@pikku/core 0.12.99 → 0.12.101

package/src/services/http-personas-converse.test.ts

@@ -57,28 +57,37 @@ const startAgentTarget = async () => {
         json({ runId: body.runId, text: 'Created it.', status: 'completed' })
         return
       }
-      if (req.url === '/api/rpc/agent/todoBot') {
+      // The SSE route, because that is the one a persona's turn goes to — the
+      // plain route buffers the whole run and dies on undici's headers timeout.
+      if (req.url === '/api/rpc/agent/todoBot/stream') {
         agentRuns++
-        if (agentRuns === 1) {
-          json({
-            runId: 'run-1',
-            text: 'Let me do that.',
-            status: 'suspended',
-            pendingApprovals: [
-              {
-                toolCallId: 'tc1',
-                toolName: 'createTodo',
-                args: { title: 'x' },
-              },
-            ],
-          })
-          return
+        const runId = `run-${agentRuns}`
+        const events: unknown[] =
+          agentRuns === 1
+            ? [
+                { type: 'RUN_STARTED', runId },
+                { type: 'TEXT_MESSAGE_CONTENT', delta: 'Let me ' },
+                { type: 'TEXT_MESSAGE_CONTENT', delta: 'do that.' },
+                {
+                  type: 'approval-request',
+                  runId,
+                  toolCallId: 'tc1',
+                  toolName: 'createTodo',
+                  args: { title: 'x' },
+                },
+                { type: 'done' },
+              ]
+            : [
+                { type: 'RUN_STARTED', runId },
+                { type: 'TEXT_MESSAGE_CONTENT', delta: 'All set.' },
+                { type: 'RUN_FINISHED', runId },
+                { type: 'done' },
+              ]
+        res.writeHead(200, { 'content-type': 'text/event-stream' })
+        for (const event of events) {
+          res.write(`data: ${JSON.stringify(event)}\n\n`)
         }
-        json({
-          runId: `run-${agentRuns}`,
-          text: 'All set.',
-          status: 'completed',
-        })
+        res.end()
         return
       }
       res.writeHead(404).end()

