@pikku/core 0.12.47 → 0.12.49

package/src/services/http-user-flow-actors.ts

@@ -0,0 +1,128 @@
+import type {
+  UserFlowActor,
+  UserFlowActorConfig,
+  UserFlowActors,
+} from './user-flow-actors-service.js'
+
+export interface HttpUserFlowActorsConfig {
+  /**
+   * Base API URL of the target app, INCLUDING the HTTP prefix — e.g.
+   * `https://app.example.com/api` or `http://localhost:4000/api`. Actor
+   * sign-in is reached at `${apiUrl}${signInPath}` and exposed RPCs at
+   * `${apiUrl}${rpcPath}/:rpcName`.
+   */
+  apiUrl: string
+  /**
+   * The actor impersonation secret. Sign-in only ever works for user rows
+   * flagged `actor: true` — knowing the secret never impersonates real users.
+   */
+  secret: string
+  /** Actor name → config (usually from pikku.config.json's actor registry). */
+  actors: Record<string, UserFlowActorConfig>
+  /** Sign-in path under apiUrl. Default: the actor plugin's `/auth/sign-in/actor`. */
+  signInPath?: string
+  /** Exposed-RPC path prefix under apiUrl. Default `/rpc`. */
+  rpcPath?: string
+}
+
+/**
+ * Default HTTP-backed actor. Signs in lazily on first invoke via the Better
+ * Auth actor plugin (`POST /auth/sign-in/actor` with `{ email, secret }` —
+ * the plugin upserts the actor-flagged user row and mints a session whose
+ * `actor` flag flows into audits/analytics). Holds the session cookies for
+ * its lifetime; a 401 mid-run re-logs-in once (long health-check runs can
+ * outlive a session).
+ */
+export class HttpUserFlowActor implements UserFlowActor {
+  private cookie: string | null = null
+  private origin: string
+
+  constructor(
+    readonly name: string,
+    private actorConfig: UserFlowActorConfig,
+    private config: HttpUserFlowActorsConfig
+  ) {
+    this.origin = new URL(config.apiUrl).origin
+  }
+
+  async invoke(rpcName: string, data: unknown): Promise<unknown> {
+    const cookie = this.cookie ?? (await this.login())
+    const res = await this.postRpc(rpcName, data, cookie)
+    if (res.status === 401) {
+      // Session expired mid-run — re-login once and retry.
+      this.cookie = null
+      return this.readRpcResponse(rpcName, await this.postRpc(rpcName, data, await this.login()))
+    }
+    return this.readRpcResponse(rpcName, res)
+  }
+
+  private async postRpc(rpcName: string, data: unknown, cookie: string) {
+    const rpcPath = this.config.rpcPath ?? '/rpc'
+    return fetch(`${this.config.apiUrl}${rpcPath}/${rpcName}`, {
+      method: 'POST',
+      headers: {
+        'content-type': 'application/json',
+        origin: this.origin,
+        cookie,
+      },
+      body: JSON.stringify({ data }),
+    })
+  }
+
+  private async readRpcResponse(rpcName: string, res: Response) {
+    if (!res.ok) {
+      const body = (await res.text().catch(() => '')).slice(0, 300)
+      throw new Error(
+        `[user-flow] '${rpcName}' as '${this.name}' returned ${res.status}: ${body}`
+      )
+    }
+    if (res.status === 204) return undefined
+    const text = await res.text()
+    return text ? JSON.parse(text) : undefined
+  }
+
+  private async login(): Promise<string> {
+    const signInPath = this.config.signInPath ?? '/auth/sign-in/actor'
+    const res = await fetch(`${this.config.apiUrl}${signInPath}`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json', origin: this.origin },
+      body: JSON.stringify({
+        email: this.actorConfig.email,
+        name: this.actorConfig.name ?? this.name,
+        secret: this.config.secret,
+      }),
+    })
+    if (!res.ok) {
+      const body = (await res.text().catch(() => '')).slice(0, 300)
+      throw new Error(
+        `[user-flow] actor sign-in failed for '${this.name}' (${res.status}): ${body}`
+      )
+    }
+    const setCookies = res.headers.getSetCookie?.() ?? []
+    const cookie = setCookies
+      .map((c) => c.split(';')[0]!)
+      .filter(Boolean)
+      .join('; ')
+    if (!cookie) {
+      throw new Error(
+        `[user-flow] actor sign-in for '${this.name}' returned no session cookie`
+      )
+    }
+    this.cookie = cookie
+    return cookie
+  }
+}
+
+/**
+ * Build the injected `actors` service from the config registry: actor name →
+ * lazy HTTP actor. Wire the result as the `actors` singleton service.
+ */
+export function createHttpUserFlowActors(
+  config: HttpUserFlowActorsConfig
+): UserFlowActors {
+  const actors: UserFlowActors = {}
+  for (const [name, actorConfig] of Object.entries(config.actors)) {
+    actors[name] = new HttpUserFlowActor(name, actorConfig, config)
+  }
+  return actors
+}

