@pikku/core 0.12.80 → 0.12.83

package/dist/internal.d.ts

@@ -1,3 +0,0 @@
-export { pikkuState, resetPikkuState, getAllPackageStates, } from './pikku-state.js';
-export { httpRouter } from './wirings/http/routers/http-router.js';
-export type { CreateSingletonServices, CreateWireServices, } from './types/core.types.js';

package/dist/internal.js

@@ -1,2 +0,0 @@
-export { pikkuState, resetPikkuState, getAllPackageStates, } from './pikku-state.js';
-export { httpRouter } from './wirings/http/routers/http-router.js';

package/dist/middleware/timeout.d.ts

@@ -1,9 +0,0 @@
-export declare const timeout: () => import("../types/core.types.js").CorePikkuMiddlewareFactory<{
-    timeout: number;
-}, import("../types/core.types.js").CoreSingletonServices<{
-    logLevel?: import("../services/logger.js").LogLevel;
-    secrets?: {};
-    workflow?: import("../wirings/workflow/workflow.types.js").WorkflowServiceConfig;
-    webhook?: import("../services/webhook-service.js").WebhookServiceConfig;
-    postgres?: import("../types/core.types.js").PostgresConfig;
-}>, import("../types/core.types.js").CoreUserSession>;

package/dist/middleware/timeout.js

@@ -1,15 +0,0 @@
-import { RequestTimeoutError } from '../errors/errors.js';
-import { pikkuMiddleware, pikkuMiddlewareFactory } from '../types/core.types.js';
-export const timeout = () => pikkuMiddlewareFactory(({ timeout }) => pikkuMiddleware(async (_services, _wire, next) => {
-    let timeoutId;
-    await Promise.race([
-        next(),
-        new Promise((_resolve, reject) => {
-            timeoutId = setTimeout(() => reject(new RequestTimeoutError()), timeout);
-        }),
-    ]).finally(() => {
-        if (timeoutId !== undefined) {
-            clearTimeout(timeoutId);
-        }
-    });
-}));

package/dist/pikku-response.d.ts

@@ -1,6 +0,0 @@
-/**
- * Abstract class representing a pikku response.
- * @group RequestResponse
- */
-export declare abstract class PikkuResponse {
-}

package/dist/pikku-response.js

@@ -1,6 +0,0 @@
-/**
- * Abstract class representing a pikku response.
- * @group RequestResponse
- */
-export class PikkuResponse {
-}

package/dist/services/gopass-secrets.d.ts

@@ -1,15 +0,0 @@
-import type { SecretService } from './secret-service.js';
-/**
- * Service for retrieving secrets from gopass.
- * Requires gopass to be installed and configured on the system.
- */
-export declare class GopassSecretService implements SecretService {
-    private prefix;
-    constructor(prefix?: string);
-    private getFullKey;
-    getSecret<T = string>(key: string): Promise<T>;
-    hasSecret(key: string): Promise<boolean>;
-    setSecret(key: string, value: unknown): Promise<void>;
-    deleteSecret(key: string): Promise<void>;
-    getSecrets<T extends Record<string, unknown> = Record<string, unknown>>(keys: (keyof T & string)[]): Promise<Partial<T>>;
-}