package/src/services/http-personas.test.ts

@@ -35,6 +35,29 @@ const startTarget = async () => {
         res.writeHead(200).end(JSON.stringify({ ok: true, email: body.email }))
         return
       }
+      if (req.url === '/api/auth/sign-in/fabric') {
+        if (body.token !== 'operator-token') {
+          res.writeHead(401).end(JSON.stringify({ message: 'bad operator' }))
+          return
+        }
+        logins++
+        res.setHeader('set-cookie', [`session=s${logins}; Path=/; HttpOnly`])
+        res
+          .writeHead(200)
+          .end(JSON.stringify({ actAs: { userId: `u-${body.actAs.email}` } }))
+        return
+      }
+      if (req.url === '/api/auth/get-session') {
+        const cookie = req.headers.cookie ?? ''
+        if (!cookie.includes('session=')) {
+          res.writeHead(200).end('null')
+          return
+        }
+        res
+          .writeHead(200, { 'content-type': 'application/json' })
+          .end(JSON.stringify({ user: { role: 'admin,support' } }))
+        return
+      }
       if (req.url?.startsWith('/api/rpc/')) {
         const cookie = req.headers.cookie ?? ''
         if (!cookie.includes('session=') || expireNext) {
@@ -43,6 +66,16 @@ const startTarget = async () => {
           return
         }
         const rpcName = req.url.slice('/api/rpc/'.length)
+        if (rpcName === 'getMyScopes') {
+          res
+            .writeHead(200, { 'content-type': 'application/json' })
+            .end(JSON.stringify({ scopes: ['stays:read'], roles: ['guest'] }))
+          return
+        }
+        if (rpcName === 'noSuchRpc') {
+          res.writeHead(404).end()
+          return
+        }
         if (rpcName === 'html-error') {
           res
             .writeHead(500, { 'content-type': 'text/html' })
@@ -63,6 +96,7 @@ const startTarget = async () => {
             echoed: body.data,
             cookie,
             userHeader: req.headers['x-user-id'] ?? null,
+            impersonated: req.headers['x-pikku-impersonate-user-id'] ?? null,
           })
         )
         return
@@ -74,6 +108,7 @@ const startTarget = async () => {
   const { port } = server.address() as { port: number }
   return {
     server,
+    origin: `http://127.0.0.1:${port}`,
     apiUrl: `http://127.0.0.1:${port}/api`,
     loginCount: () => logins,
     expireSession: () => {
@@ -231,4 +266,114 @@ describe('HttpPersona', async () => {
       /persona sign-in failed for 'customer' \(401\).*bad actor secret/
     )
   })
+
+  // An app whose auth is under `/api` but whose RPCs are not cannot put the
+  // mount in `apiUrl`, so it moves `signInPath` instead. The session read has
+  // to follow it: a 404 there reads as 'this stage does not report roles' and
+  // silently turns the role check off.
+  //
+  // `rolesRpc: false` because this is about the better-auth path specifically —
+  // leaving the RPC in would answer first and the mount would go untested.
+  test('reads the session from the mount the sign-in path names', async () => {
+    const actors = createHttpPersonas({
+      apiUrl: target.origin,
+      secret: ROOT,
+      signInPath: '/api/auth/sign-in/actor',
+      rpcPath: '/api/rpc',
+      rolesRpc: false,
+      personas: {
+        manager: {
+          id: 'manager',
+          name: 'Manager',
+          email: 'manager@personas.invalid',
+          roles: ['admin'],
+          goals: [],
+          tags: [],
+          runnable: true,
+        },
+      },
+    })
+
+    assert.deepEqual(await actors.manager!.sessionRoles(), ['admin', 'support'])
+  })
+
+  // Scopes are the model in an app that authorizes on them; better-auth's
+  // `user.role` is a projection kept in step for its own admin endpoints, and
+  // is absent entirely from an app that declares no such field. Reading the
+  // projection is how a guest holding exactly what it should got refused for
+  // "roles drifted".
+  test('reads roles from the app RPC in preference to better-auth', async () => {
+    const actors = createHttpPersonas({
+      apiUrl: target.origin,
+      secret: ROOT,
+      signInPath: '/api/auth/sign-in/actor',
+      rpcPath: '/api/rpc',
+      personas: {
+        manager: {
+          id: 'manager',
+          name: 'Manager',
+          email: 'manager@personas.invalid',
+          roles: ['guest'],
+          goals: [],
+          tags: [],
+          runnable: true,
+        },
+      },
+    })
+
+    assert.deepEqual(await actors.manager!.sessionRoles(), ['guest'])
+  })
+
+  // An app without the RPC is not an app reporting "no roles" — going quiet
+  // there would turn every persona into a mismatch against an empty list.
+  test('falls back to better-auth when the roles RPC is absent', async () => {
+    const actors = createHttpPersonas({
+      apiUrl: target.origin,
+      secret: ROOT,
+      signInPath: '/api/auth/sign-in/actor',
+      rpcPath: '/api/rpc',
+      rolesRpc: 'noSuchRpc',
+      personas: {
+        manager: {
+          id: 'manager',
+          name: 'Manager',
+          email: 'manager@personas.invalid',
+          roles: ['admin'],
+          goals: [],
+          tags: [],
+          runnable: true,
+        },
+      },
+    })
+
+    assert.deepEqual(await actors.manager!.sessionRoles(), ['admin', 'support'])
+  })
+
+  // The operator handshake sits under the same mount and must be derived from
+  // it, not inherited verbatim: posting an operator token to the ACTOR path is
+  // a validation error about a missing email, which reads like a broken
+  // persona rather than a wrong URL.
+  test('derives the operator sign-in path from the same auth mount', async () => {
+    const actors = createHttpPersonas({
+      apiUrl: target.origin,
+      signInPath: '/api/auth/sign-in/actor',
+      rpcPath: '/api/rpc',
+      operator: { token: 'operator-token' },
+      personas: {
+        manager: {
+          id: 'manager',
+          name: 'Manager',
+          email: 'manager@personas.invalid',
+          roles: ['admin'],
+          goals: [],
+          tags: [],
+          runnable: true,
+        },
+      },
+    })
+
+    const result = (await actors.manager!.invoke('ping', {})) as any
+    assert.equal(result.rpcName, 'ping')
+    assert.equal(result.impersonated, 'u-manager@personas.invalid')
+  })
 })