package/src/services/index.ts

@@ -36,6 +36,16 @@ export type {
   WriteFileArgs,
   CopyFileArgs,
 } from './content-service.js'
+export type {
+  UserFlowActor,
+  UserFlowActorConfig,
+  UserFlowActors,
+} from './user-flow-actors-service.js'
+export {
+  HttpUserFlowActor,
+  createHttpUserFlowActors,
+  type HttpUserFlowActorsConfig,
+} from './http-user-flow-actors.js'
 export type { JWTService } from './jwt-service.js'
 export type {
   EmailService,

package/src/services/user-flow-actors-service.ts

@@ -0,0 +1,29 @@
+/**
+ * A user-flow actor: a synthetic user (a normal user row flagged `actor`) that
+ * workflow steps can run as. Passed to `workflow.do(step, rpc, data, { actor })`
+ * — the step then goes through the actor's authenticated client over the REAL
+ * transport (auth middleware, permissions, serialization all exercised),
+ * never through internal dispatch. Login is lazy: the first `invoke` signs the
+ * actor in and the session is cached for the actor's lifetime.
+ */
+export interface UserFlowActor {
+  /** Stable actor name (the key in pikku.config.json's actor registry). */
+  readonly name: string
+  /** Invoke an exposed RPC as this actor over the real transport. */
+  invoke(rpcName: string, data: unknown): Promise<unknown>
+}
+
+/**
+ * Display/config metadata for an actor (from pikku.config.json). The email
+ * identifies the actor's user row; personality/jobTitle exist for the console
+ * screen and for agent-driven flows (the agent plays the persona).
+ */
+export interface UserFlowActorConfig {
+  email: string
+  name?: string
+  jobTitle?: string
+  personality?: string
+}
+
+/** The injected `actors` service: actor name → actor. */
+export type UserFlowActors = Record<string, UserFlowActor>

package/src/types/core.types.ts

@@ -29,6 +29,7 @@ import type { DeploymentService } from '../services/deployment-service.js'
 import type { AIStorageService } from '../services/ai-storage-service.js'
 
 import type { ContentService } from '../services/content-service.js'
+import type { UserFlowActors } from '../services/user-flow-actors-service.js'
 import type { AIAgentRunnerService } from '../services/ai-agent-runner-service.js'
 import type { AIRunStateService } from '../services/ai-run-state-service.js'
 import type { AgentRunService } from '../wirings/ai-agent/ai-agent.types.js'
@@ -243,6 +244,8 @@ export type CoreConfig<Config extends Record<string, unknown> = {}> = {
 export interface CoreUserSession {
   userId?: string
   orgId?: string
+  /** True when the session belongs to a synthetic user-flow actor — lets audits/analytics address synthetic traffic */
+  actor?: boolean
 }
 
 /**
@@ -336,6 +339,8 @@ export type PikkuWire<
   queue: PikkuQueue
   cli: PikkuCLI
   workflow: TypedWorkflow
+  /** User-flow actor registry (user-flow runs only) — pass into workflow.do as `{ actor: actors.x }` */
+  actors: UserFlowActors
   workflowStep: WorkflowStepWire
   graph: PikkuGraphWire
   trigger: PikkuTrigger<TriggerOutput>

package/src/wirings/workflow/dsl/workflow-dsl.types.ts

@@ -4,6 +4,7 @@
  */
 
 import type { WorkflowRun } from '../workflow.types.js'
+import type { UserFlowActor } from '../../../services/user-flow-actors-service.js'
 