package/dist/services/gopass-secrets.js

@@ -1,76 +0,0 @@
-import { execFileSync } from 'child_process';
-/**
- * Service for retrieving secrets from gopass.
- * Requires gopass to be installed and configured on the system.
- */
-export class GopassSecretService {
-    prefix;
-    constructor(prefix = '') {
-        this.prefix = prefix;
-    }
-    getFullKey(key) {
-        if (!/^[\w.\-/]+$/.test(key)) {
-            throw new Error(`Invalid secret key format: ${key}`);
-        }
-        return this.prefix ? `${this.prefix}${key}` : key;
-    }
-    async getSecret(key) {
-        const fullKey = this.getFullKey(key);
-        try {
-            const raw = execFileSync('gopass', ['show', '-o', fullKey], {
-                encoding: 'utf8',
-            }).trim();
-            try {
-                return JSON.parse(raw);
-            }
-            catch {
-                return raw;
-            }
-        }
-        catch (error) {
-            throw new Error(`Secret Not Found: ${key}`, { cause: error });
-        }
-    }
-    async hasSecret(key) {
-        const fullKey = this.getFullKey(key);
-        try {
-            execFileSync('gopass', ['show', '-o', fullKey], { encoding: 'utf8' });
-            return true;
-        }
-        catch {
-            return false;
-        }
-    }
-    async setSecret(key, value) {
-        const fullKey = this.getFullKey(key);
-        const encoded = typeof value === 'string' ? value : JSON.stringify(value);
-        try {
-            execFileSync('gopass', ['insert', '-f', fullKey], {
-                encoding: 'utf8',
-                input: encoded,
-                stdio: ['pipe', 'pipe', 'pipe'],
-            });
-        }
-        catch (error) {
-            throw new Error(`Failed to set secret: ${key}`, { cause: error });
-        }
-    }
-    async deleteSecret(key) {
-        const fullKey = this.getFullKey(key);
-        try {
-            execFileSync('gopass', ['rm', '-f', fullKey], { encoding: 'utf8' });
-        }
-        catch {
-            // Ignore errors if secret doesn't exist
-        }
-    }
-    async getSecrets(keys) {
-        const results = await Promise.allSettled(keys.map((k) => this.getSecret(k)));
-        const out = {};
-        keys.forEach((key, i) => {
-            if (results[i].status === 'fulfilled')
-                out[key] = results[i].value;
-        });
-        return out;
-    }
-}

package/dist/services/http-scenario-actors.d.ts

@@ -1,75 +0,0 @@
-import type { ScenarioActor, ScenarioActorConfig, ScenarioActors, ScenarioInvokeOptions, ScenarioHttpResponse } from './scenario-actors-service.js';
-import type { ConverseOptions, ActorFlowVerdict } from '../wirings/actor-flow/actor-flow.types.js';
-export interface HttpScenarioActorsConfig {
-    /**
-     * Base API URL of the target app, INCLUDING the HTTP prefix — e.g.
-     * `https://app.example.com/api` or `http://localhost:4000/api`. Actor
-     * sign-in is reached at `${apiUrl}${signInPath}` and exposed RPCs at
-     * `${apiUrl}${rpcPath}/:rpcName`.
-     */
-    apiUrl: string;
-    /**
-     * The actor impersonation secret. Sign-in only ever works for user rows
-     * flagged `actor: true` — knowing the secret never impersonates real users.
-     */
-    secret: string;
-    /** Actor name → config (usually from pikku.config.json's actor registry). */
-    actors: Record<string, ScenarioActorConfig>;
-    /** Sign-in path under apiUrl. Default: the actor plugin's `/auth/sign-in/actor`. */
-    signInPath?: string;
-    /** Exposed-RPC path prefix under apiUrl. Default `/rpc`. */
-    rpcPath?: string;
-    /**
-     * Default model the persona uses when `actor.converse(...)` is called without
-     * an explicit `model`. The persona's own turns/approvals/evaluation run
-     * in-process via the configured `aiAgentRunner`.
-     */
-    model?: string;
-}
-/**
- * Default HTTP-backed actor. Signs in lazily on first invoke via the Better
- * Auth actor plugin (`POST /auth/sign-in/actor` with `{ email, secret }` —
- * the plugin upserts the actor-flagged user row and mints a session whose
- * `actor` flag flows into audits/analytics). Holds the session cookies for
- * its lifetime; a 401 mid-run re-logs-in once (long health-check runs can
- * outlive a session).
- */
-export declare class HttpScenarioActor implements ScenarioActor {
-    readonly name: string;
-    private actorConfig;
-    private config;
-    private jar;
-    /**
-     * Whether `login()` has succeeded since the last time the session was
-     * dropped. The jar cannot answer this — a target may set a cookie before
-     * anyone signs in, and it would then look like a session that was never
-     * established.
-     */
-    private signedIn;
-    constructor(name: string, actorConfig: ScenarioActorConfig, config: HttpScenarioActorsConfig);
-    get email(): string;
-    invoke(rpcName: string, data: unknown): Promise<unknown>;
-    invokeRaw(rpcName: string, data: unknown, options?: ScenarioInvokeOptions): Promise<ScenarioHttpResponse>;
-    converse(options: ConverseOptions): Promise<ActorFlowVerdict>;
-    /** Start/continue the target agent's run over HTTP as this actor. */
-    private agentRun;
-    /** Answer the target agent's pending approvals over HTTP and continue. */
-    private agentApprove;
-    /**
-     * POST an agent HTTP route (raw body, not RPC-wrapped). Signs in lazily: the
-     * first call goes out with whatever cookie we hold (none, for a no-auth
-     * agent), and only a 401 triggers `login()` + one retry. This lets an actor
-     * converse with a no-auth agent without any sign-in wiring, while still
-     * authenticating against agents that require a session.
-     */
-    private postAgent;
-    private postRpc;
-    /** Drop the session, so the next call signs in again before it goes out. */
-    private signOut;
-    private login;
-}
-/**
- * Build the injected `actors` service from the config registry: actor name →
- * lazy HTTP actor. Wire the result as the `actors` singleton service.
- */
-export declare function createHttpScenarioActors(config: HttpScenarioActorsConfig): ScenarioActors;