package/src/services/http-personas.ts

@@ -10,6 +10,7 @@ import type {
   ConverseOptions,
   ActorFlowVerdict,
   TargetAgentReply,
+  TargetPendingApproval,
 } from '../wirings/actor-flow/actor-flow.types.js'
 import { runConversation } from '../wirings/actor-flow/run-conversation.js'
 import {
@@ -22,6 +23,7 @@ import {
   OperatorSignIn,
   type OperatorSignInOptions,
   type PersonaSignIn,
+  authMount,
 } from './persona-sign-in.js'
 import { getSingletonServices } from '../pikku-state.js'
 import { AIProviderNotConfiguredError } from '../errors/errors.js'
@@ -65,10 +67,26 @@ export interface HttpPersonasConfig {
    * {@link OperatorSignInOptions.signInPath} overrides it.
    */
   signInPath?: string
-  /** Where the session (and its roles) is read back. Default `/auth/get-session`. */
+  /**
+   * Where the session (and its roles) is read back. Defaults to `get-session`
+   * under the same auth mount as {@link HttpPersonasConfig.signInPath}, so an
+   * app that moved auth under `/api` moves this with it and does not have to
+   * say so twice.
+   */
   sessionPath?: string
   /** Exposed-RPC path prefix under apiUrl. Default `/rpc`. */
   rpcPath?: string
+  /**
+   * Exposed RPC that reports the CALLER's own roles, as `{ roles: string[] }`.
+   * Default `getMyScopes`. Pass `false` to skip it and read better-auth only.
+   *
+   * Asked before better-auth's `user.role`, because in an app that authorizes
+   * on scopes that column is a projection rather than the model — it exists so
+   * better-auth's own admin endpoints have something to read, is written by
+   * whatever keeps it in step, and is absent entirely from an app that declares
+   * no such field. A persona verified against it is verified against a copy.
+   */
+  rolesRpc?: string | false
   /**
    * Default model a persona thinks with when `converse(...)` is called without
    * an explicit `model`. Its own turns/approvals/evaluation run in-process via
@@ -106,7 +124,11 @@ export class HttpPersona implements ScenarioPersona {
     if (config.operator) {
       this.signIn = new OperatorSignIn(config.apiUrl, {
         ...config.operator,
-        signInPath: config.operator.signInPath ?? config.signInPath,
+        signInPath:
+          config.operator.signInPath ??
+          (authMount(config.signInPath)
+            ? `${authMount(config.signInPath)}/sign-in/fabric`
+            : undefined),
       })
     } else if (config.secret) {
       this.signIn = new ActorSignIn(
@@ -197,17 +219,51 @@ export class HttpPersona implements ScenarioPersona {
   /**
    * The roles the stage says this session holds.
    *
-   * Read from better-auth's `get-session`, which is what most pikku apps are
-   * running and where its admin plugin puts `role` — on the user, as a
-   * comma-separated list. A target that answers something else returns `null`
-   * rather than an empty list, because "this stage does not report roles" and
-   * "this person has none" call for opposite responses from the caller.
+   * {@link HttpPersonasConfig.rolesRpc} first, then better-auth's
+   * `get-session` — where its admin plugin puts `role` on the user, as a
+   * comma-separated list. A target that answers neither returns `null` rather
+   * than an empty list, because "this stage does not report roles" and "this
+   * person has none" call for opposite responses from the caller.
    */
   async sessionRoles(): Promise<string[] | null> {
     if (!this.signedIn) {
       await this.login()
     }
-    const sessionPath = this.config.sessionPath ?? '/auth/get-session'
+    const fromRpc = await this.rolesFromRpc()
+    if (fromRpc) return fromRpc
+    return await this.rolesFromSession()
+  }
+
+  /**
+   * The caller's own roles, from the app's own RPC. `null` for every answer
+   * that is not a role list — an app without the RPC 404s here, which is a
+   * reason to go on and ask better-auth, not a reason to report "none".
+   */
+  private async rolesFromRpc(): Promise<string[] | null> {
+    const rpcName = this.config.rolesRpc ?? 'getMyScopes'
+    if (rpcName === false) return null
+    let res: Response
+    try {
+      res = await this.postRpc(rpcName, {})
+    } catch {
+      return null
+    }
+    if (!res.ok) return null
+    const { body } = await readScenarioHttpResponse<{
+      roles?: unknown
+      data?: { roles?: unknown }
+    }>(res)
+    const roles = body?.roles ?? body?.data?.roles
+    if (!Array.isArray(roles)) return null
+    return roles.filter((name): name is string => typeof name === 'string')
+  }
+
+  private async rolesFromSession(): Promise<string[] | null> {
+    const mount = authMount(
+      this.config.operator?.signInPath ?? this.config.signInPath
+    )
+    const sessionPath =
+      this.config.sessionPath ?? `${mount ?? '/auth'}/get-session`
     const res = await this.jar.fetch(`${this.config.apiUrl}${sessionPath}`, {
       headers: this.signIn.headers(),
     })
@@ -240,19 +296,30 @@ export class HttpPersona implements ScenarioPersona {
     return user ? [] : null
   }
 