 /**
  * Workflow step options
@@ -15,9 +16,27 @@ export interface WorkflowStepOptions {
   retries?: number
   /** Delay between retry attempts (e.g., '1s', '2s', '2min') */
   retryDelay?: string | number
+  /**
+   * Run this step as an actor (user flows). The RPC is sent through the
+   * actor's authenticated client over the REAL transport — never dispatched
+   * internally — so auth middleware and permissions are exercised end-to-end.
+   * The step is recorded durably like any RPC step.
+   */
+  actor?: UserFlowActor
   // Future: timeout, failFast, priority
 }
 
+/**
+ * Options for workflow.expectEventually() — a durable polling step used by
+ * user flows to await async effects (a notification landing, a job finishing).
+ */
+export interface WorkflowExpectEventuallyOptions extends WorkflowStepOptions {
+  /** Give up after this long (e.g. '30s'). Default '30s'. */
+  within?: string | number
+  /** Poll interval (e.g. '1s'). Default '1s'. */
+  interval?: string | number
+}
+
 /**
  * Type signature for workflow.do() RPC form - used by inspector
  */
@@ -346,6 +365,18 @@ export interface PikkuWorkflowWire {
   /** Execute a workflow step (overloaded - RPC or inline form) */
   do: WorkflowWireDoRPC & WorkflowWireDoInline
 
+  /**
+   * Durable polling step (user flows): invoke `rpcName` (as an actor when
+   * `options.as` is set) until `predicate` passes or `options.within` elapses.
+   */
+  expectEventually: <TOutput = any, TInput = any>(
+    stepName: string,
+    rpcName: string,
+    data: TInput,
+    predicate: (output: TOutput) => boolean,
+    options?: WorkflowExpectEventuallyOptions
+  ) => Promise<TOutput>
+
   /** Sleep for a duration */
   sleep: WorkflowWireSleep
 

package/src/wirings/workflow/pikku-workflow-service.ts

@@ -58,6 +58,7 @@ import type {
   WorkflowVersionStatus,
   WorkflowServiceConfig,
   WorkflowStepOptions,
+  WorkflowExpectEventuallyOptions,
 } from './workflow.types.js'
 import {
   continueGraph,
@@ -66,6 +67,7 @@ import {
   runFromMeta,
 } from './graph/graph-runner.js'
 import type { WorkflowService } from '../../services/workflow-service.js'
+import type { UserFlowActors } from '../../services/user-flow-actors-service.js'
 import {
   PikkuError,
   addError,
@@ -218,6 +220,9 @@ const WORKFLOW_END_STATES: ReadonlySet<string> = new Set([
  */
 export abstract class PikkuWorkflowService implements WorkflowService {
   private inlineRuns = new Set<string>()
+  // User-flow actors per run: live authenticated clients (cookie jars) are
+  // process-local by nature, so they ride this map, never the persisted wire.
+  private runActors = new Map<string, UserFlowActors>()
 
   protected get logger() {
     return getSingletonServices()?.logger
@@ -1071,7 +1076,7 @@ export abstract class PikkuWorkflowService implements WorkflowService {
     input: I,
     wire: WorkflowRunWire,
     rpcService: any,
-    options?: { inline?: boolean; startNode?: string }
+    options?: { inline?: boolean; startNode?: string; actors?: UserFlowActors }
   ): Promise<{ runId: string }> {
     // Resolve workflow from static meta (root or addon namespace), then dynamic DB
     const resolved = resolveWorkflowMeta(name)
@@ -1135,6 +1140,10 @@ export abstract class PikkuWorkflowService implements WorkflowService {
       }
     )
 