package/dist/services/http-scenario-actors.js

@@ -1,195 +0,0 @@
-import { readScenarioHttpResponse } from './scenario-actors-service.js';
-import { runConversation } from '../wirings/actor-flow/run-conversation.js';
-import { createCookieJar, } from '../wirings/workflow/scenario-cookie-jar.js';
-import { getSingletonServices } from '../pikku-state.js';
-import { AIProviderNotConfiguredError } from '../errors/errors.js';
-/**
- * Default HTTP-backed actor. Signs in lazily on first invoke via the Better
- * Auth actor plugin (`POST /auth/sign-in/actor` with `{ email, secret }` —
- * the plugin upserts the actor-flagged user row and mints a session whose
- * `actor` flag flows into audits/analytics). Holds the session cookies for
- * its lifetime; a 401 mid-run re-logs-in once (long health-check runs can
- * outlive a session).
- */
-export class HttpScenarioActor {
-    name;
-    actorConfig;
-    config;
-    jar;
-    /**
-     * Whether `login()` has succeeded since the last time the session was
-     * dropped. The jar cannot answer this — a target may set a cookie before
-     * anyone signs in, and it would then look like a session that was never
-     * established.
-     */
-    signedIn = false;
-    constructor(name, actorConfig, config) {
-        this.name = name;
-        this.actorConfig = actorConfig;
-        this.config = config;
-        this.jar = createCookieJar(config.apiUrl);
-    }
-    get email() {
-        return this.actorConfig.email;
-    }
-    async invoke(rpcName, data) {
-        const res = await this.invokeRaw(rpcName, data);
-        if (!res.ok) {
-            throw new Error(`[scenario] '${rpcName}' as '${this.name}' returned ${res.status}: ${res.serialized.slice(0, 300)}`);
-        }
-        return res.body;
-    }
-    async invokeRaw(rpcName, data, options) {
-        if (!this.signedIn) {
-            await this.login();
-        }
-        let res = await this.postRpc(rpcName, data, options?.headers);
-        if (res.status === 401) {
-            // Session expired mid-run — re-login once and retry.
-            this.signOut();
-            await this.login();
-            res = await this.postRpc(rpcName, data, options?.headers);
-        }
-        return readScenarioHttpResponse(res);
-    }
-    async converse(options) {
-        const { aiAgentRunner } = getSingletonServices();
-        if (!aiAgentRunner) {
-            throw new AIProviderNotConfiguredError();
-        }
-        const model = options.model ?? this.config.model;
-        if (!model) {
-            throw new Error(`[scenario] actor '${this.name}' converse needs a model — pass options.model or set 'model' on the actors service`);
-        }
-        const threadId = globalThis.crypto.randomUUID();
-        const resourceId = `actor:${this.name}`;
-        return runConversation({
-            actor: this.actorConfig,
-            actorName: this.actorConfig.name ?? this.name,
-            agentName: options.agent,
-            task: options.task,
-            evaluate: options.evaluate,
-            approvals: options.approvals,
-            model,
-            maxTurns: options.maxTurns,
-            llm: (params) => aiAgentRunner.run(params),
-            target: {
-                run: (message) => this.agentRun(options.agent, message, threadId, resourceId),
-                approve: (runId, decisions) => this.agentApprove(options.agent, runId, decisions),
-            },
-        });
-    }
-    /** Start/continue the target agent's run over HTTP as this actor. */
-    async agentRun(agentName, message, threadId, resourceId) {
-        const raw = await this.postAgent(`agent/${agentName}`, {
-            message,
-            threadId,
-            resourceId,
-        });
-        return normalizeAgentReply(raw);
-    }
-    /** Answer the target agent's pending approvals over HTTP and continue. */
-    async agentApprove(agentName, runId, decisions) {
-        const raw = await this.postAgent(`agent/${agentName}/approve`, {
-            runId,
-            approvals: decisions,
-        });
-        return normalizeAgentReply(raw);