-  /** Start/continue the target agent's run over HTTP as this persona. */
+  /**
+   * Start/continue the target agent's run over HTTP as this persona.
+   *
+   * The SSE route, not the plain one. `POST /rpc/agent/:name` buffers the whole
+   * run before it sends a single byte, so a run longer than the client's
+   * headers timeout — 300s in undici, which is what Node and Bun both use —
+   * fails with `UND_ERR_HEADERS_TIMEOUT` and no way to tell it apart from a
+   * stage that is down. An agent that talks for several minutes, which is the
+   * normal case for anything conversational, cannot be driven that way at all.
+   * The stream sends its first event immediately and the run's length stops
+   * mattering.
+   */
   private async agentRun(
     agentName: string,
     message: string,
     threadId: string,
     resourceId: string
   ): Promise<TargetAgentReply> {
-    const raw = await this.postAgent(`agent/${agentName}`, {
+    const res = await this.sendAgent(`agent/${agentName}/stream`, {
       message,
       threadId,
       resourceId,
     })
-    return normalizeAgentReply(raw)
+    return await collectAgentStream(res)
   }
 
   /** Answer the target agent's pending approvals over HTTP and continue. */
@@ -269,7 +336,7 @@ export class HttpPersona implements ScenarioPersona {
   }
 
   // knowledge: decisions/internals/scenario-agent-calls-sign-in-on-401-only.md
-  private async postAgent(subPath: string, body: unknown): Promise<unknown> {
+  private async sendAgent(subPath: string, body: unknown): Promise<Response> {
     const rpcPath = this.config.rpcPath ?? '/rpc'
     const url = `${this.config.apiUrl}${rpcPath}/${subPath}`
     const send = () =>
@@ -294,6 +361,11 @@ export class HttpPersona implements ScenarioPersona {
         `[scenario] agent call '${subPath}' as '${this.name}' returned ${res.status}: ${text}`
       )
     }
+    return res
+  }
+
+  private async postAgent(subPath: string, body: unknown): Promise<unknown> {
+    const res = await this.sendAgent(subPath, body)
     if (res.status === 204) return undefined
     const text = await res.text()
     return text ? JSON.parse(text) : undefined
@@ -328,6 +400,77 @@ export class HttpPersona implements ScenarioPersona {
   }
 }
 
+/**
+ * Reduce the agent's SSE run into the same reply shape the plain route returns.
+ *
+ * `RUN_ERROR` is raised rather than returned: the plain route answers a failed
+ * run with a non-2xx, and a scenario that read an error as an empty transcript
+ * would score the agent on silence it never produced.
+ */
+async function collectAgentStream(res: Response): Promise<TargetAgentReply> {
+  const body = res.body
+  if (!body) {
+    throw new Error('[scenario] the agent stream carried no body')
+  }
+  const decoder = new TextDecoder()
+  const reader = body.getReader()
+  let buffer = ''
+  let text = ''
+  let runId = ''
+  const pendingApprovals: TargetPendingApproval[] = []
+
+  const consume = (line: string) => {
+    if (!line.startsWith('data:')) return
+    const payload = line.slice(5).trim()
+    if (!payload) return
+    let event: Record<string, unknown>
+    try {
+      event = JSON.parse(payload)
+    } catch {
+      return
+    }
+    if (typeof event.runId === 'string' && event.runId) runId = event.runId
+    if (
+      event.type === 'TEXT_MESSAGE_CONTENT' &&
+      typeof event.delta === 'string'
+    ) {
+      text += event.delta
+    } else if (event.type === 'approval-request') {
+      pendingApprovals.push({
+        toolCallId: String(event.toolCallId),
+        toolName: String(event.toolName),
+        args: event.args,
+        reason: typeof event.reason === 'string' ? event.reason : undefined,
+      })
+    } else if (event.type === 'RUN_ERROR' || event.type === 'error') {
+      const message = event.message ?? event.errorText ?? 'the agent run failed'
+      throw new Error(`[scenario] agent run failed: ${String(message)}`)
+    }
+  }
+
+  try {
+    for (;;) {
+      const { done, value } = await reader.read()
+      if (done) break
+      buffer += decoder.decode(value, { stream: true })
+      const lines = buffer.split('\n')
+      buffer = lines.pop() ?? ''
+      for (const line of lines) consume(line)
+    }
+    if (buffer) consume(buffer)
+  } finally {
+    await reader.cancel().catch(() => {})
+  }
+
+  return {
+    text,
+    runId,
+    status: pendingApprovals.length > 0 ? 'suspended' : 'completed',
+    pendingApprovals:
+      pendingApprovals.length > 0 ? pendingApprovals : undefined,
+  }
+}
+
 /** Normalize an agentRun/agentApprove HTTP response into a TargetAgentReply. */
 function normalizeAgentReply(raw: unknown): TargetAgentReply {
   const r = (raw ?? {}) as Record<string, unknown>