+    if (options?.actors) {
+      this.runActors.set(runId, options.actors)
+    }
+
     if (shouldInline) {
       this.inlineRuns.add(runId)
       try {
@@ -1170,6 +1179,7 @@ export abstract class PikkuWorkflowService implements WorkflowService {
         }
       } finally {
         this.inlineRuns.delete(runId)
+        this.runActors.delete(runId)
       }
     } else {
       await this.resumeWorkflow(runId)
@@ -1341,8 +1351,10 @@ export abstract class PikkuWorkflowService implements WorkflowService {
       const wire: PikkuWire = {
         workflow: workflowWire,
         pikkuUserId: run.wire?.pikkuUserId,
-        session: rpcService.wire?.session,
-        rpc: rpcService.wire?.rpc,
+        session: rpcService?.wire?.session,
+        rpc: rpcService?.wire?.rpc,
+        // User-flow actors registered for this run (see startWorkflow options)
+        actors: this.runActors.get(runId),
       }
       try {
         const result = await runPikkuFunc(
@@ -1760,6 +1772,7 @@ export abstract class PikkuWorkflowService implements WorkflowService {
     const resolvedStepOptions: WorkflowStepOptions = {
       retries: stepOptions?.retries ?? DEFAULT_STEP_RETRIES,
       retryDelay: stepOptions?.retryDelay,
+      actor: stepOptions?.actor,
     }
     // Check if step already exists
     let stepState: StepState
@@ -1807,14 +1820,18 @@ export abstract class PikkuWorkflowService implements WorkflowService {
     // so the orchestrator's next replay re-dispatches it. Marking `scheduled`
     // first would strand the step (replay sees `scheduled`, pauses, never
     // re-enqueues the job that was never created).
-    const dispatched = await this.dispatchStep(
-      runId,
-      stepName,
-      rpcName,
-      data,
-      resolvedStepOptions,
-      fromStepName
-    )
+    // Actor steps never queue: they are outbound HTTP calls made by the
+    // runner itself, and the actor's session lives on this process.
+    const dispatched = resolvedStepOptions.actor
+      ? false
+      : await this.dispatchStep(
+          runId,
+          stepName,
+          rpcName,
+          data,
+          resolvedStepOptions,
+          fromStepName
+        )
     if (dispatched) {
       await this.setStepScheduled(stepState.stepId)
       throw new WorkflowAsyncException(runId, stepName)
@@ -1830,6 +1847,12 @@ export abstract class PikkuWorkflowService implements WorkflowService {
       retries,
       retryDelay,
       async (currentStepState) => {
+        // Actor step: send through the actor's authenticated client over the
+        // REAL transport. Never falls back to internal dispatch — that would
+        // bypass auth and fake a green health check.
+        if (resolvedStepOptions.actor) {
+          return resolvedStepOptions.actor.invoke(rpcName, data)
+        }
         // Check if the name refers to a workflow
         const workflowMeta = pikkuState(null, 'workflows', 'meta')[rpcName]
         if (workflowMeta) {
@@ -2119,6 +2142,48 @@ export abstract class PikkuWorkflowService implements WorkflowService {
         }
       },
 
+      // Durable polling step: invoke an RPC (as an actor when options.as is
+      // set) until the predicate passes or `within` elapses. The whole poll is
+      // ONE recorded step, so replay returns the cached outcome.
+      expectEventually: async (
+        stepName: string,
+        rpcName: string,
+        data: any,
+        predicate: (output: any) => boolean,
+        options?: WorkflowExpectEventuallyOptions
+      ) => {
+        this.verifyStepName(stepName)
+        const resolvedRpcName =
+          addonNamespace && !rpcName.includes(':')
+            ? `${addonNamespace}:${rpcName}`
+            : rpcName
+        const within = getDurationInMilliseconds(options?.within ?? '30s')
+        const interval = getDurationInMilliseconds(options?.interval ?? '1s')
+        return await this.inlineStep(
+          runId,
+          stepName,
+          async () => {
+            const deadline = Date.now() + within
+            let last: any
+            while (true) {
+              last = options?.actor
+                ? await options.actor.invoke(resolvedRpcName, data)
+                : await rpcService.rpcWithWire(resolvedRpcName, data, {})
+              if (predicate(last)) return last
+              if (Date.now() + interval > deadline) {
+                throw new Error(
+                  `[workflow] expectEventually '${stepName}' ('${resolvedRpcName}'` +
+                    `${options?.actor ? ` as '${options.actor.name}'` : ''}) did not pass within ${within}ms; ` +
+                    `last result: ${JSON.stringify(last)?.slice(0, 300)}`
+                )
+              }
+              await new Promise((resolve) => setTimeout(resolve, interval))
+            }
+          },
+          options
+        )
+      },
+
       // Implement workflow.sleep()
       sleep: async (stepName: string, duration: string | number) => {
         this.verifyStepName(stepName)