-    }
-    /**
-     * POST an agent HTTP route (raw body, not RPC-wrapped). Signs in lazily: the
-     * first call goes out with whatever cookie we hold (none, for a no-auth
-     * agent), and only a 401 triggers `login()` + one retry. This lets an actor
-     * converse with a no-auth agent without any sign-in wiring, while still
-     * authenticating against agents that require a session.
-     */
-    async postAgent(subPath, body) {
-        const rpcPath = this.config.rpcPath ?? '/rpc';
-        const url = `${this.config.apiUrl}${rpcPath}/${subPath}`;
-        const send = () => this.jar.fetch(url, {
-            method: 'POST',
-            headers: { 'content-type': 'application/json' },
-            body: JSON.stringify(body),
-        });
-        let res = await send();
-        if (res.status === 401) {
-            this.signOut();
-            await this.login();
-            res = await send();
-        }
-        if (!res.ok) {
-            const text = (await res.text().catch(() => '')).slice(0, 300);
-            throw new Error(`[scenario] agent call '${subPath}' as '${this.name}' returned ${res.status}: ${text}`);
-        }
-        if (res.status === 204)
-            return undefined;
-        const text = await res.text();
-        return text ? JSON.parse(text) : undefined;
-    }
-    async postRpc(rpcName, data, extraHeaders) {
-        const rpcPath = this.config.rpcPath ?? '/rpc';
-        return this.jar.fetch(`${this.config.apiUrl}${rpcPath}/${rpcName}`, {
-            method: 'POST',
-            headers: { 'content-type': 'application/json', ...extraHeaders },
-            body: JSON.stringify({ data }),
-        });
-    }
-    /** Drop the session, so the next call signs in again before it goes out. */
-    signOut() {
-        this.jar.clear();
-        this.signedIn = false;
-    }
-    async login() {
-        const signInPath = this.config.signInPath ?? '/auth/sign-in/actor';
-        const res = await this.jar.fetch(`${this.config.apiUrl}${signInPath}`, {
-            method: 'POST',
-            headers: { 'content-type': 'application/json' },
-            body: JSON.stringify({
-                email: this.actorConfig.email,
-                name: this.actorConfig.name ?? this.name,
-                secret: this.config.secret,
-            }),
-        });
-        if (!res.ok) {
-            const body = (await res.text().catch(() => '')).slice(0, 300);
-            throw new Error(`[scenario] actor sign-in failed for '${this.name}' (${res.status}): ${body}`);
-        }
-        // What proves a session was established is this response setting a cookie,
-        // not the jar being non-empty — the target may have set one earlier.
-        if (res.headers.getSetCookie().length === 0) {
-            throw new Error(`[scenario] actor sign-in for '${this.name}' returned no session cookie`);
-        }
-        this.signedIn = true;
-    }
-}
-/** Normalize an agentRun/agentApprove HTTP response into a TargetAgentReply. */
-function normalizeAgentReply(raw) {
-    const r = (raw ?? {});
-    const pending = Array.isArray(r.pendingApprovals)
-        ? r.pendingApprovals.map((p) => ({
-            toolCallId: String(p.toolCallId),
-            toolName: String(p.toolName),
-            args: p.args,
-            reason: typeof p.reason === 'string' ? p.reason : undefined,
-        }))
-        : undefined;
-    return {
-        text: typeof r.text === 'string' ? r.text : '',
-        runId: typeof r.runId === 'string' ? r.runId : '',
-        status: r.status === 'completed' || r.status === 'suspended'
-            ? r.status
-            : undefined,
-        pendingApprovals: pending,
-    };
-}
-/**
- * Build the injected `actors` service from the config registry: actor name →
- * lazy HTTP actor. Wire the result as the `actors` singleton service.
- */
-export function createHttpScenarioActors(config) {
-    const actors = {};
-    for (const [name, actorConfig] of Object.entries(config.actors)) {
-        actors[name] = new HttpScenarioActor(name, actorConfig, config);
-    }
-    return actors;
-}