package/src/services/persona-sign-in.test.ts

@@ -14,7 +14,7 @@ const OPERATOR_TOKEN = 'operator.jwt.token'
  */
 const startStage = async (seeded: Array<{ id: string; email: string }>) => {
   const users = [...seeded]
-  let created = 0
+  const sentBodies: unknown[] = []
   const server: Server = createServer((req, res) => {
     const chunks: Buffer[] = []
     req.on('data', (c) => chunks.push(c))
@@ -31,21 +31,15 @@ const startStage = async (seeded: Array<{ id: string; email: string }>) => {
         }
         let actAs: { userId: string } | undefined
         if (body.actAs) {
-          let user = users.find((u) => u.email === body.actAs.email)
+          sentBodies.push(body.actAs)
+          const user = users.find((u) => u.email === body.actAs.email)
           if (!user) {
-            if (!body.actAs.create) {
-              res
-                .writeHead(404)
-                .end(
-                  JSON.stringify({
-                    message: `No account on this stage for ${body.actAs.email}`,
-                  })
-                )
-              return
-            }
-            created++
-            user = { id: `made-${created}`, email: body.actAs.email }
-            users.push(user)
+            res.writeHead(404).end(
+              JSON.stringify({
+                message: `No account on this stage for ${body.actAs.email}`,
+              })
+            )
+            return
           }
           actAs = { userId: user.id }
         }
@@ -74,8 +68,8 @@ const startStage = async (seeded: Array<{ id: string; email: string }>) => {
   return {
     apiUrl: `http://127.0.0.1:${port}/api`,
     server,
-    get createdCount() {
-      return created
+    get sentBodies() {
+      return sentBodies
     },
   }
 }
@@ -112,7 +106,6 @@ describe('operator persona sign-in', () => {
     }
     assert.equal(result.actingAs, 'user-7')
     assert.match(result.cookie, /session=operator/)
-    assert.equal(stage.createdCount, 0)
   })
 
   // An app that mounts auth somewhere other than the root moves both sign-in
@@ -151,24 +144,25 @@ describe('operator persona sign-in', () => {
       () => personas.customer!.invoke('whoami', {}),
       /operator sign-in failed for 'customer' \(404\)/
     )
-    assert.equal(stage.createdCount, 0)
   })
 
-  test('provisions the account only when told to', async () => {
-    const stage = await startStage([])
+  // Provisioning moved into the stage, so the handshake carries an address and
+  // nothing else. A `create` flag or a role list here would be the caller
+  // deciding what the stage holds, which is the arrangement this replaced.
+  test('asks only to act as an address', async () => {
+    const stage = await startStage([
+      { id: 'user-3', email: 'customer@personas.invalid' },
+    ])
     servers.push(stage.server)
 
     const personas = createHttpPersonas({
       apiUrl: stage.apiUrl,
-      operator: { token: OPERATOR_TOKEN, createMissing: true },
-      personas: { customer: persona('fresh@personas.invalid') },
+      operator: { token: OPERATOR_TOKEN },
+      personas: { customer: persona('customer@personas.invalid') },
     })
 
