base                    # optional; string or {script, run}
 priority: critical            # optional; critical|high|medium|low
 auth: true                    # default true; set false ONLY for login-flow scenarios
-timeout: 30000                # optional; scenario-level timeout in ms
+timeout: 30000                # optional; default timeout (ms) for EACH step, not a whole-test limit
 layouts:                      # optional; viewports this flow must pass in (keys of screenshot.layouts)
   - desktop
   - mobile
@@ -397,7 +397,10 @@ whose surrounding text varies — it replaces the old `assert "X" in el.inner_te
 **`count(...)` comparators**: the second argument accepts `>= <= == != > <` (e.g.
 `count(.row, >=1)`, `count(.row, !=0)`). A **bare integer** (`count(.row, 3)`) keeps the exact
 `to_have_count` check. The dominant uses are `>=1` ("at least one row appeared") and `0` ("the
-row was removed"). Interpolation works in the selector: `contains([data-testid="item-{{record_id}}"], "...")`.
+row was removed"). Like every other assertion, a comparator **waits** — it re-counts until the
+comparison holds or the step's timeout (`timeout:` → scenario `timeout:` → `timing.step_timeout`)
+runs out. So `<` and `<=`, like `count(.row, 0)`, pass at once on a list that has not rendered
+yet: assert something that proves the page loaded first. Interpolation works in the selector: `contains([data-testid="item-{{record_id}}"], "...")`.
 
 ---
 
@@ -982,7 +985,7 @@ The authoring loop is `validate` → `generate` → `run` → `guide` / `build`.
 | `steppy record [URL]` | Bootstrap a **draft** scenario from a live click-through (see Workflow step 1) |
 | `steppy seed <name>` | Run one seed script by hand, outside a test run |
 | `steppy rerun` | Re-run only the previously failed tests |
-| `steppy auth login \| status \| clear` | Interactive login for a role, inspect cached sessions, clear `.auth/` |
+| `steppy auth login \| status \| clear` | Log in for a role (headed by hand, or `--auto`: headless with a form role's credentials, no terminal needed), inspect cached sessions, clear `.auth/` |
 | `steppy flaky` | Rank scenarios by flake rate across recent parallel runs |
 | `steppy stacks cleanup` | Rescue command: tear down orphaned `steppy-run-*` Compose projects left by a force-killed parallel run |
 | `steppy video check \| cache` | Preflight and cache management for narrated video (see Narrated video guides) |

{steppy_dev-0.3.0 → steppy_dev-0.4.0}/src/steppy/__init__.py

@@ -1,6 +1,6 @@
 """Steppy - A Python CLI for generating Playwright tests from Markdown scenarios."""
 
-__version__ = "0.3.0"
+__version__ = "0.4.0"
 
 # The name pip installs this package under. `steppy` on PyPI belongs to an
 # unrelated project, so the distribution is `steppy-dev` while the import