package/dist/services/http-user-flow-actors.d.ts

@@ -1,67 +0,0 @@
-import type { UserFlowActor, UserFlowActorConfig, UserFlowActors } from './user-flow-actors-service.js';
-import type { ConverseOptions, ActorFlowVerdict } from '../wirings/actor-flow/actor-flow.types.js';
-export interface HttpUserFlowActorsConfig {
-    /**
-     * Base API URL of the target app, INCLUDING the HTTP prefix — e.g.
-     * `https://app.example.com/api` or `http://localhost:4000/api`. Actor
-     * sign-in is reached at `${apiUrl}${signInPath}` and exposed RPCs at
-     * `${apiUrl}${rpcPath}/:rpcName`.
-     */
-    apiUrl: string;
-    /**
-     * The actor impersonation secret. Sign-in only ever works for user rows
-     * flagged `actor: true` — knowing the secret never impersonates real users.
-     */
-    secret: string;
-    /** Actor name → config (usually from pikku.config.json's actor registry). */
-    actors: Record<string, UserFlowActorConfig>;
-    /** Sign-in path under apiUrl. Default: the actor plugin's `/auth/sign-in/actor`. */
-    signInPath?: string;
-    /** Exposed-RPC path prefix under apiUrl. Default `/rpc`. */
-    rpcPath?: string;
-    /**
-     * Default model the persona uses when `actor.converse(...)` is called without
-     * an explicit `model`. The persona's own turns/approvals/evaluation run
-     * in-process via the configured `aiAgentRunner`.
-     */
-    model?: string;
-}
-/**
- * Default HTTP-backed actor. Signs in lazily on first invoke via the Better
- * Auth actor plugin (`POST /auth/sign-in/actor` with `{ email, secret }` —
- * the plugin upserts the actor-flagged user row and mints a session whose
- * `actor` flag flows into audits/analytics). Holds the session cookies for
- * its lifetime; a 401 mid-run re-logs-in once (long health-check runs can
- * outlive a session).
- */
-export declare class HttpUserFlowActor implements UserFlowActor {
-    readonly name: string;
-    private actorConfig;
-    private config;
-    private cookie;
-    private origin;
-    constructor(name: string, actorConfig: UserFlowActorConfig, config: HttpUserFlowActorsConfig);
-    get email(): string;
-    invoke(rpcName: string, data: unknown): Promise<unknown>;
-    converse(options: ConverseOptions): Promise<ActorFlowVerdict>;
-    /** Start/continue the target agent's run over HTTP as this actor. */
-    private agentRun;
-    /** Answer the target agent's pending approvals over HTTP and continue. */
-    private agentApprove;
-    /**
-     * POST an agent HTTP route (raw body, not RPC-wrapped). Signs in lazily: the
-     * first call goes out with whatever cookie we hold (none, for a no-auth
-     * agent), and only a 401 triggers `login()` + one retry. This lets an actor
-     * converse with a no-auth agent without any sign-in wiring, while still
-     * authenticating against agents that require a session.
-     */
-    private postAgent;
-    private postRpc;
-    private readRpcResponse;
-    private login;
-}
-/**
- * Build the injected `actors` service from the config registry: actor name →
- * lazy HTTP actor. Wire the result as the `actors` singleton service.
- */
-export declare function createHttpUserFlowActors(config: HttpUserFlowActorsConfig): UserFlowActors;