-    const result = (await personas.customer!.invoke('whoami', {})) as {
-      actingAs: string | null
-    }
-    assert.equal(result.actingAs, 'made-1')
-    assert.equal(stage.createdCount, 1)
+    await personas.customer!.invoke('whoami', {})
+    assert.deepEqual(stage.sentBodies, [{ email: 'customer@personas.invalid' }])
   })
 
   test('mints the operator session from a token factory', async () => {

package/src/services/persona-sign-in.ts

@@ -1,4 +1,5 @@
 import { deriveActorSecret } from './persona-actor-secret.js'
+import { PikkuError } from '../errors/error-handler.js'
 import type { ResolvedPersona } from './personas-service.js'
 import type { ScenarioCookieJar } from '../wirings/workflow/scenario-cookie-jar.js'
 
@@ -30,13 +31,19 @@ export interface PersonaSignIn {
   headers(): Record<string, string>
 }
 
+/**
+ * A sign-in the target refused. `PikkuError`, not `Error`, so the CLI prints
+ * this message alone: an expired token or a persona the stage has never seen is
+ * something to go and fix, and a stack trace through the fetch internals only
+ * buries the status and the body that say which one it is.
+ */
 const failed = async (
   what: string,
   personaId: string,
   res: Response
 ): Promise<Error> => {
   const body = (await res.text().catch(() => '')).slice(0, 300)
-  return new Error(
+  return new PikkuError(
     `[scenario] ${what} failed for '${personaId}' (${res.status}): ${body}`
   )
 }
@@ -101,22 +108,28 @@ export class ActorSignIn implements PersonaSignIn {
   }
 }
 
+/**
+ * The auth mount a configured sign-in path sits under, or `undefined` when it
+ * names nothing recognisable.
+ *
+ * better-auth serves sign-in, operator sign-in and `get-session` from one
+ * prefix, so an app that mounts it at `/api/auth` moves all three together and
+ * says so once through `signInPath`. Reading the other two from a hardcoded
+ * `/auth` on such an app 404s — and for `get-session` a 404 reads as "this
+ * stage does not report roles", which silently turns off the check that tells a
+ * permissions finding from seed drift.
+ */
+export const authMount = (signInPath?: string): string | undefined => {
+  const mount = signInPath ? signInPath.lastIndexOf('/sign-in/') : -1
+  return !signInPath || mount === -1 ? undefined : signInPath.slice(0, mount)
+}
+
 export interface OperatorSignInOptions {
   /**
    * The short-lived RS256 operator token, or a function that mints one. Prefer
    * the function: tokens expire, and a long run re-logs-in after a 401.
    */
   token: string | (() => string | Promise<string>)
-  /**
-   * Create the persona's user row when the target has no account for that
-   * address.
-   *
-   * Off by default, which is the whole point of the deployed path: a persona is
-   * meant to be a real account somebody provisioned, and a test run that
-   * silently writes users into a live database is a side effect nobody asked
-   * for. Turn it on for throwaway stages.
-   */
-  createMissing?: boolean
   /** Fabric operator sign-in path under apiUrl. Default `/auth/sign-in/fabric`. */
   signInPath?: string
 }
@@ -155,12 +168,7 @@ export const establishOperatorSession = async (
     headers: { 'content-type': 'application/json', ...extraHeaders },
     body: JSON.stringify({
       token,
-      actAs: {
-        email: persona.email,
-        name: persona.name,
-        create: options.createMissing ?? false,
-        ...(persona.roles[0] ? { role: persona.roles[0] } : {}),
-      },
+      actAs: { email: persona.email },
     }),
   })
   if (!res.ok) {
@@ -168,7 +176,7 @@ export const establishOperatorSession = async (
   }
   const setCookies = res.headers.getSetCookie?.() ?? []
   if (setCookies.length === 0) {
-    throw new Error(
+    throw new PikkuError(
       `[scenario] operator sign-in for '${persona.id}' returned no session cookie`
     )
   }
@@ -178,7 +186,7 @@ export const establishOperatorSession = async (
   } | null
   const userId = body?.actAs?.userId
   if (!userId) {
-    throw new Error(
+    throw new PikkuError(
       `[scenario] operator sign-in for '${persona.id}' returned no user to act as — ` +
         'the target is running a @pikku/better-auth too old to resolve one'
     )