package/src/wirings/workflow/user-flow-step.test.ts

@@ -0,0 +1,192 @@
+import { describe, test, beforeEach } from 'node:test'
+import assert from 'node:assert/strict'
+
+import { InMemoryWorkflowService } from '../../services/in-memory-workflow-service.js'
+import { pikkuState, resetPikkuState } from '../../pikku-state.js'
+import type { UserFlowActor } from '../../services/user-flow-actors-service.js'
+
+const noopLogger = { error() {}, info() {}, warn() {}, debug() {} }
+
+const fakeActor = (
+  name: string,
+  handler: (rpcName: string, data: unknown) => Promise<unknown>
+): UserFlowActor & { calls: Array<{ rpcName: string; data: unknown }> } => {
+  const calls: Array<{ rpcName: string; data: unknown }> = []
+  return {
+    name,
+    calls,
+    invoke: async (rpcName: string, data: unknown) => {
+      calls.push({ rpcName, data })
+      return handler(rpcName, data)
+    },
+  }
+}
+
+const setup = async (
+  ws: InMemoryWorkflowService,
+  services: Record<string, unknown> = {}
+) => {
+  pikkuState(null, 'package', 'singletonServices', {
+    logger: noopLogger,
+    ...services,
+  } as any)
+  const runId = await ws.createRun('userFlowTest', {}, true, 'hash', {
+    type: 'test',
+  } as any)
+  ws.registerInlineRun(runId)
+  return runId
+}
+
+describe('user-flow actor steps (workflow.do with `actor`)', () => {
+  beforeEach(() => resetPikkuState())
+
+  test('routes through the actor over the real transport, never internal rpc', async () => {
+    const ws = new InMemoryWorkflowService()
+    const customer = fakeActor('customer', async () => ({ todoId: 't1' }))
+    let internalCalls = 0
+
+    const runId = await setup(ws)
+    const rpc = {
+      rpcWithWire: async () => {
+        internalCalls++
+        return {}
+      },
+    }
+
+    const wire = ws.createWorkflowWire('userFlowTest', runId, rpc)
+    const result = await wire.do(
+      'customer creates todo',
+      'createTodo',
+      { title: 'x' },
+      { actor: customer }
+    )
+
+    assert.deepEqual(result, { todoId: 't1' })
+    assert.deepEqual(customer.calls, [
+      { rpcName: 'createTodo', data: { title: 'x' } },
+    ])
+    assert.equal(internalCalls, 0, 'actor steps must NOT dispatch internally')
+  })
+
+  test('step is recorded durably and replay returns the cached result without re-invoking', async () => {
+    const ws = new InMemoryWorkflowService()
+    let invocations = 0
+    const yasser = fakeActor('yasser', async () => ({ n: ++invocations }))
+    const runId = await setup(ws)
+    const wire = ws.createWorkflowWire('userFlowTest', runId, {})
+
+    const first = await wire.do('step', 'someRpc', {}, { actor: yasser })
+    assert.deepEqual(first, { n: 1 })
+
+    // Simulate replay: reset per-run ordinals so the same logical step name
+    // resolves to the same durable step key.
+    ;(ws as any).resetStepOrdinals(runId)
+    const replayWire = ws.createWorkflowWire('userFlowTest', runId, {})
+    const replayed = await replayWire.do('step', 'someRpc', {}, { actor: yasser })
+
+    assert.deepEqual(replayed, { n: 1 }, 'replay must return the cached result')
+    assert.equal(invocations, 1, 'the actor must not be re-invoked on replay')
+  })
+
+  test('actor steps never queue, even when the function is queue-eligible', async () => {
+    const ws = new InMemoryWorkflowService()
+    let queued = 0
+    const customer = fakeActor('customer', async () => ({}))
+    const runId = await setup(ws, {
+      queueService: {
+        add: async () => {
+          queued++
+        },
+      },
+    })
+    // Function meta says this RPC would normally dispatch via the queue.
+    pikkuState(null, 'function', 'meta').queuedRpc = {
+      pikkuFuncId: 'queuedRpc',
+      workflowQueued: true,
+    } as any
+
+    const wire = ws.createWorkflowWire('userFlowTest', runId, {})
+    await wire.do('step', 'queuedRpc', {}, { actor: customer })
+
+    assert.equal(queued, 0, 'actor steps are outbound HTTP — never queued')
+    assert.equal(customer.calls.length, 1)
+  })
+
+  test('actor step failure surfaces the actor error and fails after retries', async () => {
+    const ws = new InMemoryWorkflowService()
+    const broken = fakeActor('broken', async () => {
+      throw new Error("[user-flow] 'createTodo' as 'broken' returned 403: nope")
+    })
+    const runId = await setup(ws)
+    const wire = ws.createWorkflowWire('userFlowTest', runId, {})
+
+    await assert.rejects(
+      wire.do('step', 'createTodo', {}, { actor: broken, retries: 2 }),
+      /returned 403/
+    )
+    assert.equal(broken.calls.length, 2, 'retries bounds total attempts')
+  })
+})
+
+describe('workflow.expectEventually', () => {
+  beforeEach(() => resetPikkuState())
+
+  test('polls as the actor until the predicate passes', async () => {
+    const ws = new InMemoryWorkflowService()
+    let polls = 0
+    const sarah = fakeActor('sarah', async () => ({
+      notifications: ++polls >= 3 ? ['ping'] : [],
+    }))
+    const runId = await setup(ws)
+    const wire = ws.createWorkflowWire('userFlowTest', runId, {})
+
+    const result = await wire.expectEventually(
+      'sarah sees the notification',
+      'getNotifications',
+      {},
+      (out: any) => out.notifications.length > 0,
+      { actor: sarah, within: 2_000, interval: 5 }
+    )
+
+    assert.deepEqual(result, { notifications: ['ping'] })
+    assert.equal(polls, 3)
+  })
+
+  test('fails with the last result when the deadline passes', async () => {
+    const ws = new InMemoryWorkflowService()
+    const sarah = fakeActor('sarah', async () => ({ notifications: [] }))
+    const runId = await setup(ws)
+    const wire = ws.createWorkflowWire('userFlowTest', runId, {})
+
+    await assert.rejects(
+      wire.expectEventually(
+        'never arrives',
+        'getNotifications',
+        {},
+        (out: any) => out.notifications.length > 0,
+        { actor: sarah, within: 30, interval: 5, retries: 0 }
+      ),
+      /did not pass within 30ms.*notifications/
+    )
+  })
+
+  test('polls internally (rpcWithWire) when no actor is given', async () => {
+    const ws = new InMemoryWorkflowService()
+    let polls = 0
+    const runId = await setup(ws)
+    const rpc = {
+      rpcWithWire: async () => ({ ready: ++polls >= 2 }),
+    }
+    const wire = ws.createWorkflowWire('userFlowTest', runId, rpc)
+
+    const result = await wire.expectEventually(
+      'job finishes',
+      'getJob',
+      {},
+      (out: any) => out.ready,
+      { within: 2_000, interval: 5 }
+    )
+    assert.deepEqual(result, { ready: true })
+    assert.equal(polls, 2)
+  })
+})