package/dist/services/http-user-flow-actors.js

@@ -1,193 +0,0 @@
-import { runConversation } from '../wirings/actor-flow/run-conversation.js';
-import { getSingletonServices } from '../pikku-state.js';
-import { AIProviderNotConfiguredError } from '../errors/errors.js';
-/**
- * Default HTTP-backed actor. Signs in lazily on first invoke via the Better
- * Auth actor plugin (`POST /auth/sign-in/actor` with `{ email, secret }` —
- * the plugin upserts the actor-flagged user row and mints a session whose
- * `actor` flag flows into audits/analytics). Holds the session cookies for
- * its lifetime; a 401 mid-run re-logs-in once (long health-check runs can
- * outlive a session).
- */
-export class HttpUserFlowActor {
-    name;
-    actorConfig;
-    config;
-    cookie = null;
-    origin;
-    constructor(name, actorConfig, config) {
-        this.name = name;
-        this.actorConfig = actorConfig;
-        this.config = config;
-        this.origin = new URL(config.apiUrl).origin;
-    }
-    get email() {
-        return this.actorConfig.email;
-    }
-    async invoke(rpcName, data) {
-        const cookie = this.cookie ?? (await this.login());
-        const res = await this.postRpc(rpcName, data, cookie);
-        if (res.status === 401) {
-            // Session expired mid-run — re-login once and retry.
-            this.cookie = null;
-            return this.readRpcResponse(rpcName, await this.postRpc(rpcName, data, await this.login()));
-        }
-        return this.readRpcResponse(rpcName, res);
-    }
-    async converse(options) {
-        const { aiAgentRunner } = getSingletonServices();
-        if (!aiAgentRunner) {
-            throw new AIProviderNotConfiguredError();
-        }
-        const model = options.model ?? this.config.model;
-        if (!model) {
-            throw new Error(`[user-flow] actor '${this.name}' converse needs a model — pass options.model or set 'model' on the actors service`);
-        }
-        const threadId = globalThis.crypto.randomUUID();
-        const resourceId = `actor:${this.name}`;
-        return runConversation({
-            persona: this.actorConfig,
-            personaName: this.actorConfig.name ?? this.name,
-            agentName: options.agent,
-            task: options.task,
-            evaluate: options.evaluate,
-            approvals: options.approvals,
-            model,
-            maxTurns: options.maxTurns,
-            llm: (params) => aiAgentRunner.run(params),
-            target: {
-                run: (message) => this.agentRun(options.agent, message, threadId, resourceId),
-                approve: (runId, decisions) => this.agentApprove(options.agent, runId, decisions),
-            },
-        });
-    }
-    /** Start/continue the target agent's run over HTTP as this actor. */
-    async agentRun(agentName, message, threadId, resourceId) {
-        const raw = await this.postAgent(`agent/${agentName}`, {
-            message,
-            threadId,
-            resourceId,
-        });
-        return normalizeAgentReply(raw);
-    }
-    /** Answer the target agent's pending approvals over HTTP and continue. */
-    async agentApprove(agentName, runId, decisions) {
-        const raw = await this.postAgent(`agent/${agentName}/approve`, {
-            runId,
-            approvals: decisions,
-        });
-        return normalizeAgentReply(raw);
-    }
-    /**
-     * POST an agent HTTP route (raw body, not RPC-wrapped). Signs in lazily: the
-     * first call goes out with whatever cookie we hold (none, for a no-auth
-     * agent), and only a 401 triggers `login()` + one retry. This lets an actor
-     * converse with a no-auth agent without any sign-in wiring, while still
-     * authenticating against agents that require a session.
-     */
-    async postAgent(subPath, body) {
-        const rpcPath = this.config.rpcPath ?? '/rpc';
-        const url = `${this.config.apiUrl}${rpcPath}/${subPath}`;
-        const send = (cookie) => fetch(url, {