package/src/wirings/workflow/workflow.types.ts

@@ -7,6 +7,7 @@ export type { WorkflowService } from '../../services/workflow-service.js'
 // Re-export DSL types from dsl module
 export type {
   WorkflowStepOptions,
+  WorkflowExpectEventuallyOptions,
   WorkflowWireDoRPC,
   WorkflowWireDoInline,
   WorkflowWireSleep,
@@ -324,6 +325,10 @@ export type WorkflowsMeta = Record<
     context?: WorkflowContext
     dsl?: boolean
     expose?: boolean
+    /** True for pikkuUserFlow workflows (complex + actor steps). */
+    userFlow?: boolean
+    /** Actor names a user flow declares (personas it runs steps as). */
+    actors?: string[]
   }
 >
 
@@ -337,12 +342,14 @@ export interface WorkflowRuntimeMeta {
   name: string
   /** Pikku function name (for execution) */
   pikkuFuncId: string
-  /** Source type: 'dsl' (serializable), 'complex' (has inline steps), 'graph' */
-  source: 'dsl' | 'complex' | 'graph' | 'dynamic-workflow'
+  /** Source type: 'dsl' (serializable), 'complex' (has inline steps), 'graph', 'user-flow' (complex + actor steps) */
+  source: 'dsl' | 'complex' | 'graph' | 'dynamic-workflow' | 'user-flow'
   /** Optional description */
   description?: string
   /** Tags for organization */
   tags?: string[]
+  /** Actor names a user flow declares (personas it runs steps as). */
+  actors?: string[]
   /** Serialized nodes */
   nodes?: Record<string, any>
   /** Entry node IDs for graph workflows (computed at build time) */