-            method: 'POST',
-            headers: {
-                'content-type': 'application/json',
-                origin: this.origin,
-                ...(cookie ? { cookie } : {}),
-            },
-            body: JSON.stringify(body),
-        });
-        let res = await send(this.cookie);
-        if (res.status === 401) {
-            this.cookie = null;
-            res = await send(await this.login());
-        }
-        if (!res.ok) {
-            const text = (await res.text().catch(() => '')).slice(0, 300);
-            throw new Error(`[user-flow] agent call '${subPath}' as '${this.name}' returned ${res.status}: ${text}`);
-        }
-        if (res.status === 204)
-            return undefined;
-        const text = await res.text();
-        return text ? JSON.parse(text) : undefined;
-    }
-    async postRpc(rpcName, data, cookie) {
-        const rpcPath = this.config.rpcPath ?? '/rpc';
-        return fetch(`${this.config.apiUrl}${rpcPath}/${rpcName}`, {
-            method: 'POST',
-            headers: {
-                'content-type': 'application/json',
-                origin: this.origin,
-                cookie,
-            },
-            body: JSON.stringify({ data }),
-        });
-    }
-    async readRpcResponse(rpcName, res) {
-        if (!res.ok) {
-            const body = (await res.text().catch(() => '')).slice(0, 300);
-            throw new Error(`[user-flow] '${rpcName}' as '${this.name}' returned ${res.status}: ${body}`);
-        }
-        if (res.status === 204)
-            return undefined;
-        const text = await res.text();
-        return text ? JSON.parse(text) : undefined;
-    }
-    async login() {
-        const signInPath = this.config.signInPath ?? '/auth/sign-in/actor';
-        const res = await fetch(`${this.config.apiUrl}${signInPath}`, {
-            method: 'POST',
-            headers: { 'content-type': 'application/json', origin: this.origin },
-            body: JSON.stringify({
-                email: this.actorConfig.email,
-                name: this.actorConfig.name ?? this.name,
-                secret: this.config.secret,
-            }),
-        });
-        if (!res.ok) {
-            const body = (await res.text().catch(() => '')).slice(0, 300);
-            throw new Error(`[user-flow] actor sign-in failed for '${this.name}' (${res.status}): ${body}`);
-        }
-        const setCookies = res.headers.getSetCookie?.() ?? [];
-        const cookie = setCookies
-            .map((c) => c.split(';')[0])
-            .filter(Boolean)
-            .join('; ');
-        if (!cookie) {
-            throw new Error(`[user-flow] actor sign-in for '${this.name}' returned no session cookie`);
-        }
-        this.cookie = cookie;
-        return cookie;
-    }
-}
-/** Normalize an agentRun/agentApprove HTTP response into a TargetAgentReply. */
-function normalizeAgentReply(raw) {
-    const r = (raw ?? {});
-    const pending = Array.isArray(r.pendingApprovals)
-        ? r.pendingApprovals.map((p) => ({
-            toolCallId: String(p.toolCallId),
-            toolName: String(p.toolName),
-            args: p.args,
-            reason: typeof p.reason === 'string' ? p.reason : undefined,
-        }))
-        : undefined;
-    return {
-        text: typeof r.text === 'string' ? r.text : '',
-        runId: typeof r.runId === 'string' ? r.runId : '',
-        status: r.status === 'completed' || r.status === 'suspended'
-            ? r.status
-            : undefined,
-        pendingApprovals: pending,
-    };
-}
-/**
- * Build the injected `actors` service from the config registry: actor name →
- * lazy HTTP actor. Wire the result as the `actors` singleton service.
- */
-export function createHttpUserFlowActors(config) {
-    const actors = {};
-    for (const [name, actorConfig] of Object.entries(config.actors)) {
-        actors[name] = new HttpUserFlowActor(name, actorConfig, config);
-    }
-    return actors;
-}